Merge from Chromium at DEPS revision r216972

This commit was generated by merge_to_master.py.

Change-Id: Ie5904a921ece9c5959b52c8e0b74db09fa08f144
diff --git a/Source/core/html/BaseCheckableInputType.cpp b/Source/core/html/BaseCheckableInputType.cpp
index 28c069b..6867bd2 100644
--- a/Source/core/html/BaseCheckableInputType.cpp
+++ b/Source/core/html/BaseCheckableInputType.cpp
@@ -44,7 +44,7 @@
 
 FormControlState BaseCheckableInputType::saveFormControlState() const
 {
-    return FormControlState(element()->checked() ? ASCIILiteral("on") : ASCIILiteral("off"));
+    return FormControlState(element()->checked() ? "on" : "off");
 }
 
 void BaseCheckableInputType::restoreFormControlState(const FormControlState& state)
@@ -93,7 +93,7 @@
 
 String BaseCheckableInputType::fallbackValue() const
 {
-    return ASCIILiteral("on");
+    return "on";
 }
 
 bool BaseCheckableInputType::storesValueSeparateFromAttribute()
diff --git a/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp b/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp
index 283fbd6..ae80ddb 100644
--- a/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp
+++ b/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp
@@ -62,7 +62,7 @@
     DEFINE_STATIC_LOCAL(AtomicString, valueContainerPseudo, ("-webkit-date-and-time-value", AtomicString::ConstructFromLiteral));
 
     RefPtr<HTMLDivElement> valueContainer = HTMLDivElement::create(element()->document());
-    valueContainer->setPseudo(valueContainerPseudo);
+    valueContainer->setPart(valueContainerPseudo);
     element()->userAgentShadowRoot()->appendChild(valueContainer.get());
     updateAppearance();
 }
@@ -75,7 +75,7 @@
     String displayValue = visibleValue();
     if (displayValue.isEmpty()) {
         // Need to put something to keep text baseline.
-        displayValue = ASCIILiteral(" ");
+        displayValue = " ";
     }
     toHTMLElement(node)->setInnerText(displayValue, ASSERT_NO_EXCEPTION);
 }
diff --git a/Source/core/html/BaseDateAndTimeInputType.cpp b/Source/core/html/BaseDateAndTimeInputType.cpp
index c86d076..71207df 100644
--- a/Source/core/html/BaseDateAndTimeInputType.cpp
+++ b/Source/core/html/BaseDateAndTimeInputType.cpp
@@ -156,7 +156,7 @@
 
 String BaseDateAndTimeInputType::sanitizeValue(const String& proposedValue) const
 {
-    return typeMismatchFor(proposedValue) ? String() : proposedValue;
+    return typeMismatchFor(proposedValue) ? emptyString() : proposedValue;
 }
 
 bool BaseDateAndTimeInputType::supportsReadOnly() const
diff --git a/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp b/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp
index ac5c46f..8ea2d94 100644
--- a/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp
+++ b/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp
@@ -130,22 +130,22 @@
 
 DateTimeEditElement* BaseMultipleFieldsDateAndTimeInputType::dateTimeEditElement() const
 {
-    return toDateTimeEditElement(elementById(ShadowElementNames::dateTimeEdit()));
+    return toDateTimeEditElement(element()->uaShadowElementById(ShadowElementNames::dateTimeEdit()));
 }
 
 SpinButtonElement* BaseMultipleFieldsDateAndTimeInputType::spinButtonElement() const
 {
-    return toSpinButtonElement(elementById(ShadowElementNames::spinButton()));
+    return toSpinButtonElement(element()->uaShadowElementById(ShadowElementNames::spinButton()));
 }
 
 ClearButtonElement* BaseMultipleFieldsDateAndTimeInputType::clearButtonElement() const
 {
-    return toClearButtonElement(elementById(ShadowElementNames::clearButton()));
+    return toClearButtonElement(element()->uaShadowElementById(ShadowElementNames::clearButton()));
 }
 
 PickerIndicatorElement* BaseMultipleFieldsDateAndTimeInputType::pickerIndicatorElement() const
 {
-    return toPickerIndicatorElement(elementById(ShadowElementNames::pickerIndicator()));
+    return toPickerIndicatorElement(element()->uaShadowElementById(ShadowElementNames::pickerIndicator()));
 }
 
 inline bool BaseMultipleFieldsDateAndTimeInputType::containsFocusedShadowElement() const
@@ -379,7 +379,7 @@
         return;
     if (direction == FocusDirectionBackward) {
         if (element()->document()->page())
-            element()->document()->page()->focusController()->advanceFocus(direction);
+            element()->document()->page()->focusController().advanceFocus(direction);
     } else if (direction == FocusDirectionNone || direction == FocusDirectionMouse) {
         edit->focusByOwner(oldFocusedElement);
     } else
diff --git a/Source/core/html/ColorInputType.cpp b/Source/core/html/ColorInputType.cpp
index 6c2c716..46e741a 100644
--- a/Source/core/html/ColorInputType.cpp
+++ b/Source/core/html/ColorInputType.cpp
@@ -120,9 +120,9 @@
 
     Document* document = element()->document();
     RefPtr<HTMLDivElement> wrapperElement = HTMLDivElement::create(document);
-    wrapperElement->setPseudo(AtomicString("-webkit-color-swatch-wrapper", AtomicString::ConstructFromLiteral));
+    wrapperElement->setPart(AtomicString("-webkit-color-swatch-wrapper", AtomicString::ConstructFromLiteral));
     RefPtr<HTMLDivElement> colorSwatch = HTMLDivElement::create(document);
-    colorSwatch->setPseudo(AtomicString("-webkit-color-swatch", AtomicString::ConstructFromLiteral));
+    colorSwatch->setPart(AtomicString("-webkit-color-swatch", AtomicString::ConstructFromLiteral));
     wrapperElement->appendChild(colorSwatch.release(), ASSERT_NO_EXCEPTION);
     element()->userAgentShadowRoot()->appendChild(wrapperElement.release(), ASSERT_NO_EXCEPTION);
 
diff --git a/Source/core/html/DOMTokenList.idl b/Source/core/html/DOMTokenList.idl
index c885018..3f16677 100644
--- a/Source/core/html/DOMTokenList.idl
+++ b/Source/core/html/DOMTokenList.idl
@@ -28,9 +28,9 @@
     readonly attribute unsigned long length;
     [TreatReturnedNullStringAs=Null] getter DOMString item(unsigned long index);
     [RaisesException] boolean contains(DOMString token);
-    [RaisesException, DeliverCustomElementCallbacks] void add(DOMString... tokens);
-    [RaisesException, DeliverCustomElementCallbacks] void remove(DOMString... tokens);
-    [RaisesException, DeliverCustomElementCallbacks] boolean toggle(DOMString token, optional boolean force);
+    [RaisesException, CustomElementCallbacks=Enable] void add(DOMString... tokens);
+    [RaisesException, CustomElementCallbacks=Enable] void remove(DOMString... tokens);
+    [RaisesException, CustomElementCallbacks=Enable] boolean toggle(DOMString token, optional boolean force);
     [NotEnumerable] DOMString toString();
 };
 
diff --git a/Source/core/html/DateInputType.cpp b/Source/core/html/DateInputType.cpp
index ec2f6a0..b18edd8 100644
--- a/Source/core/html/DateInputType.cpp
+++ b/Source/core/html/DateInputType.cpp
@@ -114,7 +114,7 @@
 void DateInputType::setupLayoutParameters(DateTimeEditElement::LayoutParameters& layoutParameters, const DateComponents& date) const
 {
     layoutParameters.dateTimeFormat = layoutParameters.locale.dateFormat();
-    layoutParameters.fallbackDateTimeFormat = ASCIILiteral("yyyy-MM-dd");
+    layoutParameters.fallbackDateTimeFormat = "yyyy-MM-dd";
     if (!parseToDateComponents(element()->fastGetAttribute(minAttr), &layoutParameters.minimum))
         layoutParameters.minimum = DateComponents();
     if (!parseToDateComponents(element()->fastGetAttribute(maxAttr), &layoutParameters.maximum))
diff --git a/Source/core/html/FileInputType.cpp b/Source/core/html/FileInputType.cpp
index 1623ac5..8db9fad 100644
--- a/Source/core/html/FileInputType.cpp
+++ b/Source/core/html/FileInputType.cpp
@@ -259,7 +259,7 @@
     RefPtr<HTMLInputElement> button = HTMLInputElement::create(inputTag, element()->document(), 0, false);
     button->setType(InputTypeNames::button());
     button->setAttribute(valueAttr, element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
-    button->setPseudo(AtomicString("-webkit-file-upload-button", AtomicString::ConstructFromLiteral));
+    button->setPart(AtomicString("-webkit-file-upload-button", AtomicString::ConstructFromLiteral));
     element()->userAgentShadowRoot()->appendChild(button.release(), IGNORE_EXCEPTION);
 }
 
diff --git a/Source/core/html/FormController.cpp b/Source/core/html/FormController.cpp
index 5b2ff3c..942ab0e 100644
--- a/Source/core/html/FormController.cpp
+++ b/Source/core/html/FormController.cpp
@@ -387,7 +387,7 @@
     // In the legacy version of serialized state, the first item was a name
     // attribute value of a form control. The following string literal should
     // contain some characters which are rarely used for name attribute values.
-    DEFINE_STATIC_LOCAL(String, signature, (ASCIILiteral("\n\r?% WebKit serialized form state version 8 \n\r=&")));
+    DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 8 \n\r=&"));
     return signature;
 }
 
diff --git a/Source/core/html/HTMLBodyElement.idl b/Source/core/html/HTMLBodyElement.idl
index f65097a..dfbd907 100644
--- a/Source/core/html/HTMLBodyElement.idl
+++ b/Source/core/html/HTMLBodyElement.idl
@@ -27,28 +27,28 @@
     [Reflect] attribute DOMString vLink;
 
     // Event handler attributes
-    [NotEnumerable] attribute EventListener onbeforeunload;
-    [NotEnumerable] attribute EventListener onhashchange;
-    [NotEnumerable] attribute EventListener onmessage;
-    [NotEnumerable] attribute EventListener onoffline;
-    [NotEnumerable] attribute EventListener ononline;
-    [NotEnumerable] attribute EventListener onpopstate;
-    [NotEnumerable] attribute EventListener onresize;
-    [NotEnumerable] attribute EventListener onstorage;
-    [NotEnumerable] attribute EventListener onunload;
+    [NotEnumerable] attribute EventHandler onbeforeunload;
+    [NotEnumerable] attribute EventHandler onhashchange;
+    [NotEnumerable] attribute EventHandler onmessage;
+    [NotEnumerable] attribute EventHandler onoffline;
+    [NotEnumerable] attribute EventHandler ononline;
+    [NotEnumerable] attribute EventHandler onpopstate;
+    [NotEnumerable] attribute EventHandler onresize;
+    [NotEnumerable] attribute EventHandler onstorage;
+    [NotEnumerable] attribute EventHandler onunload;
 
-    [Conditional=ORIENTATION_EVENTS, NotEnumerable] attribute EventListener onorientationchange;
+    [Conditional=ORIENTATION_EVENTS, NotEnumerable] attribute EventHandler onorientationchange;
 
     // Overrides of Element attributes (with different implementation in bindings).
-    [NotEnumerable] attribute EventListener onblur;
-    [NotEnumerable] attribute EventListener onerror;
-    [NotEnumerable] attribute EventListener onfocus;
-    [NotEnumerable] attribute EventListener onload;
+    [NotEnumerable] attribute EventHandler onblur;
+    [NotEnumerable] attribute EventHandler onerror;
+    [NotEnumerable] attribute EventHandler onfocus;
+    [NotEnumerable] attribute EventHandler onload;
 
     // Not implemented yet.
-    // attribute [NotEnumerable] EventListener onafterprint;
-    // attribute [NotEnumerable] EventListener onbeforeprint;
-    // attribute [NotEnumerable] EventListener onredo;
-    // attribute [NotEnumerable] EventListener onundo;
+    // attribute [NotEnumerable] EventHandler onafterprint;
+    // attribute [NotEnumerable] EventHandler onbeforeprint;
+    // attribute [NotEnumerable] EventHandler onredo;
+    // attribute [NotEnumerable] EventHandler onundo;
 };
 
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 81a2a39..9a68a4d 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -120,10 +120,10 @@
     return HTMLElement::createRenderer(style);
 }
 
-void HTMLCanvasElement::attach(const AttachContext& context)
+Node::InsertionNotificationRequest HTMLCanvasElement::insertedInto(ContainerNode* node)
 {
     setIsInCanvasSubtree(true);
-    HTMLElement::attach(context);
+    return HTMLElement::insertedInto(node);
 }
 
 void HTMLCanvasElement::addObserver(CanvasObserver* observer)
diff --git a/Source/core/html/HTMLCanvasElement.h b/Source/core/html/HTMLCanvasElement.h
index 2aed48b..1de3401 100644
--- a/Source/core/html/HTMLCanvasElement.h
+++ b/Source/core/html/HTMLCanvasElement.h
@@ -133,12 +133,13 @@
 
     float deviceScaleFactor() const { return m_deviceScaleFactor; }
 
+    InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
+
 private:
     HTMLCanvasElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual RenderObject* createRenderer(RenderStyle*);
-    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool areAuthorShadowsAllowed() const OVERRIDE { return false; }
 
     void reset();
diff --git a/Source/core/html/HTMLDocument.cpp b/Source/core/html/HTMLDocument.cpp
index 33f5417..704547f 100644
--- a/Source/core/html/HTMLDocument.cpp
+++ b/Source/core/html/HTMLDocument.cpp
@@ -121,9 +121,9 @@
     Page* page = this->page();
     if (!page)
         return false;
-    if (!page->focusController()->isActive())
+    if (!page->focusController().isActive() || !page->focusController().isFocused())
         return false;
-    if (Frame* focusedFrame = page->focusController()->focusedFrame()) {
+    if (Frame* focusedFrame = page->focusController().focusedFrame()) {
         if (focusedFrame->tree()->isDescendantOf(frame()))
             return true;
     }
@@ -216,6 +216,11 @@
     }
 }
 
+PassRefPtr<Document> HTMLDocument::cloneDocumentWithoutChildren()
+{
+    return create();
+}
+
 // --------------------------------------------------------------------------
 // not part of the DOM
 // --------------------------------------------------------------------------
diff --git a/Source/core/html/HTMLDocument.h b/Source/core/html/HTMLDocument.h
index 4d6332e..993fbc0 100644
--- a/Source/core/html/HTMLDocument.h
+++ b/Source/core/html/HTMLDocument.h
@@ -76,6 +76,8 @@
 
     static bool isCaseSensitiveAttribute(const QualifiedName&);
 
+    virtual PassRefPtr<Document> cloneDocumentWithoutChildren() OVERRIDE FINAL;
+
 protected:
     HTMLDocument(const DocumentInit&, DocumentClassFlags extendedDocumentClasses = DefaultDocumentClass);
 
diff --git a/Source/core/html/HTMLDocument.idl b/Source/core/html/HTMLDocument.idl
index 574f21b..e44baee 100644
--- a/Source/core/html/HTMLDocument.idl
+++ b/Source/core/html/HTMLDocument.idl
@@ -21,10 +21,10 @@
 [
     CustomToV8
 ] interface HTMLDocument : Document {
-    [Custom] void open();
+    [Custom, CustomElementCallbacks=Enable] void open();
     void close();
-    [Custom, PerWorldBindings, ActivityLog=AccessForIsolatedWorlds] void write([Default=Undefined] optional DOMString text);
-    [Custom, PerWorldBindings, ActivityLog=AccessForIsolatedWorlds] void writeln([Default=Undefined] optional DOMString text);
+    [Custom, PerWorldBindings, ActivityLog=AccessForIsolatedWorlds, CustomElementCallbacks=Enable] void write([Default=Undefined] optional DOMString text);
+    [Custom, PerWorldBindings, ActivityLog=AccessForIsolatedWorlds, CustomElementCallbacks=Enable] void writeln([Default=Undefined] optional DOMString text);
 
     readonly attribute HTMLCollection embeds;
     readonly attribute HTMLCollection plugins;
@@ -39,18 +39,18 @@
     [DeprecateAs=CaptureEvents] void captureEvents();
     [DeprecateAs=ReleaseEvents] void releaseEvents();
 
-    [TreatNullAs=NullString] attribute DOMString dir;
-    [TreatNullAs=NullString] attribute DOMString designMode;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString dir;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString designMode;
     readonly attribute DOMString compatMode;
 
     readonly attribute Element activeElement;
     boolean hasFocus();
 
     // Deprecated attributes
-             [TreatNullAs=NullString] attribute DOMString bgColor;
-             [TreatNullAs=NullString] attribute DOMString fgColor;
-             [TreatNullAs=NullString] attribute DOMString alinkColor;
-             [TreatNullAs=NullString] attribute DOMString linkColor;
-             [TreatNullAs=NullString] attribute DOMString vlinkColor;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString bgColor;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString fgColor;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString alinkColor;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString linkColor;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString vlinkColor;
 };
 
diff --git a/Source/core/html/HTMLElement.idl b/Source/core/html/HTMLElement.idl
index 7f97db6..d728075 100644
--- a/Source/core/html/HTMLElement.idl
+++ b/Source/core/html/HTMLElement.idl
@@ -26,28 +26,28 @@
              attribute boolean             translate;
              [Reflect] attribute DOMString dir;
 
-             attribute long              tabIndex;
-             attribute boolean           draggable;
+             [CustomElementCallbacks=Enable] attribute long              tabIndex;
+             [CustomElementCallbacks=Enable] attribute boolean           draggable;
              [Reflect] attribute DOMString webkitdropzone;
              [Reflect] attribute boolean hidden;
              [Reflect] attribute DOMString accessKey;
 
     // Extensions
-             [TreatNullAs=NullString, DeliverCustomElementCallbacks, PerWorldBindings, ActivityLog=SetterForIsolatedWorlds, SetterRaisesException] attribute DOMString innerHTML;
-             [TreatNullAs=NullString, SetterRaisesException] attribute DOMString innerText;
-             [TreatNullAs=NullString, DeliverCustomElementCallbacks, SetterRaisesException] attribute DOMString outerHTML;
-             [TreatNullAs=NullString, SetterRaisesException] attribute DOMString outerText;
+             [TreatNullAs=NullString, CustomElementCallbacks=Enable, PerWorldBindings, ActivityLog=SetterForIsolatedWorlds, SetterRaisesException] attribute DOMString innerHTML;
+             [TreatNullAs=NullString, CustomElementCallbacks=Enable, SetterRaisesException] attribute DOMString innerText;
+             [TreatNullAs=NullString, CustomElementCallbacks=Enable, SetterRaisesException] attribute DOMString outerHTML;
+             [TreatNullAs=NullString, CustomElementCallbacks=Enable, SetterRaisesException] attribute DOMString outerText;
 
-    [RaisesException] Element insertAdjacentElement([Default=Undefined] optional DOMString where,
+    [RaisesException, CustomElementCallbacks=Enable] Element insertAdjacentElement([Default=Undefined] optional DOMString where,
                                   [Default=Undefined] optional Element element);
-    [DeliverCustomElementCallbacks, RaisesException] void insertAdjacentHTML([Default=Undefined] optional DOMString where,
+    [CustomElementCallbacks=Enable, RaisesException] void insertAdjacentHTML([Default=Undefined] optional DOMString where,
                             [Default=Undefined] optional DOMString html);
     [RaisesException] void insertAdjacentText([Default=Undefined] optional DOMString where,
                             [Default=Undefined] optional DOMString text);
 
     [EnabledAtRuntime=imeAPI] readonly attribute InputMethodContext inputMethodContext;
 
-             [TreatNullAs=NullString, SetterRaisesException] attribute DOMString contentEditable;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable, SetterRaisesException] attribute DOMString contentEditable;
     readonly attribute boolean isContentEditable;
 
              attribute boolean spellcheck;
diff --git a/Source/core/html/HTMLFormElement.idl b/Source/core/html/HTMLFormElement.idl
index cd2b3c7..11c8bf5 100644
--- a/Source/core/html/HTMLFormElement.idl
+++ b/Source/core/html/HTMLFormElement.idl
@@ -22,9 +22,9 @@
     [Reflect=accept_charset] attribute DOMString acceptCharset;
     [Reflect, URL] attribute DOMString action;
     [Reflect] attribute DOMString autocomplete;
-    [TreatNullAs=NullString] attribute DOMString enctype;
-    [TreatNullAs=NullString] attribute DOMString encoding;
-    [TreatNullAs=NullString] attribute DOMString method;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString enctype;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString encoding;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString method;
     [Reflect] attribute DOMString name;
     [Reflect] attribute boolean noValidate;
     [Reflect] attribute DOMString target;
@@ -35,10 +35,10 @@
     [ImplementedAs=anonymousNamedGetter, OverrideBuiltins, NotEnumerable] getter (NodeList or Node)(DOMString name);
 
     [ImplementedAs=submitFromJavaScript] void submit();
-    void reset();
+    [CustomElementCallbacks=Enable] void reset();
     boolean checkValidity();
 
     [EnabledAtRuntime=requestAutocomplete] void requestAutocomplete();
-    [EnabledAtRuntime=requestAutocomplete,NotEnumerable] attribute EventListener onautocomplete;
-    [EnabledAtRuntime=requestAutocomplete,NotEnumerable] attribute EventListener onautocompleteerror;
+    [EnabledAtRuntime=requestAutocomplete,NotEnumerable] attribute EventHandler onautocomplete;
+    [EnabledAtRuntime=requestAutocomplete,NotEnumerable] attribute EventHandler onautocompleteerror;
 };
diff --git a/Source/core/html/HTMLFrameElementBase.cpp b/Source/core/html/HTMLFrameElementBase.cpp
index 6f1a431..d04a479 100644
--- a/Source/core/html/HTMLFrameElementBase.cpp
+++ b/Source/core/html/HTMLFrameElementBase.cpp
@@ -208,9 +208,9 @@
     HTMLFrameOwnerElement::setFocus(received);
     if (Page* page = document()->page()) {
         if (received)
-            page->focusController()->setFocusedFrame(contentFrame());
-        else if (page->focusController()->focusedFrame() == contentFrame()) // Focus may have already been given to another frame, don't take it away.
-            page->focusController()->setFocusedFrame(0);
+            page->focusController().setFocusedFrame(contentFrame());
+        else if (page->focusController().focusedFrame() == contentFrame()) // Focus may have already been given to another frame, don't take it away.
+            page->focusController().setFocusedFrame(0);
     }
 }
 
diff --git a/Source/core/html/HTMLFrameOwnerElement.cpp b/Source/core/html/HTMLFrameOwnerElement.cpp
index 8378678..f197d80 100644
--- a/Source/core/html/HTMLFrameOwnerElement.cpp
+++ b/Source/core/html/HTMLFrameOwnerElement.cpp
@@ -140,7 +140,7 @@
     RefPtr<Frame> childFrame = parentFrame->loader()->client()->createFrame(url, frameName, this, referrer, allowScrollingInContentFrame(), marginWidth(), marginHeight());
 
     if (!childFrame)  {
-        parentFrame->loader()->checkCallImplicitClose();
+        parentFrame->loader()->checkCompleted();
         return false;
     }
 
@@ -157,8 +157,6 @@
     if (renderObject && renderObject->isWidget() && view)
         toRenderWidget(renderObject)->setWidget(view);
 
-    parentFrame->loader()->checkCallImplicitClose();
-
     // Some loads are performed synchronously (e.g., about:blank and loads
     // cancelled by returning a null ResourceRequest from requestFromDelegate).
     // In these cases, the synchronous load would have finished
diff --git a/Source/core/html/HTMLFrameSetElement.cpp b/Source/core/html/HTMLFrameSetElement.cpp
index d806c61..43f18e2 100644
--- a/Source/core/html/HTMLFrameSetElement.cpp
+++ b/Source/core/html/HTMLFrameSetElement.cpp
@@ -209,7 +209,7 @@
 void HTMLFrameSetElement::willRecalcStyle(StyleChange)
 {
     if (needsStyleRecalc() && renderer()) {
-        renderer()->setNeedsLayout(true);
+        renderer()->setNeedsLayout();
         clearNeedsStyleRecalc();
     }
 }
diff --git a/Source/core/html/HTMLFrameSetElement.idl b/Source/core/html/HTMLFrameSetElement.idl
index 09c262c..0a35684 100644
--- a/Source/core/html/HTMLFrameSetElement.idl
+++ b/Source/core/html/HTMLFrameSetElement.idl
@@ -24,28 +24,28 @@
     [Reflect] attribute DOMString rows;
 
     // Event handler attributes
-    [NotEnumerable] attribute EventListener onbeforeunload;
-    [NotEnumerable] attribute EventListener onhashchange;
-    [NotEnumerable] attribute EventListener onmessage;
-    [NotEnumerable] attribute EventListener onoffline;
-    [NotEnumerable] attribute EventListener ononline;
-    [NotEnumerable] attribute EventListener onpopstate;
-    [NotEnumerable] attribute EventListener onresize;
-    [NotEnumerable] attribute EventListener onstorage;
-    [NotEnumerable] attribute EventListener onunload;
+    [NotEnumerable] attribute EventHandler onbeforeunload;
+    [NotEnumerable] attribute EventHandler onhashchange;
+    [NotEnumerable] attribute EventHandler onmessage;
+    [NotEnumerable] attribute EventHandler onoffline;
+    [NotEnumerable] attribute EventHandler ononline;
+    [NotEnumerable] attribute EventHandler onpopstate;
+    [NotEnumerable] attribute EventHandler onresize;
+    [NotEnumerable] attribute EventHandler onstorage;
+    [NotEnumerable] attribute EventHandler onunload;
 
-    [Conditional=ORIENTATION_EVENTS, NotEnumerable] attribute EventListener onorientationchange;
+    [Conditional=ORIENTATION_EVENTS, NotEnumerable] attribute EventHandler onorientationchange;
 
     // Overrides of Element attributes (with different implementation in bindings).
-    [NotEnumerable] attribute EventListener onblur;
-    [NotEnumerable] attribute EventListener onerror;
-    [NotEnumerable] attribute EventListener onfocus;
-    [NotEnumerable] attribute EventListener onload;
+    [NotEnumerable] attribute EventHandler onblur;
+    [NotEnumerable] attribute EventHandler onerror;
+    [NotEnumerable] attribute EventHandler onfocus;
+    [NotEnumerable] attribute EventHandler onload;
 
     // Not implemented yet.
-    // attribute [NotEnumerable] EventListener onafterprint;
-    // attribute [NotEnumerable] EventListener onbeforeprint;
-    // attribute [NotEnumerable] EventListener onredo;
-    // attribute [NotEnumerable] EventListener onundo;
+    // attribute [NotEnumerable] EventHandler onafterprint;
+    // attribute [NotEnumerable] EventHandler onbeforeprint;
+    // attribute [NotEnumerable] EventHandler onredo;
+    // attribute [NotEnumerable] EventHandler onundo;
 };
 
diff --git a/Source/core/html/HTMLImageElement.cpp b/Source/core/html/HTMLImageElement.cpp
index 2303be2..571462b 100644
--- a/Source/core/html/HTMLImageElement.cpp
+++ b/Source/core/html/HTMLImageElement.cpp
@@ -30,7 +30,7 @@
 #include "core/dom/EventNames.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/rendering/RenderImage.h"
 
 using namespace std;
@@ -171,7 +171,7 @@
         if (!m_imageLoader.image() && !renderImageResource->cachedImage())
             renderImage->setImageSizeForAltText();
         else
-            renderImageResource->setCachedImage(m_imageLoader.image());
+            renderImageResource->setImageResource(m_imageLoader.image());
 
     }
 }
diff --git a/Source/core/html/HTMLImageElement.h b/Source/core/html/HTMLImageElement.h
index 7810d28..590b0ec 100644
--- a/Source/core/html/HTMLImageElement.h
+++ b/Source/core/html/HTMLImageElement.h
@@ -53,8 +53,8 @@
 
     CompositeOperator compositeOperator() const { return m_compositeOperator; }
 
-    CachedImage* cachedImage() const { return m_imageLoader.image(); }
-    void setCachedImage(CachedImage* i) { m_imageLoader.setImage(i); };
+    ImageResource* cachedImage() const { return m_imageLoader.image(); }
+    void setImageResource(ImageResource* i) { m_imageLoader.setImage(i); };
 
     void setLoadManually(bool loadManually) { m_imageLoader.setLoadManually(loadManually); }
 
diff --git a/Source/core/html/HTMLImageLoader.cpp b/Source/core/html/HTMLImageLoader.cpp
index de4ee64..6b966ac 100644
--- a/Source/core/html/HTMLImageLoader.cpp
+++ b/Source/core/html/HTMLImageLoader.cpp
@@ -29,7 +29,7 @@
 #include "core/html/HTMLObjectElement.h"
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 
 namespace WebCore {
 
@@ -61,7 +61,7 @@
 
 void HTMLImageLoader::notifyFinished(Resource*)
 {
-    CachedImage* cachedImage = image();
+    ImageResource* cachedImage = image();
 
     RefPtr<Element> element = this->element();
     ImageLoader::notifyFinished(cachedImage);
diff --git a/Source/core/html/HTMLImport.cpp b/Source/core/html/HTMLImport.cpp
index a6c0886..9b1230d 100644
--- a/Source/core/html/HTMLImport.cpp
+++ b/Source/core/html/HTMLImport.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "core/html/HTMLImport.h"
 
-#include "core/html/HTMLImportsController.h"
+#include "core/dom/Document.h"
 
 namespace WebCore {
 
@@ -42,7 +42,12 @@
 
 Document* HTMLImport::master()
 {
-    return controller()->document();
+    return root()->document();
+}
+
+HTMLImportsController* HTMLImport::controller()
+{
+    return root()->toController();
 }
 
 void HTMLImport::appendChild(HTMLImport* child)
diff --git a/Source/core/html/HTMLImport.h b/Source/core/html/HTMLImport.h
index ecdfd5f..215dad9 100644
--- a/Source/core/html/HTMLImport.h
+++ b/Source/core/html/HTMLImport.h
@@ -38,6 +38,7 @@
 class Frame;
 class Document;
 class Frame;
+class HTMLImportRoot;
 class HTMLImportsController;
 
 class HTMLImport {
@@ -48,12 +49,13 @@
 
     Frame* frame();
     Document* master();
+    HTMLImportsController* controller();
 
     bool isLoaded() const { return !isBlocked() && !isProcessing(); }
     bool isBlocked() const { return m_blocked; }
     void appendChild(HTMLImport*);
 
-    virtual HTMLImportsController* controller() = 0;
+    virtual HTMLImportRoot* root() = 0;
     virtual HTMLImport* parent() const = 0;
     virtual Document* document() const = 0;
     virtual void wasDetachedFromDocument() = 0;
@@ -81,6 +83,12 @@
     bool m_blocked; // If any of decendants or predecessors is in processing, it is blocked.
 };
 
+class HTMLImportRoot : public HTMLImport {
+public:
+    virtual void importWasDisposed() = 0;
+    virtual HTMLImportsController* toController() = 0;
+};
+
 } // namespace WebCore
 
 #endif // HTMLImport_h
diff --git a/Source/core/html/HTMLImportLoader.cpp b/Source/core/html/HTMLImportLoader.cpp
new file mode 100644
index 0000000..ef2d766
--- /dev/null
+++ b/Source/core/html/HTMLImportLoader.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "core/html/HTMLImportLoader.h"
+
+#include "core/dom/Document.h"
+#include "core/html/HTMLDocument.h"
+#include "core/html/HTMLImportLoaderClient.h"
+#include "core/loader/DocumentWriter.h"
+#include "core/loader/cache/ResourceFetcher.h"
+#include "core/page/ContentSecurityPolicyResponseHeaders.h"
+
+namespace WebCore {
+
+HTMLImportLoader::HTMLImportLoader(HTMLImport* parent, const KURL& url, const ResourcePtr<RawResource>& resource)
+    : m_parent(parent)
+    , m_state(StateLoading)
+    , m_resource(resource)
+    , m_url(url)
+{
+    m_resource->addClient(this);
+}
+
+HTMLImportLoader::~HTMLImportLoader()
+{
+    // importDestroyed() should be called before the destruction.
+    ASSERT(!m_parent);
+    ASSERT(!m_importedDocument);
+    if (m_resource)
+        m_resource->removeClient(this);
+}
+
+void HTMLImportLoader::responseReceived(Resource*, const ResourceResponse& response)
+{
+    setState(startWritingAndParsing(response));
+}
+
+void HTMLImportLoader::dataReceived(Resource*, const char* data, int length)
+{
+    RefPtr<DocumentWriter> protectingWriter(m_writer);
+    m_writer->addData(data, length);
+}
+
+void HTMLImportLoader::notifyFinished(Resource*)
+{
+    setState(finishWriting());
+}
+
+void HTMLImportLoader::setState(State state)
+{
+    if (m_state == state)
+        return;
+
+    m_state = state;
+
+    if (m_state == StateReady || m_state == StateError || m_state == StateWritten) {
+        if (RefPtr<DocumentWriter> writer = m_writer.release())
+            writer->end();
+    }
+
+    // Since DocumentWriter::end() let setState() reenter, we shouldn't refer to m_state here.
+    if (state == StateReady || state == StateError)
+        didFinish();
+}
+
+void HTMLImportLoader::didFinish()
+{
+    for (size_t i = 0; i < m_clients.size(); ++i)
+        m_clients[i]->didFinish();
+
+    if (m_resource) {
+        m_resource->removeClient(this);
+        m_resource = 0;
+    }
+
+    ASSERT(!document() || !document()->parsing());
+    root()->importWasDisposed();
+}
+
+HTMLImportLoader::State HTMLImportLoader::startWritingAndParsing(const ResourceResponse& response)
+{
+    // Current canAccess() implementation isn't sufficient for catching cross-domain redirects: http://crbug.com/256976
+    if (!m_parent->document()->fetcher()->canAccess(m_resource.get()))
+        return StateError;
+
+    m_importedDocument = HTMLDocument::create(DocumentInit(response.url(), 0, this).withRegistrationContext(root()->document()->registrationContext()));
+    m_importedDocument->initContentSecurityPolicy(ContentSecurityPolicyResponseHeaders(response));
+    m_writer = DocumentWriter::create(m_importedDocument.get(), response.mimeType(), response.textEncodingName());
+
+    return StateLoading;
+}
+
+HTMLImportLoader::State HTMLImportLoader::finishWriting()
+{
+    if (!m_parent)
+        return StateError;
+    // The writer instance indicates that a part of the document can be already loaded.
+    // We don't take such a case as an error because the partially-loaded document has been visible from script at this point.
+    if (m_resource->loadFailedOrCanceled() && !m_writer)
+        return StateError;
+
+    return StateWritten;
+}
+
+HTMLImportLoader::State HTMLImportLoader::finishParsing()
+{
+    if (!m_parent)
+        return StateError;
+    return StateReady;
+}
+
+Document* HTMLImportLoader::importedDocument() const
+{
+    if (m_state == StateError)
+        return 0;
+    return m_importedDocument.get();
+}
+
+void HTMLImportLoader::addClient(HTMLImportLoaderClient* client)
+{
+    ASSERT(notFound == m_clients.find(client));
+    m_clients.append(client);
+    if (isDone())
+        client->didFinish();
+}
+
+void HTMLImportLoader::removeClient(HTMLImportLoaderClient* client)
+{
+    ASSERT(notFound != m_clients.find(client));
+    m_clients.remove(m_clients.find(client));
+}
+
+void HTMLImportLoader::importDestroyed()
+{
+    m_parent = 0;
+    if (RefPtr<Document> document = m_importedDocument.release())
+        document->setImport(0);
+}
+
+HTMLImportRoot* HTMLImportLoader::root()
+{
+    return m_parent ? m_parent->root() : 0;
+}
+
+HTMLImport* HTMLImportLoader::parent() const
+{
+    return m_parent;
+}
+
+Document* HTMLImportLoader::document() const
+{
+    return m_importedDocument.get();
+}
+
+void HTMLImportLoader::wasDetachedFromDocument()
+{
+    // For imported documens this shouldn't be called because Document::m_import is
+    // cleared before Document is destroyed by HTMLImportLoader::importDestroyed().
+    ASSERT_NOT_REACHED();
+}
+
+void HTMLImportLoader::didFinishParsing()
+{
+    setState(finishParsing());
+}
+
+bool HTMLImportLoader::isProcessing() const
+{
+    if (!m_importedDocument)
+        return !isDone();
+    return m_importedDocument->parsing();
+}
+
+} // namespace WebCore
diff --git a/Source/core/html/HTMLImportLoader.h b/Source/core/html/HTMLImportLoader.h
new file mode 100644
index 0000000..4b9b399
--- /dev/null
+++ b/Source/core/html/HTMLImportLoader.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLImportLoader_h
+#define HTMLImportLoader_h
+
+#include "core/html/HTMLImport.h"
+#include "core/loader/cache/RawResource.h"
+#include "core/loader/cache/ResourcePtr.h"
+#include "weborigin/KURL.h"
+#include "wtf/RefCounted.h"
+#include "wtf/Vector.h"
+
+namespace WebCore {
+
+class DocumentWriter;
+class HTMLImportLoaderClient;
+
+class HTMLImportLoader : public RefCounted<HTMLImportLoader>, public HTMLImport, public RawResourceClient {
+public:
+    enum State {
+        StateLoading,
+        StateWritten,
+        StateError,
+        StateReady
+    };
+
+    HTMLImportLoader(HTMLImport*, const KURL&, const ResourcePtr<RawResource>&);
+    virtual ~HTMLImportLoader();
+
+    Document* importedDocument() const;
+    const KURL& url() const { return m_url; }
+
+    void addClient(HTMLImportLoaderClient*);
+    void removeClient(HTMLImportLoaderClient*);
+    void importDestroyed();
+    bool isDone() const { return m_state == StateReady || m_state == StateError; }
+    bool isLoaded() const { return m_state == StateReady; }
+
+    // HTMLImport
+    virtual HTMLImportRoot* root() OVERRIDE;
+    virtual HTMLImport* parent() const OVERRIDE;
+    virtual Document* document() const OVERRIDE;
+    virtual void wasDetachedFromDocument() OVERRIDE;
+    virtual void didFinishParsing() OVERRIDE;
+    virtual bool isProcessing() const OVERRIDE;
+
+private:
+
+    // RawResourceClient
+    virtual void responseReceived(Resource*, const ResourceResponse&) OVERRIDE;
+    virtual void dataReceived(Resource*, const char* data, int length) OVERRIDE;
+    virtual void notifyFinished(Resource*) OVERRIDE;
+
+    State startWritingAndParsing(const ResourceResponse&);
+    State finishWriting();
+    State finishParsing();
+
+    void setState(State);
+    void didFinish();
+
+    HTMLImport* m_parent;
+    Vector<HTMLImportLoaderClient*> m_clients;
+    State m_state;
+    KURL m_url;
+    ResourcePtr<RawResource> m_resource;
+    RefPtr<Document> m_importedDocument;
+    RefPtr<DocumentWriter> m_writer;
+};
+
+} // namespace WebCore
+
+#endif // HTMLImportLoader_h
diff --git a/Source/core/html/HTMLImportLoaderClient.h b/Source/core/html/HTMLImportLoaderClient.h
new file mode 100644
index 0000000..0cac67f
--- /dev/null
+++ b/Source/core/html/HTMLImportLoaderClient.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLImportLoaderClient_h
+#define HTMLImportLoaderClient_h
+
+namespace WebCore {
+
+class HTMLImportLoaderClient {
+public:
+    virtual ~HTMLImportLoaderClient() { }
+    virtual void didFinish() = 0;
+};
+
+} // namespace WebCore
+
+#endif // HTMLImportLoaderClient_h
diff --git a/Source/core/html/HTMLImportsController.cpp b/Source/core/html/HTMLImportsController.cpp
index daa957d..cb2107a 100644
--- a/Source/core/html/HTMLImportsController.cpp
+++ b/Source/core/html/HTMLImportsController.cpp
@@ -32,229 +32,12 @@
 #include "core/html/HTMLImportsController.h"
 
 #include "core/dom/Document.h"
-#include "core/html/HTMLDocument.h"
-#include "core/html/HTMLLinkElement.h"
-#include "core/loader/CrossOriginAccessControl.h"
-#include "core/loader/DocumentWriter.h"
-#include "core/loader/cache/CachedScript.h"
+#include "core/html/HTMLImportLoader.h"
+#include "core/html/HTMLImportLoaderClient.h"
 #include "core/loader/cache/ResourceFetcher.h"
-#include "core/page/ContentSecurityPolicyResponseHeaders.h"
-#include "weborigin/SecurityOrigin.h"
 
 namespace WebCore {
 
-PassRefPtr<LinkImport> LinkImport::create(HTMLLinkElement* owner)
-{
-    return adoptRef(new LinkImport(owner));
-}
-
-LinkImport::LinkImport(HTMLLinkElement* owner)
-    : LinkResource(owner)
-{
-}
-
-LinkImport::~LinkImport()
-{
-}
-
-Document* LinkImport::importedDocument() const
-{
-    if (!m_loader)
-        return 0;
-    return m_loader->importedDocument();
-}
-
-void LinkImport::process()
-{
-    if (m_loader)
-        return;
-    if (!m_owner)
-        return;
-
-    if (!m_owner->document()->frame() && !m_owner->document()->import())
-        return;
-
-    LinkRequestBuilder builder(m_owner);
-    if (!builder.isValid())
-        return;
-
-    if (!m_owner->document()->import()) {
-        ASSERT(m_owner->document()->frame()); // The document should be the master.
-        HTMLImportsController::provideTo(m_owner->document());
-    }
-
-    HTMLImport* parent = m_owner->document()->import();
-    HTMLImportsController* controller = parent->controller();
-    if (RefPtr<HTMLImportLoader> found = controller->findLinkFor(builder.url())) {
-        m_loader = found;
-        return;
-    }
-
-    FetchRequest request = builder.build(true);
-    request.setPotentiallyCrossOriginEnabled(controller->securityOrigin(), DoNotAllowStoredCredentials);
-    ResourcePtr<CachedRawResource> resource = m_owner->document()->fetcher()->requestImport(request);
-    if (!resource)
-        return;
-
-    m_loader = HTMLImportLoader::create(parent, builder.url(), resource);
-}
-
-void LinkImport::ownerRemoved()
-{
-    m_owner = 0;
-    m_loader.clear();
-}
-
-
-PassRefPtr<HTMLImportLoader> HTMLImportLoader::create(HTMLImport* parent, const KURL& url, const ResourcePtr<CachedScript>& resource)
-{
-    RefPtr<HTMLImportLoader> loader = adoptRef(new HTMLImportLoader(parent, url, resource));
-    loader->controller()->addImport(loader);
-    parent->appendChild(loader.get());
-    return loader.release();
-}
-
-HTMLImportLoader::HTMLImportLoader(HTMLImport* parent, const KURL& url, const ResourcePtr<CachedScript>& resource)
-    : m_parent(parent)
-    , m_state(StateLoading)
-    , m_resource(resource)
-    , m_url(url)
-{
-    m_resource->addClient(this);
-}
-
-HTMLImportLoader::~HTMLImportLoader()
-{
-    // importDestroyed() should be called before the destruction.
-    ASSERT(!m_parent);
-    ASSERT(!m_importedDocument);
-    if (m_resource)
-        m_resource->removeClient(this);
-}
-
-void HTMLImportLoader::responseReceived(Resource*, const ResourceResponse& response)
-{
-    setState(startWritingAndParsing(response));
-}
-
-void HTMLImportLoader::dataReceived(Resource*, const char* data, int length)
-{
-    RefPtr<DocumentWriter> protectingWriter(m_writer);
-    m_writer->addData(data, length);
-}
-
-void HTMLImportLoader::notifyFinished(Resource*)
-{
-    setState(finishWriting());
-}
-
-void HTMLImportLoader::setState(State state)
-{
-    if (m_state == state)
-        return;
-
-    m_state = state;
-
-    if (m_state == StateReady || m_state == StateError || m_state == StateWritten) {
-        if (RefPtr<DocumentWriter> writer = m_writer.release())
-            writer->end();
-    }
-
-    if (m_state == StateReady || m_state == StateError)
-        dispose();
-}
-
-void HTMLImportLoader::dispose()
-{
-    if (m_resource) {
-        m_resource->removeClient(this);
-        m_resource = 0;
-    }
-
-    ASSERT(!document() || !document()->parsing());
-    controller()->scheduleUnblock();
-}
-
-HTMLImportLoader::State HTMLImportLoader::startWritingAndParsing(const ResourceResponse& response)
-{
-    // Current canAccess() implementation isn't sufficient for catching cross-domain redirects: http://crbug.com/256976
-    if (!m_parent->document()->fetcher()->canAccess(m_resource.get()))
-        return StateError;
-
-    m_importedDocument = HTMLDocument::create(DocumentInit(response.url(), 0, this).withRegistrationContext(controller()->document()->registrationContext()));
-    m_importedDocument->initContentSecurityPolicy(ContentSecurityPolicyResponseHeaders(response));
-    m_writer = DocumentWriter::create(m_importedDocument.get(), response.mimeType(), response.textEncodingName());
-
-    return StateLoading;
-}
-
-HTMLImportLoader::State HTMLImportLoader::finishWriting()
-{
-    if (!m_parent)
-        return StateError;
-    // The writer instance indicates that a part of the document can be already loaded.
-    // We don't take such a case as an error because the partially-loaded document has been visible from script at this point.
-    if (m_resource->loadFailedOrCanceled() && !m_writer)
-        return StateError;
-
-    return StateWritten;
-}
-
-HTMLImportLoader::State HTMLImportLoader::finishParsing()
-{
-    if (!m_parent)
-        return StateError;
-    return StateReady;
-}
-
-Document* HTMLImportLoader::importedDocument() const
-{
-    if (m_state == StateError)
-        return 0;
-    return m_importedDocument.get();
-}
-
-void HTMLImportLoader::importDestroyed()
-{
-    m_parent = 0;
-    if (RefPtr<Document> document = m_importedDocument.release())
-        document->setImport(0);
-}
-
-HTMLImportsController* HTMLImportLoader::controller()
-{
-    return m_parent ? m_parent->controller() : 0;
-}
-
-HTMLImport* HTMLImportLoader::parent() const
-{
-    return m_parent;
-}
-
-Document* HTMLImportLoader::document() const
-{
-    return m_importedDocument.get();
-}
-
-void HTMLImportLoader::wasDetachedFromDocument()
-{
-    // For imported documens this shouldn't be called because Document::m_import is
-    // cleared before Document is destroyed by HTMLImportLoader::importDestroyed().
-    ASSERT_NOT_REACHED();
-}
-
-void HTMLImportLoader::didFinishParsing()
-{
-    setState(finishParsing());
-}
-
-bool HTMLImportLoader::isProcessing() const
-{
-    if (!m_importedDocument)
-        return !isDone();
-    return m_importedDocument->parsing();
-}
-
 void HTMLImportsController::provideTo(Document* master)
 {
     DEFINE_STATIC_LOCAL(const char*, name, ("HTMLImportsController"));
@@ -283,10 +66,22 @@
     m_master = 0;
 }
 
-void HTMLImportsController::addImport(PassRefPtr<HTMLImportLoader> link)
+PassRefPtr<HTMLImportLoader> HTMLImportsController::createLoader(HTMLImport* parent, FetchRequest request)
 {
-    ASSERT(!link->url().isEmpty() && link->url().isValid());
-    m_imports.append(link);
+    ASSERT(!request.url().isEmpty() && request.url().isValid());
+
+    if (RefPtr<HTMLImportLoader> found = findLinkFor(request.url()))
+        return found.release();
+
+    request.setPotentiallyCrossOriginEnabled(securityOrigin(), DoNotAllowStoredCredentials);
+    ResourcePtr<RawResource> resource = parent->document()->fetcher()->requestImport(request);
+    if (!resource)
+        return 0;
+
+    RefPtr<HTMLImportLoader> loader = adoptRef(new HTMLImportLoader(parent, request.url(), resource));
+    parent->appendChild(loader.get());
+    m_imports.append(loader);
+    return loader.release();
 }
 
 void HTMLImportsController::showSecurityErrorMessage(const String& message)
@@ -314,7 +109,7 @@
     return m_master->fetcher();
 }
 
-HTMLImportsController* HTMLImportsController::controller()
+HTMLImportRoot* HTMLImportsController::root()
 {
     return this;
 }
@@ -343,6 +138,11 @@
     return m_master->parsing();
 }
 
+void HTMLImportsController::importWasDisposed()
+{
+    scheduleUnblock();
+}
+
 void HTMLImportsController::scheduleUnblock()
 {
     if (m_unblockTimer.isActive())
diff --git a/Source/core/html/HTMLImportsController.h b/Source/core/html/HTMLImportsController.h
index 3d4cee5..b106d8a 100644
--- a/Source/core/html/HTMLImportsController.h
+++ b/Source/core/html/HTMLImportsController.h
@@ -33,8 +33,7 @@
 
 #include "core/html/HTMLImport.h"
 #include "core/html/LinkResource.h"
-#include "core/loader/cache/CachedRawResource.h"
-#include "core/loader/cache/ResourcePtr.h"
+#include "core/loader/cache/RawResource.h"
 #include "core/platform/Supplementable.h"
 #include "core/platform/Timer.h"
 #include "wtf/FastAllocBase.h"
@@ -43,85 +42,13 @@
 
 namespace WebCore {
 
+class FetchRequest;
 class ScriptExecutionContext;
 class ResourceFetcher;
 class HTMLImportLoader;
-class HTMLImportsController;
-class DocumentWriter;
+class HTMLImportLoaderClient;
 
-//
-// A LinkResource subclasss used for @rel=import.
-//
-class LinkImport : public LinkResource {
-    WTF_MAKE_FAST_ALLOCATED;
-public:
-
-    static PassRefPtr<LinkImport> create(HTMLLinkElement* owner);
-
-    explicit LinkImport(HTMLLinkElement* owner);
-    virtual ~LinkImport();
-
-    // LinkResource
-    virtual void process() OVERRIDE;
-    virtual Type type() const OVERRIDE { return Import; }
-    virtual void ownerRemoved() OVERRIDE;
-
-    Document* importedDocument() const;
-
-private:
-    RefPtr<HTMLImportLoader> m_loader;
-};
-
-class HTMLImportLoader : public RefCounted<HTMLImportLoader>, public HTMLImport, public CachedRawResourceClient {
-public:
-    enum State {
-        StateLoading,
-        StateWritten,
-        StateError,
-        StateReady
-    };
-
-    static PassRefPtr<HTMLImportLoader> create(HTMLImport* parent, const KURL&, const ResourcePtr<CachedScript>&);
-    virtual ~HTMLImportLoader();
-
-    Document* importedDocument() const;
-    const KURL& url() const { return m_url; }
-
-    void importDestroyed();
-    bool isDone() const { return m_state == StateReady || m_state == StateError; }
-
-    // HTMLImport
-    virtual HTMLImportsController* controller() OVERRIDE;
-    virtual HTMLImport* parent() const OVERRIDE;
-    virtual Document* document() const OVERRIDE;
-    virtual void wasDetachedFromDocument() OVERRIDE;
-    virtual void didFinishParsing() OVERRIDE;
-    virtual bool isProcessing() const OVERRIDE;
-
-private:
-    HTMLImportLoader(HTMLImport*, const KURL&, const ResourcePtr<CachedScript>&);
-
-    // CachedRawResourceClient
-    virtual void responseReceived(Resource*, const ResourceResponse&) OVERRIDE;
-    virtual void dataReceived(Resource*, const char* data, int length) OVERRIDE;
-    virtual void notifyFinished(Resource*) OVERRIDE;
-
-    State startWritingAndParsing(const ResourceResponse&);
-    State finishWriting();
-    State finishParsing();
-
-    void setState(State);
-    void dispose();
-
-    HTMLImport* m_parent;
-    State m_state;
-    KURL m_url;
-    ResourcePtr<CachedRawResource> m_resource;
-    RefPtr<Document> m_importedDocument;
-    RefPtr<DocumentWriter> m_writer;
-};
-
-class HTMLImportsController : public HTMLImport, public Supplement<ScriptExecutionContext> {
+class HTMLImportsController : public HTMLImportRoot, public Supplement<ScriptExecutionContext> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static void provideTo(Document*);
@@ -130,14 +57,17 @@
     virtual ~HTMLImportsController();
 
     // HTMLImport
-    virtual HTMLImportsController* controller() OVERRIDE;
+    virtual HTMLImportRoot* root() OVERRIDE;
     virtual HTMLImport* parent() const OVERRIDE;
     virtual Document* document() const OVERRIDE;
     virtual void wasDetachedFromDocument() OVERRIDE;
     virtual void didFinishParsing() OVERRIDE;
     virtual bool isProcessing() const OVERRIDE;
+    // HTMLImportRoot
+    virtual void importWasDisposed() OVERRIDE;
+    virtual HTMLImportsController* toController() { return this; }
 
-    void addImport(PassRefPtr<HTMLImportLoader>);
+    PassRefPtr<HTMLImportLoader> createLoader(HTMLImport* parent, FetchRequest);
     void showSecurityErrorMessage(const String&);
     PassRefPtr<HTMLImportLoader> findLinkFor(const KURL&) const;
     SecurityOrigin* securityOrigin() const;
diff --git a/Source/core/html/HTMLInputElement.cpp b/Source/core/html/HTMLInputElement.cpp
index 3512604..236c653 100644
--- a/Source/core/html/HTMLInputElement.cpp
+++ b/Source/core/html/HTMLInputElement.cpp
@@ -188,16 +188,6 @@
     return m_inputType->innerSpinButtonElement();
 }
 
-HTMLElement* HTMLInputElement::searchDecorationElement() const
-{
-    return m_inputType->searchDecorationElement();
-}
-
-HTMLElement* HTMLInputElement::cancelButtonElement() const
-{
-    return m_inputType->cancelButtonElement();
-}
-
 #if ENABLE(INPUT_SPEECH)
 HTMLElement* HTMLInputElement::speechButtonElement() const
 {
diff --git a/Source/core/html/HTMLInputElement.h b/Source/core/html/HTMLInputElement.h
index 268be2b..faa6b8e 100644
--- a/Source/core/html/HTMLInputElement.h
+++ b/Source/core/html/HTMLInputElement.h
@@ -122,8 +122,6 @@
     virtual HTMLElement* innerTextElement() const;
     HTMLElement* innerBlockElement() const;
     HTMLElement* innerSpinButtonElement() const;
-    HTMLElement* searchDecorationElement() const;
-    HTMLElement* cancelButtonElement() const;
 #if ENABLE(INPUT_SPEECH)
     HTMLElement* speechButtonElement() const;
 #endif
diff --git a/Source/core/html/HTMLInputElement.idl b/Source/core/html/HTMLInputElement.idl
index 2911901..fd17406 100644
--- a/Source/core/html/HTMLInputElement.idl
+++ b/Source/core/html/HTMLInputElement.idl
@@ -34,15 +34,15 @@
     // https://www.w3.org/Bugs/Public/show_bug.cgi?id=22682
     attribute FileList files;
     [Reflect, URL] attribute DOMString formAction;
-    [TreatNullAs=NullString] attribute DOMString formEnctype;
-    [TreatNullAs=NullString] attribute DOMString formMethod;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString formEnctype;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString formMethod;
     [Reflect] attribute boolean formNoValidate;
     [Reflect] attribute DOMString formTarget;
-    attribute unsigned long height;
+    [CustomElementCallbacks=Enable] attribute unsigned long height;
     attribute boolean indeterminate;
     [EnabledAtRuntime=DataListElement] readonly attribute HTMLElement list;
     [Reflect] attribute DOMString max;
-    [SetterRaisesException] attribute long maxLength;
+    [SetterRaisesException, CustomElementCallbacks=Enable] attribute long maxLength;
     [Reflect] attribute DOMString min;
     [Reflect] attribute boolean multiple;
     [Reflect] attribute DOMString name;
@@ -50,21 +50,21 @@
     [Reflect] attribute DOMString placeholder;
     [Reflect] attribute boolean readOnly;
     [Reflect] attribute boolean required;
-    [SetterRaisesException] attribute unsigned long size; // Changed string -> long -> unsigned long
+    [SetterRaisesException, CustomElementCallbacks=Enable] attribute unsigned long size; // Changed string -> long -> unsigned long
     [Reflect, URL] attribute DOMString src;
     [Reflect] attribute DOMString step;
-    [TreatNullAs=NullString] attribute DOMString type; // readonly dropped as part of DOM level 2
-    [TreatNullAs=NullString] attribute DOMString defaultValue;
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString type; // readonly dropped as part of DOM level 2
+    [TreatNullAs=NullString, CustomElementCallbacks=Enable] attribute DOMString defaultValue;
     // See the discussion in https://bugs.webkit.org/show_bug.cgi?id=100085
-    [TreatNullAs=NullString, SetterRaisesException] attribute DOMString value;
-    [SetterRaisesException] attribute Date valueAsDate;
-    [SetterRaisesException] attribute double valueAsNumber;
+    [TreatNullAs=NullString, SetterRaisesException, CustomElementCallbacks=Enable] attribute DOMString value;
+    [SetterRaisesException, CustomElementCallbacks=Enable] attribute Date valueAsDate;
+    [SetterRaisesException, CustomElementCallbacks=Enable] attribute double valueAsNumber;
     [EnabledAtRuntime=inputModeAttribute, Reflect] attribute DOMString inputMode;
 
-    [RaisesException] void stepUp(optional long n);
-    [RaisesException] void stepDown(optional long n);
+    [RaisesException, CustomElementCallbacks=Enable] void stepUp(optional long n);
+    [RaisesException, CustomElementCallbacks=Enable] void stepDown(optional long n);
 
-    attribute unsigned long width;
+    [CustomElementCallbacks=Enable] attribute unsigned long width;
     readonly attribute boolean willValidate;
     readonly attribute ValidityState validity;
     readonly attribute DOMString validationMessage;
@@ -96,7 +96,7 @@
     [Reflect] attribute boolean incremental;
     [Conditional=INPUT_SPEECH, Reflect, EnabledAtRuntime=speechInput] attribute boolean webkitSpeech;
     [Conditional=INPUT_SPEECH, Reflect, EnabledAtRuntime=speechInput] attribute boolean webkitGrammar;
-    [Conditional=INPUT_SPEECH, NotEnumerable] attribute EventListener onwebkitspeechchange;
+    [Conditional=INPUT_SPEECH, NotEnumerable] attribute EventHandler onwebkitspeechchange;
 
     // See http://www.w3.org/TR/html-media-capture/
     [Conditional=MEDIA_CAPTURE, Reflect] attribute boolean capture;
diff --git a/Source/core/html/HTMLKeygenElement.cpp b/Source/core/html/HTMLKeygenElement.cpp
index a79b7eb..590e677 100644
--- a/Source/core/html/HTMLKeygenElement.cpp
+++ b/Source/core/html/HTMLKeygenElement.cpp
@@ -59,7 +59,7 @@
 
     // Create a select element with one option element for each key size.
     RefPtr<HTMLSelectElement> select = HTMLSelectElement::create(document());
-    select->setPseudo(keygenSelectPseudoId);
+    select->setPart(keygenSelectPseudoId);
     for (size_t i = 0; i < keys.size(); ++i) {
         RefPtr<HTMLOptionElement> option = HTMLOptionElement::create(document());
         option->appendChild(Text::create(document(), keys[i]), ASSERT_NO_EXCEPTION);
diff --git a/Source/core/html/HTMLLinkElement.cpp b/Source/core/html/HTMLLinkElement.cpp
index b2e4ae6..cf9220a 100644
--- a/Source/core/html/HTMLLinkElement.cpp
+++ b/Source/core/html/HTMLLinkElement.cpp
@@ -37,10 +37,10 @@
 #include "core/dom/DocumentStyleSheetCollection.h"
 #include "core/dom/Event.h"
 #include "core/dom/EventSender.h"
-#include "core/html/HTMLImportsController.h"
+#include "core/html/LinkImport.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
-#include "core/loader/cache/CachedCSSStyleSheet.h"
+#include "core/loader/cache/CSSStyleSheetResource.h"
 #include "core/loader/cache/FetchRequest.h"
 #include "core/loader/cache/ResourceFetcher.h"
 #include "core/page/ContentSecurityPolicy.h"
@@ -288,13 +288,18 @@
 void HTMLLinkElement::dispatchPendingEvent(LinkEventSender* eventSender)
 {
     ASSERT_UNUSED(eventSender, eventSender == &linkLoadEventSender());
-    ASSERT(linkStyle());
-    if (linkStyle()->hasLoadedSheet())
+    ASSERT(m_link);
+    if (m_link->hasLoaded())
         linkLoaded();
     else
         linkLoadingErrored();
 }
 
+void HTMLLinkElement::scheduleEvent()
+{
+    linkLoadEventSender().dispatchEventSoon(this);
+}
+
 void HTMLLinkElement::startLoadingDynamicSheet()
 {
     ASSERT(linkStyle());
@@ -386,8 +391,8 @@
     if (m_sheet)
         m_sheet->clearOwnerNode();
 
-    if (m_cachedSheet)
-        m_cachedSheet->removeClient(this);
+    if (m_resource)
+        m_resource->removeClient(this);
 }
 
 Document* LinkStyle::document()
@@ -395,7 +400,7 @@
     return m_owner->document();
 }
 
-void LinkStyle::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* cachedStyleSheet)
+void LinkStyle::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CSSStyleSheetResource* cachedStyleSheet)
 {
     if (!m_owner->inDocument()) {
         ASSERT(!m_sheet);
@@ -407,7 +412,7 @@
 
     CSSParserContext parserContext(m_owner->document(), baseURL, charset);
 
-    if (RefPtr<StyleSheetContents> restoredSheet = const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->restoreParsedStyleSheet(parserContext)) {
+    if (RefPtr<StyleSheetContents> restoredSheet = const_cast<CSSStyleSheetResource*>(cachedStyleSheet)->restoreParsedStyleSheet(parserContext)) {
         ASSERT(restoredSheet->isCacheable());
         ASSERT(!restoredSheet->isLoading());
 
@@ -438,7 +443,7 @@
     styleSheet->checkLoaded();
 
     if (styleSheet->isCacheable())
-        const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->saveParsedStyleSheet(styleSheet);
+        const_cast<CSSStyleSheetResource*>(cachedStyleSheet)->saveParsedStyleSheet(styleSheet);
 }
 
 bool LinkStyle::sheetLoaded()
@@ -455,7 +460,8 @@
     if (m_firedLoad)
         return;
     m_loadedSheet = !errorOccurred;
-    linkLoadEventSender().dispatchEventSoon(m_owner);
+    if (m_owner)
+        m_owner->scheduleEvent();
     m_firedLoad = true;
 }
 
@@ -579,10 +585,10 @@
     if ((m_disabledState != Disabled) && m_owner->relAttribute().isStyleSheet()
         && document()->frame() && builder.url().isValid()) {
 
-        if (m_cachedSheet) {
+        if (m_resource) {
             removePendingSheet();
-            m_cachedSheet->removeClient(this);
-            m_cachedSheet = 0;
+            m_resource->removeClient(this);
+            m_resource = 0;
         }
 
         if (!m_owner->shouldLoadLink())
@@ -605,10 +611,10 @@
 
         // Load stylesheets that are not needed for the rendering immediately with low priority.
         FetchRequest request = builder.build(blocking);
-        m_cachedSheet = document()->fetcher()->requestCSSStyleSheet(request);
+        m_resource = document()->fetcher()->requestCSSStyleSheet(request);
 
-        if (m_cachedSheet)
-            m_cachedSheet->addClient(this);
+        if (m_resource)
+            m_resource->addClient(this);
         else {
             // The request may have been denied if (for example) the stylesheet is local and the document is remote.
             m_loading = false;
diff --git a/Source/core/html/HTMLLinkElement.h b/Source/core/html/HTMLLinkElement.h
index 10c9587..9d10b26 100644
--- a/Source/core/html/HTMLLinkElement.h
+++ b/Source/core/html/HTMLLinkElement.h
@@ -32,8 +32,8 @@
 #include "core/html/LinkResource.h"
 #include "core/loader/LinkLoader.h"
 #include "core/loader/LinkLoaderClient.h"
-#include "core/loader/cache/CachedStyleSheetClient.h"
 #include "core/loader/cache/ResourcePtr.h"
+#include "core/loader/cache/StyleSheetResourceClient.h"
 
 namespace WebCore {
 
@@ -54,7 +54,7 @@
 // changing @rel makes it harder to move such a design so we are
 // sticking current way so far.
 //
-class LinkStyle FINAL : public LinkResource, CachedStyleSheetClient {
+class LinkStyle FINAL : public LinkResource, StyleSheetResourceClient {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassRefPtr<LinkStyle> create(HTMLLinkElement* owner);
@@ -65,6 +65,7 @@
     virtual Type type() const OVERRIDE { return Style; }
     virtual void process() OVERRIDE;
     virtual void ownerRemoved() OVERRIDE;
+    virtual bool hasLoaded() const OVERRIDE { return m_loadedSheet; }
 
     void startLoadingDynamicSheet();
     void notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred);
@@ -75,7 +76,6 @@
 
     bool styleSheetIsLoading() const;
     bool hasSheet() const { return m_sheet; }
-    bool hasLoadedSheet() const { return m_loadedSheet; }
     bool isDisabled() const { return m_disabledState == Disabled; }
     bool isEnabledViaScript() const { return m_disabledState == EnabledViaScript; }
     bool isUnset() const { return m_disabledState == Unset; }
@@ -84,7 +84,7 @@
 
 private:
     // From ResourceClient
-    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet*);
+    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CSSStyleSheetResource*);
 
     enum DisabledState {
         Unset,
@@ -108,7 +108,7 @@
     void removePendingSheet(RemovePendingSheetNotificationType = RemovePendingSheetNotifyImmediately);
     Document* document();
 
-    ResourcePtr<CachedCSSStyleSheet> m_cachedSheet;
+    ResourcePtr<CSSStyleSheetResource> m_resource;
     RefPtr<CSSStyleSheet> m_sheet;
     DisabledState m_disabledState;
     PendingSheetType m_pendingSheetType;
@@ -149,6 +149,7 @@
     DOMSettableTokenList* sizes() const;
 
     void dispatchPendingEvent(LinkEventSender*);
+    void scheduleEvent();
     static void dispatchPendingLoadEvents();
 
     // From LinkLoaderClient
diff --git a/Source/core/html/HTMLMarqueeElement.idl b/Source/core/html/HTMLMarqueeElement.idl
index 9fc56be..b5bda0c 100644
--- a/Source/core/html/HTMLMarqueeElement.idl
+++ b/Source/core/html/HTMLMarqueeElement.idl
@@ -35,7 +35,7 @@
 
     // FIXME: Implement the following event handler attributes
     // https://bugs.webkit.org/show_bug.cgi?id=49788
-    // attribute EventListener onbounce;
-    // attribute EventListener onfinish;
-    // attribute EventListener onstart;
+    // attribute EventHandler onbounce;
+    // attribute EventHandler onfinish;
+    // attribute EventHandler onstart;
 };
diff --git a/Source/core/html/HTMLMediaElement.cpp b/Source/core/html/HTMLMediaElement.cpp
index 540c8e8..ba7d02b 100644
--- a/Source/core/html/HTMLMediaElement.cpp
+++ b/Source/core/html/HTMLMediaElement.cpp
@@ -188,7 +188,7 @@
 
 static bool canLoadURL(const KURL& url, const ContentType& contentType, const String& keySystem)
 {
-    DEFINE_STATIC_LOCAL(const String, codecs, (ASCIILiteral("codecs")));
+    DEFINE_STATIC_LOCAL(const String, codecs, ("codecs"));
 
     String contentMIMEType = contentType.type().lower();
     String contentTypeCodecs = contentType.parameter(codecs);
@@ -216,7 +216,7 @@
 
 WebMimeRegistry::SupportsType HTMLMediaElement::supportsType(const ContentType& contentType, const String& keySystem)
 {
-    DEFINE_STATIC_LOCAL(const String, codecs, (ASCIILiteral("codecs")));
+    DEFINE_STATIC_LOCAL(const String, codecs, ("codecs"));
 
     if (!RuntimeEnabledFeatures::mediaEnabled())
         return WebMimeRegistry::IsNotSupported;
@@ -255,6 +255,7 @@
     , m_volume(1.0f)
     , m_lastSeekTime(0)
     , m_previousProgressTime(numeric_limits<double>::max())
+    , m_duration(numeric_limits<double>::quiet_NaN())
     , m_lastTimeUpdateEventWallTime(0)
     , m_lastTimeUpdateEventMovieTime(numeric_limits<double>::max())
     , m_loadState(WaitingForSource)
@@ -619,10 +620,10 @@
             canPlay = emptyString();
             break;
         case WebMimeRegistry::MayBeSupported:
-            canPlay = ASCIILiteral("maybe");
+            canPlay = "maybe";
             break;
         case WebMimeRegistry::IsSupported:
-            canPlay = ASCIILiteral("probably");
+            canPlay = "probably";
             break;
     }
 
@@ -713,6 +714,7 @@
 
     m_playedTimeRanges = TimeRanges::create();
     m_lastSeekTime = 0;
+    m_duration = numeric_limits<double>::quiet_NaN();
 
     // The spec doesn't say to block the load event until we actually run the asynchronous section
     // algorithm, but do it now because we won't start that until after the timer fires and the
@@ -889,7 +891,7 @@
         m_mediaSource = HTMLMediaSource::lookup(url.string());
 
     if (m_mediaSource) {
-        if (m_mediaSource->attachToElement()) {
+        if (m_mediaSource->attachToElement(this)) {
             m_player->load(url, m_mediaSource);
         } else {
             // Forget our reference to the MediaSource, so we leave it alone
@@ -1894,6 +1896,8 @@
     if (noSeekRequired) {
         if (time == now) {
             scheduleEvent(eventNames().seekingEvent);
+            // FIXME: There must be a stable state before timeupdate+seeked are dispatched and seeking
+            // is reset to false. See http://crbug.com/266631
             scheduleTimeupdateEvent(false);
             scheduleEvent(eventNames().seekedEvent);
         }
@@ -2026,6 +2030,16 @@
     if (!m_player || m_readyState < HAVE_METADATA)
         return numeric_limits<double>::quiet_NaN();
 
+    // FIXME: Refactor so m_duration is kept current (in both MSE and
+    // non-MSE cases) once we have transitioned from HAVE_NOTHING ->
+    // HAVE_METADATA. Currently, m_duration may be out of date for at least MSE
+    // case because MediaSourceBase and SourceBuffer do not notify the element
+    // directly upon duration changes caused by endOfStream, remove, or append
+    // operations; rather the notification is triggered by the WebMediaPlayer
+    // implementation observing that the underlying engine has updated duration
+    // and notifying the element to consult its MediaSource for current
+    // duration. See http://crbug.com/266644
+
     if (m_mediaSource)
         return m_mediaSource->duration();
 
@@ -2112,13 +2126,13 @@
 {
     switch (m_preload) {
     case MediaPlayer::None:
-        return ASCIILiteral("none");
+        return "none";
         break;
     case MediaPlayer::MetaData:
-        return ASCIILiteral("metadata");
+        return "metadata";
         break;
     case MediaPlayer::Auto:
-        return ASCIILiteral("auto");
+        return "auto";
         break;
     }
 
@@ -3127,7 +3141,18 @@
 void HTMLMediaElement::mediaPlayerDurationChanged()
 {
     LOG(Media, "HTMLMediaElement::mediaPlayerDurationChanged");
+    durationChanged(duration());
+}
 
+void HTMLMediaElement::durationChanged(double duration)
+{
+    LOG(Media, "HTMLMediaElement::durationChanged(%f)", duration);
+
+    // Abort if duration unchanged.
+    if (m_duration == duration)
+        return;
+
+    m_duration = duration;
     scheduleEvent(eventNames().durationchangeEvent);
 
     if (hasMediaControls())
@@ -3135,10 +3160,8 @@
     if (renderer())
         renderer()->updateFromElement();
 
-    double now = currentTime();
-    double dur = duration();
-    if (now > dur)
-        seek(dur, IGNORE_EXCEPTION);
+    if (currentTime() > duration)
+        seek(duration, IGNORE_EXCEPTION);
 }
 
 void HTMLMediaElement::mediaPlayerPlaybackStateChanged()
diff --git a/Source/core/html/HTMLMediaElement.h b/Source/core/html/HTMLMediaElement.h
index a91948f..bbc957d 100644
--- a/Source/core/html/HTMLMediaElement.h
+++ b/Source/core/html/HTMLMediaElement.h
@@ -156,6 +156,8 @@
 //  Media Source.
     void closeMediaSource();
 
+    void durationChanged(double duration);
+
     void webkitGenerateKeyRequest(const String& keySystem, PassRefPtr<Uint8Array> initData, ExceptionState&);
     void webkitGenerateKeyRequest(const String& keySystem, ExceptionState&);
     void webkitAddKey(const String& keySystem, PassRefPtr<Uint8Array> key, PassRefPtr<Uint8Array> initData, const String& sessionId, ExceptionState&);
@@ -484,6 +486,9 @@
     unsigned m_previousProgress;
     double m_previousProgressTime;
 
+    // Cached duration to suppress duplicate events if duration unchanged.
+    double m_duration;
+
     // The last time a timeupdate event was sent (wall clock).
     double m_lastTimeUpdateEventWallTime;
 
diff --git a/Source/core/html/HTMLMediaElement.idl b/Source/core/html/HTMLMediaElement.idl
index 10ebf8a..6e811ee 100644
--- a/Source/core/html/HTMLMediaElement.idl
+++ b/Source/core/html/HTMLMediaElement.idl
@@ -92,10 +92,10 @@
 [EnabledAtRuntime=legacyEncryptedMedia, RaisesException] void webkitAddKey([TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString keySystem, Uint8Array key, optional Uint8Array initData, [Default=NullString] optional DOMString sessionId);
 [EnabledAtRuntime=legacyEncryptedMedia, RaisesException] void webkitCancelKeyRequest([TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString keySystem, [Default=NullString] optional DOMString sessionId);
 
-[EnabledAtRuntime=legacyEncryptedMedia] attribute EventListener onwebkitkeyadded;
-[EnabledAtRuntime=legacyEncryptedMedia] attribute EventListener onwebkitkeyerror;
-[EnabledAtRuntime=legacyEncryptedMedia] attribute EventListener onwebkitkeymessage;
-[EnabledAtRuntime=legacyEncryptedMedia] attribute EventListener onwebkitneedkey;
+[EnabledAtRuntime=legacyEncryptedMedia] attribute EventHandler onwebkitkeyadded;
+[EnabledAtRuntime=legacyEncryptedMedia] attribute EventHandler onwebkitkeyerror;
+[EnabledAtRuntime=legacyEncryptedMedia] attribute EventHandler onwebkitkeymessage;
+[EnabledAtRuntime=legacyEncryptedMedia] attribute EventHandler onwebkitneedkey;
 
 [EnabledAtRuntime=encryptedMedia, Conditional=ENCRYPTED_MEDIA_V2] attribute MediaKeys mediaKeys;
 
diff --git a/Source/core/html/HTMLMediaSource.h b/Source/core/html/HTMLMediaSource.h
index 0b02672..ddf0aef 100644
--- a/Source/core/html/HTMLMediaSource.h
+++ b/Source/core/html/HTMLMediaSource.h
@@ -31,6 +31,7 @@
 #ifndef HTMLMediaSource_h
 #define HTMLMediaSource_h
 
+#include "core/html/HTMLMediaElement.h"
 #include "core/html/URLRegistry.h"
 #include "wtf/Forward.h"
 
@@ -52,7 +53,9 @@
     // If already attached, returns false. Otherwise, must be in
     // 'closed' state, and returns true to indicate attachment success.
     // Reattachment allowed by first calling close() (even if already in 'closed').
-    virtual bool attachToElement() = 0;
+    // Once attached, the source uses the element to synchronously service some
+    // API operations like duration change that may need to initiate seek.
+    virtual bool attachToElement(HTMLMediaElement*) = 0;
     virtual void setPrivateAndOpen(PassOwnPtr<MediaSourcePrivate>) = 0;
     virtual void close() = 0;
     virtual bool isClosed() const = 0;
diff --git a/Source/core/html/HTMLObjectElement.cpp b/Source/core/html/HTMLObjectElement.cpp
index 12e6f8a..0dd38fd 100644
--- a/Source/core/html/HTMLObjectElement.cpp
+++ b/Source/core/html/HTMLObjectElement.cpp
@@ -37,7 +37,7 @@
 #include "core/html/HTMLMetaElement.h"
 #include "core/html/HTMLParamElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/page/Frame.h"
 #include "core/page/Page.h"
 #include "core/page/Settings.h"
diff --git a/Source/core/html/HTMLPlugInElement.cpp b/Source/core/html/HTMLPlugInElement.cpp
index 14ba749..2f1c8b7 100644
--- a/Source/core/html/HTMLPlugInElement.cpp
+++ b/Source/core/html/HTMLPlugInElement.cpp
@@ -79,6 +79,13 @@
     return true;
 }
 
+void HTMLPlugInElement::removeAllEventListeners()
+{
+    HTMLFrameOwnerElement::removeAllEventListeners();
+    if (Widget* widget = pluginWidget())
+        widget->eventListenersRemoved();
+}
+
 void HTMLPlugInElement::detach(const AttachContext& context)
 {
     m_instance.clear();
diff --git a/Source/core/html/HTMLPlugInElement.h b/Source/core/html/HTMLPlugInElement.h
index f6a4563..9584710 100644
--- a/Source/core/html/HTMLPlugInElement.h
+++ b/Source/core/html/HTMLPlugInElement.h
@@ -66,6 +66,8 @@
 
     virtual bool isPlugInImageElement() const { return false; }
 
+    virtual void removeAllEventListeners() OVERRIDE;
+
 protected:
     HTMLPlugInElement(const QualifiedName& tagName, Document*);
 
diff --git a/Source/core/html/HTMLTextAreaElement.cpp b/Source/core/html/HTMLTextAreaElement.cpp
index fae5d5d..03dd058 100644
--- a/Source/core/html/HTMLTextAreaElement.cpp
+++ b/Source/core/html/HTMLTextAreaElement.cpp
@@ -59,7 +59,7 @@
 // This function returns number of characters considering this.
 static inline unsigned computeLengthForSubmission(const String& text, unsigned numberOfLineBreaks)
 {
-    return numGraphemeClusters(text) + numberOfLineBreaks;
+    return text.length() + numberOfLineBreaks;
 }
 
 static unsigned numberOfLineBreaks(const String& text)
@@ -75,12 +75,7 @@
 
 static inline unsigned computeLengthForSubmission(const String& text)
 {
-    return numGraphemeClusters(text) + numberOfLineBreaks(text);
-}
-
-static inline unsigned upperBoundForLengthForSubmission(const String& text, unsigned numberOfLineBreaks)
-{
-    return text.length() + numberOfLineBreaks;
+    return text.length() + numberOfLineBreaks(text);
 }
 
 HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
@@ -294,12 +289,10 @@
     unsigned unsignedMaxLength = static_cast<unsigned>(signedMaxLength);
 
     const String& currentValue = innerTextValue();
-    unsigned numberOfLineBreaksInCurrentValue = numberOfLineBreaks(currentValue);
-    if (upperBoundForLengthForSubmission(currentValue, numberOfLineBreaksInCurrentValue)
-        + upperBoundForLengthForSubmission(event->text(), numberOfLineBreaks(event->text())) < unsignedMaxLength)
+    unsigned currentLength = computeLengthForSubmission(currentValue);
+    if (currentLength + computeLengthForSubmission(event->text()) < unsignedMaxLength)
         return;
 
-    unsigned currentLength = computeLengthForSubmission(currentValue, numberOfLineBreaksInCurrentValue);
     // selectionLength represents the selection length of this text field to be
     // removed by this insertion.
     // If the text field has no focus, we don't need to take account of the
@@ -314,7 +307,9 @@
 
 String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue, unsigned maxLength)
 {
-    return proposedValue.left(numCharactersInGraphemeClusters(proposedValue, maxLength));
+    if (maxLength > 0 && U16_IS_LEAD(proposedValue[maxLength - 1]))
+        --maxLength;
+    return proposedValue.left(maxLength);
 }
 
 HTMLElement* HTMLTextAreaElement::innerTextElement() const
@@ -484,10 +479,7 @@
     int max = maxLength();
     if (max < 0)
         return false;
-    unsigned unsignedMax = static_cast<unsigned>(max);
-    unsigned numberOfLineBreaksInValue = numberOfLineBreaks(value);
-    return upperBoundForLengthForSubmission(value, numberOfLineBreaksInValue) > unsignedMax
-        && computeLengthForSubmission(value, numberOfLineBreaksInValue) > unsignedMax;
+    return computeLengthForSubmission(value) > static_cast<unsigned>(max);
 }
 
 bool HTMLTextAreaElement::isValidValue(const String& candidate) const
@@ -549,7 +541,7 @@
     if (!m_placeholder) {
         RefPtr<HTMLDivElement> placeholder = HTMLDivElement::create(document());
         m_placeholder = placeholder.get();
-        m_placeholder->setPseudo(AtomicString("-webkit-input-placeholder", AtomicString::ConstructFromLiteral));
+        m_placeholder->setPart(AtomicString("-webkit-input-placeholder", AtomicString::ConstructFromLiteral));
         userAgentShadowRoot()->insertBefore(m_placeholder, innerTextElement()->nextSibling(), ASSERT_NO_EXCEPTION);
     }
     m_placeholder->setInnerText(placeholderText, ASSERT_NO_EXCEPTION);
diff --git a/Source/core/html/HTMLVideoElement.cpp b/Source/core/html/HTMLVideoElement.cpp
index 2c6b0fa..a5590d2 100644
--- a/Source/core/html/HTMLVideoElement.cpp
+++ b/Source/core/html/HTMLVideoElement.cpp
@@ -79,7 +79,7 @@
             m_imageLoader = adoptPtr(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
         if (renderer())
-            toRenderImage(renderer())->imageResource()->setCachedImage(m_imageLoader->image());
+            toRenderImage(renderer())->imageResource()->setImageResource(m_imageLoader->image());
     }
 }
 
@@ -112,7 +112,7 @@
             m_imageLoader->updateFromElementIgnoringPreviousError();
         } else {
             if (renderer())
-                toRenderImage(renderer())->imageResource()->setCachedImage(0);
+                toRenderImage(renderer())->imageResource()->setImageResource(0);
         }
     } else
         HTMLMediaElement::parseAttribute(name, value);
diff --git a/Source/core/html/ImageDocument.cpp b/Source/core/html/ImageDocument.cpp
index 6839e1e..64a0dc1 100644
--- a/Source/core/html/ImageDocument.cpp
+++ b/Source/core/html/ImageDocument.cpp
@@ -39,7 +39,7 @@
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/page/Frame.h"
 #include "core/page/FrameView.h"
 #include "core/page/Page.h"
@@ -124,7 +124,7 @@
 void ImageDocumentParser::finish()
 {
     if (!isStopped() && document()->imageElement()) {
-        CachedImage* cachedImage = document()->cachedImage();
+        ImageResource* cachedImage = document()->cachedImage();
         cachedImage->finish();
         cachedImage->setResponse(document()->frame()->loader()->documentLoader()->response());
 
@@ -338,7 +338,7 @@
     }
 }
 
-CachedImage* ImageDocument::cachedImage()
+ImageResource* ImageDocument::cachedImage()
 {
     if (!m_imageElement)
         createDocumentStructure();
diff --git a/Source/core/html/ImageDocument.h b/Source/core/html/ImageDocument.h
index fbe9e50..9400112 100644
--- a/Source/core/html/ImageDocument.h
+++ b/Source/core/html/ImageDocument.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class CachedImage;
+class ImageResource;
 class HTMLImageElement;
 
 class ImageDocument FINAL : public HTMLDocument {
@@ -40,7 +40,7 @@
         return adoptRef(new ImageDocument(initializer));
     }
 
-    CachedImage* cachedImage();
+    ImageResource* cachedImage();
     HTMLImageElement* imageElement() const { return m_imageElement.get(); }
 
     void windowSizeChanged();
diff --git a/Source/core/html/ImageInputType.cpp b/Source/core/html/ImageInputType.cpp
index 64ba937..2ad3d90 100644
--- a/Source/core/html/ImageInputType.cpp
+++ b/Source/core/html/ImageInputType.cpp
@@ -31,7 +31,7 @@
 #include "core/html/HTMLInputElement.h"
 #include "core/html/InputTypeNames.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/rendering/RenderImage.h"
 #include "wtf/PassOwnPtr.h"
 
@@ -70,8 +70,8 @@
         return true;
     }
 
-    DEFINE_STATIC_LOCAL(String, dotXString, (ASCIILiteral(".x")));
-    DEFINE_STATIC_LOCAL(String, dotYString, (ASCIILiteral(".y")));
+    DEFINE_STATIC_LOCAL(String, dotXString, (".x"));
+    DEFINE_STATIC_LOCAL(String, dotYString, (".y"));
     encoding.appendData(name + dotXString, m_clickLocation.x());
     encoding.appendData(name + dotYString, m_clickLocation.y());
 
@@ -138,7 +138,7 @@
         return;
 
     RenderImageResource* imageResource = renderer->imageResource();
-    imageResource->setCachedImage(imageLoader->image());
+    imageResource->setImageResource(imageLoader->image());
 
     // If we have no image at all because we have no src attribute, set
     // image height and width for the alt text instead.
diff --git a/Source/core/html/InputType.cpp b/Source/core/html/InputType.cpp
index c70bf2e..940982f 100644
--- a/Source/core/html/InputType.cpp
+++ b/Source/core/html/InputType.cpp
@@ -474,12 +474,6 @@
     }
 }
 
-Element* InputType::elementById(const AtomicString& id) const
-{
-    ShadowRoot* shadowRoot = element()->userAgentShadowRoot();
-    return shadowRoot ? shadowRoot->getElementById(id) : 0;
-}
-
 Decimal InputType::parseToNumber(const String&, const Decimal& defaultValue) const
 {
     ASSERT_NOT_REACHED();
diff --git a/Source/core/html/InputType.h b/Source/core/html/InputType.h
index f7fc51c..ab9d248 100644
--- a/Source/core/html/InputType.h
+++ b/Source/core/html/InputType.h
@@ -208,14 +208,11 @@
 
     virtual void createShadowSubtree();
     virtual void destroyShadowSubtree();
-    Element* elementById(const AtomicString& id) const;
 
     virtual HTMLElement* containerElement() const { return 0; }
     virtual HTMLElement* innerBlockElement() const { return 0; }
     virtual HTMLElement* innerTextElement() const { return 0; }
     virtual HTMLElement* innerSpinButtonElement() const { return 0; }
-    virtual HTMLElement* searchDecorationElement() const { return 0; }
-    virtual HTMLElement* cancelButtonElement() const { return 0; }
 #if ENABLE(INPUT_SPEECH)
     virtual HTMLElement* speechButtonElement() const { return 0; }
 #endif
diff --git a/Source/core/html/LinkImport.cpp b/Source/core/html/LinkImport.cpp
new file mode 100644
index 0000000..31703ac
--- /dev/null
+++ b/Source/core/html/LinkImport.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "core/html/LinkImport.h"
+
+#include "core/dom/Document.h"
+#include "core/html/HTMLImportLoader.h"
+#include "core/html/HTMLImportsController.h"
+#include "core/html/HTMLLinkElement.h"
+#include "core/loader/CrossOriginAccessControl.h"
+
+namespace WebCore {
+
+PassRefPtr<LinkImport> LinkImport::create(HTMLLinkElement* owner)
+{
+    return adoptRef(new LinkImport(owner));
+}
+
+LinkImport::LinkImport(HTMLLinkElement* owner)
+    : LinkResource(owner)
+{
+}
+
+LinkImport::~LinkImport()
+{
+    clear();
+}
+
+Document* LinkImport::importedDocument() const
+{
+    if (!m_loader)
+        return 0;
+    return m_loader->importedDocument();
+}
+
+void LinkImport::process()
+{
+    if (m_loader)
+        return;
+    if (!m_owner)
+        return;
+    if (!m_owner->document()->frame() && !m_owner->document()->import())
+        return;
+
+    if (!m_owner->document()->import()) {
+        ASSERT(m_owner->document()->frame()); // The document should be the master.
+        HTMLImportsController::provideTo(m_owner->document());
+    }
+
+    LinkRequestBuilder builder(m_owner);
+    if (!builder.isValid()) {
+        didFinish();
+        return;
+    }
+
+    HTMLImport* parent = m_owner->document()->import();
+    HTMLImportsController* controller = parent->controller();
+    m_loader = controller->createLoader(parent, builder.build(true));
+    if (!m_loader) {
+        didFinish();
+        return;
+    }
+
+    m_loader->addClient(this);
+}
+
+void LinkImport::clear()
+{
+    m_owner = 0;
+
+    if (m_loader) {
+        m_loader->removeClient(this);
+        m_loader.clear();
+    }
+}
+
+void LinkImport::ownerRemoved()
+{
+    clear();
+}
+
+void LinkImport::didFinish()
+{
+    if (!m_owner)
+        return;
+    m_owner->scheduleEvent();
+}
+
+bool LinkImport::hasLoaded() const
+{
+    return m_loader && m_loader->isLoaded();
+}
+
+} // namespace WebCore
diff --git a/Source/core/html/LinkImport.h b/Source/core/html/LinkImport.h
new file mode 100644
index 0000000..4003f88
--- /dev/null
+++ b/Source/core/html/LinkImport.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LinkImport_h
+#define LinkImport_h
+
+#include "core/html/HTMLImportLoaderClient.h"
+#include "core/html/LinkResource.h"
+#include "wtf/FastAllocBase.h"
+#include "wtf/RefPtr.h"
+
+namespace WebCore {
+
+class Document;
+class HTMLImportLoader;
+
+//
+// A LinkResource subclasss used for @rel=import.
+//
+class LinkImport : public LinkResource, public HTMLImportLoaderClient {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+
+    static PassRefPtr<LinkImport> create(HTMLLinkElement* owner);
+
+    explicit LinkImport(HTMLLinkElement* owner);
+    virtual ~LinkImport();
+
+    // LinkResource
+    virtual void process() OVERRIDE;
+    virtual Type type() const OVERRIDE { return Import; }
+    virtual void ownerRemoved() OVERRIDE;
+    virtual bool hasLoaded() const OVERRIDE;
+
+    // HTMLImportLoaderClient
+    virtual void didFinish() OVERRIDE;
+
+    Document* importedDocument() const;
+
+private:
+    void clear();
+
+    RefPtr<HTMLImportLoader> m_loader;
+};
+
+} // namespace WebCore
+
+#endif // LinkImport_h
diff --git a/Source/core/html/LinkResource.h b/Source/core/html/LinkResource.h
index 0a8b2a8..8c6c84e 100644
--- a/Source/core/html/LinkResource.h
+++ b/Source/core/html/LinkResource.h
@@ -53,6 +53,7 @@
     virtual Type type() const = 0;
     virtual void process() = 0;
     virtual void ownerRemoved() = 0;
+    virtual bool hasLoaded() const = 0;
 
 protected:
     HTMLLinkElement* m_owner;
diff --git a/Source/core/html/RangeInputType.cpp b/Source/core/html/RangeInputType.cpp
index 8ede620..d65d553 100644
--- a/Source/core/html/RangeInputType.cpp
+++ b/Source/core/html/RangeInputType.cpp
@@ -247,7 +247,7 @@
 
     Document* document = element()->document();
     RefPtr<HTMLDivElement> track = HTMLDivElement::create(document);
-    track->setPseudo(AtomicString("-webkit-slider-runnable-track", AtomicString::ConstructFromLiteral));
+    track->setPart(AtomicString("-webkit-slider-runnable-track", AtomicString::ConstructFromLiteral));
     track->appendChild(SliderThumbElement::create(document), IGNORE_EXCEPTION);
     RefPtr<HTMLElement> container = SliderContainerElement::create(document);
     container->appendChild(track.release(), IGNORE_EXCEPTION);
@@ -332,7 +332,7 @@
     m_tickMarkValuesDirty = true;
     HTMLElement* sliderTrackElement = sliderTrackElementOf(element());
     if (sliderTrackElement->renderer())
-        sliderTrackElement->renderer()->setNeedsLayout(true);
+        sliderTrackElement->renderer()->setNeedsLayout();
 }
 
 static bool decimalCompare(const Decimal& a, const Decimal& b)
diff --git a/Source/core/html/SearchInputType.cpp b/Source/core/html/SearchInputType.cpp
index d17d432..3982770 100644
--- a/Source/core/html/SearchInputType.cpp
+++ b/Source/core/html/SearchInputType.cpp
@@ -36,6 +36,7 @@
 #include "core/dom/KeyboardEvent.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/InputTypeNames.h"
+#include "core/html/shadow/ShadowElementNames.h"
 #include "core/html/shadow/TextControlInnerElements.h"
 #include "core/rendering/RenderSearchField.h"
 #include "wtf/PassOwnPtr.h"
@@ -46,8 +47,6 @@
 
 inline SearchInputType::SearchInputType(HTMLInputElement* element)
     : BaseTextInputType(element)
-    , m_searchDecoration(0)
-    , m_cancelButton(0)
     , m_searchEventTimer(this, &SearchInputType::searchEventTimerFired)
 {
 }
@@ -90,32 +89,14 @@
 
 void SearchInputType::createShadowSubtree()
 {
-    ASSERT(!m_searchDecoration);
-    ASSERT(!m_cancelButton);
-
     TextFieldInputType::createShadowSubtree();
     HTMLElement* container = containerElement();
     HTMLElement* textWrapper = innerBlockElement();
     ASSERT(container);
     ASSERT(textWrapper);
 
-    RefPtr<SearchFieldDecorationElement> searchDecoration = SearchFieldDecorationElement::create(element()->document());
-    m_searchDecoration = searchDecoration.get();
-    container->insertBefore(m_searchDecoration, textWrapper, IGNORE_EXCEPTION);
-
-    RefPtr<SearchFieldCancelButtonElement> cancelButton = SearchFieldCancelButtonElement::create(element()->document());
-    m_cancelButton = cancelButton.get();
-    container->insertBefore(m_cancelButton, textWrapper->nextSibling(), IGNORE_EXCEPTION);
-}
-
-HTMLElement* SearchInputType::searchDecorationElement() const
-{
-    return m_searchDecoration;
-}
-
-HTMLElement* SearchInputType::cancelButtonElement() const
-{
-    return m_cancelButton;
+    container->insertBefore(SearchFieldDecorationElement::create(element()->document()), textWrapper, IGNORE_EXCEPTION);
+    container->insertBefore(SearchFieldCancelButtonElement::create(element()->document()), textWrapper->nextSibling(), IGNORE_EXCEPTION);
 }
 
 void SearchInputType::handleKeydownEvent(KeyboardEvent* event)
@@ -136,13 +117,6 @@
     TextFieldInputType::handleKeydownEvent(event);
 }
 
-void SearchInputType::destroyShadowSubtree()
-{
-    TextFieldInputType::destroyShadowSubtree();
-    m_searchDecoration = 0;
-    m_cancelButton = 0;
-}
-
 void SearchInputType::startSearchEventTimer()
 {
     ASSERT(element()->renderer());
@@ -176,7 +150,7 @@
 
 void SearchInputType::didSetValueByUserEdit(ValueChangeState state)
 {
-    if (m_cancelButton)
+    if (element()->uaShadowElementById(ShadowElementNames::clearButton()))
         toRenderSearchField(element()->renderer())->updateCancelButtonVisibility();
 
     // If the incremental attribute is set, then dispatch the search event
diff --git a/Source/core/html/SearchInputType.h b/Source/core/html/SearchInputType.h
index 33a2c0a..2065c39 100644
--- a/Source/core/html/SearchInputType.h
+++ b/Source/core/html/SearchInputType.h
@@ -54,9 +54,6 @@
     virtual bool isSearchField() const OVERRIDE;
     virtual bool needsContainer() const OVERRIDE;
     virtual void createShadowSubtree() OVERRIDE;
-    virtual void destroyShadowSubtree() OVERRIDE;
-    virtual HTMLElement* searchDecorationElement() const OVERRIDE;
-    virtual HTMLElement* cancelButtonElement() const OVERRIDE;
     virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
     virtual void didSetValueByUserEdit(ValueChangeState) OVERRIDE;
     virtual bool supportsInputModeAttribute() const OVERRIDE;
@@ -64,9 +61,9 @@
     void searchEventTimerFired(Timer<SearchInputType>*);
     bool searchEventsShouldBeDispatched() const;
     void startSearchEventTimer();
+    HTMLElement* searchDecorationElement() const;
+    HTMLElement* cancelButtonElement() const;
 
-    HTMLElement* m_searchDecoration;
-    HTMLElement* m_cancelButton;
     Timer<SearchInputType> m_searchEventTimer;
 };
 
diff --git a/Source/core/html/TextFieldInputType.cpp b/Source/core/html/TextFieldInputType.cpp
index 6c51162..9b127b0 100644
--- a/Source/core/html/TextFieldInputType.cpp
+++ b/Source/core/html/TextFieldInputType.cpp
@@ -252,7 +252,7 @@
 
     ShadowRoot* shadowRoot = element()->userAgentShadowRoot();
     m_container = TextControlInnerContainer::create(document);
-    m_container->setPseudo(AtomicString("-webkit-textfield-decoration-container", AtomicString::ConstructFromLiteral));
+    m_container->setPart(AtomicString("-webkit-textfield-decoration-container", AtomicString::ConstructFromLiteral));
     shadowRoot->appendChild(m_container, IGNORE_EXCEPTION);
 
     m_innerBlock = TextControlInnerElement::create(document);
@@ -357,7 +357,9 @@
 
 static String limitLength(const String& string, int maxLength)
 {
-    unsigned newLength = numCharactersInGraphemeClusters(string, maxLength);
+    unsigned newLength = maxLength;
+    // FIXME: We should not truncate the string at a control character. It's not
+    // compatible with IE and Firefox.
     for (unsigned i = 0; i < newLength; ++i) {
         const UChar current = string[i];
         if (current < ' ' && current != '\t') {
@@ -365,6 +367,8 @@
             break;
         }
     }
+    if (newLength > 0 && U16_IS_LEAD(string[newLength - 1]))
+        --newLength;
     return string.left(newLength);
 }
 
@@ -377,17 +381,17 @@
 {
     // Make sure that the text to be inserted will not violate the maxLength.
 
-    // We use RenderTextControlSingleLine::text() instead of InputElement::value()
-    // because they can be mismatched by sanitizeValue() in
-    // HTMLInputElement::subtreeHasChanged() in some cases.
-    unsigned oldLength = numGraphemeClusters(element()->innerTextValue());
+    // We use HTMLInputElement::innerTextValue() instead of
+    // HTMLInputElement::value() because they can be mismatched by
+    // sanitizeValue() in HTMLInputElement::subtreeHasChanged() in some cases.
+    unsigned oldLength = element()->innerTextValue().length();
 
     // selectionLength represents the selection length of this text field to be
     // removed by this insertion.
     // If the text field has no focus, we don't need to take account of the
     // selection length. The selection is the source of text drag-and-drop in
     // that case, and nothing in the text field will be removed.
-    unsigned selectionLength = element()->focused() ? numGraphemeClusters(plainText(element()->document()->frame()->selection()->selection().toNormalizedRange().get())) : 0;
+    unsigned selectionLength = element()->focused() ? plainText(element()->document()->frame()->selection()->selection().toNormalizedRange().get()).length() : 0;
     ASSERT(oldLength >= selectionLength);
 
     // Selected characters will be removed by the next text event.
@@ -427,7 +431,7 @@
     }
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(element()->document());
-        m_placeholder->setPseudo(AtomicString("-webkit-input-placeholder", AtomicString::ConstructFromLiteral));
+        m_placeholder->setPart(AtomicString("-webkit-input-placeholder", AtomicString::ConstructFromLiteral));
         element()->userAgentShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ASSERT_NO_EXCEPTION);
     }
     m_placeholder->setInnerText(placeholderText, ASSERT_NO_EXCEPTION);
diff --git a/Source/core/html/canvas/CanvasRenderingContext.cpp b/Source/core/html/canvas/CanvasRenderingContext.cpp
index fa64846..71580c9 100644
--- a/Source/core/html/canvas/CanvasRenderingContext.cpp
+++ b/Source/core/html/canvas/CanvasRenderingContext.cpp
@@ -30,7 +30,7 @@
 #include "core/html/HTMLImageElement.h"
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/canvas/CanvasPattern.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "weborigin/SecurityOrigin.h"
 
 namespace WebCore {
@@ -60,7 +60,7 @@
     if (!image || !canvas()->originClean())
         return false;
 
-    CachedImage* cachedImage = image->cachedImage();
+    ImageResource* cachedImage = image->cachedImage();
     if (!cachedImage->image()->hasSingleSecurityOrigin())
         return true;
 
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.cpp b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
index 0b22f93..feff097 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
@@ -53,7 +53,7 @@
 #include "core/html/canvas/CanvasPattern.h"
 #include "core/html/canvas/CanvasStyle.h"
 #include "core/html/canvas/DOMPath.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/page/ImageBitmap.h"
 #include "core/platform/graphics/DrawLooper.h"
 #include "core/platform/graphics/FloatQuad.h"
@@ -78,7 +78,7 @@
 static const char* const defaultFontFamily = "sans-serif";
 static const char* const defaultFont = "10px sans-serif";
 
-static bool isOriginClean(CachedImage* cachedImage, SecurityOrigin* securityOrigin)
+static bool isOriginClean(ImageResource* cachedImage, SecurityOrigin* securityOrigin)
 {
     if (!cachedImage->image()->hasSingleSecurityOrigin())
         return false;
@@ -1171,14 +1171,14 @@
     return alphaChannel(state().m_shadowColor) && (state().m_shadowBlur || !state().m_shadowOffset.isZero());
 }
 
-static LayoutSize size(HTMLImageElement* image)
+static LayoutSize sizeFor(HTMLImageElement* image)
 {
-    if (CachedImage* cachedImage = image->cachedImage())
+    if (ImageResource* cachedImage = image->cachedImage())
         return cachedImage->imageSizeForRenderer(image->renderer(), 1.0f); // FIXME: Not sure about this.
     return IntSize();
 }
 
-static IntSize size(HTMLVideoElement* video)
+static IntSize sizeFor(HTMLVideoElement* video)
 {
     if (MediaPlayer* player = video->player())
         return player->naturalSize();
@@ -1294,9 +1294,10 @@
 
     FloatRect intersectRect = intersection(bitmapRect, normalizedSrcRect);
     FloatRect actualSrcRect(intersectRect);
-    actualSrcRect.move(-bitmapRect.x(), -bitmapRect.y());
 
-    FloatRect imageRect = FloatRect(FloatPoint(), bitmapRect.size());
+    IntPoint bitmapOffset = bitmap->bitmapOffset();
+    actualSrcRect.move(bitmapOffset - bitmapRect.location());
+    FloatRect imageRect = FloatRect(bitmapOffset, bitmapRect.size());
 
     FloatRect actualDstRect(FloatPoint(intersectRect.location() - normalizedSrcRect.location()), bitmapRect.size());
     actualDstRect.scale(normalizedDstRect.width() / normalizedSrcRect.width() * intersectRect.width() / bitmapRect.width(),
@@ -1316,8 +1317,8 @@
         es.throwDOMException(TypeMismatchError);
         return;
     }
-    LayoutSize s = size(image);
-    drawImage(image, x, y, s.width(), s.height(), es);
+    LayoutSize size = sizeFor(image);
+    drawImage(image, x, y, size.width(), size.height(), es);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image,
@@ -1327,8 +1328,8 @@
         es.throwDOMException(TypeMismatchError);
         return;
     }
-    LayoutSize s = size(image);
-    drawImage(image, FloatRect(0, 0, s.width(), s.height()), FloatRect(x, y, width, height), es);
+    LayoutSize size = sizeFor(image);
+    drawImage(image, FloatRect(0, 0, size.width(), size.height()), FloatRect(x, y, width, height), es);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image,
@@ -1354,16 +1355,23 @@
         || !std::isfinite(srcRect.x()) || !std::isfinite(srcRect.y()) || !std::isfinite(srcRect.width()) || !std::isfinite(srcRect.height()))
         return;
 
-    if (!dstRect.width() || !dstRect.height())
+    ImageResource* cachedImage = image->cachedImage();
+    if (!cachedImage || !image->complete())
         return;
 
-    if (!image->complete())
+    LayoutSize size = sizeFor(image);
+    if (!size.width() || !size.height()) {
+        es.throwDOMException(InvalidStateError);
+        return;
+    }
+
+    if (!dstRect.width() || !dstRect.height())
         return;
 
     FloatRect normalizedSrcRect = normalizeRect(srcRect);
     FloatRect normalizedDstRect = normalizeRect(dstRect);
 
-    FloatRect imageRect = FloatRect(FloatPoint(), size(image));
+    FloatRect imageRect = FloatRect(FloatPoint(), size);
     if (!srcRect.width() || !srcRect.height()) {
         es.throwDOMException(IndexSizeError);
         return;
@@ -1373,10 +1381,6 @@
 
     clipRectsToImageRect(imageRect, &normalizedSrcRect, &normalizedDstRect);
 
-    CachedImage* cachedImage = image->cachedImage();
-    if (!cachedImage)
-        return;
-
     checkOrigin(image);
 
     Image* imageForRendering = cachedImage->imageForRenderer(image->renderer());
@@ -1478,8 +1482,8 @@
         es.throwDOMException(TypeMismatchError);
         return;
     }
-    IntSize s = size(video);
-    drawImage(video, x, y, s.width(), s.height(), es);
+    IntSize size = sizeFor(video);
+    drawImage(video, x, y, size.width(), size.height(), es);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video,
@@ -1489,8 +1493,8 @@
         es.throwDOMException(TypeMismatchError);
         return;
     }
-    IntSize s = size(video);
-    drawImage(video, FloatRect(0, 0, s.width(), s.height()), FloatRect(x, y, width, height), es);
+    IntSize size = sizeFor(video);
+    drawImage(video, FloatRect(0, 0, size.width(), size.height()), FloatRect(x, y, width, height), es);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video,
@@ -1510,7 +1514,7 @@
     if (video->readyState() == HTMLMediaElement::HAVE_NOTHING || video->readyState() == HTMLMediaElement::HAVE_METADATA)
         return;
 
-    FloatRect videoRect = FloatRect(FloatPoint(), size(video));
+    FloatRect videoRect = FloatRect(FloatPoint(), sizeFor(video));
     if (!srcRect.width() || !srcRect.height()) {
         es.throwDOMException(IndexSizeError);
         return;
@@ -1537,7 +1541,7 @@
     c->translate(normalizedDstRect.x(), normalizedDstRect.y());
     c->scale(FloatSize(normalizedDstRect.width() / normalizedSrcRect.width(), normalizedDstRect.height() / normalizedSrcRect.height()));
     c->translate(-normalizedSrcRect.x(), -normalizedSrcRect.y());
-    video->paintCurrentFrameInContext(c, IntRect(IntPoint(), size(video)));
+    video->paintCurrentFrameInContext(c, IntRect(IntPoint(), sizeFor(video)));
     stateSaver.restore();
     didDraw(dstRect);
 }
@@ -1748,7 +1752,7 @@
     if (!image->complete())
         return 0;
 
-    CachedImage* cachedImage = image->cachedImage();
+    ImageResource* cachedImage = image->cachedImage();
     Image* imageForRendering = cachedImage ? cachedImage->imageForRenderer(image->renderer()) : 0;
     if (!imageForRendering)
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
@@ -1892,7 +1896,7 @@
 PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(ImageBuffer::CoordinateSystem coordinateSystem, float sx, float sy, float sw, float sh, ExceptionState& es) const
 {
     if (!canvas()->originClean()) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Unable to get image data from canvas because the canvas has been tainted by cross-origin data.")));
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Unable to get image data from canvas because the canvas has been tainted by cross-origin data."));
         canvas()->document()->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, consoleMessage);
         es.throwDOMException(SecurityError);
         return 0;
@@ -2051,13 +2055,13 @@
 
 void CanvasRenderingContext2D::setFont(const String& newFont)
 {
-    MutableStylePropertyMap::iterator i = m_cachedFonts.find(newFont);
-    RefPtr<MutableStylePropertySet> parsedStyle = i != m_cachedFonts.end() ? i->value : 0;
+    MutableStylePropertyMap::iterator i = m_fetchedFonts.find(newFont);
+    RefPtr<MutableStylePropertySet> parsedStyle = i != m_fetchedFonts.end() ? i->value : 0;
 
     if (!parsedStyle) {
         parsedStyle = MutableStylePropertySet::create();
         CSSParser::parseValue(parsedStyle.get(), CSSPropertyFont, newFont, true, strictToCSSParserMode(!m_usesCSSCompatibilityParseMode), 0);
-        m_cachedFonts.add(newFont, parsedStyle);
+        m_fetchedFonts.add(newFont, parsedStyle);
     }
     if (parsedStyle->isEmpty())
         return;
@@ -2342,7 +2346,10 @@
         return;
 
     updateFocusRingAccessibility(m_path, element);
-    if (element->focused())
+    // Note: we need to check document->focusedElement() rather than just calling
+    // element->focused(), because element->focused() isn't updated until after
+    // focus events fire.
+    if (element->document() && element->document()->focusedElement() == element)
         drawFocusRing(m_path);
 }
 
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.h b/Source/core/html/canvas/CanvasRenderingContext2D.h
index 7d9218d..a76a954 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.h
@@ -341,7 +341,7 @@
     unsigned m_unrealizedSaveCount;
     bool m_usesCSSCompatibilityParseMode;
     bool m_hasAlpha;
-    MutableStylePropertyMap m_cachedFonts;
+    MutableStylePropertyMap m_fetchedFonts;
 };
 
 } // namespace WebCore
diff --git a/Source/core/html/canvas/Float32Array.idl b/Source/core/html/canvas/Float32Array.idl
deleted file mode 100644
index 09e368b..0000000
--- a/Source/core/html/canvas/Float32Array.idl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2006, 2010 Apple Computer, Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Float32Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 4;
-
-    readonly attribute unsigned long length;
-    Float32Array subarray([Default=Undefined] optional long start,
-                          optional long end);
-
-    // void set(Float32Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Float64Array.idl b/Source/core/html/canvas/Float64Array.idl
deleted file mode 100644
index f9335ff..0000000
--- a/Source/core/html/canvas/Float64Array.idl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Float64Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 8;
-
-    readonly attribute unsigned long length;
-    Float64Array subarray([Default=Undefined] optional long start,
-                          optional long end);
-
-    // void set(Float64Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Int16Array.idl b/Source/core/html/canvas/Int16Array.idl
deleted file mode 100644
index 350bcbb..0000000
--- a/Source/core/html/canvas/Int16Array.idl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2006, 2010 Apple Computer, Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Int16Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 2;
-
-    readonly attribute unsigned long length;
-    Int16Array subarray([Default=Undefined] optional long start,
-                        optional long end);
-
-    // void set(Int16Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Int32Array.idl b/Source/core/html/canvas/Int32Array.idl
deleted file mode 100644
index 7b28526..0000000
--- a/Source/core/html/canvas/Int32Array.idl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Int32Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 4;
-
-    readonly attribute unsigned long length;
-    Int32Array subarray([Default=Undefined] optional long start,
-                        optional long end);
-
-    // void set(Int32Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Int8Array.idl b/Source/core/html/canvas/Int8Array.idl
deleted file mode 100644
index 0cd83d5..0000000
--- a/Source/core/html/canvas/Int8Array.idl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Int8Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 1;
-
-    readonly attribute unsigned long length;
-    Int8Array subarray([Default=Undefined] optional long start,
-                       optional long end);
-
-    // void set(Int8Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Uint16Array.idl b/Source/core/html/canvas/Uint16Array.idl
deleted file mode 100644
index dd62b02..0000000
--- a/Source/core/html/canvas/Uint16Array.idl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Uint16Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 2;
-
-    readonly attribute unsigned long length;
-    Uint16Array subarray([Default=Undefined] optional long start, optional long end);
-
-    // void set(Uint16Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Uint32Array.idl b/Source/core/html/canvas/Uint32Array.idl
deleted file mode 100644
index d47c7ca..0000000
--- a/Source/core/html/canvas/Uint32Array.idl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Uint32Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 4;
-
-    readonly attribute unsigned long length;
-    Uint32Array subarray([Default=Undefined] optional long start, optional long end);
-
-    // void set(Uint32Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Uint8Array.idl b/Source/core/html/canvas/Uint8Array.idl
deleted file mode 100644
index 6058506..0000000
--- a/Source/core/html/canvas/Uint8Array.idl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Uint8Array : ArrayBufferView {
-    const unsigned long BYTES_PER_ELEMENT = 1;
-
-    readonly attribute unsigned long length;
-    Uint8Array subarray([Default=Undefined] optional long start, optional long end);
-
-    // void set(Uint8Array array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/Uint8ClampedArray.idl b/Source/core/html/canvas/Uint8ClampedArray.idl
deleted file mode 100644
index 66c9289..0000000
--- a/Source/core/html/canvas/Uint8ClampedArray.idl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-[
-    GlobalContext=Window&WorkerGlobalScope,
-    ConstructorTemplate=TypedArray,
-    CustomToV8,
-    DoNotCheckConstants
-] interface Uint8ClampedArray : Uint8Array {
-    const unsigned long BYTES_PER_ELEMENT = 1;
-
-    readonly attribute unsigned long length;
-    Uint8ClampedArray subarray([Default=Undefined] optional long start, optional long end);
-
-    // FIXME: Missing other setters!
-    // void set(Uint8ClampedArray array, optional in unsigned long offset);
-    // void set(sequence<long> array, optional in unsigned long offset);
-    void set();
-};
diff --git a/Source/core/html/canvas/WebGLFramebuffer.cpp b/Source/core/html/canvas/WebGLFramebuffer.cpp
index 7f74aa7..ea0352a 100644
--- a/Source/core/html/canvas/WebGLFramebuffer.cpp
+++ b/Source/core/html/canvas/WebGLFramebuffer.cpp
@@ -28,6 +28,7 @@
 #include "core/html/canvas/WebGLFramebuffer.h"
 
 #include "core/html/canvas/WebGLRenderingContext.h"
+#include "core/platform/NotImplemented.h"
 #include "core/platform/graphics/Extensions3D.h"
 
 namespace WebCore {
@@ -48,6 +49,7 @@
         virtual GC3Dsizei getWidth() const;
         virtual GC3Dsizei getHeight() const;
         virtual GC3Denum getFormat() const;
+        virtual GC3Denum getType() const;
         virtual WebGLSharedObject* getObject() const;
         virtual bool isSharedObject(WebGLSharedObject*) const;
         virtual bool isValid() const;
@@ -144,6 +146,12 @@
             context->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, attachment, GraphicsContext3D::RENDERBUFFER, 0);
     }
 
+    GC3Denum WebGLRenderbufferAttachment::getType() const
+    {
+        notImplemented();
+        return 0;
+    }
+
     class WebGLTextureAttachment : public WebGLFramebuffer::WebGLAttachment {
     public:
         static PassRefPtr<WebGLFramebuffer::WebGLAttachment> create(WebGLTexture*, GC3Denum target, GC3Dint level);
@@ -153,6 +161,7 @@
         virtual GC3Dsizei getWidth() const;
         virtual GC3Dsizei getHeight() const;
         virtual GC3Denum getFormat() const;
+        virtual GC3Denum getType() const;
         virtual WebGLSharedObject* getObject() const;
         virtual bool isSharedObject(WebGLSharedObject*) const;
         virtual bool isValid() const;
@@ -242,28 +251,21 @@
             context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, attachment, m_target, 0, m_level);
     }
 
-    bool isAttachmentComplete(WebGLFramebuffer::WebGLAttachment* attachedObject, GC3Denum attachment, const char** reason)
+    GC3Denum WebGLTextureAttachment::getType() const
     {
-        ASSERT(attachedObject && attachedObject->isValid());
-        ASSERT(reason);
-        GC3Denum format = attachedObject->getFormat();
-        unsigned need = GraphicsContext3D::getClearBitsByAttachmentType(attachment);
-        unsigned have = GraphicsContext3D::getClearBitsByFormat(format);
+        return m_texture->getType(m_target, m_level);
+    }
 
-        if ((need & have) != need) {
-            *reason = "attachment type is not correct for attachment";
+    bool isColorRenderable(GC3Denum internalformat)
+    {
+        switch (internalformat) {
+        case GraphicsContext3D::RGBA4:
+        case GraphicsContext3D::RGB5_A1:
+        case GraphicsContext3D::RGB565:
+            return true;
+        default:
             return false;
         }
-        if (!attachedObject->getWidth() || !attachedObject->getHeight()) {
-            *reason = "attachment has a 0 dimension";
-            return false;
-        }
-        if ((attachment == GraphicsContext3D::DEPTH_ATTACHMENT || attachment == GraphicsContext3D::STENCIL_ATTACHMENT)
-            && format == GraphicsContext3D::DEPTH_STENCIL) {
-          *reason = "attachment DEPTH_STENCIL not allowed on DEPTH or STENCIL attachment";
-          return false;
-        }
-        return true;
     }
 
 } // anonymous namespace
@@ -336,6 +338,92 @@
     return attachmentObject ? attachmentObject->getObject() : 0;
 }
 
+bool WebGLFramebuffer::isAttachmentComplete(WebGLAttachment* attachedObject, GC3Denum attachment, const char** reason) const
+{
+    ASSERT(attachedObject && attachedObject->isValid());
+    ASSERT(reason);
+
+    GC3Denum internalformat = attachedObject->getFormat();
+    WebGLSharedObject* object = attachedObject->getObject();
+    ASSERT(object && (object->isTexture() || object->isRenderbuffer()));
+
+    if (attachment == GraphicsContext3D::DEPTH_ATTACHMENT) {
+        if (object->isRenderbuffer()) {
+            if (internalformat != GraphicsContext3D::DEPTH_COMPONENT16) {
+                *reason = "the internalformat of the attached renderbuffer is not DEPTH_COMPONENT16";
+                return false;
+            }
+        } else if (object->isTexture()) {
+            GC3Denum type = attachedObject->getType();
+            if (!(context()->m_webglDepthTexture && internalformat == GraphicsContext3D::DEPTH_COMPONENT
+                && (type == GraphicsContext3D::UNSIGNED_SHORT || type == GraphicsContext3D::UNSIGNED_INT))) {
+                *reason = "the attached texture is not a depth texture";
+                return false;
+            }
+        }
+    } else if (attachment == GraphicsContext3D::STENCIL_ATTACHMENT) {
+        // Depend on the underlying GL drivers to check stencil textures
+        // and check renderbuffer type here only.
+        if (object->isRenderbuffer()) {
+            if (internalformat != GraphicsContext3D::STENCIL_INDEX8) {
+                *reason = "the internalformat of the attached renderbuffer is not STENCIL_INDEX8";
+                return false;
+            }
+        }
+    } else if (attachment == GraphicsContext3D::DEPTH_STENCIL_ATTACHMENT) {
+        if (object->isRenderbuffer()) {
+            if (internalformat != GraphicsContext3D::DEPTH_STENCIL) {
+                *reason = "the internalformat of the attached renderbuffer is not DEPTH_STENCIL";
+                return false;
+            }
+        } else if (object->isTexture()) {
+            GC3Denum type = attachedObject->getType();
+            if (!(context()->m_webglDepthTexture && internalformat == GraphicsContext3D::DEPTH_STENCIL
+                && type == GraphicsContext3D::UNSIGNED_INT_24_8)) {
+                *reason = "the attached texture is not a DEPTH_STENCIL texture";
+                return false;
+            }
+        }
+    } else if (attachment == GraphicsContext3D::COLOR_ATTACHMENT0
+        || (context()->m_webglDrawBuffers && attachment > GraphicsContext3D::COLOR_ATTACHMENT0
+            && attachment < static_cast<GC3Denum>(GraphicsContext3D::COLOR_ATTACHMENT0 + context()->getMaxColorAttachments()))) {
+        if (object->isRenderbuffer()) {
+            if (!isColorRenderable(internalformat)) {
+                *reason = "the internalformat of the attached renderbuffer is not color-renderable";
+                return false;
+            }
+        } else if (object->isTexture()) {
+            GC3Denum type = attachedObject->getType();
+            if (internalformat != GraphicsContext3D::RGBA && internalformat != GraphicsContext3D::RGB) {
+                *reason = "the internalformat of the attached texture is not color-renderable";
+                return false;
+            }
+            // TODO: WEBGL_color_buffer_float and EXT_color_buffer_half_float extensions have not been implemented in
+            // WebGL yet. It would be better to depend on the underlying GL drivers to check on rendering to floating point textures
+            // and add the check back to WebGL when above two extensions are implemented.
+            // Assume UNSIGNED_BYTE is renderable here without the need to explicitly check if GL_OES_rgb8_rgba8 extension is supported.
+            if (type != GraphicsContext3D::UNSIGNED_BYTE
+                && type != GraphicsContext3D::UNSIGNED_SHORT_5_6_5
+                && type != GraphicsContext3D::UNSIGNED_SHORT_4_4_4_4
+                && type != GraphicsContext3D::UNSIGNED_SHORT_5_5_5_1
+                && !(type == GraphicsContext3D::FLOAT && context()->m_oesTextureFloat)
+                && !(type == GraphicsContext3D::HALF_FLOAT_OES && context()->m_oesTextureHalfFloat)) {
+                *reason = "unsupported type: The attached texture is not supported to be rendered to";
+                return false;
+            }
+        }
+    } else {
+        *reason = "unknown framebuffer attachment point";
+        return false;
+    }
+
+    if (!attachedObject->getWidth() || !attachedObject->getHeight()) {
+        *reason = "attachment has a 0 dimension";
+        return false;
+    }
+    return true;
+}
+
 WebGLFramebuffer::WebGLAttachment* WebGLFramebuffer::getAttachment(GC3Denum attachment) const
 {
     const AttachmentMap::const_iterator it = m_attachments.find(attachment);
diff --git a/Source/core/html/canvas/WebGLFramebuffer.h b/Source/core/html/canvas/WebGLFramebuffer.h
index ff40734..7b6edba 100644
--- a/Source/core/html/canvas/WebGLFramebuffer.h
+++ b/Source/core/html/canvas/WebGLFramebuffer.h
@@ -46,6 +46,11 @@
         virtual GC3Dsizei getWidth() const = 0;
         virtual GC3Dsizei getHeight() const = 0;
         virtual GC3Denum getFormat() const = 0;
+        // For texture attachment, getType() returns the type of the attached texture.
+        // For renderbuffer attachment, the type of the renderbuffer may vary with GL implementation.
+        // To avoid confusion, it would be better to not implement getType() for renderbuffer attachment and
+        // we should always use the internalformat of the renderbuffer and avoid using getType() API.
+        virtual GC3Denum getType() const = 0;
         virtual WebGLSharedObject* getObject() const = 0;
         virtual bool isSharedObject(WebGLSharedObject*) const = 0;
         virtual bool isValid() const = 0;
@@ -109,6 +114,7 @@
     virtual bool isFramebuffer() const { return true; }
 
     WebGLAttachment* getAttachment(GC3Denum) const;
+    bool isAttachmentComplete(WebGLAttachment* attachedObject, GC3Denum attachment, const char** reason) const;
 
     // Check if the framebuffer is currently bound.
     bool isBound() const;
diff --git a/Source/core/html/canvas/WebGLRenderingContext.cpp b/Source/core/html/canvas/WebGLRenderingContext.cpp
index 91b3dfc..01e667d 100644
--- a/Source/core/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/core/html/canvas/WebGLRenderingContext.cpp
@@ -66,7 +66,7 @@
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/page/Frame.h"
 #include "core/page/Page.h"
 #include "core/page/Settings.h"
diff --git a/Source/core/html/ime/InputMethodContext.cpp b/Source/core/html/ime/InputMethodContext.cpp
index 3f59140..3518a7b 100644
--- a/Source/core/html/ime/InputMethodContext.cpp
+++ b/Source/core/html/ime/InputMethodContext.cpp
@@ -31,11 +31,9 @@
 #include "config.h"
 #include "core/html/ime/InputMethodContext.h"
 
-#include "core/editing/Editor.h"
+#include "core/editing/InputMethodController.h"
 #include "core/html/ime/Composition.h"
-#include "core/page/EditorClient.h"
 #include "core/page/Frame.h"
-#include "core/page/Page.h"
 
 namespace WebCore {
 
@@ -78,27 +76,12 @@
     Frame* frame = m_element->document()->frame();
     if (!frame)
         return;
-    Editor* editor = frame->editor();
-    if (!editor->hasComposition())
-        return;
 
     const Element* element = frame->document()->focusedElement();
     if (!element || !element->isHTMLElement() || m_element != toHTMLElement(element))
         return;
 
-    // We should verify the parent node of this IME composition node are
-    // editable because JavaScript may delete a parent node of the composition
-    // node. In this case, WebKit crashes while deleting texts from the parent
-    // node, which doesn't exist any longer.
-    RefPtr<Range> range = editor->compositionRange();
-    if (range) {
-        Node* node = range->startContainer();
-        if (!node || !node->isContentEditable())
-            return;
-    }
-
-    // This resets input method and the composition string is committed.
-    editor->client()->willSetInputMethodState();
+    frame->inputMethodController().confirmCompositionAndResetState();
 }
 
 void InputMethodContext::setCaretRectangle(Node* anchor, int x, int y, int w, int h)
diff --git a/Source/core/html/parser/CSSPreloadScanner.cpp b/Source/core/html/parser/CSSPreloadScanner.cpp
index bd1f1af..10ab28d 100644
--- a/Source/core/html/parser/CSSPreloadScanner.cpp
+++ b/Source/core/html/parser/CSSPreloadScanner.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "core/html/parser/CSSPreloadScanner.h"
 
+#include "FetchInitiatorTypeNames.h"
 #include "core/html/parser/HTMLIdentifier.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/platform/text/SegmentedString.h"
@@ -216,7 +217,7 @@
         if (!url.isEmpty()) {
             KURL baseElementURL; // FIXME: This should be passed in from the HTMLPreloadScaner via scan()!
             TextPosition position = TextPosition(source.currentLine(), source.currentColumn());
-            OwnPtr<PreloadRequest> request = PreloadRequest::create("css", position, url, baseElementURL, Resource::CSSStyleSheet);
+            OwnPtr<PreloadRequest> request = PreloadRequest::create(FetchInitiatorTypeNames::css, position, url, baseElementURL, Resource::CSSStyleSheet);
             // FIXME: Should this be including the charset in the preload request?
             m_requests->append(request.release());
         }
diff --git a/Source/core/html/parser/HTMLDocumentParser.cpp b/Source/core/html/parser/HTMLDocumentParser.cpp
index 1719851..cdc7e0a 100644
--- a/Source/core/html/parser/HTMLDocumentParser.cpp
+++ b/Source/core/html/parser/HTMLDocumentParser.cpp
@@ -41,6 +41,7 @@
 #include "core/html/parser/HTMLTreeBuilder.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/page/Frame.h"
+#include "core/platform/chromium/TraceEvent.h"
 #include "wtf/Functional.h"
 
 namespace WebCore {
@@ -683,10 +684,11 @@
             startBackgroundParser();
 
         ASSERT(inputSource->hasOneRef());
-        Closure closure = bind(&BackgroundHTMLParser::append, m_backgroundParser, String(inputSource));
+        TRACE_EVENT1("net", "HTMLDocumentParser::append", "size", inputSource->length());
         // NOTE: Important that the String temporary is destroyed before we post the task
         // otherwise the String could call deref() on a StringImpl now owned by the background parser.
         // We would like to ASSERT(closure.arg3()->hasOneRef()) but sadly the args are private.
+        Closure closure = bind(&BackgroundHTMLParser::append, m_backgroundParser, String(inputSource));
         HTMLParserThread::shared()->postTask(closure);
         return;
     }
@@ -694,6 +696,7 @@
     // pumpTokenizer can cause this parser to be detached from the Document,
     // but we need to ensure it isn't deleted yet.
     RefPtr<HTMLDocumentParser> protect(this);
+    TRACE_EVENT1("net", "HTMLDocumentParser::append", "size", inputSource->length());
     String source(inputSource);
 
     if (m_preloadScanner) {
@@ -875,18 +878,18 @@
     endIfDelayed();
 }
 
-void HTMLDocumentParser::watchForLoad(Resource* cachedScript)
+void HTMLDocumentParser::watchForLoad(Resource* resource)
 {
-    ASSERT(!cachedScript->isLoaded());
+    ASSERT(!resource->isLoaded());
     // addClient would call notifyFinished if the load were complete.
     // Callers do not expect to be re-entered from this call, so they should
     // not an already-loaded Resource.
-    cachedScript->addClient(this);
+    resource->addClient(this);
 }
 
-void HTMLDocumentParser::stopWatchingForLoad(Resource* cachedScript)
+void HTMLDocumentParser::stopWatchingForLoad(Resource* resource)
 {
-    cachedScript->removeClient(this);
+    resource->removeClient(this);
 }
 
 void HTMLDocumentParser::appendCurrentInputStreamToPreloadScannerAndScan()
diff --git a/Source/core/html/parser/HTMLEntityParser.cpp b/Source/core/html/parser/HTMLEntityParser.cpp
index f0d78ef..97cebee 100644
--- a/Source/core/html/parser/HTMLEntityParser.cpp
+++ b/Source/core/html/parser/HTMLEntityParser.cpp
@@ -30,7 +30,6 @@
 
 #include "core/html/parser/HTMLEntitySearch.h"
 #include "core/html/parser/HTMLEntityTable.h"
-#include "core/xml/parser/CharacterReferenceParserInlines.h"
 #include "wtf/text/StringBuilder.h"
 
 using namespace WTF;
@@ -44,88 +43,230 @@
     0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, 0x009D, 0x017E, 0x0178, // 98-9F
 };
 
-static inline bool isAlphaNumeric(UChar cc)
+static bool isAlphaNumeric(UChar cc)
 {
     return (cc >= '0' && cc <= '9') || (cc >= 'a' && cc <= 'z') || (cc >= 'A' && cc <= 'Z');
 }
 
-class HTMLEntityParser {
-public:
-    inline static UChar adjustEntity(UChar32 value)
-    {
-        if ((value & ~0x1F) != 0x0080)
-            return value;
-        return windowsLatin1ExtensionArray[value - 0x80];
-    }
-
-    inline static UChar32 legalEntityFor(UChar32 value)
-    {
-        // FIXME: A number of specific entity values generate parse errors.
-        if (value <= 0 || value > 0x10FFFF || (value >= 0xD800 && value <= 0xDFFF))
-            return 0xFFFD;
-        if (U_IS_BMP(value))
-            return adjustEntity(value);
+static UChar adjustEntity(UChar32 value)
+{
+    if ((value & ~0x1F) != 0x0080)
         return value;
+    return windowsLatin1ExtensionArray[value - 0x80];
+}
+
+static void appendLegalEntityFor(UChar32 c, DecodedHTMLEntity& decodedEntity)
+{
+    // FIXME: A number of specific entity values generate parse errors.
+    if (c <= 0 || c > 0x10FFFF || (c >= 0xD800 && c <= 0xDFFF)) {
+        decodedEntity.append(0xFFFD);
+        return;
     }
+    if (U_IS_BMP(c)) {
+        decodedEntity.append(adjustEntity(c));
+        return;
+    }
+    decodedEntity.append(c);
+}
 
-    inline static bool acceptMalformed() { return true; }
+static const UChar32 kInvalidUnicode = -1;
 
-    inline static bool consumeNamedEntity(SegmentedString& source, StringBuilder& decodedEntity, bool& notEnoughCharacters, UChar additionalAllowedCharacter, UChar& cc)
-    {
-        StringBuilder consumedCharacters;
-        HTMLEntitySearch entitySearch;
-        while (!source.isEmpty()) {
-            cc = source.currentChar();
-            entitySearch.advance(cc);
-            if (!entitySearch.isEntityPrefix())
-                break;
-            consumedCharacters.append(cc);
-            source.advanceAndASSERT(cc);
-        }
-        notEnoughCharacters = source.isEmpty();
-        if (notEnoughCharacters) {
-            // We can't an entity because there might be a longer entity
-            // that we could match if we had more data.
-            unconsumeCharacters(source, consumedCharacters);
-            return false;
-        }
-        if (!entitySearch.mostRecentMatch()) {
-            unconsumeCharacters(source, consumedCharacters);
-            return false;
-        }
-        if (entitySearch.mostRecentMatch()->length != entitySearch.currentLength()) {
-            // We've consumed too many characters. We need to walk the
-            // source back to the point at which we had consumed an
-            // actual entity.
-            unconsumeCharacters(source, consumedCharacters);
-            consumedCharacters.clear();
-            const int length = entitySearch.mostRecentMatch()->length;
-            const UChar* reference = entitySearch.mostRecentMatch()->entity;
-            for (int i = 0; i < length; ++i) {
-                cc = source.currentChar();
-                ASSERT_UNUSED(reference, cc == *reference++);
-                consumedCharacters.append(cc);
-                source.advanceAndASSERT(cc);
-                ASSERT(!source.isEmpty());
-            }
-            cc = source.currentChar();
-        }
-        if (entitySearch.mostRecentMatch()->lastCharacter() == ';'
-            || !additionalAllowedCharacter
-            || !(isAlphaNumeric(cc) || cc == '=')) {
-            decodedEntity.append(entitySearch.mostRecentMatch()->firstValue);
-            if (entitySearch.mostRecentMatch()->secondValue)
-                decodedEntity.append(entitySearch.mostRecentMatch()->secondValue);
-            return true;
-        }
+static bool isHexDigit(UChar cc)
+{
+    return (cc >= '0' && cc <= '9') || (cc >= 'a' && cc <= 'f') || (cc >= 'A' && cc <= 'F');
+}
+
+static UChar asHexDigit(UChar cc)
+{
+    if (cc >= '0' && cc <= '9')
+      return cc - '0';
+    if (cc >= 'a' && cc <= 'z')
+      return 10 + cc - 'a';
+    if (cc >= 'A' && cc <= 'Z')
+      return 10 + cc - 'A';
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+typedef Vector<UChar, 64> ConsumedCharacterBuffer;
+
+static void unconsumeCharacters(SegmentedString& source, ConsumedCharacterBuffer& consumedCharacters)
+{
+    if (consumedCharacters.size() == 1)
+        source.push(consumedCharacters[0]);
+    else if (consumedCharacters.size() == 2) {
+        source.push(consumedCharacters[0]);
+        source.push(consumedCharacters[1]);
+    } else
+        source.prepend(SegmentedString(String(consumedCharacters)));
+}
+
+static bool consumeNamedEntity(SegmentedString& source, DecodedHTMLEntity& decodedEntity, bool& notEnoughCharacters, UChar additionalAllowedCharacter, UChar& cc)
+{
+    ConsumedCharacterBuffer consumedCharacters;
+    HTMLEntitySearch entitySearch;
+    while (!source.isEmpty()) {
+        cc = source.currentChar();
+        entitySearch.advance(cc);
+        if (!entitySearch.isEntityPrefix())
+            break;
+        consumedCharacters.append(cc);
+        source.advanceAndASSERT(cc);
+    }
+    notEnoughCharacters = source.isEmpty();
+    if (notEnoughCharacters) {
+        // We can't an entity because there might be a longer entity
+        // that we could match if we had more data.
         unconsumeCharacters(source, consumedCharacters);
         return false;
     }
-};
+    if (!entitySearch.mostRecentMatch()) {
+        unconsumeCharacters(source, consumedCharacters);
+        return false;
+    }
+    if (entitySearch.mostRecentMatch()->length != entitySearch.currentLength()) {
+        // We've consumed too many characters. We need to walk the
+        // source back to the point at which we had consumed an
+        // actual entity.
+        unconsumeCharacters(source, consumedCharacters);
+        consumedCharacters.clear();
+        const int length = entitySearch.mostRecentMatch()->length;
+        const UChar* reference = entitySearch.mostRecentMatch()->entity;
+        for (int i = 0; i < length; ++i) {
+            cc = source.currentChar();
+            ASSERT_UNUSED(reference, cc == *reference++);
+            consumedCharacters.append(cc);
+            source.advanceAndASSERT(cc);
+            ASSERT(!source.isEmpty());
+        }
+        cc = source.currentChar();
+    }
+    if (entitySearch.mostRecentMatch()->lastCharacter() == ';'
+        || !additionalAllowedCharacter
+        || !(isAlphaNumeric(cc) || cc == '=')) {
+        decodedEntity.append(entitySearch.mostRecentMatch()->firstValue);
+        if (UChar32 second = entitySearch.mostRecentMatch()->secondValue)
+            decodedEntity.append(second);
+        return true;
+    }
+    unconsumeCharacters(source, consumedCharacters);
+    return false;
+}
 
-bool consumeHTMLEntity(SegmentedString& source, StringBuilder& decodedEntity, bool& notEnoughCharacters, UChar additionalAllowedCharacter)
+bool consumeHTMLEntity(SegmentedString& source, DecodedHTMLEntity& decodedEntity, bool& notEnoughCharacters, UChar additionalAllowedCharacter)
 {
-    return consumeCharacterReference<HTMLEntityParser>(source, decodedEntity, notEnoughCharacters, additionalAllowedCharacter);
+    ASSERT(!additionalAllowedCharacter || additionalAllowedCharacter == '"' || additionalAllowedCharacter == '\'' || additionalAllowedCharacter == '>');
+    ASSERT(!notEnoughCharacters);
+    ASSERT(decodedEntity.isEmpty());
+
+    enum EntityState {
+        Initial,
+        Number,
+        MaybeHexLowerCaseX,
+        MaybeHexUpperCaseX,
+        Hex,
+        Decimal,
+        Named
+    };
+    EntityState entityState = Initial;
+    UChar32 result = 0;
+    ConsumedCharacterBuffer consumedCharacters;
+
+    while (!source.isEmpty()) {
+        UChar cc = source.currentChar();
+        switch (entityState) {
+        case Initial: {
+            if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ' || cc == '<' || cc == '&')
+                return false;
+            if (additionalAllowedCharacter && cc == additionalAllowedCharacter)
+                return false;
+            if (cc == '#') {
+                entityState = Number;
+                break;
+            }
+            if ((cc >= 'a' && cc <= 'z') || (cc >= 'A' && cc <= 'Z')) {
+                entityState = Named;
+                continue;
+            }
+            return false;
+        }
+        case Number: {
+            if (cc == 'x') {
+                entityState = MaybeHexLowerCaseX;
+                break;
+            }
+            if (cc == 'X') {
+                entityState = MaybeHexUpperCaseX;
+                break;
+            }
+            if (cc >= '0' && cc <= '9') {
+                entityState = Decimal;
+                continue;
+            }
+            source.push('#');
+            return false;
+        }
+        case MaybeHexLowerCaseX: {
+            if (isHexDigit(cc)) {
+                entityState = Hex;
+                continue;
+            }
+            source.push('#');
+            source.push('x');
+            return false;
+        }
+        case MaybeHexUpperCaseX: {
+            if (isHexDigit(cc)) {
+                entityState = Hex;
+                continue;
+            }
+            source.push('#');
+            source.push('X');
+            return false;
+        }
+        case Hex: {
+            if (isHexDigit(cc)) {
+                if (result != kInvalidUnicode)
+                    result = result * 16 + asHexDigit(cc);
+            } else if (cc == ';') {
+                source.advanceAndASSERT(cc);
+                appendLegalEntityFor(result, decodedEntity);
+                return true;
+            } else {
+                appendLegalEntityFor(result, decodedEntity);
+                return true;
+            }
+            break;
+        }
+        case Decimal: {
+            if (cc >= '0' && cc <= '9') {
+                if (result != kInvalidUnicode)
+                    result = result * 10 + cc - '0';
+            } else if (cc == ';') {
+                source.advanceAndASSERT(cc);
+                appendLegalEntityFor(result, decodedEntity);
+                return true;
+            } else {
+                appendLegalEntityFor(result, decodedEntity);
+                return true;
+            }
+            break;
+        }
+        case Named: {
+            return consumeNamedEntity(source, decodedEntity, notEnoughCharacters, additionalAllowedCharacter, cc);
+        }
+        }
+
+        if (result > UCHAR_MAX_VALUE)
+            result = kInvalidUnicode;
+
+        consumedCharacters.append(cc);
+        source.advanceAndASSERT(cc);
+    }
+    ASSERT(source.isEmpty());
+    notEnoughCharacters = true;
+    unconsumeCharacters(source, consumedCharacters);
+    return false;
 }
 
 static size_t appendUChar32ToUCharArray(UChar32 value, UChar* result)
diff --git a/Source/core/html/parser/HTMLEntityParser.h b/Source/core/html/parser/HTMLEntityParser.h
index fc12f62..12499c7 100644
--- a/Source/core/html/parser/HTMLEntityParser.h
+++ b/Source/core/html/parser/HTMLEntityParser.h
@@ -31,7 +31,37 @@
 
 namespace WebCore {
 
-bool consumeHTMLEntity(SegmentedString&, StringBuilder& decodedEntity, bool& notEnoughCharacters, UChar additionalAllowedCharacter = '\0');
+class DecodedHTMLEntity {
+private:
+    // HTML entities contain at most four UTF-16 code units.
+    static const unsigned kMaxLength = 4;
+
+public:
+    DecodedHTMLEntity() : length(0) { }
+
+    bool isEmpty() const { return !length; }
+
+    void append(UChar c)
+    {
+        RELEASE_ASSERT(length < kMaxLength);
+        data[length++] = c;
+    }
+
+    void append(UChar32 c)
+    {
+        if (U_IS_BMP(c)) {
+            append(static_cast<UChar>(c));
+            return;
+        }
+        append(U16_LEAD(c));
+        append(U16_TRAIL(c));
+    }
+
+    unsigned length;
+    UChar data[kMaxLength];
+};
+
+bool consumeHTMLEntity(SegmentedString&, DecodedHTMLEntity& decodedEntity, bool& notEnoughCharacters, UChar additionalAllowedCharacter = '\0');
 
 // Used by the XML parser.  Not suitable for use in HTML parsing.  Use consumeHTMLEntity instead.
 size_t decodeNamedEntityToUCharArray(const char*, UChar result[4]);
diff --git a/Source/core/html/parser/HTMLPreloadScanner.cpp b/Source/core/html/parser/HTMLPreloadScanner.cpp
index 306fc7c..0b51791 100644
--- a/Source/core/html/parser/HTMLPreloadScanner.cpp
+++ b/Source/core/html/parser/HTMLPreloadScanner.cpp
@@ -33,6 +33,7 @@
 #include "core/html/LinkRelAttribute.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLTokenizer.h"
+#include "core/platform/chromium/TraceEvent.h"
 #include "wtf/MainThread.h"
 
 namespace WebCore {
@@ -84,7 +85,7 @@
     if (match(tagImpl, scriptTag))
         return scriptTag.localName();
     ASSERT_NOT_REACHED();
-    return "unknown";
+    return emptyString();
 }
 
 class TokenPreloadScanner::StartTagScanner {
@@ -126,6 +127,7 @@
         if (!shouldPreload())
             return nullptr;
 
+        TRACE_EVENT_INSTANT1("net", "PreloadRequest", "url", m_urlToLoad.ascii());
         TextPosition position = TextPosition(source.currentLine(), source.currentColumn());
         OwnPtr<PreloadRequest> request = PreloadRequest::create(initiatorFor(m_tagImpl), position, m_urlToLoad, predictedBaseURL, resourceType(), m_mediaAttribute);
         request->setCrossOriginModeAllowsCookies(crossOriginModeAllowsCookies());
@@ -188,11 +190,11 @@
         if (match(m_tagImpl, scriptTag))
             return Resource::Script;
         if (match(m_tagImpl, imgTag) || (match(m_tagImpl, inputTag) && m_inputIsImage))
-            return Resource::ImageResource;
+            return Resource::Image;
         if (match(m_tagImpl, linkTag) && m_linkIsStyleSheet)
             return Resource::CSSStyleSheet;
         ASSERT_NOT_REACHED();
-        return Resource::RawResource;
+        return Resource::Raw;
     }
 
     bool shouldPreload()
diff --git a/Source/core/html/parser/HTMLResourcePreloader.cpp b/Source/core/html/parser/HTMLResourcePreloader.cpp
index 7c4f8b4..4960d81 100644
--- a/Source/core/html/parser/HTMLResourcePreloader.cpp
+++ b/Source/core/html/parser/HTMLResourcePreloader.cpp
@@ -32,6 +32,7 @@
 #include "core/loader/cache/ResourceFetcher.h"
 #include "core/css/MediaList.h"
 #include "core/css/MediaQueryEvaluator.h"
+#include "core/platform/HistogramSupport.h"
 #include "core/rendering/RenderObject.h"
 
 namespace WebCore {
@@ -92,6 +93,7 @@
         return;
 
     FetchRequest request = preload->resourceRequest(m_document);
+    HistogramSupport::histogramCustomCounts("WebCore.PreloadDelayMs", static_cast<int>(1000 * (monotonicallyIncreasingTime() - preload->discoveryTime())), 0, 2000, 20);
     loadingDocument->fetcher()->preload(preload->resourceType(), request, preload->charset());
 }
 
diff --git a/Source/core/html/parser/HTMLResourcePreloader.h b/Source/core/html/parser/HTMLResourcePreloader.h
index 89ecb92..1b94671 100644
--- a/Source/core/html/parser/HTMLResourcePreloader.h
+++ b/Source/core/html/parser/HTMLResourcePreloader.h
@@ -28,6 +28,7 @@
 
 #include "core/loader/cache/FetchRequest.h"
 #include "core/loader/cache/Resource.h"
+#include "wtf/CurrentTime.h"
 #include "wtf/text/TextPosition.h"
 
 namespace WebCore {
@@ -50,19 +51,21 @@
 
     const String& charset() const { return m_charset; }
     const String& media() const { return m_mediaAttribute; }
+    double discoveryTime() const { return m_discoveryTime; }
     void setCharset(const String& charset) { m_charset = charset.isolatedCopy(); }
     void setCrossOriginModeAllowsCookies(bool allowsCookies) { m_crossOriginModeAllowsCookies = allowsCookies; }
     Resource::Type resourceType() const { return m_resourceType; }
 
 private:
     PreloadRequest(const String& initiatorName, const TextPosition& initiatorPosition, const String& resourceURL, const KURL& baseURL, Resource::Type resourceType, const String& mediaAttribute)
-        : m_initiatorName(initiatorName.isolatedCopy())
+        : m_initiatorName(initiatorName)
         , m_initiatorPosition(initiatorPosition)
         , m_resourceURL(resourceURL.isolatedCopy())
         , m_baseURL(baseURL.copy())
         , m_resourceType(resourceType)
         , m_mediaAttribute(mediaAttribute.isolatedCopy())
         , m_crossOriginModeAllowsCookies(false)
+        , m_discoveryTime(monotonicallyIncreasingTime())
     {
     }
 
@@ -76,6 +79,7 @@
     Resource::Type m_resourceType;
     String m_mediaAttribute;
     bool m_crossOriginModeAllowsCookies;
+    double m_discoveryTime;
 };
 
 typedef Vector<OwnPtr<PreloadRequest> > PreloadRequestStream;
diff --git a/Source/core/html/parser/HTMLScriptRunner.cpp b/Source/core/html/parser/HTMLScriptRunner.cpp
index 4ee98da..5141c82 100644
--- a/Source/core/html/parser/HTMLScriptRunner.cpp
+++ b/Source/core/html/parser/HTMLScriptRunner.cpp
@@ -35,7 +35,7 @@
 #include "core/html/parser/HTMLInputStream.h"
 #include "core/html/parser/HTMLScriptRunnerHost.h"
 #include "core/html/parser/NestingLevelIncrementer.h"
-#include "core/loader/cache/CachedScript.h"
+#include "core/loader/cache/ScriptResource.h"
 #include "core/page/Frame.h"
 #include "core/platform/NotImplemented.h"
 
@@ -55,12 +55,12 @@
 HTMLScriptRunner::~HTMLScriptRunner()
 {
     // FIXME: Should we be passed a "done loading/parsing" callback sooner than destruction?
-    if (m_parserBlockingScript.cachedScript() && m_parserBlockingScript.watchingForLoad())
+    if (m_parserBlockingScript.resource() && m_parserBlockingScript.watchingForLoad())
         stopWatchingForLoad(m_parserBlockingScript);
 
     while (!m_scriptsToExecuteAfterParsing.isEmpty()) {
         PendingScript pendingScript = m_scriptsToExecuteAfterParsing.takeFirst();
-        if (pendingScript.cachedScript() && pendingScript.watchingForLoad())
+        if (pendingScript.resource() && pendingScript.watchingForLoad())
             stopWatchingForLoad(pendingScript);
     }
 }
@@ -86,10 +86,10 @@
 
 ScriptSourceCode HTMLScriptRunner::sourceFromPendingScript(const PendingScript& script, bool& errorOccurred) const
 {
-    if (script.cachedScript()) {
-        errorOccurred = script.cachedScript()->errorOccurred();
-        ASSERT(script.cachedScript()->isLoaded());
-        return ScriptSourceCode(script.cachedScript());
+    if (script.resource()) {
+        errorOccurred = script.resource()->errorOccurred();
+        ASSERT(script.resource()->isLoaded());
+        return ScriptSourceCode(script.resource());
     }
     errorOccurred = false;
     return ScriptSourceCode(script.element()->textContent(), documentURLForScriptExecution(m_document), script.startingPosition());
@@ -100,7 +100,7 @@
     m_hasScriptsWaitingForResources = !m_document->haveStylesheetsAndImportsLoaded();
     if (m_hasScriptsWaitingForResources)
         return false;
-    if (script.cachedScript() && !script.cachedScript()->isLoaded())
+    if (script.resource() && !script.resource()->isLoaded())
         return false;
     return true;
 }
@@ -122,7 +122,7 @@
     ScriptSourceCode sourceCode = sourceFromPendingScript(pendingScript, errorOccurred);
 
     // Stop watching loads before executeScript to prevent recursion if the script reloads itself.
-    if (pendingScript.cachedScript() && pendingScript.watchingForLoad())
+    if (pendingScript.resource() && pendingScript.watchingForLoad())
         stopWatchingForLoad(pendingScript);
 
     if (!isExecutingScript())
@@ -147,14 +147,14 @@
 void HTMLScriptRunner::watchForLoad(PendingScript& pendingScript)
 {
     ASSERT(!pendingScript.watchingForLoad());
-    m_host->watchForLoad(pendingScript.cachedScript());
+    m_host->watchForLoad(pendingScript.resource());
     pendingScript.setWatchingForLoad(true);
 }
 
 void HTMLScriptRunner::stopWatchingForLoad(PendingScript& pendingScript)
 {
     ASSERT(pendingScript.watchingForLoad());
-    m_host->stopWatchingForLoad(pendingScript.cachedScript());
+    m_host->stopWatchingForLoad(pendingScript.resource());
     pendingScript.setWatchingForLoad(false);
 }
 
@@ -191,12 +191,12 @@
         executeParsingBlockingScript();
 }
 
-void HTMLScriptRunner::executeScriptsWaitingForLoad(Resource* cachedScript)
+void HTMLScriptRunner::executeScriptsWaitingForLoad(Resource* resource)
 {
     ASSERT(!isExecutingScript());
     ASSERT(hasParserBlockingScript());
-    ASSERT_UNUSED(cachedScript, m_parserBlockingScript.cachedScript() == cachedScript);
-    ASSERT(m_parserBlockingScript.cachedScript()->isLoaded());
+    ASSERT_UNUSED(resource, m_parserBlockingScript.resource() == resource);
+    ASSERT(m_parserBlockingScript.resource()->isLoaded());
     executeParsingBlockingScripts();
 }
 
@@ -216,8 +216,8 @@
     while (!m_scriptsToExecuteAfterParsing.isEmpty()) {
         ASSERT(!isExecutingScript());
         ASSERT(!hasParserBlockingScript());
-        ASSERT(m_scriptsToExecuteAfterParsing.first().cachedScript());
-        if (!m_scriptsToExecuteAfterParsing.first().cachedScript()->isLoaded()) {
+        ASSERT(m_scriptsToExecuteAfterParsing.first().resource());
+        if (!m_scriptsToExecuteAfterParsing.first().resource()->isLoaded()) {
             watchForLoad(m_scriptsToExecuteAfterParsing.first());
             return false;
         }
@@ -235,12 +235,12 @@
     if (!requestPendingScript(m_parserBlockingScript, element))
         return;
 
-    ASSERT(m_parserBlockingScript.cachedScript());
+    ASSERT(m_parserBlockingScript.resource());
 
-    // We only care about a load callback if cachedScript is not already
+    // We only care about a load callback if resource is not already
     // in the cache. Callers will attempt to run the m_parserBlockingScript
     // if possible before returning control to the parser.
-    if (!m_parserBlockingScript.cachedScript()->isLoaded())
+    if (!m_parserBlockingScript.resource()->isLoaded())
         watchForLoad(m_parserBlockingScript);
 }
 
@@ -250,7 +250,7 @@
     if (!requestPendingScript(pendingScript, element))
         return;
 
-    ASSERT(pendingScript.cachedScript());
+    ASSERT(pendingScript.resource());
     m_scriptsToExecuteAfterParsing.append(pendingScript);
 }
 
@@ -259,12 +259,12 @@
     ASSERT(!pendingScript.element());
     pendingScript.setElement(script);
     // This should correctly return 0 for empty or invalid srcValues.
-    CachedScript* cachedScript = toScriptLoaderIfPossible(script)->cachedScript().get();
-    if (!cachedScript) {
+    ScriptResource* resource = toScriptLoaderIfPossible(script)->resource().get();
+    if (!resource) {
         notImplemented(); // Dispatch error event.
         return false;
     }
-    pendingScript.setCachedScript(cachedScript);
+    pendingScript.setScriptResource(resource);
     return true;
 }
 
diff --git a/Source/core/html/parser/HTMLScriptRunner.h b/Source/core/html/parser/HTMLScriptRunner.h
index 98d84c7..82d8bc2 100644
--- a/Source/core/html/parser/HTMLScriptRunner.h
+++ b/Source/core/html/parser/HTMLScriptRunner.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 
 class Resource;
-class CachedScript;
+class ScriptResource;
 class Document;
 class Element;
 class Frame;
diff --git a/Source/core/html/parser/HTMLTokenizer.cpp b/Source/core/html/parser/HTMLTokenizer.cpp
index 0931934..c78cd59 100644
--- a/Source/core/html/parser/HTMLTokenizer.cpp
+++ b/Source/core/html/parser/HTMLTokenizer.cpp
@@ -155,7 +155,7 @@
 inline bool HTMLTokenizer::processEntity(SegmentedString& source)
 {
     bool notEnoughCharacters = false;
-    StringBuilder decodedEntity;
+    DecodedHTMLEntity decodedEntity;
     bool success = consumeHTMLEntity(source, decodedEntity, notEnoughCharacters);
     if (notEnoughCharacters)
         return false;
@@ -163,8 +163,8 @@
         ASSERT(decodedEntity.isEmpty());
         bufferCharacter('&');
     } else {
-        for (unsigned i = 0; i < decodedEntity.length(); ++i)
-            bufferCharacter(decodedEntity[i]);
+        for (unsigned i = 0; i < decodedEntity.length; ++i)
+            bufferCharacter(decodedEntity.data[i]);
     }
     return true;
 }
@@ -996,7 +996,7 @@
 
     HTML_BEGIN_STATE(CharacterReferenceInAttributeValueState) {
         bool notEnoughCharacters = false;
-        StringBuilder decodedEntity;
+        DecodedHTMLEntity decodedEntity;
         bool success = consumeHTMLEntity(source, decodedEntity, notEnoughCharacters, m_additionalAllowedCharacter);
         if (notEnoughCharacters)
             return haveBufferedCharacterToken();
@@ -1004,8 +1004,8 @@
             ASSERT(decodedEntity.isEmpty());
             m_token->appendToAttributeValue('&');
         } else {
-            for (unsigned i = 0; i < decodedEntity.length(); ++i)
-                m_token->appendToAttributeValue(decodedEntity[i]);
+            for (unsigned i = 0; i < decodedEntity.length; ++i)
+                m_token->appendToAttributeValue(decodedEntity.data[i]);
         }
         // We're supposed to switch back to the attribute value state that
         // we were in when we were switched into this state. Rather than
@@ -1072,9 +1072,9 @@
     END_STATE()
 
     HTML_BEGIN_STATE(MarkupDeclarationOpenState) {
-        DEFINE_STATIC_LOCAL(String, dashDashString, (ASCIILiteral("--")));
-        DEFINE_STATIC_LOCAL(String, doctypeString, (ASCIILiteral("doctype")));
-        DEFINE_STATIC_LOCAL(String, cdataString, (ASCIILiteral("[CDATA[")));
+        DEFINE_STATIC_LOCAL(String, dashDashString, ("--"));
+        DEFINE_STATIC_LOCAL(String, doctypeString, ("doctype"));
+        DEFINE_STATIC_LOCAL(String, cdataString, ("[CDATA["));
         if (cc == '-') {
             SegmentedString::LookAheadResult result = source.lookAhead(dashDashString);
             if (result == SegmentedString::DidMatch) {
@@ -1275,8 +1275,8 @@
             m_token->setForceQuirks();
             return emitAndReconsumeIn(source, HTMLTokenizer::DataState);
         } else {
-            DEFINE_STATIC_LOCAL(String, publicString, (ASCIILiteral("public")));
-            DEFINE_STATIC_LOCAL(String, systemString, (ASCIILiteral("system")));
+            DEFINE_STATIC_LOCAL(String, publicString, ("public"));
+            DEFINE_STATIC_LOCAL(String, systemString, ("system"));
             if (cc == 'P' || cc == 'p') {
                 SegmentedString::LookAheadResult result = source.lookAheadIgnoringCase(publicString);
                 if (result == SegmentedString::DidMatch) {
diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp
index 6f50091..47efdac 100644
--- a/Source/core/html/parser/XSSAuditor.cpp
+++ b/Source/core/html/parser/XSSAuditor.cpp
@@ -267,7 +267,7 @@
 
     String httpBodyAsString;
     if (DocumentLoader* documentLoader = document->frame()->loader()->documentLoader()) {
-        DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, (ASCIILiteral("X-XSS-Protection")));
+        DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection"));
         String headerValue = documentLoader->response().httpHeaderField(XSSProtectionHeader);
         String errorDetails;
         unsigned errorPosition = 0;
@@ -516,7 +516,7 @@
 
 bool XSSAuditor::eraseDangerousAttributesIfInjected(const FilterTokenRequest& request)
 {
-    DEFINE_STATIC_LOCAL(String, safeJavaScriptURL, (ASCIILiteral("javascript:void(0)")));
+    DEFINE_STATIC_LOCAL(String, safeJavaScriptURL, ("javascript:void(0)"));
 
     bool didBlockScript = false;
     for (size_t i = 0; i < request.token.attributes().size(); ++i) {
diff --git a/Source/core/html/shadow/ClearButtonElement.cpp b/Source/core/html/shadow/ClearButtonElement.cpp
index 3ac4628..c3eb8e9 100644
--- a/Source/core/html/shadow/ClearButtonElement.cpp
+++ b/Source/core/html/shadow/ClearButtonElement.cpp
@@ -46,7 +46,7 @@
 PassRefPtr<ClearButtonElement> ClearButtonElement::create(Document* document, ClearButtonOwner& clearButtonOwner)
 {
     RefPtr<ClearButtonElement> element = adoptRef(new ClearButtonElement(document, clearButtonOwner));
-    element->setPseudo(AtomicString("-webkit-clear-button", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-clear-button", AtomicString::ConstructFromLiteral));
     element->setAttribute(idAttr, ShadowElementNames::clearButton());
     return element.release();
 }
diff --git a/Source/core/html/shadow/DateTimeEditElement.cpp b/Source/core/html/shadow/DateTimeEditElement.cpp
index 0bc4369..a8e0222 100644
--- a/Source/core/html/shadow/DateTimeEditElement.cpp
+++ b/Source/core/html/shadow/DateTimeEditElement.cpp
@@ -403,7 +403,7 @@
     DEFINE_STATIC_LOCAL(AtomicString, textPseudoId, ("-webkit-datetime-edit-text", AtomicString::ConstructFromLiteral));
     ASSERT(text.length());
     RefPtr<HTMLDivElement> element = HTMLDivElement::create(m_editElement.document());
-    element->setPseudo(textPseudoId);
+    element->setPart(textPseudoId);
     if (m_parameters.locale.isRTL() && text.length()) {
         Direction dir = direction(text[0]);
         if (dir == SegmentSeparator || dir == WhiteSpaceNeutral || dir == OtherNeutral)
@@ -485,7 +485,7 @@
 PassRefPtr<DateTimeEditElement> DateTimeEditElement::create(Document* document, EditControlOwner& editControlOwner)
 {
     RefPtr<DateTimeEditElement> container = adoptRef(new DateTimeEditElement(document, editControlOwner));
-    container->setPseudo(AtomicString("-webkit-datetime-edit", AtomicString::ConstructFromLiteral));
+    container->setPart(AtomicString("-webkit-datetime-edit", AtomicString::ConstructFromLiteral));
     container->setAttribute(idAttr, ShadowElementNames::dateTimeEdit());
     return container.release();
 }
@@ -652,7 +652,7 @@
     DEFINE_STATIC_LOCAL(AtomicString, fieldsWrapperPseudoId, ("-webkit-datetime-edit-fields-wrapper", AtomicString::ConstructFromLiteral));
     if (!firstChild()) {
         RefPtr<HTMLDivElement> element = HTMLDivElement::create(document());
-        element->setPseudo(fieldsWrapperPseudoId);
+        element->setPart(fieldsWrapperPseudoId);
         appendChild(element.get(), ASSERT_NO_EXCEPTION, AttachLazily);
     }
     Element* fieldsWrapper = fieldsWrapperElement();
diff --git a/Source/core/html/shadow/DateTimeFieldElement.cpp b/Source/core/html/shadow/DateTimeFieldElement.cpp
index 8f266c0..d7ee1e3 100644
--- a/Source/core/html/shadow/DateTimeFieldElement.cpp
+++ b/Source/core/html/shadow/DateTimeFieldElement.cpp
@@ -153,7 +153,7 @@
     setAttribute(aria_valuemaxAttr, String::number(axMaximum));
 
     setAttribute(aria_helpAttr, axHelpText);
-    setPseudo(pseudo);
+    setPart(pseudo);
     appendChild(Text::create(document(), visibleValue()));
 }
 
diff --git a/Source/core/html/shadow/DateTimeFieldElements.cpp b/Source/core/html/shadow/DateTimeFieldElements.cpp
index 8a8a052..fda494d 100644
--- a/Source/core/html/shadow/DateTimeFieldElements.cpp
+++ b/Source/core/html/shadow/DateTimeFieldElements.cpp
@@ -79,7 +79,7 @@
 PassRefPtr<DateTimeDayFieldElement> DateTimeDayFieldElement::create(Document* document, FieldOwner& fieldOwner, const String& placeholder, const Range& range)
 {
     DEFINE_STATIC_LOCAL(AtomicString, dayPsuedoId, ("-webkit-datetime-edit-day-field", AtomicString::ConstructFromLiteral));
-    RefPtr<DateTimeDayFieldElement> field = adoptRef(new DateTimeDayFieldElement(document, fieldOwner, placeholder.isEmpty() ? ASCIILiteral("--") : placeholder, range));
+    RefPtr<DateTimeDayFieldElement> field = adoptRef(new DateTimeDayFieldElement(document, fieldOwner, placeholder.isEmpty() ? "--" : placeholder, range));
     field->initialize(dayPsuedoId, AXDayOfMonthFieldText());
     return field.release();
 }
@@ -405,7 +405,7 @@
 PassRefPtr<DateTimeMonthFieldElement> DateTimeMonthFieldElement::create(Document* document, FieldOwner& fieldOwner, const String& placeholder, const Range& range)
 {
     DEFINE_STATIC_LOCAL(AtomicString, monthPsuedoId, ("-webkit-datetime-edit-month-field", AtomicString::ConstructFromLiteral));
-    RefPtr<DateTimeMonthFieldElement> field = adoptRef(new DateTimeMonthFieldElement(document, fieldOwner, placeholder.isEmpty() ? ASCIILiteral("--") : placeholder, range));
+    RefPtr<DateTimeMonthFieldElement> field = adoptRef(new DateTimeMonthFieldElement(document, fieldOwner, placeholder.isEmpty() ? "--" : placeholder, range));
     field->initialize(monthPsuedoId, AXMonthFieldText());
     return field.release();
 }
@@ -565,7 +565,7 @@
 // ----------------------------
 
 DateTimeYearFieldElement::DateTimeYearFieldElement(Document* document, FieldOwner& fieldOwner, const DateTimeYearFieldElement::Parameters& parameters)
-    : DateTimeNumericFieldElement(document, fieldOwner, Range(parameters.minimumYear, parameters.maximumYear), Range(DateComponents::minimumYear(), DateComponents::maximumYear()), parameters.placeholder.isEmpty() ? ASCIILiteral("----") : parameters.placeholder)
+    : DateTimeNumericFieldElement(document, fieldOwner, Range(parameters.minimumYear, parameters.maximumYear), Range(DateComponents::minimumYear(), DateComponents::maximumYear()), parameters.placeholder.isEmpty() ? "----" : parameters.placeholder)
     , m_minIsSpecified(parameters.minIsSpecified)
     , m_maxIsSpecified(parameters.maxIsSpecified)
 {
diff --git a/Source/core/html/shadow/DetailsMarkerControl.h b/Source/core/html/shadow/DetailsMarkerControl.h
index 0971195..1b1bf04 100644
--- a/Source/core/html/shadow/DetailsMarkerControl.h
+++ b/Source/core/html/shadow/DetailsMarkerControl.h
@@ -53,7 +53,7 @@
 inline PassRefPtr<DetailsMarkerControl> DetailsMarkerControl::create(Document* document)
 {
     RefPtr<DetailsMarkerControl> element = adoptRef(new DetailsMarkerControl(document));
-    element->setPseudo(AtomicString("-webkit-details-marker", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-details-marker", AtomicString::ConstructFromLiteral));
     return element.release();
 }
 
diff --git a/Source/core/html/shadow/HTMLContentElement.cpp b/Source/core/html/shadow/HTMLContentElement.cpp
index 385b090..b2e81f6 100644
--- a/Source/core/html/shadow/HTMLContentElement.cpp
+++ b/Source/core/html/shadow/HTMLContentElement.cpp
@@ -87,74 +87,6 @@
         InsertionPoint::parseAttribute(name, value);
 }
 
-static bool validateSubSelector(const CSSSelector* selector)
-{
-    switch (selector->m_match) {
-    case CSSSelector::Tag:
-    case CSSSelector::Id:
-    case CSSSelector::Class:
-    case CSSSelector::Exact:
-    case CSSSelector::Set:
-    case CSSSelector::List:
-    case CSSSelector::Hyphen:
-    case CSSSelector::Contain:
-    case CSSSelector::Begin:
-    case CSSSelector::End:
-        return true;
-    case CSSSelector::PseudoElement:
-        return false;
-    case CSSSelector::PagePseudoClass:
-    case CSSSelector::PseudoClass:
-        break;
-    }
-
-    switch (selector->pseudoType()) {
-    case CSSSelector::PseudoEmpty:
-    case CSSSelector::PseudoLink:
-    case CSSSelector::PseudoVisited:
-    case CSSSelector::PseudoTarget:
-    case CSSSelector::PseudoEnabled:
-    case CSSSelector::PseudoDisabled:
-    case CSSSelector::PseudoChecked:
-    case CSSSelector::PseudoIndeterminate:
-    case CSSSelector::PseudoNthChild:
-    case CSSSelector::PseudoNthLastChild:
-    case CSSSelector::PseudoNthOfType:
-    case CSSSelector::PseudoNthLastOfType:
-    case CSSSelector::PseudoFirstChild:
-    case CSSSelector::PseudoLastChild:
-    case CSSSelector::PseudoFirstOfType:
-    case CSSSelector::PseudoLastOfType:
-    case CSSSelector::PseudoOnlyOfType:
-        return true;
-    default:
-        return false;
-    }
-}
-
-static bool validateSelector(const CSSSelector* selector)
-{
-    ASSERT(selector);
-
-    if (!validateSubSelector(selector))
-        return false;
-
-    const CSSSelector* prevSubSelector = selector;
-    const CSSSelector* subSelector = selector->tagHistory();
-
-    while (subSelector) {
-        if (prevSubSelector->relation() != CSSSelector::SubSelector)
-            return false;
-        if (!validateSubSelector(subSelector))
-            return false;
-
-        prevSubSelector = subSelector;
-        subSelector = subSelector->tagHistory();
-    }
-
-    return true;
-}
-
 bool HTMLContentElement::validateSelect() const
 {
     ASSERT(!m_shouldParseSelect);
@@ -166,7 +98,7 @@
         return false;
 
     for (const CSSSelector* selector = m_selectorList.first(); selector; selector = m_selectorList.next(selector)) {
-        if (!validateSelector(selector))
+        if (!selector->isCompound())
             return false;
     }
 
@@ -193,4 +125,3 @@
 }
 
 }
-
diff --git a/Source/core/html/shadow/MediaControlElementTypes.h b/Source/core/html/shadow/MediaControlElementTypes.h
index 5a3fde8..fb53447 100644
--- a/Source/core/html/shadow/MediaControlElementTypes.h
+++ b/Source/core/html/shadow/MediaControlElementTypes.h
@@ -84,7 +84,7 @@
     virtual bool isShowing() const;
 
     virtual MediaControlElementType displayType() { return m_displayType; }
-    virtual const AtomicString& shadowPseudoId() const = 0;
+    virtual const AtomicString& part() const = 0;
 
     virtual void setMediaController(MediaControllerInterface* controller) { m_mediaController = controller; }
     virtual MediaControllerInterface* mediaController() const { return m_mediaController; }
diff --git a/Source/core/html/shadow/MediaControlElements.cpp b/Source/core/html/shadow/MediaControlElements.cpp
index 3a936fc..9167b9c 100644
--- a/Source/core/html/shadow/MediaControlElements.cpp
+++ b/Source/core/html/shadow/MediaControlElements.cpp
@@ -38,6 +38,7 @@
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/shadow/MediaControls.h"
 #include "core/html/track/TextTrack.h"
+#include "core/html/track/TextTrackRegionList.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Frame.h"
 #include "core/page/Page.h"
@@ -71,7 +72,7 @@
     return adoptRef(new MediaControlPanelElement(document));
 }
 
-const AtomicString& MediaControlPanelElement::shadowPseudoId() const
+const AtomicString& MediaControlPanelElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-panel", AtomicString::ConstructFromLiteral));
     return id;
@@ -258,7 +259,7 @@
     return adoptRef(new MediaControlPanelEnclosureElement(document));
 }
 
-const AtomicString& MediaControlPanelEnclosureElement::shadowPseudoId() const
+const AtomicString& MediaControlPanelEnclosureElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-enclosure", AtomicString::ConstructFromLiteral));
     return id;
@@ -277,7 +278,7 @@
     return adoptRef(new MediaControlOverlayEnclosureElement(document));
 }
 
-const AtomicString& MediaControlOverlayEnclosureElement::shadowPseudoId() const
+const AtomicString& MediaControlOverlayEnclosureElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-overlay-enclosure", AtomicString::ConstructFromLiteral));
     return id;
@@ -309,7 +310,7 @@
     MediaControlMuteButtonElement::defaultEventHandler(event);
 }
 
-const AtomicString& MediaControlPanelMuteButtonElement::shadowPseudoId() const
+const AtomicString& MediaControlPanelMuteButtonElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-mute-button", AtomicString::ConstructFromLiteral));
     return id;
@@ -330,7 +331,7 @@
     return button.release();
 }
 
-const AtomicString& MediaControlVolumeSliderMuteButtonElement::shadowPseudoId() const
+const AtomicString& MediaControlVolumeSliderMuteButtonElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-volume-slider-mute-button", AtomicString::ConstructFromLiteral));
     return id;
@@ -369,7 +370,7 @@
     setDisplayType(mediaController()->canPlay() ? MediaPlayButton : MediaPauseButton);
 }
 
-const AtomicString& MediaControlPlayButtonElement::shadowPseudoId() const
+const AtomicString& MediaControlPlayButtonElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-play-button", AtomicString::ConstructFromLiteral));
     return id;
@@ -408,7 +409,7 @@
         hide();
 }
 
-const AtomicString& MediaControlOverlayPlayButtonElement::shadowPseudoId() const
+const AtomicString& MediaControlOverlayPlayButtonElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-overlay-play-button", AtomicString::ConstructFromLiteral));
     return id;
@@ -453,7 +454,7 @@
     HTMLInputElement::defaultEventHandler(event);
 }
 
-const AtomicString& MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId() const
+const AtomicString& MediaControlToggleClosedCaptionsButtonElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-toggle-closed-captions-button", AtomicString::ConstructFromLiteral));
     return id;
@@ -526,7 +527,7 @@
 }
 
 
-const AtomicString& MediaControlTimelineElement::shadowPseudoId() const
+const AtomicString& MediaControlTimelineElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-timeline", AtomicString::ConstructFromLiteral));
     return id;
@@ -549,7 +550,7 @@
     return slider.release();
 }
 
-const AtomicString& MediaControlPanelVolumeSliderElement::shadowPseudoId() const
+const AtomicString& MediaControlPanelVolumeSliderElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-volume-slider", AtomicString::ConstructFromLiteral));
     return id;
@@ -591,7 +592,7 @@
     HTMLInputElement::defaultEventHandler(event);
 }
 
-const AtomicString& MediaControlFullscreenButtonElement::shadowPseudoId() const
+const AtomicString& MediaControlFullscreenButtonElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-button", AtomicString::ConstructFromLiteral));
     return id;
@@ -620,7 +621,7 @@
     return id;
 }
 
-const AtomicString& MediaControlTimeRemainingDisplayElement::shadowPseudoId() const
+const AtomicString& MediaControlTimeRemainingDisplayElement::part() const
 {
     return getMediaControlTimeRemainingDisplayElementShadowPseudoId();
 }
@@ -643,7 +644,7 @@
     return id;
 }
 
-const AtomicString& MediaControlCurrentTimeDisplayElement::shadowPseudoId() const
+const AtomicString& MediaControlCurrentTimeDisplayElement::part() const
 {
     return getMediaControlCurrentTimeDisplayElementShadowPseudoId();
 }
@@ -674,7 +675,7 @@
     return id;
 }
 
-const AtomicString& MediaControlTextTrackContainerElement::shadowPseudoId() const
+const AtomicString& MediaControlTextTrackContainerElement::part() const
 {
     return textTrackContainerElementShadowPseudoId();
 }
diff --git a/Source/core/html/shadow/MediaControlElements.h b/Source/core/html/shadow/MediaControlElements.h
index 712ccbb..168ab29 100644
--- a/Source/core/html/shadow/MediaControlElements.h
+++ b/Source/core/html/shadow/MediaControlElements.h
@@ -53,7 +53,7 @@
 private:
     explicit MediaControlPanelElement(Document*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 
     void startDrag(const LayoutPoint& eventLocation);
@@ -84,7 +84,7 @@
 
 private:
     explicit MediaControlPanelEnclosureElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 };
 
 // ----------------------------
@@ -95,7 +95,7 @@
 
 private:
     explicit MediaControlOverlayEnclosureElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 };
 
 // ----------------------------
@@ -109,7 +109,7 @@
 private:
     explicit MediaControlPanelMuteButtonElement(Document*, MediaControls*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 
     MediaControls* m_controls;
@@ -123,7 +123,7 @@
 
 private:
     explicit MediaControlVolumeSliderMuteButtonElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 };
 
 
@@ -139,7 +139,7 @@
 private:
     explicit MediaControlPlayButtonElement(Document*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 };
 
@@ -154,7 +154,7 @@
 private:
     explicit MediaControlOverlayPlayButtonElement(Document*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 };
 
@@ -171,7 +171,7 @@
 private:
     explicit MediaControlToggleClosedCaptionsButtonElement(Document*, MediaControls*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 };
 
@@ -189,7 +189,7 @@
 private:
     explicit MediaControlTimelineElement(Document*, MediaControls*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 
     MediaControls* m_controls;
@@ -208,7 +208,7 @@
 private:
     explicit MediaControlFullscreenButtonElement(Document*);
 
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 };
 
@@ -220,7 +220,7 @@
 
 private:
     explicit MediaControlPanelVolumeSliderElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 };
 
 // ----------------------------
@@ -231,7 +231,7 @@
 
 private:
     explicit MediaControlTimeRemainingDisplayElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 };
 
 // ----------------------------
@@ -242,7 +242,7 @@
 
 private:
     explicit MediaControlCurrentTimeDisplayElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 };
 
 // ----------------------------
@@ -257,7 +257,7 @@
 
 private:
     explicit MediaControlTextTrackContainerElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    virtual const AtomicString& part() const OVERRIDE;
 
     virtual RenderObject* createRenderer(RenderStyle*);
 
diff --git a/Source/core/html/shadow/MediaControls.cpp b/Source/core/html/shadow/MediaControls.cpp
index e562a0e..d14e0c5 100644
--- a/Source/core/html/shadow/MediaControls.cpp
+++ b/Source/core/html/shadow/MediaControls.cpp
@@ -331,7 +331,7 @@
     m_hideFullscreenControlsTimer.stop();
 }
 
-const AtomicString& MediaControls::shadowPseudoId() const
+const AtomicString& MediaControls::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls"));
     return id;
diff --git a/Source/core/html/shadow/MediaControls.h b/Source/core/html/shadow/MediaControls.h
index cb65516..130d03c 100644
--- a/Source/core/html/shadow/MediaControls.h
+++ b/Source/core/html/shadow/MediaControls.h
@@ -125,7 +125,7 @@
 private:
     virtual bool isMediaControls() const { return true; }
 
-    virtual const AtomicString& shadowPseudoId() const;
+    virtual const AtomicString& part() const;
 };
 
 inline MediaControls* toMediaControls(Node* node)
diff --git a/Source/core/html/shadow/MeterShadowElement.cpp b/Source/core/html/shadow/MeterShadowElement.cpp
index 5c9fca5..f92d449 100644
--- a/Source/core/html/shadow/MeterShadowElement.cpp
+++ b/Source/core/html/shadow/MeterShadowElement.cpp
@@ -66,7 +66,7 @@
 PassRefPtr<MeterInnerElement> MeterInnerElement::create(Document* document)
 {
     RefPtr<MeterInnerElement> element = adoptRef(new MeterInnerElement(document));
-    element->setPseudo(AtomicString("-webkit-meter-inner-element", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-meter-inner-element", AtomicString::ConstructFromLiteral));
     return element.release();
 }
 
@@ -92,7 +92,7 @@
 PassRefPtr<MeterBarElement> MeterBarElement::create(Document* document)
 {
     RefPtr<MeterBarElement> element = adoptRef(new MeterBarElement(document));
-    element->setPseudo(AtomicString("-webkit-meter-bar", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-meter-bar", AtomicString::ConstructFromLiteral));
     return element.release();
 }
 
diff --git a/Source/core/html/shadow/MeterShadowElement.h b/Source/core/html/shadow/MeterShadowElement.h
index 381c74e..a314267 100644
--- a/Source/core/html/shadow/MeterShadowElement.h
+++ b/Source/core/html/shadow/MeterShadowElement.h
@@ -70,7 +70,7 @@
 public:
     static PassRefPtr<MeterValueElement> create(Document*);
     void setWidthPercentage(double);
-    void updatePseudo() { setPseudo(valuePseudoId()); }
+    void updatePseudo() { setPart(valuePseudoId()); }
 
 private:
     MeterValueElement(Document*);
diff --git a/Source/core/html/shadow/PasswordGeneratorButtonElement.cpp b/Source/core/html/shadow/PasswordGeneratorButtonElement.cpp
index 821c4d3..81b52fb 100644
--- a/Source/core/html/shadow/PasswordGeneratorButtonElement.cpp
+++ b/Source/core/html/shadow/PasswordGeneratorButtonElement.cpp
@@ -39,7 +39,7 @@
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/shadow/HTMLShadowElement.h"
-#include "core/loader/cache/CachedImage.h"
+#include "core/loader/cache/ImageResource.h"
 #include "core/page/Chrome.h"
 #include "core/page/ChromeClient.h"
 #include "core/page/Page.h"
@@ -112,9 +112,9 @@
     if (!renderer() || !renderer()->isImage())
         return;
     RenderImageResource* resource = toRenderImage(renderer())->imageResource();
-    CachedImage* image = m_isInHoverState ? imageForHoverState() : imageForNormalState();
+    ImageResource* image = m_isInHoverState ? imageForHoverState() : imageForNormalState();
     ASSERT(image);
-    resource->setCachedImage(image);
+    resource->setImageResource(image);
 }
 
 PassRefPtr<RenderStyle> PasswordGeneratorButtonElement::customStyleForRenderer()
@@ -142,20 +142,20 @@
     updateImage();
 }
 
-CachedImage* PasswordGeneratorButtonElement::imageForNormalState()
+ImageResource* PasswordGeneratorButtonElement::imageForNormalState()
 {
     if (!m_cachedImageForNormalState) {
         RefPtr<Image> image = Image::loadPlatformResource("generatePassword");
-        m_cachedImageForNormalState = new CachedImage(image.get());
+        m_cachedImageForNormalState = new ImageResource(image.get());
     }
     return m_cachedImageForNormalState.get();
 }
 
-CachedImage* PasswordGeneratorButtonElement::imageForHoverState()
+ImageResource* PasswordGeneratorButtonElement::imageForHoverState()
 {
     if (!m_cachedImageForHoverState) {
         RefPtr<Image> image = Image::loadPlatformResource("generatePasswordHover");
-        m_cachedImageForHoverState = new CachedImage(image.get());
+        m_cachedImageForHoverState = new ImageResource(image.get());
     }
     return m_cachedImageForHoverState.get();
 }
diff --git a/Source/core/html/shadow/PasswordGeneratorButtonElement.h b/Source/core/html/shadow/PasswordGeneratorButtonElement.h
index b9f654f..2032034 100644
--- a/Source/core/html/shadow/PasswordGeneratorButtonElement.h
+++ b/Source/core/html/shadow/PasswordGeneratorButtonElement.h
@@ -36,7 +36,7 @@
 
 namespace WebCore {
 
-class CachedImage;
+class ImageResource;
 class HTMLInputElement;
 class ShadowRoot;
 
@@ -61,14 +61,14 @@
     virtual bool isMouseFocusable() const OVERRIDE { return false; }
     virtual void defaultEventHandler(Event*) OVERRIDE;
 
-    CachedImage* imageForNormalState();
-    CachedImage* imageForHoverState();
+    ImageResource* imageForNormalState();
+    ImageResource* imageForHoverState();
 
     HTMLInputElement* hostInput();
     void updateImage();
 
-    ResourcePtr<CachedImage> m_cachedImageForNormalState;
-    ResourcePtr<CachedImage> m_cachedImageForHoverState;
+    ResourcePtr<ImageResource> m_cachedImageForNormalState;
+    ResourcePtr<ImageResource> m_cachedImageForHoverState;
     bool m_isInHoverState;
 };
 
diff --git a/Source/core/html/shadow/PickerIndicatorElement.cpp b/Source/core/html/shadow/PickerIndicatorElement.cpp
index 96b4b5e..6fbb1cf 100644
--- a/Source/core/html/shadow/PickerIndicatorElement.cpp
+++ b/Source/core/html/shadow/PickerIndicatorElement.cpp
@@ -53,7 +53,7 @@
 PassRefPtr<PickerIndicatorElement> PickerIndicatorElement::create(Document* document, PickerIndicatorOwner& pickerIndicatorOwner)
 {
     RefPtr<PickerIndicatorElement> element = adoptRef(new PickerIndicatorElement(document, pickerIndicatorOwner));
-    element->setPseudo(AtomicString("-webkit-calendar-picker-indicator", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-calendar-picker-indicator", AtomicString::ConstructFromLiteral));
     element->setAttribute(idAttr, ShadowElementNames::pickerIndicator());
     return element.release();
 }
diff --git a/Source/core/html/shadow/ProgressShadowElement.cpp b/Source/core/html/shadow/ProgressShadowElement.cpp
index 7720f2f..c1bc2b7 100644
--- a/Source/core/html/shadow/ProgressShadowElement.cpp
+++ b/Source/core/html/shadow/ProgressShadowElement.cpp
@@ -60,13 +60,13 @@
     : ProgressShadowElement(document)
 {
     DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));
-    setPseudo(pseudoId);
+    setPart(pseudoId);
 }
 
 PassRefPtr<ProgressInnerElement> ProgressInnerElement::create(Document* document)
 {
     RefPtr<ProgressInnerElement> element = adoptRef(new ProgressInnerElement(document));
-    element->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));
     return element.release();
 }
 
diff --git a/Source/core/html/shadow/ProgressShadowElement.h b/Source/core/html/shadow/ProgressShadowElement.h
index b46a55a..8e02bdc 100644
--- a/Source/core/html/shadow/ProgressShadowElement.h
+++ b/Source/core/html/shadow/ProgressShadowElement.h
@@ -64,7 +64,7 @@
         : ProgressShadowElement(document)
     {
         DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-progress-bar", AtomicString::ConstructFromLiteral));
-        setPseudo(pseudoId);
+        setPart(pseudoId);
     }
 
     static PassRefPtr<ProgressBarElement> create(Document*);
@@ -81,7 +81,7 @@
         : ProgressShadowElement(document)
     {
         DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-progress-value", AtomicString::ConstructFromLiteral));
-        setPseudo(pseudoId);
+        setPart(pseudoId);
     }
 
     static PassRefPtr<ProgressValueElement> create(Document*);
diff --git a/Source/core/html/shadow/ShadowElementNames.cpp b/Source/core/html/shadow/ShadowElementNames.cpp
index 010474a..238be25 100644
--- a/Source/core/html/shadow/ShadowElementNames.cpp
+++ b/Source/core/html/shadow/ShadowElementNames.cpp
@@ -59,6 +59,12 @@
     return name;
 }
 
+const AtomicString& searchDecoration()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("decoration", AtomicString::ConstructFromLiteral));
+    return name;
+}
+
 }
 
 }
diff --git a/Source/core/html/shadow/ShadowElementNames.h b/Source/core/html/shadow/ShadowElementNames.h
index 8198ec0..ed2f49c 100644
--- a/Source/core/html/shadow/ShadowElementNames.h
+++ b/Source/core/html/shadow/ShadowElementNames.h
@@ -41,6 +41,7 @@
 const AtomicString& spinButton();
 const AtomicString& clearButton();
 const AtomicString& pickerIndicator();
+const AtomicString& searchDecoration();
 
 }
 
diff --git a/Source/core/html/shadow/SliderThumbElement.cpp b/Source/core/html/shadow/SliderThumbElement.cpp
index e444df4..178307d 100644
--- a/Source/core/html/shadow/SliderThumbElement.cpp
+++ b/Source/core/html/shadow/SliderThumbElement.cpp
@@ -176,7 +176,7 @@
     // Force a layout to reset the position of the thumb so the code below doesn't move the thumb to the wrong place.
     // FIXME: Make a custom Render class for the track and move the thumb positioning code there.
     if (track)
-        track->setChildNeedsLayout(true, MarkOnlyThis);
+        track->setChildNeedsLayout(MarkOnlyThis);
 
     RenderFlexibleBox::layout();
 
@@ -216,7 +216,7 @@
     // path, we don't actually update the value here. Instead, we poke at the
     // renderer directly to trigger layout.
     if (renderer())
-        renderer()->setNeedsLayout(true);
+        renderer()->setNeedsLayout();
 }
 
 RenderObject* SliderThumbElement::createRenderer(RenderStyle*)
@@ -252,15 +252,15 @@
 
 void SliderThumbElement::setPositionFromPoint(const LayoutPoint& point)
 {
-    HTMLInputElement* input = hostInput();
-    HTMLElement* trackElement = sliderTrackElementOf(input);
+    RefPtr<HTMLInputElement> input(hostInput());
+    HTMLElement* trackElement = sliderTrackElementOf(input.get());
 
     if (!input->renderer() || !renderBox() || !trackElement->renderBox())
         return;
 
     input->setTextAsOfLastFormControlChangeEvent(input->value());
     LayoutPoint offset = roundedLayoutPoint(input->renderer()->absoluteToLocal(point, UseTransforms));
-    bool isVertical = hasVerticalAppearance(input);
+    bool isVertical = hasVerticalAppearance(input.get());
     bool isLeftToRightDirection = renderBox()->style()->isLeftToRightDirection();
     LayoutUnit trackSize;
     LayoutUnit position;
@@ -307,7 +307,8 @@
 
     // FIXME: This is no longer being set from renderer. Consider updating the method name.
     input->setValueFromRenderer(valueString);
-    renderer()->setNeedsLayout(true);
+    if (renderer())
+        renderer()->setNeedsLayout();
     input->dispatchFormControlChangeEvent();
 }
 
@@ -328,7 +329,7 @@
         frame->eventHandler()->setCapturingMouseEventsNode(0);
     m_inDragMode = false;
     if (renderer())
-        renderer()->setNeedsLayout(true);
+        renderer()->setNeedsLayout();
 }
 
 void SliderThumbElement::defaultEventHandler(Event* event)
@@ -403,23 +404,23 @@
     return toHTMLInputElement(shadowHost());
 }
 
-static const AtomicString& sliderThumbShadowPseudoId()
+static const AtomicString& sliderThumbShadowPartId()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, sliderThumb, ("-webkit-slider-thumb", AtomicString::ConstructFromLiteral));
     return sliderThumb;
 }
 
-static const AtomicString& mediaSliderThumbShadowPseudoId()
+static const AtomicString& mediaSliderThumbShadowPartId()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, mediaSliderThumb, ("-webkit-media-slider-thumb", AtomicString::ConstructFromLiteral));
     return mediaSliderThumb;
 }
 
-const AtomicString& SliderThumbElement::shadowPseudoId() const
+const AtomicString& SliderThumbElement::part() const
 {
     HTMLInputElement* input = hostInput();
     if (!input)
-        return sliderThumbShadowPseudoId();
+        return sliderThumbShadowPartId();
 
     RenderStyle* sliderStyle = input->renderer()->style();
     switch (sliderStyle->appearance()) {
@@ -429,9 +430,9 @@
     case MediaVolumeSliderThumbPart:
     case MediaFullScreenVolumeSliderPart:
     case MediaFullScreenVolumeSliderThumbPart:
-        return mediaSliderThumbShadowPseudoId();
+        return mediaSliderThumbShadowPartId();
     default:
-        return sliderThumbShadowPseudoId();
+        return sliderThumbShadowPartId();
     }
 }
 
@@ -452,7 +453,7 @@
     return new RenderSliderContainer(this);
 }
 
-const AtomicString& SliderContainerElement::shadowPseudoId() const
+const AtomicString& SliderContainerElement::part() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, mediaSliderContainer, ("-webkit-media-slider-container", AtomicString::ConstructFromLiteral));
     DEFINE_STATIC_LOCAL(const AtomicString, sliderContainer, ("-webkit-slider-container", AtomicString::ConstructFromLiteral));
diff --git a/Source/core/html/shadow/SliderThumbElement.h b/Source/core/html/shadow/SliderThumbElement.h
index e6ddcf7..585c1d6 100644
--- a/Source/core/html/shadow/SliderThumbElement.h
+++ b/Source/core/html/shadow/SliderThumbElement.h
@@ -55,7 +55,7 @@
     virtual bool willRespondToMouseMoveEvents() OVERRIDE;
     virtual bool willRespondToMouseClickEvents() OVERRIDE;
     virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
-    virtual const AtomicString& shadowPseudoId() const;
+    virtual const AtomicString& part() const OVERRIDE;
     HTMLInputElement* hostInput() const;
     void setPositionFromPoint(const LayoutPoint&);
 
@@ -120,7 +120,7 @@
 private:
     SliderContainerElement(Document*);
     virtual RenderObject* createRenderer(RenderStyle*);
-    virtual const AtomicString& shadowPseudoId() const;
+    virtual const AtomicString& part() const;
 };
 
 }
diff --git a/Source/core/html/shadow/SpinButtonElement.cpp b/Source/core/html/shadow/SpinButtonElement.cpp
index 77a7c75..998f1d4 100644
--- a/Source/core/html/shadow/SpinButtonElement.cpp
+++ b/Source/core/html/shadow/SpinButtonElement.cpp
@@ -56,7 +56,7 @@
 PassRefPtr<SpinButtonElement> SpinButtonElement::create(Document* document, SpinButtonOwner& spinButtonOwner)
 {
     RefPtr<SpinButtonElement> element = adoptRef(new SpinButtonElement(document, spinButtonOwner));
-    element->setPseudo(AtomicString("-webkit-inner-spin-button", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-inner-spin-button", AtomicString::ConstructFromLiteral));
     element->setAttribute(idAttr, ShadowElementNames::spinButton());
     return element.release();
 }
diff --git a/Source/core/html/shadow/TextControlInnerElements.cpp b/Source/core/html/shadow/TextControlInnerElements.cpp
index 367c9bd..b1ff5c1 100644
--- a/Source/core/html/shadow/TextControlInnerElements.cpp
+++ b/Source/core/html/shadow/TextControlInnerElements.cpp
@@ -35,6 +35,7 @@
 #include "core/dom/TextEvent.h"
 #include "core/dom/TextEventInputType.h"
 #include "core/html/HTMLInputElement.h"
+#include "core/html/shadow/ShadowElementNames.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Frame.h"
 #include "core/page/SpeechInput.h"
@@ -131,10 +132,12 @@
 
 PassRefPtr<SearchFieldDecorationElement> SearchFieldDecorationElement::create(Document* document)
 {
-    return adoptRef(new SearchFieldDecorationElement(document));
+    RefPtr<SearchFieldDecorationElement> element = adoptRef(new SearchFieldDecorationElement(document));
+    element->setAttribute(idAttr, ShadowElementNames::searchDecoration());
+    return element.release();
 }
 
-const AtomicString& SearchFieldDecorationElement::shadowPseudoId() const
+const AtomicString& SearchFieldDecorationElement::part() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, resultsDecorationId, ("-webkit-search-results-decoration", AtomicString::ConstructFromLiteral));
     DEFINE_STATIC_LOCAL(AtomicString, decorationId, ("-webkit-search-decoration", AtomicString::ConstructFromLiteral));
@@ -180,7 +183,8 @@
 PassRefPtr<SearchFieldCancelButtonElement> SearchFieldCancelButtonElement::create(Document* document)
 {
     RefPtr<SearchFieldCancelButtonElement> element = adoptRef(new SearchFieldCancelButtonElement(document));
-    element->setPseudo(AtomicString("-webkit-search-cancel-button", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-search-cancel-button", AtomicString::ConstructFromLiteral));
+    element->setAttribute(idAttr, ShadowElementNames::clearButton());
     return element.release();
 }
 
@@ -268,7 +272,7 @@
 PassRefPtr<InputFieldSpeechButtonElement> InputFieldSpeechButtonElement::create(Document* document)
 {
     RefPtr<InputFieldSpeechButtonElement> element = adoptRef(new InputFieldSpeechButtonElement(document));
-    element->setPseudo(AtomicString("-webkit-input-speech-button", AtomicString::ConstructFromLiteral));
+    element->setPart(AtomicString("-webkit-input-speech-button", AtomicString::ConstructFromLiteral));
     return element.release();
 }
 
diff --git a/Source/core/html/shadow/TextControlInnerElements.h b/Source/core/html/shadow/TextControlInnerElements.h
index f3f6a8c..955b8f2 100644
--- a/Source/core/html/shadow/TextControlInnerElements.h
+++ b/Source/core/html/shadow/TextControlInnerElements.h
@@ -77,7 +77,7 @@
 
 private:
     SearchFieldDecorationElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const;
+    virtual const AtomicString& part() const OVERRIDE;
     virtual bool supportsFocus() const OVERRIDE { return false; }
 };
 
diff --git a/Source/core/html/track/InbandTextTrack.cpp b/Source/core/html/track/InbandTextTrack.cpp
index b33f087..b1076d4 100644
--- a/Source/core/html/track/InbandTextTrack.cpp
+++ b/Source/core/html/track/InbandTextTrack.cpp
@@ -162,11 +162,11 @@
         cue->setForegroundColor(cueData->foregroundColor().rgb());
 
     if (cueData->align() == GenericCueData::Start)
-        cue->setAlign(ASCIILiteral("start"), IGNORE_EXCEPTION);
+        cue->setAlign("start", IGNORE_EXCEPTION);
     else if (cueData->align() == GenericCueData::Middle)
-        cue->setAlign(ASCIILiteral("middle"), IGNORE_EXCEPTION);
+        cue->setAlign("middle", IGNORE_EXCEPTION);
     else if (cueData->align() == GenericCueData::End)
-        cue->setAlign(ASCIILiteral("end"), IGNORE_EXCEPTION);
+        cue->setAlign("end", IGNORE_EXCEPTION);
     cue->setSnapToLines(false);
 
     if (hasCue(cue.get())) {
diff --git a/Source/core/html/track/LoadableTextTrack.cpp b/Source/core/html/track/LoadableTextTrack.cpp
index 30b0c53..51c9722 100644
--- a/Source/core/html/track/LoadableTextTrack.cpp
+++ b/Source/core/html/track/LoadableTextTrack.cpp
@@ -29,6 +29,7 @@
 
 #include "core/html/HTMLTrackElement.h"
 #include "core/html/track/TextTrackCueList.h"
+#include "core/html/track/TextTrackRegionList.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/track/TextTrack.cpp b/Source/core/html/track/TextTrack.cpp
index 6827910..6a392ef 100644
--- a/Source/core/html/track/TextTrack.cpp
+++ b/Source/core/html/track/TextTrack.cpp
@@ -339,7 +339,7 @@
     regionList->add(region);
 }
 
-void TextTrack::removeRegion(TextTrackRegion* region, ExceptionCode &es)
+void TextTrack::removeRegion(TextTrackRegion* region, ExceptionState &es)
 {
     if (!region)
         return;
diff --git a/Source/core/html/track/TextTrack.idl b/Source/core/html/track/TextTrack.idl
index 8b2e8aa..36e19d9 100644
--- a/Source/core/html/track/TextTrack.idl
+++ b/Source/core/html/track/TextTrack.idl
@@ -34,7 +34,7 @@
 
     readonly attribute TextTrackCueList cues;
     readonly attribute TextTrackCueList activeCues;
-             attribute EventListener oncuechange;
+             attribute EventHandler oncuechange;
 
     void addCue(TextTrackCue cue);
     [RaisesException] void removeCue(TextTrackCue cue);
diff --git a/Source/core/html/track/TextTrackCue.cpp b/Source/core/html/track/TextTrackCue.cpp
index 1e6c5e2..7c42af0 100644
--- a/Source/core/html/track/TextTrackCue.cpp
+++ b/Source/core/html/track/TextTrackCue.cpp
@@ -42,6 +42,7 @@
 #include "core/html/HTMLDivElement.h"
 #include "core/html/track/TextTrack.h"
 #include "core/html/track/TextTrackCueList.h"
+#include "core/html/track/TextTrackRegionList.h"
 #include "core/html/track/WebVTTElement.h"
 #include "core/html/track/WebVTTParser.h"
 #include "core/rendering/RenderTextTrackCue.h"
@@ -56,19 +57,19 @@
 
 static const String& startKeyword()
 {
-    DEFINE_STATIC_LOCAL(const String, start, (ASCIILiteral("start")));
+    DEFINE_STATIC_LOCAL(const String, start, ("start"));
     return start;
 }
 
 static const String& middleKeyword()
 {
-    DEFINE_STATIC_LOCAL(const String, middle, (ASCIILiteral("middle")));
+    DEFINE_STATIC_LOCAL(const String, middle, ("middle"));
     return middle;
 }
 
 static const String& endKeyword()
 {
-    DEFINE_STATIC_LOCAL(const String, end, (ASCIILiteral("end")));
+    DEFINE_STATIC_LOCAL(const String, end, ("end"));
     return end;
 }
 
@@ -79,13 +80,13 @@
 
 static const String& verticalGrowingLeftKeyword()
 {
-    DEFINE_STATIC_LOCAL(const String, verticalrl, (ASCIILiteral("rl")));
+    DEFINE_STATIC_LOCAL(const String, verticalrl, ("rl"));
     return verticalrl;
 }
 
 static const String& verticalGrowingRightKeyword()
 {
-    DEFINE_STATIC_LOCAL(const String, verticallr, (ASCIILiteral("lr")));
+    DEFINE_STATIC_LOCAL(const String, verticallr, ("lr"));
     return verticallr;
 }
 
@@ -95,7 +96,7 @@
     : HTMLDivElement(divTag, document)
     , m_cue(cue)
 {
-    setPseudo(textTrackCueBoxShadowPseudoId());
+    setPart(textTrackCueBoxShadowPseudoId());
 }
 
 TextTrackCue* TextTrackCueBox::getCue() const
@@ -607,7 +608,7 @@
 
 void TextTrackCue::determineTextDirection()
 {
-    DEFINE_STATIC_LOCAL(const String, rtTag, (ASCIILiteral("rt")));
+    DEFINE_STATIC_LOCAL(const String, rtTag, ("rt"));
     createWebVTTNodeTree();
 
     // Apply the Unicode Bidirectional Algorithm's Paragraph Level steps to the
@@ -738,7 +739,7 @@
 
 void TextTrackCue::markFutureAndPastNodes(ContainerNode* root, double previousTimestamp, double movieTime)
 {
-    DEFINE_STATIC_LOCAL(const String, timestampTag, (ASCIILiteral("timestamp")));
+    DEFINE_STATIC_LOCAL(const String, timestampTag, ("timestamp"));
 
     bool isPastNode = true;
     double currentTimestamp = previousTimestamp;
@@ -803,7 +804,7 @@
     // background box.
 
     // Note: This is contained by default in m_cueBackgroundBox.
-    m_cueBackgroundBox->setPseudo(cueShadowPseudoId());
+    m_cueBackgroundBox->setPart(cueShadowPseudoId());
     displayTree->appendChild(m_cueBackgroundBox, ASSERT_NO_EXCEPTION, AttachLazily);
 
     // FIXME(BUG 79916): Runs of children of WebVTT Ruby Objects that are not
@@ -878,13 +879,13 @@
 
 TextTrackCue::CueSetting TextTrackCue::settingName(const String& name)
 {
-    DEFINE_STATIC_LOCAL(const String, verticalKeyword, (ASCIILiteral("vertical")));
-    DEFINE_STATIC_LOCAL(const String, lineKeyword, (ASCIILiteral("line")));
-    DEFINE_STATIC_LOCAL(const String, positionKeyword, (ASCIILiteral("position")));
-    DEFINE_STATIC_LOCAL(const String, sizeKeyword, (ASCIILiteral("size")));
-    DEFINE_STATIC_LOCAL(const String, alignKeyword, (ASCIILiteral("align")));
+    DEFINE_STATIC_LOCAL(const String, verticalKeyword, ("vertical"));
+    DEFINE_STATIC_LOCAL(const String, lineKeyword, ("line"));
+    DEFINE_STATIC_LOCAL(const String, positionKeyword, ("position"));
+    DEFINE_STATIC_LOCAL(const String, sizeKeyword, ("size"));
+    DEFINE_STATIC_LOCAL(const String, alignKeyword, ("align"));
 #if ENABLE(WEBVTT_REGIONS)
-    DEFINE_STATIC_LOCAL(const String, regionIdKeyword, (ASCIILiteral("region")));
+    DEFINE_STATIC_LOCAL(const String, regionIdKeyword, ("region"));
 #endif
 
     if (name == verticalKeyword)
diff --git a/Source/core/html/track/TextTrackCue.idl b/Source/core/html/track/TextTrackCue.idl
index f398a9a..d379587 100644
--- a/Source/core/html/track/TextTrackCue.idl
+++ b/Source/core/html/track/TextTrackCue.idl
@@ -45,8 +45,8 @@
     attribute DOMString text;
     DocumentFragment getCueAsHTML();
 
-    attribute EventListener onenter;
-    attribute EventListener onexit;
+    attribute EventHandler onenter;
+    attribute EventHandler onexit;
 
     [Conditional=WEBVTT_REGIONS] attribute DOMString regionId;
 };
diff --git a/Source/core/html/track/TextTrackList.idl b/Source/core/html/track/TextTrackList.idl
index a6e51b3..d52c548 100644
--- a/Source/core/html/track/TextTrackList.idl
+++ b/Source/core/html/track/TextTrackList.idl
@@ -30,6 +30,6 @@
     readonly attribute unsigned long length;
     getter TextTrack item(unsigned long index);
 
-    attribute EventListener onaddtrack;
+    attribute EventHandler onaddtrack;
 };
 
diff --git a/Source/core/html/track/TextTrackRegion.cpp b/Source/core/html/track/TextTrackRegion.cpp
index 4a93ac6..51a91b6 100644
--- a/Source/core/html/track/TextTrackRegion.cpp
+++ b/Source/core/html/track/TextTrackRegion.cpp
@@ -468,11 +468,11 @@
         0.0,
         CSSPrimitiveValue::CSS_PX);
 
-    m_cueContainer->setPseudo(textTrackCueContainerShadowPseudoId());
+    m_cueContainer->setPart(textTrackCueContainerShadowPseudoId());
     m_regionDisplayTree->appendChild(m_cueContainer);
 
     // 7.5 Every WebVTT region object is initialised with the following CSS
-    m_regionDisplayTree->setPseudo(textTrackRegionShadowPseudoId());
+    m_regionDisplayTree->setPart(textTrackRegionShadowPseudoId());
 }
 
 void TextTrackRegion::startTimer()
diff --git a/Source/core/html/track/WebVTTParser.cpp b/Source/core/html/track/WebVTTParser.cpp
index 4a7b524..4b2dfc2 100644
--- a/Source/core/html/track/WebVTTParser.cpp
+++ b/Source/core/html/track/WebVTTParser.cpp
@@ -328,13 +328,16 @@
     // 4.8.10.13.4 WebVTT cue text parsing rules and
     // 4.8.10.13.5 WebVTT cue text DOM construction rules.
 
-    if (!text.length())
-        return 0;
-
     ASSERT(m_scriptExecutionContext->isDocument());
     Document* document = toDocument(m_scriptExecutionContext);
 
     RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
+
+    if (!text.length()) {
+        fragment->parserAppendChild(Text::create(document, ""));
+        return fragment;
+    }
+
     m_currentNode = fragment;
     m_tokenizer->reset();
     m_token.clear();