Imported WebKit commit e89504fa9195b2063b2530961d4b73dd08de3242 (http://svn.webkit.org/repository/webkit/trunk@135485)

Change-Id: I03774e5ac79721c13ffa30d152537a74d0b12e66 Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
author: Simon Hausmann <simon.hausmann@digia.com> 2012-11-22 09:09:45 +0100
committer: Simon Hausmann <simon.hausmann@digia.com> 2012-11-22 09:10:13 +0100
commit: 470286ecfe79d59df14944e5b5d34630fc739391 (patch)
tree: 43983212872e06cebefd2ae474418fa2908ca54c /Source/WebKit
parent: 23037105e948c2065da5a937d3a2396b0ff45c1e (diff)
download: qtwebkit-470286ecfe79d59df14944e5b5d34630fc739391.tar.gz
198 files changed, 6320 insertions, 1695 deletions
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 60f188987..6f392306b 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,35 @@
+2012-11-21  Kai Koehne  <kai.koehne@digia.com>
+
+        [Qt] MinGW: Don't add OpenGL library dependencies here
+        https://bugs.webkit.org/show_bug.cgi?id=102924
+
+        Reviewed by Simon Hausmann.
+
+        As the comment suggests the dependency is already for WebCore, so add it there instead.
+
+        * WebKit1.pri:
+
+2012-11-18  Laszlo Gombos  <l.gombos@samsung.com>
+
+        [CMake] Consolidate common input files
+        https://bugs.webkit.org/show_bug.cgi?id=101632
+
+        Reviewed by Rob Buis.
+
+        Consolidate and sort the list of files.
+
+        * PlatformEfl.cmake:
+
+2012-11-12  Timothy Hatcher  <timothy@apple.com>
+
+        Add a dock button to the top right corner of the Web Inspector window (similar to the full screen button).
+
+        https://bugs.webkit.org/show_bug.cgi?id=102025
+
+        Reviewed by Joseph Pecoraro.
+
+        * WebKit.xcodeproj/project.pbxproj: Added Dock.pdf.
+
 2012-11-08  Laszlo Gombos  <l.gombos@samsung.com>
 
         [EFL] Remove non-variable options from the build system
diff --git a/Source/WebKit/PlatformEfl.cmake b/Source/WebKit/PlatformEfl.cmake
index e8cb6bb9c..ed7b94d2f 100644
--- a/Source/WebKit/PlatformEfl.cmake
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -7,22 +7,23 @@ LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/efl"
     "${WEBCORE_DIR}/platform/graphics/cairo"
     "${WEBCORE_DIR}/platform/graphics/efl"
+    "${WEBCORE_DIR}/platform/graphics/freetype"
     "${WEBCORE_DIR}/platform/mock"
     "${WEBCORE_DIR}/platform/network/soup"
     ${CAIRO_INCLUDE_DIRS}
-    ${ECORE_INCLUDE_DIRS}
     ${ECORE_EVAS_INCLUDE_DIRS}
+    ${ECORE_INCLUDE_DIRS}
     ${ECORE_INPUT_INCLUDE_DIRS}
     ${EDJE_INCLUDE_DIRS}
     ${EFREET_INCLUDE_DIRS}
     ${EINA_INCLUDE_DIRS}
     ${EVAS_INCLUDE_DIRS}
+    ${GLIB_INCLUDE_DIRS}
     ${HARFBUZZ_INCLUDE_DIRS}
+    ${LIBSOUP_INCLUDE_DIRS}
     ${LIBXML2_INCLUDE_DIR}
     ${LIBXSLT_INCLUDE_DIR}
     ${SQLITE_INCLUDE_DIR}
-    ${GLIB_INCLUDE_DIRS}
-    ${LIBSOUP_INCLUDE_DIRS}
 )
 
 IF (ENABLE_SVG)
@@ -49,10 +50,6 @@ IF (ENABLE_VIDEO_TRACK)
   )
 ENDIF ()
 
-LIST(APPEND WebKit_INCLUDE_DIRECTORIES
-  "${WEBCORE_DIR}/platform/graphics/freetype"
-)
-
 IF (ENABLE_NOTIFICATIONS)
   LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/notifications"
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index d33b7411e..019cbd485 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -64,6 +64,7 @@
 		1C68F672095B5FC100C2984E /* WebNodeHighlightView.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C68F666095B5FC100C2984E /* WebNodeHighlightView.mm */; };
 		1C7B0C660EB2464D00A28502 /* WebInspectorClientCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1C7B0C650EB2464D00A28502 /* WebInspectorClientCF.cpp */; };
 		1C8CB07A0AE9830C00B1F6E9 /* WebEditingDelegatePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 1C8CB0790AE9830C00B1F6E9 /* WebEditingDelegatePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1C9F5EFC1651CDF700C480F8 /* Dock.pdf in Resources */ = {isa = PBXBuildFile; fileRef = 1C9F5EFB1651CDF700C480F8 /* Dock.pdf */; };
 		1CCFFD130B1F81F2002EE926 /* OldWebAssertions.c in Sources */ = {isa = PBXBuildFile; fileRef = 1CCFFD120B1F81F2002EE926 /* OldWebAssertions.c */; };
 		224100F3091818D900D2D266 /* WebPluginsPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 224100F2091818D900D2D266 /* WebPluginsPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		224100F90918190100D2D266 /* WebPluginsPrivate.m in Sources */ = {isa = PBXBuildFile; fileRef = 224100F80918190100D2D266 /* WebPluginsPrivate.m */; };
@@ -438,6 +439,7 @@
 		1C904FD30BA9DD0F0081E9D0 /* Version.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Version.xcconfig; sourceTree = "<group>"; };
 		1C904FD40BA9DD0F0081E9D0 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = "<group>"; };
 		1C904FD50BA9DD0F0081E9D0 /* Base.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
+		1C9F5EFB1651CDF700C480F8 /* Dock.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = Dock.pdf; sourceTree = "<group>"; };
 		1CCFFD120B1F81F2002EE926 /* OldWebAssertions.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = OldWebAssertions.c; sourceTree = "<group>"; };
 		224100F2091818D900D2D266 /* WebPluginsPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPluginsPrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		224100F80918190100D2D266 /* WebPluginsPrivate.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebPluginsPrivate.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -831,6 +833,7 @@
 		089C1665FE841158C02AAC07 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
+				1C9F5EFB1651CDF700C480F8 /* Dock.pdf */,
 				9325FBDC07D829AE00159862 /* IDNScriptWhiteList.txt */,
 				939811320824BF01008DF038 /* Info.plist */,
 				F5B67130023EDF8901C1A525 /* url_icon.tiff */,
@@ -1701,6 +1704,7 @@
 				939810B70824BF01008DF038 /* url_icon.tiff in Resources */,
 				939810B50824BF01008DF038 /* WebAuthenticationPanel.nib in Resources */,
 				5DE83A7A0D0F7F9400CAD12A /* WebJavaScriptTextInputPanel.nib in Resources */,
+				1C9F5EFC1651CDF700C480F8 /* Dock.pdf in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit/WebKit1.pri b/Source/WebKit/WebKit1.pri
index 5626f0708..f988b4c6b 100644
--- a/Source/WebKit/WebKit1.pri
+++ b/Source/WebKit/WebKit1.pri
@@ -30,8 +30,4 @@ have?(QTPRINTSUPPORT): QT += printsupport
 
 use?(TEXTURE_MAPPER_GL)|enable?(WEBGL) {
     QT *= opengl
-    # Make sure OpenGL libs are after the webcore lib so MinGW can resolve symbols
-    win32*:!win32-msvc*: LIBS += $$QMAKE_LIBS_OPENGL
 }
-
-
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index 61b90cc24..3daa490d5 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -200,12 +200,14 @@ BackingStorePrivate::BackingStorePrivate()
     , m_resumeOperation(BackingStore::None)
     , m_suspendRenderJobs(false)
     , m_suspendRegularRenderJobs(false)
+    , m_tileMatrixNeedsUpdate(false)
     , m_isScrollingOrZooming(false)
     , m_webPage(0)
     , m_client(0)
     , m_renderQueue(adoptPtr(new RenderQueue(this)))
     , m_defersBlit(true)
     , m_hasBlitJobs(false)
+    , m_webPageBackgroundColor(WebCore::Color::white)
     , m_currentWindowBackBuffer(0)
     , m_preferredTileMatrixDimension(Vertical)
 #if USE(ACCELERATED_COMPOSITING)
@@ -278,14 +280,22 @@ bool BackingStorePrivate::isOpenGLCompositing() const
     return true;
 }
 
-void BackingStorePrivate::suspendScreenAndBackingStoreUpdates()
+void BackingStorePrivate::suspendBackingStoreUpdates()
 {
-    if (m_suspendScreenUpdates) {
+    if (atomic_add_value(&m_suspendBackingStoreUpdates, 0)) {
         BBLOG(BlackBerry::Platform::LogLevelInfo,
-            "Screen and backingstore already suspended, increasing suspend counter.");
+            "Backingstore already suspended, increasing suspend counter.");
     }
 
-    ++m_suspendBackingStoreUpdates;
+    atomic_add(&m_suspendBackingStoreUpdates, 1);
+}
+
+void BackingStorePrivate::suspendScreenUpdates()
+{
+    if (m_suspendScreenUpdates) {
+        BBLOG(BlackBerry::Platform::LogLevelInfo,
+            "Screen already suspended, increasing suspend counter.");
+    }
 
     // Make sure the user interface thread gets the message before we proceed
     // because blitVisibleContents() can be called from the user interface
@@ -295,17 +305,32 @@ void BackingStorePrivate::suspendScreenAndBackingStoreUpdates()
     BlackBerry::Platform::userInterfaceThreadMessageClient()->syncToCurrentMessage();
 }
 
-void BackingStorePrivate::resumeScreenAndBackingStoreUpdates(BackingStore::ResumeUpdateOperation op)
+void BackingStorePrivate::resumeBackingStoreUpdates()
 {
-    ASSERT(m_suspendScreenUpdates);
-    ASSERT(m_suspendBackingStoreUpdates);
+    unsigned currentValue = atomic_add_value(&m_suspendBackingStoreUpdates, 0);
+    ASSERT(currentValue >= 1);
+    if (currentValue < 1) {
+        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelCritical,
+            "Call mismatch: Backingstore hasn't been suspended, therefore won't resume!");
+        return;
+    }
+
+    // Set a flag indicating that we're about to resume backingstore updates and
+    // the tile matrix should be updated as a consequence by the first render
+    // job that happens after this resumption of backingstore updates.
+    if (currentValue == 1)
+        setTileMatrixNeedsUpdate();
+
+    atomic_sub(&m_suspendBackingStoreUpdates, 1);
+}
 
-    // Both variables are similar except for the timing of setting them.
-    ASSERT(m_suspendScreenUpdates == m_suspendBackingStoreUpdates);
+void BackingStorePrivate::resumeScreenUpdates(BackingStore::ResumeUpdateOperation op)
+{
+    ASSERT(m_suspendScreenUpdates);
 
-    if (!m_suspendScreenUpdates || !m_suspendBackingStoreUpdates) {
+    if (!m_suspendScreenUpdates) {
         BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelCritical,
-            "Call mismatch: Screen and backingstore haven't been suspended, therefore won't resume!");
+            "Call mismatch: Screen hasn't been suspended, therefore won't resume!");
         return;
     }
 
@@ -314,16 +339,13 @@ void BackingStorePrivate::resumeScreenAndBackingStoreUpdates(BackingStore::Resum
         || (m_resumeOperation == BackingStore::None && op == BackingStore::Blit))
         m_resumeOperation = op;
 
-    if (m_suspendScreenUpdates >= 2 && m_suspendBackingStoreUpdates >= 2) { // we're still suspended
+    if (m_suspendScreenUpdates >= 2) { // we're still suspended
         BBLOG(BlackBerry::Platform::LogLevelInfo,
             "Screen and backingstore still suspended, decreasing suspend counter.");
-        --m_suspendBackingStoreUpdates;
         --m_suspendScreenUpdates;
         return;
     }
 
-    --m_suspendBackingStoreUpdates;
-
     op = m_resumeOperation;
     m_resumeOperation = BackingStore::None;
 
@@ -375,9 +397,6 @@ void BackingStorePrivate::resumeScreenAndBackingStoreUpdates(BackingStore::Resum
 void BackingStorePrivate::repaint(const Platform::IntRect& windowRect,
                                   bool contentChanged, bool immediate)
 {
-    if (m_suspendBackingStoreUpdates)
-        return;
-
      // If immediate is true, then we're being asked to perform synchronously.
      // NOTE: WebCore::ScrollView will call this method with immediate:true and contentChanged:false.
      // This is a special case introduced specifically for the Apple's windows port and can be safely ignored I believe.
@@ -406,6 +425,9 @@ void BackingStorePrivate::repaint(const Platform::IntRect& windowRect,
 #endif
 
         if (immediate) {
+            if (m_suspendBackingStoreUpdates)
+                return;
+
             if (render(rect)) {
                 if (!shouldDirectRenderingToWindow() && !m_webPage->d->commitRootLayerIfNeeded())
                     blitVisibleContents();
@@ -701,6 +723,9 @@ void BackingStorePrivate::setBackingStoreRect(const Platform::IntRect& backingSt
         return;
     }
 
+    if (m_suspendBackingStoreUpdates)
+        return;
+
     Platform::IntRect currentBackingStoreRect = frontState()->backingStoreRect();
     double currentScale = frontState()->scale();
 
@@ -1039,6 +1064,11 @@ bool BackingStorePrivate::render(const Platform::IntRect& rect)
     if (!isActive())
         return false;
 
+    // This is the first render job that has been performed since resumption of
+    // backingstore updates and the tile matrix needs updating since we suspend
+    // tile matrix updating with backingstore updates
+    updateTileMatrixIfNeeded();
+
     TileRectList tileRectList = mapFromTransformedContentsToTiles(rect);
     if (tileRectList.isEmpty())
         return false;
@@ -1144,6 +1174,7 @@ void BackingStorePrivate::requestLayoutIfNeeded() const
 
 bool BackingStorePrivate::renderVisibleContents()
 {
+    updateTileMatrixIfNeeded();
     Platform::IntRect renderRect = shouldDirectRenderingToWindow() ? visibleContentsRect() : visibleTilesRect();
     if (render(renderRect)) {
         m_renderQueue->clear(renderRect, true /*clearRegularRenderJobs*/);
@@ -1154,6 +1185,7 @@ bool BackingStorePrivate::renderVisibleContents()
 
 bool BackingStorePrivate::renderBackingStore()
 {
+    updateTileMatrixIfNeeded();
     return render(frontState()->backingStoreRect());
 }
 
@@ -1289,6 +1321,10 @@ void BackingStorePrivate::blitVisibleContents(bool force)
         viewportAccessor->scale());
 #endif
 
+#if DEBUG_CHECKERBOARD
+    bool blitCheckered = false;
+#endif
+
     Vector<TileBuffer*> blittedTiles;
 
     if (isActive() && !m_webPage->d->compositorDrawsRootLayer()) {
@@ -1315,10 +1351,6 @@ void BackingStorePrivate::blitVisibleContents(bool force)
         if (!transformedSrcRect.isEmpty())
             transformation = TransformationMatrix::rectToRect(FloatRect(FloatPoint(0.0, 0.0), WebCore::IntSize(transformedSrcRect.size())), WebCore::IntRect(dstRect));
 
-#if DEBUG_CHECKERBOARD
-        bool blitCheckered = false;
-#endif
-
         // Don't clip to contents if it is empty so we can still paint default background.
         if (!transformedContentsRect.isEmpty()) {
             clippedTransformedSrcRect.intersect(transformedContentsRect);
@@ -1949,12 +1981,18 @@ void BackingStorePrivate::updateTileMatrixIfNeeded()
 {
     ASSERT(BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread());
 
+    if (!m_tileMatrixNeedsUpdate)
+        return;
+
+    m_tileMatrixNeedsUpdate = false;
+
     // This will update the tile matrix.
     scrollBackingStore(0, 0);
 }
 
 void BackingStorePrivate::contentsSizeChanged(const Platform::IntSize&)
 {
+    setTileMatrixNeedsUpdate();
     updateTileMatrixIfNeeded();
 }
 
@@ -2023,6 +2061,7 @@ void BackingStorePrivate::transformChanged()
 void BackingStorePrivate::orientationChanged()
 {
     ASSERT(BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread());
+    setTileMatrixNeedsUpdate();
     updateTileMatrixIfNeeded();
     createVisibleTileBuffer();
 }
@@ -2053,6 +2092,10 @@ void BackingStorePrivate::createSurfaces()
         return;
     }
 
+    // Don't try to blit to screen unless we have a buffer.
+    if (!buffer())
+        suspendScreenUpdates();
+
     SurfacePool* surfacePool = SurfacePool::globalSurfacePool();
     surfacePool->initialize(tileSize());
 
@@ -2085,10 +2128,6 @@ void BackingStorePrivate::createSurfaces()
     swapState();
 
     createVisibleTileBufferForWebPage(m_webPage->d);
-
-    // Don't try to blit to screen unless we have a buffer.
-    if (!buffer())
-        suspendScreenAndBackingStoreUpdates();
 }
 
 void BackingStorePrivate::createVisibleTileBuffer()
@@ -2366,9 +2405,38 @@ void BackingStorePrivate::fillWindow(Platform::Graphics::FillPattern pattern,
             "Empty window buffer, couldn't fillWindow");
     }
 
+    if (pattern == BlackBerry::Platform::Graphics::CheckerboardPattern && BlackBerry::Platform::Settings::isPublicBuild()) {
+        // For public builds, convey the impression of less checkerboard.
+        // For developer builds, keep the checkerboard to get it fixed better.
+        BlackBerry::Platform::Graphics::clearBuffer(dstBuffer, dstRect,
+            m_webPageBackgroundColor.red(), m_webPageBackgroundColor.green(),
+            m_webPageBackgroundColor.blue(), m_webPageBackgroundColor.alpha());
+        return;
+    }
+
     BlackBerry::Platform::Graphics::fillBuffer(dstBuffer, pattern, dstRect, contentsOrigin, contentsScale);
 }
 
+WebCore::Color BackingStorePrivate::webPageBackgroundColorUserInterfaceThread() const
+{
+    ASSERT(BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread());
+    return m_webPageBackgroundColor;
+}
+
+void BackingStorePrivate::setWebPageBackgroundColor(const WebCore::Color& color)
+{
+    if (!BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+        typedef void (BlackBerry::WebKit::BackingStorePrivate::*FunctionType)(const WebCore::Color&);
+
+        BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(
+            BlackBerry::Platform::createMethodCallMessage<FunctionType, BackingStorePrivate, WebCore::Color>(
+                &BackingStorePrivate::setWebPageBackgroundColor, this, color));
+        return;
+    }
+
+    m_webPageBackgroundColor = color;
+}
+
 void BackingStorePrivate::invalidateWindow()
 {
     // Grab a rect appropriate for the current thread.
@@ -2490,6 +2558,8 @@ void BackingStorePrivate::setScrollingOrZooming(bool scrollingOrZooming, bool sh
     else if (shouldBlit && !shouldDirectRenderingToWindow())
         blitVisibleContents();
 #endif
+    if (!scrollingOrZooming && shouldPerformRegularRenderJobs())
+        dispatchRenderJob();
 }
 
 void BackingStorePrivate::lockBackingStore()
@@ -2602,14 +2672,24 @@ void BackingStore::createSurface()
     d->m_webPage->setFocused(true);
 }
 
-void BackingStore::suspendScreenAndBackingStoreUpdates()
+void BackingStore::suspendBackingStoreUpdates()
+{
+    d->suspendBackingStoreUpdates();
+}
+
+void BackingStore::resumeBackingStoreUpdates()
+{
+    d->resumeBackingStoreUpdates();
+}
+
+void BackingStore::suspendScreenUpdates()
 {
-    d->suspendScreenAndBackingStoreUpdates();
+    d->suspendScreenUpdates();
 }
 
-void BackingStore::resumeScreenAndBackingStoreUpdates(ResumeUpdateOperation op)
+void BackingStore::resumeScreenUpdates(ResumeUpdateOperation op)
 {
-    d->resumeScreenAndBackingStoreUpdates(op);
+    d->resumeScreenUpdates(op);
 }
 
 bool BackingStore::isScrollingOrZooming() const
@@ -2643,10 +2723,14 @@ void BackingStore::createBackingStoreMemory()
 {
     if (BackingStorePrivate::s_currentBackingStoreOwner == d->m_webPage)
         SurfacePool::globalSurfacePool()->createBuffers();
+    resumeBackingStoreUpdates();
+    resumeScreenUpdates(BackingStore::RenderAndBlit);
 }
 
 void BackingStore::releaseBackingStoreMemory()
 {
+    suspendBackingStoreUpdates();
+    suspendScreenUpdates();
     if (BackingStorePrivate::s_currentBackingStoreOwner == d->m_webPage)
         SurfacePool::globalSurfacePool()->releaseBuffers();
 }
diff --git a/Source/WebKit/blackberry/Api/BackingStore.h b/Source/WebKit/blackberry/Api/BackingStore.h
index 2501c98d9..a5f99b7db 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.h
+++ b/Source/WebKit/blackberry/Api/BackingStore.h
@@ -53,8 +53,11 @@ public:
 
     void createSurface();
 
-    void suspendScreenAndBackingStoreUpdates();
-    void resumeScreenAndBackingStoreUpdates(ResumeUpdateOperation);
+    void suspendBackingStoreUpdates();
+    void resumeBackingStoreUpdates();
+
+    void suspendScreenUpdates();
+    void resumeScreenUpdates(BackingStore::ResumeUpdateOperation);
 
     bool isScrollingOrZooming() const;
     void setScrollingOrZooming(bool);
diff --git a/Source/WebKit/blackberry/Api/BackingStore_p.h b/Source/WebKit/blackberry/Api/BackingStore_p.h
index 8e52a12ae..455217871 100644
--- a/Source/WebKit/blackberry/Api/BackingStore_p.h
+++ b/Source/WebKit/blackberry/Api/BackingStore_p.h
@@ -20,6 +20,7 @@
 #define BackingStore_p_h
 
 #include "BackingStore.h"
+#include "Color.h"
 #include "RenderQueue.h"
 #include "TileIndex.h"
 #include "TileIndexHash.h"
@@ -126,11 +127,17 @@ public:
 
     bool isSuspended() const { return m_suspendBackingStoreUpdates; }
 
+    // Suspends all backingstore updates so that rendering to the backingstore is disabled.
+    void suspendBackingStoreUpdates();
+
+    // Resumes all backingstore updates so that rendering to the backingstore is enabled.
+    void resumeBackingStoreUpdates();
+
     // Suspends all screen updates so that 'blitVisibleContents' is disabled.
-    void suspendScreenAndBackingStoreUpdates();
+    void suspendScreenUpdates();
 
     // Resumes all screen updates so that 'blitVisibleContents' is enabled.
-    void resumeScreenAndBackingStoreUpdates(BackingStore::ResumeUpdateOperation);
+    void resumeScreenUpdates(BackingStore::ResumeUpdateOperation);
 
     // The functions repaint(), slowScroll(), scroll(), scrollingStartedHelper() are
     // called from outside WebKit and within WebKit via ChromeClientBlackBerry.
@@ -275,6 +282,7 @@ public:
     TileRectList mapFromTransformedContentsToTiles(const Platform::IntRect&) const;
     TileRectList mapFromTransformedContentsToTiles(const Platform::IntRect&, BackingStoreGeometry*) const;
 
+    void setTileMatrixNeedsUpdate() { m_tileMatrixNeedsUpdate = true; }
     void updateTileMatrixIfNeeded();
 
     // Called by WebPagePrivate::notifyTransformedContentsSizeChanged.
@@ -319,6 +327,9 @@ public:
     void blitToWindow(const Platform::IntRect& dstRect, const BlackBerry::Platform::Graphics::Buffer* srcBuffer, const Platform::IntRect& srcRect, bool blend, unsigned char globalAlpha);
     void fillWindow(Platform::Graphics::FillPattern, const Platform::IntRect& dstRect, const Platform::IntPoint& contentsOrigin, double contentsScale);
 
+    WebCore::Color webPageBackgroundColorUserInterfaceThread() const; // use WebSettings::backgroundColor() for the WebKit thread
+    void setWebPageBackgroundColor(const WebCore::Color&);
+
     void invalidateWindow();
     void invalidateWindow(const Platform::IntRect& dst);
     void clearWindow(const Platform::IntRect&, unsigned char red, unsigned char green, unsigned char blue, unsigned char alpha = 255);
@@ -354,6 +365,7 @@ public:
 
     bool m_suspendRenderJobs;
     bool m_suspendRegularRenderJobs;
+    bool m_tileMatrixNeedsUpdate;
     bool m_isScrollingOrZooming;
     WebPage* m_webPage;
     BackingStoreClient* m_client;
@@ -363,6 +375,8 @@ public:
     bool m_defersBlit;
     bool m_hasBlitJobs;
 
+    WebCore::Color m_webPageBackgroundColor; // for user interface thread operations such as blitting
+
     mutable unsigned m_frontState;
     mutable unsigned m_backState;
 
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index a2b354a5c..bd372b961 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -72,6 +72,7 @@
 #include "HTTPParsers.h"
 #include "HistoryItem.h"
 #include "IconDatabaseClientBlackBerry.h"
+#include "ImageDocument.h"
 #include "InPageSearchManager.h"
 #include "InRegionScrollableArea.h"
 #include "InRegionScroller_p.h"
@@ -222,6 +223,7 @@ const IntSize minimumLayoutSize(10, 10); // Needs to be a small size, greater th
 const double minimumExpandingRatio = 0.15;
 
 const double minimumZoomToFitScale = 0.25;
+const double maximumImageDocumentZoomToFitScale = 2;
 
 // Helper function to parse a URL and fill in missing parts.
 static KURL parseUrl(const String& url)
@@ -417,12 +419,11 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_needsCommit(false)
     , m_suspendRootLayerCommit(false)
 #endif
-    , m_hasPendingSurfaceSizeChange(false)
     , m_pendingOrientation(-1)
     , m_fullscreenVideoNode(0)
     , m_hasInRegionScrollableAreas(false)
     , m_updateDelegatedOverlaysDispatched(false)
-    , m_enableQnxJavaScriptObject(true)
+    , m_enableQnxJavaScriptObject(false)
     , m_deferredTasksTimer(this, &WebPagePrivate::deferredTasksTimerFired)
     , m_selectPopup(0)
     , m_autofillManager(AutofillManager::create(this))
@@ -571,9 +572,6 @@ void WebPagePrivate::init(const BlackBerry::Platform::String& pageGroupName)
     WebCore::provideNetworkInfoTo(m_page, new WebCore::NetworkInfoClientBlackBerry(this));
 #endif
 
-    m_page->setCustomHTMLTokenizerChunkSize(256);
-    m_page->setCustomHTMLTokenizerTimeDelay(0.3);
-
     m_webSettings = WebSettings::createFromStandardSettings();
     m_webSettings->setUserAgentString(defaultUserAgent());
     m_page->setDeviceScaleFactor(m_webSettings->devicePixelRatio());
@@ -1033,6 +1031,11 @@ void WebPagePrivate::setLoadState(LoadState state)
     if (state == Finished && m_mainFrame && m_mainFrame->document())
         m_mainFrame->document()->updateStyleIfNeeded();
 
+    // Dispatch the backingstore background color at important state changes.
+    m_backingStore->d->setWebPageBackgroundColor(m_mainFrame && m_mainFrame->view()
+        ? m_mainFrame->view()->documentBackgroundColor()
+        : m_webSettings->backgroundColor());
+
     m_loadState = state;
 
 #if DEBUG_WEBPAGE_LOAD
@@ -1065,7 +1068,9 @@ void WebPagePrivate::setLoadState(LoadState state)
 #endif
 
             // Suspend screen update to avoid ui thread blitting while resetting backingstore.
-            m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+            // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+            m_backingStore->d->suspendBackingStoreUpdates();
+            m_backingStore->d->suspendScreenUpdates();
 
             m_previousContentsSize = IntSize();
             m_backingStore->d->resetRenderQueue();
@@ -1121,7 +1126,9 @@ void WebPagePrivate::setLoadState(LoadState state)
             setScrollPosition(IntPoint::zero());
             notifyTransformedScrollChanged();
 
-            m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+            // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+            m_backingStore->d->resumeBackingStoreUpdates();
+            m_backingStore->d->resumeScreenUpdates(BackingStore::None);
 
             // Paints the visible backingstore as white. Note it is important we do
             // this strictly after re-setting the scroll position to origin and resetting
@@ -1223,7 +1230,9 @@ bool WebPagePrivate::zoomAboutPoint(double unclampedScale, const FloatPoint& anc
     *m_transformationMatrix = zoom;
 
     // Suspend all screen updates to the backingstore.
-    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->suspendBackingStoreUpdates();
+    m_backingStore->d->suspendScreenUpdates();
 
     updateViewportSize();
 
@@ -1263,13 +1272,16 @@ bool WebPagePrivate::zoomAboutPoint(double unclampedScale, const FloatPoint& anc
     if (m_pendingOrientation != -1)
         m_client->updateInteractionViews();
 
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->resumeBackingStoreUpdates();
+
     // Clear window to make sure there are no artifacts.
     if (shouldRender) {
         // Resume all screen updates to the backingstore and render+blit visible contents to screen.
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+        m_backingStore->d->resumeScreenUpdates(BackingStore::RenderAndBlit);
     } else {
         // Resume all screen updates to the backingstore but do not blit to the screen because we not rendering.
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+        m_backingStore->d->resumeScreenUpdates(BackingStore::None);
     }
 
     return true;
@@ -1660,12 +1672,24 @@ void WebPagePrivate::zoomToInitialScaleOnLoad()
 double WebPagePrivate::zoomToFitScale() const
 {
     int contentWidth = contentsSize().width();
-    int contentHeight = contentsSize().height();
+
+    // For image document, zoom to fit the screen based on the actual image width
+    // instead of the contents width within a maximum scale .
+    Document* doc = m_page->mainFrame()->document();
+    bool isImageDocument = doc && doc->isImageDocument();
+    if (isImageDocument)
+        contentWidth = static_cast<ImageDocument*>(doc)->imageSize().width();
+
     double zoomToFitScale = contentWidth > 0.0 ? static_cast<double>(m_actualVisibleWidth) / contentWidth : 1.0;
+    int contentHeight = contentsSize().height();
     if (contentHeight * zoomToFitScale < static_cast<double>(m_defaultLayoutSize.height()))
         zoomToFitScale = contentHeight > 0 ? static_cast<double>(m_defaultLayoutSize.height()) / contentHeight : 1.0;
+    zoomToFitScale = std::max(zoomToFitScale, minimumZoomToFitScale);
+
+    if (!isImageDocument)
+        return zoomToFitScale;
 
-    return std::max(zoomToFitScale, minimumZoomToFitScale);
+    return std::min(zoomToFitScale, maximumImageDocumentZoomToFitScale);
 }
 
 double WebPagePrivate::initialScale() const
@@ -2234,11 +2258,6 @@ Platform::WebContext WebPagePrivate::webContext(TargetDetectionStrategy strategy
         return context;
     }
 
-    // Unpress the mouse button if we're actually getting context.
-    EventHandler* eventHandler = focusedOrMainFrame()->eventHandler();
-    if (eventHandler->mousePressed())
-        eventHandler->setMousePressed(false);
-
     requestLayoutIfNeeded();
 
     bool nodeAllowSelectionOverride = false;
@@ -2328,6 +2347,10 @@ Platform::WebContext WebPagePrivate::webContext(TargetDetectionStrategy strategy
             String elementText(DOMSupport::inputElementText(element));
             if (!elementText.stripWhiteSpace().isEmpty())
                 context.setText(elementText);
+            else if (!node->focused() && m_touchEventHandler->lastFatFingersResult().isValid() && strategy == RectBased) {
+                // If an input field is empty and not focused send a mouse click so that it gets a cursor and we can paste into it.
+                m_touchEventHandler->sendClickAtFatFingersPoint();
+            }
         }
     }
 
@@ -2624,17 +2647,19 @@ PassRefPtr<Node> WebPagePrivate::contextNode(TargetDetectionStrategy strategy)
     if (isTouching && lastFatFingersResult.isTextInput())
         return lastFatFingersResult.node(FatFingersResult::ShadowContentNotAllowed);
 
+    if (strategy == RectBased) {
+        FatFingersResult result = FatFingers(this, lastFatFingersResult.adjustedPosition(), FatFingers::Text).findBestPoint();
+        return result.node(FatFingersResult::ShadowContentNotAllowed);
+    }
+    if (strategy == FocusBased)
+        return m_inputHandler->currentFocusElement();
+
     IntPoint contentPos;
     if (isTouching)
         contentPos = lastFatFingersResult.adjustedPosition();
     else
         contentPos = mapFromViewportToContents(m_lastMouseEvent.position());
 
-    if (strategy == RectBased) {
-        FatFingersResult result = FatFingers(this, lastFatFingersResult.adjustedPosition(), FatFingers::Text).findBestPoint();
-        return result.node(FatFingersResult::ShadowContentNotAllowed);
-    }
-
     HitTestResult result = eventHandler->hitTestResultAtPoint(contentPos, false /*allowShadowContent*/);
     return result.innerNode();
 }
@@ -2701,12 +2726,12 @@ double WebPagePrivate::maxBlockZoomScale() const
     return std::min(maximumBlockZoomScale, maximumScale());
 }
 
-Node* WebPagePrivate::nodeForZoomUnderPoint(const IntPoint& point)
+Node* WebPagePrivate::nodeForZoomUnderPoint(const IntPoint& documentPoint)
 {
     if (!m_mainFrame)
         return 0;
 
-    HitTestResult result = m_mainFrame->eventHandler()->hitTestResultAtPoint(mapFromTransformed(point), false);
+    HitTestResult result = m_mainFrame->eventHandler()->hitTestResultAtPoint(documentPoint, false);
 
     Node* node = result.innerNonSharedNode();
 
@@ -2932,7 +2957,9 @@ void WebPagePrivate::zoomBlock()
     zoom.scale(m_blockZoomFinalScale);
     *m_transformationMatrix = zoom;
     m_client->resetBitmapZoomScale(m_blockZoomFinalScale);
-    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->suspendBackingStoreUpdates();
+    m_backingStore->d->suspendScreenUpdates();
     updateViewportSize();
 
 #if ENABLE(VIEWPORT_REFLOW)
@@ -2989,7 +3016,9 @@ void WebPagePrivate::zoomBlock()
 
     notifyTransformChanged();
     m_client->scaleChanged();
-    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->resumeBackingStoreUpdates();
+    m_backingStore->d->resumeScreenUpdates(BackingStore::RenderAndBlit);
 }
 
 void WebPage::blockZoomAnimationFinished()
@@ -3026,7 +3055,9 @@ void WebPage::destroy()
     disableWebInspector();
 
     // WebPage::destroyWebPageCompositor()
-    d->m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    d->m_backingStore->d->suspendBackingStoreUpdates();
+    d->m_backingStore->d->suspendScreenUpdates();
 
     // Close the backforward list and release the cached pages.
     d->m_page->backForward()->close();
@@ -3525,12 +3556,6 @@ void WebPagePrivate::setScreenOrientation(int orientation)
 void WebPage::setScreenOrientation(int orientation)
 {
     d->m_pendingOrientation = orientation;
-    d->m_hasPendingSurfaceSizeChange = true;
-}
-
-void WebPage::setHasPendingSurfaceSizeChange()
-{
-    d->m_hasPendingSurfaceSizeChange = true;
 }
 
 void WebPage::applyPendingOrientationIfNeeded()
@@ -3539,29 +3564,16 @@ void WebPage::applyPendingOrientationIfNeeded()
         d->setScreenOrientation(d->m_pendingOrientation);
 }
 
-void WebPagePrivate::resizeSurfaceIfNeeded()
-{
-    // This call will cause the client to reallocate the window buffer to new size,
-    // which needs to be serialized with usage of the window buffer. Accomplish
-    // this by sending a sync message to the compositing thread. All other usage of
-    // the window buffer happens on the compositing thread.
-    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
-        Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
-            Platform::createMethodCallMessage(&WebPagePrivate::resizeSurfaceIfNeeded, this));
-        return;
-    }
-
-    m_client->resizeSurfaceIfNeeded();
-}
-
 void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize, bool ensureFocusElementVisible)
 {
-    if (m_pendingOrientation == -1 && !m_hasPendingSurfaceSizeChange && transformedActualVisibleSize == this->transformedActualVisibleSize())
+    if (m_pendingOrientation == -1 && transformedActualVisibleSize == this->transformedActualVisibleSize())
         return;
 
     // Suspend all screen updates to the backingstore to make sure no-one tries to blit
     // while the window surface and the BackingStore are out of sync.
-    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->suspendBackingStoreUpdates();
+    m_backingStore->d->suspendScreenUpdates();
 
     // The screen rotation is a major state transition that in this case is not properly
     // communicated to the backing store, since it does early return in most methods when
@@ -3571,11 +3583,6 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
 
     bool hasPendingOrientation = m_pendingOrientation != -1;
 
-    if (m_hasPendingSurfaceSizeChange) {
-        resizeSurfaceIfNeeded();
-        m_hasPendingSurfaceSizeChange = false;
-    }
-
     // The window buffers might have been recreated, cleared, moved, etc., so:
     m_backingStore->d->windowFrontBufferState()->clearBlittedRegion();
     m_backingStore->d->windowBackBufferState()->clearBlittedRegion();
@@ -3680,7 +3687,9 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
 
     // Need to resume so that the backingstore will start recording the invalidated
     // rects from below.
-    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->resumeBackingStoreUpdates();
+    m_backingStore->d->resumeScreenUpdates(BackingStore::None);
 
     // We might need to layout here to get a correct contentsSize so that zoomToFit
     // is calculated correctly.
@@ -3753,7 +3762,9 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
     } else {
 
         // Suspend all screen updates to the backingstore.
-        m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_backingStore->d->suspendBackingStoreUpdates();
+        m_backingStore->d->suspendScreenUpdates();
 
         // If the zoom failed, then we should still preserve the special case of scroll position.
         IntPoint scrollPosition = this->scrollPosition();
@@ -3781,7 +3792,9 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         }
 
         // If we need layout then render and blit, otherwise just blit as our viewport has changed.
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(needsLayout ? BackingStore::RenderAndBlit : BackingStore::Blit);
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_backingStore->d->resumeBackingStoreUpdates();
+        m_backingStore->d->resumeScreenUpdates(needsLayout ? BackingStore::RenderAndBlit : BackingStore::Blit);
     }
 }
 
@@ -3993,11 +4006,6 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
     if (d->m_needTouchEvents && !event.m_type != Platform::TouchEvent::TouchInjected)
         handled = d->m_mainFrame->eventHandler()->handleTouchEvent(PlatformTouchEvent(&tEvent));
 
-    // Unpress mouse if touch end is consumed by a JavaScript touch handler, otherwise the mouse state will remain pressed
-    // which could either mess up the internal mouse state or start text selection on the next mouse move/down.
-    if (tEvent.m_type == Platform::TouchEvent::TouchEnd && handled && d->m_mainFrame->eventHandler()->mousePressed())
-        d->m_touchEventHandler->touchEventCancel();
-
     if (d->m_preventDefaultOnTouchStart) {
         if (tEvent.m_type == Platform::TouchEvent::TouchEnd || tEvent.m_type == Platform::TouchEvent::TouchCancel)
             d->m_preventDefaultOnTouchStart = false;
@@ -4011,7 +4019,8 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
     }
 
     if (event.isTouchHold())
-        d->m_touchEventHandler->touchHoldEvent();
+        d->m_touchEventHandler->doFatFingers(tEvent.m_points[0]);
+
 #endif
 
     return false;
@@ -4094,14 +4103,14 @@ bool WebPagePrivate::dispatchTouchEventToFullScreenPlugin(PluginView* plugin, co
     return handled;
 }
 
-bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point, bool useFatFingers)
+void WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point)
 {
     if (d->m_page->defersLoading())
-        return false;
+        return;
 
     PluginView* pluginView = d->m_fullScreenPluginView.get();
     if (pluginView)
-        return d->dispatchTouchPointAsMouseEventToFullScreenPlugin(pluginView, point);
+        d->dispatchTouchPointAsMouseEventToFullScreenPlugin(pluginView, point);
 
     d->m_lastUserEventTimestamp = currentTime();
 
@@ -4109,7 +4118,12 @@ bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point, bool use
     tPoint.m_pos = d->mapFromTransformed(tPoint.m_pos);
     tPoint.m_screenPos = tPoint.m_screenPos;
 
-    return d->m_touchEventHandler->handleTouchPoint(tPoint, useFatFingers);
+    d->m_touchEventHandler->handleTouchPoint(tPoint);
+}
+
+void WebPage::playSoundIfAnchorIsTarget() const
+{
+    d->m_touchEventHandler->playSoundIfAnchorIsTarget();
 }
 
 bool WebPagePrivate::dispatchTouchPointAsMouseEventToFullScreenPlugin(PluginView* pluginView, const Platform::TouchPoint& point)
@@ -4146,7 +4160,6 @@ void WebPage::touchEventCancel()
     d->m_pluginMayOpenNewTab = false;
     if (d->m_page->defersLoading())
         return;
-    d->m_touchEventHandler->touchEventCancel();
 }
 
 Frame* WebPagePrivate::focusedOrMainFrame() const
@@ -5136,12 +5149,16 @@ void WebPage::enableWebInspector()
 
     d->m_page->inspectorController()->connectFrontend(d->m_inspectorClient);
     d->m_page->settings()->setDeveloperExtrasEnabled(true);
+    d->setPreventsScreenDimming(true);
 }
 
 void WebPage::disableWebInspector()
 {
-    d->m_page->inspectorController()->disconnectFrontend();
-    d->m_page->settings()->setDeveloperExtrasEnabled(false);
+    if (isWebInspectorEnabled()) {
+        d->m_page->inspectorController()->disconnectFrontend();
+        d->m_page->settings()->setDeveloperExtrasEnabled(false);
+        d->setPreventsScreenDimming(false);
+    }
 }
 
 bool WebPage::isWebInspectorEnabled()
@@ -5261,14 +5278,14 @@ void WebPagePrivate::setCompositor(PassRefPtr<WebPageCompositorPrivate> composit
     ASSERT(webKitThreadMessageClient()->isCurrentThread());
 
     if (m_compositor || m_client->window())
-        m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+        m_backingStore->d->suspendScreenUpdates();
 
     // The m_compositor member has to be modified during a sync call for thread
     // safe access to m_compositor and its refcount.
     userInterfaceThreadMessageClient()->dispatchSyncMessage(createMethodCallMessage(&WebPagePrivate::setCompositorHelper, this, compositor));
 
     if (m_compositor || m_client->window()) // the new compositor, if one was set
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+        m_backingStore->d->resumeScreenUpdates(BackingStore::RenderAndBlit);
 }
 
 void WebPagePrivate::setCompositorHelper(PassRefPtr<WebPageCompositorPrivate> compositor)
@@ -5714,7 +5731,9 @@ void WebPagePrivate::exitFullScreenForElement(Element* element)
         // The Browser chrome has its own fullscreen video widget.
         exitFullscreenForNode(element);
     } else {
-        m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_backingStore->d->suspendBackingStoreUpdates();
+        m_backingStore->d->suspendScreenUpdates();
 
         // When leaving fullscreen mode, we need to restore the 'x' scroll position
         // before fullscreen.
@@ -5735,7 +5754,9 @@ void WebPagePrivate::exitFullScreenForElement(Element* element)
         }
 
         notifyTransformChanged();
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_backingStore->d->resumeBackingStoreUpdates();
+        m_backingStore->d->resumeScreenUpdates(BackingStore::RenderAndBlit);
 
         // This is where we would restore the browser's chrome
         // if hidden above.
@@ -5849,6 +5870,11 @@ void WebPagePrivate::didChangeSettings(WebSettings* webSettings)
         Platform::userInterfaceThreadMessageClient()->dispatchMessage(
             createMethodCallMessage(&WebPagePrivate::setCompositorBackgroundColor, this, backgroundColor));
     }
+    if (m_backingStore) {
+        m_backingStore->d->setWebPageBackgroundColor(m_mainFrame && m_mainFrame->view()
+            ? m_mainFrame->view()->documentBackgroundColor()
+            : webSettings->backgroundColor());
+    }
 
     m_page->setDeviceScaleFactor(webSettings->devicePixelRatio());
 }
@@ -6044,7 +6070,9 @@ void WebPagePrivate::setTextZoomFactor(float textZoomFactor)
 void WebPagePrivate::restoreHistoryViewState(Platform::IntSize contentsSize, Platform::IntPoint scrollPosition, double scale, bool shouldReflowBlock)
 {
     if (!m_mainFrame) {
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_backingStore->d->resumeBackingStoreUpdates();
+        m_backingStore->d->resumeScreenUpdates(BackingStore::RenderAndBlit);
         return;
     }
 
@@ -6062,7 +6090,9 @@ void WebPagePrivate::restoreHistoryViewState(Platform::IntSize contentsSize, Pla
     bool didZoom = zoomAboutPoint(scale, m_mainFrame->view()->scrollPosition(), true /* enforceScaleClamping */, true /*forceRendering*/, true /*isRestoringZoomLevel*/);
     // If we're already at that scale, then we should still force rendering
     // since our scroll position changed.
-    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_backingStore->d->resumeBackingStoreUpdates();
+    m_backingStore->d->resumeScreenUpdates(BackingStore::RenderAndBlit);
 
     if (!didZoom) {
         // We need to notify the client of the scroll position and content size change(s) above even if we didn't scale.
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index a8999db37..2fe56ca31 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -82,7 +82,7 @@ enum JavaScriptDataType { JSUndefined = 0, JSNull, JSBoolean, JSNumber, JSString
 
 enum ActivationStateType { ActivationActive, ActivationInactive, ActivationStandby };
 
-enum TargetDetectionStrategy {PointBased, RectBased};
+enum TargetDetectionStrategy {PointBased, RectBased, FocusBased};
 
 class BLACKBERRY_EXPORT WebPage : public Platform::GuardedPointerBase {
 public:
@@ -135,7 +135,6 @@ public:
     bool isVisible() const;
 
     void setScreenOrientation(int);
-    void setHasPendingSurfaceSizeChange();
     void applyPendingOrientationIfNeeded();
 
     Platform::ViewportAccessor* webkitThreadViewportAccessor() const;
@@ -155,7 +154,9 @@ public:
 
     // For conversion to mouse events.
     void touchEventCancel();
-    bool touchPointAsMouseEvent(const Platform::TouchPoint&, bool useFatFingers = true);
+    void touchPointAsMouseEvent(const Platform::TouchPoint&);
+
+    void playSoundIfAnchorIsTarget() const;
 
     // Returns true if the key stroke was handled by WebKit.
     bool keyEvent(const Platform::KeyboardEvent&);
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index 83574c651..69035ba1f 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -141,7 +141,6 @@ public:
     virtual Platform::Graphics::Window* window() const = 0;
 
     virtual void notifyPixelContentRendered(const Platform::IntRect&) = 0;
-    virtual void resizeSurfaceIfNeeded() = 0;
 
     virtual void inputFocusGained(int64_t inputStyle, Platform::VirtualKeyboardType, Platform::VirtualKeyboardEnterKeyType) = 0;
     virtual void inputFocusLost() = 0;
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 4331b3ed9..9c0a26dcb 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -367,7 +367,6 @@ public:
     // Scroll and/or zoom so that the WebPage fits the new actual
     // visible size.
     void setViewportSize(const WebCore::IntSize& transformedActualVisibleSize, bool ensureFocusElementVisible);
-    void resizeSurfaceIfNeeded(); // Helper method for setViewportSize().
 
     void scheduleDeferrableTimer(WebCore::Timer<WebPagePrivate>*, double timeOut);
     void unscheduleAllDeferrableTimers();
@@ -568,7 +567,6 @@ public:
     bool m_suspendRootLayerCommit;
 #endif
 
-    bool m_hasPendingSurfaceSizeChange;
     int m_pendingOrientation;
 
     RefPtr<WebCore::Node> m_fullscreenVideoNode;
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 2ab4cf3b0..ebd5d4673 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,619 @@
+2012-11-21  Genevieve Mak  <gmak@rim.com>
+
+        [BlackBerry] Drop Synchronous Mouse Events
+        https://bugs.webkit.org/show_bug.cgi?id=102980
+
+        Reviewed by Rob Buis.
+
+        Reviewed Internally by George Staikos, Mike Lattanzio and Mike Fenton.
+        Get rid of unneeded methods and simplify code.
+        Send click if getting context over an empty text field
+        so that it will be focused and have a caret.
+        PR #242781
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::webContext):
+        (BlackBerry::WebKit::WebPage::touchEvent):
+        (BlackBerry::WebKit::WebPage::touchPointAsMouseEvent):
+        (BlackBerry::WebKit::WebPage::touchEventCancel):
+        * Api/WebPage.h:
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::TouchEventHandler):
+        (BlackBerry::WebKit::TouchEventHandler::doFatFingers):
+        (BlackBerry::WebKit::TouchEventHandler::sendClickAtFatFingersPoint):
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        (BlackBerry::WebKit::TouchEventHandler::handleFatFingerPressed):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-11-21  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Prevent screen from dimming on device when inspector front-end is connected
+        https://bugs.webkit.org/show_bug.cgi?id=102978
+
+        Reviewed by Rob Buis.
+
+        Internal PR 200848
+        We prevent screen from going dim when the front-end is connected and return to normal when
+        the front-end disconnects.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::enableWebInspector):
+        (BlackBerry::WebKit::WebPage::disableWebInspector):
+
+2012-11-21  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Don't add empty rects to the tap highlight region.
+        https://bugs.webkit.org/show_bug.cgi?id=102966
+
+        Reviewed by George Staikos.
+
+        Internal PR 246960
+        Tap highlight is way too large sometimes.
+        When we add an empty rect it inflates by 2 and causes the tap region to extend to the origin.
+
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::drawTapHighlight):
+
+2012-11-21  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Switch to point instead of VisiblePosition comparison for input bounds check
+        https://bugs.webkit.org/show_bug.cgi?id=102962
+
+        Reviewed by Rob Buis.
+
+        PR 247270.
+
+        Switch from using VisiblePosition to determine if we are in a node
+        to a comparison of the field bounds.  This fixes the case where
+        there is no node before the target node to match.
+
+        Reviewed Internally by Gen Mak.
+
+        * WebKitSupport/DOMSupport.cpp:
+        * WebKitSupport/DOMSupport.h:
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::setCaretPosition):
+
+2012-11-20  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Animated gifs pause on scroll or zoom and sometimes don't resume after scroll or zoom completes
+        https://bugs.webkit.org/show_bug.cgi?id=102838
+
+        Reviewed by Rob Buis.
+
+        Internally reviewed by Adam Treat.
+        Internal PR244646
+        When entering scrolling & zooming, we suspend regular render jobs
+        in order to pause animations. When finishing scrolling or zooming,
+        dispatch a render job in order to resume those animations.
+
+        If an animation requests a repaint while the backing store is suspended,
+        add the regular render job to the render queue so that it can be
+        processed later.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::repaint):
+        (BlackBerry::WebKit::BackingStorePrivate::setScrollingOrZooming):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::load):
+        (BlackBerry::WebKit::WebPagePrivate::loadString):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::load):
+        (BlackBerry::WebKit::WebPagePrivate::loadString):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-19  Genevieve Mak  <gmak@rim.com>
+
+        [BlackBerry] Block Zoom picks wrong block
+        https://bugs.webkit.org/show_bug.cgi?id=102728
+
+        Reviewed by Rob Buis.
+
+        Reviewed Internally by Jakob Petsovits
+        Remove transform missed in previous commit for
+        https://bugs.webkit.org/show_bug.cgi?id=101608
+        PR #247198
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::nodeForZoomUnderPoint):
+
+2012-11-19  Liam Quinn  <lquinn@rim.com>
+
+        [BlackBerry] Remove RTSP handling from FrameLoaderClientBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=102692
+
+        Reviewed by Rob Buis.
+
+        Reviewed internally by George Staikos. Internal PR 242750.
+
+        Our RTSP handling in FrameLoaderClientBlackBerry causes HTTP redirects to "rtsp:" URIs to fail. Remove handling of RTSP from this class; it will be moved to the network layer alongside other URI schemes like "data:" and "file:".
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::createDocumentLoader):
+
+2012-11-16  Adam Treat  <atreat@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=102540
+        [BlackBerry] Checkerboard flicker when pinch zooming out on google.com/nwshp
+
+        Reviewed by George Staikos.
+        PR 245827
+
+        Disable updates to the backingstore tile matrix when backingstore updates
+        are disabled.  This prevents changes to the tile matrix when we are in the
+        middle of a pinch zoom which can cause checkebroard flickering.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::resumeBackingStoreUpdates):
+        (BlackBerry::WebKit::BackingStorePrivate::setBackingStoreRect):
+        (BlackBerry::WebKit::BackingStorePrivate::render):
+        (BlackBerry::WebKit::BackingStorePrivate::renderVisibleContents):
+        (BlackBerry::WebKit::BackingStorePrivate::renderBackingStore):
+        (BlackBerry::WebKit::BackingStorePrivate::updateTileMatrixIfNeeded):
+        (BlackBerry::WebKit::BackingStorePrivate::contentsSizeChanged):
+        (BlackBerry::WebKit::BackingStorePrivate::orientationChanged):
+        * Api/BackingStore_p.h:
+        (BlackBerry::WebKit::BackingStorePrivate::setTileMatrixNeedsUpdate):
+        (BackingStorePrivate):
+
+2012-11-16  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] FCC doesn't work in textarea
+        https://bugs.webkit.org/show_bug.cgi?id=102088
+
+        Reviewed by Antonio Gomes.
+
+        Remove the cancel button specializations, it was needed at some point but hitting it
+        works just as well without it. This unbreaks FCC in textarea's.
+
+        * WebKitSupport/FatFingers.cpp:
+        (BlackBerry::WebKit::FatFingers::isElementClickable):
+
+2012-11-16  Adam Treat  <atreat@rim.com>
+
+        [BlackBerry] Fix regression causing checkerboard flicker after app wake-up
+        https://bugs.webkit.org/show_bug.cgi?id=102526
+
+        Reviewed by George Staikos.
+        PR 245027
+
+        The webkit patch for 219976 introduced an undesirable behavior change
+        resulting in a regression where there was checkerboard flickering on
+        resuming from an inactive application state.  This patch restores the
+        previous behavior and fixes the regression.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStore::createBackingStoreMemory):
+        (BlackBerry::WebKit::BackingStore::releaseBackingStoreMemory):
+
+2012-11-16  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Use proper keycode value for space instead of hardcoded value.
+        https://bugs.webkit.org/show_bug.cgi?id=102518
+
+        Reviewed by Rob Buis.
+
+        Remove hard coded value for space.
+
+        Reviewed Internally by Gen Mak.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::setText):
+
+2012-11-15  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Animate changes to viewport due to input focus changes.
+        https://bugs.webkit.org/show_bug.cgi?id=102410
+
+        Reviewed by Rob Buis.
+
+        When changing scroll position or zoom level for input field focus,
+        animate the change.
+        Internal PR 231937
+
+        Internally reviewed by Mike Fenton.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+
+2012-11-15  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Don't restore zoom and scroll when leaving an input field.
+        https://bugs.webkit.org/show_bug.cgi?id=102376
+
+        Reviewed by Yong Li.
+
+        Restoring the zoom causes undesirable behavior when switching between fields.
+
+        Reviewed Internally by Andrew Lo.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::InputHandler):
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+
+2012-11-15  Jakob Petsovits  <jpetsovits@rim.com>
+
+        [BlackBerry] Fix suspend/resume assertion in setCompositor().
+        https://bugs.webkit.org/show_bug.cgi?id=102397
+        RIM PR 244701
+
+        Reviewed by Adam Treat.
+
+        If a compositor is used but no surface pool is ever
+        allocated (which is a perfectly valid use case), initial
+        suspension of the backingstore is skipped because of an
+        early return. This will cause an assertion to be triggered
+        and a bug. Fix this by suspending it before the return.
+
+        With Adam Treat's recent change to split suspension of
+        screen and backingstore into two different functions,
+        this can now be reduced to a mere screen (blitting)
+        suspension. That was the original intention of this code.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::createSurfaces):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setCompositor):
+
+2012-11-15  Jakob Petsovits  <jpetsovits@rim.com>
+
+        [BlackBerry] Leave surface resizing to the client.
+        https://bugs.webkit.org/show_bug.cgi?id=102280
+        RIM PR 235034
+        RIM PR 160619
+
+        Reviewed by Adam Treat.
+
+        Now that we always blit on the user interface thread and
+        use the client's userInterfaceViewportAccessor() to determine
+        the destination rectangle for blitting, changing the viewport
+        size does not affect the window or target surface directly.
+        The only way that blitted output is affected is through
+        layout, scroll position or scale changes. None of these
+        require us to synchronize with the UI thread to resize its
+        target surface.
+
+        This commit simplifies setViewportSize() and removes a
+        blocking message dispatch by simply offloading all surface
+        resizing responsibilities to the client. This is safer,
+        cleaner and easier.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPage::setScreenOrientation):
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+        * Api/WebPage.h:
+        * Api/WebPageClient.h:
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-11-14  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Do not clear the ProcessingChangeGuard state on DeleteBackward
+        https://bugs.webkit.org/show_bug.cgi?id=102284
+
+        Reviewed by Rob Buis.
+
+        PR237497
+        When holding backspace, clearing the state forces a keyboard
+        update which resets the state of the keyboard. Handling this
+        specific corner case separate from all other editor commands.
+
+        Internally reviewed by Mike Fenton.
+
+        * WebCoreSupport/EditorClientBlackBerry.cpp:
+        (WebCore::EditorClientBlackBerry::handleKeyboardEvent):
+
+2012-11-14  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Improve debug functionality in FatFingers
+        https://bugs.webkit.org/show_bug.cgi?id=102263
+
+        Reviewed by Antonio Gomes.
+
+        - use logAlways to log even in release.
+        - dump shadow tree info if available.
+
+        * WebKitSupport/FatFingers.cpp:
+        (BlackBerry::WebKit::FatFingers::isElementClickable):
+        (BlackBerry::WebKit::FatFingers::checkFingerIntersection):
+        (BlackBerry::WebKit::FatFingers::findIntersectingRegions):
+        (BlackBerry::WebKit::FatFingers::checkForText):
+
+2012-11-14  Adam Treat  <atreat@rim.com>
+
+        [BlackBerry] Break suspend/resume of the backingstore and screen into separate methods
+        https://bugs.webkit.org/show_bug.cgi?id=102126
+
+        Reviewed by George Staikos.
+        PR 219976
+
+        Modify the suspend/resume methods so that they can be called from the UI thread
+        itself and split up the suspend/resume methods so that we can suspend/resume
+        the screen or backingstore separately.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::suspendBackingStoreUpdates):
+        (WebKit):
+        (BlackBerry::WebKit::BackingStorePrivate::suspendScreenUpdates):
+        (BlackBerry::WebKit::BackingStorePrivate::resumeBackingStoreUpdates):
+        (BlackBerry::WebKit::BackingStorePrivate::resumeScreenUpdates):
+        (BlackBerry::WebKit::BackingStorePrivate::blitVisibleContents):
+        (BlackBerry::WebKit::BackingStorePrivate::createSurfaces):
+        (BlackBerry::WebKit::BackingStore::suspendBackingStoreUpdates):
+        (BlackBerry::WebKit::BackingStore::resumeBackingStoreUpdates):
+        (BlackBerry::WebKit::BackingStore::suspendScreenUpdates):
+        (BlackBerry::WebKit::BackingStore::resumeScreenUpdates):
+        (BlackBerry::WebKit::BackingStore::createBackingStoreMemory):
+        (BlackBerry::WebKit::BackingStore::releaseBackingStoreMemory):
+        * Api/BackingStore.h:
+        * Api/BackingStore_p.h:
+        (BackingStorePrivate):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setLoadState):
+        (BlackBerry::WebKit::WebPagePrivate::zoomAboutPoint):
+        (BlackBerry::WebKit::WebPagePrivate::zoomBlock):
+        (BlackBerry::WebKit::WebPage::destroy):
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+        (BlackBerry::WebKit::WebPagePrivate::setCompositor):
+        (BlackBerry::WebKit::WebPagePrivate::exitFullScreenForElement):
+        (BlackBerry::WebKit::WebPagePrivate::restoreHistoryViewState):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::transitionToCommittedForNewPage):
+        (WebCore::FrameLoaderClientBlackBerry::restoreViewState):
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::setBatchEditingActive):
+
+2012-11-14  Andy Chen  <andchen@rim.com>
+
+        [BlackBerry] Add FocusBased context node detection strategy
+        https://bugs.webkit.org/show_bug.cgi?id=102238
+
+        Reviewed by Rob Buis.
+
+        If last fat finger result is invalid, we need to return current
+        focus element as context node, because when user tap on selection
+        overlay, there is not touch event sent to webkit.
+        PR 241382
+
+        Internally reviewed by Genevieve Mak and Mike Fenton.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::contextNode):
+        * Api/WebPage.h:
+        * WebKitSupport/InputHandler.h:
+        (BlackBerry::WebKit::InputHandler::currentFocusElement):
+
+2012-11-14  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Use mispelled-marker offsets relative to the element
+        https://bugs.webkit.org/show_bug.cgi?id=102236
+
+        Reviewed by Rob Buis.
+
+        DocumentMarker offsets are calculated relative to a node. This is causing
+        problems for contenteditable which can have numerous nodes. Creating a Range around a word
+        and calculating its location and length gives us the correct override in this case for starting
+        and ending points to pass to IMF.
+
+        Internally reviewed by Mike Fenton.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::requestSpellingCheckingOptions):
+
+2012-11-13  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Fully restore both zoom and scroll when leaving an input field.
+        https://bugs.webkit.org/show_bug.cgi?id=102094
+
+        Reviewed by Rob Buis.
+
+        PR 234187.
+
+        Cache both the zoom and scroll position prior to adjusting
+        for input focus so that state can be reset fully.
+
+        Reviewed Internally by Gen Mak.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+
+2012-11-12  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Ensure we only receive one KeyUp per key event
+        https://bugs.webkit.org/show_bug.cgi?id=101967
+
+        Reviewed by Rob Buis.
+
+        We are creating synthetic KeyUps too often, and get into trouble since IMF will send up a KeyUp on all key events.
+        Furthermore, these KeyUps can arrive both when we are composing and not. To bypass this check, we are storing the KeyDown
+        character and comparing against it on KeyUp.
+
+        Internally reviewed by Mike Fenton.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::InputHandler):
+        (BlackBerry::WebKit::InputHandler::handleKeyboardInput):
+        (BlackBerry::WebKit::InputHandler::insertText):
+        (BlackBerry::WebKit::InputHandler::setText):
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+
+2012-11-12  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] When opening an image it does not scale to fit our window
+        https://bugs.webkit.org/show_bug.cgi?id=101778
+
+        Reviewed by Rob Buis.
+        Internally reviewed by Konrad Piascik.
+
+        PR: 230935
+        For image document, the actual image size can be different with the
+        contents size. Zoom the document based on the image width so that
+        images can fit the screen horizontally. Set 2.0 as the maximum zoom to
+        fit scale for image document so that very small images won't get
+        ridiculous large scales during the initial load.
+
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::zoomToFitScale):
+
+2012-11-12  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Use keyevents instead of editor commands for backspace
+        https://bugs.webkit.org/show_bug.cgi?id=101663
+
+        Reviewed by Rob Buis.
+
+        PR229395
+        Sending keyEvents for backspace and switching from KeyChar
+        to KeyDown since we are still receiving an unadultered KeyUp
+        from the input service. This was causing us to get two keyUps
+        for regular keys and no key downs for backspace since it was
+        triggering an editor command and bypassing JS listeners.
+
+        Reviewed internally by Mike Fenton.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::handleKeyboardInput):
+        (BlackBerry::WebKit::relativeRightOffset):
+        (WebKit):
+        (BlackBerry::WebKit::InputHandler::deleteTextRelativeToCursor):
+        (BlackBerry::WebKit::InputHandler::setText):
+
+2012-11-12  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Crash in InRegionScrollerPrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=101399
+
+        Reviewed by Yong Li.
+
+        Fix warning caused by the previous patch for this bug (r133679).
+
+        * WebKitSupport/InRegionScrollableArea.cpp:
+        (BlackBerry::WebKit::InRegionScrollableArea::InRegionScrollableArea):
+
+2012-11-11  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] The QNX extension method should not be enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=101863
+
+        Reviewed by Rob Buis.
+
+        Simply change the default to false.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+
+2012-11-09  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Adding a sound to touch events on anchor elements
+        https://bugs.webkit.org/show_bug.cgi?id=101655
+
+        Reviewed by Antonio Gomes.
+
+        Adding audio feedback to touchevents on html anchor elements.
+
+        The feedback is called directly from client instead of using the
+        mouseup event to avoid the delay between touch start and end caused
+        by the tap sequence recognizer.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::playSoundIfAnchorIsTarget):
+        (WebKit):
+        * Api/WebPage.h:
+        * WebKitSupport/TouchEventHandler.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::TouchEventHandler::playSoundIfAnchorIsTarget):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-11-09  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Remove obsolete tokenizer settings
+        https://bugs.webkit.org/show_bug.cgi?id=101689
+
+        Reviewed by Yong Li.
+
+        These tokenizer settings are obsolete and should not be here.  Remove them.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+
+2012-11-08  Chris Guan  <chris.guan@torchmobile.com.cn>
+
+        [BlackBerry] need to call closePopup at setValueAndClosePopup
+        https://bugs.webkit.org/show_bug.cgi?id=101568
+
+        Reviewed by George Staikos.
+
+        When early return occurs, we need to call closePopup
+        at setValueAndClosePopup function. See the comments
+        in WebCore/page/PagePopupClient.h. If we have not it,
+        Webkit thread is held and browser will be unresponsive 
+        in BlackBerry port.
+        
+        RIM PR 232962
+        Internally reviewed by Charles Wei.
+
+        * WebCoreSupport/SelectPopupClient.cpp:
+        (WebCore::SelectPopupClient::setValueAndClosePopup):
+
+2012-11-08  Jakob Petsovits  <jpetsovits@rim.com>
+
+        [BlackBerry] Replace checkerboard with page background color.
+        https://bugs.webkit.org/show_bug.cgi?id=101652
+        RIM PR 188235
+
+        Reviewed by George Staikos.
+
+        In order to do this, we introduce a new member variable for
+        BackingStore because when blitting, we can't access the
+        page background color in a threadsafe way.
+
+        Solid background color fill is still only used for public builds.
+        Developers and beta testers should still see checkerboard and
+        do something about it.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::fillWindow):
+        (BlackBerry::WebKit::BackingStorePrivate::webPageBackgroundColorUserInterfaceThread):
+        (WebKit):
+        (BlackBerry::WebKit::BackingStorePrivate::setWebPageBackgroundColor):
+        * Api/BackingStore_p.h:
+        (BackingStorePrivate):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setLoadState):
+        (BlackBerry::WebKit::WebPagePrivate::didChangeSettings):
+
 2012-11-08  Tiancheng Jiang  <tijiang@rim.com>
 
         [BlackBerry] Update BB10 date input form.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
index 95d02f7d5..9db591956 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
@@ -466,7 +466,9 @@ void EditorClientBlackBerry::handleKeyboardEvent(KeyboardEvent* event)
 
     if (!commandName.isEmpty()) {
         // Hot key handling. Cancel processing mode.
-        m_webPagePrivate->m_inputHandler->setProcessingChange(false);
+        if (commandName != "DeleteBackward")
+            m_webPagePrivate->m_inputHandler->setProcessingChange(false);
+
         if (frame->editor()->command(commandName).execute())
             event->setDefaultHandled();
         return;
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index 9669c938b..0e0619b4b 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -74,7 +74,6 @@
 
 #include <BlackBerryPlatformExecutableMessage.h>
 #include <BlackBerryPlatformLog.h>
-#include <BlackBerryPlatformMediaDocument.h>
 #include <BlackBerryPlatformMessageClient.h>
 #include <BlackBerryPlatformScreen.h>
 #include <JavaScriptCore/APICast.h>
@@ -404,8 +403,7 @@ PassRefPtr<DocumentLoader> FrameLoaderClientBlackBerry::createDocumentLoader(con
             // The first 6 letters is "about:"
             String aboutWhat = request.url().string().substring(6);
             source = aboutData(aboutWhat);
-        } else if (request.url().protocolIs("rtsp"))
-            source = BlackBerry::Platform::mediaDocument(request.url().string());
+        }
 
         if (!source.isEmpty()) {
             // Always ignore existing substitute data if any.
@@ -435,8 +433,11 @@ void FrameLoaderClientBlackBerry::transitionToCommittedForNewPage()
     // in the backing store from another thread (see BackingStorePrivate::blitVisibleContents method),
     // so we suspend and resume screen update to make sure we do not get a invalid FrameView
     // state.
-    if (isMainFrame() && m_webPagePrivate->backingStoreClient())
-        m_webPagePrivate->backingStoreClient()->backingStore()->d->suspendScreenAndBackingStoreUpdates();
+    if (isMainFrame() && m_webPagePrivate->backingStoreClient()) {
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_webPagePrivate->backingStoreClient()->backingStore()->d->suspendBackingStoreUpdates();
+        m_webPagePrivate->backingStoreClient()->backingStore()->d->suspendScreenUpdates();
+    }
 
     // We are navigating away from this document, so clean up any footprint we might have.
     if (m_frame->document())
@@ -456,8 +457,11 @@ void FrameLoaderClientBlackBerry::transitionToCommittedForNewPage()
                         ScrollbarAlwaysOff,                    /* ver mode */
                         true);                                 /* lock the mode */
 
-    if (isMainFrame() && m_webPagePrivate->backingStoreClient())
-        m_webPagePrivate->backingStoreClient()->backingStore()->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+    if (isMainFrame() && m_webPagePrivate->backingStoreClient()) {
+        // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+        m_webPagePrivate->backingStoreClient()->backingStore()->d->resumeBackingStoreUpdates();
+        m_webPagePrivate->backingStoreClient()->backingStore()->d->resumeScreenUpdates(BackingStore::None);
+    }
 
     m_frame->view()->updateCanHaveScrollbars();
 
@@ -1122,7 +1126,9 @@ void FrameLoaderClientBlackBerry::restoreViewState()
 
     // Don't flash checkerboard before WebPagePrivate::restoreHistoryViewState() finished.
     // This call will be balanced by BackingStorePrivate::resumeScreenAndBackingStoreUpdates() in WebPagePrivate::restoreHistoryViewState().
-    m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    m_webPagePrivate->m_backingStore->d->suspendBackingStoreUpdates();
+    m_webPagePrivate->m_backingStore->d->suspendScreenUpdates();
 
     // It is not safe to render the page at this point. So we post a message instead. Messages have higher priority than timers.
     BlackBerry::Platform::webKitThreadMessageClient()->dispatchMessage(BlackBerry::Platform::createMethodCallMessage(
diff --git a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
index b37b5e668..b1af6fa63 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
@@ -173,8 +173,11 @@ void SelectPopupClient::setValueAndClosePopup(int, const String& stringValue)
 
         const Vector<HTMLElement*>& items = m_element->listItems();
 
-        if (items.size() != static_cast<unsigned int>(m_size))
+        // If element changed after select UI showed, do nothing but closePopup().
+        if (items.size() != static_cast<unsigned>(m_size)) {
+            closePopup();
             return;
+        }
 
         HTMLOptionElement* option;
         for (unsigned i = 0; i < m_size; i++) {
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
index 1d81a5eaa..752c573e8 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
@@ -314,34 +314,6 @@ VisibleSelection visibleSelectionForRangeInputElement(Element* element, int star
     return VisibleSelection(visibleStart, visibleEnd);
 }
 
-Node* DOMContainerNodeForPosition(const Position& position)
-{
-    Node* nodeAtPos = position.containerNode();
-    if (nodeAtPos && nodeAtPos->isInShadowTree())
-        nodeAtPos = nodeAtPos->shadowAncestorNode();
-
-    return nodeAtPos;
-}
-
-bool isPositionInNode(Node* node, const Position& position)
-{
-    if (!node)
-        return false;
-
-    Node* domNodeAtPos = DOMContainerNodeForPosition(position);
-    if (!domNodeAtPos)
-        return false;
-
-    int offset = 0;
-    if (domNodeAtPos == position.containerNode())
-        offset = position.computeOffsetInContainerNode();
-
-    RefPtr<Range> rangeForNode = rangeOfContents(node);
-    int ec;
-
-    return rangeForNode->isPointInRange(domNodeAtPos, offset, ec);
-}
-
 static bool matchesReservedStringEmail(const AtomicString& string)
 {
     return string.contains("email", false /* caseSensitive */);
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
index a86e12a35..74175ecd4 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
@@ -76,9 +76,6 @@ void visibleTextQuads(const WebCore::VisibleSelection&, WTF::Vector<WebCore::Flo
 WebCore::VisibleSelection visibleSelectionForRangeInputElement(WebCore::Element*, int start, int end);
 WebCore::VisibleSelection visibleSelectionForInputElement(WebCore::Element*);
 
-WebCore::Node* DOMContainerNodeForPosition(const WebCore::Position&);
-bool isPositionInNode(WebCore::Node*, const WebCore::Position&);
-
 bool elementIdOrNameIndicatesNoAutocomplete(const WebCore::Element*);
 bool elementIdOrNameIndicatesEmail(const WebCore::HTMLInputElement*);
 bool elementIdOrNameIndicatesUrl(const WebCore::HTMLInputElement*);
diff --git a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
index 877dc2009..6494186be 100644
--- a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
@@ -92,8 +92,8 @@ bool FatFingers::isElementClickable(Element* element) const
         ExceptionCode ec = 0;
         return element->webkitMatchesSelector("a[href],*:link,*:visited,*[role=button],button,input,select,label[for],area[href],textarea,embed,object", ec)
             || element->isMediaControlElement()
-            || (element->isContentEditable() && !element->isInShadowTree())
-            || element->shadowPseudoId() == "-webkit-search-cancel-button";
+            || element->isContentEditable();
+
     }
     case MadeClickableByTheWebpage:
 
@@ -278,7 +278,13 @@ bool FatFingers::checkFingerIntersection(const IntRectRegion& region, const IntR
         nodeName = String::format("%s node", toElement(node)->tagName().latin1().data());
     else
         nodeName = "unknown node";
-    BBLOG(LogLevelInfo, "%s has region %s, intersecting at %s (area %d)", nodeName.latin1().data(),
+    if (node->isInShadowTree()) {
+        nodeName = nodeName + "(in shadow tree";
+        if (node->isElementNode() && !toElement(node)->shadowPseudoId().isEmpty())
+            nodeName = nodeName + ", pseudo id " + toElement(node)->shadowPseudoId();
+        nodeName = nodeName + ")";
+    }
+    logAlways(LogLevelInfo, "%s has region %s, intersecting at %s (area %d)", nodeName.latin1().data(),
         regionCopy.toString().c_str(), intersection.toString().c_str(), intersection.area());
 #endif
 
@@ -303,7 +309,7 @@ bool FatFingers::findIntersectingRegions(Document* document, Vector<Intersecting
 #if DEBUG_FAT_FINGERS
     IntRect fingerRect(fingerRectForPoint(frameContentPos));
     IntRect screenFingerRect = m_webPage->mapToTransformed(fingerRect);
-    BBLOG(LogLevelInfo, "fat finger rect now %d, %d, %d, %d", screenFingerRect.x(), screenFingerRect.y(), screenFingerRect.width(), screenFingerRect.height());
+    logAlways(LogLevelInfo, "fat finger rect now %d, %d, %d, %d", screenFingerRect.x(), screenFingerRect.y(), screenFingerRect.width(), screenFingerRect.height());
 
     // only record the first finger rect
     if (document == m_webPage->m_mainFrame->document())
@@ -433,7 +439,7 @@ bool FatFingers::checkForText(Node* curNode, Vector<IntersectingRegion>& interse
             RefPtr<Range> range = Range::create(document, curText, lastOffset, curText, offset);
             if (!range->text().stripWhiteSpace().isEmpty()) {
 #if DEBUG_FAT_FINGERS
-                BBLOG(LogLevelInfo, "Checking word '%s'", range->text().latin1().data());
+                logAlways(LogLevelInfo, "Checking word '%s'", range->text().latin1().data());
 #endif
                 IntRectRegion rangeRegion(DOMSupport::transformedBoundingBoxForRange(*range));
                 foundOne |= checkFingerIntersection(rangeRegion, fingerRegion, curNode, intersectingRegions);
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
index 443db8b8c..43dbde887 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
@@ -52,8 +52,8 @@ InRegionScrollableArea::~InRegionScrollableArea()
 InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLayer* layer)
     : m_webPage(webPage)
     , m_layer(layer)
-    , m_hasWindowVisibleRectCalculated(false)
     , m_document(0)
+    , m_hasWindowVisibleRectCalculated(false)
 {
     ASSERT(webPage);
     ASSERT(layer);
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index a1199ca72..3622e0adb 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -139,8 +139,8 @@ InputHandler::InputHandler(WebPagePrivate* page)
     , m_delayKeyboardVisibilityChange(false)
     , m_request(0)
     , m_processingTransactionId(-1)
-    , m_focusZoomScale(0.0)
     , m_receivedBackspaceKeyDown(false)
+    , m_expectedKeyUpChar(0)
 {
 }
 
@@ -749,6 +749,24 @@ void InputHandler::requestSpellingCheckingOptions(imf_sp_text_t& spellCheckingOp
     const WebCore::IntPoint scrollPosition = m_webPage->mainFrame()->view()->scrollPosition();
     caretRect.move(scrollPosition.x(), scrollPosition.y());
 
+    // Calculate the offset for contentEditable since the marker offsets are relative to the node.
+    // Get caret position. Though the spelling markers might no longer exist, if this method is called we can assume the caret was placed on top of a marker earlier.
+    VisiblePosition caretPosition = m_currentFocusElement->document()->frame()->selection()->selection().visibleStart();
+
+    // Create a range from the start to end of word.
+    RefPtr<Range> rangeSelection = VisibleSelection(startOfWord(caretPosition), endOfWord(caretPosition)).toNormalizedRange();
+    if (!rangeSelection)
+        return;
+
+    unsigned location = 0;
+    unsigned length = 0;
+    TextIterator::getLocationAndLengthFromRange(m_currentFocusElement.get(), rangeSelection.get(), location, length);
+
+    if (location != notFound && length) {
+        spellCheckingOptionRequest.startTextPosition = location;
+        spellCheckingOptionRequest.endTextPosition = location + length;
+    }
+
     InputLog(LogLevelInfo, "InputHandler::requestSpellingCheckingOptions caretRect topLeft=(%d,%d), bottomRight=(%d,%d), startTextPosition=%d, endTextPosition=%d"
                             , caretRect.minXMinYCorner().x(), caretRect.minXMinYCorner().y(), caretRect.maxXMaxYCorner().x(), caretRect.maxXMaxYCorner().y()
                             , spellCheckingOptionRequest.startTextPosition, spellCheckingOptionRequest.endTextPosition);
@@ -1097,11 +1115,6 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
         break;
     }
     case VisibleSelection::NoSelection:
-        if (m_focusZoomScale) {
-            m_webPage->zoomAboutPoint(m_focusZoomScale, m_focusZoomLocation);
-            m_focusZoomScale = 0.0;
-            m_focusZoomLocation = WebCore::IntPoint();
-        }
         return;
     }
 
@@ -1113,18 +1126,17 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
     // The minimum size being defined as 3 mm is a good value based on my observations.
     static const int s_minimumTextHeightInPixels = Graphics::Screen::primaryScreen()->heightInMMToPixels(3);
 
-    if (m_webPage->isUserScalable() && fontHeight && fontHeight * m_webPage->currentScale() < s_minimumTextHeightInPixels && !isRunningDrt()) {
-        if (!m_focusZoomScale) {
-            m_focusZoomScale = m_webPage->currentScale();
-            m_focusZoomLocation = selectionFocusRect.location();
-        }
-        double zoomScaleRequired = static_cast<double>(s_minimumTextHeightInPixels) / fontHeight;
-        m_webPage->zoomAboutPoint(zoomScaleRequired, m_focusZoomLocation);
-        InputLog(LogLevelInfo, "InputHandler::ensureFocusTextElementVisible zooming in to %f at point %d, %d", zoomScaleRequired, m_focusZoomLocation.x(), m_focusZoomLocation.y());
-    } else {
-        m_focusZoomScale = 0.0;
-        m_focusZoomLocation = WebCore::IntPoint();
-    }
+    double zoomScaleRequired;
+    if (m_webPage->isUserScalable() && fontHeight && fontHeight * m_webPage->currentScale() < s_minimumTextHeightInPixels && !isRunningDrt())
+        zoomScaleRequired = static_cast<double>(s_minimumTextHeightInPixels) / fontHeight;
+    else
+        zoomScaleRequired = m_webPage->currentScale(); // Don't scale.
+
+    // The scroll location we should go to given the zoom required, could be adjusted later.
+    WebCore::FloatPoint offset(selectionFocusRect.location().y() - m_webPage->scrollPosition().x(), selectionFocusRect.location().y() - m_webPage->scrollPosition().y());
+    double inverseScale = zoomScaleRequired / m_webPage->currentScale();
+    WebCore::IntPoint destinationScrollLocation = WebCore::IntPoint(max(0, static_cast<int>(roundf(selectionFocusRect.location().x() - offset.x() / inverseScale))),
+                                                                    max(0, static_cast<int>(roundf(selectionFocusRect.location().y() - offset.y() / inverseScale))));
 
     if (elementFrame != mainFrame) { // Element is in a subframe.
         // Remove any scroll offset within the subframe to get the point relative to the main frame.
@@ -1140,7 +1152,9 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
     Position start = elementFrame->selection()->start();
     if (start.anchorNode() && start.anchorNode()->renderer()) {
         if (RenderLayer* layer = start.anchorNode()->renderer()->enclosingLayer()) {
-            WebCore::IntRect actualScreenRect = WebCore::IntRect(mainFrameView->scrollPosition(), m_webPage->actualVisibleSize());
+            // Screen rect after the required zoom.
+            WebCore::IntRect actualScreenRect = WebCore::IntRect(destinationScrollLocation.x(), destinationScrollLocation.y(), m_webPage->actualVisibleSize().width() / inverseScale, m_webPage->actualVisibleSize().height() / inverseScale);
+
             ScrollAlignment horizontalScrollAlignment = ScrollAlignment::alignToEdgeIfNeeded;
             ScrollAlignment verticalScrollAlignment = ScrollAlignment::alignToEdgeIfNeeded;
 
@@ -1187,15 +1201,26 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
             // In order to adjust the scroll position to ensure the focused input field is visible,
             // we allow overscrolling. However this overscroll has to be strictly allowed towards the
             // bottom of the page on the y axis only, where the virtual keyboard pops up from.
-            WebCore::IntPoint scrollLocation = revealRect.location();
-            scrollLocation.clampNegativeToZero();
+            destinationScrollLocation = revealRect.location();
+            destinationScrollLocation.clampNegativeToZero();
             WebCore::IntPoint maximumScrollPosition = WebCore::IntPoint(mainFrameView->contentsWidth() - actualScreenRect.width(), mainFrameView->contentsHeight() - actualScreenRect.height());
-            scrollLocation = scrollLocation.shrunkTo(maximumScrollPosition);
-            mainFrameView->setScrollPosition(scrollLocation);
-            mainFrameView->setConstrainsScrollingToContentEdge(true);
-            InputLog(LogLevelInfo, "InputHandler::ensureFocusTextElementVisible scrolling to point %d, %d", scrollLocation.x(), scrollLocation.y());
+            destinationScrollLocation = destinationScrollLocation.shrunkTo(maximumScrollPosition);
         }
     }
+
+    if (destinationScrollLocation != mainFrameView->scrollPosition() || zoomScaleRequired != m_webPage->currentScale()) {
+        mainFrameView->setConstrainsScrollingToContentEdge(true);
+
+        InputLog(LogLevelInfo, "InputHandler::ensureFocusTextElementVisible zooming in to %f and scrolling to point %d, %d", zoomScaleRequired, destinationScrollLocation.x(), destinationScrollLocation.y());
+
+        // Animate to given scroll position & zoom level
+        m_webPage->m_finalBlockPoint = WebCore::FloatPoint(destinationScrollLocation);
+        m_webPage->m_blockZoomFinalScale = zoomScaleRequired;
+        m_webPage->m_shouldReflowBlock = false;
+        m_webPage->m_userPerformedManualZoom = true;
+        m_webPage->m_userPerformedManualScroll = true;
+        m_webPage->client()->animateBlockZoom(zoomScaleRequired, m_webPage->m_finalBlockPoint);
+    }
     m_webPage->resumeBackingStore();
 }
 
@@ -1473,9 +1498,23 @@ bool InputHandler::handleKeyboardInput(const Platform::KeyboardEvent& keyboardEv
     // Enable input mode if we are processing a key event.
     setInputModeEnabled();
 
+    Platform::KeyboardEvent::Type type = keyboardEvent.type();
+    /*
+     * IMF sends us an unadultered KeyUp for all key presses. This key event should be allowed to be processed at all times.
+     * We bypass the check because the state of composition has no implication on this key event.
+     * In order to ensure we allow the correct key event through, we keep track of key down events with m_expectedKeyUpChar.
+    */
+    if (type == Platform::KeyboardEvent::KeyUp) {
+        // When IMF auto-capitalizes a KeyDown, say the first letter of a new sentence, our KeyUp will still be in lowercase.
+        if (m_expectedKeyUpChar == keyboardEvent.character() || (isASCIIUpper(m_expectedKeyUpChar) && m_expectedKeyUpChar == toASCIIUpper(keyboardEvent.character()))) {
+            m_expectedKeyUpChar = 0;
+            changeIsPartOfComposition = true;
+        }
+    }
+
     // If we aren't specifically part of a composition, fail, IMF should never send key input
     // while composing text. If IMF has failed, we should have already finished the
-    // composition manually.
+    // composition manually. There is a caveat for KeyUp which is explained above.
     if (!changeIsPartOfComposition && compositionActive())
         return false;
 
@@ -1488,16 +1527,18 @@ bool InputHandler::handleKeyboardInput(const Platform::KeyboardEvent& keyboardEv
     ASSERT(m_webPage->m_page->focusController());
     bool keyboardEventHandled = false;
     if (Frame* focusedFrame = m_webPage->m_page->focusController()->focusedFrame()) {
-        bool isKeyChar = keyboardEvent.type() == Platform::KeyboardEvent::KeyChar;
-        Platform::KeyboardEvent::Type type = keyboardEvent.type();
+        bool isKeyChar = type == Platform::KeyboardEvent::KeyChar;
 
         // If this is a KeyChar type then we handle it as a keydown followed by a key up.
         if (isKeyChar)
             type = Platform::KeyboardEvent::KeyDown;
+        else if (type == Platform::KeyboardEvent::KeyDown) {
+            m_expectedKeyUpChar = keyboardEvent.character();
 
-        // If we receive the KeyDown of a Backspace, set this flag to prevent sending unnecessary selection and caret changes to IMF.
-        if (keyboardEvent.character() == KEYCODE_BACKSPACE && type == Platform::KeyboardEvent::KeyDown)
-            m_receivedBackspaceKeyDown = true;
+            // If we receive the KeyDown of a Backspace, set this flag to prevent sending unnecessary selection and caret changes to IMF.
+            if (keyboardEvent.character() == KEYCODE_BACKSPACE)
+                m_receivedBackspaceKeyDown = true;
+        }
 
         Platform::KeyboardEvent adjustedKeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
         keyboardEventHandled = focusedFrame->eventHandler()->keyEvent(PlatformKeyboardEvent(adjustedKeyboardEvent));
@@ -1528,7 +1569,7 @@ bool InputHandler::deleteSelection()
         return false;
 
     ASSERT(frame->editor());
-    return frame->editor()->command("DeleteBackward").execute();
+    return handleKeyboardInput(Platform::KeyboardEvent(KEYCODE_BACKSPACE, Platform::KeyboardEvent::KeyDown, 0), false /* changeIsPartOfComposition */);
 }
 
 void InputHandler::insertText(const WTF::String& string)
@@ -1538,7 +1579,6 @@ void InputHandler::insertText(const WTF::String& string)
 
     ASSERT(m_currentFocusElement->document() && m_currentFocusElement->document()->frame() && m_currentFocusElement->document()->frame()->editor());
     Editor* editor = m_currentFocusElement->document()->frame()->editor();
-
     editor->command("InsertText").execute(string);
 }
 
@@ -1798,10 +1838,14 @@ bool InputHandler::setBatchEditingActive(bool active)
     ASSERT(backingStoreClient);
 
     // Enable / Disable the backingstore to prevent visual updates.
-    if (!active)
-        backingStoreClient->backingStore()->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
-    else
-        backingStoreClient->backingStore()->suspendScreenAndBackingStoreUpdates();
+    // FIXME: Do we really need to suspend/resume both backingstore and screen here?
+    if (!active) {
+        backingStoreClient->backingStore()->resumeBackingStoreUpdates();
+        backingStoreClient->backingStore()->resumeScreenUpdates(BackingStore::RenderAndBlit);
+    } else {
+        backingStoreClient->backingStore()->suspendBackingStoreUpdates();
+        backingStoreClient->backingStore()->suspendScreenUpdates();
+    }
 
     return true;
 }
@@ -1843,7 +1887,12 @@ bool InputHandler::deleteTextRelativeToCursor(int leftOffset, int rightOffset)
     int caretOffset = caretPosition();
     int start = relativeLeftOffset(caretOffset, leftOffset);
     int end = relativeRightOffset(caretOffset, elementText().length(), rightOffset);
-    if (!deleteText(start, end))
+
+    // If we have backspace in a single character, send this to webkit as a KeyboardEvent. Otherwise, call deleteText.
+    if (leftOffset == 1 && !rightOffset) {
+        if (!handleKeyboardInput(Platform::KeyboardEvent(KEYCODE_BACKSPACE, Platform::KeyboardEvent::KeyDown, 0), true /* changeIsPartOfComposition */))
+            return false;
+    } else if (!deleteText(start, end))
         return false;
 
     // Scroll the field if necessary. The automatic update is suppressed
@@ -1860,6 +1909,9 @@ bool InputHandler::deleteText(int start, int end)
 
     ProcessingChangeGuard guard(this);
 
+    if (end - start == 1)
+        return handleKeyboardInput(Platform::KeyboardEvent(KEYCODE_BACKSPACE, Platform::KeyboardEvent::KeyDown, 0), true /* changeIsPartOfComposition */);
+
     if (!setSelection(start, end, true /*changeIsPartOfComposition*/))
         return false;
 
@@ -2119,7 +2171,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
             return editor->command("InsertText").execute(textToInsert.right(1));
         }
         InputLog(LogLevelInfo, "InputHandler::setText Single trailing character detected.");
-        return handleKeyboardInput(Platform::KeyboardEvent(textToInsert[textLength - 1], Platform::KeyboardEvent::KeyChar, 0), false /* changeIsPartOfComposition */);
+        return handleKeyboardInput(Platform::KeyboardEvent(textToInsert[textLength - 1], Platform::KeyboardEvent::KeyDown, 0), false /* changeIsPartOfComposition */);
     }
 
     // If no spans have changed, treat it as a delete operation.
@@ -2132,7 +2184,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
 
         if (composingTextLength - textLength == 1) {
             InputLog(LogLevelInfo, "InputHandler::setText No spans have changed. New text is one character shorter than the old. Treating as 'delete'.");
-            return editor->command("DeleteBackward").execute();
+            return handleKeyboardInput(Platform::KeyboardEvent(KEYCODE_BACKSPACE, Platform::KeyboardEvent::KeyDown, 0), true /* changeIsPartOfComposition */);
         }
     }
 
@@ -2142,7 +2194,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
     // If there is no text to add just delete.
     if (!textLength) {
         if (selectionActive())
-            return editor->command("DeleteBackward").execute();
+            return handleKeyboardInput(Platform::KeyboardEvent(KEYCODE_BACKSPACE, Platform::KeyboardEvent::KeyDown, 0), true /* changeIsPartOfComposition */);
 
         // Nothing to do.
         return true;
@@ -2153,7 +2205,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
     // Remove it and apply it as a keypress later.
     // Upstream Webkit bug created https://bugs.webkit.org/show_bug.cgi?id=70823
     bool requiresSpaceKeyPress = false;
-    if (textLength > 0 && textToInsert[textLength - 1] == 32 /* space */) {
+    if (textLength > 0 && textToInsert[textLength - 1] == KEYCODE_SPACE) {
         requiresSpaceKeyPress = true;
         textLength--;
         textToInsert.remove(textLength, 1);
@@ -2165,7 +2217,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
         // Handle single key non-attributed entry as key press rather than insert to allow
         // triggering of javascript events.
         InputLog(LogLevelInfo, "InputHandler::setText Single character entry treated as key-press in the absense of spans.");
-        return handleKeyboardInput(Platform::KeyboardEvent(textToInsert[0], Platform::KeyboardEvent::KeyChar, 0), true /* changeIsPartOfComposition */);
+        return handleKeyboardInput(Platform::KeyboardEvent(textToInsert[0], Platform::KeyboardEvent::KeyDown, 0), true /* changeIsPartOfComposition */);
     }
 
     // Perform the text change as a single command if there is one.
@@ -2175,7 +2227,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
     }
 
     if (requiresSpaceKeyPress)
-        handleKeyboardInput(Platform::KeyboardEvent(32 /* space */, Platform::KeyboardEvent::KeyChar, 0), true /* changeIsPartOfComposition */);
+        handleKeyboardInput(Platform::KeyboardEvent(KEYCODE_SPACE, Platform::KeyboardEvent::KeyDown, 0), true /* changeIsPartOfComposition */);
 
     InputLog(LogLevelInfo, "InputHandler::setText Request being processed. Text after processing '%s'", elementText().latin1().data());
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
index 9e271ae2f..34de9b28f 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
@@ -101,6 +101,7 @@ public:
 
     bool isInputMode() const { return isActiveTextEdit(); }
     bool isMultilineInputMode() const { return isActiveTextEdit() && elementType(m_currentFocusElement.get()) == BlackBerry::Platform::InputTypeTextArea; }
+    PassRefPtr<WebCore::Element> currentFocusElement() const { return m_currentFocusElement; }
 
     void ensureFocusElementVisible(bool centerFieldInDisplay = true);
     void handleInputLocaleChanged(bool isRTL);
@@ -223,10 +224,8 @@ private:
     RefPtr<WebCore::TextCheckingRequest> m_request;
     int32_t m_processingTransactionId;
 
-    double m_focusZoomScale;
-    WebCore::FloatPoint m_focusZoomLocation;
-
     bool m_receivedBackspaceKeyDown;
+    unsigned short m_expectedKeyUpChar;
 };
 
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
index fcd2e7e10..1b89071ac 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
@@ -253,14 +253,17 @@ void SelectionHandler::setCaretPosition(const WebCore::IntPoint &position)
 
     VisiblePosition visibleCaretPosition(focusedFrame->visiblePositionForPoint(relativePoint));
 
-    if (!DOMSupport::isPositionInNode(m_webPage->focusedOrMainFrame()->document()->focusedNode(), visibleCaretPosition.deepEquivalent())) {
-        if (unsigned short character = directionOfPointRelativeToRect(relativePoint, currentCaretRect))
-            m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character));
-
-        // Send the selection changed in case this does not trigger a selection change to
-        // ensure the caret position is accurate. This may be a duplicate event.
-        selectionPositionChanged(true /* forceUpdateWithoutChange */);
-        return;
+    if (RenderObject* focusedRenderer = focusedFrame->document()->focusedNode()->renderer()) {
+        WebCore::IntRect nodeOutlineBounds(focusedRenderer->absoluteOutlineBounds());
+        if (!nodeOutlineBounds.contains(relativePoint)) {
+            if (unsigned short character = directionOfPointRelativeToRect(relativePoint, currentCaretRect))
+                m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character));
+
+            // Send the selection changed in case this does not trigger a selection change to
+            // ensure the caret position is accurate. This may be a duplicate event.
+            selectionPositionChanged(true /* forceUpdateWithoutChange */);
+            return;
+        }
     }
 
     VisibleSelection newSelection(visibleCaretPosition);
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
index 3d9e92ff0..790c46403 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "TouchEventHandler.h"
 
+#include "BlackBerryPlatformSystemSound.h"
 #include "DOMSupport.h"
 #include "Document.h"
 #include "DocumentMarkerController.h"
@@ -54,62 +55,10 @@ using namespace WTF;
 namespace BlackBerry {
 namespace WebKit {
 
-static bool hasMouseMoveListener(Element* element)
-{
-    ASSERT(element);
-    return element->hasEventListeners(eventNames().mousemoveEvent) || element->document()->hasEventListeners(eventNames().mousemoveEvent);
-}
-
-static bool hasTouchListener(Element* element)
-{
-    ASSERT(element);
-    return element->hasEventListeners(eventNames().touchstartEvent)
-        || element->hasEventListeners(eventNames().touchmoveEvent)
-        || element->hasEventListeners(eventNames().touchcancelEvent)
-        || element->hasEventListeners(eventNames().touchendEvent);
-}
-
-static bool isRangeControlElement(Element* element)
-{
-    ASSERT(element);
-    if (!element->hasTagName(HTMLNames::inputTag))
-        return false;
-
-    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
-    return inputElement->isRangeControl();
-}
-
-static bool shouldConvertTouchToMouse(Element* element)
-{
-    if (!element)
-        return false;
-
-    if ((element->hasTagName(HTMLNames::objectTag) || element->hasTagName(HTMLNames::embedTag)) && static_cast<HTMLPlugInElement*>(element))
-        return true;
-
-    // Input Range element is a special case that requires natural mouse events
-    // in order to allow dragging of the slider handle.
-    // Input Range element might appear in the webpage, or it might appear in the shadow tree,
-    // like the timeline and volume media controls all use Input Range.
-    // won't operate on the shadow node of other element type, because the webpages
-    // aren't able to attach listeners to shadow content.
-    do {
-        if (isRangeControlElement(element))
-            return true;
-        element = toElement(element->shadowAncestorNode()); // If an element is not in shadow tree, shadowAncestorNode returns itself.
-    } while (element->isInShadowTree());
-
-    // Check if the element has a mouse listener and no touch listener. If so,
-    // the field will require touch events be converted to mouse events to function properly.
-    return hasMouseMoveListener(element) && !hasTouchListener(element);
-
-}
-
 TouchEventHandler::TouchEventHandler(WebPagePrivate* webpage)
     : m_webPage(webpage)
-    , m_didCancelTouch(false)
-    , m_convertTouchToMouse(false)
     , m_existingTouchMode(ProcessedTouchEvents)
+    , m_shouldRequestSpellCheckOptions(false)
 {
 }
 
@@ -117,140 +66,51 @@ TouchEventHandler::~TouchEventHandler()
 {
 }
 
-bool TouchEventHandler::shouldSuppressMouseDownOnTouchDown() const
-{
-    return m_lastFatFingersResult.isTextInput() || m_webPage->m_inputHandler->isInputMode() || m_webPage->m_selectionHandler->isSelectionActive();
-}
-
-void TouchEventHandler::touchEventCancel()
-{
-    m_webPage->m_inputHandler->processPendingKeyboardVisibilityChange();
-
-    // Input elements delay mouse down and do not need to be released on touch cancel.
-    if (!shouldSuppressMouseDownOnTouchDown())
-        m_webPage->m_page->focusController()->focusedOrMainFrame()->eventHandler()->setMousePressed(false);
-
-    m_convertTouchToMouse = m_webPage->m_touchEventMode == PureTouchEventsWithMouseConversion;
-    m_didCancelTouch = true;
-
-    // If we cancel a single touch event, we need to also clean up any hover
-    // state we get into by synthetically moving the mouse to the m_fingerPoint.
-    Element* elementUnderFatFinger = m_lastFatFingersResult.positionWasAdjusted() ? m_lastFatFingersResult.nodeAsElementIfApplicable() : 0;
-    do {
-        if (!elementUnderFatFinger || !elementUnderFatFinger->renderer())
-            break;
-
-        if (!elementUnderFatFinger->renderer()->style()->affectedByHoverRules()
-            && !elementUnderFatFinger->renderer()->style()->affectedByActiveRules())
-            break;
-
-        HitTestRequest request(HitTestRequest::TouchEvent | HitTestRequest::Release);
-        // The HitTestResult point is not actually needed.
-        HitTestResult result(IntPoint::zero());
-        result.setInnerNode(elementUnderFatFinger);
-
-        Document* document = elementUnderFatFinger->document();
-        ASSERT(document);
-        document->renderView()->layer()->updateHoverActiveState(request, result);
-        document->updateStyleIfNeeded();
-
-        // Updating the document style may destroy the renderer.
-        if (!elementUnderFatFinger->renderer())
-            break;
-
-        elementUnderFatFinger->renderer()->repaint();
-        ASSERT(!elementUnderFatFinger->hovered());
-    } while (0);
-
-    m_lastFatFingersResult.reset();
-}
-
-void TouchEventHandler::touchHoldEvent()
+void TouchEventHandler::doFatFingers(Platform::TouchPoint& point)
 {
-    // This is a hack for our hack that converts the touch pressed event that we've delayed because the user has focused a input field
-    // to the page as a mouse pressed event.
-    if (shouldSuppressMouseDownOnTouchDown())
-        handleFatFingerPressed();
-
-    // Clear the focus ring indication if tap-and-hold'ing on a link.
-    if (m_lastFatFingersResult.node() && m_lastFatFingersResult.node()->isLink())
-        m_webPage->clearFocusNode();
+    m_lastScreenPoint = point.m_screenPos;
+    m_lastFatFingersResult.reset(); // Theoretically this shouldn't be required. Keep it just in case states get mangled.
+    IntPoint contentPos(m_webPage->mapFromViewportToContents(point.m_pos));
+    m_webPage->postponeDocumentStyleRecalc();
+    m_lastFatFingersResult = FatFingers(m_webPage, contentPos, FatFingers::ClickableElement).findBestPoint();
+    m_webPage->resumeDocumentStyleRecalc();
 }
 
-static bool isMainFrameScrollable(const WebPagePrivate* page)
+void TouchEventHandler::sendClickAtFatFingersPoint()
 {
-    return page->viewportSize().width() < page->contentsSize().width() || page->viewportSize().height() < page->contentsSize().height();
+    handleFatFingerPressed();
+    PlatformMouseEvent mouseRelease(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, PlatformEvent::MouseReleased, 1, LeftButton, TouchScreen);
+    m_webPage->handleMouseEvent(mouseRelease);
 }
 
-bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point, bool useFatFingers)
+void TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point)
 {
     // Enable input mode on any touch event.
     m_webPage->m_inputHandler->setInputModeEnabled();
-    bool pureWithMouseConversion = m_webPage->m_touchEventMode == PureTouchEventsWithMouseConversion;
-    bool alwaysEnableMouseConversion = pureWithMouseConversion || (!isMainFrameScrollable(m_webPage) && !m_webPage->m_inRegionScroller->d->isActive());
-
     switch (point.m_state) {
     case Platform::TouchPoint::TouchPressed:
         {
-            // FIXME: bypass FatFingers if useFatFingers is false
-            m_lastFatFingersResult.reset(); // Theoretically this shouldn't be required. Keep it just in case states get mangled.
-            m_didCancelTouch = false;
-            m_lastScreenPoint = point.m_screenPos;
-
-            IntPoint contentPos(m_webPage->mapFromViewportToContents(point.m_pos));
-
-            m_webPage->postponeDocumentStyleRecalc();
-            m_lastFatFingersResult = FatFingers(m_webPage, contentPos, FatFingers::ClickableElement).findBestPoint();
-
-            Element* elementUnderFatFinger = 0;
-            if (m_lastFatFingersResult.positionWasAdjusted() && m_lastFatFingersResult.node()) {
-                ASSERT(m_lastFatFingersResult.node()->isElementNode());
-                elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable();
-            }
-
-            // Set or reset the touch mode.
-            Element* possibleTargetNodeForMouseMoveEvents = static_cast<Element*>(m_lastFatFingersResult.positionWasAdjusted() ? elementUnderFatFinger : m_lastFatFingersResult.node());
-            m_convertTouchToMouse = alwaysEnableMouseConversion ? true : shouldConvertTouchToMouse(possibleTargetNodeForMouseMoveEvents);
-
-            if (!possibleTargetNodeForMouseMoveEvents || (!possibleTargetNodeForMouseMoveEvents->hasEventListeners(eventNames().touchmoveEvent) && !m_convertTouchToMouse))
-                m_webPage->client()->notifyNoMouseMoveOrTouchMoveHandlers();
-
-            m_webPage->resumeDocumentStyleRecalc();
+            doFatFingers(point);
 
+            // FIXME Draw tap highlight as soon as possible if we can
+            Element* elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable();
             if (elementUnderFatFinger)
                 drawTapHighlight();
 
-            // Lets be conservative here: since we have problems on major website having
-            // mousemove listener for no good reason (e.g. google.com, desktop edition),
-            // let only delay client notifications when there is not input text node involved.
-            if (m_convertTouchToMouse
-                && (m_webPage->m_inputHandler->isInputMode() && !m_lastFatFingersResult.isTextInput())) {
-                m_webPage->m_inputHandler->setDelayKeyboardVisibilityChange(true);
-                handleFatFingerPressed();
-            } else if (!shouldSuppressMouseDownOnTouchDown())
-                handleFatFingerPressed();
-
-            return true;
+            // Check for text selection
+            if (m_lastFatFingersResult.isTextInput()) {
+                elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable(FatFingersResult::ShadowContentNotAllowed, true /* shouldUseRootEditableElement */);
+                m_shouldRequestSpellCheckOptions = m_webPage->m_inputHandler->shouldRequestSpellCheckingOptionsForPoint(point.m_pos, elementUnderFatFinger, m_spellCheckOptionRequest);
+            }
+
+            handleFatFingerPressed();
+            break;
         }
     case Platform::TouchPoint::TouchReleased:
         {
-            imf_sp_text_t spellCheckOptionRequest;
-            bool shouldRequestSpellCheckOptions = false;
-
-            if (m_lastFatFingersResult.isTextInput())
-                shouldRequestSpellCheckOptions = m_webPage->m_inputHandler->shouldRequestSpellCheckingOptionsForPoint(point.m_pos
-                                                                                                                      , m_lastFatFingersResult.nodeAsElementIfApplicable(FatFingersResult::ShadowContentNotAllowed, true /* shouldUseRootEditableElement */)
-                                                                                                                      , spellCheckOptionRequest);
-
-            // Apply any suppressed changes. This does not eliminate the need
-            // for the show after the handling of fat finger pressed as it may
-            // have triggered a state change. Leave the change suppressed if
-            // we are triggering spell check options.
-            if (!shouldRequestSpellCheckOptions)
-                m_webPage->m_inputHandler->processPendingKeyboardVisibilityChange();
 
-            if (shouldSuppressMouseDownOnTouchDown())
-                handleFatFingerPressed();
+            if (!m_shouldRequestSpellCheckOptions)
+                m_webPage->m_inputHandler->processPendingKeyboardVisibilityChange();
 
             // The rebase has eliminated a necessary event when the mouse does not
             // trigger an actual selection change preventing re-showing of the
@@ -261,52 +121,40 @@ bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point, bool useFa
 
             m_webPage->m_tapHighlight->hide();
 
-            IntPoint adjustedPoint;
-            // always use the true touch point if using the meta-tag, otherwise only use it if we sent mouse moves
-            // to the page and its requested.
-            if (pureWithMouseConversion || (m_convertTouchToMouse && !useFatFingers)) {
-                adjustedPoint = point.m_pos;
-                m_convertTouchToMouse = pureWithMouseConversion;
-            } else // Fat finger point in viewport coordinates.
-                adjustedPoint = m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition());
-
+            IntPoint adjustedPoint = m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition());
             PlatformMouseEvent mouseEvent(adjustedPoint, m_lastScreenPoint, PlatformEvent::MouseReleased, 1, LeftButton, TouchScreen);
             m_webPage->handleMouseEvent(mouseEvent);
-            m_lastFatFingersResult.reset(); // Reset the fat finger result as its no longer valid when a user's finger is not on the screen.
-            if (shouldRequestSpellCheckOptions) {
+
+            if (m_shouldRequestSpellCheckOptions) {
                 IntPoint pixelPositionRelativeToViewport = m_webPage->mapToTransformed(adjustedPoint);
-                m_webPage->m_inputHandler->requestSpellingCheckingOptions(spellCheckOptionRequest, IntSize(m_lastScreenPoint - pixelPositionRelativeToViewport));
+                m_webPage->m_inputHandler->requestSpellingCheckingOptions(m_spellCheckOptionRequest, IntSize(m_lastScreenPoint - pixelPositionRelativeToViewport));
             }
-            return true;
+
+            m_lastFatFingersResult.reset(); // Reset the fat finger result as its no longer valid when a user's finger is not on the screen.
+            break;
         }
     case Platform::TouchPoint::TouchMoved:
-        if (m_convertTouchToMouse) {
+        {
+            // You can still send mouse move events
             PlatformMouseEvent mouseEvent(point.m_pos, m_lastScreenPoint, PlatformEvent::MouseMoved, 1, LeftButton, TouchScreen);
             m_lastScreenPoint = point.m_screenPos;
-            if (!m_webPage->handleMouseEvent(mouseEvent)) {
-                m_convertTouchToMouse = alwaysEnableMouseConversion;
-                return false;
-            }
-            return true;
+            m_webPage->handleMouseEvent(mouseEvent);
+            break;
         }
-        break;
     default:
         break;
     }
-    return false;
 }
 
 void TouchEventHandler::handleFatFingerPressed()
 {
-    if (!m_didCancelTouch) {
-        // First update the mouse position with a MouseMoved event.
-        PlatformMouseEvent mouseMoveEvent(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, PlatformEvent::MouseMoved, 0, LeftButton, TouchScreen);
-        m_webPage->handleMouseEvent(mouseMoveEvent);
-
-        // Then send the MousePressed event.
-        PlatformMouseEvent mousePressedEvent(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, PlatformEvent::MousePressed, 1, LeftButton, TouchScreen);
-        m_webPage->handleMouseEvent(mousePressedEvent);
-    }
+    // First update the mouse position with a MouseMoved event.
+    PlatformMouseEvent mouseMoveEvent(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, PlatformEvent::MouseMoved, 0, LeftButton, TouchScreen);
+    m_webPage->handleMouseEvent(mouseMoveEvent);
+
+    // Then send the MousePressed event.
+    PlatformMouseEvent mousePressedEvent(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, PlatformEvent::MousePressed, 1, LeftButton, TouchScreen);
+    m_webPage->handleMouseEvent(mousePressedEvent);
 }
 
 // This method filters what element will get tap-highlight'ed or not. To start with,
@@ -394,6 +242,9 @@ void TouchEventHandler::drawTapHighlight()
         IntRect rect = focusRingQuads[i].enclosingBoundingBox();
         rect.move(framePos.x(), framePos.y());
         IntRect clippedRect = intersection(clippingRect, rect);
+        // FIXME we shouldn't have any empty rects here PR 246960
+        if (clippedRect.isEmpty())
+            continue;
         clippedRect.inflate(2);
         region = unionRegions(region, Platform::IntRect(clippedRect));
     }
@@ -405,5 +256,11 @@ void TouchEventHandler::drawTapHighlight()
                                     shouldHideTapHighlightRightAfterScrolling);
 }
 
+void TouchEventHandler::playSoundIfAnchorIsTarget() const
+{
+    if (m_lastFatFingersResult.node() && m_lastFatFingersResult.node()->isLink())
+        BlackBerry::Platform::SystemSound::instance()->playSound(BlackBerry::Platform::SystemSoundType::InputKeypress);
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
index bce187dfa..0d0f35ace 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
@@ -35,31 +35,28 @@ public:
     TouchEventHandler(WebPagePrivate* webpage);
     ~TouchEventHandler();
 
-    bool handleTouchPoint(Platform::TouchPoint&, bool useFatFingers);
-    void touchEventCancel();
-    void touchHoldEvent();
-
-    bool shouldSuppressMouseDownOnTouchDown() const;
+    void doFatFingers(Platform::TouchPoint&);
+    void handleTouchPoint(Platform::TouchPoint&);
+    void sendClickAtFatFingersPoint();
 
     const FatFingersResult& lastFatFingersResult() const { return m_lastFatFingersResult; }
     void resetLastFatFingersResult() { m_lastFatFingersResult.reset(); }
 
+    void playSoundIfAnchorIsTarget() const;
+
 private:
     void handleFatFingerPressed();
-
     void drawTapHighlight();
 
 private:
     WebPagePrivate* m_webPage;
 
-    bool m_didCancelTouch;
-    bool m_convertTouchToMouse;
-
     WebCore::TouchEventMode m_existingTouchMode;
-
     WebCore::IntPoint m_lastScreenPoint; // Screen Position
-
     FatFingersResult m_lastFatFingersResult;
+    imf_sp_text_t m_spellCheckOptionRequest;
+    bool m_shouldRequestSpellCheckOptions;
+
 };
 
 }
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index b6dc5c975..d4d3171f0 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1792 @@
+2012-11-21  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Device scale factor should be no-op when applyDeviceScaleFactorInCompositor == 0
+        https://bugs.webkit.org/show_bug.cgi?id=100061
+
+        Reviewed by Adam Barth.
+
+        On Android we're using a different pixel scaling implementation
+        (WebCore::Settings::applyDefaultDeviceScaleFactorInCompositor() == 0) than other
+        platforms. In this mode, we don't make use of device-independent pixels. Device
+        scale factor is provided to WebKit and get merged into page scale factor. Other
+        than that device scale factor should have no effects on rendering.
+
+        * src/PageWidgetDelegate.cpp:
+        (WebKit::PageWidgetDelegate::paint):
+        * src/PageWidgetDelegate.h:
+        * src/WebPagePopupImpl.cpp:
+        (WebKit::WebPagePopupImpl::paint):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::shouldApplyDeviceScaleFactorInCompositor):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-21  Tien-Ren Chen  <trchen@chromium.org>
+
+        Use m_webView->size() for viewport update
+        https://bugs.webkit.org/show_bug.cgi?id=102764
+
+        Reviewed by Adam Barth.
+
+        m_webView->client()->windowRect() returns the outer rect of the browser
+        window, which includes the decorations such as the title bar.
+        We should use the size of the WebView for layout and rendering purpose.
+
+        Existing tests are updated to work without windowRect().
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::dispatchViewportPropertiesDidChange):
+        * tests/WebFrameTest.cpp:
+
+2012-11-21  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] webkit_unit_tests should depend on forwarder2 for Android
+        https://bugs.webkit.org/show_bug.cgi?id=102934
+
+        Reviewed by Tony Chang.
+
+        Running webkit_unit_tests and TestWebKitAPI in the WebKit tree will defer
+        to the test runner used by Chromium, which in turn relies on forwarder2.
+        forwarder2 will eventually be required by layout tests as well.
+
+        * WebKitUnitTests.gyp:
+
+2012-11-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135409.
+        http://trac.webkit.org/changeset/135409
+        https://bugs.webkit.org/show_bug.cgi?id=102959
+
+        This patch causes compiling error to Chromium build (Requested
+        by jianli_ on #webkit).
+
+        * tests/IDBRequestTest.cpp:
+        (WebCore::TEST):
+
+2012-11-21  Kevin Ellis  <kevers@chromium.org>
+
+        [chromium] Add flag to enable/disable touch adjustment at runtime.
+        https://bugs.webkit.org/show_bug.cgi?id=102534
+
+        Reviewed by Antonio Gomes.
+
+        Add setting for enabling or disabling touch adjustment.
+        For touch adjustemnt to apply, the compile option must
+        also be enabled.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setEnableTouchAdjustment):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-11-21  Dan Carney  <dcarney@google.com>
+
+        IDBRequestTest needs a v8 context
+        https://bugs.webkit.org/show_bug.cgi?id=102941
+
+        Reviewed by Jochen Eisinger.
+
+        Added v8 context to IDBRequestTest tests.
+
+        * tests/IDBRequestTest.cpp:
+        (IDBRequestTest):
+        (WebKit::IDBRequestTest::IDBRequestTest):
+        (WebKit::IDBRequestTest::context):
+        (WebKit::IDBRequestTest::scriptExecutionContext):
+        (WebKit):
+        (WebKit::TEST_F):
+
+2012-11-21  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Disambiguate innerNodeFramePoint and mainFramePoint
+        https://bugs.webkit.org/show_bug.cgi?id=98139
+
+        Reviewed by Julien Chaffraix.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::mouseDidMoveOverElement):
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::selectMisspelledWord):
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::characterIndexForPoint):
+
+2012-11-21  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Link highlight should display for at least 100ms, and fadeout on GestureTap/Longpress.
+        https://bugs.webkit.org/show_bug.cgi?id=102823
+
+        Reviewed by Adrienne Walker.
+
+        Link highlights sometimes disappear so quickly they barely display. Modify
+        so that the highlight is displayed for minimum 100ms before fading out, and
+        also fadeout (as opposed to abrupt clear) on GestureTap and GestureLongPress.
+
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::LinkHighlight):
+        (WebKit::LinkHighlight::startHighlightAnimationIfNeeded): Check if min duration achieved, if not add time to fadeout animation.
+        * src/LinkHighlight.h:
+        (LinkHighlight):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent): Fadeout instead of clear on GestureTap and GestureLongPress.
+
+2012-11-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Now that offending patch has been rolled out reenable IDBRequestTest.EventsAfterStopping
+        https://bugs.webkit.org/show_bug.cgi?id=102929
+
+        * tests/IDBRequestTest.cpp:
+        (WebCore::TEST):
+
+2012-11-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Disable failing test.
+        https://bugs.webkit.org/show_bug.cgi?id=102929
+
+        * tests/IDBRequestTest.cpp:
+        (WebCore::TEST):
+
+2012-11-21  Florin Malita  <fmalita@chromium.org>
+
+        [Skia] Encapsulate access to PlatformContextSkia's SkCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=102694
+
+        Reviewed by Stephen White.
+
+        Use PlatformContextSkia's wrapper methods instead of accessing the canvas directly.
+
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::getPixelAt):
+        (WebCore::clearTopLayerAlphaChannel):
+        (WebCore::clearTopLayerAlphaPixel):
+        (WebCore::TEST):
+
+2012-11-20  Rachel Blum  <groby@chromium.org>
+
+        [Chromium] Need spellcheck suggestions even if continuous check is off.
+        https://bugs.webkit.org/show_bug.cgi?id=102535
+
+        Reviewed by Hajime Morita.
+
+        Make sure the context menu always has suggestions for misspelled words.
+
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+
+2012-11-20  Robert Kroeger  <rjkroege@chromium.org>
+
+        [chromium] Use embedder-supported gesture curves
+        https://bugs.webkit.org/show_bug.cgi?id=100884
+
+        Reviewed by James Robinson.
+
+        Use embedder-provided gesture animation curves via WebKit api interfaces.
+        Tested by existing tests.
+
+        * src/WebCompositorInputHandlerImpl.cpp:
+        (WebKit::WebCompositorInputHandlerImpl::handleGestureFling):
+        (WebKit::WebCompositorInputHandlerImpl::scrollBy):
+        * src/WebCompositorInputHandlerImpl.h:
+        (WebCompositorInputHandlerImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::scrollBy):
+        (WebKit::WebViewImpl::handleGestureEvent):
+        (WebKit::WebViewImpl::transferActiveWheelFlingAnimation):
+        * src/WebViewImpl.h:
+        (WebCore):
+        (WebKit):
+        (WebViewImpl):
+
+2012-11-20  Tony Chang  <tony@chromium.org>
+
+        When calling DocumentStyleSheetCollection::addUserSheet, pass in a user sheet
+        https://bugs.webkit.org/show_bug.cgi?id=102835
+
+        Reviewed by Ojan Vafai.
+
+        After r135082, Chromium browser_tests were triggering the ASSERT in
+        StyleResolver::collectRulesFromUserStyleSheets. Add an ASSERT that will
+        trigger earlier and make it clear in the Chromium code that we're always
+        inserting user level styles.
+
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::insertUserStyleSheet):
+
+2012-11-20  Istiaque Ahmed  <lazyboy@chromium.org>
+
+        Provide page/window coordinates to plugin's local coordinates translation in WebPluginContainer.
+        https://bugs.webkit.org/show_bug.cgi?id=102339
+
+        Reviewed by Adam Barth.
+
+        This change will allow converting a page's window coordinates to plugins's local coordinates,
+        taking CSS transformations into account. Embedder page of the plugin can use this information
+        for targetting elements inside the plugin (e.g. devtools can inspect a specific element at the
+        local coordinate position inside plugin).
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebNode.h:
+        (WebKit):
+        * public/WebPluginContainer.h:
+        (WebKit):
+        (WebPluginContainer):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeCommand):
+        (WebKit::WebFrameImpl::printBegin):
+        (WebKit::WebFrameImpl::isPrintScalingDisabledForPlugin):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::pluginContainer):
+        (WebKit):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::windowToLocalPoint):
+        (WebKit):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * tests/FakeWebPlugin.cpp: Added.
+        (WebKit):
+        (WebKit::FakeWebPlugin::FakeWebPlugin):
+        (WebKit::FakeWebPlugin::~FakeWebPlugin):
+        (WebKit::FakeWebPlugin::initialize):
+        (WebKit::FakeWebPlugin::destroy):
+        * tests/FakeWebPlugin.h: Added.
+        (WebKit):
+        (FakeWebPlugin):
+        * tests/WebPluginContainerTest.cpp: Added.
+        (WebKit):
+        (WebPluginContainerTest):
+        (WebKit::WebPluginContainerTest::WebPluginContainerTest):
+        (WebKit::WebPluginContainerTest::TearDown):
+        (WebKit::getWebPluginContainer):
+        (WebKit::TEST_F):
+        * tests/data/plugin_container.html: Added.
+
+2012-11-20  Alpha Lam  <hclam@chromium.org>
+
+        [chromium] Make lazy image decoding thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=102721
+
+        Reviewed by Stephen White.
+
+        Added a new unit test to verify that lazy image decoding operates
+        correctly on non-main threads.
+
+        * tests/DeferredImageDecoderTest.cpp:
+        (Rasterizer):
+        (WebCore):
+        (WebCore::rasterizeMain):
+        (WebCore::TEST_F):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadRequest):
+        (WebKit::WebFrameImpl::loadData):
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::initializeLoader):
+
+2012-11-20  Eberhard Graether  <egraether@google.com>
+
+        [Chromium] fix FPS counter disappearing when changing page
+        https://bugs.webkit.org/show_bug.cgi?id=102532
+
+        Reviewed by Pavel Feldman.
+
+        When changing the page with opened WebInspector and active FPS counter the WebInspector is
+        reloaded before the WebView switches to accelerated compositing, so the showFPSCounter call
+        to WebLayerTreeView is not yet possible. This fix saves the showFPSCounter value in the
+        WebSettings so it can be read when accelerated compositing is activated.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setShowFPSCounter):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadRequest):
+        (WebKit::WebFrameImpl::loadData):
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::initializeLoader):
+
+2012-11-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix Chromium Win compilation after r135196.
+        https://bugs.webkit.org/show_bug.cgi?id=102021
+
+        * tests/DeferredImageDecoderTest.cpp: changed char to unsigned char in the array
+        declaration to avoid 'warning C4309' on MSVS when initializing from hex literals.
+        (WebCore):
+
+2012-11-19  Miguel Garcia  <miguelg@chromium.org>
+
+        [Chromium] Remove the dependency of INPUT_TYPE_COLOR on PAGE_POPUP
+        https://bugs.webkit.org/show_bug.cgi?id=102525
+
+        Reviewed by Kent Tamura.
+
+        INPUT_TYPE_COLOR should not depend on PAGE_POPUP, with this change we allow platforms like android to implement the former without depending on the latter.
+
+        Tested by compiling chromium with and without ENABLE_PAGE_POPUP and made sure that forms with input type color would load in both cases.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser):
+        * src/ColorChooserUIController.cpp:
+        (WebKit::ColorChooserUIController::ColorChooserUIController):
+        (WebKit::ColorChooserUIController::openUI):
+        (WebKit):
+        (WebKit::ColorChooserUIController::endChooser):
+        * src/ColorChooserUIController.h:
+        (ColorChooserUIController):
+
+2012-11-19  Alpha Lam  <hclam@chromium.org>
+
+        [chromium] Lazy image decoding without cache
+        https://bugs.webkit.org/show_bug.cgi?id=102021
+
+        Reviewed by Stephen White.
+
+        Updated two test cases using real image data.
+
+        The tests demonstrates that original image decoder is not used and
+        image is decoded lazily with correct pixel results.
+
+        * tests/DeferredImageDecoderTest.cpp:
+        (WebCore):
+        (WebCore::DeferredImageDecoderTest::SetUp):
+        (WebCore::DeferredImageDecoderTest::decoderBeingDestroyed):
+        (DeferredImageDecoderTest):
+        (WebCore::TEST_F):
+        * tests/MockImageDecoder.h:
+        (MockImageDecoderClient):
+        (WebCore):
+        (WebCore::MockImageDecoder::MockImageDecoder):
+        (WebCore::MockImageDecoder::~MockImageDecoder):
+        (MockImageDecoder):
+
+2012-11-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135180.
+        http://trac.webkit.org/changeset/135180
+        https://bugs.webkit.org/show_bug.cgi?id=102700
+
+        breaks ui/compositor build (Requested by danakj on #webkit).
+
+        * tests/GraphicsLayerChromiumTest.cpp:
+        (WebKit::GraphicsLayerChromiumTest::GraphicsLayerChromiumTest):
+
+2012-11-19  Yusuke Sato  <yusukes@chromium.org>
+
+        [Chromium] Flash cannot receive scroll events when threaded compositing is in use
+        https://bugs.webkit.org/show_bug.cgi?id=101423
+
+        Reviewed by James Robinson.
+
+        Add setWantsWheelEvents() to Chromium's WebPluginContainer interface so that a plugin can tell the
+        container that the plugin always wants to handle wheel events even when a scroll bar is not shown.
+
+        * public/WebPluginContainer.h:
+        (WebPluginContainer):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setWantsWheelEvents):
+        (WebKit):
+        (WebKit::WebPluginContainerImpl::wantsWheelEvents):
+        (WebKit::WebPluginContainerImpl::WebPluginContainerImpl):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-11-19  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: simplify RecordIdentifier
+        https://bugs.webkit.org/show_bug.cgi?id=102018
+
+        Reviewed by Tony Chang.
+
+        Update IDBFakeBackingStore to match its parent class.
+
+        * tests/IDBFakeBackingStore.h:
+
+2012-11-19  Vincent Scheib  <scheib@chromium.org>
+
+        [Chromium] Remove WebKit::WebRuntimeFeatures::enablePointerLock.
+        https://bugs.webkit.org/show_bug.cgi?id=96946
+
+        Reviewed by Adam Barth.
+
+        The runtime flag functionality has already been removed.
+        Now that Chromium no longer has a compile dependency on this
+        API, it can be removed as well.
+
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+
+2012-11-19  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add PROXIMITY_EVENTS feature
+        https://bugs.webkit.org/show_bug.cgi?id=102658
+
+        Reviewed by Kentaro Hara.
+
+        Add PROXIMITY_EVENTS feature to chromium port.
+
+        * features.gypi:
+
+2012-11-19  Sami Kyostila  <skyostil@chromium.org>
+
+        [chromium] Use devicePixelRatio instead of screen DPI for computing viewport attributes
+        https://bugs.webkit.org/show_bug.cgi?id=101767
+
+        Reviewed by Adam Barth.
+
+        Use the newly introduced device scale factor to calculate viewport properties
+        instead of using the screen DPI. No functional changes, because Chromium
+        platforms that have VIEWPORT enabled now also initialize the device scale
+        factor accordingly.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::dispatchViewportPropertiesDidChange):
+        * tests/WebFrameTest.cpp:
+
+2012-11-18  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r135047.
+        http://trac.webkit.org/changeset/135047
+        https://bugs.webkit.org/show_bug.cgi?id=102339
+
+        it broke Chromium Windows/Mac build
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebNode.h:
+        (WebKit):
+        * public/WebPluginContainer.h:
+        (WebKit):
+        (WebPluginContainer):
+        * src/WebFrameImpl.cpp:
+        (WebKit::pluginContainerFromNode):
+        (WebKit):
+        (WebKit::WebFrameImpl::executeCommand):
+        (WebKit::WebFrameImpl::printBegin):
+        (WebKit::WebFrameImpl::isPrintScalingDisabledForPlugin):
+        * src/WebNode.cpp:
+        * src/WebPluginContainerImpl.cpp:
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * tests/FakeWebPlugin.cpp: Removed.
+        * tests/FakeWebPlugin.h: Removed.
+        * tests/WebPluginContainerTest.cpp: Removed.
+        * tests/data/plugin_container.html: Removed.
+
+2012-11-18  Rick Byers  <rbyers@chromium.org>
+
+        [chromium] add WebCursorInfo::imageScaleFactor
+        https://bugs.webkit.org/show_bug.cgi?id=102612
+
+        Reviewed by Adam Barth.
+
+        Add cursor image scale factor (currently always 1) to chromium API, in preparation for
+        high-dpi cursor support in bug 99493.
+
+        * public/WebCursorInfo.h:
+        (WebKit::WebCursorInfo::WebCursorInfo):
+        * src/WebCursorInfo.cpp:
+        (WebKit::WebCursorInfo::WebCursorInfo):
+
+2012-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-17  Istiaque Ahmed  <lazyboy@chromium.org>
+
+        Provide page/window coordinates to plugin's local coordinates translation in WebPluginContainer.
+        https://bugs.webkit.org/show_bug.cgi?id=102339
+
+        Reviewed by Adam Barth.
+
+        This change will allow converting a page's window coordinates to plugins's local coordinates,
+        taking CSS transformations into account. Embedder page of the plugin can use this information
+        for targetting elements inside the plugin (e.g. devtools can inspect a specific element at the
+        local coordinate position inside plugin).
+        Attempting to re-land after Windows build fix.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebNode.h:
+        (WebKit):
+        * public/WebPluginContainer.h:
+        (WebKit):
+        (WebPluginContainer):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeCommand):
+        (WebKit::WebFrameImpl::printBegin):
+        (WebKit::WebFrameImpl::isPrintScalingDisabledForPlugin):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::pluginContainer):
+        (WebKit):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::windowToLocalPoint):
+        (WebKit):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * tests/FakeWebPlugin.cpp: Added.
+        (WebKit):
+        (WebKit::FakeWebPlugin::FakeWebPlugin):
+        (WebKit::FakeWebPlugin::~FakeWebPlugin):
+        (WebKit::FakeWebPlugin::initialize):
+        (WebKit::FakeWebPlugin::destroy):
+        * tests/FakeWebPlugin.h: Added.
+        (WebKit):
+        (FakeWebPlugin):
+        * tests/WebPluginContainerTest.cpp: Added.
+        (WebKit):
+        (WebPluginContainerTest):
+        (WebKit::WebPluginContainerTest::WebPluginContainerTest):
+        (WebKit::WebPluginContainerTest::TearDown):
+        (WebKit::getWebPluginContainer):
+        (WebKit::TEST_F):
+        * tests/data/plugin_container.html: Added.
+
+2012-11-16  Raman Kumar  <ramankk@chromium.org>
+
+        Add setChecked API in WebInputElement
+        https://bugs.webkit.org/show_bug.cgi?id=102422
+
+        Reviewed by Adam Barth.
+
+        * public/WebInputElement.h:
+        (WebInputElement): Add setChecked(bool, bool) API
+        * src/WebInputElement.cpp:
+        (WebKit::WebInputElement::setChecked): Implement setChecked by calling
+        underlying HTMLInputElement's setChecked.
+        (WebKit):
+
+2012-11-16  Tony Chang  <tony@chromium.org>
+
+        Remove ENABLE_CSS_HIERARCHIES since it's no longer in use
+        https://bugs.webkit.org/show_bug.cgi?id=102554
+
+        Reviewed by Andreas Kling.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=79939#c41 ,
+        we're going to revist this feature once additional vendor support is
+        achieved.
+
+        * features.gypi:
+
+2012-11-16  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Remove cookie-related functions from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=99340
+
+        Reviewed by Adam Barth.
+
+        Move cookie-related functions out of PlatformSupport and implement
+        new PlatformCookieJar interface via NetworkContext.
+
+        * WebKit.gyp:
+        * src/FrameNetworkingContextImpl.cpp: Added.
+        (WebKit):
+        (WebKit::FrameNetworkingContextImpl::cookieJar):
+        * src/FrameNetworkingContextImpl.h:
+        (FrameNetworkingContextImpl):
+        * src/PlatformSupport.cpp:
+
+2012-11-16  Tien-Ren Chen  <trchen@chromium.org>
+
+        Rename applyDefaultDeviceScaleFactorInCompositor to setApplyDeviceScaleFactorInCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=102462
+
+        Reviewed by James Robinson.
+
+        As we no longer have this "default" device scale factor.
+
+        * public/WebSettings.h:
+        (WebKit::WebSettings::setApplyDefaultDeviceScaleFactorInCompositor):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        (WebKit::WebSettingsImpl::setApplyDeviceScaleFactorInCompositor):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        (WebKit::WebSettingsImpl::applyDeviceScaleFactorInCompositor):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setDeviceScaleFactor):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-11-16  Jon Lee  <jonlee@apple.com>
+
+        Fix build error on Chromium due to r134995.
+
+        * src/WebNode.cpp:
+        (WebKit::WebNode::simulateClick): Pass in NULL pointer instead.
+
+2012-11-16  Michael Pruett  <michael@68k.org>
+
+        IndexedDB: Propagate DOMRequestState to IndexedDB binding utility functions
+        https://bugs.webkit.org/show_bug.cgi?id=102430
+
+        Reviewed by Adam Barth.
+
+        DOMRequestState is currently propagated to some but not all of
+        the IndexedDB binding utility functions. In order to implement
+        these functions for JSC, this state must be propagated to all
+        of the utility functions.
+
+        * tests/IDBBindingUtilitiesTest.cpp:
+        (WebKit::checkKeyFromValueAndKeyPathInternal):
+        (WebKit::injectKey):
+
+2012-11-16  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update RTCPeerConnection states to match the latest editors draft
+        https://bugs.webkit.org/show_bug.cgi?id=102382
+
+        Reviewed by Adam Barth.
+
+        Updating readyState & iceState, and adding iceGatheringState.
+
+        * src/AssertMatchingEnums.cpp:
+
+2012-11-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r134973.
+        http://trac.webkit.org/changeset/134973
+        https://bugs.webkit.org/show_bug.cgi?id=99340
+
+        Broke compile on at least Mac and Linux.
+
+        * WebKit.gyp:
+        * src/FrameNetworkingContextImpl.h:
+        * src/PlatformSupport.cpp:
+        (WebCore::getCookieJar):
+        (WebCore):
+        (WebCore::PlatformSupport::setCookies):
+        (WebCore::PlatformSupport::cookies):
+        (WebCore::PlatformSupport::cookieRequestHeaderFieldValue):
+        (WebCore::PlatformSupport::rawCookies):
+        (WebCore::PlatformSupport::deleteCookie):
+        (WebCore::PlatformSupport::cookiesEnabled):
+
+2012-11-16  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Remove cookie-related functions from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=99340
+
+        Reviewed by Adam Barth.
+
+        Move cookie-related functions out of PlatformSupport and implement
+        new PlatformCookieJar interface via NetworkContext.
+
+        * WebKit.gyp:
+        * src/FrameNetworkingContextImpl.cpp: Added.
+        (WebKit):
+        (WebKit::FrameNetworkingContextImpl::cookieJar):
+        * src/FrameNetworkingContextImpl.h:
+        (FrameNetworkingContextImpl):
+        * src/PlatformSupport.cpp:
+
+2012-11-16  Scott Violet  <sky@chromium.org>
+
+        [chromium] Copy linux theme related files to default
+        https://bugs.webkit.org/show_bug.cgi?id=102403
+
+        Reviewed by Tony Chang
+
+        Transitional patch that copies linux WebThemeEngine to default directory.
+
+        No new tests, refactoring only.
+
+        * features.gypi:
+        * public/platform/default: Added.
+        * public/platform/default/WebThemeEngine.h: Copied from Source/WebKit/chromium/public/platform/linux/WebThemeEngine.h.
+        * src/PlatformSupport.cpp: Includes correct theme files when DEFAULT_RENDER_THEME is set.
+        (WebCore):
+        * src/WebViewImpl.cpp: Includes correct theme files when DEFAULT_RENDER_THEME is set.
+        (WebKit::WebViewImpl::setScrollbarColors): Calls to default theme as necessary.
+        (WebKit::WebViewImpl::setSelectionColors): Calls to default theme as necessary.
+
+2012-11-16  Robert Flack  <flackr@chromium.org>
+
+        Handle gesture events on scrollbars.
+        https://bugs.webkit.org/show_bug.cgi?id=101516
+
+        Reviewed by Antonio Gomes.
+
+        Adds a gesture event handler to scrollbars and sends gestures beginning
+        over a scrollbar to this handler to allow touch scrolling scrollbars.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent):
+
+2012-11-16  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-15  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r134880.
+        http://trac.webkit.org/changeset/134880
+        https://bugs.webkit.org/show_bug.cgi?id=102339
+
+        it broke Chromium Windows build
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebNode.h:
+        (WebKit):
+        * public/WebPluginContainer.h:
+        (WebKit):
+        (WebPluginContainer):
+        * src/WebFrameImpl.cpp:
+        (WebKit::pluginContainerFromNode):
+        (WebKit):
+        (WebKit::WebFrameImpl::executeCommand):
+        (WebKit::WebFrameImpl::printBegin):
+        (WebKit::WebFrameImpl::isPrintScalingDisabledForPlugin):
+        * src/WebNode.cpp:
+        * src/WebPluginContainerImpl.cpp:
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * tests/FakeWebPlugin.cpp: Removed.
+        * tests/FakeWebPlugin.h: Removed.
+        * tests/WebPluginContainerTest.cpp: Removed.
+        * tests/data/plugin_container.html: Removed.
+
+2012-11-15  Istiaque Ahmed  <lazyboy@chromium.org>
+
+        Provide page/window coordinates to plugin's local coordinates translation in WebPluginContainer.
+        https://bugs.webkit.org/show_bug.cgi?id=102339
+
+        Reviewed by Adam Barth.
+
+        This change will allow converting a page's window coordinates to plugins's local coordinates,
+        taking CSS transformations into account. Embedder page of the plugin can use this information
+        for targetting elements inside the plugin (e.g. devtools can inspect a specific element at the
+        local coordinate position inside plugin).
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebNode.h:
+        (WebKit):
+        * public/WebPluginContainer.h:
+        (WebKit):
+        (WebPluginContainer):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeCommand):
+        (WebKit::WebFrameImpl::printBegin):
+        (WebKit::WebFrameImpl::isPrintScalingDisabledForPlugin):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::pluginContainer):
+        (WebKit):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::windowToLocalPoint):
+        (WebKit):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * tests/FakeWebPlugin.cpp: Added.
+        (WebKit):
+        (WebKit::FakeWebPlugin::FakeWebPlugin):
+        (WebKit::FakeWebPlugin::~FakeWebPlugin):
+        (WebKit::FakeWebPlugin::initialize):
+        (WebKit::FakeWebPlugin::destroy):
+        * tests/FakeWebPlugin.h: Added.
+        (WebKit):
+        (FakeWebPlugin):
+        * tests/WebPluginContainerTest.cpp: Added.
+        (WebKit):
+        (WebPluginContainerTest):
+        (WebKit::WebPluginContainerTest::WebPluginContainerTest):
+        (WebKit::WebPluginContainerTest::TearDown):
+        (WebKit::getWebPluginContainer):
+        (WebKit::TEST_F):
+        * tests/data/plugin_container.html: Added.
+
+2012-11-15  Tien-Ren Chen  <trchen@chromium.org>
+
+        Add Settings to disable custom scrollbars on main frame
+        https://bugs.webkit.org/show_bug.cgi?id=102323
+
+        Reviewed by Adam Barth.
+
+        Custom scrollbars on main frame don't really work well on touch devices.
+        Add a setting to inhibit their creation.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setAllowCustomScrollbarInMainFrame):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-11-15  Yue Zhang  <zysxqn@google.com>
+
+        Ignore autocomplete=off for chrome generated passwords.
+        https://bugs.webkit.org/show_bug.cgi?id=102426
+
+        Reviewed by Adam Barth.
+
+        Record the autocomplete attribute in the web password form data,
+        so that we can handle autocomplete in chromium code. The
+        motivation/background is: we should ignore autocomplete=off field
+        for password forms with chrome generated passwords (has passed
+        security review). By handling autocomplete in chromium code we can
+        distinguish password forms with chrome generated passwords and
+        those normal password forms. Note that we haven't turned off
+        checking autocomplete=off in the Webkit code for now so there is
+        no behavior change after this CL, and we will turn off after we
+        make the chromium side change to be safe.
+
+        * public/WebPasswordFormData.h:
+        (WebPasswordFormData):
+        * src/WebPasswordFormData.cpp:
+
+2012-11-15  Scott Violet  <sky@chromium.org>
+
+        [chromium] Create default directory so that cq can apply patch
+        https://bugs.webkit.org/show_bug.cgi?id=102421
+
+        Reviewed by Tony Chang.
+
+        Done in hopes of patch that copies files to this directory working.
+
+        * public/platform/default: Added.
+
+2012-11-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134800 and r134805.
+        http://trac.webkit.org/changeset/134800
+        http://trac.webkit.org/changeset/134805
+        https://bugs.webkit.org/show_bug.cgi?id=102417
+
+        This patch broke chromium port (Requested by jianli on
+        #webkit).
+
+        * src/AssertMatchingEnums.cpp:
+
+2012-11-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        [chromium] Do not mark an event (mouse wheel, scroll update) as handled if nothing was scrolled.
+        https://bugs.webkit.org/show_bug.cgi?id=102246
+
+        Reviewed by James Robinson.
+
+        * src/WebCompositorInputHandlerImpl.cpp:
+        (WebKit::WebCompositorInputHandlerImpl::handleInputEventInternal):
+        * tests/WebCompositorInputHandlerImplTest.cpp:
+        (MockWebInputHandlerClient):
+        (WebKit::TEST_F):
+
+2012-11-15  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update RTCPeerConnection states to match the latest editors draft
+        https://bugs.webkit.org/show_bug.cgi?id=102382
+
+        Reviewed by Adam Barth.
+
+        Updating readyState & iceState, and adding iceGatheringState.
+
+        * src/AssertMatchingEnums.cpp:
+
+2012-11-15  Tien-Ren Chen  <trchen@chromium.org>
+
+        Use correct unscaled document size when calculating scale limits
+        https://bugs.webkit.org/show_bug.cgi?id=102028
+
+        Reviewed by Adam Barth.
+
+        Fixes bug http://crbug.com/160581
+        Using contentsSize / pageScaleFactor as unscaled contents size results
+        in rounding errors. This can cause scale factor to oscillate indefinitely.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::unscaledContentsSize):
+        (WebKit):
+        (WebKit::WebViewImpl::computePageScaleFactorLimits):
+        * tests/WebFrameTest.cpp:
+        * tests/data/scale_oscillate.html: Added.
+
+2012-11-15  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Move allowWebGL query to WebFrameClient
+        https://bugs.webkit.org/show_bug.cgi?id=102319
+
+        Reviewed by Adam Barth.
+
+        Moved allowWebGL query to WebFrameClient to avoid polluting
+        content/ API.
+
+        * public/WebFrameClient.h:
+        (WebFrameClient):
+        (WebKit::WebFrameClient::allowWebGL):
+        * public/WebPermissionClient.h:
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::allowWebGL):
+
+2012-11-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-15  Stephen Chenney  <schenney@chromium.org>
+
+        [Chromium] Move SK_DISABLE_FAST_AA_STROKE_RECT to skia_webkit.gyp
+
+        Unreviewed non-funtional, behavior-neutral change
+
+        * skia_webkit.gyp: Add SK_DISABLE_FAST_AA_STROKE_RECT=1 so that it can be removed from Chromium's skia.gyp
+
+2012-11-15  Stephen Chenney  <schenney@chromium.org>
+
+        [Chromium] Disable SK_IGNORE_FAST_BLURRECT
+
+        Unreviewed test update.
+
+        This flag is enabled purely to simplify rebaselining. I am now
+        removing it and doing the rebaslining.
+
+        * skia_webkit.gyp: Remove the line for SK_IGNORE_FAST_BLURRECT
+
+2012-11-15  Kent Tamura  <tkent@chromium.org>
+
+        Support stand-alone month names in calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=102196
+
+        Reviewed by Kentaro Hara.
+
+        * src/DateTimeChooserImpl.cpp:
+        (WebKit::DateTimeChooserImpl::writeDocument):
+        We don't need to pass monthLabels any more.
+
+2012-11-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-14  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove magic numbers in record comparator, handle missing case
+        https://bugs.webkit.org/show_bug.cgi?id=102255
+
+        Reviewed by Tony Chang.
+
+        Add test keys for various metadata types.
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+
+2012-11-14  Eric Uhrhane  <ericu@chromium.org>
+
+        [chromium] Don't let shift-click turn popup into tab.
+        https://bugs.webkit.org/show_bug.cgi?id=102254
+
+        Reviewed by Adam Barth.
+
+        Change http://trac.webkit.org/changeset/132399 broke shift-click on
+        compose in GMail.  We didn't want to change behavior that people were
+        depending on, and this quick fix seems a good compromise between user
+        intent and developer intent.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::updatePolicyForEvent):
+
+2012-11-14  Mike Reed  <reed@google.com>
+
+        Dynamically create canvas in Setup() to avoid calling DEPRECATED function setDevice().
+        https://bugs.webkit.org/show_bug.cgi?id=102242
+
+        Reviewed by Stephen White.
+
+        This change should not change any test results, it is an equivalent implementation that avoids
+        using a (now) DEPRECATED function.
+
+        * tests/DeferredImageDecoderTest.cpp:
+        (WebCore::createRasterCanvas):
+        (WebCore):
+        (WebCore::DeferredImageDecoderTest::SetUp):
+        (DeferredImageDecoderTest):
+        (WebCore::TEST_F):
+
+2012-11-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134523.
+        http://trac.webkit.org/changeset/134523
+        https://bugs.webkit.org/show_bug.cgi?id=102218
+
+        brake chrome windows build, as it references a non existing
+        header js/DOMRequestState.h (Requested by jochen__ on
+        #webkit).
+
+        * src/WebIDBKey.cpp:
+
+2012-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Support for localization tests of calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=102181
+
+        Reviewed by Kentaro Hara.
+
+        * src/DateTimeChooserImpl.cpp:
+        Use DateTimeChooserParameters::locale.
+        (WebKit::DateTimeChooserImpl::DateTimeChooserImpl):
+        (WebKit::DateTimeChooserImpl::writeDocument):
+
+2012-11-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134566.
+        http://trac.webkit.org/changeset/134566
+        https://bugs.webkit.org/show_bug.cgi?id=102197
+
+        "it broke Chromium Android Release build" (Requested by
+        haraken on #webkit).
+
+        * src/DateTimeChooserImpl.cpp:
+        (WebKit::DateTimeChooserImpl::DateTimeChooserImpl):
+        (WebKit::DateTimeChooserImpl::writeDocument):
+
+2012-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Support for localization tests of calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=102181
+
+        Reviewed by Kentaro Hara.
+
+        * src/DateTimeChooserImpl.cpp:
+        Use DateTimeChooserParameters::locale.
+        (WebKit::DateTimeChooserImpl::DateTimeChooserImpl):
+        (WebKit::DateTimeChooserImpl::writeDocument):
+
+2012-11-14  Yury Semikhatsky  <yurys@chromium.org>
+
+        Remove MemoryInstrumentationTest.ImageObserver
+        https://bugs.webkit.org/show_bug.cgi?id=102185
+
+        Reviewed by Pavel Feldman.
+
+        Removed obsolete memory instrumenation unit test.
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Removed.
+
+2012-11-14  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Add API to expose WebCore::DateTimeChooser
+        https://bugs.webkit.org/show_bug.cgi?id=101196
+
+        Reviewed by Hajime Morita.
+
+        Add ability to open date/time choosers to WebViewClient.
+
+        - ExternalDateTimeChooser forwards DateTimeChooser requests from WebCore
+          to WebViewClient, and waits for WebDateTimeChooerCompletion notifications.
+        - WebDateTimeChooserParams contains various information to create
+          chooser UI.
+        - WebDateTimeChooserCompletion informs value selection by users to
+          ExternalDateTimeChooser.
+
+        The design is very similar to existing WebFileChooserParams and
+        WebFileChooserCompletion.
+
+        These interfaces are used only if ENABLE_INPUT_MULTIPLE_FIELDS_UI is not
+        enabled, that is to say, in Chromium-Android port. Non-Android Chromium
+        ports use DateTimeChooserImpl and WebKit-internal choosers.
+
+        * WebKit.gyp: Add WebDateTimeChooserCompletion.h,
+        WebDateTimeChooserParams.h, ExternalDateTimeChooser.cpp, and
+        ExternalDateTimeChooser.h.
+        * public/WebDateTimeChooserCompletion.h: Added.
+        (WebDateTimeChooserCompletion):
+        (WebKit::WebDateTimeChooserCompletion::~WebDateTimeChooserCompletion):
+        * public/WebDateTimeChooserParams.h: Added.
+        (WebDateTimeChooserParams):
+        (WebKit::WebDateTimeChooserParams::WebDateTimeChooserParams):
+        * public/WebViewClient.h:
+        (WebKit): Add some forward declarations.
+        (WebKit::WebViewClient::openDateTimeChooser): Added.
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::openDateTimeChooser):
+        Creates ExternalDateTimeChooser if !ENABLE(INPUT_MULTIPLE_FIELDS_UI).
+        * src/ExternalDateTimeChooser.cpp: Added.
+        (WebDateTimeChooserCompletionImpl): An implementation of
+        WebDateTimeChooserCompletion. When didChooseValue or didCancelChooser is
+        called, it notifies to an ExternalDateTimeChooser and kill itself.
+        (WebKit::ExternalDateTimeChooser::~ExternalDateTimeChooser): Added.
+        (WebKit::ExternalDateTimeChooser::ExternalDateTimeChooser): Added.
+        (WebKit::ExternalDateTimeChooser::create):
+        Cretes an object, then asks the WebViewClient to open date/time chooser.
+        If an open request fails, an empty PassRefPtr<> is returned.
+        We don't ask to open in the constructor because open requests might fail
+        and it's hard for the constructor to tell the failure.
+        (WebKit::ExternalDateTimeChooser::openDateTimeChooser): Prepares a
+        WebDateTimeChooserParams and a WebDateTimeChooserCompletion, calls
+        WebViewClient::openDateTimeChooser, and kill the
+        WebDateTimeChooserCompletion if openDateTimeChooser fails.
+        (WebKit::ExternalDateTimeChooser::didChooseValue):
+        Called by WebDateTimeChooserCompletion.
+        We need to check m_client because the requester is already dead.
+        (WebKit::ExternalDateTimeChooser::didCancelChooser): Ditto.
+        (WebKit::ExternalDateTimeChooser::endChooser):
+        Called by the requester when it wants to close the chooser.
+        We don't close the chooser here, and just disconnect the association of
+        the client and this object.
+        * src/ExternalDateTimeChooser.h: Added.
+
+2012-11-13  Vincent Scheib  <scheib@chromium.org>
+
+        Remove RuntimeEnabledFeatures::isPointerLockEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=102107
+
+        Reviewed by Adam Barth.
+
+        The runtime flag is always true now that the feature is enabled by default in Chromium.
+
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::enablePointerLock):
+
+2012-11-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-13  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Pass showDebugBorders directly to WebLayerTreeSettings, don't use the GraphicsLayer border width setting.
+        https://bugs.webkit.org/show_bug.cgi?id=102130
+
+        Reviewed by James Robinson.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+
+2012-11-13  Keishi Hattori  <keishi@webkit.org>
+
+        Enable datalist UI for input types week and month
+        https://bugs.webkit.org/show_bug.cgi?id=102041
+
+        Reviewed by Kent Tamura.
+
+        * src/DateTimeChooserImpl.cpp:
+        (WebKit::DateTimeChooserImpl::writeDocument): If the type supports calendar picker show the "Other..." option.
+
+2012-11-13  Eberhard Graether  <egraether@google.com>
+
+        checkbox to toggle FPS counter in the inspector's settings
+        https://bugs.webkit.org/show_bug.cgi?id=99660
+
+        Reviewed by Pavel Feldman.
+
+        Added a checkbox to the inspector's settings to toggle a FPS counter. The checkbox appears when InspectorClient::canShowFPSCounter() returns true.
+
+        * public/WebView.h:
+        (WebView):
+        * src/InspectorClientImpl.cpp:
+        (WebKit::InspectorClientImpl::canShowFPSCounter):
+        (WebKit):
+        (WebKit::InspectorClientImpl::setShowFPSCounter):
+        * src/InspectorClientImpl.h:
+        (InspectorClientImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::setShowFPSCounter):
+        (WebKit):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::loadFontAtlasIfNecessary):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-13  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Plumb WebCompositorSupport settings through WebLayerTreeSettings as well, in preparation for removing the settings from WebCompositorSupport
+        https://bugs.webkit.org/show_bug.cgi?id=102146
+
+        Reviewed by James Robinson.
+
+        Add accelerated animation and per-tile painting to the WebSettings structure.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setAcceleratedAnimationEnabled):
+        (WebKit):
+        (WebKit::WebSettingsImpl::setPerTilePaintingEnabled):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        (WebKit::WebSettingsImpl::gestureTapHighlightEnabled):
+        (WebKit::WebSettingsImpl::doubleTapToZoomEnabled):
+        (WebKit::WebSettingsImpl::perTilePaintingEnabled):
+        (WebKit::WebSettingsImpl::acceleratedAnimationEnabled):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+
+2012-11-13  Kenneth Russell  <kbr@google.com>
+
+        Notify embedder of lost contexts and allow overriding of WebGL support
+        https://bugs.webkit.org/show_bug.cgi?id=101826
+
+        Reviewed by Adam Barth.
+
+        Expose new FrameLoaderClient hooks through Chromium's
+        WebPermissionClient and WebFrameClient. Downstream browser tests
+        will exercise this new functionality.
+
+        * public/WebFrameClient.h:
+        (WebFrameClient):
+        (WebKit::WebFrameClient::didLoseWebGLContext):
+        * public/WebPermissionClient.h:
+        (WebPermissionClient):
+        (WebKit::WebPermissionClient::allowWebGL):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit):
+        (WebKit::FrameLoaderClientImpl::allowWebGL):
+        (WebKit::FrameLoaderClientImpl::didLoseWebGLContext):
+        * src/FrameLoaderClientImpl.h:
+        (FrameLoaderClientImpl):
+
+2012-11-13  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: MathML types need to be semantically identified in AX tree
+        https://bugs.webkit.org/show_bug.cgi?id=101263
+
+        Reviewed by Beth Dakin.
+
+        * public/WebAccessibilityRole.h:
+        * src/AssertMatchingEnums.cpp:
+            Add new accessibility role.
+
+2012-11-13  Silvia Pfeiffer  <silviapf@chromium.org>
+
+        Clean up the inheritance tree under the MediaControls Class.
+        https://bugs.webkit.org/show_bug.cgi?id=88871
+
+        Reviewed by Eric Carlson.
+
+        This patch removes code duplication between the Chromium and Safari
+        media controls shadow DOMs.
+        The derived classes are renamed based on their platform:
+        - MediaControlRootElement                to MediaControlsApple.
+        - MediaControlRootElementChromium        to MediaControlsChromium.
+        - MediaControlRootElementChromiumAndroid to MediaControlsChromiumAndroid.
+
+        * public/WebContextMenuData.h:
+          Move MediaControlRootElement to MediaControls.
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+          Move MediaControlRootElement to MediaControls.
+
+2012-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r134446.
+        http://trac.webkit.org/changeset/134446
+        https://bugs.webkit.org/show_bug.cgi?id=101968
+
+        Need to try a different strategy for landing a two-sided patch
+        (3/3).
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        (WebKit::WebSettingsImpl::gestureTapHighlightEnabled):
+        (WebKit::WebSettingsImpl::doubleTapToZoomEnabled):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+
+2012-11-13  Dan Carney  <dcarney@google.com>
+
+        [V8] More efficient wrapper dispatch
+        https://bugs.webkit.org/show_bug.cgi?id=102082
+
+        Reviewed by Adam Barth.
+
+        * src/WebArrayBuffer.cpp:
+        (WebKit::WebArrayBuffer::toV8Value):
+        * src/WebBlob.cpp:
+        (WebKit::WebBlob::toV8Value):
+
+2012-11-12  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove the WebCompositorSupport methods for changing settings, plumb everything through WebLayerTreeSettings
+        https://bugs.webkit.org/show_bug.cgi?id=101968
+
+        Reviewed by James Robinson.
+
+        This adds perTilePainting and acceleratedAniamtions to the WebSettings
+        classes, so that DRT can turn these on via WebLayerTreeSettings.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setAcceleratedAnimationEnabled):
+        (WebKit):
+        (WebKit::WebSettingsImpl::setPerTilePaintingEnabled):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        (WebKit::WebSettingsImpl::gestureTapHighlightEnabled):
+        (WebKit::WebSettingsImpl::doubleTapToZoomEnabled):
+        (WebKit::WebSettingsImpl::perTilePaintingEnabled):
+        (WebKit::WebSettingsImpl::acceleratedAnimationEnabled):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+
+2012-11-13  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: remove legacy string-based backend methods
+        https://bugs.webkit.org/show_bug.cgi?id=102004
+
+        Reviewed by Adam Barth.
+
+        This is the final stage in a refactor, preceded by
+        https://bugs.webkit.org/show_bug.cgi?id=100426
+
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::createObjectStore):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::createIndex):
+        (WebKit::WebIDBObjectStore::index):
+        * public/WebIDBTransaction.h:
+        * src/IDBDatabaseBackendProxy.cpp:
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/IDBTransactionBackendProxy.cpp:
+        * src/IDBTransactionBackendProxy.h:
+        (IDBTransactionBackendProxy):
+
+2012-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r134391.
+        http://trac.webkit.org/changeset/134391
+        https://bugs.webkit.org/show_bug.cgi?id=99660
+
+        Speculative rollout, trying to fix browser_tests failure.
+
+        * public/WebView.h:
+        (WebView):
+        * src/InspectorClientImpl.cpp:
+        * src/InspectorClientImpl.h:
+        (InspectorClientImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed: temporary disable failing test.
+
+        * tests/MemoryInstrumentationTest.cpp:
+
+2012-11-13  Eberhard Graether  <egraether@google.com>
+
+        checkbox to toggle FPS counter in the inspector's settings
+        https://bugs.webkit.org/show_bug.cgi?id=99660
+
+        Reviewed by Pavel Feldman.
+
+        Added a checkbox to the inspector's settings to toggle a FPS counter. The checkbox appears when InspectorClient::canShowFPSCounter() returns true.
+
+        * public/WebView.h:
+        (WebView):
+        * src/InspectorClientImpl.cpp:
+        (WebKit::InspectorClientImpl::canShowFPSCounter):
+        (WebKit):
+        (WebKit::InspectorClientImpl::setShowFPSCounter):
+        * src/InspectorClientImpl.h:
+        (InspectorClientImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::setShowFPSCounter):
+        (WebKit):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::loadFontAtlasIfNecessary):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-12  Kent Tamura  <tkent@chromium.org>
+
+        Unable to set valid time value to input[type=time] with user interaction in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=102048
+
+        Reviewed by Kentaro Hara.
+
+        * tests/DecimalTest.cpp:
+        (TEST_F): Update and add tests.
+        2.1 % 3 should be 2.1
+        10 % -3 should be 1
+        -10 % -3 should be -1
+        3.6 % 1.3 should be 1
+        500 % 1000 should be 500
+        -500 % 1000 should be -500
+
+2012-11-12  Min Qin  <qinmin@chromium.org>
+
+        Fix windowRect calculation for webplugin due to page scale factors
+        https://bugs.webkit.org/show_bug.cgi?id=100182
+
+        Reviewed by Adam Barth.
+
+        The current calculaton of windowRect in WebPluginContainerImpl is wrong. Even after some of our latest changes.
+        The problem is caused by page scale factor.
+        For example, windowToContents(IntPoint) will return an unscaled offset for an iframe, but will return a scaled offset for the main frame. So in order to obtain the correct window coordinate, we need to use contentsToWindow().
+        Since webview_plugin.cc is expecting window coordinates, we need to use contentsToWindow(IntRect) to calculate the windowRect so that the rect size can get correctly scaled.
+        It is difficult to write a test for this because it's pixel-based, and plugin placeholder is managed on the Chromium side (webview_plugin.cc).
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::paint):
+
+2012-11-12  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed. Roll Chromium DEPS.
+
+2012-11-12  Stephen Chenney  <schenney@chromium.org>
+
+        [chromium] Supressing a Skia change to prevent layout test breakage.
+
+        Unreviewed expectations management.
+
+        * skia_webkit.gyp: Added supression 'SK_IGNORE_FAST_BLURRECT=1'
+
+2012-11-12  Alexandre Elias  <aelias@chromium.org>
+
+        [chromium] Delete WebCompositor.h
+        https://bugs.webkit.org/show_bug.cgi?id=101137
+
+        Reviewed by James Robinson.
+
+        The implementation of this class is getting deleted and all
+        WebKit-side users are already going via WebCompositorSupport instead.
+
+        * tests/WebCompositorInputHandlerImplTest.cpp:
+
+2012-11-12  Dirk Pranke  <dpranke@chromium.org>
+
+        Fix Chromium DEPS version after accidentally checking in HEAD a couple days ago.
+
+        Unreviewed, build fix.
+
+        * DEPS:
+
+2012-11-12  Keishi Hattori  <keishi@webkit.org>
+
+        Add support for week/month to Locale::formatDateTime()
+        https://bugs.webkit.org/show_bug.cgi?id=101878
+
+        Reviewed by Kent Tamura.
+
+        * tests/LocaleMacTest.cpp:
+        (LocaleMacTest::formatWeek): Takes ISO string and returns localized string.
+        (LocaleMacTest):
+        (LocaleMacTest::formatMonth): Ditto.
+        (TEST_F):
+
+2012-11-11  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        [chromium] Expose CustomEvent through WebDOMCustomEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=101293
+
+        Reviewed by Adam Barth.
+
+        * WebKit.gyp:
+        * public/WebDOMCustomEvent.h: Added.
+        (WebKit):
+        (WebDOMCustomEvent):
+        (WebKit::WebDOMCustomEvent::WebDOMCustomEvent):
+        * src/WebDOMCustomEvent.cpp: Added.
+        (WebKit):
+        (WebKit::WebDOMCustomEvent::initCustomEvent):
+
+2012-11-09  Rick Byers  <rbyers@chromium.org>
+
+        Move chromium to USE(LAZY_NATIVE_CURSOR)
+        https://bugs.webkit.org/show_bug.cgi?id=101501
+
+        Reviewed by Adam Barth.
+
+        Update conversion from Cursor to WebCursorInfo to remove the
+        intermediate (and useless) step of PlatformCursor.
+
+        * src/AssertMatchingEnums.cpp:
+        * src/WebCursorInfo.cpp:
+        (WebKit::WebCursorInfo::WebCursorInfo):
+
+2012-11-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Combine IDBBackingStore and IDBLevelDBBackingStore
+        https://bugs.webkit.org/show_bug.cgi?id=101415
+
+        Reviewed by Tony Chang.
+
+        Remove method that is no longer in the base class.
+
+        * tests/IDBFakeBackingStore.h:
+
+2012-11-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134101.
+        http://trac.webkit.org/changeset/134101
+        https://bugs.webkit.org/show_bug.cgi?id=101790
+
+        IDBDatabaseBackendTest.BackingStoreRetention failing
+        (Requested by jsbell|gardener on #webkit).
+
+        * tests/IDBFakeBackingStore.h:
+
+2012-11-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Combine IDBBackingStore and IDBLevelDBBackingStore
+        https://bugs.webkit.org/show_bug.cgi?id=101415
+
+        Reviewed by Tony Chang.
+
+        Remove method that is no longer in the base class.
+
+        * tests/IDBFakeBackingStore.h:
+
+2012-11-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: switch frontend to use int64_t-based references
+        https://bugs.webkit.org/show_bug.cgi?id=100426
+
+        Reviewed by Tony Chang.
+
+        Remove implementation stubs from chromium API for
+        methods obsoleted by https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        * src/IDBObjectStoreBackendProxy.cpp:
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+
+2012-11-09  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Deleting all files relating to the deprecated PeerConnection00
+        https://bugs.webkit.org/show_bug.cgi?id=101730
+
+        Reviewed by Adam Barth.
+
+        Since RTCPeerConenction has superseeded PeerConnection00 this patch removes all
+        files relating to the old API.
+
+        * WebKit.gyp:
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * public/platform/WebICECandidateDescriptor.h: Removed.
+        * public/platform/WebICEOptions.h: Removed.
+        * public/platform/WebMediaHints.h: Removed.
+        * public/platform/WebPeerConnection00Handler.h: Removed.
+        * public/platform/WebPeerConnection00HandlerClient.h: Removed.
+        * public/platform/WebPeerConnectionHandler.h: Removed.
+        * public/platform/WebPeerConnectionHandlerClient.h: Removed.
+        * public/platform/WebSessionDescriptionDescriptor.h: Removed.
+        * src/AssertMatchingEnums.cpp:
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::isPeerConnectionEnabled):
+        * src/WebSessionDescriptionDescriptor.cpp: Removed.
+
+2012-11-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134010.
+        http://trac.webkit.org/changeset/134010
+        https://bugs.webkit.org/show_bug.cgi?id=101716
+
+        Broke the chromium windows build. (Requested by noel_ on
+        #webkit).
+
+        * src/IDBCallbacksProxy.cpp:
+        * src/IDBDatabaseBackendProxy.cpp:
+        (WebKit::IDBDatabaseBackendProxy::transaction):
+        (WebKit):
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::putWithIndexKeys):
+        (WebKit):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexKeys):
+        (WebKit::IDBObjectStoreBackendProxy::createIndex):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexesReady):
+        (WebKit::IDBObjectStoreBackendProxy::index):
+        (WebKit::IDBObjectStoreBackendProxy::deleteIndex):
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp:
+        (WebKit::WebIDBDatabaseImpl::deleteObjectStore):
+        (WebKit):
+        (WebKit::WebIDBDatabaseImpl::transaction):
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::putWithIndexKeys):
+        (WebKit):
+        (WebKit::WebIDBObjectStoreImpl::setIndexKeys):
+        (WebKit::WebIDBObjectStoreImpl::setIndexesReady):
+        (WebKit::WebIDBObjectStoreImpl::index):
+        (WebKit::WebIDBObjectStoreImpl::deleteIndex):
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+        * src/WebIDBTransactionImpl.cpp:
+        (WebKit::WebIDBTransactionImpl::objectStore):
+        (WebKit):
+        * src/WebIDBTransactionImpl.h:
+        * tests/IDBRequestTest.cpp:
+
+2012-11-08  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: switch frontend to use int64_t-based references
+        https://bugs.webkit.org/show_bug.cgi?id=100426
+
+        Reviewed by Tony Chang.
+
+        Remove implementation stubs from chromium API for
+        methods obsoleted by https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        * src/IDBObjectStoreBackendProxy.cpp:
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+
+2012-11-08  Keishi Hattori  <keishi@webkit.org>
+
+        WebPagePopupImpl::handleKeyEvent is called after WebPagePopupImpl::close
+        https://bugs.webkit.org/show_bug.cgi?id=93800
+
+        Reviewed by Kent Tamura.
+
+        We need to set m_closing to true in WebPagePopupImpl::close so we won't access m_page in WebPagePopupImpl::handleKeyEvent.
+
+        * src/WebPagePopupImpl.cpp:
+        (WebKit::WebPagePopupImpl::close): Set m_closing to true.
+
+2012-11-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133984.
+        http://trac.webkit.org/changeset/133984
+        https://bugs.webkit.org/show_bug.cgi?id=101684
+
+        windows build error. (Requested by hayato on #webkit).
+
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::putWithIndexKeys):
+        (WebKit):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexKeys):
+        (WebKit::IDBObjectStoreBackendProxy::createIndex):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexesReady):
+        (WebKit::IDBObjectStoreBackendProxy::index):
+        (WebKit::IDBObjectStoreBackendProxy::deleteIndex):
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp:
+        (WebKit::WebIDBDatabaseImpl::deleteObjectStore):
+        (WebKit):
+        (WebKit::WebIDBDatabaseImpl::transaction):
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::putWithIndexKeys):
+        (WebKit):
+        (WebKit::WebIDBObjectStoreImpl::setIndexKeys):
+        (WebKit::WebIDBObjectStoreImpl::setIndexesReady):
+        (WebKit::WebIDBObjectStoreImpl::index):
+        (WebKit::WebIDBObjectStoreImpl::deleteIndex):
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+        * src/WebIDBTransactionImpl.cpp:
+        (WebKit::WebIDBTransactionImpl::objectStore):
+        (WebKit):
+        * src/WebIDBTransactionImpl.h:
+
+2012-11-08  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: switch frontend to use int64_t-based references
+        https://bugs.webkit.org/show_bug.cgi?id=100426
+
+        Reviewed by Tony Chang.
+
+        Remove implementation stubs from chromium API for
+        methods obsoleted by https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        * src/IDBObjectStoreBackendProxy.cpp:
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+
+2012-11-07  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] WebElement::hasHTMLTagName returns true for non-HTML elements
+        https://bugs.webkit.org/show_bug.cgi?id=101537
+
+        Reviewed by Abhishek Arya.
+
+        We should not do ignore-case comparison for tagName, which is always
+        upper-case and createElementNS(xhtmlNS, "INPUT") doesn't create an
+        HTMLInputElement object. We need to check if localName is equal to
+        "input" in this case.
+
+        * src/WebElement.cpp:
+        (WebKit::WebElement::hasHTMLTagName):
+
+2012-11-08  Joshua Bell  <jsbell@chromium.org>
+
+        Expose snapshots in platform/leveldb wrapper API
+        https://bugs.webkit.org/show_bug.cgi?id=100786
+
+        Reviewed by Tony Chang.
+
+        Add unit tests for transactions/snapshots.
+
+        * tests/LevelDBTest.cpp:
+        (WebCore::encodeString): Don't append to pre-sized vector.
+        (WebCore::TEST):
+        (WebCore):
+
 2012-11-08  Adam Barth  <abarth@webkit.org>
 
         Unreviewed.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index ba3dd966e..222eb8b45 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '166755'
+  'chromium_rev': '169021'
 }
 
 deps = {
@@ -137,6 +137,8 @@ deps = {
     From('chromium_deps', 'src/third_party/libjpeg_turbo'),
   'third_party/leveldatabase/src':
     From('chromium_deps', 'src/third_party/leveldatabase/src'),
+  'third_party/smhasher/src':
+    From('chromium_deps', 'src/third_party/smhasher/src'),
   'third_party/snappy/src':
     From('chromium_deps', 'src/third_party/snappy/src'),
   'third_party/sfntly/cpp/src':
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 74ef9bfcf..0dd53bfa3 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -120,6 +120,7 @@
                 'public/WebContextMenuData.h',
                 'public/WebCrossOriginPreflightResultCache.h',
                 'public/WebCursorInfo.h',
+                'public/WebDOMCustomEvent.h',
                 'public/WebDOMEvent.h',
                 'public/WebDOMEventListener.h',
                 'public/WebDOMMessageEvent.h',
@@ -129,6 +130,8 @@
                 'public/WebDataSource.h',
                 'public/WebDatabase.h',
                 'public/WebDatabaseObserver.h',
+                'public/WebDateTimeChooserCompletion.h',
+                'public/WebDateTimeChooserParams.h',
                 'public/WebDeliveredIntentClient.h',
                 'public/WebDevToolsAgent.h',
                 'public/WebDevToolsAgentClient.h',
@@ -359,6 +362,8 @@
                 'src/DateTimeChooserImpl.h',
                 'src/ChromeClientImpl.cpp',
                 'src/ChromeClientImpl.h',
+                'src/ColorChooserPopupUIController.cpp',
+                'src/ColorChooserPopupUIController.h',
                 'src/ColorChooserUIController.cpp',
                 'src/ColorChooserUIController.h',
                 'src/CompositionUnderlineBuilder.h',
@@ -383,12 +388,15 @@
                 'src/EditorClientImpl.h',
                 'src/EventListenerWrapper.cpp',
                 'src/EventListenerWrapper.h',
+                'src/ExternalDateTimeChooser.cpp',
+                'src/ExternalDateTimeChooser.h',
                 'src/ExternalPopupMenu.cpp',
                 'src/ExternalPopupMenu.h',
                 'src/FindInPageCoordinates.cpp',
                 'src/FindInPageCoordinates.h',
                 'src/FrameLoaderClientImpl.cpp',
                 'src/FrameLoaderClientImpl.h',
+                'src/FrameNetworkingContextImpl.cpp',
                 'src/FrameNetworkingContextImpl.h',
                 'src/GeolocationClientProxy.cpp',
                 'src/GeolocationClientProxy.h',
@@ -487,6 +495,7 @@
                 'src/WebCompositorInputHandlerImpl.h',
                 'src/WebCrossOriginPreflightResultCache.cpp',
                 'src/WebCursorInfo.cpp',
+                'src/WebDOMCustomEvent.cpp',
                 'src/WebDOMEvent.cpp',
                 'src/WebDOMEventListener.cpp',
                 'src/WebDOMEventListenerPrivate.cpp',
@@ -612,7 +621,6 @@
                 'src/WebSecurityPolicy.cpp',
                 'src/WebSelectElement.cpp',
                 'src/WebSerializedScriptValue.cpp',
-                'src/WebSessionDescriptionDescriptor.cpp',
                 'src/WebSettingsImpl.cpp',
                 'src/WebSettingsImpl.h',
                 'src/WebSharedWorkerImpl.cpp',
@@ -709,6 +717,7 @@
                                 # functions defined only in !WEBKIT_IMPLEMENTATION.
                                 'tests/AssociatedURLLoaderTest.cpp',
                                 'tests/EventListenerTest.cpp',
+                                'tests/FakeWebPlugin.cpp',
                                 'tests/FrameTestHelpers.cpp',
                                 'tests/IDBBindingUtilitiesTest.cpp',
                                 'tests/LevelDBTest.cpp',
@@ -723,6 +732,7 @@
                                 'tests/WebImageTest.cpp',
                                 'tests/WebPageNewSerializerTest.cpp',
                                 'tests/WebPageSerializerTest.cpp',
+                                'tests/WebPluginContainerTest.cpp',
                                 'tests/WebViewTest.cpp',
                             ],
                             'conditions': [
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index 18c6a8c35..dd5d6cf1b 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -64,6 +64,8 @@
             'tests/DeferredImageDecoderTest.cpp',
             'tests/DragImageTest.cpp',
             'tests/EventListenerTest.cpp',
+            'tests/FakeWebPlugin.cpp',
+            'tests/FakeWebPlugin.h',
             'tests/FakeWebCompositorOutputSurface.h',
             'tests/FakeWebGraphicsContext3D.h',
             'tests/FilterOperationsTest.cpp',
@@ -86,7 +88,6 @@
             'tests/LinkHighlightTest.cpp',
             'tests/ListenerLeakTest.cpp',
             'tests/MemoryInfo.cpp',
-            'tests/MemoryInstrumentationTest.cpp',
             'tests/OpaqueRectTrackingContentLayerDelegateTest.cpp',
             'tests/OpenTypeVerticalDataTest.cpp',
             'tests/PODArenaTest.cpp',
@@ -114,6 +115,7 @@
             'tests/WebMediaPlayerClientImplTest.cpp',
             'tests/WebPageNewSerializerTest.cpp',
             'tests/WebPageSerializerTest.cpp',
+            'tests/WebPluginContainerTest.cpp',
             'tests/WebSocketDeflaterTest.cpp',
             'tests/WebSocketExtensionDispatcherTest.cpp',
             'tests/WebURLRequestTest.cpp',
diff --git a/Source/WebKit/chromium/WebKitUnitTests.gyp b/Source/WebKit/chromium/WebKitUnitTests.gyp
index 5dcfcd2b4..691cb5c65 100644
--- a/Source/WebKit/chromium/WebKitUnitTests.gyp
+++ b/Source/WebKit/chromium/WebKitUnitTests.gyp
@@ -119,6 +119,7 @@
                     'type': 'shared_library',
                     'dependencies': [
                         '<(chromium_src_dir)/testing/android/native_test.gyp:native_test_native_code',
+                        '<(chromium_src_dir)/tools/android/forwarder2/forwarder.gyp:forwarder2',
                     ],
                 }],
                 ['OS=="mac"', {
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index f386deb77..4f43106d3 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -45,7 +45,6 @@
       'ENABLE_CSS_DEVICE_ADAPTATION=0',
       'ENABLE_CSS_EXCLUSIONS=1',
       'ENABLE_CSS_FILTERS=1',
-      'ENABLE_CSS_HIERARCHIES=0',
       'ENABLE_CSS_IMAGE_SET=1',
       'ENABLE_CSS_IMAGE_RESOLUTION=0',
       'ENABLE_CSS_REGIONS=1',
@@ -95,6 +94,7 @@
       'ENABLE_PAGE_VISIBILITY_API=1',
       'ENABLE_POINTER_LOCK=1',
       'ENABLE_PROGRESS_ELEMENT=1',
+      'ENABLE_PROXIMITY_EVENTS=0',
       'ENABLE_QUOTA=1',
       'ENABLE_RESOLUTION_MEDIA_QUERY=0',
       'ENABLE_REQUEST_ANIMATION_FRAME=1',
@@ -145,11 +145,13 @@
       'enable_touch_events%': 1,
       'enable_touch_icon_loading%' : 0,
       'enable_mutation_observers%': 1,
+      'use_default_render_theme%': 0,
     },
     'use_accelerated_compositing%': '<(use_accelerated_compositing)',
     'enable_skia_text%': '<(enable_skia_text)',
     'enable_svg%': '<(enable_svg)',
     'enable_touch_events%': '<(enable_touch_events)',
+    'use_default_render_theme%': '<(use_default_render_theme)',
     'conditions': [
       ['OS=="android"', {
         'feature_defines': [
@@ -239,6 +241,11 @@
           'SK_SUPPORT_HINTING_SCALE_FACTOR',
         ],
       }],
+      ['use_default_render_theme==1', {
+        'feature_defines': [
+          'ENABLE_DEFAULT_RENDER_THEME=1',
+        ],
+      }],
     ],
   },
 }
diff --git a/Source/WebKit/chromium/public/WebAccessibilityRole.h b/Source/WebKit/chromium/public/WebAccessibilityRole.h
index 031a69da9..0008724ec 100644
--- a/Source/WebKit/chromium/public/WebAccessibilityRole.h
+++ b/Source/WebKit/chromium/public/WebAccessibilityRole.h
@@ -96,6 +96,7 @@ enum WebAccessibilityRole {
     WebAccessibilityRoleListBoxOption,
     WebAccessibilityRoleListItem,
     WebAccessibilityRoleListMarker,
+    WebAccessibilityRoleMathElement,
     WebAccessibilityRoleMatte,
     WebAccessibilityRoleMenu,
     WebAccessibilityRoleMenuBar,
diff --git a/Source/WebKit/chromium/public/WebContextMenuData.h b/Source/WebKit/chromium/public/WebContextMenuData.h
index a36372192..7aaee9d52 100644
--- a/Source/WebKit/chromium/public/WebContextMenuData.h
+++ b/Source/WebKit/chromium/public/WebContextMenuData.h
@@ -100,7 +100,9 @@ struct WebContextMenuData {
         MediaCanSave = 0x10,
         MediaHasAudio = 0x20,
         MediaHasVideo = 0x40,
+        // FIXME: Remove MediaControlRootElement after patch lands for webkit.org/b/88871.
         MediaControlRootElement = 0x80,
+        MediaControls = 0x80,
         MediaCanPrint = 0x100,
         MediaCanRotate = 0x200,
     };
diff --git a/Source/WebKit/chromium/public/WebCursorInfo.h b/Source/WebKit/chromium/public/WebCursorInfo.h
index cc8bc59bd..2982b6c53 100644
--- a/Source/WebKit/chromium/public/WebCursorInfo.h
+++ b/Source/WebKit/chromium/public/WebCursorInfo.h
@@ -95,6 +95,7 @@ struct WebCursorInfo {
 
     Type type;
     WebPoint hotSpot;
+    float imageScaleFactor;
     WebImage customImage;
 
 #ifdef WIN32
@@ -107,6 +108,7 @@ struct WebCursorInfo {
 
     explicit WebCursorInfo(Type type = TypePointer)
         : type(type)
+        , imageScaleFactor(1)
     {
 #ifdef WIN32
         externalHandle = 0;
diff --git a/Source/WebKit/chromium/public/WebDOMCustomEvent.h b/Source/WebKit/chromium/public/WebDOMCustomEvent.h
new file mode 100644
index 000000000..15f1f80d3
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebDOMCustomEvent.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef WebDOMCustomEvent_h
+#define WebDOMCustomEvent_h
+
+#include "WebDOMEvent.h"
+#include "platform/WebSerializedScriptValue.h"
+
+namespace WebKit {
+
+class WebFrame;
+class WebString;
+
+class WebDOMCustomEvent : public WebDOMEvent {
+public:
+    WebDOMCustomEvent() { }
+    WEBKIT_EXPORT void initCustomEvent(const WebString& type, bool canBubble, bool cancelable, const WebSerializedScriptValue& messageData);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebDateTimeChooserCompletion.h b/Source/WebKit/chromium/public/WebDateTimeChooserCompletion.h
new file mode 100644
index 000000000..5404d7b1f
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebDateTimeChooserCompletion.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef WebDateTimeChooserCompletion_h
+#define WebDateTimeChooserCompletion_h
+
+#include "platform/WebString.h"
+
+namespace WebKit {
+
+// Gets called back when WebViewClient finished choosing a date/time value.
+class WebDateTimeChooserCompletion {
+public:
+
+    // Called with a date/time value in the HTML format. The callback instance
+    // is destroyed when this method is called.
+    virtual void didChooseValue(const WebString&) = 0;
+
+    // Called when a user closed the chooser without choosing a value. The
+    // callback instance is destroyed when this method is called.
+    virtual void didCancelChooser() = 0;
+
+protected:
+    virtual ~WebDateTimeChooserCompletion() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebDateTimeChooserParams.h b/Source/WebKit/chromium/public/WebDateTimeChooserParams.h
new file mode 100644
index 000000000..c36b98b46
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebDateTimeChooserParams.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef WebDateTimeChooserParams_h
+#define WebDateTimeChooserParams_h
+
+#include "platform/WebRect.h"
+#include "platform/WebString.h"
+#include "platform/WebVector.h"
+
+namespace WebKit {
+
+// This class conveys various information to make date/time chooser UI.
+// See WebViewClient::openDateTimeChooser.
+struct WebDateTimeChooserParams {
+    // Input type string. This is one of "date", "datetime", "datetime-local",
+    // "month", "time", and "week".
+    WebString type;
+    // Bounding rectangle of the requester element.
+    WebRect anchorRectInScreen;
+    // The current value of the requester element.
+    WebString currentValue;
+    // <datalist> option values associated to the requester element. These
+    // values should not be shown to users. The vector size might be 0.
+    WebVector<WebString> suggestionValues;
+    // Localized values of <datalist> options associated to the requester
+    // element. These values should be shown to users. The vector size must be
+    // same as suggestionValues size.
+    WebVector<WebString> localizedSuggestionValues;
+    // <datalist> option labels associated to the requester element. These
+    // values should be shown to users. The vector size must be same as
+    // suggestionValues size.
+    WebVector<WebString> suggestionLabels;
+    // HTMLInputElement::min attribute value parsed in the valusAsNumber rule,
+    // that is to say, milliseconds from the epoch for non-month types and
+    // months from the epoch for month type. If the min attribute is missing,
+    // this field has the hard minimum limit.
+    double minimum;
+    // Similar to minimum.
+    double maximum;
+    // Step value represented in milliseconds for non-month types, and
+    // represetnted in months for month type.
+    double step;
+    // Step-base value represeted in milliseconds, or months.
+    double stepBase;
+    // True if the requester element has required attribute.
+    bool isRequired;
+    // True if the requester element is rendered in rtl direction.
+    bool isAnchorElementRTL;
+
+    WebDateTimeChooserParams()
+        : minimum(0)
+        , maximum(0)
+        , step(0)
+        , stepBase(0)
+        , isRequired(false)
+        , isAnchorElementRTL(false)
+    {
+    }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebFrameClient.h b/Source/WebKit/chromium/public/WebFrameClient.h
index 73980bf7f..bda3c0389 100644
--- a/Source/WebKit/chromium/public/WebFrameClient.h
+++ b/Source/WebKit/chromium/public/WebFrameClient.h
@@ -420,6 +420,19 @@ public:
     // Platform::current()->userAgent() will be called to provide one.
     virtual WebString userAgentOverride(WebFrame*, const WebURL& url) { return WebString(); }
 
+    // WebGL ------------------------------------------------------
+
+    // Asks the embedder whether WebGL is allowed for the given WebFrame.
+    // This call is placed here instead of WebPermissionClient because this
+    // class is implemented in content/, and putting it here avoids adding
+    // more public content/ APIs.
+    virtual bool allowWebGL(WebFrame*, bool defaultValue) { return defaultValue; }
+
+    // Notifies the client that a WebGL context was lost on this page with the
+    // given reason (one of the GL_ARB_robustness status codes; see
+    // Extensions3D.h in WebCore/platform/graphics).
+    virtual void didLoseWebGLContext(WebFrame*, int) { }
+
 protected:
     ~WebFrameClient() { }
 };
diff --git a/Source/WebKit/chromium/public/WebIDBDatabase.h b/Source/WebKit/chromium/public/WebIDBDatabase.h
index f02bbf44c..b92799039 100644
--- a/Source/WebKit/chromium/public/WebIDBDatabase.h
+++ b/Source/WebKit/chromium/public/WebIDBDatabase.h
@@ -55,15 +55,9 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
-    virtual void deleteObjectStore(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteObjectStore(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     // Transfers ownership of the WebIDBTransaction to the caller.
-    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode& ec)
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
     virtual WebIDBTransaction* transaction(const WebVector<long long>&, unsigned short mode)
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index 7bda1a20d..455417160 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -55,7 +55,6 @@ public:
 
     typedef WebVector<WebIDBKey> WebIndexKeys;
 
-    virtual void putWithIndexKeys(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<WebString>& indexNames, const WebVector<WebIndexKeys>&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<long long>& indexIds, const WebVector<WebIndexKeys>&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
@@ -69,22 +68,14 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
-    virtual void setIndexKeys(const WebIDBKey&, const WebVector<WebString>&, const WebVector<WebIndexKeys>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void setIndexKeys(const WebIDBKey&, const WebVector<long long>&, const WebVector<WebIndexKeys>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void setIndexesReady(const WebVector<WebString>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); };
     virtual void setIndexesReady(const WebVector<long long>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); };
     // Transfers ownership of the WebIDBIndex to the caller.
-    virtual WebIDBIndex* index(const WebString& name, WebExceptionCode&)
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
     virtual WebIDBIndex* index(long long)
     {
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
-    virtual void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteIndex(long long indexId, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBTransaction.h b/Source/WebKit/chromium/public/WebIDBTransaction.h
index bac2da88d..221bf6056 100644
--- a/Source/WebKit/chromium/public/WebIDBTransaction.h
+++ b/Source/WebKit/chromium/public/WebIDBTransaction.h
@@ -46,11 +46,6 @@ public:
         PreemptiveTask
     };
 
-    virtual WebIDBObjectStore* objectStore(const WebString& name, WebExceptionCode&)
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
     virtual WebIDBObjectStore* objectStore(long long, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/chromium/public/WebInputElement.h b/Source/WebKit/chromium/public/WebInputElement.h
index fbc350012..29432df81 100644
--- a/Source/WebKit/chromium/public/WebInputElement.h
+++ b/Source/WebKit/chromium/public/WebInputElement.h
@@ -74,6 +74,7 @@ namespace WebKit {
         WEBKIT_EXPORT void setActivatedSubmit(bool);
         WEBKIT_EXPORT int size() const;
         WEBKIT_EXPORT void setValue(const WebString&, bool sendChangeEvent = false);
+        WEBKIT_EXPORT void setChecked(bool, bool sendChangeEvent = false);
         WEBKIT_EXPORT WebString value() const;
         // This returns the non-sanitized, exact value inside the text field.
         WEBKIT_EXPORT WebString editingValue() const;
diff --git a/Source/WebKit/chromium/public/WebNode.h b/Source/WebKit/chromium/public/WebNode.h
index 5869aeec6..e84a7b01b 100644
--- a/Source/WebKit/chromium/public/WebNode.h
+++ b/Source/WebKit/chromium/public/WebNode.h
@@ -45,6 +45,7 @@ class WebDocument;
 class WebElement;
 class WebFrame;
 class WebNodeList;
+class WebPluginContainer;
 
 // Provides access to some properties of a DOM node.
 class WebNode {
@@ -119,6 +120,7 @@ public:
     // This does not 100% guarantee the user can see it, but is pretty close.
     // Note: This method only works properly after layout has occurred.
     WEBKIT_EXPORT bool hasNonEmptyBoundingBox() const;
+    WEBKIT_EXPORT WebPluginContainer* pluginContainer() const;
 
     template<typename T> T to()
     {
diff --git a/Source/WebKit/chromium/public/WebPasswordFormData.h b/Source/WebKit/chromium/public/WebPasswordFormData.h
index c1a106509..12c2a5979 100644
--- a/Source/WebKit/chromium/public/WebPasswordFormData.h
+++ b/Source/WebKit/chromium/public/WebPasswordFormData.h
@@ -97,12 +97,20 @@ struct WebPasswordFormData {
     // When parsing an HTML form, this is typically empty.
     WebString passwordValue;
 
+    // Value of shouldAutocomplete for the password element.
+    bool passwordShouldAutocomplete;
+
     // If the form was a change password form, the name of the
     // 'old password' input element. Optional.
     WebString oldPasswordElement;
 
     // The old password. Optional.
     WebString oldPasswordValue;
+
+    WebPasswordFormData()
+        : passwordShouldAutocomplete(false)
+    {
+    }
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index debe26038..1229014da 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -31,6 +31,8 @@
 #ifndef WebPluginContainer_h
 #define WebPluginContainer_h
 
+#include "platform/WebCommon.h"
+
 struct NPObject;
 
 namespace WebKit {
@@ -40,6 +42,7 @@ class WebPlugin;
 class WebString;
 class WebURL;
 class WebURLRequest;
+struct WebPoint;
 struct WebRect;
 
 class WebPluginContainer {
@@ -111,6 +114,15 @@ public:
     // Notifies when the plugin starts/stops accepting touch events.
     virtual void setIsAcceptingTouchEvents(bool) = 0;
 
+    // Notifies when the plugin starts/stops accepting wheel events. Without
+    // calling the function with true, the container might not always able to
+    // receive wheel events in some cases (such as when threaded compositing
+    // is in use but a scroll bar is not in use).
+    virtual void setWantsWheelEvents(bool) = 0;
+
+    // Converts view's window coordinates to plugin's local coordinates.
+    virtual WebPoint windowToLocalPoint(const WebPoint&) = 0;
+
     virtual WebPlugin* plugin() = 0;
     virtual void setPlugin(WebPlugin*) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index a8082606c..2f6ef1ce4 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -108,15 +108,10 @@ public:
 
     WEBKIT_EXPORT static void enablePeerConnection(bool);
     WEBKIT_EXPORT static bool isPeerConnectionEnabled();
-    WEBKIT_EXPORT static void enableDeprecatedPeerConnection(bool);
-    WEBKIT_EXPORT static bool isDeprecatedPeerConnectionEnabled();
 
     WEBKIT_EXPORT static void enableFullScreenAPI(bool);
     WEBKIT_EXPORT static bool isFullScreenAPIEnabled();
 
-    WEBKIT_EXPORT static void enablePointerLock(bool);
-    WEBKIT_EXPORT static bool isPointerLockEnabled();
-
     WEBKIT_EXPORT static void enableMediaSource(bool);
     WEBKIT_EXPORT static bool isMediaSourceEnabled();
 
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index ddebd7e61..2d356fa6a 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -56,6 +56,7 @@ public:
     virtual bool scrollAnimatorEnabled() const = 0;
     virtual bool viewportEnabled() const = 0;
     virtual void setAccelerated2dCanvasEnabled(bool) = 0;
+    virtual void setAcceleratedAnimationEnabled(bool) = 0;
     virtual void setAcceleratedCompositingEnabled(bool) = 0;
     virtual void setAcceleratedCompositingFor3DTransformsEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForAnimationEnabled(bool) = 0;
@@ -68,10 +69,11 @@ public:
     virtual void setAcceleratedPaintingEnabled(bool) = 0;
     virtual void setAllowDisplayOfInsecureContent(bool) = 0;
     virtual void setAllowFileAccessFromFileURLs(bool) = 0;
+    virtual void setAllowCustomScrollbarInMainFrame(bool) = 0;
     virtual void setAllowRunningOfInsecureContent(bool) = 0;
     virtual void setAllowScriptsToCloseWindows(bool) = 0;
     virtual void setAllowUniversalAccessFromFileURLs(bool) = 0;
-    virtual void setApplyDefaultDeviceScaleFactorInCompositor(bool) = 0;
+    virtual void setApplyDeviceScaleFactorInCompositor(bool) = 0;
     virtual void setApplyPageScaleFactorInCompositor(bool) = 0;
     virtual void setAsynchronousSpellCheckingEnabled(bool) = 0;
     virtual void setAutoZoomFocusedNodeToLegibleScale(bool) = 0;
@@ -95,6 +97,7 @@ public:
     virtual void setEditableLinkBehaviorNeverLive() = 0;
     virtual void setEditingBehavior(EditingBehavior) = 0;
     virtual void setEnableScrollAnimator(bool) = 0;
+    virtual void setEnableTouchAdjustment(bool) = 0;
     virtual void setExperimentalCSSCustomFilterEnabled(bool) = 0;
     virtual void setExperimentalCSSGridLayoutEnabled(bool) = 0;
     virtual void setCSSStickyPositionEnabled(bool) = 0;
@@ -134,6 +137,7 @@ public:
     virtual void setPageCacheSupportsPlugins(bool) = 0;
     virtual void setPasswordEchoDurationInSeconds(double) = 0;
     virtual void setPasswordEchoEnabled(bool) = 0;
+    virtual void setPerTilePaintingEnabled(bool) = 0;
     virtual void setPictographFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setPluginsEnabled(bool) = 0;
     virtual void setPrivilegedWebGLExtensionsEnabled(bool) = 0;
@@ -166,8 +170,8 @@ public:
     virtual void setWebSecurityEnabled(bool) = 0;
     virtual void setXSSAuditorEnabled(bool) = 0;
 
-    // DEPRECATED
-    virtual void setDefaultDeviceScaleFactor(int) { }
+    // DEPRECATED (renamed. remove this after all call sites changed to the new name)
+    void setApplyDefaultDeviceScaleFactorInCompositor(bool enabled) { setApplyDeviceScaleFactorInCompositor(enabled); }
 
 protected:
     ~WebSettings() { }
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index 49aaa5138..2ec1b1bad 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -471,6 +471,8 @@ public:
 
     virtual bool isSelectionEditable() const = 0;
 
+    virtual void setShowFPSCounter(bool) = 0;
+
     // Benchmarking support -------------------------------------------------
 
     virtual WebViewBenchmarkSupport* benchmarkSupport() { return 0; }
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index da6498d30..5b3cbc0b1 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -53,6 +53,7 @@ class WebBatteryStatusClient;
 class WebColorChooser;
 class WebColorChooserClient;
 class WebCompositorOutputSurface;
+class WebDateTimeChooserCompletion;
 class WebDeviceOrientationClient;
 class WebDragData;
 class WebElement;
@@ -83,6 +84,7 @@ class WebView;
 class WebWidget;
 struct WebConsoleMessage;
 struct WebContextMenuData;
+struct WebDateTimeChooserParams;
 struct WebPoint;
 struct WebPopupMenuInfo;
 struct WebRect;
@@ -222,6 +224,13 @@ public:
     virtual bool runFileChooser(const WebFileChooserParams&,
                                 WebFileChooserCompletion*) { return false; }
 
+    // Ask users to choose date/time for the specified parameters. When a user
+    // chooses a value, an implemenattion of this function should call
+    // WebDateTimeChooserCompletion::didChooseValue or didCancelChooser. If the
+    // implementation opened date/time chooser UI successfully, it should return
+    // true. This function is used only if ExternalDateTimeChooser is used.
+    virtual bool openDateTimeChooser(const WebDateTimeChooserParams&, WebDateTimeChooserCompletion*) { return false; }
+
     // Displays a modal alert dialog containing the given message.  Returns
     // once the user dismisses the dialog.
     virtual void runModalAlertDialog(
diff --git a/Source/WebKit/chromium/public/platform/WebICECandidateDescriptor.h b/Source/WebKit/chromium/public/platform/WebICECandidateDescriptor.h
deleted file mode 100644
index 56ea93146..000000000
--- a/Source/WebKit/chromium/public/platform/WebICECandidateDescriptor.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebICECandidateDescriptor.h"
diff --git a/Source/WebKit/chromium/public/platform/WebICEOptions.h b/Source/WebKit/chromium/public/platform/WebICEOptions.h
deleted file mode 100644
index 0f2e46000..000000000
--- a/Source/WebKit/chromium/public/platform/WebICEOptions.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebICEOptions.h"
diff --git a/Source/WebKit/chromium/public/platform/WebMediaHints.h b/Source/WebKit/chromium/public/platform/WebMediaHints.h
deleted file mode 100644
index b27836db5..000000000
--- a/Source/WebKit/chromium/public/platform/WebMediaHints.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebMediaHints.h"
diff --git a/Source/WebKit/chromium/public/platform/WebPeerConnection00Handler.h b/Source/WebKit/chromium/public/platform/WebPeerConnection00Handler.h
deleted file mode 100644
index e87ec99e7..000000000
--- a/Source/WebKit/chromium/public/platform/WebPeerConnection00Handler.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebPeerConnection00Handler.h"
diff --git a/Source/WebKit/chromium/public/platform/WebPeerConnection00HandlerClient.h b/Source/WebKit/chromium/public/platform/WebPeerConnection00HandlerClient.h
deleted file mode 100644
index e6ba56cfc..000000000
--- a/Source/WebKit/chromium/public/platform/WebPeerConnection00HandlerClient.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebPeerConnection00HandlerClient.h"
diff --git a/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h b/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h
deleted file mode 100644
index e68710c96..000000000
--- a/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebPeerConnectionHandler.h"
diff --git a/Source/WebKit/chromium/public/platform/WebPeerConnectionHandlerClient.h b/Source/WebKit/chromium/public/platform/WebPeerConnectionHandlerClient.h
deleted file mode 100644
index defa67c45..000000000
--- a/Source/WebKit/chromium/public/platform/WebPeerConnectionHandlerClient.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebPeerConnectionHandlerClient.h"
diff --git a/Source/WebKit/chromium/public/platform/WebSessionDescriptionDescriptor.h b/Source/WebKit/chromium/public/platform/WebSessionDescriptionDescriptor.h
deleted file mode 100644
index 8b1d2a255..000000000
--- a/Source/WebKit/chromium/public/platform/WebSessionDescriptionDescriptor.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebSessionDescriptionDescriptor.h"
diff --git a/Source/WebKit/chromium/public/platform/default/WebThemeEngine.h b/Source/WebKit/chromium/public/platform/default/WebThemeEngine.h
new file mode 100644
index 000000000..3d7d130c2
--- /dev/null
+++ b/Source/WebKit/chromium/public/platform/default/WebThemeEngine.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "../../../../../Platform/chromium/public/default/WebThemeEngine.h"
diff --git a/Source/WebKit/chromium/skia_webkit.gyp b/Source/WebKit/chromium/skia_webkit.gyp
index d56e81d18..14a740d0c 100644
--- a/Source/WebKit/chromium/skia_webkit.gyp
+++ b/Source/WebKit/chromium/skia_webkit.gyp
@@ -47,9 +47,11 @@
 
           # Temporarily ignore fix to antialias coverage, until we can rebaseline
           'SK_USE_LEGACY_AA_COVERAGE',
+
+          # When enabled yields a 10x speedup on some devices.
+          'SK_DISABLE_FAST_AA_STROKE_RECT',
         ],
       },
     },
   ],
 }
-
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index f3e7859ee..3ee9fcac5 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -37,6 +37,7 @@
 #include "AccessibilityObject.h"
 #include "ApplicationCacheHost.h"
 #include "ContentSecurityPolicy.h"
+#include "Cursor.h"
 #include "DocumentMarker.h"
 #include "EditorInsertAction.h"
 #include "ExceptionCode.h"
@@ -59,14 +60,11 @@
 #include "IDBKeyPath.h"
 #include "IDBMetadata.h"
 #include "IDBTransactionBackendInterface.h"
-#include "IceOptions.h"
 #include "IconURL.h"
 #include "MediaPlayer.h"
 #include "MediaStreamSource.h"
 #include "NotificationClient.h"
 #include "PageVisibilityState.h"
-#include "PeerConnection00.h"
-#include "PlatformCursor.h"
 #include "RTCDataChannelDescriptor.h"
 #include "RTCPeerConnectionHandlerClient.h"
 #include "ReferrerPolicy.h"
@@ -119,10 +117,7 @@
 #include <public/WebClipboard.h>
 #include <public/WebFileSystem.h>
 #include <public/WebFilterOperation.h>
-#include <public/WebICEOptions.h>
 #include <public/WebMediaStreamSource.h>
-#include <public/WebPeerConnection00Handler.h>
-#include <public/WebPeerConnection00HandlerClient.h>
 #include <public/WebRTCDataChannel.h>
 #include <public/WebRTCPeerConnectionHandler.h>
 #include <public/WebRTCPeerConnectionHandlerClient.h>
@@ -216,6 +211,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleWebCoreLink, WebCoreLinkRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleImageMapLink, ImageMapLinkRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleImageMap, ImageMapRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleListMarker, ListMarkerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleMathElement, MathElementRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleWebArea, WebAreaRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleHeading, HeadingRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleListBox, ListBoxRole);
@@ -285,50 +281,50 @@ COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::UpdateReadyEvent, Applicat
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::CachedEvent, ApplicationCacheHost::CACHED_EVENT);
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::ObsoleteEvent, ApplicationCacheHost::OBSOLETE_EVENT);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypePointer, PlatformCursor::TypePointer);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCross, PlatformCursor::TypeCross);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeHand, PlatformCursor::TypeHand);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeIBeam, PlatformCursor::TypeIBeam);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWait, PlatformCursor::TypeWait);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeHelp, PlatformCursor::TypeHelp);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastResize, PlatformCursor::TypeEastResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthResize, PlatformCursor::TypeNorthResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastResize, PlatformCursor::TypeNorthEastResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestResize, PlatformCursor::TypeNorthWestResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthResize, PlatformCursor::TypeSouthResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthEastResize, PlatformCursor::TypeSouthEastResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthWestResize, PlatformCursor::TypeSouthWestResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWestResize, PlatformCursor::TypeWestResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthSouthResize, PlatformCursor::TypeNorthSouthResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastWestResize, PlatformCursor::TypeEastWestResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastSouthWestResize, PlatformCursor::TypeNorthEastSouthWestResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestSouthEastResize, PlatformCursor::TypeNorthWestSouthEastResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeColumnResize, PlatformCursor::TypeColumnResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeRowResize, PlatformCursor::TypeRowResize);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeMiddlePanning, PlatformCursor::TypeMiddlePanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastPanning, PlatformCursor::TypeEastPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthPanning, PlatformCursor::TypeNorthPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastPanning, PlatformCursor::TypeNorthEastPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestPanning, PlatformCursor::TypeNorthWestPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthPanning, PlatformCursor::TypeSouthPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthEastPanning, PlatformCursor::TypeSouthEastPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthWestPanning, PlatformCursor::TypeSouthWestPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWestPanning, PlatformCursor::TypeWestPanning);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeMove, PlatformCursor::TypeMove);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeVerticalText, PlatformCursor::TypeVerticalText);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCell, PlatformCursor::TypeCell);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeContextMenu, PlatformCursor::TypeContextMenu);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeAlias, PlatformCursor::TypeAlias);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeProgress, PlatformCursor::TypeProgress);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNoDrop, PlatformCursor::TypeNoDrop);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCopy, PlatformCursor::TypeCopy);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNone, PlatformCursor::TypeNone);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNotAllowed, PlatformCursor::TypeNotAllowed);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeZoomIn, PlatformCursor::TypeZoomIn);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeZoomOut, PlatformCursor::TypeZoomOut);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeGrab, PlatformCursor::TypeGrab);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeGrabbing, PlatformCursor::TypeGrabbing);
-COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCustom, PlatformCursor::TypeCustom);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypePointer, Cursor::Pointer);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCross, Cursor::Cross);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeHand, Cursor::Hand);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeIBeam, Cursor::IBeam);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWait, Cursor::Wait);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeHelp, Cursor::Help);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastResize, Cursor::EastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthResize, Cursor::NorthResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastResize, Cursor::NorthEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestResize, Cursor::NorthWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthResize, Cursor::SouthResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthEastResize, Cursor::SouthEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthWestResize, Cursor::SouthWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWestResize, Cursor::WestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthSouthResize, Cursor::NorthSouthResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastWestResize, Cursor::EastWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastSouthWestResize, Cursor::NorthEastSouthWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestSouthEastResize, Cursor::NorthWestSouthEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeColumnResize, Cursor::ColumnResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeRowResize, Cursor::RowResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeMiddlePanning, Cursor::MiddlePanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastPanning, Cursor::EastPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthPanning, Cursor::NorthPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastPanning, Cursor::NorthEastPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestPanning, Cursor::NorthWestPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthPanning, Cursor::SouthPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthEastPanning, Cursor::SouthEastPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthWestPanning, Cursor::SouthWestPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWestPanning, Cursor::WestPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeMove, Cursor::Move);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeVerticalText, Cursor::VerticalText);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCell, Cursor::Cell);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeContextMenu, Cursor::ContextMenu);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeAlias, Cursor::Alias);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeProgress, Cursor::Progress);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNoDrop, Cursor::NoDrop);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCopy, Cursor::Copy);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNone, Cursor::None);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNotAllowed, Cursor::NotAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeZoomIn, Cursor::ZoomIn);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeZoomOut, Cursor::ZoomOut);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeGrab, Cursor::Grab);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeGrabbing, Cursor::Grabbing);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCustom, Cursor::Custom);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebEditingActionTyped, EditorInsertActionTyped);
 COMPILE_ASSERT_MATCHING_ENUM(WebEditingActionPasted, EditorInsertActionPasted);
@@ -566,43 +562,31 @@ COMPILE_ASSERT_MATCHING_ENUM(WebMediaStreamSource::ReadyStateLive, MediaStreamSo
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaStreamSource::ReadyStateMuted, MediaStreamSource::ReadyStateMuted);
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaStreamSource::ReadyStateEnded, MediaStreamSource::ReadyStateEnded);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebICEOptions::CandidateTypeAll, IceOptions::ALL);
-COMPILE_ASSERT_MATCHING_ENUM(WebICEOptions::CandidateTypeNoRelay, IceOptions::NO_RELAY);
-COMPILE_ASSERT_MATCHING_ENUM(WebICEOptions::CandidateTypeOnlyRelay, IceOptions::ONLY_RELAY);
-
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00Handler::ActionSDPOffer, PeerConnection00::SDP_OFFER);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00Handler::ActionSDPPRanswer, PeerConnection00::SDP_PRANSWER);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00Handler::ActionSDPAnswer, PeerConnection00::SDP_ANSWER);
-
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ReadyStateNew, PeerConnection00::NEW);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ReadyStateOpening, PeerConnection00::OPENING);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ReadyStateNegotiating, PeerConnection00::OPENING);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ReadyStateActive, PeerConnection00::ACTIVE);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ReadyStateClosed, PeerConnection00::CLOSED);
-
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateGathering, PeerConnection00::ICE_GATHERING);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateWaiting, PeerConnection00::ICE_WAITING);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateChecking, PeerConnection00::ICE_CHECKING);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateConnected, PeerConnection00::ICE_CONNECTED);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateCompleted, PeerConnection00::ICE_COMPLETED);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateFailed, PeerConnection00::ICE_FAILED);
-COMPILE_ASSERT_MATCHING_ENUM(WebPeerConnection00HandlerClient::ICEStateClosed, PeerConnection00::ICE_CLOSED);
-
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateNew, RTCPeerConnectionHandlerClient::ReadyStateNew);
-COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateOpening, RTCPeerConnectionHandlerClient::ReadyStateOpening);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateHaveLocalOffer, RTCPeerConnectionHandlerClient::ReadyStateHaveLocalOffer);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateHaveLocalPrAnswer, RTCPeerConnectionHandlerClient::ReadyStateHaveLocalPrAnswer);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateHaveRemotePrAnswer, RTCPeerConnectionHandlerClient::ReadyStateHaveRemotePrAnswer);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateActive, RTCPeerConnectionHandlerClient::ReadyStateActive);
-COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateClosing, RTCPeerConnectionHandlerClient::ReadyStateClosing);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateClosed, RTCPeerConnectionHandlerClient::ReadyStateClosed);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateNew, RTCPeerConnectionHandlerClient::IceStateNew);
-COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateGathering, RTCPeerConnectionHandlerClient::IceStateGathering);
-COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateWaiting, RTCPeerConnectionHandlerClient::IceStateWaiting);
+// DEPRECATED
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateOpening, RTCPeerConnectionHandlerClient::ReadyStateOpening);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ReadyStateClosing, RTCPeerConnectionHandlerClient::ReadyStateClosing);
+
+
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateStarting, RTCPeerConnectionHandlerClient::IceStateStarting);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateChecking, RTCPeerConnectionHandlerClient::IceStateChecking);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateConnected, RTCPeerConnectionHandlerClient::IceStateConnected);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateCompleted, RTCPeerConnectionHandlerClient::IceStateCompleted);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateFailed, RTCPeerConnectionHandlerClient::IceStateFailed);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateDisconnected, RTCPeerConnectionHandlerClient::IceStateDisconnected);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateClosed, RTCPeerConnectionHandlerClient::IceStateClosed);
 
+// DEPRECATED
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateNew, RTCPeerConnectionHandlerClient::IceStateNew);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateGathering, RTCPeerConnectionHandlerClient::IceStateGathering);
+COMPILE_ASSERT_MATCHING_ENUM(WebRTCPeerConnectionHandlerClient::ICEStateWaiting, RTCPeerConnectionHandlerClient::IceStateWaiting);
+
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCDataChannel::ReadyStateConnecting, RTCDataChannelDescriptor::ReadyStateConnecting);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCDataChannel::ReadyStateOpen, RTCDataChannelDescriptor::ReadyStateOpen);
 COMPILE_ASSERT_MATCHING_ENUM(WebRTCDataChannel::ReadyStateClosing, RTCDataChannelDescriptor::ReadyStateClosing);
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 94959380a..e617e8f5a 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -37,8 +37,12 @@
 #if ENABLE(INPUT_TYPE_COLOR)
 #include "ColorChooser.h"
 #include "ColorChooserClient.h"
+#if ENABLE(PAGE_POPUP)
+#include "ColorChooserPopupUIController.h"
+#else
 #include "ColorChooserUIController.h"
 #endif
+#endif
 #include "Console.h"
 #include "Cursor.h"
 #include "DatabaseTracker.h"
@@ -46,6 +50,7 @@
 #include "DateTimeChooserImpl.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "ExternalDateTimeChooser.h"
 #include "ExternalPopupMenu.h"
 #include "FileChooser.h"
 #include "FileIconLoader.h"
@@ -292,7 +297,12 @@ static inline void updatePolicyForEvent(const WebInputEvent* inputEvent, WebNavi
     bool alt = mouseEvent->modifiers & WebMouseEvent::AltKey;
     bool meta = mouseEvent->modifiers & WebMouseEvent::MetaKey;
 
-    WebViewImpl::navigationPolicyFromMouseEvent(buttonNumber, ctrl, shift, alt, meta, policy);
+    WebNavigationPolicy userPolicy = *policy;
+    WebViewImpl::navigationPolicyFromMouseEvent(buttonNumber, ctrl, shift, alt, meta, &userPolicy);
+    // User and app agree that we want a new window; let the app override the decorations.
+    if (userPolicy == WebNavigationPolicyNewWindow && *policy == WebNavigationPolicyNewPopup)
+        return;
+    *policy = userPolicy;
 }
 
 WebNavigationPolicy ChromeClientImpl::getNavigationPolicy()
@@ -590,7 +600,7 @@ void ChromeClientImpl::mouseDidMoveOverElement(
             Widget* widget = toRenderWidget(object)->widget();
             if (widget && widget->isPluginContainer()) {
                 WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
-                url = plugin->plugin()->linkAtPosition(result.roundedPoint());
+                url = plugin->plugin()->linkAtPosition(result.roundedPointInInnerNodeFrame());
             }
         }
     }
@@ -615,22 +625,18 @@ void ChromeClientImpl::dispatchViewportPropertiesDidChange(const ViewportArgumen
     if (!m_webView->settings()->viewportEnabled() || !m_webView->isFixedLayoutModeEnabled() || !m_webView->client() || !m_webView->page())
         return;
 
-    FrameView* frameView = m_webView->mainFrameImpl()->frameView();
-    int dpi = screenHorizontalDPI(frameView);
-    ASSERT(dpi > 0);
-
     WebViewClient* client = m_webView->client();
-    WebRect deviceRect = client->windowRect();
+    WebSize deviceSize = m_webView->size();
     // If the window size has not been set yet don't attempt to set the viewport
-    if (!deviceRect.width || !deviceRect.height)
+    if (!deviceSize.width || !deviceSize.height)
         return;
 
     Settings* settings = m_webView->page()->settings();
-    float devicePixelRatio = dpi / ViewportArguments::deprecatedTargetDPI;
+    float devicePixelRatio = client->screenInfo().deviceScaleFactor;
     // Call the common viewport computing logic in ViewportArguments.cpp.
     ViewportAttributes computed = computeViewportAttributes(
-        arguments, settings->layoutFallbackWidth(), deviceRect.width, deviceRect.height,
-        devicePixelRatio, IntSize(deviceRect.width, deviceRect.height));
+        arguments, settings->layoutFallbackWidth(), deviceSize.width, deviceSize.height,
+        devicePixelRatio, IntSize(deviceSize.width, deviceSize.height));
 
     restrictScaleFactorToInitialScaleIfNotUserScalable(computed);
 
@@ -675,7 +681,14 @@ void ChromeClientImpl::reachedApplicationCacheOriginQuota(SecurityOrigin*, int64
 #if ENABLE(INPUT_TYPE_COLOR)
 PassOwnPtr<ColorChooser> ChromeClientImpl::createColorChooser(ColorChooserClient* chooserClient, const Color&)
 {
-    return adoptPtr(new ColorChooserUIController(this, chooserClient));
+    OwnPtr<ColorChooserUIController> controller;
+#if ENABLE(PAGE_POPUP)
+    controller = adoptPtr(new ColorChooserPopupUIController(this, chooserClient));
+#else
+    controller = adoptPtr(new ColorChooserUIController(this, chooserClient));
+#endif
+    controller->openUI();
+    return controller.release();
 }
 PassOwnPtr<WebColorChooser> ChromeClientImpl::createWebColorChooser(WebColorChooserClient* chooserClient, const WebColor& initialColor)
 {
@@ -692,8 +705,7 @@ PassRefPtr<DateTimeChooser> ChromeClientImpl::openDateTimeChooser(DateTimeChoose
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     return DateTimeChooserImpl::create(this, pickerClient, parameters);
 #else
-    notImplemented();
-    return PassRefPtr<DateTimeChooser>();
+    return ExternalDateTimeChooser::create(this, m_webView->client(), pickerClient, parameters);
 #endif
 }
 #endif
diff --git a/Source/WebKit/chromium/src/ColorChooserPopupUIController.cpp b/Source/WebKit/chromium/src/ColorChooserPopupUIController.cpp
new file mode 100644
index 000000000..5af98f087
--- /dev/null
+++ b/Source/WebKit/chromium/src/ColorChooserPopupUIController.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ColorChooserPopupUIController.h"
+
+#if ENABLE(INPUT_TYPE_COLOR) && ENABLE(PAGE_POPUP)
+#include "ChromeClientImpl.h"
+#include "ColorChooserClient.h"
+#include "ColorSuggestionPicker.h"
+#include "FrameView.h"
+#include "IntRect.h"
+#include "LocalizedStrings.h"
+#include "PickerCommon.h"
+#include "WebColorChooser.h"
+#include "WebViewImpl.h"
+#include <public/Platform.h>
+#include <public/WebLocalizedString.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Keep in sync with Actions in colorSuggestionPicker.js.
+enum ColorPickerPopupAction {
+    ColorPickerPopupActionChooseOtherColor = -2,
+    ColorPickerPopupActionCancel = -1,
+    ColorPickerPopupActionSetValue = 0
+};
+
+ColorChooserPopupUIController::ColorChooserPopupUIController(ChromeClientImpl* chromeClient, ColorChooserClient* client)
+    : ColorChooserUIController(chromeClient, client)
+    , m_chromeClient(chromeClient)
+    , m_client(client)
+    , m_popup(0)
+    , m_locale(Locale::createDefault())
+{
+}
+
+ColorChooserPopupUIController::~ColorChooserPopupUIController()
+{
+}
+
+void ColorChooserPopupUIController::openUI()
+{
+    if (m_client->shouldShowSuggestions())
+        openPopup();
+    else
+        openColorChooser();
+}
+
+void ColorChooserPopupUIController::endChooser()
+{
+    if (m_chooser)
+        m_chooser->endChooser();
+    if (m_popup)
+        closePopup();
+}
+
+IntSize ColorChooserPopupUIController::contentSize()
+{
+    return IntSize(0, 0);
+}
+
+void ColorChooserPopupUIController::writeDocument(DocumentWriter& writer)
+{
+    Vector<Color> suggestions = m_client->suggestions();
+    Vector<String> suggestionValues;
+    for (unsigned i = 0; i < suggestions.size(); i++)
+        suggestionValues.append(suggestions[i].serialized());
+    IntRect anchorRectInScreen = m_chromeClient->rootViewToScreen(m_client->elementRectRelativeToRootView());
+    FrameView* view = static_cast<WebViewImpl*>(m_chromeClient->webView())->page()->mainFrame()->view();
+    IntRect rootViewVisibleContentRect = view->visibleContentRect(true /* include scrollbars */);
+    IntRect rootViewRectInScreen = m_chromeClient->rootViewToScreen(rootViewVisibleContentRect);
+
+    PagePopupClient::addString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", writer);
+    writer.addData(pickerCommonCss, sizeof(pickerCommonCss));
+    writer.addData(colorSuggestionPickerCss, sizeof(colorSuggestionPickerCss));
+    PagePopupClient::addString("</style></head><body><div id=main>Loading...</div><script>\n"
+        "window.dialogArguments = {\n", writer);
+    PagePopupClient::addProperty("values", suggestionValues, writer);
+    PagePopupClient::addProperty("otherColorLabel", Platform::current()->queryLocalizedString(WebLocalizedString::OtherColorLabel), writer);
+    addProperty("anchorRectInScreen", anchorRectInScreen, writer);
+    addProperty("rootViewRectInScreen", rootViewRectInScreen, writer);
+#if OS(MAC_OS_X)
+    addProperty("confineToRootView", true, writer);
+#else
+    addProperty("confineToRootView", false, writer);
+#endif
+    PagePopupClient::addString("};\n", writer);
+    writer.addData(pickerCommonJs, sizeof(pickerCommonJs));
+    writer.addData(colorSuggestionPickerJs, sizeof(colorSuggestionPickerJs));
+    PagePopupClient::addString("</script></body>\n", writer);
+}
+
+Locale& ColorChooserPopupUIController::locale()
+{
+    return *m_locale;
+}
+
+void ColorChooserPopupUIController::setValueAndClosePopup(int numValue, const String& stringValue)
+{
+    ASSERT(m_popup);
+    ASSERT(m_client);
+    if (numValue == ColorPickerPopupActionSetValue)
+        m_client->didChooseColor(Color(stringValue));
+    if (numValue == ColorPickerPopupActionChooseOtherColor)
+        openColorChooser();
+    closePopup();
+}
+
+void ColorChooserPopupUIController::didClosePopup()
+{
+    m_popup = 0;
+
+    if (!m_chooser)
+        didEndChooser();
+}
+
+
+void ColorChooserPopupUIController::openPopup()
+{
+    ASSERT(!m_popup);
+    m_popup = m_chromeClient->openPagePopup(this, m_client->elementRectRelativeToRootView());
+}
+
+void ColorChooserPopupUIController::closePopup()
+{
+    if (!m_popup)
+        return;
+    m_chromeClient->closePagePopup(m_popup);
+}
+
+}
+#endif // ENABLE(INPUT_TYPE_COLOR) && ENABLE(PAGE_POPUP)
diff --git a/Source/WebKit/chromium/src/ColorChooserPopupUIController.h b/Source/WebKit/chromium/src/ColorChooserPopupUIController.h
new file mode 100644
index 000000000..c4d5848c4
--- /dev/null
+++ b/Source/WebKit/chromium/src/ColorChooserPopupUIController.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef ColorChooserPopupUIController_h
+#define ColorChooserPopupUIController_h
+
+#if ENABLE(INPUT_TYPE_COLOR) && ENABLE(PAGE_POPUP)
+#include "ColorChooserUIController.h"
+#include "PagePopupClient.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+class ColorChooserClient;
+class PagePopup;
+}
+
+namespace WebKit {
+
+class ColorChooserPopupUIController : public ColorChooserUIController, public WebCore::PagePopupClient  {
+
+public:
+    ColorChooserPopupUIController(ChromeClientImpl*, WebCore::ColorChooserClient*);
+    virtual ~ColorChooserPopupUIController();
+
+    // ColorChooserUIController functions:
+    virtual void openUI() OVERRIDE;
+
+    // ColorChooser functions
+    void endChooser() OVERRIDE;
+
+    // PagePopupClient functions:
+    virtual WebCore::IntSize contentSize() OVERRIDE;
+    virtual void writeDocument(WebCore::DocumentWriter&) OVERRIDE;
+    virtual WebCore::Locale& locale() OVERRIDE;
+    virtual void setValueAndClosePopup(int, const String&) OVERRIDE;
+    virtual void didClosePopup() OVERRIDE;
+
+private:
+    void openPopup();
+    void closePopup();
+
+    ChromeClientImpl* m_chromeClient;
+    WebCore::ColorChooserClient* m_client;
+    WebCore::PagePopup* m_popup;
+    OwnPtr<WebCore::Locale> m_locale;
+};
+}
+
+#endif // ENABLE(INPUT_TYPE_COLOR) && ENABLE(PAGE_POPUP)
+
+#endif // ColorChooserPopupUIController_h
diff --git a/Source/WebKit/chromium/src/ColorChooserUIController.cpp b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
index 5789691e8..7ab3c34d4 100644
--- a/Source/WebKit/chromium/src/ColorChooserUIController.cpp
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
@@ -27,48 +27,32 @@
 #include "ColorChooserUIController.h"
 
 #if ENABLE(INPUT_TYPE_COLOR)
-
 #include "ChromeClientImpl.h"
 #include "Color.h"
 #include "ColorChooserClient.h"
-#include "ColorSuggestionPicker.h"
-#include "FrameView.h"
-#include "IntRect.h"
-#include "LocalizedStrings.h"
-#include "PickerCommon.h"
 #include "WebColorChooser.h"
-#include "WebViewImpl.h"
-#include <public/Platform.h>
 #include <public/WebColor.h>
-#include <public/WebLocalizedString.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-// Keep in sync with Actions in colorSuggestionPicker.js.
-enum ColorPickerPopupAction {
-    ColorPickerPopupActionChooseOtherColor = -2,
-    ColorPickerPopupActionCancel = -1,
-    ColorPickerPopupActionSetValue = 0
-};
 
 ColorChooserUIController::ColorChooserUIController(ChromeClientImpl* chromeClient, ColorChooserClient* client)
     : m_chromeClient(chromeClient)
     , m_client(client)
-    , m_popup(0)
-    , m_locale(Locale::createDefault())
 {
-    if (m_client->shouldShowSuggestions())
-        openPopup();
-    else
-        openColorChooser();
 }
 
 ColorChooserUIController::~ColorChooserUIController()
 {
 }
 
+void ColorChooserUIController::openUI()
+{
+    openColorChooser();
+}
+
 void ColorChooserUIController::setSelectedColor(const Color& color)
 {
     ASSERT(m_chooser);
@@ -79,8 +63,6 @@ void ColorChooserUIController::endChooser()
 {
     if (m_chooser)
         m_chooser->endChooser();
-    if (m_popup)
-        closePopup();
 }
 
 void ColorChooserUIController::didChooseColor(const WebColor& color)
@@ -96,79 +78,6 @@ void ColorChooserUIController::didEndChooser()
     m_client->didEndChooser();
 }
 
-IntSize ColorChooserUIController::contentSize()
-{
-    return IntSize(0, 0);
-}
-
-void ColorChooserUIController::writeDocument(DocumentWriter& writer)
-{
-    Vector<Color> suggestions = m_client->suggestions();
-    Vector<String> suggestionValues;
-    for (unsigned i = 0; i < suggestions.size(); i++)
-        suggestionValues.append(suggestions[i].serialized());
-    IntRect anchorRectInScreen = m_chromeClient->rootViewToScreen(m_client->elementRectRelativeToRootView());
-    FrameView* view = static_cast<WebViewImpl*>(m_chromeClient->webView())->page()->mainFrame()->view();
-    IntRect rootViewVisibleContentRect = view->visibleContentRect(true /* include scrollbars */);
-    IntRect rootViewRectInScreen = m_chromeClient->rootViewToScreen(rootViewVisibleContentRect);
-    
-    PagePopupClient::addString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", writer);
-    writer.addData(pickerCommonCss, sizeof(pickerCommonCss));
-    writer.addData(colorSuggestionPickerCss, sizeof(colorSuggestionPickerCss));
-    PagePopupClient::addString("</style></head><body><div id=main>Loading...</div><script>\n"
-                                      "window.dialogArguments = {\n", writer);
-    PagePopupClient::addProperty("values", suggestionValues, writer);       
-    PagePopupClient::addProperty("otherColorLabel", Platform::current()->queryLocalizedString(WebLocalizedString::OtherColorLabel), writer);
-    addProperty("anchorRectInScreen", anchorRectInScreen, writer);
-    addProperty("rootViewRectInScreen", rootViewRectInScreen, writer);
-#if OS(MAC_OS_X)
-    addProperty("confineToRootView", true, writer);
-#else
-    addProperty("confineToRootView", false, writer);
-#endif
-    PagePopupClient::addString("};\n", writer);
-    writer.addData(pickerCommonJs, sizeof(pickerCommonJs));
-    writer.addData(colorSuggestionPickerJs, sizeof(colorSuggestionPickerJs));
-    PagePopupClient::addString("</script></body>\n", writer);
-}
-
-Locale& ColorChooserUIController::locale()
-{
-    return *m_locale;
-}
-
-void ColorChooserUIController::setValueAndClosePopup(int numValue, const String& stringValue)
-{
-    ASSERT(m_popup);
-    ASSERT(m_client);
-    if (numValue == ColorPickerPopupActionSetValue)
-        m_client->didChooseColor(Color(stringValue));
-    if (numValue == ColorPickerPopupActionChooseOtherColor)
-        openColorChooser();
-    closePopup();
-}
-
-void ColorChooserUIController::didClosePopup()
-{
-    m_popup = 0;
-
-    if (!m_chooser)
-        didEndChooser();
-}
-
-void ColorChooserUIController::openPopup()
-{
-    ASSERT(!m_popup);
-    m_popup = m_chromeClient->openPagePopup(this, m_client->elementRectRelativeToRootView());
-}
-
-void ColorChooserUIController::closePopup()
-{
-    if (!m_popup)
-        return;
-    m_chromeClient->closePagePopup(m_popup);
-}
-
 void ColorChooserUIController::openColorChooser()
 {
     ASSERT(!m_chooser);
diff --git a/Source/WebKit/chromium/src/ColorChooserUIController.h b/Source/WebKit/chromium/src/ColorChooserUIController.h
index 60cecfe18..4f32d7e0a 100644
--- a/Source/WebKit/chromium/src/ColorChooserUIController.h
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.h
@@ -29,15 +29,12 @@
 #if ENABLE(INPUT_TYPE_COLOR)
 
 #include "ColorChooser.h"
-#include "PagePopupClient.h"
 #include "PlatformLocale.h"
 #include "WebColorChooserClient.h"
 #include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 class ColorChooserClient;
-class PagePopup;
 }
 
 namespace WebKit {
@@ -45,11 +42,13 @@ namespace WebKit {
 class ChromeClientImpl;
 class WebColorChooser;
 
-class ColorChooserUIController : public WebColorChooserClient, public WebCore::ColorChooser, public WebCore::PagePopupClient {
+class ColorChooserUIController : public WebColorChooserClient, public WebCore::ColorChooser {
 public:
     ColorChooserUIController(ChromeClientImpl*, WebCore::ColorChooserClient*);
     virtual ~ColorChooserUIController();
 
+    virtual void openUI();
+
     // ColorChooser functions:
     virtual void setSelectedColor(const WebCore::Color&) OVERRIDE;
     virtual void endChooser() OVERRIDE;
@@ -58,23 +57,14 @@ public:
     virtual void didChooseColor(const WebColor&) OVERRIDE;
     virtual void didEndChooser() OVERRIDE;
 
-    // PagePopupClient functions:
-    virtual WebCore::IntSize contentSize() OVERRIDE;
-    virtual void writeDocument(WebCore::DocumentWriter&) OVERRIDE;
-    virtual WebCore::Locale& locale() OVERRIDE;
-    virtual void setValueAndClosePopup(int, const String&) OVERRIDE;
-    virtual void didClosePopup() OVERRIDE;
+protected:
+    void openColorChooser();
+    OwnPtr<WebColorChooser> m_chooser;
 
 private:
-    void openPopup();
-    void closePopup();
-    void openColorChooser();
 
     ChromeClientImpl* m_chromeClient;
     WebCore::ColorChooserClient* m_client;
-    OwnPtr<WebColorChooser> m_chooser;
-    WebCore::PagePopup* m_popup;
-    OwnPtr<WebCore::Locale> m_locale;
 };
 
 }
diff --git a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
index ad116090c..bda1b2e9a 100644
--- a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -120,7 +120,7 @@ static String selectMisspelledWord(const ContextMenu* defaultMenu, Frame* select
 
     // Selection is empty, so change the selection to the word under the cursor.
     HitTestResult hitTestResult = selectedFrame->eventHandler()->
-        hitTestResultAtPoint(selectedFrame->page()->contextMenuController()->hitTestResult().point(), true);
+        hitTestResultAtPoint(selectedFrame->page()->contextMenuController()->hitTestResult().pointInInnerNodeFrame(), true);
     Node* innerNode = hitTestResult.innerNode();
     VisiblePosition pos(innerNode->renderer()->positionForPoint(
         hitTestResult.localPoint()));
@@ -155,10 +155,10 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         return 0;
 
     HitTestResult r = m_webView->page()->contextMenuController()->hitTestResult();
-    Frame* selectedFrame = r.innerNonSharedNode()->document()->frame();
+    Frame* selectedFrame = r.innerNodeFrame();
 
     WebContextMenuData data;
-    data.mousePosition = selectedFrame->view()->contentsToWindow(r.roundedPoint());
+    data.mousePosition = selectedFrame->view()->contentsToWindow(r.roundedPointInInnerNodeFrame());
 
     // Compute edit flags.
     data.editFlags = WebContextMenuData::CanDoNone;
@@ -212,7 +212,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         if (mediaElement->hasVideo())
             data.mediaFlags |= WebContextMenuData::MediaHasVideo;
         if (mediaElement->controls())
-            data.mediaFlags |= WebContextMenuData::MediaControlRootElement;
+            data.mediaFlags |= WebContextMenuData::MediaControls;
     } else if (r.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
                || r.innerNonSharedNode()->hasTagName(HTMLNames::embedTag)) {
         RenderObject* object = r.innerNonSharedNode()->renderer();
@@ -298,8 +298,9 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
                         selectedFrame->selection()->setSelection(selection, WordGranularity);
                 }
             }
-        } else if (m_webView->focusedWebCoreFrame()->editor()->isContinuousSpellCheckingEnabled()) {
-            data.isSpellCheckingEnabled = true;
+        } else {
+            data.isSpellCheckingEnabled = 
+                m_webView->focusedWebCoreFrame()->editor()->isContinuousSpellCheckingEnabled();
             // Spellchecking might be enabled for the field, but could be disabled on the node.
             if (m_webView->focusedWebCoreFrame()->editor()->isSpellCheckingEnabledInFocusedNode()) {
                 data.misspelledWord = selectMisspelledWord(defaultMenu, selectedFrame);
diff --git a/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp b/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp
index f44157a76..d966ba9d6 100644
--- a/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp
+++ b/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp
@@ -60,7 +60,7 @@ DateTimeChooserImpl::DateTimeChooserImpl(ChromeClientImpl* chromeClient, WebCore
     , m_client(client)
     , m_popup(0)
     , m_parameters(parameters)
-    , m_locale(WebCore::Locale::createDefault())
+    , m_locale(WebCore::Locale::create(parameters.locale))
 {
     ASSERT(m_chromeClient);
     ASSERT(m_client);
@@ -110,12 +110,17 @@ void DateTimeChooserImpl::writeDocument(WebCore::DocumentWriter& writer)
     IntRect rootViewRectInScreen = m_chromeClient->rootViewToScreen(rootViewVisibleContentRect);
     rootViewRectInScreen.move(-view->scrollX(), -view->scrollY());
     String todayLabelString;
-    if (m_parameters.type == WebCore::InputTypeNames::month())
+    String otherDateLabelString;
+    if (m_parameters.type == WebCore::InputTypeNames::month()) {
         todayLabelString = Platform::current()->queryLocalizedString(WebLocalizedString::ThisMonthButtonLabel);
-    else if (m_parameters.type == WebCore::InputTypeNames::week())
+        otherDateLabelString = Platform::current()->queryLocalizedString(WebLocalizedString::OtherMonthLabel);
+    } else if (m_parameters.type == WebCore::InputTypeNames::week()) {
         todayLabelString = Platform::current()->queryLocalizedString(WebLocalizedString::ThisWeekButtonLabel);
-    else
+        otherDateLabelString = Platform::current()->queryLocalizedString(WebLocalizedString::OtherWeekLabel);
+    } else {
         todayLabelString = Platform::current()->queryLocalizedString(WebLocalizedString::CalendarToday);
+        otherDateLabelString = Platform::current()->queryLocalizedString(WebLocalizedString::OtherDateLabel);
+    }
 
     addString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", writer);
     writer.addData(WebCore::pickerCommonCss, sizeof(WebCore::pickerCommonCss));
@@ -139,12 +144,11 @@ void DateTimeChooserImpl::writeDocument(WebCore::DocumentWriter& writer)
     addProperty("stepBase", stepBaseString, writer);
     addProperty("required", m_parameters.required, writer);
     addProperty("currentValue", m_parameters.currentValue, writer);
-    addProperty("locale", WebCore::defaultLanguage(), writer);
+    addProperty("locale", m_parameters.locale.string(), writer);
     addProperty("todayLabel", todayLabelString, writer);
     addProperty("clearLabel", Platform::current()->queryLocalizedString(WebLocalizedString::CalendarClear), writer);
     addProperty("weekLabel", Platform::current()->queryLocalizedString(WebLocalizedString::WeekNumberLabel), writer);
     addProperty("weekStartDay", m_locale->firstDayOfWeek(), writer);
-    addProperty("monthLabels", m_locale->monthLabels(), writer);
     addProperty("dayLabels", m_locale->weekDayShortLabels(), writer);
     addProperty("isCalendarRTL", m_locale->isRTL(), writer);
     addProperty("isRTL", m_parameters.isAnchorElementRTL, writer);
@@ -154,8 +158,8 @@ void DateTimeChooserImpl::writeDocument(WebCore::DocumentWriter& writer)
         addProperty("suggestionValues", m_parameters.suggestionValues, writer);
         addProperty("localizedSuggestionValues", m_parameters.localizedSuggestionValues, writer);
         addProperty("suggestionLabels", m_parameters.suggestionLabels, writer);
-        addProperty("showOtherDateEntry", m_parameters.type == WebCore::InputTypeNames::date(), writer);
-        addProperty("otherDateLabel", Platform::current()->queryLocalizedString(WebLocalizedString::OtherDateLabel), writer);
+        addProperty("showOtherDateEntry", WebCore::RenderTheme::defaultTheme()->supportsCalendarPicker(m_parameters.type), writer);
+        addProperty("otherDateLabel", otherDateLabelString, writer);
         addProperty("suggestionHighlightColor", WebCore::RenderTheme::defaultTheme()->activeListBoxSelectionBackgroundColor().serialized(), writer);
         addProperty("suggestionHighlightTextColor", WebCore::RenderTheme::defaultTheme()->activeListBoxSelectionForegroundColor().serialized(), writer);
     }
diff --git a/Source/WebKit/chromium/src/ExternalDateTimeChooser.cpp b/Source/WebKit/chromium/src/ExternalDateTimeChooser.cpp
new file mode 100644
index 000000000..5a705e872
--- /dev/null
+++ b/Source/WebKit/chromium/src/ExternalDateTimeChooser.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES) && !ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#include "ExternalDateTimeChooser.h"
+
+#include "ChromeClientImpl.h"
+#include "DateTimeChooserClient.h"
+#include "WebDateTimeChooserCompletion.h"
+#include "WebDateTimeChooserParams.h"
+#include "WebViewClient.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebDateTimeChooserCompletionImpl : public WebDateTimeChooserCompletion {
+public:
+    WebDateTimeChooserCompletionImpl(ExternalDateTimeChooser* chooser)
+        : m_chooser(chooser)
+    {
+    }
+
+private:
+    virtual void didChooseValue(const WebString& value) OVERRIDE
+    {
+        m_chooser->didChooseValue(value);
+        delete this;
+    }
+
+    virtual void didCancelChooser() OVERRIDE
+    {
+        m_chooser->didCancelChooser();
+        delete this;
+    }
+
+    RefPtr<ExternalDateTimeChooser> m_chooser;
+};
+
+ExternalDateTimeChooser::~ExternalDateTimeChooser()
+{
+}
+
+ExternalDateTimeChooser::ExternalDateTimeChooser(WebCore::DateTimeChooserClient* client)
+    : m_client(client)
+{
+    ASSERT(client);
+}
+
+PassRefPtr<ExternalDateTimeChooser> ExternalDateTimeChooser::create(ChromeClientImpl* chromeClient, WebViewClient* webViewClient, WebCore::DateTimeChooserClient* client, const WebCore::DateTimeChooserParameters& parameters)
+{
+    ASSERT(chromeClient);
+    RefPtr<ExternalDateTimeChooser> chooser = adoptRef(new ExternalDateTimeChooser(client));
+    if (!chooser->openDateTimeChooser(chromeClient, webViewClient, parameters))
+        chooser.clear();
+    return chooser.release();
+}
+
+bool ExternalDateTimeChooser::openDateTimeChooser(ChromeClientImpl* chromeClient, WebViewClient* webViewClient, const DateTimeChooserParameters& parameters)
+{
+    if (!webViewClient)
+        return false;
+
+    WebDateTimeChooserParams webParams;
+    webParams.type = parameters.type;
+    webParams.anchorRectInScreen = chromeClient->rootViewToScreen(parameters.anchorRectInRootView);
+    webParams.currentValue = parameters.currentValue;
+    webParams.suggestionValues = parameters.suggestionValues;
+    webParams.localizedSuggestionValues = parameters.localizedSuggestionValues;
+    webParams.suggestionLabels = parameters.suggestionLabels;
+    webParams.minimum = parameters.minimum;
+    webParams.maximum = parameters.maximum;
+    webParams.step = parameters.step;
+    webParams.stepBase = parameters.stepBase;
+    webParams.isRequired = parameters.required;
+    webParams.isAnchorElementRTL = parameters.isAnchorElementRTL;
+
+    WebDateTimeChooserCompletion* completion = new WebDateTimeChooserCompletionImpl(this);
+    if (webViewClient->openDateTimeChooser(webParams, completion))
+        return true;
+    // We can't open a chooser. Calling
+    // WebDateTimeChooserCompletionImpl::didCancelChooser to delete the
+    // WebDateTimeChooserCompletionImpl object and deref this.
+    completion->didCancelChooser();
+    return false;
+}
+
+void ExternalDateTimeChooser::didChooseValue(const WebString& value)
+{
+    if (m_client)
+        m_client->didChooseValue(value);
+    // didChooseValue might run JavaScript code, and endChooser() might be
+    // called. However DateTimeChooserCompletionImpl still has one reference to
+    // this object.
+    if (m_client)
+        m_client->didEndChooser();
+}
+
+void ExternalDateTimeChooser::didCancelChooser()
+{
+    if (m_client)
+        m_client->didEndChooser();
+}
+
+void ExternalDateTimeChooser::endChooser()
+{
+    DateTimeChooserClient* client = m_client;
+    m_client = 0;
+    client->didEndChooser();
+}
+
+}
+
+#endif
diff --git a/Source/WebKit/chromium/src/ExternalDateTimeChooser.h b/Source/WebKit/chromium/src/ExternalDateTimeChooser.h
new file mode 100644
index 000000000..342db211a
--- /dev/null
+++ b/Source/WebKit/chromium/src/ExternalDateTimeChooser.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef ExternalDateTimeChooser_h
+#define ExternalDateTimeChooser_h
+
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES) && !ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#include "DateTimeChooser.h"
+
+namespace WebCore {
+class DateTimeChooserClient;
+}
+
+namespace WebKit {
+
+class ChromeClientImpl;
+class WebString;
+class WebViewClient;
+
+class ExternalDateTimeChooser : public WebCore::DateTimeChooser {
+public:
+    static PassRefPtr<ExternalDateTimeChooser> create(ChromeClientImpl*, WebViewClient*, WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&);
+    virtual ~ExternalDateTimeChooser();
+
+    // The following functions are for DateTimeChooserCompletion.
+    void didChooseValue(const WebString&);
+    void didCancelChooser();
+
+private:
+    ExternalDateTimeChooser(WebCore::DateTimeChooserClient*);
+    bool openDateTimeChooser(ChromeClientImpl*, WebViewClient*, const WebCore::DateTimeChooserParameters&);
+
+    // DateTimeChooer function:
+    virtual void endChooser() OVERRIDE;
+
+    WebCore::DateTimeChooserClient* m_client;
+};
+
+}
+#endif
+
+#endif
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index 7ffe94339..9d0aab495 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -1662,4 +1662,20 @@ void FrameLoaderClientImpl::didRequestAutocomplete(PassRefPtr<FormState> formSta
 }
 #endif
 
+#if ENABLE(WEBGL)
+bool FrameLoaderClientImpl::allowWebGL(bool enabledPerSettings)
+{
+    if (m_webFrame->client())
+        return m_webFrame->client()->allowWebGL(m_webFrame, enabledPerSettings);
+
+    return enabledPerSettings;
+}
+
+void FrameLoaderClientImpl::didLoseWebGLContext(int arbRobustnessContextLostReason)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didLoseWebGLContext(m_webFrame, arbRobustnessContextLostReason);
+}
+#endif
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 6589c37bb..2aa624bdf 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -229,6 +229,11 @@ public:
     virtual void didRequestAutocomplete(PassRefPtr<WebCore::FormState>) OVERRIDE;
 #endif
 
+#if ENABLE(WEBGL)
+    virtual bool allowWebGL(bool enabledPerSettings) OVERRIDE;
+    virtual void didLoseWebGLContext(int arbRobustnessContextLostReason) OVERRIDE;
+#endif
+
 private:
     void makeDocumentView();
 
diff --git a/Source/WebKit/chromium/src/FrameNetworkingContextImpl.cpp b/Source/WebKit/chromium/src/FrameNetworkingContextImpl.cpp
new file mode 100644
index 000000000..54f005002
--- /dev/null
+++ b/Source/WebKit/chromium/src/FrameNetworkingContextImpl.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FrameNetworkingContextImpl.h"
+
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include <public/Platform.h>
+
+namespace WebKit {
+
+WebCookieJar* FrameNetworkingContextImpl::cookieJar() const
+{
+    WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(frame());
+    if (!frameImpl || !frameImpl->client())
+        return 0;
+    WebCookieJar* cookieJar = frameImpl->client()->cookieJar(frameImpl);
+    if (!cookieJar)
+        cookieJar = WebKit::Platform::current()->cookieJar();
+    return cookieJar;
+}
+
+}
diff --git a/Source/WebKit/chromium/src/FrameNetworkingContextImpl.h b/Source/WebKit/chromium/src/FrameNetworkingContextImpl.h
index 86705067b..6eccd0332 100644
--- a/Source/WebKit/chromium/src/FrameNetworkingContextImpl.h
+++ b/Source/WebKit/chromium/src/FrameNetworkingContextImpl.h
@@ -21,11 +21,14 @@
 #define FrameNetworkingContextImpl_h
 
 #include "FrameNetworkingContext.h"
+#include <public/WebCookieJar.h>
 
 namespace WebKit {
 
 class FrameNetworkingContextImpl : public WebCore::FrameNetworkingContext {
 public:
+    virtual WebCookieJar* cookieJar() const OVERRIDE;
+
     static PassRefPtr<FrameNetworkingContextImpl> create(WebCore::Frame* frame)
     {
         return adoptRef(new FrameNetworkingContextImpl(frame));
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 42ac76ba5..81cb549e5 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -31,6 +31,7 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "DOMStringList.h"
 #include "IDBCursorBackendInterface.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseBackendProxy.h"
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
index f6d964470..0bc95466d 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
@@ -77,14 +77,6 @@ PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendProxy::createObject
     return IDBObjectStoreBackendProxy::create(objectStore.release());
 }
 
-void IDBDatabaseBackendProxy::deleteObjectStore(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBDatabase->deleteObjectStore(name, *transactionProxy->getWebIDBTransaction(), ec);
-}
-
 void IDBDatabaseBackendProxy::deleteObjectStore(int64_t objectStoreId, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -99,17 +91,6 @@ void IDBDatabaseBackendProxy::setVersion(const String& version, PassRefPtr<IDBCa
     m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode& ec)
-{
-    WebDOMStringList names(storeNames);
-    OwnPtr<WebIDBTransaction> transaction = adoptPtr(m_webIDBDatabase->transaction(names, mode, ec));
-    if (!transaction) {
-        ASSERT(ec);
-        return 0;
-    }
-    return IDBTransactionBackendProxy::create(transaction.release());
-}
-
 PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(const Vector<int64_t>& objectStoreIds, unsigned short mode)
 {
     OwnPtr<WebIDBTransaction> transaction = adoptPtr(m_webIDBDatabase->transaction(objectStoreIds, mode));
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
index 916f833ab..aa8fdf0c9 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
@@ -45,10 +45,8 @@ public:
     virtual WebCore::IDBDatabaseMetadata metadata() const;
 
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> createObjectStore(int64_t, const String& name, const WebCore::IDBKeyPath&, bool autoIncrement, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    virtual void deleteObjectStore(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteObjectStore(int64_t, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void setVersion(const String& version, PassRefPtr<WebCore::IDBCallbacks>, PassRefPtr<WebCore::IDBDatabaseCallbacks>, WebCore::ExceptionCode&);
-    virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> transaction(WebCore::DOMStringList* storeNames, unsigned short mode, WebCore::ExceptionCode&);
     virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> transaction(const Vector<int64_t>&, unsigned short mode);
     virtual void close(PassRefPtr<WebCore::IDBDatabaseCallbacks>);
 
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
index 6a0d02772..8e89deb03 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
@@ -67,16 +67,6 @@ void IDBObjectStoreBackendProxy::get(PassRefPtr<IDBKeyRange> keyRange, PassRefPt
     m_webIDBObjectStore->get(keyRange, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreBackendProxy::putWithIndexKeys(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, ExceptionCode& ec)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    WebVector<WebString> webIndexNames(indexNames);
-    WebVector<IndexKeys> webIndexKeys(indexKeys);
-    m_webIDBObjectStore->putWithIndexKeys(value, key, static_cast<WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), webIndexNames, webIndexKeys, ec);
-}
-
 void IDBObjectStoreBackendProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, const Vector<int64_t>& indexIds, const Vector<IndexKeys>& indexKeys)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -85,16 +75,6 @@ void IDBObjectStoreBackendProxy::put(PassRefPtr<SerializedScriptValue> value, Pa
     m_webIDBObjectStore->put(value, key, static_cast<WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), indexIds, indexKeys);
 }
 
-void IDBObjectStoreBackendProxy::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transaction)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    WebVector<WebString> webIndexNames(indexNames);
-    WebVector<IndexKeys> webIndexKeys(indexKeys);
-    m_webIDBObjectStore->setIndexKeys(prpPrimaryKey, webIndexNames, webIndexKeys, *transactionProxy->getWebIDBTransaction());
-}
-
 void IDBObjectStoreBackendProxy::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<int64_t>& indexIds, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transaction)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -130,25 +110,6 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::createIndex(int
     return IDBIndexBackendProxy::create(index.release());
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::createIndex(const String& name, const IDBKeyPath& keyPath, bool unique, bool multiEntry, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    OwnPtr<WebIDBIndex> index = adoptPtr(m_webIDBObjectStore->createIndex(name, keyPath, unique, multiEntry, *transactionProxy->getWebIDBTransaction(), ec));
-    if (!index)
-        return 0;
-    return IDBIndexBackendProxy::create(index.release());
-}
-
-void IDBObjectStoreBackendProxy::setIndexesReady(const Vector<String>& indexNames, IDBTransactionBackendInterface* transaction)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->setIndexesReady(WebVector<WebString>(indexNames), *transactionProxy->getWebIDBTransaction());
-}
-
 void IDBObjectStoreBackendProxy::setIndexesReady(const Vector<int64_t>& indexIds, IDBTransactionBackendInterface* transaction)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -157,14 +118,6 @@ void IDBObjectStoreBackendProxy::setIndexesReady(const Vector<int64_t>& indexIds
     m_webIDBObjectStore->setIndexesReady(WebVector<long long>(indexIds), *transactionProxy->getWebIDBTransaction());
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(const String& name, ExceptionCode& ec)
-{
-    OwnPtr<WebIDBIndex> index = adoptPtr(m_webIDBObjectStore->index(name, ec));
-    if (!index)
-        return 0;
-    return IDBIndexBackendProxy::create(index.release());
-}
-
 PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(int64_t indexId)
 {
     OwnPtr<WebIDBIndex> index = adoptPtr(m_webIDBObjectStore->index(indexId));
@@ -173,14 +126,6 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(int64_t i
     return IDBIndexBackendProxy::create(index.release());
 }
 
-void IDBObjectStoreBackendProxy::deleteIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->deleteIndex(name, *transactionProxy->getWebIDBTransaction(), ec);
-}
-
 void IDBObjectStoreBackendProxy::deleteIndex(const int64_t indexId, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
index 79113ae95..da8f6bbdd 100644
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
@@ -44,21 +44,15 @@ public:
     virtual ~IDBObjectStoreBackendProxy();
 
     virtual void get(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    virtual void putWithIndexKeys(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, const WTF::Vector<WTF::String>&, const WTF::Vector<IndexKeys>&, WebCore::ExceptionCode&);
     virtual void put(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, const WTF::Vector<int64_t>&, const WTF::Vector<IndexKeys>&);
     virtual void deleteFunction(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void clear(PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
     PassRefPtr<WebCore::IDBIndexBackendInterface> createIndex(int64_t id, const String& name, const WebCore::IDBKeyPath&, bool unique, bool multiEntry, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    PassRefPtr<WebCore::IDBIndexBackendInterface> createIndex(const String& name, const WebCore::IDBKeyPath&, bool unique, bool multiEntry, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    virtual void setIndexKeys(PassRefPtr<WebCore::IDBKey> prpPrimaryKey, const WTF::Vector<WTF::String>&, const Vector<IndexKeys>&, WebCore::IDBTransactionBackendInterface*);
     virtual void setIndexKeys(PassRefPtr<WebCore::IDBKey> prpPrimaryKey, const WTF::Vector<int64_t>&, const Vector<IndexKeys>&, WebCore::IDBTransactionBackendInterface*);
-    virtual void setIndexesReady(const Vector<String>&, WebCore::IDBTransactionBackendInterface*);
     virtual void setIndexesReady(const Vector<int64_t>&, WebCore::IDBTransactionBackendInterface*);
 
-    PassRefPtr<WebCore::IDBIndexBackendInterface> index(const String& name, WebCore::ExceptionCode&);
     PassRefPtr<WebCore::IDBIndexBackendInterface> index(int64_t);
-    void deleteIndex(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     void deleteIndex(int64_t, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
     virtual void openCursor(PassRefPtr<WebCore::IDBKeyRange>, WebCore::IDBCursor::Direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface::TaskType, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index f0837fef6..572963c13 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -54,14 +54,6 @@ IDBTransactionBackendProxy::~IDBTransactionBackendProxy()
 {
 }
 
-PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendProxy::objectStore(const String& name, ExceptionCode& ec)
-{
-    OwnPtr<WebIDBObjectStore> objectStore = adoptPtr(m_webIDBTransaction->objectStore(name, ec));
-    if (!objectStore)
-        return 0;
-    return IDBObjectStoreBackendProxy::create(objectStore.release());
-}
-
 PassRefPtr<WebCore::IDBObjectStoreBackendInterface> IDBTransactionBackendProxy::objectStore(int64_t indexId, ExceptionCode& ec)
 {
     OwnPtr<WebIDBObjectStore> objectStore = adoptPtr(m_webIDBTransaction->objectStore(indexId, ec));
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
index e8f2c3375..0a6a53b84 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -41,7 +41,6 @@ public:
     static PassRefPtr<IDBTransactionBackendInterface> create(PassOwnPtr<WebIDBTransaction>);
     virtual ~IDBTransactionBackendProxy();
 
-    virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(const String& name, WebCore::ExceptionCode&);
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(int64_t, WebCore::ExceptionCode&);
     virtual void commit();
     virtual void abort();
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.cpp b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
index c6e7b2277..220b7db74 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
@@ -163,6 +163,16 @@ void InspectorClientImpl::autoZoomPageToFitWidth()
         agent->autoZoomPageToFitWidth();
 }
 
+bool InspectorClientImpl::canShowFPSCounter()
+{
+    return true;
+}
+
+void InspectorClientImpl::setShowFPSCounter(bool show)
+{
+    m_inspectedWebView->setShowFPSCounter(show);
+}
+
 bool InspectorClientImpl::supportsFrameInstrumentation()
 {
     return true;
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.h b/Source/WebKit/chromium/src/InspectorClientImpl.h
index 75e1e4342..a759257af 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.h
@@ -77,6 +77,9 @@ public:
     virtual void overrideDeviceMetrics(int, int, float, bool);
     virtual void autoZoomPageToFitWidth();
 
+    virtual bool canShowFPSCounter();
+    virtual void setShowFPSCounter(bool);
+
     virtual bool supportsFrameInstrumentation();
 
     virtual void getAllocatedObjects(HashSet<const void*>&);
diff --git a/Source/WebKit/chromium/src/LinkHighlight.cpp b/Source/WebKit/chromium/src/LinkHighlight.cpp
index 583358b94..48709dc25 100644
--- a/Source/WebKit/chromium/src/LinkHighlight.cpp
+++ b/Source/WebKit/chromium/src/LinkHighlight.cpp
@@ -48,6 +48,7 @@
 #include <public/WebRect.h>
 #include <public/WebSize.h>
 #include <public/WebTransformationMatrix.h>
+#include <wtf/CurrentTime.h>
 
 using namespace WebCore;
 
@@ -66,6 +67,7 @@ LinkHighlight::LinkHighlight(Node* node, WebViewImpl* owningWebViewImpl)
     , m_currentGraphicsLayer(0)
     , m_geometryNeedsUpdate(false)
     , m_isAnimating(false)
+    , m_startTime(monotonicallyIncreasingTime())
 {
     ASSERT(m_node);
     ASSERT(owningWebViewImpl);
@@ -246,7 +248,8 @@ void LinkHighlight::startHighlightAnimationIfNeeded()
     m_isAnimating = true;
     const float startOpacity = 1;
     // FIXME: Should duration be configurable?
-    const float duration = 0.1f;
+    const float fadeDuration = 0.1f;
+    const float minPreFadeDuration = 0.1f;
 
     m_contentLayer->layer()->setOpacity(startOpacity);
 
@@ -255,9 +258,12 @@ void LinkHighlight::startHighlightAnimationIfNeeded()
     OwnPtr<WebFloatAnimationCurve> curve = adoptPtr(compositorSupport->createFloatAnimationCurve());
 
     curve->add(WebFloatKeyframe(0, startOpacity));
-    curve->add(WebFloatKeyframe(duration / 2, startOpacity));
+    // Make sure we have displayed for at least minPreFadeDuration before starting to fade out.
+    float extraDurationRequired = std::max(0.f, minPreFadeDuration - static_cast<float>(monotonicallyIncreasingTime() - m_startTime));
+    if (extraDurationRequired)
+        curve->add(WebFloatKeyframe(extraDurationRequired, startOpacity));
     // For layout tests we don't fade out.
-    curve->add(WebFloatKeyframe(duration, WebKit::layoutTestMode() ? startOpacity : 0));
+    curve->add(WebFloatKeyframe(fadeDuration + extraDurationRequired, WebKit::layoutTestMode() ? startOpacity : 0));
 
     m_animation = adoptPtr(compositorSupport->createAnimation(*curve, WebAnimation::TargetPropertyOpacity));
 
diff --git a/Source/WebKit/chromium/src/LinkHighlight.h b/Source/WebKit/chromium/src/LinkHighlight.h
index 06d8c909f..59582857d 100644
--- a/Source/WebKit/chromium/src/LinkHighlight.h
+++ b/Source/WebKit/chromium/src/LinkHighlight.h
@@ -91,6 +91,7 @@ private:
 
     bool m_geometryNeedsUpdate;
     bool m_isAnimating;
+    double m_startTime;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/PageWidgetDelegate.cpp b/Source/WebKit/chromium/src/PageWidgetDelegate.cpp
index 4cc81c14d..18985910b 100644
--- a/Source/WebKit/chromium/src/PageWidgetDelegate.cpp
+++ b/Source/WebKit/chromium/src/PageWidgetDelegate.cpp
@@ -81,15 +81,17 @@ void PageWidgetDelegate::layout(Page* page)
     view->updateLayoutAndStyleIfNeededRecursive();
 }
 
-void PageWidgetDelegate::paint(Page* page, PageOverlayList* overlays, WebCanvas* canvas, const WebRect& rect, CanvasBackground background)
+void PageWidgetDelegate::paint(Page* page, PageOverlayList* overlays, WebCanvas* canvas, const WebRect& rect, CanvasBackground background, bool applyDeviceScale)
 {
     if (rect.isEmpty())
         return;
     GraphicsContextBuilder builder(canvas);
     GraphicsContext& gc = builder.context();
     gc.platformContext()->setDrawingToImageBuffer(background == Opaque ? false : true);
-    gc.applyDeviceScaleFactor(page->deviceScaleFactor());
-    gc.platformContext()->setDeviceScaleFactor(page->deviceScaleFactor());
+    if (applyDeviceScale) {
+        gc.applyDeviceScaleFactor(page->deviceScaleFactor());
+        gc.platformContext()->setDeviceScaleFactor(page->deviceScaleFactor());
+    }
     IntRect dirtyRect(rect);
     gc.save();
     FrameView* view = mainFrameView(page);
diff --git a/Source/WebKit/chromium/src/PageWidgetDelegate.h b/Source/WebKit/chromium/src/PageWidgetDelegate.h
index c9f76bb95..9a03a9002 100644
--- a/Source/WebKit/chromium/src/PageWidgetDelegate.h
+++ b/Source/WebKit/chromium/src/PageWidgetDelegate.h
@@ -79,7 +79,7 @@ public:
     };
     static void animate(WebCore::Page*, double monotonicFrameBeginTime);
     static void layout(WebCore::Page*);
-    static void paint(WebCore::Page*, PageOverlayList*, WebCanvas*, const WebRect&, CanvasBackground);
+    static void paint(WebCore::Page*, PageOverlayList*, WebCanvas*, const WebRect&, CanvasBackground, bool applyDeviceScale);
     static bool handleInputEvent(WebCore::Page*, PageWidgetEventHandler&, const WebInputEvent&);
 
 private:
diff --git a/Source/WebKit/chromium/src/PlatformSupport.cpp b/Source/WebKit/chromium/src/PlatformSupport.cpp
index a39b1e9cb..d7a4fbbfc 100644
--- a/Source/WebKit/chromium/src/PlatformSupport.cpp
+++ b/Source/WebKit/chromium/src/PlatformSupport.cpp
@@ -58,7 +58,13 @@
 
 #if OS(WINDOWS)
 #include "platform/WebRect.h"
+#if !ENABLE(DEFAULT_RENDER_THEME)
 #include <public/win/WebThemeEngine.h>
+#endif // !ENABLE(DEFAULT_RENDER_THEME)
+#endif
+
+#if ENABLE(DEFAULT_RENDER_THEME)
+#include <public/default/WebThemeEngine.h>
 #endif
 
 #if OS(DARWIN)
@@ -69,15 +75,15 @@
 #include <public/android/WebThemeEngine.h>
 #else
 #include "WebFontInfo.h"
+#if !ENABLE(DEFAULT_RENDER_THEME)
 #include <public/linux/WebThemeEngine.h>
+#endif // !ENABLE(DEFAULT_RENDER_THEME)
 #endif // OS(ANDROID)
 #endif // elif OS(UNIX)
 
 #include "NativeImageSkia.h"
 
 #include "BitmapImage.h"
-#include "Cookie.h"
-#include "Document.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "IDBFactoryBackendProxy.h"
@@ -89,8 +95,6 @@
 
 #include "Worker.h"
 #include "WorkerContextProxy.h"
-#include <public/WebCookie.h>
-#include <public/WebCookieJar.h>
 #include <public/WebMimeRegistry.h>
 #include <public/WebVector.h>
 #include <wtf/Assertions.h>
@@ -100,86 +104,6 @@ using namespace WebKit;
 
 namespace WebCore {
 
-static WebCookieJar* getCookieJar(const Document* document)
-{
-    WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(document->frame());
-    if (!frameImpl || !frameImpl->client())
-        return 0;
-    WebCookieJar* cookieJar = frameImpl->client()->cookieJar(frameImpl);
-    if (!cookieJar)
-        cookieJar = WebKit::Platform::current()->cookieJar();
-    return cookieJar;
-}
-
-// Cookies --------------------------------------------------------------------
-
-void PlatformSupport::setCookies(const Document* document, const KURL& url,
-                                const String& value)
-{
-    WebCookieJar* cookieJar = getCookieJar(document);
-    if (cookieJar)
-        cookieJar->setCookie(url, document->firstPartyForCookies(), value);
-}
-
-String PlatformSupport::cookies(const Document* document, const KURL& url)
-{
-    String result;
-    WebCookieJar* cookieJar = getCookieJar(document);
-    if (cookieJar)
-        result = cookieJar->cookies(url, document->firstPartyForCookies());
-    return result;
-}
-
-String PlatformSupport::cookieRequestHeaderFieldValue(const Document* document,
-                                                     const KURL& url)
-{
-    String result;
-    WebCookieJar* cookieJar = getCookieJar(document);
-    if (cookieJar)
-        result = cookieJar->cookieRequestHeaderFieldValue(url, document->firstPartyForCookies());
-    return result;
-}
-
-bool PlatformSupport::rawCookies(const Document* document, const KURL& url, Vector<Cookie>& rawCookies)
-{
-    rawCookies.clear();
-    WebVector<WebCookie> webCookies;
-
-    WebCookieJar* cookieJar = getCookieJar(document);
-    if (cookieJar)
-        cookieJar->rawCookies(url, document->firstPartyForCookies(), webCookies);
-
-    for (unsigned i = 0; i < webCookies.size(); ++i) {
-        const WebCookie& webCookie = webCookies[i];
-        Cookie cookie(webCookie.name,
-                      webCookie.value,
-                      webCookie.domain,
-                      webCookie.path,
-                      webCookie.expires,
-                      webCookie.httpOnly,
-                      webCookie.secure,
-                      webCookie.session);
-        rawCookies.append(cookie);
-    }
-    return true;
-}
-
-void PlatformSupport::deleteCookie(const Document* document, const KURL& url, const String& cookieName)
-{
-    WebCookieJar* cookieJar = getCookieJar(document);
-    if (cookieJar)
-        cookieJar->deleteCookie(url, cookieName);
-}
-
-bool PlatformSupport::cookiesEnabled(const Document* document)
-{
-    bool result = false;
-    WebCookieJar* cookieJar = getCookieJar(document);
-    if (cookieJar)
-        result = cookieJar->cookiesEnabled(document->cookieURL(), document->firstPartyForCookies());
-    return result;
-}
-
 // Font -----------------------------------------------------------------------
 
 #if OS(WINDOWS)
@@ -221,7 +145,7 @@ NPObject* PlatformSupport::pluginScriptableObject(Widget* widget)
 
 // Theming --------------------------------------------------------------------
 
-#if OS(WINDOWS)
+#if OS(WINDOWS) && !ENABLE(DEFAULT_RENDER_THEME)
 
 void PlatformSupport::paintButton(
     GraphicsContext* gc, int part, int state, int classicState,
diff --git a/Source/WebKit/chromium/src/WebArrayBuffer.cpp b/Source/WebKit/chromium/src/WebArrayBuffer.cpp
index d43874b63..2d192bdb7 100644
--- a/Source/WebKit/chromium/src/WebArrayBuffer.cpp
+++ b/Source/WebKit/chromium/src/WebArrayBuffer.cpp
@@ -72,7 +72,7 @@ unsigned WebArrayBuffer::byteLength() const
 #if WEBKIT_USING_V8
 v8::Handle<v8::Value> WebArrayBuffer::toV8Value()
 {
-    return V8ArrayBuffer::wrap(m_private.get());
+    return toV8Object(m_private.get());
 }
 
 WebArrayBuffer* WebArrayBuffer::createFromV8Value(v8::Handle<v8::Value> value)
diff --git a/Source/WebKit/chromium/src/WebBlob.cpp b/Source/WebKit/chromium/src/WebBlob.cpp
index f8228e9d7..b2f299fdd 100644
--- a/Source/WebKit/chromium/src/WebBlob.cpp
+++ b/Source/WebKit/chromium/src/WebBlob.cpp
@@ -61,7 +61,7 @@ void WebBlob::assign(const WebBlob& other)
 #if WEBKIT_USING_V8
 v8::Handle<v8::Value>  WebBlob::toV8Value()
 {
-    return V8Blob::wrap(m_private.get());
+    return toV8Object(m_private.get());
 }
 #endif
 
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 87d7b2522..74836d55f 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -27,12 +27,12 @@
 
 #include "WebCompositorInputHandlerImpl.h"
 
-#include "PlatformGestureCurveFactory.h"
-#include "PlatformGestureCurveTarget.h"
 #include "TraceEvent.h"
 #include "WebCompositorInputHandlerClient.h"
 #include "WebInputEvent.h"
+#include <public/Platform.h>
 #include <public/WebInputHandlerClient.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/ThreadingPrimitives.h>
 
 using namespace WebCore;
@@ -119,9 +119,9 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
         switch (scrollStatus) {
         case WebInputHandlerClient::ScrollStatusStarted: {
             TRACE_EVENT_INSTANT2("cc", "WebCompositorInputHandlerImpl::handleInput wheel scroll", "deltaX", -wheelEvent.deltaX, "deltaY", -wheelEvent.deltaY);
-            m_inputHandlerClient->scrollBy(WebPoint(wheelEvent.x, wheelEvent.y), IntSize(-wheelEvent.deltaX, -wheelEvent.deltaY));
+            bool didScroll = m_inputHandlerClient->scrollByIfPossible(WebPoint(wheelEvent.x, wheelEvent.y), IntSize(-wheelEvent.deltaX, -wheelEvent.deltaY));
             m_inputHandlerClient->scrollEnd();
-            return DidHandle;
+            return didScroll ? DidHandle : DropEvent;
         }
         case WebInputHandlerClient::ScrollStatusIgnored:
             // FIXME: This should be DropEvent, but in cases where we fail to properly sync scrollability it's safer to send the
@@ -154,9 +154,9 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
             return DidNotHandle;
 
         const WebGestureEvent& gestureEvent = *static_cast<const WebGestureEvent*>(&event);
-        m_inputHandlerClient->scrollBy(WebPoint(gestureEvent.x, gestureEvent.y),
+        bool didScroll = m_inputHandlerClient->scrollByIfPossible(WebPoint(gestureEvent.x, gestureEvent.y),
             IntSize(-gestureEvent.data.scrollUpdate.deltaX, -gestureEvent.data.scrollUpdate.deltaY));
-        return DidHandle;
+        return didScroll ? DidHandle : DropEvent;
     } else if (event.type == WebInputEvent::GestureScrollEnd) {
         ASSERT(m_expectScrollUpdateEnd);
 #ifndef NDEBUG
@@ -206,8 +206,8 @@ WebCompositorInputHandlerImpl::EventDisposition WebCompositorInputHandlerImpl::h
     switch (scrollStatus) {
     case WebInputHandlerClient::ScrollStatusStarted: {
         m_inputHandlerClient->scrollEnd();
-        m_wheelFlingCurve = PlatformGestureCurveFactory::get()->createCurve(gestureEvent.data.flingStart.sourceDevice, FloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY));
-        TRACE_EVENT_ASYNC_BEGIN1("cc", "WebCompositorInputHandlerImpl::handleGestureFling::started", this, "curve", m_wheelFlingCurve->debugName());
+        m_wheelFlingCurve = adoptPtr(Platform::current()->createFlingAnimationCurve(gestureEvent.data.flingStart.sourceDevice, WebFloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY), WebSize()));
+        TRACE_EVENT_ASYNC_BEGIN0("cc", "WebCompositorInputHandlerImpl::handleGestureFling::started", this);
         m_wheelFlingParameters.delta = WebFloatPoint(gestureEvent.data.flingStart.velocityX, gestureEvent.data.flingStart.velocityY);
         m_wheelFlingParameters.point = WebPoint(gestureEvent.x, gestureEvent.y);
         m_wheelFlingParameters.globalPoint = WebPoint(gestureEvent.globalX, gestureEvent.globalY);
@@ -273,16 +273,16 @@ bool WebCompositorInputHandlerImpl::cancelCurrentFling()
     return hadFlingAnimation;
 }
 
-void WebCompositorInputHandlerImpl::scrollBy(const IntPoint& increment)
+void WebCompositorInputHandlerImpl::scrollBy(const WebPoint& increment)
 {
-    if (increment == IntPoint::zero())
+    if (increment == WebPoint())
         return;
 
-    TRACE_EVENT2("cc", "WebCompositorInputHandlerImpl::scrollBy", "x", increment.x(), "y", increment.y());
+    TRACE_EVENT2("cc", "WebCompositorInputHandlerImpl::scrollBy", "x", increment.x, "y", increment.y);
     WebMouseWheelEvent syntheticWheel;
     syntheticWheel.type = WebInputEvent::MouseWheel;
-    syntheticWheel.deltaX = increment.x();
-    syntheticWheel.deltaY = increment.y();
+    syntheticWheel.deltaX = increment.x;
+    syntheticWheel.deltaY = increment.y;
     syntheticWheel.hasPreciseScrollingDeltas = true;
     syntheticWheel.x = m_wheelFlingParameters.point.x;
     syntheticWheel.y = m_wheelFlingParameters.point.y;
@@ -293,8 +293,8 @@ void WebCompositorInputHandlerImpl::scrollBy(const IntPoint& increment)
     WebCompositorInputHandlerImpl::EventDisposition disposition = handleInputEventInternal(syntheticWheel);
     switch (disposition) {
     case DidHandle:
-        m_wheelFlingParameters.cumulativeScroll.width += increment.x();
-        m_wheelFlingParameters.cumulativeScroll.height += increment.y();
+        m_wheelFlingParameters.cumulativeScroll.width += increment.x;
+        m_wheelFlingParameters.cumulativeScroll.height += increment.y;
     case DropEvent:
         break;
     case DidNotHandle:
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
index fa81de945..efe7f53b4 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
@@ -26,10 +26,11 @@
 #ifndef WebCompositorInputHandlerImpl_h
 #define WebCompositorInputHandlerImpl_h
 
-#include "PlatformGestureCurveTarget.h"
 #include "WebActiveWheelFlingParameters.h"
 #include "WebCompositorInputHandler.h"
 #include "WebInputEvent.h"
+#include <public/WebGestureCurve.h>
+#include <public/WebGestureCurveTarget.h>
 #include <public/WebInputHandler.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
@@ -41,14 +42,13 @@ class Mutex;
 
 namespace WebCore {
 class IntPoint;
-class PlatformGestureCurve;
 }
 
 namespace WebKit {
 
 class WebCompositorInputHandlerClient;
 
-class WebCompositorInputHandlerImpl : public WebCompositorInputHandler, public WebInputHandler, public WebCore::PlatformGestureCurveTarget {
+class WebCompositorInputHandlerImpl : public WebCompositorInputHandler, public WebInputHandler, public WebGestureCurveTarget {
     WTF_MAKE_NONCOPYABLE(WebCompositorInputHandlerImpl);
 public:
     static WebCompositorInputHandler* fromIdentifier(int identifier);
@@ -64,8 +64,8 @@ public:
     virtual void bindToClient(WebInputHandlerClient*);
     virtual void animate(double monotonicTime);
 
-    // WebCore::PlatformGestureCurveTarget implementation.
-    virtual void scrollBy(const WebCore::IntPoint&);
+    // WebGestureCurveTarget implementation.
+    virtual void scrollBy(const WebPoint&);
 
     int identifier() const { return m_identifier; }
 
@@ -81,7 +81,7 @@ private:
     // Returns true if we actually had an active fling to cancel.
     bool cancelCurrentFling();
 
-    OwnPtr<WebCore::PlatformGestureCurve> m_wheelFlingCurve;
+    OwnPtr<WebGestureCurve> m_wheelFlingCurve;
     // Parameters for the active fling animation, stored in case we need to transfer it out later.
     WebActiveWheelFlingParameters m_wheelFlingParameters;
 
diff --git a/Source/WebKit/chromium/src/WebCursorInfo.cpp b/Source/WebKit/chromium/src/WebCursorInfo.cpp
index d4b0f81fa..0981e4665 100644
--- a/Source/WebKit/chromium/src/WebCursorInfo.cpp
+++ b/Source/WebKit/chromium/src/WebCursorInfo.cpp
@@ -38,13 +38,14 @@ using namespace WebCore;
 namespace WebKit {
 
 WebCursorInfo::WebCursorInfo(const Cursor& cursor)
-{
-    type = static_cast<Type>(cursor.impl().type());
-    hotSpot = cursor.impl().hotSpot();
-    customImage = cursor.impl().customImage();
+    : type(static_cast<Type>(cursor.type()))
+    , hotSpot(cursor.hotSpot())
+    , imageScaleFactor(1)
+    , customImage(cursor.image())
 #ifdef WIN32
-    externalHandle = 0;
+    , externalHandle(0)
 #endif
+{
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSessionDescriptionDescriptor.cpp b/Source/WebKit/chromium/src/WebDOMCustomEvent.cpp
index 05cfce36d..2f7f8f428 100644
--- a/Source/WebKit/chromium/src/WebSessionDescriptionDescriptor.cpp
+++ b/Source/WebKit/chromium/src/WebDOMCustomEvent.cpp
@@ -29,64 +29,23 @@
  */
 
 #include "config.h"
+#include "WebDOMCustomEvent.h"
 
-#if ENABLE(MEDIA_STREAM)
-
-#include <public/WebSessionDescriptionDescriptor.h>
-
-#include "SessionDescriptionDescriptor.h"
-#include <public/WebICECandidateDescriptor.h>
+#include "CustomEvent.h"
+#include "SerializedScriptValue.h"
+#include "platform/WebSerializedScriptValue.h"
 #include <public/WebString.h>
-#include <wtf/Vector.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-WebSessionDescriptionDescriptor::WebSessionDescriptionDescriptor(const PassRefPtr<SessionDescriptionDescriptor>& sessionDescription)
-    : m_private(sessionDescription)
+void WebDOMCustomEvent::initCustomEvent(const WebString& type, bool canBubble, bool cancelable, const WebSerializedScriptValue& webSerializedScriptValue)
 {
-}
-
-void WebSessionDescriptionDescriptor::assign(const WebSessionDescriptionDescriptor& other)
-{
-    m_private = other.m_private;
-}
-
-void WebSessionDescriptionDescriptor::reset()
-{
-    m_private.reset();
-}
-
-WebSessionDescriptionDescriptor::operator WTF::PassRefPtr<WebCore::SessionDescriptionDescriptor>()
-{
-    return m_private.get();
-}
-
-void WebSessionDescriptionDescriptor::initialize(const WebString& sdp)
-{
-    m_private = SessionDescriptionDescriptor::create(sdp);
-}
-
-size_t WebSessionDescriptionDescriptor::numberOfAddedCandidates() const
-{
-    ASSERT(!m_private.isNull());
-    return m_private.get()->numberOfAddedCandidates();
-}
-
-WebICECandidateDescriptor WebSessionDescriptionDescriptor::candidate(size_t index) const
-{
-    ASSERT(!m_private.isNull());
-    return m_private.get()->candidate(index);
-}
-
-WebString WebSessionDescriptionDescriptor::initialSDP() const
-{
-    ASSERT(!m_private.isNull());
-    return m_private.get()->initialSDP();
+    ASSERT(m_private);
+    RefPtr<SerializedScriptValue> serializedScriptValue;
+    serializedScriptValue = webSerializedScriptValue;
+    unwrap<CustomEvent>()->initCustomEvent(type, canBubble, cancelable, serializedScriptValue.get());
 }
 
 } // namespace WebKit
-
-#endif // ENABLE(MEDIA_STREAM)
-
diff --git a/Source/WebKit/chromium/src/WebDocument.cpp b/Source/WebKit/chromium/src/WebDocument.cpp
index c7a3a834a..ddd766636 100644
--- a/Source/WebKit/chromium/src/WebDocument.cpp
+++ b/Source/WebKit/chromium/src/WebDocument.cpp
@@ -194,12 +194,13 @@ WebDocumentType WebDocument::doctype() const
     return WebDocumentType(constUnwrap<Document>()->doctype());
 }
 
-void WebDocument::insertUserStyleSheet(const WebString& sourceCode, UserStyleLevel level)
+void WebDocument::insertUserStyleSheet(const WebString& sourceCode, UserStyleLevel)
 {
     RefPtr<Document> document = unwrap<Document>();
 
+    // FIXME: We currently ignore the passed in UserStyleLevel. http://crbug.com/162096
     RefPtr<StyleSheetContents> parsedSheet = StyleSheetContents::create(document.get());
-    parsedSheet->setIsUserStyleSheet(level == UserStyleUserLevel);
+    parsedSheet->setIsUserStyleSheet(true);
     parsedSheet->parseString(sourceCode);
     document->styleSheetCollection()->addUserSheet(parsedSheet.release());
 }
diff --git a/Source/WebKit/chromium/src/WebElement.cpp b/Source/WebKit/chromium/src/WebElement.cpp
index 49fff0a07..96cf9791d 100644
--- a/Source/WebKit/chromium/src/WebElement.cpp
+++ b/Source/WebKit/chromium/src/WebElement.cpp
@@ -66,8 +66,13 @@ bool WebElement::hasTagName(const WebString& tagName) const
 
 bool WebElement::hasHTMLTagName(const WebString& tagName) const
 {
+    // How to create                     class              nodeName localName
+    // createElement('input')            HTMLInputElement   INPUT    input
+    // createElement('INPUT')            HTMLInputElement   INPUT    input
+    // createElementNS(xhtmlNS, 'input') HTMLInputElement   INPUT    input
+    // createElementNS(xhtmlNS, 'INPUT') HTMLUnknownElement INPUT    INPUT
     const Element* element = constUnwrap<Element>();
-    return HTMLNames::xhtmlNamespaceURI == element->namespaceURI() && equalIgnoringCase(element->tagName(), String(tagName));
+    return HTMLNames::xhtmlNamespaceURI == element->namespaceURI() && element->localName() == String(tagName).lower();
 }
 
 bool WebElement::hasAttribute(const WebString& attrName) const
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index 1936476f3..eacf9aba8 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -130,7 +130,6 @@
 #include "RenderObject.h"
 #include "RenderTreeAsText.h"
 #include "RenderView.h"
-#include "RenderWidget.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
 #include "SchemeRegistry.h"
@@ -304,23 +303,6 @@ static long long generateFrameIdentifier()
     return ++next;
 }
 
-static WebPluginContainerImpl* pluginContainerFromNode(const WebNode& node)
-{
-    if (node.isNull())
-        return 0;
-
-    const Node* coreNode = node.constUnwrap<Node>();
-    if (coreNode->hasTagName(HTMLNames::objectTag) || coreNode->hasTagName(HTMLNames::embedTag)) {
-        RenderObject* object = coreNode->renderer();
-        if (object && object->isWidget()) {
-            Widget* widget = toRenderWidget(object)->widget();
-            if (widget && widget->isPluginContainer())
-                return static_cast<WebPluginContainerImpl*>(widget);
-        }
-    }
-    return 0;
-}
-
 WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(Frame* frame)
 {
     if (!frame)
@@ -1202,7 +1184,7 @@ size_t WebFrameImpl::characterIndexForPoint(const WebPoint& webPoint) const
 
     IntPoint point = frame()->view()->windowToContents(webPoint);
     HitTestResult result = frame()->eventHandler()->hitTestResultAtPoint(point, false);
-    RefPtr<Range> range = frame()->rangeForPoint(result.roundedPoint());
+    RefPtr<Range> range = frame()->rangeForPoint(result.roundedPointInInnerNodeFrame());
     if (!range)
         return notFound;
 
@@ -1232,7 +1214,7 @@ bool WebFrameImpl::executeCommand(const WebString& name, const WebNode& node)
     if (command == "Copy") {
         WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
         if (!pluginContainer)
-            pluginContainer = pluginContainerFromNode(node);
+            pluginContainer = static_cast<WebPluginContainerImpl*>(node.pluginContainer());
         if (pluginContainer) {
             pluginContainer->copy();
             return true;
@@ -1428,7 +1410,7 @@ int WebFrameImpl::printBegin(const WebPrintParams& printParams, const WebNode& c
         pluginContainer = pluginContainerFromFrame(frame());
     } else {
         // We only support printing plugin nodes for now.
-        pluginContainer = pluginContainerFromNode(constrainToNode);
+        pluginContainer = static_cast<WebPluginContainerImpl*>(constrainToNode.pluginContainer());
     }
 
     if (pluginContainer && pluginContainer->supportsPaginatedPrint())
@@ -1477,7 +1459,7 @@ void WebFrameImpl::printEnd()
 
 bool WebFrameImpl::isPrintScalingDisabledForPlugin(const WebNode& node)
 {
-    WebPluginContainerImpl* pluginContainer =  node.isNull() ? pluginContainerFromFrame(frame()) : pluginContainerFromNode(node);
+    WebPluginContainerImpl* pluginContainer =  node.isNull() ? pluginContainerFromFrame(frame()) : static_cast<WebPluginContainerImpl*>(node.pluginContainer());
 
     if (!pluginContainer || !pluginContainer->supportsPaginatedPrint())
         return false;
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index 90c262389..59abd5329 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -70,11 +70,6 @@ WebIDBObjectStore* WebIDBDatabaseImpl::createObjectStore(long long id, const Web
     return new WebIDBObjectStoreImpl(objectStore);
 }
 
-void WebIDBDatabaseImpl::deleteObjectStore(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
-{
-    m_databaseBackend->deleteObjectStore(name, transaction.getIDBTransactionBackendInterface(), ec);
-}
-
 void WebIDBDatabaseImpl::deleteObjectStore(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_databaseBackend->deleteObjectStore(objectStoreId, transaction.getIDBTransactionBackendInterface(), ec);
@@ -85,17 +80,6 @@ void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* c
     m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(adoptPtr(callbacks)), m_databaseCallbacks, ec);
 }
 
-WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode& ec)
-{
-    RefPtr<DOMStringList> nameList = PassRefPtr<DOMStringList>(names);
-    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, ec);
-    if (!transaction) {
-        ASSERT(ec);
-        return 0;
-    }
-    return new WebIDBTransactionImpl(transaction);
-}
-
 WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebVector<long long>& objectStoreIds, unsigned short mode)
 {
     Vector<int64_t> objectStoreIdList(objectStoreIds.size());
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
index 65a19668a..e728742c6 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -53,10 +53,8 @@ public:
     virtual WebIDBMetadata metadata() const;
 
     virtual WebIDBObjectStore* createObjectStore(long long, const WebString& name, const WebIDBKeyPath&, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&);
-    virtual void deleteObjectStore(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
     virtual void deleteObjectStore(long long objectStoreId, const WebIDBTransaction&, WebExceptionCode&);
     virtual void setVersion(const WebString& version, WebIDBCallbacks*, WebExceptionCode&);
-    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode&);
     virtual WebIDBTransaction* transaction(const WebVector<long long>& names, unsigned short mode);
     virtual void forceClose();
     virtual void close();
diff --git a/Source/WebKit/chromium/src/WebIDBKey.cpp b/Source/WebKit/chromium/src/WebIDBKey.cpp
index d60b5f5c1..609d3b4a0 100644
--- a/Source/WebKit/chromium/src/WebIDBKey.cpp
+++ b/Source/WebKit/chromium/src/WebIDBKey.cpp
@@ -30,7 +30,6 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "IDBBindingUtilities.h"
 #include "IDBKey.h"
 
 using namespace WebCore;
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 85bac13b3..102804bc8 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -58,23 +58,6 @@ void WebIDBObjectStoreImpl::get(const WebIDBKeyRange& keyRange, WebIDBCallbacks*
     m_objectStore->get(keyRange, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::putWithIndexKeys(const WebSerializedScriptValue& value, const WebIDBKey& key, PutMode putMode, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, const WebVector<WebString>& webIndexNames, const WebVector<WebIndexKeys>& webIndexKeys, WebExceptionCode& ec)
-{
-    ASSERT(webIndexNames.size() == webIndexKeys.size());
-    Vector<String> indexNames(webIndexNames.size());
-    Vector<IDBObjectStoreBackendInterface::IndexKeys> indexKeys(webIndexKeys.size());
-
-    for (size_t i = 0; i < webIndexNames.size(); ++i) {
-        indexNames[i] = webIndexNames[i];
-        Vector<RefPtr<IDBKey> > indexKeyList(webIndexKeys[i].size());
-        for (size_t j = 0; j < webIndexKeys[i].size(); ++j)
-            indexKeyList[j] = webIndexKeys[i][j];
-        indexKeys[i] = indexKeyList;
-    }
-
-    m_objectStore->putWithIndexKeys(value, key, static_cast<IDBObjectStoreBackendInterface::PutMode>(putMode), IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), indexNames, indexKeys, ec);
-}
-
 void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, PutMode putMode, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, const WebVector<long long>& webIndexIds, const WebVector<WebIndexKeys>& webIndexKeys)
 {
     ASSERT(webIndexIds.size() == webIndexKeys.size());
@@ -92,22 +75,6 @@ void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const Web
     m_objectStore->put(value, key, static_cast<IDBObjectStoreBackendInterface::PutMode>(putMode), IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), indexIds, indexKeys);
 }
 
-void WebIDBObjectStoreImpl::setIndexKeys(const WebIDBKey& primaryKey, const WebVector<WebString>& webIndexNames, const WebVector<WebIndexKeys>& webIndexKeys, const WebIDBTransaction& transaction)
-{
-    ASSERT(webIndexNames.size() == webIndexKeys.size());
-    Vector<String> indexNames(webIndexNames.size());
-    Vector<IDBObjectStoreBackendInterface::IndexKeys> indexKeys(webIndexKeys.size());
-
-    for (size_t i = 0; i < webIndexNames.size(); ++i) {
-        indexNames[i] = webIndexNames[i];
-        Vector<RefPtr<IDBKey> > indexKeyList(webIndexKeys[i].size());
-        for (size_t j = 0; j < webIndexKeys[i].size(); ++j)
-            indexKeyList[j] = webIndexKeys[i][j];
-        indexKeys[i] = indexKeyList;
-    }
-    m_objectStore->setIndexKeys(primaryKey, indexNames, indexKeys, transaction.getIDBTransactionBackendInterface());
-}
-
 void WebIDBObjectStoreImpl::setIndexKeys(const WebIDBKey& primaryKey, const WebVector<long long>& webIndexIds, const WebVector<WebIndexKeys>& webIndexKeys, const WebIDBTransaction& transaction)
 {
     ASSERT(webIndexIds.size() == webIndexKeys.size());
@@ -124,14 +91,6 @@ void WebIDBObjectStoreImpl::setIndexKeys(const WebIDBKey& primaryKey, const WebV
     m_objectStore->setIndexKeys(primaryKey, indexIds, indexKeys, transaction.getIDBTransactionBackendInterface());
 }
 
-void WebIDBObjectStoreImpl::setIndexesReady(const WebVector<WebString>& webIndexNames, const WebIDBTransaction& transaction)
-{
-    Vector<String> indexNames(webIndexNames.size());
-    for (size_t i = 0; i < webIndexNames.size(); ++i)
-        indexNames[i] = webIndexNames[i];
-    m_objectStore->setIndexesReady(indexNames, transaction.getIDBTransactionBackendInterface());
-}
-
 void WebIDBObjectStoreImpl::setIndexesReady(const WebVector<long long>& webIndexNames, const WebIDBTransaction& transaction)
 {
     Vector<int64_t> indexIds(webIndexNames.size());
@@ -158,14 +117,6 @@ WebIDBIndex* WebIDBObjectStoreImpl::createIndex(long long id, const WebString& n
     return new WebIDBIndexImpl(index);
 }
 
-WebIDBIndex* WebIDBObjectStoreImpl::index(const WebString& name, WebExceptionCode& ec)
-{
-    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name, ec);
-    if (!index)
-        return 0;
-    return new WebIDBIndexImpl(index);
-}
-
 WebIDBIndex* WebIDBObjectStoreImpl::index(long long objectStoreId)
 {
     RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(objectStoreId);
@@ -174,11 +125,6 @@ WebIDBIndex* WebIDBObjectStoreImpl::index(long long objectStoreId)
     return new WebIDBIndexImpl(index);
 }
 
-void WebIDBObjectStoreImpl::deleteIndex(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
-{
-    m_objectStore->deleteIndex(name, transaction.getIDBTransactionBackendInterface(), ec);
-}
-
 void WebIDBObjectStoreImpl::deleteIndex(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_objectStore->deleteIndex(objectStoreId, transaction.getIDBTransactionBackendInterface(), ec);
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 5de3c9a15..70f19cc8f 100644
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -46,19 +46,14 @@ public:
     ~WebIDBObjectStoreImpl();
 
     void get(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
-    void putWithIndexKeys(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<WebString>&, const WebVector<WebIndexKeys>&, WebExceptionCode&);
     void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<long long>&, const WebVector<WebIndexKeys>&);
-    void setIndexKeys(const WebIDBKey&, const WebVector<WebString>& indexNames, const WebVector<WebIndexKeys>&, const WebIDBTransaction&);
     void setIndexKeys(const WebIDBKey&, const WebVector<long long>& indexNames, const WebVector<WebIndexKeys>&, const WebIDBTransaction&);
-    void setIndexesReady(const WebVector<WebString>&, const WebIDBTransaction&);
     void setIndexesReady(const WebVector<long long>&, const WebIDBTransaction&);
     void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
     WebIDBIndex* createIndex(long long, const WebString& name, const WebIDBKeyPath&, bool unique, bool multiEntry, const WebIDBTransaction&, WebExceptionCode&);
-    WebIDBIndex* index(const WebString& name, WebExceptionCode&);
     WebIDBIndex* index(long long);
-    void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
     void deleteIndex(long long, const WebIDBTransaction&, WebExceptionCode&);
 
     void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&);
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
index 6616d671f..40d7d7563 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
@@ -47,14 +47,6 @@ WebIDBTransactionImpl::~WebIDBTransactionImpl()
 {
 }
 
-WebIDBObjectStore* WebIDBTransactionImpl::objectStore(const WebString& name, ExceptionCode& ec)
-{
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->objectStore(name, ec);
-    if (!objectStore)
-        return 0;
-    return new WebIDBObjectStoreImpl(objectStore);
-}
-
 WebIDBObjectStore* WebIDBTransactionImpl::objectStore(long long indexId, ExceptionCode& ec)
 {
     RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->objectStore(indexId, ec);
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
index 1ee6ab801..0fb653767 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
@@ -41,7 +41,6 @@ public:
     WebIDBTransactionImpl(WTF::PassRefPtr<WebCore::IDBTransactionBackendInterface>);
     virtual ~WebIDBTransactionImpl();
 
-    virtual WebIDBObjectStore* objectStore(const WebString& name, WebExceptionCode&);
     virtual WebIDBObjectStore* objectStore(long long indexId, WebExceptionCode&);
     virtual void commit();
     virtual void abort();
diff --git a/Source/WebKit/chromium/src/WebInputElement.cpp b/Source/WebKit/chromium/src/WebInputElement.cpp
index bdc9f5db2..bfc0c236b 100644
--- a/Source/WebKit/chromium/src/WebInputElement.cpp
+++ b/Source/WebKit/chromium/src/WebInputElement.cpp
@@ -163,6 +163,11 @@ bool WebInputElement::isValidValue(const WebString& value) const
     return constUnwrap<HTMLInputElement>()->isValidValue(value);
 }
 
+void WebInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
+{
+    unwrap<HTMLInputElement>()->setChecked(nowChecked, sendChangeEvent ? DispatchChangeEvent : DispatchNoEvent);
+}
+
 bool WebInputElement::isChecked() const
 {
     return constUnwrap<HTMLInputElement>()->checked();
diff --git a/Source/WebKit/chromium/src/WebNode.cpp b/Source/WebKit/chromium/src/WebNode.cpp
index 27d57cfbc..e3e720b6e 100644
--- a/Source/WebKit/chromium/src/WebNode.cpp
+++ b/Source/WebKit/chromium/src/WebNode.cpp
@@ -38,12 +38,17 @@
 #include "Node.h"
 #include "NodeList.h"
 #include "EventListenerWrapper.h"
+#include "RenderObject.h"
+#include "RenderWidget.h"
 #include "WebDOMEvent.h"
 #include "WebDOMEventListener.h"
 #include "WebDocument.h"
 #include "WebElement.h"
 #include "WebFrameImpl.h"
 #include "WebNodeList.h"
+#include "WebPluginContainer.h"
+#include "WebPluginContainerImpl.h"
+#include "Widget.h"
 #include "markup.h"
 #include <public/WebString.h>
 #include <public/WebVector.h>
@@ -204,8 +209,7 @@ bool WebNode::dispatchEvent(const WebDOMEvent& event)
 
 void WebNode::simulateClick()
 {
-    RefPtr<Event> noEvent;
-    m_private->dispatchSimulatedClick(noEvent);
+    m_private->dispatchSimulatedClick(0);
 }
 
 WebNodeList WebNode::getElementsByTagName(const WebString& tag) const
@@ -236,6 +240,22 @@ bool WebNode::hasNonEmptyBoundingBox() const
     return m_private->hasNonEmptyBoundingBox();
 }
 
+WebPluginContainer* WebNode::pluginContainer() const
+{
+    if (isNull())
+        return 0;
+    const Node* coreNode = constUnwrap<Node>();
+    if (coreNode->hasTagName(HTMLNames::objectTag) || coreNode->hasTagName(HTMLNames::embedTag)) {
+        RenderObject* object = coreNode->renderer();
+        if (object && object->isWidget()) {
+            Widget* widget = WebCore::toRenderWidget(object)->widget();
+            if (widget && widget->isPluginContainer())
+                return static_cast<WebPluginContainerImpl*>(widget);
+        }
+    }
+    return 0;
+}
+
 WebNode::WebNode(const PassRefPtr<Node>& node)
     : m_private(node)
 {
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
index 01cacda2a..53882f9e7 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -44,6 +44,7 @@
 #include "Settings.h"
 #include "WebInputEventConversion.h"
 #include "WebPagePopup.h"
+#include "WebSettingsImpl.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
 #include "WebWidgetClient.h"
@@ -242,7 +243,7 @@ void WebPagePopupImpl::layout()
 
 void WebPagePopupImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions)
 {
-    PageWidgetDelegate::paint(m_page.get(), 0, canvas, rect, PageWidgetDelegate::Opaque);
+    PageWidgetDelegate::paint(m_page.get(), 0, canvas, rect, PageWidgetDelegate::Opaque, m_webView->settingsImpl()->applyDeviceScaleFactorInCompositor());
 }
 
 void WebPagePopupImpl::resize(const WebSize& newSize)
@@ -304,6 +305,7 @@ void WebPagePopupImpl::setFocus(bool enable)
 
 void WebPagePopupImpl::close()
 {
+    m_closing = true;
     if (m_page && m_page->mainFrame())
         m_page->mainFrame()->loader()->frameDetached();
     m_page.clear();
diff --git a/Source/WebKit/chromium/src/WebPasswordFormData.cpp b/Source/WebKit/chromium/src/WebPasswordFormData.cpp
index efd8de32b..fe438200a 100644
--- a/Source/WebKit/chromium/src/WebPasswordFormData.cpp
+++ b/Source/WebKit/chromium/src/WebPasswordFormData.cpp
@@ -138,6 +138,7 @@ void assemblePasswordFormResult(const KURL& fullOrigin,
     if (password) {
         result->passwordElement = password->name();
         result->passwordValue = password->value();
+        result->passwordShouldAutocomplete = password->shouldAutocomplete();
     }
     if (oldPassword) {
         result->oldPasswordElement = oldPassword->name();
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 87a660156..075fc0548 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -67,6 +67,7 @@
 #include "ScrollAnimator.h"
 #include "ScrollView.h"
 #include "ScrollbarTheme.h"
+#include "ScrollingCoordinator.h"
 #include "TouchEvent.h"
 #include "UserGestureIndicator.h"
 #include "WebPrintParams.h"
@@ -133,13 +134,12 @@ void WebPluginContainerImpl::paint(GraphicsContext* gc, const IntRect& damageRec
 
     // The plugin is positioned in window coordinates, so it needs to be painted
     // in window coordinates.
-    IntPoint origin = view->windowToContents(IntPoint(0, 0));
-    gc->translate(static_cast<float>(origin.x()), static_cast<float>(origin.y()));
+    IntPoint origin = view->contentsToWindow(IntPoint(0, 0));
+    gc->translate(static_cast<float>(-origin.x()), static_cast<float>(-origin.y()));
 
     WebCanvas* canvas = gc->platformContext()->canvas();
 
-    IntRect windowRect =
-        IntRect(view->contentsToWindow(enclosingIntRect(scaledDamageRect).location()), enclosingIntRect(scaledDamageRect).size());
+    IntRect windowRect = view->contentsToWindow(enclosingIntRect(scaledDamageRect));
     m_webPlugin->paint(canvas, windowRect);
 
     gc->restore();
@@ -532,6 +532,28 @@ void WebPluginContainerImpl::setIsAcceptingTouchEvents(bool acceptingTouchEvents
         m_element->document()->didRemoveTouchEventHandler();
 }
 
+void WebPluginContainerImpl::setWantsWheelEvents(bool wantsWheelEvents)
+{
+    if (m_wantsWheelEvents == wantsWheelEvents)
+        return;
+    m_wantsWheelEvents = wantsWheelEvents;
+    if (Page* page = m_element->document()->page()) {
+        if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator()) {
+            if (parent() && parent()->isFrameView())
+                scrollingCoordinator->frameViewLayoutUpdated(static_cast<FrameView*>(parent()));
+        }
+    }
+}
+
+WebPoint WebPluginContainerImpl::windowToLocalPoint(const WebPoint& point)
+{
+    ScrollView* view = parent();
+    if (!view)
+        return point;
+    WebPoint windowPoint = view->windowToContents(point);
+    return roundedIntPoint(m_element->renderer()->absoluteToLocal(LayoutPoint(windowPoint), UseTransforms | SnapOffsetForTransforms));
+}
+
 void WebPluginContainerImpl::didReceiveResponse(const ResourceResponse& response)
 {
     // Make sure that the plugin receives window geometry before data, or else
@@ -582,6 +604,11 @@ bool WebPluginContainerImpl::canProcessDrag() const
     return m_webPlugin->canProcessDrag();
 }
 
+bool WebPluginContainerImpl::wantsWheelEvents()
+{
+    return m_wantsWheelEvents;
+}
+
 void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver* observer)
 {
     size_t pos = m_pluginLoadObservers.find(observer);
@@ -641,6 +668,7 @@ WebPluginContainerImpl::WebPluginContainerImpl(WebCore::HTMLPlugInElement* eleme
     , m_ioSurfaceId(0)
 #endif
     , m_isAcceptingTouchEvents(false)
+    , m_wantsWheelEvents(false)
 {
 }
 
@@ -818,8 +846,7 @@ void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
                                                IntRect& clipRect,
                                                Vector<IntRect>& cutOutRects)
 {
-    windowRect = IntRect(
-        parent()->contentsToWindow(frameRect.location()), frameRect.size());
+    windowRect = parent()->contentsToWindow(frameRect);
 
     // Calculate a clip-rect so that we don't overlap the scrollbars, etc.
     clipRect = windowClipRect();
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 89f2971b7..b4958fe19 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -79,6 +79,7 @@ public:
     virtual bool getFormValue(String&);
     virtual bool supportsKeyboardFocus() const;
     virtual bool canProcessDrag() const;
+    virtual bool wantsWheelEvents();
 
     // Widget methods
     virtual void setFrameRect(const WebCore::IntRect&);
@@ -113,6 +114,8 @@ public:
     virtual void setOpaque(bool);
     virtual bool isRectTopmost(const WebRect&);
     virtual void setIsAcceptingTouchEvents(bool);
+    virtual void setWantsWheelEvents(bool);
+    virtual WebPoint windowToLocalPoint(const WebPoint&);
 
     // This cannot be null.
     WebPlugin* plugin() { return m_webPlugin; }
@@ -199,6 +202,7 @@ private:
     OwnPtr<ScrollbarGroup> m_scrollbarGroup;
 
     bool m_isAcceptingTouchEvents;
+    bool m_wantsWheelEvents;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 9009ff9fa..a195de292 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -359,24 +359,6 @@ bool WebRuntimeFeatures::isPeerConnectionEnabled()
 #endif
 }
 
-void WebRuntimeFeatures::enableDeprecatedPeerConnection(bool enable)
-{
-#if ENABLE(MEDIA_STREAM)
-    RuntimeEnabledFeatures::setDeprecatedPeerConnectionEnabled(enable);
-#else
-    UNUSED_PARAM(enable);
-#endif
-}
-
-bool WebRuntimeFeatures::isDeprecatedPeerConnectionEnabled()
-{
-#if ENABLE(MEDIA_STREAM)
-    return RuntimeEnabledFeatures::deprecatedPeerConnectionEnabled();
-#else
-    return false;
-#endif
-}
-
 void WebRuntimeFeatures::enableFullScreenAPI(bool enable)
 {
 #if ENABLE(FULLSCREEN_API)
@@ -395,24 +377,6 @@ bool WebRuntimeFeatures::isFullScreenAPIEnabled()
 #endif
 }
 
-void WebRuntimeFeatures::enablePointerLock(bool enable)
-{
-#if ENABLE(POINTER_LOCK)
-    RuntimeEnabledFeatures::setPointerLockEnabled(enable);
-#else
-    UNUSED_PARAM(enable);
-#endif
-}
-
-bool WebRuntimeFeatures::isPointerLockEnabled()
-{
-#if ENABLE(POINTER_LOCK)
-    return RuntimeEnabledFeatures::pointerLockEnabled();
-#else
-    return false;
-#endif
-}
-
 void WebRuntimeFeatures::enableMediaSource(bool enable)
 {
 #if ENABLE(MEDIA_SOURCE)
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index b14cde32f..20fcc1b96 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -53,7 +53,7 @@ WebSettingsImpl::WebSettingsImpl(Settings* settings)
     , m_showPaintRects(false)
     , m_renderVSyncEnabled(true)
     , m_viewportEnabled(false)
-    , m_applyDefaultDeviceScaleFactorInCompositor(false)
+    , m_applyDeviceScaleFactorInCompositor(false)
     , m_gestureTapHighlightEnabled(true)
     , m_autoZoomFocusedNodeToLegibleScale(false)
     , m_deferredImageDecodingEnabled(false)
@@ -139,9 +139,9 @@ bool WebSettingsImpl::deviceSupportsTouch()
     return m_settings->deviceSupportsTouch();
 }
 
-void WebSettingsImpl::setApplyDefaultDeviceScaleFactorInCompositor(bool applyDefaultDeviceScaleFactorInCompositor)
+void WebSettingsImpl::setApplyDeviceScaleFactorInCompositor(bool applyDeviceScaleFactorInCompositor)
 {
-    m_applyDefaultDeviceScaleFactorInCompositor = applyDefaultDeviceScaleFactorInCompositor;
+    m_applyDeviceScaleFactorInCompositor = applyDeviceScaleFactorInCompositor;
 }
 
 void WebSettingsImpl::setApplyPageScaleFactorInCompositor(bool applyPageScaleFactorInCompositor)
@@ -431,6 +431,11 @@ void WebSettingsImpl::setEditingBehavior(EditingBehavior behavior)
     m_settings->setEditingBehaviorType(static_cast<WebCore::EditingBehaviorType>(behavior));
 }
 
+void WebSettingsImpl::setAcceleratedAnimationEnabled(bool enabled)
+{
+    m_acceleratedAnimationEnabled = enabled;
+}
+
 void WebSettingsImpl::setAcceleratedCompositingEnabled(bool enabled)
 {
     m_settings->setAcceleratedCompositingEnabled(enabled);
@@ -586,6 +591,11 @@ void WebSettingsImpl::setPasswordEchoDurationInSeconds(double durationInSeconds)
     m_settings->setPasswordEchoDurationInSeconds(durationInSeconds);
 }
 
+void WebSettingsImpl::setPerTilePaintingEnabled(bool enabled)
+{
+    m_perTilePaintingEnabled = enabled;
+}
+
 void WebSettingsImpl::setShouldPrintBackgrounds(bool enabled)
 {
     m_settings->setShouldPrintBackgrounds(enabled);
@@ -600,6 +610,11 @@ void WebSettingsImpl::setEnableScrollAnimator(bool enabled)
 #endif
 }
 
+void WebSettingsImpl::setEnableTouchAdjustment(bool enabled)
+{
+    m_settings->setTouchAdjustmentEnabled(enabled);
+}
+
 bool WebSettingsImpl::scrollAnimatorEnabled() const
 {
 #if ENABLE(SMOOTH_SCROLLING)
@@ -696,4 +711,9 @@ bool WebSettingsImpl::applyPageScaleFactorInCompositor() const
     return m_settings->applyPageScaleFactorInCompositor();
 }
 
+void WebSettingsImpl::setAllowCustomScrollbarInMainFrame(bool enabled)
+{
+    m_settings->setAllowCustomScrollbarInMainFrame(enabled);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index ff88bac61..98520eadf 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -48,6 +48,7 @@ public:
     virtual bool scrollAnimatorEnabled() const;
     virtual bool viewportEnabled() const { return m_viewportEnabled; }
     virtual void setAccelerated2dCanvasEnabled(bool);
+    virtual void setAcceleratedAnimationEnabled(bool);
     virtual void setAcceleratedCompositingEnabled(bool);
     virtual void setAcceleratedCompositingFor3DTransformsEnabled(bool);
     virtual void setAcceleratedCompositingForAnimationEnabled(bool);
@@ -60,10 +61,11 @@ public:
     virtual void setAcceleratedPaintingEnabled(bool);
     virtual void setAllowDisplayOfInsecureContent(bool);
     virtual void setAllowFileAccessFromFileURLs(bool);
+    virtual void setAllowCustomScrollbarInMainFrame(bool);
     virtual void setAllowRunningOfInsecureContent(bool);
     virtual void setAllowScriptsToCloseWindows(bool);
     virtual void setAllowUniversalAccessFromFileURLs(bool);
-    virtual void setApplyDefaultDeviceScaleFactorInCompositor(bool);
+    virtual void setApplyDeviceScaleFactorInCompositor(bool);
     virtual void setApplyPageScaleFactorInCompositor(bool);
     virtual void setAsynchronousSpellCheckingEnabled(bool);
     virtual void setAuthorAndUserStylesEnabled(bool);
@@ -87,6 +89,7 @@ public:
     virtual void setEditableLinkBehaviorNeverLive();
     virtual void setEditingBehavior(EditingBehavior);
     virtual void setEnableScrollAnimator(bool);
+    virtual void setEnableTouchAdjustment(bool);
     virtual void setExperimentalCSSCustomFilterEnabled(bool);
     virtual void setExperimentalCSSGridLayoutEnabled(bool);
     virtual void setCSSStickyPositionEnabled(bool);
@@ -126,6 +129,7 @@ public:
     virtual void setPageCacheSupportsPlugins(bool);
     virtual void setPasswordEchoDurationInSeconds(double);
     virtual void setPasswordEchoEnabled(bool);
+    virtual void setPerTilePaintingEnabled(bool);
     virtual void setPictographFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setPluginsEnabled(bool);
     virtual void setPrivilegedWebGLExtensionsEnabled(bool);
@@ -165,11 +169,13 @@ public:
     bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
     bool showPaintRects() const { return m_showPaintRects; }
     bool renderVSyncEnabled() const { return m_renderVSyncEnabled; }
-    bool applyDefaultDeviceScaleFactorInCompositor() const { return m_applyDefaultDeviceScaleFactorInCompositor; }
+    bool applyDeviceScaleFactorInCompositor() const { return m_applyDeviceScaleFactorInCompositor; }
     bool applyPageScaleFactorInCompositor() const;
     bool autoZoomFocusedNodeToLegibleScale() const { return m_autoZoomFocusedNodeToLegibleScale; }
-    bool gestureTapHighlightEnabled() { return m_gestureTapHighlightEnabled; }
-    bool doubleTapToZoomEnabled() { return m_doubleTapToZoomEnabled; }
+    bool gestureTapHighlightEnabled() const { return m_gestureTapHighlightEnabled; }
+    bool doubleTapToZoomEnabled() const { return m_doubleTapToZoomEnabled; }
+    bool perTilePaintingEnabled() const { return m_perTilePaintingEnabled; }
+    bool acceleratedAnimationEnabled() const { return m_acceleratedAnimationEnabled; }
     WebSize defaultTileSize() const { return m_defaultTileSize; }
     WebSize maxUntiledLayerSize() const { return m_maxUntiledLayerSize; }
 
@@ -180,11 +186,13 @@ private:
     bool m_showPaintRects;
     bool m_renderVSyncEnabled;
     bool m_viewportEnabled;
-    bool m_applyDefaultDeviceScaleFactorInCompositor;
+    bool m_applyDeviceScaleFactorInCompositor;
     bool m_gestureTapHighlightEnabled;
     bool m_autoZoomFocusedNodeToLegibleScale;
     bool m_deferredImageDecodingEnabled;
     bool m_doubleTapToZoomEnabled;
+    bool m_perTilePaintingEnabled;
+    bool m_acceleratedAnimationEnabled;
     WebSize m_defaultTileSize;
     WebSize m_maxUntiledLayerSize;
 };
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index f6f9fc6fa..7aa12048f 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -32,7 +32,6 @@
 #include "WebViewImpl.h"
 
 #include "AXObjectCache.h"
-#include "ActivePlatformGestureAnimation.h"
 #include "AutofillPopupMenuClient.h"
 #include "BackForwardListChromium.h"
 #include "BatteryClientImpl.h"
@@ -95,7 +94,6 @@
 #include "PlatformContextSkia.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
-#include "PlatformThemeChromiumLinux.h"
 #include "PlatformWheelEvent.h"
 #include "PointerLockController.h"
 #include "PopupContainer.h"
@@ -146,6 +144,7 @@
 #include "WebViewClient.h"
 #include "WheelEvent.h"
 #include "painting/GraphicsContextBuilder.h"
+#include "src/WebActiveGestureAnimation.h"
 #include <public/Platform.h>
 #include <public/WebCompositorOutputSurface.h>
 #include <public/WebCompositorSupport.h>
@@ -165,16 +164,23 @@
 #include <wtf/TemporaryChange.h>
 #include <wtf/Uint8ClampedArray.h>
 
+#if ENABLE(DEFAULT_RENDER_THEME)
+#include "PlatformThemeChromiumDefault.h"
+#include "RenderThemeChromiumDefault.h"
+#endif
+
 #if ENABLE(GESTURE_EVENTS)
-#include "PlatformGestureCurveFactory.h"
 #include "PlatformGestureEvent.h"
 #include "TouchDisambiguation.h"
 #endif
 
 #if OS(WINDOWS)
+#if !ENABLE(DEFAULT_RENDER_THEME)
 #include "RenderThemeChromiumWin.h"
+#endif
 #else
-#if OS(UNIX) && !OS(DARWIN)
+#if OS(UNIX) && !OS(DARWIN) && !ENABLE(DEFAULT_RENDER_THEME)
+#include "PlatformThemeChromiumLinux.h"
 #include "RenderThemeChromiumLinux.h"
 #endif
 #include "RenderTheme.h"
@@ -425,6 +431,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client)
     , m_compositorSurfaceReady(false)
     , m_deviceScaleInCompositor(1)
     , m_inputHandlerIdentifier(-1)
+    , m_isFontAtlasLoaded(false)
 #endif
 #if ENABLE(INPUT_SPEECH)
     , m_speechInputClient(SpeechInputClientImpl::create(client))
@@ -641,15 +648,15 @@ void WebViewImpl::handleMouseUp(Frame& mainFrame, const WebMouseEvent& event)
 #endif
 }
 
-void WebViewImpl::scrollBy(const WebCore::IntPoint& delta)
+void WebViewImpl::scrollBy(const WebPoint& delta)
 {
     WebMouseWheelEvent syntheticWheel;
     const float tickDivisor = WebCore::WheelEvent::tickMultiplier;
 
-    syntheticWheel.deltaX = delta.x();
-    syntheticWheel.deltaY = delta.y();
-    syntheticWheel.wheelTicksX = delta.x() / tickDivisor;
-    syntheticWheel.wheelTicksY = delta.y() / tickDivisor;
+    syntheticWheel.deltaX = delta.x;
+    syntheticWheel.deltaY = delta.y;
+    syntheticWheel.wheelTicksX = delta.x / tickDivisor;
+    syntheticWheel.wheelTicksY = delta.y / tickDivisor;
     syntheticWheel.hasPreciseScrollingDeltas = true;
     syntheticWheel.x = m_lastWheelPosition.x;
     syntheticWheel.y = m_lastWheelPosition.y;
@@ -677,13 +684,10 @@ bool WebViewImpl::handleGestureEvent(const WebGestureEvent& event)
 #endif
         break;
     case WebInputEvent::GestureTapCancel:
-        if (m_linkHighlight)
-            m_linkHighlight->startHighlightAnimationIfNeeded();
-        break;
     case WebInputEvent::GestureTap:
     case WebInputEvent::GestureLongPress:
-        // If a link highlight is active, kill it.
-        m_linkHighlight.clear();
+        if (m_linkHighlight)
+            m_linkHighlight->startHighlightAnimationIfNeeded();
         break;
     default:
         break;
@@ -691,13 +695,14 @@ bool WebViewImpl::handleGestureEvent(const WebGestureEvent& event)
 
     switch (event.type) {
     case WebInputEvent::GestureFlingStart: {
+        if (mainFrameImpl()->frame()->eventHandler()->isScrollbarHandlingGestures())
+            break;
         m_client->cancelScheduledContentIntents();
         m_lastWheelPosition = WebPoint(event.x, event.y);
         m_lastWheelGlobalPosition = WebPoint(event.globalX, event.globalY);
         m_flingModifier = event.modifiers;
-        // FIXME: Make the curve parametrizable from the browser.
-        OwnPtr<PlatformGestureCurve> flingCurve = PlatformGestureCurveFactory::get()->createCurve(event.data.flingStart.sourceDevice, FloatPoint(event.data.flingStart.velocityX, event.data.flingStart.velocityY));
-        m_gestureAnimation = ActivePlatformGestureAnimation::create(flingCurve.release(), this);
+        OwnPtr<WebGestureCurve> flingCurve = adoptPtr(Platform::current()->createFlingAnimationCurve(event.data.flingStart.sourceDevice, WebFloatPoint(event.data.flingStart.velocityX, event.data.flingStart.velocityY), WebSize()));
+        m_gestureAnimation = WebActiveGestureAnimation::createAtAnimationStart(flingCurve.release(), this);
         scheduleAnimation();
         eventSwallowed = true;
         break;
@@ -799,8 +804,8 @@ void WebViewImpl::transferActiveWheelFlingAnimation(const WebActiveWheelFlingPar
     m_lastWheelPosition = parameters.point;
     m_lastWheelGlobalPosition = parameters.globalPoint;
     m_flingModifier = parameters.modifiers;
-    OwnPtr<PlatformGestureCurve> curve = PlatformGestureCurveFactory::get()->createCurve(parameters.sourceDevice, parameters.delta, IntPoint(parameters.cumulativeScroll));
-    m_gestureAnimation = ActivePlatformGestureAnimation::create(curve.release(), this, parameters.startTime);
+    OwnPtr<WebGestureCurve> curve = adoptPtr(Platform::current()->createFlingAnimationCurve(parameters.sourceDevice, WebFloatPoint(parameters.delta), parameters.cumulativeScroll));
+    m_gestureAnimation = WebActiveGestureAnimation::createWithTimeOffset(curve.release(), this, parameters.startTime);
     scheduleAnimation();
 }
 
@@ -831,6 +836,18 @@ WebViewBenchmarkSupport* WebViewImpl::benchmarkSupport()
     return &m_benchmarkSupport;
 }
 
+void WebViewImpl::setShowFPSCounter(bool show)
+{
+    if (isAcceleratedCompositingActive()) {
+        TRACE_EVENT0("webkit", "WebViewImpl::setShowFPSCounter");
+#if USE(ACCELERATED_COMPOSITING)
+        loadFontAtlasIfNecessary();
+#endif
+        m_layerTreeView->setShowFPSCounter(show);
+    }
+    settingsImpl()->setShowFPSCounter(show);
+}
+
 bool WebViewImpl::handleKeyEvent(const WebKeyboardEvent& event)
 {
     ASSERT((event.type == WebInputEvent::RawKeyDown)
@@ -1817,7 +1834,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions opt
         }
 
         double paintStart = currentTime();
-        PageWidgetDelegate::paint(m_page.get(), pageOverlays(), canvas, rect, isTransparent() ? PageWidgetDelegate::Translucent : PageWidgetDelegate::Opaque);
+        PageWidgetDelegate::paint(m_page.get(), pageOverlays(), canvas, rect, isTransparent() ? PageWidgetDelegate::Translucent : PageWidgetDelegate::Opaque, m_webSettings->applyDeviceScaleFactorInCompositor());
         double paintEnd = currentTime();
         double pixelsPerSec = (rect.width * rect.height) / (paintEnd - paintStart);
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.SoftwarePaintDurationMS", (paintEnd - paintStart) * 1000, 0, 120, 30);
@@ -2913,7 +2930,7 @@ void WebViewImpl::setDeviceScaleFactor(float scaleFactor)
 
     page()->setDeviceScaleFactor(scaleFactor);
 
-    if (m_layerTreeView && m_webSettings->applyDefaultDeviceScaleFactorInCompositor()) {
+    if (m_layerTreeView && m_webSettings->applyDeviceScaleFactorInCompositor()) {
         m_deviceScaleInCompositor = page()->deviceScaleFactor();
         m_layerTreeView->setDeviceScaleFactor(m_deviceScaleInCompositor);
     }
@@ -2987,6 +3004,14 @@ void WebViewImpl::setIgnoreViewportTagMaximumScale(bool flag)
     m_page->chrome()->client()->dispatchViewportPropertiesDidChange(page()->mainFrame()->document()->viewportArguments());
 }
 
+static IntSize unscaledContentsSize(Frame* frame)
+{
+    RenderView* root = frame->contentRenderer();
+    if (!root)
+        return IntSize();
+    return root->unscaledDocumentRect().size();
+}
+
 bool WebViewImpl::computePageScaleFactorLimits()
 {
     if (m_pageDefinedMinimumPageScaleFactor == -1 || m_pageDefinedMaximumPageScaleFactor == -1)
@@ -2999,11 +3024,10 @@ bool WebViewImpl::computePageScaleFactorLimits()
     m_maximumPageScaleFactor = max(min(m_pageDefinedMaximumPageScaleFactor, maxPageScaleFactor), minPageScaleFactor) * (deviceScaleFactor() / m_deviceScaleInCompositor);
 
     int viewWidthNotIncludingScrollbars = page()->mainFrame()->view()->visibleContentRect(false).width();
-    int contentsWidth = mainFrame()->contentsSize().width;
-    if (viewWidthNotIncludingScrollbars && contentsWidth) {
+    int unscaledContentsWidth = unscaledContentsSize(page()->mainFrame()).width();
+    if (viewWidthNotIncludingScrollbars && unscaledContentsWidth) {
         // Limit page scaling down to the document width.
-        int unscaledContentWidth = contentsWidth / pageScaleFactor();
-        m_minimumPageScaleFactor = max(m_minimumPageScaleFactor, static_cast<float>(viewWidthNotIncludingScrollbars) / unscaledContentWidth);
+        m_minimumPageScaleFactor = max(m_minimumPageScaleFactor, static_cast<float>(viewWidthNotIncludingScrollbars) / unscaledContentsWidth);
         m_maximumPageScaleFactor = max(m_minimumPageScaleFactor, m_maximumPageScaleFactor);
     }
     ASSERT(m_minimumPageScaleFactor <= m_maximumPageScaleFactor);
@@ -3533,7 +3557,9 @@ void WebViewImpl::setDomainRelaxationForbidden(bool forbidden, const WebString&
 void WebViewImpl::setScrollbarColors(unsigned inactiveColor,
                                      unsigned activeColor,
                                      unsigned trackColor) {
-#if OS(UNIX) && !OS(DARWIN) && !OS(ANDROID)
+#if ENABLE(DEFAULT_RENDER_THEME)
+    PlatformThemeChromiumDefault::setScrollbarColors(inactiveColor, activeColor, trackColor);
+#elif OS(UNIX) && !OS(DARWIN) && !OS(ANDROID)
     PlatformThemeChromiumLinux::setScrollbarColors(inactiveColor, activeColor, trackColor);
 #endif
 }
@@ -3542,11 +3568,11 @@ void WebViewImpl::setSelectionColors(unsigned activeBackgroundColor,
                                      unsigned activeForegroundColor,
                                      unsigned inactiveBackgroundColor,
                                      unsigned inactiveForegroundColor) {
-#if OS(UNIX) && !OS(DARWIN) && !OS(ANDROID)
-    RenderThemeChromiumLinux::setSelectionColors(activeBackgroundColor,
-                                                 activeForegroundColor,
-                                                 inactiveBackgroundColor,
-                                                 inactiveForegroundColor);
+#if ENABLE(DEFAULT_RENDER_THEME)
+    RenderThemeChromiumDefault::setSelectionColors(activeBackgroundColor, activeForegroundColor, inactiveBackgroundColor, inactiveForegroundColor);
+    theme()->platformColorsDidChange();
+#elif OS(UNIX) && !OS(DARWIN) && !OS(ANDROID)
+    RenderThemeChromiumLinux::setSelectionColors(activeBackgroundColor, activeForegroundColor, inactiveBackgroundColor, inactiveForegroundColor);
     theme()->platformColorsDidChange();
 #endif
 }
@@ -3964,10 +3990,14 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
         WebLayerTreeView::Settings layerTreeViewSettings;
         layerTreeViewSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
+        layerTreeViewSettings.showDebugBorders = page()->settings()->showDebugBorders();
         layerTreeViewSettings.showFPSCounter = settingsImpl()->showFPSCounter();
         layerTreeViewSettings.showPlatformLayerTree = settingsImpl()->showPlatformLayerTree();
         layerTreeViewSettings.showPaintRects = settingsImpl()->showPaintRects();
         layerTreeViewSettings.renderVSyncEnabled = settingsImpl()->renderVSyncEnabled();
+        layerTreeViewSettings.perTilePaintingEnabled = settingsImpl()->perTilePaintingEnabled();
+        layerTreeViewSettings.acceleratedAnimationEnabled = settingsImpl()->acceleratedAnimationEnabled();
+        layerTreeViewSettings.pageScalePinchZoomEnabled = settingsImpl()->applyPageScaleFactorInCompositor();
 
         layerTreeViewSettings.defaultTileSize = settingsImpl()->defaultTileSize();
         layerTreeViewSettings.maxUntiledLayerSize = settingsImpl()->maxUntiledLayerSize();
@@ -3978,7 +4008,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
         m_layerTreeView = adoptPtr(Platform::current()->compositorSupport()->createLayerTreeView(this, *m_rootLayer, layerTreeViewSettings));
         if (m_layerTreeView) {
-            if (m_webSettings->applyDefaultDeviceScaleFactorInCompositor() && page()->deviceScaleFactor() != 1) {
+            if (m_webSettings->applyDeviceScaleFactorInCompositor() && page()->deviceScaleFactor() != 1) {
                 ASSERT(page()->deviceScaleFactor());
 
                 m_deviceScaleInCompositor = page()->deviceScaleFactor();
@@ -3995,17 +4025,15 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
             m_client->didActivateCompositor(m_inputHandlerIdentifier);
             m_isAcceleratedCompositingActive = true;
             m_compositorCreationFailed = false;
+            m_isFontAtlasLoaded = false;
             if (m_pageOverlays)
                 m_pageOverlays->update();
 
-            // Only allocate the font atlas if we have reason to use the heads-up display.
-            if (layerTreeViewSettings.showFPSCounter || layerTreeViewSettings.showPlatformLayerTree) {
-                TRACE_EVENT0("cc", "WebViewImpl::setIsAcceleratedCompositingActive(true) initialize font atlas");
-                WebRect asciiToRectTable[128];
-                int fontHeight;
-                SkBitmap bitmap = WebCore::CompositorHUDFontAtlas::generateFontAtlas(asciiToRectTable, fontHeight);
-                m_layerTreeView->setFontAtlas(asciiToRectTable, bitmap, fontHeight);
-            }
+            if (layerTreeViewSettings.showPlatformLayerTree)
+                loadFontAtlasIfNecessary();
+
+            if (settingsImpl()->showFPSCounter())
+                setShowFPSCounter(true);
         } else {
             m_nonCompositedContentHost.clear();
             m_isAcceleratedCompositingActive = false;
@@ -4017,6 +4045,21 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         page()->mainFrame()->view()->setClipsRepaints(!m_isAcceleratedCompositingActive);
 }
 
+void WebViewImpl::loadFontAtlasIfNecessary()
+{
+    ASSERT(m_layerTreeView);
+
+    if (m_isFontAtlasLoaded)
+        return;
+
+    TRACE_EVENT0("webkit", "WebViewImpl::loadFontAtlas");
+    WebRect asciiToRectTable[128];
+    int fontHeight;
+    SkBitmap bitmap = WebCore::CompositorHUDFontAtlas::generateFontAtlas(asciiToRectTable, fontHeight);
+    m_layerTreeView->setFontAtlas(asciiToRectTable, bitmap, fontHeight);
+    m_isFontAtlasLoaded = true;
+}
+
 #endif
 
 namespace {
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 02a1e5370..da5f69b9e 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -44,13 +44,13 @@
 #include "PageOverlayList.h"
 #include "PagePopupDriver.h"
 #include "PageWidgetDelegate.h"
-#include "PlatformGestureCurveTarget.h"
 #include "UserMediaClientImpl.h"
 #include "WebInputEvent.h"
 #include "WebNavigationPolicy.h"
 #include "WebView.h"
 #include "WebViewBenchmarkSupportImpl.h"
 #include <public/WebFloatQuad.h>
+#include <public/WebGestureCurveTarget.h>
 #include <public/WebLayer.h>
 #include <public/WebLayerTreeViewClient.h>
 #include <public/WebPoint.h>
@@ -61,7 +61,6 @@
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-class ActivePlatformGestureAnimation;
 class ChromiumDataObject;
 class Color;
 class DocumentLoader;
@@ -74,7 +73,6 @@ class Page;
 class PageGroup;
 class PagePopup;
 class PagePopupClient;
-class PlatformGestureCurveTarget;
 class PlatformKeyboardEvent;
 class PopupContainer;
 class PopupMenuClient;
@@ -101,6 +99,7 @@ class SpeechRecognitionClientProxy;
 class UserMediaClientImpl;
 class ValidationMessageClientImpl;
 class WebAccessibilityObject;
+class WebActiveGestureAnimation;
 class WebCompositorImpl;
 class WebDevToolsAgentClient;
 class WebDevToolsAgentPrivate;
@@ -119,13 +118,13 @@ class WebTouchEvent;
 class WebViewBenchmarkSupport;
 
 class WebViewImpl : public WebView
-                  , public WebLayerTreeViewClient
-                  , public RefCounted<WebViewImpl>
-                  , public WebCore::PlatformGestureCurveTarget
+    , public WebLayerTreeViewClient
+    , public RefCounted<WebViewImpl>
+    , public WebGestureCurveTarget
 #if ENABLE(PAGE_POPUP)
-                  , public WebCore::PagePopupDriver
+    , public WebCore::PagePopupDriver
 #endif
-                  , public PageWidgetEventHandler {
+    , public PageWidgetEventHandler {
 public:
     enum AutoZoomType {
         DoubleTap,
@@ -309,6 +308,7 @@ public:
 #endif
     virtual void transferActiveWheelFlingAnimation(const WebActiveWheelFlingParameters&);
     virtual WebViewBenchmarkSupport* benchmarkSupport();
+    virtual void setShowFPSCounter(bool);
 
     // WebLayerTreeViewClient
     virtual void willBeginFrame();
@@ -404,8 +404,8 @@ public:
     void numberOfWheelEventHandlersChanged(unsigned);
     void hasTouchEventHandlers(bool);
 
-    // PlatformGestureCurveTarget implementation for wheel fling.
-    virtual void scrollBy(const WebCore::IntPoint&);
+    // WebGestureCurveTarget implementation for fling.
+    virtual void scrollBy(const WebPoint&);
 
     // Handles context menu events orignated via the the keyboard. These
     // include the VK_APPS virtual key and the Shift+F10 combine. Code is
@@ -599,6 +599,7 @@ public:
     LinkHighlight* linkHighlight() { return m_linkHighlight.get(); }
 #endif
 
+    WebSettingsImpl* settingsImpl();
 
 private:
     bool computePageScaleFactorLimits();
@@ -650,6 +651,7 @@ private:
 
 #if USE(ACCELERATED_COMPOSITING)
     void setIsAcceleratedCompositingActive(bool);
+    void loadFontAtlasIfNecessary();
     void doComposite();
     void doPixelReadbackToCanvas(WebCanvas*, const WebCore::IntRect&);
     void reallocateRenderer();
@@ -677,8 +679,6 @@ private:
     virtual bool handleKeyEvent(const WebKeyboardEvent&) OVERRIDE;
     virtual bool handleCharEvent(const WebKeyboardEvent&) OVERRIDE;
 
-    WebSettingsImpl* settingsImpl();
-
     WebViewClient* m_client;
     WebAutofillClient* m_autofillClient;
     WebPermissionClient* m_permissionClient;
@@ -846,6 +846,7 @@ private:
     bool m_compositorSurfaceReady;
     float m_deviceScaleInCompositor;
     int m_inputHandlerIdentifier;
+    bool m_isFontAtlasLoaded;
 #endif
     static const WebInputEvent* m_currentInputEvent;
 
@@ -870,7 +871,7 @@ private:
 #if ENABLE(NAVIGATOR_CONTENT_UTILS)
     OwnPtr<NavigatorContentUtilsClientImpl> m_navigatorContentUtilsClient;
 #endif
-    OwnPtr<WebCore::ActivePlatformGestureAnimation> m_gestureAnimation;
+    OwnPtr<WebActiveGestureAnimation> m_gestureAnimation;
     WebPoint m_lastWheelPosition;
     WebPoint m_lastWheelGlobalPosition;
     int m_flingModifier;
diff --git a/Source/WebKit/chromium/tests/DecimalTest.cpp b/Source/WebKit/chromium/tests/DecimalTest.cpp
index 8d4106260..c10de56c3 100644
--- a/Source/WebKit/chromium/tests/DecimalTest.cpp
+++ b/Source/WebKit/chromium/tests/DecimalTest.cpp
@@ -897,13 +897,17 @@ TEST_F(DecimalTest, RealWorldExampleRangeStepUpStepDown)
 
 TEST_F(DecimalTest, Remainder)
 {
-    EXPECT_EQ(encode(9, -1, Negative), encode(21, -1, Positive).remainder(3));
+    EXPECT_EQ(encode(21, -1, Positive), encode(21, -1, Positive).remainder(3));
     EXPECT_EQ(Decimal(1), Decimal(10).remainder(3));
+    EXPECT_EQ(Decimal(1), Decimal(10).remainder(-3));
     EXPECT_EQ(encode(1, 0, Negative), Decimal(-10).remainder(3));
+    EXPECT_EQ(Decimal(-1), Decimal(-10).remainder(-3));
     EXPECT_EQ(encode(2, -1, Positive), encode(102, -1, Positive).remainder(1));
     EXPECT_EQ(encode(1, -1, Positive), Decimal(10).remainder(encode(3, -1, Positive)));
-    EXPECT_EQ(encode(3, -1, Negative), encode(36, -1, Positive).remainder(encode(13, -1, Positive)));
+    EXPECT_EQ(Decimal(1), encode(36, -1, Positive).remainder(encode(13, -1, Positive)));
     EXPECT_EQ(encode(1, 87, Positive), (encode(1234, 100, Positive).remainder(Decimal(3))));
+    EXPECT_EQ(Decimal(500), (Decimal(500).remainder(1000)));
+    EXPECT_EQ(Decimal(-500), (Decimal(-500).remainder(1000)));
 }
 
 TEST_F(DecimalTest, RemainderBigExponent)
diff --git a/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp b/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp
index 482549805..4bcc29882 100644
--- a/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp
+++ b/Source/WebKit/chromium/tests/DeferredImageDecoderTest.cpp
@@ -30,24 +30,57 @@
 #include "ImageDecodingStore.h"
 #include "MockImageDecoder.h"
 #include "NativeImageSkia.h"
+#include "SharedBuffer.h"
 #include "SkCanvas.h"
 #include "SkDevice.h"
 #include "SkPicture.h"
 #include <gtest/gtest.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
 
 using namespace WebCore;
 
 namespace {
 
-class DeferredImageDecoderTest : public ::testing::Test {
+// Raw data for a PNG file with 1x1 white pixels.
+const unsigned char whitePNG[] = {
+    0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00,
+    0x00, 0x0d, 0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x01, 0x08, 0x02, 0x00, 0x00, 0x00, 0x90,
+    0x77, 0x53, 0xde, 0x00, 0x00, 0x00, 0x01, 0x73, 0x52, 0x47,
+    0x42, 0x00, 0xae, 0xce, 0x1c, 0xe9, 0x00, 0x00, 0x00, 0x09,
+    0x70, 0x48, 0x59, 0x73, 0x00, 0x00, 0x0b, 0x13, 0x00, 0x00,
+    0x0b, 0x13, 0x01, 0x00, 0x9a, 0x9c, 0x18, 0x00, 0x00, 0x00,
+    0x0c, 0x49, 0x44, 0x41, 0x54, 0x08, 0xd7, 0x63, 0xf8, 0xff,
+    0xff, 0x3f, 0x00, 0x05, 0xfe, 0x02, 0xfe, 0xdc, 0xcc, 0x59,
+    0xe7, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4e, 0x44, 0xae,
+    0x42, 0x60, 0x82,
+};
+
+static SkCanvas* createRasterCanvas(int width, int height)
+{
+    SkAutoTUnref<SkDevice> device(new SkDevice(SkBitmap::kARGB_8888_Config, width, height));
+    return new SkCanvas(device);
+}
+
+struct Rasterizer {
+    SkCanvas* canvas;
+    SkPicture* picture;
+};
+
+class DeferredImageDecoderTest : public ::testing::Test, public MockImageDecoderClient {
 public:
     virtual void SetUp()
     {
         ImageDecodingStore::initializeOnMainThread();
-        m_actualDecoder = new MockImageDecoder();
-        m_actualDecoder->setSize(600, 613);
+        m_data = SharedBuffer::create(whitePNG, sizeof(whitePNG));
+        m_actualDecoder = new MockImageDecoder(this);
+        m_actualDecoder->setSize(1, 1);
         m_lazyDecoder = DeferredImageDecoder::createForTesting(adoptPtr(m_actualDecoder));
-        m_canvas.setDevice(new SkDevice(SkBitmap::kARGB_8888_Config, 100, 100))->unref();
+        m_lazyDecoder->setData(m_data.get(), true);
+        m_canvas.reset(createRasterCanvas(100, 100));
+        m_frameBufferRequestCount = 0;
     }
 
     virtual void TearDown()
@@ -55,29 +88,43 @@ public:
         ImageDecodingStore::shutdown();
     }
 
+    virtual void decoderBeingDestroyed()
+    {
+        m_frameBufferRequestCount = m_actualDecoder->frameBufferRequestCount();
+        m_actualDecoder = 0;
+    }
+
 protected:
     // Don't own this but saves the pointer to query states.
     MockImageDecoder* m_actualDecoder;
     OwnPtr<DeferredImageDecoder> m_lazyDecoder;
     SkPicture m_picture;
-    SkCanvas m_canvas;
+    SkAutoTUnref<SkCanvas> m_canvas;
+    int m_frameBufferRequestCount;
+    RefPtr<SharedBuffer> m_data;
 };
 
 TEST_F(DeferredImageDecoderTest, drawIntoSkPicture)
 {
     OwnPtr<NativeImageSkia> image(adoptPtr(m_lazyDecoder->frameBufferAtIndex(0)->asNewNativeImage()));
-    EXPECT_EQ(m_actualDecoder->size().width(), image->bitmap().width());
-    EXPECT_EQ(m_actualDecoder->size().height(), image->bitmap().height());
+    EXPECT_EQ(1, image->bitmap().width());
+    EXPECT_EQ(1, image->bitmap().height());
     EXPECT_FALSE(image->bitmap().isNull());
     EXPECT_TRUE(image->bitmap().isImmutable());
 
     SkCanvas* tempCanvas = m_picture.beginRecording(100, 100);
     tempCanvas->drawBitmap(image->bitmap(), 0, 0);
     m_picture.endRecording();
-    EXPECT_EQ(0, m_actualDecoder->frameBufferRequestCount());
+    EXPECT_EQ(0, m_frameBufferRequestCount);
+
+    m_canvas->drawPicture(m_picture);
+    EXPECT_EQ(0, m_frameBufferRequestCount);
 
-    m_canvas.drawPicture(m_picture);
-    EXPECT_EQ(1, m_actualDecoder->frameBufferRequestCount());
+    SkBitmap canvasBitmap;
+    canvasBitmap.setConfig(SkBitmap::kARGB_8888_Config, 100, 100);
+    ASSERT_TRUE(m_canvas->readPixels(&canvasBitmap, 0, 0));
+    SkAutoLockPixels autoLock(canvasBitmap);
+    EXPECT_EQ(SkColorSetARGB(255, 255, 255, 255), canvasBitmap.getColor(0, 0));
 }
 
 TEST_F(DeferredImageDecoderTest, drawScaledIntoSkPicture)
@@ -88,15 +135,58 @@ TEST_F(DeferredImageDecoderTest, drawScaledIntoSkPicture)
     EXPECT_TRUE(scaledBitmap.isImmutable());
     EXPECT_EQ(50, scaledBitmap.width());
     EXPECT_EQ(51, scaledBitmap.height());
-    EXPECT_EQ(0, m_actualDecoder->frameBufferRequestCount());
+    EXPECT_EQ(0, m_frameBufferRequestCount);
 
     SkCanvas* tempCanvas = m_picture.beginRecording(100, 100);
     tempCanvas->drawBitmap(scaledBitmap, 0, 0);
     m_picture.endRecording();
-    EXPECT_EQ(0, m_actualDecoder->frameBufferRequestCount());
+    EXPECT_EQ(0, m_frameBufferRequestCount);
+
+    m_canvas->drawPicture(m_picture);
+    EXPECT_EQ(0, m_frameBufferRequestCount);
+
+    SkBitmap canvasBitmap;
+    canvasBitmap.setConfig(SkBitmap::kARGB_8888_Config, 100, 100);
+    ASSERT_TRUE(m_canvas->readPixels(&canvasBitmap, 0, 0));
+    SkAutoLockPixels autoLock(canvasBitmap);
+    EXPECT_EQ(SkColorSetARGB(255, 255, 255, 255), canvasBitmap.getColor(0, 0));
+    EXPECT_EQ(SkColorSetARGB(255, 255, 255, 255), canvasBitmap.getColor(49, 50));
+}
+
+static void rasterizeMain(void* arg)
+{
+    Rasterizer* rasterizer = static_cast<Rasterizer*>(arg);
+    rasterizer->canvas->drawPicture(*rasterizer->picture);
+}
+
+TEST_F(DeferredImageDecoderTest, decodeOnOtherThread)
+{
+    WTF::initializeThreading();
+
+    OwnPtr<NativeImageSkia> image(adoptPtr(m_lazyDecoder->frameBufferAtIndex(0)->asNewNativeImage()));
+    EXPECT_EQ(1, image->bitmap().width());
+    EXPECT_EQ(1, image->bitmap().height());
+    EXPECT_FALSE(image->bitmap().isNull());
+    EXPECT_TRUE(image->bitmap().isImmutable());
+
+    SkCanvas* tempCanvas = m_picture.beginRecording(100, 100);
+    tempCanvas->drawBitmap(image->bitmap(), 0, 0);
+    m_picture.endRecording();
+    EXPECT_EQ(0, m_frameBufferRequestCount);
+
+    // Create a thread to rasterize SkPicture.
+    Rasterizer rasterizer;
+    rasterizer.canvas = m_canvas;
+    rasterizer.picture = &m_picture;
+    ThreadIdentifier threadID = createThread(&rasterizeMain, &rasterizer, "RasterThread");
+    waitForThreadCompletion(threadID);
+    EXPECT_EQ(0, m_frameBufferRequestCount);
 
-    m_canvas.drawPicture(m_picture);
-    EXPECT_EQ(1, m_actualDecoder->frameBufferRequestCount());
+    SkBitmap canvasBitmap;
+    canvasBitmap.setConfig(SkBitmap::kARGB_8888_Config, 100, 100);
+    ASSERT_TRUE(m_canvas->readPixels(&canvasBitmap, 0, 0));
+    SkAutoLockPixels autoLock(canvasBitmap);
+    EXPECT_EQ(SkColorSetARGB(255, 255, 255, 255), canvasBitmap.getColor(0, 0));
 }
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/FakeWebPlugin.cpp b/Source/WebKit/chromium/tests/FakeWebPlugin.cpp
new file mode 100644
index 000000000..5e1cb9fa0
--- /dev/null
+++ b/Source/WebKit/chromium/tests/FakeWebPlugin.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FakeWebPlugin.h"
+
+#include "WebPluginParams.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebKit {
+
+FakeWebPlugin::FakeWebPlugin(WebFrame* frame, const WebPluginParams& params)
+    : m_frame(frame)
+{
+}
+
+FakeWebPlugin::~FakeWebPlugin()
+{
+}
+
+bool FakeWebPlugin::initialize(WebPluginContainer* container)
+{
+    m_container = container;
+    return true;
+}
+
+void FakeWebPlugin::destroy()
+{
+    m_container = 0;
+    m_frame = 0;
+}
+
+} // namespace  WebKit
diff --git a/Source/WebKit/chromium/tests/FakeWebPlugin.h b/Source/WebKit/chromium/tests/FakeWebPlugin.h
new file mode 100644
index 000000000..7ee41c8dc
--- /dev/null
+++ b/Source/WebKit/chromium/tests/FakeWebPlugin.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FakeWebPlugin_h
+#define FakeWebPlugin_h
+
+#include "WebPlugin.h"
+
+namespace WebKit {
+
+class WebDragData;
+class WebFrame;
+class WebInputEvent;
+class WebPluginContainer;
+class WebURL;
+class WebURLRequest;
+class WebURLResponse;
+
+class FakeWebPlugin : public WebPlugin {
+public:
+    FakeWebPlugin(WebKit::WebFrame*, const WebKit::WebPluginParams&);
+    virtual ~FakeWebPlugin();
+
+    // WebPlugin methods:
+    virtual bool initialize(WebKit::WebPluginContainer*) OVERRIDE;
+    virtual void destroy() OVERRIDE;
+    virtual NPObject* scriptableObject() OVERRIDE { return 0; }
+    virtual bool canProcessDrag() const OVERRIDE { return false; }
+    virtual void paint(WebKit::WebCanvas*, const WebKit::WebRect&) OVERRIDE { }
+    virtual void updateGeometry(const WebKit::WebRect& frameRect, const WebKit::WebRect& clipRect, const WebKit::WebVector<WebKit::WebRect>& cutOutsRects, bool isVisible) OVERRIDE { }
+    virtual void updateFocus(bool) OVERRIDE { }
+    virtual void updateVisibility(bool) OVERRIDE { }
+    virtual bool acceptsInputEvents() OVERRIDE { return true; }
+    virtual bool handleInputEvent(const WebKit::WebInputEvent&, WebKit::WebCursorInfo&) OVERRIDE { return false; }
+    virtual bool handleDragStatusUpdate(WebKit::WebDragStatus, const WebKit::WebDragData&, WebKit::WebDragOperationsMask, const WebKit::WebPoint& position, const WebKit::WebPoint& screenPosition) OVERRIDE { return false; }
+    virtual void didReceiveResponse(const WebKit::WebURLResponse&) OVERRIDE { }
+    virtual void didReceiveData(const char* data, int dataLength) OVERRIDE { }
+    virtual void didFinishLoading() OVERRIDE { }
+    virtual void didFailLoading(const WebKit::WebURLError&) OVERRIDE { }
+    virtual void didFinishLoadingFrameRequest(const WebKit::WebURL&, void* notifyData) OVERRIDE { }
+    virtual void didFailLoadingFrameRequest(const WebKit::WebURL&, void* notifyData, const WebKit::WebURLError&) OVERRIDE { }
+    virtual bool isPlaceholder() OVERRIDE { return false; }
+
+private:
+    WebFrame* m_frame;
+    WebPluginContainer* m_container;
+};
+
+} // namespace WebKit
+
+#endif // FakeWebPlugin_h
diff --git a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
index b04b3a945..7d9c2ec8c 100644
--- a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
@@ -59,8 +59,6 @@ class GraphicsLayerChromiumTest : public testing::Test {
 public:
     GraphicsLayerChromiumTest()
     {
-        // For these tests, we will enable threaded animations.
-        Platform::current()->compositorSupport()->setAcceleratedAnimationEnabled(true);
         Platform::current()->compositorSupport()->initialize(0);
         m_graphicsLayer = static_pointer_cast<GraphicsLayerChromium>(GraphicsLayer::create(&m_client));
         m_platformLayer = m_graphicsLayer->platformLayer();
diff --git a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
index 2be4e567e..ec079f50c 100644
--- a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
@@ -24,6 +24,7 @@
  */
 
 #include "config.h"
+#include "DOMStringList.h"
 #include "IDBCallbacks.h"
 #include "IDBCursorBackendInterface.h"
 #include "IDBDatabaseBackendInterface.h"
diff --git a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
index d950c1c74..b52967ddf 100644
--- a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
@@ -53,7 +53,7 @@ PassRefPtr<IDBKey> checkKeyFromValueAndKeyPathInternal(const ScriptValue& value,
     IDBKeyPath idbKeyPath(keyPath);
     EXPECT_TRUE(idbKeyPath.isValid());
     
-    return createIDBKeyFromScriptValueAndKeyPath(value, idbKeyPath);
+    return createIDBKeyFromScriptValueAndKeyPath(0, value, idbKeyPath);
 }
 
 void checkKeyPathNullValue(const ScriptValue& value, const String& keyPath)
@@ -66,7 +66,7 @@ bool injectKey(PassRefPtr<IDBKey> key, ScriptValue& value, const String& keyPath
 {
     IDBKeyPath idbKeyPath(keyPath);
     EXPECT_TRUE(idbKeyPath.isValid());
-    return injectIDBKeyIntoScriptValue(key, value, idbKeyPath);
+    return injectIDBKeyIntoScriptValue(0, key, value, idbKeyPath);
 }
 
 void checkInjection(PassRefPtr<IDBKey> prpKey, ScriptValue& value, const String& keyPath)
diff --git a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
index 4e37d3eaa..346363ac3 100644
--- a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
+++ b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
@@ -43,21 +43,18 @@ public:
     virtual bool createObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId, const String& name, const IDBKeyPath&, bool autoIncrement) OVERRIDE { return false; };
     virtual void deleteObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId) OVERRIDE { }
 
-    virtual PassRefPtr<RecordIdentifier> createInvalidRecordIdentifier() OVERRIDE { return PassRefPtr<RecordIdentifier>(); }
-
     virtual String getRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, const IDBKey&) OVERRIDE { return String(); }
-    virtual bool putRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, const IDBKey&, const String& value, RecordIdentifier*) OVERRIDE { return false; }
+    virtual void putRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, const IDBKey&, const String& value, RecordIdentifier*) OVERRIDE { }
     virtual void clearObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId) OVERRIDE { }
-    virtual void deleteRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, const RecordIdentifier*) OVERRIDE { }
+    virtual void deleteRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, const RecordIdentifier&) OVERRIDE { }
     virtual int64_t getKeyGeneratorCurrentNumber(Transaction*, int64_t databaseId, int64_t objectStoreId) OVERRIDE { return 0; }
-    virtual bool maybeUpdateKeyGeneratorCurrentNumber(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t newNumber, bool checkCurrent) OVERRIDE { return false; }
+    virtual void maybeUpdateKeyGeneratorCurrentNumber(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t newNumber, bool checkCurrent) OVERRIDE { }
     virtual bool keyExistsInObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId, const IDBKey&, RecordIdentifier* foundRecordIdentifier) OVERRIDE { return false; }
 
     virtual Vector<IDBIndexMetadata> getIndexes(int64_t databaseId, int64_t objectStoreId) OVERRIDE { return Vector<IDBIndexMetadata>(); }
     virtual bool createIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const String& name, const IDBKeyPath&, bool isUnique, bool isMultiEntry) OVERRIDE { return false; };
     virtual void deleteIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId) OVERRIDE { }
-    virtual bool putIndexDataForRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const RecordIdentifier*) OVERRIDE { return false; }
-    virtual bool deleteIndexDataForRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const RecordIdentifier*) OVERRIDE { return false; }
+    virtual void putIndexDataForRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const RecordIdentifier&) OVERRIDE { }
     virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&) OVERRIDE { return PassRefPtr<IDBKey>(); }
     virtual bool keyExistsInIndex(Transaction*, int64_t databaseid, int64_t objectStoreId, int64_t indexId, const IDBKey& indexKey, RefPtr<IDBKey>& foundPrimaryKey) OVERRIDE { return false; }
 
@@ -65,8 +62,6 @@ public:
     virtual PassRefPtr<Cursor> openObjectStoreCursor(Transaction*, int64_t databaseId, int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction) OVERRIDE { return PassRefPtr<Cursor>(); }
     virtual PassRefPtr<Cursor> openIndexKeyCursor(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) OVERRIDE { return PassRefPtr<Cursor>(); }
     virtual PassRefPtr<Cursor> openIndexCursor(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) OVERRIDE { return PassRefPtr<Cursor>(); }
-
-    virtual PassRefPtr<Transaction> createTransaction() OVERRIDE { return PassRefPtr<Transaction>(); }
 };
 
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
index 1b2ff6fe1..1d75eba8f 100644
--- a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
@@ -651,12 +651,25 @@ TEST(IDBLevelDBCodingTest, ComparisonTest)
     keys.append(DatabaseNameKey::encode("", "a"));
     keys.append(DatabaseNameKey::encode("a", "a"));
     keys.append(DatabaseMetaDataKey::encode(1, DatabaseMetaDataKey::OriginName));
-    keys.append(ObjectStoreMetaDataKey::encode(1, 1, 0));
-    keys.append(ObjectStoreMetaDataKey::encode(1, 1, 1));
+    keys.append(DatabaseMetaDataKey::encode(1, DatabaseMetaDataKey::DatabaseName));
+    keys.append(DatabaseMetaDataKey::encode(1, DatabaseMetaDataKey::UserVersion));
+    keys.append(DatabaseMetaDataKey::encode(1, DatabaseMetaDataKey::MaxObjectStoreId));
+    keys.append(DatabaseMetaDataKey::encode(1, DatabaseMetaDataKey::UserIntVersion));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::Name));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::KeyPath));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::AutoIncrement));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::Evictable));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::LastVersion));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::MaxIndexId));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::HasKeyPath));
+    keys.append(ObjectStoreMetaDataKey::encode(1, 1, ObjectStoreMetaDataKey::KeyGeneratorCurrentNumber));
     keys.append(ObjectStoreMetaDataKey::encodeMaxKey(1, 1));
     keys.append(ObjectStoreMetaDataKey::encodeMaxKey(1, 2));
     keys.append(ObjectStoreMetaDataKey::encodeMaxKey(1));
-    keys.append(IndexMetaDataKey::encode(1, 1, 30, 0));
+    keys.append(IndexMetaDataKey::encode(1, 1, 30, IndexMetaDataKey::Name));
+    keys.append(IndexMetaDataKey::encode(1, 1, 30, IndexMetaDataKey::Unique));
+    keys.append(IndexMetaDataKey::encode(1, 1, 30, IndexMetaDataKey::KeyPath));
+    keys.append(IndexMetaDataKey::encode(1, 1, 30, IndexMetaDataKey::MultiEntry));
     keys.append(IndexMetaDataKey::encode(1, 1, 31, 0));
     keys.append(IndexMetaDataKey::encode(1, 1, 31, 1));
     keys.append(IndexMetaDataKey::encodeMaxKey(1, 1, 31));
diff --git a/Source/WebKit/chromium/tests/IDBRequestTest.cpp b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
index 52a038d5b..27f6c1e6b 100644
--- a/Source/WebKit/chromium/tests/IDBRequestTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
@@ -27,6 +27,7 @@
 
 #include "IDBRequest.h"
 
+#include "DOMStringList.h"
 #include "IDBCursorBackendInterface.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBTransactionCoordinator.h"
diff --git a/Source/WebKit/chromium/tests/LevelDBTest.cpp b/Source/WebKit/chromium/tests/LevelDBTest.cpp
index 2a00ae686..7dc0355df 100644
--- a/Source/WebKit/chromium/tests/LevelDBTest.cpp
+++ b/Source/WebKit/chromium/tests/LevelDBTest.cpp
@@ -30,7 +30,9 @@
 #include "FileSystem.h"
 #include "LevelDBComparator.h"
 #include "LevelDBDatabase.h"
+#include "LevelDBIterator.h"
 #include "LevelDBSlice.h"
+#include "LevelDBTransaction.h"
 #include <gtest/gtest.h>
 #include <webkit/support/webkit_support.h>
 #include <wtf/Vector.h>
@@ -53,7 +55,7 @@ Vector<char> encodeString(const std::string& s)
 {
     Vector<char> ret(s.size());
     for (size_t i = 0; i < s.size(); ++i)
-        ret.append(s[i]);
+        ret[i] = s[i];
     return ret;
 }
 
@@ -100,6 +102,97 @@ TEST(LevelDBDatabaseTest, CorruptionTest)
     EXPECT_FALSE(success);
 }
 
+TEST(LevelDBDatabaseTest, Transaction)
+{
+    OwnPtr<webkit_support::ScopedTempDirectory> tempDirectory = adoptPtr(webkit_support::CreateScopedTempDirectory());
+    tempDirectory->CreateUniqueTempDir();
+    const String path = String::fromUTF8(tempDirectory->path().c_str());
+
+    const Vector<char> key = encodeString("key");
+    Vector<char> gotValue;
+    SimpleComparator comparator;
+
+    OwnPtr<LevelDBDatabase> leveldb = LevelDBDatabase::open(path, &comparator);
+    EXPECT_TRUE(leveldb);
+
+    const Vector<char> oldValue = encodeString("value");
+    bool success = leveldb->put(key, oldValue);
+    EXPECT_TRUE(success);
+
+    RefPtr<LevelDBTransaction> transaction = LevelDBTransaction::create(leveldb.get());
+
+    const Vector<char> newValue = encodeString("new value");
+    success = leveldb->put(key, newValue);
+    EXPECT_TRUE(success);
+
+    success = transaction->get(key, gotValue);
+    EXPECT_TRUE(success);
+    EXPECT_EQ(comparator.compare(gotValue, oldValue), 0);
+
+    success = leveldb->get(key, gotValue);
+    EXPECT_TRUE(success);
+    EXPECT_EQ(comparator.compare(gotValue, newValue), 0);
+
+    const Vector<char> addedKey = encodeString("added key");
+    const Vector<char> addedValue = encodeString("added value");
+    success = leveldb->put(addedKey, addedValue);
+    EXPECT_TRUE(success);
+
+    success = leveldb->get(addedKey, gotValue);
+    EXPECT_TRUE(success);
+    EXPECT_EQ(comparator.compare(gotValue, addedValue), 0);
+
+    success = transaction->get(addedKey, gotValue);
+    EXPECT_FALSE(success);
+}
+
+TEST(LevelDBDatabaseTest, TransactionIterator)
+{
+    OwnPtr<webkit_support::ScopedTempDirectory> tempDirectory = adoptPtr(webkit_support::CreateScopedTempDirectory());
+    tempDirectory->CreateUniqueTempDir();
+    const String path = String::fromUTF8(tempDirectory->path().c_str());
+
+    const Vector<char> start = encodeString("");
+    const Vector<char> key1 = encodeString("key1");
+    const Vector<char> value1 = encodeString("value1");
+    const Vector<char> key2 = encodeString("key2");
+    const Vector<char> value2 = encodeString("value2");
+
+    SimpleComparator comparator;
+    bool success;
+
+    OwnPtr<LevelDBDatabase> leveldb = LevelDBDatabase::open(path, &comparator);
+    EXPECT_TRUE(leveldb);
+
+    success = leveldb->put(key1, value1);
+    EXPECT_TRUE(success);
+    success = leveldb->put(key2, value2);
+    EXPECT_TRUE(success);
+
+    RefPtr<LevelDBTransaction> transaction = LevelDBTransaction::create(leveldb.get());
+
+    success = leveldb->remove(key2);
+    EXPECT_TRUE(success);
+
+    OwnPtr<LevelDBIterator> it = transaction->createIterator();
+
+    it->seek(start);
+
+    EXPECT_TRUE(it->isValid());
+    EXPECT_EQ(comparator.compare(it->key(), key1), 0);
+    EXPECT_EQ(comparator.compare(it->value(), value1), 0);
+
+    it->next();
+
+    EXPECT_TRUE(it->isValid());
+    EXPECT_EQ(comparator.compare(it->key(), key2), 0);
+    EXPECT_EQ(comparator.compare(it->value(), value2), 0);
+
+    it->next();
+
+    EXPECT_FALSE(it->isValid());
+}
+
 } // namespace
 
 #endif // USE(LEVELDB)
diff --git a/Source/WebKit/chromium/tests/LocaleMacTest.cpp b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
index 0d2fed154..cb00138b6 100644
--- a/Source/WebKit/chromium/tests/LocaleMacTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
@@ -69,6 +69,24 @@ protected:
         return dateToDaysFrom1970(year, month, day) * msPerDay;
     }
 
+    String formatWeek(const String& localeString, const String& isoString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        DateComponents date;
+        unsigned end;
+        date.parseWeek(isoString.characters(), isoString.length(), 0, end);
+        return locale->formatDateTime(date);
+    }
+
+    String formatMonth(const String& localeString, const String& isoString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        DateComponents date;
+        unsigned end;
+        date.parseMonth(isoString.characters(), isoString.length(), 0, end);
+        return locale->formatDateTime(date);
+    }
+
     String formatDate(const String& localeString, int year, int month, int day)
     {
         OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
@@ -158,6 +176,19 @@ protected:
 #endif
 };
 
+TEST_F(LocaleMacTest, formatWeek)
+{
+    EXPECT_STREQ("Week 04, 2005", formatWeek("en_US", "2005-W04").utf8().data());
+    EXPECT_STREQ("Week 52, 2005", formatWeek("en_US", "2005-W52").utf8().data());
+}
+
+TEST_F(LocaleMacTest, formatMonth)
+{
+    EXPECT_STREQ("April 2005", formatMonth("en_US", "2005-04").utf8().data());
+    EXPECT_STREQ("avril 2005", formatMonth("fr_FR", "2005-04").utf8().data());
+    EXPECT_STREQ("2005\xE5\xB9\xB4" "04\xE6\x9C\x88", formatMonth("ja_JP", "2005-04").utf8().data());
+}
+
 TEST_F(LocaleMacTest, formatDate)
 {
     EXPECT_STREQ("04/27/2005", formatDate("en_US", 2005, April, 27).utf8().data());
diff --git a/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
deleted file mode 100644
index 72aa15a30..000000000
--- a/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "CachedImage.h"
-#include "MemoryInstrumentationImpl.h"
-#include <gtest/gtest.h>
-#include <wtf/MemoryInstrumentation.h>
-#include <wtf/OwnPtr.h>
-
-using namespace WebCore;
-
-using WTF::MemoryObjectInfo;
-using WTF::MemoryClassInfo;
-using WTF::MemoryObjectType;
-
-namespace {
-
-MemoryObjectType TestType = "TestType";
-
-class ImageObserverTestHelper {
-public:
-    ImageObserverTestHelper()
-        : m_cachedImage(adoptPtr(new CachedImage(0)))
-        , m_imageOberver(m_cachedImage.get())
-    {
-    }
-    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-    {
-        MemoryClassInfo info(memoryObjectInfo, this, TestType);
-        info.addMember(m_cachedImage);
-        info.addMember(m_imageOberver);
-    }
-
-    OwnPtr<CachedImage> m_cachedImage;
-    ImageObserver* m_imageOberver;
-};
-
-TEST(MemoryInstrumentationTest, ImageObserver)
-{
-    ImageObserverTestHelper helper;
-
-    class TestClient : public MemoryInstrumentationClientImpl {
-    public:
-        TestClient(const void* expectedPointer, const void* unexpectedPointer)
-            : m_expectedPointer(expectedPointer)
-            , m_unexpectedPointer(unexpectedPointer)
-            , m_expectedPointerFound(false)
-        {
-            EXPECT_NE(expectedPointer, unexpectedPointer);
-        }
-        virtual void countObjectSize(const void* pointer, MemoryObjectType type, size_t size) OVERRIDE
-        {
-            EXPECT_NE(m_unexpectedPointer, pointer);
-            if (m_expectedPointer == pointer)
-                m_expectedPointerFound = true;
-            MemoryInstrumentationClientImpl::countObjectSize(pointer, type, size);
-        }
-
-        bool expectedPointerFound() { return m_expectedPointerFound; }
-
-    private:
-        const void* m_expectedPointer;
-        const void* m_unexpectedPointer;
-        bool m_expectedPointerFound;
-    } client(helper.m_cachedImage.get(), helper.m_imageOberver);
-    MemoryInstrumentationImpl instrumentation(&client);
-    instrumentation.addRootObject(helper);
-    EXPECT_TRUE(client.expectedPointerFound());
-    EXPECT_LE(sizeof(CachedImage), client.reportedSizeForAllTypes());
-    EXPECT_LE(1u, client.totalCountedObjects());
-}
-
-
-} // namespace
-
diff --git a/Source/WebKit/chromium/tests/MockImageDecoder.h b/Source/WebKit/chromium/tests/MockImageDecoder.h
index 5cf23744e..c9c0d01d6 100644
--- a/Source/WebKit/chromium/tests/MockImageDecoder.h
+++ b/Source/WebKit/chromium/tests/MockImageDecoder.h
@@ -29,13 +29,24 @@
 
 namespace WebCore {
 
+class MockImageDecoderClient {
+public:
+    virtual void decoderBeingDestroyed() = 0;
+};
+
 class MockImageDecoder : public ImageDecoder {
 public:
-    MockImageDecoder()
+    MockImageDecoder(MockImageDecoderClient* client)
         : ImageDecoder(ImageSource::AlphaPremultiplied, ImageSource::GammaAndColorProfileApplied)
         , m_frameBufferRequestCount(0)
+        , m_client(client)
     { }
 
+    ~MockImageDecoder()
+    {
+        m_client->decoderBeingDestroyed();
+    }
+
     virtual String filenameExtension() const
     {
         return "mock";
@@ -54,6 +65,7 @@ public:
 
 private:
     int m_frameBufferRequestCount;
+    MockImageDecoderClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/tests/TransparencyWinTest.cpp b/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
index ae3090d8c..6d73caf51 100644
--- a/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
+++ b/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
@@ -66,7 +66,7 @@ static void drawNativeRect(GraphicsContext* context,
 
 static Color getPixelAt(GraphicsContext* context, int x, int y)
 {
-    const SkBitmap& bitmap = context->platformContext()->canvas()->getTopDevice()->accessBitmap(false);
+    const SkBitmap& bitmap = context->platformContext()->layerBitmap();
     return Color(*reinterpret_cast<const RGBA32*>(bitmap.getAddr32(x, y)));
 }
 
@@ -74,7 +74,7 @@ static Color getPixelAt(GraphicsContext* context, int x, int y)
 // Windows messing it up.
 static void clearTopLayerAlphaChannel(GraphicsContext* context)
 {
-    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->canvas()->getTopDevice()->accessBitmap(false));
+    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->layerBitmap());
     for (int y = 0; y < bitmap.height(); y++) {
         uint32_t* row = bitmap.getAddr32(0, y);
         for (int x = 0; x < bitmap.width(); x++)
@@ -85,7 +85,7 @@ static void clearTopLayerAlphaChannel(GraphicsContext* context)
 // Clears the alpha channel on the specified pixel.
 static void clearTopLayerAlphaPixel(GraphicsContext* context, int x, int y)
 {
-    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->canvas()->getTopDevice()->accessBitmap(false));
+    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->layerBitmap());
     *bitmap.getAddr32(x, y) &= 0x00FFFFFF;
 }
 
@@ -616,7 +616,7 @@ TEST(TransparencyWin, Scale)
         // the helper goes out of scope. We don't want to call
         // clearTopLayerAlphaChannel because that will actually clear the whole
         // canvas (since we have no extra layer!).
-        SkBitmap& bitmap = const_cast<SkBitmap&>(helper.context()->platformContext()->canvas()->getTopDevice()->accessBitmap(false));
+        SkBitmap& bitmap = const_cast<SkBitmap&>(helper.context()->platformContext()->layerBitmap());
         *bitmap.getAddr32(2, 2) &= 0x00FFFFFF;
         helper.composite();
     }
diff --git a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
index 49fdbff7d..395fdcf3d 100644
--- a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
@@ -32,7 +32,6 @@
 #include "WebInputEvent.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
-#include <public/WebCompositor.h>
 #include <public/WebFloatPoint.h>
 #include <public/WebInputHandler.h>
 #include <public/WebInputHandlerClient.h>
@@ -60,7 +59,7 @@ public:
     MOCK_METHOD0(scheduleAnimation, void());
 
     MOCK_METHOD2(scrollBegin, ScrollStatus(WebPoint, WebInputHandlerClient::ScrollInputType));
-    MOCK_METHOD2(scrollBy, void(WebPoint, WebSize));
+    MOCK_METHOD2(scrollByIfPossible, bool(WebPoint, WebSize));
     MOCK_METHOD0(scrollEnd, void());
 
 private:
@@ -156,11 +155,24 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureScrollStarted)
     gesture.type = WebInputEvent::GestureScrollBegin;
     m_inputHandler->handleInputEvent(gesture);
 
+    // The event should not be marked as handled if scrolling is not possible.
+    m_expectedDisposition = DropEvent;
     VERIFY_AND_RESET_MOCKS();
 
     gesture.type = WebInputEvent::GestureScrollUpdate;
     gesture.data.scrollUpdate.deltaY = -40; // -Y means scroll down - i.e. in the +Y direction.
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::Field(&WebSize::height, testing::Gt(0))));
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::height, testing::Gt(0))))
+        .WillOnce(testing::Return(false));
+    m_inputHandler->handleInputEvent(gesture);
+
+    // Mark the event as handled if scroll happens.
+    m_expectedDisposition = DidHandle;
+    VERIFY_AND_RESET_MOCKS();
+
+    gesture.type = WebInputEvent::GestureScrollUpdate;
+    gesture.data.scrollUpdate.deltaY = -40; // -Y means scroll down - i.e. in the +Y direction.
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::height, testing::Gt(0))))
+        .WillOnce(testing::Return(true));
     m_inputHandler->handleInputEvent(gesture);
 
     VERIFY_AND_RESET_MOCKS();
@@ -347,7 +359,8 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimates)
     EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
     EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusStarted));
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::Field(&WebSize::width, testing::Lt(0))));
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::width, testing::Lt(0))))
+        .WillOnce(testing::Return(true));
     EXPECT_CALL(m_mockInputHandlerClient, scrollEnd());
     m_inputHandler->animate(10.1);
 
@@ -359,7 +372,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingAnimates)
     EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
     EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusOnMainThread));
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::_)).Times(0);
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::_)).Times(0);
     EXPECT_CALL(m_mockInputHandlerClient, scrollEnd()).Times(0);
 
     // Expected wheel fling animation parameters:
@@ -430,7 +443,8 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
     EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusStarted));
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::Field(&WebSize::width, testing::Lt(0))));
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::width, testing::Lt(0))))
+        .WillOnce(testing::Return(true));
     EXPECT_CALL(m_mockInputHandlerClient, scrollEnd());
     m_inputHandler->animate(10.1);
 
@@ -442,7 +456,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
     EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusOnMainThread));
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::_)).Times(0);
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::_)).Times(0);
     EXPECT_CALL(m_mockInputHandlerClient, scrollEnd()).Times(0);
 
     // Expected wheel fling animation parameters:
@@ -510,7 +524,8 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
     EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusStarted));
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::Field(&WebSize::height, testing::Gt(0))));
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::Field(&WebSize::height, testing::Gt(0))))
+        .WillOnce(testing::Return(true));
     EXPECT_CALL(m_mockInputHandlerClient, scrollEnd());
     m_inputHandler->animate(30.1);
 
@@ -520,7 +535,7 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
     EXPECT_CALL(m_mockInputHandlerClient, scheduleAnimation());
     EXPECT_CALL(m_mockInputHandlerClient, scrollBegin(testing::_, testing::_))
         .WillOnce(testing::Return(WebInputHandlerClient::ScrollStatusOnMainThread));
-    EXPECT_CALL(m_mockInputHandlerClient, scrollBy(testing::_, testing::_)).Times(0);
+    EXPECT_CALL(m_mockInputHandlerClient, scrollByIfPossible(testing::_, testing::_)).Times(0);
     EXPECT_CALL(m_mockInputHandlerClient, scrollEnd()).Times(0);
 
     // We should get parameters from the second fling, nothing from the first fling should "leak".
@@ -536,4 +551,3 @@ TEST_F(WebCompositorInputHandlerImplTest, gestureFlingTransferResets)
 }
 
 }
-
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index ffed3c203..f503541f5 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -220,10 +220,8 @@ TEST_F(WebFrameTest, DispatchMessageEventWithOriginCheck)
 
 class FixedLayoutTestWebViewClient : public WebViewClient {
  public:
-    virtual WebRect windowRect() OVERRIDE { return m_windowRect; }
     virtual WebScreenInfo screenInfo() OVERRIDE { return m_screenInfo; }
 
-    WebRect m_windowRect;
     WebScreenInfo m_screenInfo;
 };
 
@@ -235,8 +233,7 @@ TEST_F(WebFrameTest, DeviceScaleFactorUsesDefaultWithoutViewportTag)
     int viewportHeight = 480;
 
     FixedLayoutTestWebViewClient client;
-    client.m_screenInfo.horizontalDPI = 320;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
+    client.m_screenInfo.deviceScaleFactor = 2;
 
     WebView* webView = static_cast<WebView*>(FrameTestHelpers::createWebViewAndLoad(m_baseURL + "no_viewport_tag.html", true, 0, &client));
 
@@ -260,10 +257,9 @@ TEST_F(WebFrameTest, FixedLayoutInitializeAtMinimumPageScale)
     registerMockedHttpURLLoad("fixed_layout.html");
 
     FixedLayoutTestWebViewClient client;
-    client.m_screenInfo.horizontalDPI = 160;
+    client.m_screenInfo.deviceScaleFactor = 1;
     int viewportWidth = 640;
     int viewportHeight = 480;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
 
     // Make sure we initialize to minimum scale, even if the window size
     // only becomes available after the load begins.
@@ -291,6 +287,23 @@ TEST_F(WebFrameTest, FixedLayoutInitializeAtMinimumPageScale)
     webViewImpl->resize(WebSize(viewportWidth, viewportHeight + 100));
     EXPECT_EQ(userPinchPageScaleFactor, webViewImpl->pageScaleFactor());
 }
+
+TEST_F(WebFrameTest, ScaleFactorShouldNotOscillate)
+{
+    registerMockedHttpURLLoad("scale_oscillate.html");
+
+    FixedLayoutTestWebViewClient client;
+    client.m_screenInfo.horizontalDPI = 212;
+    int viewportWidth = 800;
+    int viewportHeight = 1057;
+
+    WebViewImpl* webViewImpl = static_cast<WebViewImpl*>(FrameTestHelpers::createWebViewAndLoad(m_baseURL + "scale_oscillate.html", true, 0, &client));
+    webViewImpl->enableFixedLayoutMode(true);
+    webViewImpl->settings()->setViewportEnabled(true);
+    webViewImpl->resize(WebSize(viewportWidth, viewportHeight));
+    webViewImpl->layout();
+}
+
 #endif
 
 TEST_F(WebFrameTest, CanOverrideMaximumScaleFactor)
@@ -298,10 +311,9 @@ TEST_F(WebFrameTest, CanOverrideMaximumScaleFactor)
     registerMockedHttpURLLoad("no_scale_for_you.html");
 
     FixedLayoutTestWebViewClient client;
-    client.m_screenInfo.horizontalDPI = 160;
+    client.m_screenInfo.deviceScaleFactor = 1;
     int viewportWidth = 640;
     int viewportHeight = 480;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
 
     WebViewImpl* webViewImpl = static_cast<WebViewImpl*>(FrameTestHelpers::createWebViewAndLoad(m_baseURL + "no_scale_for_you.html", true, 0, &client));
     webViewImpl->enableFixedLayoutMode(true);
@@ -316,13 +328,6 @@ TEST_F(WebFrameTest, CanOverrideMaximumScaleFactor)
 }
 
 #if ENABLE(GESTURE_EVENTS)
-class DivAutoZoomTestWebViewClient : public WebViewClient {
-    public:
-    virtual WebRect windowRect() OVERRIDE { return m_windowRect; }
-
-    WebRect m_windowRect;
-};
-
 void setScaleAndScrollAndLayout(WebKit::WebView* webView, WebPoint scroll, float scale)
 {
     webView->setPageScaleFactor(scale, WebPoint(scroll.x, scroll.y));
@@ -333,11 +338,9 @@ TEST_F(WebFrameTest, DivAutoZoomParamsTest)
 {
     registerMockedHttpURLLoad("get_scale_for_auto_zoom_into_div_test.html");
 
-    DivAutoZoomTestWebViewClient client;
     int viewportWidth = 640;
     int viewportHeight = 480;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
-    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_for_auto_zoom_into_div_test.html", true, 0, &client);
+    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_for_auto_zoom_into_div_test.html");
     webView->enableFixedLayoutMode(true);
     webView->setDeviceScaleFactor(2.0f);
     webView->resize(WebSize(viewportWidth, viewportHeight));
@@ -401,12 +404,10 @@ TEST_F(WebFrameTest, DivAutoZoomMultipleDivsTest)
 {
     registerMockedHttpURLLoad("get_multiple_divs_for_auto_zoom_test.html");
 
-    DivAutoZoomTestWebViewClient client;
     int viewportWidth = 640;
     int viewportHeight = 480;
     float doubleTapZoomAlreadyLegibleRatio = 1.2f;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
-    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_multiple_divs_for_auto_zoom_test.html", true, 0, &client);
+    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_multiple_divs_for_auto_zoom_test.html");
     webView->enableFixedLayoutMode(true);
     webView->resize(WebSize(viewportWidth, viewportHeight));
     webView->setPageScaleFactorLimits(1, 4);
@@ -442,12 +443,10 @@ TEST_F(WebFrameTest, DivAutoZoomScaleBoundsTest)
 {
     registerMockedHttpURLLoad("get_scale_bounds_check_for_auto_zoom_test.html");
 
-    DivAutoZoomTestWebViewClient client;
     int viewportWidth = 640;
     int viewportHeight = 480;
     float doubleTapZoomAlreadyLegibleRatio = 1.2f;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
-    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_bounds_check_for_auto_zoom_test.html", true, 0, &client);
+    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_bounds_check_for_auto_zoom_test.html");
     webView->enableFixedLayoutMode(true);
     webView->resize(WebSize(viewportWidth, viewportHeight));
     webView->setPageScaleFactorLimits(1, 4);
@@ -504,14 +503,12 @@ TEST_F(WebFrameTest, DISABLED_DivScrollIntoEditableTest)
 {
     registerMockedHttpURLLoad("get_scale_for_zoom_into_editable_test.html");
 
-    DivAutoZoomTestWebViewClient client;
     int viewportWidth = 640;
     int viewportHeight = 480;
     float leftBoxRatio = 0.3f;
     int caretPadding = 10;
     int minReadableCaretHeight = 18;
-    client.m_windowRect = WebRect(0, 0, viewportWidth, viewportHeight);
-    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_for_zoom_into_editable_test.html", true, 0, &client);
+    WebKit::WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_for_zoom_into_editable_test.html");
     webView->enableFixedLayoutMode(true);
     webView->resize(WebSize(viewportWidth, viewportHeight));
     webView->setPageScaleFactorLimits(1, 10);
diff --git a/Source/WebKit/chromium/tests/WebPluginContainerTest.cpp b/Source/WebKit/chromium/tests/WebPluginContainerTest.cpp
new file mode 100644
index 000000000..50089c9d4
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebPluginContainerTest.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPluginContainer.h"
+
+#include "Element.h"
+#include "FakeWebPlugin.h"
+#include "FrameTestHelpers.h"
+#include "URLTestHelpers.h"
+#include "WebDocument.h"
+#include "WebElement.h"
+#include "WebFrame.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebPluginContainerImpl.h"
+#include "WebPluginParams.h"
+#include "WebSettings.h"
+#include "WebView.h"
+#include "WebViewImpl.h"
+#include <gtest/gtest.h>
+#include <webkit/support/webkit_support.h>
+
+using namespace WebKit;
+
+namespace {
+
+class WebPluginContainerTest : public testing::Test {
+public:
+    WebPluginContainerTest()
+        : m_baseURL("http://www.test.com/")
+    {
+    }
+
+    virtual void TearDown()
+    {
+        webkit_support::UnregisterAllMockedURLs();
+    }
+
+protected:
+    std::string m_baseURL;
+};
+
+class TestPluginWebFrameClient : public WebFrameClient {
+    virtual WebPlugin* createPlugin(WebFrame* frame, const WebPluginParams& params) OVERRIDE
+    {
+        if (params.mimeType == WebString::fromUTF8("application/x-webkit-test-webplugin"))
+            return new FakeWebPlugin(frame, params);
+        return WebFrameClient::createPlugin(frame, params);
+    }
+};
+
+WebPluginContainer* getWebPluginContainer(WebView* webView, const WebString& id)
+{
+    WebElement element = webView->mainFrame()->document().getElementById(id);
+    return element.pluginContainer();
+}
+
+TEST_F(WebPluginContainerTest, WindowToLocalPointTest)
+{
+    URLTestHelpers::registerMockedURLFromBaseURL(WebString::fromUTF8(m_baseURL.c_str()), WebString::fromUTF8("plugin_container.html"));
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "plugin_container.html", true, new TestPluginWebFrameClient());
+    ASSERT(webView);
+    webView->settings()->setPluginsEnabled(true);
+    webView->resize(WebSize(300, 300));
+    webView->layout();
+    webkit_support::RunAllPendingMessages();
+
+    WebPluginContainer* pluginContainerOne = getWebPluginContainer(webView, WebString::fromUTF8("translated-plugin"));
+    ASSERT(pluginContainerOne);
+    WebPoint point1 = pluginContainerOne->windowToLocalPoint(WebPoint(10, 10));
+    ASSERT_EQ(0, point1.x);
+    ASSERT_EQ(0, point1.y);
+    WebPoint point2 = pluginContainerOne->windowToLocalPoint(WebPoint(100, 100));
+    ASSERT_EQ(90, point2.x);
+    ASSERT_EQ(90, point2.y);
+
+    WebPluginContainer* pluginContainerTwo = getWebPluginContainer(webView, WebString::fromUTF8("rotated-plugin"));
+    ASSERT(pluginContainerTwo);
+    WebPoint point3 = pluginContainerTwo->windowToLocalPoint(WebPoint(0, 10));
+    ASSERT_EQ(10, point3.x);
+    ASSERT_EQ(0, point3.y);
+    WebPoint point4 = pluginContainerTwo->windowToLocalPoint(WebPoint(-10, 10));
+    ASSERT_EQ(10, point4.x);
+    ASSERT_EQ(10, point4.y);
+
+    webView->close();
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/data/plugin_container.html b/Source/WebKit/chromium/tests/data/plugin_container.html
new file mode 100644
index 000000000..713ca804e
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/plugin_container.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style type="text/css">
+    body { margin: 0; padding: 0; }
+  </style>
+</head>
+<body>
+  <object id="rotated-plugin"
+      style="-webkit-transform: rotate(90deg); position: absolute; top: 0; left: 0; -webkit-transform-origin: 0 0;"
+      type="application/x-webkit-test-webplugin"
+      border=0
+      width="40"
+      height="40">
+  </object>
+  <object id="translated-plugin"
+      border=0
+      style="-webkit-transform: translate(10px, 10px); position: absolute; top: 0; left: 0;"
+      type="application/x-webkit-test-webplugin"
+      width="40"
+      height="40">
+  </object>
+</body>
+</html>
diff --git a/Source/WebKit/chromium/tests/data/scale_oscillate.html b/Source/WebKit/chromium/tests/data/scale_oscillate.html
new file mode 100644
index 000000000..26ca4613c
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/scale_oscillate.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html style="width:100%;height:100%;">
+<head>
+<title>Test</title>
+<style>
+::-webkit-scrollbar {
+    width: 1px;
+}
+</style>
+<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0"/>
+</head>
+<body>
+This test passes if it doesn't cause oscillating scale factor due to content size rounding errors and creating/destroying of custom scrollbars.
+An example of parameter that reproduce the crash is viewport size (800, 1057) with device scale factor 1.325
+</body>
+</html>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index f6117da03..2f97483fa 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,145 @@
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Disambiguate innerNodeFramePoint and mainFramePoint 
+        https://bugs.webkit.org/show_bug.cgi?id=98139
+
+        Reviewed by Julien Chaffraix.
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_hit_test_new):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_uri_set):
+        (_ewk_frame_contents_set_internal):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * ewk/ewk_frame.cpp:
+        (_ewk_frame_contents_set_internal):
+
+2012-11-19  Tony Chang  <tony@chromium.org>
+
+        Remove 'is' prefix from WebSettings::isWebSecurityEnabled and WebSettings::isSpatialNavigationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=102548
+
+        Reviewed by Adam Barth.
+
+        Rename call to WebCore::Settings.
+
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+
+2012-11-16  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134694.
+        http://trac.webkit.org/changeset/134694
+        https://bugs.webkit.org/show_bug.cgi?id=102481
+
+        it made API test crash on EFL port (Requested by gyuyoung on
+        #webkit).
+
+        * DefaultTheme/default.edc:
+
+2012-11-15  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rename member vars in ViewportArgument to match css-device-adapt
+        https://bugs.webkit.org/show_bug.cgi?id=102355
+
+        Reviewed by Gyuyoung Kim.
+
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new): Update to reflect name change.
+
+2012-11-15  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed. Fix build break when using --no-tiled-backing-store option.
+
+        * ewk/ewk_frame_private.h:
+        (WebCore):
+
+2012-11-14  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL] Port tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=71352
+
+        Reviewed by Gyuyoung Kim.
+
+        Added ewk_view_setting_tiled_backing_store_enabled_{get|set} to give possibility
+        to use WebCore's tiled backing store in WebKit/Efl port. This makes WebKit/Efl
+        compliant with WebKit's generic solution of tiled backing store.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::invalidateRootView):
+        (WebCore):
+        (WebCore::ChromeClientEfl::visibleRectForTiledBackingStore):
+        * WebCoreSupport/ChromeClientEfl.h:
+        (ChromeClientEfl):
+        * ewk/ewk_frame_private.h:
+        Declared missing classes which used in this file.
+        * ewk/ewk_paint_context.cpp:
+        (ewk_paint_context_paint): Implemented to paint tiled backing store
+        * ewk/ewk_view.cpp:
+        (ewk_view_setting_tiled_backing_store_enabled_set):
+        Added API to enable/disable the WebCore's tiled backing store.
+        (ewk_view_setting_tiled_backing_store_enabled_get):
+        Added API to query if the WebCore's tiled backing store is enabled.
+        (ewk_view_tiled_backing_store_invalidate):
+        * ewk/ewk_view.h:
+        * ewk/ewk_view_private.h:
+        * ewk/ewk_view_single.cpp:
+        (_ewk_view_single_smart_repaints_process):
+        Implemented to update visible area of tiled backing store.
+        * tests/test_ewk_view.cpp: Added test case of ewk_view_setting_tiled_backing_store.
+        (TEST_F):
+
+2012-11-14  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL] Refactor theme to choose whether to support foreground color of selection
+        https://bugs.webkit.org/show_bug.cgi?id=102037
+
+        Reviewed by Gyuyoung Kim.
+
+        * DefaultTheme/default.edc:
+        Refactored color classes from active/inactive to foreground/background.
+
+2012-11-12  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [EFL] In ewk_tiled_backing_store_pre_render_region, the 'slicer' may be uninitialized
+        https://bugs.webkit.org/show_bug.cgi?id=102038
+
+        Reviewed by Gyuyoung Kim.
+
+        To fix build warning -Wuninitialized,
+        initialize the 'slicer' in ewk_tiled_backing_store_pre_render_region.
+
+        * ewk/ewk_tiled_backing_store.cpp:
+        (ewk_tiled_backing_store_pre_render_region):
+
+2012-11-09  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [EFL][DRT] Force a repaint before tracking repaint rects.
+        https://bugs.webkit.org/show_bug.cgi?id=101743
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        (DumpRenderTreeSupportEfl::forceLayout): Added.
+        * WebCoreSupport/DumpRenderTreeSupportEfl.h:
+
 2012-11-07  Emil A Eklund  <eae@chromium.org>
 
         Unreviewed EFL build fix.
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index 537424a94..0fe0ffab6 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -515,9 +515,14 @@ void ChromeClientEfl::invalidateContents(const IntRect& /*updateRect*/, bool /*i
     notImplemented();
 }
 
-void ChromeClientEfl::invalidateRootView(const IntRect& /*updateRect*/, bool /*immediate*/)
+void ChromeClientEfl::invalidateRootView(const IntRect& updateRect, bool /*immediate*/)
 {
+#if USE(TILED_BACKING_STORE)
+    ewk_view_tiled_backing_store_invalidate(m_view, updateRect);
+#else
+    UNUSED_PARAM(updateRect);
     notImplemented();
+#endif
 }
 
 void ChromeClientEfl::invalidateContentsAndRootView(const IntRect& updateRect, bool /*immediate*/)
@@ -653,6 +658,16 @@ void ChromeClientEfl::delegatedScrollRequested(const IntPoint&)
 {
     notImplemented();
 }
+
+IntRect ChromeClientEfl::visibleRectForTiledBackingStore() const
+{
+    WebCore::FloatRect rect = ewk_view_page_rect_get(m_view);
+    const Evas_Object* frame = ewk_view_frame_main_get(m_view);
+
+    int x, y;
+    ewk_frame_scroll_pos_get(frame, &x, &y);
+    return IntRect(x, y, rect.width(), rect.height());
+}
 #endif
 
 }
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index 68da45a8a..ab10778fa 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -182,6 +182,7 @@ public:
 
 #if USE(TILED_BACKING_STORE)
     virtual void delegatedScrollRequested(const IntPoint& scrollPoint);
+    virtual IntRect visibleRectForTiledBackingStore() const;
 #endif
 
     Evas_Object* m_view;
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
index b045ab042..7ea2721d8 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
@@ -399,6 +399,11 @@ void DumpRenderTreeSupportEfl::setSelectTrailingWhitespaceEnabled(Evas_Object* e
     editorClient->setSelectTrailingWhitespaceEnabled(enabled);
 }
 
+void DumpRenderTreeSupportEfl::forceLayout(Evas_Object* ewkFrame)
+{
+    ewk_frame_force_layout(ewkFrame);
+}
+
 void DumpRenderTreeSupportEfl::setTracksRepaints(Evas_Object* ewkFrame, bool enabled)
 {
     DRT_SUPPORT_FRAME_GET_OR_RETURN(ewkFrame, frame);
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
index 59a63b4b1..80277d51a 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
@@ -87,6 +87,7 @@ public:
     static void setSmartInsertDeleteEnabled(Evas_Object* ewkView, bool enabled);
     static void setSelectTrailingWhitespaceEnabled(Evas_Object* ewkView, bool enabled);
 
+    static void forceLayout(Evas_Object* ewkFrame);
     static void setTracksRepaints(Evas_Object* ewkFrame, bool enabled);
     static void resetTrackedRepaints(Evas_Object* ewkFrame);
     static bool isTrackingRepaints(const Evas_Object* ewkFrame);
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index 738a93918..dec55d698 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -702,8 +702,9 @@ Ewk_Hit_Test* ewk_frame_hit_test_new(const Evas_Object* ewkFrame, int x, int y)
         return 0;
 
     Ewk_Hit_Test* hitTest = new Ewk_Hit_Test;
-    hitTest->x = result.point().x();
-    hitTest->y = result.point().y();
+    // FIXME: This should probably use pointInMainFrame, if it is to match the documentation of ewk_hit_test.
+    hitTest->x = result.pointInInnerNodeFrame().x();
+    hitTest->y = result.pointInInnerNodeFrame().y();
 #if 0
     // FIXME
     hitTest->bounding_box.x = result.boundingBox().x();
diff --git a/Source/WebKit/efl/ewk/ewk_frame_private.h b/Source/WebKit/efl/ewk/ewk_frame_private.h
index 4f5f0e40e..d841f2a50 100644
--- a/Source/WebKit/efl/ewk/ewk_frame_private.h
+++ b/Source/WebKit/efl/ewk/ewk_frame_private.h
@@ -26,10 +26,15 @@
 #include <Evas.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
-class Widget;
+class HistoryItem;
+class HTMLPlugInElement;
+class KURL;
 class Frame;
+class IntSize;
+class Widget;
 }
 
 Evas_Object* ewk_frame_add(Evas* canvas);
diff --git a/Source/WebKit/efl/ewk/ewk_paint_context.cpp b/Source/WebKit/efl/ewk/ewk_paint_context.cpp
index bdbd899bc..c19d13811 100644
--- a/Source/WebKit/efl/ewk/ewk_paint_context.cpp
+++ b/Source/WebKit/efl/ewk/ewk_paint_context.cpp
@@ -20,6 +20,7 @@
 
 #include "config.h"
 
+#include "TiledBackingStore.h"
 #include "ewk_paint_context_private.h"
 #include "ewk_private.h"
 
@@ -158,6 +159,20 @@ void ewk_paint_context_paint(Ewk_Paint_Context* context, WebCore::FrameView* vie
 
     WebCore::IntRect paintArea(*area);
 
+#if USE(TILED_BACKING_STORE)
+    if (view->frame()->tiledBackingStore()) {
+        int scrollX = view->scrollX();
+        int scrollY = view->scrollY();
+
+        context->graphicContext->translate(-scrollX, -scrollY);
+
+        paintArea.move(scrollX, scrollY);
+
+        view->frame()->tiledBackingStore()->paint(context->graphicContext.get(), paintArea);
+        return;
+    }
+#endif
+
     if (view->isTransparent())
         context->graphicContext->clearRect(paintArea);
     view->paint(context->graphicContext.get(), paintArea);
diff --git a/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp b/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp
index ddae17347..1c5087978 100644
--- a/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp
+++ b/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp
@@ -1855,6 +1855,8 @@ bool ewk_tiled_backing_store_pre_render_region(Evas_Object* ewkBackingStore, Eva
     zoom = ROUNDED_ZOOM(priv->view.tile.width, zoom);
 
     Eina_Tile_Grid_Slicer slicer;
+    memset(&slicer, 0, sizeof(Eina_Tile_Grid_Slicer));
+
     if (!eina_tile_grid_slicer_setup(&slicer, x, y, width, height, tileWidth, tileHeight)) {
         ERR("could not setup grid slicer for %d,%d+%dx%d tile=%dx%d",
             x, y, width, height, tileWidth, tileHeight);
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index b7a84b1f9..6816a877f 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -36,6 +36,7 @@
 #include "EflScreenUtilities.h"
 #include "EventHandler.h"
 #include "FocusController.h"
+#include "Frame.h"
 #include "FrameLoaderClientEfl.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
@@ -57,6 +58,7 @@
 #include "RenderThemeEfl.h"
 #include "ResourceHandle.h"
 #include "Settings.h"
+#include "TiledBackingStore.h"
 #include "c_instance.h"
 #include "ewk_contextmenu_private.h"
 #include "ewk_frame.h"
@@ -802,12 +804,13 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     WebCore::LayoutMilestones layoutMilestones = WebCore::DidFirstLayout | WebCore::DidFirstVisuallyNonEmptyLayout;
     priv->page->addLayoutMilestones(layoutMilestones);
 
+    // FIXME: Noone is supposed to do this manually.
     priv->viewportArguments.width = WebCore::ViewportArguments::ValueAuto;
     priv->viewportArguments.height = WebCore::ViewportArguments::ValueAuto;
-    priv->viewportArguments.initialScale = WebCore::ViewportArguments::ValueAuto;
-    priv->viewportArguments.minimumScale = WebCore::ViewportArguments::ValueAuto;
-    priv->viewportArguments.maximumScale = WebCore::ViewportArguments::ValueAuto;
-    priv->viewportArguments.userScalable = true;
+    priv->viewportArguments.zoom = WebCore::ViewportArguments::ValueAuto;
+    priv->viewportArguments.minZoom = WebCore::ViewportArguments::ValueAuto;
+    priv->viewportArguments.maxZoom = WebCore::ViewportArguments::ValueAuto;
+    priv->viewportArguments.userZoom = true;
 
     priv->pageSettings->setLoadsImagesAutomatically(true);
     priv->pageSettings->setDefaultTextEncodingName("iso-8859-1");
@@ -886,7 +889,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     priv->settings.resizableTextareas = priv->pageSettings->textAreasAreResizable();
     priv->settings.privateBrowsing = priv->pageSettings->privateBrowsingEnabled();
     priv->settings.caretBrowsing = priv->pageSettings->caretBrowsingEnabled();
-    priv->settings.spatialNavigation = priv->pageSettings->isSpatialNavigationEnabled();
+    priv->settings.spatialNavigation = priv->pageSettings->spatialNavigationEnabled();
     priv->settings.localStorage = priv->pageSettings->localStorageEnabled();
     priv->settings.offlineAppCache = true; // XXX no function to read setting; this keeps the original setting
     priv->settings.pageCache = priv->pageSettings->usesPageCache();
@@ -4754,6 +4757,55 @@ Ewk_Context_Menu* ewk_view_context_menu_get(const Evas_Object* ewkView)
     return priv->contextMenu;
 }
 
+Eina_Bool ewk_view_setting_tiled_backing_store_enabled_set(Evas_Object* ewkView, Eina_Bool enable)
+{
+#if USE(TILED_BACKING_STORE)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+
+    priv->pageSettings->setTiledBackingStoreEnabled(enable);
+
+    return true;
+#else
+    UNUSED_PARAM(ewkView);
+    UNUSED_PARAM(enable);
+    return false;
+#endif
+}
+
+Eina_Bool ewk_view_setting_tiled_backing_store_enabled_get(Evas_Object* ewkView)
+{
+#if USE(TILED_BACKING_STORE)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+
+    return priv->pageSettings->tiledBackingStoreEnabled();
+#else
+    UNUSED_PARAM(ewkView);
+    return false;
+#endif
+}
+
+#if USE(TILED_BACKING_STORE)
+/**
+ * @internal
+ * Invalidate given area to repaint. The backing store will mark tiles that are
+ * in the area as dirty.
+ *
+ * @param ewkView View.
+ * @param area Area to invalidate
+ */
+void ewk_view_tiled_backing_store_invalidate(Evas_Object* ewkView, const WebCore::IntRect& area)
+{
+    EINA_SAFETY_ON_NULL_RETURN(ewkView);
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    if (priv->mainFrame->tiledBackingStore())
+        priv->mainFrame->tiledBackingStore()->invalidate(area);
+}
+#endif
+
 namespace EWKPrivate {
 
 WebCore::Page* corePage(const Evas_Object* ewkView)
diff --git a/Source/WebKit/efl/ewk/ewk_view.h b/Source/WebKit/efl/ewk/ewk_view.h
index 106ba145e..65dc55eb9 100644
--- a/Source/WebKit/efl/ewk/ewk_view.h
+++ b/Source/WebKit/efl/ewk/ewk_view.h
@@ -2777,6 +2777,28 @@ EAPI Eina_Bool ewk_view_setting_enable_fullscreen_set(Evas_Object *o, Eina_Bool
 EAPI Eina_Bool ewk_view_setting_enable_fullscreen_get(const Evas_Object *o);
 
 /**
+ * Enables/disables the WebCore's tiled backing store.
+ *
+ * @param o view object
+ * @oaram enable Enable or Disable WebCore's tiled backing store for given View
+ *
+ * @return true on success, or false on failure
+ *
+ * @note this is not for general use. It should be used for single view only.
+ */
+EAPI Eina_Bool ewk_view_setting_tiled_backing_store_enabled_set(Evas_Object *o, Eina_Bool enable);
+
+/**
+ * Queries if the WebCore's tiled backing store is enabled.
+ *
+ * @param o view object to query
+ *
+ * @return @c EINA_TRUE if the WebCore's tiled backing store is enabled
+ *         @c EINA_FALSE if not or on failure
+ */
+EAPI Eina_Bool ewk_view_setting_tiled_backing_store_enabled_get(Evas_Object *o);
+
+/**
  * Gets the context menu object.
  * @param o The view that contains context menu.
  *
diff --git a/Source/WebKit/efl/ewk/ewk_view_private.h b/Source/WebKit/efl/ewk/ewk_view_private.h
index babd1eaa4..5dc4c0bbf 100644
--- a/Source/WebKit/efl/ewk/ewk_view_private.h
+++ b/Source/WebKit/efl/ewk/ewk_view_private.h
@@ -134,6 +134,10 @@ Eina_Bool ewk_view_paint_contents(Ewk_View_Private_Data* priv, Ewk_Paint_Context
 void ewk_view_js_window_object_clear(Evas_Object* ewkView, Evas_Object* frame);
 #endif
 
+#if USE(TILED_BACKING_STORE)
+void ewk_view_tiled_backing_store_invalidate(Evas_Object* ewkView, const WebCore::IntRect& area);
+#endif
+
 #if ENABLE(TOUCH_EVENTS)
 void ewk_view_need_touch_events_set(Evas_Object*, bool needed);
 bool ewk_view_need_touch_events_get(const Evas_Object*);
diff --git a/Source/WebKit/efl/ewk/ewk_view_single.cpp b/Source/WebKit/efl/ewk/ewk_view_single.cpp
index de0eb897c..c1fc6cd02 100644
--- a/Source/WebKit/efl/ewk/ewk_view_single.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view_single.cpp
@@ -21,7 +21,8 @@
 #include "config.h"
 #include "ewk_view.h"
 
-#include "ewk_frame.h"
+#include "TiledBackingStore.h"
+#include "ewk_frame_private.h"
 #include "ewk_private.h"
 #include "ewk_view_private.h"
 
@@ -262,6 +263,12 @@ static Eina_Bool _ewk_view_single_smart_repaints_process(Ewk_View_Smart_Data* sm
         return false;
     }
 
+#if USE(TILED_BACKING_STORE)
+    WebCore::Frame* mainFrame = EWKPrivate::coreFrame(smartData->main_frame);
+    if (mainFrame && mainFrame->tiledBackingStore())
+        mainFrame->tiledBackingStore()->coverWithTilesIfNeeded();
+#endif
+
     Ewk_Paint_Context* context = ewk_paint_context_from_image_new(smartData->backing_store);
     ewk_paint_context_save(context);
 
diff --git a/Source/WebKit/efl/tests/test_ewk_view.cpp b/Source/WebKit/efl/tests/test_ewk_view.cpp
index 241580182..a3d73af42 100644
--- a/Source/WebKit/efl/tests/test_ewk_view.cpp
+++ b/Source/WebKit/efl/tests/test_ewk_view.cpp
@@ -72,6 +72,29 @@ TEST_F(EWKTestBase, ewk_view_setting_enable_fullscreen)
 }
 
 /**
+* @brief Checking whether function properly get/set fullscreen setting value.
+*/
+TEST_F(EWKTestBase, ewk_view_setting_tiled_backing_store)
+{
+    loadUrl();
+    ASSERT_FALSE(ewk_view_setting_tiled_backing_store_enabled_get(webView()));
+
+#if USE(TILED_BACKING_STORE)
+    ASSERT_TRUE(ewk_view_setting_tiled_backing_store_enabled_set(webView(), true));
+    ASSERT_TRUE(ewk_view_setting_tiled_backing_store_enabled_get(webView()));
+
+    ASSERT_TRUE(ewk_view_setting_tiled_backing_store_enabled_set(webView(), false));
+    ASSERT_FALSE(ewk_view_setting_tiled_backing_store_enabled_get(webView()));
+#else
+    ASSERT_FALSE(ewk_view_setting_tiled_backing_store_enabled_set(webView(), true));
+    ASSERT_FALSE(ewk_view_setting_tiled_backing_store_enabled_get(webView()));
+
+    ASSERT_FALSE(ewk_view_setting_tiled_backing_store_enabled_set(webView(), false));
+    ASSERT_FALSE(ewk_view_setting_tiled_backing_store_enabled_get(webView()));
+#endif
+}
+
+/**
  * @brief Checking whether function returns proper context menu structure.
  *
  * This test creates a context menu and checks if context menu structure
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index ec1d0efc1..23dbf3d49 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,98 @@
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Disambiguate innerNodeFramePoint and mainFramePoint
+        https://bugs.webkit.org/show_bug.cgi?id=98139
+
+        Reviewed by Julien Chaffraix.
+
+        Switched to using point in innerNodeFrame. While the use here seems wrong it has been
+        left functionally unchanged to be fixed by a later patch.
+
+        * webkit/webkithittestresult.cpp:
+        (WebKit::kit):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_load_uri):
+        (webkit_web_frame_load_data):
+        (webkit_web_frame_load_request):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_load_uri):
+        (webkit_web_frame_load_data):
+        (webkit_web_frame_load_request):
+
+2012-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Update NEWS and configure.ac for 1.11.2 release
+
+        * NEWS: Added release notes for 1.11.2.
+
+2012-11-16  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Move CredentialBackingStore usage from GtkAuthenticationDialog to ResourceHandleSoup
+        https://bugs.webkit.org/show_bug.cgi?id=101840
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Enable the CredentialStore by default for the WebKit1 GTK+ port. Before this value
+        didn't have an bearing on whether or not the persistent credential storage was used.
+        Now is does.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::shouldUseCredentialStorage): Enable credential storage by default.
+
+2012-11-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Split WebCore/platform into a separate library
+        https://bugs.webkit.org/show_bug.cgi?id=94435
+
+        Reviewed by Martin Robinson.
+
+        More people have been reporting problems when linking WebCore because
+        the command line limit is being exceeded. Splitting WebCore a bit more
+        is in order.
+
+        * GNUmakefile.am: link libWebCorePlatform into libwebkitgtk
+
+2012-11-15  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed build fix attempt after r134765.
+
+        * webkit/webkitviewportattributes.cpp:
+        (webkitViewportAttributesRecompute):
+
+2012-11-12  Josh Rickmar  <jrick@devio.us>
+
+        Add WebCore::Setting to block displaying and/or running insecure content on secure pages
+        https://bugs.webkit.org/show_bug.cgi?id=58378
+
+        Reviewed by Martin Robinson.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
 2012-11-05  Simon Fraser  <simon.fraser@apple.com>
 
         Fix layer borders to cleaning appear and disappear on switching
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 8997703cf..866bba2e4 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -79,6 +79,7 @@ libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LDFL
 libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIBADD = \
 	-lpthread \
 	libWebCore.la \
+	libWebCorePlatform.la \
 	libWebCoreModules.la \
 	libWebCoreGtk.la \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
diff --git a/Source/WebKit/gtk/NEWS b/Source/WebKit/gtk/NEWS
index 74e1dd22e..a31387fdd 100644
--- a/Source/WebKit/gtk/NEWS
+++ b/Source/WebKit/gtk/NEWS
@@ -1,4 +1,18 @@
 =================
+WebKitGTK+ 1.11.2
+=================
+
+What's new in WebKitGTK+ 1.11.2?
+
+  - Implement inspector server on Linux for remote debugging.
+  - Add support for password remembering to HTTP authentication
+    dialog in WebKit2 using libsecret.
+  - Add API to get favicons to WebKit2 GTK+ API.
+  - Add API to get the WebKitWebView associated to a WebKitDownload to
+    WebKit2 GTK+.
+  - Add GObject introspection support to WebKit2 GTK+ API.
+
+=================
 WebKitGTK+ 1.11.1
 =================
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index f3ccfc17f..6dc536315 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -192,11 +192,9 @@ void FrameLoaderClient::committedLoad(WebCore::DocumentLoader* loader, const cha
     }
 }
 
-bool
-FrameLoaderClient::shouldUseCredentialStorage(WebCore::DocumentLoader*, unsigned long  identifier)
+bool FrameLoaderClient::shouldUseCredentialStorage(WebCore::DocumentLoader*, unsigned long  identifier)
 {
-    notImplemented();
-    return false;
+    return true;
 }
 
 void FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge& challenge)
diff --git a/Source/WebKit/gtk/webkit/webkithittestresult.cpp b/Source/WebKit/gtk/webkit/webkithittestresult.cpp
index 1a9434af0..c4081a764 100644
--- a/Source/WebKit/gtk/webkit/webkithittestresult.cpp
+++ b/Source/WebKit/gtk/webkit/webkithittestresult.cpp
@@ -315,12 +315,15 @@ WebKitHitTestResult* kit(const WebCore::HitTestResult& result)
     if (result.innerNonSharedNode())
         node = kit(result.innerNonSharedNode());
 
+    // FIXME: This should probably use innerNodeFrame, as targetFrame is the potentially different frame the link opens in.
     targetFrame = result.targetFrame();
     if (targetFrame && targetFrame->view()) {
         // Convert document coords to widget coords.
-        point = targetFrame->view()->contentsToWindow(result.roundedPoint());
-    } else
-        point = result.roundedPoint();
+        point = targetFrame->view()->contentsToWindow(result.roundedPointInInnerNodeFrame());
+    } else {
+        // FIXME: This should probably use roundedPointInMainFrame and translate from the mainframe.
+        point = result.roundedPointInInnerNodeFrame();
+    }
 
     return WEBKIT_HIT_TEST_RESULT(g_object_new(WEBKIT_TYPE_HIT_TEST_RESULT,
                                                "link-uri", linkURI.get(),
diff --git a/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp b/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
index d1a837869..80c4cb686 100644
--- a/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
+++ b/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
@@ -545,7 +545,7 @@ void webkitViewportAttributesRecompute(WebKitViewportAttributes* viewportAttribu
     priv->minimumScaleFactor = attributes.minimumScale;
     priv->maximumScaleFactor = attributes.maximumScale;
     priv->devicePixelRatio = devicePixelRatio;
-    priv->userScalable = static_cast<bool>(arguments.userScalable);
+    priv->userScalable = static_cast<bool>(arguments.userZoom);
 
     if (!priv->isValid) {
         priv->isValid = TRUE;
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
index dd801756f..ff51ebcd2 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -120,7 +120,9 @@ enum {
     PROP_ENABLE_SMOOTH_SCROLLING,
     PROP_MEDIA_PLAYBACK_REQUIRES_USER_GESTURE,
     PROP_MEDIA_PLAYBACK_ALLOWS_INLINE,
-    PROP_ENABLE_CSS_SHADERS
+    PROP_ENABLE_CSS_SHADERS,
+    PROP_ENABLE_RUNNING_OF_INSECURE_CONTENT,
+    PROP_ENABLE_DISPLAY_OF_INSECURE_CONTENT
 };
 
 static void webkit_web_settings_finalize(GObject* object);
@@ -981,6 +983,37 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          FALSE,
                                                          flags));
 
+    /**
+    * WebKitWebSettings:enable-display-of-insecure-content
+    *
+    * Whether pages loaded via HTTPS should load subresources such as
+    * images and frames from non-HTTPS URLs. 
+    *
+    * Since: 2.0
+    */
+    g_object_class_install_property(gobject_class,
+        PROP_ENABLE_DISPLAY_OF_INSECURE_CONTENT,
+        g_param_spec_boolean("enable-display-of-insecure-content",
+            _("Enable display of insecure content"),
+            _("Whether non-HTTPS resources can display on HTTPS pages."),
+            TRUE,
+            flags));
+
+    /**
+    * WebKitWebSettings:enable-running-of-insecure-content
+    *
+    * Whether pages loaded via HTTPS should run subresources such as
+    * CSS, scripts, and plugins from non-HTTPS URLs. 
+    *
+    * Since: 2.0
+    */
+    g_object_class_install_property(gobject_class,
+        PROP_ENABLE_RUNNING_OF_INSECURE_CONTENT,
+        g_param_spec_boolean("enable-running-of-insecure-content",
+            _("Enable running of insecure content"),
+            _("Whether non-HTTPS resources can run on HTTPS pages."),
+            TRUE,
+            flags));
 }
 
 static void webkit_web_settings_init(WebKitWebSettings* web_settings)
@@ -1171,6 +1204,12 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_MEDIA_PLAYBACK_ALLOWS_INLINE:
         priv->mediaPlaybackAllowsInline = g_value_get_boolean(value);
         break;
+    case PROP_ENABLE_DISPLAY_OF_INSECURE_CONTENT:
+        priv->enableDisplayOfInsecureContent = g_value_get_boolean(value);
+        break;
+    case PROP_ENABLE_RUNNING_OF_INSECURE_CONTENT:
+        priv->enableRunningOfInsecureContent = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1351,6 +1390,12 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
     case PROP_MEDIA_PLAYBACK_ALLOWS_INLINE:
         g_value_set_boolean(value, priv->mediaPlaybackAllowsInline);
         break;
+    case PROP_ENABLE_DISPLAY_OF_INSECURE_CONTENT:
+        g_value_set_boolean(value, priv->enableDisplayOfInsecureContent);
+        break;
+    case PROP_ENABLE_RUNNING_OF_INSECURE_CONTENT:
+        g_value_set_boolean(value, priv->enableRunningOfInsecureContent);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h b/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h
index 80c84af19..387cb0527 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h
@@ -85,6 +85,8 @@ struct _WebKitWebSettingsPrivate {
     gboolean enableCSSShaders;
     gboolean mediaPlaybackRequiresUserGesture;
     gboolean mediaPlaybackAllowsInline;
+    gboolean enableDisplayOfInsecureContent;
+    gboolean enableRunningOfInsecureContent;
 };
 
 WEBKIT_API void webkit_web_settings_add_extra_plugin_directory(WebKitWebView*, const gchar* directory);
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index 5ac04842d..cb203ac29 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -3401,6 +3401,8 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     coreSettings->setDNSPrefetchingEnabled(settingsPrivate->enableDNSPrefetching);
     coreSettings->setMediaPlaybackRequiresUserGesture(settingsPrivate->mediaPlaybackRequiresUserGesture);
     coreSettings->setMediaPlaybackAllowsInline(settingsPrivate->mediaPlaybackAllowsInline);
+    coreSettings->setAllowDisplayOfInsecureContent(settingsPrivate->enableDisplayOfInsecureContent);
+    coreSettings->setAllowRunningOfInsecureContent(settingsPrivate->enableRunningOfInsecureContent);
 
 #if ENABLE(SQL_DATABASE)
     AbstractDatabase::setIsAvailable(settingsPrivate->enableHTML5Database);
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index f005f8586..86f91b300 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,164 @@
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Disambiguate innerNodeFramePoint and mainFramePoint
+        https://bugs.webkit.org/show_bug.cgi?id=98139
+
+        Reviewed by Julien Chaffraix.
+
+        Switch to using HitTestResult::innerNodeFrame and HitTestResult::innerNodeFramePoint.
+
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::showContextMenu):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * Plugins/WebPluginController.mm:
+        * WebView/WebFrame.mm:
+        (-[WebFrame loadRequest:]):
+        (-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Plugins/WebPluginController.mm:
+        * WebView/WebFrame.mm:
+        (-[WebFrame loadRequest:]):
+        (-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):
+
+2012-11-19  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add PROXIMITY_EVENTS feature
+        https://bugs.webkit.org/show_bug.cgi?id=102658
+
+        Reviewed by Kentaro Hara.
+
+        Add PROXIMITY_EVENTS feature to xcode project for WebKit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-16  Tony Chang  <tony@chromium.org>
+
+        Remove ENABLE_CSS_HIERARCHIES since it's no longer in use
+        https://bugs.webkit.org/show_bug.cgi?id=102554
+
+        Reviewed by Andreas Kling.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=79939#c41 ,
+        we're going to revist this feature once additional vendor support is
+        achieved.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Private Browsing is a per-page setting that sets a global value
+        https://bugs.webkit.org/show_bug.cgi?id=67870
+
+        Reviewed by Sam Weinig.
+
+        * WebCoreSupport/WebFrameNetworkingContext.h:
+        * WebCoreSupport/WebFrameNetworkingContext.mm:
+        Moved functions for managing global sessions from WebCore.
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::defaultCookieStorage): Added. Uses WebFrameNetworkingContext
+        to reach the storage.
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences _switchNetworkLoaderToNewTestingSession]): Ditto.
+        (+[WebPreferences _setCurrentNetworkLoaderSessionCookieAcceptPolicy:]): Ditto.
+
+        * WebView/WebPreferencesPrivate.h: Added a comment explaining that two functions
+        are not generic enough for use outside DRT (one of them had "testing" in name,
+        but another did not).
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChanged:]): Create a global private browsing session when
+        the first view with private browsing is created, delete it when any window with
+        it disabled is created (since this comes from preferences, it applies to all
+        views equally, even though we are dealing with a single one here).
+        (-[WebView _cachedResponseForURL:]): Use main frame's networking context instead of
+        a global one.
+
+2012-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Adjust the Web Inspector window title frame if needed to prevent it from intersecting the dock button.
+
+        https://bugs.webkit.org/show_bug.cgi?id=102073
+
+        Reviewed by Joseph Pecoraro.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindow _customTitleFrame]): Added. Adjust the title frame.
+
+2012-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix after r134346 and 134347.
+        
+        Use frameView.isFlipped, not frameView.flipped in the assertion.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController window]):
+
+2012-11-12  Timothy Hatcher  <timothy@apple.com>
+
+        Add a dock button to the top right corner of the Web Inspector window (similar to the full screen button).
+
+        https://bugs.webkit.org/show_bug.cgi?id=102025
+
+        Reviewed by Joseph Pecoraro.
+
+        * Resources/Dock.pdf: Added.
+        * WebCoreSupport/WebInspectorClient.h:
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindow _cursorForResizeDirection:]): Added.
+        (WebInspectorClient::didResizeMainFrame): Call attachAvailabilityChanged instead.
+        (WebInspectorFrontendClient::attachAvailabilityChanged): Added.
+        (-[WebInspectorWindowController window]): Create the dock button and add it.
+        (-[WebInspectorWindowController attachWindow:]): Added.
+        (-[WebInspectorWindowController attach]): Call setAttachedWindow.
+        (-[WebInspectorWindowController detach]): Ditto.
+        (-[WebInspectorWindowController setDockingUnavailable:]): Added. Update hidden state of the dock button.
+
+2012-11-08  Timothy Hatcher  <timothy@apple.com>
+
+        Always use a textured window for the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=101693
+
+        Reviewed by Joseph Pecoraro.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController window]): Removed the conditional for a textured window.
+
+2012-11-08  Roger Fong  <roger_fong@apple.com>
+
+        Null check URL key entries into WebHistory hash table. 
+        https://bugs.webkit.org/show_bug.cgi?id=101664
+        <rdar://problem/12440852>
+
+        Reviewed by Brady Eidson.
+        
+        Sometimes the _entriesByURL hash table used to keep track of web history is erroneously passed in null key entries, which causes an exception to fire.
+        This prevents the desired page navigation from taking effect. This is a workaround for the problem.
+        Ideally we would figure out where the null values for the key are coming from but for now we'll just set it to "" to prevent the exception from being thrown
+        so that navigation can continue as expected.
+
+        * History/WebHistory.mm:
+        (-[WebHistoryPrivate visitedURL:withTitle:increaseVisitCount:]):
+
 2012-11-07  Andreas Kling  <akling@apple.com>
 
         Remove build-webkit dependency on Java SDK for Apple Mac WebKit.
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index a4f8ca0c0..0e1b15340 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -42,7 +42,6 @@ ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
 ENABLE_CSS_DEVICE_ADAPTATION = ;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
-ENABLE_CSS_HIERARCHIES = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
@@ -129,6 +128,7 @@ ENABLE_PDFKIT_PLUGIN_macosx_1070 = ;
 ENABLE_PDFKIT_PLUGIN_macosx_1080 = ;
 ENABLE_PDFKIT_PLUGIN_macosx_1090 = ENABLE_PDFKIT_PLUGIN;
 ENABLE_PROGRESS_ELEMENT = ENABLE_PROGRESS_ELEMENT;
+ENABLE_PROXIMITY_EVENTS = ;
 ENABLE_QUOTA = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
 ENABLE_RESOLUTION_MEDIA_QUERY = ;
@@ -157,4 +157,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XHR_TIMEOUT = ENABLE_XHR_TIMEOUT;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SUBPIXEL_LAYOUT) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XHR_TIMEOUT) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_PROXIMITY_EVENTS) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SUBPIXEL_LAYOUT) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XHR_TIMEOUT) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index 2eb267a03..dd8b134f6 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 19;
+MINOR_VERSION = 20;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/History/WebHistory.mm b/Source/WebKit/mac/History/WebHistory.mm
index e781d32fd..591cc04b0 100644
--- a/Source/WebKit/mac/History/WebHistory.mm
+++ b/Source/WebKit/mac/History/WebHistory.mm
@@ -296,6 +296,8 @@ static inline WebHistoryDateKey dateKey(NSTimeInterval date)
     ASSERT(title);
     
     NSString *URLString = [url _web_originalDataAsString];
+    if (!URLString)
+        URLString = @"";
     WebHistoryItem *entry = [_entriesByURL objectForKey:URLString];
 
     if (entry) {
diff --git a/Source/WebKit/mac/Resources/Dock.pdf b/Source/WebKit/mac/Resources/Dock.pdf
new file mode 100644
index 000000000..11ff0e0e2
--- /dev/null
+++ b/Source/WebKit/mac/Resources/Dock.pdf
diff --git a/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm b/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm
index e31313603..1d5191b54 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm
@@ -356,17 +356,14 @@ void WebContextMenuClient::showContextMenu()
     if (!page)
         return;
     ContextMenuController* controller = page->contextMenuController();
-    Node* node = controller->hitTestResult().innerNonSharedNode();
-    if (!node)
-        return;
-    Frame* frame = node->document()->frame();
+    Frame* frame = controller->hitTestResult().innerNodeFrame();
     if (!frame)
         return;
     FrameView* frameView = frame->view();
     if (!frameView)
         return;
 
-    IntPoint point = frameView->contentsToWindow(controller->hitTestResult().roundedPoint());
+    IntPoint point = frameView->contentsToWindow(controller->hitTestResult().roundedPointInInnerNodeFrame());
     NSView* view = frameView->documentView();
     NSPoint nsScreenPoint = [view convertPoint:point toView:nil];
     // Show the contextual menu for this event.
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.h b/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.h
index 4b30af94f..f6b7313a5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.h
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2012 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +27,14 @@ public:
         return adoptRef(new WebFrameNetworkingContext(frame));
     }
 
+    static void setPrivateBrowsingStorageSessionIdentifierBase(const String&);
+    static void switchToNewTestingSession();
+    static void ensurePrivateBrowsingSession();
+    static void destroyPrivateBrowsingSession();
+    static CFURLStorageSessionRef defaultStorageSession();
+
+    static void setCookieAcceptPolicyForTestingContext(NSHTTPCookieAcceptPolicy);
+
 private:
     WebFrameNetworkingContext(WebCore::Frame* frame)
         : WebCore::FrameNetworkingContext(frame)
@@ -34,6 +43,7 @@ private:
 
     virtual bool needsSiteSpecificQuirks() const OVERRIDE;
     virtual bool localFileContentSniffingEnabled() const OVERRIDE;
+    virtual CFURLStorageSessionRef storageSession() const OVERRIDE;
     virtual WebCore::SchedulePairHashSet* scheduledRunLoopPairs() const OVERRIDE;
     virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&) const OVERRIDE;
 };
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.mm b/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.mm
index 5a5c63ed5..e5881d60d 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameNetworkingContext.mm
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2012 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,9 +24,13 @@
 #import <WebCore/Page.h>
 #import <WebCore/ResourceError.h>
 #import <WebCore/Settings.h>
+#import <WebKitSystemInterface.h>
 
 using namespace WebCore;
 
+static CFURLStorageSessionRef defaultCFStorageSession;
+static CFURLStorageSessionRef privateBrowsingStorageSession;
+
 bool WebFrameNetworkingContext::needsSiteSpecificQuirks() const
 {
     return frame() && frame()->settings() && frame()->settings()->needsSiteSpecificQuirks();
@@ -45,3 +50,66 @@ ResourceError WebFrameNetworkingContext::blockedError(const ResourceRequest& req
 {
     return frame()->loader()->client()->blockedError(request);
 }
+
+static String& privateBrowsingStorageSessionIdentifierBase()
+{
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(String, base, ());
+    return base;
+}
+
+void WebFrameNetworkingContext::setPrivateBrowsingStorageSessionIdentifierBase(const String& identifier)
+{
+    privateBrowsingStorageSessionIdentifierBase() = identifier;
+}
+
+void WebFrameNetworkingContext::switchToNewTestingSession()
+{
+    // Set a private session for testing to avoid interfering with global cookies. This should be different from private browsing session.
+    if (defaultCFStorageSession)
+        CFRelease(defaultCFStorageSession);
+    defaultCFStorageSession = WKCreatePrivateStorageSession(CFSTR("Private WebKit Session"));
+}
+
+void WebFrameNetworkingContext::ensurePrivateBrowsingSession()
+{
+    ASSERT(isMainThread());
+    if (privateBrowsingStorageSession)
+        return;
+
+    String base = privateBrowsingStorageSessionIdentifierBase().isNull() ? String([[NSBundle mainBundle] bundleIdentifier]) : privateBrowsingStorageSessionIdentifierBase();
+    RetainPtr<CFStringRef> cfIdentifier = String(base + ".PrivateBrowsing").createCFString();
+
+    privateBrowsingStorageSession = WKCreatePrivateStorageSession(cfIdentifier.get());
+}
+
+void WebFrameNetworkingContext::destroyPrivateBrowsingSession()
+{
+    if (!privateBrowsingStorageSession)
+        return;
+
+    CFRelease(privateBrowsingStorageSession);
+    privateBrowsingStorageSession = 0;
+}
+
+CFURLStorageSessionRef WebFrameNetworkingContext::defaultStorageSession()
+{
+    return defaultCFStorageSession;
+}
+
+CFURLStorageSessionRef WebFrameNetworkingContext::storageSession() const
+{
+    bool privateBrowsingEnabled = frame() && frame()->settings() && frame()->settings()->privateBrowsingEnabled();
+    if (privateBrowsingEnabled) {
+        ASSERT(privateBrowsingStorageSession);
+        return privateBrowsingStorageSession;
+    }
+    return defaultCFStorageSession;
+}
+
+void WebFrameNetworkingContext::setCookieAcceptPolicyForTestingContext(NSHTTPCookieAcceptPolicy policy)
+{
+    ASSERT(defaultCFStorageSession);
+    RetainPtr<CFHTTPCookieStorageRef> defaultCookieStorage = adoptCF(WKCopyHTTPCookieStorage(defaultCFStorageSession));
+    WKSetHTTPCookieAcceptPolicy(defaultCookieStorage.get(), policy);
+}
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
index 80693343d..cb2f917fe 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
@@ -90,6 +90,8 @@ class WebInspectorFrontendClient : public WebCore::InspectorFrontendClientLocal
 public:
     WebInspectorFrontendClient(WebView*, WebInspectorWindowController*, WebCore::InspectorController*, WebCore::Page*, PassOwnPtr<Settings>);
 
+    void attachAvailabilityChanged(bool);
+
     virtual void frontendLoaded();
 
     virtual String localizedStringsURL();
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index f432cd51f..5334f32c2 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -49,11 +49,49 @@
 
 SOFT_LINK_STAGED_FRAMEWORK_OPTIONAL(WebInspector, PrivateFrameworks, A)
 
+// The margin from the top and right of the dock button (same as the full screen button).
+static const CGFloat dockButtonMargin = 3;
+
 using namespace WebCore;
 
+@interface NSWindow (AppKitDetails)
+- (NSCursor *)_cursorForResizeDirection:(NSInteger)direction;
+- (NSRect)_customTitleFrame;
+@end
+
+@interface WebInspectorWindow : NSWindow {
+@public
+    RetainPtr<NSButton> _dockButton;
+}
+@end
+
+@implementation WebInspectorWindow
+
+- (NSCursor *)_cursorForResizeDirection:(NSInteger)direction
+{
+    // Don't show a resize cursor for the northeast (top right) direction if the dock button is visible.
+    // This matches what happens when the full screen button is visible.
+    if (direction == 1 && ![_dockButton isHidden])
+        return nil;
+    return [super _cursorForResizeDirection:direction];
+}
+
+- (NSRect)_customTitleFrame
+{
+    // Adjust the title frame if needed to prevent it from intersecting the dock button.
+    NSRect titleFrame = [super _customTitleFrame];
+    NSRect dockButtonFrame = _dockButton.get().frame;
+    if (NSMaxX(titleFrame) > NSMinX(dockButtonFrame) - dockButtonMargin)
+        titleFrame.size.width -= (NSMaxX(titleFrame) - NSMinX(dockButtonFrame)) + dockButtonMargin;
+    return titleFrame;
+}
+
+@end
+
 @interface WebInspectorWindowController : NSWindowController <NSWindowDelegate> {
 @private
     RetainPtr<WebView> _inspectedWebView;
+    RetainPtr<NSButton> _dockButton;
     WebView *_webView;
     WebInspectorFrontendClient* _frontendClient;
     WebInspectorClient* _inspectorClient;
@@ -72,6 +110,7 @@ using namespace WebCore;
 - (void)setInspectorClient:(WebInspectorClient*)inspectorClient;
 - (WebInspectorClient*)inspectorClient;
 - (void)setAttachedWindowHeight:(unsigned)height;
+- (void)setDockingUnavailable:(BOOL)unavailable;
 - (void)destroyInspectorView:(bool)notifyInspectorController;
 @end
 
@@ -120,7 +159,7 @@ void WebInspectorClient::bringFrontendToFront()
 void WebInspectorClient::didResizeMainFrame(Frame*)
 {
     if (m_frontendClient)
-        m_frontendClient->setDockingUnavailable(!m_frontendClient->canAttachWindow());
+        m_frontendClient->attachAvailabilityChanged(m_frontendClient->canAttachWindow());
 }
 
 void WebInspectorClient::highlight()
@@ -147,6 +186,12 @@ WebInspectorFrontendClient::WebInspectorFrontendClient(WebView* inspectedWebView
     [windowController setFrontendClient:this];
 }
 
+void WebInspectorFrontendClient::attachAvailabilityChanged(bool available)
+{
+    setDockingUnavailable(!available);
+    [m_windowController.get() setDockingUnavailable:!available];
+}
+
 void WebInspectorFrontendClient::frontendLoaded()
 {
     [m_windowController.get() showWindow:nil];
@@ -332,26 +377,56 @@ void WebInspectorFrontendClient::updateWindowTitle() const
 
 - (NSWindow *)window
 {
-    NSWindow *window = [super window];
+    WebInspectorWindow *window = (WebInspectorWindow *)[super window];
     if (window)
         return window;
 
-    bool useTexturedWindow = useWebKitWebInspector();
+    NSUInteger styleMask = (NSTitledWindowMask | NSClosableWindowMask | NSMiniaturizableWindowMask | NSResizableWindowMask | NSTexturedBackgroundWindowMask);
+    window = [[WebInspectorWindow alloc] initWithContentRect:NSMakeRect(60.0, 200.0, 750.0, 650.0) styleMask:styleMask backing:NSBackingStoreBuffered defer:NO];
+    [window setDelegate:self];
+    [window setMinSize:NSMakeSize(400.0, 400.0)];
+    [window setAutorecalculatesContentBorderThickness:NO forEdge:NSMaxYEdge];
+    [window setContentBorderThickness:55. forEdge:NSMaxYEdge];
+    WKNSWindowMakeBottomCornersSquare(window);
 
-    NSUInteger styleMask = (NSTitledWindowMask | NSClosableWindowMask | NSMiniaturizableWindowMask | NSResizableWindowMask);
+    // Create a full screen button so we can turn it into a dock button.
+    _dockButton = [NSWindow standardWindowButton:NSWindowFullScreenButton forStyleMask:styleMask];
+    _dockButton.get().target = self;
+    _dockButton.get().action = @selector(attachWindow:);
 
-    if (useTexturedWindow)
-        styleMask |= NSTexturedBackgroundWindowMask;
+    // Store the dock button on the window too so it can check its visibility.
+    window->_dockButton = _dockButton;
 
-    window = [[NSWindow alloc] initWithContentRect:NSMakeRect(60.0, 200.0, 750.0, 650.0) styleMask:styleMask backing:NSBackingStoreBuffered defer:NO];
-    [window setDelegate:self];
-    [window setMinSize:NSMakeSize(400.0, 400.0)];
+    // Get the dock image and make it a template so the button cell effects will apply.
+    NSImage *dockImage = [[NSBundle bundleForClass:[self class]] imageForResource:@"Dock"];
+    [dockImage setTemplate:YES];
 
-    if (useTexturedWindow) {
-        [window setAutorecalculatesContentBorderThickness:NO forEdge:NSMaxYEdge];
-        [window setContentBorderThickness:55. forEdge:NSMaxYEdge];
-        WKNSWindowMakeBottomCornersSquare(window);
-    }
+    // Set the dock image on the button cell.
+    NSCell *dockButtonCell = _dockButton.get().cell;
+    dockButtonCell.image = dockImage;
+
+    // Get the frame view, the superview of the content view, and its frame.
+    // This will be the superview of the dock button too.
+    NSView *contentView = window.contentView;
+    NSView *frameView = contentView.superview;
+    NSRect frameViewBounds = frameView.bounds;
+    NSSize dockButtonSize = _dockButton.get().frame.size;
+
+    ASSERT(!frameView.isFlipped);
+
+    // Position the dock button in the corner to match where the full screen button is normally.
+    NSPoint dockButtonOrigin;
+    dockButtonOrigin.x = NSMaxX(frameViewBounds) - dockButtonSize.width - dockButtonMargin;
+    dockButtonOrigin.y = NSMaxY(frameViewBounds) - dockButtonSize.height - dockButtonMargin;
+    _dockButton.get().frameOrigin = dockButtonOrigin;
+
+    // Set the autoresizing mask to keep the dock button pinned to the top right corner.
+    _dockButton.get().autoresizingMask = NSViewMinXMargin | NSViewMinYMargin;
+
+    [frameView addSubview:_dockButton.get()];
+
+    // Hide the dock button if we can't attach.
+    _dockButton.get().hidden = !_frontendClient->canAttachWindow();
 
     [self setWindow:window];
     [window release];
@@ -397,6 +472,11 @@ void WebInspectorFrontendClient::updateWindowTitle() const
         [super close];
 }
 
+- (IBAction)attachWindow:(id)sender
+{
+    _frontendClient->attachWindow();
+}
+
 - (IBAction)showWindow:(id)sender
 {
     if (_visible) {
@@ -444,6 +524,7 @@ void WebInspectorFrontendClient::updateWindowTitle() const
         return;
 
     _inspectorClient->setInspectorStartsAttached(true);
+    _frontendClient->setAttachedWindow(true);
 
     [self close];
     [self showWindow:nil];
@@ -455,6 +536,7 @@ void WebInspectorFrontendClient::updateWindowTitle() const
         return;
 
     _inspectorClient->setInspectorStartsAttached(false);
+    _frontendClient->setAttachedWindow(false);
 
     [self close];
     [self showWindow:nil];
@@ -498,6 +580,11 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     [frameView setFrame:frameViewRect];
 }
 
+- (void)setDockingUnavailable:(BOOL)unavailable
+{
+    _dockButton.get().hidden = unavailable;
+}
+
 - (void)destroyInspectorView:(bool)notifyInspectorController
 {
     [[_inspectedWebView.get() inspector] releaseFrontend];
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
index 7bcf4256b..f9d8c7719 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
@@ -51,6 +51,7 @@ private:
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged() OVERRIDE;
+    virtual RetainPtr<CFHTTPCookieStorageRef> defaultCookieStorage() OVERRIDE;
 
     // WebCore::PluginStrategy
     virtual void refreshPlugins() OVERRIDE;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
index 79bdc45d7..c79b089b9 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
@@ -25,6 +25,7 @@
 
 #import "WebPlatformStrategies.h"
 
+#import "WebFrameNetworkingContext.h"
 #import "WebPluginDatabase.h"
 #import "WebPluginPackage.h"
 #import <WebCore/BlockExceptions.h>
@@ -32,6 +33,7 @@
 #import <WebCore/Page.h>
 #import <WebCore/PageGroup.h>
 #import <WebCore/PlatformPasteboard.h>
+#import <WebKitSystemInterface.h>
 
 using namespace WebCore;
 
@@ -79,6 +81,19 @@ void WebPlatformStrategies::notifyCookiesChanged()
 {
 }
 
+RetainPtr<CFHTTPCookieStorageRef> WebPlatformStrategies::defaultCookieStorage()
+{
+    if (CFURLStorageSessionRef session = WebFrameNetworkingContext::defaultStorageSession())
+        return adoptCF(WKCopyHTTPCookieStorage(session));
+
+#if USE(CFNETWORK)
+    return WKGetDefaultHTTPCookieStorage();
+#else
+    // When using NSURLConnection, we also use its shared cookie storage.
+    return 0;
+#endif
+}
+
 void WebPlatformStrategies::refreshPlugins()
 {
     [[WebPluginDatabase sharedDatabase] refresh];
diff --git a/Source/WebKit/mac/WebView/WebPreferences.mm b/Source/WebKit/mac/WebView/WebPreferences.mm
index 9fb305b6b..c1ef69943 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.mm
+++ b/Source/WebKit/mac/WebView/WebPreferences.mm
@@ -31,6 +31,7 @@
 #import "WebPreferenceKeysPrivate.h"
 
 #import "WebApplicationCache.h"
+#import "WebFrameNetworkingContext.h"
 #import "WebKitLogging.h"
 #import "WebKitNSStringExtras.h"
 #import "WebKitSystemBits.h"
@@ -1285,17 +1286,12 @@ static NSString *classIBCreatorID = nil;
 
 + (void)_switchNetworkLoaderToNewTestingSession
 {
-    // Set a private session for testing to avoid interfering with global cookies. This should be different from private browsing session.
-    RetainPtr<CFURLStorageSessionRef> session = ResourceHandle::createPrivateBrowsingStorageSession(CFSTR("WebKit Testing Session"));
-    ResourceHandle::setDefaultStorageSession(session.get());
+    WebFrameNetworkingContext::switchToNewTestingSession();
 }
 
 + (void)_setCurrentNetworkLoaderSessionCookieAcceptPolicy:(NSHTTPCookieAcceptPolicy)policy
 {
-    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
-
-    if (RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage())
-        WKSetHTTPCookieAcceptPolicy(cookieStorage.get(), policy);
+    WebFrameNetworkingContext::setCookieAcceptPolicyForTestingContext(policy);
 }
 
 - (BOOL)isDOMPasteAllowed
diff --git a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
index c2880ccda..a5e17ffb7 100644
--- a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -246,6 +246,8 @@ extern NSString *WebPreferencesCacheModelChangedInternalNotification;
 + (CFStringEncoding)_systemCFStringEncoding;
 + (void)_setInitialDefaultTextEncodingToSystemEncoding;
 + (void)_setIBCreatorID:(NSString *)string;
+
+// For DumpRenderTree use only.
 + (void)_switchNetworkLoaderToNewTestingSession;
 + (void)_setCurrentNetworkLoaderSessionCookieAcceptPolicy:(NSHTTPCookieAcceptPolicy)cookieAcceptPolicy;
 
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 3ff7275c1..fb444b4c1 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -61,6 +61,7 @@
 #import "WebEditorClient.h"
 #import "WebFormDelegatePrivate.h"
 #import "WebFrameInternal.h"
+#import "WebFrameNetworkingContext.h"
 #import "WebFrameViewInternal.h"
 #import "WebFullScreenController.h"
 #import "WebGeolocationClient.h"
@@ -1470,7 +1471,16 @@ static bool needsSelfRetainWhileLoadingQuirk()
 #endif
     settings->setLocalStorageEnabled([preferences localStorageEnabled]);
     settings->setExperimentalNotificationsEnabled([preferences experimentalNotificationsEnabled]);
-    settings->setPrivateBrowsingEnabled([preferences privateBrowsingEnabled]);
+
+    bool privateBrowsingEnabled = [preferences privateBrowsingEnabled];
+#if PLATFORM(MAC) || USE(CFNETWORK)
+    if (privateBrowsingEnabled)
+        WebFrameNetworkingContext::ensurePrivateBrowsingSession();
+    else
+        WebFrameNetworkingContext::destroyPrivateBrowsingSession();
+#endif
+    settings->setPrivateBrowsingEnabled(privateBrowsingEnabled);
+
     settings->setSansSerifFontFamily([preferences sansSerifFontFamily]);
     settings->setSerifFontFamily([preferences serifFontFamily]);
     settings->setStandardFontFamily([preferences standardFontFamily]);
@@ -1997,14 +2007,18 @@ static inline IMP getMethod(id o, SEL s)
 
 - (NSCachedURLResponse *)_cachedResponseForURL:(NSURL *)URL
 {
-    NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:URL];
+    RetainPtr<NSMutableURLRequest *> request = adoptNS([[NSMutableURLRequest alloc] initWithURL:URL]);
     [request _web_setHTTPUserAgent:[self userAgentForURL:URL]];
     NSCachedURLResponse *cachedResponse;
-    if (CFURLStorageSessionRef storageSession = ResourceHandle::currentStorageSession())
-        cachedResponse = WKCachedResponseForRequest(storageSession, request);
+
+    if (!_private->page)
+        return nil;
+
+    if (CFURLStorageSessionRef storageSession = _private->page->mainFrame()->loader()->networkingContext()->storageSession())
+        cachedResponse = WKCachedResponseForRequest(storageSession, request.get());
     else
-        cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
-    [request release];
+        cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request.get()];
+
     return cachedResponse;
 }
 
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.cpp b/Source/WebKit/qt/Api/qgraphicswebview.cpp
index 3e8abbad9..ef42c9518 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/Api/qgraphicswebview.cpp
@@ -373,9 +373,6 @@ QVariant QGraphicsWebView::inputMethodQuery(Qt::InputMethodQuery query) const
     QPainter::TextAntialiasing and QPainter::SmoothPixmapTransform are enabled by default and will be
     used to render the item in addition of what has been set on the painter given by QGraphicsScene.
 
-    \note This property is not available on Symbian. However, the getter and
-    setter functions can still be used directly.
-
     \sa QPainter::renderHints()
 */
 
diff --git a/Source/WebKit/qt/Api/qwebelement.cpp b/Source/WebKit/qt/Api/qwebelement.cpp
index 298f6cdc3..108b9b06f 100644
--- a/Source/WebKit/qt/Api/qwebelement.cpp
+++ b/Source/WebKit/qt/Api/qwebelement.cpp
@@ -807,7 +807,7 @@ QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy str
     if (!propID)
         return QString();
 
-    const StylePropertySet* style = static_cast<StyledElement*>(m_element)->ensureInlineStyle();
+    const StylePropertySet* style = static_cast<StyledElement*>(m_element)->ensureMutableInlineStyle();
 
     if (strategy == InlineStyle)
         return style->getPropertyValue(propID);
@@ -825,7 +825,7 @@ QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy str
         // declarations, as well as embedded and inline style declarations.
 
         Document* doc = m_element->document();
-        if (RefPtr<CSSRuleList> rules = doc->styleResolver()->styleRulesForElement(m_element, /*authorOnly*/ true)) {
+        if (RefPtr<CSSRuleList> rules = doc->styleResolver()->styleRulesForElement(m_element, StyleResolver::AuthorCSSRules | StyleResolver::CrossOriginCSSRules)) {
             for (int i = rules->length(); i > 0; --i) {
                 CSSStyleRule* rule = static_cast<CSSStyleRule*>(rules->item(i - 1));
 
@@ -869,8 +869,18 @@ void QWebElement::setStyleProperty(const QString &name, const QString &value)
     if (!m_element || !m_element->isStyledElement())
         return;
 
+    // Do the parsing of the token manually since WebCore isn't doing this for us anymore.
+    const QLatin1String importantToken("!important");
+    QString adjustedValue(value);
+    bool important = false;
+    if (adjustedValue.contains(importantToken)) {
+        important = true;
+        adjustedValue.remove(importantToken);
+        adjustedValue = adjustedValue.trimmed();
+    }
+
     CSSPropertyID propID = cssPropertyID(name);
-    static_cast<StyledElement*>(m_element)->setInlineStyleProperty(propID, value);
+    static_cast<StyledElement*>(m_element)->setInlineStyleProperty(propID, adjustedValue, important);
 }
 
 /*!
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index 0accd3362..1310348ed 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -1598,7 +1598,7 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
 {
     if (!hitTest.innerNode())
         return;
-    pos = hitTest.roundedPoint();
+    pos = hitTest.roundedPointInInnerNodeFrame();
     WebCore::TextDirection dir;
     title = hitTest.title(dir);
     linkText = hitTest.textContent();
@@ -1624,9 +1624,9 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     isContentSelected = hitTest.isSelected();
     isScrollBar = hitTest.scrollbar();
 
-    if (innerNonSharedNode && innerNonSharedNode->document()
-        && innerNonSharedNode->document()->frame())
-        frame = QWebFramePrivate::kit(innerNonSharedNode->document()->frame());
+    WebCore::Frame *innerNodeFrame = hitTest.innerNodeFrame();
+    if (innerNodeFrame)
+        frame = QWebFramePrivate::kit(innerNodeFrame);
 
     enclosingBlock = QWebElement(WebCore::enclosingBlock(innerNode.get()));
 }
@@ -1684,7 +1684,9 @@ bool QWebHitTestResult::isNull() const
 }
 
 /*!
-    Returns the position where the hit test occured.
+    Returns the position where the hit test occured in the coordinates of frame containing the element hit.
+
+    \sa frame()
 */
 QPoint QWebHitTestResult::pos() const
 {
@@ -1848,7 +1850,7 @@ QWebElement QWebHitTestResult::element() const
 }
 
 /*!
-    Returns the frame the hit test was executed in.
+    Returns the frame of the element hit.
 */
 QWebFrame *QWebHitTestResult::frame() const
 {
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index ade496fa4..02383ac67 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -1582,7 +1582,7 @@ IntPoint QWebPagePrivate::TouchAdjuster::findCandidatePointForTouch(const IntPoi
     FrameView* view = document->frame()->view();
 
     // Touch rect in contents coordinates.
-    IntRect touchRect(HitTestResult::rectForPoint(view->windowToContents(IntPoint(x, y)), m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding));
+    IntRect touchRect(HitTestLocation::rectForPoint(view->windowToContents(IntPoint(x, y)), m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding));
 
     // Iterate over the list of nodes hit looking for the one whose bounding area
     // has largest intersection with the touch area (point + padding).
diff --git a/Source/WebKit/qt/Api/qwebview.cpp b/Source/WebKit/qt/Api/qwebview.cpp
index 036c8ea2e..9f2af5787 100644
--- a/Source/WebKit/qt/Api/qwebview.cpp
+++ b/Source/WebKit/qt/Api/qwebview.cpp
@@ -620,9 +620,6 @@ qreal QWebView::textSizeMultiplier() const
 
     QPainter::TextAntialiasing and QPainter::SmoothPixmapTransform are enabled by default.
 
-    \note This property is not available on Symbian. However, the getter and
-    setter functions can still be used directly.
-
     \sa QPainter::renderHints()
 */
 
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 52fbc7231..f0791bfc0 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,319 @@
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Position in QWebHitTestResult does not match documentation
+        https://bugs.webkit.org/show_bug.cgi?id=102909
+
+        Reviewed by Simon Hausmann.
+
+        Correct documentation and simplify using the new innerNodeFrame method.
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Disambiguate innerNodeFramePoint and mainFramePoint
+        https://bugs.webkit.org/show_bug.cgi?id=98139
+
+        Reviewed by Julien Chaffraix.
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::TouchAdjuster::findCandidatePointForTouch):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::QWebFrame):
+        (QWebFrame::load):
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setAlternateHtml):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::QWebFrame):
+        (QWebFrame::load):
+        (QWebFrame::setHtml):
+        (QWebFrame::setContent):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setAlternateHtml):
+        (qt_dump_set_accepts_editing):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::callErrorPageExtension):
+
+2012-11-18  Laszlo Gombos  <l.gombos@samsung.com>
+
+        [Qt] Remove remaining traces of symbian
+        https://bugs.webkit.org/show_bug.cgi?id=102634
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove symbian related part from the API documentation.
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebview.cpp:
+
+2012-11-16  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceController base-class to remove duplication of DeviceXXXControler
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Reviewed by Hajime Morita.
+
+        Change client() to deviceOrientationClient() to get DeviceOrientationClient*.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+
+2012-11-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Fix tst_QWebFrame::setUrlWithPendingLoads() API test
+        https://bugs.webkit.org/show_bug.cgi?id=63237
+
+        Reviewed by Jocelyn Turcotte.
+
+        Uncomment this API test, because it works fine now.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (tst_QWebFrame):
+        (tst_QWebFrame::setUrlWithPendingLoads):
+
+2012-11-14  Andras Becsi  <andras.becsi@digia.com>
+
+        [Qt] QStyleFacadeImp should use a QPointer to store the application style
+        https://bugs.webkit.org/show_bug.cgi?id=102084
+
+        Reviewed by Simon Hausmann.
+
+        QStyleFacadeImp implicitly creates a default style during the first
+        call to QApplication::style() in QStyleFacadeImp::style() but this
+        style is deleted when a custom style is set, thus the stored m_style
+        raw pointer in QStyleFacadeImp becomes dangling.
+        Use a QPointer to cache the style instead of a raw pointer.
+
+        This fixes the start-up crash in the anomaly example.
+        (https://bugreports.qt-project.org/browse/QTBUG-27924)
+
+        * WebCoreSupport/QStyleFacadeImp.h:
+        (QStyleFacadeImp):
+
+2012-11-13  Andreas Kling  <kling@webkit.org>
+
+        Move inline style logic from ElementAttributeData to StyledElement.
+        <http://webkit.org/b/102120>
+
+        Reviewed by Antti Koivisto.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix tst_QWebPage::findText
+
+        Reviewed by Simon Hausmann.
+
+        Details of the failure:
+        FAIL!  : tst_QWebPage::findText() Compared values are not the same
+           Actual   (m_page->selectedHtml().trimmed().replace(regExp, "")): <span>foo</span>
+           Expected (subString): foo
+           Loc: [/home/joce/dev/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp(2964)]
+
+        The format returned by selectedHtml changed.
+        Make the test a bit more robust by just checking that the HTML
+        contains our search value.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::findText):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix tst_QWebPage::testLocalStorageVisibility
+
+        Reviewed by Simon Hausmann.
+
+        window.localStorage is expected to work for file URLs.
+        I'm not sure why it did work when this test was written,
+        but I believe that it had the wrong expected value.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2012-11-08  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix tst_QObjectBridge::callQtInvokable
+
+        Reviewed by Simon Hausmann.
+
+        Q_DECLARE_METATYPE now calls qRegisterMetaType so just prevent
+        the value from being wrapped by QVariant since this code shouldn't
+        be reached anyway.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (MyQObject::myInvokableWithBrushStyleArg):
+
+2012-11-08  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix tst_QWebPage::inputMethods
+
+        Reviewed by Simon Hausmann.
+
+        Details of the failure:
+        FAIL!  : tst_QWebPage::inputMethods(QWebView) Compared values are not the same
+           Actual (page->settings()->fontFamily(QWebSettings::SerifFont)): FooSerifFont
+           Expected (font.family()): Helvetica
+           Loc: [Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp(1691)]
+
+        The issue was that WebCore wouldn't find FooSerifFont and would have
+        RenderStyle::font() return the fallback font it used instead.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix tst_QWebPage::showModalDialog() API test
+        https://bugs.webkit.org/show_bug.cgi?id=63244
+
+        Reviewed by Simon Hausmann.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] tst_QWebElement::style() fails because QWebElement::InlineStyle now works as expected
+        https://bugs.webkit.org/show_bug.cgi?id=60372
+
+        Reviewed by Simon Hausmann.
+
+        Update the expected value to follow this comment in StylePropertySet::addParsedProperty:
+        "Only add properties that have no !important counterpart present"
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] tst_QWebElement::style() fails because QWebElement::CascadedStyle doesn't work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=65244
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        StyleResolver::styleRulesForElement now takes flags as parameter instead of a bool to specify
+        that we want to exclude UI and user style sheets.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Appending "!important" to the property value of QWebElement::setStyleProperty isn't working
+        https://bugs.webkit.org/show_bug.cgi?id=101763
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        In the pastWebCore have been considering the important token of a CSS
+        property value if it was followed by !important as well as the
+        important parameter of setInlineStyleProperty, but not anymore.
+
+        Since we need to keep the behavior compatible, do the parsing of the
+        value and extract the token if present. Ideally this would be passed
+        as a parameter to the function but I think it's not worth deprecating
+        the old mechanism.
+        The parsing is pretty dumb, so this will break applications that
+        passed a value with spaces between the "!" and "important".
+
+        This fixes part of tst_QWebElement::style
+
+        * Api/qwebelement.cpp:
+        (QWebElement::setStyleProperty):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix URL issues in tst_qwebframe
+        https://bugs.webkit.org/show_bug.cgi?id=101741
+
+        Reviewed by Simon Hausmann.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (FakeReply::FakeReply):
+        Properly forward the request URL to our custom reply.
+        This would cause redirections not to occur. The requestedUrl and setUrlSameUrl tests
+        would fail because of this.
+
+        (tst_QWebFrame::setUrlToInvalid):
+        - http:/example.com is a valid URL, but not a valid HTTP URL, so remove this check.
+        - QCOMPARE uses testlib's toString on the QUrls to compare them and it now
+        also output the error description. Since we want to compare the resulting
+        URL instead, compare their toEncoded() value.
+
+2012-11-08  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix a crash in tst_QWebInspector::attachAndDestroy
+        https://bugs.webkit.org/show_bug.cgi?id=101575
+
+        Reviewed by Simon Hausmann.
+
+        It can now happen that destroyInspectorView is called when the Page
+        is destroyed. This would call getOrCreateInspector and re-create a
+        QWebInspector.
+
+        Since the new instance is created after our setInspector(0) cleanup
+        in ~QWebPagePrivate, this runs into the same crash that this line was
+        protecting us against.
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorFrontendClientQt::destroyInspectorView):
+
+2012-11-08  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix tst_QWebPage::inputMethods on Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=101571
+
+        Reviewed by Simon Hausmann.
+
+        QEvent::RequestSoftwareInputPanel isn't passed through event filters anymore.
+        Use QInputMethodPrivate::testContext instead to capture input method events,
+        the same way as qtbase tests like tst_QTextEdit are doing.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (TestInputContext::TestInputContext):
+        (TestInputContext::~TestInputContext):
+        (TestInputContext):
+        (TestInputContext::showInputPanel):
+        (TestInputContext::hideInputPanel):
+        (TestInputContext::isInputPanelVisible):
+        (tst_QWebPage::inputMethods):
+
+2012-11-09  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Unmark now passing tests
+        https://bugs.webkit.org/show_bug.cgi?id=65531
+
+        Reviewed by Csaba Osztrogonác.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::viewModes):
+
 2012-11-07  Allan Sandfeld Jensen  <allan.jensen@digia.com>
 
         [Qt] API test tst_qwebinspector crashes
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index da793111f..edf20a460 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -713,7 +713,7 @@ void DumpRenderTreeSupportQt::setMockDeviceOrientation(QWebPage* page, bool canP
 {
 #if ENABLE(DEVICE_ORIENTATION)
     Page* corePage = QWebPagePrivate::core(page);
-    DeviceOrientationClientMock* mockClient = toDeviceOrientationClientMock(DeviceOrientationController::from(corePage)->client());
+    DeviceOrientationClientMock* mockClient = toDeviceOrientationClientMock(DeviceOrientationController::from(corePage)->deviceOrientationClient());
     mockClient->setOrientation(DeviceOrientationData::create(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma));
 #endif
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index daa593d7e..025ad659d 100644
--- a/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -399,9 +399,9 @@ void InspectorFrontendClientQt::destroyInspectorView(bool notifyInspectorControl
     m_destroyingInspectorView = true;
 
     // Inspected page may have already been destroyed.
-    if (m_inspectedWebPage) {
+    if (m_inspectedWebPage && m_inspectedWebPage->d->inspector) {
         // Clear reference from QWebInspector to the frontend view.
-        m_inspectedWebPage->d->getOrCreateInspector()->d->setFrontend(0);
+        m_inspectedWebPage->d->inspector->d->setFrontend(0);
     }
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebKit/qt/WebCoreSupport/QStyleFacadeImp.h b/Source/WebKit/qt/WebCoreSupport/QStyleFacadeImp.h
index bf95d310e..7221d72c4 100644
--- a/Source/WebKit/qt/WebCoreSupport/QStyleFacadeImp.h
+++ b/Source/WebKit/qt/WebCoreSupport/QStyleFacadeImp.h
@@ -23,6 +23,7 @@
 #ifndef QStyleFacadeImp_h
 #define QStyleFacadeImp_h
 
+#include <QPointer>
 #include <QStyleFacade.h>
 
 QT_BEGIN_NAMESPACE
@@ -87,7 +88,7 @@ private:
     QStyle* style() const;
 
     WebCore::Page* m_page;
-    mutable QStyle* m_style;
+    mutable QPointer<QStyle> m_style;
     QStyle* m_fallbackStyle;
     bool m_ownFallbackStyle;
     mutable QScopedPointer<QLineEdit> m_lineEdit;
diff --git a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
index ec9c71286..bdbc937d8 100644
--- a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
+++ b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
@@ -33,7 +33,6 @@ Q_DECLARE_METATYPE(CustomType)
 Q_DECLARE_METATYPE(QBrush*)
 Q_DECLARE_METATYPE(QObjectList)
 Q_DECLARE_METATYPE(QList<int>)
-Q_DECLARE_METATYPE(Qt::BrushStyle)
 Q_DECLARE_METATYPE(QVariantList)
 Q_DECLARE_METATYPE(QVariantMap)
 
@@ -377,7 +376,8 @@ public:
     Q_INVOKABLE void myInvokableWithBrushStyleArg(Qt::BrushStyle style)
     {
         m_qtFunctionInvoked = 43;
-        m_actuals << QVariant::fromValue(style);
+        // Qt::BrushStyle isn't registered and this shouldn't be reached.
+        QVERIFY(false);
     }
     Q_INVOKABLE void myInvokableWithVoidStarArg(void* arg)
     {
diff --git a/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index ca3d1bbf5..e5559a4a4 100644
--- a/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -475,7 +475,6 @@ void tst_QWebElement::style()
     p.setStyleProperty("cursor", "auto");
 
     QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("red"));
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65244", Continue);
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("yellow"));
     QCOMPARE(p.styleProperty("cursor", QWebElement::InlineStyle), QLatin1String("auto"));
 
@@ -484,8 +483,8 @@ void tst_QWebElement::style()
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
     p.setStyleProperty("color", "blue");
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=60372", Continue);
-    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    // A current important InlineStyle shouldn't be overwritten by a non-important one.
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("green"));
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
     p.setStyleProperty("color", "blue !important");
@@ -541,7 +540,6 @@ void tst_QWebElement::style()
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
     QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String(""));
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65244", Continue);
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 
     QString html6 = "<head>"
@@ -562,7 +560,6 @@ void tst_QWebElement::style()
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
     QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65244", Continue);
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
 
     QString html7 = "<head>"
@@ -580,7 +577,6 @@ void tst_QWebElement::style()
     waitForSignal(m_page, SIGNAL(loadFinished(bool)), 200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65244", Continue);
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
 
     QString html8 = "<body><p>some text</p></body>";
diff --git a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 426893ff9..5937b2ae9 100644
--- a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -84,7 +84,7 @@ private Q_SLOTS:
     void setContent_data();
     void setContent();
     void setCacheLoadControlAttribute();
-    //void setUrlWithPendingLoads();
+    void setUrlWithPendingLoads();
     void setUrlWithFragment_data();
     void setUrlWithFragment();
     void setUrlToEmpty();
@@ -209,6 +209,7 @@ public:
     {
         setOperation(QNetworkAccessManager::GetOperation);
         setRequest(request);
+        setUrl(request.url());
         if (request.url() == QUrl("qrc:/test1.html")) {
             setHeader(QNetworkRequest::LocationHeader, QString("qrc:/test2.html"));
             setAttribute(QNetworkRequest::RedirectionTargetAttribute, QUrl("qrc:/test2.html"));
@@ -1116,16 +1117,12 @@ void tst_QWebFrame::setCacheLoadControlAttribute()
     QCOMPARE(manager->lastCacheLoad(), QNetworkRequest::PreferNetwork);
 }
 
-// [Qt] Fix tst_QWebFrame::setUrlWithPendingLoads() API test
-// https://bugs.webkit.org/show_bug.cgi?id=63237
-/*
 void tst_QWebFrame::setUrlWithPendingLoads()
 {
     QWebPage page;
     page.mainFrame()->setHtml("<img src='dummy:'/>");
     page.mainFrame()->setUrl(QUrl("about:blank"));
 }
-*/
 
 void tst_QWebFrame::setUrlWithFragment_data()
 {
@@ -1225,7 +1222,6 @@ void tst_QWebFrame::setUrlToInvalid()
 
     const QUrl invalidUrl("http:/example.com");
     QVERIFY(!invalidUrl.isEmpty());
-    QVERIFY(!invalidUrl.isValid());
     QVERIFY(invalidUrl != QUrl());
 
     // QWebFrame will do its best to accept the URL, possible converting it to a valid equivalent URL.
@@ -1240,11 +1236,11 @@ void tst_QWebFrame::setUrlToInvalid()
     const QUrl anotherInvalidUrl("1http://bugs.webkit.org");
     QVERIFY(!anotherInvalidUrl.isEmpty()); // and they are not necessarily empty.
     QVERIFY(!anotherInvalidUrl.isValid());
-    QCOMPARE(anotherInvalidUrl, QUrl());
+    QCOMPARE(anotherInvalidUrl.toEncoded(), QUrl().toEncoded());
 
     frame->setUrl(anotherInvalidUrl);
     QCOMPARE(frame->url(), aboutBlank);
-    QCOMPARE(frame->requestedUrl(), anotherInvalidUrl);
+    QCOMPARE(frame->requestedUrl().toEncoded(), anotherInvalidUrl.toEncoded());
     QCOMPARE(frame->baseUrl(), aboutBlank);
 }
 
diff --git a/Source/WebKit/qt/tests/qwebpage/qwebpage.pro b/Source/WebKit/qt/tests/qwebpage/qwebpage.pro
index ff6c49628..e56bbe8f7 100644
--- a/Source/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/Source/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -1,2 +1,3 @@
 include(../tests.pri)
 exists($${TARGET}.qrc):RESOURCES += $${TARGET}.qrc
+QT *= core-private gui-private
diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 0ede374e0..ff40b55f0 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -32,11 +32,13 @@
 #include <QStyle>
 #include <QtTest/QtTest>
 #include <QTextCharFormat>
+#include <private/qinputmethod_p.h>
 #include <qgraphicsscene.h>
 #include <qgraphicsview.h>
 #include <qgraphicswebview.h>
 #include <qnetworkcookiejar.h>
 #include <qnetworkrequest.h>
+#include <qpa/qplatforminputcontext.h>
 #include <qwebdatabase.h>
 #include <qwebelement.h>
 #include <qwebframe.h>
@@ -58,20 +60,36 @@ static void removeRecursive(const QString& dirname)
     QDir().rmdir(dirname);
 }
 
-class EventSpy : public QObject, public QList<QEvent::Type>
+class TestInputContext : public QPlatformInputContext
 {
-    Q_OBJECT
 public:
-    EventSpy(QObject* objectToSpy)
+    TestInputContext()
+    : m_visible(false)
+    {
+        QInputMethodPrivate* inputMethodPrivate = QInputMethodPrivate::get(qApp->inputMethod());
+        inputMethodPrivate->testContext = this;
+    }
+
+    ~TestInputContext()
     {
-        objectToSpy->installEventFilter(this);
+        QInputMethodPrivate* inputMethodPrivate = QInputMethodPrivate::get(qApp->inputMethod());
+        inputMethodPrivate->testContext = 0;
     }
 
-    virtual bool eventFilter(QObject* receiver, QEvent* event)
+    virtual void showInputPanel()
+    {
+        m_visible = true;
+    }
+    virtual void hideInputPanel()
+    {
+        m_visible = false;
+    }
+    virtual bool isInputPanelVisible() const
     {
-        append(event->type());
-        return false;
+        return m_visible;
     }
+
+    bool m_visible;
 };
 
 class tst_QWebPage : public QObject
@@ -544,15 +562,12 @@ void tst_QWebPage::viewModes()
     m_page->setProperty("_q_viewMode", "minimized");
 
     QVariant empty = m_page->mainFrame()->evaluateJavaScript("window.styleMedia.matchMedium(\"(-webkit-view-mode)\")");
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65531", Continue);
     QVERIFY(empty.type() == QVariant::Bool && empty.toBool());
 
     QVariant minimized = m_page->mainFrame()->evaluateJavaScript("window.styleMedia.matchMedium(\"(-webkit-view-mode: minimized)\")");
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65531", Continue);
     QVERIFY(minimized.type() == QVariant::Bool && minimized.toBool());
 
     QVariant maximized = m_page->mainFrame()->evaluateJavaScript("window.styleMedia.matchMedium(\"(-webkit-view-mode: maximized)\")");
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65531", Continue);
     QVERIFY(maximized.type() == QVariant::Bool && !maximized.toBool());
 }
 
@@ -1641,14 +1656,14 @@ void tst_QWebPage::inputMethods()
     } else
         QVERIFY2(false, "Unknown view type");
 
-    page->settings()->setFontFamily(QWebSettings::SerifFont, "FooSerifFont");
+    page->settings()->setFontFamily(QWebSettings::SerifFont, page->settings()->fontFamily(QWebSettings::FixedFont));
     page->mainFrame()->setHtml("<html><body>" \
                                             "<input type='text' id='input1' style='font-family: serif' value='' maxlength='20'/><br>" \
                                             "<input type='password'/>" \
                                             "</body></html>");
     page->mainFrame()->setFocus();
 
-    EventSpy viewEventSpy(container);
+    TestInputContext testContext;
 
     QWebElementCollection inputs = page->mainFrame()->documentElement().findAll("input");
     QPoint textInputCenter = inputs.at(0).geometry().center();
@@ -1673,22 +1688,23 @@ void tst_QWebPage::inputMethods()
     // and the RequestSoftwareInputPanel event is called. For these two situations
     // this part of the test can verified as the checks below.
     if (inputPanel)
-        QVERIFY(viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+        QVERIFY(testContext.isInputPanelVisible());
     else
-        QVERIFY(!viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
-    viewEventSpy.clear();
+        QVERIFY(!testContext.isInputPanelVisible());
+    testContext.hideInputPanel();
 
     clickOnPage(page, textInputCenter);
-    QVERIFY(viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+    QVERIFY(testContext.isInputPanelVisible());
 
     //ImMicroFocus
     QVariant variant = page->inputMethodQuery(Qt::ImMicroFocus);
     QVERIFY(inputs.at(0).geometry().contains(variant.toRect().topLeft()));
 
-    //ImFont
+    // We assigned the serif font famility to be the same as the fixef font family.
+    // Then test ImFont on a serif styled element, we should get our fixef font family.
     variant = page->inputMethodQuery(Qt::ImFont);
     QFont font = variant.value<QFont>();
-    QCOMPARE(page->settings()->fontFamily(QWebSettings::SerifFont), font.family());
+    QCOMPARE(page->settings()->fontFamily(QWebSettings::FixedFont), font.family());
 
     QList<QInputMethodEvent::Attribute> inputAttributes;
 
@@ -1884,12 +1900,12 @@ void tst_QWebPage::inputMethods()
     QVERIFY(!(inputMethodHints(view) & Qt::ImhHiddenText));
 
     page->mainFrame()->setHtml("<html><body><p>nothing to input here");
-    viewEventSpy.clear();
+    testContext.hideInputPanel();
 
     QWebElement para = page->mainFrame()->findFirstElement("p");
     clickOnPage(page, para.geometry().center());
 
-    QVERIFY(!viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+    QVERIFY(!testContext.isInputPanelVisible());
 
     //START - Test for sending empty QInputMethodEvent
     page->mainFrame()->setHtml("<html><body>" \
@@ -2221,7 +2237,7 @@ void tst_QWebPage::inputMethods()
     QWebElement inputElement = page->mainFrame()->findFirstElement("div");
     clickOnPage(page, inputElement.geometry().center());
 
-    QVERIFY(!viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+    QVERIFY(!testContext.isInputPanelVisible());
 
     // START - Newline test for textarea
     qApp->processEvents();
@@ -2472,7 +2488,7 @@ void tst_QWebPage::testLocalStorageVisibility()
     webPage.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl("file:///"));
 
     QCOMPARE(checkLocalStorageVisibility(webPage, false), false);
-    QCOMPARE(checkLocalStorageVisibility(webPage, true), false);
+    QCOMPARE(checkLocalStorageVisibility(webPage, true), true);
 
     webPage.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl("http://www.example.com"));
 
@@ -2899,9 +2915,9 @@ public:
 void tst_QWebPage::showModalDialog()
 {
     TestModalPage page;
+    page.settings()->setAttribute(QWebSettings::JavascriptCanOpenWindows, true);
     page.mainFrame()->setHtml(QString("<html></html>"));
     QString res = page.mainFrame()->evaluateJavaScript("window.showModalDialog('javascript:window.returnValue=dialogArguments; window.close();', 'This is a test');").toString();
-    QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=63244", Continue);
     QCOMPARE(res, QString("This is a test"));
 }
 
@@ -2942,12 +2958,10 @@ void tst_QWebPage::findText()
     QVERIFY(m_page->selectedText().isEmpty());
     QVERIFY(m_page->selectedHtml().isEmpty());
     QStringList words = (QStringList() << "foo" << "bar");
-    QRegExp regExp(" style=\".*\"");
-    regExp.setMinimal(true);
     foreach (QString subString, words) {
         m_page->findText(subString, QWebPage::FindWrapsAroundDocument);
         QCOMPARE(m_page->selectedText(), subString);
-        QCOMPARE(m_page->selectedHtml().trimmed().replace(regExp, ""), subString);
+        QVERIFY(m_page->selectedHtml().contains(subString));
         m_page->findText("");
         QVERIFY(m_page->selectedText().isEmpty());
         QVERIFY(m_page->selectedHtml().isEmpty());
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 26351743b..2e40dad52 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,132 @@
+2012-11-21  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Disambiguate innerNodeFramePoint and mainFramePoint
+        https://bugs.webkit.org/show_bug.cgi?id=98139
+
+        Reviewed by Julien Chaffraix.
+
+        * WebView.cpp:
+        (WebView::handleContextMenuEvent):
+
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * WebFrame.cpp:
+        (WebFrame::loadRequest):
+        (WebFrame::loadData):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebFrame.cpp:
+        (WebFrame::loadRequest):
+        (WebFrame::loadData):
+
+2012-11-17  Brady Eidson  <beidson@apple.com>
+
+        Add an integer identifier field to AuthenticationChallengeBase.
+        https://bugs.webkit.org/show_bug.cgi?id=102593
+
+        Reviewed by Darin Adler.
+
+        * WebURLAuthenticationChallenge.cpp:
+        (WebURLAuthenticationChallenge::initWithProtectionSpace): Adopt the new constructor with a dummy identifier.
+
+2012-11-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build fix after r134960.
+
+        Avoid including Mac-specific headers.
+
+        * WebCoreSupport/WebFrameNetworkingContext.cpp: Stub out
+        CFNetwork-based implementations.
+        * WebCoreSupport/WebFrameNetworkingContext.h: Exclude
+        CFNetwork data types.
+        * WebCoreSupport/WebPlatformStrategies.cpp: Stub out
+        CFNetwork-based implementations.
+        * WebCoreSupport/WebPlatformStrategies.h: Exclude
+        CFNetwork data types.
+
+2012-11-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Private Browsing is a per-page setting that sets a global value
+        https://bugs.webkit.org/show_bug.cgi?id=67870
+
+        Reviewed by Sam Weinig.
+
+        * WebCookieManagerCFNet.cpp: (WebCookieManager::cookieStorage): We can't get
+        current session without any context, but the code was not correct anyway, the client
+        is clearly interested in a getter to match override setter.
+
+        * WebCoreSupport/WebFrameNetworkingContext.cpp: Moved code for tracking global
+        sessions from WebCore to WebKit. The behavior is unchanged, but lower levels are
+        now cleaner.
+
+        * WebCoreSupport/WebFrameNetworkingContext.h: Ditto.
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebPlatformStrategies::defaultCookieStorage): Added. Use WebFrameNetworkingContext
+        for tracking the default session.
+
+        * WebView.cpp: (updateSharedSettingsFromPreferencesIfNeeded):
+        Use WebFrameNetworkingContext::setCookieAcceptPolicyForAllContexts. Updating only
+        the current session is not sufficient, and did not match Mac.
+
+2012-11-14  George Tsoumalis  <tsumalis96@gmail.com>
+
+        Implementation for mehods in WebMutableURLRequest.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=83671
+
+        Reviewed by Brent Fulgham..
+
+        * WebMutableURLRequest.cpp:
+        (WebMutableURLRequest::addValue):
+        (WebMutableURLRequest::setMainDocumentURL):
+        (WebMutableURLRequest::setHTTPShouldHandleCookies):
+
+
+2012-11-12  Roger Fong  <roger_fong@apple.com>
+
+        REGRESSION(r130643): Assertion failure when running DRT in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=101791
+
+        Reviewed by Darin Adler.
+
+        When running DRT in debug mode, we hit an assertion failure in initializing the WebKit instance.
+        This failure started occuring in r130643 and this work around follows the work around in r132302.
+
+        * WebKitCOMAPI.cpp:
+        (CLSIDHashTraits):
+
+2012-11-12  Roger Fong  <roger_fong@apple.com>
+
+        Web Inspector: Fix docking behaviour on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=101978
+
+        Reviewed by Brian Weinstein.
+
+        There are a number of problems with docking behaviour on Windows.
+        For starters, it does not ever constrain the inspector's size properly while docked.
+        It also does not properly set the whether or not the inspector can be docked/undocked.
+        This patch fixes both issues.
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorFrontendClient::frontendLoaded): 
+        (WebInspectorFrontendClient::attachWindow):
+        Call restoreAttachedWindowHeight so that when first loading or reattaching the inspector,
+        we resize the inspector window properly.
+
 2012-11-05  Simon Fraser  <simon.fraser@apple.com>
 
         Fix layer borders to cleaning appear and disappear on switching
diff --git a/Source/WebKit/win/WebCookieManagerCFNet.cpp b/Source/WebKit/win/WebCookieManagerCFNet.cpp
index b6eb68067..f0804df7c 100644
--- a/Source/WebKit/win/WebCookieManagerCFNet.cpp
+++ b/Source/WebKit/win/WebCookieManagerCFNet.cpp
@@ -40,11 +40,7 @@ HRESULT STDMETHODCALLTYPE WebCookieManager::cookieStorage(
    if (!storage)
         return E_POINTER;
 
-    // Need to retain locally to make sure the result is valid in caller.
-    static RetainPtr<CFHTTPCookieStorageRef> result;
-    result = currentCFHTTPCookieStorage();
-
-    *storage = result.get();
+    *storage = overridenCookieStorage();
     return S_OK;
 }
 
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.cpp b/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.cpp
index 40ecf46e2..01c50c1d9 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.cpp
@@ -21,9 +21,22 @@
 #include "WebFrameNetworkingContext.h"
 
 #include "FrameLoaderClient.h"
+#if USE(CFNETWORK)
+#include <CFNetwork/CFHTTPCookiesPriv.h>
+#include <WebCore/CookieStorageCFNet.h>
+#endif
+#include <WebCore/Settings.h>
+#if USE(CFNETWORK)
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
 
 using namespace WebCore;
 
+#if USE(CFNETWORK)
+static CFURLStorageSessionRef defaultCFStorageSession;
+static CFURLStorageSessionRef privateBrowsingStorageSession;
+#endif
+
 PassRefPtr<WebFrameNetworkingContext> WebFrameNetworkingContext::create(Frame* frame, const String& userAgent)
 {
     return adoptRef(new WebFrameNetworkingContext(frame, userAgent));
@@ -43,3 +56,83 @@ WebCore::ResourceError WebFrameNetworkingContext::blockedError(const WebCore::Re
 {
     return frame()->loader()->client()->blockedError(request);
 }
+
+static String& privateBrowsingStorageSessionIdentifierBase()
+{
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(String, base, ());
+    return base;
+}
+
+void WebFrameNetworkingContext::setPrivateBrowsingStorageSessionIdentifierBase(const String& identifier)
+{
+    privateBrowsingStorageSessionIdentifierBase() = identifier;
+}
+
+void WebFrameNetworkingContext::switchToNewTestingSession()
+{
+#if USE(CFNETWORK)
+    // Set a private session for testing to avoid interfering with global cookies. This should be different from private browsing session.
+    defaultCFStorageSession = wkCreatePrivateStorageSession(CFSTR("Private WebKit Session"), defaultCFStorageSession);
+#endif
+}
+
+void WebFrameNetworkingContext::ensurePrivateBrowsingSession()
+{
+    ASSERT(isMainThread());
+#if USE(CFNETWORK)
+    if (privateBrowsingStorageSession)
+        return;
+
+    String base = privateBrowsingStorageSessionIdentifierBase().isNull() ? String(reinterpret_cast<CFStringRef>(CFBundleGetValueForInfoDictionaryKey(CFBundleGetMainBundle(), kCFBundleIdentifierKey))) : privateBrowsingStorageSessionIdentifierBase();
+    RetainPtr<CFStringRef> cfIdentifier = String(base + ".PrivateBrowsing").createCFString();
+
+    privateBrowsingStorageSession = wkCreatePrivateStorageSession(cfIdentifier.get(), defaultCFStorageSession);
+#endif
+}
+
+void WebFrameNetworkingContext::destroyPrivateBrowsingSession()
+{
+#if USE(CFNETWORK)
+    if (!privateBrowsingStorageSession)
+        return;
+
+    CFRelease(privateBrowsingStorageSession);
+    privateBrowsingStorageSession = 0;
+#endif
+}
+
+#if USE(CFNETWORK)
+CFURLStorageSessionRef WebFrameNetworkingContext::defaultStorageSession()
+{
+    return defaultCFStorageSession;
+}
+
+CFURLStorageSessionRef WebFrameNetworkingContext::storageSession() const
+{
+    bool privateBrowsingEnabled = frame() && frame()->settings() && frame()->settings()->privateBrowsingEnabled();
+    if (privateBrowsingEnabled) {
+        ASSERT(privateBrowsingStorageSession);
+        return privateBrowsingStorageSession;
+    }
+    return defaultCFStorageSession;
+}
+
+void WebFrameNetworkingContext::setCookieAcceptPolicyForTestingContext(CFHTTPCookieStorageAcceptPolicy policy)
+{
+    ASSERT(defaultCFStorageSession);
+    RetainPtr<CFHTTPCookieStorageRef> defaultCookieStorage = adoptCF(wkCopyHTTPCookieStorage(defaultCFStorageSession));
+    CFHTTPCookieStorageSetCookieAcceptPolicy(defaultCookieStorage.get(), policy);
+}
+
+void WebFrameNetworkingContext::setCookieAcceptPolicyForAllContexts(CFHTTPCookieStorageAcceptPolicy policy)
+{
+    if (RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage())
+        CFHTTPCookieStorageSetCookieAcceptPolicy(cookieStorage.get(), policy);
+
+    if (privateBrowsingStorageSession) {
+        RetainPtr<CFHTTPCookieStorageRef> privateBrowsingCookieStorage = adoptCF(wkCopyHTTPCookieStorage(privateBrowsingStorageSession));
+        CFHTTPCookieStorageSetCookieAcceptPolicy(privateBrowsingCookieStorage.get(), policy);
+    }
+}
+#endif
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.h b/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.h
index a237c9aaa..d7b1f0a5f 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.h
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameNetworkingContext.h
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2012 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,6 +28,18 @@ class WebFrameNetworkingContext : public WebCore::FrameNetworkingContext {
 public:
     static PassRefPtr<WebFrameNetworkingContext> create(WebCore::Frame*, const WTF::String& userAgent);
 
+    static void setPrivateBrowsingStorageSessionIdentifierBase(const String&);
+    static void switchToNewTestingSession();
+    static void ensurePrivateBrowsingSession();
+    static void destroyPrivateBrowsingSession();
+
+#if USE(CFNETWORK)
+    static CFURLStorageSessionRef defaultStorageSession();
+
+    static void setCookieAcceptPolicyForTestingContext(CFHTTPCookieStorageAcceptPolicy);
+    static void setCookieAcceptPolicyForAllContexts(CFHTTPCookieStorageAcceptPolicy);
+#endif
+
 private:
     WebFrameNetworkingContext(WebCore::Frame* frame, const WTF::String& userAgent)
         : WebCore::FrameNetworkingContext(frame)
@@ -36,6 +49,9 @@ private:
 
     virtual WTF::String userAgent() const;
     virtual WTF::String referrer() const;
+#if USE(CFNETWORK)
+    virtual CFURLStorageSessionRef storageSession() const;
+#endif
     virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&) const;
 
     WTF::String m_userAgent;
diff --git a/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp b/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
index 2eed79758..c0aef8719 100644
--- a/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
@@ -254,6 +254,9 @@ void WebInspectorFrontendClient::frontendLoaded()
 {
     InspectorFrontendClientLocal::frontendLoaded();
 
+    if (m_attached)
+        restoreAttachedWindowHeight();
+
     setAttachedWindow(m_attached);
 }
 
@@ -290,6 +293,13 @@ void WebInspectorFrontendClient::attachWindow()
     m_inspectorClient->setInspectorStartsAttached(true);
 
     closeWindowWithoutNotifications();
+    // We need to set the attached window's height before we actually attach the window.
+    // Make sure that m_attached is true so that calling setAttachedWindowHeight from restoreAttachedWindowHeight doesn't return early. 
+    m_attached = true;
+    // Immediately after calling showWindowWithoutNotifications(), the parent frameview's visibleHeight incorrectly returns 0 always (Windows only).
+    // We are expecting this value to be just the height of the parent window when we call restoreAttachedWindowHeight, which it is before
+    // calling showWindowWithoutNotifications().
+    restoreAttachedWindowHeight();
     showWindowWithoutNotifications();
 }
 
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
index fb57612ec..75a03e219 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
@@ -26,9 +26,13 @@
 #include "config.h"
 #include "WebPlatformStrategies.h"
 
+#include "WebFrameNetworkingContext.h"
 #include <WebCore/Page.h>
 #include <WebCore/PageGroup.h>
 #include <WebCore/PluginDatabase.h>
+#if USE(CFNETWORK)
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
 
 using namespace WebCore;
 
@@ -76,6 +80,16 @@ void WebPlatformStrategies::notifyCookiesChanged()
 {
 }
 
+#if USE(CFNETWORK)
+RetainPtr<CFHTTPCookieStorageRef> WebPlatformStrategies::defaultCookieStorage()
+{
+    if (CFURLStorageSessionRef session = WebFrameNetworkingContext::defaultStorageSession())
+        return adoptCF(wkCopyHTTPCookieStorage(session));
+
+    return wkGetDefaultHTTPCookieStorage();
+}
+#endif
+
 void WebPlatformStrategies::refreshPlugins()
 {
     PluginDatabase::installedPlugins()->refresh();
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
index 9b43de3ad..9777b8480 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
@@ -50,6 +50,9 @@ private:
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
+#if USE(CFNETWORK)
+    virtual RetainPtr<CFHTTPCookieStorageRef> defaultCookieStorage();
+#endif
 
     // WebCore::PluginStrategy
     virtual void refreshPlugins();
diff --git a/Source/WebKit/win/WebKitCOMAPI.cpp b/Source/WebKit/win/WebKitCOMAPI.cpp
index 4d8ff095b..3c6f0687b 100644
--- a/Source/WebKit/win/WebKitCOMAPI.cpp
+++ b/Source/WebKit/win/WebKitCOMAPI.cpp
@@ -44,6 +44,11 @@ struct CLSIDHash {
 struct CLSIDHashTraits : WTF::GenericHashTraits<CLSID> {
     static void constructDeletedValue(CLSID& slot) { slot = CLSID_NULL; }
     static bool isDeletedValue(const CLSID& value) { return value == CLSID_NULL; }
+    // FIXME: This is a work around for the regression introducing in r130643 when running DRT in debug mode on Windows.
+    // Expanding the size of the hash table causes an assertion failure ASSERT(!isDeletedBucket) when reinserting items into the new table,
+    // presumably due to the collision issues described in r132302.
+    // This work around avoids the issue entirely simply by making sure that the table will not have to resize in running DRT. 
+    static const int minimumTableSize = 64;
 };
 
 static COMPtr<IClassFactory> classFactory(const CLSID& clsid)
diff --git a/Source/WebKit/win/WebMutableURLRequest.cpp b/Source/WebKit/win/WebMutableURLRequest.cpp
index a22f732ab..f52f79eb3 100644
--- a/Source/WebKit/win/WebMutableURLRequest.cpp
+++ b/Source/WebKit/win/WebMutableURLRequest.cpp
@@ -186,10 +186,12 @@ HRESULT STDMETHODCALLTYPE WebMutableURLRequest::HTTPMethod(
 }
 
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::HTTPShouldHandleCookies( 
-    /* [retval][out] */ BOOL* /*result*/)
+    /* [retval][out] */ BOOL* result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    bool shouldHandleCookies = m_request.allowCookies();
+
+    *result = shouldHandleCookies ? TRUE : FALSE;
+    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::initWithURL( 
@@ -264,11 +266,11 @@ HRESULT STDMETHODCALLTYPE WebMutableURLRequest::isEqual(
 // IWebMutableURLRequest --------------------------------------------------------
 
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::addValue( 
-    /* [in] */ BSTR /*value*/,
-    /* [in] */ BSTR /*field*/)
+    /* [in] */ BSTR value,
+    /* [in] */ BSTR field)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    m_request.addHTTPHeaderField(WTF::AtomicString(value, SysStringLen(value)), String(field, SysStringLen(field)));
+    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setAllHTTPHeaderFields( 
@@ -314,10 +316,10 @@ HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setHTTPShouldHandleCookies(
 }
 
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setMainDocumentURL( 
-    /* [in] */ BSTR /*theURL*/)
+    /* [in] */ BSTR theURL)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    m_request.setFirstPartyForCookies(MarshallingHelpers::BSTRToKURL(theURL));
+    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setTimeoutInterval( 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallenge.cpp b/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
index e12d0fd31..eaeeca8b3 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
@@ -148,7 +148,7 @@ HRESULT STDMETHODCALLTYPE WebURLAuthenticationChallenge::initWithProtectionSpace
     // construct the AuthenticationChallenge with that as obtained from the webSender
 #if USE(CFNETWORK)
     m_authenticationChallenge = AuthenticationChallenge(webSpace->protectionSpace(), webCredential->credential(),
-                                    previousFailureCount, webResponse->resourceResponse(), webError->resourceError());
+                                    previousFailureCount, webResponse->resourceResponse(), webError->resourceError(), 0);
 #endif
     return S_OK;
 }
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index dd7008eb3..38d2e515e 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -45,6 +45,7 @@
 #include "WebEditorClient.h"
 #include "WebElementPropertyBag.h"
 #include "WebFrame.h"
+#include "WebFrameNetworkingContext.h"
 #include "WebGeolocationClient.h"
 #include "WebGeolocationPosition.h"
 #include "WebIconDatabase.h"
@@ -1349,11 +1350,7 @@ bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam)
     if (!coreMenu)
         return false;
 
-    Node* node = contextMenuController->hitTestResult().innerNonSharedNode();
-    if (!node)
-        return false;
-
-    Frame* frame = node->document()->frame();
+    Frame* frame = contextMenuController->hitTestResult().innerNodeFrame();
     if (!frame)
         return false;
 
@@ -1361,7 +1358,7 @@ bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam)
     if (!view)
         return false;
 
-    POINT point(view->contentsToWindow(contextMenuController->hitTestResult().roundedPoint()));
+    POINT point(view->contentsToWindow(contextMenuController->hitTestResult().roundedPointInInnerNodeFrame()));
 
     // Translate the point to screen coordinates
     if (!::ClientToScreen(m_viewWindow, &point))
@@ -4960,9 +4957,7 @@ HRESULT updateSharedSettingsFromPreferencesIfNeeded(IWebPreferences* preferences
         return hr;
 
 #if USE(CFNETWORK)
-    // Set cookie storage accept policy
-    if (RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage())
-        CFHTTPCookieStorageSetCookieAcceptPolicy(cookieStorage.get(), acceptPolicy);
+    WebFrameNetworkingContext::setCookieAcceptPolicyForAllContexts(acceptPolicy);
 #endif
 
     return S_OK;
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index 2fa3f132d..0b1cae131 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,25 @@
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * WebView.cpp:
+        (WebView::load):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebView.cpp:
+        (WebView::load):
+
 2012-10-24  Brady Eidson  <beidson@apple.com>
 
         Add a strategy for loader customization.
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index e9eaf1319..4c43edc8e 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,25 @@
+2012-11-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r135295.
+        http://trac.webkit.org/changeset/135295
+        https://bugs.webkit.org/show_bug.cgi?id=102834
+
+        This patch causes assertion to some layout tests on chromium
+        (Requested by jianli on #webkit).
+
+        * WebFrame.cpp:
+        (WebKit::WebFrame::SetPageSource):
+
+2012-11-20  James Simonsen  <simonjam@chromium.org>
+
+        Consolidate FrameLoader::load() into one function taking a FrameLoadRequest
+        https://bugs.webkit.org/show_bug.cgi?id=102151
+
+        Reviewed by Adam Barth.
+
+        * WebFrame.cpp:
+        (WebKit::WebFrame::SetPageSource):
+
 2012-10-22  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
 
         [Qt] Fix "ASSERTION FAILED: !document->inPageCache()" when loading a page
author	Simon Hausmann <simon.hausmann@digia.com>	2012-11-22 09:09:45 +0100
committer	Simon Hausmann <simon.hausmann@digia.com>	2012-11-22 09:10:13 +0100
commit	470286ecfe79d59df14944e5b5d34630fc739391 (patch)
tree	43983212872e06cebefd2ae474418fa2908ca54c /Source/WebKit
parent	23037105e948c2065da5a937d3a2396b0ff45c1e (diff)
download	qtwebkit-470286ecfe79d59df14944e5b5d34630fc739391.tar.gz