Imported WebKit commit 3db4eb1820ac8fb03065d7ea73a4d9db1e8fea1a (http://svn.webkit.org/repository/webkit/trunk@110422)

This includes build fixes for the latest qtbase/qtdeclarative as well as the final QML2 API.

52 files changed, 702 insertions, 343 deletions

diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 3f0875b53..ac6fa0447 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -53,7 +53,7 @@
 #include "IconURL.h"
 #include "MediaPlayer.h"
 #include "MediaStreamSource.h"
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "PageVisibilityState.h"
 #include "PasteboardPrivate.h"
 #include "PlatformCursor.h"
@@ -394,9 +394,9 @@ COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::FormatASCII, VideoFrameChromium::ASC
 #endif
 
 #if ENABLE(NOTIFICATIONS)
-COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionAllowed, NotificationPresenter::PermissionAllowed);
-COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionNotAllowed, NotificationPresenter::PermissionNotAllowed);
-COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionDenied, NotificationPresenter::PermissionDenied);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionAllowed, NotificationClient::PermissionAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionNotAllowed, NotificationClient::PermissionNotAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionDenied, NotificationClient::PermissionDenied);
 #endif
 
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::Horizontal, HorizontalScrollbar);
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
index c314411b4..0c3a0cf55 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -79,6 +79,7 @@ void HTTPRequestHeaderValidator::visitHeader(const WebString& name, const WebStr
     m_isSafe = m_isSafe && isValidHTTPToken(name) && XMLHttpRequest::isAllowedHTTPHeader(name) && isValidHTTPHeaderValue(value);
 }
 
+// FIXME: Remove this and use WebCore code that does the same thing.
 class HTTPResponseHeaderValidator : public WebHTTPHeaderVisitor {
     WTF_MAKE_NONCOPYABLE(HTTPResponseHeaderValidator);
 public:
@@ -97,7 +98,7 @@ void HTTPResponseHeaderValidator::visitHeader(const WebString& name, const WebSt
 {
     String headerName(name);
     if (m_usingAccessControl) {
-        if (equalIgnoringCase(headerName, "access-control-expose-header"))
+        if (equalIgnoringCase(headerName, "access-control-expose-headers"))
             parseAccessControlExposeHeadersAllowList(value, m_exposedHeaders);
         else if (!isOnAccessControlResponseHeaderWhitelist(headerName))
             m_blockedHeaders.add(name);
@@ -112,7 +113,7 @@ const HTTPHeaderSet& HTTPResponseHeaderValidator::blockedHeaders()
         m_exposedHeaders.remove("set-cookie");
         m_exposedHeaders.remove("set-cookie2");
         // Block Access-Control-Expose-Header itself. It could be exposed later.
-        m_blockedHeaders.add("access-control-expose-header");
+        m_blockedHeaders.add("access-control-expose-headers");
         HTTPHeaderSet::const_iterator end = m_exposedHeaders.end();
         for (HTTPHeaderSet::const_iterator it = m_exposedHeaders.begin(); it != end; ++it)
             m_blockedHeaders.remove(*it);
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index 1f93cf93e..8d8a3fedc 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -34,7 +34,10 @@
 
 #include "AsyncFileSystemCallbacks.h"
 #include "AsyncFileWriterChromium.h"
+#include "BlobURL.h"
+#include "FileMetadata.h"
 #include "SecurityOrigin.h"
+#include "ThreadableBlobRegistry.h"
 #include "WebFileInfo.h"
 #include "WebFileSystemCallbacksImpl.h"
 #include "WebFileWriter.h"
@@ -46,11 +49,51 @@
 
 namespace WebCore {
 
+namespace {
+
 // ChromeOS-specific filesystem type.
 const AsyncFileSystem::Type externalType = static_cast<AsyncFileSystem::Type>(WebKit::WebFileSystem::TypeExternal);
 const char externalPathPrefix[] = "external";
 const size_t externalPathPrefixLength = sizeof(externalPathPrefix) - 1;
 
+// Specialized callback class for createSnapshotFileAndReadMetadata.
+class SnapshotFileCallbacks : public AsyncFileSystemCallbacks {
+public:
+    static PassOwnPtr<SnapshotFileCallbacks> create(const KURL& internalBlobURL, PassOwnPtr<WebCore::AsyncFileSystemCallbacks> callbacks)
+    {
+        return adoptPtr(new SnapshotFileCallbacks(internalBlobURL, callbacks));
+    }
+
+    virtual void didReadMetadata(const FileMetadata& metadata)
+    {
+        ASSERT(m_callbacks);
+
+        // This will create a new File object using the metadata.
+        m_callbacks->didReadMetadata(metadata);
+
+        // Now that we've registered the snapshot file, we can unregister our internalBlobURL which has played a placeholder for the file during the IPC.
+        ThreadableBlobRegistry::unregisterBlobURL(m_internalBlobURL);
+    }
+
+    virtual void didFail(int error)
+    {
+        ASSERT(m_callbacks);
+        m_callbacks->didFail(error);
+    }
+
+private:
+    SnapshotFileCallbacks(const KURL& internalBlobURL, PassOwnPtr<WebCore::AsyncFileSystemCallbacks> callbacks)
+        : m_internalBlobURL(internalBlobURL)
+        , m_callbacks(callbacks)
+    {
+    }
+
+    KURL m_internalBlobURL;
+    OwnPtr<WebCore::AsyncFileSystemCallbacks> m_callbacks;
+};
+
+} // namespace
+
 // static
 bool AsyncFileSystem::isAvailable()
 {
@@ -254,6 +297,15 @@ void AsyncFileSystemChromium::createWriter(AsyncFileWriterClient* client, const
     m_webFileSystem->readMetadata(pathAsURL, new FileWriterHelperCallbacks(client, pathAsURL, m_webFileSystem, callbacks));
 }
 
+void AsyncFileSystemChromium::createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    KURL pathAsURL = virtualPathToFileSystemURL(path);
+    KURL internalBlobURL = BlobURL::createInternalURL();
+
+    // This will create a snapshot file and register the file to a blob using the given internalBlobURL.
+    m_webFileSystem->createSnapshotFileAndReadMetadata(internalBlobURL, pathAsURL, new WebKit::WebFileSystemCallbacksImpl(createSnapshotFileCallback(internalBlobURL, callbacks)));
+}
+
 KURL AsyncFileSystemChromium::virtualPathToFileSystemURL(const String& virtualPath) const
 {
     ASSERT(!m_filesystemRootURL.isEmpty());
@@ -263,6 +315,11 @@ KURL AsyncFileSystemChromium::virtualPathToFileSystemURL(const String& virtualPa
     return url;
 }
 
+PassOwnPtr<AsyncFileSystemCallbacks> AsyncFileSystemChromium::createSnapshotFileCallback(const KURL& internalBlobURL, PassOwnPtr<AsyncFileSystemCallbacks> callbacks) const
+{
+    return SnapshotFileCallbacks::create(internalBlobURL, callbacks);
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.h b/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
index a8cbca276..8255d8e72 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
@@ -66,9 +66,13 @@ public:
     virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 protected:
     AsyncFileSystemChromium(AsyncFileSystem::Type, const KURL& rootURL);
+
+    PassOwnPtr<AsyncFileSystemCallbacks> createSnapshotFileCallback(const KURL& internalBlobURL, PassOwnPtr<AsyncFileSystemCallbacks>) const;
+
     WebKit::WebFileSystem* m_webFileSystem;
 
     // Converts a given absolute virtual path to a full origin-qualified FileSystem URL.
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 45a813859..ad35382b9 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -136,6 +136,7 @@ ChromeClientImpl::ChromeClientImpl(WebViewImpl* webView)
     , m_scrollbarsVisible(true)
     , m_menubarVisible(true)
     , m_resizable(true)
+    , m_nextNewWindowNavigationPolicy(WebNavigationPolicyIgnore)
 {
 }
 
@@ -238,13 +239,23 @@ Page* ChromeClientImpl::createWindow(
     if (!m_webView->client())
         return 0;
 
+    // FrameLoaderClientImpl may have given us a policy to use for the next new
+    // window navigation. If not, determine the policy using the same logic as
+    // show().
+    WebNavigationPolicy policy;
+    if (m_nextNewWindowNavigationPolicy != WebNavigationPolicyIgnore) {
+        policy = m_nextNewWindowNavigationPolicy;
+        m_nextNewWindowNavigationPolicy = WebNavigationPolicyIgnore;
+    } else
+        policy = getNavigationPolicy();
+
     WrappedResourceRequest request;
     if (!r.resourceRequest().isEmpty())
         request.bind(r.resourceRequest());
     else if (!action.resourceRequest().isEmpty())
         request.bind(action.resourceRequest());
     WebViewImpl* newView = static_cast<WebViewImpl*>(
-        m_webView->client()->createView(WebFrameImpl::fromFrame(frame), request, features, r.frameName()));
+        m_webView->client()->createView(WebFrameImpl::fromFrame(frame), request, features, r.frameName(), policy));
     if (!newView)
         return 0;
 
@@ -287,11 +298,8 @@ static inline bool currentEventShouldCauseBackgroundTab(const WebInputEvent* inp
     return policy == WebNavigationPolicyNewBackgroundTab;
 }
 
-void ChromeClientImpl::show()
+WebNavigationPolicy ChromeClientImpl::getNavigationPolicy()
 {
-    if (!m_webView->client())
-        return;
-
     // If our default configuration was modified by a script or wasn't
     // created by a user gesture, then show as a popup. Else, let this
     // new window be opened as a toplevel window.
@@ -306,8 +314,15 @@ void ChromeClientImpl::show()
         policy = WebNavigationPolicyNewPopup;
     if (currentEventShouldCauseBackgroundTab(WebViewImpl::currentInputEvent()))
         policy = WebNavigationPolicyNewBackgroundTab;
+    return policy;
+}
+ 
+void ChromeClientImpl::show()
+{
+    if (!m_webView->client())
+        return;
 
-    m_webView->client()->show(policy);
+    m_webView->client()->show(getNavigationPolicy());
 }
 
 bool ChromeClientImpl::canRunModal()
@@ -603,7 +618,7 @@ void ChromeClientImpl::mouseDidMoveOverElement(
             Widget* widget = toRenderWidget(object)->widget();
             if (widget && widget->isPluginContainer()) {
                 WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
-                url = plugin->plugin()->linkAtPosition(result.point());
+                url = plugin->plugin()->linkAtPosition(result.roundedPoint());
             }
         }
     }
@@ -802,6 +817,11 @@ void ChromeClientImpl::setCursorForPlugin(const WebCursorInfo& cursor)
     setCursor(cursor);
 }
 
+void ChromeClientImpl::setNewWindowNavigationPolicy(WebNavigationPolicy policy)
+{
+    m_nextNewWindowNavigationPolicy = policy;
+}
+
 void ChromeClientImpl::formStateDidChange(const Node* node)
 {
     // The current history item is not updated yet.  That happens lazily when
@@ -890,7 +910,7 @@ void ChromeClientImpl::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* grap
 
 void ChromeClientImpl::scheduleCompositingLayerSync()
 {
-    m_webView->setRootLayerNeedsDisplay();
+    m_webView->scheduleCompositingLayerSync();
 }
 
 ChromeClient::CompositingTriggerFlags ChromeClientImpl::allowedCompositingTriggers() const
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 23e02ff3d..c34945404 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -35,6 +35,7 @@
 #include "ChromeClientChromium.h"
 #include "PopupMenu.h"
 #include "SearchPopupMenu.h"
+#include "WebNavigationPolicy.h"
 
 namespace WebCore {
 class AccessibilityObject;
@@ -189,6 +190,7 @@ public:
 
     // ChromeClientImpl:
     void setCursorForPlugin(const WebCursorInfo&);
+    void setNewWindowNavigationPolicy(WebNavigationPolicy);
 
     virtual bool selectItemWritingDirectionIsNatural();
     virtual bool selectItemAlignmentFollowsMenuWritingDirection();
@@ -196,10 +198,6 @@ public:
     virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::PopupMenuClient*) const;
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const;
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
-
     virtual bool shouldRunModalDialogDuringPageDismissal(const DialogType&, const String& dialogMessage, WebCore::FrameLoader::PageDismissalType) const;
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const;
@@ -213,6 +211,7 @@ public:
 #endif
 
 private:
+    WebNavigationPolicy getNavigationPolicy();
     void getPopupMenuInfo(WebCore::PopupContainer*, WebPopupMenuInfo*);
     void setCursor(const WebCursorInfo&);
 
@@ -222,6 +221,9 @@ private:
     bool m_scrollbarsVisible;
     bool m_menubarVisible;
     bool m_resizable;
+
+    // The policy for how the next webview to be created will be shown.
+    WebNavigationPolicy m_nextNewWindowNavigationPolicy;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
index 790a9c52b..4712eff7d 100644
--- a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -158,7 +158,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
     Frame* selectedFrame = r.innerNonSharedNode()->document()->frame();
 
     WebContextMenuData data;
-    data.mousePosition = selectedFrame->view()->contentsToWindow(r.point());
+    data.mousePosition = selectedFrame->view()->contentsToWindow(r.roundedPoint());
 
     // Compute edit flags.
     data.editFlags = WebContextMenuData::CanDoNone;
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index a85ccbd2e..2dada5c50 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -145,10 +145,10 @@ void FrameLoaderClientImpl::documentElementAvailable()
 }
 
 #if USE(V8)
-void FrameLoaderClientImpl::didCreateScriptContext(v8::Handle<v8::Context> context, int worldId)
+void FrameLoaderClientImpl::didCreateScriptContext(v8::Handle<v8::Context> context, int extensionGroup, int worldId)
 {
     if (m_webFrame->client())
-        m_webFrame->client()->didCreateScriptContext(m_webFrame, context, worldId);
+        m_webFrame->client()->didCreateScriptContext(m_webFrame, context, extensionGroup, worldId);
 }
 
 void FrameLoaderClientImpl::willReleaseScriptContext(v8::Handle<v8::Context> context, int worldId)
@@ -612,7 +612,7 @@ void FrameLoaderClientImpl::dispatchWillPerformClientRedirect(
     // carry out such a navigation anyway, the best thing we can do for now to
     // not get confused is ignore this notification.
     if (m_expectedClientRedirectDest.isLocalFile()
-        && m_expectedClientRedirectSrc.protocolInHTTPFamily()) {
+        && m_expectedClientRedirectSrc.protocolIsInHTTPFamily()) {
         m_expectedClientRedirectSrc = KURL();
         m_expectedClientRedirectDest = KURL();
         return;
@@ -873,21 +873,27 @@ void FrameLoaderClientImpl::dispatchDidFirstVisuallyNonEmptyLayout()
 
 Frame* FrameLoaderClientImpl::dispatchCreatePage(const NavigationAction& action)
 {
-    struct WindowFeatures features;
-    Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
-        m_webFrame->frame(), FrameLoadRequest(m_webFrame->frame()->document()->securityOrigin()),
-        features, action);
-
     // Make sure that we have a valid disposition.  This should have been set in
     // the preceeding call to dispatchDecidePolicyForNewWindowAction.
     ASSERT(m_nextNavigationPolicy != WebNavigationPolicyIgnore);
     WebNavigationPolicy policy = m_nextNavigationPolicy;
     m_nextNavigationPolicy = WebNavigationPolicyIgnore;
 
+    // Store the disposition on the opener ChromeClientImpl so that we can pass
+    // it to WebViewClient::createView.
+    ChromeClientImpl* chromeClient = static_cast<ChromeClientImpl*>(m_webFrame->frame()->page()->chrome()->client());
+    chromeClient->setNewWindowNavigationPolicy(policy);
+
+    struct WindowFeatures features;
+    Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
+        m_webFrame->frame(), FrameLoadRequest(m_webFrame->frame()->document()->securityOrigin()),
+        features, action);
+
     // createWindow can return null (e.g., popup blocker denies the window).
     if (!newPage)
         return 0;
 
+    // Also give the disposition to the new window.
     WebViewImpl::fromPage(newPage)->setInitialNavigationPolicy(policy);
     return newPage->mainFrame();
 }
@@ -949,6 +955,11 @@ void FrameLoaderClientImpl::dispatchDecidePolicyForNewWindowAction(
         // creating or showing the new window that would allow us to avoid having
         // to keep this state.
         m_nextNavigationPolicy = navigationPolicy;
+
+        // Store the disposition on the opener ChromeClientImpl so that we can pass
+        // it to WebViewClient::createView.
+        ChromeClientImpl* chromeClient = static_cast<ChromeClientImpl*>(m_webFrame->frame()->page()->chrome()->client());
+        chromeClient->setNewWindowNavigationPolicy(navigationPolicy);
     }
     (m_webFrame->frame()->loader()->policyChecker()->*function)(policyAction);
 }
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 0bf935d6d..53d5997e8 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -62,7 +62,7 @@ public:
     virtual void documentElementAvailable();
 
 #if USE(V8)
-    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int worldId);
+    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId);
     virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId);
 #endif
 
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index c7ac894b0..4bfa2e5bc 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -67,6 +67,15 @@
 #include "GrGLInterface.h"
 #endif
 
+namespace {
+
+// The limit of the number of textures we hold in the GrContext's bitmap->texture cache.
+const int maxGaneshTextureCacheCount = 512;
+// The limit of the bytes allocated toward textures in the GrContext's bitmap->texture cache.
+const size_t maxGaneshTextureCacheBytes = 96 * 1024 * 1024;
+
+}
+
 // There are two levels of delegation in this file:
 //
 //   1. GraphicsContext3D delegates to GraphicsContext3DPrivate. This is done
@@ -158,18 +167,41 @@ Platform3DObject GraphicsContext3DPrivate::platformTexture() const
 }
 
 #if USE(SKIA)
+class GrMemoryAllocationChangedCallback : public Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM {
+public:
+    GrMemoryAllocationChangedCallback(GraphicsContext3DPrivate* context)
+        : m_context(context)
+    {
+    }
+
+    virtual void onGpuMemoryAllocationChanged(size_t gpuResourceSizeInBytes)
+    {
+        GrContext* context = m_context->grContext();
+        if (!context)
+            return;
+
+        if (!gpuResourceSizeInBytes) {
+            context->freeGpuResources();
+            context->setTextureCacheLimits(0, 0);
+        } else
+            context->setTextureCacheLimits(maxGaneshTextureCacheCount, maxGaneshTextureCacheBytes);
+    }
+
+private:
+    GraphicsContext3DPrivate* m_context;
+};
+
 GrContext* GraphicsContext3DPrivate::grContext()
 {
-    // Limit the number of textures we hold in the bitmap->texture cache.
-    static const int maxTextureCacheCount = 512;
-    // Limit the bytes allocated toward textures in the bitmap->texture cache.
-    static const size_t maxTextureCacheBytes = 96 * 1024 * 1024;
-
     if (!m_grContext) {
         SkAutoTUnref<GrGLInterface> interface(m_impl->createGrGLInterface());
         m_grContext = GrContext::Create(kOpenGL_Shaders_GrEngine, reinterpret_cast<GrPlatform3DContext>(interface.get()));
-        if (m_grContext)
-            m_grContext->setTextureCacheLimits(maxTextureCacheCount, maxTextureCacheBytes);
+        if (m_grContext) {
+            m_grContext->setTextureCacheLimits(maxGaneshTextureCacheCount, maxGaneshTextureCacheBytes);
+            Extensions3DChromium* extensions3DChromium = static_cast<Extensions3DChromium*>(getExtensions());
+            if (extensions3DChromium->supports("GL_CHROMIUM_gpu_memory_manager"))
+                extensions3DChromium->setGpuMemoryAllocationChangedCallbackCHROMIUM(adoptPtr(new GrMemoryAllocationChangedCallback(this)));
+        }
     }
     return m_grContext;
 }
@@ -552,6 +584,7 @@ GraphicsContext3D::Attributes GraphicsContext3DPrivate::getContextAttributes()
     attributes.antialias = webAttributes.antialias;
     attributes.premultipliedAlpha = webAttributes.premultipliedAlpha;
     attributes.preserveDrawingBuffer = m_preserveDrawingBuffer;
+    attributes.preferDiscreteGPU = webAttributes.preferDiscreteGPU;
     return attributes;
 }
 
@@ -651,71 +684,71 @@ void GraphicsContext3DPrivate::texSubImage2D(GC3Denum target, GC3Dint level, GC3
 
 DELEGATE_TO_IMPL_2(uniform1f, GC3Dint, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform1fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform1fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform1fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_2(uniform1i, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform1iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform1iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform1iv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_3(uniform2f, GC3Dint, GC3Dfloat, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform2fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform2fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_3(uniform2i, GC3Dint, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform2iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform2iv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_4(uniform3f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform3fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform3fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_4(uniform3i, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform3iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform3iv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_5(uniform4f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform4fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform4fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_5(uniform4i, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform4iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform4iv(location, size, v);
 }
 
-void GraphicsContext3DPrivate::uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
 {
     m_impl->uniformMatrix2fv(location, size, transpose, value);
 }
 
-void GraphicsContext3DPrivate::uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
 {
     m_impl->uniformMatrix3fv(location, size, transpose, value);
 }
 
-void GraphicsContext3DPrivate::uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
 {
     m_impl->uniformMatrix4fv(location, size, transpose, value);
 }
@@ -996,6 +1029,7 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
     webAttributes.canRecoverFromContextLoss = attrs.canRecoverFromContextLoss;
     webAttributes.noExtensions = attrs.noExtensions;
     webAttributes.shareResources = attrs.shareResources;
+    webAttributes.preferDiscreteGPU = attrs.preferDiscreteGPU;
 
     OwnPtr<WebKit::WebGraphicsContext3D> webContext = adoptPtr(WebKit::webKitPlatformSupport()->createOffscreenGraphicsContext3D(webAttributes));
     if (!webContext)
@@ -1155,24 +1189,24 @@ DELEGATE_TO_INTERNAL_3(texParameteri, GC3Denum, GC3Denum, GC3Dint)
 DELEGATE_TO_INTERNAL_9(texSubImage2D, GC3Denum, GC3Dint, GC3Dint, GC3Dint, GC3Dsizei, GC3Dsizei, GC3Denum, GC3Denum, const void*)
 
 DELEGATE_TO_INTERNAL_2(uniform1f, GC3Dint, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform1fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform1fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_2(uniform1i, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform1iv, GC3Dint, GC3Dint*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform1iv, GC3Dint, GC3Dsizei, GC3Dint*)
 DELEGATE_TO_INTERNAL_3(uniform2f, GC3Dint, GC3Dfloat, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform2fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform2fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_3(uniform2i, GC3Dint, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform2iv, GC3Dint, GC3Dint*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform2iv, GC3Dint, GC3Dsizei, GC3Dint*)
 DELEGATE_TO_INTERNAL_4(uniform3f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform3fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform3fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_4(uniform3i, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform3iv, GC3Dint, GC3Dint*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform3iv, GC3Dint, GC3Dsizei, GC3Dint*)
 DELEGATE_TO_INTERNAL_5(uniform4f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform4fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform4fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_5(uniform4i, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform4iv, GC3Dint, GC3Dint*, GC3Dsizei)
-DELEGATE_TO_INTERNAL_4(uniformMatrix2fv, GC3Dint, GC3Dboolean, GC3Dfloat*, GC3Dsizei)
-DELEGATE_TO_INTERNAL_4(uniformMatrix3fv, GC3Dint, GC3Dboolean, GC3Dfloat*, GC3Dsizei)
-DELEGATE_TO_INTERNAL_4(uniformMatrix4fv, GC3Dint, GC3Dboolean, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform4iv, GC3Dint, GC3Dsizei, GC3Dint*)
+DELEGATE_TO_INTERNAL_4(uniformMatrix2fv, GC3Dint, GC3Dsizei, GC3Dboolean, GC3Dfloat*)
+DELEGATE_TO_INTERNAL_4(uniformMatrix3fv, GC3Dint, GC3Dsizei, GC3Dboolean, GC3Dfloat*)
+DELEGATE_TO_INTERNAL_4(uniformMatrix4fv, GC3Dint, GC3Dsizei, GC3Dboolean, GC3Dfloat*)
 
 DELEGATE_TO_INTERNAL_1(useProgram, Platform3DObject)
 DELEGATE_TO_INTERNAL_1(validateProgram, Platform3DObject)
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h b/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
index d296eeb9b..be9db4287 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
+++ b/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
@@ -209,24 +209,24 @@ public:
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels);
 
     void uniform1f(GC3Dint location, GC3Dfloat x);
-    void uniform1fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform1fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform1i(GC3Dint location, GC3Dint x);
-    void uniform1iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
+    void uniform1iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform2f(GC3Dint location, GC3Dfloat x, float y);
-    void uniform2fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform2fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform2i(GC3Dint location, GC3Dint x, GC3Dint y);
-    void uniform2iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
+    void uniform2iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
-    void uniform3fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform3fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z);
-    void uniform3iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
+    void uniform3iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
-    void uniform4fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform4fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w);
-    void uniform4iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
-    void uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei);
-    void uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei);
-    void uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei);
+    void uniform4iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniformMatrix2fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix3fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix4fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
 
     void useProgram(Platform3DObject);
     void validateProgram(Platform3DObject);
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index a1cce45b0..149bfe12a 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -90,16 +90,16 @@ static const char allowIndexedDBMode[] = "allowIndexedDBMode";
 
 class AllowIndexedDBMainThreadBridge : public ThreadSafeRefCounted<AllowIndexedDBMainThreadBridge> {
 public:
-    static PassRefPtr<AllowIndexedDBMainThreadBridge> create(WebWorkerClientImpl* webWorkerClientImpl, const String& mode, const String& name)
+    static PassRefPtr<AllowIndexedDBMainThreadBridge> create(WebWorkerBase* webWorkerBase, const String& mode, const String& name)
     {
-        return adoptRef(new AllowIndexedDBMainThreadBridge(webWorkerClientImpl, mode, name));
+        return adoptRef(new AllowIndexedDBMainThreadBridge(webWorkerBase, mode, name));
     }
 
     // These methods are invoked on the worker context.
     void cancel()
     {
         MutexLocker locker(m_mutex);
-        m_webWorkerClientImpl = 0;
+        m_webWorkerBase = 0;
     }
 
     bool result()
@@ -111,31 +111,28 @@ public:
     void signalCompleted(bool result, const String& mode)
     {
         MutexLocker locker(m_mutex);
-        if (m_webWorkerClientImpl)
-            m_webWorkerClientImpl->postTaskForModeToWorkerContext(createCallbackTask(&didComplete, this, result), mode);
+        if (m_webWorkerBase)
+            m_webWorkerBase->postTaskForModeToWorkerContext(createCallbackTask(&didComplete, this, result), mode);
     }
 
 private:
-    AllowIndexedDBMainThreadBridge(WebWorkerClientImpl* webWorkerClientImpl, const String& mode, const String& name)
+    AllowIndexedDBMainThreadBridge(WebWorkerBase* webWorkerBase, const String& mode, const String& name)
         : m_result(false)
-        , m_webWorkerClientImpl(webWorkerClientImpl)
+        , m_webWorkerBase(webWorkerBase)
     {
-        WebFrameImpl* webFrame = static_cast<WebFrameImpl*>(webWorkerClientImpl->view()->mainFrame());
-        // webFrame is not deleted as long as the process is alive, relying on
-        // it to exist on the main thread should be ok.
+        WebCommonWorkerClient* commonClient = webWorkerBase->commonClient();
+        // See note about thread-safety below.
         WebWorkerBase::dispatchTaskToMainThread(
-            createCallbackTask(&allowIndexedDBTask, this, WebCore::AllowCrossThreadAccess(webFrame), name, mode));
+            createCallbackTask(&allowIndexedDBTask, this, WebCore::AllowCrossThreadAccess(commonClient), name, mode));
     }
 
-    static void allowIndexedDBTask(ScriptExecutionContext*, PassRefPtr<AllowIndexedDBMainThreadBridge> bridge, PassRefPtr<WebFrameImpl> prpWebFrame, const String& name, const String& mode)
+    static void allowIndexedDBTask(ScriptExecutionContext*, PassRefPtr<AllowIndexedDBMainThreadBridge> bridge, WebCommonWorkerClient* commonClient, const String& name, const String& mode)
     {
-        RefPtr<WebFrameImpl> webFrame = prpWebFrame;
-        WebViewImpl* webView = webFrame->viewImpl();
-        if (!webView) {
+        if (!commonClient) {
             bridge->signalCompleted(false, mode);
             return;
         }
-        bool allowed = !webView->permissionClient() || webView->permissionClient()->allowIndexedDB(webFrame.get(), name, WebSecurityOrigin());
+        bool allowed = commonClient->allowIndexedDB(name);
         bridge->signalCompleted(allowed, mode);
     }
 
@@ -146,29 +143,33 @@ private:
 
     bool m_result;
     Mutex m_mutex;
-    // WebWorkerClientImpl is never deleted as long as the renderer process
-    // is alive. We use it on the main thread to notify the worker thread that
-    // the permission result has been set. The underlying message proxy object
-    // is valid as long as the worker run loop hasn't returned
-    // MessageQueueTerminated, in which case we don't use the
-    // WebWorkerClientImpl.
-    WebWorkerClientImpl* m_webWorkerClientImpl;
+    // AllowIndexedDBMainThreadBridge uses two non-threadsafe classes across
+    // threads: WebWorkerBase and WebCommonWorkerClient.
+    // In the dedicated worker case, these are both the same object of type
+    // WebWorkerClientImpl, which isn't deleted for the life of the renderer
+    // process so we don't have to worry about use-after-frees.
+    // In the shared worker case, these are of type WebSharedWorkerImpl and
+    // chromium's WebSharedWorkerClientProxy, respectively. These are both
+    // deleted on the main thread in response to a request on the worker thread,
+    // but only after the worker run loop stops processing tasks. So even in
+    // the most interleaved case, we have:
+    // W AllowIndexedDBMainThreadBridge schedules allowIndexedDBTask
+    // M workerRunLoop marked as killed
+    // W runLoop stops and schedules object deletion on main thread
+    // M allowIndexedDBTask calls commonClient->allowIndexedDB()
+    // M WebWorkerBase and WebCommonWorkerClient are deleted
+    WebWorkerBase* m_webWorkerBase;
 };
 
 bool IDBFactoryBackendProxy::allowIDBFromWorkerThread(WorkerContext* workerContext, const String& name, const WebSecurityOrigin&)
 {
-    // FIXME: Bypass checking for permission so as not to block shared worker
-    // testing until a permissions check is implemented. This has to be fixed
-    // before m19 goes to beta. http://crbug.com/112855
-    if (workerContext->isSharedWorkerContext())
-        return true;
 
-    WebWorkerClientImpl* webWorkerClientImpl = static_cast<WebWorkerClientImpl*>(&workerContext->thread()->workerLoaderProxy());
+    WebWorkerBase* webWorkerBase = static_cast<WebWorkerBase*>(&workerContext->thread()->workerLoaderProxy());
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
     String mode = allowIndexedDBMode;
     mode.append(String::number(runLoop.createUniqueId()));
-    RefPtr<AllowIndexedDBMainThreadBridge> bridge = AllowIndexedDBMainThreadBridge::create(webWorkerClientImpl, mode, name);
+    RefPtr<AllowIndexedDBMainThreadBridge> bridge = AllowIndexedDBMainThreadBridge::create(webWorkerBase, mode, name);
 
     // Either the bridge returns, or the queue gets terminated.
     if (runLoop.runInMode(workerContext, mode) == MessageQueueTerminated) {
diff --git a/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp b/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp
index 4b68235a1..99a7ea378 100644
--- a/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp
+++ b/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp
@@ -98,10 +98,10 @@ void NotificationPresenterImpl::notificationControllerDestroyed()
 {
 }
 
-NotificationPresenter::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
 {
     int result = m_presenter->checkPermission(WebSecurityOrigin(context->securityOrigin()));
-    return static_cast<NotificationPresenter::Permission>(result);
+    return static_cast<NotificationClient::Permission>(result);
 }
 
 void NotificationPresenterImpl::requestPermission(ScriptExecutionContext* context, PassRefPtr<VoidCallback> callback)
diff --git a/Source/WebKit/chromium/src/NotificationPresenterImpl.h b/Source/WebKit/chromium/src/NotificationPresenterImpl.h
index 3eb5a87da..cad5b8801 100644
--- a/Source/WebKit/chromium/src/NotificationPresenterImpl.h
+++ b/Source/WebKit/chromium/src/NotificationPresenterImpl.h
@@ -31,7 +31,7 @@
 #ifndef NotificationPresenterImpl_h
 #define NotificationPresenterImpl_h
 
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "VoidCallback.h"
 
 #include <wtf/HashMap.h>
@@ -43,7 +43,7 @@ namespace WebKit {
 
 class WebNotificationPresenter;
 
-class NotificationPresenterImpl : public WebCore::NotificationPresenter {
+class NotificationPresenterImpl : public WebCore::NotificationClient {
 public:
     NotificationPresenterImpl() : m_presenter(0) { }
 
@@ -55,7 +55,7 @@ public:
     virtual void cancel(WebCore::Notification* object);
     virtual void notificationObjectDestroyed(WebCore::Notification* object);
     virtual void notificationControllerDestroyed();
-    virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::ScriptExecutionContext*);
+    virtual WebCore::NotificationClient::Permission checkPermission(WebCore::ScriptExecutionContext*);
     virtual void requestPermission(WebCore::ScriptExecutionContext* , WTF::PassRefPtr<WebCore::VoidCallback> callback);
     virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) {}
 
diff --git a/Source/WebKit/chromium/src/WebCache.cpp b/Source/WebKit/chromium/src/WebCache.cpp
index fa260cc4c..d7bbc813b 100644
--- a/Source/WebKit/chromium/src/WebCache.cpp
+++ b/Source/WebKit/chromium/src/WebCache.cpp
@@ -31,14 +31,9 @@
 #include "config.h"
 #include "WebCache.h"
 
-// Instead of providing accessors, we make all members of MemoryCache public.
-// This will make it easier to track WebCore changes to the MemoryCache class.
-// FIXME: We should introduce public getters on the MemoryCache class.
-#define private public
 #include "MemoryCache.h"
-#undef private
 
-using namespace WebCore;
+using WebCore::MemoryCache;
 
 namespace WebKit {
 
@@ -83,11 +78,11 @@ void WebCache::getUsageStats(UsageStats* result)
 
     MemoryCache* cache = WebCore::memoryCache();
     if (cache) {
-        result->minDeadCapacity = cache->m_minDeadCapacity;
-        result->maxDeadCapacity = cache->m_maxDeadCapacity;
-        result->capacity = cache->m_capacity;
-        result->liveSize = cache->m_liveSize;
-        result->deadSize = cache->m_deadSize;
+        result->minDeadCapacity = cache->minDeadCapacity();
+        result->maxDeadCapacity = cache->maxDeadCapacity();
+        result->capacity = cache->capacity();
+        result->liveSize = cache->liveSize();
+        result->deadSize = cache->deadSize();
     } else
         memset(result, 0, sizeof(UsageStats));
 }
diff --git a/Source/WebKit/chromium/src/WebColor.cpp b/Source/WebKit/chromium/src/WebColorName.cpp
index 737338a8b..04d8ed8a8 100644
--- a/Source/WebKit/chromium/src/WebColor.cpp
+++ b/Source/WebKit/chromium/src/WebColorName.cpp
@@ -29,21 +29,21 @@
  */
 
 #include "config.h"
-#include "platform/WebColor.h"
+#include "WebColorName.h"
 
-#include "Color.h"
 #include "CSSValueKeywords.h"
+#include "Color.h"
 #include "RenderTheme.h"
 #include "UnusedParam.h"
-#include "platform/WebColorName.h"
+#include <public/WebColor.h>
 
 using namespace::WebCore;
 
 namespace WebKit {
 
-static int toCSSValueKeyword(WebColorName in_value)
+static int toCSSValueKeyword(WebColorName name)
 {
-    switch (in_value) {
+    switch (name) {
     case WebColorActiveBorder:
         return CSSValueActiveborder;
     case WebColorActiveCaption:
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 397308b52..c2dbee3b4 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -206,7 +206,7 @@ int WebCompositorInputHandlerImpl::identifier() const
     return m_identifier;
 }
 
-void WebCompositorInputHandlerImpl::willDraw(double frameBeginTimeMs)
+void WebCompositorInputHandlerImpl::willDraw(double monotonicTime)
 {
 }
 
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
index a2f13025d..83b4bd546 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
@@ -61,7 +61,7 @@ public:
 
     // WebCore::CCInputHandler implementation
     virtual int identifier() const;
-    virtual void willDraw(double frameBeginTimeMs);
+    virtual void willDraw(double monotonicTime);
 
 private:
     explicit WebCompositorInputHandlerImpl(WebCore::CCInputHandlerClient*);
diff --git a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
index d6d98c752..501fd447c 100644
--- a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
@@ -129,6 +129,11 @@ void WebDataSourceImpl::setDeferMainResourceDataLoad(bool defer)
     DocumentLoader::setDeferMainResourceDataLoad(defer);
 }
 
+void WebDataSourceImpl::setNavigationStartTime(double navigationStart)
+{
+    timing()->setNavigationStart(navigationStart);
+}
+
 WebNavigationType WebDataSourceImpl::toWebNavigationType(NavigationType type)
 {
     switch (type) {
diff --git a/Source/WebKit/chromium/src/WebDataSourceImpl.h b/Source/WebKit/chromium/src/WebDataSourceImpl.h
index 8cc2c80c6..3e8c8bb55 100644
--- a/Source/WebKit/chromium/src/WebDataSourceImpl.h
+++ b/Source/WebKit/chromium/src/WebDataSourceImpl.h
@@ -70,6 +70,7 @@ public:
     virtual void setExtraData(ExtraData*);
     virtual WebApplicationCacheHost* applicationCacheHost();
     virtual void setDeferMainResourceDataLoad(bool);
+    virtual void setNavigationStartTime(double);
 
     static WebNavigationType toWebNavigationType(WebCore::NavigationType type);
 
diff --git a/Source/WebKit/chromium/src/WebDragData.cpp b/Source/WebKit/chromium/src/WebDragData.cpp
index 9e634340e..322dfbaeb 100644
--- a/Source/WebKit/chromium/src/WebDragData.cpp
+++ b/Source/WebKit/chromium/src/WebDragData.cpp
@@ -69,8 +69,8 @@ void WebDragData::assign(const WebDragData& other)
 WebVector<WebDragData::Item> WebDragData::items() const
 {
     Vector<Item> itemList;
-    RefPtr<DOMStringList> types = m_private->types();
-    if (types->contains(mimeTypeTextPlain)) {
+    const HashSet<String>& types = m_private->types();
+    if (types.contains(mimeTypeTextPlain)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeTextPlain);
@@ -78,7 +78,7 @@ WebVector<WebDragData::Item> WebDragData::items() const
         item.stringData = m_private->getData(mimeTypeTextPlain, ignored);
         itemList.append(item);
     }
-    if (types->contains(mimeTypeTextURIList)) {
+    if (types.contains(mimeTypeTextURIList)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeTextURIList);
@@ -87,7 +87,7 @@ WebVector<WebDragData::Item> WebDragData::items() const
         item.title = m_private->urlTitle();
         itemList.append(item);
     }
-    if (types->contains(mimeTypeTextHTML)) {
+    if (types.contains(mimeTypeTextHTML)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeTextHTML);
@@ -96,7 +96,7 @@ WebVector<WebDragData::Item> WebDragData::items() const
         item.baseURL = m_private->htmlBaseUrl();
         itemList.append(item);
     }
-    if (types->contains(mimeTypeDownloadURL)) {
+    if (types.contains(mimeTypeDownloadURL)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeDownloadURL);
diff --git a/Source/WebKit/chromium/src/WebElement.cpp b/Source/WebKit/chromium/src/WebElement.cpp
index 43e51d4bf..e6a1b6e4e 100644
--- a/Source/WebKit/chromium/src/WebElement.cpp
+++ b/Source/WebKit/chromium/src/WebElement.cpp
@@ -34,6 +34,7 @@
 #include "WebDocument.h"
 
 #include "Element.h"
+#include "NamedNodeMap.h"
 #include "RenderBoxModelObject.h"
 #include "RenderObject.h"
 #include <wtf/PassRefPtr.h>
diff --git a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
index b3a332b2a..c9ba0bc7b 100644
--- a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
+++ b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
@@ -68,7 +68,7 @@ WebFloatRect WebExternalTextureLayer::uvRect() const
 
 void WebExternalTextureLayer::invalidateRect(const WebFloatRect& updateRect)
 {
-    unwrap<WebExternalTextureLayerImpl>()->invalidateRect(updateRect);
+    unwrap<WebExternalTextureLayerImpl>()->setNeedsDisplayRect(updateRect);
 }
 
 WebExternalTextureLayer::WebExternalTextureLayer(const PassRefPtr<WebExternalTextureLayerImpl>& node)
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index adf202371..39897c823 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -1347,7 +1347,7 @@ WebString WebFrameImpl::selectionAsMarkup() const
     if (!range)
         return WebString();
 
-    return createMarkup(range.get(), 0);
+    return createMarkup(range.get(), 0, AnnotateForInterchange, false, ResolveNonLocalURLs);
 }
 
 void WebFrameImpl::selectWordAroundPosition(Frame* frame, VisiblePosition pos)
diff --git a/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp b/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
index b4c7f3d17..6d7ec631a 100644
--- a/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
+++ b/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
@@ -39,7 +39,7 @@ namespace WebKit {
 
 WebSecurityOrigin WebGeolocationPermissionRequest::securityOrigin() const
 {
-    return WebSecurityOrigin(m_private->frame()->document()->securityOrigin());
+    return WebSecurityOrigin(m_private->scriptExecutionContext()->securityOrigin());
 }
 
 void WebGeolocationPermissionRequest::setIsAllowed(bool allowed)
diff --git a/Source/WebKit/chromium/src/WebInputElement.cpp b/Source/WebKit/chromium/src/WebInputElement.cpp
index 736165bbf..f5d52da80 100644
--- a/Source/WebKit/chromium/src/WebInputElement.cpp
+++ b/Source/WebKit/chromium/src/WebInputElement.cpp
@@ -33,8 +33,6 @@
 
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
-#include "RenderObject.h"
-#include "RenderTextControlSingleLine.h"
 #include "TextControlInnerElements.h"
 #include "platform/WebString.h"
 #include <wtf/PassRefPtr.h>
@@ -165,12 +163,7 @@ bool WebInputElement::isSpeechInputEnabled() const
 WebInputElement::SpeechInputState WebInputElement::getSpeechInputState() const
 {
 #if ENABLE(INPUT_SPEECH)
-    RenderObject* renderer = constUnwrap<HTMLInputElement>()->renderer();
-    if (!renderer)
-        return Idle;
-
-    RenderTextControlSingleLine* control = toRenderTextControlSingleLine(renderer);
-    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(control->speechButtonElement());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(constUnwrap<HTMLInputElement>()->speechButtonElement());
     if (speechButton)
         return static_cast<WebInputElement::SpeechInputState>(speechButton->state());
 #endif
@@ -181,12 +174,7 @@ WebInputElement::SpeechInputState WebInputElement::getSpeechInputState() const
 void WebInputElement::startSpeechInput()
 {
 #if ENABLE(INPUT_SPEECH)
-    RenderObject* renderer = constUnwrap<HTMLInputElement>()->renderer();
-    if (!renderer)
-        return;
-
-    RenderTextControlSingleLine* control = toRenderTextControlSingleLine(renderer);
-    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(control->speechButtonElement());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(constUnwrap<HTMLInputElement>()->speechButtonElement());
     if (speechButton)
         speechButton->startSpeechInput();
 #endif
@@ -195,12 +183,7 @@ void WebInputElement::startSpeechInput()
 void WebInputElement::stopSpeechInput()
 {
 #if ENABLE(INPUT_SPEECH)
-    RenderObject* renderer = constUnwrap<HTMLInputElement>()->renderer();
-    if (!renderer)
-        return;
-
-    RenderTextControlSingleLine* control = toRenderTextControlSingleLine(renderer);
-    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(control->speechButtonElement());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(constUnwrap<HTMLInputElement>()->speechButtonElement());
     if (speechButton)
         speechButton->stopSpeechInput();
 #endif
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index d2c0f0c12..3314dc2f5 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -26,9 +26,11 @@
 #include "config.h"
 #include "platform/WebLayerTreeView.h"
 
+#include "GraphicsContext3DPrivate.h"
 #include "WebLayerTreeViewImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "platform/WebLayer.h"
+#include "platform/WebPoint.h"
 #include "platform/WebRect.h"
 #include "platform/WebSize.h"
 
@@ -51,11 +53,6 @@ WebLayerTreeView::Settings::operator CCSettings() const
     return settings;
 }
 
-WebLayerTreeView WebLayerTreeView::create(WebLayerTreeViewClient* client, const WebLayer& root, const WebLayerTreeView::Settings& settings)
-{
-    return WebLayerTreeView(WebLayerTreeViewImpl::create(client, root, settings));
-}
-
 void WebLayerTreeView::reset()
 {
     m_private.reset();
@@ -71,12 +68,23 @@ bool WebLayerTreeView::equals(const WebLayerTreeView& n) const
     return (m_private.get() == n.m_private.get());
 }
 
-void WebLayerTreeView::composite()
+bool WebLayerTreeView::initialize(WebLayerTreeViewClient* client, const WebLayer& root, const WebLayerTreeView::Settings& settings)
 {
-    if (CCProxy::hasImplThread())
-        m_private->setNeedsCommit();
+    m_private = WebLayerTreeViewImpl::create(client, root, settings);
+    return !isNull();
+}
+
+void WebLayerTreeView::setRootLayer(WebLayer *root)
+{
+    if (root)
+        m_private->setRootLayer(*root);
     else
-        m_private->composite();
+        m_private->setRootLayer(PassRefPtr<LayerChromium>());
+}
+
+int WebLayerTreeView::compositorIdentifier()
+{
+    return m_private->compositorIdentifier();
 }
 
 void WebLayerTreeView::setViewportSize(const WebSize& viewportSize)
@@ -89,38 +97,62 @@ WebSize WebLayerTreeView::viewportSize() const
     return WebSize(m_private->viewportSize());
 }
 
-bool WebLayerTreeView::compositeAndReadback(void *pixels, const WebRect& rect)
+void WebLayerTreeView::setVisible(bool visible)
 {
-    return m_private->compositeAndReadback(pixels, rect);
+    m_private->setVisible(visible);
 }
 
-void WebLayerTreeView::setRootLayer(WebLayer *root)
+void WebLayerTreeView::setPageScaleFactorAndLimits(float pageScaleFactor, float minimum, float maximum)
 {
-    if (root)
-        m_private->setRootLayer(*root);
+    m_private->setPageScaleFactorAndLimits(pageScaleFactor, minimum, maximum);
+}
+
+void WebLayerTreeView::startPageScaleAnimation(const WebPoint& scroll, bool useAnchor, float newPageScale, double durationSec)
+{
+    m_private->startPageScaleAnimation(IntSize(scroll.x, scroll.y), useAnchor, newPageScale, durationSec);
+}
+
+void WebLayerTreeView::setNeedsAnimate()
+{
+    m_private->setNeedsAnimate();
+}
+
+void WebLayerTreeView::setNeedsRedraw()
+{
+    m_private->setNeedsRedraw();
+}
+
+void WebLayerTreeView::composite()
+{
+    if (CCProxy::hasImplThread())
+        m_private->setNeedsCommit();
     else
-        m_private->setRootLayer(PassRefPtr<LayerChromium>());
+        m_private->composite();
+}
+
+void WebLayerTreeView::updateAnimations(double frameBeginTime)
+{
+    m_private->updateAnimations(frameBeginTime);
 }
 
-WebLayerTreeView::WebLayerTreeView(const PassRefPtr<CCLayerTreeHost>& node)
-    : m_private(node)
+bool WebLayerTreeView::compositeAndReadback(void *pixels, const WebRect& rect)
 {
+    return m_private->compositeAndReadback(pixels, rect);
 }
 
-WebLayerTreeView& WebLayerTreeView::operator=(const PassRefPtr<CCLayerTreeHost>& node)
+void WebLayerTreeView::finishAllRendering()
 {
-    m_private = node;
-    return *this;
+    m_private->finishAllRendering();
 }
 
-WebLayerTreeView::operator PassRefPtr<CCLayerTreeHost>() const
+WebGraphicsContext3D* WebLayerTreeView::context()
 {
-    return m_private.get();
+    return GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_private->context());
 }
 
-void WebLayerTreeView::setNeedsRedraw()
+void WebLayerTreeView::loseCompositorContext(int numTimes)
 {
-    m_private->setNeedsRedraw();
+    m_private->loseContext(numTimes);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
index 29d033215..335879b66 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
@@ -78,7 +78,7 @@ void WebLayerTreeViewImpl::applyScrollAndScale(const WebCore::IntSize& scrollDel
         m_client->applyScrollAndScale(WebSize(scrollDelta), pageScale);
 }
 
-PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createLayerTreeHostContext3D()
+PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createContext()
 {
     if (!m_client)
         return 0;
@@ -89,20 +89,22 @@ PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createLayerTreeHostContext3D
     return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow, false /* preserveDrawingBuffer */ );
 }
 
-void WebLayerTreeViewImpl::didCommitAndDrawFrame()
+void WebLayerTreeViewImpl::didRecreateContext(bool success)
 {
-    // FIXME: route this up to the WebLayerTreeView client
+    if (m_client)
+        m_client->didRebindGraphicsContext(success);
 }
 
-void WebLayerTreeViewImpl::didCompleteSwapBuffers()
+void WebLayerTreeViewImpl::didCommitAndDrawFrame()
 {
-    // FIXME: route this up to the WebLayerTreeView client
+    if (m_client)
+        m_client->didCommitAndDrawFrame();
 }
 
-void WebLayerTreeViewImpl::didRecreateGraphicsContext(bool success)
+void WebLayerTreeViewImpl::didCompleteSwapBuffers()
 {
     if (m_client)
-        m_client->didRebindGraphicsContext(success);
+        m_client->didCompleteSwapBuffers();
 }
 
 void WebLayerTreeViewImpl::scheduleComposite()
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
index 580e9af84..b1b26d0fc 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
@@ -44,8 +44,8 @@ private:
     virtual void updateAnimations(double frameBeginTime);
     virtual void layout();
     virtual void applyScrollAndScale(const WebCore::IntSize& scrollDelta, float pageScale);
-    virtual PassRefPtr<WebCore::GraphicsContext3D> createLayerTreeHostContext3D();
-    virtual void didRecreateGraphicsContext(bool success);
+    virtual PassRefPtr<WebCore::GraphicsContext3D> createContext();
+    virtual void didRecreateContext(bool success);
     virtual void didCommitAndDrawFrame();
     virtual void didCompleteSwapBuffers();
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index ec74b6bea..74c4a7200 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -152,7 +152,7 @@ void WebMediaPlayerClientImpl::repaint()
     ASSERT(m_mediaPlayer);
 #if USE(ACCELERATED_COMPOSITING)
     if (m_videoLayer && supportsAcceleratedRendering())
-        m_videoLayer->contentChanged();
+        m_videoLayer->setNeedsDisplay();
 #endif
     m_mediaPlayer->repaint();
 }
diff --git a/Source/WebKit/chromium/src/WebNamedNodeMap.cpp b/Source/WebKit/chromium/src/WebNamedNodeMap.cpp
index e2455e6b9..ba5f29625 100644
--- a/Source/WebKit/chromium/src/WebNamedNodeMap.cpp
+++ b/Source/WebKit/chromium/src/WebNamedNodeMap.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "WebNamedNodeMap.h"
 
+#include "Element.h"
 #include "NamedNodeMap.h"
 #include "Node.h"
 #include "WebAttribute.h"
@@ -63,7 +64,7 @@ unsigned WebNamedNodeMap::length() const
 
 WebAttribute WebNamedNodeMap::attributeItem(unsigned index) const
 {
-    return WebAttribute(m_private->attributeItem(index));
+    return WebAttribute(m_private->element()->attributeItem(index));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebOptionElement.cpp b/Source/WebKit/chromium/src/WebOptionElement.cpp
index d48492594..c71f7b565 100644
--- a/Source/WebKit/chromium/src/WebOptionElement.cpp
+++ b/Source/WebKit/chromium/src/WebOptionElement.cpp
@@ -83,7 +83,7 @@ bool WebOptionElement::isEnabled() const
 }
 
 WebOptionElement::WebOptionElement(const PassRefPtr<HTMLOptionElement>& elem)
-    : WebFormControlElement(elem)
+    : WebElement(elem)
 {
 }
 
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
new file mode 100644
index 000000000..bc810c7b1
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebPagePopup.h"
+
+namespace WebKit {
+
+// WebPagePopupImpl ----------------------------------------------------------------
+
+// FIXME: WebPagePopupImpl implementation will be written here.
+
+// WebPagePopup ----------------------------------------------------------------
+
+WebPagePopup* WebPagePopup::create(WebWidgetClient*)
+{
+    // FIXME: Returns a WebPagePopupImpl object.
+    return 0;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebPageSerializer.cpp b/Source/WebKit/chromium/src/WebPageSerializer.cpp
index dc2bc99e3..1ad70b1b4 100644
--- a/Source/WebKit/chromium/src/WebPageSerializer.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializer.cpp
@@ -127,7 +127,7 @@ void retrieveResourcesForElement(Element* element,
 
     // Ignore URLs that have a non-standard protocols. Since the FTP protocol
     // does no have a cache mechanism, we skip it as well.
-    if (!url.protocolInHTTPFamily() && !url.isLocalFile())
+    if (!url.protocolIsInHTTPFamily() && !url.isLocalFile())
         return;
 
     if (!resourceURLs->contains(url))
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 10c3e2e4b..a71703b15 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -370,8 +370,8 @@ void WebPluginContainerImpl::setBackingIOSurfaceId(int width,
 void WebPluginContainerImpl::commitBackingTexture()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_platformLayer.get())
-        m_platformLayer->invalidateRect(FloatRect(FloatPoint(), m_platformLayer->bounds()));
+    if (m_platformLayer)
+        m_platformLayer->setNeedsDisplay();
 #endif
 }
 
@@ -435,6 +435,14 @@ void WebPluginContainerImpl::zoomLevelChanged(double zoomLevel)
     view->fullFramePluginZoomLevelChanged(zoomLevel);
 }
  
+void WebPluginContainerImpl::setOpaque(bool opaque)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_platformLayer)
+        m_platformLayer->setOpaque(opaque);
+#endif
+}
+
 bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 {
     Page* page = m_element->document()->page();
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 898130084..9d970f2f8 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -104,6 +104,7 @@ public:
     virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
     virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
     virtual void zoomLevelChanged(double zoomLevel);    
+    virtual void setOpaque(bool);
     virtual bool isRectTopmost(const WebRect&);
 
     // This cannot be null.
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index f1960eb31..d297a828c 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -34,7 +34,7 @@
 #include "AbstractDatabase.h"
 #include "RuntimeEnabledFeatures.h"
 #include "WebMediaPlayerClientImpl.h"
-#include "websockets/WebSocket.h"
+#include "Modules/websockets/WebSocket.h"
 
 #include <wtf/UnusedParam.h>
 
@@ -260,6 +260,22 @@ bool WebRuntimeFeatures::isSpeechInputEnabled()
     return RuntimeEnabledFeatures::speechInputEnabled();
 }
 
+void WebRuntimeFeatures::enableScriptedSpeech(bool enable)
+{
+#if ENABLE(SCRIPTED_SPEECH)
+    RuntimeEnabledFeatures::setScriptedSpeechEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isScriptedSpeechEnabled()
+{
+#if ENABLE(SCRIPTED_SPEECH)
+    return RuntimeEnabledFeatures::scriptedSpeechEnabled();
+#else
+    return false;
+#endif
+}
+
 void WebRuntimeFeatures::enableXHRResponseBlob(bool enable)
 {
 #if ENABLE(XHR_RESPONSE_BLOB)
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 485a5b051..3b3a84f98 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -109,6 +109,11 @@ void WebSettingsImpl::setMinimumLogicalFontSize(int size)
     m_settings->setMinimumLogicalFontSize(size);
 }
 
+void WebSettingsImpl::setDefaultDeviceScaleFactor(int defaultDeviceScaleFactor)
+{
+    m_settings->setDefaultDeviceScaleFactor(defaultDeviceScaleFactor);
+}
+
 void WebSettingsImpl::setDefaultTextEncodingName(const WebString& encoding)
 {
     m_settings->setDefaultTextEncodingName((String)encoding);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 51d9323a4..7024b5164 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -54,6 +54,7 @@ public:
     virtual void setDefaultFixedFontSize(int);
     virtual void setMinimumFontSize(int);
     virtual void setMinimumLogicalFontSize(int);
+    virtual void setDefaultDeviceScaleFactor(int);
     virtual void setDefaultTextEncodingName(const WebString&);
     virtual void setJavaScriptEnabled(bool);
     virtual void setWebSecurityEnabled(bool);
diff --git a/Source/WebKit/chromium/src/WebSocketImpl.cpp b/Source/WebKit/chromium/src/WebSocketImpl.cpp
index f0bf28206..30a6033d3 100644
--- a/Source/WebKit/chromium/src/WebSocketImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSocketImpl.cpp
@@ -105,10 +105,19 @@ WebString WebSocketImpl::subprotocol()
 #endif
 }
 
+WebString WebSocketImpl::extensions()
+{
+#if ENABLE(WEB_SOCKETS)
+    return m_private->extensions();
+#else
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 bool WebSocketImpl::sendText(const WebString& message)
 {
 #if ENABLE(WEB_SOCKETS)
-    return m_private->send(message);
+    return m_private->send(message) == ThreadableWebSocketChannel::SendSuccess;
 #else
     ASSERT_NOT_REACHED();
 #endif
@@ -117,7 +126,7 @@ bool WebSocketImpl::sendText(const WebString& message)
 bool WebSocketImpl::sendArrayBuffer(const WebArrayBuffer& webArrayBuffer)
 {
 #if ENABLE(WEB_SOCKETS)
-    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer));
+    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer)) == ThreadableWebSocketChannel::SendSuccess;
 #else
     ASSERT_NOT_REACHED();
 #endif
diff --git a/Source/WebKit/chromium/src/WebSocketImpl.h b/Source/WebKit/chromium/src/WebSocketImpl.h
index 3d42bd506..ef14b18c7 100644
--- a/Source/WebKit/chromium/src/WebSocketImpl.h
+++ b/Source/WebKit/chromium/src/WebSocketImpl.h
@@ -53,25 +53,26 @@ public:
 
     bool isNull() const { return !m_private; }
 
-    BinaryType binaryType() const;
-    virtual bool setBinaryType(BinaryType);
-    virtual void connect(const WebURL&, const WebString& protocol);
-    virtual WebString subprotocol();
-    virtual bool sendText(const WebString&);
-    virtual bool sendArrayBuffer(const WebArrayBuffer&);
-    virtual unsigned long bufferedAmount() const;
-    virtual void close(int code, const WebString& reason);
-    virtual void fail(const WebString& reason);
-    virtual void disconnect();
+    virtual BinaryType binaryType() const OVERRIDE;
+    virtual bool setBinaryType(BinaryType) OVERRIDE;
+    virtual void connect(const WebURL&, const WebString& protocol) OVERRIDE;
+    virtual WebString subprotocol() OVERRIDE;
+    virtual WebString extensions() OVERRIDE;
+    virtual bool sendText(const WebString&) OVERRIDE;
+    virtual bool sendArrayBuffer(const WebArrayBuffer&) OVERRIDE;
+    virtual unsigned long bufferedAmount() const OVERRIDE;
+    virtual void close(int code, const WebString& reason) OVERRIDE;
+    virtual void fail(const WebString& reason) OVERRIDE;
+    virtual void disconnect() OVERRIDE;
 
     // WebSocketChannelClient
-    virtual void didConnect();
-    virtual void didReceiveMessage(const String& message);
-    virtual void didReceiveBinaryData(PassOwnPtr<Vector<char> > binaryData);
-    virtual void didReceiveMessageError();
-    virtual void didUpdateBufferedAmount(unsigned long bufferedAmount);
-    virtual void didStartClosingHandshake();
-    virtual void didClose(unsigned long bufferedAmount, ClosingHandshakeCompletionStatus, unsigned short code, const String& reason);
+    virtual void didConnect() OVERRIDE;
+    virtual void didReceiveMessage(const String& message) OVERRIDE;
+    virtual void didReceiveBinaryData(PassOwnPtr<Vector<char> > binaryData) OVERRIDE;
+    virtual void didReceiveMessageError() OVERRIDE;
+    virtual void didUpdateBufferedAmount(unsigned long bufferedAmount) OVERRIDE;
+    virtual void didStartClosingHandshake() OVERRIDE;
+    virtual void didClose(unsigned long bufferedAmount, ClosingHandshakeCompletionStatus, unsigned short code, const String& reason) OVERRIDE;
 
 private:
     RefPtr<WebCore::WebSocketChannel> m_private;
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 55a2052a4..52a022ce9 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -34,6 +34,7 @@
 #include "AutofillPopupMenuClient.h"
 #include "AXObjectCache.h"
 #include "BackForwardListChromium.h"
+#include "cc/CCProxy.h"
 #include "CSSStyleSelector.h"
 #include "CSSValueKeywords.h"
 #include "Chrome.h"
@@ -73,6 +74,7 @@
 #include "Image.h"
 #include "ImageBuffer.h"
 #include "InspectorController.h"
+#include "InspectorInstrumentation.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "LayerChromium.h"
@@ -102,6 +104,7 @@
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "Settings.h"
+#include "SharedGraphicsContext3D.h"
 #include "SpeechInputClientImpl.h"
 #include "TextIterator.h"
 #include "Timer.h"
@@ -123,6 +126,8 @@
 #include "WebInputEventConversion.h"
 #include "WebKit.h"
 #include "platform/WebKitPlatformSupport.h"
+#include "platform/WebLayer.h"
+#include "platform/WebLayerTreeView.h"
 #include "WebMediaPlayerAction.h"
 #include "WebNode.h"
 #include "WebPlugin.h"
@@ -137,7 +142,6 @@
 #include "platform/WebString.h"
 #include "platform/WebVector.h"
 #include "WebViewClient.h"
-#include "cc/CCProxy.h"
 #include <wtf/ByteArray.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
@@ -168,27 +172,6 @@
 using namespace WebCore;
 using namespace std;
 
-namespace {
-
-WebKit::WebGraphicsContext3D::Attributes getCompositorContextAttributes(bool threaded)
-{
-    // Explicitly disable antialiasing for the compositor. As of the time of
-    // this writing, the only platform that supported antialiasing for the
-    // compositor was Mac OS X, because the on-screen OpenGL context creation
-    // code paths on Windows and Linux didn't yet have multisampling support.
-    // Mac OS X essentially always behaves as though it's rendering offscreen.
-    // Multisampling has a heavy cost especially on devices with relatively low
-    // fill rate like most notebooks, and the Mac implementation would need to
-    // be optimized to resolve directly into the IOSurface shared between the
-    // GPU and browser processes. For these reasons and to avoid platform
-    // disparities we explicitly disable antialiasing.
-    WebKit::WebGraphicsContext3D::Attributes attributes;
-    attributes.antialias = false;
-    attributes.shareResources = true;
-    attributes.forUseOnAnotherThread = threaded;
-    return attributes;
-}
-
 // The following constants control parameters for automated scaling of webpages
 // (such as due to a double tap gesture or find in page etc.). These are
 // experimentally determined.
@@ -197,8 +180,6 @@ static const float minScaleDifference = 0.01;
 static const float doubleTapZoomContentDefaultMargin = 5;
 static const float doubleTapZoomContentMinimumMargin = 2;
 
-} // anonymous namespace
-
 namespace WebKit {
 
 // Change the text zoom level by kTextSizeMultiplierRatio each time the user
@@ -525,7 +506,7 @@ void WebViewImpl::mouseDown(const WebMouseEvent& event)
         || (event.button == WebMouseEvent::ButtonLeft
             && event.modifiers & WebMouseEvent::ControlKey))
         mouseContextMenu(event);
-#elif OS(UNIX)
+#elif OS(UNIX) || OS(ANDROID)
     if (event.button == WebMouseEvent::ButtonRight)
         mouseContextMenu(event);
 #endif
@@ -627,8 +608,8 @@ bool WebViewImpl::gestureEvent(const WebGestureEvent& event)
 
 void WebViewImpl::startPageScaleAnimation(const IntPoint& scroll, bool useAnchor, float newScale, double durationSec)
 {
-    if (m_layerTreeHost)
-        m_layerTreeHost->startPageScaleAnimation(IntSize(scroll.x(), scroll.y()), useAnchor, newScale, durationSec);
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.startPageScaleAnimation(scroll, useAnchor, newScale, durationSec);
 }
 #endif
 
@@ -1264,6 +1245,11 @@ void WebViewImpl::didExitFullScreen()
 #endif
 }
 
+void WebViewImpl::instrumentBeginFrame()
+{
+    InspectorInstrumentation::didBeginFrame(m_page.get());
+}
+
 void WebViewImpl::animate(double frameBeginTime)
 {
 #if ENABLE(REQUEST_ANIMATION_FRAME)
@@ -1276,7 +1262,7 @@ void WebViewImpl::animate(double frameBeginTime)
     // In composited mode, we always go through the compositor so it can apply
     // appropriate flow-control mechanisms.
     if (isAcceleratedCompositingActive())
-        m_layerTreeHost->updateAnimations(frameBeginTime);
+        m_layerTreeView.updateAnimations(frameBeginTime);
     else
 #endif
         updateAnimations(frameBeginTime);
@@ -1324,6 +1310,7 @@ void WebViewImpl::layout()
 #if USE(ACCELERATED_COMPOSITING)
 void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect)
 {
+    ASSERT(!m_layerTreeView.isNull());
 #if USE(SKIA)
     PlatformContextSkia context(canvas);
 
@@ -1342,7 +1329,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
     OwnPtr<ImageBuffer> imageBuffer(ImageBuffer::create(rect.size()));
     RefPtr<ByteArray> pixelArray(ByteArray::create(rect.width() * rect.height() * 4));
     if (imageBuffer && pixelArray) {
-        m_layerTreeHost->compositeAndReadback(pixelArray->data(), invertRect);
+        m_layerTreeView.compositeAndReadback(pixelArray->data(), invertRect);
         imageBuffer->putByteArray(Premultiplied, pixelArray.get(), rect.size(), IntRect(IntPoint(), rect.size()), IntPoint());
         gc.save();
         gc.translate(IntSize(0, bitmapHeight));
@@ -1364,7 +1351,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         if (canvas) {
             // Clip rect to the confines of the rootLayerTexture.
             IntRect resizeRect(rect);
-            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeHost->viewportSize()));
+            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeView.viewportSize()));
             doPixelReadbackToCanvas(canvas, resizeRect);
         }
 #endif
@@ -1394,7 +1381,7 @@ void WebViewImpl::composite(bool)
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (CCProxy::hasImplThread())
-        m_layerTreeHost->setNeedsRedraw();
+        m_layerTreeView.setNeedsRedraw();
     else {
         ASSERT(isAcceleratedCompositingActive());
         if (!page())
@@ -1403,7 +1390,7 @@ void WebViewImpl::composite(bool)
         if (m_pageOverlays)
             m_pageOverlays->update();
 
-        m_layerTreeHost->composite();
+        m_layerTreeView.composite();
     }
 #endif
 }
@@ -1411,16 +1398,16 @@ void WebViewImpl::composite(bool)
 void WebViewImpl::setNeedsRedraw()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost && isAcceleratedCompositingActive())
-        m_layerTreeHost->setNeedsRedraw();
+    if (!m_layerTreeView.isNull() && isAcceleratedCompositingActive())
+        m_layerTreeView.setNeedsRedraw();
 #endif
 }
 
 void WebViewImpl::loseCompositorContext(int numTimes)
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost)
-        m_layerTreeHost->loseCompositorContext(numTimes);
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.loseCompositorContext(numTimes);
 #endif
 }
 
@@ -2261,15 +2248,27 @@ void WebViewImpl::enableFixedLayoutMode(bool enable)
 #endif
 }
 
-void WebViewImpl::enableAutoResizeMode(bool enable, const WebSize& minSize, const WebSize& maxSize)
+
+void WebViewImpl::enableAutoResizeMode(const WebSize& minSize, const WebSize& maxSize)
 {
-    m_shouldAutoResize = enable;
+    m_shouldAutoResize = true;
     m_minAutoSize = minSize;
     m_maxAutoSize = maxSize;
-    if (!mainFrameImpl() || !mainFrameImpl()->frame() || !mainFrameImpl()->frame()->view())
-        return;
+    configureAutoResizeMode();
+}
 
-    mainFrameImpl()->frame()->view()->enableAutoSizeMode(m_shouldAutoResize, m_minAutoSize, m_maxAutoSize);
+void WebViewImpl::disableAutoResizeMode()
+{
+    m_shouldAutoResize = false;
+    configureAutoResizeMode();
+}
+
+void WebViewImpl::enableAutoResizeMode(bool enable, const WebSize& minSize, const WebSize& maxSize)
+{
+    if (enable)
+        enableAutoResizeMode(minSize, maxSize);
+    else
+        disableAutoResizeMode();
 }
 
 void WebViewImpl::setPageScaleFactorLimits(float minPageScale, float maxPageScale)
@@ -2302,8 +2301,8 @@ bool WebViewImpl::computePageScaleFactorLimits()
 
     float clampedScale = clampPageScaleFactorToLimits(pageScaleFactor());
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost)
-        m_layerTreeHost->setPageScaleFactorAndLimits(clampedScale, m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.setPageScaleFactorAndLimits(clampedScale, m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 #endif
     if (clampedScale != pageScaleFactor()) {
         setPageScaleFactorPreservingScrollOffset(clampedScale);
@@ -2582,6 +2581,14 @@ void WebViewImpl::sendResizeEventAndRepaint()
     }
 }
 
+void WebViewImpl::configureAutoResizeMode()
+{
+    if (!mainFrameImpl() || !mainFrameImpl()->frame() || !mainFrameImpl()->frame()->view())
+        return;
+
+    mainFrameImpl()->frame()->view()->enableAutoSizeMode(m_shouldAutoResize, m_minAutoSize, m_maxAutoSize);
+}
+
 unsigned long WebViewImpl::createUniqueIdentifierForRequest()
 {
     if (m_page)
@@ -2929,17 +2936,12 @@ void WebViewImpl::addPageOverlay(WebPageOverlay* overlay, int zOrder)
         m_pageOverlays = PageOverlayList::create(this);
 
     m_pageOverlays->add(overlay, zOrder);
-    setRootLayerNeedsDisplay();
 }
 
 void WebViewImpl::removePageOverlay(WebPageOverlay* overlay)
 {
-    if (m_pageOverlays && m_pageOverlays->remove(overlay)) {
-        setRootLayerNeedsDisplay();
-
-        if (m_pageOverlays->empty())
-            m_pageOverlays = nullptr;
-    }
+    if (m_pageOverlays && m_pageOverlays->remove(overlay) && m_pageOverlays->empty())
+        m_pageOverlays = nullptr;
 }
 
 void WebViewImpl::setOverlayLayer(WebCore::GraphicsLayer* layer)
@@ -3047,29 +3049,31 @@ void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
         }
         m_nonCompositedContentHost->setScrollLayer(scrollLayer);
     }
-    if (m_layerTreeHost)
-        m_layerTreeHost->setRootLayer(layer ? layer->platformLayer() : 0);
+
+    if (layer)
+        m_rootLayer = WebLayer(layer->platformLayer());
+
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.setRootLayer(layer ? &m_rootLayer : 0);
 
     IntRect damagedRect(0, 0, m_size.width, m_size.height);
     if (!m_isAcceleratedCompositingActive)
         m_client->didInvalidateRect(damagedRect);
 }
 
-void WebViewImpl::setRootLayerNeedsDisplay()
+void WebViewImpl::scheduleCompositingLayerSync()
 {
-    if (m_layerTreeHost)
-        m_layerTreeHost->setNeedsCommit();
+    m_layerTreeView.setNeedsRedraw();
 }
 
-void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect& clipRect)
+void WebViewImpl::scrollRootLayerRect(const IntSize&, const IntRect&)
 {
     updateLayerTreeViewport();
-    setRootLayerNeedsDisplay();
 }
 
 void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
 {
-    ASSERT(m_layerTreeHost);
+    ASSERT(!m_layerTreeView.isNull());
 
     if (!page())
         return;
@@ -3078,7 +3082,6 @@ void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
     IntRect dirtyRect = view->windowToContents(rect);
     updateLayerTreeViewport();
     m_nonCompositedContentHost->invalidateRect(dirtyRect);
-    setRootLayerNeedsDisplay();
 }
 
 NonCompositedContentHost* WebViewImpl::nonCompositedContentHost()
@@ -3091,8 +3094,8 @@ void WebViewImpl::scheduleAnimation()
 {
     if (isAcceleratedCompositingActive()) {
         if (CCProxy::hasImplThread()) {
-            ASSERT(m_layerTreeHost);
-            m_layerTreeHost->setNeedsAnimate();
+            ASSERT(!m_layerTreeView.isNull());
+            m_layerTreeView.setNeedsAnimate();
         } else
             m_client->scheduleAnimation();
     } else
@@ -3145,26 +3148,26 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         m_isAcceleratedCompositingActive = false;
         // We need to finish all GL rendering before sending didDeactivateCompositor() to prevent
         // flickering when compositing turns off.
-        if (m_layerTreeHost)
-            m_layerTreeHost->finishAllRendering();
+        if (!m_layerTreeView.isNull())
+            m_layerTreeView.finishAllRendering();
         m_client->didDeactivateCompositor();
-    } else if (m_layerTreeHost) {
+    } else if (!m_layerTreeView.isNull()) {
         m_isAcceleratedCompositingActive = true;
         updateLayerTreeViewport();
 
-        m_client->didActivateCompositor(m_layerTreeHost->compositorIdentifier());
+        m_client->didActivateCompositor(m_layerTreeView.compositorIdentifier());
     } else {
         TRACE_EVENT("WebViewImpl::setIsAcceleratedCompositingActive(true)", this, 0);
 
-        WebCore::CCSettings ccSettings;
-        ccSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
-        ccSettings.compositeOffscreen = settings()->compositeToTextureEnabled();
-        ccSettings.showFPSCounter = settings()->showFPSCounter();
-        ccSettings.showPlatformLayerTree = settings()->showPlatformLayerTree();
+        WebLayerTreeView::Settings layerTreeViewSettings;
+        layerTreeViewSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
+        layerTreeViewSettings.compositeOffscreen = settings()->compositeToTextureEnabled();
+        layerTreeViewSettings.showFPSCounter = settings()->showFPSCounter();
+        layerTreeViewSettings.showPlatformLayerTree = settings()->showPlatformLayerTree();
 
-        ccSettings.perTilePainting = page()->settings()->perTileDrawingEnabled();
-        ccSettings.partialSwapEnabled = page()->settings()->partialSwapEnabled();
-        ccSettings.threadedAnimationEnabled = page()->settings()->threadedAnimationEnabled();
+        layerTreeViewSettings.perTilePainting = page()->settings()->perTileDrawingEnabled();
+        layerTreeViewSettings.partialSwapEnabled = page()->settings()->partialSwapEnabled();
+        layerTreeViewSettings.threadedAnimationEnabled = page()->settings()->threadedAnimationEnabled();
 
         m_nonCompositedContentHost = NonCompositedContentHost::create(WebViewImplContentPainter::create(this));
         m_nonCompositedContentHost->setShowDebugBorders(page()->settings()->showDebugBorders());
@@ -3172,17 +3175,16 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         if (page() && page()->mainFrame()->view())
             m_nonCompositedContentHost->setBackgroundColor(page()->mainFrame()->view()->documentBackgroundColor());
 
-        m_layerTreeHost = CCLayerTreeHost::create(this, ccSettings);
-        if (m_layerTreeHost) {
-            m_layerTreeHost->setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+        m_layerTreeView.initialize(this, m_rootLayer, layerTreeViewSettings);
+        if (!m_layerTreeView.isNull()) {
+            m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
             updateLayerTreeViewport();
-            m_client->didActivateCompositor(m_layerTreeHost->compositorIdentifier());
+            m_client->didActivateCompositor(m_layerTreeView.compositorIdentifier());
             m_isAcceleratedCompositingActive = true;
             m_compositorCreationFailed = false;
             if (m_pageOverlays)
                 m_pageOverlays->update();
         } else {
-            m_layerTreeHost.clear();
             m_nonCompositedContentHost.clear();
             m_isAcceleratedCompositingActive = false;
             m_client->didDeactivateCompositor();
@@ -3195,29 +3197,44 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
 #endif
 
-PassRefPtr<GraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
+PassOwnPtr<WebKit::WebGraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
 {
-    WebKit::WebGraphicsContext3D::Attributes attributes = getCompositorContextAttributes(CCProxy::hasImplThread());
-    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes, true /* renderDirectlyToHostWindow */));
+    // Explicitly disable antialiasing for the compositor. As of the time of
+    // this writing, the only platform that supported antialiasing for the
+    // compositor was Mac OS X, because the on-screen OpenGL context creation
+    // code paths on Windows and Linux didn't yet have multisampling support.
+    // Mac OS X essentially always behaves as though it's rendering offscreen.
+    // Multisampling has a heavy cost especially on devices with relatively low
+    // fill rate like most notebooks, and the Mac implementation would need to
+    // be optimized to resolve directly into the IOSurface shared between the
+    // GPU and browser processes. For these reasons and to avoid platform
+    // disparities we explicitly disable antialiasing.
+    WebKit::WebGraphicsContext3D::Attributes attributes;
+    attributes.antialias = false;
+    attributes.shareResources = true;
+
+    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes));
     if (!webContext)
-        return 0;
+        return nullptr;
 
-    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow);
+    return webContext.release();
 }
 
-PassRefPtr<GraphicsContext3D> WebViewImpl::createLayerTreeHostContext3D()
+WebKit::WebGraphicsContext3D* WebViewImpl::createContext3D()
 {
-    RefPtr<GraphicsContext3D> context;
+    OwnPtr<WebKit::WebGraphicsContext3D> webContext;
 
     // If we've already created an onscreen context for this view, return that.
     if (m_temporaryOnscreenGraphicsContext3D)
-        context = m_temporaryOnscreenGraphicsContext3D.release();
+        webContext = m_temporaryOnscreenGraphicsContext3D.release();
     else // Otherwise make a new one.
-        context = createCompositorGraphicsContext3D();
-    return context;
+        webContext = createCompositorGraphicsContext3D();
+    // The caller takes ownership of this object, but since there's no equivalent of PassOwnPtr<> in the WebKit API
+    // we return a raw pointer.
+    return webContext.leakPtr();
 }
 
-void WebViewImpl::applyScrollAndScale(const IntSize& scrollDelta, float pageScaleDelta)
+void WebViewImpl::applyScrollAndScale(const WebSize& scrollDelta, float pageScaleDelta)
 {
     if (!mainFrameImpl() || !mainFrameImpl()->frameView())
         return;
@@ -3230,8 +3247,8 @@ void WebViewImpl::applyScrollAndScale(const IntSize& scrollDelta, float pageScal
         // in the old coordinate space, so we first need to multiply them
         // by the page scale delta.
         WebSize scrollOffset = mainFrame()->scrollOffset();
-        scrollOffset.width += scrollDelta.width();
-        scrollOffset.height += scrollDelta.height();
+        scrollOffset.width += scrollDelta.width;
+        scrollOffset.height += scrollDelta.height;
         WebPoint scaledScrollOffset(scrollOffset.width * pageScaleDelta,
                                     scrollOffset.height * pageScaleDelta);
         setPageScaleFactor(pageScaleFactor() * pageScaleDelta, scaledScrollOffset);
@@ -3250,7 +3267,7 @@ void WebViewImpl::didCompleteSwapBuffers()
         m_client->didCompleteSwapBuffers();
 }
 
-void WebViewImpl::didRecreateGraphicsContext(bool success)
+void WebViewImpl::didRebindGraphicsContext(bool success)
 {
 
     // Switch back to software rendering mode, if necessary
@@ -3277,7 +3294,7 @@ void WebViewImpl::scheduleComposite()
 
 void WebViewImpl::updateLayerTreeViewport()
 {
-    if (!page() || !m_nonCompositedContentHost || !m_layerTreeHost)
+    if (!page() || !m_nonCompositedContentHost || m_layerTreeView.isNull())
         return;
 
     FrameView* view = page()->mainFrame()->view();
@@ -3293,18 +3310,18 @@ void WebViewImpl::updateLayerTreeViewport()
         layerAdjustX = -view->contentsSize().width() + view->visibleContentRect(false).width();
     }
     m_nonCompositedContentHost->setViewport(visibleRect.size(), view->contentsSize(), scroll, pageScaleFactor(), layerAdjustX);
-    m_layerTreeHost->setViewportSize(visibleRect.size());
-    m_layerTreeHost->setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+    m_layerTreeView.setViewportSize(visibleRect.size());
+    m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 }
 
 WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (m_page->settings()->acceleratedCompositingEnabled() && allowsAcceleratedCompositing()) {
-        if (m_layerTreeHost) {
-            WebGraphicsContext3D* webContext = GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_layerTreeHost->context());
-            if (webContext && !webContext->isContextLost())
-                return webContext;
+        if (!m_layerTreeView.isNull()) {
+            WebGraphicsContext3D* context = m_layerTreeView.context();
+            if (context && !context->isContextLost())
+                return context;
         }
         // If we get here it means that some system needs access to the context the compositor will use but the compositor itself
         // hasn't requested a context or it was unable to successfully instantiate a context.
@@ -3313,7 +3330,7 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
         if (!m_temporaryOnscreenGraphicsContext3D)
             m_temporaryOnscreenGraphicsContext3D = createCompositorGraphicsContext3D();
 
-        WebGraphicsContext3D* webContext = GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
+        WebGraphicsContext3D* webContext = m_temporaryOnscreenGraphicsContext3D.get();
         if (webContext && !webContext->isContextLost())
             return webContext;
     }
@@ -3321,6 +3338,14 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
     return 0;
 }
 
+WebGraphicsContext3D* WebViewImpl::sharedGraphicsContext3D()
+{
+    if (!m_page->settings()->acceleratedCompositingEnabled() || !allowsAcceleratedCompositing())
+        return 0;
+
+    return GraphicsContext3DPrivate::extractWebGraphicsContext3D(SharedGraphicsContext3D::get());
+}
+
 void WebViewImpl::setVisibilityState(WebPageVisibilityState visibilityState,
                                      bool isInitialState) {
     if (!page())
@@ -3338,7 +3363,7 @@ void WebViewImpl::setVisibilityState(WebPageVisibilityState visibilityState,
         bool visible = visibilityState == WebPageVisibilityStateVisible;
         if (!visible)
             m_nonCompositedContentHost->protectVisibleTileTextures();
-        m_layerTreeHost->setVisible(visible);
+        m_layerTreeView.setVisible(visible);
     }
 #endif
 }
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index bc7a53d04..3819ecb65 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -32,6 +32,9 @@
 #define WebViewImpl_h
 
 #include "WebNavigationPolicy.h"
+#include "platform/WebLayer.h"
+#include "platform/WebLayerTreeView.h"
+#include "platform/WebLayerTreeViewClient.h"
 #include "platform/WebPoint.h"
 #include "platform/WebRect.h"
 #include "platform/WebSize.h"
@@ -50,7 +53,6 @@
 #include "NotificationPresenterImpl.h"
 #include "PageOverlayList.h"
 #include "UserMediaClientImpl.h"
-#include "cc/CCLayerTreeHost.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -94,7 +96,7 @@ class WebMouseWheelEvent;
 class WebSettingsImpl;
 class WebTouchEvent;
 
-class WebViewImpl : public WebView, public WebCore::CCLayerTreeHostClient, public RefCounted<WebViewImpl> {
+class WebViewImpl : public WebView, public WebLayerTreeViewClient, public RefCounted<WebViewImpl> {
 public:
     enum AutoZoomType {
         DoubleTap,
@@ -137,6 +139,7 @@ public:
     virtual void didNotAcquirePointerLock();
     virtual void didLosePointerLock();
     virtual void didChangeWindowResizerRect();
+    virtual void instrumentBeginFrame();
 
     // WebView methods:
     virtual void initializeMainFrame(WebFrameClient*);
@@ -186,6 +189,10 @@ public:
     virtual WebSize fixedLayoutSize() const;
     virtual void setFixedLayoutSize(const WebSize&);
     virtual void enableAutoResizeMode(
+        const WebSize& minSize,
+        const WebSize& maxSize);
+    virtual void disableAutoResizeMode();
+    virtual void enableAutoResizeMode(
         bool enable,
         const WebSize& minSize,
         const WebSize& maxSize);
@@ -246,13 +253,13 @@ public:
     virtual void addPageOverlay(WebPageOverlay*, int /* zOrder */);
     virtual void removePageOverlay(WebPageOverlay*);
 
-    // CCLayerTreeHostClient
+    // WebLayerTreeViewClient
     virtual void updateAnimations(double frameBeginTime);
-    virtual void applyScrollAndScale(const WebCore::IntSize&, float);
-    virtual PassRefPtr<WebCore::GraphicsContext3D> createLayerTreeHostContext3D();
+    virtual void applyScrollAndScale(const WebSize&, float);
+    virtual WebGraphicsContext3D* createContext3D();
+    virtual void didRebindGraphicsContext(bool);
     virtual void didCommitAndDrawFrame();
     virtual void didCompleteSwapBuffers();
-    virtual void didRecreateGraphicsContext(bool success);
     virtual void scheduleComposite();
 
     // WebViewImpl
@@ -434,7 +441,7 @@ public:
     bool allowsAcceleratedCompositing();
     bool pageHasRTLStyle() const;
     void setRootGraphicsLayer(WebCore::GraphicsLayer*);
-    void setRootLayerNeedsDisplay();
+    void scheduleCompositingLayerSync();
     void scrollRootLayerRect(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& clipRect);
     void invalidateRootLayerRect(const WebCore::IntRect&);
     NonCompositedContentHost* nonCompositedContentHost();
@@ -450,7 +457,9 @@ public:
     // we could not successfully instantiate a context.
     virtual WebGraphicsContext3D* graphicsContext3D();
 
-    PassRefPtr<WebCore::GraphicsContext3D> createCompositorGraphicsContext3D();
+    virtual WebGraphicsContext3D* sharedGraphicsContext3D();
+
+    PassOwnPtr<WebGraphicsContext3D> createCompositorGraphicsContext3D();
 
     virtual void setVisibilityState(WebPageVisibilityState, bool);
 
@@ -532,6 +541,7 @@ private:
                                                DragAction);
 
     void sendResizeEventAndRepaint();
+    void configureAutoResizeMode();
 
 #if USE(ACCELERATED_COMPOSITING)
     void setIsAcceleratedCompositingActive(bool);
@@ -688,7 +698,8 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     WebCore::IntRect m_rootLayerScrollDamage;
     OwnPtr<NonCompositedContentHost> m_nonCompositedContentHost;
-    RefPtr<WebCore::CCLayerTreeHost> m_layerTreeHost;
+    WebLayerTreeView m_layerTreeView;
+    WebLayer m_rootLayer;
     WebCore::GraphicsLayer* m_rootGraphicsLayer;
     bool m_isAcceleratedCompositingActive;
     bool m_compositorCreationFailed;
@@ -703,7 +714,7 @@ private:
     // If we attempt to fetch the on-screen GraphicsContext3D before
     // the compositor has been turned on, we need to instantiate it
     // early. This member holds on to the GC3D in this case.
-    RefPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
+    OwnPtr<WebGraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
     OwnPtr<GeolocationClientProxy> m_geolocationClientProxy;
 
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 1db2d1dd9..a69f01a5f 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -214,6 +214,16 @@ bool WebWorkerClientImpl::allowDatabase(WebFrame*, const WebString& name, const
         return false;
     return !webView->permissionClient() || webView->permissionClient()->allowDatabase(m_webFrame, name, displayName, estimatedSize);
 }
+
+bool WebWorkerClientImpl::allowIndexedDB(const WebString& name)
+{
+    if (m_proxy->askedToTerminate())
+        return false;
+    WebKit::WebViewImpl* webView = m_webFrame->viewImpl();
+    if (!webView)
+        return false;
+    return !webView->permissionClient() || webView->permissionClient()->allowIndexedDB(m_webFrame, name, WebSecurityOrigin());
+}
  
 WebView* WebWorkerClientImpl::view() const 
 {
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.h b/Source/WebKit/chromium/src/WebWorkerClientImpl.h
index 3d5dab0de..d47744c9c 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.h
@@ -69,45 +69,46 @@ public:
     virtual void startWorkerContext(const WebCore::KURL&,
                                     const WTF::String&,
                                     const WTF::String&,
-                                    WebCore::WorkerThreadStartMode);
-    virtual void terminateWorkerContext();
+                                    WebCore::WorkerThreadStartMode) OVERRIDE;
+    virtual void terminateWorkerContext() OVERRIDE;
     virtual void postMessageToWorkerContext(
         PassRefPtr<WebCore::SerializedScriptValue> message,
-        PassOwnPtr<WebCore::MessagePortChannelArray> channels);
-    virtual bool hasPendingActivity() const;
-    virtual void workerObjectDestroyed();
+        PassOwnPtr<WebCore::MessagePortChannelArray> channels) OVERRIDE;
+    virtual bool hasPendingActivity() const OVERRIDE;
+    virtual void workerObjectDestroyed() OVERRIDE;
 
 #if ENABLE(INSPECTOR)
-    virtual void connectToInspector(WebCore::WorkerContextProxy::PageInspector*);
-    virtual void disconnectFromInspector();
-    virtual void sendMessageToInspector(const String&);
-    virtual void postMessageToPageInspector(const String&);
-    virtual void updateInspectorStateCookie(const String&);
+    virtual void connectToInspector(WebCore::WorkerContextProxy::PageInspector*) OVERRIDE;
+    virtual void disconnectFromInspector() OVERRIDE;
+    virtual void sendMessageToInspector(const String&) OVERRIDE;
+    virtual void postMessageToPageInspector(const String&) OVERRIDE;
+    virtual void updateInspectorStateCookie(const String&) OVERRIDE;
 #endif
     // WebCore::WorkerLoaderProxy methods:
-    virtual void postTaskToLoader(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
-    virtual void postTaskForModeToWorkerContext(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode);
+    virtual void postTaskToLoader(PassOwnPtr<WebCore::ScriptExecutionContext::Task>) OVERRIDE;
+    virtual void postTaskForModeToWorkerContext(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode) OVERRIDE;
 
     // WebCore::WorkerObjectProxy methods:
-    virtual void postMessageToWorkerObject(PassRefPtr<WebCore::SerializedScriptValue>, PassOwnPtr<WebCore::MessagePortChannelArray>);
-    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void postMessageToWorkerObject(PassRefPtr<WebCore::SerializedScriptValue>, PassOwnPtr<WebCore::MessagePortChannelArray>) OVERRIDE;
+    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) OVERRIDE;
 
     virtual void postConsoleMessageToWorkerObject(WebCore::MessageSource, WebCore::MessageType, WebCore::MessageLevel,
-                                                  const String& message, int lineNumber, const String& sourceURL);
-    virtual void confirmMessageFromWorkerObject(bool);
-    virtual void reportPendingActivity(bool);
-    virtual void workerContextClosed();
-    virtual void workerContextDestroyed();
+                                                  const String& message, int lineNumber, const String& sourceURL) OVERRIDE;
+    virtual void confirmMessageFromWorkerObject(bool) OVERRIDE;
+    virtual void reportPendingActivity(bool) OVERRIDE;
+    virtual void workerContextClosed() OVERRIDE;
+    virtual void workerContextDestroyed() OVERRIDE;
 
     // WebWorkerClientBase methods:
-    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize);
+    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize) OVERRIDE;
     virtual bool allowFileSystem();
     virtual void openFileSystem(WebFileSystem::Type, long long size, bool create,
-                                WebFileSystemCallbacks*);
+                                WebFileSystemCallbacks*) OVERRIDE;
+    virtual bool allowIndexedDB(const WebString& name) OVERRIDE;
 
     // WebCommentWorkerBase methods:
-    virtual WebCommonWorkerClient* commonClient() { return this; }
-    virtual WebView* view() const;
+    virtual WebCommonWorkerClient* commonClient() OVERRIDE { return this; }
+    virtual WebView* view() const OVERRIDE;
 
 private:
     WebWorkerClientImpl(WebCore::Worker*, WebFrameImpl*);
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
index 7fbb1f468..80a26ff03 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(FILE_SYSTEM) && ENABLE(WORKERS)
 
 #include "AsyncFileSystemCallbacks.h"
+#include "BlobURL.h"
 #include "FileMetadata.h"
 #include "FileSystem.h"
 #include "NotImplemented.h"
@@ -208,6 +209,14 @@ void WorkerAsyncFileSystemChromium::createWriter(AsyncFileWriterClient* client,
     createWorkerFileSystemCallbacksBridge(WorkerFileWriterHelperCallbacks::create(client, pathAsURL, m_webFileSystem, callbacks, m_workerContext))->postReadMetadataToMainThread(m_webFileSystem, pathAsURL, m_modeForCurrentOperation);
 }
 
+void WorkerAsyncFileSystemChromium::createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    KURL pathAsURL = virtualPathToFileSystemURL(path);
+    KURL internalBlobURL = BlobURL::createInternalURL();
+
+    createWorkerFileSystemCallbacksBridge(createSnapshotFileCallback(internalBlobURL, callbacks))->postCreateSnapshotFileToMainThread(m_webFileSystem, internalBlobURL, pathAsURL, m_modeForCurrentOperation);
+}
+
 PassRefPtr<WorkerFileSystemCallbacksBridge> WorkerAsyncFileSystemChromium::createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
     ASSERT(!m_synchronous || !m_bridgeForCurrentOperation);
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
index c8ae3565f..08918518a 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
@@ -74,6 +74,7 @@ public:
     virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 private:
     WorkerAsyncFileSystemChromium(ScriptExecutionContext*, AsyncFileSystem::Type, const WebKit::WebURL& rootURL, bool synchronous);
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index b1dad7035..8fd5cfa6d 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -289,6 +289,15 @@ void WorkerFileSystemCallbacksBridge::postReadDirectoryToMainThread(WebFileSyste
                            this, mode));
 }
 
+void WorkerFileSystemCallbacksBridge::postCreateSnapshotFileToMainThread(WebFileSystem* fileSystem, const KURL& internalBlobURL, const KURL& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(
+        createCallbackTask(&createSnapshotFileOnMainThread,
+                           AllowCrossThreadAccess(fileSystem),
+                           internalBlobURL, path, this, mode));
+}
+
 void WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread(ScriptExecutionContext*, WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, bool create, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
 {
     if (!commonClient)
@@ -348,6 +357,11 @@ void WorkerFileSystemCallbacksBridge::readDirectoryOnMainThread(WebCore::ScriptE
     fileSystem->readDirectory(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
 }
 
+void WorkerFileSystemCallbacksBridge::createSnapshotFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const KURL& internalBlobURL, const KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
+{
+    fileSystem->createSnapshotFileAndReadMetadata(internalBlobURL, path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
 void WorkerFileSystemCallbacksBridge::didFailOnMainThread(WebFileError error, const String& mode)
 {
     mayPostTaskToWorker(createCallbackTask(&didFailOnWorkerThread, this, error), mode);
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
index 350839cd5..e496de2ef 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
@@ -94,6 +94,7 @@ public:
     void postFileExistsToMainThread(WebFileSystem*, const WebCore::KURL& path, const String& mode);
     void postDirectoryExistsToMainThread(WebFileSystem*, const WebCore::KURL& path, const String& mode);
     void postReadDirectoryToMainThread(WebFileSystem*, const WebCore::KURL& path, const String& mode);
+    void postCreateSnapshotFileToMainThread(WebFileSystem*, const WebCore::KURL& internalBlobURL, const WebCore::KURL& path, const String& mode);
 
     // Callback methods that are called on the main thread.
     void didFailOnMainThread(WebFileError, const String& mode);
@@ -117,6 +118,7 @@ private:
     static void fileExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
     static void directoryExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
     static void readDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
+    static void createSnapshotFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& internalBlobURL, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
 
     friend class MainThreadFileSystemCallbacks;
 
diff --git a/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png b/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
index abe8db8ec..425ab5ed2 100644
--- a/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
diff --git a/Source/WebKit/chromium/src/js/Tests.js b/Source/WebKit/chromium/src/js/Tests.js
index 16a1ba257..b8dc8de50 100644
--- a/Source/WebKit/chromium/src/js/Tests.js
+++ b/Source/WebKit/chromium/src/js/Tests.js
@@ -579,6 +579,50 @@ TestSuite.prototype.waitForTestResultsInConsole = function()
     this.takeControl();
 };
 
+TestSuite.prototype.checkLogAndErrorMessages = function()
+{
+    var messages = WebInspector.console.messages;
+
+    var matchesCount = 0;
+    function validMessage(message)
+    {
+        if (message.text === "log" && message.level === WebInspector.ConsoleMessage.MessageLevel.Log) {
+            ++matchesCount;
+            return true;
+        }
+
+        if (message.text === "error" && message.level === WebInspector.ConsoleMessage.MessageLevel.Error) {
+            ++matchesCount;
+            return true;
+        }
+        return false;
+    }
+
+    for (var i = 0; i < messages.length; ++i) {
+        if (validMessage(messages[i]))
+            continue;
+        this.fail(messages[i].text + ":" + messages[i].level); // This will throw.
+    }
+
+    if (matchesCount === 2)
+        return;
+
+    // Wait for more messages.
+    function onConsoleMessage(event)
+    {
+        var message = event.data;
+        if (validMessage(message)) {
+            if (matchesCount === 2) {
+                this.releaseControl();
+                return;
+            }
+        } else
+            this.fail(message.text + ":" + messages[i].level);
+    }
+
+    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.MessageAdded, onConsoleMessage, this);
+    this.takeControl();
+};
 
 /**
  * Serializes array of uiSourceCodes to string.
diff --git a/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp b/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp
index c71a3b6c6..9da4b4a27 100644
--- a/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp
+++ b/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp
@@ -107,7 +107,9 @@ WebKeyboardEvent WebInputEventFactory::keyboardEvent(HWND hwnd, UINT message,
     // caller, who would know for sure.
     result.timeStampSeconds = GetMessageTime() / 1000.0;
 
-    result.windowsKeyCode = result.nativeKeyCode = static_cast<int>(wparam);
+    result.windowsKeyCode = static_cast<int>(wparam);
+    // Record the scan code (along with other context bits) for this key event.
+    result.nativeKeyCode = static_cast<int>(lparam);
 
     switch (message) {
     case WM_SYSKEYDOWN: