Merge from Chromium at DEPS revision r207203

This commit was generated by merge_to_master.py.

Change-Id: Ia8a6c2a997232c94108d8937f8c2556f42be1c37
diff --git a/Source/core/html/ColorInputType.cpp b/Source/core/html/ColorInputType.cpp
index 0968962..06abe9e 100644
--- a/Source/core/html/ColorInputType.cpp
+++ b/Source/core/html/ColorInputType.cpp
@@ -144,7 +144,7 @@
 
 void ColorInputType::handleDOMActivateEvent(Event* event)
 {
-    if (element()->isDisabledOrReadOnly() || !element()->renderer())
+    if (element()->isDisabledFormControl() || !element()->renderer())
         return;
 
     if (!ScriptController::processingUserGesture())
@@ -174,7 +174,7 @@
 
 void ColorInputType::didChooseColor(const Color& color)
 {
-    if (element()->isDisabledOrReadOnly() || color == valueAsColor())
+    if (element()->isDisabledFormControl() || color == valueAsColor())
         return;
     element()->setValueFromRenderer(color.serialized());
     updateColorSwatch();
diff --git a/Source/core/html/DOMURL.cpp b/Source/core/html/DOMURL.cpp
index d5905ef..777fe23 100644
--- a/Source/core/html/DOMURL.cpp
+++ b/Source/core/html/DOMURL.cpp
@@ -28,16 +28,16 @@
 
 #include "core/html/DOMURL.h"
 
-#include <wtf/MainThread.h>
-#include <wtf/PassOwnPtr.h>
 #include "core/dom/ScriptExecutionContext.h"
 #include "core/fileapi/Blob.h"
 #include "core/fileapi/BlobURL.h"
 #include "core/html/PublicURLManager.h"
 #include "core/loader/cache/MemoryCache.h"
-#include "core/platform/KURL.h"
 #include "modules/mediasource/MediaSourceBase.h"
 #include "modules/mediastream/MediaStream.h"
+#include "weborigin/KURL.h"
+#include "wtf/MainThread.h"
+#include "wtf/PassOwnPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/DOMURL.h b/Source/core/html/DOMURL.h
index f64dafd..3b80033 100644
--- a/Source/core/html/DOMURL.h
+++ b/Source/core/html/DOMURL.h
@@ -27,11 +27,9 @@
 #ifndef DOMURL_h
 #define DOMURL_h
 
-#include "core/platform/KURL.h"
-#include <wtf/HashSet.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/text/WTFString.h>
+#include "wtf/Forward.h"
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/EmailInputType.cpp b/Source/core/html/EmailInputType.cpp
index ec5e295..f8707a2 100644
--- a/Source/core/html/EmailInputType.cpp
+++ b/Source/core/html/EmailInputType.cpp
@@ -27,8 +27,12 @@
 #include "core/html/HTMLInputElement.h"
 #include "core/html/InputTypeNames.h"
 #include "core/html/parser/HTMLParserIdioms.h"
+#include "core/page/Chrome.h"
+#include "core/page/ChromeClient.h"
 #include "core/platform/LocalizedStrings.h"
 #include "core/platform/text/RegularExpression.h"
+#include "public/platform/Platform.h"
+#include <unicode/uidna.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -39,6 +43,55 @@
     "@"
     "[a-z0-9-]+(\\.[a-z0-9-]+)*"; // domain part
 
+// RFC5321 says the maximum total length of a domain name is 255 octets.
+static const size_t maximumDomainNameLength = 255;
+static const int32_t idnaConversionOption = UIDNA_ALLOW_UNASSIGNED;
+
+static String convertEmailAddressToASCII(const String& address)
+{
+    if (address.containsOnlyASCII())
+        return address;
+
+    size_t atPosition = address.find('@');
+    if (atPosition == notFound)
+        return address;
+
+    UErrorCode error = U_ZERO_ERROR;
+    UChar domainNameBuffer[maximumDomainNameLength];
+    int32_t domainNameLength = uidna_IDNToASCII(address.characters() + atPosition + 1, address.length() - atPosition - 1, domainNameBuffer, WTF_ARRAY_LENGTH(domainNameBuffer), idnaConversionOption, 0, &error);
+    if (error != U_ZERO_ERROR || domainNameLength <= 0)
+        return address;
+
+    StringBuilder builder;
+    builder.append(address, 0, atPosition + 1);
+    builder.append(domainNameBuffer, domainNameLength);
+    return builder.toString();
+}
+
+String EmailInputType::convertEmailAddressToUnicode(const String& address) const
+{
+    if (!address.containsOnlyASCII())
+        return address;
+
+    size_t atPosition = address.find('@');
+    if (atPosition == notFound)
+        return address;
+
+    if (address.find("xn--", atPosition + 1) == notFound)
+        return address;
+
+    ChromeClient* chromeClient = chrome() ? chrome()->client() : 0;
+    if (!chromeClient)
+        return address;
+
+    String languages = chromeClient->acceptLanguages();
+    String unicodeHost = WebKit::Platform::current()->convertIDNToUnicode(address.substring(atPosition + 1), languages);
+    StringBuilder builder;
+    builder.append(address, 0, atPosition + 1);
+    builder.append(unicodeHost);
+    return builder.toString();
+}
+
 static bool isValidEmailAddress(const String& address)
 {
     int addressLength = address.length();
@@ -112,7 +165,7 @@
     Vector<String> addresses;
     noLineBreakValue.split(',', true, addresses);
     StringBuilder strippedValue;
-    for (unsigned i = 0; i < addresses.size(); ++i) {
+    for (size_t i = 0; i < addresses.size(); ++i) {
         if (i > 0)
             strippedValue.append(",");
         strippedValue.append(stripLeadingAndTrailingHTMLSpaces(addresses[i]));
@@ -120,4 +173,39 @@
     return strippedValue.toString();
 }
 
+String EmailInputType::convertFromVisibleValue(const String& visibleValue) const
+{
+    String sanitizedValue = sanitizeValue(visibleValue);
+    if (!element()->multiple())
+        return convertEmailAddressToASCII(sanitizedValue);
+    Vector<String> addresses;
+    sanitizedValue.split(',', true, addresses);
+    StringBuilder builder;
+    builder.reserveCapacity(sanitizedValue.length());
+    for (size_t i = 0; i < addresses.size(); ++i) {
+        if (i > 0)
+            builder.append(",");
+        builder.append(convertEmailAddressToASCII(addresses[i]));
+    }
+    return builder.toString();
+}
+
+String EmailInputType::visibleValue() const
+{
+    String value = element()->value();
+    if (!element()->multiple())
+        return convertEmailAddressToUnicode(value);
+
+    Vector<String> addresses;
+    value.split(',', true, addresses);
+    StringBuilder builder;
+    builder.reserveCapacity(value.length());
+    for (size_t i = 0; i < addresses.size(); ++i) {
+        if (i > 0)
+            builder.append(",");
+        builder.append(convertEmailAddressToUnicode(addresses[i]));
+    }
+    return builder.toString();
+}
+
 } // namespace WebCore
diff --git a/Source/core/html/EmailInputType.h b/Source/core/html/EmailInputType.h
index b33689e..a4cc34c 100644
--- a/Source/core/html/EmailInputType.h
+++ b/Source/core/html/EmailInputType.h
@@ -49,6 +49,9 @@
     virtual bool isEmailField() const OVERRIDE;
     virtual bool supportsSelectionAPI() const OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
+    virtual String convertFromVisibleValue(const String&) const OVERRIDE;
+    virtual String visibleValue() const OVERRIDE;
+    String convertEmailAddressToUnicode(const String&) const;
 };
 
 } // namespace WebCore
diff --git a/Source/core/html/FileInputType.cpp b/Source/core/html/FileInputType.cpp
index 78d31cd..eac4fb4 100644
--- a/Source/core/html/FileInputType.cpp
+++ b/Source/core/html/FileInputType.cpp
@@ -47,44 +47,6 @@
 
 using namespace HTMLNames;
 
-class UploadButtonElement : public HTMLInputElement {
-public:
-    static PassRefPtr<UploadButtonElement> create(Document*);
-    static PassRefPtr<UploadButtonElement> createForMultiple(Document*);
-
-private:
-    UploadButtonElement(Document*);
-
-    virtual const AtomicString& shadowPseudoId() const;
-};
-
-PassRefPtr<UploadButtonElement> UploadButtonElement::create(Document* document)
-{
-    RefPtr<UploadButtonElement> button = adoptRef(new UploadButtonElement(document));
-    button->setType("button");
-    button->setValue(fileButtonChooseFileLabel());
-    return button.release();
-}
-
-PassRefPtr<UploadButtonElement> UploadButtonElement::createForMultiple(Document* document)
-{
-    RefPtr<UploadButtonElement> button = adoptRef(new UploadButtonElement(document));
-    button->setType("button");
-    button->setValue(fileButtonChooseMultipleFilesLabel());
-    return button.release();
-}
-
-UploadButtonElement::UploadButtonElement(Document* document)
-    : HTMLInputElement(inputTag, document, 0, false)
-{
-}
-
-const AtomicString& UploadButtonElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-file-upload-button", AtomicString::ConstructFromLiteral));
-    return pseudoId;
-}
-
 inline FileInputType::FileInputType(HTMLInputElement* element)
     : BaseClickableWithKeyInputType(element)
     , m_fileList(FileList::create())
@@ -295,23 +257,25 @@
 void FileInputType::createShadowSubtree()
 {
     ASSERT(element()->shadow());
-    element()->userAgentShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), IGNORE_EXCEPTION);
+    RefPtr<HTMLInputElement> button = HTMLInputElement::create(inputTag, element()->document(), 0, false);
+    button->setType(InputTypeNames::button());
+    button->setAttribute(valueAttr, element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
+    button->setPseudo(AtomicString("-webkit-file-upload-button", AtomicString::ConstructFromLiteral));
+    element()->userAgentShadowRoot()->appendChild(button.release(), IGNORE_EXCEPTION);
 }
 
 void FileInputType::disabledAttributeChanged()
 {
     ASSERT(element()->shadow());
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->userAgentShadowRoot()->firstChild());
-    if (button)
+    if (Element* button = toElement(element()->userAgentShadowRoot()->firstChild()))
         button->setBooleanAttribute(disabledAttr, element()->isDisabledFormControl());
 }
 
 void FileInputType::multipleAttributeChanged()
 {
     ASSERT(element()->shadow());
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->userAgentShadowRoot()->firstChild());
-    if (button)
-        button->setValue(element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
+    if (Element* button = toElement(element()->userAgentShadowRoot()->firstChild()))
+        button->setAttribute(valueAttr, element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
 
 void FileInputType::requestIcon(const Vector<String>& paths)
diff --git a/Source/core/html/FormController.cpp b/Source/core/html/FormController.cpp
index cc42735..57436bb 100644
--- a/Source/core/html/FormController.cpp
+++ b/Source/core/html/FormController.cpp
@@ -368,12 +368,7 @@
 void FormKeyGenerator::willDeleteForm(HTMLFormElement* form)
 {
     ASSERT(form);
-    if (m_formToKeyMap.isEmpty())
-        return;
-    FormToKeyMap::iterator it = m_formToKeyMap.find(form);
-    if (it == m_formToKeyMap.end())
-        return;
-    m_formToKeyMap.remove(it);
+    m_formToKeyMap.remove(form);
 }
 
 // ----------------------------------------------------------------------------
diff --git a/Source/core/html/HTMLAnchorElement.cpp b/Source/core/html/HTMLAnchorElement.cpp
index 79760db..05576d4 100644
--- a/Source/core/html/HTMLAnchorElement.cpp
+++ b/Source/core/html/HTMLAnchorElement.cpp
@@ -77,6 +77,7 @@
     }
 
     void handleEvent(Event* e);
+    void didChangeHREF() { m_hadHREFChanged = true; }
 
 private:
     explicit PrefetchEventHandler(HTMLAnchorElement*);
@@ -97,6 +98,7 @@
     double m_mouseOverTimestamp;
     double m_mouseDownTimestamp;
     double m_tapDownTimestamp;
+    bool m_hadHREFChanged;
     bool m_hadTapUnconfirmed;
     bool m_hasIssuedPreconnect;
 };
@@ -147,12 +149,11 @@
 
 bool HTMLAnchorElement::isMouseFocusable() const
 {
-    // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
+    // Links are focusable by default, but only allow links with tabindex or contenteditable to be mouse focusable.
+    // https://bugs.webkit.org/show_bug.cgi?id=26856
     if (isLink())
-        // Only allow links with tabIndex or contentEditable to be mouse focusable.
         return HTMLElement::supportsFocus();
 
-    // Allow tab index etc to control focus.
     return HTMLElement::isMouseFocusable();
 }
 
@@ -188,7 +189,7 @@
     if (!target->hasTagName(imgTag))
         return;
 
-    HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(event->target()->toNode());
+    HTMLImageElement* imageElement = toHTMLImageElement(event->target()->toNode());
     if (!imageElement || !imageElement->isServerMap())
         return;
 
@@ -285,6 +286,9 @@
                 if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
                     prefetchDNS(document()->completeURL(parsedURL).host());
             }
+
+            if (wasLink)
+                prefetchEventHandler()->didChangeHREF();
         }
         invalidateCachedVisitedLinkHash();
     } else if (name == nameAttr || name == titleAttr) {
@@ -684,6 +688,7 @@
 
 void HTMLAnchorElement::PrefetchEventHandler::reset()
 {
+    m_hadHREFChanged = false;
     m_mouseOverTimestamp = 0;
     m_mouseDownTimestamp = 0;
     m_hadTapUnconfirmed = false;
@@ -791,6 +796,9 @@
 
 bool HTMLAnchorElement::PrefetchEventHandler::shouldPrefetch(const KURL& url)
 {
+    if (m_hadHREFChanged)
+        return false;
+
     if (m_anchorElement->hasEventListeners(eventNames().clickEvent))
         return false;
 
diff --git a/Source/core/html/HTMLAreaElement.cpp b/Source/core/html/HTMLAreaElement.cpp
index 13d17d4..f956d10 100644
--- a/Source/core/html/HTMLAreaElement.cpp
+++ b/Source/core/html/HTMLAreaElement.cpp
@@ -182,8 +182,11 @@
 
 HTMLImageElement* HTMLAreaElement::imageElement() const
 {
-    Node* mapElement = parentNode();
-    if (!mapElement || !mapElement->hasTagName(mapTag))
+    Element* mapElement = parentElement();
+    while (mapElement && !mapElement->hasTagName(mapTag))
+        mapElement = mapElement->parentElement();
+
+    if (!mapElement)
         return 0;
     
     return static_cast<HTMLMapElement*>(mapElement)->imageElement();
@@ -199,7 +202,7 @@
     return isFocusable();
 }
 
-bool HTMLAreaElement::isFocusable() const
+bool HTMLAreaElement::rendererIsFocusable() const
 {
     HTMLImageElement* image = imageElement();
     if (!image || !image->renderer() || image->renderer()->style()->visibility() != VISIBLE)
@@ -241,8 +244,7 @@
 bool HTMLAreaElement::supportsFocus() const
 {
     // If the AREA element was a link, it should support focus.
-    // The inherited method is not used because it assumes that a render object must exist 
-    // for the element to support focus. AREA elements do not have render objects.
+    // FIXME: This means that an AREA that is not a link cannot be made focusable through contenteditable or tabindex. Is it correct?
     return isLink();
 }
 
diff --git a/Source/core/html/HTMLAreaElement.h b/Source/core/html/HTMLAreaElement.h
index d1f3cb6..0d3099f 100644
--- a/Source/core/html/HTMLAreaElement.h
+++ b/Source/core/html/HTMLAreaElement.h
@@ -55,7 +55,7 @@
     virtual String target() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
-    virtual bool isFocusable() const;
+    virtual bool rendererIsFocusable() const OVERRIDE;
     virtual void updateFocusAppearance(bool /*restorePreviousSelection*/);
     virtual void setFocus(bool) OVERRIDE;
 
diff --git a/Source/core/html/HTMLBodyElement.cpp b/Source/core/html/HTMLBodyElement.cpp
index 59acee8..7d5ac62 100644
--- a/Source/core/html/HTMLBodyElement.cpp
+++ b/Source/core/html/HTMLBodyElement.cpp
@@ -194,6 +194,8 @@
 
 bool HTMLBodyElement::supportsFocus() const
 {
+    // This override is needed because the inherited method bails if the parent is editable.
+    // The <body> should be focusable even if <html> is editable.
     return rendererIsEditable() || HTMLElement::supportsFocus();
 }
 
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 8a60bab..2dba91d 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -119,10 +119,10 @@
     return HTMLElement::createRenderer(arena, style);
 }
 
-void HTMLCanvasElement::attach()
+void HTMLCanvasElement::attach(const AttachContext& context)
 {
     setIsInCanvasSubtree(true);
-    HTMLElement::attach();
+    HTMLElement::attach(context);
 }
 
 void HTMLCanvasElement::addObserver(CanvasObserver* observer)
diff --git a/Source/core/html/HTMLCanvasElement.h b/Source/core/html/HTMLCanvasElement.h
index fad2dcb..781477b 100644
--- a/Source/core/html/HTMLCanvasElement.h
+++ b/Source/core/html/HTMLCanvasElement.h
@@ -138,7 +138,7 @@
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool areAuthorShadowsAllowed() const OVERRIDE { return false; }
 
     void reset();
diff --git a/Source/core/html/HTMLDialogElement.cpp b/Source/core/html/HTMLDialogElement.cpp
index 30c9f3a..431099e 100644
--- a/Source/core/html/HTMLDialogElement.cpp
+++ b/Source/core/html/HTMLDialogElement.cpp
@@ -35,6 +35,11 @@
 
 using namespace HTMLNames;
 
+static bool needsCenteredPositioning(const RenderStyle* style)
+{
+    return style->position() == AbsolutePosition && style->hasAutoTopAndBottom();
+}
+
 HTMLDialogElement::HTMLDialogElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_topIsValid(false)
@@ -61,11 +66,6 @@
     m_topIsValid = false;
 }
 
-static bool needsCenteredPositioning(const RenderStyle* style)
-{
-    return style->position() == AbsolutePosition && style->hasAutoTopAndBottom();
-}
-
 PassRefPtr<RenderStyle> HTMLDialogElement::customStyleForRenderer()
 {
     RefPtr<RenderStyle> originalStyle = originalStyleForRenderer();
@@ -78,7 +78,7 @@
     return style.release();
 }
 
-void HTMLDialogElement::positionAndReattach()
+void HTMLDialogElement::reposition()
 {
     // Layout because we need to know our ancestors' positions and our own height.
     document()->updateLayoutIgnorePendingStylesheets();
@@ -97,8 +97,7 @@
         m_top += (visibleHeight - box->height()) / 2;
     m_topIsValid = true;
 
-    // FIXME: It's inefficient to reattach here. We could do better by mutating style directly and forcing another layout.
-    reattach();
+    setNeedsStyleRecalc(InlineStyleChange);
 }
 
 void HTMLDialogElement::show()
@@ -106,7 +105,7 @@
     if (fastHasAttribute(openAttr))
         return;
     setBooleanAttribute(openAttr, true);
-    positionAndReattach();
+    reposition();
 }
 
 void HTMLDialogElement::showModal(ExceptionCode& ec)
@@ -117,7 +116,7 @@
     }
     document()->addToTopLayer(this);
     setBooleanAttribute(openAttr, true);
-    positionAndReattach();
+    reposition();
 }
 
 bool HTMLDialogElement::isPresentationAttribute(const QualifiedName& name) const
diff --git a/Source/core/html/HTMLDialogElement.h b/Source/core/html/HTMLDialogElement.h
index 7dcbed6..d840034 100644
--- a/Source/core/html/HTMLDialogElement.h
+++ b/Source/core/html/HTMLDialogElement.h
@@ -47,7 +47,7 @@
     virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual bool shouldBeReparentedUnderRenderView(const RenderStyle*) const OVERRIDE;
-    void positionAndReattach();
+    void reposition();
 
     bool m_topIsValid;
     LayoutUnit m_top;
diff --git a/Source/core/html/HTMLElement.cpp b/Source/core/html/HTMLElement.cpp
index f40633f..5953c68 100644
--- a/Source/core/html/HTMLElement.cpp
+++ b/Source/core/html/HTMLElement.cpp
@@ -325,9 +325,7 @@
     
     RefPtr<Text> textNode = toText(node.get());
     RefPtr<Text> textNext = toText(next);
-    textNode->appendData(textNext->data(), ec);
-    if (ec)
-        return;
+    textNode->appendData(textNext->data());
     if (textNext->parentNode()) // Might have been removed by mutation event.
         textNext->remove(ec);
 }
@@ -602,6 +600,11 @@
 
 bool HTMLElement::supportsFocus() const
 {
+    // FIXME: supportsFocus() can be called when layout is not up to date.
+    // Logic that deals with the renderer should be moved to rendererIsFocusable().
+    // But supportsFocus must return true when the element is editable, or else
+    // it won't be focusable. Furthermore, supportsFocus cannot just return true
+    // always or else tabIndex() will change for all HTML elements.
     return Element::supportsFocus() || (rendererIsEditable() && parentNode() && !parentNode()->rendererIsEditable());
 }
 
diff --git a/Source/core/html/HTMLFormControlElement.cpp b/Source/core/html/HTMLFormControlElement.cpp
index b150754..48056cb 100644
--- a/Source/core/html/HTMLFormControlElement.cpp
+++ b/Source/core/html/HTMLFormControlElement.cpp
@@ -203,11 +203,11 @@
     element->deref(); 
 }
 
-void HTMLFormControlElement::attach()
+void HTMLFormControlElement::attach(const AttachContext& context)
 {
     PostAttachCallbackDisabler disabler(this);
 
-    HTMLElement::attach();
+    HTMLElement::attach(context);
 
     // The call to updateFromElement() needs to go after the call through
     // to the base class's attach() because that can sometimes do a close
@@ -305,15 +305,13 @@
     return !isDisabledFormControl();
 }
 
-bool HTMLFormControlElement::isFocusable() const
+bool HTMLFormControlElement::rendererIsFocusable() const
 {
     // If there's a renderer, make sure the size isn't empty, but if there's no renderer,
-    // it might still be focusable if it's in a canvas subtree (handled in Node::isFocusable).
+    // it might still be focusable if it's in a canvas subtree (handled in Element::rendererIsFocusable).
     if (renderer() && (!renderer()->isBox() || toRenderBox(renderer())->size().isEmpty()))
         return false;
-    // HTMLElement::isFocusable handles visibility and calls suportsFocus which
-    // will cover the disabled case.
-    return HTMLElement::isFocusable();
+    return HTMLElement::rendererIsFocusable();
 }
 
 bool HTMLFormControlElement::isKeyboardFocusable(KeyboardEvent*) const
@@ -442,11 +440,6 @@
     setNeedsValidityCheck();
 }
 
-bool HTMLFormControlElement::validationMessageShadowTreeContains(Node* node) const
-{
-    return m_validationMessage && m_validationMessage->shadowTreeContains(node);
-}
-
 void HTMLFormControlElement::dispatchBlurEvent(PassRefPtr<Node> newFocusedNode)
 {
     HTMLElement::dispatchBlurEvent(newFocusedNode);
diff --git a/Source/core/html/HTMLFormControlElement.h b/Source/core/html/HTMLFormControlElement.h
index b9886d7..7edb7bd 100644
--- a/Source/core/html/HTMLFormControlElement.h
+++ b/Source/core/html/HTMLFormControlElement.h
@@ -66,7 +66,6 @@
 
     virtual bool isDisabledFormControl() const OVERRIDE;
 
-    virtual bool isFocusable() const;
     virtual bool isEnumeratable() const { return false; }
 
     bool isRequired() const;
@@ -112,12 +111,13 @@
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual void requiredAttributeChanged();
     virtual void disabledAttributeChanged();
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void removedFrom(ContainerNode*) OVERRIDE;
     virtual void didMoveToNewDocument(Document* oldDocument) OVERRIDE;
 
-    virtual bool supportsFocus() const;
+    virtual bool supportsFocus() const OVERRIDE;
+    virtual bool rendererIsFocusable() const OVERRIDE;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
@@ -129,8 +129,6 @@
     void setNeedsWillValidateCheck();
     virtual bool recalcWillValidate() const;
 
-    bool validationMessageShadowTreeContains(Node*) const;
-
 private:
     virtual void refFormAssociatedElement() { ref(); }
     virtual void derefFormAssociatedElement() { deref(); }
diff --git a/Source/core/html/HTMLFrameElement.cpp b/Source/core/html/HTMLFrameElement.cpp
index 3d9710b..c8e3d5d 100644
--- a/Source/core/html/HTMLFrameElement.cpp
+++ b/Source/core/html/HTMLFrameElement.cpp
@@ -71,9 +71,9 @@
     return hasAttribute(noresizeAttr);
 }
 
-void HTMLFrameElement::attach()
+void HTMLFrameElement::attach(const AttachContext& context)
 {
-    HTMLFrameElementBase::attach();
+    HTMLFrameElementBase::attach(context);
     
     if (HTMLFrameSetElement* frameSetElement = containingFrameSetElement(this)) {
         if (!m_frameBorderSet)
diff --git a/Source/core/html/HTMLFrameElement.h b/Source/core/html/HTMLFrameElement.h
index b9bf176..04e0fea 100644
--- a/Source/core/html/HTMLFrameElement.h
+++ b/Source/core/html/HTMLFrameElement.h
@@ -39,7 +39,7 @@
 private:
     HTMLFrameElement(const QualifiedName&, Document*);
 
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/core/html/HTMLFrameElement.idl b/Source/core/html/HTMLFrameElement.idl
index ec98564..c702fd6 100644
--- a/Source/core/html/HTMLFrameElement.idl
+++ b/Source/core/html/HTMLFrameElement.idl
@@ -33,7 +33,7 @@
     [CheckSecurityForNode] readonly attribute Document contentDocument;
 
     // Extensions
-    readonly attribute DOMWindow contentWindow;
+    readonly attribute Window contentWindow;
 
     [CheckSecurityForNode, RaisesException] SVGDocument getSVGDocument();
 
diff --git a/Source/core/html/HTMLFrameElementBase.cpp b/Source/core/html/HTMLFrameElementBase.cpp
index aadb7af..602adbe 100644
--- a/Source/core/html/HTMLFrameElementBase.cpp
+++ b/Source/core/html/HTMLFrameElementBase.cpp
@@ -161,9 +161,9 @@
     setNameAndOpenURL();
 }
 
-void HTMLFrameElementBase::attach()
+void HTMLFrameElementBase::attach(const AttachContext& context)
 {
-    HTMLFrameOwnerElement::attach();
+    HTMLFrameOwnerElement::attach(context);
 
     if (RenderPart* part = renderPart()) {
         if (Frame* frame = contentFrame())
diff --git a/Source/core/html/HTMLFrameElementBase.h b/Source/core/html/HTMLFrameElementBase.h
index 7dcbeb0..ef09c0e 100644
--- a/Source/core/html/HTMLFrameElementBase.h
+++ b/Source/core/html/HTMLFrameElementBase.h
@@ -52,7 +52,7 @@
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void didNotifySubtreeInsertions(ContainerNode*) OVERRIDE;
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
 private:
     virtual bool supportsFocus() const;
diff --git a/Source/core/html/HTMLFrameSetElement.cpp b/Source/core/html/HTMLFrameSetElement.cpp
index a65c4bb..1a273fa 100644
--- a/Source/core/html/HTMLFrameSetElement.cpp
+++ b/Source/core/html/HTMLFrameSetElement.cpp
@@ -164,7 +164,7 @@
     return new (arena) RenderFrameSet(this);
 }
 
-void HTMLFrameSetElement::attach()
+void HTMLFrameSetElement::attach(const AttachContext& context)
 {
     // Inherit default settings from parent frameset
     // FIXME: This is not dynamic.
@@ -185,7 +185,7 @@
         }
     }
 
-    HTMLElement::attach();
+    HTMLElement::attach(context);
 }
 
 void HTMLFrameSetElement::defaultEventHandler(Event* evt)
diff --git a/Source/core/html/HTMLFrameSetElement.h b/Source/core/html/HTMLFrameSetElement.h
index 7a4177d..1a2ce49 100644
--- a/Source/core/html/HTMLFrameSetElement.h
+++ b/Source/core/html/HTMLFrameSetElement.h
@@ -73,7 +73,7 @@
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/Source/core/html/HTMLFrameSetElement.idl b/Source/core/html/HTMLFrameSetElement.idl
index 8781d36..09c262c 100644
--- a/Source/core/html/HTMLFrameSetElement.idl
+++ b/Source/core/html/HTMLFrameSetElement.idl
@@ -19,7 +19,7 @@
  */
 
 interface HTMLFrameSetElement : HTMLElement {
-    [ImplementedAs=anonymousNamedGetter, OverrideBuiltins, NotEnumerable] getter DOMWindow (DOMString name);
+    [ImplementedAs=anonymousNamedGetter, OverrideBuiltins, NotEnumerable] getter Window (DOMString name);
     [Reflect] attribute DOMString cols;
     [Reflect] attribute DOMString rows;
 
diff --git a/Source/core/html/HTMLIFrameElement.idl b/Source/core/html/HTMLIFrameElement.idl
index b73c764..bc93aa3 100644
--- a/Source/core/html/HTMLIFrameElement.idl
+++ b/Source/core/html/HTMLIFrameElement.idl
@@ -37,7 +37,7 @@
     [CheckSecurityForNode] readonly attribute Document contentDocument;
 
     // Extensions
-    readonly attribute DOMWindow contentWindow;
+    readonly attribute Window contentWindow;
 
     [CheckSecurityForNode, RaisesException] SVGDocument getSVGDocument();
 };
diff --git a/Source/core/html/HTMLImageElement.cpp b/Source/core/html/HTMLImageElement.cpp
index c913c1b..7c8ccad 100644
--- a/Source/core/html/HTMLImageElement.cpp
+++ b/Source/core/html/HTMLImageElement.cpp
@@ -156,9 +156,9 @@
     return false;
 }
 
-void HTMLImageElement::attach()
+void HTMLImageElement::attach(const AttachContext& context)
 {
-    HTMLElement::attach();
+    HTMLElement::attach(context);
 
     if (renderer() && renderer()->isImage() && !m_imageLoader.hasPendingBeforeLoadEvent()) {
         RenderImage* renderImage = toRenderImage(renderer());
diff --git a/Source/core/html/HTMLImageElement.h b/Source/core/html/HTMLImageElement.h
index f510160..e7b45c7 100644
--- a/Source/core/html/HTMLImageElement.h
+++ b/Source/core/html/HTMLImageElement.h
@@ -90,7 +90,7 @@
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     virtual bool canStartSelection() const;
@@ -111,6 +111,18 @@
     CompositeOperator m_compositeOperator;
 };
 
+inline HTMLImageElement* toHTMLImageElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::imgTag));
+    return static_cast<HTMLImageElement*>(node);
+}
+
+inline const HTMLImageElement* toHTMLImageElement(const Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::imgTag));
+    return static_cast<const HTMLImageElement*>(node);
+}
+
 } //namespace
 
 #endif
diff --git a/Source/core/html/HTMLImportsController.cpp b/Source/core/html/HTMLImportsController.cpp
index 4048d79..7202664 100644
--- a/Source/core/html/HTMLImportsController.cpp
+++ b/Source/core/html/HTMLImportsController.cpp
@@ -32,7 +32,6 @@
 #include "core/html/HTMLImportsController.h"
 
 #include "core/dom/Document.h"
-#include "core/dom/DocumentFragment.h"
 #include "core/dom/DocumentType.h"
 #include "core/dom/Range.h"
 #include "core/html/HTMLDocument.h"
@@ -78,13 +77,8 @@
     }
 
     // FIXME(morrita): This should be done in incremental way.
-    RefPtr<Document> parsingPlaceholder = HTMLDocument::create(0, KURL());
-    parsingPlaceholder->setContent(m_resource->script());
-
-    // Doctypes cannot be moved between documents. So we remove it before the migration.
-    if (RefPtr<Node> doctype = parsingPlaceholder->doctype())
-        parsingPlaceholder->removeChild(doctype.get());
-    m_importedFragment->takeAllChildrenFrom(parsingPlaceholder.get());
+    m_importedDocument = HTMLDocument::create(0, m_resource->response().url());
+    m_importedDocument->setContent(m_resource->script());
 
     return StateReady;
 }
@@ -132,12 +126,11 @@
     m_resource->addClient(this);
     m_url = builder.url();
     m_controller->addImport(this);
-    m_importedFragment = m_controller->createDocumentFragment();
 
     return StateStarted;
 }
 
-DocumentFragment* LinkImport::importedFragment() const
+Document* LinkImport::importedDocument() const
 {
     if (!m_owner)
         return 0;
@@ -145,11 +138,11 @@
         return 0;
 
     if (m_ofSameLocation) {
-        ASSERT(!m_importedFragment);
-        return m_ofSameLocation->importedFragment();
+        ASSERT(!m_importedDocument);
+        return m_ofSameLocation->importedDocument();
     }
 
-    return m_importedFragment.get();
+    return m_importedDocument.get();
 }
 
 void LinkImport::process()
@@ -167,7 +160,7 @@
 void LinkImport::importDestroyed()
 {
     m_controller = 0;
-    m_importedFragment.clear();
+    m_importedDocument.clear();
 }
 
 PassOwnPtr<HTMLImportsController> HTMLImportsController::create(Document* master)
@@ -177,7 +170,6 @@
 
 HTMLImportsController::HTMLImportsController(Document* master)
     : m_master(master)
-    , m_importedFragmentOwner(HTMLDocument::create(0, KURL()))
 {
 }
 
@@ -204,11 +196,6 @@
         m_master->didLoadAllImports();
 }
 
-PassRefPtr<DocumentFragment> HTMLImportsController::createDocumentFragment() const
-{
-    return m_importedFragmentOwner->createDocumentFragment();
-}
-
 PassRefPtr<LinkImport> HTMLImportsController::findLinkFor(const KURL& url) const
 {
     for (size_t i = 0; i < m_imports.size(); ++i) {
diff --git a/Source/core/html/HTMLImportsController.h b/Source/core/html/HTMLImportsController.h
index b9e2e2a..5bf13be 100644
--- a/Source/core/html/HTMLImportsController.h
+++ b/Source/core/html/HTMLImportsController.h
@@ -66,7 +66,7 @@
     virtual Type type() const OVERRIDE { return Import; }
     virtual void ownerRemoved() OVERRIDE;
 
-    DocumentFragment* importedFragment() const;
+    Document* importedDocument() const;
     const KURL& url() const { return m_url; }
     void importDestroyed();
     bool isDone() const { return m_state == StateReady || m_state == StateError; }
@@ -84,7 +84,7 @@
     KURL m_url;
     State m_state;
     CachedResourceHandle<CachedScript> m_resource;
-    RefPtr<DocumentFragment> m_importedFragment;
+    RefPtr<Document> m_importedDocument;
 };
 
 
@@ -98,7 +98,6 @@
 
     void addImport(PassRefPtr<LinkImport>);
     void showSecurityErrorMessage(const String&);
-    PassRefPtr<DocumentFragment> createDocumentFragment() const;
     PassRefPtr<LinkImport> findLinkFor(const KURL&) const;
     SecurityOrigin* securityOrigin() const;
     bool haveLoaded() const;
@@ -107,7 +106,6 @@
 private:
 
     Document* m_master;
-    RefPtr<Document> m_importedFragmentOwner;
 
     // List of import which has been loaded or being loaded.
     typedef Vector<RefPtr<LinkImport> > ImportList;
diff --git a/Source/core/html/HTMLInputElement.cpp b/Source/core/html/HTMLInputElement.cpp
index 9c38f7c..60b8a17 100644
--- a/Source/core/html/HTMLInputElement.cpp
+++ b/Source/core/html/HTMLInputElement.cpp
@@ -768,21 +768,24 @@
     }
 #if ENABLE(INPUT_SPEECH)
     else if (name == webkitspeechAttr) {
-        if (renderer()) {
-            // This renderer and its children have quite different layouts and styles depending on
-            // whether the speech button is visible or not. So we reset the whole thing and recreate
-            // to get the right styles and layout.
-            m_inputType->destroyShadowSubtree();
-            detach();
-            m_inputType->createShadowSubtree();
-            if (!attached())
-                attach();
-        } else {
-            m_inputType->destroyShadowSubtree();
-            m_inputType->createShadowSubtree();
+        if (m_inputType->shouldRespectSpeechAttribute() && RuntimeEnabledFeatures::speechInputEnabled()) {
+            // This renderer and its children have quite different layouts and
+            // styles depending on whether the speech button is visible or
+            // not. So we reset the whole thing and recreate to get the right
+            // styles and layout.
+            if (attached()) {
+                m_inputType->destroyShadowSubtree();
+                detach();
+                m_inputType->createShadowSubtree();
+                if (!attached())
+                    attach();
+            } else {
+                m_inputType->destroyShadowSubtree();
+                m_inputType->createShadowSubtree();
+            }
+            setFormControlValueMatchesRenderer(false);
+            setNeedsStyleRecalc();
         }
-        setFormControlValueMatchesRenderer(false);
-        setNeedsStyleRecalc();
         UseCounter::count(document(), UseCounter::PrefixedSpeechAttribute);
     } else if (name == onwebkitspeechchangeAttr)
         setAttributeEventListener(eventNames().webkitspeechchangeEvent, createAttributeEventListener(this, name, value));
@@ -818,14 +821,14 @@
     return m_inputType->createRenderer(arena, style);
 }
 
-void HTMLInputElement::attach()
+void HTMLInputElement::attach(const AttachContext& context)
 {
     PostAttachCallbackDisabler disabler(this);
 
     if (!m_hasType)
         updateType();
 
-    HTMLTextFormControlElement::attach();
+    HTMLTextFormControlElement::attach(context);
 
     m_inputType->attach();
 
@@ -833,9 +836,9 @@
         document()->updateFocusAppearanceSoon(true /* restore selection */);
 }
 
-void HTMLInputElement::detach()
+void HTMLInputElement::detach(const AttachContext& context)
 {
-    HTMLTextFormControlElement::detach();
+    HTMLTextFormControlElement::detach(context);
     setFormControlValueMatchesRenderer(false);
     m_inputType->detach();
 }
@@ -1475,18 +1478,11 @@
     addToRadioButtonGroup();
 }
 
-void HTMLInputElement::addToRadioButtonGroupCallback(Node* node)
-{
-    ASSERT(node && node->toInputElement());
-    HTMLInputElement* inputElement = node->toInputElement();
-    inputElement->addToRadioButtonGroup();
-}
-
 Node::InsertionNotificationRequest HTMLInputElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLTextFormControlElement::insertedInto(insertionPoint);
-    if (insertionPoint->inDocument() && !form() && checkedRadioButtons())
-        queueInsertionCallback(addToRadioButtonGroupCallback, this);
+    if (insertionPoint->inDocument() && !form())
+        addToRadioButtonGroup();
     resetListAttributeTargetObserver();
     return InsertionDone;
 }
diff --git a/Source/core/html/HTMLInputElement.h b/Source/core/html/HTMLInputElement.h
index d62527c..6b887b0 100644
--- a/Source/core/html/HTMLInputElement.h
+++ b/Source/core/html/HTMLInputElement.h
@@ -50,8 +50,6 @@
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitspeechchange);
 
-    virtual HTMLInputElement* toInputElement() { return this; }
-
     virtual bool shouldAutocomplete() const;
 
     // For ValidityState
@@ -189,7 +187,7 @@
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
 
     // FIXME: For isActivatedSubmit and setActivatedSubmit, we should use the NVI-idiom here by making
     // it private virtual in all classes and expose a public method in HTMLFormControlElement to call
@@ -310,7 +308,6 @@
 
     virtual void willChangeForm() OVERRIDE;
     virtual void didChangeForm() OVERRIDE;
-    static void addToRadioButtonGroupCallback(Node*);
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void removedFrom(ContainerNode*) OVERRIDE;
     virtual void didMoveToNewDocument(Document* oldDocument) OVERRIDE;
@@ -344,7 +341,7 @@
 
     virtual void copyNonAttributePropertiesFromElement(const Element&);
 
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     virtual bool appendFormData(FormDataList&, bool);
 
diff --git a/Source/core/html/HTMLLIElement.cpp b/Source/core/html/HTMLLIElement.cpp
index a31ccd1..5e05061 100644
--- a/Source/core/html/HTMLLIElement.cpp
+++ b/Source/core/html/HTMLLIElement.cpp
@@ -84,11 +84,11 @@
         HTMLElement::parseAttribute(name, value);
 }
 
-void HTMLLIElement::attach()
+void HTMLLIElement::attach(const AttachContext& context)
 {
     ASSERT(!attached());
 
-    HTMLElement::attach();
+    HTMLElement::attach(context);
 
     if (renderer() && renderer()->isListItem()) {
         RenderListItem* listItemRenderer = toRenderListItem(renderer());
diff --git a/Source/core/html/HTMLLIElement.h b/Source/core/html/HTMLLIElement.h
index 0c02ebb..32e6c4c 100644
--- a/Source/core/html/HTMLLIElement.h
+++ b/Source/core/html/HTMLLIElement.h
@@ -39,7 +39,7 @@
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     void parseValue(const AtomicString&);
 };
diff --git a/Source/core/html/HTMLLabelElement.cpp b/Source/core/html/HTMLLabelElement.cpp
index e85652f..c543eca 100644
--- a/Source/core/html/HTMLLabelElement.cpp
+++ b/Source/core/html/HTMLLabelElement.cpp
@@ -63,7 +63,7 @@
     return adoptRef(new HTMLLabelElement(tagName, document));
 }
 
-bool HTMLLabelElement::isFocusable() const
+bool HTMLLabelElement::rendererIsFocusable() const
 {
     HTMLLabelElement* that = const_cast<HTMLLabelElement*>(this);
     return that->isContentEditable();
diff --git a/Source/core/html/HTMLLabelElement.h b/Source/core/html/HTMLLabelElement.h
index 29532a8..4e239ed 100644
--- a/Source/core/html/HTMLLabelElement.h
+++ b/Source/core/html/HTMLLabelElement.h
@@ -41,7 +41,7 @@
 private:
     HTMLLabelElement(const QualifiedName&, Document*);
 
-    virtual bool isFocusable() const;
+    virtual bool rendererIsFocusable() const OVERRIDE;
 
     virtual void accessKeyAction(bool sendMouseEvents);
 
diff --git a/Source/core/html/HTMLLinkElement.cpp b/Source/core/html/HTMLLinkElement.cpp
index bb331d9..381f096 100644
--- a/Source/core/html/HTMLLinkElement.cpp
+++ b/Source/core/html/HTMLLinkElement.cpp
@@ -173,10 +173,10 @@
     return static_cast<LinkImport*>(m_link.get());
 }
 
-DocumentFragment* HTMLLinkElement::import() const
+Document* HTMLLinkElement::import() const
 {
     if (LinkImport* link = linkImport())
-        return linkImport()->importedFragment();
+        return linkImport()->importedDocument();
     return 0;
 }
 
diff --git a/Source/core/html/HTMLLinkElement.h b/Source/core/html/HTMLLinkElement.h
index 1cfa93b..a227aa5 100644
--- a/Source/core/html/HTMLLinkElement.h
+++ b/Source/core/html/HTMLLinkElement.h
@@ -140,7 +140,7 @@
     String iconSizes() const;
 
     CSSStyleSheet* sheet() const { return linkStyle() ? linkStyle()->sheet() : 0; }
-    DocumentFragment* import() const;
+    Document* import() const;
 
     bool styleSheetIsLoading() const;
 
diff --git a/Source/core/html/HTMLLinkElement.idl b/Source/core/html/HTMLLinkElement.idl
index d5db95d..0d5ee7d 100644
--- a/Source/core/html/HTMLLinkElement.idl
+++ b/Source/core/html/HTMLLinkElement.idl
@@ -34,6 +34,6 @@
     // DOM Level 2 Style
     readonly attribute StyleSheet sheet;
 
-    [EnabledAtRuntime=htmlImports] readonly attribute DocumentFragment import;
+    [EnabledAtRuntime=htmlImports] readonly attribute Document import;
 };
 
diff --git a/Source/core/html/HTMLMapElement.cpp b/Source/core/html/HTMLMapElement.cpp
index 26901cf..c7e800c 100644
--- a/Source/core/html/HTMLMapElement.cpp
+++ b/Source/core/html/HTMLMapElement.cpp
@@ -88,7 +88,7 @@
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off.
-        HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(curr);
+        HTMLImageElement* imageElement = toHTMLImageElement(curr);
         String useMapName = imageElement->getAttribute(usemapAttr).string().substring(1);
         if (equalIgnoringCase(useMapName, m_name))
             return imageElement;
diff --git a/Source/core/html/HTMLMarqueeElement.cpp b/Source/core/html/HTMLMarqueeElement.cpp
index fed12cd..e66d444 100644
--- a/Source/core/html/HTMLMarqueeElement.cpp
+++ b/Source/core/html/HTMLMarqueeElement.cpp
@@ -185,9 +185,14 @@
 
 RenderMarquee* HTMLMarqueeElement::renderMarquee() const
 {
-    if (renderer() && renderer()->hasLayer())
-        return renderBoxModelObject()->layer()->marquee();
+    if (renderer() && renderer()->isMarquee())
+        return toRenderMarquee(renderer());
     return 0;
 }
 
+RenderObject* HTMLMarqueeElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderMarquee(this);
+}
+
 } // namespace WebCore
diff --git a/Source/core/html/HTMLMarqueeElement.h b/Source/core/html/HTMLMarqueeElement.h
index a4fcee3..26188a7 100644
--- a/Source/core/html/HTMLMarqueeElement.h
+++ b/Source/core/html/HTMLMarqueeElement.h
@@ -61,6 +61,8 @@
     virtual void suspend(ReasonForSuspension);
     virtual void resume();
 
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE FINAL;
+
     RenderMarquee* renderMarquee() const;
 };
 
diff --git a/Source/core/html/HTMLMediaElement.cpp b/Source/core/html/HTMLMediaElement.cpp
index b9d4e24..530c97c 100644
--- a/Source/core/html/HTMLMediaElement.cpp
+++ b/Source/core/html/HTMLMediaElement.cpp
@@ -44,6 +44,7 @@
 #include "core/dom/EventNames.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExceptionCodePlaceholder.h"
+#include "core/dom/FullscreenController.h"
 #include "core/dom/NodeRenderingContext.h"
 #include "core/dom/WebCoreMemoryInstrumentation.h"
 #include "core/dom/shadow/ShadowRoot.h"
@@ -386,7 +387,7 @@
         return false;
 
     // If no controls specified, we should still be able to focus the element if it has tabIndex.
-    return controls() ||  HTMLElement::supportsFocus();
+    return controls() || HTMLElement::supportsFocus();
 }
 
 bool HTMLMediaElement::isMouseFocusable() const
@@ -539,11 +540,11 @@
     HTMLElement::removedFrom(insertionPoint);
 }
 
-void HTMLMediaElement::attach()
+void HTMLMediaElement::attach(const AttachContext& context)
 {
     ASSERT(!attached());
 
-    HTMLElement::attach();
+    HTMLElement::attach(context);
 
     if (renderer())
         renderer()->updateFromElement();
@@ -3492,7 +3493,7 @@
 
 bool HTMLMediaElement::isFullscreen() const
 {
-    return document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == this;
+    return FullscreenController::isActiveFullScreenElement(this);
 }
 
 void HTMLMediaElement::enterFullscreen()
@@ -3500,7 +3501,7 @@
     LOG(Media, "HTMLMediaElement::enterFullscreen");
 
     if (document()->settings() && document()->settings()->fullScreenEnabled())
-        document()->requestFullScreenForElement(this, 0, Document::ExemptIFrameAllowFullScreenRequirement);
+        FullscreenController::from(document())->requestFullScreenForElement(this, 0, FullscreenController::ExemptIFrameAllowFullScreenRequirement);
 }
 
 void HTMLMediaElement::exitFullscreen()
@@ -3508,7 +3509,7 @@
     LOG(Media, "HTMLMediaElement::exitFullscreen");
 
     if (document()->settings() && document()->settings()->fullScreenEnabled() && isFullscreen())
-        document()->webkitCancelFullScreen();
+        FullscreenController::from(document())->webkitCancelFullScreen();
 }
 
 void HTMLMediaElement::didBecomeFullscreenElement()
@@ -3523,7 +3524,7 @@
         mediaControls()->exitedFullscreen();
 }
 
-PlatformLayer* HTMLMediaElement::platformLayer() const
+WebKit::WebLayer* HTMLMediaElement::platformLayer() const
 {
     return m_player ? m_player->platformLayer() : 0;
 }
diff --git a/Source/core/html/HTMLMediaElement.h b/Source/core/html/HTMLMediaElement.h
index 89c1ad9..2bcda2a 100644
--- a/Source/core/html/HTMLMediaElement.h
+++ b/Source/core/html/HTMLMediaElement.h
@@ -36,6 +36,8 @@
 #include "core/platform/graphics/MediaPlayer.h"
 #include "public/platform/WebMimeRegistry.h"
 
+namespace WebKit { class WebLayer; }
+
 namespace WebCore {
 
 #if ENABLE(WEB_AUDIO)
@@ -84,7 +86,7 @@
 
     virtual bool supportsSave() const;
     
-    PlatformLayer* platformLayer() const;
+    WebKit::WebLayer* platformLayer() const;
 
     enum DelayedActionType {
         LoadMediaResource = 1 << 0,
@@ -292,7 +294,7 @@
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual void finishParsingChildren();
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
-    virtual void attach() OVERRIDE;
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     virtual void didMoveToNewDocument(Document* oldDocument) OVERRIDE;
 
diff --git a/Source/core/html/HTMLObjectElement.cpp b/Source/core/html/HTMLObjectElement.cpp
index bc8e546..87cf60f 100644
--- a/Source/core/html/HTMLObjectElement.cpp
+++ b/Source/core/html/HTMLObjectElement.cpp
@@ -370,7 +370,7 @@
         if (!isImageType()) {
             // If we don't think we have an image type anymore, then clear the image from the loader.
             m_imageLoader->setImage(0);
-            reattach();
+            lazyReattach();
             return;
         }
     }
@@ -378,8 +378,7 @@
     m_useFallbackContent = true;
 
     // FIXME: Style gets recalculated which is suboptimal.
-    detach();
-    attach();
+    lazyReattach();
 }
 
 // FIXME: This should be removed, all callers are almost certainly wrong.
diff --git a/Source/core/html/HTMLOptGroupElement.cpp b/Source/core/html/HTMLOptGroupElement.cpp
index dd72cae..d5bf7ad 100644
--- a/Source/core/html/HTMLOptGroupElement.cpp
+++ b/Source/core/html/HTMLOptGroupElement.cpp
@@ -53,15 +53,10 @@
     return fastHasAttribute(disabledAttr);
 }
 
-bool HTMLOptGroupElement::supportsFocus() const
-{
-    return HTMLElement::supportsFocus();
-}
-
-bool HTMLOptGroupElement::isFocusable() const
+bool HTMLOptGroupElement::rendererIsFocusable() const
 {
     // Optgroup elements do not have a renderer so we check the renderStyle instead.
-    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
+    return renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptGroupElement::formControlType() const
@@ -94,9 +89,9 @@
         toHTMLSelectElement(select)->setRecalcListItems();
 }
 
-void HTMLOptGroupElement::attach()
+void HTMLOptGroupElement::attach(const AttachContext& context)
 {
-    HTMLElement::attach();
+    HTMLElement::attach(context);
     // If after attaching nothing called styleForRenderer() on this node we
     // manually cache the value. This happens if our parent doesn't have a
     // renderer like <optgroup> or if it doesn't allow children like <select>.
@@ -104,10 +99,10 @@
         updateNonRenderStyle();
 }
 
-void HTMLOptGroupElement::detach()
+void HTMLOptGroupElement::detach(const AttachContext& context)
 {
     m_style.clear();
-    HTMLElement::detach();
+    HTMLElement::detach(context);
 }
 
 void HTMLOptGroupElement::updateNonRenderStyle()
diff --git a/Source/core/html/HTMLOptGroupElement.h b/Source/core/html/HTMLOptGroupElement.h
index c6be9d1..e3360f9 100644
--- a/Source/core/html/HTMLOptGroupElement.h
+++ b/Source/core/html/HTMLOptGroupElement.h
@@ -43,12 +43,11 @@
     HTMLOptGroupElement(const QualifiedName&, Document*);
 
     virtual const AtomicString& formControlType() const;
-    virtual bool supportsFocus() const;
-    virtual bool isFocusable() const;
+    virtual bool rendererIsFocusable() const OVERRIDE;
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
-    virtual void attach();
-    virtual void detach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/core/html/HTMLOptionElement.cpp b/Source/core/html/HTMLOptionElement.cpp
index 71a8ffc..dd763b6 100644
--- a/Source/core/html/HTMLOptionElement.cpp
+++ b/Source/core/html/HTMLOptionElement.cpp
@@ -87,9 +87,9 @@
     return element.release();
 }
 
-void HTMLOptionElement::attach()
+void HTMLOptionElement::attach(const AttachContext& context)
 {
-    HTMLElement::attach();
+    HTMLElement::attach(context);
     // If after attaching nothing called styleForRenderer() on this node we
     // manually cache the value. This happens if our parent doesn't have a
     // renderer like <optgroup> or if it doesn't allow children like <select>.
@@ -97,21 +97,16 @@
         updateNonRenderStyle();
 }
 
-void HTMLOptionElement::detach()
+void HTMLOptionElement::detach(const AttachContext& context)
 {
     m_style.clear();
-    HTMLElement::detach();
+    HTMLElement::detach(context);
 }
 
-bool HTMLOptionElement::supportsFocus() const
-{
-    return HTMLElement::supportsFocus();
-}
-
-bool HTMLOptionElement::isFocusable() const
+bool HTMLOptionElement::rendererIsFocusable() const
 {
     // Option elements do not have a renderer so we check the renderStyle instead.
-    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
+    return renderStyle() && renderStyle()->display() != NONE;
 }
 
 String HTMLOptionElement::text() const
@@ -148,7 +143,7 @@
     // Handle the common special case where there's exactly 1 child node, and it's a text node.
     Node* child = firstChild();
     if (child && child->isTextNode() && !child->nextSibling())
-        toText(child)->setData(text, ec);
+        toText(child)->setData(text);
     else {
         removeChildren();
         appendChild(Text::create(document(), text), ec);
diff --git a/Source/core/html/HTMLOptionElement.h b/Source/core/html/HTMLOptionElement.h
index b132074..5c5fd6f 100644
--- a/Source/core/html/HTMLOptionElement.h
+++ b/Source/core/html/HTMLOptionElement.h
@@ -67,11 +67,10 @@
 private:
     HTMLOptionElement(const QualifiedName&, Document*);
 
-    virtual bool supportsFocus() const;
-    virtual bool isFocusable() const;
+    virtual bool rendererIsFocusable() const OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
-    virtual void attach();
-    virtual void detach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
 
diff --git a/Source/core/html/HTMLOptionElement.idl b/Source/core/html/HTMLOptionElement.idl
index e47ca9f..d315551 100644
--- a/Source/core/html/HTMLOptionElement.idl
+++ b/Source/core/html/HTMLOptionElement.idl
@@ -20,7 +20,7 @@
 
 [
     NamedConstructor=Option([Default=NullString] optional DOMString data, [Default=NullString] optional DOMString value, [Default=Undefined] optional boolean defaultSelected, [Default=Undefined] optional boolean selected),
-    RaisesException
+    ConstructorRaisesException
 ] interface HTMLOptionElement : HTMLElement {
     [Reflect] attribute boolean disabled;
     readonly attribute HTMLFormElement form;
diff --git a/Source/core/html/HTMLPlugInElement.cpp b/Source/core/html/HTMLPlugInElement.cpp
index 0bb097b..73f7249 100644
--- a/Source/core/html/HTMLPlugInElement.cpp
+++ b/Source/core/html/HTMLPlugInElement.cpp
@@ -79,7 +79,7 @@
     return true;
 }
 
-void HTMLPlugInElement::detach()
+void HTMLPlugInElement::detach(const AttachContext& context)
 {
     m_instance.clear();
 
@@ -94,7 +94,7 @@
         m_NPObject = 0;
     }
 
-    HTMLFrameOwnerElement::detach();
+    HTMLFrameOwnerElement::detach(context);
 }
 
 void HTMLPlugInElement::resetInstance()
@@ -218,9 +218,9 @@
     return true;
 }
 
-bool HTMLPlugInElement::supportsFocus() const
+bool HTMLPlugInElement::rendererIsFocusable() const
 {
-    if (HTMLFrameOwnerElement::supportsFocus())
+    if (HTMLFrameOwnerElement::supportsFocus() && HTMLFrameOwnerElement::rendererIsFocusable())
         return true;
 
     if (useFallbackContent() || !renderer() || !renderer()->isEmbeddedObject())
diff --git a/Source/core/html/HTMLPlugInElement.h b/Source/core/html/HTMLPlugInElement.h
index 939d7f7..7a567c7 100644
--- a/Source/core/html/HTMLPlugInElement.h
+++ b/Source/core/html/HTMLPlugInElement.h
@@ -70,7 +70,7 @@
 protected:
     HTMLPlugInElement(const QualifiedName& tagName, Document*);
 
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
@@ -85,7 +85,8 @@
 
     virtual RenderWidget* renderWidgetForJSBindings() const = 0;
 
-    virtual bool supportsFocus() const OVERRIDE;
+    virtual bool supportsFocus() const OVERRIDE { return true; };
+    virtual bool rendererIsFocusable() const OVERRIDE;
 
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isPluginElement() const;
diff --git a/Source/core/html/HTMLPlugInImageElement.cpp b/Source/core/html/HTMLPlugInImageElement.cpp
index 8c782ef..622dbc2 100644
--- a/Source/core/html/HTMLPlugInImageElement.cpp
+++ b/Source/core/html/HTMLPlugInImageElement.cpp
@@ -159,7 +159,7 @@
         reattach();
 }
 
-void HTMLPlugInImageElement::attach()
+void HTMLPlugInImageElement::attach(const AttachContext& context)
 {
     PostAttachCallbackDisabler disabler(this);
 
@@ -168,7 +168,7 @@
     if (!isImage)
         queuePostAttachCallback(&HTMLPlugInImageElement::updateWidgetCallback, this);
 
-    HTMLPlugInElement::attach();
+    HTMLPlugInElement::attach(context);
 
     if (isImage && renderer() && !useFallbackContent()) {
         if (!m_imageLoader)
@@ -177,7 +177,7 @@
     }
 }
 
-void HTMLPlugInImageElement::detach()
+void HTMLPlugInImageElement::detach(const AttachContext& context)
 {
     // FIXME: Because of the insanity that is HTMLPlugInImageElement::recalcStyle,
     // we can end up detaching during an attach() call, before we even have a
@@ -185,7 +185,7 @@
     if (attached() && renderer() && !useFallbackContent())
         // Update the widget the next time we attach (detaching destroys the plugin).
         setNeedsWidgetUpdate(true);
-    HTMLPlugInElement::detach();
+    HTMLPlugInElement::detach(context);
 }
 
 void HTMLPlugInImageElement::updateWidgetIfNecessary()
diff --git a/Source/core/html/HTMLPlugInImageElement.h b/Source/core/html/HTMLPlugInImageElement.h
index fa84ad7..4f5ae54 100644
--- a/Source/core/html/HTMLPlugInImageElement.h
+++ b/Source/core/html/HTMLPlugInImageElement.h
@@ -89,8 +89,8 @@
     KURL m_loadedUrl;
     
     static void updateWidgetCallback(Node*);
-    virtual void attach();
-    virtual void detach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
 
     bool allowedToLoadFrameURL(const String& url);
     bool wouldLoadAsNetscapePlugin(const String& url, const String& serviceType);
diff --git a/Source/core/html/HTMLProgressElement.cpp b/Source/core/html/HTMLProgressElement.cpp
index 11579e0..17e7890 100644
--- a/Source/core/html/HTMLProgressElement.cpp
+++ b/Source/core/html/HTMLProgressElement.cpp
@@ -90,9 +90,9 @@
         LabelableElement::parseAttribute(name, value);
 }
 
-void HTMLProgressElement::attach()
+void HTMLProgressElement::attach(const AttachContext& context)
 {
-    LabelableElement::attach();
+    LabelableElement::attach(context);
     if (RenderProgress* render = renderProgress())
         render->updateFromElement();
 }
diff --git a/Source/core/html/HTMLProgressElement.h b/Source/core/html/HTMLProgressElement.h
index 839aef1..42e3287 100644
--- a/Source/core/html/HTMLProgressElement.h
+++ b/Source/core/html/HTMLProgressElement.h
@@ -59,7 +59,7 @@
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
 
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     void didElementStateChange();
     virtual void didAddUserAgentShadowRoot(ShadowRoot*) OVERRIDE;
diff --git a/Source/core/html/HTMLScriptElement.cpp b/Source/core/html/HTMLScriptElement.cpp
index bf60a04..c0fbc1f 100644
--- a/Source/core/html/HTMLScriptElement.cpp
+++ b/Source/core/html/HTMLScriptElement.cpp
@@ -85,7 +85,7 @@
     int numChildren = childNodeCount();
 
     if (numChildren == 1 && firstChild()->isTextNode()) {
-        toText(firstChild())->setData(value, IGNORE_EXCEPTION);
+        toText(firstChild())->setData(value);
         return;
     }
 
diff --git a/Source/core/html/HTMLScriptElement.h b/Source/core/html/HTMLScriptElement.h
index dd1c1f6..153f271 100644
--- a/Source/core/html/HTMLScriptElement.h
+++ b/Source/core/html/HTMLScriptElement.h
@@ -67,6 +67,12 @@
     virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren();
 };
 
+inline HTMLScriptElement* toHTMLScriptElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::scriptTag));
+    return static_cast<HTMLScriptElement*>(node);
+}
+
 } //namespace
 
 #endif
diff --git a/Source/core/html/HTMLSelectElement.cpp b/Source/core/html/HTMLSelectElement.cpp
index 7d8288d..017631e 100644
--- a/Source/core/html/HTMLSelectElement.cpp
+++ b/Source/core/html/HTMLSelectElement.cpp
@@ -346,8 +346,8 @@
     if (!HTMLFormControlElementWithState::childShouldCreateRenderer(childContext))
         return false;
     if (!usesMenuList())
-        return childContext.node()->hasTagName(HTMLNames::optionTag) || childContext.node()->hasTagName(HTMLNames::optgroupTag) || validationMessageShadowTreeContains(childContext.node());
-    return validationMessageShadowTreeContains(childContext.node());
+        return childContext.node()->hasTagName(HTMLNames::optionTag) || childContext.node()->hasTagName(HTMLNames::optgroupTag);
+    return false;
 }
 
 PassRefPtr<HTMLCollection> HTMLSelectElement::selectedOptions()
diff --git a/Source/core/html/HTMLSourceElement.idl b/Source/core/html/HTMLSourceElement.idl
index 763a084..4502f86 100644
--- a/Source/core/html/HTMLSourceElement.idl
+++ b/Source/core/html/HTMLSourceElement.idl
@@ -24,7 +24,7 @@
  */
 
 [
-    NoInterfaceObject
+    EnabledAtRuntime=media
 ] interface HTMLSourceElement : HTMLElement {
 [Reflect, URL] attribute DOMString src;
     attribute DOMString type;
diff --git a/Source/core/html/HTMLStyleElement.cpp b/Source/core/html/HTMLStyleElement.cpp
index e32e8e4..7d7ba3f 100644
--- a/Source/core/html/HTMLStyleElement.cpp
+++ b/Source/core/html/HTMLStyleElement.cpp
@@ -234,19 +234,18 @@
     setBooleanAttribute(scopedAttr, scopedValue);
 }
 
-Element* HTMLStyleElement::scopingElement() const
+ContainerNode* HTMLStyleElement::scopingNode()
 {
-    if (!scoped())
+    if (!inDocument())
         return 0;
 
-    // FIXME: This probably needs to be refined for scoped stylesheets within shadow DOM.
-    // As written, such a stylesheet could style the host element, as well as children of the host.
-    // OTOH, this paves the way for a :bound-element implementation.
-    ContainerNode* parentOrShadowHost = parentOrShadowHostNode();
-    if (!parentOrShadowHost || !parentOrShadowHost->isElementNode())
-        return 0;
+    if (!isRegisteredAsScoped())
+        return document();
 
-    return toElement(parentOrShadowHost);
+    if (isRegisteredInShadowRoot())
+        return containingShadowRoot();
+
+    return parentNode();
 }
 
 void HTMLStyleElement::dispatchPendingLoadEvents()
diff --git a/Source/core/html/HTMLStyleElement.h b/Source/core/html/HTMLStyleElement.h
index f96c113..ba2bcf1 100644
--- a/Source/core/html/HTMLStyleElement.h
+++ b/Source/core/html/HTMLStyleElement.h
@@ -43,7 +43,7 @@
 
     bool scoped() const;
     void setScoped(bool);
-    Element* scopingElement() const;
+    ContainerNode* scopingNode();
     bool isRegisteredAsScoped() const
     {
         // Note: We cannot rely on the 'scoped' attribute still being present when this method is invoked.
diff --git a/Source/core/html/HTMLTextAreaElement.cpp b/Source/core/html/HTMLTextAreaElement.cpp
index 62c6eca..6ba0903 100644
--- a/Source/core/html/HTMLTextAreaElement.cpp
+++ b/Source/core/html/HTMLTextAreaElement.cpp
@@ -519,9 +519,9 @@
     return m_placeholder;
 }
 
-void HTMLTextAreaElement::attach()
+void HTMLTextAreaElement::attach(const AttachContext& context)
 {
-    HTMLTextFormControlElement::attach();
+    HTMLTextFormControlElement::attach(context);
     fixPlaceholderRenderer(m_placeholder, innerTextElement());
 }
 
diff --git a/Source/core/html/HTMLTextAreaElement.h b/Source/core/html/HTMLTextAreaElement.h
index 4857fdf..4a5efac 100644
--- a/Source/core/html/HTMLTextAreaElement.h
+++ b/Source/core/html/HTMLTextAreaElement.h
@@ -111,7 +111,7 @@
     virtual void accessKeyAction(bool sendMouseEvents);
 
     virtual bool shouldUseInputMethod();
-    virtual void attach() OVERRIDE;
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool matchesReadOnlyPseudoClass() const OVERRIDE;
     virtual bool matchesReadWritePseudoClass() const OVERRIDE;
 
diff --git a/Source/core/html/HTMLTitleElement.cpp b/Source/core/html/HTMLTitleElement.cpp
index c161612..14e02ca 100644
--- a/Source/core/html/HTMLTitleElement.cpp
+++ b/Source/core/html/HTMLTitleElement.cpp
@@ -103,7 +103,7 @@
     int numChildren = childNodeCount();
     
     if (numChildren == 1 && firstChild()->isTextNode())
-        toText(firstChild())->setData(value, IGNORE_EXCEPTION);
+        toText(firstChild())->setData(value);
     else {
         // We make a copy here because entity of "value" argument can be Document::m_title,
         // which goes empty during removeChildren() invocation below,
diff --git a/Source/core/html/HTMLVideoElement.cpp b/Source/core/html/HTMLVideoElement.cpp
index edb678b..de51bcf 100644
--- a/Source/core/html/HTMLVideoElement.cpp
+++ b/Source/core/html/HTMLVideoElement.cpp
@@ -69,9 +69,9 @@
     return new (arena) RenderVideo(this);
 }
 
-void HTMLVideoElement::attach()
+void HTMLVideoElement::attach(const AttachContext& context)
 {
-    HTMLMediaElement::attach();
+    HTMLMediaElement::attach(context);
 
     updateDisplayState();
     if (shouldDisplayPosterImage()) {
diff --git a/Source/core/html/HTMLVideoElement.h b/Source/core/html/HTMLVideoElement.h
index 63d42b7..d2ded02 100644
--- a/Source/core/html/HTMLVideoElement.h
+++ b/Source/core/html/HTMLVideoElement.h
@@ -73,7 +73,7 @@
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
diff --git a/Source/core/html/LinkResource.h b/Source/core/html/LinkResource.h
index aa3afd3..a4acde8 100644
--- a/Source/core/html/LinkResource.h
+++ b/Source/core/html/LinkResource.h
@@ -32,7 +32,7 @@
 #define LinkResource_h
 
 #include "core/loader/cache/CachedResourceRequest.h"
-#include "core/platform/KURL.h"
+#include "weborigin/KURL.h"
 #include "wtf/Forward.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
diff --git a/Source/core/html/MediaController.idl b/Source/core/html/MediaController.idl
index cedb4c3..54c4153 100644
--- a/Source/core/html/MediaController.idl
+++ b/Source/core/html/MediaController.idl
@@ -24,9 +24,9 @@
  */
 
 [
-    NoInterfaceObject,
+    EnabledAtRuntime=media,
     Constructor,
-    CallWith=ScriptExecutionContext,
+    ConstructorCallWith=ScriptExecutionContext,
     EventTarget
 ] interface MediaController {
     readonly attribute TimeRanges buffered;
diff --git a/Source/core/html/MediaError.idl b/Source/core/html/MediaError.idl
index 0e12164..16d339f 100644
--- a/Source/core/html/MediaError.idl
+++ b/Source/core/html/MediaError.idl
@@ -24,7 +24,7 @@
  */
 
 [
-    NoInterfaceObject
+    EnabledAtRuntime=media
 ] interface MediaError {
       const unsigned short MEDIA_ERR_ABORTED = 1;
       const unsigned short MEDIA_ERR_NETWORK = 2;
diff --git a/Source/core/html/MediaFragmentURIParser.h b/Source/core/html/MediaFragmentURIParser.h
index 509adb9..5d5be04 100644
--- a/Source/core/html/MediaFragmentURIParser.h
+++ b/Source/core/html/MediaFragmentURIParser.h
@@ -26,9 +26,9 @@
 #ifndef MediaFragmentURIParser_h
 #define MediaFragmentURIParser_h
 
-#include "core/platform/KURL.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
+#include "weborigin/KURL.h"
+#include "wtf/PassOwnPtr.h"
+#include "wtf/Vector.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/PluginDocument.cpp b/Source/core/html/PluginDocument.cpp
index 4b4597a..ad47278 100644
--- a/Source/core/html/PluginDocument.cpp
+++ b/Source/core/html/PluginDocument.cpp
@@ -159,13 +159,13 @@
     return m_pluginNode.get();
 }
 
-void PluginDocument::detach()
+void PluginDocument::detach(const AttachContext& context)
 {
     // Release the plugin node so that we don't have a circular reference.
     m_pluginNode = 0;
     if (FrameLoader* loader = frame()->loader())
         loader->client()->redirectDataToPlugin(0);
-    HTMLDocument::detach();
+    HTMLDocument::detach(context);
 }
 
 void PluginDocument::cancelManualPluginLoad()
diff --git a/Source/core/html/PluginDocument.h b/Source/core/html/PluginDocument.h
index 98c6ef0..bd74d2c 100644
--- a/Source/core/html/PluginDocument.h
+++ b/Source/core/html/PluginDocument.h
@@ -44,7 +44,7 @@
     Widget* pluginWidget();
     Node* pluginNode();
 
-    virtual void detach() OVERRIDE;
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
 
     void cancelManualPluginLoad();
 
diff --git a/Source/core/html/PublicURLManager.cpp b/Source/core/html/PublicURLManager.cpp
index 5b5250d..0135038 100644
--- a/Source/core/html/PublicURLManager.cpp
+++ b/Source/core/html/PublicURLManager.cpp
@@ -28,7 +28,7 @@
 #include "core/html/PublicURLManager.h"
 
 #include "core/html/URLRegistry.h"
-#include "core/platform/KURL.h"
+#include "weborigin/KURL.h"
 #include "wtf/text/StringHash.h"
 
 namespace WebCore {
diff --git a/Source/core/html/RadioNodeList.cpp b/Source/core/html/RadioNodeList.cpp
index 9e0b10b..66fd5dc 100644
--- a/Source/core/html/RadioNodeList.cpp
+++ b/Source/core/html/RadioNodeList.cpp
@@ -52,8 +52,10 @@
 static inline HTMLInputElement* toRadioButtonInputElement(Node* node)
 {
     ASSERT(node->isElementNode());
-    HTMLInputElement* inputElement = node->toInputElement();
-    if (!inputElement || !inputElement->isRadioButton() || inputElement->value().isEmpty())
+    if (!node->hasTagName(inputTag))
+        return 0;
+    HTMLInputElement* inputElement = toHTMLInputElement(node);
+    if (!inputElement->isRadioButton() || inputElement->value().isEmpty())
         return 0;
     return inputElement;
 }
@@ -103,10 +105,8 @@
     if (!testElement->hasTagName(objectTag) && !testElement->isFormControlElement())
         return false;
 
-    if (HTMLInputElement* inputElement = testElement->toInputElement()) {
-        if (inputElement->isImageButton())
-            return false;
-    }
+    if (testElement->hasTagName(inputTag) && toHTMLInputElement(testElement)->isImageButton())
+        return false;
 
     return checkElementMatchesRadioNodeListFilter(testElement);
 }
diff --git a/Source/core/html/RangeInputType.cpp b/Source/core/html/RangeInputType.cpp
index 476f011..e96c490 100644
--- a/Source/core/html/RangeInputType.cpp
+++ b/Source/core/html/RangeInputType.cpp
@@ -286,7 +286,8 @@
     // Sanitize the value.
     if (element()->hasDirtyValue())
         element()->setValue(element()->value());
-    element()->setNeedsStyleRecalc();
+
+    sliderThumbElementOf(element())->setPositionFromValue();
 }
 
 void RangeInputType::setValue(const String& value, bool valueChanged, TextFieldEventBehavior eventBehavior)
diff --git a/Source/core/html/TimeRanges.idl b/Source/core/html/TimeRanges.idl
index eba7735..c6ad136 100644
--- a/Source/core/html/TimeRanges.idl
+++ b/Source/core/html/TimeRanges.idl
@@ -24,7 +24,7 @@
  */
 
 [
-    NoInterfaceObject
+    EnabledAtRuntime=media
 ] interface TimeRanges {
     readonly attribute unsigned long length;
     [RaisesException] double start(unsigned long index);
diff --git a/Source/core/html/URL.idl b/Source/core/html/URL.idl
index 7e5e300..b631c4c 100644
--- a/Source/core/html/URL.idl
+++ b/Source/core/html/URL.idl
@@ -29,6 +29,7 @@
     Constructor,
     ImplementedAs=DOMURL
 ] interface URL {
+    [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(MediaSource? source);
     [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(WebKitMediaSource? source);
     [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(MediaStream? stream);
     [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(Blob? blob);
diff --git a/Source/core/html/ValidationMessage.cpp b/Source/core/html/ValidationMessage.cpp
index 568b3c3..83cf399 100644
--- a/Source/core/html/ValidationMessage.cpp
+++ b/Source/core/html/ValidationMessage.cpp
@@ -31,26 +31,14 @@
 #include "config.h"
 #include "core/html/ValidationMessage.h"
 
-#include "CSSPropertyNames.h"
-#include "CSSValueKeywords.h"
-#include "HTMLNames.h"
-#include "core/dom/ExceptionCodePlaceholder.h"
-#include "core/dom/Text.h"
-#include "core/dom/shadow/ShadowRoot.h"
-#include "core/html/HTMLBRElement.h"
-#include "core/html/HTMLDivElement.h"
 #include "core/html/HTMLFormControlElement.h"
 #include "core/page/Page.h"
 #include "core/page/Settings.h"
 #include "core/page/ValidationMessageClient.h"
-#include "core/rendering/RenderBlock.h"
-#include "core/rendering/RenderObject.h"
-#include <wtf/PassOwnPtr.h>
+#include "wtf/PassOwnPtr.h"
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
 ALWAYS_INLINE ValidationMessage::ValidationMessage(HTMLFormControlElement* element)
     : m_element(element)
 {
@@ -59,12 +47,8 @@
 
 ValidationMessage::~ValidationMessage()
 {
-    if (ValidationMessageClient* client = validationMessageClient()) {
+    if (ValidationMessageClient* client = validationMessageClient())
         client->hideValidationMessage(*m_element);
-        return;
-    }
-
-    deleteBubbleTree();
 }
 
 PassOwnPtr<ValidationMessage> ValidationMessage::create(HTMLFormControlElement* element)
@@ -74,181 +58,36 @@
 
 ValidationMessageClient* ValidationMessage::validationMessageClient() const
 {
-    if (Page* page = m_element->document()->page())
-        return page->validationMessageClient();
-    return 0;
+    Page* page = m_element->document()->page();
+    if (!page)
+        return 0;
+    // The form valdiation feature requires ValidationMessageClient.
+    ASSERT(page->validationMessageClient());
+    return page->validationMessageClient();
 }
 
 void ValidationMessage::updateValidationMessage(const String& message)
 {
-    String updatedMessage = message;
-    if (!validationMessageClient()) {
-        // HTML5 specification doesn't ask UA to show the title attribute value
-        // with the validationMessage. However, this behavior is same as Opera
-        // and the specification describes such behavior as an example.
-        const AtomicString& title = m_element->fastGetAttribute(titleAttr);
-        if (!updatedMessage.isEmpty() && !title.isEmpty()) {
-            updatedMessage.append('\n');
-            updatedMessage.append(title);
-        }
-    }
-
-    if (updatedMessage.isEmpty()) {
+    ValidationMessageClient* client = validationMessageClient();
+    if (!client)
+        return;
+    if (message.isEmpty())
         requestToHideMessage();
-        return;
-    }
-    setMessage(updatedMessage);
-}
-
-void ValidationMessage::setMessage(const String& message)
-{
-    if (ValidationMessageClient* client = validationMessageClient()) {
-        client->showValidationMessage(*m_element, message);
-        return;
-    }
-
-    // Don't modify the DOM tree in this context.
-    // If so, an assertion in Node::isFocusable() fails.
-    ASSERT(!message.isEmpty());
-    m_message = message;
-    if (!m_bubble)
-        m_timer = adoptPtr(new Timer<ValidationMessage>(this, &ValidationMessage::buildBubbleTree));
     else
-        m_timer = adoptPtr(new Timer<ValidationMessage>(this, &ValidationMessage::setMessageDOMAndStartTimer));
-    m_timer->startOneShot(0);
-}
-
-void ValidationMessage::setMessageDOMAndStartTimer(Timer<ValidationMessage>*)
-{
-    ASSERT(!validationMessageClient());
-    ASSERT(m_messageHeading);
-    ASSERT(m_messageBody);
-    m_messageHeading->removeChildren();
-    m_messageBody->removeChildren();
-    Vector<String> lines;
-    m_message.split('\n', lines);
-    Document* doc = m_messageHeading->document();
-    for (unsigned i = 0; i < lines.size(); ++i) {
-        if (i) {
-            m_messageBody->appendChild(Text::create(doc, lines[i]), ASSERT_NO_EXCEPTION);
-            if (i < lines.size() - 1)
-                m_messageBody->appendChild(HTMLBRElement::create(doc), ASSERT_NO_EXCEPTION);
-        } else
-            m_messageHeading->setInnerText(lines[i], ASSERT_NO_EXCEPTION);
-    }
-
-    int magnification = doc->page() ? doc->page()->settings()->validationMessageTimerMagnification() : -1;
-    if (magnification <= 0)
-        m_timer.clear();
-    else {
-        m_timer = adoptPtr(new Timer<ValidationMessage>(this, &ValidationMessage::deleteBubbleTree));
-        m_timer->startOneShot(max(5.0, static_cast<double>(m_message.length()) * magnification / 1000));
-    }
-}
-
-static void adjustBubblePosition(const LayoutRect& hostRect, HTMLElement* bubble)
-{
-    ASSERT(bubble);
-    if (hostRect.isEmpty())
-        return;
-    double hostX = hostRect.x();
-    double hostY = hostRect.y();
-    if (RenderObject* renderer = bubble->renderer()) {
-        if (RenderBox* container = renderer->containingBlock()) {
-            FloatPoint containerLocation = container->localToAbsolute();
-            hostX -= containerLocation.x() + container->borderLeft();
-            hostY -= containerLocation.y() + container->borderTop();
-        }
-    }
-
-    bubble->setInlineStyleProperty(CSSPropertyTop, hostY + hostRect.height(), CSSPrimitiveValue::CSS_PX);
-    // The 'left' value of ::-webkit-validation-bubble-arrow.
-    const int bubbleArrowTopOffset = 32;
-    double bubbleX = hostX;
-    if (hostRect.width() / 2 < bubbleArrowTopOffset)
-        bubbleX = max(hostX + hostRect.width() / 2 - bubbleArrowTopOffset, 0.0);
-    bubble->setInlineStyleProperty(CSSPropertyLeft, bubbleX, CSSPrimitiveValue::CSS_PX);
-}
-
-void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
-{
-    ASSERT(!validationMessageClient());
-    ShadowRoot* shadowRoot = m_element->ensureUserAgentShadowRoot();
-
-    Document* doc = m_element->document();
-    m_bubble = HTMLDivElement::create(doc);
-    m_bubble->setPseudo(AtomicString("-webkit-validation-bubble", AtomicString::ConstructFromLiteral));
-    // Need to force position:absolute because RenderMenuList doesn't assume it
-    // contains non-absolute or non-fixed renderers as children.
-    m_bubble->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
-    shadowRoot->appendChild(m_bubble.get(), ASSERT_NO_EXCEPTION);
-    m_element->document()->updateLayout();
-    adjustBubblePosition(m_element->boundingBox(), m_bubble.get());
-
-    RefPtr<HTMLDivElement> clipper = HTMLDivElement::create(doc);
-    clipper->setPseudo(AtomicString("-webkit-validation-bubble-arrow-clipper", AtomicString::ConstructFromLiteral));
-    RefPtr<HTMLDivElement> bubbleArrow = HTMLDivElement::create(doc);
-    bubbleArrow->setPseudo(AtomicString("-webkit-validation-bubble-arrow", AtomicString::ConstructFromLiteral));
-    clipper->appendChild(bubbleArrow.release(), ASSERT_NO_EXCEPTION);
-    m_bubble->appendChild(clipper.release(), ASSERT_NO_EXCEPTION);
-
-    RefPtr<HTMLElement> message = HTMLDivElement::create(doc);
-    message->setPseudo(AtomicString("-webkit-validation-bubble-message", AtomicString::ConstructFromLiteral));
-    RefPtr<HTMLElement> icon = HTMLDivElement::create(doc);
-    icon->setPseudo(AtomicString("-webkit-validation-bubble-icon", AtomicString::ConstructFromLiteral));
-    message->appendChild(icon.release(), ASSERT_NO_EXCEPTION);
-    RefPtr<HTMLElement> textBlock = HTMLDivElement::create(doc);
-    textBlock->setPseudo(AtomicString("-webkit-validation-bubble-text-block", AtomicString::ConstructFromLiteral));
-    m_messageHeading = HTMLDivElement::create(doc);
-    m_messageHeading->setPseudo(AtomicString("-webkit-validation-bubble-heading", AtomicString::ConstructFromLiteral));
-    textBlock->appendChild(m_messageHeading, ASSERT_NO_EXCEPTION);
-    m_messageBody = HTMLDivElement::create(doc);
-    m_messageBody->setPseudo(AtomicString("-webkit-validation-bubble-body", AtomicString::ConstructFromLiteral));
-    textBlock->appendChild(m_messageBody, ASSERT_NO_EXCEPTION);
-    message->appendChild(textBlock.release(), ASSERT_NO_EXCEPTION);
-    m_bubble->appendChild(message.release(), ASSERT_NO_EXCEPTION);
-
-    setMessageDOMAndStartTimer();
-
-    // FIXME: Use transition to show the bubble.
+        client->showValidationMessage(*m_element, message);
 }
 
 void ValidationMessage::requestToHideMessage()
 {
-    if (ValidationMessageClient* client = validationMessageClient()) {
+    if (ValidationMessageClient* client = validationMessageClient())
         client->hideValidationMessage(*m_element);
-        return;
-    }
-
-    // We must not modify the DOM tree in this context by the same reason as setMessage().
-    m_timer = adoptPtr(new Timer<ValidationMessage>(this, &ValidationMessage::deleteBubbleTree));
-    m_timer->startOneShot(0);
-}
-
-bool ValidationMessage::shadowTreeContains(Node* node) const
-{
-    if (validationMessageClient() || !m_bubble)
-        return false;
-    return m_bubble->treeScope() == node->treeScope();
-}
-
-void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
-{
-    ASSERT(!validationMessageClient());
-    if (m_bubble) {
-        m_messageHeading = 0;
-        m_messageBody = 0;
-        m_element->userAgentShadowRoot()->removeChild(m_bubble.get(), ASSERT_NO_EXCEPTION);
-        m_bubble = 0;
-    }
-    m_message = String();
 }
 
 bool ValidationMessage::isVisible() const
 {
     if (ValidationMessageClient* client = validationMessageClient())
         return client->isValidationMessageVisible(*m_element);
-    return !m_message.isEmpty();
+    return false;
 }
 
 } // namespace WebCore
diff --git a/Source/core/html/ValidationMessage.h b/Source/core/html/ValidationMessage.h
index 83c7f26..5c47055 100644
--- a/Source/core/html/ValidationMessage.h
+++ b/Source/core/html/ValidationMessage.h
@@ -31,21 +31,17 @@
 #ifndef ValidationMessage_h
 #define ValidationMessage_h
 
-#include "core/platform/Timer.h"
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/text/WTFString.h>
+#include "wtf/FastAllocBase.h"
+#include "wtf/Forward.h"
+#include "wtf/Noncopyable.h"
 
 namespace WebCore {
 
-class HTMLElement;
 class HTMLFormControlElement;
 class Node;
 class ValidationMessageClient;
 
-// FIXME: We should remove the code for !validationMessageClient() when all
-// ports supporting interactive validation switch to ValidationMessageClient.
+// FIXME: Fold this class into HTMLFormControlElement. This class is very small.
 class ValidationMessage {
     WTF_MAKE_NONCOPYABLE(ValidationMessage); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -54,22 +50,12 @@
     void updateValidationMessage(const String&);
     void requestToHideMessage();
     bool isVisible() const;
-    bool shadowTreeContains(Node*) const;
 
 private:
     ValidationMessage(HTMLFormControlElement*);
     ValidationMessageClient* validationMessageClient() const;
-    void setMessage(const String&);
-    void setMessageDOMAndStartTimer(Timer<ValidationMessage>* = 0);
-    void buildBubbleTree(Timer<ValidationMessage>*);
-    void deleteBubbleTree(Timer<ValidationMessage>* = 0);
 
     HTMLFormControlElement* m_element;
-    String m_message;
-    OwnPtr<Timer<ValidationMessage> > m_timer;
-    RefPtr<HTMLElement> m_bubble;
-    RefPtr<HTMLElement> m_messageHeading;
-    RefPtr<HTMLElement> m_messageBody;
 };
 
 } // namespace WebCore
diff --git a/Source/core/html/canvas/ANGLEInstancedArrays.cpp b/Source/core/html/canvas/ANGLEInstancedArrays.cpp
new file mode 100644
index 0000000..0d3ce90
--- /dev/null
+++ b/Source/core/html/canvas/ANGLEInstancedArrays.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "core/html/canvas/ANGLEInstancedArrays.h"
+
+#include "core/html/canvas/WebGLRenderingContext.h"
+#include "core/platform/graphics/Extensions3D.h"
+
+namespace WebCore {
+
+ANGLEInstancedArrays::ANGLEInstancedArrays(WebGLRenderingContext* context)
+    : WebGLExtension(context)
+{
+    ScriptWrappable::init(this);
+    context->graphicsContext3D()->getExtensions()->ensureEnabled("GL_ANGLE_instanced_arrays");
+}
+
+ANGLEInstancedArrays::~ANGLEInstancedArrays()
+{
+}
+
+WebGLExtension::ExtensionName ANGLEInstancedArrays::getName() const
+{
+    return ANGLEInstancedArraysName;
+}
+
+PassRefPtr<ANGLEInstancedArrays> ANGLEInstancedArrays::create(WebGLRenderingContext* context)
+{
+    return adoptRef(new ANGLEInstancedArrays(context));
+}
+
+bool ANGLEInstancedArrays::supported(WebGLRenderingContext* context)
+{
+    Extensions3D* extensions = context->graphicsContext3D()->getExtensions();
+    return extensions->supports("GL_ANGLE_instanced_arrays");
+}
+
+const char* ANGLEInstancedArrays::getExtensionName()
+{
+    return "ANGLE_instanced_arrays";
+}
+
+void ANGLEInstancedArrays::drawArraysInstancedANGLE(GC3Denum mode, GC3Dint first, GC3Dsizei count, GC3Dsizei primcount)
+{
+    m_context->drawArraysInstancedANGLE(mode, first, count, primcount);
+}
+
+void ANGLEInstancedArrays::drawElementsInstancedANGLE(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset, GC3Dsizei primcount)
+{
+    m_context->drawElementsInstancedANGLE(mode, count, type, offset, primcount);
+}
+
+void ANGLEInstancedArrays::vertexAttribDivisorANGLE(GC3Duint index, GC3Duint divisor)
+{
+    m_context->vertexAttribDivisorANGLE(index, divisor);
+}
+
+} // namespace WebCore
diff --git a/Source/core/html/canvas/ANGLEInstancedArrays.h b/Source/core/html/canvas/ANGLEInstancedArrays.h
new file mode 100644
index 0000000..e5ad34e
--- /dev/null
+++ b/Source/core/html/canvas/ANGLEInstancedArrays.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef ANGLEInstancedArrays_h
+#define ANGLEInstancedArrays_h
+
+#include "bindings/v8/ScriptWrappable.h"
+#include "core/html/canvas/WebGLExtension.h"
+#include "core/platform/graphics/GraphicsTypes3D.h"
+#include "wtf/PassRefPtr.h"
+
+namespace WebCore {
+
+class WebGLRenderingContext;
+
+class ANGLEInstancedArrays : public WebGLExtension, public ScriptWrappable {
+public:
+    static PassRefPtr<ANGLEInstancedArrays> create(WebGLRenderingContext*);
+    static bool supported(WebGLRenderingContext*);
+    static const char* getExtensionName();
+
+    virtual ~ANGLEInstancedArrays();
+    virtual ExtensionName getName() const;
+
+    void drawArraysInstancedANGLE(GC3Denum mode, GC3Dint first, GC3Dsizei count, GC3Dsizei primcount);
+    void drawElementsInstancedANGLE(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset, GC3Dsizei primcount);
+    void vertexAttribDivisorANGLE(GC3Duint index, GC3Duint divisor);
+
+private:
+    ANGLEInstancedArrays(WebGLRenderingContext*);
+};
+
+} // namespace WebCore
+
+#endif // ANGLEInstancedArrays_h
diff --git a/Source/core/html/canvas/ANGLEInstancedArrays.idl b/Source/core/html/canvas/ANGLEInstancedArrays.idl
new file mode 100644
index 0000000..487b8cd
--- /dev/null
+++ b/Source/core/html/canvas/ANGLEInstancedArrays.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+[
+    NoInterfaceObject,
+    DoNotCheckConstants
+] interface ANGLEInstancedArrays {
+    const unsigned long VERTEX_ATTRIB_ARRAY_DIVISOR_ANGLE = 0x88FE;
+
+    [StrictTypeChecking] void drawArraysInstancedANGLE(unsigned long mode, long first, long count, long primcount);
+    [StrictTypeChecking] void drawElementsInstancedANGLE(unsigned long mode, long count, unsigned long type, long long offset, long primcount);
+    [StrictTypeChecking] void vertexAttribDivisorANGLE(unsigned long index, long divisor); 
+};
diff --git a/Source/core/html/canvas/CanvasRenderingContext.h b/Source/core/html/canvas/CanvasRenderingContext.h
index f9846f9..d8abb8e 100644
--- a/Source/core/html/canvas/CanvasRenderingContext.h
+++ b/Source/core/html/canvas/CanvasRenderingContext.h
@@ -33,6 +33,8 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/text/StringHash.h>
 
+namespace WebKit { class WebLayer; }
+
 namespace WebCore {
 
 class CanvasPattern;
@@ -58,7 +60,7 @@
 
     virtual void paintRenderingResultsToCanvas() {}
 
-    virtual PlatformLayer* platformLayer() const { return 0; }
+    virtual WebKit::WebLayer* platformLayer() const { return 0; }
 
 protected:
     CanvasRenderingContext(HTMLCanvasElement*);
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.cpp b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
index c053ae7..89ea17d 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
@@ -58,15 +58,14 @@
 #include "core/page/Page.h"
 #include "core/page/Settings.h"
 #include "core/platform/FloatConversion.h"
-#include "core/platform/KURL.h"
 #include "core/platform/graphics/FloatQuad.h"
 #include "core/platform/graphics/FontCache.h"
 #include "core/platform/graphics/GraphicsContextStateSaver.h"
-#include "core/platform/graphics/StrokeStyleApplier.h"
 #include "core/platform/graphics/TextRun.h"
 #include "core/platform/graphics/transforms/AffineTransform.h"
 #include "core/rendering/RenderHTMLCanvas.h"
 #include "core/rendering/RenderLayer.h"
+#include "weborigin/KURL.h"
 #include "weborigin/SecurityOrigin.h"
 
 #include <wtf/CheckedArithmetic.h>
@@ -95,30 +94,6 @@
     return !securityOrigin->taintsCanvas(cachedImage->response().url());
 }
 
-class CanvasStrokeStyleApplier : public StrokeStyleApplier {
-public:
-    CanvasStrokeStyleApplier(CanvasRenderingContext2D* canvasContext)
-        : m_canvasContext(canvasContext)
-    {
-    }
-
-    virtual void strokeStyle(GraphicsContext* c)
-    {
-        c->setStrokeThickness(m_canvasContext->lineWidth());
-        c->setLineCap(m_canvasContext->getLineCap());
-        c->setLineJoin(m_canvasContext->getLineJoin());
-        c->setMiterLimit(m_canvasContext->miterLimit());
-        const Vector<float>& lineDash = m_canvasContext->getLineDash();
-        DashArray convertedLineDash(lineDash.size());
-        for (size_t i = 0; i < lineDash.size(); ++i)
-            convertedLineDash[i] = static_cast<DashArrayElement>(lineDash[i]);
-        c->setLineDash(convertedLineDash, m_canvasContext->lineDashOffset());
-    }
-
-private:
-    CanvasRenderingContext2D* m_canvasContext;
-};
-
 CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas, const Canvas2DContextAttributes* attrs, bool usesCSSCompatibilityParseMode)
     : CanvasRenderingContext(canvas)
     , m_stateStack(1)
@@ -751,7 +726,7 @@
         return;
 
     realizeSaves();
-    
+
     c->setCTM(canvas()->baseTransform());
     modifiableState().m_transform = AffineTransform();
     m_path.transform(ctm);
@@ -898,7 +873,7 @@
         windRule = RULE_EVENODD;
     else
         return false;
-    
+
     return true;
 }
 
@@ -933,7 +908,7 @@
             c->fillPath(m_path);
             didDraw(m_path.boundingRect());
         }
-        
+
         c->setFillRule(windRule);
     }
 }
@@ -993,7 +968,7 @@
     WindRule windRule = RULE_NONZERO;
     if (!parseWinding(windingRuleString, windRule))
         return false;
-    
+
     return m_path.contains(transformedPoint, windRule);
 }
 
@@ -1012,8 +987,13 @@
     if (!std::isfinite(transformedPoint.x()) || !std::isfinite(transformedPoint.y()))
         return false;
 
-    CanvasStrokeStyleApplier applier(this);
-    return m_path.strokeContains(&applier, transformedPoint);
+    StrokeData strokeData;
+    strokeData.setThickness(lineWidth());
+    strokeData.setLineCap(getLineCap());
+    strokeData.setLineJoin(getLineJoin());
+    strokeData.setMiterLimit(miterLimit());
+    strokeData.setLineDash(getLineDash(), lineDashOffset());
+    return m_path.strokeContains(transformedPoint, strokeData);
 }
 
 void CanvasRenderingContext2D::clearRect(float x, float y, float width, float height)
@@ -1833,7 +1813,7 @@
     if (sw < 0) {
         sx += sw;
         sw = -sw;
-    }    
+    }
     if (sh < 0) {
         sy += sh;
         sh = -sh;
@@ -1945,6 +1925,8 @@
 
     if (fontDescription.italic())
         serializedFont.appendLiteral("italic ");
+    if (fontDescription.weight() == FontWeightBold)
+        serializedFont.appendLiteral("bold ");
     if (fontDescription.smallCaps() == FontSmallCapsOn)
         serializedFont.appendLiteral("small-caps ");
 
@@ -1975,8 +1957,14 @@
     if (newFont == state().m_unparsedFont && state().m_realizedFont)
         return;
 
-    RefPtr<MutableStylePropertySet> parsedStyle = MutableStylePropertySet::create();
-    CSSParser::parseValue(parsedStyle.get(), CSSPropertyFont, newFont, true, strictToCSSParserMode(!m_usesCSSCompatibilityParseMode), 0);
+    MutableStylePropertyMap::iterator i = m_cachedFonts.find(newFont);
+    RefPtr<MutableStylePropertySet> parsedStyle = i != m_cachedFonts.end() ? i->value : 0;
+
+    if (!parsedStyle) {
+        parsedStyle = MutableStylePropertySet::create();
+        CSSParser::parseValue(parsedStyle.get(), CSSPropertyFont, newFont, true, strictToCSSParserMode(!m_usesCSSCompatibilityParseMode), 0);
+        m_cachedFonts.add(newFont, parsedStyle);
+    }
     if (parsedStyle->isEmpty())
         return;
 
@@ -2227,7 +2215,7 @@
     return state().m_font;
 }
 
-PlatformLayer* CanvasRenderingContext2D::platformLayer() const
+WebKit::WebLayer* CanvasRenderingContext2D::platformLayer() const
 {
     return canvas()->buffer() ? canvas()->buffer()->platformLayer() : 0;
 }
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.h b/Source/core/html/canvas/CanvasRenderingContext2D.h
index 461ca49..c48e913 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.h
@@ -36,11 +36,12 @@
 #include "core/platform/graphics/GraphicsTypes.h"
 #include "core/platform/graphics/ImageBuffer.h"
 #include "core/platform/graphics/Path.h"
-#include "core/platform/graphics/PlatformLayer.h"
 #include "core/platform/graphics/transforms/AffineTransform.h"
-#include <wtf/text/WTFString.h>
-#include <wtf/Vector.h>
+#include "wtf/HashMap.h"
+#include "wtf/Vector.h"
+#include "wtf/text/WTFString.h"
 
+namespace WebKit { class WebLayer; }
 
 namespace WebCore {
 
@@ -57,6 +58,7 @@
 class TextMetrics;
 
 typedef int ExceptionCode;
+typedef HashMap<String, RefPtr<MutableStylePropertySet> > MutableStylePropertyMap;
 
 class CanvasRenderingContext2D : public CanvasRenderingContext, public CanvasPathMethods {
 public:
@@ -321,12 +323,13 @@
 
     virtual bool isTransformInvertible() const { return state().m_invertibleCTM; }
 
-    virtual PlatformLayer* platformLayer() const OVERRIDE;
+    virtual WebKit::WebLayer* platformLayer() const OVERRIDE;
 
     Vector<State, 1> m_stateStack;
     unsigned m_unrealizedSaveCount;
     bool m_usesCSSCompatibilityParseMode;
     bool m_hasAlpha;
+    MutableStylePropertyMap m_cachedFonts;
 };
 
 } // namespace WebCore
diff --git a/Source/core/html/canvas/DataView.idl b/Source/core/html/canvas/DataView.idl
index c814a6b..5ff575d 100644
--- a/Source/core/html/canvas/DataView.idl
+++ b/Source/core/html/canvas/DataView.idl
@@ -30,11 +30,8 @@
 ] interface DataView : ArrayBufferView {
     // All these methods raise an exception if they would read or write beyond the end of the view.
 
-    // We have to use custom code because our code generator does not support int8_t type.
-    // int8_t getInt8(unsigned long byteOffset);
-    // uint8_t getUint8(unsigned long byteOffset);
-    [Custom, RaisesException] any getInt8();
-    [Custom, RaisesException] any getUint8();
+    [RaisesException] byte getInt8(unsigned long byteOffset);
+    [RaisesException] octet getUint8(unsigned long byteOffset);
 
     [StrictTypeChecking, RaisesException] short getInt16(unsigned long byteOffset, optional boolean littleEndian);
     [StrictTypeChecking, RaisesException] unsigned short getUint16(unsigned long byteOffset, optional boolean littleEndian);
@@ -45,11 +42,8 @@
     [StrictTypeChecking, RaisesException] float getFloat32(unsigned long byteOffset, optional boolean littleEndian);
     [StrictTypeChecking, RaisesException] double getFloat64(unsigned long byteOffset, optional boolean littleEndian);
 
-    // We have to use custom code because our code generator does not support uint8_t type.
-    // void setInt8(unsigned long byteOffset, int8_t value);
-    // void setUint8(unsigned long byteOffset, uint8_t value);
-    [Custom, RaisesException] void setInt8();
-    [Custom, RaisesException] void setUint8();
+    [RaisesException] void setInt8(unsigned long byteOffset, byte value);
+    [RaisesException] void setUint8(unsigned long byteOffset, octet value);
 
     [StrictTypeChecking, RaisesException] void setInt16(unsigned long byteOffset, short value, optional boolean littleEndian);
     [StrictTypeChecking, RaisesException] void setUint16(unsigned long byteOffset, unsigned short value, optional boolean littleEndian);
diff --git a/Source/core/html/canvas/EXTFragDepth.cpp b/Source/core/html/canvas/EXTFragDepth.cpp
index 80b422a..5f9e2d9 100644
--- a/Source/core/html/canvas/EXTFragDepth.cpp
+++ b/Source/core/html/canvas/EXTFragDepth.cpp
@@ -47,9 +47,9 @@
     return EXTFragDepthName;
 }
 
-PassOwnPtr<EXTFragDepth> EXTFragDepth::create(WebGLRenderingContext* context)
+PassRefPtr<EXTFragDepth> EXTFragDepth::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new EXTFragDepth(context));
+    return adoptRef(new EXTFragDepth(context));
 }
 
 bool EXTFragDepth::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/EXTFragDepth.h b/Source/core/html/canvas/EXTFragDepth.h
index c28a44a..57da19e 100644
--- a/Source/core/html/canvas/EXTFragDepth.h
+++ b/Source/core/html/canvas/EXTFragDepth.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class EXTFragDepth : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<EXTFragDepth> create(WebGLRenderingContext*);
+    static PassRefPtr<EXTFragDepth> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/EXTTextureFilterAnisotropic.cpp b/Source/core/html/canvas/EXTTextureFilterAnisotropic.cpp
index 6128c25..81f5d82 100644
--- a/Source/core/html/canvas/EXTTextureFilterAnisotropic.cpp
+++ b/Source/core/html/canvas/EXTTextureFilterAnisotropic.cpp
@@ -46,9 +46,9 @@
     return EXTTextureFilterAnisotropicName;
 }
 
-PassOwnPtr<EXTTextureFilterAnisotropic> EXTTextureFilterAnisotropic::create(WebGLRenderingContext* context)
+PassRefPtr<EXTTextureFilterAnisotropic> EXTTextureFilterAnisotropic::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new EXTTextureFilterAnisotropic(context));
+    return adoptRef(new EXTTextureFilterAnisotropic(context));
 }
 
 bool EXTTextureFilterAnisotropic::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/EXTTextureFilterAnisotropic.h b/Source/core/html/canvas/EXTTextureFilterAnisotropic.h
index 7daafd9..6c445f9 100644
--- a/Source/core/html/canvas/EXTTextureFilterAnisotropic.h
+++ b/Source/core/html/canvas/EXTTextureFilterAnisotropic.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class EXTTextureFilterAnisotropic : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<EXTTextureFilterAnisotropic> create(WebGLRenderingContext*);
+    static PassRefPtr<EXTTextureFilterAnisotropic> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESElementIndexUint.cpp b/Source/core/html/canvas/OESElementIndexUint.cpp
index be10812..4fa47ed 100644
--- a/Source/core/html/canvas/OESElementIndexUint.cpp
+++ b/Source/core/html/canvas/OESElementIndexUint.cpp
@@ -46,9 +46,9 @@
     return OESElementIndexUintName;
 }
 
-PassOwnPtr<OESElementIndexUint> OESElementIndexUint::create(WebGLRenderingContext* context)
+PassRefPtr<OESElementIndexUint> OESElementIndexUint::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESElementIndexUint(context));
+    return adoptRef(new OESElementIndexUint(context));
 }
 
 bool OESElementIndexUint::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/OESElementIndexUint.h b/Source/core/html/canvas/OESElementIndexUint.h
index d7b21d4..c57f6b5 100644
--- a/Source/core/html/canvas/OESElementIndexUint.h
+++ b/Source/core/html/canvas/OESElementIndexUint.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class OESElementIndexUint : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESElementIndexUint> create(WebGLRenderingContext*);
+    static PassRefPtr<OESElementIndexUint> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESStandardDerivatives.cpp b/Source/core/html/canvas/OESStandardDerivatives.cpp
index 988c878..442640c 100644
--- a/Source/core/html/canvas/OESStandardDerivatives.cpp
+++ b/Source/core/html/canvas/OESStandardDerivatives.cpp
@@ -46,9 +46,9 @@
     return OESStandardDerivativesName;
 }
 
-PassOwnPtr<OESStandardDerivatives> OESStandardDerivatives::create(WebGLRenderingContext* context)
+PassRefPtr<OESStandardDerivatives> OESStandardDerivatives::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESStandardDerivatives(context));
+    return adoptRef(new OESStandardDerivatives(context));
 }
 
 bool OESStandardDerivatives::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/OESStandardDerivatives.h b/Source/core/html/canvas/OESStandardDerivatives.h
index d2d2ce2..eee4ab5 100644
--- a/Source/core/html/canvas/OESStandardDerivatives.h
+++ b/Source/core/html/canvas/OESStandardDerivatives.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class OESStandardDerivatives : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESStandardDerivatives> create(WebGLRenderingContext*);
+    static PassRefPtr<OESStandardDerivatives> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESTextureFloat.cpp b/Source/core/html/canvas/OESTextureFloat.cpp
index d2f5a22..3d19049 100644
--- a/Source/core/html/canvas/OESTextureFloat.cpp
+++ b/Source/core/html/canvas/OESTextureFloat.cpp
@@ -46,9 +46,9 @@
     return OESTextureFloatName;
 }
 
-PassOwnPtr<OESTextureFloat> OESTextureFloat::create(WebGLRenderingContext* context)
+PassRefPtr<OESTextureFloat> OESTextureFloat::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESTextureFloat(context));
+    return adoptRef(new OESTextureFloat(context));
 }
 
 bool OESTextureFloat::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/OESTextureFloat.h b/Source/core/html/canvas/OESTextureFloat.h
index d881e04..15322a9 100644
--- a/Source/core/html/canvas/OESTextureFloat.h
+++ b/Source/core/html/canvas/OESTextureFloat.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class OESTextureFloat : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESTextureFloat> create(WebGLRenderingContext*);
+    static PassRefPtr<OESTextureFloat> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESTextureFloatLinear.cpp b/Source/core/html/canvas/OESTextureFloatLinear.cpp
index 04d59e2..1bf416d 100644
--- a/Source/core/html/canvas/OESTextureFloatLinear.cpp
+++ b/Source/core/html/canvas/OESTextureFloatLinear.cpp
@@ -47,9 +47,9 @@
     return OESTextureFloatLinearName;
 }
 
-PassOwnPtr<OESTextureFloatLinear> OESTextureFloatLinear::create(WebGLRenderingContext* context)
+PassRefPtr<OESTextureFloatLinear> OESTextureFloatLinear::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESTextureFloatLinear(context));
+    return adoptRef(new OESTextureFloatLinear(context));
 }
 
 bool OESTextureFloatLinear::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/OESTextureFloatLinear.h b/Source/core/html/canvas/OESTextureFloatLinear.h
index 8a79aad..34a3994 100644
--- a/Source/core/html/canvas/OESTextureFloatLinear.h
+++ b/Source/core/html/canvas/OESTextureFloatLinear.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class OESTextureFloatLinear : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESTextureFloatLinear> create(WebGLRenderingContext*);
+    static PassRefPtr<OESTextureFloatLinear> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESTextureHalfFloat.cpp b/Source/core/html/canvas/OESTextureHalfFloat.cpp
index 1d00ea8..022e02a 100644
--- a/Source/core/html/canvas/OESTextureHalfFloat.cpp
+++ b/Source/core/html/canvas/OESTextureHalfFloat.cpp
@@ -46,9 +46,9 @@
     return OESTextureHalfFloatName;
 }
 
-PassOwnPtr<OESTextureHalfFloat> OESTextureHalfFloat::create(WebGLRenderingContext* context)
+PassRefPtr<OESTextureHalfFloat> OESTextureHalfFloat::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESTextureHalfFloat(context));
+    return adoptRef(new OESTextureHalfFloat(context));
 }
 
 bool OESTextureHalfFloat::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/OESTextureHalfFloat.h b/Source/core/html/canvas/OESTextureHalfFloat.h
index ff7d5b2..34bfe8a 100644
--- a/Source/core/html/canvas/OESTextureHalfFloat.h
+++ b/Source/core/html/canvas/OESTextureHalfFloat.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class OESTextureHalfFloat : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESTextureHalfFloat> create(WebGLRenderingContext*);
+    static PassRefPtr<OESTextureHalfFloat> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESTextureHalfFloatLinear.cpp b/Source/core/html/canvas/OESTextureHalfFloatLinear.cpp
index 2b51eb4..6a69c93 100644
--- a/Source/core/html/canvas/OESTextureHalfFloatLinear.cpp
+++ b/Source/core/html/canvas/OESTextureHalfFloatLinear.cpp
@@ -47,9 +47,9 @@
     return OESTextureHalfFloatLinearName;
 }
 
-PassOwnPtr<OESTextureHalfFloatLinear> OESTextureHalfFloatLinear::create(WebGLRenderingContext* context)
+PassRefPtr<OESTextureHalfFloatLinear> OESTextureHalfFloatLinear::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESTextureHalfFloatLinear(context));
+    return adoptRef(new OESTextureHalfFloatLinear(context));
 }
 
 bool OESTextureHalfFloatLinear::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/OESTextureHalfFloatLinear.h b/Source/core/html/canvas/OESTextureHalfFloatLinear.h
index 99ebdce..0258535 100644
--- a/Source/core/html/canvas/OESTextureHalfFloatLinear.h
+++ b/Source/core/html/canvas/OESTextureHalfFloatLinear.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class OESTextureHalfFloatLinear : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESTextureHalfFloatLinear> create(WebGLRenderingContext*);
+    static PassRefPtr<OESTextureHalfFloatLinear> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/OESVertexArrayObject.cpp b/Source/core/html/canvas/OESVertexArrayObject.cpp
index 7b8df7f..4123a5f 100644
--- a/Source/core/html/canvas/OESVertexArrayObject.cpp
+++ b/Source/core/html/canvas/OESVertexArrayObject.cpp
@@ -49,14 +49,14 @@
     return OESVertexArrayObjectName;
 }
 
-PassOwnPtr<OESVertexArrayObject> OESVertexArrayObject::create(WebGLRenderingContext* context)
+PassRefPtr<OESVertexArrayObject> OESVertexArrayObject::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new OESVertexArrayObject(context));
+    return adoptRef(new OESVertexArrayObject(context));
 }
 
 PassRefPtr<WebGLVertexArrayObjectOES> OESVertexArrayObject::createVertexArrayOES()
 {
-    if (m_context->isContextLost())
+    if (isLost())
         return 0;
     
     RefPtr<WebGLVertexArrayObjectOES> o = WebGLVertexArrayObjectOES::create(m_context, WebGLVertexArrayObjectOES::VaoTypeUser);
@@ -66,7 +66,7 @@
 
 void OESVertexArrayObject::deleteVertexArrayOES(WebGLVertexArrayObjectOES* arrayObject)
 {
-    if (!arrayObject || m_context->isContextLost())
+    if (!arrayObject || isLost())
         return;
     
     if (!arrayObject->isDefaultObject() && arrayObject == m_context->m_boundVertexArrayObject)
@@ -77,7 +77,7 @@
 
 GC3Dboolean OESVertexArrayObject::isVertexArrayOES(WebGLVertexArrayObjectOES* arrayObject)
 {
-    if (!arrayObject || m_context->isContextLost())
+    if (!arrayObject || isLost())
         return 0;
     
     if (!arrayObject->hasEverBeenBound())
@@ -90,7 +90,7 @@
 void OESVertexArrayObject::bindVertexArrayOES(WebGLVertexArrayObjectOES* arrayObject, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (m_context->isContextLost())
+    if (isLost())
         return;
     
     if (arrayObject && (arrayObject->isDeleted() || !arrayObject->validate(0, context()))) {
diff --git a/Source/core/html/canvas/OESVertexArrayObject.h b/Source/core/html/canvas/OESVertexArrayObject.h
index da2ac64..7ac7de4 100644
--- a/Source/core/html/canvas/OESVertexArrayObject.h
+++ b/Source/core/html/canvas/OESVertexArrayObject.h
@@ -30,7 +30,7 @@
 #include "core/html/canvas/WebGLExtension.h"
 #include "core/html/canvas/WebGLVertexArrayObjectOES.h"
 #include "core/platform/graphics/GraphicsTypes3D.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 #include "wtf/UnusedParam.h"
 
 namespace WebCore {
@@ -42,7 +42,7 @@
 
 class OESVertexArrayObject : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<OESVertexArrayObject> create(WebGLRenderingContext*);
+    static PassRefPtr<OESVertexArrayObject> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLCompressedTextureATC.cpp b/Source/core/html/canvas/WebGLCompressedTextureATC.cpp
index db998a9..9df4b36 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureATC.cpp
+++ b/Source/core/html/canvas/WebGLCompressedTextureATC.cpp
@@ -49,9 +49,9 @@
     return WebGLCompressedTextureATCName;
 }
 
-PassOwnPtr<WebGLCompressedTextureATC> WebGLCompressedTextureATC::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLCompressedTextureATC> WebGLCompressedTextureATC::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLCompressedTextureATC(context));
+    return adoptRef(new WebGLCompressedTextureATC(context));
 }
 
 bool WebGLCompressedTextureATC::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/WebGLCompressedTextureATC.h b/Source/core/html/canvas/WebGLCompressedTextureATC.h
index 4856580..6cf6541 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureATC.h
+++ b/Source/core/html/canvas/WebGLCompressedTextureATC.h
@@ -29,7 +29,7 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@
 
 class WebGLCompressedTextureATC : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLCompressedTextureATC> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLCompressedTextureATC> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLCompressedTexturePVRTC.cpp b/Source/core/html/canvas/WebGLCompressedTexturePVRTC.cpp
index 04ee496..db3d0f0 100644
--- a/Source/core/html/canvas/WebGLCompressedTexturePVRTC.cpp
+++ b/Source/core/html/canvas/WebGLCompressedTexturePVRTC.cpp
@@ -51,9 +51,9 @@
     return WebGLCompressedTexturePVRTCName;
 }
 
-PassOwnPtr<WebGLCompressedTexturePVRTC> WebGLCompressedTexturePVRTC::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLCompressedTexturePVRTC> WebGLCompressedTexturePVRTC::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLCompressedTexturePVRTC(context));
+    return adoptRef(new WebGLCompressedTexturePVRTC(context));
 }
 
 bool WebGLCompressedTexturePVRTC::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/WebGLCompressedTexturePVRTC.h b/Source/core/html/canvas/WebGLCompressedTexturePVRTC.h
index 3c9709b..8e1330b 100644
--- a/Source/core/html/canvas/WebGLCompressedTexturePVRTC.h
+++ b/Source/core/html/canvas/WebGLCompressedTexturePVRTC.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class WebGLCompressedTexturePVRTC : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLCompressedTexturePVRTC> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLCompressedTexturePVRTC> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp b/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp
index ae7abe3..287127e 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp
+++ b/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp
@@ -54,9 +54,9 @@
     return WebGLCompressedTextureS3TCName;
 }
 
-PassOwnPtr<WebGLCompressedTextureS3TC> WebGLCompressedTextureS3TC::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLCompressedTextureS3TC> WebGLCompressedTextureS3TC::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLCompressedTextureS3TC(context));
+    return adoptRef(new WebGLCompressedTextureS3TC(context));
 }
 
 bool WebGLCompressedTextureS3TC::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/WebGLCompressedTextureS3TC.h b/Source/core/html/canvas/WebGLCompressedTextureS3TC.h
index 24a1d57..b8816be 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureS3TC.h
+++ b/Source/core/html/canvas/WebGLCompressedTextureS3TC.h
@@ -29,7 +29,7 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@
 
 class WebGLCompressedTextureS3TC : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLCompressedTextureS3TC> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLCompressedTextureS3TC> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLDebugRendererInfo.cpp b/Source/core/html/canvas/WebGLDebugRendererInfo.cpp
index c8fc790..7786e3f 100644
--- a/Source/core/html/canvas/WebGLDebugRendererInfo.cpp
+++ b/Source/core/html/canvas/WebGLDebugRendererInfo.cpp
@@ -44,9 +44,9 @@
     return WebGLDebugRendererInfoName;
 }
 
-PassOwnPtr<WebGLDebugRendererInfo> WebGLDebugRendererInfo::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLDebugRendererInfo> WebGLDebugRendererInfo::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLDebugRendererInfo(context));
+    return adoptRef(new WebGLDebugRendererInfo(context));
 }
 
 bool WebGLDebugRendererInfo::supported(WebGLRenderingContext*)
diff --git a/Source/core/html/canvas/WebGLDebugRendererInfo.h b/Source/core/html/canvas/WebGLDebugRendererInfo.h
index be39c61..ce8464c 100644
--- a/Source/core/html/canvas/WebGLDebugRendererInfo.h
+++ b/Source/core/html/canvas/WebGLDebugRendererInfo.h
@@ -28,7 +28,7 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
@@ -39,7 +39,7 @@
         UNMASKED_RENDERER_WEBGL = 0x9246
     };
 
-    static PassOwnPtr<WebGLDebugRendererInfo> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLDebugRendererInfo> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLDebugShaders.cpp b/Source/core/html/canvas/WebGLDebugShaders.cpp
index 9adcfa1..ea33aa2 100644
--- a/Source/core/html/canvas/WebGLDebugShaders.cpp
+++ b/Source/core/html/canvas/WebGLDebugShaders.cpp
@@ -50,15 +50,15 @@
     return WebGLDebugShadersName;
 }
 
-PassOwnPtr<WebGLDebugShaders> WebGLDebugShaders::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLDebugShaders> WebGLDebugShaders::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLDebugShaders(context));
+    return adoptRef(new WebGLDebugShaders(context));
 }
 
 String WebGLDebugShaders::getTranslatedShaderSource(WebGLShader* shader, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (m_context->isContextLost())
+    if (isLost())
         return String();
     if (!m_context->validateWebGLObject("getTranslatedShaderSource", shader))
         return "";
diff --git a/Source/core/html/canvas/WebGLDebugShaders.h b/Source/core/html/canvas/WebGLDebugShaders.h
index 67e2067..8c19c5a 100644
--- a/Source/core/html/canvas/WebGLDebugShaders.h
+++ b/Source/core/html/canvas/WebGLDebugShaders.h
@@ -28,7 +28,7 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
@@ -38,7 +38,7 @@
 
 class WebGLDebugShaders : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLDebugShaders> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLDebugShaders> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLDepthTexture.cpp b/Source/core/html/canvas/WebGLDepthTexture.cpp
index c12beec..6a450c2 100644
--- a/Source/core/html/canvas/WebGLDepthTexture.cpp
+++ b/Source/core/html/canvas/WebGLDepthTexture.cpp
@@ -47,9 +47,9 @@
     return WebGLDepthTextureName;
 }
 
-PassOwnPtr<WebGLDepthTexture> WebGLDepthTexture::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLDepthTexture> WebGLDepthTexture::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLDepthTexture(context));
+    return adoptRef(new WebGLDepthTexture(context));
 }
 
 bool WebGLDepthTexture::supported(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/WebGLDepthTexture.h b/Source/core/html/canvas/WebGLDepthTexture.h
index ea566c1..75ee15f 100644
--- a/Source/core/html/canvas/WebGLDepthTexture.h
+++ b/Source/core/html/canvas/WebGLDepthTexture.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class WebGLDepthTexture : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLDepthTexture> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLDepthTexture> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLDrawBuffers.cpp b/Source/core/html/canvas/WebGLDrawBuffers.cpp
index df45aff..1d779d6 100644
--- a/Source/core/html/canvas/WebGLDrawBuffers.cpp
+++ b/Source/core/html/canvas/WebGLDrawBuffers.cpp
@@ -47,9 +47,9 @@
     return WebGLExtension::WebGLDrawBuffersName;
 }
 
-PassOwnPtr<WebGLDrawBuffers> WebGLDrawBuffers::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLDrawBuffers> WebGLDrawBuffers::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLDrawBuffers(context));
+    return adoptRef(new WebGLDrawBuffers(context));
 }
 
 // static
@@ -67,7 +67,7 @@
 
 void WebGLDrawBuffers::drawBuffersWEBGL(const Vector<GC3Denum>& buffers)
 {
-    if (m_context->isContextLost())
+    if (isLost())
         return;
     GC3Dsizei n = buffers.size();
     const GC3Denum* bufs = buffers.data();
diff --git a/Source/core/html/canvas/WebGLDrawBuffers.h b/Source/core/html/canvas/WebGLDrawBuffers.h
index efd7d8f..b002f22 100644
--- a/Source/core/html/canvas/WebGLDrawBuffers.h
+++ b/Source/core/html/canvas/WebGLDrawBuffers.h
@@ -28,13 +28,13 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 class WebGLDrawBuffers : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLDrawBuffers> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLDrawBuffers> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
diff --git a/Source/core/html/canvas/WebGLExtension.h b/Source/core/html/canvas/WebGLExtension.h
index 84eef1b..4028906 100644
--- a/Source/core/html/canvas/WebGLExtension.h
+++ b/Source/core/html/canvas/WebGLExtension.h
@@ -27,14 +27,16 @@
 #define WebGLExtension_h
 
 #include "core/html/canvas/WebGLRenderingContext.h"
+#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
-class WebGLExtension {
+class WebGLExtension : public RefCounted<WebGLExtension> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     // Extension names are needed to properly wrap instances in JavaScript objects.
     enum ExtensionName {
+        ANGLEInstancedArraysName,
         EXTFragDepthName,
         EXTTextureFilterAnisotropicName,
         OESElementIndexUintName,
@@ -54,15 +56,27 @@
         WebGLLoseContextName,
     };
 
-    void ref() { m_context->ref(); }
-    void deref() { m_context->deref(); }
     WebGLRenderingContext* context() { return m_context; }
 
     virtual ~WebGLExtension();
     virtual ExtensionName getName() const = 0;
 
+    // Lose this extension. Passing true = force loss. Some extensions
+    // like WEBGL_lose_context are not normally lost when the context
+    // is lost but must be lost when destroying their WebGLRenderingContext.
+    virtual void lose(bool)
+    {
+        m_context = 0;
+    }
+
+    bool isLost()
+    {
+        return !m_context;
+    }
+
 protected:
     WebGLExtension(WebGLRenderingContext*);
+
     WebGLRenderingContext* m_context;
 };
 
diff --git a/Source/core/html/canvas/WebGLLoseContext.cpp b/Source/core/html/canvas/WebGLLoseContext.cpp
index 49b3a72..5238316 100644
--- a/Source/core/html/canvas/WebGLLoseContext.cpp
+++ b/Source/core/html/canvas/WebGLLoseContext.cpp
@@ -41,24 +41,32 @@
 {
 }
 
+void WebGLLoseContext::lose(bool force)
+{
+    if (force)
+        WebGLExtension::lose(true);
+}
+
 WebGLExtension::ExtensionName WebGLLoseContext::getName() const
 {
     return WebGLLoseContextName;
 }
 
-PassOwnPtr<WebGLLoseContext> WebGLLoseContext::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLLoseContext> WebGLLoseContext::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLLoseContext(context));
+    return adoptRef(new WebGLLoseContext(context));
 }
 
 void WebGLLoseContext::loseContext()
 {
-    m_context->forceLostContext(WebGLRenderingContext::SyntheticLostContext);
+    if (!isLost())
+        m_context->forceLostContext(WebGLRenderingContext::SyntheticLostContext);
 }
 
 void WebGLLoseContext::restoreContext()
 {
-    m_context->forceRestoreContext();
+    if (!isLost())
+        m_context->forceRestoreContext();
 }
 
 bool WebGLLoseContext::supported(WebGLRenderingContext*)
diff --git a/Source/core/html/canvas/WebGLLoseContext.h b/Source/core/html/canvas/WebGLLoseContext.h
index 4f81813..aa0c593 100644
--- a/Source/core/html/canvas/WebGLLoseContext.h
+++ b/Source/core/html/canvas/WebGLLoseContext.h
@@ -28,7 +28,7 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
@@ -36,12 +36,13 @@
 
 class WebGLLoseContext : public WebGLExtension, public ScriptWrappable {
 public:
-    static PassOwnPtr<WebGLLoseContext> create(WebGLRenderingContext*);
+    static PassRefPtr<WebGLLoseContext> create(WebGLRenderingContext*);
     static bool supported(WebGLRenderingContext*);
     static const char* getExtensionName();
 
     virtual ~WebGLLoseContext();
     virtual ExtensionName getName() const;
+    virtual void lose(bool);
 
     void loseContext();
     void restoreContext();
diff --git a/Source/core/html/canvas/WebGLRenderingContext.cpp b/Source/core/html/canvas/WebGLRenderingContext.cpp
index 5f1be6b..f6071a6 100644
--- a/Source/core/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/core/html/canvas/WebGLRenderingContext.cpp
@@ -33,6 +33,7 @@
 #include "core/html/HTMLImageElement.h"
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/ImageData.h"
+#include "core/html/canvas/ANGLEInstancedArrays.h"
 #include "core/html/canvas/EXTFragDepth.h"
 #include "core/html/canvas/EXTTextureFilterAnisotropic.h"
 #include "core/html/canvas/OESElementIndexUint.h"
@@ -62,6 +63,7 @@
 #include "core/html/canvas/WebGLShaderPrecisionFormat.h"
 #include "core/html/canvas/WebGLTexture.h"
 #include "core/html/canvas/WebGLUniformLocation.h"
+#include "core/inspector/InspectorInstrumentation.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/loader/cache/CachedImage.h"
@@ -592,6 +594,7 @@
     registerExtension<WebGLLoseContext>(m_webglLoseContext, false, false, false, bothPrefixes);
 
     // Register draft extensions.
+    registerExtension<ANGLEInstancedArrays>(m_angleInstancedArrays, false, true, false, unprefixed);
     registerExtension<EXTFragDepth>(m_extFragDepth, false, true, false, unprefixed);
     registerExtension<WebGLDrawBuffers>(m_webglDrawBuffers, false, true, false, unprefixed);
 
@@ -693,7 +696,6 @@
 
     m_isGLES2NPOTStrict = !m_context->getExtensions()->isEnabled("GL_OES_texture_npot");
     m_isDepthStencilSupported = m_context->getExtensions()->isEnabled("GL_OES_packed_depth_stencil");
-    m_isRobustnessEXTSupported = m_context->getExtensions()->isEnabled("GL_EXT_robustness");
 }
 
 bool WebGLRenderingContext::allowPrivilegedExtensions() const
@@ -710,6 +712,11 @@
         m_compressedTextureFormats.append(format);
 }
 
+void WebGLRenderingContext::removeAllCompressedTextureFormats()
+{
+    m_compressedTextureFormats.clear();
+}
+
 WebGLRenderingContext::~WebGLRenderingContext()
 {
     // Remove all references to WebGLObjects so if they are the last reference
@@ -731,6 +738,11 @@
     m_blackTextureCubeMap = 0;
 
     detachAndRemoveAllObjects();
+
+    // release all extensions
+    for (size_t i = 0; i < m_extensions.size(); ++i)
+        delete m_extensions[i];
+
     destroyGraphicsContext3D();
     m_contextGroup->removeContext(this);
 
@@ -1758,33 +1770,9 @@
 {
     UNUSED_PARAM(ec);
 
-    if (isContextLost() || !validateDrawMode("drawArrays", mode))
+    if (!validateDrawArrays("drawArrays", mode, first, count))
         return;
 
-    if (!validateStencilSettings("drawArrays"))
-        return;
-
-    if (first < 0 || count < 0) {
-        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "drawArrays", "first or count < 0");
-        return;
-    }
-
-    if (!count) {
-        markContextChanged();
-        return;
-    }
-
-    if (!validateRenderingState()) {
-        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "drawArrays", "attribs not setup correctly");
-        return;
-    }
-
-    const char* reason = "framebuffer incomplete";
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), &reason)) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "drawArrays", reason);
-        return;
-    }
-
     clearIfComposited();
 
     handleTextureCompleteness("drawArrays", true);
@@ -1797,51 +1785,9 @@
 {
     UNUSED_PARAM(ec);
 
-    if (isContextLost() || !validateDrawMode("drawElements", mode))
+    if (!validateDrawElements("drawElements", mode, count, type, offset))
         return;
 
-    if (!validateStencilSettings("drawElements"))
-        return;
-
-    switch (type) {
-    case GraphicsContext3D::UNSIGNED_BYTE:
-    case GraphicsContext3D::UNSIGNED_SHORT:
-        break;
-    case GraphicsContext3D::UNSIGNED_INT:
-        if (m_oesElementIndexUint)
-            break;
-        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "drawElements", "invalid type");
-        return;
-    default:
-        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "drawElements", "invalid type");
-        return;
-    }
-
-    if (count < 0 || offset < 0) {
-        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "drawElements", "count or offset < 0");
-        return;
-    }
-
-    if (!count) {
-        markContextChanged();
-        return;
-    }
-
-    if (!m_boundVertexArrayObject->getElementArrayBuffer()) {
-        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "drawElements", "no ELEMENT_ARRAY_BUFFER bound");
-        return;
-    }
-
-    if (!validateRenderingState()) {
-        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "drawElements", "attribs not setup correctly");
-        return;
-    }
-
-    const char* reason = "framebuffer incomplete";
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), &reason)) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "drawElements", reason);
-        return;
-    }
     clearIfComposited();
 
     handleTextureCompleteness("drawElements", true);
@@ -1850,6 +1796,38 @@
     markContextChanged();
 }
 
+void WebGLRenderingContext::drawArraysInstancedANGLE(GC3Denum mode, GC3Dint first, GC3Dsizei count, GC3Dsizei primcount)
+{
+    if (!validateDrawArrays("drawArraysInstancedANGLE", mode, first, count))
+        return;
+
+    if (!validateDrawInstanced("drawArraysInstancedANGLE", primcount))
+        return;
+
+    clearIfComposited();
+
+    handleTextureCompleteness("drawArraysInstancedANGLE", true);
+    m_context->getExtensions()->drawArraysInstancedANGLE(mode, first, count, primcount);
+    handleTextureCompleteness("drawArraysInstancedANGLE", false);
+    markContextChanged();
+}
+
+void WebGLRenderingContext::drawElementsInstancedANGLE(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset, GC3Dsizei primcount)
+{
+    if (!validateDrawElements("drawElementsInstancedANGLE", mode, count, type, offset))
+        return;
+
+    if (!validateDrawInstanced("drawElementsInstancedANGLE", primcount))
+        return;
+
+    clearIfComposited();
+
+    handleTextureCompleteness("drawElementsInstancedANGLE", true);
+    m_context->getExtensions()->drawElementsInstancedANGLE(mode, count, type, static_cast<GC3Dintptr>(offset), primcount);
+    handleTextureCompleteness("drawElementsInstancedANGLE", false);
+    markContextChanged();
+}
+
 void WebGLRenderingContext::enable(GC3Denum cap)
 {
     if (isContextLost() || !validateCapability("enable", cap))
@@ -2143,7 +2121,7 @@
     return false;
 }
 
-WebGLExtension* WebGLRenderingContext::getExtension(const String& name)
+PassRefPtr<WebGLExtension> WebGLRenderingContext::getExtension(const String& name)
 {
     if (isContextLost())
         return 0;
@@ -2762,30 +2740,21 @@
                 switch (baseType) {
                 case GraphicsContext3D::FLOAT: {
                     GC3Dfloat value[16] = {0};
-                    if (m_isRobustnessEXTSupported)
-                        m_context->getExtensions()->getnUniformfvEXT(objectOrZero(program), location, 16 * sizeof(GC3Dfloat), value);
-                    else
-                        m_context->getUniformfv(objectOrZero(program), location, value);
+                    m_context->getUniformfv(objectOrZero(program), location, value);
                     if (length == 1)
                         return WebGLGetInfo(value[0]);
                     return WebGLGetInfo(Float32Array::create(value, length));
                 }
                 case GraphicsContext3D::INT: {
                     GC3Dint value[4] = {0};
-                    if (m_isRobustnessEXTSupported)
-                        m_context->getExtensions()->getnUniformivEXT(objectOrZero(program), location, 4 * sizeof(GC3Dint), value);
-                    else
-                        m_context->getUniformiv(objectOrZero(program), location, value);
+                    m_context->getUniformiv(objectOrZero(program), location, value);
                     if (length == 1)
                         return WebGLGetInfo(value[0]);
                     return WebGLGetInfo(Int32Array::create(value, length));
                 }
                 case GraphicsContext3D::BOOL: {
                     GC3Dint value[4] = {0};
-                    if (m_isRobustnessEXTSupported)
-                        m_context->getExtensions()->getnUniformivEXT(objectOrZero(program), location, 4 * sizeof(GC3Dint), value);
-                    else
-                        m_context->getUniformiv(objectOrZero(program), location, value);
+                    m_context->getUniformiv(objectOrZero(program), location, value);
                     if (length > 1) {
                         bool boolValue[16] = {0};
                         for (unsigned j = 0; j < length; j++)
@@ -2836,6 +2805,10 @@
         return WebGLGetInfo();
     }
     const WebGLVertexArrayObjectOES::VertexAttribState& state = m_boundVertexArrayObject->getVertexAttribState(index);
+
+    if (m_angleInstancedArrays && pname == Extensions3D::VERTEX_ATTRIB_ARRAY_DIVISOR_ANGLE)
+        return WebGLGetInfo(state.divisor);
+
     switch (pname) {
     case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:
         if (!state.bufferBinding || !state.bufferBinding->object())
@@ -3072,16 +3045,14 @@
     // Calculate array size, taking into consideration of PACK_ALIGNMENT.
     unsigned int totalBytesRequired = 0;
     unsigned int padding = 0;
-    if (!m_isRobustnessEXTSupported) {
-        GC3Denum error = m_context->computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
-        if (error != GraphicsContext3D::NO_ERROR) {
-            synthesizeGLError(error, "readPixels", "invalid dimensions");
-            return;
-        }
-        if (pixels->byteLength() < totalBytesRequired) {
-            synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "readPixels", "ArrayBufferView not large enough for dimensions");
-            return;
-        }
+    GC3Denum error = m_context->computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
+    if (error != GraphicsContext3D::NO_ERROR) {
+        synthesizeGLError(error, "readPixels", "invalid dimensions");
+        return;
+    }
+    if (pixels->byteLength() < totalBytesRequired) {
+        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "readPixels", "ArrayBufferView not large enough for dimensions");
+        return;
     }
 
     clearIfComposited();
@@ -3089,15 +3060,10 @@
 
     {
         ScopedDrawingBufferBinder binder(m_drawingBuffer.get(), m_framebufferBinding.get());
-        if (m_isRobustnessEXTSupported)
-            m_context->getExtensions()->readnPixelsEXT(x, y, width, height, format, type, pixels->byteLength(), data);
-        else
-            m_context->readPixels(x, y, width, height, format, type, data);
+        m_context->readPixels(x, y, width, height, format, type, data);
     }
 
 #if OS(DARWIN)
-    if (m_isRobustnessEXTSupported) // we haven't computed padding
-        m_context->computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
     // FIXME: remove this section when GL driver bug on Mac is fixed, i.e.,
     // when alpha is off, readPixels should set alpha to 255 instead of 0.
     if (!m_framebufferBinding && !m_context->getContextAttributes().alpha) {
@@ -4131,6 +4097,20 @@
     m_context->vertexAttribPointer(index, size, type, normalized, stride, static_cast<GC3Dintptr>(offset));
 }
 
+void WebGLRenderingContext::vertexAttribDivisorANGLE(GC3Duint index, GC3Duint divisor)
+{
+    if (isContextLost())
+        return;
+
+    if (index >= m_maxVertexAttribs) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "vertexAttribDivisorANGLE", "index out of range");
+        return;
+    }
+
+    m_boundVertexArrayObject->setVertexAttribDivisor(index, divisor);
+    m_context->getExtensions()->vertexAttribDivisorANGLE(index, divisor);
+}
+
 void WebGLRenderingContext::viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
 {
     if (isContextLost())
@@ -4173,6 +4153,14 @@
 
     detachAndRemoveAllObjects();
 
+    // Lose all the extensions.
+    for (size_t i = 0; i < m_extensions.size(); ++i) {
+        ExtensionTracker* tracker = m_extensions[i];
+        tracker->loseExtension();
+    }
+
+    removeAllCompressedTextureFormats();
+
     if (mode != RealLostContext)
         destroyGraphicsContext3D();
 
@@ -4205,7 +4193,7 @@
         m_restoreTimer.startOneShot(0);
 }
 
-PlatformLayer* WebGLRenderingContext::platformLayer() const
+WebKit::WebLayer* WebGLRenderingContext::platformLayer() const
 {
     return m_drawingBuffer->platformLayer();
 }
@@ -4967,6 +4955,8 @@
 
     if (!m_numGLErrorsToConsoleAllowed)
         printWarningToConsole("WebGL: too many errors, no more errors will be reported to the console for this context.");
+
+    return;
 }
 
 void WebGLRenderingContext::printWarningToConsole(const String& message)
@@ -5173,6 +5163,108 @@
     return true;
 }
 
+bool WebGLRenderingContext::validateDrawArrays(const char* functionName, GC3Denum mode, GC3Dint first, GC3Dsizei count)
+{
+    if (isContextLost() || !validateDrawMode(functionName, mode))
+        return false;
+
+    if (!validateStencilSettings(functionName))
+        return false;
+
+    if (first < 0 || count < 0) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, functionName, "first or count < 0");
+        return false;
+    }
+
+    if (!count) {
+        markContextChanged();
+        return false;
+    }
+
+    if (!validateRenderingState()) {
+        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, functionName, "attribs not setup correctly");
+        return false;
+    }
+
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, functionName, reason);
+        return false;
+    }
+
+    return true;
+}
+
+bool WebGLRenderingContext::validateDrawElements(const char* functionName, GC3Denum mode, GC3Dsizei count, GC3Denum type, long long offset)
+{
+    if (isContextLost() || !validateDrawMode(functionName, mode))
+        return false;
+
+    if (!validateStencilSettings(functionName))
+        return false;
+
+    switch (type) {
+    case GraphicsContext3D::UNSIGNED_BYTE:
+    case GraphicsContext3D::UNSIGNED_SHORT:
+        break;
+    case GraphicsContext3D::UNSIGNED_INT:
+        if (m_oesElementIndexUint)
+            break;
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "invalid type");
+        return false;
+    default:
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "invalid type");
+        return false;
+    }
+
+    if (count < 0 || offset < 0) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, functionName, "count or offset < 0");
+        return false;
+    }
+
+    if (!count) {
+        markContextChanged();
+        return false;
+    }
+
+    if (!m_boundVertexArrayObject->getElementArrayBuffer()) {
+        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, functionName, "no ELEMENT_ARRAY_BUFFER bound");
+        return false;
+    }
+
+    if (!validateRenderingState()) {
+        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, functionName, "attribs not setup correctly");
+        return false;
+    }
+
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, functionName, reason);
+        return false;
+    }
+
+    return true;
+}
+
+// Helper function to validate draw*Instanced calls
+bool WebGLRenderingContext::validateDrawInstanced(const char* functionName, GC3Dsizei primcount)
+{
+    if (primcount < 0) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, functionName, "primcount < 0");
+        return false;
+    }
+
+    // Ensure at least one enabled vertex attrib has a divisor of 0.
+    for (unsigned i = 0; i < m_maxVertexAttribs; ++i) {
+        const WebGLVertexArrayObjectOES::VertexAttribState& state = m_boundVertexArrayObject->getVertexAttribState(i);
+        if (state.enabled && !state.divisor)
+            return true;
+    }
+
+    synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, functionName, "at least one enabled attribute must have a divisor of 0");
+    return false;
+}
+
 void WebGLRenderingContext::vertexAttribfImpl(const char* functionName, GC3Duint index, GC3Dsizei expectedSize, GC3Dfloat v0, GC3Dfloat v1, GC3Dfloat v2, GC3Dfloat v3)
 {
     if (isContextLost())
@@ -5383,7 +5475,7 @@
         case GraphicsContext3D::CONTEXT_LOST_WEBGL:
             return "CONTEXT_LOST_WEBGL";
         default:
-            return String::format("WebGL ERROR(%04x)", error);
+            return String::format("WebGL ERROR(0x%04X)", error);
         }
     }
 
@@ -5391,9 +5483,10 @@
 
 void WebGLRenderingContext::synthesizeGLError(GC3Denum error, const char* functionName, const char* description, ConsoleDisplayPreference display)
 {
+    String errorType = GetErrorString(error);
     if (m_synthesizedErrorsToConsole && display == DisplayInConsole) {
-      String str = String("WebGL: ") + GetErrorString(error) +  ": " + String(functionName) + ": " + String(description);
-      printGLErrorToConsole(str);
+        String message = String("WebGL: ") + errorType +  ": " + String(functionName) + ": " + String(description);
+        printGLErrorToConsole(message);
     }
     if (!isContextLost())
         m_context->synthesizeGLError(error);
@@ -5401,6 +5494,7 @@
         if (lost_context_errors_.find(error) == WTF::notFound)
             lost_context_errors_.append(error);
     }
+    InspectorInstrumentation::didFireWebGLError(canvas()->document(), errorType);
 }
 
 
diff --git a/Source/core/html/canvas/WebGLRenderingContext.h b/Source/core/html/canvas/WebGLRenderingContext.h
index dbe983f..358b94b 100644
--- a/Source/core/html/canvas/WebGLRenderingContext.h
+++ b/Source/core/html/canvas/WebGLRenderingContext.h
@@ -40,8 +40,11 @@
 #include <wtf/text/WTFString.h>
 #include <wtf/Uint8Array.h>
 
+namespace WebKit { class WebLayer; }
+
 namespace WebCore {
 
+class ANGLEInstancedArrays;
 class DrawingBuffer;
 class WebGLDrawBuffers;
 class EXTFragDepth;
@@ -155,6 +158,9 @@
     void drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count, ExceptionCode&);
     void drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, long long offset, ExceptionCode&);
 
+    void drawArraysInstancedANGLE(GC3Denum mode, GC3Dint first, GC3Dsizei count, GC3Dsizei primcount);
+    void drawElementsInstancedANGLE(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset, GC3Dsizei primcount);
+
     void enable(GC3Denum cap);
     void enableVertexAttribArray(GC3Duint index, ExceptionCode&);
     void finish();
@@ -171,7 +177,7 @@
     WebGLGetInfo getBufferParameter(GC3Denum target, GC3Denum pname, ExceptionCode&);
     PassRefPtr<WebGLContextAttributes> getContextAttributes();
     GC3Denum getError();
-    WebGLExtension* getExtension(const String& name);
+    PassRefPtr<WebGLExtension> getExtension(const String& name);
     WebGLGetInfo getFramebufferAttachmentParameter(GC3Denum target, GC3Denum attachment, GC3Denum pname, ExceptionCode&);
     WebGLGetInfo getParameter(GC3Denum pname, ExceptionCode&);
     WebGLGetInfo getProgramParameter(WebGLProgram*, GC3Denum pname, ExceptionCode&);
@@ -290,6 +296,8 @@
     void vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized,
                              GC3Dsizei stride, long long offset, ExceptionCode&);
 
+    void vertexAttribDivisorANGLE(GC3Duint index, GC3Duint divisor);
+
     void viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
 
     // WEBKIT_lose_context support
@@ -309,7 +317,7 @@
 
     GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
     WebGLContextGroup* contextGroup() const { return m_contextGroup.get(); }
-    virtual PlatformLayer* platformLayer() const;
+    virtual WebKit::WebLayer* platformLayer() const;
 
     void reshape(int width, int height);
 
@@ -365,6 +373,7 @@
 
     // Adds a compressed texture format.
     void addCompressedTextureFormat(GC3Denum);
+    void removeAllCompressedTextureFormats();
 
     PassRefPtr<Image> videoFrameToImage(HTMLVideoElement*, BackingStoreCopy, ExceptionCode&);
 
@@ -495,29 +504,29 @@
 
     bool m_isGLES2NPOTStrict;
     bool m_isDepthStencilSupported;
-    bool m_isRobustnessEXTSupported;
 
     bool m_synthesizedErrorsToConsole;
     int m_numGLErrorsToConsoleAllowed;
 
     // Enabled extension objects.
-    OwnPtr<EXTFragDepth> m_extFragDepth;
-    OwnPtr<EXTTextureFilterAnisotropic> m_extTextureFilterAnisotropic;
-    OwnPtr<OESTextureFloat> m_oesTextureFloat;
-    OwnPtr<OESTextureFloatLinear> m_oesTextureFloatLinear;
-    OwnPtr<OESTextureHalfFloat> m_oesTextureHalfFloat;
-    OwnPtr<OESTextureHalfFloatLinear> m_oesTextureHalfFloatLinear;
-    OwnPtr<OESStandardDerivatives> m_oesStandardDerivatives;
-    OwnPtr<OESVertexArrayObject> m_oesVertexArrayObject;
-    OwnPtr<OESElementIndexUint> m_oesElementIndexUint;
-    OwnPtr<WebGLLoseContext> m_webglLoseContext;
-    OwnPtr<WebGLDebugRendererInfo> m_webglDebugRendererInfo;
-    OwnPtr<WebGLDebugShaders> m_webglDebugShaders;
-    OwnPtr<WebGLDrawBuffers> m_webglDrawBuffers;
-    OwnPtr<WebGLCompressedTextureATC> m_webglCompressedTextureATC;
-    OwnPtr<WebGLCompressedTexturePVRTC> m_webglCompressedTexturePVRTC;
-    OwnPtr<WebGLCompressedTextureS3TC> m_webglCompressedTextureS3TC;
-    OwnPtr<WebGLDepthTexture> m_webglDepthTexture;
+    RefPtr<ANGLEInstancedArrays> m_angleInstancedArrays;
+    RefPtr<EXTFragDepth> m_extFragDepth;
+    RefPtr<EXTTextureFilterAnisotropic> m_extTextureFilterAnisotropic;
+    RefPtr<OESTextureFloat> m_oesTextureFloat;
+    RefPtr<OESTextureFloatLinear> m_oesTextureFloatLinear;
+    RefPtr<OESTextureHalfFloat> m_oesTextureHalfFloat;
+    RefPtr<OESTextureHalfFloatLinear> m_oesTextureHalfFloatLinear;
+    RefPtr<OESStandardDerivatives> m_oesStandardDerivatives;
+    RefPtr<OESVertexArrayObject> m_oesVertexArrayObject;
+    RefPtr<OESElementIndexUint> m_oesElementIndexUint;
+    RefPtr<WebGLLoseContext> m_webglLoseContext;
+    RefPtr<WebGLDebugRendererInfo> m_webglDebugRendererInfo;
+    RefPtr<WebGLDebugShaders> m_webglDebugShaders;
+    RefPtr<WebGLDrawBuffers> m_webglDrawBuffers;
+    RefPtr<WebGLCompressedTextureATC> m_webglCompressedTextureATC;
+    RefPtr<WebGLCompressedTexturePVRTC> m_webglCompressedTexturePVRTC;
+    RefPtr<WebGLCompressedTextureS3TC> m_webglCompressedTextureS3TC;
+    RefPtr<WebGLDepthTexture> m_webglDepthTexture;
 
     class ExtensionTracker {
     public:
@@ -529,6 +538,10 @@
         {
         }
 
+        virtual ~ExtensionTracker()
+        {
+        }
+
         bool getPrefixed() const
         {
             return m_prefixed;
@@ -546,9 +559,10 @@
 
         bool matchesNameWithPrefixes(const String&) const;
 
-        virtual WebGLExtension* getExtension(WebGLRenderingContext*) const = 0;
+        virtual PassRefPtr<WebGLExtension> getExtension(WebGLRenderingContext*) const = 0;
         virtual bool supported(WebGLRenderingContext*) const = 0;
         virtual const char* getExtensionName() const = 0;
+        virtual void loseExtension() = 0;
 
     private:
         bool m_privileged;
@@ -560,18 +574,26 @@
     template <typename T>
     class TypedExtensionTracker : public ExtensionTracker {
     public:
-        TypedExtensionTracker(OwnPtr<T>& extensionField, bool privileged, bool draft, bool prefixed, const char** prefixes)
+        TypedExtensionTracker(RefPtr<T>& extensionField, bool privileged, bool draft, bool prefixed, const char** prefixes)
             : ExtensionTracker(privileged, draft, prefixed, prefixes)
             , m_extensionField(extensionField)
         {
         }
 
-        virtual WebGLExtension* getExtension(WebGLRenderingContext* context) const
+        ~TypedExtensionTracker()
+        {
+            if (m_extensionField) {
+                m_extensionField->lose(true);
+                m_extensionField = 0;
+            }
+        }
+
+        virtual PassRefPtr<WebGLExtension> getExtension(WebGLRenderingContext* context) const
         {
             if (!m_extensionField)
                 m_extensionField = T::create(context);
 
-            return m_extensionField.get();
+            return m_extensionField;
         }
 
         virtual bool supported(WebGLRenderingContext* context) const
@@ -584,14 +606,23 @@
             return T::getExtensionName();
         }
 
+        virtual void loseExtension()
+        {
+            if (m_extensionField) {
+                m_extensionField->lose(false);
+                if (m_extensionField->isLost())
+                    m_extensionField = 0;
+            }
+        }
+
     private:
-        OwnPtr<T>& m_extensionField;
+        RefPtr<T>& m_extensionField;
     };
 
     Vector<ExtensionTracker*> m_extensions;
 
     template <typename T>
-    void registerExtension(OwnPtr<T>& extensionPtr, bool privileged, bool draft, bool prefixed, const char** prefixes)
+    void registerExtension(RefPtr<T>& extensionPtr, bool privileged, bool draft, bool prefixed, const char** prefixes)
     {
         m_extensions.append(new TypedExtensionTracker<T>(extensionPtr, privileged, draft, prefixed, prefixes));
     }
@@ -781,6 +812,15 @@
     // Helper function for tex{Sub}Image2D to make sure video is ready wouldn't taint Origin.
     bool validateHTMLVideoElement(const char* functionName, HTMLVideoElement*, ExceptionCode&);
 
+    // Helper function to validate drawArrays(Instanced) calls
+    bool validateDrawArrays(const char* functionName, GC3Denum mode, GC3Dint first, GC3Dsizei count);
+
+    // Helper function to validate drawElements(Instanced) calls
+    bool validateDrawElements(const char* functionName, GC3Denum mode, GC3Dsizei count, GC3Denum type, long long offset);
+
+    // Helper function to validate draw*Instanced calls
+    bool validateDrawInstanced(const char* functionName, GC3Dsizei primcount);
+
     // Helper functions for vertexAttribNf{v}.
     void vertexAttribfImpl(const char* functionName, GC3Duint index, GC3Dsizei expectedSize, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat);
     void vertexAttribfvImpl(const char* functionName, GC3Duint index, Float32Array*, GC3Dsizei expectedSize);
diff --git a/Source/core/html/canvas/WebGLTexture.cpp b/Source/core/html/canvas/WebGLTexture.cpp
index 15cb747..61bce34 100644
--- a/Source/core/html/canvas/WebGLTexture.cpp
+++ b/Source/core/html/canvas/WebGLTexture.cpp
@@ -44,6 +44,7 @@
     , m_wrapS(GraphicsContext3D::REPEAT)
     , m_wrapT(GraphicsContext3D::REPEAT)
     , m_isNPOT(false)
+    , m_isCubeComplete(false)
     , m_isComplete(false)
     , m_needToUseBlackTexture(false)
     , m_isFloatType(false)
@@ -282,7 +283,8 @@
         const LevelInfo& info = m_info[ii][0];
         if (!info.valid
             || info.width != first.width || info.height != first.height
-            || info.internalFormat != first.internalFormat || info.type != first.type)
+            || info.internalFormat != first.internalFormat || info.type != first.type
+            || (m_info.size() > 1 && !m_isCubeComplete))
             return false;
     }
     return true;
@@ -318,6 +320,7 @@
         }
     }
     m_isComplete = true;
+    m_isCubeComplete = true;
     const LevelInfo& first = m_info[0][0];
     GC3Dint levelCount = computeLevelCount(first.width, first.height);
     if (levelCount < 1)
@@ -327,7 +330,10 @@
             const LevelInfo& info0 = m_info[ii][0];
             if (!info0.valid
                 || info0.width != first.width || info0.height != first.height
-                || info0.internalFormat != first.internalFormat || info0.type != first.type) {
+                || info0.internalFormat != first.internalFormat || info0.type != first.type
+                || (m_info.size() > 1 && info0.width != info0.height)) {
+                if (m_info.size() > 1)
+                    m_isCubeComplete = false;
                 m_isComplete = false;
                 break;
             }
@@ -347,34 +353,17 @@
             }
         }
     }
-    m_isFloatType = false;
-    if (m_isComplete)
-        m_isFloatType = m_info[0][0].type == GraphicsContext3D::FLOAT;
-    else {
-        for (size_t ii = 0; ii < m_info.size(); ++ii) {
-            if (m_info[ii][0].type == GraphicsContext3D::FLOAT) {
-                m_isFloatType = true;
-                break;
-            }
-        }
-    }
-    m_isHalfFloatType = false;
-    if (m_isComplete)
-        m_isHalfFloatType = m_info[0][0].type == GraphicsContext3D::HALF_FLOAT_OES;
-    else {
-        for (size_t ii = 0; ii < m_info.size(); ++ii) {
-            if (m_info[ii][0].type == GraphicsContext3D::HALF_FLOAT_OES) {
-                m_isHalfFloatType = true;
-                break;
-            }
-        }
-    }
+    m_isFloatType = m_info[0][0].type == GraphicsContext3D::FLOAT;
+    m_isHalfFloatType = m_info[0][0].type == GraphicsContext3D::HALF_FLOAT_OES;
 
     m_needToUseBlackTexture = false;
     // NPOT
     if (m_isNPOT && ((m_minFilter != GraphicsContext3D::NEAREST && m_minFilter != GraphicsContext3D::LINEAR)
                      || m_wrapS != GraphicsContext3D::CLAMP_TO_EDGE || m_wrapT != GraphicsContext3D::CLAMP_TO_EDGE))
         m_needToUseBlackTexture = true;
+    // If it is a Cube texture, check Cube Completeness first
+    if (m_info.size() > 1 && !m_isCubeComplete)
+        m_needToUseBlackTexture = true;
     // Completeness
     if (!m_isComplete && m_minFilter != GraphicsContext3D::NEAREST && m_minFilter != GraphicsContext3D::LINEAR)
         m_needToUseBlackTexture = true;
diff --git a/Source/core/html/canvas/WebGLTexture.h b/Source/core/html/canvas/WebGLTexture.h
index 075cdb5..9b79082 100644
--- a/Source/core/html/canvas/WebGLTexture.h
+++ b/Source/core/html/canvas/WebGLTexture.h
@@ -127,6 +127,7 @@
     Vector<Vector<LevelInfo> > m_info;
 
     bool m_isNPOT;
+    bool m_isCubeComplete;
     bool m_isComplete;
     bool m_needToUseBlackTexture;
     bool m_isFloatType;
diff --git a/Source/core/html/canvas/WebGLVertexArrayObjectOES.cpp b/Source/core/html/canvas/WebGLVertexArrayObjectOES.cpp
index 61f79ab..ac6dc1d 100644
--- a/Source/core/html/canvas/WebGLVertexArrayObjectOES.cpp
+++ b/Source/core/html/canvas/WebGLVertexArrayObjectOES.cpp
@@ -130,4 +130,10 @@
     }
 }
 
+void WebGLVertexArrayObjectOES::setVertexAttribDivisor(GC3Duint index, GC3Duint divisor)
+{
+    VertexAttribState& state = m_vertexAttribState[index];
+    state.divisor = divisor;
+}
+
 }
diff --git a/Source/core/html/canvas/WebGLVertexArrayObjectOES.h b/Source/core/html/canvas/WebGLVertexArrayObjectOES.h
index 85fb380..9bbc585 100644
--- a/Source/core/html/canvas/WebGLVertexArrayObjectOES.h
+++ b/Source/core/html/canvas/WebGLVertexArrayObjectOES.h
@@ -56,6 +56,7 @@
             , stride(16)
             , originalStride(0)
             , offset(0)
+            , divisor(0)
         {
         }
 
@@ -68,6 +69,7 @@
         GC3Dsizei stride;
         GC3Dsizei originalStride;
         GC3Dintptr offset;
+        GC3Duint divisor;
     };
 
     bool isDefaultObject() const { return m_type == VaoTypeDefault; }
@@ -81,6 +83,7 @@
     VertexAttribState& getVertexAttribState(int index) { return m_vertexAttribState[index]; }
     void setVertexAttribState(GC3Duint, GC3Dsizei, GC3Dint, GC3Denum, GC3Dboolean, GC3Dsizei, GC3Dintptr, PassRefPtr<WebGLBuffer>);
     void unbindBuffer(PassRefPtr<WebGLBuffer>);
+    void setVertexAttribDivisor(GC3Duint index, GC3Duint divisor);
 
 private:
     WebGLVertexArrayObjectOES(WebGLRenderingContext*, VaoType);
diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp
index 481466c..ec7983c 100644
--- a/Source/core/html/parser/XSSAuditor.cpp
+++ b/Source/core/html/parser/XSSAuditor.cpp
@@ -48,9 +48,9 @@
 #include "core/page/DOMWindow.h"
 #include "core/page/Frame.h"
 #include "core/page/Settings.h"
-#include "core/platform/KURL.h"
 #include "core/platform/network/FormData.h"
 #include "core/platform/text/DecodeEscapeSequences.h"
+#include "weborigin/KURL.h"
 #include "weborigin/SecurityOrigin.h"
 #include "wtf/Functional.h"
 #include "wtf/MainThread.h"
@@ -162,7 +162,7 @@
 
 static inline String decodeStandardURLEscapeSequences(const String& string, const WTF::TextEncoding& encoding)
 {
-    // We use decodeEscapeSequences() instead of decodeURLEscapeSequences() (declared in core/platform/KURL.h) to
+    // We use decodeEscapeSequences() instead of decodeURLEscapeSequences() (declared in weborigin/KURL.h) to
     // avoid platform-specific URL decoding differences (e.g. KURLGoogle).
     return decodeEscapeSequences<URLEscapeSequence>(string, encoding);
 }
diff --git a/Source/core/html/parser/XSSAuditor.h b/Source/core/html/parser/XSSAuditor.h
index e140091..33788b5 100644
--- a/Source/core/html/parser/XSSAuditor.h
+++ b/Source/core/html/parser/XSSAuditor.h
@@ -27,9 +27,9 @@
 #define XSSAuditor_h
 
 #include "core/html/parser/HTMLToken.h"
-#include "core/platform/KURL.h"
 #include "core/platform/network/HTTPParsers.h"
 #include "core/platform/text/SuffixTree.h"
+#include "weborigin/KURL.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/text/TextEncoding.h"
 
diff --git a/Source/core/html/parser/XSSAuditorDelegate.h b/Source/core/html/parser/XSSAuditorDelegate.h
index 8d4779c..1ee8dd5 100644
--- a/Source/core/html/parser/XSSAuditorDelegate.h
+++ b/Source/core/html/parser/XSSAuditorDelegate.h
@@ -26,12 +26,12 @@
 #ifndef XSSAuditorDelegate_h
 #define XSSAuditorDelegate_h
 
-#include "core/platform/KURL.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/text/TextPosition.h>
-#include <wtf/text/WTFString.h>
-#include <wtf/Vector.h>
+#include "weborigin/KURL.h"
+#include "wtf/OwnPtr.h"
+#include "wtf/PassOwnPtr.h"
+#include "wtf/Vector.h"
+#include "wtf/text/TextPosition.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/ClearButtonElement.cpp b/Source/core/html/shadow/ClearButtonElement.cpp
index 97ccd40..58acf52 100644
--- a/Source/core/html/shadow/ClearButtonElement.cpp
+++ b/Source/core/html/shadow/ClearButtonElement.cpp
@@ -41,22 +41,23 @@
     , m_clearButtonOwner(&clearButtonOwner)
     , m_capturing(false)
 {
-    setPseudo(AtomicString("-webkit-clear-button", AtomicString::ConstructFromLiteral));
-    setAttribute(idAttr, ShadowElementNames::clearButton());
 }
 
 PassRefPtr<ClearButtonElement> ClearButtonElement::create(Document* document, ClearButtonOwner& clearButtonOwner)
 {
-    return adoptRef(new ClearButtonElement(document, clearButtonOwner));
+    RefPtr<ClearButtonElement> element = adoptRef(new ClearButtonElement(document, clearButtonOwner));
+    element->setPseudo(AtomicString("-webkit-clear-button", AtomicString::ConstructFromLiteral));
+    element->setAttribute(idAttr, ShadowElementNames::clearButton());
+    return element.release();
 }
 
-void ClearButtonElement::detach()
+void ClearButtonElement::detach(const AttachContext& context)
 {
     if (m_capturing) {
         if (Frame* frame = document()->frame())
             frame->eventHandler()->setCapturingMouseEventsNode(0);
     }
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 void ClearButtonElement::releaseCapture()
diff --git a/Source/core/html/shadow/ClearButtonElement.h b/Source/core/html/shadow/ClearButtonElement.h
index 9b9c0c0..a08b1d3 100644
--- a/Source/core/html/shadow/ClearButtonElement.h
+++ b/Source/core/html/shadow/ClearButtonElement.h
@@ -47,7 +47,7 @@
 
 private:
     ClearButtonElement(Document*, ClearButtonOwner&);
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isMouseFocusable() const { return false; }
     virtual void defaultEventHandler(Event*);
     virtual bool isClearButtonElement() const OVERRIDE;
diff --git a/Source/core/html/shadow/DateTimeEditElement.cpp b/Source/core/html/shadow/DateTimeEditElement.cpp
index 37beb2f..07b774d 100644
--- a/Source/core/html/shadow/DateTimeEditElement.cpp
+++ b/Source/core/html/shadow/DateTimeEditElement.cpp
@@ -447,9 +447,6 @@
     : HTMLDivElement(divTag, document)
     , m_editControlOwner(&editControlOwner)
 {
-    DEFINE_STATIC_LOCAL(AtomicString, dateTimeEditPseudoId, ("-webkit-datetime-edit", AtomicString::ConstructFromLiteral));
-    setPseudo(dateTimeEditPseudoId);
-    setAttribute(idAttr, ShadowElementNames::dateTimeEdit());
     setHasCustomStyleCallbacks();
 }
 
@@ -491,6 +488,8 @@
 PassRefPtr<DateTimeEditElement> DateTimeEditElement::create(Document* document, EditControlOwner& editControlOwner)
 {
     RefPtr<DateTimeEditElement> container = adoptRef(new DateTimeEditElement(document, editControlOwner));
+    container->setPseudo(AtomicString("-webkit-datetime-edit", AtomicString::ConstructFromLiteral));
+    container->setAttribute(idAttr, ShadowElementNames::dateTimeEdit());
     return container.release();
 }
 
diff --git a/Source/core/html/shadow/DateTimeFieldElement.cpp b/Source/core/html/shadow/DateTimeFieldElement.cpp
index 545ac02..db8f421 100644
--- a/Source/core/html/shadow/DateTimeFieldElement.cpp
+++ b/Source/core/html/shadow/DateTimeFieldElement.cpp
@@ -46,9 +46,6 @@
     : HTMLSpanElement(spanTag, document)
     , m_fieldOwner(&fieldOwner)
 {
-    // On accessibility, DateTimeFieldElement acts like spin button.
-    setAttribute(roleAttr, "spinbutton");
-    setAttribute(aria_valuetextAttr, AXDateTimeFieldEmptyValueText());
 }
 
 void DateTimeFieldElement::defaultEventHandler(Event* event)
@@ -149,9 +146,13 @@
 
 void DateTimeFieldElement::initialize(const AtomicString& pseudo, const String& axHelpText, int axMinimum, int axMaximum)
 {
-    setAttribute(aria_helpAttr, axHelpText);
+    // On accessibility, DateTimeFieldElement acts like spin button.
+    setAttribute(roleAttr, AtomicString("spinbutton", AtomicString::ConstructFromLiteral));
+    setAttribute(aria_valuetextAttr, AXDateTimeFieldEmptyValueText());
     setAttribute(aria_valueminAttr, String::number(axMinimum));
     setAttribute(aria_valuemaxAttr, String::number(axMaximum));
+
+    setAttribute(aria_helpAttr, axHelpText);
     setPseudo(pseudo);
     appendChild(Text::create(document(), visibleValue()));
 }
@@ -171,15 +172,6 @@
     return m_fieldOwner && m_fieldOwner->isFieldOwnerReadOnly();
 }
 
-bool DateTimeFieldElement::isFocusable() const
-{
-    if (isDisabled())
-        return false;
-    if (isFieldOwnerDisabled())
-        return false;
-    return HTMLElement::isFocusable();
-}
-
 bool DateTimeFieldElement::isDisabled() const
 {
     return fastHasAttribute(disabledAttr);
@@ -210,7 +202,7 @@
 
 bool DateTimeFieldElement::supportsFocus() const
 {
-    return true;
+    return !isDisabled() && !isFieldOwnerDisabled();
 }
 
 void DateTimeFieldElement::updateVisibleValue(EventBehavior eventBehavior)
diff --git a/Source/core/html/shadow/DateTimeFieldElement.h b/Source/core/html/shadow/DateTimeFieldElement.h
index 0b0118d..896d6bc 100644
--- a/Source/core/html/shadow/DateTimeFieldElement.h
+++ b/Source/core/html/shadow/DateTimeFieldElement.h
@@ -64,7 +64,6 @@
     virtual void defaultEventHandler(Event*) OVERRIDE;
     virtual bool hasValue() const = 0;
     bool isDisabled() const;
-    virtual bool isFocusable() const OVERRIDE FINAL;
     virtual float maximumWidth(const Font&);
     virtual void populateDateTimeFieldsState(DateTimeFieldsState&) = 0;
     void removeEventHandler() { m_fieldOwner = 0; }
diff --git a/Source/core/html/shadow/DetailsMarkerControl.cpp b/Source/core/html/shadow/DetailsMarkerControl.cpp
index e797072..84fa604 100644
--- a/Source/core/html/shadow/DetailsMarkerControl.cpp
+++ b/Source/core/html/shadow/DetailsMarkerControl.cpp
@@ -54,12 +54,6 @@
     return summaryElement()->isMainSummary() && HTMLDivElement::rendererIsNeeded(context);
 }
 
-const AtomicString& DetailsMarkerControl::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-details-marker", AtomicString::ConstructFromLiteral));
-    return pseudId;
-}
-
 HTMLSummaryElement* DetailsMarkerControl::summaryElement()
 {
     Element* element = shadowHost();
diff --git a/Source/core/html/shadow/DetailsMarkerControl.h b/Source/core/html/shadow/DetailsMarkerControl.h
index 867f6f1..9cd6e66 100644
--- a/Source/core/html/shadow/DetailsMarkerControl.h
+++ b/Source/core/html/shadow/DetailsMarkerControl.h
@@ -46,14 +46,15 @@
 private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual const AtomicString& shadowPseudoId() const;
 
     HTMLSummaryElement* summaryElement();
 };
 
 inline PassRefPtr<DetailsMarkerControl> DetailsMarkerControl::create(Document* document)
 {
-    return adoptRef(new DetailsMarkerControl(document));
+    RefPtr<DetailsMarkerControl> element = adoptRef(new DetailsMarkerControl(document));
+    element->setPseudo(AtomicString("-webkit-details-marker", AtomicString::ConstructFromLiteral));
+    return element.release();
 }
 
 }
diff --git a/Source/core/html/shadow/HTMLShadowElement.cpp b/Source/core/html/shadow/HTMLShadowElement.cpp
index 7c1383f..3c69757 100644
--- a/Source/core/html/shadow/HTMLShadowElement.cpp
+++ b/Source/core/html/shadow/HTMLShadowElement.cpp
@@ -61,12 +61,13 @@
     if (!containingRoot)
         return 0;
 
-    ContentDistributor::ensureDistribution(containingRoot);
+    containingRoot->host()->ensureDistribution();
 
     ShadowRoot* older = containingRoot->olderShadowRoot();
-    if (!older || older->type() != ShadowRoot::AuthorShadowRoot || ScopeContentDistribution::assignedTo(older) != this)
+    if (!older || !older->shouldExposeToBindings() || ScopeContentDistribution::assignedTo(older) != this)
         return 0;
 
+    ASSERT(older->shouldExposeToBindings());
     return older;
 }
 
diff --git a/Source/core/html/shadow/HTMLShadowElement.idl b/Source/core/html/shadow/HTMLShadowElement.idl
index a252e14..3b6351b 100644
--- a/Source/core/html/shadow/HTMLShadowElement.idl
+++ b/Source/core/html/shadow/HTMLShadowElement.idl
@@ -30,5 +30,5 @@
 
 interface HTMLShadowElement : HTMLElement {
     attribute boolean resetStyleInheritance;
-    readonly attribute ShadowRoot olderShadowRoot;
+    [DeprecateAs=HTMLShadowElementOlderShadowRoot] readonly attribute ShadowRoot olderShadowRoot;
 };
diff --git a/Source/core/html/shadow/MediaControlElements.cpp b/Source/core/html/shadow/MediaControlElements.cpp
index 6eae3dd..243144a 100644
--- a/Source/core/html/shadow/MediaControlElements.cpp
+++ b/Source/core/html/shadow/MediaControlElements.cpp
@@ -34,6 +34,7 @@
 #include "core/dom/EventNames.h"
 #include "core/dom/EventTarget.h"
 #include "core/dom/ExceptionCodePlaceholder.h"
+#include "core/dom/FullscreenController.h"
 #include "core/dom/MouseEvent.h"
 #include "core/html/DOMTokenList.h"
 #include "core/html/HTMLVideoElement.h"
@@ -588,10 +589,10 @@
         // video implementation without requiring them to implement their own full
         // screen behavior.
         if (document()->settings() && document()->settings()->fullScreenEnabled()) {
-            if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == toParentMediaElement(this))
-                document()->webkitCancelFullScreen();
+            if (FullscreenController::isActiveFullScreenElement(toParentMediaElement(this)))
+                FullscreenController::from(document())->webkitCancelFullScreen();
             else
-                document()->requestFullScreenForElement(toParentMediaElement(this), 0, Document::ExemptIFrameAllowFullScreenRequirement);
+                FullscreenController::from(document())->requestFullScreenForElement(toParentMediaElement(this), 0, FullscreenController::ExemptIFrameAllowFullScreenRequirement);
         } else
             mediaController()->enterFullscreen();
         event->setDefaultHandled();
diff --git a/Source/core/html/shadow/MeterShadowElement.cpp b/Source/core/html/shadow/MeterShadowElement.cpp
index 8b79697..482c4eb 100644
--- a/Source/core/html/shadow/MeterShadowElement.cpp
+++ b/Source/core/html/shadow/MeterShadowElement.cpp
@@ -42,7 +42,7 @@
 
 using namespace HTMLNames;
 
-MeterShadowElement::MeterShadowElement(Document* document) 
+inline MeterShadowElement::MeterShadowElement(Document* document)
     : HTMLDivElement(HTMLNames::divTag, document)
 {
 }
@@ -58,11 +58,16 @@
     return render && !render->theme()->supportsMeter(render->style()->appearance()) && HTMLDivElement::rendererIsNeeded(context);
 }
 
-MeterInnerElement::MeterInnerElement(Document* document)
+inline MeterInnerElement::MeterInnerElement(Document* document)
     : MeterShadowElement(document)
 {
-    DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-meter-inner-element", AtomicString::ConstructFromLiteral));
-    setPseudo(pseudoId);
+}
+
+PassRefPtr<MeterInnerElement> MeterInnerElement::create(Document* document)
+{
+    RefPtr<MeterInnerElement> element = adoptRef(new MeterInnerElement(document));
+    element->setPseudo(AtomicString("-webkit-meter-inner-element", AtomicString::ConstructFromLiteral));
+    return element.release();
 }
 
 bool MeterInnerElement::rendererIsNeeded(const NodeRenderingContext& context)
@@ -79,6 +84,30 @@
     return new (arena) RenderMeter(this);
 }
 
+inline MeterBarElement::MeterBarElement(Document* document)
+    : MeterShadowElement(document)
+{
+}
+
+PassRefPtr<MeterBarElement> MeterBarElement::create(Document* document)
+{
+    RefPtr<MeterBarElement> element = adoptRef(new MeterBarElement(document));
+    element->setPseudo(AtomicString("-webkit-meter-bar", AtomicString::ConstructFromLiteral));
+    return element.release();
+}
+
+inline MeterValueElement::MeterValueElement(Document* document)
+    : MeterShadowElement(document)
+{
+}
+
+PassRefPtr<MeterValueElement> MeterValueElement::create(Document* document)
+{
+    RefPtr<MeterValueElement> element = adoptRef(new MeterValueElement(document));
+    element->updatePseudo();
+    return element.release();
+}
+
 const AtomicString& MeterValueElement::valuePseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, optimumPseudoId, ("-webkit-meter-optimum-value", AtomicString::ConstructFromLiteral));
diff --git a/Source/core/html/shadow/MeterShadowElement.h b/Source/core/html/shadow/MeterShadowElement.h
index 3f4bdd4..e076515 100644
--- a/Source/core/html/shadow/MeterShadowElement.h
+++ b/Source/core/html/shadow/MeterShadowElement.h
@@ -40,7 +40,7 @@
 class RenderMeter;
 
 class MeterShadowElement : public HTMLDivElement {
-public:
+protected:
     MeterShadowElement(Document*);
     HTMLMeterElement* meterElement() const;
 
@@ -50,57 +50,33 @@
 
 class MeterInnerElement FINAL : public MeterShadowElement {
 public:
-    MeterInnerElement(Document*);
     static PassRefPtr<MeterInnerElement> create(Document*);
 
 private:
+    MeterInnerElement(Document*);
     virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
 };
 
-inline PassRefPtr<MeterInnerElement> MeterInnerElement::create(Document* document)
-{
-    return adoptRef(new MeterInnerElement(document));
-}
-
 class MeterBarElement FINAL : public MeterShadowElement {
-public:
-    MeterBarElement(Document* document) 
-        : MeterShadowElement(document)
-    {
-        DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-meter-bar", AtomicString::ConstructFromLiteral));
-        setPseudo(pseudoId);
-    }
+private:
+    MeterBarElement(Document*);
 
+public:
     static PassRefPtr<MeterBarElement> create(Document*);
 };
 
-inline PassRefPtr<MeterBarElement> MeterBarElement::create(Document* document)
-{
-    return adoptRef(new MeterBarElement(document));
-}
-
 class MeterValueElement FINAL : public MeterShadowElement {
 public:
-    MeterValueElement(Document* document) 
-        : MeterShadowElement(document)
-    {
-        updatePseudo();
-    }
-
     static PassRefPtr<MeterValueElement> create(Document*);
     void setWidthPercentage(double);
     void updatePseudo() { setPseudo(valuePseudoId()); }
 
 private:
+    MeterValueElement(Document*);
     const AtomicString& valuePseudoId() const;
 };
 
-inline PassRefPtr<MeterValueElement> MeterValueElement::create(Document* document)
-{
-    return adoptRef(new MeterValueElement(document));
-}
-
 }
 
 #endif // MeterShadowElement_h
diff --git a/Source/core/html/shadow/PickerIndicatorElement.cpp b/Source/core/html/shadow/PickerIndicatorElement.cpp
index dbe8453..37531e4 100644
--- a/Source/core/html/shadow/PickerIndicatorElement.cpp
+++ b/Source/core/html/shadow/PickerIndicatorElement.cpp
@@ -48,13 +48,14 @@
     : HTMLDivElement(divTag, document)
     , m_pickerIndicatorOwner(&pickerIndicatorOwner)
 {
-    setPseudo(AtomicString("-webkit-calendar-picker-indicator", AtomicString::ConstructFromLiteral));
-    setAttribute(idAttr, ShadowElementNames::pickerIndicator());
 }
 
 PassRefPtr<PickerIndicatorElement> PickerIndicatorElement::create(Document* document, PickerIndicatorOwner& pickerIndicatorOwner)
 {
-    return adoptRef(new PickerIndicatorElement(document, pickerIndicatorOwner));
+    RefPtr<PickerIndicatorElement> element = adoptRef(new PickerIndicatorElement(document, pickerIndicatorOwner));
+    element->setPseudo(AtomicString("-webkit-calendar-picker-indicator", AtomicString::ConstructFromLiteral));
+    element->setAttribute(idAttr, ShadowElementNames::pickerIndicator());
+    return element.release();
 }
 
 PickerIndicatorElement::~PickerIndicatorElement()
@@ -125,10 +126,10 @@
     m_chooser->endChooser();
 }
 
-void PickerIndicatorElement::detach()
+void PickerIndicatorElement::detach(const AttachContext& context)
 {
     closePopup();
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 bool PickerIndicatorElement::isPickerIndicatorElement() const
diff --git a/Source/core/html/shadow/PickerIndicatorElement.h b/Source/core/html/shadow/PickerIndicatorElement.h
index a380672..496d151 100644
--- a/Source/core/html/shadow/PickerIndicatorElement.h
+++ b/Source/core/html/shadow/PickerIndicatorElement.h
@@ -69,7 +69,7 @@
     PickerIndicatorElement(Document*, PickerIndicatorOwner&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
-    virtual void detach() OVERRIDE;
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isPickerIndicatorElement() const OVERRIDE;
 
     HTMLInputElement* hostInput();
diff --git a/Source/core/html/shadow/ProgressShadowElement.cpp b/Source/core/html/shadow/ProgressShadowElement.cpp
index 030c1ce..f7fdc8a 100644
--- a/Source/core/html/shadow/ProgressShadowElement.cpp
+++ b/Source/core/html/shadow/ProgressShadowElement.cpp
@@ -65,7 +65,9 @@
 
 PassRefPtr<ProgressInnerElement> ProgressInnerElement::create(Document* document)
 {
-    return adoptRef(new ProgressInnerElement(document));
+    RefPtr<ProgressInnerElement> element = adoptRef(new ProgressInnerElement(document));
+    element->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));
+    return element.release();
 }
 
 RenderObject* ProgressInnerElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/Source/core/html/shadow/SliderThumbElement.cpp b/Source/core/html/shadow/SliderThumbElement.cpp
index cdcddf3..3579d9a 100644
--- a/Source/core/html/shadow/SliderThumbElement.cpp
+++ b/Source/core/html/shadow/SliderThumbElement.cpp
@@ -72,8 +72,8 @@
 
 SliderThumbElement* sliderThumbElementOf(Node* node)
 {
-    ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->userAgentShadowRoot();
+    RELEASE_ASSERT(node->hasTagName(inputTag));
+    ShadowRoot* shadow = toHTMLInputElement(node)->userAgentShadowRoot();
     ASSERT(shadow);
     Node* thumb = shadow->firstChild()->firstChild()->firstChild();
     ASSERT(thumb);
@@ -82,8 +82,8 @@
 
 HTMLElement* sliderTrackElementOf(Node* node)
 {
-    ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->userAgentShadowRoot();
+    RELEASE_ASSERT(node->hasTagName(inputTag));
+    ShadowRoot* shadow = toHTMLInputElement(node)->userAgentShadowRoot();
     ASSERT(shadow);
     Node* track = shadow->firstChild()->firstChild();
     ASSERT(track);
@@ -135,7 +135,7 @@
 
 void RenderSliderContainer::computeLogicalHeight(LayoutUnit logicalHeight, LayoutUnit logicalTop, LogicalExtentComputedValues& computedValues) const
 {
-    HTMLInputElement* input = node()->shadowHost()->toInputElement();
+    HTMLInputElement* input = toHTMLInputElement(node()->shadowHost());
     bool isVertical = hasVerticalAppearance(input);
 
     if (input->renderer()->isSlider() && !isVertical && input->list()) {
@@ -161,7 +161,7 @@
 
 void RenderSliderContainer::layout()
 {
-    HTMLInputElement* input = node()->shadowHost()->toInputElement();
+    HTMLInputElement* input = toHTMLInputElement(node()->shadowHost());
     bool isVertical = hasVerticalAppearance(input);
     style()->setFlexDirection(isVertical ? FlowColumn : FlowRow);
     TextDirection oldTextDirection = style()->direction();
@@ -227,7 +227,7 @@
 
 bool SliderThumbElement::isDisabledFormControl() const
 {
-    return hostInput()->isDisabledFormControl();
+    return hostInput() && hostInput()->isDisabledFormControl();
 }
 
 bool SliderThumbElement::matchesReadOnlyPseudoClass() const
@@ -388,20 +388,20 @@
     return HTMLDivElement::willRespondToMouseClickEvents();
 }
 
-void SliderThumbElement::detach()
+void SliderThumbElement::detach(const AttachContext& context)
 {
     if (m_inDragMode) {
         if (Frame* frame = document()->frame())
             frame->eventHandler()->setCapturingMouseEventsNode(0);
     }
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 HTMLInputElement* SliderThumbElement::hostInput() const
 {
     // Only HTMLInputElement creates SliderThumbElement instances as its shadow nodes.
     // So, shadowHost() must be an HTMLInputElement.
-    return shadowHost()->toInputElement();
+    return toHTMLInputElement(shadowHost());
 }
 
 static const AtomicString& sliderThumbShadowPseudoId()
@@ -458,11 +458,10 @@
     DEFINE_STATIC_LOCAL(const AtomicString, mediaSliderContainer, ("-webkit-media-slider-container", AtomicString::ConstructFromLiteral));
     DEFINE_STATIC_LOCAL(const AtomicString, sliderContainer, ("-webkit-slider-container", AtomicString::ConstructFromLiteral));
 
-    HTMLInputElement* input = shadowHost()->toInputElement();
-    if (!input)
+    if (!shadowHost()->hasTagName(inputTag))
         return sliderContainer;
 
-    RenderStyle* sliderStyle = input->renderer()->style();
+    RenderStyle* sliderStyle = toHTMLInputElement(shadowHost())->renderer()->style();
     switch (sliderStyle->appearance()) {
     case MediaSliderPart:
     case MediaSliderThumbPart:
diff --git a/Source/core/html/shadow/SliderThumbElement.h b/Source/core/html/shadow/SliderThumbElement.h
index 1b935e6..983d44b 100644
--- a/Source/core/html/shadow/SliderThumbElement.h
+++ b/Source/core/html/shadow/SliderThumbElement.h
@@ -56,7 +56,7 @@
     virtual void defaultEventHandler(Event*);
     virtual bool willRespondToMouseMoveEvents() OVERRIDE;
     virtual bool willRespondToMouseClickEvents() OVERRIDE;
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual const AtomicString& shadowPseudoId() const;
     HTMLInputElement* hostInput() const;
     void setPositionFromPoint(const LayoutPoint&);
diff --git a/Source/core/html/shadow/SpinButtonElement.cpp b/Source/core/html/shadow/SpinButtonElement.cpp
index f2d8709..f82212f 100644
--- a/Source/core/html/shadow/SpinButtonElement.cpp
+++ b/Source/core/html/shadow/SpinButtonElement.cpp
@@ -51,24 +51,20 @@
     , m_pressStartingState(Indeterminate)
     , m_repeatingTimer(this, &SpinButtonElement::repeatingTimerFired)
 {
-    setAttribute(idAttr, ShadowElementNames::spinButton());
 }
 
 PassRefPtr<SpinButtonElement> SpinButtonElement::create(Document* document, SpinButtonOwner& spinButtonOwner)
 {
-    return adoptRef(new SpinButtonElement(document, spinButtonOwner));
+    RefPtr<SpinButtonElement> element = adoptRef(new SpinButtonElement(document, spinButtonOwner));
+    element->setPseudo(AtomicString("-webkit-inner-spin-button", AtomicString::ConstructFromLiteral));
+    element->setAttribute(idAttr, ShadowElementNames::spinButton());
+    return element.release();
 }
 
-const AtomicString& SpinButtonElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, innerPseudoId, ("-webkit-inner-spin-button", AtomicString::ConstructFromLiteral));
-    return innerPseudoId;
-}
-
-void SpinButtonElement::detach()
+void SpinButtonElement::detach(const AttachContext& context)
 {
     releaseCapture();
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 void SpinButtonElement::defaultEventHandler(Event* event)
diff --git a/Source/core/html/shadow/SpinButtonElement.h b/Source/core/html/shadow/SpinButtonElement.h
index 6f6611b..03f7da4 100644
--- a/Source/core/html/shadow/SpinButtonElement.h
+++ b/Source/core/html/shadow/SpinButtonElement.h
@@ -69,8 +69,7 @@
 private:
     SpinButtonElement(Document*, SpinButtonOwner&);
 
-    virtual const AtomicString& shadowPseudoId() const;
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isSpinButtonElement() const { return true; }
     virtual bool isDisabledFormControl() const OVERRIDE { return shadowHost() && shadowHost()->isDisabledFormControl(); }
     virtual bool matchesReadOnlyPseudoClass() const OVERRIDE;
diff --git a/Source/core/html/shadow/TextControlInnerElements.cpp b/Source/core/html/shadow/TextControlInnerElements.cpp
index 811f994..0eb551d 100644
--- a/Source/core/html/shadow/TextControlInnerElements.cpp
+++ b/Source/core/html/shadow/TextControlInnerElements.cpp
@@ -145,8 +145,8 @@
     Element* host = shadowHost();
     if (!host)
         return resultsDecorationId;
-    if (HTMLInputElement* input = host->toInputElement()) {
-        if (input->maxResults() < 0)
+    if (host->hasTagName(inputTag)) {
+        if (toHTMLInputElement(host)->maxResults() < 0)
             return decorationId;
         return resultsDecorationId;
     }
@@ -183,22 +183,18 @@
 
 PassRefPtr<SearchFieldCancelButtonElement> SearchFieldCancelButtonElement::create(Document* document)
 {
-    return adoptRef(new SearchFieldCancelButtonElement(document));
+    RefPtr<SearchFieldCancelButtonElement> element = adoptRef(new SearchFieldCancelButtonElement(document));
+    element->setPseudo(AtomicString("-webkit-search-cancel-button", AtomicString::ConstructFromLiteral));
+    return element.release();
 }
 
-const AtomicString& SearchFieldCancelButtonElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-search-cancel-button", AtomicString::ConstructFromLiteral));
-    return pseudoId;
-}
-
-void SearchFieldCancelButtonElement::detach()
+void SearchFieldCancelButtonElement::detach(const AttachContext& context)
 {
     if (m_capturing) {
         if (Frame* frame = document()->frame())
             frame->eventHandler()->setCapturingMouseEventsNode(0);
     }
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 
@@ -275,7 +271,9 @@
 
 PassRefPtr<InputFieldSpeechButtonElement> InputFieldSpeechButtonElement::create(Document* document)
 {
-    return adoptRef(new InputFieldSpeechButtonElement(document));
+    RefPtr<InputFieldSpeechButtonElement> element = adoptRef(new InputFieldSpeechButtonElement(document));
+    element->setPseudo(AtomicString("-webkit-input-speech-button", AtomicString::ConstructFromLiteral));
+    return element.release();
 }
 
 void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
@@ -401,15 +399,15 @@
         renderer()->repaint();
 }
 
-void InputFieldSpeechButtonElement::attach()
+void InputFieldSpeechButtonElement::attach(const AttachContext& context)
 {
     ASSERT(!m_listenerId);
     if (SpeechInput* input = SpeechInput::from(document()->page()))
         m_listenerId = input->registerListener(this);
-    HTMLDivElement::attach();
+    HTMLDivElement::attach(context);
 }
 
-void InputFieldSpeechButtonElement::detach()
+void InputFieldSpeechButtonElement::detach(const AttachContext& context)
 {
     if (m_capturing) {
         if (Frame* frame = document()->frame())
@@ -423,7 +421,7 @@
         m_listenerId = 0;
     }
 
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 void InputFieldSpeechButtonElement::startSpeechInput()
@@ -444,13 +442,6 @@
     if (m_state == Recording)
         speechInput()->stopRecording(m_listenerId);
 }
-
-const AtomicString& InputFieldSpeechButtonElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-input-speech-button", AtomicString::ConstructFromLiteral));
-    return pseudoId;
-}
-
 #endif // ENABLE(INPUT_SPEECH)
 
 }
diff --git a/Source/core/html/shadow/TextControlInnerElements.h b/Source/core/html/shadow/TextControlInnerElements.h
index 7a74919..78ad561 100644
--- a/Source/core/html/shadow/TextControlInnerElements.h
+++ b/Source/core/html/shadow/TextControlInnerElements.h
@@ -90,8 +90,7 @@
 
 private:
     SearchFieldCancelButtonElement(Document*);
-    virtual const AtomicString& shadowPseudoId() const;
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isMouseFocusable() const { return false; }
 
     bool m_capturing;
@@ -112,7 +111,7 @@
     static PassRefPtr<InputFieldSpeechButtonElement> create(Document*);
     virtual ~InputFieldSpeechButtonElement();
 
-    virtual void detach();
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual void defaultEventHandler(Event*);
     virtual bool willRespondToMouseClickEvents();
     virtual bool isInputFieldSpeechButtonElement() const { return true; }
@@ -129,9 +128,8 @@
     InputFieldSpeechButtonElement(Document*);
     SpeechInput* speechInput();
     void setState(SpeechInputState state);
-    virtual const AtomicString& shadowPseudoId() const;
     virtual bool isMouseFocusable() const { return false; }
-    virtual void attach();
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     bool m_capturing;
     SpeechInputState m_state;
diff --git a/Source/core/html/shadow/TextFieldDecorationElement.cpp b/Source/core/html/shadow/TextFieldDecorationElement.cpp
index d20fb0d..f281d43 100644
--- a/Source/core/html/shadow/TextFieldDecorationElement.cpp
+++ b/Source/core/html/shadow/TextFieldDecorationElement.cpp
@@ -169,16 +169,16 @@
     return image;
 }
 
-void TextFieldDecorationElement::attach()
+void TextFieldDecorationElement::attach(const AttachContext& context)
 {
-    HTMLDivElement::attach();
+    HTMLDivElement::attach(context);
     updateImage();
 }
 
-void TextFieldDecorationElement::detach()
+void TextFieldDecorationElement::detach(const AttachContext& context)
 {
     m_textFieldDecorator->willDetach(hostInput());
-    HTMLDivElement::detach();
+    HTMLDivElement::detach(context);
 }
 
 bool TextFieldDecorationElement::isMouseFocusable() const
diff --git a/Source/core/html/shadow/TextFieldDecorationElement.h b/Source/core/html/shadow/TextFieldDecorationElement.h
index cf34338..5222044 100644
--- a/Source/core/html/shadow/TextFieldDecorationElement.h
+++ b/Source/core/html/shadow/TextFieldDecorationElement.h
@@ -80,8 +80,8 @@
     virtual bool isTextFieldDecoration() const OVERRIDE;
     virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
-    virtual void attach() OVERRIDE;
-    virtual void detach() OVERRIDE;
+    virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
+    virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isMouseFocusable() const OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
 
diff --git a/Source/core/html/track/TextTrackCue.idl b/Source/core/html/track/TextTrackCue.idl
index 88725a4..7933a53 100644
--- a/Source/core/html/track/TextTrackCue.idl
+++ b/Source/core/html/track/TextTrackCue.idl
@@ -26,7 +26,7 @@
 [
     EnabledAtRuntime=videoTrack,
     Constructor(double startTime, double endTime, DOMString text),
-    CallWith=ScriptExecutionContext,
+    ConstructorCallWith=ScriptExecutionContext,
     EventTarget
 ] interface TextTrackCue {
     readonly attribute TextTrack track;
diff --git a/Source/core/html/track/TextTrackRegion.idl b/Source/core/html/track/TextTrackRegion.idl
index 54421aa..104abba 100644
--- a/Source/core/html/track/TextTrackRegion.idl
+++ b/Source/core/html/track/TextTrackRegion.idl
@@ -27,7 +27,7 @@
     Conditional=WEBVTT_REGIONS,
     Constructor(),
     EnabledAtRuntime=videoTrack,
-    CallWith=ScriptExecutionContext
+    ConstructorCallWith=ScriptExecutionContext
 ] interface TextTrackRegion {
     readonly attribute TextTrack track;