Merge WebKit at r80534: Intial merge by Git

Change-Id: Ia7a83357124c9e1cdb1debf55d9661ec0bd09a61

116 files changed, 2238 insertions, 998 deletions

diff --git a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
new file mode 100644
index 0000000..71ae14f
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebApplicationCacheManager.h"
+
+#include "MessageID.h"
+#include "SecurityOriginData.h"
+#include "WebApplicationCacheManagerProxyMessages.h"
+#include "WebProcess.h"
+#include <WebCore/ApplicationCacheStorage.h>
+#include <WebCore/SecurityOrigin.h>
+#include <WebCore/SecurityOriginHash.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebApplicationCacheManager& WebApplicationCacheManager::shared()
+{
+    static WebApplicationCacheManager& shared = *new WebApplicationCacheManager;
+    return shared;
+}
+
+WebApplicationCacheManager::WebApplicationCacheManager()
+{
+}
+
+void WebApplicationCacheManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebApplicationCacheManagerMessage(connection, messageID, arguments);
+}
+
+void WebApplicationCacheManager::getApplicationCacheOrigins(uint64_t callbackID)
+{
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash> origins;
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    cacheStorage().getOriginsWithCache(origins);
+#endif
+
+    Vector<SecurityOriginData> identifiers;
+    identifiers.reserveCapacity(origins.size());
+
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::iterator end = origins.end();
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::iterator i = origins.begin();
+    for (; i != end; ++i) {
+        RefPtr<SecurityOrigin> origin = *i;
+        
+        SecurityOriginData originData;
+        originData.protocol = origin->protocol();
+        originData.host = origin->host();
+        originData.port = origin->port();
+
+        identifiers.uncheckedAppend(originData);
+    }
+
+    WebProcess::shared().connection()->send(Messages::WebApplicationCacheManagerProxy::DidGetApplicationCacheOrigins(identifiers, callbackID), 0);
+}
+
+void WebApplicationCacheManager::deleteEntriesForOrigin(const SecurityOriginData& originData)
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(originData.protocol, originData.host, originData.port);
+    if (!origin)
+        return;
+    
+    cacheStorage().deleteEntriesForOrigin(origin.get());
+#endif
+}
+
+void WebApplicationCacheManager::deleteAllEntries()
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    cacheStorage().deleteAllEntries();
+#endif
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.h b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.h
new file mode 100644
index 0000000..d217ffd
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebApplicationCacheManager_h
+#define WebApplicationCacheManager_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class Connection;
+    class MessageID;
+}
+
+namespace WebKit {
+
+struct SecurityOriginData;
+
+class WebApplicationCacheManager {
+    WTF_MAKE_NONCOPYABLE(WebApplicationCacheManager);
+
+public:
+    static WebApplicationCacheManager& shared();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    WebApplicationCacheManager();
+    
+    void getApplicationCacheOrigins(uint64_t callbackID);
+    void deleteEntriesForOrigin(const SecurityOriginData&);
+    void deleteAllEntries();
+
+    void didReceiveWebApplicationCacheManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+};
+
+} // namespace WebKit
+
+#endif // WebApplicationCacheManager_h
diff --git a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.messages.in b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.messages.in
new file mode 100644
index 0000000..bf21d9d
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.messages.in
@@ -0,0 +1,27 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebApplicationCacheManager {
+    void GetApplicationCacheOrigins(uint64_t callbackID)
+    void DeleteEntriesForOrigin(WebKit::SecurityOriginData originIdentifier)
+    void DeleteAllEntries()
+}
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
new file mode 100644
index 0000000..1c88ee2
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCookieManager.h"
+
+#include "MessageID.h"
+#include "WebCookieManagerProxyMessages.h"
+#include "WebProcess.h"
+#include <WebCore/CookieJar.h>
+#include <WebCore/CookieStorage.h>
+#include <WebCore/NotImplemented.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebCookieManager& WebCookieManager::shared()
+{
+    DEFINE_STATIC_LOCAL(WebCookieManager, shared, ());
+    return shared;
+}
+
+WebCookieManager::WebCookieManager()
+{
+}
+
+void WebCookieManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebCookieManagerMessage(connection, messageID, arguments);
+}
+
+void WebCookieManager::getHostnamesWithCookies(uint64_t callbackID)
+{
+    HashSet<String> hostnames;
+
+    WebCore::getHostnamesWithCookies(hostnames);
+
+    Vector<String> hostnameList;
+    copyToVector(hostnames, hostnameList);
+
+    WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::DidGetHostnamesWithCookies(hostnameList, callbackID), 0);
+}
+
+void WebCookieManager::deleteCookiesForHostname(const String& hostname)
+{
+    WebCore::deleteCookiesForHostname(hostname);
+}
+
+void WebCookieManager::deleteAllCookies()
+{
+    WebCore::deleteAllCookies();
+}
+
+void WebCookieManager::startObservingCookieChanges()
+{
+    WebCore::startObservingCookieChanges();
+}
+
+void WebCookieManager::stopObservingCookieChanges()
+{
+    WebCore::stopObservingCookieChanges();
+}
+
+void WebCookieManager::dispatchCookiesDidChange()
+{
+    WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::CookiesDidChange(), 0);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h
new file mode 100644
index 0000000..911020c
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCookieManager_h
+#define WebCookieManager_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class Connection;
+    class MessageID;
+}
+
+namespace WebKit {
+
+class WebCookieManager {
+    WTF_MAKE_NONCOPYABLE(WebCookieManager);
+public:
+    static WebCookieManager& shared();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    
+    void dispatchCookiesDidChange();
+
+private:
+    WebCookieManager();
+    
+    void getHostnamesWithCookies(uint64_t callbackID);
+    void deleteCookiesForHostname(const String&);
+    void deleteAllCookies();
+
+    void startObservingCookieChanges();
+    void stopObservingCookieChanges();
+
+    void didReceiveWebCookieManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+};
+
+} // namespace WebKit
+
+#endif // WebCookieManager_h
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in
new file mode 100644
index 0000000..470facb
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+ messages -> WebCookieManager {
+    void GetHostnamesWithCookies(uint64_t callbackID)
+    void DeleteCookiesForHostname(WTF::String hostname)
+    void DeleteAllCookies()
+    
+    void StartObservingCookieChanges()
+    void StopObservingCookieChanges()
+}
diff --git a/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp b/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp
index 1cb288e..4a96b11 100644
--- a/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp
@@ -78,7 +78,7 @@ void DownloadManager::downloadFinished(Download* download)
 
     delete download;
 
-    WebProcess::shared().shutdownIfPossible();
+    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Downloads/cf/DownloadCFNet.cpp b/Source/WebKit2/WebProcess/Downloads/cf/DownloadCFNet.cpp
index c8a065e..3215039 100644
--- a/Source/WebKit2/WebProcess/Downloads/cf/DownloadCFNet.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/cf/DownloadCFNet.cpp
@@ -27,11 +27,11 @@
 #include "Download.h"
 
 #include "DataReference.h"
-#include "NotImplemented.h"
 
 #pragma warning(push, 0)
 #include <WebCore/DownloadBundle.h>
 #include <WebCore/LoaderRunLoopCF.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/ResourceError.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/ResourceResponse.h>
diff --git a/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp b/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp
index eb0a1cd..6ebce01 100644
--- a/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "Download.h"
 
-#include "NotImplemented.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm b/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
index 0abd744..f7fe8dc 100644
--- a/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
+++ b/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
@@ -28,11 +28,11 @@
 
 #import <WebCore/BackForwardController.h>
 #import <WebCore/HistoryItem.h>
+#import <WebCore/NotImplemented.h>
 #import <WebCore/Page.h>
 #import <WebCore/ResourceHandle.h>
 #import <WebCore/ResourceResponse.h>
 #import "DataReference.h"
-#import "NotImplemented.h"
 #import "WebPage.h"
 
 @interface NSURLDownload (WebNSURLDownloadDetails)
diff --git a/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp b/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp
index 131f53a..19b86f0 100644
--- a/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "Download.h"
 
-#include "NotImplemented.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp b/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
index ba2aad0..1ac23b1 100644
--- a/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
+++ b/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "GeolocationPermissionRequestManager.h"
 
+#include "WebCoreArgumentCoders.h"
 #include "WebFrame.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
index 82f616a..dd44e93 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
@@ -164,6 +164,13 @@ WKBundlePageRef WKBundleFrameGetPage(WKBundleFrameRef frameRef)
     return toAPI(toImpl(frameRef)->page());
 }
 
+void WKBundleFrameClearOpener(WKBundleFrameRef frameRef)
+{
+    Frame* coreFrame = toImpl(frameRef)->coreFrame();
+    if (coreFrame)
+        coreFrame->loader()->setOpener(0);
+}
+
 WKStringRef WKBundleFrameCopyLayerTreeAsText(WKBundleFrameRef frameRef)
 {
     return toCopiedAPI(toImpl(frameRef)->layerTreeAsText());
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFramePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFramePrivate.h
index 3f83a61..a31e4ae 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFramePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFramePrivate.h
@@ -47,6 +47,7 @@ WK_EXPORT void WKBundleFrameSuspendAnimations(WKBundleFrameRef frame);
 WK_EXPORT void WKBundleFrameResumeAnimations(WKBundleFrameRef frame);
 WK_EXPORT unsigned WKBundleFrameGetPendingUnloadCount(WKBundleFrameRef frame);
 WK_EXPORT WKStringRef WKBundleFrameCopyLayerTreeAsText(WKBundleFrameRef frame);
+WK_EXPORT void WKBundleFrameClearOpener(WKBundleFrameRef frame);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.cpp
index b764ee9..4e941c3 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.cpp
@@ -38,10 +38,10 @@ WKTypeID WKBundleHitTestResultGetTypeID()
     return toAPI(InjectedBundleHitTestResult::APIType);
 }
 
-WKBundleNodeHandleRef WKBundleHitTestResultGetNodeHandle(WKBundleHitTestResultRef hitTestResultRef)
+WKBundleNodeHandleRef WKBundleHitTestResultCopyNodeHandle(WKBundleHitTestResultRef hitTestResultRef)
 {
     RefPtr<InjectedBundleNodeHandle> nodeHandle = toImpl(hitTestResultRef)->nodeHandle();
-    return toAPI(nodeHandle.get());
+    return toAPI(nodeHandle.release().leakRef());
 }
 
 WKBundleFrameRef WKBundleHitTestResultGetFrame(WKBundleHitTestResultRef hitTestResultRef)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.h
index 19a6582..b288e0b 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.h
@@ -35,7 +35,7 @@ extern "C" {
 
 WK_EXPORT WKTypeID WKBundleHitTestResultGetTypeID();
 
-WK_EXPORT WKBundleNodeHandleRef WKBundleHitTestResultGetNodeHandle(WKBundleHitTestResultRef hitTestResult);
+WK_EXPORT WKBundleNodeHandleRef WKBundleHitTestResultCopyNodeHandle(WKBundleHitTestResultRef hitTestResult);
 
 WK_EXPORT WKBundleFrameRef WKBundleHitTestResultGetFrame(WKBundleHitTestResultRef hitTestResult);
 WK_EXPORT WKBundleFrameRef WKBundleHitTestResultGetTargetFrame(WKBundleHitTestResultRef hitTestResult);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
index 9b0eaf1..0e91d8e 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
@@ -45,6 +45,12 @@ WKBundleNodeHandleRef WKBundleNodeHandleCreate(JSContextRef contextRef, JSObject
     return toAPI(nodeHandle.release().releaseRef());
 }
 
+WKBundleNodeHandleRef WKBundleNodeHandleCopyDocument(WKBundleNodeHandleRef nodeHandleRef)
+{
+    RefPtr<InjectedBundleNodeHandle> nodeHandle = toImpl(nodeHandleRef)->document();
+    return toAPI(nodeHandle.release().releaseRef());
+}
+
 WKRect WKBundleNodeHandleGetElementBounds(WKBundleNodeHandleRef nodeHandleRef)
 {
     return toAPI(toImpl(nodeHandleRef)->elementBounds());
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
index 8953ff8..aaa95e6 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
@@ -36,6 +36,9 @@ extern "C" {
 
 WK_EXPORT WKBundleNodeHandleRef WKBundleNodeHandleCreate(JSContextRef context, JSObjectRef object);
 
+/* Convenience Operations */
+WK_EXPORT WKBundleNodeHandleRef WKBundleNodeHandleCopyDocument(WKBundleNodeHandleRef nodeHandle);
+
 
 /* Additional DOM Operations */
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
index a1a4da3..58052c5 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
@@ -212,3 +212,8 @@ WKBundleInspectorRef WKBundlePageGetInspector(WKBundlePageRef pageRef)
     return toAPI(toImpl(pageRef)->inspector());
 }
 #endif
+
+void WKBundlePageForceRepaint(WKBundlePageRef page)
+{
+    toImpl(page)->forceRepaintWithoutCallback();
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
index 944a5b6..4be67d5 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
@@ -114,17 +114,25 @@ struct WKBundlePageLoaderClient {
 };
 typedef struct WKBundlePageLoaderClient WKBundlePageLoaderClient;
 
+enum {
+    WKBundlePagePolicyActionPassThrough,
+    WKBundlePagePolicyActionUse
+};
+typedef uint32_t WKBundlePagePolicyAction;
+
 // Policy Client
-typedef void (*WKBundlePageDecidePolicyForNavigationActionCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleNavigationActionRef navigationAction, WKURLRequestRef request, WKTypeRef* userData, const void* clientInfo);
-typedef void (*WKBundlePageDecidePolicyForNewWindowActionCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleNavigationActionRef navigationAction, WKURLRequestRef request, WKStringRef frameName, WKTypeRef* userData, const void* clientInfo);
-typedef void (*WKBundlePageDecidePolicyForMIMETypeCallback)(WKBundlePageRef page, WKBundleFrameRef frame,  WKStringRef MIMEType, WKURLRequestRef request, WKTypeRef* userData, const void* clientInfo);
+typedef WKBundlePagePolicyAction (*WKBundlePageDecidePolicyForNavigationActionCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleNavigationActionRef navigationAction, WKURLRequestRef request, WKTypeRef* userData, const void* clientInfo);
+typedef WKBundlePagePolicyAction (*WKBundlePageDecidePolicyForNewWindowActionCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleNavigationActionRef navigationAction, WKURLRequestRef request, WKStringRef frameName, WKTypeRef* userData, const void* clientInfo);
+typedef WKBundlePagePolicyAction (*WKBundlePageDecidePolicyForResponseCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKURLResponseRef response, WKURLRequestRef request, WKTypeRef* userData, const void* clientInfo);
+typedef void (*WKBundlePageUnableToImplementPolicyCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKErrorRef error, WKTypeRef* userData, const void* clientInfo);
 
 struct WKBundlePagePolicyClient {
     int                                                                 version;
     const void *                                                        clientInfo;
     WKBundlePageDecidePolicyForNavigationActionCallback                 decidePolicyForNavigationAction;
     WKBundlePageDecidePolicyForNewWindowActionCallback                  decidePolicyForNewWindowAction;
-    WKBundlePageDecidePolicyForMIMETypeCallback                         decidePolicyForMIMEType;
+    WKBundlePageDecidePolicyForResponseCallback                         decidePolicyForResponse;
+    WKBundlePageUnableToImplementPolicyCallback                         unableToImplementPolicy;
 };
 typedef struct WKBundlePagePolicyClient WKBundlePagePolicyClient;
 
@@ -140,7 +148,10 @@ struct WKBundlePageResourceLoadClient {
     int                                                                 version;
     const void *                                                        clientInfo;
     WKBundlePageDidInitiateLoadForResourceCallback                      didInitiateLoadForResource;
+
+    // willSendRequestForFrame is supposed to return a retained reference to the URL request.
     WKBundlePageWillSendRequestForFrameCallback                         willSendRequestForFrame;
+
     WKBundlePageDidReceiveResponseForResourceCallback                   didReceiveResponseForResource;
     WKBundlePageDidReceiveContentLengthForResourceCallback              didReceiveContentLengthForResource;
     WKBundlePageDidFinishLoadForResourceCallback                        didFinishLoadForResource;
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
index 4bc8fed..b9dce68 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
@@ -45,6 +45,8 @@ WK_EXPORT void WKBundlePageSetTextZoomFactor(WKBundlePageRef page, double zoomFa
 WK_EXPORT double WKBundlePageGetPageZoomFactor(WKBundlePageRef page);
 WK_EXPORT void WKBundlePageSetPageZoomFactor(WKBundlePageRef page, double zoomFactor);
 
+WK_EXPORT void WKBundlePageForceRepaint(WKBundlePageRef page);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
index 43cf1ef..858941e 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
@@ -95,6 +95,11 @@ Node* InjectedBundleNodeHandle::coreNode() const
     return m_node.get();
 }
 
+PassRefPtr<InjectedBundleNodeHandle> InjectedBundleNodeHandle::document()
+{
+    return getOrCreate(m_node->document());
+}
+
 // Additional DOM Operations
 // Note: These should only be operations that are not exposed to JavaScript.
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
index a02f7f2..0dcebf6 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
@@ -53,6 +53,9 @@ public:
 
     WebCore::Node* coreNode() const;
 
+    // Convenience DOM Operations
+    PassRefPtr<InjectedBundleNodeHandle> document();
+
     // Additional DOM Operations
     // Note: These should only be operations that are not exposed to JavaScript.
     WebCore::IntRect elementBounds() const;
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp
index c55e729..b90cf1f 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp
@@ -27,45 +27,60 @@
 #include "InjectedBundlePagePolicyClient.h"
 
 #include "WKBundleAPICast.h"
+#include "WebError.h"
 #include "WebURLRequest.h"
 
 using namespace WebCore;
 
 namespace WebKit {
 
-void InjectedBundlePagePolicyClient::decidePolicyForNavigationAction(WebPage* page, WebFrame* frame, InjectedBundleNavigationAction* action, const ResourceRequest& resourceRequest, RefPtr<APIObject>& userData)
+WKBundlePagePolicyAction InjectedBundlePagePolicyClient::decidePolicyForNavigationAction(WebPage* page, WebFrame* frame, InjectedBundleNavigationAction* action, const ResourceRequest& resourceRequest, RefPtr<APIObject>& userData)
 {
     if (!m_client.decidePolicyForNavigationAction)
-        return;
+        return WKBundlePagePolicyActionPassThrough;
 
     RefPtr<WebURLRequest> request = WebURLRequest::create(resourceRequest);
 
     WKTypeRef userDataToPass = 0;
-    m_client.decidePolicyForNavigationAction(toAPI(page), toAPI(frame), toAPI(action), toAPI(request.get()), &userDataToPass, m_client.clientInfo);
+    WKBundlePagePolicyAction policy = m_client.decidePolicyForNavigationAction(toAPI(page), toAPI(frame), toAPI(action), toAPI(request.get()), &userDataToPass, m_client.clientInfo);
     userData = adoptRef(toImpl(userDataToPass));
+    return policy;
 }
 
-void InjectedBundlePagePolicyClient::decidePolicyForNewWindowAction(WebPage* page, WebFrame* frame, InjectedBundleNavigationAction* action, const ResourceRequest& resourceRequest, const String& frameName, RefPtr<APIObject>& userData)
+WKBundlePagePolicyAction InjectedBundlePagePolicyClient::decidePolicyForNewWindowAction(WebPage* page, WebFrame* frame, InjectedBundleNavigationAction* action, const ResourceRequest& resourceRequest, const String& frameName, RefPtr<APIObject>& userData)
 {
     if (!m_client.decidePolicyForNewWindowAction)
-        return;
+        return WKBundlePagePolicyActionPassThrough;
 
     RefPtr<WebURLRequest> request = WebURLRequest::create(resourceRequest);
 
     WKTypeRef userDataToPass = 0;
-    m_client.decidePolicyForNewWindowAction(toAPI(page), toAPI(frame), toAPI(action), toAPI(request.get()), toAPI(frameName.impl()), &userDataToPass, m_client.clientInfo);
+    WKBundlePagePolicyAction policy = m_client.decidePolicyForNewWindowAction(toAPI(page), toAPI(frame), toAPI(action), toAPI(request.get()), toAPI(frameName.impl()), &userDataToPass, m_client.clientInfo);
     userData = adoptRef(toImpl(userDataToPass));
+    return policy;
 }
 
-void InjectedBundlePagePolicyClient::decidePolicyForMIMEType(WebPage* page, WebFrame* frame, const String& MIMEType, const ResourceRequest& resourceRequest, RefPtr<APIObject>& userData)
+WKBundlePagePolicyAction InjectedBundlePagePolicyClient::decidePolicyForResponse(WebPage* page, WebFrame* frame, const ResourceResponse& resourceResponse, const ResourceRequest& resourceRequest, RefPtr<APIObject>& userData)
 {
-    if (!m_client.decidePolicyForMIMEType)
-        return;
+    if (!m_client.decidePolicyForResponse)
+        return WKBundlePagePolicyActionPassThrough;
 
+    RefPtr<WebURLResponse> response = WebURLResponse::create(resourceResponse);
     RefPtr<WebURLRequest> request = WebURLRequest::create(resourceRequest);
 
     WKTypeRef userDataToPass = 0;
-    m_client.decidePolicyForMIMEType(toAPI(page), toAPI(frame), toAPI(MIMEType.impl()), toAPI(request.get()), &userDataToPass, m_client.clientInfo);
+    WKBundlePagePolicyAction policy = m_client.decidePolicyForResponse(toAPI(page), toAPI(frame), toAPI(response.get()), toAPI(request.get()), &userDataToPass, m_client.clientInfo);
+    userData = adoptRef(toImpl(userDataToPass));
+    return policy;
+}
+
+void InjectedBundlePagePolicyClient::unableToImplementPolicy(WebPage* page, WebFrame* frame, const WebCore::ResourceError& error, RefPtr<APIObject>& userData)
+{
+    if (!m_client.unableToImplementPolicy)
+        return;
+
+    WKTypeRef userDataToPass = 0;
+    m_client.unableToImplementPolicy(toAPI(page), toAPI(frame), toAPI(error), &userDataToPass, m_client.clientInfo);
     userData = adoptRef(toImpl(userDataToPass));
 }
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.h
index 2145ac4..fd02196 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.h
@@ -32,7 +32,9 @@
 #include <wtf/Forward.h>
 
 namespace WebCore {
+    class ResourceError;
     class ResourceRequest;
+    class ResourceResponse;
 }
 
 namespace WebKit {
@@ -43,9 +45,10 @@ class WebPage;
 
 class InjectedBundlePagePolicyClient : public APIClient<WKBundlePagePolicyClient> {
 public:
-    void decidePolicyForNavigationAction(WebPage*, WebFrame*, InjectedBundleNavigationAction*, const WebCore::ResourceRequest&, RefPtr<APIObject>& userData);
-    void decidePolicyForNewWindowAction(WebPage*, WebFrame*, InjectedBundleNavigationAction*, const WebCore::ResourceRequest&, const String& frameName, RefPtr<APIObject>& userData);
-    void decidePolicyForMIMEType(WebPage*, WebFrame*, const String& MIMEType, const WebCore::ResourceRequest&, RefPtr<APIObject>& userData);
+    WKBundlePagePolicyAction decidePolicyForNavigationAction(WebPage*, WebFrame*, InjectedBundleNavigationAction*, const WebCore::ResourceRequest&, RefPtr<APIObject>& userData);
+    WKBundlePagePolicyAction decidePolicyForNewWindowAction(WebPage*, WebFrame*, InjectedBundleNavigationAction*, const WebCore::ResourceRequest&, const String& frameName, RefPtr<APIObject>& userData);
+    WKBundlePagePolicyAction decidePolicyForResponse(WebPage*, WebFrame*, const WebCore::ResourceResponse&, const WebCore::ResourceRequest&, RefPtr<APIObject>& userData);
+    void unableToImplementPolicy(WebPage*, WebFrame*, const WebCore::ResourceError&, RefPtr<APIObject>& userData);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp
index c2866a8..49dcac6 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp
@@ -46,7 +46,7 @@ void InjectedBundlePageResourceLoadClient::willSendRequestForFrame(WebPage* page
     if (!m_client.willSendRequestForFrame)
         return;
 
-    RefPtr<WebURLRequest> returnedRequest = toImpl(m_client.willSendRequestForFrame(toAPI(page), toAPI(frame), identifier, toAPI(request), toAPI(redirectResponse), m_client.clientInfo));
+    RefPtr<WebURLRequest> returnedRequest = adoptRef(toImpl(m_client.willSendRequestForFrame(toAPI(page), toAPI(frame), identifier, toAPI(request), toAPI(redirectResponse), m_client.clientInfo)));
     if (returnedRequest)
         request = returnedRequest->resourceRequest();
     else
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp b/Source/WebKit2/WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp
index c75e433..bbf24e4 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp
@@ -27,9 +27,9 @@
 #include "config.h"
 #include "InjectedBundle.h"
 
-#include "NotImplemented.h"
 #include "WKBundleAPICast.h"
 #include "WKBundleInitialize.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
new file mode 100644
index 0000000..5ee1419
--- /dev/null
+++ b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKeyValueStorageManager.h"
+
+#include "MessageID.h"
+#include "SecurityOriginData.h"
+#include "WebKeyValueStorageManagerProxyMessages.h"
+#include "WebProcess.h"
+
+#include <WebCore/NotImplemented.h>
+#include <WebCore/SecurityOrigin.h>
+#include <WebCore/SecurityOriginHash.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebKeyValueStorageManager& WebKeyValueStorageManager::shared()
+{
+    static WebKeyValueStorageManager& shared = *new WebKeyValueStorageManager;
+    return shared;
+}
+
+WebKeyValueStorageManager::WebKeyValueStorageManager()
+{
+}
+
+void WebKeyValueStorageManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebKeyValueStorageManagerMessage(connection, messageID, arguments);
+}
+
+void WebKeyValueStorageManager::getKeyValueStorageOrigins(uint64_t callbackID)
+{
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash> origins;
+
+    // FIXME: <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172 - Actually get the origins from WebCore once https://bugs.webkit.org/show_bug.cgi?id=51878 is resolved.
+
+    Vector<SecurityOriginData> identifiers;
+    identifiers.reserveCapacity(origins.size());
+
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::iterator end = origins.end();
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::iterator i = origins.begin();
+    for (; i != end; ++i) {
+        RefPtr<SecurityOrigin> origin = *i;
+        
+        SecurityOriginData originData;
+        originData.protocol = origin->protocol();
+        originData.host = origin->host();
+        originData.port = origin->port();
+
+        identifiers.uncheckedAppend(originData);
+    }
+
+    WebProcess::shared().connection()->send(Messages::WebKeyValueStorageManagerProxy::DidGetKeyValueStorageOrigins(identifiers, callbackID), 0);
+}
+
+void WebKeyValueStorageManager::deleteEntriesForOrigin(const SecurityOriginData& originData)
+{
+    // FIXME: <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172 - Implement once https://bugs.webkit.org/show_bug.cgi?id=51878 is resolved.
+    notImplemented();
+}
+
+void WebKeyValueStorageManager::deleteAllEntries()
+{
+    // FIXME: <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172 - Implement once https://bugs.webkit.org/show_bug.cgi?id=51878 is resolved.
+    notImplemented();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.h b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.h
new file mode 100644
index 0000000..d86a8be
--- /dev/null
+++ b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebKeyValueStorageManager_h
+#define WebKeyValueStorageManager_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class Connection;
+    class MessageID;
+}
+
+namespace WebKit {
+
+struct SecurityOriginData;
+
+class WebKeyValueStorageManager {
+    WTF_MAKE_NONCOPYABLE(WebKeyValueStorageManager);
+
+public:
+    static WebKeyValueStorageManager& shared();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    WebKeyValueStorageManager();
+    
+    void getKeyValueStorageOrigins(uint64_t callbackID);
+    void deleteEntriesForOrigin(const SecurityOriginData&);
+    void deleteAllEntries();
+
+    void didReceiveWebKeyValueStorageManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+};
+
+} // namespace WebKit
+
+#endif // WebKeyValueStorageManager_h
diff --git a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.messages.in b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.messages.in
new file mode 100644
index 0000000..2f0d648
--- /dev/null
+++ b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.messages.in
@@ -0,0 +1,27 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebKeyValueStorageManager {
+    void GetKeyValueStorageOrigins(uint64_t callbackID)
+    void DeleteEntriesForOrigin(WebKit::SecurityOriginData originIdentifier)
+    void DeleteAllEntries()
+}
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp
index edd2b44..fc73519 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp
@@ -27,24 +27,25 @@
 #include "JSNPMethod.h"
 
 #include "JSNPObject.h"
-#include "NotImplemented.h"
 #include <JavaScriptCore/Error.h>
 #include <JavaScriptCore/FunctionPrototype.h>
 #include <JavaScriptCore/JSGlobalObject.h>
 #include <WebCore/JSHTMLElement.h>
 #include <WebCore/JSPluginElementFunctions.h>
+#include <WebCore/NotImplemented.h>
 
 using namespace JSC;
 using namespace WebCore;
 
 namespace WebKit {
 
-const ClassInfo JSNPMethod::s_info = { "NPMethod", &InternalFunction::info, 0, 0 };
+const ClassInfo JSNPMethod::s_info = { "NPMethod", &InternalFunction::s_info, 0, 0 };
 
 JSNPMethod::JSNPMethod(ExecState* exec, JSGlobalObject* globalObject, const Identifier& name, NPIdentifier npIdentifier)
     : InternalFunction(&exec->globalData(), globalObject, createStructure(globalObject->functionPrototype()), name)
     , m_npIdentifier(npIdentifier)
 {
+    ASSERT(inherits(&s_info));
 }
 
 static EncodedJSValue JSC_HOST_CALL callMethod(ExecState* exec)
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
index 9a8578c..a913a99 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
@@ -44,11 +44,10 @@ public:
 private:    
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     
     NPIdentifier m_npIdentifier;
 };
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
index f6939cb..2724f0d 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
@@ -47,13 +47,15 @@ static NPIdentifier npIdentifierFromIdentifier(const Identifier& identifier)
     return static_cast<NPIdentifier>(IdentifierRep::get(identifier.ustring().utf8().data()));
 }
 
-const ClassInfo JSNPObject::s_info = { "NPObject", 0, 0, 0 };
+const ClassInfo JSNPObject::s_info = { "NPObject", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
 JSNPObject::JSNPObject(JSGlobalObject* globalObject, NPRuntimeObjectMap* objectMap, NPObject* npObject)
     : JSObjectWithGlobalObject(globalObject, createStructure(globalObject->objectPrototype()))
     , m_objectMap(objectMap)
     , m_npObject(npObject)
 {
+    ASSERT(inherits(&s_info));
+
     // We should never have an NPJSObject inside a JSNPObject.
     ASSERT(!NPJSObject::isNPJSObject(m_npObject));
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
index af1369a..adaffa7 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
@@ -53,11 +53,11 @@ public:
     NPObject* npObject() const { return m_npObject; }
 
 private:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSObject::StructureFlags;
     
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
@@ -73,8 +73,6 @@ private:
     static JSC::JSValue methodGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
     static JSC::JSObject* throwInvalidAccessError(JSC::ExecState*);
 
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-
     NPRuntimeObjectMap* m_objectMap;
     NPObject* m_npObject;
 };
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
index 345bd54..4c687f4 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
@@ -29,12 +29,12 @@
 #include "JSNPObject.h"
 #include "NPRuntimeObjectMap.h"
 #include "NPRuntimeUtilities.h"
-#include "NotImplemented.h"
 #include "PluginView.h"
 #include <JavaScriptCore/JSLock.h>
 #include <JavaScriptCore/JSObject.h>
 #include <WebCore/Frame.h>  
 #include <WebCore/IdentifierRep.h>
+#include <WebCore/NotImplemented.h>
 #include <wtf/text/WTFString.h>
 
 using namespace JSC;
@@ -42,19 +42,20 @@ using namespace WebCore;
 
 namespace WebKit {
 
-NPJSObject* NPJSObject::create(NPRuntimeObjectMap* objectMap, JSObject* jsObject)
+NPJSObject* NPJSObject::create(JSGlobalData& globalData, NPRuntimeObjectMap* objectMap, JSObject* jsObject)
 {
     // We should never have a JSNPObject inside an NPJSObject.
     ASSERT(!jsObject->inherits(&JSNPObject::s_info));
 
     NPJSObject* npJSObject = toNPJSObject(createNPObject(0, npClass()));
-    npJSObject->initialize(objectMap, jsObject);
+    npJSObject->initialize(globalData, objectMap, jsObject);
 
     return npJSObject;
 }
 
 NPJSObject::NPJSObject()
     : m_objectMap(0)
+    , m_jsObject(Global<JSObject>::EmptyValue)
 {
 }
 
@@ -68,13 +69,13 @@ bool NPJSObject::isNPJSObject(NPObject* npObject)
     return npObject->_class == npClass();
 }
 
-void NPJSObject::initialize(NPRuntimeObjectMap* objectMap, JSObject* jsObject)
+void NPJSObject::initialize(JSGlobalData& globalData, NPRuntimeObjectMap* objectMap, JSObject* jsObject)
 {
     ASSERT(!m_objectMap);
     ASSERT(!m_jsObject);
 
     m_objectMap = objectMap;
-    m_jsObject = jsObject;
+    m_jsObject.set(globalData, jsObject);
 }
 
 static Identifier identifierFromIdentifierRep(ExecState* exec, IdentifierRep* identifierRep)
@@ -132,7 +133,7 @@ bool NPJSObject::invokeDefault(const NPVariant* arguments, uint32_t argumentCoun
 
     JSLock lock(SilenceAssertionsOnly);
 
-    JSValue function = m_jsObject;
+    JSValue function = m_jsObject.get();
     return invoke(exec, m_objectMap->globalObject(), function, arguments, argumentCount, result);
 }
 
@@ -259,7 +260,7 @@ bool NPJSObject::construct(const NPVariant* arguments, uint32_t argumentCount, N
     JSLock lock(SilenceAssertionsOnly);
 
     ConstructData constructData;
-    ConstructType constructType = getConstructData(m_jsObject, constructData);
+    ConstructType constructType = getConstructData(m_jsObject.get(), constructData);
     if (constructType == ConstructTypeNone)
         return false;
 
@@ -269,7 +270,7 @@ bool NPJSObject::construct(const NPVariant* arguments, uint32_t argumentCount, N
         argumentList.append(m_objectMap->convertNPVariantToJSValue(exec, m_objectMap->globalObject(), arguments[i]));
 
     exec->globalData().timeoutChecker.start();
-    JSValue value = JSC::construct(exec, m_jsObject, constructType, constructData, argumentList);
+    JSValue value = JSC::construct(exec, m_jsObject.get(), constructType, constructData, argumentList);
     exec->globalData().timeoutChecker.stop();
     
     // Convert and return the new object.
@@ -292,7 +293,7 @@ bool NPJSObject::invoke(ExecState* exec, JSGlobalObject* globalObject, JSValue f
         argumentList.append(m_objectMap->convertNPVariantToJSValue(exec, globalObject, arguments[i]));
 
     exec->globalData().timeoutChecker.start();
-    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject, argumentList);
+    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject.get(), argumentList);
     exec->globalData().timeoutChecker.stop();
 
     // Convert and return the result of the function call.
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h
index 3518221..796f1c3 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h
@@ -26,13 +26,16 @@
 #ifndef NPJSObject_h
 #define NPJSObject_h
 
-#include <JavaScriptCore/Protect.h>
+#include <JavaScriptCore/Global.h>
 #include <WebCore/npruntime_internal.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
-    class JSGlobalObject;
-    class JSObject;
+
+class JSGlobalData;
+class JSGlobalObject;
+class JSObject;
+
 }
 
 namespace WebKit {
@@ -43,7 +46,7 @@ class NPRuntimeObjectMap;
 class NPJSObject : public NPObject {
     WTF_MAKE_NONCOPYABLE(NPJSObject);
 public:
-    static NPJSObject* create(NPRuntimeObjectMap* objectMap, JSC::JSObject* jsObject);
+    static NPJSObject* create(JSC::JSGlobalData&, NPRuntimeObjectMap*, JSC::JSObject*);
 
     JSC::JSObject* jsObject() const { return m_jsObject.get(); }
 
@@ -59,7 +62,7 @@ private:
     NPJSObject();
     ~NPJSObject();
 
-    void initialize(NPRuntimeObjectMap*, JSC::JSObject* jsObject);
+    void initialize(JSC::JSGlobalData&, NPRuntimeObjectMap*, JSC::JSObject*);
 
     bool hasMethod(NPIdentifier methodName);
     bool invoke(NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result);
@@ -87,7 +90,7 @@ private:
     static bool NP_Construct(NPObject*, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result);
     
     NPRuntimeObjectMap* m_objectMap;
-    JSC::ProtectedPtr<JSC::JSObject> m_jsObject;
+    JSC::Global<JSC::JSObject> m_jsObject;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
index 0a96ad7..f6c0057 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
@@ -29,12 +29,12 @@
 #include "JSNPObject.h"
 #include "NPJSObject.h"
 #include "NPRuntimeUtilities.h"
-#include "NotImplemented.h"
 #include "PluginView.h"
 #include <JavaScriptCore/Error.h>
 #include <JavaScriptCore/JSLock.h>
 #include <JavaScriptCore/SourceCode.h>
 #include <WebCore/Frame.h>
+#include <WebCore/NotImplemented.h>
 
 using namespace JSC;
 using namespace WebCore;
@@ -58,7 +58,7 @@ NPRuntimeObjectMap::PluginProtector::~PluginProtector()
 {
 }
 
-NPObject* NPRuntimeObjectMap::getOrCreateNPObject(JSObject* jsObject)
+NPObject* NPRuntimeObjectMap::getOrCreateNPObject(JSGlobalData& globalData, JSObject* jsObject)
 {
     // If this is a JSNPObject, we can just get its underlying NPObject.
     if (jsObject->classInfo() == &JSNPObject::s_info) {
@@ -75,7 +75,7 @@ NPObject* NPRuntimeObjectMap::getOrCreateNPObject(JSObject* jsObject)
         return npJSObject;
     }
 
-    NPJSObject* npJSObject = NPJSObject::create(this, jsObject);
+    NPJSObject* npJSObject = NPJSObject::create(globalData, this, jsObject);
     m_npJSObjects.set(jsObject, npJSObject);
 
     return npJSObject;
@@ -172,7 +172,7 @@ void NPRuntimeObjectMap::convertJSValueToNPVariant(ExecState* exec, JSValue valu
     }
 
     if (value.isObject()) {
-        NPObject* npObject = getOrCreateNPObject(asObject(value));
+        NPObject* npObject = getOrCreateNPObject(exec->globalData(), asObject(value));
         OBJECT_TO_NPVARIANT(npObject, variant);
         return;
     }
@@ -182,14 +182,14 @@ void NPRuntimeObjectMap::convertJSValueToNPVariant(ExecState* exec, JSValue valu
 
 bool NPRuntimeObjectMap::evaluate(NPObject* npObject, const String&scriptString, NPVariant* result)
 {
-    ProtectedPtr<JSGlobalObject> globalObject = this->globalObject();
+    Global<JSGlobalObject> globalObject(this->globalObject()->globalData(), this->globalObject());
     if (!globalObject)
         return false;
 
     ExecState* exec = globalObject->globalExec();
     
     JSLock lock(SilenceAssertionsOnly);
-    JSValue thisValue = getOrCreateJSObject(globalObject, npObject);
+    JSValue thisValue = getOrCreateJSObject(globalObject.get(), npObject);
 
     globalObject->globalData().timeoutChecker.start();
     Completion completion = JSC::evaluate(exec, globalObject->globalScopeChain(), makeSource(UString(scriptString.impl())), thisValue);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h
index a11c354..d13e1fe 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h
@@ -34,6 +34,7 @@ typedef struct _NPVariant NPVariant;
 
 namespace JSC {
     class ExecState;
+    class JSGlobalData;
     class JSGlobalObject;
     class JSObject;
     class JSValue;
@@ -61,7 +62,7 @@ public:
 
     // Returns an NPObject that wraps the given JSObject object. If there is already an NPObject that wraps this JSObject, it will
     // retain it and return it.
-    NPObject* getOrCreateNPObject(JSC::JSObject*);
+    NPObject* getOrCreateNPObject(JSC::JSGlobalData&, JSC::JSObject*);
     void npJSObjectDestroyed(NPJSObject*);
 
     // Returns a JSObject object that wraps the given NPObject.
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
index 5f8ee5c..679de6f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
@@ -28,9 +28,10 @@
 
 #include "NPRuntimeUtilities.h"
 #include "NetscapePlugin.h"
-#include "NotImplemented.h"
+#include "PluginController.h"
 #include <WebCore/HTTPHeaderMap.h>
 #include <WebCore/IdentifierRep.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/SharedBuffer.h>
 #include <utility>
 
@@ -39,6 +40,18 @@ using namespace std;
 
 namespace WebKit {
 
+// Helper class for delaying destruction of a plug-in.
+class PluginDestructionProtector {
+public:
+    explicit PluginDestructionProtector(NetscapePlugin* plugin)
+        : m_protector(static_cast<Plugin*>(plugin)->controller())
+    {
+    }
+    
+private:
+    PluginController::PluginDestructionProtector m_protector;
+};
+
 static bool startsWithBlankLine(const char* bytes, unsigned length)
 {
     return length > 0 && bytes[0] == '\n';
@@ -401,13 +414,18 @@ static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
     switch (variable) {
         case NPNVWindowNPObject: {
             RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+            PluginDestructionProtector protector(plugin.get());
 
             NPObject* windowNPObject = plugin->windowScriptNPObject();
+            if (!windowNPObject)
+                return NPERR_GENERIC_ERROR;
+
             *(NPObject**)value = windowNPObject;
             break;
         }
         case NPNVPluginElementNPObject: {
             RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+            PluginDestructionProtector protector(plugin.get());
 
             NPObject* pluginElementNPObject = plugin->pluginElementNPObject();
             *(NPObject**)value = pluginElementNPObject;
@@ -465,6 +483,18 @@ static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
        case NPNVSupportsWindowless:
            *(NPBool*)value = true;
            break;
+#elif PLUGIN_ARCHITECTURE(X11)
+       case NPNVToolkit: {
+           const uint32_t expectedGTKToolKitVersion = 2;
+
+           RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+           if (plugin->quirks().contains(PluginQuirks::RequiresGTKToolKit)) {
+               *reinterpret_cast<uint32_t*>(value) = expectedGTKToolKitVersion;
+               break;
+           }
+
+           return NPERR_GENERIC_ERROR;
+       }
 #endif
         default:
             notImplemented();
@@ -605,45 +635,62 @@ static bool NPN_InvokeDefault(NPP, NPObject *npObject, const NPVariant* argument
 static bool NPN_Evaluate(NPP npp, NPObject *npObject, NPString *script, NPVariant* result)
 {
     RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     String scriptString = String::fromUTF8WithLatin1Fallback(script->UTF8Characters, script->UTF8Length);
     
     return plugin->evaluate(npObject, scriptString, result);
 }
 
-static bool NPN_GetProperty(NPP, NPObject* npObject, NPIdentifier propertyName, NPVariant* result)
+static bool NPN_GetProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName, NPVariant* result)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (npObject->_class->getProperty)
         return npObject->_class->getProperty(npObject, propertyName, result);
     
     return false;
 }
 
-static bool NPN_SetProperty(NPP, NPObject* npObject, NPIdentifier propertyName, const NPVariant* value)
+static bool NPN_SetProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName, const NPVariant* value)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (npObject->_class->setProperty)
         return npObject->_class->setProperty(npObject, propertyName, value);
 
     return false;
 }
 
-static bool NPN_RemoveProperty(NPP, NPObject* npObject, NPIdentifier propertyName)
+static bool NPN_RemoveProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (npObject->_class->removeProperty)
         return npObject->_class->removeProperty(npObject, propertyName);
 
     return false;
 }
 
-static bool NPN_HasProperty(NPP, NPObject* npObject, NPIdentifier propertyName)
+static bool NPN_HasProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (npObject->_class->hasProperty)
         return npObject->_class->hasProperty(npObject, propertyName);
 
     return false;
 }
 
-static bool NPN_HasMethod(NPP, NPObject* npObject, NPIdentifier methodName)
+static bool NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (npObject->_class->hasMethod)
         return npObject->_class->hasMethod(npObject, methodName);
 
@@ -672,8 +719,11 @@ static void NPN_PopPopupsEnabledState(NPP npp)
     plugin->popPopupsEnabledState();
 }
     
-static bool NPN_Enumerate(NPP, NPObject* npObject, NPIdentifier** identifiers, uint32_t* identifierCount)
+static bool NPN_Enumerate(NPP npp, NPObject* npObject, NPIdentifier** identifiers, uint32_t* identifierCount)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (NP_CLASS_STRUCT_VERSION_HAS_ENUM(npObject->_class) && npObject->_class->enumerate)
         return npObject->_class->enumerate(npObject, identifiers, identifierCount);
 
@@ -685,8 +735,11 @@ static void NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void*), void*
     notImplemented();
 }
 
-static bool NPN_Construct(NPP, NPObject* npObject, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
+static bool NPN_Construct(NPP npp, NPObject* npObject, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
 {
+    RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+    PluginDestructionProtector protector(plugin.get());
+    
     if (NP_CLASS_STRUCT_VERSION_HAS_CTOR(npObject->_class) && npObject->_class->construct)
         return npObject->_class->construct(npObject, arguments, argumentCount, result);
 
@@ -716,7 +769,8 @@ static NPError NPN_GetValueForURL(NPP npp, NPNURLVariable variable, const char*
     switch (variable) {
         case NPNURLVCookie: {
             RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
-
+            PluginDestructionProtector protector(plugin.get());
+            
             String cookies = plugin->cookiesForURL(makeURLString(url));
             if (cookies.isNull())
                 return NPERR_GENERIC_ERROR;
@@ -726,7 +780,8 @@ static NPError NPN_GetValueForURL(NPP npp, NPNURLVariable variable, const char*
 
         case NPNURLVProxy: {
             RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
-
+            PluginDestructionProtector protector(plugin.get());
+            
             String proxies = plugin->proxiesForURL(makeURLString(url));
             if (proxies.isNull())
                 return NPERR_GENERIC_ERROR;
@@ -744,7 +799,8 @@ static NPError NPN_SetValueForURL(NPP npp, NPNURLVariable variable, const char*
     switch (variable) {
         case NPNURLVCookie: {
             RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
-
+            PluginDestructionProtector protector(plugin.get());
+            
             plugin->setCookiesForURL(makeURLString(url), String(value, len));
             return NPERR_NO_ERROR;
         }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index e746d5a..7e9b059 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -29,6 +29,7 @@
 #include "NPRuntimeObjectMap.h"
 #include "NetscapePluginStream.h"
 #include "PluginController.h"
+#include "ShareableBitmap.h"
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/HTTPHeaderMap.h>
 #include <WebCore/IntRect.h>
@@ -479,6 +480,23 @@ void NetscapePlugin::paint(GraphicsContext* context, const IntRect& dirtyRect)
     platformPaint(context, dirtyRect);
 }
 
+PassRefPtr<ShareableBitmap> NetscapePlugin::snapshot()
+{
+    if (!supportsSnapshotting() || m_frameRect.isEmpty())
+        return 0;
+
+    ASSERT(m_isStarted);
+    
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(m_frameRect.size());
+    OwnPtr<GraphicsContext> context = bitmap->createGraphicsContext();
+
+    context->translate(-m_frameRect.x(), -m_frameRect.y());
+
+    platformPaint(context.get(), m_frameRect, true);
+    
+    return bitmap.release();
+}
+
 void NetscapePlugin::geometryDidChange(const IntRect& frameRect, const IntRect& clipRect)
 {
     ASSERT(m_isStarted);
@@ -672,6 +690,14 @@ void NetscapePlugin::privateBrowsingStateChanged(bool privateBrowsingEnabled)
     NPP_SetValue(NPNVprivateModeBool, &value);
 }
 
+bool NetscapePlugin::supportsSnapshotting() const
+{
+#if PLATFORM(MAC)
+    return m_pluginModule && m_pluginModule->pluginQuirks().contains(PluginQuirks::SupportsSnapshotting);
+#endif
+    return false;
+}
+
 PluginController* NetscapePlugin::controller()
 {
     return m_pluginController;
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
index e807beb..e865d93 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
@@ -70,6 +70,8 @@ public:
     HWND containingWindow() const;
 #endif
 
+    PluginQuirks quirks() const { return m_pluginModule->pluginQuirks(); }
+
     void invalidate(const NPRect*);
     static const char* userAgent(NPP);
     void loadURL(const String& method, const String& urlString, const String& target, const WebCore::HTTPHeaderMap& headerFields,
@@ -126,7 +128,7 @@ private:
     void platformDestroy();
     bool platformInvalidate(const WebCore::IntRect&);
     void platformGeometryDidChange();
-    void platformPaint(WebCore::GraphicsContext*, const WebCore::IntRect& dirtyRect);
+    void platformPaint(WebCore::GraphicsContext*, const WebCore::IntRect& dirtyRect, bool isSnapshot = false);
 
     bool platformHandleMouseEvent(const WebMouseEvent&);
     bool platformHandleWheelEvent(const WebWheelEvent&);
@@ -139,6 +141,7 @@ private:
     virtual bool initialize(PluginController*, const Parameters&);
     virtual void destroy();
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect& dirtyRect);
+    virtual PassRefPtr<ShareableBitmap> snapshot();
 #if PLATFORM(MAC)
     virtual PlatformLayer* pluginLayer();
 #endif
@@ -176,6 +179,8 @@ private:
 
     virtual void privateBrowsingStateChanged(bool);
 
+    bool supportsSnapshotting() const;
+
     virtual PluginController* controller();
 
     PluginController* m_pluginController;
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp
index 2b734fd..f7c9440 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "NetscapePlugin.h"
 
-#include "NotImplemented.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
@@ -55,7 +55,7 @@ void NetscapePlugin::platformGeometryDidChange()
     notImplemented();
 }
 
-void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect)
+void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
index 46671b8..2a33008 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
@@ -373,7 +373,7 @@ static EventModifiers modifiersForEvent(const WebEvent& event)
 
 #endif
 
-void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect)
+void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool isSnapshot)
 {
     CGContextRef platformContext = context->platformContext();
 
@@ -383,7 +383,7 @@ void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirt
     switch (m_eventModel) {
         case NPEventModelCocoa: {
             // Don't send draw events when we're using the Core Animation drawing model.
-            if (m_drawingModel == NPDrawingModelCoreAnimation)
+            if (!isSnapshot && m_drawingModel == NPDrawingModelCoreAnimation)
                 return;
 
             NPCocoaEvent event = initializeEvent(NPCocoaEventDrawRect);
@@ -830,9 +830,8 @@ void NetscapePlugin::windowVisibilityChanged(bool)
 
 uint64_t NetscapePlugin::pluginComplexTextInputIdentifier() const
 {
-    // This is never called for NetscapePlugin.
-    ASSERT_NOT_REACHED();
-    return 0;
+    // Just return a dummy value; this is only called for in-process plug-ins, which we don't support on Mac.
+    return static_cast<uint64_t>(reinterpret_cast<uintptr_t>(this));
 }
 
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp
index 1ede2c3..581dcf3 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp
@@ -27,9 +27,9 @@
 #include "config.h"
 #include "NetscapePlugin.h"
 
-#include "NotImplemented.h"
 #include "WebEvent.h"
 #include <WebCore/GraphicsContext.h>
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
@@ -57,7 +57,7 @@ void NetscapePlugin::platformGeometryDidChange()
     notImplemented();
 }
 
-void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect)
+void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/win/LayerBackedDrawingAreaWin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/qt/PluginProxyQt.cpp
index 3c2f3c9..7af1784 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/LayerBackedDrawingAreaWin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/qt/PluginProxyQt.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Nokia Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,42 +24,20 @@
  */
 
 #include "config.h"
-#include "LayerBackedDrawingArea.h"
+#include "PluginProxy.h"
 
-#if USE(ACCELERATED_COMPOSITING)
+#if ENABLE(PLUGIN_PROCESS)
 
-using namespace WebCore;
+#include <WebCore/NotImplemented.h>
 
 namespace WebKit {
 
-void LayerBackedDrawingArea::platformInit()
-{
-}
-
-void LayerBackedDrawingArea::platformClear()
-{
-}
-
-void LayerBackedDrawingArea::attachCompositingContext()
-{
-}
-
-void LayerBackedDrawingArea::detachCompositingContext()
-{
-}
-
-void LayerBackedDrawingArea::setRootCompositingLayer(WebCore::GraphicsLayer* layer)
-{
-}
-
-void LayerBackedDrawingArea::scheduleCompositingLayerSync()
-{
-}
-
-void LayerBackedDrawingArea::syncCompositingLayers()
+bool PluginProxy::needsBackingStore() const
 {
+    notImplemented();
+    return true;
 }
 
 } // namespace WebKit
 
-#endif // USE(ACCELERATED_COMPOSITING)
+#endif // ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/win/NetscapePluginWin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/win/NetscapePluginWin.cpp
index e713f83..5fbe32c 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/win/NetscapePluginWin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/win/NetscapePluginWin.cpp
@@ -26,11 +26,11 @@
 #include "config.h"
 #include "NetscapePlugin.h"
 
-#include "NotImplemented.h"
 #include "PluginController.h"
 #include "WebEvent.h"
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/LocalWindowsContext.h>
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
@@ -135,7 +135,7 @@ void NetscapePlugin::platformGeometryDidChange()
     ::MoveWindow(m_window, m_frameRect.x(), m_frameRect.y(), m_frameRect.width(), m_frameRect.height(), TRUE);
 }
 
-void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect)
+void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool)
 {
     // FIXME: Call SetWindow here if we haven't called it yet (see r59904).
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.h b/Source/WebKit2/WebProcess/Plugins/Plugin.h
index 6f20159..6afeb5c 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.h
@@ -45,6 +45,7 @@ namespace WebCore {
 
 namespace WebKit {
 
+class ShareableBitmap;
 class WebKeyboardEvent;
 class WebMouseEvent;
 class WebWheelEvent;
@@ -76,6 +77,9 @@ public:
     // dirty rect are in window coordinates. The context is saved/restored by the caller.
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect& dirtyRect) = 0;
 
+    // Tells the plug-in to draw itself into a bitmap, and return that.
+    virtual PassRefPtr<ShareableBitmap> snapshot() = 0;
+
 #if PLATFORM(MAC)
     // If a plug-in is using the Core Animation drawing model, this returns its plug-in layer.
     virtual PlatformLayer* pluginLayer() = 0;
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginController.h b/Source/WebKit2/WebProcess/Plugins/PluginController.h
index 9dc8ec3..a104139 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginController.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginController.h
@@ -108,6 +108,30 @@ public:
     // Returns whether private browsing is enabled.
     virtual bool isPrivateBrowsingEnabled() = 0;
 
+    // Increments a counter that prevents the plug-in from being destroyed.
+    virtual void protectPluginFromDestruction() = 0;
+
+    // Decrements a counter that, when it reaches 0, stops preventing the plug-in from being destroyed.
+    virtual void unprotectPluginFromDestruction() = 0;
+
+    // Helper class for delaying destruction of a plug-in.
+    class PluginDestructionProtector {
+    public:
+        explicit PluginDestructionProtector(PluginController* pluginController)
+            : m_pluginController(pluginController)
+        {
+            m_pluginController->protectPluginFromDestruction();
+        }
+        
+        ~PluginDestructionProtector()
+        {
+            m_pluginController->unprotectPluginFromDestruction();
+        }
+        
+    private:
+        PluginController* m_pluginController;
+    };
+    
 protected:
     virtual ~PluginController() { }
 };
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
index 551e458..f267d9e 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
@@ -117,6 +117,8 @@ void PluginProxy::destroy()
     m_connection->connection()->sendSync(Messages::WebProcessConnection::DestroyPlugin(m_pluginInstanceID), Messages::WebProcessConnection::DestroyPlugin::Reply(), 0);
 
     m_isStarted = false;
+    m_pluginController = 0;
+
     m_connection->removePluginProxy(this);
 }
 
@@ -148,6 +150,16 @@ void PluginProxy::paint(GraphicsContext* graphicsContext, const IntRect& dirtyRe
     }
 }
 
+PassRefPtr<ShareableBitmap> PluginProxy::snapshot()
+{
+    IntSize bufferSize;
+    SharedMemory::Handle snapshotStoreHandle;
+    m_connection->connection()->sendSync(Messages::PluginControllerProxy::Snapshot(), Messages::PluginControllerProxy::Snapshot::Reply(bufferSize, snapshotStoreHandle), m_pluginInstanceID);
+
+    RefPtr<ShareableBitmap> snapshotBuffer = ShareableBitmap::create(bufferSize, snapshotStoreHandle);
+    return snapshotBuffer.release();
+}
+
 void PluginProxy::geometryDidChange(const IntRect& frameRect, const IntRect& clipRect)
 {
     ASSERT(m_isStarted);
@@ -394,6 +406,8 @@ void PluginProxy::getPluginElementNPObject(uint64_t& pluginElementNPObjectID)
 
 void PluginProxy::evaluate(const NPVariantData& npObjectAsVariantData, const String& scriptString, bool allowPopups, bool& returnValue, NPVariantData& resultData)
 {
+    PluginController::PluginDestructionProtector protector(m_pluginController);
+
     NPVariant npObjectAsVariant = m_connection->npRemoteObjectMap()->npVariantDataToNPVariant(npObjectAsVariantData);
     ASSERT(NPVARIANT_IS_OBJECT(npObjectAsVariant));
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
index 9be7bd1..4fe99a7 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
@@ -64,6 +64,7 @@ private:
     virtual bool initialize(PluginController*, const Parameters&);
     virtual void destroy();
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect& dirtyRect);
+    virtual PassRefPtr<ShareableBitmap> snapshot();
 #if PLATFORM(MAC)
     virtual PlatformLayer* pluginLayer();
 #endif
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
index 8ac7d3a..3b1629d 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
@@ -28,6 +28,7 @@
 
 #include "NPRuntimeUtilities.h"
 #include "Plugin.h"
+#include "ShareableBitmap.h"
 #include "WebEvent.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
@@ -505,25 +506,36 @@ void PluginView::setFrameRect(const WebCore::IntRect& rect)
     viewGeometryDidChange();
 }
 
+void PluginView::setBoundsSize(const WebCore::IntSize& size)
+{
+    Widget::setBoundsSize(size);
+    m_boundsSize = size;
+    viewGeometryDidChange();
+}
+
 void PluginView::paint(GraphicsContext* context, const IntRect& dirtyRect)
 {
     if (context->paintingDisabled() || !m_plugin || !m_isInitialized)
         return;
 
     IntRect dirtyRectInWindowCoordinates = parent()->contentsToWindow(dirtyRect);
-    
     IntRect paintRectInWindowCoordinates = intersection(dirtyRectInWindowCoordinates, clipRectInWindowCoordinates());
     if (paintRectInWindowCoordinates.isEmpty())
         return;
 
-    // context is in document coordinates. Translate it to window coordinates.
-    IntPoint documentOriginInWindowCoordinates = parent()->contentsToWindow(IntPoint());
-    context->save();
-    context->translate(-documentOriginInWindowCoordinates.x(), -documentOriginInWindowCoordinates.y());
-
-    m_plugin->paint(context, paintRectInWindowCoordinates);
-
-    context->restore();
+    if (m_snapshot)
+        m_snapshot->paint(*context, frameRect().location(), m_snapshot->bounds());
+    else {
+        // The plugin is given a frame rect which is parent()->contentsToWindow(frameRect()),
+        // and un-translates by the its origin when painting. The current CTM reflects
+        // this widget's frame is its parent (the document), so we have to offset the CTM by
+        // the document's window coordinates.
+        IntPoint documentOriginInWindowCoordinates = parent()->contentsToWindow(IntPoint());
+        context->save();
+        context->translate(-documentOriginInWindowCoordinates.x(), -documentOriginInWindowCoordinates.y());
+        m_plugin->paint(context, paintRectInWindowCoordinates);
+        context->restore();
+    }
 }
 
 void PluginView::frameRectsChanged()
@@ -577,7 +589,20 @@ void PluginView::handleEvent(Event* event)
     if (didHandleEvent)
         event->setDefaultHandled();
 }
-    
+
+void PluginView::notifyWidget(WidgetNotification notification)
+{
+    switch (notification) {
+    case WillPaintFlattened:
+        if (m_plugin && m_isInitialized)
+            m_snapshot = m_plugin->snapshot();
+        break;
+    case DidPaintFlattened:
+        m_snapshot = nullptr;
+        break;
+    }
+}
+
 void PluginView::viewGeometryDidChange()
 {
     if (!m_isInitialized || !m_plugin || !parent())
@@ -585,7 +610,7 @@ void PluginView::viewGeometryDidChange()
 
     // Get the frame rect in window coordinates.
     IntRect frameRectInWindowCoordinates = parent()->contentsToWindow(frameRect());
-
+    frameRectInWindowCoordinates.setSize(m_boundsSize);
     m_plugin->geometryDidChange(frameRectInWindowCoordinates, clipRectInWindowCoordinates());
 }
 
@@ -595,6 +620,7 @@ IntRect PluginView::clipRectInWindowCoordinates() const
 
     // Get the frame rect in window coordinates.
     IntRect frameRectInWindowCoordinates = parent()->contentsToWindow(frameRect());
+    frameRectInWindowCoordinates.setSize(m_boundsSize);
 
     // Get the window clip rect for the enclosing layer (in window coordinates).
     RenderLayer* layer = m_pluginElement->renderer()->enclosingLayer();
@@ -712,7 +738,7 @@ void PluginView::performJavaScriptURLRequest(URLRequest* request)
     bool oldAllowPopups = frame->script()->allowPopupsFromPlugin();
     frame->script()->setAllowPopupsFromPlugin(request->allowPopups());
     
-    ScriptValue result = m_pluginElement->document()->frame()->script()->executeScript(jsString);
+    ScriptValue result = frame->script()->executeScript(jsString);
 
     frame->script()->setAllowPopupsFromPlugin(oldAllowPopups);
 
@@ -720,7 +746,7 @@ void PluginView::performJavaScriptURLRequest(URLRequest* request)
     if (!plugin->controller())
         return;
 
-    ScriptState* scriptState = m_pluginElement->document()->frame()->script()->globalObject(pluginWorld())->globalExec();
+    ScriptState* scriptState = frame->script()->globalObject(pluginWorld())->globalExec();
     String resultString;
     result.getString(scriptState, resultString);
   
@@ -883,7 +909,7 @@ NPObject* PluginView::windowScriptNPObject()
     // FIXME: Handle JavaScript being disabled.
     ASSERT(frame()->script()->canExecuteScripts(NotAboutToExecuteScript));
 
-    return m_npRuntimeObjectMap.getOrCreateNPObject(frame()->script()->windowShell(pluginWorld())->window());
+    return m_npRuntimeObjectMap.getOrCreateNPObject(*pluginWorld()->globalData(), frame()->script()->windowShell(pluginWorld())->window());
 }
 
 NPObject* PluginView::pluginElementNPObject()
@@ -895,7 +921,7 @@ NPObject* PluginView::pluginElementNPObject()
     JSObject* object = frame()->script()->jsObjectForPluginElement(m_pluginElement.get());
     ASSERT(object);
 
-    return m_npRuntimeObjectMap.getOrCreateNPObject(object);
+    return m_npRuntimeObjectMap.getOrCreateNPObject(*pluginWorld()->globalData(), object);
 }
 
 bool PluginView::evaluate(NPObject* npObject, const String& scriptString, NPVariant* result, bool allowPopups)
@@ -1007,6 +1033,18 @@ bool PluginView::isPrivateBrowsingEnabled()
     return settings->privateBrowsingEnabled();
 }
 
+void PluginView::protectPluginFromDestruction()
+{
+    if (!m_isBeingDestroyed)
+        ref();
+}
+
+void PluginView::unprotectPluginFromDestruction()
+{
+    if (!m_isBeingDestroyed)
+        deref();
+}
+
 void PluginView::didFinishLoad(WebFrame* webFrame)
 {
     RefPtr<URLRequest> request = m_pendingFrameLoads.take(webFrame);
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.h b/Source/WebKit2/WebProcess/Plugins/PluginView.h
index dca3a62..a30926f 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.h
@@ -104,12 +104,14 @@ private:
     
     // WebCore::Widget
     virtual void setFrameRect(const WebCore::IntRect&);
+    virtual void setBoundsSize(const WebCore::IntSize&);
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect&);
     virtual void invalidateRect(const WebCore::IntRect&);
     virtual void setFocus(bool);
     virtual void frameRectsChanged();
     virtual void setParent(WebCore::ScrollView*);
     virtual void handleEvent(WebCore::Event*);
+    virtual void notifyWidget(WebCore::WidgetNotification);
 
     // WebCore::MediaCanStartListener
     virtual void mediaCanStart();
@@ -138,6 +140,8 @@ private:
     virtual String cookiesForURL(const String&);
     virtual void setCookiesForURL(const String& urlString, const String& cookieString);
     virtual bool isPrivateBrowsingEnabled();
+    virtual void protectPluginFromDestruction();
+    virtual void unprotectPluginFromDestruction();
 
     // WebFrame::LoadListener
     virtual void didFinishLoad(WebFrame*);
@@ -179,6 +183,9 @@ private:
     WebCore::ResourceResponse m_manualStreamResponse;
     WebCore::ResourceError m_manualStreamError;
     RefPtr<WebCore::SharedBuffer> m_manualStreamData;
+    
+    RefPtr<ShareableBitmap> m_snapshot;
+    WebCore::IntSize m_boundsSize;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
new file mode 100644
index 0000000..dad2791
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebResourceCacheManager.h"
+
+#include "Connection.h"
+#include "MessageID.h"
+#include "SecurityOriginData.h"
+#include "WebCoreArgumentCoders.h"
+#include "WebResourceCacheManagerProxyMessages.h"
+#include "WebProcess.h"
+#include <WebCore/MemoryCache.h>
+#include <WebCore/SecurityOrigin.h>
+#include <WebCore/SecurityOriginHash.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebResourceCacheManager& WebResourceCacheManager::shared()
+{
+    static WebResourceCacheManager& shared = *new WebResourceCacheManager;
+    return shared;
+}
+
+WebResourceCacheManager::WebResourceCacheManager()
+{
+}
+
+WebResourceCacheManager::~WebResourceCacheManager()
+{
+}
+
+void WebResourceCacheManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebResourceCacheManagerMessage(connection, messageID, arguments);
+}
+
+
+void WebResourceCacheManager::getCacheOrigins(uint64_t callbackID) const
+{
+    MemoryCache::SecurityOriginSet origins;
+    memoryCache()->getOriginsWithCache(origins);
+
+#if USE(CFURLCACHE)
+    RetainPtr<CFArrayRef> cfURLHosts = cfURLCacheHostNames();
+    CFIndex size = cfURLHosts ? CFArrayGetCount(cfURLHosts.get()) : 0;
+
+    String httpString("http");
+    for (CFIndex i = 0; i < size; ++i) {
+        CFStringRef host = static_cast<CFStringRef>(CFArrayGetValueAtIndex(cfURLHosts.get(), i));
+        origins.add(SecurityOrigin::create(httpString, host, 0));
+    }
+#endif
+
+    // Create a list with the origins in both of the caches.
+    Vector<SecurityOriginData> identifiers;
+    identifiers.reserveCapacity(origins.size());
+
+    MemoryCache::SecurityOriginSet::iterator end = origins.end();
+    for (MemoryCache::SecurityOriginSet::iterator it = origins.begin(); it != end; ++it) {
+        RefPtr<SecurityOrigin> origin = *it;
+        
+        SecurityOriginData originData;
+        originData.protocol = origin->protocol();
+        originData.host = origin->host();
+        originData.port = origin->port();
+
+        identifiers.uncheckedAppend(originData);
+    }
+
+    WebProcess::shared().connection()->send(Messages::WebResourceCacheManagerProxy::DidGetCacheOrigins(identifiers, callbackID), 0);
+}
+
+void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData) const
+{
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(originData.protocol, originData.host, originData.port);
+    if (!origin)
+        return;
+
+    memoryCache()->removeResourcesWithOrigin(origin.get());
+
+#if USE(CFURLCACHE)
+    RetainPtr<CFMutableArrayRef> hostArray(AdoptCF, CFArrayCreateMutable(0, 0, &kCFTypeArrayCallBacks));
+    RetainPtr<CFStringRef> host(AdoptCF, origin->host().createCFString());
+    CFArrayAppendValue(hostArray.get(), host.get());
+
+    clearCFURLCacheForHostNames(hostArray.get());
+#endif
+}
+
+void WebResourceCacheManager::clearCacheForAllOrigins() const
+{
+    WebProcess::shared().clearResourceCaches();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h
new file mode 100644
index 0000000..3a29a4b
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebResourceCacheManager_h
+#define WebResourceCacheManager_h
+
+#include "Arguments.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+class MessageID;
+}
+
+namespace WebKit {
+
+struct SecurityOriginData;
+
+class WebResourceCacheManager {
+    WTF_MAKE_NONCOPYABLE(WebResourceCacheManager);
+public:
+    static WebResourceCacheManager& shared();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    WebResourceCacheManager();
+    virtual ~WebResourceCacheManager();
+
+    // Implemented in generated WebResourceCacheManagerMessageReceiver.cpp
+    void didReceiveWebResourceCacheManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    void getCacheOrigins(uint64_t callbackID) const;
+    void clearCacheForOrigin(SecurityOriginData origin) const;
+    void clearCacheForAllOrigins() const;
+
+#if USE(CFURLCACHE)
+    static RetainPtr<CFArrayRef> cfURLCacheHostNames();
+    static void clearCFURLCacheForHostNames(CFArrayRef);
+#endif
+};
+
+} // namespace WebKit
+
+#endif // WebResourceCacheManager_h
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in
new file mode 100644
index 0000000..b6d5900
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in
@@ -0,0 +1,27 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebResourceCacheManager {
+    void GetCacheOrigins(uint64_t callbackID)
+    void ClearCacheForOrigin(WebKit::SecurityOriginData originIdentifier)
+    void ClearCacheForAllOrigins()
+}
diff --git a/Source/WebKit2/WebProcess/ResourceCache/cf/WebResourceCacheManagerCFNet.cpp b/Source/WebKit2/WebProcess/ResourceCache/cf/WebResourceCacheManagerCFNet.cpp
new file mode 100644
index 0000000..86372cf
--- /dev/null
+++ b/Source/WebKit2/WebProcess/ResourceCache/cf/WebResourceCacheManagerCFNet.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebResourceCacheManager.h"
+
+#if USE(CFURLCACHE)
+
+#if PLATFORM(WIN)
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#elif PLATFORM(MAC)
+#include "WebKitSystemInterface.h"
+#endif
+
+
+namespace WebKit {
+
+#if PLATFORM(WIN)
+// The Windows version of WKSI defines these functions as capitalized, while the Mac version defines them as lower case.
+static inline CFArrayRef WKCFURLCacheCopyAllHostNamesInPersistentStore() { return wkCFURLCacheCopyAllHostNamesInPersistentStore(); }
+static inline void WKCFURLCacheDeleteHostNamesInPersistentStore(CFArrayRef hostNames) { return wkCFURLCacheDeleteHostNamesInPersistentStore(hostNames); }
+#endif
+
+RetainPtr<CFArrayRef> WebResourceCacheManager::cfURLCacheHostNames()
+{
+    return RetainPtr<CFArrayRef>(AdoptCF, WKCFURLCacheCopyAllHostNamesInPersistentStore());
+}
+
+void WebResourceCacheManager::clearCFURLCacheForHostNames(CFArrayRef hostNames)
+{
+    WKCFURLCacheDeleteHostNamesInPersistentStore(hostNames);
+}
+
+} // namespace WebKit
+
+#endif // USE(CFURLCACHE)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index 2394141..d4c357d 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -27,9 +27,6 @@
 #include "config.h"
 #include "WebChromeClient.h"
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 #include "DrawingArea.h"
 #include "InjectedBundleNavigationAction.h"
 #include "InjectedBundleUserMessageCoders.h"
@@ -54,6 +51,7 @@
 #include <WebCore/FrameView.h>
 #include <WebCore/HTMLNames.h>
 #include <WebCore/HTMLPlugInImageElement.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/SecurityOrigin.h>
 
@@ -64,13 +62,15 @@ namespace WebKit {
 
 static double area(WebFrame* frame)
 {
-    IntSize size = frame->size();
+    IntSize size = frame->visibleContentBoundsExcludingScrollbars().size();
     return static_cast<double>(size.height()) * size.width();
 }
 
 
 static WebFrame* findLargestFrameInFrameSet(WebPage* page)
 {
+    // Approximate what a user could consider a default target frame for application menu operations.
+
     WebFrame* mainFrame = page->mainFrame();
     if (!mainFrame->isFrameSet())
         return 0;
@@ -252,11 +252,7 @@ void WebChromeClient::addMessageToConsole(MessageSource, MessageType, MessageLev
 
 bool WebChromeClient::canRunBeforeUnloadConfirmPanel()
 {
-    bool canRun = false;
-    if (!WebProcess::shared().connection()->sendSync(Messages::WebPageProxy::CanRunBeforeUnloadConfirmPanel(), Messages::WebPageProxy::CanRunBeforeUnloadConfirmPanel::Reply(canRun), m_page->pageID()))
-        return false;
-
-    return canRun;
+    return m_page->canRunBeforeUnloadConfirmPanel();
 }
 
 bool WebChromeClient::runBeforeUnloadConfirmPanel(const String& message, Frame* frame)
@@ -340,9 +336,9 @@ bool WebChromeClient::shouldInterruptJavaScript()
     return false;
 }
 
-bool WebChromeClient::tabsToLinks() const
+KeyboardUIMode WebChromeClient::keyboardUIMode()
 {
-    return m_page->tabsToLinks();
+    return m_page->keyboardUIMode();
 }
 
 IntRect WebChromeClient::windowResizerRect() const
@@ -458,7 +454,7 @@ void WebChromeClient::missingPluginButtonClicked(Element* element) const
 
     HTMLPlugInImageElement* pluginElement = static_cast<HTMLPlugInImageElement*>(element);
 
-    m_page->send(Messages::WebPageProxy::MissingPluginButtonClicked(pluginElement->serviceType(), pluginElement->url()));
+    m_page->send(Messages::WebPageProxy::MissingPluginButtonClicked(pluginElement->serviceType(), pluginElement->url(), pluginElement->getAttribute(pluginspageAttr)));
 }
 
 void WebChromeClient::scrollbarsModeDidChange() const
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
index 82ba36e..96da752 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
@@ -102,8 +102,9 @@ private:
     virtual bool runJavaScriptPrompt(WebCore::Frame*, const String& message, const String& defaultValue, String& result);
     virtual void setStatusbarText(const String&);
     virtual bool shouldInterruptJavaScript();
-    virtual bool tabsToLinks() const;
-    
+
+    virtual WebCore::KeyboardUIMode keyboardUIMode();
+
     virtual WebCore::IntRect windowResizerRect() const;
     
     // Methods used by HostWindow.
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
index 0c83cda..b71bf3c 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
@@ -30,12 +30,10 @@
 #include "WebPage.h"
 #include <WebCore/ContextMenu.h>
 #include <WebCore/Frame.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/UserGestureIndicator.h>
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 using namespace WebCore;
 
 namespace WebKit {
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp
index 9e348cd..dfb1542 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp
@@ -26,8 +26,7 @@
 #include "config.h"
 #include "WebDragClient.h"
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
index 5ed1c60..b954283 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "WebEditorClient.h"
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 #include "SelectionState.h"
+#include "WebCoreArgumentCoders.h"
 #include "WebFrameLoaderClient.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
@@ -43,6 +41,7 @@
 #include <WebCore/HTMLNames.h>
 #include <WebCore/HTMLTextAreaElement.h>
 #include <WebCore/KeyboardEvent.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/UserTypingGestureIndicator.h>
 
@@ -170,21 +169,21 @@ bool WebEditorClient::shouldMoveRangeAfterDelete(Range*, Range*)
 void WebEditorClient::didBeginEditing()
 {
     // FIXME: What good is a notification name, if it's always the same?
-    static const String WebViewDidBeginEditingNotification = "WebViewDidBeginEditingNotification";
+    DEFINE_STATIC_LOCAL(String, WebViewDidBeginEditingNotification, ("WebViewDidBeginEditingNotification"));
     m_page->injectedBundleEditorClient().didBeginEditing(m_page, WebViewDidBeginEditingNotification.impl());
     notImplemented();
 }
 
 void WebEditorClient::respondToChangedContents()
 {
-    static const String WebViewDidChangeNotification = "WebViewDidChangeNotification";
+    DEFINE_STATIC_LOCAL(String, WebViewDidChangeNotification, ("WebViewDidChangeNotification"));
     m_page->injectedBundleEditorClient().didChange(m_page, WebViewDidChangeNotification.impl());
     notImplemented();
 }
 
 void WebEditorClient::respondToChangedSelection()
 {
-    static const String WebViewDidChangeSelectionNotification = "WebViewDidChangeSelectionNotification";
+    DEFINE_STATIC_LOCAL(String, WebViewDidChangeSelectionNotification, ("WebViewDidChangeSelectionNotification"));
     m_page->injectedBundleEditorClient().didChangeSelection(m_page, WebViewDidChangeSelectionNotification.impl());
     Frame* frame = m_page->corePage()->focusController()->focusedFrame();
     if (!frame)
@@ -193,6 +192,7 @@ void WebEditorClient::respondToChangedSelection()
     SelectionState selectionState;
     selectionState.isNone = frame->selection()->isNone();
     selectionState.isContentEditable = frame->selection()->isContentEditable();
+    selectionState.isContentRichlyEditable = frame->selection()->isContentRichlyEditable();
     selectionState.isInPasswordField = frame->selection()->isInPasswordField();
     selectionState.hasComposition = frame->editor()->hasComposition();
 
@@ -213,7 +213,7 @@ void WebEditorClient::respondToChangedSelection()
     
 void WebEditorClient::didEndEditing()
 {
-    static const String WebViewDidEndEditingNotification = "WebViewDidEndEditingNotification";
+    DEFINE_STATIC_LOCAL(String, WebViewDidEndEditingNotification, ("WebViewDidEndEditingNotification"));
     m_page->injectedBundleEditorClient().didEndEditing(m_page, WebViewDidEndEditingNotification.impl());
     notImplemented();
 }
@@ -251,6 +251,16 @@ void WebEditorClient::clearUndoRedoOperations()
     m_page->send(Messages::WebPageProxy::ClearAllEditCommands());
 }
 
+bool WebEditorClient::canCopyCut(bool defaultValue) const
+{
+    return defaultValue;
+}
+
+bool WebEditorClient::canPaste(bool defaultValue) const
+{
+    return defaultValue;
+}
+
 bool WebEditorClient::canUndo() const
 {
     notImplemented();
@@ -395,9 +405,9 @@ void WebEditorClient::checkGrammarOfString(const UChar*, int, Vector<GrammarDeta
     notImplemented();
 }
 
-void WebEditorClient::updateSpellingUIWithGrammarString(const String&, const GrammarDetail&)
+void WebEditorClient::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
 {
-    notImplemented();
+    m_page->send(Messages::WebPageProxy::UpdateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail));
 }
 
 void WebEditorClient::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
index 40bd8c6..fa8426a 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
@@ -27,12 +27,13 @@
 #define WebEditorClient_h
 
 #include <WebCore/EditorClient.h>
+#include <WebCore/TextCheckerClient.h>
 
 namespace WebKit {
 
 class WebPage;
 
-class WebEditorClient : public WebCore::EditorClient {
+class WebEditorClient : public WebCore::EditorClient, public WebCore::TextCheckerClient {
 public:
     WebEditorClient(WebPage* page)
         : m_page(page)
@@ -74,6 +75,8 @@ private:
     virtual void registerCommandForRedo(PassRefPtr<WebCore::EditCommand>);
     virtual void clearUndoRedoOperations();
 
+    virtual bool canCopyCut(bool defaultValue) const;
+    virtual bool canPaste(bool defaultValue) const;
     virtual bool canUndo() const;
     virtual bool canRedo() const;
     
@@ -120,6 +123,8 @@ private:
     virtual void toggleAutomaticSpellingCorrection();
 #endif
 
+    TextCheckerClient* textChecker() { return this; }
+
     virtual void ignoreWordInSpellDocument(const String&);
     virtual void learnWord(const String&);
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength);
@@ -140,6 +145,7 @@ private:
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings, WebCore::Editor*);
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
     virtual bool isShowingCorrectionPanel();
+    virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const WTF::String& replacedString, const WTF::String& replacementString);
 #endif
     WebPage* m_page;
 };
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 4be913f..3770ca6 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -26,9 +26,6 @@
 #include "config.h"
 #include "WebFrameLoaderClient.h"
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 #include "AuthenticationManager.h"
 #include "DataReference.h"
 #include "InjectedBundleNavigationAction.h"
@@ -36,6 +33,7 @@
 #include "PlatformCertificateInfo.h"
 #include "PluginView.h"
 #include "StringPairVector.h"
+#include "WebBackForwardListProxy.h"
 #include "WebContextMessages.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebErrors.h"
@@ -62,6 +60,7 @@
 #include <WebCore/HistoryItem.h>
 #include <WebCore/MIMETypeRegistry.h>
 #include <WebCore/MouseEvent.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/PluginData.h>
 #include <WebCore/ProgressTracker.h>
@@ -576,7 +575,7 @@ void WebFrameLoaderClient::dispatchShow()
     webPage->show();
 }
 
-void WebFrameLoaderClient::dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const String& MIMEType, const ResourceRequest& request)
+void WebFrameLoaderClient::dispatchDecidePolicyForResponse(FramePolicyFunction function, const ResourceResponse& response, const ResourceRequest& request)
 {
     WebPage* webPage = m_frame->page();
     if (!webPage)
@@ -588,7 +587,11 @@ void WebFrameLoaderClient::dispatchDecidePolicyForMIMEType(FramePolicyFunction f
     RefPtr<APIObject> userData;
 
     // Notify the bundle client.
-    webPage->injectedBundlePolicyClient().decidePolicyForMIMEType(webPage, m_frame, MIMEType, request, userData);
+    WKBundlePagePolicyAction policy = webPage->injectedBundlePolicyClient().decidePolicyForResponse(webPage, m_frame, response, request, userData);
+    if (policy == WKBundlePagePolicyActionUse) {
+        (m_frame->coreFrame()->loader()->policyChecker()->*function)(PolicyUse);
+        return;
+    }
 
     uint64_t listenerID = m_frame->setUpPolicyListener(function);
     bool receivedPolicyAction;
@@ -596,7 +599,7 @@ void WebFrameLoaderClient::dispatchDecidePolicyForMIMEType(FramePolicyFunction f
     uint64_t downloadID;
 
     // Notify the UIProcess.
-    if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForMIMEType(m_frame->frameID(), MIMEType, request, listenerID, InjectedBundleUserMessageEncoder(userData.get())), Messages::WebPageProxy::DecidePolicyForMIMEType::Reply(receivedPolicyAction, policyAction, downloadID)))
+    if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForResponse(m_frame->frameID(), response, request, listenerID, InjectedBundleUserMessageEncoder(userData.get())), Messages::WebPageProxy::DecidePolicyForResponse::Reply(receivedPolicyAction, policyAction, downloadID)))
         return;
 
     // We call this synchronously because CFNetwork can only convert a loading connection to a download from its didReceiveResponse callback.
@@ -615,7 +618,11 @@ void WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction(FramePolicyFun
     RefPtr<InjectedBundleNavigationAction> action = InjectedBundleNavigationAction::create(m_frame, navigationAction, formState);
 
     // Notify the bundle client.
-    webPage->injectedBundlePolicyClient().decidePolicyForNewWindowAction(webPage, m_frame, action.get(), request, frameName, userData);
+    WKBundlePagePolicyAction policy = webPage->injectedBundlePolicyClient().decidePolicyForNewWindowAction(webPage, m_frame, action.get(), request, frameName, userData);
+    if (policy == WKBundlePagePolicyActionUse) {
+        (m_frame->coreFrame()->loader()->policyChecker()->*function)(PolicyUse);
+        return;
+    }
 
 
     uint64_t listenerID = m_frame->setUpPolicyListener(function);
@@ -630,24 +637,35 @@ void WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(FramePolicyFu
     if (!webPage)
         return;
 
+    // Always ignore requests with empty URLs. 
+    if (request.isEmpty()) { 
+        (m_frame->coreFrame()->loader()->policyChecker()->*function)(PolicyIgnore); 
+        return; 
+    }
+
     RefPtr<APIObject> userData;
 
     RefPtr<InjectedBundleNavigationAction> action = InjectedBundleNavigationAction::create(m_frame, navigationAction, formState);
 
     // Notify the bundle client.
-    webPage->injectedBundlePolicyClient().decidePolicyForNavigationAction(webPage, m_frame, action.get(), request, userData);
+    WKBundlePagePolicyAction policy = webPage->injectedBundlePolicyClient().decidePolicyForNavigationAction(webPage, m_frame, action.get(), request, userData);
+    if (policy == WKBundlePagePolicyActionUse) {
+        (m_frame->coreFrame()->loader()->policyChecker()->*function)(PolicyUse);
+        return;
+    }
 
     uint64_t listenerID = m_frame->setUpPolicyListener(function);
     bool receivedPolicyAction;
     uint64_t policyAction;
+    uint64_t downloadID;
 
     // Notify the UIProcess.
-    if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForNavigationAction(m_frame->frameID(), action->navigationType(), action->modifiers(), action->mouseButton(), request, listenerID, InjectedBundleUserMessageEncoder(userData.get())), Messages::WebPageProxy::DecidePolicyForNavigationAction::Reply(receivedPolicyAction, policyAction)))
+    if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForNavigationAction(m_frame->frameID(), action->navigationType(), action->modifiers(), action->mouseButton(), request, listenerID, InjectedBundleUserMessageEncoder(userData.get())), Messages::WebPageProxy::DecidePolicyForNavigationAction::Reply(receivedPolicyAction, policyAction, downloadID)))
         return;
 
     // We call this synchronously because WebCore cannot gracefully handle a frame load without a synchronous navigation policy reply.
     if (receivedPolicyAction)
-        m_frame->didReceivePolicyDecision(listenerID, static_cast<PolicyAction>(policyAction), 0);
+        m_frame->didReceivePolicyDecision(listenerID, static_cast<PolicyAction>(policyAction), downloadID);
 }
 
 void WebFrameLoaderClient::cancelPolicyCheck()
@@ -655,9 +673,19 @@ void WebFrameLoaderClient::cancelPolicyCheck()
     m_frame->invalidatePolicyListener();
 }
 
-void WebFrameLoaderClient::dispatchUnableToImplementPolicy(const ResourceError&)
+void WebFrameLoaderClient::dispatchUnableToImplementPolicy(const ResourceError& error)
 {
-    notImplemented();
+    WebPage* webPage = m_frame->page();
+    if (!webPage)
+        return;
+
+    RefPtr<APIObject> userData;
+
+    // Notify the bundle client.
+    webPage->injectedBundlePolicyClient().unableToImplementPolicy(webPage, m_frame, error, userData);
+
+    // Notify the UIProcess.
+    webPage->send(Messages::WebPageProxy::UnableToImplementPolicy(m_frame->frameID(), error, InjectedBundleUserMessageEncoder(userData.get())));
 }
 
 void WebFrameLoaderClient::dispatchWillSubmitForm(FramePolicyFunction function, PassRefPtr<FormState> prpFormState)
@@ -797,7 +825,7 @@ void WebFrameLoaderClient::finishedLoading(DocumentLoader* loader)
             RefPtr<SharedBuffer> mainResourceData = loader->mainResourceData();
             CoreIPC::DataReference dataReference(reinterpret_cast<const uint8_t*>(mainResourceData ? mainResourceData->data() : 0), mainResourceData ? mainResourceData->size() : 0);
             
-            webPage->send(Messages::WebPageProxy::DidFinishLoadingDataForCustomRepresentation(dataReference));
+            webPage->send(Messages::WebPageProxy::DidFinishLoadingDataForCustomRepresentation(loader->response().suggestedFilename(), dataReference));
         }
 
         return;
@@ -845,9 +873,28 @@ void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
     }
 }
 
-bool WebFrameLoaderClient::shouldGoToHistoryItem(HistoryItem*) const
+bool WebFrameLoaderClient::shouldGoToHistoryItem(HistoryItem* item) const
+{
+    WebPage* webPage = m_frame->page();
+    if (!webPage)
+        return false;
+    
+    uint64_t itemID = WebBackForwardListProxy::idForItem(item);
+    if (!itemID) {
+        // We should never be considering navigating to an item that is not actually in the back/forward list.
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    
+    bool shouldGoToBackForwardListItem;
+    if (!webPage->sendSync(Messages::WebPageProxy::ShouldGoToBackForwardListItem(itemID), Messages::WebPageProxy::ShouldGoToBackForwardListItem::Reply(shouldGoToBackForwardListItem)))
+        return false;
+    
+    return shouldGoToBackForwardListItem;
+}
+
+bool WebFrameLoaderClient::shouldStopLoadingForHistoryItem(HistoryItem* item) const
 {
-    notImplemented();
     return true;
 }
 
@@ -985,6 +1032,11 @@ void WebFrameLoaderClient::restoreViewState()
     // Inform the UI process of the scale factor.
     double scaleFactor = m_frame->coreFrame()->loader()->history()->currentItem()->pageScaleFactor();
     m_frame->page()->send(Messages::WebPageProxy::ViewScaleFactorDidChange(scaleFactor));
+
+    // FIXME: This should not be necessary. WebCore should be correctly invalidating
+    // the view on restores from the back/forward cache.
+    if (m_frame == m_frame->page()->mainFrame())
+        m_frame->page()->drawingArea()->setNeedsDisplay(m_frame->page()->bounds());
 }
 
 void WebFrameLoaderClient::provisionalLoadStarted()
@@ -1273,6 +1325,23 @@ bool WebFrameLoaderClient::shouldUsePluginDocument(const String& /*mimeType*/) c
     return false;
 }
 
+void WebFrameLoaderClient::didChangeScrollOffset()
+{
+    WebPage* webPage = m_frame->page();
+    if (!webPage)
+        return;
+
+    if (!m_frame->isMainFrame())
+        return;
+
+    // If this is called when tearing down a FrameView, the WebCore::Frame's
+    // current FrameView will be null.
+    if (!m_frame->coreFrame()->view())
+        return;
+
+    webPage->didChangeScrollOffsetForMainFrame();
+}
+
 PassRefPtr<FrameNetworkingContext> WebFrameLoaderClient::createNetworkingContext()
 {
     return WebFrameNetworkingContext::create(m_frame->coreFrame());
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
index 9070b3a..9ca9a75 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
@@ -97,7 +97,7 @@ private:
     virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
     
-    virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction, const String& MIMEType, const WebCore::ResourceRequest&);
+    virtual void dispatchDecidePolicyForResponse(WebCore::FramePolicyFunction, const WebCore::ResourceResponse&, const WebCore::ResourceRequest&);
     virtual void dispatchDecidePolicyForNewWindowAction(WebCore::FramePolicyFunction, const WebCore::NavigationAction&, const WebCore::ResourceRequest&, PassRefPtr<WebCore::FormState>, const String& frameName);
     virtual void dispatchDecidePolicyForNavigationAction(WebCore::FramePolicyFunction, const WebCore::NavigationAction&, const WebCore::ResourceRequest&, PassRefPtr<WebCore::FormState>);
     virtual void cancelPolicyCheck();
@@ -132,6 +132,7 @@ private:
     virtual void updateGlobalHistoryRedirectLinks();
     
     virtual bool shouldGoToHistoryItem(WebCore::HistoryItem*) const;
+    virtual bool shouldStopLoadingForHistoryItem(WebCore::HistoryItem*) const;
     virtual void dispatchDidAddBackForwardItem(WebCore::HistoryItem*) const;
     virtual void dispatchDidRemoveBackForwardItem(WebCore::HistoryItem*) const;
     virtual void dispatchDidChangeBackForwardIndex() const;
@@ -213,7 +214,9 @@ private:
 #endif
     
     virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const;
-    
+
+    virtual void didChangeScrollOffset();
+
     virtual PassRefPtr<WebCore::FrameNetworkingContext> createNetworkingContext();
 
     WebFrame* m_frame;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp
index 80552f0..7a91dcd 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp
@@ -32,11 +32,9 @@
 #include "WebInspector.h"
 #include "WebPage.h"
 #include <WebCore/InspectorController.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 using namespace WebCore;
 
 namespace WebKit {
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp
index 6298293..d429464 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp
@@ -30,12 +30,10 @@
 
 #include "WebInspector.h"
 #include "WebPage.h"
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <wtf/text/WTFString.h>
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 using namespace WebCore;
 
 namespace WebKit {
@@ -94,9 +92,9 @@ void WebInspectorFrontendClient::setAttachedWindowHeight(unsigned)
     notImplemented();
 }
 
-void WebInspectorFrontendClient::inspectedURLChanged(const String&)
+void WebInspectorFrontendClient::inspectedURLChanged(const String& urlString)
 {
-    notImplemented();
+    m_page->inspector()->inspectedURLChanged(urlString);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 479252a..7e14701 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,24 +28,34 @@
 
 #if USE(PLATFORM_STRATEGIES)
 
-#include "NotImplemented.h"
 #include "PluginInfoStore.h"
 #include "WebContextMessages.h"
+#include "WebCookieManager.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebProcess.h"
+#include <WebCore/LocalizedStrings.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/PageGroup.h>
 #include <wtf/MathExtras.h>
 #include <wtf/text/CString.h>
 
-#if PLATFORM(CF)
+#if USE(CF)
 #include <wtf/RetainPtr.h>
 #endif
 
-// FIXME (WebKit2) <rdar://problem/8728860> WebKit2 needs to be localized
+#if PLATFORM(MAC)
+
+#define UI_STRING(string, description) localizedString(string)
+#define UI_STRING_KEY(string, key, description) localizedString(key)
+
+#else
+
 #define UI_STRING(string, description) String::fromUTF8(string, strlen(string))
 #define UI_STRING_KEY(string, key, description) String::fromUTF8(string, strlen(string))
 
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -57,7 +67,7 @@ namespace WebKit {
 // type according to section 18.7/3 of the C++ N1905 standard.
 static String formatLocalizedString(String format, ...)
 {
-#if PLATFORM(CF)
+#if USE(CF)
     va_list arguments;
     va_start(arguments, format);
     RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
@@ -89,7 +99,10 @@ WebPlatformStrategies::WebPlatformStrategies()
 {
 }
 
-// PluginStrategy
+CookiesStrategy* WebPlatformStrategies::createCookiesStrategy()
+{
+    return this;
+}
 
 PluginStrategy* WebPlatformStrategies::createPluginStrategy()
 {
@@ -106,6 +119,13 @@ VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
     return this;
 }
 
+// CookiesStrategy
+
+void WebPlatformStrategies::notifyCookiesChanged()
+{
+    WebCookieManager::shared().dispatchCookiesDidChange();
+}
+
 // PluginStrategy
 
 void WebPlatformStrategies::populatePluginCache()
@@ -175,6 +195,11 @@ String WebPlatformStrategies::fileButtonNoFileSelectedLabel()
     return UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
 }
 
+String WebPlatformStrategies::defaultDetailsSummaryText()
+{
+    return UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
+}
+
 #if PLATFORM(MAC)
 String WebPlatformStrategies::copyImageUnknownFileLabel()
 {
@@ -748,8 +773,8 @@ String WebPlatformStrategies::allFilesText()
 
 String WebPlatformStrategies::imageTitle(const String& filename, const IntSize& size)
 {
-    // FIXME: It would be nice to have the filename inside the format string, but it's not easy to do that in a way that works with non-ASCII characters in the filename.
-    return filename + formatLocalizedString(UI_STRING(" %d×%d pixels", "window title suffix for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height());
+    // FIXME: This should format the numbers correctly. In Mac WebKit, we used +[NSNumberFormatter localizedStringFromNumber:numberStyle:].
+    return formatLocalizedString(UI_STRING("<filename> %d×%d pixels", "window title suffix for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
 }
 
 String WebPlatformStrategies::mediaElementLoadingStateText()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
index a763475..92f8236 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
@@ -28,6 +28,7 @@
 
 #if USE(PLATFORM_STRATEGIES)
 
+#include <WebCore/CookiesStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
 #include <WebCore/LocalizationStrategy.h>
@@ -35,7 +36,7 @@
 
 namespace WebKit {
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::PluginStrategy, private WebCore::LocalizationStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::LocalizationStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -43,10 +44,14 @@ private:
     WebPlatformStrategies();
     
     // WebCore::PlatformStrategies
+    virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
     virtual WebCore::LocalizationStrategy* createLocalizationStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
 
+    // WebCore::CookiesStrategy
+    virtual void notifyCookiesChanged();
+
     // WebCore::PluginStrategy
     virtual void refreshPlugins();
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&);
@@ -58,6 +63,7 @@ private:
     virtual String submitButtonDefaultLabel();
     virtual String fileButtonChooseFileLabel();
     virtual String fileButtonNoFileSelectedLabel();
+    virtual String defaultDetailsSummaryText();
 #if PLATFORM(MAC)
     virtual String copyImageUnknownFileLabel();
 #endif
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp
index b21be47..d91520e 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "WebContextMenuClient.h"
 
-#include "NotImplemented.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebErrorsGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebErrorsGtk.cpp
new file mode 100644
index 0000000..7791349
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebErrorsGtk.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebErrors.h"
+
+#include <WebCore/ResourceRequest.h>
+#include <WebCore/ResourceResponse.h>
+#include <glib/gi18n-lib.h>
+#include <webkit/webkiterror.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+ResourceError cancelledError(const ResourceRequest& request)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_NETWORK_ERROR), WEBKIT_NETWORK_ERROR_CANCELLED,
+                         request.url().string(), _("Load request cancelled"));
+}
+
+ResourceError blockedError(const ResourceRequest& request)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_CANNOT_USE_RESTRICTED_PORT,
+                         request.url().string(), _("Not allowed to use restricted network port"));
+}
+
+ResourceError cannotShowURLError(const ResourceRequest& request)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_CANNOT_SHOW_URL,
+                         request.url().string(), _("URL cannot be shown"));
+}
+
+ResourceError interruptForPolicyChangeError(const ResourceRequest& request)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_FRAME_LOAD_INTERRUPTED_BY_POLICY_CHANGE,
+                         request.url().string(), _("Frame load was interrupted"));
+}
+
+ResourceError cannotShowMIMETypeError(const ResourceResponse& response)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_CANNOT_SHOW_MIME_TYPE,
+                         response.url().string(), _("Content with the specified MIME type cannot be shown"));
+}
+
+ResourceError fileDoesNotExistError(const ResourceResponse& response)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_NETWORK_ERROR), WEBKIT_NETWORK_ERROR_FILE_DOES_NOT_EXIST,
+                         response.url().string(), _("File does not exist"));
+}
+
+ResourceError pluginWillHandleLoadError(const ResourceResponse& response)
+{
+    return ResourceError(g_quark_to_string(WEBKIT_PLUGIN_ERROR), WEBKIT_PLUGIN_ERROR_WILL_HANDLE_LOAD,
+                         response.url().string(), _("Plugin will handle load"));
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp
index b6d71bb..154b022 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "WebPopupMenu.h"
 
-#include "NotImplemented.h"
 #include "PlatformPopupMenuData.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
index 750a397..7d91c56 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
@@ -26,9 +26,12 @@
 #import "config.h"
 #import "WebContextMenuClient.h"
 
-#import "NotImplemented.h"
+#import "DictionaryPopupInfo.h"
+#import "WebCoreArgumentCoders.h"
 #import "WebPage.h"
+#import "WebPageProxyMessages.h"
 #import <WebCore/Frame.h>
+#import <WebCore/FrameView.h>
 #import <WebCore/Page.h>
 #import <wtf/text/WTFString.h>
 
@@ -36,10 +39,13 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void WebContextMenuClient::lookUpInDictionary(Frame*)
+void WebContextMenuClient::lookUpInDictionary(Frame* frame)
 {
-    // FIXME: <rdar://problem/8750610> - Implement
-    notImplemented();
+    RefPtr<Range> selectedRange = frame->selection()->selection().toNormalizedRange();
+    if (!selectedRange)
+        return;
+
+    m_page->performDictionaryLookupForRange(DictionaryPopupInfo::ContextMenu, frame, selectedRange.get());
 }
 
 bool WebContextMenuClient::isSpeaking()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
index 5169b23..ae9cec3 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
@@ -63,7 +63,7 @@ void WebDragClient::startDrag(DragImageRef dragImage, const IntPoint& at, const
     NSGraphicsContext* bitmapContext = [NSGraphicsContext graphicsContextWithGraphicsPort:graphicsContext->platformContext() flipped:YES];
     [NSGraphicsContext setCurrentContext: bitmapContext];
     
-    [dragNSImage drawInRect:NSMakeRect(0, 0, [dragNSImage size].width , [dragNSImage size].height) fromRect:NSZeroRect operation:NSCompositeSourceOver fraction:1];
+    [dragNSImage drawInRect:NSMakeRect(0, 0, [dragNSImage size].width , [dragNSImage size].height) fromRect:NSZeroRect operation:NSCompositeSourceOver fraction:1 respectFlipped:YES hints:nil];
     [NSGraphicsContext restoreGraphicsState];
  
     SharedMemory::Handle handle;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
index ee87ea2..8af0438 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
@@ -30,9 +30,6 @@
 #import "config.h"
 #import "WebEditorClient.h"
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#import "NotImplemented.h"
-
 #import "WebCoreArgumentCoders.h"
 #import "WebPage.h"
 #import "WebFrame.h"
@@ -45,6 +42,7 @@
 #import <WebCore/FocusController.h>
 #import <WebCore/Frame.h>
 #import <WebCore/KeyboardEvent.h>
+#import <WebCore/NotImplemented.h>
 #import <WebCore/Page.h>
 #import <WebKit/WebResource.h>
 #import <WebKit/WebNSURLExtras.h>
@@ -264,6 +262,11 @@ bool WebEditorClient::isShowingCorrectionPanel()
     notImplemented();
     return false;
 }
+
+void WebEditorClient::recordAutocorrectionResponse(EditorClient::AutocorrectionResponseType responseType, const String& replacedString, const String& replacementString)
+{
+    notImplemented();
+}
 #endif
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
index 7e446b7..e36f438 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
@@ -27,13 +27,25 @@
 #import "WebPopupMenu.h"
 
 #import "PlatformPopupMenuData.h"
+#import <WebCore/Frame.h>
+#import <WebCore/FrameView.h>
+#import <WebCore/PopupMenuClient.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-void WebPopupMenu::setUpPlatformData(const IntRect&, PlatformPopupMenuData&)
+void WebPopupMenu::setUpPlatformData(const IntRect&, PlatformPopupMenuData& data)
 {
+    NSFont *font = m_popupClient->menuStyle().font().primaryFont()->getNSFont();
+    if (!font)
+        return;
+    
+    CFDictionaryRef fontDescriptorAttributes = (CFDictionaryRef)[[font fontDescriptor] fontAttributes];
+    if (!fontDescriptorAttributes)
+        return;
+    
+    data.fontInfo.fontAttributeDictionary = fontDescriptorAttributes;
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
index 2d74bbc..2c8649e 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
@@ -93,6 +93,13 @@ void InitWebCoreSystemInterface(void)
         INIT(SignalCFReadStreamEnd);
         INIT(SignalCFReadStreamError);
         INIT(SignalCFReadStreamHasBytes);
+        INIT(CreatePrivateStorageSession);
+        INIT(CopyRequestWithStorageSession);
+        INIT(CreatePrivateInMemoryHTTPCookieStorage);
+        INIT(GetHTTPCookieAcceptPolicy);
+        INIT(HTTPCookiesForURL);
+        INIT(SetHTTPCookiesForURL);
+        INIT(DeleteHTTPCookie);
 
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
         INIT(IOSurfaceContextCreate);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebContextMenuClientQt.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebContextMenuClientQt.cpp
index f6c45b0..a09ec19 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebContextMenuClientQt.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebContextMenuClientQt.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "WebContextMenuClient.h"
 
-#include "NotImplemented.h"
+#include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
index b80dccd..b4db406 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
@@ -66,7 +66,7 @@ void WebPopupMenu::setUpPlatformData(const WebCore::IntRect& pageCoordinates, Pl
             itemFont.update(m_popupClient->fontSelector());
         }
 
-        popupWidth = std::max(popupWidth, itemFont.width(TextRun(text.characters(), text.length())));
+        popupWidth = std::max<float>(popupWidth, ceilf(itemFont.width(TextRun(text.characters(), text.length()))));
     }
 
     // FIXME: popupWidth should probably take into account monitor constraints as is done with WebPopupMenuProxyWin::calculatePositionAndSize.
diff --git a/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp b/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp
index f5100aa..ed40063 100644
--- a/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.cpp
@@ -38,8 +38,8 @@ using namespace WebCore;
 
 namespace WebKit {
 
-ChunkedUpdateDrawingArea::ChunkedUpdateDrawingArea(DrawingAreaInfo::Identifier identifier, WebPage* webPage)
-    : DrawingArea(DrawingAreaInfo::ChunkedUpdate, identifier, webPage)
+ChunkedUpdateDrawingArea::ChunkedUpdateDrawingArea(WebPage* webPage)
+    : DrawingArea(DrawingAreaTypeChunkedUpdate, webPage)
     , m_isWaitingForUpdate(false)
     , m_paintingIsSuspended(false)
     , m_displayTimer(WebProcess::shared().runLoop(), this, &ChunkedUpdateDrawingArea::display)
@@ -74,15 +74,9 @@ void ChunkedUpdateDrawingArea::display()
     if (m_dirtyRect.isEmpty())
         return;
 
-    // Laying out the page can cause the drawing area to change so we keep an extra reference.
-    RefPtr<ChunkedUpdateDrawingArea> protect(this);
-
     // Layout if necessary.
     m_webPage->layoutIfNeeded();
  
-    if (m_webPage->drawingArea() != this)
-        return;
-    
     IntRect dirtyRect = m_dirtyRect;
     m_dirtyRect = IntRect();
 
@@ -126,15 +120,9 @@ void ChunkedUpdateDrawingArea::setSize(const IntSize& viewSize)
     // We don't want to wait for an update until we display.
     m_isWaitingForUpdate = false;
     
-    // Laying out the page can cause the drawing area to change so we keep an extra reference.
-    RefPtr<ChunkedUpdateDrawingArea> protect(this);
-
     m_webPage->setSize(viewSize);
     m_webPage->layoutIfNeeded();
 
-    if (m_webPage->drawingArea() != this)
-        return;
-
     if (m_paintingIsSuspended) {
         ASSERT(!m_displayTimer.isActive());
 
@@ -160,7 +148,7 @@ void ChunkedUpdateDrawingArea::suspendPainting()
     m_displayTimer.stop();
 }
 
-void ChunkedUpdateDrawingArea::resumePainting(bool forceRepaint)
+void ChunkedUpdateDrawingArea::deprecatedResumePainting(bool forceRepaint)
 {
     ASSERT(m_paintingIsSuspended);
     
@@ -185,14 +173,6 @@ void ChunkedUpdateDrawingArea::didUpdate()
 
 void ChunkedUpdateDrawingArea::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
-    DrawingAreaInfo::Identifier targetIdentifier;
-    if (!arguments->decode(CoreIPC::Out(targetIdentifier)))
-        return;
-
-    // We can switch drawing areas on the fly, so if this message was targetted at an obsolete drawing area, ignore it.
-    if (targetIdentifier != info().identifier)
-        return;
-
     switch (messageID.get<DrawingAreaLegacyMessage::Kind>()) {
         case DrawingAreaLegacyMessage::SetSize: {
             IntSize size;
@@ -212,7 +192,7 @@ void ChunkedUpdateDrawingArea::didReceiveMessage(CoreIPC::Connection*, CoreIPC::
             if (!arguments->decode(CoreIPC::Out(forceRepaint)))
                 return;
             
-            resumePainting(forceRepaint);
+            deprecatedResumePainting(forceRepaint);
             break;
         }
         case DrawingAreaLegacyMessage::DidUpdate:
diff --git a/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.h
index d32ed4c..5798ef6 100644
--- a/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/ChunkedUpdateDrawingArea.h
@@ -36,7 +36,7 @@ class UpdateChunk;
 
 class ChunkedUpdateDrawingArea : public DrawingArea {
 public:
-    ChunkedUpdateDrawingArea(DrawingAreaInfo::Identifier identifier, WebPage*);
+    explicit ChunkedUpdateDrawingArea(WebPage*);
     virtual ~ChunkedUpdateDrawingArea();
 
     virtual void setNeedsDisplay(const WebCore::IntRect&);
@@ -45,8 +45,6 @@ public:
     virtual void forceRepaint();
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual void attachCompositingContext() { }
-    virtual void detachCompositingContext() { }
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) { }
     virtual void scheduleCompositingLayerSync() { }
     virtual void syncCompositingLayers() { }
@@ -60,7 +58,7 @@ private:
     // CoreIPC message handlers.
     void setSize(const WebCore::IntSize& viewSize);
     void suspendPainting();
-    void resumePainting(bool forceRepaint);
+    void deprecatedResumePainting(bool forceRepaint);
     void didUpdate();
 
     // Platform overrides
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
index 10a8dbf..c808b19 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
@@ -33,10 +33,6 @@
 #include "DrawingAreaImpl.h"
 #endif
 
-#if USE(ACCELERATED_COMPOSITING)
-#include "LayerBackedDrawingArea.h"
-#endif
-
 #if ENABLE(TILED_BACKING_STORE)
 #include "TiledDrawingArea.h"
 #endif
@@ -45,37 +41,29 @@
 
 namespace WebKit {
 
-PassRefPtr<DrawingArea> DrawingArea::create(WebPage* webPage, const WebPageCreationParameters& parameters)
+PassOwnPtr<DrawingArea> DrawingArea::create(WebPage* webPage, const WebPageCreationParameters& parameters)
 {
-    switch (parameters.drawingAreaInfo.type) {
-        case DrawingAreaInfo::None:
-            ASSERT_NOT_REACHED();
-            break;
-
-        case DrawingAreaInfo::Impl:
+    switch (parameters.drawingAreaType) {
+    case DrawingAreaTypeImpl:
 #if PLATFORM(MAC) || PLATFORM(WIN)
-            return DrawingAreaImpl::create(webPage, parameters);
+        return DrawingAreaImpl::create(webPage, parameters);
 #else
-            return 0;
+        return 0;
 #endif
-        case DrawingAreaInfo::ChunkedUpdate:
-            return adoptRef(new ChunkedUpdateDrawingArea(parameters.drawingAreaInfo.identifier, webPage));
+    case DrawingAreaTypeChunkedUpdate:
+        return adoptPtr(new ChunkedUpdateDrawingArea(webPage));
 
-#if USE(ACCELERATED_COMPOSITING) && PLATFORM(MAC)
-        case DrawingAreaInfo::LayerBacked:
-            return adoptRef(new LayerBackedDrawingArea(parameters.drawingAreaInfo.identifier, webPage));
-#endif
 #if ENABLE(TILED_BACKING_STORE)
-        case DrawingAreaInfo::Tiled:
-            return adoptRef(new TiledDrawingArea(parameters.drawingAreaInfo.identifier, webPage));
+    case DrawingAreaTypeTiled:
+        return adoptPtr(new TiledDrawingArea(webPage));
 #endif
     }
 
     return 0;
 }
 
-DrawingArea::DrawingArea(DrawingAreaInfo::Type type, DrawingAreaInfo::Identifier identifier, WebPage* webPage)
-    : m_info(type, identifier)
+DrawingArea::DrawingArea(DrawingAreaType type, WebPage* webPage)
+    : m_type(type)
     , m_webPage(webPage)
 {
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
index de256b6..940e40e 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
@@ -28,13 +28,17 @@
 
 #include "DrawingAreaInfo.h"
 #include <WebCore/IntRect.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class Connection;
+    class MessageID;
+}
 
 namespace WebCore {
-#if USE(ACCELERATED_COMPOSITING)
     class GraphicsLayer;
-#endif
 }
 
 namespace WebKit {
@@ -42,10 +46,11 @@ namespace WebKit {
 class WebPage;
 struct WebPageCreationParameters;
 
-class DrawingArea : public RefCounted<DrawingArea> {
+class DrawingArea {
+    WTF_MAKE_NONCOPYABLE(DrawingArea);
+
 public:
-    // FIXME: It might make sense to move this create function into a factory style class. 
-    static PassRefPtr<DrawingArea> create(WebPage*, const WebPageCreationParameters&);
+    static PassOwnPtr<DrawingArea> create(WebPage*, const WebPageCreationParameters&);
     virtual ~DrawingArea();
     
 #if PLATFORM(MAC) || PLATFORM(WIN)
@@ -57,7 +62,6 @@ public:
 
     // FIXME: These should be pure virtual.
     virtual void pageBackgroundTransparencyChanged() { }
-    virtual void onPageClose() { }
     virtual void forceRepaint() { }
 
     virtual void didInstallPageOverlay() { }
@@ -65,8 +69,6 @@ public:
     virtual void setPageOverlayNeedsDisplay(const WebCore::IntRect&) { }
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual void attachCompositingContext() = 0;
-    virtual void detachCompositingContext() = 0;
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) = 0;
     virtual void scheduleCompositingLayerSync() = 0;
     virtual void syncCompositingLayers() = 0;
@@ -74,18 +76,16 @@ public:
 
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) = 0;
 
-    const DrawingAreaInfo& info() const { return m_info; }
-
 protected:
-    DrawingArea(DrawingAreaInfo::Type, DrawingAreaInfo::Identifier, WebPage*);
+    DrawingArea(DrawingAreaType, WebPage*);
 
-    DrawingAreaInfo m_info;
+    DrawingAreaType m_type;
     WebPage* m_webPage;
 
 private:
     // CoreIPC message handlers.
     // FIXME: These should be pure virtual.
-    virtual void setSize(const WebCore::IntSize& size, const WebCore::IntSize& scrollOffset) { }
+    virtual void updateBackingStoreState(uint64_t backingStoreStateID, bool respondImmediately, const WebCore::IntSize& size, const WebCore::IntSize& scrollOffset) { }
     virtual void didUpdate() { }
     virtual void suspendPainting() { }
     virtual void resumePainting() { }
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in b/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
index ec09e18..30186f2 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
@@ -21,7 +21,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 messages -> DrawingArea {
-    SetSize(WebCore::IntSize size, WebCore::IntSize scrollOffset)
+    UpdateBackingStoreState(uint64_t backingStoreStateID, bool respondImmediately, WebCore::IntSize size, WebCore::IntSize scrollOffset)
     DidUpdate()
     SuspendPainting()
     ResumePainting()
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 6d65fae..0a18256 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -34,6 +34,8 @@
 #include "WebPageCreationParameters.h"
 #include "WebProcess.h"
 #include <WebCore/GraphicsContext.h>
+#include <WebCore/Page.h>
+#include <WebCore/Settings.h>
 
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
 #error "This drawing area is not ready for use by other ports yet."
@@ -43,15 +45,9 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static uint64_t generateSequenceNumber()
+PassOwnPtr<DrawingAreaImpl> DrawingAreaImpl::create(WebPage* webPage, const WebPageCreationParameters& parameters)
 {
-    static uint64_t sequenceNumber;
-    return ++sequenceNumber;
-}
-
-PassRefPtr<DrawingAreaImpl> DrawingAreaImpl::create(WebPage* webPage, const WebPageCreationParameters& parameters)
-{
-    return adoptRef(new DrawingAreaImpl(webPage, parameters));
+    return adoptPtr(new DrawingAreaImpl(webPage, parameters));
 }
 
 DrawingAreaImpl::~DrawingAreaImpl()
@@ -61,13 +57,21 @@ DrawingAreaImpl::~DrawingAreaImpl()
 }
 
 DrawingAreaImpl::DrawingAreaImpl(WebPage* webPage, const WebPageCreationParameters& parameters)
-    : DrawingArea(DrawingAreaInfo::Impl, parameters.drawingAreaInfo.identifier, webPage)
-    , m_inSetSize(false)
+    : DrawingArea(DrawingAreaTypeImpl, webPage)
+    , m_backingStoreStateID(0)
+    , m_inUpdateBackingStoreState(false)
+    , m_shouldSendDidUpdateBackingStoreState(false)
     , m_isWaitingForDidUpdate(false)
     , m_isPaintingSuspended(!parameters.isVisible)
+    , m_alwaysUseCompositing(false)
     , m_displayTimer(WebProcess::shared().runLoop(), this, &DrawingAreaImpl::display)
     , m_exitCompositingTimer(WebProcess::shared().runLoop(), this, &DrawingAreaImpl::exitAcceleratedCompositingMode)
 {
+    if (webPage->corePage()->settings()->acceleratedDrawingEnabled())
+        m_alwaysUseCompositing = true;
+        
+    if (m_alwaysUseCompositing)
+        enterAcceleratedCompositingMode(0);
 }
 
 void DrawingAreaImpl::setNeedsDisplay(const IntRect& rect)
@@ -142,6 +146,15 @@ void DrawingAreaImpl::scroll(const IntRect& scrollRect, const IntSize& scrollOff
 
 void DrawingAreaImpl::forceRepaint()
 {
+    setNeedsDisplay(m_webPage->bounds());
+
+    m_webPage->layoutIfNeeded();
+
+    if (m_layerTreeHost) {
+        m_layerTreeHost->forceRepaint();
+        return;
+    }
+
     m_isWaitingForDidUpdate = false;
     display();
 }
@@ -170,12 +183,21 @@ void DrawingAreaImpl::setPageOverlayNeedsDisplay(const IntRect& rect)
     setNeedsDisplay(rect);
 }
 
-void DrawingAreaImpl::attachCompositingContext()
+void DrawingAreaImpl::layerHostDidFlushLayers()
 {
-}
+    ASSERT(m_layerTreeHost);
 
-void DrawingAreaImpl::detachCompositingContext()
-{
+    m_layerTreeHost->forceRepaint();
+
+    if (m_shouldSendDidUpdateBackingStoreState) {
+        sendDidUpdateBackingStoreState();
+        return;
+    }
+
+    if (!m_layerTreeHost)
+        return;
+
+    m_webPage->send(Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode(m_backingStoreStateID, m_layerTreeHost->layerTreeContext()));
 }
 
 void DrawingAreaImpl::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
@@ -191,9 +213,17 @@ void DrawingAreaImpl::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
         }
     } else {
         if (m_layerTreeHost) {
-            // We'll exit accelerated compositing mode on a timer, to avoid re-entering
-            // compositing code via display() and layout.
-            exitAcceleratedCompositingModeSoon();
+            m_layerTreeHost->setRootCompositingLayer(0);
+            if (!m_alwaysUseCompositing) {
+                // We'll exit accelerated compositing mode on a timer, to avoid re-entering
+                // compositing code via display() and layout.
+                // If we're leaving compositing mode because of a setSize, it is safe to
+                // exit accelerated compositing mode right away.
+                if (m_inUpdateBackingStoreState)
+                    exitAcceleratedCompositingMode();
+                else
+                    exitAcceleratedCompositingModeSoon();
+            }
         }
     }
 }
@@ -213,39 +243,74 @@ void DrawingAreaImpl::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID
 {
 }
 
-void DrawingAreaImpl::setSize(const WebCore::IntSize& size, const WebCore::IntSize& scrollOffset)
+void DrawingAreaImpl::updateBackingStoreState(uint64_t stateID, bool respondImmediately, const WebCore::IntSize& size, const WebCore::IntSize& scrollOffset)
 {
-    ASSERT(!m_inSetSize);
-    m_inSetSize = true;
+    ASSERT(!m_inUpdateBackingStoreState);
+    m_inUpdateBackingStoreState = true;
+
+    ASSERT_ARG(stateID, stateID >= m_backingStoreStateID);
+    if (stateID != m_backingStoreStateID) {
+        m_backingStoreStateID = stateID;
+        m_shouldSendDidUpdateBackingStoreState = true;
+
+        m_webPage->setSize(size);
+        m_webPage->layoutIfNeeded();
+        m_webPage->scrollMainFrameIfNotAtMaxScrollPosition(scrollOffset);
+
+        if (m_layerTreeHost)
+            m_layerTreeHost->sizeDidChange(size);
+        else
+            m_dirtyRegion = m_webPage->bounds();
+    } else {
+        ASSERT(size == m_webPage->size());
+        if (!m_shouldSendDidUpdateBackingStoreState) {
+            // We've already sent a DidUpdateBackingStoreState message for this state. We have nothing more to do.
+            m_inUpdateBackingStoreState = false;
+            return;
+        }
+    }
 
-    // Set this to false since we're about to call display().
+    // The UI process has updated to a new backing store state. Any Update messages we sent before
+    // this point will be ignored. We wait to set this to false until after updating the page's
+    // size so that any displays triggered by the relayout will be ignored. If we're supposed to
+    // respond to the UpdateBackingStoreState message immediately, we'll do a display anyway in
+    // sendDidUpdateBackingStoreState; otherwise we shouldn't do one right now.
     m_isWaitingForDidUpdate = false;
 
-    m_webPage->setSize(size);
-    m_webPage->layoutIfNeeded();
-    m_webPage->scrollMainFrameIfNotAtMaxScrollPosition(scrollOffset);
+    if (respondImmediately)
+        sendDidUpdateBackingStoreState();
+
+    m_inUpdateBackingStoreState = false;
+}
+
+void DrawingAreaImpl::sendDidUpdateBackingStoreState()
+{
+    ASSERT(!m_isWaitingForDidUpdate);
+    ASSERT(m_shouldSendDidUpdateBackingStoreState);
+
+    m_shouldSendDidUpdateBackingStoreState = false;
 
     UpdateInfo updateInfo;
     LayerTreeContext layerTreeContext;
 
-    if (m_layerTreeHost) {
-        m_layerTreeHost->sizeDidChange(size);
-        layerTreeContext = m_layerTreeHost->layerTreeContext();
-    }
+    if (!m_isPaintingSuspended && !m_layerTreeHost)
+        display(updateInfo);
 
-    if (m_isPaintingSuspended || m_layerTreeHost)
+    if (m_isPaintingSuspended || m_layerTreeHost) {
         updateInfo.viewSize = m_webPage->size();
-    else {
-        m_dirtyRegion.unite(m_webPage->bounds());
 
-        // The display here should not cause layout to happen, so we can't enter accelerated compositing mode here.
-        display(updateInfo);
-        ASSERT(!m_layerTreeHost);
-    }
+        if (m_layerTreeHost) {
+            layerTreeContext = m_layerTreeHost->layerTreeContext();
 
-    m_webPage->send(Messages::DrawingAreaProxy::DidSetSize(generateSequenceNumber(), updateInfo, layerTreeContext));
+            // We don't want the layer tree host to notify after the next scheduled
+            // layer flush because that might end up sending an EnterAcceleratedCompositingMode
+            // message back to the UI process, but the updated layer tree context
+            // will be sent back in the DidUpdateBackingStoreState message.
+            m_layerTreeHost->setShouldNotifyAfterNextScheduledLayerFlush(false);
+        }
+    }
 
-    m_inSetSize = false;
+    m_webPage->send(Messages::DrawingAreaProxy::DidUpdateBackingStoreState(m_backingStoreStateID, updateInfo, layerTreeContext));
 }
 
 void DrawingAreaImpl::didUpdate()
@@ -286,6 +351,9 @@ void DrawingAreaImpl::enterAcceleratedCompositingMode(GraphicsLayer* graphicsLay
     ASSERT(!m_layerTreeHost);
 
     m_layerTreeHost = LayerTreeHost::create(m_webPage);
+    if (!m_inUpdateBackingStoreState)
+        m_layerTreeHost->setShouldNotifyAfterNextScheduledLayerFlush(true);
+
     m_layerTreeHost->setRootCompositingLayer(graphicsLayer);
     
     // Non-composited content will now be handled exclusively by the layer tree host.
@@ -294,35 +362,38 @@ void DrawingAreaImpl::enterAcceleratedCompositingMode(GraphicsLayer* graphicsLay
     m_scrollOffset = IntSize();
     m_displayTimer.stop();
     m_isWaitingForDidUpdate = false;
-
-    if (!m_inSetSize)
-        m_webPage->send(Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode(generateSequenceNumber(), m_layerTreeHost->layerTreeContext()));
 }
 
 void DrawingAreaImpl::exitAcceleratedCompositingMode()
 {
+    if (m_alwaysUseCompositing)
+        return;
+
     m_exitCompositingTimer.stop();
 
     ASSERT(m_layerTreeHost);
 
     m_layerTreeHost->invalidate();
     m_layerTreeHost = nullptr;
+    m_dirtyRegion = m_webPage->bounds();
+
+    if (m_inUpdateBackingStoreState)
+        return;
 
-    if (m_inSetSize)
+    if (m_shouldSendDidUpdateBackingStoreState) {
+        sendDidUpdateBackingStoreState();
         return;
+    }
 
     UpdateInfo updateInfo;
     if (m_isPaintingSuspended)
         updateInfo.viewSize = m_webPage->size();
-    else {
-        m_dirtyRegion = m_webPage->bounds();
+    else
         display(updateInfo);
-    }
 
     // Send along a complete update of the page so we can paint the contents right after we exit the
     // accelerated compositing mode, eliminiating flicker.
-    if (!m_inSetSize)
-        m_webPage->send(Messages::DrawingAreaProxy::ExitAcceleratedCompositingMode(generateSequenceNumber(), updateInfo));
+    m_webPage->send(Messages::DrawingAreaProxy::ExitAcceleratedCompositingMode(m_backingStoreStateID, updateInfo));
 }
 
 void DrawingAreaImpl::exitAcceleratedCompositingModeSoon()
@@ -354,6 +425,7 @@ void DrawingAreaImpl::display()
 {
     ASSERT(!m_layerTreeHost);
     ASSERT(!m_isWaitingForDidUpdate);
+    ASSERT(!m_inUpdateBackingStoreState);
 
     if (m_isPaintingSuspended)
         return;
@@ -361,6 +433,11 @@ void DrawingAreaImpl::display()
     if (m_dirtyRegion.isEmpty())
         return;
 
+    if (m_shouldSendDidUpdateBackingStoreState) {
+        sendDidUpdateBackingStoreState();
+        return;
+    }
+
     UpdateInfo updateInfo;
     display(updateInfo);
 
@@ -370,7 +447,7 @@ void DrawingAreaImpl::display()
         return;
     }
 
-    m_webPage->send(Messages::DrawingAreaProxy::Update(generateSequenceNumber(), updateInfo));
+    m_webPage->send(Messages::DrawingAreaProxy::Update(m_backingStoreStateID, updateInfo));
     m_isWaitingForDidUpdate = true;
 }
 
@@ -405,7 +482,20 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     if (m_webPage->mainFrameHasCustomRepresentation())
         return;
 
+    m_webPage->layoutIfNeeded();
+
+    // The layout may have put the page into accelerated compositing mode, in which case the
+    // LayerTreeHost is now in charge of displaying.
+    if (m_layerTreeHost)
+        return;
+
     IntRect bounds = m_dirtyRegion.bounds();
+    ASSERT(m_webPage->bounds().contains(bounds));
+
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(bounds.size());
+    if (!bitmap->createHandle(updateInfo.bitmapHandle))
+        return;
+
     Vector<IntRect> rects = m_dirtyRegion.rects();
 
     if (shouldPaintBoundsRect(bounds, rects)) {
@@ -419,14 +509,8 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     m_dirtyRegion = Region();
     m_scrollRect = IntRect();
     m_scrollOffset = IntSize();
-    
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(bounds.size());
-    if (!bitmap->createHandle(updateInfo.bitmapHandle))
-        return;
 
     OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
-
-    m_webPage->layoutIfNeeded();
     
     updateInfo.viewSize = m_webPage->size();
     updateInfo.updateRectBounds = bounds;
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index cbb94c2..8d85200 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -37,9 +37,11 @@ class UpdateInfo;
 
 class DrawingAreaImpl : public DrawingArea {
 public:
-    static PassRefPtr<DrawingAreaImpl> create(WebPage*, const WebPageCreationParameters&);
+    static PassOwnPtr<DrawingAreaImpl> create(WebPage*, const WebPageCreationParameters&);
     virtual ~DrawingAreaImpl();
 
+    void layerHostDidFlushLayers();
+
 private:
     DrawingAreaImpl(WebPage*, const WebPageCreationParameters&);
 
@@ -52,19 +54,19 @@ private:
     virtual void didUninstallPageOverlay();
     virtual void setPageOverlayNeedsDisplay(const WebCore::IntRect&);
     
-    virtual void attachCompositingContext();
-    virtual void detachCompositingContext();
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*);
     virtual void scheduleCompositingLayerSync();
     virtual void syncCompositingLayers();
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
     // CoreIPC message handlers.
-    virtual void setSize(const WebCore::IntSize&, const WebCore::IntSize& scrollOffset);
+    virtual void updateBackingStoreState(uint64_t backingStoreStateID, bool respondImmediately, const WebCore::IntSize&, const WebCore::IntSize& scrollOffset);
     virtual void didUpdate();
     virtual void suspendPainting();
     virtual void resumePainting();
 
+    void sendDidUpdateBackingStoreState();
+
     void enterAcceleratedCompositingMode(WebCore::GraphicsLayer*);
     void exitAcceleratedCompositingModeSoon();
     void exitAcceleratedCompositingMode();
@@ -73,12 +75,18 @@ private:
     void display();
     void display(UpdateInfo&);
 
+    uint64_t m_backingStoreStateID;
+
     Region m_dirtyRegion;
     WebCore::IntRect m_scrollRect;
     WebCore::IntSize m_scrollOffset;
 
-    // Whether we're currently processing a setSize message.
-    bool m_inSetSize;
+    // Whether we're currently processing an UpdateBackingStoreState message.
+    bool m_inUpdateBackingStoreState;
+
+    // When true, we should send an UpdateBackingStoreState message instead of any other messages
+    // we normally send to the UI process.
+    bool m_shouldSendDidUpdateBackingStoreState;
 
     // Whether we're waiting for a DidUpdate message. Used for throttling paints so that the 
     // web process won't paint more frequent than the UI process can handle.
@@ -87,6 +95,7 @@ private:
     // Whether painting is suspended. We'll still keep track of the dirty region but we 
     // won't paint until painting has resumed again.
     bool m_isPaintingSuspended;
+    bool m_alwaysUseCompositing;
 
     RunLoop::Timer<DrawingAreaImpl> m_displayTimer;
     RunLoop::Timer<DrawingAreaImpl> m_exitCompositingTimer;
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp b/Source/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp
deleted file mode 100644
index 44b3bd6..0000000
--- a/Source/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.cpp
+++ /dev/null
@@ -1,239 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "LayerBackedDrawingArea.h"
-
-#if USE(ACCELERATED_COMPOSITING)
-
-#include "DrawingAreaMessageKinds.h"
-#include "DrawingAreaProxyMessageKinds.h"
-#include "MessageID.h"
-#include "WebCoreArgumentCoders.h"
-#include "WebPage.h"
-#include "WebProcess.h"
-#include <WebCore/GraphicsLayer.h>
-#include <WebCore/Page.h>
-#include <WebCore/Settings.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-LayerBackedDrawingArea::LayerBackedDrawingArea(DrawingAreaInfo::Identifier identifier, WebPage* webPage)
-    : DrawingArea(DrawingAreaInfo::LayerBacked, identifier, webPage)
-    , m_syncTimer(WebProcess::shared().runLoop(), this, &LayerBackedDrawingArea::syncCompositingLayers)
-    , m_attached(false)
-    , m_shouldPaint(true)
-{
-    m_hostingLayer = GraphicsLayer::create(this);
-    m_hostingLayer->setDrawsContent(false);
-#ifndef NDEBUG
-    m_hostingLayer->setName("DrawingArea hosting layer");
-#endif
-    m_hostingLayer->setSize(webPage->size());
-    m_backingLayer = GraphicsLayer::create(this);
-    m_backingLayer->setDrawsContent(true);
-    m_backingLayer->setContentsOpaque(webPage->drawsBackground() && !webPage->drawsTransparentBackground());
-
-#ifndef NDEBUG
-    m_backingLayer->setName("DrawingArea backing layer");
-#endif
-    m_backingLayer->setSize(webPage->size());
-    m_hostingLayer->addChild(m_backingLayer.get());
-    platformInit();
-}
-
-LayerBackedDrawingArea::~LayerBackedDrawingArea()
-{
-    platformClear();
-}
-
-void LayerBackedDrawingArea::scroll(const IntRect& scrollRect, const IntSize& scrollOffset)
-{
-    // FIXME: Do something much smarter.
-    setNeedsDisplay(scrollRect);
-}
-
-void LayerBackedDrawingArea::setNeedsDisplay(const IntRect& rect)
-{
-    m_backingLayer->setNeedsDisplayInRect(rect);
-    scheduleCompositingLayerSync();
-}
-
-void LayerBackedDrawingArea::display()
-{
-    // Laying out the page can cause the drawing area to change so we keep an extra reference.
-    RefPtr<LayerBackedDrawingArea> protect(this);
-
-    // Layout if necessary.
-    m_webPage->layoutIfNeeded();
-
-    if (m_webPage->drawingArea() != this)
-        return;
-}
-
-void LayerBackedDrawingArea::pageBackgroundTransparencyChanged()
-{
-    m_backingLayer->setContentsOpaque(m_webPage->drawsBackground() && !m_webPage->drawsTransparentBackground());
-}
-
-void LayerBackedDrawingArea::scheduleDisplay()
-{
-}
-
-void LayerBackedDrawingArea::setSize(const IntSize& viewSize)
-{
-    ASSERT(m_shouldPaint);
-    ASSERT_ARG(viewSize, !viewSize.isEmpty());
-
-    m_hostingLayer->setSize(viewSize);
-    m_backingLayer->setSize(viewSize);
-    scheduleCompositingLayerSync();
-
-    // Laying out the page can cause the drawing area to change so we keep an extra reference.
-    RefPtr<LayerBackedDrawingArea> protect(this);
-    
-    m_webPage->setSize(viewSize);
-    m_webPage->layoutIfNeeded();
-
-    if (m_webPage->drawingArea() != this)
-        return;
-    
-    WebProcess::shared().connection()->deprecatedSend(DrawingAreaProxyLegacyMessage::DidSetSize, m_webPage->pageID(), CoreIPC::In(viewSize));
-}
-
-void LayerBackedDrawingArea::suspendPainting()
-{
-    ASSERT(m_shouldPaint);
-    
-    m_shouldPaint = false;
-}
-
-void LayerBackedDrawingArea::resumePainting()
-{
-    ASSERT(!m_shouldPaint);
-    
-    m_shouldPaint = true;
-    
-    // Display if needed.
-    display();
-}
-
-void LayerBackedDrawingArea::didUpdate()
-{
-    // Display if needed.
-    display();
-}
-
-void LayerBackedDrawingArea::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
-{
-    DrawingAreaInfo::Identifier targetIdentifier;
-    if (!arguments->decode(CoreIPC::Out(targetIdentifier)))
-        return;
-
-    // We can switch drawing areas on the fly, so if this message was targetted at an obsolete drawing area, ignore it.
-    if (targetIdentifier != info().identifier)
-        return;
-
-    switch (messageID.get<DrawingAreaLegacyMessage::Kind>()) {
-        case DrawingAreaLegacyMessage::SetSize: {
-            IntSize size;
-            if (!arguments->decode(CoreIPC::Out(size)))
-                return;
-
-            setSize(size);
-            break;
-        }
-        
-        case DrawingAreaLegacyMessage::SuspendPainting:
-            suspendPainting();
-            break;
-
-        case DrawingAreaLegacyMessage::ResumePainting:
-            resumePainting();
-            break;
-
-        case DrawingAreaLegacyMessage::DidUpdate:
-            didUpdate();
-            break;
-
-        default:
-            ASSERT_NOT_REACHED();
-            break;
-    }
-}
-
-// GraphicsLayerClient methods
-void LayerBackedDrawingArea::paintContents(const GraphicsLayer*, GraphicsContext& graphicsContext, GraphicsLayerPaintingPhase, const IntRect& inClip)
-{
-    m_webPage->drawRect(graphicsContext, inClip);
-}
-
-bool LayerBackedDrawingArea::showDebugBorders() const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerBackedDrawingArea::showRepaintCounter() const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
-#if !PLATFORM(MAC) && !PLATFORM(WIN)
-void LayerBackedDrawingArea::attachCompositingContext(GraphicsLayer*)
-{
-}
-
-void LayerBackedDrawingArea::detachCompositingContext()
-{
-}
-
-#if !PLATFORM(MAC)
-void LayerBackedDrawingArea::setRootCompositingLayer(WebCore::GraphicsLayer*)
-{
-}
-#endif
-
-void LayerBackedDrawingArea::scheduleCompositingLayerSync()
-{
-}
-
-void LayerBackedDrawingArea::syncCompositingLayers()
-{
-}
-
-void LayerBackedDrawingArea::platformInit()
-{
-}
-
-void LayerBackedDrawingArea::platformClear()
-{
-}
-#endif
-
-} // namespace WebKit
-
-#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.h
deleted file mode 100644
index 400c8c5..0000000
--- a/Source/WebKit2/WebProcess/WebPage/LayerBackedDrawingArea.h
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LayerBackedDrawingArea_h
-#define LayerBackedDrawingArea_h
-
-#if USE(ACCELERATED_COMPOSITING)
-
-#include "DrawingArea.h"
-#include "RunLoop.h"
-#include <WebCore/IntPoint.h>
-#include <WebCore/GraphicsLayerClient.h>
-
-#if PLATFORM(MAC)
-#include <wtf/RetainPtr.h>
-OBJC_CLASS NSPopUpButtonCell;
-OBJC_CLASS WKView;
-typedef struct __WKCARemoteLayerClientRef *WKCARemoteLayerClientRef;
-#endif
-
-namespace WebCore {
-    class GraphicsContext;
-    class GraphicsLayer;
-}
-
-namespace WebKit {
-
-class LayerBackedDrawingArea : public DrawingArea, private WebCore::GraphicsLayerClient {
-public:
-    LayerBackedDrawingArea(DrawingAreaInfo::Identifier identifier, WebPage*);
-    virtual ~LayerBackedDrawingArea();
-
-    virtual void setNeedsDisplay(const WebCore::IntRect&);
-    virtual void scroll(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
-    virtual void display();
-
-    virtual void pageBackgroundTransparencyChanged();
-
-    virtual void attachCompositingContext();
-    virtual void detachCompositingContext();
-    virtual void setRootCompositingLayer(WebCore::GraphicsLayer*);
-    virtual void scheduleCompositingLayerSync();
-    virtual void syncCompositingLayers();
-
-    virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
-
-private:
-
-    // GraphicsLayerClient
-    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double /*time*/) { }
-    virtual void notifySyncRequired(const WebCore::GraphicsLayer*) { }
-public:
-    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-private:
-    virtual bool showDebugBorders() const;
-    virtual bool showRepaintCounter() const;
-
-#if PLATFORM(MAC)
-    virtual void onPageClose();
-#endif
-
-    void scheduleDisplay();
-    
-    // CoreIPC message handlers.
-    void setSize(const WebCore::IntSize& viewSize);
-    void suspendPainting();
-    void resumePainting();
-    void didUpdate();
-    
-    void platformInit();
-    void platformClear();
-
-#if PLATFORM(MAC)
-    void setUpUpdateLayoutRunLoopObserver();
-    void scheduleUpdateLayoutRunLoopObserver();
-    void removeUpdateLayoutRunLoopObserver();
-
-    static void updateLayoutRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*);
-    void updateLayoutRunLoopObserverFired();
-#endif
-
-    RunLoop::Timer<LayerBackedDrawingArea> m_syncTimer;
-
-    OwnPtr<WebCore::GraphicsLayer> m_hostingLayer;
-    OwnPtr<WebCore::GraphicsLayer> m_backingLayer;
-#if PLATFORM(MAC)
-#if HAVE(HOSTED_CORE_ANIMATION)
-    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerRef;
-#endif
-    RetainPtr<CFRunLoopObserverRef> m_updateLayoutRunLoopObserver;
-#endif
-
-    bool m_attached;
-    bool m_shouldPaint;
-};
-
-} // namespace WebKit
-
-#endif // USE(ACCELERATED_COMPOSITING)
-
-#endif // LayerBackedDrawingArea_h
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
index 4ca1137..bbb94e8 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
@@ -47,11 +47,13 @@ public:
 
     virtual const LayerTreeContext& layerTreeContext() = 0;
     virtual void scheduleLayerFlush() = 0;
+    virtual void setShouldNotifyAfterNextScheduledLayerFlush(bool) = 0;
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) = 0;
     virtual void invalidate() = 0;
 
     virtual void setNonCompositedContentsNeedDisplay(const WebCore::IntRect&) = 0;
     virtual void scrollNonCompositedContents(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset) = 0;
+    virtual void forceRepaint() = 0;
     virtual void sizeDidChange(const WebCore::IntSize& newSize) = 0;
 
     virtual void didInstallPageOverlay() = 0;
diff --git a/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.cpp b/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.cpp
index f27f14f..5997564 100644
--- a/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.cpp
@@ -43,8 +43,8 @@ using namespace WebCore;
 
 namespace WebKit {
 
-TiledDrawingArea::TiledDrawingArea(DrawingAreaInfo::Identifier identifier, WebPage* webPage)
-    : DrawingArea(DrawingAreaInfo::Tiled, identifier, webPage)
+TiledDrawingArea::TiledDrawingArea(WebPage* webPage)
+    : DrawingArea(DrawingAreaTypeTiled, webPage)
     , m_isWaitingForUpdate(false)
     , m_shouldPaint(true)
     , m_displayTimer(WebProcess::shared().runLoop(), this, &TiledDrawingArea::display)
diff --git a/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.h
index 7b682ca..3572c9f 100644
--- a/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.h
@@ -30,7 +30,6 @@
 
 #include "DrawingArea.h"
 #include "RunLoop.h"
-#include <WebCore/IntPoint.h>
 #include <WebCore/IntRect.h>
 #include <wtf/Vector.h>
 
@@ -40,7 +39,7 @@ class UpdateChunk;
 
 class TiledDrawingArea : public DrawingArea {
 public:
-    TiledDrawingArea(DrawingAreaInfo::Identifier, WebPage*);
+    explicit TiledDrawingArea(WebPage*);
     virtual ~TiledDrawingArea();
 
     virtual void setNeedsDisplay(const WebCore::IntRect&);
diff --git a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
index 7b958bf..02688c5 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
@@ -51,13 +51,13 @@ typedef HashMap<RefPtr<HistoryItem>, uint64_t> HistoryItemToIDMap;
 
 static IDToHistoryItemMap& idToHistoryItemMap()
 {
-    static IDToHistoryItemMap map;
+    DEFINE_STATIC_LOCAL(IDToHistoryItemMap, map, ());
     return map;
 } 
 
 static HistoryItemToIDMap& historyItemToIDMap()
 {
-    static HistoryItemToIDMap map;
+    DEFINE_STATIC_LOCAL(HistoryItemToIDMap, map, ());
     return map;
 } 
 
@@ -118,6 +118,12 @@ HistoryItem* WebBackForwardListProxy::itemForID(uint64_t itemID)
     return idToHistoryItemMap().get(itemID).get();
 }
 
+uint64_t WebBackForwardListProxy::idForItem(HistoryItem* item)
+{
+    ASSERT(item);
+    return historyItemToIDMap().get(item);
+}
+
 void WebBackForwardListProxy::removeItem(uint64_t itemID)
 {
     IDToHistoryItemMap::iterator it = idToHistoryItemMap().find(itemID);
diff --git a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.h b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.h
index be28739..00ef8f6 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.h
@@ -38,6 +38,7 @@ public:
     static PassRefPtr<WebBackForwardListProxy> create(WebPage* page) { return adoptRef(new WebBackForwardListProxy(page)); }
 
     static WebCore::HistoryItem* itemForID(uint64_t);
+    static uint64_t idForItem(WebCore::HistoryItem*);
     static void removeItem(uint64_t itemID);
 
     static void addItemFromUIProcess(uint64_t itemID, PassRefPtr<WebCore::HistoryItem>);
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
index 4b3fdaf..58ae5ea 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
@@ -86,6 +86,11 @@ void WebInspector::didClose()
     WebProcess::shared().connection()->send(Messages::WebInspectorProxy::DidClose(), m_page->pageID());
 }
 
+void WebInspector::inspectedURLChanged(const String& urlString)
+{
+    WebProcess::shared().connection()->send(Messages::WebInspectorProxy::InspectedURLChanged(urlString), m_page->pageID());
+}
+
 // Called by WebInspector messages
 void WebInspector::show()
 {
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.h b/Source/WebKit2/WebProcess/WebPage/WebInspector.h
index 517ae8e..6b1c77a 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.h
@@ -73,6 +73,7 @@ private:
     // Called from WebInspectorFrontendClient
     void didLoadInspectorPage();
     void didClose();
+    void inspectedURLChanged(const String&);
 
     // Implemented in platform WebInspector file
     String localizedStringsURL() const;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 462d352..ff567bd 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -91,6 +91,7 @@
 #include <WebCore/RenderView.h>
 #include <WebCore/ReplaceSelectionCommand.h>
 #include <WebCore/ResourceRequest.h>
+#include <WebCore/SerializedScriptValue.h>
 #include <WebCore/Settings.h>
 #include <WebCore/SharedBuffer.h>
 #include <WebCore/SubstituteData.h>
@@ -99,6 +100,9 @@
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 
+#include <WebCore/Range.h>
+#include <WebCore/VisiblePosition.h>
+
 #if PLATFORM(MAC) || PLATFORM(WIN)
 #include <WebCore/LegacyWebArchive.h>
 #endif
@@ -151,8 +155,11 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     , m_findController(this)
     , m_geolocationPermissionRequestManager(this)
     , m_pageID(pageID)
+    , m_canRunBeforeUnloadConfirmPanel(parameters.canRunBeforeUnloadConfirmPanel)
     , m_canRunModal(parameters.canRunModal)
     , m_isRunningModal(false)
+    , m_cachedMainFrameIsPinnedToLeftSide(false)
+    , m_cachedMainFrameIsPinnedToRightSide(false)
 {
     ASSERT(m_pageID);
 
@@ -184,7 +191,7 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     m_page->setGroupName(m_pageGroup->identifier());
 
     platformInitialize();
-    Settings::setMinDOMTimerInterval(0.004);
+    Settings::setDefaultMinDOMTimerInterval(0.004);
 
     m_drawingArea = DrawingArea::create(this, parameters);
     m_mainFrame = WebFrame::createMainFrame(this);
@@ -192,6 +199,8 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     setDrawsBackground(parameters.drawsBackground);
     setDrawsTransparentBackground(parameters.drawsTransparentBackground);
 
+    setMemoryCacheMessagesEnabled(parameters.areMemoryCacheClientCallsEnabled);
+
     setActive(parameters.isActive);
     setFocused(parameters.isFocused);
     setIsInWindow(parameters.isInWindow);
@@ -319,45 +328,13 @@ void WebPage::clearMainFrameName()
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-void WebPage::changeAcceleratedCompositingMode(WebCore::GraphicsLayer* layer)
-{
-    if (m_isClosed)
-        return;
-
-    // With the new drawing area we don't need to inform the UI process when the accelerated
-    // compositing mode changes.
-    if (m_drawingArea->info().type == DrawingAreaInfo::Impl)
-        return;
-
-    bool compositing = layer;
-    
-    // Tell the UI process that accelerated compositing changed. It may respond by changing
-    // drawing area types.
-    DrawingAreaInfo newDrawingAreaInfo;
-
-    if (!sendSync(Messages::WebPageProxy::DidChangeAcceleratedCompositing(compositing), Messages::WebPageProxy::DidChangeAcceleratedCompositing::Reply(newDrawingAreaInfo)))
-        return;
-    
-    if (newDrawingAreaInfo.type != drawingArea()->info().type) {
-        m_drawingArea = 0;
-        if (newDrawingAreaInfo.type != DrawingAreaInfo::None) {
-            WebPageCreationParameters parameters;
-            parameters.drawingAreaInfo = newDrawingAreaInfo;
-            m_drawingArea = DrawingArea::create(this, parameters);
-            m_drawingArea->setNeedsDisplay(IntRect(IntPoint(0, 0), m_viewSize));
-        }
-    }
-}
-
 void WebPage::enterAcceleratedCompositingMode(GraphicsLayer* layer)
 {
-    changeAcceleratedCompositingMode(layer);
     m_drawingArea->setRootCompositingLayer(layer);
 }
 
 void WebPage::exitAcceleratedCompositingMode()
 {
-    changeAcceleratedCompositingMode(0);
     m_drawingArea->setRootCompositingLayer(0);
 }
 #endif
@@ -393,15 +370,16 @@ void WebPage::close()
     m_mainFrame->coreFrame()->loader()->detachFromParent();
     m_page.clear();
 
-    m_drawingArea->onPageClose();
     m_drawingArea.clear();
 
+    bool isRunningModal = m_isRunningModal;
+    m_isRunningModal = false;
+
+    // The WebPage can be destroyed by this call.
     WebProcess::shared().removeWebPage(m_pageID);
 
-    if (m_isRunningModal) {
-        m_isRunningModal = false;
+    if (isRunningModal)
         WebProcess::shared().runLoop()->stop();
-    }
 }
 
 void WebPage::tryClose()
@@ -482,25 +460,34 @@ void WebPage::reload(bool reloadFromOrigin)
 
 void WebPage::goForward(uint64_t backForwardItemID, const SandboxExtension::Handle& sandboxExtensionHandle)
 {
-    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
-
     HistoryItem* item = WebBackForwardListProxy::itemForID(backForwardItemID);
+    ASSERT(item);
+    if (!item)
+        return;
+
+    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_page->goToItem(item, FrameLoadTypeForward);
 }
 
 void WebPage::goBack(uint64_t backForwardItemID, const SandboxExtension::Handle& sandboxExtensionHandle)
 {
-    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
-
     HistoryItem* item = WebBackForwardListProxy::itemForID(backForwardItemID);
+    ASSERT(item);
+    if (!item)
+        return;
+
+    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_page->goToItem(item, FrameLoadTypeBack);
 }
 
 void WebPage::goToBackForwardItem(uint64_t backForwardItemID, const SandboxExtension::Handle& sandboxExtensionHandle)
 {
-    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
-
     HistoryItem* item = WebBackForwardListProxy::itemForID(backForwardItemID);
+    ASSERT(item);
+    if (!item)
+        return;
+
+    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_page->goToItem(item, FrameLoadTypeIndexedBackForward);
 }
 
@@ -603,10 +590,6 @@ void WebPage::drawRect(GraphicsContext& graphicsContext, const IntRect& rect)
     graphicsContext.clip(rect);
     m_mainFrame->coreFrame()->view()->paint(&graphicsContext, rect);
     graphicsContext.restore();
-
-    // FIXME: Remove this code once we're using the new drawing area on mac and windows.
-    if (m_pageOverlay && m_drawingArea->info().type != DrawingAreaInfo::Impl)
-        drawPageOverlay(graphicsContext, rect);
 }
 
 void WebPage::drawPageOverlay(GraphicsContext& graphicsContext, const IntRect& rect)
@@ -999,7 +982,7 @@ void WebPage::gestureEvent(const WebGestureEvent& gestureEvent)
 }
 #endif
 
-void WebPage::validateMenuItem(const String& commandName)
+void WebPage::validateCommand(const String& commandName, uint64_t callbackID)
 {
     bool isEnabled = false;
     int32_t state = 0;
@@ -1010,7 +993,7 @@ void WebPage::validateMenuItem(const String& commandName)
         isEnabled = command.isSupported() && command.isEnabled();
     }
 
-    send(Messages::WebPageProxy::DidValidateMenuItem(commandName, isEnabled, state));
+    send(Messages::WebPageProxy::ValidateCommandCallback(commandName, isEnabled, state, callbackID));
 }
 
 void WebPage::executeEditCommand(const String& commandName)
@@ -1209,18 +1192,29 @@ IntRect WebPage::windowResizerRect() const
                    m_windowResizerSize.width(), m_windowResizerSize.height());
 }
 
+KeyboardUIMode WebPage::keyboardUIMode()
+{
+    bool fullKeyboardAccessEnabled = WebProcess::shared().fullKeyboardAccessEnabled();
+    return static_cast<KeyboardUIMode>((fullKeyboardAccessEnabled ? KeyboardAccessFull : KeyboardAccessDefault) | (m_tabToLinks ? KeyboardAccessTabsToLinks : 0));
+}
+
 void WebPage::runJavaScriptInMainFrame(const String& script, uint64_t callbackID)
 {
     // NOTE: We need to be careful when running scripts that the objects we depend on don't
     // disappear during script execution.
 
+    // Retain the SerializedScriptValue at this level so it (and the internal data) lives
+    // long enough for the DataReference to be encoded by the sent message.
+    RefPtr<SerializedScriptValue> serializedResultValue;
+    CoreIPC::DataReference dataReference;
+
     JSLock lock(SilenceAssertionsOnly);
-    JSValue resultValue = m_mainFrame->coreFrame()->script()->executeScript(script, true).jsValue();
-    String resultString;
-    if (resultValue)
-        resultString = ustringToString(resultValue.toString(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec()));
+    if (JSValue resultValue = m_mainFrame->coreFrame()->script()->executeScript(script, true).jsValue()) {
+        if ((serializedResultValue = SerializedScriptValue::create(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec(), resultValue)))
+            dataReference = CoreIPC::DataReference(serializedResultValue->data().data(), serializedResultValue->data().size());
+    }
 
-    send(Messages::WebPageProxy::StringCallback(resultString, callbackID));
+    send(Messages::WebPageProxy::ScriptValueCallback(dataReference, callbackID));
 }
 
 void WebPage::getContentsAsString(uint64_t callbackID)
@@ -1291,7 +1285,7 @@ void WebPage::getWebArchiveOfFrame(uint64_t frameID, uint64_t callbackID)
 #if PLATFORM(MAC) || PLATFORM(WIN)
     RetainPtr<CFDataRef> data;
     if (WebFrame* frame = WebProcess::shared().webFrame(frameID)) {
-        if (RefPtr<LegacyWebArchive> archive = LegacyWebArchive::create(frame->coreFrame())) {
+        if (RefPtr<LegacyWebArchive> archive = LegacyWebArchive::create(frame->coreFrame()->document())) {
             if ((data = archive->rawDataRepresentation()))
                 dataReference = CoreIPC::DataReference(CFDataGetBytePtr(data.get()), CFDataGetLength(data.get()));
         }
@@ -1301,12 +1295,17 @@ void WebPage::getWebArchiveOfFrame(uint64_t frameID, uint64_t callbackID)
     send(Messages::WebPageProxy::DataCallback(dataReference, callbackID));
 }
 
-void WebPage::forceRepaint(uint64_t callbackID)
+void WebPage::forceRepaintWithoutCallback()
 {
     m_drawingArea->forceRepaint();
+}
+
+void WebPage::forceRepaint(uint64_t callbackID)
+{
+    forceRepaintWithoutCallback();
     send(Messages::WebPageProxy::VoidCallback(callbackID));
 }
-    
+
 void WebPage::preferencesDidChange(const WebPreferencesStore& store)
 {
     WebPreferencesStore::removeTestRunnerOverrides();
@@ -1363,8 +1362,10 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
 #if PLATFORM(WIN)
     // Temporarily turn off accelerated compositing until we have a good solution for rendering it.
     settings->setAcceleratedCompositingEnabled(false);
+    settings->setAcceleratedDrawingEnabled(false);
 #else
     settings->setAcceleratedCompositingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedCompositingEnabledKey()));
+    settings->setAcceleratedDrawingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedDrawingEnabledKey()));
 #endif
     settings->setShowDebugBorders(store.getBoolValueForKey(WebPreferencesKey::compositingBordersVisibleKey()));
     settings->setShowRepaintCounter(store.getBoolValueForKey(WebPreferencesKey::compositingRepaintCountersVisibleKey()));
@@ -1664,9 +1665,9 @@ void WebPage::replaceSelectionWithText(Frame* frame, const String& text)
 {
     if (frame->selection()->isNone())
         return;
-    
+
     RefPtr<DocumentFragment> textFragment = createFragmentFromText(frame->selection()->toNormalizedRange().get(), text);
-    applyCommand(ReplaceSelectionCommand::create(frame->document(), textFragment.release(), true, false, true));
+    applyCommand(ReplaceSelectionCommand::create(frame->document(), textFragment.release(), ReplaceSelectionCommand::SelectReplacement | ReplaceSelectionCommand::MatchStyle | ReplaceSelectionCommand::PreventNesting));
     frame->selection()->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
 }
 
@@ -1675,6 +1676,23 @@ bool WebPage::mainFrameHasCustomRepresentation() const
     return static_cast<WebFrameLoaderClient*>(mainFrame()->coreFrame()->loader()->client())->frameHasCustomRepresentation();
 }
 
+void WebPage::didChangeScrollOffsetForMainFrame()
+{
+    Frame* frame = m_page->mainFrame();
+    IntPoint scrollPosition = frame->view()->scrollPosition();
+    IntPoint maximumScrollPosition = frame->view()->maximumScrollPosition();
+
+    bool isPinnedToLeftSide = (scrollPosition.x() <= 0);
+    bool isPinnedToRightSide = (scrollPosition.x() >= maximumScrollPosition.x());
+
+    if (isPinnedToLeftSide != m_cachedMainFrameIsPinnedToLeftSide || isPinnedToRightSide != m_cachedMainFrameIsPinnedToRightSide) {
+        send(Messages::WebPageProxy::DidChangeScrollOffsetPinningForMainFrame(isPinnedToLeftSide, isPinnedToRightSide));
+        
+        m_cachedMainFrameIsPinnedToLeftSide = isPinnedToLeftSide;
+        m_cachedMainFrameIsPinnedToRightSide = isPinnedToRightSide;
+    }
+}
+
 #if PLATFORM(MAC)
 
 void WebPage::addPluginView(PluginView* pluginView)
@@ -1969,8 +1987,7 @@ void WebPage::computePagesForPrinting(uint64_t frameID, const PrintInfo& printIn
     send(Messages::WebPageProxy::ComputedPagesCallback(resultPageRects, resultTotalScaleFactorForPrinting, callbackID));
 }
 
-#if PLATFORM(MAC)
-// FIXME: Find a better place for Mac specific code.
+#if PLATFORM(MAC) || PLATFORM(WIN)
 void WebPage::drawRectToPDF(uint64_t frameID, const WebCore::IntRect& rect, uint64_t callbackID)
 {
     WebFrame* frame = WebProcess::shared().webFrame(frameID);
@@ -2050,4 +2067,9 @@ void WebPage::runModal()
     ASSERT(!m_isRunningModal);
 }
 
+void WebPage::setMemoryCacheMessagesEnabled(bool memoryCacheMessagesEnabled)
+{
+    m_page->setMemoryCacheClientCallsEnabled(memoryCacheMessagesEnabled);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 89087b0..8ce6405 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -46,6 +46,7 @@
 #include <WebCore/Editor.h>
 #include <WebCore/FrameLoaderTypes.h>
 #include <WebCore/IntRect.h>
+#include <WebCore/WebCoreKeyboardUIMode.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -57,6 +58,7 @@
 #endif
 
 #if PLATFORM(MAC)
+#include "DictionaryPopupInfo.h"
 #include <wtf/RetainPtr.h>
 OBJC_CLASS AccessibilityWebPageObject;
 #endif
@@ -72,6 +74,7 @@ namespace WebCore {
     class KeyboardEvent;
     class Page;
     class PrintContext;
+    class Range;
     class ResourceRequest;
     class SharedBuffer;
 }
@@ -151,7 +154,7 @@ public:
     void show();
     String userAgent() const { return m_userAgent; }
     WebCore::IntRect windowResizerRect() const;
-    bool tabsToLinks() const { return m_tabToLinks; }
+    WebCore::KeyboardUIMode keyboardUIMode();
 
     WebEditCommand* webEditCommand(uint64_t);
     void addWebEditCommand(uint64_t, WebEditCommand*);
@@ -215,7 +218,6 @@ public:
     void setDefersLoading(bool deferLoading);
 
 #if USE(ACCELERATED_COMPOSITING)
-    void changeAcceleratedCompositingMode(WebCore::GraphicsLayer*);
     void enterAcceleratedCompositingMode(WebCore::GraphicsLayer*);
     void exitAcceleratedCompositingMode();
 #endif
@@ -294,6 +296,7 @@ public:
     void getMarkedRange(uint64_t& location, uint64_t& length);
     void characterIndexForPoint(const WebCore::IntPoint point, uint64_t& result);
     void firstRectForCharacterRange(uint64_t location, uint64_t length, WebCore::IntRect& resultRect);
+    void writeSelectionToPasteboard(const WTF::String& pasteboardName, const WTF::Vector<WTF::String>& pasteboardTypes, bool& result);
 #elif PLATFORM(WIN)
     void confirmComposition(const String& compositionString);
     void setComposition(const WTF::String& compositionString, const WTF::Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition);
@@ -306,6 +309,8 @@ public:
     void dummy(bool&);
 
 #if PLATFORM(MAC)
+    void performDictionaryLookupForRange(DictionaryPopupInfo::Type, WebCore::Frame*, WebCore::Range*);
+
     bool isSpeaking();
     void speak(const String&);
     void stopSpeaking();
@@ -324,16 +329,27 @@ public:
     void beginPrinting(uint64_t frameID, const PrintInfo&);
     void endPrinting();
     void computePagesForPrinting(uint64_t frameID, const PrintInfo&, uint64_t callbackID);
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(WIN)
     void drawRectToPDF(uint64_t frameID, const WebCore::IntRect&, uint64_t callbackID);
     void drawPagesToPDF(uint64_t frameID, uint32_t first, uint32_t count, uint64_t callbackID);
 #endif
 
     bool mainFrameHasCustomRepresentation() const;
 
+    void didChangeScrollOffsetForMainFrame();
+
+    bool canRunBeforeUnloadConfirmPanel() const { return m_canRunBeforeUnloadConfirmPanel; }
+    void setCanRunBeforeUnloadConfirmPanel(bool canRunBeforeUnloadConfirmPanel) { m_canRunBeforeUnloadConfirmPanel = canRunBeforeUnloadConfirmPanel; }
+
     bool canRunModal() const { return m_canRunModal; }
+    void setCanRunModal(bool canRunModal) { m_canRunModal = canRunModal; }
+
     void runModal();
 
+    void setMemoryCacheMessagesEnabled(bool);
+
+    void forceRepaintWithoutCallback();
+
 private:
     WebPage(uint64_t pageID, const WebPageCreationParameters&);
 
@@ -369,7 +385,7 @@ private:
     void setInitialFocus(bool);
     void setWindowResizerSize(const WebCore::IntSize&);
     void setIsInWindow(bool);
-    void validateMenuItem(const String&);
+    void validateCommand(const String&, uint64_t);
     void executeEditCommand(const String&);
 
     void mouseEvent(const WebMouseEvent&);
@@ -412,6 +428,8 @@ private:
     void setCustomTextEncodingName(const String&);
 
 #if PLATFORM(MAC)
+    void performDictionaryLookupAtLocation(const WebCore::FloatPoint&);
+
     void setWindowIsVisible(bool windowIsVisible);
     void windowAndViewFramesChanged(const WebCore::IntRect& windowFrameInScreenCoordinates, const WebCore::IntRect& viewFrameInWindowCoordinates, const WebCore::IntPoint& accessibilityViewCoordinates);
 #endif
@@ -464,7 +482,7 @@ private:
     String m_userAgent;
 
     WebCore::IntSize m_viewSize;
-    RefPtr<DrawingArea> m_drawingArea;
+    OwnPtr<DrawingArea> m_drawingArea;
 
     bool m_drawsBackground;
     bool m_drawsTransparentBackground;
@@ -531,8 +549,13 @@ private:
     SandboxExtensionTracker m_sandboxExtensionTracker;
     uint64_t m_pageID;
 
+    bool m_canRunBeforeUnloadConfirmPanel;
+
     bool m_canRunModal;
     bool m_isRunningModal;
+
+    bool m_cachedMainFrameIsPinnedToLeftSide;
+    bool m_cachedMainFrameIsPinnedToRightSide;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index e47a013..0c0eea5 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -70,10 +70,13 @@ messages -> WebPage {
     GetSourceForFrame(uint64_t frameID, uint64_t callbackID)
     GetWebArchiveOfFrame(uint64_t frameID, uint64_t callbackID)
     RunJavaScriptInMainFrame(WTF::String script, uint64_t callbackID)
-
-    # FIXME: This should be a drawing area message.
     ForceRepaint(uint64_t callbackID)
 
+#if PLATFORM(MAC)
+    # Dictionary support.
+    PerformDictionaryLookupAtLocation(WebCore::FloatPoint point)
+#endif
+
     PreferencesDidChange(WebKit::WebPreferencesStore store)
 
     SetUserAgent(WTF::String userAgent)
@@ -87,7 +90,7 @@ messages -> WebPage {
     Close()
     TryClose()
 
-    ValidateMenuItem(WTF::String name)
+    ValidateCommand(WTF::String name, uint64_t callbackID)
     ExecuteEditCommand(WTF::String name)
 
     DidRemoveEditCommand(uint64_t commandID)
@@ -153,15 +156,20 @@ messages -> WebPage {
     BeginPrinting(uint64_t frameID, WebKit::PrintInfo printInfo)
     EndPrinting();
     ComputePagesForPrinting(uint64_t frameID, WebKit::PrintInfo printInfo, uint64_t callbackID)
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(WIN)
     DrawRectToPDF(uint64_t frameID, WebCore::IntRect rect, uint64_t callbackID)
     DrawPagesToPDF(uint64_t frameID, uint32_t first, uint32_t count, uint64_t callbackID)
 #endif
 
+    SetMemoryCacheMessagesEnabled(bool memoryCacheMessagesEnabled)
+
     // FIXME: This a dummy message, to avoid breaking the build for platforms that don't require
     // any synchronous messages, and should be removed when <rdar://problem/8775115> is fixed.
     Dummy() -> (bool dummyReturn)
 
+    SetCanRunBeforeUnloadConfirmPanel(bool canRunBeforeUnloadConfirmPanel)
+    SetCanRunModal(bool canRunModal)
+
 #if PLATFORM(MAC)
     # Complex text input support for plug-ins.
     SendComplexTextInputToPlugin(uint64_t pluginComplexTextInputIdentifier, String textInput)
@@ -172,6 +180,7 @@ messages -> WebPage {
     CharacterIndexForPoint(WebCore::IntPoint point) -> (uint64_t result)
     FirstRectForCharacterRange(uint64_t location, uint64_t length) -> (WebCore::IntRect resultRect)
     RegisterUIProcessAccessibilityTokens(CoreIPC::DataReference elemenToken, CoreIPC::DataReference windowToken)
+    WriteSelectionToPasteboard(WTF::String pasteboardName, WTF::Vector<WTF::String> pasteboardTypes) -> (bool result)
 #endif
 #if PLATFORM(WIN)
     ConfirmComposition(WTF::String compositionString)
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/WebInspectorGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/WebInspectorGtk.cpp
index 36bde01..e00e437 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/WebInspectorGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/WebInspectorGtk.cpp
@@ -29,11 +29,9 @@
 
 #if ENABLE(INSPECTOR)
 
+#include <WebCore/NotImplemented.h>
 #include <wtf/text/WTFString.h>
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 namespace WebKit {
 
 String WebInspector::localizedStringsURL() const
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm
deleted file mode 100644
index 25a1dfd..0000000
--- a/Source/WebKit2/WebProcess/WebPage/mac/LayerBackedDrawingAreaMac.mm
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "config.h"
-#import "LayerBackedDrawingArea.h"
-
-#if USE(ACCELERATED_COMPOSITING)
-
-#import "DrawingAreaProxyMessageKinds.h"
-#import "WebKitSystemInterface.h"
-#import "WebPage.h"
-#import "WebProcess.h"
-#import <WebCore/Frame.h>
-#import <WebCore/FrameView.h>
-#import <WebCore/GraphicsLayer.h>
-#import <WebCore/Page.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-void LayerBackedDrawingArea::platformInit()
-{
-    setUpUpdateLayoutRunLoopObserver();
-
-    [m_hostingLayer->platformLayer() setGeometryFlipped:YES];
-#if HAVE(HOSTED_CORE_ANIMATION)
-    attachCompositingContext();
-#endif
-
-    scheduleCompositingLayerSync();
-}
-
-void LayerBackedDrawingArea::platformClear()
-{
-    if (!m_attached)
-        return;
-
-    if (m_updateLayoutRunLoopObserver) {
-        CFRunLoopObserverInvalidate(m_updateLayoutRunLoopObserver.get());
-        m_updateLayoutRunLoopObserver = 0;
-    }
-
-#if HAVE(HOSTED_CORE_ANIMATION)
-    WKCARemoteLayerClientInvalidate(m_remoteLayerRef.get());
-    m_remoteLayerRef = nullptr;
-#endif
-
-    m_attached = false;
-}
-
-void LayerBackedDrawingArea::attachCompositingContext()
-{
-    if (m_attached)
-        return;
-
-    m_attached = true;
-
-#if HAVE(HOSTED_CORE_ANIMATION)
-    mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
-    m_remoteLayerRef = WKCARemoteLayerClientMakeWithServerPort(serverPort);
-    WKCARemoteLayerClientSetLayer(m_remoteLayerRef.get(), m_hostingLayer->platformLayer());
-    
-    uint32_t contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerRef.get());
-    WebProcess::shared().connection()->deprecatedSendSync(DrawingAreaProxyLegacyMessage::AttachCompositingContext, m_webPage->pageID(), CoreIPC::In(contextID), CoreIPC::Out());
-#endif
-}
-
-void LayerBackedDrawingArea::detachCompositingContext()
-{
-    m_backingLayer->removeAllChildren();
-
-    scheduleCompositingLayerSync();
-}
-
-void LayerBackedDrawingArea::setRootCompositingLayer(WebCore::GraphicsLayer* layer)
-{
-    m_backingLayer->removeAllChildren();
-    if (layer)
-        m_backingLayer->addChild(layer);
-
-    scheduleCompositingLayerSync();
-}
-
-void LayerBackedDrawingArea::scheduleCompositingLayerSync()
-{
-//    if (m_syncTimer.isActive())
-//        return;
-//
-//    m_syncTimer.startOneShot(0);
-
-    scheduleUpdateLayoutRunLoopObserver();
-}
-
-void LayerBackedDrawingArea::syncCompositingLayers()
-{
-    m_hostingLayer->syncCompositingStateForThisLayerOnly();
-    m_backingLayer->syncCompositingStateForThisLayerOnly();
-
-    bool didSync = m_webPage->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
-    if (!didSync) {
-    
-    }
-}
-
-void LayerBackedDrawingArea::setUpUpdateLayoutRunLoopObserver()
-{
-    if (m_updateLayoutRunLoopObserver)
-        return;
-
-    // Run before Core Animations commit observer, which has order 2000000.
-    const CFIndex runLoopOrder = 2000000 - 1;
-    CFRunLoopObserverContext context = { 0, this, 0, 0, 0 };
-    m_updateLayoutRunLoopObserver.adoptCF(CFRunLoopObserverCreate(0,
-        kCFRunLoopBeforeWaiting | kCFRunLoopExit, true /* repeats */,
-        runLoopOrder, updateLayoutRunLoopObserverCallback, &context));
-}
-
-void LayerBackedDrawingArea::scheduleUpdateLayoutRunLoopObserver()
-{
-    CFRunLoopRef currentRunLoop = CFRunLoopGetCurrent();
-    CFRunLoopWakeUp(currentRunLoop);
-
-    if (CFRunLoopContainsObserver(currentRunLoop, m_updateLayoutRunLoopObserver.get(), kCFRunLoopCommonModes))
-        return;
-
-    CFRunLoopAddObserver(currentRunLoop, m_updateLayoutRunLoopObserver.get(), kCFRunLoopCommonModes);
-}
-
-void LayerBackedDrawingArea::removeUpdateLayoutRunLoopObserver()
-{
-    // FIXME: cache the run loop ref?
-    CFRunLoopRemoveObserver(CFRunLoopGetCurrent(), m_updateLayoutRunLoopObserver.get(), kCFRunLoopCommonModes);
-}
-
-void LayerBackedDrawingArea::updateLayoutRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void* info)
-{
-    // Keep the drawing area alive while running the callback, since that does layout,
-    // which might replace this drawing area with one of another type.
-    RefPtr<LayerBackedDrawingArea> drawingArea = reinterpret_cast<LayerBackedDrawingArea*>(info);
-    drawingArea->updateLayoutRunLoopObserverFired();
-}
-
-void LayerBackedDrawingArea::updateLayoutRunLoopObserverFired()
-{
-    // Laying out the page can cause the drawing area to change so we keep an extra reference.
-    RefPtr<LayerBackedDrawingArea> protect(this);
-
-    m_webPage->layoutIfNeeded();
-
-    if (m_webPage->drawingArea() != this)
-        return;
-    
-    if (m_attached)
-        syncCompositingLayers();
-}
-
-void LayerBackedDrawingArea::onPageClose()
-{
-    platformClear();
-}
-
-} // namespace WebKit
-
-#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h b/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h
index 016f0d6..d05e43e 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h
+++ b/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h
@@ -47,12 +47,14 @@ private:
     // LayerTreeHost.
     virtual const LayerTreeContext& layerTreeContext();
     virtual void scheduleLayerFlush();
+    virtual void setShouldNotifyAfterNextScheduledLayerFlush(bool);
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*);
     virtual void invalidate();
 
     virtual void setNonCompositedContentsNeedDisplay(const WebCore::IntRect&);
     virtual void scrollNonCompositedContents(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
     virtual void sizeDidChange(const WebCore::IntSize& newSize);
+    virtual void forceRepaint();
 
     virtual void didInstallPageOverlay();
     virtual void didUninstallPageOverlay();
@@ -78,6 +80,10 @@ private:
     // Whether the layer tree host is valid or not.
     bool m_isValid;    
 
+    // Whether we should let the drawing area know the next time we've flushed
+    // layer tree changes.
+    bool m_notifyAfterScheduledLayerFlush;
+    
     // The root layer.
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
 
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm
index 9734aec..494f5e6 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "LayerTreeHostMac.h"
 
+#import "DrawingAreaImpl.h"
 #import "WebPage.h"
 #import "WebProcess.h"
 #import <QuartzCore/CATransaction.h>
@@ -51,6 +52,7 @@ PassRefPtr<LayerTreeHostMac> LayerTreeHostMac::create(WebPage* webPage)
 LayerTreeHostMac::LayerTreeHostMac(WebPage* webPage)
     : LayerTreeHost(webPage)
     , m_isValid(true)
+    , m_notifyAfterScheduledLayerFlush(false)
 {
     mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
     m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
@@ -72,6 +74,8 @@ LayerTreeHostMac::LayerTreeHostMac(WebPage* webPage)
     m_nonCompositedContentLayer->setDrawsContent(true);
     m_nonCompositedContentLayer->setContentsOpaque(m_webPage->drawsBackground() && !m_webPage->drawsTransparentBackground());
     m_nonCompositedContentLayer->setSize(webPage->size());
+    if (m_webPage->corePage()->settings()->acceleratedDrawingEnabled())
+        m_nonCompositedContentLayer->setAcceleratesDrawing(true);
 
     m_rootLayer->addChild(m_nonCompositedContentLayer.get());
 
@@ -116,14 +120,18 @@ void LayerTreeHostMac::scheduleLayerFlush()
     CFRunLoopAddObserver(currentRunLoop, m_flushPendingLayerChangesRunLoopObserver.get(), kCFRunLoopCommonModes);
 }
 
-void LayerTreeHostMac::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
+void LayerTreeHostMac::setShouldNotifyAfterNextScheduledLayerFlush(bool notifyAfterScheduledLayerFlush)
 {
-    ASSERT(graphicsLayer);
+    m_notifyAfterScheduledLayerFlush = notifyAfterScheduledLayerFlush;
+}
 
+void LayerTreeHostMac::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
+{
     m_nonCompositedContentLayer->removeAllChildren();
 
     // Add the accelerated layer tree hierarchy.
-    m_nonCompositedContentLayer->addChild(graphicsLayer);
+    if (graphicsLayer)
+        m_nonCompositedContentLayer->addChild(graphicsLayer);
 }
 
 void LayerTreeHostMac::invalidate()
@@ -170,6 +178,15 @@ void LayerTreeHostMac::sizeDidChange(const IntSize& newSize)
     [CATransaction synchronize];
 }
 
+void LayerTreeHostMac::forceRepaint()
+{
+    scheduleLayerFlush();
+    flushPendingLayerChanges();
+
+    [CATransaction flush];
+    [CATransaction synchronize];
+}    
+
 void LayerTreeHostMac::didInstallPageOverlay()
 {
     createPageOverlayLayer();
@@ -242,6 +259,12 @@ void LayerTreeHostMac::flushPendingLayerChangesRunLoopObserverCallback()
     ASSERT(m_flushPendingLayerChangesRunLoopObserver);
     CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
     m_flushPendingLayerChangesRunLoopObserver = 0;
+
+    if (m_notifyAfterScheduledLayerFlush) {
+        // Let the drawing area know that we've done a flush of the layer changes.
+        static_cast<DrawingAreaImpl*>(m_webPage->drawingArea())->layerHostDidFlushLayers();
+        m_notifyAfterScheduledLayerFlush = false;
+    }
 }
 
 bool LayerTreeHostMac::flushPendingLayerChanges()
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index 71bbf78..4cae5aa 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -42,6 +42,7 @@
 #import <WebCore/KeyboardEvent.h>
 #import <WebCore/Page.h>
 #import <WebCore/PlatformKeyboardEvent.h>
+#import <WebCore/ResourceHandle.h>
 #import <WebCore/ScrollView.h>
 #import <WebCore/TextIterator.h>
 #import <WebCore/WindowsKeyboardCodes.h>
@@ -163,29 +164,29 @@ void WebPage::getMarkedRange(uint64_t& location, uint64_t& length)
     getLocationAndLengthFromRange(frame->editor()->compositionRange().get(), location, length);
 }
 
-static Range *characterRangeAtPoint(Frame* frame, const IntPoint point)
+static PassRefPtr<Range> characterRangeAtPoint(Frame* frame, const IntPoint& point)
 {
     VisiblePosition position = frame->visiblePositionForPoint(point);
     if (position.isNull())
-        return NULL;
+        return 0;
     
     VisiblePosition previous = position.previous();
     if (previous.isNotNull()) {
-        Range *previousCharacterRange = makeRange(previous, position).get();
-        NSRect rect = frame->editor()->firstRectForRange(previousCharacterRange);
-        if (NSPointInRect(point, rect))
-            return previousCharacterRange;
+        RefPtr<Range> previousCharacterRange = makeRange(previous, position);
+        IntRect rect = frame->editor()->firstRectForRange(previousCharacterRange.get());
+        if (rect.contains(point))
+            return previousCharacterRange.release();
     }
     
     VisiblePosition next = position.next();
     if (next.isNotNull()) {
-        Range *nextCharacterRange = makeRange(position, next).get();
-        NSRect rect = frame->editor()->firstRectForRange(nextCharacterRange);
-        if (NSPointInRect(point, rect))
-            return nextCharacterRange;
+        RefPtr<Range> nextCharacterRange = makeRange(position, next);
+        IntRect rect = frame->editor()->firstRectForRange(nextCharacterRange.get());
+        if (rect.contains(point))
+            return nextCharacterRange.release();
     }
     
-    return NULL;
+    return 0;
 }
     
 void WebPage::characterIndexForPoint(IntPoint point, uint64_t& index)
@@ -198,12 +199,12 @@ void WebPage::characterIndexForPoint(IntPoint point, uint64_t& index)
     HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(point, false);
     frame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : m_page->focusController()->focusedOrMainFrame();
     
-    Range *range = characterRangeAtPoint(frame, result.point());
+    RefPtr<Range> range = characterRangeAtPoint(frame, result.point());
     if (!range)
         return;
 
     uint64_t length;
-    getLocationAndLengthFromRange(range, index, length);
+    getLocationAndLengthFromRange(range.get(), index, length);
 }
 
 static PassRefPtr<Range> convertToRange(Frame* frame, NSRange nsrange)
@@ -241,6 +242,84 @@ void WebPage::firstRectForCharacterRange(uint64_t location, uint64_t length, Web
     resultRect = frame->view()->contentsToWindow(rect);
 }
 
+void WebPage::performDictionaryLookupAtLocation(const FloatPoint& floatPoint)
+{
+    Frame* frame = m_page->mainFrame();
+    if (!frame)
+        return;
+
+    // Find the frame the point is over.
+    IntPoint point = roundedIntPoint(floatPoint);
+
+    HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(point, false);
+    frame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : m_page->focusController()->focusedOrMainFrame();
+
+    // Figure out if there are any characters under the point.
+    RefPtr<Range> characterRange = characterRangeAtPoint(frame, frame->view()->windowToContents(point));
+    if (!characterRange)
+        return;
+
+    // Grab the currently selected text.
+    RefPtr<Range> selectedRange = m_page->focusController()->focusedOrMainFrame()->selection()->selection().toNormalizedRange();
+
+    // Use the selected text if the point was anywhere in it. Assertain this by seeing if either character range
+    // the mouse is over is contained by the selection range.
+    if (characterRange && selectedRange) {
+        ExceptionCode ec = 0;
+        selectedRange->compareBoundaryPoints(Range::START_TO_START, characterRange.get(), ec);
+        if (!ec) {
+            if (selectedRange->isPointInRange(characterRange->startContainer(), characterRange->startOffset(), ec)) {
+                if (!ec)
+                    characterRange = selectedRange;
+            }
+        }
+    }
+
+    if (!characterRange)
+        return;
+
+    // Ensure we have whole words.
+    VisibleSelection selection(characterRange.get());
+    selection.expandUsingGranularity(WordGranularity);
+
+    RefPtr<Range> finalRange = selection.toNormalizedRange();
+    if (!finalRange)
+        return;
+
+    performDictionaryLookupForRange(DictionaryPopupInfo::HotKey, frame, finalRange.get());
+}
+
+void WebPage::performDictionaryLookupForRange(DictionaryPopupInfo::Type type, Frame* frame, Range* range)
+{
+    String rangeText = range->text();
+    if (rangeText.stripWhiteSpace().isEmpty())
+        return;
+    
+    RenderObject* renderer = range->startContainer()->renderer();
+    RenderStyle* style = renderer->style();
+    NSFont *font = style->font().primaryFont()->getNSFont();
+    if (!font)
+        return;
+    
+    CFDictionaryRef fontDescriptorAttributes = (CFDictionaryRef)[[font fontDescriptor] fontAttributes];
+    if (!fontDescriptorAttributes)
+        return;
+
+    Vector<FloatQuad> quads;
+    range->textQuads(quads);
+    if (quads.isEmpty())
+        return;
+    
+    IntRect rangeRect = frame->view()->contentsToWindow(quads[0].enclosingBoundingBox());
+    
+    DictionaryPopupInfo dictionaryPopupInfo;
+    dictionaryPopupInfo.type = type;
+    dictionaryPopupInfo.origin = FloatPoint(rangeRect.x(), rangeRect.y());
+    dictionaryPopupInfo.fontInfo.fontAttributeDictionary = fontDescriptorAttributes;
+
+    send(Messages::WebPageProxy::DidPerformDictionaryLookup(rangeText, dictionaryPopupInfo));
+}
+
 static inline void scroll(Page* page, ScrollDirection direction, ScrollGranularity granularity)
 {
     page->focusController()->focusedOrMainFrame()->eventHandler()->scrollRecursively(direction, granularity);
@@ -349,6 +428,13 @@ void WebPage::registerUIProcessAccessibilityTokens(const CoreIPC::DataReference&
 #endif
 }
 
+void WebPage::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes, bool& result)
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    frame->editor()->writeSelectionToPasteboard(pasteboardName, pasteboardTypes);
+    result = true;
+}
+
 AccessibilityWebPageObject* WebPage::accessibilityRemoteObject()
 {
     return m_mockAccessibilityElement.get();
@@ -358,7 +444,13 @@ bool WebPage::platformHasLocalDataForURL(const WebCore::KURL& url)
 {
     NSMutableURLRequest* request = [[NSMutableURLRequest alloc] initWithURL:url];
     [request setValue:(NSString*)userAgent() forHTTPHeaderField:@"User-Agent"];
-    NSCachedURLResponse *cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
+    NSCachedURLResponse *cachedResponse;
+#if USE(CFURLSTORAGESESSIONS)
+    if (CFURLStorageSessionRef storageSession = ResourceHandle::privateBrowsingStorageSession())
+        cachedResponse = WKCachedResponseForRequest(storageSession, request);
+    else
+#endif
+        cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
     [request release];
     
     return cachedResponse;
@@ -368,7 +460,13 @@ String WebPage::cachedResponseMIMETypeForURL(const WebCore::KURL& url)
 {
     NSMutableURLRequest* request = [[NSMutableURLRequest alloc] initWithURL:url];
     [request setValue:(NSString*)userAgent() forHTTPHeaderField:@"User-Agent"];
-    NSCachedURLResponse *cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
+    NSCachedURLResponse *cachedResponse;
+#if USE(CFURLSTORAGESESSIONS)
+    if (CFURLStorageSessionRef storageSession = ResourceHandle::privateBrowsingStorageSession())
+        cachedResponse = WKCachedResponseForRequest(storageSession, request);
+    else
+#endif
+        cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
     [request release];
     
     return [[cachedResponse response] MIMEType];
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/WebInspectorQt.cpp b/Source/WebKit2/WebProcess/WebPage/qt/WebInspectorQt.cpp
index 1675d77..1a3b598 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/WebInspectorQt.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/qt/WebInspectorQt.cpp
@@ -28,11 +28,9 @@
 
 #if ENABLE(INSPECTOR)
 
+#include <WebCore/NotImplemented.h>
 #include <wtf/text/WTFString.h>
 
-#define DISABLE_NOT_IMPLEMENTED_WARNINGS 1
-#include "NotImplemented.h"
-
 namespace WebKit {
 
 String WebInspector::localizedStringsURL() const
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebInspectorWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebInspectorWin.cpp
index 3ae0dae..5ada45d 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebInspectorWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebInspectorWin.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "WebKitBundle.h"
 #include <wtf/RetainPtr.h>
 #include <wtf/text/WTFString.h>
 
@@ -35,7 +36,7 @@ namespace WebKit {
 
 String WebInspector::localizedStringsURL() const
 {
-    RetainPtr<CFURLRef> localizedStringsURLRef(AdoptCF, CFBundleCopyResourceURL(CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebKit")), CFSTR("localizedStrings"), CFSTR("js"), 0));
+    RetainPtr<CFURLRef> localizedStringsURLRef(AdoptCF, CFBundleCopyResourceURL(webKitBundle(), CFSTR("localizedStrings"), CFSTR("js"), 0));
     if (!localizedStringsURLRef)
         return String();
 
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
index e20af3a..73ba2b2 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
@@ -36,6 +36,7 @@
 #include <WebCore/KeyboardEvent.h>
 #include <WebCore/Page.h>
 #include <WebCore/PlatformKeyboardEvent.h>
+#include <WebCore/ResourceHandle.h>
 #include <WebCore/Settings.h>
 #if PLATFORM(CG)
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
@@ -253,7 +254,13 @@ bool WebPage::platformHasLocalDataForURL(const WebCore::KURL& url)
     RetainPtr<CFStringRef> userAgent(AdoptCF, userAgent().createCFString());
     CFURLRequestSetHTTPHeaderFieldValue(request.get(), CFSTR("User-Agent"), userAgent.get());
 
-    RetainPtr<CFURLCacheRef> cache(AdoptCF, CFURLCacheCopySharedURLCache());
+    RetainPtr<CFURLCacheRef> cache;
+#if USE(CFURLSTORAGESESSIONS)
+    if (CFURLStorageSessionRef storageSession = ResourceHandle::privateBrowsingStorageSession())
+        cache.adoptCF(wkCopyURLCache(storageSession));
+    else
+#endif
+        cache.adoptCF(CFURLCacheCopySharedURLCache());
 
     RetainPtr<CFCachedURLResponseRef> response(AdoptCF, CFURLCacheCopyResponseForRequest(cache.get(), request.get()));    
     return response;
@@ -271,7 +278,13 @@ String WebPage::cachedResponseMIMETypeForURL(const WebCore::KURL& url)
     RetainPtr<CFStringRef> userAgent(AdoptCF, userAgent().createCFString());
     CFURLRequestSetHTTPHeaderFieldValue(request.get(), CFSTR("User-Agent"), userAgent.get());
 
-    RetainPtr<CFURLCacheRef> cache(AdoptCF, CFURLCacheCopySharedURLCache());
+    RetainPtr<CFURLCacheRef> cache;
+#if USE(CFURLSTORAGESESSIONS)
+    if (CFURLStorageSessionRef storageSession = ResourceHandle::privateBrowsingStorageSession())
+        cache.adoptCF(wkCopyURLCache(storageSession));
+    else
+#endif
+        cache.adoptCF(CFURLCacheCopySharedURLCache());
 
     RetainPtr<CFCachedURLResponseRef> cachedResponse(AdoptCF, CFURLCacheCopyResponseForRequest(cache.get(), request.get()));
     
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 97faec4..6de748f 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -33,11 +33,14 @@
 #include "InjectedBundleUserMessageCoders.h"
 #include "RunLoop.h"
 #include "SandboxExtension.h"
+#include "WebApplicationCacheManager.h"
 #include "WebContextMessages.h"
+#include "WebCookieManager.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebDatabaseManager.h"
 #include "WebFrame.h"
 #include "WebGeolocationManagerMessages.h"
+#include "WebKeyValueStorageManager.h"
 #include "WebMemorySampler.h"
 #include "WebPage.h"
 #include "WebPageCreationParameters.h"
@@ -46,12 +49,16 @@
 #include "WebProcessCreationParameters.h"
 #include "WebProcessMessages.h"
 #include "WebProcessProxyMessages.h"
+#include "WebResourceCacheManager.h"
 #include <WebCore/ApplicationCacheStorage.h>
 #include <WebCore/CrossOriginPreflightResultCache.h>
 #include <WebCore/Font.h>
 #include <WebCore/Language.h>
+#include <WebCore/Logging.h>
+#include <WebCore/MemoryCache.h>
 #include <WebCore/Page.h>
 #include <WebCore/PageGroup.h>
+#include <WebCore/ResourceHandle.h>
 #include <WebCore/SchemeRegistry.h>
 #include <WebCore/SecurityOrigin.h>
 #include <WebCore/Settings.h>
@@ -67,6 +74,10 @@
 #include <unistd.h>
 #endif
 
+#if !ENABLE(PLUGIN_PROCESS)
+#include "NetscapePluginModule.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -120,6 +131,8 @@ WebProcess::WebProcess()
     // Initialize our platform strategies.
     WebPlatformStrategies::initialize();
 #endif // USE(PLATFORM_STRATEGIES)
+
+    WebCore::InitializeLoggingChannelsIfNecessary();
 }
 
 void WebProcess::initialize(CoreIPC::Connection::Identifier serverIdentifier, RunLoop* runLoop)
@@ -184,6 +197,8 @@ void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parame
     for (size_t i = 0; i < parameters.urlSchemesForWhichDomainRelaxationIsForbidden.size(); ++i)
         setDomainRelaxationForbiddenForURLScheme(parameters.urlSchemesForWhichDomainRelaxationIsForbidden[i]);
 
+    setDefaultRequestTimeoutInterval(parameters.defaultRequestTimeoutInterval);
+
     for (size_t i = 0; i < parameters.mimeTypesWithCustomRepresentation.size(); ++i)
         m_mimeTypesWithCustomRepresentations.add(parameters.mimeTypesWithCustomRepresentation[i]);
 
@@ -198,6 +213,10 @@ void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parame
 
     if (parameters.shouldAlwaysUseComplexTextCodePath)
         setAlwaysUsesComplexTextCodePath(true);
+
+#if USE(CFURLSTORAGESESSIONS)
+    WebCore::ResourceHandle::setPrivateBrowsingStorageSessionIdentifierBase(parameters.uiProcessBundleIdentifier);
+#endif
 }
 
 void WebProcess::setShouldTrackVisitedLinks(bool shouldTrackVisitedLinks)
@@ -220,9 +239,14 @@ void WebProcess::setDomainRelaxationForbiddenForURLScheme(const String& urlSchem
     SecurityOrigin::setDomainRelaxationForbiddenForURLScheme(true, urlScheme);
 }
 
+void WebProcess::setDefaultRequestTimeoutInterval(double timeoutInterval)
+{
+    ResourceRequest::setDefaultTimeoutInterval(timeoutInterval);
+}
+
 void WebProcess::setAlwaysUsesComplexTextCodePath(bool alwaysUseComplexText)
 {
-    Font::setCodePath(alwaysUseComplexText ? Font::Complex : Font::Auto);
+    WebCore::Font::setCodePath(alwaysUseComplexText ? WebCore::Font::Complex : WebCore::Font::Auto);
 }
 
 void WebProcess::languageChanged(const String& language) const
@@ -267,6 +291,13 @@ void WebProcess::addVisitedLink(WebCore::LinkHash linkHash)
     m_connection->send(Messages::WebContext::AddVisitedLinkHash(linkHash), 0);
 }
 
+#if !PLATFORM(MAC)
+bool WebProcess::fullKeyboardAccessEnabled()
+{
+    return false;
+}
+#endif
+
 void WebProcess::setCacheModel(uint32_t cm)
 {
     CacheModel cacheModel = static_cast<CacheModel>(cm);
@@ -443,8 +474,7 @@ void WebProcess::createWebPage(uint64_t pageID, const WebPageCreationParameters&
 void WebProcess::removeWebPage(uint64_t pageID)
 {
     m_pageMap.remove(pageID);
-
-    shutdownIfPossible();
+    terminateIfPossible();
 }
 
 bool WebProcess::isSeparateProcess() const
@@ -453,7 +483,7 @@ bool WebProcess::isSeparateProcess() const
     return m_runLoop == RunLoop::main();
 }
  
-void WebProcess::shutdownIfPossible()
+void WebProcess::terminateIfPossible()
 {
     if (!m_pageMap.isEmpty())
         return;
@@ -468,7 +498,13 @@ void WebProcess::shutdownIfPossible()
     if (!isSeparateProcess())
         return;
 
-    // Actually shut down the process.
+    // FIXME: the ShouldTerminate message should also send termination parameters, such as any session cookies that need to be preserved.
+    bool shouldTerminate = false;
+    if (m_connection->sendSync(Messages::WebProcessProxy::ShouldTerminate(), Messages::WebProcessProxy::ShouldTerminate::Reply(shouldTerminate), 0)
+        && !shouldTerminate)
+        return;
+
+    // Actually terminate the process.
 
 #ifndef NDEBUG
     gcController().garbageCollectNow();
@@ -479,8 +515,7 @@ void WebProcess::shutdownIfPossible()
     m_connection->invalidate();
     m_connection = nullptr;
 
-    platformShutdown();
-
+    platformTerminate();
     m_runLoop->stop();
 }
 
@@ -510,6 +545,16 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+    if (messageID.is<CoreIPC::MessageClassWebApplicationCacheManager>()) {
+        WebApplicationCacheManager::shared().didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
+    if (messageID.is<CoreIPC::MessageClassWebCookieManager>()) {
+        WebCookieManager::shared().didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
     if (messageID.is<CoreIPC::MessageClassWebDatabaseManager>()) {
         WebDatabaseManager::shared().didReceiveMessage(connection, messageID, arguments);
         return;
@@ -520,6 +565,16 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+    if (messageID.is<CoreIPC::MessageClassWebKeyValueStorageManager>()) {
+        WebKeyValueStorageManager::shared().didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
+    if (messageID.is<CoreIPC::MessageClassWebResourceCacheManager>()) {
+        WebResourceCacheManager::shared().didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
     if (messageID.is<CoreIPC::MessageClassInjectedBundle>()) {
         if (!m_injectedBundle)
             return;
@@ -623,6 +678,8 @@ void WebProcess::clearResourceCaches()
     setCacheModel(CacheModelDocumentViewer);
     setCacheModel(cacheModel);
 
+    memoryCache()->evictResources();
+
     // Empty the cross-origin preflight cache.
     CrossOriginPreflightResultCache::shared().empty();
 }
@@ -635,6 +692,50 @@ void WebProcess::clearApplicationCache()
 #endif
 }
 
+#if !ENABLE(PLUGIN_PROCESS)
+void WebProcess::getSitesWithPluginData(const Vector<String>& pluginPaths, uint64_t callbackID)
+{
+    HashSet<String> sitesSet;
+
+    for (size_t i = 0; i < pluginPaths.size(); ++i) {
+        RefPtr<NetscapePluginModule> netscapePluginModule = NetscapePluginModule::getOrCreate(pluginPaths[i]);
+        if (!netscapePluginModule)
+            continue;
+
+        Vector<String> sites = netscapePluginModule->sitesWithData();
+        for (size_t i = 0; i < sites.size(); ++i)
+            sitesSet.add(sites[i]);
+    }
+
+    Vector<String> sites;
+    copyToVector(sitesSet, sites);
+
+    m_connection->send(Messages::WebContext::DidGetSitesWithPluginData(sites, callbackID), 0);
+    terminateIfPossible();
+}
+
+void WebProcess::clearPluginSiteData(const Vector<String>& pluginPaths, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
+{
+    for (size_t i = 0; i < pluginPaths.size(); ++i) {
+        RefPtr<NetscapePluginModule> netscapePluginModule = NetscapePluginModule::getOrCreate(pluginPaths[i]);
+        if (!netscapePluginModule)
+            continue;
+
+        if (sites.isEmpty()) {
+            // Clear everything.
+            netscapePluginModule->clearSiteData(String(), flags, maxAgeInSeconds);
+            continue;
+        }
+
+        for (size_t i = 0; i < sites.size(); ++i)
+            netscapePluginModule->clearSiteData(sites[i], flags, maxAgeInSeconds);
+    }
+
+    m_connection->send(Messages::WebContext::DidClearPluginSiteData(callbackID), 0);
+    terminateIfPossible();
+}
+#endif
+
 void WebProcess::downloadRequest(uint64_t downloadID, uint64_t initiatingPageID, const ResourceRequest& request)
 {
     WebPage* initiatingPage = initiatingPageID ? webPage(initiatingPageID) : 0;
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index 993cf38..946bb69 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -88,6 +88,8 @@ public:
     void addVisitedLink(WebCore::LinkHash);
     bool isLinkVisited(WebCore::LinkHash) const;
 
+    bool fullKeyboardAccessEnabled();
+
     WebFrame* webFrame(uint64_t) const;
     void addWebFrame(uint64_t, WebFrame*);
     void removeWebFrame(uint64_t);
@@ -103,8 +105,8 @@ public:
     QNetworkAccessManager* networkAccessManager() { return m_networkAccessManager; }
 #endif
 
-    // Will shut down the web process if there are no live pages or downloads.
-    void shutdownIfPossible();
+    // Will terminate the web process if there are no live pages or downloads.
+    void terminateIfPossible();
 
     bool shouldUseCustomRepresentationForMIMEType(const String& mimeType) const { return m_mimeTypesWithCustomRepresentations.contains(mimeType); }
 
@@ -114,16 +116,19 @@ public:
     // Geolocation
     WebGeolocationManager& geolocationManager() { return m_geolocationManager; }
 
+    void clearResourceCaches();
+
 private:
     WebProcess();
 
     void initializeWebProcess(const WebProcessCreationParameters&, CoreIPC::ArgumentDecoder*);
     void platformInitializeWebProcess(const WebProcessCreationParameters&, CoreIPC::ArgumentDecoder*);
-    void platformShutdown();
+    void platformTerminate();
     void setShouldTrackVisitedLinks(bool);
     void registerURLSchemeAsEmptyDocument(const String&);
     void registerURLSchemeAsSecure(const String&) const;
     void setDomainRelaxationForbiddenForURLScheme(const String&) const;
+    void setDefaultRequestTimeoutInterval(double);
     void setAlwaysUsesComplexTextCodePath(bool);
     void languageChanged(const String&) const;
 #if PLATFORM(WIN)
@@ -139,10 +144,14 @@ private:
     static void calculateCacheSizes(CacheModel cacheModel, uint64_t memorySize, uint64_t diskFreeSize,
         unsigned& cacheTotalCapacity, unsigned& cacheMinDeadCapacity, unsigned& cacheMaxDeadCapacity, double& deadDecodedDataDeletionInterval,
         unsigned& pageCacheCapacity, unsigned long& urlCacheMemoryCapacity, unsigned long& urlCacheDiskCapacity);
-    void clearResourceCaches();
     void platformClearResourceCaches();
     void clearApplicationCache();
 
+#if !ENABLE(PLUGIN_PROCESS)
+    void getSitesWithPluginData(const Vector<String>& pluginPaths, uint64_t callbackID);
+    void clearPluginSiteData(const Vector<String>& pluginPaths, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID);
+#endif
+    
     void startMemorySampler(const SandboxExtension::Handle&, const String&, const double);
     void stopMemorySampler();
 
diff --git a/Source/WebKit2/WebProcess/WebProcess.messages.in b/Source/WebKit2/WebProcess/WebProcess.messages.in
index 2ea9237..e297179 100644
--- a/Source/WebKit2/WebProcess/WebProcess.messages.in
+++ b/Source/WebKit2/WebProcess/WebProcess.messages.in
@@ -38,12 +38,19 @@ messages -> WebProcess {
     RegisterURLSchemeAsEmptyDocument(WTF::String scheme)
     RegisterURLSchemeAsSecure(WTF::String scheme)
     SetDomainRelaxationForbiddenForURLScheme(WTF::String scheme)
+    SetDefaultRequestTimeoutInterval(double timeoutInterval)
     SetAlwaysUsesComplexTextCodePath(bool alwaysUseComplexText)
     LanguageChanged(WTF::String language)
 #if PLATFORM(WIN)
     SetShouldPaintNativeControls(bool shouldPaintNativeControls)
 #endif
 
+#if !ENABLE(PLUGIN_PROCESS)
+    # Plug-ins.
+    GetSitesWithPluginData(Vector<WTF::String> pluginPaths, uint64_t callbackID)
+    ClearPluginSiteData(Vector<WTF::String> pluginPaths, Vector<WTF::String> sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
+#endif
+
     ClearResourceCaches();
     ClearApplicationCache();
     
diff --git a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
index 5d81971..07c1f52 100644
--- a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
+++ b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
@@ -87,6 +87,7 @@
 ;; Various services required by AppKit and other frameworks
 (allow mach-lookup
    (global-name "com.apple.CoreServices.coreservicesd")
+   (global-name "com.apple.CFPasteboardClient")
    (global-name "com.apple.DiskArbitration.diskarbitrationd")
    (global-name "com.apple.FileCoordination")
    (global-name "com.apple.FontObjectsServer")
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp
index 43e9776..0deed68 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "WebProcess.h"
 
-#include "NotImplemented.h"
 #include "WebProcessCreationParameters.h"
+#include <WebCore/NotImplemented.h>
 
 namespace WebKit {
 
@@ -47,7 +47,7 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     notImplemented();
 }
 
-void WebProcess::platformShutdown()
+void WebProcess::platformTerminate()
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/mac/FullKeyboardAccessWatcher.h b/Source/WebKit2/WebProcess/mac/FullKeyboardAccessWatcher.h
new file mode 100644
index 0000000..d6212b2
--- /dev/null
+++ b/Source/WebKit2/WebProcess/mac/FullKeyboardAccessWatcher.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FullKeyboardAccessWatcher_h
+#define FullKeyboardAccessWatcher_h
+
+#import <Cocoa/Cocoa.h>
+
+@interface FullKeyboardAccessWatcher : NSObject {
+@private
+    BOOL fullKeyboardAccessEnabled;
+}
+
++ (BOOL)fullKeyboardAccessEnabled;
+
+@end;
+
+#endif // FullKeyboardAccessWatcher_h
diff --git a/Source/WebKit2/WebProcess/mac/FullKeyboardAccessWatcher.mm b/Source/WebKit2/WebProcess/mac/FullKeyboardAccessWatcher.mm
new file mode 100644
index 0000000..db19e95
--- /dev/null
+++ b/Source/WebKit2/WebProcess/mac/FullKeyboardAccessWatcher.mm
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "FullKeyboardAccessWatcher.h"
+
+NSString * const KeyboardUIModeDidChangeNotification = @"com.apple.KeyboardUIModeDidChange";
+const CFStringRef AppleKeyboardUIMode = CFSTR("AppleKeyboardUIMode");
+const CFStringRef UniversalAccessDomain = CFSTR("com.apple.universalaccess");
+
+@implementation FullKeyboardAccessWatcher
+
+- (void)retrieveKeyboardUIModeFromPreferences:(NSNotification *)notification
+{
+    CFPreferencesAppSynchronize(UniversalAccessDomain);
+
+    Boolean keyExistsAndHasValidFormat;
+    int mode = CFPreferencesGetAppIntegerValue(AppleKeyboardUIMode, UniversalAccessDomain, &keyExistsAndHasValidFormat);
+    if (keyExistsAndHasValidFormat) {
+        // The keyboard access mode is reported by two bits:
+        // Bit 0 is set if feature is on
+        // Bit 1 is set if full keyboard access works for any control, not just text boxes and lists.
+        fullKeyboardAccessEnabled = (mode & 0x2);
+    }
+}
+
+- (id)init
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    [self retrieveKeyboardUIModeFromPreferences:nil];
+
+    [[NSDistributedNotificationCenter defaultCenter] 
+        addObserver:self selector:@selector(retrieveKeyboardUIModeFromPreferences:) 
+        name:KeyboardUIModeDidChangeNotification object:nil];
+
+    return self;
+}
+
++ (BOOL)fullKeyboardAccessEnabled
+{
+    static FullKeyboardAccessWatcher *watcher = [[FullKeyboardAccessWatcher alloc] init];
+    return watcher->fullKeyboardAccessEnabled;
+}
+
+@end
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
index fc06d2c..92b36b8 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "WebProcess.h"
 
+#import "FullKeyboardAccessWatcher.h"
 #import "SandboxExtension.h"
 #import "WebProcessCreationParameters.h"
 #import <WebCore/MemoryCache.h>
@@ -110,6 +111,11 @@ void WebProcess::platformClearResourceCaches()
     [[NSURLCache sharedURLCache] removeAllCachedResponses];
 }
 
+bool WebProcess::fullKeyboardAccessEnabled()
+{
+    return [FullKeyboardAccessWatcher fullKeyboardAccessEnabled];
+}
+
 #if ENABLE(WEB_PROCESS_SANDBOX)
 static void appendSandboxParameterPath(Vector<const char*>& vector, const char* name, const char* path)
 {
@@ -179,7 +185,7 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
         NSUInteger cacheMemoryCapacity = parameters.nsURLCacheMemoryCapacity;
         NSUInteger cacheDiskCapacity = parameters.nsURLCacheDiskCapacity;
 
-        NSString *nsCachePath = [[NSFileManager defaultManager] stringWithFileSystemRepresentation:parameters.nsURLCachePath.data() length:parameters.nsURLCachePath.length()];
+        NSString *nsCachePath = [[NSFileManager defaultManager] stringWithFileSystemRepresentation:parameters.nsURLCachePath.data() length:strlen(parameters.nsURLCachePath.data())];
         RetainPtr<NSURLCache> parentProcessURLCache(AdoptNS, [[NSURLCache alloc] initWithMemoryCapacity:cacheMemoryCapacity diskCapacity:cacheDiskCapacity diskPath:nsCachePath]);
         [NSURLCache setSharedURLCache:parentProcessURLCache.get()];
     }
@@ -187,7 +193,7 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     m_compositingRenderServerPort = parameters.acceleratedCompositingPort.port();
 }
 
-void WebProcess::platformShutdown()
+void WebProcess::platformTerminate()
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm
index 846d7a1..6469df2 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -72,6 +72,11 @@ int WebProcessMain(const CommandLine& commandLine)
         return 2;
     }
 
+    String localization = commandLine["localization"];
+    RetainPtr<CFStringRef> cfLocalization(AdoptCF, CFStringCreateWithCharacters(0, reinterpret_cast<const UniChar*>(localization.characters()), localization.length()));
+    if (cfLocalization)
+        WKSetDefaultLocalization(cfLocalization.get());
+
 #if !SHOW_CRASH_REPORTER
     // Installs signal handlers that exit on a crash so that CrashReporter does not show up.
     signal(SIGILL, _exit);
diff --git a/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp b/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
index c45ea32..459274c 100644
--- a/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
+++ b/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
@@ -55,7 +55,7 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
 #endif
 }
 
-void WebProcess::platformShutdown()
+void WebProcess::platformTerminate()
 {
     delete m_networkAccessManager;
     m_networkAccessManager = 0;
diff --git a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
index 97e2385..58230d3 100644
--- a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
+++ b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
@@ -108,9 +108,20 @@ void WebProcess::platformClearResourceCaches()
 void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters& parameters, CoreIPC::ArgumentDecoder*)
 {
     setShouldPaintNativeControls(parameters.shouldPaintNativeControls);
+
+#if USE(CFNETWORK)
+    RetainPtr<CFStringRef> cachePath(AdoptCF, parameters.cfURLCachePath.createCFString());
+    if (!cachePath)
+        return;
+
+    CFIndex cacheDiskCapacity = parameters.cfURLCacheDiskCapacity;
+    CFIndex cacheMemoryCapacity = parameters.cfURLCacheMemoryCapacity;
+    RetainPtr<CFURLCacheRef> uiProcessCache(AdoptCF, CFURLCacheCreate(kCFAllocatorDefault, cacheMemoryCapacity, cacheDiskCapacity, cachePath.get()));
+    CFURLCacheSetSharedURLCache(uiProcessCache.get());
+#endif
 }
 
-void WebProcess::platformShutdown()
+void WebProcess::platformTerminate()
 {
 }