Imported WebKit commit 2730223e8fe1776419fae168986b9e77f55d02d3

Change-Id: I46d453477a779a8db544ffc50d088fa13331da9b
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>

44 files changed, 1083 insertions, 689 deletions

diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 1504e53a8..d570b8dd0 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -1318,6 +1318,8 @@ if (${JavaScriptCore_LIBRARY_TYPE} STREQUAL "SHARED")
     install(TARGETS JavaScriptCore DESTINATION "${LIB_INSTALL_DIR}")
 endif ()
 
+QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(JavaScriptCore)
+
 # Force staging of shared scripts, even if they aren't directly used to build JavaScriptCore.
 
 add_custom_target(stageSharedScripts DEPENDS ${JavaScriptCore_SCRIPTS})
diff --git a/Source/JavaScriptCore/PlatformQt.cmake b/Source/JavaScriptCore/PlatformQt.cmake
index 7bc7f0348..11587f401 100644
--- a/Source/JavaScriptCore/PlatformQt.cmake
+++ b/Source/JavaScriptCore/PlatformQt.cmake
@@ -18,6 +18,12 @@ list(APPEND JavaScriptCore_LIBRARIES
     ${Qt5Core_LIBRARIES}
 )
 
+if (QT_STATIC_BUILD)
+    list(APPEND JavaScriptCore_LIBRARIES
+        ${STATIC_LIB_DEPENDENCIES}
+    )
+endif ()
+
 # From PlatformWin.cmake
 if (WIN32)
     list(REMOVE_ITEM JavaScriptCore_SOURCES
diff --git a/Source/JavaScriptCore/shell/PlatformQt.cmake b/Source/JavaScriptCore/shell/PlatformQt.cmake
new file mode 100644
index 000000000..55640eb3a
--- /dev/null
+++ b/Source/JavaScriptCore/shell/PlatformQt.cmake
@@ -0,0 +1,5 @@
+if (QT_STATIC_BUILD)
+    list(APPEND JSC_LIBRARIES
+        ${DEPEND_STATIC_LIBS}
+    )
+endif ()
diff --git a/Source/ThirdParty/brotli/CMakeLists.txt b/Source/ThirdParty/brotli/CMakeLists.txt
index 2c406da8c..22a052d36 100644
--- a/Source/ThirdParty/brotli/CMakeLists.txt
+++ b/Source/ThirdParty/brotli/CMakeLists.txt
@@ -20,3 +20,5 @@ WEBKIT_SET_EXTRA_COMPILER_FLAGS(brotli)
 if (COMPILER_IS_CLANG)
     ADD_TARGET_PROPERTIES(brotli COMPILE_FLAGS "-Wno-cast-align")
 endif ()
+
+QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(brotli)
diff --git a/Source/ThirdParty/woff2/CMakeLists.txt b/Source/ThirdParty/woff2/CMakeLists.txt
index 075ab5a62..e8f7cf2aa 100644
--- a/Source/ThirdParty/woff2/CMakeLists.txt
+++ b/Source/ThirdParty/woff2/CMakeLists.txt
@@ -9,6 +9,7 @@ set(WOFF2_SOURCES
   ${WOFF2_DIR}/src/variable_length.cc
   ${WOFF2_DIR}/src/woff2_common.cc
   ${WOFF2_DIR}/src/woff2_dec.cc
+  ${WOFF2_DIR}/src/woff2_out.cc
 )
 
 include_directories("${THIRDPARTY_DIR}/brotli/dec")
@@ -18,9 +19,11 @@ target_link_libraries(woff2 brotli)
 WEBKIT_SET_EXTRA_COMPILER_FLAGS(woff2)
 
 if (COMPILER_IS_GCC_OR_CLANG)
-    ADD_TARGET_PROPERTIES(woff2 COMPILE_FLAGS "-Wno-sign-compare")
+    ADD_TARGET_PROPERTIES(woff2 COMPILE_FLAGS "-Wno-sign-compare -Wno-unused-variable -Wno-unused-parameter")
 endif ()
 
 if (CMAKE_COMPILER_IS_GNUCXX)
     ADD_TARGET_PROPERTIES(woff2 COMPILE_FLAGS "-Wno-unused-but-set-variable")
 endif ()
+
+QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(woff2)
diff --git a/Source/ThirdParty/woff2/README.webkit b/Source/ThirdParty/woff2/README.webkit
index 0e0920232..9348171e5 100644
--- a/Source/ThirdParty/woff2/README.webkit
+++ b/Source/ThirdParty/woff2/README.webkit
@@ -11,4 +11,4 @@ The in-tree copy is updated by running
   sh update.sh
 from within the modules/woff2 directory.
 
-Current version: [commit 643c7b45891cbeb5dc1f7599a4c9b53fbe82a08f].
+Current version: [commit 63b8fb6d0d797f04e77ee825fd8fcf7ea6205aac].
diff --git a/Source/ThirdParty/woff2/src/file.h b/Source/ThirdParty/woff2/src/file.h
index 69a92f8ab..7afcb315f 100644
--- a/Source/ThirdParty/woff2/src/file.h
+++ b/Source/ThirdParty/woff2/src/file.h
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-// File IO helpers
+// File IO helpers.
 
 #ifndef WOFF2_FILE_H_
 #define WOFF2_FILE_H_
@@ -22,18 +22,20 @@
 
 namespace woff2 {
 
-inline std::string GetFileContent(std::string filename) {
+using std::string;
+
+
+inline string GetFileContent(string filename) {
   std::ifstream ifs(filename.c_str(), std::ios::binary);
-  return std::string(
+  return string(
     std::istreambuf_iterator<char>(ifs.rdbuf()),
     std::istreambuf_iterator<char>());
 }
 
-inline void SetFileContents(std::string filename, std::string content) {
+inline void SetFileContents(string filename, string::iterator start,
+    string::iterator end) {
   std::ofstream ofs(filename.c_str(), std::ios::binary);
-  std::copy(content.begin(),
-            content.end(),
-            std::ostream_iterator<char>(ofs));
+  std::copy(start, end, std::ostream_iterator<char>(ofs));
 }
 
 } // namespace woff2
diff --git a/Source/ThirdParty/woff2/src/font.cc b/Source/ThirdParty/woff2/src/font.cc
index 7cc5688b5..060673005 100644
--- a/Source/ThirdParty/woff2/src/font.cc
+++ b/Source/ThirdParty/woff2/src/font.cc
@@ -49,11 +49,7 @@ std::vector<uint32_t> Font::OutputOrderedTags() const {
     output_order.push_back(table.tag);
   }
 
-  // Alphabetize and do not put loca immediately after glyf
-  // This violates woff2 spec but results in a font that passes OTS
-  std::sort(output_order.begin(), output_order.end());
-  // TODO(user): change to match spec once browsers are on newer OTS
-  /*
+  // Alphabetize then put loca immediately after glyf
   auto glyf_loc = std::find(output_order.begin(), output_order.end(),
       kGlyfTableTag);
   auto loca_loc = std::find(output_order.begin(), output_order.end(),
@@ -62,7 +58,7 @@ std::vector<uint32_t> Font::OutputOrderedTags() const {
     output_order.erase(loca_loc);
     output_order.insert(std::find(output_order.begin(), output_order.end(),
       kGlyfTableTag) + 1, kLocaTableTag);
-  }*/
+  }
 
   return output_order;
 }
@@ -145,7 +141,7 @@ bool ReadTrueTypeCollection(Buffer* file, const uint8_t* data, size_t len,
     }
 
     std::vector<uint32_t> offsets;
-    for (auto i = 0; i < num_fonts; i++) {
+    for (size_t i = 0; i < num_fonts; i++) {
       uint32_t offset;
       if (!file->ReadU32(&offset)) {
         return FONT_COMPRESSION_FAILURE();
@@ -185,15 +181,14 @@ bool ReadFontCollection(const uint8_t* data, size_t len,
                         FontCollection* font_collection) {
   Buffer file(data, len);
 
-  uint32_t flavor;
-  if (!file.ReadU32(&flavor)) {
+  if (!file.ReadU32(&font_collection->flavor)) {
     return FONT_COMPRESSION_FAILURE();
   }
 
-  if (flavor != kTtcFontFlavor) {
+  if (font_collection->flavor != kTtcFontFlavor) {
     font_collection->fonts.resize(1);
     Font& font = font_collection->fonts[0];
-    font.flavor = flavor;
+    font.flavor = font_collection->flavor;
     return ReadTrueTypeFont(&file, data, len, &font);
   }
   return ReadTrueTypeCollection(&file, data, len, font_collection);
@@ -290,7 +285,7 @@ bool WriteFontCollection(const FontCollection& font_collection, uint8_t* dst,
   size_t offset = 0;
 
   // It's simpler if this just a simple sfnt
-  if (font_collection.fonts.size() == 1) {
+  if (font_collection.flavor != kTtcFontFlavor) {
     return WriteFont(font_collection.fonts[0], &offset, dst, dst_size);
   }
 
@@ -301,7 +296,7 @@ bool WriteFontCollection(const FontCollection& font_collection, uint8_t* dst,
 
   // Offset Table, zeroed for now
   size_t offset_table = offset;  // where to write offsets later
-  for (int i = 0; i < font_collection.fonts.size(); i++) {
+  for (size_t i = 0; i < font_collection.fonts.size(); i++) {
     StoreU32(0, &offset, dst);
   }
 
@@ -312,7 +307,7 @@ bool WriteFontCollection(const FontCollection& font_collection, uint8_t* dst,
   }
 
   // Write fonts and their offsets.
-  for (int i = 0; i < font_collection.fonts.size(); i++) {
+  for (size_t i = 0; i < font_collection.fonts.size(); i++) {
     const auto& font = font_collection.fonts[i];
     StoreU32(offset, &offset_table, dst);
     if (!WriteFont(font, &offset, dst, dst_size)) {
diff --git a/Source/ThirdParty/woff2/src/font.h b/Source/ThirdParty/woff2/src/font.h
index 601c4c8f8..93806e6b5 100644
--- a/Source/ThirdParty/woff2/src/font.h
+++ b/Source/ThirdParty/woff2/src/font.h
@@ -61,6 +61,7 @@ struct Font {
 
 // Accomodates both singular (OTF, TTF) and collection (TTC) fonts
 struct FontCollection {
+  uint32_t flavor;
   uint32_t header_version;
   // (offset, first use of table*) pairs
   std::map<uint32_t, Font::Table*> tables;
diff --git a/Source/ThirdParty/woff2/src/glyph.cc b/Source/ThirdParty/woff2/src/glyph.cc
index 17bef382c..1dadafcb7 100644
--- a/Source/ThirdParty/woff2/src/glyph.cc
+++ b/Source/ThirdParty/woff2/src/glyph.cc
@@ -122,7 +122,7 @@ bool ReadGlyph(const uint8_t* data, size_t len, Glyph* glyph) {
     uint8_t flag_repeat = 0;
     for (int i = 0; i < num_contours; ++i) {
       flags[i].resize(glyph->contours[i].size());
-      for (int j = 0; j < glyph->contours[i].size(); ++j) {
+      for (size_t j = 0; j < glyph->contours[i].size(); ++j) {
         if (flag_repeat == 0) {
           if (!buffer.ReadU8(&flag)) {
             return FONT_COMPRESSION_FAILURE();
@@ -143,7 +143,7 @@ bool ReadGlyph(const uint8_t* data, size_t len, Glyph* glyph) {
     // Read the x coordinates.
     int prev_x = 0;
     for (int i = 0; i < num_contours; ++i) {
-      for (int j = 0; j < glyph->contours[i].size(); ++j) {
+      for (size_t j = 0; j < glyph->contours[i].size(); ++j) {
         uint8_t flag = flags[i][j];
         if (flag & kFLAG_XSHORT) {
           // single byte x-delta coord value
@@ -170,7 +170,7 @@ bool ReadGlyph(const uint8_t* data, size_t len, Glyph* glyph) {
     // Read the y coordinates.
     int prev_y = 0;
     for (int i = 0; i < num_contours; ++i) {
-      for (int j = 0; j < glyph->contours[i].size(); ++j) {
+      for (size_t j = 0; j < glyph->contours[i].size(); ++j) {
         uint8_t flag = flags[i][j];
         if (flag & kFLAG_YSHORT) {
           // single byte y-delta coord value
diff --git a/Source/ThirdParty/woff2/src/store_bytes.h b/Source/ThirdParty/woff2/src/store_bytes.h
index e1a11f38c..74b279c42 100644
--- a/Source/ThirdParty/woff2/src/store_bytes.h
+++ b/Source/ThirdParty/woff2/src/store_bytes.h
@@ -58,8 +58,7 @@ inline void Store16(int val, size_t* offset, uint8_t* dst) {
       ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
   *offset += 2;
 #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
-  *reinterpret_cast<uint16_t*>(dst + *offset) =
-      static_cast<uint16_t>(val);
+  *reinterpret_cast<uint16_t*>(dst + *offset) = static_cast<uint16_t>(val);
   *offset += 2;
 #else
   dst[(*offset)++] = val >> 8;
diff --git a/Source/ThirdParty/woff2/src/transform.cc b/Source/ThirdParty/woff2/src/transform.cc
index b7b0cf033..2ad8b163c 100644
--- a/Source/ThirdParty/woff2/src/transform.cc
+++ b/Source/ThirdParty/woff2/src/transform.cc
@@ -39,7 +39,7 @@ void WriteBytes(std::vector<uint8_t>* out, const uint8_t* data, size_t len) {
 }
 
 void WriteBytes(std::vector<uint8_t>* out, const std::vector<uint8_t>& in) {
-  for (int i = 0; i < in.size(); ++i) {
+  for (size_t i = 0; i < in.size(); ++i) {
     out->push_back(in[i]);
   }
 }
diff --git a/Source/ThirdParty/woff2/src/woff2_common.cc b/Source/ThirdParty/woff2/src/woff2_common.cc
index 39dc54e6f..eba6a46e2 100644
--- a/Source/ThirdParty/woff2/src/woff2_common.cc
+++ b/Source/ThirdParty/woff2/src/woff2_common.cc
@@ -23,7 +23,8 @@ namespace woff2 {
 
 uint32_t ComputeULongSum(const uint8_t* buf, size_t size) {
   uint32_t checksum = 0;
-  for (size_t i = 0; i < size; i += 4) {
+  size_t aligned_size = size & ~3;
+  for (size_t i = 0; i < aligned_size; i += 4) {
 #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
     uint32_t v = *reinterpret_cast<const uint32_t*>(buf + i);
     checksum += (((v & 0xFF) << 24) | ((v & 0xFF00) << 8) |
@@ -35,6 +36,16 @@ uint32_t ComputeULongSum(const uint8_t* buf, size_t size) {
       (buf[i + 2] << 8) | buf[i + 3];
 #endif
   }
+
+  // treat size not aligned on 4 as if it were padded to 4 with 0's
+  if (size != aligned_size) {
+    uint32_t v = 0;
+    for (size_t i = aligned_size; i < size; ++i) {
+      v |= buf[i] << (24 - 8 * (i & 3));
+    }
+    checksum += v;
+  }
+
   return checksum;
 }
 
diff --git a/Source/ThirdParty/woff2/src/woff2_compress.cc b/Source/ThirdParty/woff2/src/woff2_compress.cc
index ec41ad5cb..e5cf710f7 100644
--- a/Source/ThirdParty/woff2/src/woff2_compress.cc
+++ b/Source/ThirdParty/woff2/src/woff2_compress.cc
@@ -47,7 +47,7 @@ int main(int argc, char **argv) {
   }
   output.resize(output_size);
 
-  woff2::SetFileContents(outfilename, output);
+  woff2::SetFileContents(outfilename, output.begin(), output.end());
 
   return 0;
 }
diff --git a/Source/ThirdParty/woff2/src/woff2_dec.cc b/Source/ThirdParty/woff2/src/woff2_dec.cc
index 2fa291c3a..ec75775a0 100644
--- a/Source/ThirdParty/woff2/src/woff2_dec.cc
+++ b/Source/ThirdParty/woff2/src/woff2_dec.cc
@@ -25,6 +25,7 @@
 #include <vector>
 #include <map>
 #include <memory>
+#include <utility>
 
 #include "./decode.h"
 #include "./buffer.h"
@@ -65,13 +66,54 @@ const size_t kCheckSumAdjustmentOffset = 8;
 const size_t kEndPtsOfContoursOffset = 10;
 const size_t kCompositeGlyphBegin = 10;
 
+// 98% of Google Fonts have no glyph above 5k bytes
+// Largest glyph ever observed was 72k bytes
+const size_t kDefaultGlyphBuf = 5120;
+
+// Over 14k test fonts the max compression ratio seen to date was ~20.
+// >100 suggests you wrote a bad uncompressed size.
+const float kMaxPlausibleCompressionRatio = 100.0;
+
 // metadata for a TTC font entry
 struct TtcFont {
   uint32_t flavor;
   uint32_t dst_offset;
+  uint32_t header_checksum;
   std::vector<uint16_t> table_indices;
 };
 
+struct WOFF2Header {
+  uint32_t flavor;
+  uint32_t header_version;
+  uint16_t num_tables;
+  uint64_t compressed_offset;
+  uint32_t compressed_length;
+  uint32_t uncompressed_size;
+  std::vector<Table> tables;  // num_tables unique tables
+  std::vector<TtcFont> ttc_fonts;  // metadata to help rebuild font
+};
+
+/**
+ * Accumulates data we may need to reconstruct a single font. One per font
+ * created for a TTC.
+ */
+struct WOFF2FontInfo {
+  uint16_t num_glyphs;
+  uint16_t index_format;
+  uint16_t num_hmetrics;
+  std::vector<int16_t> x_mins;
+  std::map<uint32_t, uint32_t> table_entry_by_tag;
+};
+
+// Accumulates metadata as we rebuild the font
+struct RebuildMetadata {
+  uint32_t header_checksum;  // set by WriteHeaders
+  std::vector<WOFF2FontInfo> font_infos;
+  // checksums for tables that have been written.
+  // (tag, src_offset) => checksum. Need both because 0-length loca.
+  std::map<std::pair<uint32_t, uint32_t>, uint32_t> checksums;
+};
+
 int WithSign(int flag, int baseval) {
   // Precondition: 0 <= baseval < 65536 (to avoid integer overflow)
   return (flag & 1) ? baseval : -baseval;
@@ -244,6 +286,7 @@ bool StorePoints(unsigned int n_points, const Point* points,
 
 // Compute the bounding box of the coordinates, and store into a glyf buffer.
 // A precondition is that there are at least 10 bytes available.
+// dst should point to the beginning of a 'glyf' record.
 void ComputeBbox(unsigned int n_points, const Point* points, uint8_t* dst) {
   int x_min = 0;
   int y_min = 0;
@@ -271,14 +314,15 @@ void ComputeBbox(unsigned int n_points, const Point* points, uint8_t* dst) {
   offset = Store16(dst, offset, y_max);
 }
 
-bool ProcessComposite(Buffer* composite_stream, uint8_t* dst,
-    size_t dst_size, size_t* glyph_size, bool* have_instructions) {
-  size_t start_offset = composite_stream->offset();
+
+bool SizeOfComposite(Buffer composite_stream, size_t* size,
+                     bool* have_instructions) {
+  size_t start_offset = composite_stream.offset();
   bool we_have_instructions = false;
 
   uint16_t flags = FLAG_MORE_COMPONENTS;
   while (flags & FLAG_MORE_COMPONENTS) {
-    if (PREDICT_FALSE(!composite_stream->ReadU16(&flags))) {
+    if (PREDICT_FALSE(!composite_stream.ReadU16(&flags))) {
       return FONT_COMPRESSION_FAILURE();
     }
     we_have_instructions |= (flags & FLAG_WE_HAVE_INSTRUCTIONS) != 0;
@@ -295,34 +339,43 @@ bool ProcessComposite(Buffer* composite_stream, uint8_t* dst,
     } else if (flags & FLAG_WE_HAVE_A_TWO_BY_TWO) {
       arg_size += 8;
     }
-    if (PREDICT_FALSE(!composite_stream->Skip(arg_size))) {
+    if (PREDICT_FALSE(!composite_stream.Skip(arg_size))) {
       return FONT_COMPRESSION_FAILURE();
     }
   }
-  size_t composite_glyph_size = composite_stream->offset() - start_offset;
-  if (PREDICT_FALSE(composite_glyph_size + kCompositeGlyphBegin > dst_size)) {
+
+  *size = composite_stream.offset() - start_offset;
+  *have_instructions = we_have_instructions;
+
+  return true;
+}
+
+bool Pad4(WOFF2Out* out) {
+  uint8_t zeroes[] = {0, 0, 0};
+  if (PREDICT_FALSE(out->Size() + 3 < out->Size())) {
     return FONT_COMPRESSION_FAILURE();
   }
-  Store16(dst, 0, 0xffff);  // nContours = -1 for composite glyph
-  std::memcpy(dst + kCompositeGlyphBegin,
-      composite_stream->buffer() + start_offset,
-      composite_glyph_size);
-  *glyph_size = kCompositeGlyphBegin + composite_glyph_size;
-  *have_instructions = we_have_instructions;
+  uint32_t pad_bytes = Round4(out->Size()) - out->Size();
+  if (pad_bytes > 0) {
+    if (PREDICT_FALSE(!out->Write(&zeroes, pad_bytes))) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+  }
   return true;
 }
 
 // Build TrueType loca table
 bool StoreLoca(const std::vector<uint32_t>& loca_values, int index_format,
-               uint8_t* dst, size_t dst_size) {
+               uint32_t* checksum, WOFF2Out* out) {
+  // TODO(user) figure out what index format to use based on whether max
+  // offset fits into uint16_t or not
   const uint64_t loca_size = loca_values.size();
   const uint64_t offset_size = index_format ? 4 : 2;
   if (PREDICT_FALSE((loca_size << 2) >> 2 != loca_size)) {
     return FONT_COMPRESSION_FAILURE();
   }
-  if (PREDICT_FALSE(offset_size * loca_size > dst_size)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
+  std::vector<uint8_t> loca_content(loca_size * offset_size);
+  uint8_t* dst = &loca_content[0];
   size_t offset = 0;
   for (size_t i = 0; i < loca_values.size(); ++i) {
     uint32_t value = loca_values[i];
@@ -332,30 +385,34 @@ bool StoreLoca(const std::vector<uint32_t>& loca_values, int index_format,
       offset = Store16(dst, offset, value >> 1);
     }
   }
+  *checksum = ComputeULongSum(&loca_content[0], loca_content.size());
+  if (PREDICT_FALSE(!out->Write(&loca_content[0], loca_content.size()))) {
+    return FONT_COMPRESSION_FAILURE();
+  }
   return true;
 }
 
 // Reconstruct entire glyf table based on transformed original
-bool ReconstructGlyf(const uint8_t* data, size_t data_size,
-                     uint8_t* dst, size_t dst_size,
-                     uint8_t* loca_buf, size_t loca_size) {
+bool ReconstructGlyf(const uint8_t* data, Table* glyf_table,
+                     uint32_t* glyf_checksum, Table * loca_table,
+                     uint32_t* loca_checksum, WOFF2FontInfo* info,
+                     WOFF2Out* out) {
   static const int kNumSubStreams = 7;
-  Buffer file(data, data_size);
+  Buffer file(data, glyf_table->transform_length);
   uint32_t version;
   std::vector<std::pair<const uint8_t*, size_t> > substreams(kNumSubStreams);
+  const size_t glyf_start = out->Size();
 
   if (PREDICT_FALSE(!file.ReadU32(&version))) {
     return FONT_COMPRESSION_FAILURE();
   }
-  uint16_t num_glyphs;
-  uint16_t index_format;
-  if (PREDICT_FALSE(!file.ReadU16(&num_glyphs) ||
-      !file.ReadU16(&index_format))) {
+  if (PREDICT_FALSE(!file.ReadU16(&info->num_glyphs) ||
+      !file.ReadU16(&info->index_format))) {
     return FONT_COMPRESSION_FAILURE();
   }
 
   unsigned int offset = (2 + kNumSubStreams) * 4;
-  if (PREDICT_FALSE(offset > data_size)) {
+  if (PREDICT_FALSE(offset > glyf_table->transform_length)) {
     return FONT_COMPRESSION_FAILURE();
   }
   // Invariant from here on: data_size >= offset
@@ -364,7 +421,7 @@ bool ReconstructGlyf(const uint8_t* data, size_t data_size,
     if (PREDICT_FALSE(!file.ReadU32(&substream_size))) {
       return FONT_COMPRESSION_FAILURE();
     }
-    if (PREDICT_FALSE(substream_size > data_size - offset)) {
+    if (PREDICT_FALSE(substream_size > glyf_table->transform_length - offset)) {
       return FONT_COMPRESSION_FAILURE();
     }
     substreams[i] = std::make_pair(data + offset, substream_size);
@@ -378,18 +435,23 @@ bool ReconstructGlyf(const uint8_t* data, size_t data_size,
   Buffer bbox_stream(substreams[5].first, substreams[5].second);
   Buffer instruction_stream(substreams[6].first, substreams[6].second);
 
-  std::vector<uint32_t> loca_values(num_glyphs + 1);
+  std::vector<uint32_t> loca_values(info->num_glyphs + 1);
   std::vector<unsigned int> n_points_vec;
   std::unique_ptr<Point[]> points;
   size_t points_size = 0;
-  uint32_t loca_offset = 0;
   const uint8_t* bbox_bitmap = bbox_stream.buffer();
   // Safe because num_glyphs is bounded
-  unsigned int bitmap_length = ((num_glyphs + 31) >> 5) << 2;
+  unsigned int bitmap_length = ((info->num_glyphs + 31) >> 5) << 2;
   if (!bbox_stream.Skip(bitmap_length)) {
     return FONT_COMPRESSION_FAILURE();
   }
-  for (unsigned int i = 0; i < num_glyphs; ++i) {
+
+  // Temp buffer for glyph's.
+  size_t glyph_buf_size = kDefaultGlyphBuf;
+  std::unique_ptr<uint8_t[]> glyph_buf(new uint8_t[glyph_buf_size]);
+
+  info->x_mins.resize(info->num_glyphs);
+  for (unsigned int i = 0; i < info->num_glyphs; ++i) {
     size_t glyph_size = 0;
     uint16_t n_contours = 0;
     bool have_bbox = false;
@@ -399,8 +461,6 @@ bool ReconstructGlyf(const uint8_t* data, size_t data_size,
     if (PREDICT_FALSE(!n_contour_stream.ReadU16(&n_contours))) {
       return FONT_COMPRESSION_FAILURE();
     }
-    uint8_t* glyf_dst = dst + loca_offset;
-    size_t glyf_dst_size = dst_size - loca_offset;
 
     if (n_contours == 0xffff) {
       // composite glyph
@@ -410,26 +470,42 @@ bool ReconstructGlyf(const uint8_t* data, size_t data_size,
         // composite glyphs must have an explicit bbox
         return FONT_COMPRESSION_FAILURE();
       }
-      if (PREDICT_FALSE(!ProcessComposite(&composite_stream, glyf_dst,
-            glyf_dst_size, &glyph_size, &have_instructions))) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-      if (PREDICT_FALSE(!bbox_stream.Read(glyf_dst + 2, 8))) {
+
+      size_t composite_size;
+      if (PREDICT_FALSE(!SizeOfComposite(composite_stream, &composite_size,
+                                         &have_instructions))) {
         return FONT_COMPRESSION_FAILURE();
       }
       if (have_instructions) {
         if (PREDICT_FALSE(!Read255UShort(&glyph_stream, &instruction_size))) {
           return FONT_COMPRESSION_FAILURE();
         }
-        if (PREDICT_FALSE(instruction_size + 2 > glyf_dst_size - glyph_size)) {
-          return FONT_COMPRESSION_FAILURE();
-        }
-        Store16(glyf_dst, glyph_size, instruction_size);
-        if (PREDICT_FALSE(!instruction_stream.Read(glyf_dst + glyph_size + 2,
+      }
+
+      size_t size_needed = 12 + composite_size + instruction_size;
+      if (PREDICT_FALSE(glyph_buf_size < size_needed)) {
+        glyph_buf.reset(new uint8_t[size_needed]);
+        glyph_buf_size = size_needed;
+      }
+
+      glyph_size = Store16(glyph_buf.get(), glyph_size, n_contours);
+      if (PREDICT_FALSE(!bbox_stream.Read(glyph_buf.get() + glyph_size, 8))) {
+        return FONT_COMPRESSION_FAILURE();
+      }
+      glyph_size += 8;
+
+      if (PREDICT_FALSE(!composite_stream.Read(glyph_buf.get() + glyph_size,
+            composite_size))) {
+        return FONT_COMPRESSION_FAILURE();
+      }
+      glyph_size += composite_size;
+      if (have_instructions) {
+        glyph_size = Store16(glyph_buf.get(), glyph_size, instruction_size);
+        if (PREDICT_FALSE(!instruction_stream.Read(glyph_buf.get() + glyph_size,
               instruction_size))) {
           return FONT_COMPRESSION_FAILURE();
         }
-        glyph_size += instruction_size + 2;
+        glyph_size += instruction_size;
       }
     } else if (n_contours > 0) {
       // simple glyph
@@ -465,141 +541,110 @@ bool ReconstructGlyf(const uint8_t* data, size_t data_size,
           total_n_points, points.get(), &triplet_bytes_consumed))) {
         return FONT_COMPRESSION_FAILURE();
       }
-      const uint32_t header_and_endpts_contours_size =
-          kEndPtsOfContoursOffset + 2 * n_contours;
-      if (PREDICT_FALSE(glyf_dst_size < header_and_endpts_contours_size)) {
+      if (PREDICT_FALSE(!flag_stream.Skip(flag_size))) {
         return FONT_COMPRESSION_FAILURE();
       }
-      Store16(glyf_dst, 0, n_contours);
+      if (PREDICT_FALSE(!glyph_stream.Skip(triplet_bytes_consumed))) {
+        return FONT_COMPRESSION_FAILURE();
+      }
+      unsigned int instruction_size;
+      if (PREDICT_FALSE(!Read255UShort(&glyph_stream, &instruction_size))) {
+        return FONT_COMPRESSION_FAILURE();
+      }
+
+      if (PREDICT_FALSE(total_n_points >= (1 << 27)
+                        || instruction_size >= (1 << 30))) {
+        return FONT_COMPRESSION_FAILURE();
+      }
+      size_t size_needed = 12 + 2 * n_contours + 5 * total_n_points
+                           + instruction_size;
+      if (PREDICT_FALSE(glyph_buf_size < size_needed)) {
+        glyph_buf.reset(new uint8_t[size_needed]);
+        glyph_buf_size = size_needed;
+      }
+
+      glyph_size = Store16(glyph_buf.get(), glyph_size, n_contours);
       if (have_bbox) {
-        if (PREDICT_FALSE(!bbox_stream.Read(glyf_dst + 2, 8))) {
+        if (PREDICT_FALSE(!bbox_stream.Read(glyph_buf.get() + glyph_size, 8))) {
           return FONT_COMPRESSION_FAILURE();
         }
       } else {
-        ComputeBbox(total_n_points, points.get(), glyf_dst);
+        ComputeBbox(total_n_points, points.get(), glyph_buf.get());
       }
-      size_t offset = kEndPtsOfContoursOffset;
+      glyph_size = kEndPtsOfContoursOffset;
       int end_point = -1;
       for (unsigned int contour_ix = 0; contour_ix < n_contours; ++contour_ix) {
         end_point += n_points_vec[contour_ix];
         if (PREDICT_FALSE(end_point >= 65536)) {
           return FONT_COMPRESSION_FAILURE();
         }
-        offset = Store16(glyf_dst, offset, end_point);
-      }
-      if (PREDICT_FALSE(!flag_stream.Skip(flag_size))) {
-        return FONT_COMPRESSION_FAILURE();
+        glyph_size = Store16(glyph_buf.get(), glyph_size, end_point);
       }
-      if (PREDICT_FALSE(!glyph_stream.Skip(triplet_bytes_consumed))) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-      unsigned int instruction_size;
-      if (PREDICT_FALSE(!Read255UShort(&glyph_stream, &instruction_size))) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-      if (PREDICT_FALSE(glyf_dst_size - header_and_endpts_contours_size <
-          instruction_size + 2)) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-      uint8_t* instruction_dst = glyf_dst + header_and_endpts_contours_size;
-      Store16(instruction_dst, 0, instruction_size);
-      if (PREDICT_FALSE(
-          !instruction_stream.Read(instruction_dst + 2, instruction_size))) {
+
+      glyph_size = Store16(glyph_buf.get(), glyph_size, instruction_size);
+      if (PREDICT_FALSE(!instruction_stream.Read(glyph_buf.get() + glyph_size,
+                                                 instruction_size))) {
         return FONT_COMPRESSION_FAILURE();
       }
+      glyph_size += instruction_size;
+
       if (PREDICT_FALSE(!StorePoints(total_n_points, points.get(), n_contours,
-            instruction_size, glyf_dst, glyf_dst_size, &glyph_size))) {
+            instruction_size, glyph_buf.get(), glyph_buf_size, &glyph_size))) {
         return FONT_COMPRESSION_FAILURE();
       }
-    } else {
-      glyph_size = 0;
     }
-    loca_values[i] = loca_offset;
-    if (PREDICT_FALSE(glyph_size + 3 < glyph_size)) {
+
+    loca_values[i] = out->Size() - glyf_start;
+    if (PREDICT_FALSE(!out->Write(glyph_buf.get(), glyph_size))) {
       return FONT_COMPRESSION_FAILURE();
     }
-    glyph_size = Round4(glyph_size);
-    if (PREDICT_FALSE(glyph_size > dst_size - loca_offset)) {
-      // This shouldn't happen, but this test defensively maintains the
-      // invariant that loca_offset <= dst_size.
+
+    // TODO(user) Old code aligned glyphs ... but do we actually need to?
+    if (PREDICT_FALSE(!Pad4(out))) {
       return FONT_COMPRESSION_FAILURE();
     }
-    loca_offset += glyph_size;
-  }
-  loca_values[num_glyphs] = loca_offset;
-  return StoreLoca(loca_values, index_format, loca_buf, loca_size);
-}
 
-// This is linear search, but could be changed to binary because we
-// do have a guarantee that the tables are sorted by tag. But the total
-// cpu time is expected to be very small in any case.
-const Table* FindTable(const std::vector<Table>& tables, uint32_t tag) {
-  size_t n_tables = tables.size();
-  for (size_t i = 0; i < n_tables; ++i) {
-    if (tables[i].tag == tag) {
-      return &tables[i];
+    *glyf_checksum += ComputeULongSum(glyph_buf.get(), glyph_size);
+
+    // We may need x_min to reconstruct 'hmtx'
+    if (n_contours > 0) {
+      Buffer x_min_buf(glyph_buf.get() + 2, 2);
+      if (PREDICT_FALSE(!x_min_buf.ReadS16(&info->x_mins[i]))) {
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
   }
-  return NULL;
-}
 
-// https://www.microsoft.com/typography/otspec/maxp.htm
-bool ReadNumGlyphs(const Table* maxp_table,
-                   uint8_t* dst, size_t dst_length, uint16_t* num_glyphs) {
-  if (PREDICT_FALSE(static_cast<uint64_t>(maxp_table->dst_offset +
-      maxp_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  Buffer buffer(dst + maxp_table->dst_offset, maxp_table->dst_length);
-  // Skip 4 to reach 'maxp' numGlyphs
-  if (PREDICT_FALSE(!buffer.Skip(4) || !buffer.ReadU16(num_glyphs))) {
+  // glyf_table dst_offset was set by ReconstructFont
+  glyf_table->dst_length = out->Size() - glyf_table->dst_offset;
+  loca_table->dst_offset = out->Size();
+  // loca[n] will be equal the length of the glyph data ('glyf') table
+  loca_values[info->num_glyphs] = glyf_table->dst_length;
+  if (PREDICT_FALSE(!StoreLoca(loca_values, info->index_format, loca_checksum,
+      out))) {
     return FONT_COMPRESSION_FAILURE();
   }
-  return true;
-}
+  loca_table->dst_length = out->Size() - loca_table->dst_offset;
 
-// Get numberOfHMetrics, https://www.microsoft.com/typography/otspec/hhea.htm
-bool ReadNumHMetrics(const Table* hhea_table,
-                     uint8_t* dst, size_t dst_length, uint16_t* num_hmetrics) {
-  if (PREDICT_FALSE(static_cast<uint64_t>(hhea_table->dst_offset +
-      hhea_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  // Skip 34 to reach 'hhea' numberOfHMetrics
-  Buffer buffer(dst + hhea_table->dst_offset, hhea_table->dst_length);
-  if (PREDICT_FALSE(!buffer.Skip(34) || !buffer.ReadU16(num_hmetrics))) {
-    return FONT_COMPRESSION_FAILURE();
-  }
   return true;
 }
 
-// x_min for glyph; https://www.microsoft.com/typography/otspec/glyf.htm
-bool ReadGlyphXMin(Buffer* glyf_buff, Buffer* loca_buff, int16_t loca_format,
-                   uint16_t index, int16_t* x_min) {
-  uint32_t offset1, offset2;
-  loca_buff->set_offset((loca_format == 0 ? 2 : 4) * index);
-  if (loca_format == 0) {
-    uint16_t tmp1, tmp2;
-    if (PREDICT_FALSE(!loca_buff->ReadU16(&tmp1) ||
-                      !loca_buff->ReadU16(&tmp2))) {
-      return FONT_COMPRESSION_FAILURE();
+Table* FindTable(std::vector<Table*>* tables, uint32_t tag) {
+  for (Table* table : *tables) {
+    if (table->tag == tag) {
+      return table;
     }
-    // https://www.microsoft.com/typography/otspec/loca.htm
-    // "The actual local offset divided by 2 is stored."
-    offset1 = tmp1 * 2;
-    offset2 = tmp2 * 2;
-  } else if (PREDICT_FALSE(!loca_buff->ReadU32(&offset1) ||
-                           !loca_buff->ReadU32(&offset2))) {
-    return FONT_COMPRESSION_FAILURE();
   }
+  return NULL;
+}
 
-  if (offset1 != offset2) {
-    glyf_buff->set_offset(offset1 + 2);
-    if (!glyf_buff->ReadS16(x_min)) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-  } else {
-    *x_min = 0;
+// Get numberOfHMetrics, https://www.microsoft.com/typography/otspec/hhea.htm
+bool ReadNumHMetrics(const uint8_t* data, size_t data_size,
+                     uint16_t* num_hmetrics) {
+  // Skip 34 to reach 'hhea' numberOfHMetrics
+  Buffer buffer(data, data_size);
+  if (PREDICT_FALSE(!buffer.Skip(34) || !buffer.ReadU16(num_hmetrics))) {
+    return FONT_COMPRESSION_FAILURE();
   }
   return true;
 }
@@ -607,40 +652,11 @@ bool ReadGlyphXMin(Buffer* glyf_buff, Buffer* loca_buff, int16_t loca_format,
 // http://dev.w3.org/webfonts/WOFF2/spec/Overview.html#hmtx_table_format
 bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
                                 size_t transformed_size,
-                                const Table* glyf_table,
-                                const Table* hhea_table,
-                                const Table* hmtx_table,
-                                const Table* loca_table,
-                                const Table* maxp_table,
-                                uint8_t* dst, size_t dst_length) {
-  if (PREDICT_FALSE(!glyf_table)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(!hhea_table)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(!hmtx_table)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(!loca_table)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(!maxp_table)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-
-  uint16_t num_glyphs, num_hmetrics;
-  if (!ReadNumGlyphs(maxp_table, dst, dst_length, &num_glyphs)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (!ReadNumHMetrics(hhea_table, dst, dst_length, &num_hmetrics)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-
-  if (PREDICT_FALSE(static_cast<uint64_t>(hmtx_table->dst_offset +
-      hmtx_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
+                                uint16_t num_glyphs,
+                                uint16_t num_hmetrics,
+                                const std::vector<int16_t>& x_mins,
+                                uint32_t* checksum,
+                                WOFF2Out* out) {
   Buffer hmtx_buff_in(transformed_buf, transformed_size);
 
   uint8_t hmtx_flags;
@@ -658,23 +674,16 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
     return FONT_COMPRESSION_FAILURE();
   }
 
-  // glyf/loca are done already so we can use them to recover x_min's
-  if (PREDICT_FALSE(static_cast<uint64_t>(glyf_table->dst_offset +
-      glyf_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(static_cast<uint64_t>(loca_table->dst_offset +
-      loca_table->dst_length) > dst_length)) {
+  assert(x_mins.size() == num_glyphs);
+
+  // num_glyphs 0 is OK if there is no 'glyf' but cannot then xform 'hmtx'.
+  if (PREDICT_FALSE(num_hmetrics > num_glyphs)) {
     return FONT_COMPRESSION_FAILURE();
   }
-  Buffer glyf_buff(dst + glyf_table->dst_offset, glyf_table->dst_length);
-  Buffer loca_buff(dst + loca_table->dst_offset, loca_table->dst_length);
-  int16_t loca_format;
-  if (loca_table->dst_length == 2 * (num_glyphs + 1)) {
-    loca_format = 0;
-  } else if (loca_table->dst_length == 4 * (num_glyphs + 1)) {
-    loca_format = 1;
-  } else {
+
+  // https://www.microsoft.com/typography/otspec/hmtx.htm
+  // "...only one entry need be in the array, but that entry is required."
+  if (PREDICT_FALSE(num_hmetrics < 1)) {
     return FONT_COMPRESSION_FAILURE();
   }
 
@@ -693,10 +702,7 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
         return FONT_COMPRESSION_FAILURE();
       }
     } else {
-      if (PREDICT_FALSE(!ReadGlyphXMin(&glyf_buff, &loca_buff, loca_format, i,
-          &lsb))) {
-        return FONT_COMPRESSION_FAILURE();
-      }
+      lsb = x_mins[i];
     }
     lsbs.push_back(lsb);
   }
@@ -708,25 +714,16 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
         return FONT_COMPRESSION_FAILURE();
       }
     } else {
-      if (PREDICT_FALSE(!ReadGlyphXMin(&glyf_buff, &loca_buff, loca_format, i,
-          &lsb))) {
-        return FONT_COMPRESSION_FAILURE();
-      }
+      lsb = x_mins[i];
     }
     lsbs.push_back(lsb);
   }
 
   // bake me a shiny new hmtx table
   uint32_t hmtx_output_size = 2 * num_glyphs + 2 * num_hmetrics;
-  if (hmtx_output_size > hmtx_table->dst_length) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(static_cast<uint64_t>(hmtx_table->dst_offset +
-      hmtx_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-
-  size_t dst_offset = hmtx_table->dst_offset;
+  std::vector<uint8_t> hmtx_table(hmtx_output_size);
+  uint8_t* dst = &hmtx_table[0];
+  size_t dst_offset = 0;
   for (uint32_t i = 0; i < num_glyphs; i++) {
     if (i < num_hmetrics) {
       Store16(advance_widths[i], &dst_offset, dst);
@@ -734,152 +731,14 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
     Store16(lsbs[i], &dst_offset, dst);
   }
 
-  return true;
-}
-
-bool ReconstructTransformedGlyf(const uint8_t* transformed_buf,
-    size_t transformed_size, const Table* glyf_table, const Table* loca_table,
-    uint8_t* dst, size_t dst_length) {
-  if (PREDICT_FALSE(glyf_table == NULL || loca_table == NULL)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(static_cast<uint64_t>(glyf_table->dst_offset +
-      glyf_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  if (PREDICT_FALSE(static_cast<uint64_t>(loca_table->dst_offset +
-     loca_table->dst_length) > dst_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  return ReconstructGlyf(transformed_buf, transformed_size,
-                         dst + glyf_table->dst_offset, glyf_table->dst_length,
-                         dst + loca_table->dst_offset, loca_table->dst_length);
-}
-
-// Reconstructs a single font. tables must not contain duplicates.
-bool ReconstructTransformed(const std::vector<Table>& tables, uint32_t tag,
-    const uint8_t* transformed_buf, size_t transformed_size,
-    uint8_t* dst, size_t dst_length) {
-
-  if (tag == kGlyfTableTag) {
-    const Table* glyf_table = FindTable(tables, tag);
-    const Table* loca_table = FindTable(tables, kLocaTableTag);
-    return ReconstructTransformedGlyf(transformed_buf, transformed_size,
-                                      glyf_table, loca_table, dst, dst_length);
-  } else if (tag == kLocaTableTag) {
-    // processing was already done by glyf table, but validate
-    if (PREDICT_FALSE(!FindTable(tables, kGlyfTableTag))) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-  } else if (tag == kHmtxTableTag) {
-    // Tables are sorted for a non-collection.
-    // glyf is before hmtx and includes loca so all our accesses are safe.
-    const Table* glyf_table = FindTable(tables, kGlyfTableTag);
-    const Table* hhea_table = FindTable(tables, kHheaTableTag);
-    const Table* hmtx_table = FindTable(tables, kHmtxTableTag);
-    const Table* loca_table = FindTable(tables, kLocaTableTag);
-    const Table* maxp_table = FindTable(tables, kMaxpTableTag);
-
-    if (PREDICT_FALSE(!ReconstructTransformedHmtx(
-        transformed_buf, transformed_size, glyf_table, hhea_table,
-        hmtx_table, loca_table, maxp_table, dst, dst_length))) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-  } else {
-    // transform for the tag is not known
+  *checksum = ComputeULongSum(&hmtx_table[0], hmtx_output_size);
+  if (PREDICT_FALSE(!out->Write(&hmtx_table[0], hmtx_output_size))) {
     return FONT_COMPRESSION_FAILURE();
   }
-  return true;
-}
-
-uint32_t ComputeChecksum(const Table* table, const uint8_t* dst) {
-  return ComputeULongSum(dst + table->dst_offset, table->dst_length);
-}
-
-const Table* FindTable(TtcFont ttc_font, const std::vector<Table>& tables,
-  uint32_t tag) {
-  for (const auto i : ttc_font.table_indices) {
-    if (tables[i].tag == tag) return &tables[i];
-  }
-  return NULL;
-}
-
-bool FixCollectionChecksums(size_t header_version,
-  const std::vector<Table>& tables, const std::vector<TtcFont>& ttc_fonts,
-  uint8_t* dst) {
-  size_t offset = CollectionHeaderSize(header_version, ttc_fonts.size());
-
-  for (const auto& ttc_font : ttc_fonts) {
-    offset += 12;  // move to start of Offset Table
-    const std::vector<uint16_t>& table_indices = ttc_font.table_indices;
-
-    const Table* head_table = FindTable(ttc_font, tables, kHeadTableTag);
-    if (PREDICT_FALSE(head_table == NULL ||
-        head_table->dst_length < kCheckSumAdjustmentOffset + 4)) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-
-    size_t first_table_offset = std::numeric_limits<size_t>::max();
-    for (const auto index : table_indices) {
-      const auto& table = tables[index];
-      if (table.dst_offset < first_table_offset) {
-        first_table_offset = table.dst_offset;
-      }
-    }
-
-    size_t adjustment_offset = head_table->dst_offset
-      + kCheckSumAdjustmentOffset;
-    StoreU32(dst, adjustment_offset, 0);
-
-    uint32_t file_checksum = 0;
-    // compute each tables checksum
-    for (size_t i = 0; i < table_indices.size(); i++) {
-      const Table& table = tables[table_indices[i]];
-      uint32_t table_checksum = ComputeChecksum(&table, dst);
-      size_t checksum_offset = offset + 4;  // skip past tag to checkSum
-
-      // write the checksum for the Table Record
-      StoreU32(dst, checksum_offset, table_checksum);
-      file_checksum += table_checksum;
-      // next Table Record
-      offset += 16;
-    }
-
-    size_t header_size = kSfntHeaderSize +
-      kSfntEntrySize * table_indices.size();
-    uint32_t header_checksum = ComputeULongSum(dst + ttc_font.dst_offset,
-                                               header_size);
-
-    file_checksum += header_checksum;
-    uint32_t checksum_adjustment = 0xb1b0afba - file_checksum;
-    StoreU32(dst, adjustment_offset, checksum_adjustment);
-  }
 
   return true;
 }
 
-bool FixChecksums(const std::vector<Table>& tables, uint8_t* dst) {
-  const Table* head_table = FindTable(tables, kHeadTableTag);
-  if (PREDICT_FALSE(head_table == NULL ||
-      head_table->dst_length < kCheckSumAdjustmentOffset + 4)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
-  size_t adjustment_offset = head_table->dst_offset + kCheckSumAdjustmentOffset;
-  StoreU32(dst, adjustment_offset, 0);
-  size_t n_tables = tables.size();
-  uint32_t file_checksum = 0;
-  for (size_t i = 0; i < n_tables; ++i) {
-    uint32_t checksum = ComputeChecksum(&tables[i], dst);
-    StoreU32(dst, kSfntHeaderSize + i * kSfntEntrySize + 4, checksum);
-    file_checksum += checksum;
-  }
-  file_checksum += ComputeULongSum(dst,
-                                   kSfntHeaderSize + kSfntEntrySize * n_tables);
-  uint32_t checksum_adjustment = 0xb1b0afba - file_checksum;
-  StoreU32(dst, adjustment_offset, checksum_adjustment);
-  return true;
-}
-
 bool Woff2Uncompress(uint8_t* dst_buf, size_t dst_size,
   const uint8_t* src_buf, size_t src_size) {
   size_t uncompressed_size = dst_size;
@@ -893,6 +752,7 @@ bool Woff2Uncompress(uint8_t* dst_buf, size_t dst_size,
 
 bool ReadTableDirectory(Buffer* file, std::vector<Table>* tables,
     size_t num_tables) {
+  uint32_t src_offset = 0;
   for (size_t i = 0; i < num_tables; ++i) {
     Table* table = &(*tables)[i];
     uint8_t flag_byte;
@@ -933,6 +793,13 @@ bool ReadTableDirectory(Buffer* file, std::vector<Table>* tables,
         return FONT_COMPRESSION_FAILURE();
       }
     }
+    if (PREDICT_FALSE(src_offset + transform_length < src_offset)) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+    table->src_offset = src_offset;
+    table->src_length = transform_length;
+    src_offset += transform_length;
+
     table->tag = tag;
     table->flags = flags;
     table->transform_length = transform_length;
@@ -941,19 +808,6 @@ bool ReadTableDirectory(Buffer* file, std::vector<Table>* tables,
   return true;
 }
 
-}  // namespace
-
-size_t ComputeWOFF2FinalSize(const uint8_t* data, size_t length) {
-  Buffer file(data, length);
-  uint32_t total_length;
-
-  if (!file.Skip(16) ||
-      !file.ReadU32(&total_length)) {
-    return 0;
-  }
-  return total_length;
-}
-
 // Writes a single Offset Table entry
 size_t StoreOffsetTable(uint8_t* result, size_t offset, uint32_t flavor,
                         uint16_t num_tables) {
@@ -971,62 +825,185 @@ size_t StoreOffsetTable(uint8_t* result, size_t offset, uint32_t flavor,
   return offset;
 }
 
-size_t StoreTableEntry(uint8_t* result, const Table& table, size_t offset) {
-  offset = StoreU32(result, offset, table.tag);
-  offset = StoreU32(result, offset, 0);  // checksum, to fill in later
-  offset = StoreU32(result, offset, table.dst_offset);
-  offset = StoreU32(result, offset, table.dst_length);
+size_t StoreTableEntry(uint8_t* result, uint32_t offset, uint32_t tag) {
+  offset = StoreU32(result, offset, tag);
+  offset = StoreU32(result, offset, 0);
+  offset = StoreU32(result, offset, 0);
+  offset = StoreU32(result, offset, 0);
   return offset;
 }
 
 // First table goes after all the headers, table directory, etc
-uint64_t ComputeOffsetToFirstTable(const uint32_t header_version,
-                                   const uint16_t num_tables,
-                                   const std::vector<TtcFont>& ttc_fonts) {
+uint64_t ComputeOffsetToFirstTable(const WOFF2Header& hdr) {
   uint64_t offset = kSfntHeaderSize +
-    kSfntEntrySize * static_cast<uint64_t>(num_tables);
-  if (header_version) {
-    offset = CollectionHeaderSize(header_version, ttc_fonts.size())
-      + kSfntHeaderSize * ttc_fonts.size();
-    for (const auto& ttc_font : ttc_fonts) {
-      offset +=
-        kSfntEntrySize * ttc_font.table_indices.size();
+    kSfntEntrySize * static_cast<uint64_t>(hdr.num_tables);
+  if (hdr.header_version) {
+    offset = CollectionHeaderSize(hdr.header_version, hdr.ttc_fonts.size())
+      + kSfntHeaderSize * hdr.ttc_fonts.size();
+    for (const auto& ttc_font : hdr.ttc_fonts) {
+      offset += kSfntEntrySize * ttc_font.table_indices.size();
     }
   }
   return offset;
 }
 
-bool ReconstructTransformedFont(const std::vector<Table>& tables,
-                                std::map<uint32_t, const uint8_t*>* src_by_dest,
-                                uint8_t* result, size_t result_length) {
-  for (const auto& table : tables) {
-    if ((table.flags & kWoff2FlagsTransform) != kWoff2FlagsTransform) {
-      continue;
+std::vector<Table*> Tables(WOFF2Header* hdr, size_t font_index) {
+  std::vector<Table*> tables;
+  if (PREDICT_FALSE(hdr->header_version)) {
+    for (auto index : hdr->ttc_fonts[font_index].table_indices) {
+      tables.push_back(&hdr->tables[index]);
+    }
+  } else {
+    for (auto& table : hdr->tables) {
+      tables.push_back(&table);
+    }
+  }
+  return tables;
+}
+
+// Offset tables assumed to have been written in with 0's initially.
+// WOFF2Header isn't const so we can use [] instead of at() (which upsets FF)
+bool ReconstructFont(uint8_t* transformed_buf,
+                     const uint32_t transformed_buf_size,
+                     RebuildMetadata* metadata,
+                     WOFF2Header* hdr,
+                     size_t font_index,
+                     WOFF2Out* out) {
+  size_t dest_offset = out->Size();
+  uint8_t table_entry[12];
+  WOFF2FontInfo* info = &metadata->font_infos[font_index];
+  std::vector<Table*> tables = Tables(hdr, font_index);
+
+  // 'glyf' without 'loca' doesn't make sense
+  if (PREDICT_FALSE(static_cast<bool>(FindTable(&tables, kGlyfTableTag)) !=
+                    static_cast<bool>(FindTable(&tables, kLocaTableTag)))) {
+    return FONT_COMPRESSION_FAILURE();
+  }
+
+  uint32_t font_checksum = metadata->header_checksum;
+  if (hdr->header_version) {
+    font_checksum = hdr->ttc_fonts[font_index].header_checksum;
+  }
+
+  uint32_t loca_checksum = 0;
+  for (size_t i = 0; i < tables.size(); i++) {
+    Table& table = *tables[i];
+
+    std::pair<uint32_t, uint32_t> checksum_key = {table.tag, table.src_offset};
+    bool reused = metadata->checksums.find(checksum_key)
+               != metadata->checksums.end();
+    if (PREDICT_FALSE(font_index == 0 && reused)) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+
+    // TODO(user) a collection with optimized hmtx that reused glyf/loca
+    // would fail. We don't optimize hmtx for collections yet.
+    if (PREDICT_FALSE(static_cast<uint64_t>(table.src_offset + table.src_length)
+        > transformed_buf_size)) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+
+    if (table.tag == kHheaTableTag) {
+      if (!ReadNumHMetrics(transformed_buf + table.src_offset,
+          table.src_length, &info->num_hmetrics)) {
+        return FONT_COMPRESSION_FAILURE();
+      }
+    }
+
+    uint32_t checksum = 0;
+    if (!reused) {
+      if ((table.flags & kWoff2FlagsTransform) != kWoff2FlagsTransform) {
+        if (table.tag == kHeadTableTag) {
+          if (PREDICT_FALSE(table.src_length < 12)) {
+            return FONT_COMPRESSION_FAILURE();
+          }
+          // checkSumAdjustment = 0
+          StoreU32(transformed_buf + table.src_offset, 8, 0);
+        }
+        table.dst_offset = dest_offset;
+        checksum = ComputeULongSum(transformed_buf + table.src_offset,
+                                   table.src_length);
+        if (PREDICT_FALSE(!out->Write(transformed_buf + table.src_offset,
+            table.src_length))) {
+          return FONT_COMPRESSION_FAILURE();
+        }
+      } else {
+        if (table.tag == kGlyfTableTag) {
+          table.dst_offset = dest_offset;
+
+          Table* loca_table = FindTable(&tables, kLocaTableTag);
+          if (PREDICT_FALSE(!ReconstructGlyf(transformed_buf + table.src_offset,
+              &table, &checksum, loca_table, &loca_checksum, info, out))) {
+            return FONT_COMPRESSION_FAILURE();
+          }
+        } else if (table.tag == kLocaTableTag) {
+          // All the work was done by ReconstructGlyf. We already know checksum.
+          checksum = loca_checksum;
+        } else if (table.tag == kHmtxTableTag) {
+          table.dst_offset = dest_offset;
+          // Tables are sorted so all the info we need has been gathered.
+          if (PREDICT_FALSE(!ReconstructTransformedHmtx(
+              transformed_buf + table.src_offset, table.src_length,
+              info->num_glyphs, info->num_hmetrics, info->x_mins, &checksum,
+              out))) {
+            return FONT_COMPRESSION_FAILURE();
+          }
+        } else {
+          return FONT_COMPRESSION_FAILURE();  // transform unknown
+        }
+      }
+      metadata->checksums[checksum_key] = checksum;
+    } else {
+      checksum = metadata->checksums[checksum_key];
+    }
+    font_checksum += checksum;
+
+    // update the table entry with real values.
+    StoreU32(table_entry, 0, checksum);
+    StoreU32(table_entry, 4, table.dst_offset);
+    StoreU32(table_entry, 8, table.dst_length);
+    if (PREDICT_FALSE(!out->Write(table_entry,
+        info->table_entry_by_tag[table.tag] + 4, 12))) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+
+    // We replaced 0's. Update overall checksum.
+    font_checksum += ComputeULongSum(table_entry, 12);
+
+    if (PREDICT_FALSE(!Pad4(out))) {
+      return FONT_COMPRESSION_FAILURE();
     }
-    const auto it = src_by_dest->find(table.dst_offset);
-    if (it == src_by_dest->end()) {
-      continue;
+
+    if (PREDICT_FALSE(static_cast<uint64_t>(table.dst_offset + table.dst_length)
+        > out->Size())) {
+      return FONT_COMPRESSION_FAILURE();
     }
-    const uint8_t* transform_buf = (*it).second;
-    src_by_dest->erase(table.dst_offset);
+    dest_offset = out->Size();
+  }
 
-    size_t transform_length = table.transform_length;
-    if (PREDICT_FALSE(!ReconstructTransformed(tables, table.tag,
-            transform_buf, transform_length, result, result_length))) {
+  // Update 'head' checkSumAdjustment. We already set it to 0 and summed font.
+  Table* head_table = FindTable(&tables, kHeadTableTag);
+  if (head_table) {
+    if (PREDICT_FALSE(head_table->dst_length < 12)) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+    uint8_t checksum_adjustment[4];
+    StoreU32(checksum_adjustment, 0, 0xB1B0AFBA - font_checksum);
+    if (PREDICT_FALSE(!out->Write(checksum_adjustment,
+                                  head_table->dst_offset + 8, 4))) {
       return FONT_COMPRESSION_FAILURE();
     }
   }
+
   return true;
 }
 
-bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
-                       const uint8_t* data, size_t length) {
+bool ReadWOFF2Header(const uint8_t* data, size_t length, WOFF2Header* hdr) {
   Buffer file(data, length);
 
   uint32_t signature;
-  uint32_t flavor;
   if (PREDICT_FALSE(!file.ReadU32(&signature) || signature != kWoff2Signature ||
-      !file.ReadU32(&flavor))) {
+      !file.ReadU32(&hdr->flavor))) {
     return FONT_COMPRESSION_FAILURE();
   }
 
@@ -1037,18 +1014,17 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
       !file.ReadU32(&reported_length) || length != reported_length)) {
     return FONT_COMPRESSION_FAILURE();
   }
-  uint16_t num_tables;
-  if (PREDICT_FALSE(!file.ReadU16(&num_tables) || !num_tables)) {
+  if (PREDICT_FALSE(!file.ReadU16(&hdr->num_tables) || !hdr->num_tables)) {
     return FONT_COMPRESSION_FAILURE();
   }
+
   // We don't care about these fields of the header:
   //   uint16_t reserved
-  //   uint32_t total_sfnt_size, the caller already passes it as result_length
+  //   uint32_t total_sfnt_size, we don't believe this, will compute later
   if (PREDICT_FALSE(!file.Skip(6))) {
     return FONT_COMPRESSION_FAILURE();
   }
-  uint32_t compressed_length;
-  if (PREDICT_FALSE(!file.ReadU32(&compressed_length))) {
+  if (PREDICT_FALSE(!file.ReadU32(&hdr->compressed_length))) {
     return FONT_COMPRESSION_FAILURE();
   }
   // We don't care about these fields of the header:
@@ -1082,28 +1058,37 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
       return FONT_COMPRESSION_FAILURE();
     }
   }
-  std::vector<Table> tables(num_tables);
-  if (PREDICT_FALSE(!ReadTableDirectory(&file, &tables, num_tables))) {
+  hdr->tables.resize(hdr->num_tables);
+  if (PREDICT_FALSE(!ReadTableDirectory(
+          &file, &hdr->tables, hdr->num_tables))) {
+    return FONT_COMPRESSION_FAILURE();
+  }
+
+  // Before we sort for output the last table end is the uncompressed size.
+  Table& last_table = hdr->tables.back();
+  hdr->uncompressed_size = last_table.src_offset + last_table.src_length;
+  if (PREDICT_FALSE(hdr->uncompressed_size < last_table.src_offset)) {
     return FONT_COMPRESSION_FAILURE();
   }
 
-  uint32_t header_version = 0;
-  // for each font in a ttc, metadata to use when rebuilding
-  std::vector<TtcFont> ttc_fonts;
-  std::map<const Table*, const Table*> loca_by_glyf;
+  hdr->header_version = 0;
 
-  if (flavor == kTtcFontFlavor) {
-    if (PREDICT_FALSE(!file.ReadU32(&header_version))) {
+  if (hdr->flavor == kTtcFontFlavor) {
+    if (PREDICT_FALSE(!file.ReadU32(&hdr->header_version))) {
+      return FONT_COMPRESSION_FAILURE();
+    }
+    if (PREDICT_FALSE(hdr->header_version != 0x00010000
+                   && hdr->header_version != 0x00020000)) {
       return FONT_COMPRESSION_FAILURE();
     }
     uint32_t num_fonts;
     if (PREDICT_FALSE(!Read255UShort(&file, &num_fonts) || !num_fonts)) {
       return FONT_COMPRESSION_FAILURE();
     }
-    ttc_fonts.resize(num_fonts);
+    hdr->ttc_fonts.resize(num_fonts);
 
     for (uint32_t i = 0; i < num_fonts; i++) {
-      TtcFont& ttc_font = ttc_fonts[i];
+      TtcFont& ttc_font = hdr->ttc_fonts[i];
       uint32_t num_tables;
       if (PREDICT_FALSE(!Read255UShort(&file, &num_tables) || !num_tables)) {
         return FONT_COMPRESSION_FAILURE();
@@ -1116,25 +1101,21 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
 
       const Table* glyf_table = NULL;
       const Table* loca_table = NULL;
-      uint16_t glyf_idx;
-      uint16_t loca_idx;
 
       for (uint32_t j = 0; j < num_tables; j++) {
         unsigned int table_idx;
         if (PREDICT_FALSE(!Read255UShort(&file, &table_idx)) ||
-            table_idx >= tables.size()) {
+            table_idx >= hdr->tables.size()) {
           return FONT_COMPRESSION_FAILURE();
         }
         ttc_font.table_indices[j] = table_idx;
 
-        const Table& table = tables[table_idx];
+        const Table& table = hdr->tables[table_idx];
         if (table.tag == kLocaTableTag) {
           loca_table = &table;
-          loca_idx = table_idx;
         }
         if (table.tag == kGlyfTableTag) {
           glyf_table = &table;
-          glyf_idx = table_idx;
         }
 
       }
@@ -1145,65 +1126,28 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
 #endif
         return FONT_COMPRESSION_FAILURE();
       }
-
-      if (glyf_table != NULL && loca_table != NULL) {
-        loca_by_glyf[glyf_table] = loca_table;
-      }
     }
   }
 
-  const uint64_t first_table_offset =
-    ComputeOffsetToFirstTable(header_version, num_tables, ttc_fonts);
-
-  if (PREDICT_FALSE(first_table_offset > result_length)) {
-    return FONT_COMPRESSION_FAILURE();
-  }
+  const uint64_t first_table_offset = ComputeOffsetToFirstTable(*hdr);
 
-  uint64_t compressed_offset = file.offset();
-  if (PREDICT_FALSE(compressed_offset > std::numeric_limits<uint32_t>::max())) {
+  hdr->compressed_offset = file.offset();
+  if (PREDICT_FALSE(hdr->compressed_offset >
+                    std::numeric_limits<uint32_t>::max())) {
     return FONT_COMPRESSION_FAILURE();
   }
-  uint64_t src_offset = Round4(compressed_offset + compressed_length);
+  uint64_t src_offset = Round4(hdr->compressed_offset + hdr->compressed_length);
   uint64_t dst_offset = first_table_offset;
 
 
-  for (uint16_t i = 0; i < num_tables; ++i) {
-    Table* table = &tables[i];
-    table->dst_offset = dst_offset;
-    dst_offset += table->dst_length;
-    if (PREDICT_FALSE(dst_offset > std::numeric_limits<uint32_t>::max())) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-    dst_offset = Round4(dst_offset);
-  }
-  if (PREDICT_FALSE(src_offset > length || dst_offset != result_length)) {
+  if (PREDICT_FALSE(src_offset > length)) {
 #ifdef FONT_COMPRESSION_BIN
     fprintf(stderr, "offset fail; src_offset %" PRIu64 " length %lu "
-      "dst_offset %" PRIu64 " result_length %lu\n",
-      src_offset, length, dst_offset, result_length);
+      "dst_offset %" PRIu64 "\n",
+      src_offset, length, dst_offset);
 #endif
     return FONT_COMPRESSION_FAILURE();
   }
-
-  // Re-order tables in output (OTSpec) order
-  std::vector<Table> sorted_tables(tables);
-  if (header_version) {
-    // collection; we have to sort the table offset vector in each font
-    for (auto& ttc_font : ttc_fonts) {
-      std::map<uint32_t, uint16_t> sorted_index_by_tag;
-      for (auto table_index : ttc_font.table_indices) {
-        sorted_index_by_tag[tables[table_index].tag] = table_index;
-      }
-      uint16_t index = 0;
-      for (auto& i : sorted_index_by_tag) {
-        ttc_font.table_indices[index++] = i.second;
-      }
-    }
-  } else {
-    // non-collection; we can just sort the tables
-    std::sort(sorted_tables.begin(), sorted_tables.end());
-  }
-
   if (meta_offset) {
     if (PREDICT_FALSE(src_offset != meta_offset)) {
       return FONT_COMPRESSION_FAILURE();
@@ -1228,28 +1172,58 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
     return FONT_COMPRESSION_FAILURE();
   }
 
+  return true;
+}
+
+// Write everything before the actual table data
+bool WriteHeaders(const uint8_t* data, size_t length, RebuildMetadata* metadata,
+                  WOFF2Header* hdr, WOFF2Out* out) {
+  std::vector<uint8_t> output(ComputeOffsetToFirstTable(*hdr), 0);
+
+  // Re-order tables in output (OTSpec) order
+  std::vector<Table> sorted_tables(hdr->tables);
+  if (hdr->header_version) {
+    // collection; we have to sort the table offset vector in each font
+    for (auto& ttc_font : hdr->ttc_fonts) {
+      std::map<uint32_t, uint16_t> sorted_index_by_tag;
+      for (auto table_index : ttc_font.table_indices) {
+        sorted_index_by_tag[hdr->tables[table_index].tag] = table_index;
+      }
+      uint16_t index = 0;
+      for (auto& i : sorted_index_by_tag) {
+        ttc_font.table_indices[index++] = i.second;
+      }
+    }
+  } else {
+    // non-collection; we can just sort the tables
+    std::sort(sorted_tables.begin(), sorted_tables.end());
+  }
+
   // Start building the font
+  uint8_t* result = &output[0];
   size_t offset = 0;
-  size_t offset_table = 0;
-  if (header_version) {
+  if (hdr->header_version) {
     // TTC header
-    offset = StoreU32(result, offset, flavor);  // TAG TTCTag
-    offset = StoreU32(result, offset, header_version);  // FIXED Version
-    offset = StoreU32(result, offset, ttc_fonts.size());  // ULONG numFonts
+    offset = StoreU32(result, offset, hdr->flavor);  // TAG TTCTag
+    offset = StoreU32(result, offset, hdr->header_version);  // FIXED Version
+    offset = StoreU32(result, offset, hdr->ttc_fonts.size());  // ULONG numFonts
     // Space for ULONG OffsetTable[numFonts] (zeroed initially)
-    offset_table = offset;  // keep start of offset table for later
-    for (size_t i = 0; i < ttc_fonts.size(); i++) {
+    size_t offset_table = offset;  // keep start of offset table for later
+    for (size_t i = 0; i < hdr->ttc_fonts.size(); i++) {
       offset = StoreU32(result, offset, 0);  // will fill real values in later
     }
     // space for DSIG fields for header v2
-    if (header_version == 0x00020000) {
+    if (hdr->header_version == 0x00020000) {
       offset = StoreU32(result, offset, 0);  // ULONG ulDsigTag
       offset = StoreU32(result, offset, 0);  // ULONG ulDsigLength
       offset = StoreU32(result, offset, 0);  // ULONG ulDsigOffset
     }
 
     // write Offset Tables and store the location of each in TTC Header
-    for (auto& ttc_font : ttc_fonts) {
+    metadata->font_infos.resize(hdr->ttc_fonts.size());
+    for (size_t i = 0; i < hdr->ttc_fonts.size(); i++) {
+      TtcFont& ttc_font = hdr->ttc_fonts[i];
+
       // write Offset Table location into TTC Header
       offset_table = StoreU32(result, offset_table, offset);
 
@@ -1258,99 +1232,82 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
       offset = StoreOffsetTable(result, offset, ttc_font.flavor,
                                 ttc_font.table_indices.size());
 
-      // write table entries
       for (const auto table_index : ttc_font.table_indices) {
-        offset = StoreTableEntry(result, tables[table_index], offset);
+        uint32_t tag = hdr->tables[table_index].tag;
+        metadata->font_infos[i].table_entry_by_tag[tag] = offset;
+        offset = StoreTableEntry(result, offset, tag);
       }
+
+      ttc_font.header_checksum = ComputeULongSum(&output[ttc_font.dst_offset],
+                                                 offset - ttc_font.dst_offset);
     }
   } else {
-    offset = StoreOffsetTable(result, offset, flavor, num_tables);
-    for (uint16_t i = 0; i < num_tables; ++i) {
-      offset = StoreTableEntry(result, sorted_tables[i], offset);
+    metadata->font_infos.resize(1);
+    offset = StoreOffsetTable(result, offset, hdr->flavor, hdr->num_tables);
+    for (uint16_t i = 0; i < hdr->num_tables; ++i) {
+      metadata->font_infos[0].table_entry_by_tag[sorted_tables[i].tag] = offset;
+      offset = StoreTableEntry(result, offset, sorted_tables[i].tag);
     }
   }
 
-  std::vector<uint8_t> uncompressed_buf;
-  const uint8_t* transform_buf = NULL;
-  uint64_t total_size = 0;
-  for (uint16_t i = 0; i < num_tables; ++i) {
-    total_size += tables[i].transform_length;
-    if (PREDICT_FALSE(total_size > std::numeric_limits<uint32_t>::max())) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-  }
-  uncompressed_buf.resize(total_size);
-  const uint8_t* src_buf = data + compressed_offset;
-  if (PREDICT_FALSE(!Woff2Uncompress(&uncompressed_buf[0], total_size,
-                       src_buf, compressed_length))) {
+  if (PREDICT_FALSE(!out->Write(&output[0], output.size()))) {
     return FONT_COMPRESSION_FAILURE();
   }
+  metadata->header_checksum = ComputeULongSum(&output[0], output.size());
+  return true;
+}
 
-  // round 1, copy across all the unmodified tables
-  transform_buf = &uncompressed_buf[0];
-  const uint8_t* const transform_buf_end = &uncompressed_buf[0]
-                                           + uncompressed_buf.size();
+}  // namespace
 
-  // We wipe out the values as they get written into the final result to dedup
-  std::map<uint32_t, const uint8_t*> src_by_dest;
-  for (uint16_t i = 0; i < num_tables; ++i) {
-    const Table* table = &tables[i];
-    size_t transform_length = table->transform_length;
+size_t ComputeWOFF2FinalSize(const uint8_t* data, size_t length) {
+  Buffer file(data, length);
+  uint32_t total_length;
 
-    src_by_dest[table->dst_offset] = transform_buf;
+  if (!file.Skip(16) ||
+      !file.ReadU32(&total_length)) {
+    return 0;
+  }
+  return total_length;
+}
 
-    if (PREDICT_FALSE(transform_buf + transform_length > transform_buf_end)) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-    transform_buf += transform_length;
+bool ConvertWOFF2ToTTF(uint8_t *result, size_t result_length,
+                       const uint8_t *data, size_t length) {
+  WOFF2MemoryOut out(result, result_length);
+  return ConvertWOFF2ToTTF(data, length, &out);
+}
+
+bool ConvertWOFF2ToTTF(const uint8_t* data, size_t length,
+                       WOFF2Out* out) {
+  RebuildMetadata metadata;
+  WOFF2Header hdr;
+  if (!ReadWOFF2Header(data, length, &hdr)) {
+    return FONT_COMPRESSION_FAILURE();
   }
 
-  for (uint16_t i = 0; i < num_tables; ++i) {
-    const Table* table = &tables[i];
-    const size_t transform_length = table->transform_length;
+  if (!WriteHeaders(data, length, &metadata, &hdr, out)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
 
-    if ((table->flags & kWoff2FlagsTransform) != kWoff2FlagsTransform) {
-      if (PREDICT_FALSE(transform_length != table->dst_length)) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-      if (PREDICT_FALSE(static_cast<uint64_t>(table->dst_offset +
-          transform_length) > result_length)) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-      transform_buf = src_by_dest[table->dst_offset];
-      src_by_dest.erase(table->dst_offset);
-      std::memcpy(result + table->dst_offset, transform_buf, transform_length);
-    }
+  const float compression_ratio = (float) hdr.uncompressed_size / length;
+  if (compression_ratio > kMaxPlausibleCompressionRatio) {
+#ifdef FONT_COMPRESSION_BIN
+    fprintf(stderr, "Implausible compression ratio %.01f\n", compression_ratio);
+#endif
+    return FONT_COMPRESSION_FAILURE();
   }
 
-  // round 2, reconstruct transformed tables
-  if (PREDICT_FALSE(header_version)) {
-    // Rebuild collection font by font.
-    std::vector<Table> font_tables;
-    for (const auto& ttc_font : ttc_fonts) {
-      font_tables.resize(ttc_font.table_indices.size());
-      for (auto i = 0; i < ttc_font.table_indices.size(); i++) {
-        font_tables[i] = tables[ttc_font.table_indices[i]];
-      }
-      if (PREDICT_FALSE(!ReconstructTransformedFont(font_tables, &src_by_dest,
-                                                    result, result_length))) {
-        return FONT_COMPRESSION_FAILURE();
-      }
-    }
-  } else {
-    if (PREDICT_FALSE(!ReconstructTransformedFont(tables, &src_by_dest, result,
-                                                  result_length))) {
-      return FONT_COMPRESSION_FAILURE();
-    }
+  const uint8_t* src_buf = data + hdr.compressed_offset;
+  std::vector<uint8_t> uncompressed_buf(hdr.uncompressed_size);
+  if (PREDICT_FALSE(!Woff2Uncompress(&uncompressed_buf[0],
+                                     hdr.uncompressed_size, src_buf,
+                                     hdr.compressed_length))) {
+    return FONT_COMPRESSION_FAILURE();
   }
 
-  if (header_version) {
-    if (PREDICT_FALSE(
-        !FixCollectionChecksums(header_version, tables, ttc_fonts, result))) {
-      return FONT_COMPRESSION_FAILURE();
-    }
-  } else {
-    if (PREDICT_FALSE(!FixChecksums(sorted_tables, result))) {
+  for (size_t i = 0; i < metadata.font_infos.size(); i++) {
+    if (PREDICT_FALSE(!ReconstructFont(&uncompressed_buf[0],
+                                       hdr.uncompressed_size,
+                                       &metadata, &hdr, i, out))) {
       return FONT_COMPRESSION_FAILURE();
     }
   }
diff --git a/Source/ThirdParty/woff2/src/woff2_dec.h b/Source/ThirdParty/woff2/src/woff2_dec.h
index 74ba7f5cd..b889812fb 100644
--- a/Source/ThirdParty/woff2/src/woff2_dec.h
+++ b/Source/ThirdParty/woff2/src/woff2_dec.h
@@ -19,6 +19,7 @@
 
 #include <stddef.h>
 #include <inttypes.h>
+#include "./woff2_out.h"
 
 namespace woff2 {
 
@@ -28,9 +29,16 @@ size_t ComputeWOFF2FinalSize(const uint8_t *data, size_t length);
 // Decompresses the font into the target buffer. The result_length should
 // be the same as determined by ComputeFinalSize(). Returns true on successful
 // decompression.
+// DEPRECATED; please prefer the version that takes a WOFF2Out*
 bool ConvertWOFF2ToTTF(uint8_t *result, size_t result_length,
                        const uint8_t *data, size_t length);
 
+// Decompresses the font into out. Returns true on success.
+// Works even if WOFF2Header totalSfntSize is wrong.
+// Please prefer this API.
+bool ConvertWOFF2ToTTF(const uint8_t *data, size_t length,
+                       WOFF2Out* out);
+
 } // namespace woff2
 
 #endif  // WOFF2_WOFF2_DEC_H_
diff --git a/Source/ThirdParty/woff2/src/woff2_decompress.cc b/Source/ThirdParty/woff2/src/woff2_decompress.cc
index 7668c4e82..f29c797cb 100644
--- a/Source/ThirdParty/woff2/src/woff2_decompress.cc
+++ b/Source/ThirdParty/woff2/src/woff2_decompress.cc
@@ -17,10 +17,10 @@
 
 #include <string>
 
-
-#include "file.h"
+#include "./file.h"
 #include "./woff2_dec.h"
 
+
 int main(int argc, char **argv) {
   using std::string;
 
@@ -31,24 +31,18 @@ int main(int argc, char **argv) {
 
   string filename(argv[1]);
   string outfilename = filename.substr(0, filename.find_last_of(".")) + ".ttf";
-  fprintf(stdout, "Processing %s => %s\n",
-    filename.c_str(), outfilename.c_str());
+
   string input = woff2::GetFileContent(filename);
+  const uint8_t* raw_input = reinterpret_cast<const uint8_t*>(input.data());
+  string output(std::min(woff2::ComputeWOFF2FinalSize(raw_input, input.size()),
+                         woff2::kDefaultMaxSize), 0);
+  woff2::WOFF2StringOut out(&output);
 
-  size_t decompressed_size = woff2::ComputeWOFF2FinalSize(
-      reinterpret_cast<const uint8_t*>(input.data()), input.size());
-  string output(decompressed_size, 0);
-  const bool ok = woff2::ConvertWOFF2ToTTF(
-      reinterpret_cast<uint8_t*>(&output[0]), decompressed_size,
-      reinterpret_cast<const uint8_t*>(input.data()), input.size());
+  const bool ok = woff2::ConvertWOFF2ToTTF(raw_input, input.size(), &out);
 
-  if (!ok) {
-    fprintf(stderr, "Decompression failed\n");
-    return 1;
+  if (ok) {
+    woff2::SetFileContents(outfilename, output.begin(),
+        output.begin() + out.Size());
   }
-
-  woff2::SetFileContents(outfilename, output);
-
-  return 0;
+  return ok ? 0 : 1;
 }
-
diff --git a/Source/ThirdParty/woff2/src/woff2_enc.cc b/Source/ThirdParty/woff2/src/woff2_enc.cc
index 5255aa517..d100ad51b 100644
--- a/Source/ThirdParty/woff2/src/woff2_enc.cc
+++ b/Source/ThirdParty/woff2/src/woff2_enc.cc
@@ -23,8 +23,8 @@
 #include <string>
 #include <vector>
 
+#include "./compressor.h"
 #include "./buffer.h"
-#include "./encode.h"
 #include "./font.h"
 #include "./normalize.h"
 #include "./round.h"
@@ -47,6 +47,7 @@ using std::vector;
 const size_t kWoff2HeaderSize = 48;
 const size_t kWoff2EntrySize = 20;
 
+
 bool Compress(const uint8_t* data, const size_t len,
               uint8_t* result, uint32_t* result_len,
               brotli::BrotliParams::Mode mode, int quality) {
@@ -120,7 +121,7 @@ size_t ComputeWoff2Length(const FontCollection& font_collection,
   }
 
   // for collections only, collection tables
-  if (font_collection.fonts.size() > 1) {
+  if (font_collection.flavor == kTtcFontFlavor) {
     size += 4;  // UInt32 Version of TTC Header
     size += Size255UShort(font_collection.fonts.size());  // 255UInt16 numFonts
 
@@ -147,14 +148,6 @@ size_t ComputeWoff2Length(const FontCollection& font_collection,
   return size;
 }
 
-size_t ComputeTTFLength(const std::vector<Table>& tables) {
-  size_t size = 12 + 16 * tables.size();  // sfnt header
-  for (const auto& table : tables) {
-    size += Round4(table.src_length);
-  }
-  return size;
-}
-
 size_t ComputeUncompressedLength(const Font& font) {
   // sfnt header + offset table
   size_t size = 12 + 16 * font.num_tables;
@@ -168,7 +161,7 @@ size_t ComputeUncompressedLength(const Font& font) {
 }
 
 size_t ComputeUncompressedLength(const FontCollection& font_collection) {
-  if (font_collection.fonts.size() == 1) {
+  if (font_collection.flavor != kTtcFontFlavor) {
     return ComputeUncompressedLength(font_collection.fonts[0]);
   }
   size_t size = CollectionHeaderSize(font_collection.header_version,
@@ -279,20 +272,22 @@ bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
   std::vector<uint8_t> compression_buf(compression_buffer_size);
   uint32_t total_compressed_length = compression_buffer_size;
 
-  // Collect all transformed data into one place.
+  // Collect all transformed data into one place in output order.
   std::vector<uint8_t> transform_buf(total_transform_length);
   size_t transform_offset = 0;
   for (const auto& font : font_collection.fonts) {
-    for (const auto& i : font.tables) {
-      const Font::Table* table = font.FindTable(i.second.tag ^ 0x80808080);
-      if (i.second.IsReused()) continue;
-      if (i.second.tag & 0x80808080) continue;
+    for (const auto tag : font.OutputOrderedTags()) {
+      const Font::Table& original = font.tables.at(tag);
+      if (original.IsReused()) continue;
+      if (tag & 0x80808080) continue;
+      const Font::Table* table_to_store = font.FindTable(tag ^ 0x80808080);
+      if (table_to_store == NULL) table_to_store = &original;
 
-      if (table == NULL) table = &i.second;
-      StoreBytes(table->data, table->length,
+      StoreBytes(table_to_store->data, table_to_store->length,
                  &transform_offset, &transform_buf[0]);
     }
   }
+
   // Compress all transformed data in one stream.
   if (!Woff2Compress(transform_buf.data(), total_transform_length,
                      &compression_buf[0],
@@ -377,13 +372,12 @@ bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
   }
   *result_length = woff2_length;
 
-  const Font& first_font = font_collection.fonts[0];
   size_t offset = 0;
 
   // start of woff2 header (http://www.w3.org/TR/WOFF2/#woff20Header)
   StoreU32(kWoff2Signature, &offset, result);
-  if (font_collection.fonts.size() == 1) {
-    StoreU32(first_font.flavor, &offset, result);
+  if (font_collection.flavor != kTtcFontFlavor) {
+    StoreU32(font_collection.fonts[0].flavor, &offset, result);
   } else {
     StoreU32(kTtcFontFlavor, &offset, result);
   }
@@ -394,9 +388,9 @@ bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
   StoreU32(ComputeUncompressedLength(font_collection), &offset, result);
   StoreU32(total_compressed_length, &offset, result);  // totalCompressedSize
 
-  // TODO(user): is always taking this from the first tables head OK?
-  // font revision
-  StoreBytes(first_font.FindTable(kHeadTableTag)->data + 4, 4, &offset, result);
+  // Let's just all be v1.0
+  Store16(1, &offset, result);  // majorVersion
+  Store16(0, &offset, result);  // minorVersion
   if (compressed_metadata_buf_length > 0) {
     StoreU32(woff2_length - compressed_metadata_buf_length,
              &offset, result);  // metaOffset
@@ -418,7 +412,7 @@ bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
   }
 
   // for collections only, collection table directory
-  if (font_collection.fonts.size() > 1) {
+  if (font_collection.flavor == kTtcFontFlavor) {
     StoreU32(font_collection.header_version, &offset, result);
     Store255UShort(font_collection.fonts.size(), &offset, result);
     for (const Font& font : font_collection.fonts) {
diff --git a/Source/ThirdParty/woff2/src/woff2_out.cc b/Source/ThirdParty/woff2/src/woff2_out.cc
new file mode 100644
index 000000000..888230644
--- /dev/null
+++ b/Source/ThirdParty/woff2/src/woff2_out.cc
@@ -0,0 +1,73 @@
+// Copyright 2014 Google Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Output buffer for WOFF2 decompression.
+
+#include "./woff2_out.h"
+
+namespace woff2 {
+
+WOFF2StringOut::WOFF2StringOut(string* buf)
+  : buf_(buf),
+    max_size_(kDefaultMaxSize),
+    offset_(0) {}
+
+bool WOFF2StringOut::Write(const void *buf, size_t n) {
+  return Write(buf, offset_, n);
+}
+
+bool WOFF2StringOut::Write(const void *buf, size_t offset, size_t n) {
+  if (offset > max_size_ || n > max_size_ - offset) {
+    return false;
+  }
+  if (offset == buf_->size()) {
+    buf_->append(static_cast<const char*>(buf), n);
+  } else {
+    if (offset + n > buf_->size()) {
+      buf_->append(offset + n - buf_->size(), 0);
+    }
+    buf_->replace(offset, n, static_cast<const char*>(buf), n);
+  }
+  offset_ = std::max(offset_, offset + n);
+
+  return true;
+}
+
+void WOFF2StringOut::SetMaxSize(size_t max_size) {
+  max_size_ = max_size;
+  if (offset_ > max_size_) {
+    offset_ = max_size_;
+  }
+}
+
+WOFF2MemoryOut::WOFF2MemoryOut(uint8_t* buf, size_t buf_size)
+  : buf_(buf),
+    buf_size_(buf_size),
+    offset_(0) {}
+
+bool WOFF2MemoryOut::Write(const void *buf, size_t n) {
+  return Write(buf, offset_, n);
+}
+
+bool WOFF2MemoryOut::Write(const void *buf, size_t offset, size_t n) {
+  if (offset > buf_size_ || n > buf_size_ - offset) {
+    return false;
+  }
+  std::memcpy(buf_ + offset, buf, n);
+  offset_ = std::max(offset_, offset + n);
+
+  return true;
+}
+
+} // namespace woff2
diff --git a/Source/ThirdParty/woff2/src/woff2_out.h b/Source/ThirdParty/woff2/src/woff2_out.h
new file mode 100644
index 000000000..c956afa0e
--- /dev/null
+++ b/Source/ThirdParty/woff2/src/woff2_out.h
@@ -0,0 +1,114 @@
+// Copyright 2016 Google Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Output buffer for WOFF2 decompression.
+
+// Copyright 2016 Google Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Output buffer for WOFF2 decompression.
+
+#ifndef WOFF2_WOFF2_OUT_H_
+#define WOFF2_WOFF2_OUT_H_
+
+#include <algorithm>
+#include <cstring>
+#include <memory>
+#include <string>
+#include "./port.h"
+
+namespace woff2 {
+
+// Suggested max size for output.
+const size_t kDefaultMaxSize = 30 * 1024 * 1024;
+
+using std::string;
+
+
+/**
+ * Output interface for the woff2 decoding.
+ *
+ * Writes to arbitrary offsets are supported to facilitate updating offset
+ * table and checksums after tables are ready. Reading the current size is
+ * supported so a 'loca' table can be built up while writing glyphs.
+ *
+ * By default limits size to kDefaultMaxSize.
+ */
+class WOFF2Out {
+ public:
+  virtual ~WOFF2Out(void) {}
+
+  // Append n bytes of data from buf.
+  // Return true if all written, false otherwise.
+  virtual bool Write(const void *buf, size_t n) = 0;
+
+  // Write n bytes of data from buf at offset.
+  // Return true if all written, false otherwise.
+  virtual bool Write(const void *buf, size_t offset, size_t n) = 0;
+
+  virtual size_t Size() = 0;
+};
+
+/**
+ * Expanding memory block for woff2 out. By default limited to kDefaultMaxSize.
+ */
+class WOFF2StringOut : public WOFF2Out {
+ public:
+  // Create a writer that writes its data to buf.
+  // buf->size() will grow to at most max_size
+  // buf may be sized (e.g. using EstimateWOFF2FinalSize) or empty.
+  explicit WOFF2StringOut(string* buf);
+
+  bool Write(const void *buf, size_t n) override;
+  bool Write(const void *buf, size_t offset, size_t n) override;
+  size_t Size() override { return offset_; }
+  size_t MaxSize() { return max_size_; }
+  void SetMaxSize(size_t max_size);
+ private:
+  string* buf_;
+  size_t max_size_;
+  size_t offset_;
+};
+
+/**
+ * Fixed memory block for woff2 out.
+ */
+class WOFF2MemoryOut : public WOFF2Out {
+ public:
+  // Create a writer that writes its data to buf.
+  WOFF2MemoryOut(uint8_t* buf, size_t buf_size);
+
+  bool Write(const void *buf, size_t n) override;
+  bool Write(const void *buf, size_t offset, size_t n) override;
+  size_t Size() override { return offset_; }
+ private:
+  uint8_t* buf_;
+  size_t buf_size_;
+  size_t offset_;
+};
+
+} // namespace woff2
+
+#endif  // WOFF2_WOFF2_OUT_H_
diff --git a/Source/WTF/wtf/CMakeLists.txt b/Source/WTF/wtf/CMakeLists.txt
index 6fd5bd830..09b848c7a 100644
--- a/Source/WTF/wtf/CMakeLists.txt
+++ b/Source/WTF/wtf/CMakeLists.txt
@@ -291,3 +291,5 @@ if (MSVC)
     set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} /SUBSYSTEM:WINDOWS")
     set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /SUBSYSTEM:WINDOWS")
 endif ()
+
+QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(WTF)
diff --git a/Source/WTF/wtf/PlatformQt.cmake b/Source/WTF/wtf/PlatformQt.cmake
index 03e773736..42f4e86ff 100644
--- a/Source/WTF/wtf/PlatformQt.cmake
+++ b/Source/WTF/wtf/PlatformQt.cmake
@@ -15,6 +15,12 @@ list(APPEND WTF_LIBRARIES
     ${CMAKE_THREAD_LIBS_INIT}
 )
 
+if (QT_STATIC_BUILD)
+    list(APPEND WTF_LIBRARIES
+        ${STATIC_LIB_DEPENDENCIES}
+    )
+endif ()
+
 if (USE_GLIB)
     list(APPEND WTF_SOURCES
         glib/GRefPtr.cpp
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index ff9e12889..58fc73285 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -3807,6 +3807,11 @@ if (SHARED_CORE)
     install(TARGETS WebCore DESTINATION "${LIB_INSTALL_DIR}")
 endif ()
 
+QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(WebCore)
+if (ENABLE_TEST_SUPPORT)
+    QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(WebCoreTestSupport)
+endif ()
+
 # [ARM] Build SVGPathElement.cpp with -O2 due to a GCC bug
 # https://bugs.webkit.org/show_bug.cgi?id=145377
 if ((CMAKE_CXX_COMPILER_ID STREQUAL "GNU") AND WTF_CPU_ARM AND (CMAKE_CXX_COMPILER_VERSION VERSION_GREATER "4.9") AND (CMAKE_CXX_COMPILER_VERSION VERSION_LESS "4.9.3"))
diff --git a/Source/WebCore/PlatformQt.cmake b/Source/WebCore/PlatformQt.cmake
index 2e013d601..84e9127eb 100644
--- a/Source/WebCore/PlatformQt.cmake
+++ b/Source/WebCore/PlatformQt.cmake
@@ -234,6 +234,12 @@ list(APPEND WebCore_LIBRARIES
     ${ZLIB_LIBRARIES}
 )
 
+if (QT_STATIC_BUILD)
+    list(APPEND WebCore_LIBRARIES
+        ${STATIC_LIB_DEPENDENCIES}
+    )
+endif ()
+
 list(APPEND WebCore_USER_AGENT_STYLE_SHEETS
 #    ${WEBCORE_DIR}/css/mediaControlsGtk.css
 #    ${WEBCORE_DIR}/css/mediaControlsQt.css
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index ae0c7e907..6912422d0 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -1589,7 +1589,12 @@ void QtConnectionObject::execute(void** argv)
         args[i] = convertQVariantToValue(m_context, m_rootObject, QVariant(argType, argv[i+1]), ignoredException);
     }
 
-    JSObjectCallAsFunction(m_context, m_receiverFunction, m_receiver, argc, args.data(), 0);
+    JSValueRef call_exception = 0;
+    ExecState* exec = toJS(m_context);
+    JSObjectCallAsFunction(m_context, m_receiverFunction, m_receiver, argc, args.data(), &call_exception);
+    if (call_exception) {
+        WebCore::reportException(exec, toJS(exec, call_exception));
+    }
 }
 
 bool QtConnectionObject::match(JSContextRef context, QObject* sender, int signalIndex, JSObjectRef receiver, JSObjectRef receiverFunction)
diff --git a/Source/WebCore/loader/cache/CachedFont.cpp b/Source/WebCore/loader/cache/CachedFont.cpp
index 08b337470..6836653a1 100644
--- a/Source/WebCore/loader/cache/CachedFont.cpp
+++ b/Source/WebCore/loader/cache/CachedFont.cpp
@@ -103,9 +103,9 @@ bool CachedFont::ensureCustomFontData(SharedBuffer* data)
         RefPtr<SharedBuffer> buffer(data);
 
 #if !PLATFORM(COCOA)
-        if (isWOFF(buffer.get())) {
+        if (isWOFF(*buffer)) {
             Vector<char> convertedFont;
-            if (!convertWOFFToSfnt(buffer.get(), convertedFont))
+            if (!convertWOFFToSfnt(*buffer, convertedFont))
                 buffer = nullptr;
             else
                 buffer = SharedBuffer::adoptVector(convertedFont);
diff --git a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
index 61a58b904..c2323cf04 100644
--- a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
+++ b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
@@ -37,25 +37,25 @@
 
 namespace WebCore {
 
-static bool readUInt32(SharedBuffer* buffer, size_t& offset, uint32_t& value)
+static bool readUInt32(SharedBuffer& buffer, size_t& offset, uint32_t& value)
 {
-    ASSERT_ARG(offset, offset <= buffer->size());
-    if (buffer->size() - offset < sizeof(value))
+    ASSERT_ARG(offset, offset <= buffer.size());
+    if (buffer.size() - offset < sizeof(value))
         return false;
 
-    value = ntohl(*reinterpret_cast_ptr<const uint32_t*>(buffer->data() + offset));
+    value = ntohl(*reinterpret_cast_ptr<const uint32_t*>(buffer.data() + offset));
     offset += sizeof(value);
 
     return true;
 }
 
-static bool readUInt16(SharedBuffer* buffer, size_t& offset, uint16_t& value)
+static bool readUInt16(SharedBuffer& buffer, size_t& offset, uint16_t& value)
 {
-    ASSERT_ARG(offset, offset <= buffer->size());
-    if (buffer->size() - offset < sizeof(value))
+    ASSERT_ARG(offset, offset <= buffer.size());
+    if (buffer.size() - offset < sizeof(value))
         return false;
 
-    value = ntohs(*reinterpret_cast_ptr<const uint16_t*>(buffer->data() + offset));
+    value = ntohs(*reinterpret_cast_ptr<const uint16_t*>(buffer.data() + offset));
     offset += sizeof(value);
 
     return true;
@@ -75,7 +75,7 @@ static bool writeUInt16(Vector<char>& vector, uint16_t value)
 
 static const uint32_t woffSignature = 0x774f4646; /* 'wOFF' */
 
-bool isWOFF(SharedBuffer* buffer)
+bool isWOFF(SharedBuffer& buffer)
 {
     size_t offset = 0;
     uint32_t signature;
@@ -90,7 +90,43 @@ bool isWOFF(SharedBuffer* buffer)
 #endif
 }
 
-bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
+#if USE(WOFF2)
+class WOFF2VectorOut : public woff2::WOFF2Out {
+public:
+    WOFF2VectorOut(Vector<char>& vector)
+        : m_vector(vector)
+    { }
+
+    bool Write(const void* data, size_t n) override
+    {
+        if (!m_vector.tryReserveCapacity(m_vector.size() + n))
+            return false;
+        m_vector.append(static_cast<const char*>(data), n);
+        return true;
+    }
+
+    bool Write(const void* data, size_t offset, size_t n) override
+    {
+        if (!m_vector.tryReserveCapacity(offset + n))
+            return false;
+        if (offset + n > m_vector.size())
+            m_vector.resize(offset + n);
+        m_vector.remove(offset, n);
+        m_vector.insert(offset, static_cast<const char*>(data), n);
+        return true;
+    }
+
+    size_t Size() override
+    {
+        return m_vector.size();
+    }
+
+private:
+    Vector<char>& m_vector;
+};
+#endif
+
+bool convertWOFFToSfnt(SharedBuffer& woff, Vector<char>& sfnt)
 {
     ASSERT_ARG(sfnt, sfnt.isEmpty());
 
@@ -105,15 +141,15 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
 
 #if USE(WOFF2)
     if (signature == woff2::kWoff2Signature) {
-        const uint8_t* woffData = reinterpret_cast_ptr<const uint8_t*>(woff->data());
-        const size_t woffSize = woff->size();
+        const uint8_t* woffData = reinterpret_cast_ptr<const uint8_t*>(woff.data());
+        const size_t woffSize = woff.size();
         const size_t sfntSize = woff2::ComputeWOFF2FinalSize(woffData, woffSize);
 
         if (!sfnt.tryReserveCapacity(sfntSize))
             return false;
-        sfnt.resize(sfntSize);
 
-        return woff2::ConvertWOFF2ToTTF(reinterpret_cast<uint8_t*>(sfnt.data()), sfnt.size(), woffData, woffSize);
+        WOFF2VectorOut out(sfnt);
+        return woff2::ConvertWOFF2ToTTF(woffData, woffSize, &out);
     }
 #endif
 
@@ -127,7 +163,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
         return false;
 
     uint32_t length;
-    if (!readUInt32(woff, offset, length) || length != woff->size())
+    if (!readUInt32(woff, offset, length) || length != woff.size())
         return false;
 
     uint16_t numTables;
@@ -145,7 +181,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
     if (!readUInt32(woff, offset, totalSfntSize))
         return false;
 
-    if (woff->size() - offset < sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t))
+    if (woff.size() - offset < sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t))
         return false;
 
     offset += sizeof(uint16_t); // majorVersion
@@ -157,7 +193,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
     offset += sizeof(uint32_t); // privLength
 
     // Check if the WOFF can supply as many tables as it claims it has.
-    if (woff->size() - offset < numTables * 5 * sizeof(uint32_t))
+    if (woff.size() - offset < numTables * 5 * sizeof(uint32_t))
         return false;
 
     // Write the sfnt offset subtable.
@@ -201,7 +237,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
         if (!readUInt32(woff, offset, tableCompLength))
             return false;
 
-        if (tableOffset > woff->size() || tableCompLength > woff->size() - tableOffset)
+        if (tableOffset > woff.size() || tableCompLength > woff.size() - tableOffset)
             return false;
 
         uint32_t tableOrigLength;
@@ -225,7 +261,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
 
         if (tableCompLength == tableOrigLength) {
             // The table is not compressed.
-            if (!sfnt.tryAppend(woff->data() + tableOffset, tableCompLength))
+            if (!sfnt.tryAppend(woff.data() + tableOffset, tableCompLength))
                 return false;
         } else {
             uLongf destLen = tableOrigLength;
@@ -233,7 +269,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
                 return false;
             Bytef* dest = reinterpret_cast<Bytef*>(sfnt.end());
             sfnt.grow(sfnt.size() + tableOrigLength);
-            if (uncompress(dest, &destLen, reinterpret_cast<const Bytef*>(woff->data() + tableOffset), tableCompLength) != Z_OK)
+            if (uncompress(dest, &destLen, reinterpret_cast<const Bytef*>(woff.data() + tableOffset), tableCompLength) != Z_OK)
                 return false;
             if (destLen != tableOrigLength)
                 return false;
diff --git a/Source/WebCore/platform/graphics/WOFFFileFormat.h b/Source/WebCore/platform/graphics/WOFFFileFormat.h
index c6892fde1..44c38245d 100644
--- a/Source/WebCore/platform/graphics/WOFFFileFormat.h
+++ b/Source/WebCore/platform/graphics/WOFFFileFormat.h
@@ -33,11 +33,11 @@ namespace WebCore {
 class SharedBuffer;
 
 // Returns whether the buffer is a WOFF file.
-bool isWOFF(SharedBuffer* buffer);
+bool isWOFF(SharedBuffer&);
 
 // Returns false if the WOFF file woff is invalid or could not be converted to sfnt (for example,
 // if conversion ran out of memory). Otherwise returns true and writes the sfnt payload into sfnt.
-bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt);
+bool convertWOFFToSfnt(SharedBuffer& woff, Vector<char>& sfnt);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
index 78e159aa0..bc65c0511 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
@@ -39,18 +39,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(const FontDescription&
 
 std::unique_ptr<FontCustomPlatformData> createFontCustomPlatformData(SharedBuffer& buffer)
 {
-    SharedBuffer* fontBuffer = &buffer;
-    RefPtr<SharedBuffer> sfntBuffer;
-    if (isWOFF(&buffer)) {
-        Vector<char> sfnt;
-        if (!convertWOFFToSfnt(&buffer, sfnt))
-            return 0;
-
-        sfntBuffer = SharedBuffer::adoptVector(sfnt);
-        fontBuffer = sfntBuffer.get();
-    }
-
-    const QByteArray fontData(fontBuffer->data(), fontBuffer->size());
+    const QByteArray fontData(buffer.data(), buffer.size());
 
     // Pixel size doesn't matter at this point, it is set in FontCustomPlatformData::fontPlatformData.
     QRawFont rawFont(fontData, /*pixelSize = */0, QFont::PreferDefaultHinting);
diff --git a/Source/WebCore/platform/qt/QStyleFacade.h b/Source/WebCore/platform/qt/QStyleFacade.h
index 1c82300d5..f2fbdb82b 100644
--- a/Source/WebCore/platform/qt/QStyleFacade.h
+++ b/Source/WebCore/platform/qt/QStyleFacade.h
@@ -38,6 +38,8 @@ struct QStyleFacadeOption;
 class QStyleFacade {
 public:
     enum ButtonSubElement {
+        CheckBoxIndicator,
+        RadioButtonIndicator,
         PushButtonLayoutItem,
         PushButtonContents
     };
diff --git a/Source/WebCore/platform/qt/RenderThemeQStyle.cpp b/Source/WebCore/platform/qt/RenderThemeQStyle.cpp
index 36c2d18eb..b9c6953fa 100644
--- a/Source/WebCore/platform/qt/RenderThemeQStyle.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQStyle.cpp
@@ -60,6 +60,20 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static QStyleFacade::ButtonSubElement indicatorSubElement(QStyleFacade::ButtonType part)
+{
+    switch (part) {
+    case QStyleFacade::CheckBox:
+        return QStyleFacade::CheckBoxIndicator;
+    case QStyleFacade::RadioButton:
+        return QStyleFacade::RadioButtonIndicator;
+    default:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return QStyleFacade::CheckBoxIndicator;
+}
+
 QSharedPointer<StylePainter> RenderThemeQStyle::getStylePainter(const PaintInfo& paintInfo)
 {
     return QSharedPointer<StylePainter>(new StylePainterQStyle(this, paintInfo));
@@ -140,6 +154,11 @@ void RenderThemeQStyle::setPaletteFromPageClientIfExists(QPalette& palette) cons
         palette = pageClient->palette();
 }
 
+QRect RenderThemeQStyle::indicatorRect(QStyleFacade::ButtonType part, const QRect& originalRect) const
+{
+    return m_qStyle->buttonSubElementRect(indicatorSubElement(part), QStyleFacade::State_Small, originalRect);
+}
+
 QRect RenderThemeQStyle::inflateButtonRect(const QRect& originalRect) const
 {
     QRect layoutRect = m_qStyle->buttonSubElementRect(QStyleFacade::PushButtonLayoutItem, QStyleFacade::State_Small, originalRect);
@@ -168,6 +187,29 @@ QRectF RenderThemeQStyle::inflateButtonRect(const QRectF& originalRect) const
     return originalRect;
 }
 
+template<typename T>
+static void inflateCheckBoxRectImpl(T& originalRect, const QRect& rect)
+{
+    if (!rect.isNull()) {
+        int dx = static_cast<int>((rect.width() - originalRect.width()) / 2);
+        originalRect.setX(originalRect.x() - dx);
+        originalRect.setWidth(rect.width());
+        int dy = static_cast<int>((rect.height() - originalRect.height()) / 2);
+        originalRect.setY(originalRect.y() - dy);
+        originalRect.setHeight(rect.height());
+    }
+}
+
+void RenderThemeQStyle::computeControlRect(QStyleFacade::ButtonType part, QRect& originalRect) const
+{
+    inflateCheckBoxRectImpl(originalRect, indicatorRect(part, originalRect));
+}
+
+void RenderThemeQStyle::computeControlRect(QStyleFacade::ButtonType part, FloatRect& originalRect) const
+{
+    inflateCheckBoxRectImpl(originalRect, indicatorRect(part, enclosingIntRect(originalRect)));
+}
+
 static int extendFixedPadding(Length oldPadding, int padding)
 {
     if (oldPadding.isFixed())
@@ -322,10 +364,13 @@ bool RenderThemeQStyle::paintButton(const RenderObject& o, const PaintInfo& i, c
     if (p.appearance == PushButtonPart || p.appearance == ButtonPart) {
         p.styleOption.rect = inflateButtonRect(p.styleOption.rect);
         p.paintButton(QStyleFacade::PushButton);
-    } else if (p.appearance == RadioPart)
+    } else if (p.appearance == RadioPart) {
+        computeControlRect(QStyleFacade::RadioButton, p.styleOption.rect);
         p.paintButton(QStyleFacade::RadioButton);
-    else if (p.appearance == CheckboxPart)
+    } else if (p.appearance == CheckboxPart) {
+        computeControlRect(QStyleFacade::CheckBox, p.styleOption.rect);
         p.paintButton(QStyleFacade::CheckBox);
+    }
 
     return false;
 }
diff --git a/Source/WebCore/platform/qt/RenderThemeQStyle.h b/Source/WebCore/platform/qt/RenderThemeQStyle.h
index 17b8bfa87..d49f5e19b 100644
--- a/Source/WebCore/platform/qt/RenderThemeQStyle.h
+++ b/Source/WebCore/platform/qt/RenderThemeQStyle.h
@@ -22,7 +22,6 @@
 #ifndef RenderThemeQStyle_h
 #define RenderThemeQStyle_h
 
-#include "QStyleFacade.h"
 #include "RenderThemeQt.h"
 
 namespace WebCore {
@@ -95,6 +94,8 @@ protected:
 
     QRect inflateButtonRect(const QRect& originalRect) const override;
     QRectF inflateButtonRect(const QRectF& originalRect) const override;
+    void computeControlRect(QStyleFacade::ButtonType, QRect& originalRect) const override;
+    void computeControlRect(QStyleFacade::ButtonType, FloatRect& originalRect) const override;
 
     void setPopupPadding(RenderStyle&) const override;
 
@@ -107,6 +108,8 @@ private:
 
     void setPaletteFromPageClientIfExists(QPalette&) const;
 
+    QRect indicatorRect(QStyleFacade::ButtonType part, const QRect& originalRect) const;
+
 #ifdef Q_OS_MAC
     int m_buttonFontPixelSize;
 #endif
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 32530fad2..a5a48f92b 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -217,12 +217,22 @@ QRectF RenderThemeQt::inflateButtonRect(const QRectF& originalRect) const
     return originalRect;
 }
 
+void RenderThemeQt::computeControlRect(QStyleFacade::ButtonType, QRect&) const
+{
+}
+
+void RenderThemeQt::computeControlRect(QStyleFacade::ButtonType, FloatRect&) const
+{
+}
+
 void RenderThemeQt::adjustRepaintRect(const RenderObject& o, FloatRect& rect)
 {
     switch (o.style().appearance()) {
     case CheckboxPart:
+        computeControlRect(QStyleFacade::CheckBox, rect);
         break;
     case RadioPart:
+        computeControlRect(QStyleFacade::RadioButton, rect);
         break;
     case PushButtonPart:
     case ButtonPart: {
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index 355b372c4..ee572bace 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -22,6 +22,7 @@
 #ifndef RenderThemeQt_h
 #define RenderThemeQt_h
 
+#include "QStyleFacade.h"
 #include "RenderTheme.h"
 
 #include <QBrush>
@@ -166,6 +167,8 @@ protected:
 
     virtual QRect inflateButtonRect(const QRect& originalRect) const;
     virtual QRectF inflateButtonRect(const QRectF& originalRect) const;
+    virtual void computeControlRect(QStyleFacade::ButtonType, QRect& originalRect) const;
+    virtual void computeControlRect(QStyleFacade::ButtonType, FloatRect& originalRect) const;
 
     virtual void setPopupPadding(RenderStyle&) const = 0;
 
diff --git a/Source/WebKit/PlatformQt.cmake b/Source/WebKit/PlatformQt.cmake
index 4e1ff3329..7054e6784 100644
--- a/Source/WebKit/PlatformQt.cmake
+++ b/Source/WebKit/PlatformQt.cmake
@@ -381,9 +381,52 @@ install(
         ${KDE_INSTALL_INCLUDEDIR}/QtWebKit/${PROJECT_VERSION}/QtWebKit/private
 )
 
+set(WEBKIT_PKGCONGIG_DEPS "Qt5Core Qt5Gui Qt5Network")
+set(WEBKIT_PRI_DEPS "core gui network")
+set(WEBKIT_PRI_RUNTIME_DEPS "sensors positioning qml quick webchannel core_private gui_private")
+set(WEBKIT_PRI_EXTRA_LIBS "")
+set(WEBKITWIDGETS_PKGCONGIG_DEPS "Qt5Core Qt5Gui Qt5Network Qt5Widgets Qt5WebKit")
+set(WEBKITWIDGETS_PRI_DEPS "core gui network widgets webkit")
+set(WEBKITWIDGETS_PRI_RUNTIME_DEPS "sensors positioning widgets_private opengl sql core_private gui_private")
+if (QT_STATIC_BUILD)
+    if (MSVC)
+        set(LIB_PREFIX "lib")
+    endif ()
+    set(WEBKIT_PKGCONGIG_DEPS "${WEBKIT_PKGCONGIG_DEPS} Qt5Sql")
+    set(WEBKIT_PRI_DEPS "${WEBKIT_PRI_DEPS} sql")
+    set(WEBKITWIDGETS_PKGCONGIG_DEPS "${WEBKITWIDGETS_PKGCONGIG_DEPS} Qt5PrintSupport")
+    set(WEBKITWIDGETS_PRI_DEPS "${WEBKITWIDGETS_PRI_DEPS} printsupport")
+    set(EXTRA_LIBS_NAMES WebCore JavaScriptCore WTF xml2)
+    if (NOT USE_SYSTEM_MALLOC)
+        list(APPEND EXTRA_LIBS_NAMES bmalloc)
+    endif ()
+    if (ENABLE_XSLT)
+        list(APPEND EXTRA_LIBS_NAMES xslt)
+    endif ()
+    if (USE_LIBHYPHEN)
+        list(APPEND EXTRA_LIBS_NAMES hyphen)
+    endif ()
+    if (USE_WEBP)
+        list(APPEND EXTRA_LIBS_NAMES webp)
+    endif ()
+    if (USE_WOFF2)
+        list(APPEND EXTRA_LIBS_NAMES woff2 brotli)
+    endif ()
+    if (APPLE)
+        list(APPEND EXTRA_LIBS_NAMES icucore)
+    endif ()
+    foreach (LIB_NAME ${EXTRA_LIBS_NAMES})
+        set(WEBKIT_PKGCONGIG_DEPS "${WEBKIT_PKGCONGIG_DEPS} ${LIB_PREFIX}${LIB_NAME}")
+        set(WEBKIT_PRI_EXTRA_LIBS "${WEBKIT_PRI_EXTRA_LIBS} -l${LIB_PREFIX}${LIB_NAME}")
+    endforeach ()
+else ()
+    set(WEBKIT_PRI_RUNTIME_DEPS "${WEBKIT_PRI_RUNTIME_DEPS} sql")
+    set(WEBKITWIDGETS_PRI_RUNTIME_DEPS "${WEBKITWIDGETS_PRI_RUNTIME_DEPS} printsupport")
+endif ()
+
 ecm_generate_pkgconfig_file(
     BASE_NAME Qt5WebKit
-    DEPS "Qt5Core Qt5Gui Qt5Network"
+    DEPS "${WEBKIT_PKGCONGIG_DEPS}"
     FILENAME_VAR WebKit_PKGCONFIG_FILENAME
     INSTALL
 )
@@ -405,10 +448,11 @@ endif ()
 ecm_generate_pri_file(
     BASE_NAME webkit
     LIB_NAME QtWebKit
-    DEPS "core gui network"
-    RUNTIME_DEPS "sensors positioning qml quick webchannel sql core_private gui_private"
+    DEPS "${WEBKIT_PRI_DEPS}"
+    RUNTIME_DEPS "${WEBKIT_PRI_RUNTIME_DEPS}"
     DEFINES QT_WEBKIT_LIB
     QT_MODULES webkit
+    EXTRA_LIBS "${WEBKIT_PRI_EXTRA_LIBS}"
     FILENAME_VAR WebKit_PRI_FILENAME
     ${WebKit_PRI_ARGUMENTS}
 )
@@ -547,7 +591,7 @@ install(
 
 ecm_generate_pkgconfig_file(
     BASE_NAME Qt5WebKitWidgets
-    DEPS "Qt5Core Qt5Gui Qt5Network Qt5Widgets Qt5WebKit"
+    DEPS "${WEBKITWIDGETS_PKGCONFIG_DEPS}"
     FILENAME_VAR WebKitWidgets_PKGCONFIG_FILENAME
     INSTALL
 )
@@ -569,8 +613,8 @@ endif ()
 ecm_generate_pri_file(
     BASE_NAME webkitwidgets
     LIB_NAME QtWebKitWidgets
-    DEPS "core gui network widgets webkit"
-    RUNTIME_DEPS "sensors positioning widgets_private printsupport opengl sql core_private gui_private"
+    DEPS "${WEBKITWIDGETS_PRI_DEPS}"
+    RUNTIME_DEPS "${WEBKITWIDGETS_PRI_RUNTIME_DEPS}"
     DEFINES QT_WEBKITWIDGETS_LIB
     QT_MODULES webkitwidgets
     FILENAME_VAR WebKitWidgets_PRI_FILENAME
diff --git a/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp b/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp
index 5efb9a9af..b35545674 100644
--- a/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp
+++ b/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp
@@ -163,6 +163,8 @@ QRect QStyleFacadeImp::buttonSubElementRect(QStyleFacade::ButtonSubElement butto
 
     QStyle::SubElement subElement = QStyle::SE_CustomBase;
     switch (buttonElement) {
+    case CheckBoxIndicator: subElement = QStyle::SE_CheckBoxIndicator; break;
+    case RadioButtonIndicator: subElement = QStyle::SE_RadioButtonIndicator; break;
     case PushButtonLayoutItem: subElement = QStyle::SE_PushButtonLayoutItem; break;
     case PushButtonContents: subElement = QStyle::SE_PushButtonContents; break;
     default: Q_UNREACHABLE();
diff --git a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
index 2eacc70b0..a46d39050 100644
--- a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
+++ b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
@@ -642,6 +642,7 @@ private Q_SLOTS:
     void introspectQtMethods_data();
     void introspectQtMethods();
     void scriptablePlugin();
+    void exceptionInSlot();
 
 private:
     QString evalJS(const QString& s)
@@ -2239,5 +2240,32 @@ void tst_QObjectBridge::scriptablePlugin()
 //#endif
 }
 
+class WebPageWithConsoleCapture : public QWebPage
+{
+public:
+    void javaScriptConsoleMessage(const QString &message, int, const QString &)
+    {
+        consoleMessages << message;
+    }
+
+    QStringList consoleMessages;
+};
+
+void tst_QObjectBridge::exceptionInSlot()
+{
+    WebPageWithConsoleCapture page;
+    QWebFrame* frame = page.mainFrame();
+    frame->addToJavaScriptWindowObject("myObject", m_myObject);
+    frame->evaluateJavaScript(
+        "myHandler = function() { window.gotSignal = true; throw 'exception in slot'; };"
+        "myObject.mySignal.connect(myHandler);"
+        "gotSignal = false;"
+        "myObject.mySignal();"
+    );
+    QString ret = frame->evaluateJavaScript("gotSignal").toString();
+    QCOMPARE(ret, sTrue);
+    QCOMPARE(page.consoleMessages, QStringList() << "exception in slot");
+}
+
 QTEST_MAIN(tst_QObjectBridge)
 #include "tst_qobjectbridge.moc"
diff --git a/Source/WebKit/win/Plugins/PluginView.h b/Source/WebKit/win/Plugins/PluginView.h
index 6a61e7445..c7c800d50 100644
--- a/Source/WebKit/win/Plugins/PluginView.h
+++ b/Source/WebKit/win/Plugins/PluginView.h
@@ -194,7 +194,9 @@ namespace WebCore {
         void privateBrowsingStateChanged(bool) override;
 
         void disconnectStream(PluginStream*);
+#if ENABLE(NETSCAPE_PLUGIN_API)
         void streamDidFinishLoading(PluginStream* stream) override { disconnectStream(stream); }
+#endif
 
         // Widget functions
         void setFrameRect(const IntRect&) override;
diff --git a/Source/bmalloc/CMakeLists.txt b/Source/bmalloc/CMakeLists.txt
index 4e00800df..ae4afc6a5 100644
--- a/Source/bmalloc/CMakeLists.txt
+++ b/Source/bmalloc/CMakeLists.txt
@@ -31,3 +31,5 @@ include_directories(${bmalloc_INCLUDE_DIRECTORIES})
 add_library(bmalloc STATIC ${bmalloc_SOURCES})
 target_link_libraries(bmalloc ${bmalloc_LIBRARIES})
 set_target_properties(bmalloc PROPERTIES COMPILE_DEFINITIONS "BUILDING_bmalloc")
+
+QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(bmalloc)
diff --git a/Source/cmake/ECMGeneratePriFile.cmake b/Source/cmake/ECMGeneratePriFile.cmake
index b74e89328..9b4a80f18 100644
--- a/Source/cmake/ECMGeneratePriFile.cmake
+++ b/Source/cmake/ECMGeneratePriFile.cmake
@@ -106,7 +106,7 @@ endif()
 
 function(ECM_GENERATE_PRI_FILE)
   set(options )
-  set(oneValueArgs BASE_NAME LIB_NAME DEPS RUNTIME_DEPS FILENAME_VAR INCLUDE_INSTALL_DIR INCLUDE_INSTALL_DIR2 LIB_INSTALL_DIR SET_RPATH DEFINES QT_MODULES)
+  set(oneValueArgs BASE_NAME LIB_NAME DEPS RUNTIME_DEPS FILENAME_VAR INCLUDE_INSTALL_DIR INCLUDE_INSTALL_DIR2 LIB_INSTALL_DIR SET_RPATH DEFINES QT_MODULES EXTRA_LIBS)
   set(multiValueArgs )
 
   cmake_parse_arguments(EGPF "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
@@ -152,6 +152,7 @@ function(ECM_GENERATE_PRI_FILE)
   set(PRI_TARGET_QTDEPS ${EGPF_DEPS})
   set(PRI_TARGET_QTRUNDEPS ${EGPF_RUNTIME_DEPS})
   set(PRI_TARGET_QT_MODULES ${EGPF_QT_MODULES})
+  set(PRI_TARGET_EXTRA_LIBS ${EGPF_EXTRA_LIBS})
   if(IS_ABSOLUTE "${EGPF_INCLUDE_INSTALL_DIR}" OR EGPF_INCLUDE_INSTALL_DIR MATCHES "^\\$\\$")
       set(PRI_TARGET_INCLUDES "${EGPF_INCLUDE_INSTALL_DIR}")
   else()
@@ -176,9 +177,14 @@ function(ECM_GENERATE_PRI_FILE)
 
   set(PRI_FILENAME ${CMAKE_CURRENT_BINARY_DIR}/qt_lib_${PRI_TARGET_BASENAME}.pri)
   if (EGPF_FILENAME_VAR)
-     set(${EGPF_FILENAME_VAR} ${PRI_FILENAME} PARENT_SCOPE)
+      set(${EGPF_FILENAME_VAR} ${PRI_FILENAME} PARENT_SCOPE)
   endif()
 
+  if (PRI_TARGET_EXTRA_LIBS)
+      # assuming that this var is set in STATIC build only
+      set(PRI_TARGET_CONFIG "staticlib")
+  endif ()
+
   file(GENERATE
      OUTPUT ${PRI_FILENAME}
      CONTENT
@@ -199,8 +205,9 @@ QT.${PRI_TARGET_BASENAME}.libexec =
 QT.${PRI_TARGET_BASENAME}.plugins =
 QT.${PRI_TARGET_BASENAME}.imports =
 QT.${PRI_TARGET_BASENAME}.qml =
-QT.${PRI_TARGET_BASENAME}.module_config =
+QT.${PRI_TARGET_BASENAME}.module_config = ${PRI_TARGET_CONFIG}
 QT_MODULES += ${PRI_TARGET_QT_MODULES}
+QMAKE_LIBS_PRIVATE += ${PRI_TARGET_EXTRA_LIBS}
 "
   )
 
diff --git a/Source/cmake/OptionsQt.cmake b/Source/cmake/OptionsQt.cmake
index f6f71a87b..6e709f0c9 100644
--- a/Source/cmake/OptionsQt.cmake
+++ b/Source/cmake/OptionsQt.cmake
@@ -20,22 +20,33 @@ macro(macro_process_qtbase_prl_file qt_target_component)
         endif ()
         if (EXISTS ${_prl_file_location})
             file(STRINGS ${_prl_file_location} prl_strings REGEX "QMAKE_PRL_LIBS")
-            string(REGEX REPLACE "QMAKE_PRL_LIBS *= *([^\n]*)" "\\1" static_depends ${prl_strings})
+            string(REGEX REPLACE "QMAKE_PRL_LIBS *= *([^\\n]*)" "\\1" static_depends ${prl_strings})
             string(STRIP ${static_depends} static_depends)
             set_target_properties(${qt_target_component} PROPERTIES
                 "INTERFACE_LINK_LIBRARIES" "${_link_libs}${_list_sep}${static_depends}"
                 "IMPORTED_LOCATION" "${_lib_location}"
             )
+            string(REPLACE " " ";" static_depends ${static_depends})
+            set(${_lib_name}_STATIC_LIB_DEPENDENCIES "${static_depends}")
         endif ()
     endif ()
 endmacro()
 
+macro(QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT target)
+    if (QT_STATIC_BUILD)
+        install(TARGETS ${target} EXPORT WebKitTargets
+            DESTINATION "${LIB_INSTALL_DIR}")
+    endif ()
+endmacro()
+
 set(PROJECT_VERSION_MAJOR 5)
 set(PROJECT_VERSION_MINOR 602)
 set(PROJECT_VERSION_MICRO 1)
 set(PROJECT_VERSION ${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_MICRO})
 set(PROJECT_VERSION_STRING "${PROJECT_VERSION}")
 
+set(CMAKE_MACOSX_RPATH ON)
+
 add_definitions(-DBUILDING_QT__=1)
 
 WEBKIT_OPTION_BEGIN()
@@ -173,12 +184,9 @@ set(ENABLE_WEBKIT ON)
 set(ENABLE_WEBKIT2 OFF)
 set(WTF_USE_UDIS86 1)
 
-
 get_target_property(QT_CORE_TYPE Qt5::Core TYPE)
 if (QT_CORE_TYPE MATCHES STATIC)
     set(QT_STATIC_BUILD ON)
-endif ()
-if (QT_STATIC_BUILD)
     set(SHARED_CORE OFF)
 endif ()
 
@@ -252,6 +260,13 @@ else ()
     )
     set(ICU_LIBRARIES libicucore.dylib)
     find_library(COREFOUNDATION_LIBRARY CoreFoundation)
+    if (QT_STATIC_BUILD)
+        find_library(CARBON_LIBRARY Carbon)
+        find_library(COCOA_LIBRARY Cocoa)
+        find_library(SYSTEMCONFIGURATION_LIBRARY SystemConfiguration)
+        find_library(CORESERVICES_LIBRARY CoreServices)
+        find_library(SECURITY_LIBRARY Security)
+    endif ()
 endif ()
 
 if (ENABLE_XSLT)
@@ -271,8 +286,6 @@ if (WEBP_FOUND)
 endif ()
 
 set(REQUIRED_QT_VERSION 5.2.0)
-
-
 set(QT_REQUIRED_COMPONENTS Core Gui Network Sql)
 
 # FIXME: Allow building w/o these components
@@ -287,19 +300,48 @@ if (ENABLE_TEST_SUPPORT)
     )
 endif ()
 
+if (ENABLE_GEOLOCATION)
+    list(APPEND QT_REQUIRED_COMPONENTS Positioning)
+    SET_AND_EXPOSE_TO_BUILD(HAVE_QTPOSITIONING 1)
+endif ()
+
+if (ENABLE_DEVICE_ORIENTATION)
+    list(APPEND QT_REQUIRED_COMPONENTS Sensors)
+    SET_AND_EXPOSE_TO_BUILD(HAVE_QTSENSORS 1)
+endif ()
+
+if (ENABLE_PRINT_SUPPORT)
+    list(APPEND QT_REQUIRED_COMPONENTS PrintSupport)
+    SET_AND_EXPOSE_TO_BUILD(HAVE_QTPRINTSUPPORT 1)
+endif ()
+
 find_package(Qt5 ${REQUIRED_QT_VERSION} REQUIRED COMPONENTS ${QT_REQUIRED_COMPONENTS})
 if (QT_STATIC_BUILD)
     foreach (qt_module ${QT_REQUIRED_COMPONENTS})
         macro_process_qtbase_prl_file(Qt5::${qt_module})
+        list(APPEND STATIC_LIB_DEPENDENCIES
+            ${Qt5${qt_module}_STATIC_LIB_DEPENDENCIES}
+        )
     endforeach ()
+    # HACK: We must explicitly add LIB path of the Qt installation
+    # to correctly find qtpcre
+    link_directories(${_qt5_install_prefix}/../)
 endif ()
+
 foreach (qt_module ${QT_OPTIONAL_COMPONENTS})
-    find_package("Qt5${qt_module}" ${REQUIRED_QT_VERSION})
+    find_package("Qt5${qt_module}" ${REQUIRED_QT_VERSION} PATHS ${_qt5_install_prefix} NO_DEFAULT_PATH)
     if (QT_STATIC_BUILD)
         macro_process_qtbase_prl_file(Qt5::${qt_module})
+        list(APPEND STATIC_LIB_DEPENDENCIES
+            ${Qt5${qt_module}_STATIC_LIB_DEPENDENCIES}
+        )
     endif ()
 endforeach ()
 
+if (QT_STATIC_BUILD)
+    list(REMOVE_DUPLICATES STATIC_LIB_DEPENDENCIES)
+endif ()
+
 if (COMPILER_IS_GCC_OR_CLANG AND UNIX)
     if (APPLE OR CMAKE_SYSTEM_NAME MATCHES "Android" OR ${Qt5_VERSION} VERSION_LESS 5.6)
         set(USE_LINKER_VERSION_SCRIPT_DEFAULT OFF)
@@ -312,21 +354,6 @@ endif ()
 
 option(USE_LINKER_VERSION_SCRIPT "Use linker script for ABI compatibility with Qt libraries" ${USE_LINKER_VERSION_SCRIPT_DEFAULT})
 
-if (ENABLE_GEOLOCATION)
-    find_package(Qt5Positioning ${REQUIRED_QT_VERSION} REQUIRED)
-    SET_AND_EXPOSE_TO_BUILD(HAVE_QTPOSITIONING 1)
-endif ()
-
-if (ENABLE_DEVICE_ORIENTATION)
-    find_package(Qt5Sensors ${REQUIRED_QT_VERSION} REQUIRED)
-    SET_AND_EXPOSE_TO_BUILD(HAVE_QTSENSORS 1)
-endif ()
-
-if (ENABLE_PRINT_SUPPORT)
-    find_package(Qt5PrintSupport ${REQUIRED_QT_VERSION} REQUIRED)
-    SET_AND_EXPOSE_TO_BUILD(HAVE_QTPRINTSUPPORT 1)
-endif ()
-
 # Find includes in corresponding build directories
 set(CMAKE_INCLUDE_CURRENT_DIR ON)
 # Instruct CMake to run moc automatically when needed.
@@ -390,9 +417,9 @@ if (NOT ENABLE_VIDEO)
 endif ()
 
 if (USE_QT_MULTIMEDIA)
-    find_package(Qt5Multimedia ${REQUIRED_QT_VERSION} REQUIRED)
+    find_package(Qt5Multimedia ${REQUIRED_QT_VERSION} REQUIRED PATHS ${_qt5_install_prefix} NO_DEFAULT_PATH)
     # FIXME: Allow building w/o widgets
-    find_package(Qt5MultimediaWidgets ${REQUIRED_QT_VERSION} REQUIRED)
+    find_package(Qt5MultimediaWidgets ${REQUIRED_QT_VERSION} REQUIRED PATHS ${_qt5_install_prefix} NO_DEFAULT_PATH)
 endif ()
 
 # From OptionsGTK.cmake
diff --git a/Tools/QtTestBrowser/CMakeLists.txt b/Tools/QtTestBrowser/CMakeLists.txt
index 1ee49365a..485cd0ca1 100644
--- a/Tools/QtTestBrowser/CMakeLists.txt
+++ b/Tools/QtTestBrowser/CMakeLists.txt
@@ -41,6 +41,7 @@ set(QtTestBrowser_LIBRARIES
     ${Qt5Widgets_LIBRARIES}
     ${Qt5PrintSupport_LIBRARIES}
     WebKitWidgets
+    ${STATIC_LIB_DEPENDENCIES}
 )
 
 qt_wrap_cpp(WebKit QtTestBrowser_SOURCES
diff --git a/Tools/TestWebKitAPI/PlatformQt.cmake b/Tools/TestWebKitAPI/PlatformQt.cmake
index 08d94c0d8..fe3808685 100644
--- a/Tools/TestWebKitAPI/PlatformQt.cmake
+++ b/Tools/TestWebKitAPI/PlatformQt.cmake
@@ -35,6 +35,7 @@ set(test_webcore_LIBRARIES
     WebCore
     gtest
     ${Qt5Gui_LIBRARIES}
+    ${DEPEND_STATIC_LIBS}
 )
 
 add_executable(TestWebCore
diff --git a/Tools/qt/make-snapshot.pl b/Tools/qt/make-snapshot.pl
index 27c5621d6..b8a527e3f 100755
--- a/Tools/qt/make-snapshot.pl
+++ b/Tools/qt/make-snapshot.pl
@@ -28,6 +28,8 @@ my @commands = (
     "Tools/gtk/make-dist.py -t snapshot Tools/qt/manifest.txt",
     "cd $target_repo",
     "git rm -rf *",
+    "git reset -- dist LICENSE.LGPLv21",
+    "git checkout -- dist LICENSE.LGPLv21",
     "tar -xf $src_repo/snapshot.tar --strip-components=1",
     "git add -A",
     "rm $src_repo/snapshot.tar",