Merge from Chromium at DEPS revision r213371

This commit was generated by merge_to_master.py.

Change-Id: I03fae1c1dae6e5de12e56e0a6c3780252291bfae
diff --git a/Source/core/html/ColorInputType.cpp b/Source/core/html/ColorInputType.cpp
index e6278d4..a0fc7dd 100644
--- a/Source/core/html/ColorInputType.cpp
+++ b/Source/core/html/ColorInputType.cpp
@@ -61,7 +61,7 @@
     // We don't accept #rgb and #aarrggbb formats.
     if (value.length() != 7)
         return false;
-    Color color(value);
+    StyleColor color(value);
     return color.isValid() && !color.hasAlpha();
 }
 
@@ -108,9 +108,9 @@
     return proposedValue.lower();
 }
 
-Color ColorInputType::valueAsColor() const
+StyleColor ColorInputType::valueAsColor() const
 {
-    return Color(element()->value());
+    return StyleColor(element()->value());
 }
 
 void ColorInputType::createShadowSubtree()
@@ -137,7 +137,7 @@
 
     updateColorSwatch();
     if (m_chooser)
-        m_chooser->setSelectedColor(valueAsColor());
+        m_chooser->setSelectedColor(valueAsColor().color());
 }
 
 void ColorInputType::handleDOMActivateEvent(Event* event)
@@ -150,7 +150,7 @@
 
     Chrome* chrome = this->chrome();
     if (chrome && !m_chooser)
-        m_chooser = chrome->createColorChooser(this, valueAsColor());
+        m_chooser = chrome->createColorChooser(this, valueAsColor().color());
 
     event->setDefaultHandled();
 }
@@ -196,7 +196,7 @@
     if (!colorSwatch)
         return;
 
-    colorSwatch->setInlineStyleProperty(CSSPropertyBackgroundColor, element()->value(), false);
+    colorSwatch->setInlineStyleProperty(CSSPropertyBackgroundColor, element()->value());
 }
 
 HTMLElement* ColorInputType::shadowColorSwatch() const
@@ -212,7 +212,7 @@
 
 Color ColorInputType::currentColor()
 {
-    return valueAsColor();
+    return valueAsColor().color();
 }
 
 bool ColorInputType::shouldShowSuggestions() const
@@ -233,10 +233,10 @@
             for (unsigned i = 0; HTMLOptionElement* option = toHTMLOptionElement(options->item(i)); i++) {
                 if (!element()->isValidValue(option->value()))
                     continue;
-                Color color(option->value());
+                StyleColor color(option->value());
                 if (!color.isValid())
                     continue;
-                suggestions.append(color);
+                suggestions.append(color.color());
             }
         }
     }
diff --git a/Source/core/html/ColorInputType.h b/Source/core/html/ColorInputType.h
index 161d912..fedaac7 100644
--- a/Source/core/html/ColorInputType.h
+++ b/Source/core/html/ColorInputType.h
@@ -64,7 +64,7 @@
     virtual bool shouldRespectListAttribute() OVERRIDE;
     virtual bool typeMismatchFor(const String&) const OVERRIDE;
 
-    Color valueAsColor() const;
+    StyleColor valueAsColor() const;
     void endColorChooser();
     void updateColorSwatch();
     HTMLElement* shadowColorSwatch() const;
diff --git a/Source/core/html/FileInputType.cpp b/Source/core/html/FileInputType.cpp
index 6804ebb..c8820eb 100644
--- a/Source/core/html/FileInputType.cpp
+++ b/Source/core/html/FileInputType.cpp
@@ -37,7 +37,6 @@
 #include "core/platform/DragData.h"
 #include "core/platform/FileSystem.h"
 #include "core/platform/LocalizedStrings.h"
-#include "core/platform/graphics/Icon.h"
 #include "core/rendering/RenderFileUploadControl.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/text/StringBuilder.h"
@@ -212,7 +211,6 @@
 void FileInputType::setValue(const String&, bool, TextFieldEventBehavior)
 {
     m_fileList->clear();
-    m_icon.clear();
     element()->setNeedsStyleRecalc();
 }
 
@@ -278,15 +276,6 @@
         button->setAttribute(valueAttr, element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
 
-void FileInputType::requestIcon(const Vector<String>& paths)
-{
-    if (!paths.size())
-        return;
-
-    if (Chrome* chrome = this->chrome())
-        chrome->loadIconForFiles(paths, newFileIconLoader());
-}
-
 void FileInputType::setFiles(PassRefPtr<FileList> files)
 {
     if (!files)
@@ -315,7 +304,6 @@
     Vector<String> paths;
     for (unsigned i = 0; i < m_fileList->length(); ++i)
         paths.append(m_fileList->item(i)->path());
-    requestIcon(paths);
 
     if (input->renderer())
         input->renderer()->repaint();
@@ -347,16 +335,6 @@
     }
 }
 
-void FileInputType::updateRendering(PassRefPtr<Icon> icon)
-{
-    if (m_icon == icon)
-        return;
-
-    m_icon = icon;
-    if (element()->renderer())
-        element()->renderer()->repaint();
-}
-
 bool FileInputType::receiveDroppedFiles(const DragData* dragData)
 {
     Vector<String> paths;
@@ -391,11 +369,6 @@
     return m_droppedFileSystemId;
 }
 
-Icon* FileInputType::icon() const
-{
-    return m_icon.get();
-}
-
 String FileInputType::defaultToolTip() const
 {
     FileList* fileList = m_fileList.get();
diff --git a/Source/core/html/FileInputType.h b/Source/core/html/FileInputType.h
index 71f626a..2ec2682 100644
--- a/Source/core/html/FileInputType.h
+++ b/Source/core/html/FileInputType.h
@@ -34,7 +34,6 @@
 
 #include "core/html/BaseClickableWithKeyInputType.h"
 #include "core/platform/FileChooser.h"
-#include "core/platform/FileIconLoader.h"
 #include "wtf/RefPtr.h"
 
 namespace WebCore {
@@ -42,7 +41,7 @@
 class DragData;
 class FileList;
 
-class FileInputType : public BaseClickableWithKeyInputType, private FileChooserClient, private FileIconLoaderClient {
+class FileInputType : public BaseClickableWithKeyInputType, private FileChooserClient {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
     static Vector<FileChooserFileInfo> filesFromFormControlState(const FormControlState&);
@@ -66,7 +65,6 @@
     virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual bool receiveDroppedFiles(const DragData*) OVERRIDE;
     virtual String droppedFileSystemId() OVERRIDE;
-    virtual Icon* icon() const OVERRIDE;
     virtual bool isFileUpload() const OVERRIDE;
     virtual void createShadowSubtree() OVERRIDE;
     virtual void disabledAttributeChanged() OVERRIDE;
@@ -76,15 +74,10 @@
     // FileChooserClient implementation.
     virtual void filesChosen(const Vector<FileChooserFileInfo>&) OVERRIDE;
 
-    // FileIconLoaderClient implementation.
-    virtual void updateRendering(PassRefPtr<Icon>) OVERRIDE;
-
     PassRefPtr<FileList> createFileList(const Vector<FileChooserFileInfo>& files) const;
     void receiveDropForDirectoryUpload(const Vector<String>&);
-    void requestIcon(const Vector<String>&);
 
     RefPtr<FileList> m_fileList;
-    RefPtr<Icon> m_icon;
 
     String m_droppedFileSystemId;
 };
diff --git a/Source/core/html/FormAssociatedElement.cpp b/Source/core/html/FormAssociatedElement.cpp
index a9533cb..21cb452 100644
--- a/Source/core/html/FormAssociatedElement.cpp
+++ b/Source/core/html/FormAssociatedElement.cpp
@@ -176,7 +176,8 @@
         m_formAttributeTargetObserver = nullptr;
     } else {
         resetFormOwner();
-        resetFormAttributeTargetObserver();
+        if (element->inDocument())
+            resetFormAttributeTargetObserver();
     }
 }
 
@@ -250,6 +251,7 @@
 
 void FormAssociatedElement::resetFormAttributeTargetObserver()
 {
+    ASSERT(toHTMLElement(this)->inDocument());
     m_formAttributeTargetObserver = FormAttributeTargetObserver::create(toHTMLElement(this)->fastGetAttribute(formAttr), this);
 }
 
diff --git a/Source/core/html/FormController.cpp b/Source/core/html/FormController.cpp
index dc05f48..5b2ff3c 100644
--- a/Source/core/html/FormController.cpp
+++ b/Source/core/html/FormController.cpp
@@ -82,13 +82,13 @@
 
 class FormElementKey {
 public:
-    FormElementKey(AtomicStringImpl* = 0, AtomicStringImpl* = 0);
+    FormElementKey(StringImpl* = 0, StringImpl* = 0);
     ~FormElementKey();
     FormElementKey(const FormElementKey&);
     FormElementKey& operator=(const FormElementKey&);
 
-    AtomicStringImpl* name() const { return m_name; }
-    AtomicStringImpl* type() const { return m_type; }
+    StringImpl* name() const { return m_name; }
+    StringImpl* type() const { return m_type; }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     FormElementKey(WTF::HashTableDeletedValueType) : m_name(hashTableDeletedValue()) { }
@@ -98,13 +98,13 @@
     void ref() const;
     void deref() const;
 
-    static AtomicStringImpl* hashTableDeletedValue() { return reinterpret_cast<AtomicStringImpl*>(-1); }
+    static StringImpl* hashTableDeletedValue() { return reinterpret_cast<StringImpl*>(-1); }
 
-    AtomicStringImpl* m_name;
-    AtomicStringImpl* m_type;
+    StringImpl* m_name;
+    StringImpl* m_type;
 };
 
-FormElementKey::FormElementKey(AtomicStringImpl* name, AtomicStringImpl* type)
+FormElementKey::FormElementKey(StringImpl* name, StringImpl* type)
     : m_name(name)
     , m_type(type)
 {
@@ -415,7 +415,7 @@
     stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 4);
     stateVector.append(formStateSignature());
     for (SavedFormStateMap::const_iterator it = stateMap->begin(); it != stateMap->end(); ++it) {
-        stateVector.append(it->key.get());
+        stateVector.append(it->key);
         it->value->serializeTo(stateVector);
     }
     bool hasOnlySignature = stateVector.size() == 1;
diff --git a/Source/core/html/FormController.h b/Source/core/html/FormController.h
index 9276e79..5609075 100644
--- a/Source/core/html/FormController.h
+++ b/Source/core/html/FormController.h
@@ -26,7 +26,7 @@
 #include "wtf/Forward.h"
 #include "wtf/ListHashSet.h"
 #include "wtf/Vector.h"
-#include "wtf/text/WTFString.h"
+#include "wtf/text/AtomicStringHash.h"
 
 namespace WebCore {
 
@@ -96,7 +96,7 @@
 
 private:
     typedef ListHashSet<RefPtr<HTMLFormControlElementWithState>, 64> FormElementListHashSet;
-    typedef HashMap<RefPtr<AtomicStringImpl>, OwnPtr<SavedFormState> > SavedFormStateMap;
+    typedef HashMap<AtomicString, OwnPtr<SavedFormState> > SavedFormStateMap;
 
     FormController();
     static PassOwnPtr<SavedFormStateMap> createSavedFormStateMap(const FormElementListHashSet&);
diff --git a/Source/core/html/HTMLCollection.h b/Source/core/html/HTMLCollection.h
index d76c61e..585cd9e 100644
--- a/Source/core/html/HTMLCollection.h
+++ b/Source/core/html/HTMLCollection.h
@@ -70,7 +70,7 @@
 
     virtual void updateNameCache() const;
 
-    typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<Element*> > > NodeCacheMap;
+    typedef HashMap<StringImpl*, OwnPtr<Vector<Element*> > > NodeCacheMap;
     Vector<Element*>* idCache(const AtomicString& name) const { return m_idCache.get(name.impl()); }
     Vector<Element*>* nameCache(const AtomicString& name) const { return m_nameCache.get(name.impl()); }
     void appendIdCache(const AtomicString& name, Element* element) const { append(m_idCache, name, element); }
diff --git a/Source/core/html/HTMLDetailsElement.cpp b/Source/core/html/HTMLDetailsElement.cpp
index 4147245..4b6e3fd 100644
--- a/Source/core/html/HTMLDetailsElement.cpp
+++ b/Source/core/html/HTMLDetailsElement.cpp
@@ -98,15 +98,10 @@
 
 bool HTMLDetailsElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (!childContext.isOnEncapsulationBoundary())
-        return false;
-
     if (m_isOpen)
         return HTMLElement::childShouldCreateRenderer(childContext);
-
     if (!childContext.node()->hasTagName(summaryTag))
         return false;
-
     return childContext.node() == findMainSummary() && HTMLElement::childShouldCreateRenderer(childContext);
 }
 
diff --git a/Source/core/html/HTMLDetailsElement.h b/Source/core/html/HTMLDetailsElement.h
index 565bba9..ea0ffbe 100644
--- a/Source/core/html/HTMLDetailsElement.h
+++ b/Source/core/html/HTMLDetailsElement.h
@@ -44,6 +44,22 @@
     bool m_isOpen;
 };
 
+inline bool isHTMLDetailsElement(const Node* node)
+{
+    return node->hasTagName(HTMLNames::detailsTag);
+}
+
+inline bool isHTMLDetailsElement(const Element* element)
+{
+    return element->hasTagName(HTMLNames::detailsTag);
+}
+
+inline HTMLDetailsElement* toHTMLDetailsElement(Node* node)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLDetailsElement(node));
+    return static_cast<HTMLDetailsElement*>(node);
+}
+
 } // namespace WebCore
 
 #endif // HTMLDetailsElement_h
diff --git a/Source/core/html/HTMLDocument.cpp b/Source/core/html/HTMLDocument.cpp
index 90ccd0f..1af0f73 100644
--- a/Source/core/html/HTMLDocument.cpp
+++ b/Source/core/html/HTMLDocument.cpp
@@ -220,7 +220,7 @@
 // not part of the DOM
 // --------------------------------------------------------------------------
 
-void HTMLDocument::addItemToMap(HashCountedSet<AtomicStringImpl*>& map, const AtomicString& name)
+void HTMLDocument::addItemToMap(HashCountedSet<StringImpl*>& map, const AtomicString& name)
 {
     if (name.isEmpty())
         return;
@@ -229,7 +229,7 @@
         f->script()->namedItemAdded(this, name);
 }
 
-void HTMLDocument::removeItemFromMap(HashCountedSet<AtomicStringImpl*>& map, const AtomicString& name)
+void HTMLDocument::removeItemFromMap(HashCountedSet<StringImpl*>& map, const AtomicString& name)
 {
     if (name.isEmpty())
         return;
@@ -258,16 +258,16 @@
     removeItemFromMap(m_extraNamedItemCounts, name);
 }
 
-static void addLocalNameToSet(HashSet<AtomicStringImpl*>* set, const QualifiedName& qName)
+static void addLocalNameToSet(HashSet<StringImpl*>* set, const QualifiedName& qName)
 {
     set->add(qName.localName().impl());
 }
 
-static HashSet<AtomicStringImpl*>* createHtmlCaseInsensitiveAttributesSet()
+static HashSet<StringImpl*>* createHtmlCaseInsensitiveAttributesSet()
 {
     // This is the list of attributes in HTML 4.01 with values marked as "[CI]" or case-insensitive
     // Mozilla treats all other values as case-sensitive, thus so do we.
-    HashSet<AtomicStringImpl*>* attrSet = new HashSet<AtomicStringImpl*>;
+    HashSet<StringImpl*>* attrSet = new HashSet<StringImpl*>;
 
     addLocalNameToSet(attrSet, accept_charsetAttr);
     addLocalNameToSet(attrSet, acceptAttr);
@@ -320,7 +320,7 @@
 
 bool HTMLDocument::isCaseSensitiveAttribute(const QualifiedName& attributeName)
 {
-    static HashSet<AtomicStringImpl*>* htmlCaseInsensitiveAttributesSet = createHtmlCaseInsensitiveAttributesSet();
+    static HashSet<StringImpl*>* htmlCaseInsensitiveAttributesSet = createHtmlCaseInsensitiveAttributesSet();
     bool isPossibleHTMLAttr = !attributeName.hasPrefix() && (attributeName.namespaceURI() == nullAtom);
     return !isPossibleHTMLAttr || !htmlCaseInsensitiveAttributesSet->contains(attributeName.localName().impl());
 }
diff --git a/Source/core/html/HTMLDocument.h b/Source/core/html/HTMLDocument.h
index 369758a..c224741 100644
--- a/Source/core/html/HTMLDocument.h
+++ b/Source/core/html/HTMLDocument.h
@@ -65,11 +65,11 @@
 
     void addNamedItem(const AtomicString& name);
     void removeNamedItem(const AtomicString& name);
-    bool hasNamedItem(AtomicStringImpl* name);
+    bool hasNamedItem(StringImpl* name);
 
     void addExtraNamedItem(const AtomicString& name);
     void removeExtraNamedItem(const AtomicString& name);
-    bool hasExtraNamedItem(AtomicStringImpl* name);
+    bool hasExtraNamedItem(StringImpl* name);
 
     static bool isCaseSensitiveAttribute(const QualifiedName&);
 
@@ -78,20 +78,20 @@
 
 private:
     HTMLBodyElement* bodyAsHTMLBodyElement() const;
-    void addItemToMap(HashCountedSet<AtomicStringImpl*>&, const AtomicString&);
-    void removeItemFromMap(HashCountedSet<AtomicStringImpl*>&, const AtomicString&);
+    void addItemToMap(HashCountedSet<StringImpl*>&, const AtomicString&);
+    void removeItemFromMap(HashCountedSet<StringImpl*>&, const AtomicString&);
 
-    HashCountedSet<AtomicStringImpl*> m_namedItemCounts;
-    HashCountedSet<AtomicStringImpl*> m_extraNamedItemCounts;
+    HashCountedSet<StringImpl*> m_namedItemCounts;
+    HashCountedSet<StringImpl*> m_extraNamedItemCounts;
 };
 
-inline bool HTMLDocument::hasNamedItem(AtomicStringImpl* name)
+inline bool HTMLDocument::hasNamedItem(StringImpl* name)
 {
     ASSERT(name);
     return m_namedItemCounts.contains(name);
 }
 
-inline bool HTMLDocument::hasExtraNamedItem(AtomicStringImpl* name)
+inline bool HTMLDocument::hasExtraNamedItem(StringImpl* name)
 {
     ASSERT(name);
     return m_extraNamedItemCounts.contains(name);
diff --git a/Source/core/html/HTMLElement.cpp b/Source/core/html/HTMLElement.cpp
index 54a2bbb..2b9bf86 100644
--- a/Source/core/html/HTMLElement.cpp
+++ b/Source/core/html/HTMLElement.cpp
@@ -1054,9 +1054,9 @@
         return;
 
     // If the string is a named CSS color or a 3/6-digit hex color, use that.
-    Color parsedColor(colorString);
+    StyleColor parsedColor(colorString);
     if (!parsedColor.isValid())
-        parsedColor.setRGB(parseColorStringWithCrazyLegacyRules(colorString));
+        parsedColor = parseColorStringWithCrazyLegacyRules(colorString);
 
     style->setProperty(propertyID, cssValuePool().createColorValue(parsedColor.rgb()));
 }
diff --git a/Source/core/html/HTMLFormControlsCollection.cpp b/Source/core/html/HTMLFormControlsCollection.cpp
index f1f06aa..a432b1b 100644
--- a/Source/core/html/HTMLFormControlsCollection.cpp
+++ b/Source/core/html/HTMLFormControlsCollection.cpp
@@ -122,7 +122,7 @@
     if (hasNameCache())
         return;
 
-    HashSet<AtomicStringImpl*> foundInputElements;
+    HashSet<StringImpl*> foundInputElements;
 
     const Vector<FormAssociatedElement*>& elementsArray = formControlElements();
 
diff --git a/Source/core/html/HTMLFormElement.h b/Source/core/html/HTMLFormElement.h
index c3fd077..a0bd172 100644
--- a/Source/core/html/HTMLFormElement.h
+++ b/Source/core/html/HTMLFormElement.h
@@ -157,7 +157,7 @@
     // are any invalid controls in this form.
     bool checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >*, HTMLFormControlElement::CheckValidityDispatchEvents = HTMLFormControlElement::CheckValidityDispatchEventsAllowed);
 
-    typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<Node> > AliasMap;
+    typedef HashMap<AtomicString, RefPtr<Node> > AliasMap;
 
     FormSubmission::Attributes m_attributes;
     OwnPtr<AliasMap> m_elementAliases;
diff --git a/Source/core/html/HTMLInputElement.cpp b/Source/core/html/HTMLInputElement.cpp
index 3325cf9..07a317a 100644
--- a/Source/core/html/HTMLInputElement.cpp
+++ b/Source/core/html/HTMLInputElement.cpp
@@ -1376,11 +1376,6 @@
     return m_inputType->droppedFileSystemId();
 }
 
-Icon* HTMLInputElement::icon() const
-{
-    return m_inputType->icon();
-}
-
 bool HTMLInputElement::canReceiveDroppedFiles() const
 {
     return m_canReceiveDroppedFiles;
diff --git a/Source/core/html/HTMLInputElement.h b/Source/core/html/HTMLInputElement.h
index b45046d..97d068b 100644
--- a/Source/core/html/HTMLInputElement.h
+++ b/Source/core/html/HTMLInputElement.h
@@ -300,10 +300,6 @@
 private:
     enum AutoCompleteSetting { Uninitialized, On, Off };
 
-    // FIXME: Author shadows should be allowed
-    // https://bugs.webkit.org/show_bug.cgi?id=92608
-    virtual bool areAuthorShadowsAllowed() const OVERRIDE { return false; }
-
     virtual void didAddUserAgentShadowRoot(ShadowRoot*) OVERRIDE;
 
     virtual void willChangeForm() OVERRIDE;
diff --git a/Source/core/html/HTMLInputElement.idl b/Source/core/html/HTMLInputElement.idl
index b4db40f..2911901 100644
--- a/Source/core/html/HTMLInputElement.idl
+++ b/Source/core/html/HTMLInputElement.idl
@@ -30,6 +30,8 @@
     [Reflect] attribute DOMString dirName;
     [Reflect] attribute boolean disabled;
     readonly attribute HTMLFormElement form;
+    // The 'files' attribute is intentionally not readonly.
+    // https://www.w3.org/Bugs/Public/show_bug.cgi?id=22682
     attribute FileList files;
     [Reflect, URL] attribute DOMString formAction;
     [TreatNullAs=NullString] attribute DOMString formEnctype;
diff --git a/Source/core/html/HTMLMediaElement.cpp b/Source/core/html/HTMLMediaElement.cpp
index 13cc476..1f180db 100644
--- a/Source/core/html/HTMLMediaElement.cpp
+++ b/Source/core/html/HTMLMediaElement.cpp
@@ -353,6 +353,8 @@
 
 void HTMLMediaElement::didMoveToNewDocument(Document* oldDocument)
 {
+    LOG(Media, "HTMLMediaElement::didMoveToNewDocument");
+
     if (m_shouldDelayLoadEvent) {
         if (oldDocument)
             oldDocument->decrementLoadEventDelayCount();
@@ -364,6 +366,13 @@
 
     addElementToDocumentMap(this, document());
 
+    // FIXME: This is a temporary fix to prevent this object from causing the
+    // MediaPlayer to dereference Frame and FrameLoader pointers from the
+    // previous document. A proper fix would provide a mechanism to allow this
+    // object to refresh the MediaPlayer's Frame and FrameLoader references on
+    // document changes so that playback can be resumed properly.
+    userCancelledLoad();
+
     HTMLElement::didMoveToNewDocument(oldDocument);
 }
 
@@ -491,14 +500,7 @@
 
 bool HTMLMediaElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (!hasMediaControls())
-        return false;
-    // <media> doesn't allow its content, including shadow subtree, to
-    // be rendered. So this should return false for most of the children.
-    // One exception is a shadow tree built for rendering controls which should be visible.
-    // So we let them go here by comparing its subtree root with one of the controls.
-    return (mediaControls()->treeScope() == childContext.node()->treeScope()
-            && childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext));
+    return hasMediaControls() && HTMLElement::childShouldCreateRenderer(childContext);
 }
 
 Node::InsertionNotificationRequest HTMLMediaElement::insertedInto(ContainerNode* insertionPoint)
diff --git a/Source/core/html/HTMLMeterElement.cpp b/Source/core/html/HTMLMeterElement.cpp
index b8b59e0..891cdb0 100644
--- a/Source/core/html/HTMLMeterElement.cpp
+++ b/Source/core/html/HTMLMeterElement.cpp
@@ -62,11 +62,6 @@
     return new (document()->renderArena()) RenderMeter(this);
 }
 
-bool HTMLMeterElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
-{
-    return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
-}
-
 void HTMLMeterElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == valueAttr || name == minAttr || name == maxAttr || name == lowAttr || name == highAttr || name == optimumAttr)
diff --git a/Source/core/html/HTMLMeterElement.h b/Source/core/html/HTMLMeterElement.h
index 0411f71..b40093c 100644
--- a/Source/core/html/HTMLMeterElement.h
+++ b/Source/core/html/HTMLMeterElement.h
@@ -72,7 +72,6 @@
 
     virtual bool recalcWillValidate() const { return false; }
     virtual RenderObject* createRenderer(RenderStyle*);
-    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
 
     void didElementStateChange();
diff --git a/Source/core/html/HTMLObjectElement.cpp b/Source/core/html/HTMLObjectElement.cpp
index 87cf60f..17a14cc 100644
--- a/Source/core/html/HTMLObjectElement.cpp
+++ b/Source/core/html/HTMLObjectElement.cpp
@@ -384,7 +384,7 @@
 // FIXME: This should be removed, all callers are almost certainly wrong.
 static bool isRecognizedTagName(const QualifiedName& tagName)
 {
-    DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, tagList, ());
+    DEFINE_STATIC_LOCAL(HashSet<StringImpl*>, tagList, ());
     if (tagList.isEmpty()) {
         QualifiedName** tags = HTMLNames::getHTMLTags();
         for (size_t i = 0; i < HTMLNames::HTMLTagsCount; i++) {
diff --git a/Source/core/html/HTMLProgressElement.cpp b/Source/core/html/HTMLProgressElement.cpp
index 3aad685..98d7de6 100644
--- a/Source/core/html/HTMLProgressElement.cpp
+++ b/Source/core/html/HTMLProgressElement.cpp
@@ -64,11 +64,6 @@
     return new (document()->renderArena()) RenderProgress(this);
 }
 
-bool HTMLProgressElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
-{
-    return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
-}
-
 RenderProgress* HTMLProgressElement::renderProgress() const
 {
     if (renderer() && renderer()->isProgress())
diff --git a/Source/core/html/HTMLProgressElement.h b/Source/core/html/HTMLProgressElement.h
index 91fca9b..128f712 100644
--- a/Source/core/html/HTMLProgressElement.h
+++ b/Source/core/html/HTMLProgressElement.h
@@ -54,7 +54,6 @@
     virtual bool supportLabels() const OVERRIDE { return true; }
 
     virtual RenderObject* createRenderer(RenderStyle*);
-    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     RenderProgress* renderProgress() const;
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
diff --git a/Source/core/html/HTMLSelectElement.cpp b/Source/core/html/HTMLSelectElement.cpp
index 53e16a6..694c7ba 100644
--- a/Source/core/html/HTMLSelectElement.cpp
+++ b/Source/core/html/HTMLSelectElement.cpp
@@ -1579,4 +1579,10 @@
     return true;
 }
 
+bool HTMLSelectElement::anonymousIndexedSetterRemove(unsigned index, ExceptionCode& ec)
+{
+    remove(index);
+    return true;
+}
+
 } // namespace
diff --git a/Source/core/html/HTMLSelectElement.h b/Source/core/html/HTMLSelectElement.h
index bcfed46..6004c71 100644
--- a/Source/core/html/HTMLSelectElement.h
+++ b/Source/core/html/HTMLSelectElement.h
@@ -109,6 +109,7 @@
     void optionSelectionStateChanged(HTMLOptionElement*, bool optionIsSelected);
     bool isParsingInProgress() const { return m_isParsingInProgress; }
     bool anonymousIndexedSetter(unsigned, PassRefPtr<HTMLOptionElement>, ExceptionCode&);
+    bool anonymousIndexedSetterRemove(unsigned, ExceptionCode&);
 
 protected:
     HTMLSelectElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
diff --git a/Source/core/html/HTMLSelectElement.idl b/Source/core/html/HTMLSelectElement.idl
index 3c6a8f3..a1d0e77 100644
--- a/Source/core/html/HTMLSelectElement.idl
+++ b/Source/core/html/HTMLSelectElement.idl
@@ -33,7 +33,7 @@
     [SetterRaisesException] attribute unsigned long length;
 
     getter Node item([IsIndex,Default=Undefined] optional unsigned long index);
-    [ImplementedAs=anonymousIndexedSetter, RaisesException] setter HTMLOptionElement (unsigned long index, HTMLOptionElement value);
+    [ImplementedAs=anonymousIndexedSetter, RaisesException] setter HTMLOptionElement (unsigned long index, [TreatNullAs=anonymousIndexedSetterRemove, TreatUndefinedAs=anonymousIndexedSetterRemove] HTMLOptionElement value);
     Node namedItem([Default=Undefined] optional DOMString name);
      [RaisesException] void add([Default=Undefined] optional HTMLElement element,
                             [Default=Undefined] optional HTMLElement before);
diff --git a/Source/core/html/HTMLSummaryElement.cpp b/Source/core/html/HTMLSummaryElement.cpp
index d047101..6907751 100644
--- a/Source/core/html/HTMLSummaryElement.cpp
+++ b/Source/core/html/HTMLSummaryElement.cpp
@@ -52,13 +52,6 @@
     return new (document()->renderArena()) RenderBlock(this);
 }
 
-bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
-{
-    if (childContext.node()->isPseudoElement())
-        return true;
-    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
-}
-
 void HTMLSummaryElement::didAddUserAgentShadowRoot(ShadowRoot* root)
 {
     root->appendChild(DetailsMarkerControl::create(document()), ASSERT_NO_EXCEPTION, AttachLazily);
@@ -67,10 +60,10 @@
 
 HTMLDetailsElement* HTMLSummaryElement::detailsElement() const
 {
-    Node* mayDetails = const_cast<HTMLSummaryElement*>(this)->parentNodeForRenderingAndStyle();
-    if (!mayDetails || !mayDetails->hasTagName(detailsTag))
-        return 0;
-    return static_cast<HTMLDetailsElement*>(mayDetails);
+    Node* parent = NodeRenderingTraversal::parent(this);
+    if (parent && isHTMLDetailsElement(parent))
+        return toHTMLDetailsElement(parent);
+    return 0;
 }
 
 bool HTMLSummaryElement::isMainSummary() const
diff --git a/Source/core/html/HTMLSummaryElement.h b/Source/core/html/HTMLSummaryElement.h
index 8a2108e..f0238f0 100644
--- a/Source/core/html/HTMLSummaryElement.h
+++ b/Source/core/html/HTMLSummaryElement.h
@@ -37,7 +37,6 @@
     HTMLSummaryElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderStyle*);
-    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
 
     virtual void didAddUserAgentShadowRoot(ShadowRoot*) OVERRIDE;
diff --git a/Source/core/html/HTMLTextAreaElement.h b/Source/core/html/HTMLTextAreaElement.h
index 58808aa..09533a7 100644
--- a/Source/core/html/HTMLTextAreaElement.h
+++ b/Source/core/html/HTMLTextAreaElement.h
@@ -66,7 +66,6 @@
     enum WrapMethod { NoWrap, SoftWrap, HardWrap };
 
     virtual void didAddUserAgentShadowRoot(ShadowRoot*) OVERRIDE;
-    virtual bool areAuthorShadowsAllowed() const OVERRIDE { return false; }
 
     void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*) const;
     static String sanitizeUserInputValue(const String&, unsigned maxLength);
diff --git a/Source/core/html/HTMLTextFormControlElement.cpp b/Source/core/html/HTMLTextFormControlElement.cpp
index e55dfb4..70fe01d 100644
--- a/Source/core/html/HTMLTextFormControlElement.cpp
+++ b/Source/core/html/HTMLTextFormControlElement.cpp
@@ -61,15 +61,6 @@
 {
 }
 
-bool HTMLTextFormControlElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
-{
-    // FIXME: We shouldn't force the pseudo elements down into the shadow, but
-    // this perserves the current behavior of WebKit.
-    if (childContext.node()->isPseudoElement())
-        return HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
-    return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
-}
-
 Node::InsertionNotificationRequest HTMLTextFormControlElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLFormControlElementWithState::insertedInto(insertionPoint);
@@ -161,7 +152,7 @@
     HTMLElement* placeholder = placeholderElement();
     if (!placeholder)
         return;
-    placeholder->setInlineStyleProperty(CSSPropertyVisibility, placeholderShouldBeVisible() ? ASCIILiteral("visible") : ASCIILiteral("hidden"));
+    placeholder->setInlineStyleProperty(CSSPropertyVisibility, placeholderShouldBeVisible() ? CSSValueVisible : CSSValueHidden);
 }
 
 void HTMLTextFormControlElement::fixPlaceholderRenderer(HTMLElement* placeholder, HTMLElement* siblingElement)
@@ -535,7 +526,7 @@
         innerTextElement()->setInnerText(value, ASSERT_NO_EXCEPTION);
 
         if (value.endsWith('\n') || value.endsWith('\r'))
-            innerTextElement()->appendChild(HTMLBRElement::create(document()), ASSERT_NO_EXCEPTION);
+            innerTextElement()->appendChild(HTMLBRElement::create(document()), ASSERT_NO_EXCEPTION, AttachLazily);
     }
 
     setFormControlValueMatchesRenderer(true);
diff --git a/Source/core/html/HTMLTextFormControlElement.h b/Source/core/html/HTMLTextFormControlElement.h
index 79f60a8..c18ef23 100644
--- a/Source/core/html/HTMLTextFormControlElement.h
+++ b/Source/core/html/HTMLTextFormControlElement.h
@@ -117,9 +117,12 @@
     int computeSelectionEnd() const;
     TextFieldSelectionDirection computeSelectionDirection() const;
 
+    // FIXME: Author shadows should be allowed
+    // https://bugs.webkit.org/show_bug.cgi?id=92608
+    virtual bool areAuthorShadowsAllowed() const OVERRIDE { return false; }
+
     virtual void dispatchFocusEvent(PassRefPtr<Node> oldFocusedNode, FocusDirection) OVERRIDE;
     virtual void dispatchBlurEvent(PassRefPtr<Node> newFocusedNode);
-    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
 
     // Returns true if user-editable value is empty. Used to check placeholder visibility.
     virtual bool isEmptyValue() const = 0;
diff --git a/Source/core/html/ImageDocument.cpp b/Source/core/html/ImageDocument.cpp
index db1a3d1..3b046c4 100644
--- a/Source/core/html/ImageDocument.cpp
+++ b/Source/core/html/ImageDocument.cpp
@@ -229,7 +229,7 @@
     m_imageElement->setWidth(static_cast<int>(imageSize.width() * scale));
     m_imageElement->setHeight(static_cast<int>(imageSize.height() * scale));
     
-    m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-in", false);
+    m_imageElement->setInlineStyleProperty(CSSPropertyCursor, CSSValueWebkitZoomIn);
 }
 
 void ImageDocument::imageClicked(int x, int y)
@@ -285,7 +285,7 @@
     if (imageFitsInWindow())
         m_imageElement->removeInlineStyleProperty(CSSPropertyCursor);
     else
-        m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
+        m_imageElement->setInlineStyleProperty(CSSPropertyCursor, CSSValueWebkitZoomOut);
         
     m_didShrinkImage = false;
 }
@@ -318,7 +318,7 @@
         if (fitsInWindow)
             m_imageElement->removeInlineStyleProperty(CSSPropertyCursor);
         else
-            m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
+            m_imageElement->setInlineStyleProperty(CSSPropertyCursor, CSSValueWebkitZoomOut);
         return;
     }
     
diff --git a/Source/core/html/InputType.cpp b/Source/core/html/InputType.cpp
index 57c8ad3..d100660 100644
--- a/Source/core/html/InputType.cpp
+++ b/Source/core/html/InputType.cpp
@@ -702,12 +702,6 @@
     return String();
 }
 
-Icon* InputType::icon() const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 bool InputType::shouldResetOnDocumentActivation()
 {
     return false;
diff --git a/Source/core/html/InputType.h b/Source/core/html/InputType.h
index e4f473e..0545aac 100644
--- a/Source/core/html/InputType.h
+++ b/Source/core/html/InputType.h
@@ -54,7 +54,6 @@
 class HTMLElement;
 class HTMLFormElement;
 class HTMLInputElement;
-class Icon;
 class KeyboardEvent;
 class MouseEvent;
 class Node;
@@ -243,7 +242,6 @@
     // Should return true if the given DragData has more than one dropped files.
     virtual bool receiveDroppedFiles(const DragData*);
     virtual String droppedFileSystemId();
-    virtual Icon* icon() const;
     // Should return true if the corresponding renderer for a type can display a suggested value.
     virtual bool canSetSuggestedValue();
     virtual bool shouldSendChangeEventAfterCheckedChanged();
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.cpp b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
index b270133..ebea8be 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
@@ -1191,6 +1191,25 @@
         max(rect.height(), -rect.height()));
 }
 
+static inline void clipRectsToImageRect(const FloatRect& imageRect, FloatRect* srcRect, FloatRect* dstRect)
+{
+    if (imageRect.contains(*srcRect))
+        return;
+
+    // Compute the src to dst transform
+    FloatSize scale(dstRect->size().width() / srcRect->size().width(), dstRect->size().height() / srcRect->size().height());
+    FloatPoint scaledSrcLocation = srcRect->location();
+    scaledSrcLocation.scale(scale.width(), scale.height());
+    FloatSize offset = dstRect->location() - scaledSrcLocation;
+
+    srcRect->intersect(imageRect);
+
+    // To clip the destination rectangle in the same proportion, transform the clipped src rect
+    *dstRect = *srcRect;
+    dstRect->scale(scale.width(), scale.height());
+    dstRect->move(offset);
+}
+
 void CanvasRenderingContext2D::drawImageInternal(Image* image, const FloatRect& srcRect, const FloatRect& dstRect, const CompositeOperator& op, const BlendMode& blendMode)
 {
     if (!image)
@@ -1272,9 +1291,11 @@
         ec = IndexSizeError;
         return;
     }
-    if (!imageRect.contains(normalizedSrcRect))
+    if (!imageRect.intersects(normalizedSrcRect))
         return;
 
+    clipRectsToImageRect(imageRect, &normalizedSrcRect, &actualDstRect);
+
     Image* imageForRendering = bitmap->bitmapImage();
 
     drawImageInternal(imageForRendering, normalizedSrcRect, actualDstRect, state().m_globalComposite, state().m_globalBlend);
@@ -1340,9 +1361,11 @@
         ec = IndexSizeError;
         return;
     }
-    if (!imageRect.contains(normalizedSrcRect))
+    if (!imageRect.intersects(normalizedSrcRect))
         return;
 
+    clipRectsToImageRect(imageRect, &normalizedSrcRect, &normalizedDstRect);
+
     CachedImage* cachedImage = image->cachedImage();
     if (!cachedImage)
         return;
@@ -1400,9 +1423,14 @@
 
     ec = 0;
 
-    if (!srcCanvasRect.contains(normalizeRect(srcRect)) || !dstRect.width() || !dstRect.height())
+    FloatRect normalizedSrcRect = normalizeRect(srcRect);
+    FloatRect normalizedDstRect = normalizeRect(dstRect);
+
+    if (!srcCanvasRect.intersects(normalizedSrcRect) || !normalizedDstRect.width() || !normalizedDstRect.height())
         return;
 
+    clipRectsToImageRect(srcCanvasRect, &normalizedSrcRect, &normalizedDstRect);
+
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -1423,19 +1451,19 @@
     if (!isAccelerated() || !sourceContext || !sourceContext->isAccelerated() || !sourceContext->is2d())
         sourceCanvas->makeRenderingResultsAvailable();
 
-    if (rectContainsCanvas(dstRect)) {
-        c->drawImageBuffer(buffer, dstRect, srcRect, state().m_globalComposite, state().m_globalBlend);
+    if (rectContainsCanvas(normalizedDstRect)) {
+        c->drawImageBuffer(buffer, normalizedDstRect, normalizedSrcRect, state().m_globalComposite, state().m_globalBlend);
         didDrawEntireCanvas();
     } else if (isFullCanvasCompositeMode(state().m_globalComposite)) {
-        fullCanvasCompositedDrawImage(buffer, dstRect, srcRect, state().m_globalComposite);
+        fullCanvasCompositedDrawImage(buffer, normalizedDstRect, normalizedSrcRect, state().m_globalComposite);
         didDrawEntireCanvas();
     } else if (state().m_globalComposite == CompositeCopy) {
         clearCanvas();
-        c->drawImageBuffer(buffer, dstRect, srcRect, state().m_globalComposite, state().m_globalBlend);
+        c->drawImageBuffer(buffer, normalizedDstRect, normalizedSrcRect, state().m_globalComposite, state().m_globalBlend);
         didDrawEntireCanvas();
     } else {
-        c->drawImageBuffer(buffer, dstRect, srcRect, state().m_globalComposite, state().m_globalBlend);
-        didDraw(dstRect);
+        c->drawImageBuffer(buffer, normalizedDstRect, normalizedSrcRect, state().m_globalComposite, state().m_globalBlend);
+        didDraw(normalizedDstRect);
     }
 }
 
@@ -1486,9 +1514,14 @@
         return;
     }
 
-    if (!videoRect.contains(normalizeRect(srcRect)) || !dstRect.width() || !dstRect.height())
+    FloatRect normalizedSrcRect = normalizeRect(srcRect);
+    FloatRect normalizedDstRect = normalizeRect(dstRect);
+
+    if (!videoRect.intersects(normalizedSrcRect) || !normalizedDstRect.width() || !normalizedDstRect.height())
         return;
 
+    clipRectsToImageRect(videoRect, &normalizedSrcRect, &normalizedDstRect);
+
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -1498,10 +1531,10 @@
     checkOrigin(video);
 
     GraphicsContextStateSaver stateSaver(*c);
-    c->clip(dstRect);
-    c->translate(dstRect.x(), dstRect.y());
-    c->scale(FloatSize(dstRect.width() / srcRect.width(), dstRect.height() / srcRect.height()));
-    c->translate(-srcRect.x(), -srcRect.y());
+    c->clip(normalizedDstRect);
+    c->translate(normalizedDstRect.x(), normalizedDstRect.y());
+    c->scale(FloatSize(normalizedDstRect.width() / normalizedSrcRect.width(), normalizedDstRect.height() / normalizedSrcRect.height()));
+    c->translate(-normalizedSrcRect.x(), -normalizedSrcRect.y());
     video->paintCurrentFrameInContext(c, IntRect(IntPoint(), size(video)));
     stateSaver.restore();
     didDraw(dstRect);
diff --git a/Source/core/html/shadow/DateTimeEditElement.cpp b/Source/core/html/shadow/DateTimeEditElement.cpp
index 6654f86..1573712 100644
--- a/Source/core/html/shadow/DateTimeEditElement.cpp
+++ b/Source/core/html/shadow/DateTimeEditElement.cpp
@@ -409,7 +409,7 @@
             element->appendChild(Text::create(m_editElement.document(), String(&rightToLeftMark, 1)));
     }
     element->appendChild(Text::create(m_editElement.document(), text));
-    m_editElement.fieldsWrapperElement()->appendChild(element);
+    m_editElement.fieldsWrapperElement()->appendChild(element, ASSERT_NO_EXCEPTION, AttachLazily);
 }
 
 DateTimeNumericFieldElement::Step DateTimeEditBuilder::createStep(double msPerFieldUnit, double msPerFieldSize) const
@@ -463,7 +463,7 @@
     if (m_fields.size() == m_fields.capacity())
         return;
     m_fields.append(field.get());
-    fieldsWrapperElement()->appendChild(field);
+    fieldsWrapperElement()->appendChild(field, ASSERT_NO_EXCEPTION, AttachLazily);
 }
 
 bool DateTimeEditElement::anyEditableFieldsHaveValues() const
@@ -652,7 +652,7 @@
     if (!firstChild()) {
         RefPtr<HTMLDivElement> element = HTMLDivElement::create(document());
         element->setPseudo(fieldsWrapperPseudoId);
-        appendChild(element.get());
+        appendChild(element.get(), ASSERT_NO_EXCEPTION, AttachLazily);
     }
     Element* fieldsWrapper = fieldsWrapperElement();
 
diff --git a/Source/core/html/shadow/HTMLShadowElement.cpp b/Source/core/html/shadow/HTMLShadowElement.cpp
index 71f8ef0..b692d59 100644
--- a/Source/core/html/shadow/HTMLShadowElement.cpp
+++ b/Source/core/html/shadow/HTMLShadowElement.cpp
@@ -63,7 +63,7 @@
     containingRoot->host()->ensureDistribution();
 
     ShadowRoot* older = containingRoot->olderShadowRoot();
-    if (!older || !older->shouldExposeToBindings() || ScopeContentDistribution::assignedTo(older) != this)
+    if (!older || !older->shouldExposeToBindings() || older->insertionPoint() != this)
         return 0;
 
     ASSERT(older->shouldExposeToBindings());
diff --git a/Source/core/html/shadow/MediaControlElementTypes.cpp b/Source/core/html/shadow/MediaControlElementTypes.cpp
index c012642..7eba7a7 100644
--- a/Source/core/html/shadow/MediaControlElementTypes.cpp
+++ b/Source/core/html/shadow/MediaControlElementTypes.cpp
@@ -116,6 +116,11 @@
 {
 }
 
+bool MediaControlInputElement::isMouseFocusable() const
+{
+    return false;
+}
+
 // ----------------------------
 
 MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, MediaControlElementType displayType)
diff --git a/Source/core/html/shadow/MediaControlElementTypes.h b/Source/core/html/shadow/MediaControlElementTypes.h
index 7f9296c..5a3fde8 100644
--- a/Source/core/html/shadow/MediaControlElementTypes.h
+++ b/Source/core/html/shadow/MediaControlElementTypes.h
@@ -119,6 +119,7 @@
 
 private:
     virtual void updateDisplayType() { }
+    virtual bool isMouseFocusable() const OVERRIDE;
 };
 
 // ----------------------------
diff --git a/Source/core/html/shadow/MediaControlElements.cpp b/Source/core/html/shadow/MediaControlElements.cpp
index 84f6ea9..6cc16b1 100644
--- a/Source/core/html/shadow/MediaControlElements.cpp
+++ b/Source/core/html/shadow/MediaControlElements.cpp
@@ -798,7 +798,7 @@
     float fontSize = smallestDimension * 0.05f;
     if (fontSize != m_fontSize) {
         m_fontSize = fontSize;
-        setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
+        setInlineStyleProperty(CSSPropertyFontSize, fontSize, CSSPrimitiveValue::CSS_PX);
     }
 
     CueList activeCues = mediaElement->currentlyActiveCues();
diff --git a/Source/core/html/track/InbandTextTrack.cpp b/Source/core/html/track/InbandTextTrack.cpp
index c97e193..a18d82b 100644
--- a/Source/core/html/track/InbandTextTrack.cpp
+++ b/Source/core/html/track/InbandTextTrack.cpp
@@ -156,9 +156,9 @@
         cue->setLine(lround(cueData->line()), IGNORE_EXCEPTION);
     if (cueData->size() > 0)
         cue->setSize(lround(cueData->size()), IGNORE_EXCEPTION);
-    if (cueData->backgroundColor().isValid())
+    if (cueData->backgroundColor().alpha())
         cue->setBackgroundColor(cueData->backgroundColor().rgb());
-    if (cueData->foregroundColor().isValid())
+    if (cueData->foregroundColor().alpha())
         cue->setForegroundColor(cueData->foregroundColor().rgb());
 
     if (cueData->align() == GenericCueData::Start)
diff --git a/Source/core/html/track/TextTrackCue.cpp b/Source/core/html/track/TextTrackCue.cpp
index 068e4d1..0c1a1b3 100644
--- a/Source/core/html/track/TextTrackCue.cpp
+++ b/Source/core/html/track/TextTrackCue.cpp
@@ -124,15 +124,15 @@
     setInlineStyleProperty(CSSPropertyDirection, m_cue->getCSSWritingDirection());
 
     // the 'writing-mode' property must be set to writing-mode
-    setInlineStyleProperty(CSSPropertyWebkitWritingMode, m_cue->getCSSWritingMode(), false);
+    setInlineStyleProperty(CSSPropertyWebkitWritingMode, m_cue->getCSSWritingMode());
 
     std::pair<float, float> position = m_cue->getCSSPosition();
 
     // the 'top' property must be set to top,
-    setInlineStyleProperty(CSSPropertyTop, static_cast<double>(position.second), CSSPrimitiveValue::CSS_PERCENTAGE);
+    setInlineStyleProperty(CSSPropertyTop, position.second, CSSPrimitiveValue::CSS_PERCENTAGE);
 
     // the 'left' property must be set to left
-    setInlineStyleProperty(CSSPropertyLeft, static_cast<double>(position.first), CSSPrimitiveValue::CSS_PERCENTAGE);
+    setInlineStyleProperty(CSSPropertyLeft, position.first, CSSPrimitiveValue::CSS_PERCENTAGE);
 
     // the 'width' property must be set to width, and the 'height' property  must be set to height
     if (m_cue->vertical() == horizontalKeyword()) {
diff --git a/Source/core/html/track/TextTrackCueGeneric.cpp b/Source/core/html/track/TextTrackCueGeneric.cpp
index 2b5c3d3..a7f0db2 100644
--- a/Source/core/html/track/TextTrackCueGeneric.cpp
+++ b/Source/core/html/track/TextTrackCueGeneric.cpp
@@ -61,7 +61,7 @@
 
     float size = static_cast<float>(cue->getCSSSize());
     if (cue->useDefaultPosition()) {
-        setInlineStyleProperty(CSSPropertyBottom, "0");
+        setInlineStyleProperty(CSSPropertyBottom, 0.0, CSSPrimitiveValue::CSS_PX);
         setInlineStyleProperty(CSSPropertyMarginBottom, 1.0, CSSPrimitiveValue::CSS_PERCENTAGE);
     } else {
         setInlineStyleProperty(CSSPropertyLeft, static_cast<float>(cue->position()), CSSPrimitiveValue::CSS_PERCENTAGE);
@@ -73,10 +73,10 @@
             setInlineStyleProperty(CSSPropertyHeight, size,  CSSPrimitiveValue::CSS_PERCENTAGE);
     }
 
-    if (cue->foregroundColor().isValid())
+    if (cue->foregroundColor().alpha())
         setInlineStyleProperty(CSSPropertyColor, cue->foregroundColor().serialized());
     
-    if (cue->backgroundColor().isValid())
+    if (cue->backgroundColor().alpha())
         cue->element()->setInlineStyleProperty(CSSPropertyBackgroundColor, cue->backgroundColor().serialized());
 
     if (cue->getWritingDirection() == TextTrackCue::Horizontal)
@@ -88,7 +88,7 @@
         double fontSize = videoSize.height() * cue->baseFontSizeRelativeToVideoHeight() / 100;
         if (cue->fontSizeMultiplier())
             fontSize *= cue->fontSizeMultiplier() / 100;
-        setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
+        setInlineStyleProperty(CSSPropertyFontSize, fontSize, CSSPrimitiveValue::CSS_PX);
     }
 
     if (cue->getAlignment() == TextTrackCue::Middle)
@@ -137,7 +137,7 @@
         double fontSize = videoSize.height() * baseFontSizeRelativeToVideoHeight() / 100;
         if (fontSizeMultiplier())
             fontSize *= fontSizeMultiplier() / 100;
-        displayTreeInternal()->setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
+        displayTreeInternal()->setInlineStyleProperty(CSSPropertyFontSize, fontSize, CSSPrimitiveValue::CSS_PX);
     }
 
 }
diff --git a/Source/core/html/track/TextTrackCueGeneric.h b/Source/core/html/track/TextTrackCueGeneric.h
index 4997e86..39ba418 100644
--- a/Source/core/html/track/TextTrackCueGeneric.h
+++ b/Source/core/html/track/TextTrackCueGeneric.h
@@ -60,10 +60,10 @@
     void setFontName(String name) { m_fontName = name; }
 
     Color foregroundColor() const { return m_foregroundColor; }
-    void setForegroundColor(RGBA32 color) { m_foregroundColor.setRGB(color); }
+    void setForegroundColor(Color color) { m_foregroundColor = color; }
     
     Color backgroundColor() const { return m_backgroundColor; }
-    void setBackgroundColor(RGBA32 color) { m_backgroundColor.setRGB(color); }
+    void setBackgroundColor(Color color) { m_backgroundColor = color; }
 
     virtual void videoSizeDidChange(const IntSize&);
 
diff --git a/Source/core/html/track/TextTrackRegion.cpp b/Source/core/html/track/TextTrackRegion.cpp
index 6d93be3..236f2f7 100644
--- a/Source/core/html/track/TextTrackRegion.cpp
+++ b/Source/core/html/track/TextTrackRegion.cpp
@@ -464,7 +464,7 @@
     // gradually scrolled out as multiple cues are appended to the region.
     m_cueContainer = HTMLDivElement::create(ownerDocument());
     m_cueContainer->setInlineStyleProperty(CSSPropertyTop,
-        0.0f,
+        0.0,
         CSSPrimitiveValue::CSS_PX);
 
     m_cueContainer->setPseudo(textTrackCueContainerShadowPseudoId());