Imported WebKit commit 3a8c29f35d00659d2ce7a0ccdfa8304f14e82327 (http://svn.webkit.org/repository/webkit/trunk@120813)

New snapshot with Windows build fixes

42 files changed, 766 insertions, 218 deletions

diff --git a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
index edae3aaeb..1f8d2faab 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
+++ b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
@@ -56,21 +56,22 @@
             'type': 'executable',
             'dependencies': [
                 '<(chromium_src_dir)/webkit/support/webkit_support.gyp:webkit_support_gfx',
-                '<(source_dir)/WTF/WTF.gyp/WTF.gyp:wtf',
             ],
             'include_dirs': [
-                '<(source_dir)/JavaScriptCore',
                 '<(DEPTH)',
             ],
             'sources': [
                 '<(tools_dir)/DumpRenderTree/chromium/ImageDiff.cpp',
             ],
             'conditions': [
-                ['OS=="android"', {
+                ['OS=="android" and android_build_type==0', {
                     # The Chromium Android port will compare images on host rather
                     # than target (a device or emulator) for performance reasons.
                     'toolsets': ['host'],
                 }],
+                ['OS=="android" and android_build_type!=0', {
+                    'type': 'none',
+                }],
             ],
         },
         {
@@ -95,7 +96,6 @@
             'include_dirs': [
                 '<(chromium_src_dir)',
                 '<(source_dir)/WebKit/chromium/public',
-                '<(source_dir)/JavaScriptCore',
                 '<(DEPTH)',
             ],
             'defines': [
@@ -243,7 +243,6 @@
                 ['OS=="android"', {
                     'type': 'shared_library',
                     'dependencies': [
-                        'ImageDiff#host',
                         '<(chromium_src_dir)/base/base.gyp:test_support_base',
                         '<(chromium_src_dir)/tools/android/forwarder/forwarder.gyp:forwarder',
                         '<(chromium_src_dir)/testing/android/native_test.gyp:native_test_native_code',
@@ -265,6 +264,11 @@
                         ['exclude', 'Android\\.cpp$'],
                     ],
                 }],
+                ['OS=="android" and android_build_type==0', {
+                    'dependencies': [
+                        'ImageDiff#host',
+                    ],
+                }],
                 ['inside_chromium_build==1 and component=="shared_library"', {
                     'sources': [
                         '<(source_dir)/WebKit/chromium/src/ChromiumCurrentTime.cpp',
@@ -403,38 +407,51 @@
         }],
         ['OS=="android"', {
             # Wrap libDumpRenderTree.so into an android apk for execution.
-            # See <(chromium_src_dir)/base/base.gyp for TODO(jrg)s about this strategy.
             'targets': [{
                 'target_name': 'DumpRenderTree_apk',
                 'type': 'none',
                 'dependencies': [
+                    '<(chromium_src_dir)/base/base.gyp:base_java',
+                    '<(chromium_src_dir)/net/net.gyp:net_java',
+                    '<(chromium_src_dir)/media/media.gyp:media_java',
                     'DumpRenderTree',
                 ],
+                'variables': {
+                    'input_shlib_path': '<(SHARED_LIB_DIR)/<(SHARED_LIB_PREFIX)DumpRenderTree<(SHARED_LIB_SUFFIX)',
+                    'input_jars_paths': [
+                        '<(PRODUCT_DIR)/lib.java/chromium_base.jar',
+                        '<(PRODUCT_DIR)/lib.java/chromium_net.jar',
+                        '<(PRODUCT_DIR)/lib.java/chromium_media.jar',
+                    ],
+                },
+                # Part of the following was copied from <(chromium_src_dir)/build/apk_test.gpyi.
+                # Not including it because gyp include doesn't support variable in path or under
+                # conditions. And we also have some different requirements.
                 'actions': [{
-                    # Generate apk files (including source and antfile) from
-                    # a template, and builds them.
-                    'action_name': 'generate_and_build',
+                    'action_name': 'apk_DumpRenderTree',
+                    'message': 'Building DumpRenderTree test apk.',
                     'inputs': [
+                        '<(chromium_src_dir)/testing/android/AndroidManifest.xml',
                         '<(chromium_src_dir)/testing/android/generate_native_test.py',
-                        '<(SHARED_LIB_DIR)/<(SHARED_LIB_PREFIX)DumpRenderTree<(SHARED_LIB_SUFFIX)',
-                        # FIXME: Build the jar for native tests with SDK.
-                        # For now we are using Android.mk to build the apk.
+                        '<(input_shlib_path)',
+                        '<@(input_jars_paths)',
                     ],
                     'outputs': [
-                        '<(PRODUCT_DIR)/DumpRenderTree_apk/ChromeNativeTests-debug.apk',
+                        '<(PRODUCT_DIR)/DumpRenderTree_apk/DumpRenderTree-debug.apk',
                     ],
                     'action': [
                         '<(chromium_src_dir)/testing/android/generate_native_test.py',
                         '--native_library',
-                        '<(SHARED_LIB_DIR)/<(SHARED_LIB_PREFIX)DumpRenderTree<(SHARED_LIB_SUFFIX)',
-                        # FIXME: Build the jar for native tests with SDK.
-                        # '--jar',
-                        # 'foo/bar.jar',
+                        '<(input_shlib_path)',
+                        '--jars',
+                        '"<@(input_jars_paths)"',
                         '--output',
                         '<(PRODUCT_DIR)/DumpRenderTree_apk',
                         '--ant-args',
                         '-DPRODUCT_DIR=<(ant_build_out)',
-                        '--ant-compile'
+                        '--ant-compile',
+                        '--app_abi',
+                        '<(android_app_abi)',
                     ],
                 }],
             }],
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gypi b/Tools/DumpRenderTree/DumpRenderTree.gypi
index e8d88be74..5412a199e 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gypi
+++ b/Tools/DumpRenderTree/DumpRenderTree.gypi
@@ -28,6 +28,8 @@
             'chromium/MockWebPrerenderingSupport.h',
             'chromium/MockWebSpeechInputController.cpp',
             'chromium/MockWebSpeechInputController.h',
+            'chromium/MockWebSpeechRecognizer.cpp',
+            'chromium/MockWebSpeechRecognizer.h',
             'chromium/NotificationPresenter.h',
             'chromium/NotificationPresenter.cpp',
             'chromium/Task.h',
diff --git a/Tools/DumpRenderTree/LayoutTestController.cpp b/Tools/DumpRenderTree/LayoutTestController.cpp
index 2fa80cf67..cd01d1c3b 100644
--- a/Tools/DumpRenderTree/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/LayoutTestController.cpp
@@ -96,6 +96,7 @@ LayoutTestController::LayoutTestController(const std::string& testPathOrURL, con
     , m_customFullScreenBehavior(false) 
     , m_testPathOrURL(testPathOrURL)
     , m_expectedPixelHash(expectedPixelHash)
+    , m_titleTextDirection("ltr")
 {
 }
 
@@ -662,22 +663,6 @@ static JSValueRef findStringCallback(JSContextRef context, JSObjectRef function,
     return JSValueMakeBoolean(context, controller->findString(context, target.get(), options));
 }
 
-static JSValueRef counterValueForElementByIdCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(context);
-
-    JSRetainPtr<JSStringRef> elementId(Adopt, JSValueToStringCopy(context, arguments[0], exception));
-    if (*exception)
-        return JSValueMakeUndefined(context);
-
-    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    JSRetainPtr<JSStringRef> counterValue(controller->counterValueForElementById(elementId.get()));
-    if (!counterValue.get())
-        return JSValueMakeUndefined(context);
-    return JSValueMakeString(context, counterValue.get());
-}
-
 static JSValueRef goBackCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -2174,6 +2159,13 @@ static JSValueRef getPlatformNameCallback(JSContextRef context, JSObjectRef this
 }
 #endif
 
+static JSValueRef getTitleTextDirectionCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> titleDirection(Adopt, JSStringCreateWithUTF8CString(controller->titleTextDirection().c_str()));
+    return JSValueMakeString(context, titleDirection.get());
+}
+
 static bool setGlobalFlagCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -2244,6 +2236,8 @@ static void layoutTestControllerObjectFinalize(JSObjectRef object)
 void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> layoutTestContollerStr(Adopt, JSStringCreateWithUTF8CString("layoutTestController"));
+    JSRetainPtr<JSStringRef> testRunnerStr(Adopt, JSStringCreateWithUTF8CString("testRunner"));
+    ref();
     ref();
 
     JSClassRef classRef = getJSClass();
@@ -2251,6 +2245,7 @@ void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef wi
     JSClassRelease(classRef);
 
     JSObjectSetProperty(context, windowObject, layoutTestContollerStr.get(), layoutTestContollerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
+    JSObjectSetProperty(context, windowObject, testRunnerStr.get(), layoutTestContollerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
 JSClassRef LayoutTestController::getJSClass()
@@ -2274,6 +2269,7 @@ JSStaticValue* LayoutTestController::staticValues()
 #if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(WIN)
         { "platformName", getPlatformNameCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
 #endif
+        { "titleTextDirection", getTitleTextDirectionCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0, 0 }
     };
     return staticValues;
@@ -2332,7 +2328,6 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "evaluateScriptInIsolatedWorld", evaluateScriptInIsolatedWorldCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "execCommand", execCommandCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "findString", findStringCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "counterValueForElementById", counterValueForElementByIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "originsWithApplicationCache", originsWithApplicationCacheCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "goBack", goBackCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
         { "grantDesktopNotificationPermission", grantDesktopNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
diff --git a/Tools/DumpRenderTree/LayoutTestController.h b/Tools/DumpRenderTree/LayoutTestController.h
index 640d1c1d4..54ca9278a 100644
--- a/Tools/DumpRenderTree/LayoutTestController.h
+++ b/Tools/DumpRenderTree/LayoutTestController.h
@@ -56,7 +56,6 @@ public:
     bool callShouldCloseOnWebView();
     JSStringRef copyDecodedHostName(JSStringRef name);
     JSStringRef copyEncodedHostName(JSStringRef name);
-    JSRetainPtr<JSStringRef> counterValueForElementById(JSStringRef id);
     void deliverWebIntent(JSStringRef action, JSStringRef type, JSStringRef data);
     void disableImageLoading();
     void dispatchPendingLoadRequests();
@@ -360,6 +359,8 @@ public:
     void setMinimumTimerInterval(double);
 
     void setTextDirection(JSStringRef);
+    const std::string& titleTextDirection() const { return m_titleTextDirection; }
+    void setTitleTextDirection(const std::string& direction) { m_titleTextDirection = direction; }
 
     // Custom full screen behavior.
     void setHasCustomFullScreenBehavior(bool value) { m_customFullScreenBehavior = value; }
@@ -424,6 +425,7 @@ private:
     std::string m_authenticationPassword; 
     std::string m_testPathOrURL;
     std::string m_expectedPixelHash;    // empty string if no hash
+    std::string m_titleTextDirection;
 
     std::set<std::string> m_willSendRequestClearHeaders;
     
diff --git a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
index 4f043d962..ceadb7a63 100644
--- a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
+++ b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
@@ -429,21 +429,6 @@ void LayoutTestController::disableImageLoading()
     BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setLoadsImagesAutomatically(false);
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
-{
-    String idStr = jsStringRefToWebCoreString(id);
-    WebCore::Element* coreElement = mainFrame->document()->getElementById(AtomicString(idStr));
-    if (!coreElement)
-        return 0;
-
-    CString counterValueStr = counterValueForElement(coreElement).utf8();
-    if (counterValueStr.isNull())
-        return 0;
-
-    JSRetainPtr<JSStringRef> counterValue(Adopt, JSStringCreateWithUTF8CString(counterValueStr.data()));
-    return counterValue;
-}
-
 void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value)
 {
     if (!mainFrame)
diff --git a/Tools/DumpRenderTree/chromium/EventSender.cpp b/Tools/DumpRenderTree/chromium/EventSender.cpp
index 05e4eb83f..47bec2a71 100644
--- a/Tools/DumpRenderTree/chromium/EventSender.cpp
+++ b/Tools/DumpRenderTree/chromium/EventSender.cpp
@@ -287,6 +287,7 @@ EventSender::EventSender(TestShell* shell)
     bindMethod("gestureScrollUpdate", &EventSender::gestureScrollUpdate);
     bindMethod("gestureTap", &EventSender::gestureTap);
     bindMethod("gestureLongPress", &EventSender::gestureLongPress);
+    bindMethod("gestureTwoFingerTap", &EventSender::gestureTwoFingerTap);
     bindMethod("zoomPageIn", &EventSender::zoomPageIn);
     bindMethod("zoomPageOut", &EventSender::zoomPageOut);
     bindMethod("scalePageBy", &EventSender::scalePageBy);
@@ -1117,6 +1118,12 @@ void EventSender::gestureLongPress(const CppArgumentList& arguments, CppVariant*
     gestureEvent(WebInputEvent::GestureLongPress, arguments);
 }
 
+void EventSender::gestureTwoFingerTap(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    gestureEvent(WebInputEvent::GestureTwoFingerTap, arguments);
+}
+
 void EventSender::gestureScrollFirstPoint(const CppArgumentList& arguments, CppVariant* result)
 {
     result->setNull();
@@ -1170,6 +1177,10 @@ void EventSender::gestureEvent(WebInputEvent::Type type, const CppArgumentList&
         event.x = point.x;
         event.y = point.y;
         break;
+    case WebInputEvent::GestureTwoFingerTap:
+        event.x = point.x;
+        event.y = point.y;
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
diff --git a/Tools/DumpRenderTree/chromium/EventSender.h b/Tools/DumpRenderTree/chromium/EventSender.h
index bc8a6baa0..9de2f760b 100644
--- a/Tools/DumpRenderTree/chromium/EventSender.h
+++ b/Tools/DumpRenderTree/chromium/EventSender.h
@@ -105,6 +105,7 @@ public:
     void gestureScrollUpdate(const CppArgumentList&, CppVariant*);
     void gestureTap(const CppArgumentList&, CppVariant*);
     void gestureLongPress(const CppArgumentList&, CppVariant*);
+    void gestureTwoFingerTap(const CppArgumentList&, CppVariant*);
     void gestureEvent(WebKit::WebInputEvent::Type, const CppArgumentList&);
 
     // Unimplemented stubs
diff --git a/Tools/DumpRenderTree/chromium/ImageDiff.cpp b/Tools/DumpRenderTree/chromium/ImageDiff.cpp
index 966554bab..906813d9c 100644
--- a/Tools/DumpRenderTree/chromium/ImageDiff.cpp
+++ b/Tools/DumpRenderTree/chromium/ImageDiff.cpp
@@ -34,8 +34,6 @@
 // The exact format of this tool's output to stdout is important, to match
 // what the run-webkit-tests script expects.
 
-#include "config.h"
-
 #include "webkit/support/webkit_support_gfx.h"
 #include <algorithm>
 #include <iterator>
@@ -44,12 +42,13 @@
 #include <string.h>
 #include <vector>
 
-#if OS(WINDOWS)
+#if defined(_WIN32)
 #include <windows.h>
 #define PATH_MAX MAX_PATH
+#define strtok_r strtok_s
 #endif
 
-// Define macro here to make ImageDiff independent of JavaScriptCore.
+// Define macro here to make ImageDiff independent of WTF.
 #ifdef NDEBUG
 #define ASSERT(assertion) do { } while (0)
 #else
@@ -342,13 +341,8 @@ int untestedCompareImages(ImageComparisonProc comparator)
     while (fgets(buffer, sizeof(buffer), stdin)) {
         if (!strncmp("Content-length: ", buffer, 16)) {
             char* context;
-#if OS(WINDOWS)
-            strtok_s(buffer, " ", &context);
-            int imageSize = strtol(strtok_s(0, " ", &context), 0, 10);
-#else
             strtok_r(buffer, " ", &context);
             int imageSize = strtol(strtok_r(0, " ", &context), 0, 10);
-#endif
 
             bool success = false;
             if (imageSize > 0 && !actualImage.hasImage()) {
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
index c739143e0..120197e25 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -34,6 +34,7 @@
 
 #include "DRTDevToolsAgent.h"
 #include "MockWebSpeechInputController.h"
+#include "MockWebSpeechRecognizer.h"
 #include "TestShell.h"
 #include "WebAnimationController.h"
 #include "WebBindings.h"
@@ -77,6 +78,10 @@
 #include <wtf/OwnArrayPtr.h>
 #endif
 
+#if OS(LINUX) || OS(ANDROID)
+#include "linux/WebFontRendering.h"
+#endif
+
 using namespace WebCore;
 using namespace WebKit;
 using namespace std;
@@ -110,12 +115,15 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("addMockSpeechInputResult", &LayoutTestController::addMockSpeechInputResult);
     bindMethod("setMockSpeechInputDumpRect", &LayoutTestController::setMockSpeechInputDumpRect);
 #endif
+#if ENABLE(SCRIPTED_SPEECH)
+    bindMethod("addMockSpeechRecognitionResult", &LayoutTestController::addMockSpeechRecognitionResult);
+    bindMethod("setMockSpeechRecognitionError", &LayoutTestController::setMockSpeechRecognitionError);
+#endif
     bindMethod("addOriginAccessWhitelistEntry", &LayoutTestController::addOriginAccessWhitelistEntry);
     bindMethod("addUserScript", &LayoutTestController::addUserScript);
     bindMethod("addUserStyleSheet", &LayoutTestController::addUserStyleSheet);
     bindMethod("clearAllDatabases", &LayoutTestController::clearAllDatabases);
     bindMethod("closeWebInspector", &LayoutTestController::closeWebInspector);
-    bindMethod("counterValueForElementById", &LayoutTestController::counterValueForElementById);
 #if ENABLE(POINTER_LOCK)
     bindMethod("didLosePointerLock", &LayoutTestController::didLosePointerLock);
 #endif
@@ -211,6 +219,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setPrinting", &LayoutTestController::setPrinting);
     bindMethod("setScrollbarPolicy", &LayoutTestController::setScrollbarPolicy);
     bindMethod("setSelectTrailingWhitespaceEnabled", &LayoutTestController::setSelectTrailingWhitespaceEnabled);
+    bindMethod("setTextSubpixelPositioning", &LayoutTestController::setTextSubpixelPositioning);
     bindMethod("setSmartInsertDeleteEnabled", &LayoutTestController::setSmartInsertDeleteEnabled);
     bindMethod("setStopProvisionalFrameLoads", &LayoutTestController::setStopProvisionalFrameLoads);
     bindMethod("setTabKeyCyclesThroughElements", &LayoutTestController::setTabKeyCyclesThroughElements);
@@ -692,6 +701,9 @@ void LayoutTestController::reset()
     m_taskList.revokeAll();
     m_shouldStayOnPageAfterHandlingBeforeUnload = false;
     m_hasCustomFullScreenBehavior = false;
+#if OS(LINUX) || OS(ANDROID)
+    WebFontRendering::setSubpixelPositioning(false);
+#endif
 }
 
 void LayoutTestController::locationChangeDone()
@@ -1644,20 +1656,6 @@ void LayoutTestController::setPOSIXLocale(const CppArgumentList& arguments, CppV
         setlocale(LC_ALL, arguments[0].toString().c_str());
 }
 
-void LayoutTestController::counterValueForElementById(const CppArgumentList& arguments, CppVariant* result)
-{
-    result->setNull();
-    if (arguments.size() < 1 || !arguments[0].isString())
-        return;
-    WebFrame* frame = m_shell->webView()->mainFrame();
-    if (!frame)
-        return;
-    WebString counterValue = frame->counterValueForElementById(cppVariantToWebString(arguments[0]));
-    if (counterValue.isNull())
-        return;
-    result->set(counterValue.utf8());
-}
-
 // Parse a single argument. The method returns true if there is an argument that
 // is a number or if there is no argument at all. It returns false only if there
 // is some argument that is not a number. The value parameter is filled with the
@@ -1874,7 +1872,15 @@ void LayoutTestController::setMockDeviceOrientation(const CppArgumentList& argum
     if (arguments.size() < 6 || !arguments[0].isBool() || !arguments[1].isNumber() || !arguments[2].isBool() || !arguments[3].isNumber() || !arguments[4].isBool() || !arguments[5].isNumber())
         return;
 
-    WebDeviceOrientation orientation(arguments[0].toBoolean(), arguments[1].toDouble(), arguments[2].toBoolean(), arguments[3].toDouble(), arguments[4].toBoolean(), arguments[5].toDouble());
+    WebDeviceOrientation orientation;
+    orientation.setNull(false);
+    if (arguments[0].toBoolean())
+        orientation.setAlpha(arguments[1].toDouble());
+    if (arguments[2].toBoolean())
+        orientation.setBeta(arguments[3].toDouble());
+    if (arguments[4].toBoolean())
+        orientation.setGamma(arguments[5].toDouble());
+
     // Note that we only call setOrientation on the main page's mock since this is all that the
     // tests require. If necessary, we could get a list of WebViewHosts from the TestShell and
     // call setOrientation on each DeviceOrientationClientMock.
@@ -1940,6 +1946,28 @@ void LayoutTestController::setMockSpeechInputDumpRect(const CppArgumentList& arg
 }
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+void LayoutTestController::addMockSpeechRecognitionResult(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    if (arguments.size() < 2 || !arguments[0].isString() || !arguments[1].isNumber())
+        return;
+
+    if (MockWebSpeechRecognizer* recognizer = m_shell->webViewHost()->mockSpeechRecognizer())
+        recognizer->addMockResult(cppVariantToWebString(arguments[0]), arguments[1].toDouble());
+}
+
+void LayoutTestController::setMockSpeechRecognitionError(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    if (arguments.size() < 2 || !arguments[0].isNumber() || !arguments[1].isString())
+        return;
+
+    if (MockWebSpeechRecognizer* recognizer = m_shell->webViewHost()->mockSpeechRecognizer())
+        recognizer->setError(arguments[0].toInt32(), cppVariantToWebString(arguments[1]));
+}
+#endif
+
 void LayoutTestController::startSpeechInput(const CppArgumentList& arguments, CppVariant* result)
 {
     result->setNull();
@@ -2159,9 +2187,20 @@ void LayoutTestController::deliverWebIntent(const CppArgumentList& arguments, Cp
     WebSerializedScriptValue serializedData = WebSerializedScriptValue::serialize(
         v8::String::New(data.data(), data.length()));
 
-    WebIntent intent(action, type, serializedData.toString());
+    WebIntent intent = WebIntent::create(action, type, serializedData.toString(), WebVector<WebString>(), WebVector<WebString>());
+
+    m_shell->webView()->mainFrame()->deliverIntent(intent, 0, m_intentClient.get());
+}
 
-    m_shell->webView()->mainFrame()->deliverIntent(intent, m_intentClient.get());
+void LayoutTestController::setTextSubpixelPositioning(const CppArgumentList& arguments, CppVariant* result)
+{
+#if OS(LINUX) || OS(ANDROID)
+    // Since FontConfig doesn't provide a variable to control subpixel positioning, we'll fall back
+    // to setting it globally for all fonts.
+    if (arguments.size() > 0 && arguments[0].isBool())
+        WebFontRendering::setSubpixelPositioning(arguments[0].value.boolValue);
+#endif
+    result->setNull();
 }
 
 void LayoutTestController::setPluginsEnabled(const CppArgumentList& arguments, CppVariant* result)
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.h b/Tools/DumpRenderTree/chromium/LayoutTestController.h
index 37978657e..5a8729388 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.h
@@ -324,9 +324,6 @@ public:
     // Resets between tests.
     void setPOSIXLocale(const CppArgumentList&, CppVariant*);
 
-    // Gets the value of the counter in the element specified by its ID.
-    void counterValueForElementById(const CppArgumentList&, CppVariant*);
-
     // Causes layout to happen as if targetted to printed pages.
     void setPrinting(const CppArgumentList&, CppVariant*);
 
@@ -375,6 +372,10 @@ public:
     void addMockSpeechInputResult(const CppArgumentList&, CppVariant*);
     void setMockSpeechInputDumpRect(const CppArgumentList&, CppVariant*);
 #endif
+#if ENABLE(SCRIPTED_SPEECH)
+    void addMockSpeechRecognitionResult(const CppArgumentList&, CppVariant*);
+    void setMockSpeechRecognitionError(const CppArgumentList&, CppVariant*);
+#endif
     void startSpeechInput(const CppArgumentList&, CppVariant*);
 
     void layerTreeAsText(const CppArgumentList& args, CppVariant* result);
@@ -444,6 +445,13 @@ public:
     // Cause the web intent to be delivered to this context.
     void deliverWebIntent(const CppArgumentList&, CppVariant*);
 
+    // Enables or disables subpixel positioning (i.e. fractional X positions for
+    // glyphs) in text rendering on Linux. Since this method changes global
+    // settings, tests that call it must use their own custom font family for
+    // all text that they render. If not, an already-cached style will be used,
+    // resulting in the changed setting being ignored.
+    void setTextSubpixelPositioning(const CppArgumentList&, CppVariant*);
+
 public:
     // The following methods are not exposed to JavaScript.
     void setWorkQueueFrozen(bool frozen) { m_workQueue.setFrozen(frozen); }
diff --git a/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp
new file mode 100644
index 000000000..b53e1701f
--- /dev/null
+++ b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MockWebSpeechRecognizer.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "WebSpeechRecognitionResult.h"
+#include "WebSpeechRecognizerClient.h"
+
+using namespace WebKit;
+
+namespace {
+
+// Task class for calling a client function that does not take any parameters.
+typedef void (WebSpeechRecognizerClient::*ClientFunctionPointer)(const WebSpeechRecognitionHandle&);
+class ClientCallTask : public MethodTask<MockWebSpeechRecognizer> {
+public:
+    ClientCallTask(MockWebSpeechRecognizer* mock, ClientFunctionPointer function)
+        : MethodTask<MockWebSpeechRecognizer>(mock)
+        , m_function(function)
+    {
+    }
+
+    virtual void runIfValid() OVERRIDE { (m_object->client()->*m_function)(m_object->handle()); }
+
+private:
+    ClientFunctionPointer m_function;
+};
+
+// Task for delivering a result event.
+class ResultTask : public MethodTask<MockWebSpeechRecognizer> {
+public:
+    ResultTask(MockWebSpeechRecognizer* mock, const WebString transcript, float confidence)
+        : MethodTask<MockWebSpeechRecognizer>(mock)
+        , m_transcript(transcript)
+        , m_confidence(confidence)
+    {
+    }
+
+    virtual void runIfValid() OVERRIDE
+    {
+        WebVector<WebString> transcripts(static_cast<size_t>(1));
+        WebVector<float> confidences(static_cast<size_t>(1));
+        transcripts[0] = m_transcript;
+        confidences[0] = m_confidence;
+        WebSpeechRecognitionResult res;
+        res.assign(transcripts, confidences, true);
+
+        m_object->client()->didReceiveResult(m_object->handle(), res, 0, WebVector<WebSpeechRecognitionResult>());
+    }
+
+private:
+    WebString m_transcript;
+    float m_confidence;
+};
+
+// Task for delivering a nomatch event.
+class NoMatchTask : public MethodTask<MockWebSpeechRecognizer> {
+public:
+    NoMatchTask(MockWebSpeechRecognizer* mock) : MethodTask<MockWebSpeechRecognizer>(mock) { }
+    virtual void runIfValid() OVERRIDE { m_object->client()->didReceiveNoMatch(m_object->handle(), WebSpeechRecognitionResult()); }
+};
+
+// Task for delivering an error event.
+class ErrorTask : public MethodTask<MockWebSpeechRecognizer> {
+public:
+    ErrorTask(MockWebSpeechRecognizer* mock, int code, const WebString& message)
+        : MethodTask<MockWebSpeechRecognizer>(mock)
+        , m_code(code)
+        , m_message(message)
+    {
+    }
+
+    virtual void runIfValid() OVERRIDE { m_object->client()->didReceiveError(m_object->handle(), m_message, static_cast<WebSpeechRecognizerClient::ErrorCode>(m_code)); }
+
+private:
+    int m_code;
+    WebString m_message;
+};
+
+} // namespace
+
+PassOwnPtr<MockWebSpeechRecognizer> MockWebSpeechRecognizer::create()
+{
+    return adoptPtr(new MockWebSpeechRecognizer());
+}
+
+void MockWebSpeechRecognizer::start(const WebSpeechRecognitionHandle& handle, const WebSpeechRecognitionParams& params, WebSpeechRecognizerClient* client)
+{
+    m_handle = handle;
+    m_client = client;
+
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didStart));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didStartAudio));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didStartSound));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didStartSpeech));
+
+    if (!m_mockTranscripts.isEmpty()) {
+        ASSERT(m_mockTranscripts.size() == m_mockConfidences.size());
+
+        for (size_t i = 0; i < m_mockTranscripts.size(); ++i)
+            postTask(new ResultTask(this, m_mockTranscripts[i], m_mockConfidences[i]));
+
+        m_mockTranscripts.clear();
+        m_mockConfidences.clear();
+    } else
+        postTask(new NoMatchTask(this));
+
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didEndSpeech));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didEndSound));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didEndAudio));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didEnd));
+}
+
+void MockWebSpeechRecognizer::stop(const WebSpeechRecognitionHandle& handle, WebSpeechRecognizerClient* client)
+{
+    m_handle = handle;
+    m_client = client;
+
+    // FIXME: Implement.
+    ASSERT_NOT_REACHED();
+}
+
+void MockWebSpeechRecognizer::abort(const WebSpeechRecognitionHandle& handle, WebSpeechRecognizerClient* client)
+{
+    m_handle = handle;
+    m_client = client;
+
+    // FIXME: Implement.
+    ASSERT_NOT_REACHED();
+}
+
+void MockWebSpeechRecognizer::addMockResult(const WebString& transcript, float confidence)
+{
+    m_mockTranscripts.append(transcript);
+    m_mockConfidences.append(confidence);
+}
+
+void MockWebSpeechRecognizer::setError(int code, const WebString& message)
+{
+    m_taskList.revokeAll();
+    postTask(new ErrorTask(this, code, message));
+    postTask(new ClientCallTask(this, &WebSpeechRecognizerClient::didEnd));
+}
+
+MockWebSpeechRecognizer::MockWebSpeechRecognizer()
+{
+}
+
+MockWebSpeechRecognizer::~MockWebSpeechRecognizer()
+{
+}
+
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h
new file mode 100644
index 000000000..939497686
--- /dev/null
+++ b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MockWebSpeechRecognizer_h
+#define MockWebSpeechRecognizer_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "Task.h"
+#include "WebSpeechRecognizer.h"
+#include <wtf/Compiler.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebKit {
+class WebSpeechRecognitionHandle;
+class WebSpeechRecognitionParams;
+class WebSpeechRecognizerClient;
+}
+
+class MockWebSpeechRecognizer : public WebKit::WebSpeechRecognizer {
+public:
+    static PassOwnPtr<MockWebSpeechRecognizer> create();
+    ~MockWebSpeechRecognizer();
+
+    // WebSpeechRecognizer implementation:
+    virtual void start(const WebKit::WebSpeechRecognitionHandle&, const WebKit::WebSpeechRecognitionParams&, WebKit::WebSpeechRecognizerClient*) OVERRIDE;
+    virtual void stop(const WebKit::WebSpeechRecognitionHandle&, WebKit::WebSpeechRecognizerClient*) OVERRIDE;
+    virtual void abort(const WebKit::WebSpeechRecognitionHandle&, WebKit::WebSpeechRecognizerClient*) OVERRIDE;
+
+    // Methods accessed by layout tests:
+    void addMockResult(const WebKit::WebString& transcript, float confidence);
+    void setError(int code, const WebKit::WebString& message);
+
+    TaskList* taskList() { return &m_taskList; }
+    WebKit::WebSpeechRecognizerClient* client() { return m_client; }
+    WebKit::WebSpeechRecognitionHandle& handle() { return m_handle; }
+
+private:
+    MockWebSpeechRecognizer();
+
+    TaskList m_taskList;
+    WebKit::WebSpeechRecognitionHandle m_handle;
+    WebKit::WebSpeechRecognizerClient* m_client;
+    Vector<WebKit::WebString> m_mockTranscripts;
+    Vector<float> m_mockConfidences;
+};
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // MockWebSpeechRecognizer_h
diff --git a/Tools/DumpRenderTree/chromium/TestShell.cpp b/Tools/DumpRenderTree/chromium/TestShell.cpp
index 9b9ca4a5b..b8323a39b 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShell.cpp
@@ -114,7 +114,6 @@ TestShell::TestShell()
     , m_accelerated2dCanvasEnabled(false)
     , m_deferred2dCanvasEnabled(false)
     , m_acceleratedPaintingEnabled(false)
-    , m_perTilePaintingEnabled(false)
     , m_stressOpt(false)
     , m_stressDeopt(false)
     , m_dumpWhenFinished(true)
@@ -231,7 +230,6 @@ void TestShell::resetWebSettings(WebView& webView)
     m_prefs.accelerated2dCanvasEnabled = m_accelerated2dCanvasEnabled;
     m_prefs.deferred2dCanvasEnabled = m_deferred2dCanvasEnabled;
     m_prefs.acceleratedPaintingEnabled = m_acceleratedPaintingEnabled;
-    m_prefs.perTilePaintingEnabled = m_perTilePaintingEnabled;
     m_prefs.applyTo(&webView);
 }
 
@@ -377,6 +375,11 @@ void TestShell::testTimedOut()
     testFinished();
 }
 
+void TestShell::setPerTilePaintingEnabled(bool enabled)
+{
+    WebCompositor::setPerTilePaintingEnabled(enabled);
+}
+
 static string dumpDocumentText(WebFrame* frame)
 {
     // We use the document element's text instead of the body text here because
@@ -726,6 +729,7 @@ void TestShell::bindJSObjectsToWindow(WebFrame* frame)
     m_accessibilityController->bindToJavascript(frame, WebString::fromUTF8("accessibilityController"));
     m_gamepadController->bindToJavascript(frame, WebString::fromUTF8("gamepadController"));
     m_layoutTestController->bindToJavascript(frame, WebString::fromUTF8("layoutTestController"));
+    m_layoutTestController->bindToJavascript(frame, WebString::fromUTF8("testRunner"));
     m_eventSender->bindToJavascript(frame, WebString::fromUTF8("eventSender"));
     m_textInputController->bindToJavascript(frame, WebString::fromUTF8("textInputController"));
 }
diff --git a/Tools/DumpRenderTree/chromium/TestShell.h b/Tools/DumpRenderTree/chromium/TestShell.h
index ae9d8d8a1..8ae0c2421 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.h
+++ b/Tools/DumpRenderTree/chromium/TestShell.h
@@ -142,7 +142,7 @@ public:
     void setAccelerated2dCanvasEnabled(bool enabled) { m_accelerated2dCanvasEnabled = enabled; }
     void setDeferred2dCanvasEnabled(bool enabled) { m_deferred2dCanvasEnabled = enabled; }
     void setAcceleratedPaintingEnabled(bool enabled) { m_acceleratedPaintingEnabled = enabled; }
-    void setPerTilePaintingEnabled(bool enabled) { m_perTilePaintingEnabled = enabled; }
+    void setPerTilePaintingEnabled(bool);
 #if defined(OS_WIN)
     // Access to the finished event. Used by the static WatchDog thread.
     HANDLE finishedEvent() { return m_finishedEvent; }
diff --git a/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp b/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
index e77d80d48..ba182bbbb 100644
--- a/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "TestShell.h"
 
+#include "linux/WebFontRendering.h"
 #include <android/log.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -127,4 +128,8 @@ void platformInit(int* argc, char*** argv)
         // Redirect stderr to stdout.
         dup2(1, 2);
     }
+
+    // Disable auto hint and use normal hinting in layout test mode to produce the same font metrics as chromium-linux.
+    WebKit::WebFontRendering::setAutoHint(false);
+    WebKit::WebFontRendering::setHinting(SkPaint::kNormal_Hinting);
 }
diff --git a/Tools/DumpRenderTree/chromium/TestWebPlugin.h b/Tools/DumpRenderTree/chromium/TestWebPlugin.h
index 8581288ac..4c9f2f4d2 100644
--- a/Tools/DumpRenderTree/chromium/TestWebPlugin.h
+++ b/Tools/DumpRenderTree/chromium/TestWebPlugin.h
@@ -68,6 +68,7 @@ public:
     virtual void didFailLoading(const WebKit::WebURLError&) { }
     virtual void didFinishLoadingFrameRequest(const WebKit::WebURL&, void* notifyData) { }
     virtual void didFailLoadingFrameRequest(const WebKit::WebURL&, void* notifyData, const WebKit::WebURLError&) { }
+    virtual bool isPlaceholder() { return false; }
 
 private:
     enum Primitive {
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.cpp b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
index 3227c0231..751dfeeb5 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -117,7 +117,6 @@ void WebPreferences::reset()
     acceleratedPaintingEnabled = false;
     forceCompositingMode = false;
     hixie76WebSocketProtocolEnabled = true;
-    perTilePaintingEnabled = false;
     mockScrollbarsEnabled = false;
     cssCustomFilterEnabled = false;
 }
@@ -226,7 +225,6 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setDeferred2dCanvasEnabled(deferred2dCanvasEnabled);
     settings->setAcceleratedPaintingEnabled(acceleratedPaintingEnabled);
     settings->setHixie76WebSocketProtocolEnabled(hixie76WebSocketProtocolEnabled);
-    settings->setPerTilePaintingEnabled(perTilePaintingEnabled);
     settings->setMockScrollbarsEnabled(mockScrollbarsEnabled);
 
     // Fixed values.
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.h b/Tools/DumpRenderTree/chromium/WebPreferences.h
index 31de331ed..6e951feb3 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.h
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.h
@@ -110,7 +110,6 @@ struct WebPreferences {
     bool deferred2dCanvasEnabled;
     bool acceleratedPaintingEnabled;
     bool hixie76WebSocketProtocolEnabled;
-    bool perTilePaintingEnabled;
     bool mockScrollbarsEnabled;
     bool cssCustomFilterEnabled;
 
diff --git a/Tools/DumpRenderTree/chromium/WebThemeEngineDRTWin.cpp b/Tools/DumpRenderTree/chromium/WebThemeEngineDRTWin.cpp
index 789b1c816..831c354fa 100755
--- a/Tools/DumpRenderTree/chromium/WebThemeEngineDRTWin.cpp
+++ b/Tools/DumpRenderTree/chromium/WebThemeEngineDRTWin.cpp
@@ -51,7 +51,7 @@ static const int dfcsNormal = 0x0000;
 static SkIRect webRectToSkIRect(const WebRect& webRect)
 {
     SkIRect irect;
-    irect.set(webRect.x, webRect.y, webRect.x + webRect.width, webRect.y + webRect.height);
+    irect.set(webRect.x, webRect.y, webRect.x + webRect.width - 1, webRect.y + webRect.height - 1);
     return irect;
 }
 
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.cpp b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
index 6c48bc1e1..88e07378f 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -34,6 +34,7 @@
 #include "LayoutTestController.h"
 #include "MockGrammarCheck.h"
 #include "MockWebSpeechInputController.h"
+#include "MockWebSpeechRecognizer.h"
 #include "TestNavigationController.h"
 #include "TestShell.h"
 #include "TestWebPlugin.h"
@@ -261,6 +262,7 @@ WebWidget* WebViewHost::createPopupMenu(WebPopupType type)
     switch (type) {
     case WebKit::WebPopupTypeNone:
     case WebKit::WebPopupTypePage:
+    case WebKit::WebPopupTypeHelperPlugin:
         break;
     case WebKit::WebPopupTypeSelect:
     case WebKit::WebPopupTypeSuggestion:
@@ -286,7 +288,7 @@ WebKit::WebGraphicsContext3D* WebViewHost::createGraphicsContext3D(const WebKit:
 {
     if (!webView())
         return 0;
-    return webkit_support::CreateGraphicsContext3D(attributes, webView(), true);
+    return webkit_support::CreateGraphicsContext3D(attributes, webView());
 }
 
 void WebViewHost::didAddMessageToConsole(const WebConsoleMessage& message, const WebString& sourceName, unsigned sourceLine)
@@ -465,6 +467,32 @@ void WebViewHost::spellCheck(const WebString& text, int& misspelledOffset, int&
     m_spellcheck.spellCheckWord(text, &misspelledOffset, &misspelledLength);
 }
 
+void WebViewHost::checkTextOfParagraph(const WebString& text, WebTextCheckingTypeMask mask, WebVector<WebTextCheckingResult>* webResults)
+{
+    Vector<WebTextCheckingResult> results;
+    if (mask & WebTextCheckingTypeSpelling) {
+        size_t offset = 0;
+        size_t length = text.length();
+        const WebUChar* data = text.data();
+        while (offset < length) {
+            int misspelledPosition = 0;
+            int misspelledLength = 0;
+            m_spellcheck.spellCheckWord(WebString(&data[offset], length - offset), &misspelledPosition, &misspelledLength);
+            if (!misspelledLength)
+                break;
+            WebTextCheckingResult result;
+            result.type = WebTextCheckingTypeSpelling;
+            result.location = offset + misspelledPosition;
+            result.length = misspelledLength;
+            results.append(result);
+            offset += misspelledPosition + misspelledLength;
+        }
+    }
+    if (mask & WebTextCheckingTypeGrammar)
+        MockGrammarCheck::checkGrammarOfString(text, &results);
+    webResults->assign(results);
+}
+
 void WebViewHost::requestCheckingOfText(const WebString& text, WebTextCheckingCompletion* completion)
 {
     if (text.isEmpty()) {
@@ -714,6 +742,15 @@ WebSpeechInputController* WebViewHost::speechInputController(WebKit::WebSpeechIn
 }
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+WebSpeechRecognizer* WebViewHost::speechRecognizer()
+{
+    if (!m_mockSpeechRecognizer)
+        m_mockSpeechRecognizer = MockWebSpeechRecognizer::create();
+    return m_mockSpeechRecognizer.get();
+}
+#endif
+
 WebDeviceOrientationClientMock* WebViewHost::deviceOrientationClientMock()
 {
     if (!m_deviceOrientationClientMock.get())
@@ -857,9 +894,10 @@ void WebViewHost::didNotAcquirePointerLock()
 
 void WebViewHost::didLosePointerLock()
 {
-    ASSERT(m_pointerLocked);
+    bool wasLocked = m_pointerLocked;
     m_pointerLocked = false;
-    webWidget()->didLosePointerLock();
+    if (wasLocked)
+        webWidget()->didLosePointerLock();
 }
 #endif
 
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.h b/Tools/DumpRenderTree/chromium/WebViewHost.h
index 21dbb4c8d..ce189d915 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.h
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.h
@@ -48,6 +48,7 @@
 
 class LayoutTestController;
 class MockWebSpeechInputController;
+class MockWebSpeechRecognizer;
 class SkCanvas;
 class TestShell;
 
@@ -117,6 +118,10 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
     MockWebSpeechInputController* speechInputControllerMock() { return m_speechInputControllerMock.get(); }
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+    MockWebSpeechRecognizer* mockSpeechRecognizer() { return m_mockSpeechRecognizer.get(); }
+#endif
+
 #if ENABLE(POINTER_LOCK)
     void didLosePointerLock();
     void setPointerLockWillFailAsynchronously() { m_pointerLockPlannedResult = PointerLockWillFailAsync; }
@@ -131,6 +136,7 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
 
     // WebKit::WebSpellCheckClient
     virtual void spellCheck(const WebKit::WebString&, int& offset, int& length, WebKit::WebVector<WebKit::WebString>* optionalSuggestions);
+    virtual void checkTextOfParagraph(const WebKit::WebString&, WebKit::WebTextCheckingTypeMask, WebKit::WebVector<WebKit::WebTextCheckingResult>*);
     virtual void requestCheckingOfText(const WebKit::WebString&, WebKit::WebTextCheckingCompletion*);
     virtual WebKit::WebString autoCorrectWord(const WebKit::WebString&);
 
@@ -176,7 +182,10 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
 #if ENABLE(INPUT_SPEECH)
     virtual WebKit::WebSpeechInputController* speechInputController(WebKit::WebSpeechInputListener*);
 #endif
-    virtual WebKit::WebDeviceOrientationClient* deviceOrientationClient();
+#if ENABLE(SCRIPTED_SPEECH)
+    virtual WebKit::WebSpeechRecognizer* speechRecognizer() OVERRIDE;
+#endif
+    virtual WebKit::WebDeviceOrientationClient* deviceOrientationClient() OVERRIDE;
 #if ENABLE(MEDIA_STREAM)
     virtual WebKit::WebUserMediaClient* userMediaClient();
 #endif
@@ -412,6 +421,10 @@ private:
     OwnPtr<MockWebSpeechInputController> m_speechInputControllerMock;
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+    OwnPtr<MockWebSpeechRecognizer> m_mockSpeechRecognizer;
+#endif
+
 #if ENABLE(MEDIA_STREAM)
     OwnPtr<WebKit::WebUserMediaClientMock> m_userMediaClientMock;
     OwnPtr<webkit_support::TestMediaStreamClient> m_testMediaStreamClient;
diff --git a/Tools/DumpRenderTree/chromium/fonts.conf b/Tools/DumpRenderTree/chromium/fonts.conf
index b75a9322e..8e4f8d712 100644
--- a/Tools/DumpRenderTree/chromium/fonts.conf
+++ b/Tools/DumpRenderTree/chromium/fonts.conf
@@ -226,4 +226,17 @@
     </edit>
   </match>
 
+  <match target="pattern">
+    <!-- FontConfig doesn't currently provide a well-defined way to turn on
+         subpixel positioning.  This is just an arbitrary pattern to use after
+         turning subpixel positioning on globally to ensure that we don't have
+         issues with our style getting cached for other tests. -->
+    <test name="family" compare="eq">
+      <string>SubpixelPositioning</string>
+    </test>
+    <edit name="family" mode="assign">
+      <string>Times New Roman</string>
+    </edit>
+  </match>
+
 </fontconfig>
diff --git a/Tools/DumpRenderTree/efl/CMakeLists.txt b/Tools/DumpRenderTree/efl/CMakeLists.txt
index 06cef3a19..0a8fd065b 100644
--- a/Tools/DumpRenderTree/efl/CMakeLists.txt
+++ b/Tools/DumpRenderTree/efl/CMakeLists.txt
@@ -62,6 +62,7 @@ SET(DumpRenderTree_INCLUDE_DIRECTORIES
     ${WEBCORE_DIR}/platform/text
     ${WEBCORE_DIR}/platform/graphics
     ${WEBCORE_DIR}/platform/graphics/cairo
+    ${WEBCORE_DIR}/platform/graphics/transforms
     ${WEBCORE_DIR}/platform/network
     ${WEBCORE_DIR}/platform/network/soup
     ${WEBCORE_DIR}/plugins
@@ -76,6 +77,7 @@ SET(DumpRenderTree_INCLUDE_DIRECTORIES
     ${JAVASCRIPTCORE_DIR}/assembler
     ${JAVASCRIPTCORE_DIR}/bytecode
     ${JAVASCRIPTCORE_DIR}/dfg
+    ${JAVASCRIPTCORE_DIR}/disassembler
     ${JAVASCRIPTCORE_DIR}/heap
     ${JAVASCRIPTCORE_DIR}/interpreter
     ${JAVASCRIPTCORE_DIR}/jit
@@ -116,14 +118,12 @@ ADD_DEFINITIONS(-DFONTS_CONF_DIR="${TOOLS_DIR}/DumpRenderTree/gtk/fonts"
 
 INCLUDE_DIRECTORIES(${DumpRenderTree_INCLUDE_DIRECTORIES})
 
-ADD_EXECUTABLE(bin/DumpRenderTree ${DumpRenderTree_SOURCES})
-TARGET_LINK_LIBRARIES(bin/DumpRenderTree ${DumpRenderTree_LIBRARIES})
-ADD_TARGET_PROPERTIES(bin/DumpRenderTree LINK_FLAGS "${DumpRenderTree_LINK_FLAGS}")
-SET_TARGET_PROPERTIES(bin/DumpRenderTree PROPERTIES FOLDER "Tools")
-SET_TARGET_PROPERTIES(bin/DumpRenderTree PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}")
+ADD_EXECUTABLE(DumpRenderTree ${DumpRenderTree_SOURCES})
+TARGET_LINK_LIBRARIES(DumpRenderTree ${DumpRenderTree_LIBRARIES})
+ADD_TARGET_PROPERTIES(DumpRenderTree LINK_FLAGS "${DumpRenderTree_LINK_FLAGS}")
+SET_TARGET_PROPERTIES(DumpRenderTree PROPERTIES FOLDER "Tools")
 
-ADD_EXECUTABLE(bin/ImageDiff ${ImageDiff_SOURCES})
-TARGET_LINK_LIBRARIES(bin/ImageDiff ${DumpRenderTree_LIBRARIES})
-ADD_TARGET_PROPERTIES(bin/ImageDiff LINK_FLAGS "${DumpRenderTree_LINK_FLAGS}")
-SET_TARGET_PROPERTIES(bin/ImageDiff PROPERTIES FOLDER "Tools")
-SET_TARGET_PROPERTIES(bin/ImageDiff PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}")
+ADD_EXECUTABLE(ImageDiff ${ImageDiff_SOURCES})
+TARGET_LINK_LIBRARIES(ImageDiff ${DumpRenderTree_LIBRARIES})
+ADD_TARGET_PROPERTIES(ImageDiff LINK_FLAGS "${DumpRenderTree_LINK_FLAGS}")
+SET_TARGET_PROPERTIES(ImageDiff PROPERTIES FOLDER "Tools")
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTree.cpp b/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
index f8bf85e54..aace475b5 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
@@ -199,6 +199,11 @@ static String getExpectedPixelHash(const String& testURL)
     return (hashSeparatorPos != notFound) ? testURL.substring(hashSeparatorPos + 1) : String();
 }
 
+static inline bool isGlobalHistoryTest(const String& cTestPathOrURL)
+{
+    return cTestPathOrURL.contains("/globalhistory/");
+}
+
 static void createLayoutTestController(const String& testURL, const String& expectedPixelHash)
 {
     gLayoutTestController =
@@ -214,6 +219,7 @@ static void createLayoutTestController(const String& testURL, const String& expe
         gLayoutTestController->setDumpFrameLoadCallbacks(true);
 
     gLayoutTestController->setDeveloperExtrasEnabled(true);
+    gLayoutTestController->setDumpHistoryDelegateCallbacks(isGlobalHistoryTest(testURL));
 
     if (shouldDumpAsText(testURL)) {
         gLayoutTestController->setDumpAsText(true);
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
index 862a616a9..8a901c41d 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
@@ -110,6 +110,10 @@ Evas_Object* DumpRenderTreeChrome::createView() const
     evas_object_smart_callback_add(view, "mixedcontent,run", onInsecureContentRun, 0);
     evas_object_smart_callback_add(view, "mixedcontent,displayed", onInsecureContentDisplayed, 0);
     evas_object_smart_callback_add(view, "frame,created", onFrameCreated, 0);
+    evas_object_smart_callback_add(view, "navigate,with,data", onWebViewNavigatedWithData, 0);
+    evas_object_smart_callback_add(view, "perform,server,redirect", onWebViewServerRedirect, 0);
+    evas_object_smart_callback_add(view, "perform,client,redirect", onWebViewClientRedirect, 0);
+    evas_object_smart_callback_add(view, "populate,visited,links", onWebViewPopulateVisitedLinks, 0);
 
     connectEditingCallbacks(view);
 
@@ -213,6 +217,7 @@ void DumpRenderTreeChrome::resetDefaultsToConsistentValues()
 
     ewk_settings_memory_cache_clear();
     ewk_settings_application_cache_clear();
+    ewk_settings_shadow_dom_enable_set(EINA_TRUE);
 
     ewk_view_setting_private_browsing_set(mainView(), EINA_FALSE);
     ewk_view_setting_spatial_navigation_set(mainView(), EINA_FALSE);
@@ -240,13 +245,15 @@ void DumpRenderTreeChrome::resetDefaultsToConsistentValues()
     ewk_view_setting_minimum_timer_interval_set(browser->mainView(), 0.010); // 10 milliseconds (DOMTimer::s_minDefaultTimerInterval)
     ewk_view_setting_enable_webgl_set(mainView(), EINA_TRUE);
     ewk_view_setting_enable_hyperlink_auditing_set(mainView(), EINA_FALSE);
-    ewk_view_setting_include_links_in_focus_chain_set(mainView(), EINA_TRUE);
+    ewk_view_setting_include_links_in_focus_chain_set(mainView(), EINA_FALSE);
     ewk_view_setting_scripts_can_access_clipboard_set(mainView(), EINA_TRUE);
+    ewk_view_setting_web_audio_set(mainView(), EINA_FALSE);
 
     ewk_view_zoom_set(mainView(), 1.0, 0, 0);
     ewk_view_scale_set(mainView(), 1.0, 0, 0);
     ewk_view_text_zoom_set(mainView(), 1.0);
     ewk_view_visibility_state_set(mainView(), EWK_PAGE_VISIBILITY_STATE_VISIBLE, true);
+    ewk_view_text_direction_set(mainView(), EWK_TEXT_DIRECTION_DEFAULT);
 
     ewk_history_clear(ewk_view_history_get(mainView()));
 
@@ -268,7 +275,12 @@ void DumpRenderTreeChrome::resetDefaultsToConsistentValues()
     DumpRenderTreeSupportEfl::setDefersLoading(mainView(), false);
     DumpRenderTreeSupportEfl::setLoadsSiteIconsIgnoringImageLoadingSetting(mainView(), false);
     DumpRenderTreeSupportEfl::setSerializeHTTPLoads(false);
+
+    // Reset capacities for the memory cache for dead objects.
+    static const unsigned cacheTotalCapacity =  8192 * 1024;
+    ewk_settings_object_cache_capacity_set(0, cacheTotalCapacity, cacheTotalCapacity);
     DumpRenderTreeSupportEfl::setDeadDecodedDataDeletionInterval(0);
+    ewk_settings_page_cache_capacity_set(3);
 
     if (m_currentIntentRequest) {
         ewk_intent_request_unref(m_currentIntentRequest);
@@ -454,6 +466,12 @@ void DumpRenderTreeChrome::onFrameTitleChanged(void*, Evas_Object* frame, void*
 
     if (!done && gLayoutTestController->dumpTitleChanges())
         printf("TITLE CHANGED: %s\n", (titleText && titleText->string) ? titleText->string : "");
+
+    if (!done && gLayoutTestController->dumpHistoryDelegateCallbacks())
+        printf("WebView updated the title for history URL \"%s\" to \"%s\".\n", ewk_frame_uri_get(frame)
+               , (titleText && titleText->string) ? titleText->string : "");
+
+    gLayoutTestController->setTitleTextDirection(titleText->direction == EWK_TEXT_DIRECTION_LEFT_TO_RIGHT ? "ltr" : "rtl");
 }
 
 void DumpRenderTreeChrome::onDocumentLoadFinished(void*, Evas_Object*, void* eventInfo)
@@ -550,6 +568,57 @@ void DumpRenderTreeChrome::onFrameCreated(void*, Evas_Object*, void* eventInfo)
     evas_object_smart_callback_add(frame, "xss,detected", onDidDetectXSS, 0);
 }
 
+void DumpRenderTreeChrome::onWebViewNavigatedWithData(void*, Evas_Object*, void* eventInfo)
+{
+    if (done || !gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return;
+
+    ASSERT(eventInfo);
+    const Ewk_View_Navigation_Data* navigationData = static_cast<Ewk_View_Navigation_Data*>(eventInfo);
+
+    ASSERT(navigationData->request);
+    ASSERT(navigationData->response);
+
+    const bool wasFailure = navigationData->has_substitute_data || navigationData->response->status_code >= 400;
+    const bool wasRedirected = navigationData->client_redirect_source && *(navigationData->client_redirect_source);
+
+    printf("WebView navigated to url \"%s\" with title \"%s\" with HTTP equivalent method \"%s\".  The navigation was %s and was %s%s.\n",
+        navigationData->url,
+        navigationData->title,
+        navigationData->request->http_method,
+        wasFailure? "a failure" : "successful",
+        (wasRedirected ? "a client redirect from " : "not a client redirect"),
+        (wasRedirected ? navigationData->client_redirect_source : ""));
+}
+
+void DumpRenderTreeChrome::onWebViewServerRedirect(void*, Evas_Object*, void* eventInfo)
+{
+    if (done || !gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return;
+
+    ASSERT(eventInfo);
+    const Ewk_View_Redirection_Data* data = static_cast<Ewk_View_Redirection_Data*>(eventInfo);
+    printf("WebView performed a server redirect from \"%s\" to \"%s\".\n", data->source_url, data->destination_url);
+}
+
+void DumpRenderTreeChrome::onWebViewClientRedirect(void*, Evas_Object*, void* eventInfo)
+{
+    if (done || !gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return;
+
+    ASSERT(eventInfo);
+    const Ewk_View_Redirection_Data* data = static_cast<Ewk_View_Redirection_Data*>(eventInfo);
+    printf("WebView performed a client redirect from \"%s\" to \"%s\".\n", data->source_url, data->destination_url);
+}
+
+void DumpRenderTreeChrome::onWebViewPopulateVisitedLinks(void*, Evas_Object* ewkView, void*)
+{
+    if (done || !gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return;
+
+    printf("Asked to populate visited links for WebView \"%s\"\n", ewk_view_uri_get(ewkView));
+}
+
 void DumpRenderTreeChrome::onFrameProvisionalLoad(void*, Evas_Object* frame, void*)
 {
     if (!done && gLayoutTestController->dumpFrameLoadCallbacks()) {
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.h b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.h
index 9b65b4102..9e2f32372 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.h
+++ b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.h
@@ -91,6 +91,14 @@ private:
 
     static void onWebViewOnloadEvent(void*, Evas_Object*, void*);
 
+    static void onWebViewNavigatedWithData(void*, Evas_Object*, void*);
+
+    static void onWebViewServerRedirect(void*, Evas_Object*, void*);
+
+    static void onWebViewClientRedirect(void*, Evas_Object*, void*);
+
+    static void onWebViewPopulateVisitedLinks(void*, Evas_Object*, void*);
+
     static void onInsecureContentRun(void*, Evas_Object*, void*);
 
     static void onInsecureContentDisplayed(void*, Evas_Object*, void*);
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTreeView.cpp b/Tools/DumpRenderTree/efl/DumpRenderTreeView.cpp
index f07d3815b..32f4c39b3 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTreeView.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTreeView.cpp
@@ -23,6 +23,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#define __STDC_FORMAT_MACROS
 #include "config.h"
 #include "DumpRenderTreeView.h"
 
@@ -36,6 +37,7 @@
 #include <Evas.h>
 #include <cstdio>
 #include <cstdlib>
+#include <inttypes.h>
 #include <wtf/NotFound.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
@@ -129,7 +131,7 @@ static int64_t onExceededApplicationCacheQuota(Ewk_View_Smart_Data*, Ewk_Securit
         // sufficient to just get a range of 10000 to determine if we were
         // above or below a threshold.
         int64_t truncatedSpaceNeeded = (totalSpaceNeeded / 10000) * 10000;
-        printf("UI DELEGATE APPLICATION CACHE CALLBACK: exceededApplicationCacheOriginQuotaForSecurityOrigin:{%s, %s, %i} totalSpaceNeeded:~%lld\n",
+        printf("UI DELEGATE APPLICATION CACHE CALLBACK: exceededApplicationCacheOriginQuotaForSecurityOrigin:{%s, %s, %i} totalSpaceNeeded:~%" PRId64 "\n",
                ewk_security_origin_protocol_get(origin),
                ewk_security_origin_host_get(origin),
                ewk_security_origin_port_get(origin),
@@ -187,6 +189,12 @@ static Eina_Bool onNavigationPolicyDecision(Ewk_View_Smart_Data*, Ewk_Frame_Reso
     return policyDelegatePermissive;
 }
 
+static Eina_Bool onFocusCanCycle(Ewk_View_Smart_Data*, Ewk_Focus_Direction)
+{
+    // This is the behavior of Mac and Chromium ports and is expected by some test cases.
+    return true;
+}
+
 Evas_Object* drtViewAdd(Evas* evas)
 {
     static Ewk_View_Smart_Class api = EWK_VIEW_SMART_CLASS_INIT_NAME_VERSION("DRT_View");
@@ -206,6 +214,7 @@ Evas_Object* drtViewAdd(Evas* evas)
     api.exceeded_application_cache_quota = onExceededApplicationCacheQuota;
     api.exceeded_database_quota = onExceededDatabaseQuota;
     api.navigation_policy_decision = onNavigationPolicyDecision;
+    api.focus_can_cycle = onFocusCanCycle;
 
     return evas_object_smart_add(evas, evas_smart_class_new(&api.sc));
 }
diff --git a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
index 0e8a66e2e..070af8c14 100644
--- a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
+++ b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
@@ -7,6 +7,7 @@
  * Copyright (C) 2010 Joone Hur <joone@kldp.org>
  * Copyright (C) 2011 ProFUSION Embedded Systems
  * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,6 +55,13 @@
 #include <stdio.h>
 #include <wtf/text/WTFString.h>
 
+// Same as Mac cache model enum in Source/WebKit/mac/WebView/WebPreferences.h.
+enum {
+    WebCacheModelDocumentViewer = 0,
+    WebCacheModelDocumentBrowser = 1,
+    WebCacheModelPrimaryWebBrowser = 2
+};
+
 LayoutTestController::~LayoutTestController()
 {
 }
@@ -99,13 +107,6 @@ void LayoutTestController::display()
     displayWebView();
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
-{
-    const Evas_Object* mainFrame = browser->mainFrame();
-    const String counterValue(DumpRenderTreeSupportEfl::counterValueByElementId(mainFrame, id->ustring().utf8().data()));
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithUTF8CString(counterValue.utf8().data()));
-}
-
 void LayoutTestController::keepWebHistory()
 {
     notImplemented();
@@ -177,8 +178,28 @@ void LayoutTestController::notifyDone()
 
 JSStringRef LayoutTestController::pathToLocalResource(JSContextRef context, JSStringRef url)
 {
-    // Function introduced in r28690. This may need special-casing on Windows.
-    return JSStringRetain(url); // Do nothing on Unix.
+    String requestedUrl(url->characters(), url->length());
+    String resourceRoot;
+    String requestedRoot;
+
+    if (requestedUrl.find("LayoutTests") != notFound) {
+        // If the URL contains LayoutTests we need to remap that to
+        // LOCAL_RESOURCE_ROOT which is the path of the LayoutTests directory
+        // within the WebKit source tree.
+        requestedRoot = "/tmp/LayoutTests";
+        resourceRoot = getenv("LOCAL_RESOURCE_ROOT");
+    } else if (requestedUrl.find("tmp") != notFound) {
+        // If the URL is a child of /tmp we need to convert it to be a child
+        // DUMPRENDERTREE_TEMP replace tmp with DUMPRENDERTREE_TEMP
+        requestedRoot = "/tmp";
+        resourceRoot = getenv("DUMPRENDERTREE_TEMP");
+    }
+
+    size_t indexOfRootStart = requestedUrl.reverseFind(requestedRoot);
+    size_t indexOfSeparatorAfterRoot = indexOfRootStart + requestedRoot.length();
+    String fullPathToUrl = "file://" + resourceRoot + requestedUrl.substring(indexOfSeparatorAfterRoot);
+
+    return JSStringCreateWithUTF8CString(fullPathToUrl.utf8().data());
 }
 
 void LayoutTestController::queueLoad(JSStringRef url, JSStringRef target)
@@ -527,21 +548,21 @@ void LayoutTestController::setCacheModel(int cacheModel)
 
     // These constants are derived from the Mac cache model enum in Source/WebKit/mac/WebView/WebPreferences.h.
     switch (cacheModel) {
-    case 0: // WebCacheModelDocumentViewer
+    case WebCacheModelDocumentViewer:
         pageCacheCapacity = 0;
         cacheTotalCapacity = 0;
         cacheMinDeadCapacity = 0;
         cacheMaxDeadCapacity = 0;
         deadDecodedDataDeletionInterval = 0;
         break;
-    case 1: // WebCacheModelDocumentBrowser
+    case WebCacheModelDocumentBrowser:
         pageCacheCapacity = 2;
         cacheTotalCapacity = 16 * 1024 * 1024;
         cacheMinDeadCapacity = cacheTotalCapacity / 8;
         cacheMaxDeadCapacity = cacheTotalCapacity / 4;
         deadDecodedDataDeletionInterval = 0;
         break;
-    case 3: // WebCacheModelPrimaryWebBrowser
+    case WebCacheModelPrimaryWebBrowser:
         pageCacheCapacity = 3;
         cacheTotalCapacity = 32 * 1024 * 1024;
         cacheMinDeadCapacity = cacheTotalCapacity / 4;
@@ -645,9 +666,9 @@ void LayoutTestController::syncLocalStorage()
     notImplemented();
 }
 
-void LayoutTestController::setDomainRelaxationForbiddenForURLScheme(bool, JSStringRef)
+void LayoutTestController::setDomainRelaxationForbiddenForURLScheme(bool forbidden, JSStringRef scheme)
 {
-    notImplemented();
+    DumpRenderTreeSupportEfl::setDomainRelaxationForbiddenForURLScheme(forbidden, WTF::String(scheme->ustring().impl()));
 }
 
 void LayoutTestController::goBack()
@@ -716,6 +737,8 @@ void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value
         DumpRenderTreeSupportEfl::setLoadsSiteIconsIgnoringImageLoadingSetting(browser->mainView(), toBool(value));
     else if (equals(key, "WebKitCSSGridLayoutEnabled"))
         DumpRenderTreeSupportEfl::setCSSGridLayoutEnabled(browser->mainView(), toBool(value));
+    else if (equals(key, "WebKitWebAudioEnabled"))
+        ewk_view_setting_web_audio_set(browser->mainView(), toBool(value));
     else
         fprintf(stderr, "LayoutTestController::overridePreference tried to override unknown preference '%s'.\n", value->ustring().utf8().data());
 }
@@ -828,9 +851,21 @@ void LayoutTestController::setMinimumTimerInterval(double minimumTimerInterval)
     ewk_view_setting_minimum_timer_interval_set(browser->mainView(), minimumTimerInterval);
 }
 
-void LayoutTestController::setTextDirection(JSStringRef)
+void LayoutTestController::setTextDirection(JSStringRef direction)
 {
-    notImplemented();
+    Ewk_Text_Direction ewkDirection;
+    if (JSStringIsEqualToUTF8CString(direction, "auto"))
+        ewkDirection = EWK_TEXT_DIRECTION_DEFAULT;
+    else if (JSStringIsEqualToUTF8CString(direction, "rtl"))
+        ewkDirection = EWK_TEXT_DIRECTION_RIGHT_TO_LEFT;
+    else if (JSStringIsEqualToUTF8CString(direction, "ltr"))
+        ewkDirection = EWK_TEXT_DIRECTION_LEFT_TO_RIGHT;
+    else {
+        fprintf(stderr, "LayoutTestController::setTextDirection called with unknown direction: '%s'.\n", direction->ustring().utf8().data());
+        return;
+    }
+
+    ewk_view_text_direction_set(browser->mainView(), ewkDirection);
 }
 
 void LayoutTestController::addChromeInputField()
diff --git a/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp b/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
index cedacdb65..bee371960 100644
--- a/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
@@ -140,7 +140,8 @@ gchar* attributeSetToString(AtkAttributeSet* attributeSet)
     GString* str = g_string_new(0);
     for (GSList* attributes = attributeSet; attributes; attributes = attributes->next) {
         AtkAttribute* attribute = static_cast<AtkAttribute*>(attributes->data);
-        g_string_append(str, g_strconcat(attribute->name, ":", attribute->value, NULL));
+        GOwnPtr<gchar> attributeData(g_strconcat(attribute->name, ":", attribute->value, NULL));
+        g_string_append(str, attributeData.get());
         if (attributes->next)
             g_string_append(str, ", ");
     }
@@ -154,7 +155,8 @@ JSStringRef AccessibilityUIElement::allAttributes()
         return JSStringCreateWithCharacters(0, 0);
 
     ASSERT(ATK_IS_OBJECT(m_element));
-    return JSStringCreateWithUTF8CString(attributeSetToString(atk_object_get_attributes(ATK_OBJECT(m_element))));
+    GOwnPtr<gchar> attributeData(attributeSetToString(atk_object_get_attributes(ATK_OBJECT(m_element))));
+    return JSStringCreateWithUTF8CString(attributeData.get());
 }
 
 JSStringRef AccessibilityUIElement::attributesOfLinkedUIElements()
@@ -328,13 +330,9 @@ double AccessibilityUIElement::intValue() const
         return 0.0f;
 
     atk_value_get_current_value(ATK_VALUE(m_element), &value);
-
-    if (G_VALUE_HOLDS_DOUBLE(&value))
-        return g_value_get_double(&value);
-    else if (G_VALUE_HOLDS_INT(&value))
-        return static_cast<double>(g_value_get_int(&value));
-    else
+    if (!G_VALUE_HOLDS_FLOAT(&value))
         return 0.0f;
+    return g_value_get_float(&value);
 }
 
 double AccessibilityUIElement::minValue()
@@ -345,13 +343,9 @@ double AccessibilityUIElement::minValue()
         return 0.0f;
 
     atk_value_get_minimum_value(ATK_VALUE(m_element), &value);
-
-    if (G_VALUE_HOLDS_DOUBLE(&value))
-        return g_value_get_double(&value);
-    else if (G_VALUE_HOLDS_INT(&value))
-        return static_cast<double>(g_value_get_int(&value));
-    else
+    if (!G_VALUE_HOLDS_FLOAT(&value))
         return 0.0f;
+    return g_value_get_float(&value);
 }
 
 double AccessibilityUIElement::maxValue()
@@ -362,13 +356,9 @@ double AccessibilityUIElement::maxValue()
         return 0.0f;
 
     atk_value_get_maximum_value(ATK_VALUE(m_element), &value);
-
-    if (G_VALUE_HOLDS_DOUBLE(&value))
-        return g_value_get_double(&value);
-    else if (G_VALUE_HOLDS_INT(&value))
-        return static_cast<double>(g_value_get_int(&value));
-    else
+    if (!G_VALUE_HOLDS_FLOAT(&value))
         return 0.0f;
+    return g_value_get_float(&value);
 }
 
 JSStringRef AccessibilityUIElement::valueDescription()
@@ -644,22 +634,38 @@ bool AccessibilityUIElement::isAttributeSupported(JSStringRef attribute)
     return false;
 }
 
-void AccessibilityUIElement::increment()
+static void alterCurrentValue(PlatformUIElement element, int factor)
 {
-    if (!m_element)
+    if (!element)
         return;
 
-    ASSERT(ATK_IS_OBJECT(m_element));
-    DumpRenderTreeSupportGtk::incrementAccessibilityValue(ATK_OBJECT(m_element));
+    ASSERT(ATK_IS_VALUE(element));
+
+    GValue currentValue = G_VALUE_INIT;
+    atk_value_get_current_value(ATK_VALUE(element), &currentValue);
+
+    GValue increment = G_VALUE_INIT;
+    atk_value_get_minimum_increment(ATK_VALUE(element), &increment);
+
+    GValue newValue = G_VALUE_INIT;
+    g_value_init(&newValue, G_TYPE_FLOAT);
+
+    g_value_set_float(&newValue, g_value_get_float(&currentValue) + factor * g_value_get_float(&increment));
+    atk_value_set_current_value(ATK_VALUE(element), &newValue);
+
+    g_value_unset(&newValue);
+    g_value_unset(&increment);
+    g_value_unset(&currentValue);
 }
 
-void AccessibilityUIElement::decrement()
+void AccessibilityUIElement::increment()
 {
-    if (!m_element)
-        return;
+    alterCurrentValue(m_element, 1);
+}
 
-    ASSERT(ATK_IS_OBJECT(m_element));
-    DumpRenderTreeSupportGtk::decrementAccessibilityValue(ATK_OBJECT(m_element));
+void AccessibilityUIElement::decrement()
+{
+    alterCurrentValue(m_element, -1);
 }
 
 void AccessibilityUIElement::press()
diff --git a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 18aafafd1..9740d276f 100644
--- a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -128,10 +128,12 @@ void dumpFrameScrollPosition(WebKitWebFrame* frame)
 
 void displayWebView()
 {
-    gtk_widget_queue_draw(GTK_WIDGET(webView));
+    DumpRenderTreeSupportGtk::forceWebViewPaint(webView);
+    DumpRenderTreeSupportGtk::setTracksRepaints(mainFrame, true);
+    DumpRenderTreeSupportGtk::resetTrackedRepaints(mainFrame);
 }
 
-static void appendString(gchar*& target, gchar* string)
+static void appendString(gchar*& target, const gchar* string)
 {
     gchar* oldString = target;
     target = g_strconcat(target, string, NULL);
@@ -246,8 +248,10 @@ static gchar* dumpFramesAsText(WebKitWebFrame* frame)
 
     if (gLayoutTestController->dumpChildFramesAsText()) {
         GSList* children = DumpRenderTreeSupportGtk::getFrameChildren(frame);
-        for (GSList* child = children; child; child = g_slist_next(child))
-            appendString(result, dumpFramesAsText(static_cast<WebKitWebFrame* >(child->data)));
+        for (GSList* child = children; child; child = g_slist_next(child)) {
+            GOwnPtr<gchar> childData(dumpFramesAsText(static_cast<WebKitWebFrame*>(child->data)));
+            appendString(result, childData.get());
+        }
         g_slist_free(children);
     }
 
@@ -278,8 +282,10 @@ static void dumpHistoryItem(WebKitWebHistoryItem* item, int indent, bool current
     gchar* uriScheme = g_uri_parse_scheme(uri);
     if (g_strcmp0(uriScheme, "file") == 0) {
         gchar* pos = g_strstr_len(uri, -1, "/LayoutTests/");
-        if (!pos)
+        if (!pos) {
+            g_free(uriScheme);
             return;
+        }
 
         GString* result = g_string_sized_new(strlen(uri));
         result = g_string_append(result, "(file test):");
@@ -291,9 +297,9 @@ static void dumpHistoryItem(WebKitWebHistoryItem* item, int indent, bool current
 
     g_free(uriScheme);
 
-    const gchar* target = webkit_web_history_item_get_target(item);
-    if (target && strlen(target) > 0)
-        printf(" (in frame \"%s\")", target);
+    GOwnPtr<gchar> target(webkit_web_history_item_get_target(item));
+    if (target.get() && strlen(target.get()) > 0)
+        printf(" (in frame \"%s\")", target.get());
     if (webkit_web_history_item_is_target_item(item))
         printf("  **nav target**");
     putchar('\n');
@@ -456,6 +462,7 @@ static void resetDefaultsToConsistentValues()
         axController->resetToConsistentState();
 
     DumpRenderTreeSupportGtk::clearOpener(mainFrame);
+    DumpRenderTreeSupportGtk::setTracksRepaints(mainFrame, false);
 
     DumpRenderTreeSupportGtk::resetGeolocationClientMock(webView);
 
diff --git a/Tools/DumpRenderTree/gtk/EventSender.cpp b/Tools/DumpRenderTree/gtk/EventSender.cpp
index bc38a2029..102bb660f 100644
--- a/Tools/DumpRenderTree/gtk/EventSender.cpp
+++ b/Tools/DumpRenderTree/gtk/EventSender.cpp
@@ -205,8 +205,10 @@ static JSValueRef contextClickCallback(JSContextRef context, JSObjectRef functio
 {
     GdkEvent* pressEvent = gdk_event_new(GDK_BUTTON_PRESS);
 
-    if (!prepareMouseButtonEvent(pressEvent, 2, 0))
+    if (!prepareMouseButtonEvent(pressEvent, 2, 0)) {
+        gdk_event_free(pressEvent);
         return JSObjectMakeArray(context, 0, 0, 0);
+    }
 
     GdkEvent* releaseEvent = gdk_event_copy(pressEvent);
     sendOrQueueEvent(pressEvent);
@@ -315,12 +317,16 @@ static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function,
     guint modifiers = argumentCount >= 2 ? gdkModifersFromJSValue(context, arguments[1]) : 0;
 
     GdkEvent* event = gdk_event_new(GDK_BUTTON_PRESS);
-    if (!prepareMouseButtonEvent(event, button, modifiers))
+    if (!prepareMouseButtonEvent(event, button, modifiers)) {
+        gdk_event_free(event);
         return JSValueMakeUndefined(context);
+    }
 
     // If the same mouse button is already in the down position don't send another event as it may confuse Xvfb.
-    if (buttonCurrentlyDown == event->button.button)
+    if (buttonCurrentlyDown == event->button.button) {
+        gdk_event_free(event);
         return JSValueMakeUndefined(context);
+    }
 
     buttonCurrentlyDown = event->button.button;
 
@@ -363,8 +369,10 @@ static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JS
     guint modifiers = argumentCount >= 2 ? gdkModifersFromJSValue(context, arguments[1]) : 0;
 
     GdkEvent* event = gdk_event_new(GDK_BUTTON_RELEASE);
-    if (!prepareMouseButtonEvent(event, button, modifiers))
+    if (!prepareMouseButtonEvent(event, button, modifiers)) {
+        gdk_event_free(event);
         return JSValueMakeUndefined(context);
+    }
 
     lastClickPositionX = lastMousePositionX;
     lastClickPositionY = lastMousePositionY;
diff --git a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 275c2e029..72d69fa0a 100644
--- a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -102,17 +102,6 @@ void LayoutTestController::display()
     displayWebView();
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
-{
-    gchar* idGChar = JSStringCopyUTF8CString(id);
-    CString counterValueGChar = DumpRenderTreeSupportGtk::counterValueForElementById(mainFrame, idGChar);
-    g_free(idGChar);
-    if (counterValueGChar.isNull())
-        return 0;
-    JSRetainPtr<JSStringRef> counterValue(Adopt, JSStringCreateWithUTF8CString(counterValueGChar.data()));
-    return counterValue;
-}
-
 void LayoutTestController::keepWebHistory()
 {
     // FIXME: implement
diff --git a/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp b/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
index 3eabfd96c..0a800ec13 100644
--- a/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
@@ -35,6 +35,41 @@
 #include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
 #include <webkit/webkit.h>
 
+static void paintOverlay(cairo_surface_t* surface)
+{
+    cairo_t* context = cairo_create(surface);
+
+    // Paint a transparent black overlay from which the repainted rectangles are then cleared.
+    // The alpha component of the overlay should have a value of 0.66, as on other ports.
+    cairo_set_source_rgba(context, 0.0, 0.0, 0.0, 0.66);
+    cairo_rectangle(context, 0, 0, cairo_image_surface_get_width(surface), cairo_image_surface_get_height(surface));
+    cairo_fill(context);
+
+    GSList* trackedRectsList = DumpRenderTreeSupportGtk::trackedRepaintRects(mainFrame);
+    for (GSList* listElement = trackedRectsList; listElement; listElement = g_slist_next(listElement)) {
+        GdkRectangle* rect = static_cast<GdkRectangle*>(listElement->data);
+
+        cairo_set_operator(context, CAIRO_OPERATOR_CLEAR);
+        cairo_rectangle(context, rect->x, rect->y, rect->width, rect->height);
+        cairo_fill(context);
+    }
+
+    g_slist_free_full(trackedRectsList, g_free);
+    cairo_destroy(context);
+}
+
+static void fillRepaintOverlayIntoContext(cairo_t* context, gint width, gint height)
+{
+    cairo_surface_t* overlaySurface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height);
+    paintOverlay(overlaySurface);
+
+    cairo_set_source_surface(context, overlaySurface, 0, 0);
+    cairo_rectangle(context, 0, 0, width, height);
+    cairo_fill(context);
+
+    cairo_surface_destroy(overlaySurface);
+}
+
 PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool drawSelectionRect)
 {
     WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
@@ -48,6 +83,9 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool
     height = gtk_widget_get_allocated_height(viewContainer);
 #endif
 
+    while (gtk_events_pending())
+        gtk_main_iteration();
+
     cairo_surface_t* imageSurface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height);
     cairo_t* context = cairo_create(imageSurface);
 
@@ -59,6 +97,9 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool
     gtk_widget_draw(viewContainer, context);
 #endif
 
+    if (DumpRenderTreeSupportGtk::isTrackingRepaints(mainFrame))
+        fillRepaintOverlayIntoContext(context, width, height);
+
     if (drawSelectionRect) {
         cairo_rectangle_int_t rectangle;
         DumpRenderTreeSupportGtk::rectangleForSelection(mainFrame, &rectangle);
@@ -69,5 +110,6 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool
         cairo_stroke(context);
     }
 
+    cairo_surface_destroy(imageSurface);
     return BitmapContext::createByAdoptingBitmapAndContext(0, context);
 }
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index 00bdb2184..271683f7a 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -590,7 +590,7 @@ static void resetDefaultsToConsistentValues()
 #endif
 
 
-#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION) && !PLATFORM(CHROMIUM)
     [defaults setBool:NO forKey:@"NSScrollAnimationEnabled"];
 #else
     [defaults setBool:NO forKey:@"AppleScrollAnimationEnabled"];
diff --git a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 72c0cea47..884572e9b 100644
--- a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -249,19 +249,6 @@ void LayoutTestController::display()
     displayWebView();
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
-{
-    RetainPtr<CFStringRef> idCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, id));
-    NSString *idNS = (NSString *)idCF.get();
-
-    DOMElement *element = [[mainFrame DOMDocument] getElementById:idNS];
-    if (!element)
-        return 0;
-
-    JSRetainPtr<JSStringRef> counterValue(Adopt, JSStringCreateWithCFString((CFStringRef)[mainFrame counterValueForElement:element]));
-    return counterValue;
-}
-
 void LayoutTestController::keepWebHistory()
 {
     if (![WebHistory optionalSharedHistory]) {
diff --git a/Tools/DumpRenderTree/mac/TextInputController.m b/Tools/DumpRenderTree/mac/TextInputController.m
index f78079446..afeb16e4d 100644
--- a/Tools/DumpRenderTree/mac/TextInputController.m
+++ b/Tools/DumpRenderTree/mac/TextInputController.m
@@ -31,6 +31,10 @@
 
 #import "DumpRenderTreeMac.h"
 #import <AppKit/NSInputManager.h>
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+#define SUPPORT_DICTATION_ALTERNATIVES
+#import <AppKit/NSTextAlternatives.h>
+#endif
 #import <WebKit/WebDocument.h>
 #import <WebKit/WebFrame.h>
 #import <WebKit/WebFramePrivate.h>
@@ -170,7 +174,8 @@
             || aSelector == @selector(characterIndexForPointX:Y:)
             || aSelector == @selector(validAttributesForMarkedText)
             || aSelector == @selector(attributedStringWithString:)
-            || aSelector == @selector(setInputMethodHandler:))
+            || aSelector == @selector(setInputMethodHandler:)
+            || aSelector == @selector(dictatedStringWithPrimaryString:alternative:alternativeOffset:alternativeLength:))
         return NO;
     return YES;
 }
@@ -194,7 +199,9 @@
     else if (aSelector == @selector(attributedStringWithString:))
         return @"makeAttributedString"; // just a factory method, doesn't call into NSTextInput
     else if (aSelector == @selector(setInputMethodHandler:))
-        return @"setInputMethodHandler"; 
+        return @"setInputMethodHandler";
+    else if (aSelector == @selector(dictatedStringWithPrimaryString:alternative:alternativeOffset:alternativeLength:))
+        return @"makeDictatedString";
 
     return nil;
 }
@@ -375,6 +382,27 @@
     return [[[NSMutableAttributedString alloc] initWithString:aString] autorelease];
 }
 
+- (NSMutableAttributedString*)dictatedStringWithPrimaryString:(NSString*)aString alternative:(NSString*)alternative alternativeOffset:(int)offset alternativeLength:(int)length
+{
+#if defined(SUPPORT_DICTATION_ALTERNATIVES)
+    NSMutableAttributedString* dictatedString = [self attributedStringWithString:aString];
+    NSRange rangeWithAlternative = NSMakeRange((NSUInteger)offset, (NSUInteger)length);
+    NSString* subStringWithAlternative = [aString substringWithRange:rangeWithAlternative];
+    if (!subStringWithAlternative)
+        return nil;
+
+    NSTextAlternatives* alternativeObject = [[[NSTextAlternatives alloc] initWithPrimaryString:subStringWithAlternative alternativeStrings:[NSArray arrayWithObject:alternative]] autorelease];
+    if (!alternativeObject)
+        return nil;
+
+    [dictatedString addAttribute:NSTextAlternativesAttributeName value:alternativeObject range:rangeWithAlternative];
+
+    return dictatedString;
+#else
+    return nil;
+#endif
+}
+
 - (void)setInputMethodHandler:(WebScriptObject *)handler
 {
     if (inputMethodHandler == handler)
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index df70e08a6..d77faa6f3 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -743,6 +743,7 @@ void DumpRenderTree::initJSObjects()
     QWebFrame *frame = qobject_cast<QWebFrame*>(sender());
     Q_ASSERT(frame);
     frame->addToJavaScriptWindowObject(QLatin1String("layoutTestController"), m_controller);
+    frame->addToJavaScriptWindowObject(QLatin1String("testRunner"), m_controller);
     frame->addToJavaScriptWindowObject(QLatin1String("eventSender"), m_eventSender);
     frame->addToJavaScriptWindowObject(QLatin1String("textInputController"), m_textInputController);
     frame->addToJavaScriptWindowObject(QLatin1String("GCController"), m_gcController);
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index 9bbf439bc..7689d5b4b 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -155,11 +155,6 @@ void LayoutTestController::waitUntilDone()
     m_timeoutTimer.start(m_timeout, this);
 }
 
-QString LayoutTestController::counterValueForElementById(const QString& id)
-{
-    return DumpRenderTreeSupportQt::counterValueForElementById(m_drt->webPage()->mainFrame(), id);
-}
-
 void LayoutTestController::setViewModeMediaFeature(const QString& mode)
 {
     m_drt->webPage()->setProperty("_q_viewMode", mode);
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
index ef68b36e9..88b57cffa 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -105,7 +105,6 @@ public slots:
     void setCanOpenWindows() { m_canOpenWindows = true; }
     void setPrinting() { m_isPrinting = true; }
     void waitUntilDone();
-    QString counterValueForElementById(const QString& id);
     int webHistoryItemCount();
     void keepWebHistory();
     void notifyDone();
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
index 92ab8632c..a6f583f60 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -37,6 +37,7 @@
 #include "PolicyDelegate.h"
 #include "ResourceLoadDelegate.h"
 #include "UIDelegate.h"
+#include "WebCoreTestSupport.h"
 #include "WorkQueueItem.h"
 #include "WorkQueue.h"
 
@@ -893,6 +894,11 @@ static void resetWebViewToConsistentStateBeforeTesting()
     if (SUCCEEDED(webView->preferences(&preferences)))
         resetDefaultsToConsistentValues(preferences.get());
 
+    if (gLayoutTestController) {
+        JSGlobalContextRef context = frame->globalContext();
+        WebCoreTestSupport::resetInternalsObject(context);
+    }
+
     COMPtr<IWebViewEditing> viewEditing;
     if (SUCCEEDED(webView->QueryInterface(&viewEditing)))
         viewEditing->setSmartInsertDeleteEnabled(TRUE);
diff --git a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index 123944929..9d03abc77 100644
--- a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -1300,25 +1300,6 @@ void LayoutTestController::removeAllVisitedLinks()
     sharedHistoryPrivate->removeAllVisitedLinks();
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
-{
-    COMPtr<IWebFramePrivate> framePrivate(Query, frame);
-    if (!framePrivate)
-        return 0;
-
-    wstring idWstring = jsStringRefToWString(id);
-    BSTR idBSTR = SysAllocStringLen((OLECHAR*)idWstring.c_str(), idWstring.length());
-    BSTR counterValueBSTR;
-    if (FAILED(framePrivate->counterValueForElementById(idBSTR, &counterValueBSTR)))
-        return 0;
-
-    wstring counterValue(counterValueBSTR, SysStringLen(counterValueBSTR));
-    SysFreeString(idBSTR);
-    SysFreeString(counterValueBSTR);
-    JSRetainPtr<JSStringRef> counterValueJS(Adopt, JSStringCreateWithCharacters(counterValue.data(), counterValue.length()));
-    return counterValueJS;
-}
-
 int LayoutTestController::pageNumberForElementById(JSStringRef id, float pageWidthInPixels, float pageHeightInPixels)
 {
     COMPtr<IWebFramePrivate> framePrivate(Query, frame);
diff --git a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index 08d2832ac..e0c05843d 100644
--- a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -472,11 +472,6 @@ void LayoutTestController::setScrollbarPolicy(JSStringRef orientation, JSStringR
     // FIXME: implement
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
-{
-    return 0;
-}
-
 int LayoutTestController::pageNumberForElementById(JSStringRef, float, float)
 {
     // FIXME: implement