Imported WebKit commit c60cfe0fc09efd257aa0111d7b133b02deb8a63e (http://svn.webkit.org/repository/webkit/trunk@136119)

New snapshot that includes the fix for installing the QtWebProcess into libexec Change-Id: I01344e079cbdac5678c4cba6ffcc05f4597cf0d7 Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
author: Simon Hausmann <simon.hausmann@digia.com> 2012-11-29 12:18:48 +0100
committer: Simon Hausmann <simon.hausmann@digia.com> 2012-11-29 12:18:57 +0100
commit: 4c01d0526ba4dd8cff0c0ff22a6f0ab5eb973064 (patch)
tree: bed2fe914fe0f7ec70abfb47d2d84af8a3604d09 /Source/WebKit
parent: 01485457c9a5da3f1121015afd25bb53af77662e (diff)
download: qtwebkit-4c01d0526ba4dd8cff0c0ff22a6f0ab5eb973064.tar.gz
97 files changed, 2572 insertions, 467 deletions
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index 8c24a51cd..775887c06 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -56,6 +56,7 @@
 #include "EditorClientBlackBerry.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoaderClientBlackBerry.h"
 #if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
 #include "GeolocationClientMock.h"
@@ -372,7 +373,6 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_overflowExceedsContentsSize(false)
     , m_resetVirtualViewportOnCommitted(true)
     , m_shouldUseFixedDesktopMode(false)
-    , m_needTouchEvents(false)
     , m_preventIdleDimmingCount(0)
 #if ENABLE(TOUCH_EVENTS)
     , m_preventDefaultOnTouchStart(false)
@@ -703,7 +703,10 @@ void WebPagePrivate::load(const BlackBerry::Platform::String& url, const BlackBe
 
     request.setSuggestedSaveName(suggestedSaveName);
 
-    m_mainFrame->loader()->load(request, "" /* name */, false);
+    FrameLoadRequest frameRequest(m_mainFrame, request);
+    frameRequest.setFrameName("");
+    frameRequest.setShouldCheckNewWindowPolicy(true);
+    m_mainFrame->loader()->load(frameRequest);
 }
 
 void WebPage::load(const BlackBerry::Platform::String& url, const BlackBerry::Platform::String& networkToken, bool isInitial)
@@ -748,7 +751,7 @@ void WebPagePrivate::loadString(const BlackBerry::Platform::String& string, cons
         extractMIMETypeFromMediaType(contentType),
         extractCharsetFromMediaType(contentType),
         !failingURL.empty() ? parseUrl(failingURL) : KURL());
-    m_mainFrame->loader()->load(request, substituteData, false);
+    m_mainFrame->loader()->load(FrameLoadRequest(m_mainFrame, request, substituteData));
 }
 
 void WebPage::loadString(const BlackBerry::Platform::String& string, const BlackBerry::Platform::String& baseURL, const BlackBerry::Platform::String& mimeType, const BlackBerry::Platform::String& failingURL)
@@ -4010,7 +4013,7 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
 
     bool handled = false;
 
-    if (d->m_needTouchEvents && !event.m_type != Platform::TouchEvent::TouchInjected)
+    if (!event.m_type != Platform::TouchEvent::TouchInjected)
         handled = d->m_mainFrame->eventHandler()->handleTouchEvent(PlatformTouchEvent(&tEvent));
 
     if (d->m_preventDefaultOnTouchStart) {
@@ -5796,6 +5799,7 @@ void WebPagePrivate::didChangeSettings(WebSettings* webSettings)
 
     coreSettings->setFirstScheduledLayoutDelay(webSettings->firstScheduledLayoutDelay());
     coreSettings->setUseCache(webSettings->useWebKitCache());
+    coreSettings->setCookieEnabled(webSettings->areCookiesEnabled());
 
 #if ENABLE(SQL_DATABASE)
     // DatabaseTracker can only be initialized for once, so it doesn't
@@ -5918,11 +5922,6 @@ bool WebPage::isWebGLEnabled() const
     return d->m_page->settings()->webGLEnabled();
 }
 
-void WebPagePrivate::setNeedTouchEvents(bool value)
-{
-    m_needTouchEvents = value;
-}
-
 void WebPagePrivate::frameUnloaded(const Frame* frame)
 {
     m_inputHandler->frameUnloaded(frame);
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index 896f24c67..c86b674ba 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -103,7 +103,6 @@ public:
     virtual void notifyRunLayoutTestsFinished() = 0;
 
     virtual void notifyInRegionScrollableAreasChanged(const std::vector<Platform::ScrollViewBase*>&) = 0;
-    virtual void notifyNoMouseMoveOrTouchMoveHandlers() = 0;
 
     virtual void notifyDocumentOnLoad(bool) = 0;
 
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 10a209e33..b0df6e12c 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -490,7 +490,6 @@ public:
     bool m_overflowExceedsContentsSize;
     bool m_resetVirtualViewportOnCommitted;
     bool m_shouldUseFixedDesktopMode;
-    bool m_needTouchEvents;
     int m_preventIdleDimmingCount;
 
 #if ENABLE(TOUCH_EVENTS)
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 8950d4e85..981a30d4e 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,132 @@
+2012-11-28  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] CookieJarBlackBerry will use document settings for cookiesEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=103560
+
+        Reviewed by Rob Buis.
+
+        PR 253490
+
+        Syncing platform Websetting's cookieEnabled value with Page->setting's cookieEnabled
+        value.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::didChangeSettings):
+
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::load):
+        (BlackBerry::WebKit::WebPagePrivate::loadString):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-27  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] http:// origins can navigate to privileged local:// origins
+        https://bugs.webkit.org/show_bug.cgi?id=103437
+
+        Reviewed by Yong Li.
+
+        PR: 251489
+        When we aren't allowed to display the destination origin, we shouldn't
+        even create the window for it. In this way we can block the remote
+        origins(like http://) window.open local origins(like file:// and
+        local://) and avoid further security issues.
+        Chrome and Safari will open a blank window and fail to load. Firefox
+        will fail to open the window and report a load failure error which has
+        the same behavior as us. I would prefer this way as the window would
+        be useless and the calls after that would be harmful to us.
+
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::createWindow):
+
+2012-11-27  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Remove unnecessary backing store suspension in InputHandler::ensureFocusTextElementVisible
+        https://bugs.webkit.org/show_bug.cgi?id=103441
+
+        Reviewed by Rob Buis.
+        Internally reviewed by Mike Fenton.
+
+        Remove unnecessary backing store suspension in
+        InputHandler::ensureFocusTextElementVisible.
+
+        Not necessary anymore since both zoom and scroll adjustments
+        happen in an animation.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::load):
+        (BlackBerry::WebKit::WebPagePrivate::loadString):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::load):
+        (BlackBerry::WebKit::WebPagePrivate::loadString):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-26  Genevieve Mak  <gmak@rim.com>
+
+        [BlackBerry] Form controls don't show pressed state.
+        https://bugs.webkit.org/show_bug.cgi?id=103292
+
+        Reviewed by Rob Buis.
+
+        Reviewed internally by Eli Fidler and Mike Lattanzio.
+        We weren't sending touch events to webpages unless they
+        had JS touch event listeners which form controls don't have.
+        Now send them always and do a little cleanup.
+        PR #249791
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPage::touchEvent):
+        * Api/WebPageClient.h:
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::needTouchEvents):
+
+2012-11-26  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Null check calls associated with retrieving the caret rect.
+        https://bugs.webkit.org/show_bug.cgi?id=103281
+
+        Reviewed by Rob Buis.
+
+        Some of these calls can return null, which could lead to a crash.
+
+        Internally reviewed by Gen Mak.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::requestSpellingCheckingOptions):
+
 2012-11-26  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
 
         [BlackBerry] Should not autofill username and password when there're more than one password inputs on the same page
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index 78c12b2c9..657414010 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -215,8 +215,17 @@ bool ChromeClientBlackBerry::shouldForceDocumentStyleSelectorUpdate()
     return !m_webPagePrivate->m_webSettings->isJavaScriptEnabled() && !m_webPagePrivate->m_inputHandler->processingChange();
 }
 
-Page* ChromeClientBlackBerry::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features, const NavigationAction&)
-{
+Page* ChromeClientBlackBerry::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features, const NavigationAction&)
+{
+    // Bail out early when we aren't allowed to display the target origin, otherwise,
+    // it would be harmful and the window would be useless. This is the same check
+    // as the one in FrameLoader::loadFrameRequest().
+    const KURL& url = request.resourceRequest().url();
+    if (!request.requester()->canDisplay(url)) {
+        frame->loader()->reportLocalLoadFailed(frame, url.string());
+        return 0;
+    }
+
 #if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree && !m_webPagePrivate->m_dumpRenderTree->allowsOpeningWindow())
         return 0;
@@ -248,7 +257,7 @@ Page* ChromeClientBlackBerry::createWindow(Frame*, const FrameLoadRequest& reque
     if (features.dialog)
         flags |= WebPageClient::FlagWindowIsDialog;
 
-    WebPage* webPage = m_webPagePrivate->m_client->createWindow(x, y, width, height, flags, request.resourceRequest().url().string(), request.frameName());
+    WebPage* webPage = m_webPagePrivate->m_client->createWindow(x, y, width, height, flags, url.string(), request.frameName());
     if (!webPage)
         return 0;
 
@@ -656,7 +665,6 @@ PlatformPageClient ChromeClientBlackBerry::platformPageClient() const
 #if ENABLE(TOUCH_EVENTS)
 void ChromeClientBlackBerry::needTouchEvents(bool value)
 {
-    m_webPagePrivate->setNeedTouchEvents(value);
 }
 #endif
 
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index 0b92aec37..80fc06b6a 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -34,6 +34,7 @@
 #include "CredentialTransformData.h"
 #include "DumpRenderTreeClient.h"
 #include "ExternalExtension.h"
+#include "FrameLoadRequest.h"
 #include "FrameNetworkingContextBlackBerry.h"
 #include "FrameView.h"
 #include "HTMLFormElement.h"
@@ -750,7 +751,7 @@ void FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad(const ResourceE
     }
 
     m_loadingErrorPage = true;
-    m_frame->loader()->load(originalRequest, errorData, false);
+    m_frame->loader()->load(FrameLoadRequest(m_frame, originalRequest, errorData));
 }
 
 void FrameLoaderClientBlackBerry::dispatchWillSubmitForm(FramePolicyFunction function, PassRefPtr<FormState>)
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index 115b2fbc4..ca0fdf4bd 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -743,6 +743,9 @@ void InputHandler::requestSpellingCheckingOptions(imf_sp_text_t& spellCheckingOp
     if (m_webPage->focusedOrMainFrame()->selection()->selectionType() != VisibleSelection::CaretSelection)
         return;
 
+    if (!m_currentFocusElement || !m_currentFocusElement->document() || !m_currentFocusElement->document()->frame())
+        return;
+
     // imf_sp_text_t should be generated in pixel viewport coordinates.
     WebCore::IntRect caretRect = m_webPage->focusedOrMainFrame()->selection()->selection().visibleStart().absoluteCaretBounds();
     caretRect = m_webPage->focusedOrMainFrame()->view()->contentsToRootView(caretRect);
@@ -1120,8 +1123,6 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
 
     int fontHeight = selectionFocusRect.height();
 
-    m_webPage->suspendBackingStore();
-
     // If the text is too small, zoom in to make it a minimum size.
     // The minimum size being defined as 3 mm is a good value based on my observations.
     static const int s_minimumTextHeightInPixels = Graphics::Screen::primaryScreen()->heightInMMToPixels(3);
@@ -1221,7 +1222,6 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
         m_webPage->m_userPerformedManualScroll = true;
         m_webPage->client()->animateBlockZoom(zoomScaleRequired, m_webPage->m_finalBlockPoint);
     }
-    m_webPage->resumeBackingStore();
 }
 
 void InputHandler::ensureFocusPluginElementVisible()
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 24abafb25..293f6f11b 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,650 @@
+2012-11-29  Miguel Garcia  <miguelg@chromium.org>
+
+        Fix typo in description of openDateTimeChooser documentation
+        https://bugs.webkit.org/show_bug.cgi?id=103622
+
+        Reviewed by Kent Tamura.
+
+
+        * public/WebViewClient.h:
+        (WebViewClient):
+
+2012-11-28  Robert Kroeger  <rjkroege@chromium.org>
+
+        remove unused PlatformGestureCurve code
+        https://bugs.webkit.org/show_bug.cgi?id=103296
+
+        Reviewed by Adam Barth.
+
+        Previous CLs have made the Chromium embedder provide gesture fling
+        curve implementation to WebKit. Consequently no platform uses the
+        gestural fling code currently found in WebKit. This CL removes this code.
+
+        Code removal only: covered by existing tests.
+
+        * WebKit.gypi:
+        * tests/PlatformGestureCurveTest.cpp: Removed.
+
+2012-11-28  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Remove pluginsScriptableObject from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=103542
+
+        Reviewed by Adam Barth.
+
+        Part of a refactoring series. See tracking bug 82948.
+
+        * src/PlatformSupport.cpp:
+        (WebCore):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-11-28  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium][Win] Remove ensureFontLoaded from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=97696
+
+        Reviewed by Adam Barth.
+
+        Move ensureFontLoaded() from PlatformSupport to
+        FontPlatformDataChromiumWin. Part of a refactoring series; see
+        tracking bug 82948.
+
+        * src/PlatformSupport.cpp:
+        (WebCore):
+
+2012-11-28  Eric Uhrhane  <ericu@chromium.org>
+
+        [chromium] Add unit tests for ChromeClientImpl::getNavigationPolicy
+        https://bugs.webkit.org/show_bug.cgi?id=102424
+
+        Reviewed by Adam Barth.
+
+        This tests a bunch of basic scenarios regarding what will produce a
+        popup, a new foreground/background tab, or a new window.
+
+        * WebKit.gypi: Added test file.
+        * src/WebViewImpl.h:
+        (WebViewImpl): Added friend declaration for setCurrentInputEventForTest.
+        * tests/ChromeClientImplTest.cpp: Added.
+
+2012-11-28  Alexandre Elias  <aelias@chromium.org>
+
+        [chromium] Handle pinch correctly in slow-scrolling area
+        https://bugs.webkit.org/show_bug.cgi?id=102740
+
+        Reviewed by James Robinson.
+
+        With the nonmodal gesture event model, pinch zoom gestures involve
+        interleaved pinch and scroll events. This caused a bug on slow-scroll
+        areas: the scroll events were sent to the main thread and
+        the pinch events were handled in the impl thread.
+
+        This patch makes it so that scroll events are always handled in the impl
+        thread if a pinch is active.
+
+        * src/WebCompositorInputHandlerImpl.cpp:
+        (WebKit::WebCompositorInputHandlerImpl::WebCompositorInputHandlerImpl):
+        (WebKit::WebCompositorInputHandlerImpl::handleInputEventInternal):
+        * src/WebCompositorInputHandlerImpl.h:
+        * tests/WebCompositorInputHandlerImplTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit):
+
+2012-11-28  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        [chromium] Allow plugins to opt-in to receive synthetic mouse events out of touch events.
+        https://bugs.webkit.org/show_bug.cgi?id=103092
+
+        Reviewed by Tony Chang.
+
+        A plugin can now request to receive raw touch events, or to receive mouse events synthesized
+        from the touch events, or to not receive any touch events at all.
+
+        * public/WebPluginContainer.h:
+        (WebPluginContainer):
+        * src/WebInputEventConversion.cpp:
+        (WebKit::updateWebMouseEventFromWebCoreMouseEvent):
+        (WebKit::WebMouseEventBuilder::WebMouseEventBuilder):
+        (WebKit):
+        * src/WebInputEventConversion.h:
+        (WebMouseEventBuilder):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setIsAcceptingTouchEvents):
+        (WebKit):
+        (WebKit::WebPluginContainerImpl::requestTouchEventType):
+        (WebKit::WebPluginContainerImpl::WebPluginContainerImpl):
+        (WebKit::WebPluginContainerImpl::~WebPluginContainerImpl):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-11-28  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Remove setVersion from WK API
+        https://bugs.webkit.org/show_bug.cgi?id=103456
+
+        Reviewed by Darin Fisher.
+
+        These are the last vestiges of this ancient API. The bulk of the
+        removal was done in bug 94972.
+
+        * public/WebIDBCallbacks.h:
+        * public/WebIDBDatabase.h:
+
+2012-11-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadRequest):
+        (WebKit::WebFrameImpl::loadData):
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::initializeLoader):
+
+2012-11-27  Eberhard Graether  <egraether@google.com>
+
+        [chromium] Add WebLayerTreeViewClient API to request font atlas
+        https://bugs.webkit.org/show_bug.cgi?id=102958
+
+        Reviewed by James Robinson.
+
+        This change makes the font atlas creation accessible to the WebLayerTreeView.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::createFontAtlas):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-27  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Simplify transaction timers and event tracking
+        https://bugs.webkit.org/show_bug.cgi?id=102984
+
+        Reviewed by Tony Chang.
+
+        Remove now-unused didCompleteTaskEvents() method.
+
+        * src/IDBTransactionBackendProxy.cpp:
+        * src/IDBTransactionBackendProxy.h:
+        (IDBTransactionBackendProxy):
+        * src/WebIDBTransactionImpl.cpp:
+        * src/WebIDBTransactionImpl.h:
+
+2012-11-27  Alpha Lam  <hclam@chromium.org>
+
+        [chromium] Implement full-featured image cache
+        https://bugs.webkit.org/show_bug.cgi?id=99784
+
+        Reviewed by Stephen White.
+
+        Added ImageFrameGeneratorTest to test cache logic and generation
+        of new cache entries.
+
+        ImageFrameGeneratorTest.cacheHit
+        Test that a complete cached entry is reused.
+
+        ImageFrameGeneratorTest.cacheMissWithScale
+        Cache miss for a scaled image but cache hit on a full size image.
+        Scaled image is created from cached full size image.
+
+        ImageFrameGeneratorTest.cacheMissWithDecodeAndScale
+        Cache miss for both scaled image and full size image.
+
+        ImageFrameGeneratorTest.cacheMissWithIncompleteDecode
+        Test the logic for handling incomplete cache objects.
+
+        * WebKit.gypi:
+        * src/WebKit.cpp:
+        (WebKit::initializeWithoutV8):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setDeferredImageDecodingEnabled):
+        * tests/DeferredImageDecoderTest.cpp:
+        (WebCore::DeferredImageDecoderTest::SetUp):
+        (WebCore::DeferredImageDecoderTest::decoderBeingDestroyed):
+        (WebCore::DeferredImageDecoderTest::frameBufferRequested):
+        (DeferredImageDecoderTest):
+        (WebCore::DeferredImageDecoderTest::frameStatus):
+        * tests/ImageFrameGeneratorTest.cpp: Added.
+        (WebCore):
+        (WebCore::fullSize):
+        (WebCore::scaledSize):
+        (MockImageDecoderFactory):
+        (WebCore::MockImageDecoderFactory::create):
+        (WebCore::MockImageDecoderFactory::MockImageDecoderFactory):
+        (ImageFrameGeneratorTest):
+        (WebCore::ImageFrameGeneratorTest::SetUp):
+        (WebCore::ImageFrameGeneratorTest::TearDown):
+        (WebCore::ImageFrameGeneratorTest::decoderBeingDestroyed):
+        (WebCore::ImageFrameGeneratorTest::frameBufferRequested):
+        (WebCore::ImageFrameGeneratorTest::frameStatus):
+        (WebCore::ImageFrameGeneratorTest::createCompleteImage):
+        (WebCore::ImageFrameGeneratorTest::setFrameStatus):
+        (WebCore::TEST_F):
+        * tests/MockImageDecoder.h:
+        (MockImageDecoderClient):
+        (WebCore::MockImageDecoder::frameBufferAtIndex):
+
+2012-11-27  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Remove IDBDatabase.setVersion API
+        https://bugs.webkit.org/show_bug.cgi?id=94972
+
+        Reviewed by Tony Chang.
+
+        * src/IDBCallbacksProxy.cpp:
+        * src/IDBCallbacksProxy.h:
+        (IDBCallbacksProxy):
+        * src/IDBDatabaseBackendProxy.cpp:
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/WebIDBCallbacksImpl.cpp:
+        * src/WebIDBCallbacksImpl.h:
+        (WebIDBCallbacksImpl):
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+
+2012-11-27  Eberhard Graether  <egraether@google.com>
+
+        Plumbing showPaintRects out of InspectorPageAgent to use a different drawing implementation if available.
+        https://bugs.webkit.org/show_bug.cgi?id=102452
+
+        Reviewed by Pavel Feldman.
+
+        This change makes the showPaintRects setting in the Web Inspector's settings notify InspectorClient
+        when changed. And the default paint rects drawing is not used if an alternative is available.
+        This allows Chromium to draw the paint rects in the compositor's HUDLayer.
+
+        * public/WebView.h:
+        (WebView):
+        * src/InspectorClientImpl.cpp:
+        (WebKit::InspectorClientImpl::overridesShowPaintRects):
+        (WebKit):
+        (WebKit::InspectorClientImpl::setShowPaintRects):
+        * src/InspectorClientImpl.h:
+        (InspectorClientImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setShowPaintRects):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-27  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed build fix on Linux clang.
+
+        ../../third_party/WebKit/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp:1055:63: error:
+        C++98 requires an accessible copy constructor for class 'WebKit::WebCachedURLRequest' when binding
+        a reference to a temporary; was private [-Werror,-Wbind-to-temporary-copy]
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchWillRequestResource):
+
+2012-11-27  Marja Hölttä  <marja@chromium.org>
+
+        Add callbacks to the FrameLoaderClient when a resource is requested
+        https://bugs.webkit.org/show_bug.cgi?id=92761
+
+        Reviewed by Adam Barth.
+
+        In Chromium, when an extension script cancels a network
+        request (which happens out of process), we'd like to
+        notify content scripts running on the current page about
+        which elements failed to load because the requests were
+        cancelled (as opposed to e.g. the network request just
+        didn't work). Since the resource request itself does not
+        carry any information what DOM element is was made for,
+        currently a content script has to search the DOM tree and
+        guess which requests will be cancelled by its counter
+        part. By adding these callbacks, the embedder can make
+        this connection explictly.
+
+        * WebKit.gyp:
+        * public/WebCachedURLRequest.h: Added.
+        (WebKit):
+        (WebCachedURLRequest):
+        (WebKit::WebCachedURLRequest::~WebCachedURLRequest):
+        * public/WebFrameClient.h:
+        (WebKit):
+        (WebFrameClient):
+        (WebKit::WebFrameClient::willRequestResource):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchWillRequestResource):
+        (WebKit):
+        * src/FrameLoaderClientImpl.h:
+        (FrameLoaderClientImpl):
+        * src/WebCachedURLRequest.cpp: Added.
+        (WebKit):
+        (WebKit::WebCachedURLRequest::reset):
+        (WebKit::WebCachedURLRequest::urlRequest):
+        (WebKit::WebCachedURLRequest::charset):
+        (WebKit::WebCachedURLRequest::forPreload):
+        (WebKit::WebCachedURLRequest::initiatorName):
+        (WebKit::WebCachedURLRequest::initiatorElement):
+        (WebKit::WebCachedURLRequest::WebCachedURLRequest):
+
+2012-11-27  Keishi Hattori  <keishi@webkit.org>
+
+        Add WebLocalizedString for validation type badinput
+        https://bugs.webkit.org/show_bug.cgi?id=103381
+
+        Reviewed by Kent Tamura.
+
+        * src/LocalizedStrings.cpp:
+        (WebCore::validationMessageBadInputForNumberText): Using the newly added WebLocalizedString enum.
+        (WebCore::validationMessageBadInputForDateTimeText): Ditto.
+
+2012-11-27  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: stub out IDBDatabaseBackendInterface::createTransaction
+        https://bugs.webkit.org/show_bug.cgi?id=102730
+
+        Reviewed by Darin Fisher.
+
+        Add support for new createTransaction() method in both sides
+        of the WebKit API.
+
+        * public/WebIDBDatabase.h:
+        (WebIDBDatabase):
+        (WebKit::WebIDBDatabase::createTransaction):
+        * src/IDBDatabaseBackendProxy.cpp:
+        (WebKit):
+        (WebKit::IDBDatabaseBackendProxy::createTransaction):
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp:
+        (WebKit::WebIDBDatabaseImpl::createTransaction):
+        (WebKit):
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadRequest):
+        (WebKit::WebFrameImpl::loadData):
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::initializeLoader):
+
+2012-11-25  Kent Tamura  <tkent@chromium.org>
+
+        Implement ValidityState::badInput
+        https://bugs.webkit.org/show_bug.cgi?id=102861
+
+        Reviewed by Hajime Morita.
+
+        * src/LocalizedStrings.cpp:
+        Add placeholder implementations for new localized string functions.
+        We'll update them in another patch.
+        (WebCore::validationMessageBadInputForNumberText):
+        (WebCore::validationMessageBadInputForDateTimeText):
+
+2012-11-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135798.
+        http://trac.webkit.org/changeset/135798
+        https://bugs.webkit.org/show_bug.cgi?id=103354
+
+        Broke the chrome mac build (Requested by noel_ on #webkit).
+
+        * WebKit.gypi:
+        * src/WebKit.cpp:
+        (WebKit::initializeWithoutV8):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setDeferredImageDecodingEnabled):
+        * tests/DeferredImageDecoderTest.cpp:
+        (WebCore::DeferredImageDecoderTest::SetUp):
+        (WebCore::DeferredImageDecoderTest::decoderBeingDestroyed):
+        * tests/ImageFrameGeneratorTest.cpp: Removed.
+        * tests/MockImageDecoder.h:
+        (MockImageDecoderClient):
+        (WebCore::MockImageDecoder::frameBufferAtIndex):
+
+2012-11-26  Alexandre Elias  <aelias@chromium.org>
+
+        [chromium] Touchscreen fling handling
+        https://bugs.webkit.org/show_bug.cgi?id=103278
+
+        Reviewed by James Robinson.
+
+        The fling logic for touchpad can fall through to bad
+        performance in several ways. This patch introduces an alternate
+        path for touchscreen fling that simplifies it as follows:
+
+        - Stop generating wheel events, to prevent unnecessary scrollBegin hit
+        tests and to avoid falling back to slow path if a wheel handler is
+        registered.
+
+        - Drop the event on ScrollStatusIgnored. There's no real reason to
+        send the event to the WebKit thread here.
+
+        - Don't call transferActiveWheelFlingAnimation. This type of
+        transition shouldn't be needed with touchscreen flings.
+
+        * src/WebCompositorInputHandlerImpl.cpp:
+        (WebKit::WebCompositorInputHandlerImpl::handleGestureFling):
+        (WebKit::WebCompositorInputHandlerImpl::animate):
+        (WebKit::WebCompositorInputHandlerImpl::cancelCurrentFling):
+        (WebKit::WebCompositorInputHandlerImpl::scrollBy):
+        * src/WebCompositorInputHandlerImpl.h:
+
+2012-11-26  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove WorkerContextExecutionProxy.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=103325
+
+        Reviewed by Adam Barth.
+
+        Now WorkerContextExecutionProxy.{h,cpp} are empty.
+
+        No tests. No change in behavior.
+
+        * src/WebKit.cpp:
+        * src/WebWorkerClientImpl.cpp:
+
+2012-11-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove deprecated and unused WebGraphicsContext3D compositor binding calls
+        https://bugs.webkit.org/show_bug.cgi?id=103322
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-26  Alpha Lam  <hclam@chromium.org>
+
+        [chromium] Implement full-featured image cache
+        https://bugs.webkit.org/show_bug.cgi?id=99784
+
+        Reviewed by James Robinson.
+
+        Added ImageFrameGeneratorTest to test cache logic and generation
+        of new cache entries.
+
+        ImageFrameGeneratorTest.cacheHit
+        Test that a complete cached entry is reused.
+
+        ImageFrameGeneratorTest.cacheMissWithScale
+        Cache miss for a scaled image but cache hit on a full size image.
+        Scaled image is created from cached full size image.
+
+        ImageFrameGeneratorTest.cacheMissWithDecodeAndScale
+        Cache miss for both scaled image and full size image.
+
+        ImageFrameGeneratorTest.cacheMissWithIncompleteDecode
+        Test the logic for handling incomplete cache objects.
+
+        * WebKit.gypi:
+        * src/WebKit.cpp:
+        (WebKit::initializeWithoutV8):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setDeferredImageDecodingEnabled):
+        * tests/DeferredImageDecoderTest.cpp:
+        (WebCore::DeferredImageDecoderTest::SetUp):
+        (WebCore::DeferredImageDecoderTest::decoderBeingDestroyed):
+        (WebCore::DeferredImageDecoderTest::frameBufferRequested):
+        (DeferredImageDecoderTest):
+        (WebCore::DeferredImageDecoderTest::frameStatus):
+        * tests/ImageFrameGeneratorTest.cpp: Added.
+        (WebCore):
+        (WebCore::fullSize):
+        (WebCore::scaledSize):
+        (MockImageDecoderFactory):
+        (WebCore::MockImageDecoderFactory::create):
+        (WebCore::MockImageDecoderFactory::MockImageDecoderFactory):
+        (ImageFrameGeneratorTest):
+        (WebCore::ImageFrameGeneratorTest::SetUp):
+        (WebCore::ImageFrameGeneratorTest::TearDown):
+        (WebCore::ImageFrameGeneratorTest::decoderBeingDestroyed):
+        (WebCore::ImageFrameGeneratorTest::frameBufferRequested):
+        (WebCore::ImageFrameGeneratorTest::frameStatus):
+        (WebCore::ImageFrameGeneratorTest::createCompleteImage):
+        (WebCore::ImageFrameGeneratorTest::setFrameStatus):
+        (WebCore::TEST_F):
+        * tests/MockImageDecoder.h:
+        (MockImageDecoderClient):
+        (WebCore::MockImageDecoder::frameBufferAtIndex):
+
+2012-11-26  Varun Jain  <varunjain@chromium.org>
+
+        LongPress and LongTap gestures should start drag/drop and open context menu respectively.
+        https://bugs.webkit.org/show_bug.cgi?id=101545
+
+        Reviewed by Antonio Gomes.
+
+        For LongPress, we simulate drag by sending a mouse down and mouse drag
+        events. If a drag is not started (because maybe there is no draggable
+        element), then we show context menu instead (which is the current
+        behavior for LongPress). For LongTap, we use the existing functions that
+        LongPress uses to summon the context menu. LongPress initiated drag and
+        drop can be enabled/disabled by the platform using the Setting
+        touchDragDropEnabled which is disabled by default.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setTouchDragDropEnabled):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-11-26  Yusuf Ozuysal  <yusufo@google.com>
+
+        Add hasTouchEventhandlersAt to WebView API
+        https://bugs.webkit.org/show_bug.cgi?id=102541
+
+        Reviewed by James Robinson.
+
+        Adds hasTouchEventHandlersAt to WebWidget API to check for touch event handlers at a
+        given point. This will be used to distinguish between events not processed by
+        touch event handlers and event not hitting any touch event handlers. Both are
+        returning the same ACK message currently. Default implementation returns true to
+        continue the same behavior as we currently have.
+
+        * public/WebWidget.h:
+        (WebWidget):
+        (WebKit::WebWidget::hasTouchEventHandlersAt):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::hasTouchEventHandlersAt):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadRequest):
+        (WebKit::WebFrameImpl::loadData):
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::initializeLoader):
+
+2012-11-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135743.
+        http://trac.webkit.org/changeset/135743
+        https://bugs.webkit.org/show_bug.cgi?id=103280
+
+        Caused compile failure 'SK_DISABLE_DITHER_32BIT_GRADIENT'
+        macro redefined (Requested by rjkroege on #webkit).
+
+        * skia_webkit.gyp:
+
+2012-11-26  Mike Reed  <reed@google.com>
+
+        add SK_DISABLE_DITHER_32BIT_GRADIENT define, in preparation for rebaselining
+        https://bugs.webkit.org/show_bug.cgi?id=103272
+
+        Reviewed by NOBODY. Unreviewed.
+
+        No behavior change, as this define already exists on the chrome side in SkUserConfig.h
+
+        * skia_webkit.gyp:
+
+2012-11-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135735.
+        http://trac.webkit.org/changeset/135735
+        https://bugs.webkit.org/show_bug.cgi?id=103270
+
+        Caused breakage across the Chromium tree. (Requested by
+        rjkroege_ on #webkit).
+
+        * skia_webkit.gyp:
+
+2012-11-26  Mike Reed  <reed@google.com>
+
+        add SK_DISABLE_DITHER_32BIT_GRADIENT define, in preparation for rebaselining
+        https://bugs.webkit.org/show_bug.cgi?id=103269
+
+        Reviewed by NOBODY. Unreviewed.
+
+        No behavior change, as this define already exists on the chrome side in SkUserConfig.h
+
+        * skia_webkit.gyp:
+
+2012-11-26  Scott Violet  <sky@chromium.org>
+
+        [chromium] Make use_default_render_theme compile the right set of files
+        https://bugs.webkit.org/show_bug.cgi?id=102952
+
+        Reviewed by Kent Tamura.
+
+        * WebKit.gyp: Adds WebRenderTheme.* and updates rules as to when to compile them.
+        * features.gypi: Removes use_default_render_theme default values as common.gypi sets them.
+        * public/default: Added.
+        * public/default/WebRenderTheme.h: Copy of linux/WebRenderTheme.h
+        * src/default: Added.
+        * src/default/WebRenderTheme.cpp: Copy of linux/WebRenderTheme.cpp
+
 2012-11-24  Silvia Pfeiffer  <silviapf@chromium.org>
 
         [chromium] Remove traces of MediaControlRootElement
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 31ff1844f..c04782eb3 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '169306'
+  'chromium_rev': '169895'
 }
 
 deps = {
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 92afddaa0..0e6f0c9a0 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -108,6 +108,7 @@
                 'public/WebBindings.h',
                 'public/WebBlob.h',
                 'public/WebCache.h',
+                'public/WebCachedURLRequest.h',
                 'public/WebColorChooser.h',
                 'public/WebColorChooserClient.h',
                 'public/WebColorName.h',
@@ -288,6 +289,7 @@
                 'public/WebWorkerInfo.h',
                 'public/android/WebInputEventFactory.h',
                 'public/android/WebSandboxSupport.h',
+                'public/default/WebRenderTheme.h',
                 'public/gtk/WebInputEventFactory.h',
                 'public/linux/WebFontRenderStyle.h',
                 'public/linux/WebFontRendering.h',
@@ -432,6 +434,7 @@
                 'src/PrerendererClientImpl.h',
                 'src/PrerendererClientImpl.cpp',
                 'src/android/WebInputEventFactory.cpp',
+                'src/default/WebRenderTheme.cpp',
                 'src/linux/WebFontInfo.cpp',
                 'src/linux/WebFontRendering.cpp',
                 'src/linux/WebFontRenderStyle.cpp',
@@ -489,6 +492,7 @@
                 'src/WebBlob.cpp',
                 'src/WebBlobData.cpp',
                 'src/WebCache.cpp',
+                'src/WebCachedURLRequest.cpp',
                 'src/WebColorName.cpp',
                 'src/WebCommon.cpp',
                 'src/WebCompositorInputHandlerImpl.cpp',
@@ -840,6 +844,20 @@
                         }],
                     ],
                 }],
+                ['use_default_render_theme==1', {
+                    'sources/': [
+                        ['exclude', 'src/linux/WebRenderTheme.cpp'],
+                        ['exclude', 'public/linux/WebRenderTheme.h'],
+                    ],
+                    'include_dirs': [
+                        'public/default',
+                    ],
+                }, { # else use_default_render_theme==0
+                    'sources/': [
+                        ['exclude', 'src/default/WebRenderTheme.cpp'],
+                        ['exclude', 'public/default/WebRenderTheme.h'],
+                    ],
+                }],
             ],
             'target_conditions': [
                 ['OS=="android"', {
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index dd5d6cf1b..3ad3e20da 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -57,6 +57,7 @@
             'tests/AssociatedURLLoaderTest.cpp',
             'tests/Canvas2DLayerBridgeTest.cpp',
             'tests/Canvas2DLayerManagerTest.cpp',
+            'tests/ChromeClientImplTest.cpp',
             'tests/ClipboardChromiumTest.cpp',
             'tests/CompositorFakeWebGraphicsContext3D.h',
             'tests/DateTimeFormatTest.cpp',
@@ -80,6 +81,7 @@
             'tests/IDBKeyPathTest.cpp',
             'tests/IDBLevelDBCodingTest.cpp',
             'tests/IDBRequestTest.cpp',
+            'tests/ImageFrameGeneratorTest.cpp',
             'tests/ImageLayerChromiumTest.cpp',
             'tests/MockImageDecoder.h',
             'tests/KeyboardTest.cpp',
@@ -95,7 +97,6 @@
             'tests/PODRedBlackTreeTest.cpp',
             'tests/PaintAggregatorTest.cpp',
             'tests/PlatformContextSkiaTest.cpp',
-            'tests/PlatformGestureCurveTest.cpp',
             'tests/PopupContainerTest.cpp',
             'tests/RegionTest.cpp',
             'tests/RenderTableCellTest.cpp',
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 8e2aaf317..a7bf6367a 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -146,13 +146,11 @@
       'enable_touch_events%': 1,
       'enable_touch_icon_loading%' : 0,
       'enable_mutation_observers%': 1,
-      'use_default_render_theme%': 0,
     },
     'use_accelerated_compositing%': '<(use_accelerated_compositing)',
     'enable_skia_text%': '<(enable_skia_text)',
     'enable_svg%': '<(enable_svg)',
     'enable_touch_events%': '<(enable_touch_events)',
-    'use_default_render_theme%': '<(use_default_render_theme)',
     'conditions': [
       ['OS=="android"', {
         'feature_defines': [
diff --git a/Source/WebKit/chromium/public/WebCachedURLRequest.h b/Source/WebKit/chromium/public/WebCachedURLRequest.h
new file mode 100644
index 000000000..5006a749d
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebCachedURLRequest.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCachedURLRequest_h
+#define WebCachedURLRequest_h
+
+#include "WebElement.h"
+#include "platform/WebCommon.h"
+#include "platform/WebPrivateOwnPtr.h"
+#include "platform/WebString.h"
+
+namespace WebCore { class CachedResourceRequest; }
+
+namespace WebKit {
+
+class WebElement;
+class WebString;
+class WebURLRequest;
+class WrappedResourceRequest;
+
+class WebCachedURLRequest {
+public:
+    ~WebCachedURLRequest() { reset(); }
+    WEBKIT_EXPORT void reset();
+
+    WEBKIT_EXPORT const WebURLRequest& urlRequest() const;
+    WEBKIT_EXPORT WebString charset() const;
+    WEBKIT_EXPORT bool forPreload() const;
+    WEBKIT_EXPORT WebString initiatorName() const;
+    WEBKIT_EXPORT WebElement initiatorElement() const;
+
+#if WEBKIT_IMPLEMENTATION
+    explicit WebCachedURLRequest(WebCore::CachedResourceRequest*);
+#endif
+
+private:
+    WebCachedURLRequest(const WebCachedURLRequest&);
+    WebCachedURLRequest& operator=(const WebCachedURLRequest&);
+
+    WebCore::CachedResourceRequest* m_private;
+    mutable WebPrivateOwnPtr<WrappedResourceRequest> m_resourceRequestWrapper;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebFrameClient.h b/Source/WebKit/chromium/public/WebFrameClient.h
index bda3c0389..c2eee586a 100644
--- a/Source/WebKit/chromium/public/WebFrameClient.h
+++ b/Source/WebKit/chromium/public/WebFrameClient.h
@@ -50,6 +50,7 @@ namespace WebKit {
 
 class WebApplicationCacheHost;
 class WebApplicationCacheHostClient;
+class WebCachedURLRequest;
 class WebCookieJar;
 class WebDataSource;
 class WebDOMEvent;
@@ -251,6 +252,9 @@ public:
      // the client keeps such an association.
      virtual void removeIdentifierForRequest(unsigned identifier) { }
 
+    // An element will request a resource.
+    virtual void willRequestResource(WebFrame*, const WebCachedURLRequest&) { }
+
     // A request is about to be sent out, and the client may modify it.  Request
     // is writable, and changes to the URL, for example, will change the request
     // made.  If this request is the result of a redirect, then redirectResponse
diff --git a/Source/WebKit/chromium/public/WebIDBCallbacks.h b/Source/WebKit/chromium/public/WebIDBCallbacks.h
index b91b0f5a2..09861f133 100644
--- a/Source/WebKit/chromium/public/WebIDBCallbacks.h
+++ b/Source/WebKit/chromium/public/WebIDBCallbacks.h
@@ -53,7 +53,6 @@ public:
     virtual void onSuccess(WebIDBCursor*, const WebIDBKey& key, const WebIDBKey& primaryKey, const WebSerializedScriptValue&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBDatabase*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebIDBKey&) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void onSuccess(WebIDBTransaction*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&, const WebIDBKey&, const WebIDBKeyPath&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(long long) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBDatabase.h b/Source/WebKit/chromium/public/WebIDBDatabase.h
index b92799039..3aef7bdb0 100644
--- a/Source/WebKit/chromium/public/WebIDBDatabase.h
+++ b/Source/WebKit/chromium/public/WebIDBDatabase.h
@@ -56,13 +56,15 @@ public:
         return 0;
     }
     virtual void deleteObjectStore(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Remove this as part of https://bugs.webkit.org/show_bug.cgi?id=102733.
     // Transfers ownership of the WebIDBTransaction to the caller.
     virtual WebIDBTransaction* transaction(const WebVector<long long>&, unsigned short mode)
     {
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    // Transfers ownership of the WebIDBTransaction to the caller.
+    virtual WebIDBTransaction* createTransaction(long long id, const WebVector<long long>&, unsigned short mode) { WEBKIT_ASSERT_NOT_REACHED(); return 0; }
     virtual void close() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void forceClose() { WEBKIT_ASSERT_NOT_REACHED(); }
 
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index 1229014da..aad631f67 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -47,6 +47,12 @@ struct WebRect;
 
 class WebPluginContainer {
 public:
+    enum TouchEventRequestType {
+        TouchEventRequestTypeNone,
+        TouchEventRequestTypeRaw,
+        TouchEventRequestTypeSynthesizedMouse,
+    };
+
     // Returns the element containing this plugin.
     virtual WebElement element() = 0;
 
@@ -111,9 +117,12 @@ public:
     // content. The rectangle is in the plugin's coordinate system.
     virtual bool isRectTopmost(const WebRect&) = 0;
 
-    // Notifies when the plugin starts/stops accepting touch events.
+    // Notifies when the plugin starts/stops accepting touch events. This is deprecated, use requestTouchEventType instead.
     virtual void setIsAcceptingTouchEvents(bool) = 0;
 
+    // Notifies when the plugin changes the kind of touch-events it accepts.
+    virtual void requestTouchEventType(TouchEventRequestType) = 0;
+
     // Notifies when the plugin starts/stops accepting wheel events. Without
     // calling the function with true, the container might not always able to
     // receive wheel events in some cases (such as when threaded compositing
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 2d356fa6a..4c9d0cc64 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -158,6 +158,7 @@ public:
     virtual void setTextAutosizingEnabled(bool) = 0;
     virtual void setTextAutosizingFontScaleFactor(float) = 0;
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded() = 0;
+    virtual void setTouchDragDropEnabled(bool) = 0;
     virtual void setUnifiedTextCheckerEnabled(bool) = 0;
     virtual void setUserStyleSheetLocation(const WebURL&) = 0;
     virtual void setUsesEncodingDetector(bool) = 0;
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index 2ec1b1bad..7a7d3f4c7 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -471,6 +471,7 @@ public:
 
     virtual bool isSelectionEditable() const = 0;
 
+    virtual void setShowPaintRects(bool) = 0;
     virtual void setShowFPSCounter(bool) = 0;
 
     // Benchmarking support -------------------------------------------------
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 5b3cbc0b1..c6e175dba 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -225,7 +225,7 @@ public:
                                 WebFileChooserCompletion*) { return false; }
 
     // Ask users to choose date/time for the specified parameters. When a user
-    // chooses a value, an implemenattion of this function should call
+    // chooses a value, an implementation of this function should call
     // WebDateTimeChooserCompletion::didChooseValue or didCancelChooser. If the
     // implementation opened date/time chooser UI successfully, it should return
     // true. This function is used only if ExternalDateTimeChooser is used.
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index f2b394439..da23951f9 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -157,6 +157,9 @@ public:
     // the event has been processed, false otherwise.
     virtual bool handleInputEvent(const WebInputEvent&) { return false; }
 
+    // Check whether the given point hits any registered touch event handlers.
+    virtual bool hasTouchEventHandlersAt(const WebPoint&) { return true; }
+
     // Called to inform the WebWidget that mouse capture was lost.
     virtual void mouseCaptureLost() { }
 
diff --git a/Source/WebKit/chromium/public/default/WebRenderTheme.h b/Source/WebKit/chromium/public/default/WebRenderTheme.h
new file mode 100644
index 000000000..ae517c664
--- /dev/null
+++ b/Source/WebKit/chromium/public/default/WebRenderTheme.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Joel Stanley. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRenderTheme_h
+#define WebRenderTheme_h
+
+#include "../platform/WebCommon.h"
+
+namespace WebKit {
+
+// Set caret blink interval for text input areas.
+WEBKIT_EXPORT void setCaretBlinkInterval(double);
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index 9d0aab495..fdf56b5f6 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -65,6 +65,7 @@
 #if ENABLE(REQUEST_AUTOCOMPLETE)
 #include "WebAutofillClient.h"
 #endif
+#include "WebCachedURLRequest.h"
 #include "WebDOMEvent.h"
 #include "WebDataSourceImpl.h"
 #include "WebDevToolsAgentPrivate.h"
@@ -1048,6 +1049,14 @@ void FrameLoaderClientImpl::dispatchUnableToImplementPolicy(const ResourceError&
     m_webFrame->client()->unableToImplementPolicyWithError(m_webFrame, error);
 }
 
+void FrameLoaderClientImpl::dispatchWillRequestResource(CachedResourceRequest* request)
+{
+    if (m_webFrame->client()) {
+        WebCachedURLRequest urlRequest(request);
+        m_webFrame->client()->willRequestResource(m_webFrame, urlRequest);
+    }
+}
+
 void FrameLoaderClientImpl::dispatchWillSendSubmitEvent(PassRefPtr<FormState> prpFormState)
 {
     if (m_webFrame->client())
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 2aa624bdf..78fea62fa 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -118,6 +118,7 @@ public:
     virtual void dispatchDecidePolicyForNavigationAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState> form_state);
     virtual void cancelPolicyCheck();
     virtual void dispatchUnableToImplementPolicy(const WebCore::ResourceError&);
+    virtual void dispatchWillRequestResource(WebCore::CachedResourceRequest*);
     virtual void dispatchWillSendSubmitEvent(PassRefPtr<WebCore::FormState>);
     virtual void dispatchWillSubmitForm(WebCore::FramePolicyFunction, PassRefPtr<WebCore::FormState>);
     virtual void revertToProvisionalState(WebCore::DocumentLoader*) { }
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 81cb549e5..837cc32a6 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -87,11 +87,6 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBKey> idbKey)
     m_callbacks->onSuccess(WebIDBKey(idbKey));
 }
 
-void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBTransactionBackendInterface> backend)
-{
-    m_callbacks->onSuccess(new WebIDBTransactionImpl(backend));
-}
-
 void IDBCallbacksProxy::onSuccess(PassRefPtr<DOMStringList> domStringList)
 {
     m_callbacks->onSuccess(WebDOMStringList(domStringList));
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.h b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
index c940698f7..65f3b740a 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -51,7 +51,6 @@ public:
     virtual void onSuccess(PassRefPtr<WebCore::IDBCursorBackendInterface>, PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBKey> primaryKey, PassRefPtr<WebCore::SerializedScriptValue>);
     virtual void onSuccess(PassRefPtr<WebCore::IDBDatabaseBackendInterface>);
     virtual void onSuccess(PassRefPtr<WebCore::IDBKey>);
-    virtual void onSuccess(PassRefPtr<WebCore::IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<WebCore::SerializedScriptValue>);
     virtual void onSuccess(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, const WebCore::IDBKeyPath&);
     virtual void onSuccess(int64_t);
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
index 0bc95466d..91a419a3e 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
@@ -85,15 +85,19 @@ void IDBDatabaseBackendProxy::deleteObjectStore(int64_t objectStoreId, IDBTransa
     m_webIDBDatabase->deleteObjectStore(objectStoreId, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBDatabaseBackendProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks, ExceptionCode& ec)
+// FIXME: Remove this as part of https://bugs.webkit.org/show_bug.cgi?id=102733.
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(const Vector<int64_t>& objectStoreIds, unsigned short mode)
 {
-    ASSERT(m_webIDBDatabase);
-    m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks), ec);
+    OwnPtr<WebIDBTransaction> transaction = adoptPtr(m_webIDBDatabase->transaction(objectStoreIds, mode));
+    if (!transaction)
+        return 0;
+
+    return IDBTransactionBackendProxy::create(transaction.release());
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(const Vector<int64_t>& objectStoreIds, unsigned short mode)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::createTransaction(int64_t id, const Vector<int64_t>& objectStoreIds, unsigned short mode)
 {
-    OwnPtr<WebIDBTransaction> transaction = adoptPtr(m_webIDBDatabase->transaction(objectStoreIds, mode));
+    OwnPtr<WebIDBTransaction> transaction = adoptPtr(m_webIDBDatabase->createTransaction(id, objectStoreIds, mode));
     if (!transaction)
         return 0;
 
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
index aa8fdf0c9..4e7cce29e 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
@@ -46,8 +46,9 @@ public:
 
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> createObjectStore(int64_t, const String& name, const WebCore::IDBKeyPath&, bool autoIncrement, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteObjectStore(int64_t, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    virtual void setVersion(const String& version, PassRefPtr<WebCore::IDBCallbacks>, PassRefPtr<WebCore::IDBDatabaseCallbacks>, WebCore::ExceptionCode&);
+    // FIXME: Remove this as part of https://bugs.webkit.org/show_bug.cgi?id=102733.
     virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> transaction(const Vector<int64_t>&, unsigned short mode);
+    virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> createTransaction(int64_t, const Vector<int64_t>&, unsigned short mode);
     virtual void close(PassRefPtr<WebCore::IDBDatabaseCallbacks>);
 
 private:
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index 572963c13..6e0134c2a 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -72,11 +72,6 @@ void IDBTransactionBackendProxy::abort()
     m_webIDBTransaction->abort();
 }
 
-void IDBTransactionBackendProxy::didCompleteTaskEvents()
-{
-    m_webIDBTransaction->didCompleteTaskEvents();
-}
-
 void IDBTransactionBackendProxy::setCallbacks(IDBTransactionCallbacks* callbacks)
 {
     m_webIDBTransaction->setCallbacks(new WebIDBTransactionCallbacksImpl(callbacks));
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
index 0a6a53b84..8ead3164c 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -44,7 +44,6 @@ public:
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(int64_t, WebCore::ExceptionCode&);
     virtual void commit();
     virtual void abort();
-    virtual void didCompleteTaskEvents();
     virtual void setCallbacks(WebCore::IDBTransactionCallbacks*);
 
     WebIDBTransaction* getWebIDBTransaction() const { return m_webIDBTransaction.get(); }
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.cpp b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
index 220b7db74..3d69376d7 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
@@ -163,6 +163,16 @@ void InspectorClientImpl::autoZoomPageToFitWidth()
         agent->autoZoomPageToFitWidth();
 }
 
+bool InspectorClientImpl::overridesShowPaintRects()
+{
+    return m_inspectedWebView->isAcceleratedCompositingActive();
+}
+
+void InspectorClientImpl::setShowPaintRects(bool show)
+{
+    m_inspectedWebView->setShowPaintRects(show);
+}
+
 bool InspectorClientImpl::canShowFPSCounter()
 {
     return true;
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.h b/Source/WebKit/chromium/src/InspectorClientImpl.h
index a759257af..b9e3b8419 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.h
@@ -77,6 +77,9 @@ public:
     virtual void overrideDeviceMetrics(int, int, float, bool);
     virtual void autoZoomPageToFitWidth();
 
+    virtual bool overridesShowPaintRects();
+    virtual void setShowPaintRects(bool);
+
     virtual bool canShowFPSCounter();
     virtual void setShowFPSCounter(bool);
 
diff --git a/Source/WebKit/chromium/src/LocalizedStrings.cpp b/Source/WebKit/chromium/src/LocalizedStrings.cpp
index a5c2024fa..309611381 100644
--- a/Source/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/Source/WebKit/chromium/src/LocalizedStrings.cpp
@@ -504,4 +504,16 @@ String validationMessageStepMismatchText(const String& base, const String& step)
     return query(WebLocalizedString::ValidationStepMismatch, base, step);
 }
 
+String validationMessageBadInputForNumberText()
+{
+    return query(WebLocalizedString::ValidationBadInputForNumber);
+}
+
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+String validationMessageBadInputForDateTimeText()
+{
+    return query(WebLocalizedString::ValidationBadInputForDateTime);
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/PlatformSupport.cpp b/Source/WebKit/chromium/src/PlatformSupport.cpp
index d7a4fbbfc..d7f0dccea 100644
--- a/Source/WebKit/chromium/src/PlatformSupport.cpp
+++ b/Source/WebKit/chromium/src/PlatformSupport.cpp
@@ -104,19 +104,6 @@ using namespace WebKit;
 
 namespace WebCore {
 
-// Font -----------------------------------------------------------------------
-
-#if OS(WINDOWS)
-bool PlatformSupport::ensureFontLoaded(HFONT font)
-{
-    WebSandboxSupport* ss = WebKit::Platform::current()->sandboxSupport();
-
-    // if there is no sandbox, then we can assume the font
-    // was able to be loaded successfully already
-    return ss ? ss->ensureFontLoaded(font) : true;
-}
-#endif
-
 // Indexed Database -----------------------------------------------------------
 
 PassRefPtr<IDBFactoryBackendInterface> PlatformSupport::idbFactory()
@@ -135,14 +122,6 @@ bool PlatformSupport::plugins(bool refresh, Vector<PluginInfo>* results)
     return true;  // FIXME: There is no need for this function to return a value.
 }
 
-NPObject* PlatformSupport::pluginScriptableObject(Widget* widget)
-{
-    if (!widget || !widget->isPluginContainer())
-        return 0;
-
-    return static_cast<WebPluginContainerImpl*>(widget)->scriptableObject();
-}
-
 // Theming --------------------------------------------------------------------
 
 #if OS(WINDOWS) && !ENABLE(DEFAULT_RENDER_THEME)
diff --git a/Source/WebKit/chromium/src/WebCachedURLRequest.cpp b/Source/WebKit/chromium/src/WebCachedURLRequest.cpp
new file mode 100644
index 000000000..370c541d1
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebCachedURLRequest.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCachedURLRequest.h"
+
+#include "CachedResourceRequest.h"
+#include "Element.h"
+#include "WrappedResourceRequest.h"
+#include <public/WebURLRequest.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebCachedURLRequest::reset()
+{
+    m_resourceRequestWrapper.reset(0);
+    m_private = 0;
+}
+
+const WebURLRequest& WebCachedURLRequest::urlRequest() const
+{
+    if (!m_resourceRequestWrapper.get())
+        m_resourceRequestWrapper.reset(new WrappedResourceRequest(m_private->resourceRequest()));
+    else
+        m_resourceRequestWrapper->bind(m_private->resourceRequest());
+    return *m_resourceRequestWrapper.get();
+}
+
+WebString WebCachedURLRequest::charset() const
+{
+    return WebString(m_private->charset());
+}
+
+bool WebCachedURLRequest::forPreload() const
+{
+    return m_private->forPreload();
+}
+
+WebString WebCachedURLRequest::initiatorName() const
+{
+    return WebString(m_private->initiatorName());
+}
+
+WebElement WebCachedURLRequest::initiatorElement() const
+{
+    return WebElement(m_private->initiatorElement());
+}
+
+WebCachedURLRequest::WebCachedURLRequest(CachedResourceRequest* request)
+    : m_private(request)
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 74836d55f..0f8dbcc95 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -69,7 +69,8 @@ WebCompositorInputHandlerImpl::WebCompositorInputHandlerImpl()
     , m_expectScrollUpdateEnd(false)
     , m_expectPinchUpdateEnd(false)
 #endif
-    , m_gestureScrollStarted(false)
+    , m_gestureScrollOnImplThread(false)
+    , m_gesturePinchOnImplThread(false)
 {
 }
 
@@ -118,7 +119,7 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
         WebInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(WebPoint(wheelEvent.x, wheelEvent.y), WebInputHandlerClient::ScrollInputTypeWheel);
         switch (scrollStatus) {
         case WebInputHandlerClient::ScrollStatusStarted: {
-            TRACE_EVENT_INSTANT2("cc", "WebCompositorInputHandlerImpl::handleInput wheel scroll", "deltaX", -wheelEvent.deltaX, "deltaY", -wheelEvent.deltaY);
+            TRACE_EVENT_INSTANT2("webkit", "WebCompositorInputHandlerImpl::handleInput wheel scroll", "deltaX", -wheelEvent.deltaX, "deltaY", -wheelEvent.deltaY);
             bool didScroll = m_inputHandlerClient->scrollByIfPossible(WebPoint(wheelEvent.x, wheelEvent.y), IntSize(-wheelEvent.deltaX, -wheelEvent.deltaY));
             m_inputHandlerClient->scrollEnd();
             return didScroll ? DidHandle : DropEvent;
@@ -131,7 +132,7 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
             return DidNotHandle;
         }
     } else if (event.type == WebInputEvent::GestureScrollBegin) {
-        ASSERT(!m_gestureScrollStarted);
+        ASSERT(!m_gestureScrollOnImplThread);
         ASSERT(!m_expectScrollUpdateEnd);
 #ifndef NDEBUG
         m_expectScrollUpdateEnd = true;
@@ -140,7 +141,7 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
         WebInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(WebPoint(gestureEvent.x, gestureEvent.y), WebInputHandlerClient::ScrollInputTypeGesture);
         switch (scrollStatus) {
         case WebInputHandlerClient::ScrollStatusStarted:
-            m_gestureScrollStarted = true;
+            m_gestureScrollOnImplThread = true;
             return DidHandle;
         case WebInputHandlerClient::ScrollStatusOnMainThread:
             return DidNotHandle;
@@ -150,7 +151,7 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
     } else if (event.type == WebInputEvent::GestureScrollUpdate) {
         ASSERT(m_expectScrollUpdateEnd);
 
-        if (!m_gestureScrollStarted)
+        if (!m_gestureScrollOnImplThread && !m_gesturePinchOnImplThread)
             return DidNotHandle;
 
         const WebGestureEvent& gestureEvent = *static_cast<const WebGestureEvent*>(&event);
@@ -162,11 +163,11 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
 #ifndef NDEBUG
         m_expectScrollUpdateEnd = false;
 #endif
-        if (!m_gestureScrollStarted)
+        if (!m_gestureScrollOnImplThread)
             return DidNotHandle;
 
         m_inputHandlerClient->scrollEnd();
-        m_gestureScrollStarted = false;
+        m_gestureScrollOnImplThread = false;
         return DidHandle;
     } else if (event.type == WebInputEvent::GesturePinchBegin) {
         ASSERT(!m_expectPinchUpdateEnd);
@@ -174,12 +175,14 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
         m_expectPinchUpdateEnd = true;
 #endif
         m_inputHandlerClient->pinchGestureBegin();
+        m_gesturePinchOnImplThread = true;
         return DidHandle;
     } else if (event.type == WebInputEvent::GesturePinchEnd) {
         ASSERT(m_expectPinchUpdateEnd);
 #ifndef NDEBUG
         m_expectPinchUpdateEnd = false;
 #endif
+        m_gesturePinchOnImplThread = false;
         m_inputHandlerClient->pinchGestureEnd();
         return DidHandle;
     } else if (event.type == WebInputEvent::GesturePinchUpdate) {
@@ -205,26 +208,30 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
     WebInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(WebPoint(gestureEvent.x, gestureEvent.y), WebInputHandlerClient::ScrollInputTypeGesture);
     switch (scrollStatus) {
     case WebInputHandlerClient::ScrollStatusStarted: {
-        m_inputHandlerClient->scrollEnd();
-        m_wheelFlingCurve = adoptPtr(Platform::current()->createFlingAnimationCurve(gestureEvent.data.flingStart.sourceDevice, WebFloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY), WebSize()));
-        TRACE_EVENT_ASYNC_BEGIN0("cc", "WebCompositorInputHandlerImpl::handleGestureFling::started", this);
-        m_wheelFlingParameters.delta = WebFloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY);
-        m_wheelFlingParameters.point = WebPoint(gestureEvent.x, gestureEvent.y);
-        m_wheelFlingParameters.globalPoint = WebPoint(gestureEvent.globalX, gestureEvent.globalY);
-        m_wheelFlingParameters.modifiers = gestureEvent.modifiers;
-        m_wheelFlingParameters.sourceDevice = gestureEvent.data.flingStart.sourceDevice;
+        if (gestureEvent.data.flingStart.sourceDevice == WebGestureEvent::Touchpad)
+            m_inputHandlerClient->scrollEnd();
+        m_flingCurve = adoptPtr(Platform::current()->createFlingAnimationCurve(gestureEvent.data.flingStart.sourceDevice, WebFloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY), WebSize()));
+        TRACE_EVENT_ASYNC_BEGIN0("webkit", "WebCompositorInputHandlerImpl::handleGestureFling::started", this);
+        m_flingParameters.delta = WebFloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY);
+        m_flingParameters.point = WebPoint(gestureEvent.x, gestureEvent.y);
+        m_flingParameters.globalPoint = WebPoint(gestureEvent.globalX, gestureEvent.globalY);
+        m_flingParameters.modifiers = gestureEvent.modifiers;
+        m_flingParameters.sourceDevice = gestureEvent.data.flingStart.sourceDevice;
         m_inputHandlerClient->scheduleAnimation();
         return DidHandle;
     }
     case WebInputHandlerClient::ScrollStatusOnMainThread: {
-        TRACE_EVENT_INSTANT0("cc", "WebCompositorInputHandlerImpl::handleGestureFling::scrollOnMainThread");
+        TRACE_EVENT_INSTANT0("webkit", "WebCompositorInputHandlerImpl::handleGestureFling::scrollOnMainThread");
         return DidNotHandle;
     }
     case WebInputHandlerClient::ScrollStatusIgnored: {
-        TRACE_EVENT_INSTANT0("cc", "WebCompositorInputHandlerImpl::handleGestureFling::ignored");
-        // We still pass the curve to the main thread if there's nothing scrollable, in case something
-        // registers a handler before the curve is over.
-        return DidNotHandle;
+        TRACE_EVENT_INSTANT0("webkit", "WebCompositorInputHandlerImpl::handleGestureFling::ignored");
+        if (gestureEvent.data.flingStart.sourceDevice == WebGestureEvent::Touchpad) {
+            // We still pass the curve to the main thread if there's nothing scrollable, in case something
+            // registers a handler before the curve is over.
+            return DidNotHandle;
+        }
+        return DropEvent;
     }
     }
     return DidNotHandle;
@@ -234,7 +241,7 @@ void WebCompositorInputHandlerImpl::bindToClient(WebInputHandlerClient* client)
 {
     ASSERT(!m_inputHandlerClient);
 
-    TRACE_EVENT_INSTANT0("cc", "WebCompositorInputHandlerImpl::bindToClient");
+    TRACE_EVENT_INSTANT0("webkit", "WebCompositorInputHandlerImpl::bindToClient");
     if (!s_compositors)
         s_compositors = new HashSet<WebCompositorInputHandlerImpl*>;
     s_compositors->add(this);
@@ -244,71 +251,94 @@ void WebCompositorInputHandlerImpl::bindToClient(WebInputHandlerClient* client)
 
 void WebCompositorInputHandlerImpl::animate(double monotonicTime)
 {
-    if (!m_wheelFlingCurve)
+    if (!m_flingCurve)
         return;
 
-    if (!m_wheelFlingParameters.startTime) {
-        m_wheelFlingParameters.startTime = monotonicTime;
+    if (!m_flingParameters.startTime) {
+        m_flingParameters.startTime = monotonicTime;
         m_inputHandlerClient->scheduleAnimation();
         return;
     }
 
-    if (m_wheelFlingCurve->apply(monotonicTime - m_wheelFlingParameters.startTime, this))
+    if (m_flingCurve->apply(monotonicTime - m_flingParameters.startTime, this))
         m_inputHandlerClient->scheduleAnimation();
     else {
-        TRACE_EVENT_INSTANT0("cc", "WebCompositorInputHandlerImpl::animate::flingOver");
+        TRACE_EVENT_INSTANT0("webkit", "WebCompositorInputHandlerImpl::animate::flingOver");
         cancelCurrentFling();
     }
 }
 
 bool WebCompositorInputHandlerImpl::cancelCurrentFling()
 {
-    bool hadFlingAnimation = m_wheelFlingCurve;
-    if (hadFlingAnimation)
-        TRACE_EVENT_ASYNC_END0("cc", "WebCompositorInputHandlerImpl::handleGestureFling::started", this);
+    bool hadFlingAnimation = m_flingCurve;
+    if (hadFlingAnimation && m_flingParameters.sourceDevice == WebGestureEvent::Touchscreen) {
+        m_inputHandlerClient->scrollEnd();
+        TRACE_EVENT_ASYNC_END0("webkit", "WebCompositorInputHandlerImpl::handleGestureFling::started", this);
+    }
 
-    TRACE_EVENT_INSTANT1("cc", "WebCompositorInputHandlerImpl::cancelCurrentFling", "hadFlingAnimation", hadFlingAnimation);
-    m_wheelFlingCurve.clear();
-    m_wheelFlingParameters = WebActiveWheelFlingParameters();
+    TRACE_EVENT_INSTANT1("webkit", "WebCompositorInputHandlerImpl::cancelCurrentFling", "hadFlingAnimation", hadFlingAnimation);
+    m_flingCurve.clear();
+    m_flingParameters = WebActiveWheelFlingParameters();
     return hadFlingAnimation;
 }
 
-void WebCompositorInputHandlerImpl::scrollBy(const WebPoint& increment)
+bool WebCompositorInputHandlerImpl::touchpadFlingScroll(const WebPoint& increment)
 {
-    if (increment == WebPoint())
-        return;
-
-    TRACE_EVENT2("cc", "WebCompositorInputHandlerImpl::scrollBy", "x", increment.x, "y", increment.y);
     WebMouseWheelEvent syntheticWheel;
     syntheticWheel.type = WebInputEvent::MouseWheel;
     syntheticWheel.deltaX = increment.x;
     syntheticWheel.deltaY = increment.y;
     syntheticWheel.hasPreciseScrollingDeltas = true;
-    syntheticWheel.x = m_wheelFlingParameters.point.x;
-    syntheticWheel.y = m_wheelFlingParameters.point.y;
-    syntheticWheel.globalX = m_wheelFlingParameters.globalPoint.x;
-    syntheticWheel.globalY = m_wheelFlingParameters.globalPoint.y;
-    syntheticWheel.modifiers = m_wheelFlingParameters.modifiers;
+    syntheticWheel.x = m_flingParameters.point.x;
+    syntheticWheel.y = m_flingParameters.point.y;
+    syntheticWheel.globalX = m_flingParameters.globalPoint.x;
+    syntheticWheel.globalY = m_flingParameters.globalPoint.y;
+    syntheticWheel.modifiers = m_flingParameters.modifiers;
 
     WebCompositorInputHandlerImpl::EventDisposition disposition = handleInputEventInternal(syntheticWheel);
     switch (disposition) {
     case DidHandle:
-        m_wheelFlingParameters.cumulativeScroll.width += increment.x;
-        m_wheelFlingParameters.cumulativeScroll.height += increment.y;
+        return true;
     case DropEvent:
         break;
     case DidNotHandle:
-        TRACE_EVENT_INSTANT0("cc", "WebCompositorInputHandlerImpl::scrollBy::AbortFling");
+        TRACE_EVENT_INSTANT0("webkit", "WebCompositorInputHandlerImpl::scrollBy::AbortFling");
         // If we got a DidNotHandle, that means we need to deliver wheels on the main thread.
         // In this case we need to schedule a commit and transfer the fling curve over to the main
         // thread and run the rest of the wheels from there.
         // This can happen when flinging a page that contains a scrollable subarea that we can't
         // scroll on the thread if the fling starts outside the subarea but then is flung "under" the
         // pointer.
-        m_client->transferActiveWheelFlingAnimation(m_wheelFlingParameters);
+        m_client->transferActiveWheelFlingAnimation(m_flingParameters);
         cancelCurrentFling();
         break;
     }
+
+    return false;
+}
+
+void WebCompositorInputHandlerImpl::scrollBy(const WebPoint& increment)
+{
+    if (increment == WebPoint())
+        return;
+
+    TRACE_EVENT2("webkit", "WebCompositorInputHandlerImpl::scrollBy", "x", increment.x, "y", increment.y);
+
+    bool didScroll = false;
+
+    switch (m_flingParameters.sourceDevice) {
+    case WebGestureEvent::Touchpad:
+        didScroll = touchpadFlingScroll(increment);
+        break;
+    case WebGestureEvent::Touchscreen:
+        didScroll = m_inputHandlerClient->scrollByIfPossible(m_flingParameters.point, IntSize(-increment.x, -increment.y));
+        break;
+    }
+
+    if (didScroll) {
+        m_flingParameters.cumulativeScroll.width += increment.x;
+        m_flingParameters.cumulativeScroll.height += increment.y;
+    }
 }
 
 }
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
index efe7f53b4..5c79addff 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
@@ -78,12 +78,15 @@ private:
 
     EventDisposition handleGestureFling(const WebGestureEvent&);
 
+    // Returns true if we scrolled by the increment.
+    bool touchpadFlingScroll(const WebPoint& increment);
+
     // Returns true if we actually had an active fling to cancel.
     bool cancelCurrentFling();
 
-    OwnPtr<WebGestureCurve> m_wheelFlingCurve;
+    OwnPtr<WebGestureCurve> m_flingCurve;
     // Parameters for the active fling animation, stored in case we need to transfer it out later.
-    WebActiveWheelFlingParameters m_wheelFlingParameters;
+    WebActiveWheelFlingParameters m_flingParameters;
 
     WebCompositorInputHandlerClient* m_client;
     int m_identifier;
@@ -93,7 +96,8 @@ private:
     bool m_expectScrollUpdateEnd;
     bool m_expectPinchUpdateEnd;
 #endif
-    bool m_gestureScrollStarted;
+    bool m_gestureScrollOnImplThread;
+    bool m_gesturePinchOnImplThread;
 
     static int s_nextAvailableIdentifier;
     static HashSet<WebCompositorInputHandlerImpl*>* s_compositors;
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index eacf9aba8..5d32afd85 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -957,7 +957,7 @@ void WebFrameImpl::loadRequest(const WebURLRequest& request)
         return;
     }
 
-    frame()->loader()->load(resourceRequest, false);
+    frame()->loader()->load(FrameLoadRequest(frame(), resourceRequest));
 }
 
 void WebFrameImpl::loadHistoryItem(const WebHistoryItem& item)
@@ -976,8 +976,6 @@ void WebFrameImpl::loadHistoryItem(const WebHistoryItem& item)
 void WebFrameImpl::loadData(const WebData& data, const WebString& mimeType, const WebString& textEncoding, const WebURL& baseURL, const WebURL& unreachableURL, bool replace)
 {
     ASSERT(frame());
-    SubstituteData substData(data, mimeType, textEncoding, unreachableURL);
-    ASSERT(substData.isValid());
 
     // If we are loading substitute data to replace an existing load, then
     // inherit all of the properties of that original request.  This way,
@@ -990,7 +988,9 @@ void WebFrameImpl::loadData(const WebData& data, const WebString& mimeType, cons
         request = frame()->loader()->originalRequest();
     request.setURL(baseURL);
 
-    frame()->loader()->load(request, substData, false);
+    FrameLoadRequest frameRequest(frame(), request, SubstituteData(data, mimeType, textEncoding, unreachableURL));
+    ASSERT(frameRequest.substituteData().isValid());
+    frame()->loader()->load(frameRequest);
     if (replace) {
         // Do this to force WebKit to treat the load as replacing the currently
         // loaded page.
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index 8d12cfa3e..dcf303b39 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -86,11 +86,6 @@ void WebIDBCallbacksImpl::onSuccess(const WebIDBKey& key)
     m_callbacks->onSuccess(key);
 }
 
-void WebIDBCallbacksImpl::onSuccess(WebIDBTransaction* webKitInstance)
-{
-    m_callbacks->onSuccess(IDBTransactionBackendProxy::create(adoptPtr(webKitInstance)));
-}
-
 void WebIDBCallbacksImpl::onSuccess(const WebSerializedScriptValue& serializedScriptValue)
 {
     m_callbacks->onSuccess(serializedScriptValue);
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
index ba4448428..8f8c02aaa 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -46,7 +46,6 @@ public:
     virtual void onSuccess(WebIDBCursor*, const WebIDBKey&, const WebIDBKey& primaryKey, const WebSerializedScriptValue&);
     virtual void onSuccess(WebIDBDatabase*);
     virtual void onSuccess(const WebIDBKey&);
-    virtual void onSuccess(WebIDBTransaction*);
     virtual void onSuccess(const WebSerializedScriptValue&);
     virtual void onSuccess(const WebSerializedScriptValue&, const WebIDBKey&, const WebIDBKeyPath&);
     virtual void onSuccess(const WebIDBKey&, const WebIDBKey& primaryKey, const WebSerializedScriptValue&);
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index 59abd5329..622465de4 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -75,9 +75,15 @@ void WebIDBDatabaseImpl::deleteObjectStore(long long objectStoreId, const WebIDB
     m_databaseBackend->deleteObjectStore(objectStoreId, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
+WebIDBTransaction* WebIDBDatabaseImpl::createTransaction(long long id, const WebVector<long long>& objectStoreIds, unsigned short mode)
 {
-    m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(adoptPtr(callbacks)), m_databaseCallbacks, ec);
+    Vector<int64_t> objectStoreIdList(objectStoreIds.size());
+    for (size_t i = 0; i < objectStoreIds.size(); ++i)
+        objectStoreIdList[i] = objectStoreIds[i];
+    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->createTransaction(id, objectStoreIdList, mode);
+    if (!transaction)
+        return 0;
+    return new WebIDBTransactionImpl(transaction);
 }
 
 WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebVector<long long>& objectStoreIds, unsigned short mode)
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
index e728742c6..ebd4d48f9 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -54,8 +54,9 @@ public:
 
     virtual WebIDBObjectStore* createObjectStore(long long, const WebString& name, const WebIDBKeyPath&, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&);
     virtual void deleteObjectStore(long long objectStoreId, const WebIDBTransaction&, WebExceptionCode&);
-    virtual void setVersion(const WebString& version, WebIDBCallbacks*, WebExceptionCode&);
+    // FIXME: Remove this as part of https://bugs.webkit.org/show_bug.cgi?id=102733.
     virtual WebIDBTransaction* transaction(const WebVector<long long>& names, unsigned short mode);
+    virtual WebIDBTransaction* createTransaction(long long id, const WebVector<long long>&, unsigned short mode);
     virtual void forceClose();
     virtual void close();
 
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
index 40d7d7563..41f4c9d20 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
@@ -65,11 +65,6 @@ void WebIDBTransactionImpl::abort()
     m_backend->abort();
 }
 
-void WebIDBTransactionImpl::didCompleteTaskEvents()
-{
-    m_backend->didCompleteTaskEvents();
-}
-
 void WebIDBTransactionImpl::setCallbacks(WebIDBTransactionCallbacks* callbacks)
 {
     RefPtr<IDBTransactionCallbacks> idbCallbacks = IDBTransactionCallbacksProxy::create(adoptPtr(callbacks));
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
index 0fb653767..4272cbe10 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
@@ -44,7 +44,6 @@ public:
     virtual WebIDBObjectStore* objectStore(long long indexId, WebExceptionCode&);
     virtual void commit();
     virtual void abort();
-    virtual void didCompleteTaskEvents();
     virtual void setCallbacks(WebIDBTransactionCallbacks*);
 
     virtual WebCore::IDBTransactionBackendInterface* getIDBTransactionBackendInterface() const;
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.cpp b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
index 5cf24d0c1..dcde40f32 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.cpp
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
@@ -407,7 +407,7 @@ static IntPoint convertLocationForRenderObject(const LayoutPoint& location, cons
     return roundedIntPoint(renderObject.absoluteToLocal(location, UseTransforms | SnapOffsetForTransforms));
 }
 
-static void updateWebMouseEventFromWebCoreMouseEvent(const MouseEvent& event, const Widget& widget, const WebCore::RenderObject& renderObject, WebMouseEvent& webEvent)
+static void updateWebMouseEventFromWebCoreMouseEvent(const MouseRelatedEvent& event, const Widget& widget, const WebCore::RenderObject& renderObject, WebMouseEvent& webEvent)
 {
     webEvent.timeStampSeconds = event.timeStamp() / millisPerSecond;
     webEvent.modifiers = getWebInputModifiers(event);
@@ -473,6 +473,37 @@ WebMouseEventBuilder::WebMouseEventBuilder(const Widget* widget, const WebCore::
     clickCount = event.detail();
 }
 
+WebMouseEventBuilder::WebMouseEventBuilder(const Widget* widget, const WebCore::RenderObject* renderObject, const TouchEvent& event)
+{
+    if (event.touches()->length() != 1) {
+        if (event.touches()->length() || event.type() != eventNames().touchendEvent || event.changedTouches()->length() != 1)
+            return;
+    }
+
+    const Touch* touch = event.touches()->length() == 1 ? event.touches()->item(0) : event.changedTouches()->item(0);
+    if (touch->identifier())
+        return;
+
+    if (event.type() == eventNames().touchstartEvent)
+        type = MouseDown;
+    else if (event.type() == eventNames().touchmoveEvent)
+        type = MouseMove;
+    else if (event.type() == eventNames().touchendEvent)
+        type = MouseUp;
+    else
+        return;
+
+    updateWebMouseEventFromWebCoreMouseEvent(event, *widget, *renderObject, *this);
+
+    button = WebMouseEvent::ButtonLeft;
+    modifiers |= WebInputEvent::LeftButtonDown;
+    clickCount = (type == MouseDown || type == MouseUp);
+
+    IntPoint localPoint = convertLocationForRenderObject(LayoutPoint(touch->pageX(), touch->pageY()), *renderObject);
+    x = localPoint.x();
+    y = localPoint.y();
+}
+
 WebMouseWheelEventBuilder::WebMouseWheelEventBuilder(const Widget* widget, const WebCore::RenderObject* renderObject, const WheelEvent& event)
 {
     if (event.type() != eventNames().mousewheelEvent)
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.h b/Source/WebKit/chromium/src/WebInputEventConversion.h
index 3512646eb..181d1e5c2 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.h
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.h
@@ -105,6 +105,7 @@ public:
 class WebMouseEventBuilder : public WebMouseEvent {
 public:
     WebMouseEventBuilder(const WebCore::Widget*, const WebCore::RenderObject*, const WebCore::MouseEvent&);
+    WebMouseEventBuilder(const WebCore::Widget*, const WebCore::RenderObject*, const WebCore::TouchEvent&);
 };
 
 // Converts a WebCore::WheelEvent to a corresponding WebMouseWheelEvent.
diff --git a/Source/WebKit/chromium/src/WebKit.cpp b/Source/WebKit/chromium/src/WebKit.cpp
index 243d08e62..a517d155e 100644
--- a/Source/WebKit/chromium/src/WebKit.cpp
+++ b/Source/WebKit/chromium/src/WebKit.cpp
@@ -43,7 +43,6 @@
 #include "V8RecursionScope.h"
 #include "WebMediaPlayerClientImpl.h"
 #include "WebSocket.h"
-#include "WorkerContextExecutionProxy.h"
 #include "platform/WebKitPlatformSupport.h"
 #include "v8.h"
 #include <public/Platform.h>
@@ -134,6 +133,7 @@ void initializeWithoutV8(WebKitPlatformSupport* webKitPlatformSupport)
     ASSERT(!s_webKitPlatformSupport);
     s_webKitPlatformSupport = webKitPlatformSupport;
     Platform::initialize(s_webKitPlatformSupport);
+    WebCore::ImageDecodingStore::initializeOnce();
 
     WTF::initializeThreading();
     WTF::initializeMainThread();
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 075fc0548..1059df748 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -523,10 +523,15 @@ bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 
 void WebPluginContainerImpl::setIsAcceptingTouchEvents(bool acceptingTouchEvents)
 {
-    if (m_isAcceptingTouchEvents == acceptingTouchEvents)
+    requestTouchEventType(acceptingTouchEvents ? TouchEventRequestTypeRaw : TouchEventRequestTypeNone);
+}
+
+void WebPluginContainerImpl::requestTouchEventType(TouchEventRequestType requestType)
+{
+    if (m_touchEventRequestType == requestType)
         return;
-    m_isAcceptingTouchEvents = acceptingTouchEvents;
-    if (m_isAcceptingTouchEvents)
+    m_touchEventRequestType = requestType;
+    if (m_touchEventRequestType != TouchEventRequestTypeNone)
         m_element->document()->didAddTouchEventHandler();
     else
         m_element->document()->didRemoveTouchEventHandler();
@@ -667,7 +672,7 @@ WebPluginContainerImpl::WebPluginContainerImpl(WebCore::HTMLPlugInElement* eleme
     , m_textureId(0)
     , m_ioSurfaceId(0)
 #endif
-    , m_isAcceptingTouchEvents(false)
+    , m_touchEventRequestType(TouchEventRequestTypeNone)
     , m_wantsWheelEvents(false)
 {
 }
@@ -681,7 +686,7 @@ WebPluginContainerImpl::~WebPluginContainerImpl()
         GraphicsLayerChromium::unregisterContentsLayer(m_ioSurfaceLayer->layer());
 #endif
 
-    if (m_isAcceptingTouchEvents)
+    if (m_touchEventRequestType != TouchEventRequestTypeNone)
         m_element->document()->didRemoveTouchEventHandler();
 
     for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
@@ -819,9 +824,28 @@ void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
 
 void WebPluginContainerImpl::handleTouchEvent(TouchEvent* event)
 {
-    if (!m_isAcceptingTouchEvents)
+    switch (m_touchEventRequestType) {
+    case TouchEventRequestTypeNone:
+        return;
+    case TouchEventRequestTypeRaw: {
+        WebTouchEventBuilder webEvent(this, m_element->renderer(), *event);
+        if (webEvent.type == WebInputEvent::Undefined)
+            return;
+        WebCursorInfo cursorInfo;
+        if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+            event->setDefaultHandled();
+        // FIXME: Can a plugin change the cursor from a touch-event callback?
+        return;
+    }
+    case TouchEventRequestTypeSynthesizedMouse:
+        synthesizeMouseEventIfPossible(event);
         return;
-    WebTouchEventBuilder webEvent(this, m_element->renderer(), *event);
+    }
+}
+
+void WebPluginContainerImpl::handleGestureEvent(GestureEvent* event)
+{
+    WebGestureEventBuilder webEvent(this, m_element->renderer(), *event);
     if (webEvent.type == WebInputEvent::Undefined)
         return;
     WebCursorInfo cursorInfo;
@@ -830,15 +854,15 @@ void WebPluginContainerImpl::handleTouchEvent(TouchEvent* event)
     // FIXME: Can a plugin change the cursor from a touch-event callback?
 }
 
-void WebPluginContainerImpl::handleGestureEvent(GestureEvent* event)
+void WebPluginContainerImpl::synthesizeMouseEventIfPossible(TouchEvent* event)
 {
-    WebGestureEventBuilder webEvent(this, m_element->renderer(), *event);
+    WebMouseEventBuilder webEvent(this, m_element->renderer(), *event);
     if (webEvent.type == WebInputEvent::Undefined)
         return;
+
     WebCursorInfo cursorInfo;
     if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
         event->setDefaultHandled();
-    // FIXME: Can a plugin change the cursor from a touch-event callback?
 }
 
 void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index b4958fe19..70293a822 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -114,6 +114,7 @@ public:
     virtual void setOpaque(bool);
     virtual bool isRectTopmost(const WebRect&);
     virtual void setIsAcceptingTouchEvents(bool);
+    virtual void requestTouchEventType(TouchEventRequestType);
     virtual void setWantsWheelEvents(bool);
     virtual WebPoint windowToLocalPoint(const WebPoint&);
 
@@ -149,7 +150,7 @@ public:
     void didFinishLoading();
     void didFailLoading(const WebCore::ResourceError&);
 
-    NPObject* scriptableObject();
+    virtual NPObject* scriptableObject() OVERRIDE;
 
     void willDestroyPluginLoadObserver(WebPluginLoadObserver*);
 
@@ -175,6 +176,8 @@ private:
     void handleTouchEvent(WebCore::TouchEvent*);
     void handleGestureEvent(WebCore::GestureEvent*);
 
+    void synthesizeMouseEventIfPossible(WebCore::TouchEvent*);
+
     void calculateGeometry(const WebCore::IntRect& frameRect,
                            WebCore::IntRect& windowRect,
                            WebCore::IntRect& clipRect,
@@ -201,7 +204,7 @@ private:
     // scrollbars.
     OwnPtr<ScrollbarGroup> m_scrollbarGroup;
 
-    bool m_isAcceptingTouchEvents;
+    TouchEventRequestType m_touchEventRequestType;
     bool m_wantsWheelEvents;
 };
 
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 20fcc1b96..6a33786ac 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -31,8 +31,8 @@
 #include "config.h"
 #include "WebSettingsImpl.h"
 
+#include "DeferredImageDecoder.h"
 #include "FontRenderingMode.h"
-#include "ImageDecodingStore.h"
 #include "Settings.h"
 #include <public/WebString.h>
 #include <public/WebURL.h>
@@ -346,6 +346,11 @@ void WebSettingsImpl::setTextDirectionSubmenuInclusionBehaviorNeverIncluded()
     m_settings->setTextDirectionSubmenuInclusionBehavior(WebCore::TextDirectionSubmenuNeverIncluded);
 }
 
+void WebSettingsImpl::setTouchDragDropEnabled(bool enabled)
+{
+    m_settings->setTouchDragDropEnabled(enabled);
+}
+
 void WebSettingsImpl::setOfflineWebApplicationCacheEnabled(bool enabled)
 {
     m_settings->setOfflineWebApplicationCacheEnabled(enabled);
@@ -500,10 +505,7 @@ void WebSettingsImpl::setDeferred2dCanvasEnabled(bool enabled)
 
 void WebSettingsImpl::setDeferredImageDecodingEnabled(bool enabled)
 {
-    if (!m_deferredImageDecodingEnabled && enabled)
-        ImageDecodingStore::initializeOnMainThread();
-    if (m_deferredImageDecodingEnabled && !enabled)
-        ImageDecodingStore::shutdown();
+    DeferredImageDecoder::setEnabled(enabled);
     m_deferredImageDecodingEnabled = enabled;
 }
 
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 98520eadf..ab92562fa 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -153,6 +153,7 @@ public:
     virtual void setTextAutosizingEnabled(bool);
     virtual void setTextAutosizingFontScaleFactor(float);
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
+    virtual void setTouchDragDropEnabled(bool);
     virtual void setUnifiedTextCheckerEnabled(bool);
     virtual void setUserStyleSheetLocation(const WebURL&);
     virtual void setUsesEncodingDetector(bool);
diff --git a/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp b/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
index 5cf999851..119d9acb6 100644
--- a/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
@@ -34,6 +34,7 @@
 #include "CrossThreadTask.h"
 #include "DatabaseTask.h"
 #include "Document.h"
+#include "FrameLoadRequest.h"
 #include "GroupSettings.h"
 #include "KURL.h"
 #include "MessageEvent.h"
@@ -130,10 +131,9 @@ void WebSharedWorkerImpl::initializeLoader(const WebURL& url)
     // Construct substitute data source for the 'shadow page'. We only need it
     // to have same origin as the worker so the loading checks work correctly.
     CString content("");
-    int len = static_cast<int>(content.length());
-    RefPtr<SharedBuffer> buf(SharedBuffer::create(content.data(), len));
-    SubstituteData substData(buf, String("text/html"), String("UTF-8"), KURL());
-    webFrame->frame()->loader()->load(ResourceRequest(url), substData, false);
+    int length = static_cast<int>(content.length());
+    RefPtr<SharedBuffer> buffer(SharedBuffer::create(content.data(), length));
+    webFrame->frame()->loader()->load(FrameLoadRequest(webFrame->frame(), ResourceRequest(url), SubstituteData(buffer, "text/html", "UTF-8", KURL())));
 
     // This document will be used as 'loading context' for the worker.
     m_loadingDocument = webFrame->frame()->document();
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 7aa12048f..f66ae48c4 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -848,6 +848,15 @@ void WebViewImpl::setShowFPSCounter(bool show)
     settingsImpl()->setShowFPSCounter(show);
 }
 
+void WebViewImpl::setShowPaintRects(bool show)
+{
+    if (isAcceleratedCompositingActive()) {
+        TRACE_EVENT0("webkit", "WebViewImpl::setShowPaintRects");
+        m_layerTreeView->setShowPaintRects(show);
+    }
+    settingsImpl()->setShowPaintRects(show);
+}
+
 bool WebViewImpl::handleKeyEvent(const WebKeyboardEvent& event)
 {
     ASSERT((event.type == WebInputEvent::RawKeyDown)
@@ -1274,6 +1283,11 @@ void WebViewImpl::hasTouchEventHandlers(bool hasTouchHandlers)
         m_client->hasTouchEventHandlers(hasTouchHandlers);
 }
 
+bool WebViewImpl::hasTouchEventHandlersAt(const WebPoint& point)
+{
+    return true;
+}
+
 #if !OS(DARWIN)
 // Mac has no way to open a context menu based on a keyboard event.
 bool WebViewImpl::sendContextMenuEvent(const WebKeyboardEvent& event)
@@ -4105,17 +4119,6 @@ private:
 
 } // namespace
 
-WebGraphicsContext3D* WebViewImpl::createContext3D()
-{
-    // Temporarily, if the output surface can't be created, create a WebGraphicsContext3D
-    // directly. This allows bootstrapping the output surface system while downstream
-    // users of the API still use the old approach.
-    WebKit::WebGraphicsContext3D::Attributes attributes;
-    attributes.antialias = false;
-    attributes.shareResources = true;
-    return m_client->createGraphicsContext3D(attributes);
-}
-
 WebCompositorOutputSurface* WebViewImpl::createOutputSurface()
 {
     return m_client->createOutputSurface();
@@ -4180,11 +4183,6 @@ void WebViewImpl::didCompleteSwapBuffers()
         m_client->didCompleteSwapBuffers();
 }
 
-void WebViewImpl::didRebindGraphicsContext(bool success)
-{
-    didRecreateOutputSurface(success);
-}
-
 void WebViewImpl::didRecreateOutputSurface(bool success)
 {
     // Switch back to software rendering mode, if necessary
@@ -4214,6 +4212,12 @@ void WebViewImpl::scheduleComposite()
     m_client->scheduleComposite();
 }
 
+void WebViewImpl::createFontAtlas(SkBitmap& bitmap, WebRect asciiToRectTable[128], int& fontHeight)
+{
+    TRACE_EVENT0("webkit", "WebViewImpl::loadFontAtlas");
+    bitmap = WebCore::CompositorHUDFontAtlas::generateFontAtlas(asciiToRectTable, fontHeight);
+}
+
 void WebViewImpl::updateLayerTreeViewport()
 {
     if (!page() || !m_nonCompositedContentHost || !m_layerTreeView)
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index da5f69b9e..6246cab0e 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -152,6 +152,7 @@ public:
     virtual void setNeedsRedraw();
     virtual bool isInputThrottled() const;
     virtual bool handleInputEvent(const WebInputEvent&);
+    virtual bool hasTouchEventHandlersAt(const WebPoint&);
     virtual void mouseCaptureLost();
     virtual void setFocus(bool enable);
     virtual bool setComposition(
@@ -308,6 +309,7 @@ public:
 #endif
     virtual void transferActiveWheelFlingAnimation(const WebActiveWheelFlingParameters&);
     virtual WebViewBenchmarkSupport* benchmarkSupport();
+    virtual void setShowPaintRects(bool);
     virtual void setShowFPSCounter(bool);
 
     // WebLayerTreeViewClient
@@ -315,8 +317,6 @@ public:
     virtual void didBeginFrame();
     virtual void updateAnimations(double monotonicFrameBeginTime);
     virtual void applyScrollAndScale(const WebSize&, float);
-    virtual WebGraphicsContext3D* createContext3D() OVERRIDE;
-    virtual void didRebindGraphicsContext(bool success) OVERRIDE;
     virtual WebCompositorOutputSurface* createOutputSurface() OVERRIDE;
     virtual void didRecreateOutputSurface(bool success) OVERRIDE;
     virtual WebInputHandler* createInputHandler() OVERRIDE;
@@ -325,6 +325,7 @@ public:
     virtual void didCommitAndDrawFrame();
     virtual void didCompleteSwapBuffers();
     virtual void scheduleComposite();
+    virtual void createFontAtlas(SkBitmap&, WebRect[128], int&);
 
     // WebViewImpl
 
@@ -610,6 +611,7 @@ private:
 
     friend class WebView;  // So WebView::Create can call our constructor
     friend class WTF::RefCounted<WebViewImpl>;
+    friend void setCurrentInputEventForTest(const WebInputEvent*);
 
     enum DragAction {
       DragEnter,
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 96f04fa4b..2c0fb9ac8 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -50,7 +50,6 @@
 #include "ScriptExecutionContext.h"
 #include "Worker.h"
 #include "WorkerContext.h"
-#include "WorkerContextExecutionProxy.h"
 #include "WorkerScriptController.h"
 #include "WorkerMessagingProxy.h"
 #include <wtf/Threading.h>
diff --git a/Source/WebKit/chromium/src/default/WebRenderTheme.cpp b/Source/WebKit/chromium/src/default/WebRenderTheme.cpp
new file mode 100644
index 000000000..a7b29f909
--- /dev/null
+++ b/Source/WebKit/chromium/src/default/WebRenderTheme.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2010 Joel Stanley. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebRenderTheme.h"
+
+#include "RenderThemeChromiumDefault.h"
+#include "WebView.h"
+
+using WebCore::RenderTheme;
+using WebCore::RenderThemeChromiumDefault;
+
+namespace WebKit {
+
+void setCaretBlinkInterval(double interval)
+{
+    RenderThemeChromiumDefault::setCaretBlinkInterval(interval);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/tests/ChromeClientImplTest.cpp b/Source/WebKit/chromium/tests/ChromeClientImplTest.cpp
new file mode 100644
index 000000000..779c1cdd2
--- /dev/null
+++ b/Source/WebKit/chromium/tests/ChromeClientImplTest.cpp
@@ -0,0 +1,268 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <gtest/gtest.h>
+
+#include "Chrome.h"
+#include "WebFrameClient.h"
+#include "WebInputEvent.h"
+#include "WebView.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+
+using namespace WebKit;
+
+namespace WebKit {
+
+void setCurrentInputEventForTest(const WebInputEvent* event)
+{
+    WebViewImpl::m_currentInputEvent = event;
+}
+
+}
+
+namespace {
+
+class TestWebWidgetClient : public WebWidgetClient {
+public:
+    ~TestWebWidgetClient() { }
+};
+
+class TestWebViewClient : public WebViewClient {
+public:
+    explicit TestWebViewClient(WebNavigationPolicy* target) : m_target(target) { }
+    ~TestWebViewClient() { }
+
+    virtual void show(WebNavigationPolicy policy)
+    {
+        *m_target = policy;
+    }
+
+private:
+    WebNavigationPolicy* m_target;
+};
+
+class TestWebFrameClient : public WebFrameClient {
+public:
+    ~TestWebFrameClient() { }
+};
+
+class GetNavigationPolicyTest : public testing::Test {
+public:
+    GetNavigationPolicyTest()
+        : m_result(WebNavigationPolicyIgnore)
+        , m_webViewClient(&m_result)
+    {
+    }
+
+protected:
+    virtual void SetUp()
+    {
+        m_webView = static_cast<WebViewImpl*>(WebView::create(&m_webViewClient));
+        m_webView->initializeMainFrame(&m_webFrameClient);
+        m_chromeClientImpl = static_cast<ChromeClientImpl*>(m_webView->page()->chrome()->client());
+        m_result = WebNavigationPolicyIgnore;
+    }
+
+    virtual void TearDown()
+    {
+        m_webView->close();
+    }
+
+    WebNavigationPolicy getNavigationPolicyWithMouseEvent(int modifiers, WebMouseEvent::Button button, bool asPopup)
+    {
+        WebMouseEvent event;
+        event.modifiers = modifiers;
+        event.type = WebInputEvent::MouseUp;
+        event.button = button;
+        setCurrentInputEventForTest(&event);
+        m_chromeClientImpl->setScrollbarsVisible(!asPopup);
+        m_chromeClientImpl->show();
+        setCurrentInputEventForTest(0);
+        return m_result;
+    }
+
+    bool isNavigationPolicyPopup()
+    {
+        m_chromeClientImpl->show();
+        return m_result == WebNavigationPolicyNewPopup;
+    }
+
+protected:
+    WebNavigationPolicy m_result;
+    TestWebViewClient m_webViewClient;
+    WebViewImpl* m_webView;
+    TestWebFrameClient m_webFrameClient;
+    ChromeClientImpl* m_chromeClientImpl;
+};
+
+TEST_F(GetNavigationPolicyTest, LeftClick)
+{
+    int modifiers = 0;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = false;
+    EXPECT_EQ(WebNavigationPolicyNewForegroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, LeftClickPopup)
+{
+    int modifiers = 0;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = true;
+    EXPECT_EQ(WebNavigationPolicyNewPopup,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, ShiftLeftClick)
+{
+    int modifiers = WebInputEvent::ShiftKey;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = false;
+    EXPECT_EQ(WebNavigationPolicyNewWindow,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, ShiftLeftClickPopup)
+{
+    int modifiers = WebInputEvent::ShiftKey;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = true;
+    EXPECT_EQ(WebNavigationPolicyNewPopup,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, ControlOrMetaLeftClick)
+{
+#if OS(DARWIN)
+    int modifiers = WebInputEvent::MetaKey;
+#else
+    int modifiers = WebInputEvent::ControlKey;
+#endif
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = false;
+    EXPECT_EQ(WebNavigationPolicyNewBackgroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, ControlOrMetaLeftClickPopup)
+{
+#if OS(DARWIN)
+    int modifiers = WebInputEvent::MetaKey;
+#else
+    int modifiers = WebInputEvent::ControlKey;
+#endif
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = true;
+    EXPECT_EQ(WebNavigationPolicyNewBackgroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, ControlOrMetaAndShiftLeftClick)
+{
+#if OS(DARWIN)
+    int modifiers = WebInputEvent::MetaKey;
+#else
+    int modifiers = WebInputEvent::ControlKey;
+#endif
+    modifiers |= WebInputEvent::ShiftKey;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = false;
+    EXPECT_EQ(WebNavigationPolicyNewForegroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, ControlOrMetaAndShiftLeftClickPopup)
+{
+#if OS(DARWIN)
+    int modifiers = WebInputEvent::MetaKey;
+#else
+    int modifiers = WebInputEvent::ControlKey;
+#endif
+    modifiers |= WebInputEvent::ShiftKey;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonLeft;
+    bool asPopup = true;
+    EXPECT_EQ(WebNavigationPolicyNewForegroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, MiddleClick)
+{
+    int modifiers = 0;
+    bool asPopup = false;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonMiddle;
+    EXPECT_EQ(WebNavigationPolicyNewBackgroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, MiddleClickPopup)
+{
+    int modifiers = 0;
+    bool asPopup = true;
+    WebMouseEvent::Button button = WebMouseEvent::ButtonMiddle;
+    EXPECT_EQ(WebNavigationPolicyNewBackgroundTab,
+        getNavigationPolicyWithMouseEvent(modifiers, button, asPopup));
+}
+
+TEST_F(GetNavigationPolicyTest, NoToolbarsForcesPopup)
+{
+    m_chromeClientImpl->setToolbarsVisible(false);
+    EXPECT_TRUE(isNavigationPolicyPopup());
+    m_chromeClientImpl->setToolbarsVisible(true);
+    EXPECT_FALSE(isNavigationPolicyPopup());
+}
+
+TEST_F(GetNavigationPolicyTest, NoStatusbarForcesPopup)
+{
+    m_chromeClientImpl->setStatusbarVisible(false);
+    EXPECT_TRUE(isNavigationPolicyPopup());
+    m_chromeClientImpl->setStatusbarVisible(true);
+    EXPECT_FALSE(isNavigationPolicyPopup());
+}
+
+TEST_F(GetNavigationPolicyTest, NoMenubarForcesPopup)
+{
+    m_chromeClientImpl->setMenubarVisible(false);
+    EXPECT_TRUE(isNavigationPolicyPopup());
+    m_chromeClientImpl->setMenubarVisible(true);
+    EXPECT_FALSE(isNavigationPolicyPopup());
+}
+
+TEST_F(GetNavigationPolicyTest, NotResizableForcesPopup)
+{
+    m_chromeClientImpl->setResizable(false);
+    EXPECT_TRUE(isNavigationPolicyPopup());
+    m_chromeClientImpl->setResizable(true);
+    EXPECT_FALSE(isNavigationPolicyPopup());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp b/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp
index 4bcc29882..7fd4017a6 100644
--- a/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp
+++ b/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp
@@ -73,7 +73,8 @@ class DeferredImageDecoderTest : public ::testing::Test, public MockImageDecoder
 public:
     virtual void SetUp()
     {
-        ImageDecodingStore::initializeOnMainThread();
+        ImageDecodingStore::initializeOnce();
+        DeferredImageDecoder::setEnabled(true);
         m_data = SharedBuffer::create(whitePNG, sizeof(whitePNG));
         m_actualDecoder = new MockImageDecoder(this);
         m_actualDecoder->setSize(1, 1);
@@ -90,10 +91,19 @@ public:
 
     virtual void decoderBeingDestroyed()
     {
-        m_frameBufferRequestCount = m_actualDecoder->frameBufferRequestCount();
         m_actualDecoder = 0;
     }
 
+    virtual void frameBufferRequested()
+    {
+        ++m_frameBufferRequestCount;
+    }
+
+    virtual ImageFrame::FrameStatus frameStatus()
+    {
+        return ImageFrame::FrameComplete;
+    }
+
 protected:
     // Don't own this but saves the pointer to query states.
     MockImageDecoder* m_actualDecoder;
diff --git a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
index e97bc7f6d..0eb7fae66 100644
--- a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
@@ -88,7 +88,6 @@ public:
         m_wasSuccessDBCalled = true;
     }
     virtual void onSuccess(PassRefPtr<IDBKey>) OVERRIDE { }
-    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) OVERRIDE { }
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) OVERRIDE { }
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&) OVERRIDE { };
     virtual void onSuccess(int64_t) OVERRIDE { }
@@ -153,9 +152,9 @@ public:
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(int64_t, const String& name, const IDBKeyPath&, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&) { return 0; }
     virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) { }
     virtual void deleteObjectStore(int64_t, IDBTransactionBackendInterface*, ExceptionCode&) { }
-    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBDatabaseCallbacks>, ExceptionCode&) { }
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode&) { return 0; }
+    // FIXME: Remove this as part of https://bugs.webkit.org/show_bug.cgi?id=102733.
     virtual PassRefPtr<IDBTransactionBackendInterface> transaction(const Vector<int64_t>&, unsigned short mode) { return 0; }
+    virtual PassRefPtr<IDBTransactionBackendInterface> createTransaction(int64_t, const Vector<int64_t>&, unsigned short mode) { return 0; }
 
     virtual void close(PassRefPtr<IDBDatabaseCallbacks>)
     {
diff --git a/Source/WebKit/chromium/tests/IDBRequestTest.cpp b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
index a0734e14c..8a7a3f4a7 100644
--- a/Source/WebKit/chromium/tests/IDBRequestTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
@@ -94,7 +94,6 @@ TEST_F(IDBRequestTest, EventsAfterStopping)
     request->onSuccess(DOMStringList::create());
     request->onSuccess(PassRefPtr<IDBCursorBackendInterface>(), IDBKey::createInvalid(), IDBKey::createInvalid(), SerializedScriptValue::nullValue());
     request->onSuccess(IDBKey::createInvalid());
-    request->onSuccess(PassRefPtr<IDBTransactionBackendInterface>());
     request->onSuccess(SerializedScriptValue::nullValue());
     request->onSuccess(SerializedScriptValue::nullValue(), IDBKey::createInvalid(), IDBKeyPath());
     request->onSuccess(IDBKey::createInvalid(), IDBKey::createInvalid(), SerializedScriptValue::nullValue());
diff --git a/Source/WebKit/chromium/tests/ImageFrameGeneratorTest.cpp b/Source/WebKit/chromium/tests/ImageFrameGeneratorTest.cpp
new file mode 100644
index 000000000..da0a2f864
--- /dev/null
+++ b/Source/WebKit/chromium/tests/ImageFrameGeneratorTest.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ImageFrameGenerator.h"
+
+#include "ImageDecodingStore.h"
+#include "MockImageDecoder.h"
+#include "SharedBuffer.h"
+#include <gtest/gtest.h>
+
+using namespace WebCore;
+
+namespace {
+
+class ImageFrameGeneratorTest;
+
+// Helper methods to generate standard sizes.
+SkISize fullSize() { return SkISize::Make(100, 100); }
+SkISize scaledSize() { return SkISize::Make(50, 50); }
+
+class ImageFrameGeneratorTest;
+
+class MockImageDecoderFactory : public ImageDecoderFactory {
+public:
+    static PassOwnPtr<MockImageDecoderFactory> create(ImageFrameGeneratorTest* test)
+    {
+        return adoptPtr(new MockImageDecoderFactory(test));
+    }
+
+    virtual PassOwnPtr<ImageDecoder> create();
+
+private:
+    MockImageDecoderFactory(ImageFrameGeneratorTest* test)
+        : m_test(test)
+    {
+    }
+
+    ImageFrameGeneratorTest* m_test;
+};
+
+class ImageFrameGeneratorTest : public ::testing::Test, public MockImageDecoderClient {
+public:
+    virtual void SetUp()
+    {
+        ImageDecodingStore::initializeOnce();
+        m_data = SharedBuffer::create();
+        m_generator = ImageFrameGenerator::create(fullSize(), m_data, true);
+        m_generator->setImageDecoderFactoryForTesting(MockImageDecoderFactory::create(this));
+        m_frameBufferRequestCount = 0;
+        m_frameStatus = ImageFrame::FrameEmpty;
+    }
+
+    virtual void TearDown()
+    {
+        ImageDecodingStore::shutdown();
+    }
+
+    virtual void decoderBeingDestroyed()
+    {
+    }
+
+    virtual void frameBufferRequested()
+    {
+        ++m_frameBufferRequestCount;
+    }
+
+    virtual ImageFrame::FrameStatus frameStatus()
+    {
+        return m_frameStatus;
+    }
+
+protected:
+    PassOwnPtr<ScaledImageFragment> createCompleteImage(const SkISize& size)
+    {
+        SkBitmap bitmap;
+        bitmap.setConfig(SkBitmap::kARGB_8888_Config, size.width(), size.height());
+        bitmap.allocPixels();
+        return ScaledImageFragment::create(size, bitmap, true);
+    }
+
+    void setFrameStatus(ImageFrame::FrameStatus status)  { m_frameStatus = status; }
+
+    RefPtr<SharedBuffer> m_data;
+    RefPtr<ImageFrameGenerator> m_generator;
+    int m_frameBufferRequestCount;
+    ImageFrame::FrameStatus m_frameStatus;
+};
+
+PassOwnPtr<ImageDecoder> MockImageDecoderFactory::create()
+{
+    MockImageDecoder* decoder = new MockImageDecoder(m_test);
+    decoder->setSize(fullSize().width(), fullSize().height());
+    return adoptPtr(decoder);
+}
+
+TEST_F(ImageFrameGeneratorTest, cacheHit)
+{
+    const ScaledImageFragment* fullImage = ImageDecodingStore::instance()->insertAndLockCache(
+        m_generator.get(), createCompleteImage(fullSize()));
+    EXPECT_EQ(fullSize(), fullImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), fullImage);
+
+    const ScaledImageFragment* tempImage = m_generator->decodeAndScale(fullSize());
+    EXPECT_EQ(fullImage, tempImage);
+    EXPECT_EQ(fullSize(), tempImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), tempImage);
+    EXPECT_EQ(0, m_frameBufferRequestCount);
+}
+
+TEST_F(ImageFrameGeneratorTest, cacheMissWithScale)
+{
+    const ScaledImageFragment* fullImage = ImageDecodingStore::instance()->insertAndLockCache(
+        m_generator.get(), createCompleteImage(fullSize()));
+    EXPECT_EQ(fullSize(), fullImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), fullImage);
+
+    // Cache miss because of scaled size not found.
+    const ScaledImageFragment* scaledImage = m_generator->decodeAndScale(scaledSize());
+    EXPECT_NE(fullImage, scaledImage);
+    EXPECT_EQ(scaledSize(), scaledImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), scaledImage);
+
+    // Cache hit.
+    const ScaledImageFragment* tempImage = m_generator->decodeAndScale(scaledSize());
+    EXPECT_EQ(scaledImage, tempImage);
+    EXPECT_EQ(scaledSize(), tempImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), tempImage);
+    EXPECT_EQ(0, m_frameBufferRequestCount);
+}
+
+TEST_F(ImageFrameGeneratorTest, cacheMissWithDecodeAndScale)
+{
+    setFrameStatus(ImageFrame::FrameComplete);
+
+    // Cache miss.
+    const ScaledImageFragment* scaledImage = m_generator->decodeAndScale(scaledSize());
+    EXPECT_EQ(1, m_frameBufferRequestCount);
+    EXPECT_EQ(scaledSize(), scaledImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), scaledImage);
+
+    // Cache hit.
+    const ScaledImageFragment* fullImage = m_generator->decodeAndScale(fullSize());
+    EXPECT_NE(scaledImage, fullImage);
+    EXPECT_EQ(fullSize(), fullImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), fullImage);
+
+    // Cache hit.
+    const ScaledImageFragment* tempImage = m_generator->decodeAndScale(scaledSize());
+    EXPECT_EQ(scaledImage, tempImage);
+    EXPECT_EQ(scaledSize(), tempImage->scaledSize());
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), tempImage);
+    EXPECT_EQ(1, m_frameBufferRequestCount);
+}
+
+// Test that incomplete frames are not cached.
+TEST_F(ImageFrameGeneratorTest, cacheMissWithIncompleteDecode)
+{
+    setFrameStatus(ImageFrame::FramePartial);
+
+    const ScaledImageFragment* tempImage = m_generator->decodeAndScale(scaledSize());
+    EXPECT_EQ(1, m_frameBufferRequestCount);
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), tempImage);
+
+    tempImage = m_generator->decodeAndScale(fullSize());
+    EXPECT_EQ(2, m_frameBufferRequestCount);
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), tempImage);
+
+    tempImage = m_generator->decodeAndScale(scaledSize());
+    EXPECT_EQ(3, m_frameBufferRequestCount);
+    ImageDecodingStore::instance()->unlockCache(m_generator.get(), tempImage);
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/MockImageDecoder.h b/Source/WebKit/chromium/tests/MockImageDecoder.h
index c9c0d01d6..8b4f40382 100644
--- a/Source/WebKit/chromium/tests/MockImageDecoder.h
+++ b/Source/WebKit/chromium/tests/MockImageDecoder.h
@@ -32,6 +32,8 @@ namespace WebCore {
 class MockImageDecoderClient {
 public:
     virtual void decoderBeingDestroyed() = 0;
+    virtual void frameBufferRequested() = 0;
+    virtual ImageFrame::FrameStatus frameStatus() = 0;
 };
 
 class MockImageDecoder : public ImageDecoder {
@@ -55,9 +57,11 @@ public:
     virtual ImageFrame* frameBufferAtIndex(size_t)
     {
         ++m_frameBufferRequestCount;
+        m_client->frameBufferRequested();
 
         m_frameBufferCache.resize(1);
         m_frameBufferCache[0].setSize(size().width(), size().height());
+        m_frameBufferCache[0].setStatus(m_client->frameStatus());
         return &m_frameBufferCache[0];
     }
 
diff --git a/Source/WebKit/chromium/tests/PlatformGestureCurveTest.cpp b/Source/WebKit/chromium/tests/PlatformGestureCurveTest.cpp
deleted file mode 100644
index 0e83a84e1..000000000
--- a/Source/WebKit/chromium/tests/PlatformGestureCurveTest.cpp
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "PlatformGestureCurve.h"
-
-#include "ActivePlatformGestureAnimation.h"
-#include "PlatformGestureCurveTarget.h"
-#include "TouchFlingPlatformGestureCurve.h"
-#include "WheelFlingPlatformGestureCurve.h"
-#include <gtest/gtest.h>
-#include <wtf/OwnPtr.h>
-
-namespace {
-
-using namespace WebCore;
-
-class MockPlatformGestureCurveTarget : public PlatformGestureCurveTarget {
-public:
-    virtual void scrollBy(const IntPoint& delta)
-    {
-        m_cumulativeDelta = m_cumulativeDelta + delta;
-    }
-
-    IntPoint cumulativeDelta() const { return  m_cumulativeDelta; }
-    void resetCumulativeDelta() { m_cumulativeDelta = IntPoint(); }
-
-private:
-    IntPoint m_cumulativeDelta;
-};
-
-TEST(PlatformGestureCurve, flingCurve)
-{
-    MockPlatformGestureCurveTarget target;
-    OwnPtr<ActivePlatformGestureAnimation> animation = ActivePlatformGestureAnimation::create(WheelFlingPlatformGestureCurve::create(FloatPoint(100, 0)), &target);
-
-    // Note: the expectations below are dependent on the value of sigma hard-coded in the Rayleigh
-    //       curve. If sigma changes, these test expectations will also change.
-    EXPECT_TRUE(animation->animate(0));
-    EXPECT_TRUE(animation->animate(0.25));
-    EXPECT_TRUE(animation->animate(0.45)); // Use non-uniform tick spacing.
-    EXPECT_TRUE(animation->animate(0.75));
-    EXPECT_TRUE(animation->animate(1000));
-    EXPECT_FALSE(animation->animate(1001));
-    // Since the Rayleigh CDF maxes out at 1, we expect the cumulative scroll increments to
-    // match the input velocity parameter.
-    EXPECT_NEAR(target.cumulativeDelta().x(), 100, 1);
-    EXPECT_EQ(target.cumulativeDelta().y(), 0);
-
-    // Test animation when not starting at t = 0.
-    double baseTime = 42.42;
-    animation = ActivePlatformGestureAnimation::create(WheelFlingPlatformGestureCurve::create(FloatPoint(100, 0)), &target);
-    target.resetCumulativeDelta();
-
-    EXPECT_TRUE(animation->animate(baseTime + 0.35));
-    EXPECT_TRUE(animation->animate(baseTime + 1.35));
-    EXPECT_TRUE(animation->animate(baseTime + 1000));
-    EXPECT_FALSE(animation->animate(baseTime + 1001));
-    EXPECT_NEAR(target.cumulativeDelta().x(), 100, 1);
-
-    animation = ActivePlatformGestureAnimation::create(WheelFlingPlatformGestureCurve::create(FloatPoint(50, 150)), &target);
-    target.resetCumulativeDelta();
-
-    // Test animation with both horizontal and vertical scroll velocities.
-    EXPECT_TRUE(animation->animate(0));
-    EXPECT_TRUE(animation->animate(0.25));
-    EXPECT_TRUE(animation->animate(0.45));
-    EXPECT_TRUE(animation->animate(0.75));
-    EXPECT_TRUE(animation->animate(1000));
-    EXPECT_FALSE(animation->animate(1001));
-    EXPECT_NEAR(target.cumulativeDelta().x(), 50, 1);
-    EXPECT_NEAR(target.cumulativeDelta().y(), 150, 1);
-}
-
-TEST(PlatformGestureCurve, flingCurveTouch)
-{
-    double initialVelocity = 5000;
-    MockPlatformGestureCurveTarget target;
-    // Explicitly parametrized to make test non-brittle in face of
-    // parameter changes.
-    OwnPtr<ActivePlatformGestureAnimation> animation = ActivePlatformGestureAnimation::create(TouchFlingPlatformGestureCurve::create(FloatPoint(initialVelocity, 0), -5.70762e+03f, 1.72e+02f, 3.7e+00f, 1.3f), &target);
-
-    // Note: the expectations below are dependent on the curve parameters hard
-    // coded into the create call above.
-    EXPECT_TRUE(animation->animate(0));
-    EXPECT_TRUE(animation->animate(0.25));
-    EXPECT_TRUE(animation->animate(0.45f)); // Use non-uniform tick spacing.
-    EXPECT_TRUE(animation->animate(1));
-    EXPECT_FALSE(animation->animate(1.5));
-    EXPECT_NEAR(target.cumulativeDelta().x(), 1193, 1);
-    EXPECT_EQ(target.cumulativeDelta().y(), 0);
-}
-
-} // namespace anonymous
diff --git a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
index 395fdcf3d..36fee689d 100644
--- a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
@@ -259,7 +259,76 @@ TEST_F(WebCompositorInputHandlerImplTest, gesturePinch)
     m_inputHandler->handleInputEvent(gesture);
 }
 
-TEST_F(WebCompositorInputHandlerImplTest, gestureFlingStarted)
+TEST_F(WebCompositorInputHandlerImplTest, gesturePinchAfterScrollOnMainThread)
+{
+    // Scrolls will start by being sent to the main thread.
+    m_expectedDisposition = DidNotHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(::testing::_, ::testing::_))
+        .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusOnMainThread));
+
+    gesture.type = WebInputEvent::GestureScrollBegin;
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GestureScrollUpdate;
+    gesture.data.scrollUpdate.deltaY = 40;
+    m_inputHandler->handleInputEvent(gesture);
+
+    // However, after the pinch gesture starts, they should go to the impl
+    // thread.
+    m_expectedDisposition = DidHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GesturePinchBegin;
+    EXPECT_CALL(m_mockInputHandlerClient, pinchGestureBegin());
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GesturePinchUpdate;
+    gesture.data.pinchUpdate.scale = 1.5;
+    gesture.x = 7;
+    gesture.y = 13;
+    EXPECT_CALL(m_mockInputHandlerClient, pinchGestureUpdate(1.5, WebPoint(7, 13)));
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GestureScrollUpdate;
+    gesture.data.scrollUpdate.deltaY = -40; // -Y means scroll down - i.e. in the +Y direction.
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::height, testing::Gt(0))))
+        .WillOnce(testing::Return(true));
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GesturePinchUpdate;
+    gesture.data.pinchUpdate.scale = 0.5;
+    gesture.x = 9;
+    gesture.y = 6;
+    EXPECT_CALL(m_mockInputHandlerClient, pinchGestureUpdate(.5, WebPoint(9, 6)));
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GesturePinchEnd;
+    EXPECT_CALL(m_mockInputHandlerClient, pinchGestureEnd());
+    m_inputHandler->handleInputEvent(gesture);
+
+    // After the pinch gesture ends, they should go to back to the main
+    // thread.
+    m_expectedDisposition = DidNotHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GestureScrollEnd;
+    gesture.data.scrollUpdate.deltaY = 0;
+    m_inputHandler->handleInputEvent(gesture);
+}
+
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingStartedTouchpad)
 {
     // We shouldn't send any events to the widget for this gesture.
     m_expectedDisposition = DidHandle;
@@ -272,16 +341,18 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingStarted)
 
     gesture.type = WebInputEvent::GestureFlingStart;
     gesture.data.flingStart.velocityX = 10;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     m_inputHandler->handleInputEvent(gesture);
 
     VERIFY_AND_RESET_MOCKS();
 
     // Verify that a GestureFlingCancel during an animation cancels it.
     gesture.type = WebInputEvent::GestureFlingCancel;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     m_inputHandler->handleInputEvent(gesture);
 }
 
-TEST_F(WebCompositorInputHandlerImplTest, gestureFlingFailed)
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingOnMainThreadTouchpad)
 {
     // We should send all events to the widget for this gesture.
     m_expectedDisposition = DidNotHandle;
@@ -291,16 +362,18 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingFailed)
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusOnMainThread));
 
     gesture.type = WebInputEvent::GestureFlingStart;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     m_inputHandler->handleInputEvent(gesture);
 
     VERIFY_AND_RESET_MOCKS();
 
     // Even if we didn't start a fling ourselves, we still need to send the cancel event to the widget.
     gesture.type = WebInputEvent::GestureFlingCancel;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     m_inputHandler->handleInputEvent(gesture);
 }
 
-TEST_F(WebCompositorInputHandlerImplTest, gestureFlingIgnored)
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingIgnoredTouchpad)
 {
     m_expectedDisposition = DidNotHandle;
     VERIFY_AND_RESET_MOCKS();
@@ -309,16 +382,18 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingIgnored)
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusIgnored));
 
     gesture.type = WebInputEvent::GestureFlingStart;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     m_inputHandler->handleInputEvent(gesture);
 
     VERIFY_AND_RESET_MOCKS();
 
     // Even if we didn't start a fling ourselves, we still need to send the cancel event to the widget.
     gesture.type = WebInputEvent::GestureFlingCancel;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     m_inputHandler->handleInputEvent(gesture);
 }
 
-TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimates)
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimatesTouchpad)
 {
     // We shouldn't send any events to the widget for this gesture.
     m_expectedDisposition = DidHandle;
@@ -333,6 +408,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimates)
     int modifiers = 7;
     gesture.data.flingStart.velocityX = flingDelta.x;
     gesture.data.flingStart.velocityY = flingDelta.y;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     gesture.x = flingPoint.x;
     gesture.y = flingPoint.y;
     gesture.globalX = flingGlobalPoint.x;
@@ -405,7 +481,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimates)
     m_inputHandler->handleInputEvent(gesture);
 }
 
-TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResetsTouchpad)
 {
     // We shouldn't send any events to the widget for this gesture.
     m_expectedDisposition = DidHandle;
@@ -419,6 +495,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     int modifiers = 1;
     gesture.data.flingStart.velocityX = flingDelta.x;
     gesture.data.flingStart.velocityY = flingDelta.y;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     gesture.x = flingPoint.x;
     gesture.y = flingPoint.y;
     gesture.globalX = flingGlobalPoint.x;
@@ -500,6 +577,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     modifiers = 2;
     gesture.data.flingStart.velocityX = flingDelta.x;
     gesture.data.flingStart.velocityY = flingDelta.y;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchpad;
     gesture.x = flingPoint.x;
     gesture.y = flingPoint.y;
     gesture.globalX = flingGlobalPoint.x;
@@ -550,4 +628,121 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     m_inputHandler->animate(30.2);
 }
 
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingStartedTouchscreen)
+{
+    // We shouldn't send any events to the widget for this gesture.
+    m_expectedDisposition = DidHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
+        .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusStarted));
+    EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
+
+    gesture.type = WebInputEvent::GestureFlingStart;
+    gesture.data.flingStart.velocityX = 10;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    EXPECT_CALL(m_mockInputHandlerClient, scrollEnd());
+
+    // Verify that a GestureFlingCancel during an animation cancels it.
+    gesture.type = WebInputEvent::GestureFlingCancel;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    m_inputHandler->handleInputEvent(gesture);
+}
+
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingOnMainThreadTouchscreen)
+{
+    // We should send all events to the widget for this gesture.
+    m_expectedDisposition = DidNotHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
+        .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusOnMainThread));
+
+    gesture.type = WebInputEvent::GestureFlingStart;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    m_inputHandler->handleInputEvent(gesture);
+
+    VERIFY_AND_RESET_MOCKS();
+
+    // Even if we didn't start a fling ourselves, we still need to send the cancel event to the widget.
+    gesture.type = WebInputEvent::GestureFlingCancel;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    m_inputHandler->handleInputEvent(gesture);
+}
+
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingIgnoredTouchscreen)
+{
+    m_expectedDisposition = DropEvent;
+    VERIFY_AND_RESET_MOCKS();
+
+    EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
+        .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusIgnored));
+
+    gesture.type = WebInputEvent::GestureFlingStart;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    m_inputHandler->handleInputEvent(gesture);
+
+    m_expectedDisposition = DidNotHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    // Even if we didn't start a fling ourselves, we still need to send the cancel event to the widget.
+    gesture.type = WebInputEvent::GestureFlingCancel;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    m_inputHandler->handleInputEvent(gesture);
+}
+
+TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimatesTouchscreen)
+{
+    // We shouldn't send any events to the widget for this gesture.
+    m_expectedDisposition = DidHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    // On the fling start, we should schedule an animation but not actually start
+    // scrolling.
+    gesture.type = WebInputEvent::GestureFlingStart;
+    WebFloatPoint flingDelta = WebFloatPoint(1000, 0);
+    WebPoint flingPoint = WebPoint(7, 13);
+    WebPoint flingGlobalPoint = WebPoint(17, 23);
+    int modifiers = 7;
+    gesture.data.flingStart.velocityX = flingDelta.x;
+    gesture.data.flingStart.velocityY = flingDelta.y;
+    gesture.data.flingStart.sourceDevice = WebGestureEvent::Touchscreen;
+    gesture.x = flingPoint.x;
+    gesture.y = flingPoint.y;
+    gesture.globalX = flingGlobalPoint.x;
+    gesture.globalY = flingGlobalPoint.y;
+    gesture.modifiers = modifiers;
+    EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
+    EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
+        .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusStarted));
+    m_inputHandler->handleInputEvent(gesture);
+
+    testing::Mock::VerifyAndClearExpectations(&m_mockInputHandlerClient);
+    // The first animate call should let us pick up an animation start time, but we
+    // shouldn't actually move anywhere just yet. The first frame after the fling start
+    // will typically include the last scroll from the gesture that lead to the scroll
+    // (either wheel or gesture scroll), so there should be no visible hitch.
+    EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
+    m_inputHandler->animate(10);
+
+    testing::Mock::VerifyAndClearExpectations(&m_mockInputHandlerClient);
+
+    // The second call should start scrolling in the -X direction.
+    EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::width, testing::Lt(0))))
+        .WillOnce(testing::Return(true));
+    m_inputHandler->animate(10.1);
+
+    testing::Mock::VerifyAndClearExpectations(&m_mockInputHandlerClient);
+
+    EXPECT_CALL(m_mockClient, didHandleInputEvent());
+    EXPECT_CALL(m_mockInputHandlerClient, scrollEnd());
+    gesture.type = WebInputEvent::GestureFlingCancel;
+    m_inputHandler->handleInputEvent(gesture);
+}
+
 }
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 2007c5354..0310650bd 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,77 @@
+2012-11-29  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Broken rendering occurs when scrolling in ewk_view_single.
+        https://bugs.webkit.org/show_bug.cgi?id=77325
+
+        Reviewed by Gyuyoung Kim.
+
+        After r104687, broken rendering occurs when scrolling contents.
+        It's because scrollWidth can be smaller than width of image buffer.
+
+        This patch fixes it and renames parameter to avoid confusion.
+
+        * ewk/ewk_view_single.cpp:
+        (_ewk_view_screen_move):
+        (_ewk_view_single_scroll_process_single):
+
+2012-11-28  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL] Generate big_button_theme.edj
+        https://bugs.webkit.org/show_bug.cgi?id=103511
+
+        Reviewed by Gyuyoung Kim.
+
+        big_button_theme.edj, binary file which is used for test, should be generated.
+
+        * DefaultTheme/CMakeLists.txt:
+        Introduced macro and new target to share files of default theme instead
+        of adding many files for big_button_theme.
+        * DefaultTheme/widget/button/button.edc:
+        Implemented for big_button_theme.
+
+2012-11-28  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL] Refactor theme to choose whether to support foreground color of selection
+        https://bugs.webkit.org/show_bug.cgi?id=102037
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * DefaultTheme/default.edc:
+        Refactored color classes from active/inactive to foreground/background.
+
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * ewk/ewk_frame.cpp:
+        (_ewk_frame_contents_set_internal):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_uri_set):
+        (_ewk_frame_contents_set_internal):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * ewk/ewk_frame.cpp:
+        (_ewk_frame_contents_set_internal):
+
 2012-11-24  Viatcheslav Ostapenko  <v.ostapenko@samsung.com>
 
         [EFL] Layout test comes to crash on WK1
diff --git a/Source/WebKit/efl/DefaultTheme/CMakeLists.txt b/Source/WebKit/efl/DefaultTheme/CMakeLists.txt
index 850749e14..ded410845 100644
--- a/Source/WebKit/efl/DefaultTheme/CMakeLists.txt
+++ b/Source/WebKit/efl/DefaultTheme/CMakeLists.txt
@@ -1,110 +1,116 @@
-SET(DefaultTheme_RESOURCE_NAME default.edj)
-SET(DefaultTheme_DIR "${WEBKIT_DIR}/efl/DefaultTheme")
+MACRO (GENERATE_THEME _target_name _name _option)
+    SET(DefaultTheme_DIR "${WEBKIT_DIR}/efl/DefaultTheme")
+
+    ADD_CUSTOM_COMMAND(
+        OUTPUT ${THEME_BINARY_DIR}/${_name}
+        COMMAND ${EDJE_CC_EXECUTABLE} -v ${_option} default.edc ${THEME_BINARY_DIR}/${_name}
+        DEPENDS
+            default.edc
+            widget/button/button.edc
+            widget/button/img_button_focus.png
+            widget/button/img_button_hover.png
+            widget/button/img_button_normal.png
+            widget/button/img_button_press.png
+            widget/check/check.edc
+            widget/check/img_check_off_focus.png
+            widget/check/img_check_off_hover.png
+            widget/check/img_check_off.png
+            widget/check/img_check_on_focus.png
+            widget/check/img_check_on_hover.png
+            widget/check/img_check_on.png
+            widget/combo/combo.edc
+            widget/combo/combo_focus_button.png
+            widget/combo/combo_focus.png
+            widget/combo/combo_hover_button.png
+            widget/combo/combo_hover.png
+            widget/combo/combo_normal_button.png
+            widget/combo/combo_normal.png
+            widget/combo/combo_press_button.png
+            widget/combo/combo_press.png
+            widget/combo/icon.png
+            widget/entry/entry.edc
+            widget/entry/img_focused.png
+            widget/entry/img_hovered.png
+            widget/entry/img_normal.png
+            widget/file/file.edc
+            widget/file/file_focus.png
+            widget/file/file_hover.png
+            widget/file/file_normal.png
+            widget/file/file_press.png
+            widget/mediacontrol/fullscreenbutton/enterfullscreenbutton.png
+            widget/mediacontrol/fullscreenbutton/exitfullscreenbutton.png
+            widget/mediacontrol/fullscreenbutton/fullscreen_button.edc
+            widget/mediacontrol/mutebutton/mute_button.edc
+            widget/mediacontrol/mutebutton/mutebutton.png
+            widget/mediacontrol/mutebutton/unmutebutton.png
+            widget/mediacontrol/playpausebutton/pausebutton.png
+            widget/mediacontrol/playpausebutton/playbutton.png
+            widget/mediacontrol/playpausebutton/playpause_button.edc
+            widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc
+            widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png
+            widget/mediacontrol/seekforwardbutton/seekforward_button.edc
+            widget/mediacontrol/seekforwardbutton/seekforwardbutton.png
+            widget/mediacontrol/togglecaptionsbutton/closedcaption_disabled.png
+            widget/mediacontrol/togglecaptionsbutton/closedcaption.png
+            widget/mediacontrol/togglecaptionsbutton/toggle_captions_button.edc
+            widget/progressbar/bt_base.png
+            widget/progressbar/progressbar.edc
+            widget/progressbar/shelf_inset.png
+            widget/radio/img_radio_off_focus.png
+            widget/radio/img_radio_off_hover.png
+            widget/radio/img_radio_off.png
+            widget/radio/img_radio_on_focus.png
+            widget/radio/img_radio_on_hover.png
+            widget/radio/img_radio_on.png
+            widget/radio/radio.edc
+            widget/scrollbar/scrollbar.edc
+            widget/scrollbar/scrollbar_h.png
+            widget/scrollbar/scrollbar_knob_h.png
+            widget/scrollbar/scrollbar_knob_v.png
+            widget/scrollbar/scrollbar_v.png
+            widget/search/cancel/cancel_normal_button2.png
+            widget/search/cancel/cancel_normal_button.png
+            widget/search/cancel/search_cancel.edc
+            widget/search/decoration/decoration_normal_button.png
+            widget/search/decoration/search_decoration.edc
+            widget/search/field/field_focused.png
+            widget/search/field/field_hovered.png
+            widget/search/field/field_normal.png
+            widget/search/field/search_field.edc
+            widget/slider/slider.edc
+            widget/slider/slider_fill_h.png
+            widget/slider/slider_fill_v.png
+            widget/slider/slider_h.png
+            widget/slider/slider_thumb_h.png
+            widget/slider/slider_thumb_press_h.png
+            widget/slider/slider_thumb_press_v.png
+            widget/slider/slider_thumb_v.png
+            widget/slider/slider_v.png
+            widget/spinner/sp_bg.png
+            widget/spinner/sp_down_default.png
+            widget/spinner/sp_down_hover.png
+            widget/spinner/sp_down_pressed.png
+            widget/spinner/spinner.edc
+            widget/spinner/sp_up_default.png
+            widget/spinner/sp_up_hover.png
+            widget/spinner/sp_up_pressed.png
+        WORKING_DIRECTORY ${DefaultTheme_DIR}
+        VERBATIM
+    )
+
+    ADD_CUSTOM_TARGET(${_target_name} ALL
+        DEPENDS ${THEME_BINARY_DIR}/${_name}
+    )
+ENDMACRO()
 
 SET(DefaultTheme_DEFINITION "")
 IF (ENABLE_PROGRESS_ELEMENT)
     LIST(APPEND DefaultTheme_DEFINITION "-DENABLE_PROGRESS_ELEMENT")
 ENDIF ()
 
-ADD_CUSTOM_COMMAND(
-    OUTPUT ${THEME_BINARY_DIR}/${DefaultTheme_RESOURCE_NAME}
-    COMMAND ${EDJE_CC_EXECUTABLE} -v ${DefaultTheme_DEFINITION} default.edc ${THEME_BINARY_DIR}/${DefaultTheme_RESOURCE_NAME}
-    DEPENDS
-        default.edc
-        widget/button/button.edc
-        widget/button/img_button_focus.png
-        widget/button/img_button_hover.png
-        widget/button/img_button_normal.png
-        widget/button/img_button_press.png
-        widget/check/check.edc
-        widget/check/img_check_off_focus.png
-        widget/check/img_check_off_hover.png
-        widget/check/img_check_off.png
-        widget/check/img_check_on_focus.png
-        widget/check/img_check_on_hover.png
-        widget/check/img_check_on.png
-        widget/combo/combo.edc
-        widget/combo/combo_focus_button.png
-        widget/combo/combo_focus.png
-        widget/combo/combo_hover_button.png
-        widget/combo/combo_hover.png
-        widget/combo/combo_normal_button.png
-        widget/combo/combo_normal.png
-        widget/combo/combo_press_button.png
-        widget/combo/combo_press.png
-        widget/combo/icon.png
-        widget/entry/entry.edc
-        widget/entry/img_focused.png
-        widget/entry/img_hovered.png
-        widget/entry/img_normal.png
-        widget/file/file.edc
-        widget/file/file_focus.png
-        widget/file/file_hover.png
-        widget/file/file_normal.png
-        widget/file/file_press.png
-        widget/mediacontrol/fullscreenbutton/enterfullscreenbutton.png
-        widget/mediacontrol/fullscreenbutton/exitfullscreenbutton.png
-        widget/mediacontrol/fullscreenbutton/fullscreen_button.edc
-        widget/mediacontrol/mutebutton/mute_button.edc
-        widget/mediacontrol/mutebutton/mutebutton.png
-        widget/mediacontrol/mutebutton/unmutebutton.png
-        widget/mediacontrol/playpausebutton/pausebutton.png
-        widget/mediacontrol/playpausebutton/playbutton.png
-        widget/mediacontrol/playpausebutton/playpause_button.edc
-        widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc
-        widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png
-        widget/mediacontrol/seekforwardbutton/seekforward_button.edc
-        widget/mediacontrol/seekforwardbutton/seekforwardbutton.png
-        widget/mediacontrol/togglecaptionsbutton/closedcaption_disabled.png
-        widget/mediacontrol/togglecaptionsbutton/closedcaption.png
-        widget/mediacontrol/togglecaptionsbutton/toggle_captions_button.edc
-        widget/progressbar/bt_base.png
-        widget/progressbar/progressbar.edc
-        widget/progressbar/shelf_inset.png
-        widget/radio/img_radio_off_focus.png
-        widget/radio/img_radio_off_hover.png
-        widget/radio/img_radio_off.png
-        widget/radio/img_radio_on_focus.png
-        widget/radio/img_radio_on_hover.png
-        widget/radio/img_radio_on.png
-        widget/radio/radio.edc
-        widget/scrollbar/scrollbar.edc
-        widget/scrollbar/scrollbar_h.png
-        widget/scrollbar/scrollbar_knob_h.png
-        widget/scrollbar/scrollbar_knob_v.png
-        widget/scrollbar/scrollbar_v.png
-        widget/search/cancel/cancel_normal_button2.png
-        widget/search/cancel/cancel_normal_button.png
-        widget/search/cancel/search_cancel.edc
-        widget/search/decoration/decoration_normal_button.png
-        widget/search/decoration/search_decoration.edc
-        widget/search/field/field_focused.png
-        widget/search/field/field_hovered.png
-        widget/search/field/field_normal.png
-        widget/search/field/search_field.edc
-        widget/slider/slider.edc
-        widget/slider/slider_fill_h.png
-        widget/slider/slider_fill_v.png
-        widget/slider/slider_h.png
-        widget/slider/slider_thumb_h.png
-        widget/slider/slider_thumb_press_h.png
-        widget/slider/slider_thumb_press_v.png
-        widget/slider/slider_thumb_v.png
-        widget/slider/slider_v.png
-        widget/spinner/sp_bg.png
-        widget/spinner/sp_down_default.png
-        widget/spinner/sp_down_hover.png
-        widget/spinner/sp_down_pressed.png
-        widget/spinner/spinner.edc
-        widget/spinner/sp_up_default.png
-        widget/spinner/sp_up_hover.png
-        widget/spinner/sp_up_pressed.png
-    WORKING_DIRECTORY ${DefaultTheme_DIR}
-    VERBATIM
-)
+GENERATE_THEME(DefaultTheme "default.edj" "${DefaultTheme_DEFINITION}")
+INSTALL(FILES "${THEME_BINARY_DIR}/default.edj" DESTINATION ${DATA_INSTALL_DIR}/themes)
 
-ADD_CUSTOM_TARGET(DefaultTheme ALL
-    DEPENDS ${THEME_BINARY_DIR}/${DefaultTheme_RESOURCE_NAME}
-)
-
-INSTALL(FILES ${THEME_BINARY_DIR}/${DefaultTheme_RESOURCE_NAME} DESTINATION ${DATA_INSTALL_DIR}/themes)
+IF (ENABLE_API_TESTS)
+    GENERATE_THEME(BigButtonTheme "big_button_theme.edj" "-DBIG_BUTTON_THEME_FOR_TESTING")
+ENDIF ()
diff --git a/Source/WebKit/efl/DefaultTheme/default.edc b/Source/WebKit/efl/DefaultTheme/default.edc
index e234839d7..2ac69c5c3 100644
--- a/Source/WebKit/efl/DefaultTheme/default.edc
+++ b/Source/WebKit/efl/DefaultTheme/default.edc
@@ -21,14 +21,14 @@
 
 color_classes {
    color_class {
-      name: "webkit/selection/active";
-      color: 255 255 255 255; /* foreground */
-      color2: 86 86 209 255; /* background */
+      name: "webkit/selection/foreground";
+      color: 255 255 255 255; /* active */
+      color2: 255 255 255 255; /* inactive */
    }
    color_class {
-      name: "webkit/selection/inactive";
-      color: 255 255 255 255; /* foreground */
-      color2: 0 0 128 128; /* background */
+      name: "webkit/selection/background";
+      color: 86 86 209 255; /* active */
+      color2: 0 0 128 128; /* inactive */
    }
    color_class {
       name: "webkit/focus_ring";
diff --git a/Source/WebKit/efl/DefaultTheme/widget/button/button.edc b/Source/WebKit/efl/DefaultTheme/widget/button/button.edc
index 78cc72a54..b435ed139 100644
--- a/Source/WebKit/efl/DefaultTheme/widget/button/button.edc
+++ b/Source/WebKit/efl/DefaultTheme/widget/button/button.edc
@@ -113,7 +113,11 @@
                }
                rel2 {
                   relative: 1.0 1.0;
+#ifdef BIG_BUTTON_THEME_FOR_TESTING
+                  offset: -285 -11;
+#else
                   offset: -16 -11;
+#endif
                }
             }
          }
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index dec55d698..af38e4a08 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -30,6 +30,7 @@
 #include "DocumentMarkerController.h"
 #include "EventHandler.h"
 #include "FocusController.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoaderClientEfl.h"
 #include "FrameView.h"
 #include "HTMLCollection.h"
@@ -338,7 +339,7 @@ Eina_Bool ewk_frame_uri_set(Evas_Object* ewkFrame, const char* uri)
     WebCore::KURL kurl(WebCore::KURL(), WTF::String::fromUTF8(uri));
     WebCore::ResourceRequest req(kurl);
     WebCore::FrameLoader* loader = smartData->frame->loader();
-    loader->load(req, false);
+    loader->load(WebCore::FrameLoadRequest(smartData->frame, req));
     return true;
 }
 
@@ -416,7 +417,7 @@ static Eina_Bool _ewk_frame_contents_set_internal(Ewk_Frame_Smart_Data* smartDat
         baseKURL, unreachableKURL);
     WebCore::ResourceRequest request(baseKURL);
 
-    smartData->frame->loader()->load(request, substituteData, false);
+    smartData->frame->loader()->load(WebCore::FrameLoadRequest(smartData->frame, request, substituteData));
     return true;
 }
 
diff --git a/Source/WebKit/efl/ewk/ewk_view_single.cpp b/Source/WebKit/efl/ewk/ewk_view_single.cpp
index c1fc6cd02..c5779ab3f 100644
--- a/Source/WebKit/efl/ewk/ewk_view_single.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view_single.cpp
@@ -101,10 +101,10 @@ static void _ewk_view_single_smart_resize(Evas_Object* ewkView, Evas_Coord width
     }
 }
 
-static inline void _ewk_view_screen_move(uint32_t* image, size_t destinationX, size_t destinationY, size_t sourceX, size_t sourceY, size_t copyWidth, size_t copyHeight, size_t frameWidth)
+static inline void _ewk_view_screen_move(uint32_t* image, size_t destinationX, size_t destinationY, size_t sourceX, size_t sourceY, size_t copyWidth, size_t copyHeight, size_t imageWidth)
 {
-    uint32_t* sourceBegin = image + (frameWidth * sourceY) + sourceX;
-    uint32_t* destinationBegin = image + (frameWidth * destinationY) + destinationX;
+    uint32_t* sourceBegin = image + (imageWidth * sourceY) + sourceX;
+    uint32_t* destinationBegin = image + (imageWidth * destinationY) + destinationX;
 
     size_t copyLength = copyWidth * 4;
     const int moveLineUpDown = sourceY >= destinationY ? 1 : -1;
@@ -113,15 +113,15 @@ static inline void _ewk_view_screen_move(uint32_t* image, size_t destinationX, s
     uint32_t* source, * destination;
     if (sourceX >= destinationX) {
         for (size_t i = 0; i < copyHeight; i++) {
-            source = sourceBegin + (frameWidth * startHeight);
-            destination = destinationBegin + (frameWidth * startHeight);
+            source = sourceBegin + (imageWidth * startHeight);
+            destination = destinationBegin + (imageWidth * startHeight);
             startHeight = startHeight + moveLineUpDown;
             memcpy(destination, source, copyLength);
         }
     } else {
         for (size_t i = 0; i < copyHeight; i++) {
-            source = sourceBegin + (frameWidth * startHeight);
-            destination = destinationBegin + (frameWidth * startHeight);
+            source = sourceBegin + (imageWidth * startHeight);
+            destination = destinationBegin + (imageWidth * startHeight);
             startHeight = startHeight + moveLineUpDown;
             memmove(destination, source, copyLength);
         }
@@ -176,7 +176,7 @@ static inline void _ewk_view_single_scroll_process_single(Ewk_View_Smart_Data* s
     int copyWidth = scrollWidth - abs(scrollRequest->dx);
     int copyHeight = scrollHeight - abs(scrollRequest->dy);
     if (scrollRequest->dx || scrollRequest->dy) {
-        _ewk_view_screen_move(static_cast<uint32_t*>(pixels), destinationX, destinationY, sourceX, sourceY, copyWidth, copyHeight, scrollWidth);
+        _ewk_view_screen_move(static_cast<uint32_t*>(pixels), destinationX, destinationY, sourceX, sourceY, copyWidth, copyHeight, width);
         evas_object_image_data_update_add(smartData->backing_store, destinationX, destinationY, copyWidth, copyHeight);
     }
 
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index bf9641b43..e56a9f561 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,41 @@
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_load_uri):
+        (webkit_web_frame_load_data):
+        (webkit_web_frame_load_request):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_load_uri):
+        (webkit_web_frame_load_data):
+        (webkit_web_frame_load_request):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_load_uri):
+        (webkit_web_frame_load_data):
+        (webkit_web_frame_load_request):
+
 2012-11-25  Kaustubh Atrawalkar  <kaustubh@motorola.com>
 
         Remove deprecated load-done signal
diff --git a/Source/WebKit/gtk/webkit/webkitwebframe.cpp b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
index 80800c2c5..1e7c4c3f3 100644
--- a/Source/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -33,6 +33,7 @@
 #include "DocumentFragment.h"
 #include "DocumentLoader.h"
 #include "DocumentLoaderGtk.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClientGtk.h"
 #include "FrameSelection.h"
@@ -674,7 +675,7 @@ void webkit_web_frame_load_uri(WebKitWebFrame* frame, const gchar* uri)
     if (!coreFrame)
         return;
 
-    coreFrame->loader()->load(ResourceRequest(KURL(KURL(), String::fromUTF8(uri))), false);
+    coreFrame->loader()->load(FrameLoadRequest(coreFrame, ResourceRequest(KURL(KURL(), String::fromUTF8(uri)))));
 }
 
 static void webkit_web_frame_load_data(WebKitWebFrame* frame, const gchar* content, const gchar* mimeType, const gchar* encoding, const gchar* baseURL, const gchar* unreachableURL)
@@ -693,7 +694,7 @@ static void webkit_web_frame_load_data(WebKitWebFrame* frame, const gchar* conte
                                   KURL(KURL(), String::fromUTF8(unreachableURL)),
                                   KURL(KURL(), String::fromUTF8(unreachableURL)));
 
-    coreFrame->loader()->load(request, substituteData, false);
+    coreFrame->loader()->load(FrameLoadRequest(coreFrame, request, substituteData));
 }
 
 /**
@@ -762,7 +763,7 @@ void webkit_web_frame_load_request(WebKitWebFrame* frame, WebKitNetworkRequest*
     if (!coreFrame)
         return;
 
-    coreFrame->loader()->load(core(request), false);
+    coreFrame->loader()->load(FrameLoadRequest(coreFrame->document()->securityOrigin(), core(request)));
 }
 
 /**
diff --git a/Source/WebKit/mac/Carbon/HIWebView.mm b/Source/WebKit/mac/Carbon/HIWebView.mm
index 284dcea16..9235d11dd 100644
--- a/Source/WebKit/mac/Carbon/HIWebView.mm
+++ b/Source/WebKit/mac/Carbon/HIWebView.mm
@@ -36,7 +36,7 @@
 #import "WebHTMLViewInternal.h"
 #import "WebKit.h"
 #import <WebKitSystemInterface.h>
-#import <objc/objc-runtime.h>
+#import <wtf/ObjcRuntimeExtras.h>
 
 @interface NSWindow (AppKitSecretsHIWebViewKnows)
 - (void)_removeWindowRef;
@@ -1166,8 +1166,7 @@ UpdateCommandStatus( HIWebView* inView, const HICommand* inCommand )
 						
                         // Can't use -performSelector:withObject: here because the method we're calling returns BOOL, while
                         // -performSelector:withObject:'s return value is assumed to be an id.
-                        BOOL (*validationFunction)(id, SEL, id) = (BOOL (*)(id, SEL, id))objc_msgSend;
-                        if (validationFunction(resp, @selector(validateUserInterfaceItem:), proxy))
+                        if (wtfObjcMsgSend<BOOL>(resp, @selector(validateUserInterfaceItem:), proxy))
 							EnableMenuItem( inCommand->menu.menuRef, inCommand->menu.menuItemIndex );
 						else
 							DisableMenuItem( inCommand->menu.menuRef, inCommand->menu.menuItemIndex );
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index a1eafcd63..50e12ae99 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,90 @@
+2012-11-28  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=102970
+        [WK1] REGRESSION (r129545): Main frame doesn't rubberband unless 
+        WebFrameLoadDelegate implements -webView:didFirstLayoutInFrame:
+
+        Reviewed by Sam Weinig.
+
+        We should always register for DidFirstLayout in WK1 since we do work 
+        at that time besides just calling the delegate function.
+        * WebView/WebView.mm:
+        (-[WebView _cacheFrameLoadDelegateImplementations]):
+
+2012-11-27  Michael Saboff  <msaboff@apple.com>
+
+        TextIterator unnecessarily converts 8 bit strings to 16 bits
+        https://bugs.webkit.org/show_bug.cgi?id=103295
+
+        Reviewed by Brent Fulgham.
+
+        Updated _stringForRange to use plainText() instead of removed plainTextToMallocAllocatedBuffer().
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringForRange:]):
+
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Plugins/WebPluginController.mm:
+        * WebView/WebFrame.mm:
+        (-[WebFrame loadRequest:]):
+        (-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):
+
+2012-11-27  Pratik Solanki  <psolanki@apple.com>
+
+        objc/objc-runtime.h does not exist on all PLATFORM(MAC)
+        https://bugs.webkit.org/show_bug.cgi?id=101780
+
+        Reviewed by Brent Fulgham.
+
+        Clean up header includes so we don't include objc/objc-runtime.h.
+
+        * Carbon/HIWebView.mm:
+        (UpdateCommandStatus): Use wtfObjcMsgSend template instead of objc_msgSend.
+        * Plugins/WebNetscapePluginView.mm:
+        * Plugins/WebPluginContainerCheck.mm:
+        (-[WebPluginContainerCheck _continueWithPolicy:]): Use wtfObjcMsgSend template instead of objc_msgSend.
+        * Plugins/WebPluginController.mm:
+        * WebCoreSupport/WebCachedFramePlatformData.h:
+        * WebCoreSupport/WebDeviceOrientationClient.mm:
+        * WebView/WebDelegateImplementationCaching.mm:
+        * WebView/WebHTMLView.mm:
+        * WebView/WebPDFDocumentExtras.mm:
+        * WebView/WebPolicyDelegate.mm:
+        (-[WebPolicyDecisionListener _usePolicy:]): Use wtfObjcMsgSend template instead of objc_msgSend.
+        * WebView/WebView.mm:
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * Plugins/WebPluginController.mm:
+        * WebView/WebFrame.mm:
+        (-[WebFrame loadRequest:]):
+        (-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Plugins/WebPluginController.mm:
+        * WebView/WebFrame.mm:
+        (-[WebFrame loadRequest:]):
+        (-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):
+
 2012-11-23  Alexis Menard  <alexis@webkit.org>
 
         [CSS3 Backgrounds and Borders] Implement new CSS3 background-position parsing.
diff --git a/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm b/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 6a1eb640a..1e1bd385b 100644
--- a/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -77,7 +77,7 @@
 #import <WebCore/npruntime_impl.h>
 #import <WebKit/DOMPrivate.h>
 #import <WebKit/WebUIDelegate.h>
-#import <objc/objc-runtime.h>
+#import <objc/runtime.h>
 #import <runtime/InitializeThreading.h>
 #import <runtime/JSLock.h>
 #import <wtf/Assertions.h>
diff --git a/Source/WebKit/mac/Plugins/WebPluginContainerCheck.mm b/Source/WebKit/mac/Plugins/WebPluginContainerCheck.mm
index 30368a879..67c93d2ae 100644
--- a/Source/WebKit/mac/Plugins/WebPluginContainerCheck.mm
+++ b/Source/WebKit/mac/Plugins/WebPluginContainerCheck.mm
@@ -42,7 +42,7 @@
 #import <WebCore/FrameLoaderTypes.h>
 #import <WebCore/SecurityOrigin.h>
 #import <wtf/Assertions.h>
-#import <objc/objc-runtime.h>
+#import <wtf/ObjcRuntimeExtras.h>
 
 using namespace WebCore;
 
@@ -87,9 +87,9 @@ using namespace WebCore;
 - (void)_continueWithPolicy:(PolicyAction)policy
 {
     if (_contextInfo)
-        ((void (*)(id, SEL, BOOL, id))objc_msgSend)(_resultObject, _resultSelector, (policy == PolicyUse), _contextInfo);
+        wtfObjcMsgSend<void>(_resultObject, _resultSelector, (policy == PolicyUse), _contextInfo);
     else     
-        ((void (*)(id, SEL, BOOL))objc_msgSend)(_resultObject, _resultSelector, (policy == PolicyUse));
+        wtfObjcMsgSend<void>(_resultObject, _resultSelector, (policy == PolicyUse));
 
     // this will call indirectly call cancel
     [_controller _webPluginContainerCancelCheckIfAllowedToLoadRequest:self];
diff --git a/Source/WebKit/mac/Plugins/WebPluginController.mm b/Source/WebKit/mac/Plugins/WebPluginController.mm
index 3ff109086..4c007e3db 100644
--- a/Source/WebKit/mac/Plugins/WebPluginController.mm
+++ b/Source/WebKit/mac/Plugins/WebPluginController.mm
@@ -50,6 +50,7 @@
 #import <Foundation/NSURLRequest.h>
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/Frame.h>
+#import <WebCore/FrameLoadRequest.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/HTMLMediaElement.h>
 #import <WebCore/HTMLNames.h>
@@ -57,7 +58,7 @@
 #import <WebCore/ResourceRequest.h>
 #import <WebCore/ScriptController.h>
 #import <WebCore/WebCoreURLResponse.h>
-#import <objc/objc-runtime.h>
+#import <objc/runtime.h>
 #import <runtime/JSLock.h>
 #import <wtf/text/WTFString.h>
 
@@ -401,7 +402,10 @@ static void cancelOutstandingCheck(const void *item, void *context)
             LOG_ERROR("could not load URL %@", [request URL]);
             return;
         }
-        core(frame)->loader()->load(request, target, false);
+        FrameLoadRequest frameRequest(core(frame), request);
+        frameRequest.setFrameName(target);
+        frameRequest.setShouldCheckNewWindowPolicy(true);
+        core(frame)->loader()->load(frameRequest);
     }
 }
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebCachedFramePlatformData.h b/Source/WebKit/mac/WebCoreSupport/WebCachedFramePlatformData.h
index 9bdb51560..f7481b828 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebCachedFramePlatformData.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebCachedFramePlatformData.h
@@ -26,7 +26,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import <objc/objc-runtime.h>
 #import <WebCore/CachedFramePlatformData.h>
 #import <wtf/ObjcRuntimeExtras.h>
 #import <wtf/RetainPtr.h>
diff --git a/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm b/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm
index 669c0c288..511cc10ea 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm
@@ -28,7 +28,6 @@
 #import "WebDeviceOrientationInternal.h"
 #import "WebDeviceOrientationProvider.h"
 #import "WebViewInternal.h"
-#import <objc/objc-runtime.h>
 #import <wtf/ObjcRuntimeExtras.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit/mac/WebView/WebDelegateImplementationCaching.mm b/Source/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
index aac4cbfb0..6246a1d19 100644
--- a/Source/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
+++ b/Source/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
@@ -32,7 +32,6 @@
 #import "WebKitLogging.h"
 #import "WebView.h"
 #import "WebViewData.h"
-#import <objc/objc-runtime.h>
 #import <wtf/ObjcRuntimeExtras.h>
 
 @implementation WebView (WebDelegateImplementationCaching)
diff --git a/Source/WebKit/mac/WebView/WebFrame.mm b/Source/WebKit/mac/WebView/WebFrame.mm
index f91ffd8e5..89b9b8171 100644
--- a/Source/WebKit/mac/WebView/WebFrame.mm
+++ b/Source/WebKit/mac/WebView/WebFrame.mm
@@ -67,6 +67,7 @@
 #import <WebCore/EventHandler.h>
 #import <WebCore/EventNames.h>
 #import <WebCore/Frame.h>
+#import <WebCore/FrameLoadRequest.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/FrameLoaderStateMachine.h>
 #import <WebCore/FrameTree.h>
@@ -497,15 +498,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 
 - (NSString *)_stringForRange:(DOMRange *)range
 {
-    // This will give a system malloc'd buffer that can be turned directly into an NSString
-    unsigned length;
-    UChar* buf = plainTextToMallocAllocatedBuffer(core(range), length, true);
-    
-    if (!buf)
-        return [NSString string];
-
-    // Transfer buffer ownership to NSString
-    return [[[NSString alloc] initWithCharactersNoCopy:buf length:length freeWhenDone:YES] autorelease];
+    return plainText(core(range), TextIteratorDefaultBehavior, true);
 }
 
 - (BOOL)_shouldFlattenCompositingLayers:(CGContextRef)context
@@ -1369,7 +1362,7 @@ static bool needsMicrosoftMessengerDOMDocumentWorkaround()
     if (!resourceRequest.url().isValid() && !resourceRequest.url().isEmpty())
         resourceRequest.setURL([NSURL URLWithString:[@"file:" stringByAppendingString:[[request URL] absoluteString]]]);
 
-    coreFrame->loader()->load(resourceRequest, false);
+    coreFrame->loader()->load(FrameLoadRequest(coreFrame, resourceRequest));
 }
 
 static NSURL *createUniqueWebDataURL()
@@ -1400,7 +1393,7 @@ static NSURL *createUniqueWebDataURL()
 
     SubstituteData substituteData(WebCore::SharedBuffer::wrapNSData(data), MIMEType, encodingName, [unreachableURL absoluteURL], responseURL);
 
-    _private->coreFrame->loader()->load(request, substituteData, false);
+    _private->coreFrame->loader()->load(FrameLoadRequest(_private->coreFrame, request, substituteData));
 }
 
 
diff --git a/Source/WebKit/mac/WebView/WebHTMLView.mm b/Source/WebKit/mac/WebView/WebHTMLView.mm
index 8f12e5bf0..9f759ad05 100644
--- a/Source/WebKit/mac/WebView/WebHTMLView.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLView.mm
@@ -125,7 +125,6 @@
 #import <WebKitSystemInterface.h>
 #import <dlfcn.h>
 #import <limits>
-#import <objc/objc-runtime.h>
 #import <runtime/InitializeThreading.h>
 #import <wtf/MainThread.h>
 #import <wtf/ObjcRuntimeExtras.h>
diff --git a/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm b/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm
index 592edf75b..2cfd9b63c 100644
--- a/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm
+++ b/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm
@@ -29,7 +29,6 @@
 #import <wtf/Vector.h>
 #import <wtf/RetainPtr.h>
 #import <PDFKit/PDFDocument.h>
-#import <objc/objc-runtime.h>
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED == 1050
 @interface PDFDocument (Internal)
diff --git a/Source/WebKit/mac/WebView/WebPolicyDelegate.mm b/Source/WebKit/mac/WebView/WebPolicyDelegate.mm
index f2df74429..409db69a3 100644
--- a/Source/WebKit/mac/WebView/WebPolicyDelegate.mm
+++ b/Source/WebKit/mac/WebView/WebPolicyDelegate.mm
@@ -29,7 +29,7 @@
 #import "WebPolicyDelegatePrivate.h"
 
 #import <WebCore/FrameLoaderTypes.h>
-#import <objc/objc-runtime.h>
+#import <wtf/ObjcRuntimeExtras.h>
 
 using namespace WebCore;
 
@@ -91,7 +91,7 @@ NSString *WebActionOriginalURLKey = @"WebActionOriginalURLKey";
 - (void)_usePolicy:(PolicyAction)policy
 {
     if (_private->target)
-        ((void (*)(id, SEL, PolicyAction))objc_msgSend)(_private->target, _private->action, policy);
+        wtfObjcMsgSend<void>(_private->target, _private->action, policy);
 }
 
 - (void)_invalidate
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index fb444b4c1..1b17c67e4 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -181,7 +181,7 @@
 #import <WebKitSystemInterface.h>
 #import <mach-o/dyld.h>
 #import <objc/objc-auto.h>
-#import <objc/objc-runtime.h>
+#import <objc/runtime.h>
 #import <runtime/ArrayPrototype.h>
 #import <runtime/DateInstance.h>
 #import <runtime/InitializeThreading.h>
@@ -1686,9 +1686,7 @@ static inline IMP getMethod(id o, SEL s)
     // for backwards compatibility.
     Page* page = core(self);
     if (page) {
-        unsigned milestones = 0;
-        if (cache->didFirstLayoutInFrameFunc)
-            milestones |= DidFirstLayout;
+        unsigned milestones = DidFirstLayout;
         if (cache->didFirstVisuallyNonEmptyLayoutInFrameFunc)
             milestones |= DidFirstVisuallyNonEmptyLayout;
         page->addLayoutMilestones(static_cast<LayoutMilestones>(milestones));
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index 89474dd2e..3fa0e8b71 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -30,6 +30,7 @@
 #include "Element.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoaderClientQt.h"
 #include "FrameSelection.h"
 #include "FrameTree.h"
@@ -828,7 +829,7 @@ void QWebFrame::setHtml(const QString &html, const QUrl &baseUrl)
     const QByteArray utf8 = html.toUtf8();
     WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
     WebCore::SubstituteData substituteData(data, WTF::String("text/html"), WTF::String("utf-8"), KURL());
-    d->frame->loader()->load(request, substituteData, false);
+    d->frame->loader()->load(WebCore::FrameLoadRequest(d->frame, request, substituteData));
 }
 
 /*!
@@ -858,7 +859,7 @@ void QWebFrame::setContent(const QByteArray &data, const QString &mimeType, cons
         encoding = extractCharsetFromMediaType(mimeType);
     }
     WebCore::SubstituteData substituteData(buffer, WTF::String(actualMimeType), encoding, KURL());
-    d->frame->loader()->load(request, substituteData, false);
+    d->frame->loader()->load(WebCore::FrameLoadRequest(d->frame, request, substituteData));
 }
 
 /*!
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index f8ba65ff8..7ec8fbc3e 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,81 @@
+2012-11-28  Huang Dongsung  <luxtella@company100.net>
+
+        [Texmap] REGRESSION(r135620) QtTestBrowser crashes on Google-gravity.
+        https://bugs.webkit.org/show_bug.cgi?id=103410
+
+        Reviewed by Noam Rosenthal.
+
+        TextureMapperLayerClientQt::setTextureMapper() must call
+        flushCompositingStateForThisLayerOnly() of the root layer.
+
+        Currently, PageClientQGraphicsWidget::setRootGraphicsLayer does not flush layer
+        states of the root layer after setting TextureMapper while
+        PageClientQWidget::setRootGraphicsLayer() flushes them of the root layer.  If
+        not flushing states, descendant layers can not reach the root layer. It means
+        descendant layers can not reach the TextureMapper that the root layer has.
+
+        This is already the behavior for PageClientQWidget, which should be the case
+        for PageClientQGraphicsWidget as well.
+
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::TextureMapperLayerClientQt::setTextureMapper):
+        (WebCore::PageClientQWidget::setRootGraphicsLayer):
+
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::QWebFrame):
+        (QWebFrame::load):
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setAlternateHtml):
+        (qt_dump_set_accepts_editing):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setAlternateHtml):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+        * WebCoreSupport/QWebFrameAdapter.cpp:
+        (QWebFrameAdapter::load):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::QWebFrame):
+        (QWebFrame::load):
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setAlternateHtml):
+        (qt_dump_set_accepts_editing):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
 2012-11-26  Pierre Rossi  <pierre.rossi@gmail.com>
 
         [Qt] REGRESSION(r135575): It made all tests assert
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 8d08c4a10..9a3be3523 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -40,6 +40,7 @@
 #include "Element.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoaderClientQt.h"
 #include "FrameView.h"
 #include "GCController.h"
@@ -926,7 +927,7 @@ void DumpRenderTreeSupportQt::setAlternateHtml(QWebFrameAdapter* adapter, const
     const QByteArray utf8 = html.toUtf8();
     WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
     WebCore::SubstituteData substituteData(data, WTF::String("text/html"), WTF::String("utf-8"), failingUrl);
-    coreFrame->loader()->load(request, substituteData, false);
+    coreFrame->loader()->load(WebCore::FrameLoadRequest(coreFrame, request, substituteData));
 }
 
 void DumpRenderTreeSupportQt::confirmComposition(QWebPageAdapter *adapter, const char* text)
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 7a23ee268..8028bf91e 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -37,6 +37,7 @@
 #include "CSSPropertyNames.h"
 #include "DocumentLoader.h"
 #include "FormState.h"
+#include "FrameLoadRequest.h"
 #include "FrameNetworkingContextQt.h"
 #include "FrameTree.h"
 #include "FrameView.h"
@@ -1153,7 +1154,7 @@ bool FrameLoaderClientQt::callErrorPageExtension(const WebCore::ResourceError& e
     WebCore::ResourceRequest request(baseUrl);
     WTF::RefPtr<WebCore::SharedBuffer> buffer = WebCore::SharedBuffer::create(output.content.constData(), output.content.length());
     WebCore::SubstituteData substituteData(buffer, output.contentType, output.encoding, failingUrl);
-    m_frame->loader()->load(request, substituteData, false);
+    m_frame->loader()->load(WebCore::FrameLoadRequest(m_frame, request, substituteData));
     return true;
 }
 
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index 369307cba..d2b090af2 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -100,6 +100,7 @@ void TextureMapperLayerClientQt::setTextureMapper(const PassOwnPtr<TextureMapper
 {
     m_frame->d->textureMapper = textureMapper;
     m_frame->d->rootTextureMapperLayer->setTextureMapper(m_frame->d->textureMapper.get());
+    syncRootLayer();
 }
 
 TextureMapperLayerClientQt::~TextureMapperLayerClientQt()
@@ -123,7 +124,6 @@ void PageClientQWidget::setRootGraphicsLayer(GraphicsLayer* layer)
     if (layer) {
         TextureMapperLayerClient = adoptPtr(new TextureMapperLayerClientQt(page->mainFrame(), layer));
         TextureMapperLayerClient->setTextureMapper(TextureMapper::create());
-        TextureMapperLayerClient->syncRootLayer();
         return;
     }
     TextureMapperLayerClient.clear();
diff --git a/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp b/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
index e86413cf0..380b74954 100644
--- a/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
@@ -22,6 +22,7 @@
 #include "QWebFrameAdapter.h"
 
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoaderClientQt.h"
 #include "QWebPageAdapter.h"
 #if ENABLE(GESTURE_EVENTS)
@@ -132,7 +133,7 @@ void QWebFrameAdapter::load(const QNetworkRequest& req, QNetworkAccessManager::O
     if (!body.isEmpty())
         request.setHTTPBody(WebCore::FormData::create(body.constData(), body.size()));
 
-    frame->loader()->load(request, false);
+    frame->loader()->load(WebCore::FrameLoadRequest(frame, request));
 
     if (frame->tree()->parent())
         pageAdapter->insideOpenCall = false;
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 2e40dad52..74d351c4e 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,38 @@
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebFrame.cpp:
+        (WebFrame::loadRequest):
+        (WebFrame::loadData):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * WebFrame.cpp:
+        (WebFrame::loadRequest):
+        (WebFrame::loadData):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebFrame.cpp:
+        (WebFrame::loadRequest):
+        (WebFrame::loadData):
+
 2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
 
         Disambiguate innerNodeFramePoint and mainFramePoint
diff --git a/Source/WebKit/win/WebFrame.cpp b/Source/WebKit/win/WebFrame.cpp
index ee9cdd8c4..c859e6a25 100644
--- a/Source/WebKit/win/WebFrame.cpp
+++ b/Source/WebKit/win/WebFrame.cpp
@@ -556,7 +556,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::loadRequest(
     if (!coreFrame)
         return E_FAIL;
 
-    coreFrame->loader()->load(requestImpl->resourceRequest(), false);
+    coreFrame->loader()->load(FrameLoadRequest(coreFrame, requestImpl->resourceRequest()));
     return S_OK;
 }
 
@@ -580,7 +580,7 @@ void WebFrame::loadData(PassRefPtr<WebCore::SharedBuffer> data, BSTR mimeType, B
 
     // This method is only called from IWebFrame methods, so don't ASSERT that the Frame pointer isn't null.
     if (Frame* coreFrame = core(this))
-        coreFrame->loader()->load(request, substituteData, false);
+        coreFrame->loader()->load(FrameLoadRequest(coreFrame, request, substituteData));
 }
 
 
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index 0b1cae131..d46a6549d 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,35 @@
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebView.cpp:
+        (WebView::load):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * WebView.cpp:
+        (WebView::load):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebView.cpp:
+        (WebView::load):
+
 2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r135295.
diff --git a/Source/WebKit/wince/WebView.cpp b/Source/WebKit/wince/WebView.cpp
index fcc04d7db..9059a4022 100644
--- a/Source/WebKit/wince/WebView.cpp
+++ b/Source/WebKit/wince/WebView.cpp
@@ -32,6 +32,7 @@
 #include "EditorClientWinCE.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClientWinCE.h"
 #include "FrameView.h"
@@ -218,7 +219,7 @@ void WebView::load(const String &url)
 
 void WebView::load(const WebCore::ResourceRequest &request)
 {
-    frame()->loader()->load(request, false);
+    frame()->loader()->load(FrameLoadRequest(frame(), request));
 }
 
 void WebView::reload()
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index 4c43edc8e..eb1d3763f 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,35 @@
+2012-11-27  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebFrame.cpp:
+        (WebKit::WebFrame::SetPageSource):
+
+2012-11-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135786.
+        http://trac.webkit.org/changeset/135786
+        https://bugs.webkit.org/show_bug.cgi?id=103379
+
+        It made 3 plugin tests timeout on several platforms (Requested
+        by Ossy on #webkit).
+
+        * WebFrame.cpp:
+        (WebKit::WebFrame::SetPageSource):
+
+2012-11-26  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebFrame.cpp:
+        (WebKit::WebFrame::SetPageSource):
+
 2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r135295.
diff --git a/Source/WebKit/wx/WebFrame.cpp b/Source/WebKit/wx/WebFrame.cpp
index b374113c0..ccf54e38f 100644
--- a/Source/WebKit/wx/WebFrame.cpp
+++ b/Source/WebKit/wx/WebFrame.cpp
@@ -32,6 +32,7 @@
 #include "FloatRect.h"
 #include "FormState.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClientWx.h"
 #include "FrameView.h"
@@ -322,7 +323,7 @@ void WebFrame::SetPageSource(const wxString& source, const wxString& baseUrl, co
         WebCore::SubstituteData substituteData(sharedBuffer, mimetype, WTF::String("UTF-8"), WebCore::blankURL(), url);
 
         m_impl->frame->loader()->stop();
-        m_impl->frame->loader()->load(WebCore::ResourceRequest(url), substituteData, false);
+        m_impl->frame->loader()->load(WebCore::FrameLoadRequest(m_impl->frame, WebCore::ResourceRequest(url), substituteData));
     }
 }
author	Simon Hausmann <simon.hausmann@digia.com>	2012-11-29 12:18:48 +0100
committer	Simon Hausmann <simon.hausmann@digia.com>	2012-11-29 12:18:57 +0100
commit	4c01d0526ba4dd8cff0c0ff22a6f0ab5eb973064 (patch)
tree	bed2fe914fe0f7ec70abfb47d2d84af8a3604d09 /Source/WebKit
parent	01485457c9a5da3f1121015afd25bb53af77662e (diff)
download	qtwebkit-4c01d0526ba4dd8cff0c0ff22a6f0ab5eb973064.tar.gz