Update chromium to branch 1599.

Change-Id: I04e775a946a208bb4500d3b722bcb05c82b9d7cb
Reviewed-by: Andras Becsi <andras.becsi@digia.com>

28 files changed, 425 insertions, 111 deletions

diff --git a/chromium/content/public/android/java/res/values-v17/styles.xml b/chromium/content/public/android/java/res/values-v17/styles.xml
new file mode 100644
index 00000000000..aaeb6d759d6
--- /dev/null
+++ b/chromium/content/public/android/java/res/values-v17/styles.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2013 The Chromium Authors. All rights reserved.
+
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file.
+-->
+
+<resources>
+    <style name="ContentActionBar">
+        <item name="action_mode_share_drawable">@drawable/ic_menu_share_holo_light</item>
+        <item name="action_mode_web_search_drawable">@drawable/ic_menu_search_holo_light</item>
+    </style>
+    <style name="SelectPopupDialog">
+        <item name="select_dialog_singlechoice">@android:layout/select_dialog_singlechoice</item>
+        <item name="select_dialog_multichoice">@android:layout/select_dialog_multichoice</item>
+    </style>
+</resources>
diff --git a/chromium/content/public/android/java/res/values/attrs.xml b/chromium/content/public/android/java/res/values/attrs.xml
new file mode 100644
index 00000000000..8014143954b
--- /dev/null
+++ b/chromium/content/public/android/java/res/values/attrs.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2013 The Chromium Authors. All rights reserved.
+
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file.
+-->
+
+<resources>
+    <attr name="action_mode_share_drawable" format="reference" />
+    <attr name="action_mode_web_search_drawable" format="reference" />
+    <attr name="select_dialog_multichoice" format="reference" />
+    <attr name="select_dialog_singlechoice" format="reference" />
+</resources>
diff --git a/chromium/content/public/android/java/resource_map/org/chromium/content/R.java b/chromium/content/public/android/java/resource_map/org/chromium/content/R.java
index ea936839690..6204c72a058 100644
--- a/chromium/content/public/android/java/resource_map/org/chromium/content/R.java
+++ b/chromium/content/public/android/java/resource_map/org/chromium/content/R.java
@@ -16,12 +16,16 @@ package org.chromium.content;
  * com.android.internal.R.
  */
 public final class R {
+    public static final class attr {
+        public static int action_mode_share_drawable;
+        public static int action_mode_web_search_drawable;
+        public static int select_dialog_multichoice;
+        public static int select_dialog_singlechoice;
+    }
     public static final class dimen {
         public static int link_preview_overlay_radius;
     }
     public static final class drawable {
-        public static int ic_menu_search_holo_light;
-        public static int ic_menu_share_holo_light;
         public static int ondemand_overlay;
     }
     public static final class id {
@@ -56,4 +60,8 @@ public final class R {
         public static int month_picker_dialog_title;
         public static int week_picker_dialog_title;
     }
+    public static final class style {
+        public static int ContentActionBar;
+        public static int SelectPopupDialog;
+    }
 }
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/ContentView.java b/chromium/content/public/android/java/src/org/chromium/content/browser/ContentView.java
index c1d7b0aab00..f4c358bb0ad 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/ContentView.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/ContentView.java
@@ -101,6 +101,9 @@ public class ContentView extends FrameLayout
             setVerticalScrollBarEnabled(false);
         }
 
+        setFocusable(true);
+        setFocusableInTouchMode(true);
+
         mContentViewCore = new ContentViewCore(context);
         mContentViewCore.initialize(this, this, nativeWebContents, windowAndroid,
                 Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN ?
@@ -441,6 +444,12 @@ public class ContentView extends FrameLayout
     }
 
     @Override
+    public void onWindowFocusChanged(boolean hasWindowFocus) {
+        super.onWindowFocusChanged(hasWindowFocus);
+        mContentViewCore.onWindowFocusChanged(hasWindowFocus);
+    }
+
+    @Override
     public boolean onKeyUp(int keyCode, KeyEvent event) {
         return mContentViewCore.onKeyUp(keyCode, event);
     }
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index 6b65a9c5774..531417fb419 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
@@ -27,6 +27,7 @@ import android.text.Editable;
 import android.util.Log;
 import android.util.Pair;
 import android.view.ActionMode;
+import android.view.HapticFeedbackConstants;
 import android.view.InputDevice;
 import android.view.KeyEvent;
 import android.view.MotionEvent;
@@ -58,8 +59,8 @@ import org.chromium.content.browser.accessibility.BrowserAccessibilityManager;
 import org.chromium.content.browser.input.AdapterInputConnection;
 import org.chromium.content.browser.input.HandleView;
 import org.chromium.content.browser.input.ImeAdapter;
-import org.chromium.content.browser.input.InputMethodManagerWrapper;
 import org.chromium.content.browser.input.ImeAdapter.AdapterInputConnectionFactory;
+import org.chromium.content.browser.input.InputMethodManagerWrapper;
 import org.chromium.content.browser.input.InsertionHandleController;
 import org.chromium.content.browser.input.SelectPopupDialog;
 import org.chromium.content.browser.input.SelectionHandleController;
@@ -71,7 +72,6 @@ import org.chromium.ui.gfx.DeviceDisplayInfo;
 
 import java.lang.annotation.Annotation;
 import java.lang.reflect.Field;
-import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
@@ -403,6 +403,12 @@ import java.util.Map;
     // The AccessibilityInjector that handles loading Accessibility scripts into the web page.
     private AccessibilityInjector mAccessibilityInjector;
 
+    // Whether native accessibility, i.e. without any script injection, is allowed.
+    private boolean mNativeAccessibilityAllowed;
+
+    // Whether native accessibility, i.e. without any script injection, has been enabled.
+    private boolean mNativeAccessibilityEnabled;
+
     // Handles native accessibility, i.e. without any script injection.
     private BrowserAccessibilityManager mBrowserAccessibilityManager;
 
@@ -519,9 +525,9 @@ import java.util.Map;
                 // The anchor view should not go outside the bounds of the ContainerView.
                 int leftMargin = Math.round(x * scale);
                 int topMargin = Math.round(mRenderCoordinates.getContentOffsetYPix() + y * scale);
+                int scaledWidth = Math.round(width * scale);
                 // ContentViewCore currently only supports these two container view types.
                 if (mContainerView instanceof FrameLayout) {
-                    int scaledWidth = Math.round(width * scale);
                     if (scaledWidth + leftMargin > mContainerView.getWidth()) {
                         scaledWidth = mContainerView.getWidth() - leftMargin;
                     }
@@ -538,9 +544,10 @@ import java.util.Map;
                     // these models.
                     leftMargin += mRenderCoordinates.getScrollXPixInt();
                     topMargin += mRenderCoordinates.getScrollYPixInt();
+
                     android.widget.AbsoluteLayout.LayoutParams lp =
-                            new android.widget.AbsoluteLayout.LayoutParams((int)width,
-                                    (int)(height * scale), leftMargin, topMargin);
+                            new android.widget.AbsoluteLayout.LayoutParams(
+                                scaledWidth, (int)(height * scale), leftMargin, topMargin);
                     view.setLayoutParams(lp);
                 } else {
                     Log.e(TAG, "Unknown layout " + mContainerView.getClass().getName());
@@ -757,8 +764,6 @@ import java.util.Map;
         mContainerViewInternals = internalDispatcher;
 
         mContainerView.setWillNotDraw(false);
-        mContainerView.setFocusable(true);
-        mContainerView.setFocusableInTouchMode(true);
         mContainerView.setClickable(true);
 
         mZoomManager = new ZoomManager(mContext, this);
@@ -1375,7 +1380,20 @@ import java.util.Map;
     public void evaluateJavaScript(
             String script, JavaScriptCallback callback) throws IllegalStateException {
         checkIsAlive();
-        nativeEvaluateJavaScript(mNativeContentViewCore, script, callback);
+        nativeEvaluateJavaScript(mNativeContentViewCore, script, callback, false);
+    }
+
+    /**
+     * Injects the passed Javascript code in the current page and evaluates it.
+     * If there is no page existing, a new one will be created.
+     *
+     * @param script The Javascript to execute.
+     * @throws IllegalStateException If the ContentView has been destroyed.
+     */
+    public void evaluateJavaScriptEvenIfNotYetNavigated(String script)
+            throws IllegalStateException {
+        checkIsAlive();
+        nativeEvaluateJavaScript(mNativeContentViewCore, script, null, true);
     }
 
     /**
@@ -1657,6 +1675,15 @@ import java.util.Map;
         mScrolledAndZoomedFocusedEditableNode = false;
     }
 
+    /**
+     * @see View#onWindowFocusChanged(boolean)
+     */
+    public void onWindowFocusChanged(boolean hasWindowFocus) {
+        if (!hasWindowFocus) {
+            mContentViewGestureHandler.onWindowFocusLost();
+        }
+    }
+
     public void onFocusChanged(boolean gainFocus) {
         if (!gainFocus) getContentViewClient().onImeStateChangeRequested(false);
         if (mNativeContentViewCore != 0) nativeSetFocus(mNativeContentViewCore, gainFocus);
@@ -1860,17 +1887,32 @@ import java.util.Map;
         }
     }
 
+    /**
+     * Called by native side when the corresponding renderer crashes. Note that if a renderer is
+     * shared between tabs, this might be called multiple times while the tab is crashed. This is
+     * because the tabs sharing a renderer also share RenderProcessHost. When one of those tabs
+     * reloads and a new renderer is created for the shared RenderProcessHost, all tabs are notified
+     * in onRenderProcessSwap(), not only the one that reloads. If this renderer dies, all the other
+     * dead tabs are notified again.
+     * @param alreadyCrashed true iff this tab is already in crashed state but the shared renderer
+     *                       resurrected and died again since the last time this was called.
+     */
     @SuppressWarnings("unused")
     @CalledByNative
-    private void onTabCrash() {
+    private void onTabCrash(boolean alreadyCrashed) {
         assert mPid != 0;
-        getContentViewClient().onRendererCrash(ChildProcessLauncher.isOomProtected(mPid));
+        if (!alreadyCrashed) {
+            getContentViewClient().onRendererCrash(ChildProcessLauncher.isOomProtected(mPid));
+        }
         mPid = 0;
     }
 
     private void handleTapOrPress(
             long timeMs, float xPix, float yPix, int isLongPressOrTap, boolean showPress) {
-        if (!mContainerView.isFocused()) mContainerView.requestFocus();
+        if (mContainerView.isFocusable() && mContainerView.isFocusableInTouchMode()
+                && !mContainerView.isFocused())  {
+            mContainerView.requestFocus();
+        }
 
         if (!mPopupZoomer.isShowing()) mPopupZoomer.setLastTouch(xPix, yPix);
 
@@ -1905,6 +1947,10 @@ import java.util.Map;
         mZoomManager.updateMultiTouchSupport(supportsMultiTouchZoom);
     }
 
+    public void updateDoubleTapDragSupport(boolean supportsDoubleTapDrag) {
+        mContentViewGestureHandler.updateDoubleTapDragSupport(supportsDoubleTapDrag);
+    }
+
     public void selectPopupMenuItems(int[] indices) {
         if (mNativeContentViewCore != 0) {
             nativeSelectPopupMenuItems(mNativeContentViewCore, indices);
@@ -2403,9 +2449,18 @@ import java.util.Map;
                 mEndHandlePoint.setLocalDip(x1, y1);
             }
 
+            boolean wereSelectionHandlesShowing = getSelectionHandleController().isShowing();
+
             getSelectionHandleController().onSelectionChanged(anchorDir, focusDir);
             updateHandleScreenPositions();
             mHasSelection = true;
+
+            if (!wereSelectionHandlesShowing && getSelectionHandleController().isShowing()) {
+                // TODO(cjhopman): Remove this when there is a better signal that long press caused
+                // a selection. See http://crbug.com/150151.
+                mContainerView.performHapticFeedback(HapticFeedbackConstants.LONG_PRESS);
+            }
+
         } else {
             mUnselectAllOnActionModeDismiss = false;
             hideSelectActionBar();
@@ -2472,15 +2527,19 @@ import java.util.Map;
     @SuppressWarnings("unused")
     @CalledByNative
     private void onWebContentsConnected() {
-        if (mImeAdapter != null &&
-                !mImeAdapter.isNativeImeAdapterAttached() && mNativeContentViewCore != 0) {
-            mImeAdapter.attach(nativeGetNativeImeAdapter(mNativeContentViewCore));
-        }
+        attachImeAdapter();
     }
 
     @SuppressWarnings("unused")
     @CalledByNative
     private void onWebContentsSwapped() {
+        attachImeAdapter();
+    }
+
+    /**
+     * Attaches the native ImeAdapter object to the java ImeAdapter to allow communication via JNI.
+     */
+    public void attachImeAdapter() {
         if (mImeAdapter != null && mNativeContentViewCore != 0) {
             mImeAdapter.attach(nativeGetNativeImeAdapter(mNativeContentViewCore));
         }
@@ -2751,14 +2810,23 @@ import java.util.Map;
      * If native accessibility (not script injection) is enabled, and if this is
      * running on JellyBean or later, returns an AccessibilityNodeProvider that
      * implements native accessibility for this view. Returns null otherwise.
+     * Lazily initializes native accessibility here if it's allowed.
      * @return The AccessibilityNodeProvider, if available, or null otherwise.
      */
     public AccessibilityNodeProvider getAccessibilityNodeProvider() {
         if (mBrowserAccessibilityManager != null) {
             return mBrowserAccessibilityManager.getAccessibilityNodeProvider();
-        } else {
-            return null;
         }
+
+        if (mNativeAccessibilityAllowed &&
+                !mNativeAccessibilityEnabled &&
+                mNativeContentViewCore != 0 &&
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
+            mNativeAccessibilityEnabled = true;
+            nativeSetAccessibilityEnabled(mNativeContentViewCore, true);
+        }
+
+        return null;
     }
 
     /**
@@ -2845,29 +2913,20 @@ import java.util.Map;
      * Turns browser accessibility on or off.
      * If |state| is |false|, this turns off both native and injected accessibility.
      * Otherwise, if accessibility script injection is enabled, this will enable the injected
-     * accessibility scripts, and if it is disabled this will enable the native accessibility.
+     * accessibility scripts. Native accessibility is enabled on demand.
      */
     public void setAccessibilityState(boolean state) {
-        boolean injectedAccessibility = false;
-        boolean nativeAccessibility = false;
-        if (state) {
-            if (isDeviceAccessibilityScriptInjectionEnabled()) {
-                injectedAccessibility = true;
-            } else {
-                nativeAccessibility = true;
-            }
+        if (!state) {
+            setInjectedAccessibility(false);
+            return;
         }
-        setInjectedAccessibility(injectedAccessibility);
-        setNativeAccessibilityState(nativeAccessibility);
-    }
 
-    /**
-     * Enable or disable native accessibility features.
-     */
-    public void setNativeAccessibilityState(boolean enabled) {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
-            nativeSetAccessibilityEnabled(mNativeContentViewCore, enabled);
+        if (isDeviceAccessibilityScriptInjectionEnabled()) {
+            setInjectedAccessibility(true);
+            return;
         }
+
+        mNativeAccessibilityAllowed = true;
     }
 
     /**
@@ -3121,7 +3180,7 @@ import java.util.Map;
     private native void nativeClearHistory(int nativeContentViewCoreImpl);
 
     private native void nativeEvaluateJavaScript(int nativeContentViewCoreImpl,
-            String script, JavaScriptCallback callback);
+            String script, JavaScriptCallback callback, boolean startRenderer);
 
     private native int nativeGetNativeImeAdapter(int nativeContentViewCoreImpl);
 
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewGestureHandler.java b/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewGestureHandler.java
index 053aa9a48a3..ddf433e3ac2 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewGestureHandler.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/ContentViewGestureHandler.java
@@ -9,6 +9,7 @@ import android.os.Bundle;
 import android.os.Handler;
 import android.os.SystemClock;
 import android.util.Log;
+import android.view.InputDevice;
 import android.view.MotionEvent;
 import android.view.ViewConfiguration;
 
@@ -143,6 +144,10 @@ class ContentViewGestureHandler implements LongPressDelegate {
     // Whether input events are delivered right before vsync.
     private final boolean mInputEventsDeliveredAtVSync;
 
+    // Keeps track of the last long press event, if we end up opening a context menu, we would need
+    // to potentially use the event to send GESTURE_SHOW_PRESS_CANCEL to remove ::active styling
+    private MotionEvent mLastLongPressEvent;
+
     static final int GESTURE_SHOW_PRESSED_STATE = 0;
     static final int GESTURE_DOUBLE_TAP = 1;
     static final int GESTURE_SINGLE_TAP_UP = 2;
@@ -176,6 +181,7 @@ class ContentViewGestureHandler implements LongPressDelegate {
     static final int DOUBLE_TAP_DRAG_MODE_NONE = 0;
     static final int DOUBLE_TAP_DRAG_MODE_DETECTION_IN_PROGRESS = 1;
     static final int DOUBLE_TAP_DRAG_MODE_ZOOM = 2;
+    static final int DOUBLE_TAP_DRAG_MODE_DISABLED = 3;
 
     private class TouchEventTimeoutHandler implements Runnable {
         private static final int TOUCH_EVENT_TIMEOUT = 200;
@@ -336,9 +342,9 @@ class ContentViewGestureHandler implements LongPressDelegate {
     void setTestDependencies(
             LongPressDetector longPressDetector, GestureDetector gestureDetector,
             OnGestureListener listener) {
-        mLongPressDetector = longPressDetector;
-        mGestureDetector = gestureDetector;
-        mListener = listener;
+        if (longPressDetector != null) mLongPressDetector = longPressDetector;
+        if (gestureDetector != null) mGestureDetector = gestureDetector;
+        if (listener != null) mListener = listener;
     }
 
     private void initGestureDetectors(final Context context) {
@@ -510,6 +516,7 @@ class ContentViewGestureHandler implements LongPressDelegate {
 
                     @Override
                     public boolean onDoubleTapEvent(MotionEvent e) {
+                        if (isDoubleTapDragDisabled()) return false;
                         switch (e.getActionMasked()) {
                             case MotionEvent.ACTION_DOWN:
                                 sendShowPressCancelIfNecessary(e);
@@ -543,7 +550,7 @@ class ContentViewGestureHandler implements LongPressDelegate {
                                     pinchBy(e.getEventTime(),
                                             Math.round(mDoubleTapDragZoomAnchorX),
                                             Math.round(mDoubleTapDragZoomAnchorY),
-                                            (float) Math.pow(dy < 0 ?
+                                            (float) Math.pow(dy > 0 ?
                                                     1.0f - DOUBLE_TAP_DRAG_ZOOM_SPEED :
                                                     1.0f + DOUBLE_TAP_DRAG_ZOOM_SPEED,
                                                     Math.abs(dy * mPxToDp)));
@@ -569,8 +576,9 @@ class ContentViewGestureHandler implements LongPressDelegate {
                     @Override
                     public void onLongPress(MotionEvent e) {
                         if (!mZoomManager.isScaleGestureDetectionInProgress() &&
-                                mDoubleTapDragMode == DOUBLE_TAP_DRAG_MODE_NONE) {
-                            sendShowPressCancelIfNecessary(e);
+                                (mDoubleTapDragMode == DOUBLE_TAP_DRAG_MODE_NONE ||
+                                 isDoubleTapDragDisabled())) {
+                            mLastLongPressEvent = e;
                             sendMotionEventAsGesture(GESTURE_LONG_PRESS, e, null);
                         }
                     }
@@ -664,6 +672,7 @@ class ContentViewGestureHandler implements LongPressDelegate {
      *              to send. This argument is an optional and can be null.
      */
     void endDoubleTapDragMode(MotionEvent event) {
+        if (isDoubleTapDragDisabled()) return;
         if (mDoubleTapDragMode == DOUBLE_TAP_DRAG_MODE_ZOOM) {
             if (event == null) event = obtainActionCancelMotionEvent();
             pinchEnd(event.getEventTime());
@@ -796,6 +805,15 @@ class ContentViewGestureHandler implements LongPressDelegate {
         }
     }
 
+    /**
+     * Handle content view losing focus -- ensure that any remaining active state is removed.
+     */
+    void onWindowFocusLost() {
+        if (mLongPressDetector.isInLongPress() && mLastLongPressEvent != null) {
+            sendShowPressCancelIfNecessary(mLastLongPressEvent);
+        }
+    }
+
     private MotionEvent obtainActionCancelMotionEvent() {
         return MotionEvent.obtain(
                 SystemClock.uptimeMillis(),
@@ -810,16 +828,11 @@ class ContentViewGestureHandler implements LongPressDelegate {
      * FrameLoader::transitionToCommitted iff the page ever had touch handlers.
      */
     void resetGestureHandlers() {
-        {
-            MotionEvent me = obtainActionCancelMotionEvent();
-            mGestureDetector.onTouchEvent(me);
-            me.recycle();
-        }
-        {
-            MotionEvent me = obtainActionCancelMotionEvent();
-            mZoomManager.processTouchEvent(me);
-            me.recycle();
-        }
+        MotionEvent me = obtainActionCancelMotionEvent();
+        me.setSource(InputDevice.SOURCE_CLASS_POINTER);
+        mGestureDetector.onTouchEvent(me);
+        mZoomManager.processTouchEvent(me);
+        me.recycle();
         mLongPressDetector.cancelLongPress();
     }
 
@@ -1081,6 +1094,7 @@ class ContentViewGestureHandler implements LongPressDelegate {
 
         if (sendMotionEventAsGesture(GESTURE_SHOW_PRESS_CANCEL, e, null)) {
             mShowPressIsCalled = false;
+            mLastLongPressEvent = null;
         }
     }
 
@@ -1148,4 +1162,15 @@ class ContentViewGestureHandler implements LongPressDelegate {
     boolean hasScheduledTouchTimeoutEventForTesting() {
         return mTouchEventTimeoutHandler.hasScheduledTimeoutEventForTesting();
     }
+
+    public void updateDoubleTapDragSupport(boolean supportDoubleTapDrag) {
+        assert (mDoubleTapDragMode == DOUBLE_TAP_DRAG_MODE_DISABLED ||
+                mDoubleTapDragMode == DOUBLE_TAP_DRAG_MODE_NONE);
+        mDoubleTapDragMode = supportDoubleTapDrag ?
+                DOUBLE_TAP_DRAG_MODE_NONE : DOUBLE_TAP_DRAG_MODE_DISABLED;
+    }
+
+    private boolean isDoubleTapDragDisabled() {
+        return mDoubleTapDragMode == DOUBLE_TAP_DRAG_MODE_DISABLED;
+    }
 }
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/MediaResourceGetter.java b/chromium/content/public/android/java/src/org/chromium/content/browser/MediaResourceGetter.java
index 5d0de5ad95b..cab9de296b5 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/MediaResourceGetter.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/MediaResourceGetter.java
@@ -5,6 +5,7 @@
 package org.chromium.content.browser;
 
 import android.content.Context;
+import android.content.pm.PackageManager;
 import android.media.MediaMetadataRetriever;
 import android.net.ConnectivityManager;
 import android.net.NetworkInfo;
@@ -63,6 +64,12 @@ class MediaResourceGetter {
         ConnectivityManager mConnectivityManager =
                 (ConnectivityManager) context.getSystemService(Context.CONNECTIVITY_SERVICE);
         if (mConnectivityManager != null) {
+            if (context.checkCallingOrSelfPermission(
+                    android.Manifest.permission.ACCESS_NETWORK_STATE) !=
+                    PackageManager.PERMISSION_GRANTED) {
+                return new MediaMetadata(0, 0, 0, false);
+            }
+
             NetworkInfo info = mConnectivityManager.getActiveNetworkInfo();
             if (info == null) {
                 return new MediaMetadata(durationInMilliseconds, width, height, success);
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/SelectActionModeCallback.java b/chromium/content/public/android/java/src/org/chromium/content/browser/SelectActionModeCallback.java
index 4ff58bd6bdc..6053448f554 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/SelectActionModeCallback.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/SelectActionModeCallback.java
@@ -4,6 +4,7 @@
 
 package org.chromium.content.browser;
 
+import android.app.Activity;
 import android.app.SearchManager;
 import android.content.ClipboardManager;
 import android.content.Context;
@@ -27,11 +28,15 @@ public class SelectActionModeCallback implements ActionMode.Callback {
     private static final int CUT_ATTR_INDEX = 1;
     private static final int COPY_ATTR_INDEX = 2;
     private static final int PASTE_ATTR_INDEX = 3;
+    private static final int SHARE_ATTR_INDEX = 4;
+    private static final int WEB_SEARCH_ATTR_INDEX = 5;
     private static final int[] ACTION_MODE_ATTRS = {
         android.R.attr.actionModeSelectAllDrawable,
         android.R.attr.actionModeCutDrawable,
         android.R.attr.actionModeCopyDrawable,
         android.R.attr.actionModePasteDrawable,
+        R.attr.action_mode_share_drawable,
+        R.attr.action_mode_web_search_drawable
     };
 
     private static final int ID_SELECTALL = 0;
@@ -124,7 +129,8 @@ public class SelectActionModeCallback implements ActionMode.Callback {
     }
 
     private void createActionMenu(ActionMode mode, Menu menu) {
-        TypedArray styledAttributes = getContext().obtainStyledAttributes(ACTION_MODE_ATTRS);
+        TypedArray styledAttributes = getContext().obtainStyledAttributes(
+                R.style.ContentActionBar, ACTION_MODE_ATTRS);
 
         menu.add(Menu.NONE, ID_SELECTALL, Menu.NONE, android.R.string.selectAll).
             setAlphabeticShortcut('a').
@@ -157,14 +163,14 @@ public class SelectActionModeCallback implements ActionMode.Callback {
         if (!mEditable) {
             if (isShareHandlerAvailable()) {
                 menu.add(Menu.NONE, ID_SHARE, Menu.NONE, R.string.actionbar_share).
-                    setIcon(R.drawable.ic_menu_share_holo_light).
+                    setIcon(styledAttributes.getResourceId(SHARE_ATTR_INDEX, 0)).
                     setShowAsAction(
                             MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT);
             }
 
             if (!mIncognito && isWebSearchAvailable()) {
                 menu.add(Menu.NONE, ID_SEARCH, Menu.NONE, R.string.actionbar_web_search).
-                    setIcon(R.drawable.ic_menu_search_holo_light).
+                    setIcon(styledAttributes.getResourceId(WEB_SEARCH_ATTR_INDEX, 0)).
                     setShowAsAction(
                             MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT);
             }
@@ -212,6 +218,9 @@ public class SelectActionModeCallback implements ActionMode.Callback {
                     i.putExtra(SearchManager.EXTRA_NEW_SEARCH, true);
                     i.putExtra(SearchManager.QUERY, selection);
                     i.putExtra(Browser.EXTRA_APPLICATION_ID, getContext().getPackageName());
+                    if (!(getContext() instanceof Activity)) {
+                        i.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                    }
                     try {
                         getContext().startActivity(i);
                     } catch (android.content.ActivityNotFoundException ex) {
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/accessibility/BrowserAccessibilityManager.java b/chromium/content/public/android/java/src/org/chromium/content/browser/accessibility/BrowserAccessibilityManager.java
index f03ba9b79e7..2180b480e7f 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/accessibility/BrowserAccessibilityManager.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/accessibility/BrowserAccessibilityManager.java
@@ -268,13 +268,11 @@ public class BrowserAccessibilityManager {
 
     @CalledByNative
     private void handleTextSelectionChanged(int id) {
-        sendAccessibilityEvent(id, AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED);
         sendAccessibilityEvent(id, AccessibilityEvent.TYPE_VIEW_TEXT_SELECTION_CHANGED);
     }
 
     @CalledByNative
     private void handleEditableTextChanged(int id) {
-        sendAccessibilityEvent(id, AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED);
         sendAccessibilityEvent(id, AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED);
     }
 
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/input/HandleView.java b/chromium/content/public/android/java/src/org/chromium/content/browser/input/HandleView.java
index a220894fd80..88a6deaefea 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/input/HandleView.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/input/HandleView.java
@@ -152,16 +152,20 @@ public class HandleView extends View {
                 mDrawable.getIntrinsicHeight());
     }
 
+    private void updateContainerPosition() {
+        final int[] coords = mTempCoords;
+        mParent.getLocationInWindow(coords);
+        mContainerPositionX = coords[0] + mPositionX;
+        mContainerPositionY = coords[1] + mPositionY;
+    }
+
     void show() {
         if (!isPositionVisible()) {
             hide();
             return;
         }
         mContainer.setContentView(this);
-        final int[] coords = mTempCoords;
-        mParent.getLocationInWindow(coords);
-        mContainerPositionX = coords[0] + mPositionX;
-        mContainerPositionY = coords[1] + mPositionY;
+        updateContainerPosition();
         mContainer.showAtLocation(mParent, 0, mContainerPositionX, mContainerPositionY);
 
         // Hide paste view when handle is moved on screen.
@@ -261,6 +265,9 @@ public class HandleView extends View {
     @Override
     protected void onDraw(Canvas c) {
         updateAlpha();
+        updateContainerPosition();
+        mContainer.update(mContainerPositionX, mContainerPositionY,
+                getRight() - getLeft(), getBottom() - getTop());
         mDrawable.setBounds(0, 0, getRight() - getLeft(), getBottom() - getTop());
         mDrawable.draw(c);
     }
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/input/MonthPicker.java b/chromium/content/public/android/java/src/org/chromium/content/browser/input/MonthPicker.java
index 3e06d75cf90..57cab667619 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/input/MonthPicker.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/input/MonthPicker.java
@@ -92,16 +92,16 @@ public class MonthPicker extends TwoFieldDatePicker {
 
 
     @Override
-    protected int getMaxPositionInYear() {
-        if (getYear() == getMaxDate().get(Calendar.YEAR)) {
+    protected int getMaxPositionInYear(int year) {
+        if (year == getMaxDate().get(Calendar.YEAR)) {
             return getMaxDate().get(Calendar.MONTH);
         }
         return MONTHS_NUMBER - 1;
     }
 
     @Override
-    protected int getMinPositionInYear() {
-        if (getYear() == getMinDate().get(Calendar.YEAR)) {
+    protected int getMinPositionInYear(int year) {
+        if (year == getMinDate().get(Calendar.YEAR)) {
             return getMinDate().get(Calendar.MONTH);
         }
         return 0;
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java b/chromium/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java
index d32266b0f44..360f9282883 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/input/SelectPopupDialog.java
@@ -8,6 +8,7 @@ import org.chromium.content.browser.ContentViewCore;
 
 import android.app.AlertDialog;
 import android.content.DialogInterface;
+import android.content.res.TypedArray;
 import android.util.SparseBooleanArray;
 import android.view.View;
 import android.view.ViewGroup;
@@ -17,6 +18,8 @@ import android.widget.ArrayAdapter;
 import android.widget.CheckedTextView;
 import android.widget.ListView;
 
+import org.chromium.content.R;
+
 /**
  * Handles the popup dialog for the <select> HTML tag support.
  */
@@ -24,6 +27,11 @@ public class SelectPopupDialog {
     // The currently showing popup dialog, null if none is showing.
     private static SelectPopupDialog sShownDialog;
 
+    private static final int[] SELECT_DIALOG_ATTRS = {
+        R.attr.select_dialog_multichoice,
+        R.attr.select_dialog_singlechoice
+    };
+
     // The dialog hosting the popup list view.
     private AlertDialog mListBoxPopup = null;
 
@@ -48,9 +56,7 @@ public class SelectPopupDialog {
         private boolean mAreAllItemsEnabled;
 
         public SelectPopupArrayAdapter(String[] labels, int[] enabled, boolean multiple) {
-            super(mContentViewCore.getContext(), multiple ?
-                  android.R.layout.select_dialog_multichoice :
-                  android.R.layout.select_dialog_singlechoice, labels);
+            super(mContentViewCore.getContext(), getSelectDialogLayout(multiple), labels);
             mItemEnabled = enabled;
             mAreAllItemsEnabled = true;
             for (int item : mItemEnabled) {
@@ -99,11 +105,21 @@ public class SelectPopupDialog {
         }
     }
 
+    private int getSelectDialogLayout(boolean isMultiChoice) {
+        int resource_id;
+        TypedArray styledAttributes = mContentViewCore.getContext().obtainStyledAttributes(
+                R.style.SelectPopupDialog, SELECT_DIALOG_ATTRS);
+        resource_id = styledAttributes.getResourceId(isMultiChoice ? 0 : 1, 0);
+        styledAttributes.recycle();
+        return resource_id;
+    }
+
     private SelectPopupDialog(ContentViewCore contentViewCore, String[] labels, int[] enabled,
             boolean multiple, int[] selected) {
         mContentViewCore = contentViewCore;
 
         final ListView listView = new ListView(mContentViewCore.getContext());
+        listView.setCacheColorHint(0);
         AlertDialog.Builder b = new AlertDialog.Builder(mContentViewCore.getContext())
                 .setView(listView)
                 .setCancelable(true)
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/input/TwoFieldDatePicker.java b/chromium/content/public/android/java/src/org/chromium/content/browser/input/TwoFieldDatePicker.java
index 4eaa0b787cb..c6dfd616c38 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/input/TwoFieldDatePicker.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/input/TwoFieldDatePicker.java
@@ -67,8 +67,10 @@ public abstract class TwoFieldDatePicker extends FrameLayout {
                     positionInYear = newVal;
                     if (oldVal == picker.getMaxValue() && newVal == picker.getMinValue()) {
                         year += 1;
+                        positionInYear = getMinPositionInYear(year);
                     } else if (oldVal == picker.getMinValue() && newVal == picker.getMaxValue()) {
                         year -=1;
+                        positionInYear = getMaxPositionInYear(year);
                     }
                 } else if (picker == mYearSpinner) {
                     year = newVal;
@@ -188,9 +190,9 @@ public abstract class TwoFieldDatePicker extends FrameLayout {
 
     protected abstract int getMinYear();
 
-    protected abstract int getMaxPositionInYear();
+    protected abstract int getMaxPositionInYear(int year);
 
-    protected abstract int getMinPositionInYear();
+    protected abstract int getMinPositionInYear(int year);
 
     protected Calendar getMaxDate() {
         return mMaxDate;
@@ -219,8 +221,8 @@ public abstract class TwoFieldDatePicker extends FrameLayout {
         mPositionInYearSpinner.setDisplayedValues(null);
 
         // set the spinner ranges respecting the min and max dates
-        mPositionInYearSpinner.setMinValue(getMinPositionInYear());
-        mPositionInYearSpinner.setMaxValue(getMaxPositionInYear());
+        mPositionInYearSpinner.setMinValue(getMinPositionInYear(getYear()));
+        mPositionInYearSpinner.setMaxValue(getMaxPositionInYear(getYear()));
         mPositionInYearSpinner.setWrapSelectorWheel(
                 !mCurrentDate.equals(mMinDate) && !mCurrentDate.equals(mMaxDate));
 
diff --git a/chromium/content/public/android/java/src/org/chromium/content/browser/input/WeekPicker.java b/chromium/content/public/android/java/src/org/chromium/content/browser/input/WeekPicker.java
index 117793b1978..efca4763a29 100644
--- a/chromium/content/public/android/java/src/org/chromium/content/browser/input/WeekPicker.java
+++ b/chromium/content/public/android/java/src/org/chromium/content/browser/input/WeekPicker.java
@@ -76,9 +76,9 @@ public class WeekPicker extends TwoFieldDatePicker {
         }
     }
 
-    private int getNumberOfWeeks() {
+    private int getNumberOfWeeks(int year) {
         // Create a date in the middle of the year, where the week year matches the year.
-        Calendar date = createDateFromWeek(getYear(), 20);
+        Calendar date = createDateFromWeek(year, 20);
         return date.getActualMaximum(Calendar.WEEK_OF_YEAR);
     }
 
@@ -113,16 +113,16 @@ public class WeekPicker extends TwoFieldDatePicker {
     }
 
     @Override
-    protected int getMaxPositionInYear() {
-        if (getYear() == getISOWeekYearForDate(getMaxDate())) {
+    protected int getMaxPositionInYear(int year) {
+        if (year == getISOWeekYearForDate(getMaxDate())) {
             return getWeekForDate(getMaxDate());
         }
-        return getNumberOfWeeks();
+        return getNumberOfWeeks(year);
     }
 
     @Override
-    protected int getMinPositionInYear() {
-        if (getYear() == getISOWeekYearForDate(getMinDate())) {
+    protected int getMinPositionInYear(int year) {
+        if (year == getISOWeekYearForDate(getMinDate())) {
             return getWeekForDate(getMinDate());
         }
         return 1;
diff --git a/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewGestureHandlerTest.java b/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewGestureHandlerTest.java
index 2647b3a2f59..ce63defa32c 100644
--- a/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewGestureHandlerTest.java
+++ b/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewGestureHandlerTest.java
@@ -639,6 +639,55 @@ public class ContentViewGestureHandlerTest extends InstrumentationTestCase {
     }
 
     /**
+     * Verify that a show pressed state gesture followed by a long press followed by
+     * the focus
+     * loss in the window due to context menu cancels show pressed.
+     * @throws Exception
+     */
+    @SmallTest
+    @Feature({"Gestures"})
+    public void testShowPressCancelOnWindowFocusLost() throws Exception {
+        final long time = SystemClock.uptimeMillis();
+        GestureRecordingMotionEventDelegate mockDelegate =
+                new GestureRecordingMotionEventDelegate();
+        mGestureHandler = new ContentViewGestureHandler(
+                getInstrumentation().getTargetContext(), mockDelegate,
+                new MockZoomManager(getInstrumentation().getTargetContext(), null),
+                ContentViewCore.INPUT_EVENTS_DELIVERED_AT_VSYNC);
+        mLongPressDetector = new LongPressDetector(
+                getInstrumentation().getTargetContext(), mGestureHandler);
+        mGestureHandler.setTestDependencies(mLongPressDetector, null, null);
+
+        MotionEvent event = motionEvent(MotionEvent.ACTION_DOWN, time, time);
+        mGestureHandler.onTouchEvent(event);
+
+        mGestureHandler.sendShowPressedStateGestureForTesting();
+        assertEquals("A show pressed state event should have been sent",
+                ContentViewGestureHandler.GESTURE_SHOW_PRESSED_STATE,
+                        mockDelegate.mMostRecentGestureEvent.mType);
+        assertEquals("Only showPressedState should have been sent",
+                1, mockDelegate.mGestureTypeList.size());
+
+        mLongPressDetector.startLongPressTimerIfNeeded(event);
+        mLongPressDetector.sendLongPressGestureForTest();
+
+        assertEquals("Only should have sent only LONG_PRESS event",
+                2, mockDelegate.mGestureTypeList.size());
+        assertEquals("Should have a long press event next",
+                ContentViewGestureHandler.GESTURE_LONG_PRESS,
+                mockDelegate.mGestureTypeList.get(1).intValue());
+
+        // The long press triggers window focus loss by opening a context menu
+        mGestureHandler.onWindowFocusLost();
+
+        assertEquals("Only should have sent only GESTURE_SHOW_PRESS_CANCEL event",
+                3, mockDelegate.mGestureTypeList.size());
+        assertEquals("Should have a long press event next",
+                ContentViewGestureHandler.GESTURE_SHOW_PRESS_CANCEL,
+                mockDelegate.mGestureTypeList.get(2).intValue());
+    }
+
+    /**
      * Verify that a recent show pressed state gesture is canceled when scrolling begins.
      * @throws Exception
      */
@@ -890,6 +939,73 @@ public class ContentViewGestureHandlerTest extends InstrumentationTestCase {
     }
 
     /**
+     * Verify that double tap drag zoom feature is not invoked
+     * when it is disabled..
+     * @throws Exception
+     */
+    @SmallTest
+    @Feature({"Gestures"})
+    public void testDoubleTapDragZoomNothingWhenDisabled() throws Exception {
+        final long downTime1 = SystemClock.uptimeMillis();
+        final long downTime2 = downTime1 + 100;
+
+        GestureRecordingMotionEventDelegate mockDelegate =
+                new GestureRecordingMotionEventDelegate();
+        mGestureHandler = new ContentViewGestureHandler(
+                getInstrumentation().getTargetContext(), mockDelegate,
+                new MockZoomManager(getInstrumentation().getTargetContext(), null),
+                ContentViewCore.INPUT_EVENTS_DELIVERED_AT_VSYNC);
+
+        mGestureHandler.updateDoubleTapDragSupport(false);
+
+        MotionEvent event = motionEvent(MotionEvent.ACTION_DOWN, downTime1, downTime1);
+        assertTrue(mGestureHandler.onTouchEvent(event));
+
+        event = MotionEvent.obtain(
+                downTime1, downTime1 + 5, MotionEvent.ACTION_UP,
+                FAKE_COORD_X, FAKE_COORD_Y, 0);
+        mGestureHandler.onTouchEvent(event);
+
+        event = MotionEvent.obtain(
+                downTime2, downTime2, MotionEvent.ACTION_DOWN,
+                FAKE_COORD_X, FAKE_COORD_Y, 0);
+        assertTrue(mGestureHandler.onTouchEvent(event));
+
+        event = MotionEvent.obtain(
+                downTime2, downTime2 + 5, MotionEvent.ACTION_MOVE,
+                FAKE_COORD_X, FAKE_COORD_Y + 100, 0);
+        // As double tap and drag to zoom is disabled, we won't handle
+        // the move event.
+        assertFalse(mGestureHandler.onTouchEvent(event));
+
+        assertFalse("No GESTURE_SCROLL_START should have been sent",
+                mockDelegate.mGestureTypeList.contains(
+                        ContentViewGestureHandler.GESTURE_SCROLL_START));
+        assertTrue("No GESTURE_PINCH_BEGIN should have been sent",
+                ContentViewGestureHandler.GESTURE_PINCH_BEGIN !=
+                mockDelegate.mMostRecentGestureEvent.mType);
+
+        event = MotionEvent.obtain(
+                downTime2, downTime2 + 10, MotionEvent.ACTION_MOVE,
+                FAKE_COORD_X, FAKE_COORD_Y + 200, 0);
+        assertFalse(mGestureHandler.onTouchEvent(event));
+        assertFalse("No GESTURE_SCROLL_BY should have been sent",
+                mockDelegate.mGestureTypeList.contains(
+                        ContentViewGestureHandler.GESTURE_SCROLL_BY));
+        assertTrue("No GESTURE_PINCH_BY should have been sent",
+                ContentViewGestureHandler.GESTURE_PINCH_BY !=
+                mockDelegate.mMostRecentGestureEvent.mType);
+
+        event = MotionEvent.obtain(
+                downTime2, downTime2 + 15, MotionEvent.ACTION_UP,
+                FAKE_COORD_X, FAKE_COORD_Y + 200, 0);
+        assertFalse(mGestureHandler.onTouchEvent(event));
+        assertFalse("No GESTURE_PINCH_END should have been sent",
+                mockDelegate.mGestureTypeList.contains(
+                        ContentViewGestureHandler.GESTURE_PINCH_END));
+    }
+
+    /**
      * Mock MotionEventDelegate that remembers the most recent gesture event.
      */
     static class GestureRecordingMotionEventDelegate implements MotionEventDelegate {
diff --git a/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewScrollingTest.java b/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewScrollingTest.java
index 998f036d58a..d880a96b86b 100644
--- a/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewScrollingTest.java
+++ b/chromium/content/public/android/javatests/src/org/chromium/content/browser/ContentViewScrollingTest.java
@@ -26,6 +26,15 @@ public class ContentViewScrollingTest extends ContentShellTestBase {
             "<body>Lorem ipsum dolor sit amet, consectetur adipiscing elit.</body>" +
             "</html>");
 
+    private void assertWaitForPageScaleFactor(final float scale) throws InterruptedException {
+        assertTrue(CriteriaHelper.pollForCriteria(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                return getContentViewCore().getScale() == scale;
+            }
+        }));
+    }
+
     private void assertWaitForScroll(final boolean hugLeft, final boolean hugTop)
             throws InterruptedException {
         assertTrue(CriteriaHelper.pollForCriteria(new Criteria() {
@@ -70,7 +79,7 @@ public class ContentViewScrollingTest extends ContentShellTestBase {
 
         launchContentShellWithUrl(LARGE_PAGE);
         assertTrue("Page failed to load", waitForActiveShellToBeDoneLoading());
-        assertWaitForPageScaleFactorMatch(1.0f);
+        assertWaitForPageScaleFactor(1.0f);
 
         assertEquals(0, getContentViewCore().getNativeScrollXForTest());
         assertEquals(0, getContentViewCore().getNativeScrollYForTest());
diff --git a/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java b/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
index e4c1a5f727f..a12007f3cc8 100644
--- a/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
+++ b/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
@@ -61,7 +61,7 @@ public class ImeTest extends ContentShellTestBase {
         mContentView = getActivity().getActiveContentView();
         mCallbackContainer = new TestCallbackHelperContainer(mContentView);
         // TODO(aurimas) remove this wait once crbug.com/179511 is fixed.
-        assertWaitForPageScaleFactorMatch(1);
+        assertWaitForPageScaleFactor(1);
         DOMUtils.clickNode(this, mContentView, mCallbackContainer, "input_text");
         assertWaitForKeyboardStatus(true);
 
@@ -286,6 +286,17 @@ public class ImeTest extends ContentShellTestBase {
                 });
     }
 
+
+
+    private void assertWaitForPageScaleFactor(final float scale) throws InterruptedException {
+        assertTrue(CriteriaHelper.pollForCriteria(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                return getContentViewCore().getScale() == scale;
+            }
+        }));
+    }
+
     private void assertWaitForKeyboardStatus(final boolean show) throws InterruptedException {
         assertTrue(CriteriaHelper.pollForCriteria(new Criteria() {
             @Override
diff --git a/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/InsertionHandleTest.java b/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/InsertionHandleTest.java
index 91e61242d71..d2697b711f1 100644
--- a/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/InsertionHandleTest.java
+++ b/chromium/content/public/android/javatests/src/org/chromium/content/browser/input/InsertionHandleTest.java
@@ -87,12 +87,8 @@ public class InsertionHandleTest extends ContentShellTestBase {
     }
 
 
-    /**
-     * @MediumTest
-     * @Feature({"TextSelection", "TextInput", "Main"})
-     * http://crbug.com/169648
-     */
-    @DisabledTest
+    @MediumTest
+    @Feature({"TextSelection", "TextInput", "Main"})
     public void testKeyEventHidesHandle() throws Throwable {
         launchWithUrl(TEXTAREA_DATA_URL);
         clickNodeToShowInsertionHandle(TEXTAREA_ID);
diff --git a/chromium/content/public/browser/android/synchronous_compositor_client.h b/chromium/content/public/browser/android/synchronous_compositor_client.h
index dbd6d33bdf4..bfd647b931d 100644
--- a/chromium/content/public/browser/android/synchronous_compositor_client.h
+++ b/chromium/content/public/browser/android/synchronous_compositor_client.h
@@ -27,7 +27,8 @@ class SynchronousCompositorClient {
   // See LayerScrollOffsetDelegate for details.
   virtual void SetTotalRootLayerScrollOffset(gfx::Vector2dF new_value) = 0;
   virtual gfx::Vector2dF GetTotalRootLayerScrollOffset() = 0;
-  virtual void DidOverscroll(gfx::Vector2dF latest_overscroll_delta,
+  virtual void DidOverscroll(gfx::Vector2dF accumulated_overscroll,
+                             gfx::Vector2dF latest_overscroll_delta,
                              gfx::Vector2dF current_fling_velocity) = 0;
 
   // When true, should periodically call
diff --git a/chromium/content/public/browser/browser_plugin_guest_delegate.h b/chromium/content/public/browser/browser_plugin_guest_delegate.h
index 73b477040cd..11facb9b5ed 100644
--- a/chromium/content/public/browser/browser_plugin_guest_delegate.h
+++ b/chromium/content/public/browser/browser_plugin_guest_delegate.h
@@ -11,7 +11,6 @@
 #include "base/values.h"
 #include "content/common/content_export.h"
 #include "content/public/common/browser_plugin_permission_type.h"
-#include "ui/gfx/size.h"
 
 namespace content {
 
@@ -58,10 +57,6 @@ class CONTENT_EXPORT BrowserPluginGuestDelegate {
       BrowserPluginPermissionType permission_type,
       const base::DictionaryValue& request_info,
       const PermissionResponseCallback& callback);
-
-  // Notifies that the content size of the guest has changed in autosize mode.
-  virtual void SizeChanged(const gfx::Size& old_size,
-                           const gfx::Size& new_size) {}
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index c2bf137b077..4337c2da772 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -208,6 +208,7 @@ WebKit::WebNotificationPresenter::Permission
 
 bool ContentBrowserClient::CanCreateWindow(
     const GURL& opener_url,
+    const GURL& opener_top_level_frame_url,
     const GURL& source_origin,
     WindowContainerType container_type,
     const GURL& target_url,
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index 21687691706..56c01775e65 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -451,6 +451,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // the window that is created should be scriptable/in the same process.
   // This is called on the IO thread.
   virtual bool CanCreateWindow(const GURL& opener_url,
+                               const GURL& opener_top_level_frame_url,
                                const GURL& source_origin,
                                WindowContainerType container_type,
                                const GURL& target_url,
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index 47e30b2acba..964206d31e1 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -127,8 +127,11 @@ bool WebContentsDelegate::ShouldCreateWebContents(
     WindowContainerType window_container_type,
     const string16& frame_name,
     const GURL& target_url,
-    const std::string& partition_id,
-    SessionStorageNamespace* session_storage_namespace) {
+    const Referrer& referrer,
+    WindowOpenDisposition disposition,
+    const WebKit::WebWindowFeatures& features,
+    bool user_gesture,
+    bool opener_suppressed) {
   return true;
 }
 
@@ -146,6 +149,13 @@ content::ColorChooser* WebContentsDelegate::OpenColorChooser(
   return NULL;
 }
 
+void WebContentsDelegate::RequestMediaAccessPermission(
+    WebContents* web_contents,
+    const MediaStreamRequest& request,
+    const MediaResponseCallback& callback) {
+  callback.Run(MediaStreamDevices(), scoped_ptr<MediaStreamUI>());
+}
+
 bool WebContentsDelegate::RequestPpapiBrokerPermission(
     WebContents* web_contents,
     const GURL& url,
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index 69ac871c85e..aa1bb4e3472 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -37,7 +37,6 @@ class DownloadItem;
 class JavaScriptDialogManager;
 class PageState;
 class RenderViewHost;
-class SessionStorageNamespace;
 class WebContents;
 class WebContentsImpl;
 struct ContextMenuParams;
@@ -301,8 +300,11 @@ class CONTENT_EXPORT WebContentsDelegate {
       WindowContainerType window_container_type,
       const string16& frame_name,
       const GURL& target_url,
-      const std::string& partition_id,
-      SessionStorageNamespace* session_storage_namespace);
+      const Referrer& referrer,
+      WindowOpenDisposition disposition,
+      const WebKit::WebWindowFeatures& features,
+      bool user_gesture,
+      bool opener_suppressed);
 
   // Notifies the delegate about the creation of a new WebContents. This
   // typically happens when popups are created.
@@ -422,7 +424,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual void RequestMediaAccessPermission(
       WebContents* web_contents,
       const MediaStreamRequest& request,
-      const MediaResponseCallback& callback) {}
+      const MediaResponseCallback& callback);
 
   // Requests permission to access the PPAPI broker. The delegate should return
   // true and call the passed in |callback| with the result, or return false
diff --git a/chromium/content/public/common/common_param_traits_macros.h b/chromium/content/public/common/common_param_traits_macros.h
index a77c4c4ec70..9b5226e2116 100644
--- a/chromium/content/public/common/common_param_traits_macros.h
+++ b/chromium/content/public/common/common_param_traits_macros.h
@@ -201,7 +201,11 @@ IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(user_gesture_required_for_media_playback)
   IPC_STRUCT_TRAITS_MEMBER(default_video_poster_url)
   IPC_STRUCT_TRAITS_MEMBER(support_deprecated_target_density_dpi)
+  IPC_STRUCT_TRAITS_MEMBER(use_legacy_background_size_shorthand_behavior)
+  IPC_STRUCT_TRAITS_MEMBER(wide_viewport_quirk)
   IPC_STRUCT_TRAITS_MEMBER(use_wide_viewport)
+  IPC_STRUCT_TRAITS_MEMBER(viewport_meta_layout_size_quirk)
+  IPC_STRUCT_TRAITS_MEMBER(viewport_meta_zero_values_quirk)
 #endif
 IPC_STRUCT_TRAITS_END()
 
diff --git a/chromium/content/public/common/content_switches.cc b/chromium/content/public/common/content_switches.cc
index 63e94dfdc90..5169ba47de4 100644
--- a/chromium/content/public/common/content_switches.cc
+++ b/chromium/content/public/common/content_switches.cc
@@ -531,6 +531,11 @@ const char kEnableWebMIDI[]                 = "enable-web-midi";
 // Enable WebRTC to open TCP server sockets.
 const char kEnableWebRtcTcpServerSocket[]   = "enable-webrtc-tcp-server-socket";
 
+// Enables experimental features for the geolocation API.
+// Current features:
+// - CoreLocation support for Mac OS X 10.6
+const char kExperimentalLocationFeatures[]  = "experimental-location-features";
+
 // Load NPAPI plugins from the specified directory.
 const char kExtraPluginDir[]                = "extra-plugin-dir";
 
@@ -777,10 +782,6 @@ const char kTestingFixedHttpsPort[]         = "testing-fixed-https-port";
 // Runs the security test for the renderer sandbox.
 const char kTestSandbox[]                   = "test-sandbox";
 
-// Enables not sending touch events to renderer while scrolling.
-const char kNoTouchToRendererWhileScrolling[] =
-    "no-touch-to-renderer-while-scrolling";
-
 // Causes TRACE_EVENT flags to be recorded from startup. Optionally, can
 // specify the specific trace categories to include (e.g.
 // --trace-startup=base,net) otherwise, all events are recorded. Setting this
@@ -872,9 +873,6 @@ const char kEnableWebRtcAecRecordings[]     = "enable-webrtc-aec-recordings";
 // Enables HW decode acceleration for WebRTC.
 const char kEnableWebRtcHWDecoding[]        = "enable-webrtc-hw-decoding";
 
-// Enables HW encode acceleration for WebRTC.
-const char kEnableWebRtcHWEncoding[] = "enable-webrtc-hw-encoding";
-
 #endif
 
 #if defined(OS_ANDROID)
diff --git a/chromium/content/public/common/content_switches.h b/chromium/content/public/common/content_switches.h
index c468139f903..949400af1b9 100644
--- a/chromium/content/public/common/content_switches.h
+++ b/chromium/content/public/common/content_switches.h
@@ -159,6 +159,7 @@ extern const char kEnableWebAnimationsSVG[];
 CONTENT_EXPORT extern const char kEnableWebGLDraftExtensions[];
 extern const char kEnableWebMIDI[];
 extern const char kEnableWebRtcTcpServerSocket[];
+CONTENT_EXPORT extern const char kExperimentalLocationFeatures[];
 CONTENT_EXPORT extern const char kExtraPluginDir[];
 CONTENT_EXPORT extern const char kForceCompositingMode[];
 extern const char kForceFieldTrials[];
@@ -223,7 +224,6 @@ extern const char kTapDownDeferralTimeMs[];
 CONTENT_EXPORT extern const char kTestingFixedHttpPort[];
 CONTENT_EXPORT extern const char kTestingFixedHttpsPort[];
 CONTENT_EXPORT extern const char kTestSandbox[];
-CONTENT_EXPORT extern const char kNoTouchToRendererWhileScrolling[];
 extern const char kTraceStartup[];
 extern const char kTraceStartupDuration[];
 extern const char kTraceStartupFile[];
@@ -248,7 +248,6 @@ CONTENT_EXPORT extern const char kDisableDeviceEnumeration[];
 CONTENT_EXPORT extern const char kEnableSCTPDataChannels[];
 extern const char kEnableWebRtcAecRecordings[];
 extern const char kEnableWebRtcHWDecoding[];
-extern const char kEnableWebRtcHWEncoding[];
 #endif
 
 #if defined(OS_ANDROID)
diff --git a/chromium/content/public/common/renderer_preferences.h b/chromium/content/public/common/renderer_preferences.h
index bc5447a3e4f..0f141d21cc4 100644
--- a/chromium/content/public/common/renderer_preferences.h
+++ b/chromium/content/public/common/renderer_preferences.h
@@ -40,8 +40,9 @@ enum RendererPreferencesSubpixelRenderingEnum {
 enum TapMultipleTargetsStrategy {
   TAP_MULTIPLE_TARGETS_STRATEGY_ZOOM = 0,
   TAP_MULTIPLE_TARGETS_STRATEGY_POPUP,
+  TAP_MULTIPLE_TARGETS_STRATEGY_NONE,
 
-  TAP_MULTIPLE_TARGETS_STRATEGY_MAX = TAP_MULTIPLE_TARGETS_STRATEGY_POPUP,
+  TAP_MULTIPLE_TARGETS_STRATEGY_MAX = TAP_MULTIPLE_TARGETS_STRATEGY_NONE,
 };
 
 struct CONTENT_EXPORT RendererPreferences {