| Index: Source/core/dom/Document.cpp
 | 
| diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
 | 
| index 9deea3efe9cbfa5420230d415cda3d00c81d4cd2..88cb372fb0919c63849476774909218eb251be7b 100644
 | 
| --- a/Source/core/dom/Document.cpp
 | 
| +++ b/Source/core/dom/Document.cpp
 | 
| @@ -119,6 +119,7 @@
 | 
|  #include "core/frame/Settings.h"
 | 
|  #include "core/html/HTMLAllCollection.h"
 | 
|  #include "core/html/HTMLAnchorElement.h"
 | 
| +#include "core/html/HTMLBaseElement.h"
 | 
|  #include "core/html/HTMLCanvasElement.h"
 | 
|  #include "core/html/HTMLCollection.h"
 | 
|  #include "core/html/HTMLDialogElement.h"
 | 
| @@ -1358,13 +1359,8 @@ void Document::removeTitle(Element* titleElement)
 | 
|      // FIXME: This is broken for SVG.
 | 
|      // Update title based on first title element in the head, if one exists.
 | 
|      if (HTMLElement* headElement = head()) {
 | 
| -        for (Element* element = ElementTraversal::firstWithin(*headElement); element; element = ElementTraversal::nextSibling(*element)) {
 | 
| -            if (!element->hasTagName(titleTag))
 | 
| -                continue;
 | 
| -            HTMLTitleElement* title = toHTMLTitleElement(element);
 | 
| +        if (HTMLTitleElement* title = Traversal<HTMLTitleElement>::firstChild(*headElement))
 | 
|              setTitleElement(title->text(), title);
 | 
| -            break;
 | 
| -        }
 | 
|      }
 | 
|  
 | 
|      if (!m_titleElement)
 | 
| @@ -2359,11 +2355,7 @@ HTMLHeadElement* Document::head()
 | 
|      if (!de)
 | 
|          return 0;
 | 
|  
 | 
| -    for (Element* child = ElementTraversal::firstWithin(*de); child; child = ElementTraversal::nextSibling(*child)) {
 | 
| -        if (child->hasTagName(headTag))
 | 
| -            return toHTMLHeadElement(child);
 | 
| -    }
 | 
| -    return 0;
 | 
| +    return Traversal<HTMLHeadElement>::firstChild(*de);
 | 
|  }
 | 
|  
 | 
|  Element* Document::viewportDefiningElement(RenderStyle* rootStyle) const
 | 
| @@ -2740,10 +2732,8 @@ void Document::updateBaseURL()
 | 
|      if (!equalIgnoringFragmentIdentifier(oldBaseURL, m_baseURL)) {
 | 
|          // Base URL change changes any relative visited links.
 | 
|          // FIXME: There are other URLs in the tree that would need to be re-evaluated on dynamic base URL change. Style should be invalidated too.
 | 
| -        for (Element* element = ElementTraversal::firstWithin(*this); element; element = ElementTraversal::next(*element)) {
 | 
| -            if (element->hasTagName(aTag))
 | 
| -                toHTMLAnchorElement(element)->invalidateCachedVisitedLinkHash();
 | 
| -        }
 | 
| +        for (HTMLAnchorElement* anchor = Traversal<HTMLAnchorElement>::firstWithin(*this); anchor; anchor = Traversal<HTMLAnchorElement>::next(*anchor))
 | 
| +            anchor->invalidateCachedVisitedLinkHash();
 | 
|      }
 | 
|  }
 | 
|  
 | 
| @@ -2758,21 +2748,19 @@ void Document::processBaseElement()
 | 
|      // Find the first href attribute in a base element and the first target attribute in a base element.
 | 
|      const AtomicString* href = 0;
 | 
|      const AtomicString* target = 0;
 | 
| -    for (Element* element = ElementTraversal::firstWithin(*this); element && (!href || !target); element = ElementTraversal::next(*element)) {
 | 
| -        if (element->hasTagName(baseTag)) {
 | 
| -            if (!href) {
 | 
| -                const AtomicString& value = element->fastGetAttribute(hrefAttr);
 | 
| -                if (!value.isNull())
 | 
| -                    href = &value;
 | 
| -            }
 | 
| -            if (!target) {
 | 
| -                const AtomicString& value = element->fastGetAttribute(targetAttr);
 | 
| -                if (!value.isNull())
 | 
| -                    target = &value;
 | 
| -            }
 | 
| -            if (contentSecurityPolicy()->isActive())
 | 
| -                UseCounter::count(*this, UseCounter::ContentSecurityPolicyWithBaseElement);
 | 
| +    for (HTMLBaseElement* base = Traversal<HTMLBaseElement>::firstWithin(*this); base && (!href || !target); base = Traversal<HTMLBaseElement>::next(*base)) {
 | 
| +        if (!href) {
 | 
| +            const AtomicString& value = base->fastGetAttribute(hrefAttr);
 | 
| +            if (!value.isNull())
 | 
| +                href = &value;
 | 
| +        }
 | 
| +        if (!target) {
 | 
| +            const AtomicString& value = base->fastGetAttribute(targetAttr);
 | 
| +            if (!value.isNull())
 | 
| +                target = &value;
 | 
|          }
 | 
| +        if (contentSecurityPolicy()->isActive())
 | 
| +            UseCounter::count(*this, UseCounter::ContentSecurityPolicyWithBaseElement);
 | 
|      }
 | 
|  
 | 
|      // FIXME: Since this doesn't share code with completeURL it may not handle encodings correctly.
 | 
| 
 |