diff --git a/Source/core/Init.cpp b/Source/core/Init.cpp
index a6e5b8a..bd1e5a0 100644
--- a/Source/core/Init.cpp
+++ b/Source/core/Init.cpp
@@ -48,6 +48,7 @@
 #include "core/dom/Document.h"
 #include "core/events/EventFactory.h"
 #include "core/html/parser/HTMLParserThread.h"
+#include "core/workers/WorkerThread.h"
 #include "platform/EventTracer.h"
 #include "platform/FontFamilyNames.h"
 #include "platform/Partitions.h"
@@ -114,6 +115,9 @@
     // Make sure we stop the HTMLParserThread before Platform::current() is cleared.
     HTMLParserThread::shutdown();
 
+    // Make sure we stop WorkerThreads before Partition::shutdown() which frees ExecutionContext.
+    WorkerThread::terminateAndWaitForAllWorkers();
+
     Partitions::shutdown();
 }
 
diff --git a/Source/core/css/CSSFontSelector.cpp b/Source/core/css/CSSFontSelector.cpp
index 965051b..f87fadf 100644
--- a/Source/core/css/CSSFontSelector.cpp
+++ b/Source/core/css/CSSFontSelector.cpp
@@ -98,15 +98,14 @@
 
 static AtomicString familyNameFromSettings(const GenericFontFamilySettings& settings, const FontDescription& fontDescription, const AtomicString& genericFamilyName)
 {
-    UScriptCode script = fontDescription.script();
-
 #if OS(ANDROID)
     if (fontDescription.genericFamily() == FontDescription::StandardFamily)
-        return FontCache::getGenericFamilyNameForScript(FontFamilyNames::webkit_standard, script);
+        return FontCache::getGenericFamilyNameForScript(FontFamilyNames::webkit_standard, fontDescription);
 
     if (genericFamilyName.startsWith("-webkit-"))
-        return FontCache::getGenericFamilyNameForScript(genericFamilyName, script);
+        return FontCache::getGenericFamilyNameForScript(genericFamilyName, fontDescription);
 #else
+    UScriptCode script = fontDescription.script();
     if (fontDescription.genericFamily() == FontDescription::StandardFamily)
         return settings.standard(script);
     if (genericFamilyName == FontFamilyNames::webkit_serif)
diff --git a/Source/core/css/resolver/FontBuilder.cpp b/Source/core/css/resolver/FontBuilder.cpp
index 073dd94..be9bbc0 100644
--- a/Source/core/css/resolver/FontBuilder.cpp
+++ b/Source/core/css/resolver/FontBuilder.cpp
@@ -558,6 +558,7 @@
 void FontBuilder::createFontForDocument(PassRefPtrWillBeRawPtr<FontSelector> fontSelector, RenderStyle* documentStyle)
 {
     FontDescription fontDescription = FontDescription();
+    fontDescription.setLocale(documentStyle->locale());
     fontDescription.setScript(localeToScriptCodeForFontSelection(documentStyle->locale()));
 
     setFontFamilyToStandard(fontDescription, m_document);
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index 66a1bd4..114e63d 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -670,7 +670,11 @@
         childrenChanged(change);
     }
 
-    dispatchSubtreeModifiedEvent();
+    // We don't fire the DOMSubtreeModified event for Attr Nodes. This matches the behavior
+    // of IE and Firefox. This event is fired synchronously and is a source of trouble for
+    // attributes as the JS callback could alter the attributes and leave us in a bad state.
+    if (!isAttributeNode())
+        dispatchSubtreeModifiedEvent();
 }
 
 PassRefPtrWillBeRawPtr<Node> ContainerNode::appendChild(PassRefPtrWillBeRawPtr<Node> newChild, ExceptionState& exceptionState)
diff --git a/Source/core/dom/ProcessingInstruction.cpp b/Source/core/dom/ProcessingInstruction.cpp
index 585454e..a85dfcd 100644
--- a/Source/core/dom/ProcessingInstruction.cpp
+++ b/Source/core/dom/ProcessingInstruction.cpp
@@ -219,6 +219,7 @@
 
     ASSERT(m_isXSL);
     m_sheet = XSLStyleSheet::create(this, href, baseURL);
+    RefPtrWillBeRawPtr<Document> protect(&document());
     parseStyleSheet(sheet);
 }
 
diff --git a/Source/core/dom/TreeScopeAdopter.cpp b/Source/core/dom/TreeScopeAdopter.cpp
index 60a3a47..6325b47 100644
--- a/Source/core/dom/TreeScopeAdopter.cpp
+++ b/Source/core/dom/TreeScopeAdopter.cpp
@@ -92,6 +92,13 @@
     ASSERT(oldDocument != newDocument);
     for (Node* node = &root; node; node = NodeTraversal::next(*node, &root)) {
         moveNodeToNewDocument(*node, oldDocument, newDocument);
+
+        if (node->hasSyntheticAttrChildNodes()) {
+            WillBeHeapVector<RefPtrWillBeMember<Attr> >& attrs = *toElement(node)->attrNodeList();
+            for (unsigned i = 0; i < attrs.size(); ++i)
+                moveTreeToNewDocument(*attrs[i], oldDocument, newDocument);
+        }
+
         for (ShadowRoot* shadow = node->youngestShadowRoot(); shadow; shadow = shadow->olderShadowRoot())
             moveTreeToNewDocument(*shadow, oldDocument, newDocument);
     }
diff --git a/Source/core/editing/Caret.cpp b/Source/core/editing/Caret.cpp
index 8bdff9f..07647ce 100644
--- a/Source/core/editing/Caret.cpp
+++ b/Source/core/editing/Caret.cpp
@@ -134,6 +134,29 @@
     return paintedByBlock ? toRenderBlock(renderer) : renderer->containingBlock();
 }
 
+static void mapCaretRectToCaretPainter(RenderObject* caretRenderer, RenderBlock* caretPainter, LayoutRect& caretRect)
+{
+    // FIXME: This shouldn't be called on un-rooted subtrees.
+    // FIXME: This should probably just use mapLocalToContainer.
+    // Compute an offset between the caretRenderer and the caretPainter.
+
+    ASSERT(caretRenderer->isDescendantOf(caretPainter));
+
+    bool unrooted = false;
+    while (caretRenderer != caretPainter) {
+        RenderObject* containerObject = caretRenderer->container();
+        if (!containerObject) {
+            unrooted = true;
+            break;
+        }
+        caretRect.move(caretRenderer->offsetFromContainer(containerObject, caretRect.location()));
+        caretRenderer = containerObject;
+    }
+
+    if (unrooted)
+        caretRect = LayoutRect();
+}
+
 bool CaretBase::updateCaretRect(Document* document, const PositionWithAffinity& caretPosition)
 {
     m_caretLocalRect = LayoutRect();
@@ -147,26 +170,13 @@
 
     // First compute a rect local to the renderer at the selection start.
     RenderObject* renderer;
-    LayoutRect localRect = localCaretRectOfPosition(caretPosition, renderer);
+    m_caretLocalRect = localCaretRectOfPosition(caretPosition, renderer);
 
     // Get the renderer that will be responsible for painting the caret
     // (which is either the renderer we just found, or one of its containers).
     RenderBlock* caretPainter = caretRenderer(caretPosition.position().deprecatedNode());
 
-    // Compute an offset between the renderer and the caretPainter.
-    bool unrooted = false;
-    while (renderer != caretPainter) {
-        RenderObject* containerObject = renderer->container();
-        if (!containerObject) {
-            unrooted = true;
-            break;
-        }
-        localRect.move(renderer->offsetFromContainer(containerObject, localRect.location()));
-        renderer = containerObject;
-    }
-
-    if (!unrooted)
-        m_caretLocalRect = localRect;
+    mapCaretRectToCaretPainter(renderer, caretPainter, m_caretLocalRect);
 
     return true;
 }
@@ -203,6 +213,9 @@
     LayoutRect inflatedRect = rect;
     inflatedRect.inflate(1);
 
+    // FIXME: We should use mapLocalToContainer() since we know we're not un-rooted.
+    mapCaretRectToCaretPainter(node->renderer(), caretPainter, inflatedRect);
+
     caretPainter->invalidatePaintRectangle(inflatedRect);
 }
 
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 18c4833..669bfc0 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -207,6 +207,14 @@
     if (m_dirtyRect.isEmpty())
         return;
 
+    // Fix for crbug.com/417201 just for Chrome 38: invalidate the content layer
+    // if accelerated. This code (four lines below) should be removed from trunk
+    // after merging to the M-38 branch.
+    if (RenderBox* ro = renderBox()) {
+        if (ro->hasAcceleratedCompositing())
+            ro->contentChanged(CanvasChanged);
+    }
+
     // Propagate the m_dirtyRect accumulated so far to the compositor
     // before restarting with a blank dirty rect.
     FloatRect srcRect(0, 0, size().width(), size().height());
diff --git a/Source/core/html/HTMLPlugInElement.cpp b/Source/core/html/HTMLPlugInElement.cpp
index bd5a571..f8dd7f9 100644
--- a/Source/core/html/HTMLPlugInElement.cpp
+++ b/Source/core/html/HTMLPlugInElement.cpp
@@ -41,6 +41,7 @@
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Page.h"
+#include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/plugins/PluginView.h"
 #include "core/rendering/RenderEmbeddedObject.h"
 #include "core/rendering/RenderImage.h"
@@ -498,6 +499,11 @@
     }
     document().setContainsPlugins();
     scheduleSVGFilterLayerUpdateHack();
+    // Make sure any input event handlers introduced by the plugin are taken into account.
+    if (Page* page = document().frame()->page()) {
+        if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+            scrollingCoordinator->notifyLayoutUpdated();
+    }
     return true;
 }
 
diff --git a/Source/core/html/forms/BaseMultipleFieldsDateAndTimeInputType.cpp b/Source/core/html/forms/BaseMultipleFieldsDateAndTimeInputType.cpp
index 32c5ab6..18a5cf7 100644
--- a/Source/core/html/forms/BaseMultipleFieldsDateAndTimeInputType.cpp
+++ b/Source/core/html/forms/BaseMultipleFieldsDateAndTimeInputType.cpp
@@ -264,6 +264,7 @@
     DateTimeEditElement* edit = this->dateTimeEditElement();
     if (!edit)
         return;
+    EventQueueScope scope;
     DateComponents date;
     unsigned end;
     if (date.parseDate(value, 0, end) && end == value.length())
diff --git a/Source/core/page/DragController.cpp b/Source/core/page/DragController.cpp
index 9ce9b02..4f99c81 100644
--- a/Source/core/page/DragController.cpp
+++ b/Source/core/page/DragController.cpp
@@ -720,6 +720,23 @@
     dataTransfer->declareAndWriteDragImage(node, !linkURL.isEmpty() ? linkURL : imageURL, label);
 }
 
+static ShadowRoot::ShadowRootType treeScopeType(const TreeScope& scope)
+{
+    // Treat document like an author shadow root.
+    if (scope.rootNode().isDocumentNode())
+        return ShadowRoot::AuthorShadowRoot;
+    return toShadowRoot(scope.rootNode()).type();
+}
+
+static bool containsExcludingUserAgentShadowTrees(const Node& dragSrc, Node* dragOrigin)
+{
+    if (!dragOrigin)
+        return false;
+    if (treeScopeType(dragSrc.treeScope()) != treeScopeType(dragOrigin->treeScope()))
+        return false;
+    return dragSrc.containsIncludingShadowDOM(dragOrigin);
+}
+
 bool DragController::populateDragDataTransfer(LocalFrame* src, const DragState& state, const IntPoint& dragOrigin)
 {
     ASSERT(dragTypeIsValid(state.m_dragType));
@@ -730,7 +747,7 @@
     HitTestResult hitTestResult = src->eventHandler().hitTestResultAtPoint(dragOrigin);
     // FIXME: Can this even happen? I guess it's possible, but should verify
     // with a layout test.
-    if (!state.m_dragSrc->containsIncludingShadowDOM(hitTestResult.innerNode())) {
+    if (!containsExcludingUserAgentShadowTrees(*state.m_dragSrc, hitTestResult.innerNode())) {
         // The original node being dragged isn't under the drag origin anymore... maybe it was
         // hidden or moved out from under the cursor. Regardless, we don't want to start a drag on
         // something that's not actually under the drag origin.
@@ -848,7 +865,7 @@
         return false;
 
     HitTestResult hitTestResult = src->eventHandler().hitTestResultAtPoint(dragOrigin);
-    if (!state.m_dragSrc->containsIncludingShadowDOM(hitTestResult.innerNode())) {
+    if (!containsExcludingUserAgentShadowTrees(*state.m_dragSrc, hitTestResult.innerNode())) {
         // The original node being dragged isn't under the drag origin anymore... maybe it was
         // hidden or moved out from under the cursor. Regardless, we don't want to start a drag on
         // something that's not actually under the drag origin.
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index 25e9ae1..85f3503 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -1720,8 +1720,10 @@
             oldLogicalTop = logicalTopForChild(r);
         }
 
+        // FIXME: We should be able to do a r->setNeedsPositionedMovementLayout() here instead of a full layout. Need
+        // to investigate why it does not trigger the correct invalidations in that case. crbug.com/350756
         if (info == ForcedLayoutAfterContainingBlockMoved)
-            r->setNeedsPositionedMovementLayout();
+            r->setNeedsLayout();
 
         r->layoutIfNeeded();
 
diff --git a/Source/core/rendering/RenderBoxModelObject.cpp b/Source/core/rendering/RenderBoxModelObject.cpp
index b06ed1d..eb6e04c 100644
--- a/Source/core/rendering/RenderBoxModelObject.cpp
+++ b/Source/core/rendering/RenderBoxModelObject.cpp
@@ -193,11 +193,10 @@
     if (cb->isRenderView())
         return false;
 
-    if (cb->isOutOfFlowPositioned() && !cb->style()->logicalTop().isAuto() && !cb->style()->logicalBottom().isAuto())
+    if (!cb->style()->logicalHeight().isAuto() || (!cb->style()->logicalTop().isAuto() && !cb->style()->logicalBottom().isAuto()))
         return false;
 
-    // If the height of the containing block computes to 'auto', then it hasn't been 'specified explicitly'.
-    return cb->hasAutoHeightOrContainingBlockWithAutoHeight();
+    return true;
 }
 
 LayoutSize RenderBoxModelObject::relativePositionOffset() const
diff --git a/Source/core/rendering/TextAutosizer.cpp b/Source/core/rendering/TextAutosizer.cpp
index 5b35814..960a54b 100644
--- a/Source/core/rendering/TextAutosizer.cpp
+++ b/Source/core/rendering/TextAutosizer.cpp
@@ -306,7 +306,7 @@
 
 void TextAutosizer::destroy(const RenderBlock* block)
 {
-    if (!m_pageInfo.m_settingEnabled)
+    if (!m_pageInfo.m_settingEnabled && !m_fingerprintMapper.hasFingerprints())
         return;
 
     ASSERT(!m_blocksThatHaveBegunLayout.contains(block));
diff --git a/Source/core/rendering/TextAutosizer.h b/Source/core/rendering/TextAutosizer.h
index bf6c100..ea27c6c 100644
--- a/Source/core/rendering/TextAutosizer.h
+++ b/Source/core/rendering/TextAutosizer.h
@@ -216,6 +216,7 @@
         bool remove(const RenderObject*);
         Fingerprint get(const RenderObject*);
         BlockSet* getTentativeClusterRoots(Fingerprint);
+        bool hasFingerprints() const { return !m_fingerprints.isEmpty(); }
     private:
         typedef HashMap<const RenderObject*, Fingerprint> FingerprintMap;
         typedef HashMap<Fingerprint, OwnPtr<BlockSet> > ReverseFingerprintMap;
diff --git a/Source/core/rendering/compositing/CompositedLayerMapping.cpp b/Source/core/rendering/compositing/CompositedLayerMapping.cpp
index 7be9f79..6b3fa2c 100644
--- a/Source/core/rendering/compositing/CompositedLayerMapping.cpp
+++ b/Source/core/rendering/compositing/CompositedLayerMapping.cpp
@@ -1153,6 +1153,7 @@
         if (!m_ancestorClippingLayer) {
             m_ancestorClippingLayer = createGraphicsLayer(CompositingReasonLayerForAncestorClip);
             m_ancestorClippingLayer->setMasksToBounds(true);
+            m_ancestorClippingLayer->setShouldFlattenTransform(false);
             layersChanged = true;
         }
     } else if (m_ancestorClippingLayer) {
@@ -1286,13 +1287,13 @@
 }
 
 enum ApplyToGraphicsLayersModeFlags {
-    ApplyToCoreLayers = (1 << 0),
+    ApplyToLayersAffectedByPreserve3D = (1 << 0),
     ApplyToSquashingLayer = (1 << 1),
     ApplyToScrollbarLayers = (1 << 2),
     ApplyToBackgroundLayer = (1 << 3),
     ApplyToMaskLayers = (1 << 4),
     ApplyToContentLayers = (1 << 5),
-    ApplyToAllGraphicsLayers = (ApplyToSquashingLayer | ApplyToScrollbarLayers | ApplyToBackgroundLayer | ApplyToMaskLayers | ApplyToCoreLayers | ApplyToContentLayers)
+    ApplyToAllGraphicsLayers = (ApplyToSquashingLayer | ApplyToScrollbarLayers | ApplyToBackgroundLayer | ApplyToMaskLayers | ApplyToLayersAffectedByPreserve3D | ApplyToContentLayers)
 };
 typedef unsigned ApplyToGraphicsLayersMode;
 
@@ -1301,23 +1302,19 @@
 {
     ASSERT(mode);
 
-    if ((mode & ApplyToCoreLayers) && mapping->squashingContainmentLayer())
-        f(mapping->squashingContainmentLayer());
-    if ((mode & ApplyToCoreLayers) && mapping->childTransformLayer())
+    if ((mode & ApplyToLayersAffectedByPreserve3D) && mapping->childTransformLayer())
         f(mapping->childTransformLayer());
-    if ((mode & ApplyToCoreLayers) && mapping->ancestorClippingLayer())
-        f(mapping->ancestorClippingLayer());
-    if (((mode & ApplyToCoreLayers) || (mode & ApplyToContentLayers)) && mapping->mainGraphicsLayer())
+    if (((mode & ApplyToLayersAffectedByPreserve3D) || (mode & ApplyToContentLayers)) && mapping->mainGraphicsLayer())
         f(mapping->mainGraphicsLayer());
-    if ((mode & ApplyToCoreLayers) && mapping->clippingLayer())
+    if ((mode & ApplyToLayersAffectedByPreserve3D) && mapping->clippingLayer())
         f(mapping->clippingLayer());
-    if ((mode & ApplyToCoreLayers) && mapping->scrollingLayer())
+    if ((mode & ApplyToLayersAffectedByPreserve3D) && mapping->scrollingLayer())
         f(mapping->scrollingLayer());
-    if ((mode & ApplyToCoreLayers) && mapping->scrollingBlockSelectionLayer())
+    if ((mode & ApplyToLayersAffectedByPreserve3D) && mapping->scrollingBlockSelectionLayer())
         f(mapping->scrollingBlockSelectionLayer());
-    if (((mode & ApplyToCoreLayers) || (mode & ApplyToContentLayers)) && mapping->scrollingContentsLayer())
+    if (((mode & ApplyToLayersAffectedByPreserve3D) || (mode & ApplyToContentLayers)) && mapping->scrollingContentsLayer())
         f(mapping->scrollingContentsLayer());
-    if (((mode & ApplyToCoreLayers) || (mode & ApplyToContentLayers)) && mapping->foregroundLayer())
+    if (((mode & ApplyToLayersAffectedByPreserve3D) || (mode & ApplyToContentLayers)) && mapping->foregroundLayer())
         f(mapping->foregroundLayer());
 
     if ((mode & ApplyToSquashingLayer) && mapping->squashingLayer())
@@ -1378,7 +1375,7 @@
     // All CLM-managed layers that could affect a descendant layer should update their
     // should-flatten-transform value (the other layers' transforms don't matter here).
     UpdateShouldFlattenTransformFunctor functor = { !m_owningLayer.shouldPreserve3D() };
-    ApplyToGraphicsLayersMode mode = ApplyToCoreLayers;
+    ApplyToGraphicsLayersMode mode = ApplyToLayersAffectedByPreserve3D;
     ApplyToGraphicsLayers(this, functor, mode);
 
     // Note, if we apply perspective, we have to set should flatten differently
@@ -1582,6 +1579,7 @@
         } else {
             if (!m_squashingContainmentLayer) {
                 m_squashingContainmentLayer = createGraphicsLayer(CompositingReasonLayerForSquashingContainer);
+                m_squashingContainmentLayer->setShouldFlattenTransform(false);
                 layersChanged = true;
             }
         }
diff --git a/Source/core/rendering/compositing/RenderLayerCompositor.cpp b/Source/core/rendering/compositing/RenderLayerCompositor.cpp
index be07f7d..041954f 100644
--- a/Source/core/rendering/compositing/RenderLayerCompositor.cpp
+++ b/Source/core/rendering/compositing/RenderLayerCompositor.cpp
@@ -446,8 +446,10 @@
         break;
     }
 
-    if (layer->hasCompositedLayerMapping() && layer->compositedLayerMapping()->updateRequiresOwnBackingStoreForIntrinsicReasons())
+    if (layer->hasCompositedLayerMapping() && layer->compositedLayerMapping()->updateRequiresOwnBackingStoreForIntrinsicReasons()) {
         compositedLayerMappingChanged = true;
+        layer->compositedLayerMapping()->setNeedsGraphicsLayerUpdate(GraphicsLayerUpdateSubtree);
+    }
 
     if (compositedLayerMappingChanged && layer->renderer()->isRenderPart()) {
         RenderLayerCompositor* innerCompositor = frameContentsCompositor(toRenderPart(layer->renderer()));
diff --git a/Source/core/rendering/svg/RenderSVGImage.cpp b/Source/core/rendering/svg/RenderSVGImage.cpp
index ac6f324..c56cf2e 100644
--- a/Source/core/rendering/svg/RenderSVGImage.cpp
+++ b/Source/core/rendering/svg/RenderSVGImage.cpp
@@ -37,6 +37,7 @@
 #include "core/rendering/svg/SVGResources.h"
 #include "core/rendering/svg/SVGResourcesCache.h"
 #include "core/svg/SVGImageElement.h"
+#include "platform/LengthFunctions.h"
 #include "platform/graphics/GraphicsContextStateSaver.h"
 
 namespace blink {
@@ -56,6 +57,32 @@
     m_imageResource->shutdown();
 }
 
+bool RenderSVGImage::forceNonUniformScaling(SVGImageElement* image) const
+{
+    // Images with preserveAspectRatio=none should force non-uniform
+    // scaling. This can be achieved by setting the image's container size to
+    // its intrinsic size. If the image does not have an intrinsic size - or
+    // the intrinsic size is degenerate - set the container size to the bounds
+    // as in pAR!=none cases.
+    // See: http://www.w3.org/TR/SVG/single-page.html, 7.8 The ‘preserveAspectRatio’ attribute.
+    if (image->preserveAspectRatio()->currentValue()->align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
+        return false;
+    ImageResource* cachedImage = m_imageResource->cachedImage();
+    if (!cachedImage)
+        return false;
+    Length intrinsicWidth;
+    Length intrinsicHeight;
+    FloatSize intrinsicRatio;
+    cachedImage->computeIntrinsicDimensions(intrinsicWidth, intrinsicHeight, intrinsicRatio);
+    if (!intrinsicWidth.isFixed() || !intrinsicHeight.isFixed())
+        return false;
+    // If the viewport defined by the referenced image is zero in either
+    // dimension, then SVGImage will have computed an intrinsic size of 300x150.
+    if (!floatValueForLength(intrinsicWidth, 0) || !floatValueForLength(intrinsicHeight, 0))
+        return false;
+    return true;
+}
+
 bool RenderSVGImage::updateImageViewport()
 {
     SVGImageElement* image = toSVGImageElement(element());
@@ -67,11 +94,8 @@
 
     bool boundsChanged = oldBoundaries != m_objectBoundingBox;
 
-    // Images with preserveAspectRatio=none should force non-uniform scaling. This can be achieved
-    // by setting the image's container size to its intrinsic size.
-    // See: http://www.w3.org/TR/SVG/single-page.html, 7.8 The ‘preserveAspectRatio’ attribute.
     IntSize newViewportSize;
-    if (image->preserveAspectRatio()->currentValue()->align() == SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE) {
+    if (forceNonUniformScaling(image)) {
         LayoutSize intrinsicSize = m_imageResource->intrinsicSize(style()->effectiveZoom());
         if (intrinsicSize != m_imageResource->imageSize(style()->effectiveZoom())) {
             newViewportSize = roundedIntSize(intrinsicSize);
diff --git a/Source/core/rendering/svg/RenderSVGImage.h b/Source/core/rendering/svg/RenderSVGImage.h
index 39d6f7d..b9470d2 100644
--- a/Source/core/rendering/svg/RenderSVGImage.h
+++ b/Source/core/rendering/svg/RenderSVGImage.h
@@ -62,6 +62,7 @@
     virtual void layout() OVERRIDE;
     virtual void paint(PaintInfo&, const LayoutPoint&) OVERRIDE;
 
+    bool forceNonUniformScaling(SVGImageElement*) const;
     void invalidateBufferedForeground();
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction) OVERRIDE;
diff --git a/Source/core/testing/Internals.cpp b/Source/core/testing/Internals.cpp
index 702e7a0..ae096fe 100644
--- a/Source/core/testing/Internals.cpp
+++ b/Source/core/testing/Internals.cpp
@@ -569,6 +569,12 @@
     return CSSComputedStyleDeclaration::create(node, allowVisitedStyle);
 }
 
+PassRefPtrWillBeRawPtr<ShadowRoot> Internals::createUserAgentShadowRoot(Element* host)
+{
+    ASSERT(host);
+    return PassRefPtrWillBeRawPtr<ShadowRoot>(host->ensureUserAgentShadowRoot());
+}
+
 ShadowRoot* Internals::shadowRoot(Element* host)
 {
     // FIXME: Internals::shadowRoot() in tests should be converted to youngestShadowRoot() or oldestShadowRoot().
diff --git a/Source/core/testing/Internals.h b/Source/core/testing/Internals.h
index 2743000..dec51c1 100644
--- a/Source/core/testing/Internals.h
+++ b/Source/core/testing/Internals.h
@@ -97,6 +97,8 @@
 
     PassRefPtrWillBeRawPtr<CSSStyleDeclaration> computedStyleIncludingVisitedInfo(Node*) const;
 
+    PassRefPtrWillBeRawPtr<ShadowRoot> createUserAgentShadowRoot(Element* host);
+
     ShadowRoot* shadowRoot(Element* host);
     ShadowRoot* youngestShadowRoot(Element* host);
     ShadowRoot* oldestShadowRoot(Element* host);
diff --git a/Source/core/testing/Internals.idl b/Source/core/testing/Internals.idl
index 675dfbc..c41b359 100644
--- a/Source/core/testing/Internals.idl
+++ b/Source/core/testing/Internals.idl
@@ -46,6 +46,8 @@
 
     [TypeChecking=Interface] CSSStyleDeclaration computedStyleIncludingVisitedInfo(Node node);
 
+    [TypeChecking=Interface] ShadowRoot createUserAgentShadowRoot(Element host);
+
     [TypeChecking=Interface] ShadowRoot shadowRoot(Element host);
     [TypeChecking=Interface] ShadowRoot youngestShadowRoot(Element host);
     [TypeChecking=Interface] ShadowRoot oldestShadowRoot(Element host);
diff --git a/Source/core/workers/WorkerThread.cpp b/Source/core/workers/WorkerThread.cpp
index 2d4f884..988256e 100644
--- a/Source/core/workers/WorkerThread.cpp
+++ b/Source/core/workers/WorkerThread.cpp
@@ -207,6 +207,7 @@
     , m_workerReportingProxy(workerReportingProxy)
     , m_startupData(startupData)
     , m_shutdownEvent(adoptPtr(blink::Platform::current()->createWaitableEvent()))
+    , m_terminationEvent(adoptPtr(blink::Platform::current()->createWaitableEvent()))
 {
     MutexLocker lock(threadSetMutex());
     workerThreads().add(this);
@@ -320,6 +321,8 @@
     // This can free this thread object, hence it must not be touched afterwards.
     workerReportingProxy().workerThreadTerminated();
 
+    m_terminationEvent->signal();
+
     // Clean up PlatformThreadData before WTF::WTFThreadData goes away!
     PlatformThreadData::current().destroy();
 }
@@ -373,7 +376,16 @@
 {
     // Prevent the deadlock between GC and an attempt to stop a thread.
     ThreadState::SafePointScope safePointScope(ThreadState::HeapPointersOnStack);
+    stopInternal();
+}
 
+void WorkerThread::stopInShutdownSequence()
+{
+    stopInternal();
+}
+
+void WorkerThread::stopInternal()
+{
     // Protect against this method and initialize() racing each other.
     MutexLocker lock(m_threadCreationMutex);
 
@@ -397,6 +409,18 @@
     postTask(WorkerThreadShutdownStartTask::create());
 }
 
+void WorkerThread::terminateAndWaitForAllWorkers()
+{
+    // Keep this lock to prevent WorkerThread instances from being destroyed.
+    MutexLocker lock(threadSetMutex());
+    HashSet<WorkerThread*> threads = workerThreads();
+    for (HashSet<WorkerThread*>::iterator itr = threads.begin(); itr != threads.end(); ++itr)
+        (*itr)->stopInShutdownSequence();
+
+    for (HashSet<WorkerThread*>::iterator itr = threads.begin(); itr != threads.end(); ++itr)
+        (*itr)->terminationEvent()->wait();
+}
+
 bool WorkerThread::isCurrentThread() const
 {
     return m_thread && m_thread->isCurrentThread();
diff --git a/Source/core/workers/WorkerThread.h b/Source/core/workers/WorkerThread.h
index 80a2bf5..082d437 100644
--- a/Source/core/workers/WorkerThread.h
+++ b/Source/core/workers/WorkerThread.h
@@ -71,6 +71,9 @@
         // (This is signalled on the main thread, so it's assumed to be waited on the worker context thread)
         blink::WebWaitableEvent* shutdownEvent() { return m_shutdownEvent.get(); }
 
+        blink::WebWaitableEvent* terminationEvent() { return m_terminationEvent.get(); }
+        static void terminateAndWaitForAllWorkers();
+
         bool isCurrentThread() const;
         WorkerLoaderProxy& workerLoaderProxy() const { return m_workerLoaderProxy; }
         WorkerReportingProxy& workerReportingProxy() const { return m_workerReportingProxy; }
@@ -107,6 +110,9 @@
         friend class WorkerSharedTimer;
         friend class WorkerThreadShutdownFinishTask;
 
+        void stopInShutdownSequence();
+        void stopInternal();
+
         void initialize();
         void cleanup();
         void idleHandler();
@@ -132,6 +138,9 @@
         // Used to signal thread shutdown.
         OwnPtr<blink::WebWaitableEvent> m_shutdownEvent;
 
+        // Used to signal thread termination.
+        OwnPtr<blink::WebWaitableEvent> m_terminationEvent;
+
         // FIXME: This has to be last because of crbug.com/401397 - the
         // WorkerThread might get deleted before it had a chance to properly
         // shut down. By deleting the WebThread first, we can guarantee that
diff --git a/Source/devtools/front_end/cmdevtools.css b/Source/devtools/front_end/cmdevtools.css
index 387e26d..af23072 100644
--- a/Source/devtools/front_end/cmdevtools.css
+++ b/Source/devtools/front_end/cmdevtools.css
@@ -225,10 +225,9 @@
 
 .CodeMirror .text-editor-line-decoration-wave {
   position: absolute;
-  border-top-width: 3px;
   top: -2px;
   cursor: pointer;
-  height: 8px;
+  height: 4px;
 }
 
 .text-editor-messages-description-container {
@@ -274,6 +273,7 @@
 .CodeMirror .text-editor-line-decoration-wave {
   background-image: url(Images/errorWave.png);
   background-repeat: repeat-x;
+  background-size: contain;
 }
 
 @media (-webkit-min-device-pixel-ratio: 1.5) {
diff --git a/Source/devtools/front_end/inspectorStyle.css b/Source/devtools/front_end/inspectorStyle.css
index 7488dd6..6c9404a 100644
--- a/Source/devtools/front_end/inspectorStyle.css
+++ b/Source/devtools/front_end/inspectorStyle.css
@@ -851,9 +851,10 @@
     padding: 1px 22px 1px 0;
     margin-left: 24px;
     min-height: 16px;
+    flex: auto;
 }
 
-.console-adjacent-user-command-result {
+.console-adjacent-user-command-result .console-user-command {
     border-bottom: none;
 }
 
@@ -1026,10 +1027,6 @@
     box-sizing: border-box;
 }
 
-.console-message {
-    flex: 1 1 auto;
-}
-
 .console-error-level .console-message-text,
 .console-error-level .section > .header .title {
     color: red !important;
diff --git a/Source/devtools/front_end/sdk/CSSMetadata.js b/Source/devtools/front_end/sdk/CSSMetadata.js
index a4d390e..e01edac 100644
--- a/Source/devtools/front_end/sdk/CSSMetadata.js
+++ b/Source/devtools/front_end/sdk/CSSMetadata.js
@@ -384,7 +384,7 @@
         "over", "under"
     ] },
     "image-rendering": { values: [
-        "auto", "optimizeSpeed", "optimizeQuality", "pixelated"
+        "auto", "optimizeSpeed", "optimizeQuality"
     ] },
     "alignment-baseline": { values: [
         "baseline", "middle", "auto", "before-edge", "after-edge", "central", "text-before-edge", "text-after-edge",
diff --git a/Source/devtools/front_end/source_frame/SourceFrame.js b/Source/devtools/front_end/source_frame/SourceFrame.js
index c180c45..2840158 100644
--- a/Source/devtools/front_end/source_frame/SourceFrame.js
+++ b/Source/devtools/front_end/source_frame/SourceFrame.js
@@ -862,7 +862,9 @@
         var base = this._textEditor.cursorPositionToCoordinates(lineNumber, 0);
         var start = this._textEditor.cursorPositionToCoordinates(lineNumber, lineIndent);
         var end = this._textEditor.cursorPositionToCoordinates(lineNumber, lineText.length);
-        this._wave.style.left = (start.x - base.x) + "px";
+        /** @const */
+        var codeMirrorLinesLeftPadding = 4;
+        this._wave.style.left = (start.x - base.x + codeMirrorLinesLeftPadding) + "px";
         this._wave.style.width = (end.x - start.x) + "px";
     },
 
diff --git a/Source/devtools/front_end/toolbox/OverridesUI.js b/Source/devtools/front_end/toolbox/OverridesUI.js
index 04fb62f..b9b133c 100644
--- a/Source/devtools/front_end/toolbox/OverridesUI.js
+++ b/Source/devtools/front_end/toolbox/OverridesUI.js
@@ -204,9 +204,10 @@
     {
         var conditions = networkConditionsSetting.get();
         var presetIndex = presets.length - 1;
+        var kbps = 1024 / 8;
         for (var i = 0; i < presets.length; ++i) {
-            if (presets[i].throughput === conditions.throughput && presets[i].latency === conditions.latency) {
-                conditionsSelectElement.selectedIndex = i;
+            if (presets[i].throughput === conditions.throughput / kbps && presets[i].latency === conditions.latency) {
+                presetIndex = i;
                 break;
             }
         }
diff --git a/Source/platform/RuntimeEnabledFeatures.in b/Source/platform/RuntimeEnabledFeatures.in
index b86f122..2da1184 100644
--- a/Source/platform/RuntimeEnabledFeatures.in
+++ b/Source/platform/RuntimeEnabledFeatures.in
@@ -72,7 +72,7 @@
 HighResolutionTimeInWorkers status=stable
 IMEAPI status=experimental
 ImageDataConstructor status=experimental
-ImageRenderingPixelated status=stable
+ImageRenderingPixelated status=experimental
 IndexedDBExperimental status=experimental
 InputModeAttribute status=experimental
 LangAttributeAwareFormControlUI
diff --git a/Source/platform/fonts/Font.cpp b/Source/platform/fonts/Font.cpp
index 4151a4b..d65a982 100644
--- a/Source/platform/fonts/Font.cpp
+++ b/Source/platform/fonts/Font.cpp
@@ -259,6 +259,12 @@
     if (run.length() > 1 && fontDescription().typesettingFeatures())
         return ComplexPath;
 
+    // FIXME: This really shouldn't be needed but for some reason the
+    // TextRendering setting doesn't propagate to typesettingFeatures in time
+    // for the prefs width calculation.
+    if (fontDescription().textRendering() == OptimizeLegibility || fontDescription().textRendering() == GeometricPrecision)
+        return ComplexPath;
+
     if (!run.characterScanForCodePath())
         return SimplePath;
 
diff --git a/Source/platform/fonts/FontCache.h b/Source/platform/fonts/FontCache.h
index c6948bb..5a02d0a 100644
--- a/Source/platform/fonts/FontCache.h
+++ b/Source/platform/fonts/FontCache.h
@@ -117,7 +117,7 @@
 #endif
 
 #if OS(ANDROID)
-    static AtomicString getGenericFamilyNameForScript(const AtomicString& familyName, UScriptCode);
+    static AtomicString getGenericFamilyNameForScript(const AtomicString& familyName, const FontDescription&);
 #else
     struct PlatformFallbackFont {
         String name;
diff --git a/Source/platform/fonts/SimpleFontData.cpp b/Source/platform/fonts/SimpleFontData.cpp
index 1b957da..c0341ae 100644
--- a/Source/platform/fonts/SimpleFontData.cpp
+++ b/Source/platform/fonts/SimpleFontData.cpp
@@ -103,7 +103,6 @@
 {
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
     if (!glyphPageZero) {
-        WTF_LOG_ERROR("Failed to get glyph page zero.");
         m_spaceGlyph = 0;
         m_spaceWidth = 0;
         m_zeroGlyph = 0;
diff --git a/Source/platform/fonts/android/FontCacheAndroid.cpp b/Source/platform/fonts/android/FontCacheAndroid.cpp
index 8f070e8..59dafdc 100644
--- a/Source/platform/fonts/android/FontCacheAndroid.cpp
+++ b/Source/platform/fonts/android/FontCacheAndroid.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "platform/fonts/FontCache.h"
 
-
+#include "platform/Language.h"
 #include "platform/fonts/SimpleFontData.h"
 #include "platform/fonts/FontDescription.h"
 #include "platform/fonts/FontFaceCreationParams.h"
@@ -40,31 +40,10 @@
 
 namespace blink {
 
-static AtomicString getFamilyNameForCharacter(UChar32 c, UScriptCode script)
+static AtomicString getFamilyNameForCharacter(UChar32 c, const FontDescription& fontDescription)
 {
-    // This is a hack to use the preferred font for CJK scripts.
-    // FIXME: Use new Skia API once Android system supports per-family and per-script fallback fonts.
-    const char* locale;
-    switch (script) {
-    case USCRIPT_SIMPLIFIED_HAN:
-        locale = "zh-CN";
-        break;
-    case USCRIPT_TRADITIONAL_HAN:
-        locale = "zh-TW";
-        break;
-    case USCRIPT_KATAKANA_OR_HIRAGANA:
-        locale = "ja";
-        break;
-    case USCRIPT_HANGUL:
-        locale = "ko";
-        break;
-    default:
-        locale = 0;
-        break;
-    }
-
     RefPtr<SkFontMgr> fm = adoptRef(SkFontMgr::RefDefault());
-    RefPtr<SkTypeface> typeface = adoptRef(fm->matchFamilyStyleCharacter(0, SkFontStyle(), locale, c));
+    RefPtr<SkTypeface> typeface = adoptRef(fm->matchFamilyStyleCharacter(0, SkFontStyle(), fontDescription.locale().isEmpty() ? defaultLanguage().ascii().data() : fontDescription.locale().ascii().data(), c));
     if (!typeface)
         return emptyAtom;
 
@@ -75,19 +54,19 @@
 
 PassRefPtr<SimpleFontData> FontCache::fallbackFontForCharacter(const FontDescription& fontDescription, UChar32 c, const SimpleFontData*)
 {
-    AtomicString familyName = getFamilyNameForCharacter(c, fontDescription.script());
+    AtomicString familyName = getFamilyNameForCharacter(c, fontDescription);
     if (familyName.isEmpty())
         return getLastResortFallbackFont(fontDescription, DoNotRetain);
     return fontDataFromFontPlatformData(getFontPlatformData(fontDescription, FontFaceCreationParams(familyName)), DoNotRetain);
 }
 
 // static
-AtomicString FontCache::getGenericFamilyNameForScript(const AtomicString& familyName, UScriptCode script)
+AtomicString FontCache::getGenericFamilyNameForScript(const AtomicString& familyName, const FontDescription& fontDescription)
 {
     // This is a hack to use the preferred font for CJK scripts.
     // FIXME: Use new Skia API once Android system supports per-family and per-script fallback fonts.
     UChar32 examplerChar;
-    switch (script) {
+    switch (fontDescription.script()) {
     case USCRIPT_SIMPLIFIED_HAN:
     case USCRIPT_TRADITIONAL_HAN:
     case USCRIPT_KATAKANA_OR_HIRAGANA:
@@ -101,7 +80,7 @@
         return familyName;
     }
 
-    return getFamilyNameForCharacter(examplerChar, script);
+    return getFamilyNameForCharacter(examplerChar, fontDescription);
 }
 
 } // namespace blink
diff --git a/Source/platform/fonts/skia/FontCacheSkia.cpp b/Source/platform/fonts/skia/FontCacheSkia.cpp
index 6fcbca2..c069970 100644
--- a/Source/platform/fonts/skia/FontCacheSkia.cpp
+++ b/Source/platform/fonts/skia/FontCacheSkia.cpp
@@ -97,7 +97,7 @@
     }
 
     FontCache::PlatformFallbackFont fallbackFont;
-    FontCache::getFontForCharacter(c, "", &fallbackFont);
+    FontCache::getFontForCharacter(c, fontDescription.locale().ascii().data(), &fallbackFont);
     if (fallbackFont.name.isEmpty())
         return nullptr;