Merge from Chromium at DEPS revision r210036

This commit was generated by merge_to_master.py.

Change-Id: Ib2112ed87a48d7a6d9c0563ba71850716d1475ef
diff --git a/Source/core/html/BaseButtonInputType.cpp b/Source/core/html/BaseButtonInputType.cpp
index 046f8b8..868e235 100644
--- a/Source/core/html/BaseButtonInputType.cpp
+++ b/Source/core/html/BaseButtonInputType.cpp
@@ -33,13 +33,48 @@
 #include "core/html/BaseButtonInputType.h"
 
 #include "HTMLNames.h"
+#include "core/dom/Text.h"
+#include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/rendering/RenderButton.h"
+#include "core/rendering/RenderTextFragment.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+class NonSelectableText : public Text {
+    inline NonSelectableText(Document* document, const String& data)
+        : Text(document, data, CreateText)
+    {
+    }
+
+    virtual RenderText* createTextRenderer(RenderStyle*) OVERRIDE
+    {
+        return new (document()->renderArena()) RenderTextFragment(this, dataImpl());
+    }
+
+public:
+    static inline PassRefPtr<NonSelectableText> create(Document* document, const String& data)
+    {
+        return adoptRef(new NonSelectableText(document, data));
+    }
+};
+
+// ----------------------------
+
+void BaseButtonInputType::createShadowSubtree()
+{
+    ASSERT(element()->userAgentShadowRoot());
+    RefPtr<Text> text = NonSelectableText::create(element()->document(), element()->valueWithDefault());
+    element()->userAgentShadowRoot()->appendChild(text);
+}
+
+void BaseButtonInputType::valueAttributeChanged()
+{
+    toText(element()->userAgentShadowRoot()->firstChild())->setData(element()->valueWithDefault());
+}
+
 bool BaseButtonInputType::shouldSaveAndRestoreFormControlState() const
 {
     return false;
@@ -51,9 +86,9 @@
     return false;
 }
 
-RenderObject* BaseButtonInputType::createRenderer(RenderArena* arena, RenderStyle*) const
+RenderObject* BaseButtonInputType::createRenderer(RenderStyle*) const
 {
-    return new (arena) RenderButton(element());
+    return new (element()->document()->renderArena()) RenderButton(element());
 }
 
 bool BaseButtonInputType::storesValueSeparateFromAttribute()
diff --git a/Source/core/html/BaseButtonInputType.h b/Source/core/html/BaseButtonInputType.h
index 1549404..e006445 100644
--- a/Source/core/html/BaseButtonInputType.h
+++ b/Source/core/html/BaseButtonInputType.h
@@ -41,9 +41,11 @@
     BaseButtonInputType(HTMLInputElement* element) : BaseClickableWithKeyInputType(element) { }
 
 private:
+    virtual void createShadowSubtree() OVERRIDE;
+    virtual void valueAttributeChanged() OVERRIDE;
     virtual bool shouldSaveAndRestoreFormControlState() const OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
 };
diff --git a/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp b/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp
index a8642eb..4682522 100644
--- a/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp
+++ b/Source/core/html/BaseChooserOnlyDateAndTimeInputType.cpp
@@ -128,10 +128,5 @@
     BaseClickableWithKeyInputType::accessKeyAction(element(), sendMouseEvents);
 }
 
-bool BaseChooserOnlyDateAndTimeInputType::isMouseFocusable() const
-{
-    return element()->isFocusable();
-}
-
 }
 #endif
diff --git a/Source/core/html/BaseChooserOnlyDateAndTimeInputType.h b/Source/core/html/BaseChooserOnlyDateAndTimeInputType.h
index 645b2e2..245db8a 100644
--- a/Source/core/html/BaseChooserOnlyDateAndTimeInputType.h
+++ b/Source/core/html/BaseChooserOnlyDateAndTimeInputType.h
@@ -52,7 +52,6 @@
     virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
     virtual void handleKeyupEvent(KeyboardEvent*) OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
-    virtual bool isMouseFocusable() const OVERRIDE;
 
     // DateTimeChooserClient functions:
     virtual void didChooseValue(const String&) OVERRIDE;
diff --git a/Source/core/html/BaseDateAndTimeInputType.cpp b/Source/core/html/BaseDateAndTimeInputType.cpp
index 52e3857..6013692 100644
--- a/Source/core/html/BaseDateAndTimeInputType.cpp
+++ b/Source/core/html/BaseDateAndTimeInputType.cpp
@@ -34,11 +34,10 @@
 #include <limits>
 #include "core/html/HTMLInputElement.h"
 #include "core/platform/text/PlatformLocale.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/DateMath.h>
-#include <wtf/MathExtras.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/text/WTFString.h>
+#include "wtf/CurrentTime.h"
+#include "wtf/DateMath.h"
+#include "wtf/MathExtras.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
@@ -110,7 +109,7 @@
     DateComponents ignoredResult;
     if (!out)
         out = &ignoredResult;
-    return parseToDateComponentsInternal(source.characters(), source.length(), out);
+    return parseToDateComponentsInternal(source, out);
 }
 
 String BaseDateAndTimeInputType::serialize(const Decimal& value) const
@@ -175,4 +174,9 @@
     return element()->isRequired() && value.isEmpty();
 }
 
+bool BaseDateAndTimeInputType::shouldShowFocusRingOnMouseFocus() const
+{
+    return true;
+}
+
 } // namespace WebCore
diff --git a/Source/core/html/BaseDateAndTimeInputType.h b/Source/core/html/BaseDateAndTimeInputType.h
index e68495c..5416764 100644
--- a/Source/core/html/BaseDateAndTimeInputType.h
+++ b/Source/core/html/BaseDateAndTimeInputType.h
@@ -33,7 +33,6 @@
 
 #include "core/html/InputType.h"
 #include "core/platform/DateComponents.h"
-#include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
@@ -50,7 +49,7 @@
     virtual String visibleValue() const OVERRIDE;
 
 private:
-    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const = 0;
+    virtual bool parseToDateComponentsInternal(const String&, DateComponents*) const = 0;
     virtual DateComponents::Type dateType() const = 0;
     virtual double valueAsDate() const OVERRIDE;
     virtual void setValueAsDate(double, ExceptionCode&) const OVERRIDE;
@@ -65,6 +64,7 @@
     virtual String localizeValue(const String&) const OVERRIDE;
     virtual bool supportsReadOnly() const OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
+    virtual bool shouldShowFocusRingOnMouseFocus() const OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp b/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp
index fcf04bf..b15c0a4 100644
--- a/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp
+++ b/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.cpp
@@ -153,6 +153,7 @@
     // We don't need to call blur(). This function is called when control
     // lost focus.
 
+    RefPtr<HTMLInputElement> protector(element());
     // Remove focus ring by CSS "focus" pseudo class.
     element()->setFocus(false);
 }
@@ -163,6 +164,7 @@
     // got focus.
 
     // Add focus ring by CSS "focus" pseudo class.
+    // FIXME: Setting the focus flag to non-focused element is too tricky.
     element()->setFocus(true);
 }
 
@@ -248,7 +250,7 @@
         return;
     DateComponents date;
     unsigned end;
-    if (date.parseDate(value.characters(), value.length(), 0, end) && end == value.length())
+    if (date.parseDate(value, 0, end) && end == value.length())
         edit->setOnlyYearMonthDay(date);
 }
 
@@ -368,7 +370,7 @@
     if (direction == FocusDirectionBackward) {
         if (element()->document()->page())
             element()->document()->page()->focusController()->advanceFocus(direction, 0);
-    } else if (direction == FocusDirectionNone) {
+    } else if (direction == FocusDirectionNone || direction == FocusDirectionMouse) {
         edit->focusByOwner(oldFocusedNode);
     } else
         edit->focusByOwner();
@@ -424,11 +426,6 @@
     return element()->isFocusable();
 }
 
-bool BaseMultipleFieldsDateAndTimeInputType::isMouseFocusable() const
-{
-    return element()->isFocusable();
-}
-
 AtomicString BaseMultipleFieldsDateAndTimeInputType::localeIdentifier() const
 {
     return element()->computeInheritedLanguage();
diff --git a/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.h b/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.h
index a6c4135..639dc04 100644
--- a/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.h
+++ b/Source/core/html/BaseMultipleFieldsDateAndTimeInputType.h
@@ -98,7 +98,6 @@
     virtual bool hasBadInput() const OVERRIDE;
     virtual bool hasCustomFocusLogic() const OVERRIDE FINAL;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const OVERRIDE FINAL;
-    virtual bool isMouseFocusable() const OVERRIDE FINAL;
     virtual void minOrMaxAttributeChanged() OVERRIDE FINAL;
     virtual void readonlyAttributeChanged() OVERRIDE FINAL;
     virtual void requiredAttributeChanged() OVERRIDE FINAL;
diff --git a/Source/core/html/ClassList.cpp b/Source/core/html/ClassList.cpp
index 1865a12..c12b38a 100644
--- a/Source/core/html/ClassList.cpp
+++ b/Source/core/html/ClassList.cpp
@@ -26,7 +26,6 @@
 #include "core/html/ClassList.h"
 
 #include "core/dom/SpaceSplitString.h"
-#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/ClassList.h b/Source/core/html/ClassList.h
index af032d2..ab5220a 100644
--- a/Source/core/html/ClassList.h
+++ b/Source/core/html/ClassList.h
@@ -29,9 +29,8 @@
 #include "core/dom/Element.h"
 #include "core/dom/SpaceSplitString.h"
 #include "core/html/DOMTokenList.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
+#include "wtf/OwnPtr.h"
+#include "wtf/PassOwnPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/ColorInputType.cpp b/Source/core/html/ColorInputType.cpp
index 06abe9e..e6278d4 100644
--- a/Source/core/html/ColorInputType.cpp
+++ b/Source/core/html/ColorInputType.cpp
@@ -35,7 +35,6 @@
 #include "RuntimeEnabledFeatures.h"
 #include "bindings/v8/ScriptController.h"
 #include "core/dom/MouseEvent.h"
-#include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLDataListElement.h"
 #include "core/html/HTMLDivElement.h"
@@ -44,10 +43,9 @@
 #include "core/html/InputTypeNames.h"
 #include "core/page/Chrome.h"
 #include "core/platform/graphics/Color.h"
-#include "core/rendering/RenderObject.h"
 #include "core/rendering/RenderView.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/text/WTFString.h>
+#include "wtf/PassOwnPtr.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/DOMFormData.cpp b/Source/core/html/DOMFormData.cpp
index cf4cbc4..942f51f 100644
--- a/Source/core/html/DOMFormData.cpp
+++ b/Source/core/html/DOMFormData.cpp
@@ -32,7 +32,6 @@
 #include "core/html/DOMFormData.h"
 
 #include "core/fileapi/Blob.h"
-#include "core/html/HTMLFormControlElement.h"
 #include "core/html/HTMLFormElement.h"
 #include "wtf/text/TextEncoding.h"
 #include "wtf/text/WTFString.h"
diff --git a/Source/core/html/DOMSettableTokenList.h b/Source/core/html/DOMSettableTokenList.h
index 0b11920..caa1079 100644
--- a/Source/core/html/DOMSettableTokenList.h
+++ b/Source/core/html/DOMSettableTokenList.h
@@ -27,9 +27,8 @@
 
 #include "core/dom/SpaceSplitString.h"
 #include "core/html/DOMTokenList.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/text/AtomicString.h>
+#include "wtf/RefCounted.h"
+#include "wtf/text/AtomicString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/DOMURL.cpp b/Source/core/html/DOMURL.cpp
index 777fe23..6fe9ffa 100644
--- a/Source/core/html/DOMURL.cpp
+++ b/Source/core/html/DOMURL.cpp
@@ -37,7 +37,6 @@
 #include "modules/mediastream/MediaStream.h"
 #include "weborigin/KURL.h"
 #include "wtf/MainThread.h"
-#include "wtf/PassOwnPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/DateInputType.cpp b/Source/core/html/DateInputType.cpp
index 40ffc25..d53ec40 100644
--- a/Source/core/html/DateInputType.cpp
+++ b/Source/core/html/DateInputType.cpp
@@ -84,11 +84,11 @@
     return StepRange(stepBase, minimum, maximum, step, stepDescription);
 }
 
-bool DateInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+bool DateInputType::parseToDateComponentsInternal(const String& string, DateComponents* out) const
 {
     ASSERT(out);
     unsigned end;
-    return out->parseDate(characters, length, 0, end) && end == length;
+    return out->parseDate(string, 0, end) && end == string.length();
 }
 
 bool DateInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
diff --git a/Source/core/html/DateInputType.h b/Source/core/html/DateInputType.h
index 78575ee..3c25c9b 100644
--- a/Source/core/html/DateInputType.h
+++ b/Source/core/html/DateInputType.h
@@ -33,7 +33,6 @@
 
 #include "core/html/BaseChooserOnlyDateAndTimeInputType.h"
 #include "core/html/BaseMultipleFieldsDateAndTimeInputType.h"
-#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -55,7 +54,7 @@
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual DateComponents::Type dateType() const OVERRIDE;
     virtual StepRange createStepRange(AnyStepHandling) const OVERRIDE;
-    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const OVERRIDE;
+    virtual bool parseToDateComponentsInternal(const String&, DateComponents*) const OVERRIDE;
     virtual bool setMillisecondToDateComponents(double, DateComponents*) const OVERRIDE;
     virtual bool isDateField() const OVERRIDE;
 
diff --git a/Source/core/html/DateTimeFieldsState.h b/Source/core/html/DateTimeFieldsState.h
index 2dd2195..3f6834e 100644
--- a/Source/core/html/DateTimeFieldsState.h
+++ b/Source/core/html/DateTimeFieldsState.h
@@ -27,7 +27,6 @@
 #define DateTimeFieldsState_h
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/DateTimeLocalInputType.cpp b/Source/core/html/DateTimeLocalInputType.cpp
index 7fb9e66..5edd420 100644
--- a/Source/core/html/DateTimeLocalInputType.cpp
+++ b/Source/core/html/DateTimeLocalInputType.cpp
@@ -35,14 +35,13 @@
 #include "core/html/HTMLInputElement.h"
 #include "core/html/InputTypeNames.h"
 #include "core/platform/DateComponents.h"
-#include <wtf/PassOwnPtr.h>
+#include "wtf/PassOwnPtr.h"
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "core/html/DateTimeFieldsState.h"
 #include "core/platform/LocalizedStrings.h"
 #include "core/platform/text/PlatformLocale.h"
-#include <wtf/text/StringBuilder.h>
-#include <wtf/text/WTFString.h>
+#include "wtf/text/WTFString.h"
 #endif
 
 namespace WebCore {
@@ -96,11 +95,11 @@
     return StepRange(stepBase, minimum, maximum, step, stepDescription);
 }
 
-bool DateTimeLocalInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+bool DateTimeLocalInputType::parseToDateComponentsInternal(const String& string, DateComponents* out) const
 {
     ASSERT(out);
     unsigned end;
-    return out->parseDateTimeLocal(characters, length, 0, end) && end == length;
+    return out->parseDateTimeLocal(string, 0, end) && end == string.length();
 }
 
 bool DateTimeLocalInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
diff --git a/Source/core/html/DateTimeLocalInputType.h b/Source/core/html/DateTimeLocalInputType.h
index e2e083e..5b89a78 100644
--- a/Source/core/html/DateTimeLocalInputType.h
+++ b/Source/core/html/DateTimeLocalInputType.h
@@ -54,7 +54,7 @@
     virtual double valueAsDate() const OVERRIDE;
     virtual void setValueAsDate(double, ExceptionCode&) const OVERRIDE;
     virtual StepRange createStepRange(AnyStepHandling) const;
-    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const OVERRIDE;
+    virtual bool parseToDateComponentsInternal(const String&, DateComponents*) const OVERRIDE;
     virtual bool setMillisecondToDateComponents(double, DateComponents*) const OVERRIDE;
     virtual bool isDateTimeLocalField() const OVERRIDE;
 
diff --git a/Source/core/html/EmailInputType.cpp b/Source/core/html/EmailInputType.cpp
index f8707a2..70a9d5d 100644
--- a/Source/core/html/EmailInputType.cpp
+++ b/Source/core/html/EmailInputType.cpp
@@ -58,7 +58,7 @@
 
     UErrorCode error = U_ZERO_ERROR;
     UChar domainNameBuffer[maximumDomainNameLength];
-    int32_t domainNameLength = uidna_IDNToASCII(address.characters() + atPosition + 1, address.length() - atPosition - 1, domainNameBuffer, WTF_ARRAY_LENGTH(domainNameBuffer), idnaConversionOption, 0, &error);
+    int32_t domainNameLength = uidna_IDNToASCII(address.bloatedCharacters() + atPosition + 1, address.length() - atPosition - 1, domainNameBuffer, WTF_ARRAY_LENGTH(domainNameBuffer), idnaConversionOption, 0, &error);
     if (error != U_ZERO_ERROR || domainNameLength <= 0)
         return address;
 
diff --git a/Source/core/html/FileInputType.cpp b/Source/core/html/FileInputType.cpp
index eac4fb4..50e4641 100644
--- a/Source/core/html/FileInputType.cpp
+++ b/Source/core/html/FileInputType.cpp
@@ -158,9 +158,9 @@
     event->setDefaultHandled();
 }
 
-RenderObject* FileInputType::createRenderer(RenderArena* arena, RenderStyle*) const
+RenderObject* FileInputType::createRenderer(RenderStyle*) const
 {
-    return new (arena) RenderFileUploadControl(element());
+    return new (element()->document()->renderArena()) RenderFileUploadControl(element());
 }
 
 bool FileInputType::canSetStringValue() const
diff --git a/Source/core/html/FileInputType.h b/Source/core/html/FileInputType.h
index 104fc84..2a5ce2e 100644
--- a/Source/core/html/FileInputType.h
+++ b/Source/core/html/FileInputType.h
@@ -56,7 +56,7 @@
     virtual bool valueMissing(const String&) const OVERRIDE;
     virtual String valueMissingText() const OVERRIDE;
     virtual void handleDOMActivateEvent(Event*) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual bool canSetStringValue() const OVERRIDE;
     virtual bool canChangeFromAnotherType() const OVERRIDE;
     virtual FileList* files() OVERRIDE;
diff --git a/Source/core/html/FormAssociatedElement.cpp b/Source/core/html/FormAssociatedElement.cpp
index cfb6269..ff69e49 100644
--- a/Source/core/html/FormAssociatedElement.cpp
+++ b/Source/core/html/FormAssociatedElement.cpp
@@ -106,7 +106,7 @@
         HTMLFormElement* newForm = 0;
         Element* newFormCandidate = element->treeScope()->getElementById(formId);
         if (newFormCandidate && newFormCandidate->hasTagName(formTag))
-            newForm = static_cast<HTMLFormElement*>(newFormCandidate);
+            newForm = toHTMLFormElement(newFormCandidate);
         return newForm;
     }
 
diff --git a/Source/core/html/FormController.h b/Source/core/html/FormController.h
index d0b2f43..9276e79 100644
--- a/Source/core/html/FormController.h
+++ b/Source/core/html/FormController.h
@@ -23,11 +23,10 @@
 #define FormController_h
 
 #include "core/dom/CheckedRadioButtons.h"
-#include <wtf/Deque.h>
-#include <wtf/Forward.h>
-#include <wtf/ListHashSet.h>
-#include <wtf/text/WTFString.h>
-#include <wtf/Vector.h>
+#include "wtf/Forward.h"
+#include "wtf/ListHashSet.h"
+#include "wtf/Vector.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/FormDataList.cpp b/Source/core/html/FormDataList.cpp
index aee7619..6096a23 100644
--- a/Source/core/html/FormDataList.cpp
+++ b/Source/core/html/FormDataList.cpp
@@ -30,15 +30,15 @@
 {
 }
 
-void FormDataList::appendString(const String& s)
+void FormDataList::appendString(const String& string)
 {
-    CString cstr = m_encoding.encode(s.characters(), s.length(), WTF::EntitiesForUnencodables);
-    m_items.append(normalizeLineEndingsToCRLF(cstr));
+    CString encodedString = m_encoding.encode(string, WTF::EntitiesForUnencodables);
+    m_items.append(normalizeLineEndingsToCRLF(encodedString));
 }
 
-void FormDataList::appendString(const CString& s)
+void FormDataList::appendString(const CString& string)
 {
-    m_items.append(s);
+    m_items.append(string);
 }
 
 void FormDataList::appendBlob(PassRefPtr<Blob> blob, const String& filename)
diff --git a/Source/core/html/HTMLAnchorElement.cpp b/Source/core/html/HTMLAnchorElement.cpp
index 05576d4..68b31d3 100644
--- a/Source/core/html/HTMLAnchorElement.cpp
+++ b/Source/core/html/HTMLAnchorElement.cpp
@@ -198,7 +198,7 @@
     RenderImage* renderer = toRenderImage(imageElement->renderer());
 
     // FIXME: This should probably pass true for useTransforms.
-    FloatPoint absolutePosition = renderer->absoluteToLocal(FloatPoint(static_cast<MouseEvent*>(event)->pageX(), static_cast<MouseEvent*>(event)->pageY()));
+    FloatPoint absolutePosition = renderer->absoluteToLocal(FloatPoint(toMouseEvent(event)->pageX(), toMouseEvent(event)->pageY()));
     int x = absolutePosition.x();
     int y = absolutePosition.y();
     url.append('?');
@@ -226,9 +226,9 @@
         if (rendererIsEditable()) {
             // This keeps track of the editable block that the selection was in (if it was in one) just before the link was clicked
             // for the LiveWhenNotFocused editable link behavior
-            if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() != RightButton && document()->frame() && document()->frame()->selection()) {
+            if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() != RightButton && document()->frame() && document()->frame()->selection()) {
                 setRootEditableElementForSelectionOnMouseDown(document()->frame()->selection()->rootEditableElement());
-                m_wasShiftKeyDownOnMouseDown = static_cast<MouseEvent*>(event)->shiftKey();
+                m_wasShiftKeyDownOnMouseDown = toMouseEvent(event)->shiftKey();
             } else if (event->type() == eventNames().mouseoverEvent) {
                 // These are cleared on mouseover and not mouseout because their values are needed for drag events,
                 // but drag events happen after mouse out events.
@@ -588,7 +588,7 @@
 {
     if (!event->isMouseEvent())
         return NonMouseEvent;
-    return static_cast<MouseEvent*>(event)->shiftKey() ? MouseEventWithShiftKey : MouseEventWithoutShiftKey;
+    return toMouseEvent(event)->shiftKey() ? MouseEventWithShiftKey : MouseEventWithoutShiftKey;
 }
 
 bool HTMLAnchorElement::treatLinkAsLiveForEventType(EventType eventType) const
@@ -623,12 +623,12 @@
 
 bool isEnterKeyKeydownEvent(Event* event)
 {
-    return event->type() == eventNames().keydownEvent && event->isKeyboardEvent() && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "Enter";
+    return event->type() == eventNames().keydownEvent && event->isKeyboardEvent() && toKeyboardEvent(event)->keyIdentifier() == "Enter";
 }
 
 bool isLinkClick(Event* event)
 {
-    return event->type() == eventNames().clickEvent && (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button() != RightButton);
+    return event->type() == eventNames().clickEvent && (!event->isMouseEvent() || toMouseEvent(event)->button() != RightButton);
 }
 
 bool HTMLAnchorElement::willRespondToMouseClickEvents()
@@ -705,7 +705,7 @@
         handleMouseOver(event);
     else if (event->type() == eventNames().mouseoutEvent)
         handleMouseOut(event);
-    else if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton)
+    else if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton)
         handleLeftMouseDown(event);
     else if (event->type() == eventNames().gesturetapdownEvent)
         handleGestureTapDown(event);
diff --git a/Source/core/html/HTMLAppletElement.cpp b/Source/core/html/HTMLAppletElement.cpp
index d1ac02c..23bc61f 100644
--- a/Source/core/html/HTMLAppletElement.cpp
+++ b/Source/core/html/HTMLAppletElement.cpp
@@ -72,7 +72,7 @@
     return HTMLPlugInImageElement::rendererIsNeeded(context);
 }
 
-RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style)
+RenderObject* HTMLAppletElement::createRenderer(RenderStyle* style)
 {
     if (!canEmbedJava())
         return RenderObject::createObject(this, style);
diff --git a/Source/core/html/HTMLAppletElement.h b/Source/core/html/HTMLAppletElement.h
index affbc68..dd3ea7e 100644
--- a/Source/core/html/HTMLAppletElement.h
+++ b/Source/core/html/HTMLAppletElement.h
@@ -37,7 +37,7 @@
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     
     virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE;
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
     virtual void updateWidget(PluginCreationOption) OVERRIDE;
diff --git a/Source/core/html/HTMLAreaElement.cpp b/Source/core/html/HTMLAreaElement.cpp
index f956d10..c298681 100644
--- a/Source/core/html/HTMLAreaElement.cpp
+++ b/Source/core/html/HTMLAreaElement.cpp
@@ -39,7 +39,6 @@
 
 inline HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
     : HTMLAnchorElement(tagName, document)
-    , m_coordsLen(0)
     , m_lastSize(-1, -1)
     , m_shape(Unknown)
 {
@@ -65,7 +64,7 @@
             m_shape = Rect;
         invalidateCachedRegion();
     } else if (name == coordsAttr) {
-        m_coords = newCoordsArray(value.string(), m_coordsLen);
+        m_coords = parseHTMLAreaElementCoords(value.string());
         invalidateCachedRegion();
     } else if (name == altAttr || name == accesskeyAttr) {
         // Do nothing.
@@ -125,7 +124,7 @@
 
 Path HTMLAreaElement::getRegion(const LayoutSize& size) const
 {
-    if (!m_coords && m_shape != Default)
+    if (m_coords.isEmpty() && m_shape != Default)
         return Path();
 
     LayoutUnit width = size.width();
@@ -134,11 +133,11 @@
     // If element omits the shape attribute, select shape based on number of coordinates.
     Shape shape = m_shape;
     if (shape == Unknown) {
-        if (m_coordsLen == 3)
+        if (m_coords.size() == 3)
             shape = Circle;
-        else if (m_coordsLen == 4)
+        else if (m_coords.size() == 4)
             shape = Rect;
-        else if (m_coordsLen >= 6)
+        else if (m_coords.size() >= 6)
             shape = Poly;
     }
 
@@ -146,8 +145,8 @@
     RenderView* renderView = document()->renderView();
     switch (shape) {
         case Poly:
-            if (m_coordsLen >= 6) {
-                int numPoints = m_coordsLen / 2;
+            if (m_coords.size() >= 6) {
+                int numPoints = m_coords.size() / 2;
                 path.moveTo(FloatPoint(minimumValueForLength(m_coords[0], width, renderView), minimumValueForLength(m_coords[1], height, renderView)));
                 for (int i = 1; i < numPoints; ++i)
                     path.addLineTo(FloatPoint(minimumValueForLength(m_coords[i * 2], width, renderView), minimumValueForLength(m_coords[i * 2 + 1], height, renderView)));
@@ -155,14 +154,14 @@
             }
             break;
         case Circle:
-            if (m_coordsLen >= 3) {
+            if (m_coords.size() >= 3) {
                 Length radius = m_coords[2];
                 int r = min(minimumValueForLength(radius, width, renderView), minimumValueForLength(radius, height, renderView));
                 path.addEllipse(FloatRect(minimumValueForLength(m_coords[0], width, renderView) - r, minimumValueForLength(m_coords[1], height, renderView) - r, 2 * r, 2 * r));
             }
             break;
         case Rect:
-            if (m_coordsLen >= 4) {
+            if (m_coords.size() >= 4) {
                 int x0 = minimumValueForLength(m_coords[0], width, renderView);
                 int y0 = minimumValueForLength(m_coords[1], height, renderView);
                 int x1 = minimumValueForLength(m_coords[2], width, renderView);
diff --git a/Source/core/html/HTMLAreaElement.h b/Source/core/html/HTMLAreaElement.h
index 0d3099f..778e1e5 100644
--- a/Source/core/html/HTMLAreaElement.h
+++ b/Source/core/html/HTMLAreaElement.h
@@ -25,7 +25,6 @@
 
 #include "core/html/HTMLAnchorElement.h"
 #include "core/platform/graphics/LayoutRect.h"
-#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -64,8 +63,7 @@
     void invalidateCachedRegion();
 
     OwnPtr<Path> m_region;
-    OwnArrayPtr<Length> m_coords;
-    int m_coordsLen;
+    Vector<Length> m_coords;
     LayoutSize m_lastSize;
     Shape m_shape;
 };
diff --git a/Source/core/html/HTMLAttributeNames.in b/Source/core/html/HTMLAttributeNames.in
index b4ce47a..1dfbd91 100644
--- a/Source/core/html/HTMLAttributeNames.in
+++ b/Source/core/html/HTMLAttributeNames.in
@@ -125,6 +125,7 @@
 id
 incremental
 indeterminate
+inputmode
 is
 ismap
 itemid
diff --git a/Source/core/html/HTMLBRElement.cpp b/Source/core/html/HTMLBRElement.cpp
index 54425a4..7113519 100644
--- a/Source/core/html/HTMLBRElement.cpp
+++ b/Source/core/html/HTMLBRElement.cpp
@@ -71,12 +71,12 @@
         HTMLElement::collectStyleForPresentationAttribute(name, value, style);
 }
 
-RenderObject* HTMLBRElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLBRElement::createRenderer(RenderStyle* style)
 {
-     if (style->hasContent())
+    if (style->hasContent())
         return RenderObject::createObject(this, style);
 
-     return new (arena) RenderBR(this);
+    return new (document()->renderArena()) RenderBR(this);
 }
 
 }
diff --git a/Source/core/html/HTMLBRElement.h b/Source/core/html/HTMLBRElement.h
index 7034507..8825e17 100644
--- a/Source/core/html/HTMLBRElement.h
+++ b/Source/core/html/HTMLBRElement.h
@@ -41,7 +41,7 @@
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 };
 
 } // namespace
diff --git a/Source/core/html/HTMLBodyElement.h b/Source/core/html/HTMLBodyElement.h
index fe7e259..a5941f7 100644
--- a/Source/core/html/HTMLBodyElement.h
+++ b/Source/core/html/HTMLBodyElement.h
@@ -93,6 +93,12 @@
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 };
 
+inline HTMLBodyElement* toHTMLBodyElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::bodyTag));
+    return static_cast<HTMLBodyElement*>(node);
+}
+
 } //namespace
 
 #endif
diff --git a/Source/core/html/HTMLButtonElement.cpp b/Source/core/html/HTMLButtonElement.cpp
index 855af64..abbf43c 100644
--- a/Source/core/html/HTMLButtonElement.cpp
+++ b/Source/core/html/HTMLButtonElement.cpp
@@ -58,9 +58,9 @@
     setAttribute(typeAttr, type);
 }
 
-RenderObject* HTMLButtonElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLButtonElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderButton(this);
+    return new (document()->renderArena()) RenderButton(this);
 }
 
 const AtomicString& HTMLButtonElement::formControlType() const
@@ -125,13 +125,13 @@
     }
 
     if (event->isKeyboardEvent()) {
-        if (event->type() == eventNames().keydownEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+        if (event->type() == eventNames().keydownEvent && toKeyboardEvent(event)->keyIdentifier() == "U+0020") {
             setActive(true, true);
             // No setDefaultHandled() - IE dispatches a keypress in this case.
             return;
         }
         if (event->type() == eventNames().keypressEvent) {
-            switch (static_cast<KeyboardEvent*>(event)->charCode()) {
+            switch (toKeyboardEvent(event)->charCode()) {
                 case '\r':
                     dispatchSimulatedClick(event);
                     event->setDefaultHandled();
@@ -142,7 +142,7 @@
                     return;
             }
         }
-        if (event->type() == eventNames().keyupEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+        if (event->type() == eventNames().keyupEvent && toKeyboardEvent(event)->keyIdentifier() == "U+0020") {
             if (active())
                 dispatchSimulatedClick(event);
             event->setDefaultHandled();
diff --git a/Source/core/html/HTMLButtonElement.h b/Source/core/html/HTMLButtonElement.h
index 80c096d..37d545e 100644
--- a/Source/core/html/HTMLButtonElement.h
+++ b/Source/core/html/HTMLButtonElement.h
@@ -45,7 +45,7 @@
 
     virtual const AtomicString& formControlType() const;
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 
     // HTMLFormControlElement always creates one, but buttons don't need it.
     virtual bool alwaysCreateUserAgentShadowRoot() const OVERRIDE { return false; }
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 2dba91d..bd0a8fa 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -29,7 +29,6 @@
 #include "core/html/HTMLCanvasElement.h"
 
 #include <math.h>
-#include <stdio.h>
 #include "HTMLNames.h"
 #include "bindings/v8/ScriptController.h"
 #include "core/dom/Document.h"
@@ -45,6 +44,7 @@
 #include "core/platform/graphics/GraphicsContextStateSaver.h"
 #include "core/platform/graphics/ImageBuffer.h"
 #include "core/rendering/RenderHTMLCanvas.h"
+#include "wtf/MemoryInstrumentationHashSet.h"
 
 #include "core/html/canvas/WebGLContextAttributes.h"
 #include "core/html/canvas/WebGLRenderingContext.h"
@@ -76,6 +76,7 @@
     , m_originClean(true)
     , m_hasCreatedImageBuffer(false)
     , m_didClearImageBuffer(false)
+    , m_accelerationDisabled(false)
 {
     ASSERT(hasTagName(canvasTag));
     ScriptWrappable::init(this);
@@ -107,16 +108,16 @@
     HTMLElement::parseAttribute(name, value);
 }
 
-RenderObject* HTMLCanvasElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLCanvasElement::createRenderer(RenderStyle* style)
 {
     Frame* frame = document()->frame();
     if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript)) {
         m_rendererIsCanvas = true;
-        return new (arena) RenderHTMLCanvas(this);
+        return new (document()->renderArena()) RenderHTMLCanvas(this);
     }
 
     m_rendererIsCanvas = false;
-    return HTMLElement::createRenderer(arena, style);
+    return HTMLElement::createRenderer(style);
 }
 
 void HTMLCanvasElement::attach(const AttachContext& context)
@@ -160,10 +161,8 @@
             return 0;
         if (!m_context) {
             m_context = CanvasRenderingContext2D::create(this, RuntimeEnabledFeatures::experimentalCanvasFeaturesEnabled() ? static_cast<Canvas2DContextAttributes*>(attrs) : 0, document()->inQuirksMode());
-            if (m_context) {
-                // Need to make sure a RenderLayer and compositing layer get created for the Canvas
-                setNeedsStyleRecalc(SyntheticStyleChange);
-            }
+            if (m_context)
+                setNeedsLayerUpdate();
         }
         return m_context.get();
     }
@@ -184,10 +183,8 @@
                 return 0;
             if (!m_context) {
                 m_context = WebGLRenderingContext::create(this, static_cast<WebGLContextAttributes*>(attrs));
-                if (m_context) {
-                    // Need to make sure a RenderLayer and compositing layer get created for the Canvas
-                    setNeedsStyleRecalc(SyntheticStyleChange);
-                }
+                if (m_context)
+                    setNeedsLayerUpdate();
             }
             return m_context.get();
         }
@@ -458,6 +455,9 @@
     if (m_context && !m_context->is2d())
         return false;
 
+    if (m_accelerationDisabled)
+        return false;
+
     Settings* settings = document()->settings();
     if (!settings || !settings->accelerated2dCanvasEnabled())
         return false;
@@ -472,7 +472,7 @@
     return true;
 }
 
-void HTMLCanvasElement::createImageBuffer() const
+void HTMLCanvasElement::createImageBuffer()
 {
     ASSERT(!m_imageBuffer);
 
@@ -499,17 +499,15 @@
     m_imageBuffer = ImageBuffer::create(size(), m_deviceScaleFactor, renderingMode, opacityMode);
     if (!m_imageBuffer)
         return;
-    m_imageBuffer->context()->setShadowsIgnoreTransforms(true);
     m_imageBuffer->context()->setImageInterpolationQuality(DefaultInterpolationQuality);
     if (document()->settings() && !document()->settings()->antialiased2dCanvasEnabled())
         m_imageBuffer->context()->setShouldAntialias(false);
     m_imageBuffer->context()->setStrokeThickness(1);
     m_contextStateSaver = adoptPtr(new GraphicsContextStateSaver(*m_imageBuffer->context()));
 
-    if (m_context && m_context->is2d()) {
-        // Recalculate compositing requirements if acceleration state changed.
-        const_cast<HTMLCanvasElement*>(this)->setNeedsStyleRecalc(SyntheticStyleChange);
-    }
+    // Recalculate compositing requirements if acceleration state changed.
+    if (m_context && m_context->is2d())
+        setNeedsLayerUpdate();
 }
 
 GraphicsContext* HTMLCanvasElement::drawingContext() const
@@ -528,7 +526,7 @@
 ImageBuffer* HTMLCanvasElement::buffer() const
 {
     if (!m_hasCreatedImageBuffer)
-        createImageBuffer();
+        const_cast<HTMLCanvasElement*>(this)->createImageBuffer();
     return m_imageBuffer.get();
 }
 
@@ -542,7 +540,7 @@
     return m_copiedImage.get();
 }
 
-void HTMLCanvasElement::clearImageBuffer() const
+void HTMLCanvasElement::clearImageBuffer()
 {
     ASSERT(m_hasCreatedImageBuffer);
     ASSERT(!m_didClearImageBuffer);
diff --git a/Source/core/html/HTMLCanvasElement.h b/Source/core/html/HTMLCanvasElement.h
index 781477b..34bccfb 100644
--- a/Source/core/html/HTMLCanvasElement.h
+++ b/Source/core/html/HTMLCanvasElement.h
@@ -73,6 +73,8 @@
 
     void setWidth(int);
     void setHeight(int);
+    void setAccelerationDisabled(bool accelerationDisabled) { m_accelerationDisabled = accelerationDisabled; }
+    bool accelerationDisabled() const { return m_accelerationDisabled; }
 
     void setSize(const IntSize& newSize)
     { 
@@ -137,7 +139,7 @@
     HTMLCanvasElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool areAuthorShadowsAllowed() const OVERRIDE { return false; }
 
@@ -145,8 +147,8 @@
 
     float targetDeviceScaleFactor() const;
 
-    void createImageBuffer() const;
-    void clearImageBuffer() const;
+    void createImageBuffer();
+    void clearImageBuffer();
 
     void setSurfaceSize(const IntSize&);
 
@@ -161,6 +163,7 @@
     bool m_rendererIsCanvas;
 
     bool m_ignoreReset;
+    bool m_accelerationDisabled;
     FloatRect m_dirtyRect;
 
     float m_deviceScaleFactor;
@@ -169,9 +172,9 @@
     // m_createdImageBuffer means we tried to malloc the buffer.  We didn't necessarily get it.
     mutable bool m_hasCreatedImageBuffer;
     mutable bool m_didClearImageBuffer;
-    mutable OwnPtr<ImageBuffer> m_imageBuffer;
+    OwnPtr<ImageBuffer> m_imageBuffer;
     mutable OwnPtr<GraphicsContextStateSaver> m_contextStateSaver;
-    
+
     mutable RefPtr<Image> m_presentedImage;
     mutable RefPtr<Image> m_copiedImage; // FIXME: This is temporary for platforms that have to copy the image buffer to render (and for CSSCanvasValue).
 };
diff --git a/Source/core/html/HTMLCollection.cpp b/Source/core/html/HTMLCollection.cpp
index b9aa6fb..2e74168 100644
--- a/Source/core/html/HTMLCollection.cpp
+++ b/Source/core/html/HTMLCollection.cpp
@@ -32,8 +32,6 @@
 #include "core/html/HTMLObjectElement.h"
 #include "core/html/HTMLOptionElement.h"
 
-#include <utility>
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -205,7 +203,7 @@
         return element->hasLocalName(optionTag) && toHTMLOptionElement(element)->selected();
     case DataListOptions:
         if (element->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(element);
+            HTMLOptionElement* option = toHTMLOptionElement(element);
             if (!option->isDisabledFormControl() && !option->value().isEmpty())
                 return true;
         }
diff --git a/Source/core/html/HTMLCollection.h b/Source/core/html/HTMLCollection.h
index a971961..d76c61e 100644
--- a/Source/core/html/HTMLCollection.h
+++ b/Source/core/html/HTMLCollection.h
@@ -23,13 +23,11 @@
 #ifndef HTMLCollection_h
 #define HTMLCollection_h
 
-#include "bindings/v8/ScriptWrappable.h"
 #include "core/dom/LiveNodeList.h"
 #include "core/html/CollectionType.h"
-#include <wtf/Forward.h>
-#include <wtf/HashMap.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
+#include "wtf/Forward.h"
+#include "wtf/HashMap.h"
+#include "wtf/Vector.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/HTMLDetailsElement.cpp b/Source/core/html/HTMLDetailsElement.cpp
index 1c5620f..4147245 100644
--- a/Source/core/html/HTMLDetailsElement.cpp
+++ b/Source/core/html/HTMLDetailsElement.cpp
@@ -55,9 +55,9 @@
     ScriptWrappable::init(this);
 }
 
-RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLDetailsElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderBlock(this);
+    return new (document()->renderArena()) RenderBlock(this);
 }
 
 void HTMLDetailsElement::didAddUserAgentShadowRoot(ShadowRoot* root)
diff --git a/Source/core/html/HTMLDetailsElement.h b/Source/core/html/HTMLDetailsElement.h
index 16d97c2..565bba9 100644
--- a/Source/core/html/HTMLDetailsElement.h
+++ b/Source/core/html/HTMLDetailsElement.h
@@ -35,7 +35,7 @@
 private:
     HTMLDetailsElement(const QualifiedName&, Document*);
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
 
diff --git a/Source/core/html/HTMLDocument.cpp b/Source/core/html/HTMLDocument.cpp
index d157c4c..a9ceaf4 100644
--- a/Source/core/html/HTMLDocument.cpp
+++ b/Source/core/html/HTMLDocument.cpp
@@ -77,20 +77,6 @@
 {
 }
 
-int HTMLDocument::width()
-{
-    updateLayoutIgnorePendingStylesheets();
-    FrameView* frameView = view();
-    return frameView ? frameView->contentsWidth() : 0;
-}
-
-int HTMLDocument::height()
-{
-    updateLayoutIgnorePendingStylesheets();
-    FrameView* frameView = view();
-    return frameView ? frameView->contentsHeight() : 0;
-}
-
 String HTMLDocument::dir()
 {
     HTMLElement* b = body();
@@ -144,60 +130,48 @@
     return false;
 }
 
+inline HTMLBodyElement* HTMLDocument::bodyAsHTMLBodyElement() const
+{
+    HTMLElement* element = body();
+    return (element && element->hasTagName(bodyTag)) ? toHTMLBodyElement(element) : 0;
+}
+
 String HTMLDocument::bgColor()
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (!bodyElement)
-        return String();
-    return bodyElement->bgColor();
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
+        return bodyElement->bgColor();
+    return String();
 }
 
 void HTMLDocument::setBgColor(const String& value)
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (bodyElement)
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
         bodyElement->setBgColor(value);
 }
 
 String HTMLDocument::fgColor()
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (!bodyElement)
-        return String();
-    return bodyElement->text();
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
+        return bodyElement->text();
+    return String();
 }
 
 void HTMLDocument::setFgColor(const String& value)
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (bodyElement)
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
         bodyElement->setText(value);
 }
 
 String HTMLDocument::alinkColor()
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (!bodyElement)
-        return String();
-    return bodyElement->aLink();
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
+        return bodyElement->aLink();
+    return String();
 }
 
 void HTMLDocument::setAlinkColor(const String& value)
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (bodyElement) {
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement()) {
         // This check is a bit silly, but some benchmarks like to set the
         // document's link colors over and over to the same value and we
         // don't want to incur a style update each time.
@@ -208,20 +182,14 @@
 
 String HTMLDocument::linkColor()
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (!bodyElement)
-        return String();
-    return bodyElement->link();
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
+        return bodyElement->link();
+    return String();
 }
 
 void HTMLDocument::setLinkColor(const String& value)
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (bodyElement) {
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement()) {
         // This check is a bit silly, but some benchmarks like to set the
         // document's link colors over and over to the same value and we
         // don't want to incur a style update each time.
@@ -232,20 +200,14 @@
 
 String HTMLDocument::vlinkColor()
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (!bodyElement)
-        return String();
-    return bodyElement->vLink();
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement())
+        return bodyElement->vLink();
+    return String();
 }
 
 void HTMLDocument::setVlinkColor(const String& value)
 {
-    HTMLElement* b = body();
-    HTMLBodyElement* bodyElement = (b && b->hasTagName(bodyTag)) ? static_cast<HTMLBodyElement*>(b) : 0;
-
-    if (bodyElement) {
+    if (HTMLBodyElement* bodyElement = bodyAsHTMLBodyElement()) {
         // This check is a bit silly, but some benchmarks like to set the
         // document's link colors over and over to the same value and we
         // don't want to incur a style update each time.
diff --git a/Source/core/html/HTMLDocument.h b/Source/core/html/HTMLDocument.h
index 78f067a..82f46a3 100644
--- a/Source/core/html/HTMLDocument.h
+++ b/Source/core/html/HTMLDocument.h
@@ -25,12 +25,12 @@
 
 #include "core/dom/Document.h"
 #include "core/loader/cache/CachedResourceClient.h"
-#include <wtf/HashCountedSet.h>
-#include <wtf/text/AtomicStringHash.h>
+#include "wtf/HashCountedSet.h"
 
 namespace WebCore {
 
 class FrameView;
+class HTMLBodyElement;
 class HTMLElement;
 
 class HTMLDocument : public Document, public CachedResourceClient {
@@ -41,9 +41,6 @@
     }
     virtual ~HTMLDocument();
 
-    int width();
-    int height();
-
     String dir();
     void setDir(const String&);
 
@@ -80,6 +77,7 @@
     HTMLDocument(Frame*, const KURL&, DocumentClassFlags extendedDocumentClasses = DefaultDocumentClass);
 
 private:
+    HTMLBodyElement* bodyAsHTMLBodyElement() const;
     void addItemToMap(HashCountedSet<AtomicStringImpl*>&, const AtomicString&);
     void removeItemFromMap(HashCountedSet<AtomicStringImpl*>&, const AtomicString&);
 
diff --git a/Source/core/html/HTMLDocument.idl b/Source/core/html/HTMLDocument.idl
index 889f741..860900f 100644
--- a/Source/core/html/HTMLDocument.idl
+++ b/Source/core/html/HTMLDocument.idl
@@ -32,14 +32,12 @@
 
     // Extensions
 
-    [Replaceable] readonly attribute HTMLAllCollection all;
+    [Replaceable, ImplementedAs=allForBinding] readonly attribute HTMLAllCollection all;
 
     [DeprecateAs=DocumentClear] void clear();
 
-    readonly attribute long width;
-    readonly attribute long height;
-             [TreatNullAs=NullString] attribute DOMString dir;
-             [TreatNullAs=NullString] attribute DOMString designMode;
+    [TreatNullAs=NullString] attribute DOMString dir;
+    [TreatNullAs=NullString] attribute DOMString designMode;
     readonly attribute DOMString compatMode;
 
     readonly attribute Element activeElement;
diff --git a/Source/core/html/HTMLElement.cpp b/Source/core/html/HTMLElement.cpp
index 5953c68..44c6176 100644
--- a/Source/core/html/HTMLElement.cpp
+++ b/Source/core/html/HTMLElement.cpp
@@ -38,6 +38,7 @@
 #include "core/dom/EventListener.h"
 #include "core/dom/EventNames.h"
 #include "core/dom/ExceptionCode.h"
+#include "core/dom/KeyboardEvent.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/Text.h"
 #include "core/editing/markup.h"
@@ -48,6 +49,7 @@
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/loader/FrameLoader.h"
 #include "core/page/Frame.h"
+#include "core/page/Settings.h"
 #include "core/rendering/RenderWordBreak.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
@@ -143,7 +145,7 @@
 {
     if (name == alignAttr || name == contenteditableAttr || name == hiddenAttr || name == langAttr || name.matches(XMLNames::langAttr) || name == draggableAttr || name == dirAttr)
         return true;
-    return StyledElement::isPresentationAttribute(name);
+    return Element::isPresentationAttribute(name);
 }
 
 void HTMLElement::collectStyleForPresentationAttribute(const QualifiedName& name, const AtomicString& value, MutableStylePropertySet* style)
@@ -187,7 +189,7 @@
         if (!fastHasAttribute(XMLNames::langAttr))
             mapLanguageAttributeToLocale(value, style);
     } else
-        StyledElement::collectStyleForPresentationAttribute(name, value, style);
+        Element::collectStyleForPresentationAttribute(name, value, style);
 }
 
 AtomicString HTMLElement::eventNameForAttributeName(const QualifiedName& attrName) const
@@ -277,7 +279,7 @@
 void HTMLElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (isIdAttributeName(name) || name == classAttr || name == styleAttr)
-        return StyledElement::parseAttribute(name, value);
+        return Element::parseAttribute(name, value);
 
     if (name == dirAttr)
         dirAttributeChanged(value);
@@ -598,6 +600,23 @@
     return false;
 }
 
+bool HTMLElement::supportsSpatialNavigationFocus() const
+{
+    // This function checks whether the element satisfies the extended criteria
+    // for the element to be focusable, introduced by spatial navigation feature,
+    // i.e. checks if click or keyboard event handler is specified.
+    // This is the way to make it possible to navigate to (focus) elements
+    // which web designer meant for being active (made them respond to click events).
+
+    if (!document()->settings() || !document()->settings()->spatialNavigationEnabled())
+        return false;
+    EventTarget* target = const_cast<HTMLElement*>(this);
+    return target->hasEventListeners(eventNames().clickEvent)
+        || target->hasEventListeners(eventNames().keydownEvent)
+        || target->hasEventListeners(eventNames().keypressEvent)
+        || target->hasEventListeners(eventNames().keyupEvent);
+}
+
 bool HTMLElement::supportsFocus() const
 {
     // FIXME: supportsFocus() can be called when layout is not up to date.
@@ -605,7 +624,8 @@
     // But supportsFocus must return true when the element is editable, or else
     // it won't be focusable. Furthermore, supportsFocus cannot just return true
     // always or else tabIndex() will change for all HTML elements.
-    return Element::supportsFocus() || (rendererIsEditable() && parentNode() && !parentNode()->rendererIsEditable());
+    return Element::supportsFocus() || (rendererIsEditable() && parentNode() && !parentNode()->rendererIsEditable())
+        || supportsSpatialNavigationFocus();
 }
 
 String HTMLElement::contentEditable() const
@@ -732,13 +752,13 @@
         if (frame && frame->loader()->subframeLoader()->allowPlugins(NotAboutToInstantiatePlugin))
             return false;
     }
-    return StyledElement::rendererIsNeeded(context);
+    return Element::rendererIsNeeded(context);
 }
 
-RenderObject* HTMLElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLElement::createRenderer(RenderStyle* style)
 {
     if (hasLocalName(wbrTag))
-        return new (arena) RenderWordBreak(this);
+        return new (document()->renderArena()) RenderWordBreak(this);
     return RenderObject::createObject(this, style);
 }
 
@@ -746,7 +766,7 @@
 {
     for (ContainerNode* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
         if (ancestor->hasTagName(formTag))
-            return static_cast<HTMLFormElement*>(ancestor);
+            return toHTMLFormElement(ancestor);
     }
     return 0;
 }
@@ -786,7 +806,7 @@
 
 void HTMLElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    StyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    Element::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     adjustDirectionalityIfNeededAfterChildrenChanged(beforeChange, childCountDelta);
 }
 
@@ -1029,6 +1049,28 @@
     style->setProperty(propertyID, cssValuePool().createColorValue(parsedColor.rgb()));
 }
 
+void HTMLElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().keypressEvent && event->isKeyboardEvent()) {
+        handleKeypressEvent(toKeyboardEvent(event));
+        if (event->defaultHandled())
+            return;
+    }
+
+    Element::defaultEventHandler(event);
+}
+
+void HTMLElement::handleKeypressEvent(KeyboardEvent* event)
+{
+    if (!document()->settings() || !document()->settings()->spatialNavigationEnabled() || !supportsFocus())
+        return;
+    int charCode = event->charCode();
+    if (charCode == '\r' || charCode == ' ') {
+        dispatchSimulatedClick(event);
+        event->setDefaultHandled();
+    }
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/core/html/HTMLElement.h b/Source/core/html/HTMLElement.h
index 3f93fc2..4918a7a 100644
--- a/Source/core/html/HTMLElement.h
+++ b/Source/core/html/HTMLElement.h
@@ -23,7 +23,7 @@
 #ifndef HTMLElement_h
 #define HTMLElement_h
 
-#include "core/dom/StyledElement.h"
+#include "core/dom/Element.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@
     TranslateAttributeInherit
 };
 
-class HTMLElement : public StyledElement {
+class HTMLElement : public Element {
 public:
     static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
 
@@ -79,7 +79,7 @@
     bool ieForbidsInsertHTML() const;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 
     HTMLFormElement* form() const { return virtualForm(); }
 
@@ -92,6 +92,8 @@
 
     virtual bool isLabelable() const { return false; }
 
+    virtual void defaultEventHandler(Event*) OVERRIDE;
+
 protected:
     HTMLElement(const QualifiedName& tagName, Document*, ConstructionType);
 
@@ -127,6 +129,9 @@
     TranslateAttributeMode translateAttributeMode() const;
 
     AtomicString eventNameForAttributeName(const QualifiedName& attrName) const;
+
+    void handleKeypressEvent(KeyboardEvent*);
+    bool supportsSpatialNavigationFocus() const;
 };
 
 inline HTMLElement* toHTMLElement(Node* node)
@@ -145,7 +150,7 @@
 void toHTMLElement(const HTMLElement*);
 
 inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document, ConstructionType type = CreateHTMLElement)
-    : StyledElement(tagName, document, type)
+    : Element(tagName, document, type)
 {
     ASSERT(tagName.localName().impl());
     ScriptWrappable::init(this);
diff --git a/Source/core/html/HTMLEmbedElement.cpp b/Source/core/html/HTMLEmbedElement.cpp
index 909f822..6aabaf2 100644
--- a/Source/core/html/HTMLEmbedElement.cpp
+++ b/Source/core/html/HTMLEmbedElement.cpp
@@ -27,17 +27,13 @@
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
 #include "core/dom/Attribute.h"
-#include "core/html/HTMLDocument.h"
 #include "core/html/HTMLImageLoader.h"
 #include "core/html/HTMLObjectElement.h"
 #include "core/html/PluginDocument.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/page/Frame.h"
-#include "core/page/Settings.h"
 #include "core/rendering/RenderEmbeddedObject.h"
-#include "core/rendering/RenderImage.h"
 #include "core/rendering/RenderWidget.h"
 
 namespace WebCore {
diff --git a/Source/core/html/HTMLFieldSetElement.cpp b/Source/core/html/HTMLFieldSetElement.cpp
index d441041..21a386b 100644
--- a/Source/core/html/HTMLFieldSetElement.cpp
+++ b/Source/core/html/HTMLFieldSetElement.cpp
@@ -54,7 +54,7 @@
 {
     for (Element* element = ElementTraversal::firstWithin(base); element; element = ElementTraversal::next(element, base)) {
         if (element->isFormControlElement())
-            static_cast<HTMLFormControlElement*>(element)->ancestorDisabledStateWasChanged();
+            toHTMLFormControlElement(element)->ancestorDisabledStateWasChanged();
     }
 }
 
@@ -85,9 +85,9 @@
     return fieldset;
 }
 
-RenderObject* HTMLFieldSetElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLFieldSetElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderFieldset(this);
+    return new (document()->renderArena()) RenderFieldset(this);
 }
 
 HTMLLegendElement* HTMLFieldSetElement::legend() const
@@ -123,7 +123,7 @@
         if (!element->isFormControlElement())
             continue;
 
-        m_associatedElements.append(static_cast<HTMLFormControlElement*>(element));
+        m_associatedElements.append(toHTMLFormControlElement(element));
     }
 }
 
diff --git a/Source/core/html/HTMLFieldSetElement.h b/Source/core/html/HTMLFieldSetElement.h
index 587f2fe..c63444f 100644
--- a/Source/core/html/HTMLFieldSetElement.h
+++ b/Source/core/html/HTMLFieldSetElement.h
@@ -25,7 +25,6 @@
 #define HTMLFieldSetElement_h
 
 #include "core/html/HTMLFormControlElement.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -50,7 +49,7 @@
 
     virtual bool isEnumeratable() const { return true; }
     virtual bool supportsFocus() const;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual const AtomicString& formControlType() const;
     virtual bool recalcWillValidate() const { return false; }
     virtual void childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta) OVERRIDE;
diff --git a/Source/core/html/HTMLFormControlElement.cpp b/Source/core/html/HTMLFormControlElement.cpp
index 48056cb..6fc0026 100644
--- a/Source/core/html/HTMLFormControlElement.cpp
+++ b/Source/core/html/HTMLFormControlElement.cpp
@@ -55,6 +55,7 @@
     , m_willValidate(true)
     , m_isValid(true)
     , m_wasChangedSinceLastFormControlChangeEvent(false)
+    , m_wasFocusedByMouse(false)
     , m_hasAutofocused(false)
 {
     setForm(form ? form : findFormAncestor());
@@ -316,14 +317,39 @@
 
 bool HTMLFormControlElement::isKeyboardFocusable(KeyboardEvent*) const
 {
-    return isFocusable() && document()->frame();
+    // Skip tabIndex check in a parent class.
+    return isFocusable();
 }
 
-bool HTMLFormControlElement::isMouseFocusable() const
+bool HTMLFormControlElement::shouldShowFocusRingOnMouseFocus() const
 {
     return false;
 }
 
+void HTMLFormControlElement::dispatchFocusEvent(PassRefPtr<Node> oldFocusedNode, FocusDirection direction)
+{
+    m_wasFocusedByMouse = direction == FocusDirectionMouse;
+    HTMLElement::dispatchFocusEvent(oldFocusedNode, direction);
+}
+
+bool HTMLFormControlElement::shouldHaveFocusAppearance() const
+{
+    ASSERT(focused());
+    return shouldShowFocusRingOnMouseFocus() || !m_wasFocusedByMouse;
+}
+
+void HTMLFormControlElement::willCallDefaultEventHandler(const Event& event)
+{
+    if (!event.isKeyboardEvent() || event.type() != eventNames().keydownEvent)
+        return;
+    if (!m_wasFocusedByMouse)
+        return;
+    m_wasFocusedByMouse = false;
+    if (renderer())
+        renderer()->repaint();
+}
+
+
 short HTMLFormControlElement::tabIndex() const
 {
     // Skip the supportsFocus check in HTMLElement.
@@ -396,10 +422,12 @@
         m_validationMessage->requestToHideMessage();
 }
 
-bool HTMLFormControlElement::checkValidity(Vector<RefPtr<FormAssociatedElement> >* unhandledInvalidControls)
+bool HTMLFormControlElement::checkValidity(Vector<RefPtr<FormAssociatedElement> >* unhandledInvalidControls, CheckValidityDispatchEvents dispatchEvents)
 {
     if (!willValidate() || isValidFormControlElement())
         return true;
+    if (dispatchEvents == CheckValidityDispatchEventsNone)
+        return false;
     // An event handler can deref this object.
     RefPtr<HTMLFormControlElement> protector(this);
     RefPtr<Document> originalDocument(document());
@@ -460,7 +488,7 @@
 {
     for (; node; node = node->parentNode()) {
         if (node->isElementNode() && toElement(node)->isFormControlElement())
-            return static_cast<HTMLFormControlElement*>(node);
+            return toHTMLFormControlElement(node);
     }
     return 0;
 }
diff --git a/Source/core/html/HTMLFormControlElement.h b/Source/core/html/HTMLFormControlElement.h
index 7edb7bd..6d0a644 100644
--- a/Source/core/html/HTMLFormControlElement.h
+++ b/Source/core/html/HTMLFormControlElement.h
@@ -84,10 +84,12 @@
     virtual bool isActivatedSubmit() const { return false; }
     virtual void setActivatedSubmit(bool) { }
 
+    enum CheckValidityDispatchEvents { CheckValidityDispatchEventsAllowed, CheckValidityDispatchEventsNone };
+
     virtual bool willValidate() const;
     void updateVisibleValidationMessage();
     void hideVisibleValidationMessage();
-    bool checkValidity(Vector<RefPtr<FormAssociatedElement> >* unhandledInvalidControls = 0);
+    bool checkValidity(Vector<RefPtr<FormAssociatedElement> >* unhandledInvalidControls = 0, CheckValidityDispatchEvents = CheckValidityDispatchEventsAllowed);
     // This must be called when a validation constraint or control value is changed.
     void setNeedsValidityCheck();
     virtual void setCustomValidity(const String&) OVERRIDE;
@@ -119,7 +121,10 @@
     virtual bool supportsFocus() const OVERRIDE;
     virtual bool rendererIsFocusable() const OVERRIDE;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
+    virtual bool shouldShowFocusRingOnMouseFocus() const;
+    virtual bool shouldHaveFocusAppearance() const OVERRIDE;
+    virtual void dispatchFocusEvent(PassRefPtr<Node> oldFocusedNode, FocusDirection) OVERRIDE;
+    virtual void willCallDefaultEventHandler(const Event&) OVERRIDE;
 
     virtual void didRecalcStyle(StyleChange) OVERRIDE;
 
@@ -165,10 +170,22 @@
     bool m_isValid : 1;
 
     bool m_wasChangedSinceLastFormControlChangeEvent : 1;
-
+    bool m_wasFocusedByMouse : 1;
     bool m_hasAutofocused : 1;
 };
 
+inline HTMLFormControlElement* toHTMLFormControlElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || (node->isElementNode() && toElement(node)->isFormControlElement()));
+    return static_cast<HTMLFormControlElement*>(node);
+}
+
+inline HTMLFormControlElement* toHTMLFormControlElement(FormAssociatedElement* control)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!control || control->isFormControlElement());
+    return static_cast<HTMLFormControlElement*>(control);
+}
+
 } // namespace
 
 #endif
diff --git a/Source/core/html/HTMLFormControlsCollection.cpp b/Source/core/html/HTMLFormControlsCollection.cpp
index ac6fca4..f1f06aa 100644
--- a/Source/core/html/HTMLFormControlsCollection.cpp
+++ b/Source/core/html/HTMLFormControlsCollection.cpp
@@ -56,15 +56,14 @@
     ASSERT(ownerNode());
     ASSERT(ownerNode()->hasTagName(formTag) || ownerNode()->hasTagName(fieldsetTag));
     if (ownerNode()->hasTagName(formTag))
-        return static_cast<HTMLFormElement*>(ownerNode())->associatedElements();
+        return toHTMLFormElement(ownerNode())->associatedElements();
     return static_cast<HTMLFieldSetElement*>(ownerNode())->associatedElements();
 }
 
 const Vector<HTMLImageElement*>& HTMLFormControlsCollection::formImageElements() const
 {
     ASSERT(ownerNode());
-    ASSERT(ownerNode()->hasTagName(formTag));
-    return static_cast<HTMLFormElement*>(ownerNode())->imageElements();
+    return toHTMLFormElement(ownerNode())->imageElements();
 }
 
 Element* HTMLFormControlsCollection::virtualItemAfter(unsigned& offset, Element* previousItem) const
diff --git a/Source/core/html/HTMLFormElement.cpp b/Source/core/html/HTMLFormElement.cpp
index 633d4b9..e9988d1 100644
--- a/Source/core/html/HTMLFormElement.cpp
+++ b/Source/core/html/HTMLFormElement.cpp
@@ -37,25 +37,14 @@
 #include "core/dom/NamedNodesCollection.h"
 #include "core/dom/NodeRenderingContext.h"
 #include "core/dom/NodeTraversal.h"
-#include "core/fileapi/FileList.h"
-#include "core/html/DOMFormData.h"
 #include "core/html/FormController.h"
-#include "core/html/FormDataList.h"
 #include "core/html/HTMLCollection.h"
-#include "core/html/HTMLDocument.h"
 #include "core/html/HTMLImageElement.h"
 #include "core/html/HTMLInputElement.h"
-#include "core/html/ValidityState.h"
 #include "core/loader/FormState.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
-#include "core/page/DOMWindow.h"
 #include "core/page/Frame.h"
-#include "core/page/Page.h"
-#include "core/page/Settings.h"
-#include "core/platform/FileSystem.h"
-#include "core/platform/MIMETypeRegistry.h"
-#include "core/platform/network/FormData.h"
 #include "core/rendering/RenderTextControl.h"
 
 using namespace std;
@@ -186,13 +175,13 @@
         FormAssociatedElement* formAssociatedElement = m_associatedElements[i];
         if (!formAssociatedElement->isFormControlElement())
             continue;
-        HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(formAssociatedElement);
-        if (formElement->isSuccessfulSubmitButton()) {
-            if (formElement->renderer()) {
-                formElement->dispatchSimulatedClick(event);
+        HTMLFormControlElement* control = toHTMLFormControlElement(formAssociatedElement);
+        if (control->isSuccessfulSubmitButton()) {
+            if (control->renderer()) {
+                control->dispatchSimulatedClick(event);
                 return;
             }
-        } else if (formElement->canTriggerImplicitSubmission())
+        } else if (control->canTriggerImplicitSubmission())
             ++submissionTriggerCount;
     }
     if (fromImplicitSubmissionTrigger && submissionTriggerCount == 1)
@@ -203,7 +192,7 @@
 {
     for (Node* node = event->target()->toNode(); node; node = node->parentNode()) {
         if (node->isElementNode() && toElement(node)->isFormControlElement())
-            return static_cast<HTMLFormControlElement*>(node);
+            return toHTMLFormControlElement(node);
     }
     return 0;
 }
@@ -220,11 +209,11 @@
 
     for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
         if (m_associatedElements[i]->isFormControlElement())
-            static_cast<HTMLFormControlElement*>(m_associatedElements[i])->hideVisibleValidationMessage();
+            toHTMLFormControlElement(m_associatedElements[i])->hideVisibleValidationMessage();
     }
 
     Vector<RefPtr<FormAssociatedElement> > unhandledInvalidControls;
-    if (!checkInvalidControlsAndCollectUnhandled(unhandledInvalidControls))
+    if (!checkInvalidControlsAndCollectUnhandled(&unhandledInvalidControls))
         return true;
     // Because the form has invalid controls, we abort the form submission and
     // show a validation message on a focusable form control.
@@ -242,7 +231,7 @@
             unhandled->scrollIntoViewIfNeeded(false);
             unhandled->focus();
             if (unhandled->isFormControlElement())
-                static_cast<HTMLFormControlElement*>(unhandled)->updateVisibleValidationMessage();
+                toHTMLFormControlElement(unhandled)->updateVisibleValidationMessage();
             break;
         }
     }
@@ -344,7 +333,7 @@
         if (!associatedElement->isFormControlElement())
             continue;
         if (needButtonActivation) {
-            HTMLFormControlElement* control = static_cast<HTMLFormControlElement*>(associatedElement);
+            HTMLFormControlElement* control = toHTMLFormControlElement(associatedElement);
             if (control->isActivatedSubmit())
                 needButtonActivation = false;
             else if (firstSuccessfulSubmitButton == 0 && control->isSuccessfulSubmitButton())
@@ -379,7 +368,7 @@
 
     for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
         if (m_associatedElements[i]->isFormControlElement())
-            static_cast<HTMLFormControlElement*>(m_associatedElements[i])->reset();
+            toHTMLFormControlElement(m_associatedElements[i])->reset();
     }
 
     m_isInResetFunction = false;
@@ -625,7 +614,7 @@
     for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
         if (!m_associatedElements[i]->isFormControlElement())
             continue;
-        HTMLFormControlElement* control = static_cast<HTMLFormControlElement*>(m_associatedElements[i]);
+        HTMLFormControlElement* control = toHTMLFormControlElement(m_associatedElements[i]);
         if (control->isSuccessfulSubmitButton())
             return control;
     }
@@ -636,10 +625,15 @@
 bool HTMLFormElement::checkValidity()
 {
     Vector<RefPtr<FormAssociatedElement> > controls;
-    return !checkInvalidControlsAndCollectUnhandled(controls);
+    return !checkInvalidControlsAndCollectUnhandled(&controls);
 }
 
-bool HTMLFormElement::checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >& unhandledInvalidControls)
+bool HTMLFormElement::checkValidityWithoutDispatchingEvents()
+{
+    return !checkInvalidControlsAndCollectUnhandled(0, HTMLFormControlElement::CheckValidityDispatchEventsNone);
+}
+
+bool HTMLFormElement::checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >* unhandledInvalidControls, HTMLFormControlElement::CheckValidityDispatchEvents dispatchEvents)
 {
     RefPtr<HTMLFormElement> protector(this);
     // Copy m_associatedElements because event handlers called from
@@ -651,22 +645,22 @@
     bool hasInvalidControls = false;
     for (unsigned i = 0; i < elements.size(); ++i) {
         if (elements[i]->form() == this && elements[i]->isFormControlElement()) {
-            HTMLFormControlElement* control = static_cast<HTMLFormControlElement*>(elements[i].get());
-            if (!control->checkValidity(&unhandledInvalidControls) && control->form() == this)
+            HTMLFormControlElement* control = toHTMLFormControlElement(elements[i].get());
+            if (!control->checkValidity(unhandledInvalidControls, dispatchEvents) && control->form() == this)
                 hasInvalidControls = true;
         }
     }
     return hasInvalidControls;
 }
 
-HTMLFormControlElement* HTMLFormElement::elementForAlias(const AtomicString& alias)
+Node* HTMLFormElement::elementForAlias(const AtomicString& alias)
 {
     if (alias.isEmpty() || !m_elementAliases)
         return 0;
     return m_elementAliases->get(alias.impl());
 }
 
-void HTMLFormElement::addElementAlias(HTMLFormControlElement* element, const AtomicString& alias)
+void HTMLFormElement::addElementAlias(Node* element, const AtomicString& alias)
 {
     if (alias.isEmpty())
         return;
@@ -679,7 +673,7 @@
 {
     elements()->namedItems(name, namedItems);
 
-    HTMLFormControlElement* aliasElement = elementForAlias(name);
+    Node* aliasElement = elementForAlias(name);
     if (aliasElement) {
         if (namedItems.find(aliasElement) == notFound) {
             // We have seen it before but it is gone now. Still, we need to return it.
@@ -688,7 +682,7 @@
         }
     }
     if (namedItems.size() && namedItems.first() != aliasElement)
-        addElementAlias(static_cast<HTMLFormControlElement*>(namedItems.first().get()), name);
+        addElementAlias(namedItems.first().get(), name);
 }
 
 bool HTMLFormElement::shouldAutocomplete() const
diff --git a/Source/core/html/HTMLFormElement.h b/Source/core/html/HTMLFormElement.h
index dc0b527..d745ea2 100644
--- a/Source/core/html/HTMLFormElement.h
+++ b/Source/core/html/HTMLFormElement.h
@@ -26,6 +26,7 @@
 
 #include "core/dom/CheckedRadioButtons.h"
 #include "core/html/HTMLElement.h"
+#include "core/html/HTMLFormControlElement.h"
 #include "core/loader/FormState.h"
 #include "core/loader/FormSubmission.h"
 #include <wtf/OwnPtr.h>
@@ -100,6 +101,7 @@
     HTMLFormControlElement* defaultButton() const;
 
     bool checkValidity();
+    bool checkValidityWithoutDispatchingEvents();
 
     enum AutocompleteResult {
         AutocompleteResultSuccess,
@@ -114,8 +116,8 @@
     DEFINE_ATTRIBUTE_EVENT_LISTENER(autocomplete);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(autocompleteerror);
 
-    HTMLFormControlElement* elementForAlias(const AtomicString&);
-    void addElementAlias(HTMLFormControlElement*, const AtomicString& alias);
+    Node* elementForAlias(const AtomicString&);
+    void addElementAlias(Node*, const AtomicString& alias);
 
     CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
 
@@ -153,9 +155,9 @@
     // Validates each of the controls, and stores controls of which 'invalid'
     // event was not canceled to the specified vector. Returns true if there
     // are any invalid controls in this form.
-    bool checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >&);
+    bool checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >*, HTMLFormControlElement::CheckValidityDispatchEvents = HTMLFormControlElement::CheckValidityDispatchEventsAllowed);
 
-    typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<HTMLFormControlElement> > AliasMap;
+    typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<Node> > AliasMap;
 
     FormSubmission::Attributes m_attributes;
     OwnPtr<AliasMap> m_elementAliases;
@@ -181,6 +183,12 @@
     Timer<HTMLFormElement> m_requestAutocompleteTimer;
 };
 
+inline HTMLFormElement* toHTMLFormElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::formTag));
+    return static_cast<HTMLFormElement*>(node);
+}
+
 } // namespace WebCore
 
 #endif // HTMLFormElement_h
diff --git a/Source/core/html/HTMLFrameElement.cpp b/Source/core/html/HTMLFrameElement.cpp
index c8e3d5d..f3ade9c 100644
--- a/Source/core/html/HTMLFrameElement.cpp
+++ b/Source/core/html/HTMLFrameElement.cpp
@@ -52,9 +52,9 @@
     return isURLAllowed();
 }
 
-RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLFrameElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderFrame(this);
+    return new (document()->renderArena()) RenderFrame(this);
 }
 
 static inline HTMLFrameSetElement* containingFrameSetElement(Node* node)
diff --git a/Source/core/html/HTMLFrameElement.h b/Source/core/html/HTMLFrameElement.h
index 04e0fea..087d7ab 100644
--- a/Source/core/html/HTMLFrameElement.h
+++ b/Source/core/html/HTMLFrameElement.h
@@ -42,7 +42,7 @@
     virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
 
diff --git a/Source/core/html/HTMLFrameElementBase.cpp b/Source/core/html/HTMLFrameElementBase.cpp
index 602adbe..892878e 100644
--- a/Source/core/html/HTMLFrameElementBase.cpp
+++ b/Source/core/html/HTMLFrameElementBase.cpp
@@ -109,7 +109,7 @@
     } else if (name == scrollingAttr) {
         // Auto and yes both simply mean "allow scrolling." No means "don't allow scrolling."
         if (equalIgnoringCase(value, "auto") || equalIgnoringCase(value, "yes"))
-            m_scrolling = document()->frameElementsShouldIgnoreScrolling() ? ScrollbarAlwaysOff : ScrollbarAuto;
+            m_scrolling = ScrollbarAuto;
         else if (equalIgnoringCase(value, "no"))
             m_scrolling = ScrollbarAlwaysOff;
         // FIXME: If we are already attached, this has no effect.
diff --git a/Source/core/html/HTMLFrameOwnerElement.h b/Source/core/html/HTMLFrameOwnerElement.h
index e6e16b5..21c5c95 100644
--- a/Source/core/html/HTMLFrameOwnerElement.h
+++ b/Source/core/html/HTMLFrameOwnerElement.h
@@ -22,7 +22,6 @@
 #define HTMLFrameOwnerElement_h
 
 #include "core/html/HTMLElement.h"
-#include "core/loader/FrameLoaderTypes.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/HTMLFrameSetElement.cpp b/Source/core/html/HTMLFrameSetElement.cpp
index 1a273fa..6ae06a4 100644
--- a/Source/core/html/HTMLFrameSetElement.cpp
+++ b/Source/core/html/HTMLFrameSetElement.cpp
@@ -45,8 +45,6 @@
 
 HTMLFrameSetElement::HTMLFrameSetElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
-    , m_totalRows(1)
-    , m_totalCols(1)
     , m_border(6)
     , m_borderSet(false)
     , m_borderColorSet(false)
@@ -83,12 +81,12 @@
 {
     if (name == rowsAttr) {
         if (!value.isNull()) {
-            m_rowLengths = newLengthArray(value.string(), m_totalRows);
+            m_rowLengths = parseFrameSetListOfDimensions(value.string());
             setNeedsStyleRecalc();
         }
     } else if (name == colsAttr) {
         if (!value.isNull()) {
-            m_colLengths = newLengthArray(value.string(), m_totalCols);
+            m_colLengths = parseFrameSetListOfDimensions(value.string());
             setNeedsStyleRecalc();
         }
     } else if (name == frameborderAttr) {
@@ -156,12 +154,12 @@
     return context.style()->isStyleAvailable();
 }
 
-RenderObject *HTMLFrameSetElement::createRenderer(RenderArena *arena, RenderStyle *style)
+RenderObject* HTMLFrameSetElement::createRenderer(RenderStyle *style)
 {
     if (style->hasContent())
         return RenderObject::createObject(this, style);
     
-    return new (arena) RenderFrameSet(this);
+    return new (document()->renderArena()) RenderFrameSet(this);
 }
 
 void HTMLFrameSetElement::attach(const AttachContext& context)
@@ -191,7 +189,7 @@
 void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 {
     if (evt->isMouseEvent() && !m_noresize && renderer() && renderer()->isFrameSet()) {
-        if (toRenderFrameSet(renderer())->userResize(static_cast<MouseEvent*>(evt))) {
+        if (toRenderFrameSet(renderer())->userResize(toMouseEvent(evt))) {
             evt->setDefaultHandled();
             return;
         }
diff --git a/Source/core/html/HTMLFrameSetElement.h b/Source/core/html/HTMLFrameSetElement.h
index 1a2ce49..912b397 100644
--- a/Source/core/html/HTMLFrameSetElement.h
+++ b/Source/core/html/HTMLFrameSetElement.h
@@ -25,7 +25,6 @@
 #define HTMLFrameSetElement_h
 
 #include "core/html/HTMLElement.h"
-#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -36,14 +35,14 @@
     bool hasFrameBorder() const { return m_frameborder; }
     bool noResize() const { return m_noresize; }
 
-    int totalRows() const { return m_totalRows; }
-    int totalCols() const { return m_totalCols; }
+    size_t totalRows() const { return std::max<size_t>(1, m_rowLengths.size()); }
+    size_t totalCols() const { return std::max<size_t>(1, m_colLengths.size()); }
     int border() const { return hasFrameBorder() ? m_border : 0; }
 
     bool hasBorderColor() const { return m_borderColorSet; }
 
-    const Length* rowLengths() const { return m_rowLengths.get(); }
-    const Length* colLengths() const { return m_colLengths.get(); }
+    const Vector<Length>& rowLengths() const { return m_rowLengths; }
+    const Vector<Length>& colLengths() const { return m_colLengths; }
 
     DOMWindow* anonymousNamedGetter(const AtomicString&);
 
@@ -75,18 +74,15 @@
 
     virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 
     virtual void defaultEventHandler(Event*);
 
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void willRecalcStyle(StyleChange) OVERRIDE;
 
-    OwnArrayPtr<Length> m_rowLengths;
-    OwnArrayPtr<Length> m_colLengths;
-
-    int m_totalRows;
-    int m_totalCols;
+    Vector<Length> m_rowLengths;
+    Vector<Length> m_colLengths;
 
     int m_border;
     bool m_borderSet;
diff --git a/Source/core/html/HTMLIFrameElement.cpp b/Source/core/html/HTMLIFrameElement.cpp
index 8a5314b..239bc50 100644
--- a/Source/core/html/HTMLIFrameElement.cpp
+++ b/Source/core/html/HTMLIFrameElement.cpp
@@ -30,7 +30,6 @@
 #include "core/dom/NodeRenderingContext.h"
 #include "core/html/HTMLDocument.h"
 #include "core/rendering/RenderIFrame.h"
-#include <wtf/text/TextPosition.h>
 
 namespace WebCore {
 
@@ -103,9 +102,9 @@
     return isURLAllowed() && context.style()->display() != NONE;
 }
 
-RenderObject* HTMLIFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLIFrameElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderIFrame(this);
+    return new (document()->renderArena()) RenderIFrame(this);
 }
 
 Node::InsertionNotificationRequest HTMLIFrameElement::insertedInto(ContainerNode* insertionPoint)
diff --git a/Source/core/html/HTMLIFrameElement.h b/Source/core/html/HTMLIFrameElement.h
index c4b935e..ac821c2 100644
--- a/Source/core/html/HTMLIFrameElement.h
+++ b/Source/core/html/HTMLIFrameElement.h
@@ -45,7 +45,7 @@
     virtual void removedFrom(ContainerNode*) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 
     virtual void didRecalcStyle(StyleChange) OVERRIDE;
 
diff --git a/Source/core/html/HTMLImageElement.cpp b/Source/core/html/HTMLImageElement.cpp
index 7c8ccad..90c15f7 100644
--- a/Source/core/html/HTMLImageElement.cpp
+++ b/Source/core/html/HTMLImageElement.cpp
@@ -138,12 +138,12 @@
     return alt;
 }
 
-RenderObject* HTMLImageElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLImageElement::createRenderer(RenderStyle* style)
 {
     if (style->hasContent())
         return RenderObject::createObject(this, style);
 
-    RenderImage* image = new (arena) RenderImage(this);
+    RenderImage* image = new (document()->renderArena()) RenderImage(this);
     image->setImageResource(RenderImageResource::create());
     return image;
 }
@@ -176,15 +176,11 @@
 
 Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode* insertionPoint)
 {
+    // m_form can be non-null if it was set in constructor.
     if (!m_form) {
-        // m_form can be non-null if it was set in constructor.
-        for (ContainerNode* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
-            if (ancestor->hasTagName(formTag)) {
-                m_form = static_cast<HTMLFormElement*>(ancestor);
-                m_form->registerImgElement(this);
-                break;
-            }
-        }
+        m_form = findFormAncestor();
+        if (m_form)
+            m_form->registerImgElement(this);
     }
 
     // If we have been inserted from a renderer-less document,
diff --git a/Source/core/html/HTMLImageElement.h b/Source/core/html/HTMLImageElement.h
index e7b45c7..d0186c4 100644
--- a/Source/core/html/HTMLImageElement.h
+++ b/Source/core/html/HTMLImageElement.h
@@ -91,7 +91,7 @@
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
     virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 
     virtual bool canStartSelection() const;
 
diff --git a/Source/core/html/HTMLImportsController.cpp b/Source/core/html/HTMLImportsController.cpp
index 7202664..3f59c55 100644
--- a/Source/core/html/HTMLImportsController.cpp
+++ b/Source/core/html/HTMLImportsController.cpp
@@ -32,8 +32,6 @@
 #include "core/html/HTMLImportsController.h"
 
 #include "core/dom/Document.h"
-#include "core/dom/DocumentType.h"
-#include "core/dom/Range.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/HTMLLinkElement.h"
 #include "core/loader/cache/CachedResourceLoader.h"
@@ -49,19 +47,100 @@
 
 LinkImport::LinkImport(HTMLLinkElement* owner)
     : LinkResource(owner)
-    , m_controller(0)
-    , m_ofSameLocation(0)
-    , m_state(StatePreparing)
 {
 }
 
 LinkImport::~LinkImport()
 {
+}
+
+Document* LinkImport::importedDocument() const
+{
+    if (!m_loader)
+        return 0;
+    return m_loader->importedDocument();
+}
+
+void LinkImport::process()
+{
+    if (m_loader)
+        return;
+    if (!m_owner)
+        return;
+
+    // FIXME(morrita): Should take care of sub-imports whose document doesn't have frame.
+    if (!m_owner->document()->frame() && !m_owner->document()->imports())
+        return;
+
+    LinkRequestBuilder builder(m_owner);
+    if (!builder.isValid())
+        return;
+
+    HTMLImportsController* controller = m_owner->document()->imports();
+    if (!controller) {
+        ASSERT(m_owner->document()->frame()); // The document should be the master.
+        m_owner->document()->setImports(HTMLImportsController::create(m_owner->document()));
+        controller = m_owner->document()->imports();
+    }
+
+    if (RefPtr<HTMLImportLoader> found = controller->findLinkFor(builder.url())) {
+        m_loader = found;
+        return;
+    }
+
+    CachedResourceRequest request = builder.build(true);
+    CachedResourceHandle<CachedScript> resource = controller->cachedResourceLoader()->requestScript(request);
+    if (!resource)
+        return;
+
+    m_loader = HTMLImportLoader::create(controller, builder.url(), resource);
+}
+
+void LinkImport::ownerRemoved()
+{
+    m_owner = 0;
+    m_loader.clear();
+}
+
+
+PassRefPtr<HTMLImportLoader> HTMLImportLoader::create(HTMLImportsController* controller, const KURL& url, const CachedResourceHandle<CachedScript>& resource)
+{
+    RefPtr<HTMLImportLoader> loader = adoptRef(new HTMLImportLoader(controller, url, resource));
+    controller->addImport(loader);
+    return loader;
+}
+
+HTMLImportLoader::HTMLImportLoader(HTMLImportsController* controller, const KURL& url, const CachedResourceHandle<CachedScript>& resource)
+    : m_controller(controller)
+    , m_state(StateLoading)
+    , m_resource(resource)
+    , m_url(url)
+{
+    m_resource->addClient(this);
+}
+
+HTMLImportLoader::~HTMLImportLoader()
+{
     if (m_resource)
         m_resource->removeClient(this);
 }
 
-LinkImport::State LinkImport::finish()
+void HTMLImportLoader::notifyFinished(CachedResource*)
+{
+    setState(finish());
+}
+
+void HTMLImportLoader::setState(State state)
+{
+    if (m_state == state)
+        return;
+    m_state = state;
+
+    if ((m_state == StateReady  || m_state == StateError) && m_controller)
+        m_controller->didLoad();
+}
+
+HTMLImportLoader::State HTMLImportLoader::finish()
 {
     if (!m_controller)
         return StateError;
@@ -78,94 +157,29 @@
 
     // FIXME(morrita): This should be done in incremental way.
     m_importedDocument = HTMLDocument::create(0, m_resource->response().url());
+    m_importedDocument->setImports(m_controller);
     m_importedDocument->setContent(m_resource->script());
 
     return StateReady;
 }
 
-void LinkImport::notifyFinished(CachedResource*)
+Document* HTMLImportLoader::importedDocument() const
 {
-    setState(finish());
-}
-
-void LinkImport::setState(State state)
-{
-    if (m_state == state)
-        return;
-    m_state = state;
-
-    if ((m_state == StateReady  || m_state == StateError)
-        && m_controller)
-        m_controller->didLoad();
-}
-
-LinkImport::State LinkImport::startRequest()
-{
-    ASSERT(m_owner);
-    ASSERT(m_state == StatePreparing);
-
-    // FIXME(morrita): Should take care of sub-imports whose document doesn't have frame.
-    if (!m_owner->document()->frame())
-        return StateError;
-
-    LinkRequestBuilder builder(m_owner);
-    if (!builder.isValid())
-        return StateError;
-
-    m_controller = m_owner->document()->ensureImports();
-    if (RefPtr<LinkImport> found = m_controller->findLinkFor(builder.url())) {
-        m_ofSameLocation = found.get();
-        return StateReady;
-    }
-
-    CachedResourceRequest request = builder.build(true);
-    m_resource = m_owner->document()->cachedResourceLoader()->requestScript(request);
-    if (!m_resource)
-        return StateError;
-
-    m_resource->addClient(this);
-    m_url = builder.url();
-    m_controller->addImport(this);
-
-    return StateStarted;
-}
-
-Document* LinkImport::importedDocument() const
-{
-    if (!m_owner)
-        return 0;
     if (m_state != StateReady)
         return 0;
-
-    if (m_ofSameLocation) {
-        ASSERT(!m_importedDocument);
-        return m_ofSameLocation->importedDocument();
-    }
-
     return m_importedDocument.get();
 }
 
-void LinkImport::process()
-{
-    if (StatePreparing != m_state)
-        return;
-    setState(startRequest());
-}
-
-void LinkImport::ownerRemoved()
-{
-    m_owner = 0;
-}
-
-void LinkImport::importDestroyed()
+void HTMLImportLoader::importDestroyed()
 {
     m_controller = 0;
     m_importedDocument.clear();
 }
 
-PassOwnPtr<HTMLImportsController> HTMLImportsController::create(Document* master)
+
+PassRefPtr<HTMLImportsController> HTMLImportsController::create(Document* master)
 {
-    return adoptPtr(new HTMLImportsController(master));
+    return adoptRef(new HTMLImportsController(master));
 }
 
 HTMLImportsController::HTMLImportsController(Document* master)
@@ -179,7 +193,7 @@
         m_imports[i]->importDestroyed();
 }
 
-void HTMLImportsController::addImport(PassRefPtr<LinkImport> link)
+void HTMLImportsController::addImport(PassRefPtr<HTMLImportLoader> link)
 {
     ASSERT(!link->url().isEmpty() && link->url().isValid());
     m_imports.append(link);
@@ -196,10 +210,10 @@
         m_master->didLoadAllImports();
 }
 
-PassRefPtr<LinkImport> HTMLImportsController::findLinkFor(const KURL& url) const
+PassRefPtr<HTMLImportLoader> HTMLImportsController::findLinkFor(const KURL& url) const
 {
     for (size_t i = 0; i < m_imports.size(); ++i) {
-        if (m_imports[i]->url() == url)
+        if (equalIgnoringFragmentIdentifier(m_imports[i]->url(), url))
             return m_imports[i];
     }
 
@@ -211,6 +225,11 @@
     return m_master->securityOrigin();
 }
 
+CachedResourceLoader* HTMLImportsController::cachedResourceLoader() const
+{
+    return m_master->cachedResourceLoader();
+}
+
 bool HTMLImportsController::haveLoaded() const
 {
     for (size_t i = 0; i < m_imports.size(); ++i) {
diff --git a/Source/core/html/HTMLImportsController.h b/Source/core/html/HTMLImportsController.h
index 5bf13be..fd1ecc3 100644
--- a/Source/core/html/HTMLImportsController.h
+++ b/Source/core/html/HTMLImportsController.h
@@ -40,21 +40,16 @@
 
 namespace WebCore {
 
-class DocumentFragment;
+class CachedResourceLoader;
+class HTMLImportLoader;
 class HTMLImportsController;
 
 //
 // A LinkResource subclasss used for @rel=import.
 //
-class LinkImport : public LinkResource, CachedResourceClient {
+class LinkImport : public LinkResource {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    enum State {
-        StatePreparing,
-        StateStarted,
-        StateError,
-        StateReady
-    };
 
     static PassRefPtr<LinkImport> create(HTMLLinkElement* owner);
 
@@ -67,48 +62,67 @@
     virtual void ownerRemoved() OVERRIDE;
 
     Document* importedDocument() const;
+
+private:
+    RefPtr<HTMLImportLoader> m_loader;
+};
+
+
+class HTMLImportLoader : public RefCounted<HTMLImportLoader>, public CachedResourceClient {
+public:
+    enum State {
+        StateLoading,
+        StateError,
+        StateReady
+    };
+
+    static PassRefPtr<HTMLImportLoader> create(HTMLImportsController*, const KURL&, const CachedResourceHandle<CachedScript>&);
+    virtual ~HTMLImportLoader();
+
+    Document* importedDocument() const;
     const KURL& url() const { return m_url; }
+
     void importDestroyed();
     bool isDone() const { return m_state == StateReady || m_state == StateError; }
 
 private:
-    State startRequest();
-    State finish();
-    void setState(State);
+    HTMLImportLoader(HTMLImportsController*, const KURL&, const CachedResourceHandle<CachedScript>&);
 
     // CachedResourceClient
     virtual void notifyFinished(CachedResource*) OVERRIDE;
 
+    State finish();
+    void setState(State);
+
     HTMLImportsController* m_controller;
-    LinkImport* m_ofSameLocation;
-    KURL m_url;
     State m_state;
+    KURL m_url;
     CachedResourceHandle<CachedScript> m_resource;
     RefPtr<Document> m_importedDocument;
 };
 
 
-class HTMLImportsController {
+class HTMLImportsController : public RefCounted<HTMLImportsController> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<HTMLImportsController> create(Document*);
+    static PassRefPtr<HTMLImportsController> create(Document*);
 
     explicit HTMLImportsController(Document*);
     virtual ~HTMLImportsController();
 
-    void addImport(PassRefPtr<LinkImport>);
+    void addImport(PassRefPtr<HTMLImportLoader>);
     void showSecurityErrorMessage(const String&);
-    PassRefPtr<LinkImport> findLinkFor(const KURL&) const;
+    PassRefPtr<HTMLImportLoader> findLinkFor(const KURL&) const;
     SecurityOrigin* securityOrigin() const;
+    CachedResourceLoader* cachedResourceLoader() const;
     bool haveLoaded() const;
     void didLoad();
 
 private:
-
     Document* m_master;
 
     // List of import which has been loaded or being loaded.
-    typedef Vector<RefPtr<LinkImport> > ImportList;
+    typedef Vector<RefPtr<HTMLImportLoader> > ImportList;
     ImportList m_imports;
 };
 
diff --git a/Source/core/html/HTMLInputElement.cpp b/Source/core/html/HTMLInputElement.cpp
index 60b8a17..de999dd 100644
--- a/Source/core/html/HTMLInputElement.cpp
+++ b/Source/core/html/HTMLInputElement.cpp
@@ -30,7 +30,6 @@
 #include "core/html/HTMLInputElement.h"
 
 #include "CSSPropertyNames.h"
-#include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "RuntimeEnabledFeatures.h"
 #include "bindings/v8/ScriptEventListener.h"
@@ -68,11 +67,9 @@
 #include "core/platform/Language.h"
 #include "core/platform/LocalizedStrings.h"
 #include "core/platform/PlatformMouseEvent.h"
-#include "core/platform/text/PlatformLocale.h"
 #include "core/rendering/RenderTextControlSingleLine.h"
 #include "core/rendering/RenderTheme.h"
-#include <wtf/MathExtras.h>
-#include <wtf/StdLibExtras.h>
+#include "wtf/MathExtras.h"
 
 using namespace std;
 
@@ -368,9 +365,9 @@
     return m_inputType->isKeyboardFocusable(event);
 }
 
-bool HTMLInputElement::isMouseFocusable() const
+bool HTMLInputElement::shouldShowFocusRingOnMouseFocus() const
 {
-    return m_inputType->isMouseFocusable();
+    return m_inputType->shouldShowFocusRingOnMouseFocus();
 }
 
 bool HTMLInputElement::isTextFormControlKeyboardFocusable(KeyboardEvent* event) const
@@ -378,11 +375,6 @@
     return HTMLTextFormControlElement::isKeyboardFocusable(event);
 }
 
-bool HTMLInputElement::isTextFormControlMouseFocusable() const
-{
-    return HTMLTextFormControlElement::isMouseFocusable();
-}
-
 void HTMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
 {
     if (isTextField()) {
@@ -500,9 +492,9 @@
     }
 
     if (wasAttached) {
-        attach();
+        lazyAttach();
         if (document()->focusedNode() == this)
-            updateFocusAppearance(true);
+            document()->updateFocusAppearanceSoon(true /* restore selection */);
     }
 
     if (ElementShadow* elementShadow = shadowOfParentForDistribution(this))
@@ -768,23 +760,15 @@
     }
 #if ENABLE(INPUT_SPEECH)
     else if (name == webkitspeechAttr) {
-        if (m_inputType->shouldRespectSpeechAttribute() && RuntimeEnabledFeatures::speechInputEnabled()) {
+        if (RuntimeEnabledFeatures::speechInputEnabled() && m_inputType->shouldRespectSpeechAttribute()) {
             // This renderer and its children have quite different layouts and
             // styles depending on whether the speech button is visible or
             // not. So we reset the whole thing and recreate to get the right
             // styles and layout.
-            if (attached()) {
-                m_inputType->destroyShadowSubtree();
-                detach();
-                m_inputType->createShadowSubtree();
-                if (!attached())
-                    attach();
-            } else {
-                m_inputType->destroyShadowSubtree();
-                m_inputType->createShadowSubtree();
-            }
+            m_inputType->destroyShadowSubtree();
+            lazyReattachIfAttached();
+            m_inputType->createShadowSubtree();
             setFormControlValueMatchesRenderer(false);
-            setNeedsStyleRecalc();
         }
         UseCounter::count(document(), UseCounter::PrefixedSpeechAttribute);
     } else if (name == onwebkitspeechchangeAttr)
@@ -816,9 +800,9 @@
     return m_inputType->rendererIsNeeded() && HTMLTextFormControlElement::rendererIsNeeded(context);
 }
 
-RenderObject* HTMLInputElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLInputElement::createRenderer(RenderStyle* style)
 {
-    return m_inputType->createRenderer(arena, style);
+    return m_inputType->createRenderer(style);
 }
 
 void HTMLInputElement::attach(const AttachContext& context)
@@ -1138,7 +1122,7 @@
     }
     if (event->type() != eventNames().clickEvent)
         return 0;
-    if (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button() != LeftButton)
+    if (!event->isMouseEvent() || toMouseEvent(event)->button() != LeftButton)
         return 0;
     // FIXME: Check whether there are any cases where this actually ends up leaking.
     return m_inputType->willDispatchClick().leakPtr();
@@ -1154,8 +1138,8 @@
 
 void HTMLInputElement::defaultEventHandler(Event* evt)
 {
-    if (evt->isMouseEvent() && evt->type() == eventNames().clickEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        m_inputType->handleClickEvent(static_cast<MouseEvent*>(evt));
+    if (evt->isMouseEvent() && evt->type() == eventNames().clickEvent && toMouseEvent(evt)->button() == LeftButton) {
+        m_inputType->handleClickEvent(toMouseEvent(evt));
         if (evt->defaultHandled())
             return;
     }
@@ -1167,7 +1151,7 @@
     }
 
     if (evt->isKeyboardEvent() && evt->type() == eventNames().keydownEvent) {
-        m_inputType->handleKeydownEvent(static_cast<KeyboardEvent*>(evt));
+        m_inputType->handleKeydownEvent(toKeyboardEvent(evt));
         if (evt->defaultHandled())
             return;
     }
@@ -1194,13 +1178,13 @@
     // Use key press event here since sending simulated mouse events
     // on key down blocks the proper sending of the key press event.
     if (evt->isKeyboardEvent() && evt->type() == eventNames().keypressEvent) {
-        m_inputType->handleKeypressEvent(static_cast<KeyboardEvent*>(evt));
+        m_inputType->handleKeypressEvent(toKeyboardEvent(evt));
         if (evt->defaultHandled())
             return;
     }
 
     if (evt->isKeyboardEvent() && evt->type() == eventNames().keyupEvent) {
-        m_inputType->handleKeyupEvent(static_cast<KeyboardEvent*>(evt));
+        m_inputType->handleKeyupEvent(toKeyboardEvent(evt));
         if (evt->defaultHandled())
             return;
     }
@@ -1226,7 +1210,7 @@
         m_inputType->handleBeforeTextInsertedEvent(static_cast<BeforeTextInsertedEvent*>(evt));
 
     if (evt->isMouseEvent() && evt->type() == eventNames().mousedownEvent) {
-        m_inputType->handleMouseDownEvent(static_cast<MouseEvent*>(evt));
+        m_inputType->handleMouseDownEvent(toMouseEvent(evt));
         if (evt->defaultHandled())
             return;
     }
diff --git a/Source/core/html/HTMLInputElement.h b/Source/core/html/HTMLInputElement.h
index 6b887b0..80fc77d 100644
--- a/Source/core/html/HTMLInputElement.h
+++ b/Source/core/html/HTMLInputElement.h
@@ -186,7 +186,7 @@
     void setSelectionRangeForBinding(int start, int end, const String& direction, ExceptionCode&);
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
 
     // FIXME: For isActivatedSubmit and setActivatedSubmit, we should use the NVI-idiom here by making
@@ -250,7 +250,6 @@
     // Functions for InputType classes.
     void setValueInternal(const String&, TextFieldEventBehavior);
     bool isTextFormControlKeyboardFocusable(KeyboardEvent*) const;
-    bool isTextFormControlMouseFocusable() const;
     bool valueAttributeWasUpdatedAfterParsing() const { return m_valueAttributeWasUpdatedAfterParsing; }
 
     void cacheSelectionInResponseToSetValue(int caretOffset) { cacheSelection(caretOffset, caretOffset, SelectionHasNoDirection); }
@@ -314,7 +313,7 @@
 
     virtual bool hasCustomFocusLogic() const OVERRIDE;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
+    virtual bool shouldShowFocusRingOnMouseFocus() const OVERRIDE;
     virtual bool isEnumeratable() const;
     virtual bool supportLabels() const OVERRIDE;
     virtual void updateFocusAppearance(bool restorePreviousSelection);
diff --git a/Source/core/html/HTMLInputElement.idl b/Source/core/html/HTMLInputElement.idl
index 00e4a1e..42d3347 100644
--- a/Source/core/html/HTMLInputElement.idl
+++ b/Source/core/html/HTMLInputElement.idl
@@ -57,6 +57,7 @@
     [TreatNullAs=NullString, SetterRaisesException] attribute DOMString value;
     [SetterRaisesException] attribute Date valueAsDate;
     [SetterRaisesException] attribute double valueAsNumber;
+    [EnabledAtRuntime=inputModeAttribute, Reflect] attribute DOMString inputMode;
 
     [RaisesException] void stepUp(optional long n);
     [RaisesException] void stepDown(optional long n);
diff --git a/Source/core/html/HTMLKeygenElement.cpp b/Source/core/html/HTMLKeygenElement.cpp
index abc62c9..30a8deb 100644
--- a/Source/core/html/HTMLKeygenElement.cpp
+++ b/Source/core/html/HTMLKeygenElement.cpp
@@ -118,7 +118,7 @@
 
 void HTMLKeygenElement::reset()
 {
-    static_cast<HTMLFormControlElement*>(shadowSelect())->reset();
+    shadowSelect()->reset();
 }
 
 bool HTMLKeygenElement::shouldSaveAndRestoreFormControlState() const
diff --git a/Source/core/html/HTMLLabelElement.cpp b/Source/core/html/HTMLLabelElement.cpp
index c543eca..44ac76d 100644
--- a/Source/core/html/HTMLLabelElement.cpp
+++ b/Source/core/html/HTMLLabelElement.cpp
@@ -35,20 +35,13 @@
 
 using namespace HTMLNames;
 
-static LabelableElement* nodeAsLabelableElement(Node* node)
+static bool supportsLabels(Element* element)
 {
-    if (!node || !node->isHTMLElement())
-        return 0;
-    
-    HTMLElement* element = static_cast<HTMLElement*>(node);
-    if (!element->isLabelable())
-        return 0;
-
-    LabelableElement* labelableElement = static_cast<LabelableElement*>(element);
-    if (!labelableElement->supportLabels())
-        return 0;
-
-    return labelableElement;
+    if (!element || !element->isHTMLElement())
+        return false;
+    if (!toHTMLElement(element)->isLabelable())
+        return false;
+    return toLabelableElement(element)->supportLabels();
 }
 
 inline HTMLLabelElement::HTMLLabelElement(const QualifiedName& tagName, Document* document)
@@ -78,15 +71,19 @@
         // the form element must be "labelable form-associated element".
         Element* element = this;
         while ((element = ElementTraversal::next(element, this))) {
-            if (LabelableElement* labelableElement = nodeAsLabelableElement(element))
-                return labelableElement;
+            if (!supportsLabels(element))
+                continue;
+            return toLabelableElement(element);
         }
         return 0;
     }
-    
-    // Find the first element whose id is controlId. If it is found and it is a labelable form control,
-    // return it, otherwise return 0.
-    return nodeAsLabelableElement(treeScope()->getElementById(controlId));
+
+    if (Element* element = treeScope()->getElementById(controlId)) {
+        if (supportsLabels(element))
+            return toLabelableElement(element);
+    }
+
+    return 0;
 }
 
 HTMLFormElement* HTMLLabelElement::form() const
@@ -137,6 +134,7 @@
         // Click the corresponding control.
         element->dispatchSimulatedClick(evt);
 
+        document()->updateLayoutIgnorePendingStylesheets();
         if (element->isMouseFocusable())
             element->focus();
 
diff --git a/Source/core/html/HTMLLegendElement.cpp b/Source/core/html/HTMLLegendElement.cpp
index 15e8b1d..d73f0cc 100644
--- a/Source/core/html/HTMLLegendElement.cpp
+++ b/Source/core/html/HTMLLegendElement.cpp
@@ -29,7 +29,6 @@
 #include "core/dom/NodeTraversal.h"
 #include "core/html/HTMLFieldSetElement.h"
 #include "core/html/HTMLFormControlElement.h"
-#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -62,7 +61,7 @@
     Element* element = fieldset;
     while ((element = ElementTraversal::next(element, fieldset))) {
         if (element->isFormControlElement())
-            return static_cast<HTMLFormControlElement*>(element);
+            return toHTMLFormControlElement(element);
     }
 
     return 0;
diff --git a/Source/core/html/HTMLLinkElement.cpp b/Source/core/html/HTMLLinkElement.cpp
index 381f096..a98eaa0 100644
--- a/Source/core/html/HTMLLinkElement.cpp
+++ b/Source/core/html/HTMLLinkElement.cpp
@@ -25,7 +25,6 @@
 #include "config.h"
 #include "core/html/HTMLLinkElement.h"
 
-#include <wtf/StdLibExtras.h>
 #include "HTMLNames.h"
 #include "bindings/v8/ScriptEventListener.h"
 #include "core/css/MediaList.h"
@@ -34,7 +33,6 @@
 #include "core/css/resolver/StyleResolver.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/Document.h"
-#include "core/dom/DocumentFragment.h"
 #include "core/dom/DocumentStyleSheetCollection.h"
 #include "core/dom/Event.h"
 #include "core/dom/EventSender.h"
@@ -45,6 +43,7 @@
 #include "core/loader/cache/CachedResourceRequest.h"
 #include "core/page/Frame.h"
 #include "core/page/FrameView.h"
+#include "wtf/StdLibExtras.h"
 
 namespace WebCore {
 
@@ -532,6 +531,9 @@
             return;
         }
 
+        if (m_sheet)
+            m_sheet->setDisabled(disabled);
+
         // Load the sheet, since it's never been loaded before.
         if (!m_sheet && m_disabledState == EnabledViaScript) {
             if (m_owner->shouldProcessStyle())
diff --git a/Source/core/html/HTMLLinkElement.h b/Source/core/html/HTMLLinkElement.h
index a227aa5..c854140 100644
--- a/Source/core/html/HTMLLinkElement.h
+++ b/Source/core/html/HTMLLinkElement.h
@@ -34,7 +34,6 @@
 #include "core/loader/LinkLoaderClient.h"
 #include "core/loader/cache/CachedResourceHandle.h"
 #include "core/loader/cache/CachedStyleSheetClient.h"
-#include "core/platform/Timer.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/HTMLMarqueeElement.cpp b/Source/core/html/HTMLMarqueeElement.cpp
index e66d444..181c72c 100644
--- a/Source/core/html/HTMLMarqueeElement.cpp
+++ b/Source/core/html/HTMLMarqueeElement.cpp
@@ -27,7 +27,6 @@
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "core/dom/ExceptionCode.h"
-#include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderMarquee.h"
 
 namespace WebCore {
@@ -190,9 +189,9 @@
     return 0;
 }
 
-RenderObject* HTMLMarqueeElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLMarqueeElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderMarquee(this);
+    return new (document()->renderArena()) RenderMarquee(this);
 }
 
 } // namespace WebCore
diff --git a/Source/core/html/HTMLMarqueeElement.h b/Source/core/html/HTMLMarqueeElement.h
index 26188a7..ad49859 100644
--- a/Source/core/html/HTMLMarqueeElement.h
+++ b/Source/core/html/HTMLMarqueeElement.h
@@ -61,7 +61,7 @@
     virtual void suspend(ReasonForSuspension);
     virtual void resume();
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE FINAL;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE FINAL;
 
     RenderMarquee* renderMarquee() const;
 };
diff --git a/Source/core/html/HTMLMediaElement.cpp b/Source/core/html/HTMLMediaElement.cpp
index 530c97c..8c01b54 100644
--- a/Source/core/html/HTMLMediaElement.cpp
+++ b/Source/core/html/HTMLMediaElement.cpp
@@ -26,13 +26,6 @@
 #include "config.h"
 #include "core/html/HTMLMediaElement.h"
 
-#include <wtf/CurrentTime.h>
-#include <wtf/MathExtras.h>
-#include <wtf/MemoryInstrumentationVector.h>
-#include <wtf/NonCopyingSort.h>
-#include <wtf/text/CString.h>
-#include <wtf/Uint8Array.h>
-#include <limits>
 #include "HTMLNames.h"
 #include "RuntimeEnabledFeatures.h"
 #include "bindings/v8/ScriptController.h"
@@ -51,7 +44,6 @@
 #include "core/html/HTMLSourceElement.h"
 #include "core/html/HTMLTrackElement.h"
 #include "core/html/MediaController.h"
-#include "core/html/MediaDocument.h"
 #include "core/html/MediaError.h"
 #include "core/html/MediaFragmentURIParser.h"
 #include "core/html/MediaKeyError.h"
@@ -64,9 +56,7 @@
 #include "core/loader/FrameLoader.h"
 #include "core/page/ContentSecurityPolicy.h"
 #include "core/page/Frame.h"
-#include "core/page/FrameView.h"
 #include "core/page/Page.h"
-#include "core/page/PageGroup.h"
 #include "core/page/Settings.h"
 #include "core/platform/ContentType.h"
 #include "core/platform/Language.h"
@@ -76,15 +66,19 @@
 #include "core/platform/NotImplemented.h"
 #include "core/platform/graphics/InbandTextTrackPrivate.h"
 #include "core/platform/graphics/MediaPlayer.h"
-#include "core/rendering/RenderLayerCompositor.h"
 #include "core/rendering/RenderVideo.h"
-#include "core/rendering/RenderView.h"
 #include "modules/mediasource/MediaSourceBase.h"
 #include "modules/mediasource/MediaSourceRegistry.h"
 #include "modules/mediastream/MediaStreamRegistry.h"
-#include "weborigin/SecurityOrigin.h"
-#include "weborigin/SecurityPolicy.h"
 #include "public/platform/Platform.h"
+#include "weborigin/SecurityOrigin.h"
+#include "wtf/CurrentTime.h"
+#include "wtf/MathExtras.h"
+#include "wtf/MemoryInstrumentationVector.h"
+#include "wtf/NonCopyingSort.h"
+#include "wtf/Uint8Array.h"
+#include "wtf/text/CString.h"
+#include <limits>
 
 #if ENABLE(WEB_AUDIO)
 #include "core/platform/audio/AudioSourceProvider.h"
@@ -493,9 +487,9 @@
     return controls() ? HTMLElement::rendererIsNeeded(context) : false;
 }
 
-RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLMediaElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderMedia(this);
+    return new (document()->renderArena()) RenderMedia(this);
 }
 
 bool HTMLMediaElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
@@ -3943,9 +3937,9 @@
     m_restrictions = NoRestrictions;
 }
 
-void HTMLMediaElement::mediaPlayerNeedsStyleRecalc()
+void HTMLMediaElement::scheduleLayerUpdate()
 {
-    setNeedsStyleRecalc(WebCore::SyntheticStyleChange);
+    setNeedsLayerUpdate();
 }
 
 void HTMLMediaElement::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
diff --git a/Source/core/html/HTMLMediaElement.h b/Source/core/html/HTMLMediaElement.h
index 2bcda2a..3e2d4b8 100644
--- a/Source/core/html/HTMLMediaElement.h
+++ b/Source/core/html/HTMLMediaElement.h
@@ -336,7 +336,7 @@
     virtual bool supportsFocus() const;
     virtual bool isMouseFocusable() const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void removedFrom(ContainerNode*) OVERRIDE;
@@ -376,7 +376,7 @@
 
     virtual CORSMode mediaPlayerCORSMode() const OVERRIDE;
 
-    virtual void mediaPlayerNeedsStyleRecalc() OVERRIDE;
+    virtual void scheduleLayerUpdate() OVERRIDE;
 
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
diff --git a/Source/core/html/HTMLMediaElement.idl b/Source/core/html/HTMLMediaElement.idl
index 5db5f75..10ebf8a 100644
--- a/Source/core/html/HTMLMediaElement.idl
+++ b/Source/core/html/HTMLMediaElement.idl
@@ -97,9 +97,7 @@
 [EnabledAtRuntime=legacyEncryptedMedia] attribute EventListener onwebkitkeymessage;
 [EnabledAtRuntime=legacyEncryptedMedia] attribute EventListener onwebkitneedkey;
 
-#if defined(ENABLE_ENCRYPTED_MEDIA_V2) && ENABLE_ENCRYPTED_MEDIA_V2
-[EnabledAtRuntime=encryptedMedia] attribute MediaKeys mediaKeys;
-#endif
+[EnabledAtRuntime=encryptedMedia, Conditional=ENCRYPTED_MEDIA_V2] attribute MediaKeys mediaKeys;
 
 [EnabledAtRuntime=videoTrack, RaisesException] TextTrack addTextTrack(DOMString kind, optional DOMString label, optional DOMString language);
 [EnabledAtRuntime=videoTrack] readonly attribute TextTrackList textTracks;
diff --git a/Source/core/html/HTMLMeterElement.cpp b/Source/core/html/HTMLMeterElement.cpp
index 02885fe..e2680b9 100644
--- a/Source/core/html/HTMLMeterElement.cpp
+++ b/Source/core/html/HTMLMeterElement.cpp
@@ -31,7 +31,6 @@
 #include "core/page/Page.h"
 #include "core/rendering/RenderMeter.h"
 #include "core/rendering/RenderTheme.h"
-#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -55,12 +54,12 @@
     return meter;
 }
 
-RenderObject* HTMLMeterElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLMeterElement::createRenderer(RenderStyle* style)
 {
     if (hasAuthorShadowRoot() || !document()->page()->theme()->supportsMeter(style->appearance()))
         return RenderObject::createObject(this, style);
 
-    return new (arena) RenderMeter(this);
+    return new (document()->renderArena()) RenderMeter(this);
 }
 
 bool HTMLMeterElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
diff --git a/Source/core/html/HTMLMeterElement.h b/Source/core/html/HTMLMeterElement.h
index 0ed11eb..0411f71 100644
--- a/Source/core/html/HTMLMeterElement.h
+++ b/Source/core/html/HTMLMeterElement.h
@@ -71,7 +71,7 @@
     virtual bool supportLabels() const OVERRIDE { return true; }
 
     virtual bool recalcWillValidate() const { return false; }
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
 
diff --git a/Source/core/html/HTMLOptionElement.cpp b/Source/core/html/HTMLOptionElement.cpp
index dd763b6..4947a72 100644
--- a/Source/core/html/HTMLOptionElement.cpp
+++ b/Source/core/html/HTMLOptionElement.cpp
@@ -28,7 +28,6 @@
 #include "core/html/HTMLOptionElement.h"
 
 #include "HTMLNames.h"
-#include "core/css/resolver/StyleResolver.h"
 #include "core/dom/Document.h"
 #include "core/dom/NodeRenderStyle.h"
 #include "core/dom/NodeTraversal.h"
@@ -38,9 +37,8 @@
 #include "core/html/HTMLSelectElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/rendering/RenderTheme.h"
-#include <wtf/StdLibExtras.h>
-#include <wtf/text/StringBuilder.h>
-#include <wtf/Vector.h>
+#include "wtf/Vector.h"
+#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
@@ -344,12 +342,9 @@
 {
     if (ownElementDisabled())
         return true;
-
-    if (!parentNode() || !parentNode()->isHTMLElement())
-        return false;
-
-    HTMLElement* parentElement = static_cast<HTMLElement*>(parentNode());
-    return parentElement->hasTagName(optgroupTag) && parentElement->isDisabledFormControl();
+    if (Element* parent = parentElement())
+        return parent->hasTagName(optgroupTag) && parent->isDisabledFormControl();
+    return false;
 }
 
 Node::InsertionNotificationRequest HTMLOptionElement::insertedInto(ContainerNode* insertionPoint)
@@ -383,20 +378,4 @@
     return text.toString();
 }
 
-#ifndef NDEBUG
-
-HTMLOptionElement* toHTMLOptionElement(Node* node)
-{
-    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(optionTag));
-    return static_cast<HTMLOptionElement*>(node);
-}
-
-const HTMLOptionElement* toHTMLOptionElement(const Node* node)
-{
-    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(optionTag));
-    return static_cast<const HTMLOptionElement*>(node);
-}
-
-#endif
-
-} // namespace
+} // namespace WebCore
diff --git a/Source/core/html/HTMLOptionElement.h b/Source/core/html/HTMLOptionElement.h
index 5c5fd6f..a0e81c4 100644
--- a/Source/core/html/HTMLOptionElement.h
+++ b/Source/core/html/HTMLOptionElement.h
@@ -93,26 +93,20 @@
     RefPtr<RenderStyle> m_style;
 };
 
-HTMLOptionElement* toHTMLOptionElement(Node*);
-const HTMLOptionElement* toHTMLOptionElement(const Node*);
 void toHTMLOptionElement(const HTMLOptionElement*); // This overload will catch anyone doing an unnecessary cast.
 
-#ifdef NDEBUG
-
-// The debug versions of these, with assertions, are not inlined.
-
 inline HTMLOptionElement* toHTMLOptionElement(Node* node)
 {
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::optionTag));
     return static_cast<HTMLOptionElement*>(node);
 }
 
 inline const HTMLOptionElement* toHTMLOptionElement(const Node* node)
 {
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::optionTag));
     return static_cast<const HTMLOptionElement*>(node);
 }
 
-#endif
-
-} // namespace
+} // namespace WebCore
 
 #endif
diff --git a/Source/core/html/HTMLOptionsCollection.cpp b/Source/core/html/HTMLOptionsCollection.cpp
index ef8bba0..e0a7a4b 100644
--- a/Source/core/html/HTMLOptionsCollection.cpp
+++ b/Source/core/html/HTMLOptionsCollection.cpp
@@ -65,7 +65,7 @@
     if (index == -1 || unsigned(index) >= length())
         select->add(newOption, 0, ec);
     else
-        select->add(newOption, static_cast<HTMLOptionElement*>(item(index)), ec);
+        select->add(newOption, toHTMLOptionElement(item(index)), ec);
 
     ASSERT(!ec);
 }
diff --git a/Source/core/html/HTMLOutputElement.h b/Source/core/html/HTMLOutputElement.h
index 4b27451..8981f7d 100644
--- a/Source/core/html/HTMLOutputElement.h
+++ b/Source/core/html/HTMLOutputElement.h
@@ -33,7 +33,6 @@
 
 #include "core/html/DOMSettableTokenList.h"
 #include "core/html/HTMLFormControlElement.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/HTMLPlugInElement.h b/Source/core/html/HTMLPlugInElement.h
index 7a567c7..75c8e36 100644
--- a/Source/core/html/HTMLPlugInElement.h
+++ b/Source/core/html/HTMLPlugInElement.h
@@ -24,7 +24,6 @@
 #define HTMLPlugInElement_h
 
 #include "core/html/HTMLFrameOwnerElement.h"
-#include "core/platform/graphics/Image.h"
 
 #include "bindings/v8/ScriptInstance.h"
 
diff --git a/Source/core/html/HTMLPlugInImageElement.cpp b/Source/core/html/HTMLPlugInImageElement.cpp
index 622dbc2..8a931c2 100644
--- a/Source/core/html/HTMLPlugInImageElement.cpp
+++ b/Source/core/html/HTMLPlugInImageElement.cpp
@@ -21,31 +21,16 @@
 #include "config.h"
 #include "core/html/HTMLPlugInImageElement.h"
 
-#include <wtf/CurrentTime.h>
 #include "bindings/v8/ScriptController.h"
-#include "core/dom/MouseEvent.h"
-#include "core/dom/NodeList.h"
-#include "core/dom/NodeRenderStyle.h"
-#include "core/dom/NodeRenderingContext.h"
-#include "core/dom/Text.h"
-#include "core/dom/shadow/ShadowRoot.h"
-#include "core/html/HTMLDivElement.h"
 #include "core/html/HTMLImageLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
-#include "core/page/Chrome.h"
-#include "core/page/ChromeClient.h"
 #include "core/page/Frame.h"
-#include "core/page/FrameView.h"
-#include "core/page/Page.h"
-#include "core/page/Settings.h"
-#include "core/platform/LocalizedStrings.h"
 #include "core/platform/Logging.h"
 #include "core/platform/MIMETypeFromURL.h"
 #include "core/platform/graphics/Image.h"
 #include "core/rendering/RenderEmbeddedObject.h"
 #include "core/rendering/RenderImage.h"
-#include "weborigin/SchemeRegistry.h"
 #include "weborigin/SecurityOrigin.h"
 
 namespace WebCore {
@@ -135,7 +120,7 @@
     return false;
 }
 
-RenderObject* HTMLPlugInImageElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLPlugInImageElement::createRenderer(RenderStyle* style)
 {
     // Fallback content breaks the DOM->Renderer class relationship of this
     // class and all superclasses because createObject won't necessarily
@@ -144,12 +129,12 @@
         return RenderObject::createObject(this, style);
 
     if (isImageType()) {
-        RenderImage* image = new (arena) RenderImage(this);
+        RenderImage* image = new (document()->renderArena()) RenderImage(this);
         image->setImageResource(RenderImageResource::create());
         return image;
     }
 
-    return new (arena) RenderEmbeddedObject(this);
+    return new (document()->renderArena()) RenderEmbeddedObject(this);
 }
 
 void HTMLPlugInImageElement::willRecalcStyle(StyleChange)
diff --git a/Source/core/html/HTMLPlugInImageElement.h b/Source/core/html/HTMLPlugInImageElement.h
index 4f5ae54..fc79771 100644
--- a/Source/core/html/HTMLPlugInImageElement.h
+++ b/Source/core/html/HTMLPlugInImageElement.h
@@ -25,8 +25,7 @@
 
 #include "core/platform/MIMETypeFromURL.h"
 #include "core/rendering/style/RenderStyle.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/RefPtr.h>
+#include "wtf/OwnPtr.h"
 
 namespace WebCore {
 
@@ -98,7 +97,7 @@
     virtual void didMoveToNewDocument(Document* oldDocument) OVERRIDE;
 
 private:
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual void willRecalcStyle(StyleChange) OVERRIDE FINAL;
 
     virtual void finishParsingChildren();
diff --git a/Source/core/html/HTMLProgressElement.cpp b/Source/core/html/HTMLProgressElement.cpp
index 17e7890..d39fc76 100644
--- a/Source/core/html/HTMLProgressElement.cpp
+++ b/Source/core/html/HTMLProgressElement.cpp
@@ -29,7 +29,6 @@
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/shadow/ProgressShadowElement.h"
 #include "core/rendering/RenderProgress.h"
-#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -57,12 +56,12 @@
     return progress.release();
 }
 
-RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyle* style)
+RenderObject* HTMLProgressElement::createRenderer(RenderStyle* style)
 {
     if (!style->hasAppearance() || hasAuthorShadowRoot())
         return RenderObject::createObject(this, style);
 
-    return new (arena) RenderProgress(this);
+    return new (document()->renderArena()) RenderProgress(this);
 }
 
 bool HTMLProgressElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
diff --git a/Source/core/html/HTMLProgressElement.h b/Source/core/html/HTMLProgressElement.h
index 42e3287..91fca9b 100644
--- a/Source/core/html/HTMLProgressElement.h
+++ b/Source/core/html/HTMLProgressElement.h
@@ -53,7 +53,7 @@
     virtual bool shouldAppearIndeterminate() const OVERRIDE;
     virtual bool supportLabels() const OVERRIDE { return true; }
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     RenderProgress* renderProgress() const;
 
diff --git a/Source/core/html/HTMLSelectElement.cpp b/Source/core/html/HTMLSelectElement.cpp
index 017631e..cdec5af 100644
--- a/Source/core/html/HTMLSelectElement.cpp
+++ b/Source/core/html/HTMLSelectElement.cpp
@@ -51,8 +51,6 @@
 #include "core/rendering/RenderListBox.h"
 #include "core/rendering/RenderMenuList.h"
 #include "core/rendering/RenderTheme.h"
-#include <wtf/text/StringBuilder.h>
-#include <wtf/unicode/Unicode.h>
 
 using namespace std;
 using namespace WTF::Unicode;
@@ -142,8 +140,7 @@
     ASSERT(listIndex >= 0);
     if (listIndex < 0)
         return false;
-    HTMLOptionElement* option = static_cast<HTMLOptionElement*>(listItems()[listIndex]);
-    return !listIndex && option->value().isEmpty();
+    return !listIndex && toHTMLOptionElement(listItems()[listIndex])->value().isEmpty();
 }
 
 String HTMLSelectElement::validationMessage() const
@@ -215,7 +212,7 @@
     if (!element || !(element->hasLocalName(optionTag) || element->hasLocalName(hrTag)))
         return;
 
-    insertBefore(element, before, ec);
+    insertBefore(element, before, ec, AttachLazily);
     setNeedsValidityCheck();
 }
 
@@ -240,8 +237,8 @@
 {
     const Vector<HTMLElement*>& items = listItems();
     for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(items[i])->selected())
-            return static_cast<HTMLOptionElement*>(items[i])->value();
+        if (items[i]->hasLocalName(optionTag) && toHTMLOptionElement(items[i])->selected())
+            return toHTMLOptionElement(items[i])->value();
     }
     return "";
 }
@@ -259,7 +256,7 @@
     unsigned optionIndex = 0;
     for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->value() == value) {
+            if (toHTMLOptionElement(items[i])->value() == value) {
                 setSelectedIndex(optionIndex);
                 return;
             }
@@ -315,18 +312,9 @@
         HTMLFormControlElementWithState::parseAttribute(name, value);
 }
 
-bool HTMLSelectElement::isKeyboardFocusable(KeyboardEvent* event) const
+bool HTMLSelectElement::shouldShowFocusRingOnMouseFocus() const
 {
-    if (renderer())
-        return isFocusable();
-    return HTMLFormControlElementWithState::isKeyboardFocusable(event);
-}
-
-bool HTMLSelectElement::isMouseFocusable() const
-{
-    if (renderer())
-        return isFocusable();
-    return HTMLFormControlElementWithState::isMouseFocusable();
+    return true;
 }
 
 bool HTMLSelectElement::canSelectAll() const
@@ -334,11 +322,11 @@
     return !usesMenuList();
 }
 
-RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLSelectElement::createRenderer(RenderStyle*)
 {
     if (usesMenuList())
-        return new (arena) RenderMenuList(this);
-    return new (arena) RenderListBox(this);
+        return new (document()->renderArena()) RenderMenuList(this);
+    return new (document()->renderArena()) RenderListBox(this);
 }
 
 bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
@@ -373,6 +361,7 @@
 {
     setRecalcListItems();
     setNeedsValidityCheck();
+    m_lastOnChangeSelection.clear();
 
     HTMLFormControlElementWithState::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
@@ -641,6 +630,7 @@
 
     // If the cached selection list is empty, or the size has changed, then fire
     // dispatchFormControlChangeEvent, and return early.
+    // FIXME: Why? This looks unreasonable.
     if (m_lastOnChangeSelection.isEmpty() || m_lastOnChangeSelection.size() != items.size()) {
         dispatchFormControlChangeEvent();
         return;
@@ -959,7 +949,7 @@
     for (size_t i = listIndexStart; i < loopEndIndex; ++i) {
         if (!items[i]->hasLocalName(optionTag))
             continue;
-        if (static_cast<HTMLOptionElement*>(items[i])->value() == value)
+        if (toHTMLOptionElement(items[i])->value() == value)
             return i;
     }
     return notFound;
@@ -977,7 +967,7 @@
     for (size_t i = 0; i < itemsSize; ++i) {
         if (!items[i]->hasLocalName(optionTag))
             continue;
-        static_cast<HTMLOptionElement*>(items[i])->setSelectedState(false);
+        toHTMLOptionElement(items[i])->setSelectedState(false);
     }
 
     if (!multiple()) {
@@ -1108,7 +1098,7 @@
         if (!renderer() || !event->isKeyboardEvent())
             return;
 
-        if (platformHandleKeydownEvent(static_cast<KeyboardEvent*>(event)))
+        if (platformHandleKeydownEvent(toKeyboardEvent(event)))
             return;
 
         // When using spatial navigation, we want to be able to navigate away
@@ -1119,7 +1109,7 @@
                 return;
         }
 
-        const String& keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+        const String& keyIdentifier = toKeyboardEvent(event)->keyIdentifier();
         bool handled = true;
         const Vector<HTMLElement*>& listItems = this->listItems();
         int listIndex = optionToListIndex(selectedIndex());
@@ -1152,7 +1142,7 @@
         if (!renderer() || !event->isKeyboardEvent())
             return;
 
-        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+        int keyCode = toKeyboardEvent(event)->keyCode();
         bool handled = false;
 
         if (keyCode == ' ' && isSpatialNavigationEnabled(document()->frame())) {
@@ -1209,7 +1199,7 @@
             event->setDefaultHandled();
     }
 
-    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         focus();
         if (renderer() && renderer()->isMenuList()) {
             if (RenderMenuList* menuList = toRenderMenuList(renderer())) {
@@ -1290,14 +1280,14 @@
 {
     const Vector<HTMLElement*>& listItems = this->listItems();
 
-    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         focus();
         // Calling focus() may cause us to lose our renderer, in which case do not want to handle the event.
         if (!renderer())
             return;
 
         // Convert to coords relative to the list box if needed.
-        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        MouseEvent* mouseEvent = toMouseEvent(event);
         IntPoint localOffset = roundedIntPoint(renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), UseTransforms));
         int listIndex = toRenderListBox(renderer())->listIndexAtOffset(toIntSize(localOffset));
         if (listIndex >= 0) {
@@ -1314,7 +1304,7 @@
             event->setDefaultHandled();
         }
     } else if (event->type() == eventNames().mousemoveEvent && event->isMouseEvent() && !toRenderBox(renderer())->canBeScrolledAndHasScrollableArea()) {
-        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        MouseEvent* mouseEvent = toMouseEvent(event);
         if (mouseEvent->button() != LeftButton || !mouseEvent->buttonDown())
             return;
 
@@ -1337,7 +1327,7 @@
             }
             event->setDefaultHandled();
         }
-    } else if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton && renderer() && !toRenderBox(renderer())->autoscrollInProgress()) {
+    } else if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton && renderer() && !toRenderBox(renderer())->autoscrollInProgress()) {
         // We didn't start this click/drag on any options.
         if (m_lastOnChangeSelection.isEmpty())
             return;
@@ -1348,7 +1338,7 @@
     } else if (event->type() == eventNames().keydownEvent) {
         if (!event->isKeyboardEvent())
             return;
-        const String& keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+        const String& keyIdentifier = toKeyboardEvent(event)->keyIdentifier();
 
         bool handled = false;
         int endIndex = 0;
@@ -1407,12 +1397,12 @@
             ASSERT_UNUSED(listItems, !listItems.size() || static_cast<size_t>(endIndex) < listItems.size());
             setActiveSelectionEndIndex(endIndex);
 
-            bool selectNewItem = !m_multiple || static_cast<KeyboardEvent*>(event)->shiftKey() || !isSpatialNavigationEnabled(document()->frame());
+            bool selectNewItem = !m_multiple || toKeyboardEvent(event)->shiftKey() || !isSpatialNavigationEnabled(document()->frame());
             if (selectNewItem)
                 m_activeSelectionState = true;
             // If the anchor is unitialized, or if we're going to deselect all
             // other options, then set the anchor index equal to the end index.
-            bool deselectOthers = !m_multiple || (!static_cast<KeyboardEvent*>(event)->shiftKey() && selectNewItem);
+            bool deselectOthers = !m_multiple || (!toKeyboardEvent(event)->shiftKey() && selectNewItem);
             if (m_activeSelectionAnchorIndex < 0 || deselectOthers) {
                 if (deselectOthers)
                     deselectItemsWithoutValidation();
@@ -1431,7 +1421,7 @@
     } else if (event->type() == eventNames().keypressEvent) {
         if (!event->isKeyboardEvent())
             return;
-        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+        int keyCode = toKeyboardEvent(event)->keyCode();
 
         if (keyCode == '\r') {
             if (form())
@@ -1465,7 +1455,7 @@
         return;
 
     if (event->type() == eventNames().keypressEvent && event->isKeyboardEvent()) {
-        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        KeyboardEvent* keyboardEvent = toKeyboardEvent(event);
         if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() && isPrintableChar(keyboardEvent->charCode())) {
             typeAheadFind(keyboardEvent);
             event->setDefaultHandled();
diff --git a/Source/core/html/HTMLSelectElement.h b/Source/core/html/HTMLSelectElement.h
index bac7c08..1fa1b46 100644
--- a/Source/core/html/HTMLSelectElement.h
+++ b/Source/core/html/HTMLSelectElement.h
@@ -49,6 +49,8 @@
     virtual String validationMessage() const OVERRIDE;
     virtual bool valueMissing() const OVERRIDE;
 
+    virtual void reset() OVERRIDE;
+
     unsigned length() const;
 
     int size() const { return m_size; }
@@ -113,8 +115,7 @@
 private:
     virtual const AtomicString& formControlType() const;
     
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
+    virtual bool shouldShowFocusRingOnMouseFocus() const OVERRIDE;
 
     virtual void dispatchFocusEvent(PassRefPtr<Node> oldFocusedNode, FocusDirection) OVERRIDE;
     virtual void dispatchBlurEvent(PassRefPtr<Node> newFocusedNode);
@@ -131,11 +132,9 @@
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
 
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
+    virtual RenderObject* createRenderer(RenderStyle *);
     virtual bool appendFormData(FormDataList&, bool);
 
-    virtual void reset();
-
     virtual void defaultEventHandler(Event*);
 
     void dispatchChangeEventForMenuList();
diff --git a/Source/core/html/HTMLSourceElement.cpp b/Source/core/html/HTMLSourceElement.cpp
index 0c42dda..9c02a7b 100644
--- a/Source/core/html/HTMLSourceElement.cpp
+++ b/Source/core/html/HTMLSourceElement.cpp
@@ -29,7 +29,6 @@
 #include "HTMLNames.h"
 #include "core/dom/Event.h"
 #include "core/dom/EventNames.h"
-#include "core/html/HTMLDocument.h"
 #include "core/html/HTMLMediaElement.h"
 #include "core/platform/Logging.h"
 
diff --git a/Source/core/html/HTMLStyleElement.h b/Source/core/html/HTMLStyleElement.h
index ba2bcf1..084d4fd 100644
--- a/Source/core/html/HTMLStyleElement.h
+++ b/Source/core/html/HTMLStyleElement.h
@@ -103,14 +103,9 @@
     ScopedStyleRegistrationState m_scopedStyleRegistrationState;
 };
 
-inline bool isHTMLStyleElement(Node* node)
-{
-    return node->hasTagName(HTMLNames::styleTag);
-}
-
 inline HTMLStyleElement* toHTMLStyleElement(Node* node)
 {
-    ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLStyleElement(node));
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::styleTag));
     return static_cast<HTMLStyleElement*>(node);
 }
 
diff --git a/Source/core/html/HTMLSummaryElement.cpp b/Source/core/html/HTMLSummaryElement.cpp
index c50214a..d047101 100644
--- a/Source/core/html/HTMLSummaryElement.cpp
+++ b/Source/core/html/HTMLSummaryElement.cpp
@@ -47,9 +47,9 @@
     ASSERT(hasTagName(summaryTag));
 }
 
-RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLSummaryElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderBlock(this);
+    return new (document()->renderArena()) RenderBlock(this);
 }
 
 bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
@@ -108,13 +108,13 @@
         }
 
         if (event->isKeyboardEvent()) {
-            if (event->type() == eventNames().keydownEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+            if (event->type() == eventNames().keydownEvent && toKeyboardEvent(event)->keyIdentifier() == "U+0020") {
                 setActive(true, true);
                 // No setDefaultHandled() - IE dispatches a keypress in this case.
                 return;
             }
             if (event->type() == eventNames().keypressEvent) {
-                switch (static_cast<KeyboardEvent*>(event)->charCode()) {
+                switch (toKeyboardEvent(event)->charCode()) {
                 case '\r':
                     dispatchSimulatedClick(event);
                     event->setDefaultHandled();
@@ -125,7 +125,7 @@
                     return;
                 }
             }
-            if (event->type() == eventNames().keyupEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+            if (event->type() == eventNames().keyupEvent && toKeyboardEvent(event)->keyIdentifier() == "U+0020") {
                 if (active())
                     dispatchSimulatedClick(event);
                 event->setDefaultHandled();
diff --git a/Source/core/html/HTMLSummaryElement.h b/Source/core/html/HTMLSummaryElement.h
index feaa019..8a2108e 100644
--- a/Source/core/html/HTMLSummaryElement.h
+++ b/Source/core/html/HTMLSummaryElement.h
@@ -36,7 +36,7 @@
 private:
     HTMLSummaryElement(const QualifiedName&, Document*);
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
 
diff --git a/Source/core/html/HTMLTableElement.cpp b/Source/core/html/HTMLTableElement.cpp
index e9145c9..209470e 100644
--- a/Source/core/html/HTMLTableElement.cpp
+++ b/Source/core/html/HTMLTableElement.cpp
@@ -29,13 +29,11 @@
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "core/css/CSSImageValue.h"
-#include "core/css/CSSStyleSheet.h"
 #include "core/css/CSSValuePool.h"
 #include "core/css/StylePropertySet.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExceptionCodePlaceholder.h"
-#include "core/dom/Text.h"
 #include "core/html/HTMLTableCaptionElement.h"
 #include "core/html/HTMLTableRowElement.h"
 #include "core/html/HTMLTableRowsCollection.h"
diff --git a/Source/core/html/HTMLTextAreaElement.cpp b/Source/core/html/HTMLTextAreaElement.cpp
index 6ba0903..2c102f2 100644
--- a/Source/core/html/HTMLTextAreaElement.cpp
+++ b/Source/core/html/HTMLTextAreaElement.cpp
@@ -204,9 +204,9 @@
         HTMLTextFormControlElement::parseAttribute(name, value);
 }
 
-RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLTextAreaElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderTextControlMultiLine(this);
+    return new (document()->renderArena()) RenderTextControlMultiLine(this);
 }
 
 bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
@@ -241,9 +241,9 @@
     return isFocusable();
 }
 
-bool HTMLTextAreaElement::isMouseFocusable() const
+bool HTMLTextAreaElement::shouldShowFocusRingOnMouseFocus() const
 {
-    return isFocusable();
+    return true;
 }
 
 void HTMLTextAreaElement::updateFocusAppearance(bool restorePreviousSelection)
diff --git a/Source/core/html/HTMLTextAreaElement.h b/Source/core/html/HTMLTextAreaElement.h
index 4a5efac..8d06a88 100644
--- a/Source/core/html/HTMLTextAreaElement.h
+++ b/Source/core/html/HTMLTextAreaElement.h
@@ -100,11 +100,11 @@
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool appendFormData(FormDataList&, bool);
     virtual void reset();
     virtual bool hasCustomFocusLogic() const OVERRIDE;
-    virtual bool isMouseFocusable() const;
+    virtual bool shouldShowFocusRingOnMouseFocus() const OVERRIDE;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual void updateFocusAppearance(bool restorePreviousSelection);
 
diff --git a/Source/core/html/HTMLTextAreaElement.idl b/Source/core/html/HTMLTextAreaElement.idl
index 105683b..cefbca9 100644
--- a/Source/core/html/HTMLTextAreaElement.idl
+++ b/Source/core/html/HTMLTextAreaElement.idl
@@ -32,6 +32,7 @@
     [Reflect] attribute boolean required;
     attribute long rows;
     [Reflect] attribute DOMString wrap;
+    [EnabledAtRuntime=inputModeAttribute, Reflect] attribute DOMString inputMode;
 
     readonly attribute DOMString type;
     [TreatNullAs=NullString] attribute DOMString defaultValue;
diff --git a/Source/core/html/HTMLTextFormControlElement.cpp b/Source/core/html/HTMLTextFormControlElement.cpp
index 100fdcc..50c6c79 100644
--- a/Source/core/html/HTMLTextFormControlElement.cpp
+++ b/Source/core/html/HTMLTextFormControlElement.cpp
@@ -621,13 +621,13 @@
             unsigned position = 0;
             while (breakNode == node && breakOffset <= length) {
                 if (breakOffset > position) {
-                    result.append(data.characters() + position, breakOffset - position);
+                    result.append(data, position, breakOffset - position);
                     position = breakOffset;
                     result.append(newlineCharacter);
                 }
                 getNextSoftBreak(line, breakNode, breakOffset);
             }
-            result.append(data.characters() + position, length - position);
+            result.append(data, position, length - position);
         }
         while (breakNode == node)
             getNextSoftBreak(line, breakNode, breakOffset);
diff --git a/Source/core/html/HTMLTitleElement.cpp b/Source/core/html/HTMLTitleElement.cpp
index 14e02ca..9df7789 100644
--- a/Source/core/html/HTMLTitleElement.cpp
+++ b/Source/core/html/HTMLTitleElement.cpp
@@ -25,11 +25,10 @@
 
 #include "HTMLNames.h"
 #include "core/dom/Document.h"
-#include "core/dom/NodeRenderingContext.h"
 #include "core/dom/Text.h"
 #include "core/rendering/style/RenderStyle.h"
 #include "core/rendering/style/StyleInheritedData.h"
-#include <wtf/text/StringBuilder.h>
+#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/HTMLTrackElement.cpp b/Source/core/html/HTMLTrackElement.cpp
index 4d4a314..17e9e65 100644
--- a/Source/core/html/HTMLTrackElement.cpp
+++ b/Source/core/html/HTMLTrackElement.cpp
@@ -27,10 +27,8 @@
 #include "core/html/HTMLTrackElement.h"
 
 #include "HTMLNames.h"
-#include "bindings/v8/ScriptEventListener.h"
 #include "core/dom/Event.h"
 #include "core/html/HTMLMediaElement.h"
-#include "core/inspector/ScriptCallStack.h"
 #include "core/page/ContentSecurityPolicy.h"
 #include "RuntimeEnabledFeatures.h"
 #include "core/platform/Logging.h"
diff --git a/Source/core/html/HTMLVideoElement.cpp b/Source/core/html/HTMLVideoElement.cpp
index de51bcf..83eb6fe 100644
--- a/Source/core/html/HTMLVideoElement.cpp
+++ b/Source/core/html/HTMLVideoElement.cpp
@@ -34,7 +34,6 @@
 #include "core/dom/ExceptionCode.h"
 #include "core/html/HTMLImageLoader.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/page/Frame.h"
 #include "core/page/Settings.h"
 #include "core/rendering/RenderImage.h"
 #include "core/rendering/RenderVideo.h"
@@ -64,9 +63,9 @@
     return HTMLElement::rendererIsNeeded(context); 
 }
 
-RenderObject* HTMLVideoElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLVideoElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderVideo(this);
+    return new (document()->renderArena()) RenderVideo(this);
 }
 
 void HTMLVideoElement::attach(const AttachContext& context)
diff --git a/Source/core/html/HTMLVideoElement.h b/Source/core/html/HTMLVideoElement.h
index d2ded02..d77a4b5 100644
--- a/Source/core/html/HTMLVideoElement.h
+++ b/Source/core/html/HTMLVideoElement.h
@@ -72,7 +72,7 @@
     HTMLVideoElement(const QualifiedName&, Document*, bool);
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
diff --git a/Source/core/html/HiddenInputType.cpp b/Source/core/html/HiddenInputType.cpp
index b48060d..8b1d15c 100644
--- a/Source/core/html/HiddenInputType.cpp
+++ b/Source/core/html/HiddenInputType.cpp
@@ -72,7 +72,7 @@
     return false;
 }
 
-RenderObject* HiddenInputType::createRenderer(RenderArena*, RenderStyle*) const
+RenderObject* HiddenInputType::createRenderer(RenderStyle*) const
 {
     ASSERT_NOT_REACHED();
     return 0;
diff --git a/Source/core/html/HiddenInputType.h b/Source/core/html/HiddenInputType.h
index d6af8c2..bb31b47 100644
--- a/Source/core/html/HiddenInputType.h
+++ b/Source/core/html/HiddenInputType.h
@@ -45,7 +45,7 @@
     virtual FormControlState saveFormControlState() const OVERRIDE;
     virtual void restoreFormControlState(const FormControlState&) OVERRIDE;
     virtual bool supportsValidation() const OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual bool rendererIsNeeded() OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
diff --git a/Source/core/html/ImageDocument.cpp b/Source/core/html/ImageDocument.cpp
index 85b95b1..eb594be 100644
--- a/Source/core/html/ImageDocument.cpp
+++ b/Source/core/html/ImageDocument.cpp
@@ -91,7 +91,7 @@
     {
     }
 
-    virtual void appendBytes(DocumentWriter*, const char*, size_t);
+    virtual size_t appendBytes(const char*, size_t) OVERRIDE;
     virtual void finish();
 };
 
@@ -125,18 +125,19 @@
     return frame ? frame->pageZoomFactor() : 1;
 }
 
-void ImageDocumentParser::appendBytes(DocumentWriter*, const char* data, size_t length)
+size_t ImageDocumentParser::appendBytes(const char* data, size_t length)
 {
     if (!length)
-        return;
+        return 0;
 
     Frame* frame = document()->frame();
     Settings* settings = frame->settings();
     if (!frame->loader()->client()->allowImage(!settings || settings->areImagesEnabled(), document()->url()))
-        return;
+        return 0;
 
     document()->cachedImage()->appendData(data, length);
     document()->imageUpdated();
+    return 0;
 }
 
 void ImageDocumentParser::finish()
@@ -374,7 +375,7 @@
     if (event->type() == eventNames().resizeEvent)
         m_doc->windowSizeChanged();
     else if (event->type() == eventNames().clickEvent && event->isMouseEvent()) {
-        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        MouseEvent* mouseEvent = toMouseEvent(event);
         m_doc->imageClicked(mouseEvent->x(), mouseEvent->y());
     }
 }
diff --git a/Source/core/html/ImageInputType.cpp b/Source/core/html/ImageInputType.cpp
index eef34da..3147783 100644
--- a/Source/core/html/ImageInputType.cpp
+++ b/Source/core/html/ImageInputType.cpp
@@ -92,7 +92,7 @@
         return;
     element->setActivatedSubmit(true);
     if (event->underlyingEvent() && event->underlyingEvent()->isMouseEvent()) {
-        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event->underlyingEvent());
+        MouseEvent* mouseEvent = toMouseEvent(event->underlyingEvent());
         m_clickLocation = IntPoint(mouseEvent->offsetX(), mouseEvent->offsetY());
     } else
         m_clickLocation = IntPoint();
@@ -101,9 +101,9 @@
     event->setDefaultHandled();
 }
 
-RenderObject* ImageInputType::createRenderer(RenderArena* arena, RenderStyle*) const
+RenderObject* ImageInputType::createRenderer(RenderStyle*) const
 {
-    RenderImage* image = new (arena) RenderImage(element());
+    RenderImage* image = new (element()->document()->renderArena()) RenderImage(element());
     image->setImageResource(RenderImageResource::create());
     return image;
 }
diff --git a/Source/core/html/ImageInputType.h b/Source/core/html/ImageInputType.h
index ebaca90..2341c4e 100644
--- a/Source/core/html/ImageInputType.h
+++ b/Source/core/html/ImageInputType.h
@@ -35,7 +35,6 @@
 
 #include "core/html/BaseButtonInputType.h"
 #include "core/platform/graphics/IntPoint.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -49,7 +48,7 @@
     virtual bool isFormDataAppendable() const OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
     virtual bool supportsValidation() const OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual void handleDOMActivateEvent(Event*) OVERRIDE;
     virtual void altAttributeChanged() OVERRIDE;
     virtual void srcAttributeChanged() OVERRIDE;
diff --git a/Source/core/html/InputType.cpp b/Source/core/html/InputType.cpp
index 18bead5..665b6ae 100644
--- a/Source/core/html/InputType.cpp
+++ b/Source/core/html/InputType.cpp
@@ -429,7 +429,7 @@
 
 bool InputType::shouldSubmitImplicitly(Event* event)
 {
-    return event->isKeyboardEvent() && event->type() == eventNames().keypressEvent && static_cast<KeyboardEvent*>(event)->charCode() == '\r';
+    return event->isKeyboardEvent() && event->type() == eventNames().keypressEvent && toKeyboardEvent(event)->charCode() == '\r';
 }
 
 PassRefPtr<HTMLFormElement> InputType::formForSubmission() const
@@ -437,7 +437,7 @@
     return element()->form();
 }
 
-RenderObject* InputType::createRenderer(RenderArena*, RenderStyle* style) const
+RenderObject* InputType::createRenderer(RenderStyle* style) const
 {
     return RenderObject::createObject(element(), style);
 }
@@ -531,9 +531,9 @@
     return element()->isTextFormControlKeyboardFocusable(event);
 }
 
-bool InputType::isMouseFocusable() const
+bool InputType::shouldShowFocusRingOnMouseFocus() const
 {
-    return element()->isTextFormControlMouseFocusable();
+    return false;
 }
 
 bool InputType::shouldUseInputMethod() const
diff --git a/Source/core/html/InputType.h b/Source/core/html/InputType.h
index 0c316e4..28f95d7 100644
--- a/Source/core/html/InputType.h
+++ b/Source/core/html/InputType.h
@@ -36,11 +36,10 @@
 #include "core/html/HTMLTextFormControlElement.h"
 #include "core/html/StepRange.h"
 #include "core/page/UseCounter.h"
-#include <wtf/FastAllocBase.h>
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
+#include "wtf/FastAllocBase.h"
+#include "wtf/Forward.h"
+#include "wtf/Noncopyable.h"
+#include "wtf/RefPtr.h"
 
 namespace WebCore {
 
@@ -59,7 +58,6 @@
 class KeyboardEvent;
 class MouseEvent;
 class Node;
-class RenderArena;
 class RenderObject;
 class RenderStyle;
 class TouchEvent;
@@ -197,7 +195,7 @@
     virtual PassRefPtr<HTMLFormElement> formForSubmission() const;
     virtual bool hasCustomFocusLogic() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
+    virtual bool shouldShowFocusRingOnMouseFocus() const;
     virtual bool shouldUseInputMethod() const;
     virtual void handleFocusEvent(Node* oldFocusedNode, FocusDirection);
     virtual void handleBlurEvent();
@@ -230,7 +228,7 @@
     // Miscellaneous functions
 
     virtual bool rendererIsNeeded();
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const;
+    virtual RenderObject* createRenderer(RenderStyle*) const;
     virtual PassRefPtr<RenderStyle> customStyleForRenderer(PassRefPtr<RenderStyle>);
     virtual void attach();
     virtual void detach();
diff --git a/Source/core/html/LabelableElement.h b/Source/core/html/LabelableElement.h
index ce7a2cf..86a23ed 100644
--- a/Source/core/html/LabelableElement.h
+++ b/Source/core/html/LabelableElement.h
@@ -50,6 +50,12 @@
     virtual bool isLabelable() const OVERRIDE FINAL { return true; }
 };
 
+inline LabelableElement* toLabelableElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || (node->isHTMLElement() && toHTMLElement(node)->isLabelable()));
+    return static_cast<LabelableElement*>(node);
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/core/html/LinkResource.h b/Source/core/html/LinkResource.h
index a4acde8..3cac604 100644
--- a/Source/core/html/LinkResource.h
+++ b/Source/core/html/LinkResource.h
@@ -33,7 +33,6 @@
 
 #include "core/loader/cache/CachedResourceRequest.h"
 #include "weborigin/KURL.h"
-#include "wtf/Forward.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
 
diff --git a/Source/core/html/MediaController.h b/Source/core/html/MediaController.h
index 4ec9d6e..cb05e8c 100644
--- a/Source/core/html/MediaController.h
+++ b/Source/core/html/MediaController.h
@@ -27,15 +27,13 @@
 #define MediaController_h
 
 #include "bindings/v8/ScriptWrappable.h"
-#include "core/dom/ActiveDOMObject.h"
 #include "core/dom/Event.h"
-#include "core/dom/EventListener.h"
 #include "core/dom/EventTarget.h"
 #include "core/html/MediaControllerInterface.h"
 #include "core/platform/Timer.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefCounted.h"
+#include "wtf/Vector.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/MediaDocument.cpp b/Source/core/html/MediaDocument.cpp
index 9c8d880..4be22af 100644
--- a/Source/core/html/MediaDocument.cpp
+++ b/Source/core/html/MediaDocument.cpp
@@ -60,7 +60,7 @@
     {
     }
 
-    virtual void appendBytes(DocumentWriter*, const char*, size_t);
+    virtual size_t appendBytes(const char*, size_t) OVERRIDE;
 
     void createDocumentStructure();
 
@@ -97,21 +97,16 @@
 
     m_mediaElement->appendChild(sourceElement, IGNORE_EXCEPTION);
     body->appendChild(mediaElement, IGNORE_EXCEPTION);
-
-    Frame* frame = document()->frame();
-    if (!frame)
-        return;
-
-    frame->loader()->activeDocumentLoader()->setMainResourceDataBufferingPolicy(DoNotBufferData);
 }
 
-void MediaDocumentParser::appendBytes(DocumentWriter*, const char*, size_t)
+size_t MediaDocumentParser::appendBytes(const char*, size_t)
 {
     if (m_mediaElement)
-        return;
+        return 0;
 
     createDocumentStructure();
     finish();
+    return 0;
 }
     
 MediaDocument::MediaDocument(Frame* frame, const KURL& url)
@@ -154,7 +149,7 @@
         if (!video)
             return;
 
-        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        KeyboardEvent* keyboardEvent = toKeyboardEvent(event);
         if (keyboardEvent->keyIdentifier() == "U+0020" || keyboardEvent->keyCode() == VKEY_MEDIA_PLAY_PAUSE) {
             // space or media key (play/pause)
             if (video->paused()) {
diff --git a/Source/core/html/MediaFragmentURIParser.cpp b/Source/core/html/MediaFragmentURIParser.cpp
index d8e7af5..5a8ddf9 100644
--- a/Source/core/html/MediaFragmentURIParser.cpp
+++ b/Source/core/html/MediaFragmentURIParser.cpp
@@ -126,11 +126,10 @@
         //  a. Decode percent-encoded octets in name and value as defined by RFC 3986. If either
         //     name or value are not valid percent-encoded strings, then remove the name-value pair
         //     from the list.
-        const UChar* fragmentStart = fragmentString.characters();
-        String name = decodeURLEscapeSequences(String(fragmentStart + parameterStart, equalOffset - parameterStart));
+        String name = decodeURLEscapeSequences(fragmentString.substring(parameterStart, equalOffset - parameterStart));
         String value;
         if (equalOffset != parameterEnd)
-            value = decodeURLEscapeSequences(String(fragmentStart + equalOffset + 1, parameterEnd - equalOffset - 1));
+            value = decodeURLEscapeSequences(fragmentString.substring(equalOffset + 1, parameterEnd - equalOffset - 1));
         
         //  b. Convert name and value to Unicode strings by interpreting them as UTF-8. If either
         //     name or value are not valid UTF-8 strings, then remove the name-value pair from the list.
diff --git a/Source/core/html/MediaFragmentURIParser.h b/Source/core/html/MediaFragmentURIParser.h
index 5d5be04..50c95c7 100644
--- a/Source/core/html/MediaFragmentURIParser.h
+++ b/Source/core/html/MediaFragmentURIParser.h
@@ -27,7 +27,6 @@
 #define MediaFragmentURIParser_h
 
 #include "weborigin/KURL.h"
-#include "wtf/PassOwnPtr.h"
 #include "wtf/Vector.h"
 
 namespace WebCore {
diff --git a/Source/core/html/MonthInputType.cpp b/Source/core/html/MonthInputType.cpp
index bf4f8b5..885f311 100644
--- a/Source/core/html/MonthInputType.cpp
+++ b/Source/core/html/MonthInputType.cpp
@@ -128,11 +128,11 @@
     return Decimal::fromDouble(months);
 }
 
-bool MonthInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+bool MonthInputType::parseToDateComponentsInternal(const String& string, DateComponents* out) const
 {
     ASSERT(out);
     unsigned end;
-    return out->parseMonth(characters, length, 0, end) && end == length;
+    return out->parseMonth(string, 0, end) && end == string.length();
 }
 
 bool MonthInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
diff --git a/Source/core/html/MonthInputType.h b/Source/core/html/MonthInputType.h
index 2e11cd4..9fbfd33 100644
--- a/Source/core/html/MonthInputType.h
+++ b/Source/core/html/MonthInputType.h
@@ -56,7 +56,7 @@
     virtual Decimal parseToNumber(const String&, const Decimal&) const OVERRIDE;
     virtual Decimal defaultValueForStepUp() const OVERRIDE;
     virtual StepRange createStepRange(AnyStepHandling) const OVERRIDE;
-    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const OVERRIDE;
+    virtual bool parseToDateComponentsInternal(const String&, DateComponents*) const OVERRIDE;
     virtual bool setMillisecondToDateComponents(double, DateComponents*) const OVERRIDE;
     virtual bool isMonthField() const OVERRIDE;
 
diff --git a/Source/core/html/NumberInputType.cpp b/Source/core/html/NumberInputType.cpp
index e66394b..be73a85 100644
--- a/Source/core/html/NumberInputType.cpp
+++ b/Source/core/html/NumberInputType.cpp
@@ -34,7 +34,6 @@
 
 #include <limits>
 #include "HTMLNames.h"
-#include "core/dom/BeforeTextInsertedEvent.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/KeyboardEvent.h"
 #include "core/html/HTMLInputElement.h"
@@ -43,9 +42,8 @@
 #include "core/platform/LocalizedStrings.h"
 #include "core/platform/text/PlatformLocale.h"
 #include "core/rendering/RenderTextControl.h"
-#include <wtf/ASCIICType.h>
-#include <wtf/MathExtras.h>
-#include <wtf/PassOwnPtr.h>
+#include "wtf/MathExtras.h"
+#include "wtf/PassOwnPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/PluginDocument.cpp b/Source/core/html/PluginDocument.cpp
index ad47278..b4f129c 100644
--- a/Source/core/html/PluginDocument.cpp
+++ b/Source/core/html/PluginDocument.cpp
@@ -35,6 +35,7 @@
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/Frame.h"
 #include "core/page/FrameView.h"
+#include "core/plugins/PluginView.h"
 #include "core/rendering/RenderEmbeddedObject.h"
 
 namespace WebCore {
@@ -56,10 +57,14 @@
     {
     }
 
-    virtual void appendBytes(DocumentWriter*, const char*, size_t);
+    virtual size_t appendBytes(const char*, size_t) OVERRIDE;
+
+    virtual void finish() OVERRIDE;
 
     void createDocumentStructure();
 
+    PluginView* pluginView() const;
+
     HTMLEmbedElement* m_embedElement;
 };
 
@@ -91,19 +96,11 @@
     DocumentLoader* loader = document()->loader();
     ASSERT(loader);
     if (loader)
-        m_embedElement->setAttribute(typeAttr, loader->writer()->mimeType());
+        m_embedElement->setAttribute(typeAttr, loader->mimeType());
 
     toPluginDocument(document())->setPluginNode(m_embedElement);
 
     body->appendChild(embedElement, IGNORE_EXCEPTION);
-}
-
-void PluginDocumentParser::appendBytes(DocumentWriter*, const char*, size_t)
-{
-    if (m_embedElement)
-        return;
-
-    createDocumentStructure();
 
     Frame* frame = document()->frame();
     if (!frame)
@@ -121,15 +118,42 @@
     // can synchronously redirect data to the plugin.
     frame->view()->flushAnyPendingPostLayoutTasks();
 
-    if (RenderPart* renderer = m_embedElement->renderPart()) {
-        if (Widget* widget = renderer->widget()) {
-            frame->loader()->client()->redirectDataToPlugin(widget);
-            // In a plugin document, the main resource is the plugin. If we have a null widget, that means
-            // the loading of the plugin was cancelled, which gives us a null mainResourceLoader(), so we
-            // need to have this call in a null check of the widget or of mainResourceLoader().
-            frame->loader()->activeDocumentLoader()->setMainResourceDataBufferingPolicy(DoNotBufferData);
-        }
+    if (PluginView* view = pluginView())
+        view->didReceiveResponse(document()->loader()->response());
+}
+
+size_t PluginDocumentParser::appendBytes(const char* data, size_t length)
+{
+    if (!m_embedElement)
+        createDocumentStructure();
+
+    if (!length)
+        return 0;
+    if (PluginView* view = pluginView())
+        view->didReceiveData(data, length);
+
+    return 0;
+}
+
+void PluginDocumentParser::finish()
+{
+    if (PluginView* view = pluginView()) {
+        const ResourceError& error = document()->loader()->mainDocumentError();
+        if (error.isNull())
+            view->didFinishLoading();
+        else
+            view->didFailLoading(error);
     }
+    RawDataDocumentParser::finish();
+}
+
+PluginView* PluginDocumentParser::pluginView() const
+{
+    if (Widget* widget = static_cast<PluginDocument*>(document())->pluginWidget()) {
+        ASSERT_WITH_SECURITY_IMPLICATION(widget->isPluginContainer());
+        return static_cast<PluginView*>(widget);
+    }
+    return 0;
 }
 
 PluginDocument::PluginDocument(Frame* frame, const KURL& url)
@@ -163,8 +187,6 @@
 {
     // Release the plugin node so that we don't have a circular reference.
     m_pluginNode = 0;
-    if (FrameLoader* loader = frame()->loader())
-        loader->client()->redirectDataToPlugin(0);
     HTMLDocument::detach(context);
 }
 
diff --git a/Source/core/html/PublicURLManager.h b/Source/core/html/PublicURLManager.h
index 9aeed98..7b9f2f7 100644
--- a/Source/core/html/PublicURLManager.h
+++ b/Source/core/html/PublicURLManager.h
@@ -30,7 +30,6 @@
 #include "wtf/HashMap.h"
 #include "wtf/HashSet.h"
 #include "wtf/PassOwnPtr.h"
-#include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
 
 namespace WebCore {
diff --git a/Source/core/html/RadioInputType.cpp b/Source/core/html/RadioInputType.cpp
index d228a97..1818056 100644
--- a/Source/core/html/RadioInputType.cpp
+++ b/Source/core/html/RadioInputType.cpp
@@ -94,6 +94,7 @@
         if (inputElement->form() != element()->form())
             break;
         if (inputElement->isRadioButton() && inputElement->name() == element()->name() && inputElement->isFocusable()) {
+            RefPtr<HTMLInputElement> protector(inputElement);
             document->setFocusedNode(inputElement);
             inputElement->dispatchSimulatedClick(event, SendNoEvents, DoNotShowPressedLook);
             event->setDefaultHandled();
diff --git a/Source/core/html/RadioNodeList.cpp b/Source/core/html/RadioNodeList.cpp
index 66fd5dc..5768dcf 100644
--- a/Source/core/html/RadioNodeList.cpp
+++ b/Source/core/html/RadioNodeList.cpp
@@ -92,7 +92,7 @@
         if (testElement->hasTagName(objectTag))
             formElement = static_cast<HTMLObjectElement*>(testElement)->form();
         else
-            formElement = static_cast<HTMLFormControlElement*>(testElement)->form();
+            formElement = toHTMLFormControlElement(testElement)->form();
         if (!formElement || formElement != ownerNode())
             return false;
     }
diff --git a/Source/core/html/RadioNodeList.h b/Source/core/html/RadioNodeList.h
index 85a5dfd..d0bdbf3 100644
--- a/Source/core/html/RadioNodeList.h
+++ b/Source/core/html/RadioNodeList.h
@@ -27,10 +27,8 @@
 #define RadioNodeList_h
 
 #include "core/dom/LiveNodeList.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/text/AtomicString.h>
-#include <wtf/Vector.h>
+#include "wtf/PassRefPtr.h"
+#include "wtf/text/AtomicString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/RangeInputType.cpp b/Source/core/html/RangeInputType.cpp
index e96c490..ebac793 100644
--- a/Source/core/html/RangeInputType.cpp
+++ b/Source/core/html/RangeInputType.cpp
@@ -254,9 +254,9 @@
     element()->userAgentShadowRoot()->appendChild(container.release(), IGNORE_EXCEPTION);
 }
 
-RenderObject* RangeInputType::createRenderer(RenderArena* arena, RenderStyle*) const
+RenderObject* RangeInputType::createRenderer(RenderStyle*) const
 {
-    return new (arena) RenderSlider(element());
+    return new (element()->document()->renderArena()) RenderSlider(element());
 }
 
 Decimal RangeInputType::parseToNumber(const String& src, const Decimal& defaultValue) const
diff --git a/Source/core/html/RangeInputType.h b/Source/core/html/RangeInputType.h
index 76c2ceb..2b6e24d 100644
--- a/Source/core/html/RangeInputType.h
+++ b/Source/core/html/RangeInputType.h
@@ -56,7 +56,7 @@
     virtual void handleTouchEvent(TouchEvent*) OVERRIDE;
     virtual bool hasTouchEventHandler() const OVERRIDE;
     virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual void createShadowSubtree() OVERRIDE;
     virtual Decimal parseToNumber(const String&, const Decimal&) const OVERRIDE;
     virtual String serialize(const Decimal&) const OVERRIDE;
diff --git a/Source/core/html/SearchInputType.cpp b/Source/core/html/SearchInputType.cpp
index 7d21d26..dc515fc 100644
--- a/Source/core/html/SearchInputType.cpp
+++ b/Source/core/html/SearchInputType.cpp
@@ -62,9 +62,9 @@
     observeFeatureIfVisible(UseCounter::InputTypeSearch);
 }
 
-RenderObject* SearchInputType::createRenderer(RenderArena* arena, RenderStyle*) const
+RenderObject* SearchInputType::createRenderer(RenderStyle*) const
 {
-    return new (arena) RenderSearchField(element());
+    return new (element()->document()->renderArena()) RenderSearchField(element());
 }
 
 const AtomicString& SearchInputType::formControlType() const
diff --git a/Source/core/html/SearchInputType.h b/Source/core/html/SearchInputType.h
index 3a35cc9..c30272e 100644
--- a/Source/core/html/SearchInputType.h
+++ b/Source/core/html/SearchInputType.h
@@ -48,7 +48,7 @@
 private:
     SearchInputType(HTMLInputElement*);
     virtual void attach() OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool shouldRespectSpeechAttribute() OVERRIDE;
     virtual bool isSearchField() const OVERRIDE;
diff --git a/Source/core/html/StepRange.h b/Source/core/html/StepRange.h
index 4aa5cae..0b04444 100644
--- a/Source/core/html/StepRange.h
+++ b/Source/core/html/StepRange.h
@@ -22,8 +22,7 @@
 #define StepRange_h
 
 #include "core/platform/Decimal.h"
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
+#include "wtf/Forward.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/TextFieldInputType.cpp b/Source/core/html/TextFieldInputType.cpp
index 92a4676..9c848cb 100644
--- a/Source/core/html/TextFieldInputType.cpp
+++ b/Source/core/html/TextFieldInputType.cpp
@@ -48,6 +48,7 @@
 #include "core/page/ChromeClient.h"
 #include "core/page/Frame.h"
 #include "core/page/Page.h"
+#include "core/page/Settings.h"
 #include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderTextControlSingleLine.h"
 #include "core/rendering/RenderTheme.h"
@@ -73,9 +74,9 @@
     return element()->isFocusable();
 }
 
-bool TextFieldInputType::isMouseFocusable() const
+bool TextFieldInputType::shouldShowFocusRingOnMouseFocus() const
 {
-    return element()->isFocusable();
+    return true;
 }
 
 bool TextFieldInputType::isTextField() const
@@ -83,9 +84,18 @@
     return true;
 }
 
+static inline bool shouldIgnoreRequiredAttribute(const HTMLInputElement& input)
+{
+    if (!input.document()->settings() || !input.document()->settings()->needsSiteSpecificQuirks())
+        return false;
+    if (!equalIgnoringCase(input.document()->url().host(), "egov.uscis.gov"))
+        return false;
+    return input.fastGetAttribute(requiredAttr) == "no";
+}
+
 bool TextFieldInputType::valueMissing(const String& value) const
 {
-    return element()->isRequired() && value.isEmpty();
+    return !shouldIgnoreRequiredAttribute(*element()) && element()->isRequired() && value.isEmpty();
 }
 
 bool TextFieldInputType::canSetSuggestedValue()
@@ -201,9 +211,9 @@
     return (event->type() == eventNames().textInputEvent && event->hasInterface(eventNames().interfaceForTextEvent) && static_cast<TextEvent*>(event)->data() == "\n") || InputType::shouldSubmitImplicitly(event);
 }
 
-RenderObject* TextFieldInputType::createRenderer(RenderArena* arena, RenderStyle*) const
+RenderObject* TextFieldInputType::createRenderer(RenderStyle*) const
 {
-    return new (arena) RenderTextControlSingleLine(element());
+    return new (element()->document()->renderArena()) RenderTextControlSingleLine(element());
 }
 
 bool TextFieldInputType::needsContainer() const
diff --git a/Source/core/html/TextFieldInputType.h b/Source/core/html/TextFieldInputType.h
index 48e06fc..e38ad76 100644
--- a/Source/core/html/TextFieldInputType.h
+++ b/Source/core/html/TextFieldInputType.h
@@ -33,7 +33,6 @@
 
 #include "core/html/InputType.h"
 #include "core/html/shadow/SpinButtonElement.h"
-#include "core/html/shadow/TextControlInnerElements.h"
 
 namespace WebCore {
 
@@ -80,13 +79,13 @@
 
 private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const OVERRIDE;
-    virtual bool isMouseFocusable() const OVERRIDE;
+    virtual bool shouldShowFocusRingOnMouseFocus() const OVERRIDE;
     virtual bool isTextField() const OVERRIDE;
     virtual bool valueMissing(const String&) const OVERRIDE;
     virtual void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*) OVERRIDE;
     virtual void forwardEvent(Event*) OVERRIDE;
     virtual bool shouldSubmitImplicitly(Event*) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) const OVERRIDE;
     virtual bool shouldUseInputMethod() const OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
diff --git a/Source/core/html/TimeInputType.cpp b/Source/core/html/TimeInputType.cpp
index bc0d6ea..c20d431 100644
--- a/Source/core/html/TimeInputType.cpp
+++ b/Source/core/html/TimeInputType.cpp
@@ -105,11 +105,11 @@
     return StepRange(stepBase, minimum, maximum, step, stepDescription);
 }
 
-bool TimeInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+bool TimeInputType::parseToDateComponentsInternal(const String& string, DateComponents* out) const
 {
     ASSERT(out);
     unsigned end;
-    return out->parseTime(characters, length, 0, end) && end == length;
+    return out->parseTime(string, 0, end) && end == string.length();
 }
 
 bool TimeInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
diff --git a/Source/core/html/TimeInputType.h b/Source/core/html/TimeInputType.h
index 4a1eca6..31a968b 100644
--- a/Source/core/html/TimeInputType.h
+++ b/Source/core/html/TimeInputType.h
@@ -53,7 +53,7 @@
     virtual DateComponents::Type dateType() const OVERRIDE;
     virtual Decimal defaultValueForStepUp() const OVERRIDE;
     virtual StepRange createStepRange(AnyStepHandling) const OVERRIDE;
-    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const OVERRIDE;
+    virtual bool parseToDateComponentsInternal(const String&, DateComponents*) const OVERRIDE;
     virtual bool setMillisecondToDateComponents(double, DateComponents*) const OVERRIDE;
     virtual bool isTimeField() const OVERRIDE;
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
diff --git a/Source/core/html/TypeAhead.cpp b/Source/core/html/TypeAhead.cpp
index e404255..d93541f 100644
--- a/Source/core/html/TypeAhead.cpp
+++ b/Source/core/html/TypeAhead.cpp
@@ -29,8 +29,7 @@
 #include "core/html/TypeAhead.h"
 
 #include "core/dom/KeyboardEvent.h"
-#include <wtf/unicode/CharacterNames.h>
-#include <wtf/unicode/Unicode.h>
+#include "wtf/unicode/CharacterNames.h"
 
 using namespace WTF::Unicode;
 
diff --git a/Source/core/html/URL.idl b/Source/core/html/URL.idl
index b631c4c..9f71a67 100644
--- a/Source/core/html/URL.idl
+++ b/Source/core/html/URL.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     Constructor,
     ImplementedAs=DOMURL
 ] interface URL {
diff --git a/Source/core/html/ValidationMessage.cpp b/Source/core/html/ValidationMessage.cpp
index 83cf399..7b4e298 100644
--- a/Source/core/html/ValidationMessage.cpp
+++ b/Source/core/html/ValidationMessage.cpp
@@ -33,7 +33,6 @@
 
 #include "core/html/HTMLFormControlElement.h"
 #include "core/page/Page.h"
-#include "core/page/Settings.h"
 #include "core/page/ValidationMessageClient.h"
 #include "wtf/PassOwnPtr.h"
 
diff --git a/Source/core/html/ValidityState.cpp b/Source/core/html/ValidityState.cpp
index 98cbdb7..b47a93c 100644
--- a/Source/core/html/ValidityState.cpp
+++ b/Source/core/html/ValidityState.cpp
@@ -24,18 +24,8 @@
 #include "config.h"
 #include "core/html/ValidityState.h"
 
-#include "HTMLNames.h"
-#include "core/html/HTMLInputElement.h"
-#include "core/html/HTMLSelectElement.h"
-#include "core/html/HTMLTextAreaElement.h"
-#include "core/html/parser/HTMLTreeBuilder.h"
-#include "core/platform/LocalizedStrings.h"
-#include <wtf/StdLibExtras.h>
-
 namespace WebCore {
 
-using namespace HTMLNames;
-
 String ValidityState::validationMessage() const
 {
     return m_control->validationMessage();
diff --git a/Source/core/html/WeekInputType.cpp b/Source/core/html/WeekInputType.cpp
index 64ad701..50cfd74 100644
--- a/Source/core/html/WeekInputType.cpp
+++ b/Source/core/html/WeekInputType.cpp
@@ -82,11 +82,11 @@
     return StepRange(stepBase, minimum, maximum, step, stepDescription);
 }
 
-bool WeekInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+bool WeekInputType::parseToDateComponentsInternal(const String& string, DateComponents* out) const
 {
     ASSERT(out);
     unsigned end;
-    return out->parseWeek(characters, length, 0, end) && end == length;
+    return out->parseWeek(string, 0, end) && end == string.length();
 }
 
 bool WeekInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
diff --git a/Source/core/html/WeekInputType.h b/Source/core/html/WeekInputType.h
index 9242089..5aa3ea7 100644
--- a/Source/core/html/WeekInputType.h
+++ b/Source/core/html/WeekInputType.h
@@ -52,7 +52,7 @@
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual DateComponents::Type dateType() const OVERRIDE;
     virtual StepRange createStepRange(AnyStepHandling) const OVERRIDE;
-    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const OVERRIDE;
+    virtual bool parseToDateComponentsInternal(const String&, DateComponents*) const OVERRIDE;
     virtual bool setMillisecondToDateComponents(double, DateComponents*) const OVERRIDE;
     virtual bool isWeekField() const OVERRIDE;
 
diff --git a/Source/core/html/canvas/ArrayBuffer.idl b/Source/core/html/canvas/ArrayBuffer.idl
index 1a6df2d..781bd90 100644
--- a/Source/core/html/canvas/ArrayBuffer.idl
+++ b/Source/core/html/canvas/ArrayBuffer.idl
@@ -24,7 +24,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     CustomConstructor(unsigned long length)
 ] interface ArrayBuffer {
     readonly attribute unsigned long byteLength;
diff --git a/Source/core/html/canvas/ArrayBufferView.idl b/Source/core/html/canvas/ArrayBufferView.idl
index 9626c46..0f0aba6 100644
--- a/Source/core/html/canvas/ArrayBufferView.idl
+++ b/Source/core/html/canvas/ArrayBufferView.idl
@@ -24,6 +24,7 @@
  */
 
 [
+    NoInterfaceObject,
     CustomToV8
 ] interface ArrayBufferView {
     readonly attribute ArrayBuffer buffer;
diff --git a/Source/core/html/canvas/CanvasGradient.idl b/Source/core/html/canvas/CanvasGradient.idl
index 0e07d5e..4d06b83 100644
--- a/Source/core/html/canvas/CanvasGradient.idl
+++ b/Source/core/html/canvas/CanvasGradient.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2013 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,8 +26,7 @@
 [
 ] interface CanvasGradient {
 
-    [RaisesException] void addColorStop([Default=Undefined] optional float offset, 
-                      [Default=Undefined] optional DOMString color);
+    [RaisesException] void addColorStop(float offset, DOMString color);
 
 };
 
diff --git a/Source/core/html/canvas/CanvasPathMethods.h b/Source/core/html/canvas/CanvasPathMethods.h
index 19fa93e..3259697 100644
--- a/Source/core/html/canvas/CanvasPathMethods.h
+++ b/Source/core/html/canvas/CanvasPathMethods.h
@@ -31,8 +31,6 @@
 
 #include "core/platform/graphics/Path.h"
 
-#include <wtf/Noncopyable.h>
-
 namespace WebCore {
 
 class FloatRect;
diff --git a/Source/core/html/canvas/CanvasRenderingContext.h b/Source/core/html/canvas/CanvasRenderingContext.h
index d8abb8e..f014a7f 100644
--- a/Source/core/html/canvas/CanvasRenderingContext.h
+++ b/Source/core/html/canvas/CanvasRenderingContext.h
@@ -28,10 +28,9 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/HTMLCanvasElement.h"
-#include "core/platform/graphics/GraphicsLayer.h"
-#include <wtf/HashSet.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/text/StringHash.h>
+#include "wtf/HashSet.h"
+#include "wtf/Noncopyable.h"
+#include "wtf/text/StringHash.h"
 
 namespace WebKit { class WebLayer; }
 
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.cpp b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
index 89ea17d..bbb61bb 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
@@ -34,8 +34,6 @@
 #include "core/html/canvas/CanvasRenderingContext2D.h"
 
 #include "CSSPropertyNames.h"
-#include "HTMLNames.h"
-#include "RuntimeEnabledFeatures.h"
 #include "core/css/CSSFontSelector.h"
 #include "core/css/CSSParser.h"
 #include "core/css/StylePropertySet.h"
@@ -54,33 +52,25 @@
 #include "core/html/canvas/CanvasStyle.h"
 #include "core/html/canvas/DOMPath.h"
 #include "core/loader/cache/CachedImage.h"
-#include "core/page/Console.h"
-#include "core/page/Page.h"
-#include "core/page/Settings.h"
-#include "core/platform/FloatConversion.h"
+#include "core/platform/graphics/DrawLooper.h"
 #include "core/platform/graphics/FloatQuad.h"
 #include "core/platform/graphics/FontCache.h"
 #include "core/platform/graphics/GraphicsContextStateSaver.h"
 #include "core/platform/graphics/TextRun.h"
 #include "core/platform/graphics/transforms/AffineTransform.h"
-#include "core/rendering/RenderHTMLCanvas.h"
 #include "core/rendering/RenderLayer.h"
-#include "weborigin/KURL.h"
 #include "weborigin/SecurityOrigin.h"
 
-#include <wtf/CheckedArithmetic.h>
-#include <wtf/MathExtras.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/StringBuilder.h>
-#include <wtf/Uint8ClampedArray.h>
-#include <wtf/UnusedParam.h>
+#include "wtf/CheckedArithmetic.h"
+#include "wtf/MathExtras.h"
+#include "wtf/OwnPtr.h"
+#include "wtf/Uint8ClampedArray.h"
+#include "wtf/text/StringBuilder.h"
 
 using namespace std;
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
 static const int defaultFontSize = 10;
 static const char* const defaultFontFamily = "sans-serif";
 static const char* const defaultFont = "10px sans-serif";
@@ -587,8 +577,6 @@
     BlendMode blendMode = BlendModeNormal;
     if (!parseCompositeAndBlendOperator(operation, op, blendMode))
         return;
-    if (!RuntimeEnabledFeatures::cssCompositingEnabled() && blendMode != BlendModeNormal)
-        blendMode = BlendModeNormal;
     if ((state().m_globalComposite == op) && (state().m_globalBlend == blendMode))
         return;
     realizeSaves();
@@ -1163,10 +1151,12 @@
     if (!c)
         return;
 
-    if (shouldDrawShadows())
-        c->setShadow(state().m_shadowOffset, state().m_shadowBlur, state().m_shadowColor);
-    else
+    if (shouldDrawShadows()) {
+        c->setShadow(state().m_shadowOffset, state().m_shadowBlur, state().m_shadowColor,
+            DrawLooper::ShadowIgnoresTransforms);
+    } else {
         c->clearShadow();
+    }
 }
 
 bool CanvasRenderingContext2D::shouldDrawShadows() const
@@ -2076,7 +2066,7 @@
 {
     FontCachePurgePreventer fontCachePurgePreventer;
     RefPtr<TextMetrics> metrics = TextMetrics::create();
-    metrics->setWidth(accessFont().width(TextRun(text.characters(), text.length())));
+    metrics->setWidth(accessFont().width(TextRun(text)));
     return metrics.release();
 }
 
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.h b/Source/core/html/canvas/CanvasRenderingContext2D.h
index c48e913..d4ff4af 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.h
@@ -30,7 +30,6 @@
 #include "core/html/canvas/CanvasPathMethods.h"
 #include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/platform/graphics/Color.h"
-#include "core/platform/graphics/DashArray.h"
 #include "core/platform/graphics/FloatSize.h"
 #include "core/platform/graphics/Font.h"
 #include "core/platform/graphics/GraphicsTypes.h"
diff --git a/Source/core/html/canvas/DataView.idl b/Source/core/html/canvas/DataView.idl
index 5ff575d..5847f9c 100644
--- a/Source/core/html/canvas/DataView.idl
+++ b/Source/core/html/canvas/DataView.idl
@@ -24,7 +24,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     CustomConstructor(ArrayBuffer buffer, optional unsigned long byteOffset, optional unsigned long byteLength),
     CustomToV8
 ] interface DataView : ArrayBufferView {
diff --git a/Source/core/html/canvas/Float32Array.idl b/Source/core/html/canvas/Float32Array.idl
index a9b9dac..7d5818d 100644
--- a/Source/core/html/canvas/Float32Array.idl
+++ b/Source/core/html/canvas/Float32Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Float64Array.idl b/Source/core/html/canvas/Float64Array.idl
index 28f9d6b..3215e80 100644
--- a/Source/core/html/canvas/Float64Array.idl
+++ b/Source/core/html/canvas/Float64Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Int16Array.idl b/Source/core/html/canvas/Int16Array.idl
index 42c8dac..63640db 100644
--- a/Source/core/html/canvas/Int16Array.idl
+++ b/Source/core/html/canvas/Int16Array.idl
@@ -24,7 +24,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Int32Array.idl b/Source/core/html/canvas/Int32Array.idl
index fb4b6d1..012e6a8 100644
--- a/Source/core/html/canvas/Int32Array.idl
+++ b/Source/core/html/canvas/Int32Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Int8Array.idl b/Source/core/html/canvas/Int8Array.idl
index 52434af..5c65ac1 100644
--- a/Source/core/html/canvas/Int8Array.idl
+++ b/Source/core/html/canvas/Int8Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/OESVertexArrayObject.h b/Source/core/html/canvas/OESVertexArrayObject.h
index 7ac7de4..fc49109 100644
--- a/Source/core/html/canvas/OESVertexArrayObject.h
+++ b/Source/core/html/canvas/OESVertexArrayObject.h
@@ -28,10 +28,8 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLExtension.h"
-#include "core/html/canvas/WebGLVertexArrayObjectOES.h"
 #include "core/platform/graphics/GraphicsTypes3D.h"
 #include "wtf/PassRefPtr.h"
-#include "wtf/UnusedParam.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/Uint16Array.idl b/Source/core/html/canvas/Uint16Array.idl
index 086ee28..96e95ee 100644
--- a/Source/core/html/canvas/Uint16Array.idl
+++ b/Source/core/html/canvas/Uint16Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Uint32Array.idl b/Source/core/html/canvas/Uint32Array.idl
index 3c69bfd..a964686 100644
--- a/Source/core/html/canvas/Uint32Array.idl
+++ b/Source/core/html/canvas/Uint32Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Uint8Array.idl b/Source/core/html/canvas/Uint8Array.idl
index b9c6a21..afa941c 100644
--- a/Source/core/html/canvas/Uint8Array.idl
+++ b/Source/core/html/canvas/Uint8Array.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/Uint8ClampedArray.idl b/Source/core/html/canvas/Uint8ClampedArray.idl
index 895505a..66c9289 100644
--- a/Source/core/html/canvas/Uint8ClampedArray.idl
+++ b/Source/core/html/canvas/Uint8ClampedArray.idl
@@ -25,7 +25,7 @@
  */
 
 [
-    GlobalContext=WindowAndWorker,
+    GlobalContext=Window&WorkerGlobalScope,
     ConstructorTemplate=TypedArray,
     CustomToV8,
     DoNotCheckConstants
diff --git a/Source/core/html/canvas/WebGLBuffer.cpp b/Source/core/html/canvas/WebGLBuffer.cpp
index aac8a47..1a949c5 100644
--- a/Source/core/html/canvas/WebGLBuffer.cpp
+++ b/Source/core/html/canvas/WebGLBuffer.cpp
@@ -28,7 +28,6 @@
 #include "core/html/canvas/WebGLBuffer.h"
 
 #include "core/html/canvas/WebGLRenderingContext.h"
-#include <wtf/ArrayBufferView.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLBuffer.h b/Source/core/html/canvas/WebGLBuffer.h
index 4c7a470..5a7fa22 100644
--- a/Source/core/html/canvas/WebGLBuffer.h
+++ b/Source/core/html/canvas/WebGLBuffer.h
@@ -28,10 +28,8 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLSharedObject.h"
-#include "wtf/ArrayBuffer.h"
 #include "wtf/Forward.h"
 #include "wtf/PassRefPtr.h"
-#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLCompressedTextureATC.h b/Source/core/html/canvas/WebGLCompressedTextureATC.h
index 6cf6541..4984696 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureATC.h
+++ b/Source/core/html/canvas/WebGLCompressedTextureATC.h
@@ -27,7 +27,6 @@
 #define WebGLCompressedTextureATC_h
 
 #include "bindings/v8/ScriptWrappable.h"
-#include "core/dom/ExceptionCode.h"
 #include "core/html/canvas/WebGLExtension.h"
 #include "wtf/PassRefPtr.h"
 
diff --git a/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp b/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp
index 287127e..46689f5 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp
+++ b/Source/core/html/canvas/WebGLCompressedTextureS3TC.cpp
@@ -30,9 +30,6 @@
 #include "core/html/canvas/WebGLRenderingContext.h"
 #include "core/platform/graphics/Extensions3D.h"
 
-#include <wtf/Int32Array.h>
-#include <wtf/OwnArrayPtr.h>
-
 namespace WebCore {
 
 WebGLCompressedTextureS3TC::WebGLCompressedTextureS3TC(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/WebGLCompressedTextureS3TC.h b/Source/core/html/canvas/WebGLCompressedTextureS3TC.h
index b8816be..5b8c1d0 100644
--- a/Source/core/html/canvas/WebGLCompressedTextureS3TC.h
+++ b/Source/core/html/canvas/WebGLCompressedTextureS3TC.h
@@ -27,7 +27,6 @@
 #define WebGLCompressedTextureS3TC_h
 
 #include "bindings/v8/ScriptWrappable.h"
-#include "core/dom/ExceptionCode.h"
 #include "core/html/canvas/WebGLExtension.h"
 #include "wtf/PassRefPtr.h"
 
diff --git a/Source/core/html/canvas/WebGLContextGroup.cpp b/Source/core/html/canvas/WebGLContextGroup.cpp
index 0620470..46650a6 100644
--- a/Source/core/html/canvas/WebGLContextGroup.cpp
+++ b/Source/core/html/canvas/WebGLContextGroup.cpp
@@ -88,10 +88,12 @@
 
 void WebGLContextGroup::loseContextGroup(WebGLRenderingContext::LostContextMode mode)
 {
+    // Detach must happen before loseContextImpl, which destroys the GraphicsContext3D
+    // and prevents groupObjects from being properly deleted.
+    detachAndRemoveAllObjects();
+
     for (HashSet<WebGLRenderingContext*>::iterator it = m_contexts.begin(); it != m_contexts.end(); ++it)
         (*it)->loseContextImpl(mode);
-
-    detachAndRemoveAllObjects();
 }
 
 } // namespace WebCore
diff --git a/Source/core/html/canvas/WebGLContextObject.h b/Source/core/html/canvas/WebGLContextObject.h
index b894008..1e4d296 100644
--- a/Source/core/html/canvas/WebGLContextObject.h
+++ b/Source/core/html/canvas/WebGLContextObject.h
@@ -27,7 +27,6 @@
 #define WebGLContextObject_h
 
 #include "core/html/canvas/WebGLObject.h"
-#include "core/platform/graphics/GraphicsContext3D.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLDebugShaders.cpp b/Source/core/html/canvas/WebGLDebugShaders.cpp
index ea33aa2..2448230 100644
--- a/Source/core/html/canvas/WebGLDebugShaders.cpp
+++ b/Source/core/html/canvas/WebGLDebugShaders.cpp
@@ -31,8 +31,6 @@
 #include "core/html/canvas/WebGLShader.h"
 #include "core/platform/graphics/Extensions3D.h"
 
-#include <wtf/OwnArrayPtr.h>
-
 namespace WebCore {
 
 WebGLDebugShaders::WebGLDebugShaders(WebGLRenderingContext* context)
diff --git a/Source/core/html/canvas/WebGLObject.h b/Source/core/html/canvas/WebGLObject.h
index a3a9f86..fdadfe2 100644
--- a/Source/core/html/canvas/WebGLObject.h
+++ b/Source/core/html/canvas/WebGLObject.h
@@ -28,8 +28,7 @@
 
 #include "core/platform/graphics/GraphicsContext3D.h"
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLProgram.cpp b/Source/core/html/canvas/WebGLProgram.cpp
index 5581744..4f2f23b 100644
--- a/Source/core/html/canvas/WebGLProgram.cpp
+++ b/Source/core/html/canvas/WebGLProgram.cpp
@@ -168,7 +168,7 @@
     for (int i = 0; i < numAttribs; ++i) {
         ActiveInfo info;
         context3d->getActiveAttrib(object(), i, info);
-        m_activeAttribLocations[i] = context3d->getAttribLocation(object(), info.name.charactersWithNullTermination());
+        m_activeAttribLocations[i] = context3d->getAttribLocation(object(), info.name);
     }
 }
 
diff --git a/Source/core/html/canvas/WebGLProgram.h b/Source/core/html/canvas/WebGLProgram.h
index 7356cac..63a976c 100644
--- a/Source/core/html/canvas/WebGLProgram.h
+++ b/Source/core/html/canvas/WebGLProgram.h
@@ -30,7 +30,6 @@
 #include "core/html/canvas/WebGLSharedObject.h"
 #include "core/html/canvas/WebGLShader.h"
 #include "wtf/PassRefPtr.h"
-#include "wtf/RefCounted.h"
 #include "wtf/Vector.h"
 
 namespace WebCore {
diff --git a/Source/core/html/canvas/WebGLRenderbuffer.h b/Source/core/html/canvas/WebGLRenderbuffer.h
index b353004..93bcc17 100644
--- a/Source/core/html/canvas/WebGLRenderbuffer.h
+++ b/Source/core/html/canvas/WebGLRenderbuffer.h
@@ -29,7 +29,6 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLSharedObject.h"
 #include "wtf/PassRefPtr.h"
-#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLRenderingContext.cpp b/Source/core/html/canvas/WebGLRenderingContext.cpp
index f6071a6..1faa49d 100644
--- a/Source/core/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/core/html/canvas/WebGLRenderingContext.cpp
@@ -77,11 +77,10 @@
 #include "core/platform/graphics/gpu/DrawingBuffer.h"
 #include "core/rendering/RenderBox.h"
 
-#include <wtf/OwnArrayPtr.h>
-#include <wtf/PassOwnArrayPtr.h>
-#include <wtf/text/StringBuilder.h>
-#include <wtf/Uint16Array.h>
-#include <wtf/Uint32Array.h>
+#include "wtf/OwnArrayPtr.h"
+#include "wtf/PassOwnArrayPtr.h"
+#include "wtf/Uint32Array.h"
+#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
@@ -743,9 +742,12 @@
     for (size_t i = 0; i < m_extensions.size(); ++i)
         delete m_extensions[i];
 
-    destroyGraphicsContext3D();
+    // Context must be removed from the group prior to the destruction of the
+    // GraphicsContext3D, otherwise shared objects may not be properly deleted.
     m_contextGroup->removeContext(this);
 
+    destroyGraphicsContext3D();
+
     if (m_multisamplingObserverRegistered) {
         Page* page = canvas()->document()->page();
         if (page)
@@ -1658,8 +1660,11 @@
     if (!deleteObject(texture))
         return;
     for (size_t i = 0; i < m_textureUnits.size(); ++i) {
-        if (texture == m_textureUnits[i].m_texture2DBinding)
+        if (texture == m_textureUnits[i].m_texture2DBinding) {
             m_textureUnits[i].m_texture2DBinding = 0;
+            if (!i)
+                m_drawingBuffer->setTexture2DBinding(0);
+        }
         if (texture == m_textureUnits[i].m_textureCubeMapBinding)
             m_textureUnits[i].m_textureCubeMapBinding = 0;
     }
diff --git a/Source/core/html/canvas/WebGLRenderingContext.h b/Source/core/html/canvas/WebGLRenderingContext.h
index 358b94b..e260a29 100644
--- a/Source/core/html/canvas/WebGLRenderingContext.h
+++ b/Source/core/html/canvas/WebGLRenderingContext.h
@@ -34,11 +34,10 @@
 #include "core/platform/graphics/GraphicsContext3D.h"
 #include "core/platform/graphics/ImageBuffer.h"
 
-#include <wtf/Float32Array.h>
-#include <wtf/Int32Array.h>
-#include <wtf/OwnArrayPtr.h>
-#include <wtf/text/WTFString.h>
-#include <wtf/Uint8Array.h>
+#include "wtf/Float32Array.h"
+#include "wtf/Int32Array.h"
+#include "wtf/OwnArrayPtr.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebKit { class WebLayer; }
 
diff --git a/Source/core/html/canvas/WebGLShader.h b/Source/core/html/canvas/WebGLShader.h
index fbeaac7..65f540a 100644
--- a/Source/core/html/canvas/WebGLShader.h
+++ b/Source/core/html/canvas/WebGLShader.h
@@ -29,7 +29,6 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLSharedObject.h"
 #include "wtf/PassRefPtr.h"
-#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLTexture.h b/Source/core/html/canvas/WebGLTexture.h
index 9b79082..5dd35c5 100644
--- a/Source/core/html/canvas/WebGLTexture.h
+++ b/Source/core/html/canvas/WebGLTexture.h
@@ -28,9 +28,8 @@
 
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLSharedObject.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
+#include "wtf/PassRefPtr.h"
+#include "wtf/Vector.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/canvas/WebGLUniformLocation.h b/Source/core/html/canvas/WebGLUniformLocation.h
index 142a73b..d61aec7 100644
--- a/Source/core/html/canvas/WebGLUniformLocation.h
+++ b/Source/core/html/canvas/WebGLUniformLocation.h
@@ -28,7 +28,6 @@
 #define WebGLUniformLocation_h
 
 #include "bindings/v8/ScriptWrappable.h"
-#include "core/html/canvas/WebGLObject.h"
 #include "core/html/canvas/WebGLProgram.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
diff --git a/Source/core/html/canvas/WebGLVertexArrayObjectOES.h b/Source/core/html/canvas/WebGLVertexArrayObjectOES.h
index 9bbc585..f1cdda2 100644
--- a/Source/core/html/canvas/WebGLVertexArrayObjectOES.h
+++ b/Source/core/html/canvas/WebGLVertexArrayObjectOES.h
@@ -29,8 +29,7 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/html/canvas/WebGLBuffer.h"
 #include "core/html/canvas/WebGLContextObject.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/ime/InputMethodContext.cpp b/Source/core/html/ime/InputMethodContext.cpp
index 6723fbb..537fa03 100644
--- a/Source/core/html/ime/InputMethodContext.cpp
+++ b/Source/core/html/ime/InputMethodContext.cpp
@@ -31,7 +31,11 @@
 #include "config.h"
 #include "core/html/ime/InputMethodContext.h"
 
+#include "core/editing/Editor.h"
 #include "core/html/ime/Composition.h"
+#include "core/page/EditorClient.h"
+#include "core/page/Frame.h"
+#include "core/page/Page.h"
 
 namespace WebCore {
 
@@ -80,7 +84,30 @@
 
 void InputMethodContext::confirmComposition()
 {
-    // FIXME: Implement this.
+    Frame* frame = m_element->document()->frame();
+    if (!frame)
+        return;
+    Editor* editor = frame->editor();
+    if (!editor->hasComposition())
+        return;
+
+    const Node* node = frame->document()->focusedNode();
+    if (!node || !node->isHTMLElement() || m_element != toHTMLElement(node))
+        return;
+
+    // We should verify the parent node of this IME composition node are
+    // editable because JavaScript may delete a parent node of the composition
+    // node. In this case, WebKit crashes while deleting texts from the parent
+    // node, which doesn't exist any longer.
+    RefPtr<Range> range = editor->compositionRange();
+    if (range) {
+        Node* node = range->startContainer();
+        if (!node || !node->isContentEditable())
+            return;
+    }
+
+    // This resets input method and the composition string is committed.
+    editor->client()->willSetInputMethodState();
 }
 
 void InputMethodContext::setCaretRectangle(Node* anchor, int x, int y, int w, int h)
diff --git a/Source/core/html/parser/BackgroundHTMLParser.cpp b/Source/core/html/parser/BackgroundHTMLParser.cpp
index 942725a..23747ed 100644
--- a/Source/core/html/parser/BackgroundHTMLParser.cpp
+++ b/Source/core/html/parser/BackgroundHTMLParser.cpp
@@ -27,12 +27,11 @@
 #include "core/html/parser/BackgroundHTMLParser.h"
 
 #include "core/html/parser/HTMLDocumentParser.h"
-#include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLParserThread.h"
 #include "core/html/parser/HTMLTokenizer.h"
 #include "core/html/parser/XSSAuditor.h"
-#include <wtf/MainThread.h>
-#include <wtf/text/TextPosition.h>
+#include "wtf/MainThread.h"
+#include "wtf/text/TextPosition.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/BackgroundHTMLParser.h b/Source/core/html/parser/BackgroundHTMLParser.h
index 14a0df5..b9b5a51 100644
--- a/Source/core/html/parser/BackgroundHTMLParser.h
+++ b/Source/core/html/parser/BackgroundHTMLParser.h
@@ -35,10 +35,8 @@
 #include "core/html/parser/HTMLTokenizer.h"
 #include "core/html/parser/HTMLTreeBuilderSimulator.h"
 #include "core/html/parser/XSSAuditorDelegate.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
-#include <wtf/WeakPtr.h>
+#include "wtf/PassOwnPtr.h"
+#include "wtf/WeakPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/CSSPreloadScanner.cpp b/Source/core/html/parser/CSSPreloadScanner.cpp
index ff31acf..c2711e8 100644
--- a/Source/core/html/parser/CSSPreloadScanner.cpp
+++ b/Source/core/html/parser/CSSPreloadScanner.cpp
@@ -30,7 +30,6 @@
 
 #include "core/html/parser/HTMLIdentifier.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/loader/cache/CachedResourceRequestInitiators.h"
 #include "core/platform/text/SegmentedString.h"
 
 namespace WebCore {
diff --git a/Source/core/html/parser/HTMLConstructionSite.cpp b/Source/core/html/parser/HTMLConstructionSite.cpp
index 96d3025..e6566a3 100644
--- a/Source/core/html/parser/HTMLConstructionSite.cpp
+++ b/Source/core/html/parser/HTMLConstructionSite.cpp
@@ -34,24 +34,18 @@
 #include "core/dom/DocumentType.h"
 #include "core/dom/Element.h"
 #include "core/dom/Text.h"
-#include "core/html/HTMLDocument.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLHtmlElement.h"
-#include "core/html/HTMLPlugInElement.h"
 #include "core/html/HTMLScriptElement.h"
 #include "core/html/HTMLTemplateElement.h"
 #include "core/html/parser/AtomicHTMLToken.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLStackItem.h"
 #include "core/html/parser/HTMLToken.h"
-#include "core/html/parser/HTMLTokenizer.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/Frame.h"
-#include "core/page/Settings.h"
-#include "core/platform/LocalizedStrings.h"
 #include "core/platform/NotImplemented.h"
-#include "wtf/UnusedParam.h"
 #include <limits>
 
 namespace WebCore {
@@ -645,10 +639,14 @@
 PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken* token)
 {
     QualifiedName tagName(nullAtom, token->name(), xhtmlNamespaceURI);
+    Document* document = ownerDocumentForCurrentNode();
+    // Only associate the element with the current form if we're creating the new element
+    // in a document with a browsing context (rather than in <template> contents).
+    HTMLFormElement* form = document->frame() ? m_form.get() : 0;
     // FIXME: This can't use HTMLConstructionSite::createElement because we
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
-    RefPtr<Element> element = HTMLElementFactory::createHTMLElement(tagName, ownerDocumentForCurrentNode(), form(), true);
+    RefPtr<Element> element = HTMLElementFactory::createHTMLElement(tagName, document, form, true);
     setAttributes(element.get(), token, m_parserContentPolicy);
     ASSERT(element->isHTMLElement());
     return element.release();
diff --git a/Source/core/html/parser/HTMLConstructionSite.h b/Source/core/html/parser/HTMLConstructionSite.h
index fb2e5e7..d24d489 100644
--- a/Source/core/html/parser/HTMLConstructionSite.h
+++ b/Source/core/html/parser/HTMLConstructionSite.h
@@ -27,14 +27,13 @@
 #ifndef HTMLConstructionSite_h
 #define HTMLConstructionSite_h
 
-#include "core/dom/FragmentScriptingPermission.h"
+#include "core/dom/ParserContentPolicy.h"
 #include "core/html/parser/HTMLElementStack.h"
 #include "core/html/parser/HTMLFormattingElementList.h"
-#include "core/platform/NotImplemented.h"
-#include <wtf/Noncopyable.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
+#include "wtf/Noncopyable.h"
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefPtr.h"
+#include "wtf/Vector.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLDocumentParser.cpp b/Source/core/html/parser/HTMLDocumentParser.cpp
index 6961e26..e47d69c 100644
--- a/Source/core/html/parser/HTMLDocumentParser.cpp
+++ b/Source/core/html/parser/HTMLDocumentParser.cpp
@@ -29,7 +29,6 @@
 #include "HTMLNames.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/Element.h"
-#include "core/html/HTMLDocument.h"
 #include "core/html/parser/AtomicHTMLToken.h"
 #include "core/html/parser/BackgroundHTMLParser.h"
 #include "core/html/parser/CompactHTMLToken.h"
@@ -42,7 +41,7 @@
 #include "core/html/parser/HTMLTreeBuilder.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/page/Frame.h"
-#include <wtf/Functional.h>
+#include "wtf/Functional.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLDocumentParser.h b/Source/core/html/parser/HTMLDocumentParser.h
index f32a3bb..a6c2349 100644
--- a/Source/core/html/parser/HTMLDocumentParser.h
+++ b/Source/core/html/parser/HTMLDocumentParser.h
@@ -26,7 +26,7 @@
 #ifndef HTMLDocumentParser_h
 #define HTMLDocumentParser_h
 
-#include "core/dom/FragmentScriptingPermission.h"
+#include "core/dom/ParserContentPolicy.h"
 #include "core/dom/ScriptableDocumentParser.h"
 #include "core/html/parser/BackgroundHTMLInputStream.h"
 #include "core/html/parser/CompactHTMLToken.h"
@@ -41,12 +41,11 @@
 #include "core/html/parser/XSSAuditor.h"
 #include "core/html/parser/XSSAuditorDelegate.h"
 #include "core/loader/cache/CachedResourceClient.h"
-#include "core/platform/Timer.h"
 #include "core/platform/text/SegmentedString.h"
-#include <wtf/Deque.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/TextPosition.h>
-#include <wtf/WeakPtr.h>
+#include "wtf/Deque.h"
+#include "wtf/OwnPtr.h"
+#include "wtf/WeakPtr.h"
+#include "wtf/text/TextPosition.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLElementStack.h b/Source/core/html/parser/HTMLElementStack.h
index 1a90a46..d9ad04c 100644
--- a/Source/core/html/parser/HTMLElementStack.h
+++ b/Source/core/html/parser/HTMLElementStack.h
@@ -27,13 +27,12 @@
 #ifndef HTMLElementStack_h
 #define HTMLElementStack_h
 
-#include "HTMLNames.h"
 #include "core/html/parser/HTMLStackItem.h"
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/RefPtr.h>
+#include "wtf/Forward.h"
+#include "wtf/Noncopyable.h"
+#include "wtf/OwnPtr.h"
+#include "wtf/PassOwnPtr.h"
+#include "wtf/RefPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLIdentifier.cpp b/Source/core/html/parser/HTMLIdentifier.cpp
index 41b8ee7..8c5fa52 100644
--- a/Source/core/html/parser/HTMLIdentifier.cpp
+++ b/Source/core/html/parser/HTMLIdentifier.cpp
@@ -100,7 +100,7 @@
         IdentifierTable::AddResult addResult = table.add(hash, name);
         maxNameLength = std::max(maxNameLength, name->length());
         // Ensure we're using the same hashing algorithm to get and set.
-        ASSERT_UNUSED(addResult, !addResult.isNewEntry || HTMLIdentifier::findIfKnown(name->characters(), name->length()) == name);
+        ASSERT_UNUSED(addResult, !addResult.isNewEntry || HTMLIdentifier::findIfKnown(name->bloatedCharacters(), name->length()) == name);
         // We expect some hash collisions, but only for identical strings.
         // Since all of these names are AtomicStrings pointers should be equal.
         // Note: If you hit this ASSERT, then we had a hash collision among
diff --git a/Source/core/html/parser/HTMLParserIdioms.cpp b/Source/core/html/parser/HTMLParserIdioms.cpp
index 5ef401b..6baada9 100644
--- a/Source/core/html/parser/HTMLParserIdioms.cpp
+++ b/Source/core/html/parser/HTMLParserIdioms.cpp
@@ -29,10 +29,9 @@
 #include "core/dom/QualifiedName.h"
 #include "core/html/parser/HTMLIdentifier.h"
 #include "core/platform/Decimal.h"
-#include <wtf/MathExtras.h>
-#include <wtf/text/AtomicString.h>
-#include <wtf/text/StringBuilder.h>
-#include <wtf/text/StringHash.h>
+#include "wtf/MathExtras.h"
+#include "wtf/text/AtomicString.h"
+#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
@@ -73,7 +72,7 @@
     if (string.is8Bit())
         return stripLeadingAndTrailingHTMLSpaces(string, string.characters8(), length);
 
-    return stripLeadingAndTrailingHTMLSpaces(string, string.characters(), length);
+    return stripLeadingAndTrailingHTMLSpaces(string, string.characters16(), length);
 }
 
 String serializeForNumberType(const Decimal& number)
@@ -208,12 +207,12 @@
     // Step 1
     // Step 2
     unsigned length = input.length();
-    if (length && input.is8Bit()) {
+    if (!length || input.is8Bit()) {
         const LChar* start = input.characters8();
         return parseHTMLIntegerInternal(start, start + length, value);
     }
 
-    const UChar* start = input.characters();
+    const UChar* start = input.characters16();
     return parseHTMLIntegerInternal(start, start + length, value);
 }
 
@@ -274,7 +273,7 @@
         return parseHTMLNonNegativeIntegerInternal(start, start + length, value);
     }
     
-    const UChar* start = input.characters();
+    const UChar* start = input.characters16();
     return parseHTMLNonNegativeIntegerInternal(start, start + length, value);
 }
 
diff --git a/Source/core/html/parser/HTMLParserIdioms.h b/Source/core/html/parser/HTMLParserIdioms.h
index 3c6903e..70db795 100644
--- a/Source/core/html/parser/HTMLParserIdioms.h
+++ b/Source/core/html/parser/HTMLParserIdioms.h
@@ -27,9 +27,8 @@
 
 #include "core/dom/QualifiedName.h"
 #include "core/html/parser/HTMLIdentifier.h"
-#include <wtf/Forward.h>
-#include <wtf/text/WTFString.h>
-#include <wtf/unicode/Unicode.h>
+#include "wtf/Forward.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLParserScheduler.cpp b/Source/core/html/parser/HTMLParserScheduler.cpp
index 19baf9c..1dbd927 100644
--- a/Source/core/html/parser/HTMLParserScheduler.cpp
+++ b/Source/core/html/parser/HTMLParserScheduler.cpp
@@ -39,8 +39,7 @@
 
 // parserTimeLimit is the seconds the parser will run in one write() call
 // before yielding. Inline <script> execution can cause it to exceed the limit.
-// FIXME: We would like this value to be 0.2.
-const double HTMLParserScheduler::parserTimeLimit = 0.500;
+const double HTMLParserScheduler::parserTimeLimit = 0.2;
 
 ActiveParserSession::ActiveParserSession(Document* document)
     : m_document(document)
diff --git a/Source/core/html/parser/HTMLParserScheduler.h b/Source/core/html/parser/HTMLParserScheduler.h
index 722c284..01624b7 100644
--- a/Source/core/html/parser/HTMLParserScheduler.h
+++ b/Source/core/html/parser/HTMLParserScheduler.h
@@ -26,12 +26,11 @@
 #ifndef HTMLParserScheduler_h
 #define HTMLParserScheduler_h
 
-#include <limits.h>
 #include "core/html/parser/NestingLevelIncrementer.h"
 #include "core/platform/Timer.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/RefPtr.h>
+#include "wtf/CurrentTime.h"
+#include "wtf/PassOwnPtr.h"
+#include "wtf/RefPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLPreloadScanner.cpp b/Source/core/html/parser/HTMLPreloadScanner.cpp
index 1b19991..c48575a 100644
--- a/Source/core/html/parser/HTMLPreloadScanner.cpp
+++ b/Source/core/html/parser/HTMLPreloadScanner.cpp
@@ -33,8 +33,7 @@
 #include "core/html/LinkRelAttribute.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLTokenizer.h"
-#include <wtf/Functional.h>
-#include <wtf/MainThread.h>
+#include "wtf/MainThread.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLScriptRunner.cpp b/Source/core/html/parser/HTMLScriptRunner.cpp
index d5ca07c..0429e96 100644
--- a/Source/core/html/parser/HTMLScriptRunner.cpp
+++ b/Source/core/html/parser/HTMLScriptRunner.cpp
@@ -27,11 +27,10 @@
 #include "core/html/parser/HTMLScriptRunner.h"
 
 #include "bindings/v8/ScriptSourceCode.h"
-#include "core/dom/CustomElementRegistry.h"
 #include "core/dom/Element.h"
 #include "core/dom/Event.h"
 #include "core/dom/IgnoreDestructiveWriteCountIncrementer.h"
-#include "core/dom/MutationObserver.h"
+#include "core/dom/Microtask.h"
 #include "core/dom/ScriptElement.h"
 #include "core/html/parser/HTMLInputStream.h"
 #include "core/html/parser/HTMLScriptRunnerHost.h"
@@ -126,10 +125,8 @@
     if (pendingScript.cachedScript() && pendingScript.watchingForLoad())
         stopWatchingForLoad(pendingScript);
 
-    if (!isExecutingScript()) {
-        CustomElementRegistry::deliverAllLifecycleCallbacks();
-        MutationObserver::deliverAllMutations();
-    }
+    if (!isExecutingScript())
+        Microtask::performCheckpoint();
 
     // Clear the pending script before possible rentrancy from executeScript()
     RefPtr<Element> element = pendingScript.releaseElementAndClear();
@@ -292,10 +289,8 @@
         // every script element, even if it's not ready to execute yet. There's
         // unfortuantely no obvious way to tell if prepareScript is going to
         // execute the script from out here.
-        if (!isExecutingScript()) {
-            CustomElementRegistry::deliverAllLifecycleCallbacks();
-            MutationObserver::deliverAllMutations();
-        }
+        if (!isExecutingScript())
+            Microtask::performCheckpoint();
 
         InsertionPointRecord insertionPointRecord(m_host->inputStream());
         NestingLevelIncrementer nestingLevelIncrementer(m_scriptNestingLevel);
diff --git a/Source/core/html/parser/HTMLSourceTracker.h b/Source/core/html/parser/HTMLSourceTracker.h
index 79b4aca..63fec2b 100644
--- a/Source/core/html/parser/HTMLSourceTracker.h
+++ b/Source/core/html/parser/HTMLSourceTracker.h
@@ -28,7 +28,6 @@
 
 #include "core/html/parser/HTMLToken.h"
 #include "core/platform/text/SegmentedString.h"
-#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLTokenizer.cpp b/Source/core/html/parser/HTMLTokenizer.cpp
index 5775af9..cc75625 100644
--- a/Source/core/html/parser/HTMLTokenizer.cpp
+++ b/Source/core/html/parser/HTMLTokenizer.cpp
@@ -34,12 +34,9 @@
 #include "core/html/parser/HTMLTreeBuilder.h"
 #include "core/platform/NotImplemented.h"
 #include "core/xml/parser/MarkupTokenizerInlines.h"
-#include <wtf/ASCIICType.h>
-#include <wtf/CurrentTime.h>
-#include <wtf/text/AtomicString.h>
-#include <wtf/text/CString.h>
-#include <wtf/unicode/Unicode.h>
-#include <wtf/UnusedParam.h>
+#include "wtf/ASCIICType.h"
+#include "wtf/text/AtomicString.h"
+#include "wtf/unicode/Unicode.h"
 
 using namespace WTF;
 
diff --git a/Source/core/html/parser/HTMLTreeBuilder.cpp b/Source/core/html/parser/HTMLTreeBuilder.cpp
index 764afdc..2f3e37e 100644
--- a/Source/core/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/core/html/parser/HTMLTreeBuilder.cpp
@@ -34,7 +34,6 @@
 #include "XMLNSNames.h"
 #include "XMLNames.h"
 #include "core/dom/DocumentFragment.h"
-#include "core/html/HTMLDocument.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/parser/AtomicHTMLToken.h"
 #include "core/html/parser/HTMLDocumentParser.h"
@@ -44,8 +43,8 @@
 #include "core/html/parser/HTMLTokenizer.h"
 #include "core/platform/LocalizedStrings.h"
 #include "core/platform/NotImplemented.h"
-#include <wtf/MainThread.h>
-#include <wtf/unicode/CharacterNames.h>
+#include "wtf/MainThread.h"
+#include "wtf/unicode/CharacterNames.h"
 
 namespace WebCore {
 
@@ -137,7 +136,7 @@
     ASSERT(isMainThread());
     while (element) {
         if (element->hasTagName(formTag))
-            return static_cast<HTMLFormElement*>(element);
+            return toHTMLFormElement(element);
         ContainerNode* parent = element->parentNode();
         if (!parent || !parent->isElementNode())
             return 0;
diff --git a/Source/core/html/parser/HTMLTreeBuilder.h b/Source/core/html/parser/HTMLTreeBuilder.h
index d5fdd86..ae4fbc5 100644
--- a/Source/core/html/parser/HTMLTreeBuilder.h
+++ b/Source/core/html/parser/HTMLTreeBuilder.h
@@ -30,14 +30,13 @@
 #include "core/html/parser/HTMLConstructionSite.h"
 #include "core/html/parser/HTMLElementStack.h"
 #include "core/html/parser/HTMLParserOptions.h"
-#include <wtf/Noncopyable.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/text/StringBuilder.h>
-#include <wtf/text/TextPosition.h>
-#include <wtf/unicode/Unicode.h>
-#include <wtf/Vector.h>
+#include "wtf/Noncopyable.h"
+#include "wtf/PassOwnPtr.h"
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefPtr.h"
+#include "wtf/Vector.h"
+#include "wtf/text/StringBuilder.h"
+#include "wtf/text/TextPosition.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/HTMLTreeBuilderSimulator.h b/Source/core/html/parser/HTMLTreeBuilderSimulator.h
index 4b73eb5..a09eb99 100644
--- a/Source/core/html/parser/HTMLTreeBuilderSimulator.h
+++ b/Source/core/html/parser/HTMLTreeBuilderSimulator.h
@@ -27,8 +27,7 @@
 #define HTMLTreeBuilderSimulator_h
 
 #include "core/html/parser/HTMLParserOptions.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
+#include "wtf/Vector.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp
index ec7983c..a92133c 100644
--- a/Source/core/html/parser/XSSAuditor.cpp
+++ b/Source/core/html/parser/XSSAuditor.cpp
@@ -31,30 +31,20 @@
 #include "SVGNames.h"
 #include "XLinkNames.h"
 #include "core/dom/Document.h"
-#include "core/html/FormDataList.h"
 #include "core/html/HTMLParamElement.h"
 #include "core/html/parser/HTMLDocumentParser.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/html/parser/HTMLTokenizer.h"
 #include "core/html/parser/XSSAuditorDelegate.h"
-#include "core/inspector/InspectorInstrumentation.h"
-#include "core/inspector/InspectorValues.h"
 #include "core/loader/DocumentLoader.h"
-#include "core/loader/FrameLoaderClient.h"
-#include "core/loader/PingLoader.h"
 #include "core/loader/TextResourceDecoder.h"
-#include "core/page/Console.h"
 #include "core/page/ContentSecurityPolicy.h"
-#include "core/page/DOMWindow.h"
 #include "core/page/Frame.h"
 #include "core/page/Settings.h"
+#include "core/platform/JSONValues.h"
 #include "core/platform/network/FormData.h"
 #include "core/platform/text/DecodeEscapeSequences.h"
 #include "weborigin/KURL.h"
-#include "weborigin/SecurityOrigin.h"
-#include "wtf/Functional.h"
 #include "wtf/MainThread.h"
-#include "wtf/text/CString.h"
 #include "wtf/text/TextEncoding.h"
 
 namespace WebCore {
diff --git a/Source/core/html/parser/XSSAuditorDelegate.cpp b/Source/core/html/parser/XSSAuditorDelegate.cpp
index a9e7b25..bc435c5 100644
--- a/Source/core/html/parser/XSSAuditorDelegate.cpp
+++ b/Source/core/html/parser/XSSAuditorDelegate.cpp
@@ -26,16 +26,16 @@
 #include "config.h"
 #include "core/html/parser/XSSAuditorDelegate.h"
 
-#include <wtf/text/StringBuilder.h>
 #include "core/dom/Document.h"
-#include "core/inspector/InspectorValues.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/loader/PingLoader.h"
 #include "core/page/Frame.h"
+#include "core/platform/JSONValues.h"
 #include "core/platform/network/FormData.h"
 #include "weborigin/SecurityOrigin.h"
+#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
@@ -79,11 +79,11 @@
             httpBody = formData->flattenToString();
     }
 
-    RefPtr<InspectorObject> reportDetails = InspectorObject::create();
+    RefPtr<JSONObject> reportDetails = JSONObject::create();
     reportDetails->setString("request-url", m_document->url().string());
     reportDetails->setString("request-body", httpBody);
 
-    RefPtr<InspectorObject> reportObject = InspectorObject::create();
+    RefPtr<JSONObject> reportObject = JSONObject::create();
     reportObject->setObject("xss-report", reportDetails.release());
 
     return FormData::create(reportObject->toJSONString().utf8().data());
diff --git a/Source/core/html/parser/XSSAuditorDelegate.h b/Source/core/html/parser/XSSAuditorDelegate.h
index 1ee8dd5..896ef26 100644
--- a/Source/core/html/parser/XSSAuditorDelegate.h
+++ b/Source/core/html/parser/XSSAuditorDelegate.h
@@ -31,7 +31,6 @@
 #include "wtf/PassOwnPtr.h"
 #include "wtf/Vector.h"
 #include "wtf/text/TextPosition.h"
-#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/ClearButtonElement.cpp b/Source/core/html/shadow/ClearButtonElement.cpp
index 58acf52..3ac4628 100644
--- a/Source/core/html/shadow/ClearButtonElement.cpp
+++ b/Source/core/html/shadow/ClearButtonElement.cpp
@@ -85,7 +85,7 @@
         return;
     }
 
-    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         if (renderer() && renderer()->visibleToHitTesting()) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(this);
@@ -95,7 +95,7 @@
         m_clearButtonOwner->focusAndSelectClearButtonOwner();
         event->setDefaultHandled();
     }
-    if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         if (m_capturing) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(0);
diff --git a/Source/core/html/shadow/DateTimeEditElement.cpp b/Source/core/html/shadow/DateTimeEditElement.cpp
index 07b774d..6194d2c 100644
--- a/Source/core/html/shadow/DateTimeEditElement.cpp
+++ b/Source/core/html/shadow/DateTimeEditElement.cpp
@@ -28,22 +28,18 @@
 #include "core/html/shadow/DateTimeEditElement.h"
 
 #include "HTMLNames.h"
-#include "core/dom/KeyboardEvent.h"
 #include "core/dom/MouseEvent.h"
 #include "core/dom/Text.h"
 #include "core/html/DateTimeFieldsState.h"
 #include "core/html/shadow/DateTimeFieldElements.h"
-#include "core/html/shadow/DateTimeSymbolicFieldElement.h"
 #include "core/html/shadow/ShadowElementNames.h"
-#include "core/page/EventHandler.h"
 #include "core/platform/DateComponents.h"
 #include "core/platform/graphics/FontCache.h"
 #include "core/platform/text/DateTimeFormat.h"
 #include "core/platform/text/PlatformLocale.h"
 #include "core/rendering/style/RenderStyle.h"
 #include "core/rendering/style/StyleInheritedData.h"
-#include <wtf/DateMath.h>
-#include <wtf/text/StringBuilder.h>
+#include "wtf/DateMath.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/DateTimeFieldElement.cpp b/Source/core/html/shadow/DateTimeFieldElement.cpp
index db8f421..a53010a 100644
--- a/Source/core/html/shadow/DateTimeFieldElement.cpp
+++ b/Source/core/html/shadow/DateTimeFieldElement.cpp
@@ -57,7 +57,7 @@
         didFocus();
 
     if (event->isKeyboardEvent()) {
-        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        KeyboardEvent* keyboardEvent = toKeyboardEvent(event);
         if (!isDisabled() && !isFieldOwnerDisabled() && !isFieldOwnerReadOnly()) {
             handleKeyboardEvent(keyboardEvent);
             if (keyboardEvent->defaultHandled())
diff --git a/Source/core/html/shadow/DetailsMarkerControl.cpp b/Source/core/html/shadow/DetailsMarkerControl.cpp
index 84fa604..3d139df 100644
--- a/Source/core/html/shadow/DetailsMarkerControl.cpp
+++ b/Source/core/html/shadow/DetailsMarkerControl.cpp
@@ -44,9 +44,9 @@
 {
 }
 
-RenderObject* DetailsMarkerControl::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* DetailsMarkerControl::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderDetailsMarker(this);
+    return new (document()->renderArena()) RenderDetailsMarker(this);
 }
 
 bool DetailsMarkerControl::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/core/html/shadow/DetailsMarkerControl.h b/Source/core/html/shadow/DetailsMarkerControl.h
index 9cd6e66..168491f 100644
--- a/Source/core/html/shadow/DetailsMarkerControl.h
+++ b/Source/core/html/shadow/DetailsMarkerControl.h
@@ -44,7 +44,7 @@
     static PassRefPtr<DetailsMarkerControl> create(Document*);
 
 private:
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     HTMLSummaryElement* summaryElement();
diff --git a/Source/core/html/shadow/HTMLContentElement.cpp b/Source/core/html/shadow/HTMLContentElement.cpp
index 514855d..79d4f95 100644
--- a/Source/core/html/shadow/HTMLContentElement.cpp
+++ b/Source/core/html/shadow/HTMLContentElement.cpp
@@ -31,7 +31,6 @@
 #include "core/css/CSSParser.h"
 #include "core/dom/QualifiedName.h"
 #include "core/dom/shadow/ShadowRoot.h"
-#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/HTMLContentElement.h b/Source/core/html/shadow/HTMLContentElement.h
index 6f30076..a7864a2 100644
--- a/Source/core/html/shadow/HTMLContentElement.h
+++ b/Source/core/html/shadow/HTMLContentElement.h
@@ -33,7 +33,6 @@
 
 #include "core/css/CSSSelectorList.h"
 #include "core/dom/shadow/InsertionPoint.h"
-#include <wtf/Forward.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/HTMLShadowElement.cpp b/Source/core/html/shadow/HTMLShadowElement.cpp
index 3c69757..71f8ef0 100644
--- a/Source/core/html/shadow/HTMLShadowElement.cpp
+++ b/Source/core/html/shadow/HTMLShadowElement.cpp
@@ -33,7 +33,6 @@
 
 #include "HTMLNames.h"
 #include "core/dom/shadow/ShadowRoot.h"
-#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/MediaControlElementTypes.cpp b/Source/core/html/shadow/MediaControlElementTypes.cpp
index bd2f257..c012642 100644
--- a/Source/core/html/shadow/MediaControlElementTypes.cpp
+++ b/Source/core/html/shadow/MediaControlElementTypes.cpp
@@ -167,7 +167,7 @@
 void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
 {
     // Left button is 0. Rejects mouse events not from left button.
-    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+    if (event->isMouseEvent() && toMouseEvent(event)->button())
         return;
 
     if (!attached())
diff --git a/Source/core/html/shadow/MediaControlElements.cpp b/Source/core/html/shadow/MediaControlElements.cpp
index 243144a..8e22f60 100644
--- a/Source/core/html/shadow/MediaControlElements.cpp
+++ b/Source/core/html/shadow/MediaControlElements.cpp
@@ -32,7 +32,6 @@
 #include "core/html/shadow/MediaControlElements.h"
 
 #include "core/dom/EventNames.h"
-#include "core/dom/EventTarget.h"
 #include "core/dom/ExceptionCodePlaceholder.h"
 #include "core/dom/FullscreenController.h"
 #include "core/dom/MouseEvent.h"
@@ -40,21 +39,14 @@
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/shadow/MediaControls.h"
 #include "core/html/track/TextTrack.h"
-#include "core/html/track/TextTrackList.h"
-#include "core/html/track/TextTrackRegionList.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Frame.h"
 #include "core/page/Page.h"
-#include "core/page/PageGroup.h"
 #include "core/page/Settings.h"
-#include "core/platform/LocalizedStrings.h"
-#include "core/platform/graphics/GraphicsContext.h"
-#include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderMediaControlElements.h"
 #include "core/rendering/RenderSlider.h"
 #include "core/rendering/RenderTheme.h"
 #include "core/rendering/RenderVideo.h"
-#include "core/rendering/RenderView.h"
 
 namespace WebCore {
 
@@ -224,7 +216,7 @@
     MediaControlDivElement::defaultEventHandler(event);
 
     if (event->isMouseEvent()) {
-        LayoutPoint location = static_cast<MouseEvent*>(event)->absoluteLocation();
+        LayoutPoint location = toMouseEvent(event)->absoluteLocation();
         if (event->type() == eventNames().mousedownEvent && event->target() == this) {
             startDrag(location);
             event->setDefaultHandled();
@@ -490,7 +482,7 @@
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
 {
     // Left button is 0. Rejects mouse events not from left button.
-    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+    if (event->isMouseEvent() && toMouseEvent(event)->button())
         return;
 
     if (!attached())
@@ -672,9 +664,9 @@
     return element.release();
 }
 
-RenderObject* MediaControlTextTrackContainerElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* MediaControlTextTrackContainerElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderTextTrackContainerElement(this);
+    return new (document()->renderArena()) RenderTextTrackContainerElement(this);
 }
 
 const AtomicString& MediaControlTextTrackContainerElement::textTrackContainerElementShadowPseudoId()
@@ -757,7 +749,7 @@
             // WebVTT region whose region identifier is identical to cue's text
             // track cue region identifier, run the following substeps:
 #endif
-            if (displayBox->hasChildNodes() && !contains(static_cast<Node*>(displayBox.get())))
+            if (displayBox->hasChildNodes() && !contains(displayBox.get()))
                 // Note: the display tree of a cue is removed when the active flag of the cue is unset.
                 appendChild(displayBox, ASSERT_NO_EXCEPTION, AttachNow);
 #if ENABLE(WEBVTT_REGIONS)
diff --git a/Source/core/html/shadow/MediaControlElements.h b/Source/core/html/shadow/MediaControlElements.h
index 7a4f3b7..712ccbb 100644
--- a/Source/core/html/shadow/MediaControlElements.h
+++ b/Source/core/html/shadow/MediaControlElements.h
@@ -259,7 +259,7 @@
     explicit MediaControlTextTrackContainerElement(Document*);
     virtual const AtomicString& shadowPseudoId() const OVERRIDE;
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 
     IntRect m_videoDisplaySize;
     float m_fontSize;
diff --git a/Source/core/html/shadow/MediaControls.cpp b/Source/core/html/shadow/MediaControls.cpp
index 37a0418..4e3ff07 100644
--- a/Source/core/html/shadow/MediaControls.cpp
+++ b/Source/core/html/shadow/MediaControls.cpp
@@ -342,7 +342,7 @@
 {
     if (!event->isMouseEvent())
         return false;
-    EventTarget* relatedTarget = static_cast<MouseEvent*>(event)->relatedTarget();
+    EventTarget* relatedTarget = toMouseEvent(event)->relatedTarget();
     if (!relatedTarget)
         return false;
     return contains(relatedTarget->toNode());
diff --git a/Source/core/html/shadow/MediaControls.h b/Source/core/html/shadow/MediaControls.h
index b83157f..cb65516 100644
--- a/Source/core/html/shadow/MediaControls.h
+++ b/Source/core/html/shadow/MediaControls.h
@@ -27,18 +27,11 @@
 #ifndef MediaControls_h
 #define MediaControls_h
 
-#include "HTMLNames.h"
 #include "core/dom/MouseEvent.h"
-#include "core/dom/Text.h"
 #include "core/html/HTMLDivElement.h"
-#include "core/html/HTMLMediaElement.h"
 #include "core/html/shadow/MediaControlElements.h"
-#include "core/page/Chrome.h"
 #include "core/page/Page.h"
 #include "core/rendering/RenderTheme.h"
-#include <wtf/RefPtr.h>
-
-#include "core/html/track/TextTrackCue.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/shadow/MeterShadowElement.cpp b/Source/core/html/shadow/MeterShadowElement.cpp
index 482c4eb..df0220b 100644
--- a/Source/core/html/shadow/MeterShadowElement.cpp
+++ b/Source/core/html/shadow/MeterShadowElement.cpp
@@ -79,9 +79,9 @@
     return render && !render->theme()->supportsMeter(render->style()->appearance()) && HTMLDivElement::rendererIsNeeded(context);
 }
 
-RenderObject* MeterInnerElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* MeterInnerElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderMeter(this);
+    return new (document()->renderArena()) RenderMeter(this);
 }
 
 inline MeterBarElement::MeterBarElement(Document* document)
diff --git a/Source/core/html/shadow/MeterShadowElement.h b/Source/core/html/shadow/MeterShadowElement.h
index e076515..a7b644c 100644
--- a/Source/core/html/shadow/MeterShadowElement.h
+++ b/Source/core/html/shadow/MeterShadowElement.h
@@ -55,7 +55,7 @@
 private:
     MeterInnerElement(Document*);
     virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE;
 };
 
 class MeterBarElement FINAL : public MeterShadowElement {
diff --git a/Source/core/html/shadow/PickerIndicatorElement.cpp b/Source/core/html/shadow/PickerIndicatorElement.cpp
index 37531e4..3fedf69 100644
--- a/Source/core/html/shadow/PickerIndicatorElement.cpp
+++ b/Source/core/html/shadow/PickerIndicatorElement.cpp
@@ -64,9 +64,9 @@
     ASSERT(!m_chooser);
 }
 
-RenderObject* PickerIndicatorElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* PickerIndicatorElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderDetailsMarker(this);
+    return new (document()->renderArena()) RenderDetailsMarker(this);
 }
 
 void PickerIndicatorElement::defaultEventHandler(Event* event)
diff --git a/Source/core/html/shadow/PickerIndicatorElement.h b/Source/core/html/shadow/PickerIndicatorElement.h
index 496d151..29aff6e 100644
--- a/Source/core/html/shadow/PickerIndicatorElement.h
+++ b/Source/core/html/shadow/PickerIndicatorElement.h
@@ -35,7 +35,6 @@
 #include "core/html/HTMLDivElement.h"
 #include "core/platform/DateTimeChooser.h"
 #include "core/platform/DateTimeChooserClient.h"
-#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -67,7 +66,7 @@
 
 private:
     PickerIndicatorElement(Document*, PickerIndicatorOwner&);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE;
     virtual void defaultEventHandler(Event*) OVERRIDE;
     virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isPickerIndicatorElement() const OVERRIDE;
diff --git a/Source/core/html/shadow/ProgressShadowElement.cpp b/Source/core/html/shadow/ProgressShadowElement.cpp
index f7fdc8a..6411544 100644
--- a/Source/core/html/shadow/ProgressShadowElement.cpp
+++ b/Source/core/html/shadow/ProgressShadowElement.cpp
@@ -70,9 +70,9 @@
     return element.release();
 }
 
-RenderObject* ProgressInnerElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* ProgressInnerElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderProgress(this);
+    return new (document()->renderArena()) RenderProgress(this);
 }
 
 bool ProgressInnerElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/core/html/shadow/ProgressShadowElement.h b/Source/core/html/shadow/ProgressShadowElement.h
index db6e4d2..68b5f64 100644
--- a/Source/core/html/shadow/ProgressShadowElement.h
+++ b/Source/core/html/shadow/ProgressShadowElement.h
@@ -54,7 +54,7 @@
 
     static PassRefPtr<ProgressInnerElement> create(Document*);
 private:
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 };
 
diff --git a/Source/core/html/shadow/SliderThumbElement.cpp b/Source/core/html/shadow/SliderThumbElement.cpp
index 3579d9a..24d35eb 100644
--- a/Source/core/html/shadow/SliderThumbElement.cpp
+++ b/Source/core/html/shadow/SliderThumbElement.cpp
@@ -44,7 +44,6 @@
 #include "core/rendering/RenderFlexibleBox.h"
 #include "core/rendering/RenderSlider.h"
 #include "core/rendering/RenderTheme.h"
-#include <wtf/MathExtras.h>
 
 using namespace std;
 
@@ -220,9 +219,9 @@
         renderer()->setNeedsLayout(true);
 }
 
-RenderObject* SliderThumbElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* SliderThumbElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderSliderThumb(this);
+    return new (document()->renderArena()) RenderSliderThumb(this);
 }
 
 bool SliderThumbElement::isDisabledFormControl() const
@@ -348,7 +347,7 @@
         return;
     }
 
-    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+    MouseEvent* mouseEvent = toMouseEvent(event);
     bool isLeftButton = mouseEvent->button() == LeftButton;
     const AtomicString& eventType = event->type();
 
@@ -448,9 +447,9 @@
     return adoptRef(new SliderContainerElement(document));
 }
 
-RenderObject* SliderContainerElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* SliderContainerElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderSliderContainer(this);
+    return new (document()->renderArena()) RenderSliderContainer(this);
 }
 
 const AtomicString& SliderContainerElement::shadowPseudoId() const
diff --git a/Source/core/html/shadow/SliderThumbElement.h b/Source/core/html/shadow/SliderThumbElement.h
index 983d44b..e6ddcf7 100644
--- a/Source/core/html/shadow/SliderThumbElement.h
+++ b/Source/core/html/shadow/SliderThumbElement.h
@@ -34,10 +34,8 @@
 
 #include "HTMLNames.h"
 #include "core/html/HTMLDivElement.h"
-#include "core/platform/graphics/FloatPoint.h"
 #include "core/rendering/RenderBlock.h"
-#include "core/rendering/style/RenderStyleConstants.h"
-#include <wtf/Forward.h>
+#include "wtf/Forward.h"
 
 namespace WebCore {
 
@@ -63,7 +61,7 @@
 
 private:
     SliderThumbElement(Document*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren();
     virtual bool isDisabledFormControl() const OVERRIDE;
     virtual bool matchesReadOnlyPseudoClass() const OVERRIDE;
@@ -121,7 +119,7 @@
 
 private:
     SliderContainerElement(Document*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual const AtomicString& shadowPseudoId() const;
 };
 
diff --git a/Source/core/html/shadow/SpinButtonElement.cpp b/Source/core/html/shadow/SpinButtonElement.cpp
index f82212f..17c1d41 100644
--- a/Source/core/html/shadow/SpinButtonElement.cpp
+++ b/Source/core/html/shadow/SpinButtonElement.cpp
@@ -88,7 +88,7 @@
         return;
     }
 
-    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+    MouseEvent* mouseEvent = toMouseEvent(event);
     IntPoint local = roundedIntPoint(box->absoluteToLocal(mouseEvent->absoluteLocation(), UseTransforms));
     if (mouseEvent->type() == eventNames().mousedownEvent && mouseEvent->button() == LeftButton) {
         if (box->pixelSnappedBorderBoxRect().contains(local)) {
diff --git a/Source/core/html/shadow/TextControlInnerElements.cpp b/Source/core/html/shadow/TextControlInnerElements.cpp
index 0eb551d..def5731 100644
--- a/Source/core/html/shadow/TextControlInnerElements.cpp
+++ b/Source/core/html/shadow/TextControlInnerElements.cpp
@@ -29,23 +29,19 @@
 
 #include "HTMLNames.h"
 #include "bindings/v8/ScriptController.h"
-#include "core/dom/BeforeTextInsertedEvent.h"
 #include "core/dom/Document.h"
 #include "core/dom/EventNames.h"
 #include "core/dom/MouseEvent.h"
 #include "core/dom/TextEvent.h"
 #include "core/dom/TextEventInputType.h"
 #include "core/html/HTMLInputElement.h"
-#include "core/html/HTMLTextAreaElement.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Frame.h"
-#include "core/page/Page.h"
 #include "core/page/SpeechInput.h"
 #include "core/page/SpeechInputEvent.h"
 #include "core/rendering/RenderSearchField.h"
 #include "core/rendering/RenderTextControl.h"
 #include "core/rendering/RenderView.h"
-#include "core/rendering/style/StyleInheritedData.h"
 
 namespace WebCore {
 
@@ -61,9 +57,9 @@
     return adoptRef(new TextControlInnerContainer(document));
 }
     
-RenderObject* TextControlInnerContainer::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* TextControlInnerContainer::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderTextControlInnerContainer(this);
+    return new (document()->renderArena()) RenderTextControlInnerContainer(this);
 }
 
 TextControlInnerElement::TextControlInnerElement(Document* document)
@@ -115,9 +111,9 @@
         HTMLDivElement::defaultEventHandler(event);
 }
 
-RenderObject* TextControlInnerTextElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* TextControlInnerTextElement::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderTextControlInnerBlock(this);
+    return new (document()->renderArena()) RenderTextControlInnerBlock(this);
 }
 
 PassRefPtr<RenderStyle> TextControlInnerTextElement::customStyleForRenderer()
@@ -157,7 +153,7 @@
 {
     // On mousedown, focus the search field
     HTMLInputElement* input = toHTMLInputElement(shadowHost());
-    if (input && event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (input && event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         input->focus();
         input->select();
         RenderSearchField* renderer = toRenderSearchField(input->renderer());
@@ -208,7 +204,7 @@
         return;
     }
 
-    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         if (renderer() && renderer()->visibleToHitTesting()) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(this);
@@ -219,7 +215,7 @@
         input->select();
         event->setDefaultHandled();
     }
-    if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         if (m_capturing) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(0);
@@ -296,7 +292,7 @@
     }
 
     // On mouse down, select the text and set focus.
-    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         if (renderer() && renderer()->visibleToHitTesting()) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(this);
@@ -309,7 +305,7 @@
         event->setDefaultHandled();
     }
     // On mouse up, release capture cleanly.
-    if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+    if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && toMouseEvent(event)->button() == LeftButton) {
         if (m_capturing && renderer() && renderer()->visibleToHitTesting()) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(0);
diff --git a/Source/core/html/shadow/TextControlInnerElements.h b/Source/core/html/shadow/TextControlInnerElements.h
index 78ad561..2bb6e24 100644
--- a/Source/core/html/shadow/TextControlInnerElements.h
+++ b/Source/core/html/shadow/TextControlInnerElements.h
@@ -40,7 +40,7 @@
     static PassRefPtr<TextControlInnerContainer> create(Document*);
 protected:
     TextControlInnerContainer(Document*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
 };
 
 class TextControlInnerElement FINAL : public HTMLDivElement {
@@ -63,7 +63,7 @@
 
 private:
     TextControlInnerTextElement(Document*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderStyle*);
     virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
     virtual bool isMouseFocusable() const { return false; }
 };
diff --git a/Source/core/html/shadow/TextFieldDecorationElement.cpp b/Source/core/html/shadow/TextFieldDecorationElement.cpp
index f281d43..5020fc7 100644
--- a/Source/core/html/shadow/TextFieldDecorationElement.cpp
+++ b/Source/core/html/shadow/TextFieldDecorationElement.cpp
@@ -111,10 +111,10 @@
     ASSERT(existingRoot);
     RefPtr<HTMLDivElement> box = HTMLDivElement::create(input->document());
     decorationRoot->appendChild(box);
-    box->setInlineStyleProperty(CSSPropertyDisplay, CSSValueWebkitFlex);
-    box->setInlineStyleProperty(CSSPropertyWebkitAlignItems, CSSValueCenter);
+    box->setInlineStyleProperty(CSSPropertyDisplay, CSSValueFlex);
+    box->setInlineStyleProperty(CSSPropertyAlignItems, CSSValueCenter);
     ASSERT(existingRoot->childNodeCount() == 1);
-    toHTMLElement(existingRoot->firstChild())->setInlineStyleProperty(CSSPropertyWebkitFlexGrow, 1.0, CSSPrimitiveValue::CSS_NUMBER);
+    toHTMLElement(existingRoot->firstChild())->setInlineStyleProperty(CSSPropertyFlexGrow, 1.0, CSSPrimitiveValue::CSS_NUMBER);
     box->appendChild(HTMLShadowElement::create(HTMLNames::shadowTag, input->document()));
     setInlineStyleProperty(CSSPropertyDisplay, visible ? CSSValueBlock : CSSValueNone);
     box->appendChild(this);
@@ -162,9 +162,9 @@
     return style.release();
 }
 
-RenderObject* TextFieldDecorationElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* TextFieldDecorationElement::createRenderer(RenderStyle*)
 {
-    RenderImage* image = new (arena) RenderImage(this);
+    RenderImage* image = new (document()->renderArena()) RenderImage(this);
     image->setImageResource(RenderImageResource::create());
     return image;
 }
diff --git a/Source/core/html/shadow/TextFieldDecorationElement.h b/Source/core/html/shadow/TextFieldDecorationElement.h
index 5222044..e4cd73b 100644
--- a/Source/core/html/shadow/TextFieldDecorationElement.h
+++ b/Source/core/html/shadow/TextFieldDecorationElement.h
@@ -79,7 +79,7 @@
     TextFieldDecorationElement(Document*, TextFieldDecorator*);
     virtual bool isTextFieldDecoration() const OVERRIDE;
     virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE;
     virtual void attach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual void detach(const AttachContext& = AttachContext()) OVERRIDE;
     virtual bool isMouseFocusable() const OVERRIDE;
diff --git a/Source/core/html/track/InbandTextTrack.h b/Source/core/html/track/InbandTextTrack.h
index db73064..236d5de 100644
--- a/Source/core/html/track/InbandTextTrack.h
+++ b/Source/core/html/track/InbandTextTrack.h
@@ -27,9 +27,8 @@
 #define InbandTextTrack_h
 
 #include "core/html/track/TextTrack.h"
-#include "core/platform/graphics/InbandTextTrackPrivate.h"
 #include "core/platform/graphics/InbandTextTrackPrivateClient.h"
-#include <wtf/RefPtr.h>
+#include "wtf/RefPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/track/LoadableTextTrack.cpp b/Source/core/html/track/LoadableTextTrack.cpp
index 06c5c92..a856d17 100644
--- a/Source/core/html/track/LoadableTextTrack.cpp
+++ b/Source/core/html/track/LoadableTextTrack.cpp
@@ -29,7 +29,6 @@
 
 #include "core/html/HTMLTrackElement.h"
 #include "core/html/track/TextTrackCueList.h"
-#include "core/html/track/TextTrackRegionList.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/track/LoadableTextTrack.h b/Source/core/html/track/LoadableTextTrack.h
index a8ffc9e..4ac4c1f 100644
--- a/Source/core/html/track/LoadableTextTrack.h
+++ b/Source/core/html/track/LoadableTextTrack.h
@@ -28,8 +28,7 @@
 
 #include "core/html/track/TextTrack.h"
 #include "core/loader/TextTrackLoader.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/Vector.h>
+#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/track/TextTrack.h b/Source/core/html/track/TextTrack.h
index c033f74..655eb31 100644
--- a/Source/core/html/track/TextTrack.h
+++ b/Source/core/html/track/TextTrack.h
@@ -30,9 +30,7 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/html/track/TrackBase.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/text/WTFString.h>
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
diff --git a/Source/core/html/track/TextTrack.idl b/Source/core/html/track/TextTrack.idl
index 00a44a8..c1b39ff 100644
--- a/Source/core/html/track/TextTrack.idl
+++ b/Source/core/html/track/TextTrack.idl
@@ -40,11 +40,9 @@
     void addCue(TextTrackCue cue);
     [RaisesException] void removeCue(TextTrackCue cue);
 
-#if defined(ENABLE_WEBVTT_REGIONS) && ENABLE_WEBVTT_REGIONS
-    readonly attribute TextTrackRegionList regions;
-    void addRegion(TextTrackRegion region);
-    [RaisesException] void removeRegion(TextTrackRegion region);
-#endif
+    [Conditional=WEBVTT_REGIONS] readonly attribute TextTrackRegionList regions;
+    [Conditional=WEBVTT_REGIONS] void addRegion(TextTrackRegion region);
+    [RaisesException, Conditional=WEBVTT_REGIONS] void removeRegion(TextTrackRegion region);
 
     // EventTarget interface
     void addEventListener(DOMString type,
diff --git a/Source/core/html/track/TextTrackCue.cpp b/Source/core/html/track/TextTrackCue.cpp
index feddf70..96083de 100644
--- a/Source/core/html/track/TextTrackCue.cpp
+++ b/Source/core/html/track/TextTrackCue.cpp
@@ -41,12 +41,11 @@
 #include "core/html/HTMLDivElement.h"
 #include "core/html/track/TextTrack.h"
 #include "core/html/track/TextTrackCueList.h"
-#include "core/html/track/TextTrackRegionList.h"
 #include "core/html/track/WebVTTElement.h"
 #include "core/html/track/WebVTTParser.h"
 #include "core/rendering/RenderTextTrackCue.h"
-#include <wtf/MathExtras.h>
-#include <wtf/text/StringBuilder.h>
+#include "wtf/MathExtras.h"
+#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
@@ -179,9 +178,9 @@
     return trackDisplayBoxShadowPseudoId;
 }
 
-RenderObject* TextTrackCueBox::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* TextTrackCueBox::createRenderer(RenderStyle*)
 {
-    return new (arena) RenderTextTrackCue(this);
+    return new (document()->renderArena()) RenderTextTrackCue(this);
 }
 
 // ----------------------------
@@ -480,8 +479,11 @@
 
 int TextTrackCue::cueIndex()
 {
-    if (m_cueIndex == invalidCueIndex)
-        m_cueIndex = track()->cues()->getCueIndex(this);
+    if (m_cueIndex == invalidCueIndex) {
+        TextTrackCueList* cues = track()->cues();
+        if (cues)
+            m_cueIndex = cues->getCueIndex(this);
+    }
 
     return m_cueIndex;
 }
@@ -760,7 +762,7 @@
             toWebVTTElement(child)->setIsPastNode(isPastNode);
             // Make an elemenet id match a cue id for style matching purposes.
             if (!m_id.isEmpty())
-                toElement(child)->setIdAttribute(AtomicString(m_id.characters(), m_id.length()));
+                toElement(child)->setIdAttribute(m_id);
         }
     }
 }
diff --git a/Source/core/html/track/TextTrackCue.h b/Source/core/html/track/TextTrackCue.h
index eeb7880..8c29667 100644
--- a/Source/core/html/track/TextTrackCue.h
+++ b/Source/core/html/track/TextTrackCue.h
@@ -35,10 +35,7 @@
 #include "bindings/v8/ScriptWrappable.h"
 #include "core/dom/EventTarget.h"
 #include "core/html/HTMLDivElement.h"
-#include "core/html/HTMLElement.h"
-#include "core/html/track/TextTrack.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/RefCounted.h>
+#include "wtf/RefCounted.h"
 
 namespace WebCore {
 
@@ -64,7 +61,7 @@
 protected:
     TextTrackCueBox(Document*, TextTrackCue*);
 
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual RenderObject* createRenderer(RenderStyle*) OVERRIDE;
 
     TextTrackCue* m_cue;
 };
diff --git a/Source/core/html/track/TextTrackCue.idl b/Source/core/html/track/TextTrackCue.idl
index 7933a53..962f695 100644
--- a/Source/core/html/track/TextTrackCue.idl
+++ b/Source/core/html/track/TextTrackCue.idl
@@ -58,8 +58,6 @@
                              optional boolean useCapture);
     [RaisesException] boolean dispatchEvent(Event evt);
 
-#if defined(ENABLE_WEBVTT_REGIONS) && ENABLE_WEBVTT_REGIONS
-    attribute DOMString regionId;
-#endif
+    [Conditional=WEBVTT_REGIONS] attribute DOMString regionId;
 };
 
diff --git a/Source/core/html/track/TextTrackCueGeneric.h b/Source/core/html/track/TextTrackCueGeneric.h
index 821fa7c..4997e86 100644
--- a/Source/core/html/track/TextTrackCueGeneric.h
+++ b/Source/core/html/track/TextTrackCueGeneric.h
@@ -28,7 +28,6 @@
 
 #include "core/html/track/TextTrackCue.h"
 #include "core/platform/graphics/Color.h"
-#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
diff --git a/Source/core/html/track/TextTrackList.h b/Source/core/html/track/TextTrackList.h
index 9876406..1d55351 100644
--- a/Source/core/html/track/TextTrackList.h
+++ b/Source/core/html/track/TextTrackList.h
@@ -34,8 +34,6 @@
 #include "wtf/RefCounted.h"
 #include "wtf/Vector.h"
 
-#include <algorithm>
-
 namespace WebCore {
 
 class HTMLMediaElement;
diff --git a/Source/core/html/track/TextTrackRegion.cpp b/Source/core/html/track/TextTrackRegion.cpp
index d63a2cd..17bf8db 100644
--- a/Source/core/html/track/TextTrackRegion.cpp
+++ b/Source/core/html/track/TextTrackRegion.cpp
@@ -70,7 +70,7 @@
 static const float scrollTime = 0.433;
 
 TextTrackRegion::TextTrackRegion(ScriptExecutionContext* context)
-    : ContextDestructionObserver(context)
+    : ContextLifecycleObserver(context)
     , m_id(emptyString())
     , m_width(defaultWidth)
     , m_heightInLines(defaultHeightInLines)
diff --git a/Source/core/html/track/TextTrackRegion.h b/Source/core/html/track/TextTrackRegion.h
index 168c87a..30b8568 100644
--- a/Source/core/html/track/TextTrackRegion.h
+++ b/Source/core/html/track/TextTrackRegion.h
@@ -33,7 +33,7 @@
 
 #if ENABLE(WEBVTT_REGIONS)
 
-#include "core/dom/ContextDestructionObserver.h"
+#include "core/dom/ContextLifecycleObserver.h"
 #include "core/dom/Document.h"
 #include "core/html/track/TextTrack.h"
 #include "core/platform/graphics/FloatPoint.h"
@@ -45,7 +45,7 @@
 class HTMLDivElement;
 class TextTrackCueBox;
 
-class TextTrackRegion : public RefCounted<TextTrackRegion>, public ContextDestructionObserver {
+class TextTrackRegion : public RefCounted<TextTrackRegion>, public ContextLifecycleObserver {
 public:
     static PassRefPtr<TextTrackRegion> create(ScriptExecutionContext* context)
     {