changeset 8235:741607023e18

Automated merge with http://hg.openjdk.java.net/openjfx/8u20/rt
author kcr
date Thu, 31 Jul 2014 15:48:30 -0700
parents 292cf1a8bc82 28f7bb7efcfb
children 034ae49376a2 f39c67412840
files .hgtags
diffstat 65 files changed, 464 insertions(+), 211 deletions(-) [+]
line wrap: on
line diff
--- a/.hgtags	Thu Jul 31 08:05:32 2014 -0700
+++ b/.hgtags	Thu Jul 31 15:48:30 2014 -0700
@@ -170,6 +170,16 @@
 dab88dec3067cd90b67561841c0eb48c5fd58547 8u20-b21
 6bd56ba93d13e5767ea07414e013133166429f50 8u20-b22
 286ceb40550c43aecb51fc7d4cf1f461d54bca45 8u20-b23
+cb020d568ab201ec47cca5b02522e4e10450dd35 8u25-b01
+6c282cc7085f4689605e9f2dd16c1b1b72e9c72e 8u25-b02
 fb2c6cb178c1eccec458c938583f0ce086ecfc1d 8u20-b24
 d02f4bddeed4e59477b21353cb64256c270ffe00 8u20-b25
+ea5b29a762178b9a4add26b177cf9412c32bead1 8u25-b03
 e56a8bbcba203231aa4eb7ea482f4b30e169bef0 8u20-b26
+3c701047594b7f7b96cace7684a978f9290bf961 8u25-b04
+c2e5db10e5de446ddaceb23a653ae3197c8c5426 8u25-b05
+0ab73c666381a6b719462f825fd3c014ce1eadc9 8u25-b06
+5c3e2f51fb81e0501964c8f1f70556aaa71396aa 8u25-b07
+ea04246ecca8fc62b2785d44a20145aecb41d6e3 8u25-b08
+8b94e05827e0e907b8bf3f51654c641d4b8deb53 8u25-b09
+5a1b722579111945acddb750930248522ad7d5ef 8u25-b10
--- a/build.properties	Thu Jul 31 08:05:32 2014 -0700
+++ b/build.properties	Thu Jul 31 15:48:30 2014 -0700
@@ -33,10 +33,10 @@
 jfx.release.milestone=fcs
 # Note: For fcs builds the suffix should be blank
 jfx.release.suffix=
-jfx.release.name=8u20
+jfx.release.name=8u25
 jfx.release.major.version=8
 jfx.release.minor.version=0
-jfx.release.micro.version=20
+jfx.release.micro.version=25
 
 ##############################################################################
 #
--- a/modules/graphics/src/main/java/com/sun/javafx/font/PrismFontFactory.java	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/graphics/src/main/java/com/sun/javafx/font/PrismFontFactory.java	Thu Jul 31 15:48:30 2014 -0700
@@ -1566,8 +1566,7 @@
     }
 
     private synchronized PrismFontFile loadEmbeddedFont(String name, String path,
-                                                        boolean register,
-                                                        boolean copy,
+                                                        boolean register, boolean copy,
                                                         boolean tracked) {
 
         ++numEmbeddedFonts;
--- a/modules/web/src/main/native/Source/JavaScriptCore/jit/JITThunks.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/JavaScriptCore/jit/JITThunks.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -71,17 +71,17 @@
 
 NativeExecutable* JITThunks::hostFunctionStub(VM* vm, NativeFunction function, NativeFunction constructor)
 {
-    if (NativeExecutable* nativeExecutable = m_hostFunctionStubMap->get(function))
+    if (NativeExecutable* nativeExecutable = m_hostFunctionStubMap->get(std::pair<NativeFunction, NativeFunction>(function, constructor)))
         return nativeExecutable;
 
     NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, JIT::compileCTINativeCall(vm, function), function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), constructor, NoIntrinsic);
-    weakAdd(*m_hostFunctionStubMap, function, PassWeak<NativeExecutable>(nativeExecutable));
+    weakAdd(*m_hostFunctionStubMap, std::pair<NativeFunction, NativeFunction>(function, constructor), PassWeak<NativeExecutable>(nativeExecutable));
     return nativeExecutable;
 }
 
 NativeExecutable* JITThunks::hostFunctionStub(VM* vm, NativeFunction function, ThunkGenerator generator, Intrinsic intrinsic)
 {
-    if (NativeExecutable* nativeExecutable = m_hostFunctionStubMap->get(function))
+    if (NativeExecutable* nativeExecutable = m_hostFunctionStubMap->get(std::pair<NativeFunction, NativeFunction>(function, callHostFunctionAsConstructor)))
         return nativeExecutable;
 
     MacroAssemblerCodeRef code;
@@ -94,7 +94,7 @@
         code = JIT::compileCTINativeCall(vm, function);
 
     NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, code, function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), callHostFunctionAsConstructor, intrinsic);
-    weakAdd(*m_hostFunctionStubMap, function, PassWeak<NativeExecutable>(nativeExecutable));
+    weakAdd(*m_hostFunctionStubMap, std::pair<NativeFunction, NativeFunction>(function, callHostFunctionAsConstructor), PassWeak<NativeExecutable>(nativeExecutable));
     return nativeExecutable;
 }
 
--- a/modules/web/src/main/native/Source/JavaScriptCore/jit/JITThunks.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/JavaScriptCore/jit/JITThunks.h	Thu Jul 31 15:48:30 2014 -0700
@@ -64,7 +64,7 @@
 private:
     typedef HashMap<ThunkGenerator, MacroAssemblerCodeRef> CTIStubMap;
     CTIStubMap m_ctiStubMap;
-    typedef HashMap<NativeFunction, Weak<NativeExecutable> > HostFunctionStubMap;
+    typedef HashMap<pair<NativeFunction, NativeFunction>, Weak<NativeExecutable> > HostFunctionStubMap;
     OwnPtr<HostFunctionStubMap> m_hostFunctionStubMap;
 };
 
--- a/modules/web/src/main/native/Source/JavaScriptCore/runtime/JSCell.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/JavaScriptCore/runtime/JSCell.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -66,13 +66,19 @@
     return isObject() ? static_cast<const JSObject*>(this) : 0;
 }
 
-CallType JSCell::getCallData(JSCell*, CallData&)
+CallType JSCell::getCallData(JSCell*, CallData& callData)
 {
+    callData.js.functionExecutable = 0;
+    callData.js.scope = 0;
+    callData.native.function = 0;
     return CallTypeNone;
 }
 
-ConstructType JSCell::getConstructData(JSCell*, ConstructData&)
+ConstructType JSCell::getConstructData(JSCell*, ConstructData& constructData)
 {
+    constructData.js.functionExecutable = 0;
+    constructData.js.scope = 0;
+    constructData.native.function = 0;
     return ConstructTypeNone;
 }
 
--- a/modules/web/src/main/native/Source/WebCore/TargetJava.pri	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/TargetJava.pri	Thu Jul 31 15:48:30 2014 -0700
@@ -233,6 +233,7 @@
     platform/java/IDNJava.h \
     platform/java/InspectorClientJava.h \
     platform/java/JavaEnv.h \
+    platform/java/NotificationClientJava.h \
     platform/java/PlatformStrategiesJava.h \
     platform/java/RenderThemeJava.h \
     platform/java/ScrollbarThemeJava.h \
--- a/modules/web/src/main/native/Source/WebCore/accessibility/AXObjectCache.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/accessibility/AXObjectCache.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -642,7 +642,9 @@
         AccessibilityObject* obj = m_notificationsToPost[i].first.get();
         if (!obj->axObjectID())
             continue;
-
+        
+        if (!obj->axObjectCache()) 
+            continue; 
 #ifndef NDEBUG
         // Make sure none of the render views are in the process of being layed out.
         // Notifications should only be sent after the renderer has finished
--- a/modules/web/src/main/native/Source/WebCore/bindings/objc/DOM.mm	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/bindings/objc/DOM.mm	Thu Jul 31 15:48:30 2014 -0700
@@ -359,9 +359,9 @@
 {
     // FIXME: Could we move this function to WebCore::Node and autogenerate?
     WebCore::RenderObject* renderer = core(self)->renderer();
-    if (!renderer || !renderer->isImage())
+    if (!renderer || !renderer->isRenderImage())
         return nil;
-    WebCore::CachedImage* cachedImage = static_cast<WebCore::RenderImage*>(renderer)->cachedImage();
+    WebCore::CachedImage* cachedImage = toRenderImage(renderer)->cachedImage();
     if (!cachedImage || cachedImage->errorOccurred())
         return nil;
     return cachedImage->imageForRenderer(renderer)->getNSImage();
@@ -384,9 +384,9 @@
 {
     // FIXME: Could we move this function to WebCore::Element and autogenerate?
     WebCore::RenderObject* renderer = core(self)->renderer();
-    if (!renderer || !renderer->isImage())
+    if (!renderer || !renderer->isRenderImage())
         return nil;
-    WebCore::CachedImage* cachedImage = static_cast<WebCore::RenderImage*>(renderer)->cachedImage();
+    WebCore::CachedImage* cachedImage = toRenderImage(renderer)->cachedImage();
     if (!cachedImage || cachedImage->errorOccurred())
         return nil;
     return (NSData *)cachedImage->imageForRenderer(renderer)->getTIFFRepresentation();
--- a/modules/web/src/main/native/Source/WebCore/css/CSSCursorImageValue.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSCursorImageValue.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -67,8 +67,16 @@
 {
 }
 
+inline void CSSCursorImageValue::detachPendingImage()
+{
+    if (m_image && m_image->isPendingImage())
+        static_cast<StylePendingImage&>(*m_image).detachFromCSSValue();
+}
+
 CSSCursorImageValue::~CSSCursorImageValue()
 {
+    detachPendingImage();
+
 #if ENABLE(SVG)
     if (!isSVGCursor())
         return;
@@ -153,6 +161,7 @@
             RefPtr<CSSImageValue> imageValue = static_cast<CSSImageValue*>(m_imageValue.get());
         // FIXME: This will fail if the <cursor> element is in a shadow DOM (bug 59827)
             if (SVGCursorElement* cursorElement = resourceReferencedByCursorElement(imageValue->url(), loader->document())) {
+                detachPendingImage();
                 RefPtr<CSSImageValue> svgImageValue = CSSImageValue::create(cursorElement->href());
                 StyleCachedImage* cachedImage = svgImageValue->cachedImage(loader);
                 m_image = cachedImage;
@@ -161,8 +170,10 @@
     }
 #endif
 
-        if (m_imageValue->isImageValue())
+        if (m_imageValue->isImageValue()) {
+            detachPendingImage();
             m_image = static_cast<CSSImageValue*>(m_imageValue.get())->cachedImage(loader);
+        }
     }
 
     if (m_image && m_image->isCachedImage())
@@ -205,6 +216,7 @@
 
 void CSSCursorImageValue::clearCachedImage()
 {
+    detachPendingImage();
     m_image = 0;
     m_accessedImage = false;
 }
--- a/modules/web/src/main/native/Source/WebCore/css/CSSCursorImageValue.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSCursorImageValue.h	Thu Jul 31 15:48:30 2014 -0700
@@ -64,6 +64,8 @@
 private:
     CSSCursorImageValue(PassRefPtr<CSSValue> imageValue, bool hasHotSpot, const IntPoint& hotSpot);
 
+    void detachPendingImage();
+
 #if ENABLE(SVG)
     bool isSVGCursor() const;
     String cachedImageURL();
--- a/modules/web/src/main/native/Source/WebCore/css/CSSImageGeneratorValue.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSImageGeneratorValue.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -49,15 +49,17 @@
 void CSSImageGeneratorValue::addClient(RenderObject* renderer)
 {
     ASSERT(renderer);
-    ref();
+    if (m_clients.isEmpty())
+        ref();
     m_clients.add(renderer);
 }
 
 void CSSImageGeneratorValue::removeClient(RenderObject* renderer)
 {
     ASSERT(renderer);
-    m_clients.remove(renderer);
-    deref();
+    ASSERT(m_clients.contains(renderer));
+    if (m_clients.remove(renderer) && m_clients.isEmpty())
+        deref();
 }
 
 GeneratorGeneratedImage* CSSImageGeneratorValue::cachedImageForSize(IntSize size)
--- a/modules/web/src/main/native/Source/WebCore/css/CSSImageSetValue.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSImageSetValue.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -49,8 +49,15 @@
 {
 }
 
+inline void CSSImageSetValue::detachPendingImage()
+{
+    if (m_imageSet && m_imageSet->isPendingImage())
+        static_cast<StylePendingImage&>(*m_imageSet).detachFromCSSValue();
+}
+
 CSSImageSetValue::~CSSImageSetValue()
 {
+    detachPendingImage();
     if (m_imageSet && m_imageSet->isCachedImageSet())
         static_cast<StyleCachedImageSet*>(m_imageSet.get())->clearImageSetValue();
 }
@@ -114,6 +121,7 @@
         CachedResourceRequest request(ResourceRequest(document->completeURL(image.imageURL)));
         request.setInitiator(cachedResourceRequestInitiators().css);
         if (CachedResourceHandle<CachedImage> cachedImage = loader->requestImage(request)) {
+            detachPendingImage();
             m_imageSet = StyleCachedImageSet::create(cachedImage.get(), image.scaleFactor, this);
             m_accessedBestFitImage = true;
         }
--- a/modules/web/src/main/native/Source/WebCore/css/CSSImageSetValue.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSImageSetValue.h	Thu Jul 31 15:48:30 2014 -0700
@@ -71,6 +71,8 @@
     CSSImageSetValue();
     CSSImageSetValue(const CSSImageSetValue& cloneFrom);
 
+    void detachPendingImage();
+
     void fillImageSet();
     static inline bool compareByScaleFactor(ImageWithScale first, ImageWithScale second) { return first.scaleFactor < second.scaleFactor; }
 
--- a/modules/web/src/main/native/Source/WebCore/css/CSSImageValue.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSImageValue.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -51,8 +51,16 @@
 {
 }
 
+inline void CSSImageValue::detachPendingImage()
+{
+    if (m_image && m_image->isPendingImage())
+        static_cast<StylePendingImage&>(*m_image).detachFromCSSValue();
+}
+
+
 CSSImageValue::~CSSImageValue()
 {
+    detachPendingImage();
 }
 
 StyleImage* CSSImageValue::cachedOrPendingImage()
@@ -75,8 +83,10 @@
             request.setInitiator(cachedResourceRequestInitiators().css);
         else
             request.setInitiator(m_initiatorName);
-        if (CachedResourceHandle<CachedImage> cachedImage = loader->requestImage(request))
+        if (CachedResourceHandle<CachedImage> cachedImage = loader->requestImage(request)) {
+            detachPendingImage();
             m_image = StyleCachedImage::create(cachedImage.get());
+        }
     }
 
     return (m_image && m_image->isCachedImage()) ? static_cast<StyleCachedImage*>(m_image.get()) : 0;
--- a/modules/web/src/main/native/Source/WebCore/css/CSSImageValue.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSImageValue.h	Thu Jul 31 15:48:30 2014 -0700
@@ -59,6 +59,7 @@
 private:
     explicit CSSImageValue(const String& url);
     CSSImageValue(const String& url, StyleImage*);
+    void detachPendingImage();
 
     String m_url;
     RefPtr<StyleImage> m_image;
--- a/modules/web/src/main/native/Source/WebCore/css/CSSParser.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/CSSParser.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1288,8 +1288,10 @@
     RefPtr<MutableStylePropertySet> dummyStyle = MutableStylePropertySet::create();
     if (!parseValue(dummyStyle.get(), CSSPropertyFontFamily, string, false, CSSQuirksMode, 0))
         return 0;
-    return static_pointer_cast<CSSValueList>(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily));
-}
+    RefPtr<CSSValue> fontFamily = dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily); 
+    if (!fontFamily->isValueList()) 
+ 	return 0; // FIXME: "initial" and "inherit" should be parsed as font names in the face attribute. 
+    return static_pointer_cast<CSSValueList>(fontFamily.release()); }
 
 #if ENABLE(CSS_VARIABLES)
 bool CSSParser::parseValue(MutableStylePropertySet* declaration, CSSPropertyID propertyID, const String& string, bool important, Document* document)
@@ -1940,9 +1942,9 @@
 
     case CSSPropertyTextAlign:
         // left | right | center | justify | -webkit-left | -webkit-right | -webkit-center | -webkit-match-parent
-        // | start | end | <string> | inherit | -webkit-auto (converted to start)
-        if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitMatchParent) || id == CSSValueStart || id == CSSValueEnd
-            || value->unit == CSSPrimitiveValue::CSS_STRING)
+        // | start | end | inherit | -webkit-auto (converted to start)
+        // NOTE: <string> is not supported. 
+        if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitMatchParent) || id == CSSValueStart || id == CSSValueEnd)
             validPrimitive = true;
         break;
 
--- a/modules/web/src/main/native/Source/WebCore/css/DeprecatedStyleBuilder.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/css/DeprecatedStyleBuilder.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1218,6 +1218,7 @@
             return;
 
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        ASSERT(primitiveValue->isValueID());
 
         if (primitiveValue->getIdent() != CSSValueWebkitMatchParent)
             styleResolver->style()->setTextAlign(*primitiveValue);
--- a/modules/web/src/main/native/Source/WebCore/dom/ContainerNode.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/ContainerNode.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -460,8 +460,6 @@
     NodeVector children;
     getChildNodes(container, children);
 
-    container->document()->nodeChildrenWillBeRemoved(container);
-
     ChildListMutationScope mutation(container);
     for (NodeVector::const_iterator it = children.begin(); it != children.end(); ++it) {
         Node* child = it->get();
@@ -472,6 +470,8 @@
         dispatchChildRemovalEvents(child);
     }
 
+    container->document()->nodeChildrenWillBeRemoved(container);
+
     ChildFrameDisconnector(container).disconnect(ChildFrameDisconnector::DescendantsOnly);
 }
 
--- a/modules/web/src/main/native/Source/WebCore/dom/Document.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/Document.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1802,7 +1802,6 @@
     
     RefPtr<FrameView> frameView = view();
     if (frameView) {
-        frameView->pauseScheduledEvents();
         frameView->beginDeferredRepaints();
     }
 
@@ -1849,7 +1848,6 @@
             m_styleSheetCollection->resetCSSFeatureFlags();
 
     if (frameView) {
-        frameView->resumeScheduledEvents();
         frameView->endDeferredRepaints();
     }
     }
@@ -3686,6 +3684,11 @@
     m_eventQueue->enqueueEvent(event);
 }
 
+void Document::enqueueOverflowEvent(PassRefPtr<Event> event)
+{
+    m_eventQueue->enqueueEvent(event);
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     RefPtr<Event> event = EventFactory::create(eventType);
--- a/modules/web/src/main/native/Source/WebCore/dom/Document.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/Document.h	Thu Jul 31 15:48:30 2014 -0700
@@ -1024,6 +1024,7 @@
 
     void enqueueWindowEvent(PassRefPtr<Event>);
     void enqueueDocumentEvent(PassRefPtr<Event>);
+    void enqueueOverflowEvent(PassRefPtr<Event>);
     void enqueuePageshowEvent(PageshowEventPersistence);
     void enqueueHashchangeEvent(const String& oldURL, const String& newURL);
     void enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject);
--- a/modules/web/src/main/native/Source/WebCore/dom/DocumentOrderedMap.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/DocumentOrderedMap.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -106,6 +106,9 @@
     m_map.checkConsistency();
     Map::iterator it = m_map.find(key);
     ASSERT(it != m_map.end());
+    if (it == m_map.end())
+        return;
+
     MapEntry& entry = it->value;
 
     ASSERT(entry.count);
--- a/modules/web/src/main/native/Source/WebCore/dom/MutationObserver.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/MutationObserver.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -129,7 +129,7 @@
     m_records.clear();
     HashSet<MutationObserverRegistration*> registrations(m_registrations);
     for (HashSet<MutationObserverRegistration*>::iterator iter = registrations.begin(); iter != registrations.end(); ++iter)
-        (*iter)->unregister();
+        MutationObserverRegistration::unregisterAndDelete(*iter);
 }
 
 void MutationObserver::observationStarted(MutationObserverRegistration* registration)
--- a/modules/web/src/main/native/Source/WebCore/dom/MutationObserverRegistration.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/MutationObserverRegistration.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -98,10 +98,11 @@
     m_registrationNodeKeepAlive = 0; // Balanced in observeSubtreeNodeWillDetach.
 }
 
-void MutationObserverRegistration::unregister()
+void MutationObserverRegistration::unregisterAndDelete(MutationObserverRegistration* registry)
 {
-    m_registrationNode->unregisterMutationObserver(this);
-    // The above line will cause this object to be deleted, so don't do any more in this function.
+        RefPtr<Node> registrationNode(registry->m_registrationNode); 
+ 	registrationNode->unregisterMutationObserver(registry); 
+ 	// The above line will cause registry to be deleted, so don't do any more in this function. 
 }
 
 bool MutationObserverRegistration::shouldReceiveMutationFrom(Node* node, MutationObserver::MutationType type, const QualifiedName* attributeName) const
--- a/modules/web/src/main/native/Source/WebCore/dom/MutationObserverRegistration.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/MutationObserverRegistration.h	Thu Jul 31 15:48:30 2014 -0700
@@ -49,7 +49,7 @@
     void observedSubtreeNodeWillDetach(Node*);
     void clearTransientRegistrations();
     bool hasTransientRegistrations() const { return m_transientRegistrationNodes && !m_transientRegistrationNodes->isEmpty(); }
-    void unregister();
+    static void unregisterAndDelete(MutationObserverRegistration*);
 
     bool shouldReceiveMutationFrom(Node*, MutationObserver::MutationType, const QualifiedName* attributeName) const;
     bool isSubtree() const { return m_options & MutationObserver::Subtree; }
--- a/modules/web/src/main/native/Source/WebCore/dom/TemplateContentDocumentFragment.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/dom/TemplateContentDocumentFragment.h	Thu Jul 31 15:48:30 2014 -0700
@@ -41,6 +41,7 @@
     }
 
     const Element* host() const { return m_host; }
+    void clearHost() { m_host = 0; }
 
 private:
     TemplateContentDocumentFragment(Document* document, const Element* host)
--- a/modules/web/src/main/native/Source/WebCore/editing/CompositeEditCommand.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/editing/CompositeEditCommand.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1009,7 +1009,7 @@
         appendNode(lastNode, blockElement);
     }
 
-    if (start.deprecatedNode() != outerNode && lastNode->isElementNode()) {
+    if (start.deprecatedNode() != outerNode && lastNode->isElementNode() && start.anchorNode()->isDescendantOf(outerNode.get())) {
         Vector<RefPtr<Node> > ancestors;
         
         // Insert each node from innerNode to outerNode (excluded) in a list.
--- a/modules/web/src/main/native/Source/WebCore/editing/FrameSelection.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/editing/FrameSelection.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1705,6 +1705,8 @@
 {
     bool activeAndFocused = isFocusedAndActive();
 
+    m_frame->document()->updateStyleIfNeeded();
+
     // Because RenderObject::selectionBackgroundColor() and
     // RenderObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
@@ -1722,7 +1724,7 @@
     // Because StyleResolver::checkOneSelector() and
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
-    if (Node* node = m_frame->document()->focusedNode()) {
+    if (Node* node = m_frame->document()->focusedElement()) {
         node->setNeedsStyleRecalc();
         if (RenderObject* renderer = node->renderer())
             if (renderer && renderer->style()->hasAppearance())
@@ -1935,6 +1937,10 @@
 
 FloatRect FrameSelection::bounds(bool clipToVisibleContent) const
 {
+    if (!m_frame->document())
+        return LayoutRect();
+
+    m_frame->document()->updateStyleIfNeeded();
     RenderView* root = m_frame->contentRenderer();
     FrameView* view = m_frame->view();
     if (!root || !view)
--- a/modules/web/src/main/native/Source/WebCore/editing/ReplaceSelectionCommand.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/editing/ReplaceSelectionCommand.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -989,22 +989,22 @@
     // NOTE: This would be an incorrect usage of downstream() if downstream() were changed to mean the last position after 
     // p that maps to the same visible position as p (since in the case where a br is at the end of a block and collapsed 
     // away, there are positions after the br which map to the same visible position as [br, 0]).  
-    Node* endBR = insertionPos.downstream().deprecatedNode()->hasTagName(brTag) ? insertionPos.downstream().deprecatedNode() : 0;
+    RefPtr<Node> endBR = insertionPos.downstream().deprecatedNode()->hasTagName(brTag) ? insertionPos.downstream().deprecatedNode() : 0;
     VisiblePosition originalVisPosBeforeEndBR;
     if (endBR)
-        originalVisPosBeforeEndBR = VisiblePosition(positionBeforeNode(endBR), DOWNSTREAM).previous();
+        originalVisPosBeforeEndBR = VisiblePosition(positionBeforeNode(endBR.get()), DOWNSTREAM).previous();
     
-    startBlock = enclosingBlock(insertionPos.deprecatedNode());
+    RefPtr<Node> insertionBlock = enclosingBlock(insertionPos.deprecatedNode());
     
     // Adjust insertionPos to prevent nesting.
     // If the start was in a Mail blockquote, we will have already handled adjusting insertionPos above.
-    if (m_preventNesting && startBlock && !isTableCell(startBlock) && !startIsInsideMailBlockquote) {
-        ASSERT(startBlock != currentRoot);
+    if (m_preventNesting && startBlock && !isTableCell(insertionBlock.get()) && !startIsInsideMailBlockquote) {
+        ASSERT(insertionBlock != currentRoot);
         VisiblePosition visibleInsertionPos(insertionPos);
         if (isEndOfBlock(visibleInsertionPos) && !(isStartOfBlock(visibleInsertionPos) && fragment.hasInterchangeNewlineAtEnd()))
-            insertionPos = positionInParentAfterNode(startBlock);
+            insertionPos = positionInParentAfterNode(insertionBlock.get());
         else if (isStartOfBlock(visibleInsertionPos))
-            insertionPos = positionInParentBeforeNode(startBlock);
+            insertionPos = positionInParentBeforeNode(insertionBlock.get());
     }
     
     // Paste at start or end of link goes outside of link.
@@ -1115,14 +1115,14 @@
 
     VisiblePosition startOfInsertedContent = firstPositionInOrBeforeNode(insertedNodes.firstNodeInserted());
 
-    // We inserted before the startBlock to prevent nesting, and the content before the startBlock wasn't in its own block and
+    // We inserted before the insertionBlock to prevent nesting, and the content before the startBlock wasn't in its own block and
     // didn't have a br after it, so the inserted content ended up in the same paragraph.
-    if (startBlock && insertionPos.deprecatedNode() == startBlock->parentNode() && (unsigned)insertionPos.deprecatedEditingOffset() < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
+    if (insertionBlock && insertionPos.deprecatedNode() == insertionBlock->parentNode() && (unsigned)insertionPos.deprecatedEditingOffset() < insertionBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
         insertNodeAt(createBreakElement(document()).get(), startOfInsertedContent.deepEquivalent());
 
-    if (endBR && (plainTextFragment || shouldRemoveEndBR(endBR, originalVisPosBeforeEndBR))) {
+    if (endBR && (plainTextFragment || shouldRemoveEndBR(endBR.get(), originalVisPosBeforeEndBR))) {
         RefPtr<Node> parent = endBR->parentNode();
-        insertedNodes.willRemoveNode(endBR);
+        insertedNodes.willRemoveNode(endBR.get());
         removeNode(endBR);
         if (Node* nodeToRemove = highestNodeToRemoveInPruning(parent.get())) {
             insertedNodes.willRemoveNode(nodeToRemove);
--- a/modules/web/src/main/native/Source/WebCore/editing/mac/EditorMac.mm	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/editing/mac/EditorMac.mm	Thu Jul 31 15:48:30 2014 -0700
@@ -276,11 +276,15 @@
 
 String Editor::stringSelectionForPasteboard()
 {
+    if (!canCopy())
+        return "";
     return Pasteboard::getStringSelection(m_frame, DefaultSelectedTextType);
 }
 
 PassRefPtr<SharedBuffer> Editor::dataSelectionForPasteboard(const String& pasteboardType)
 {
+    if (!canCopy())
+        return 0;
     return Pasteboard::getDataSelection(m_frame, pasteboardType);
 }
 
--- a/modules/web/src/main/native/Source/WebCore/html/FormAssociatedElement.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/FormAssociatedElement.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -179,7 +179,8 @@
         m_formAttributeTargetObserver = nullptr;
     } else {
         resetFormOwner();
-        resetFormAttributeTargetObserver();
+        if (element->inDocument()) 
+            resetFormAttributeTargetObserver();
     }
 }
 
--- a/modules/web/src/main/native/Source/WebCore/html/HTMLAreaElement.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/HTMLAreaElement.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -221,7 +221,7 @@
         return;
 
     RenderObject* renderer = imageElement->renderer();
-    if (!renderer || !renderer->isImage())
+    if (!renderer || !renderer->isRenderImage())
         return;
 
     toRenderImage(renderer)->areaElementFocusChanged(this);
--- a/modules/web/src/main/native/Source/WebCore/html/HTMLImageElement.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/HTMLImageElement.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -111,7 +111,7 @@
 void HTMLImageElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == altAttr) {
-        if (renderer() && renderer()->isImage())
+        if (renderer() && renderer()->isRenderImage())
             toRenderImage(renderer())->updateAltText();
     } else if (name == srcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
@@ -176,7 +176,7 @@
 {
     HTMLElement::attach();
 
-    if (renderer() && renderer()->isImage() && !m_imageLoader.hasPendingBeforeLoadEvent()) {
+    if (renderer() && renderer()->isRenderImage() && !m_imageLoader.hasPendingBeforeLoadEvent()) {
         RenderImage* renderImage = toRenderImage(renderer());
         RenderImageResource* renderImageResource = renderImage->imageResource();
         if (renderImageResource->hasImage())
@@ -203,12 +203,16 @@
         }
     }
 
+    // Insert needs to complete first, before we start updating the loader. Loader dispatches events which could result
+    // in callbacks back to this node.
+    Node::InsertionNotificationRequest insertNotificationRequest = HTMLElement::insertedInto(insertionPoint);
+
     // If we have been inserted from a renderer-less document,
     // our loader may have not fetched the image, so do it now.
     if (insertionPoint->inDocument() && !m_imageLoader.image())
         m_imageLoader.updateFromElement();
 
-    return HTMLElement::insertedInto(insertionPoint);
+    return insertNotificationRequest;
 }
 
 void HTMLImageElement::removedFrom(ContainerNode* insertionPoint)
--- a/modules/web/src/main/native/Source/WebCore/html/HTMLMediaElement.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/HTMLMediaElement.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -369,8 +369,10 @@
     }
 #endif
 
-    if (m_mediaController)
+    if (m_mediaController) {
         m_mediaController->removeMediaElement(this);
+        m_mediaController = 0;
+    }
 
 #if ENABLE(MEDIA_SOURCE)
     setSourceState(MediaSource::closedKeyword());
--- a/modules/web/src/main/native/Source/WebCore/html/HTMLTemplateElement.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/HTMLTemplateElement.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -51,6 +51,8 @@
 
 HTMLTemplateElement::~HTMLTemplateElement()
 {
+    if (m_content)
+        m_content->clearHost();
 }
 
 PassRefPtr<HTMLTemplateElement> HTMLTemplateElement::create(const QualifiedName& tagName, Document* document)
--- a/modules/web/src/main/native/Source/WebCore/html/HTMLTemplateElement.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/HTMLTemplateElement.h	Thu Jul 31 15:48:30 2014 -0700
@@ -38,6 +38,9 @@
 
 namespace WebCore {
 
+class DocumentFragment;
+class TemplateContentDocumentFragment;
+
 class HTMLTemplateElement FINAL : public HTMLElement {
 public:
     static PassRefPtr<HTMLTemplateElement> create(const QualifiedName&, Document*);
@@ -51,7 +54,7 @@
 
     HTMLTemplateElement(const QualifiedName&, Document*);
 
-    mutable RefPtr<DocumentFragment> m_content;
+    mutable RefPtr<TemplateContentDocumentFragment> m_content;
 };
 
 const HTMLTemplateElement* toHTMLTemplateElement(const Node*);
--- a/modules/web/src/main/native/Source/WebCore/html/parser/HTMLConstructionSite.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/parser/HTMLConstructionSite.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -80,13 +80,16 @@
     return string.isAllSpecialCharacters<isHTMLSpace>();
 }
 
-static inline void executeTask(HTMLConstructionSiteTask& task)
+static inline void insert(HTMLConstructionSiteTask& task) 
 {
 #if ENABLE(TEMPLATE_ELEMENT)
     if (task.parent->hasTagName(templateTag))
         task.parent = toHTMLTemplateElement(task.parent.get())->content();
 #endif
 
+    if (ContainerNode* parent = task.child->parentNode()) 
+        parent->parserRemoveChild(task.child.get());
+
     if (task.nextChild)
         task.parent->parserInsertBefore(task.child.get(), task.nextChild.get());
     else
@@ -98,18 +101,72 @@
     if (task.child->parentNode() && task.parent->attached() && !task.child->attached())
         task.child->attach();
 
+} 
+
+static inline void executeInsertTask(HTMLConstructionSiteTask& task) 
+{ 
+    ASSERT(task.operation == HTMLConstructionSiteTask::Insert); 
+
+    insert(task); 
+
     task.child->beginParsingChildren();
 
     if (task.selfClosing)
         task.child->finishParsingChildren();
 }
 
+static inline void executeReparentTask(HTMLConstructionSiteTask& task)
+{
+    ASSERT(task.operation == HTMLConstructionSiteTask::Reparent);
+
+    if (ContainerNode* parent = task.child->parentNode())
+        parent->parserRemoveChild(task.child.get());
+
+    task.parent->parserAppendChild(task.child.get());
+}
+
+static inline void executeInsertAlreadyParsedChildTask(HTMLConstructionSiteTask& task)
+{
+    ASSERT(task.operation == HTMLConstructionSiteTask::InsertAlreadyParsedChild);
+
+    insert(task);
+}
+
+static inline void executeTakeAllChildrenTask(HTMLConstructionSiteTask& task)
+{
+    ASSERT(task.operation == HTMLConstructionSiteTask::TakeAllChildren);
+
+    task.parent->takeAllChildrenFrom(task.oldParent());
+    // Notice that we don't need to manually attach the moved children
+    // because takeAllChildrenFrom does that work for us.
+}
+
+static inline void executeTask(HTMLConstructionSiteTask& task)
+{
+    switch (task.operation) {
+    case HTMLConstructionSiteTask::Insert:
+        executeInsertTask(task);
+        return;
+    // All the cases below this point are only used by the adoption agency.
+    case HTMLConstructionSiteTask::InsertAlreadyParsedChild:
+        executeInsertAlreadyParsedChildTask(task);
+        return;
+    case HTMLConstructionSiteTask::Reparent:
+        executeReparentTask(task);
+        return;
+    case HTMLConstructionSiteTask::TakeAllChildren:
+        executeTakeAllChildrenTask(task);
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
 void HTMLConstructionSite::attachLater(ContainerNode* parent, PassRefPtr<Node> prpChild, bool selfClosing)
 {
     ASSERT(scriptingContentIsAllowed(m_parserContentPolicy) || !prpChild.get()->isElementNode() || !toScriptElementIfPossible(toElement(prpChild.get())));
     ASSERT(pluginContentIsAllowed(m_parserContentPolicy) || !prpChild->isPluginElement());
 
-    HTMLConstructionSiteTask task;
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::Insert); 
     task.parent = parent;
     task.child = prpChild;
     task.selfClosing = selfClosing;
@@ -124,19 +181,19 @@
         task.parent = task.parent->parentNode();
 
     ASSERT(task.parent);
-    m_attachmentQueue.append(task);
+    m_taskQueue.append(task);
 }
 
 void HTMLConstructionSite::executeQueuedTasks()
 {
-    const size_t size = m_attachmentQueue.size();
+    const size_t size = m_taskQueue.size(); 
     if (!size)
         return;
 
     // Copy the task queue into a local variable in case executeTask
     // re-enters the parser.
-    AttachmentQueue queue;
-    queue.swap(m_attachmentQueue);
+    TaskQueue queue;
+    queue.swap(m_taskQueue);
 
     for (size_t i = 0; i < size; ++i)
         executeTask(queue[i]);
@@ -473,7 +530,7 @@
 
 void HTMLConstructionSite::insertTextNode(const String& characters, WhitespaceMode whitespaceMode)
 {
-    HTMLConstructionSiteTask task;
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::Insert);
     task.parent = currentNode();
 
     if (shouldFosterParent())
@@ -518,6 +575,43 @@
     }
 }
 
+void HTMLConstructionSite::reparent(HTMLElementStack::ElementRecord& newParent, HTMLElementStack::ElementRecord& child)
+{
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::Reparent);
+    task.parent = newParent.node();
+    task.child = child.element();
+    m_taskQueue.append(task);
+}
+
+void HTMLConstructionSite::reparent(HTMLElementStack::ElementRecord& newParent, HTMLStackItem& child)
+{
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::Reparent);
+    task.parent = newParent.node();
+    task.child = child.element();
+    m_taskQueue.append(task);
+}
+
+void HTMLConstructionSite::insertAlreadyParsedChild(HTMLStackItem& newParent, HTMLElementStack::ElementRecord& child)
+{
+    if (newParent.causesFosterParenting()) {
+        fosterParent(child.element());
+        return;
+    }
+
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::InsertAlreadyParsedChild);
+    task.parent = newParent.node();
+    task.child = child.element();
+    m_taskQueue.append(task);
+}
+
+void HTMLConstructionSite::takeAllChildren(HTMLStackItem& newParent, HTMLElementStack::ElementRecord& oldParent)
+{
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::TakeAllChildren);
+    task.parent = newParent.node();
+    task.child = oldParent.node();
+    m_taskQueue.append(task);
+}
+
 PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken* token, const AtomicString& namespaceURI)
 {
     QualifiedName tagName(nullAtom, token->name(), namespaceURI);
@@ -653,12 +747,12 @@
 
 void HTMLConstructionSite::fosterParent(PassRefPtr<Node> node)
 {
-    HTMLConstructionSiteTask task;
+    HTMLConstructionSiteTask task(HTMLConstructionSiteTask::Insert); 
     findFosterSite(task);
     task.child = node;
     ASSERT(task.parent);
 
-    m_attachmentQueue.append(task);
+    m_taskQueue.append(task);
 }
 
 }
--- a/modules/web/src/main/native/Source/WebCore/html/parser/HTMLConstructionSite.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/parser/HTMLConstructionSite.h	Thu Jul 31 15:48:30 2014 -0700
@@ -39,11 +39,28 @@
 namespace WebCore {
 
 struct HTMLConstructionSiteTask {
-    HTMLConstructionSiteTask()
-        : selfClosing(false)
+    enum Operation {
+        Insert,
+        InsertAlreadyParsedChild,
+        Reparent,
+        TakeAllChildren,
+    };    
+
+    explicit HTMLConstructionSiteTask(Operation op)
+        : operation(op)
+        , selfClosing(false)
     {
     }
 
+    ContainerNode* oldParent()
+    {
+        // It's sort of ugly, but we store the |oldParent| in the |child| field
+        // of the task so that we don't bloat the HTMLConstructionSiteTask
+        // object in the common case of the Insert operation.
+        return toContainerNode(child.get());
+    }
+
+    Operation operation;
     RefPtr<ContainerNode> parent;
     RefPtr<Node> nextChild;
     RefPtr<Node> child;
@@ -100,6 +117,14 @@
     void insertHTMLHtmlStartTagInBody(AtomicHTMLToken*);
     void insertHTMLBodyStartTagInBody(AtomicHTMLToken*);
 
+    void reparent(HTMLElementStack::ElementRecord& newParent, HTMLElementStack::ElementRecord& child);
+    void reparent(HTMLElementStack::ElementRecord& newParent, HTMLStackItem& child);
+    // insertAlreadyParsedChild assumes that |child| has already been parsed (i.e., we're just
+    // moving it around in the tree rather than parsing it for the first time). That means
+    // this function doesn't call beginParsingChildren / finishParsingChildren.
+    void insertAlreadyParsedChild(HTMLStackItem& newParent, HTMLElementStack::ElementRecord& child);
+    void takeAllChildren(HTMLStackItem& newParent, HTMLElementStack::ElementRecord& oldParent);
+
     PassRefPtr<HTMLStackItem> createElementFromSavedToken(HTMLStackItem*);
 
     bool shouldFosterParent() const;
@@ -156,7 +181,7 @@
 private:
     // In the common case, this queue will have only one task because most
     // tokens produce only one DOM mutation.
-    typedef Vector<HTMLConstructionSiteTask, 1> AttachmentQueue;
+    typedef Vector<HTMLConstructionSiteTask, 1> TaskQueue;
 
     void setCompatibilityMode(Document::CompatibilityMode);
     void setCompatibilityModeFromDoctype(const String& name, const String& publicId, const String& systemId);
@@ -183,7 +208,7 @@
     mutable HTMLElementStack m_openElements;
     mutable HTMLFormattingElementList m_activeFormattingElements;
 
-    AttachmentQueue m_attachmentQueue;
+    TaskQueue m_taskQueue;
 
     ParserContentPolicy m_parserContentPolicy;
     bool m_isParsingFragment;
--- a/modules/web/src/main/native/Source/WebCore/html/parser/HTMLTreeBuilder.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/parser/HTMLTreeBuilder.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1595,49 +1595,18 @@
             if (lastNode == furthestBlock)
                 bookmark.moveToAfter(nodeEntry);
             // 9.9
-            if (ContainerNode* parent = lastNode->element()->parentNode())
-                parent->parserRemoveChild(lastNode->element());
-            node->element()->parserAppendChild(lastNode->element());
-            if (lastNode->element()->parentElement()->attached() && !lastNode->element()->attached())
-                lastNode->element()->lazyAttach();
+	    m_tree.reparent(*node, *lastNode);
             // 9.10
             lastNode = node;
         }
         // 10.
-        if (ContainerNode* parent = lastNode->element()->parentNode())
-            parent->parserRemoveChild(lastNode->element());
-        if (commonAncestor->causesFosterParenting())
-            m_tree.fosterParent(lastNode->element());
-        else {
-#if ENABLE(TEMPLATE_ELEMENT)
-            if (commonAncestor->hasTagName(templateTag))
-                toHTMLTemplateElement(commonAncestor->node())->content()->parserAppendChild(lastNode->element());
-            else
-                commonAncestor->node()->parserAppendChild(lastNode->element());
-#else
-            commonAncestor->node()->parserAppendChild(lastNode->element());
-#endif
-            ASSERT(lastNode->stackItem()->isElementNode());
-            ASSERT(lastNode->element()->parentNode());
-            if (lastNode->element()->parentNode()->attached() && !lastNode->element()->attached())
-                lastNode->element()->lazyAttach();
-        }
+	m_tree.insertAlreadyParsedChild(*commonAncestor, *lastNode);
         // 11.
         RefPtr<HTMLStackItem> newItem = m_tree.createElementFromSavedToken(formattingElementRecord->stackItem().get());
         // 12.
-        newItem->element()->takeAllChildrenFrom(furthestBlock->element());
+	m_tree.takeAllChildren(*newItem, *furthestBlock);
         // 13.
-        Element* furthestBlockElement = furthestBlock->element();
-        // FIXME: All this creation / parserAppendChild / attach business should
-        //        be in HTMLConstructionSite. My guess is that steps 11--15
-        //        should all be in some HTMLConstructionSite function.
-        furthestBlockElement->parserAppendChild(newItem->element());
-        // FIXME: Why is this attach logic necessary? Style resolve should attach us if needed.
-        if (furthestBlockElement->attached() && !newItem->element()->attached()) {
-            // Notice that newItem->element() might already be attached if, for example, one of the reparented
-            // children is a style element, which attaches itself automatically.
-            newItem->element()->attach();
-        }
+	m_tree.reparent(*furthestBlock, *newItem); 
         // 14.
         m_tree.activeFormattingElements()->swapTo(formattingElement, newItem, bookmark);
         // 15.
--- a/modules/web/src/main/native/Source/WebCore/html/shadow/SliderThumbElement.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/html/shadow/SliderThumbElement.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -224,17 +224,20 @@
 
 bool SliderThumbElement::isDisabledFormControl() const
 {
-    return hostInput()->isDisabledFormControl();
+    HTMLInputElement* input = hostInput();
+    return !input || input->isDisabledFormControl();
 }
 
 bool SliderThumbElement::matchesReadOnlyPseudoClass() const
 {
-    return hostInput()->matchesReadOnlyPseudoClass();
+    HTMLInputElement* input = hostInput();
+    return input && input->matchesReadOnlyPseudoClass();
 }
 
 bool SliderThumbElement::matchesReadWritePseudoClass() const
 {
-    return hostInput()->matchesReadWritePseudoClass();
+    HTMLInputElement* input = hostInput();
+    return input && input->matchesReadWritePseudoClass();
 }
 
 Element* SliderThumbElement::focusDelegate()
@@ -244,21 +247,22 @@
 
 void SliderThumbElement::dragFrom(const LayoutPoint& point)
 {
+    RefPtr<SliderThumbElement> protect(this);
     setPositionFromPoint(point);
     startDragging();
 }
 
 void SliderThumbElement::setPositionFromPoint(const LayoutPoint& point)
 {
-    HTMLInputElement* input = hostInput();
-    HTMLElement* trackElement = sliderTrackElementOf(input);
+    RefPtr<HTMLInputElement> input(hostInput());
+    HTMLElement* trackElement = sliderTrackElementOf(input.get());
 
     if (!input->renderer() || !renderBox() || !trackElement->renderBox())
         return;
 
     input->setTextAsOfLastFormControlChangeEvent(input->value());
     LayoutPoint offset = roundedLayoutPoint(input->renderer()->absoluteToLocal(point, UseTransforms));
-    bool isVertical = hasVerticalAppearance(input);
+    bool isVertical = hasVerticalAppearance(input.get());
     bool isLeftToRightDirection = renderBox()->style()->isLeftToRightDirection();
     LayoutUnit trackSize;
     LayoutUnit position;
@@ -307,7 +311,8 @@
 
     // FIXME: This is no longer being set from renderer. Consider updating the method name.
     input->setValueFromRenderer(valueString);
-    renderer()->setNeedsLayout(true);
+    if (renderer())
+        renderer()->setNeedsLayout(true);
     input->dispatchFormControlChangeEvent();
 }
 
@@ -400,7 +405,8 @@
 {
     // Only HTMLInputElement creates SliderThumbElement instances as its shadow nodes.
     // So, shadowHost() must be an HTMLInputElement.
-    return shadowHost()->toInputElement();
+    Element* host = shadowHost();
+    return host ? host->toInputElement() : 0;
 }
 
 static const AtomicString& sliderThumbShadowPseudoId()
--- a/modules/web/src/main/native/Source/WebCore/loader/ImageLoader.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/loader/ImageLoader.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -212,8 +212,9 @@
             clearFailedLoadURL();
     } else if (!attr.isNull()) {
         // Fire an error event if the url is empty.
-        // FIXME: Should we fire this event asynchronoulsy via errorEventSender()?
-        m_element->dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+        m_failedLoadURL = attr;
+        m_hasPendingErrorEvent = true;
+        errorEventSender().dispatchEventSoon(this);
     }
     
     CachedImage* oldImage = m_image.get();
@@ -325,7 +326,7 @@
 
     // We don't return style generated image because it doesn't belong to the ImageLoader.
     // See <https://bugs.webkit.org/show_bug.cgi?id=42840>
-    if (renderer->isImage() && !static_cast<RenderImage*>(renderer)->isGeneratedContent())
+    if (renderer->isRenderImage() && !static_cast<RenderImage*>(renderer)->isGeneratedContent())
         return toRenderImage(renderer)->imageResource();
 
 #if ENABLE(SVG)
--- a/modules/web/src/main/native/Source/WebCore/loader/SubframeLoader.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/loader/SubframeLoader.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -341,6 +341,9 @@
     else
         frame = loadSubframe(ownerElement, url, frameName, m_frame->loader()->outgoingReferrer());
 
+    if (!frame) 
+        return 0;
+
     ASSERT(ownerElement->contentFrame() == frame || !ownerElement->contentFrame());
     return ownerElement->contentFrame();
 }
--- a/modules/web/src/main/native/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -101,7 +101,7 @@
 #endif
 }
     
-ApplicationCache* ApplicationCacheGroup::cacheForMainRequest(const ResourceRequest& request, DocumentLoader*)
+ApplicationCache* ApplicationCacheGroup::cacheForMainRequest(const ResourceRequest& request, DocumentLoader* documentLoader) 
 {
     if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
         return 0;
@@ -109,6 +109,10 @@
     KURL url(request.url());
     if (url.hasFragmentIdentifier())
         url.removeFragmentIdentifier();
+
+    if (documentLoader->frame() && documentLoader->frame()->settings()->privateBrowsingEnabled()) 
+        return 0; 
+
 #if !PLATFORM(JAVA)
     if (ApplicationCacheGroup* group = cacheStorage().cacheGroupForURL(url)) {
         ASSERT(group->newestCache());
@@ -157,6 +161,13 @@
         return;
     }
 
+    // Don't access anything on disk if private browsing is enabled.
+    if (frame->settings()->privateBrowsingEnabled()) {
+        postListenerTask(ApplicationCacheHost::CHECKING_EVENT, documentLoader);
+	postListenerTask(ApplicationCacheHost::ERROR_EVENT, documentLoader);
+	return;
+    }
+
     KURL manifestURL(passedManifestURL);
     if (manifestURL.hasFragmentIdentifier())
         manifestURL.removeFragmentIdentifier();
@@ -201,12 +212,6 @@
     if (!protocolHostAndPortAreEqual(manifestURL, request.url()))
         return;
 
-    // Don't change anything on disk if private browsing is enabled.
-    if (frame->settings()->privateBrowsingEnabled()) {
-        postListenerTask(ApplicationCacheHost::CHECKING_EVENT, documentLoader);
-        postListenerTask(ApplicationCacheHost::ERROR_EVENT, documentLoader);
-        return;
-    }
 #if !PLATFORM(JAVA)
     ApplicationCacheGroup* group = cacheStorage().findOrCreateCacheGroup(manifestURL);
 
@@ -454,7 +459,7 @@
         ASSERT(m_pendingEntries.isEmpty());
         ASSERT(!m_cacheBeingUpdated);
         postListenerTask(ApplicationCacheHost::CHECKING_EVENT, frame->loader()->documentLoader());
-        postListenerTask(ApplicationCacheHost::NOUPDATE_EVENT, frame->loader()->documentLoader());
+	postListenerTask(ApplicationCacheHost::ERROR_EVENT, frame->loader()->documentLoader());
         return;
     }
 
--- a/modules/web/src/main/native/Source/WebCore/loader/appcache/ApplicationCacheHost.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/loader/appcache/ApplicationCacheHost.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -471,8 +471,9 @@
 
 bool ApplicationCacheHost::isApplicationCacheEnabled()
 {
-    return m_documentLoader->frame() && m_documentLoader->frame()->settings()
-           && m_documentLoader->frame()->settings()->offlineWebApplicationCacheEnabled();
+  return m_documentLoader->frame() &&
+         m_documentLoader->frame()->settings()->offlineWebApplicationCacheEnabled() &&
+         !m_documentLoader->frame()->settings()->privateBrowsingEnabled();
 }
 
 }  // namespace WebCore
--- a/modules/web/src/main/native/Source/WebCore/page/DragController.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/page/DragController.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -683,7 +683,7 @@
 {
     ASSERT(element);
     RenderObject* renderer = element->renderer();
-    if (!renderer || !renderer->isImage())
+    if (!renderer || !renderer->isRenderImage())
         return 0;
     RenderImage* image = toRenderImage(renderer);
     return image->cachedImage();
--- a/modules/web/src/main/native/Source/WebCore/page/FrameView.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/page/FrameView.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -2562,21 +2562,6 @@
     return true;
 }
 
-void FrameView::scheduleEvent(PassRefPtr<Event> event, PassRefPtr<Node> eventTarget)
-{
-    m_actionScheduler->scheduleEvent(event, eventTarget);
-}
-
-void FrameView::pauseScheduledEvents()
-{
-    m_actionScheduler->pause();
-}
-
-void FrameView::resumeScheduledEvents()
-{
-    m_actionScheduler->resume();
-}
-
 void FrameView::scrollToAnchor()
 {
     RefPtr<Node> anchorNode = m_maintainScrollPositionAnchor;
@@ -2941,9 +2926,11 @@
         m_horizontalOverflow = horizontalOverflow;
         m_verticalOverflow = verticalOverflow;
         
-        m_actionScheduler->scheduleEvent(OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow,
-            verticalOverflowChanged, verticalOverflow),
-            m_viewportRenderer->node());
+        RefPtr<OverflowEvent> overflowEvent = OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow,
+            verticalOverflowChanged, verticalOverflow);
+        overflowEvent->setTarget(m_viewportRenderer->node());
+
+        m_frame->document()->enqueueOverflowEvent(overflowEvent.release());
     }
     
 }
--- a/modules/web/src/main/native/Source/WebCore/page/FrameView.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/page/FrameView.h	Thu Jul 31 15:48:30 2014 -0700
@@ -40,7 +40,6 @@
 
 class AXObjectCache;
 class Element;
-class Event;
 class FloatSize;
 class FrameActionScheduler;
 class KURL;
@@ -252,9 +251,6 @@
 
     void restoreScrollbar();
 
-    void scheduleEvent(PassRefPtr<Event>, PassRefPtr<Node>);
-    void pauseScheduledEvents();
-    void resumeScheduledEvents();
     void postLayoutTimerFired(Timer<FrameView>*);
 
     bool wasScrolledByUser() const;
--- a/modules/web/src/main/native/Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -59,6 +59,7 @@
     , m_previousFrameDone(true)
     , m_unscheduledFireCount(0)
     , m_displayID(displayID)
+    , m_clientsToBeNotified(nullptr) 
 #if PLATFORM(MAC)
     , m_displayLink(0)
 #endif
@@ -81,12 +82,9 @@
 
 bool DisplayRefreshMonitor::removeClient(DisplayRefreshMonitorClient* client)
 {
-    DisplayRefreshMonitorClientSet::iterator it = m_clients.find(client);
-    if (it != m_clients.end()) {
-        m_clients.remove(it);
-        return true;
-    }
-    return false;
+    if (m_clientsToBeNotified) 
+        m_clientsToBeNotified->remove(client); 
+    return m_clients.remove(client); 
 }
 
 void DisplayRefreshMonitor::displayDidRefresh()
@@ -94,7 +92,7 @@
     double monotonicAnimationStartTime;
     {
         MutexLocker lock(m_mutex);
-         if (!m_scheduled)
+        if (!m_scheduled)
             ++m_unscheduledFireCount;
         else
             m_unscheduledFireCount = 0;
@@ -107,11 +105,25 @@
     // against deletion until the end of the method.
     RefPtr<DisplayRefreshMonitor> protector(this);
     
-    Vector<DisplayRefreshMonitorClient*> clients;
-    copyToVector(m_clients, clients);
-    for (size_t i = 0; i < clients.size(); ++i)
-        clients[i]->fireDisplayRefreshIfNeeded(monotonicAnimationStartTime);
+    // Copy the hash table and remove clients from it one by one so we don't notify
+    // any client twice, but can respond to removal of clients during the delivery process.
+    HashSet<DisplayRefreshMonitorClient*> clientsToBeNotified = m_clients;
+    m_clientsToBeNotified = &clientsToBeNotified;
+    while (!clientsToBeNotified.isEmpty()) {
+        // Take a random client out of the set. Ordering doesn't matter.
+        // FIXME: Would read more cleanly if HashSet had a take function.
+        auto it = clientsToBeNotified.begin();
+        DisplayRefreshMonitorClient* client = *it;
+        clientsToBeNotified.remove(it);
+        client->fireDisplayRefreshIfNeeded(monotonicAnimationStartTime);
 
+        // This checks if this function was reentered. In that case, stop iterating
+        // since it's not safe to use the set any more.
+        if (m_clientsToBeNotified != &clientsToBeNotified)
+            break;
+    }
+    if (m_clientsToBeNotified == &clientsToBeNotified)
+        m_clientsToBeNotified = nullptr;
     {
         MutexLocker lock(m_mutex);
         m_previousFrameDone = true;
--- a/modules/web/src/main/native/Source/WebCore/platform/graphics/DisplayRefreshMonitor.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/platform/graphics/DisplayRefreshMonitor.h	Thu Jul 31 15:48:30 2014 -0700
@@ -44,6 +44,7 @@
 
 namespace WebCore {
 
+class DisplayAnimationClient;
 class DisplayRefreshMonitor;
 class DisplayRefreshMonitorManager;
 
@@ -116,7 +117,7 @@
     }
     
 private:
-    DisplayRefreshMonitor(PlatformDisplayID);
+    explicit DisplayRefreshMonitor(PlatformDisplayID);
 
     void displayDidRefresh();
     static void handleDisplayRefreshedNotificationOnMainThread(void* data);
@@ -129,8 +130,9 @@
     PlatformDisplayID m_displayID;
     Mutex m_mutex;
     
-    typedef HashSet<DisplayRefreshMonitorClient*> DisplayRefreshMonitorClientSet;
-    DisplayRefreshMonitorClientSet m_clients;
+    HashSet<DisplayRefreshMonitorClient*> m_clients;
+    HashSet<DisplayRefreshMonitorClient*>* m_clientsToBeNotified; 
+    
 #if PLATFORM(BLACKBERRY)
 public:
     void displayLinkFired();
@@ -171,7 +173,14 @@
     DisplayRefreshMonitor* ensureMonitorForClient(DisplayRefreshMonitorClient*);
 
     // We know nothing about the values of PlatformDisplayIDs, so use UnsignedWithZeroKeyHashTraits.
-    typedef HashMap<uint64_t, RefPtr<DisplayRefreshMonitor>, WTF::IntHash<uint64_t>, WTF::UnsignedWithZeroKeyHashTraits<uint64_t> > DisplayRefreshMonitorMap;
+    // FIXME: Since we know nothing about these values, this is not sufficient. 
+
+    // Even with UnsignedWithZeroKeyHashTraits, there are still two special values used for empty and deleted hash table slots. 
+    typedef HashMap<uint64_t,
+                    RefPtr<DisplayRefreshMonitor>,
+                    WTF::IntHash<uint64_t>,
+                    WTF::UnsignedWithZeroKeyHashTraits<uint64_t>>
+            DisplayRefreshMonitorMap;
     DisplayRefreshMonitorMap m_monitors;
 };
 
--- a/modules/web/src/main/native/Source/WebCore/platform/gtk/PasteboardGtk.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/platform/gtk/PasteboardGtk.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -215,7 +215,7 @@
 {
     ASSERT(node);
 
-    if (!(node->renderer() && node->renderer()->isImage()))
+    if (!(node->renderer() && node->renderer()->isRenderImage()))
         return;
 
     RenderImage* renderer = toRenderImage(node->renderer());
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/modules/web/src/main/native/Source/WebCore/platform/java/NotificationClientJava.h	Thu Jul 31 15:48:30 2014 -0700
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ */
+#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
+#include "NotificationClient.h"
+
+namespace WebCore {
+// Empty stub for NotificationClient; to be implemented later
+class NotificationClientJava: public NotificationClient {
+public:
+    // since WebKit Notification API doesn't provide a method to remove a NotificationClient,
+    // notificationClient is to be instantiated on WebPage creation and remain till the app termination
+    static NotificationClientJava* instance() {
+        static NotificationClientJava inst;
+        return &inst;
+    }
+    NotificationClientJava() {}
+    bool show(Notification* n) {return false;}
+    void cancel(Notification*) {}
+    void notificationObjectDestroyed(Notification*) {}
+    void notificationControllerDestroyed() {}
+#if ENABLE(LEGACY_NOTIFICATIONS)
+    void requestPermission(ScriptExecutionContext*, PassRefPtr<VoidCallback>) {}
+#endif
+#if ENABLE(NOTIFICATIONS)
+    void requestPermission(ScriptExecutionContext*, PassRefPtr<NotificationPermissionCallback>) {}
+#endif
+    void cancelRequestsForPermission(ScriptExecutionContext*) {}
+    Permission checkPermission(ScriptExecutionContext*) {return PermissionDenied;}
+    ~NotificationClientJava() {}
+};
+
+} // namespace WebCore
+#endif // ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
--- a/modules/web/src/main/native/Source/WebCore/platform/java/WebPage.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/platform/java/WebPage.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -87,6 +87,11 @@
 #include "com_sun_webkit_event_WCKeyEvent.h"
 #include "com_sun_webkit_event_WCMouseEvent.h"
 
+#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
+#include "NotificationController.h"
+#include "NotificationClientJava.h"
+#endif
+
 namespace WebCore {
 
 WebPage::WebPage(PassOwnPtr<Page> page)
@@ -96,6 +101,11 @@
     , m_syncLayers(false)
 #endif
 {
+#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
+    if(!NotificationController::clientFrom(m_page.get())) {
+        provideNotification(m_page.get(), NotificationClientJava::instance());
+    }
+#endif
 }
 
 WebPage::~WebPage()
--- a/modules/web/src/main/native/Source/WebCore/platform/win/PasteboardWin.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/platform/win/PasteboardWin.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -727,7 +727,7 @@
 {
     ASSERT(node);
 
-    if (!(node->renderer() && node->renderer()->isImage()))
+    if (!(node->renderer() && node->renderer()->isRenderImage()))
         return;
 
     RenderImage* renderer = toRenderImage(node->renderer());
@@ -878,7 +878,7 @@
     // Attempt to pull CachedImage from element
     ASSERT(element);
     RenderObject* renderer = element->renderer();
-    if (!renderer || !renderer->isImage()) 
+    if (!renderer || !renderer->isRenderImage()) 
         return 0;
 
     RenderImage* image = toRenderImage(renderer);
--- a/modules/web/src/main/native/Source/WebCore/rendering/HitTestResult.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/HitTestResult.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -287,8 +287,8 @@
         return 0;
     
     RenderObject* renderer = m_innerNonSharedNode->renderer();
-    if (renderer && renderer->isImage()) {
-        RenderImage* image = static_cast<WebCore::RenderImage*>(renderer);
+    if (renderer && renderer->isRenderImage()) {
+        RenderImage* image = toRenderImage(renderer);
         if (image->cachedImage() && !image->cachedImage()->errorOccurred())
             return image->cachedImage()->imageForRenderer(image);
     }
--- a/modules/web/src/main/native/Source/WebCore/rendering/InlineIterator.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/InlineIterator.h	Thu Jul 31 15:48:30 2014 -0700
@@ -420,12 +420,16 @@
 static inline RenderObject* containingIsolate(RenderObject* object, RenderObject* root)
 {
     ASSERT(object);
+    RenderObject* containingIsolateObject = 0;
     while (object && object != root) {
+        if (containingIsolateObject && !isIsolatedInline(object))
+            break;
+        
         if (isIsolatedInline(object))
-            return object;
+            containingIsolateObject = object;
         object = object->parent();
     }
-    return 0;
+    return containingIsolateObject;
 }
 
 static inline unsigned numberOfIsolateAncestors(const InlineIterator& iter)
--- a/modules/web/src/main/native/Source/WebCore/rendering/LogicalSelectionOffsetCaches.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/LogicalSelectionOffsetCaches.h	Thu Jul 31 15:48:30 2014 -0700
@@ -40,16 +40,16 @@
     return (object->isInline() && !object->isReplaced()) || !object->isRenderBlock();
 }
 
-static inline RenderObject* containingBlockForFixedPosition(RenderObject* parent)
+static inline RenderBlock* containingBlockForFixedPosition(RenderObject* parent)
 {
     RenderObject* object = parent;
     while (object && !object->canContainFixedPositionObjects())
         object = object->parent();
     ASSERT(!object || !object->isAnonymousBlock());
-    return object;
+    return toRenderBlock(object);
 }
 
-static inline RenderObject* containingBlockForAbsolutePosition(RenderObject* parent)
+static inline RenderBlock* containingBlockForAbsolutePosition(RenderObject* parent)
 {
     RenderObject* object = parent;
     while (object && !isContainingBlockCandidateForAbsolutelyPositionedObject(object))
@@ -59,21 +59,21 @@
     // not the inline itself, to avoid having a positioned objects list in all RenderInlines
     // and use RenderBlock* as RenderObject::containingBlock's return type.
     // Use RenderBlock::container() to obtain the inline.
-    if (object && object->isRenderInline())
+    if (object && !object->isRenderBlock())
         object = object->containingBlock();
 
     while (object && object->isAnonymousBlock())
         object = object->containingBlock();
 
-    return object;
+    return toRenderBlock(object);
 }
 
-static inline RenderObject* containingBlockForObjectInFlow(RenderObject* parent)
+static inline RenderBlock* containingBlockForObjectInFlow(RenderObject* parent)
 {
     RenderObject* object = parent;
     while (object && isNonRenderBlockInline(object))
         object = object->parent();
-    return object;
+    return toRenderBlock(object);
 }
 
 class LogicalSelectionOffsetCaches {
@@ -139,9 +139,9 @@
         RenderObject* parent = rootBlock->parent();
 
         // LogicalSelectionOffsetCaches should not be used on an orphaned tree.
-        m_containingBlockForFixedPosition.setBlock(toRenderBlock(containingBlockForFixedPosition(parent)), 0);
-        m_containingBlockForAbsolutePosition.setBlock(toRenderBlock(containingBlockForAbsolutePosition(parent)), 0);
-        m_containingBlockForInflowPosition.setBlock(toRenderBlock(containingBlockForObjectInFlow(parent)), 0);
+        m_containingBlockForFixedPosition.setBlock(containingBlockForFixedPosition(parent), 0);
+        m_containingBlockForAbsolutePosition.setBlock(containingBlockForAbsolutePosition(parent), 0);
+        m_containingBlockForInflowPosition.setBlock(containingBlockForObjectInFlow(parent), 0);
     }
 
     LogicalSelectionOffsetCaches(RenderBlock* block, const LogicalSelectionOffsetCaches& cache)
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderBlock.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderBlock.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -150,10 +150,13 @@
 
         bool horizontalLayoutOverflowChanged = hasHorizontalLayoutOverflow != m_hadHorizontalLayoutOverflow;
         bool verticalLayoutOverflowChanged = hasVerticalLayoutOverflow != m_hadVerticalLayoutOverflow;
-        if (horizontalLayoutOverflowChanged || verticalLayoutOverflowChanged) {
-            if (FrameView* frameView = m_block->document()->view())
-                frameView->scheduleEvent(OverflowEvent::create(horizontalLayoutOverflowChanged, hasHorizontalLayoutOverflow, verticalLayoutOverflowChanged, hasVerticalLayoutOverflow), m_block->node());
-        }
+
+        if (!horizontalLayoutOverflowChanged && !verticalLayoutOverflowChanged)
+            return;
+
+        RefPtr<OverflowEvent> overflowEvent = OverflowEvent::create(horizontalLayoutOverflowChanged, hasHorizontalLayoutOverflow, verticalLayoutOverflowChanged, hasVerticalLayoutOverflow);
+        overflowEvent->setTarget(m_block->node());
+        m_block->document()->enqueueOverflowEvent(overflowEvent.release());
     }
 
 private:
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderBlockLineLayout.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderBlockLineLayout.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1352,6 +1352,7 @@
         if (!isolatedResolver.isolatedRuns().isEmpty()) {
             topResolver.isolatedRuns().appendVector(isolatedResolver.isolatedRuns());
             isolatedResolver.isolatedRuns().clear();
+            currentRoot = isolatedInline; 
         }
     }
 }
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderLayer.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderLayer.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -2288,8 +2288,6 @@
     // We may end up propagating a scroll event. It is important that we suspend events until 
     // the end of the function since they could delete the layer or the layer's renderer().
     FrameView* frameView = renderer()->document()->view();
-    if (frameView)
-        frameView->pauseScheduledEvents();
 
     bool restrictedByLineClamp = false;
     if (renderer()->parent()) {
@@ -2371,9 +2369,6 @@
     
     if (parentLayer)
         parentLayer->scrollRectToVisible(newRect, alignX, alignY);
-
-    if (frameView)
-        frameView->resumeScheduledEvents();
 }
 
 void RenderLayer::updateCompositingLayersAfterScroll()
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderLayerBacking.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderLayerBacking.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -1682,7 +1682,7 @@
 {
     RenderObject* renderObject = renderer();
     
-    if (!renderObject->isImage() || m_owningLayer->hasBoxDecorationsOrBackground() || renderObject->hasClip())
+    if (!renderObject->isRenderImage() || m_owningLayer->hasBoxDecorationsOrBackground() || renderObject->hasClip())
         return false;
 
     RenderImage* imageRenderer = toRenderImage(renderObject);
@@ -1726,7 +1726,7 @@
 
 void RenderLayerBacking::updateImageContents()
 {
-    ASSERT(renderer()->isImage());
+    ASSERT(renderer()->isRenderImage());
     RenderImage* imageRenderer = toRenderImage(renderer());
 
     CachedImage* cachedImage = imageRenderer->cachedImage();
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderMarquee.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderMarquee.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -160,12 +160,6 @@
     if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero())
         return;
 
-    // We may end up propagating a scroll event. It is important that we suspend events until 
-    // the end of the function since they could delete the layer, including the marquee.
-    FrameView* frameView = m_layer->renderer()->document()->view();
-    if (frameView)
-        frameView->pauseScheduledEvents();
-
     if (!m_suspended && !m_stopped) {
         if (isHorizontal())
             m_layer->scrollToOffset(IntSize(m_start, 0));
@@ -178,9 +172,6 @@
     }
 
     m_timer.startRepeating(speed() * 0.001);
-
-    if (frameView)
-        frameView->resumeScheduledEvents();
 }
 
 void RenderMarquee::suspend()
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderNamedFlowThread.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderNamedFlowThread.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -460,6 +460,17 @@
         && logicalTopForBox < logicalBottomForRegion && logicalTopForRegion < logicalBottomForBox;
 }
 
+// Retrieve the next node to be visited while computing the ranges inside a region. 
+static Node* nextNodeInsideContentNode(const Node* currNode, const Node* contentNode) 
+{ 
+    ASSERT(currNode); 
+    ASSERT(contentNode && contentNode->inNamedFlow()); 
+
+    if (currNode->renderer() && currNode->renderer()->isSVGRoot()) 
+        return NodeTraversal::nextSkippingChildren(currNode, contentNode); 
+    return NodeTraversal::next(currNode, contentNode); 
+} 
+ 	 	
 void RenderNamedFlowThread::getRanges(Vector<RefPtr<Range> >& rangeObjects, const RenderRegion* region) const
 {
     LayoutUnit logicalTopForRegion;
@@ -497,7 +508,7 @@
         bool skipOverOutsideNodes = false;
         Node* lastEndNode = 0;
 
-        for (Node* node = contentNode; node; node = NodeTraversal::next(node, contentNode)) {
+        for (Node* node = contentNode; node; node = nextNodeInsideContentNode(node, contentNode)) {
             RenderObject* renderer = node->renderer();
             if (!renderer)
                 continue;
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderTextControlSingleLine.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderTextControlSingleLine.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -98,6 +98,15 @@
     return containerElement() ? contentLogicalHeight() : logicalHeight();
 }
 
+static void setNeedsLayoutOnAncestors(RenderObject* start, RenderObject* ancestor) 
+{ 
+    ASSERT(start != ancestor); 
+    for (RenderObject* renderer = start; renderer != ancestor; renderer = renderer->parent()) { 
+        ASSERT(renderer); 
+        renderer->setNeedsLayout(true, MarkOnlyThis); 
+    } 
+} 
+
 void RenderTextControlSingleLine::layout()
 {
     StackStats::LayoutCheckPoint layoutCheckPoint;
@@ -119,11 +128,11 @@
     // To ensure consistency between layouts, we need to reset any conditionally overriden height.
     if (innerTextRenderer && !innerTextRenderer->style()->logicalHeight().isAuto()) {
         innerTextRenderer->style()->setLogicalHeight(Length(Auto));
-        innerTextRenderer->setNeedsLayout(true, MarkOnlyThis);
+        setNeedsLayoutOnAncestors(innerTextRenderer, this);
     }
     if (innerBlockRenderer && !innerBlockRenderer->style()->logicalHeight().isAuto()) {
         innerBlockRenderer->style()->setLogicalHeight(Length(Auto));
-        innerBlockRenderer->setNeedsLayout(true, MarkOnlyThis);
+        setNeedsLayoutOnAncestors(innerBlockRenderer, this);
     }
 
     RenderBlock::layoutBlock(false);
--- a/modules/web/src/main/native/Source/WebCore/rendering/RenderView.cpp	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/RenderView.cpp	Thu Jul 31 15:48:30 2014 -0700
@@ -605,8 +605,6 @@
 
 IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
 {
-    document()->updateStyleIfNeeded();
-
     typedef HashMap<RenderObject*, OwnPtr<RenderSelectionInfo> > SelectionMap;
     SelectionMap selectedObjects;
 
@@ -647,8 +645,6 @@
 
 void RenderView::repaintSelection() const
 {
-    document()->updateStyleIfNeeded();
-
     HashSet<RenderBlock*> processedBlocks;
 
     RenderObject* end = rendererAfterPosition(m_selectionEnd, m_selectionEndPos);
--- a/modules/web/src/main/native/Source/WebCore/rendering/style/StylePendingImage.h	Thu Jul 31 08:05:32 2014 -0700
+++ b/modules/web/src/main/native/Source/WebCore/rendering/style/StylePendingImage.h	Thu Jul 31 15:48:30 2014 -0700
@@ -48,13 +48,15 @@
     virtual WrappedImagePtr data() const { return static_cast<CSSImageValue*>(m_value); }
 
     virtual PassRefPtr<CSSValue> cssValue() const { return m_value; }
-    CSSImageValue* cssImageValue() const { return m_value->isImageValue() ? static_cast<CSSImageValue*>(m_value) : 0; }
-    CSSImageGeneratorValue* cssImageGeneratorValue() const { return m_value->isImageGeneratorValue() ? static_cast<CSSImageGeneratorValue*>(m_value) : 0; }
-    CSSCursorImageValue* cssCursorImageValue() const { return m_value->isCursorImageValue() ? static_cast<CSSCursorImageValue*>(m_value) : 0; }
+    CSSImageValue* cssImageValue() const { return m_value && m_value->isImageValue() ? static_cast<CSSImageValue*>(m_value) : 0; }
+    CSSImageGeneratorValue* cssImageGeneratorValue() const { return m_value && m_value->isImageGeneratorValue() ? static_cast<CSSImageGeneratorValue*>(m_value) : 0; }
+    CSSCursorImageValue* cssCursorImageValue() const { return m_value && m_value->isCursorImageValue() ? static_cast<CSSCursorImageValue*>(m_value) : 0; }
 #if ENABLE(CSS_IMAGE_SET)
-    CSSImageSetValue* cssImageSetValue() const { return m_value->isImageSetValue() ? static_cast<CSSImageSetValue*>(m_value) : 0; }
+    CSSImageSetValue* cssImageSetValue() const { return m_value && m_value->isImageSetValue() ? static_cast<CSSImageSetValue*>(m_value) : 0; }
 #endif
     
+    void detachFromCSSValue() { m_value = 0; }    
+
     virtual LayoutSize imageSize(const RenderObject*, float /*multiplier*/) const OVERRIDE { return LayoutSize(); }
     virtual bool imageHasRelativeWidth() const { return false; }
     virtual bool imageHasRelativeHeight() const { return false; }
@@ -69,7 +71,7 @@
         return 0;
     }
     virtual bool knownToBeOpaque(const RenderObject*) const { return false; }
-    
+
 private:
     StylePendingImage(CSSValue* value)
         : m_value(value)