merge in lmp-mr1-release history after reset to lmp-mr1-dev
diff --git a/.merged-revisions b/.merged-revisions
index a3017cc..04ee52d 100644
--- a/.merged-revisions
+++ b/.merged-revisions
@@ -57,3 +57,4 @@
 fdbb120d0a4a87db74bcb608de226c85a7d1c920 6276c39deb740b2acc93ad2b75f09802ce5698bd 82b43a30f84e56323422332d2d7cc69fd2e7e758
 f542a0e9557608d421c9d165487573efa35a5f91 28cfbf09145941b4f9a047523e24093167ce4491 1f5435ff821046f593d811f1a86e523834ba1fdf
 a372c30a9dc26aa32e51fa7b85e0c47b55479f89 9e4f975de7fe39810c2fe4299e8e34ec54d9bcf2 ebce7a93d30e324a30c64fed331579b1725d04f9
+018c2aa55614eda57c6617f8d0747eacefc389a3 042939c159e27d08cc39001e3990ccb318513dd6 9946b88e4b0f26a8f3535beddb7f582cf9f4e328
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 8aacbbb..be81d14 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -3894,13 +3894,6 @@
     ensureScriptedAnimationController().enqueueMediaQueryChangeListeners(listeners);
 }
 
-void Document::dispatchEventsForPrinting()
-{
-    if (!m_scriptedAnimationController)
-        return;
-    m_scriptedAnimationController->dispatchEventsAndCallbacksForPrinting();
-}
-
 Document::EventFactorySet& Document::eventFactories()
 {
     DEFINE_STATIC_LOCAL(EventFactorySet, s_eventFactory, ());
diff --git a/Source/core/dom/Document.h b/Source/core/dom/Document.h
index 79c2d68..dc9f9fa 100644
--- a/Source/core/dom/Document.h
+++ b/Source/core/dom/Document.h
@@ -917,8 +917,6 @@
     void enqueueUniqueAnimationFrameEvent(PassRefPtrWillBeRawPtr<Event>);
     void enqueueMediaQueryChangeListeners(WillBeHeapVector<RefPtrWillBeMember<MediaQueryListListener> >&);
 
-    void dispatchEventsForPrinting();
-
     bool hasFullscreenSupplement() const { return m_hasFullscreenSupplement; }
     void setHasFullscreenSupplement() { m_hasFullscreenSupplement = true; }
 
diff --git a/Source/core/dom/ScriptedAnimationController.cpp b/Source/core/dom/ScriptedAnimationController.cpp
index dc5824c..1b1f7d5 100644
--- a/Source/core/dom/ScriptedAnimationController.cpp
+++ b/Source/core/dom/ScriptedAnimationController.cpp
@@ -81,12 +81,6 @@
     scheduleAnimationIfNeeded();
 }
 
-void ScriptedAnimationController::dispatchEventsAndCallbacksForPrinting()
-{
-    dispatchEvents();
-    callMediaQueryListListeners();
-}
-
 ScriptedAnimationController::CallbackId ScriptedAnimationController::registerCallback(RequestAnimationFrameCallback* callback)
 {
     ScriptedAnimationController::CallbackId id = ++m_nextCallbackId;
diff --git a/Source/core/dom/ScriptedAnimationController.h b/Source/core/dom/ScriptedAnimationController.h
index bf39210..524ac0e 100644
--- a/Source/core/dom/ScriptedAnimationController.h
+++ b/Source/core/dom/ScriptedAnimationController.h
@@ -64,7 +64,6 @@
     void suspend();
     void resume();
 
-    void dispatchEventsAndCallbacksForPrinting();
 private:
     explicit ScriptedAnimationController(Document*);
 
diff --git a/Source/core/frame/FrameView.cpp b/Source/core/frame/FrameView.cpp
index 1e23a5c..40a3e3e 100644
--- a/Source/core/frame/FrameView.cpp
+++ b/Source/core/frame/FrameView.cpp
@@ -1236,18 +1236,26 @@
     }
 }
 
-// FIXME: If we had a flag to force invalidations in a whole subtree, we could get rid of this function (crbug.com/410097).
-static void setShouldDoFullPaintInvalidationIncludingNonCompositingDescendants(const RenderLayer* layer)
+void FrameView::scrollContentsIfNeeded()
 {
-    layer->renderer()->setShouldDoFullPaintInvalidation(true);
+    bool didScroll = !pendingScrollDelta().isZero();
+    ScrollView::scrollContentsIfNeeded();
+    if (didScroll)
+        updateFixedElementPaintInvalidationRectsAfterScroll();
+}
 
-    for (RenderLayer* child = layer->firstChild(); child; child = child->nextSibling()) {
+static LayoutRect paintInvalidationRectIncludingNonCompositingDescendants(const RenderLayer* layer)
+{
+    LayoutRect paintInvalidationRect = layer->renderer()->previousPaintInvalidationRect();
+
+    for (const RenderLayer* child = layer->firstChild(); child; child = child->nextSibling()) {
         // Don't include paint invalidation rects for composited child layers; they will paint themselves and have a different origin.
-        if (child->isPaintInvalidationContainer())
+        if (child->compositingState() == PaintsIntoOwnBacking || child->compositingState() == PaintsIntoGroupedBacking)
             continue;
 
-        setShouldDoFullPaintInvalidationIncludingNonCompositingDescendants(child);
+        paintInvalidationRect.unite(paintInvalidationRectIncludingNonCompositingDescendants(child));
     }
+    return paintInvalidationRect;
 }
 
 bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta)
@@ -1260,6 +1268,7 @@
         return true;
     }
 
+    Region regionToUpdate;
     ViewportConstrainedObjectSet::const_iterator end = m_viewportConstrainedObjects->end();
     for (ViewportConstrainedObjectSet::const_iterator it = m_viewportConstrainedObjects->begin(); it != end; ++it) {
         RenderObject* renderer = *it;
@@ -1267,7 +1276,8 @@
         ASSERT(renderer->hasLayer());
         RenderLayer* layer = toRenderBoxModelObject(renderer)->layer();
 
-        if (layer->isPaintInvalidationContainer())
+        CompositingState state = layer->compositingState();
+        if (state == PaintsIntoOwnBacking || state == PaintsIntoGroupedBacking)
             continue;
 
         if (layer->subtreeIsInvisible())
@@ -1278,10 +1288,39 @@
         if (layer->hasAncestorWithFilterOutsets())
             return false;
 
-        setShouldDoFullPaintInvalidationIncludingNonCompositingDescendants(layer);
+        IntRect updateRect = pixelSnappedIntRect(paintInvalidationRectIncludingNonCompositingDescendants(layer));
+
+        const RenderLayerModelObject* repaintContainer = layer->renderer()->containerForPaintInvalidation();
+        if (repaintContainer && !repaintContainer->isRenderView()) {
+            // Invalidate the old and new locations of fixed position elements that are not drawn into the RenderView.
+            updateRect.moveBy(scrollPosition());
+            IntRect previousRect = updateRect;
+            previousRect.move(scrollDelta);
+            // FIXME: Rather than uniting the rects, we should just issue both invalidations.
+            updateRect.unite(previousRect);
+            layer->renderer()->invalidatePaintUsingContainer(repaintContainer, updateRect, InvalidationScroll);
+        } else {
+            // Coalesce the paint invalidations that will be issued to the renderView.
+            updateRect = contentsToRootView(updateRect);
+            if (!updateRect.isEmpty())
+                regionToUpdate.unite(updateRect);
+        }
     }
 
     InspectorInstrumentation::didScroll(page());
+
+    // Invalidate the old and new locations of fixed position elements that are drawn into the RenderView.
+    Vector<IntRect> subRectsToUpdate = regionToUpdate.rects();
+    size_t viewportConstrainedObjectsCount = subRectsToUpdate.size();
+    for (size_t i = 0; i < viewportConstrainedObjectsCount; ++i) {
+        IntRect updateRect = subRectsToUpdate[i];
+        IntRect scrolledRect = updateRect;
+        scrolledRect.move(-scrollDelta);
+        updateRect.unite(scrolledRect);
+        // FIXME: We should be able to issue these invalidations separately and before we actually scroll.
+        renderView()->setBackingNeedsPaintInvalidationInRect(rootViewToContents(updateRect));
+    }
+
     return true;
 }
 
@@ -1544,6 +1583,48 @@
     return true;
 }
 
+static void computePaintInvalidationRectsIncludingNonCompositingDescendants(RenderLayer* layer)
+{
+    // FIXME: boundsRectForPaintInvalidation() has to walk up the parent chain
+    // for every layer to compute the rects. We should make this more efficient.
+    // FIXME: it's wrong to call this when layout is not up-to-date, which we do.
+    layer->renderer()->setPreviousPaintInvalidationRect(layer->renderer()->boundsRectForPaintInvalidation(layer->renderer()->containerForPaintInvalidation()));
+    // FIXME: We are only updating the paint invalidation bounds but not
+    // the positionFromPaintInvalidationContainer. This means that we may
+    // forcing a full invaliation of the new position. Is this really correct?
+
+    for (RenderLayer* child = layer->firstChild(); child; child = child->nextSibling()) {
+        if (child->compositingState() != PaintsIntoOwnBacking && child->compositingState() != PaintsIntoGroupedBacking)
+            computePaintInvalidationRectsIncludingNonCompositingDescendants(child);
+    }
+}
+
+void FrameView::updateFixedElementPaintInvalidationRectsAfterScroll()
+{
+    if (!hasViewportConstrainedObjects())
+        return;
+
+    // Update the paint invalidation rects for fixed elements after scrolling and invalidation to reflect
+    // the new scroll position.
+    ViewportConstrainedObjectSet::const_iterator end = m_viewportConstrainedObjects->end();
+    for (ViewportConstrainedObjectSet::const_iterator it = m_viewportConstrainedObjects->begin(); it != end; ++it) {
+        RenderObject* renderer = *it;
+        // m_viewportConstrainedObjects should not contain non-viewport constrained objects.
+        ASSERT(renderer->style()->hasViewportConstrainedPosition());
+
+        // Fixed items should always have layers.
+        ASSERT(renderer->hasLayer());
+
+        RenderLayer* layer = toRenderBoxModelObject(renderer)->layer();
+
+        // Don't need to do this for composited fixed items.
+        if (layer->compositingState() == PaintsIntoOwnBacking)
+            continue;
+
+        computePaintInvalidationRectsIncludingNonCompositingDescendants(layer);
+    }
+}
+
 void FrameView::updateCompositedSelectionBoundsIfNeeded()
 {
     if (!RuntimeEnabledFeatures::compositedSelectionUpdateEnabled())
@@ -2555,8 +2636,7 @@
 
     updateWidgetPositionsIfNeeded();
 
-    RenderView* view = renderView();
-    if (view) {
+    if (RenderView* view = renderView()) {
         TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "UpdateLayerTree", "frame", m_frame.get());
         // FIXME(361045): remove InspectorInstrumentation calls once DevTools Timeline migrates to tracing.
         InspectorInstrumentation::willUpdateLayerTree(m_frame.get());
@@ -2569,13 +2649,11 @@
         updateCompositedSelectionBoundsIfNeeded();
 
         InspectorInstrumentation::didUpdateLayerTree(m_frame.get());
+
+        invalidateTreeIfNeededRecursive();
     }
 
     scrollContentsIfNeededRecursive();
-
-    if (view)
-        invalidateTreeIfNeededRecursive();
-
     ASSERT(lifecycle().state() == DocumentLifecycle::PaintInvalidationClean);
 }
 
diff --git a/Source/core/frame/FrameView.h b/Source/core/frame/FrameView.h
index 12f9f41..42bbd35 100644
--- a/Source/core/frame/FrameView.h
+++ b/Source/core/frame/FrameView.h
@@ -342,6 +342,7 @@
     virtual GraphicsLayer* layerForScrollCorner() const OVERRIDE;
 
 protected:
+    virtual void scrollContentsIfNeeded();
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta) OVERRIDE;
     virtual void scrollContentsSlowPath(const IntRect& updateRect) OVERRIDE;
 
@@ -412,6 +413,7 @@
     void updateLayersAndCompositingAfterScrollIfNeeded();
 
     static bool computeCompositedSelectionBounds(LocalFrame&, CompositedSelectionBound& start, CompositedSelectionBound& end);
+    void updateFixedElementPaintInvalidationRectsAfterScroll();
     void updateCompositedSelectionBoundsIfNeeded();
 
     bool hasCustomScrollbars() const;
diff --git a/Source/core/page/FocusController.cpp b/Source/core/page/FocusController.cpp
index f9cb3d9..48d9e8c 100644
--- a/Source/core/page/FocusController.cpp
+++ b/Source/core/page/FocusController.cpp
@@ -546,9 +546,10 @@
     int winningTabIndex = std::numeric_limits<short>::max() + 1;
     Node* winner = 0;
     for (Node* node = start; node; node = NodeTraversal::next(*node)) {
-        if (shouldVisit(node) && node->tabIndex() > tabIndex && node->tabIndex() < winningTabIndex) {
+        int currentTabIndex = adjustedTabIndex(node);
+        if (shouldVisit(node) && currentTabIndex > tabIndex && currentTabIndex < winningTabIndex) {
             winner = node;
-            winningTabIndex = node->tabIndex();
+            winningTabIndex = currentTabIndex;
         }
     }
 
diff --git a/Source/core/rendering/RenderBox.h b/Source/core/rendering/RenderBox.h
index 7462d2b..546efe4 100644
--- a/Source/core/rendering/RenderBox.h
+++ b/Source/core/rendering/RenderBox.h
@@ -620,6 +620,7 @@
 
     bool backgroundHasOpaqueTopLayer() const;
 
+    void updateIntrinsicContentLogicalHeight(LayoutUnit intrinsicContentLogicalHeight) const { m_intrinsicContentLogicalHeight = intrinsicContentLogicalHeight; }
 protected:
     virtual void willBeDestroyed() OVERRIDE;
 
@@ -649,8 +650,6 @@
     virtual void addLayerHitTestRects(LayerHitTestRects&, const RenderLayer* currentCompositedLayer, const LayoutPoint& layerOffset, const LayoutRect& containerRect) const OVERRIDE;
     virtual void computeSelfHitTestRects(Vector<LayoutRect>&, const LayoutPoint& layerOffset) const OVERRIDE;
 
-    void updateIntrinsicContentLogicalHeight(LayoutUnit intrinsicContentLogicalHeight) const { m_intrinsicContentLogicalHeight = intrinsicContentLogicalHeight; }
-
     virtual InvalidationReason getPaintInvalidationReason(const RenderLayerModelObject& paintInvalidationContainer,
         const LayoutRect& oldBounds, const LayoutPoint& oldPositionFromPaintInvalidationContainer,
         const LayoutRect& newBounds, const LayoutPoint& newPositionFromPaintInvalidationContainer) OVERRIDE;
diff --git a/Source/core/rendering/RenderFlexibleBox.cpp b/Source/core/rendering/RenderFlexibleBox.cpp
index 101947d..a9e10ca 100644
--- a/Source/core/rendering/RenderFlexibleBox.cpp
+++ b/Source/core/rendering/RenderFlexibleBox.cpp
@@ -1356,7 +1356,12 @@
             if (desiredLogicalHeight != child.logicalHeight()) {
                 child.setOverrideLogicalContentHeight(desiredLogicalHeight - child.borderAndPaddingLogicalHeight());
                 child.setLogicalHeight(0);
+                // We cache the child's intrinsic content logical height to avoid it being reset to the stretched height.
+                // FIXME: This is fragile. RenderBoxes should be smart enough to determine their intrinsic content logical
+                // height correctly even when there's an overrideHeight.
+                LayoutUnit childIntrinsicContentLogicalHeight = child.intrinsicContentLogicalHeight();
                 child.forceChildLayout();
+                child.updateIntrinsicContentLogicalHeight(childIntrinsicContentLogicalHeight);
             }
         }
     } else if (isColumnFlow() && child.style()->logicalWidth().isAuto()) {
diff --git a/Source/core/rendering/RenderLayer.cpp b/Source/core/rendering/RenderLayer.cpp
index 2e9a7aa..88f2d78 100644
--- a/Source/core/rendering/RenderLayer.cpp
+++ b/Source/core/rendering/RenderLayer.cpp
@@ -981,7 +981,7 @@
     if (isPaintInvalidationContainer())
         return const_cast<RenderLayer*>(this);
 
-    for (const RenderLayer* curr = parent(); curr; curr = curr->parent()) {
+    for (const RenderLayer* curr = compositingContainer(); curr; curr = curr->compositingContainer()) {
         if (curr->isPaintInvalidationContainer())
             return const_cast<RenderLayer*>(curr);
     }
diff --git a/Source/core/rendering/RenderLayerModelObject.cpp b/Source/core/rendering/RenderLayerModelObject.cpp
index d048fdd..a051fc4 100644
--- a/Source/core/rendering/RenderLayerModelObject.cpp
+++ b/Source/core/rendering/RenderLayerModelObject.cpp
@@ -181,7 +181,8 @@
 
     bool establishesNewPaintInvalidationContainer = isPaintInvalidationContainer();
     const RenderLayerModelObject& newPaintInvalidationContainer = *adjustCompositedContainerForSpecialAncestors(establishesNewPaintInvalidationContainer ? this : &paintInvalidationState.paintInvalidationContainer());
-    ASSERT(&newPaintInvalidationContainer == containerForPaintInvalidation());
+    // FIXME: This assert should be re-enabled when we move paint invalidation to after compositing update. crbug.com/360286
+    // ASSERT(&newPaintInvalidationContainer == containerForPaintInvalidation());
 
     InvalidationReason reason = invalidatePaintIfNeeded(paintInvalidationState, newPaintInvalidationContainer);
     clearPaintInvalidationState(paintInvalidationState);
diff --git a/Source/core/rendering/RenderMedia.cpp b/Source/core/rendering/RenderMedia.cpp
index 0899466..9be9622 100644
--- a/Source/core/rendering/RenderMedia.cpp
+++ b/Source/core/rendering/RenderMedia.cpp
@@ -77,6 +77,16 @@
     clearNeedsLayout();
 }
 
+bool RenderMedia::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    // The only allowed child is the media controls. The user agent stylesheet
+    // (mediaControls.css) has ::-webkit-media-controls { display: flex; }. If
+    // author style sets display: inline we would get an inline renderer as a
+    // child of replaced content, which is not supposed to be possible. This
+    // check can be removed if ::-webkit-media-controls is made internal.
+    return child->isFlexibleBox();
+}
+
 void RenderMedia::paintReplaced(PaintInfo&, const LayoutPoint&)
 {
 }
diff --git a/Source/core/rendering/RenderMedia.h b/Source/core/rendering/RenderMedia.h
index a5cda7b..721241c 100644
--- a/Source/core/rendering/RenderMedia.h
+++ b/Source/core/rendering/RenderMedia.h
@@ -63,6 +63,7 @@
     // so we can't support generated content.
     virtual bool canHaveGeneratedChildren() const OVERRIDE FINAL { return false; }
     virtual bool canHaveChildren() const OVERRIDE FINAL { return true; }
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const override final;
 
     virtual const char* renderName() const OVERRIDE { return "RenderMedia"; }
     virtual bool isMedia() const OVERRIDE FINAL { return true; }
diff --git a/Source/platform/scroll/ScrollView.h b/Source/platform/scroll/ScrollView.h
index cccd70e..761517a 100644
--- a/Source/platform/scroll/ScrollView.h
+++ b/Source/platform/scroll/ScrollView.h
@@ -265,7 +265,7 @@
     virtual void updateScrollCorner();
     virtual void invalidateScrollCornerRect(const IntRect&) OVERRIDE;
 
-    void scrollContentsIfNeeded();
+    virtual void scrollContentsIfNeeded();
     // Scroll the content by via the compositor.
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta) { return true; }
     // Scroll the content by invalidating everything.
diff --git a/Source/web/WebLocalFrameImpl.cpp b/Source/web/WebLocalFrameImpl.cpp
index df2276d..75de329 100644
--- a/Source/web/WebLocalFrameImpl.cpp
+++ b/Source/web/WebLocalFrameImpl.cpp
@@ -323,26 +323,18 @@
 
     float spoolSinglePage(GraphicsContext& graphicsContext, int pageNumber)
     {
-        frame()->document()->dispatchEventsForPrinting();
-        if (!frame()->document() || !frame()->document()->renderView())
-            return 0;
-
+        // FIXME: Why is it ok to proceed without all the null checks that
+        // spoolAllPagesWithBoundaries does?
         frame()->view()->updateLayoutAndStyleForPainting();
-        if (!frame()->document() || !frame()->document()->renderView())
-            return 0;
-
         return spoolPage(graphicsContext, pageNumber);
     }
 
     void spoolAllPagesWithBoundaries(GraphicsContext& graphicsContext, const FloatSize& pageSizeInPixels)
     {
-        frame()->document()->dispatchEventsForPrinting();
-        if (!frame()->document() || !frame()->document()->renderView())
+        if (!frame()->document() || !frame()->view() || !frame()->document()->renderView())
             return;
 
         frame()->view()->updateLayoutAndStyleForPainting();
-        if (!frame()->document() || !frame()->document()->renderView())
-            return;
 
         float pageHeight;
         computePageRects(FloatRect(FloatPoint(0, 0), pageSizeInPixels), 0, 0, 1, pageHeight);