Merge remote-tracking branch 'origin/stable' into dev

Change-Id: Ibe8c6167bf9d9b6bd689b93ed7f5b94cdbd73ba7

95 files changed, 860 insertions, 454 deletions

diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index 859f4a20d..629a4838c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -33,7 +33,7 @@ INCLUDEPATH += \
     $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR
 
 # Pick up the right version of LLIntAssembly.h
-macx:INCLUDEPATH+=$$JAVASCRIPTCORE_GENERATED_SOURCES_DIR/$$activeBuildConfig()
+macx:INCLUDEPATH+=$$JAVASCRIPTCORE_GENERATED_SOURCES_DIR/$$targetSubDir()
 
 win32-*: LIBS += -lwinmm
 
diff --git a/Source/JavaScriptCore/LLIntOffsetsExtractor.pro b/Source/JavaScriptCore/LLIntOffsetsExtractor.pro
index 97b3529b7..d119bbf08 100644
--- a/Source/JavaScriptCore/LLIntOffsetsExtractor.pro
+++ b/Source/JavaScriptCore/LLIntOffsetsExtractor.pro
@@ -58,9 +58,9 @@ llint.CONFIG += no_link
 QMAKE_EXTRA_COMPILERS += llint
 
 macx {
-    DESTDIR = $$activeBuildConfig()
-    llint.output = $$activeBuildConfig()/$$llint.output
-    INCLUDEPATH += $$activeBuildConfig()
+    DESTDIR = $$targetSubDir()
+    llint.output = $$targetSubDir()/$$llint.output
+    INCLUDEPATH += $$targetSubDir()
 }
 
 # Compilation of this file will automatically depend on LLIntDesiredOffsets.h
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index e1da901c1..0f2659ec9 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -30,7 +30,7 @@ include(yarr/yarr.pri)
 
 INSTALLDEPS += all
 
-debug_and_release: INCLUDEPATH += $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR/$$activeBuildConfig()
+debug_and_release: INCLUDEPATH += $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR/$$targetSubDir()
 
 SOURCES += \
     API/JSBase.cpp \
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index b02e0112c..35c553cf8 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -621,26 +621,27 @@ public:
                 continue;
             for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
                 NodeIndex nodeIndex = block->at(indexInBlock);
-                Node& node = m_graph[nodeIndex];
-                if (node.op() != CreateArguments)
+                Node* nodePtr = &m_graph[nodeIndex];
+                if (nodePtr->op() != CreateArguments)
                     continue;
                 // If this is a CreateArguments for an InlineCallFrame* that does
                 // not create arguments, then replace it with a PhantomArguments.
                 // PhantomArguments is a non-executing node that just indicates
                 // that the node should be reified as an arguments object on OSR
                 // exit.
-                if (m_createsArguments.contains(node.codeOrigin.inlineCallFrame))
+                if (m_createsArguments.contains(nodePtr->codeOrigin.inlineCallFrame))
                     continue;
-                if (node.shouldGenerate()) {
-                    Node phantom(Phantom, node.codeOrigin);
-                    phantom.children = node.children;
+                if (nodePtr->shouldGenerate()) {
+                    Node phantom(Phantom, nodePtr->codeOrigin);
+                    phantom.children = nodePtr->children;
                     phantom.ref();
                     NodeIndex phantomNodeIndex = m_graph.size();
                     m_graph.append(phantom);
                     insertionSet.append(indexInBlock, phantomNodeIndex);
+                    nodePtr = &m_graph[nodeIndex];
                 }
-                node.setOpAndDefaultFlags(PhantomArguments);
-                node.children.reset();
+                nodePtr->setOpAndDefaultFlags(PhantomArguments);
+                nodePtr->children.reset();
                 changed = true;
             }
             insertionSet.execute(*block);
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 1ba40def3..b98d824f5 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -317,8 +317,8 @@ private:
                 && node.canSpeculateInteger()) {
                 if (isX86())
                     break;
-                fixDoubleEdge(0);
-                fixDoubleEdge(1);
+                injectInt32ToDoubleNode(0);
+                injectInt32ToDoubleNode(1);
                 
                 Node& oldDivision = m_graph[m_compileIndex];
                 
@@ -540,11 +540,19 @@ private:
         Node& source = m_graph[m_compileIndex];
         Edge& edge = m_graph.child(source, childIndex);
         
-        if (!m_graph[edge].shouldSpeculateInteger()) {
+        if (m_graph[edge].prediction() & SpecDouble) {
             edge.setUseKind(DoubleUse);
             return;
         }
         
+        injectInt32ToDoubleNode(childIndex);
+    }
+
+    void injectInt32ToDoubleNode(unsigned childIndex)
+    {
+        Node& source = m_graph[m_compileIndex];
+        Edge& edge = m_graph.child(source, childIndex);
+        
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
index 9a7e7df70..bba3a5b43 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
@@ -1214,12 +1214,12 @@ void dfgLinkClosureCall(ExecState* exec, CallLinkInfo& callLinkInfo, CodeBlock*
     JITCompiler::Jump done = stubJit.jump();
     
     slowPath.link(&stubJit);
-    stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation.executableAddress()), GPRInfo::nonArgGPR2);
-    stubJit.restoreReturnAddressBeforeReturn(GPRInfo::nonArgGPR2);
     stubJit.move(calleeGPR, GPRInfo::nonArgGPR0);
 #if USE(JSVALUE32_64)
     stubJit.move(CCallHelpers::TrustedImm32(JSValue::CellTag), GPRInfo::nonArgGPR1);
 #endif
+    stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation.executableAddress()), GPRInfo::nonArgGPR2);
+    stubJit.restoreReturnAddressBeforeReturn(GPRInfo::nonArgGPR2);
     JITCompiler::Jump slow = stubJit.jump();
     
     LinkBuffer patchBuffer(*globalData, &stubJit, callerCodeBlock);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index d7f7b2fab..4f2889b8f 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -2250,8 +2250,7 @@ void SpeculativeJIT::compileInt32ToDouble(Node& node)
     // than a int->double conversion. On 32_64, unfortunately, we currently don't have
     // any such mechanism - though we could have it, if we just provisioned some memory
     // in CodeBlock for the double form of integer constants.
-    if (at(node.child1()).hasConstant()) {
-        ASSERT(isInt32Constant(node.child1().index()));
+    if (isInt32Constant(node.child1().index())) {
         FPRTemporary result(this);
         GPRTemporary temp(this);
         m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(valueOfNumberConstant(node.child1().index()))), temp.gpr());
@@ -3097,11 +3096,11 @@ void SpeculativeJIT::compileIntegerArithDivForX86(Node& node)
         speculationCheck(Overflow, JSValueRegs(), NoNode, m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1)));
     } else {
         JITCompiler::Jump zero = m_jit.branchTest32(JITCompiler::Zero, op2GPR);
-        JITCompiler::Jump notNeg2ToThe31 = m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1));
+        JITCompiler::Jump isNeg2ToThe31 = m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1));
         zero.link(&m_jit);
         m_jit.move(TrustedImm32(0), eax.gpr());
+        isNeg2ToThe31.link(&m_jit);
         done = m_jit.jump();
-        notNeg2ToThe31.link(&m_jit);
     }
     
     safeDenominator.link(&m_jit);
diff --git a/Source/JavaScriptCore/heap/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
index 755a0ad50..39907c715 100644
--- a/Source/JavaScriptCore/heap/MarkStack.cpp
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -31,7 +31,6 @@
 #include "CopiedSpace.h"
 #include "CopiedSpaceInlines.h"
 #include "Heap.h"
-#include "Options.h"
 #include "JSArray.h"
 #include "JSCell.h"
 #include "JSObject.h"
@@ -45,13 +44,13 @@
 
 namespace JSC {
 
+COMPILE_ASSERT(MarkStackSegment::blockSize == WeakBlock::blockSize, blockSizeMatch);
+
 MarkStackArray::MarkStackArray(BlockAllocator& blockAllocator)
     : m_blockAllocator(blockAllocator)
-    , m_segmentCapacity(MarkStackSegment::capacityFromSize(Options::gcMarkStackSegmentSize()))
     , m_top(0)
     , m_numberOfSegments(0)
 {
-    ASSERT(MarkStackSegment::blockSize == WeakBlock::blockSize);
     m_segments.push(MarkStackSegment::create(m_blockAllocator.allocate<MarkStackSegment>()));
     m_numberOfSegments++;
 }
@@ -64,7 +63,7 @@ MarkStackArray::~MarkStackArray()
 
 void MarkStackArray::expand()
 {
-    ASSERT(m_segments.head()->m_top == m_segmentCapacity);
+    ASSERT(m_segments.head()->m_top == s_segmentCapacity);
     
     MarkStackSegment* nextSegment = MarkStackSegment::create(m_blockAllocator.allocate<MarkStackSegment>());
     m_numberOfSegments++;
@@ -97,8 +96,6 @@ void MarkStackArray::donateSomeCellsTo(MarkStackArray& other)
     // we prefer donating whole segments over donating individual cells,
     // even if this skews away from our 1 / 2 target.
 
-    ASSERT(m_segmentCapacity == other.m_segmentCapacity);
-
     size_t segmentsToDonate = m_numberOfSegments / 2; // If we only have one segment (our head) we don't donate any segments.
 
     if (!segmentsToDonate) {
@@ -141,7 +138,6 @@ void MarkStackArray::stealSomeCellsFrom(MarkStackArray& other, size_t idleThread
     // To reduce copying costs, we prefer stealing a whole segment over stealing
     // individual cells, even if this skews away from our 1 / N target.
 
-    ASSERT(m_segmentCapacity == other.m_segmentCapacity);
     validatePrevious();
     other.validatePrevious();
         
@@ -151,7 +147,7 @@ void MarkStackArray::stealSomeCellsFrom(MarkStackArray& other, size_t idleThread
         MarkStackSegment* otherHead = other.m_segments.removeHead();
         MarkStackSegment* myHead = m_segments.removeHead();
 
-        ASSERT(other.m_segments.head()->m_top == m_segmentCapacity);
+        ASSERT(other.m_segments.head()->m_top == s_segmentCapacity);
 
         m_segments.push(other.m_segments.removeHead());
 
diff --git a/Source/JavaScriptCore/heap/MarkStack.h b/Source/JavaScriptCore/heap/MarkStack.h
index 2a7f04450..c97b6a735 100644
--- a/Source/JavaScriptCore/heap/MarkStack.h
+++ b/Source/JavaScriptCore/heap/MarkStack.h
@@ -75,16 +75,6 @@ public:
     {
         return bitwise_cast<const JSCell**>(this + 1);
     }
-    
-    static size_t capacityFromSize(size_t size)
-    {
-        return (size - sizeof(MarkStackSegment)) / sizeof(const JSCell*);
-    }
-    
-    static size_t sizeFromCapacity(size_t capacity)
-    {
-        return sizeof(MarkStackSegment) + capacity * sizeof(const JSCell*);
-    }
 
     static const size_t blockSize = 4 * KB;
 
@@ -111,6 +101,10 @@ public:
     bool isEmpty();
 
 private:
+    template <size_t size> struct CapacityFromSize {
+        static const size_t value = (size - sizeof(MarkStackSegment)) / sizeof(const JSCell*);
+    };
+
     JS_EXPORT_PRIVATE void expand();
     
     size_t postIncTop();
@@ -124,7 +118,7 @@ private:
     DoublyLinkedList<MarkStackSegment> m_segments;
     BlockAllocator& m_blockAllocator;
 
-    size_t m_segmentCapacity;
+    JS_EXPORT_PRIVATE static const size_t s_segmentCapacity = CapacityFromSize<MarkStackSegment::blockSize>::value;
     size_t m_top;
     size_t m_numberOfSegments;
    
diff --git a/Source/JavaScriptCore/heap/MarkStackInlines.h b/Source/JavaScriptCore/heap/MarkStackInlines.h
index 1595e843e..c577de602 100644
--- a/Source/JavaScriptCore/heap/MarkStackInlines.h
+++ b/Source/JavaScriptCore/heap/MarkStackInlines.h
@@ -52,8 +52,8 @@ inline size_t MarkStackArray::preDecTop()
 
 inline void MarkStackArray::setTopForFullSegment()
 {
-    ASSERT(m_segments.head()->m_top == m_segmentCapacity);
-    m_top = m_segmentCapacity;
+    ASSERT(m_segments.head()->m_top == s_segmentCapacity);
+    m_top = s_segmentCapacity;
 }
 
 inline void MarkStackArray::setTopForEmptySegment()
@@ -82,7 +82,7 @@ inline void MarkStackArray::validatePrevious()
 
 inline void MarkStackArray::append(const JSCell* cell)
 {
-    if (m_top == m_segmentCapacity)
+    if (m_top == s_segmentCapacity)
         expand();
     m_segments.head()->data()[postIncTop()] = cell;
 }
@@ -102,7 +102,7 @@ inline bool MarkStackArray::isEmpty()
     if (m_top)
         return false;
     if (m_segments.head()->next()) {
-        ASSERT(m_segments.head()->next()->m_top == m_segmentCapacity);
+        ASSERT(m_segments.head()->next()->m_top == s_segmentCapacity);
         return false;
     }
     return true;
@@ -110,7 +110,7 @@ inline bool MarkStackArray::isEmpty()
 
 inline size_t MarkStackArray::size()
 {
-    return m_top + m_segmentCapacity * (m_numberOfSegments - 1);
+    return m_top + s_segmentCapacity * (m_numberOfSegments - 1);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/WeakSet.cpp b/Source/JavaScriptCore/heap/WeakSet.cpp
index 67b1d0613..7cedaee85 100644
--- a/Source/JavaScriptCore/heap/WeakSet.cpp
+++ b/Source/JavaScriptCore/heap/WeakSet.cpp
@@ -84,7 +84,7 @@ WeakBlock::FreeCell* WeakSet::addAllocator()
 void WeakSet::removeAllocator(WeakBlock* block)
 {
     m_blocks.remove(block);
-    WeakBlock::destroy(block);
+    heap()->blockAllocator().deallocate(WeakBlock::destroy(block));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index c0d60add1..bbbc3b1c7 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -555,7 +555,7 @@ namespace JSC {
         static const int sequenceGetByIdHotPathInstructionSpace = 36;
         static const int sequenceGetByIdHotPathConstantSpace = 4;
         // sequenceGetByIdSlowCase
-        static const int sequenceGetByIdSlowCaseInstructionSpace = 64;
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 80;
         static const int sequenceGetByIdSlowCaseConstantSpace = 4;
         // sequencePutById
         static const int sequencePutByIdInstructionSpace = 36;
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index eca0fb079..64acfeef5 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -364,7 +364,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 
 #else // USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && CPU(X86_64)
+#if COMPILER(GCC) && CPU(X86_64) && !OS(WINDOWS)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -433,6 +433,75 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
+#elif COMPILER(GCC) && CPU(X86_64) && OS(WINDOWS)
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) % 16 == 0x0, JITStackFrame_maintains_16byte_stack_alignment);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x58, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm (
+".text\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    // Dump register parameters to their home address
+    "movq %r9, 0x20(%rsp)" "\n"
+    "movq %r8, 0x18(%rsp)" "\n"
+    "movq %rdx, 0x10(%rsp)" "\n"
+    "movq %rcx, 0x8(%rsp)" "\n"
+
+    "pushq %rbp" "\n"
+    "movq %rsp, %rbp" "\n"
+    "pushq %r12" "\n"
+    "pushq %r13" "\n"
+    "pushq %r14" "\n"
+    "pushq %r15" "\n"
+    "pushq %rbx" "\n"
+
+    // Decrease rsp to point to the start of our JITStackFrame
+    "subq $0x58, %rsp" "\n"
+    "movq $512, %r12" "\n"
+    "movq $0xFFFF000000000000, %r14" "\n"
+    "movq $0xFFFF000000000002, %r15" "\n"
+    "movq %r8, %r13" "\n"
+    "call *%rcx" "\n"
+    "addq $0x58, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+".globl " SYMBOL_STRING(ctiTrampolineEnd) "\n"
+HIDE_SYMBOL(ctiTrampolineEnd) "\n"
+SYMBOL_STRING(ctiTrampolineEnd) ":" "\n"
+);
+
+asm (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "movq %rsp, %rcx" "\n"
+    "call " LOCAL_REFERENCE(cti_vm_throw) "\n"
+    "int3" "\n"
+);
+
+asm (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addq $0x58, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
 #elif COMPILER(MSVC) && CPU(X86_64)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 746e281e3..ff4c2ff76 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -522,7 +522,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, JSScope* s
     UNUSED_PARAM(bytecodeIndex);
 #endif
     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForCall);
-    JSObject* exception;
+    JSObject* exception = 0;
     OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, CodeForCall, exception);
     if (!newCodeBlock)
         return exception;
@@ -558,7 +558,7 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, JSSco
 #endif
     
     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForConstruct);
-    JSObject* exception;
+    JSObject* exception = 0;
     OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, CodeForConstruct, exception);
     if (!newCodeBlock)
         return exception;
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 4ba5cc2bd..c742804f7 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -1347,7 +1347,7 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
     
     // Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
     for (; numDefined < usedVectorLength; ++numDefined) {
-        if (numDefined > m_butterfly->vectorLength())
+        if (numDefined >= m_butterfly->vectorLength())
             break;
         JSValue v = getHolyIndexQuickly(numDefined);
         if (!v || v.isUndefined())
@@ -1356,7 +1356,7 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
         tree.insert(numDefined);
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        if (i > m_butterfly->vectorLength())
+        if (i >= m_butterfly->vectorLength())
             break;
         JSValue v = getHolyIndexQuickly(i);
         if (v) {
@@ -1384,6 +1384,7 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
     iter.start_iter_least(tree);
     JSGlobalData& globalData = exec->globalData();
     for (unsigned i = 0; i < elementsToExtractThreshold; ++i) {
+        ASSERT(i < butterfly()->vectorLength());
         if (structure()->indexingType() == ArrayWithDouble)
             butterfly()->contiguousDouble()[i] = tree.abstractor().m_nodes[*iter].value.asNumber();
         else
@@ -1398,12 +1399,15 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
         break;
         
     default:
-        for (unsigned i = elementsToExtractThreshold; i < undefinedElementsThreshold; ++i)
+        for (unsigned i = elementsToExtractThreshold; i < undefinedElementsThreshold; ++i) {
+            ASSERT(i < butterfly()->vectorLength());
             currentIndexingData()[i].setUndefined();
+        }
     }
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = undefinedElementsThreshold; i < clearElementsThreshold; ++i) {
+        ASSERT(i < butterfly()->vectorLength());
         if (structure()->indexingType() == ArrayWithDouble)
             butterfly()->contiguousDouble()[i] = QNaN;
         else
@@ -1533,6 +1537,7 @@ void JSArray::copyToArguments(ExecState* exec, CallFrame* callFrame, uint32_t le
         vector = 0;
         vectorEnd = 0;
         for (; i < m_butterfly->publicLength(); ++i) {
+            ASSERT(i < butterfly()->vectorLength());
             double v = m_butterfly->contiguousDouble()[i];
             if (v != v)
                 break;
@@ -1578,6 +1583,7 @@ void JSArray::compactForSorting(unsigned& numDefined, unsigned& newRelevantLengt
     unsigned numUndefined = 0;
         
     for (; numDefined < myRelevantLength; ++numDefined) {
+        ASSERT(numDefined < m_butterfly->vectorLength());
         if (indexingType == ArrayWithInt32) {
             JSValue v = m_butterfly->contiguousInt32()[numDefined].get();
             if (!v)
@@ -1597,11 +1603,13 @@ void JSArray::compactForSorting(unsigned& numDefined, unsigned& newRelevantLengt
     }
         
     for (unsigned i = numDefined; i < myRelevantLength; ++i) {
+        ASSERT(i < m_butterfly->vectorLength());
         if (indexingType == ArrayWithInt32) {
             JSValue v = m_butterfly->contiguousInt32()[i].get();
             if (!v)
                 continue;
             ASSERT(v.isInt32());
+            ASSERT(numDefined < m_butterfly->vectorLength());
             m_butterfly->contiguousInt32()[numDefined++].setWithoutWriteBarrier(v);
             continue;
         }
@@ -1609,6 +1617,7 @@ void JSArray::compactForSorting(unsigned& numDefined, unsigned& newRelevantLengt
             double v = m_butterfly->contiguousDouble()[i];
             if (v != v)
                 continue;
+            ASSERT(numDefined < m_butterfly->vectorLength());
             m_butterfly->contiguousDouble()[numDefined++] = v;
             continue;
         }
@@ -1616,8 +1625,10 @@ void JSArray::compactForSorting(unsigned& numDefined, unsigned& newRelevantLengt
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
-            else
+            else {
+                ASSERT(numDefined < m_butterfly->vectorLength());
                 indexingData<indexingType>()[numDefined++].setWithoutWriteBarrier(v);
+            }
         }
     }
         
@@ -1633,11 +1644,14 @@ void JSArray::compactForSorting(unsigned& numDefined, unsigned& newRelevantLengt
         break;
         
     default:
-        for (unsigned i = numDefined; i < newRelevantLength; ++i)
+        for (unsigned i = numDefined; i < newRelevantLength; ++i) {
+            ASSERT(i < m_butterfly->vectorLength());
             indexingData<indexingType>()[i].setUndefined();
+        }
         break;
     }
     for (unsigned i = newRelevantLength; i < myRelevantLength; ++i) {
+        ASSERT(i < m_butterfly->vectorLength());
         if (indexingType == ArrayWithDouble)
             m_butterfly->contiguousDouble()[i] = QNaN;
         else
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index ea1ed9047..cef3b53ad 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -245,6 +245,10 @@ inline JSArray* JSArray::tryCreateUninitialized(JSGlobalData& globalData, Struct
         butterfly = Butterfly::fromBase(temp, 0, 0);
         butterfly->setVectorLength(vectorLength);
         butterfly->setPublicLength(initialLength);
+        if (hasDouble(structure->indexingType())) {
+            for (unsigned i = initialLength; i < vectorLength; ++i)
+                butterfly->contiguousDouble()[i] = QNaN;
+        }
     } else {
         void* temp;
         if (!globalData.heap.tryAllocateStorage(Butterfly::totalSize(0, 0, true, ArrayStorage::sizeFor(vectorLength)), &temp))
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 957ba8227..428e51f3c 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -862,6 +862,7 @@ protected:
         
     JSValue getHolyIndexQuickly(unsigned i)
     {
+        ASSERT(i < m_butterfly->vectorLength());
         switch (structure()->indexingType()) {
         case ALL_INT32_INDEXING_TYPES:
         case ALL_CONTIGUOUS_INDEXING_TYPES:
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index 5ad30bde3..bf4a0cf75 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -117,7 +117,6 @@ namespace JSC {
     v(double, structureCheckVoteRatioForHoisting, 1) \
     \
     v(unsigned, minimumNumberOfScansBetweenRebalance, 100) \
-    v(unsigned, gcMarkStackSegmentSize, pageSize()) \
     v(unsigned, numberOfGCMarkers, computeNumberOfGCMarkers(7)) \
     v(unsigned, opaqueRootMergeThreshold, 1000) \
     v(double, minHeapUtilization, 0.8) \
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index d5b215413..1aef49bdf 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -756,7 +756,11 @@ class YarrGenerator : private MacroAssembler {
         const RegisterID character = regT0;
         int maxCharactersAtOnce = m_charSize == Char8 ? 4 : 2;
         unsigned ignoreCaseMask = 0;
+#if CPU(BIG_ENDIAN)
+        int allCharacters = ch << (m_charSize == Char8 ? 24 : 16);
+#else
         int allCharacters = ch;
+#endif
         int numberCharacters;
         int startTermPosition = term->inputPosition;
 
@@ -765,7 +769,11 @@ class YarrGenerator : private MacroAssembler {
         ASSERT(!m_pattern.m_ignoreCase || isASCIIAlpha(ch) || isCanonicallyUnique(ch));
 
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch))
+#if CPU(BIG_ENDIAN)
+            ignoreCaseMask |= 32 << (m_charSize == Char8 ? 24 : 16);
+#else
             ignoreCaseMask |= 32;
+#endif
 
         for (numberCharacters = 1; numberCharacters < maxCharactersAtOnce && nextOp->m_op == OpTerm; ++numberCharacters, nextOp = &m_ops[opIndex + numberCharacters]) {
             PatternTerm* nextTerm = nextOp->m_term;
@@ -778,7 +786,11 @@ class YarrGenerator : private MacroAssembler {
 
             nextOp->m_isDeadCode = true;
 
+#if CPU(BIG_ENDIAN)
+            int shiftAmount = (m_charSize == Char8 ? 24 : 16) - ((m_charSize == Char8 ? 8 : 16) * numberCharacters);
+#else
             int shiftAmount = (m_charSize == Char8 ? 8 : 16) * numberCharacters;
+#endif
 
             UChar currentCharacter = nextTerm->patternCharacter;
 
diff --git a/Source/ThirdParty/ANGLE/ANGLE.pri b/Source/ThirdParty/ANGLE/ANGLE.pri
index 2f7b700e9..ae6692d77 100644
--- a/Source/ThirdParty/ANGLE/ANGLE.pri
+++ b/Source/ThirdParty/ANGLE/ANGLE.pri
@@ -7,6 +7,8 @@
 
 SOURCE_DIR = $${ROOT_WEBKIT_DIR}/Source/ThirdParty/ANGLE
 
+*clang: QT_CONFIG -= c++11
+
 INCLUDEPATH += \
     $$SOURCE_DIR/include/GLSLANG
 
diff --git a/Source/WTF/wtf/Compiler.h b/Source/WTF/wtf/Compiler.h
index a9ef419c1..293e86b8b 100644
--- a/Source/WTF/wtf/Compiler.h
+++ b/Source/WTF/wtf/Compiler.h
@@ -122,6 +122,9 @@
 
 /* Specific compiler features */
 #if COMPILER(GCC) && !COMPILER(CLANG)
+#if GCC_VERSION_AT_LEAST(4, 8, 0)
+#pragma GCC diagnostic ignored "-Wunused-local-typedefs"
+#endif
 #if GCC_VERSION_AT_LEAST(4, 7, 0) && defined(__cplusplus) && __cplusplus >= 201103L
 #define WTF_COMPILER_SUPPORTS_CXX_RVALUE_REFERENCES 1
 #define WTF_COMPILER_SUPPORTS_CXX_DELETED_FUNCTIONS 1
diff --git a/Source/WTF/wtf/HashMap.h b/Source/WTF/wtf/HashMap.h
index 10ee425da..254554458 100644
--- a/Source/WTF/wtf/HashMap.h
+++ b/Source/WTF/wtf/HashMap.h
@@ -134,29 +134,35 @@ namespace WTF {
     private:
         AddResult inlineAdd(const KeyType&, MappedPassInReferenceType);
 
-        class HashMapKeysProxy : private HashMap {
+        HashTableType m_impl;
+    };
+
+    template<typename KeyArg, typename MappedArg, typename HashArg, typename KeyTraitsArg, typename MappedTraitsArg>
+    class HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg>::HashMapKeysProxy :
+        private HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> {
         public:
-            typedef typename HashMap::iterator::Keys iterator;
-            typedef typename HashMap::const_iterator::Keys const_iterator;
-            
+            typedef HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> HashMapType;
+            typedef typename HashMapType::iterator::Keys iterator;
+            typedef typename HashMapType::const_iterator::Keys const_iterator;
+
             iterator begin()
             {
-                return HashMap::begin().keys();
+                return HashMapType::begin().keys();
             }
-            
+
             iterator end()
             {
-                return HashMap::end().keys();
+                return HashMapType::end().keys();
             }
 
             const_iterator begin() const
             {
-                return HashMap::begin().keys();
+                return HashMapType::begin().keys();
             }
-            
+
             const_iterator end() const
             {
-                return HashMap::end().keys();
+                return HashMapType::end().keys();
             }
 
         private:
@@ -167,31 +173,34 @@ namespace WTF {
             HashMapKeysProxy(const HashMapKeysProxy&);
             HashMapKeysProxy& operator=(const HashMapKeysProxy&);
             ~HashMapKeysProxy();
-        };
+    };
 
-        class HashMapValuesProxy : private HashMap {
+    template<typename KeyArg, typename MappedArg, typename HashArg,  typename KeyTraitsArg, typename MappedTraitsArg>
+    class HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg>::HashMapValuesProxy :
+        private HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> {
         public:
-            typedef typename HashMap::iterator::Values iterator;
-            typedef typename HashMap::const_iterator::Values const_iterator;
-            
+            typedef HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> HashMapType;
+            typedef typename HashMapType::iterator::Values iterator;
+            typedef typename HashMapType::const_iterator::Values const_iterator;
+
             iterator begin()
             {
-                return HashMap::begin().values();
+                return HashMapType::begin().values();
             }
-            
+
             iterator end()
             {
-                return HashMap::end().values();
+                return HashMapType::end().values();
             }
 
             const_iterator begin() const
             {
-                return HashMap::begin().values();
+                return HashMapType::begin().values();
             }
-            
+
             const_iterator end() const
             {
-                return HashMap::end().values();
+                return HashMapType::end().values();
             }
 
         private:
@@ -202,9 +211,6 @@ namespace WTF {
             HashMapValuesProxy(const HashMapValuesProxy&);
             HashMapValuesProxy& operator=(const HashMapValuesProxy&);
             ~HashMapValuesProxy();
-        };
-
-        HashTableType m_impl;
     };
 
     template<typename KeyTraits, typename MappedTraits> struct HashMapValueTraits : KeyValuePairHashTraits<KeyTraits, MappedTraits> {
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index e08750c67..156d9c468 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,102 @@
+2013-01-08  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Build failures when building with python 3.3
+        https://bugs.webkit.org/show_bug.cgi?id=106194
+
+        Reviewed by Dirk Pranke.
+
+        Python 3.3 introduced changes to dictionaries which can result in changed
+        iteration order. More about these changes:
+        http://docs.python.org/3.3/whatsnew/3.3.html#pep-412-key-sharing-dictionary
+        http://www.python.org/dev/peps/pep-0412/#cons
+
+        This causes the Source/WebCore/inspector/generate-inspector-protocol-version
+        script to fail the self-testing when using Python 3.3. These changes work
+        around this problem by not checking for expected errors in order but rather
+        for their presence in the error output sequence. The number of actual errors
+        is also checked to be equal to the number of expected errors.
+
+        No new tests - no new functionality.
+
+        * inspector/generate-inspector-protocol-version:
+        (self_test):
+
+2013-03-12  Floris Bos  <bos@je-eigen-domein.nl>
+
+        [Qt] WebKit fails to compile if EGL headers are not in default INCLUDEPATH
+        https://bugs.webkit.org/show_bug.cgi?id=111859
+
+        Reviewed by Jocelyn Turcotte.
+
+        The 3D graphics code wants to include EGL header files.
+        But on some platforms such as the Raspberry Pi those are not in /usr/include
+        but in another folder.
+        Fix adds "egl" to CONFIG when OpenGL ES2 is used, so the right include
+        paths are added.
+
+        * WebCore.pri:
+
+2013-01-29  Michael Brüning  <michael.bruning@digia.com>
+
+        [Qt][WK1] Reflect recursion limit and loop checks also for list conversions.
+        https://bugs.webkit.org/show_bug.cgi?id=107950
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        No new tests, bugfix, no behavioral change.
+
+        Make conversions from Javascript values to QLists take the maximum
+        recursion depth into consideration and check for objects that were
+        already visited. Otherwise, the conversion may recurse until the
+        stack is full and then cause a segmentation fault.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertToList):
+        (JSC::Bindings::convertValueToQVariant):
+
+2013-04-03  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Fail gracefully if an OpenGL context could not be created.
+        https://bugs.webkit.org/show_bug.cgi?id=113784
+
+        In case we fail to create or adopt a valid platform OpenGL context
+        we do not want to provide a GraphicsContext3D instance.
+        Otherwise we would crash as soon as the instance is being used.
+
+        Reviewed by Jocelyn Turcotte.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2013-04-03  Tor Arne Vestbø  <tor.arne.vestbo@digia.com>
+
+        [Qt] Update QMAKE_MAC_SDK check for Qt 5.1
+
+        Relies on QMAKE_MAC_SDK_VERSION set in features.prf
+
+        Reviewed by Simon Hausmann.
+
+        * WebCore.pri:
+
+2012-12-10  Michael Brüning  <michael.bruning@digia.com>
+
+        [Qt] Builds for Mac are tied to the OS system instead of the SDK version.
+        https://bugs.webkit.org/show_bug.cgi?id=104529
+
+        Reviewed by Simon Hausmann.
+
+        Using work by Eike Ziller <eike.ziller@digia.com>.
+
+        The build system now first tries to assign the correct system libraries
+        for the SDK being used for Mac builds. If this does not yield any
+        result, it falls back to using the Mac OS version to determine the
+        correct library.
+
+        No new tests (not applicable).
+
+        * WebCore.pri:
+
 2013-02-21  Levi Weintraub  <leviw@chromium.org>
 
         ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 1f41c8583..16915a4e0 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -4043,6 +4043,11 @@ use?(WEBP) {
     SOURCES += platform/image-decoders/webp/WEBPImageDecoder.cpp
 }
 
+use?(ZLIB) {
+    HEADERS += platform/graphics/WOFFFileFormat.h
+    SOURCES += platform/graphics/WOFFFileFormat.cpp
+}
+
 !have?(sqlite3):exists($${SQLITE3SRCDIR}/sqlite3.c) {
     # Build sqlite3 into WebCore from source
     # somewhat copied from $$QT_SOURCE_TREE/src/plugins/sqldrivers/sqlite/sqlite.pro
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index fc504427c..b7cd93adf 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -185,18 +185,32 @@ enable?(VIDEO) {
                 -framework QuartzCore -framework QTKit \
                 -framework Security -framework IOKit
 
-        # We can know the Mac OS version by using the Darwin major version
         DARWIN_VERSION = $$split(QMAKE_HOST.version, ".")
         DARWIN_MAJOR_VERSION = $$first(DARWIN_VERSION)
-        equals(DARWIN_MAJOR_VERSION, "12") {
-            LIBS += $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
-        } else:equals(DARWIN_MAJOR_VERSION, "11") {
-            LIBS += $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceLion.a
-        } else:equals(DARWIN_MAJOR_VERSION, "10") {
-            LIBS += $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
-        } else:equals(DARWIN_MAJOR_VERSION, "9") {
-            LIBS += $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+
+        haveQt(5,1) {
+            equals(QMAKE_MAC_SDK_VERSION, 10.7): \
+                SYSTEM_LIBRARY_PATH = $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceLion.a
+            else:equals(QMAKE_MAC_SDK_VERSION, 10.8): \
+                SYSTEM_LIBRARY_PATH = $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
+        } else {
+            # We first check if a specific SDK is set to be used for the build.
+            contains(QMAKE_MAC_SDK, ".*MacOSX10.7.sdk.*") {
+                SYSTEM_LIBRARY_PATH = $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceLion.a
+            } else:contains(QMAKE_MAC_SDK, ".*MacOSX10.8.sdk.*") {
+                SYSTEM_LIBRARY_PATH = $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
+            }
+
+            # If the previous check did not yield a result, we resort to the Darwin version.
+            isEmpty(SYSTEM_LIBRARY_PATH) {
+                equals(DARWIN_MAJOR_VERSION, "11") {
+                    SYSTEM_LIBRARY_PATH = $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceLion.a
+                } else:equals(DARWIN_MAJOR_VERSION, "12") {
+                    SYSTEM_LIBRARY_PATH = $${ROOT_WEBKIT_DIR}/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
+                }
+            }
         }
+        LIBS += $$SYSTEM_LIBRARY_PATH
     } else:use?(GSTREAMER) {
         INCLUDEPATH += $$SOURCE_DIR/platform/graphics/gstreamer
     } else:use?(QT_MULTIMEDIA) {
@@ -231,7 +245,7 @@ use?(3D_GRAPHICS) {
             }
         }
     } else {
-        contains(QT_CONFIG, opengles2): LIBS += -lEGL
+        contains(QT_CONFIG, opengles2): CONFIG += egl
     }
 }
 
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index a605e638f..370ddf627 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -82,6 +82,7 @@ ScriptController::~ScriptController()
     disconnectPlatformScriptObjects();
 
     if (m_cacheableBindingRootObject) {
+        JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         m_cacheableBindingRootObject->invalidate();
         m_cacheableBindingRootObject = 0;
     }
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index 2bc5c2cac..f50465979 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -253,7 +253,7 @@ JSClassRef QtPixmapRuntime::getClassRef()
     };
 
     static const JSStaticFunction staticFunctions[] = {
-        { "assignTo", assignToHTMLImageElement, 0 },
+        { "assignToHTMLImageElement", assignToHTMLImageElement, 0 },
         { "toDataUrl", pixmapToDataUrl, 0 },
         { "toImageData", pixmapToImageData, 0 },
         { "toString", pixmapToString, 0 }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 131239533..bb63d6695 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -21,6 +21,7 @@
 #include "qt_runtime.h"
 
 #include "APICast.h"
+#include "APIShims.h"
 #include "BooleanObject.h"
 #include "DateInstance.h"
 #include "DatePrototype.h"
@@ -199,8 +200,9 @@ static QString toString(JSStringRef stringRef)
 
 static JSValueRef unwrapBoxedPrimitive(JSContextRef context, JSValueRef value, JSObjectRef obj)
 {
-    JSObject* object = toJS(obj);
     ExecState* exec = toJS(context);
+    APIEntryShim entryShim(exec);
+    JSObject* object = toJS(obj);
     if (object->inherits(&NumberObject::s_info))
         return toRef(exec, jsNumber(object->toNumber(exec)));
     if (object->inherits(&StringObject::s_info))
@@ -236,7 +238,7 @@ static QVariantMap convertValueToQVariantMap(JSContextRef context, JSObjectRef o
 
 template <typename ItemType>
 QList<ItemType> convertToList(JSContextRef context, JSRealType type, JSObjectRef object,
-                              JSValueRef value, int* distance, JSValueRef* exception,
+                              JSValueRef value, int* distance, HashSet<JSObjectRef>* visitedObjects, int recursionLimit, JSValueRef* exception,
                               const QMetaType::Type typeId = static_cast<QMetaType::Type>(qMetaTypeId<ItemType>()))
 {
     QList<ItemType> list;
@@ -248,7 +250,7 @@ QList<ItemType> convertToList(JSContextRef context, JSRealType type, JSObjectRef
         for (size_t i = 0; i < length; ++i) {
             JSValueRef value = JSObjectGetPropertyAtIndex(context, object, i, exception);
             int itemDistance = -1;
-            QVariant variant = convertValueToQVariant(context, value, typeId, &itemDistance, exception);
+            QVariant variant = convertValueToQVariant(context, value, typeId, &itemDistance, visitedObjects, recursionLimit, exception);
             if (itemDistance >= 0)
                 list << variant.value<ItemType>();
             else
@@ -260,7 +262,7 @@ QList<ItemType> convertToList(JSContextRef context, JSRealType type, JSObjectRef
             *distance = 5;
     } else {
         int itemDistance = -1;
-        QVariant variant = convertValueToQVariant(context, value, typeId, &itemDistance, exception);
+        QVariant variant = convertValueToQVariant(context, value, typeId, &itemDistance, visitedObjects, recursionLimit, exception);
         if (itemDistance >= 0) {
             list << variant.value<ItemType>();
             if (distance)
@@ -281,6 +283,7 @@ static QString toQString(JSContextRef context, JSValueRef value)
 static void getGregorianDateTimeUTC(JSContextRef context, JSRealType type, JSValueRef value, JSObjectRef object, JSValueRef* exception, GregorianDateTime* gdt)
 {
     ExecState* exec = toJS(context);
+    APIEntryShim entryShim(exec);
     if (type == Date) {
         JSObject* jsObject = toJS(object);
         DateInstance* date = asDateInstance(jsObject);
@@ -481,11 +484,11 @@ QVariant convertValueToQVariant(JSContextRef context, JSValueRef value, QMetaTyp
             break;
 
         case QMetaType::QVariantList:
-            ret = QVariant(convertToList<QVariant>(context, type, object, value, &dist, exception, QMetaType::Void));
+            ret = QVariant(convertToList<QVariant>(context, type, object, value, &dist, visitedObjects, recursionLimit, exception, QMetaType::Void));
             break;
 
         case QMetaType::QStringList: {
-            ret = QVariant(convertToList<QString>(context, type, object, value, &dist, exception));
+            ret = QVariant(convertToList<QString>(context, type, object, value, &dist, visitedObjects, recursionLimit, exception));
             break;
         }
 
@@ -616,11 +619,11 @@ QVariant convertValueToQVariant(JSContextRef context, JSValueRef value, QMetaTyp
         default:
             // Non const type ids
             if (hint == (QMetaType::Type) qMetaTypeId<QObjectList>()) {
-                ret = QVariant::fromValue(convertToList<QObject*>(context, type, object, value, &dist, exception));
+                ret = QVariant::fromValue(convertToList<QObject*>(context, type, object, value, &dist, visitedObjects, recursionLimit, exception));
                 break;
             }
             if (hint == (QMetaType::Type) qMetaTypeId<QList<int> >()) {
-                ret = QVariant::fromValue(convertToList<int>(context, type, object, value, &dist, exception));
+                ret = QVariant::fromValue(convertToList<int>(context, type, object, value, &dist, visitedObjects, recursionLimit, exception));
                 break;
             }
             if (QtPixmapRuntime::canHandle(static_cast<QMetaType::Type>(hint))) {
@@ -729,6 +732,7 @@ JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r
         WTF::RefPtr<WTF::Uint8ClampedArray> wtfByteArray = WTF::Uint8ClampedArray::createUninitialized(qtByteArray.length());
         memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         return toRef(exec, toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get()));
     }
 
@@ -737,6 +741,7 @@ JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r
         if (!obj)
             return JSValueMakeNull(context);
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         return toRef(exec, QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec));
     }
 
@@ -751,6 +756,7 @@ JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r
         if (!document)
             return JSValueMakeUndefined(context);
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         return toRef(exec, customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant));
     }
 
@@ -800,6 +806,7 @@ JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r
         QObjectList ol = variant.value<QObjectList>();
         JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         for (int i = 0; i < ol.count(); ++i) {
             JSValueRef jsObject = toRef(exec, QtInstance::getQtInstance(ol.at(i), root, QtInstance::QtOwnership)->createRuntimeObject(exec));
             JSObjectSetPropertyAtIndex(context, array, i, jsObject, /*ignored exception*/0);
diff --git a/Source/WebCore/css/mediaControlsQt.css b/Source/WebCore/css/mediaControlsQt.css
index 64e0ec524..5cfa3c7b7 100644
--- a/Source/WebCore/css/mediaControlsQt.css
+++ b/Source/WebCore/css/mediaControlsQt.css
@@ -1,8 +1,9 @@
 /*
  * QtWebKit specific overrides for HTML5 media elements.
  *
- * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009, 2011 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2013 Digia Plc. and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,63 +33,27 @@ audio {
     width: 400px;
 }
 
-audio::-webkit-media-controls-panel {
-    display: -webkit-box;
-    -webkit-box-orient: horizontal;
-    -webkit-box-align: end;
-    -webkit-user-select: none;
-    position: absolute;
-    bottom: 0;
-    width: 100%;
-    z-index: 0;
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     overflow: visible;
-    height: 100%;
-    text-align: right;
-}
-
-video::-webkit-media-controls-panel {
-    display: -webkit-box;
-    -webkit-box-orient: horizontal;
-    -webkit-box-align: end;
-    -webkit-user-select: none;
-    position: absolute;
-    bottom: 0;
-    width: 100%;
-    z-index: 0;
-    overflow: hidden;
-    height: 100%;
-    text-align: right;
-}
-
-video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: 0px;
-}
-
-audio::-webkit-media-controls-mute-button {
-    width: 12px;
-    height: 12px;
-    padding: 6px;
-    margin: 5px 5px 5px 3px;
-    border: none !important;
+    height: 34px;
+    max-width: 800px;
+    margin-left: auto;
+    margin-right: auto;
 }
 
-video::-webkit-media-controls-mute-button {
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     width: 12px;
     height: 12px;
     padding: 6px;
-    margin: 5px 5px 5px 3px;
+    margin-left: 6px;
+    margin-right: 3px;
     border: none !important;
-}
 
-audio::-webkit-media-controls-play-button {
-    width: 9px;
-    height: 12px;
-    padding: 6px 12px 6px 11px;
-    margin: 5px 3px 5px 5px;
-    border: none !important;
+    position: relative;
+    z-index: 1;
 }
 
-video::-webkit-media-controls-play-button {
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
@@ -96,15 +61,11 @@ video::-webkit-media-controls-play-button {
     border: none !important;
 }
 
-audio::-webkit-media-controls-timeline-container {
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
     height: 34px;
 }
 
-video::-webkit-media-controls-timeline-container {
-    height: 34px;
-}
-
-audio::-webkit-media-controls-current-time-display {
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
     -webkit-appearance: media-current-time-display;
     -webkit-user-select: none;
     display: inline-block;
@@ -116,99 +77,51 @@ audio::-webkit-media-controls-current-time-display {
     cursor: default;
 
     text-align: center;
-    font-size: 10px;
     font-family: Verdana;
-    font-weight: bold;
-    color: white;
-}
-
-video::-webkit-media-controls-current-time-display {
-    -webkit-appearance: media-current-time-display;
-    -webkit-user-select: none;
-    display: inline-block;
-    height: 12px;
-    padding: 6px;
-    margin: 5px 3px;
-
-    overflow: hidden;
-    cursor: default;
-
-    text-align: center;
     font-size: 10px;
-    font-family: Verdana;
     font-weight: bold;
     color: white;
 }
 
-audio::-webkit-media-controls-time-remaining-display {
-    display: none;
-}
-
-video::-webkit-media-controls-time-remaining-display {
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
-audio::-webkit-media-controls-timeline {
-    height: 12px; /* See RenderThemeQt::adjustSliderThumbSize(). */
-    padding: 6px 8px;
-    margin: 5px 3px;
-}
-
-video::-webkit-media-controls-timeline {
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    display: -webkit-box;
+    -webkit-box-flex: 1 1;
     height: 12px; /* See RenderThemeQt::adjustSliderThumbSize(). */
     padding: 6px 8px;
-    margin: 5px 3px;
 }
 
-audio::-webkit-media-controls-volume-slider-container {
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
     -webkit-appearance: media-volume-slider-container;
     position: absolute;
-    height: 103px;
-    width: 24px;
-}
+    bottom: 29px;
+    z-index: 2;
 
-video::-webkit-media-controls-volume-slider-container {
-    -webkit-appearance: media-volume-slider-container;
-    position: absolute;
-    height: 103px;
     width: 24px;
+    height: 103px;
 }
 
-audio::-webkit-media-controls-volume-slider {
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
     -webkit-appearance: media-volume-slider;
     display: inline;
     position: absolute;
 
-    width: 12px; /* See RenderThemeQt::adjustSliderThumbSize(). */
-    padding: 6px;
-    height: 88px;
-    margin: 0 0 3px 0;
-}
-
-video::-webkit-media-controls-volume-slider {
-    -webkit-appearance: media-volume-slider;
-    display: inline;
-    position: absolute;
+    top: 0px;
+    left: 6px;
 
     width: 12px; /* See RenderThemeQt::adjustSliderThumbSize(). */
     padding: 6px;
     height: 88px;
-    margin: 0 0 3px 0;
 }
 
-audio::-webkit-media-controls-seek-back-button {
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     display: none;
 }
 
-video::-webkit-media-controls-seek-back-button {
-    display: none;
-}
-
-audio::-webkit-media-controls-seek-forward-button {
-    display: none;
-}
-
-video::-webkit-media-controls-seek-forward-button {
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     display: none;
 }
 
@@ -226,27 +139,15 @@ video::-webkit-media-controls-fullscreen-button {
     border: none !important;
 }
 
-audio::-webkit-media-controls-rewind-button {
-    display: none;
-}
-
-video::-webkit-media-controls-rewind-button {
-    display: none;
-}
-
-audio::-webkit-media-controls-return-to-realtime-button {
-    display: none;
-}
-
-video::-webkit-media-controls-return-to-realtime-button {
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
     display: none;
 }
 
-audio::-webkit-media-controls-toggle-closed-captions-button {
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
     display: none;
 }
 
-video::-webkit-media-controls-toggle-closed-captions-button {
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
     display: none;
 }
 
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index c1c2b7b5d..ec7ca673e 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -3179,7 +3179,7 @@ void Document::styleResolverChanged(StyleResolverUpdateFlag updateFlag)
     if (didLayoutWithPendingStylesheets() && !m_styleSheetCollection->hasPendingSheets()) {
         m_pendingSheetLayout = IgnoreLayoutWithPendingSheets;
         if (renderer())
-            renderer()->repaint();
+            renderView()->repaintViewAndCompositedLayers();
     }
 
     if (!stylesheetChangeRequiresStyleRecalc)
diff --git a/Source/WebCore/dom/RequestAnimationFrameCallback.h b/Source/WebCore/dom/RequestAnimationFrameCallback.h
index f1347268a..52580dc53 100644
--- a/Source/WebCore/dom/RequestAnimationFrameCallback.h
+++ b/Source/WebCore/dom/RequestAnimationFrameCallback.h
@@ -42,6 +42,7 @@ public:
 
     int m_id;
     bool m_firedOrCancelled;
+    bool m_useLegacyTimeBase;
 };
 
 }
diff --git a/Source/WebCore/dom/ScriptedAnimationController.cpp b/Source/WebCore/dom/ScriptedAnimationController.cpp
index 2f7862bdd..afa131b1a 100644
--- a/Source/WebCore/dom/ScriptedAnimationController.cpp
+++ b/Source/WebCore/dom/ScriptedAnimationController.cpp
@@ -114,6 +114,7 @@ void ScriptedAnimationController::serviceScriptedAnimations(double monotonicTime
         return;
 
     double highResNowMs = 1000.0 * m_document->loader()->timing()->monotonicTimeToZeroBasedDocumentTime(monotonicTimeNow);
+    double legacyHighResNowMs = 1000.0 * m_document->loader()->timing()->monotonicTimeToPseudoWallTime(monotonicTimeNow);
 
     // First, generate a list of callbacks to consider.  Callbacks registered from this point
     // on are considered only for the "next" frame, not this one.
@@ -128,7 +129,10 @@ void ScriptedAnimationController::serviceScriptedAnimations(double monotonicTime
         if (!callback->m_firedOrCancelled) {
             callback->m_firedOrCancelled = true;
             InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireAnimationFrame(m_document, callback->m_id);
-            callback->handleEvent(highResNowMs);
+            if (callback->m_useLegacyTimeBase)
+                callback->handleEvent(legacyHighResNowMs);
+            else
+                callback->handleEvent(highResNowMs);
             InspectorInstrumentation::didFireAnimationFrame(cookie);
         }
     }
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 006f9ab5f..1e0e0bf89 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -188,7 +188,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, Canvas
 #if ENABLE(WEBGL)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()
-#if !PLATFORM(CHROMIUM) && !PLATFORM(GTK) && !PLATFORM(EFL)
+#if !PLATFORM(CHROMIUM) && !PLATFORM(GTK) && !PLATFORM(EFL) && !PLATFORM(QT)
         && settings->acceleratedCompositingEnabled()
 #endif
         ) {
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 440ee7b9b..d52275c5f 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -106,6 +106,13 @@ const AtomicString& NumberInputType::formControlType() const
     return InputTypeNames::number();
 }
 
+void NumberInputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
+{
+    if (!valueChanged && sanitizedValue.isEmpty() && !element()->innerTextValue().isEmpty())
+        updateInnerTextValue();
+    TextFieldInputType::setValue(sanitizedValue, valueChanged, eventBehavior);
+}
+
 double NumberInputType::valueAsDouble() const
 {
     return parseToDoubleForNumberType(element()->value());
diff --git a/Source/WebCore/html/NumberInputType.h b/Source/WebCore/html/NumberInputType.h
index c77a9a78e..1efcdc13c 100644
--- a/Source/WebCore/html/NumberInputType.h
+++ b/Source/WebCore/html/NumberInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     NumberInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual double valueAsDouble() const OVERRIDE;
     virtual void setValueAsDouble(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual void setValueAsDecimal(const Decimal&, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
diff --git a/Source/WebCore/inspector/generate-inspector-protocol-version b/Source/WebCore/inspector/generate-inspector-protocol-version
index bd606b46e..38a0f98c3 100755
--- a/Source/WebCore/inspector/generate-inspector-protocol-version
+++ b/Source/WebCore/inspector/generate-inspector-protocol-version
@@ -303,9 +303,9 @@ def self_test():
         "Network.requestWillBeSent: required parameter is missing: postData",
         "Network.requestWillBeSent: required parameter is missing: documentURL" ]
     for i in range(len(errors)):
-        if errors[i] != golden_errors[i]:
+        if errors[i] not in golden_errors:
             return False
-    return True
+    return len(errors) is len(golden_errors)
 
 def main():
     if not self_test():
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 35c32328c..ad6eb1fb1 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -275,6 +275,7 @@ namespace WebCore {
             CanvasTrigger = 1 << 3,
             AnimationTrigger = 1 << 4,
             FilterTrigger = 1 << 5,
+            AnimatedOpacityTrigger = 1 << 6,
             AllTriggers = 0xFFFFFFFF
         };
         typedef unsigned CompositingTriggerFlags;
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 3d82599fb..f557ba6de 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -341,8 +341,11 @@ FloatRect DOMWindow::adjustWindowRect(Page* page, const FloatRect& pendingChange
         window.setHeight(pendingChanges.height());
 
     FloatSize minimumSize = page->chrome()->client()->minimumWindowSize();
-    window.setWidth(min(max(minimumSize.width(), window.width()), screen.width()));
-    window.setHeight(min(max(minimumSize.height(), window.height()), screen.height()));
+    // Let size 0 pass through, since that indicates default size, not minimum size.
+    if (window.width())
+        window.setWidth(min(max(minimumSize.width(), window.width()), screen.width()));
+    if (window.height())
+        window.setHeight(min(max(minimumSize.height(), window.height()), screen.height()));
 
     // Constrain the window position within the valid screen area.
     window.setX(max(screen.x(), min(window.x(), screen.maxX() - window.width())));
@@ -1551,6 +1554,15 @@ void DOMWindow::clearInterval(int timeoutId)
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 int DOMWindow::requestAnimationFrame(PassRefPtr<RequestAnimationFrameCallback> callback)
 {
+    callback->m_useLegacyTimeBase = false;
+    if (Document* d = document())
+        return d->requestAnimationFrame(callback);
+    return 0;
+}
+
+int DOMWindow::webkitRequestAnimationFrame(PassRefPtr<RequestAnimationFrameCallback> callback)
+{
+    callback->m_useLegacyTimeBase = true;
     if (Document* d = document())
         return d->requestAnimationFrame(callback);
     return 0;
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 424f58a2e..79029d08b 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -264,6 +264,7 @@ namespace WebCore {
         // WebKit animation extensions
 #if ENABLE(REQUEST_ANIMATION_FRAME)
         int requestAnimationFrame(PassRefPtr<RequestAnimationFrameCallback>);
+        int webkitRequestAnimationFrame(PassRefPtr<RequestAnimationFrameCallback>);
         void cancelAnimationFrame(int id);
 #endif
 
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 4a3a5f4de..5fe8c177a 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -216,7 +216,7 @@
 #if defined(ENABLE_REQUEST_ANIMATION_FRAME) && ENABLE_REQUEST_ANIMATION_FRAME
     [V8MeasureAs=UnprefixedRequestAnimationFrame] long requestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback);
     void cancelAnimationFrame(in long id);
-    [ImplementedAs=requestAnimationFrame, V8MeasureAs=PrefixedRequestAnimationFrame] long webkitRequestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback);
+    [V8MeasureAs=PrefixedRequestAnimationFrame] long webkitRequestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback);
     [ImplementedAs=cancelAnimationFrame] void webkitCancelAnimationFrame(in long id);
     [ImplementedAs=cancelAnimationFrame] void webkitCancelRequestAnimationFrame(in long id); // This is a deprecated alias for webkitCancelAnimationFrame(). Remove this when removing vendor prefix.
 #endif
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index da7d2238c..22d616e0f 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1706,7 +1706,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
             swallowEvent = handleMousePressEvent(mev);
     }
 
-    return !swallowEvent;
+    return swallowEvent;
 }
 
 // This method only exists for platforms that don't know how to deliver 
diff --git a/Source/WebCore/platform/graphics/Color.cpp b/Source/WebCore/platform/graphics/Color.cpp
index f3cddc5f3..04dc73ea6 100644
--- a/Source/WebCore/platform/graphics/Color.cpp
+++ b/Source/WebCore/platform/graphics/Color.cpp
@@ -414,31 +414,30 @@ void Color::getHSL(double& hue, double& saturation, double& lightness) const
         saturation = ((max - min) / (2.0 - (max + min)));
 }
 
-Color colorFromPremultipliedARGB(unsigned pixelColor)
+Color colorFromPremultipliedARGB(RGBA32 pixelColor)
 {
-    Color color;
-
-    if (unsigned alpha = (pixelColor & 0xFF000000) >> 24) {
-        color = Color::createUnchecked(
-                        ((pixelColor & 0x00FF0000) >> 16) * 255 / alpha,
-                        ((pixelColor & 0x0000FF00) >> 8) * 255 / alpha,
-                         (pixelColor & 0x000000FF) * 255 / alpha,
-                          alpha);
+    int alpha = alphaChannel(pixelColor);
+    if (alpha && alpha < 255) {
+        return Color::createUnchecked(
+            redChannel(pixelColor) * 255 / alpha,
+            greenChannel(pixelColor) * 255 / alpha,
+            blueChannel(pixelColor) * 255 / alpha,
+            alpha);
     } else
-        color = Color(pixelColor);
-
-    return color;
+        return Color(pixelColor);
 }
 
-unsigned premultipliedARGBFromColor(const Color& color)
+RGBA32 premultipliedARGBFromColor(const Color& color)
 {
     unsigned pixelColor;
 
-    if (unsigned alpha = color.alpha()) {
-        pixelColor = alpha << 24 |
-             ((color.red() * alpha  + 254) / 255) << 16 | 
-             ((color.green() * alpha  + 254) / 255) << 8 | 
-             ((color.blue() * alpha  + 254) / 255);
+    unsigned alpha = color.alpha();
+    if (alpha < 255) {
+        pixelColor = Color::createUnchecked(
+            (color.red() * alpha  + 254) / 255,
+            (color.green() * alpha  + 254) / 255,
+            (color.blue() * alpha  + 254) / 255,
+            alpha).rgb();
     } else
          pixelColor = color.rgb();
 
diff --git a/Source/WebCore/platform/graphics/Color.h b/Source/WebCore/platform/graphics/Color.h
index 9b51ff790..87ca23375 100644
--- a/Source/WebCore/platform/graphics/Color.h
+++ b/Source/WebCore/platform/graphics/Color.h
@@ -182,8 +182,8 @@ inline bool operator!=(const Color& a, const Color& b)
     return !(a == b);
 }
 
-Color colorFromPremultipliedARGB(unsigned);
-unsigned premultipliedARGBFromColor(const Color&);
+Color colorFromPremultipliedARGB(RGBA32);
+RGBA32 premultipliedARGBFromColor(const Color&);
 
 inline Color blend(const Color& from, const Color& to, double progress, bool blendPremultiplied = true)
 {
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index e36f9947c..d6d393a16 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -297,7 +297,7 @@ private:
     }
 
 #if PLATFORM(QT)
-    void initFormatForTextLayout(QTextLayout*) const;
+    void initFormatForTextLayout(QTextLayout*, const TextRun&) const;
 #endif
 
     static TypesettingFeatures s_defaultTypesettingFeatures;
diff --git a/Source/WebCore/platform/graphics/OpenGLShims.cpp b/Source/WebCore/platform/graphics/OpenGLShims.cpp
index ac7df609e..2f656b302 100644
--- a/Source/WebCore/platform/graphics/OpenGLShims.cpp
+++ b/Source/WebCore/platform/graphics/OpenGLShims.cpp
@@ -141,6 +141,8 @@ bool initializeOpenGLShims()
     ASSIGN_FUNCTION_TABLE_ENTRY(glBufferSubData, success);
     ASSIGN_FUNCTION_TABLE_ENTRY(glCheckFramebufferStatus, success);
     ASSIGN_FUNCTION_TABLE_ENTRY(glCompileShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glCompressedTexImage2D, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glCompressedTexSubImage2D, success);
     ASSIGN_FUNCTION_TABLE_ENTRY(glCreateProgram, success);
     ASSIGN_FUNCTION_TABLE_ENTRY(glCreateShader, success);
     ASSIGN_FUNCTION_TABLE_ENTRY(glDeleteBuffers, success);
diff --git a/Source/WebCore/platform/graphics/OpenGLShims.h b/Source/WebCore/platform/graphics/OpenGLShims.h
index 3d96927e6..5d71ae20e 100644
--- a/Source/WebCore/platform/graphics/OpenGLShims.h
+++ b/Source/WebCore/platform/graphics/OpenGLShims.h
@@ -62,6 +62,8 @@ typedef void (GLAPIENTRY *glBufferDataType) (GLenum, GLsizeiptr, const GLvoid*,
 typedef void (GLAPIENTRY *glBufferSubDataType) (GLenum, GLintptr, GLsizeiptr, const GLvoid*);
 typedef GLenum (GLAPIENTRY *glCheckFramebufferStatusType) (GLenum);
 typedef void (GLAPIENTRY *glCompileShaderType) (GLuint);
+typedef void (GLAPIENTRY *glCompressedTexImage2DType) (GLenum, GLint, GLenum, GLsizei, GLsizei, GLint, GLsizei, const GLvoid*);
+typedef void (GLAPIENTRY *glCompressedTexSubImage2DType) (GLenum, GLint, GLint, GLint, GLsizei, GLsizei, GLenum, GLsizei, const GLvoid*);
 typedef GLuint (GLAPIENTRY *glCreateProgramType) ();
 typedef GLuint (GLAPIENTRY *glCreateShaderType) (GLenum);
 typedef void (GLAPIENTRY *glDeleteBuffersType) (GLsizei, const GLuint*);
@@ -158,6 +160,8 @@ typedef struct _OpenGLFunctionTable {
     FUNCTION_TABLE_ENTRY(glBufferSubData);
     FUNCTION_TABLE_ENTRY(glCheckFramebufferStatus);
     FUNCTION_TABLE_ENTRY(glCompileShader);
+    FUNCTION_TABLE_ENTRY(glCompressedTexImage2D);
+    FUNCTION_TABLE_ENTRY(glCompressedTexSubImage2D);
     FUNCTION_TABLE_ENTRY(glCreateProgram);
     FUNCTION_TABLE_ENTRY(glCreateShader);
     FUNCTION_TABLE_ENTRY(glDeleteBuffers);
@@ -259,6 +263,8 @@ typedef struct _OpenGLFunctionTable {
 #define glCheckFramebufferStatusEXT            glCheckFramebufferStatus
 #define glCheckFramebufferStatus               LOOKUP_GL_FUNCTION(glCheckFramebufferStatus)
 #define glCompileShader                        LOOKUP_GL_FUNCTION(glCompileShader)
+#define glCompressedTexImage2D                 LOOKUP_GL_FUNCTION(glCompressedTexImage2D)
+#define glCompressedTexSubImage2D              LOOKUP_GL_FUNCTION(glCompressedTexSubImage2D)
 #define glCreateProgram                        LOOKUP_GL_FUNCTION(glCreateProgram)
 #define glCreateShader                         LOOKUP_GL_FUNCTION(glCreateShader)
 #define glDeleteBuffers                        LOOKUP_GL_FUNCTION(glDeleteBuffers)
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.h b/Source/WebCore/platform/graphics/SimpleFontData.h
index 93726b7a9..8621ca596 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.h
+++ b/Source/WebCore/platform/graphics/SimpleFontData.h
@@ -200,16 +200,19 @@ public:
 
     bool applyTransforms(GlyphBufferGlyph* glyphs, GlyphBufferAdvance* advances, size_t glyphCount, TypesettingFeatures typesettingFeatures) const
     {
-#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED <= 1080
+#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED > 1080
+        wkCTFontTransformOptions options = (typesettingFeatures & Kerning ? wkCTFontTransformApplyPositioning : 0) | (typesettingFeatures & Ligatures ? wkCTFontTransformApplyShaping : 0);
+        return wkCTFontTransformGlyphs(m_platformData.ctFont(), glyphs, reinterpret_cast<CGSize*>(advances), glyphCount, options);
+#elif PLATFORM(QT) && QT_VERSION >= 0x050100
+        QRawFont::LayoutFlags flags = (typesettingFeatures & Kerning) ? QRawFont::KernedAdvances : QRawFont::SeparateAdvances;
+        return m_platformData.rawFont().advancesForGlyphIndexes(glyphs, advances, glyphCount, flags);
+#else
         UNUSED_PARAM(glyphs);
         UNUSED_PARAM(advances);
         UNUSED_PARAM(glyphCount);
         UNUSED_PARAM(typesettingFeatures);
         ASSERT_NOT_REACHED();
         return false;
-#else
-    wkCTFontTransformOptions options = (typesettingFeatures & Kerning ? wkCTFontTransformApplyPositioning : 0) | (typesettingFeatures & Ligatures ? wkCTFontTransformApplyShaping : 0);
-    return wkCTFontTransformGlyphs(m_platformData.ctFont(), glyphs, reinterpret_cast<CGSize*>(advances), glyphCount, options);
 #endif
     }
 
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index 9a37a96fa..418fb5dc2 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -86,9 +86,11 @@ void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& trajectoryVecto
 void TiledBackingStore::invalidate(const IntRect& contentsDirtyRect)
 {
     IntRect dirtyRect(mapFromContents(contentsDirtyRect));
+    IntRect keepRectFitToTileSize = tileRectForCoordinate(tileCoordinateForPoint(m_keepRect.location()));
+    keepRectFitToTileSize.unite(tileRectForCoordinate(tileCoordinateForPoint(innerBottomRight(m_keepRect))));
 
     // Only iterate on the part of the rect that we know we might have tiles.
-    IntRect coveredDirtyRect = intersection(dirtyRect, m_keepRect);
+    IntRect coveredDirtyRect = intersection(dirtyRect, keepRectFitToTileSize);
     Tile::Coordinate topLeft = tileCoordinateForPoint(coveredDirtyRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(coveredDirtyRect));
 
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
index 2be38550e..5c36380d2 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
@@ -24,6 +24,9 @@
 
 #include "FontPlatformData.h"
 #include "SharedBuffer.h"
+#if USE(ZLIB)
+#include "WOFFFileFormat.h"
+#endif
 #include <QStringList>
 
 namespace WebCore {
@@ -39,7 +42,25 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 {
     ASSERT_ARG(buffer, buffer);
 
+#if USE(ZLIB)
+    RefPtr<SharedBuffer> sfntBuffer;
+    if (isWOFF(buffer)) {
+        Vector<char> sfnt;
+        if (!convertWOFFToSfnt(buffer, sfnt))
+            return 0;
+
+        sfntBuffer = SharedBuffer::adoptVector(sfnt);
+        buffer = sfntBuffer.get();
+    }
+#endif // USE(ZLIB)
+
     const QByteArray fontData(buffer->data(), buffer->size());
+#if !USE(ZLIB)
+    if (fontData.startsWith("wOFF")) {
+        qWarning("WOFF support requires QtWebKit to be built with zlib support.");
+        return 0;
+    }
+#endif // !USE(ZLIB)
     // Pixel size doesn't matter at this point, it is set in FontCustomPlatformData::fontPlatformData.
     QRawFont rawFont(fontData, /*pixelSize = */0, QFont::PreferDefaultHinting);
     if (!rawFont.isValid())
@@ -52,7 +73,11 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 
 bool FontCustomPlatformData::supportsFormat(const String& format)
 {
-    return equalIgnoringCase(format, "truetype") || equalIgnoringCase(format, "opentype");
+    return equalIgnoringCase(format, "truetype") || equalIgnoringCase(format, "opentype")
+#if USE(ZLIB)
+            || equalIgnoringCase(format, "woff")
+#endif
+    ;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index 067437188..99a4e397f 100644
--- a/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -68,7 +68,8 @@ FontPlatformData::FontPlatformData(const FontDescription& description, const Ato
     QFont font;
     int requestedSize = description.computedPixelSize();
     font.setFamily(familyName);
-    font.setPixelSize(requestedSize);
+    if (requestedSize)
+        font.setPixelSize(requestedSize);
     font.setItalic(description.italic());
     font.setWeight(toQFontWeight(description.weight()));
     font.setWordSpacing(wordSpacing);
diff --git a/Source/WebCore/platform/graphics/qt/FontQt.cpp b/Source/WebCore/platform/graphics/qt/FontQt.cpp
index e2cde765b..3afbb3528 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt.cpp
@@ -182,7 +182,7 @@ void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const Float
     const QString string = fromRawDataWithoutRef(sanitized);
     QTextLayout layout(string);
     layout.setRawFont(rawFont());
-    initFormatForTextLayout(&layout);
+    initFormatForTextLayout(&layout, run);
     QTextLine line = setupLayout(&layout, run);
     const QPointF adjustedPoint(point.x(), point.y() - line.ascent());
 
@@ -206,14 +206,11 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
     QTextLayout layout(string);
     layout.setRawFont(rawFont());
-    initFormatForTextLayout(&layout);
+    initFormatForTextLayout(&layout, run);
     QTextLine line = setupLayout(&layout, run);
     float x1 = line.cursorToX(0);
     float x2 = line.cursorToX(run.length());
     float width = qAbs(x2 - x1);
-    // RenderBlockLineLayout expects us to only add word-spacing for trailing spaces, not for leading spaces.
-    if (treatAsSpace(run[0]))
-        width -= m_wordSpacing;
 
     return width + run.expansion();
 }
@@ -225,7 +222,7 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float position, bo
 
     QTextLayout layout(string);
     layout.setRawFont(rawFont());
-    initFormatForTextLayout(&layout);
+    initFormatForTextLayout(&layout, run);
     QTextLine line = setupLayout(&layout, run);
     return line.xToCursor(position);
 }
@@ -237,7 +234,7 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint
 
     QTextLayout layout(string);
     layout.setRawFont(rawFont());
-    initFormatForTextLayout(&layout);
+    initFormatForTextLayout(&layout, run);
     QTextLine line = setupLayout(&layout, run);
 
     float x1 = line.cursorToX(from);
@@ -248,11 +245,17 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint
     return FloatRect(pt.x() + x1, pt.y(), x2 - x1, h);
 }
 
-void Font::initFormatForTextLayout(QTextLayout* layout) const
+void Font::initFormatForTextLayout(QTextLayout* layout, const TextRun& run) const
 {
     QTextLayout::FormatRange range;
-    range.start = 0;
-    range.length = layout->text().length();
+    // WebCore expects word-spacing to be ignored on leading spaces contrary to what Qt does.
+    // To avoid word-spacing on any leading spaces, we exclude them from FormatRange which
+    // word-spacing along with other options would be applied to. This is safe since the other
+    // formatting options does not affect spaces.
+    unsigned length = run.length();
+    for (range.start = 0; range.start < length && treatAsSpace(run[range.start]); ++range.start) { }
+    range.length = length - range.start;
+
     if (m_wordSpacing)
         range.format.setFontWordSpacing(m_wordSpacing);
     if (m_letterSpacing)
@@ -262,7 +265,7 @@ void Font::initFormatForTextLayout(QTextLayout* layout) const
     if (isSmallCaps())
         range.format.setFontCapitalization(QFont::SmallCaps);
 
-    if (range.format.propertyCount())
+    if (range.format.propertyCount() && range.length)
         layout->setAdditionalFormats(QList<QTextLayout::FormatRange>() << range);
 }
 
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 237d47eed..ab4447232 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -110,7 +110,8 @@ GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, H
 {
     if (renderStyle == GraphicsContext3D::RenderToCurrentGLContext) {
         m_platformContext = QOpenGLContext::currentContext();
-        m_surface = m_platformContext->surface();
+        if (m_platformContext)
+            m_surface = m_platformContext->surface();
         return;
     }
 
@@ -387,8 +388,8 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
 {
     validateAttributes();
 
-    if (!m_private->m_surface) {
-        LOG_ERROR("GraphicsContext3D: QGLWidget initialization failed.");
+    if (!m_private->m_surface || !m_private->m_platformContext) {
+        LOG_ERROR("GraphicsContext3D: GL context creation failed.");
         m_private = nullptr;
         return;
     }
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index fdbe88db3..3fa8c2985 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -188,14 +188,19 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
         m_data.m_painter->begin(&m_data.m_pixmap);
 }
 
-static inline quint32 convertABGRToARGB(quint32 pixel)
+static inline void copyColorToRGBA(Color& from, uchar* to)
 {
-    return ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
+    // Copy from endian dependent 32bit ARGB to endian independent RGBA8888.
+    to[0] = from.red();
+    to[1] = from.green();
+    to[2] = from.blue();
+    to[3] = from.alpha();
 }
 
-static inline quint32 convertARGBToABGR(quint32 pixel)
+static inline void copyRGBAToColor(const uchar* from, Color& to)
 {
-    return convertABGRToARGB(pixel);
+    // Copy from endian independent RGBA8888 to endian dependent 32bit ARGB.
+    to = Color::createUnchecked(from[0], from[1], from[2], from[3]);
 }
 
 template <Multiply multiplied>
@@ -206,7 +211,7 @@ PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& rect, const ImageBuffe
         return 0;
 
     RefPtr<Uint8ClampedArray> result = Uint8ClampedArray::createUninitialized(rect.width() * rect.height() * 4);
-    unsigned char* data = result->data();
+    uchar* resultData = result->data();
 
     if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
         result->zeroFill();
@@ -233,27 +238,26 @@ PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& rect, const ImageBuffe
         endy = size.height();
     int numRows = endy - originy;
 
+    const unsigned destBytesPerRow = 4 * rect.width();
+
     // NOTE: For unmultiplied data, we undo the premultiplication below.
     QImage image = imageData.toQImage().convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     ASSERT(!image.isNull());
 
-    const int bytesPerLine = image.bytesPerLine();
-    const uchar* bits = image.constBits();
-
-    quint32* destRows = reinterpret_cast_ptr<quint32*>(&data[desty * rect.width() * 4 + destx * 4]);
+    // The Canvas 2D Context expects RGBA order, while Qt uses 32bit QRgb (ARGB/BGRA).
     for (int y = 0; y < numRows; ++y) {
-        const quint32* scanLine = reinterpret_cast_ptr<const quint32*>(bits + (y + originy) * bytesPerLine);
-        for (int x = 0; x < numColumns; x++) {
-            QRgb pixel = scanLine[x + originx];
+        // This cast and the calls below relies on both QRgb and WebCore::RGBA32 being 32bit ARGB.
+        const unsigned* srcRow = reinterpret_cast<const unsigned*>(image.constScanLine(originy + y)) + originx;
+        uchar* destRow = resultData + (desty + y) * destBytesPerRow + destx * 4;
+        for (int x = 0; x < numColumns; x++, srcRow++, destRow += 4) {
             Color pixelColor;
             if (multiplied == Unmultiplied)
-                pixelColor = colorFromPremultipliedARGB(Color(qRed(pixel), qGreen(pixel), qBlue(pixel), qAlpha(pixel)).rgb());
+                pixelColor = colorFromPremultipliedARGB(*srcRow);
             else
-                pixelColor = Color(qRed(pixel), qGreen(pixel), qBlue(pixel), qAlpha(pixel));
-            destRows[x] = convertARGBToABGR(pixelColor.rgb());
+                pixelColor = Color(*srcRow);
+            copyColorToRGBA(pixelColor, destRow);
         }
-        destRows += rect.width();
     }
 
     return result.release();
@@ -297,25 +301,26 @@ void ImageBuffer::putByteArray(Multiply multiplied, Uint8ClampedArray* source, c
     ASSERT(endy <= m_size.height());
     int numRows = endy - desty;
 
-    unsigned srcBytesPerRow = 4 * sourceSize.width();
+    const unsigned srcBytesPerRow = 4 * sourceSize.width();
 
     // NOTE: For unmultiplied input data, we do the premultiplication below.
     QImage image(numColumns, numRows, QImage::Format_ARGB32_Premultiplied);
-    uchar* bits = image.bits();
-    const int bytesPerLine = image.bytesPerLine();
 
-    const quint32* srcScanLine = reinterpret_cast_ptr<const quint32*>(source->data() + originy * srcBytesPerRow + originx * 4);
+    unsigned* destData = reinterpret_cast<unsigned*>(image.bits());
+    const uchar* srcData = source->data();
 
     for (int y = 0; y < numRows; ++y) {
-        quint32* destScanLine = reinterpret_cast_ptr<quint32*>(bits + y * bytesPerLine);
-        for (int x = 0; x < numColumns; x++) {
-            quint32 pixel = convertABGRToARGB(srcScanLine[x]);
+        const uchar* srcRow = srcData + (originy + y) * srcBytesPerRow + originx * 4;
+        // This cast and the calls below relies on both QRgb and WebCore::RGBA32 being 32bit ARGB.
+        unsigned* destRow = destData + y * numColumns;
+        for (int x = 0; x < numColumns; x++, srcRow += 4, destRow++) {
+            Color pixelColor;
+            copyRGBAToColor(srcRow, pixelColor);
             if (multiplied == Unmultiplied)
-                destScanLine[x] = premultipliedARGBFromColor(Color(pixel));
+                *destRow = premultipliedARGBFromColor(pixelColor);
             else
-                destScanLine[x] = pixel;
+                *destRow = pixelColor.rgb();
         }
-        srcScanLine += sourceSize.width();
     }
 
     bool isPainting = m_data.m_painter->isActive();
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
index 7e9e00175..e01ed3d9f 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
@@ -171,12 +171,13 @@ PassRefPtr<BitmapTexture> BitmapTextureImageBuffer::applyFilters(TextureMapper*,
     renderer->setSourceImageRect(FloatRect(FloatPoint::zero(), contentTexture.size()));
 
     // The document parameter is only needed for CSS shaders.
-    renderer->build(0 /*document */, filters);
-    renderer->allocateBackingStoreIfNeeded();
-    GraphicsContext* context = renderer->inputContext();
-    context->drawImageBuffer(static_cast<const BitmapTextureImageBuffer&>(contentTexture).m_image.get(), ColorSpaceDeviceRGB, IntPoint::zero());
-    renderer->apply();
-    m_image->context()->drawImageBuffer(renderer->output(), ColorSpaceDeviceRGB, renderer->outputRect());
+    if (renderer->build(0 /*document */, filters)) {
+        renderer->allocateBackingStoreIfNeeded();
+        GraphicsContext* context = renderer->inputContext();
+        context->drawImageBuffer(static_cast<const BitmapTextureImageBuffer&>(contentTexture).m_image.get(), ColorSpaceDeviceRGB, IntPoint::zero());
+        renderer->apply();
+        m_image->context()->drawImageBuffer(renderer->output(), ColorSpaceDeviceRGB, renderer->outputRect());
+    }
     return this;
 }
 #endif
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index 6e95a44fe..e3a725108 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -71,9 +71,9 @@ struct TextEncodingNameHash {
         char c1;
         char c2;
         do {
-#if defined(_MSC_FULL_VER) && _MSC_FULL_VER == 170051106
-            // Workaround for a bug in the VS2012 Update 1 optimizer, remove once the fix is released.
-            // https://connect.microsoft.com/VisualStudio/feedback/details/777533/vs2012-c-optimizing-bug-when-using-inline-and-char-return-type-x86-target-only
+#if defined(_MSC_VER) && _MSC_VER == 1700
+            // Workaround for a bug in the VS2012 Update1 and Update2 optimizer, remove once the fix is released.
+            // https://connect.microsoft.com/VisualStudio/feedback/details/781189/vs2012-update-ctp4-c-optimizing-bug
             c1 = toASCIILower(*s1++);
             c2 = toASCIILower(*s2++);
             if (c1 != c2)
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index 579ed03fa..60d23f895 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -229,7 +229,7 @@ void PluginView::paintUsingXPixmap(QPainter* painter, const QRect &exposedRect)
 
     XImage* xImage = XGetImage(x11Display(), m_drawable, exposedRect.x(), exposedRect.y(),
                                exposedRect.width(), exposedRect.height(), ULONG_MAX, ZPixmap);
-    painter->drawImage(QPoint(exposedRect.x(), exposedRect.y()), qimageFromXImage(xImage), exposedRect);
+    painter->drawImage(QPoint(exposedRect.x(), exposedRect.y()), qimageFromXImage(xImage));
     XDestroyImage(xImage);
 }
 
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index e53d338be..d47340ece 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -88,6 +88,9 @@ inline bool isFilterSizeValid(FloatRect rect)
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 static PassRefPtr<FECustomFilter> createCustomFilterEffect(Filter* filter, Document* document, ValidatedCustomFilterOperation* operation)
 {
+    if (!document)
+        return 0;
+
     CustomFilterGlobalContext* globalContext = document->renderView()->customFilterGlobalContext();
     globalContext->prepareContextIfNeeded(document->view()->hostWindow());
     if (!globalContext->context())
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 4265ecdf3..058e90431 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -2925,8 +2925,8 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, const LayoutPoint& p
 void RenderBlock::paintContents(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
     // Avoid painting descendants of the root element when stylesheets haven't loaded.  This eliminates FOUC.
-    // It's ok not to draw, because later on, when all the stylesheets do load, updateStyleSelector on the Document
-    // will do a full repaint().
+    // It's ok not to draw, because later on, when all the stylesheets do load, styleResolverChanged() on the Document
+    // will do a full repaint.
     if (document()->didLayoutWithPendingStylesheets() && !isRenderView())
         return;
 
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 3c7cf6e56..c8437895f 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -166,7 +166,6 @@ RenderLayer::RenderLayer(RenderLayerModelObject* renderer)
 #if !ASSERT_DISABLED
     , m_layerListMutationAllowed(true)
 #endif
-    , m_canSkipRepaintRectsUpdateOnScroll(renderer->isTableCell())
 #if ENABLE(CSS_FILTERS)
     , m_hasFilterInfo(false)
 #endif
@@ -546,7 +545,7 @@ void RenderLayer::updateLayerPositionsAfterScroll(RenderGeometryMap* geometryMap
         flags |= HasSeenAncestorWithOverflowClip;
 
     if (flags & HasSeenViewportConstrainedAncestor
-        || (flags & IsOverflowScroll && flags & HasSeenAncestorWithOverflowClip && !m_canSkipRepaintRectsUpdateOnScroll)) {
+        || (flags & IsOverflowScroll && flags & HasSeenAncestorWithOverflowClip)) {
         // FIXME: We could track the repaint container as we walk down the tree.
         computeRepaintRects(renderer()->containerForRepaint(), geometryMap);
     } else {
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 65f1070ab..c5e652411 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -996,10 +996,6 @@ protected:
 #if !ASSERT_DISABLED
     bool m_layerListMutationAllowed : 1;
 #endif
-    // This is an optimization added for <table>.
-    // Currently cells do not need to update their repaint rectangles when scrolling. This also
-    // saves a lot of time when scrolling on a table.
-    const bool m_canSkipRepaintRectsUpdateOnScroll : 1;
 
 #if ENABLE(CSS_FILTERS)
     bool m_hasFilterInfo : 1;
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 870bf1ddf..badb782c4 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -1340,16 +1340,20 @@ void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* com
 }
 
 
-void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& absRect)
+void RenderLayerCompositor::repaintCompositedLayers(const IntRect* absRect)
 {
-    recursiveRepaintLayerRect(rootRenderLayer(), absRect);
+    recursiveRepaintLayer(rootRenderLayer(), absRect);
 }
 
-void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
+void RenderLayerCompositor::recursiveRepaintLayer(RenderLayer* layer, const IntRect* rect)
 {
     // FIXME: This method does not work correctly with transforms.
-    if (layer->isComposited() && !layer->backing()->paintsIntoCompositedAncestor())
-        layer->setBackingNeedsRepaintInRect(rect);
+    if (layer->isComposited() && !layer->backing()->paintsIntoCompositedAncestor()) {
+        if (rect)
+            layer->setBackingNeedsRepaintInRect(*rect);
+        else
+            layer->setBackingNeedsRepaint();
+    }
 
 #if !ASSERT_DISABLED
     LayerListMutationDetector mutationChecker(layer);
@@ -1360,9 +1364,12 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                IntRect childRect(rect);
-                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
-                recursiveRepaintLayerRect(curLayer, childRect);
+                if (rect) {
+                    IntRect childRect(*rect);
+                    curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
+                    recursiveRepaintLayer(curLayer, &childRect);
+                } else
+                    recursiveRepaintLayer(curLayer);
             }
         }
 
@@ -1370,9 +1377,12 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                IntRect childRect(rect);
-                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
-                recursiveRepaintLayerRect(curLayer, childRect);
+                if (rect) {
+                    IntRect childRect(*rect);
+                    curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
+                    recursiveRepaintLayer(curLayer, &childRect);
+                } else
+                    recursiveRepaintLayer(curLayer);
             }
         }
     }
@@ -1380,9 +1390,12 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            IntRect childRect(rect);
-            curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
-            recursiveRepaintLayerRect(curLayer, childRect);
+            if (rect) {
+                IntRect childRect(*rect);
+                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
+                recursiveRepaintLayer(curLayer, &childRect);
+            } else
+                recursiveRepaintLayer(curLayer);
         }
     }
 }
@@ -1871,7 +1884,8 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
         return false;
 
     if (AnimationController* animController = renderer->animation()) {
-        return (animController->isRunningAnimationOnRenderer(renderer, CSSPropertyOpacity) && inCompositingMode())
+        return (animController->isRunningAnimationOnRenderer(renderer, CSSPropertyOpacity)
+                && (inCompositingMode() || (m_compositingTriggers & ChromeClient::AnimatedOpacityTrigger)))
 #if ENABLE(CSS_FILTERS)
 #if !PLATFORM(MAC) || (!PLATFORM(IOS) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080)
             // <rdar://problem/10907251> - WebKit2 doesn't support CA animations of CI filters on Lion and below
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 4d828f1a5..5193411a2 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -144,8 +144,8 @@ public:
     // Get the nearest ancestor layer that has overflow or clip, but is not a stacking context
     RenderLayer* enclosingNonStackingClippingLayer(const RenderLayer* layer) const;
 
-    // Repaint parts of all composited layers that intersect the given absolute rectangle.
-    void repaintCompositedLayersAbsoluteRect(const IntRect&);
+    // Repaint parts of all composited layers that intersect the given absolute rectangle (or the entire layer if the pointer is null).
+    void repaintCompositedLayers(const IntRect* = 0);
 
     // Returns true if the given layer needs it own backing store.
     bool requiresOwnBackingStore(const RenderLayer*, const RenderLayer* compositingAncestorLayer) const;
@@ -257,7 +257,7 @@ private:
     void clearBackingForLayerIncludingDescendants(RenderLayer*);
 
     // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
-    void recursiveRepaintLayerRect(RenderLayer*, const IntRect&);
+    void recursiveRepaintLayer(RenderLayer*, const IntRect* = 0);
 
     void addToOverlapMap(OverlapMap&, RenderLayer*, IntRect& layerBounds, bool& boundsComputed);
     void addToOverlapMapRecursive(OverlapMap&, RenderLayer*, RenderLayer* ancestorLayer = 0);
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index c8452a47c..4bc186874 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -1081,7 +1081,9 @@ CellSpan RenderTableSection::spannedColumns(const LayoutRect& flippedRect) const
     return CellSpan(startColumn, endColumn);
 }
 
-
+#if defined(_MSC_VER) && _MSC_VER == 1700
+#pragma optimize("", off)
+#endif
 void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
     PaintPhase paintPhase = paintInfo.phase;
@@ -1182,6 +1184,9 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
         }
     }
 }
+#if defined(_MSC_VER) && _MSC_VER == 1700
+#pragma optimize("", on)
+#endif
 
 void RenderTableSection::imageChanged(WrappedImagePtr, const IntRect*)
 {
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 1457b6be2..bdb9c8069 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -435,8 +435,20 @@ void RenderView::repaintRectangleInViewAndCompositedLayers(const LayoutRect& ur,
     repaintViewRectangle(ur, immediate);
     
 #if USE(ACCELERATED_COMPOSITING)
+    if (compositor()->inCompositingMode()) {
+        IntRect repaintRect = pixelSnappedIntRect(ur);
+        compositor()->repaintCompositedLayers(&repaintRect);
+    }
+#endif
+}
+
+void RenderView::repaintViewAndCompositedLayers()
+{
+    repaint();
+    
+#if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode())
-        compositor()->repaintCompositedLayersAbsoluteRect(pixelSnappedIntRect(ur));
+        compositor()->repaintCompositedLayers();
 #endif
 }
 
diff --git a/Source/WebCore/rendering/RenderView.h b/Source/WebCore/rendering/RenderView.h
index d63f8df86..99ab1c1a3 100644
--- a/Source/WebCore/rendering/RenderView.h
+++ b/Source/WebCore/rendering/RenderView.h
@@ -78,10 +78,11 @@ public:
     FrameView* frameView() const { return m_frameView; }
 
     virtual void computeRectForRepaint(const RenderLayerModelObject* repaintContainer, LayoutRect&, bool fixed = false) const OVERRIDE;
-    virtual void repaintViewRectangle(const LayoutRect&, bool immediate = false) const;
+    void repaintViewRectangle(const LayoutRect&, bool immediate = false) const;
     // Repaint the view, and all composited layers that intersect the given absolute rectangle.
     // FIXME: ideally we'd never have to do this, if all repaints are container-relative.
-    virtual void repaintRectangleInViewAndCompositedLayers(const LayoutRect&, bool immediate = false);
+    void repaintRectangleInViewAndCompositedLayers(const LayoutRect&, bool immediate = false);
+    void repaintViewAndCompositedLayers();
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual void paintBoxDecorations(PaintInfo&, const LayoutPoint&) OVERRIDE;
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index 0fe0ffab6..64ebba386 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -128,7 +128,7 @@ FloatRect ChromeClientEfl::windowRect()
 
 void ChromeClientEfl::setWindowRect(const FloatRect& rect)
 {
-    if (!ewk_view_setting_enable_auto_resize_window_get(m_view))
+    if (!ewk_view_setting_enable_auto_resize_window_get(m_view) || rect.isEmpty())
         return;
 
     Ecore_Evas* ee = ecore_evas_ecore_evas_get(evas_object_evas_get(m_view));
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 6152f5080..99f2b85ed 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -138,7 +138,8 @@ void ChromeClient::setWindowRect(const FloatRect& rect)
     GtkWidget* window = gtk_widget_get_toplevel(GTK_WIDGET(m_webView));
     if (widgetIsOnscreenToplevelWindow(window)) {
         gtk_window_move(GTK_WINDOW(window), intrect.x(), intrect.y());
-        gtk_window_resize(GTK_WINDOW(window), intrect.width(), intrect.height());
+        if (!intrect.isEmpty())
+            gtk_window_resize(GTK_WINDOW(window), intrect.width(), intrect.height());
     }
 }
 
diff --git a/Source/WebKit/qt/Api/qwebdatabase.cpp b/Source/WebKit/qt/Api/qwebdatabase.cpp
index b26772089..8739b2466 100644
--- a/Source/WebKit/qt/Api/qwebdatabase.cpp
+++ b/Source/WebKit/qt/Api/qwebdatabase.cpp
@@ -46,7 +46,7 @@ using namespace WebCore;
 
     WebKit uses SQLite to create and access the local SQL databases. The location of the database
     file in the local file system is returned by fileName(). You can access the database directly
-    through the QtSql database module.
+    through the \l{Qt SQL} database module.
 
     For each database the web site can define an expectedSize(). The current size of the database
     in bytes is returned by size().
@@ -131,7 +131,7 @@ QWebDatabase::QWebDatabase(QWebDatabasePrivate* priv)
 /*!
     Returns the file name of the web database.
 
-    The name can be used to access the database through the QtSql database module, for example:
+    The name can be used to access the database through the \l{Qt SQL} database module, for example:
     \code
       QWebDatabase webdb = ...
       QSqlDatabase sqldb = QSqlDatabase::addDatabase("QSQLITE", "myconnection");
diff --git a/Source/WebKit/qt/Api/qwebelement.cpp b/Source/WebKit/qt/Api/qwebelement.cpp
index 82f579d95..96278333b 100644
--- a/Source/WebKit/qt/Api/qwebelement.cpp
+++ b/Source/WebKit/qt/Api/qwebelement.cpp
@@ -44,6 +44,7 @@
 #include "qt_runtime.h"
 #include "NodeList.h"
 #include "RenderImage.h"
+#include "ScriptSourceCode.h"
 #include "ScriptState.h"
 #include "StaticNodeList.h"
 #include "StyleResolver.h"
@@ -709,7 +710,7 @@ QWebFrame *QWebElement::webFrame() const
     return frameAdapter->apiHandle();
 }
 
-static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValue, ScriptState*& state, ScriptController*& scriptController)
+static bool setupScriptContext(WebCore::Element* element, ScriptState*& state, ScriptController*& scriptController)
 {
     if (!element)
         return false;
@@ -730,10 +731,6 @@ static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValu
     if (!state)
         return false;
 
-    thisValue = toJS(state, deprecatedGlobalObjectForPrototype(state), element);
-    if (!thisValue)
-        return false;
-
     return true;
 }
 
@@ -746,21 +743,29 @@ QVariant QWebElement::evaluateJavaScript(const QString& scriptSource)
         return QVariant();
 
     ScriptState* state = 0;
-    JSC::JSValue thisValue;
     ScriptController* scriptController = 0;
 
-    if (!setupScriptContext(m_element, thisValue, state, scriptController))
+    if (!setupScriptContext(m_element, state, scriptController))
+        return QVariant();
+
+    JSC::JSLockHolder lock(state);
+    RefPtr<Element> protect = m_element;
+
+    JSC::JSValue thisValue = toJS(state, toJSDOMGlobalObject(m_element->document(), state), m_element);
+    if (!thisValue)
         return QVariant();
-    String script(reinterpret_cast_ptr<const UChar*>(scriptSource.data()), scriptSource.length());
+
+    ScriptSourceCode sourceCode(scriptSource);
 
     JSC::JSValue evaluationException;
-    JSC::JSValue evaluationResult = JSC::evaluate(state, JSC::makeSource(script), thisValue, &evaluationException);
+    JSC::JSValue evaluationResult = JSC::evaluate(state, sourceCode.jsSourceCode(), thisValue, &evaluationException);
     if (evaluationException)
         return QVariant();
+    JSValueRef evaluationResultRef = toRef(state, evaluationResult);
 
     int distance = 0;
     JSValueRef* ignoredException = 0;
-    return JSC::Bindings::convertValueToQVariant(toRef(state), toRef(state, evaluationResult), QMetaType::Void, &distance, ignoredException);
+    return JSC::Bindings::convertValueToQVariant(toRef(state), evaluationResultRef, QMetaType::Void, &distance, ignoredException);
 }
 
 /*!
diff --git a/Source/WebKit/qt/Api/qwebkitglobal.cpp b/Source/WebKit/qt/Api/qwebkitglobal.cpp
index 0ae955b8f..da9596322 100644
--- a/Source/WebKit/qt/Api/qwebkitglobal.cpp
+++ b/Source/WebKit/qt/Api/qwebkitglobal.cpp
@@ -34,7 +34,7 @@
     and behaviour.
 
     The evolution of this version is bound to the releases of Apple's
-    Safari browser. For a version specific to the QtWebKit library,
+    Safari browser. For a version specific to the Qt WebKit module,
     see QTWEBKIT_VERSION
 
     \sa QWebPage::userAgentForUrl()
@@ -77,11 +77,11 @@ int qWebKitMinorVersion()
     \relates QWebPage
 
     This macro expands a numeric value of the form 0xMMNNPP (MM =
-    major, NN = minor, PP = patch) that specifies QtWebKit's version
-    number. For example, if you compile your application against QtWebKit
+    major, NN = minor, PP = patch) that specifies Qt WebKit's version
+    number. For example, if you compile your application against Qt WebKit
     2.1.2, the QTWEBKIT_VERSION macro will expand to 0x020102.
 
-    You can use QTWEBKIT_VERSION to use the latest QtWebKit API where
+    You can use QTWEBKIT_VERSION to use the latest Qt WebKit API where
     available.
 
     \sa QT_VERSION
@@ -91,7 +91,7 @@ int qWebKitMinorVersion()
     \macro QTWEBKIT_VERSION_STR
     \relates QWebPage
 
-    This macro expands to a string that specifies QtWebKit's version number
+    This macro expands to a string that specifies Qt WebKit's version number
     (for example, "2.1.2"). This is the version against which the
     application is compiled.
 
@@ -109,7 +109,7 @@ int qWebKitMinorVersion()
 
     \code
     #if QTWEBKIT_VERSION >= QTWEBKIT_VERSION_CHECK(2, 1, 0)
-    // code to use API new in QtWebKit 2.1.0
+    // code to use API new in Qt WebKit 2.1.0
     #endif
     \endcode
 */
diff --git a/Source/WebKit/qt/Api/qwebpluginfactory.cpp b/Source/WebKit/qt/Api/qwebpluginfactory.cpp
index 34ea05265..16d7a602d 100644
--- a/Source/WebKit/qt/Api/qwebpluginfactory.cpp
+++ b/Source/WebKit/qt/Api/qwebpluginfactory.cpp
@@ -34,7 +34,7 @@
     <object type="application/x-pdf" data="http://qt.nokia.com/document.pdf" width="500" height="400"></object>
     \endcode
 
-    QtWebkit will natively handle the most basic data types like \c{text/html} and
+    Qt WebKit will natively handle the most basic data types like \c{text/html} and
     \c{image/jpeg}, but for any advanced or custom data types you will need to
     provide a handler yourself.
 
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 88172149c..a905e2e27 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -77,6 +77,7 @@ public:
     QString defaultTextEncoding;
     QString localStoragePath;
     QString offlineWebApplicationCachePath;
+    QString mediaType;
     qint64 offlineStorageDefaultQuota;
     QWebSettings::ThirdPartyCookiePolicy thirdPartyCookiePolicy;
     void apply();
@@ -225,6 +226,9 @@ void QWebSettingsPrivate::apply()
         QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
         settings->setLocalStorageDatabasePath(storagePath);
 
+        if (mediaType.isEmpty())
+            mediaType = global->mediaType;
+
         value = attributes.value(QWebSettings::PrintElementBackgrounds,
                                       global->attributes.value(QWebSettings::PrintElementBackgrounds));
         settings->setShouldPrintBackgrounds(value);
@@ -331,7 +335,7 @@ QWebSettings* QWebSettings::globalSettings()
     Support for browser plugins can enabled by setting the
     \l{QWebSettings::PluginsEnabled}{PluginsEnabled} attribute. For many applications,
     this attribute is enabled for all pages by setting it on the
-    \l{globalSettings()}{global settings object}. QtWebKit will always ignore this setting
+    \l{globalSettings()}{global settings object}. Qt WebKit will always ignore this setting
     when processing Qt plugins. The decision to allow a Qt plugin is made by the client
     in its reimplementation of QWebPage::createPlugin().
 
@@ -414,7 +418,7 @@ QWebSettings* QWebSettings::globalSettings()
 
     \value AutoLoadImages Specifies whether images are automatically loaded in
         web pages. This is enabled by default.
-    \value DnsPrefetchEnabled Specifies whether QtWebkit will try to pre-fetch DNS entries to
+    \value DnsPrefetchEnabled Specifies whether Qt WebKit will try to pre-fetch DNS entries to
         speed up browsing. This only works as a global attribute. Only for Qt 4.6 and later. This is disabled by default.
     \value JavascriptEnabled Enables or disables the running of JavaScript
         programs. This is enabled by default
@@ -773,7 +777,7 @@ static const char* resourceNameForWebGraphic(QWebSettings::WebGraphic type)
 }
 
 /*!
-    Sets \a graphic to be drawn when QtWebKit needs to draw an image of the
+    Sets \a graphic to be drawn when Qt WebKit needs to draw an image of the
     given \a type.
 
     For example, when an image cannot be loaded, the pixmap specified by
@@ -910,6 +914,29 @@ QWebSettings::ThirdPartyCookiePolicy QWebSettings::thirdPartyCookiePolicy() cons
 }
 
 /*!
+    Sets the CSS media type to \a type.
+    
+    Setting this will override the normal value of the CSS media property.
+    
+    \note Setting the value to null QString will restore the default value.
+*/
+void QWebSettings::setCSSMediaType(const QString& type)
+{
+    d->mediaType = type;
+    d->apply();
+}
+
+/*!
+    Returns the current CSS media type.
+    
+    \note It will only return the value set through setCSSMediaType and not the one used internally.
+*/
+QString QWebSettings::cssMediaType() const
+{
+    return d->mediaType;
+}
+
+/*!
     Sets the actual font family to \a family for the specified generic family,
     \a which.
 */
diff --git a/Source/WebKit/qt/Api/qwebsettings.h b/Source/WebKit/qt/Api/qwebsettings.h
index 49721b7cb..30b61a756 100644
--- a/Source/WebKit/qt/Api/qwebsettings.h
+++ b/Source/WebKit/qt/Api/qwebsettings.h
@@ -160,6 +160,9 @@ public:
     void setThirdPartyCookiePolicy(ThirdPartyCookiePolicy);
     QWebSettings::ThirdPartyCookiePolicy thirdPartyCookiePolicy() const;
 
+    void setCSSMediaType(const QString&);
+    QString cssMediaType() const;
+
     inline QWebSettingsPrivate* handle() const { return d; }
 
 private:
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 71b45d6dd..58dad5b76 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -654,7 +654,7 @@ void ChromeClientQt::scheduleCompositingLayerFlush()
 ChromeClient::CompositingTriggerFlags ChromeClientQt::allowedCompositingTriggers() const
 {
     if (allowsAcceleratedCompositing())
-        return ThreeDTransformTrigger | VideoTrigger | CanvasTrigger | AnimationTrigger;
+        return ThreeDTransformTrigger | CanvasTrigger | AnimationTrigger | AnimatedOpacityTrigger;
 
     return 0;
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 8028bf91e..3788fd21c 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -77,6 +77,7 @@
 #include "qwebhistory_p.h"
 #include "qwebhistoryinterface.h"
 #include "qwebpluginfactory.h"
+#include "qwebsettings.h"
 
 #include <QCoreApplication>
 #include <QDebug>
@@ -1560,6 +1561,9 @@ PassRefPtr<Widget> FrameLoaderClientQt::createJavaAppletWidget(const IntSize& pl
 
 String FrameLoaderClientQt::overrideMediaType() const
 {
+    if (m_webFrame && m_webFrame->pageAdapter && m_webFrame->pageAdapter->settings)
+        return m_webFrame->pageAdapter->settings->cssMediaType();
+
     return String();
 }
 
diff --git a/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp b/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
index 7f55da362..595d758b4 100644
--- a/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
@@ -194,14 +194,17 @@ void QWebFrameAdapter::handleGestureEvent(QGestureEventFacade* gestureEvent)
 
 QVariant QWebFrameAdapter::evaluateJavaScript(const QString &scriptSource)
 {
-    ScriptController* proxy = frame->script();
+    ScriptController* scriptController = frame->script();
     QVariant rc;
-    if (proxy) {
+    if (scriptController) {
         int distance = 0;
-        JSC::JSValue v = frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
-        JSC::ExecState* exec = proxy->globalObject(mainThreadNormalWorld())->globalExec();
+        ScriptValue value = scriptController->executeScript(ScriptSourceCode(scriptSource));
+        JSC::ExecState* exec = scriptController->globalObject(mainThreadNormalWorld())->globalExec();
         JSValueRef* ignoredException = 0;
-        rc = JSC::Bindings::convertValueToQVariant(toRef(exec), toRef(exec, v), QMetaType::Void, &distance, ignoredException);
+        JSC::JSLock::lock(exec);
+        JSValueRef valueRef = toRef(exec, value.jsValue());
+        JSC::JSLock::unlock(exec);
+        rc = JSC::Bindings::convertValueToQVariant(toRef(exec), valueRef, QMetaType::Void, &distance, ignoredException);
     }
     return rc;
 }
diff --git a/Source/WebKit/qt/WidgetApi/qgraphicswebview.cpp b/Source/WebKit/qt/WidgetApi/qgraphicswebview.cpp
index 9827d224e..69138d73f 100644
--- a/Source/WebKit/qt/WidgetApi/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/WidgetApi/qgraphicswebview.cpp
@@ -145,7 +145,7 @@ void QGraphicsWebViewPrivate::_q_scaleChanged()
     \since 4.6
 
     An instance of this class renders Web content from a URL or supplied as data, using
-    features of the QtWebKit module.
+    features of the Qt WebKit module.
 
     If the width and height of the item are not set, they will default to 800 and 600,
     respectively. If the Web page contents is larger than that, scrollbars will be shown
diff --git a/Source/WebKit/qt/WidgetApi/qwebframe.cpp b/Source/WebKit/qt/WidgetApi/qwebframe.cpp
index 242edb1ea..e7286f88e 100644
--- a/Source/WebKit/qt/WidgetApi/qwebframe.cpp
+++ b/Source/WebKit/qt/WidgetApi/qwebframe.cpp
@@ -242,7 +242,7 @@ QWebFrame::~QWebFrame()
 
     Qt properties will be exposed as JavaScript properties and slots as
     JavaScript methods.
-    The interaction between C++ and JavaScript is explained in the documentation of the \l{The QtWebKit Bridge}{QtWebKit bridge}.
+    The interaction between C++ and JavaScript is explained in the documentation of the \l{The Qt WebKit Bridge}{Qt WebKit bridge}.
 
     If you want to ensure that your QObjects remain accessible after loading a
     new URL, you should add them in a slot connected to the
diff --git a/Source/WebKit/qt/WidgetApi/qwebpage.cpp b/Source/WebKit/qt/WidgetApi/qwebpage.cpp
index a1fe49e13..4931a4854 100644
--- a/Source/WebKit/qt/WidgetApi/qwebpage.cpp
+++ b/Source/WebKit/qt/WidgetApi/qwebpage.cpp
@@ -1675,7 +1675,7 @@ static void collectChildFrames(QWebFrame* frame, QList<QWebFrame*>& list)
 
 /*!
     This function can be called to trigger the specified \a action.
-    It is also called by QtWebKit if the user triggers the action, for example
+    It is also called by Qt WebKit if the user triggers the action, for example
     through a context menu item.
 
     If \a action is a checkable action then \a checked specified whether the action
diff --git a/Source/WebKit/qt/WidgetApi/qwebview.cpp b/Source/WebKit/qt/WidgetApi/qwebview.cpp
index fcfc934be..9ba962178 100644
--- a/Source/WebKit/qt/WidgetApi/qwebview.cpp
+++ b/Source/WebKit/qt/WidgetApi/qwebview.cpp
@@ -78,7 +78,7 @@ void QWebViewPrivate::_q_pageDestroyed()
 
     \inmodule QtWebKit
 
-    QWebView is the main widget component of the QtWebKit web browsing module.
+    QWebView is the main widget component of the Qt WebKit web browsing module.
     It can be used in various applications to display web content live from the
     Internet.
 
@@ -144,7 +144,7 @@ void QWebViewPrivate::_q_pageDestroyed()
     \image qwebview-diagram.png
 
     \note It is possible to use QWebPage and QWebFrame, without using QWebView,
-    if you do not require QWidget attributes. Nevertheless, QtWebKit depends
+    if you do not require QWidget attributes. Nevertheless, Qt WebKit depends
     on QtGui, so you should use a QApplication instead of QCoreApplication.
 
     \sa {Previewer Example}, {Web Browser}, {Form Extractor Example},
diff --git a/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc b/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc
index 2975d157f..c7b3c27e7 100644
--- a/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc
+++ b/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc
@@ -1,19 +1,19 @@
 /*!
     \inmodule QtWebKit
     \page qtwebkit-bridge.html
-    \title The QtWebKit Bridge
-    \contentspage QtWebKit
+    \title The Qt WebKit Bridge
+    \contentspage Qt WebKit
     \section1 Overview
     \section2 The technology
 
-    The QtWebKit bridge is a mechanism that extends WebKit's JavaScript environment to access native
+    The Qt WebKit bridge is a mechanism that extends WebKit's JavaScript environment to access native
     objects represented as \l{QObject}s. It takes advantage of the \l{QObject} introspection,
     a part of the \l{Object Model}, which makes it easy to integrate with the dynamic JavaScript environment.
     For example \l{QObject} properties map directly to JavaScript properties.
 
     \section2 Use Cases
 
-    There are two main use cases for the QtWebKit bridge: web content in native applications and thin clients.
+    There are two main use cases for the Qt WebKit bridge: web content in native applications and thin clients.
 
     \section3 Web Content in Native Applications
 
@@ -25,7 +25,7 @@
     or \l{QtDeclarative}. The music store, which shows dynamic content
     from the Internet and gets modified rapidly, is best authored in HTML and maintained on the server.
 
-    With the QtWebKit bridge, the music store component can interact with native parts of the application,
+    With the Qt WebKit bridge, the music store component can interact with native parts of the application,
     for example, when a file needs to be saved to a specific location.
 
     \section3 Thin Clients
@@ -43,22 +43,22 @@
 
     \section2 Difference from Other Bridge Technologies
 
-    Of course, QtWebKit is not the only bridge technology out there. NPAPI, for example,
+    Of course, Qt WebKit is not the only bridge technology out there. NPAPI, for example,
     is a long-time standard for web-native bridging. Due to Qt's meta-object system, full applications
-    leveraging web technologies are much easier to develop with the QtWebKit bridge than with NPAPI. NPAPI, however, is better
+    leveraging web technologies are much easier to develop with the Qt WebKit bridge than with NPAPI. NPAPI, however, is better
     for cross-browser plugins, due to it being an accepted standard.
 
     When developing a plugin for a browser, NPAPI is recommended. When developing a full application
-    utilizing HTML-rendering, the QtWebKit bridge is recommended.
+    utilizing HTML-rendering, the Qt WebKit bridge is recommended.
 
-    \section2 Relationship with QtScript
+    \section2 Relationship with Qt Script
 
-    The QtWebKit bridge is similar to \l{QtScript}, especially for some of the features described in the
-    \l{Making Applications Scriptable} page. However, Qt 4.7 does not provide the full QtScript API for web applications.
+    The Qt WebKit bridge is similar to \l{Qt Script}, especially for some of the features described in the
+    \l{Making Applications Scriptable} page. However, Qt 4.7 does not provide the full Qt Script API for web applications.
     Full support is planned for future versions. You might notice that some of the features
     described here are an exact copy of the ones described in the \l{Making Applications Scriptable} page. That is because
-    the QtWebKit bridge is a subset of that functionality, and this page tries to capture the full
-    capabilities available through the QtWebKit bridge specifically.
+    the Qt WebKit bridge is a subset of that functionality, and this page tries to capture the full
+    capabilities available through the Qt WebKit bridge specifically.
 
     \section1 Accessing QObjects
 
@@ -74,9 +74,9 @@
 
     \section2 Using Signals and Slots
 
-    The QtWebKit bridge adapts Qt's central \l{Signals and Slots} feature for
+    The Qt WebKit bridge adapts Qt's central \l{Signals and Slots} feature for
     scripting. There are three principal ways to use signals and slots
-    with the QtWebKit bridge:
+    with the Qt WebKit bridge:
 
     \list
     \li \b{Hybrid C++/script}: C++ application code connects a
@@ -100,7 +100,7 @@
     script function.
     \endlist
 
-    Note that QtScript functions such as qScriptConnect are unavilable in the web environment.
+    Note that Qt Script functions such as qScriptConnect are unavilable in the web environment.
 
     \section3 Signal to Function Connections
 
@@ -117,7 +117,7 @@
     \snippet webkitsnippets/qtwebkit_bridge_snippets.cpp 8
 
     When the argument is a slot of a QObject, the argument types of the
-    signal and the slot do not have to be compatible. If possible, the QtWebKit
+    signal and the slot do not have to be compatible. If possible, the Qt WebKit
     bridge converts the signal arguments such that they match the slot argument.
 
     To disconnect a slot from a signal, you call the signal's
@@ -194,7 +194,7 @@
 
     \section3 Overloaded Signals and Slots
 
-    When a signal or slot is overloaded, the QtWebKit bridge will attempt to
+    When a signal or slot is overloaded, the Qt WebKit bridge will attempt to
     pick the right overload based on the actual types of the QScriptValue arguments
     involved in the function invocation. For example, if your class has slots
     \c{myOverloadedSlot(int)} and \c{myOverloadedSlot(QString)}, the following
@@ -208,7 +208,7 @@
 
     \snippet webkitsnippets/qtwebkit_bridge_snippets.cpp 21
 
-    If the overloads have different number of arguments, the QtWebKit bridge will
+    If the overloads have different number of arguments, the Qt WebKit bridge will
     pick the overload with the argument count that best matches the
     actual number of arguments passed to the slot.
 
@@ -260,7 +260,7 @@
 
     When calling slots, receiving signals or accessing properties, usually some payload is involved.
     For example, a property "text" might return a \l{QString} parameter.
-    The QtWebKit bridge does the job of converting between a given JavaScript data-type, and the
+    The Qt WebKit bridge does the job of converting between a given JavaScript data-type, and the
     expected or given Qt type. Each Qt type has a coresponding set of rules of how JavaScript treats it.
 
     The data type conversions are also applicable for the data returned from non-void invokable methods.
@@ -269,7 +269,7 @@
 
     All Qt numeric data types are converted to or from a JavaScript number. These include int, short, float,
     double, and the portable Qt types (qreal, qint etc). A special case is \l{QChar}.
-    If a slot expects a QChar, the QtWebKit bridge uses the Unicode value in case of a number and the first character in case of a string.
+    If a slot expects a QChar, the Qt WebKit bridge uses the Unicode value in case of a number and the first character in case of a string.
 
     Note that non-standard (typedef'ed) number types are not automatically converted to
     or from a JavaScript number - we suggest to use standard number types for signals, slots
@@ -280,31 +280,31 @@
 
     \section3 Strings
 
-    When JavaScript accesses methods or properties that expect a \l{QString}, the QtWebKit bridge
+    When JavaScript accesses methods or properties that expect a \l{QString}, the Qt WebKit bridge
     will automatically convert the value to a string (if it is not already a string), using the
     built-in JavaScript toString method.
 
-    When a QString is passed to JavaScript from a signal or a property, the QtWebKit bridge
+    When a QString is passed to JavaScript from a signal or a property, the Qt WebKit bridge
     converts it into a JavaScript string.
 
     \section3 Date & Time
 
     Both \l{QDate}, \l{QTime} and \l{QDateTime} are automatically translated to or from the JavaScript
     Date object. If a number is passed as an argument to a method that expects one of the date/time
-    types, the QtWebKit bridge treats it as a timestamp. If a sting is passed, QtWebKit
+    types, the Qt WebKit bridge treats it as a timestamp. If a sting is passed, Qt WebKit
     tries the different Qt date parsing functions to perform the right translation.
 
     \section3 Regular Expressions
 
-    The QtWebKit bridge automatically converts a JavaScript RegEx object to a \l{QRegExp}.
+    The Qt WebKit bridge automatically converts a JavaScript RegEx object to a \l{QRegExp}.
     If a string is passed to a method expecting a \l{QRegExp}, the string is converted
     to a \l{QRegExp}.
 
     \section3 Lists
 
-    The QtWebKit bridge treats several types of lists in a special way: \l{QVariantList}, \l{QStringList},
+    The Qt WebKit bridge treats several types of lists in a special way: \l{QVariantList}, \l{QStringList},
     \l{QObjectList} and \l{QList}<int>. When a slot or property expects one of those list types,
-    the QtWebKit bridge tries to convert a JavaScript array into that type, converting each of
+    the Qt WebKit bridge tries to convert a JavaScript array into that type, converting each of
     the array's elements to the single-element type of the list.
 
     The most useful type of list is \l{QVariantList}, which can be converted to and from any
@@ -326,7 +326,7 @@
 
     \section3 QVariants
 
-    When a slot or property accepts a \l{QVariant}, the QtWebKit bridge creates a \l{QVariant} that best
+    When a slot or property accepts a \l{QVariant}, the Qt WebKit bridge creates a \l{QVariant} that best
     matches the argument passed by JavaScript. A string, for example, becomes a \l{QVariant} holding a \l{QString},
     a normal JSON object becomes a \l{QVariantMap}, and a JavaScript array becomes a \l{QVariantList}.
 
@@ -341,7 +341,7 @@
     Pointers to a \l{QObject} or a \l{QWidget} can be used in signals, slots and properties. This object
     can then be used like an object that is exposed directly. Its slots can be invoked, its signals connected to, etc.
     However, this functionality is fairly limited - the type used has to be \l{QObject}* or \l{QWidget}*. If the type
-    specified is a pointer to a non-\l{QWidget} subclass of \l{QObject}, the QtWebKit bridge does not recognize it as
+    specified is a pointer to a non-\l{QWidget} subclass of \l{QObject}, the Qt WebKit bridge does not recognize it as
     a \l{QObject}.
 
     In general its advised to use care when passing \l{QObject}s as arguments, as those objects don't become owned by
@@ -352,7 +352,7 @@
 
     \since 4.7
 
-    The QtWebKit bridge handles \l{QPixmap}s and \l{QImage}s in a special way. Since QtWebKit stores \l{QPixmap}s to
+    The Qt WebKit bridge handles \l{QPixmap}s and \l{QImage}s in a special way. Since Qt WebKit stores \l{QPixmap}s to
     represent HTML images, \l{QPixmap}s coming from the native environment can be used directly inside WebKit.
     A \l{QImage} or a \l{QPixmap} coming from Qt is converted to an intermediate JavaScript object,
     which can be represented like this:
@@ -374,7 +374,7 @@
     \snippet webkitsnippets/qtwebkit_bridge_snippets.cpp 3
 
     When a Qt object expects a \l{QImage} or a \l{QPixmap} as input, and the argument passed is an HTML image element,
-    the QtWebKit bridge would convert the pixmap assigned to that image element into a \l{QPixmap} or a \l{QImage}.
+    the Qt WebKit bridge would convert the pixmap assigned to that image element into a \l{QPixmap} or a \l{QImage}.
 
     \since 4.7
 
@@ -399,7 +399,7 @@
 
     \section2 Limiting the Scope of the Hybrid Layer
 
-    When using QtWebKit's hybrid features, it is a common pitfall to make the API exposed to JavaScript very rich and
+    When using Qt WebKit's hybrid features, it is a common pitfall to make the API exposed to JavaScript very rich and
     use all its features. This, however, leads to complexity and can create bugs that are hard to find.
     Instead, it is advisable to keep the hybrid layer small and manageable: create a gate only when
     there's an actual need for it, i.e. there's a new native enabler that requires a direct interface
diff --git a/Source/WebKit/qt/docs/qtwebkit-goes-mobile.qdoc b/Source/WebKit/qt/docs/qtwebkit-goes-mobile.qdoc
index 40144d18e..f1236b9c0 100644
--- a/Source/WebKit/qt/docs/qtwebkit-goes-mobile.qdoc
+++ b/Source/WebKit/qt/docs/qtwebkit-goes-mobile.qdoc
@@ -1,11 +1,11 @@
 /*!
     \inmodule QtWebKit
     \page qtwebkit-goes-mobile.html
-    \title QtWebKit Goes Mobile
-    \contentspage QtWebKit
+    \title Qt WebKit Goes Mobile
+    \contentspage Qt WebKit
     \section1 Overview
 
-    A lot of effort has been put into QtWebKit to make it attractive for
+    A lot of effort has been put into Qt WebKit to make it attractive for
     use on mobile devices.
 
     The goal of this tutorial is to help you understand the mobile
@@ -24,7 +24,7 @@
 
     Here we set up a \l{QGraphicsView} application and add a
     \l{QGraphicsWebView} to the scene. Notice
-    that we're disabling the scrollbars on the QGraphicsView because QtWebKit
+    that we're disabling the scrollbars on the QGraphicsView because Qt WebKit
     handles scrolling and scrollbars automatically. This is to allow scrolling
     optimizations and to enable web authors to interact with the scrollbars,
     for instance, to style them differently.
@@ -53,7 +53,7 @@
     One way to overcome this issue, is to do all loading, laying out and
     painting (basically all non-UI related work) in another thread or process, and
     just blit the result from the web process/thread to the UI. There is research
-    in progress to enable this for a future version of QtWebKit, using WebKit2, but for now,
+    in progress to enable this for a future version of Qt WebKit, using WebKit2, but for now,
     freezing the backing store can help when performing a zooming operation, for instance.
     This will be discussed later, in the \l{#Enabling the Tiling}{Enabling the Tiling} section.
 
@@ -125,7 +125,7 @@
     are written with a desktop browser in mind, that makes only very few sites
     fit into the width of a mobile device.
 
-    QtWebKit has a way to force a layout to a given width or height. What really
+    Qt WebKit has a way to force a layout to a given width or height. What really
     matters here is the width. If you lay out a page to a given width, it will get
     that width and images might be cropped. The width or height is also used for
     laying out fixed elements, but when we resize the \l{QGraphicsWebView} to the
@@ -149,7 +149,7 @@
     \section1 The 'viewport' Meta-Tag
 
     As some sites do not work with 960 pixels width or want to have control of
-    how the page is laid out, QtWebKit, Android, Firefox Mobile and
+    how the page is laid out, Qt WebKit, Android, Firefox Mobile and
     the iPhone Safari browser support a meta-tag called \c viewport. This makes
     it possible for a web page to let the browser know how it wants to be shown.
     More info can be found in the
diff --git a/Source/WebKit/qt/docs/qtwebkit.qdoc b/Source/WebKit/qt/docs/qtwebkit.qdoc
index 7d82714c6..aa471dfc4 100644
--- a/Source/WebKit/qt/docs/qtwebkit.qdoc
+++ b/Source/WebKit/qt/docs/qtwebkit.qdoc
@@ -32,7 +32,7 @@
 
 /*!
     \page qtwebkitwidgets-index.html
-    \title Qt Webkit Widgets
+    \title Qt WebKit Widgets
     \ingroup modules
 
     \brief The Qt WebKit Widgets module provides a web browser engine as well as
@@ -49,7 +49,7 @@
 
     A bridge between the JavaScript execution environment and the Qt object
     model makes it possible for custom QObjects to be scripted. For detailed
-    documentation see \l{The QtWebkit Bridge}.
+    documentation see \l{The Qt WebKit Bridge}.
     Integration with the Qt networking module enables Web pages to be transparently loaded
     from Web servers, the local file system or even the Qt resource system.
 
@@ -57,7 +57,7 @@
     made fully editable to the user through the use of the \c{contenteditable}
     attribute on HTML elements.
 
-    QtWebKit is based on the Open Source WebKit engine. More information about
+    Qt WebKit is based on the Open Source WebKit engine. More information about
     WebKit itself can be found on the \l{WebKit Open Source Project} Web site.
 
     \section1 Including In Your Project
@@ -74,10 +74,10 @@
 
     \section1 Notes
 
-    \note Building the QtWebKit module with debugging symbols is problematic
+    \note Building the Qt WebKit module with debugging symbols is problematic
     on many platforms due to the size of the WebKit engine. We recommend
     building the module only in release mode for embedded platforms.
-    Currently QtWebKit will always be compiled without debugging symbols
+    Currently Qt WebKit will always be compiled without debugging symbols
     when using gcc. Take a look at the last lines of
     \c{src/3rdparty/webkit/Source/WebCore/WebCore.pro} if you need to change this.
 
@@ -108,7 +108,7 @@
     may contain many child frames.
 
     Individual elements of an HTML document can be accessed via DOM JavaScript
-    interfaces from within a web page. The equivalent of this API in QtWebKit
+    interfaces from within a web page. The equivalent of this API in Qt WebKit
     is represented by QWebElement. QWebElement objects are obtained using QWebFrame's
     \l{QWebFrame::}{findAllElements()} and \l{QWebFrame::}{findFirstElement()}
     functions with CSS selector queries.
@@ -193,7 +193,7 @@
     can be found in the \c{src/3rdparty/webkit/VERSION} file supplied with Qt.
 
     Qt Commercial Edition licensees that wish to distribute applications that
-    use the QtWebKit module need to be aware of their obligations under the
+    use the Qt WebKit module need to be aware of their obligations under the
     GNU Library General Public License (LGPL).
 
     Developers using the Open Source Edition can choose to redistribute
diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 2853d600a..fbba56d6c 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -186,6 +186,9 @@ private Q_SLOTS:
     void renderOnRepaintRequestedShouldNotRecurse();
     void loadSignalsOrder_data();
     void loadSignalsOrder();
+    void openWindowDefaultSize();
+    void cssMediaTypeGlobalSetting();
+    void cssMediaTypePageSetting();
 
 #ifdef Q_OS_MAC
     void macCopyUnicodeToClipboard();
@@ -410,10 +413,13 @@ void tst_QWebPage::consoleOutput()
     QCOMPARE(page.lineNumbers.at(0), 1);
 }
 
-class TestPage : public QWebPage
-{
+class TestPage : public QWebPage {
+    Q_OBJECT
 public:
-    TestPage(QObject* parent = 0) : QWebPage(parent) {}
+    TestPage(QObject* parent = 0) : QWebPage(parent)
+    {
+        connect(this, SIGNAL(geometryChangeRequested(QRect)), this, SLOT(slotGeometryChangeRequested(QRect)));
+    }
 
     struct Navigation {
         QPointer<QWebFrame> frame;
@@ -422,7 +428,8 @@ public:
     };
 
     QList<Navigation> navigations;
-    QList<QWebPage*> createdWindows;
+    QList<TestPage*> createdWindows;
+    QRect requestedGeometry;
 
     virtual bool acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest &request, NavigationType type) {
         Navigation n;
@@ -434,10 +441,15 @@ public:
     }
 
     virtual QWebPage* createWindow(WebWindowType) {
-        QWebPage* page = new TestPage(this);
+        TestPage* page = new TestPage(this);
         createdWindows.append(page);
         return page;
     }
+
+private Q_SLOTS:
+    void slotGeometryChangeRequested(const QRect& geom) {
+        requestedGeometry = geom;
+    }
 };
 
 void tst_QWebPage::popupFormSubmission()
@@ -3253,5 +3265,83 @@ void tst_QWebPage::undoActionHaveCustomText()
     QVERIFY(typingActionText != alignActionText);
 }
 
+void tst_QWebPage::openWindowDefaultSize()
+{
+    TestPage page;
+    page.settings()->setAttribute(QWebSettings::JavascriptCanOpenWindows, true);
+    // Open a default window.
+    page.mainFrame()->evaluateJavaScript("window.open()");
+    // Open a too small window.
+    page.mainFrame()->evaluateJavaScript("window.open('', '', 'width=10,height=10')");
+
+    QTest::qWait(500);
+    // The number of popups created should be two.
+    QVERIFY(page.createdWindows.size() == 2);
+
+    QRect requestedGeometry = page.createdWindows[0]->requestedGeometry;
+    // Check default size has been requested.
+    QVERIFY(requestedGeometry.width() == 0);
+    QVERIFY(requestedGeometry.height() == 0);
+
+    requestedGeometry = page.createdWindows[1]->requestedGeometry;
+    // Check minimum size has been requested.
+    QVERIFY(requestedGeometry.width() == 100);
+    QVERIFY(requestedGeometry.height() == 100);
+}
+
+void tst_QWebPage::cssMediaTypeGlobalSetting()
+{
+    QString testHtml("<style>@media tv {body{background-color:red;}}@media handheld {body{background-color:green;}}@media screen {body{background-color:blue;}}</style>");
+    QSignalSpy loadSpy(m_view, SIGNAL(loadFinished(bool)));
+
+    QWebSettings::globalSettings()->setCSSMediaType("tv");
+    // Clear page specific setting to read from global setting
+    m_view->page()->settings()->setCSSMediaType(QString());
+    m_view->setHtml(testHtml);
+    QTRY_COMPARE(loadSpy.count(), 1);
+    QVERIFY(m_view->page()->mainFrame()->evaluateJavaScript("window.matchMedia('tv').matches == true").toBool()); 
+    QVERIFY(QWebSettings::globalSettings()->cssMediaType() == "tv");
+
+    QWebSettings::globalSettings()->setCSSMediaType("handheld");
+    // Clear page specific setting to read from global setting
+    m_view->page()->settings()->setCSSMediaType(QString());
+    m_view->setHtml(testHtml);
+    QTRY_COMPARE(loadSpy.count(), 2);
+    QVERIFY(m_view->page()->mainFrame()->evaluateJavaScript("window.matchMedia('handheld').matches == true").toBool());
+    QVERIFY(QWebSettings::globalSettings()->cssMediaType() == "handheld");
+
+    QWebSettings::globalSettings()->setCSSMediaType("screen");
+    // Clear page specific setting to read from global setting
+    m_view->page()->settings()->setCSSMediaType(QString());
+    m_view->setHtml(testHtml);
+    QTRY_COMPARE(loadSpy.count(), 3);
+    QVERIFY(m_view->page()->mainFrame()->evaluateJavaScript("window.matchMedia('screen').matches == true").toBool()); 
+    QVERIFY(QWebSettings::globalSettings()->cssMediaType() == "screen"); 
+}
+
+void tst_QWebPage::cssMediaTypePageSetting()
+{
+    QString testHtml("<style>@media tv {body{background-color:red;}}@media handheld {body{background-color:green;}}@media screen {body{background-color:blue;}}</style>");
+    QSignalSpy loadSpy(m_view, SIGNAL(loadFinished(bool)));
+
+    m_view->page()->settings()->setCSSMediaType("tv");
+    m_view->setHtml(testHtml);
+    QTRY_COMPARE(loadSpy.count(), 1);
+    QVERIFY(m_view->page()->mainFrame()->evaluateJavaScript("window.matchMedia('tv').matches == true").toBool()); 
+    QVERIFY(m_view->page()->settings()->cssMediaType() == "tv"); 
+
+    m_view->page()->settings()->setCSSMediaType("handheld");
+    m_view->setHtml(testHtml);
+    QTRY_COMPARE(loadSpy.count(), 2);
+    QVERIFY(m_view->page()->mainFrame()->evaluateJavaScript("window.matchMedia('handheld').matches == true").toBool());
+    QVERIFY(m_view->page()->settings()->cssMediaType() == "handheld");
+
+    m_view->page()->settings()->setCSSMediaType("screen");
+    m_view->setHtml(testHtml);
+    QTRY_COMPARE(loadSpy.count(), 3);
+    QVERIFY(m_view->page()->mainFrame()->evaluateJavaScript("window.matchMedia('screen').matches == true").toBool()); 
+    QVERIFY(m_view->page()->settings()->cssMediaType() == "screen"); 
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
index 62b53f901..47157464e 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
@@ -172,9 +172,9 @@ static String truncateToSingleLine(const String& string)
     }
     buffer[newLength++] = UChar('\n');
 
-    if (newLength == oldLength + 1)
-        return stringBuffer;
-    return String(stringBuffer.characters16(), newLength);
+    String result = (newLength == oldLength + 1) ? stringBuffer : String(stringBuffer.characters16(), newLength);
+    ASSERT(result.endsWith(UChar('\n')));
+    return result;
 }
 
 bool NetscapePluginModule::scanPlugin(const String& pluginPath)
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index bf742ad11..c3e372b54 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -2124,7 +2124,7 @@ void QQuickWebView::setAllowAnyHTTPSCertificateForLocalHost(bool allow)
 
     \row
     \li InternalErrorDomain
-    \li Content fails to be interpreted by QtWebKit.
+    \li Content fails to be interpreted by Qt WebKit.
 
     \row
     \li NetworkErrorDomain
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp
index 4c0ced289..17c18bd1a 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp
@@ -106,7 +106,7 @@ PassRefPtr<BitmapTexture> CoordinatedBackingStore::texture() const
 
 void CoordinatedBackingStore::setSize(const WebCore::FloatSize& size)
 {
-    m_size = size;
+    m_pendingSize = size;
 }
 
 static bool shouldShowTileDebugVisuals()
@@ -177,6 +177,11 @@ void CoordinatedBackingStore::paintToTextureMapper(TextureMapper* textureMapper,
 void CoordinatedBackingStore::commitTileOperations(TextureMapper* textureMapper)
 {
     HashSet<int>::iterator tilesToRemoveEnd = m_tilesToRemove.end();
+    if (!m_pendingSize.isZero()) {
+        m_size = m_pendingSize;
+        m_pendingSize = FloatSize();
+    }
+
     for (HashSet<int>::iterator it = m_tilesToRemove.begin(); it != tilesToRemoveEnd; ++it)
         m_tiles.remove(*it);
     m_tilesToRemove.clear();
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h
index 4038a3724..3b747372d 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h
@@ -77,6 +77,8 @@ private:
     HashSet<int> m_tilesToRemove;
     WebCore::FloatSize m_size;
     float m_scale;
+    // FIXME: m_pendingSize should be removed after the following bug is fixed: https://bugs.webkit.org/show_bug.cgi?id=108294
+    WebCore::FloatSize m_pendingSize;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
index 0e88379bf..6ed1b12fd 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
@@ -427,6 +427,7 @@ void LayerTreeRenderer::prepareContentBackingStore(GraphicsLayer* graphicsLayer)
     }
 
     createBackingStoreIfNeeded(graphicsLayer);
+    resetBackingStoreSizeToLayerSize(graphicsLayer);
 }
 
 void LayerTreeRenderer::createBackingStoreIfNeeded(GraphicsLayer* graphicsLayer)
@@ -448,7 +449,6 @@ void LayerTreeRenderer::createBackingStoreIfNeeded(GraphicsLayer* graphicsLayer)
         return; // The layer already has a backing store (and no pending removal).
 
     RefPtr<CoordinatedBackingStore> backingStore(CoordinatedBackingStore::create());
-    backingStore->setSize(graphicsLayer->size());
     ASSERT(!m_pendingSyncBackingStores.contains(layer));
     m_pendingSyncBackingStores.add(layer, backingStore);
 }
@@ -481,6 +481,7 @@ void LayerTreeRenderer::resetBackingStoreSizeToLayerSize(GraphicsLayer* graphics
     CoordinatedBackingStore* backingStore = getBackingStore(graphicsLayer);
     ASSERT(backingStore);
     backingStore->setSize(graphicsLayer->size());
+    m_backingStoresWithPendingBuffers.add(backingStore);
 }
 
 void LayerTreeRenderer::createTile(WebLayerID layerID, int tileID, float scale)
@@ -490,7 +491,6 @@ void LayerTreeRenderer::createTile(WebLayerID layerID, int tileID, float scale)
     CoordinatedBackingStore* backingStore = getBackingStore(layer);
     ASSERT(backingStore);
     backingStore->createTile(tileID, scale);
-    resetBackingStoreSizeToLayerSize(layer);
 }
 
 void LayerTreeRenderer::removeTile(WebLayerID layerID, int tileID)
@@ -502,7 +502,6 @@ void LayerTreeRenderer::removeTile(WebLayerID layerID, int tileID)
         return;
 
     backingStore->removeTile(tileID);
-    resetBackingStoreSizeToLayerSize(layer);
     m_backingStoresWithPendingBuffers.add(backingStore);
 }
 
@@ -513,7 +512,6 @@ void LayerTreeRenderer::updateTile(WebLayerID layerID, int tileID, const TileUpd
     RefPtr<CoordinatedBackingStore> backingStore = getBackingStore(layer);
     ASSERT(backingStore);
     backingStore->updateTile(tileID, update.sourceRect, update.tileRect, update.surface, update.offset);
-    resetBackingStoreSizeToLayerSize(layer);
     m_backingStoresWithPendingBuffers.add(backingStore);
 }
 
diff --git a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
index 0b6ee1bd5..75a7aa725 100644
--- a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
@@ -109,7 +109,7 @@ void QtWebProcess::setupChildProcess()
 
 void ProcessLauncher::launchProcess()
 {
-    QString commandLine = QLatin1String("%1 %2 %3");
+    QString commandLine = QLatin1String("%1 \"%2\" %3");
     if (m_launchOptions.processType == WebProcess) {
         QByteArray webProcessPrefix = qgetenv("QT_WEBKIT2_WP_CMD_PREFIX");
         commandLine = commandLine.arg(QLatin1String(webProcessPrefix.constData())).arg(QString(executablePathOfWebProcess()));
diff --git a/Source/WebKit2/UIProcess/Plugins/qt/PluginProcessProxyQt.cpp b/Source/WebKit2/UIProcess/Plugins/qt/PluginProcessProxyQt.cpp
index 8b4e3596f..cb4884d4c 100644
--- a/Source/WebKit2/UIProcess/Plugins/qt/PluginProcessProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/qt/PluginProcessProxyQt.cpp
@@ -208,7 +208,7 @@ bool PluginProcessProxy::scanPlugin(const String& pluginPath, RawPluginMetaData&
         String output(reinterpret_cast<const UChar*>(outputBytes.constData()), outputBytes.size() / sizeof(UChar));
         Vector<String> lines;
         output.split(UChar('\n'), true, lines);
-        ASSERT(lines.size() == 3);
+        ASSERT(lines.size() == 4 && lines.last().isEmpty());
 
         result.name.swap(lines[0]);
         result.description.swap(lines[1]);
diff --git a/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp b/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp
index 61f2aaf57..6351555cf 100644
--- a/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp
@@ -449,7 +449,7 @@ void PageViewportControllerClientQt::pinchGestureStarted(const QPointF& pinchCen
     // This can only happen as a result of a user interaction.
     ASSERT(m_controller->hadUserInteraction());
 
-    if (!m_controller->allowsUserScaling())
+    if (!m_controller->allowsUserScaling() || !m_viewportItem->isInteractive())
         return;
 
     clearRelativeZoomState();
@@ -461,11 +461,10 @@ void PageViewportControllerClientQt::pinchGestureStarted(const QPointF& pinchCen
 
 void PageViewportControllerClientQt::pinchGestureRequestUpdate(const QPointF& pinchCenterInViewportCoordinates, qreal totalScaleFactor)
 {
-    ASSERT(m_scaleChange.inProgress());
-
-    if (!m_controller->allowsUserScaling())
+    if (!m_controller->allowsUserScaling() || !m_viewportItem->isInteractive())
         return;
 
+    ASSERT(m_scaleChange.inProgress());
     ASSERT(m_pinchStartScale > 0);
     //  Changes of the center position should move the page even if the zoom factor does not change.
     const qreal pinchScale = m_pinchStartScale * totalScaleFactor;
@@ -483,11 +482,10 @@ void PageViewportControllerClientQt::pinchGestureRequestUpdate(const QPointF& pi
 
 void PageViewportControllerClientQt::pinchGestureEnded()
 {
-    ASSERT(m_scaleChange.inProgress());
-
-    if (!m_controller->allowsUserScaling())
+    if (m_pinchStartScale < 0)
         return;
 
+    ASSERT(m_scaleChange.inProgress());
     m_pinchStartScale = -1;
 
     // This will take care of resuming the content, even if no animation was performed.
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index b80613438..8176ed1cd 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -271,6 +271,9 @@ void QtWebPageEventHandler::handleSingleTapEvent(const QTouchEvent::TouchPoint&
 
 void QtWebPageEventHandler::handleDoubleTapEvent(const QTouchEvent::TouchPoint& point)
 {
+    if (!m_webView->isInteractive())
+        return;
+
     deactivateTapHighlight();
     QTransform fromItemTransform = m_webPage->transformFromItem();
     m_webPageProxy->findZoomableAreaForPoint(fromItemTransform.map(point.pos()).toPoint(), IntSize(point.rect().size().toSize()));
@@ -506,7 +509,6 @@ void QtWebPageEventHandler::handleInputEvent(const QInputEvent* event)
         m_isMouseButtonPressed = false;
         break;
     case QEvent::MouseButtonDblClick:
-        ASSERT_NOT_REACHED();
         return;
     default:
         break;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index f8efcbf40..849c1c1e9 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -367,6 +367,9 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     
     setMediaVolume(parameters.mediaVolume);
 
+    // We use the DidFirstLayout milestone to determine when to unfreeze the layer tree.
+    m_page->addLayoutMilestones(DidFirstLayout);
+
     WebProcess::shared().addMessageReceiver(Messages::WebPage::messageReceiverName(), m_pageID, this);
 
     // FIXME: This should be done in the object constructors, and the objects themselves should be message receivers.
diff --git a/Source/widgetsapi.pri b/Source/widgetsapi.pri
index 96db91589..50262742c 100644
--- a/Source/widgetsapi.pri
+++ b/Source/widgetsapi.pri
@@ -71,8 +71,33 @@ BASE_TARGET = $$TARGET
 
 load(qt_module)
 
-# Allow doing a debug-only build of WebKit (not supported by Qt)
-macx:!debug_and_release:debug: TARGET = $$BASE_TARGET
+# Make sure the install_name of the QtWebKit library point to webkit
+force_independent:macx {
+    # We do our own absolute path so that we can trick qmake into
+    # using the webkit build path instead of the Qt install path.
+    CONFIG -= absolute_library_soname
+    QMAKE_LFLAGS_SONAME = $$QMAKE_LFLAGS_SONAME$$WEBKIT_DESTDIR/
+
+    !debug_and_release|build_pass {
+        # We also have to make sure the install_name is correct when
+        # the library is installed.
+        change_install_name.depends = install_target
+
+        # The install rules generated by qmake for frameworks are busted in
+        # that both the debug and the release makefile copy QtWebKit.framework
+        # into the install dir, so whatever changes we did to the release library
+        # will get overwritten when the debug library is installed. We work around
+        # that by running install_name on both, for both configs.
+        change_install_name.commands = framework_dir=\$\$(dirname $(TARGETD)); \
+            for file in \$\$(ls $$[QT_INSTALL_LIBS]/\$\$framework_dir/$$BASE_TARGET*); do \
+                install_name_tool -id \$\$file \$\$file; \
+            done
+        default_install_target.target = install
+        default_install_target.depends += change_install_name
+
+        QMAKE_EXTRA_TARGETS += change_install_name default_install_target
+    }
+}
 
 SOURCES += \
     $$PWD/WebKit/qt/WidgetApi/qgraphicswebview.cpp \