Imported WebKit commit 20271caf2e2c016d5cef40184cddeefeac4f1876 (http://svn.webkit.org/repository/webkit/trunk@133733)

New snapshot that contains all previous fixes as well as build fix for latest QtMultimedia API changes.

96 files changed, 2065 insertions, 665 deletions

diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
index 0892f2178..3cb06b398 100644
--- a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(BATTERY_STATUS)
 
+#include "WebBatteryManagerMessages.h"
 #include "WebBatteryManagerProxyMessages.h"
 #include "WebPage.h"
 #include "WebProcess.h"
@@ -42,6 +43,7 @@ namespace WebKit {
 WebBatteryManager::WebBatteryManager(WebProcess* process)
     : m_process(process)
 {
+    m_process->addMessageReceiver(Messages::WebBatteryManager::messageReceiverName(), this);
 }
 
 WebBatteryManager::~WebBatteryManager()
diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
index 45fab18c1..d47dea4d1 100644
--- a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
@@ -28,24 +28,19 @@
 
 #if ENABLE(BATTERY_STATUS)
 
-#include "MessageID.h"
+#include "MessageReceiver.h"
 #include "WebBatteryStatus.h"
 #include "WebCoreArgumentCoders.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/AtomicString.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-}
-
 namespace WebKit {
 
 class WebPage;
 class WebProcess;
 
-class WebBatteryManager {
+class WebBatteryManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebBatteryManager);
 
 public:
@@ -58,9 +53,10 @@ public:
     void didChangeBatteryStatus(const WTF::AtomicString& eventType, const WebBatteryStatus::Data&);
     void updateBatteryStatus(const WebBatteryStatus::Data&);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
     // Implemented in generated WebBatteryManagerMessageReceiver.cpp
     void didReceiveWebBatteryManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
diff --git a/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm b/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
index daf39cdc7..0584307d6 100644
--- a/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
+++ b/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
@@ -34,12 +34,10 @@ namespace WebKit {
 
 void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
 {
-    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:static_cast<NSHTTPCookieAcceptPolicy>(policy)];
 
-#if USE(CFURLSTORAGESESSIONS)
     if (RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage())
         WKSetHTTPCookieAcceptPolicy(cookieStorage.get(), policy);
-#endif
 }
 
 HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
index a04793eb4..c9360b3ee 100644
--- a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
@@ -27,8 +27,8 @@
 #include "WebIconDatabaseProxy.h"
 
 #include "DataReference.h"
-#include "MessageID.h"
 #include "WebIconDatabaseMessages.h"
+#include "WebIconDatabaseProxyMessages.h"
 #include "WebProcess.h"
 #include <WebCore/SharedBuffer.h>
 #include <wtf/text/WTFString.h>
@@ -45,6 +45,7 @@ WebIconDatabaseProxy::WebIconDatabaseProxy(WebProcess* process)
     : m_isEnabled(false)
     , m_process(process)
 {
+    m_process->addMessageReceiver(Messages::WebIconDatabaseProxy::messageReceiverName(), this);
 }
 
 bool WebIconDatabaseProxy::isEnabled() const
@@ -61,7 +62,6 @@ void WebIconDatabaseProxy::setEnabled(bool enabled)
     setGlobalIconDatabase(enabled ? this : 0);
 }
 
-
 void WebIconDatabaseProxy::retainIconForPageURL(const String& pageURL)
 {
     m_process->connection()->send(Messages::WebIconDatabase::RetainIconForPageURL(pageURL), 0);
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
index cd9f7176e..16f8ea7a1 100644
--- a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
@@ -27,33 +27,25 @@
 #define WebIconDatabaseProxy_h
 
 #include "APIObject.h"
-
+#include "MessageReceiver.h"
 #include <WebCore/IconDatabaseBase.h>
-
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-class MessageID;
-}
-
 namespace WebKit {
 
 class WebProcess;
 
-class WebIconDatabaseProxy : public WebCore::IconDatabaseBase {
+class WebIconDatabaseProxy : public WebCore::IconDatabaseBase, private CoreIPC::MessageReceiver {
 public:
     explicit WebIconDatabaseProxy(WebProcess*);
     virtual ~WebIconDatabaseProxy();
 
     virtual bool isEnabled() const;
     void setEnabled(bool);
-    
-    
+
     virtual void retainIconForPageURL(const String&);
     virtual void releaseIconForPageURL(const String&);
     virtual void setIconURLForPageURL(const String&, const String&);
@@ -69,10 +61,12 @@ public:
     virtual void loadDecisionForIconURL(const String&, PassRefPtr<WebCore::IconLoadDecisionCallback>);
     void receivedIconLoadDecision(int decision, uint64_t callbackID);
     virtual void iconDataForIconURL(const String&, PassRefPtr<WebCore::IconDataCallback>);
-        
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-    
+
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
+    // Implemented in generated WebIconDatabaseProxyMessageReceiver.cpp
     void didReceiveWebIconDatabaseProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     
     // Callbacks from the UIProcess
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
index 7210a9d9e..95273a704 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
@@ -329,6 +329,11 @@ void WKBundleSetSerialLoadingEnabled(WKBundleRef bundleRef, bool enabled)
     toImpl(bundleRef)->setSerialLoadingEnabled(enabled);
 }
 
+void WKBundleSetShadowDOMEnabled(WKBundleRef bundleRef, bool enabled)
+{
+    toImpl(bundleRef)->setShadowDOMEnabled(enabled);
+}
+
 void WKBundleDispatchPendingLoadRequests(WKBundleRef bundleRef)
 {
     toImpl(bundleRef)->dispatchPendingLoadRequests();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
index 24188fff2..f00e03539 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
@@ -32,6 +32,7 @@
 #include "WKBundleAPICast.h"
 #include "WKData.h"
 #include "WebFrame.h"
+#include "WebSecurityOrigin.h"
 #include <WebCore/Frame.h>
 #include <WebCore/FrameView.h>
 
@@ -286,3 +287,12 @@ WKBundleHitTestResultRef WKBundleFrameCreateHitTestResult(WKBundleFrameRef frame
 {
     return toAPI(toImpl(frameRef)->hitTest(toIntPoint(point)).leakRef());
 }
+
+WKSecurityOriginRef WKBundleFrameCopySecurityOrigin(WKBundleFrameRef frameRef)
+{
+    Frame* coreFrame = toImpl(frameRef)->coreFrame();
+    if (!coreFrame)
+        return 0;
+
+    return toCopiedAPI(coreFrame->document()->securityOrigin());
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
index 021aec0ed..8c2b875f5 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
@@ -44,6 +44,7 @@ WK_EXPORT WKArrayRef WKBundleFrameCopyChildFrames(WKBundleFrameRef frame);
 WK_EXPORT WKStringRef WKBundleFrameCopyName(WKBundleFrameRef frame);
 WK_EXPORT WKURLRef WKBundleFrameCopyURL(WKBundleFrameRef frame);
 WK_EXPORT WKURLRef WKBundleFrameCopyProvisionalURL(WKBundleFrameRef frame);
+WK_EXPORT WKSecurityOriginRef WKBundleFrameCopySecurityOrigin(WKBundleFrameRef frame);
 
 WK_EXPORT WKFrameLoadState WKBundleFrameGetFrameLoadState(WKBundleFrameRef frame); 
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
index 369c4302f..15b2e7c85 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
@@ -102,6 +102,7 @@ WK_EXPORT size_t WKBundleGetWorkerThreadCount(WKBundleRef bundle);
 
 WK_EXPORT void WKBundleSetTabKeyCyclesThroughElements(WKBundleRef bundle, WKBundlePageRef page, bool enabled);
 WK_EXPORT void WKBundleSetSerialLoadingEnabled(WKBundleRef bundle, bool enabled);
+WK_EXPORT void WKBundleSetShadowDOMEnabled(WKBundleRef bundle, bool enabled);
 WK_EXPORT void WKBundleDispatchPendingLoadRequests(WKBundleRef bundle);
 
 #ifdef __cplusplus
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h
index f33e454cd..7407a9137 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h
@@ -111,6 +111,10 @@ WKDOMText *toWKDOMText(WebCore::Text*);
 WebCore::Range* toWebCoreRange(WKDOMRange *);
 WKDOMRange *toWKDOMRange(WebCore::Range*);
 
+// -- Helpers --
+
+NSArray *toNSArray(const Vector<WebCore::IntRect>&);
+
 } // namespace WebKit
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm
index ab9046613..70369afb6 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm
@@ -165,6 +165,15 @@ static WKDOMType toWKDOMType(WebCoreType impl, DOMCache<WebCoreType, WKDOMType>&
     return [wrapper autorelease];
 }
 
+NSArray *toNSArray(const Vector<WebCore::IntRect>& rects)
+{
+    size_t size = rects.size();
+    NSMutableArray *array = [NSMutableArray arrayWithCapacity:size];
+    for (size_t i = 0; i < size; ++i)
+        [array addObject:[NSValue valueWithRect:rects[i]]];
+    return array;
+}
+
 } // namespace WebKit
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h
index 40a8f9c90..d804d9641 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h
@@ -43,6 +43,7 @@ WK_EXPORT
 @property(readonly) WKDOMNode *lastChild;
 @property(readonly) WKDOMNode *previousSibling;
 @property(readonly) WKDOMNode *nextSibling;
+@property(readonly) NSArray *textRects;
 
 @end
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm
index a3296bfc0..5b86f746d 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm
@@ -30,6 +30,7 @@
 #import "WKDOMNode.h"
 
 #import "WKDOMInternals.h"
+#import <WebCore/Document.h>
 
 @implementation WKDOMNode
 
@@ -102,6 +103,16 @@
     return WebKit::toWKDOMNode(_impl->nextSibling());
 }
 
+- (NSArray *)textRects
+{
+    _impl->document()->updateLayoutIgnorePendingStylesheets();
+    if (!_impl->renderer())
+        return nil;
+    Vector<WebCore::IntRect> rects;
+    _impl->textRects(rects);
+    return WebKit::toNSArray(rects);
+}
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h
index 64ed00ce2..43b9a1c43 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h
@@ -47,6 +47,7 @@ WK_EXPORT
 @property(readonly) NSInteger endOffset;
 @property(readonly, copy) NSString *text;
 @property(readonly) BOOL isCollapsed;
+@property(readonly) NSArray *textRects;
 
 @end
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm
index 1cc408408..81f066ca1 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm
@@ -137,6 +137,14 @@
     return _impl->collapsed(ec);
 }
 
+- (NSArray *)textRects
+{
+    _impl->ownerDocument()->updateLayoutIgnorePendingStylesheets();
+    Vector<WebCore::IntRect> rects;
+    _impl->textRects(rects);
+    return WebKit::toNSArray(rects);
+}
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h
index 4a7cc50a6..f65e73b35 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h
@@ -28,6 +28,7 @@
 #import <Foundation/Foundation.h>
 #import <WebKit2/WKBase.h>
 
+@class WKConnection;
 @class WKWebProcessPlugInController;
 @class WKWebProcessPlugInBrowserContextController;
 
@@ -40,6 +41,9 @@
 
 WK_EXPORT
 @interface WKWebProcessPlugInController : NSObject
+
+@property(readonly) WKConnection *connection;
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm
index d967ec29b..cbcc8492e 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm
@@ -31,6 +31,7 @@
 #import "WKWebProcessPlugInInternal.h"
 
 #import "InjectedBundle.h"
+#import "WKConnectionInternal.h"
 #import "WKBundle.h"
 #import "WKBundleAPICast.h"
 #import "WKRetainPtr.h"
@@ -43,6 +44,7 @@ typedef HashMap<WKBundlePageRef, RetainPtr<WKWebProcessPlugInBrowserContextContr
     RetainPtr<id<WKWebProcessPlugIn> > _principalClassInstance;
     WKRetainPtr<WKBundleRef> _bundleRef;
     BundlePageWrapperCache _bundlePageWrapperCache;
+    RetainPtr<WKConnection *> _connectionWrapper;
 }
 @end
 
@@ -111,6 +113,7 @@ static WKWebProcessPlugInController *sharedInstance;
 
     _principalClassInstance = principalClassInstance;
     _bundleRef = bundleRef;
+    _connectionWrapper = adoptNS([[WKConnection alloc] _initWithConnectionRef:WKBundleGetApplicationConnection(_bundleRef.get())]);
 
     ASSERT_WITH_MESSAGE(!sharedInstance, "WKWebProcessPlugInController initialized multiple times.");
     sharedInstance = self;
@@ -124,6 +127,11 @@ static WKWebProcessPlugInController *sharedInstance;
 
 @implementation WKWebProcessPlugInController
 
+- (WKConnection *)connection
+{
+    return _connectionWrapper.get();
+}
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index 4d0aa56a3..82c122036 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -70,6 +70,10 @@
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassOwnArrayPtr.h>
 
+#if ENABLE(SHADOW_DOM)
+#include <WebCore/RuntimeEnabledFeatures.h>
+#endif
+
 using namespace WebCore;
 using namespace JSC;
 
@@ -93,7 +97,7 @@ void InjectedBundle::initializeClient(WKBundleClient* client)
 
 void InjectedBundle::postMessage(const String& messageName, APIObject* messageBody)
 {
-    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), "", 0);
+    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), CoreIPC::StringReference("PostMessage"), 0);
     encoder->encode(messageName);
     encoder->encode(InjectedBundleUserMessageEncoder(messageBody));
 
@@ -105,7 +109,7 @@ void InjectedBundle::postSynchronousMessage(const String& messageName, APIObject
     InjectedBundleUserMessageDecoder messageDecoder(returnData);
 
     uint64_t syncRequestID;
-    OwnPtr<CoreIPC::MessageEncoder> encoder = WebProcess::shared().connection()->createSyncMessageEncoder(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), "", 0, syncRequestID);
+    OwnPtr<CoreIPC::MessageEncoder> encoder = WebProcess::shared().connection()->createSyncMessageEncoder(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), CoreIPC::StringReference("PostSynchronousMessage"), 0, syncRequestID);
     encoder->encode(messageName);
     encoder->encode(InjectedBundleUserMessageEncoder(messageBody));
 
@@ -279,8 +283,9 @@ void InjectedBundle::setPopupBlockingEnabled(WebPageGroupProxy* pageGroup, bool
 
 void InjectedBundle::switchNetworkLoaderToNewTestingSession()
 {
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     // Set a private session for testing to avoid interfering with global cookies. This should be different from private browsing session.
+    // FIXME (NetworkProcess): Do this in network process, too.
     RetainPtr<CFURLStorageSessionRef> session = ResourceHandle::createPrivateBrowsingStorageSession(CFSTR("Private WebKit Session"));
     ResourceHandle::setDefaultStorageSession(session.get());
 #endif
@@ -622,6 +627,15 @@ void InjectedBundle::setSerialLoadingEnabled(bool enabled)
     resourceLoadScheduler()->setSerialLoadingEnabled(enabled);
 }
 
+void InjectedBundle::setShadowDOMEnabled(bool enabled)
+{
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setShadowDOMEnabled(enabled);
+#else
+    UNUSED_PARAM(enabled);
+#endif
+}
+
 void InjectedBundle::dispatchPendingLoadRequests()
 {
     resourceLoadScheduler()->servePendingRequests();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index 754b13320..c621f2483 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -178,6 +178,7 @@ public:
 
     void setTabKeyCyclesThroughElements(WebPage*, bool enabled);
     void setSerialLoadingEnabled(bool);
+    void setShadowDOMEnabled(bool);
     void dispatchPendingLoadRequests();
 
 private:
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h
index 49d66966a..c3fb18d30 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h
@@ -49,7 +49,7 @@ public:
     {
     }
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const 
+    void encode(CoreIPC::ArgumentEncoder& encoder) const
     {
         APIObject::Type type = APIObject::TypeNull;
         if (baseEncode(encoder, type))
@@ -58,17 +58,17 @@ public:
         switch (type) {
         case APIObject::TypeBundlePage: {
             WebPage* page = static_cast<WebPage*>(m_root);
-            encoder->encode(page->pageID());
+            encoder << page->pageID();
             break;
         }
         case APIObject::TypeBundleFrame: {
             WebFrame* frame = static_cast<WebFrame*>(m_root);
-            encoder->encode(frame->frameID());
+            encoder << frame->frameID();
             break;
         }
         case APIObject::TypeBundlePageGroup: {
             WebPageGroupProxy* pageGroup = static_cast<WebPageGroupProxy*>(m_root);
-            encoder->encode(pageGroup->pageGroupID());
+            encoder << pageGroup->pageGroupID();
             break;
         }
         default:
diff --git a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp
index dd9d6cbbc..10d672208 100644
--- a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp
@@ -42,12 +42,18 @@ NetworkProcessConnection::~NetworkProcessConnection()
 {
 }
 
-void NetworkProcessConnection::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&)
+void NetworkProcessConnection::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
 {
+    if (messageID.is<CoreIPC::MessageClassNetworkProcessConnection>()) {
+        didReceiveNetworkProcessConnectionMessage(connection, messageID, decoder);
+        return;
+    }
+    ASSERT_NOT_REACHED();
 }
 
 void NetworkProcessConnection::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&)
 {
+    ASSERT_NOT_REACHED();
 }
 
 void NetworkProcessConnection::didClose(CoreIPC::Connection*)
@@ -56,10 +62,14 @@ void NetworkProcessConnection::didClose(CoreIPC::Connection*)
     WebProcess::shared().networkProcessConnectionClosed(this);
 }
 
-void NetworkProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void NetworkProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
+void NetworkProcessConnection::startResourceLoad(ResourceLoadIdentifier resourceLoadIdentifier)
+{
+    WebProcess::shared().webResourceLoadScheduler().startResourceLoad(resourceLoadIdentifier);
+}
     
 } // namespace WebKit
 
diff --git a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h
index 65e259843..6d6a98fdd 100644
--- a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h
+++ b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h
@@ -34,6 +34,8 @@
 
 namespace WebKit {
 
+typedef uint64_t ResourceLoadIdentifier;
+
 class NetworkProcessConnection : public RefCounted<NetworkProcessConnection>, CoreIPC::Connection::Client {
 public:
     static PassRefPtr<NetworkProcessConnection> create(CoreIPC::Connection::Identifier connectionIdentifier)
@@ -51,7 +53,11 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
+
+    void didReceiveNetworkProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
+
+    void startResourceLoad(ResourceLoadIdentifier);
 
     // The connection from the web process to the network process.
     RefPtr<CoreIPC::Connection> m_connection;
diff --git a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.messages.in b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.messages.in
new file mode 100644
index 000000000..69aeabb24
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.messages.in
@@ -0,0 +1,32 @@
+# Copyright (C) 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(NETWORK_PROCESS)
+
+messages -> NetworkProcessConnection {
+
+    // FIXME (NetworkProcess): This message is for the NetworkProcess to tell the WebProcess to start a load.
+    // Once the NetworkProcess is doing the loading itself then we should remove it.
+    StartResourceLoad(uint64_t resourceLoadIdentifier)
+}
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp
new file mode 100644
index 000000000..def60e45a
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebResourceLoadScheduler.h"
+
+#include "Logging.h"
+#include "NetworkConnectionToWebProcessMessages.h"
+#include "NetworkProcessConnection.h"
+#include "WebCoreArgumentCoders.h"
+#include "WebProcess.h"
+#include <WebCore/DocumentLoader.h>
+#include <WebCore/Frame.h>
+#include <WebCore/FrameLoader.h>
+#include <WebCore/NetscapePlugInStreamLoader.h>
+#include <WebCore/ResourceLoader.h>
+#include <WebCore/SubresourceLoader.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebResourceLoadScheduler::WebResourceLoadScheduler()
+    : m_suspendPendingRequestsCount(0)
+{
+}
+
+WebResourceLoadScheduler::~WebResourceLoadScheduler()
+{
+}
+
+PassRefPtr<SubresourceLoader> WebResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, CachedResource* resource, const ResourceRequest& request, ResourceLoadPriority priority, const ResourceLoaderOptions& options)
+{
+    RefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, resource, request, options);
+    if (loader)
+        scheduleLoad(loader.get(), priority);
+    return loader.release();
+}
+
+PassRefPtr<NetscapePlugInStreamLoader> WebResourceLoadScheduler::schedulePluginStreamLoad(Frame* frame, NetscapePlugInStreamLoaderClient* client, const ResourceRequest& request)
+{
+    RefPtr<NetscapePlugInStreamLoader> loader = NetscapePlugInStreamLoader::create(frame, client, request);
+    if (loader)
+        scheduleLoad(loader.get(), ResourceLoadPriorityLow);
+    return loader.release();
+}
+
+void WebResourceLoadScheduler::scheduleLoad(ResourceLoader* resourceLoader, ResourceLoadPriority priority)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::scheduleLoad, url '%s' priority %i", resourceLoader->url().string().utf8().data(), priority);
+
+    ASSERT(resourceLoader);
+    ASSERT(priority != ResourceLoadPriorityUnresolved);
+    priority = ResourceLoadPriorityHighest;
+
+    // If there's a web archive resource for this URL, we don't need to schedule the load since it will never touch the network.
+    if (resourceLoader->documentLoader()->archiveResourceForURL(resourceLoader->request().url())) {
+        startResourceLoader(resourceLoader);
+        return;
+    }
+    
+    ResourceLoadIdentifier identifier;
+    
+    ResourceRequest request = resourceLoader->request();
+    
+    // We want the network process involved in scheduling data URL loads but it doesn't need to know the full (often long) URL.
+    if (request.url().protocolIsData()) {
+        DEFINE_STATIC_LOCAL(KURL, dataURL, (KURL(), "data:"));
+        request.setURL(dataURL);
+    }
+
+    if (!WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::ScheduleNetworkRequest(request, priority), Messages::NetworkConnectionToWebProcess::ScheduleNetworkRequest::Reply(identifier), 0)) {
+        // FIXME (NetworkProcess): What should we do if this fails?
+        ASSERT_NOT_REACHED();
+    }
+    
+    resourceLoader->setIdentifier(identifier);
+    m_pendingResourceLoaders.set(identifier, resourceLoader);
+    
+    notifyDidScheduleResourceRequest(resourceLoader);
+}
+
+void WebResourceLoadScheduler::addMainResourceLoad(ResourceLoader* resourceLoader)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::addMainResourceLoad, url '%s'", resourceLoader->url().string().utf8().data());
+
+    ResourceLoadIdentifier identifier;
+
+    if (!WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::AddLoadInProgress(resourceLoader->url()), Messages::NetworkConnectionToWebProcess::AddLoadInProgress::Reply(identifier), 0)) {
+        // FIXME (NetworkProcess): What should we do if this fails?
+        ASSERT_NOT_REACHED();
+    }
+
+    resourceLoader->setIdentifier(identifier);
+    
+    m_activeResourceLoaders.set(identifier, resourceLoader);
+}
+
+void WebResourceLoadScheduler::remove(ResourceLoader* resourceLoader)
+{
+    ASSERT(resourceLoader);
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::remove, url '%s'", resourceLoader->url().string().utf8().data());
+
+    // FIXME (NetworkProcess): It's possible for a resourceLoader to be removed before it ever started,
+    // meaning before it even has an identifier.
+    // We should make this not be possible.
+    // The ResourceLoader code path should always for an identifier to ResourceLoaders.
+    
+    ResourceLoadIdentifier identifier = resourceLoader->identifier();
+    if (!identifier) {
+        LOG_ERROR("WebResourceLoadScheduler removing a ResourceLoader that has no identifier.");
+        return;
+    }
+    
+    WebProcess::shared().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::RemoveLoadIdentifier(identifier), 0);
+    
+    ASSERT(m_pendingResourceLoaders.contains(identifier) || m_activeResourceLoaders.contains(identifier));
+    m_pendingResourceLoaders.remove(identifier);
+    m_activeResourceLoaders.remove(identifier);
+}
+
+void WebResourceLoadScheduler::crossOriginRedirectReceived(ResourceLoader* resourceLoader, const KURL& redirectURL)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::crossOriginRedirectReceived. From '%s' to '%s'", resourceLoader->url().string().utf8().data(), redirectURL.string().utf8().data());
+
+    ASSERT(resourceLoader);
+    ASSERT(resourceLoader->identifier());
+
+    if (!WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::crossOriginRedirectReceived(resourceLoader->identifier(), redirectURL), Messages::NetworkConnectionToWebProcess::crossOriginRedirectReceived::Reply(), 0)) {
+        // FIXME (NetworkProcess): What should we do if this fails?
+        ASSERT_NOT_REACHED();
+    }
+}
+
+void WebResourceLoadScheduler::servePendingRequests(ResourceLoadPriority minimumPriority)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::servePendingRequests");
+    
+    // If this WebProcess has its own request suspension count then we don't even
+    // have to bother messaging the NetworkProcess.
+    if (m_suspendPendingRequestsCount)
+        return;
+
+    WebProcess::shared().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ServePendingRequests(minimumPriority), 0);
+}
+
+void WebResourceLoadScheduler::suspendPendingRequests()
+{
+    WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::SuspendPendingRequests(), Messages::NetworkConnectionToWebProcess::SuspendPendingRequests::Reply(), 0);
+
+    ++m_suspendPendingRequestsCount;
+}
+
+void WebResourceLoadScheduler::resumePendingRequests()
+{
+    WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::ResumePendingRequests(), Messages::NetworkConnectionToWebProcess::ResumePendingRequests::Reply(), 0);
+
+    ASSERT(m_suspendPendingRequestsCount);
+    --m_suspendPendingRequestsCount;
+}
+
+void WebResourceLoadScheduler::setSerialLoadingEnabled(bool enabled)
+{
+    WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::SetSerialLoadingEnabled(enabled), Messages::NetworkConnectionToWebProcess::SetSerialLoadingEnabled::Reply(), 0);
+}
+
+void WebResourceLoadScheduler::startResourceLoad(ResourceLoadIdentifier identifier)
+{
+    RefPtr<ResourceLoader> loader = m_pendingResourceLoaders.take(identifier);
+    
+    // <rdar://problem/12596761> and http://webkit.org/b/100792
+    // There is a race condition where the WebProcess might tell the NetworkProcess to remove a resource load identifier
+    // at the very time the NetworkProcess is telling the WebProcess to start that particular load.
+    // We'd like to remove that race condition but it makes sense for release builds to do an early return.
+    ASSERT(loader);
+    if (!loader)
+        return;
+    
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::startResourceLoad starting load for '%s'", loader->url().string().utf8().data());
+
+    m_activeResourceLoaders.set(identifier, loader);
+
+    startResourceLoader(loader.get());
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.h b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.h
new file mode 100644
index 000000000..422427bc6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebResourceLoadScheduler_h
+#define WebResourceLoadScheduler_h
+
+#include <WebCore/ResourceLoadPriority.h>
+#include <WebCore/ResourceLoadScheduler.h>
+#include <WebCore/ResourceLoader.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+namespace WebKit {
+
+class NetworkProcessConnection;
+typedef uint64_t ResourceLoadIdentifier;
+
+class WebResourceLoadScheduler : public WebCore::ResourceLoadScheduler {
+    WTF_MAKE_NONCOPYABLE(WebResourceLoadScheduler); WTF_MAKE_FAST_ALLOCATED;
+public:
+    WebResourceLoadScheduler();
+    virtual ~WebResourceLoadScheduler();
+    
+    virtual PassRefPtr<WebCore::SubresourceLoader> scheduleSubresourceLoad(WebCore::Frame*, WebCore::CachedResource*, const WebCore::ResourceRequest&, WebCore::ResourceLoadPriority, const WebCore::ResourceLoaderOptions&) OVERRIDE;
+    virtual PassRefPtr<WebCore::NetscapePlugInStreamLoader> schedulePluginStreamLoad(WebCore::Frame*, WebCore::NetscapePlugInStreamLoaderClient*, const WebCore::ResourceRequest&) OVERRIDE;
+    
+    virtual void addMainResourceLoad(WebCore::ResourceLoader*) OVERRIDE;
+    virtual void remove(WebCore::ResourceLoader*) OVERRIDE;
+    virtual void crossOriginRedirectReceived(WebCore::ResourceLoader*, const WebCore::KURL& redirectURL) OVERRIDE;
+    
+    virtual void servePendingRequests(WebCore::ResourceLoadPriority minimumPriority = WebCore::ResourceLoadPriorityVeryLow) OVERRIDE;
+
+    virtual void suspendPendingRequests() OVERRIDE;
+    virtual void resumePendingRequests() OVERRIDE;
+
+    virtual void setSerialLoadingEnabled(bool) OVERRIDE;
+
+private:
+    void scheduleLoad(WebCore::ResourceLoader*, WebCore::ResourceLoadPriority);
+
+    // NetworkProcessConnection gets to tell loads to actually start.
+    // FIXME (NetworkProcess): Once actual loading takes place in the NetworkProcess we won't need this.
+    friend class NetworkProcessConnection;
+    void startResourceLoad(ResourceLoadIdentifier);
+    
+    typedef HashMap<unsigned long, RefPtr<WebCore::ResourceLoader> > ResourceLoaderMap;
+    ResourceLoaderMap m_pendingResourceLoaders;
+    ResourceLoaderMap m_activeResourceLoaders;
+    
+    unsigned m_suspendPendingRequestsCount;
+
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
+
+#endif // WebResourceLoadScheduler_h
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
index 631f02234..cba67fedb 100644
--- a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(NETWORK_INFO)
 
+#include "WebNetworkInfoManagerMessages.h"
 #include "WebNetworkInfoManagerProxyMessages.h"
 #include "WebPage.h"
 #include "WebProcess.h"
@@ -42,6 +43,7 @@ namespace WebKit {
 WebNetworkInfoManager::WebNetworkInfoManager(WebProcess* process)
     : m_process(process)
 {
+    m_process->addMessageReceiver(Messages::WebNetworkInfoManager::messageReceiverName(), this);
 }
 
 WebNetworkInfoManager::~WebNetworkInfoManager()
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
index dfe9afa95..ee3282f4f 100644
--- a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
@@ -28,24 +28,19 @@
 
 #if ENABLE(NETWORK_INFO)
 
-#include "MessageID.h"
+#include "MessageReceiver.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebNetworkInfo.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/AtomicString.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-}
-
 namespace WebKit {
 
 class WebProcess;
 class WebPage;
 
-class WebNetworkInfoManager {
+class WebNetworkInfoManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebNetworkInfoManager);
 public:
     explicit WebNetworkInfoManager(WebProcess*);
@@ -56,10 +51,10 @@ public:
 
     double bandwidth(WebPage*) const;
     bool metered(WebPage*) const;
-
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
     // Implemented in generated WebNetworkInfoManagerMessageReceiver.cpp
     void didReceiveWebNetworkInfoManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
index fb42bcc43..35070e144 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
@@ -31,6 +31,7 @@
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
 #include "WebNotification.h"
+#include "WebNotificationManagerMessages.h"
 #include "WebNotificationManagerProxyMessages.h"
 #include "WebPageProxyMessages.h"
 #include <WebCore/Document.h>
@@ -57,6 +58,9 @@ static uint64_t generateNotificationID()
 WebNotificationManager::WebNotificationManager(WebProcess* process)
     : m_process(process)
 {
+#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
+    m_process->addMessageReceiver(Messages::WebNotificationManager::messageReceiverName(), this);
+#endif
 }
 
 WebNotificationManager::~WebNotificationManager()
@@ -170,7 +174,7 @@ void WebNotificationManager::cancel(Notification* notification, WebPage* page)
     if (!notificationID)
         return;
     
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::Cancel(notificationID), page->pageID());
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::Cancel(notificationID), 0);
 #else
     UNUSED_PARAM(notification);
     UNUSED_PARAM(page);
@@ -185,7 +189,7 @@ void WebNotificationManager::clearNotifications(WebCore::ScriptExecutionContext*
         return;
     
     Vector<uint64_t>& notificationIDs = it->value;
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::ClearNotifications(notificationIDs), page->pageID());
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::ClearNotifications(notificationIDs), 0);
     size_t count = notificationIDs.size();
     for (size_t i = 0; i < count; ++i) {
         RefPtr<Notification> notification = m_notificationIDMap.take(notificationIDs[i]);
@@ -211,7 +215,7 @@ void WebNotificationManager::didDestroyNotification(Notification* notification,
 
     m_notificationIDMap.remove(notificationID);
     removeNotificationFromContextMap(notificationID, notification);
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::DidDestroyNotification(notificationID), page->pageID());
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::DidDestroyNotification(notificationID), 0);
 #else
     UNUSED_PARAM(notification);
     UNUSED_PARAM(page);
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
index a3f658f24..9f505aa90 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
@@ -26,7 +26,7 @@
 #ifndef WebNotificationManager_h
 #define WebNotificationManager_h
 
-#include "MessageID.h"
+#include "MessageReceiver.h"
 #include <WebCore/NotificationClient.h>
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
@@ -34,11 +34,6 @@
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-}
-
 namespace WebCore {
 class Notification;
 class SecurityOrigin;
@@ -49,7 +44,7 @@ namespace WebKit {
 class WebPage;
 class WebProcess;
 
-class WebNotificationManager {
+class WebNotificationManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebNotificationManager);
 public:
     explicit WebNotificationManager(WebProcess*);
@@ -63,7 +58,6 @@ public:
     // This callback comes from WebCore, not messaged from the UI process.
     void didDestroyNotification(WebCore::Notification*, WebPage*);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     void didUpdateNotificationDecision(const String& originString, bool allowed);
 
     // Looks in local cache for permission. If not found, returns DefaultDenied.
@@ -73,6 +67,9 @@ public:
     uint64_t notificationIDForTesting(WebCore::Notification*);
 
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
     // Implemented in generated WebNotificationManagerMessageReceiver.cpp
     void didReceiveWebNotificationManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
index 27b10e726..5da43a7e4 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
@@ -52,12 +52,13 @@ namespace WebKit {
 class PluginDestructionProtector {
 public:
     explicit PluginDestructionProtector(NetscapePlugin* plugin)
-        : m_protector(static_cast<Plugin*>(plugin)->controller())
     {
+        if (plugin)
+            m_protector = adoptPtr(new PluginController::PluginDestructionProtector(static_cast<Plugin*>(plugin)->controller()));
     }
     
 private:
-    PluginController::PluginDestructionProtector m_protector;
+    OwnPtr<PluginController::PluginDestructionProtector> m_protector;
 };
 
 static bool startsWithBlankLine(const char* bytes, unsigned length)
@@ -272,8 +273,8 @@ static String makeURLString(const char* url)
     String urlString(url);
     
     // Strip return characters.
-    urlString.replace('\r', "");
-    urlString.replace('\n', "");
+    urlString.replaceWithLiteral('\r', "");
+    urlString.replaceWithLiteral('\n', "");
 
     return urlString;
 }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index 374eb4414..3b9c6125b 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -112,12 +112,10 @@ NetscapePlugin::~NetscapePlugin()
 
 PassRefPtr<NetscapePlugin> NetscapePlugin::fromNPP(NPP npp)
 {
-    if (npp)
-        return static_cast<NetscapePlugin*>(npp->ndata);
+    if (!npp)
+        return 0;
 
-    // FIXME: Return the current NetscapePlugin here.
-    ASSERT_NOT_REACHED();
-    return 0;
+    return static_cast<NetscapePlugin*>(npp->ndata);
 }
 
 void NetscapePlugin::invalidate(const NPRect* invalidRect)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFLayerControllerDetails.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFLayerControllerDetails.h
new file mode 100644
index 000000000..6e7b52af2
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFLayerControllerDetails.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <PDFKit/PDFKit.h>
+
+@protocol PDFLayerControllerDelegate <NSObject>
+
+- (void)updateScrollPosition:(CGPoint)newPosition;
+- (void)writeItemsToPasteboard:(NSArray *)items withTypes:(NSArray *)types;
+- (void)showDefinitionForAttributedString:(NSAttributedString *)string atPoint:(CGPoint)point;
+- (void)performWebSearch:(NSString *)string;
+- (void)openWithPreview;
+- (void)saveToPDF;
+
+- (void)pdfLayerController:(PDFLayerController *)pdfLayerController didChangeActiveAnnotation:(PDFAnnotation *)annotation;
+
+@end
+
+@interface PDFLayerController : NSObject
+@end
+
+@interface PDFLayerController (Details)
+
+@property(retain) CALayer *parentLayer;
+@property(retain) PDFDocument *document;
+@property(retain) id<PDFLayerControllerDelegate> delegate;
+
+- (void)setFrameSize:(CGSize)size;
+
+- (void)setDisplayMode:(int)mode;
+- (void)setDisplaysPageBreaks:(BOOL)pageBreaks;
+
+- (CGFloat)tileScaleFactor;
+- (void)setTileScaleFactor:(CGFloat)scaleFactor;
+
+- (CGSize)contentSize;
+- (CGSize)contentSizeRespectingZoom;
+
+- (void)snapshotInContext:(CGContextRef)context;
+
+- (void)magnifyWithMagnification:(CGFloat)magnification atPoint:(CGPoint)point immediately:(BOOL)immediately;
+
+- (CGPoint)scrollPosition;
+- (void)setScrollPosition:(CGPoint)newPosition;
+- (void)scrollWithDelta:(CGSize)delta;
+
+- (void)mouseDown:(NSEvent *)event;
+- (void)mouseMoved:(NSEvent *)event;
+- (void)mouseUp:(NSEvent *)event;
+- (void)mouseDragged:(NSEvent *)event;
+- (void)mouseEntered:(NSEvent *)event;
+- (void)mouseExited:(NSEvent *)event;
+
+- (NSArray *)findString:(NSString *)string caseSensitive:(BOOL)isCaseSensitive highlightMatches:(BOOL)shouldHighlightMatches;
+
+- (id)currentSelection;
+- (void)copySelection;
+- (void)selectAll;
+
+- (bool)keyDown:(NSEvent *)event;
+
+- (void)setHUDEnabled:(BOOL)enabled;
+- (BOOL)hudEnabled;
+
+- (CGRect)boundsForAnnotation:(PDFAnnotation *)annotation;
+
+@end
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h
index cd58d8721..d3641b66b 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h
@@ -38,15 +38,18 @@ typedef const struct OpaqueJSContext* JSContextRef;
 typedef struct OpaqueJSValue* JSObjectRef;
 typedef const struct OpaqueJSValue* JSValueRef;
 
+OBJC_CLASS PDFAnnotation;
 OBJC_CLASS PDFLayerController;
 OBJC_CLASS WKPDFLayerControllerDelegate;
 
 namespace WebCore {
+class Element;
 struct PluginInfo;
 }
 
 namespace WebKit {
 
+class PDFPluginAnnotation;
 class PluginView;
 class WebFrame;
 
@@ -56,6 +59,7 @@ public:
     ~PDFPlugin();
 
     void paintControlForLayerInContext(CALayer *, CGContextRef);
+    void setActiveAnnotation(PDFAnnotation *);
     
     using ScrollableArea::notifyScrollPositionChanged;
 
@@ -77,13 +81,15 @@ private:
     virtual bool handleKeyboardEvent(const WebKeyboardEvent&) OVERRIDE;
     virtual bool handleEditingCommand(const String& commandName, const String& argument) OVERRIDE;
     virtual bool isEditingCommandEnabled(const String&) OVERRIDE;
-    virtual bool handlesPageScaleFactor() OVERRIDE { return true; }
+    virtual bool handlesPageScaleFactor() OVERRIDE;
 
     // ScrollableArea functions.
     virtual void setScrollOffset(const WebCore::IntPoint&) OVERRIDE;
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&) OVERRIDE;
     virtual void invalidateScrollCornerRect(const WebCore::IntRect&) OVERRIDE;
 
+    bool supportsForms();
+
     RetainPtr<CALayer> m_containerLayer;
     RetainPtr<CALayer> m_contentLayer;
     RetainPtr<CALayer> m_horizontalScrollbarLayer;
@@ -91,6 +97,9 @@ private:
     RetainPtr<CALayer> m_scrollCornerLayer;
     RetainPtr<PDFLayerController> m_pdfLayerController;
     
+    RefPtr<PDFPluginAnnotation> m_activeAnnotation;
+    RefPtr<WebCore::Element> m_annotationContainer;
+
     WebCore::AffineTransform m_rootViewToPluginTransform;
     WebCore::IntPoint m_lastMousePoint;
     
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm
index c5a3469cd..b09c80b6c 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm
@@ -29,6 +29,8 @@
 #import "PDFPlugin.h"
 
 #import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import "PDFPluginAnnotation.h"
 #import "PluginView.h"
 #import "ShareableBitmap.h"
 #import "WebEvent.h"
@@ -36,12 +38,15 @@
 #import <PDFKit/PDFKit.h>
 #import <QuartzCore/QuartzCore.h>
 #import <WebCore/ArchiveResource.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
 #import <WebCore/Chrome.h>
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/FocusController.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/GraphicsContext.h>
+#import <WebCore/HTMLElement.h>
 #import <WebCore/HTTPHeaderMap.h>
 #import <WebCore/LocalizedStrings.h>
 #import <WebCore/Page.h>
@@ -51,73 +56,35 @@
 #import <WebCore/ScrollAnimator.h>
 #import <WebCore/ScrollbarTheme.h>
 
-@protocol PDFLayerControllerDelegate <NSObject>
-
-- (void)updateScrollPosition:(CGPoint)newPosition;
-- (void)writeItemsToPasteboard:(NSArray *)items withTypes:(NSArray *)types;
-- (void)showDefinitionForAttributedString:(NSAttributedString *)string atPoint:(CGPoint)point;
-- (void)performWebSearch:(NSString *)string;
-- (void)openWithPreview;
-- (void)saveToPDF;
-
-@end
-
-@interface PDFLayerController : NSObject
-@end
-
-@interface PDFLayerController (Details)
-
-@property (retain) CALayer *parentLayer;
-@property (retain) PDFDocument *document;
-@property (retain) id<PDFLayerControllerDelegate> delegate;
-
-- (void)setFrameSize:(CGSize)size;
-
-- (void)setDisplayMode:(int)mode;
-- (void)setDisplaysPageBreaks:(BOOL)pageBreaks;
-
-- (CGFloat)tileScaleFactor;
-- (void)setTileScaleFactor:(CGFloat)scaleFactor;
-
-- (CGSize)contentSize;
-- (CGSize)contentSizeRespectingZoom;
-
-- (void)snapshotInContext:(CGContextRef)context;
-
-- (void)magnifyWithMagnification:(CGFloat)magnification atPoint:(CGPoint)point immediately:(BOOL)immediately;
-
-- (CGPoint)scrollPosition;
-- (void)setScrollPosition:(CGPoint)newPosition;
-- (void)scrollWithDelta:(CGSize)delta;
-
-- (void)mouseDown:(NSEvent *)event;
-- (void)mouseMoved:(NSEvent *)event;
-- (void)mouseUp:(NSEvent *)event;
-- (void)mouseDragged:(NSEvent *)event;
-- (void)mouseEntered:(NSEvent *)event;
-- (void)mouseExited:(NSEvent *)event;
-
-- (NSArray *)findString:(NSString *)string caseSensitive:(BOOL)isCaseSensitive highlightMatches:(BOOL)shouldHighlightMatches;
-
-- (id)currentSelection;
-- (void)copySelection;
-- (void)selectAll;
-
-- (bool)keyDown:(NSEvent *)event;
-
-- (void)setHUDEnabled:(BOOL)enabled;
-- (BOOL)hudEnabled;
-
-@end
-
 using namespace WebCore;
 
+// Set overflow: hidden on the annotation container so <input> elements scrolled out of view don't show
+// scrollbars on the body. We can't add annotations directly to the body, because overflow: hidden on the body
+// will break rubber-banding.
+static const char* annotationStyle =
+"#annotationContainer {"
+"    overflow: hidden; "
+"    position: absolute; "
+"    pointer-events: none; "
+"    top: 0; "
+"    left: 0; "
+"    right: 0; "
+"    bottom: 0; "
+"} "
+".annotation { "
+"    position: absolute; "
+"    pointer-events: auto; "
+"} "
+"textarea.annotation { "
+"    resize: none; "
+"}";
+
 @interface WKPDFPluginScrollbarLayer : CALayer
 {
     WebKit::PDFPlugin* _pdfPlugin;
 }
 
-@property (assign) WebKit::PDFPlugin* pdfPlugin;
+@property(assign) WebKit::PDFPlugin* pdfPlugin;
 
 @end
 
@@ -152,7 +119,7 @@ using namespace WebCore;
     WebKit::PDFPlugin* _pdfPlugin;
 }
 
-@property (assign) WebKit::PDFPlugin* pdfPlugin;
+@property(assign) WebKit::PDFPlugin* pdfPlugin;
 
 @end
 
@@ -208,10 +175,17 @@ using namespace WebCore;
     // FIXME: Implement.
 }
 
+- (void)pdfLayerController:(PDFLayerController *)pdfLayerController didChangeActiveAnnotation:(PDFAnnotation *)annotation
+{
+    _pdfPlugin->setActiveAnnotation(annotation);
+}
+
 @end
 
 namespace WebKit {
 
+using namespace HTMLNames;
+
 PassRefPtr<PDFPlugin> PDFPlugin::create(WebFrame* frame)
 {
     return adoptRef(new PDFPlugin(frame));
@@ -227,7 +201,19 @@ PDFPlugin::PDFPlugin(WebFrame* frame)
 {
     m_pdfLayerController.get().delegate = m_pdfLayerControllerDelegate.get();
     m_pdfLayerController.get().parentLayer = m_contentLayer.get();
-    
+
+    if (supportsForms()) {
+        Document* document = webFrame()->coreFrame()->document();
+        m_annotationContainer = document->createElement(divTag, false);
+        m_annotationContainer->setAttribute(idAttr, "annotationContainer");
+
+        RefPtr<Element> m_annotationStyle = document->createElement(styleTag, false);
+        m_annotationStyle->setTextContent(annotationStyle, ASSERT_NO_EXCEPTION);
+
+        m_annotationContainer->appendChild(m_annotationStyle.get());
+        document->body()->appendChild(m_annotationContainer.get());
+    }
+
     [m_containerLayer.get() addSublayer:m_contentLayer.get()];
     [m_containerLayer.get() addSublayer:m_scrollCornerLayer.get()];
 }
@@ -298,7 +284,10 @@ void PDFPlugin::pdfDocumentDidLoad()
     [m_pdfLayerController.get() setFrameSize:size()];
     m_pdfLayerController.get().document = document.get();
     
-    pluginView()->setPageScaleFactor([m_pdfLayerController.get() tileScaleFactor], IntPoint());
+    if (handlesPageScaleFactor())
+        pluginView()->setPageScaleFactor([m_pdfLayerController.get() tileScaleFactor], IntPoint());
+
+    notifyScrollPositionChanged(IntPoint([m_pdfLayerController.get() scrollPosition]));
 
     calculateSizes();
     updateScrollbars();
@@ -325,6 +314,9 @@ void PDFPlugin::destroy()
             frameView->removeScrollableArea(this);
     }
 
+    m_activeAnnotation = 0;
+    m_annotationContainer = 0;
+
     destroyScrollbar(HorizontalScrollbar);
     destroyScrollbar(VerticalScrollbar);
     
@@ -400,16 +392,24 @@ void PDFPlugin::geometryDidChange(const IntSize& pluginSize, const IntRect&, con
     [CATransaction begin];
     [CATransaction setDisableActions:YES];
     CATransform3D transform = CATransform3DMakeScale(1, -1, 1);
+    transform = CATransform3DTranslate(transform, 0, -pluginSize.height(), 0);
     
-    CGFloat magnification = pluginView()->pageScaleFactor() - [m_pdfLayerController.get() tileScaleFactor];
-    
-    // FIXME: Instead of m_lastMousePoint, we should use the zoom origin from PluginView::setPageScaleFactor.
-    [m_pdfLayerController.get() magnifyWithMagnification:magnification atPoint:m_lastMousePoint immediately:YES];
-    [m_contentLayer.get() setSublayerTransform:CATransform3DTranslate(transform, 0, -pluginSize.height(), 0)];
-    [CATransaction commit];
+    if (handlesPageScaleFactor()) {
+        CGFloat magnification = pluginView()->pageScaleFactor() - [m_pdfLayerController.get() tileScaleFactor];
+
+        // FIXME: Instead of m_lastMousePoint, we should use the zoom origin from PluginView::setPageScaleFactor.
+        if (magnification)
+            [m_pdfLayerController.get() magnifyWithMagnification:magnification atPoint:m_lastMousePoint immediately:YES];
+    }
 
     calculateSizes();
     updateScrollbars();
+
+    if (m_activeAnnotation)
+        m_activeAnnotation->updateGeometry();
+
+    [m_contentLayer.get() setSublayerTransform:transform];
+    [CATransaction commit];
 }
     
 static NSUInteger modifierFlagsFromWebEvent(const WebEvent& event)
@@ -561,7 +561,14 @@ bool PDFPlugin::isEditingCommandEnabled(const String& commandName)
 void PDFPlugin::setScrollOffset(const IntPoint& offset)
 {
     SimplePDFPlugin::setScrollOffset(offset);
+
+    [CATransaction begin];
     [m_pdfLayerController.get() setScrollPosition:offset];
+
+    if (m_activeAnnotation)
+        m_activeAnnotation->updateGeometry();
+
+    [CATransaction commit];
 }
 
 void PDFPlugin::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
@@ -577,6 +584,32 @@ void PDFPlugin::invalidateScrollCornerRect(const IntRect& rect)
     [m_scrollCornerLayer.get() setNeedsDisplay];
 }
 
+bool PDFPlugin::handlesPageScaleFactor()
+{
+    return webFrame()->isMainFrame();
+}
+
+void PDFPlugin::setActiveAnnotation(PDFAnnotation *annotation)
+{
+    if (!supportsForms())
+        return;
+
+    if (m_activeAnnotation)
+        m_activeAnnotation->commit();
+
+    if (annotation) {
+        m_activeAnnotation = PDFPluginAnnotation::create(annotation, m_pdfLayerController.get(), this);
+        m_activeAnnotation->attach(m_annotationContainer.get());
+    } else
+        m_activeAnnotation = 0;
+}
+
+bool PDFPlugin::supportsForms()
+{
+    // FIXME: Should we support forms for inline PDFs? Since we touch the document, this might be difficult.
+    return webFrame()->isMainFrame();
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.h
new file mode 100644
index 000000000..d6e3ee661
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PDFPluginAnnotation_h
+#define PDFPluginAnnotation_h
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#include <WebCore/EventListener.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+class Document;
+class Element;
+}
+
+OBJC_CLASS PDFAnnotation;
+OBJC_CLASS PDFLayerController;
+
+namespace WebKit {
+
+class PDFPlugin;
+
+class PDFPluginAnnotation : public RefCounted<PDFPluginAnnotation> {
+public:
+    static PassRefPtr<PDFPluginAnnotation> create(PDFAnnotation *, PDFLayerController *, PDFPlugin*);
+    virtual ~PDFPluginAnnotation();
+
+    WebCore::Element* element() const { return m_element.get(); }
+    PDFAnnotation *annotation() const { return m_annotation.get(); }
+    PDFPlugin* plugin() const { return m_plugin; }
+
+    virtual void updateGeometry();
+    virtual void commit() = 0;
+
+    void attach(WebCore::Element*);
+
+protected:
+    PDFPluginAnnotation(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+        : m_annotation(annotation)
+        , m_eventListener(PDFPluginAnnotationEventListener::create(this))
+        , m_pdfLayerController(pdfLayerController)
+        , m_plugin(plugin)
+    {
+    }
+
+    WebCore::Element* parent() const { return m_parent; }
+    PDFLayerController *pdfLayerController() const { return m_pdfLayerController; }
+
+private:
+    virtual PassRefPtr<WebCore::Element> createAnnotationElement() = 0;
+
+    class PDFPluginAnnotationEventListener : public WebCore::EventListener {
+    public:
+        static PassRefPtr<PDFPluginAnnotationEventListener> create(PDFPluginAnnotation* annotation)
+        {
+            return adoptRef(new PDFPluginAnnotationEventListener(annotation));
+        }
+
+        virtual bool operator==(const EventListener& listener) OVERRIDE { return this == &listener; }
+
+    private:
+
+        PDFPluginAnnotationEventListener(PDFPluginAnnotation* annotation)
+            : WebCore::EventListener(WebCore::EventListener::CPPEventListenerType)
+            , m_annotation(annotation)
+        {
+        }
+
+        virtual void handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) OVERRIDE;
+
+        PDFPluginAnnotation* m_annotation;
+    };
+
+    WebCore::Element* m_parent;
+
+    RefPtr<WebCore::Element> m_element;
+    RetainPtr<PDFAnnotation> m_annotation;
+
+    RefPtr<PDFPluginAnnotationEventListener> m_eventListener;
+
+    PDFLayerController *m_pdfLayerController;
+    PDFPlugin* m_plugin;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
+
+#endif // PDFPluginAnnotation_h
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm
new file mode 100644
index 000000000..efbc19d0b
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#import "config.h"
+#import "PDFPluginAnnotation.h"
+
+#import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import "PDFPlugin.h"
+#import "PDFPluginChoiceAnnotation.h"
+#import "PDFPluginTextAnnotation.h"
+#import <PDFKit/PDFKit.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
+#import <WebCore/ColorMac.h>
+#import <WebCore/HTMLElement.h>
+#import <WebCore/HTMLInputElement.h>
+#import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLOptionElement.h>
+#import <WebCore/HTMLSelectElement.h>
+#import <WebCore/HTMLTextAreaElement.h>
+#import <WebCore/Page.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+using namespace HTMLNames;
+
+PassRefPtr<PDFPluginAnnotation> PDFPluginAnnotation::create(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+{
+    if ([annotation isKindOfClass:pdfAnnotationTextWidgetClass()])
+        return PDFPluginTextAnnotation::create(annotation, pdfLayerController, plugin);
+    if ([annotation isKindOfClass:pdfAnnotationChoiceWidgetClass()])
+        return PDFPluginChoiceAnnotation::create(annotation, pdfLayerController, plugin);
+
+    return 0;
+}
+
+void PDFPluginAnnotation::attach(Element* parent)
+{
+    ASSERT(!m_parent);
+
+    m_parent = parent;
+    m_element = createAnnotationElement();
+
+    m_element->setAttribute(classAttr, "annotation");
+    m_element->addEventListener("change", m_eventListener, false);
+    m_element->addEventListener("blur", m_eventListener, false);
+
+    updateGeometry();
+
+    m_parent->appendChild(m_element);
+
+    // FIXME: The text cursor doesn't blink after this. Why?
+    m_element->focus();
+}
+
+PDFPluginAnnotation::~PDFPluginAnnotation()
+{
+    m_element->removeEventListener(eventNames().changeEvent, m_eventListener.get(), false);
+    m_element->removeEventListener(eventNames().blurEvent, m_eventListener.get(), false);
+
+    m_parent->removeChild(element());
+}
+
+void PDFPluginAnnotation::updateGeometry()
+{
+    IntSize documentSize(m_pdfLayerController.contentSizeRespectingZoom);
+    IntPoint scrollPosition(m_pdfLayerController.scrollPosition);
+    NSRect annotationRect = NSRectFromCGRect([m_pdfLayerController boundsForAnnotation:m_annotation.get()]);
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element());
+    styledElement->setInlineStyleProperty(CSSPropertyWidth, annotationRect.size.width, CSSPrimitiveValue::CSS_PX);
+    styledElement->setInlineStyleProperty(CSSPropertyHeight, annotationRect.size.height, CSSPrimitiveValue::CSS_PX);
+    styledElement->setInlineStyleProperty(CSSPropertyLeft, annotationRect.origin.x - scrollPosition.x(), CSSPrimitiveValue::CSS_PX);
+    styledElement->setInlineStyleProperty(CSSPropertyTop, documentSize.height() - annotationRect.origin.y - annotationRect.size.height - scrollPosition.y(), CSSPrimitiveValue::CSS_PX);
+}
+
+void PDFPluginAnnotation::PDFPluginAnnotationEventListener::handleEvent(ScriptExecutionContext*, Event* event)
+{
+    if (event->type() == eventNames().blurEvent || event->type() == eventNames().changeEvent)
+        m_annotation->plugin()->setActiveAnnotation(0);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h
new file mode 100644
index 000000000..ea0e8308e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PDFPluginChoiceAnnotation_h
+#define PDFPluginChoiceAnnotation_h
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#include "PDFPluginAnnotation.h"
+
+namespace WebCore {
+class Element;
+}
+
+OBJC_CLASS PDFAnnotationChoiceWidget;
+
+namespace WebKit {
+
+class PDFPluginChoiceAnnotation : public PDFPluginAnnotation {
+public:
+    static PassRefPtr<PDFPluginChoiceAnnotation> create(PDFAnnotation *, PDFLayerController *, PDFPlugin*);
+
+    virtual void updateGeometry() OVERRIDE;
+    virtual void commit() OVERRIDE;
+
+private:
+    PDFPluginChoiceAnnotation(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+        : PDFPluginAnnotation(annotation, pdfLayerController, plugin)
+    {
+    }
+
+    virtual PassRefPtr<WebCore::Element> createAnnotationElement() OVERRIDE;
+
+    PDFAnnotationChoiceWidget *choiceAnnotation() { return static_cast<PDFAnnotationChoiceWidget *>(annotation()); }
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
+
+#endif // PDFPluginChoiceAnnotation_h
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm
new file mode 100644
index 000000000..fe996967e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#import "config.h"
+#import "PDFPluginChoiceAnnotation.h"
+
+#import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import <PDFKit/PDFKit.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
+#import <WebCore/ColorMac.h>
+#import <WebCore/HTMLElement.h>
+#import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLOptionElement.h>
+#import <WebCore/HTMLSelectElement.h>
+#import <WebCore/Page.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+using namespace HTMLNames;
+
+PassRefPtr<PDFPluginChoiceAnnotation> PDFPluginChoiceAnnotation::create(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+{
+    return adoptRef(new PDFPluginChoiceAnnotation(annotation, pdfLayerController, plugin));
+}
+
+void PDFPluginChoiceAnnotation::updateGeometry()
+{
+    PDFPluginAnnotation::updateGeometry();
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element());
+    styledElement->setInlineStyleProperty(CSSPropertyFontSize, choiceAnnotation().font.pointSize * pdfLayerController().tileScaleFactor, CSSPrimitiveValue::CSS_PX);
+}
+
+void PDFPluginChoiceAnnotation::commit()
+{
+    choiceAnnotation().stringValue = static_cast<HTMLSelectElement*>(element())->value();
+}
+
+PassRefPtr<Element> PDFPluginChoiceAnnotation::createAnnotationElement()
+{
+    Document* document = parent()->ownerDocument();
+    PDFAnnotationChoiceWidget *choiceAnnotation = this->choiceAnnotation();
+
+    RefPtr<Element> element = document->createElement(selectTag, false);
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element.get());
+
+    // FIXME: Match font weight and style as well?
+    styledElement->setInlineStyleProperty(CSSPropertyColor, colorFromNSColor(choiceAnnotation.fontColor).serialized());
+    styledElement->setInlineStyleProperty(CSSPropertyFontFamily, choiceAnnotation.font.familyName);
+
+    NSArray *choices = choiceAnnotation.choices;
+    NSString *selectedChoice = choiceAnnotation.stringValue;
+
+    for (NSString *choice in choices) {
+        RefPtr<Element> choiceOption = document->createElement(optionTag, false);
+        choiceOption->setAttribute(valueAttr, choice);
+        choiceOption->setTextContent(choice, ASSERT_NO_EXCEPTION);
+
+        if (choice == selectedChoice)
+            choiceOption->setAttribute(selectedAttr, "selected");
+
+        styledElement->appendChild(choiceOption);
+    }
+
+    return element;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h
new file mode 100644
index 000000000..626628ebe
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PDFPluginTextAnnotation_h
+#define PDFPluginTextAnnotation_h
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#include "PDFPluginAnnotation.h"
+
+namespace WebCore {
+class Element;
+}
+
+OBJC_CLASS PDFAnnotationTextWidget;
+
+namespace WebKit {
+
+class PDFPluginTextAnnotation : public PDFPluginAnnotation {
+public:
+    static PassRefPtr<PDFPluginTextAnnotation> create(PDFAnnotation *, PDFLayerController *, PDFPlugin*);
+
+    virtual void updateGeometry() OVERRIDE;
+    virtual void commit() OVERRIDE;
+
+private:
+    PDFPluginTextAnnotation(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+        : PDFPluginAnnotation(annotation, pdfLayerController, plugin)
+    {
+    }
+
+    virtual PassRefPtr<WebCore::Element> createAnnotationElement() OVERRIDE;
+
+    PDFAnnotationTextWidget * textAnnotation() { return static_cast<PDFAnnotationTextWidget *>(annotation()); }
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
+
+#endif // PDFPluginTextAnnotation_h
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm
new file mode 100644
index 000000000..c94ea15f6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#import "config.h"
+#import "PDFPluginTextAnnotation.h"
+
+#import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import <PDFKit/PDFKit.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
+#import <WebCore/ColorMac.h>
+#import <WebCore/HTMLElement.h>
+#import <WebCore/HTMLInputElement.h>
+#import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLTextAreaElement.h>
+#import <WebCore/Page.h>
+
+@interface PDFAnnotationTextWidget (Details)
+- (BOOL)isMultiline;
+@end
+
+using namespace WebCore;
+
+namespace WebKit {
+
+using namespace HTMLNames;
+
+static const String cssAlignmentValueForNSTextAlignment(NSTextAlignment alignment)
+{
+    switch (alignment) {
+    case NSLeftTextAlignment:
+        return "left";
+    case NSRightTextAlignment:
+        return "right";
+    case NSCenterTextAlignment:
+        return "center";
+    case NSJustifiedTextAlignment:
+        return "justify";
+    case NSNaturalTextAlignment:
+        return "-webkit-start";
+    }
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+PassRefPtr<PDFPluginTextAnnotation> PDFPluginTextAnnotation::create(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+{
+    return adoptRef(new PDFPluginTextAnnotation(annotation, pdfLayerController, plugin));
+}
+
+PassRefPtr<Element> PDFPluginTextAnnotation::createAnnotationElement()
+{
+    RefPtr<Element> element;
+
+    Document* document = parent()->ownerDocument();
+    PDFAnnotationTextWidget *textAnnotation = this->textAnnotation();
+    bool isMultiline = textAnnotation.isMultiline;
+
+    if (isMultiline)
+        element = document->createElement(textareaTag, false);
+    else
+        element = document->createElement(inputTag, false);
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element.get());
+
+    // FIXME: Match font weight and style as well?
+    styledElement->setInlineStyleProperty(CSSPropertyColor, colorFromNSColor(textAnnotation.fontColor).serialized());
+    styledElement->setInlineStyleProperty(CSSPropertyFontFamily, textAnnotation.font.familyName);
+    styledElement->setInlineStyleProperty(CSSPropertyTextAlign, cssAlignmentValueForNSTextAlignment(textAnnotation.alignment));
+
+    if (isMultiline)
+        static_cast<HTMLTextAreaElement*>(styledElement)->setValue(textAnnotation.stringValue);
+    else
+        static_cast<HTMLInputElement*>(styledElement)->setValue(textAnnotation.stringValue);
+
+    return element;
+}
+
+void PDFPluginTextAnnotation::updateGeometry()
+{
+    PDFPluginAnnotation::updateGeometry();
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element());
+    styledElement->setInlineStyleProperty(CSSPropertyFontSize, textAnnotation().font.pointSize * pdfLayerController().tileScaleFactor, CSSPrimitiveValue::CSS_PX);
+}
+
+void PDFPluginTextAnnotation::commit()
+{
+    PDFAnnotationTextWidget *textAnnotation = this->textAnnotation();
+
+    if (textAnnotation.isMultiline)
+        textAnnotation.stringValue = static_cast<HTMLTextAreaElement*>(element())->value();
+    else
+        textAnnotation.stringValue = static_cast<HTMLInputElement*>(element())->value();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.cpp b/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
index bc884b962..12e0b3d31 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
@@ -32,16 +32,16 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void Plugin::Parameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void Plugin::Parameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(url.string());
-    encoder->encode(names);
-    encoder->encode(values);
-    encoder->encode(mimeType);
-    encoder->encode(isFullFramePlugin);
-    encoder->encode(shouldUseManualLoader);
+    encoder << url.string();
+    encoder << names;
+    encoder << values;
+    encoder << mimeType;
+    encoder << isFullFramePlugin;
+    encoder << shouldUseManualLoader;
 #if PLATFORM(MAC)
-    encoder->encodeEnum(layerHostingMode);
+    encoder.encodeEnum(layerHostingMode);
 #endif
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.h b/Source/WebKit2/WebProcess/Plugins/Plugin.h
index 98f8770c1..ded53d157 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.h
@@ -77,7 +77,7 @@ public:
         LayerHostingMode layerHostingMode;
 #endif
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Parameters&);
     };
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
index fcfb249ad..648a51eb8 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
@@ -129,7 +129,7 @@ void PluginProcessConnection::didClose(CoreIPC::Connection*)
     }
 }
 
-void PluginProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void PluginProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
index 2dc2cca59..bc6558ffd 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
@@ -67,7 +67,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 
     // Message handlers.
     void didReceiveSyncPluginProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
index d0a5e1e2c..e82704105 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
@@ -61,6 +61,7 @@
 #include <WebCore/SecurityPolicy.h>
 #include <WebCore/Settings.h>
 #include <WebCore/UserGestureIndicator.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace JSC;
 using namespace WebCore;
@@ -162,23 +163,22 @@ static String buildHTTPHeaders(const ResourceResponse& response, long long& expe
     if (!response.isHTTP())
         return String();
 
-    Vector<UChar> stringBuilder;
-    String separator(": ");
+    StringBuilder stringBuilder;
     
     String statusLine = String::format("HTTP %d ", response.httpStatusCode());
-    stringBuilder.append(statusLine.characters(), statusLine.length());
-    stringBuilder.append(response.httpStatusText().characters(), response.httpStatusText().length());
+    stringBuilder.append(statusLine);
+    stringBuilder.append(response.httpStatusText());
     stringBuilder.append('\n');
     
     HTTPHeaderMap::const_iterator end = response.httpHeaderFields().end();
     for (HTTPHeaderMap::const_iterator it = response.httpHeaderFields().begin(); it != end; ++it) {
-        stringBuilder.append(it->key.characters(), it->key.length());
-        stringBuilder.append(separator.characters(), separator.length());
-        stringBuilder.append(it->value.characters(), it->value.length());
+        stringBuilder.append(it->key);
+        stringBuilder.appendLiteral(": ");
+        stringBuilder.append(it->value);
         stringBuilder.append('\n');
     }
     
-    String headers = String::adopt(stringBuilder);
+    String headers = stringBuilder.toString();
     
     // If the content is encoded (most likely compressed), then don't send its length to the plugin,
     // which is only interested in the decoded length, not yet known at the moment.
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
index 6810f0abd..395649c50 100644
--- a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
@@ -118,8 +118,7 @@ void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData,
 #if USE(CFURLCACHE)
     if (resourceCachesToClear != InMemoryResourceCachesOnly) { 
         RetainPtr<CFMutableArrayRef> hostArray(AdoptCF, CFArrayCreateMutable(0, 0, &kCFTypeArrayCallBacks));
-        RetainPtr<CFStringRef> host(AdoptCF, origin->host().createCFString());
-        CFArrayAppendValue(hostArray.get(), host.get());
+        CFArrayAppendValue(hostArray.get(), origin->host().createCFString().get());
 
         clearCFURLCacheForHostNames(hostArray.get());
     }
diff --git a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp
index 538007d4f..9c142d8a8 100644
--- a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp
@@ -51,7 +51,7 @@ WebConnectionToUIProcess::WebConnectionToUIProcess(WebProcess* process, CoreIPC:
 
 void WebConnectionToUIProcess::encodeMessageBody(CoreIPC::ArgumentEncoder& encoder, APIObject* messageBody)
 {
-    encoder.encode(InjectedBundleUserMessageEncoder(messageBody));
+    encoder << InjectedBundleUserMessageEncoder(messageBody);
 }
 
 bool WebConnectionToUIProcess::decodeMessageBody(CoreIPC::ArgumentDecoder& decoder, RefPtr<APIObject>& messageBody)
@@ -81,9 +81,9 @@ void WebConnectionToUIProcess::didClose(CoreIPC::Connection* connection)
     m_process->didClose(connection);
 }
 
-void WebConnectionToUIProcess::didReceiveInvalidMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID)
+void WebConnectionToUIProcess::didReceiveInvalidMessage(CoreIPC::Connection* connection, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName)
 {
-    m_process->didReceiveInvalidMessage(connection, messageID);
+    m_process->didReceiveInvalidMessage(connection, messageReceiverName, messageName);
 }
 
 #if PLATFORM(WIN)
diff --git a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h
index af591115b..7f3f1fdb1 100644
--- a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h
+++ b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h
@@ -48,7 +48,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)  OVERRIDE;
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 #if PLATFORM(WIN)
     virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
 #endif
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index ac3daa908..3e7fe3294 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -473,19 +473,28 @@ void WebChromeClient::scrollRectIntoView(const IntRect&) const
 
 bool WebChromeClient::shouldUnavailablePluginMessageBeButton(RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason) const
 {
-    if (pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::InsecurePluginVersion) {
+    switch (pluginUnavailabilityReason) {
+    case RenderEmbeddedObject::PluginMissing:
         // FIXME: <rdar://problem/8794397> We should only return true when there is a
         // missingPluginButtonClicked callback defined on the Page UI client.
+    case RenderEmbeddedObject::InsecurePluginVersion:
+    case RenderEmbeddedObject::PluginInactive:
         return true;
+
+
+    case RenderEmbeddedObject::PluginCrashed:
+    case RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy:
+        return false;
     }
 
+    ASSERT_NOT_REACHED();
     return false;
 }
     
 void WebChromeClient::unavailablePluginButtonClicked(Element* element, RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason) const
 {
     ASSERT(element->hasTagName(objectTag) || element->hasTagName(embedTag) || element->hasTagName(appletTag));
-    ASSERT(pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::InsecurePluginVersion);
+    ASSERT(pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::InsecurePluginVersion || pluginUnavailabilityReason == RenderEmbeddedObject::PluginInactive);
 
     HTMLPlugInImageElement* pluginElement = static_cast<HTMLPlugInImageElement*>(element);
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 1a1206a4b..dd3e50926 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -201,6 +201,7 @@ bool WebFrameLoaderClient::shouldUseCredentialStorage(DocumentLoader*, unsigned
     return webPage->injectedBundleResourceLoadClient().shouldUseCredentialStorage(webPage, m_frame, identifier);
 }
 
+#if !PLATFORM(GTK)
 void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoader*, unsigned long, const AuthenticationChallenge& challenge)
 {
     // FIXME: Authentication is a per-resource concept, but we don't do per-resource handling in the UIProcess at the API level quite yet.
@@ -212,6 +213,7 @@ void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoa
 
     AuthenticationManager::shared().didReceiveAuthenticationChallenge(m_frame, challenge);
 }
+#endif
 
 void WebFrameLoaderClient::dispatchDidCancelAuthenticationChallenge(DocumentLoader*, unsigned long /*identifier*/, const AuthenticationChallenge&)    
 {
@@ -1234,6 +1236,11 @@ void WebFrameLoaderClient::transitionToCommittedForNewPage()
 
     m_frame->coreFrame()->createView(webPage->size(), backgroundColor, /* transparent */ false, IntSize(), currentFixedVisibleContentRect, shouldUseFixedLayout);
     m_frame->coreFrame()->view()->setTransparent(!webPage->drawsBackground());
+
+#if USE(TILED_BACKING_STORE)
+    m_frame->coreFrame()->view()->setDelegatesScrolling(shouldUseFixedLayout);
+    m_frame->coreFrame()->view()->setPaintsEntireContents(shouldUseFixedLayout);
+#endif
 }
 
 void WebFrameLoaderClient::didSaveToPageCache()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 62f900400..f12b85196 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -37,6 +37,7 @@
 #include "WebProcessProxyMessages.h"
 #include <WebCore/Color.h>
 #include <WebCore/KURL.h>
+#include <WebCore/LoaderStrategy.h>
 #include <WebCore/Page.h>
 #include <WebCore/PlatformPasteboard.h>
 #include <wtf/Atomics.h>
@@ -68,17 +69,27 @@ CookiesStrategy* WebPlatformStrategies::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* WebPlatformStrategies::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return this;
+}
+
 PluginStrategy* WebPlatformStrategies::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
+SharedWorkerStrategy* WebPlatformStrategies::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
     return this;
 }
@@ -90,6 +101,23 @@ void WebPlatformStrategies::notifyCookiesChanged()
     WebCookieManager::shared().dispatchCookiesDidChange();
 }
 
+// LoaderStrategy
+
+#if ENABLE(NETWORK_PROCESS)
+ResourceLoadScheduler* WebPlatformStrategies::resourceLoadScheduler()
+{
+    static ResourceLoadScheduler* scheduler;
+    if (!scheduler) {
+        if (WebProcess::shared().usesNetworkProcess())
+            scheduler = &WebProcess::shared().webResourceLoadScheduler();
+        else
+            scheduler = WebCore::resourceLoadScheduler();
+    }
+    
+    return scheduler;
+}
+#endif
+
 // PluginStrategy
 
 void WebPlatformStrategies::refreshPlugins()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
index dfbcc334c..bb644b1ab 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
@@ -29,14 +29,16 @@
 #if USE(PLATFORM_STRATEGIES)
 
 #include <WebCore/CookiesStrategy.h>
+#include <WebCore/LoaderStrategy.h>
 #include <WebCore/PasteboardStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
+#include <WebCore/SharedWorkerStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
 namespace WebKit {
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy, private WebCore::PasteboardStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PasteboardStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -45,13 +47,20 @@ private:
     
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy() OVERRIDE;
+    virtual WebCore::LoaderStrategy* createLoaderStrategy() OVERRIDE;
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
     virtual WebCore::PluginStrategy* createPluginStrategy() OVERRIDE;
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy() OVERRIDE;
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy() OVERRIDE;
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged() OVERRIDE;
 
+    // WebCore::LoaderStrategy
+#if ENABLE(NETWORK_PROCESS)
+    virtual WebCore::ResourceLoadScheduler* resourceLoadScheduler() OVERRIDE;
+#endif
+
     // WebCore::PluginStrategy
     virtual void refreshPlugins() OVERRIDE;
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&) OVERRIDE;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
index 22a5cf453..8dc90d00d 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
@@ -27,12 +27,15 @@
 #include "WebEditorClient.h"
 
 #include "Frame.h"
+#include "NativeWebKeyboardEvent.h"
 #include "PlatformKeyboardEvent.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
+#include <WebCore/FocusController.h>
 #include <WebCore/KeyboardEvent.h>
 #include <WebCore/NotImplemented.h>
+#include <WebCore/Page.h>
 
 using namespace WebCore;
 
@@ -44,9 +47,18 @@ void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
         event->setDefaultHandled();
 }
 
-void WebEditorClient::handleInputMethodKeydown(KeyboardEvent*)
+void WebEditorClient::handleInputMethodKeydown(KeyboardEvent* event)
 {
-    notImplemented();
+    Frame* frame = m_page->corePage()->focusController()->focusedOrMainFrame();
+    if (!frame || !frame->editor()->canEdit())
+        return;
+
+    // FIXME: sending sync message might make input lagging.
+    bool handled = false;
+    m_page->sendSync(Messages::WebPageProxy::HandleInputMethodKeydown(), Messages::WebPageProxy::HandleInputMethodKeydown::Reply(handled));
+
+    if (handled)
+        event->setDefaultHandled();
 }
 
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp
new file mode 100644
index 000000000..a6ff36e5f
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012, Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY IGALIA S.L. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "WebFrameLoaderClient.h"
+
+#include <WebCore/AuthenticationChallenge.h>
+#include <WebCore/GtkAuthenticationDialog.h>
+#include <WebCore/ResourceHandle.h>
+
+namespace WebKit {
+
+using WebCore::GtkAuthenticationDialog;
+using WebCore::AuthenticationChallenge;
+
+void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long, const AuthenticationChallenge& challenge)
+{
+    GtkAuthenticationDialog* dialog = new GtkAuthenticationDialog(0, challenge);
+    dialog->show();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
index aef59ca86..08db0ad3b 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
@@ -100,7 +100,6 @@ void InitWebCoreSystemInterface(void)
         INIT(SetCGFontRenderingMode);
         INIT(SetCONNECTProxyAuthorizationForStream);
         INIT(SetCONNECTProxyForStream);
-        INIT(SetCookieStoragePrivateBrowsingEnabled);
         INIT(SetDragImage);
         INIT(SetHTTPPipeliningMaximumPriority);
         INIT(SetHTTPPipeliningPriority);
@@ -117,8 +116,10 @@ void InitWebCoreSystemInterface(void)
         INIT(CopyHTTPCookieStorage);
         INIT(GetHTTPCookieAcceptPolicy);
         INIT(SetHTTPCookieAcceptPolicy);
+        INIT(HTTPCookies);
         INIT(HTTPCookiesForURL);
         INIT(SetHTTPCookiesForURL);
+        INIT(DeleteAllHTTPCookies);
         INIT(DeleteHTTPCookie);
 
         INIT(SetMetadataURL);
@@ -192,5 +193,17 @@ void InitWebCoreSystemInterface(void)
         INIT(NSReboundDeltaForElasticDelta);
 #endif
 
+        INIT(CaptionAppearanceHasUserPreferences);
+        INIT(CaptionAppearanceShowCaptionsWhenAvailable);
+        INIT(CaptionAppearanceCopyForegroundColor);
+        INIT(CaptionAppearanceCopyBackgroundColor);
+        INIT(CaptionAppearanceCopyWindowColor);
+        INIT(CaptionAppearanceGetForegroundOpacity);
+        INIT(CaptionAppearanceGetBackgroundOpacity);
+        INIT(CaptionAppearanceGetWindowOpacity);
+        INIT(CaptionAppearanceCopyFontForStyle);
+        INIT(CaptionAppearanceGetRelativeCharacterSize);
+        INIT(CaptionAppearanceGetTextEdgeStyle);
+        INIT(CaptionAppearanceGetSettingsChangedNotification);
     });
 }
diff --git a/Source/WebKit2/WebProcess/WebKitMain.cpp b/Source/WebKit2/WebProcess/WebKitMain.cpp
index c3fa98ebe..0d2a0e193 100644
--- a/Source/WebKit2/WebProcess/WebKitMain.cpp
+++ b/Source/WebKit2/WebProcess/WebKitMain.cpp
@@ -60,11 +60,9 @@ static int WebKitMain(const CommandLine& commandLine)
         case ProcessLauncher::PluginProcess:
             return PluginProcessMain(commandLine);
 #endif
-        case ProcessLauncher::NetworkProcess:
 #if ENABLE(NETWORK_PROCESS)
+        case ProcessLauncher::NetworkProcess:
             return NetworkProcessMain(commandLine);
-#else
-            break;
 #endif
 #if ENABLE(SHARED_WORKER_PROCESS)
         case ProcessLauncher::SharedWorkerProcess:
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
index 79c8eec5c..26e48d61c 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
@@ -47,15 +47,6 @@ static HashMap<WebLayerID, CoordinatedGraphicsLayer*>& layerByIDMap()
     return globalMap;
 }
 
-CoordinatedGraphicsLayer* CoordinatedGraphicsLayer::layerByID(WebKit::WebLayerID id)
-{
-    HashMap<WebLayerID, CoordinatedGraphicsLayer*>& table = layerByIDMap();
-    HashMap<WebLayerID, CoordinatedGraphicsLayer*>::iterator it = table.find(id);
-    if (it == table.end())
-        return 0;
-    return it->value;
-}
-
 static WebLayerID toWebLayerID(GraphicsLayer* layer)
 {
     return layer ? toCoordinatedGraphicsLayer(layer)->id() : 0;
@@ -68,9 +59,9 @@ void CoordinatedGraphicsLayer::didChangeLayerState()
         client()->notifyFlushRequired(this);
 }
 
-void CoordinatedGraphicsLayer::didChangeAnimatedProperties()
+void CoordinatedGraphicsLayer::didChangeAnimations()
 {
-    m_shouldSyncAnimatedProperties = true;
+    m_shouldSyncAnimations = true;
     if (client())
         client()->notifyFlushRequired(this);
 }
@@ -93,9 +84,6 @@ void CoordinatedGraphicsLayer::didChangeFilters()
 
 void CoordinatedGraphicsLayer::setShouldUpdateVisibleRect()
 {
-    if (!transform().isAffine())
-        return;
-
     m_shouldUpdateVisibleRect = true;
     for (size_t i = 0; i < children().size(); ++i)
         toCoordinatedGraphicsLayer(children()[i])->setShouldUpdateVisibleRect();
@@ -117,7 +105,7 @@ CoordinatedGraphicsLayer::CoordinatedGraphicsLayer(GraphicsLayerClient* client)
     , m_shouldSyncLayerState(true)
     , m_shouldSyncChildren(true)
     , m_shouldSyncFilters(true)
-    , m_shouldSyncAnimatedProperties(true)
+    , m_shouldSyncAnimations(true)
     , m_fixedToViewport(false)
     , m_canvasNeedsDisplay(false)
     , m_CoordinatedGraphicsLayerClient(0)
@@ -141,11 +129,6 @@ CoordinatedGraphicsLayer::~CoordinatedGraphicsLayer()
     willBeDestroyed();
 }
 
-void CoordinatedGraphicsLayer::willBeDestroyed()
-{
-    GraphicsLayer::willBeDestroyed();
-}
-
 bool CoordinatedGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
 {
     bool ok = GraphicsLayer::setChildren(children);
@@ -493,32 +476,23 @@ void CoordinatedGraphicsLayer::syncLayerState()
     m_layerInfo.mask = toWebLayerID(maskLayer());
     m_layerInfo.masksToBounds = masksToBounds();
     m_layerInfo.opacity = opacity();
-    m_layerInfo.parent = toWebLayerID(parent());
     m_layerInfo.pos = position();
     m_layerInfo.preserves3D = preserves3D();
     m_layerInfo.replica = toWebLayerID(replicaLayer());
     m_layerInfo.size = size();
     m_layerInfo.transform = transform();
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
-        m_effectiveTransform = transform();
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
-        m_effectiveOpacity = opacity();
     m_CoordinatedGraphicsLayerClient->syncLayerState(m_id, m_layerInfo);
 }
 
-void CoordinatedGraphicsLayer::syncAnimatedProperties()
+void CoordinatedGraphicsLayer::syncAnimations()
 {
-    m_animations.apply(this);
-    if (!m_shouldSyncAnimatedProperties)
+    if (!m_shouldSyncAnimations)
         return;
 
-    m_shouldSyncAnimatedProperties = false;
-    if (m_effectiveOpacity != opacity())
-        m_CoordinatedGraphicsLayerClient->setLayerAnimatedOpacity(id(), m_effectiveOpacity);
-    if (m_effectiveTransform != transform())
-        m_CoordinatedGraphicsLayerClient->setLayerAnimatedTransform(id(), m_effectiveTransform);
-}
+    m_shouldSyncAnimations = false;
 
+    m_CoordinatedGraphicsLayerClient->setLayerAnimations(m_id, m_animations);
+}
 
 void CoordinatedGraphicsLayer::syncCanvas()
 {
@@ -550,7 +524,7 @@ void CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly()
     // The remote image might have been released by purgeBackingStores.
     ensureImageBackingStore();
     syncLayerState();
-    syncAnimatedProperties();
+    syncAnimations();
     computeTransformedVisibleRect();
     syncChildren();
 #if ENABLE(CSS_FILTERS)
@@ -662,9 +636,9 @@ Color CoordinatedGraphicsLayer::tiledBackingStoreBackgroundColor() const
     return contentsOpaque() ? Color::white : Color::transparent;
 }
 
-PassOwnPtr<WebCore::GraphicsContext> CoordinatedGraphicsLayer::beginContentUpdate(const WebCore::IntSize& size, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
+PassOwnPtr<WebCore::GraphicsContext> CoordinatedGraphicsLayer::beginContentUpdate(const WebCore::IntSize& size, int& atlas, WebCore::IntPoint& offset)
 {
-    return m_CoordinatedGraphicsLayerClient->beginContentUpdate(size, contentsOpaque() ? 0 : ShareableBitmap::SupportsAlpha, handle, offset);
+    return m_CoordinatedGraphicsLayerClient->beginContentUpdate(size, contentsOpaque() ? 0 : ShareableBitmap::SupportsAlpha, atlas, offset);
 }
 
 void CoordinatedGraphicsLayer::createTile(int tileID, const SurfaceUpdateInfo& updateInfo, const IntRect& targetRect)
@@ -749,12 +723,30 @@ void CoordinatedGraphicsLayer::adjustVisibleRect()
         m_mainBackingStore->coverWithTilesIfNeeded();
 }
 
+bool CoordinatedGraphicsLayer::hasPendingVisibleChanges()
+{
+    if (opacity() < 0.01 && !m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
+        return false;
+
+    for (size_t i = 0; i < children().size(); ++i) {
+        if (toCoordinatedGraphicsLayer(children()[i])->hasPendingVisibleChanges())
+            return true;
+    }
+
+    if (!m_shouldSyncLayerState && !m_shouldSyncChildren && !m_shouldSyncFilters && !m_shouldSyncAnimations && !m_canvasNeedsDisplay)
+        return false;
+
+    return selfOrAncestorHaveNonAffineTransforms() || !tiledBackingStoreVisibleRect().isEmpty();
+
+}
+
 void CoordinatedGraphicsLayer::computeTransformedVisibleRect()
 {
     if (!m_shouldUpdateVisibleRect)
         return;
+
     m_shouldUpdateVisibleRect = false;
-    m_layerTransform.setLocalTransform(m_effectiveTransform);
+    m_layerTransform.setLocalTransform(transform());
     m_layerTransform.setPosition(position());
     m_layerTransform.setAnchorPoint(anchorPoint());
     m_layerTransform.setSize(size());
@@ -779,13 +771,16 @@ void CoordinatedGraphicsLayer::initFactory()
 
 bool CoordinatedGraphicsLayer::selfOrAncestorHaveNonAffineTransforms()
 {
+    if (m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
+        return true;
+
     if (!m_layerTransform.combined().isAffine())
         return true;
 
     return false;
 }
 
-bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
+bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double delayAsNegativeTimeOffset)
 {
     ASSERT(!keyframesName.isEmpty());
 
@@ -798,39 +793,28 @@ bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList,
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         listsMatch = validateTransformOperations(valueList, ignoredHasBigRotation) >= 0;
 
-    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, timeOffset, listsMatch));
+    m_lastAnimationStartTime = WTF::currentTime() - delayAsNegativeTimeOffset;
+    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, m_lastAnimationStartTime, listsMatch));
     m_animationStartedTimer.startOneShot(0);
-    didChangeLayerState();
+    didChangeAnimations();
     return true;
 }
 
-void CoordinatedGraphicsLayer::pauseAnimation(const String& animationName, double timeOffset)
+void CoordinatedGraphicsLayer::pauseAnimation(const String& animationName, double time)
 {
-    m_animations.pause(animationName, timeOffset);
+    m_animations.pause(animationName, time);
+    didChangeAnimations();
 }
 
 void CoordinatedGraphicsLayer::removeAnimation(const String& animationName)
 {
     m_animations.remove(animationName);
+    didChangeAnimations();
 }
 
 void CoordinatedGraphicsLayer::animationStartedTimerFired(Timer<CoordinatedGraphicsLayer>*)
 {
-    client()->notifyAnimationStarted(this, /* DOM time */ WTF::currentTime());
+    client()->notifyAnimationStarted(this, m_lastAnimationStartTime);
 }
-
-void CoordinatedGraphicsLayer::setAnimatedTransform(const TransformationMatrix& transform)
-{
-    m_effectiveTransform = transform;
-    didChangeAnimatedProperties();
-    m_shouldUpdateVisibleRect = true;
-}
-
-void CoordinatedGraphicsLayer::setAnimatedOpacity(float opacity)
-{
-    m_effectiveOpacity = opacity;
-    didChangeAnimatedProperties();
-}
-
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
index 049991070..1188aa75f 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
@@ -42,6 +42,7 @@
 #if USE(COORDINATED_GRAPHICS)
 namespace WebCore {
 class CoordinatedGraphicsLayer;
+class GraphicsLayerAnimations;
 }
 
 namespace WebKit {
@@ -66,117 +67,130 @@ public:
     virtual void syncCanvas(WebLayerID, const WebCore::IntSize& canvasSize, const WebCore::GraphicsSurfaceToken&, uint32_t frontBuffer) = 0;
 #endif
 
-    virtual void setLayerAnimatedOpacity(WebLayerID, float) = 0;
-    virtual void setLayerAnimatedTransform(WebLayerID, const WebCore::TransformationMatrix&) = 0;
+    virtual void setLayerAnimations(WebLayerID, const WebCore::GraphicsLayerAnimations&) = 0;
 
     virtual void attachLayer(WebCore::CoordinatedGraphicsLayer*) = 0;
     virtual void detachLayer(WebCore::CoordinatedGraphicsLayer*) = 0;
     virtual void syncFixedLayers() = 0;
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, ShareableSurface::Handle&, WebCore::IntPoint&) = 0;
+    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, int& atlasID, WebCore::IntPoint&) = 0;
 };
 }
 
 namespace WebCore {
 
-class CoordinatedGraphicsLayer : public WebCore::GraphicsLayer
-                       , public TiledBackingStoreClient
-                       , public WebKit::CoordinatedTileClient
-                       , public GraphicsLayerAnimation::Client {
+class CoordinatedGraphicsLayer : public GraphicsLayer
+    , public TiledBackingStoreClient
+    , public WebKit::CoordinatedTileClient {
 public:
     CoordinatedGraphicsLayer(GraphicsLayerClient*);
     virtual ~CoordinatedGraphicsLayer();
 
     // Reimplementations from GraphicsLayer.h.
-    bool setChildren(const Vector<GraphicsLayer*>&);
-    void addChild(GraphicsLayer*);
-    void addChildAtIndex(GraphicsLayer*, int);
-    void addChildAbove(GraphicsLayer*, GraphicsLayer*);
-    void addChildBelow(GraphicsLayer*, GraphicsLayer*);
-    bool replaceChild(GraphicsLayer*, GraphicsLayer*);
-    void removeFromParent();
-    void setPosition(const FloatPoint&);
-    void setAnchorPoint(const FloatPoint3D&);
-    void setSize(const FloatSize&);
-    void setTransform(const TransformationMatrix&);
-    void setChildrenTransform(const TransformationMatrix&);
-    void setPreserves3D(bool);
-    void setMasksToBounds(bool);
-    void setDrawsContent(bool);
-    void setContentsVisible(bool);
-    void setContentsOpaque(bool);
-    void setBackfaceVisibility(bool);
-    void setOpacity(float);
-    void setContentsRect(const IntRect&);
-    void setContentsToImage(Image*);
-    void setContentsToCanvas(PlatformLayer*);
-    void setMaskLayer(GraphicsLayer*);
-    void setReplicatedByLayer(GraphicsLayer*);
-    void setNeedsDisplay();
-    void setNeedsDisplayInRect(const FloatRect&);
-    void setContentsNeedsDisplay();
-    void setContentsScale(float);
-    void setVisibleContentRectTrajectoryVector(const FloatPoint&);
-    virtual void flushCompositingState(const FloatRect&);
-    virtual void flushCompositingStateForThisLayerOnly();
+    virtual bool setChildren(const Vector<GraphicsLayer*>&) OVERRIDE;
+    virtual void addChild(GraphicsLayer*) OVERRIDE;
+    virtual void addChildAtIndex(GraphicsLayer*, int) OVERRIDE;
+    virtual void addChildAbove(GraphicsLayer*, GraphicsLayer*) OVERRIDE;
+    virtual void addChildBelow(GraphicsLayer*, GraphicsLayer*) OVERRIDE;
+    virtual bool replaceChild(GraphicsLayer*, GraphicsLayer*) OVERRIDE;
+    virtual void removeFromParent() OVERRIDE;
+    virtual void setPosition(const FloatPoint&) OVERRIDE;
+    virtual void setAnchorPoint(const FloatPoint3D&) OVERRIDE;
+    virtual void setSize(const FloatSize&) OVERRIDE;
+    virtual void setTransform(const TransformationMatrix&) OVERRIDE;
+    virtual void setChildrenTransform(const TransformationMatrix&) OVERRIDE;
+    virtual void setPreserves3D(bool) OVERRIDE;
+    virtual void setMasksToBounds(bool) OVERRIDE;
+    virtual void setDrawsContent(bool) OVERRIDE;
+    virtual void setContentsVisible(bool) OVERRIDE;
+    virtual void setContentsOpaque(bool) OVERRIDE;
+    virtual void setBackfaceVisibility(bool) OVERRIDE;
+    virtual void setOpacity(float) OVERRIDE;
+    virtual void setContentsRect(const IntRect&) OVERRIDE;
+    virtual void setContentsToImage(Image*) OVERRIDE;
+    virtual void setContentsToCanvas(PlatformLayer*) OVERRIDE;
+    virtual void setMaskLayer(GraphicsLayer*) OVERRIDE;
+    virtual void setReplicatedByLayer(GraphicsLayer*) OVERRIDE;
+    virtual void setNeedsDisplay() OVERRIDE;
+    virtual void setNeedsDisplayInRect(const FloatRect&) OVERRIDE;
+    virtual void setContentsNeedsDisplay() OVERRIDE;
+    virtual void flushCompositingState(const FloatRect&) OVERRIDE;
+    virtual void flushCompositingStateForThisLayerOnly() OVERRIDE;
 #if ENABLE(CSS_FILTERS)
-    bool setFilters(const FilterOperations&);
+    virtual bool setFilters(const FilterOperations&) OVERRIDE;
 #endif
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize&, const Animation*, const String&, double) OVERRIDE;
+    virtual void pauseAnimation(const String&, double) OVERRIDE;
+    virtual void removeAnimation(const String&) OVERRIDE;
+    
+    void setContentsScale(float);
+    void setVisibleContentRectTrajectoryVector(const FloatPoint&);
 
     void setRootLayer(bool);
 
     WebKit::WebLayerID id() const;
-    static CoordinatedGraphicsLayer* layerByID(WebKit::WebLayerID);
-    void didSynchronize();
-    Image* image() { return m_image.get(); }
 
-    bool fixedToViewport() const { return m_fixedToViewport; }
     void setFixedToViewport(bool isFixed) { m_fixedToViewport = isFixed; }
 
-    GraphicsLayer* maskTarget() const { return m_maskTarget; }
-    void setMaskTarget(GraphicsLayer* layer) { m_maskTarget = layer; }
     IntRect coverRect() const { return m_mainBackingStore ? m_mainBackingStore->mapToContents(m_mainBackingStore->coverRect()) : IntRect(); }
 
     static void initFactory();
 
     // TiledBackingStoreClient
-    virtual void tiledBackingStorePaintBegin();
-    virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&);
-    virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea);
-    virtual bool tiledBackingStoreUpdatesAllowed() const;
-    virtual IntRect tiledBackingStoreContentsRect();
-    virtual IntRect tiledBackingStoreVisibleRect();
-    virtual Color tiledBackingStoreBackgroundColor() const;
+    virtual void tiledBackingStorePaintBegin() OVERRIDE;
+    virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&) OVERRIDE;
+    virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea) OVERRIDE;
+    virtual bool tiledBackingStoreUpdatesAllowed() const OVERRIDE;
+    virtual IntRect tiledBackingStoreContentsRect() OVERRIDE;
+    virtual IntRect tiledBackingStoreVisibleRect() OVERRIDE;
+    virtual Color tiledBackingStoreBackgroundColor() const OVERRIDE;
 
     // CoordinatedTileClient
-    virtual void createTile(int tileID, const WebKit::SurfaceUpdateInfo&, const WebCore::IntRect&);
-    virtual void updateTile(int tileID, const WebKit::SurfaceUpdateInfo&, const WebCore::IntRect&);
-    virtual void removeTile(int tileID);
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, WebKit::ShareableSurface::Handle&, WebCore::IntPoint&);
+    virtual void createTile(int tileID, const WebKit::SurfaceUpdateInfo&, const IntRect&) OVERRIDE;
+    virtual void updateTile(int tileID, const WebKit::SurfaceUpdateInfo&, const IntRect&) OVERRIDE;
+    virtual void removeTile(int tileID) OVERRIDE;
+    virtual PassOwnPtr<GraphicsContext> beginContentUpdate(const IntSize&, int& atlasID, IntPoint&) OVERRIDE;
 
     void setCoordinatedGraphicsLayerClient(WebKit::CoordinatedGraphicsLayerClient*);
-    void syncChildren();
+
+    void adjustVisibleRect();
+    void purgeBackingStores();
+    bool hasPendingVisibleChanges();
+
+private:
+    bool fixedToViewport() const { return m_fixedToViewport; }
+    void setMaskTarget(GraphicsLayer* layer) { m_maskTarget = layer; }
+
+    void notifyChange();
+    void didChangeLayerState();
+    void didChangeAnimations();
+    void didChangeGeometry();
+    void didChangeChildren();
+#if ENABLE(CSS_FILTERS)
+    void didChangeFilters();
+#endif
+
     void syncLayerState();
+    void syncAnimations();
+    void syncChildren();
 #if ENABLE(CSS_FILTERS)
     void syncFilters();
 #endif
     void syncCanvas();
     void ensureImageBackingStore();
-
-    void adjustVisibleRect();
-    bool isReadyForTileBufferSwap() const;
+    void computeTransformedVisibleRect();
     void updateContentBuffers();
-    void purgeBackingStores();
 
-    // GraphicsLayerAnimation::Client
-    virtual void setAnimatedTransform(const TransformationMatrix&);
-    virtual void setAnimatedOpacity(float);
+    void createBackingStore();
 
-    virtual bool addAnimation(const KeyframeValueList&, const IntSize&, const Animation*, const String&, double);
-    virtual void pauseAnimation(const String&, double);
-    virtual void removeAnimation(const String&);
+    bool selfOrAncestorHaveNonAffineTransforms();
+    bool shouldUseTiledBackingStore();
+    void adjustContentsScale();
+
+    void setShouldUpdateVisibleRect();
+    float effectiveContentsScale();
+
+    void animationStartedTimerFired(Timer<CoordinatedGraphicsLayer>*);
 
-private:
-    virtual void willBeDestroyed();
     WebKit::WebLayerID m_id;
     WebKit::WebLayerInfo m_layerInfo;
     RefPtr<Image> m_image;
@@ -188,42 +202,21 @@ private:
     bool m_shouldSyncLayerState: 1;
     bool m_shouldSyncChildren: 1;
     bool m_shouldSyncFilters: 1;
-    bool m_shouldSyncAnimatedProperties: 1;
+    bool m_shouldSyncAnimations: 1;
     bool m_fixedToViewport : 1;
     bool m_canvasNeedsDisplay : 1;
 
-    void notifyChange();
-    void didChangeAnimatedProperties();
-    void didChangeGeometry();
-    void didChangeLayerState();
-    void didChangeChildren();
-#if ENABLE(CSS_FILTERS)
-    void didChangeFilters();
-#endif
-
     float m_effectiveOpacity;
     TransformationMatrix m_effectiveTransform;
 
-    void createBackingStore();
-
-    bool selfOrAncestorHaveNonAffineTransforms();
-    bool shouldUseTiledBackingStore();
-    void adjustContentsScale();
-    void computeTransformedVisibleRect();
-    void syncLayerParameters();
-    void syncAnimatedProperties();
-    void setShouldUpdateVisibleRect();
-    float effectiveContentsScale();
-
-    void animationStartedTimerFired(WebCore::Timer<CoordinatedGraphicsLayer>*);
-
     WebKit::CoordinatedGraphicsLayerClient* m_CoordinatedGraphicsLayerClient;
-    OwnPtr<WebCore::TiledBackingStore> m_mainBackingStore;
-    OwnPtr<WebCore::TiledBackingStore> m_previousBackingStore;
+    OwnPtr<TiledBackingStore> m_mainBackingStore;
+    OwnPtr<TiledBackingStore> m_previousBackingStore;
     float m_contentsScale;
     PlatformLayer* m_canvasPlatformLayer;
     Timer<CoordinatedGraphicsLayer> m_animationStartedTimer;
     GraphicsLayerAnimations m_animations;
+    double m_lastAnimationStartTime;
 };
 
 CoordinatedGraphicsLayer* toCoordinatedGraphicsLayer(GraphicsLayer*);
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
index 668ca5d9e..548d49d32 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
@@ -73,7 +73,7 @@ Vector<IntRect> CoordinatedTile::updateBackBuffer()
         return Vector<IntRect>();
 
     SurfaceUpdateInfo updateInfo;
-    OwnPtr<GraphicsContext> graphicsContext = m_client->beginContentUpdate(m_dirtyRect.size(), updateInfo.surfaceHandle, updateInfo.surfaceOffset);
+    OwnPtr<GraphicsContext> graphicsContext = m_client->beginContentUpdate(m_dirtyRect.size(), updateInfo.atlasID, updateInfo.surfaceOffset);
     if (!graphicsContext)
         return Vector<IntRect>();
     graphicsContext->translate(-m_dirtyRect.x(), -m_dirtyRect.y());
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
index 84d1134f0..32ff4e7c7 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
@@ -28,7 +28,6 @@
 
 #if USE(TILED_BACKING_STORE)
 
-#include "ShareableSurface.h"
 #include "Tile.h"
 #include "TiledBackingStore.h"
 #include "WebCore/IntRect.h"
@@ -79,7 +78,7 @@ public:
     virtual void createTile(int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void updateTile(int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void removeTile(int tileID) = 0;
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableSurface::Handle&, WebCore::IntPoint&) = 0;
+    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, int& atlasID, WebCore::IntPoint&) = 0;
 };
 
 class CoordinatedTileBackend : public WebCore::TiledBackingStoreBackend {
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
index aaa1c38d5..5d9b3ef38 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
@@ -82,6 +82,7 @@ LayerTreeCoordinator::LayerTreeCoordinator(WebPage* webPage)
     , m_releaseInactiveAtlasesTimer(this, &LayerTreeCoordinator::releaseInactiveAtlasesTimerFired)
     , m_layerFlushSchedulingEnabled(true)
     , m_forceRepaintAsyncCallbackID(0)
+    , m_animationsLocked(false)
 {
     // Create a root layer.
     m_rootLayer = GraphicsLayer::create(this, this);
@@ -266,6 +267,8 @@ bool LayerTreeCoordinator::flushPendingLayerChanges()
 
     m_rootLayer->flushCompositingStateForThisLayerOnly();
 
+    purgeReleasedImages();
+
     if (m_shouldSyncRootLayer) {
         m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetRootCompositingLayer(toCoordinatedGraphicsLayer(m_rootLayer.get())->id()));
         m_shouldSyncRootLayer = false;
@@ -279,7 +282,8 @@ bool LayerTreeCoordinator::flushPendingLayerChanges()
         m_webPage->send(Messages::LayerTreeCoordinatorProxy::DidRenderFrame(contentsSize, coveredRect));
         m_waitingForUIProcess = true;
         m_shouldSyncFrame = false;
-    }
+    } else
+        unlockAnimations();
 
     if (m_forceRepaintAsyncCallbackID) {
         m_webPage->send(Messages::WebPageProxy::VoidCallback(m_forceRepaintAsyncCallbackID));
@@ -387,13 +391,37 @@ void LayerTreeCoordinator::syncFixedLayers()
         updateOffsetFromViewportForLayer(rootRenderLayer->firstChild());
 }
 
+void LayerTreeCoordinator::lockAnimations()
+{
+    m_animationsLocked = true;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetAnimationsLocked(true));
+}
+
+void LayerTreeCoordinator::unlockAnimations()
+{
+    if (!m_animationsLocked)
+        return;
+
+    m_animationsLocked = false;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetAnimationsLocked(false));
+}
+
 void LayerTreeCoordinator::performScheduledLayerFlush()
 {
     if (m_isSuspended || m_waitingForUIProcess)
         return;
 
+    // We lock the animations while performing layout, to avoid flickers caused by animations continuing in the UI process while
+    // the web process layout wants to cancel them.
+    lockAnimations();
     syncDisplayState();
 
+    // We can unlock the animations before flushing if there are no visible changes, for example if there are content updates
+    // in a layer with opacity 0.
+    bool canUnlockBeforeFlush = !m_isValid || !toCoordinatedGraphicsLayer(m_rootLayer.get())->hasPendingVisibleChanges();
+    if (canUnlockBeforeFlush)
+        unlockAnimations();
+
     if (!m_isValid)
         return;
 
@@ -419,6 +447,13 @@ void LayerTreeCoordinator::didPerformScheduledLayerFlush()
     }
 }
 
+void LayerTreeCoordinator::purgeReleasedImages()
+{
+    for (size_t i = 0; i < m_releasedDirectlyCompositedImages.size(); ++i)
+        m_webPage->send(Messages::LayerTreeCoordinatorProxy::DestroyDirectlyCompositedImage(m_releasedDirectlyCompositedImages[i]));
+    m_releasedDirectlyCompositedImages.clear();
+}
+
 void LayerTreeCoordinator::layerFlushTimerFired(Timer<LayerTreeCoordinator>*)
 {
     performScheduledLayerFlush();
@@ -477,15 +512,20 @@ int64_t LayerTreeCoordinator::adoptImageBackingStore(Image* image)
         return key;
     }
 
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size(), (image->currentFrameHasAlpha() ? ShareableBitmap::SupportsAlpha : 0));
-    {
-        OwnPtr<WebCore::GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
-        graphicsContext->drawImage(image, ColorSpaceDeviceRGB, IntPoint::zero());
-    }
+    // Check if we were going to release this image during the next flush.
+    size_t releasedIndex = m_releasedDirectlyCompositedImages.find(key);
+    if (releasedIndex == notFound) {
+        RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size(), (image->currentFrameHasAlpha() ? ShareableBitmap::SupportsAlpha : 0));
+        {
+            OwnPtr<WebCore::GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
+            graphicsContext->drawImage(image, ColorSpaceDeviceRGB, IntPoint::zero());
+        }
+        ShareableBitmap::Handle handle;
+        bitmap->createHandle(handle);
+        m_webPage->send(Messages::LayerTreeCoordinatorProxy::CreateDirectlyCompositedImage(key, handle));
+    } else
+        m_releasedDirectlyCompositedImages.remove(releasedIndex);
 
-    ShareableBitmap::Handle handle;
-    bitmap->createHandle(handle);
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::CreateDirectlyCompositedImage(key, handle));
     m_directlyCompositedImageRefCounts.add(key, 1);
     return key;
 }
@@ -503,13 +543,15 @@ void LayerTreeCoordinator::releaseImageBackingStore(int64_t key)
     if (it->value)
         return;
 
-    m_directlyCompositedImageRefCounts.remove(it);
 #if USE(CAIRO)
     // Complement the referencing in adoptImageBackingStore().
     cairo_surface_t* cairoSurface = reinterpret_cast<cairo_surface_t*>(key);
     cairo_surface_destroy(cairoSurface);
 #endif
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::DestroyDirectlyCompositedImage(key));
+
+    m_directlyCompositedImageRefCounts.remove(it);
+    m_releasedDirectlyCompositedImages.append(key);
+    scheduleLayerFlush();
 }
 
 
@@ -536,19 +578,11 @@ void LayerTreeCoordinator::paintContents(const WebCore::GraphicsLayer* graphicsL
     }
 }
 
-bool LayerTreeCoordinator::showDebugBorders(const WebCore::GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerTreeCoordinator::showRepaintCounter(const WebCore::GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 PassOwnPtr<GraphicsLayer> LayerTreeCoordinator::createGraphicsLayer(GraphicsLayerClient* client)
 {
-    return adoptPtr(new CoordinatedGraphicsLayer(client));
+    CoordinatedGraphicsLayer* newLayer = new CoordinatedGraphicsLayer(client);
+    newLayer->setCoordinatedGraphicsLayerClient(this);
+    return adoptPtr(newLayer);
 }
 
 bool LayerTreeHost::supportsAcceleratedCompositing()
@@ -574,22 +608,26 @@ void LayerTreeCoordinator::removeTile(WebLayerID layerID, int tileID)
     m_webPage->send(Messages::LayerTreeCoordinatorProxy::RemoveTileForLayer(layerID, tileID));
 }
 
-WebCore::IntRect LayerTreeCoordinator::visibleContentsRect() const
+void LayerTreeCoordinator::createUpdateAtlas(int atlasID, const ShareableSurface::Handle& handle)
 {
-    return m_visibleContentsRect;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::CreateUpdateAtlas(atlasID, handle));
 }
 
+void LayerTreeCoordinator::removeUpdateAtlas(int atlasID)
+{
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::RemoveUpdateAtlas(atlasID));
+}
 
-void LayerTreeCoordinator::setLayerAnimatedOpacity(WebLayerID id, float opacity)
+WebCore::IntRect LayerTreeCoordinator::visibleContentsRect() const
 {
-    m_shouldSyncFrame = true;
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimatedOpacity(id, opacity));
+    return m_visibleContentsRect;
 }
 
-void LayerTreeCoordinator::setLayerAnimatedTransform(WebLayerID id, const TransformationMatrix& transform)
+
+void LayerTreeCoordinator::setLayerAnimations(WebLayerID layerID, const GraphicsLayerAnimations& animations)
 {
     m_shouldSyncFrame = true;
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimatedTransform(id, transform));
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimations(layerID, animations.getActiveAnimations()));
 }
 
 void LayerTreeCoordinator::setVisibleContentsRect(const IntRect& rect, float scale, const FloatPoint& trajectoryVector)
@@ -625,10 +663,17 @@ GraphicsLayerFactory* LayerTreeCoordinator::graphicsLayerFactory()
     return this;
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
 void LayerTreeCoordinator::scheduleAnimation()
 {
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::RequestAnimationFrame());
+}
+
+void LayerTreeCoordinator::animationFrameReady()
+{
     scheduleLayerFlush();
 }
+#endif
 
 void LayerTreeCoordinator::renderNextFrame()
 {
@@ -649,27 +694,30 @@ void LayerTreeCoordinator::purgeBackingStores()
     for (HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it)
         (*it)->purgeBackingStores();
 
+    purgeReleasedImages();
+
     ASSERT(!m_directlyCompositedImageRefCounts.size());
+    ASSERT(!m_releasedDirectlyCompositedImages.size());
     m_updateAtlases.clear();
 }
 
-PassOwnPtr<WebCore::GraphicsContext> LayerTreeCoordinator::beginContentUpdate(const WebCore::IntSize& size, ShareableBitmap::Flags flags, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
+PassOwnPtr<WebCore::GraphicsContext> LayerTreeCoordinator::beginContentUpdate(const WebCore::IntSize& size, ShareableBitmap::Flags flags, int& atlasID, WebCore::IntPoint& offset)
 {
     OwnPtr<WebCore::GraphicsContext> graphicsContext;
     for (unsigned i = 0; i < m_updateAtlases.size(); ++i) {
         UpdateAtlas* atlas = m_updateAtlases[i].get();
         if (atlas->flags() == flags) {
             // This will return null if there is no available buffer space.
-            graphicsContext = atlas->beginPaintingOnAvailableBuffer(handle, size, offset);
+            graphicsContext = atlas->beginPaintingOnAvailableBuffer(atlasID, size, offset);
             if (graphicsContext)
                 return graphicsContext.release();
         }
     }
 
     static const int ScratchBufferDimension = 1024; // Should be a power of two.
-    m_updateAtlases.append(adoptPtr(new UpdateAtlas(ScratchBufferDimension, flags)));
+    m_updateAtlases.append(adoptPtr(new UpdateAtlas(this, ScratchBufferDimension, flags)));
     scheduleReleaseInactiveAtlases();
-    return m_updateAtlases.last()->beginPaintingOnAvailableBuffer(handle, size, offset);
+    return m_updateAtlases.last()->beginPaintingOnAvailableBuffer(atlasID, size, offset);
 }
 
 const double ReleaseInactiveAtlasesTimerInterval = 0.5;
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
index 776a8d97e..cacb68eaa 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
@@ -38,14 +38,13 @@ class UpdateInfo;
 class WebPage;
 
 class LayerTreeCoordinator : public LayerTreeHost, WebCore::GraphicsLayerClient
-                           , public CoordinatedGraphicsLayerClient
-                           , public WebCore::GraphicsLayerFactory {
+    , public CoordinatedGraphicsLayerClient
+    , public UpdateAtlasClient
+    , public WebCore::GraphicsLayerFactory {
 public:
     static PassRefPtr<LayerTreeCoordinator> create(WebPage*);
     virtual ~LayerTreeCoordinator();
 
-    static bool supportsAcceleratedCompositing();
-
     virtual const LayerTreeContext& layerTreeContext() { return m_layerTreeContext; }
     virtual void setLayerFlushSchedulingEnabled(bool);
     virtual void scheduleLayerFlush();
@@ -84,8 +83,7 @@ public:
 
     virtual void syncLayerState(WebLayerID, const WebLayerInfo&);
     virtual void syncLayerChildren(WebLayerID, const Vector<WebLayerID>&);
-    virtual void setLayerAnimatedOpacity(WebLayerID, float);
-    virtual void setLayerAnimatedTransform(WebLayerID, const WebCore::TransformationMatrix&);
+    virtual void setLayerAnimations(WebLayerID, const WebCore::GraphicsLayerAnimations&);
 #if ENABLE(CSS_FILTERS)
     virtual void syncLayerFilters(WebLayerID, const WebCore::FilterOperations&);
 #endif
@@ -96,8 +94,15 @@ public:
     virtual void detachLayer(WebCore::CoordinatedGraphicsLayer*);
     virtual void syncFixedLayers();
 
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, ShareableSurface::Handle&, WebCore::IntPoint&);
+    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, int& atlasID, WebCore::IntPoint&);
+
+    // UpdateAtlasClient
+    virtual void createUpdateAtlas(int atlasID, const ShareableSurface::Handle&);
+    virtual void removeUpdateAtlas(int atlasID);
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
     virtual void scheduleAnimation() OVERRIDE;
+#endif
 
 protected:
     explicit LayerTreeCoordinator(WebPage*);
@@ -107,8 +112,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
     // GraphicsLayerFactory
     virtual PassOwnPtr<WebCore::GraphicsLayer> createGraphicsLayer(WebCore::GraphicsLayerClient*) OVERRIDE;
@@ -121,10 +124,17 @@ private:
     void performScheduledLayerFlush();
     void didPerformScheduledLayerFlush();
     void syncDisplayState();
+    void lockAnimations();
+    void unlockAnimations();
+    void purgeReleasedImages();
 
     void layerFlushTimerFired(WebCore::Timer<LayerTreeCoordinator>*);
 
     void scheduleReleaseInactiveAtlases();
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void animationFrameReady();
+#endif
+
     void releaseInactiveAtlasesTimerFired(WebCore::Timer<LayerTreeCoordinator>*);
 
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
@@ -138,6 +148,7 @@ private:
     HashSet<WebCore::CoordinatedGraphicsLayer*> m_registeredLayers;
     Vector<WebLayerID> m_detachedLayers;
     HashMap<int64_t, int> m_directlyCompositedImageRefCounts;
+    Vector<int64_t> m_releasedDirectlyCompositedImages;
     Vector<OwnPtr<UpdateAtlas> > m_updateAtlases;
 
     bool m_notifyAfterScheduledLayerFlush;
@@ -156,6 +167,7 @@ private:
     WebCore::Timer<LayerTreeCoordinator> m_releaseInactiveAtlasesTimer;
     bool m_layerFlushSchedulingEnabled;
     uint64_t m_forceRepaintAsyncCallbackID;
+    bool m_animationsLocked;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
index 7b9c2acdf..6ac372562 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
@@ -23,5 +23,8 @@ messages -> LayerTreeCoordinator {
     SetVisibleContentsRect(WebCore::IntRect visibleContentsRect, float scale, WebCore::FloatPoint trajectoryVectory)
     RenderNextFrame()
     PurgeBackingStores()
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    AnimationFrameReady()
+#endif
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
index 63417720c..4179c982c 100644
--- a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
@@ -45,7 +45,7 @@ DecoderAdapter::DecoderAdapter(const uint8_t* buffer, size_t bufferSize)
 bool DecoderAdapter::decodeBytes(Vector<uint8_t>& bytes)
 {
     CoreIPC::DataReference dataReference;
-    if (!m_decoder->decodeVariableLengthByteArray(dataReference))
+    if (!m_decoder->decode(dataReference))
         return false;
 
     bytes = dataReference.vector();
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
index 11e893faf..ed6cface2 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
@@ -33,6 +33,10 @@
 #include "TiledCoreAnimationDrawingArea.h"
 #endif
 
+#if PLATFORM(MAC)
+#include "RemoteLayerTreeDrawingArea.h"
+#endif
+
 #include "WebPageCreationParameters.h"
 
 namespace WebKit {
@@ -46,6 +50,10 @@ PassOwnPtr<DrawingArea> DrawingArea::create(WebPage* webPage, const WebPageCreat
     case DrawingAreaTypeTiledCoreAnimation:
         return TiledCoreAnimationDrawingArea::create(webPage, parameters);
 #endif
+#if PLATFORM(MAC)
+    case DrawingAreaTypeRemoteLayerTree:
+        return RemoteLayerTreeDrawingArea::create(webPage, parameters);
+#endif
     }
 
     return nullptr;
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 71916909d..5e70c9448 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -307,6 +307,7 @@ void DrawingAreaImpl::layerHostDidFlushLayers()
 #endif
 }
 
+#if USE(ACCELERATED_COMPOSITING)
 GraphicsLayerFactory* DrawingAreaImpl::graphicsLayerFactory()
 {
     if (m_layerTreeHost)
@@ -361,6 +362,7 @@ void DrawingAreaImpl::scheduleCompositingLayerFlush()
         return;
     m_layerTreeHost->scheduleLayerFlush();
 }
+#endif
 
 void DrawingAreaImpl::updateBackingStoreState(uint64_t stateID, bool respondImmediately, float deviceScaleFactor, const WebCore::IntSize& size, const WebCore::IntSize& scrollOffset)
 {
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index ba93954f9..6d49719f7 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -68,9 +68,11 @@ private:
     virtual void setPaintingEnabled(bool);
     virtual void updatePreferences(const WebPreferencesStore&) OVERRIDE;
 
+#if USE(ACCELERATED_COMPOSITING)
     virtual WebCore::GraphicsLayerFactory* graphicsLayerFactory() OVERRIDE;
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) OVERRIDE;
     virtual void scheduleCompositingLayerFlush() OVERRIDE;
+#endif
 
 #if PLATFORM(WIN)
     virtual void scheduleChildWindowGeometryUpdate(const WindowGeometry&);
diff --git a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
index b7269caa1..ed6dc210e 100644
--- a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
@@ -47,7 +47,7 @@ CoreIPC::DataReference EncoderAdapter::dataReference() const
 
 void EncoderAdapter::encodeBytes(const uint8_t* bytes, size_t size)
 {
-    m_encoder->encodeVariableLengthByteArray(CoreIPC::DataReference(bytes, size));
+    m_encoder->encode(CoreIPC::DataReference(bytes, size));
 }
 
 void EncoderAdapter::encodeBool(bool value)
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
index 68d158236..7a1ca6cf6 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
@@ -109,7 +109,7 @@ public:
     virtual WebCore::GraphicsDeviceAdapter* graphicsDeviceAdapter() const { return 0; }
 #endif
 
-#if USE(COORDINATED_GRAPHICS)
+#if USE(COORDINATED_GRAPHICS) && ENABLE(REQUEST_ANIMATION_FRAME)
     virtual void scheduleAnimation() = 0;
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
index 27500635d..9a5418f1e 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
@@ -30,12 +30,28 @@ using namespace WebCore;
 
 namespace WebKit {
 
-UpdateAtlas::UpdateAtlas(int dimension, ShareableBitmap::Flags flags)
-    : m_flags(flags)
+UpdateAtlas::UpdateAtlas(UpdateAtlasClient* client, int dimension, ShareableBitmap::Flags flags)
+    : m_client(client)
+    , m_flags(flags)
     , m_inactivityInSeconds(0)
+    , m_isVaild(true)
 {
+    static int nextID = 0;
+    m_ID = ++nextID;
     IntSize size = nextPowerOfTwo(IntSize(dimension, dimension));
     m_surface = ShareableSurface::create(size, flags, ShareableSurface::SupportsGraphicsSurface);
+
+    if (!m_surface->createHandle(m_handle)) {
+        m_isVaild = false;
+        return;
+    }
+    m_client->createUpdateAtlas(m_ID, m_handle);
+}
+
+UpdateAtlas::~UpdateAtlas()
+{
+    if (m_isVaild)
+        m_client->removeUpdateAtlas(m_ID);
 }
 
 void UpdateAtlas::buildLayoutIfNeeded()
@@ -51,7 +67,7 @@ void UpdateAtlas::didSwapBuffers()
     m_areaAllocator.clear();
 }
 
-PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(ShareableSurface::Handle& handle, const WebCore::IntSize& size, IntPoint& offset)
+PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(int& atlasID, const WebCore::IntSize& size, IntPoint& offset)
 {
     m_inactivityInSeconds = 0;
     buildLayoutIfNeeded();
@@ -61,8 +77,10 @@ PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(Shareabl
     if (rect.isEmpty())
         return PassOwnPtr<GraphicsContext>();
 
-    if (!m_surface->createHandle(handle))
-        return PassOwnPtr<WebCore::GraphicsContext>();
+    if (!m_isVaild)
+        return PassOwnPtr<GraphicsContext>();
+
+    atlasID = m_ID;
 
     // FIXME: Use tri-state buffers, to allow faster updates.
     offset = rect.location();
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
index 00e850b83..7cefe9c97 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
@@ -32,15 +32,22 @@ class IntPoint;
 
 namespace WebKit {
 
+class UpdateAtlasClient {
+public:
+    virtual void createUpdateAtlas(int atlasID, const ShareableSurface::Handle&) = 0;
+    virtual void removeUpdateAtlas(int atlasID) = 0;
+};
+
 class UpdateAtlas {
     WTF_MAKE_NONCOPYABLE(UpdateAtlas);
 public:
-    UpdateAtlas(int dimension, ShareableBitmap::Flags);
+    UpdateAtlas(UpdateAtlasClient*, int dimension, ShareableBitmap::Flags);
+    ~UpdateAtlas();
 
     inline WebCore::IntSize size() const { return m_surface->size(); }
 
     // Returns a null pointer of there is no available buffer.
-    PassOwnPtr<WebCore::GraphicsContext> beginPaintingOnAvailableBuffer(ShareableSurface::Handle&, const WebCore::IntSize&, WebCore::IntPoint& offset);
+    PassOwnPtr<WebCore::GraphicsContext> beginPaintingOnAvailableBuffer(int& atlasID, const WebCore::IntSize&, WebCore::IntPoint& offset);
     void didSwapBuffers();
     ShareableBitmap::Flags flags() const { return m_flags; }
 
@@ -60,10 +67,14 @@ private:
     void buildLayoutIfNeeded();
 
 private:
+    UpdateAtlasClient* m_client;
     OwnPtr<GeneralAreaAllocator> m_areaAllocator;
     ShareableBitmap::Flags m_flags;
     RefPtr<ShareableSurface> m_surface;
+    ShareableSurface::Handle m_handle;
     double m_inactivityInSeconds;
+    int m_ID;
+    bool m_isVaild;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 3d8583d8d..2312e84c3 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -31,6 +31,7 @@
 #include "DataReference.h"
 #include "DecoderAdapter.h"
 #include "DrawingArea.h"
+#include "DrawingAreaMessages.h"
 #include "InjectedBundle.h"
 #include "InjectedBundleBackForwardList.h"
 #include "InjectedBundleUserMessageCoders.h"
@@ -60,15 +61,18 @@
 #include "WebEventConversion.h"
 #include "WebFrame.h"
 #include "WebFullScreenManager.h"
+#include "WebFullScreenManagerMessages.h"
 #include "WebGeolocationClient.h"
 #include "WebGeometry.h"
 #include "WebImage.h"
 #include "WebInspector.h"
 #include "WebInspectorClient.h"
+#include "WebInspectorMessages.h"
 #include "WebNotificationClient.h"
 #include "WebOpenPanelResultListener.h"
 #include "WebPageCreationParameters.h"
 #include "WebPageGroupProxy.h"
+#include "WebPageMessages.h"
 #include "WebPageProxyMessages.h"
 #include "WebPopupMenu.h"
 #include "WebPreferencesStore.h"
@@ -176,6 +180,10 @@
 #include <wtf/RefCountedLeakCounter.h>
 #endif
 
+#if USE(COORDINATED_GRAPHICS)
+#include "LayerTreeCoordinatorMessages.h"
+#endif
+
 using namespace JSC;
 using namespace WebCore;
 using namespace std;
@@ -355,6 +363,20 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     
     setMediaVolume(parameters.mediaVolume);
 
+    WebProcess::shared().addMessageReceiver(Messages::WebPage::messageReceiverName(), m_pageID, this);
+
+    // FIXME: This should be done in the object constructors, and the objects themselves should be message receivers.
+    WebProcess::shared().addMessageReceiver(Messages::DrawingArea::messageReceiverName(), m_pageID, this);
+#if USE(COORDINATED_GRAPHICS)
+    WebProcess::shared().addMessageReceiver(Messages::LayerTreeCoordinator::messageReceiverName(), m_pageID, this);
+#endif
+#if ENABLE(INSPECTOR)
+    WebProcess::shared().addMessageReceiver(Messages::WebInspector::messageReceiverName(), m_pageID, this);
+#endif
+#if ENABLE(FULLSCREEN_API)
+    WebProcess::shared().addMessageReceiver(Messages::WebFullScreenManager::messageReceiverName(), m_pageID, this);
+#endif
+
 #ifndef NDEBUG
     webPageCounter.increment();
 #endif
@@ -372,6 +394,20 @@ WebPage::~WebPage()
     for (HashSet<PluginView*>::const_iterator it = m_pluginViews.begin(), end = m_pluginViews.end(); it != end; ++it)
         (*it)->webPageDestroyed();
 
+    WebProcess::shared().removeMessageReceiver(Messages::WebPage::messageReceiverName(), m_pageID);
+
+    // FIXME: This should be done in the object destructors, and the objects themselves should be message receivers.
+    WebProcess::shared().removeMessageReceiver(Messages::DrawingArea::messageReceiverName(), m_pageID);
+#if USE(COORDINATED_GRAPHICS)
+    WebProcess::shared().removeMessageReceiver(Messages::LayerTreeCoordinator::messageReceiverName(), m_pageID);
+#endif
+#if ENABLE(INSPECTOR)
+    WebProcess::shared().removeMessageReceiver(Messages::WebInspector::messageReceiverName(), m_pageID);
+#endif
+#if ENABLE(FULLSCREEN_API)
+    WebProcess::shared().removeMessageReceiver(Messages::WebFullScreenManager::messageReceiverName(), m_pageID);
+#endif
+
 #ifndef NDEBUG
     webPageCounter.decrement();
 #endif
@@ -455,20 +491,28 @@ void WebPage::initializeInjectedBundleDiagnosticLoggingClient(WKBundlePageDiagno
 PassRefPtr<Plugin> WebPage::createPlugin(WebFrame* frame, HTMLPlugInElement* pluginElement, const Plugin::Parameters& parameters)
 {
     String pluginPath;
-    bool blocked;
-
+    uint32_t pluginLoadPolicy;
     if (!WebProcess::shared().connection()->sendSync(
             Messages::WebProcessProxy::GetPluginPath(parameters.mimeType, parameters.url.string()),
-            Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, blocked), 0)) {
+            Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, pluginLoadPolicy), 0)) {
         return 0;
     }
 
-    if (blocked) {
+    switch (static_cast<PluginModuleLoadPolicy>(pluginLoadPolicy)) {
+    case PluginModuleLoadNormally:
+        break;
+
+    case PluginModuleBlocked:
         if (pluginElement->renderer()->isEmbeddedObject())
             toRenderEmbeddedObject(pluginElement->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
 
         send(Messages::WebPageProxy::DidBlockInsecurePluginVersion(parameters.mimeType, parameters.url.string()));
         return 0;
+
+    case PluginModuleInactive:
+        if (pluginElement->renderer()->isEmbeddedObject())
+            toRenderEmbeddedObject(pluginElement->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginInactive);
+        return 0;
     }
 
     if (pluginPath.isNull()) {
@@ -630,6 +674,20 @@ PassRefPtr<ImmutableArray> WebPage::trackedRepaintRects()
     return ImmutableArray::adopt(vector);
 }
 
+static PluginView* focusedPluginViewForFrame(Frame* frame)
+{
+    if (!frame->document()->isPluginDocument())
+        return 0;
+
+    PluginDocument* pluginDocument = static_cast<PluginDocument*>(frame->document());
+
+    if (pluginDocument->focusedNode() != pluginDocument->pluginNode())
+        return 0;
+
+    PluginView* pluginView = static_cast<PluginView*>(pluginDocument->pluginWidget());
+    return pluginView;
+}
+
 static PluginView* pluginViewForFrame(Frame* frame)
 {
     if (!frame->document()->isPluginDocument())
@@ -646,7 +704,7 @@ void WebPage::executeEditingCommand(const String& commandName, const String& arg
     if (!frame)
         return;
 
-    if (PluginView* pluginView = pluginViewForFrame(frame)) {
+    if (PluginView* pluginView = focusedPluginViewForFrame(frame)) {
         pluginView->handleEditingCommand(commandName, argument);
         return;
     }
@@ -660,7 +718,7 @@ bool WebPage::isEditingCommandEnabled(const String& commandName)
     if (!frame)
         return false;
 
-    if (PluginView* pluginView = pluginViewForFrame(frame))
+    if (PluginView* pluginView = focusedPluginViewForFrame(frame))
         return pluginView->isEditingCommandEnabled(commandName);
     
     Editor::Command command = frame->editor()->command(commandName);
@@ -926,32 +984,6 @@ void WebPage::setFixedVisibleContentRect(const IntRect& rect)
     m_page->mainFrame()->view()->setFixedVisibleContentRect(rect);
 }
 
-void WebPage::setResizesToContentsUsingLayoutSize(const IntSize& targetLayoutSize)
-{
-    ASSERT(m_useFixedLayout);
-    ASSERT(!targetLayoutSize.isEmpty());
-
-    FrameView* view = m_page->mainFrame()->view();
-
-    view->setDelegatesScrolling(true);
-    view->setUseFixedLayout(true);
-    view->setPaintsEntireContents(true);
-
-    if (view->fixedLayoutSize() == targetLayoutSize)
-        return;
-
-    m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(true);
-    m_page->settings()->setFixedElementsLayoutRelativeToFrame(true);
-    m_page->settings()->setFixedPositionCreatesStackingContext(true);
-#if ENABLE(SMOOTH_SCROLLING)
-    // Ensure we don't do animated scrolling in the WebProcess when scrolling is delegated.
-    m_page->settings()->setEnableScrollAnimator(false);
-#endif
-
-    // Always reset even when empty. This also takes care of the relayout.
-    setFixedLayoutSize(targetLayoutSize);
-}
-
 void WebPage::resizeToContentsIfNeeded()
 {
     ASSERT(m_useFixedLayout);
@@ -990,7 +1022,8 @@ void WebPage::sendViewportAttributesChanged()
 
     ViewportAttributes attr = computeViewportAttributes(m_page->viewportArguments(), minimumLayoutFallbackWidth, deviceWidth, deviceHeight, m_page->deviceScaleFactor(), m_viewportSize);
 
-    setResizesToContentsUsingLayoutSize(IntSize(static_cast<int>(attr.layoutSize.width()), static_cast<int>(attr.layoutSize.height())));
+    // This also takes care of the relayout.
+    setFixedLayoutSize(IntSize(static_cast<int>(attr.layoutSize.width()), static_cast<int>(attr.layoutSize.height())));
     send(Messages::WebPageProxy::DidChangeViewportProperties(attr));
 }
 
@@ -1152,12 +1185,31 @@ float WebPage::deviceScaleFactor() const
 
 void WebPage::setUseFixedLayout(bool fixed)
 {
+    // Do not overwrite current settings if initially setting it to false.
+    if (m_useFixedLayout == fixed)
+        return;
     m_useFixedLayout = fixed;
 
+    m_page->settings()->setFixedElementsLayoutRelativeToFrame(fixed);
+#if USE(COORDINATED_GRAPHICS)
+    m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(fixed);
+    m_page->settings()->setFixedPositionCreatesStackingContext(fixed);
+#endif
+
+#if USE(TILED_BACKING_STORE) && ENABLE(SMOOTH_SCROLLING)
+    // Delegated scrolling will be enabled when the FrameView is created if fixed layout is enabled.
+    // Ensure we don't do animated scrolling in the WebProcess in that case.
+    m_page->settings()->setEnableScrollAnimator(!fixed);
+#endif
+
     FrameView* view = mainFrameView();
     if (!view)
         return;
 
+#if USE(TILED_BACKING_STORE)
+    view->setDelegatesScrolling(fixed);
+    view->setPaintsEntireContents(fixed);
+#endif
     view->setUseFixedLayout(fixed);
     if (!fixed)
         setFixedLayoutSize(IntSize());
@@ -1166,7 +1218,7 @@ void WebPage::setUseFixedLayout(bool fixed)
 void WebPage::setFixedLayoutSize(const IntSize& size)
 {
     FrameView* view = mainFrameView();
-    if (!view)
+    if (!view || view->fixedLayoutSize() == size)
         return;
 
     view->setFixedLayoutSize(size);
@@ -1573,7 +1625,7 @@ void WebPage::validateCommand(const String& commandName, uint64_t callbackID)
     int32_t state = 0;
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
     if (frame) {
-        if (PluginView* pluginView = pluginViewForFrame(frame))
+        if (PluginView* pluginView = focusedPluginViewForFrame(frame))
             isEnabled = pluginView->isEditingCommandEnabled(commandName);
         else {
             Editor::Command command = frame->editor()->command(commandName);
@@ -1854,7 +1906,7 @@ void WebPage::didStartPageTransition()
 
 void WebPage::didCompletePageTransition()
 {
-#if PLATFORM(QT)
+#if USE(TILED_BACKING_STORE)
     if (m_mainFrame->coreFrame()->view()->delegatesScrolling())
         // Wait until the UI process sent us the visible rect it wants rendered.
         send(Messages::WebPageProxy::PageTransitionViewportReady());
@@ -3449,12 +3501,12 @@ static bool canPluginHandleResponse(const ResourceResponse& response)
 {
 #if ENABLE(NETSCAPE_PLUGIN_API)
     String pluginPath;
-    bool blocked;
+    uint32_t pluginLoadPolicy;
     
-    if (!WebProcess::shared().connection()->sendSync(Messages::WebProcessProxy::GetPluginPath(response.mimeType(), response.url().string()), Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, blocked), 0))
+    if (!WebProcess::shared().connection()->sendSync(Messages::WebProcessProxy::GetPluginPath(response.mimeType(), response.url().string()), Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, pluginLoadPolicy), 0))
         return false;
-    
-    return !blocked && !pluginPath.isEmpty();
+
+    return pluginLoadPolicy != PluginModuleBlocked && !pluginPath.isEmpty();
 #else
     return false;
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 74be313e7..eafc8716c 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -43,6 +43,7 @@
 #include "InjectedBundlePagePolicyClient.h"
 #include "InjectedBundlePageResourceLoadClient.h"
 #include "InjectedBundlePageUIClient.h"
+#include "MessageReceiver.h"
 #include "MessageSender.h"
 #include "TapHighlightController.h"
 #include "Plugin.h"
@@ -162,7 +163,7 @@ class WebGestureEvent;
 class WebTouchEvent;
 #endif
 
-class WebPage : public APIObject, public CoreIPC::MessageSender<WebPage> {
+class WebPage : public APIObject, public CoreIPC::MessageReceiver, public CoreIPC::MessageSender<WebPage> {
 public:
     static const Type APIType = TypeBundlePage;
 
@@ -238,9 +239,8 @@ public:
     WebOpenPanelResultListener* activeOpenPanelResultListener() const { return m_activeOpenPanelResultListener.get(); }
     void setActiveOpenPanelResultListener(PassRefPtr<WebOpenPanelResultListener>);
 
-    // -- Called from WebProcess.
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-    void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+    void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
 
     // -- InjectedBundle methods
 #if ENABLE(CONTEXT_MENUS)
@@ -378,7 +378,6 @@ public:
 #if USE(TILED_BACKING_STORE)
     void pageDidRequestScroll(const WebCore::IntPoint&);
     void setFixedVisibleContentRect(const WebCore::IntRect&);
-    void setResizesToContentsUsingLayoutSize(const WebCore::IntSize&);
     void resizeToContentsIfNeeded();
     void sendViewportAttributesChanged();
     void setViewportSize(const WebCore::IntSize&);
@@ -465,7 +464,10 @@ public:
     void gestureWillBegin(const WebCore::IntPoint&, bool& canBeginPanning);
     void gestureDidScroll(const WebCore::IntSize&);
     void gestureDidEnd();
-
+#elif PLATFORM(EFL)
+    void confirmComposition(const String& compositionString);
+    void setComposition(const WTF::String& compositionString, const WTF::Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition);
+    void cancelComposition();
 #elif PLATFORM(GTK)
     void updateAccessibilityTree();
 #if USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index e891890ac..0933aa1aa 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -292,6 +292,11 @@ messages -> WebPage {
     GestureDidScroll(WebCore::IntSize size)
     GestureDidEnd()
 #endif
+#if PLATFORM(EFL)
+    ConfirmComposition(WTF::String compositionString)
+    SetComposition(WTF::String compositionString, WTF::Vector<WebCore::CompositionUnderline> underlines, uint64_t cursorPosition)
+    CancelComposition()
+#endif
 #if PLATFORM(QT)
     FindZoomableAreaForPoint(WebCore::IntPoint point, WebCore::IntSize area)
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
index 0872f4355..dba55c212 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
@@ -203,16 +203,6 @@ void LayerTreeHostCA::paintContents(const GraphicsLayer* graphicsLayer, Graphics
     }
 }
 
-bool LayerTreeHostCA::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerTreeHostCA::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 float LayerTreeHostCA::deviceScaleFactor() const
 {
     return m_webPage->corePage()->deviceScaleFactor();
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
index 9cb8ca6a5..21b13da1c 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
@@ -76,8 +76,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
     virtual float deviceScaleFactor() const;
     virtual void didCommitChangesForLayer(const WebCore::GraphicsLayer*) const { }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp b/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
index 0057e86ac..520ce8576 100644
--- a/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "WebPage.h"
 
+#include "EditorState.h"
 #include "NotImplemented.h"
 #include "WebEvent.h"
 #include "WindowsKeyboardCodes.h"
@@ -152,4 +153,56 @@ void WebPage::setThemePath(const String& themePath)
     theme->setThemePath(themePath);
 }
 
+static Frame* targetFrameForEditing(WebPage* page)
+{
+    Frame* frame = page->corePage()->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return 0;
+
+    Editor* editor = frame->editor();
+    if (!editor->canEdit())
+        return 0;
+
+    if (editor->hasComposition()) {
+        // We should verify the parent node of this IME composition node are
+        // editable because JavaScript may delete a parent node of the composition
+        // node. In this case, WebKit crashes while deleting texts from the parent
+        // node, which doesn't exist any longer.
+        if (PassRefPtr<Range> range = editor->compositionRange()) {
+            Node* node = range->startContainer();
+            if (!node || !node->isContentEditable())
+                return 0;
+        }
+    }
+
+    return frame;
+}
+
+void WebPage::confirmComposition(const String& compositionString)
+{
+    Frame* targetFrame = targetFrameForEditing(this);
+    if (!targetFrame)
+        return;
+
+    targetFrame->editor()->confirmComposition(compositionString);
+}
+
+void WebPage::setComposition(const String& compositionString, const Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition)
+{
+    Frame* targetFrame = targetFrameForEditing(this);
+    if (!targetFrame)
+        return;
+
+    targetFrame->editor()->setComposition(compositionString, underlines, cursorPosition, 0);
+}
+
+void WebPage::cancelComposition()
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
+
+    frame->editor()->cancelComposition();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
index af2ae89bf..07fe12855 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
@@ -258,16 +258,6 @@ void LayerTreeHostGtk::paintContents(const GraphicsLayer* graphicsLayer, Graphic
     }
 }
 
-bool LayerTreeHostGtk::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerTreeHostGtk::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 gboolean LayerTreeHostGtk::layerFlushTimerFiredCallback(LayerTreeHostGtk* layerTreeHost)
 {
     layerTreeHost->layerFlushTimerFired();
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
index 61b9fa671..840ada813 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
@@ -77,8 +77,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
     virtual void didCommitChangesForLayer(const WebCore::GraphicsLayer*) const { }
 
     void createPageOverlayLayer();
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h
new file mode 100644
index 000000000..c6163c1d6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RemoteLayerTreeDrawingArea_h
+#define RemoteLayerTreeDrawingArea_h
+
+#include "DrawingArea.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class RemoteLayerTreeDrawingArea : public DrawingArea {
+public:
+    static PassOwnPtr<RemoteLayerTreeDrawingArea> create(WebPage*, const WebPageCreationParameters&);
+    virtual ~RemoteLayerTreeDrawingArea();
+
+private:
+    RemoteLayerTreeDrawingArea(WebPage*, const WebPageCreationParameters&);
+
+    // DrawingArea
+    virtual void setNeedsDisplay(const WebCore::IntRect&) OVERRIDE;
+    virtual void scroll(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset) OVERRIDE;
+
+    virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) OVERRIDE;
+    virtual void scheduleCompositingLayerFlush() OVERRIDE;
+};
+
+} // namespace WebKit
+
+#endif // RemoteLayerTreeDrawingArea_h
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm
new file mode 100644
index 000000000..318b3815a
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RemoteLayerTreeDrawingArea.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+PassOwnPtr<RemoteLayerTreeDrawingArea> RemoteLayerTreeDrawingArea::create(WebPage* webPage, const WebPageCreationParameters& parameters)
+{
+    return adoptPtr(new RemoteLayerTreeDrawingArea(webPage, parameters));
+}
+
+RemoteLayerTreeDrawingArea::RemoteLayerTreeDrawingArea(WebPage* webPage, const WebPageCreationParameters&)
+    : DrawingArea(DrawingAreaTypeRemoteLayerTree, webPage)
+{
+}
+
+RemoteLayerTreeDrawingArea::~RemoteLayerTreeDrawingArea()
+{
+}
+
+void RemoteLayerTreeDrawingArea::setNeedsDisplay(const IntRect&)
+{
+}
+
+void RemoteLayerTreeDrawingArea::scroll(const IntRect& scrollRect, const IntSize& scrollOffset)
+{
+}
+
+void RemoteLayerTreeDrawingArea::setRootCompositingLayer(GraphicsLayer*)
+{
+}
+
+void RemoteLayerTreeDrawingArea::scheduleCompositingLayerFlush()
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
index f5048a985..7d5b3be96 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
@@ -72,8 +72,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) OVERRIDE;
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*) OVERRIDE;
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect) OVERRIDE;
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const OVERRIDE;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const OVERRIDE;
     virtual float deviceScaleFactor() const OVERRIDE;
 
     // WebCore::LayerFlushSchedulerClient
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
index fcd72cac9..cf5d23e01 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
@@ -273,16 +273,6 @@ void TiledCoreAnimationDrawingArea::paintContents(const GraphicsLayer* graphicsL
     m_webPage->drawPageOverlay(graphicsContext, clipRect);
 }
 
-bool TiledCoreAnimationDrawingArea::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool TiledCoreAnimationDrawingArea::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 float TiledCoreAnimationDrawingArea::deviceScaleFactor() const
 {
     return m_webPage->corePage()->deviceScaleFactor();
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index 2acf85b0e..b524daf0c 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -679,11 +679,9 @@ bool WebPage::platformHasLocalDataForURL(const WebCore::KURL& url)
     NSMutableURLRequest* request = [[NSMutableURLRequest alloc] initWithURL:url];
     [request setValue:(NSString*)userAgent() forHTTPHeaderField:@"User-Agent"];
     NSCachedURLResponse *cachedResponse;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = ResourceHandle::currentStorageSession())
         cachedResponse = WKCachedResponseForRequest(storageSession, request);
     else
-#endif
         cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
     [request release];
     
@@ -695,10 +693,8 @@ static NSCachedURLResponse *cachedResponseForURL(WebPage* webPage, const KURL& u
     RetainPtr<NSMutableURLRequest> request(AdoptNS, [[NSMutableURLRequest alloc] initWithURL:url]);
     [request.get() setValue:(NSString *)webPage->userAgent() forHTTPHeaderField:@"User-Agent"];
 
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = ResourceHandle::currentStorageSession())
         return WKCachedResponseForRequest(storageSession, request.get());
-#endif
 
     return [[NSURLCache sharedURLCache] cachedResponseForRequest:request.get()];
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
index 6294f00d8..212fe6d4d 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
@@ -266,19 +266,14 @@ static RetainPtr<CFCachedURLResponseRef> cachedResponseForURL(WebPage* webPage,
 {
     RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
     RetainPtr<CFMutableURLRequestRef> request(AdoptCF, CFURLRequestCreateMutable(0, cfURL.get(), kCFURLRequestCachePolicyReloadIgnoringCache, 60, 0));
-#if USE(CFURLSTORAGESESSIONS)
     wkSetRequestStorageSession(ResourceHandle::currentStorageSession(), request.get());
-#endif
 
-    RetainPtr<CFStringRef> userAgent(AdoptCF, webPage->userAgent().createCFString());
-    CFURLRequestSetHTTPHeaderFieldValue(request.get(), CFSTR("User-Agent"), userAgent.get());
+    CFURLRequestSetHTTPHeaderFieldValue(request.get(), CFSTR("User-Agent"), webPage->userAgent().createCFString().get());
 
     RetainPtr<CFURLCacheRef> cache;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef currentStorageSession = ResourceHandle::currentStorageSession())
         cache.adoptCF(wkCopyURLCache(currentStorageSession));
     else
-#endif
         cache.adoptCF(CFURLCacheCopySharedURLCache());
 
     RetainPtr<CFCachedURLResponseRef> response(AdoptCF, CFURLCacheCopyResponseForRequest(cache.get(), request.get()));
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 33be75989..60fe731b9 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -199,6 +199,16 @@ void WebProcess::addMessageReceiver(CoreIPC::StringReference messageReceiverName
     m_messageReceiverMap.addMessageReceiver(messageReceiverName, messageReceiver);
 }
 
+void WebProcess::addMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID, CoreIPC::MessageReceiver* messageReceiver)
+{
+    m_messageReceiverMap.addMessageReceiver(messageReceiverName, destinationID, messageReceiver);
+}
+
+void WebProcess::removeMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID)
+{
+    m_messageReceiverMap.removeMessageReceiver(messageReceiverName, destinationID);
+}
+
 void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parameters, CoreIPC::MessageDecoder& decoder)
 {
     ASSERT(m_pageMap.isEmpty());
@@ -264,7 +274,8 @@ void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parame
     if (parameters.shouldUseFontSmoothing)
         setShouldUseFontSmoothing(true);
 
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
+    // FIXME (NetworkProcess): Send this identifier to network process.
     WebCore::ResourceHandle::setPrivateBrowsingStorageSessionIdentifierBase(parameters.uiProcessBundleIdentifier);
 #endif
 
@@ -297,8 +308,7 @@ void WebProcess::ensureNetworkProcessConnection()
 #else
     ASSERT_NOT_REACHED();
 #endif
-
-    RefPtr<NetworkProcessConnection> m_networkProcessConnection = NetworkProcessConnection::create(connectionIdentifier);
+    m_networkProcessConnection = NetworkProcessConnection::create(connectionIdentifier);
 }
 #endif // ENABLE(NETWORK_PROCESS)
 
@@ -651,18 +661,8 @@ void WebProcess::terminate()
 
 void WebProcess::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& replyEncoder)
 {
-    if (m_messageReceiverMap.dispatchSyncMessage(connection, messageID, decoder, replyEncoder))
-        return;
-
-    uint64_t pageID = decoder.destinationID();
-    if (!pageID)
-        return;
-    
-    WebPage* page = webPage(pageID);
-    if (!page)
+    m_messageReceiverMap.dispatchSyncMessage(connection, messageID, decoder, replyEncoder);
         return;
-    
-    page->didReceiveSyncMessage(connection, messageID, decoder, replyEncoder);
 }
 
 void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
@@ -692,25 +692,6 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
     }
 #endif
 
-#if ENABLE(BATTERY_STATUS)
-    if (messageID.is<CoreIPC::MessageClassWebBatteryManager>()) {
-        m_batteryManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
-
-#if ENABLE(NETWORK_INFO)
-    if (messageID.is<CoreIPC::MessageClassWebNetworkInfoManager>()) {
-        m_networkInfoManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
-
-    if (messageID.is<CoreIPC::MessageClassWebIconDatabaseProxy>()) {
-        m_iconDatabaseProxy.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-
     if (messageID.is<CoreIPC::MessageClassWebKeyValueStorageManager>()) {
         WebKeyValueStorageManager::shared().didReceiveMessage(connection, messageID, decoder);
         return;
@@ -720,25 +701,11 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         WebMediaCacheManager::shared().didReceiveMessage(connection, messageID, decoder);
         return;
     }
-
-#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
-    if (messageID.is<CoreIPC::MessageClassWebNotificationManager>()) {
-        m_notificationManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
     
     if (messageID.is<CoreIPC::MessageClassWebResourceCacheManager>()) {
         WebResourceCacheManager::shared().didReceiveMessage(connection, messageID, decoder);
         return;
     }
-
-#if USE(SOUP)
-    if (messageID.is<CoreIPC::MessageClassWebSoupRequestManager>()) {
-        m_soupRequestManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
     
     if (messageID.is<CoreIPC::MessageClassWebPageGroupProxy>()) {
         uint64_t pageGroupID = decoder.destinationID();
@@ -751,16 +718,6 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         
         pageGroupProxy->didReceiveMessage(connection, messageID, decoder);
     }
-
-    uint64_t pageID = decoder.destinationID();
-    if (!pageID)
-        return;
-    
-    WebPage* page = webPage(pageID);
-    if (!page)
-        return;
-    
-    page->didReceiveMessage(connection, messageID, decoder);
 }
 
 void WebProcess::didClose(CoreIPC::Connection*)
@@ -786,7 +743,7 @@ void WebProcess::didClose(CoreIPC::Connection*)
     m_runLoop->stop();
 }
 
-void WebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void WebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
     // We received an invalid message, but since this is from the UI process (which we trust),
     // we'll let it slide.
@@ -1075,8 +1032,18 @@ void WebProcess::postInjectedBundleMessage(const CoreIPC::DataReference& message
 }
 
 #if ENABLE(NETWORK_PROCESS)
+NetworkProcessConnection* WebProcess::networkConnection()
+{
+    // FIXME (NetworkProcess): How do we handle not having the connection when the WebProcess needs it?
+    // If the NetworkProcess crashed, for example.  Do we respawn it?
+    ASSERT(m_networkProcessConnection);
+    return m_networkProcessConnection.get();
+}
+
 void WebProcess::networkProcessConnectionClosed(NetworkProcessConnection* connection)
 {
+    // FIXME (NetworkProcess): How do we handle not having the connection when the WebProcess needs it?
+    // If the NetworkProcess crashed, for example.  Do we respawn it?
     ASSERT(m_networkProcessConnection);
     ASSERT(m_networkProcessConnection == connection);
 
@@ -1085,6 +1052,8 @@ void WebProcess::networkProcessConnectionClosed(NetworkProcessConnection* connec
 
 void WebProcess::networkProcessCrashed(CoreIPC::Connection*)
 {
+    // FIXME (NetworkProcess): How do we handle not having the connection when the WebProcess needs it?
+    // If the NetworkProcess crashed, for example.  Do we respawn it?
     ASSERT(m_networkProcessConnection);
     
     networkProcessConnectionClosed(m_networkProcessConnection.get());
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index 88b5f5799..0b3c0fb99 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -72,6 +72,10 @@ QT_END_NAMESPACE
 #include "WebNotificationManager.h"
 #endif
 
+#if ENABLE(NETWORK_PROCESS)
+#include "WebResourceLoadScheduler.h"
+#endif
+
 #if ENABLE(PLUGIN_PROCESS)
 #include "PluginProcessConnectionManager.h"
 #endif
@@ -115,6 +119,9 @@ public:
     WebCore::RunLoop* runLoop() const { return m_runLoop; }
 
     void addMessageReceiver(CoreIPC::StringReference messageReceiverName, CoreIPC::MessageReceiver*);
+    void addMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID, CoreIPC::MessageReceiver*);
+
+    void removeMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID);
 
     WebConnectionToUIProcess* webConnectionToUIProcess() const { return m_connection.get(); }
 
@@ -196,7 +203,10 @@ public:
 #endif
 
 #if ENABLE(NETWORK_PROCESS)
+    NetworkProcessConnection* networkConnection();
     void networkProcessConnectionClosed(NetworkProcessConnection*);
+    bool usesNetworkProcess() const { return m_usesNetworkProcess; }
+    WebResourceLoadScheduler& webResourceLoadScheduler() { return m_webResourceLoadScheduler; }
 #endif
 
 private:
@@ -278,7 +288,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 #if PLATFORM(WIN)
     virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
 #endif
@@ -354,6 +364,7 @@ private:
     void ensureNetworkProcessConnection();
     RefPtr<NetworkProcessConnection> m_networkProcessConnection;
     bool m_usesNetworkProcess;
+    WebResourceLoadScheduler m_webResourceLoadScheduler;
 #endif
 
 #if ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/WebProcess/WebProcess.messages.in b/Source/WebKit2/WebProcess/WebProcess.messages.in
index 2cc1e6280..2c1b43052 100644
--- a/Source/WebKit2/WebProcess/WebProcess.messages.in
+++ b/Source/WebKit2/WebProcess/WebProcess.messages.in
@@ -97,4 +97,8 @@ messages -> WebProcess {
     SecItemResponse(uint64_t requestID, WebKit::SecItemResponseData response) DispatchOnConnectionQueue
     SecKeychainItemResponse(uint64_t requestID, WebKit::SecKeychainItemResponseData response) DispatchOnConnectionQueue
 #endif
+
+#if PLATFORM(MAC)
+    SetApplicationIsOccluded(bool flag);
+#endif
 }
diff --git a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
index 589aa70fe..e4a807bca 100644
--- a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
+++ b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
@@ -41,6 +41,17 @@
 #include <wtf/MainThread.h>
 #include <wtf/text/CString.h>
 
+#ifdef HAVE_ECORE_X
+#include <Ecore_X.h>
+#include <X11/Xlib.h>
+#include <X11/extensions/Xext.h>
+
+static int dummyExtensionErrorHandler(Display*, _Xconst char*, _Xconst char*)
+{
+    return 0;
+}
+#endif
+
 #if USE(COORDINATED_GRAPHICS)
 #include "CoordinatedGraphicsLayer.h"
 #endif
@@ -64,6 +75,19 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
         return 1;
     }
 
+#ifdef HAVE_ECORE_X
+    XSetExtensionErrorHandler(dummyExtensionErrorHandler);
+
+    if (!ecore_x_init(0)) {
+        // Could not init ecore_x.
+        // PlatformScreenEfl and systemBeep() functions
+        // depend on ecore_x functionality.
+        ecore_shutdown();
+        eina_shutdown();
+        return 1;
+    }
+#endif
+
 #if ENABLE(GLIB_SUPPORT)
     g_type_init();
 
@@ -105,6 +129,10 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
     soup_cache_dump(soupCache);
     g_object_unref(soupCache);
 
+    ecore_x_shutdown();
+    ecore_shutdown();
+    eina_shutdown();
+
     return 0;
 
 }
diff --git a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp b/Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp
deleted file mode 100644
index f3c3eab9c..000000000
--- a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2011 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "WebAuthDialog.h"
-
-#include <WebCore/GtkAuthenticationDialog.h>
-
-typedef struct {
-    GObject parent;
-} WebAuthDialog;
-
-typedef struct {
-    GObjectClass parent;
-} WebAuthDialogClass;
-
-static void webAuthDialogSessionFeatureInit(SoupSessionFeatureInterface*, gpointer);
-
-G_DEFINE_TYPE_WITH_CODE(WebAuthDialog, web_auth_dialog, G_TYPE_OBJECT,
-                        G_IMPLEMENT_INTERFACE(SOUP_TYPE_SESSION_FEATURE,
-                                              webAuthDialogSessionFeatureInit))
-
-static void web_auth_dialog_class_init(WebAuthDialogClass*)
-{
-}
-
-static void web_auth_dialog_init(WebAuthDialog*)
-{
-}
-
-static void sessionAuthenticate(SoupSession* session, SoupMessage* message, SoupAuth* auth, gboolean, gpointer)
-{
-    WebCore::GtkAuthenticationDialog* authDialog = new WebCore::GtkAuthenticationDialog(0, session, message, auth);
-    authDialog->show();
-}
-
-static void attach(SoupSessionFeature*, SoupSession* session)
-{
-    g_signal_connect(session, "authenticate", G_CALLBACK(sessionAuthenticate), 0);
-}
-
-static void detach(SoupSessionFeature*, SoupSession* session)
-{
-    g_signal_handlers_disconnect_by_func(session, reinterpret_cast<gpointer>(sessionAuthenticate), 0);
-}
-
-static void webAuthDialogSessionFeatureInit(SoupSessionFeatureInterface* feature, gpointer)
-{
-    feature->attach = attach;
-    feature->detach = detach;
-}
diff --git a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.h b/Source/WebKit2/WebProcess/gtk/WebAuthDialog.h
deleted file mode 100644
index 9eafea10c..000000000
--- a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2011 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WebAuthDialog_h
-#define WebAuthDialog_h
-
-#include <glib-object.h>
-
-#define WEB_TYPE_AUTH_DIALOG (web_auth_dialog_get_type())
-
-GType web_auth_dialog_get_type();
-
-#endif // WebAuthDialog_h
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
index 7dacc226e..f17ac6cee 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
@@ -29,9 +29,7 @@
 
 #define LIBSOUP_USE_UNSTABLE_REQUEST_API
 
-#include "WebAuthDialog.h"
 #include "WKBase.h"
-#include <WebCore/GtkAuthenticationDialog.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/RunLoop.h>
 #include <WebKit2/WebProcess.h>
@@ -66,12 +64,10 @@ WK_EXPORT int WebProcessMainGtk(int argc, char* argv[])
     int socket = atoi(argv[1]);
     WebProcess::shared().initialize(socket, RunLoop::main());
 
-    SoupSession* session = WebCore::ResourceHandle::defaultSession();
-    soup_session_add_feature_by_type(session, WEB_TYPE_AUTH_DIALOG);
-
     // Despite using system CAs to validate certificates we're
     // accepting invalid certificates by default. New API will be
     // added later to let client accept/discard invalid certificates.
+    SoupSession* session = WebCore::ResourceHandle::defaultSession();
     g_object_set(session, SOUP_SESSION_SSL_USE_SYSTEM_CA_FILE, TRUE,
                  SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
index 10766d2cc..001deb4c8 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
@@ -53,6 +53,7 @@
 #endif
 
 #if ENABLE(WEB_PROCESS_SANDBOX)
+#import <pwd.h>
 #import <stdlib.h>
 #import <sysexits.h>
 
@@ -168,15 +169,9 @@ static void appendReadonlySandboxDirectory(Vector<const char*>& vector, const ch
     appendSandboxParameterPathInternal(vector, name, [path length] ? [(NSString *)path fileSystemRepresentation] : "");
 }
 
-static void appendReadwriteSandboxDirectory(Vector<const char*>& vector, const char* name, NSString *path)
+static void appendReadwriteSandboxDirectory(Vector<const char*>& vector, const char* name, const char* path)
 {
-    NSError *error = nil;
-
-    // This is very unlikely to fail, but in case it actually happens, we'd like some sort of output in the console.
-    if (![[NSFileManager defaultManager] createDirectoryAtPath:path withIntermediateDirectories:YES attributes:nil error:&error])
-        NSLog(@"could not create \"%@\", error %@", path, error);
-
-    appendSandboxParameterPathInternal(vector, name, [(NSString *)path fileSystemRepresentation]);
+    appendSandboxParameterPathInternal(vector, name, path);
 }
 
 #endif
@@ -215,8 +210,17 @@ void WebProcess::initializeSandbox(const String& clientIdentifier)
     appendReadwriteConfDirectory(sandboxParameters, "DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR);
     appendReadwriteConfDirectory(sandboxParameters, "DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR);
 
+    char buffer[4096];
+    int bufferSize = sizeof(buffer);
+    struct passwd pwd;
+    struct passwd* result = 0;
+    if (getpwuid_r(getuid(), &pwd, buffer, bufferSize, &result) || !result) {
+        WTFLogAlways("WebProcess: Couldn't find home directory\n");
+        exit(EX_NOPERM);
+    }
+
     // These are read-write paths.
-    appendReadwriteSandboxDirectory(sandboxParameters, "HOME_DIR", NSHomeDirectory());
+    appendReadwriteSandboxDirectory(sandboxParameters, "HOME_DIR", pwd.pw_dir);
 
     sandboxParameters.append(static_cast<const char*>(0));
 
@@ -224,7 +228,7 @@ void WebProcess::initializeSandbox(const String& clientIdentifier)
 
     char* errorBuf;
     if (sandbox_init_with_parameters(profilePath, SANDBOX_NAMED_EXTERNAL, sandboxParameters.data(), &errorBuf)) {
-        WTFLogAlways("WebProcess: couldn't initialize sandbox profile [%s] error '%s'\n", profilePath, errorBuf);
+        WTFLogAlways("WebProcess: Couldn't initialize sandbox profile [%s] error '%s'\n", profilePath, errorBuf);
         for (size_t i = 0; sandboxParameters[i]; i += 2)
             WTFLogAlways("%s=%s\n", sandboxParameters[i], sandboxParameters[i + 1]);
         exit(EX_NOPERM);
@@ -236,7 +240,7 @@ void WebProcess::initializeSandbox(const String& clientIdentifier)
     // This will override LSFileQuarantineEnabled from Info.plist unless sandbox quarantine is globally disabled.
     OSStatus error = WKEnableSandboxStyleFileQuarantine();
     if (error) {
-        WTFLogAlways("WebProcess: couldn't enable sandbox style file quarantine: %ld\n", (long)error);
+        WTFLogAlways("WebProcess: Couldn't enable sandbox style file quarantine: %ld\n", (long)error);
         exit(EX_NOPERM);
     }
 #endif
diff --git a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp
index b9b3587f4..c7d10c6b3 100644
--- a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp
+++ b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp
@@ -27,6 +27,7 @@
 #include "WebKitSoupRequestInputStream.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
+#include "WebSoupRequestManagerMessages.h"
 #include "WebSoupRequestManagerProxyMessages.h"
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/ResourceRequest.h>
@@ -80,6 +81,7 @@ WebSoupRequestManager::WebSoupRequestManager(WebProcess* process)
     : m_process(process)
     , m_schemes(adoptGRef(g_ptr_array_new_with_free_func(g_free)))
 {
+    m_process->addMessageReceiver(Messages::WebSoupRequestManager::messageReceiverName(), this);
 }
 
 WebSoupRequestManager::~WebSoupRequestManager()
diff --git a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h
index cae652ecf..8178411a6 100644
--- a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h
+++ b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h
@@ -20,6 +20,8 @@
 #ifndef WebSoupRequestManager_h
 #define WebSoupRequestManager_h
 
+#include "DataReference.h"
+#include "MessageReceiver.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -29,19 +31,12 @@
 typedef struct _GInputStream GInputStream;
 typedef struct _GSimpleAsyncResult GSimpleAsyncResult;
 
-namespace CoreIPC {
-class Connection;
-class DataReference;
-class MessageDecoder;
-class MessageID;
-}
-
 namespace WebKit {
 
 class WebProcess;
 struct WebSoupRequestAsyncData;
 
-class WebSoupRequestManager {
+class WebSoupRequestManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebSoupRequestManager);
 public:
     explicit WebSoupRequestManager(WebProcess*);
@@ -50,9 +45,11 @@ public:
     void send(GSimpleAsyncResult*, GCancellable*);
     GInputStream* finish(GSimpleAsyncResult*);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
+    // Implemented in generated WebSoupRequestManagerMessageReceiver.cpp
     void didReceiveWebSoupRequestManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
     void registerURIScheme(const String& scheme);
diff --git a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
index 25dbc36c4..40066a276 100644
--- a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
+++ b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
@@ -71,15 +71,13 @@ void WebProcess::platformSetCacheModel(CacheModel cacheModel)
 {
 #if USE(CFNETWORK)
     RetainPtr<CFStringRef> cfurlCacheDirectory;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef defaultStorageSession = ResourceHandle::defaultStorageSession())
         cfurlCacheDirectory.adoptCF(wkCopyFoundationCacheDirectory(defaultStorageSession));
     else
-#endif
         cfurlCacheDirectory.adoptCF(wkCopyFoundationCacheDirectory(0));
 
     if (!cfurlCacheDirectory)
-        cfurlCacheDirectory.adoptCF(WebCore::localUserSpecificStorageDirectory().createCFString());
+        cfurlCacheDirectory = WebCore::localUserSpecificStorageDirectory().createCFString();
 
     // As a fudge factor, use 1000 instead of 1024, in case the reported byte 
     // count doesn't align exactly to a megabyte boundary.
@@ -103,11 +101,9 @@ void WebProcess::platformSetCacheModel(CacheModel cacheModel)
     pageCache()->setCapacity(pageCacheCapacity);
 
     RetainPtr<CFURLCacheRef> cfurlCache;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef defaultStorageSession = ResourceHandle::defaultStorageSession())
         cfurlCache.adoptCF(wkCopyURLCache(defaultStorageSession));
     else
-#endif // USE(CFURLSTORAGESESSIONS)
         cfurlCache.adoptCF(CFURLCacheCopySharedURLCache());
 
     CFURLCacheSetMemoryCapacity(cfurlCache.get(), urlCacheMemoryCapacity);
@@ -122,11 +118,9 @@ void WebProcess::platformClearResourceCaches(ResourceCachesToClear cachesToClear
         return;
 
     RetainPtr<CFURLCacheRef> cache;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef defaultStorageSession = ResourceHandle::defaultStorageSession())
         cache.adoptCF(wkCopyURLCache(defaultStorageSession));
     else
-#endif // USE(CFURLSTORAGESESSIONS)
         cache.adoptCF(CFURLCacheCopySharedURLCache());
 
     CFURLCacheRemoveAllCachedResponses(cache.get());
@@ -148,13 +142,12 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     if (defaultStorageSession)
         return;
 
-    RetainPtr<CFStringRef> cachePath(AdoptCF, parameters.diskCacheDirectory.createCFString());
-    if (!cachePath)
+    if (!parameters.diskCacheDirectory)
         return;
 
     CFIndex cacheDiskCapacity = parameters.cfURLCacheDiskCapacity;
     CFIndex cacheMemoryCapacity = parameters.cfURLCacheMemoryCapacity;
-    RetainPtr<CFURLCacheRef> uiProcessCache(AdoptCF, CFURLCacheCreate(kCFAllocatorDefault, cacheMemoryCapacity, cacheDiskCapacity, cachePath.get()));
+    RetainPtr<CFURLCacheRef> uiProcessCache(AdoptCF, CFURLCacheCreate(kCFAllocatorDefault, cacheMemoryCapacity, cacheDiskCapacity, parameters.diskCacheDirectory.createCFString().get()));
     CFURLCacheSetSharedURLCache(uiProcessCache.get());
 #endif // USE(CFNETWORK)
 }