Merge WebView M40 build 1832189 into AOSP.
diff --git a/.merged-revisions b/.merged-revisions
index 5ad6016..e2aee3d 100644
--- a/.merged-revisions
+++ b/.merged-revisions
@@ -54,3 +54,12 @@
 bb5fa6fd0e1a66f11c6c88f8edcf6292db0eb270 4c33796d447ff2ef2758068b9e056d396fe991aa 1987615c8101e1a77c5a0f50dd525817475ef0a9
 91eb1d86c5e31d6d16c98a222fb9754fb2bb3789 db3b40afa68d8e975f6b9b39269b783c97b1193b 38e597695d1ea223898eb4a0e7f77f09f65d10bf
 04b5e0ef5841f4ca24fb295a1e6b8ad3945ebb1e 627124f9ae042257f3e34af213ba90c4d9b43753 367cfecc032b2ace027caf0d085560764bdd8433
+eed44c943c9f046859ac3ff92f33e340b7a48ba7 e867532940814305af6919ad0d230a066310772d 6b4e6a72725f0b37640d78f4ad065ea2ea25629b
+29e85d2deb6296e95613c56b6c48f7c1b1fb65cf b00cd162efebe8f732c9ce6835468808e6fd2691 d889fd68f1e727829688671c54dad9f1451991fe
+89c67ddcc5facac418484cf5529e5e9ad57d6902 db158510a660b87dc1f8e778d9137ed81b0ccf80 817ef1692560311cabd7216cbad390f82176bb0c
+bbc94673cb67ec241a14093b662f45afed88ee1a a1c277b4ba5f16d867fe198d39a4991139d78f6f fc04b46a390d35fcf850563609d38b3fd52da64d
+dda3e71dfec2cee8b52aafff7db353bc1a8aa0f6 fdb9e630f6269d516d306945c53a1ad035dd2911 c51dda7029d7ec562d3caafcee88b47bd18c283d
+2e473b9e39cddff89bc3b5dbc4b62c6443d140e0 097478c1a38c1b7c44825045bf02f635e0948918 cd3498425a25bc6a7cb057ad90721d5f312346e6
+ec3f91c2254a4a87db039560486ad2cd1c24cd5a 9e75a9e8e78755bdac83500676c5d9a933921504 55853ee1cec3fd97a73955bafe02bc24fd046a61
+55f653529432df63e7ee547545d92551c283ac0f 2d50636ba2727b3fb1fb2357fad512d293e307c5 e454debdd1276690a4bd8f63ccb3807de323a679
+3d920bbbe184a4e397234c7fb33d9d5f1040dc8f 06454d4e6794cee8d5b29d15a75cd6342372d2ba 5c7589bdbe6878566f5ea7171d640153c924cd9e
diff --git a/ManualTests/resources/zh-hans.png b/ManualTests/resources/zh-hans.png
new file mode 100644
index 0000000..2aef636
--- /dev/null
+++ b/ManualTests/resources/zh-hans.png
Binary files differ
diff --git a/ManualTests/resources/zh-hant.png b/ManualTests/resources/zh-hant.png
new file mode 100644
index 0000000..1e06d51
--- /dev/null
+++ b/ManualTests/resources/zh-hant.png
Binary files differ
diff --git a/ManualTests/zh-font-fallback-android.html b/ManualTests/zh-font-fallback-android.html
new file mode 100644
index 0000000..fdd7d01
--- /dev/null
+++ b/ManualTests/zh-font-fallback-android.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<style>
+.test { font-size: 30px; }
+</style>
+<div lang="zh-CN">lang=zh-CN: <span class="test">&#x8AA4;&#x904E;&#x9AA8;</span></div>
+<div lang="zh-TW">lang=zh-TW: <span class="test">&#x8AA4;&#x904E;&#x9AA8;</span></div>
+<div lang="en">lang=en: <span class="test">&#x8AA4;&#x904E;&#x9AA8;</span></div>
+<div>no lang: <span class="test">&#x8AA4;&#x904E;&#x9AA8;</span></div>
+<h2>Expected results:</h2>
+<div>On Android Lollipop when system locale is not zh-TW or zh-HK,<br>
+or on previous Android releases regardless of system locale:</div>
+<img src="resources/zh-hans.png">
+<div>On Android Lollipop when system locale is zh-TW or zh-HK:</div>
+<img src="resources/zh-hant.png">
+
diff --git a/Source/bindings/core/v8/CustomElementBinding.cpp b/Source/bindings/core/v8/CustomElementBinding.cpp
index b9622e2..04526ea 100644
--- a/Source/bindings/core/v8/CustomElementBinding.cpp
+++ b/Source/bindings/core/v8/CustomElementBinding.cpp
@@ -39,10 +39,13 @@
 }
 
 CustomElementBinding::CustomElementBinding(v8::Isolate* isolate, v8::Handle<v8::Object> prototype)
-    : m_isolate(isolate)
-    , m_prototype(isolate, prototype)
+    : m_prototype(isolate, prototype)
 {
     ASSERT(!m_prototype.isEmpty());
 }
 
+CustomElementBinding::~CustomElementBinding()
+{
+}
+
 } // namespace blink
diff --git a/Source/bindings/core/v8/CustomElementBinding.h b/Source/bindings/core/v8/CustomElementBinding.h
index c30bfab..406ab3a 100644
--- a/Source/bindings/core/v8/CustomElementBinding.h
+++ b/Source/bindings/core/v8/CustomElementBinding.h
@@ -40,15 +40,10 @@
 class CustomElementBinding {
 public:
     static PassOwnPtr<CustomElementBinding> create(v8::Isolate*, v8::Handle<v8::Object> prototype);
-
-    ~CustomElementBinding() { }
-
-    v8::Handle<v8::Object> prototype() { return m_prototype.newLocal(m_isolate); }
+    ~CustomElementBinding();
 
 private:
     CustomElementBinding(v8::Isolate*, v8::Handle<v8::Object> prototype);
-
-    v8::Isolate* m_isolate;
     ScopedPersistent<v8::Object> m_prototype;
 };
 
diff --git a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp
index a4f7f41..da5c4f5 100644
--- a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp
+++ b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.cpp
@@ -92,7 +92,6 @@
 V8CustomElementLifecycleCallbacks::V8CustomElementLifecycleCallbacks(ScriptState* scriptState, v8::Handle<v8::Object> prototype, v8::Handle<v8::Function> created, v8::Handle<v8::Function> attached, v8::Handle<v8::Function> detached, v8::Handle<v8::Function> attributeChanged)
     : CustomElementLifecycleCallbacks(flagSet(attached, detached, attributeChanged))
     , ContextLifecycleObserver(scriptState->executionContext())
-    , m_owner(0)
     , m_scriptState(scriptState)
     , m_prototype(scriptState->isolate(), prototype)
     , m_created(scriptState->isolate(), created)
@@ -124,27 +123,18 @@
 
 V8CustomElementLifecycleCallbacks::~V8CustomElementLifecycleCallbacks()
 {
-    if (!m_owner)
-        return;
-
-    v8::HandleScope handleScope(m_scriptState->isolate());
-    if (V8PerContextData* perContextData = creationContextData())
-        perContextData->clearCustomElementBinding(m_owner);
 }
 
 bool V8CustomElementLifecycleCallbacks::setBinding(CustomElementDefinition* owner, PassOwnPtr<CustomElementBinding> binding)
 {
-    ASSERT(!m_owner);
-
     V8PerContextData* perContextData = creationContextData();
     if (!perContextData)
         return false;
 
-    m_owner = owner;
-
-    // Bindings retrieve the prototype when needed from per-context data.
+    // The context is responsible for keeping the prototype
+    // alive. This in turn keeps callbacks alive through hidden
+    // references; see CALLBACK_LIST(SET_HIDDEN_VALUE).
     perContextData->addCustomElementBinding(owner, binding);
-
     return true;
 }
 
@@ -156,33 +146,28 @@
     if (!executionContext() || executionContext()->activeDOMObjectsAreStopped())
         return;
 
-    element->setCustomElementState(Element::Upgraded);
-
     if (!m_scriptState->contextIsValid())
         return;
+
+    element->setCustomElementState(Element::Upgraded);
+
     ScriptState::Scope scope(m_scriptState.get());
     v8::Isolate* isolate = m_scriptState->isolate();
     v8::Handle<v8::Context> context = m_scriptState->context();
     v8::Handle<v8::Object> receiver = m_scriptState->world().domDataStore().get(element, isolate);
-    if (!receiver.IsEmpty()) {
-        // Swizzle the prototype of the existing wrapper. We don't need to
-        // worry about non-existent wrappers; they will get the right
-        // prototype when wrapped.
-        v8::Handle<v8::Object> prototype = m_prototype.newLocal(isolate);
-        if (prototype.IsEmpty())
-            return;
-        receiver->SetPrototype(prototype);
-    }
+    if (receiver.IsEmpty())
+        receiver = toV8(element, context->Global(), isolate).As<v8::Object>();
+
+    // Swizzle the prototype of the wrapper.
+    v8::Handle<v8::Object> prototype = m_prototype.newLocal(isolate);
+    if (prototype.IsEmpty())
+        return;
+    receiver->SetPrototype(prototype);
 
     v8::Handle<v8::Function> callback = m_created.newLocal(isolate);
     if (callback.IsEmpty())
         return;
 
-    if (receiver.IsEmpty())
-        receiver = toV8(element, context->Global(), isolate).As<v8::Object>();
-
-    ASSERT(!receiver.IsEmpty());
-
     InspectorInstrumentation::willExecuteCustomElementCallback(element);
 
     v8::TryCatch exceptionCatcher;
diff --git a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h
index 6c73468..b4849b0 100644
--- a/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h
+++ b/Source/bindings/core/v8/V8CustomElementLifecycleCallbacks.h
@@ -65,7 +65,6 @@
 
     V8PerContextData* creationContextData();
 
-    CustomElementDefinition* m_owner;
     RefPtr<ScriptState> m_scriptState;
     ScopedPersistent<v8::Object> m_prototype;
     ScopedPersistent<v8::Function> m_created;
diff --git a/Source/bindings/core/v8/V8PerContextData.cpp b/Source/bindings/core/v8/V8PerContextData.cpp
index 65ebdac..691c079 100644
--- a/Source/bindings/core/v8/V8PerContextData.cpp
+++ b/Source/bindings/core/v8/V8PerContextData.cpp
@@ -46,7 +46,6 @@
     , m_constructorMap(m_isolate)
     , m_contextHolder(adoptPtr(new gin::ContextHolder(m_isolate)))
     , m_context(m_isolate, context)
-    , m_customElementBindings(adoptPtr(new CustomElementBindingMap()))
     , m_activityLogger(0)
     , m_compiledPrivateScript(m_isolate)
 {
@@ -134,25 +133,9 @@
 
 void V8PerContextData::addCustomElementBinding(CustomElementDefinition* definition, PassOwnPtr<CustomElementBinding> binding)
 {
-    ASSERT(!m_customElementBindings->contains(definition));
-    m_customElementBindings->add(definition, binding);
+    m_customElementBindings.append(binding);
 }
 
-void V8PerContextData::clearCustomElementBinding(CustomElementDefinition* definition)
-{
-    CustomElementBindingMap::iterator it = m_customElementBindings->find(definition);
-    ASSERT_WITH_SECURITY_IMPLICATION(it != m_customElementBindings->end());
-    m_customElementBindings->remove(it);
-}
-
-CustomElementBinding* V8PerContextData::customElementBinding(CustomElementDefinition* definition)
-{
-    CustomElementBindingMap::const_iterator it = m_customElementBindings->find(definition);
-    ASSERT_WITH_SECURITY_IMPLICATION(it != m_customElementBindings->end());
-    return it->value.get();
-}
-
-
 static v8::Handle<v8::Value> createDebugData(const char* worldName, int debugId, v8::Isolate* isolate)
 {
     char buffer[32];
diff --git a/Source/bindings/core/v8/V8PerContextData.h b/Source/bindings/core/v8/V8PerContextData.h
index ee1b5ea..238c974 100644
--- a/Source/bindings/core/v8/V8PerContextData.h
+++ b/Source/bindings/core/v8/V8PerContextData.h
@@ -88,8 +88,6 @@
     V8NPObjectMap* v8NPObjectMap() { return &m_v8NPObjectMap; }
 
     void addCustomElementBinding(CustomElementDefinition*, PassOwnPtr<CustomElementBinding>);
-    void clearCustomElementBinding(CustomElementDefinition*);
-    CustomElementBinding* customElementBinding(CustomElementDefinition*);
 
     V8DOMActivityLogger* activityLogger() const { return m_activityLogger; }
     void setActivityLogger(V8DOMActivityLogger* activityLogger) { m_activityLogger = activityLogger; }
@@ -120,8 +118,8 @@
     ScopedPersistent<v8::Context> m_context;
     ScopedPersistent<v8::Value> m_errorPrototype;
 
-    typedef WTF::HashMap<CustomElementDefinition*, OwnPtr<CustomElementBinding> > CustomElementBindingMap;
-    OwnPtr<CustomElementBindingMap> m_customElementBindings;
+    typedef Vector<OwnPtr<CustomElementBinding> > CustomElementBindingList;
+    CustomElementBindingList m_customElementBindings;
 
     // This is owned by a static hash map in V8DOMActivityLogger.
     V8DOMActivityLogger* m_activityLogger;
diff --git a/Source/bindings/core/v8/V8ThrowException.cpp b/Source/bindings/core/v8/V8ThrowException.cpp
index 060ab6b..9a0d436 100644
--- a/Source/bindings/core/v8/V8ThrowException.cpp
+++ b/Source/bindings/core/v8/V8ThrowException.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "bindings/core/v8/V8ThrowException.h"
 
+#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8DOMException.h"
 #include "core/dom/DOMException.h"
@@ -62,8 +63,16 @@
     if (ec == V8ReferenceError)
         return V8ThrowException::createReferenceError(isolate, sanitizedMessage);
 
+    v8::Handle<v8::Object> sanitizedCreationContext = creationContext;
+
+    // FIXME: Is the current context always the right choice?
+    Frame* frame = toFrameIfNotDetached(creationContext->CreationContext());
+    if (!frame || !BindingSecurity::shouldAllowAccessToFrame(isolate, frame, DoNotReportSecurityError))
+        sanitizedCreationContext = isolate->GetCurrentContext()->Global();
+
+
     RefPtrWillBeRawPtr<DOMException> domException = DOMException::create(ec, sanitizedMessage, unsanitizedMessage);
-    v8::Handle<v8::Value> exception = toV8(domException, creationContext, isolate);
+    v8::Handle<v8::Value> exception = toV8(domException, sanitizedCreationContext, isolate);
 
     if (exception.IsEmpty())
         return v8Undefined();
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm.mk
index 6e2f1bf..de751d9 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm.mk
@@ -81,7 +81,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -181,7 +180,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm64.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm64.mk
index b979802..5b96a56 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm64.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-arm64.mk
@@ -80,7 +80,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -168,7 +167,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86.mk
index c203b9e..8f279dd 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86.mk
@@ -80,7 +80,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -174,7 +173,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86_64.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86_64.mk
index 6a23f7a..c48abf1 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86_64.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.darwin-x86_64.mk
@@ -81,7 +81,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -174,7 +173,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm.mk
index 6e2f1bf..de751d9 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm.mk
@@ -81,7 +81,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -181,7 +180,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm64.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm64.mk
index b979802..5b96a56 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm64.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-arm64.mk
@@ -80,7 +80,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -168,7 +167,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86.mk
index c203b9e..8f279dd 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86.mk
@@ -80,7 +80,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -174,7 +173,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86_64.mk b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86_64.mk
index 6a23f7a..c48abf1 100644
--- a/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86_64.mk
+++ b/Source/bindings/core/v8/bindings_core_impl_generated.target.linux-x86_64.mk
@@ -81,7 +81,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -174,7 +173,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm.mk
index 17606ee..65a4e89 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm.mk
@@ -5740,7 +5740,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5840,7 +5839,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm64.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm64.mk
index 71fbac1..6c91e0b 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm64.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-arm64.mk
@@ -5739,7 +5739,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5827,7 +5826,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86.mk
index 4e00c9a..1dc42da 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86.mk
@@ -5739,7 +5739,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5833,7 +5832,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86_64.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86_64.mk
index 9053b8f..acc47cf 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86_64.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.darwin-x86_64.mk
@@ -5740,7 +5740,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5833,7 +5832,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm.mk
index 17606ee..65a4e89 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm.mk
@@ -5740,7 +5740,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5840,7 +5839,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm64.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm64.mk
index 71fbac1..6c91e0b 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm64.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-arm64.mk
@@ -5739,7 +5739,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5827,7 +5826,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86.mk
index 4e00c9a..1dc42da 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86.mk
@@ -5739,7 +5739,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5833,7 +5832,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86_64.mk b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86_64.mk
index 9053b8f..acc47cf 100644
--- a/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86_64.mk
+++ b/Source/bindings/core/v8/bindings_core_v8_generated_individual.target.linux-x86_64.mk
@@ -5740,7 +5740,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -5833,7 +5832,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm.mk
index 3e36aed..07b291b 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm.mk
@@ -85,7 +85,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -185,7 +184,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm64.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm64.mk
index 8b4ad87..2af7620 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-arm64.mk
@@ -84,7 +84,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -172,7 +171,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86.mk
index ce97d81..ddeade6 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86.mk
@@ -84,7 +84,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -178,7 +177,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86_64.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86_64.mk
index e1fda8a..ca581f5 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86_64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.darwin-x86_64.mk
@@ -85,7 +85,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -178,7 +177,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm.mk
index 3e36aed..07b291b 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm.mk
@@ -85,7 +85,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -185,7 +184,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm64.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm64.mk
index 8b4ad87..2af7620 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-arm64.mk
@@ -84,7 +84,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -172,7 +171,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86.mk
index ce97d81..ddeade6 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86.mk
@@ -84,7 +84,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -178,7 +177,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86_64.mk b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86_64.mk
index e1fda8a..ca581f5 100644
--- a/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86_64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_impl_generated.target.linux-x86_64.mk
@@ -85,7 +85,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -178,7 +177,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm.mk
index 92c5c54..9afb0eb 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm.mk
@@ -2463,7 +2463,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2563,7 +2562,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm64.mk
index cb2db99..74974fa 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-arm64.mk
@@ -2462,7 +2462,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2550,7 +2549,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86.mk
index fc3e02c..23c2906 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86.mk
@@ -2462,7 +2462,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2556,7 +2555,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86_64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86_64.mk
index 0814693..a85b069 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86_64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.darwin-x86_64.mk
@@ -2463,7 +2463,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2556,7 +2555,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm.mk
index 92c5c54..9afb0eb 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm.mk
@@ -2463,7 +2463,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2563,7 +2562,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm64.mk
index cb2db99..74974fa 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-arm64.mk
@@ -2462,7 +2462,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2550,7 +2549,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86.mk
index fc3e02c..23c2906 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86.mk
@@ -2462,7 +2462,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2556,7 +2555,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86_64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86_64.mk
index 0814693..a85b069 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86_64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_individual.target.linux-x86_64.mk
@@ -2463,7 +2463,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -2556,7 +2555,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm.mk
index bede5e3..fafc54e 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm.mk
@@ -219,7 +219,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -319,7 +318,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm64.mk
index 19e5dd4..a57a64c 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-arm64.mk
@@ -218,7 +218,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -306,7 +305,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86.mk
index f0d6683..6f3cee3 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86.mk
@@ -218,7 +218,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -312,7 +311,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86_64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86_64.mk
index c80df30..1e298b7 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86_64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.darwin-x86_64.mk
@@ -219,7 +219,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -312,7 +311,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm.mk
index bede5e3..fafc54e 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm.mk
@@ -219,7 +219,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -319,7 +318,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm64.mk
index 19e5dd4..a57a64c 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-arm64.mk
@@ -218,7 +218,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -306,7 +305,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86.mk
index f0d6683..6f3cee3 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86.mk
@@ -218,7 +218,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -312,7 +311,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86_64.mk b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86_64.mk
index c80df30..1e298b7 100644
--- a/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86_64.mk
+++ b/Source/bindings/modules/v8/bindings_modules_v8_generated_partial_individual.target.linux-x86_64.mk
@@ -219,7 +219,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -312,7 +311,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/core/accessibility/AXObject.h b/Source/core/accessibility/AXObject.h
index 9ca68a1..43517cd 100644
--- a/Source/core/accessibility/AXObject.h
+++ b/Source/core/accessibility/AXObject.h
@@ -417,6 +417,10 @@
     virtual AXObject* titleUIElement() const { return 0; }
     virtual KURL url() const { return KURL(); }
 
+    // Load inline text boxes for just this node, even if
+    // settings->inlineTextBoxAccessibilityEnabled() is false.
+    virtual void loadInlineTextBoxes() { }
+
     // For an inline text box.
     virtual AccessibilityTextDirection textDirection() const { return AccessibilityTextDirectionLeftToRight; }
     // The integer horizontal pixel offset of each character in the string; negative values for RTL.
diff --git a/Source/core/accessibility/AXRenderObject.cpp b/Source/core/accessibility/AXRenderObject.cpp
index bf0909f..7d71392 100644
--- a/Source/core/accessibility/AXRenderObject.cpp
+++ b/Source/core/accessibility/AXRenderObject.cpp
@@ -883,6 +883,19 @@
 }
 
 //
+// Load inline text boxes.
+//
+
+void AXRenderObject::loadInlineTextBoxes()
+{
+    if (!renderer() || !renderer()->isText())
+        return;
+
+    clearChildren();
+    addInlineTextBoxChildren(true);
+}
+
+//
 // Properties of interactive elements.
 //
 
@@ -962,6 +975,24 @@
     if (m_renderer->isFileUploadControl())
         return toRenderFileUploadControl(m_renderer)->fileTextValue();
 
+     // Handle other HTML input elements that aren't text controls, like date and time
+     // controls, by returning the string value, with the exception of checkboxes
+     // and radio buttons (which would return "on").
+     if (node() && isHTMLInputElement(node())) {
+         HTMLInputElement* input = toHTMLInputElement(node());
+         if (input->type() != InputTypeNames::checkbox && input->type() != InputTypeNames::radio)
+             return input->value();
+    }
+
+    // Handle other HTML input elements that aren't text controls, like date and time
+    // controls, by returning the string value, with the exception of checkboxes
+    // and radio buttons (which would return "on").
+    if (node() && isHTMLInputElement(node())) {
+        HTMLInputElement* input = toHTMLInputElement(node());
+        if (input->type() != InputTypeNames::checkbox && input->type() != InputTypeNames::radio)
+            return input->value();
+    }
+
     // FIXME: We might need to implement a value here for more types
     // FIXME: It would be better not to advertise a value at all for the types for which we don't implement one;
     // this would require subclassing or making accessibilityAttributeNames do something other than return a
@@ -1514,7 +1545,7 @@
     addTextFieldChildren();
     addCanvasChildren();
     addRemoteSVGChildren();
-    addInlineTextBoxChildren();
+    addInlineTextBoxChildren(false);
 
     for (unsigned i = 0; i < m_children.size(); ++i) {
         if (!m_children[i].get()->cachedParentObject())
@@ -1857,10 +1888,10 @@
     return TextIterator::rangeLength(range.get());
 }
 
-void AXRenderObject::addInlineTextBoxChildren()
+void AXRenderObject::addInlineTextBoxChildren(bool force)
 {
     Settings* settings = document()->settings();
-    if (!settings || !settings->inlineTextBoxAccessibilityEnabled())
+    if (!force && (!settings || !settings->inlineTextBoxAccessibilityEnabled()))
         return;
 
     if (!renderer() || !renderer()->isText())
diff --git a/Source/core/accessibility/AXRenderObject.h b/Source/core/accessibility/AXRenderObject.h
index 7fb9505..b3eb7c3 100644
--- a/Source/core/accessibility/AXRenderObject.h
+++ b/Source/core/accessibility/AXRenderObject.h
@@ -104,6 +104,9 @@
     virtual int textLength() const override;
     virtual KURL url() const override;
 
+    // Load inline text boxes if they're not already loaded.
+    virtual void loadInlineTextBoxes() override;
+
     // Properties of interactive elements.
     virtual String actionVerb() const override;
     virtual String stringValue() const override;
@@ -210,7 +213,7 @@
     void addAttachmentChildren();
     void addPopupChildren();
     void addRemoteSVGChildren();
-    void addInlineTextBoxChildren();
+    void addInlineTextBoxChildren(bool force);
 
     void ariaSelectedRows(AccessibilityChildrenVector&);
     bool elementAttributeValue(const QualifiedName&) const;
diff --git a/Source/core/animation/css/CSSAnimations.cpp b/Source/core/animation/css/CSSAnimations.cpp
index 18f5745..f871570 100644
--- a/Source/core/animation/css/CSSAnimations.cpp
+++ b/Source/core/animation/css/CSSAnimations.cpp
@@ -199,8 +199,11 @@
 const StyleRuleKeyframes* CSSAnimations::matchScopedKeyframesRule(StyleResolver* resolver, const Element* element, const StringImpl* animationName)
 {
     // FIXME: This is all implementation detail of style resolver, CSSAnimations shouldn't be reaching into any of it.
-    if (element->document().styleEngine()->hasOnlyScopedResolverForDocument())
-        return element->document().scopedStyleResolver()->keyframeStylesForAnimation(animationName);
+    if (element->document().styleEngine()->onlyDocumentHasStyles()) {
+        if (ScopedStyleResolver* resolver = element->document().scopedStyleResolver())
+            return resolver->keyframeStylesForAnimation(animationName);
+        return nullptr;
+    }
 
     WillBeHeapVector<RawPtrWillBeMember<ScopedStyleResolver>, 8> stack;
     resolver->styleTreeResolveScopedKeyframesRules(element, stack);
diff --git a/Source/core/css/CSSSelector.h b/Source/core/css/CSSSelector.h
index 100241c..647bea9 100644
--- a/Source/core/css/CSSSelector.h
+++ b/Source/core/css/CSSSelector.h
@@ -48,9 +48,6 @@
     //   --> (relation == SubSelector)
     //     selectorText(): .b
     //
-    // Note that currently a bare selector such as ".a" has a relation() of Descendant. This is a bug - instead the relation should be
-    // "None".
-    //
     // The order of tagHistory() varies depending on the situation.
     // * Relations using combinators (http://www.w3.org/TR/css3-selectors/#combinators), such as descendant, sibling, etc., are parsed
     //   right-to-left (in the example above, this is why .c is earlier in the tagHistory() chain than .a.b).
@@ -106,7 +103,7 @@
 
         /* how the attribute value has to match.... Default is Exact */
         enum Match {
-            Unknown = 0,
+            Unknown,
             Tag, // Example: div
             Id, // Example: #id
             Class, // example: .class
@@ -124,17 +121,17 @@
         };
 
         enum Relation {
-            Descendant = 0, // "Space" combinator
+            SubSelector, // No combinator
+            Descendant, // "Space" combinator
             Child, // > combinator
             DirectAdjacent, // + combinator
             IndirectAdjacent, // ~ combinator
-            SubSelector, // "No space" combinator
             ShadowPseudo, // Special case of shadow DOM pseudo elements / shadow pseudo element
             ShadowDeep // /deep/ combinator
         };
 
         enum PseudoType {
-            PseudoNotParsed = 0,
+            PseudoNotParsed,
             PseudoUnknown,
             PseudoEmpty,
             PseudoFirstChild,
@@ -296,8 +293,6 @@
         bool isHostPseudoClass() const;
         bool isTreeBoundaryCrossing() const;
         bool isInsertionPointCrossing() const;
-        // FIXME: selectors with no tagHistory() get a relation() of Descendant (and sometimes even SubSelector). It should instead be
-        // None.
         Relation relation() const { return static_cast<Relation>(m_relation); }
         void setRelation(Relation relation)
         {
@@ -472,7 +467,7 @@
 }
 
 inline CSSSelector::CSSSelector()
-    : m_relation(Descendant)
+    : m_relation(SubSelector)
     , m_match(Unknown)
     , m_pseudoType(PseudoNotParsed)
     , m_parsedNth(false)
@@ -486,7 +481,7 @@
 }
 
 inline CSSSelector::CSSSelector(const QualifiedName& tagQName, bool tagIsForNamespaceRule)
-    : m_relation(Descendant)
+    : m_relation(SubSelector)
     , m_match(Tag)
     , m_pseudoType(PseudoNotParsed)
     , m_parsedNth(false)
diff --git a/Source/core/css/RuleSet.cpp b/Source/core/css/RuleSet.cpp
index 6cf0f6e..e8e6852 100644
--- a/Source/core/css/RuleSet.cpp
+++ b/Source/core/css/RuleSet.cpp
@@ -57,10 +57,8 @@
         const AtomicString& selectorNamespace = selector.tagQName().namespaceURI();
         if (selectorNamespace != starAtom && selectorNamespace != xhtmlNamespaceURI)
             return false;
-        if (selector.relation() == CSSSelector::SubSelector) {
-            ASSERT(selector.tagHistory());
+        if (selector.relation() == CSSSelector::SubSelector && selector.tagHistory())
             return isSelectorMatchingHTMLBasedOnRuleHash(*selector.tagHistory());
-        }
         return true;
     }
     if (SelectorChecker::isCommonPseudoClassSelector(selector))
@@ -181,10 +179,8 @@
 #endif
 
     const CSSSelector* it = &component;
-    for (; it && it->relation() == CSSSelector::SubSelector; it = it->tagHistory()) {
+    for (; it && it->relation() == CSSSelector::SubSelector; it = it->tagHistory())
         extractValuesforSelector(it, id, className, customPseudoElementName, tagName);
-    }
-    // FIXME: this null check should not be necessary. See crbug.com/358475
     if (it)
         extractValuesforSelector(it, id, className, customPseudoElementName, tagName);
 
diff --git a/Source/core/css/html.css b/Source/core/css/html.css
index 00df892..05c18bd 100644
--- a/Source/core/css/html.css
+++ b/Source/core/css/html.css
@@ -397,6 +397,7 @@
 input, textarea, keygen, select, button {
     margin: 0__qem;
     font: -webkit-small-control;
+    text-rendering: auto; /* FIXME: Remove when tabs work with optimizeLegibility. */
     color: initial;
     letter-spacing: normal;
     word-spacing: normal;
diff --git a/Source/core/css/parser/BisonCSSParser-in.cpp b/Source/core/css/parser/BisonCSSParser-in.cpp
index 51b08bb..8d561e0 100644
--- a/Source/core/css/parser/BisonCSSParser-in.cpp
+++ b/Source/core/css/parser/BisonCSSParser-in.cpp
@@ -965,7 +965,6 @@
     // We therefore create a new Selector with that combinator here in any case, even if matching any (host) element in any namespace (i.e. '*').
     OwnPtr<CSSParserSelector> elementNameSelector = adoptPtr(new CSSParserSelector(tag));
     last->setTagHistory(elementNameSelector.release());
-    last->setRelation(CSSSelector::SubSelector);
     return specifiers;
 }
 
diff --git a/Source/core/css/parser/CSSParserValues.cpp b/Source/core/css/parser/CSSParserValues.cpp
index 565112b..3e9a98e 100644
--- a/Source/core/css/parser/CSSParserValues.cpp
+++ b/Source/core/css/parser/CSSParserValues.cpp
@@ -144,9 +144,7 @@
     second->m_selector = m_selector.release();
     second->m_tagHistory = m_tagHistory.release();
     m_tagHistory = second.release();
-
     m_selector = adoptPtr(new CSSSelector(tagQName, tagIsForNamespaceRule));
-    m_selector->setRelation(CSSSelector::SubSelector);
 }
 
 bool CSSParserSelector::hasHostPseudoSelector() const
diff --git a/Source/core/css/resolver/StyleResolver.cpp b/Source/core/css/resolver/StyleResolver.cpp
index edcebea..9aeb7a4 100644
--- a/Source/core/css/resolver/StyleResolver.cpp
+++ b/Source/core/css/resolver/StyleResolver.cpp
@@ -181,9 +181,7 @@
     if (!treeScope)
         return;
 
-    ScopedStyleResolver& resolver = treeScope->ensureScopedStyleResolver();
-    document().styleEngine()->addScopedStyleResolver(&resolver);
-    unsigned index = resolver.appendCSSStyleSheet(cssSheet);
+    unsigned index = treeScope->ensureScopedStyleResolver().appendCSSStyleSheet(cssSheet);
 
     addRulesFromSheet(cssSheet, treeScope, index);
 }
@@ -240,10 +238,9 @@
 void StyleResolver::processScopedRules(const RuleSet& authorRules, CSSStyleSheet* parentStyleSheet, unsigned parentIndex, ContainerNode& scope)
 {
     const WillBeHeapVector<RawPtrWillBeMember<StyleRuleKeyframes> > keyframesRules = authorRules.keyframesRules();
-    ScopedStyleResolver* resolver = &scope.treeScope().ensureScopedStyleResolver();
-    document().styleEngine()->addScopedStyleResolver(resolver);
+    ScopedStyleResolver& resolver = scope.treeScope().ensureScopedStyleResolver();
     for (unsigned i = 0; i < keyframesRules.size(); ++i)
-        resolver->addKeyframeStyle(keyframesRules[i]);
+        resolver.addKeyframeStyle(keyframesRules[i]);
 
     m_treeBoundaryCrossingRules.addTreeBoundaryCrossingRules(authorRules, parentStyleSheet, parentIndex, scope);
 
@@ -259,19 +256,18 @@
 
 void StyleResolver::resetAuthorStyle(TreeScope& treeScope)
 {
+    m_treeBoundaryCrossingRules.reset(&treeScope.rootNode());
+    resetRuleFeatures();
+
     ScopedStyleResolver* resolver = treeScope.scopedStyleResolver();
     if (!resolver)
         return;
 
-    m_treeBoundaryCrossingRules.reset(&treeScope.rootNode());
-
     resolver->resetAuthorStyle();
-    resetRuleFeatures();
     if (treeScope.rootNode().isDocumentNode())
         return;
 
     // resolver is going to be freed below.
-    document().styleEngine()->removeScopedStyleResolver(resolver);
     treeScope.clearScopedStyleResolver();
 }
 
@@ -402,8 +398,13 @@
     collector.clearMatchedRules();
     collector.matchedResult().ranges.lastAuthorRule = collector.matchedResult().matchedProperties.size() - 1;
 
-    if (document().styleEngine()->hasOnlyScopedResolverForDocument()) {
-        document().scopedStyleResolver()->collectMatchingAuthorRules(collector, includeEmptyRules, ignoreCascadeScope);
+    if (document().styleEngine()->onlyDocumentHasStyles()) {
+        ScopedStyleResolver* resolver = document().scopedStyleResolver();
+        if (!resolver)
+            return;
+        // If we have no resolver for a document, the document has no styles.
+        // We don't need to see any rules (including treeboundary crossing ones).
+        resolver->collectMatchingAuthorRules(collector, includeEmptyRules, ignoreCascadeScope);
         m_treeBoundaryCrossingRules.collectTreeBoundaryCrossingRules(element, collector, includeEmptyRules);
         collector.sortAndTransferMatchedRules();
         return;
@@ -419,15 +420,14 @@
         return;
     }
 
-    if (resolvers.isEmpty())
-        return;
-
-    CascadeScope cascadeScope = 0;
-    CascadeOrder cascadeOrder = resolvers.size();
-    for (unsigned i = 0; i < resolvers.size(); ++i, --cascadeOrder) {
-        ScopedStyleResolver* resolver = resolvers.at(i);
-        // FIXME: Need to clarify how to treat style scoped.
-        resolver->collectMatchingAuthorRules(collector, includeEmptyRules, cascadeScope++, resolver->treeScope() == element->treeScope() && resolver->treeScope().rootNode().isShadowRoot() ? 0 : cascadeOrder);
+    if (!resolvers.isEmpty()) {
+        CascadeScope cascadeScope = 0;
+        CascadeOrder cascadeOrder = resolvers.size();
+        for (unsigned i = 0; i < resolvers.size(); ++i, --cascadeOrder) {
+            ScopedStyleResolver* resolver = resolvers.at(i);
+            // FIXME: Need to clarify how to treat style scoped.
+            resolver->collectMatchingAuthorRules(collector, includeEmptyRules, cascadeScope++, resolver->treeScope() == element->treeScope() && resolver->treeScope().rootNode().isShadowRoot() ? 0 : cascadeOrder);
+        }
     }
 
     m_treeBoundaryCrossingRules.collectTreeBoundaryCrossingRules(element, collector, includeEmptyRules);
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 19637bd..a498a62 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -120,6 +120,7 @@
 #include "core/frame/History.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/PinchViewport.h"
 #include "core/frame/Settings.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/DocumentNameCollection.h"
@@ -5289,7 +5290,7 @@
     if (!view())
         return;
 
-    LayoutRect visibleContentRect = view()->visibleContentRect();
+    LayoutRect visibleContentRect = view()->visualViewportRect();
     for (size_t i = 0; i < quads.size(); ++i) {
         quads[i].move(-FloatSize(visibleContentRect.x().toFloat(), visibleContentRect.y().toFloat()));
         adjustFloatQuadForAbsoluteZoom(quads[i], renderer);
@@ -5301,7 +5302,7 @@
     if (!view())
         return;
 
-    LayoutRect visibleContentRect = view()->visibleContentRect();
+    LayoutRect visibleContentRect = view()->visualViewportRect();
     rect.move(-FloatSize(visibleContentRect.x().toFloat(), visibleContentRect.y().toFloat()));
     adjustFloatRectForAbsoluteZoom(rect, renderer);
 }
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index 1df94f8..e4db3d3 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -78,8 +78,10 @@
 #include "core/editing/markup.h"
 #include "core/events/EventDispatcher.h"
 #include "core/events/FocusEvent.h"
+#include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/PinchViewport.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
@@ -802,6 +804,11 @@
         result.unite(quads[i].enclosingBoundingBox());
 
     result = view->contentsToRootView(result);
+
+    // FIXME: Cleanup pinch viewport coordinate translations. crbug.com/371902.
+    PinchViewport& pinchViewport = document().page()->frameHost().pinchViewport();
+    result = enclosingIntRect(pinchViewport.mainViewToViewportCSSPixels(result));
+
     return result;
 }
 
@@ -922,12 +929,13 @@
     }
 
     const Attribute& existingAttribute = elementData()->attributes().at(index);
+    AtomicString existingAttributeValue = existingAttribute.value();
     QualifiedName existingAttributeName = existingAttribute.name();
 
     if (!inSynchronizationOfLazyAttribute)
-        willModifyAttribute(existingAttributeName, existingAttribute.value(), newValue);
+        willModifyAttribute(existingAttributeName, existingAttributeValue, newValue);
 
-    if (newValue != existingAttribute.value()) {
+    if (newValue != existingAttributeValue) {
         // If there is an Attr node hooked to this attribute, the Attr::setValue() call below
         // will write into the ElementData.
         // FIXME: Refactor this so it makes some sense.
@@ -1368,8 +1376,6 @@
     HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
     cancelFocusAppearanceUpdate();
     removeCallbackSelectors();
-    if (svgFilterNeedsLayerUpdate())
-        document().unscheduleSVGFilterLayerUpdateHack(*this);
     if (hasRareData()) {
         ElementRareData* data = elementRareData();
         data->clearPseudoElements();
@@ -1396,7 +1402,12 @@
         if (ElementShadow* shadow = data->shadow())
             shadow->detach(context);
     }
+
     ContainerNode::detach(context);
+
+    ASSERT(needsAttach());
+    if (svgFilterNeedsLayerUpdate())
+        document().unscheduleSVGFilterLayerUpdateHack(*this);
 }
 
 bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
@@ -3238,42 +3249,4 @@
     ContainerNode::trace(visitor);
 }
 
-v8::Handle<v8::Object> Element::wrap(v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
-{
-    if (isCustomElement())
-        return wrapCustomElement(creationContext, isolate);
-    return ContainerNode::wrap(creationContext, isolate);
-}
-
-v8::Handle<v8::Object> Element::wrapCustomElement(v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
-{
-    // It's possible that no one except for the new wrapper owns this object at
-    // this moment, so we have to prevent GC to collect this object until the
-    // object gets associated with the wrapper.
-    RefPtrWillBeRawPtr<Element> protect(this);
-
-    ASSERT(!DOMDataStore::containsWrapper(this, isolate));
-
-    ASSERT(!creationContext.IsEmpty());
-    v8::Handle<v8::Context> context = creationContext->CreationContext();
-
-    if (!isUpgradedCustomElement() || DOMWrapperWorld::world(context).isIsolatedWorld())
-        return ContainerNode::wrap(creationContext, isolate);
-
-    const WrapperTypeInfo* wrapperType = wrapperTypeInfo();
-    v8::Handle<v8::Object> wrapper = V8DOMWrapper::createWrapper(creationContext, wrapperType, toScriptWrappableBase(), isolate);
-    if (wrapper.IsEmpty())
-        return v8::Handle<v8::Object>();
-
-    V8PerContextData* perContextData = V8PerContextData::from(context);
-    if (!perContextData)
-        return wrapper;
-
-    CustomElementBinding* binding = perContextData->customElementBinding(customElementDefinition());
-
-    wrapper->SetPrototype(binding->prototype());
-
-    return V8DOMWrapper::associateObjectWithWrapper(isolate, this, wrapperType, wrapper);
-}
-
 } // namespace blink
diff --git a/Source/core/dom/Element.h b/Source/core/dom/Element.h
index 62e268b..240253a 100644
--- a/Source/core/dom/Element.h
+++ b/Source/core/dom/Element.h
@@ -489,8 +489,6 @@
 
     virtual void trace(Visitor*) override;
 
-    virtual v8::Handle<v8::Object> wrap(v8::Handle<v8::Object> creationContext, v8::Isolate*) override;
-
 protected:
     Element(const QualifiedName& tagName, Document*, ConstructionType);
 
diff --git a/Source/core/dom/ProcessingInstruction.cpp b/Source/core/dom/ProcessingInstruction.cpp
index d011233..194ea62 100644
--- a/Source/core/dom/ProcessingInstruction.cpp
+++ b/Source/core/dom/ProcessingInstruction.cpp
@@ -273,18 +273,21 @@
     if (!insertionPoint->inDocument())
         return;
 
+    // No need to remove XSLStyleSheet from StyleEngine.
     if (m_isCSS)
         document().styleEngine()->removeStyleSheetCandidateNode(this);
     else if (m_isXSL)
         document().styleEngine()->removeXSLStyleSheet(this);
 
     RefPtrWillBeRawPtr<StyleSheet> removedSheet = m_sheet;
-
     if (m_sheet) {
         ASSERT(m_sheet->ownerNode() == this);
         clearSheet();
     }
 
+    // No need to remove pending sheets.
+    clearResource();
+
     // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
     if (document().isActive())
         document().removedStyleSheet(removedSheet.get());
diff --git a/Source/core/dom/ScriptedAnimationController.cpp b/Source/core/dom/ScriptedAnimationController.cpp
index dc5824c..5d1a20c 100644
--- a/Source/core/dom/ScriptedAnimationController.cpp
+++ b/Source/core/dom/ScriptedAnimationController.cpp
@@ -83,7 +83,7 @@
 
 void ScriptedAnimationController::dispatchEventsAndCallbacksForPrinting()
 {
-    dispatchEvents();
+    dispatchEvents(EventNames::MediaQueryListEvent);
     callMediaQueryListListeners();
 }
 
@@ -128,11 +128,25 @@
     }
 }
 
-void ScriptedAnimationController::dispatchEvents()
+void ScriptedAnimationController::dispatchEvents(const AtomicString& eventInterfaceFilter)
 {
     WillBeHeapVector<RefPtrWillBeMember<Event> > events;
-    events.swap(m_eventQueue);
-    m_perFrameEvents.clear();
+    if (eventInterfaceFilter.isEmpty()) {
+        events.swap(m_eventQueue);
+        m_perFrameEvents.clear();
+    } else {
+        WillBeHeapVector<RefPtrWillBeMember<Event> > remaining;
+        for (auto& event : m_eventQueue) {
+            if (event && event->interfaceName() == eventInterfaceFilter) {
+                m_perFrameEvents.remove(eventTargetKey(event.get()));
+                events.append(event.release());
+            } else {
+                remaining.append(event.release());
+            }
+        }
+        remaining.swap(m_eventQueue);
+    }
+
 
     for (size_t i = 0; i < events.size(); ++i) {
         EventTarget* eventTarget = events[i]->target();
diff --git a/Source/core/dom/ScriptedAnimationController.h b/Source/core/dom/ScriptedAnimationController.h
index bf39210..812ebc2 100644
--- a/Source/core/dom/ScriptedAnimationController.h
+++ b/Source/core/dom/ScriptedAnimationController.h
@@ -31,6 +31,7 @@
 #include "wtf/RefCounted.h"
 #include "wtf/RefPtr.h"
 #include "wtf/Vector.h"
+#include "wtf/text/AtomicString.h"
 #include "wtf/text/StringImpl.h"
 
 namespace blink {
@@ -70,7 +71,7 @@
 
     void scheduleAnimationIfNeeded();
 
-    void dispatchEvents();
+    void dispatchEvents(const AtomicString& eventInterfaceFilter = AtomicString());
     void executeCallbacks(double monotonicTimeNow);
     void callMediaQueryListListeners();
 
diff --git a/Source/core/dom/StyleEngine.cpp b/Source/core/dom/StyleEngine.cpp
index 9b72382..9883e46 100644
--- a/Source/core/dom/StyleEngine.cpp
+++ b/Source/core/dom/StyleEngine.cpp
@@ -104,9 +104,7 @@
     m_fontSelector.clear();
     m_resolver.clear();
     m_styleSheetCollectionMap.clear();
-    for (ScopedStyleResolverSet::iterator it = m_scopedStyleResolvers.begin(); it != m_scopedStyleResolvers.end(); ++it)
-        const_cast<TreeScope&>((*it)->treeScope()).clearScopedStyleResolver();
-    m_scopedStyleResolvers.clear();
+    m_activeTreeScopes.clear();
 }
 #endif
 
@@ -320,7 +318,6 @@
     collection->removeStyleSheetCandidateNode(node);
 
     markTreeScopeDirty(treeScope);
-    m_activeTreeScopes.remove(&treeScope);
 }
 
 void StyleEngine::addXSLStyleSheet(ProcessingInstruction* node, bool createdByParser)
@@ -428,8 +425,12 @@
             ShadowTreeStyleSheetCollection* collection = static_cast<ShadowTreeStyleSheetCollection*>(styleSheetCollectionFor(*treeScope));
             ASSERT(collection);
             collection->updateActiveStyleSheets(this, updateMode);
-            if (!collection->hasStyleSheetCandidateNodes())
+            if (!collection->hasStyleSheetCandidateNodes()) {
                 treeScopesRemoved.add(treeScope);
+                // When removing TreeScope from ActiveTreeScopes,
+                // its resolver should be destroyed by invoking resetAuthorStyle.
+                ASSERT(!treeScope->scopedStyleResolver());
+            }
         }
         m_activeTreeScopes.removeAll(treeScopesRemoved);
     }
@@ -465,9 +466,9 @@
 
 void StyleEngine::didRemoveShadowRoot(ShadowRoot* shadowRoot)
 {
-    if (shadowRoot->scopedStyleResolver())
-        removeScopedStyleResolver(shadowRoot->scopedStyleResolver());
     m_styleSheetCollectionMap.remove(shadowRoot);
+    m_activeTreeScopes.remove(shadowRoot);
+    m_dirtyTreeScopes.remove(shadowRoot);
 }
 
 void StyleEngine::appendActiveAuthorStyleSheets()
@@ -494,8 +495,9 @@
     ASSERT(document().frame());
 
     m_resolver = adoptPtrWillBeNoop(new StyleResolver(*m_document));
-    addScopedStyleResolver(&m_document->ensureScopedStyleResolver());
 
+    // A scoped style resolver for document will be created during
+    // appendActiveAuthorStyleSheets if needed.
     appendActiveAuthorStyleSheets();
     combineCSSFeatureFlags(m_resolver->ensureUpdatedRuleFeatureSet());
 }
@@ -505,9 +507,16 @@
     ASSERT(!document().inStyleRecalc());
     ASSERT(isMaster() || !m_resolver);
 
-    for (ScopedStyleResolverSet::iterator it = m_scopedStyleResolvers.begin(); it != m_scopedStyleResolvers.end(); ++it)
-        const_cast<TreeScope&>((*it)->treeScope()).clearScopedStyleResolver();
-    m_scopedStyleResolvers.clear();
+    document().clearScopedStyleResolver();
+    // clearResolver might be invoked while destryoing document. In this case,
+    // treescopes in m_activeTreeScopes might have already been destoryed,
+    // because m_activeTreeScopes are updated in updateActiveStyleSheets, not
+    // in removeStyleSheetCandidateNode. So we should not invoke
+    // treeScope->clearScopedStyleResolver when document is not active.
+    if (document().isActive()) {
+        for (auto& treeScope: m_activeTreeScopes)
+            treeScope->clearScopedStyleResolver();
+    }
 
     if (m_resolver)
         document().updateStyleInvalidationIfNeeded();
@@ -690,8 +699,17 @@
 void StyleEngine::collectScopedStyleFeaturesTo(RuleFeatureSet& features) const
 {
     HashSet<const StyleSheetContents*> visitedSharedStyleSheetContents;
-    for (ScopedStyleResolverSet::iterator it = m_scopedStyleResolvers.begin(); it != m_scopedStyleResolvers.end(); ++it)
-        (*it)->collectFeaturesTo(features, visitedSharedStyleSheetContents);
+    if (document().scopedStyleResolver())
+        document().scopedStyleResolver()->collectFeaturesTo(features, visitedSharedStyleSheetContents);
+    for (auto& treeScope: m_activeTreeScopes) {
+        // When creating StyleResolver, dirty treescopes might not be processed.
+        // So some active treescopes might not have a scoped style resolver.
+        // In this case, we should skip collectFeatures for the treescopes without
+        // scoped style resolvers. When invoking updateActiveStyleSheets,
+        // the treescope's features will be processed.
+        if (ScopedStyleResolver* resolver = treeScope->scopedStyleResolver())
+            resolver->collectFeaturesTo(features, visitedSharedStyleSheetContents);
+    }
 }
 
 void StyleEngine::fontsNeedUpdate(CSSFontSelector*)
@@ -712,7 +730,6 @@
     visitor->trace(m_authorStyleSheets);
     visitor->trace(m_documentStyleSheetCollection);
     visitor->trace(m_styleSheetCollectionMap);
-    visitor->trace(m_scopedStyleResolvers);
     visitor->trace(m_resolver);
     visitor->trace(m_fontSelector);
     visitor->trace(m_textToSheetCache);
diff --git a/Source/core/dom/StyleEngine.h b/Source/core/dom/StyleEngine.h
index 6c6df00..9806bc1 100644
--- a/Source/core/dom/StyleEngine.h
+++ b/Source/core/dom/StyleEngine.h
@@ -170,9 +170,7 @@
     PassRefPtrWillBeRawPtr<CSSStyleSheet> createSheet(Element*, const String& text, TextPosition startPosition, bool createdByParser);
     void removeSheet(StyleSheetContents*);
 
-    void addScopedStyleResolver(const ScopedStyleResolver* resolver) { m_scopedStyleResolvers.add(resolver); }
-    void removeScopedStyleResolver(const ScopedStyleResolver* resolver) { m_scopedStyleResolvers.remove(resolver); }
-    bool hasOnlyScopedResolverForDocument() const { return m_scopedStyleResolvers.size() == 1; }
+    bool onlyDocumentHasStyles() const { return m_activeTreeScopes.isEmpty(); }
     void collectScopedStyleFeaturesTo(RuleFeatureSet&) const;
 
     virtual void trace(Visitor*) override;
@@ -232,8 +230,6 @@
 
     typedef WillBeHeapHashMap<RawPtrWillBeWeakMember<TreeScope>, OwnPtrWillBeMember<ShadowTreeStyleSheetCollection> > StyleSheetCollectionMap;
     StyleSheetCollectionMap m_styleSheetCollectionMap;
-    typedef WillBeHeapHashSet<RawPtrWillBeMember<const ScopedStyleResolver> > ScopedStyleResolverSet;
-    ScopedStyleResolverSet m_scopedStyleResolvers;
 
     bool m_documentScopeDirty;
     TreeScopeSet m_dirtyTreeScopes;
diff --git a/Source/core/dom/shadow/ShadowRoot.cpp b/Source/core/dom/shadow/ShadowRoot.cpp
index d346a20..d598a73 100644
--- a/Source/core/dom/shadow/ShadowRoot.cpp
+++ b/Source/core/dom/shadow/ShadowRoot.cpp
@@ -175,13 +175,16 @@
 
 void ShadowRoot::removedFrom(ContainerNode* insertionPoint)
 {
-    if (insertionPoint->inDocument() && m_registeredWithParentShadowRoot) {
-        ShadowRoot* root = host()->containingShadowRoot();
-        if (!root)
-            root = insertionPoint->containingShadowRoot();
-        if (root)
-            root->removeChildShadowRoot();
-        m_registeredWithParentShadowRoot = false;
+    if (insertionPoint->inDocument()) {
+        clearScopedStyleResolver();
+        if (m_registeredWithParentShadowRoot) {
+            ShadowRoot* root = host()->containingShadowRoot();
+            if (!root)
+                root = insertionPoint->containingShadowRoot();
+            if (root)
+                root->removeChildShadowRoot();
+            m_registeredWithParentShadowRoot = false;
+        }
     }
 
     DocumentFragment::removedFrom(insertionPoint);
diff --git a/Source/core/editing/DeleteSelectionCommand.cpp b/Source/core/editing/DeleteSelectionCommand.cpp
index e2165e8..64e6939 100644
--- a/Source/core/editing/DeleteSelectionCommand.cpp
+++ b/Source/core/editing/DeleteSelectionCommand.cpp
@@ -845,7 +845,10 @@
     if (placeholder) {
         if (m_sanitizeMarkup)
             removeRedundantBlocks();
-        insertNodeAt(placeholder.get(), m_endingPosition);
+        // handleGeneralDelete cause DOM mutation events so |m_endingPosition|
+        // can be out of document.
+        if (m_endingPosition.inDocument())
+            insertNodeAt(placeholder.get(), m_endingPosition);
     }
 
     rebalanceWhitespaceAt(m_endingPosition);
diff --git a/Source/core/editing/FrameSelection.cpp b/Source/core/editing/FrameSelection.cpp
index e071499..f98e29e 100644
--- a/Source/core/editing/FrameSelection.cpp
+++ b/Source/core/editing/FrameSelection.cpp
@@ -72,6 +72,7 @@
 #include "platform/SecureTextInput.h"
 #include "platform/geometry/FloatQuad.h"
 #include "platform/graphics/GraphicsContext.h"
+#include "platform/text/UnicodeUtilities.h"
 #include "wtf/text/CString.h"
 #include <stdio.h>
 
@@ -1930,6 +1931,22 @@
         page->animator().scheduleVisualUpdate();
 }
 
+bool FrameSelection::selectWordAroundPosition(const VisiblePosition& position)
+{
+    static const EWordSide wordSideList[2] = { RightWordIfOnBoundary, LeftWordIfOnBoundary };
+    for (EWordSide wordSide : wordSideList) {
+        VisiblePosition start = startOfWord(position, wordSide);
+        VisiblePosition end = endOfWord(position, wordSide);
+        String text = plainText(start.deepEquivalent(), end.deepEquivalent());
+        if (!text.isEmpty() && !isSeparator(text.characterStartingAt(0))) {
+            setSelection(VisibleSelection(start, end), WordGranularity);
+            return true;
+        }
+    }
+
+    return false;
+}
+
 }
 
 #ifndef NDEBUG
diff --git a/Source/core/editing/FrameSelection.h b/Source/core/editing/FrameSelection.h
index 30f1f34..01f2f87 100644
--- a/Source/core/editing/FrameSelection.h
+++ b/Source/core/editing/FrameSelection.h
@@ -184,6 +184,9 @@
 
     void updateSecureKeyboardEntryIfActive();
 
+    // Returns true if a word is selected.
+    bool selectWordAroundPosition(const VisiblePosition&);
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
     void showTreeForThis() const;
diff --git a/Source/core/editing/FrameSelectionTest.cpp b/Source/core/editing/FrameSelectionTest.cpp
index 2aea63b..b5ab2dd 100644
--- a/Source/core/editing/FrameSelectionTest.cpp
+++ b/Source/core/editing/FrameSelectionTest.cpp
@@ -138,4 +138,25 @@
     EXPECT_EQ(startCount, layoutCount());
 }
 
+#define EXPECT_EQ_SELECTED_TEXT(text) \
+    EXPECT_EQ(text, WebString(selection().selectedText()).utf8())
+
+TEST_F(FrameSelectionTest, SelectWordAroundPosition)
+{
+    // "Foo Bar  Baz,"
+    RefPtrWillBeRawPtr<Text> text = document().createTextNode("Foo Bar&nbsp;&nbsp;Baz,");
+    document().body()->appendChild(text);
+    // "Fo|o Bar  Baz,"
+    EXPECT_TRUE(selection().selectWordAroundPosition(VisiblePosition(Position(text, 2))));
+    EXPECT_EQ_SELECTED_TEXT("Foo");
+    // "Foo| Bar  Baz,"
+    EXPECT_TRUE(selection().selectWordAroundPosition(VisiblePosition(Position(text, 3))));
+    EXPECT_EQ_SELECTED_TEXT("Foo");
+    // "Foo Bar | Baz,"
+    EXPECT_FALSE(selection().selectWordAroundPosition(VisiblePosition(Position(text, 13))));
+    // "Foo Bar  Baz|,"
+    EXPECT_TRUE(selection().selectWordAroundPosition(VisiblePosition(Position(text, 22))));
+    EXPECT_EQ_SELECTED_TEXT("Baz");
+}
+
 }
diff --git a/Source/core/editing/VisibleSelection.cpp b/Source/core/editing/VisibleSelection.cpp
index d8c63bb..4ac0ed5 100644
--- a/Source/core/editing/VisibleSelection.cpp
+++ b/Source/core/editing/VisibleSelection.cpp
@@ -747,7 +747,7 @@
 
 Node* VisibleSelection::nonBoundaryShadowTreeRootNode() const
 {
-    return start().deprecatedNode() ? start().deprecatedNode()->nonBoundaryShadowTreeRootNode() : 0;
+    return start().deprecatedNode() && !start().deprecatedNode()->isShadowRoot() ? start().deprecatedNode()->nonBoundaryShadowTreeRootNode() : 0;
 }
 
 VisibleSelection::ChangeObserver::ChangeObserver()
diff --git a/Source/core/events/KeyboardEvent.cpp b/Source/core/events/KeyboardEvent.cpp
index 99be09c..e0d77f6 100644
--- a/Source/core/events/KeyboardEvent.cpp
+++ b/Source/core/events/KeyboardEvent.cpp
@@ -172,6 +172,14 @@
     // We match IE.
     if (!m_keyEvent)
         return 0;
+
+#if OS(ANDROID)
+    // FIXME: Check to see if this applies to other OS.
+    // If the key event belongs to IME composition then propagate to JS.
+    if (m_keyEvent->nativeVirtualKeyCode() == 0xE5) // VKEY_PROCESSKEY
+        return m_keyEvent->nativeVirtualKeyCode();
+#endif
+
     if (type() == EventTypeNames::keydown || type() == EventTypeNames::keyup)
         return windowsVirtualKeyCodeWithoutLocation(m_keyEvent->windowsVirtualKeyCode());
 
diff --git a/Source/core/events/TreeScopeEventContext.cpp b/Source/core/events/TreeScopeEventContext.cpp
index 738193b..bdf4c0f 100644
--- a/Source/core/events/TreeScopeEventContext.cpp
+++ b/Source/core/events/TreeScopeEventContext.cpp
@@ -42,8 +42,8 @@
     WillBeHeapVector<RefPtrWillBeMember<Node>> nodes;
     nodes.reserveInitialCapacity(path.size());
     for (size_t i = 0; i < path.size(); ++i) {
-        TreeScope& treeScope = path[i].treeScopeEventContext().treeScope();
-        if (treeScope.rootNode().isShadowRoot() && toShadowRoot(treeScope).type() == ShadowRoot::AuthorShadowRoot)
+        Node& rootNode = path[i].treeScopeEventContext().rootNode();
+        if (rootNode.isShadowRoot() && toShadowRoot(rootNode).type() == ShadowRoot::AuthorShadowRoot)
             nodes.append(path[i].node());
         else if (path[i].treeScopeEventContext().isInclusiveAncestorOf(*this))
             nodes.append(path[i].node());
@@ -66,6 +66,7 @@
 
 TreeScopeEventContext::TreeScopeEventContext(TreeScope& treeScope)
     : m_treeScope(treeScope)
+    , m_rootNode(treeScope.rootNode())
     , m_preOrder(-1)
     , m_postOrder(-1)
 {
@@ -76,6 +77,7 @@
 void TreeScopeEventContext::trace(Visitor* visitor)
 {
     visitor->trace(m_treeScope);
+    visitor->trace(m_rootNode);
     visitor->trace(m_target);
     visitor->trace(m_relatedTarget);
     visitor->trace(m_eventPath);
diff --git a/Source/core/events/TreeScopeEventContext.h b/Source/core/events/TreeScopeEventContext.h
index 3b040eb..b6d018d 100644
--- a/Source/core/events/TreeScopeEventContext.h
+++ b/Source/core/events/TreeScopeEventContext.h
@@ -51,6 +51,7 @@
     void trace(Visitor*);
 
     TreeScope& treeScope() const { return *m_treeScope; }
+    Node& rootNode() const { return *m_rootNode; }
 
     EventTarget* target() const { return m_target.get(); }
     void setTarget(PassRefPtrWillBeRawPtr<EventTarget>);
@@ -78,6 +79,7 @@
 #endif
 
     RawPtrWillBeMember<TreeScope> m_treeScope;
+    RefPtrWillBeMember<Node> m_rootNode; // Prevents TreeScope from being freed. TreeScope itself isn't RefCounted.
     RefPtrWillBeMember<EventTarget> m_target;
     RefPtrWillBeMember<EventTarget> m_relatedTarget;
     RefPtrWillBeMember<StaticNodeList> m_eventPath;
diff --git a/Source/core/fetch/ResourceFetcher.cpp b/Source/core/fetch/ResourceFetcher.cpp
index 81f56c4..b29a1a2 100644
--- a/Source/core/fetch/ResourceFetcher.cpp
+++ b/Source/core/fetch/ResourceFetcher.cpp
@@ -1161,12 +1161,9 @@
 
 void ResourceFetcher::didLoadResource()
 {
-    RefPtr<DocumentLoader> protectDocumentLoader(m_documentLoader);
-    RefPtrWillBeRawPtr<Document> protectDocument(m_document.get());
-
+    scheduleDocumentResourcesGC();
     if (frame())
         frame()->loader().loadDone();
-    scheduleDocumentResourcesGC();
 }
 
 void ResourceFetcher::scheduleDocumentResourcesGC()
@@ -1303,6 +1300,8 @@
 void ResourceFetcher::didFinishLoading(Resource* resource, double finishTime, int64_t encodedDataLength)
 {
     TRACE_EVENT_ASYNC_END0("net", "Resource", resource);
+    RefPtr<Document> protectDocument(m_document);
+    RefPtr<DocumentLoader> protectDocumentLoader(m_documentLoader);
 
     if (resource && resource->response().isHTTP() && resource->response().httpStatusCode() < 400 && document()) {
         ResourceTimingInfoMap::iterator it = m_resourceTimingInfoMap.find(resource);
diff --git a/Source/core/frame/FrameView.cpp b/Source/core/frame/FrameView.cpp
index 8a77e1c..1426827 100644
--- a/Source/core/frame/FrameView.cpp
+++ b/Source/core/frame/FrameView.cpp
@@ -1203,13 +1203,7 @@
 bool FrameView::contentsInCompositedLayer() const
 {
     RenderView* renderView = this->renderView();
-    if (renderView && renderView->compositingState() == PaintsIntoOwnBacking) {
-        GraphicsLayer* layer = renderView->layer()->compositedLayerMapping()->mainGraphicsLayer();
-        if (layer && layer->drawsContent())
-            return true;
-    }
-
-    return false;
+    return renderView && renderView->compositingState() == PaintsIntoOwnBacking;
 }
 
 void FrameView::addSlowRepaintObject()
@@ -1488,6 +1482,7 @@
 
     bool pinchVirtualViewportEnabled = m_frame->settings()->pinchVirtualViewportEnabled();
 
+    // FIXME: This needs an isMainFrame() check as well. crbug.com/378776.
     if (pinchVirtualViewportEnabled) {
         PinchViewport& pinchViewport = m_frame->page()->frameHost().pinchViewport();
 
@@ -2976,7 +2971,15 @@
     if (!m_frame->settings() || !m_frame->settings()->pinchVirtualViewportEnabled())
         return false;
 
-    return m_frame->isMainFrame() && ScrollbarTheme::theme()->usesOverlayScrollbars();
+    // FIXME: This decision should be made based on whether or not to use
+    // viewport scrollbars for the main frame. This is implicitly just Android,
+    // but should be made explicit.
+    // http://crbug.com/434533
+#if !OS(ANDROID)
+    return false;
+#else
+    return m_frame->isMainFrame();
+#endif
 }
 
 AXObjectCache* FrameView::axObjectCache() const
@@ -3030,6 +3033,10 @@
 
 void FrameView::setTopControlsViewportAdjustment(float adjustment)
 {
+#if !OS(ANDROID)
+    // The adjustment is done only for top controls which are android only.
+    ASSERT(!adjustment);
+#endif
     m_topControlsViewportAdjustment = adjustment;
 }
 
@@ -3170,6 +3177,17 @@
     return IntRect(flooredIntPoint(m_scrollPosition), expandedIntSize(visibleContentSize));
 }
 
+IntRect FrameView::visualViewportRect() const
+{
+    if (!m_frame->isMainFrame()
+        || !m_frame->settings()
+        || !m_frame->settings()->pinchVirtualViewportEnabled())
+        return visibleContentRect();
+
+    PinchViewport& pinchViewport = m_frame->page()->frameHost().pinchViewport();
+    return enclosingIntRect(pinchViewport.visibleRectInDocument());
+}
+
 IntSize FrameView::contentsSize() const
 {
     return m_contentsSize;
diff --git a/Source/core/frame/FrameView.h b/Source/core/frame/FrameView.h
index 3ea8d4f..01324d1 100644
--- a/Source/core/frame/FrameView.h
+++ b/Source/core/frame/FrameView.h
@@ -402,6 +402,11 @@
     virtual IntRect visibleContentRect(IncludeScrollbarsInRect = ExcludeScrollbars) const override;
     IntSize visibleSize() const { return visibleContentRect().size(); }
 
+    // The visual viewport in the document. For subframes, this will be the visibleContentRect.
+    // For the main frame, we delegate to the PinchViewport as the visual viewport will be affected
+    // by page scale.
+    IntRect visualViewportRect() const;
+
     // visibleContentRect().size() is computed from unscaledVisibleContentSize() divided by the value of visibleContentScaleFactor.
     // For the main frame, visibleContentScaleFactor is equal to the page's pageScaleFactor; it's 1 otherwise.
     IntSize unscaledVisibleContentSize(IncludeScrollbarsInRect = ExcludeScrollbars) const;
diff --git a/Source/core/frame/ImageBitmap.cpp b/Source/core/frame/ImageBitmap.cpp
index 60e52ee..d5ffd02 100644
--- a/Source/core/frame/ImageBitmap.cpp
+++ b/Source/core/frame/ImageBitmap.cpp
@@ -82,7 +82,7 @@
 {
     CanvasRenderingContext* sourceContext = canvas->renderingContext();
     if (sourceContext && sourceContext->is3d())
-        sourceContext->paintRenderingResultsToCanvas();
+        sourceContext->paintRenderingResultsToCanvas(CanvasRenderingContext::Back);
 
     IntRect srcRect = intersection(cropRect, IntRect(IntPoint(), canvas->size()));
     m_bitmapRect = IntRect(IntPoint(std::max(0, -cropRect.x()), std::max(0, -cropRect.y())), srcRect.size());
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index ef0b377..5482e18 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -1151,13 +1151,21 @@
     if (!view)
         return 0;
 
+    FrameHost* host = frame()->host();
+    if (!host)
+        return 0;
+
     // FIXME: This is potentially too much work. We really only need to know the dimensions of the parent frame's renderer.
     if (Frame* parent = frame()->tree().parent()) {
         if (parent && parent->isLocalFrame())
             toLocalFrame(parent)->document()->updateLayoutIgnorePendingStylesheets();
     }
 
-    return adjustForAbsoluteZoom(view->visibleContentRect(IncludeScrollbars).height(), frame()->pageZoomFactor());
+    FloatSize viewportSize = host->settings().pinchVirtualViewportEnabled() && frame()->isMainFrame()
+        ? host->pinchViewport().visibleRect().size()
+        : view->visibleContentRect(IncludeScrollbars).size();
+
+    return adjustForAbsoluteZoom(expandedIntSize(viewportSize).height(), frame()->pageZoomFactor());
 }
 
 int LocalDOMWindow::innerWidth() const
@@ -1169,13 +1177,21 @@
     if (!view)
         return 0;
 
+    FrameHost* host = frame()->host();
+    if (!host)
+        return 0;
+
     // FIXME: This is potentially too much work. We really only need to know the dimensions of the parent frame's renderer.
     if (Frame* parent = frame()->tree().parent()) {
         if (parent && parent->isLocalFrame())
             toLocalFrame(parent)->document()->updateLayoutIgnorePendingStylesheets();
     }
 
-    return adjustForAbsoluteZoom(view->visibleContentRect(IncludeScrollbars).width(), frame()->pageZoomFactor());
+    FloatSize viewportSize = host->settings().pinchVirtualViewportEnabled() && frame()->isMainFrame()
+        ? host->pinchViewport().visibleRect().size()
+        : view->visibleContentRect(IncludeScrollbars).size();
+
+    return adjustForAbsoluteZoom(expandedIntSize(viewportSize).width(), frame()->pageZoomFactor());
 }
 
 int LocalDOMWindow::screenX() const
@@ -1215,9 +1231,18 @@
     if (!view)
         return 0;
 
+    FrameHost* host = frame()->host();
+    if (!host)
+        return 0;
+
     frame()->document()->updateLayoutIgnorePendingStylesheets();
 
-    return adjustScrollForAbsoluteZoom(view->scrollX(), frame()->pageZoomFactor());
+    double viewportX = view->scrollX();
+
+    if (host->settings().pinchVirtualViewportEnabled() && frame()->isMainFrame())
+        viewportX += host->pinchViewport().location().x();
+
+    return adjustScrollForAbsoluteZoom(viewportX, frame()->pageZoomFactor());
 }
 
 double LocalDOMWindow::scrollY() const
@@ -1229,9 +1254,18 @@
     if (!view)
         return 0;
 
+    FrameHost* host = frame()->host();
+    if (!host)
+        return 0;
+
     frame()->document()->updateLayoutIgnorePendingStylesheets();
 
-    return adjustScrollForAbsoluteZoom(view->scrollY(), frame()->pageZoomFactor());
+    double viewportY = view->scrollY();
+
+    if (host->settings().pinchVirtualViewportEnabled() && frame()->isMainFrame())
+        viewportY += host->pinchViewport().location().y();
+
+    return adjustScrollForAbsoluteZoom(viewportY, frame()->pageZoomFactor());
 }
 
 bool LocalDOMWindow::closed() const
@@ -1396,6 +1430,26 @@
     return false;
 }
 
+// FIXME: This class shouldn't be explicitly moving the viewport around. crbug.com/371896
+static void scrollViewportTo(LocalFrame* frame, DoublePoint offset, ScrollBehavior scrollBehavior)
+{
+    FrameView* view = frame->view();
+    if (!view)
+        return;
+
+    FrameHost* host = frame->host();
+    if (!host)
+        return;
+
+    view->setScrollPosition(offset, scrollBehavior);
+
+    if (host->settings().pinchVirtualViewportEnabled() && frame->isMainFrame()) {
+        PinchViewport& pinchViewport = frame->host()->pinchViewport();
+        DoubleSize excessDelta = offset - DoublePoint(pinchViewport.visibleRectInDocument().location());
+        pinchViewport.move(FloatPoint(excessDelta.width(), excessDelta.height()));
+    }
+}
+
 void LocalDOMWindow::scrollBy(double x, double y, ScrollBehavior scrollBehavior) const
 {
     if (!isCurrentlyDisplayedInFrame())
@@ -1407,11 +1461,19 @@
     if (!view)
         return;
 
+    FrameHost* host = frame()->host();
+    if (!host)
+        return;
+
     if (std::isnan(x) || std::isnan(y))
         return;
 
+    DoublePoint currentOffset = host->settings().pinchVirtualViewportEnabled() && frame()->isMainFrame()
+        ? DoublePoint(host->pinchViewport().visibleRectInDocument().location())
+        : view->scrollPositionDouble();
+
     DoubleSize scaledOffset(x * frame()->pageZoomFactor(), y * frame()->pageZoomFactor());
-    view->scrollBy(scaledOffset, scrollBehavior);
+    scrollViewportTo(frame(), currentOffset + scaledOffset, scrollBehavior);
 }
 
 void LocalDOMWindow::scrollBy(double x, double y, const ScrollOptions& scrollOptions, ExceptionState &exceptionState) const
@@ -1429,15 +1491,11 @@
 
     document()->updateLayoutIgnorePendingStylesheets();
 
-    RefPtrWillBeRawPtr<FrameView> view = frame()->view();
-    if (!view)
-        return;
-
     if (std::isnan(x) || std::isnan(y))
         return;
 
     DoublePoint layoutPos(x * frame()->pageZoomFactor(), y * frame()->pageZoomFactor());
-    view->setScrollPosition(layoutPos, scrollBehavior);
+    scrollViewportTo(frame(), layoutPos, scrollBehavior);
 }
 
 void LocalDOMWindow::scrollTo(double x, double y, const ScrollOptions& scrollOptions, ExceptionState& exceptionState) const
diff --git a/Source/core/frame/LocalDOMWindow.h b/Source/core/frame/LocalDOMWindow.h
index 9dd259f..6813445 100644
--- a/Source/core/frame/LocalDOMWindow.h
+++ b/Source/core/frame/LocalDOMWindow.h
@@ -201,6 +201,8 @@
     void postMessageTimerFired(PostMessageTimer*);
     void dispatchMessageEventWithOriginCheck(SecurityOrigin* intendedTargetOrigin, PassRefPtrWillBeRawPtr<Event>, PassRefPtrWillBeRawPtr<ScriptCallStack>);
 
+    // FIXME: ScrollBehaviorSmooth is currently unsupported in PinchViewport.
+    // crbug.com/434497
     void scrollBy(double x, double y, ScrollBehavior = ScrollBehaviorAuto) const;
     void scrollBy(double x, double y, const ScrollOptions&, ExceptionState&) const;
     void scrollTo(double x, double y, ScrollBehavior = ScrollBehaviorAuto) const;
diff --git a/Source/core/frame/PinchViewport.cpp b/Source/core/frame/PinchViewport.cpp
index 30d86e8..1cc01b4 100644
--- a/Source/core/frame/PinchViewport.cpp
+++ b/Source/core/frame/PinchViewport.cpp
@@ -133,6 +133,14 @@
     return pinchRect;
 }
 
+FloatRect PinchViewport::mainViewToViewportCSSPixels(const FloatRect& rect) const
+{
+    // Note, this is in CSS Pixels so we don't apply scale.
+    FloatRect rectInViewport = rect;
+    rectInViewport.moveBy(-location());
+    return rectInViewport;
+}
+
 void PinchViewport::scrollIntoView(const LayoutRect& rect)
 {
     if (!mainFrame() || !mainFrame()->view())
@@ -199,6 +207,9 @@
         ASSERT(coordinator);
         coordinator->scrollableAreaScrollLayerDidChange(this);
 
+        Document* document = mainFrame()->document();
+        document->enqueueScrollEventForNode(document);
+
         valuesChanged = true;
     }
 
diff --git a/Source/core/frame/PinchViewport.h b/Source/core/frame/PinchViewport.h
index f26ebae..5a42888 100644
--- a/Source/core/frame/PinchViewport.h
+++ b/Source/core/frame/PinchViewport.h
@@ -114,8 +114,14 @@
     FloatRect visibleRect() const;
 
     // The viewport rect relative to the document origin, in partial CSS pixels.
+    // FIXME: This should be a DoubleRect since scroll offsets are now doubles.
     FloatRect visibleRectInDocument() const;
 
+    // Convert the given rect in the main FrameView's coordinates into a rect
+    // in the viewport. The given and returned rects are in CSS pixels, meaning
+    // scale isn't applied.
+    FloatRect mainViewToViewportCSSPixels(const FloatRect&) const;
+
     // Scroll the main frame and pinch viewport so that the given rect in the
     // top-level document is centered in the viewport. This method will avoid
     // scrolling the pinch viewport unless necessary.
@@ -133,6 +139,10 @@
     // necessary adjustments so that we don't incorrectly clamp scroll offsets
     // coming from the compositor. crbug.com/422328
     void setTopControlsAdjustment(float);
+
+    // Adjust the viewport's offset so that it remains bounded by the outer
+    // viepwort.
+    void clampToBoundaries();
 private:
     explicit PinchViewport(FrameHost&);
 
@@ -165,7 +175,6 @@
 
     void setupScrollbar(blink::WebScrollbar::Orientation);
     FloatPoint clampOffsetToBoundaries(const FloatPoint&);
-    void clampToBoundaries();
 
     LocalFrame* mainFrame() const;
 
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index bb00e4d..dddb0c2 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -333,18 +333,12 @@
     if (m_context) {
         if (!paintsIntoCanvasBuffer() && !document().printing())
             return;
-        m_context->paintRenderingResultsToCanvas();
+        m_context->paintRenderingResultsToCanvas(CanvasRenderingContext::Front);
     }
 
     if (hasImageBuffer()) {
-        ImageBuffer* imageBuffer = buffer();
-        if (imageBuffer) {
-            CompositeOperator compositeOperator = !m_context || m_context->hasAlpha() ? CompositeSourceOver : CompositeCopy;
-            if (m_presentedImage)
-                context->drawImage(m_presentedImage.get(), pixelSnappedIntRect(r), compositeOperator, DoNotRespectImageOrientation);
-            else
-                context->drawImageBuffer(imageBuffer, pixelSnappedIntRect(r), 0, compositeOperator);
-        }
+        CompositeOperator compositeOperator = !m_context || m_context->hasAlpha() ? CompositeSourceOver : CompositeCopy;
+        context->drawImageBuffer(buffer(), pixelSnappedIntRect(r), 0, compositeOperator);
     } else {
         // When alpha is false, we should draw to opaque black.
         if (m_context && !m_context->hasAlpha())
@@ -360,21 +354,6 @@
     return m_context && m_context->is3d();
 }
 
-void HTMLCanvasElement::makePresentationCopy()
-{
-    if (!m_presentedImage) {
-        // The buffer contains the last presented data, so save a copy of it.
-        m_presentedImage = buffer()->copyImage(CopyBackingStore, Unscaled);
-        updateExternallyAllocatedMemory();
-    }
-}
-
-void HTMLCanvasElement::clearPresentationCopy()
-{
-    m_presentedImage.clear();
-    updateExternallyAllocatedMemory();
-}
-
 void HTMLCanvasElement::setSurfaceSize(const IntSize& size)
 {
     m_size = size;
@@ -419,9 +398,7 @@
         return ImageDataToDataURL(ImageDataBuffer(imageData->size(), imageData->data()), encodingMimeType, quality);
 
     if (m_context && m_context->is3d()) {
-        toWebGLRenderingContext(m_context.get())->setSavingImage(isSaving);
-        m_context->paintRenderingResultsToCanvas();
-        toWebGLRenderingContext(m_context.get())->setSavingImage(false);
+        m_context->paintRenderingResultsToCanvas(isSaving ? CanvasRenderingContext::Front : CanvasRenderingContext::Back);
     }
 
     return buffer()->toDataURL(encodingMimeType, quality);
@@ -646,8 +623,6 @@
         bufferCount += 2;
     if (m_copiedImage)
         bufferCount++;
-    if (m_presentedImage)
-        bufferCount++;
 
     Checked<intptr_t, RecordOverflow> checkedExternallyAllocatedMemory = 4 * bufferCount;
     checkedExternallyAllocatedMemory *= width();
@@ -695,9 +670,7 @@
 {
     if (!m_copiedImage && buffer()) {
         if (m_context && m_context->is3d()) {
-            toWebGLRenderingContext(m_context.get())->setSavingImage(true);
-            m_context->paintRenderingResultsToCanvas();
-            toWebGLRenderingContext(m_context.get())->setSavingImage(false);
+            m_context->paintRenderingResultsToCanvas(CanvasRenderingContext::Front);
         }
         m_copiedImage = buffer()->copyImage(CopyBackingStore, Unscaled);
         updateExternallyAllocatedMemory();
@@ -781,7 +754,7 @@
     }
 
     if (m_context && m_context->is3d()) {
-        m_context->paintRenderingResultsToCanvas();
+        m_context->paintRenderingResultsToCanvas(CanvasRenderingContext::Back);
         *status = ExternalSourceImageStatus;
 
         // can't create SkImage from WebGLImageBufferSurface (contains only SkBitmap)
diff --git a/Source/core/html/HTMLCanvasElement.h b/Source/core/html/HTMLCanvasElement.h
index bd7a75c..9677d01 100644
--- a/Source/core/html/HTMLCanvasElement.h
+++ b/Source/core/html/HTMLCanvasElement.h
@@ -123,8 +123,6 @@
     Image* copiedImage() const;
     void clearCopiedImage();
     PassRefPtrWillBeRawPtr<ImageData> getImageData() const;
-    void makePresentationCopy();
-    void clearPresentationCopy();
 
     SecurityOrigin* securityOrigin() const;
     bool originClean() const { return m_originClean; }
@@ -213,7 +211,6 @@
     OwnPtr<ImageBuffer> m_imageBuffer;
     mutable OwnPtr<GraphicsContextStateSaver> m_contextStateSaver;
 
-    mutable RefPtr<Image> m_presentedImage;
     mutable RefPtr<Image> m_copiedImage; // FIXME: This is temporary for platforms that have to copy the image buffer to render (and for CSSCanvasValue).
 };
 
diff --git a/Source/core/html/HTMLMediaElement.cpp b/Source/core/html/HTMLMediaElement.cpp
index e40f1e1..24e9732 100644
--- a/Source/core/html/HTMLMediaElement.cpp
+++ b/Source/core/html/HTMLMediaElement.cpp
@@ -276,6 +276,8 @@
     AutoplayBailout = 2,
     // Autoplay disabled but user manually started media.
     AutoplayManualStart = 3,
+    // Autoplay was (re)enabled through a user-gesture triggered load()
+    AutoplayEnabledThroughLoad = 4,
     // This enum value must be last.
     NumberOfAutoplayMetrics,
 };
@@ -740,8 +742,17 @@
 {
     WTF_LOG(Media, "HTMLMediaElement::load(%p)", this);
 
-    if (UserGestureIndicator::processingUserGesture())
+    if (m_initialPlayWithoutUserGestures && m_playing)
+        gesturelessInitialPlayHalted();
+
+    if (UserGestureIndicator::processingUserGesture() && m_userGestureRequiredForPlay) {
+        recordAutoplayMetric(AutoplayEnabledThroughLoad);
         m_userGestureRequiredForPlay = false;
+        // While usergesture-initiated load()s technically count as autoplayed,
+        // they don't feel like such to the users and hence we don't want to
+        // count them for the purposes of metrics.
+        m_autoplayMediaCounted = true;
+    }
 
     prepareForLoad();
     loadInternal();
@@ -1896,7 +1907,6 @@
         if (m_autoplaying && m_paused && autoplay() && !document().isSandboxed(SandboxAutomaticFeatures)) {
             autoplayMediaEncountered();
             if (!m_userGestureRequiredForPlay) {
-                m_initialPlayWithoutUserGestures = true;
                 m_paused = false;
                 invalidateCachedTime();
                 scheduleEvent(EventTypeNames::play);
@@ -2270,10 +2280,8 @@
         autoplayMediaEncountered();
         if (m_userGestureRequiredForPlay)
             return;
-        if (m_autoplaying)
-            m_initialPlayWithoutUserGestures = true;
-    } else {
-        if (m_userGestureRequiredForPlay)
+    } else if (m_userGestureRequiredForPlay) {
+        if (m_autoplayMediaCounted)
             recordAutoplayMetric(AutoplayManualStart);
         m_userGestureRequiredForPlay = false;
     }
@@ -2316,6 +2324,9 @@
     if (!m_autoplayMediaCounted) {
         m_autoplayMediaCounted = true;
         recordAutoplayMetric(AutoplayMediaFound);
+
+        if (!m_userGestureRequiredForPlay)
+            m_initialPlayWithoutUserGestures = true;
     }
 }
 
diff --git a/Source/core/html/HTMLScriptElement.cpp b/Source/core/html/HTMLScriptElement.cpp
index 6bfccd1..bce71bd 100644
--- a/Source/core/html/HTMLScriptElement.cpp
+++ b/Source/core/html/HTMLScriptElement.cpp
@@ -73,8 +73,17 @@
 
 void HTMLScriptElement::didMoveToNewDocument(Document& oldDocument)
 {
-    if (RefPtrWillBeRawPtr<Document> contextDocument = document().contextDocument().get())
-        oldDocument.scriptRunner()->movePendingAsyncScript(contextDocument->scriptRunner(), m_loader.get());
+    RefPtrWillBeRawPtr<Document> contextDocument = document().contextDocument().get();
+    if (!contextDocument) {
+        ASSERT(!document().frame());
+        // A frame-detached document is handled as having no context
+        // document - it would be the document if not detached. The
+        // newly moved script element needs to be the latter here as
+        // the script loader for the pending script must also move to
+        // reside with that document and its script runner.
+        contextDocument = &document();
+    }
+    oldDocument.scriptRunner()->movePendingAsyncScript(contextDocument->scriptRunner(), m_loader.get());
     HTMLElement::didMoveToNewDocument(oldDocument);
 }
 
diff --git a/Source/core/html/canvas/ANGLEInstancedArrays.cpp b/Source/core/html/canvas/ANGLEInstancedArrays.cpp
index 20012cc..15169cc 100644
--- a/Source/core/html/canvas/ANGLEInstancedArrays.cpp
+++ b/Source/core/html/canvas/ANGLEInstancedArrays.cpp
@@ -68,26 +68,29 @@
 
 void ANGLEInstancedArrays::drawArraysInstancedANGLE(GLenum mode, GLint first, GLsizei count, GLsizei primcount)
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return;
 
-    m_context->drawArraysInstancedANGLE(mode, first, count, primcount);
+    scoped.context()->drawArraysInstancedANGLE(mode, first, count, primcount);
 }
 
 void ANGLEInstancedArrays::drawElementsInstancedANGLE(GLenum mode, GLsizei count, GLenum type, long long offset, GLsizei primcount)
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return;
 
-    m_context->drawElementsInstancedANGLE(mode, count, type, offset, primcount);
+    scoped.context()->drawElementsInstancedANGLE(mode, count, type, offset, primcount);
 }
 
 void ANGLEInstancedArrays::vertexAttribDivisorANGLE(GLuint index, GLuint divisor)
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return;
 
-    m_context->vertexAttribDivisorANGLE(index, divisor);
+    scoped.context()->vertexAttribDivisorANGLE(index, divisor);
 }
 
 } // namespace blink
diff --git a/Source/core/html/canvas/CanvasRenderingContext.h b/Source/core/html/canvas/CanvasRenderingContext.h
index 2af7128..b03358e 100644
--- a/Source/core/html/canvas/CanvasRenderingContext.h
+++ b/Source/core/html/canvas/CanvasRenderingContext.h
@@ -58,7 +58,8 @@
     virtual bool hasAlpha() const { return true; }
     virtual void setIsHidden(bool) = 0;
 
-    virtual void paintRenderingResultsToCanvas() {}
+    enum SourceBuffer { Front, Back };
+    virtual void paintRenderingResultsToCanvas(SourceBuffer) { }
 
     virtual blink::WebLayer* platformLayer() const { return nullptr; }
 
diff --git a/Source/core/html/canvas/OESVertexArrayObject.cpp b/Source/core/html/canvas/OESVertexArrayObject.cpp
index 063dc0f..9979902 100644
--- a/Source/core/html/canvas/OESVertexArrayObject.cpp
+++ b/Source/core/html/canvas/OESVertexArrayObject.cpp
@@ -55,54 +55,58 @@
 
 PassRefPtrWillBeRawPtr<WebGLVertexArrayObjectOES> OESVertexArrayObject::createVertexArrayOES()
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return nullptr;
 
-    RefPtrWillBeRawPtr<WebGLVertexArrayObjectOES> o = WebGLVertexArrayObjectOES::create(m_context, WebGLVertexArrayObjectOES::VaoTypeUser);
-    m_context->addContextObject(o.get());
+    RefPtrWillBeRawPtr<WebGLVertexArrayObjectOES> o = WebGLVertexArrayObjectOES::create(scoped.context(), WebGLVertexArrayObjectOES::VaoTypeUser);
+    scoped.context()->addContextObject(o.get());
     return o.release();
 }
 
 void OESVertexArrayObject::deleteVertexArrayOES(WebGLVertexArrayObjectOES* arrayObject)
 {
-    if (!arrayObject || isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (!arrayObject || scoped.isLost())
         return;
 
-    if (!arrayObject->isDefaultObject() && arrayObject == m_context->m_boundVertexArrayObject)
-        m_context->setBoundVertexArrayObject(nullptr);
+    if (!arrayObject->isDefaultObject() && arrayObject == scoped.context()->m_boundVertexArrayObject)
+        scoped.context()->setBoundVertexArrayObject(nullptr);
 
-    arrayObject->deleteObject(m_context->webContext());
+    arrayObject->deleteObject(scoped.context()->webContext());
 }
 
 GLboolean OESVertexArrayObject::isVertexArrayOES(WebGLVertexArrayObjectOES* arrayObject)
 {
-    if (!arrayObject || isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (!arrayObject || scoped.isLost())
         return 0;
 
     if (!arrayObject->hasEverBeenBound())
         return 0;
 
-    return m_context->webContext()->isVertexArrayOES(arrayObject->object());
+    return scoped.context()->webContext()->isVertexArrayOES(arrayObject->object());
 }
 
 void OESVertexArrayObject::bindVertexArrayOES(WebGLVertexArrayObjectOES* arrayObject)
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return;
 
-    if (arrayObject && (arrayObject->isDeleted() || !arrayObject->validate(0, context()))) {
-        m_context->webContext()->synthesizeGLError(GL_INVALID_OPERATION);
+    if (arrayObject && (arrayObject->isDeleted() || !arrayObject->validate(0, scoped.context()))) {
+        scoped.context()->webContext()->synthesizeGLError(GL_INVALID_OPERATION);
         return;
     }
 
     if (arrayObject && !arrayObject->isDefaultObject() && arrayObject->object()) {
-        m_context->webContext()->bindVertexArrayOES(arrayObject->object());
+        scoped.context()->webContext()->bindVertexArrayOES(arrayObject->object());
 
         arrayObject->setHasEverBeenBound();
-        m_context->setBoundVertexArrayObject(arrayObject);
+        scoped.context()->setBoundVertexArrayObject(arrayObject);
     } else {
-        m_context->webContext()->bindVertexArrayOES(0);
-        m_context->setBoundVertexArrayObject(nullptr);
+        scoped.context()->webContext()->bindVertexArrayOES(0);
+        scoped.context()->setBoundVertexArrayObject(nullptr);
     }
 }
 
diff --git a/Source/core/html/canvas/WebGLDebugShaders.cpp b/Source/core/html/canvas/WebGLDebugShaders.cpp
index 74719bd..229d1b3 100644
--- a/Source/core/html/canvas/WebGLDebugShaders.cpp
+++ b/Source/core/html/canvas/WebGLDebugShaders.cpp
@@ -53,11 +53,12 @@
 
 String WebGLDebugShaders::getTranslatedShaderSource(WebGLShader* shader)
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return String();
-    if (!m_context->validateWebGLObject("getTranslatedShaderSource", shader))
+    if (!scoped.context()->validateWebGLObject("getTranslatedShaderSource", shader))
         return "";
-    return m_context->ensureNotNull(m_context->webContext()->getTranslatedShaderSourceANGLE(shader->object()));
+    return scoped.context()->ensureNotNull(scoped.context()->webContext()->getTranslatedShaderSourceANGLE(shader->object()));
 }
 
 bool WebGLDebugShaders::supported(WebGLRenderingContextBase* context)
diff --git a/Source/core/html/canvas/WebGLDrawBuffers.cpp b/Source/core/html/canvas/WebGLDrawBuffers.cpp
index e3d14f8..655b188 100644
--- a/Source/core/html/canvas/WebGLDrawBuffers.cpp
+++ b/Source/core/html/canvas/WebGLDrawBuffers.cpp
@@ -63,35 +63,36 @@
 
 void WebGLDrawBuffers::drawBuffersWEBGL(const Vector<GLenum>& buffers)
 {
-    if (isLost())
+    WebGLExtensionScopedContext scoped(this);
+    if (scoped.isLost())
         return;
     GLsizei n = buffers.size();
     const GLenum* bufs = buffers.data();
-    if (!m_context->m_framebufferBinding) {
+    if (!scoped.context()->m_framebufferBinding) {
         if (n != 1) {
-            m_context->synthesizeGLError(GL_INVALID_VALUE, "drawBuffersWEBGL", "more than one buffer");
+            scoped.context()->synthesizeGLError(GL_INVALID_VALUE, "drawBuffersWEBGL", "more than one buffer");
             return;
         }
         if (bufs[0] != GL_BACK && bufs[0] != GL_NONE) {
-            m_context->synthesizeGLError(GL_INVALID_OPERATION, "drawBuffersWEBGL", "BACK or NONE");
+            scoped.context()->synthesizeGLError(GL_INVALID_OPERATION, "drawBuffersWEBGL", "BACK or NONE");
             return;
         }
         // Because the backbuffer is simulated on all current WebKit ports, we need to change BACK to COLOR_ATTACHMENT0.
         GLenum value = (bufs[0] == GL_BACK) ? GL_COLOR_ATTACHMENT0 : GL_NONE;
-        m_context->webContext()->drawBuffersEXT(1, &value);
-        m_context->setBackDrawBuffer(bufs[0]);
+        scoped.context()->webContext()->drawBuffersEXT(1, &value);
+        scoped.context()->setBackDrawBuffer(bufs[0]);
     } else {
-        if (n > m_context->maxDrawBuffers()) {
-            m_context->synthesizeGLError(GL_INVALID_VALUE, "drawBuffersWEBGL", "more than max draw buffers");
+        if (n > scoped.context()->maxDrawBuffers()) {
+            scoped.context()->synthesizeGLError(GL_INVALID_VALUE, "drawBuffersWEBGL", "more than max draw buffers");
             return;
         }
         for (GLsizei i = 0; i < n; ++i) {
             if (bufs[i] != GL_NONE && bufs[i] != static_cast<GLenum>(GL_COLOR_ATTACHMENT0_EXT + i)) {
-                m_context->synthesizeGLError(GL_INVALID_OPERATION, "drawBuffersWEBGL", "COLOR_ATTACHMENTi_EXT or NONE");
+                scoped.context()->synthesizeGLError(GL_INVALID_OPERATION, "drawBuffersWEBGL", "COLOR_ATTACHMENTi_EXT or NONE");
                 return;
             }
         }
-        m_context->m_framebufferBinding->drawBuffers(buffers);
+        scoped.context()->m_framebufferBinding->drawBuffers(buffers);
     }
 }
 
diff --git a/Source/core/html/canvas/WebGLExtension.cpp b/Source/core/html/canvas/WebGLExtension.cpp
index 8070663..a65b65c 100644
--- a/Source/core/html/canvas/WebGLExtension.cpp
+++ b/Source/core/html/canvas/WebGLExtension.cpp
@@ -29,6 +29,21 @@
 
 namespace blink {
 
+WebGLExtensionScopedContext::WebGLExtensionScopedContext(WebGLExtension* extension)
+    : m_context(extension->m_context)
+{
+}
+
+WebGLExtensionScopedContext::~WebGLExtensionScopedContext()
+{
+}
+
+void WebGLExtensionScopedContext::trace(Visitor* visitor)
+{
+    visitor->trace(m_context);
+}
+
+
 WebGLExtension::WebGLExtension(WebGLRenderingContextBase* context)
     : m_context(context)
 {
diff --git a/Source/core/html/canvas/WebGLExtension.h b/Source/core/html/canvas/WebGLExtension.h
index 474f500..09ae66a 100644
--- a/Source/core/html/canvas/WebGLExtension.h
+++ b/Source/core/html/canvas/WebGLExtension.h
@@ -26,6 +26,7 @@
 #ifndef WebGLExtension_h
 #define WebGLExtension_h
 
+#include "core/html/HTMLCanvasElement.h"
 #include "core/html/canvas/WebGLExtensionName.h"
 #include "core/html/canvas/WebGLRenderingContextBase.h"
 #include "platform/heap/Handle.h"
@@ -33,11 +34,25 @@
 
 namespace blink {
 
+class WebGLExtensionScopedContext : public NoBaseWillBeGarbageCollectedFinalized<WebGLExtensionScopedContext> {
+    WTF_MAKE_NONCOPYABLE(WebGLExtensionScopedContext);
+    WTF_MAKE_FAST_ALLOCATED_WILL_BE_REMOVED;
+public:
+    WebGLExtensionScopedContext(WebGLExtension*);
+    virtual ~WebGLExtensionScopedContext();
+
+    bool isLost() { return !m_context; }
+    WebGLRenderingContextBase* context() const { return m_context.get(); }
+
+    virtual void trace(Visitor*);
+
+private:
+    RefPtrWillBeMember<WebGLRenderingContextBase> m_context;
+};
+
 class WebGLExtension : public RefCountedWillBeGarbageCollectedFinalized<WebGLExtension> {
     WTF_MAKE_FAST_ALLOCATED_WILL_BE_REMOVED;
 public:
-    WebGLRenderingContextBase* context() { return m_context; }
-
     virtual ~WebGLExtension();
     virtual WebGLExtensionName name() const = 0;
 
@@ -49,16 +64,16 @@
         m_context = nullptr;
     }
 
-    bool isLost()
-    {
-        return !m_context;
-    }
+    bool isLost() { return !m_context; }
 
     virtual void trace(Visitor*);
 
 protected:
     explicit WebGLExtension(WebGLRenderingContextBase*);
 
+private:
+    friend WebGLExtensionScopedContext;
+
     RawPtrWillBeWeakMember<WebGLRenderingContextBase> m_context;
 };
 
diff --git a/Source/core/html/canvas/WebGLLoseContext.cpp b/Source/core/html/canvas/WebGLLoseContext.cpp
index 7fe3222..51e9677 100644
--- a/Source/core/html/canvas/WebGLLoseContext.cpp
+++ b/Source/core/html/canvas/WebGLLoseContext.cpp
@@ -58,14 +58,16 @@
 
 void WebGLLoseContext::loseContext()
 {
-    if (!isLost())
-        m_context->forceLostContext(WebGLRenderingContextBase::WebGLLoseContextLostContext, WebGLRenderingContextBase::Manual);
+    WebGLExtensionScopedContext scoped(this);
+    if (!scoped.isLost())
+        scoped.context()->forceLostContext(WebGLRenderingContextBase::WebGLLoseContextLostContext, WebGLRenderingContextBase::Manual);
 }
 
 void WebGLLoseContext::restoreContext()
 {
-    if (!isLost())
-        m_context->forceRestoreContext();
+    WebGLExtensionScopedContext scoped(this);
+    if (!scoped.isLost())
+        scoped.context()->forceRestoreContext();
 }
 
 bool WebGLLoseContext::supported(WebGLRenderingContextBase*)
diff --git a/Source/core/html/canvas/WebGLRenderingContextBase.cpp b/Source/core/html/canvas/WebGLRenderingContextBase.cpp
index 4305ba8..31844c8 100644
--- a/Source/core/html/canvas/WebGLRenderingContextBase.cpp
+++ b/Source/core/html/canvas/WebGLRenderingContextBase.cpp
@@ -565,7 +565,6 @@
     , m_multisamplingAllowed(false)
     , m_multisamplingObserverRegistered(false)
     , m_onePlusMaxNonDefaultTextureUnit(0)
-    , m_savingImage(false)
 {
     ASSERT(context);
 
@@ -888,24 +887,10 @@
         drawingBuffer()->setIsHidden(hidden);
 }
 
-void WebGLRenderingContextBase::paintRenderingResultsToCanvas()
+void WebGLRenderingContextBase::paintRenderingResultsToCanvas(SourceBuffer source)
 {
-    if (isContextLost()) {
-        canvas()->clearPresentationCopy();
+    if (isContextLost())
         return;
-    }
-
-    if (canvas()->document().printing())
-        canvas()->clearPresentationCopy();
-
-    // Until the canvas is written to by the application, the clear that
-    // happened after it was composited should be ignored by the compositor.
-    if (drawingBuffer()->layerComposited() && !m_requestedAttributes->preserveDrawingBuffer()) {
-        drawingBuffer()->paintCompositedResultsToCanvas(canvas()->buffer());
-
-        canvas()->makePresentationCopy();
-    } else
-        canvas()->clearPresentationCopy();
 
     clearIfComposited();
 
@@ -918,7 +903,7 @@
     ScopedTexture2DRestorer restorer(this);
 
     drawingBuffer()->commit();
-    if (!canvas()->buffer()->copyRenderingResultsFromDrawingBuffer(drawingBuffer(), m_savingImage)) {
+    if (!canvas()->buffer()->copyRenderingResultsFromDrawingBuffer(drawingBuffer(), source == Front)) {
         canvas()->ensureUnacceleratedImageBuffer();
         if (canvas()->hasImageBuffer())
             drawingBuffer()->paintRenderingResultsToCanvas(canvas()->buffer());
@@ -3565,7 +3550,7 @@
             WebGLRenderingContextBase* gl = toWebGLRenderingContextBase(canvas->renderingContext());
             ScopedTexture2DRestorer restorer(gl);
             if (gl && gl->drawingBuffer()->copyToPlatformTexture(webContext(), texture->object(), internalformat, type,
-                level, m_unpackPremultiplyAlpha, !m_unpackFlipY)) {
+                level, m_unpackPremultiplyAlpha, !m_unpackFlipY, DrawingBuffer::Back)) {
                 texture->setLevelInfo(target, level, internalformat, canvas->width(), canvas->height(), type);
                 return;
             }
diff --git a/Source/core/html/canvas/WebGLRenderingContextBase.h b/Source/core/html/canvas/WebGLRenderingContextBase.h
index 16a8a5e..aacb79c 100644
--- a/Source/core/html/canvas/WebGLRenderingContextBase.h
+++ b/Source/core/html/canvas/WebGLRenderingContextBase.h
@@ -359,8 +359,6 @@
     virtual bool hasPendingActivity() const override;
     virtual void stop() override;
 
-    void setSavingImage(bool isSaving) { m_savingImage = isSaving; }
-
     virtual void trace(Visitor*) override;
 
     class TextureUnitState {
@@ -400,7 +398,7 @@
     virtual bool is3d() const override { return true; }
     virtual bool isAccelerated() const override { return true; }
     virtual void setIsHidden(bool) override;
-    virtual void paintRenderingResultsToCanvas() override;
+    virtual void paintRenderingResultsToCanvas(SourceBuffer) override;
     virtual blink::WebLayer* platformLayer() const override;
 
     void addSharedObject(WebGLSharedObject*);
@@ -571,8 +569,6 @@
 
     OwnPtr<Extensions3DUtil> m_extensionsUtil;
 
-    bool m_savingImage;
-
     enum ExtensionFlags {
         ApprovedExtension               = 0x00,
         // Extension that is behind the draft extensions runtime flag:
diff --git a/Source/core/html/forms/FileInputType.cpp b/Source/core/html/forms/FileInputType.cpp
index e26e55d..6196fb3 100644
--- a/Source/core/html/forms/FileInputType.cpp
+++ b/Source/core/html/forms/FileInputType.cpp
@@ -336,7 +336,7 @@
 bool FileInputType::receiveDroppedFiles(const DragData* dragData)
 {
     Vector<String> paths;
-    dragData->asFilenames(paths);
+    dragData->asFilePaths(paths);
     if (paths.isEmpty())
         return false;
 
diff --git a/Source/core/html/forms/FileInputTypeTest.cpp b/Source/core/html/forms/FileInputTypeTest.cpp
index 68da534..7bb943d 100644
--- a/Source/core/html/forms/FileInputTypeTest.cpp
+++ b/Source/core/html/forms/FileInputTypeTest.cpp
@@ -5,7 +5,11 @@
 #include "config.h"
 #include "FileInputType.h"
 
+#include "core/clipboard/DataObject.h"
+#include "core/dom/Document.h"
 #include "core/fileapi/FileList.h"
+#include "core/html/HTMLInputElement.h"
+#include "core/page/DragData.h"
 #include <gtest/gtest.h>
 
 namespace blink {
@@ -42,4 +46,34 @@
     EXPECT_EQ(24 * 60 * 60 * 1000 /* ms */, list->item(1)->lastModified());
 }
 
+TEST(FileInputTypeTest, ignoreDroppedNonNativeFiles)
+{
+    const RefPtrWillBeRawPtr<Document> document = Document::create();
+    const RefPtrWillBeRawPtr<HTMLInputElement> input =
+        HTMLInputElement::create(*document, nullptr, /* createdByParser */true);
+    const RefPtrWillBeRawPtr<InputType> fileInput = FileInputType::create(*input);
+
+    const RefPtrWillBeRawPtr<DataObject> nativeFileRawDragData = DataObject::create();
+    const DragData nativeFileDragData(nativeFileRawDragData.get(), IntPoint(), IntPoint(), DragOperationCopy);
+    nativeFileDragData.platformData()->add(File::create("/native/path"));
+    nativeFileDragData.platformData()->setFilesystemId("fileSystemId");
+    fileInput->receiveDroppedFiles(&nativeFileDragData);
+    EXPECT_EQ("fileSystemId", fileInput->droppedFileSystemId());
+    ASSERT_EQ(1u, fileInput->files()->length());
+    EXPECT_EQ(String("/native/path"), fileInput->files()->item(0)->path());
+
+    const RefPtrWillBeRawPtr<DataObject> nonNativeFileRawDragData = DataObject::create();
+    const DragData nonNativeFileDragData(nonNativeFileRawDragData.get(), IntPoint(), IntPoint(), DragOperationCopy);
+    FileMetadata metadata;
+    metadata.length = 1234;
+    const KURL url(ParsedURLStringTag(), "filesystem:http://example.com/isolated/hash/non-native-file");
+    nonNativeFileDragData.platformData()->add(File::createForFileSystemFile(url, metadata, File::IsUserVisible));
+    nonNativeFileDragData.platformData()->setFilesystemId("fileSystemId");
+    fileInput->receiveDroppedFiles(&nonNativeFileDragData);
+    // Dropping non-native files should not change the existing files.
+    EXPECT_EQ("fileSystemId", fileInput->droppedFileSystemId());
+    ASSERT_EQ(1u, fileInput->files()->length());
+    EXPECT_EQ(String("/native/path"), fileInput->files()->item(0)->path());
+}
+
 } // namespace blink
diff --git a/Source/core/html/shadow/MediaControlElements.cpp b/Source/core/html/shadow/MediaControlElements.cpp
index ecf4074..ce0549b 100644
--- a/Source/core/html/shadow/MediaControlElements.cpp
+++ b/Source/core/html/shadow/MediaControlElements.cpp
@@ -570,6 +570,7 @@
 MediaControlCastButtonElement::MediaControlCastButtonElement(MediaControls& mediaControls, bool isOverlayButton)
     : MediaControlInputElement(mediaControls, MediaCastOnButton), m_isOverlayButton(isOverlayButton)
 {
+    setIsPlayingRemotely(false);
 }
 
 PassRefPtrWillBeRawPtr<MediaControlCastButtonElement> MediaControlCastButtonElement::create(MediaControls& mediaControls, bool isOverlayButton)
@@ -601,7 +602,19 @@
 
 void MediaControlCastButtonElement::setIsPlayingRemotely(bool isPlayingRemotely)
 {
-    setDisplayType(isPlayingRemotely ? MediaCastOnButton : MediaCastOffButton);
+    if (isPlayingRemotely) {
+        if (m_isOverlayButton) {
+            setDisplayType(MediaOverlayCastOnButton);
+        } else {
+            setDisplayType(MediaCastOnButton);
+        }
+    } else {
+        if (m_isOverlayButton) {
+            setDisplayType(MediaOverlayCastOffButton);
+        } else {
+            setDisplayType(MediaCastOffButton);
+        }
+    }
 }
 
 bool MediaControlCastButtonElement::keepEventInNode(Event* event)
diff --git a/Source/core/html/shadow/MediaControls.cpp b/Source/core/html/shadow/MediaControls.cpp
index c3d51df..4c693c5 100644
--- a/Source/core/html/shadow/MediaControls.cpp
+++ b/Source/core/html/shadow/MediaControls.cpp
@@ -370,6 +370,24 @@
     refreshClosedCaptionsButtonVisibility();
 }
 
+static Element* elementFromCenter(Element& element)
+{
+    RefPtrWillBeRawPtr<ClientRect> clientRect = element.getBoundingClientRect();
+    int centerX = static_cast<int>((clientRect->left() + clientRect->right()) / 2);
+    int centerY = static_cast<int>((clientRect->top() + clientRect->bottom()) / 2);
+
+    return element.document().elementFromPoint(centerX , centerY);
+}
+
+void MediaControls::tryShowOverlayCastButton()
+{
+    // The element needs to be shown to have its dimensions and position.
+    m_overlayCastButton->show();
+
+    if (elementFromCenter(*m_overlayCastButton) != &mediaElement())
+        m_overlayCastButton->hide();
+}
+
 void MediaControls::refreshCastButtonVisibility()
 {
     if (mediaElement().hasRemoteRoutes()) {
@@ -386,7 +404,7 @@
             // Check that the cast button actually fits on the bar.
             if (m_fullScreenButton->getBoundingClientRect()->right() > m_panel->getBoundingClientRect()->right()) {
                 m_castButton->hide();
-                m_overlayCastButton->show();
+                tryShowOverlayCastButton();
             }
         }
     } else {
@@ -397,7 +415,7 @@
 
 void MediaControls::showOverlayCastButton()
 {
-    m_overlayCastButton->show();
+    tryShowOverlayCastButton();
     resetHideMediaControlsTimer();
 }
 
diff --git a/Source/core/html/shadow/MediaControls.h b/Source/core/html/shadow/MediaControls.h
index 8da8ff7..a04a9f5 100644
--- a/Source/core/html/shadow/MediaControls.h
+++ b/Source/core/html/shadow/MediaControls.h
@@ -96,6 +96,10 @@
     void stopHideMediaControlsTimer();
     void resetHideMediaControlsTimer();
 
+    // Attempts to show the overlay cast button. If it is covered by another
+    // element in the page, it will be hidden.
+    void tryShowOverlayCastButton();
+
     void createTextTrackDisplay();
     void showTextTrackDisplay();
     void hideTextTrackDisplay();
diff --git a/Source/core/inspector/InspectorStyleSheet.cpp b/Source/core/inspector/InspectorStyleSheet.cpp
index d341945..0adbafe 100644
--- a/Source/core/inspector/InspectorStyleSheet.cpp
+++ b/Source/core/inspector/InspectorStyleSheet.cpp
@@ -1068,13 +1068,15 @@
         return false;
     }
 
-    rule->setSelectorText(selector);
-    RefPtrWillBeRawPtr<CSSRuleSourceData> sourceData = ruleSourceDataAt(id.ordinal());
-    if (!sourceData) {
-        exceptionState.throwDOMException(NotFoundError, "The selector '" + selector + "' could not be set.");
+    if (!verifySelectorText(selector)) {
+        exceptionState.throwDOMException(SyntaxError, "Selector text is not valid.");
         return false;
     }
 
+    rule->setSelectorText(selector);
+    RefPtrWillBeRawPtr<CSSRuleSourceData> sourceData = ruleSourceDataAt(id.ordinal());
+    ASSERT(sourceData);
+
     String sheetText = m_parsedStyleSheet->text();
     sheetText.replace(sourceData->ruleHeaderRange.start, sourceData->ruleHeaderRange.length(), selector);
     updateText(sheetText);
@@ -1183,6 +1185,33 @@
     return true;
 }
 
+bool InspectorStyleSheet::verifySelectorText(const String& selectorText)
+{
+    DEFINE_STATIC_LOCAL(String, bogusPropertyName, ("-webkit-boguz-propertee"));
+    RuleSourceDataList sourceData;
+    RefPtrWillBeRawPtr<StyleSheetContents> styleSheetContents = StyleSheetContents::create(strictCSSParserContext());
+    String text = selectorText + " div { " + bogusPropertyName + ": none; }";
+    StyleSheetHandler handler(text, ownerDocument(), styleSheetContents.get(), &sourceData);
+    CSSParser::parseSheet(parserContextForDocument(ownerDocument()), styleSheetContents.get(), text, TextPosition::minimumPosition(), &handler);
+
+    // Exactly one rule should be parsed.
+    unsigned ruleCount = sourceData.size();
+    if (ruleCount != 1 || sourceData.at(0)->type != CSSRuleSourceData::STYLE_RULE)
+        return false;
+
+    // Exactly one property should be in style rule.
+    WillBeHeapVector<CSSPropertySourceData>& propertyData = sourceData.at(0)->styleSourceData->propertyData;
+    unsigned propertyCount = propertyData.size();
+    if (propertyCount != 1)
+        return false;
+
+    // Check for the property name.
+    if (propertyData.at(0).name != bogusPropertyName)
+        return false;
+
+    return true;
+}
+
 CSSStyleRule* InspectorStyleSheet::addRule(const String& ruleText, const SourceRange& location, ExceptionState& exceptionState)
 {
     if (!ensureParsedDataReady()) {
diff --git a/Source/core/inspector/InspectorStyleSheet.h b/Source/core/inspector/InspectorStyleSheet.h
index 03f24a9..53badeb 100644
--- a/Source/core/inspector/InspectorStyleSheet.h
+++ b/Source/core/inspector/InspectorStyleSheet.h
@@ -237,6 +237,7 @@
     CSSStyleRule* insertCSSOMRuleInMediaRule(CSSMediaRule*, const SourceRange&, const String& ruleText, ExceptionState&);
     CSSStyleRule* insertCSSOMRuleBySourceRange(const SourceRange&, const String& ruleText, ExceptionState&);
     bool verifyRuleText(const String& ruleText);
+    bool verifySelectorText(const String& selectorText);
     unsigned ruleIndexByStyle(CSSStyleDeclaration*) const;
     String sourceMapURL() const;
     String sourceURL() const;
diff --git a/Source/core/inspector/InspectorTraceEvents.cpp b/Source/core/inspector/InspectorTraceEvents.cpp
index dd765e1..c0aec71 100644
--- a/Source/core/inspector/InspectorTraceEvents.cpp
+++ b/Source/core/inspector/InspectorTraceEvents.cpp
@@ -492,7 +492,6 @@
 const char InspectorLayerInvalidationTrackingEvent::RemovedFromSquashingLayer[] = "Removed the layer from a squashing layer";
 const char InspectorLayerInvalidationTrackingEvent::ReflectionLayerChanged[] = "Reflection layer change";
 const char InspectorLayerInvalidationTrackingEvent::NewCompositedLayer[] = "Assigned a new composited layer";
-const char InspectorLayerInvalidationTrackingEvent::AncestorRequiresNewLayer[] = "A new composited layer is needed based on the RenderLayer's compositing ancestor's properties";
 
 PassRefPtr<TraceEvent::ConvertableToTraceFormat> InspectorLayerInvalidationTrackingEvent::data(const RenderLayer* layer, const char* reason)
 {
diff --git a/Source/core/inspector/InspectorTraceEvents.h b/Source/core/inspector/InspectorTraceEvents.h
index 2629ca1..9c9f40c 100644
--- a/Source/core/inspector/InspectorTraceEvents.h
+++ b/Source/core/inspector/InspectorTraceEvents.h
@@ -186,7 +186,6 @@
     static const char RemovedFromSquashingLayer[];
     static const char ReflectionLayerChanged[];
     static const char NewCompositedLayer[];
-    static const char AncestorRequiresNewLayer[];
 
     static PassRefPtr<TraceEvent::ConvertableToTraceFormat> data(const RenderLayer*, const char* reason);
 };
diff --git a/Source/core/make_core_generated.target.darwin-arm.mk b/Source/core/make_core_generated.target.darwin-arm.mk
index e3d69a4..2e29b83 100644
--- a/Source/core/make_core_generated.target.darwin-arm.mk
+++ b/Source/core/make_core_generated.target.darwin-arm.mk
@@ -498,7 +498,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -598,7 +598,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.darwin-arm64.mk b/Source/core/make_core_generated.target.darwin-arm64.mk
index ad948d5..d39b4ec 100644
--- a/Source/core/make_core_generated.target.darwin-arm64.mk
+++ b/Source/core/make_core_generated.target.darwin-arm64.mk
@@ -497,7 +497,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -585,7 +585,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.darwin-x86.mk b/Source/core/make_core_generated.target.darwin-x86.mk
index 1944394..6ef3ed7 100644
--- a/Source/core/make_core_generated.target.darwin-x86.mk
+++ b/Source/core/make_core_generated.target.darwin-x86.mk
@@ -497,7 +497,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -591,7 +591,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.darwin-x86_64.mk b/Source/core/make_core_generated.target.darwin-x86_64.mk
index 321040d..b3f507b 100644
--- a/Source/core/make_core_generated.target.darwin-x86_64.mk
+++ b/Source/core/make_core_generated.target.darwin-x86_64.mk
@@ -498,7 +498,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -591,7 +591,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.linux-arm.mk b/Source/core/make_core_generated.target.linux-arm.mk
index e3d69a4..2e29b83 100644
--- a/Source/core/make_core_generated.target.linux-arm.mk
+++ b/Source/core/make_core_generated.target.linux-arm.mk
@@ -498,7 +498,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -598,7 +598,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.linux-arm64.mk b/Source/core/make_core_generated.target.linux-arm64.mk
index ad948d5..d39b4ec 100644
--- a/Source/core/make_core_generated.target.linux-arm64.mk
+++ b/Source/core/make_core_generated.target.linux-arm64.mk
@@ -497,7 +497,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -585,7 +585,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.linux-x86.mk b/Source/core/make_core_generated.target.linux-x86.mk
index 1944394..6ef3ed7 100644
--- a/Source/core/make_core_generated.target.linux-x86.mk
+++ b/Source/core/make_core_generated.target.linux-x86.mk
@@ -497,7 +497,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -591,7 +591,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/make_core_generated.target.linux-x86_64.mk b/Source/core/make_core_generated.target.linux-x86_64.mk
index 321040d..b3f507b 100644
--- a/Source/core/make_core_generated.target.linux-x86_64.mk
+++ b/Source/core/make_core_generated.target.linux-x86_64.mk
@@ -498,7 +498,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -591,7 +591,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/page/DragController.cpp b/Source/core/page/DragController.cpp
index e2abec2..e17f5d1 100644
--- a/Source/core/page/DragController.cpp
+++ b/Source/core/page/DragController.cpp
@@ -385,16 +385,18 @@
         dragSession.mouseIsOverFileInput = m_fileInputElementUnderMouse;
         dragSession.numberOfItemsToBeAccepted = 0;
 
-        unsigned numberOfFiles = dragData->numberOfFiles();
+        Vector<String> paths;
+        dragData->asFilePaths(paths);
+        const unsigned numberOfFiles = paths.size();
         if (m_fileInputElementUnderMouse) {
             if (m_fileInputElementUnderMouse->isDisabledFormControl())
                 dragSession.numberOfItemsToBeAccepted = 0;
             else if (m_fileInputElementUnderMouse->multiple())
                 dragSession.numberOfItemsToBeAccepted = numberOfFiles;
-            else if (numberOfFiles > 1)
-                dragSession.numberOfItemsToBeAccepted = 0;
-            else
+            else if (numberOfFiles == 1)
                 dragSession.numberOfItemsToBeAccepted = 1;
+            else
+                dragSession.numberOfItemsToBeAccepted = 0;
 
             if (!dragSession.numberOfItemsToBeAccepted)
                 dragSession.operation = DragOperationNone;
diff --git a/Source/core/page/DragData.cpp b/Source/core/page/DragData.cpp
index 6e7e29a..fbb264c 100644
--- a/Source/core/page/DragData.cpp
+++ b/Source/core/page/DragData.cpp
@@ -85,21 +85,18 @@
     return m_platformDragData->containsFilenames();
 }
 
-unsigned DragData::numberOfFiles() const
-{
-    return m_platformDragData->filenames().size();
-}
-
 int DragData::modifierKeyState() const
 {
     return m_platformDragData->modifierKeyState();
 }
 
-void DragData::asFilenames(Vector<String>& result) const
+void DragData::asFilePaths(Vector<String>& result) const
 {
     const Vector<String>& filenames = m_platformDragData->filenames();
-    for (size_t i = 0; i < filenames.size(); ++i)
-        result.append(filenames[i]);
+    for (size_t i = 0; i < filenames.size(); ++i) {
+        if (!filenames[i].isEmpty())
+            result.append(filenames[i]);
+    }
 }
 
 bool DragData::containsPlainText() const
diff --git a/Source/core/page/DragData.h b/Source/core/page/DragData.h
index 7c6f12a..8489d16 100644
--- a/Source/core/page/DragData.h
+++ b/Source/core/page/DragData.h
@@ -65,11 +65,10 @@
     bool containsCompatibleContent() const;
     String asURL(FilenameConversionPolicy filenamePolicy = ConvertFilenames, String* title = nullptr) const;
     String asPlainText() const;
-    void asFilenames(Vector<String>&) const;
+    void asFilePaths(Vector<String>&) const;
     PassRefPtrWillBeRawPtr<DocumentFragment> asFragment(LocalFrame*, PassRefPtrWillBeRawPtr<Range> context, bool allowPlainText, bool& chosePlainText) const;
     bool canSmartReplace() const;
     bool containsFiles() const;
-    unsigned numberOfFiles() const;
     int modifierKeyState() const;
 
     String droppedFileSystemId() const;
diff --git a/Source/core/page/EventSource.cpp b/Source/core/page/EventSource.cpp
index a6902c8..5b5dda3 100644
--- a/Source/core/page/EventSource.cpp
+++ b/Source/core/page/EventSource.cpp
@@ -86,12 +86,7 @@
     }
 
     // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved.
-    bool shouldBypassMainWorldCSP = false;
-    if (context->isDocument()) {
-        Document* document = toDocument(context);
-        shouldBypassMainWorldCSP = document->frame()->script().shouldBypassMainWorldCSP();
-    }
-    if (!shouldBypassMainWorldCSP && !context->contentSecurityPolicy()->allowConnectToSource(fullURL)) {
+    if (!ContentSecurityPolicy::shouldBypassMainWorld(context) && !context->contentSecurityPolicy()->allowConnectToSource(fullURL)) {
         // We can safely expose the URL to JavaScript, as this exception is generate synchronously before any redirects take place.
         exceptionState.throwSecurityError("Refused to connect to '" + fullURL.elidedString() + "' because it violates the document's Content Security Policy.");
         return nullptr;
diff --git a/Source/core/paint/BoxPainter.cpp b/Source/core/paint/BoxPainter.cpp
index fb79cb9..2a9a2b6 100644
--- a/Source/core/paint/BoxPainter.cpp
+++ b/Source/core/paint/BoxPainter.cpp
@@ -547,10 +547,6 @@
     if (!m_renderBox.layer() || m_renderBox.layer()->compositingState() != PaintsIntoOwnBacking)
         return;
 
-    // We should never have this state in this function. A layer with a mask
-    // should have always created its own backing if it became composited.
-    ASSERT(m_renderBox.layer()->compositingState() != HasOwnBackingButPaintsIntoAncestor);
-
     LayoutRect paintRect = LayoutRect(paintOffset, m_renderBox.size());
     paintInfo.context->fillRect(pixelSnappedIntRect(paintRect), Color::black);
 }
diff --git a/Source/core/paint/ImagePainter.cpp b/Source/core/paint/ImagePainter.cpp
index 447ccd5..03a2b86 100644
--- a/Source/core/paint/ImagePainter.cpp
+++ b/Source/core/paint/ImagePainter.cpp
@@ -200,4 +200,19 @@
     InspectorInstrumentation::didPaintImage(&m_renderImage);
 }
 
+void ImagePainter::paintBoxDecorationBackground(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
+{
+    // Don't anti-alias the background of an image. See crbug.com/423834 for the reason why.
+    // However, don't turn off anti-aliasing for subclasses such as video.
+    // An additional mega-hack here is to turn off anti-aliasing only for situations with a large device scale factor
+    // The referenced bug gives more details about a device with a scale factor greater than 3.4).
+    bool shouldAntialias = !m_renderImage.isRenderImage() || blink::deviceScaleFactor(m_renderImage.frame()) < 3.4;
+
+    bool oldShouldAntialias = paintInfo.context->shouldAntialias();
+    paintInfo.context->setShouldAntialias(shouldAntialias);
+    BoxPainter(m_renderImage).paintBoxDecorationBackground(paintInfo, paintOffset);
+
+    paintInfo.context->setShouldAntialias(oldShouldAntialias);
+}
+
 } // namespace blink
diff --git a/Source/core/paint/ImagePainter.h b/Source/core/paint/ImagePainter.h
index f3e2ced..2831801 100644
--- a/Source/core/paint/ImagePainter.h
+++ b/Source/core/paint/ImagePainter.h
@@ -17,9 +17,10 @@
 public:
     ImagePainter(RenderImage& renderImage) : m_renderImage(renderImage) { }
 
-    void paint(PaintInfo&, const LayoutPoint&);
-    void paintReplaced(PaintInfo&, const LayoutPoint&);
-    void paintIntoRect(GraphicsContext*, const LayoutRect&);
+    void paint(PaintInfo&, const LayoutPoint& paintOffset);
+    void paintReplaced(PaintInfo&, const LayoutPoint& paintOffset);
+    void paintIntoRect(GraphicsContext*, const LayoutRect& paintOffset);
+    void paintBoxDecorationBackground(PaintInfo&, const LayoutPoint& paintOffset);
 
 private:
     void paintAreaElementFocusRing(PaintInfo&);
diff --git a/Source/core/paint/LayerPainter.cpp b/Source/core/paint/LayerPainter.cpp
index 00cc876..1ca2e32 100644
--- a/Source/core/paint/LayerPainter.cpp
+++ b/Source/core/paint/LayerPainter.cpp
@@ -502,7 +502,6 @@
     DisableCompositingQueryAsserts disabler;
 
     return m_renderLayer.compositingState() == NotComposited
-        || m_renderLayer.compositingState() == HasOwnBackingButPaintsIntoAncestor
         || (paintingInfo.paintBehavior & PaintBehaviorFlattenCompositingLayers)
         || ((paintFlags & PaintLayerPaintingReflection) && !m_renderLayer.has3DTransform())
         || paintForFixedRootBackground(&m_renderLayer, paintFlags);
diff --git a/Source/core/rendering/InlineBox.cpp b/Source/core/rendering/InlineBox.cpp
index 362384c..830a7e5 100644
--- a/Source/core/rendering/InlineBox.cpp
+++ b/Source/core/rendering/InlineBox.cpp
@@ -107,7 +107,7 @@
 
 void InlineBox::showBox(int printedCharacters) const
 {
-    printedCharacters += fprintf(stderr, "%s\t%p", boxName(), this);
+    printedCharacters += fprintf(stderr, "%s %p", boxName(), this);
     for (; printedCharacters < showTreeCharacterOffset; printedCharacters++)
         fputc(' ', stderr);
     fprintf(stderr, "\t%s %p {pos=%g,%g size=%g,%g} baseline=%i/%i\n",
diff --git a/Source/core/rendering/InlineTextBox.cpp b/Source/core/rendering/InlineTextBox.cpp
index 91d7ad6..47c4c0c 100644
--- a/Source/core/rendering/InlineTextBox.cpp
+++ b/Source/core/rendering/InlineTextBox.cpp
@@ -526,6 +526,7 @@
     TextRun run(string, textPos(), expansion(), expansionBehavior(), direction(), dirOverride() || style->rtlOrdering() == VisualOrder, !renderer().canUseSimpleFontCodePath());
     run.setTabSize(!style->collapseWhiteSpace(), style->tabSize());
     run.setCharacterScanForCodePath(!renderer().canUseSimpleFontCodePath());
+    run.setUseComplexCodePath(!renderer().canUseSimpleFontCodePath());
 
     // Propagate the maximum length of the characters buffer to the TextRun, even when we're only processing a substring.
     run.setCharactersLength(maximumLength);
@@ -552,11 +553,11 @@
     value = value.substring(start(), len());
     value.replaceWithLiteral('\\', "\\\\");
     value.replaceWithLiteral('\n', "\\n");
-    printedCharacters += fprintf(stderr, "%s\t%p", boxName(), this);
+    printedCharacters += fprintf(stderr, "%s %p", boxName(), this);
     for (; printedCharacters < showTreeCharacterOffset; printedCharacters++)
         fputc(' ', stderr);
     printedCharacters = fprintf(stderr, "\t%s %p", obj.renderName(), &obj);
-    const int rendererCharacterOffset = 24;
+    const int rendererCharacterOffset = 75;
     for (; printedCharacters < rendererCharacterOffset; printedCharacters++)
         fputc(' ', stderr);
     fprintf(stderr, "(%d,%d) \"%s\"\n", start(), start() + len(), value.utf8().data());
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index 53b3e20..2e101f1 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -613,11 +613,6 @@
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    // If we are moving inline children from |this| to cloneBlock, then we need
-    // to clear our line box tree.
-    if (beforeChild && childrenInline())
-        deleteLineBoxTree();
-
     // Now take all of the children from beforeChild to the end and remove
     // them from |this| and place them in the clone.
     moveChildrenTo(cloneBlock, beforeChild, 0, true);
@@ -788,7 +783,8 @@
     // This function currently supports (1) and (2).
     RenderBlockFlow* columnsBlockAncestor = 0;
     if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isBeforeOrAfterContent()
-        && !newChild->isFloatingOrOutOfFlowPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
+        && !newChild->isFloatingOrOutOfFlowPositioned() && !newChild->isInline() && !newChild->isTablePart()
+        && !isAnonymousColumnSpanBlock()) {
         columnsBlockAncestor = containingColumnsBlock(false);
         if (columnsBlockAncestor) {
             // Make sure that none of the parent ancestors have a continuation.
@@ -4349,6 +4345,26 @@
     return !hasOverflowClip();
 }
 
+// Called when a positioned object moves but doesn't necessarily change size.  A simplified layout is attempted
+// that just updates the object's position. If the size does change, the object remains dirty.
+bool RenderBlock::tryLayoutDoingPositionedMovementOnly()
+{
+    LayoutUnit oldWidth = logicalWidth();
+    LogicalExtentComputedValues computedValues;
+    logicalExtentAfterUpdatingLogicalWidth(logicalTop(), computedValues);
+    // If we shrink to fit our width may have changed, so we still need full layout.
+    if (oldWidth != computedValues.m_extent)
+        return false;
+    setLogicalWidth(computedValues.m_extent);
+    setLogicalLeft(computedValues.m_position);
+    setMarginStart(computedValues.m_margins.m_start);
+    setMarginEnd(computedValues.m_margins.m_end);
+
+    LayoutUnit oldHeight = logicalHeight();
+    updateLogicalHeight();
+    return !hasPercentHeightDescendants() || oldHeight == logicalHeight();
+}
+
 #if ENABLE(ASSERT)
 void RenderBlock::checkPositionedObjectsNeedLayout()
 {
diff --git a/Source/core/rendering/RenderBlock.h b/Source/core/rendering/RenderBlock.h
index d4e3bdb..c5aef0e 100644
--- a/Source/core/rendering/RenderBlock.h
+++ b/Source/core/rendering/RenderBlock.h
@@ -369,7 +369,8 @@
 
     Node* nodeForHitTest() const;
 
-private:
+    bool tryLayoutDoingPositionedMovementOnly();
+
     virtual bool avoidsFloats() const override { return true; }
 
     bool hitTestColumns(const HitTestRequest&, HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
diff --git a/Source/core/rendering/RenderBlockFlow.cpp b/Source/core/rendering/RenderBlockFlow.cpp
index 79571ad..a22f5c3 100644
--- a/Source/core/rendering/RenderBlockFlow.cpp
+++ b/Source/core/rendering/RenderBlockFlow.cpp
@@ -1887,8 +1887,9 @@
             LayoutRect borderBox = child->borderBoxRect();
             LayoutUnit childLogicalWidthAtOldLogicalTopOffset = isHorizontalWritingMode() ? borderBox.width() : borderBox.height();
 
-            borderBox = child->borderBoxAfterUpdatingLogicalWidth(newLogicalTop);
-            LayoutUnit childLogicalWidthAtNewLogicalTopOffset = isHorizontalWritingMode() ? borderBox.width() : borderBox.height();
+            LogicalExtentComputedValues computedValues;
+            child->logicalExtentAfterUpdatingLogicalWidth(newLogicalTop, computedValues);
+            LayoutUnit childLogicalWidthAtNewLogicalTopOffset = computedValues.m_extent;
 
             if (childLogicalWidthAtNewLogicalTopOffset <= availableLogicalWidthAtNewLogicalTopOffset) {
                 // Even though we may not be moving, if the logical width did shrink because of the presence of new floats, then
@@ -2717,6 +2718,13 @@
     return RenderBox::avoidsFloats() || !style()->hasAutoColumnCount() || !style()->hasAutoColumnWidth();
 }
 
+void RenderBlockFlow::moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
+{
+    if (childrenInline())
+        deleteLineBoxTree();
+    RenderBoxModelObject::moveChildrenTo(toBoxModelObject, startChild, endChild, beforeChild, fullRemoveInsert);
+}
+
 LayoutUnit RenderBlockFlow::logicalLeftSelectionOffset(const RenderBlock* rootBlock, LayoutUnit position) const
 {
     LayoutUnit logicalLeft = logicalLeftOffsetForLine(position, false);
diff --git a/Source/core/rendering/RenderBlockFlow.h b/Source/core/rendering/RenderBlockFlow.h
index a6aaabb..adbf636 100644
--- a/Source/core/rendering/RenderBlockFlow.h
+++ b/Source/core/rendering/RenderBlockFlow.h
@@ -186,6 +186,9 @@
 
     virtual bool avoidsFloats() const override;
 
+    using RenderBoxModelObject::moveChildrenTo;
+    virtual void moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false) override;
+
     LayoutUnit xPositionForFloatIncludingMargin(const FloatingObject* child) const
     {
         if (isHorizontalWritingMode())
diff --git a/Source/core/rendering/RenderBlockLineLayout.cpp b/Source/core/rendering/RenderBlockLineLayout.cpp
index 93dd3c5..91db4b5 100644
--- a/Source/core/rendering/RenderBlockLineLayout.cpp
+++ b/Source/core/rendering/RenderBlockLineLayout.cpp
@@ -1164,17 +1164,28 @@
         child->borderStart();
 }
 
-static inline void stripTrailingSpace(float& inlineMax, float& inlineMin, RenderObject* trailingSpaceChild)
+static inline void stripTrailingSpace(float& inlineMax, float& inlineMin,
+    RenderObject* trailingSpaceChild)
 {
     if (trailingSpaceChild && trailingSpaceChild->isText()) {
-        // Collapse away the trailing space at the end of a block.
+        // Collapse away the trailing space at the end of a block by finding
+        // the first white-space character and subtracting its width. Subsequent
+        // white-space characters have been collapsed into the first one (which
+        // can be either a space or a tab character).
         RenderText* text = toRenderText(trailingSpaceChild);
-        bool useComplexCodePath = !text->canUseSimpleFontCodePath();
-        const UChar space = ' ';
-        const Font& font = text->style()->font(); // FIXME: This ignores first-line.
-        TextRun run = constructTextRun(text, font, &space, 1, text->style(), LTR);
-        if (useComplexCodePath)
-            run.setUseComplexCodePath(true);
+        UChar trailingWhitespaceChar = ' ';
+        for (unsigned i = text->textLength(); i > 0; i--) {
+            UChar c = text->characterAt(i - 1);
+            if (!Character::treatAsSpace(c))
+                break;
+            trailingWhitespaceChar = c;
+        }
+
+        // FIXME: This ignores first-line.
+        const Font& font = text->style()->font();
+        TextRun run = constructTextRun(text, font, &trailingWhitespaceChar, 1,
+            text->style(), text->style()->direction());
+        run.setUseComplexCodePath(!text->canUseSimpleFontCodePath());
         float spaceWidth = font.width(run);
         inlineMax -= spaceWidth + font.fontDescription().wordSpacing();
         if (inlineMin > inlineMax)
diff --git a/Source/core/rendering/RenderBox.cpp b/Source/core/rendering/RenderBox.cpp
index 7ae553d..3dbd51f 100644
--- a/Source/core/rendering/RenderBox.cpp
+++ b/Source/core/rendering/RenderBox.cpp
@@ -1307,9 +1307,8 @@
     // If we are set to do a full paint invalidation that means the RenderView will be
     // issue paint invalidations. We can then skip issuing of paint invalidations for the child
     // renderers as they'll be covered by the RenderView.
-    if (!view()->doingFullPaintInvalidation()) {
-        if (!isFullPaintInvalidationReason(reason))
-            invalidatePaintForOverflowIfNeeded();
+    if (!view()->doingFullPaintInvalidation() && !isFullPaintInvalidationReason(reason)) {
+        invalidatePaintForOverflowIfNeeded();
 
         // Issue paint invalidations for any scrollbars if there is a scrollable area for this renderer.
         if (ScrollableArea* area = scrollableArea()) {
@@ -1763,11 +1762,14 @@
         // If the paintInvalidationContainer is below o, then we need to map the rect into paintInvalidationContainer's coordinates.
         LayoutSize containerOffset = paintInvalidationContainer->offsetFromAncestorContainer(o);
         rect.move(-containerOffset);
+        // If the paintInvalidationContainer is fixed, then the rect is already in its coordinates so doesn't need viewport-adjusting.
+        if (paintInvalidationContainer->style()->position() != FixedPosition && o->isRenderView())
+            toRenderView(o)->adjustViewportConstrainedOffset(rect, RenderView::viewportConstrainedPosition(position));
         return;
     }
 
     if (o->isRenderView())
-        toRenderView(o)->mapRectToPaintInvalidationBacking(paintInvalidationContainer, rect, position == FixedPosition ? RenderView::IsFixedPosition : RenderView::IsNotFixedPosition, paintInvalidationState);
+        toRenderView(o)->mapRectToPaintInvalidationBacking(paintInvalidationContainer, rect, RenderView::viewportConstrainedPosition(position), paintInvalidationState);
     else
         o->mapRectToPaintInvalidationBacking(paintInvalidationContainer, rect, paintInvalidationState);
 }
@@ -2454,16 +2456,9 @@
     if (logicalHeight == initialLogicalHeight)
         return true;
 
-    if (!logicalHeight.isPercent() || isOutOfFlowPositioned())
-        return false;
-
-    // Anonymous block boxes are ignored when resolving percentage values that would refer to it:
-    // the closest non-anonymous ancestor box is used instead.
-    RenderBlock* containingBlock = this->containingBlock();
-    while (containingBlock->isAnonymous())
-        containingBlock = containingBlock->containingBlock();
-
-    return containingBlock->hasAutoHeightOrContainingBlockWithAutoHeight();
+    if (RenderBlock* cb = containingBlockForAutoHeightDetection(logicalHeight))
+        return cb->hasAutoHeightOrContainingBlockWithAutoHeight();
+    return false;
 }
 
 LayoutUnit RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight(LayoutUnit logicalHeight) const
@@ -3764,6 +3759,19 @@
     return isReplaced() || isReplacedElement(node()) || hasOverflowClip() || isHR() || isLegend() || isWritingModeRoot() || isFlexItemIncludingDeprecated();
 }
 
+bool RenderBox::hasNonCompositedScrollbars() const
+{
+    if (RenderLayer* layer = this->layer()) {
+        if (RenderLayerScrollableArea* scrollableArea = layer->scrollableArea()) {
+            if (scrollableArea->hasHorizontalScrollbar() && !scrollableArea->layerForHorizontalScrollbar())
+                return true;
+            if (scrollableArea->hasVerticalScrollbar() && !scrollableArea->layerForVerticalScrollbar())
+                return true;
+        }
+    }
+    return false;
+}
+
 PaintInvalidationReason RenderBox::paintInvalidationReason(const RenderLayerModelObject& paintInvalidationContainer,
     const LayoutRect& oldBounds, const LayoutPoint& oldLocation, const LayoutRect& newBounds, const LayoutPoint& newLocation) const
 {
@@ -3779,8 +3787,13 @@
         && hasLayer() && layer()->transform() && !layer()->transform()->isIdentityOrTranslation())
         return PaintInvalidationBoundsChange;
 
-    if (!style()->hasBackground() && !style()->hasBoxDecorations())
+    if (!style()->hasBackground() && !style()->hasBoxDecorations()) {
+        // We could let incremental invalidation cover non-composited scrollbars, but just
+        // do a full invalidation because incremental invalidation will go away with slimming paint.
+        if (invalidationReason == PaintInvalidationIncremental && hasNonCompositedScrollbars())
+            return PaintInvalidationBorderBoxChange;
         return invalidationReason;
+    }
 
     LayoutSize oldBorderBoxSize = computePreviousBorderBoxSize(oldBounds.size());
     LayoutSize newBorderBoxSize = size();
@@ -3788,8 +3801,11 @@
     if (oldBorderBoxSize == newBorderBoxSize)
         return invalidationReason;
 
-    // FIXME: Implement correct incremental invalidation for visual overflowing effects.
-    if (style()->hasVisualOverflowingEffect() || style()->hasAppearance() || style()->hasFilter())
+    // See another hasNonCompositedScrollbars() callsite above.
+    if (hasNonCompositedScrollbars())
+        return PaintInvalidationBorderBoxChange;
+
+    if (style()->hasVisualOverflowingEffect() || style()->hasAppearance() || style()->hasFilter() || style()->resize() != RESIZE_NONE)
         return PaintInvalidationBorderBoxChange;
 
     if (style()->hasBorderRadius()) {
@@ -4425,24 +4441,28 @@
     return previousBoundsSize;
 }
 
-LayoutRect RenderBox::borderBoxAfterUpdatingLogicalWidth(const LayoutUnit& newLogicalTop)
+void RenderBox::logicalExtentAfterUpdatingLogicalWidth(const LayoutUnit& newLogicalTop, RenderBox::LogicalExtentComputedValues& computedValues)
 {
     // FIXME: None of this is right for perpendicular writing-mode children.
     LayoutUnit oldLogicalWidth = logicalWidth();
+    LayoutUnit oldLogicalLeft = logicalLeft();
     LayoutUnit oldMarginLeft = marginLeft();
     LayoutUnit oldMarginRight = marginRight();
     LayoutUnit oldLogicalTop = logicalTop();
 
     setLogicalTop(newLogicalTop);
     updateLogicalWidth();
-    LayoutRect borderBox = borderBoxRect();
+
+    computedValues.m_extent = logicalWidth();
+    computedValues.m_position = logicalLeft();
+    computedValues.m_margins.m_start = marginStart();
+    computedValues.m_margins.m_end = marginEnd();
 
     setLogicalTop(oldLogicalTop);
     setLogicalWidth(oldLogicalWidth);
+    setLogicalLeft(oldLogicalLeft);
     setMarginLeft(oldMarginLeft);
     setMarginRight(oldMarginRight);
-
-    return borderBox;
 }
 
 } // namespace blink
diff --git a/Source/core/rendering/RenderBox.h b/Source/core/rendering/RenderBox.h
index 5a899c0..5ca9d92 100644
--- a/Source/core/rendering/RenderBox.h
+++ b/Source/core/rendering/RenderBox.h
@@ -494,22 +494,7 @@
     virtual void paintClippingMask(PaintInfo&, const LayoutPoint&);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0) override;
 
-    LayoutRect borderBoxAfterUpdatingLogicalWidth(const LayoutUnit& logicalTop);
-
-    // Called when a positioned object moves but doesn't necessarily change size.  A simplified layout is attempted
-    // that just updates the object's position. If the size does change, the object remains dirty.
-    bool tryLayoutDoingPositionedMovementOnly()
-    {
-        LayoutUnit oldWidth = width();
-        LayoutUnit newWidth = borderBoxAfterUpdatingLogicalWidth(logicalTop()).width();
-        // If we shrink to fit our width may have changed, so we still need full layout.
-        // FIXME: We check for potential change of width when deciding to set needsPositionedMovementLayout.
-        // So either that check or this one is unnecessary, probably the former. crbug.com/428050
-        if (oldWidth != newWidth)
-            return false;
-        updateLogicalHeight();
-        return true;
-    }
+    void logicalExtentAfterUpdatingLogicalWidth(const LayoutUnit& logicalTop, LogicalExtentComputedValues&);
 
     virtual PositionWithAffinity positionForPoint(const LayoutPoint&) override;
 
@@ -643,6 +628,7 @@
 
     bool backgroundHasOpaqueTopLayer() const;
 
+    void updateIntrinsicContentLogicalHeight(LayoutUnit intrinsicContentLogicalHeight) const { m_intrinsicContentLogicalHeight = intrinsicContentLogicalHeight; }
 protected:
     virtual void willBeDestroyed() override;
 
@@ -672,8 +658,6 @@
     virtual void addLayerHitTestRects(LayerHitTestRects&, const RenderLayer* currentCompositedLayer, const LayoutPoint& layerOffset, const LayoutRect& containerRect) const override;
     virtual void computeSelfHitTestRects(Vector<LayoutRect>&, const LayoutPoint& layerOffset) const override;
 
-    void updateIntrinsicContentLogicalHeight(LayoutUnit intrinsicContentLogicalHeight) const { m_intrinsicContentLogicalHeight = intrinsicContentLogicalHeight; }
-
     virtual PaintInvalidationReason paintInvalidationReason(const RenderLayerModelObject& paintInvalidationContainer,
         const LayoutRect& oldBounds, const LayoutPoint& oldPositionFromPaintInvalidationContainer,
         const LayoutRect& newBounds, const LayoutPoint& newPositionFromPaintInvalidationContainer) const override;
@@ -750,6 +734,8 @@
 
     void inflatePaintInvalidationRectForReflectionAndFilter(LayoutRect&) const;
 
+    bool hasNonCompositedScrollbars() const;
+
 protected:
     LayoutBoxExtent m_marginBox;
 
diff --git a/Source/core/rendering/RenderBoxModelObject.cpp b/Source/core/rendering/RenderBoxModelObject.cpp
index 69d4847..43e3b2e 100644
--- a/Source/core/rendering/RenderBoxModelObject.cpp
+++ b/Source/core/rendering/RenderBoxModelObject.cpp
@@ -155,17 +155,13 @@
     return offset;
 }
 
-bool RenderBoxModelObject::hasAutoHeightOrContainingBlockWithAutoHeight() const
+RenderBlock* RenderBoxModelObject::containingBlockForAutoHeightDetection(Length logicalHeight) const
 {
-    Length logicalHeightLength = style()->logicalHeight();
-    if (logicalHeightLength.isAuto())
-        return true;
-
     // For percentage heights: The percentage is calculated with respect to the height of the generated box's
     // containing block. If the height of the containing block is not specified explicitly (i.e., it depends
     // on content height), and this element is not absolutely positioned, the value computes to 'auto'.
-    if (!logicalHeightLength.isPercent() || isOutOfFlowPositioned() || document().inQuirksMode())
-        return false;
+    if (!logicalHeight.isPercent() || isOutOfFlowPositioned())
+        return 0;
 
     // Anonymous block boxes are ignored when resolving percentage values that would refer to it:
     // the closest non-anonymous ancestor box is used instead.
@@ -178,18 +174,32 @@
     // what the CSS spec says to do with heights. Basically we
     // don't care if the cell specified a height or not.
     if (cb->isTableCell())
-        return false;
+        return 0;
 
     // Match RenderBox::availableLogicalHeightUsing by special casing
     // the render view. The available height is taken from the frame.
     if (cb->isRenderView())
-        return false;
+        return 0;
 
     if (cb->isOutOfFlowPositioned() && !cb->style()->logicalTop().isAuto() && !cb->style()->logicalBottom().isAuto())
+        return 0;
+
+    return cb;
+}
+
+bool RenderBoxModelObject::hasAutoHeightOrContainingBlockWithAutoHeight() const
+{
+    Length logicalHeightLength = style()->logicalHeight();
+    if (logicalHeightLength.isAuto())
+        return true;
+
+    if (document().inQuirksMode())
         return false;
 
     // If the height of the containing block computes to 'auto', then it hasn't been 'specified explicitly'.
-    return cb->hasAutoHeightOrContainingBlockWithAutoHeight();
+    if (RenderBlock* cb = containingBlockForAutoHeightDetection(logicalHeightLength))
+        return cb->hasAutoHeightOrContainingBlockWithAutoHeight();
+    return false;
 }
 
 LayoutSize RenderBoxModelObject::relativePositionOffset() const
diff --git a/Source/core/rendering/RenderBoxModelObject.h b/Source/core/rendering/RenderBoxModelObject.h
index 98ce0dc..164c0ae 100644
--- a/Source/core/rendering/RenderBoxModelObject.h
+++ b/Source/core/rendering/RenderBoxModelObject.h
@@ -179,6 +179,7 @@
     LayoutRect localCaretRectForEmptyElement(LayoutUnit width, LayoutUnit textIndentOffset);
 
     bool hasAutoHeightOrContainingBlockWithAutoHeight() const;
+    RenderBlock* containingBlockForAutoHeightDetection(Length logicalHeight) const;
 
 public:
 
@@ -208,7 +209,7 @@
     {
         moveChildrenTo(toBoxModelObject, startChild, endChild, 0, fullRemoveInsert);
     }
-    void moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
+    virtual void moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
 
     enum ScaleByEffectiveZoomOrNot { ScaleByEffectiveZoom, DoNotScaleByEffectiveZoom };
     IntSize calculateImageIntrinsicDimensions(StyleImage*, const IntSize& scaledPositioningAreaSize, ScaleByEffectiveZoomOrNot) const;
diff --git a/Source/core/rendering/RenderCombineText.cpp b/Source/core/rendering/RenderCombineText.cpp
index cc6b573..fb58e1a 100644
--- a/Source/core/rendering/RenderCombineText.cpp
+++ b/Source/core/rendering/RenderCombineText.cpp
@@ -99,6 +99,10 @@
     if (style()->isHorizontalWritingMode())
         return;
 
+    // Nothing to combine.
+    if (hasEmptyText())
+        return;
+
     TextRun run = constructTextRun(this, originalFont(), this, style(), style()->direction());
     FontDescription description = originalFont().fontDescription();
     float emWidth = description.computedSize() * textCombineMargin;
diff --git a/Source/core/rendering/RenderFlexibleBox.cpp b/Source/core/rendering/RenderFlexibleBox.cpp
index 51454b7..1a789c4 100644
--- a/Source/core/rendering/RenderFlexibleBox.cpp
+++ b/Source/core/rendering/RenderFlexibleBox.cpp
@@ -1350,7 +1350,12 @@
                 child.setOverrideLogicalContentHeight(desiredLogicalHeight - child.borderAndPaddingLogicalHeight());
             if (childNeedsRelayout) {
                 child.setLogicalHeight(0);
+                // We cache the child's intrinsic content logical height to avoid it being reset to the stretched height.
+                // FIXME: This is fragile. RenderBoxes should be smart enough to determine their intrinsic content logical
+                // height correctly even when there's an overrideHeight.
+                LayoutUnit childIntrinsicContentLogicalHeight = child.intrinsicContentLogicalHeight();
                 child.forceChildLayout();
+                child.updateIntrinsicContentLogicalHeight(childIntrinsicContentLogicalHeight);
             }
         }
     } else if (isColumnFlow() && child.style()->logicalWidth().isAuto()) {
diff --git a/Source/core/rendering/RenderImage.cpp b/Source/core/rendering/RenderImage.cpp
index 6278c97..0a677ad 100644
--- a/Source/core/rendering/RenderImage.cpp
+++ b/Source/core/rendering/RenderImage.cpp
@@ -38,6 +38,7 @@
 #include "core/html/HTMLImageElement.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/HTMLMapElement.h"
+#include "core/page/Page.h"
 #include "core/paint/ImagePainter.h"
 #include "core/rendering/HitTestResult.h"
 #include "core/rendering/PaintInfo.h"
@@ -50,8 +51,6 @@
 
 namespace blink {
 
-float deviceScaleFactor(LocalFrame*);
-
 using namespace HTMLNames;
 
 RenderImage::RenderImage(Element* element)
@@ -280,6 +279,11 @@
     ImagePainter(*this).paint(paintInfo, paintOffset);
 }
 
+void RenderImage::paintBoxDecorationBackground(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
+{
+    ImagePainter(*this).paintBoxDecorationBackground(paintInfo, paintOffset);
+}
+
 void RenderImage::areaElementFocusChanged(HTMLAreaElement* areaElement)
 {
     ASSERT(areaElement->imageElement() == node());
diff --git a/Source/core/rendering/RenderImage.h b/Source/core/rendering/RenderImage.h
index 6c5c128..8a12af1 100644
--- a/Source/core/rendering/RenderImage.h
+++ b/Source/core/rendering/RenderImage.h
@@ -81,6 +81,8 @@
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0) override;
 
     virtual void paint(PaintInfo&, const LayoutPoint&) override final;
+    virtual void paintBoxDecorationBackground(PaintInfo&, const LayoutPoint&) override final;
+
     virtual void layout() override;
     virtual bool updateImageLoadingPriorities() override final;
 
diff --git a/Source/core/rendering/RenderInline.cpp b/Source/core/rendering/RenderInline.cpp
index d156b0b..b436757 100644
--- a/Source/core/rendering/RenderInline.cpp
+++ b/Source/core/rendering/RenderInline.cpp
@@ -1019,29 +1019,42 @@
     return rect;
 }
 
+LayoutRect RenderInline::absoluteClippedOverflowRect() const
+{
+    return clippedOverflowRect(view());
+}
+
 LayoutRect RenderInline::clippedOverflowRectForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer, const PaintInvalidationState* paintInvalidationState) const
 {
+    // If we don't create line boxes, we don't have any invalidations to do.
+    if (!alwaysCreateLineBoxes())
+        return LayoutRect();
+    return clippedOverflowRect(paintInvalidationContainer);
+}
+
+LayoutRect RenderInline::clippedOverflowRect(const RenderLayerModelObject* paintInvalidationContainer, const PaintInvalidationState* paintInvalidationState) const
+{
     if ((!firstLineBoxIncludingCulling() && !continuation()) || style()->visibility() != VISIBLE)
         return LayoutRect();
 
-    LayoutRect paintInvalidationRect(linesVisualOverflowBoundingBox());
+    LayoutRect overflowRect(linesVisualOverflowBoundingBox());
 
     LayoutUnit outlineSize = style()->outlineSize();
-    paintInvalidationRect.inflate(outlineSize);
+    overflowRect.inflate(outlineSize);
 
-    mapRectToPaintInvalidationBacking(paintInvalidationContainer, paintInvalidationRect, paintInvalidationState);
+    mapRectToPaintInvalidationBacking(paintInvalidationContainer, overflowRect, paintInvalidationState);
 
     if (outlineSize) {
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
             if (!curr->isText())
-                paintInvalidationRect.unite(curr->rectWithOutlineForPaintInvalidation(paintInvalidationContainer, outlineSize));
+                overflowRect.unite(curr->rectWithOutlineForPaintInvalidation(paintInvalidationContainer, outlineSize));
         }
 
         if (continuation() && !continuation()->isInline() && continuation()->parent())
-            paintInvalidationRect.unite(continuation()->rectWithOutlineForPaintInvalidation(paintInvalidationContainer, outlineSize));
+            overflowRect.unite(continuation()->rectWithOutlineForPaintInvalidation(paintInvalidationContainer, outlineSize));
     }
 
-    return paintInvalidationRect;
+    return overflowRect;
 }
 
 LayoutRect RenderInline::rectWithOutlineForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer, LayoutUnit outlineWidth, const PaintInvalidationState* paintInvalidationState) const
diff --git a/Source/core/rendering/RenderInline.h b/Source/core/rendering/RenderInline.h
index c277d9e..6c25269 100644
--- a/Source/core/rendering/RenderInline.h
+++ b/Source/core/rendering/RenderInline.h
@@ -144,10 +144,15 @@
     virtual LayoutUnit offsetWidth() const override final { return linesBoundingBox().width(); }
     virtual LayoutUnit offsetHeight() const override final { return linesBoundingBox().height(); }
 
+    virtual LayoutRect absoluteClippedOverflowRect() const override;
     virtual LayoutRect clippedOverflowRectForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer, const PaintInvalidationState* = 0) const override;
     virtual LayoutRect rectWithOutlineForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer, LayoutUnit outlineWidth, const PaintInvalidationState* = 0) const override final;
     virtual void mapRectToPaintInvalidationBacking(const RenderLayerModelObject* paintInvalidationContainer, LayoutRect&, const PaintInvalidationState*) const override final;
 
+    // This method differs from clippedOverflowRectForPaintInvalidation in that it includes
+    // the rects for culled inline boxes, which aren't necessary for paint invalidation.
+    LayoutRect clippedOverflowRect(const RenderLayerModelObject*, const PaintInvalidationState* = 0) const;
+
     virtual void mapLocalToContainer(const RenderLayerModelObject* paintInvalidationContainer, TransformState&, MapCoordinatesFlags = ApplyContainerFlip, bool* wasFixed = 0, const PaintInvalidationState* = 0) const override;
 
     virtual PositionWithAffinity positionForPoint(const LayoutPoint&) override final;
diff --git a/Source/core/rendering/RenderLayer.cpp b/Source/core/rendering/RenderLayer.cpp
index df23cdb..b96470b 100644
--- a/Source/core/rendering/RenderLayer.cpp
+++ b/Source/core/rendering/RenderLayer.cpp
@@ -551,6 +551,11 @@
 {
     RenderLayer* paintInvalidationLayer = paintInvalidationContainer->layer();
     if (!paintInvalidationLayer->groupedMapping()) {
+        // FIXME: this is defensive code to avoid crashes such as those described in crbug.com/440887, most likely due to
+        // the new multi-column code special-casing when choosing paint invalidation containers. Remove once that is cleaned up.
+        if (!paintInvalidationLayer->compositedLayerMapping())
+            return;
+
         point.move(paintInvalidationLayer->compositedLayerMapping()->contentOffsetInCompositingLayer());
         return;
     }
@@ -652,7 +657,7 @@
 
     m_hasNonCompositedChild = false;
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->compositingState() == NotComposited || child->compositingState() == HasOwnBackingButPaintsIntoAncestor) {
+        if (child->compositingState() == NotComposited) {
             m_hasNonCompositedChild = true;
             return;
         }
@@ -2398,9 +2403,6 @@
     if (!m_compositedLayerMapping)
         return NotComposited;
 
-    if (compositedLayerMapping()->paintsIntoCompositedAncestor())
-        return HasOwnBackingButPaintsIntoAncestor;
-
     return PaintsIntoOwnBacking;
 }
 
@@ -2493,15 +2495,6 @@
     return m_compositedLayerMapping && m_compositedLayerMapping->hasChildClippingMaskLayer();
 }
 
-bool RenderLayer::clipsCompositingDescendantsWithBorderRadius() const
-{
-    RenderStyle* style = renderer()->style();
-    if (!style)
-        return false;
-
-    return compositor()->clipsCompositingDescendants(this) && style->hasBorderRadius();
-}
-
 bool RenderLayer::paintsWithTransform(PaintBehavior paintBehavior) const
 {
     return transform() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || compositingState() != PaintsIntoOwnBacking);
diff --git a/Source/core/rendering/RenderLayer.h b/Source/core/rendering/RenderLayer.h
index 6a447be..9fe19f8 100644
--- a/Source/core/rendering/RenderLayer.h
+++ b/Source/core/rendering/RenderLayer.h
@@ -304,8 +304,6 @@
     bool hasCompositedClippingMask() const;
     bool needsCompositedScrolling() const { return m_scrollableArea && m_scrollableArea->needsCompositedScrolling(); }
 
-    bool clipsCompositingDescendantsWithBorderRadius() const;
-
     // Computes the position of the given render object in the space of |paintInvalidationContainer|.
     // FIXME: invert the logic to have paint invalidation containers take care of painting objects into them, rather than the reverse.
     // This will allow us to clean up this static method messiness.
diff --git a/Source/core/rendering/RenderMediaControls.cpp b/Source/core/rendering/RenderMediaControls.cpp
index 9124b87..996d760 100644
--- a/Source/core/rendering/RenderMediaControls.cpp
+++ b/Source/core/rendering/RenderMediaControls.cpp
@@ -106,7 +106,8 @@
     if (!hasSource(mediaElement))
         return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
 
-    return paintMediaButton(paintInfo.context, rect, mediaControlElementType(object->node()) == MediaPlayButton ? mediaPlay : mediaPause);
+    Image * image = !object->node()->isMediaControlElement() || mediaControlElementType(object->node()) == MediaPlayButton ? mediaPlay : mediaPause;
+    return paintMediaButton(paintInfo.context, rect, image);
 }
 
 static bool paintMediaOverlayPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
@@ -345,15 +346,24 @@
     if (!mediaElement)
         return false;
 
-    static Image* mediaCastOnButton = platformResource("mediaplayerCastOn");
-    static Image* mediaCastOffButton = platformResource("mediaplayerCastOff");
+    static Image* mediaCastOn = platformResource("mediaplayerCastOn");
+    static Image* mediaCastOff = platformResource("mediaplayerCastOff");
+    // To ensure that the overlaid cast button is visible when overlaid on pale videos we use a
+    // different version of it for the overlaid case with a semi-opaque background.
+    static Image* mediaOverlayCastOff = platformResource("mediaplayerOverlayCastOff");
 
-    if (mediaElement->isPlayingRemotely()) {
-        return paintMediaButton(paintInfo.context, rect, mediaCastOnButton);
+    switch (mediaControlElementType(object->node())) {
+    case MediaCastOnButton:
+    case MediaOverlayCastOnButton:
+        return paintMediaButton(paintInfo.context, rect, mediaCastOn);
+    case MediaCastOffButton:
+        return paintMediaButton(paintInfo.context, rect, mediaCastOff);
+    case MediaOverlayCastOffButton:
+        return paintMediaButton(paintInfo.context, rect, mediaOverlayCastOff);
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
     }
-
-    return paintMediaButton(paintInfo.context, rect, mediaCastOffButton);
-
 }
 
 bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
diff --git a/Source/core/rendering/RenderObject.cpp b/Source/core/rendering/RenderObject.cpp
index 62447b8..110765b 100644
--- a/Source/core/rendering/RenderObject.cpp
+++ b/Source/core/rendering/RenderObject.cpp
@@ -1722,14 +1722,6 @@
             container->setNeedsOverflowRecalcAfterStyleChange();
     }
 
-    if (diff.visualOverflowChanged() && !needsLayout()) {
-        // FIXME crbug.com/425610: Compute overflow without layout for line boxes too.
-        if (isRenderBlock())
-            setNeedsOverflowRecalcAfterStyleChange();
-        else
-            setNeedsLayoutAndPrefWidthsRecalc();
-    }
-
     if (updatedDiff.needsPaintInvalidationLayer())
         toRenderLayerModelObject(this)->layer()->setShouldDoFullPaintInvalidationIncludingNonCompositingDescendants();
     else if (diff.needsPaintInvalidationObject() || updatedDiff.needsPaintInvalidationObject())
diff --git a/Source/core/rendering/RenderObject.h b/Source/core/rendering/RenderObject.h
index 618de57..503113d 100644
--- a/Source/core/rendering/RenderObject.h
+++ b/Source/core/rendering/RenderObject.h
@@ -864,7 +864,7 @@
 
     // Returns the rect that should have paint invalidated whenever this object changes. The rect is in the view's
     // coordinate space. This method deals with outlines and overflow.
-    LayoutRect absoluteClippedOverflowRect() const;
+    virtual LayoutRect absoluteClippedOverflowRect() const;
     IntRect pixelSnappedAbsoluteClippedOverflowRect() const;
     virtual LayoutRect clippedOverflowRectForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer, const PaintInvalidationState* = 0) const;
     virtual LayoutRect rectWithOutlineForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer, LayoutUnit outlineWidth, const PaintInvalidationState* = 0) const;
diff --git a/Source/core/rendering/RenderTable.cpp b/Source/core/rendering/RenderTable.cpp
index cf2d2f3..a10fc6a 100644
--- a/Source/core/rendering/RenderTable.cpp
+++ b/Source/core/rendering/RenderTable.cpp
@@ -389,6 +389,11 @@
 
 void RenderTable::simplifiedNormalFlowLayout()
 {
+    // FIXME: We should walk through the items in the tree in tree order to do the layout here
+    // instead of walking through individual parts of the tree. crbug.com/442737
+    for (auto& caption : m_captions)
+        caption->layoutIfNeeded();
+
     for (RenderTableSection* section = topSection(); section; section = sectionBelow(section)) {
         section->layoutIfNeeded();
         section->computeOverflowFromCells();
diff --git a/Source/core/rendering/RenderText.cpp b/Source/core/rendering/RenderText.cpp
index d23c67f..8fa83e9 100644
--- a/Source/core/rendering/RenderText.cpp
+++ b/Source/core/rendering/RenderText.cpp
@@ -809,7 +809,9 @@
         const Font& font = style()->font(); // FIXME: This ignores first-line.
         if (stripFrontSpaces) {
             const UChar spaceChar = space;
-            float spaceWidth = font.width(constructTextRun(this, font, &spaceChar, 1, style(), direction));
+            TextRun run = constructTextRun(this, font, &spaceChar, 1, style(), direction);
+            run.setUseComplexCodePath(!canUseSimpleFontCodePath());
+            float spaceWidth = font.width(run);
             maxWidth -= spaceWidth;
         } else {
             maxWidth += font.fontDescription().wordSpacing();
diff --git a/Source/core/rendering/RenderTreeAsText.cpp b/Source/core/rendering/RenderTreeAsText.cpp
index 6c73353..9544861 100644
--- a/Source/core/rendering/RenderTreeAsText.cpp
+++ b/Source/core/rendering/RenderTreeAsText.cpp
@@ -556,8 +556,6 @@
                 << l.compositedLayerMapping()->compositedBounds()
                 << ", drawsContent="
                 << l.compositedLayerMapping()->mainGraphicsLayer()->drawsContent()
-                << ", paints into ancestor="
-                << l.compositedLayerMapping()->paintsIntoCompositedAncestor()
                 << (l.shouldIsolateCompositedDescendants() ? ", isolatesCompositedBlending" : "")
                 << ")";
         }
diff --git a/Source/core/rendering/RenderView.cpp b/Source/core/rendering/RenderView.cpp
index bd48ce8..2067106 100644
--- a/Source/core/rendering/RenderView.cpp
+++ b/Source/core/rendering/RenderView.cpp
@@ -242,8 +242,11 @@
         transformState.applyTransform(t);
     }
 
-    if (mode & IsFixed && m_frameView)
+    if ((mode & IsFixed) && m_frameView) {
         transformState.move(m_frameView->scrollOffsetForFixedPosition());
+        // IsFixed flag is only applicable within this RenderView.
+        mode &= ~IsFixed;
+    }
 
     if (paintInvalidationContainer == this)
         return;
@@ -330,7 +333,7 @@
     LayoutRect dirtyRect = viewRect();
     if (doingFullPaintInvalidation() && !dirtyRect.isEmpty()) {
         const RenderLayerModelObject* paintInvalidationContainer = &paintInvalidationState.paintInvalidationContainer();
-        mapRectToPaintInvalidationBacking(paintInvalidationContainer, dirtyRect, &paintInvalidationState);
+        RenderLayer::mapRectToPaintInvalidationBacking(this, paintInvalidationContainer, dirtyRect, &paintInvalidationState);
         invalidatePaintUsingContainer(paintInvalidationContainer, dirtyRect, PaintInvalidationFull);
     }
     RenderBlock::invalidateTreeIfNeeded(paintInvalidationState);
@@ -382,13 +385,7 @@
             rect.setX(viewWidth() - rect.maxX());
     }
 
-    if (viewportConstraint == IsFixedPosition && m_frameView) {
-        rect.move(m_frameView->scrollOffsetForFixedPosition());
-        // If we have a pending scroll, invalidate the previous scroll position.
-        if (!m_frameView->pendingScrollDelta().isZero()) {
-            rect.move(-LayoutSize(m_frameView->pendingScrollDelta()));
-        }
-    }
+    adjustViewportConstrainedOffset(rect, viewportConstraint);
 
     // Apply our transform if we have one (because of full page zooming).
     if (!paintInvalidationContainer && layer() && layer()->transform())
@@ -416,6 +413,18 @@
     }
 }
 
+void RenderView::adjustViewportConstrainedOffset(LayoutRect& rect, ViewportConstrainedPosition viewportConstraint) const
+{
+    if (viewportConstraint != IsFixedPosition)
+        return;
+
+    if (m_frameView) {
+        rect.move(m_frameView->scrollOffsetForFixedPosition());
+        // If we have a pending scroll, invalidate the previous scroll position.
+        if (!m_frameView->pendingScrollDelta().isZero())
+            rect.move(-LayoutSize(m_frameView->pendingScrollDelta()));
+    }
+}
 
 void RenderView::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
diff --git a/Source/core/rendering/RenderView.h b/Source/core/rendering/RenderView.h
index 18d3dc3..0723c2f 100644
--- a/Source/core/rendering/RenderView.h
+++ b/Source/core/rendering/RenderView.h
@@ -86,8 +86,11 @@
         IsNotFixedPosition,
         IsFixedPosition,
     };
+
+    static ViewportConstrainedPosition viewportConstrainedPosition(EPosition position) { return position == FixedPosition ? IsFixedPosition : IsNotFixedPosition; }
     void mapRectToPaintInvalidationBacking(const RenderLayerModelObject* paintInvalidationContainer, LayoutRect&, ViewportConstrainedPosition, const PaintInvalidationState*) const;
     virtual void mapRectToPaintInvalidationBacking(const RenderLayerModelObject* paintInvalidationContainer, LayoutRect&, const PaintInvalidationState*) const override;
+    void adjustViewportConstrainedOffset(LayoutRect&, ViewportConstrainedPosition) const;
 
     void invalidatePaintForRectangle(const LayoutRect&, PaintInvalidationReason) const;
 
diff --git a/Source/core/rendering/SubtreeLayoutScope.cpp b/Source/core/rendering/SubtreeLayoutScope.cpp
index 8e21605..5fbdd52 100644
--- a/Source/core/rendering/SubtreeLayoutScope.cpp
+++ b/Source/core/rendering/SubtreeLayoutScope.cpp
@@ -55,7 +55,7 @@
 void SubtreeLayoutScope::setNeedsLayout(RenderObject* descendant)
 {
     ASSERT(descendant->isDescendantOf(&m_root));
-    descendant->setNeedsLayoutAndFullPaintInvalidation(MarkContainingBlockChain, this);
+    descendant->setNeedsLayout(MarkContainingBlockChain, this);
 }
 
 void SubtreeLayoutScope::setChildNeedsLayout(RenderObject* descendant)
diff --git a/Source/core/rendering/compositing/CompositedLayerMapping.cpp b/Source/core/rendering/compositing/CompositedLayerMapping.cpp
index eb1ccfc..3cf7bbc 100644
--- a/Source/core/rendering/compositing/CompositedLayerMapping.cpp
+++ b/Source/core/rendering/compositing/CompositedLayerMapping.cpp
@@ -164,8 +164,6 @@
     , m_contentOffsetInCompositingLayerDirty(false)
     , m_pendingUpdateScope(GraphicsLayerUpdateNone)
     , m_isMainFrameRenderViewLayer(false)
-    , m_requiresOwnBackingStoreForIntrinsicReasons(false)
-    , m_requiresOwnBackingStoreForAncestorReasons(false)
     , m_backgroundLayerPaintsFixedRootBackground(false)
     , m_scrollingContentsAreEmpty(false)
 {
@@ -1146,7 +1144,7 @@
 
     const IntRect blockSelectionGapsBounds = m_owningLayer.blockSelectionGapsBounds();
     const bool shouldDrawContent = !blockSelectionGapsBounds.isEmpty();
-    m_scrollingBlockSelectionLayer->setDrawsContent(!paintsIntoCompositedAncestor() && shouldDrawContent);
+    m_scrollingBlockSelectionLayer->setDrawsContent(shouldDrawContent);
     if (!shouldDrawContent)
         return;
     // FIXME: Remove the flooredIntSize conversion. crbug.com/414283.
@@ -1168,7 +1166,7 @@
         // m_scrollingLayer never has backing store.
         // m_scrollingContentsLayer only needs backing store if the scrolled contents need to paint.
         m_scrollingContentsAreEmpty = !m_owningLayer.hasVisibleContent() || !(renderer()->hasBackground() || paintsChildren());
-        m_scrollingContentsLayer->setDrawsContent(!paintsIntoCompositedAncestor() && !m_scrollingContentsAreEmpty);
+        m_scrollingContentsLayer->setDrawsContent(!m_scrollingContentsAreEmpty);
         updateScrollingBlockSelection();
     }
 
@@ -1193,10 +1191,10 @@
         m_backgroundLayer->setDrawsContent(hasPaintedContent);
 
     if (m_maskLayer)
-        m_maskLayer->setDrawsContent(!paintsIntoCompositedAncestor());
+        m_maskLayer->setDrawsContent(true);
 
     if (m_childClippingMaskLayer)
-        m_childClippingMaskLayer->setDrawsContent(!paintsIntoCompositedAncestor());
+        m_childClippingMaskLayer->setDrawsContent(true);
 }
 
 void CompositedLayerMapping::updateChildrenTransform()
@@ -1700,7 +1698,7 @@
         // contribute to. This whole confusion can be avoided by specifying
         // explicitly the composited ancestor where we would stop accumulating
         // opacity.
-        if (curr->compositingState() == PaintsIntoOwnBacking || curr->compositingState() == HasOwnBackingButPaintsIntoAncestor)
+        if (curr->compositingState() == PaintsIntoOwnBacking)
             break;
 
         finalOpacity *= curr->renderer()->opacity();
@@ -1765,7 +1763,7 @@
 
 bool CompositedLayerMapping::containsPaintedContent() const
 {
-    if (paintsIntoCompositedAncestor() || m_owningLayer.isReflection())
+    if (m_owningLayer.isReflection())
         return false;
 
     if (renderer()->isImage() && isDirectlyCompositedImage())
@@ -1952,49 +1950,6 @@
     return m_childTransformLayer.get();
 }
 
-bool CompositedLayerMapping::updateRequiresOwnBackingStoreForAncestorReasons(const RenderLayer* compositingAncestorLayer)
-{
-    unsigned previousRequiresOwnBackingStoreForAncestorReasons = m_requiresOwnBackingStoreForAncestorReasons;
-    bool previousPaintsIntoCompositedAncestor = paintsIntoCompositedAncestor();
-    bool canPaintIntoAncestor = compositingAncestorLayer
-        && (compositingAncestorLayer->compositedLayerMapping()->mainGraphicsLayer()->drawsContent()
-            || compositingAncestorLayer->compositedLayerMapping()->paintsIntoCompositedAncestor());
-
-    m_requiresOwnBackingStoreForAncestorReasons = !canPaintIntoAncestor;
-    if (paintsIntoCompositedAncestor() != previousPaintsIntoCompositedAncestor) {
-        // Back out the change temporarily while invalidating with respect to the old container.
-        m_requiresOwnBackingStoreForAncestorReasons = !m_requiresOwnBackingStoreForAncestorReasons;
-        compositor()->paintInvalidationOnCompositingChange(&m_owningLayer);
-        m_requiresOwnBackingStoreForAncestorReasons = !m_requiresOwnBackingStoreForAncestorReasons;
-    }
-
-    return m_requiresOwnBackingStoreForAncestorReasons != previousRequiresOwnBackingStoreForAncestorReasons;
-}
-
-bool CompositedLayerMapping::updateRequiresOwnBackingStoreForIntrinsicReasons()
-{
-    unsigned previousRequiresOwnBackingStoreForIntrinsicReasons = m_requiresOwnBackingStoreForIntrinsicReasons;
-    bool previousPaintsIntoCompositedAncestor = paintsIntoCompositedAncestor();
-    RenderObject* renderer = m_owningLayer.renderer();
-    m_requiresOwnBackingStoreForIntrinsicReasons = m_owningLayer.isRootLayer()
-        || (m_owningLayer.compositingReasons() & CompositingReasonComboReasonsThatRequireOwnBacking)
-        || m_owningLayer.transform()
-        || m_owningLayer.clipsCompositingDescendantsWithBorderRadius() // FIXME: Revisit this if the paintsIntoCompositedAncestor state is removed.
-        || renderer->isTransparent()
-        || renderer->hasMask()
-        || renderer->hasReflection()
-        || renderer->hasFilter();
-
-    if (paintsIntoCompositedAncestor() != previousPaintsIntoCompositedAncestor) {
-        // Back out the change temporarily while invalidating with respect to the old container.
-        m_requiresOwnBackingStoreForIntrinsicReasons = !m_requiresOwnBackingStoreForIntrinsicReasons;
-        compositor()->paintInvalidationOnCompositingChange(&m_owningLayer);
-        m_requiresOwnBackingStoreForIntrinsicReasons = !m_requiresOwnBackingStoreForIntrinsicReasons;
-    }
-
-    return m_requiresOwnBackingStoreForIntrinsicReasons != previousRequiresOwnBackingStoreForIntrinsicReasons;
-}
-
 void CompositedLayerMapping::setBlendMode(WebBlendMode blendMode)
 {
     if (m_ancestorClippingLayer) {
@@ -2028,7 +1983,6 @@
 void CompositedLayerMapping::setContentsNeedDisplay()
 {
     // FIXME: need to split out paint invalidations for the background.
-    ASSERT(!paintsIntoCompositedAncestor());
     ApplyToGraphicsLayers(this, SetContentsNeedsDisplayFunctor(), ApplyToContentLayers);
 }
 
@@ -2050,8 +2004,6 @@
 void CompositedLayerMapping::setContentsNeedDisplayInRect(const LayoutRect& r, PaintInvalidationReason invalidationReason)
 {
     // FIXME: need to split out paint invalidations for the background.
-    ASSERT(!paintsIntoCompositedAncestor());
-
     SetContentsNeedsDisplayInRectFunctor functor = {
         pixelSnappedIntRect(r.location() + m_owningLayer.subpixelAccumulation(), r.size()),
         invalidationReason
@@ -2099,8 +2051,6 @@
 void CompositedLayerMapping::doPaintTask(const GraphicsLayerPaintInfo& paintInfo, const PaintLayerFlags& paintLayerFlags, GraphicsContext* context,
     const IntRect& clip) // In the coords of rootLayer.
 {
-    RELEASE_ASSERT(paintInfo.renderLayer->compositingState() == PaintsIntoGroupedBacking || !paintsIntoCompositedAncestor());
-
     FontCachePurgePreventer fontCachePurgePreventer;
 
     // Note carefully: in theory it is appropriate to invoke context->save() here
diff --git a/Source/core/rendering/compositing/CompositedLayerMapping.h b/Source/core/rendering/compositing/CompositedLayerMapping.h
index dae7e41..7565b18 100644
--- a/Source/core/rendering/compositing/CompositedLayerMapping.h
+++ b/Source/core/rendering/compositing/CompositedLayerMapping.h
@@ -116,19 +116,6 @@
     // Contains the bottommost layer in the hierarchy that can contain the children transform.
     GraphicsLayer* layerForChildrenTransform() const;
 
-    // Returns true for a composited layer that has no backing store of its own, so
-    // paints into some ancestor layer.
-    bool paintsIntoCompositedAncestor() const { return !(m_requiresOwnBackingStoreForAncestorReasons || m_requiresOwnBackingStoreForIntrinsicReasons); }
-
-    // Updates whether a backing store is needed based on the layer's compositing ancestor's
-    // properties; returns true if the need for a backing store for ancestor reasons changed.
-    bool updateRequiresOwnBackingStoreForAncestorReasons(const RenderLayer* compositingAncestor);
-
-    // Updates whether a backing store is needed for intrinsic reasons (that is, based on the
-    // layer's own properties or compositing reasons); returns true if the intrinsic need for
-    // a backing store changed.
-    bool updateRequiresOwnBackingStoreForIntrinsicReasons();
-
     void setSquashingContentsNeedDisplay();
     void setContentsNeedDisplay();
     // r is in the coordinate space of the layer's render object
@@ -421,8 +408,7 @@
 
     unsigned m_pendingUpdateScope : 2;
     unsigned m_isMainFrameRenderViewLayer : 1;
-    unsigned m_requiresOwnBackingStoreForIntrinsicReasons : 1;
-    unsigned m_requiresOwnBackingStoreForAncestorReasons : 1;
+
     unsigned m_backgroundLayerPaintsFixedRootBackground : 1;
     unsigned m_scrollingContentsAreEmpty : 1;
 };
diff --git a/Source/core/rendering/compositing/CompositingLayerAssigner.cpp b/Source/core/rendering/compositing/CompositingLayerAssigner.cpp
index e95e56e..44727ed 100644
--- a/Source/core/rendering/compositing/CompositingLayerAssigner.cpp
+++ b/Source/core/rendering/compositing/CompositingLayerAssigner.cpp
@@ -275,8 +275,8 @@
     }
 
     if (m_layerSquashingEnabled) {
-        // At this point, if the layer is to be "separately" composited, then its backing becomes the most recent in paint-order.
-        if (layer->compositingState() == PaintsIntoOwnBacking || layer->compositingState() == HasOwnBackingButPaintsIntoAncestor) {
+        // At this point, if the layer is to be separately composited, then its backing becomes the most recent in paint-order.
+        if (layer->compositingState() == PaintsIntoOwnBacking) {
             ASSERT(!requiresSquashing(layer->compositingReasons()));
             squashingState.updateSquashingStateForNewMapping(layer->compositedLayerMapping(), layer->hasCompositedLayerMapping());
         }
diff --git a/Source/core/rendering/compositing/CompositingState.h b/Source/core/rendering/compositing/CompositingState.h
index 9e2cb4b..b56514b 100644
--- a/Source/core/rendering/compositing/CompositingState.h
+++ b/Source/core/rendering/compositing/CompositingState.h
@@ -11,17 +11,11 @@
     // The layer paints into its enclosing composited ancestor.
     NotComposited = 0,
 
-    // The layer is composited, but its contents still paint into enclosing composited ancestor.
-    // In this state, paint invalidations must be sent to the enclosing composited ancestor.
-    // Typically this happens when a layer's properties need to be represented in the compositor
-    // output data structures, but it doesn't actually have any other reasons to be composited.
-    HasOwnBackingButPaintsIntoAncestor = 1,
-
-    PaintsIntoOwnBacking = 2,
+    PaintsIntoOwnBacking = 1,
 
     // In this state, the RenderLayer subtree paints into a backing that is shared by
     // several RenderLayer subtrees.
-    PaintsIntoGroupedBacking = 3
+    PaintsIntoGroupedBacking = 2
 };
 
 } // namespace blink
diff --git a/Source/core/rendering/compositing/GraphicsLayerUpdater.cpp b/Source/core/rendering/compositing/GraphicsLayerUpdater.cpp
index aa37e4a..709fe4a 100644
--- a/Source/core/rendering/compositing/GraphicsLayerUpdater.cpp
+++ b/Source/core/rendering/compositing/GraphicsLayerUpdater.cpp
@@ -97,12 +97,6 @@
             const RenderLayer* compositingContainer = context.compositingContainer(layer);
             ASSERT(compositingContainer == layer.enclosingLayerWithCompositedLayerMapping(ExcludeSelf));
 
-            if (mapping->updateRequiresOwnBackingStoreForAncestorReasons(compositingContainer)) {
-                TRACE_LAYER_INVALIDATION(&layer, InspectorLayerInvalidationTrackingEvent::AncestorRequiresNewLayer);
-                layersNeedingPaintInvalidation.append(&layer);
-                updateType = ForceUpdate;
-            }
-
             if (mapping->updateGraphicsLayerConfiguration())
                 m_needsRebuildTree = true;
 
diff --git a/Source/core/rendering/compositing/RenderLayerCompositor.cpp b/Source/core/rendering/compositing/RenderLayerCompositor.cpp
index 009eadc..7631e23 100644
--- a/Source/core/rendering/compositing/RenderLayerCompositor.cpp
+++ b/Source/core/rendering/compositing/RenderLayerCompositor.cpp
@@ -459,11 +459,6 @@
         break;
     }
 
-    if (layer->hasCompositedLayerMapping() && layer->compositedLayerMapping()->updateRequiresOwnBackingStoreForIntrinsicReasons()) {
-        compositedLayerMappingChanged = true;
-        layer->compositedLayerMapping()->setNeedsGraphicsLayerUpdate(GraphicsLayerUpdateSubtree);
-    }
-
     if (compositedLayerMappingChanged && layer->renderer()->isRenderPart()) {
         RenderLayerCompositor* innerCompositor = frameContentsCompositor(toRenderPart(layer->renderer()));
         if (innerCompositor && innerCompositor->staleInCompositingMode())
diff --git a/Source/core/rendering/style/BorderData.h b/Source/core/rendering/style/BorderData.h
index 8faa0fe..ad575b5 100644
--- a/Source/core/rendering/style/BorderData.h
+++ b/Source/core/rendering/style/BorderData.h
@@ -107,11 +107,6 @@
             && m_bottomRight == o.m_bottomRight;
     }
 
-    bool visualOverflowEqual(const BorderData& o) const
-    {
-        return m_image.outset() == o.m_image.outset();
-    }
-
     bool operator!=(const BorderData& o) const
     {
         return !(*this == o);
diff --git a/Source/core/rendering/style/RenderStyle.cpp b/Source/core/rendering/style/RenderStyle.cpp
index 568ab19..6508d90 100644
--- a/Source/core/rendering/style/RenderStyle.cpp
+++ b/Source/core/rendering/style/RenderStyle.cpp
@@ -474,6 +474,10 @@
             && *rareNonInheritedData->m_flexibleBox.get() != *other.rareNonInheritedData->m_flexibleBox.get())
             return true;
 
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
+        if (!rareNonInheritedData->shadowDataEquivalent(*other.rareNonInheritedData.get()))
+            return true;
+
         if (!rareNonInheritedData->reflectionDataEquivalent(*other.rareNonInheritedData.get()))
             return true;
 
@@ -589,6 +593,11 @@
     if ((visibility() == COLLAPSE) != (other.visibility() == COLLAPSE))
         return true;
 
+    if (!m_background->outline().visuallyEqual(other.m_background->outline())) {
+        // FIXME: We only really need to recompute the overflow but we don't have an optimized layout for it.
+        return true;
+    }
+
     // Movement of non-static-positioned object is special cased in RenderStyle::visualInvalidationDiff().
 
     return false;
@@ -652,9 +661,6 @@
 
 bool RenderStyle::diffNeedsPaintInvalidationObject(const RenderStyle& other) const
 {
-    if (!m_background->outline().visuallyEqual(other.m_background->outline()))
-        return true;
-
     if (inherited_flags._visibility != other.inherited_flags._visibility
         || inherited_flags.m_printColorAdjust != other.inherited_flags.m_printColorAdjust
         || inherited_flags._insideLink != other.inherited_flags._insideLink
@@ -673,12 +679,14 @@
         if (rareNonInheritedData->userDrag != other.rareNonInheritedData->userDrag
             || rareNonInheritedData->m_objectFit != other.rareNonInheritedData->m_objectFit
             || rareNonInheritedData->m_objectPosition != other.rareNonInheritedData->m_objectPosition
-            || !rareNonInheritedData->shadowDataEquivalent(*other.rareNonInheritedData.get())
             || !rareNonInheritedData->shapeOutsideDataEquivalent(*other.rareNonInheritedData.get())
             || !rareNonInheritedData->clipPathDataEquivalent(*other.rareNonInheritedData.get()))
             return true;
     }
 
+    if (resize() != other.resize())
+        return true;
+
     return false;
 }
 
@@ -697,14 +705,8 @@
 
         if (rareNonInheritedData->m_filter != other.rareNonInheritedData->m_filter)
             diff.setFilterChanged();
-
-        if (!rareNonInheritedData->shadowDataEquivalent(*other.rareNonInheritedData.get()))
-            diff.setVisualOverflowChanged();
     }
 
-    if (!m_background->outline().visuallyEqual(other.m_background->outline()) || !surround->border.visualOverflowEqual(other.surround->border))
-        diff.setVisualOverflowChanged();
-
     if (!diff.needsPaintInvalidation()) {
         if (inherited->color != other.inherited->color
             || inherited_flags.m_textUnderline != other.inherited_flags.m_textUnderline
diff --git a/Source/core/rendering/style/RenderStyle.h b/Source/core/rendering/style/RenderStyle.h
index 5582520..6bc37c4 100644
--- a/Source/core/rendering/style/RenderStyle.h
+++ b/Source/core/rendering/style/RenderStyle.h
@@ -1527,7 +1527,7 @@
     void setHasExplicitlyInheritedProperties() { noninherited_flags.explicitInheritance = true; }
     bool hasExplicitlyInheritedProperties() const { return noninherited_flags.explicitInheritance; }
 
-    bool hasBoxDecorations() const { return hasBorder() || hasBorderRadius() || hasOutline() || hasAppearance() || boxShadow() || hasFilter(); }
+    bool hasBoxDecorations() const { return hasBorder() || hasBorderRadius() || hasOutline() || hasAppearance() || boxShadow() || hasFilter() || resize() != RESIZE_NONE; }
 
     bool borderObscuresBackground() const;
     void getBorderEdgeInfo(BorderEdge edges[], bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true) const;
diff --git a/Source/core/rendering/style/SVGRenderStyle.cpp b/Source/core/rendering/style/SVGRenderStyle.cpp
index d5b92d9..5192620 100644
--- a/Source/core/rendering/style/SVGRenderStyle.cpp
+++ b/Source/core/rendering/style/SVGRenderStyle.cpp
@@ -150,7 +150,7 @@
         return true;
 
     // Text related properties influence layout.
-    if (misc->baselineShiftValue != other->misc->baselineShiftValue)
+    if (*misc->baselineShiftValue != *other->misc->baselineShiftValue)
         return true;
 
     // These properties affect the cached stroke bounding box rects.
@@ -164,13 +164,13 @@
 
     // Some stroke properties, requires relayouts, as the cached stroke boundaries need to be recalculated.
     if (stroke.get() != other->stroke.get()) {
-        if (stroke->width != other->stroke->width
+        if (*stroke->width != *other->stroke->width
             || stroke->paintType != other->stroke->paintType
             || stroke->paintColor != other->stroke->paintColor
             || stroke->paintUri != other->stroke->paintUri
             || stroke->miterLimit != other->stroke->miterLimit
-            || stroke->dashArray != other->stroke->dashArray
-            || stroke->dashOffset != other->stroke->dashOffset
+            || *stroke->dashArray != *other->stroke->dashArray
+            || *stroke->dashOffset != *other->stroke->dashOffset
             || stroke->visitedLinkPaintColor != other->stroke->visitedLinkPaintColor
             || stroke->visitedLinkPaintUri != other->stroke->visitedLinkPaintUri
             || stroke->visitedLinkPaintType != other->stroke->visitedLinkPaintType)
diff --git a/Source/core/rendering/style/SVGRenderStyle.h b/Source/core/rendering/style/SVGRenderStyle.h
index 8e37efe..33ad251 100644
--- a/Source/core/rendering/style/SVGRenderStyle.h
+++ b/Source/core/rendering/style/SVGRenderStyle.h
@@ -187,7 +187,7 @@
 
     void setStrokeDashArray(PassRefPtr<SVGLengthList> obj)
     {
-        if (!(stroke->dashArray == obj))
+        if (*stroke->dashArray != *obj)
             stroke.access()->dashArray = obj;
     }
 
@@ -199,13 +199,13 @@
 
     void setStrokeWidth(PassRefPtr<SVGLength> obj)
     {
-        if (!(stroke->width == obj))
+        if (*stroke->width != *obj)
             stroke.access()->width = obj;
     }
 
     void setStrokeDashOffset(PassRefPtr<SVGLength> obj)
     {
-        if (!(stroke->dashOffset == obj))
+        if (*stroke->dashOffset != *obj)
             stroke.access()->dashOffset = obj;
     }
 
diff --git a/Source/core/rendering/style/StyleDifference.h b/Source/core/rendering/style/StyleDifference.h
index 7af431c..1d3e610 100644
--- a/Source/core/rendering/style/StyleDifference.h
+++ b/Source/core/rendering/style/StyleDifference.h
@@ -18,7 +18,6 @@
         FilterChanged = 1 << 3,
         // The object needs to issue paint invalidations if it contains text or properties dependent on color (e.g., border or outline).
         TextOrColorChanged = 1 << 4,
-        VisualOverflowChanged = 1 << 5
     };
 
     StyleDifference()
@@ -78,8 +77,6 @@
     bool textOrColorChanged() const { return m_propertySpecificDifferences & TextOrColorChanged; }
     void setTextOrColorChanged() { m_propertySpecificDifferences |= TextOrColorChanged; }
 
-    bool visualOverflowChanged() const { return m_propertySpecificDifferences & VisualOverflowChanged; }
-    void setVisualOverflowChanged() { m_propertySpecificDifferences |= VisualOverflowChanged; }
 private:
     enum PaintInvalidationType {
         NoPaintInvalidation = 0,
@@ -95,7 +92,7 @@
     };
     unsigned m_layoutType : 2;
 
-    unsigned m_propertySpecificDifferences : 6;
+    unsigned m_propertySpecificDifferences : 5;
 };
 
 } // namespace blink
diff --git a/Source/core/rendering/svg/RenderSVGImage.cpp b/Source/core/rendering/svg/RenderSVGImage.cpp
index 0dd6aa8..2f7849f 100644
--- a/Source/core/rendering/svg/RenderSVGImage.cpp
+++ b/Source/core/rendering/svg/RenderSVGImage.cpp
@@ -61,58 +61,43 @@
     RenderSVGModelObject::destroy();
 }
 
-bool RenderSVGImage::forceNonUniformScaling(SVGImageElement* image) const
+FloatSize RenderSVGImage::computeImageViewportSize(ImageResource& cachedImage) const
 {
+    if (toSVGImageElement(element())->preserveAspectRatio()->currentValue()->align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
+        return m_objectBoundingBox.size();
+
     // Images with preserveAspectRatio=none should force non-uniform
     // scaling. This can be achieved by setting the image's container size to
-    // its intrinsic size. If the image does not have an intrinsic size - or
-    // the intrinsic size is degenerate - set the container size to the bounds
-    // as in pAR!=none cases.
+    // its viewport size (i.e. if a viewBox is available - use that - else use intrinsic size.)
     // See: http://www.w3.org/TR/SVG/single-page.html, 7.8 The ‘preserveAspectRatio’ attribute.
-    if (image->preserveAspectRatio()->currentValue()->align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
-        return false;
-    ImageResource* cachedImage = m_imageResource->cachedImage();
-    if (!cachedImage)
-        return false;
     Length intrinsicWidth;
     Length intrinsicHeight;
     FloatSize intrinsicRatio;
-    cachedImage->computeIntrinsicDimensions(intrinsicWidth, intrinsicHeight, intrinsicRatio);
-    if (!intrinsicWidth.isFixed() || !intrinsicHeight.isFixed())
-        return false;
-    // If the viewport defined by the referenced image is zero in either
-    // dimension, then SVGImage will have computed an intrinsic size of 300x150.
-    if (!floatValueForLength(intrinsicWidth, 0) || !floatValueForLength(intrinsicHeight, 0))
-        return false;
-    return true;
+    cachedImage.computeIntrinsicDimensions(intrinsicWidth, intrinsicHeight, intrinsicRatio);
+    return intrinsicRatio;
 }
 
 bool RenderSVGImage::updateImageViewport()
 {
     SVGImageElement* image = toSVGImageElement(element());
     FloatRect oldBoundaries = m_objectBoundingBox;
-    bool updatedViewport = false;
 
     SVGLengthContext lengthContext(image);
     m_objectBoundingBox = FloatRect(image->x()->currentValue()->value(lengthContext), image->y()->currentValue()->value(lengthContext), image->width()->currentValue()->value(lengthContext), image->height()->currentValue()->value(lengthContext));
-
     bool boundsChanged = oldBoundaries != m_objectBoundingBox;
 
-    IntSize newViewportSize;
-    if (forceNonUniformScaling(image)) {
-        LayoutSize intrinsicSize = m_imageResource->intrinsicSize(style()->effectiveZoom());
-        if (intrinsicSize != m_imageResource->imageSize(style()->effectiveZoom())) {
-            newViewportSize = roundedIntSize(intrinsicSize);
+    bool updatedViewport = false;
+    ImageResource* cachedImage = m_imageResource->cachedImage();
+    if (cachedImage && cachedImage->usesImageContainerSize()) {
+        FloatSize imageViewportSize = computeImageViewportSize(*cachedImage);
+        if (imageViewportSize != m_imageResource->imageSize(style()->effectiveZoom())) {
+            m_imageResource->setContainerSizeForRenderer(roundedIntSize(imageViewportSize));
             updatedViewport = true;
         }
-    } else if (boundsChanged) {
-        newViewportSize = enclosingIntRect(m_objectBoundingBox).size();
-        updatedViewport = true;
     }
-    if (updatedViewport)
-        m_imageResource->setContainerSizeForRenderer(newViewportSize);
+
     m_needsBoundariesUpdate |= boundsChanged;
-    return updatedViewport;
+    return updatedViewport || boundsChanged;
 }
 
 void RenderSVGImage::layout()
diff --git a/Source/core/rendering/svg/RenderSVGImage.h b/Source/core/rendering/svg/RenderSVGImage.h
index 2ac9b79..b391821 100644
--- a/Source/core/rendering/svg/RenderSVGImage.h
+++ b/Source/core/rendering/svg/RenderSVGImage.h
@@ -63,7 +63,7 @@
     virtual void layout() override;
     virtual void paint(PaintInfo&, const LayoutPoint&) override;
 
-    bool forceNonUniformScaling(SVGImageElement*) const;
+    FloatSize computeImageViewportSize(ImageResource&) const;
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction) override;
 
diff --git a/Source/core/webcore_dom.target.darwin-arm.mk b/Source/core/webcore_dom.target.darwin-arm.mk
index 74a0da1..769a082 100644
--- a/Source/core/webcore_dom.target.darwin-arm.mk
+++ b/Source/core/webcore_dom.target.darwin-arm.mk
@@ -224,7 +224,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -384,7 +384,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.darwin-arm64.mk b/Source/core/webcore_dom.target.darwin-arm64.mk
index 57debe9..52d7e63 100644
--- a/Source/core/webcore_dom.target.darwin-arm64.mk
+++ b/Source/core/webcore_dom.target.darwin-arm64.mk
@@ -223,7 +223,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -371,7 +371,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.darwin-x86.mk b/Source/core/webcore_dom.target.darwin-x86.mk
index 04bdb45..97d2b15 100644
--- a/Source/core/webcore_dom.target.darwin-x86.mk
+++ b/Source/core/webcore_dom.target.darwin-x86.mk
@@ -223,7 +223,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -377,7 +377,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.darwin-x86_64.mk b/Source/core/webcore_dom.target.darwin-x86_64.mk
index 8dbcd0b..0e3a19f 100644
--- a/Source/core/webcore_dom.target.darwin-x86_64.mk
+++ b/Source/core/webcore_dom.target.darwin-x86_64.mk
@@ -224,7 +224,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -377,7 +377,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.linux-arm.mk b/Source/core/webcore_dom.target.linux-arm.mk
index 74a0da1..769a082 100644
--- a/Source/core/webcore_dom.target.linux-arm.mk
+++ b/Source/core/webcore_dom.target.linux-arm.mk
@@ -224,7 +224,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -384,7 +384,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.linux-arm64.mk b/Source/core/webcore_dom.target.linux-arm64.mk
index 57debe9..52d7e63 100644
--- a/Source/core/webcore_dom.target.linux-arm64.mk
+++ b/Source/core/webcore_dom.target.linux-arm64.mk
@@ -223,7 +223,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -371,7 +371,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.linux-x86.mk b/Source/core/webcore_dom.target.linux-x86.mk
index 04bdb45..97d2b15 100644
--- a/Source/core/webcore_dom.target.linux-x86.mk
+++ b/Source/core/webcore_dom.target.linux-x86.mk
@@ -223,7 +223,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -377,7 +377,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_dom.target.linux-x86_64.mk b/Source/core/webcore_dom.target.linux-x86_64.mk
index 8dbcd0b..0e3a19f 100644
--- a/Source/core/webcore_dom.target.linux-x86_64.mk
+++ b/Source/core/webcore_dom.target.linux-x86_64.mk
@@ -224,7 +224,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -377,7 +377,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.darwin-arm.mk b/Source/core/webcore_generated.target.darwin-arm.mk
index d59d37f..a10b35f 100644
--- a/Source/core/webcore_generated.target.darwin-arm.mk
+++ b/Source/core/webcore_generated.target.darwin-arm.mk
@@ -343,7 +343,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -503,7 +503,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.darwin-arm64.mk b/Source/core/webcore_generated.target.darwin-arm64.mk
index 186307d..eedef85 100644
--- a/Source/core/webcore_generated.target.darwin-arm64.mk
+++ b/Source/core/webcore_generated.target.darwin-arm64.mk
@@ -342,7 +342,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -490,7 +490,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.darwin-x86.mk b/Source/core/webcore_generated.target.darwin-x86.mk
index 685760a..59a6f46 100644
--- a/Source/core/webcore_generated.target.darwin-x86.mk
+++ b/Source/core/webcore_generated.target.darwin-x86.mk
@@ -342,7 +342,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -496,7 +496,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.darwin-x86_64.mk b/Source/core/webcore_generated.target.darwin-x86_64.mk
index e71e704..379c631 100644
--- a/Source/core/webcore_generated.target.darwin-x86_64.mk
+++ b/Source/core/webcore_generated.target.darwin-x86_64.mk
@@ -343,7 +343,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -496,7 +496,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.linux-arm.mk b/Source/core/webcore_generated.target.linux-arm.mk
index d59d37f..a10b35f 100644
--- a/Source/core/webcore_generated.target.linux-arm.mk
+++ b/Source/core/webcore_generated.target.linux-arm.mk
@@ -343,7 +343,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -503,7 +503,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.linux-arm64.mk b/Source/core/webcore_generated.target.linux-arm64.mk
index 186307d..eedef85 100644
--- a/Source/core/webcore_generated.target.linux-arm64.mk
+++ b/Source/core/webcore_generated.target.linux-arm64.mk
@@ -342,7 +342,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -490,7 +490,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.linux-x86.mk b/Source/core/webcore_generated.target.linux-x86.mk
index 685760a..59a6f46 100644
--- a/Source/core/webcore_generated.target.linux-x86.mk
+++ b/Source/core/webcore_generated.target.linux-x86.mk
@@ -342,7 +342,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -496,7 +496,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_generated.target.linux-x86_64.mk b/Source/core/webcore_generated.target.linux-x86_64.mk
index e71e704..379c631 100644
--- a/Source/core/webcore_generated.target.linux-x86_64.mk
+++ b/Source/core/webcore_generated.target.linux-x86_64.mk
@@ -343,7 +343,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -496,7 +496,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.darwin-arm.mk b/Source/core/webcore_html.target.darwin-arm.mk
index 3f1d586..ece0704 100644
--- a/Source/core/webcore_html.target.darwin-arm.mk
+++ b/Source/core/webcore_html.target.darwin-arm.mk
@@ -317,7 +317,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -477,7 +477,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.darwin-arm64.mk b/Source/core/webcore_html.target.darwin-arm64.mk
index d6ab754..a4af0ba 100644
--- a/Source/core/webcore_html.target.darwin-arm64.mk
+++ b/Source/core/webcore_html.target.darwin-arm64.mk
@@ -316,7 +316,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -464,7 +464,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.darwin-x86.mk b/Source/core/webcore_html.target.darwin-x86.mk
index 1503853..0bf2af8 100644
--- a/Source/core/webcore_html.target.darwin-x86.mk
+++ b/Source/core/webcore_html.target.darwin-x86.mk
@@ -316,7 +316,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -470,7 +470,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.darwin-x86_64.mk b/Source/core/webcore_html.target.darwin-x86_64.mk
index 4a78396..d8f9d92 100644
--- a/Source/core/webcore_html.target.darwin-x86_64.mk
+++ b/Source/core/webcore_html.target.darwin-x86_64.mk
@@ -317,7 +317,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -470,7 +470,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.linux-arm.mk b/Source/core/webcore_html.target.linux-arm.mk
index 3f1d586..ece0704 100644
--- a/Source/core/webcore_html.target.linux-arm.mk
+++ b/Source/core/webcore_html.target.linux-arm.mk
@@ -317,7 +317,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -477,7 +477,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.linux-arm64.mk b/Source/core/webcore_html.target.linux-arm64.mk
index d6ab754..a4af0ba 100644
--- a/Source/core/webcore_html.target.linux-arm64.mk
+++ b/Source/core/webcore_html.target.linux-arm64.mk
@@ -316,7 +316,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -464,7 +464,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.linux-x86.mk b/Source/core/webcore_html.target.linux-x86.mk
index 1503853..0bf2af8 100644
--- a/Source/core/webcore_html.target.linux-x86.mk
+++ b/Source/core/webcore_html.target.linux-x86.mk
@@ -316,7 +316,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -470,7 +470,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_html.target.linux-x86_64.mk b/Source/core/webcore_html.target.linux-x86_64.mk
index 4a78396..d8f9d92 100644
--- a/Source/core/webcore_html.target.linux-x86_64.mk
+++ b/Source/core/webcore_html.target.linux-x86_64.mk
@@ -317,7 +317,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -470,7 +470,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.darwin-arm.mk b/Source/core/webcore_remaining.target.darwin-arm.mk
index ff0d917..f51c92c 100644
--- a/Source/core/webcore_remaining.target.darwin-arm.mk
+++ b/Source/core/webcore_remaining.target.darwin-arm.mk
@@ -633,7 +633,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -794,7 +794,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.darwin-arm64.mk b/Source/core/webcore_remaining.target.darwin-arm64.mk
index f2efd0b..e555563 100644
--- a/Source/core/webcore_remaining.target.darwin-arm64.mk
+++ b/Source/core/webcore_remaining.target.darwin-arm64.mk
@@ -632,7 +632,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -781,7 +781,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.darwin-x86.mk b/Source/core/webcore_remaining.target.darwin-x86.mk
index 4c49e33..52432d1 100644
--- a/Source/core/webcore_remaining.target.darwin-x86.mk
+++ b/Source/core/webcore_remaining.target.darwin-x86.mk
@@ -632,7 +632,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -787,7 +787,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.darwin-x86_64.mk b/Source/core/webcore_remaining.target.darwin-x86_64.mk
index 716154b..cc83afe 100644
--- a/Source/core/webcore_remaining.target.darwin-x86_64.mk
+++ b/Source/core/webcore_remaining.target.darwin-x86_64.mk
@@ -633,7 +633,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -787,7 +787,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.linux-arm.mk b/Source/core/webcore_remaining.target.linux-arm.mk
index ff0d917..f51c92c 100644
--- a/Source/core/webcore_remaining.target.linux-arm.mk
+++ b/Source/core/webcore_remaining.target.linux-arm.mk
@@ -633,7 +633,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -794,7 +794,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.linux-arm64.mk b/Source/core/webcore_remaining.target.linux-arm64.mk
index f2efd0b..e555563 100644
--- a/Source/core/webcore_remaining.target.linux-arm64.mk
+++ b/Source/core/webcore_remaining.target.linux-arm64.mk
@@ -632,7 +632,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -781,7 +781,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.linux-x86.mk b/Source/core/webcore_remaining.target.linux-x86.mk
index 4c49e33..52432d1 100644
--- a/Source/core/webcore_remaining.target.linux-x86.mk
+++ b/Source/core/webcore_remaining.target.linux-x86.mk
@@ -632,7 +632,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -787,7 +787,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_remaining.target.linux-x86_64.mk b/Source/core/webcore_remaining.target.linux-x86_64.mk
index 716154b..cc83afe 100644
--- a/Source/core/webcore_remaining.target.linux-x86_64.mk
+++ b/Source/core/webcore_remaining.target.linux-x86_64.mk
@@ -633,7 +633,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -787,7 +787,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.darwin-arm.mk b/Source/core/webcore_rendering.target.darwin-arm.mk
index b5e71a6..582b7e0 100644
--- a/Source/core/webcore_rendering.target.darwin-arm.mk
+++ b/Source/core/webcore_rendering.target.darwin-arm.mk
@@ -200,7 +200,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -360,7 +360,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.darwin-arm64.mk b/Source/core/webcore_rendering.target.darwin-arm64.mk
index f5e208e..15201c4 100644
--- a/Source/core/webcore_rendering.target.darwin-arm64.mk
+++ b/Source/core/webcore_rendering.target.darwin-arm64.mk
@@ -199,7 +199,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -347,7 +347,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.darwin-x86.mk b/Source/core/webcore_rendering.target.darwin-x86.mk
index e1d8807..8d66361 100644
--- a/Source/core/webcore_rendering.target.darwin-x86.mk
+++ b/Source/core/webcore_rendering.target.darwin-x86.mk
@@ -199,7 +199,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -353,7 +353,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.darwin-x86_64.mk b/Source/core/webcore_rendering.target.darwin-x86_64.mk
index aa9969c..acd4335 100644
--- a/Source/core/webcore_rendering.target.darwin-x86_64.mk
+++ b/Source/core/webcore_rendering.target.darwin-x86_64.mk
@@ -200,7 +200,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -353,7 +353,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.linux-arm.mk b/Source/core/webcore_rendering.target.linux-arm.mk
index b5e71a6..582b7e0 100644
--- a/Source/core/webcore_rendering.target.linux-arm.mk
+++ b/Source/core/webcore_rendering.target.linux-arm.mk
@@ -200,7 +200,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -360,7 +360,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.linux-arm64.mk b/Source/core/webcore_rendering.target.linux-arm64.mk
index f5e208e..15201c4 100644
--- a/Source/core/webcore_rendering.target.linux-arm64.mk
+++ b/Source/core/webcore_rendering.target.linux-arm64.mk
@@ -199,7 +199,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -347,7 +347,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.linux-x86.mk b/Source/core/webcore_rendering.target.linux-x86.mk
index e1d8807..8d66361 100644
--- a/Source/core/webcore_rendering.target.linux-x86.mk
+++ b/Source/core/webcore_rendering.target.linux-x86.mk
@@ -199,7 +199,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -353,7 +353,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_rendering.target.linux-x86_64.mk b/Source/core/webcore_rendering.target.linux-x86_64.mk
index aa9969c..acd4335 100644
--- a/Source/core/webcore_rendering.target.linux-x86_64.mk
+++ b/Source/core/webcore_rendering.target.linux-x86_64.mk
@@ -200,7 +200,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -353,7 +353,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.darwin-arm.mk b/Source/core/webcore_svg.target.darwin-arm.mk
index abe4dfe..3714018 100644
--- a/Source/core/webcore_svg.target.darwin-arm.mk
+++ b/Source/core/webcore_svg.target.darwin-arm.mk
@@ -239,7 +239,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -399,7 +399,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.darwin-arm64.mk b/Source/core/webcore_svg.target.darwin-arm64.mk
index 6e6b00e..b7819a2 100644
--- a/Source/core/webcore_svg.target.darwin-arm64.mk
+++ b/Source/core/webcore_svg.target.darwin-arm64.mk
@@ -238,7 +238,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -386,7 +386,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.darwin-x86.mk b/Source/core/webcore_svg.target.darwin-x86.mk
index d92cef8..4a859c9 100644
--- a/Source/core/webcore_svg.target.darwin-x86.mk
+++ b/Source/core/webcore_svg.target.darwin-x86.mk
@@ -238,7 +238,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -392,7 +392,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.darwin-x86_64.mk b/Source/core/webcore_svg.target.darwin-x86_64.mk
index 6cf2cb7..ae99e1d 100644
--- a/Source/core/webcore_svg.target.darwin-x86_64.mk
+++ b/Source/core/webcore_svg.target.darwin-x86_64.mk
@@ -239,7 +239,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -392,7 +392,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.linux-arm.mk b/Source/core/webcore_svg.target.linux-arm.mk
index abe4dfe..3714018 100644
--- a/Source/core/webcore_svg.target.linux-arm.mk
+++ b/Source/core/webcore_svg.target.linux-arm.mk
@@ -239,7 +239,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -399,7 +399,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.linux-arm64.mk b/Source/core/webcore_svg.target.linux-arm64.mk
index 6e6b00e..b7819a2 100644
--- a/Source/core/webcore_svg.target.linux-arm64.mk
+++ b/Source/core/webcore_svg.target.linux-arm64.mk
@@ -238,7 +238,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -386,7 +386,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.linux-x86.mk b/Source/core/webcore_svg.target.linux-x86.mk
index d92cef8..4a859c9 100644
--- a/Source/core/webcore_svg.target.linux-x86.mk
+++ b/Source/core/webcore_svg.target.linux-x86.mk
@@ -238,7 +238,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -392,7 +392,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/webcore_svg.target.linux-x86_64.mk b/Source/core/webcore_svg.target.linux-x86_64.mk
index 6cf2cb7..ae99e1d 100644
--- a/Source/core/webcore_svg.target.linux-x86_64.mk
+++ b/Source/core/webcore_svg.target.linux-x86_64.mk
@@ -239,7 +239,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -392,7 +392,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/core/xml/XSLImportRule.cpp b/Source/core/xml/XSLImportRule.cpp
index b391b30..66e6178 100644
--- a/Source/core/xml/XSLImportRule.cpp
+++ b/Source/core/xml/XSLImportRule.cpp
@@ -106,7 +106,7 @@
 
     ASSERT(!m_styleSheet);
     if (SharedBuffer* data = resource->resourceBuffer())
-        setXSLStyleSheet(absHref, parentSheet->baseURL(), UTF8Encoding().decode(data->data(), data->size()));
+        setXSLStyleSheet(absHref, resource->response().url(), UTF8Encoding().decode(data->data(), data->size()));
 }
 
 void XSLImportRule::trace(Visitor* visitor)
diff --git a/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/Source/core/xmlhttprequest/XMLHttpRequest.cpp
index 3494b56..96ea78b 100644
--- a/Source/core/xmlhttprequest/XMLHttpRequest.cpp
+++ b/Source/core/xmlhttprequest/XMLHttpRequest.cpp
@@ -208,6 +208,7 @@
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
     , m_downloadingToFile(false)
+    , m_responseTextOverflow(false)
 {
 #ifndef NDEBUG
     xmlHttpRequestCounter.increment();
@@ -1361,8 +1362,13 @@
         return;
     }
 
-    if (m_decoder)
-        m_responseText = m_responseText.concatenateWith(m_decoder->flush());
+    if (m_decoder) {
+        auto text = m_decoder->flush();
+        if (!text.isEmpty() && !m_responseTextOverflow) {
+            m_responseText = m_responseText.concatenateWith(text);
+            m_responseTextOverflow = m_responseText.isEmpty();
+        }
+    }
 
     if (m_responseLegacyStream)
         m_responseLegacyStream->finalize();
@@ -1538,7 +1544,11 @@
         if (!m_decoder)
             m_decoder = createDecoder();
 
-        m_responseText = m_responseText.concatenateWith(m_decoder->decode(data, len));
+        auto text = m_decoder->decode(data, len);
+        if (!text.isEmpty() && !m_responseTextOverflow) {
+            m_responseText = m_responseText.concatenateWith(text);
+            m_responseTextOverflow = m_responseText.isEmpty();
+        }
     } else if (m_responseTypeCode == ResponseTypeArrayBuffer || m_responseTypeCode == ResponseTypeBlob) {
         // Buffer binary data.
         if (!m_binaryResponseBuilder)
diff --git a/Source/core/xmlhttprequest/XMLHttpRequest.h b/Source/core/xmlhttprequest/XMLHttpRequest.h
index d7151be..e7f726d 100644
--- a/Source/core/xmlhttprequest/XMLHttpRequest.h
+++ b/Source/core/xmlhttprequest/XMLHttpRequest.h
@@ -306,6 +306,7 @@
     // True iff the ongoing resource loading is using the downloadToFile
     // option.
     bool m_downloadingToFile;
+    bool m_responseTextOverflow;
 };
 
 } // namespace blink
diff --git a/Source/devtools/front_end/components/DOMPresentationUtils.js b/Source/devtools/front_end/components/DOMPresentationUtils.js
index dc55a7a..3b19ffd 100644
--- a/Source/devtools/front_end/components/DOMPresentationUtils.js
+++ b/Source/devtools/front_end/components/DOMPresentationUtils.js
@@ -120,7 +120,7 @@
 WebInspector.DOMPresentationUtils.buildImagePreviewContents = function(target, imageURL, showDimensions, userCallback, precomputedDimensions)
 {
     var resource = target.resourceTreeModel.resourceForURL(imageURL);
-    if (!resource) {
+    if (!resource || resource.resourceType() !== WebInspector.resourceTypes.Image) {
         userCallback();
         return;
     }
diff --git a/Source/devtools/front_end/elements/ElementsPanel.js b/Source/devtools/front_end/elements/ElementsPanel.js
index fcebcf1..3f05540 100644
--- a/Source/devtools/front_end/elements/ElementsPanel.js
+++ b/Source/devtools/front_end/elements/ElementsPanel.js
@@ -86,7 +86,7 @@
     WebInspector.settings.splitVerticallyWhenDockedToRight.addChangeListener(this._dockSideChanged.bind(this));
     this._dockSideChanged();
 
-    this._popoverHelper = new WebInspector.PopoverHelper(this.element, this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
+    this._popoverHelper = new WebInspector.PopoverHelper(this._splitView.sidebarElement(), this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
     this._popoverHelper.setTimeout(0);
 
     /** @type {!Array.<!WebInspector.ElementsTreeOutline>} */
@@ -204,7 +204,7 @@
                 else
                     treeOutline.domModel().requestDocument();
         }
-        WebInspector.context.setFlavor(WebInspector.ElementsPanel, this);
+
     },
 
     willHide: function()
@@ -218,7 +218,6 @@
         }
         this._popoverHelper.hidePopover();
         WebInspector.Panel.prototype.willHide.call(this);
-        WebInspector.context.setFlavor(WebInspector.ElementsPanel, null);
     },
 
     onResize: function()
@@ -463,55 +462,7 @@
         if (!anchor || !anchor.href)
             return;
 
-        var treeOutlineElement = anchor.enclosingNodeOrSelfWithClass("elements-tree-outline");
-        if (!treeOutlineElement)
-            return;
-
-        for (var i = 0; i < this._treeOutlines.length; ++i) {
-            if (this._treeOutlines[i].element !== treeOutlineElement)
-                continue;
-
-            var resource = this._treeOutlines[i].target().resourceTreeModel.resourceForURL(anchor.href);
-            if (!resource || resource.resourceType() !== WebInspector.resourceTypes.Image)
-                return;
-            anchor.removeAttribute("title");
-            return anchor;
-        }
-    },
-
-    /**
-     * @param {!WebInspector.DOMNode} node
-     * @param {function()} callback
-     */
-    _loadDimensionsForNode: function(node, callback)
-    {
-        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img") {
-            callback();
-            return;
-        }
-
-        node.resolveToObject("", resolvedNode);
-
-        function resolvedNode(object)
-        {
-            if (!object) {
-                callback();
-                return;
-            }
-
-            object.callFunctionJSON(dimensions, undefined, callback);
-            object.release();
-
-            /**
-             * @return {!{offsetWidth: number, offsetHeight: number, naturalWidth: number, naturalHeight: number}}
-             * @suppressReceiverCheck
-             * @this {!Element}
-             */
-            function dimensions()
-            {
-                return { offsetWidth: this.offsetWidth, offsetHeight: this.offsetHeight, naturalWidth: this.naturalWidth, naturalHeight: this.naturalHeight };
-            }
-        }
+        return anchor;
     },
 
     /**
@@ -520,17 +471,9 @@
      */
     _showPopover: function(anchor, popover)
     {
-        var listItem = anchor.enclosingNodeOrSelfWithNodeName("li");
-        // We get here for CSS properties, too.
-        if (listItem && listItem.treeElement && listItem.treeElement instanceof WebInspector.ElementsTreeElement) {
-            var elementsTreeElement = /** @type {!WebInspector.ElementsTreeElement} */ (listItem.treeElement);
-            var node = elementsTreeElement.node();
-            this._loadDimensionsForNode(node, WebInspector.DOMPresentationUtils.buildImagePreviewContents.bind(WebInspector.DOMPresentationUtils, node.target(), anchor.href, true, showPopover));
-        } else {
-            var node = this.selectedDOMNode();
-            if (node)
-                WebInspector.DOMPresentationUtils.buildImagePreviewContents(node.target(), anchor.href, true, showPopover);
-        }
+        var node = this.selectedDOMNode();
+        if (node)
+            WebInspector.DOMPresentationUtils.buildImagePreviewContents(node.target(), anchor.href, true, showPopover);
 
         /**
          * @param {!Element=} contents
@@ -690,31 +633,45 @@
         this.sidebarPanes.platformFonts.setNode(selectedDOMNode);
     },
 
-    _undo: function()
-    {
-        var treeOutline = this._treeOutlineForNode(this._lastValidSelectedNode);
-        if (!treeOutline || WebInspector.isEditing())
-            return;
-        treeOutline.target().domModel.undo(this._updateSidebars.bind(this));
-    },
-
-    _redo: function()
-    {
-        var treeOutline = this._treeOutlineForNode(this._lastValidSelectedNode);
-        if (!treeOutline || WebInspector.isEditing())
-            return;
-        treeOutline.target().domModel.redo(this._updateSidebars.bind(this));
-    },
-
     /**
      * @param {!KeyboardEvent} event
      */
     handleShortcut: function(event)
     {
-        var treeOutline = this._treeOutlineForNode(this._lastValidSelectedNode);
+        /**
+         * @param {!WebInspector.ElementsTreeOutline} treeOutline
+         * @this {WebInspector.ElementsPanel}
+         */
+        function handleUndoRedo(treeOutline)
+        {
+            if (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) && !event.shiftKey && event.keyIdentifier === "U+005A") { // Z key
+                treeOutline.target().domModel.undo(this._updateSidebars.bind(this));
+                event.handled = true;
+                return;
+            }
+
+            var isRedoKey = WebInspector.isMac() ? event.metaKey && event.shiftKey && event.keyIdentifier === "U+005A" : // Z key
+                                                   event.ctrlKey && event.keyIdentifier === "U+0059"; // Y key
+            if (isRedoKey) {
+                treeOutline.target().domModel.redo(this._updateSidebars.bind(this));
+                event.handled = true;
+            }
+        }
+
+        var treeOutline = null;
+        for (var i = 0; i < this._treeOutlines.length; ++i) {
+            if (this._treeOutlines[i].selectedDOMNode() === this._lastValidSelectedNode)
+                treeOutline = this._treeOutlines[i];
+        }
         if (!treeOutline)
             return;
 
+        if (!treeOutline.editing()) {
+            handleUndoRedo.call(this, treeOutline);
+            if (event.handled)
+                return;
+        }
+
         treeOutline.handleShortcut(event);
         if (event.handled)
             return;
@@ -1098,44 +1055,3 @@
         return WebInspector.ElementsPanel.instance();
     }
 }
-
-/**
- * @constructor
- * @implements {WebInspector.ActionDelegate}
- */
-WebInspector.ElementsPanel.UndoActionDelegate = function()
-{
-}
-
-WebInspector.ElementsPanel.UndoActionDelegate.prototype = {
-    /**
-     * @return {boolean}
-     */
-    handleAction: function()
-    {
-        var panel = WebInspector.ElementsPanel.instance();
-        panel._undo();
-        return true;
-    }
-}
-
-/**
- * @constructor
- * @implements {WebInspector.ActionDelegate}
- */
-WebInspector.ElementsPanel.RedoActionDelegate = function()
-{
-}
-
-WebInspector.ElementsPanel.RedoActionDelegate.prototype = {
-    /**
-     * @return {boolean}
-     */
-    handleAction: function()
-    {
-        var panel = WebInspector.ElementsPanel.instance();
-        panel._redo();
-        return true;
-    }
-}
-
diff --git a/Source/devtools/front_end/elements/ElementsTreeOutline.js b/Source/devtools/front_end/elements/ElementsTreeOutline.js
index a2839ea..b88807c 100644
--- a/Source/devtools/front_end/elements/ElementsTreeOutline.js
+++ b/Source/devtools/front_end/elements/ElementsTreeOutline.js
@@ -76,6 +76,9 @@
 
     this._setPseudoClassCallback = setPseudoClassCallback;
     this._createNodeDecorators();
+
+    this._popoverHelper = new WebInspector.PopoverHelper(this._element, this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
+    this._popoverHelper.setTimeout(0);
 }
 
 /** @typedef {{node: !WebInspector.DOMNode, isCut: boolean}} */
@@ -348,8 +351,10 @@
     setVisible: function(visible)
     {
         this._visible = visible;
-        if (!this._visible)
+        if (!this._visible) {
+            this._popoverHelper.hidePopover();
             return;
+        }
 
         this._updateModifiedNodes();
         if (this._selectedDOMNode)
@@ -588,6 +593,77 @@
         return element;
     },
 
+    /**
+     * @param {!Element} element
+     * @param {!Event} event
+     * @return {!Element|!AnchorBox|undefined}
+     */
+    _getPopoverAnchor: function(element, event)
+    {
+        var anchor = element.enclosingNodeOrSelfWithClass("webkit-html-resource-link");
+        if (!anchor || !anchor.href)
+            return;
+
+        return anchor;
+    },
+
+    /**
+     * @param {!WebInspector.DOMNode} node
+     * @param {function()} callback
+     */
+    _loadDimensionsForNode: function(node, callback)
+    {
+        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img") {
+            callback();
+            return;
+        }
+
+        node.resolveToObject("", resolvedNode);
+
+        function resolvedNode(object)
+        {
+            if (!object) {
+                callback();
+                return;
+            }
+
+            object.callFunctionJSON(dimensions, undefined, callback);
+            object.release();
+
+            /**
+             * @return {!{offsetWidth: number, offsetHeight: number, naturalWidth: number, naturalHeight: number}}
+             * @suppressReceiverCheck
+             * @this {!Element}
+             */
+            function dimensions()
+            {
+                return { offsetWidth: this.offsetWidth, offsetHeight: this.offsetHeight, naturalWidth: this.naturalWidth, naturalHeight: this.naturalHeight };
+            }
+        }
+    },
+
+    /**
+     * @param {!Element} anchor
+     * @param {!WebInspector.Popover} popover
+     */
+    _showPopover: function(anchor, popover)
+    {
+        var listItem = anchor.enclosingNodeOrSelfWithNodeName("li");
+        var node = /** @type {!WebInspector.ElementsTreeElement} */ (listItem.treeElement).node();
+        this._loadDimensionsForNode(node, WebInspector.DOMPresentationUtils.buildImagePreviewContents.bind(WebInspector.DOMPresentationUtils, node.target(), anchor.href, true, showPopover));
+
+        /**
+         * @param {!Element=} contents
+         */
+        function showPopover(contents)
+        {
+            if (!contents)
+                return;
+            popover.setCanShrink(false);
+            popover.show(contents, anchor);
+        }
+    },
+
     _onmousedown: function(event)
     {
         var element = this._treeElementFromEvent(event);
diff --git a/Source/devtools/front_end/elements/elementsPanel.css b/Source/devtools/front_end/elements/elementsPanel.css
index 0df58c9..88f27b8 100644
--- a/Source/devtools/front_end/elements/elementsPanel.css
+++ b/Source/devtools/front_end/elements/elementsPanel.css
@@ -34,6 +34,11 @@
     transform: translateZ(0);
 }
 
+#elements-content:not(.elements-wrap) > div {
+    display: inline-block;
+    min-width: 100%;
+}
+
 #elements-content.elements-wrap {
     overflow-x: hidden;
 }
diff --git a/Source/devtools/front_end/elements/elementsTreeOutline.css b/Source/devtools/front_end/elements/elementsTreeOutline.css
index e517ab8..799d027 100644
--- a/Source/devtools/front_end/elements/elementsTreeOutline.css
+++ b/Source/devtools/front_end/elements/elementsTreeOutline.css
@@ -100,6 +100,7 @@
     min-width: 100%;
     min-height: 100%;
     -webkit-transform: translateZ(0);
+    padding-left: 2px;
 }
 
 .outline-disclosure ol:focus li.selected {
@@ -271,3 +272,8 @@
 .outline-disclosure .nowrap li {
     word-wrap: normal;
 }
+
+.outline-disclosure.single-node li {
+    padding-left: 2px;
+}
+
diff --git a/Source/devtools/front_end/elements/module.json b/Source/devtools/front_end/elements/module.json
index 235b1e4..683a317 100644
--- a/Source/devtools/front_end/elements/module.json
+++ b/Source/devtools/front_end/elements/module.json
@@ -13,38 +13,6 @@
             "className": "WebInspector.ElementsPanel.ContextMenuProvider"
         },
         {
-            "type": "@WebInspector.ActionDelegate",
-            "actionId": "elements.undo",
-            "className": "WebInspector.ElementsPanel.UndoActionDelegate",
-            "contextTypes": ["WebInspector.ElementsPanel"],
-            "bindings": [
-                {
-                    "platform": "windows,linux",
-                    "shortcut": "Ctrl+Z"
-                },
-                {
-                    "platform": "mac",
-                    "shortcut": "Meta+Z"
-                }
-            ]
-        },
-        {
-            "type": "@WebInspector.ActionDelegate",
-            "actionId": "elements.redo",
-            "className": "WebInspector.ElementsPanel.RedoActionDelegate",
-            "contextTypes": ["WebInspector.ElementsPanel"],
-            "bindings": [
-                {
-                    "platform": "windows,linux",
-                    "shortcut": "Ctrl+Y"
-                },
-                {
-                    "platform": "mac",
-                    "shortcut": "Meta+Shift+Z"
-                }
-            ]
-        },
-        {
             "type": "@WebInspector.Renderer",
             "contextTypes": ["WebInspector.DOMNode", "WebInspector.RemoteObject"],
             "className": "WebInspector.ElementsTreeOutline.Renderer"
diff --git a/Source/devtools/front_end/inspectorStyle.css b/Source/devtools/front_end/inspectorStyle.css
index 40c897d..570396c 100644
--- a/Source/devtools/front_end/inspectorStyle.css
+++ b/Source/devtools/front_end/inspectorStyle.css
@@ -1095,33 +1095,6 @@
     color: rgb(60%, 60%, 60%);
 }
 
-.console-group-messages .outline-disclosure {
-    padding-left: 0;
-}
-
-.console-group-messages .outline-disclosure > ol {
-    padding: 0 0 0 12px !important;
-}
-
-.console-group-messages .outline-disclosure,
-.console-group-messages .outline-disclosure ol {
-    font-size: inherit;
-    line-height: 12px;
-}
-
-.console-group-messages .outline-disclosure.single-node li {
-    padding-left: 2px;
-}
-
-.console-group-messages .outline-disclosure li .selection {
-    margin-left: -6px;
-    margin-right: -6px;
-}
-
-.console-group-messages .add-attribute {
-    display: none;
-}
-
 .console-formatted-object,
 .console-formatted-map,
 .console-formatted-set,
diff --git a/Source/devtools/front_end/platform/DOMExtension.js b/Source/devtools/front_end/platform/DOMExtension.js
index d16df07..a38a92e 100644
--- a/Source/devtools/front_end/platform/DOMExtension.js
+++ b/Source/devtools/front_end/platform/DOMExtension.js
@@ -275,6 +275,14 @@
 }
 
 /**
+ * @return {!Window}
+ */
+Node.prototype.window = function()
+{
+    return this.ownerDocument.defaultView;
+}
+
+/**
  * @param {string} query
  * @return {?Node}
  */
diff --git a/Source/devtools/front_end/profiler/ProfilesPanel.js b/Source/devtools/front_end/profiler/ProfilesPanel.js
index 3e0ab77..bd7085e 100644
--- a/Source/devtools/front_end/profiler/ProfilesPanel.js
+++ b/Source/devtools/front_end/profiler/ProfilesPanel.js
@@ -449,7 +449,6 @@
     mainView.show(this.mainElement());
 
     this.profilesItemTreeElement = new WebInspector.ProfilesSidebarTreeElement(this);
-    this.sidebarTree.setFocusable(false);
     this.sidebarTree.appendChild(this.profilesItemTreeElement);
 
     this.profileViews = createElement("div");
diff --git a/Source/devtools/front_end/sources/WorkspaceMappingTip.js b/Source/devtools/front_end/sources/WorkspaceMappingTip.js
index f41f6f5..35abf89 100644
--- a/Source/devtools/front_end/sources/WorkspaceMappingTip.js
+++ b/Source/devtools/front_end/sources/WorkspaceMappingTip.js
@@ -105,7 +105,7 @@
      */
     _showWorkspaceInfobar: function(uiSourceCode)
     {
-        var infobar = new WebInspector.UISourceCodeFrame.Infobar(WebInspector.UISourceCodeFrame.Infobar.Level.Info, WebInspector.UIString("Serving from the file system? Add your files into the workspace."));
+        var infobar = new WebInspector.UISourceCodeFrame.Infobar(WebInspector.UISourceCodeFrame.Infobar.Level.Info, WebInspector.UIString("Serving from the file system? Add your files into the workspace."), this._onWorkspaceInfobarDispose.bind(this));
         infobar.createDetailsRowMessage(WebInspector.UIString("If you add files into your DevTools workspace, your changes will be persisted to disk."));
         infobar.createDetailsRowMessage(WebInspector.UIString("To add a folder into the workspace, drag and drop it into the Sources panel."));
         this._appendInfobar(uiSourceCode, infobar);
diff --git a/Source/devtools/front_end/splitView.css b/Source/devtools/front_end/splitView.css
index 9680cf9..058a0c8 100644
--- a/Source/devtools/front_end/splitView.css
+++ b/Source/devtools/front_end/splitView.css
@@ -62,6 +62,14 @@
     z-index: 500;
 }
 
+.split-view.hbox.split-view-first-is-sidebar {
+    flex-direction: row-reverse !important;
+}
+
+.split-view.vbox.split-view-first-is-sidebar {
+    flex-direction: column-reverse !important;
+}
+
 .split-view-resizer-border {
     pointer-events: none;
 }
diff --git a/Source/devtools/front_end/timeline/TracingTimelineUIUtils.js b/Source/devtools/front_end/timeline/TracingTimelineUIUtils.js
index 32736d3..1f50233 100644
--- a/Source/devtools/front_end/timeline/TracingTimelineUIUtils.js
+++ b/Source/devtools/front_end/timeline/TracingTimelineUIUtils.js
@@ -169,7 +169,7 @@
      */
     hiddenEmptyRecordsFilter: function()
     {
-        var hiddenEmptyRecords = [WebInspector.TimelineModel.RecordType.EventDispatch];
+        var hiddenEmptyRecords = [WebInspector.TimelineModel.RecordType.EventDispatch, WebInspector.TimelineModel.RecordType.UpdateCounters];
         return new WebInspector.TimelineRecordHiddenEmptyTypeFilter(hiddenEmptyRecords);
     },
 
@@ -247,6 +247,7 @@
     eventStyles[recordTypes.EmbedderCallback] = new WebInspector.TimelineRecordStyle(WebInspector.UIString("Embedder Callback"), categories["scripting"]);
     eventStyles[recordTypes.DecodeImage] = new WebInspector.TimelineRecordStyle(WebInspector.UIString("Image Decode"), categories["painting"]);
     eventStyles[recordTypes.ResizeImage] = new WebInspector.TimelineRecordStyle(WebInspector.UIString("Image Resize"), categories["painting"]);
+    eventStyles[recordTypes.UpdateCounters] = new WebInspector.TimelineRecordStyle(WebInspector.UIString("UpdateCounters"), categories["other"]);
     WebInspector.TracingTimelineUIUtils._eventStylesMap = eventStyles;
     return eventStyles;
 }
diff --git a/Source/devtools/front_end/toolbox/InspectedPagePlaceholder.js b/Source/devtools/front_end/toolbox/InspectedPagePlaceholder.js
index 47b4a52..d007e33 100644
--- a/Source/devtools/front_end/toolbox/InspectedPagePlaceholder.js
+++ b/Source/devtools/front_end/toolbox/InspectedPagePlaceholder.js
@@ -58,8 +58,8 @@
     _scheduleUpdate: function()
     {
         if (this._updateId)
-            window.cancelAnimationFrame(this._updateId);
-        this._updateId = window.requestAnimationFrame(this.update.bind(this));
+            this.element.window().cancelAnimationFrame(this._updateId);
+        this._updateId = this.element.window().requestAnimationFrame(this.update.bind(this));
     },
 
     /**
diff --git a/Source/devtools/front_end/ui/SplitView.js b/Source/devtools/front_end/ui/SplitView.js
index 543991d..41cc1de 100644
--- a/Source/devtools/front_end/ui/SplitView.js
+++ b/Source/devtools/front_end/ui/SplitView.js
@@ -52,13 +52,8 @@
 
     this._resizerElement = this.element.createChild("div", "split-view-resizer");
     this._resizerElement.createChild("div", "split-view-resizer-border");
-    if (secondIsSidebar) {
-        this._mainView.show(this.element);
-        this._sidebarView.show(this.element);
-    } else {
-        this._sidebarView.show(this.element);
-        this._mainView.show(this.element);
-    }
+    this._mainView.show(this.element);
+    this._sidebarView.show(this.element);
 
     this._resizerWidget = new WebInspector.ResizerWidget();
     this._resizerWidget.setEnabled(true);
@@ -202,16 +197,7 @@
         this._mainElement.classList.toggle("split-view-contents-second", !secondIsSidebar);
         this._sidebarElement.classList.toggle("split-view-contents-first", !secondIsSidebar);
         this._sidebarElement.classList.toggle("split-view-contents-second", secondIsSidebar);
-
-        // Make sure second is last in the children array.
-        if (secondIsSidebar) {
-            if (this._sidebarElement.parentElement && this._sidebarElement.nextSibling)
-                this.element.appendChild(this._sidebarElement);
-        } else {
-            if (this._mainElement.parentElement && this._mainElement.nextSibling)
-                this.element.appendChild(this._mainElement);
-        }
-
+        this.element.classList.toggle("split-view-first-is-sidebar", !secondIsSidebar);
         this._secondIsSidebar = secondIsSidebar;
     },
 
@@ -284,7 +270,11 @@
          */
         function callback()
         {
-            sideToShow.show(this.element);
+            // Make sure main is first in the children list.
+            if (sideToShow === this._mainView)
+                this._mainView.show(this.element, this._sidebarView.element);
+            else
+                this._sidebarView.show(this.element);
             sideToHide.detach();
             sideToShow.element.classList.add("maximized");
             sideToHide.element.classList.remove("maximized");
@@ -336,7 +326,8 @@
         this._sidebarElement.classList.remove("maximized");
         this._resizerElement.classList.remove("hidden");
 
-        this._mainView.show(this.element);
+        // Make sure main is the first in the children list.
+        this._mainView.show(this.element, this._sidebarView.element);
         this._sidebarView.show(this.element);
         // Order views in DOM properly.
         this.setSecondIsSidebar(this._secondIsSidebar);
diff --git a/Source/devtools/front_end/ui/View.js b/Source/devtools/front_end/ui/View.js
index 611e1ae..1606d72 100644
--- a/Source/devtools/front_end/ui/View.js
+++ b/Source/devtools/front_end/ui/View.js
@@ -106,6 +106,20 @@
         return this._isShowing;
     },
 
+    /**
+     * @return {boolean}
+     */
+    _shouldHideOnDetach: function()
+    {
+        if (this._hideOnDetach)
+            return true;
+        for (var child of this._children) {
+            if (child._shouldHideOnDetach())
+                return true;
+        }
+        return false;
+    },
+
     setHideOnDetach: function()
     {
         this._hideOnDetach = true;
@@ -272,7 +286,7 @@
         if (this._parentIsShowing())
             this._processWillHide();
 
-        if (this._hideOnDetach && !overrideHideOnDetach) {
+        if (!overrideHideOnDetach && this._shouldHideOnDetach()) {
             this.element.classList.remove("visible");
             this._visible = false;
             if (this._parentIsShowing())
diff --git a/Source/modules/indexeddb/IDBCursor.cpp b/Source/modules/indexeddb/IDBCursor.cpp
index 9414b92..9aa7c34 100644
--- a/Source/modules/indexeddb/IDBCursor.cpp
+++ b/Source/modules/indexeddb/IDBCursor.cpp
@@ -38,7 +38,6 @@
 #include "modules/indexeddb/IDBTracing.h"
 #include "modules/indexeddb/IDBTransaction.h"
 #include "modules/indexeddb/WebIDBCallbacksImpl.h"
-#include "public/platform/WebBlobInfo.h"
 #include "public/platform/WebIDBDatabase.h"
 #include "public/platform/WebIDBKeyRange.h"
 #include <limits>
@@ -72,12 +71,6 @@
 
 IDBCursor::~IDBCursor()
 {
-    ASSERT(!m_blobInfo || m_blobInfo->size() == 0);
-}
-
-void IDBCursor::dispose()
-{
-    handleBlobAcks();
 }
 
 void IDBCursor::trace(Visitor* visitor)
@@ -274,7 +267,7 @@
 
 void IDBCursor::close()
 {
-    handleBlobAcks();
+    m_blobs.clear();
     m_request.clear();
     m_backend.clear();
 }
@@ -299,17 +292,16 @@
     const IDBObjectStoreMetadata& metadata = objectStore->metadata();
     IDBAny* value;
     if (metadata.autoIncrement && !metadata.keyPath.isNull()) {
-        value = IDBAny::create(m_value, m_blobInfo.get(), m_primaryKey, metadata.keyPath);
+        value = IDBAny::create(m_value, m_blobs->getInfo(), m_primaryKey, metadata.keyPath);
 #if ENABLE(ASSERT)
-        assertPrimaryKeyValidOrInjectable(scriptState, m_value, m_blobInfo.get(), m_primaryKey, metadata.keyPath);
+        assertPrimaryKeyValidOrInjectable(scriptState, m_value, m_blobs->getInfo(), m_primaryKey, metadata.keyPath);
 #endif
     } else {
-        value = IDBAny::create(m_value, m_blobInfo.get());
+        value = IDBAny::create(m_value, m_blobs->getInfo());
     }
 
     m_valueDirty = false;
     ScriptValue scriptValue = idbAnyToScriptValue(scriptState, value);
-    handleBlobAcks();
     return scriptValue;
 }
 
@@ -318,7 +310,7 @@
     return idbAnyToScriptValue(scriptState, m_source);
 }
 
-void IDBCursor::setValueReady(IDBKey* key, IDBKey* primaryKey, PassRefPtr<SharedBuffer> value, PassOwnPtr<Vector<WebBlobInfo> > blobInfo)
+void IDBCursor::setValueReady(IDBKey* key, IDBKey* primaryKey, PassRefPtr<SharedBuffer> value, PassOwnPtr<IDBRequest::IDBBlobHolder> blobs)
 {
     m_key = key;
     m_keyDirty = true;
@@ -328,11 +320,8 @@
 
     if (isCursorWithValue()) {
         m_value = value;
-        handleBlobAcks();
-        m_blobInfo = blobInfo;
+        m_blobs = blobs;
         m_valueDirty = true;
-        if (m_blobInfo && m_blobInfo->size() > 0)
-            ThreadState::current()->registerPreFinalizer(*this);
     }
 
     m_gotValue = true;
@@ -352,17 +341,6 @@
     return m_source->idbIndex()->isDeleted();
 }
 
-void IDBCursor::handleBlobAcks()
-{
-    ASSERT(m_request || !m_blobInfo || !m_blobInfo->size());
-    if (m_blobInfo.get() && m_blobInfo->size()) {
-        ASSERT(m_request);
-        m_transaction->db()->ackReceivedBlobs(m_blobInfo.get());
-        m_blobInfo.clear();
-        ThreadState::current()->unregisterPreFinalizer(*this);
-    }
-}
-
 WebIDBCursorDirection IDBCursor::stringToDirection(const String& directionString, ExceptionState& exceptionState)
 {
     if (directionString == IndexedDBNames::next)
diff --git a/Source/modules/indexeddb/IDBCursor.h b/Source/modules/indexeddb/IDBCursor.h
index b44a442..ac7ad65 100644
--- a/Source/modules/indexeddb/IDBCursor.h
+++ b/Source/modules/indexeddb/IDBCursor.h
@@ -43,11 +43,9 @@
 class IDBTransaction;
 class ScriptState;
 class SharedBuffer;
-class WebBlobInfo;
 
 class IDBCursor : public GarbageCollectedFinalized<IDBCursor>, public ScriptWrappable {
     DEFINE_WRAPPERTYPEINFO();
-    USING_PRE_FINALIZER(IDBCursor, dispose);
 public:
     static WebIDBCursorDirection stringToDirection(const String& modeString, ExceptionState&);
 
@@ -77,7 +75,7 @@
     void postSuccessHandlerCallback();
     bool isDeleted() const;
     void close();
-    void setValueReady(IDBKey*, IDBKey* primaryKey, PassRefPtr<SharedBuffer> value, PassOwnPtr<Vector<WebBlobInfo> >);
+    void setValueReady(IDBKey*, IDBKey* primaryKey, PassRefPtr<SharedBuffer> value, PassOwnPtr<IDBRequest::IDBBlobHolder>);
     IDBKey* idbPrimaryKey() const { return m_primaryKey; }
     IDBRequest* request() const { return m_request.get(); }
     virtual bool isKeyCursor() const { return true; }
@@ -87,9 +85,7 @@
     IDBCursor(PassOwnPtr<WebIDBCursor>, WebIDBCursorDirection, IDBRequest*, IDBAny* source, IDBTransaction*);
 
 private:
-    void dispose();
     IDBObjectStore* effectiveObjectStore() const;
-    void handleBlobAcks();
 
     OwnPtr<WebIDBCursor> m_backend;
     Member<IDBRequest> m_request;
@@ -103,7 +99,7 @@
     Member<IDBKey> m_key;
     Member<IDBKey> m_primaryKey;
     RefPtr<SharedBuffer> m_value;
-    OwnPtr<Vector<WebBlobInfo> > m_blobInfo;
+    OwnPtr<IDBRequest::IDBBlobHolder> m_blobs;
 };
 
 } // namespace blink
diff --git a/Source/modules/indexeddb/IDBDatabase.cpp b/Source/modules/indexeddb/IDBDatabase.cpp
index a02f9c5..4e39cb4 100644
--- a/Source/modules/indexeddb/IDBDatabase.cpp
+++ b/Source/modules/indexeddb/IDBDatabase.cpp
@@ -110,16 +110,10 @@
     return atomicIncrement(&currentTransactionId);
 }
 
-void IDBDatabase::ackReceivedBlobs(const Vector<WebBlobInfo>* blobInfo)
+void IDBDatabase::ackReceivedBlobs(const Vector<String>& uuids)
 {
-    ASSERT(blobInfo);
-    if (!blobInfo->size() || !m_backend)
+    if (!m_backend)
         return;
-    Vector<WebBlobInfo>::const_iterator iter;
-    Vector<String> uuids;
-    uuids.reserveCapacity(blobInfo->size());
-    for (iter = blobInfo->begin(); iter != blobInfo->end(); ++iter)
-        uuids.append(iter->uuid());
     m_backend->ackReceivedBlobs(uuids);
 }
 
diff --git a/Source/modules/indexeddb/IDBDatabase.h b/Source/modules/indexeddb/IDBDatabase.h
index fdce7a2..185a101 100644
--- a/Source/modules/indexeddb/IDBDatabase.h
+++ b/Source/modules/indexeddb/IDBDatabase.h
@@ -118,7 +118,8 @@
 
     static int64_t nextTransactionId();
 
-    void ackReceivedBlobs(const Vector<WebBlobInfo>*);
+    // Acknowledge receipt of the blobs (referenced by their UUID's).
+    void ackReceivedBlobs(const Vector<String>& uuids);
 
     static const char indexDeletedErrorMessage[];
     static const char isKeyCursorErrorMessage[];
diff --git a/Source/modules/indexeddb/IDBRequest.cpp b/Source/modules/indexeddb/IDBRequest.cpp
index 36f55b0..742c8f0 100644
--- a/Source/modules/indexeddb/IDBRequest.cpp
+++ b/Source/modules/indexeddb/IDBRequest.cpp
@@ -77,12 +77,6 @@
 IDBRequest::~IDBRequest()
 {
     ASSERT(m_readyState == DONE || m_readyState == EarlyDeath || !executionContext());
-    ASSERT(!m_blobInfo || m_blobInfo->size() == 0);
-}
-
-void IDBRequest::dispose()
-{
-    handleBlobAcks();
 }
 
 void IDBRequest::trace(Visitor* visitor)
@@ -110,7 +104,6 @@
         return ScriptValue();
     m_resultDirty = false;
     ScriptValue value = idbAnyToScriptValue(m_scriptState.get(), m_result);
-    handleBlobAcks();
     return value;
 }
 
@@ -211,19 +204,7 @@
 
 void IDBRequest::setBlobInfo(PassOwnPtr<Vector<WebBlobInfo>> blobInfo)
 {
-    ASSERT(!m_blobInfo);
-    m_blobInfo = blobInfo;
-    if (m_blobInfo && m_blobInfo->size() > 0)
-        ThreadState::current()->registerPreFinalizer(*this);
-}
-
-void IDBRequest::handleBlobAcks()
-{
-    if (m_blobInfo.get() && m_blobInfo->size()) {
-        m_transaction->db()->ackReceivedBlobs(m_blobInfo.get());
-        m_blobInfo.clear();
-        ThreadState::current()->unregisterPreFinalizer(*this);
-    }
+    m_blobs = adoptPtr(new IDBBlobHolder(blobInfo));
 }
 
 bool IDBRequest::shouldEnqueueEvent() const
@@ -310,7 +291,7 @@
     }
 
     setBlobInfo(blobInfo);
-    onSuccessInternal(IDBAny::create(valueBuffer, m_blobInfo.get()));
+    onSuccessInternal(IDBAny::create(valueBuffer, m_blobs->getInfo()));
 }
 
 #if ENABLE(ASSERT)
@@ -339,10 +320,10 @@
     setBlobInfo(blobInfo);
 
 #if ENABLE(ASSERT)
-    assertPrimaryKeyValidOrInjectable(m_scriptState.get(), valueBuffer, m_blobInfo.get(), primaryKey, keyPath);
+    assertPrimaryKeyValidOrInjectable(m_scriptState.get(), valueBuffer, m_blobs->getInfo(), primaryKey, keyPath);
 #endif
 
-    onSuccessInternal(IDBAny::create(valueBuffer, m_blobInfo.get(), primaryKey, keyPath));
+    onSuccessInternal(IDBAny::create(valueBuffer, m_blobs->getInfo(), primaryKey, keyPath));
 }
 
 void IDBRequest::onSuccess(int64_t value)
@@ -458,11 +439,8 @@
     IDBCursor* cursorToNotify = 0;
     if (event->type() == EventTypeNames::success) {
         cursorToNotify = getResultCursor();
-        if (cursorToNotify) {
-            if (m_blobInfo && m_blobInfo->size() > 0)
-                ThreadState::current()->unregisterPreFinalizer(*this);
-            cursorToNotify->setValueReady(m_cursorKey.release(), m_cursorPrimaryKey.release(), m_cursorValue.release(), m_blobInfo.release());
-        }
+        if (cursorToNotify)
+            cursorToNotify->setValueReady(m_cursorKey.release(), m_cursorPrimaryKey.release(), m_cursorValue.release(), m_blobs.release());
     }
 
     if (event->type() == EventTypeNames::upgradeneeded) {
@@ -556,4 +534,23 @@
     }
 }
 
+IDBRequest::IDBBlobHolder::IDBBlobHolder(PassOwnPtr<Vector<WebBlobInfo>> blobInfo)
+    : m_blobInfo(blobInfo)
+{
+    if (!m_blobInfo->isEmpty()) {
+        m_blobData = adoptPtr(new Vector<RefPtr<BlobDataHandle>>());
+        for (const auto& info : *m_blobInfo.get())
+            m_blobData->append(BlobDataHandle::create(info.uuid(), info.type(), info.size()));
+    }
+}
+
+Vector<String> IDBRequest::IDBBlobHolder::getUUIDs() const
+{
+    Vector<String> uuids;
+    uuids.reserveCapacity(m_blobInfo->size());
+    for (const auto& info : *m_blobInfo)
+        uuids.append(info.uuid());
+    return uuids;
+}
+
 } // namespace blink
diff --git a/Source/modules/indexeddb/IDBRequest.h b/Source/modules/indexeddb/IDBRequest.h
index 81afa0d..a59c61d 100644
--- a/Source/modules/indexeddb/IDBRequest.h
+++ b/Source/modules/indexeddb/IDBRequest.h
@@ -40,6 +40,7 @@
 #include "modules/indexeddb/IDBAny.h"
 #include "modules/indexeddb/IDBTransaction.h"
 #include "modules/indexeddb/IndexedDB.h"
+#include "platform/blob/BlobData.h"
 #include "platform/heap/Handle.h"
 #include "public/platform/WebBlobInfo.h"
 #include "public/platform/WebIDBCursor.h"
@@ -58,7 +59,7 @@
     , public ActiveDOMObject {
     DEFINE_EVENT_TARGET_REFCOUNTING_WILL_BE_REMOVED(RefCountedGarbageCollected<IDBRequest>);
     DEFINE_WRAPPERTYPEINFO();
-    USING_PRE_FINALIZER(IDBRequest, dispose);
+    WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(IDBRequest);
     WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(IDBRequest);
 public:
     static IDBRequest* create(ScriptState*, IDBAny* source, IDBTransaction*);
@@ -85,6 +86,20 @@
         EarlyDeath = 3
     };
 
+    class IDBBlobHolder {
+        WTF_MAKE_NONCOPYABLE(IDBBlobHolder);
+    public:
+        explicit IDBBlobHolder(PassOwnPtr<Vector<WebBlobInfo>>);
+        virtual ~IDBBlobHolder() { }
+
+        const Vector<WebBlobInfo>* getInfo() const { return m_blobInfo.get(); }
+        Vector<String> getUUIDs() const;
+
+    private:
+        OwnPtr<Vector<WebBlobInfo>> m_blobInfo;
+        OwnPtr<Vector<RefPtr<BlobDataHandle>>> m_blobData;
+    };
+
     const String& readyState() const;
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(success);
@@ -142,10 +157,8 @@
     bool m_requestAborted; // May be aborted by transaction then receive async onsuccess; ignore vs. assert.
 
 private:
-    void dispose();
     void setResultCursor(IDBCursor*, IDBKey*, IDBKey* primaryKey, PassRefPtr<SharedBuffer> value, PassOwnPtr<Vector<WebBlobInfo> >);
     void setBlobInfo(PassOwnPtr<Vector<WebBlobInfo>>);
-    void handleBlobAcks();
 
     RefPtr<ScriptState> m_scriptState;
     Member<IDBAny> m_source;
@@ -164,7 +177,7 @@
     Member<IDBKey> m_cursorKey;
     Member<IDBKey> m_cursorPrimaryKey;
     RefPtr<SharedBuffer> m_cursorValue;
-    OwnPtr<Vector<WebBlobInfo> > m_blobInfo;
+    OwnPtr<IDBBlobHolder> m_blobs;
 
     bool m_didFireUpgradeNeededEvent;
     bool m_preventPropagation;
diff --git a/Source/modules/mediastream/MediaStream.cpp b/Source/modules/mediastream/MediaStream.cpp
index 0d1a4f1..046c118 100644
--- a/Source/modules/mediastream/MediaStream.cpp
+++ b/Source/modules/mediastream/MediaStream.cpp
@@ -260,9 +260,9 @@
     if (ended())
         return;
 
-    MediaStreamCenter::instance().didStopLocalMediaStream(descriptor());
-
     streamEnded();
+
+    MediaStreamCenter::instance().didStopLocalMediaStream(descriptor());
 }
 
 void MediaStream::trackEnded()
diff --git a/Source/modules/modules.target.darwin-arm.mk b/Source/modules/modules.target.darwin-arm.mk
index 74c0356..c0a2676 100644
--- a/Source/modules/modules.target.darwin-arm.mk
+++ b/Source/modules/modules.target.darwin-arm.mk
@@ -484,7 +484,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -639,7 +639,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.darwin-arm64.mk b/Source/modules/modules.target.darwin-arm64.mk
index dd8af71..7b84a3d 100644
--- a/Source/modules/modules.target.darwin-arm64.mk
+++ b/Source/modules/modules.target.darwin-arm64.mk
@@ -483,7 +483,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -626,7 +626,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.darwin-x86.mk b/Source/modules/modules.target.darwin-x86.mk
index a6b9d8a..2ae2373 100644
--- a/Source/modules/modules.target.darwin-x86.mk
+++ b/Source/modules/modules.target.darwin-x86.mk
@@ -483,7 +483,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -632,7 +632,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.darwin-x86_64.mk b/Source/modules/modules.target.darwin-x86_64.mk
index 9f63d99..029a2c0 100644
--- a/Source/modules/modules.target.darwin-x86_64.mk
+++ b/Source/modules/modules.target.darwin-x86_64.mk
@@ -484,7 +484,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -632,7 +632,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.linux-arm.mk b/Source/modules/modules.target.linux-arm.mk
index 74c0356..c0a2676 100644
--- a/Source/modules/modules.target.linux-arm.mk
+++ b/Source/modules/modules.target.linux-arm.mk
@@ -484,7 +484,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -639,7 +639,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.linux-arm64.mk b/Source/modules/modules.target.linux-arm64.mk
index dd8af71..7b84a3d 100644
--- a/Source/modules/modules.target.linux-arm64.mk
+++ b/Source/modules/modules.target.linux-arm64.mk
@@ -483,7 +483,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -626,7 +626,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.linux-x86.mk b/Source/modules/modules.target.linux-x86.mk
index a6b9d8a..2ae2373 100644
--- a/Source/modules/modules.target.linux-x86.mk
+++ b/Source/modules/modules.target.linux-x86.mk
@@ -483,7 +483,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -632,7 +632,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/modules.target.linux-x86_64.mk b/Source/modules/modules.target.linux-x86_64.mk
index 9f63d99..029a2c0 100644
--- a/Source/modules/modules.target.linux-x86_64.mk
+++ b/Source/modules/modules.target.linux-x86_64.mk
@@ -484,7 +484,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -632,7 +632,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/modules/serviceworkers/Body.h b/Source/modules/serviceworkers/Body.h
index 6aa5d1c..d5b03b5 100644
--- a/Source/modules/serviceworkers/Body.h
+++ b/Source/modules/serviceworkers/Body.h
@@ -43,6 +43,9 @@
     ScriptPromise json(ScriptState*);
     ScriptPromise text(ScriptState*);
 
+    // Sets the bodyUsed flag to true. This signifies that the contents of the
+    // body have been consumed and cannot be accessed again.
+    void setBodyUsed();
     bool bodyUsed() const;
 
     // ActiveDOMObject override.
@@ -55,10 +58,6 @@
     // Copy constructor for clone() implementations
     explicit Body(const Body&);
 
-    // Sets the bodyUsed flag to true. This signifies that the contents of the
-    // body have been consumed and cannot be accessed again.
-    void setBodyUsed();
-
 private:
     ScriptPromise readAsync(ScriptState*, ResponseType);
     void resolveJSON();
diff --git a/Source/modules/serviceworkers/Cache.cpp b/Source/modules/serviceworkers/Cache.cpp
index a0c1a73..9f63334 100644
--- a/Source/modules/serviceworkers/Cache.cpp
+++ b/Source/modules/serviceworkers/Cache.cpp
@@ -315,13 +315,22 @@
     return promise;
 }
 
-ScriptPromise Cache::putImpl(ScriptState* scriptState, const Request* request, Response* response)
+ScriptPromise Cache::putImpl(ScriptState* scriptState, Request* request, Response* response)
 {
     KURL url(KURL(), request->url());
     if (!url.protocolIsInHTTPFamily())
         return ScriptPromise::reject(scriptState, V8ThrowException::createTypeError(scriptState->isolate(), "Request scheme '" + url.protocol() + "' is unsupported"));
     if (request->method() != "GET")
         return ScriptPromise::reject(scriptState, V8ThrowException::createTypeError(scriptState->isolate(), "Request method '" + request->method() + "' is unsupported"));
+    if (request->hasBody() && request->bodyUsed())
+        return ScriptPromise::reject(scriptState, V8ThrowException::createTypeError(scriptState->isolate(), "Request body is already used"));
+    if (response->hasBody() && response->bodyUsed())
+        return ScriptPromise::reject(scriptState, V8ThrowException::createTypeError(scriptState->isolate(), "Response body is already used"));
+
+    if (request->hasBody())
+        request->setBodyUsed();
+    if (response->hasBody())
+        response->setBodyUsed();
 
     WebVector<WebServiceWorkerCache::BatchOperation> batchOperations(size_t(1));
     batchOperations[0].operationType = WebServiceWorkerCache::OperationTypePut;
diff --git a/Source/modules/serviceworkers/Cache.h b/Source/modules/serviceworkers/Cache.h
index 444bbd1..0962771 100644
--- a/Source/modules/serviceworkers/Cache.h
+++ b/Source/modules/serviceworkers/Cache.h
@@ -58,7 +58,7 @@
     ScriptPromise addImpl(ScriptState*, const Request*);
     ScriptPromise addAllImpl(ScriptState*, const Vector<const Request*>);
     ScriptPromise deleteImpl(ScriptState*, const Request*, const CacheQueryOptions&);
-    ScriptPromise putImpl(ScriptState*, const Request*, Response*);
+    ScriptPromise putImpl(ScriptState*, Request*, Response*);
     ScriptPromise keysImpl(ScriptState*);
     ScriptPromise keysImpl(ScriptState*, const Request*, const CacheQueryOptions&);
 
diff --git a/Source/modules/serviceworkers/CacheTest.cpp b/Source/modules/serviceworkers/CacheTest.cpp
index 0520a4e..87fad73 100644
--- a/Source/modules/serviceworkers/CacheTest.cpp
+++ b/Source/modules/serviceworkers/CacheTest.cpp
@@ -398,7 +398,7 @@
 
     request = newRequestFromUrl(url);
     ASSERT(request);
-    ScriptPromise putResult = cache->put(scriptState(), request, response);
+    ScriptPromise putResult = cache->put(scriptState(), request, response->clone());
     EXPECT_EQ("dispatchBatch", testCache->getAndClearLastErrorWebCacheMethodCalled());
     EXPECT_EQ(kNotImplementedString, getRejectString(putResult));
 
diff --git a/Source/modules/serviceworkers/Request.h b/Source/modules/serviceworkers/Request.h
index 04283ba..9448ffc 100644
--- a/Source/modules/serviceworkers/Request.h
+++ b/Source/modules/serviceworkers/Request.h
@@ -49,6 +49,7 @@
     void populateWebServiceWorkerRequest(WebServiceWorkerRequest&) const;
 
     void setBodyBlobHandle(PassRefPtr<BlobDataHandle>);
+    bool hasBody() const { return m_request->blobDataHandle(); }
 
     virtual void trace(Visitor*)  override;
 
diff --git a/Source/modules/serviceworkers/Response.h b/Source/modules/serviceworkers/Response.h
index 65d89ba..5ef005e 100644
--- a/Source/modules/serviceworkers/Response.h
+++ b/Source/modules/serviceworkers/Response.h
@@ -49,6 +49,8 @@
 
     void populateWebServiceWorkerResponse(WebServiceWorkerResponse&);
 
+    bool hasBody() const { return m_response->blobDataHandle(); }
+
     virtual void trace(Visitor*) override;
 
 private:
diff --git a/Source/modules/serviceworkers/ServiceWorkerClient.h b/Source/modules/serviceworkers/ServiceWorkerClient.h
index f8eaa71..938fa4c 100644
--- a/Source/modules/serviceworkers/ServiceWorkerClient.h
+++ b/Source/modules/serviceworkers/ServiceWorkerClient.h
@@ -18,7 +18,6 @@
     static ServiceWorkerClient* create(unsigned id);
 
     // ServiceWorkerClient.idl
-    unsigned id() const { return m_id; }
     void postMessage(ExecutionContext*, PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, ExceptionState&);
 
     void trace(Visitor*) { }
diff --git a/Source/modules/serviceworkers/ServiceWorkerClient.idl b/Source/modules/serviceworkers/ServiceWorkerClient.idl
index db7d411..fe6a0e7 100644
--- a/Source/modules/serviceworkers/ServiceWorkerClient.idl
+++ b/Source/modules/serviceworkers/ServiceWorkerClient.idl
@@ -9,7 +9,5 @@
     GarbageCollected,
     TypeChecking=Interface,
 ] interface ServiceWorkerClient {
-    readonly attribute unsigned long id;
-
     [Custom, RaisesException, CallWith=ExecutionContext] void postMessage(SerializedScriptValue message, optional sequence<Transferable> transfer);
 };
diff --git a/Source/modules/serviceworkers/ServiceWorkerContainer.cpp b/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
index 8263534..83b6909 100644
--- a/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
+++ b/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
@@ -121,6 +121,12 @@
         return promise;
     }
 
+    KURL pageURL = KURL(KURL(), documentOrigin->toString());
+    if (!pageURL.protocolIsInHTTPFamily()) {
+        resolver->reject(DOMException::create(SecurityError, "The URL protocol of the current origin is not supported: " + pageURL.protocol()));
+        return promise;
+    }
+
     KURL patternURL = executionContext->completeURL(options.scope());
     patternURL.removeFragmentIdentifier();
     if (!documentOrigin->canRequest(patternURL)) {
@@ -135,11 +141,6 @@
         return promise;
     }
 
-    if (!patternURL.string().startsWith(scriptURL.baseAsString())) {
-        resolver->reject(DOMException::create(SecurityError, "The scope must be under the directory of the script URL."));
-        return promise;
-    }
-
     m_provider->registerServiceWorker(patternURL, scriptURL, new CallbackPromiseAdapter<ServiceWorkerRegistration, ServiceWorkerError>(resolver));
 
     return promise;
@@ -174,6 +175,12 @@
         return promise;
     }
 
+    KURL pageURL = KURL(KURL(), documentOrigin->toString());
+    if (!pageURL.protocolIsInHTTPFamily()) {
+        resolver->reject(DOMException::create(SecurityError, "The URL protocol of the current origin is not supported: " + pageURL.protocol()));
+        return promise;
+    }
+
     KURL completedURL = executionContext->completeURL(documentURL);
     completedURL.removeFragmentIdentifier();
     if (!documentOrigin->canRequest(completedURL)) {
diff --git a/Source/modules/serviceworkers/ServiceWorkerContainerTest.cpp b/Source/modules/serviceworkers/ServiceWorkerContainerTest.cpp
index bf4ac0e..90e63eb 100644
--- a/Source/modules/serviceworkers/ServiceWorkerContainerTest.cpp
+++ b/Source/modules/serviceworkers/ServiceWorkerContainerTest.cpp
@@ -228,15 +228,6 @@
         ExpectDOMException("SecurityError", "The scope must match the current origin."));
 }
 
-TEST_F(ServiceWorkerContainerTest, Register_DifferentDirectoryThanScript)
-{
-    setPageURL("https://www.example.com/");
-    testRegisterRejected(
-        "https://www.example.com/js/worker.js",
-        "https://www.example.com/",
-        ExpectDOMException("SecurityError", "The scope must be under the directory of the script URL."));
-}
-
 TEST_F(ServiceWorkerContainerTest, GetRegistration_NonSecureOriginIsRejected)
 {
     setPageURL("http://www.example.com/");
diff --git a/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp b/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp
index b0de045..a65ff09 100644
--- a/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp
+++ b/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp
@@ -89,6 +89,8 @@
 
 String ServiceWorkerGlobalScope::scope(ExecutionContext* context)
 {
+    // FIXME: Remove scope from ServiceWorkerGlobalScope.
+    context->addConsoleMessage(ConsoleMessage::create(JSMessageSource, WarningMessageLevel, "ServiceWorkerGlobalScope.scope is deprecated. It will be replaced by ServiceWorkerGlobalScope.registration.scope. https://crbug.com/443881"));
     return ServiceWorkerGlobalScopeClient::from(context)->scope().string();
 }
 
diff --git a/Source/modules/webaudio/AudioBufferSourceNode.cpp b/Source/modules/webaudio/AudioBufferSourceNode.cpp
index 05738f9..3c57b56 100644
--- a/Source/modules/webaudio/AudioBufferSourceNode.cpp
+++ b/Source/modules/webaudio/AudioBufferSourceNode.cpp
@@ -233,7 +233,7 @@
     // If we're looping and the offset (virtualReadIndex) is past the end of the loop, wrap back to
     // the beginning of the loop. For other cases, nothing needs to be done.
     if (loop() && m_virtualReadIndex >= virtualEndFrame)
-        m_virtualReadIndex = m_loopStart * buffer()->sampleRate();
+        m_virtualReadIndex = (m_loopStart < 0) ? 0 : (m_loopStart * buffer()->sampleRate());
 
     double pitchRate = totalPitchRate();
 
@@ -250,6 +250,10 @@
     const float** sourceChannels = m_sourceChannels.get();
     float** destinationChannels = m_destinationChannels.get();
 
+    ASSERT(virtualReadIndex >= 0);
+    ASSERT(virtualDeltaFrames >= 0);
+    ASSERT(virtualEndFrame >= 0);
+
     // Optimize for the very common case of playing back with pitchRate == 1.
     // We can avoid the linear interpolation.
     if (pitchRate == 1 && virtualReadIndex == floor(virtualReadIndex)
diff --git a/Source/modules/webaudio/AudioContext.cpp b/Source/modules/webaudio/AudioContext.cpp
index c1d4588..878b124 100644
--- a/Source/modules/webaudio/AudioContext.cpp
+++ b/Source/modules/webaudio/AudioContext.cpp
@@ -101,10 +101,11 @@
     , m_destinationNode(nullptr)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
+    , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
     , m_isOfflineContext(false)
 {
-    m_referencedNodes = new HeapVector<Member<AudioNode>>();
+    m_didInitializeContextGraphMutex = true;
     m_destinationNode = DefaultAudioDestinationNode::create(this);
 
     initialize();
@@ -122,10 +123,11 @@
     , m_destinationNode(nullptr)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
+    , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
     , m_isOfflineContext(true)
 {
-    m_referencedNodes = new HeapVector<Member<AudioNode>>();
+    m_didInitializeContextGraphMutex = true;
     // Create a new destination for offline rendering.
     m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
     if (m_renderTarget.get())
@@ -141,6 +143,7 @@
 #endif
     // AudioNodes keep a reference to their context, so there should be no way to be in the destructor if there are still AudioNodes around.
     ASSERT(!m_isInitialized);
+    ASSERT(!m_referencedNodes.size());
     ASSERT(!m_finishedNodes.size());
     ASSERT(!m_automaticPullNodes.size());
     if (m_automaticPullNodesNeedUpdating)
@@ -530,6 +533,11 @@
     return PeriodicWave::create(sampleRate(), real->view(), imag->view());
 }
 
+void AudioContext::notifyNodeStartedProcessing(AudioNode* node)
+{
+    refNode(node);
+}
+
 void AudioContext::notifyNodeFinishedProcessing(AudioNode* node)
 {
     ASSERT(isAudioThread());
@@ -551,7 +559,7 @@
     ASSERT(isMainThread());
     AutoLocker locker(this);
 
-    m_referencedNodes->append(node);
+    m_referencedNodes.append(node);
     node->makeConnection();
 }
 
@@ -559,10 +567,10 @@
 {
     ASSERT(isGraphOwner());
 
-    for (unsigned i = 0; i < m_referencedNodes->size(); ++i) {
-        if (node == m_referencedNodes->at(i).get()) {
+    for (unsigned i = 0; i < m_referencedNodes.size(); ++i) {
+        if (node == m_referencedNodes.at(i).get()) {
             node->breakConnection();
-            m_referencedNodes->remove(i);
+            m_referencedNodes.remove(i);
             break;
         }
     }
@@ -571,10 +579,10 @@
 void AudioContext::derefUnfinishedSourceNodes()
 {
     ASSERT(isMainThread());
-    for (unsigned i = 0; i < m_referencedNodes->size(); ++i)
-        m_referencedNodes->at(i)->breakConnection();
+    for (unsigned i = 0; i < m_referencedNodes.size(); ++i)
+        m_referencedNodes.at(i)->breakConnection();
 
-    m_referencedNodes->clear();
+    m_referencedNodes.clear();
 }
 
 void AudioContext::lock()
@@ -841,12 +849,12 @@
     visitor->trace(m_destinationNode);
     visitor->trace(m_listener);
     // trace() can be called in AudioContext constructor, and
-    // m_contextGraphMutex might be unavailable.  We can use m_contextGraphMutex
-    // if m_referencedNodes is not null because m_referencedNodes is initialized
-    // after m_contextGraphMutex.
-    if (m_referencedNodes) {
+    // m_contextGraphMutex might be unavailable.
+    if (m_didInitializeContextGraphMutex) {
         AutoLocker lock(this);
         visitor->trace(m_referencedNodes);
+    } else {
+        visitor->trace(m_referencedNodes);
     }
     visitor->trace(m_liveNodes);
     visitor->trace(m_liveAudioSummingJunctions);
diff --git a/Source/modules/webaudio/AudioContext.h b/Source/modules/webaudio/AudioContext.h
index c8cba0b..8243f05 100644
--- a/Source/modules/webaudio/AudioContext.h
+++ b/Source/modules/webaudio/AudioContext.h
@@ -129,7 +129,11 @@
     OscillatorNode* createOscillator();
     PeriodicWave* createPeriodicWave(DOMFloat32Array* real, DOMFloat32Array* imag, ExceptionState&);
 
-    // When a source node has no more processing to do (has finished playing), then it tells the context to dereference it.
+    // When a source node has started processing and needs to be protected,
+    // this method tells the context to protect the node.
+    void notifyNodeStartedProcessing(AudioNode*);
+    // When a source node has no more processing to do (has finished playing),
+    // this method tells the context to dereference the node.
     void notifyNodeFinishedProcessing(AudioNode*);
 
     // Called at the start of each render quantum.
@@ -273,7 +277,7 @@
     // Oilpan: This Vector holds connection references. We must call
     // AudioNode::makeConnection when we add an AudioNode to this, and must call
     // AudioNode::breakConnection() when we remove an AudioNode from this.
-    Member<HeapVector<Member<AudioNode>>> m_referencedNodes;
+    HeapVector<Member<AudioNode>> m_referencedNodes;
 
     class AudioNodeDisposer {
     public:
@@ -326,6 +330,7 @@
     unsigned m_connectionCount;
 
     // Graph locking.
+    bool m_didInitializeContextGraphMutex;
     RecursiveMutex m_contextGraphMutex;
     volatile ThreadIdentifier m_audioThread;
 
diff --git a/Source/modules/webaudio/AudioSummingJunction.cpp b/Source/modules/webaudio/AudioSummingJunction.cpp
index 551b90f..76a24a3 100644
--- a/Source/modules/webaudio/AudioSummingJunction.cpp
+++ b/Source/modules/webaudio/AudioSummingJunction.cpp
@@ -56,6 +56,11 @@
 void AudioSummingJunction::trace(Visitor* visitor)
 {
     visitor->trace(m_context);
+    // FIXME: Oilpan: m_renderingOutputs should not be strong references.  This
+    // is a short-term workaround to avoid crashes, and causes AudioNode leaks.
+    AudioContext::AutoLocker locker(m_context);
+    for (size_t i = 0; i < m_renderingOutputs.size(); ++i)
+        visitor->trace(m_renderingOutputs[i]);
 }
 
 void AudioSummingJunction::changedOutputs()
diff --git a/Source/modules/webaudio/OfflineAudioDestinationNode.cpp b/Source/modules/webaudio/OfflineAudioDestinationNode.cpp
index 11da979..66b60a9 100644
--- a/Source/modules/webaudio/OfflineAudioDestinationNode.cpp
+++ b/Source/modules/webaudio/OfflineAudioDestinationNode.cpp
@@ -81,12 +81,13 @@
 void OfflineAudioDestinationNode::startRendering()
 {
     ASSERT(isMainThread());
-    ASSERT(m_renderTarget.get());
-    if (!m_renderTarget.get())
+    ASSERT(m_renderTarget);
+    if (!m_renderTarget)
         return;
 
     if (!m_startedRendering) {
         m_startedRendering = true;
+        context()->notifyNodeStartedProcessing(this);
         m_renderThread = adoptPtr(blink::Platform::current()->createThread("Offline Audio Renderer"));
         m_renderThread->postTask(new Task(bind(&OfflineAudioDestinationNode::offlineRender, this)));
     }
@@ -94,9 +95,16 @@
 
 void OfflineAudioDestinationNode::offlineRender()
 {
+    offlineRenderInternal();
+    context()->notifyNodeFinishedProcessing(this);
+    context()->handlePostRenderTasks();
+}
+
+void OfflineAudioDestinationNode::offlineRenderInternal()
+{
     ASSERT(!isMainThread());
-    ASSERT(m_renderBus.get());
-    if (!m_renderBus.get())
+    ASSERT(m_renderBus);
+    if (!m_renderBus)
         return;
 
     bool isAudioContextInitialized = context()->isInitialized();
diff --git a/Source/modules/webaudio/OfflineAudioDestinationNode.h b/Source/modules/webaudio/OfflineAudioDestinationNode.h
index 05dba11..6e267f2 100644
--- a/Source/modules/webaudio/OfflineAudioDestinationNode.h
+++ b/Source/modules/webaudio/OfflineAudioDestinationNode.h
@@ -60,6 +60,12 @@
 private:
     OfflineAudioDestinationNode(AudioContext*, AudioBuffer* renderTarget);
 
+    void offlineRender();
+    void offlineRenderInternal();
+
+    // For completion callback on main thread.
+    void notifyComplete();
+
     // This AudioNode renders into this AudioBuffer.
     Member<AudioBuffer> m_renderTarget;
     // Temporary AudioBus for each render quantum.
@@ -68,10 +74,6 @@
     // Rendering thread.
     OwnPtr<WebThread> m_renderThread;
     bool m_startedRendering;
-    void offlineRender();
-
-    // For completion callback on main thread.
-    void notifyComplete();
 };
 
 } // namespace blink
diff --git a/Source/modules/websockets/DOMWebSocket.cpp b/Source/modules/websockets/DOMWebSocket.cpp
index 4ac9187..fa21826 100644
--- a/Source/modules/websockets/DOMWebSocket.cpp
+++ b/Source/modules/websockets/DOMWebSocket.cpp
@@ -304,12 +304,7 @@
     }
 
     // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved.
-    bool shouldBypassMainWorldCSP = false;
-    if (executionContext()->isDocument()) {
-        Document* document = toDocument(executionContext());
-        shouldBypassMainWorldCSP = document->frame()->script().shouldBypassMainWorldCSP();
-    }
-    if (!shouldBypassMainWorldCSP && !executionContext()->contentSecurityPolicy()->allowConnectToSource(m_url)) {
+    if (!ContentSecurityPolicy::shouldBypassMainWorld(executionContext()) && !executionContext()->contentSecurityPolicy()->allowConnectToSource(m_url)) {
         m_state = CLOSED;
         // The URL is safe to expose to JavaScript, as this check happens synchronously before redirection.
         exceptionState.throwSecurityError("Refused to connect to '" + m_url.elidedString() + "' because it violates the document's Content Security Policy.");
diff --git a/Source/platform/audio/HRTFDatabaseLoader.cpp b/Source/platform/audio/HRTFDatabaseLoader.cpp
index 4731ec4..79f1fc2 100644
--- a/Source/platform/audio/HRTFDatabaseLoader.cpp
+++ b/Source/platform/audio/HRTFDatabaseLoader.cpp
@@ -71,20 +71,23 @@
 HRTFDatabaseLoader::~HRTFDatabaseLoader()
 {
     ASSERT(isMainThread());
-
-    MutexLocker locker(m_lock);
     waitForLoaderThreadCompletion();
-    m_hrtfDatabase.clear();
 }
 
 void HRTFDatabaseLoader::load()
 {
     ASSERT(!isMainThread());
-    MutexLocker locker(m_lock);
-    if (!m_hrtfDatabase) {
-        // Load the default HRTF database.
-        m_hrtfDatabase = HRTFDatabase::create(m_databaseSampleRate);
+    m_thread->attachGC();
+
+    {
+        MutexLocker locker(m_lock);
+        if (!m_hrtfDatabase) {
+            // Load the default HRTF database.
+            m_hrtfDatabase = HRTFDatabase::create(m_databaseSampleRate);
+        }
     }
+
+    m_thread->detachGC();
 }
 
 void HRTFDatabaseLoader::loadAsynchronously()
@@ -92,10 +95,10 @@
     ASSERT(isMainThread());
 
     MutexLocker locker(m_lock);
-    if (!m_hrtfDatabase && !m_databaseLoaderThread) {
+    if (!m_hrtfDatabase && !m_thread) {
         // Start the asynchronous database loading process.
-        m_databaseLoaderThread = adoptPtr(Platform::current()->createThread("HRTF database loader"));
-        m_databaseLoaderThread->postTask(new Task(WTF::bind(&HRTFDatabaseLoader::load, this)));
+        m_thread = WebThreadSupportingGC::create("HRTF database loader");
+        m_thread->postTask(new Task(WTF::bind(&HRTFDatabaseLoader::load, this)));
     }
 }
 
@@ -107,7 +110,7 @@
 
 void HRTFDatabaseLoader::waitForLoaderThreadCompletion()
 {
-    m_databaseLoaderThread.clear();
+    m_thread.clear();
 }
 
 } // namespace blink
diff --git a/Source/platform/audio/HRTFDatabaseLoader.h b/Source/platform/audio/HRTFDatabaseLoader.h
index 27d0017..74408b2 100644
--- a/Source/platform/audio/HRTFDatabaseLoader.h
+++ b/Source/platform/audio/HRTFDatabaseLoader.h
@@ -29,9 +29,9 @@
 #ifndef HRTFDatabaseLoader_h
 #define HRTFDatabaseLoader_h
 
+#include "platform/WebThreadSupportingGC.h"
 #include "platform/audio/HRTFDatabase.h"
 #include "platform/heap/Handle.h"
-#include "public/platform/WebThread.h"
 #include "wtf/HashMap.h"
 #include "wtf/ThreadingPrimitives.h"
 
@@ -77,7 +77,7 @@
     Mutex m_lock;
     OwnPtr<HRTFDatabase> m_hrtfDatabase;
 
-    OwnPtr<WebThread> m_databaseLoaderThread;
+    OwnPtr<WebThreadSupportingGC> m_thread;
 
     float m_databaseSampleRate;
 };
diff --git a/Source/platform/blink_common.target.darwin-arm.mk b/Source/platform/blink_common.target.darwin-arm.mk
index 7217338..3df7f79 100644
--- a/Source/platform/blink_common.target.darwin-arm.mk
+++ b/Source/platform/blink_common.target.darwin-arm.mk
@@ -35,7 +35,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -173,7 +173,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.darwin-arm64.mk b/Source/platform/blink_common.target.darwin-arm64.mk
index d45e2b8..b576261 100644
--- a/Source/platform/blink_common.target.darwin-arm64.mk
+++ b/Source/platform/blink_common.target.darwin-arm64.mk
@@ -34,7 +34,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -160,7 +160,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.darwin-x86.mk b/Source/platform/blink_common.target.darwin-x86.mk
index 541bb25..df2a6f8 100644
--- a/Source/platform/blink_common.target.darwin-x86.mk
+++ b/Source/platform/blink_common.target.darwin-x86.mk
@@ -34,7 +34,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -166,7 +166,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.darwin-x86_64.mk b/Source/platform/blink_common.target.darwin-x86_64.mk
index 197b884..888b582 100644
--- a/Source/platform/blink_common.target.darwin-x86_64.mk
+++ b/Source/platform/blink_common.target.darwin-x86_64.mk
@@ -35,7 +35,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -166,7 +166,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.linux-arm.mk b/Source/platform/blink_common.target.linux-arm.mk
index 7217338..3df7f79 100644
--- a/Source/platform/blink_common.target.linux-arm.mk
+++ b/Source/platform/blink_common.target.linux-arm.mk
@@ -35,7 +35,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -173,7 +173,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.linux-arm64.mk b/Source/platform/blink_common.target.linux-arm64.mk
index d45e2b8..b576261 100644
--- a/Source/platform/blink_common.target.linux-arm64.mk
+++ b/Source/platform/blink_common.target.linux-arm64.mk
@@ -34,7 +34,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -160,7 +160,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.linux-x86.mk b/Source/platform/blink_common.target.linux-x86.mk
index 541bb25..df2a6f8 100644
--- a/Source/platform/blink_common.target.linux-x86.mk
+++ b/Source/platform/blink_common.target.linux-x86.mk
@@ -34,7 +34,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -166,7 +166,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_common.target.linux-x86_64.mk b/Source/platform/blink_common.target.linux-x86_64.mk
index 197b884..888b582 100644
--- a/Source/platform/blink_common.target.linux-x86_64.mk
+++ b/Source/platform/blink_common.target.linux-x86_64.mk
@@ -35,7 +35,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -166,7 +166,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_heap_asm_stubs.target.darwin-arm.mk b/Source/platform/blink_heap_asm_stubs.target.darwin-arm.mk
index a360378..6cbe44e 100644
--- a/Source/platform/blink_heap_asm_stubs.target.darwin-arm.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.darwin-arm.mk
@@ -31,7 +31,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -131,7 +130,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.darwin-arm64.mk b/Source/platform/blink_heap_asm_stubs.target.darwin-arm64.mk
index 0ea4814..fb8e477 100644
--- a/Source/platform/blink_heap_asm_stubs.target.darwin-arm64.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.darwin-arm64.mk
@@ -30,7 +30,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -118,7 +117,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.darwin-x86.mk b/Source/platform/blink_heap_asm_stubs.target.darwin-x86.mk
index af9a6c5..b226586 100644
--- a/Source/platform/blink_heap_asm_stubs.target.darwin-x86.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.darwin-x86.mk
@@ -44,7 +44,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -138,7 +137,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.darwin-x86_64.mk b/Source/platform/blink_heap_asm_stubs.target.darwin-x86_64.mk
index 9d959a2..7c940f1 100644
--- a/Source/platform/blink_heap_asm_stubs.target.darwin-x86_64.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.darwin-x86_64.mk
@@ -45,7 +45,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -138,7 +137,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.linux-arm.mk b/Source/platform/blink_heap_asm_stubs.target.linux-arm.mk
index a360378..6cbe44e 100644
--- a/Source/platform/blink_heap_asm_stubs.target.linux-arm.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.linux-arm.mk
@@ -31,7 +31,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -131,7 +130,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.linux-arm64.mk b/Source/platform/blink_heap_asm_stubs.target.linux-arm64.mk
index 0ea4814..fb8e477 100644
--- a/Source/platform/blink_heap_asm_stubs.target.linux-arm64.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.linux-arm64.mk
@@ -30,7 +30,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -118,7 +117,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.linux-x86.mk b/Source/platform/blink_heap_asm_stubs.target.linux-x86.mk
index af9a6c5..b226586 100644
--- a/Source/platform/blink_heap_asm_stubs.target.linux-x86.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.linux-x86.mk
@@ -44,7 +44,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -138,7 +137,6 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_heap_asm_stubs.target.linux-x86_64.mk b/Source/platform/blink_heap_asm_stubs.target.linux-x86_64.mk
index 9d959a2..7c940f1 100644
--- a/Source/platform/blink_heap_asm_stubs.target.linux-x86_64.mk
+++ b/Source/platform/blink_heap_asm_stubs.target.linux-x86_64.mk
@@ -45,7 +45,6 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
@@ -138,7 +137,6 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
 	-fno-strict-aliasing \
 	-Wno-unused-parameter \
 	-Wno-missing-field-initializers \
diff --git a/Source/platform/blink_platform.gypi b/Source/platform/blink_platform.gypi
index afefacb..b3b9016 100644
--- a/Source/platform/blink_platform.gypi
+++ b/Source/platform/blink_platform.gypi
@@ -918,6 +918,7 @@
       'network/HTTPParsersTest.cpp',
       'network/ResourceRequestTest.cpp',
       'scheduler/SchedulerTest.cpp',
+      'scroll/ScrollableAreaTest.cpp',
       'testing/ArenaTestHelpers.h',
       'testing/TreeTestHelpers.cpp',
       'testing/TreeTestHelpers.h',
diff --git a/Source/platform/blink_platform.target.darwin-arm.mk b/Source/platform/blink_platform.target.darwin-arm.mk
index ec73343..ef5d374 100644
--- a/Source/platform/blink_platform.target.darwin-arm.mk
+++ b/Source/platform/blink_platform.target.darwin-arm.mk
@@ -434,7 +434,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -590,7 +590,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.darwin-arm64.mk b/Source/platform/blink_platform.target.darwin-arm64.mk
index be3f923..1a8a99e 100644
--- a/Source/platform/blink_platform.target.darwin-arm64.mk
+++ b/Source/platform/blink_platform.target.darwin-arm64.mk
@@ -432,7 +432,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -576,7 +576,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.darwin-x86.mk b/Source/platform/blink_platform.target.darwin-x86.mk
index bbac42c..619bf91 100644
--- a/Source/platform/blink_platform.target.darwin-x86.mk
+++ b/Source/platform/blink_platform.target.darwin-x86.mk
@@ -432,7 +432,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -581,7 +581,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.darwin-x86_64.mk b/Source/platform/blink_platform.target.darwin-x86_64.mk
index 3744c99..ed31b6c 100644
--- a/Source/platform/blink_platform.target.darwin-x86_64.mk
+++ b/Source/platform/blink_platform.target.darwin-x86_64.mk
@@ -433,7 +433,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -581,7 +581,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.linux-arm.mk b/Source/platform/blink_platform.target.linux-arm.mk
index ec73343..ef5d374 100644
--- a/Source/platform/blink_platform.target.linux-arm.mk
+++ b/Source/platform/blink_platform.target.linux-arm.mk
@@ -434,7 +434,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -590,7 +590,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.linux-arm64.mk b/Source/platform/blink_platform.target.linux-arm64.mk
index be3f923..1a8a99e 100644
--- a/Source/platform/blink_platform.target.linux-arm64.mk
+++ b/Source/platform/blink_platform.target.linux-arm64.mk
@@ -432,7 +432,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -576,7 +576,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.linux-x86.mk b/Source/platform/blink_platform.target.linux-x86.mk
index bbac42c..619bf91 100644
--- a/Source/platform/blink_platform.target.linux-x86.mk
+++ b/Source/platform/blink_platform.target.linux-x86.mk
@@ -432,7 +432,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -581,7 +581,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/blink_platform.target.linux-x86_64.mk b/Source/platform/blink_platform.target.linux-x86_64.mk
index 3744c99..ed31b6c 100644
--- a/Source/platform/blink_platform.target.linux-x86_64.mk
+++ b/Source/platform/blink_platform.target.linux-x86_64.mk
@@ -433,7 +433,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -581,7 +581,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/platform/fonts/Font.cpp b/Source/platform/fonts/Font.cpp
index bc22d60..2bfc2c6 100644
--- a/Source/platform/fonts/Font.cpp
+++ b/Source/platform/fonts/Font.cpp
@@ -749,19 +749,19 @@
     return markFontData->fontMetrics().height();
 }
 
-static SkPaint textFillPaint(GraphicsContext* gc, const SimpleFontData* font)
+SkPaint Font::textFillPaint(GraphicsContext* gc, const SimpleFontData* font) const
 {
     SkPaint paint = gc->fillPaint();
-    font->platformData().setupPaint(&paint, gc);
+    font->platformData().setupPaint(&paint, gc, this);
     gc->adjustTextRenderMode(&paint);
     paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
     return paint;
 }
 
-static SkPaint textStrokePaint(GraphicsContext* gc, const SimpleFontData* font, bool isFilling)
+SkPaint Font::textStrokePaint(GraphicsContext* gc, const SimpleFontData* font, bool isFilling) const
 {
     SkPaint paint = gc->strokePaint();
-    font->platformData().setupPaint(&paint, gc);
+    font->platformData().setupPaint(&paint, gc, this);
     gc->adjustTextRenderMode(&paint);
     paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
     if (isFilling) {
@@ -779,9 +779,9 @@
     return paint;
 }
 
-static void paintGlyphs(GraphicsContext* gc, const SimpleFontData* font,
+void Font::paintGlyphs(GraphicsContext* gc, const SimpleFontData* font,
     const Glyph glyphs[], unsigned numGlyphs,
-    const SkPoint pos[], const FloatRect& textRect)
+    const SkPoint pos[], const FloatRect& textRect) const
 {
     TextDrawingModeFlags textMode = gc->textDrawingMode();
 
@@ -797,9 +797,9 @@
     }
 }
 
-static void paintGlyphsHorizontal(GraphicsContext* gc, const SimpleFontData* font,
+void Font::paintGlyphsHorizontal(GraphicsContext* gc, const SimpleFontData* font,
     const Glyph glyphs[], unsigned numGlyphs,
-    const SkScalar xpos[], SkScalar constY, const FloatRect& textRect)
+    const SkScalar xpos[], SkScalar constY, const FloatRect& textRect) const
 {
     TextDrawingModeFlags textMode = gc->textDrawingMode();
 
diff --git a/Source/platform/fonts/Font.h b/Source/platform/fonts/Font.h
index 33c1612..2c21fcc 100644
--- a/Source/platform/fonts/Font.h
+++ b/Source/platform/fonts/Font.h
@@ -141,6 +141,13 @@
     float buildGlyphBuffer(const TextRunPaintInfo&, GlyphBuffer&, ForTextEmphasisOrNot = NotForTextEmphasis) const;
     PassTextBlobPtr buildTextBlob(const GlyphBuffer&, float initialAdvance, const FloatRect& bounds,
         bool couldUseLCD) const;
+
+    SkPaint textFillPaint(GraphicsContext*, const SimpleFontData*) const;
+    SkPaint textStrokePaint(GraphicsContext*, const SimpleFontData*, bool isFilling) const;
+    void paintGlyphs(GraphicsContext*, const SimpleFontData*, const Glyph glyphs[], unsigned numGlyphs,
+        const SkPoint pos[], const FloatRect& textRect) const;
+    void paintGlyphsHorizontal(GraphicsContext*, const SimpleFontData*, const Glyph glyphs[], unsigned numGlyphs,
+        const SkScalar xpos[], SkScalar constY, const FloatRect& textRect) const;
     void drawGlyphs(GraphicsContext*, const SimpleFontData*, const GlyphBuffer&, unsigned from, unsigned numGlyphs, const FloatPoint&, const FloatRect& textRect) const;
     void drawTextBlob(GraphicsContext*, const SkTextBlob*, const SkPoint& origin) const;
     float drawGlyphBuffer(GraphicsContext*, const TextRunPaintInfo&, const GlyphBuffer&, const FloatPoint&) const;
diff --git a/Source/platform/fonts/FontPlatformData.h b/Source/platform/fonts/FontPlatformData.h
index 1a44b36..51ed7a6 100644
--- a/Source/platform/fonts/FontPlatformData.h
+++ b/Source/platform/fonts/FontPlatformData.h
@@ -62,6 +62,7 @@
 
 namespace blink {
 
+class Font;
 class GraphicsContext;
 class HarfBuzzFace;
 
@@ -143,7 +144,7 @@
     // The returned styles are all actual styles without FontRenderStyle::NoPreference.
     const FontRenderStyle& fontRenderStyle() const { return m_style; }
 #endif
-    void setupPaint(SkPaint*, GraphicsContext* = 0) const;
+    void setupPaint(SkPaint*, GraphicsContext* = 0, const Font* = 0) const;
 
 #if OS(WIN)
     int paintTextFlags() const { return m_paintTextFlags; }
diff --git a/Source/platform/fonts/android/FontCacheAndroid.cpp b/Source/platform/fonts/android/FontCacheAndroid.cpp
index 25c4c75..369f6b7 100644
--- a/Source/platform/fonts/android/FontCacheAndroid.cpp
+++ b/Source/platform/fonts/android/FontCacheAndroid.cpp
@@ -35,21 +35,39 @@
 #include "platform/fonts/SimpleFontData.h"
 #include "platform/fonts/FontDescription.h"
 #include "platform/fonts/FontFaceCreationParams.h"
+#include "platform/text/LocaleToScriptMapping.h"
 #include "third_party/skia/include/core/SkTypeface.h"
 #include "third_party/skia/include/ports/SkFontMgr.h"
 
 namespace blink {
 
+// SkFontMgr requires script-based locale names, like "zh-Hant" and "zh-Hans",
+// instead of "zh-CN" and "zh-TW".
+static CString toSkFontMgrLocale(const String& locale)
+{
+    if (!locale.startsWith("zh", false))
+        return locale.ascii();
+
+    switch (localeToScriptCodeForFontSelection(locale)) {
+    case USCRIPT_SIMPLIFIED_HAN:
+        return "zh-Hans";
+    case USCRIPT_TRADITIONAL_HAN:
+        return "zh-Hant";
+    default:
+        return locale.ascii();
+    }
+}
+
 static AtomicString getFamilyNameForCharacter(UChar32 c, const FontDescription& fontDescription)
 {
     RefPtr<SkFontMgr> fm = adoptRef(SkFontMgr::RefDefault());
     const char* bcp47Locales[2];
     int localeCount = 0;
-    CString defaultLocale = defaultLanguage().ascii();
+    CString defaultLocale = toSkFontMgrLocale(defaultLanguage());
     bcp47Locales[localeCount++] = defaultLocale.data();
     CString fontLocale;
     if (!fontDescription.locale().isEmpty()) {
-        fontLocale = fontDescription.locale().ascii();
+        fontLocale = toSkFontMgrLocale(fontDescription.locale());
         bcp47Locales[localeCount++] = fontLocale.data();
     }
     RefPtr<SkTypeface> typeface = adoptRef(fm->matchFamilyStyleCharacter(0, SkFontStyle(), bcp47Locales, localeCount, c));
diff --git a/Source/platform/fonts/linux/FontPlatformDataLinux.cpp b/Source/platform/fonts/linux/FontPlatformDataLinux.cpp
index 0191a3d..a4eb172 100644
--- a/Source/platform/fonts/linux/FontPlatformDataLinux.cpp
+++ b/Source/platform/fonts/linux/FontPlatformDataLinux.cpp
@@ -72,8 +72,7 @@
     useSkiaSubpixelRendering = useSubpixelRendering;
 }
 
-void FontPlatformData::setupPaint(SkPaint* paint, GraphicsContext* context)
-    const
+void FontPlatformData::setupPaint(SkPaint* paint, GraphicsContext* context, const Font*) const
 {
     paint->setAntiAlias(m_style.useAntiAlias);
     paint->setHinting(static_cast<SkPaint::Hinting>(m_style.hintStyle));
diff --git a/Source/platform/fonts/mac/FontPlatformDataMac.mm b/Source/platform/fonts/mac/FontPlatformDataMac.mm
index 833692d..bac86e8 100644
--- a/Source/platform/fonts/mac/FontPlatformDataMac.mm
+++ b/Source/platform/fonts/mac/FontPlatformDataMac.mm
@@ -30,6 +30,7 @@
 
 #include "platform/LayoutTestSupport.h"
 #include "platform/RuntimeEnabledFeatures.h"
+#include "platform/fonts/Font.h"
 #import "platform/fonts/shaping/HarfBuzzFace.h"
 #include "third_party/skia/include/ports/SkTypeface_mac.h"
 
@@ -44,15 +45,34 @@
     return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
-void FontPlatformData::setupPaint(SkPaint* paint, GraphicsContext*) const
+void FontPlatformData::setupPaint(SkPaint* paint, GraphicsContext*, const Font* font) const
 {
     bool shouldSmoothFonts = true;
     bool shouldAntialias = true;
 
-    shouldAntialias = shouldAntialias && (!LayoutTestSupport::isRunningLayoutTest()
-        || LayoutTestSupport::isFontAntialiasingEnabledForTest());
+    if (font) {
+        switch (font->fontDescription().fontSmoothing()) {
+        case Antialiased:
+            shouldSmoothFonts = false;
+            break;
+        case SubpixelAntialiased:
+            break;
+        case NoSmoothing:
+            shouldAntialias = false;
+            shouldSmoothFonts = false;
+            break;
+        case AutoSmoothing:
+            // For the AutoSmooth case, don't do anything! Keep the default settings.
+            break;
+        }
+    }
+
+    if (LayoutTestSupport::isRunningLayoutTest()) {
+        shouldSmoothFonts = false;
+        shouldAntialias = shouldAntialias && LayoutTestSupport::isFontAntialiasingEnabledForTest();
+    }
+
     bool useSubpixelText = RuntimeEnabledFeatures::subpixelFontScalingEnabled();
-    shouldSmoothFonts = shouldSmoothFonts && !LayoutTestSupport::isRunningLayoutTest();
 
     paint->setAntiAlias(shouldAntialias);
     paint->setEmbeddedBitmapText(false);
@@ -61,10 +81,14 @@
     paint->setTypeface(typeface());
     paint->setFakeBoldText(m_syntheticBold);
     paint->setTextSkewX(m_syntheticItalic ? -SK_Scalar1 / 4 : 0);
-    paint->setAutohinted(false); // freetype specific
     paint->setLCDRenderText(shouldSmoothFonts);
     paint->setSubpixelText(useSubpixelText);
-    paint->setHinting(SkPaint::kNo_Hinting);
+
+    // When rendering using CoreGraphics, disable hinting when webkit-font-smoothing:antialiased or
+    // text-rendering:geometricPrecision is used.
+    // See crbug.com/152304
+    if (font && (font->fontDescription().fontSmoothing() == Antialiased || font->fontDescription().textRendering() == GeometricPrecision))
+        paint->setHinting(SkPaint::kNo_Hinting);
 }
 
 // These CoreText Text Spacing feature selectors are not defined in CoreText.
diff --git a/Source/platform/fonts/win/FontPlatformDataWin.cpp b/Source/platform/fonts/win/FontPlatformDataWin.cpp
index 621e252..50fc655 100644
--- a/Source/platform/fonts/win/FontPlatformDataWin.cpp
+++ b/Source/platform/fonts/win/FontPlatformDataWin.cpp
@@ -44,7 +44,7 @@
 // if available.
 const float kMaxSizeForEmbeddedBitmap = 24.0f;
 
-void FontPlatformData::setupPaint(SkPaint* paint, GraphicsContext* context) const
+void FontPlatformData::setupPaint(SkPaint* paint, GraphicsContext* context, const Font*) const
 {
     const float ts = m_textSize >= 0 ? m_textSize : 12;
     paint->setTextSize(SkFloatToScalar(m_textSize));
diff --git a/Source/platform/graphics/Image.h b/Source/platform/graphics/Image.h
index 8b40396..6c9cef8 100644
--- a/Source/platform/graphics/Image.h
+++ b/Source/platform/graphics/Image.h
@@ -84,6 +84,10 @@
     virtual bool usesContainerSize() const { return false; }
     virtual bool hasRelativeWidth() const { return false; }
     virtual bool hasRelativeHeight() const { return false; }
+
+    // Computes (extracts) the intrinsic dimensions and ratio from the Image. The intrinsic ratio
+    // will be the 'viewport' of the image. (Same as the dimensions for a raster image. For SVG
+    // images it can be the dimensions defined by the 'viewBox'.)
     virtual void computeIntrinsicDimensions(Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio);
 
     virtual IntSize size() const = 0;
diff --git a/Source/platform/graphics/ImageBuffer.cpp b/Source/platform/graphics/ImageBuffer.cpp
index 2c733d6..c7ac9b2 100644
--- a/Source/platform/graphics/ImageBuffer.cpp
+++ b/Source/platform/graphics/ImageBuffer.cpp
@@ -249,7 +249,7 @@
 
     m_surface->invalidateCachedBitmap();
     bool result = drawingBuffer->copyToPlatformTexture(context3D, tex, GL_RGBA,
-        GL_UNSIGNED_BYTE, 0, true, false, fromFrontBuffer);
+        GL_UNSIGNED_BYTE, 0, true, false, fromFrontBuffer ? DrawingBuffer::Front : DrawingBuffer::Back);
 
     if (result) {
         m_surface->didModifyBackingTexture();
diff --git a/Source/platform/graphics/filters/FEGaussianBlur.cpp b/Source/platform/graphics/filters/FEGaussianBlur.cpp
index fdd8e52..62a41dd 100644
--- a/Source/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/Source/platform/graphics/filters/FEGaussianBlur.cpp
@@ -38,8 +38,6 @@
     return 3 / 4.f * sqrtf(twoPiFloat);
 }
 
-static const int gMaxKernelSize = 1000;
-
 namespace blink {
 
 FEGaussianBlur::FEGaussianBlur(Filter* filter, float x, float y)
@@ -83,12 +81,12 @@
     // inflates the absolute paint rect to much. This is compatible with Firefox' behavior.
     if (std.x()) {
         int size = std::max<unsigned>(2, static_cast<unsigned>(floorf(std.x() * gaussianKernelFactor() + 0.5f)));
-        kernelSize.setWidth(std::min(size, gMaxKernelSize));
+        kernelSize.setWidth(size);
     }
 
     if (std.y()) {
         int size = std::max<unsigned>(2, static_cast<unsigned>(floorf(std.y() * gaussianKernelFactor() + 0.5f)));
-        kernelSize.setHeight(std::min(size, gMaxKernelSize));
+        kernelSize.setHeight(size);
     }
 
     return kernelSize;
diff --git a/Source/platform/graphics/gpu/DrawingBuffer.cpp b/Source/platform/graphics/gpu/DrawingBuffer.cpp
index 3f15b36..60a9d98 100644
--- a/Source/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/Source/platform/graphics/gpu/DrawingBuffer.cpp
@@ -458,7 +458,8 @@
     return true;
 }
 
-bool DrawingBuffer::copyToPlatformTexture(WebGraphicsContext3D* context, Platform3DObject texture, GLenum internalFormat, GLenum destType, GLint level, bool premultiplyAlpha, bool flipY, bool fromFrontBuffer)
+bool DrawingBuffer::copyToPlatformTexture(WebGraphicsContext3D* context, Platform3DObject texture, GLenum internalFormat,
+    GLenum destType, GLint level, bool premultiplyAlpha, bool flipY, SourceBuffer source)
 {
     if (m_contentsChanged) {
         if (m_multisampleMode != None) {
@@ -477,7 +478,7 @@
     // Contexts may be in a different share group. We must transfer the texture through a mailbox first
     WebExternalTextureMailbox mailbox;
     GLint textureId = 0;
-    if (fromFrontBuffer && m_frontColorBuffer.texInfo.textureId) {
+    if (source == Front && m_frontColorBuffer.texInfo.textureId) {
         textureId = m_frontColorBuffer.texInfo.textureId;
         mailbox = m_frontColorBuffer.mailbox;
     } else {
@@ -533,45 +534,6 @@
     return m_layer->layer();
 }
 
-void DrawingBuffer::paintCompositedResultsToCanvas(ImageBuffer* imageBuffer)
-{
-    if (m_context->getGraphicsResetStatusARB() != GL_NO_ERROR)
-        return;
-
-    if (!imageBuffer || !m_frontColorBuffer.texInfo.textureId)
-        return;
-    Platform3DObject tex = imageBuffer->getBackingTexture();
-    if (tex) {
-        OwnPtr<WebGraphicsContext3DProvider> provider =
-            adoptPtr(Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
-        if (!provider)
-            return;
-        WebGraphicsContext3D* context = provider->context3d();
-        if (!context)
-            return;
-
-        context->waitSyncPoint(m_frontColorBuffer.mailbox.syncPoint);
-        Platform3DObject sourceTexture = context->createAndConsumeTextureCHROMIUM(GL_TEXTURE_2D, m_frontColorBuffer.mailbox.name);
-        context->copyTextureCHROMIUM(GL_TEXTURE_2D, sourceTexture,
-            tex, 0, GL_RGBA, GL_UNSIGNED_BYTE);
-        context->deleteTexture(sourceTexture);
-        context->flush();
-        m_context->waitSyncPoint(context->insertSyncPoint());
-        imageBuffer->didModifyBackingTexture();
-        return;
-    }
-
-    Platform3DObject framebuffer = m_context->createFramebuffer();
-    m_context->bindFramebuffer(GL_FRAMEBUFFER, framebuffer);
-    // We don't need to bind a copy of m_frontColorBuffer since the texture parameters are untouched.
-    m_context->framebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_frontColorBuffer.texInfo.textureId, 0);
-
-    paintFramebufferToCanvas(framebuffer, size().width(), size().height(), !m_actualAttributes.premultipliedAlpha, imageBuffer);
-    m_context->deleteFramebuffer(framebuffer);
-    // Since we're using the same context as WebGL, we have to restore any state we change (in this case, just the framebuffer binding).
-    restoreFramebufferBinding();
-}
-
 void DrawingBuffer::clearPlatformLayer()
 {
     if (m_layer)
diff --git a/Source/platform/graphics/gpu/DrawingBuffer.h b/Source/platform/graphics/gpu/DrawingBuffer.h
index 698b4a3..c28f68f 100644
--- a/Source/platform/graphics/gpu/DrawingBuffer.h
+++ b/Source/platform/graphics/gpu/DrawingBuffer.h
@@ -144,7 +144,6 @@
     void setIsHidden(bool);
 
     WebLayer* platformLayer();
-    void paintCompositedResultsToCanvas(ImageBuffer*);
 
     WebGraphicsContext3D* context();
 
@@ -156,9 +155,10 @@
     virtual bool prepareMailbox(WebExternalTextureMailbox*, WebExternalBitmap*) override;
     virtual void mailboxReleased(const WebExternalTextureMailbox&, bool lostResource = false) override;
 
+    enum SourceBuffer { Front, Back };
     // Destroys the TEXTURE_2D binding for the owned context
     bool copyToPlatformTexture(WebGraphicsContext3D*, Platform3DObject texture, GLenum internalFormat,
-        GLenum destType, GLint level, bool premultiplyAlpha, bool flipY, bool fromFrontBuffer = false);
+        GLenum destType, GLint level, bool premultiplyAlpha, bool flipY, SourceBuffer);
 
     void setPackAlignment(GLint param);
 
diff --git a/Source/platform/mac/ScrollAnimatorMac.mm b/Source/platform/mac/ScrollAnimatorMac.mm
index 1856fe7..96ef816 100644
--- a/Source/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/platform/mac/ScrollAnimatorMac.mm
@@ -326,7 +326,6 @@
     void stop()
     {
         m_timer.stop();
-        [m_animation setCurrentProgress:1];
     }
 
     void setDuration(CFTimeInterval duration)
@@ -340,12 +339,12 @@
         double currentTime = WTF::currentTime();
         double delta = currentTime - m_startTime;
 
-        if (delta >= m_duration) {
-            stop();
-            return;
-        }
+        if (delta >= m_duration)
+            m_timer.stop();
 
         double fraction = delta / m_duration;
+        fraction = std::min(1.0, fraction);
+        fraction = std::max(0.0, fraction);
         double progress = m_timingFunction->evaluate(fraction, 0.001);
         [m_animation setCurrentProgress:progress];
     }
diff --git a/Source/platform/scroll/ScrollableArea.cpp b/Source/platform/scroll/ScrollableArea.cpp
index f170495..9992fd0 100644
--- a/Source/platform/scroll/ScrollableArea.cpp
+++ b/Source/platform/scroll/ScrollableArea.cpp
@@ -183,7 +183,7 @@
 void ScrollableArea::notifyScrollPositionChanged(const IntPoint& position)
 {
     scrollPositionChanged(DoublePoint(position));
-    scrollAnimator()->setCurrentPosition(position);
+    scrollAnimator()->setCurrentPosition(scrollPosition());
 }
 
 void ScrollableArea::scrollPositionChanged(const DoublePoint& position)
diff --git a/Source/platform/scroll/ScrollableAreaTest.cpp b/Source/platform/scroll/ScrollableAreaTest.cpp
new file mode 100644
index 0000000..1ba5f45
--- /dev/null
+++ b/Source/platform/scroll/ScrollableAreaTest.cpp
@@ -0,0 +1,60 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+
+#include "platform/scroll/ScrollableArea.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+using namespace blink;
+
+namespace {
+
+class MockScrollableArea : public ScrollableArea {
+public:
+    MockScrollableArea(const IntPoint& maximumScrollPosition)
+        : m_maximumScrollPosition(maximumScrollPosition) { }
+
+    MOCK_CONST_METHOD0(isActive, bool());
+    MOCK_CONST_METHOD1(scrollSize, int(ScrollbarOrientation));
+    MOCK_METHOD2(invalidateScrollbar, void(Scrollbar*, const IntRect&));
+    MOCK_CONST_METHOD0(isScrollCornerVisible, bool());
+    MOCK_CONST_METHOD0(scrollCornerRect, IntRect());
+    MOCK_METHOD2(invalidateScrollbarRect, void(Scrollbar*, const IntRect&));
+    MOCK_METHOD1(invalidateScrollCornerRect, void(const IntRect&));
+    MOCK_CONST_METHOD0(enclosingScrollableArea, ScrollableArea*());
+    MOCK_CONST_METHOD0(minimumScrollPosition, IntPoint());
+    MOCK_CONST_METHOD1(visibleContentRect, IntRect(IncludeScrollbarsInRect));
+    MOCK_CONST_METHOD0(contentsSize, IntSize());
+    MOCK_CONST_METHOD0(overhangAmount, IntSize());
+    MOCK_CONST_METHOD0(scrollbarsCanBeActive, bool());
+    MOCK_CONST_METHOD0(scrollableAreaBoundingBox, IntRect());
+
+    virtual bool userInputScrollable(ScrollbarOrientation) const override { return true; }
+    virtual bool shouldPlaceVerticalScrollbarOnLeft() const override { return false; }
+    virtual void setScrollOffset(const IntPoint& offset) override { m_scrollPosition = offset.shrunkTo(m_maximumScrollPosition); }
+    virtual IntPoint scrollPosition() const override { return m_scrollPosition; }
+    virtual IntPoint maximumScrollPosition() const override { return m_maximumScrollPosition; }
+    virtual int visibleHeight() const override { return 768; }
+    virtual int visibleWidth() const override { return 1024; }
+    virtual bool scrollAnimatorEnabled() const override { return false; }
+    virtual int pageStep(ScrollbarOrientation) const override { return 0; }
+
+private:
+    IntPoint m_scrollPosition;
+    IntPoint m_maximumScrollPosition;
+};
+
+TEST(ScrollableAreaTest, ScrollAnimatorCurrentPositionShouldBeSync)
+{
+    MockScrollableArea scrollableArea(IntPoint(0, 100));
+    scrollableArea.notifyScrollPositionChanged(IntPoint(0, 10000));
+    EXPECT_EQ(100.0, scrollableArea.scrollAnimator()->currentPosition().y());
+}
+
+} // unnamed namespace
+
+
diff --git a/Source/web/ExternalPopupMenu.cpp b/Source/web/ExternalPopupMenu.cpp
index f3aca8d..21316bc 100644
--- a/Source/web/ExternalPopupMenu.cpp
+++ b/Source/web/ExternalPopupMenu.cpp
@@ -31,8 +31,11 @@
 #include "config.h"
 #include "web/ExternalPopupMenu.h"
 
+#include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/PinchViewport.h"
+#include "core/page/Page.h"
 #include "platform/PopupMenuClient.h"
 #include "platform/geometry/FloatQuad.h"
 #include "platform/geometry/IntPoint.h"
@@ -83,7 +86,11 @@
     WebLocalFrameImpl* webframe = WebLocalFrameImpl::fromFrame(m_localFrame.get());
     m_webExternalPopupMenu = webframe->client()->createExternalPopupMenu(info, this);
     if (m_webExternalPopupMenu) {
-        m_webExternalPopupMenu->show(m_localFrame->view()->contentsToWindow(rect));
+        // FIXME: Standardize viewport coordinate conversions. crbug.com/371902.
+        IntRect rectInViewport = m_localFrame->view()->contentsToWindow(rect);
+        if (m_webView.pinchVirtualViewportEnabled())
+            rectInViewport.moveBy(-flooredIntPoint(m_webView.page()->frameHost().pinchViewport().location()));
+        m_webExternalPopupMenu->show(rectInViewport);
 #if OS(MACOSX)
         const WebInputEvent* currentEvent = WebViewImpl::currentInputEvent();
         if (currentEvent && currentEvent->type == WebInputEvent::MouseDown) {
diff --git a/Source/web/ExternalPopupMenuTest.cpp b/Source/web/ExternalPopupMenuTest.cpp
index e73aff1..ecb284c 100644
--- a/Source/web/ExternalPopupMenuTest.cpp
+++ b/Source/web/ExternalPopupMenuTest.cpp
@@ -6,7 +6,10 @@
 #include "web/ExternalPopupMenu.h"
 
 #include "core/HTMLNames.h"
+#include "core/frame/FrameHost.h"
+#include "core/frame/PinchViewport.h"
 #include "core/html/HTMLSelectElement.h"
+#include "core/page/Page.h"
 #include "core/rendering/RenderMenuList.h"
 #include "core/testing/URLTestHelpers.h"
 #include "platform/PopupMenu.h"
@@ -15,6 +18,7 @@
 #include "public/platform/WebUnitTestSupport.h"
 #include "public/web/WebExternalPopupMenu.h"
 #include "public/web/WebPopupMenuInfo.h"
+#include "public/web/WebSettings.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/tests/FrameTestHelpers.h"
 #include <gtest/gtest.h>
@@ -108,11 +112,28 @@
     {
         return &m_mockWebExternalPopupMenu;
     }
+    WebRect shownBounds() const
+    {
+        return m_mockWebExternalPopupMenu.shownBounds();
+    }
 private:
     class MockWebExternalPopupMenu : public WebExternalPopupMenu {
-        virtual void show(const WebRect& bounds) override { }
+        virtual void show(const WebRect& bounds) override
+        {
+            m_shownBounds = bounds;
+        }
         virtual void close() override { }
+
+    public:
+        WebRect shownBounds() const
+        {
+            return m_shownBounds;
+        }
+
+    private:
+        WebRect m_shownBounds;
     };
+    WebRect m_shownBounds;
     MockWebExternalPopupMenu m_mockWebExternalPopupMenu;
 };
 
@@ -123,7 +144,7 @@
 protected:
     virtual void SetUp() override
     {
-        m_helper.initialize(false, &m_webFrameClient, &m_webViewClient);
+        m_helper.initialize(false, &m_webFrameClient, &m_webViewClient, &configureSettings);
         webView()->setUseExternalPopupMenus(true);
     }
     virtual void TearDown() override
@@ -142,15 +163,47 @@
     }
 
     WebViewImpl* webView() const { return m_helper.webViewImpl(); }
+    const ExternalPopupMenuWebFrameClient& client() const { return m_webFrameClient; }
     WebLocalFrameImpl* mainFrame() const { return m_helper.webViewImpl()->mainFrameImpl(); }
 
 private:
+    static void configureSettings(WebSettings* settings)
+    {
+        settings->setPinchVirtualViewportEnabled(true);
+    }
+
     std::string m_baseURL;
     FrameTestHelpers::TestWebViewClient m_webViewClient;
     ExternalPopupMenuWebFrameClient m_webFrameClient;
     FrameTestHelpers::WebViewHelper m_helper;
 };
 
+TEST_F(ExternalPopupMenuTest, PopupAccountsForPinchViewportOffset)
+{
+    registerMockedURLLoad("select_mid_screen.html");
+    loadFrame("select_mid_screen.html");
+
+    webView()->resize(WebSize(100, 100));
+    webView()->layout();
+
+    HTMLSelectElement* select = toHTMLSelectElement(mainFrame()->frame()->document()->getElementById("select"));
+    RenderMenuList* menuList = toRenderMenuList(select->renderer());
+    ASSERT_TRUE(menuList);
+
+    PinchViewport& pinchViewport = webView()->page()->frameHost().pinchViewport();
+
+    IntRect rectInDocument = menuList->absoluteBoundingBoxRect();
+
+    webView()->setPageScaleFactor(2);
+    IntPoint scrollDelta(20, 30);
+    pinchViewport.move(scrollDelta);
+
+    menuList->showPopup();
+
+    EXPECT_EQ(rectInDocument.x() - scrollDelta.x(), client().shownBounds().x);
+    EXPECT_EQ(rectInDocument.y() - scrollDelta.y(), client().shownBounds().y);
+}
+
 TEST_F(ExternalPopupMenuTest, DidAcceptIndex)
 {
     registerMockedURLLoad("select.html");
diff --git a/Source/web/LinkHighlight.cpp b/Source/web/LinkHighlight.cpp
index 5e16b12..aedb248 100644
--- a/Source/web/LinkHighlight.cpp
+++ b/Source/web/LinkHighlight.cpp
@@ -40,7 +40,6 @@
 #include "core/rendering/compositing/CompositedLayerMapping.h"
 #include "core/rendering/style/ShadowData.h"
 #include "platform/graphics/Color.h"
-#include "platform/graphics/DisplayList.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorAnimationCurve.h"
 #include "public/platform/WebCompositorSupport.h"
@@ -108,8 +107,9 @@
 
 void LinkHighlight::attachLinkHighlightToCompositingLayer(const RenderLayerModelObject* paintInvalidationContainer)
 {
+    // FIXME: there should always be a GraphicsLayer. See https://code.google.com/p/chromium/issues/detail?id=359877.
     GraphicsLayer* newGraphicsLayer = paintInvalidationContainer->layer()->graphicsLayerBacking();
-    if (!newGraphicsLayer->drawsContent())
+    if (newGraphicsLayer && !newGraphicsLayer->drawsContent())
         newGraphicsLayer = paintInvalidationContainer->layer()->graphicsLayerBackingForScrolling();
     if (!newGraphicsLayer)
         return;
@@ -228,13 +228,6 @@
     bool pathHasChanged = !(newPath == m_path);
     if (pathHasChanged) {
         m_path = newPath;
-
-        GraphicsContext gc(0);
-        gc.beginRecording(boundingRect);
-        gc.setFillColor(m_node->renderer()->style()->tapHighlightColor());
-        gc.fillPath(m_path);
-        m_displayList = gc.endRecording();
-
         m_contentLayer->layer()->setBounds(enclosingIntRect(boundingRect).size());
     }
 
@@ -251,8 +244,9 @@
     GraphicsContext gc(canvas,
         contextStatus == WebContentLayerClient::GraphicsContextEnabled ? GraphicsContext::NothingDisabled : GraphicsContext::FullyDisabled);
     IntRect clipRect(IntPoint(webClipRect.x, webClipRect.y), IntSize(webClipRect.width, webClipRect.height));
-    m_displayList->setClip(clipRect);
-    gc.drawDisplayList(m_displayList.get());
+    gc.clip(clipRect);
+    gc.setFillColor(m_node->renderer()->style()->tapHighlightColor());
+    gc.fillPath(m_path);
 }
 
 void LinkHighlight::startHighlightAnimationIfNeeded()
diff --git a/Source/web/LinkHighlight.h b/Source/web/LinkHighlight.h
index 6fbd3de..4fc79aa 100644
--- a/Source/web/LinkHighlight.h
+++ b/Source/web/LinkHighlight.h
@@ -39,7 +39,6 @@
 
 namespace blink {
 
-class DisplayList;
 class Node;
 class RenderLayerModelObject;
 struct WebRect;
@@ -84,7 +83,6 @@
     OwnPtr<WebContentLayer> m_contentLayer;
     OwnPtr<WebLayer> m_clipLayer;
     Path m_path;
-    RefPtr<DisplayList> m_displayList;
 
     RefPtrWillBePersistent<Node> m_node;
     WebViewImpl* m_owningWebViewImpl;
diff --git a/Source/web/PageScaleConstraintsSet.cpp b/Source/web/PageScaleConstraintsSet.cpp
index 113517d..4aa0494 100644
--- a/Source/web/PageScaleConstraintsSet.cpp
+++ b/Source/web/PageScaleConstraintsSet.cpp
@@ -206,7 +206,8 @@
 
     if (wideViewportQuirkEnabled) {
         if (useWideViewport && (description.maxWidth.isAuto() || description.maxWidth.type() == ExtendToZoom) && description.zoom != 1.0f) {
-            adjustedLayoutSizeWidth = layoutFallbackWidth;
+            if (layoutFallbackWidth)
+                adjustedLayoutSizeWidth = layoutFallbackWidth;
             adjustedLayoutSizeHeight = computeHeightByAspectRatio(adjustedLayoutSizeWidth, m_viewSize);
         } else if (!useWideViewport) {
             const float nonWideScale = description.zoom < 1 && description.maxWidth.type() != DeviceWidth && description.maxWidth.type() != DeviceHeight ? -1 : oldInitialScale;
diff --git a/Source/web/TextFinder.cpp b/Source/web/TextFinder.cpp
index 4a12362..120cb3e 100644
--- a/Source/web/TextFinder.cpp
+++ b/Source/web/TextFinder.cpp
@@ -191,7 +191,6 @@
         if (selectionRect) {
             *selectionRect = ownerFrame().frameView()->contentsToWindow(m_activeMatch->boundingBox());
             reportFindInPageSelection(*selectionRect, m_activeMatchIndexInCurrentFrame + 1, identifier);
-            reportFindInPageResultToAccessibility(identifier);
         }
     }
 
@@ -449,6 +448,10 @@
     // Update the UI with the latest selection rect.
     if (ownerFrame().client())
         ownerFrame().client()->reportFindInPageSelection(identifier, ordinalOfFirstMatch() + activeMatchOrdinal, selectionRect);
+
+    // Update accessibility too, so if the user commits to this query
+    // we can move accessibility focus to this result.
+    reportFindInPageResultToAccessibility(identifier);
 }
 
 void TextFinder::resetMatchCount()
diff --git a/Source/web/WebAXObject.cpp b/Source/web/WebAXObject.cpp
index 05113ed..6226125 100644
--- a/Source/web/WebAXObject.cpp
+++ b/Source/web/WebAXObject.cpp
@@ -1150,6 +1150,14 @@
     return rowRange.second;
 }
 
+void WebAXObject::loadInlineTextBoxes() const
+{
+    if (isDetached())
+        return;
+
+    m_private->loadInlineTextBoxes();
+}
+
 WebAXTextDirection WebAXObject::textDirection() const
 {
     if (isDetached())
diff --git a/Source/web/WebDevToolsFrontendImpl.cpp b/Source/web/WebDevToolsFrontendImpl.cpp
index 0ccaa20..8e1a33f 100644
--- a/Source/web/WebDevToolsFrontendImpl.cpp
+++ b/Source/web/WebDevToolsFrontendImpl.cpp
@@ -160,7 +160,23 @@
             "InspectorFrontendHost.loaded = function() {};"
             "InspectorFrontendHost.hiddenPanels = function() { return ""; };"
             "InspectorFrontendHost.localizedStringsURL = function() { return ""; };"
-            "InspectorFrontendHost.close = function(url) { };";
+            "InspectorFrontendHost.close = function(url) { };"
+            ""
+            "(function() {"
+            "function getValue(property)"
+            "{"
+            "    if (property == 'padding-left') {"
+            "        return {"
+            "            getFloatValue: function() { return this.__paddingLeft; },"
+            "            __paddingLeft: parseFloat(this.paddingLeft)"
+            "        };"
+            "    }"
+            "    throw new Error('getPropertyCSSValue is undefined');"
+            "}"
+            ""
+            "window.CSSStyleDeclaration.prototype.getPropertyCSSValue = getValue;"
+            "window.CSSPrimitiveValue = { CSS_PX: 'CSS_PX' };"
+            "})();";
         scriptController->executeScriptInMainWorld(installAdditionalAPI, ScriptController::ExecuteScriptWhenScriptsDisabled);
     }
 }
diff --git a/Source/web/WebLocalFrameImpl.cpp b/Source/web/WebLocalFrameImpl.cpp
index b19b1a5..5c114a7 100644
--- a/Source/web/WebLocalFrameImpl.cpp
+++ b/Source/web/WebLocalFrameImpl.cpp
@@ -332,7 +332,7 @@
 
     float spoolSinglePage(GraphicsContext& graphicsContext, int pageNumber)
     {
-        frame()->document()->dispatchEventsForPrinting();
+        dispatchEventsForPrintingOnAllFrames();
         if (!frame()->document() || !frame()->document()->renderView())
             return 0;
 
@@ -345,7 +345,7 @@
 
     void spoolAllPagesWithBoundaries(GraphicsContext& graphicsContext, const FloatSize& pageSizeInPixels)
     {
-        frame()->document()->dispatchEventsForPrinting();
+        dispatchEventsForPrintingOnAllFrames();
         if (!frame()->document() || !frame()->document()->renderView())
             return;
 
@@ -414,6 +414,18 @@
     }
 
 private:
+    void dispatchEventsForPrintingOnAllFrames()
+    {
+        WillBeHeapVector<RefPtrWillBeMember<Document>> documents;
+        for (Frame* currentFrame = frame(); currentFrame; currentFrame = currentFrame->tree().traverseNext(frame())) {
+            if (currentFrame->isLocalFrame())
+                documents.append(toLocalFrame(currentFrame)->document());
+        }
+
+        for (auto& doc : documents)
+            doc->dispatchEventsForPrinting();
+    }
+
     // Set when printing.
     float m_printedPageWidth;
 };
@@ -1154,11 +1166,7 @@
 
 void WebLocalFrameImpl::selectWordAroundPosition(LocalFrame* frame, VisiblePosition position)
 {
-    VisibleSelection selection(position);
-    selection.expandUsingGranularity(WordGranularity);
-
-    TextGranularity granularity = selection.isRange() ? WordGranularity : CharacterGranularity;
-    frame->selection().setSelection(selection, granularity);
+    frame->selection().selectWordAroundPosition(position);
 }
 
 bool WebLocalFrameImpl::selectWordAroundCaret()
@@ -1166,8 +1174,7 @@
     FrameSelection& selection = frame()->selection();
     if (selection.isNone() || selection.isRange())
         return false;
-    selectWordAroundPosition(frame(), selection.selection().visibleStart());
-    return true;
+    return frame()->selection().selectWordAroundPosition(selection.selection().visibleStart());
 }
 
 void WebLocalFrameImpl::selectRange(const WebPoint& base, const WebPoint& extent)
@@ -1666,7 +1673,7 @@
     if (isLocalRoot)
         webView->suppressInvalidations(true);
 
-    frame()->createView(webView->size(), webView->baseBackgroundColor(), webView->isTransparent());
+    frame()->createView(webView->mainFrameSize(), webView->baseBackgroundColor(), webView->isTransparent());
     if (webView->shouldAutoResize() && isLocalRoot)
         frame()->view()->enableAutoSizeMode(webView->minAutoSize(), webView->maxAutoSize());
 
diff --git a/Source/web/WebViewImpl.cpp b/Source/web/WebViewImpl.cpp
index d002f3e..932fb5a 100644
--- a/Source/web/WebViewImpl.cpp
+++ b/Source/web/WebViewImpl.cpp
@@ -1653,6 +1653,7 @@
         return;
 
     page()->frameHost().pinchViewport().setSize(newSize);
+    page()->frameHost().pinchViewport().clampToBoundaries();
 }
 
 WebLocalFrameImpl* WebViewImpl::localFrameRootTemporary() const
@@ -1684,6 +1685,11 @@
     if (pinchVirtualViewportEnabled())
         page()->frameHost().pinchViewport().setSize(m_size);
 
+    if (localFrameRootTemporary()->frameView()) {
+        if (!localFrameRootTemporary()->frameView()->needsLayout())
+            postLayoutResize(localFrameRootTemporary());
+    }
+
     // When device emulation is enabled, device size values may change - they are
     // usually set equal to the view size. These values are not considered viewport-dependent
     // (see MediaQueryExp::isViewportDependent), since they are only viewport-dependent in emulation mode,
@@ -1732,11 +1738,15 @@
 
         pinchViewport.setTopControlsAdjustment(topControlsViewportAdjustment);
 
+// On ChromeOS the pinch viewport can change size independent of the layout viewport due to the
+// on screen keyboard so we should only set the FrameView adjustment on Android.
+#if OS(ANDROID)
         // Shrink the FrameView by the amount that will maintain the aspect-ratio with the PinchViewport.
         float aspectRatio = pinchViewport.visibleRect().width() / pinchViewport.visibleRect().height();
         float newHeight = view->unscaledVisibleContentSize(ExcludeScrollbars).width() / aspectRatio;
         float adjustment = newHeight - view->unscaledVisibleContentSize(ExcludeScrollbars).height();
         view->setTopControlsViewportAdjustment(adjustment);
+#endif
     }
 }
 
@@ -1781,6 +1791,9 @@
     m_fullscreenController->updateSize();
 
     if (settings()->viewportEnabled()) {
+        PinchViewport& pinchViewport = page()->frameHost().pinchViewport();
+        FloatPoint viewportOffsetBeforeResize = pinchViewport.visibleRectInDocument().location();
+
         // Relayout immediately to recalculate the minimum scale limit.
         if (view->needsLayout())
             view->layout();
@@ -1797,6 +1810,9 @@
             viewportAnchor.computeOrigins(*view, pinchViewportSize,
                 mainFrameOrigin, pinchViewportOrigin);
             scrollAndRescaleViewports(newPageScaleFactor, mainFrameOrigin, pinchViewportOrigin);
+        } else {
+            FloatSize deltaFromResize = viewportOffsetBeforeResize - pinchViewport.visibleRectInDocument().location();
+            pinchViewport.move(FloatPoint(deltaFromResize));
         }
     }
 
@@ -3210,6 +3226,24 @@
     setUserAgentPageScaleConstraints(constraints);
 }
 
+IntSize WebViewImpl::mainFrameSize()
+{
+    if (!pinchVirtualViewportEnabled() || !localFrameRootTemporary())
+        return m_size;
+
+    FrameView* view = localFrameRootTemporary()->frameView();
+
+    if (!view)
+        return m_size;
+
+    int contentAndScrollbarWidth = contentsSize().width();
+
+    if (view && view->verticalScrollbar() && !view->verticalScrollbar()->isOverlayScrollbar())
+        contentAndScrollbarWidth += view->verticalScrollbar()->width();
+
+    return m_pageScaleConstraintsSet.mainFrameSize(contentAndScrollbarWidth);
+}
+
 void WebViewImpl::refreshPageScaleFactorAfterLayout()
 {
     if (!mainFrame() || !page() || !page()->mainFrame() || !page()->mainFrame()->isLocalFrame() || !page()->deprecatedLocalMainFrame()->view())
@@ -3226,13 +3260,7 @@
         m_pageScaleConstraintsSet.adjustFinalConstraintsToContentsSize(contentsSize(), verticalScrollbarWidth);
     }
 
-    if (pinchVirtualViewportEnabled()) {
-        int contentAndScrollbarWidth = contentsSize().width();
-        if (view->verticalScrollbar() && !view->verticalScrollbar()->isOverlayScrollbar())
-            contentAndScrollbarWidth += view->verticalScrollbar()->width();
-
-        view->resize(m_pageScaleConstraintsSet.mainFrameSize(contentAndScrollbarWidth));
-    }
+    postLayoutResize(localFrameRootTemporary());
 
     float newPageScaleFactor = pageScaleFactor();
     if (m_pageScaleConstraintsSet.needsReset() && m_pageScaleConstraintsSet.finalConstraints().initialScale != -1) {
@@ -3930,6 +3958,18 @@
     }
 }
 
+void WebViewImpl::postLayoutResize(WebLocalFrameImpl* webframe)
+{
+    FrameView* view = webframe->frame()->view();
+    if (pinchVirtualViewportEnabled()) {
+        if (webframe == mainFrame()) {
+            view->resize(mainFrameSize());
+        } else {
+            view->resize(webframe->frameView()->layoutSize());
+        }
+    }
+}
+
 void WebViewImpl::layoutUpdated(WebLocalFrameImpl* webframe)
 {
     if (!m_client || !webframe->frame()->isLocalRoot())
diff --git a/Source/web/WebViewImpl.h b/Source/web/WebViewImpl.h
index e3b2985..3ef53db 100644
--- a/Source/web/WebViewImpl.h
+++ b/Source/web/WebViewImpl.h
@@ -359,6 +359,8 @@
     // not take the user away from the current page.
     void didCommitLoad(bool isNewNavigation, bool isNavigationWithinPage);
 
+    void postLayoutResize(WebLocalFrameImpl* webframe);
+
     // Indicates two things:
     //   1) This view may have a new layout now.
     //   2) Calling layout() is a no-op.
@@ -507,6 +509,8 @@
 
     virtual void setTopControlsLayoutHeight(float) override;
 
+    IntSize mainFrameSize();
+
 private:
     void didUpdateTopControls();
     void setTopControlsContentOffset(float);
diff --git a/Source/web/blink_web.target.darwin-arm.mk b/Source/web/blink_web.target.darwin-arm.mk
index f360da1..0194ed5 100644
--- a/Source/web/blink_web.target.darwin-arm.mk
+++ b/Source/web/blink_web.target.darwin-arm.mk
@@ -211,7 +211,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -367,7 +367,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.darwin-arm64.mk b/Source/web/blink_web.target.darwin-arm64.mk
index f236027..5e0bd89 100644
--- a/Source/web/blink_web.target.darwin-arm64.mk
+++ b/Source/web/blink_web.target.darwin-arm64.mk
@@ -210,7 +210,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -354,7 +354,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.darwin-x86.mk b/Source/web/blink_web.target.darwin-x86.mk
index 3571fa7..fbe3d03 100644
--- a/Source/web/blink_web.target.darwin-x86.mk
+++ b/Source/web/blink_web.target.darwin-x86.mk
@@ -210,7 +210,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -360,7 +360,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.darwin-x86_64.mk b/Source/web/blink_web.target.darwin-x86_64.mk
index ff29aaa..8d61cc7 100644
--- a/Source/web/blink_web.target.darwin-x86_64.mk
+++ b/Source/web/blink_web.target.darwin-x86_64.mk
@@ -211,7 +211,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -360,7 +360,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.linux-arm.mk b/Source/web/blink_web.target.linux-arm.mk
index f360da1..0194ed5 100644
--- a/Source/web/blink_web.target.linux-arm.mk
+++ b/Source/web/blink_web.target.linux-arm.mk
@@ -211,7 +211,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -367,7 +367,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.linux-arm64.mk b/Source/web/blink_web.target.linux-arm64.mk
index f236027..5e0bd89 100644
--- a/Source/web/blink_web.target.linux-arm64.mk
+++ b/Source/web/blink_web.target.linux-arm64.mk
@@ -210,7 +210,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -354,7 +354,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.linux-x86.mk b/Source/web/blink_web.target.linux-x86.mk
index 3571fa7..fbe3d03 100644
--- a/Source/web/blink_web.target.linux-x86.mk
+++ b/Source/web/blink_web.target.linux-x86.mk
@@ -210,7 +210,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -360,7 +360,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/blink_web.target.linux-x86_64.mk b/Source/web/blink_web.target.linux-x86_64.mk
index ff29aaa..8d61cc7 100644
--- a/Source/web/blink_web.target.linux-x86_64.mk
+++ b/Source/web/blink_web.target.linux-x86_64.mk
@@ -211,7 +211,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -360,7 +360,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/web/tests/PinchViewportTest.cpp b/Source/web/tests/PinchViewportTest.cpp
index a588bcc..0b96421 100644
--- a/Source/web/tests/PinchViewportTest.cpp
+++ b/Source/web/tests/PinchViewportTest.cpp
@@ -354,6 +354,7 @@
     PinchViewport& pinchViewport = frame()->page()->frameHost().pinchViewport();
     EXPECT_FLOAT_SIZE_EQ(FloatSize(320, 240), pinchViewport.containerLayer()->size());
 }
+
 // Make sure that the visibleRect method acurately reflects the scale and scroll location
 // of the viewport.
 TEST_F(PinchViewportTest, TestVisibleRect)
@@ -1008,6 +1009,36 @@
     EXPECT_FLOAT_POINT_EQ(FloatPoint(0, 10), pinchViewport.visibleRect().location());
 }
 
+#if OS(ANDROID)
+
+// Top controls can make an unscrollable page temporarily scrollable, causing
+// a scroll clamp when the page is resized. Make sure this bug is fixed.
+// crbug.com/437620
+TEST_F(PinchViewportTest, TestResizeDoesntChangeScrollOffset)
+{
+    initializeWithAndroidSettings();
+    webViewImpl()->resize(IntSize(100, 150));
+
+    navigateTo("about:blank");
+
+    PinchViewport& pinchViewport = frame()->page()->frameHost().pinchViewport();
+    FrameView& frameView = *webViewImpl()->mainFrameImpl()->frameView();
+
+    pinchViewport.setScale(2);
+    pinchViewport.move(FloatPoint(0, 40));
+
+    // Simulate bringing down the top controls by 20px but counterscrolling the outer viewport.
+    webViewImpl()->applyViewportDeltas(WebSize(), WebSize(0, 20), 1, 20);
+
+    EXPECT_EQ(20, frameView.scrollPosition().y());
+
+    webViewImpl()->setTopControlsLayoutHeight(20);
+    webViewImpl()->resize(WebSize(100, 130));
+
+    EXPECT_EQ(0, frameView.scrollPosition().y());
+    EXPECT_EQ(60, pinchViewport.location().y());
+}
+
 static IntPoint expectedMaxFrameViewScrollOffset(PinchViewport& pinchViewport, FrameView& frameView)
 {
     float aspectRatio = pinchViewport.visibleRect().width() / pinchViewport.visibleRect().height();
@@ -1164,25 +1195,6 @@
     EXPECT_POINT_EQ(pinchViewportExpected, pinchViewport.location());
 }
 
-// Tests that the layout viewport's scroll layer bounds are updated in a compositing
-// change update. crbug.com/423188.
-TEST_F(PinchViewportTest, TestChangingContentSizeAffectsScrollBounds)
-{
-    initializeWithAndroidSettings();
-    webViewImpl()->resize(IntSize(100, 150));
-
-    registerMockedHttpURLLoad("content-width-1000.html");
-    navigateTo(m_baseURL + "content-width-1000.html");
-
-    FrameView& frameView = *webViewImpl()->mainFrameImpl()->frameView();
-    WebLayer* scrollLayer = frameView.layerForScrolling()->platformLayer();
-
-    frameView.setContentsSize(IntSize(1500, 2400));
-    frameView.updateLayoutAndStyleForPainting();
-
-    EXPECT_SIZE_EQ(IntSize(1500, 2400), IntSize(scrollLayer->bounds()));
-}
-
 // Tests that a resize due to top controls hiding doesn't incorrectly clamp the
 // main frame's scroll offset. crbug.com/428193.
 TEST_F(PinchViewportTest, TestTopControlHidingResizeDoesntClampMainFrame)
@@ -1208,6 +1220,92 @@
     webViewImpl()->resize(IntSize(1000, 1500));
     EXPECT_EQ(500, frameView.scrollPositionDouble().y());
 }
+#endif
 
+// Tests that the layout viewport's scroll layer bounds are updated in a compositing
+// change update. crbug.com/423188.
+TEST_F(PinchViewportTest, TestChangingContentSizeAffectsScrollBounds)
+{
+    initializeWithAndroidSettings();
+    webViewImpl()->resize(IntSize(100, 150));
+
+    registerMockedHttpURLLoad("content-width-1000.html");
+    navigateTo(m_baseURL + "content-width-1000.html");
+
+    FrameView& frameView = *webViewImpl()->mainFrameImpl()->frameView();
+    WebLayer* scrollLayer = frameView.layerForScrolling()->platformLayer();
+
+    frameView.setContentsSize(IntSize(1500, 2400));
+    frameView.updateLayoutAndStyleForPainting();
+
+    EXPECT_SIZE_EQ(IntSize(1500, 2400), IntSize(scrollLayer->bounds()));
+}
+
+// Tests that resizing the pinch viepwort keeps its bounds within the outer
+// viewport.
+TEST_F(PinchViewportTest, ResizePinchViewportStaysWithinOuterViewport)
+{
+    initializeWithDesktopSettings();
+    webViewImpl()->resize(IntSize(100, 200));
+
+    navigateTo("about:blank");
+    webViewImpl()->layout();
+
+    webViewImpl()->resizePinchViewport(IntSize(100, 100));
+
+    PinchViewport& pinchViewport = frame()->page()->frameHost().pinchViewport();
+    pinchViewport.move(FloatPoint(0, 100));
+
+    EXPECT_EQ(100, pinchViewport.location().y());
+
+    webViewImpl()->resizePinchViewport(IntSize(100, 200));
+
+    EXPECT_EQ(0, pinchViewport.location().y());
+}
+
+TEST_F(PinchViewportTest, ElementBoundsInRootViewSpaceAccountsForViewport)
+{
+    initializeWithAndroidSettings();
+
+    webViewImpl()->resize(IntSize(500, 800));
+
+    registerMockedHttpURLLoad("pinch-viewport-input-field.html");
+    navigateTo(m_baseURL + "pinch-viewport-input-field.html");
+
+    webViewImpl()->setInitialFocus(false);
+    Element* inputElement = webViewImpl()->focusedElement();
+
+    IntRect bounds = inputElement->renderer()->absoluteBoundingBoxRect();
+
+    PinchViewport& pinchViewport = frame()->page()->frameHost().pinchViewport();
+    IntPoint scrollDelta(250, 400);
+    pinchViewport.setScale(2);
+    pinchViewport.setLocation(scrollDelta);
+
+    IntRect boundsInViewport = inputElement->boundsInRootViewSpace();
+
+    EXPECT_POINT_EQ(IntPoint(bounds.location() - scrollDelta),
+        boundsInViewport.location());
+    EXPECT_SIZE_EQ(bounds.size(), boundsInViewport.size());
+}
+
+// Tests that when a new frame is created, it is created with the intended
+// size (i.e. the contentWidth).
+TEST_F(PinchViewportTest, TestMainFrameInitializationSizing)
+{
+    initializeWithAndroidSettings();
+
+    webViewImpl()->setPageScaleFactorLimits(0.5, 2.0);
+    webViewImpl()->resize(IntSize(100, 200));
+
+    registerMockedHttpURLLoad("content-width-1000.html");
+    navigateTo(m_baseURL + "content-width-1000.html");
+
+    WebLocalFrameImpl* localFrame = webViewImpl()->mainFrameImpl();
+    FrameView& frameView = *localFrame->frameView();
+    localFrame->createFrameView();
+
+    EXPECT_SIZE_EQ(IntSize(200, 400), frameView.frameRect().size());
+}
 
 } // namespace
diff --git a/Source/web/tests/WebFrameTest.cpp b/Source/web/tests/WebFrameTest.cpp
index 84c6232..ab870aa 100644
--- a/Source/web/tests/WebFrameTest.cpp
+++ b/Source/web/tests/WebFrameTest.cpp
@@ -1070,6 +1070,28 @@
     EXPECT_EQ(980.0 / viewportWidth * viewportHeight, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->contentsSize().height());
 }
 
+TEST_F(WebFrameTest, WideViewportSetsTo980WithXhtmlMp)
+{
+    UseMockScrollbarSettings mockScrollbarSettings;
+    registerMockedHttpURLLoad("viewport/viewport-legacy-xhtmlmp.html");
+
+    FixedLayoutTestWebViewClient client;
+    client.m_screenInfo.deviceScaleFactor = 1;
+    int viewportWidth = 640;
+    int viewportHeight = 480;
+
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    webViewHelper.initialize(true, 0, &client, enableViewportSettings);
+    applyViewportStyleOverride(&webViewHelper);
+    webViewHelper.webView()->settings()->setWideViewportQuirkEnabled(true);
+    webViewHelper.webView()->settings()->setUseWideViewport(true);
+    FrameTestHelpers::loadFrame(webViewHelper.webView()->mainFrame(), m_baseURL + "viewport/viewport-legacy-xhtmlmp.html");
+
+    webViewHelper.webView()->resize(WebSize(viewportWidth, viewportHeight));
+    EXPECT_EQ(viewportWidth, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->contentsSize().width());
+    EXPECT_EQ(viewportHeight, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->contentsSize().height());
+}
+
 TEST_F(WebFrameTest, NoWideViewportAndHeightInMeta)
 {
     UseMockScrollbarSettings mockScrollbarSettings;
@@ -1292,6 +1314,49 @@
     EXPECT_LE(viewportHeight, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->layoutSize().height());
 }
 
+TEST_F(WebFrameTest, SetForceZeroLayoutHeightWorksWithRelayoutsWhenHeightChanged)
+{
+    // this unit test is an attempt to target a real world case where an app could
+    // 1. call resize(width, 0) and setForceZeroLayoutHeight(true)
+    // 2. load content (hoping that the viewport height would increase
+    // as more content is added)
+    // 3. fail to register touch events aimed at the loaded content
+    // because the layout is only updated if either width or height is changed
+    UseMockScrollbarSettings mockScrollbarSettings;
+    registerMockedHttpURLLoad("button.html");
+
+    FixedLayoutTestWebViewClient client;
+    client.m_screenInfo.deviceScaleFactor = 1;
+    int viewportWidth = 640;
+    int viewportHeight = 480;
+
+    FrameTestHelpers::WebViewHelper webViewHelper;
+
+    webViewHelper.initializeAndLoad(m_baseURL + "button.html", true, 0, &client, configurePinchVirtualViewport);
+    // set view height to zero so that if the height of the view is not
+    // successfully updated during later resizes touch events will fail
+    // (as in not hit content included in the view)
+    webViewHelper.webView()->resize(WebSize(viewportWidth, 0));
+    webViewHelper.webView()->layout();
+
+    webViewHelper.webView()->settings()->setForceZeroLayoutHeight(true);
+    webViewHelper.webView()->resize(WebSize(viewportWidth, viewportHeight));
+
+    IntPoint hitPoint = IntPoint(30, 30); // button size is 100x100
+
+    WebLocalFrameImpl* frame = toWebLocalFrameImpl(webViewHelper.webView()->mainFrame());
+    Document* document = frame->frame()->document();
+    Element* element = document->getElementById("tap_button");
+
+    ASSERT_NE(nullptr, element);
+    EXPECT_EQ(String("oldValue"), element->innerText());
+
+    PlatformGestureEvent gestureEvent(PlatformEvent::Type::GestureTap, hitPoint, hitPoint, IntSize(0, 0), 0, false, false, false, false, 0.0, 0.0, 0.0, 0.0, false);
+    webViewHelper.webViewImpl()->mainFrameImpl()->frame()->eventHandler().handleGestureEvent(gestureEvent);
+    // when pressed, the button changes its own text to "updatedValue"
+    EXPECT_EQ(String("updatedValue"), element->innerText());
+}
+
 TEST_F(WebFrameTest, SetForceZeroLayoutHeightWorksAcrossNavigations)
 {
     UseMockScrollbarSettings mockScrollbarSettings;
diff --git a/Source/web/tests/data/button.html b/Source/web/tests/data/button.html
new file mode 100644
index 0000000..20aee88
--- /dev/null
+++ b/Source/web/tests/data/button.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function changeText(id, newText) {
+  var node = document.getElementById(id);
+  node.childNodes[0].nodeValue = newText;
+}
+</script>
+
+  <meta name='viewport' content='width=device-width'/>
+  <style>
+    body {
+      margin: 0px;
+    }
+  </style>
+</head>
+
+<body>
+  <button type="button" id="tap_button" onclick="changeText('tap_button', 'updatedValue')" style="width:100px;height:100px">oldValue</button>
+</body>
+
+</html>
+
diff --git a/Source/web/tests/data/popup/select_mid_screen.html b/Source/web/tests/data/popup/select_mid_screen.html
new file mode 100644
index 0000000..baf7b37
--- /dev/null
+++ b/Source/web/tests/data/popup/select_mid_screen.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+  body {
+    margin: 0px;
+  }
+</style>
+<div style="padding:50px">
+<select id="select">
+<option>0</option>
+<option>1</option>
+<option>2</option>
+</select>
+</div>
diff --git a/Source/wtf/wtf.target.darwin-arm.mk b/Source/wtf/wtf.target.darwin-arm.mk
index 872245b..39e3747 100644
--- a/Source/wtf/wtf.target.darwin-arm.mk
+++ b/Source/wtf/wtf.target.darwin-arm.mk
@@ -105,7 +105,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -217,7 +217,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.darwin-arm64.mk b/Source/wtf/wtf.target.darwin-arm64.mk
index fe15d92..9d25fb2 100644
--- a/Source/wtf/wtf.target.darwin-arm64.mk
+++ b/Source/wtf/wtf.target.darwin-arm64.mk
@@ -104,7 +104,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -204,7 +204,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.darwin-x86.mk b/Source/wtf/wtf.target.darwin-x86.mk
index fea36e5..529ce56 100644
--- a/Source/wtf/wtf.target.darwin-x86.mk
+++ b/Source/wtf/wtf.target.darwin-x86.mk
@@ -104,7 +104,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -210,7 +210,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.darwin-x86_64.mk b/Source/wtf/wtf.target.darwin-x86_64.mk
index c9f3d83..3d3b7d0 100644
--- a/Source/wtf/wtf.target.darwin-x86_64.mk
+++ b/Source/wtf/wtf.target.darwin-x86_64.mk
@@ -105,7 +105,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -210,7 +210,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.linux-arm.mk b/Source/wtf/wtf.target.linux-arm.mk
index 872245b..39e3747 100644
--- a/Source/wtf/wtf.target.linux-arm.mk
+++ b/Source/wtf/wtf.target.linux-arm.mk
@@ -105,7 +105,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -217,7 +217,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.linux-arm64.mk b/Source/wtf/wtf.target.linux-arm64.mk
index fe15d92..9d25fb2 100644
--- a/Source/wtf/wtf.target.linux-arm64.mk
+++ b/Source/wtf/wtf.target.linux-arm64.mk
@@ -104,7 +104,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -204,7 +204,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.linux-x86.mk b/Source/wtf/wtf.target.linux-x86.mk
index fea36e5..529ce56 100644
--- a/Source/wtf/wtf.target.linux-x86.mk
+++ b/Source/wtf/wtf.target.linux-x86.mk
@@ -104,7 +104,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -210,7 +210,7 @@
 # Flags passed to both C and C++ files.
 MY_CFLAGS_Release := \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/Source/wtf/wtf.target.linux-x86_64.mk b/Source/wtf/wtf.target.linux-x86_64.mk
index c9f3d83..3d3b7d0 100644
--- a/Source/wtf/wtf.target.linux-x86_64.mk
+++ b/Source/wtf/wtf.target.linux-x86_64.mk
@@ -105,7 +105,7 @@
 MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
@@ -210,7 +210,7 @@
 MY_CFLAGS_Release := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
-	 \
+	-Werror \
 	-fno-strict-aliasing \
 	-Wall \
 	-Wno-unused-parameter \
diff --git a/public/web/WebAXObject.h b/public/web/WebAXObject.h
index 8cd0788..e2fb717 100644
--- a/public/web/WebAXObject.h
+++ b/public/web/WebAXObject.h
@@ -206,6 +206,10 @@
     BLINK_EXPORT unsigned cellRowIndex() const;
     BLINK_EXPORT unsigned cellRowSpan() const;
 
+    // Load inline text boxes for just this subtree, even if
+    // settings->inlineTextBoxAccessibilityEnabled() is false.
+    BLINK_EXPORT void loadInlineTextBoxes() const;
+
     // For an inline text box.
     BLINK_EXPORT WebAXTextDirection textDirection() const;
     BLINK_EXPORT void characterOffsets(WebVector<int>&) const;