Import WebKit commit 6d0ad27b6bc4209fb8d8cee2692dc0c6a5462051v5.212.0-alpha2

Change-Id: Ifdedb7bc3162434686201813dc1d994cf5ae7e70 Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
author: Konstantin Tokarev <annulen@yandex.ru> 2017-06-15 12:13:20 +0300
committer: Konstantin Tokarev <annulen@yandex.ru> 2017-06-17 10:46:54 +0000
commit: aab669a05f943c587f6acccd94d53a8544170c1c (patch)
tree: 2c22545100b500eb80d23f75b8e3180ed9b5f3b7
parent: c119ecc79e19c630a8b1ef10fe01cc567901033f (diff)
71 files changed, 535 insertions, 136 deletions
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index d9f888fb1..c0a84fc5f 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -68,6 +68,7 @@
 
 #if OS(WINDOWS)
 #include <direct.h>
+#include <wtf/text/win/WCharStringExtras.h>
 #else
 #include <unistd.h>
 #endif
@@ -868,8 +869,7 @@ static bool currentWorkingDirectory(DirectoryName& directoryName)
     // https://msdn.microsoft.com/en-us/library/windows/desktop/ff381407.aspx
     auto buffer = std::make_unique<wchar_t[]>(bufferLength);
     DWORD lengthNotIncludingNull = ::GetCurrentDirectoryW(bufferLength, buffer.get());
-    static_assert(sizeof(wchar_t) == sizeof(UChar), "In Windows, both are UTF-16LE");
-    String directoryString = String(reinterpret_cast<UChar*>(buffer.get()));
+    String directoryString = wcharToString(buffer.get(), lengthNotIncludingNull);
     // We don't support network path like \\host\share\<path name>.
     if (directoryString.startsWith("\\\\"))
         return false;
@@ -999,9 +999,7 @@ static bool fetchModuleFromLocalFileSystem(const String& fileName, Vector<char>&
     // https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247.aspx#maxpath
     // Use long UNC to pass the long path name to the Windows APIs.
     String longUNCPathName = WTF::makeString("\\\\?\\", fileName);
-    static_assert(sizeof(wchar_t) == sizeof(UChar), "In Windows, both are UTF-16LE");
-    auto utf16Vector = longUNCPathName.charactersWithNullTermination();
-    FILE* f = _wfopen(reinterpret_cast<wchar_t*>(utf16Vector.data()), L"rb");
+    FILE* f = _wfopen(stringToNullTerminatedWChar(longUNCPathName).data(), L"rb");
 #else
     FILE* f = fopen(fileName.utf8().data(), "r");
 #endif
diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
index 05e27338b..8a87cc62a 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
@@ -32,6 +32,7 @@
 
 #if OS(WINDOWS)
 #include <windows.h>
+#include <wtf/text/win/WCharStringExtras.h>
 #endif
 
 using namespace WTF;
@@ -108,7 +109,7 @@ String formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool as
             TIME_ZONE_INFORMATION timeZoneInformation;
             GetTimeZoneInformation(&timeZoneInformation);
             const WCHAR* winTimeZoneName = t.isDST() ? timeZoneInformation.DaylightName : timeZoneInformation.StandardName;
-            String timeZoneName(reinterpret_cast<const UChar*>(winTimeZoneName));
+            String timeZoneName = nullTerminatedWCharToString(winTimeZoneName);
 #else
             struct tm gtm = t;
             char timeZoneName[70];
diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferView.h b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
index 769150b36..a5afdb9ef 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferView.h
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
@@ -162,7 +162,7 @@ public:
     bool isNeutered() { return hasArrayBuffer() && !vector(); }
     void neuter();
     
-    void* vector()
+    void* vector() const
     {
         return m_vector.getPredicated(
             this,
diff --git a/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp b/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp
index bf99dbc87..5c038c502 100644
--- a/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp
@@ -35,6 +35,7 @@
 #include "JSObject.h"
 #include "JSTypedArrayViewPrototype.h"
 #include "JSTypedArrays.h"
+#include "TypedArrayInlines.h"
 
 namespace JSC {
 
diff --git a/Source/PlatformQt.cmake b/Source/PlatformQt.cmake
index 1bab6fbe5..0044dec03 100644
--- a/Source/PlatformQt.cmake
+++ b/Source/PlatformQt.cmake
@@ -1,3 +1,17 @@
+# Automoc
+
+set(TARGETS_WITH_AUTOMOC
+    WebKit
+    WebKitWidgets
+)
+if (ENABLE_WEBKIT2)
+    list(APPEND TARGETS_WITH_AUTOMOC
+        WebKit2
+    )
+endif ()
+set_property(TARGET ${TARGETS_WITH_AUTOMOC} PROPERTY AUTOMOC ON)
+
+
 # Minimal debug
 
 # Builds with debug flags result in a huge amount of symbols with the GNU toolchain,
diff --git a/Source/WTF/wtf/Compiler.h b/Source/WTF/wtf/Compiler.h
index 89f4ca42e..f74fc8a0d 100644
--- a/Source/WTF/wtf/Compiler.h
+++ b/Source/WTF/wtf/Compiler.h
@@ -52,7 +52,6 @@
 #define WTF_COMPILER_SUPPORTS_C_STATIC_ASSERT __has_feature(c_static_assert)
 #define WTF_COMPILER_SUPPORTS_CXX_REFERENCE_QUALIFIED_FUNCTIONS __has_feature(cxx_reference_qualified_functions)
 #define WTF_COMPILER_SUPPORTS_CXX_USER_LITERALS __has_feature(cxx_user_literals)
-#define WTF_COMPILER_SUPPORTS_FALLTHROUGH_WARNINGS __has_feature(cxx_attributes) && __has_warning("-Wimplicit-fallthrough")
 #endif
 
 /* COMPILER(GCC_OR_CLANG) - GNU Compiler Collection or Clang */
@@ -176,10 +175,18 @@
 
 /* FALLTHROUGH */
 
-#if !defined(FALLTHROUGH) && COMPILER_SUPPORTS(FALLTHROUGH_WARNINGS) && COMPILER(CLANG)
+#if !defined(FALLTHROUGH) && defined(__cplusplus) && defined(__has_cpp_attribute)
+
+#if __has_cpp_attribute(fallthrough)
+#define FALLTHROUGH [[fallthrough]]
+#elif __has_cpp_attribute(clang::fallthrough)
 #define FALLTHROUGH [[clang::fallthrough]]
+#elif __has_cpp_attribute(gnu::fallthrough)
+#define FALLTHROUGH [[gnu::fallthrough]]
 #endif
 
+#endif // !defined(FALLTHROUGH) && defined(__cplusplus) && defined(__has_cpp_attribute)
+
 #if !defined(FALLTHROUGH)
 #define FALLTHROUGH
 #endif
diff --git a/Source/WTF/wtf/PlatformQt.cmake b/Source/WTF/wtf/PlatformQt.cmake
index 636ad40c2..32c8d2c70 100644
--- a/Source/WTF/wtf/PlatformQt.cmake
+++ b/Source/WTF/wtf/PlatformQt.cmake
@@ -4,6 +4,7 @@ list(APPEND WTF_SOURCES
 
     text/qt/StringQt.cpp
 )
+QTWEBKIT_GENERATE_MOC_FILES_CPP(qt/MainThreadQt.cpp qt/RunLoopQt.cpp)
 
 list(APPEND WTF_SYSTEM_INCLUDE_DIRECTORIES
     ${Qt5Core_INCLUDE_DIRS}
@@ -32,6 +33,7 @@ if (UNIX AND NOT APPLE)
 
         qt/WorkQueueQt.cpp
     )
+    QTWEBKIT_GENERATE_MOC_FILES_CPP(qt/WorkQueueQt.cpp)
 endif ()
 
 if (USE_GLIB)
diff --git a/Source/WTF/wtf/text/win/WCharStringExtras.h b/Source/WTF/wtf/text/win/WCharStringExtras.h
new file mode 100644
index 000000000..9d004e515
--- /dev/null
+++ b/Source/WTF/wtf/text/win/WCharStringExtras.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2017 Konstantin Tokarev <annulen@yandex.ru>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wchar.h>
+#include <wtf/text/WTFString.h>
+
+namespace WTF {
+
+inline Vector<wchar_t> stringToNullTerminatedWChar(const String& string)
+{
+    Vector<wchar_t> result;
+
+    if (!string.isNull()) {
+        result.reserveInitialCapacity(string.impl()->length() + 1);
+
+        if (string.is8Bit()) {
+            const LChar* characters8 = string.impl()->characters8();
+            for (size_t i = 0; i < string.impl()->length(); ++i)
+                result.uncheckedAppend(characters8[i]);
+        } else {
+            const UChar* characters16 = string.impl()->characters16();
+            result.append(characters16, string.impl()->length());
+        }
+
+        result.append(0);
+    }
+
+    return result;
+}
+
+inline String wcharToString(const wchar_t* characters, unsigned length)
+{
+    static_assert(sizeof(wchar_t) == sizeof(UChar), "We assume wchar_t and UChar have the same size");
+    return String(reinterpret_cast<const UChar*>(characters), length);
+}
+
+inline String nullTerminatedWCharToString(const wchar_t* characters)
+{
+    return wcharToString(characters, wcslen(characters) - 1);
+}
+
+} // namespace WTF
+
+using WTF::stringToNullTerminatedWChar;
+using WTF::wcharToString;
+using WTF::nullTerminatedWCharToString;
diff --git a/Source/WebCore/PlatformQt.cmake b/Source/WebCore/PlatformQt.cmake
index 44ed482fb..c5466b6c7 100644
--- a/Source/WebCore/PlatformQt.cmake
+++ b/Source/WebCore/PlatformQt.cmake
@@ -162,6 +162,20 @@ list(APPEND WebCore_SOURCES
     platform/text/qt/TextBreakIteratorInternalICUQt.cpp
 )
 
+QTWEBKIT_GENERATE_MOC_FILES_CPP(
+    platform/network/qt/DNSQt.cpp
+    platform/qt/MainThreadSharedTimerQt.cpp
+)
+
+QTWEBKIT_GENERATE_MOC_FILES_H(
+    platform/network/qt/CookieJarQt.h
+    platform/network/qt/QNetworkReplyHandler.h
+    platform/network/qt/QtMIMETypeSniffer.h
+)
+
+QTWEBKIT_GENERATE_MOC_FILE_H(platform/network/qt/NetworkStateNotifierPrivate.h platform/network/qt/NetworkStateNotifierQt.cpp)
+QTWEBKIT_GENERATE_MOC_FILE_H(platform/network/qt/SocketStreamHandlePrivate.h platform/network/qt/SocketStreamHandleQt.cpp)
+
 if (COMPILER_IS_GCC_OR_CLANG)
     set_source_files_properties(
         platform/graphics/qt/ImageBufferDataQt.cpp
@@ -183,6 +197,7 @@ if (ENABLE_GAMEPAD_DEPRECATED)
     list(APPEND WebCore_SOURCES
         platform/qt/GamepadsQt.cpp
     )
+    QTWEBKIT_GENERATE_MOC_FILES_CPP(platform/qt/GamepadsQt.cpp)
 endif ()
 
 if (ENABLE_GRAPHICS_CONTEXT_3D)
@@ -359,6 +374,7 @@ if (USE_QT_MULTIMEDIA)
     list(APPEND WebCore_LIBRARIES
         ${Qt5Multimedia_LIBRARIES}
     )
+    QTWEBKIT_GENERATE_MOC_FILES_H(platform/graphics/qt/MediaPlayerPrivateQt.h)
 endif ()
 
 if (ENABLE_VIDEO)
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index 1bd6efcac..93bbd3cc4 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2006-2008, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -197,7 +197,7 @@ void ScriptController::getAllWorlds(Vector<Ref<DOMWrapperWorld>>& worlds)
     static_cast<JSVMClientData*>(JSDOMWindow::commonVM().clientData)->getAllWorlds(worlds);
 }
 
-void ScriptController::clearWindowShell(DOMWindow* newDOMWindow, bool goingIntoPageCache)
+void ScriptController::clearWindowShellsNotMatchingDOMWindow(DOMWindow* newDOMWindow, bool goingIntoPageCache)
 {
     if (m_windowShells.isEmpty())
         return;
@@ -205,16 +205,13 @@ void ScriptController::clearWindowShell(DOMWindow* newDOMWindow, bool goingIntoP
     JSLockHolder lock(JSDOMWindowBase::commonVM());
 
     Vector<JSC::Strong<JSDOMWindowShell>> windowShells = this->windowShells();
-    for (size_t i = 0; i < windowShells.size(); ++i) {
-        JSDOMWindowShell* windowShell = windowShells[i].get();
-
+    for (auto& windowShell : windowShells) {
         if (&windowShell->window()->wrapped() == newDOMWindow)
             continue;
 
         // Clear the debugger and console from the current window before setting the new window.
-        attachDebugger(windowShell, nullptr);
+        attachDebugger(windowShell.get(), nullptr);
         windowShell->window()->setConsoleClient(nullptr);
-
         // FIXME: We should clear console profiles for each frame as soon as the frame is destroyed.
         // Instead of clearing all of them when the main frame is destroyed.
         if (m_frame.isMainFrame()) {
@@ -223,24 +220,39 @@ void ScriptController::clearWindowShell(DOMWindow* newDOMWindow, bool goingIntoP
         }
 
         windowShell->window()->willRemoveFromWindowShell();
-        windowShell->setWindow(newDOMWindow);
+    }
+
+    // It's likely that resetting our windows created a lot of garbage, unless
+    // it went in a back/forward cache.
+    if (!goingIntoPageCache)
+        collectGarbageAfterWindowShellDestruction();
+}
 
+void ScriptController::setDOMWindowForWindowShell(DOMWindow* newDOMWindow)
+{
+    if (m_windowShells.isEmpty())
+        return;
+    
+    JSLockHolder lock(JSDOMWindowBase::commonVM());
+    
+    Vector<JSC::Strong<JSDOMWindowShell>> windowShells = this->windowShells();
+    for (auto& windowShell : windowShells) {
+        if (&windowShell->window()->wrapped() == newDOMWindow)
+            continue;
+        
+        windowShell->setWindow(newDOMWindow);
+        
         // An m_cacheableBindingRootObject persists between page navigations
         // so needs to know about the new JSDOMWindow.
         if (m_cacheableBindingRootObject)
             m_cacheableBindingRootObject->updateGlobalObject(windowShell->window());
-
+        
         if (Page* page = m_frame.page()) {
-            attachDebugger(windowShell, page->debugger());
+            attachDebugger(windowShell.get(), page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
             windowShell->window()->setConsoleClient(&page->console());
         }
     }
-
-    // It's likely that resetting our windows created a lot of garbage, unless
-    // it went in a back/forward cache.
-    if (!goingIntoPageCache)
-        collectGarbageAfterWindowShellDestruction();
 }
 
 JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld& world)
diff --git a/Source/WebCore/bindings/js/ScriptController.h b/Source/WebCore/bindings/js/ScriptController.h
index 62a51b855..6f65c722e 100644
--- a/Source/WebCore/bindings/js/ScriptController.h
+++ b/Source/WebCore/bindings/js/ScriptController.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -135,7 +135,8 @@ public:
 
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
-    void clearWindowShell(DOMWindow* newDOMWindow, bool goingIntoPageCache);
+    void clearWindowShellsNotMatchingDOMWindow(DOMWindow* newDOMWindow, bool goingIntoPageCache);
+    void setDOMWindowForWindowShell(DOMWindow* newDOMWindow);
     void updateDocument();
 
     void namedItemAdded(HTMLDocument*, const AtomicString&) { }
diff --git a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp
index d3126773f..44d7c5738 100644
--- a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp
+++ b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,6 +43,11 @@ ContentExtensionStyleSheet::ContentExtensionStyleSheet(Document& document)
     m_styleSheet->contents().setIsUserStyleSheet(true);
 }
 
+ContentExtensionStyleSheet::~ContentExtensionStyleSheet()
+{
+    m_styleSheet->clearOwnerNode();
+}
+
 bool ContentExtensionStyleSheet::addDisplayNoneSelector(const String& selector, uint32_t selectorID)
 {
     ASSERT(selectorID != std::numeric_limits<uint32_t>::max());
diff --git a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.h b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.h
index a503b586a..514407676 100644
--- a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.h
+++ b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,6 +45,7 @@ public:
     {
         return adoptRef(*new ContentExtensionStyleSheet(document));
     }
+    virtual ~ContentExtensionStyleSheet();
 
     bool addDisplayNoneSelector(const String& selector, uint32_t selectorID);
 
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index f34a1c15f..2598b0f1e 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -1769,6 +1769,8 @@ void Document::scheduleForcedStyleRecalc()
 
 void Document::scheduleStyleRecalc()
 {
+    ASSERT(!m_renderView || !m_renderView->inHitTesting());
+
     if (m_styleRecalcTimer.isActive() || inPageCache())
         return;
 
diff --git a/Source/WebCore/dom/InlineStyleSheetOwner.cpp b/Source/WebCore/dom/InlineStyleSheetOwner.cpp
index e6e7acdb0..83574842c 100644
--- a/Source/WebCore/dom/InlineStyleSheetOwner.cpp
+++ b/Source/WebCore/dom/InlineStyleSheetOwner.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Rob Buis
- * Copyright (C) 2008, 2013 Apple, Inc. All rights reserved.
+ * Copyright (C) 2008-2016 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -46,6 +46,8 @@ InlineStyleSheetOwner::InlineStyleSheetOwner(Document& document, bool createdByP
 
 InlineStyleSheetOwner::~InlineStyleSheetOwner()
 {
+    if (m_sheet)
+        clearSheet();
 }
 
 static AuthorStyleSheets& authorStyleSheetsForElement(Element& element)
diff --git a/Source/WebCore/editing/AlternativeTextController.cpp b/Source/WebCore/editing/AlternativeTextController.cpp
index 73102571a..32c204d14 100644
--- a/Source/WebCore/editing/AlternativeTextController.cpp
+++ b/Source/WebCore/editing/AlternativeTextController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2008, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -315,6 +315,8 @@ void AlternativeTextController::respondToUnappliedSpellCorrection(const VisibleS
 {
     if (AlternativeTextClient* client = alternativeTextClient())
         client->recordAutocorrectionResponse(AutocorrectionReverted, corrected, correction);
+
+    Ref<Frame> protector(m_frame);
     m_frame.document()->updateLayout();
     m_frame.selection().setSelection(selectionOfCorrected, FrameSelection::defaultSetSelectionOptions() | FrameSelection::SpellCorrectionTriggered);
     RefPtr<Range> range = Range::create(*m_frame.document(), m_frame.selection().selection().start(), m_frame.selection().selection().end());
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index cdbfbda74..41a9730ab 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2011, 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2008, 2011, 2013-2016 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1743,6 +1743,8 @@ void Editor::setComposition(const String& text, SetCompositionMode mode)
 
 void Editor::setComposition(const String& text, const Vector<CompositionUnderline>& underlines, unsigned selectionStart, unsigned selectionEnd)
 {
+    Ref<Frame> protection(m_frame);
+
     UserTypingGestureIndicator typingGestureIndicator(m_frame);
 
     setIgnoreCompositionSelectionChange(true);
@@ -1876,6 +1878,8 @@ void Editor::learnSpelling()
 #if !PLATFORM(IOS)
 void Editor::advanceToNextMisspelling(bool startBeforeSelection)
 {
+    Ref<Frame> protection(m_frame);
+
     // The basic approach is to search in two phases - from the selection end to the end of the doc, and
     // then we wrap and search from the doc start to (approximately) where we started.
     
@@ -2191,6 +2195,8 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelecti
 
 void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping, bool doReplacement)
 {
+    Ref<Frame> protection(m_frame);
+
 #if PLATFORM(IOS)
     UNUSED_PARAM(selectionAfterTyping);
     UNUSED_PARAM(doReplacement);
@@ -2437,6 +2443,7 @@ static void correctSpellcheckingPreservingTextCheckingParagraph(TextCheckingPara
 
 void Editor::markAndReplaceFor(PassRefPtr<SpellCheckRequest> request, const Vector<TextCheckingResult>& results)
 {
+    Ref<Frame> protection(m_frame);
     ASSERT(request);
 
     TextCheckingTypeMask textCheckingOptions = request->data().mask();
@@ -2889,6 +2896,8 @@ void Editor::dismissCorrectionPanelAsIgnored()
 
 void Editor::changeSelectionAfterCommand(const VisibleSelection& newSelection, FrameSelection::SetSelectionOptions options, AXTextStateChangeIntent intent)
 {
+    Ref<Frame> protection(m_frame);
+
     // If the new selection is orphaned, then don't update the selection.
     if (newSelection.start().isOrphan() || newSelection.end().isOrphan())
         return;
@@ -3079,6 +3088,8 @@ void Editor::applyEditingStyleToElement(Element* element) const
 
 bool Editor::findString(const String& target, FindOptions options)
 {
+    Ref<Frame> protection(m_frame);
+
     VisibleSelection selection = m_frame.selection().selection();
 
     RefPtr<Range> resultRange = rangeOfString(target, selection.firstRange().get(), options);
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index 82e5daa66..92674c58a 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2008, 2014, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Igalia S.L.
  *
@@ -1064,6 +1064,7 @@ static bool executeSuperscript(Frame& frame, Event*, EditorCommandSource source,
 
 static bool executeSwapWithMark(Frame& frame, Event*, EditorCommandSource, const String&)
 {
+    Ref<Frame> protector(frame);
     const VisibleSelection& mark = frame.editor().mark();
     const VisibleSelection& selection = frame.selection().selection();
     if (mark.isNone() || selection.isNone()) {
diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
index a0f912ab0..f8b4509df 100644
--- a/Source/WebCore/editing/TypingCommand.cpp
+++ b/Source/WebCore/editing/TypingCommand.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2005-2008, 2016 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -438,6 +438,7 @@ bool TypingCommand::makeEditableRootEmpty()
 void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool shouldAddToKillRing)
 {
     Frame& frame = this->frame();
+    Ref<Frame> protector(frame);
 
     frame.editor().updateMarkersForWordsAffectedByEditing(false);
 
@@ -547,6 +548,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool shouldAdd
 void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool shouldAddToKillRing)
 {
     Frame& frame = this->frame();
+    Ref<Frame> protector(frame);
 
     frame.editor().updateMarkersForWordsAffectedByEditing(false);
 
diff --git a/Source/WebCore/loader/DocumentWriter.cpp b/Source/WebCore/loader/DocumentWriter.cpp
index 442e3bf57..593c0a5e7 100644
--- a/Source/WebCore/loader/DocumentWriter.cpp
+++ b/Source/WebCore/loader/DocumentWriter.cpp
@@ -71,6 +71,12 @@ DocumentWriter::DocumentWriter(Frame* frame)
 void DocumentWriter::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader().stopAllLoaders();
+
+    // If we are in the midst of changing the frame's document, don't execute script
+    // that modifes the document further:
+    if (m_frame->documentIsBeingReplaced())
+        return;
+
     begin(m_frame->document()->url(), true, ownerDocument);
 
     // begin() might fire an unload event, which will result in a situation where no new document has been attached,
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 705b0f5a5..1d6c60ba5 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -591,7 +591,7 @@ void FrameLoader::clear(Document* newDocument, bool clearWindowProperties, bool
     if (clearWindowProperties) {
         InspectorInstrumentation::frameWindowDiscarded(&m_frame, m_frame.document()->domWindow());
         m_frame.document()->domWindow()->resetUnlessSuspendedForDocumentSuspension();
-        m_frame.script().clearWindowShell(newDocument->domWindow(), m_frame.document()->inPageCache());
+        m_frame.script().clearWindowShellsNotMatchingDOMWindow(newDocument->domWindow(), m_frame.document()->inPageCache());
     }
 
     m_frame.selection().prepareForDestruction();
@@ -609,6 +609,9 @@ void FrameLoader::clear(Document* newDocument, bool clearWindowProperties, bool
 
     subframeLoader().clear();
 
+    if (clearWindowProperties)
+        m_frame.script().setDOMWindowForWindowShell(newDocument->domWindow());
+
     if (clearScriptObjects)
         m_frame.script().clearScriptObjects();
 
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 47e5fc970..d528a92cd 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2007, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Igalia S.L
  *
  * Redistribution and use in source and binary forms, with or without
@@ -223,6 +223,8 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuAction action, co
     if (!frame)
         return;
 
+    Ref<Frame> protector(*frame);
+
     switch (action) {
     case ContextMenuItemTagOpenLinkInNewWindow:
         openNewWindow(m_context.hitTestResult().absoluteLinkURL(), frame, ShouldOpenExternalURLsPolicy::ShouldAllowExternalSchemes);
diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index e119f64d8..064f76837 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -203,7 +203,7 @@ void DOMSelection::collapse(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -219,6 +219,7 @@ void DOMSelection::collapseToEnd(ExceptionCode& ec)
         return;
     }
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(selection.end(), DOWNSTREAM);
 }
 
@@ -234,6 +235,7 @@ void DOMSelection::collapseToStart(ExceptionCode& ec)
         return;
     }
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(selection.start(), DOWNSTREAM);
 }
 
@@ -257,7 +259,7 @@ void DOMSelection::setBaseAndExtent(Node* baseNode, int baseOffset, Node* extent
     if (!isValidForPosition(baseNode) || !isValidForPosition(extentNode))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(baseNode, baseOffset), createLegacyEditingPosition(extentNode, extentOffset), DOWNSTREAM);
 }
 
@@ -273,7 +275,7 @@ void DOMSelection::setPosition(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -324,6 +326,7 @@ void DOMSelection::modify(const String& alterString, const String& directionStri
     else
         return;
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().modify(alter, direction, granularity);
 }
 
@@ -345,7 +348,7 @@ void DOMSelection::extend(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().setExtent(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -385,6 +388,8 @@ void DOMSelection::addRange(Range* r)
     if (!r)
         return;
 
+    Ref<Frame> protector(*m_frame);
+
     FrameSelection& selection = m_frame->selection();
 
     if (selection.isNone()) {
@@ -433,6 +438,7 @@ void DOMSelection::deleteFromDocument()
     if (!selectedRange)
         return;
 
+    Ref<Frame> protector(*m_frame);
     selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
 
     setBaseAndExtent(&selectedRange->startContainer(), selectedRange->startOffset(), &selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index c4cbb67ef..7a874db56 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009, 2010, 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009-2010, 2013, 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -432,6 +432,7 @@ DragOperation DragController::operationForLoad(DragData& dragData)
 
 static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
 {
+    Ref<Frame> protector(*frame);
     frame->selection().setSelection(dragCaret);
     if (frame->selection().selection().isNone()) {
         dragCaret = frame->visiblePositionForPoint(point);
@@ -752,6 +753,7 @@ bool DragController::startDrag(Frame& src, const DragState& state, DragOperation
     if (!src.view() || !src.contentRenderer() || !state.source)
         return false;
 
+    Ref<Frame> protector(src);
     HitTestResult hitTestResult = src.eventHandler().hitTestResultAtPoint(dragOrigin, HitTestRequest::ReadOnly | HitTestRequest::Active);
 
     // FIXME(136836): Investigate whether all elements should use the containsIncludingShadowDOM() path here.
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index a40b4bfab..97a0d2d39 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1138,8 +1138,8 @@ HitTestResult EventHandler::hitTestResultAtPoint(const LayoutPoint& point, HitTe
     }
 
     // We should always start hit testing a clean tree.
-    if (m_frame.document())
-        m_frame.document()->updateLayoutIgnorePendingStylesheets();
+    if (auto* frameView = m_frame.view())
+        frameView->updateLayoutAndStyleIfNeededRecursive();
     HitTestResult result(point, padding.height(), padding.width(), padding.height(), padding.width());
     RenderView* renderView = m_frame.contentRenderer();
     if (!renderView)
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 9315237af..f447d5ded 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -267,6 +267,11 @@ void Frame::setDocument(RefPtr<Document>&& newDocument)
 {
     ASSERT(!newDocument || newDocument->frame() == this);
 
+    if (m_documentIsBeingReplaced)
+        return;
+
+    m_documentIsBeingReplaced = true;
+    
     if (m_doc && m_doc->pageCacheState() != Document::InPageCache)
         m_doc->prepareForDestruction();
 
@@ -280,6 +285,8 @@ void Frame::setDocument(RefPtr<Document>&& newDocument)
         newDocument->didBecomeCurrentDocumentInFrame();
 
     InspectorInstrumentation::frameDocumentUpdated(this);
+
+    m_documentIsBeingReplaced = false;
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -603,6 +610,8 @@ int Frame::checkOverflowScroll(OverflowScrollAction action)
         }
     }
 
+    Ref<Frame> protectedThis(*this);
+
     if (action == PerformOverflowScroll && (deltaX || deltaY)) {
         layer->scrollToOffset(layer->scrollOffset() + IntSize(deltaX, deltaY));
 
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index d0e22ef4e..f43a93ecb 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -162,6 +162,8 @@ namespace WebCore {
         WEBCORE_EXPORT RenderView* contentRenderer() const; // Root of the render tree for the document contained in this frame.
         WEBCORE_EXPORT RenderWidget* ownerRenderer() const; // Renderer for the element that contains this frame.
 
+        bool documentIsBeingReplaced() const { return m_documentIsBeingReplaced; }
+
     // ======== All public functions below this point are candidates to move out of Frame into another class. ========
 
         void injectUserScripts(UserScriptInjectionTime);
@@ -329,6 +331,7 @@ namespace WebCore {
 
         int m_activeDOMObjectsAndAnimationsSuspendedCount;
         bool m_mainFrameWasDestroyed { false };
+        bool m_documentIsBeingReplaced { false };
 
     protected:
         std::unique_ptr<EventHandler> m_eventHandler;
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index bf35cf8b2..2983a2d92 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -2741,8 +2741,10 @@ void FrameView::setNeedsLayout()
         return;
     }
 
-    if (RenderView* renderView = this->renderView())
+    if (auto* renderView = this->renderView()) {
+        ASSERT(!renderView->inHitTesting());
         renderView->setNeedsLayout();
+    }
 }
 
 void FrameView::unscheduleRelayout()
diff --git a/Source/WebCore/page/TextIndicator.cpp b/Source/WebCore/page/TextIndicator.cpp
index fd0c0ba73..768fd9aa7 100644
--- a/Source/WebCore/page/TextIndicator.cpp
+++ b/Source/WebCore/page/TextIndicator.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -69,6 +69,8 @@ RefPtr<TextIndicator> TextIndicator::createWithRange(const Range& range, TextInd
     if (!frame)
         return nullptr;
 
+    Ref<Frame> protector(*frame);
+
 #if PLATFORM(IOS)
     frame->editor().setIgnoreCompositionSelectionChange(true);
     frame->selection().setUpdateAppearanceEnabled(true);
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp
index b6bdf60ca..0610c85b6 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp
@@ -47,6 +47,7 @@
 
 #include <wtf/MainThread.h>
 #include <wtf/NeverDestroyed.h>
+#include <wtf/text/win/WCharStringExtras.h>
 
 SOFT_LINK_LIBRARY(Mf);
 SOFT_LINK_OPTIONAL(Mf, MFCreateSourceResolver, HRESULT, STDAPICALLTYPE, (IMFSourceResolver**));
@@ -98,6 +99,7 @@ MediaPlayerPrivateMediaFoundation::MediaPlayerPrivateMediaFoundation(MediaPlayer
     , m_hasVideo(false)
     , m_preparingToPlay(false)
     , m_hwndVideo(nullptr)
+    , m_volume(1.0)
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
     , m_weakPtrFactory(this)
@@ -147,7 +149,7 @@ static const HashSet<String, ASCIICaseInsensitiveHash>& mimeTypeCache()
     if (SUCCEEDED(hr)) {
         CALPWSTR mimeTypeArray = propVarMimeTypeArray.calpwstr;
         for (unsigned i = 0; i < mimeTypeArray.cElems; i++)
-            cachedTypes.get().add(mimeTypeArray.pElems[i]);
+            cachedTypes.get().add(nullTerminatedWCharToString(mimeTypeArray.pElems[i]));
     }
 
     PropVariantClear(&propVarMimeTypeArray);
@@ -173,6 +175,11 @@ MediaPlayer::SupportsType MediaPlayerPrivateMediaFoundation::supportsType(const
 
 void MediaPlayerPrivateMediaFoundation::load(const String& url)
 {
+    {
+        LockHolder locker(m_cachedNaturalSizeLock);
+        m_cachedNaturalSize = FloatSize();
+    }
+
     startCreateMediaSource(url);
 
     m_networkState = MediaPlayer::Loading;
@@ -215,9 +222,10 @@ bool MediaPlayerPrivateMediaFoundation::supportsFullscreen() const
     return true;
 }
 
-FloatSize MediaPlayerPrivateMediaFoundation::naturalSize() const 
+FloatSize MediaPlayerPrivateMediaFoundation::naturalSize() const
 {
-    return m_size;
+    LockHolder locker(m_cachedNaturalSizeLock);
+    return m_cachedNaturalSize;
 }
 
 bool MediaPlayerPrivateMediaFoundation::hasVideo() const
@@ -299,16 +307,27 @@ bool MediaPlayerPrivateMediaFoundation::paused() const
     return m_paused;
 }
 
-void MediaPlayerPrivateMediaFoundation::setVolume(float volume)
+bool MediaPlayerPrivateMediaFoundation::setAllChannelVolumes(float volume)
 {
     if (!MFGetServicePtr())
-        return;
+        return false;
 
-    COMPtr<IMFSimpleAudioVolume> audioVolume;
-    if (SUCCEEDED(MFGetServicePtr()(m_mediaSession.get(), MR_POLICY_VOLUME_SERVICE, __uuidof(IMFSimpleAudioVolume), (void **)&audioVolume))) {
-        HRESULT hr = audioVolume->SetMasterVolume(volume);
-        ASSERT(SUCCEEDED(hr));
-    }
+    COMPtr<IMFAudioStreamVolume> audioVolume;
+    if (!SUCCEEDED(MFGetServicePtr()(m_mediaSession.get(), MR_STREAM_VOLUME_SERVICE, __uuidof(IMFAudioStreamVolume), (void **)&audioVolume)))
+        return false;
+
+    UINT32 channelsCount;
+    HRESULT hr = audioVolume->GetChannelCount(&channelsCount);
+    ASSERT(SUCCEEDED(hr));
+
+    Vector<float> volumes(channelsCount, volume);
+    return SUCCEEDED(audioVolume->SetAllVolumes(channelsCount, volumes.data()));
+}
+
+void MediaPlayerPrivateMediaFoundation::setVolume(float volume)
+{
+    if (setAllChannelVolumes(volume))
+        m_volume = volume;
 }
 
 bool MediaPlayerPrivateMediaFoundation::supportsMuting() const
@@ -318,14 +337,7 @@ bool MediaPlayerPrivateMediaFoundation::supportsMuting() const
 
 void MediaPlayerPrivateMediaFoundation::setMuted(bool muted)
 {
-    if (!MFGetServicePtr())
-        return;
-
-    COMPtr<IMFSimpleAudioVolume> audioVolume;
-    if (SUCCEEDED(MFGetServicePtr()(m_mediaSession.get(), MR_POLICY_VOLUME_SERVICE, __uuidof(IMFSimpleAudioVolume), (void **)&audioVolume))) {
-        HRESULT hr = audioVolume->SetMute(muted ? TRUE : FALSE);
-        ASSERT(SUCCEEDED(hr));
-    }
+    setAllChannelVolumes(muted ? 0.0 : m_volume);
 }
 
 MediaPlayer::NetworkState MediaPlayerPrivateMediaFoundation::networkState() const
@@ -465,7 +477,7 @@ bool MediaPlayerPrivateMediaFoundation::startCreateMediaSource(const String& url
         return false;
 
     COMPtr<IUnknown> cancelCookie;
-    Vector<UChar> urlSource = url.charactersWithNullTermination();
+    Vector<wchar_t> urlSource = stringToNullTerminatedWChar(url);
 
     AsyncCallback* callback = new AsyncCallback(this, false);
 
@@ -749,6 +761,12 @@ void MediaPlayerPrivateMediaFoundation::notifyDeleted()
         (*it)->onMediaPlayerDeleted();
 }
 
+void MediaPlayerPrivateMediaFoundation::setNaturalSize(const FloatSize& size)
+{
+    LockHolder locker(m_cachedNaturalSizeLock);
+    m_cachedNaturalSize = size;
+}
+
 bool MediaPlayerPrivateMediaFoundation::createOutputNode(COMPtr<IMFStreamDescriptor> sourceSD, COMPtr<IMFTopologyNode>& node)
 {
     if (!MFCreateTopologyNodePtr() || !MFCreateAudioRendererActivatePtr() || !MFCreateVideoRendererActivatePtr())
@@ -1554,6 +1572,22 @@ static bool areMediaTypesEqual(IMFMediaType* type1, IMFMediaType* type2)
     return S_OK == type1->IsEqual(type2, &flags);
 }
 
+static FloatSize calculateNaturalSize(IMFMediaType* mediaType)
+{
+    UINT32 width = 0, height = 0;
+    HRESULT hr = MFGetAttributeSize(mediaType, MF_MT_FRAME_SIZE, &width, &height);
+    if (FAILED(hr) || !height)
+        return FloatSize();
+
+    UINT32 pixelAspectRatioNumerator = 0;
+    UINT32 pixelAspectRatioDenominator = 0;
+    hr = MFGetAttributeRatio(mediaType, MF_MT_PIXEL_ASPECT_RATIO, &pixelAspectRatioNumerator, &pixelAspectRatioDenominator);
+    if (SUCCEEDED(hr) && pixelAspectRatioNumerator && pixelAspectRatioDenominator)
+        return FloatSize(float(width) * pixelAspectRatioNumerator / pixelAspectRatioDenominator, height);
+
+    return FloatSize();
+}
+
 HRESULT MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::setMediaType(IMFMediaType* mediaType)
 {
     if (!mediaType) {
@@ -1611,6 +1645,10 @@ HRESULT MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::setMediaType(IM
         m_scheduler.setFrameRate(defaultFrameRate);
     }
 
+    // Update natural size
+    if (m_mediaPlayer)
+        m_mediaPlayer->setNaturalSize(calculateNaturalSize(mediaType));
+
     ASSERT(mediaType);
     m_mediaType = mediaType;
 
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.h b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.h
index 2fdce58ee..c3303cf7b 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.h
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.h
@@ -112,6 +112,7 @@ private:
     bool m_hasAudio;
     bool m_hasVideo;
     bool m_preparingToPlay;
+    float m_volume;
     HWND m_hwndVideo;
     MediaPlayer::NetworkState m_networkState;
     MediaPlayer::ReadyState m_readyState;
@@ -121,6 +122,9 @@ private:
     HashSet<MediaPlayerListener*> m_listeners;
     Lock m_mutexListeners;
 
+    FloatSize m_cachedNaturalSize;
+    mutable Lock m_cachedNaturalSizeLock;
+
     WeakPtrFactory<MediaPlayerPrivateMediaFoundation> m_weakPtrFactory;
     COMPtr<IMFMediaSession> m_mediaSession;
     COMPtr<IMFSourceResolver> m_sourceResolver;
@@ -158,10 +162,13 @@ private:
 
     void addListener(MediaPlayerListener*);
     void removeListener(MediaPlayerListener*);
+    void setNaturalSize(const FloatSize&);
     void notifyDeleted();
 
     static LRESULT CALLBACK VideoViewWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
 
+    bool setAllChannelVolumes(float);
+
     class MediaPlayerListener {
     public:
         MediaPlayerListener() { }
diff --git a/Source/WebCore/platform/mock/mediasource/MockBox.cpp b/Source/WebCore/platform/mock/mediasource/MockBox.cpp
index 31028030d..149827610 100644
--- a/Source/WebCore/platform/mock/mediasource/MockBox.cpp
+++ b/Source/WebCore/platform/mock/mediasource/MockBox.cpp
@@ -31,6 +31,7 @@
 #include <runtime/ArrayBuffer.h>
 #include <runtime/DataView.h>
 #include <runtime/Int8Array.h>
+#include <runtime/TypedArrayInlines.h>
 #include <wtf/NeverDestroyed.h>
 #include <wtf/text/StringBuilder.h>
 
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index bf1a78a7f..b2d056f94 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -2751,7 +2751,9 @@ void RenderBlock::computePreferredLogicalWidths()
 {
     ASSERT(preferredLogicalWidthsDirty());
 
-    updateFirstLetter();
+    // FIXME: Do not even try to reshuffle first letter renderers when we are not in layout
+    // until after webkit.org/b/163848 is fixed.
+    updateFirstLetter(view().frameView().isInRenderTreeLayout() ? RenderTreeMutationIsAllowed::Yes : RenderTreeMutationIsAllowed::No);
 
     m_minPreferredLogicalWidth = 0;
     m_maxPreferredLogicalWidth = 0;
@@ -3301,7 +3303,7 @@ void RenderBlock::getFirstLetter(RenderObject*& firstLetter, RenderElement*& fir
         firstLetterContainer = nullptr;
 }
 
-void RenderBlock::updateFirstLetter()
+void RenderBlock::updateFirstLetter(RenderTreeMutationIsAllowed mutationAllowedOrNot)
 {
     RenderObject* firstLetterObj;
     RenderElement* firstLetterContainer;
@@ -3322,6 +3324,8 @@ void RenderBlock::updateFirstLetter()
     if (!is<RenderText>(*firstLetterObj))
         return;
 
+    if (mutationAllowedOrNot != RenderTreeMutationIsAllowed::Yes)
+        return;
     // Our layout state is not valid for the repaints we are going to trigger by
     // adding and removing children of firstLetterContainer.
     LayoutStateDisabler layoutStateDisabler(view());
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 49468c586..b8292b138 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -243,7 +243,8 @@ public:
     LayoutUnit collapsedMarginBeforeForChild(const RenderBox& child) const;
     LayoutUnit collapsedMarginAfterForChild(const RenderBox& child) const;
 
-    virtual void updateFirstLetter();
+    enum class RenderTreeMutationIsAllowed { Yes, No };
+    virtual void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes);
     void getFirstLetter(RenderObject*& firstLetter, RenderElement*& firstLetterContainer, RenderObject* skipObject = nullptr);
 
     virtual void scrollbarsChanged(bool /*horizontalScrollbarChanged*/, bool /*verticalScrollbarChanged*/) { }
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index e4809d288..2fe6cbfa8 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -55,6 +55,7 @@
 #include "RenderIterator.h"
 #include "RenderLayer.h"
 #include "RenderLayerCompositor.h"
+#include "RenderMultiColumnFlowThread.h"
 #include "RenderNamedFlowFragment.h"
 #include "RenderNamedFlowThread.h"
 #include "RenderTableCell.h"
@@ -2264,6 +2265,21 @@ LayoutRect RenderBox::computeRectForRepaint(const LayoutRect& rect, const Render
         adjustedRect.expand(locationOffset - flooredLocationOffset);
         locationOffset = flooredLocationOffset;
     }
+
+    if (is<RenderMultiColumnFlowThread>(this)) {
+        // We won't normally run this code. Only when the repaintContainer is null (i.e., we're trying
+        // to get the rect in view coordinates) will we come in here, since normally repaintContainer
+        // will be set and we'll stop at the flow thread. This case is mainly hit by the check for whether
+        // or not images should animate.
+        // FIXME: Just as with offsetFromContainer, we aren't really handling objects that span
+        // multiple columns properly.
+        LayoutPoint physicalPoint(flipForWritingMode(adjustedRect.location()));
+        if (auto* region = downcast<RenderMultiColumnFlowThread>(*this).physicalTranslationFromFlowToRegion((physicalPoint))) {
+            adjustedRect.setLocation(region->flipForWritingMode(physicalPoint));
+            return region->computeRectForRepaint(adjustedRect, repaintContainer, fixed);
+        }
+    }
+
     LayoutPoint topLeft = adjustedRect.location();
     topLeft.move(locationOffset);
 
@@ -3107,17 +3123,22 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(SizeType heightType, Len
         case Percent:
         case Calculated:
         {
-            auto cb = isOutOfFlowPositioned() ? container() : containingBlock();
-            while (cb && cb->isAnonymous() && !is<RenderView>(*cb)) {
-                cb = cb->containingBlock();
-                downcast<RenderBlock>(*cb).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
+            auto* container = isOutOfFlowPositioned() ? this->container() : containingBlock();
+            while (container && container->isAnonymous()) {
+                // Stop at rendering context root.
+                if (is<RenderView>(*container) || is<RenderNamedFlowThread>(*container))
+                    break;
+                container = container->containingBlock();
+                downcast<RenderBlock>(*container).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
             }
 
             // FIXME: This calculation is not patched for block-flow yet.
             // https://bugs.webkit.org/show_bug.cgi?id=46500
-            if (cb->isOutOfFlowPositioned() && cb->style().height().isAuto() && !(cb->style().top().isAuto() || cb->style().bottom().isAuto())) {
-                ASSERT_WITH_SECURITY_IMPLICATION(cb->isRenderBlock());
-                RenderBlock& block = downcast<RenderBlock>(*cb);
+            if (container->isOutOfFlowPositioned()
+                && container->style().height().isAuto()
+                && !(container->style().top().isAuto() || container->style().bottom().isAuto())) {
+                ASSERT_WITH_SECURITY_IMPLICATION(container->isRenderBlock());
+                auto& block = downcast<RenderBlock>(*container);
                 LogicalExtentComputedValues computedValues;
                 block.computeLogicalHeight(block.logicalHeight(), 0, computedValues);
                 LayoutUnit newContentHeight = computedValues.m_extent - block.borderAndPaddingLogicalHeight() - block.scrollbarLogicalHeight();
@@ -3130,7 +3151,7 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(SizeType heightType, Len
             // https://bugs.webkit.org/show_bug.cgi?id=46496
             LayoutUnit availableHeight;
             if (isOutOfFlowPositioned())
-                availableHeight = containingBlockLogicalHeightForPositioned(downcast<RenderBoxModelObject>(cb));
+                availableHeight = containingBlockLogicalHeightForPositioned(downcast<RenderBoxModelObject>(container));
             else {
                 availableHeight = containingBlockLogicalHeightForContent(IncludeMarginBorderPadding);
                 // It is necessary to use the border-box to match WinIE's broken
@@ -3138,15 +3159,16 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(SizeType heightType, Len
                 // table cells using percentage heights.
                 // FIXME: This needs to be made block-flow-aware.  If the cell and image are perpendicular block-flows, this isn't right.
                 // https://bugs.webkit.org/show_bug.cgi?id=46997
-                while (cb && !is<RenderView>(*cb) && (cb->style().logicalHeight().isAuto() || cb->style().logicalHeight().isPercentOrCalculated())) {
-                    if (cb->isTableCell()) {
+                while (container && !is<RenderView>(*container)
+                    && (container->style().logicalHeight().isAuto() || container->style().logicalHeight().isPercentOrCalculated())) {
+                    if (container->isTableCell()) {
                         // Don't let table cells squeeze percent-height replaced elements
                         // <http://bugs.webkit.org/show_bug.cgi?id=15359>
                         availableHeight = std::max(availableHeight, intrinsicLogicalHeight());
                         return valueForLength(logicalHeight, availableHeight - borderAndPaddingLogicalHeight());
                     }
-                    downcast<RenderBlock>(*cb).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
-                    cb = cb->containingBlock();
+                    downcast<RenderBlock>(*container).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
+                    container = container->containingBlock();
                 }
             }
             return adjustContentBoxLogicalHeightForBoxSizing(valueForLength(logicalHeight, availableHeight));
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index 9ce483c2b..06e75c28d 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -273,7 +273,7 @@ void RenderListItem::insertOrMoveMarkerRendererIfNeeded()
     if (!m_marker)
         return;
 
-    // FIXME: Do not even try reposition the marker when we are not in layout
+    // FIXME: Do not even try to reposition the marker when we are not in layout
     // until after we fixed webkit.org/b/163789.
     if (!view().frameView().isInRenderTreeLayout())
         return;
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index 8abbf9549..3d614add1 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -106,7 +106,7 @@ RenderBlock* RenderRubyRun::firstLineBlock() const
     return 0;
 }
 
-void RenderRubyRun::updateFirstLetter()
+void RenderRubyRun::updateFirstLetter(RenderTreeMutationIsAllowed)
 {
 }
 
diff --git a/Source/WebCore/rendering/RenderRubyRun.h b/Source/WebCore/rendering/RenderRubyRun.h
index 65cf224a5..3e59ac5db 100644
--- a/Source/WebCore/rendering/RenderRubyRun.h
+++ b/Source/WebCore/rendering/RenderRubyRun.h
@@ -60,8 +60,8 @@ public:
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0) override;
     virtual void removeChild(RenderObject&) override;
 
-    virtual RenderBlock* firstLineBlock() const override;
-    virtual void updateFirstLetter() override;
+    RenderBlock* firstLineBlock() const override;
+    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
 
     void getOverhang(bool firstLine, RenderObject* startRenderer, RenderObject* endRenderer, float& startOverhang, float& endOverhang) const;
 
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index b3be2de98..4f325dfb9 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -1456,7 +1456,7 @@ RenderBlock* RenderTable::firstLineBlock() const
     return nullptr;
 }
 
-void RenderTable::updateFirstLetter()
+void RenderTable::updateFirstLetter(RenderTreeMutationIsAllowed)
 {
 }
 
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index e2b585146..f49592569 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -303,8 +303,8 @@ private:
 
     void invalidateCachedColumnOffsets();
 
-    virtual RenderBlock* firstLineBlock() const override final;
-    virtual void updateFirstLetter() override final;
+    RenderBlock* firstLineBlock() const final;
+    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) final;
     
     virtual void updateLogicalWidth() override final;
 
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 3c10cb5cf..5c374092c 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -52,6 +52,7 @@
 #include "StyleInheritedData.h"
 #include "TransformState.h"
 #include <wtf/StackStats.h>
+#include <wtf/TemporaryChange.h>
 
 namespace WebCore {
 
@@ -195,6 +196,10 @@ bool RenderView::hitTest(const HitTestRequest& request, HitTestResult& result)
 bool RenderView::hitTest(const HitTestRequest& request, const HitTestLocation& location, HitTestResult& result)
 {
     document().updateLayout();
+    
+#if !ASSERT_DISABLED
+    TemporaryChange<bool> hitTestRestorer { m_inHitTesting, true };
+#endif
 
     FrameFlatteningLayoutDisallower disallower(frameView());
 
diff --git a/Source/WebCore/rendering/RenderView.h b/Source/WebCore/rendering/RenderView.h
index 40aa58229..9279b9eec 100644
--- a/Source/WebCore/rendering/RenderView.h
+++ b/Source/WebCore/rendering/RenderView.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2006, 2015 Apple Inc.
+ * Copyright (C) 2006, 2015-2016 Apple Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -252,6 +252,10 @@ public:
     const HashSet<const RenderBox*>& boxesWithScrollSnapCoordinates() { return m_boxesWithScrollSnapCoordinates; }
 #endif
 
+#if !ASSERT_DISABLED
+    bool inHitTesting() const { return m_inHitTesting; }
+#endif
+
 protected:
     virtual void mapLocalToContainer(const RenderLayerModelObject* repaintContainer, TransformState&, MapCoordinatesFlags, bool* wasFixed) const override;
     virtual const RenderObject* pushMappingToContainer(const RenderLayerModelObject* ancestorToStopAt, RenderGeometryMap&) const override;
@@ -369,6 +373,9 @@ private:
     bool m_hasSoftwareFilters;
     bool m_usesFirstLineRules { false };
     bool m_usesFirstLetterRules { false };
+#if !ASSERT_DISABLED
+    bool m_inHitTesting { false };
+#endif
 
     HashSet<RenderElement*> m_renderersWithPausedImageAnimation;
     HashSet<RenderElement*> m_visibleInViewportRenderers;
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index 86063acb4..4bb8ef4bf 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -547,7 +547,7 @@ RenderBlock* RenderSVGText::firstLineBlock() const
 
 // Fix for <rdar://problem/8048875>. We should not render :first-letter CSS Style
 // in a SVG text element context.
-void RenderSVGText::updateFirstLetter()
+void RenderSVGText::updateFirstLetter(RenderTreeMutationIsAllowed)
 {
 }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 71be1cde3..b2271954b 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -91,8 +91,8 @@ private:
     virtual AffineTransform localTransform() const override { return m_localTransform; }
     virtual std::unique_ptr<RootInlineBox> createRootInlineBox() override;
 
-    virtual RenderBlock* firstLineBlock() const override;
-    virtual void updateFirstLetter() override;
+    RenderBlock* firstLineBlock() const override;
+    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
 
     bool shouldHandleSubtreeMutations() const;
 
diff --git a/Source/WebCore/style/StyleTreeResolver.cpp b/Source/WebCore/style/StyleTreeResolver.cpp
index d6be6658c..8ab152277 100644
--- a/Source/WebCore/style/StyleTreeResolver.cpp
+++ b/Source/WebCore/style/StyleTreeResolver.cpp
@@ -49,6 +49,7 @@
 #include "RenderWidget.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "StyleFontSizeFunctions.h"
 #include "StyleResolver.h"
 #include "Text.h"
 
@@ -105,6 +106,15 @@ static void ensurePlaceholderStyle(Document& document)
         return;
     placeholderStyle = &RenderStyle::create().leakRef();
     placeholderStyle->setDisplay(NONE);
+
+    FontCascadeDescription fontDescription;
+    fontDescription.setOneFamily(standardFamily);
+    fontDescription.setKeywordSizeFromIdentifier(CSSValueMedium);
+    float size = Style::fontSizeForKeyword(CSSValueMedium, false, document);
+    fontDescription.setSpecifiedSize(size);
+    fontDescription.setComputedSize(size);
+    placeholderStyle->setFontDescription(fontDescription);
+
     placeholderStyle->fontCascade().update(&document.fontSelector());
 }
 
diff --git a/Source/WebKit/qt/declarative/CMakeLists.txt b/Source/WebKit/qt/declarative/CMakeLists.txt
index 6a76e88b5..e1ba22bc1 100644
--- a/Source/WebKit/qt/declarative/CMakeLists.txt
+++ b/Source/WebKit/qt/declarative/CMakeLists.txt
@@ -38,6 +38,8 @@ set_target_properties(qmlwebkitplugin PROPERTIES
     ARCHIVE_OUTPUT_DIRECTORY_RELEASE ${qmlwebkit_output_dir}
     LIBRARY_OUTPUT_DIRECTORY_RELEASE ${qmlwebkit_output_dir}
     RUNTIME_OUTPUT_DIRECTORY_RELEASE ${qmlwebkit_output_dir}
+
+    AUTOMOC ON
 )
 
 add_custom_target(
diff --git a/Source/WebKit/qt/declarative/experimental/CMakeLists.txt b/Source/WebKit/qt/declarative/experimental/CMakeLists.txt
index e4d41798c..1526e6f47 100644
--- a/Source/WebKit/qt/declarative/experimental/CMakeLists.txt
+++ b/Source/WebKit/qt/declarative/experimental/CMakeLists.txt
@@ -15,6 +15,8 @@ set_target_properties(qmlwebkitexperimentalplugin PROPERTIES
     ARCHIVE_OUTPUT_DIRECTORY_RELEASE ${qmlwebkitexperimental_output_dir}
     LIBRARY_OUTPUT_DIRECTORY_RELEASE ${qmlwebkitexperimental_output_dir}
     RUNTIME_OUTPUT_DIRECTORY_RELEASE ${qmlwebkitexperimental_output_dir}
+
+    AUTOMOC ON
 )
 
 add_custom_target(
diff --git a/Source/WebKit/qt/tests/CMakeLists.txt b/Source/WebKit/qt/tests/CMakeLists.txt
index 4fd45c624..3dc6af1d5 100644
--- a/Source/WebKit/qt/tests/CMakeLists.txt
+++ b/Source/WebKit/qt/tests/CMakeLists.txt
@@ -57,7 +57,7 @@ foreach (testName ${QtWK1ApiTests})
     add_executable(tst_${testName} ${tst_${testName}_SOURCES})
     target_include_directories(tst_${testName} PRIVATE ${testName})
     target_link_libraries(tst_${testName} ${QtWK1ApiTests_LIBRARIES})
-    set_target_properties(tst_${testName} PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${QtWK1ApiTests_RUNTIME_OUTPUT_DIRECTORY})
+    set_target_properties(tst_${testName} PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${QtWK1ApiTests_RUNTIME_OUTPUT_DIRECTORY} AUTOMOC ON)
 
     add_test(${testName} "${QtWK1ApiTests_RUNTIME_OUTPUT_DIRECTORY}/tst_${testName}")
     set_tests_properties(${testName} PROPERTIES TIMEOUT 60)
diff --git a/Source/WebKit/win/Plugins/PluginDatabaseWin.cpp b/Source/WebKit/win/Plugins/PluginDatabaseWin.cpp
index ea272601b..8230a793c 100644
--- a/Source/WebKit/win/Plugins/PluginDatabaseWin.cpp
+++ b/Source/WebKit/win/Plugins/PluginDatabaseWin.cpp
@@ -32,6 +32,7 @@
 #include "URL.h"
 #include "PluginPackage.h"
 #include <wtf/WindowsExtras.h>
+#include <wtf/text/win/WCharStringExtras.h>
 
 namespace WebCore {
 
@@ -62,7 +63,7 @@ static inline void addPluginPathsFromRegistry(HKEY rootKey, HashSet<String>& pat
         if (result != ERROR_SUCCESS || type != REG_SZ)
             continue;
 
-        paths.add(String(pathStr, pathStrSize / sizeof(WCHAR) - 1));
+        paths.add(wcharToString(pathStr, pathStrSize / sizeof(WCHAR) - 1));
     }
 
     RegCloseKey(key);
@@ -83,7 +84,7 @@ void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
     for (Vector<String>::const_iterator it = m_pluginDirectories.begin(); it != end; ++it) {
         String pattern = *it + "\\*";
 
-        hFind = FindFirstFileW(pattern.charactersWithNullTermination().data(), &findFileData);
+        hFind = FindFirstFileW(stringToNullTerminatedWChar(pattern).data(), &findFileData);
 
         if (hFind == INVALID_HANDLE_VALUE)
             continue;
@@ -92,7 +93,7 @@ void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
             if (findFileData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
                 continue;
 
-            String filename = String(findFileData.cFileName, wcslen(findFileData.cFileName));
+            String filename = wcharToString(findFileData.cFileName, wcslen(findFileData.cFileName));
             if ((!filename.startsWith("np", false) || !filename.endsWith("dll", false)) &&
                 (!equalLettersIgnoringASCIICase(filename, "plugin.dll") || !it->endsWith("Shockwave 10", false)))
                 continue;
@@ -179,11 +180,11 @@ static inline void addMozillaPluginDirectories(Vector<String>& directories)
             if (result != ERROR_SUCCESS)
                 break;
 
-            String extensionsPath = String(name, nameLen) + "\\Extensions";
+            String extensionsPath = wcharToString(name, nameLen) + "\\Extensions";
             HKEY extensionsKey;
 
             // Try opening the key
-            result = RegOpenKeyEx(key, extensionsPath.charactersWithNullTermination().data(), 0, KEY_READ, &extensionsKey);
+            result = RegOpenKeyEx(key, stringToNullTerminatedWChar(extensionsPath).data(), 0, KEY_READ, &extensionsKey);
 
             if (result == ERROR_SUCCESS) {
                 // Now get the plugins directory
@@ -194,7 +195,7 @@ static inline void addMozillaPluginDirectories(Vector<String>& directories)
                 result = RegQueryValueEx(extensionsKey, TEXT("Plugins"), 0, &type, (LPBYTE)&pluginsDirectoryStr, &pluginsDirectorySize);
 
                 if (result == ERROR_SUCCESS && type == REG_SZ)
-                    directories.append(String(pluginsDirectoryStr, pluginsDirectorySize / sizeof(WCHAR) - 1));
+                    directories.append(wcharToString(pluginsDirectoryStr, pluginsDirectorySize / sizeof(WCHAR) - 1));
 
                 RegCloseKey(extensionsKey);
             }
@@ -211,7 +212,7 @@ static inline void addWindowsMediaPlayerPluginDirectory(Vector<String>& director
     DWORD pluginDirectorySize = ::ExpandEnvironmentStringsW(TEXT("%SYSTEMDRIVE%\\PFiles\\Plugins"), pluginDirectoryStr, WTF_ARRAY_LENGTH(pluginDirectoryStr));
 
     if (pluginDirectorySize > 0 && pluginDirectorySize <= WTF_ARRAY_LENGTH(pluginDirectoryStr))
-        directories.append(String(pluginDirectoryStr, pluginDirectorySize - 1));
+        directories.append(wcharToString(pluginDirectoryStr, pluginDirectorySize - 1));
 
     DWORD type;
     WCHAR installationDirectoryStr[_MAX_PATH];
@@ -220,7 +221,7 @@ static inline void addWindowsMediaPlayerPluginDirectory(Vector<String>& director
     HRESULT result = getRegistryValue(HKEY_LOCAL_MACHINE, L"Software\\Microsoft\\MediaPlayer", L"Installation Directory", &type, &installationDirectoryStr, &installationDirectorySize);
 
     if (result == ERROR_SUCCESS && type == REG_SZ)
-        directories.append(String(installationDirectoryStr, installationDirectorySize / sizeof(WCHAR) - 1));
+        directories.append(wcharToString(installationDirectoryStr, installationDirectorySize / sizeof(WCHAR) - 1));
 }
 
 static inline void addAdobeAcrobatPluginDirectory(Vector<String>& directories)
@@ -244,10 +245,10 @@ static inline void addAdobeAcrobatPluginDirectory(Vector<String>& directories)
         if (result != ERROR_SUCCESS)
             break;
 
-        Vector<int> acrobatVersion = parseVersionString(String(name, nameLen));
+        Vector<int> acrobatVersion = parseVersionString(wcharToString(name, nameLen));
         if (compareVersions(acrobatVersion, latestAcrobatVersion)) {
             latestAcrobatVersion = acrobatVersion;
-            latestAcrobatVersionString = String(name, nameLen);
+            latestAcrobatVersionString = wcharToString(name, nameLen);
         }
     }
 
@@ -257,10 +258,10 @@ static inline void addAdobeAcrobatPluginDirectory(Vector<String>& directories)
         DWORD acrobatInstallPathSize = sizeof(acrobatInstallPathStr);
 
         String acrobatPluginKeyPath = "Software\\Adobe\\Acrobat Reader\\" + latestAcrobatVersionString + "\\InstallPath";
-        result = getRegistryValue(HKEY_LOCAL_MACHINE, acrobatPluginKeyPath.charactersWithNullTermination().data(), 0, &type, acrobatInstallPathStr, &acrobatInstallPathSize);
+        result = getRegistryValue(HKEY_LOCAL_MACHINE, stringToNullTerminatedWChar(acrobatPluginKeyPath).data(), 0, &type, acrobatInstallPathStr, &acrobatInstallPathSize);
 
         if (result == ERROR_SUCCESS) {
-            String acrobatPluginDirectory = String(acrobatInstallPathStr, acrobatInstallPathSize / sizeof(WCHAR) - 1) + "\\browser";
+            String acrobatPluginDirectory = wcharToString(acrobatInstallPathStr, acrobatInstallPathSize / sizeof(WCHAR) - 1) + "\\browser";
             directories.append(acrobatPluginDirectory);
         }
     }
@@ -289,10 +290,10 @@ static inline void addJavaPluginDirectory(Vector<String>& directories)
         if (result != ERROR_SUCCESS)
             break;
 
-        Vector<int> javaVersion = parseVersionString(String(name, nameLen));
+        Vector<int> javaVersion = parseVersionString(wcharToString(name, nameLen));
         if (compareVersions(javaVersion, latestJavaVersion)) {
             latestJavaVersion = javaVersion;
-            latestJavaVersionString = String(name, nameLen);
+            latestJavaVersionString = wcharToString(name, nameLen);
         }
     }
 
@@ -304,12 +305,12 @@ static inline void addJavaPluginDirectory(Vector<String>& directories)
         DWORD useNewPluginSize;
 
         String javaPluginKeyPath = "Software\\JavaSoft\\Java Plug-in\\" + latestJavaVersionString;
-        result = getRegistryValue(HKEY_LOCAL_MACHINE, javaPluginKeyPath.charactersWithNullTermination().data(), L"UseNewJavaPlugin", &type, &useNewPluginValue, &useNewPluginSize);
+        result = getRegistryValue(HKEY_LOCAL_MACHINE, stringToNullTerminatedWChar(javaPluginKeyPath).data(), L"UseNewJavaPlugin", &type, &useNewPluginValue, &useNewPluginSize);
 
         if (result == ERROR_SUCCESS && useNewPluginValue == 1) {
-            result = getRegistryValue(HKEY_LOCAL_MACHINE, javaPluginKeyPath.charactersWithNullTermination().data(), L"JavaHome", &type, javaInstallPathStr, &javaInstallPathSize);
+            result = getRegistryValue(HKEY_LOCAL_MACHINE, stringToNullTerminatedWChar(javaPluginKeyPath).data(), L"JavaHome", &type, javaInstallPathStr, &javaInstallPathSize);
             if (result == ERROR_SUCCESS) {
-                String javaPluginDirectory = String(javaInstallPathStr, javaInstallPathSize / sizeof(WCHAR) - 1) + "\\bin\\new_plugin";
+                String javaPluginDirectory = wcharToString(javaInstallPathStr, javaInstallPathSize / sizeof(WCHAR) - 1) + "\\bin\\new_plugin";
                 directories.append(javaPluginDirectory);
             }
         }
@@ -335,7 +336,7 @@ static inline String safariPluginsDirectory()
         if (!PathRemoveFileSpec(moduleFileNameStr))
             goto exit;
 
-        pluginsDirectory = String(moduleFileNameStr) + "\\Plugins";
+        pluginsDirectory = nullTerminatedWCharToString(moduleFileNameStr) + "\\Plugins";
     }
 exit:
     return pluginsDirectory;
@@ -351,10 +352,10 @@ static inline void addMacromediaPluginDirectories(Vector<String>& directories)
     WCHAR macromediaDirectoryStr[MAX_PATH];
 
     PathCombine(macromediaDirectoryStr, systemDirectoryStr, TEXT("macromed\\Flash"));
-    directories.append(macromediaDirectoryStr);
+    directories.append(nullTerminatedWCharToString(macromediaDirectoryStr));
 
     PathCombine(macromediaDirectoryStr, systemDirectoryStr, TEXT("macromed\\Shockwave 10"));
-    directories.append(macromediaDirectoryStr);
+    directories.append(nullTerminatedWCharToString(macromediaDirectoryStr));
 }
 
 #if PLATFORM(QT)
diff --git a/Source/WebKit/win/Plugins/PluginPackageWin.cpp b/Source/WebKit/win/Plugins/PluginPackageWin.cpp
index 7119d8854..e0094b96b 100644
--- a/Source/WebKit/win/Plugins/PluginPackageWin.cpp
+++ b/Source/WebKit/win/Plugins/PluginPackageWin.cpp
@@ -34,10 +34,11 @@
 #include "PluginDebug.h"
 #include "Timer.h"
 #include "npruntime_impl.h"
+#include <shlwapi.h>
 #include <string.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
-#include <shlwapi.h>
+#include <wtf/text/win/WCharStringExtras.h>
 
 namespace WebCore {
 
@@ -47,7 +48,7 @@ static String getVersionInfo(const LPVOID versionInfoData, const String& info)
     UINT bufferLength;
     String subInfo = "\\StringfileInfo\\040904E4\\" + info;
     bool retval = VerQueryValueW(versionInfoData,
-        const_cast<UChar*>(subInfo.charactersWithNullTermination().data()),
+        stringToNullTerminatedWChar(subInfo).data(),
         &buffer, &bufferLength);
     if (!retval || bufferLength == 0)
         return String();
@@ -167,14 +168,13 @@ void PluginPackage::determineQuirks(const String& mimeType)
 bool PluginPackage::fetchInfo()
 {
     DWORD versionInfoSize, zeroHandle;
-    versionInfoSize = GetFileVersionInfoSizeW(const_cast<UChar*>(m_path.charactersWithNullTermination().data()), &zeroHandle);
+    versionInfoSize = GetFileVersionInfoSizeW(stringToNullTerminatedWChar(m_path).data(), &zeroHandle);
     if (versionInfoSize == 0)
         return false;
 
     auto versionInfoData = std::make_unique<char[]>(versionInfoSize);
 
-    if (!GetFileVersionInfoW(const_cast<UChar*>(m_path.charactersWithNullTermination().data()),
-            0, versionInfoSize, versionInfoData.get()))
+    if (!GetFileVersionInfoW(stringToNullTerminatedWChar(m_path).data(), 0, versionInfoSize, versionInfoData.get()))
         return false;
 
     m_name = getVersionInfo(versionInfoData.get(), "ProductName");
@@ -244,11 +244,11 @@ bool PluginPackage::load()
 
         String path = m_path.substring(0, m_path.reverseFind('\\'));
 
-        if (!::SetCurrentDirectoryW(path.charactersWithNullTermination().data()))
+        if (!::SetCurrentDirectoryW(stringToNullTerminatedWChar(path).data()))
             return false;
 
         // Load the library
-        m_module = ::LoadLibraryExW(m_path.charactersWithNullTermination().data(), 0, LOAD_WITH_ALTERED_SEARCH_PATH);
+        m_module = ::LoadLibraryExW(stringToNullTerminatedWChar(m_path).data(), 0, LOAD_WITH_ALTERED_SEARCH_PATH);
 
         if (!::SetCurrentDirectoryW(currentPath)) {
             if (m_module)
diff --git a/Source/WebKit/win/Plugins/PluginViewWin.cpp b/Source/WebKit/win/Plugins/PluginViewWin.cpp
index 68af391fc..a0b41113e 100644
--- a/Source/WebKit/win/Plugins/PluginViewWin.cpp
+++ b/Source/WebKit/win/Plugins/PluginViewWin.cpp
@@ -71,6 +71,7 @@
 #include <runtime/JSLock.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/text/WTFString.h>
+#include <wtf/text/win/WCharStringExtras.h>
 #include <wtf/win/GDIObject.h>
 
 #if USE(CAIRO)
@@ -852,13 +853,13 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32_t len, const
 
     // Get file info
     WIN32_FILE_ATTRIBUTE_DATA attrs;
-    if (GetFileAttributesExW(filename.charactersWithNullTermination().data(), GetFileExInfoStandard, &attrs) == 0)
+    if (!GetFileAttributesExW(stringToNullTerminatedWChar(filename).data(), GetFileExInfoStandard, &attrs))
         return NPERR_FILE_NOT_FOUND;
 
     if (attrs.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
         return NPERR_FILE_NOT_FOUND;
 
-    HANDLE fileHandle = CreateFileW(filename.charactersWithNullTermination().data(), FILE_READ_DATA, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
+    HANDLE fileHandle = CreateFileW(stringToNullTerminatedWChar(filename).data(), FILE_READ_DATA, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
     
     if (fileHandle == INVALID_HANDLE_VALUE)
         return NPERR_FILE_NOT_FOUND;
diff --git a/Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp b/Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp
index 18d02cdd9..3902003f9 100644
--- a/Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp
+++ b/Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp
@@ -199,6 +199,11 @@ bool Connection::processMessage()
     memcpy(&messageInfo, messageData, sizeof(messageInfo));
     messageData += sizeof(messageInfo);
 
+    if (messageInfo.attachmentCount() > attachmentMaxAmount || (!messageInfo.isMessageBodyIsOutOfLine() && messageInfo.bodySize() > messageMaxSize)) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
     size_t messageLength = sizeof(MessageInfo) + messageInfo.attachmentCount() * sizeof(AttachmentInfo) + (messageInfo.isMessageBodyIsOutOfLine() ? 0 : messageInfo.bodySize());
     if (m_readBuffer.size() < messageLength)
         return false;
@@ -256,7 +261,7 @@ bool Connection::processMessage()
     if (messageInfo.isMessageBodyIsOutOfLine()) {
         ASSERT(messageInfo.bodySize());
 
-        if (attachmentInfo[attachmentCount].isNull()) {
+        if (attachmentInfo[attachmentCount].isNull() || attachmentInfo[attachmentCount].getSize() != messageInfo.bodySize()) {
             ASSERT_NOT_REACHED();
             return false;
         }
@@ -334,6 +339,10 @@ static ssize_t readBytesFromSocket(int socketDescriptor, Vector<uint8_t>& buffer
         struct cmsghdr* controlMessage;
         for (controlMessage = CMSG_FIRSTHDR(&message); controlMessage; controlMessage = CMSG_NXTHDR(&message, controlMessage)) {
             if (controlMessage->cmsg_level == SOL_SOCKET && controlMessage->cmsg_type == SCM_RIGHTS) {
+                if (controlMessage->cmsg_len < CMSG_LEN(0) || controlMessage->cmsg_len > attachmentMaxAmount) {
+                    ASSERT_NOT_REACHED();
+                    break;
+                }
                 size_t previousFileDescriptorsSize = fileDescriptors.size();
                 size_t fileDescriptorsCount = (controlMessage->cmsg_len - CMSG_LEN(0)) / sizeof(int);
                 fileDescriptors.grow(fileDescriptors.size() + fileDescriptorsCount);
diff --git a/Source/WebKit2/Shared/qt/NativeWebTouchEventQt.cpp b/Source/WebKit2/Shared/qt/NativeWebTouchEventQt.cpp
index 5792ef623..f6cc58825 100644
--- a/Source/WebKit2/Shared/qt/NativeWebTouchEventQt.cpp
+++ b/Source/WebKit2/Shared/qt/NativeWebTouchEventQt.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "NativeWebTouchEvent.h"
 
+#if ENABLE(TOUCH_EVENTS)
+
 #include "WebEventFactory.h"
 
 namespace WebKit {
@@ -37,3 +39,5 @@ NativeWebTouchEvent::NativeWebTouchEvent(const QTouchEvent* event, const QTransf
 }
 
 } // namespace WebKit
+
+#endif // ENABLE(TOUCH_EVENTS)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/CMakeLists.txt b/Source/WebKit2/UIProcess/API/qt/tests/CMakeLists.txt
index b26366492..899a9e038 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/CMakeLists.txt
+++ b/Source/WebKit2/UIProcess/API/qt/tests/CMakeLists.txt
@@ -87,7 +87,9 @@ set(qmltests_LIBRARIES
 add_executable(tst_qmltests_WebView ${qmltests_SOURCES})
 target_compile_definitions(tst_qmltests_WebView PRIVATE ${tst_qmltests_WebView_DEFINITIONS})
 target_link_libraries(tst_qmltests_WebView ${qmltests_LIBRARIES})
+set_target_properties(tst_qmltests_WebView PROPERTIES AUTOMOC ON)
 
 add_executable(tst_qmltests_DesktopBehavior ${qmltests_SOURCES})
 target_compile_definitions(tst_qmltests_DesktopBehavior PRIVATE ${tst_qmltests_DesktopBehavior_DEFINITIONS})
 target_link_libraries(tst_qmltests_DesktopBehavior ${qmltests_LIBRARIES})
+set_target_properties(tst_qmltests_DesktopBehavior PROPERTIES AUTOMOC ON)
diff --git a/Source/WebKit2/UIProcess/UserContent/WebUserContentControllerProxy.cpp b/Source/WebKit2/UIProcess/UserContent/WebUserContentControllerProxy.cpp
index b40662f06..d27175cee 100644
--- a/Source/WebKit2/UIProcess/UserContent/WebUserContentControllerProxy.cpp
+++ b/Source/WebKit2/UIProcess/UserContent/WebUserContentControllerProxy.cpp
@@ -116,7 +116,7 @@ void WebUserContentControllerProxy::addUserScript(API::UserScript& userScript)
 void WebUserContentControllerProxy::removeUserScript(const API::UserScript& userScript)
 {
     for (WebProcessProxy* process : m_processes)
-        process->connection()->send(Messages::WebUserContentController::RemoveUserScript({ userScript.userScript().url().string() }), m_identifier);
+        process->connection()->send(Messages::WebUserContentController::RemoveUserScript(userScript.userScript().url().string()), m_identifier);
 
     m_userScripts->elements().removeAll(&userScript);
 }
@@ -140,7 +140,7 @@ void WebUserContentControllerProxy::addUserStyleSheet(API::UserStyleSheet& userS
 void WebUserContentControllerProxy::removeUserStyleSheet(const API::UserStyleSheet& userStyleSheet)
 {
     for (WebProcessProxy* process : m_processes)
-        process->connection()->send(Messages::WebUserContentController::RemoveUserStyleSheet({ userStyleSheet.userStyleSheet().url().string() }), m_identifier);
+        process->connection()->send(Messages::WebUserContentController::RemoveUserStyleSheet(userStyleSheet.userStyleSheet().url().string()), m_identifier);
 
     m_userStyleSheets->elements().removeAll(&userStyleSheet);
 }
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
index c4edb793e..5f62dc600 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
@@ -110,10 +110,12 @@ void QtPageClient::didChangeViewportProperties(const WebCore::ViewportAttributes
     QQuickWebViewPrivate::get(m_webView)->didChangeViewportProperties(attr);
 }
 
+#if ENABLE(DRAG_SUPPORT)
 void QtPageClient::startDrag(const WebCore::DragData& dragData, PassRefPtr<ShareableBitmap> dragImage)
 {
     m_eventHandler->startDrag(dragData, dragImage);
 }
+#endif
 
 void QtPageClient::handleDownloadRequest(DownloadProxy* download)
 {
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.h b/Source/WebKit2/UIProcess/qt/QtPageClient.h
index 3467ceaa9..b31720bc8 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.h
@@ -73,7 +73,9 @@ public:
     void updateAcceleratedCompositingMode(const LayerTreeContext&) override;
     void pageClosed() override { }
     void preferencesDidChange() override { }
+#if ENABLE(DRAG_SUPPORT)
     void startDrag(const WebCore::DragData&, PassRefPtr<ShareableBitmap> dragImage) override;
+#endif
     void setCursor(const WebCore::Cursor&) override;
     void setCursorHiddenUntilMouseMoves(bool) override;
     void toolTipChanged(const String&, const String&) override;
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index d05649736..2a7d6f15e 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -184,16 +184,21 @@ void QtWebPageEventHandler::handleHoverMoveEvent(QHoverEvent* ev)
 
 void QtWebPageEventHandler::handleDragEnterEvent(QDragEnterEvent* ev)
 {
+#if ENABLE(DRAG_SUPPORT)
     m_webPageProxy->resetCurrentDragInformation();
     QTransform fromItemTransform = m_webPage->transformFromItem();
     // FIXME: Should not use QCursor::pos()
     DragData dragData(ev->mimeData(), fromItemTransform.map(ev->pos()), QCursor::pos(), dropActionToDragOperation(ev->possibleActions()));
     m_webPageProxy->dragEntered(dragData);
     ev->acceptProposedAction();
+#else
+    Q_UNUSED(ev);
+#endif
 }
 
 void QtWebPageEventHandler::handleDragLeaveEvent(QDragLeaveEvent* ev)
 {
+#if ENABLE(DRAG_SUPPORT)
     bool accepted = ev->isAccepted();
 
     // FIXME: Should not use QCursor::pos()
@@ -202,10 +207,14 @@ void QtWebPageEventHandler::handleDragLeaveEvent(QDragLeaveEvent* ev)
     m_webPageProxy->resetCurrentDragInformation();
 
     ev->setAccepted(accepted);
+#else
+    Q_UNUSED(ev);
+#endif
 }
 
 void QtWebPageEventHandler::handleDragMoveEvent(QDragMoveEvent* ev)
 {
+#if ENABLE(DRAG_SUPPORT)
     bool accepted = ev->isAccepted();
 
     QTransform fromItemTransform = m_webPage->transformFromItem();
@@ -217,10 +226,14 @@ void QtWebPageEventHandler::handleDragMoveEvent(QDragMoveEvent* ev)
         ev->accept();
 
     ev->setAccepted(accepted);
+#else
+    Q_UNUSED(ev);
+#endif
 }
 
 void QtWebPageEventHandler::handleDropEvent(QDropEvent* ev)
 {
+#if ENABLE(DRAG_SUPPORT)
     bool accepted = ev->isAccepted();
     QTransform fromItemTransform = m_webPage->transformFromItem();
     // FIXME: Should not use QCursor::pos()
@@ -232,6 +245,9 @@ void QtWebPageEventHandler::handleDropEvent(QDropEvent* ev)
     ev->accept();
 
     ev->setAccepted(accepted);
+#else
+    Q_UNUSED(ev);
+#endif
 }
 
 void QtWebPageEventHandler::activateTapHighlight(const QTouchEvent::TouchPoint& point)
@@ -615,6 +631,7 @@ void QtWebPageEventHandler::didFindZoomableArea(const IntPoint& target, const In
 
 void QtWebPageEventHandler::startDrag(const WebCore::DragData& dragData, PassRefPtr<ShareableBitmap> dragImage)
 {
+#if ENABLE(DRAG_SUPPORT)
     QImage dragQImage;
     if (dragImage)
         dragQImage = dragImage->createQImage();
@@ -639,6 +656,10 @@ void QtWebPageEventHandler::startDrag(const WebCore::DragData& dragData, PassRef
     }
 
     m_webPageProxy->dragEnded(clientPosition, globalPosition, dropActionToDragOperation(actualDropAction));
+#else
+    Q_UNUSED(dragData);
+    Q_UNUSED(dragImage);
+#endif
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
index dcb73b3ff..dde8526fb 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,6 +114,8 @@ PassRefPtr<WebImage> InjectedBundleRangeHandle::renderedImage(SnapshotOptions op
     if (!frameView)
         return nullptr;
 
+    Ref<Frame> protector(*frame);
+
     VisibleSelection oldSelection = frame->selection().selection();
     frame->selection().setSelection(VisibleSelection(*m_range));
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebDragClientQt.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebDragClientQt.cpp
index 380208a46..8b93b2903 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebDragClientQt.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebDragClientQt.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebDragClient.h"
 
+#if ENABLE(DRAG_SUPPORT)
+
 #include "DataTransfer.h"
 #include "DragData.h"
 #include "GraphicsContext.h"
@@ -67,3 +69,5 @@ void WebDragClient::startDrag(DragImageRef dragImage, const IntPoint& clientPosi
 }
 
 }
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index c8d54d523..6a69492d9 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -4493,6 +4493,8 @@ void WebPage::insertTextAsync(const String& text, const EditingRange& replacemen
 {
     Frame& frame = m_page->focusController().focusedOrMainFrame();
 
+    Ref<Frame> protector(frame);
+
     if (replacementEditingRange.location != notFound) {
         RefPtr<Range> replacementRange = rangeFromEditingRange(frame, replacementEditingRange, static_cast<EditingRangeIsRelativeTo>(editingRangeIsRelativeTo));
         if (replacementRange)
@@ -4655,6 +4657,8 @@ void WebPage::setComposition(const String& text, const Vector<CompositionUnderli
         return;
     }
 
+    Ref<Frame> protector(*targetFrame);
+
     if (replacementLength > 0) {
         // The layout needs to be uptodate before setting a selection
         targetFrame->document()->updateLayout();
diff --git a/Source/cmake/OptionsCommon.cmake b/Source/cmake/OptionsCommon.cmake
index 4529bdd84..529e2bc0d 100644
--- a/Source/cmake/OptionsCommon.cmake
+++ b/Source/cmake/OptionsCommon.cmake
@@ -32,6 +32,10 @@ if (COMPILER_IS_GCC_OR_CLANG)
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-exceptions -fno-strict-aliasing")
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-exceptions -fno-strict-aliasing -fno-rtti")
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
+    if (NOT (COMPILER_IS_CLANG AND "${CLANG_VERSION}" VERSION_LESS 4.0.0))
+        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-expansion-to-defined")
+        set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-expansion-to-defined")
+    endif ()
 endif ()
 
 if (COMPILER_IS_CLANG AND CMAKE_GENERATOR STREQUAL "Ninja")
@@ -196,9 +200,9 @@ endif ()
 
 # The Ninja generator does not yet know how to build archives in pieces, and so response
 # files must be used to deal with very long linker command lines.
-# See https://bugs.webkit.org/show_bug.cgi?id=129771
-# The Apple Toolchain doesn't support response files.
-if (NOT APPLE)
+# CMake does this automatically, but the condition was wrong on Linux until CMake 3.2.
+# See https://cmake.org/Bug/view.php?id=14892
+if ((CMAKE_HOST_SYSTEM_NAME STREQUAL "Linux") AND (CMAKE_VERSION VERSION_LESS 3.2))
     set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
 endif ()
 
diff --git a/Source/cmake/OptionsQt.cmake b/Source/cmake/OptionsQt.cmake
index 6dc423109..1930027d1 100644
--- a/Source/cmake/OptionsQt.cmake
+++ b/Source/cmake/OptionsQt.cmake
@@ -59,6 +59,40 @@ macro(QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT target)
     endif ()
 endmacro()
 
+macro(QTWEBKIT_GENERATE_MOC_FILES_CPP)
+    foreach (_file ${ARGN})
+        get_filename_component(_ext ${_file} EXT)
+        if (NOT _ext STREQUAL ".cpp")
+            message(FATAL_ERROR "QTWEBKIT_GENERATE_MOC_FILES_CPP must be used for .cpp files only")
+        endif ()
+        get_filename_component(_name_we ${_file} NAME_WE)
+        set(_moc_name "${CMAKE_CURRENT_BINARY_DIR}/${_name_we}.moc")
+        qt5_generate_moc(${_file} ${_moc_name})
+        ADD_SOURCE_DEPENDENCIES(${_file} ${_moc_name})
+    endforeach ()
+endmacro()
+
+macro(QTWEBKIT_GENERATE_MOC_FILE_H _header _source)
+    get_filename_component(_header_ext ${_header} EXT)
+    get_filename_component(_source_ext ${_source} EXT)
+    if ((NOT _header_ext STREQUAL ".h") OR (NOT _source_ext STREQUAL ".cpp"))
+        message(FATAL_ERROR "QTWEBKIT_GENERATE_MOC_FILE_H must be called with arguments being .h and .cpp files")
+    endif ()
+    get_filename_component(_name_we ${_header} NAME_WE)
+    set(_moc_name "${CMAKE_CURRENT_BINARY_DIR}/moc_${_name_we}.cpp")
+    qt5_generate_moc(${_header} ${_moc_name})
+    ADD_SOURCE_DEPENDENCIES(${_source} ${_moc_name})
+endmacro()
+
+macro(QTWEBKIT_GENERATE_MOC_FILES_H)
+    foreach (_header ${ARGN})
+        get_filename_component(_header_dir ${_header} DIRECTORY)
+        get_filename_component(_name_we ${_header} NAME_WE)
+        set(_source "${_header_dir}/${_name_we}.cpp")
+        QTWEBKIT_GENERATE_MOC_FILE_H(${_header} ${_source})
+    endforeach ()
+endmacro()
+
 set(CMAKE_MACOSX_RPATH ON)
 
 add_definitions(-DBUILDING_QT__=1)
@@ -98,6 +132,13 @@ else ()
     set(USE_QT_MULTIMEDIA_DEFAULT OFF)
 endif ()
 
+if (MSVC)
+    set(USE_QT_MULTIMEDIA_DEFAULT OFF)
+    set(USE_MEDIA_FOUNDATION_DEFAULT ON)
+else ()
+    set(USE_MEDIA_FOUNDATION_DEFAULT OFF)
+endif ()
+
 if (CMAKE_SYSTEM_NAME MATCHES "Linux")
     set(ENABLE_GAMEPAD_DEPRECATED_DEFAULT ON)
 else ()
@@ -130,7 +171,7 @@ endif ()
 # and the option is not relevant to any other WebKit ports.
 WEBKIT_OPTION_DEFINE(USE_GSTREAMER "Use GStreamer implementation of MediaPlayer" PUBLIC ${USE_GSTREAMER_DEFAULT})
 WEBKIT_OPTION_DEFINE(USE_LIBHYPHEN "Use automatic hyphenation with LibHyphen" PUBLIC ${USE_LIBHYPHEN_DEFAULT})
-WEBKIT_OPTION_DEFINE(USE_MEDIA_FOUNDATION "Use MediaFoundation implementation of MediaPlayer" PUBLIC OFF)
+WEBKIT_OPTION_DEFINE(USE_MEDIA_FOUNDATION "Use MediaFoundation implementation of MediaPlayer" PUBLIC ${USE_MEDIA_FOUNDATION_DEFAULT})
 WEBKIT_OPTION_DEFINE(USE_QT_MULTIMEDIA "Use Qt Multimedia implementation of MediaPlayer" PUBLIC ${USE_QT_MULTIMEDIA_DEFAULT})
 WEBKIT_OPTION_DEFINE(USE_WOFF2 "Include support of WOFF2 fonts format" PUBLIC ON)
 WEBKIT_OPTION_DEFINE(ENABLE_INSPECTOR_UI "Include Inspector UI into resources" PUBLIC ON)
@@ -490,8 +531,6 @@ option(USE_LINKER_VERSION_SCRIPT "Use linker script for ABI compatibility with Q
 
 # Find includes in corresponding build directories
 set(CMAKE_INCLUDE_CURRENT_DIR ON)
-# Instruct CMake to run moc automatically when needed.
-set(CMAKE_AUTOMOC ON)
 
 # TODO: figure out if we can run automoc only on Qt sources
 
diff --git a/Source/cmake/WebKitMacros.cmake b/Source/cmake/WebKitMacros.cmake
index d1edb210c..858e2e47d 100644
--- a/Source/cmake/WebKitMacros.cmake
+++ b/Source/cmake/WebKitMacros.cmake
@@ -33,8 +33,12 @@ macro(ADD_PRECOMPILED_HEADER _header _cpp _source)
             PROPERTIES COMPILE_FLAGS "/Yc\"${_header}\" /Fp\"${PrecompiledBinary}\""
             OBJECT_OUTPUTS "${PrecompiledBinary}")
         set_source_files_properties(${_sources}
-            PROPERTIES COMPILE_FLAGS "/Yu\"${_header}\" /FI\"${_header}\" /Fp\"${PrecompiledBinary}\""
-            OBJECT_DEPENDS "${PrecompiledBinary}")
+            PROPERTIES COMPILE_FLAGS "/Yu\"${_header}\" /FI\"${_header}\" /Fp\"${PrecompiledBinary}\"")
+
+        foreach (_src ${_sources})
+            ADD_SOURCE_DEPENDENCIES(${_src} ${PrecompiledBinary})
+        endforeach ()
+
         list(APPEND ${_source} ${_cpp})
     endif ()
     #FIXME: Add support for Xcode.
diff --git a/Tools/DumpRenderTree/CMakeLists.txt b/Tools/DumpRenderTree/CMakeLists.txt
index eb7c1f4ff..db6ef4304 100644
--- a/Tools/DumpRenderTree/CMakeLists.txt
+++ b/Tools/DumpRenderTree/CMakeLists.txt
@@ -127,3 +127,7 @@ endif ()
 if (WIN32)
     add_dependencies(DumpRenderTree DumpRenderTreeLib)
 endif ()
+
+if (${PORT} STREQUAL "Qt")
+    set_target_properties(DumpRenderTree PROPERTIES AUTOMOC ON)
+endif ()
diff --git a/Tools/MiniBrowser/qt/CMakeLists.txt b/Tools/MiniBrowser/qt/CMakeLists.txt
index 0d5c7783f..e77d3bd54 100644
--- a/Tools/MiniBrowser/qt/CMakeLists.txt
+++ b/Tools/MiniBrowser/qt/CMakeLists.txt
@@ -61,4 +61,4 @@ include_directories(${MiniBrowser_INCLUDE_DIRECTORIES})
 include_directories(SYSTEM ${MiniBrowser_SYSTEM_INCLUDE_DIRECTORIES})
 add_executable(MiniBrowser ${MiniBrowser_SOURCES})
 target_link_libraries(MiniBrowser ${MiniBrowser_LIBRARIES})
-set_target_properties(MiniBrowser PROPERTIES FOLDER "Tools")
+set_target_properties(MiniBrowser PROPERTIES FOLDER "Tools" AUTOMOC ON)
diff --git a/Tools/QtTestBrowser/CMakeLists.txt b/Tools/QtTestBrowser/CMakeLists.txt
index f43bb7852..a091c9541 100644
--- a/Tools/QtTestBrowser/CMakeLists.txt
+++ b/Tools/QtTestBrowser/CMakeLists.txt
@@ -66,7 +66,7 @@ include_directories(${QtTestBrowser_INCLUDE_DIRECTORIES})
 include_directories(SYSTEM ${QtTestBrowser_SYSTEM_INCLUDE_DIRECTORIES})
 add_executable(QtTestBrowser ${QtTestBrowser_SOURCES})
 target_link_libraries(QtTestBrowser ${QtTestBrowser_LIBRARIES})
-set_target_properties(QtTestBrowser PROPERTIES FOLDER "Tools")
+set_target_properties(QtTestBrowser PROPERTIES FOLDER "Tools" AUTOMOC ON)
 
 if (${CMAKE_BUILD_TYPE} MATCHES "Release")
     set_target_properties(QtTestBrowser PROPERTIES WIN32_EXECUTABLE ON)
diff --git a/Tools/QtTestBrowser/launcherwindow.cpp b/Tools/QtTestBrowser/launcherwindow.cpp
index 26b6dce79..0fd64654e 100644
--- a/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/Tools/QtTestBrowser/launcherwindow.cpp
@@ -353,6 +353,10 @@ void LauncherWindow::createChrome()
     touchMockAction->setCheckable(true);
     touchMockAction->setShortcut(QKeySequence(Qt::CTRL | Qt::ALT | Qt::Key_T));
 
+    QAction* toggleWebSecurity = toolsMenu->addAction("Disable Web Security", this, SLOT(toggleWebSecurity(bool)));
+    toggleWebSecurity->setCheckable(true);
+    toggleWebSecurity->setChecked(false);
+
     toolsMenu->addSeparator();
 
     QAction* toggleLocalStorage = toolsMenu->addAction("Enable Local Storage", this, SLOT(toggleLocalStorage(bool)));
@@ -1001,6 +1005,11 @@ void LauncherWindow::togglePrivateBrowsing(bool enable)
     page()->settings()->setAttribute(QWebSettings::PrivateBrowsingEnabled, enable);
 }
 
+void LauncherWindow::toggleWebSecurity(bool enable)
+{
+    page()->settings()->setAttribute(QWebSettings::WebSecurityEnabled, !enable);
+}
+
 void LauncherWindow::setUseDiskCookies(bool enable)
 {
     testBrowserCookieJarInstance()->setDiskStorageEnabled(enable);
diff --git a/Tools/QtTestBrowser/launcherwindow.h b/Tools/QtTestBrowser/launcherwindow.h
index 0b5ea32db..a05a6cd56 100644
--- a/Tools/QtTestBrowser/launcherwindow.h
+++ b/Tools/QtTestBrowser/launcherwindow.h
@@ -144,6 +144,7 @@ protected Q_SLOTS:
     void toggleJavascriptCanOpenWindows(bool enable);
     void toggleAutoLoadImages(bool enable);
     void togglePrivateBrowsing(bool enable);
+    void toggleWebSecurity(bool enable);
     void setUseDiskCookies(bool enable);
     void clearCookies();
     void togglePlugins(bool enable);
diff --git a/Tools/qt/jhbuild.modules b/Tools/qt/jhbuild.modules
index f59f198df..b3e0c5101 100644
--- a/Tools/qt/jhbuild.modules
+++ b/Tools/qt/jhbuild.modules
@@ -124,14 +124,17 @@
 
 
   <autotools id="libxml2" supports-non-srcdir-builds="no"
-             autogen-sh="./autogen.sh; ./configure --with-python=no">
+             autogen-sh="./autogen.sh; ./configure --without-python --without-valid --without-xinclude --without-xptr --without-c14n --without-catalog --without-regexps --without-zlib --without-lzma --without-schemas --without-schematron --without-threads --without-legacy --without-http --without-iconv --with-icu">
+    <dependencies>
+      <dep package="icu"/>
+    </dependencies>
     <branch module="/sources/libxml2-2.9.1.tar.gz" version="2.9.1"
             repo="xmlsoft.org"
             hash="sha256:fd3c64cb66f2c4ea27e934d275904d92cec494a8e8405613780cbc8a71680fdb"
             md5sum="9c0cfef285d5c4a5c80d00904ddab380"/>
   </autotools>
 
-  <autotools id="libxslt">
+  <autotools id="libxslt" autogenargs="--without-python">
     <branch module="/sources/libxslt-${version}.tar.gz" version="1.1.29"
             repo="xmlsoft.org"
             hash="sha256:b5976e3857837e7617b29f2249ebb5eeac34e249208d31f1fbf7a6ba7a4090ce"/>
diff --git a/Tools/qt/manifest.txt b/Tools/qt/manifest.txt
index b7aeadcea..6fe3e9546 100644
--- a/Tools/qt/manifest.txt
+++ b/Tools/qt/manifest.txt
@@ -69,6 +69,7 @@ exclude Source/WebKit2/Resources
 file Source/WebCore/English.lproj/mediaControlsLocalizedStrings.js
 
 # Windows-specific code
+file Source/WTF/wtf/text/win
 file Source/WTF/wtf/threads/win/BinarySemaphoreWin.cpp
 file Source/WTF/wtf/win
 file Source/WebCore/platform/graphics/win/LocalWindowsContext.h
author	Konstantin Tokarev <annulen@yandex.ru>	2017-06-15 12:13:20 +0300
committer	Konstantin Tokarev <annulen@yandex.ru>	2017-06-17 10:46:54 +0000
commit	aab669a05f943c587f6acccd94d53a8544170c1c (patch)
tree	2c22545100b500eb80d23f75b8e3180ed9b5f3b7
parent	c119ecc79e19c630a8b1ef10fe01cc567901033f (diff)