Merge WebKit at r78450: Initial merge by git.

Change-Id: I6d3e5f1f868ec266a0aafdef66182ddc3f265dc1

75 files changed, 783 insertions, 501 deletions

diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index e89fb74..aaaa4a5 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -36,6 +36,7 @@
 #include "AccessibilityObject.h"
 #include "ApplicationCacheHost.h"
 #include "AsyncFileSystem.h"
+#include "DocumentMarker.h"
 #include "EditorInsertAction.h"
 #include "FileError.h"
 #include "FileMetadata.h"
@@ -74,6 +75,7 @@
 #include "WebSettings.h"
 #include "WebTextAffinity.h"
 #include "WebTextCaseSensitivity.h"
+#include "WebTextCheckingResult.h"
 #include "WebVideoFrame.h"
 #include "WebView.h"
 #include <wtf/Assertions.h>
@@ -397,6 +399,9 @@ COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorPathExists, FileError::PATH_EXISTS_ERR)
 COMPILE_ASSERT_MATCHING_ENUM(WebGeolocationError::ErrorPermissionDenied, GeolocationError::PermissionDenied);
 COMPILE_ASSERT_MATCHING_ENUM(WebGeolocationError::ErrorPositionUnavailable, GeolocationError::PositionUnavailable);
 
+COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingResult::ErrorSpelling, DocumentMarker::Spelling);
+COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingResult::ErrorGrammar, DocumentMarker::Grammar);
+
 #if OS(DARWIN)
 COMPILE_ASSERT_MATCHING_ENUM(WebThemeEngine::StateDisabled, PlatformBridge::StateDisabled);
 COMPILE_ASSERT_MATCHING_ENUM(WebThemeEngine::StateInactive, PlatformBridge::StateInactive);
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index 5975e72..ef1f616 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -50,8 +50,8 @@ bool AsyncFileSystem::isAvailable()
     return true;
 }
 
-AsyncFileSystemChromium::AsyncFileSystemChromium(const String& rootPath)
-    : AsyncFileSystem(rootPath)
+AsyncFileSystemChromium::AsyncFileSystemChromium(AsyncFileSystem::Type type, const String& rootPath)
+    : AsyncFileSystem(type, rootPath)
     , m_webFileSystem(WebKit::webKitClient()->fileSystem())
 {
     ASSERT(m_webFileSystem);
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.h b/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
index 6205609..da98a33 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
@@ -46,9 +46,9 @@ class AsyncFileSystemCallbacks;
 
 class AsyncFileSystemChromium : public AsyncFileSystem {
 public:
-    static PassOwnPtr<AsyncFileSystem> create(const String& rootPath)
+    static PassOwnPtr<AsyncFileSystem> create(AsyncFileSystem::Type type, const String& rootPath)
     {
-        return adoptPtr(new AsyncFileSystemChromium(rootPath));
+        return adoptPtr(new AsyncFileSystemChromium(type, rootPath));
     }
 
     virtual ~AsyncFileSystemChromium();
@@ -66,7 +66,7 @@ public:
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 private:
-    explicit AsyncFileSystemChromium(const String& rootPath);
+    AsyncFileSystemChromium(AsyncFileSystem::Type, const String& rootPath);
     WebKit::WebFileSystem* m_webFileSystem;
 };
 
diff --git a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
index bed2562..a483308 100644
--- a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
+++ b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
@@ -41,10 +41,15 @@ using namespace WebKit;
 namespace WebCore {
 
 // Buffer size that the Chromium audio system will call us back with.
+#if OS(DARWIN)
+// For Mac OS X the chromium audio backend uses a low-latency CoreAudio API, so a low buffer size is possible.
+const unsigned callbackBufferSize = 128;
+#else
 // This value may need to be tuned based on the OS.
 // FIXME: It may be possible to reduce this value once real-time threads
 // and other Chromium audio improvements are made.
 const unsigned callbackBufferSize = 2048;
+#endif
 
 // Buffer size at which the web audio engine will render.
 const unsigned renderBufferSize = 128;
diff --git a/Source/WebKit/chromium/src/AutoFillPopupMenuClient.cpp b/Source/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
index 2ce31a9..d04c57c 100644
--- a/Source/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
+++ b/Source/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
@@ -293,7 +293,7 @@ void AutoFillPopupMenuClient::initialize(
     // the input element: textField.
     m_regularStyle.set(new PopupMenuStyle(Color::black, Color::white, regularFont,
                                           true, false, Length(WebCore::Fixed),
-                                          textField->renderer()->style()->direction()));
+                                          textField->renderer()->style()->direction(), textField->renderer()->style()->unicodeBidi() == Override));
 
     FontDescription warningFontDescription = regularFont.fontDescription();
     warningFontDescription.setItalic(true);
@@ -305,7 +305,8 @@ void AutoFillPopupMenuClient::initialize(
                                           m_regularStyle->isVisible(),
                                           m_regularStyle->isDisplayNone(),
                                           m_regularStyle->textIndent(),
-                                          m_regularStyle->textDirection()));
+                                          m_regularStyle->textDirection(),
+                                          m_regularStyle->hasTextDirectionOverride()));
 }
 
 void AutoFillPopupMenuClient::setSuggestions(const WebVector<WebString>& names,
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index a63a625..4b68c18 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -34,7 +34,6 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityObject.h"
-#include "CharacterNames.h"
 #include "Console.h"
 #include "Cursor.h"
 #include "DatabaseTracker.h"
@@ -70,6 +69,7 @@
 #include "WebFileChooserCompletionImpl.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
+#include "WebIconLoadingCompletionImpl.h"
 #include "WebInputEvent.h"
 #include "WebKit.h"
 #include "WebNode.h"
@@ -86,6 +86,7 @@
 #include "WebWindowFeatures.h"
 #include "WindowFeatures.h"
 #include "WrappedResourceRequest.h"
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace WebCore;
 
@@ -501,6 +502,13 @@ IntRect ChromeClientImpl::windowResizerRect() const
     return result;
 }
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+void ChromeClientImpl::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title)
+{
+    notImplemented();
+}
+#endif
+
 void ChromeClientImpl::invalidateWindow(const IntRect&, bool)
 {
     notImplemented();
@@ -669,9 +677,13 @@ void ChromeClientImpl::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileCh
     chooserCompletion->didChooseFile(WebVector<WebString>());
 }
 
-void ChromeClientImpl::chooseIconForFiles(const Vector<WTF::String>&, WebCore::FileChooser*)
+void ChromeClientImpl::chooseIconForFiles(const Vector<String>& filenames, FileChooser* fileChooser)
 {
-    notImplemented();
+    if (!m_webView->client())
+        return;
+    WebIconLoadingCompletionImpl* iconCompletion = new WebIconLoadingCompletionImpl(fileChooser);
+    if (!m_webView->client()->queryIconForFiles(filenames, iconCompletion))
+        iconCompletion->didLoadIcon(WebData());
 }
 
 void ChromeClientImpl::popupOpened(PopupContainer* popupContainer,
@@ -732,24 +744,29 @@ void ChromeClientImpl::getPopupMenuInfo(PopupContainer* popupContainer,
 {
     const Vector<PopupItem*>& inputItems = popupContainer->popupData();
 
-    WebVector<WebPopupMenuInfo::Item> outputItems(inputItems.size());
+    WebVector<WebMenuItemInfo> outputItems(inputItems.size());
 
     for (size_t i = 0; i < inputItems.size(); ++i) {
         const PopupItem& inputItem = *inputItems[i];
-        WebPopupMenuInfo::Item& outputItem = outputItems[i];
+        WebMenuItemInfo& outputItem = outputItems[i];
 
         outputItem.label = inputItem.label;
         outputItem.enabled = inputItem.enabled;
+        if (inputItem.textDirection == WebCore::RTL)
+            outputItem.textDirection = WebTextDirectionRightToLeft;
+        else
+            outputItem.textDirection = WebTextDirectionLeftToRight;
+        outputItem.hasTextDirectionOverride = inputItem.hasTextDirectionOverride;
 
         switch (inputItem.type) {
         case PopupItem::TypeOption:
-            outputItem.type = WebPopupMenuInfo::Item::Option;
+            outputItem.type = WebMenuItemInfo::Option;
             break;
         case PopupItem::TypeGroup:
-            outputItem.type = WebPopupMenuInfo::Item::Group;
+            outputItem.type = WebMenuItemInfo::Group;
             break;
         case PopupItem::TypeSeparator:
-            outputItem.type = WebPopupMenuInfo::Item::Separator;
+            outputItem.type = WebMenuItemInfo::Separator;
             break;
         default:
             ASSERT_NOT_REACHED();
@@ -848,6 +865,11 @@ bool ChromeClientImpl::selectItemWritingDirectionIsNatural()
     return false;
 }
 
+bool ChromeClientImpl::selectItemAlignmentFollowsMenuWritingDirection()
+{
+    return true;
+}
+
 PassRefPtr<PopupMenu> ChromeClientImpl::createPopupMenu(PopupMenuClient* client) const
 {
     if (WebViewImpl::useExternalPopupMenus())
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 07f7d1f..d3ccb75 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -39,7 +39,6 @@
 namespace WebCore {
 class AccessibilityObject;
 class FileChooser;
-class HTMLParserQuirks;
 class PopupContainer;
 class PopupMenuClient;
 class SecurityOrigin;
@@ -102,6 +101,9 @@ public:
     virtual bool shouldInterruptJavaScript();
     virtual bool tabsToLinks() const;
     virtual WebCore::IntRect windowResizerRect() const;
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+#endif
     virtual void invalidateWindow(const WebCore::IntRect&, bool);
     virtual void invalidateContentsAndWindow(const WebCore::IntRect&, bool);
     virtual void invalidateContentsForSlowScroll(const WebCore::IntRect&, bool);
@@ -137,7 +139,6 @@ public:
     virtual void chooseIconForFiles(const Vector<WTF::String>&, WebCore::FileChooser*);
     virtual void setCursor(const WebCore::Cursor&);
     virtual void formStateDidChange(const WebCore::Node*);
-    virtual PassOwnPtr<WebCore::HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
 #if ENABLE(TOUCH_EVENTS)
     // FIXME: All touch events are forwarded regardless of whether or not they are needed.
     virtual void needTouchEvents(bool needTouchEvents) { }
@@ -173,6 +174,7 @@ public:
     void setCursorForPlugin(const WebCursorInfo&);
 
     virtual bool selectItemWritingDirectionIsNatural();
+    virtual bool selectItemAlignmentFollowsMenuWritingDirection();
     virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::PopupMenuClient*) const;
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const;
 
diff --git a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
index d166d9d..49de043 100644
--- a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -236,7 +236,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
 
     // If it's not a link, an image, a media element, or an image/media link,
     // show a selection menu or a more generic page menu.
-    data.frameEncoding = selectedFrame->loader()->writer()->encoding();
+    data.frameEncoding = selectedFrame->document()->loader()->writer()->encoding();
 
     // Send the frame and page URLs in any case.
     data.pageURL = urlFromFrame(m_webView->mainFrameImpl()->frame());
diff --git a/Source/WebKit/chromium/src/DragClientImpl.cpp b/Source/WebKit/chromium/src/DragClientImpl.cpp
index 9874401..4c896a7 100644
--- a/Source/WebKit/chromium/src/DragClientImpl.cpp
+++ b/Source/WebKit/chromium/src/DragClientImpl.cpp
@@ -96,12 +96,6 @@ void DragClientImpl::startDrag(DragImageRef dragImage,
         offsetPoint);
 }
 
-DragImageRef DragClientImpl::createDragImageForLink(KURL&, const String& label, Frame*)
-{
-    // FIXME
-    return 0;
-}
-
 void DragClientImpl::dragControllerDestroyed()
 {
     // Our lifetime is bound to the WebViewImpl.
diff --git a/Source/WebKit/chromium/src/DragClientImpl.h b/Source/WebKit/chromium/src/DragClientImpl.h
index dac7acd..b48206a 100644
--- a/Source/WebKit/chromium/src/DragClientImpl.h
+++ b/Source/WebKit/chromium/src/DragClientImpl.h
@@ -62,8 +62,6 @@ public:
         WebCore::Clipboard* clipboard,
         WebCore::Frame* frame,
         bool isLinkDrag = false);
-    virtual WebCore::DragImageRef createDragImageForLink(
-        WebCore::KURL&, const WTF::String& label, WebCore::Frame*);
     virtual void dragControllerDestroyed();
 
 private:
diff --git a/Source/WebKit/chromium/src/DragScrollTimer.cpp b/Source/WebKit/chromium/src/DragScrollTimer.cpp
index 83b81b7..c994cd7 100644
--- a/Source/WebKit/chromium/src/DragScrollTimer.cpp
+++ b/Source/WebKit/chromium/src/DragScrollTimer.cpp
@@ -43,12 +43,12 @@ static IntSize distanceToRect(const IntPoint& point, const IntRect& rect)
     int dx = 0, dy = 0;
     if (point.x() < rect.x())
         dx = point.x() - rect.x();
-    else if (rect.right() < point.x())
-        dx = point.x() - rect.right();
+    else if (rect.maxX() < point.x())
+        dx = point.x() - rect.maxX();
     if (point.y() < rect.y())
         dy = point.y() - rect.y();
-    else if (rect.bottom() < point.y())
-        dy = point.y() - rect.bottom();
+    else if (rect.maxY() < point.y())
+        dy = point.y() - rect.maxY();
     return IntSize(dx, dy);
 }
 
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.cpp b/Source/WebKit/chromium/src/EditorClientImpl.cpp
index 68694c2..3dc3a6a 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/EditorClientImpl.cpp
@@ -40,6 +40,7 @@
 #include "PlatformKeyboardEvent.h"
 #include "PlatformString.h"
 #include "RenderObject.h"
+#include "SpellChecker.h"
 
 #include "DOMUtilitiesPrivate.h"
 #include "WebAutoFillClient.h"
@@ -54,6 +55,7 @@
 #include "WebPasswordAutocompleteListener.h"
 #include "WebRange.h"
 #include "WebTextAffinity.h"
+#include "WebTextCheckingCompletionImpl.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
 
@@ -800,18 +802,6 @@ void EditorClientImpl::cancelPendingAutofill()
     m_autofillTimer.stop();
 }
 
-void EditorClientImpl::onAutocompleteSuggestionAccepted(HTMLInputElement* textField)
-{
-    if (m_webView->autoFillClient())
-        m_webView->autoFillClient()->didAcceptAutocompleteSuggestion(WebInputElement(textField));
-
-    WebFrameImpl* webframe = WebFrameImpl::fromFrame(textField->document()->frame());
-    if (!webframe)
-        return;
-
-    webframe->notifiyPasswordListenerOfAutocomplete(WebInputElement(textField));
-}
-
 bool EditorClientImpl::doTextFieldCommandFromEvent(Element* element,
                                                    KeyboardEvent* event)
 {
@@ -876,6 +866,11 @@ void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
         *misspellingLength = spellLength;
 }
 
+void EditorClientImpl::requestCheckingOfString(SpellChecker* sender, int identifier, const String& text)
+{
+    m_webView->client()->requestCheckingOfText(text, new WebTextCheckingCompletionImpl(identifier, sender));
+}
+
 String EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord)
 {
     if (!(isContinuousSpellCheckingEnabled() && m_webView->client()))
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.h b/Source/WebKit/chromium/src/EditorClientImpl.h
index 9dbd6af..8c40f3c 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.h
+++ b/Source/WebKit/chromium/src/EditorClientImpl.h
@@ -37,6 +37,7 @@
 
 namespace WebCore {
 class HTMLInputElement;
+class SpellChecker;
 }
 
 namespace WebKit {
@@ -111,7 +112,7 @@ public:
                                    WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&);
 
     // Shows the form autofill popup for |node| if it is an HTMLInputElement and
     // it is empty.  This is called when you press the up or down arrow in a
@@ -120,12 +121,6 @@ public:
     // otherwise.
     virtual bool showFormAutofillForNode(WebCore::Node*);
 
-    // Notification that the text changed due to acceptance of a suggestion
-    // provided by an Autocomplete popup.  Having a separate callback in this
-    // case is a simple way to break the cycle that would otherwise occur if
-    // textDidChangeInTextField was called.
-    virtual void onAutocompleteSuggestionAccepted(WebCore::HTMLInputElement*);
-
 private:
     void modifySelection(WebCore::Frame*, WebCore::KeyboardEvent*);
 
diff --git a/Source/WebKit/chromium/src/Extensions3DChromium.cpp b/Source/WebKit/chromium/src/Extensions3DChromium.cpp
index ca2215e..52c2e12 100644
--- a/Source/WebKit/chromium/src/Extensions3DChromium.cpp
+++ b/Source/WebKit/chromium/src/Extensions3DChromium.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "Extensions3DChromium.h"
 
@@ -62,6 +62,16 @@ int Extensions3DChromium::getGraphicsResetStatusARB()
     return m_internal->isContextLost() ? static_cast<int>(Extensions3D::UNKNOWN_CONTEXT_RESET_ARB) : static_cast<int>(GraphicsContext3D::NO_ERROR);
 }
 
+void Extensions3DChromium::blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter)
+{
+    m_internal->blitFramebufferCHROMIUM(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask, filter);
+}
+
+void Extensions3DChromium::renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_internal->renderbufferStorageMultisampleCHROMIUM(target, samples, internalformat, width, height);
+}
+
 void* Extensions3DChromium::mapBufferSubDataCHROMIUM(unsigned target, int offset, int size, unsigned access)
 {
     return m_internal->mapBufferSubDataCHROMIUM(target, offset, size, access);
@@ -89,4 +99,4 @@ void Extensions3DChromium::copyTextureToParentTextureCHROMIUM(unsigned texture,
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebKit/chromium/src/ExternalPopupMenu.cpp b/Source/WebKit/chromium/src/ExternalPopupMenu.cpp
index f7f9862..5808003 100644
--- a/Source/WebKit/chromium/src/ExternalPopupMenu.cpp
+++ b/Source/WebKit/chromium/src/ExternalPopupMenu.cpp
@@ -128,10 +128,10 @@ void ExternalPopupMenu::didCancel()
 void ExternalPopupMenu::getPopupMenuInfo(WebPopupMenuInfo* info)
 {
     int itemCount = m_popupMenuClient->listSize();
-    WebVector<WebPopupMenuInfo::Item> items(
+    WebVector<WebMenuItemInfo> items(
         static_cast<size_t>(itemCount));
     for (int i = 0; i < itemCount; ++i) {
-        WebPopupMenuInfo::Item& popupItem = items[i];
+        WebMenuItemInfo& popupItem = items[i];
         popupItem.label = m_popupMenuClient->itemText(i);
         if (m_popupMenuClient->itemIsSeparator(i))
             popupItem.type = WebMenuItemInfo::Separator;
@@ -140,9 +140,15 @@ void ExternalPopupMenu::getPopupMenuInfo(WebPopupMenuInfo* info)
         else
             popupItem.type = WebMenuItemInfo::Option;
         popupItem.enabled = m_popupMenuClient->itemIsEnabled(i);
+        PopupMenuStyle style = m_popupMenuClient->itemStyle(i);
+        if (style.textDirection() == WebCore::RTL)
+            popupItem.textDirection = WebTextDirectionRightToLeft;
+        else
+            popupItem.textDirection = WebTextDirectionLeftToRight;
+        popupItem.hasTextDirectionOverride = style.hasTextDirectionOverride();
     }
 
-    info->itemHeight = m_popupMenuClient->menuStyle().font().height();
+    info->itemHeight = m_popupMenuClient->menuStyle().font().fontMetrics().height();
     info->itemFontSize =
         static_cast<int>(m_popupMenuClient->menuStyle().font().size());
     info->selectedIndex = m_popupMenuClient->selectedIndex();
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index b767450..34c53cf 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -1099,7 +1099,7 @@ void FrameLoaderClientImpl::finishedLoading(DocumentLoader* dl)
         // However, we only want to do this if makeRepresentation has been called, to
         // match the behavior on the Mac.
         if (m_hasRepresentation)
-            dl->frameLoader()->writer()->setEncoding("", false);
+            dl->writer()->setEncoding("", false);
     }
 }
 
@@ -1153,10 +1153,10 @@ void FrameLoaderClientImpl::didDisplayInsecureContent()
         m_webFrame->client()->didDisplayInsecureContent(m_webFrame);
 }
 
-void FrameLoaderClientImpl::didRunInsecureContent(SecurityOrigin* origin)
+void FrameLoaderClientImpl::didRunInsecureContent(SecurityOrigin* origin, const KURL& insecureURL)
 {
     if (m_webFrame->client())
-        m_webFrame->client()->didRunInsecureContent(m_webFrame, WebSecurityOrigin(origin));
+        m_webFrame->client()->didRunInsecureContent(m_webFrame, WebSecurityOrigin(origin), insecureURL);
 }
 
 ResourceError FrameLoaderClientImpl::blockedError(const ResourceRequest&)
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 1d7a741..925b759 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -142,7 +142,7 @@ public:
     virtual void dispatchDidRemoveBackForwardItem(WebCore::HistoryItem*) const;
     virtual void dispatchDidChangeBackForwardIndex() const;
     virtual void didDisplayInsecureContent();
-    virtual void didRunInsecureContent(WebCore::SecurityOrigin*);
+    virtual void didRunInsecureContent(WebCore::SecurityOrigin*, const WebCore::KURL& insecureURL);
     virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&);
     virtual WebCore::ResourceError cancelledError(const WebCore::ResourceRequest&);
     virtual WebCore::ResourceError cannotShowURLError(const WebCore::ResourceRequest&);
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index 8148ff6..0751785 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
 
@@ -205,7 +205,7 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
         // We need to draw the resizing bitmap into the canvas's backing store.
         SkCanvas canvas(*canvasBitmap);
         SkRect dst;
-        dst.set(SkIntToScalar(0), SkIntToScalar(0), canvasBitmap->width(), canvasBitmap->height());
+        dst.set(SkIntToScalar(0), SkIntToScalar(0), SkIntToScalar(canvasBitmap->width()), SkIntToScalar(canvasBitmap->height()));
         canvas.drawBitmapRect(m_resizingBitmap, 0, dst);
     }
 #elif PLATFORM(CG)
@@ -364,8 +364,13 @@ rt GraphicsContext3DInternal::name(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6, t7
     return m_impl->name(a1, a2, a3, a4, a5, a6, a7, a8, a9);   \
 }
 
+#define DELEGATE_TO_IMPL_10(name, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10) \
+void GraphicsContext3DInternal::name(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6, t7 a7, t8 a8, t9 a9, t10 a10) \
+{ \
+    m_impl->name(a1, a2, a3, a4, a5, a6, a7, a8, a9, a10); \
+}
+
 DELEGATE_TO_IMPL_R(makeContextCurrent, bool)
-DELEGATE_TO_IMPL_1R(sizeInBytes, GC3Denum, unsigned int)
 
 bool GraphicsContext3DInternal::isGLES2Compliant() const
 {
@@ -692,6 +697,14 @@ void splitStringHelper(const String& str, HashSet<String>& set)
         set.add(substrings[i]);
 }
 
+String mapExtensionName(const String& name)
+{
+    if (name == "GL_ANGLE_framebuffer_blit"
+        || name == "GL_ANGLE_framebuffer_multisample")
+        return "GL_CHROMIUM_framebuffer_multisample";
+    return name;
+}
+
 } // anonymous namespace
 
 void GraphicsContext3DInternal::initializeExtensions()
@@ -711,25 +724,27 @@ void GraphicsContext3DInternal::initializeExtensions()
 bool GraphicsContext3DInternal::supportsExtension(const String& name)
 {
     initializeExtensions();
-    return m_enabledExtensions.contains(name) || m_requestableExtensions.contains(name);
+    String mappedName = mapExtensionName(name);
+    return m_enabledExtensions.contains(mappedName) || m_requestableExtensions.contains(mappedName);
 }
 
 bool GraphicsContext3DInternal::ensureExtensionEnabled(const String& name)
 {
     initializeExtensions();
 
-    if (m_enabledExtensions.contains(name))
+    String mappedName = mapExtensionName(name);
+    if (m_enabledExtensions.contains(mappedName))
         return true;
 
-    if (m_requestableExtensions.contains(name)) {
-        m_impl->requestExtensionCHROMIUM(name.ascii().data());
+    if (m_requestableExtensions.contains(mappedName)) {
+        m_impl->requestExtensionCHROMIUM(mappedName.ascii().data());
         m_enabledExtensions.clear();
         m_requestableExtensions.clear();
         m_initializedAvailableExtensions = false;
     }
 
     initializeExtensions();
-    return m_enabledExtensions.contains(name);
+    return m_enabledExtensions.contains(mappedName);
 }
 
 DELEGATE_TO_IMPL_4R(mapBufferSubDataCHROMIUM, GC3Denum, GC3Dsizeiptr, GC3Dsizei, GC3Denum, void*)
@@ -737,6 +752,8 @@ DELEGATE_TO_IMPL_1(unmapBufferSubDataCHROMIUM, const void*)
 DELEGATE_TO_IMPL_9R(mapTexSubImage2DCHROMIUM, GC3Denum, GC3Dint, GC3Dint, GC3Dint, GC3Dsizei, GC3Dsizei, GC3Denum, GC3Denum, GC3Denum, void*)
 DELEGATE_TO_IMPL_1(unmapTexSubImage2DCHROMIUM, const void*)
 DELEGATE_TO_IMPL_2(copyTextureToParentTextureCHROMIUM, Platform3DObject, Platform3DObject)
+DELEGATE_TO_IMPL_10(blitFramebufferCHROMIUM, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dbitfield, GC3Denum)
+DELEGATE_TO_IMPL_5(renderbufferStorageMultisampleCHROMIUM, GC3Denum, GC3Dsizei, GC3Denum, GC3Dsizei, GC3Dsizei)
 
 //----------------------------------------------------------------------
 // GraphicsContext3D
@@ -897,7 +914,6 @@ PlatformLayer* GraphicsContext3D::platformLayer() const
 #endif
 
 DELEGATE_TO_INTERNAL(makeContextCurrent)
-DELEGATE_TO_INTERNAL_1R(sizeInBytes, GC3Denum, unsigned int)
 DELEGATE_TO_INTERNAL_2(reshape, int, int)
 DELEGATE_TO_INTERNAL_R(getInternalFramebufferSize, IntSize)
 
@@ -1066,6 +1082,35 @@ DELEGATE_TO_INTERNAL_1(deleteTexture, Platform3DObject)
 DELEGATE_TO_INTERNAL_1(synthesizeGLError, GC3Denum)
 DELEGATE_TO_INTERNAL_R(getExtensions, Extensions3D*)
 
+DELEGATE_TO_INTERNAL_1(setContextLostCallback, PassOwnPtr<GraphicsContext3D::ContextLostCallback>)
+
+class GraphicsContextLostCallbackAdapter : public WebKit::WebGraphicsContext3D::WebGraphicsContextLostCallback {
+public:
+    virtual void onContextLost();
+    static PassOwnPtr<GraphicsContextLostCallbackAdapter> create(PassOwnPtr<GraphicsContext3D::ContextLostCallback>);
+    virtual ~GraphicsContextLostCallbackAdapter() {}
+private:
+    GraphicsContextLostCallbackAdapter(PassOwnPtr<GraphicsContext3D::ContextLostCallback> cb) : m_contextLostCallback(cb) {}
+    OwnPtr<GraphicsContext3D::ContextLostCallback> m_contextLostCallback;
+};
+
+void GraphicsContextLostCallbackAdapter::onContextLost()
+{
+    if (m_contextLostCallback)
+        m_contextLostCallback->onContextLost();
+}
+
+PassOwnPtr<GraphicsContextLostCallbackAdapter> GraphicsContextLostCallbackAdapter::create(PassOwnPtr<GraphicsContext3D::ContextLostCallback> cb)
+{
+    return adoptPtr(new GraphicsContextLostCallbackAdapter(cb));
+}
+
+void GraphicsContext3DInternal::setContextLostCallback(PassOwnPtr<GraphicsContext3D::ContextLostCallback> cb)
+{
+    m_contextLostCallbackAdapter = GraphicsContextLostCallbackAdapter::create(cb);
+    m_impl->setContextLostCallback(m_contextLostCallbackAdapter.get());
+}
+
 bool GraphicsContext3D::isGLES2Compliant() const
 {
     return m_internal->isGLES2Compliant();
@@ -1073,4 +1118,4 @@ bool GraphicsContext3D::isGLES2Compliant() const
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DInternal.h b/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
index 30a8e57..be9ce16 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
+++ b/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
@@ -44,6 +44,7 @@ class Extensions3DChromium;
 #if USE(ACCELERATED_COMPOSITING)
 class WebGLLayerChromium;
 #endif
+class GraphicsContextLostCallbackAdapter;
 
 class GraphicsContext3DInternal {
 public:
@@ -62,8 +63,6 @@ public:
 
     bool makeContextCurrent();
 
-    unsigned int sizeInBytes(GC3Denum type);
-
     void reshape(int width, int height);
     IntSize getInternalFramebufferSize();
 
@@ -241,6 +240,8 @@ public:
 
     void synthesizeGLError(GC3Denum error);
 
+    void setContextLostCallback(PassOwnPtr<GraphicsContext3D::ContextLostCallback>);
+
     // Extensions3D support.
     Extensions3D* getExtensions();
     bool supportsExtension(const String& name);
@@ -260,9 +261,14 @@ public:
     bool supportsCopyTextureToParentTextureCHROMIUM();
     void copyTextureToParentTextureCHROMIUM(Platform3DObject texture, Platform3DObject parentTexture);
 
+    // GL_CHROMIUM_framebuffer_multisample
+    void blitFramebufferCHROMIUM(GC3Dint srcX0, GC3Dint srcY0, GC3Dint srcX1, GC3Dint srcY1, GC3Dint dstX0, GC3Dint dstY0, GC3Dint dstX1, GC3Dint dstY1, GC3Dbitfield mask, GC3Denum filter);
+    void renderbufferStorageMultisampleCHROMIUM(GC3Denum target, GC3Dsizei samples, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height);
+
 private:
     OwnPtr<WebKit::WebGraphicsContext3D> m_impl;
     OwnPtr<Extensions3DChromium> m_extensions;
+    OwnPtr<GraphicsContextLostCallbackAdapter> m_contextLostCallbackAdapter;
     WebKit::WebViewImpl* m_webViewImpl;
     bool m_initializedAvailableExtensions;
     HashSet<String> m_enabledExtensions;
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 69051d0..dba28d9 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -62,55 +62,41 @@ IDBCallbacksProxy::~IDBCallbacksProxy()
 void IDBCallbacksProxy::onError(PassRefPtr<IDBDatabaseError> idbDatabaseError)
 {
     m_callbacks->onError(WebKit::WebIDBDatabaseError(idbDatabaseError));
-    m_callbacks.clear();
-}
-
-void IDBCallbacksProxy::onSuccess()
-{
-    m_callbacks->onSuccess();
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBCursorBackendInterface> idbCursorBackend)
 {
     m_callbacks->onSuccess(new WebKit::WebIDBCursorImpl(idbCursorBackend));
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
     m_callbacks->onSuccess(new WebKit::WebIDBDatabaseImpl(backend));
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBIndexBackendInterface> backend)
 {
     m_callbacks->onSuccess(new WebKit::WebIDBIndexImpl(backend));
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     m_callbacks->onSuccess(WebKit::WebIDBKey(idbKey));
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBObjectStoreBackendInterface> backend)
 {
     m_callbacks->onSuccess(new WebKit::WebIDBObjectStoreImpl(backend));
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBTransactionBackendInterface> backend)
 {
     m_callbacks->onSuccess(new WebKit::WebIDBTransactionImpl(backend));
-    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
     m_callbacks->onSuccess(WebKit::WebSerializedScriptValue(serializedScriptValue));
-    m_callbacks.clear();
 }
 
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.h b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
index 8c26161..e1db23d 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -48,7 +48,6 @@ public:
     virtual ~IDBCallbacksProxy();
 
     virtual void onError(PassRefPtr<IDBDatabaseError>);
-    virtual void onSuccess(); // For "null".
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
diff --git a/Source/WebKit/chromium/src/IDBDatabaseProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseProxy.cpp
index f070d64..6355a2a 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseProxy.cpp
@@ -95,10 +95,10 @@ void IDBDatabaseProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks
     m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode& ec)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode& ec)
 {
     WebKit::WebDOMStringList names(storeNames);
-    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, timeout, ec);
+    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, ec);
     if (!transaction) {
         ASSERT(ec);
         return 0;
diff --git a/Source/WebKit/chromium/src/IDBDatabaseProxy.h b/Source/WebKit/chromium/src/IDBDatabaseProxy.h
index c51a604..2ceb77e 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseProxy.h
@@ -49,7 +49,7 @@ public:
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&);
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode&);
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode&);
     virtual void close();
 
 private:
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreProxy.cpp
index e03cdc8..d6871e0 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreProxy.cpp
@@ -80,12 +80,12 @@ void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> c
     m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->put(value, key, addOnly, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
+    m_webIDBObjectStore->put(value, key, static_cast<WebKit::WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
 void IDBObjectStoreProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
@@ -96,6 +96,14 @@ void IDBObjectStoreProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBC
     m_webIDBObjectStore->deleteFunction(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
+void IDBObjectStoreProxy::clear(PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->clear(new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
+}
+
 PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreProxy.h
index 348c794..a6e3748 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreProxy.h
+++ b/Source/WebKit/chromium/src/IDBObjectStoreProxy.h
@@ -47,8 +47,9 @@ public:
     virtual PassRefPtr<DOMStringList> indexNames() const;
 
     virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&);
     PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
@@ -67,4 +68,3 @@ private:
 #endif
 
 #endif // IDBObjectStoreProxy_h
-
diff --git a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
index 3a19fe2..ebda1dd 100644
--- a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
@@ -52,19 +52,11 @@ IDBTransactionCallbacksProxy::~IDBTransactionCallbacksProxy()
 void IDBTransactionCallbacksProxy::onAbort()
 {
     m_callbacks->onAbort();
-    m_callbacks.clear();
 }
 
 void IDBTransactionCallbacksProxy::onComplete()
 {
     m_callbacks->onComplete();
-    m_callbacks.clear();
-}
-
-void IDBTransactionCallbacksProxy::onTimeout()
-{
-    m_callbacks->onTimeout();
-    m_callbacks.clear();
 }
 
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
index 891d5c9..79c32f6 100644
--- a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
@@ -47,7 +47,6 @@ public:
 
     virtual void onAbort();
     virtual void onComplete();
-    virtual void onTimeout();
 
 private:
     IDBTransactionCallbacksProxy(PassOwnPtr<WebKit::WebIDBTransactionCallbacks>);
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.cpp b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
index 77150bb..1ed5284 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
@@ -81,18 +81,6 @@ void InspectorClientImpl::hideHighlight()
         agent->hideHighlight();
 }
 
-void InspectorClientImpl::populateSetting(const String& key, String* value)
-{
-    if (WebDevToolsAgentImpl* agent = devToolsAgent())
-        agent->populateSetting(key, value);
-}
-
-void InspectorClientImpl::storeSetting(const String& key, const String& value)
-{
-    if (WebDevToolsAgentImpl* agent = devToolsAgent())
-        agent->storeSetting(key, value);
-}
-
 bool InspectorClientImpl::sendMessageToFrontend(const WTF::String& message)
 {
     if (WebDevToolsAgentImpl* agent = devToolsAgent())
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.h b/Source/WebKit/chromium/src/InspectorClientImpl.h
index 78d34e3..cc91454 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.h
@@ -53,9 +53,6 @@ public:
     virtual void highlight(WebCore::Node*);
     virtual void hideHighlight();
 
-    virtual void populateSetting(const WTF::String& key, WTF::String* value);
-    virtual void storeSetting(const WTF::String& key, const WTF::String& value);
-
     virtual bool sendMessageToFrontend(const WTF::String&);
 
     virtual void updateInspectorStateCookie(const WTF::String&);
diff --git a/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp b/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp
index a9c61d0..ae2eb1d 100644
--- a/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp
@@ -62,7 +62,7 @@ void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileS
     ASSERT(context && context->isDocument());
     Document* document = static_cast<Document*>(context);
     WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
-    webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), size, false, new WebFileSystemCallbacksImpl(callbacks));
+    webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), size, false, new WebFileSystemCallbacksImpl(callbacks, type));
 }
 
 void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous)
@@ -71,12 +71,12 @@ void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFi
     if (context->isDocument()) {
         Document* document = static_cast<Document*>(context);
         WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
-        webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), size, true, new WebFileSystemCallbacksImpl(callbacks));
+        webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), size, true, new WebFileSystemCallbacksImpl(callbacks, type));
     } else {
         WorkerContext* workerContext = static_cast<WorkerContext*>(context);
         WorkerLoaderProxy* workerLoaderProxy = &workerContext->thread()->workerLoaderProxy();
         WebWorkerBase* webWorker = static_cast<WebWorkerBase*>(workerLoaderProxy);
-        webWorker->openFileSystem(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks, context, synchronous), synchronous);
+        webWorker->openFileSystem(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks, type, context, synchronous), synchronous);
     }
 }
 
diff --git a/Source/WebKit/chromium/src/PlatformBridge.cpp b/Source/WebKit/chromium/src/PlatformBridge.cpp
index 04016fc..b09d150 100644
--- a/Source/WebKit/chromium/src/PlatformBridge.cpp
+++ b/Source/WebKit/chromium/src/PlatformBridge.cpp
@@ -132,6 +132,14 @@ static WebWidgetClient* toWebWidgetClient(Widget* widget)
     return chromeClientImpl->webView()->client();
 }
 
+static WebClipboard* getClipboard(const Frame* frame)
+{
+    WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(frame);
+    if (!frameImpl || !frameImpl->client())
+        return 0;
+    return frameImpl->client()->clipboard();
+}
+
 static WebCookieJar* getCookieJar(const Document* document)
 {
     WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(document->frame());
@@ -217,9 +225,15 @@ void PlatformBridge::clipboardWriteData(const String& type,
 }
 
 HashSet<String> PlatformBridge::clipboardReadAvailableTypes(
-    PasteboardPrivate::ClipboardBuffer buffer, bool* containsFilenames)
+    const Frame* frame,
+    PasteboardPrivate::ClipboardBuffer buffer,
+    bool* containsFilenames)
 {
-    WebVector<WebString> result = webKitClient()->clipboard()->readAvailableTypes(
+    WebClipboard* clipboard = getClipboard(frame);
+    if (!clipboard)
+        return HashSet<String>();
+
+    WebVector<WebString> result = clipboard->readAvailableTypes(
         static_cast<WebClipboard::Buffer>(buffer), containsFilenames);
     HashSet<String> types;
     for (size_t i = 0; i < result.size(); ++i)
@@ -227,12 +241,19 @@ HashSet<String> PlatformBridge::clipboardReadAvailableTypes(
     return types;
 }
 
-bool PlatformBridge::clipboardReadData(PasteboardPrivate::ClipboardBuffer buffer,
-                                       const String& type, String& data, String& metadata)
+bool PlatformBridge::clipboardReadData(const Frame* frame,
+                                       PasteboardPrivate::ClipboardBuffer buffer,
+                                       const String& type,
+                                       String& data,
+                                       String& metadata)
 {
+    WebClipboard* clipboard = getClipboard(frame);
+    if (!clipboard)
+        return false;
+
     WebString resultData;
     WebString resultMetadata;
-    bool succeeded = webKitClient()->clipboard()->readData(
+    bool succeeded = clipboard->readData(
         static_cast<WebClipboard::Buffer>(buffer), type, &resultData, &resultMetadata);
     if (succeeded) {
         data = resultData;
@@ -241,9 +262,14 @@ bool PlatformBridge::clipboardReadData(PasteboardPrivate::ClipboardBuffer buffer
     return succeeded;
 }
 
-Vector<String> PlatformBridge::clipboardReadFilenames(PasteboardPrivate::ClipboardBuffer buffer)
+Vector<String> PlatformBridge::clipboardReadFilenames(const Frame* frame,
+                                                      PasteboardPrivate::ClipboardBuffer buffer)
 {
-    WebVector<WebString> result = webKitClient()->clipboard()->readFilenames(
+    WebClipboard* clipboard = getClipboard(frame);
+    if (!clipboard)
+        return Vector<String>();
+
+    WebVector<WebString> result = clipboard->readFilenames(
         static_cast<WebClipboard::Buffer>(buffer));
     Vector<String> convertedResult;
     for (size_t i = 0; i < result.size(); ++i)
@@ -509,12 +535,6 @@ PassRefPtr<IDBFactoryBackendInterface> PlatformBridge::idbFactory()
     return IDBFactoryBackendProxy::create();
 }
 
-void PlatformBridge::idbShutdown()
-{
-    // In the browser process, this shuts down the utility process. In the renderer process, it does nothing.
-    webKitClient()->idbShutdown();
-}
-
 void PlatformBridge::createIDBKeysFromSerializedValuesAndKeyPath(const Vector<RefPtr<SerializedScriptValue> >& values, const String& keyPath, Vector<RefPtr<IDBKey> >& keys)
 {
     WebVector<WebSerializedScriptValue> webValues = values;
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 11ce797..6329d76 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -64,23 +64,7 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 
-using WebCore::DocumentLoader;
-using WebCore::FrameLoader;
-using WebCore::InjectedScriptHost;
-using WebCore::InspectorArray;
-using WebCore::InspectorBackendDispatcher;
-using WebCore::InspectorController;
-using WebCore::InspectorInstrumentation;
-using WebCore::InspectorInstrumentationCookie;
-using WebCore::Node;
-using WebCore::Page;
-using WebCore::ResourceError;
-using WebCore::ResourceRequest;
-using WebCore::ResourceResponse;
-using WTF::String;
-using WebCore::V8DOMWrapper;
-using WebCore::V8Node;
-using WebCore::V8Proxy;
+using namespace WebCore;
 
 namespace WebKit {
 
@@ -89,14 +73,14 @@ namespace {
 static const char kFrontendConnectedFeatureName[] = "frontend-connected";
 static const char kInspectorStateFeatureName[] = "inspector-state";
 
-class ClientMessageLoopAdapter : public WebCore::ScriptDebugServer::ClientMessageLoop {
+class ClientMessageLoopAdapter : public ScriptDebugServer::ClientMessageLoop {
 public:
     static void ensureClientMessageLoopCreated(WebDevToolsAgentClient* client)
     {
         if (s_instance)
             return;
         s_instance = new ClientMessageLoopAdapter(client->createClientMessageLoop());
-        WebCore::ScriptDebugServer::shared().setClientMessageLoop(s_instance);
+        ScriptDebugServer::shared().setClientMessageLoop(s_instance);
     }
 
     static void inspectedViewClosed(WebViewImpl* view)
@@ -109,7 +93,7 @@ public:
     {
         // Release render thread if necessary.
         if (s_instance && s_instance->m_running)
-            WebCore::ScriptDebugServer::shared().continueProgram();
+            ScriptDebugServer::shared().continueProgram();
     }
 
 private:
@@ -204,8 +188,8 @@ void WebDevToolsAgentImpl::attach()
     m_debuggerAgentImpl.set(
         new DebuggerAgentImpl(m_webViewImpl, this, m_client));
     WebCString debuggerScriptJs = m_client->debuggerScriptSource();
-    WebCore::ScriptDebugServer::shared().setDebuggerScriptSource(
-        WTF::String(debuggerScriptJs.data(), debuggerScriptJs.length()));
+    ScriptDebugServer::shared().setDebuggerScriptSource(
+        String(debuggerScriptJs.data(), debuggerScriptJs.length()));
     m_attached = true;
 }
 
@@ -238,7 +222,7 @@ void WebDevToolsAgentImpl::didClearWindowObject(WebFrameImpl* webframe)
 
 void WebDevToolsAgentImpl::dispatchOnInspectorBackend(const WebString& message)
 {
-    inspectorController()->inspectorBackendDispatcher()->dispatch(message);
+    inspectorController()->dispatchMessageFromFrontend(message);
 }
 
 void WebDevToolsAgentImpl::inspectElementAt(const WebPoint& point)
@@ -249,7 +233,7 @@ void WebDevToolsAgentImpl::inspectElementAt(const WebPoint& point)
 void WebDevToolsAgentImpl::inspectNode(v8::Handle<v8::Value> node)
 {
     if (!V8Node::HasInstance(node))
-        V8Proxy::setDOMException(WebCore::TYPE_MISMATCH_ERR);
+        V8Proxy::setDOMException(TYPE_MISMATCH_ERR);
     else
         inspectorController()->inspect(V8Node::toNative(v8::Handle<v8::Object>::Cast(node)));
 }
@@ -262,14 +246,14 @@ void WebDevToolsAgentImpl::setRuntimeProperty(const WebString& name, const WebSt
     }
 }
 
-WebCore::InspectorController* WebDevToolsAgentImpl::inspectorController()
+InspectorController* WebDevToolsAgentImpl::inspectorController()
 {
     if (Page* page = m_webViewImpl->page())
         return page->inspectorController();
     return 0;
 }
 
-WebCore::Frame* WebDevToolsAgentImpl::mainFrame()
+Frame* WebDevToolsAgentImpl::mainFrame()
 {
     if (Page* page = m_webViewImpl->page())
         return page->mainFrame();
@@ -284,7 +268,7 @@ void WebDevToolsAgentImpl::identifierForInitialRequest(
     const WebURLRequest& request)
 {
     WebFrameImpl* webFrameImpl = static_cast<WebFrameImpl*>(webFrame);
-    WebCore::Frame* frame = webFrameImpl->frame();
+    Frame* frame = webFrameImpl->frame();
     DocumentLoader* loader = frame->loader()->activeDocumentLoader();
     InspectorInstrumentation::identifierForInitialRequest(frame, resourceId, loader, request.toResourceRequest());
 }
@@ -348,19 +332,7 @@ void WebDevToolsAgentImpl::hideHighlight()
         m_webViewImpl->client()->didInvalidateRect(damagedRect);
 }
 
-void WebDevToolsAgentImpl::populateSetting(const String& key, String* value)
-{
-    WebString string;
-    m_webViewImpl->inspectorSetting(key, &string);
-    *value = string;
-}
-
-void WebDevToolsAgentImpl::storeSetting(const String& key, const String& value)
-{
-    m_webViewImpl->setInspectorSetting(key, value);
-}
-
-bool WebDevToolsAgentImpl::sendMessageToFrontend(const WTF::String& message)
+bool WebDevToolsAgentImpl::sendMessageToFrontend(const String& message)
 {
     WebDevToolsAgentImpl* devToolsAgent = static_cast<WebDevToolsAgentImpl*>(m_webViewImpl->devToolsAgent());
     if (!devToolsAgent)
@@ -370,7 +342,7 @@ bool WebDevToolsAgentImpl::sendMessageToFrontend(const WTF::String& message)
     return true;
 }
 
-void WebDevToolsAgentImpl::updateInspectorStateCookie(const WTF::String& state)
+void WebDevToolsAgentImpl::updateInspectorStateCookie(const String& state)
 {
     m_client->runtimePropertyChanged(kInspectorStateFeatureName, state);
 }
@@ -402,7 +374,7 @@ void WebDevToolsAgent::debuggerPauseScript()
 
 void WebDevToolsAgent::interruptAndDispatch(MessageDescriptor* d)
 {
-    class DebuggerTask : public WebCore::ScriptDebugServer::Task {
+    class DebuggerTask : public ScriptDebugServer::Task {
     public:
         DebuggerTask(WebDevToolsAgent::MessageDescriptor* descriptor) : m_descriptor(descriptor) { }
         virtual ~DebuggerTask() { }
@@ -414,7 +386,7 @@ void WebDevToolsAgent::interruptAndDispatch(MessageDescriptor* d)
     private:
         OwnPtr<WebDevToolsAgent::MessageDescriptor> m_descriptor;
     };
-    WebCore::ScriptDebugServer::interruptAndRun(new DebuggerTask(d));
+    ScriptDebugServer::interruptAndRun(new DebuggerTask(d));
 }
 
 bool WebDevToolsAgent::shouldInterruptForMessage(const WebString& message)
@@ -422,19 +394,19 @@ bool WebDevToolsAgent::shouldInterruptForMessage(const WebString& message)
     String commandName;
     if (!InspectorBackendDispatcher::getCommandName(message, &commandName))
         return false;
-    return commandName == InspectorBackendDispatcher::pauseCmd
-        || commandName == InspectorBackendDispatcher::setBreakpointCmd
-        || commandName == InspectorBackendDispatcher::removeBreakpointCmd
-        || commandName == InspectorBackendDispatcher::activateBreakpointsCmd
-        || commandName == InspectorBackendDispatcher::deactivateBreakpointsCmd
-        || commandName == InspectorBackendDispatcher::startProfilingCmd
-        || commandName == InspectorBackendDispatcher::stopProfilingCmd
-        || commandName == InspectorBackendDispatcher::getProfileCmd;
+    return commandName == InspectorBackendDispatcher::Debugger_pauseCmd
+        || commandName == InspectorBackendDispatcher::Debugger_setJavaScriptBreakpointCmd
+        || commandName == InspectorBackendDispatcher::Debugger_removeJavaScriptBreakpointCmd
+        || commandName == InspectorBackendDispatcher::Debugger_activateBreakpointsCmd
+        || commandName == InspectorBackendDispatcher::Debugger_deactivateBreakpointsCmd
+        || commandName == InspectorBackendDispatcher::Inspector_startProfilingCmd
+        || commandName == InspectorBackendDispatcher::Inspector_stopProfilingCmd
+        || commandName == InspectorBackendDispatcher::Profiler_getProfileCmd;
 }
 
 void WebDevToolsAgent::processPendingMessages()
 {
-    WebCore::ScriptDebugServer::shared().runPendingTasks();
+    ScriptDebugServer::shared().runPendingTasks();
 }
 
 void WebDevToolsAgent::setMessageLoopDispatchHandler(MessageLoopDispatchHandler handler)
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
index 681eedb..2bc197d 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
@@ -93,8 +93,6 @@ public:
     virtual void openInspectorFrontend(WebCore::InspectorController*);
     virtual void highlight(WebCore::Node*);
     virtual void hideHighlight();
-    virtual void populateSetting(const WTF::String& key, WTF::String* value);
-    virtual void storeSetting(const WTF::String& key, const WTF::String& value);
     virtual void updateInspectorStateCookie(const WTF::String&);
     virtual bool sendMessageToFrontend(const WTF::String&);
 
diff --git a/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
index 52a4032..0c71f80 100644
--- a/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
@@ -36,8 +36,9 @@
 #include "AsyncFileSystemChromium.h"
 #include "FileMetadata.h"
 #include "ScriptExecutionContext.h"
-#include "WebFileSystemEntry.h"
 #include "WebFileInfo.h"
+#include "WebFileSystem.h"
+#include "WebFileSystemEntry.h"
 #include "WebString.h"
 #include "WorkerAsyncFileSystemChromium.h"
 #include <wtf/Vector.h>
@@ -46,8 +47,9 @@ using namespace WebCore;
 
 namespace WebKit {
 
-WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl(PassOwnPtr<AsyncFileSystemCallbacks> callbacks, WebCore::ScriptExecutionContext* context, bool synchronous)
+WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl(PassOwnPtr<AsyncFileSystemCallbacks> callbacks, AsyncFileSystem::Type type, WebCore::ScriptExecutionContext* context, bool synchronous)
     : m_callbacks(callbacks)
+    , m_type(type)
     , m_context(context)
     , m_synchronous(synchronous)
 {
@@ -85,9 +87,9 @@ void WebFileSystemCallbacksImpl::didReadDirectory(const WebVector<WebFileSystemE
 void WebFileSystemCallbacksImpl::didOpenFileSystem(const WebString& name, const WebString& path)
 {
     if (m_context && m_context->isWorkerContext())
-        m_callbacks->didOpenFileSystem(name, WorkerAsyncFileSystemChromium::create(m_context, path, m_synchronous));
+        m_callbacks->didOpenFileSystem(name, WorkerAsyncFileSystemChromium::create(m_context, m_type, path, m_synchronous));
     else
-        m_callbacks->didOpenFileSystem(name, AsyncFileSystemChromium::create(path));
+        m_callbacks->didOpenFileSystem(name, AsyncFileSystemChromium::create(m_type, path));
     delete this;
 }
 
diff --git a/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.h b/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
index 75fa2bb..3e2192e 100644
--- a/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
@@ -31,6 +31,8 @@
 #ifndef WebFileSystemCallbacksImpl_h
 #define WebFileSystemCallbacksImpl_h
 
+#include "AsyncFileSystem.h"
+#include "WebFileSystem.h"
 #include "WebFileSystemCallbacks.h"
 #include "WebVector.h"
 #include <wtf/OwnPtr.h>
@@ -49,7 +51,7 @@ class WebString;
 
 class WebFileSystemCallbacksImpl : public WebFileSystemCallbacks {
 public:
-    WebFileSystemCallbacksImpl(PassOwnPtr<WebCore::AsyncFileSystemCallbacks>, WebCore::ScriptExecutionContext* = 0, bool synchronous = false);
+    WebFileSystemCallbacksImpl(PassOwnPtr<WebCore::AsyncFileSystemCallbacks>, WebCore::AsyncFileSystem::Type = WebCore::AsyncFileSystem::Temporary, WebCore::ScriptExecutionContext* = 0, bool synchronous = false);
     virtual ~WebFileSystemCallbacksImpl();
 
     virtual void didSucceed();
@@ -61,6 +63,9 @@ public:
 private:
     OwnPtr<WebCore::AsyncFileSystemCallbacks> m_callbacks;
 
+    // Used for openFileSystem callbacks.
+    WebCore::AsyncFileSystem::Type m_type;
+
     // Used for worker's openFileSystem callbacks.
     WebCore::ScriptExecutionContext* m_context;
     bool m_synchronous;
diff --git a/Source/WebKit/chromium/src/WebFontImpl.cpp b/Source/WebKit/chromium/src/WebFontImpl.cpp
index e1fa0e7..d3555f2 100644
--- a/Source/WebKit/chromium/src/WebFontImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFontImpl.cpp
@@ -34,7 +34,7 @@
 #include "Font.h"
 #include "FontDescription.h"
 #include "GraphicsContext.h"
-#include "PlatformContextSkia.h"
+#include "painting/GraphicsContextBuilder.h"
 #include "TextRun.h"
 #include "WebFloatPoint.h"
 #include "WebFloatRect.h"
@@ -64,27 +64,27 @@ WebFontDescription WebFontImpl::fontDescription() const
 
 int WebFontImpl::ascent() const
 {
-    return m_font.ascent();
+    return m_font.fontMetrics().ascent();
 }
 
 int WebFontImpl::descent() const
 {
-    return m_font.descent();
+    return m_font.fontMetrics().descent();
 }
 
 int WebFontImpl::height() const
 {
-    return m_font.height();
+    return m_font.fontMetrics().height();
 }
 
 int WebFontImpl::lineSpacing() const
 {
-    return m_font.lineSpacing();
+    return m_font.fontMetrics().lineSpacing();
 }
 
 float WebFontImpl::xHeight() const
 {
-    return m_font.xHeight();
+    return m_font.fontMetrics().xHeight();
 }
 
 void WebFontImpl::drawText(WebCanvas* canvas, const WebTextRun& run, const WebFloatPoint& leftBaseline,
@@ -94,15 +94,9 @@ void WebFontImpl::drawText(WebCanvas* canvas, const WebTextRun& run, const WebFl
     // FIXME hook canvasIsOpaque up to the platform-specific indicators for
     // whether subpixel AA can be used for this draw. On Windows, this is
     // PlatformContextSkia::setDrawingToImageBuffer.
-#if WEBKIT_USING_CG
-    GraphicsContext gc(canvas);
-#elif WEBKIT_USING_SKIA
-    PlatformContextSkia context(canvas);
-    // PlatformGraphicsContext is actually a pointer to PlatformContextSkia.
-    GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
-#else
-    notImplemented();
-#endif
+
+    GraphicsContextBuilder builder(canvas);
+    GraphicsContext& gc = builder.context();
 
     gc.save();
     gc.setFillColor(color, ColorSpaceDeviceRGB);
diff --git a/Source/WebKit/chromium/src/WebFormControlElement.cpp b/Source/WebKit/chromium/src/WebFormControlElement.cpp
index a75fe5c..d2bc8ab 100644
--- a/Source/WebKit/chromium/src/WebFormControlElement.cpp
+++ b/Source/WebKit/chromium/src/WebFormControlElement.cpp
@@ -53,6 +53,11 @@ WebString WebFormControlElement::formControlType() const
     return constUnwrap<HTMLFormControlElement>()->type();
 }
 
+void WebFormControlElement::dispatchFormControlChangeEvent()
+{
+    unwrap<HTMLFormControlElement>()->dispatchFormControlChangeEvent();
+}
+
 WebString WebFormControlElement::nameForAutofill() const
 {
     String name = constUnwrap<HTMLFormControlElement>()->name();
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index 8651fa8..c86e715 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -90,7 +90,6 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
-#include "GraphicsContext.h"
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameOwnerElement.h"
@@ -101,9 +100,9 @@
 #include "HistoryItem.h"
 #include "InspectorController.h"
 #include "Page.h"
+#include "painting/GraphicsContextBuilder.h"
 #include "Performance.h"
 #include "PlatformBridge.h"
-#include "PlatformContextSkia.h"
 #include "PluginDocument.h"
 #include "PrintContext.h"
 #include "RenderFrame.h"
@@ -155,10 +154,6 @@
 #include <algorithm>
 #include <wtf/CurrentTime.h>
 
-#if OS(DARWIN)
-#include "LocalCurrentGraphicsContext.h"
-#endif
-
 #if OS(LINUX) || OS(FREEBSD)
 #include <gdk/gdk.h>
 #endif
@@ -537,7 +532,7 @@ WebURL WebFrameImpl::openSearchDescriptionURL() const
 
 WebString WebFrameImpl::encoding() const
 {
-    return frame()->loader()->writer()->encoding();
+    return frame()->document()->loader()->writer()->encoding();
 }
 
 WebSize WebFrameImpl::scrollOffset() const
@@ -685,12 +680,14 @@ void WebFrameImpl::forms(WebVector<WebFormElement>& results) const
     }
 
     WebVector<WebFormElement> temp(formCount);
-    for (size_t i = 0; i < formCount; ++i) {
-        Node* node = forms->item(i);
+    size_t j = 0;
+    for (size_t sourceIndex = 0; j < forms->length(); ++sourceIndex) {
+        Node* node = forms->item(sourceIndex);
         // Strange but true, sometimes item can be 0.
         if (node && node->isHTMLElement())
-            temp[i] = static_cast<HTMLFormElement*>(node);
+            temp[j++] = static_cast<HTMLFormElement*>(node);
     }
+    ASSERT(j == formCount);
     results.swap(temp);
 }
 
@@ -884,17 +881,6 @@ void WebFrameImpl::loadHistoryItem(const WebHistoryItem& item)
     RefPtr<HistoryItem> historyItem = PassRefPtr<HistoryItem>(item);
     ASSERT(historyItem.get());
 
-    // Sanity check for http://webkit.org/b/52819.  It appears that some child
-    // items of this item might be null.  Try validating just the first set of
-    // children in an attempt to catch it early.
-    const HistoryItemVector& childItems = historyItem->children();
-    int size = childItems.size();
-    for (int i = 0; i < size; ++i) {
-      RefPtr<HistoryItem> childItem = childItems[i].get();
-      if (!childItem.get())
-        CRASH();
-    }
-
     // If there is no currentItem, which happens when we are navigating in
     // session history after a crash, we need to manufacture one otherwise WebKit
     // hoarks. This is probably the wrong thing to do, but it seems to work.
@@ -1349,15 +1335,7 @@ float WebFrameImpl::printPage(int page, WebCanvas* canvas)
         return 0;
     }
 
-#if OS(WINDOWS) || OS(LINUX) || OS(FREEBSD) || OS(SOLARIS)
-    PlatformContextSkia context(canvas);
-    GraphicsContext spool(&context);
-#elif OS(DARWIN)
-    GraphicsContext spool(canvas);
-    LocalCurrentGraphicsContext localContext(&spool);
-#endif
-
-    return m_printContext->spoolPage(spool, page);
+    return m_printContext->spoolPage(GraphicsContextBuilder(canvas).context(), page);
 }
 
 void WebFrameImpl::printEnd()
@@ -1542,6 +1520,9 @@ void WebFrameImpl::scopeStringMatches(int identifier,
 
     RefPtr<Range> searchRange(rangeOfContents(frame()->document()));
 
+    Node* originalEndContainer = searchRange->endContainer();
+    int originalEndOffset = searchRange->endOffset();
+
     ExceptionCode ec = 0, ec2 = 0;
     if (m_resumeScopingFromRange.get()) {
         // This is a continuation of a scoping operation that timed out and didn't
@@ -1556,9 +1537,6 @@ void WebFrameImpl::scopeStringMatches(int identifier,
         }
     }
 
-    Node* originalEndContainer = searchRange->endContainer();
-    int originalEndOffset = searchRange->endOffset();
-
     // This timeout controls how long we scope before releasing control.  This
     // value does not prevent us from running for longer than this, but it is
     // periodically checked to see if we have exceeded our allocated time.
@@ -1932,18 +1910,7 @@ void WebFrameImpl::paint(WebCanvas* canvas, const WebRect& rect)
 {
     if (rect.isEmpty())
         return;
-#if WEBKIT_USING_CG
-    GraphicsContext gc(canvas);
-    LocalCurrentGraphicsContext localContext(&gc);
-#elif WEBKIT_USING_SKIA
-    PlatformContextSkia context(canvas);
-
-    // PlatformGraphicsContext is actually a pointer to PlatformContextSkia
-    GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
-#else
-    notImplemented();
-#endif
-    paintWithContext(gc, rect);
+    paintWithContext(GraphicsContextBuilder(canvas).context(), rect);
 }
 
 void WebFrameImpl::createFrameView()
@@ -1985,7 +1952,7 @@ void WebFrameImpl::createFrameView()
         view->setParentVisible(true);
 }
 
-WebFrameImpl* WebFrameImpl::fromFrame(Frame* frame)
+WebFrameImpl* WebFrameImpl::fromFrame(const Frame* frame)
 {
     if (!frame)
         return 0;
@@ -2133,7 +2100,7 @@ void WebFrameImpl::invalidateArea(AreaToInvalidate area)
             IntRect contentArea(
                 view->x(), view->y(), view->visibleWidth(), view->visibleHeight());
             IntRect frameRect = view->frameRect();
-            contentArea.move(-frameRect.topLeft().x(), -frameRect.topLeft().y());
+            contentArea.move(-frameRect.x(), -frameRect.y());
             view->invalidateRect(contentArea);
         }
 
@@ -2144,7 +2111,7 @@ void WebFrameImpl::invalidateArea(AreaToInvalidate area)
                 ScrollbarTheme::nativeTheme()->scrollbarThickness(),
                 view->visibleHeight());
             IntRect frameRect = view->frameRect();
-            scrollBarVert.move(-frameRect.topLeft().x(), -frameRect.topLeft().y());
+            scrollBarVert.move(-frameRect.x(), -frameRect.y());
             view->invalidateRect(scrollBarVert);
         }
     }
@@ -2298,7 +2265,7 @@ void WebFrameImpl::loadJavaScriptURL(const KURL& url)
         return;
 
     if (!m_frame->navigationScheduler()->locationChangePending())
-        m_frame->loader()->writer()->replaceDocument(scriptResult);
+        m_frame->document()->loader()->writer()->replaceDocument(scriptResult);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index b7ac100..e7c92b0 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -209,7 +209,7 @@ public:
     void paintWithContext(WebCore::GraphicsContext&, const WebRect&);
     void createFrameView();
 
-    static WebFrameImpl* fromFrame(WebCore::Frame* frame);
+    static WebFrameImpl* fromFrame(const WebCore::Frame*);
     static WebFrameImpl* fromFrameOwnerElement(WebCore::Element* element);
 
     // If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index 14ed02e..bb7a19b 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -61,11 +61,6 @@ void WebIDBCallbacksImpl::onError(const WebKit::WebIDBDatabaseError& error)
     m_callbacks->onError(error);
 }
 
-void WebIDBCallbacksImpl::onSuccess()
-{
-    m_callbacks->onSuccess();
-}
-
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBCursor* cursor)
 {
     m_callbacks->onSuccess(IDBCursorBackendProxy::create(cursor));
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
index 33a72f4..d2ae255 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -42,7 +42,6 @@ public:
     virtual ~WebIDBCallbacksImpl();
 
     virtual void onError(const WebKit::WebIDBDatabaseError&);
-    virtual void onSuccess(); // For "null".
     virtual void onSuccess(WebKit::WebIDBCursor*);
     virtual void onSuccess(WebKit::WebIDBDatabase*);
     virtual void onSuccess(const WebKit::WebIDBKey&);
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index fa7a200..7f794d9 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -84,10 +84,10 @@ void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* c
     m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode& ec)
+WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode& ec)
 {
     RefPtr<DOMStringList> nameList = PassRefPtr<DOMStringList>(names);
-    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, timeout, ec);
+    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, ec);
     if (!transaction) {
         ASSERT(ec);
         return 0;
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
index 64e0b2e..2dc27d5 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -52,7 +52,7 @@ public:
     virtual WebIDBObjectStore* createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&);
     virtual void deleteObjectStore(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
     virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&);
-    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode&);
+    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode&);
     virtual void close();
 
 private:
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 0503ede..9fe6166 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -71,9 +71,9 @@ void WebIDBObjectStoreImpl::get(const WebIDBKey& key, WebIDBCallbacks* callbacks
     m_objectStore->get(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, PutMode putMode, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->put(value, key, addOnly, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
+    m_objectStore->put(value, key, static_cast<IDBObjectStoreBackendInterface::PutMode>(putMode), IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
 void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
@@ -81,6 +81,11 @@ void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKey& key, WebIDBCallbacks
     m_objectStore->deleteFunction(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
+void WebIDBObjectStoreImpl::clear(WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+{
+    m_objectStore->clear(IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
+}
+
 WebIDBIndex* WebIDBObjectStoreImpl::createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     RefPtr<IDBIndexBackendInterface> index = m_objectStore->createIndex(name, keyPath, unique, transaction.getIDBTransactionBackendInterface(), ec);
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index f9cd776..3e2dfab 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -48,8 +48,9 @@ public:
     WebDOMStringList indexNames() const;
 
     void get(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
-    void put(const WebSerializedScriptValue&, const WebIDBKey& key, bool addOnly, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void deleteFunction(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
     WebIDBIndex* createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction&, WebExceptionCode&);
     WebIDBIndex* index(const WebString& name, WebExceptionCode&);
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
index 96924cf..848182e 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
@@ -51,11 +51,6 @@ void WebIDBTransactionCallbacksImpl::onComplete()
     m_callbacks->onComplete();
 }
 
-void WebIDBTransactionCallbacksImpl::onTimeout()
-{
-    m_callbacks->onTimeout();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
index 89b9cbe..416ac3c 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
@@ -43,7 +43,6 @@ public:
 
     virtual void onAbort();
     virtual void onComplete();
-    virtual void onTimeout();
 
 private:
     RefPtr<IDBTransactionCallbacks> m_callbacks;
diff --git a/Source/WebKit/chromium/src/WebIconLoadingCompletionImpl.cpp b/Source/WebKit/chromium/src/WebIconLoadingCompletionImpl.cpp
new file mode 100644
index 0000000..c1dd321
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebIconLoadingCompletionImpl.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebIconLoadingCompletionImpl.h"
+
+#include "BitmapImage.h"
+#include "Icon.h"
+#include "SharedBuffer.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebIconLoadingCompletionImpl::WebIconLoadingCompletionImpl(FileChooser* chooser)
+    : m_fileChooser(chooser)
+{
+}
+
+WebIconLoadingCompletionImpl::~WebIconLoadingCompletionImpl()
+{
+}
+
+void WebIconLoadingCompletionImpl::didLoadIcon(const WebData& iconData)
+{
+    if (!iconData.isEmpty()) {
+        RefPtr<Image> image = BitmapImage::create();
+        image->setData(iconData, true);
+        m_fileChooser->iconLoaded(Icon::create(image));
+    }
+    // This object is no longer needed.
+    delete this;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebIconLoadingCompletionImpl.h b/Source/WebKit/chromium/src/WebIconLoadingCompletionImpl.h
new file mode 100644
index 0000000..6e6f3a8
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebIconLoadingCompletionImpl.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebIconLoadingCompletionImpl_h
+#define WebIconLoadingCompletionImpl_h
+
+#include "FileChooser.h"
+#include "WebData.h"
+#include "WebIconLoadingCompletion.h"
+#include <wtf/PassRefPtr.h>
+
+using WebKit::WebIconLoadingCompletion;
+using WebKit::WebData;
+
+namespace WebKit {
+
+class WebIconLoadingCompletionImpl : public WebIconLoadingCompletion {
+public:
+    WebIconLoadingCompletionImpl(WebCore::FileChooser*);
+    virtual void didLoadIcon(const WebData&);
+
+private:
+    ~WebIconLoadingCompletionImpl();
+
+    RefPtr<WebCore::FileChooser> m_fileChooser;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/src/WebImageCG.cpp b/Source/WebKit/chromium/src/WebImageCG.cpp
index 045c8be..dda829f 100644
--- a/Source/WebKit/chromium/src/WebImageCG.cpp
+++ b/Source/WebKit/chromium/src/WebImageCG.cpp
@@ -49,20 +49,38 @@ namespace WebKit {
 
 WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
 {
-    // FIXME: Do something like what WebImageSkia.cpp does to enumerate frames.
-    // Not sure whether the CG decoder uses the same frame ordering rules (if so
-    // we can just use the same logic).
-
     ImageSource source;
     source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
     if (!source.isSizeAvailable())
         return WebImage();
 
-    RetainPtr<CGImageRef> frame0(AdoptCF, source.createFrameAtIndex(0));
-    if (!frame0)
+    // Frames are arranged by decreasing size, then decreasing bit depth.
+    // Pick the frame closest to |desiredSize|'s area without being smaller,
+    // which has the highest bit depth.
+    const size_t frameCount = source.frameCount();
+    size_t index = 0; // Default to first frame if none are large enough.
+    int frameAreaAtIndex = 0;
+    for (size_t i = 0; i < frameCount; ++i) {
+        const IntSize frameSize = source.frameSizeAtIndex(i);
+        if (WebSize(frameSize) == desiredSize) {
+            index = i;
+            break; // Perfect match.
+        }
+        const int frameArea = frameSize.width() * frameSize.height();
+        if (frameArea < (desiredSize.width * desiredSize.height))
+            break; // No more frames that are large enough.
+
+        if (!i || (frameArea < frameAreaAtIndex)) {
+            index = i; // Closer to desired area than previous best match.
+            frameAreaAtIndex = frameArea;
+        }
+    }
+
+    RetainPtr<CGImageRef> frame(AdoptCF, source.createFrameAtIndex(index));
+    if (!frame)
         return WebImage();
 
-    return WebImage(frame0.get());
+    return WebImage(frame.get());
 }
 
 void WebImage::reset()
diff --git a/Source/WebKit/chromium/src/WebInputElement.cpp b/Source/WebKit/chromium/src/WebInputElement.cpp
index 8d89c60..7e91a17 100644
--- a/Source/WebKit/chromium/src/WebInputElement.cpp
+++ b/Source/WebKit/chromium/src/WebInputElement.cpp
@@ -135,11 +135,6 @@ void WebInputElement::setAutofilled(bool autoFilled)
     unwrap<HTMLInputElement>()->setAutofilled(autoFilled);
 }
 
-void WebInputElement::dispatchFormControlChangeEvent()
-{
-    unwrap<HTMLInputElement>()->dispatchFormControlChangeEvent();
-}
-
 void WebInputElement::setSelectionRange(int start, int end)
 {
     unwrap<HTMLInputElement>()->setSelectionRange(start, end);
@@ -160,7 +155,10 @@ bool WebInputElement::isValidValue(const WebString& value) const
     return constUnwrap<HTMLInputElement>()->isValidValue(value);
 }
 
-const int WebInputElement::defaultMaxLength = HTMLInputElement::s_maximumLength;
+int WebInputElement::defaultMaxLength()
+{
+    return HTMLInputElement::s_maximumLength;
+}
 
 WebInputElement::WebInputElement(const PassRefPtr<HTMLInputElement>& elem)
     : WebFormControlElement(elem)
@@ -178,4 +176,15 @@ WebInputElement::operator PassRefPtr<HTMLInputElement>() const
     return static_cast<HTMLInputElement*>(m_private.get());
 }
 
+WebInputElement* toWebInputElement(WebElement* webElement)
+{
+    InputElement* inputElement = toInputElement(webElement->unwrap<Element>());
+    if (!inputElement)
+        return 0;
+
+    ASSERT(webElement->unwrap<Element>()->isHTMLElement());
+
+    return static_cast<WebInputElement*>(webElement);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index 65f0fde..853cbcf 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -144,7 +144,7 @@ void WebMediaPlayerClientImpl::repaint()
     ASSERT(m_mediaPlayer);
 #if USE(ACCELERATED_COMPOSITING)
     if (m_videoLayer.get() && supportsAcceleratedRendering())
-        m_videoLayer->setNeedsDisplay(FloatRect(0, 0, m_videoLayer->bounds().width(), m_videoLayer->bounds().height()));
+        m_videoLayer->setNeedsDisplay(IntRect(0, 0, m_videoLayer->bounds().width(), m_videoLayer->bounds().height()));
 #endif
     m_mediaPlayer->repaint();
 }
@@ -397,6 +397,17 @@ void WebMediaPlayerClientImpl::setSize(const IntSize& size)
 
 void WebMediaPlayerClientImpl::paint(GraphicsContext* context, const IntRect& rect)
 {
+#if USE(ACCELERATED_COMPOSITING)
+    // If we are using GPU to render video, ignore requests to paint frames into
+    // canvas because it will be taken care of by VideoLayerChromium.
+    if (acceleratedRenderingInUse())
+        return;
+#endif
+    paintCurrentFrameInContext(context, rect);
+}
+
+void WebMediaPlayerClientImpl::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& rect)
+{
     // Normally GraphicsContext operations do nothing when painting is disabled.
     // Since we're accessing platformContext() directly we have to manually
     // check.
@@ -445,6 +456,11 @@ bool WebMediaPlayerClientImpl::supportsAcceleratedRendering() const
     return m_supportsAcceleratedCompositing;
 }
 
+bool WebMediaPlayerClientImpl::acceleratedRenderingInUse()
+{
+    return m_videoLayer.get() && m_videoLayer->layerRenderer();
+}
+
 VideoFrameChromium* WebMediaPlayerClientImpl::getCurrentFrame()
 {
     VideoFrameChromium* videoFrame = 0;
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index ca7c43c..fcdb219 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -111,6 +111,7 @@ public:
     virtual unsigned bytesLoaded() const;
     virtual void setSize(const WebCore::IntSize&);
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect&);
+    virtual void paintCurrentFrameInContext(WebCore::GraphicsContext*, const WebCore::IntRect&);
     virtual bool hasSingleSecurityOrigin() const;
     virtual WebCore::MediaPlayer::MovieLoadType movieLoadType() const;
 #if USE(ACCELERATED_COMPOSITING)
@@ -128,6 +129,9 @@ private:
     static void getSupportedTypes(WTF::HashSet<WTF::String>&);
     static WebCore::MediaPlayer::SupportsType supportsType(
         const WTF::String& type, const WTF::String& codecs);
+#if USE(ACCELERATED_COMPOSITING)
+    bool acceleratedRenderingInUse();
+#endif
 
     WebCore::MediaPlayer* m_mediaPlayer;
     OwnPtr<WebMediaPlayer> m_webMediaPlayer;
diff --git a/Source/WebKit/chromium/src/WebNotification.cpp b/Source/WebKit/chromium/src/WebNotification.cpp
index c3b1f51..1f2640c 100644
--- a/Source/WebKit/chromium/src/WebNotification.cpp
+++ b/Source/WebKit/chromium/src/WebNotification.cpp
@@ -96,12 +96,6 @@ WebString WebNotification::body() const
     return m_private->contents().body();
 }
 
-// FIXME: remove dir() when unreferenced.  Being replaced by direction().
-WebString WebNotification::dir() const
-{
-    return m_private->dir();
-}
-
 WebTextDirection WebNotification::direction() const
 {
     return (m_private->direction() == RTL) ?
diff --git a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
index 0d85d78..7ea9a8c 100644
--- a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
@@ -168,7 +168,7 @@ String WebPageSerializerImpl::preActionBeforeSerializeOpenTag(
             // Get encoding info.
             String xmlEncoding = param->document->xmlEncoding();
             if (xmlEncoding.isEmpty())
-                xmlEncoding = param->document->frame()->loader()->writer()->encoding();
+                xmlEncoding = param->document->loader()->writer()->encoding();
             if (xmlEncoding.isEmpty())
                 xmlEncoding = UTF8Encoding().name();
             result.append("<?xml version=\"");
@@ -505,7 +505,7 @@ bool WebPageSerializerImpl::serialize()
 
         didSerialization = true;
 
-        String encoding = webFrame->frame()->loader()->writer()->encoding();
+        String encoding = document->loader()->writer()->encoding();
         const TextEncoding& textEncoding = encoding.isEmpty() ? UTF8Encoding() : TextEncoding(encoding);
         String directoryName = url == mainURL ? m_localDirectoryName : "";
 
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 5f62077..bb1b083 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -63,12 +63,14 @@
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "IFrameShimSupport.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderBox.h"
 #include "ScrollView.h"
+#include "UserGestureIndicator.h"
 #include "WheelEvent.h"
 
 #if WEBKIT_USING_SKIA
@@ -127,14 +129,12 @@ void WebPluginContainerImpl::invalidateRect(const IntRect& rect)
     if (!parent())
         return;
 
-    IntRect damageRect = convertToContainingWindow(rect);
+    RenderBox* renderer = toRenderBox(m_element->renderer());
 
-    // Get our clip rect and intersect with it to ensure we don't invalidate
-    // too much.
-    IntRect clipRect = parent()->windowClipRect();
-    damageRect.intersect(clipRect);
-
-    parent()->hostWindow()->invalidateContentsAndWindow(damageRect, false /*immediate*/);
+    IntRect dirtyRect = rect;
+    dirtyRect.move(renderer->borderLeft() + renderer->paddingLeft(),
+                   renderer->borderTop() + renderer->paddingTop());
+    renderer->repaintRectangle(dirtyRect);
 }
 
 void WebPluginContainerImpl::setFocus(bool focused)
@@ -368,6 +368,9 @@ void WebPluginContainerImpl::loadFrameRequest(
     FrameLoadRequest frameRequest(frame->document()->securityOrigin(),
         request.toResourceRequest(), target);
 
+    UserGestureIndicator gestureIndicator(request.hasUserGesture() ?
+        DefinitelyProcessingUserGesture : DefinitelyNotProcessingUserGesture);
+
     frame->loader()->loadFrameRequest(
         frameRequest,
         false,  // lock history
@@ -552,7 +555,7 @@ void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
     clipRect = windowClipRect();
     clipRect.move(-windowRect.x(), -windowRect.y());
 
-    windowCutOutRects(frameRect, cutOutRects);
+    getPluginOcclusions(m_element, this->parent(), frameRect, cutOutRects);
     // Convert to the plugin position.
     for (size_t i = 0; i < cutOutRects.size(); i++)
         cutOutRects[i].move(-frameRect.x(), -frameRect.y());
@@ -577,132 +580,4 @@ WebCore::IntRect WebPluginContainerImpl::windowClipRect() const
     return clipRect;
 }
 
-static void getObjectStack(const RenderObject* ro,
-                           Vector<const RenderObject*>* roStack)
-{
-    roStack->clear();
-    while (ro) {
-        roStack->append(ro);
-        ro = ro->parent();
-    }
-}
-
-// Returns true if stack1 is at or above stack2
-static bool checkStackOnTop(
-        const Vector<const RenderObject*>& iframeZstack,
-        const Vector<const RenderObject*>& pluginZstack)
-{
-    for (size_t i1 = 0, i2 = 0;
-         i1 < iframeZstack.size() && i2 < pluginZstack.size();
-         i1++, i2++) {
-        // The root is at the end of these stacks.  We want to iterate
-        // root-downwards so we index backwards from the end.
-        const RenderObject* ro1 = iframeZstack[iframeZstack.size() - 1 - i1];
-        const RenderObject* ro2 = pluginZstack[pluginZstack.size() - 1 - i2];
-
-        if (ro1 != ro2) {
-            // When we find nodes in the stack that are not the same, then
-            // we've found the nodes just below the lowest comment ancestor.
-            // Determine which should be on top.
-
-            // See if z-index determines an order.
-            if (ro1->style() && ro2->style()) {
-                int z1 = ro1->style()->zIndex();
-                int z2 = ro2->style()->zIndex();
-                if (z1 > z2)
-                    return true;
-                if (z1 < z2)
-                    return false;
-            }
-
-            // If the plugin does not have an explicit z-index it stacks behind the iframe.
-            // This is for maintaining compatibility with IE.
-            if (ro2->style()->position() == StaticPosition) {
-                // The 0'th elements of these RenderObject arrays represent the plugin node and
-                // the iframe.
-                const RenderObject* pluginRenderObject = pluginZstack[0];
-                const RenderObject* iframeRenderObject = iframeZstack[0];
-
-                if (pluginRenderObject->style() && iframeRenderObject->style()) {
-                    if (pluginRenderObject->style()->zIndex() > iframeRenderObject->style()->zIndex())
-                        return false;
-                }
-                return true;
-            }
-
-            // Inspect the document order.  Later order means higher
-            // stacking.
-            const RenderObject* parent = ro1->parent();
-            if (!parent)
-                return false;
-            ASSERT(parent == ro2->parent());
-
-            for (const RenderObject* ro = parent->firstChild(); ro; ro = ro->nextSibling()) {
-                if (ro == ro1)
-                    return false;
-                if (ro == ro2)
-                    return true;
-            }
-            ASSERT(false);  // We should have seen ro1 and ro2 by now.
-            return false;
-        }
-    }
-    return true;
-}
-
-// Return a set of rectangles that should not be overdrawn by the
-// plugin ("cutouts").  This helps implement the "iframe shim"
-// technique of overlaying a windowed plugin with content from the
-// page.  In a nutshell, iframe elements should occlude plugins when
-// they occur higher in the stacking order.
-void WebPluginContainerImpl::windowCutOutRects(const IntRect& frameRect,
-                                               Vector<IntRect>& cutOutRects)
-{
-    RenderObject* pluginNode = m_element->renderer();
-    ASSERT(pluginNode);
-    if (!pluginNode->style())
-        return;
-    Vector<const RenderObject*> pluginZstack;
-    Vector<const RenderObject*> iframeZstack;
-    getObjectStack(pluginNode, &pluginZstack);
-
-    // Get the parent widget
-    Widget* parentWidget = this->parent();
-    if (!parentWidget->isFrameView())
-        return;
-
-    FrameView* parentFrameView = static_cast<FrameView*>(parentWidget);
-
-    const HashSet<RefPtr<Widget> >* children = parentFrameView->children();
-    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != children->end(); ++it) {
-        // We only care about FrameView's because iframes show up as FrameViews.
-        if (!(*it)->isFrameView())
-            continue;
-
-        const FrameView* frameView =
-            static_cast<const FrameView*>((*it).get());
-        // Check to make sure we can get both the element and the RenderObject
-        // for this FrameView, if we can't just move on to the next object.
-        if (!frameView->frame() || !frameView->frame()->ownerElement()
-            || !frameView->frame()->ownerElement()->renderer())
-            continue;
-
-        HTMLElement* element = frameView->frame()->ownerElement();
-        RenderObject* iframeRenderer = element->renderer();
-
-        if (element->hasTagName(HTMLNames::iframeTag)
-            && iframeRenderer->absoluteBoundingBoxRect().intersects(frameRect)
-            && (!iframeRenderer->style() || iframeRenderer->style()->visibility() == VISIBLE)) {
-            getObjectStack(iframeRenderer, &iframeZstack);
-            if (checkStackOnTop(iframeZstack, pluginZstack)) {
-                IntPoint point =
-                    roundedIntPoint(iframeRenderer->localToAbsolute());
-                RenderBox* rbox = toRenderBox(iframeRenderer);
-                IntSize size(rbox->width(), rbox->height());
-                cutOutRects.append(IntRect(point, size));
-            }
-        }
-    }
-}
-
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp b/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp
index a209e6a..b4d4246 100644
--- a/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp
@@ -35,7 +35,7 @@
 #include "FramelessScrollView.h"
 #include "FrameView.h"
 #include "IntRect.h"
-#include "PlatformContextSkia.h"
+#include "painting/GraphicsContextBuilder.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
@@ -141,13 +141,13 @@ void WebPopupMenuImpl::resize(const WebSize& newSize)
     m_size = newSize;
 
     if (m_widget) {
-      IntRect newGeometry(0, 0, m_size.width, m_size.height);
-      m_widget->setFrameRect(newGeometry);
+        IntRect newGeometry(0, 0, m_size.width, m_size.height);
+        m_widget->setFrameRect(newGeometry);
     }
 
     if (m_client) {
-      WebRect damagedRect(0, 0, m_size.width, m_size.height);
-      m_client->didInvalidateRect(damagedRect);
+        WebRect damagedRect(0, 0, m_size.width, m_size.height);
+        m_client->didInvalidateRect(damagedRect);
     }
 }
 
@@ -164,18 +164,8 @@ void WebPopupMenuImpl::paint(WebCanvas* canvas, const WebRect& rect)
     if (!m_widget)
         return;
 
-    if (!rect.isEmpty()) {
-#if WEBKIT_USING_CG
-        GraphicsContext gc(canvas);
-#elif WEBKIT_USING_SKIA
-        PlatformContextSkia context(canvas);
-        // PlatformGraphicsContext is actually a pointer to PlatformContextSkia.
-        GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
-#else
-        notImplemented();
-#endif
-        m_widget->paint(&gc, rect);
-    }
+    if (!rect.isEmpty())
+        m_widget->paint(&GraphicsContextBuilder(canvas).context(), rect);
 }
 
 void WebPopupMenuImpl::themeChanged()
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 0b5d397..e3ece6e 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -202,14 +202,14 @@ bool WebRuntimeFeatures::isWebAudioEnabled()
 
 void WebRuntimeFeatures::enableWebGL(bool enable)
 {
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     RuntimeEnabledFeatures::setWebGLEnabled(enable);
 #endif
 }
 
 bool WebRuntimeFeatures::isWebGLEnabled()
 {
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     return RuntimeEnabledFeatures::webGLRenderingContextEnabled();
 #else
     return false;
@@ -304,4 +304,20 @@ bool WebRuntimeFeatures::isFileSystemEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableJavaScriptI18NAPI(bool enable)
+{
+#if ENABLE(JAVASCRIPT_I18N_API)
+    RuntimeEnabledFeatures::setJavaScriptI18NAPIEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isJavaScriptI18NAPIEnabled()
+{
+#if ENABLE(JAVASCRIPT_I18N_API)
+    return RuntimeEnabledFeatures::javaScriptI18NAPIEnabled();
+#else
+    return false;
+#endif
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
index 05d2d1f..57ea92e 100644
--- a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
@@ -33,7 +33,7 @@
 
 #include "GraphicsContext.h"
 #include "KeyboardCodes.h"
-#include "PlatformContextSkia.h"
+#include "painting/GraphicsContextBuilder.h"
 #include "Scrollbar.h"
 #include "ScrollbarTheme.h"
 #include "ScrollTypes.h"
@@ -76,7 +76,7 @@ WebScrollbarImpl::~WebScrollbarImpl()
 
 void WebScrollbarImpl::setLocation(const WebRect& rect)
 {
-    WebCore::IntRect oldRect = m_scrollbar->frameRect();
+    IntRect oldRect = m_scrollbar->frameRect();
     m_scrollbar->setFrameRect(rect);
     if (WebRect(oldRect) != rect)
       m_scrollbar->invalidate();
@@ -95,7 +95,7 @@ int WebScrollbarImpl::value() const
 
 void WebScrollbarImpl::setValue(int position)
 {
-    WebCore::ScrollableArea::scrollToOffsetWithoutAnimation(m_scrollbar->orientation(), position);
+    ScrollableArea::scrollToOffsetWithoutAnimation(m_scrollbar->orientation(), static_cast<float>(position));
 }
 
 void WebScrollbarImpl::setDocumentSize(int size)
@@ -119,18 +119,7 @@ void WebScrollbarImpl::scroll(ScrollDirection direction, ScrollGranularity granu
 
 void WebScrollbarImpl::paint(WebCanvas* canvas, const WebRect& rect)
 {
-#if WEBKIT_USING_CG
-    GraphicsContext gc(canvas);
-#elif WEBKIT_USING_SKIA
-    PlatformContextSkia context(canvas);
-
-    // PlatformGraphicsContext is actually a pointer to PlatformContextSkia
-    GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
-#else
-    notImplemented();
-#endif
-
-    m_scrollbar->paint(&gc, rect);
+    m_scrollbar->paint(&GraphicsContextBuilder(canvas).context(), rect);
 }
 
 bool WebScrollbarImpl::handleInputEvent(const WebInputEvent& event)
@@ -220,7 +209,7 @@ bool WebScrollbarImpl::onMouseWheel(const WebInputEvent& event)
             if (negative)
                 delta *= -1;
         }
-        WebCore::ScrollableArea::scroll((m_scrollbar->orientation() == HorizontalScrollbar) ? WebCore::ScrollLeft : WebCore::ScrollUp, WebCore::ScrollByPixel, delta);
+        ScrollableArea::scroll((m_scrollbar->orientation() == HorizontalScrollbar) ? WebCore::ScrollLeft : WebCore::ScrollUp, WebCore::ScrollByPixel, delta);
         return true;
     }
 
@@ -259,7 +248,7 @@ bool WebScrollbarImpl::onKeyDown(const WebInputEvent& event)
     WebCore::ScrollGranularity scrollGranularity;
     if (WebViewImpl::mapKeyCodeForScroll(keyCode, &scrollDirection, &scrollGranularity)) {
         // Will return false if scroll direction wasn't compatible with this scrollbar.
-        return WebCore::ScrollableArea::scroll(scrollDirection, scrollGranularity);
+        return ScrollableArea::scroll(scrollDirection, scrollGranularity);
     }
     return false;
 }
@@ -269,12 +258,12 @@ int WebScrollbarImpl::scrollSize(WebCore::ScrollbarOrientation orientation) cons
     return (orientation == m_scrollbar->orientation()) ? (m_scrollbar->totalSize() - m_scrollbar->visibleSize()) : 0;
 }
 
-int WebScrollbarImpl::scrollPosition(WebCore::Scrollbar*) const
+int WebScrollbarImpl::scrollPosition(Scrollbar*) const
 {
     return m_scrollOffset;
 }
 
-void WebScrollbarImpl::setScrollOffset(const WebCore::IntPoint& offset)
+void WebScrollbarImpl::setScrollOffset(const IntPoint& offset)
 {
     if (m_scrollbar->orientation() == HorizontalScrollbar)
         m_scrollOffset = offset.x();
@@ -284,7 +273,7 @@ void WebScrollbarImpl::setScrollOffset(const WebCore::IntPoint& offset)
     m_client->valueChanged(this);
 }
 
-void WebScrollbarImpl::invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect& rect)
+void WebScrollbarImpl::invalidateScrollbarRect(Scrollbar*, const IntRect& rect)
 {
     WebRect webrect(rect);
     webrect.x += m_scrollbar->x();
@@ -302,7 +291,7 @@ bool WebScrollbarImpl::scrollbarCornerPresent() const
     return false;
 }
 
-void WebScrollbarImpl::getTickmarks(Vector<WebCore::IntRect>& tickmarks) const
+void WebScrollbarImpl::getTickmarks(Vector<IntRect>& tickmarks) const
 {
     WebVector<WebRect> ticks;
     m_client->getTickmarks(const_cast<WebScrollbarImpl*>(this), &ticks);
@@ -311,4 +300,14 @@ void WebScrollbarImpl::getTickmarks(Vector<WebCore::IntRect>& tickmarks) const
         tickmarks[i] = ticks[i];
 }
 
+Scrollbar* WebScrollbarImpl::horizontalScrollbar() const
+{
+    return m_scrollbar->orientation() == HorizontalScrollbar ? m_scrollbar.get() : 0;
+}
+
+Scrollbar* WebScrollbarImpl::verticalScrollbar() const
+{
+    return m_scrollbar->orientation() == VerticalScrollbar ? m_scrollbar.get() : 0;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.h b/Source/WebKit/chromium/src/WebScrollbarImpl.h
index 4dcfd5d..ac120cf 100644
--- a/Source/WebKit/chromium/src/WebScrollbarImpl.h
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.h
@@ -65,6 +65,8 @@ public:
     virtual bool isActive() const;
     virtual bool scrollbarCornerPresent() const;
     virtual void getTickmarks(Vector<WebCore::IntRect>&) const;
+    virtual WebCore::Scrollbar* horizontalScrollbar() const;
+    virtual WebCore::Scrollbar* verticalScrollbar() const;
 
 private:
     bool onMouseDown(const WebInputEvent& event);
diff --git a/Source/WebKit/chromium/src/WebSearchableFormData.cpp b/Source/WebKit/chromium/src/WebSearchableFormData.cpp
index 8e27a67..647f20d 100644
--- a/Source/WebKit/chromium/src/WebSearchableFormData.cpp
+++ b/Source/WebKit/chromium/src/WebSearchableFormData.cpp
@@ -62,8 +62,7 @@ void GetFormEncoding(const HTMLFormElement* form, TextEncoding* encoding)
         if (encoding->isValid())
             return;
     }
-    const Frame* frame = form->document()->frame();
-    *encoding = frame ? TextEncoding(frame->loader()->writer()->encoding()) : Latin1Encoding();
+    *encoding = TextEncoding(form->document()->loader()->writer()->encoding());
 }
 
 // Returns true if the submit request results in an HTTP URL.
diff --git a/Source/WebKit/chromium/src/WebSelectElement.cpp b/Source/WebKit/chromium/src/WebSelectElement.cpp
index 79a4d85..7aac44a 100644
--- a/Source/WebKit/chromium/src/WebSelectElement.cpp
+++ b/Source/WebKit/chromium/src/WebSelectElement.cpp
@@ -46,14 +46,14 @@ void WebSelectElement::setValue(const WebString& value)
     unwrap<HTMLSelectElement>()->setValue(value);
 }
 
-WebString WebSelectElement::value()
+WebString WebSelectElement::value() const
 {
-    return unwrap<HTMLSelectElement>()->value();
+    return constUnwrap<HTMLSelectElement>()->value();
 }
 
-WebVector<WebElement> WebSelectElement::listItems()
+WebVector<WebElement> WebSelectElement::listItems() const
 {
-    const Vector<Element*>& sourceItems = unwrap<HTMLSelectElement>()->listItems();
+    const Vector<Element*>& sourceItems = constUnwrap<HTMLSelectElement>()->listItems();
     WebVector<WebElement> items(sourceItems.size());
     for (size_t i = 0; i < sourceItems.size(); ++i)
         items[i] = WebElement(static_cast<HTMLElement*>(sourceItems[i]));
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 0457f77..dd82fa6 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -274,6 +274,11 @@ void WebSettingsImpl::setExperimentalWebGLEnabled(bool enabled)
     m_settings->setWebGLEnabled(enabled);
 }
 
+void WebSettingsImpl::setOpenGLMultisamplingEnabled(bool enabled)
+{
+    m_settings->setOpenGLMultisamplingEnabled(enabled);
+}
+
 void WebSettingsImpl::setShowDebugBorders(bool show)
 {
     m_settings->setShowDebugBorders(show);
@@ -329,6 +334,11 @@ void WebSettingsImpl::setHyperlinkAuditingEnabled(bool enabled)
     m_settings->setHyperlinkAuditingEnabled(enabled);
 }
 
+void WebSettingsImpl::setAsynchronousSpellCheckingEnabled(bool enabled)
+{
+    m_settings->setAsynchronousSpellCheckingEnabled(enabled);
+}
+
 void WebSettingsImpl::setCaretBrowsingEnabled(bool enabled)
 {
     m_settings->setCaretBrowsingEnabled(enabled);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 4960bb9..b52a364 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -86,6 +86,7 @@ public:
     virtual void setOfflineWebApplicationCacheEnabled(bool);
     virtual void setWebAudioEnabled(bool);
     virtual void setExperimentalWebGLEnabled(bool);
+    virtual void setOpenGLMultisamplingEnabled(bool);
     virtual void setShowDebugBorders(bool);
     virtual void setEditingBehavior(EditingBehavior);
     virtual void setAcceleratedCompositingEnabled(bool);
@@ -97,6 +98,7 @@ public:
     virtual void setAccelerated2dCanvasEnabled(bool);
     virtual void setMemoryInfoEnabled(bool);
     virtual void setHyperlinkAuditingEnabled(bool);
+    virtual void setAsynchronousSpellCheckingEnabled(bool);
     virtual void setCaretBrowsingEnabled(bool);
     virtual void setInteractiveFormValidationEnabled(bool);
 
diff --git a/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
new file mode 100644
index 0000000..2759790
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebTextCheckingCompletionImpl.h"
+
+#include "SpellChecker.h"
+#include "WebTextCheckingResult.h"
+#include "WebVector.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+static Vector<SpellCheckingResult> toCoreResults(const WebVector<WebTextCheckingResult>& results)
+{
+    Vector<SpellCheckingResult> coreResults;
+    for (size_t i = 0; i < results.size(); ++i)
+        coreResults.append(SpellCheckingResult(static_cast<DocumentMarker::MarkerType>(results[i].error()), results[i].position(), results[i].length()));
+    return coreResults;
+}
+
+void WebTextCheckingCompletionImpl::didFinishCheckingText(const WebVector<WebTextCheckingResult>& results)
+{
+    m_spellChecker->didCheck(m_identifier, toCoreResults(results));
+    delete this;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.h b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.h
new file mode 100644
index 0000000..f1017c7
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTextCheckingCompletionImpl_h
+#define WebTextCheckingCompletionImpl_h
+
+#include "WebTextCheckingCompletion.h"
+
+namespace WebCore {
+class SpellChecker;
+}
+
+namespace WebKit {
+
+class WebTextCheckingCompletionImpl : public WebTextCheckingCompletion {
+public:
+    WebTextCheckingCompletionImpl(int identifier, WebCore::SpellChecker* spellchecker)
+        : m_identifier(identifier), m_spellChecker(spellchecker)
+    {
+    }
+
+    virtual void didFinishCheckingText(const WebVector<WebTextCheckingResult>&);
+
+private:
+    int m_identifier;
+    WebCore::SpellChecker* m_spellChecker;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/src/WebTextRun.cpp b/Source/WebKit/chromium/src/WebTextRun.cpp
index 58d9fac..b8c6ccb 100644
--- a/Source/WebKit/chromium/src/WebTextRun.cpp
+++ b/Source/WebKit/chromium/src/WebTextRun.cpp
@@ -39,7 +39,7 @@ namespace WebKit {
 
 WebTextRun::operator WebCore::TextRun() const
 {
-    return TextRun(text, false, 0, 0, rtl, directionalOverride);
+    return TextRun(text, false, 0, 0, TextRun::AllowTrailingExpansion, rtl, directionalOverride);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebURLResponse.cpp b/Source/WebKit/chromium/src/WebURLResponse.cpp
index bf3c521..7917298 100644
--- a/Source/WebKit/chromium/src/WebURLResponse.cpp
+++ b/Source/WebKit/chromium/src/WebURLResponse.cpp
@@ -384,6 +384,16 @@ void WebURLResponse::setDownloadFilePath(const WebString& downloadFilePath)
     m_private->m_downloadFilePath = downloadFilePath;
 }
 
+WebString WebURLResponse::socketAddress() const
+{
+    return m_private->m_resourceResponse->socketAddress();
+}
+
+void WebURLResponse::setSocketAddress(const WebString& socketAddress)
+{
+    m_private->m_resourceResponse->setSocketAddress(socketAddress);
+}
+
 void WebURLResponse::assign(WebURLResponsePrivate* p)
 {
     // Subclasses may call this directly so a self-assignment check is needed
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 798e5ff..18a953e 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -121,6 +121,7 @@
 #include "WebVector.h"
 #include "WebViewClient.h"
 #include <wtf/ByteArray.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/RefPtr.h>
 
 #if PLATFORM(CG)
@@ -200,13 +201,9 @@ COMPILE_ASSERT_MATCHING_ENUM(DragOperationEvery);
 static const PopupContainerSettings autoFillPopupSettings = {
     false, // setTextOnIndexChange
     false, // acceptOnAbandon
-    true,  // loopSelectionNavigation
-    false, // restrictWidthOfListBox (For security reasons show the entire entry
-           // so the user doesn't enter information he did not intend to.)
-    // For suggestions, we use the direction of the input field as the direction
-    // of the popup items. The main reason is to keep the display of items in
-    // drop-down the same as the items in the input field.
-    PopupContainerSettings::DOMElementDirection,
+    true, // loopSelectionNavigation
+    false // restrictWidthOfListBox (For security reasons show the entire entry
+          // so the user doesn't enter information he did not intend to.)
 };
 
 static bool shouldUseExternalPopupMenus = false;
@@ -979,7 +976,7 @@ void WebViewImpl::animate()
     if (webframe) {
         FrameView* view = webframe->frameView();
         if (view)
-            view->serviceScriptedAnimations();
+            view->serviceScriptedAnimations(convertSecondsToDOMTimeStamp(currentTime()));
     }
 #endif
 }
@@ -1008,8 +1005,8 @@ void WebViewImpl::layout()
 #if USE(ACCELERATED_COMPOSITING)
 void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect)
 {
-    ASSERT(rect.right() <= m_layerRenderer->rootLayerTextureSize().width()
-           && rect.bottom() <= m_layerRenderer->rootLayerTextureSize().height());
+    ASSERT(rect.maxX() <= m_layerRenderer->rootLayerTextureSize().width()
+           && rect.maxY() <= m_layerRenderer->rootLayerTextureSize().height());
 
 #if PLATFORM(SKIA)
     PlatformContextSkia context(canvas);
@@ -1024,7 +1021,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
     notImplemented();
 #endif
     // Compute rect to sample from inverted GPU buffer.
-    IntRect invertRect(rect.x(), bitmapHeight - rect.bottom(), rect.width(), rect.height());
+    IntRect invertRect(rect.x(), bitmapHeight - rect.maxY(), rect.width(), rect.height());
 
     OwnPtr<ImageBuffer> imageBuffer(ImageBuffer::create(rect.size()));
     RefPtr<ByteArray> pixelArray(ByteArray::create(rect.width() * rect.height() * 4));
@@ -1032,7 +1029,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
         m_layerRenderer->getFramebufferPixels(pixelArray->data(), invertRect);
         imageBuffer->putPremultipliedImageData(pixelArray.get(), rect.size(), IntRect(IntPoint(), rect.size()), IntPoint());
         gc.save();
-        gc.translate(FloatSize(0.0f, bitmapHeight));
+        gc.translate(IntSize(0, bitmapHeight));
         gc.scale(FloatSize(1.0f, -1.0f));
         // Use invertRect in next line, so that transform above inverts it back to
         // desired destination rect.
@@ -1461,7 +1458,7 @@ WebString WebViewImpl::pageEncoding() const
     if (!m_page.get())
         return WebString();
 
-    return m_page->mainFrame()->loader()->writer()->encoding();
+    return m_page->mainFrame()->document()->loader()->writer()->encoding();
 }
 
 void WebViewImpl::setPageEncoding(const WebString& encodingName)
@@ -1615,7 +1612,7 @@ double WebViewImpl::setZoomLevel(bool textOnly, double zoomLevel)
     if (pluginContainer)
         pluginContainer->plugin()->setZoomLevel(m_zoomLevel, textOnly);
     else {
-        double zoomFactor = zoomLevelToZoomFactor(m_zoomLevel);
+        float zoomFactor = static_cast<float>(zoomLevelToZoomFactor(m_zoomLevel));
         if (textOnly)
             frame->setPageAndTextZoomFactors(1, zoomFactor);
         else
@@ -1760,7 +1757,7 @@ WebDragOperation WebViewImpl::dragTargetDragEnterNew(
 {
     ASSERT(!m_currentDragData.get());
 
-    m_currentDragData = ChromiumDataObject::createReadable(Clipboard::DragAndDrop);
+    m_currentDragData = ChromiumDataObject::createReadable(m_page->mainFrame(), Clipboard::DragAndDrop);
     m_dragIdentity = identity;
     m_operationsAllowed = operationsAllowed;
 
@@ -2372,7 +2369,7 @@ public:
             return;
         FrameView* view = page->mainFrame()->view();
 
-        context.translate(view->scrollX(), view->scrollY());
+        context.translate(static_cast<float>(view->scrollX()), static_cast<float>(view->scrollY()));
         IntRect windowRect = view->contentsToWindow(contentRect);
         view->paintScrollbars(&context, windowRect);
     }
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index d164a48..7640ceb 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -53,6 +53,7 @@
 
 namespace WebCore {
 class ChromiumDataObject;
+class DocumentLoader;
 class Frame;
 class HistoryItem;
 class HitTestResult;
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
index 058e947..faea40b 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -56,8 +56,8 @@ namespace WebCore {
 
 static const char fileSystemOperationsMode[] = "fileSystemOperationsMode";
 
-WorkerAsyncFileSystemChromium::WorkerAsyncFileSystemChromium(ScriptExecutionContext* context, const String& rootPath, bool synchronous)
-    : AsyncFileSystem(rootPath)
+WorkerAsyncFileSystemChromium::WorkerAsyncFileSystemChromium(ScriptExecutionContext* context, AsyncFileSystem::Type type, const String& rootPath, bool synchronous)
+    : AsyncFileSystem(type, rootPath)
     , m_scriptExecutionContext(context)
     , m_webFileSystem(WebKit::webKitClient()->fileSystem())
     , m_workerContext(static_cast<WorkerContext*>(context))
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
index 0b4b708..7e3316b 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
@@ -52,9 +52,9 @@ class WorkerContext;
 
 class WorkerAsyncFileSystemChromium : public AsyncFileSystem {
 public:
-    static PassOwnPtr<AsyncFileSystem> create(ScriptExecutionContext* context, const String& rootPath, bool synchronous)
+    static PassOwnPtr<AsyncFileSystem> create(ScriptExecutionContext* context, AsyncFileSystem::Type type, const String& rootPath, bool synchronous)
     {
-        return adoptPtr(new WorkerAsyncFileSystemChromium(context, rootPath, synchronous));
+        return adoptPtr(new WorkerAsyncFileSystemChromium(context, type, rootPath, synchronous));
     }
 
     virtual ~WorkerAsyncFileSystemChromium();
@@ -75,7 +75,7 @@ public:
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 private:
-    WorkerAsyncFileSystemChromium(ScriptExecutionContext*, const String& rootPath, bool synchronous);
+    WorkerAsyncFileSystemChromium(ScriptExecutionContext*, AsyncFileSystem::Type, const String& rootPath, bool synchronous);
 
     PassRefPtr<WebKit::WorkerFileSystemCallbacksBridge> createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks>);
 
diff --git a/Source/WebKit/chromium/src/js/DevTools.js b/Source/WebKit/chromium/src/js/DevTools.js
index d6536bc..3d61be7 100644
--- a/Source/WebKit/chromium/src/js/DevTools.js
+++ b/Source/WebKit/chromium/src/js/DevTools.js
@@ -41,6 +41,7 @@ var context = {};  // Used by WebCore's inspector routines.
     Preferences.ignoreWhitespace = false;
     Preferences.samplingCPUProfiler = true;
     Preferences.heapProfilerPresent = true;
+    Preferences.detailedHeapProfiles = false;
     Preferences.debuggerAlwaysEnabled = true;
     Preferences.profilerAlwaysEnabled = true;
     Preferences.canEditScriptSource = true;
@@ -88,6 +89,18 @@ WebInspector.UIString = function(string)
 };
 
 
+/*
+ * This label must be kept consistent with that in English.lproj/localizedStrings.js
+ *
+ * http://code.google.com/p/chromium/issues/detail?id=61302 requires a custom label for Chromium,
+ * since its behavior is different.
+ */
+WebInspector.openLinkExternallyLabel = function()
+{
+    return WebInspector.UIString("Open Link in New Tab");
+};
+
+
 /** Pending WebKit upstream by apavlov). Fixes iframe vs drag problem. */
 (function()
 {
diff --git a/Source/WebKit/chromium/src/js/Tests.js b/Source/WebKit/chromium/src/js/Tests.js
index 900d79e..f155e08 100644
--- a/Source/WebKit/chromium/src/js/Tests.js
+++ b/Source/WebKit/chromium/src/js/Tests.js
@@ -685,7 +685,7 @@ TestSuite.prototype._checkSourceFrameWhenLoaded = function(expectations, callbac
 {
     var test = this;
 
-    var frame = WebInspector.currentPanel.visibleView.sourceFrame;
+    var frame = WebInspector.currentPanel.visibleView;
 
     if (frame._textViewer)
         checkExecLine();
diff --git a/Source/WebKit/chromium/src/painting/GraphicsContextBuilder.h b/Source/WebKit/chromium/src/painting/GraphicsContextBuilder.h
new file mode 100644
index 0000000..5ffae8e
--- /dev/null
+++ b/Source/WebKit/chromium/src/painting/GraphicsContextBuilder.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GraphicsContextBuilder_h
+#define GraphicsContextBuilder_h
+
+#include "GraphicsContext.h"
+
+#if WEBKIT_USING_CG
+#include "LocalCurrentGraphicsContext.h"
+#elif WEBKIT_USING_SKIA
+#include "PlatformContextSkia.h"
+#endif
+
+namespace WebKit {
+
+#if WEBKIT_USING_CG
+
+class GraphicsContextBuilder {
+public:
+    GraphicsContextBuilder(WebCanvas* canvas)
+        : m_graphicsContext(canvas)
+        , m_localContext(&m_graphicsContext) 
+    {
+    }
+
+    WebCore::GraphicsContext& context() { return m_graphicsContext; }
+
+private:
+    WebCore::GraphicsContext m_graphicsContext;
+    WebCore::LocalCurrentGraphicsContext m_localContext;
+};
+
+#elif WEBKIT_USING_SKIA
+
+class GraphicsContextBuilder {
+public:
+    GraphicsContextBuilder(WebCanvas* canvas)
+        : m_platformContext(canvas)
+        , m_graphicsContext(&m_platformContext)
+    {
+    }
+
+    WebCore::GraphicsContext& context() { return m_graphicsContext; }
+
+private:
+    WebCore::PlatformContextSkia m_platformContext;
+    WebCore::GraphicsContext m_graphicsContext;
+};
+
+#else
+#error "Need to define GraphicsContextBuilder!"
+#endif
+
+} // namespace WebKit
+
+#endif