Merge WebKit at r70209: Initial merge by Git

Change-Id: Id23a68efa36e9d1126bcce0b137872db00892c8e

93 files changed, 1755 insertions, 812 deletions

diff --git a/WebKit/chromium/src/ApplicationCacheHost.cpp b/WebKit/chromium/src/ApplicationCacheHost.cpp
index 3bfcfe2..f1b1a91 100644
--- a/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -108,7 +108,7 @@ void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
             // see WebCore::ApplicationCacheGroup::selectCache()
             const KURL& docURL = m_documentLoader->frame()->document()->url();
             String referrer = m_documentLoader->frameLoader()->referrer();
-            m_documentLoader->frame()->redirectScheduler()->scheduleLocationChange(docURL, referrer);
+            m_documentLoader->frame()->navigationScheduler()->scheduleLocationChange(docURL, referrer);
         }
     }
 }
@@ -256,6 +256,11 @@ void ApplicationCacheHost::stopDeferringEvents()
     m_defersEvents = false;
 }
 
+void ApplicationCacheHost::stopLoadingInFrame(Frame* frame)
+{
+    // FIXME: Implement this method.
+}
+
 void ApplicationCacheHost::dispatchDOMEvent(EventID id, int total, int done)
 {
     if (m_domApplicationCache) {
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
index f3b8f5a..9647a44 100644
--- a/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -321,10 +321,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::FormatEmpty, VideoFrameChromium::Emp
 COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::FormatASCII, VideoFrameChromium::ASCII);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeSystemMemory, VideoFrameChromium::TypeSystemMemory);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeOMXBufferHead, VideoFrameChromium::TypeOMXBufferHead);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeEGLImage, VideoFrameChromium::TypeEGLImage);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeMFBuffer, VideoFrameChromium::TypeMFBuffer);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeDirect3DSurface, VideoFrameChromium::TypeDirect3DSurface);
+COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeTexture, VideoFrameChromium::TypeTexture);
 #endif
 
 #if ENABLE(NOTIFICATIONS)
diff --git a/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index db65bbd..5975e72 100644
--- a/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -61,14 +61,14 @@ AsyncFileSystemChromium::~AsyncFileSystemChromium()
 {
 }
 
-void AsyncFileSystemChromium::move(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void AsyncFileSystemChromium::move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    m_webFileSystem->move(srcPath, destPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+    m_webFileSystem->move(sourcePath, destinationPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
 }
 
-void AsyncFileSystemChromium::copy(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void AsyncFileSystemChromium::copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    m_webFileSystem->copy(srcPath, destPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+    m_webFileSystem->copy(sourcePath, destinationPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
 }
 
 void AsyncFileSystemChromium::remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
@@ -76,6 +76,11 @@ void AsyncFileSystemChromium::remove(const String& path, PassOwnPtr<AsyncFileSys
     m_webFileSystem->remove(path, new WebKit::WebFileSystemCallbacksImpl(callbacks));
 }
 
+void AsyncFileSystemChromium::removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    m_webFileSystem->removeRecursively(path, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+}
+
 void AsyncFileSystemChromium::readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
     m_webFileSystem->readMetadata(path, new WebKit::WebFileSystemCallbacksImpl(callbacks));
diff --git a/WebKit/chromium/src/AsyncFileSystemChromium.h b/WebKit/chromium/src/AsyncFileSystemChromium.h
index d8698d5..6205609 100644
--- a/WebKit/chromium/src/AsyncFileSystemChromium.h
+++ b/WebKit/chromium/src/AsyncFileSystemChromium.h
@@ -34,7 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "AsyncFileSystem.h"
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebKit {
 class WebFileSystem;
@@ -46,12 +46,17 @@ class AsyncFileSystemCallbacks;
 
 class AsyncFileSystemChromium : public AsyncFileSystem {
 public:
-    AsyncFileSystemChromium(const String& rootPath);
+    static PassOwnPtr<AsyncFileSystem> create(const String& rootPath)
+    {
+        return adoptPtr(new AsyncFileSystemChromium(rootPath));
+    }
+
     virtual ~AsyncFileSystemChromium();
 
-    virtual void move(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks>);
-    virtual void copy(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
@@ -61,6 +66,7 @@ public:
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 private:
+    explicit AsyncFileSystemChromium(const String& rootPath);
     WebKit::WebFileSystem* m_webFileSystem;
 };
 
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.cpp b/WebKit/chromium/src/BackForwardListClientImpl.cpp
index f5b04ab..2976329 100644
--- a/WebKit/chromium/src/BackForwardListClientImpl.cpp
+++ b/WebKit/chromium/src/BackForwardListClientImpl.cpp
@@ -34,6 +34,7 @@
 #include "HistoryItem.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
+#include <wtf/text/StringConcatenate.h>
 
 using namespace WebCore;
 
@@ -102,11 +103,8 @@ HistoryItem* BackForwardListClientImpl::itemAtIndex(int index)
     // differently.  It should perhaps just ask the FrameLoaderClient to
     // perform those navigations.
 
-    String url_string = String::format(
-        "%s://go/%d", backForwardNavigationScheme, index);
-
-    m_pendingHistoryItem =
-        HistoryItem::create(url_string, String(), 0.0);
+    String urlString = makeString(backForwardNavigationScheme, "://go/", String::number(index));
+    m_pendingHistoryItem = HistoryItem::create(urlString, String(), 0);
     return m_pendingHistoryItem.get();
 }
 
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
index 5f702e0..4f1705f 100644
--- a/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -55,10 +55,10 @@
 #include "NotificationPresenterImpl.h"
 #include "Page.h"
 #include "PopupMenuChromium.h"
+#include "RenderWidget.h"
 #include "ScriptController.h"
 #include "SearchPopupMenuChromium.h"
 #include "SecurityOrigin.h"
-#include "SharedGraphicsContext3D.h"
 #if USE(V8)
 #include "V8Proxy.h"
 #endif
@@ -72,6 +72,8 @@
 #include "WebInputEvent.h"
 #include "WebKit.h"
 #include "WebNode.h"
+#include "WebPlugin.h"
+#include "WebPluginContainerImpl.h"
 #include "WebPopupMenuImpl.h"
 #include "WebPopupMenuInfo.h"
 #include "WebPopupType.h"
@@ -246,28 +248,6 @@ void ChromeClientImpl::focusedNodeChanged(Node* node)
             focusURL = hitTest.absoluteLinkURL();
     }
     m_webView->client()->setKeyboardFocusURL(focusURL);
-    
-    if (!node)
-        return;
-
-    // If accessibility is enabled, we should notify assistive technology that
-    // the active AccessibilityObject changed.
-    Document* document = node->document();
-    if (!document) {
-        ASSERT_NOT_REACHED();
-        return;
-    }
-
-    // TODO: Remove once the FocusedUIElementChanged notification is handled downstream.
-    if (document && document->axObjectCache()->accessibilityEnabled()) {
-        // Retrieve the focused AccessibilityObject.
-        AccessibilityObject* focusedAccObj =
-            document->axObjectCache()->getOrCreate(node->renderer());
-
-        // Alert assistive technology that focus changed.
-        if (focusedAccObj)
-            m_webView->client()->focusAccessibilityObject(WebAccessibilityObject(focusedAccObj));
-    }
 }
 
 Page* ChromeClientImpl::createWindow(
@@ -604,11 +584,25 @@ void ChromeClientImpl::mouseDidMoveOverElement(
 {
     if (!m_webView->client())
         return;
+
+    WebURL url;
     // Find out if the mouse is over a link, and if so, let our UI know...
     if (result.isLiveLink() && !result.absoluteLinkURL().string().isEmpty())
-        m_webView->client()->setMouseOverURL(result.absoluteLinkURL());
-    else
-        m_webView->client()->setMouseOverURL(WebURL());
+        url = result.absoluteLinkURL();
+    else if (result.innerNonSharedNode()
+             && (result.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
+                 || result.innerNonSharedNode()->hasTagName(HTMLNames::embedTag))) {
+        RenderObject* object = result.innerNonSharedNode()->renderer();
+        if (object && object->isWidget()) {
+            Widget* widget = toRenderWidget(object)->widget();
+            if (widget && widget->isPluginContainer()) {
+                WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
+                url = plugin->plugin()->linkAtPosition(result.point());
+            }
+        }
+    }
+
+    m_webView->client()->setMouseOverURL(url);
 }
 
 void ChromeClientImpl::setToolTip(const String& tooltipText, TextDirection dir)
@@ -777,15 +771,23 @@ NotificationPresenter* ChromeClientImpl::notificationPresenter() const
 
 void ChromeClientImpl::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    // FIXME: Implement Client-based Geolocation Permissions
+#else
     GeolocationServiceChromium* geolocationService = static_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
     geolocationService->geolocationServiceBridge()->attachBridgeIfNeeded();
     m_webView->client()->geolocationService()->requestPermissionForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
+#endif
 }
 
 void ChromeClientImpl::cancelGeolocationPermissionRequestForFrame(Frame* frame, Geolocation* geolocation)
 {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    // FIXME: Implement Client-based Geolocation Permissions
+#else
     GeolocationServiceChromium* geolocationService = static_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
     m_webView->client()->geolocationService()->cancelPermissionRequestForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
+#endif
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -805,11 +807,6 @@ bool ChromeClientImpl::allowsAcceleratedCompositing() const
 }
 #endif
 
-WebCore::SharedGraphicsContext3D* ChromeClientImpl::getSharedGraphicsContext3D()
-{
-    return m_webView->getSharedGraphicsContext3D();
-}
-
 bool ChromeClientImpl::supportsFullscreenForNode(const WebCore::Node* node)
 {
     if (m_webView->client() && node->hasTagName(WebCore::HTMLNames::videoTag))
diff --git a/WebKit/chromium/src/ChromeClientImpl.h b/WebKit/chromium/src/ChromeClientImpl.h
index 02f1de6..b1208f7 100644
--- a/WebKit/chromium/src/ChromeClientImpl.h
+++ b/WebKit/chromium/src/ChromeClientImpl.h
@@ -155,8 +155,6 @@ public:
     virtual bool allowsAcceleratedCompositing() const;
 #endif
 
-    virtual WebCore::SharedGraphicsContext3D* getSharedGraphicsContext3D();
-
     virtual bool supportsFullscreenForNode(const WebCore::Node*);
     virtual void enterFullscreenForNode(WebCore::Node*);
     virtual void exitFullscreenForNode(WebCore::Node*);
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
index b906575..1af32cf 100644
--- a/WebKit/chromium/src/ChromiumBridge.cpp
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -63,10 +63,11 @@
 
 #if OS(WINDOWS)
 #include "WebRect.h"
-#include "WebThemeEngine.h"
+#include "win/WebThemeEngine.h"
 #endif
 
 #if OS(LINUX) || OS(FREEBSD)
+#include "linux/WebThemeEngine.h"
 #include "WebFontInfo.h"
 #include "WebFontRenderStyle.h"
 #endif
@@ -85,7 +86,11 @@
 #include "PlatformContextSkia.h"
 #include "PluginData.h"
 #include "SharedBuffer.h"
+
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
 #include "WebGeolocationServiceBridgeImpl.h"
+#endif
+
 #include "Worker.h"
 #include "WorkerContextProxy.h"
 #include <wtf/Assertions.h>
@@ -464,12 +469,14 @@ bool ChromiumBridge::loadFont(NSFont* srcFont, ATSFontContainerRef* out)
 }
 #endif
 
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
 // Geolocation ----------------------------------------------------------------
 
 GeolocationServiceBridge* ChromiumBridge::createGeolocationServiceBridge(GeolocationServiceChromium* geolocationServiceChromium)
 {
     return createGeolocationServiceBridgeImpl(geolocationServiceChromium);
 }
+#endif
 
 // Databases ------------------------------------------------------------------
 
@@ -584,14 +591,9 @@ bool ChromiumBridge::plugins(bool refresh, Vector<PluginInfo>* results)
 
 NPObject* ChromiumBridge::pluginScriptableObject(Widget* widget)
 {
-    if (!widget)
+    if (!widget || !widget->isPluginContainer())
         return 0;
 
-    ASSERT(!widget->isFrameView());
-
-    // NOTE:  We have to trust that the widget passed to us here is a
-    // WebPluginContainerImpl.  There isn't a way to dynamically verify it,
-    // since the derived class (Widget) has no identifier.
     return static_cast<WebPluginContainerImpl*>(widget)->scriptableObject();
 }
 
@@ -739,6 +741,60 @@ void ChromiumBridge::paintProgressBar(
         gc->platformContext()->canvas(), barRect, valueRect, determinate, animatedSeconds);
 }
 
+#elif OS(LINUX)
+
+static WebThemeEngine::Part WebThemePart(ChromiumBridge::ThemePart part)
+{
+    switch (part) {
+    case ChromiumBridge::PartScrollbarDownArrow: return WebThemeEngine::PartScrollbarDownArrow;
+    case ChromiumBridge::PartScrollbarLeftArrow: return WebThemeEngine::PartScrollbarLeftArrow;
+    case ChromiumBridge::PartScrollbarRightArrow: return WebThemeEngine::PartScrollbarRightArrow;
+    case ChromiumBridge::PartScrollbarUpArrow: return WebThemeEngine::PartScrollbarUpArrow;
+    case ChromiumBridge::PartScrollbarHorizontalThumb: return WebThemeEngine::PartScrollbarHorizontalThumb;
+    case ChromiumBridge::PartScrollbarVerticalThumb: return WebThemeEngine::PartScrollbarVerticalThumb;
+    case ChromiumBridge::PartScrollbarHoriztonalTrack: return WebThemeEngine::PartScrollbarHoriztonalTrack;
+    case ChromiumBridge::PartScrollbarVerticalTrack: return WebThemeEngine::PartScrollbarVerticalTrack;
+    }
+    ASSERT_NOT_REACHED();
+    return WebThemeEngine::PartScrollbarDownArrow;
+}
+
+static WebThemeEngine::State WebThemeState(ChromiumBridge::ThemePaintState state)
+{
+    switch (state) {
+    case ChromiumBridge::StateDisabled: return WebThemeEngine::StateDisabled;
+    case ChromiumBridge::StateHover: return WebThemeEngine::StateHover;
+    case ChromiumBridge::StateNormal: return WebThemeEngine::StateNormal;
+    case ChromiumBridge::StatePressed: return WebThemeEngine::StatePressed;
+    }
+    ASSERT_NOT_REACHED();
+    return WebThemeEngine::StateDisabled;
+}
+
+static void GetWebThemeExtraParams(ChromiumBridge::ThemePart part, ChromiumBridge::ThemePaintState state, const ChromiumBridge::ThemePaintExtraParams* extraParams, WebThemeEngine::ExtraParams* webThemeExtraParams)
+{
+    if (part == ChromiumBridge::PartScrollbarHoriztonalTrack || part == ChromiumBridge::PartScrollbarVerticalTrack) {
+        webThemeExtraParams->scrollbarTrack.trackX = extraParams->scrollbarTrack.trackX;
+        webThemeExtraParams->scrollbarTrack.trackY = extraParams->scrollbarTrack.trackY;
+        webThemeExtraParams->scrollbarTrack.trackWidth = extraParams->scrollbarTrack.trackWidth;
+        webThemeExtraParams->scrollbarTrack.trackHeight = extraParams->scrollbarTrack.trackHeight;
+    }
+}
+
+IntSize ChromiumBridge::getThemePartSize(ThemePart part)
+{
+     return webKitClient()->themeEngine()->getSize(WebThemePart(part));
+}
+
+void ChromiumBridge::paintThemePart(
+    GraphicsContext* gc, ThemePart part, ThemePaintState state, const IntRect& rect, const ThemePaintExtraParams* extraParams)
+{
+    WebThemeEngine::ExtraParams webThemeExtraParams;
+    GetWebThemeExtraParams(part, state, extraParams, &webThemeExtraParams);
+    webKitClient()->themeEngine()->paint(
+        gc->platformContext()->canvas(), WebThemePart(part), WebThemeState(state), rect, &webThemeExtraParams);
+}
+
 #endif
 
 // Trace Event ----------------------------------------------------------------
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index ef611e1..d9ccb17 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -208,7 +208,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         RenderObject* object = r.innerNonSharedNode()->renderer();
         if (object && object->isWidget()) {
             Widget* widget = toRenderWidget(object)->widget();
-            if (widget) {
+            if (widget && widget->isPluginContainer()) {
                 WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
                 WebString text = plugin->plugin()->selectionAsText();
                 if (!text.isEmpty()) {
@@ -216,6 +216,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
                     data.editFlags |= WebContextMenuData::CanCopy;
                 }
                 data.editFlags &= ~WebContextMenuData::CanTranslate;
+                data.linkURL = plugin->plugin()->linkAtPosition(data.mousePosition);
             }
         }
     }
diff --git a/WebKit/chromium/src/DebuggerAgentManager.cpp b/WebKit/chromium/src/DebuggerAgentManager.cpp
index dfc186c..0860cb1 100644
--- a/WebKit/chromium/src/DebuggerAgentManager.cpp
+++ b/WebKit/chromium/src/DebuggerAgentManager.cpp
@@ -41,6 +41,7 @@
 #include "WebViewImpl.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebKit {
 
@@ -153,10 +154,9 @@ void DebuggerAgentManager::debugDetach(DebuggerAgentImpl* debuggerAgent)
         }
     } else {
       // Remove all breakpoints set by the agent.
-      WTF::String clearBreakpointGroupCmd = WTF::String::format(
+      String clearBreakpointGroupCmd = makeString(
           "{\"seq\":1,\"type\":\"request\",\"command\":\"clearbreakpointgroup\","
-              "\"arguments\":{\"groupId\":%d}}",
-          hostId);
+              "\"arguments\":{\"groupId\":", String::number(hostId), "}}");
       sendCommandToV8(clearBreakpointGroupCmd, new CallerIdWrapper());
 
       if (isOnBreakpoint) {
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index ba9c8fd..b4c62f4 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -1072,7 +1072,11 @@ void FrameLoaderClientImpl::committedLoad(DocumentLoader* loader, const char* da
             m_pluginWidget->didReceiveResponse(
                 m_webFrame->frame()->loader()->activeDocumentLoader()->response());
         }
-        m_pluginWidget->didReceiveData(data, length);
+
+        // It's possible that the above call removed the pointer to the plugin, so
+        // check before calling it.
+        if (m_pluginWidget.get())
+            m_pluginWidget->didReceiveData(data, length);
     }
 }
 
@@ -1411,14 +1415,6 @@ PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
     if (!webPlugin->initialize(container.get()))
         return 0;
 
-    bool zoomTextOnly = m_webFrame->viewImpl()->zoomTextOnly();
-    float zoomFactor = zoomTextOnly ? m_webFrame->frame()->textZoomFactor() : m_webFrame->frame()->pageZoomFactor();
-    if (zoomFactor != 1) {
-        // There's a saved zoom level, so tell the plugin about it since
-        // WebViewImpl::setZoomLevel was called before the plugin was created.
-        webPlugin->setZoomFactor(zoomFactor, zoomTextOnly);
-    }
-
     // The element might have been removed during plugin initialization!
     if (!element->renderer())
         return 0;
@@ -1430,7 +1426,8 @@ PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
 // (e.g., acrobat reader).
 void FrameLoaderClientImpl::redirectDataToPlugin(Widget* pluginWidget)
 {
-    m_pluginWidget = static_cast<WebPluginContainerImpl*>(pluginWidget);
+    if (pluginWidget->isPluginContainer())
+        m_pluginWidget = static_cast<WebPluginContainerImpl*>(pluginWidget);
     ASSERT(m_pluginWidget.get());
 }
 
diff --git a/WebKit/chromium/src/GraphicsContext3D.cpp b/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index c78d334..afc2707 100644
--- a/WebKit/chromium/src/GraphicsContext3D.cpp
+++ b/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -801,15 +801,15 @@ GraphicsContext3D::~GraphicsContext3D()
 {
 }
 
-PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
 {
     OwnPtr<GraphicsContext3DInternal> internal = adoptPtr(new GraphicsContext3DInternal());
     if (!internal->initialize(attrs, hostWindow, renderStyle == RenderDirectlyToHostWindow)) {
         return 0;
     }
-    PassOwnPtr<GraphicsContext3D> result = new GraphicsContext3D(attrs, hostWindow, renderStyle == RenderDirectlyToHostWindow);
+    RefPtr<GraphicsContext3D> result = adoptRef(new GraphicsContext3D(attrs, hostWindow, renderStyle == RenderDirectlyToHostWindow));
     result->m_internal = internal.release();
-    return result;
+    return result.release();
 }
 
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
@@ -1047,6 +1047,11 @@ bool GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses() const
     return m_internal->isErrorGeneratedOnOutOfBoundsAccesses();
 }
 
+int GraphicsContext3D::getGraphicsResetStatusARB()
+{
+    return NO_ERROR;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.cpp b/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 3eab622..69051d0 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -38,6 +38,7 @@
 #include "WebIDBIndexImpl.h"
 #include "WebIDBKey.h"
 #include "WebIDBObjectStoreImpl.h"
+#include "WebIDBTransactionImpl.h"
 #include "WebSerializedScriptValue.h"
 
 #if ENABLE(INDEXED_DATABASE)
@@ -100,6 +101,12 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBObjectStoreBackendInterface> bac
     m_callbacks.clear();
 }
 
+void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBTransactionBackendInterface> backend)
+{
+    m_callbacks->onSuccess(new WebKit::WebIDBTransactionImpl(backend));
+    m_callbacks.clear();
+}
+
 void IDBCallbacksProxy::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
     m_callbacks->onSuccess(WebKit::WebSerializedScriptValue(serializedScriptValue));
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.h b/WebKit/chromium/src/IDBCallbacksProxy.h
index 506dbb0..8c26161 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -54,6 +54,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBObjectStoreBackendInterface>);
+    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
 
 private:
diff --git a/WebKit/chromium/src/IDBCursorBackendProxy.cpp b/WebKit/chromium/src/IDBCursorBackendProxy.cpp
index cf18917..94491f9 100644
--- a/WebKit/chromium/src/IDBCursorBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBCursorBackendProxy.cpp
@@ -75,19 +75,19 @@ PassRefPtr<IDBAny> IDBCursorBackendProxy::value() const
     return IDBAny::create<IDBKey>(webKey);
 }
 
-void IDBCursorBackendProxy::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendProxy::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->update(value, new WebIDBCallbacksImpl(callbacks));
+    m_idbCursor->update(value, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-void IDBCursorBackendProxy::continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendProxy::continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->continueFunction(key, new WebIDBCallbacksImpl(callbacks));
+    m_idbCursor->continueFunction(key, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-void IDBCursorBackendProxy::remove(PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendProxy::remove(PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->remove(new WebIDBCallbacksImpl(callbacks));
+    m_idbCursor->remove(new WebIDBCallbacksImpl(callbacks), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBCursorBackendProxy.h b/WebKit/chromium/src/IDBCursorBackendProxy.h
index d8b621a..0a7a288 100644
--- a/WebKit/chromium/src/IDBCursorBackendProxy.h
+++ b/WebKit/chromium/src/IDBCursorBackendProxy.h
@@ -45,9 +45,9 @@ public:
     virtual unsigned short direction() const;
     virtual PassRefPtr<IDBKey> key() const;
     virtual PassRefPtr<IDBAny> value() const;
-    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>);
-    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
-    virtual void remove(PassRefPtr<IDBCallbacks>);
+    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void remove(PassRefPtr<IDBCallbacks>, ExceptionCode&);
 
 private:
     IDBCursorBackendProxy(PassOwnPtr<WebKit::WebIDBCursor>);
diff --git a/WebKit/chromium/src/IDBDatabaseProxy.cpp b/WebKit/chromium/src/IDBDatabaseProxy.cpp
index ce5e0a6..4fecf1b 100644
--- a/WebKit/chromium/src/IDBDatabaseProxy.cpp
+++ b/WebKit/chromium/src/IDBDatabaseProxy.cpp
@@ -76,36 +76,42 @@ PassRefPtr<DOMStringList> IDBDatabaseProxy::objectStores() const
     return m_webIDBDatabase->objectStores();
 }
 
-void IDBDatabaseProxy::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks> callbacks)
+PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseProxy::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBDatabase->createObjectStore(name, keyPath, autoIncrement, new WebIDBCallbacksImpl(callbacks));
-}
-
-PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseProxy::objectStore(const String& name, unsigned short mode)
-{
-    WebKit::WebIDBObjectStore* objectStore = m_webIDBDatabase->objectStore(name, mode);
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    WebKit::WebIDBObjectStore* objectStore = m_webIDBDatabase->createObjectStore(name, keyPath, autoIncrement, *transactionProxy->getWebIDBTransaction(), ec);
     if (!objectStore)
         return 0;
     return IDBObjectStoreProxy::create(objectStore);
 }
 
-void IDBDatabaseProxy::removeObjectStore(const String& name, PassRefPtr<IDBCallbacks> callbacks)
+void IDBDatabaseProxy::removeObjectStore(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBDatabase->removeObjectStore(name, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBDatabase->removeObjectStore(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBDatabaseProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks)
+void IDBDatabaseProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks));
+    m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode& ec)
 {
     WebKit::WebDOMStringList names(storeNames);
-    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, timeout);
+    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, timeout, ec);
     return IDBTransactionBackendProxy::create(transaction);
 }
 
+void IDBDatabaseProxy::close()
+{
+    m_webIDBDatabase->close();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebKit/chromium/src/IDBDatabaseProxy.h b/WebKit/chromium/src/IDBDatabaseProxy.h
index fffd23e..5d20073 100644
--- a/WebKit/chromium/src/IDBDatabaseProxy.h
+++ b/WebKit/chromium/src/IDBDatabaseProxy.h
@@ -47,13 +47,11 @@ public:
     virtual String version() const;
     virtual PassRefPtr<DOMStringList> objectStores() const;
 
-    // FIXME: Add setVersion.
-
-    virtual void createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, unsigned short mode);
-    virtual void removeObjectStore(const String& name, PassRefPtr<IDBCallbacks>);
-    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout);
+    virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void removeObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode&);
+    virtual void close();
 
 private:
     IDBDatabaseProxy(PassOwnPtr<WebKit::WebIDBDatabase>);
diff --git a/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index d43e787..2e65246 100755
--- a/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -59,10 +59,10 @@ IDBFactoryBackendProxy::~IDBFactoryBackendProxy()
 {
 }
 
-void IDBFactoryBackendProxy::open(const String& name, const String& description, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir)
+void IDBFactoryBackendProxy::open(const String& name, const String& description, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir, int64_t maximumSize)
 {
     WebKit::WebFrame* webFrame = WebKit::WebFrameImpl::fromFrame(frame);
-    m_webIDBFactory->open(name, description, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir);
+    m_webIDBFactory->open(name, description, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir, maximumSize);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBFactoryBackendProxy.h b/WebKit/chromium/src/IDBFactoryBackendProxy.h
index 6371686..0a55b59 100755
--- a/WebKit/chromium/src/IDBFactoryBackendProxy.h
+++ b/WebKit/chromium/src/IDBFactoryBackendProxy.h
@@ -45,7 +45,7 @@ public:
     virtual ~IDBFactoryBackendProxy();
 
     PassRefPtr<DOMStringList> databases(void) const;
-    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir);
+    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize);
 
 private:
     IDBFactoryBackendProxy();
diff --git a/WebKit/chromium/src/IDBIndexBackendProxy.cpp b/WebKit/chromium/src/IDBIndexBackendProxy.cpp
index f92f4f2..410750e 100644
--- a/WebKit/chromium/src/IDBIndexBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBIndexBackendProxy.cpp
@@ -30,6 +30,7 @@
 
 #include "IDBCallbacks.h"
 #include "IDBKeyRange.h"
+#include "IDBTransactionBackendProxy.h"
 #include "WebIDBCallbacksImpl.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBIndex.h"
@@ -72,24 +73,36 @@ bool IDBIndexBackendProxy::unique()
     return m_webIDBIndex->unique();
 }
 
-void IDBIndexBackendProxy::openObjectCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::openCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->openObjectCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->openObjectCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBIndexBackendProxy::openCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::openKeyCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->openCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->openKeyCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBIndexBackendProxy::getObject(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->getObject(key, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->getObject(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBIndexBackendProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::getKey(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->get(key, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->getKey(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBIndexBackendProxy.h b/WebKit/chromium/src/IDBIndexBackendProxy.h
index 6aafdfa..e9de05a 100644
--- a/WebKit/chromium/src/IDBIndexBackendProxy.h
+++ b/WebKit/chromium/src/IDBIndexBackendProxy.h
@@ -46,10 +46,10 @@ public:
     virtual String keyPath();
     virtual bool unique();
 
-    virtual void openObjectCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>);
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>);
-    virtual void getObject(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
-    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void openKeyCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
     IDBIndexBackendProxy(PassOwnPtr<WebKit::WebIDBIndex>);
diff --git a/WebKit/chromium/src/IDBObjectStoreProxy.cpp b/WebKit/chromium/src/IDBObjectStoreProxy.cpp
index 82ca5f6..e537718 100755
--- a/WebKit/chromium/src/IDBObjectStoreProxy.cpp
+++ b/WebKit/chromium/src/IDBObjectStoreProxy.cpp
@@ -72,45 +72,63 @@ PassRefPtr<DOMStringList> IDBObjectStoreProxy::indexNames() const
     return m_webIDBObjectStore->indexNames();
 }
 
-void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction)
+void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction());
+    m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->put(value, key, addOnly, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->put(value, key, addOnly, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->remove(key, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->remove(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks> callbacks)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->createIndex(name, keyPath, unique, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    WebKit::WebIDBIndex* index = m_webIDBObjectStore->createIndex(name, keyPath, unique, *transactionProxy->getWebIDBTransaction(), ec);
+    if (!index)
+        return 0;
+    return IDBIndexBackendProxy::create(index);
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::index(const String& name)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::index(const String& name, ExceptionCode& ec)
 {
-    WebKit::WebIDBIndex* index = m_webIDBObjectStore->index(name);
+    WebKit::WebIDBIndex* index = m_webIDBObjectStore->index(name, ec);
     if (!index)
         return 0;
     return IDBIndexBackendProxy::create(index);
 }
 
-void IDBObjectStoreProxy::removeIndex(const String& name, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::removeIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->removeIndex(name, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->removeIndex(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->openCursor(range, direction, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->openCursor(range, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBObjectStoreProxy.h b/WebKit/chromium/src/IDBObjectStoreProxy.h
index 13dfe23..1e19279 100755
--- a/WebKit/chromium/src/IDBObjectStoreProxy.h
+++ b/WebKit/chromium/src/IDBObjectStoreProxy.h
@@ -40,21 +40,21 @@ namespace WebCore {
 class IDBObjectStoreProxy : public IDBObjectStoreBackendInterface {
 public:
     static PassRefPtr<IDBObjectStoreBackendInterface> create(PassOwnPtr<WebKit::WebIDBObjectStore>);
-    ~IDBObjectStoreProxy();
+    virtual ~IDBObjectStoreProxy();
 
-    String name() const;
-    String keyPath() const;
-    PassRefPtr<DOMStringList> indexNames() const;
+    virtual String name() const;
+    virtual String keyPath() const;
+    virtual PassRefPtr<DOMStringList> indexNames() const;
 
-    void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*);
-    void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>);
-    void remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void remove(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
-    void createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks>);
-    PassRefPtr<IDBIndexBackendInterface> index(const String& name);
-    void removeIndex(const String& name, PassRefPtr<IDBCallbacks>);
+    PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&);
+    PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
+    void removeIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
 
-    virtual void openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>);
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
     IDBObjectStoreProxy(PassOwnPtr<WebKit::WebIDBObjectStore>);
diff --git a/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index 59e88d8..4b19ee4 100644
--- a/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -45,6 +45,8 @@ PassRefPtr<IDBTransactionBackendInterface> IDBTransactionBackendProxy::create(Pa
 IDBTransactionBackendProxy::IDBTransactionBackendProxy(PassOwnPtr<WebKit::WebIDBTransaction> transaction)
     : m_webIDBTransaction(transaction)
 {
+    if (!m_webIDBTransaction)
+        m_webIDBTransaction = adoptPtr(new WebKit::WebIDBTransaction());
 }
 
 IDBTransactionBackendProxy::~IDBTransactionBackendProxy()
@@ -69,7 +71,7 @@ void IDBTransactionBackendProxy::abort()
     m_webIDBTransaction->abort();
 }
 
-bool IDBTransactionBackendProxy::scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>)
+bool IDBTransactionBackendProxy::scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>, PassOwnPtr<ScriptExecutionContext::Task>)
 {
     // This should never be reached as it's the impl objects who get to
     // execute tasks in the browser process.
diff --git a/WebKit/chromium/src/IDBTransactionBackendProxy.h b/WebKit/chromium/src/IDBTransactionBackendProxy.h
index 3daf73e..0c56f19 100644
--- a/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -45,7 +45,7 @@ public:
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name);
     virtual unsigned short mode() const;
     virtual void abort();
-    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>, PassOwnPtr<ScriptExecutionContext::Task>);
     virtual void didCompleteTaskEvents();
     virtual int id() const;
     virtual void setCallbacks(IDBTransactionCallbacks*);
diff --git a/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp b/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
index be7d44f..3a19fe2 100644
--- a/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
+++ b/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
@@ -55,9 +55,16 @@ void IDBTransactionCallbacksProxy::onAbort()
     m_callbacks.clear();
 }
 
-int IDBTransactionCallbacksProxy::id() const
+void IDBTransactionCallbacksProxy::onComplete()
 {
-    return m_callbacks->id();
+    m_callbacks->onComplete();
+    m_callbacks.clear();
+}
+
+void IDBTransactionCallbacksProxy::onTimeout()
+{
+    m_callbacks->onTimeout();
+    m_callbacks.clear();
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBTransactionCallbacksProxy.h b/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
index 821eff4..891d5c9 100644
--- a/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
+++ b/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
@@ -46,8 +46,8 @@ public:
     virtual ~IDBTransactionCallbacksProxy();
 
     virtual void onAbort();
-    virtual int id() const;
-    // FIXME: implement onComplete().
+    virtual void onComplete();
+    virtual void onTimeout();
 
 private:
     IDBTransactionCallbacksProxy(PassOwnPtr<WebKit::WebIDBTransactionCallbacks>);
diff --git a/WebKit/chromium/src/LocalFileSystemChromium.cpp b/WebKit/chromium/src/LocalFileSystemChromium.cpp
index 7bf4335..25b1feb 100644
--- a/WebKit/chromium/src/LocalFileSystemChromium.cpp
+++ b/WebKit/chromium/src/LocalFileSystemChromium.cpp
@@ -57,7 +57,7 @@ LocalFileSystem& LocalFileSystem::localFileSystem()
     return *localFileSystem;
 }
 
-void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous)
 {
     ASSERT(context);
     if (context->isDocument()) {
@@ -68,7 +68,7 @@ void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFi
         WorkerContext* workerContext = static_cast<WorkerContext*>(context);
         WorkerLoaderProxy* workerLoaderProxy = &workerContext->thread()->workerLoaderProxy();
         WebWorkerBase* webWorker = static_cast<WebWorkerBase*>(workerLoaderProxy);
-        webWorker->openFileSystem(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks));
+        webWorker->openFileSystem(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks, context, synchronous), synchronous);
     }
 }
 
diff --git a/WebKit/chromium/src/LocalizedStrings.cpp b/WebKit/chromium/src/LocalizedStrings.cpp
index 3354c30..fbc35ce 100644
--- a/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/WebKit/chromium/src/LocalizedStrings.cpp
@@ -33,14 +33,15 @@
 
 #include "IntSize.h"
 #include "NotImplemented.h"
-#include "PlatformString.h"
-#include "StringBuilder.h"
 
 #include "WebKit.h"
 #include "WebKitClient.h"
 #include "WebLocalizedString.h"
 #include "WebString.h"
 
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
 using WebKit::WebLocalizedString;
 
 namespace WebCore {
@@ -213,14 +214,13 @@ String keygenMenuMediumGradeKeySize()
 // Used in ImageDocument.cpp as the title for pages when that page is an image.
 String imageTitle(const String& filename, const IntSize& size)
 {
-    // Note that we cannot use String::format because it works for ASCII only.
     StringBuilder result;
     result.append(filename);
     result.append(" (");
     result.append(String::number(size.width()));
     result.append(static_cast<UChar>(0xD7));  // U+00D7 (multiplication sign)
     result.append(String::number(size.height()));
-    result.append(")");
+    result.append(')');
     return result.toString();
 }
 
diff --git a/WebKit/chromium/src/VideoFrameChromiumImpl.cpp b/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
index a60fe28..99e3e1e 100644
--- a/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
+++ b/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
@@ -100,6 +100,13 @@ const void* VideoFrameChromiumImpl::data(unsigned plane) const
     return 0;
 }
 
+unsigned VideoFrameChromiumImpl::texture(unsigned plane) const
+{
+    if (m_webVideoFrame)
+        return m_webVideoFrame->texture(plane);
+    return 0;
+}
+
 const IntSize VideoFrameChromiumImpl::requiredTextureSize(unsigned plane) const
 {
     switch (format()) {
diff --git a/WebKit/chromium/src/VideoFrameChromiumImpl.h b/WebKit/chromium/src/VideoFrameChromiumImpl.h
index 042cd7e..f86ee1c 100644
--- a/WebKit/chromium/src/VideoFrameChromiumImpl.h
+++ b/WebKit/chromium/src/VideoFrameChromiumImpl.h
@@ -56,6 +56,7 @@ public:
     virtual unsigned planes() const;
     virtual int stride(unsigned plane) const;
     virtual const void* data(unsigned plane) const;
+    virtual unsigned texture(unsigned plane) const;
     virtual const IntSize requiredTextureSize(unsigned plane) const;
 
 private:
diff --git a/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp b/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
index 8304878..f91bd1c 100644
--- a/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
+++ b/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
@@ -118,11 +118,6 @@ WebAccessibilityObject WebAccessibilityCacheImpl::getObjectById(int id)
     return WebAccessibilityObject(it->second->accessibilityObject());
 }
 
-bool WebAccessibilityCacheImpl::isValidId(int id) const
-{
-    return id >= firstObjectId;
-}
-
 void WebAccessibilityCacheImpl::remove(int id)
 {
     ObjectMap::iterator it = m_objectMap.find(id);
@@ -166,4 +161,17 @@ int WebAccessibilityCacheImpl::addOrGetId(const WebAccessibilityObject& object)
     return m_nextNewId++;
 }
 
+bool WebAccessibilityCacheImpl::isCached(const WebAccessibilityObject& object)
+{
+    if (!object.isValid())
+        return false;
+
+    RefPtr<AccessibilityObject> o = toAccessibilityObject(object);
+    IdMap::iterator it = m_idMap.find(o.get());
+    if (it == m_idMap.end())
+        return false;
+        
+    return true;
+}
+
 }
diff --git a/WebKit/chromium/src/WebAccessibilityCacheImpl.h b/WebKit/chromium/src/WebAccessibilityCacheImpl.h
index 5148b74..c72c0fc 100644
--- a/WebKit/chromium/src/WebAccessibilityCacheImpl.h
+++ b/WebKit/chromium/src/WebAccessibilityCacheImpl.h
@@ -45,8 +45,8 @@ public:
     virtual bool isInitialized() const { return m_initialized; }
 
     virtual WebAccessibilityObject getObjectById(int);
-    virtual bool isValidId(int) const;
     virtual int addOrGetId(const WebKit::WebAccessibilityObject&);
+    virtual bool isCached(const WebAccessibilityObject&);
 
     virtual void remove(int);
     virtual void clear();
diff --git a/WebKit/chromium/src/WebBlobData.cpp b/WebKit/chromium/src/WebBlobData.cpp
index 4cd1d67..42018dd 100644
--- a/WebKit/chromium/src/WebBlobData.cpp
+++ b/WebKit/chromium/src/WebBlobData.cpp
@@ -32,6 +32,7 @@
 #include "WebBlobData.h"
 
 #include "BlobData.h"
+#include <wtf/PassOwnPtr.h>
 
 using namespace WebCore;
 
@@ -89,54 +90,18 @@ bool WebBlobData::itemAt(size_t index, Item& result) const
     return false;
 }
 
-void WebBlobData::appendData(const WebCString& data)
-{
-    ASSERT(!isNull());
-    m_private->appendData(data);
-}
-
-void WebBlobData::appendFile(const WebString& filePath)
-{
-    ASSERT(!isNull());
-    m_private->appendFile(filePath);
-}
-
-void WebBlobData::appendFile(const WebString& filePath, long long offset, long long length, double expectedModificationTime)
-{
-    ASSERT(!isNull());
-    m_private->appendFile(filePath, offset, length, expectedModificationTime);
-}
-
-void WebBlobData::appendBlob(const WebURL& blobURL, long long offset, long long length)
-{
-    ASSERT(!isNull());
-    m_private->appendBlob(blobURL, offset, length);
-}
-
 WebString WebBlobData::contentType() const
 {
     ASSERT(!isNull());
     return m_private->contentType();
 }
 
-void WebBlobData::setContentType(const WebString& contentType)
-{
-    ASSERT(!isNull());
-    m_private->setContentType(contentType);
-}
-
 WebString WebBlobData::contentDisposition() const
 {
     ASSERT(!isNull());
     return m_private->contentDisposition();
 }
 
-void WebBlobData::setContentDisposition(const WebString& contentDisposition)
-{
-    ASSERT(!isNull());
-    m_private->setContentDisposition(contentDisposition);
-}
-
 WebBlobData::WebBlobData(const PassOwnPtr<BlobData>& data)
     : m_private(0)
 {
diff --git a/WebKit/chromium/src/WebBlobStorageData.cpp b/WebKit/chromium/src/WebBlobStorageData.cpp
deleted file mode 100644
index 38a25fe..0000000
--- a/WebKit/chromium/src/WebBlobStorageData.cpp
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebBlobStorageData.h"
-
-#include "BlobStorageData.h"
-
-using namespace WebCore;
-
-namespace WebKit {
-
-class WebBlobStorageDataPrivate : public BlobStorageData {
-};
-
-void WebBlobStorageData::reset()
-{
-    assign(0);
-}
-
-size_t WebBlobStorageData::itemCount() const
-{
-    ASSERT(!isNull());
-    return m_private->items().size();
-}
-
-bool WebBlobStorageData::itemAt(size_t index, WebBlobData::Item& result) const
-{
-    ASSERT(!isNull());
-
-    if (index >= m_private->items().size())
-        return false;
-
-    const BlobDataItem& item = m_private->items()[index];
-    result.offset = item.offset;
-    result.length = item.length;
-    result.expectedModificationTime = item.expectedModificationTime;
-    if (item.type == BlobDataItem::Data) {
-        result.type = WebBlobData::Item::TypeData;
-        result.data.assign(item.data.data(), static_cast<size_t>(item.data.length()));
-        return true;
-    } else {
-        ASSERT(item.type == BlobDataItem::File);
-        result.type = WebBlobData::Item::TypeFile;
-        result.filePath = item.path;
-        return true;
-    }
-}
-
-WebString WebBlobStorageData::contentType() const
-{
-    ASSERT(!isNull());
-    return m_private->contentType();
-}
-
-WebString WebBlobStorageData::contentDisposition() const
-{
-    ASSERT(!isNull());
-    return m_private->contentDisposition();
-}
-
-WebBlobStorageData::WebBlobStorageData(const PassRefPtr<BlobStorageData>& data)
-    : m_private(0)
-{
-    assign(data);
-}
-
-WebBlobStorageData& WebBlobStorageData::operator=(const PassRefPtr<BlobStorageData>& data)
-{
-    assign(data);
-    return *this;
-}
-
-WebBlobStorageData::operator PassRefPtr<BlobStorageData>() const
-{
-    return m_private;
-}
-
-void WebBlobStorageData::assign(const PassRefPtr<BlobStorageData>& data)
-{
-    if (m_private)
-        m_private->deref();
-    m_private = static_cast<WebBlobStorageDataPrivate*>(data.leakRef());
-}
-
-} // namespace WebKit
diff --git a/WebKit/chromium/src/WebCache.cpp b/WebKit/chromium/src/WebCache.cpp
index 9d03a4d..c124bdf 100644
--- a/WebKit/chromium/src/WebCache.cpp
+++ b/WebKit/chromium/src/WebCache.cpp
@@ -67,15 +67,8 @@ void WebCache::clear()
 {
     Cache* cache = WebCore::cache();
     if (cache && !cache->disabled()) {
-        // NOTE: I think using setDisabled() instead of setCapacities() will
-        // remove from the cache items that won't actually be freed from memory
-        // (due to other live references to them), so it just results in wasting
-        // time later and not saving memory compared to the below technique.
-        unsigned minDeadCapacity = cache->m_minDeadCapacity;
-        unsigned maxDeadCapacity = cache->m_maxDeadCapacity;
-        unsigned capacity = cache->m_capacity;
-        cache->setCapacities(0, 0, 0);  // Will prune the cache.
-        cache->setCapacities(minDeadCapacity, maxDeadCapacity, capacity);
+        cache->setDisabled(true);
+        cache->setDisabled(false);
     }
 }
 
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index c7bb050..9b7b2bd 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -317,8 +317,11 @@ void WebDevToolsAgentImpl::identifierForInitialRequest(
 
 void WebDevToolsAgentImpl::willSendRequest(unsigned long resourceId, WebURLRequest& request)
 {
-    if (InspectorController* ic = inspectorController())
+    if (InspectorController* ic = inspectorController()) {
         ic->willSendRequest(resourceId, request.toMutableResourceRequest(), ResourceResponse());
+        if (ic->hasFrontend() && request.reportLoadTiming())
+            request.setReportRawHeaders(true);
+    }
 }
 
 void WebDevToolsAgentImpl::didReceiveData(unsigned long resourceId, int length)
@@ -330,7 +333,7 @@ void WebDevToolsAgentImpl::didReceiveData(unsigned long resourceId, int length)
 void WebDevToolsAgentImpl::didReceiveResponse(unsigned long resourceId, const WebURLResponse& response)
 {
     if (InspectorController* ic = inspectorController())
-        ic->didReceiveResponse(resourceId, response.toResourceResponse());
+        ic->didReceiveResponse(resourceId, 0, response.toResourceResponse());
 }
 
 void WebDevToolsAgentImpl::didFinishLoading(unsigned long resourceId)
diff --git a/WebKit/chromium/src/WebDragData.cpp b/WebKit/chromium/src/WebDragData.cpp
index 643c35d..9167c69 100644
--- a/WebKit/chromium/src/WebDragData.cpp
+++ b/WebKit/chromium/src/WebDragData.cpp
@@ -32,6 +32,8 @@
 #include "WebDragData.h"
 
 #include "ChromiumDataObject.h"
+#include "ChromiumDataObjectLegacy.h"
+#include "ClipboardMimeTypes.h"
 #include "WebData.h"
 #include "WebString.h"
 #include "WebURL.h"
@@ -48,7 +50,7 @@ class WebDragDataPrivate : public ChromiumDataObject {
 
 void WebDragData::initialize()
 {
-    assign(static_cast<WebDragDataPrivate*>(ChromiumDataObject::create().releaseRef()));
+    assign(static_cast<WebDragDataPrivate*>(ChromiumDataObject::create(ChromiumDataObjectLegacy::create(Clipboard::DragAndDrop)).releaseRef()));
 }
 
 void WebDragData::reset()
@@ -64,137 +66,144 @@ void WebDragData::assign(const WebDragData& other)
     assign(p);
 }
 
-WebURL WebDragData::url() const
+WebString WebDragData::url() const
 {
     ASSERT(!isNull());
-    return m_private->getURL();
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeURL, ignoredSuccess);
 }
 
 void WebDragData::setURL(const WebURL& url)
 {
     ensureMutable();
-    m_private->setURL(url);
+    m_private->setData(mimeTypeURL, KURL(url).string());
 }
 
 WebString WebDragData::urlTitle() const
 {
     ASSERT(!isNull());
-    return m_private->urlTitle;
+    return m_private->urlTitle();
 }
 
 void WebDragData::setURLTitle(const WebString& urlTitle)
 {
     ensureMutable();
-    m_private->urlTitle = urlTitle;
+    m_private->setUrlTitle(urlTitle);
 }
 
 WebString WebDragData::downloadMetadata() const
 {
     ASSERT(!isNull());
-    return m_private->downloadMetadata;
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeDownloadURL, ignoredSuccess);
 }
 
 void WebDragData::setDownloadMetadata(const WebString& downloadMetadata)
 {
     ensureMutable();
-    m_private->downloadMetadata = downloadMetadata;
+    m_private->setData(mimeTypeDownloadURL, downloadMetadata);
 }
 
 WebString WebDragData::fileExtension() const
 {
     ASSERT(!isNull());
-    return m_private->fileExtension;
+    return m_private->fileExtension();
 }
 
 void WebDragData::setFileExtension(const WebString& fileExtension)
 {
     ensureMutable();
-    m_private->fileExtension = fileExtension;
+    m_private->setFileExtension(fileExtension);
 }
 
-bool WebDragData::hasFileNames() const
+bool WebDragData::containsFilenames() const
 {
     ASSERT(!isNull());
-    return !m_private->filenames.isEmpty();
+    return m_private->containsFilenames();
 }
 
-void WebDragData::fileNames(WebVector<WebString>& fileNames) const
+void WebDragData::filenames(WebVector<WebString>& filenames) const
 {
     ASSERT(!isNull());
-    fileNames = m_private->filenames;
+    filenames = m_private->filenames();
 }
 
-void WebDragData::setFileNames(const WebVector<WebString>& fileNames)
+void WebDragData::setFilenames(const WebVector<WebString>& filenames)
 {
     ensureMutable();
-    m_private->filenames.clear();
-    m_private->filenames.append(fileNames.data(), fileNames.size());
+    Vector<String> filenamesCopy;
+    filenamesCopy.append(filenames.data(), filenames.size());
+    m_private->setFilenames(filenamesCopy);
 }
 
-void WebDragData::appendToFileNames(const WebString& fileName)
+void WebDragData::appendToFilenames(const WebString& filename)
 {
     ensureMutable();
-    m_private->filenames.append(fileName);
+    Vector<String> filenames = m_private->filenames();
+    filenames.append(filename);
+    m_private->setFilenames(filenames);
 }
 
 WebString WebDragData::plainText() const
 {
     ASSERT(!isNull());
-    return m_private->plainText;
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeTextPlain, ignoredSuccess);
 }
 
 void WebDragData::setPlainText(const WebString& plainText)
 {
     ensureMutable();
-    m_private->plainText = plainText;
+    m_private->setData(mimeTypeTextPlain, plainText);
 }
 
 WebString WebDragData::htmlText() const
 {
     ASSERT(!isNull());
-    return m_private->textHtml;
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeTextHTML, ignoredSuccess);
 }
 
 void WebDragData::setHTMLText(const WebString& htmlText)
 {
     ensureMutable();
-    m_private->textHtml = htmlText;
+    m_private->setData(mimeTypeTextHTML, htmlText);
 }
 
 WebURL WebDragData::htmlBaseURL() const
 {
     ASSERT(!isNull());
-    return m_private->htmlBaseUrl;
+    return m_private->htmlBaseUrl();
 }
 
 void WebDragData::setHTMLBaseURL(const WebURL& htmlBaseURL)
 {
     ensureMutable();
-    m_private->htmlBaseUrl = htmlBaseURL;
+    m_private->setHtmlBaseUrl(htmlBaseURL);
 }
 
-WebString WebDragData::fileContentFileName() const
+WebString WebDragData::fileContentFilename() const
 {
     ASSERT(!isNull());
-    return m_private->fileContentFilename;
+    return m_private->fileContentFilename();
 }
 
-void WebDragData::setFileContentFileName(const WebString& fileName)
+void WebDragData::setFileContentFilename(const WebString& filename)
 {
     ensureMutable();
-    m_private->fileContentFilename = fileName;
+    m_private->setFileContentFilename(filename);
 }
 
 WebData WebDragData::fileContent() const
 {
     ASSERT(!isNull());
-    return WebData(m_private->fileContent);
+    return WebData(m_private->fileContent());
 }
 
 void WebDragData::setFileContent(const WebData& fileContent)
 {
     ensureMutable();
-    m_private->fileContent = fileContent;
+    m_private->setFileContent(fileContent);
 }
 
 WebDragData::WebDragData(const WTF::PassRefPtr<WebCore::ChromiumDataObject>& data)
@@ -224,8 +233,7 @@ void WebDragData::assign(WebDragDataPrivate* p)
 void WebDragData::ensureMutable()
 {
     ASSERT(!isNull());
-    if (!m_private->hasOneRef())
-        assign(static_cast<WebDragDataPrivate*>(m_private->copy().releaseRef()));
+    ASSERT(m_private->hasOneRef());
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebElement.cpp b/WebKit/chromium/src/WebElement.cpp
index 91f310d..34daa34 100644
--- a/WebKit/chromium/src/WebElement.cpp
+++ b/WebKit/chromium/src/WebElement.cpp
@@ -47,6 +47,11 @@ bool WebElement::isFormControlElement() const
     return constUnwrap<Element>()->isFormControlElement();
 }
 
+bool WebElement::isTextFormControlElement() const
+{
+    return constUnwrap<Element>()->isTextFormControl();
+}
+
 WebString WebElement::tagName() const
 {
     return constUnwrap<Element>()->tagName();
diff --git a/WebKit/chromium/src/WebEntities.cpp b/WebKit/chromium/src/WebEntities.cpp
index bfdd9f2..4e37dde 100644
--- a/WebKit/chromium/src/WebEntities.cpp
+++ b/WebKit/chromium/src/WebEntities.cpp
@@ -31,15 +31,12 @@
 #include "config.h"
 #include "WebEntities.h"
 
-#include <string.h>
-
-#include "PlatformString.h"
-#include "StringBuilder.h"
-#include <wtf/HashMap.h>
-
 #include "WebString.h"
 
-using namespace WebCore;
+#include <string.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebKit {
 
@@ -76,9 +73,9 @@ String WebEntities::convertEntitiesInString(const String& value) const
             // Append content before entity code.
             if (curPos > startPos)
                 result.append(String(startPos, curPos - startPos));
-            result.append("&");
+            result.append('&');
             result.append(m_entitiesMap.get(*curPos));
-            result.append(";");
+            result.append(';');
             startPos = ++curPos;
         } else
             curPos++;
diff --git a/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp b/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
index a23add7..f44e8f1 100644
--- a/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
@@ -34,19 +34,23 @@
 
 #include "AsyncFileSystemCallbacks.h"
 #include "AsyncFileSystemChromium.h"
-#include "ExceptionCode.h"
+#include "ScriptExecutionContext.h"
 #include "WebFileSystemEntry.h"
 #include "WebFileInfo.h"
 #include "WebString.h"
+#include "WorkerAsyncFileSystemChromium.h"
 #include <wtf/Vector.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl(PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl(PassOwnPtr<AsyncFileSystemCallbacks> callbacks, WebCore::ScriptExecutionContext* context, bool synchronous)
     : m_callbacks(callbacks)
+    , m_context(context)
+    , m_synchronous(synchronous)
 {
+    ASSERT(m_callbacks);
 }
 
 WebFileSystemCallbacksImpl::~WebFileSystemCallbacksImpl()
@@ -55,37 +59,35 @@ WebFileSystemCallbacksImpl::~WebFileSystemCallbacksImpl()
 
 void WebFileSystemCallbacksImpl::didSucceed()
 {
-    ASSERT(m_callbacks);
     m_callbacks->didSucceed();
     delete this;
 }
 
 void WebFileSystemCallbacksImpl::didReadMetadata(const WebFileInfo& info)
 {
-    ASSERT(m_callbacks);
     m_callbacks->didReadMetadata(info.modificationTime);
     delete this;
 }
 
 void WebFileSystemCallbacksImpl::didReadDirectory(const WebVector<WebFileSystemEntry>& entries, bool hasMore)
 {
-    ASSERT(m_callbacks);
     for (size_t i = 0; i < entries.size(); ++i)
         m_callbacks->didReadDirectoryEntry(entries[i].name, entries[i].isDirectory);
     m_callbacks->didReadDirectoryEntries(hasMore);
-    if (!hasMore)
-        delete this;
+    delete this;
 }
 
 void WebFileSystemCallbacksImpl::didOpenFileSystem(const WebString& name, const WebString& path)
 {
-    m_callbacks->didOpenFileSystem(name, new AsyncFileSystemChromium(path));
+    if (m_context && m_context->isWorkerContext())
+        m_callbacks->didOpenFileSystem(name, WorkerAsyncFileSystemChromium::create(m_context, path, m_synchronous));
+    else
+        m_callbacks->didOpenFileSystem(name, AsyncFileSystemChromium::create(path));
     delete this;
 }
 
 void WebFileSystemCallbacksImpl::didFail(WebFileError error)
 {
-    ASSERT(m_callbacks);
     m_callbacks->didFail(error);
     delete this;
 }
diff --git a/WebKit/chromium/src/WebFileSystemCallbacksImpl.h b/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
index 36ab9ff..75fa2bb 100644
--- a/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
+++ b/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
@@ -38,6 +38,7 @@
 
 namespace WebCore {
 class AsyncFileSystemCallbacks;
+class ScriptExecutionContext;
 }
 
 namespace WebKit {
@@ -48,7 +49,7 @@ class WebString;
 
 class WebFileSystemCallbacksImpl : public WebFileSystemCallbacks {
 public:
-    WebFileSystemCallbacksImpl(PassOwnPtr<WebCore::AsyncFileSystemCallbacks>);
+    WebFileSystemCallbacksImpl(PassOwnPtr<WebCore::AsyncFileSystemCallbacks>, WebCore::ScriptExecutionContext* = 0, bool synchronous = false);
     virtual ~WebFileSystemCallbacksImpl();
 
     virtual void didSucceed();
@@ -59,6 +60,10 @@ public:
 
 private:
     OwnPtr<WebCore::AsyncFileSystemCallbacks> m_callbacks;
+
+    // Used for worker's openFileSystem callbacks.
+    WebCore::ScriptExecutionContext* m_context;
+    bool m_synchronous;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebFontImpl.cpp b/WebKit/chromium/src/WebFontImpl.cpp
index 6fa5494..8c61997 100644
--- a/WebKit/chromium/src/WebFontImpl.cpp
+++ b/WebKit/chromium/src/WebFontImpl.cpp
@@ -103,9 +103,11 @@ void WebFontImpl::drawText(WebCanvas* canvas, const WebTextRun& run, const WebFl
     notImplemented();
 #endif
 
-    gc.setFillColor(color, DeviceColorSpace);
+    gc.save();
+    gc.setFillColor(color, ColorSpaceDeviceRGB);
     gc.clip(WebCore::FloatRect(clip));
     m_font.drawText(&gc, run, leftBaseline, from, to);
+    gc.restore();
 }
 
 int WebFontImpl::calculateWidth(const WebTextRun& run) const
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
index 1b64e5a..b4d23c0 100644
--- a/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -261,6 +261,12 @@ static void frameContentAsPlainText(size_t maxChars, Frame* frame,
     }
 }
 
+static long long generateFrameIdentifier()
+{
+    static long long next = 0;
+    return ++next;
+}
+
 WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(Frame* frame)
 {
     if (!frame)
@@ -488,6 +494,11 @@ void WebFrameImpl::setName(const WebString& name)
     m_frame->tree()->setName(name);
 }
 
+long long WebFrameImpl::identifier() const
+{
+    return m_identifier;
+}
+
 WebURL WebFrameImpl::url() const
 {
     const WebDataSource* ds = dataSource();
@@ -1759,6 +1770,13 @@ bool WebFrameImpl::pauseSVGAnimation(const WebString& animationId, double time,
 #endif
 }
 
+WebString WebFrameImpl::layerTreeAsText() const
+{
+    if (!m_frame)
+        return WebString();
+    return WebString(m_frame->layerTreeAsText());
+}
+
 // WebFrameImpl public ---------------------------------------------------------
 
 PassRefPtr<WebFrameImpl> WebFrameImpl::create(WebFrameClient* client)
@@ -1779,6 +1797,7 @@ WebFrameImpl::WebFrameImpl(WebFrameClient* client)
     , m_scopingComplete(false)
     , m_nextInvalidateAfter(0)
     , m_animationController(this)
+    , m_identifier(generateFrameIdentifier())
 {
     ChromiumBridge::incrementStatsCounter(webFrameActiveCount);
     frameCount++;
@@ -1869,7 +1888,7 @@ void WebFrameImpl::paintWithContext(GraphicsContext& gc, const WebRect& rect)
         frameView()->paint(&gc, dirtyRect);
         m_frame->page()->inspectorController()->drawNodeHighlight(gc);
     } else
-        gc.fillRect(dirtyRect, Color::white, DeviceColorSpace);
+        gc.fillRect(dirtyRect, Color::white, ColorSpaceDeviceRGB);
     gc.restore();
 }
 
@@ -2242,7 +2261,7 @@ void WebFrameImpl::loadJavaScriptURL(const KURL& url)
     if (!result.getString(scriptResult))
         return;
 
-    if (!m_frame->redirectScheduler()->locationChangePending())
+    if (!m_frame->navigationScheduler()->locationChangePending())
         m_frame->loader()->writer()->replaceDocument(scriptResult);
 }
 
diff --git a/WebKit/chromium/src/WebFrameImpl.h b/WebKit/chromium/src/WebFrameImpl.h
index d93254b..35158a1 100644
--- a/WebKit/chromium/src/WebFrameImpl.h
+++ b/WebKit/chromium/src/WebFrameImpl.h
@@ -67,6 +67,7 @@ public:
     // WebFrame methods:
     virtual WebString name() const;
     virtual void setName(const WebString&);
+    virtual long long identifier() const;
     virtual WebURL url() const;
     virtual WebURL favIconURL() const;
     virtual WebURL openSearchDescriptionURL() const;
@@ -189,6 +190,7 @@ public:
     virtual bool pauseSVGAnimation(const WebString& animationId,
                                    double time,
                                    const WebString& elementId);
+    virtual WebString layerTreeAsText() const;
 
     static PassRefPtr<WebFrameImpl> create(WebFrameClient* client);
     ~WebFrameImpl();
@@ -386,6 +388,9 @@ private:
 
     // Keeps a reference to the frame's WebAnimationController.
     WebAnimationControllerImpl m_animationController;
+
+    // The identifier of this frame.
+    long long m_identifier;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebGeolocationServiceMock.cpp b/WebKit/chromium/src/WebGeolocationServiceMock.cpp
index e149cf1..07d3f44 100644
--- a/WebKit/chromium/src/WebGeolocationServiceMock.cpp
+++ b/WebKit/chromium/src/WebGeolocationServiceMock.cpp
@@ -42,6 +42,38 @@
 
 #if ENABLE(GEOLOCATION)
 
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+// FIXME: Implement mock bindings for client-based geolocation. Ultimately
+// move to another class and remove WebGeolocationService*.
+
+namespace WebKit {
+
+class WebGeolocationServiceMockClientBasedImpl : public WebGeolocationServiceMock {
+};
+
+WebGeolocationServiceMock* WebGeolocationServiceMock::createWebGeolocationServiceMock()
+{
+    return new WebGeolocationServiceMockClientBasedImpl;
+}
+
+void WebGeolocationServiceMock::setMockGeolocationPermission(bool allowed)
+{
+    // FIXME: Implement mock binding
+}
+
+void WebGeolocationServiceMock::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    // FIXME: Implement mock binding
+}
+
+void WebGeolocationServiceMock::setMockGeolocationError(int errorCode, const WebString& message)
+{
+    // FIXME: Implement mock binding
+}
+
+} // namespace WebKit
+
+#else
 using WebCore::Coordinates;
 using WebCore::Frame;
 using WebCore::Geolocation;
@@ -241,4 +273,5 @@ void WebGeolocationServiceMockImpl::notifyPendingPermissions()
 
 } // namespace WebKit
 
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
 #endif // ENABLE(GEOLOCATION)
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
index 45bc2ee..1625eb8 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
@@ -37,6 +37,8 @@
 #include "app/gfx/gl/gl_bindings.h"
 #include "app/gfx/gl/gl_context.h"
 #include "NotImplemented.h"
+#include "WebView.h"
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/CString.h>
 
@@ -67,6 +69,7 @@ WebGraphicsContext3DDefaultImpl::VertexAttribPointerState::VertexAttribPointerSt
 
 WebGraphicsContext3DDefaultImpl::WebGraphicsContext3DDefaultImpl()
     : m_initialized(false)
+    , m_renderDirectlyToWebView(false)
     , m_texture(0)
     , m_fbo(0)
     , m_depthStencilBuffer(0)
@@ -106,25 +109,59 @@ WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl()
 
         m_glContext->Destroy();
 
+        for (ShaderSourceMap::iterator ii = m_shaderSourceMap.begin(); ii != m_shaderSourceMap.end(); ++ii) {
+            if (ii->second)
+                delete ii->second;
+        }
         angleDestroyCompilers();
     }
 }
 
 bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attributes attributes, WebView* webView, bool renderDirectlyToWebView)
 {
-    if (renderDirectlyToWebView) {
-        // This mode isn't supported with the in-process implementation yet. (FIXME)
-        return false;
-    }
-
     if (!gfx::GLContext::InitializeOneOff())
         return false;
 
-    m_glContext = WTF::adoptPtr(gfx::GLContext::CreateOffscreenGLContext(0));
+    m_renderDirectlyToWebView = renderDirectlyToWebView;
+    gfx::GLContext* shareContext = 0;
+
+    if (!renderDirectlyToWebView) {
+        // Pick up the compositor's context to share resources with.
+        WebGraphicsContext3D* viewContext = webView->graphicsContext3D();
+        if (viewContext) {
+            WebGraphicsContext3DDefaultImpl* contextImpl = static_cast<WebGraphicsContext3DDefaultImpl*>(viewContext);
+            shareContext = contextImpl->m_glContext.get();
+        } else {
+            // The compositor's context didn't get created
+            // successfully, so conceptually there is no way we can
+            // render successfully to the WebView.
+            m_renderDirectlyToWebView = false;
+        }
+    }
+
+    // This implementation always renders offscreen regardless of
+    // whether renderDirectlyToWebView is true. Both DumpRenderTree
+    // and test_shell paint first to an intermediate offscreen buffer
+    // and from there to the window, and WebViewImpl::paint already
+    // correctly handles the case where the compositor is active but
+    // the output needs to go to a WebCanvas.
+    m_glContext = WTF::adoptPtr(gfx::GLContext::CreateOffscreenGLContext(shareContext));
     if (!m_glContext)
         return false;
 
     m_attributes = attributes;
+
+    // FIXME: for the moment we disable multisampling for the compositor.
+    // It actually works in this implementation, but there are a few
+    // considerations. First, we likely want to reduce the fuzziness in
+    // these tests as much as possible because we want to run pixel tests.
+    // Second, Mesa's multisampling doesn't seem to antialias straight
+    // edges in some CSS 3D samples. Third, we don't have multisampling
+    // support for the compositor in the normal case at the time of this
+    // writing.
+    if (renderDirectlyToWebView)
+        m_attributes.antialias = false;
+
     validateAttributes();
 
     glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
@@ -159,12 +196,30 @@ void WebGraphicsContext3DDefaultImpl::validateAttributes()
 #endif
         if (!isValidVendor || !strstr(extensions, "GL_EXT_framebuffer_multisample"))
             m_attributes.antialias = false;
+
+        // Don't antialias when using Mesa to ensure more reliable testing and
+        // because it doesn't appear to multisample straight lines correctly.
+        const char* renderer = reinterpret_cast<const char*>(glGetString(GL_RENDERER));
+        if (!strncmp(renderer, "Mesa", 4))
+            m_attributes.antialias = false;
     }
     // FIXME: instead of enforcing premultipliedAlpha = true, implement the
     // correct behavior when premultipliedAlpha = false is requested.
     m_attributes.premultipliedAlpha = true;
 }
 
+void WebGraphicsContext3DDefaultImpl::resolveMultisampledFramebuffer(unsigned x, unsigned y, unsigned width, unsigned height)
+{
+    if (m_attributes.antialias) {
+        bool mustRestoreFBO = (m_boundFBO != m_multisampleFBO);
+        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
+        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
+        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+        if (mustRestoreFBO)
+            glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+    }
+}
+
 bool WebGraphicsContext3DDefaultImpl::makeContextCurrent()
 {
     return m_glContext->MakeCurrent();
@@ -218,13 +273,15 @@ bool WebGraphicsContext3DDefaultImpl::isErrorGeneratedOnOutOfBoundsAccesses()
 
 unsigned int WebGraphicsContext3DDefaultImpl::getPlatformTextureId()
 {
-    ASSERT_NOT_REACHED();
-    return 0;
+    return m_texture;
 }
 
 void WebGraphicsContext3DDefaultImpl::prepareTexture()
 {
-    ASSERT_NOT_REACHED();
+    if (!m_renderDirectlyToWebView) {
+        // We need to prepare our rendering results for the compositor.
+        resolveMultisampledFramebuffer(0, 0, m_cachedWidth, m_cachedHeight);
+    }
 }
 
 static int createTextureObject(GLenum target)
@@ -434,19 +491,8 @@ bool WebGraphicsContext3DDefaultImpl::readBackFramebuffer(unsigned char* pixels,
     // vertical flip is only a temporary solution anyway until Chrome
     // is fully GPU composited, it wasn't worth the complexity.
 
-    bool mustRestoreFBO = false;
-    if (m_attributes.antialias) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(0, 0, m_cachedWidth, m_cachedHeight, 0, 0, m_cachedWidth, m_cachedHeight, GL_COLOR_BUFFER_BIT, GL_LINEAR);
-        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-        mustRestoreFBO = true;
-    } else {
-        if (m_boundFBO != m_fbo) {
-            mustRestoreFBO = true;
-            glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-        }
-    }
+    resolveMultisampledFramebuffer(0, 0, m_cachedWidth, m_cachedHeight);
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
 
     GLint packAlignment = 4;
     bool mustRestorePackAlignment = false;
@@ -463,8 +509,7 @@ bool WebGraphicsContext3DDefaultImpl::readBackFramebuffer(unsigned char* pixels,
     if (mustRestorePackAlignment)
         glPixelStorei(GL_PACK_ALIGNMENT, packAlignment);
 
-    if (mustRestoreFBO)
-        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 
 #ifdef FLIP_FRAMEBUFFER_VERTICALLY
     if (pixels)
@@ -682,13 +727,14 @@ void WebGraphicsContext3DDefaultImpl::compileShader(WebGLId shader)
         glCompileShader(shader);
         return;
     }
-    ShaderSourceEntry& entry = result->second;
+    ShaderSourceEntry* entry = result->second;
+    ASSERT(entry);
 
-    if (!angleValidateShaderSource(entry))
+    if (!angleValidateShaderSource(*entry))
         return; // Shader didn't validate, don't move forward with compiling translated source
 
-    int shaderLength = entry.translatedSource ? strlen(entry.translatedSource) : 0;
-    glShaderSource(shader, 1, const_cast<const char**>(&entry.translatedSource), &shaderLength);
+    int shaderLength = entry->translatedSource ? strlen(entry->translatedSource) : 0;
+    glShaderSource(shader, 1, const_cast<const char**>(&entry->translatedSource), &shaderLength);
     glCompileShader(shader);
 
 #ifndef NDEBUG
@@ -704,16 +750,15 @@ void WebGraphicsContext3DDefaultImpl::copyTexImage2D(unsigned long target, long
 {
     makeContextCurrent();
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+    bool needsResolve = (m_attributes.antialias && m_boundFBO == m_multisampleFBO);
+    if (needsResolve) {
+        resolveMultisampledFramebuffer(x, y, width, height);
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     }
 
     glCopyTexImage2D(target, level, internalformat, x, y, width, height, border);
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO)
+    if (needsResolve)
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
@@ -722,16 +767,15 @@ void WebGraphicsContext3DDefaultImpl::copyTexSubImage2D(unsigned long target, lo
 {
     makeContextCurrent();
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+    bool needsResolve = (m_attributes.antialias && m_boundFBO == m_multisampleFBO);
+    if (needsResolve) {
+        resolveMultisampledFramebuffer(x, y, width, height);
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     }
 
     glCopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO)
+    if (needsResolve)
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
@@ -962,24 +1006,25 @@ void WebGraphicsContext3DDefaultImpl::getShaderiv(WebGLId shader, unsigned long
 
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
         switch (pname) {
         case GL_COMPILE_STATUS:
-            if (!entry.isValid) {
+            if (!entry->isValid) {
                 *value = 0;
                 return;
             }
             break;
         case GL_INFO_LOG_LENGTH:
-            if (!entry.isValid) {
-                *value = entry.log ? strlen(entry.log) : 0;
+            if (!entry->isValid) {
+                *value = entry->log ? strlen(entry->log) : 0;
                 if (*value)
                     (*value)++;
                 return;
             }
             break;
         case GL_SHADER_SOURCE_LENGTH:
-            *value = entry.source ? strlen(entry.source) : 0;
+            *value = entry->source ? strlen(entry->source) : 0;
             if (*value)
                 (*value)++;
             return;
@@ -995,11 +1040,12 @@ WebString WebGraphicsContext3DDefaultImpl::getShaderInfoLog(WebGLId shader)
 
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
-        if (!entry.isValid) {
-            if (!entry.log)
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
+        if (!entry->isValid) {
+            if (!entry->log)
                 return WebString();
-            WebString res = WebString::fromUTF8(entry.log, strlen(entry.log));
+            WebString res = WebString::fromUTF8(entry->log, strlen(entry->log));
             return res;
         }
     }
@@ -1025,10 +1071,11 @@ WebString WebGraphicsContext3DDefaultImpl::getShaderSource(WebGLId shader)
 
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
-        if (!entry.source)
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
+        if (!entry->source)
             return WebString();
-        WebString res = WebString::fromUTF8(entry.source, strlen(entry.source));
+        WebString res = WebString::fromUTF8(entry->source, strlen(entry->source));
         return res;
     }
 
@@ -1105,17 +1152,16 @@ void WebGraphicsContext3DDefaultImpl::readPixels(long x, long y, unsigned long w
     // FIXME: remove the two glFlush calls when the driver bug is fixed, i.e.,
     // all previous rendering calls should be done before reading pixels.
     glFlush();
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+    bool needsResolve = (m_attributes.antialias && m_boundFBO == m_multisampleFBO);
+    if (needsResolve) {
+        resolveMultisampledFramebuffer(x, y, width, height);
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
         glFlush();
     }
 
     glReadPixels(x, y, width, height, format, type, pixels);
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO)
+    if (needsResolve)
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
@@ -1151,20 +1197,86 @@ DELEGATE_TO_GL_2(sampleCoverage, SampleCoverage, double, bool)
 
 DELEGATE_TO_GL_4(scissor, Scissor, long, long, unsigned long, unsigned long)
 
+unsigned bytesPerComponent(unsigned type)
+{
+    switch (type) {
+    case GL_BYTE:
+    case GL_UNSIGNED_BYTE:
+        return 1;
+    case GL_SHORT:
+    case GL_UNSIGNED_SHORT:
+    case GL_UNSIGNED_SHORT_5_6_5:
+    case GL_UNSIGNED_SHORT_4_4_4_4:
+    case GL_UNSIGNED_SHORT_5_5_5_1:
+        return 2;
+    case GL_FLOAT:
+        return 4;
+    default:
+        return 4;
+    }
+}
+
+unsigned componentsPerPixel(unsigned format, unsigned type)
+{
+    switch (type) {
+    case GL_UNSIGNED_SHORT_5_6_5:
+    case GL_UNSIGNED_SHORT_4_4_4_4:
+    case GL_UNSIGNED_SHORT_5_5_5_1:
+        return 1;
+    default:
+        break;
+    }
+    switch (format) {
+    case GL_LUMINANCE:
+        return 1;
+    case GL_LUMINANCE_ALPHA:
+        return 2;
+    case GL_RGB:
+        return 3;
+    case GL_RGBA:
+    case GL_BGRA_EXT:
+        return 4;
+    default:
+        return 4;
+    }
+}
+
+// N.B.:  This code does not protect against integer overflow (as the command
+// buffer implementation does), so it should not be considered robust enough
+// for use in the browser.  Since this implementation is only used for layout
+// tests, this should be ok for now.
+size_t imageSizeInBytes(unsigned width, unsigned height, unsigned format, unsigned type)
+{
+    return width * height * bytesPerComponent(type) * componentsPerPixel(format, type);
+}
+
+void WebGraphicsContext3DDefaultImpl::texImage2D(unsigned target, unsigned level, unsigned internalFormat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, const void* pixels)
+{
+    OwnArrayPtr<uint8> zero;
+    if (!pixels) {
+        size_t size = imageSizeInBytes(width, height, format, type);
+        zero.set(new uint8[size]);
+        memset(zero.get(), 0, size);
+        pixels = zero.get();
+    }
+    glTexImage2D(target, level, internalFormat, width, height, border, format, type, pixels);
+}
+
 void WebGraphicsContext3DDefaultImpl::shaderSource(WebGLId shader, const char* string)
 {
     makeContextCurrent();
     GLint length = string ? strlen(string) : 0;
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
-        if (entry.source) {
-            fastFree(entry.source);
-            entry.source = 0;
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
+        if (entry->source) {
+            fastFree(entry->source);
+            entry->source = 0;
         }
-        if (!tryFastMalloc((length + 1) * sizeof(char)).getValue(entry.source))
+        if (!tryFastMalloc((length + 1) * sizeof(char)).getValue(entry->source))
             return; // FIXME: generate an error?
-        memcpy(entry.source, string, (length + 1) * sizeof(char));
+        memcpy(entry->source, string, (length + 1) * sizeof(char));
     } else
         glShaderSource(shader, 1, &string, &length);
 }
@@ -1181,8 +1293,6 @@ DELEGATE_TO_GL_3(stencilOp, StencilOp, unsigned long, unsigned long, unsigned lo
 
 DELEGATE_TO_GL_4(stencilOpSeparate, StencilOpSeparate, unsigned long, unsigned long, unsigned long, unsigned long)
 
-DELEGATE_TO_GL_9(texImage2D, TexImage2D, unsigned, unsigned, unsigned, unsigned, unsigned, unsigned, unsigned, unsigned, const void*)
-
 DELEGATE_TO_GL_3(texParameterf, TexParameterf, unsigned, unsigned, float);
 
 DELEGATE_TO_GL_3(texParameteri, TexParameteri, unsigned, unsigned, int);
@@ -1311,10 +1421,12 @@ unsigned WebGraphicsContext3DDefaultImpl::createShader(unsigned long shaderType)
     ASSERT(shaderType == GL_VERTEX_SHADER || shaderType == GL_FRAGMENT_SHADER);
     unsigned shader = glCreateShader(shaderType);
     if (shader) {
-        ShaderSourceEntry entry;
-        entry.type = shaderType;
-        m_shaderSourceMap.set(shader, entry);
+        ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
+        if (result != m_shaderSourceMap.end())
+            delete result->second;
+        m_shaderSourceMap.set(shader, new ShaderSourceEntry(shaderType));
     }
+
     return shader;
 }
 
@@ -1353,8 +1465,12 @@ void WebGraphicsContext3DDefaultImpl::deleteRenderbuffer(unsigned renderbuffer)
 void WebGraphicsContext3DDefaultImpl::deleteShader(unsigned shader)
 {
     makeContextCurrent();
+
+    ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
+    if (result != m_shaderSourceMap.end())
+        delete result->second;
+    m_shaderSourceMap.remove(result);
     glDeleteShader(shader);
-    m_shaderSourceMap.remove(shader);
 }
 
 void WebGraphicsContext3DDefaultImpl::deleteTexture(unsigned texture)
@@ -1368,29 +1484,20 @@ bool WebGraphicsContext3DDefaultImpl::angleCreateCompilers()
     if (!ShInitialize())
         return false;
 
-    TBuiltInResource resource;
-    resource.MaxVertexAttribs = 0;
-    getIntegerv(GL_MAX_VERTEX_ATTRIBS, &resource.MaxVertexAttribs);
-    resource.MaxVertexUniformVectors = 0;
-    getIntegerv(MAX_VERTEX_UNIFORM_VECTORS,
-                &resource.MaxVertexUniformVectors);
-    resource.MaxVaryingVectors = 0;
-    getIntegerv(MAX_VARYING_VECTORS,
-                &resource.MaxVaryingVectors);
-    resource.MaxVertexTextureImageUnits = 0;
-    getIntegerv(GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS, &resource.MaxVertexTextureImageUnits);
-    resource.MaxCombinedTextureImageUnits = 0;
-    getIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &resource.MaxCombinedTextureImageUnits);
-    resource.MaxTextureImageUnits = 0;
-    getIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS, &resource.MaxTextureImageUnits);
-    resource.MaxFragmentUniformVectors = 0;
-    getIntegerv(MAX_FRAGMENT_UNIFORM_VECTORS,
-                &resource.MaxFragmentUniformVectors);
+    ShBuiltInResources resources;
+    ShInitBuiltInResources(&resources);
+    getIntegerv(GL_MAX_VERTEX_ATTRIBS, &resources.MaxVertexAttribs);
+    getIntegerv(MAX_VERTEX_UNIFORM_VECTORS, &resources.MaxVertexUniformVectors);
+    getIntegerv(MAX_VARYING_VECTORS, &resources.MaxVaryingVectors);
+    getIntegerv(GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS, &resources.MaxVertexTextureImageUnits);
+    getIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &resources.MaxCombinedTextureImageUnits);
+    getIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS, &resources.MaxTextureImageUnits);
+    getIntegerv(MAX_FRAGMENT_UNIFORM_VECTORS, &resources.MaxFragmentUniformVectors);
     // Always set to 1 for OpenGL ES.
-    resource.MaxDrawBuffers = 1;
+    resources.MaxDrawBuffers = 1;
 
-    m_fragmentCompiler = ShConstructCompiler(EShLangFragment, EShSpecWebGL, &resource);
-    m_vertexCompiler = ShConstructCompiler(EShLangVertex, EShSpecWebGL, &resource);
+    m_fragmentCompiler = ShConstructCompiler(SH_FRAGMENT_SHADER, SH_WEBGL_SPEC, &resources);
+    m_vertexCompiler = ShConstructCompiler(SH_VERTEX_SHADER, SH_WEBGL_SPEC, &resources);
     return (m_fragmentCompiler && m_vertexCompiler);
 }
 
@@ -1430,7 +1537,7 @@ bool WebGraphicsContext3DDefaultImpl::angleValidateShaderSource(ShaderSourceEntr
     if (!compiler)
         return false;
 
-    if (!ShCompile(compiler, &entry.source, 1, EShOptObjectCode)) {
+    if (!ShCompile(compiler, &entry.source, 1, SH_OBJECT_CODE)) {
         int logSize = 0;
         ShGetInfo(compiler, SH_INFO_LOG_LENGTH, &logSize);
         if (logSize > 1 && tryFastMalloc(logSize * sizeof(char)).getValue(entry.log))
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
index 319d9d8..124ceac 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
@@ -273,6 +273,8 @@ public:
 private:
     WebGraphicsContext3D::Attributes m_attributes;
     bool m_initialized;
+    bool m_renderDirectlyToWebView;
+
     unsigned int m_texture;
     unsigned int m_fbo;
     unsigned int m_depthStencilBuffer;
@@ -298,6 +300,9 @@ private:
     // not be honored based on the capabilities of the OpenGL implementation.
     void validateAttributes();
 
+    // Resolve the given rectangle of the multisampled framebuffer if necessary.
+    void resolveMultisampledFramebuffer(unsigned x, unsigned y, unsigned width, unsigned height);
+
     // Note: we aren't currently using this information, but we will
     // need to in order to verify that all enabled vertex arrays have
     // a valid buffer bound -- to avoid crashes on certain cards.
@@ -327,8 +332,8 @@ private:
 
     // ANGLE related.
     struct ShaderSourceEntry {
-        ShaderSourceEntry()
-                : type(0)
+        ShaderSourceEntry(unsigned long shaderType)
+                : type(shaderType)
                 , source(0)
                 , log(0)
                 , translatedSource(0)
@@ -357,7 +362,7 @@ private:
     void angleDestroyCompilers();
     bool angleValidateShaderSource(ShaderSourceEntry& entry);
 
-    typedef HashMap<WebGLId, ShaderSourceEntry> ShaderSourceMap;
+    typedef HashMap<WebGLId, ShaderSourceEntry*> ShaderSourceMap;
     ShaderSourceMap m_shaderSourceMap;
 
     ShHandle m_fragmentCompiler;
diff --git a/WebKit/chromium/src/WebHTTPBody.cpp b/WebKit/chromium/src/WebHTTPBody.cpp
index 93b94c2..f32b64f 100644
--- a/WebKit/chromium/src/WebHTTPBody.cpp
+++ b/WebKit/chromium/src/WebHTTPBody.cpp
@@ -32,7 +32,6 @@
 #include "WebHTTPBody.h"
 
 #include "FormData.h"
-#include "WebFileInfo.h"
 
 using namespace WebCore;
 
@@ -78,8 +77,6 @@ bool WebHTTPBody::elementAt(size_t index, Element& result) const
     result.filePath.reset();
     result.fileStart = 0;
     result.fileLength = 0;
-    // FIXME: remove this line once all users of Element have been switched to use 'modificationTime'.
-    result.fileInfo.modificationTime = 0.0;
     result.modificationTime = 0.0;
     result.blobURL = KURL();
 
@@ -94,8 +91,6 @@ bool WebHTTPBody::elementAt(size_t index, Element& result) const
 #if ENABLE(BLOB)
         result.fileStart = element.m_fileStart;
         result.fileLength = element.m_fileLength;
-        // FIXME: remove this line once all users of Element have been switched to use 'modificationTime'.
-        result.fileInfo.modificationTime = element.m_expectedFileModificationTime;
         result.modificationTime = element.m_expectedFileModificationTime;
 #endif
         break;
@@ -135,12 +130,6 @@ void WebHTTPBody::appendFileRange(const WebString& filePath, long long fileStart
 #endif
 }
 
-// FIXME: Remove this method once all callers have been switched to use the method above.
-void WebHTTPBody::appendFileRange(const WebString& filePath, long long fileStart, long long fileLength, const WebFileInfo& fileInfo)
-{
-    return appendFileRange(filePath, fileStart, fileLength, fileInfo.modificationTime);
-}
-
 void WebHTTPBody::appendBlob(const WebURL& blobURL)
 {
 #if ENABLE(BLOB)
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index fe67789..14ed02e 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -33,12 +33,14 @@
 #include "IDBIndexBackendProxy.h"
 #include "IDBKey.h"
 #include "IDBObjectStoreProxy.h"
+#include "IDBTransactionBackendProxy.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBDatabase.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBIndex.h"
 #include "WebIDBKey.h"
 #include "WebIDBObjectStore.h"
+#include "WebIDBTransaction.h"
 #include "WebSerializedScriptValue.h"
 
 #if ENABLE(INDEXED_DATABASE)
@@ -89,6 +91,11 @@ void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBObjectStore* webKitInstance)
     m_callbacks->onSuccess(IDBObjectStoreProxy::create(webKitInstance));
 }
 
+void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBTransaction* webKitInstance)
+{
+    m_callbacks->onSuccess(IDBTransactionBackendProxy::create(webKitInstance));
+}
+
 void WebIDBCallbacksImpl::onSuccess(const WebKit::WebSerializedScriptValue& serializedScriptValue)
 {
     m_callbacks->onSuccess(serializedScriptValue);
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.h b/WebKit/chromium/src/WebIDBCallbacksImpl.h
index 1835c60..33a72f4 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -48,6 +48,7 @@ public:
     virtual void onSuccess(const WebKit::WebIDBKey&);
     virtual void onSuccess(WebKit::WebIDBIndex*);
     virtual void onSuccess(WebKit::WebIDBObjectStore*);
+    virtual void onSuccess(WebKit::WebIDBTransaction*);
     virtual void onSuccess(const WebKit::WebSerializedScriptValue&);
 
 private:
diff --git a/WebKit/chromium/src/WebIDBCursorImpl.cpp b/WebKit/chromium/src/WebIDBCursorImpl.cpp
index 6a1053e..eca5d42 100644
--- a/WebKit/chromium/src/WebIDBCursorImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCursorImpl.cpp
@@ -70,19 +70,19 @@ void WebIDBCursorImpl::value(WebSerializedScriptValue& serializedScriptValue, We
         ASSERT_NOT_REACHED();
 }
 
-void WebIDBCursorImpl::update(const WebSerializedScriptValue& value, WebIDBCallbacks* callbacks)
+void WebIDBCursorImpl::update(const WebSerializedScriptValue& value, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->update(value, IDBCallbacksProxy::create(callbacks));
+    m_idbCursorBackend->update(value, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-void WebIDBCursorImpl::continueFunction(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+void WebIDBCursorImpl::continueFunction(const WebIDBKey& key, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->continueFunction(key, IDBCallbacksProxy::create(callbacks));
+    m_idbCursorBackend->continueFunction(key, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-void WebIDBCursorImpl::remove(WebIDBCallbacks* callbacks)
+void WebIDBCursorImpl::remove(WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->remove(IDBCallbacksProxy::create(callbacks));
+    m_idbCursorBackend->remove(IDBCallbacksProxy::create(callbacks), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBCursorImpl.h b/WebKit/chromium/src/WebIDBCursorImpl.h
index 5fb9e1c..39fa44b 100644
--- a/WebKit/chromium/src/WebIDBCursorImpl.h
+++ b/WebKit/chromium/src/WebIDBCursorImpl.h
@@ -27,6 +27,7 @@
 #define WebIDBCursorImpl_h
 
 #include "WebCommon.h"
+#include "WebExceptionCode.h"
 #include "WebIDBCursor.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -44,9 +45,9 @@ public:
     virtual unsigned short direction() const;
     virtual WebIDBKey key() const;
     virtual void value(WebSerializedScriptValue&, WebIDBKey&) const;
-    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*);
-    virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*);
-    virtual void remove(WebIDBCallbacks*);
+    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*, WebExceptionCode&);
+    virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*, WebExceptionCode&);
+    virtual void remove(WebIDBCallbacks*, WebExceptionCode&);
 
  private:
     WTF::RefPtr<WebCore::IDBCursorBackendInterface> m_idbCursorBackend;
diff --git a/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index 8870ff9..2d95e21 100644
--- a/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -69,38 +69,38 @@ WebDOMStringList WebIDBDatabaseImpl::objectStores() const
     return m_databaseBackend->objectStores();
 }
 
-void WebIDBDatabaseImpl::createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, WebIDBCallbacks* callbacks)
+WebIDBObjectStore* WebIDBDatabaseImpl::createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_databaseBackend->createObjectStore(name, keyPath, autoIncrement, IDBCallbacksProxy::create(callbacks));
-}
-
-WebIDBObjectStore* WebIDBDatabaseImpl::objectStore(const WebString& name, unsigned short mode)
-{
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_databaseBackend->objectStore(name, mode);
+    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_databaseBackend->createObjectStore(name, keyPath, autoIncrement, transaction.getIDBTransactionBackendInterface(), ec);
     if (!objectStore)
         return 0;
     return new WebIDBObjectStoreImpl(objectStore);
 }
 
-void WebIDBDatabaseImpl::removeObjectStore(const WebString& name, WebIDBCallbacks* callbacks)
+void WebIDBDatabaseImpl::removeObjectStore(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_databaseBackend->removeObjectStore(name, IDBCallbacksProxy::create(callbacks));
+    m_databaseBackend->removeObjectStore(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* callbacks)
+void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(callbacks));
+    m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout)
+WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode& ec)
 {
     RefPtr<DOMStringList> nameList = PassRefPtr<DOMStringList>(names);
-    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, timeout);
+    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, timeout, ec);
     if (!transaction)
         return 0;
     return new WebIDBTransactionImpl(transaction);
 }
 
+void WebIDBDatabaseImpl::close()
+{
+    m_databaseBackend->close();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebKit/chromium/src/WebIDBDatabaseImpl.h b/WebKit/chromium/src/WebIDBDatabaseImpl.h
index e0eaaa5..fda4265 100644
--- a/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -27,6 +27,7 @@
 #define WebIDBDatabaseImpl_h
 
 #include "WebCommon.h"
+#include "WebExceptionCode.h"
 #include "WebIDBDatabase.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -49,11 +50,11 @@ public:
     virtual WebString version() const;
     virtual WebDOMStringList objectStores() const;
 
-    virtual void createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, WebIDBCallbacks* callbacks);
-    virtual WebIDBObjectStore* objectStore(const WebString& name, unsigned short mode);
-    virtual void removeObjectStore(const WebString& name, WebIDBCallbacks* callbacks);
-    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks);
-    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout);
+    virtual WebIDBObjectStore* createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void removeObjectStore(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&);
+    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode&);
+    virtual void close();
 
 private:
     WTF::RefPtr<WebCore::IDBDatabaseBackendInterface> m_databaseBackend;
diff --git a/WebKit/chromium/src/WebIDBFactoryImpl.cpp b/WebKit/chromium/src/WebIDBFactoryImpl.cpp
index 7147cf0..5d0ab85 100755
--- a/WebKit/chromium/src/WebIDBFactoryImpl.cpp
+++ b/WebKit/chromium/src/WebIDBFactoryImpl.cpp
@@ -58,9 +58,9 @@ WebIDBFactoryImpl::~WebIDBFactoryImpl()
 {
 }
 
-void WebIDBFactoryImpl::open(const WebString& name, const WebString& description, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame*, const WebString& dataDir)
+void WebIDBFactoryImpl::open(const WebString& name, const WebString& description, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame*, const WebString& dataDir, unsigned long long maximumSize)
 {
-    m_idbFactoryBackend->open(name, description, IDBCallbacksProxy::create(callbacks), origin, 0, dataDir);
+    m_idbFactoryBackend->open(name, description, IDBCallbacksProxy::create(callbacks), origin, 0, dataDir, maximumSize);
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebIDBFactoryImpl.h b/WebKit/chromium/src/WebIDBFactoryImpl.h
index a0a4d7d..4bc9426 100755
--- a/WebKit/chromium/src/WebIDBFactoryImpl.h
+++ b/WebKit/chromium/src/WebIDBFactoryImpl.h
@@ -42,7 +42,7 @@ public:
     WebIDBFactoryImpl();
     virtual ~WebIDBFactoryImpl();
 
-    virtual void open(const WebString& name, const WebString& description, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir);
+    virtual void open(const WebString& name, const WebString& description, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir, unsigned long long maximumSize);
 
 private:
     WTF::RefPtr<WebCore::IDBFactoryBackendInterface> m_idbFactoryBackend;
diff --git a/WebKit/chromium/src/WebIDBIndexImpl.cpp b/WebKit/chromium/src/WebIDBIndexImpl.cpp
index c049aac..6e8e1f2 100644
--- a/WebKit/chromium/src/WebIDBIndexImpl.cpp
+++ b/WebKit/chromium/src/WebIDBIndexImpl.cpp
@@ -68,24 +68,24 @@ bool WebIDBIndexImpl::unique() const
     return m_backend->unique();
 }
 
-void WebIDBIndexImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::openObjectCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->openCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks));
+    m_backend->openCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBIndexImpl::openObjectCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::openKeyCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->openObjectCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks));
+    m_backend->openKeyCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBIndexImpl::getObject(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::getObject(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->getObject(keyRange, IDBCallbacksProxy::create(callbacks));
+    m_backend->get(keyRange, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBIndexImpl::get(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::getKey(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->get(keyRange, IDBCallbacksProxy::create(callbacks));
+    m_backend->getKey(keyRange, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBIndexImpl.h b/WebKit/chromium/src/WebIDBIndexImpl.h
index 2108001..f68da7f 100644
--- a/WebKit/chromium/src/WebIDBIndexImpl.h
+++ b/WebKit/chromium/src/WebIDBIndexImpl.h
@@ -46,10 +46,10 @@ public:
     virtual WebString keyPath() const;
     virtual bool unique() const;
 
-    virtual void openObjectCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*); 
-    virtual void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*);
-    virtual void getObject(const WebIDBKey&, WebIDBCallbacks*);
-    virtual void get(const WebIDBKey&, WebIDBCallbacks*);
+    virtual void openObjectCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&); 
+    virtual void openKeyCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void getObject(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void getKey(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
 private:
     WTF::RefPtr<WebCore::IDBIndexBackendInterface> m_backend;
diff --git a/WebKit/chromium/src/WebIDBKeyRange.cpp b/WebKit/chromium/src/WebIDBKeyRange.cpp
index 4ce9452..720af5f 100644
--- a/WebKit/chromium/src/WebIDBKeyRange.cpp
+++ b/WebKit/chromium/src/WebIDBKeyRange.cpp
@@ -41,7 +41,10 @@ void WebIDBKeyRange::assign(const WebIDBKeyRange& other)
 
 void WebIDBKeyRange::assign(const WebIDBKey& left, const WebIDBKey& right, unsigned short flags)
 {
-    m_private = IDBKeyRange::create(left, right, flags);
+    if (left.type() == WebIDBKey::InvalidType && right.type() == WebIDBKey::InvalidType)
+        m_private = 0;
+    else
+        m_private = IDBKeyRange::create(left, right, flags);
 }
 
 void WebIDBKeyRange::reset()
@@ -51,16 +54,22 @@ void WebIDBKeyRange::reset()
 
 WebIDBKey WebIDBKeyRange::left() const
 {
+    if (!m_private.get())
+        return WebIDBKey::createInvalid();
     return m_private->left();
 }
 
 WebIDBKey WebIDBKeyRange::right() const
 {
+    if (!m_private.get())
+        return WebIDBKey::createInvalid();
     return m_private->right();
 }
 
 unsigned short WebIDBKeyRange::flags() const
 {
+    if (!m_private.get())
+        return 0;
     return m_private->flags();
 }
 
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 36d8ace..96495fe 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -66,42 +66,45 @@ WebDOMStringList WebIDBObjectStoreImpl::indexNames() const
     return m_objectStore->indexNames();
 }
 
-void WebIDBObjectStoreImpl::get(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction)
+void WebIDBObjectStoreImpl::get(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->get(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface());
+    m_objectStore->get(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->put(value, key, addOnly, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->put(value, key, addOnly, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::remove(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::remove(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->remove(key, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->remove(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks)
+WebIDBIndex* WebIDBObjectStoreImpl::createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->createIndex(name, keyPath, unique, IDBCallbacksProxy::create(callbacks));
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->createIndex(name, keyPath, unique, transaction.getIDBTransactionBackendInterface(), ec);
+    if (!index)
+        return 0;
+    return new WebIDBIndexImpl(index);
 }
 
-WebIDBIndex* WebIDBObjectStoreImpl::index(const WebString& name)
+WebIDBIndex* WebIDBObjectStoreImpl::index(const WebString& name, WebExceptionCode& ec)
 {
-    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name);
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name, ec);
     if (!index)
         return 0;
     return new WebIDBIndexImpl(index);
 }
 
-void WebIDBObjectStoreImpl::removeIndex(const WebString& name, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::removeIndex(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->removeIndex(name, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->removeIndex(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->openCursor(IDBKeyRange::create(keyRange.left(), keyRange.right(), keyRange.flags()), direction, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->openCursor(IDBKeyRange::create(keyRange.left(), keyRange.right(), keyRange.flags()), direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index a9f1200..9148118 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -47,15 +47,15 @@ public:
     WebString keyPath() const;
     WebDOMStringList indexNames() const;
 
-    void get(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&);
-    void put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks*);
-    void remove(const WebIDBKey& key, WebIDBCallbacks*);
+    void get(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void put(const WebSerializedScriptValue&, const WebIDBKey& key, bool addOnly, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void remove(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
-    void createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks);
-    WebIDBIndex* index(const WebString& name);
-    void removeIndex(const WebString& name, WebIDBCallbacks* callbacks);
+    WebIDBIndex* createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction&, WebExceptionCode&);
+    WebIDBIndex* index(const WebString& name, WebExceptionCode&);
+    void removeIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
 
-    void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*);
+    void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
  private:
     WTF::RefPtr<WebCore::IDBObjectStoreBackendInterface> m_objectStore;
diff --git a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
index 264ddc5..96924cf 100644
--- a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
@@ -46,9 +46,14 @@ void WebIDBTransactionCallbacksImpl::onAbort()
     m_callbacks->onAbort();
 }
 
-int WebIDBTransactionCallbacksImpl::id() const
+void WebIDBTransactionCallbacksImpl::onComplete()
 {
-    return m_callbacks->id();
+    m_callbacks->onComplete();
+}
+
+void WebIDBTransactionCallbacksImpl::onTimeout()
+{
+    m_callbacks->onTimeout();
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
index 398a679a..89b9cbe 100644
--- a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
+++ b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
@@ -42,7 +42,8 @@ public:
     virtual ~WebIDBTransactionCallbacksImpl();
 
     virtual void onAbort();
-    virtual int id() const;
+    virtual void onComplete();
+    virtual void onTimeout();
 
 private:
     RefPtr<IDBTransactionCallbacks> m_callbacks;
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index f0ece0d..e19308a 100644
--- a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -95,6 +95,14 @@ WebMediaPlayer* WebMediaPlayerClientImpl::mediaPlayer() const
 
 // WebMediaPlayerClient --------------------------------------------------------
 
+WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl()
+{
+    // VideoLayerChromium may outlive this object so make sure all frames are
+    // released.
+    if (m_videoLayer.get())
+        m_videoLayer->releaseCurrentFrame();
+}
+
 void WebMediaPlayerClientImpl::networkStateChanged()
 {
     ASSERT(m_mediaPlayer);
@@ -105,6 +113,8 @@ void WebMediaPlayerClientImpl::readyStateChanged()
 {
     ASSERT(m_mediaPlayer);
     m_mediaPlayer->readyStateChanged();
+    if (hasVideo() && supportsAcceleratedRendering() && !m_videoLayer.get())
+        m_videoLayer = VideoLayerChromium::create(0, this);
 }
 
 void WebMediaPlayerClientImpl::volumeChanged(float newVolume)
@@ -173,6 +183,11 @@ void WebMediaPlayerClientImpl::load(const String& url)
     Frame* frame = static_cast<HTMLMediaElement*>(
         m_mediaPlayer->mediaPlayerClient())->document()->frame();
 
+    // Video frame object is owned by WebMediaPlayer. Before destroying
+    // WebMediaPlayer all frames need to be released.
+    if (m_videoLayer.get())
+        m_videoLayer->releaseCurrentFrame();
+
     m_webMediaPlayer.set(createWebMediaPlayer(this, frame));
     if (m_webMediaPlayer.get())
         m_webMediaPlayer->load(KURL(ParsedURLString, url));
@@ -455,9 +470,6 @@ MediaPlayerPrivateInterface* WebMediaPlayerClientImpl::create(MediaPlayer* playe
     // if necessary.
     client->m_supportsAcceleratedCompositing =
         frame->contentRenderer()->compositor()->hasAcceleratedCompositing();
-
-    if (client->m_supportsAcceleratedCompositing)
-        client->m_videoLayer = VideoLayerChromium::create(0, client);
 #endif
 
     return client;
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index e014871..6535094 100644
--- a/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -36,6 +36,7 @@
 #include "MediaPlayerPrivate.h"
 #include "VideoFrameChromium.h"
 #include "VideoFrameProvider.h"
+#include "VideoLayerChromium.h"
 #include "WebMediaPlayerClient.h"
 #include <wtf/OwnPtr.h>
 
@@ -61,6 +62,7 @@ public:
     WebMediaPlayer* mediaPlayer() const;
 
     // WebMediaPlayerClient methods:
+    virtual ~WebMediaPlayerClientImpl();
     virtual void networkStateChanged();
     virtual void readyStateChanged();
     virtual void volumeChanged(float);
@@ -129,7 +131,7 @@ private:
     WebCore::MediaPlayer* m_mediaPlayer;
     OwnPtr<WebMediaPlayer> m_webMediaPlayer;
 #if USE(ACCELERATED_COMPOSITING)
-    RefPtr<WebCore::PlatformLayer> m_videoLayer;
+    RefPtr<WebCore::VideoLayerChromium> m_videoLayer;
     bool m_supportsAcceleratedCompositing;
 #endif
     static bool m_isEnabled;
diff --git a/WebKit/chromium/src/WebNode.cpp b/WebKit/chromium/src/WebNode.cpp
index caea589..e91d1ee 100644
--- a/WebKit/chromium/src/WebNode.cpp
+++ b/WebKit/chromium/src/WebNode.cpp
@@ -32,6 +32,7 @@
 #include "WebNode.h"
 
 #include "Document.h"
+#include "Element.h"
 #include "Frame.h"
 #include "FrameLoaderClientImpl.h"
 #include "Node.h"
@@ -144,6 +145,11 @@ bool WebNode::isTextNode() const
     return m_private->isTextNode();
 }
 
+bool WebNode::isContentEditable() const
+{
+    return m_private->isContentEditable();
+}
+
 bool WebNode::isElementNode() const
 {
     return m_private->isElementNode();
diff --git a/WebKit/chromium/src/WebNotification.cpp b/WebKit/chromium/src/WebNotification.cpp
index bfc1bec..c3b1f51 100644
--- a/WebKit/chromium/src/WebNotification.cpp
+++ b/WebKit/chromium/src/WebNotification.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(NOTIFICATIONS)
 
 #include "Notification.h"
+#include "UserGestureIndicator.h"
 
 #include "WebString.h"
 #include "WebTextDirection.h"
@@ -140,6 +141,8 @@ void WebNotification::dispatchCloseEvent(bool /* byUser */)
 
 void WebNotification::dispatchClickEvent()
 {
+    // Make sure clicks on notifications are treated as user gestures.
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     RefPtr<Event> event = Event::create(eventNames().clickEvent, false, true);
     m_private->dispatchEvent(event.release());
 }
diff --git a/WebKit/chromium/src/WebPageSerializer.cpp b/WebKit/chromium/src/WebPageSerializer.cpp
index 4f93702..1fda484 100644
--- a/WebKit/chromium/src/WebPageSerializer.cpp
+++ b/WebKit/chromium/src/WebPageSerializer.cpp
@@ -32,7 +32,6 @@
 #include "WebPageSerializer.h"
 
 #include "KURL.h"
-#include "PlatformString.h"
 
 #include "WebFrame.h"
 #include "WebPageSerializerClient.h"
@@ -41,6 +40,8 @@
 #include "WebURL.h"
 #include "WebVector.h"
 
+#include <wtf/text/StringConcatenate.h>
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -59,8 +60,7 @@ bool WebPageSerializer::serialize(WebFrame* frame,
 
 WebString WebPageSerializer::generateMetaCharsetDeclaration(const WebString& charset)
 {
-    return String::format("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=%s\">",
-                          charset.utf8().data());
+    return makeString("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=", static_cast<const String&>(charset), "\">");
 }
 
 WebString WebPageSerializer::generateMarkOfTheWebDeclaration(const WebURL& url)
@@ -72,10 +72,9 @@ WebString WebPageSerializer::generateMarkOfTheWebDeclaration(const WebURL& url)
 
 WebString WebPageSerializer::generateBaseTagDeclaration(const WebString& baseTarget)
 {
-    String targetDeclaration;
-    if (!baseTarget.isEmpty())
-        targetDeclaration = String::format(" target=\"%s\"", baseTarget.utf8().data());
-    return String::format("<base href=\".\"%s>", targetDeclaration.utf8().data());
+    if (baseTarget.isEmpty())
+        return makeString("<base href=\".\">");
+    return makeString("<base href=\".\" target=\"", static_cast<const String&>(baseTarget), "\">");
 }
 
 }  // namespace WebKit
diff --git a/WebKit/chromium/src/WebPageSerializerImpl.cpp b/WebKit/chromium/src/WebPageSerializerImpl.cpp
index 885ee25..0d85d78 100644
--- a/WebKit/chromium/src/WebPageSerializerImpl.cpp
+++ b/WebKit/chromium/src/WebPageSerializerImpl.cpp
@@ -88,8 +88,6 @@
 #include "HTMLMetaElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
-#include "PlatformString.h"
-#include "StringBuilder.h"
 #include "TextEncoding.h"
 #include "markup.h"
 
@@ -107,22 +105,22 @@ namespace WebKit {
 // contegious string is found in the page.
 static const unsigned dataBufferCapacity = 65536;
 
-WebPageSerializerImpl::SerializeDomParam::SerializeDomParam(const KURL& currentFrameURL,
+WebPageSerializerImpl::SerializeDomParam::SerializeDomParam(const KURL& url,
                                                             const TextEncoding& textEncoding,
-                                                            Document* doc,
+                                                            Document* document,
                                                             const String& directoryName)
-    : currentFrameURL(currentFrameURL)
+    : url(url)
     , textEncoding(textEncoding)
-    , doc(doc)
+    , document(document)
     , directoryName(directoryName)
-    , hasDoctype(false)
-    , hasCheckedMeta(false)
+    , isHTMLDocument(document->isHTMLDocument())
+    , haveSeenDocType(false)
+    , haveAddedCharsetDeclaration(false)
     , skipMetaElement(0)
     , isInScriptOrStyleTag(false)
-    , hasDocDeclaration(false)
+    , haveAddedXMLProcessingDirective(false)
+    , haveAddedContentsBeforeEnd(false)
 {
-    // Cache the value since we check it lots of times.
-    isHTMLDocument = doc->isHTMLDocument();
 }
 
 String WebPageSerializerImpl::preActionBeforeSerializeOpenTag(
@@ -150,41 +148,41 @@ String WebPageSerializerImpl::preActionBeforeSerializeOpenTag(
             }
         } else if (element->hasTagName(HTMLNames::htmlTag)) {
             // Check something before processing the open tag of HEAD element.
-            // First we add doc type declaration if original doc has it.
-            if (!param->hasDoctype) {
-                param->hasDoctype = true;
-                result.append(createMarkup(param->doc->doctype()));
+            // First we add doc type declaration if original document has it.
+            if (!param->haveSeenDocType) {
+                param->haveSeenDocType = true;
+                result.append(createMarkup(param->document->doctype()));
             }
 
             // Add MOTW declaration before html tag.
             // See http://msdn2.microsoft.com/en-us/library/ms537628(VS.85).aspx.
-            result.append(WebPageSerializer::generateMarkOfTheWebDeclaration(param->currentFrameURL));
+            result.append(WebPageSerializer::generateMarkOfTheWebDeclaration(param->url));
         } else if (element->hasTagName(HTMLNames::baseTag)) {
             // Comment the BASE tag when serializing dom.
             result.append("<!--");
         }
     } else {
         // Write XML declaration.
-        if (!param->hasDocDeclaration) {
-            param->hasDocDeclaration = true;
+        if (!param->haveAddedXMLProcessingDirective) {
+            param->haveAddedXMLProcessingDirective = true;
             // Get encoding info.
-            String xmlEncoding = param->doc->xmlEncoding();
+            String xmlEncoding = param->document->xmlEncoding();
             if (xmlEncoding.isEmpty())
-                xmlEncoding = param->doc->frame()->loader()->writer()->encoding();
+                xmlEncoding = param->document->frame()->loader()->writer()->encoding();
             if (xmlEncoding.isEmpty())
                 xmlEncoding = UTF8Encoding().name();
             result.append("<?xml version=\"");
-            result.append(param->doc->xmlVersion());
+            result.append(param->document->xmlVersion());
             result.append("\" encoding=\"");
             result.append(xmlEncoding);
-            if (param->doc->xmlStandalone())
+            if (param->document->xmlStandalone())
                 result.append("\" standalone=\"yes");
             result.append("\"?>\n");
         }
-        // Add doc type declaration if original doc has it.
-        if (!param->hasDoctype) {
-            param->hasDoctype = true;
-            result.append(createMarkup(param->doc->doctype()));
+        // Add doc type declaration if original document has it.
+        if (!param->haveSeenDocType) {
+            param->haveSeenDocType = true;
+            result.append(createMarkup(param->document->doctype()));
         }
     }
     return result.toString();
@@ -195,13 +193,13 @@ String WebPageSerializerImpl::postActionAfterSerializeOpenTag(
 {
     StringBuilder result;
 
-    param->hasAddedContentsBeforeEnd = false;
+    param->haveAddedContentsBeforeEnd = false;
     if (!param->isHTMLDocument)
         return result.toString();
     // Check after processing the open tag of HEAD element
-    if (!param->hasCheckedMeta
+    if (!param->haveAddedCharsetDeclaration
         && element->hasTagName(HTMLNames::headTag)) {
-        param->hasCheckedMeta = true;
+        param->haveAddedCharsetDeclaration = true;
         // Check meta element. WebKit only pre-parse the first 512 bytes
         // of the document. If the whole <HEAD> is larger and meta is the
         // end of head part, then this kind of pages aren't decoded correctly
@@ -212,7 +210,7 @@ String WebPageSerializerImpl::postActionAfterSerializeOpenTag(
         result.append(WebPageSerializer::generateMetaCharsetDeclaration(
             String(param->textEncoding.name())));
 
-        param->hasAddedContentsBeforeEnd = true;
+        param->haveAddedContentsBeforeEnd = true;
         // Will search each META which has charset declaration, and skip them all
         // in PreActionBeforeSerializeOpenTag.
     } else if (element->hasTagName(HTMLNames::scriptTag)
@@ -259,7 +257,7 @@ String WebPageSerializerImpl::postActionAfterSerializeEndTag(
         result.append("-->");
         // Append a new base tag declaration.
         result.append(WebPageSerializer::generateBaseTagDeclaration(
-            param->doc->baseTarget()));
+            param->document->baseTarget()));
     }
 
     return result.toString();
@@ -271,27 +269,27 @@ void WebPageSerializerImpl::saveHTMLContentToBuffer(
     m_dataBuffer.append(result);
     encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsNotFinished,
                          param,
-                         0);
+                         DoNotForceFlush);
 }
 
 void WebPageSerializerImpl::encodeAndFlushBuffer(
     WebPageSerializerClient::PageSerializationStatus status,
     SerializeDomParam* param,
-    bool force)
+    FlushOption flushOption)
 {
     // Data buffer is not full nor do we want to force flush.
-    if (!force && m_dataBuffer.length() <= dataBufferCapacity)
+    if (flushOption != ForceFlush && m_dataBuffer.length() <= dataBufferCapacity)
         return;
 
     String content = m_dataBuffer.toString();
-    m_dataBuffer.clear();
+    m_dataBuffer = StringBuilder();
 
     // Convert the unicode content to target encoding
     CString encodedContent = param->textEncoding.encode(
         content.characters(), content.length(), EntitiesForUnencodables);
 
     // Send result to the client.
-    m_client->didSerializeDataForFrame(param->currentFrameURL,
+    m_client->didSerializeDataForFrame(param->url,
                                        WebCString(encodedContent.data(), encodedContent.length()),
                                        status);
 }
@@ -329,7 +327,7 @@ void WebPageSerializerImpl::openTagToString(const Element* element,
                         result += attrValue;
                     else {
                         // Get the absolute link
-                        String completeURL = param->doc->completeURL(attrValue);
+                        String completeURL = param->document->completeURL(attrValue);
                         // Check whether we have local files for those link.
                         if (m_localLinks.contains(completeURL)) {
                             if (!m_localDirectoryName.isEmpty())
@@ -352,7 +350,7 @@ void WebPageSerializerImpl::openTagToString(const Element* element,
     // Do post action for open tag.
     String addedContents = postActionAfterSerializeOpenTag(element, param);
     // Complete the open tag for element when it has child/children.
-    if (element->hasChildNodes() || param->hasAddedContentsBeforeEnd)
+    if (element->hasChildNodes() || param->haveAddedContentsBeforeEnd)
         result += ">";
     // Append the added contents generate in  post action of open tag.
     result += addedContents;
@@ -372,7 +370,7 @@ void WebPageSerializerImpl::endTagToString(const Element* element,
     if (needSkip)
         return;
     // Write end tag when element has child/children.
-    if (element->hasChildNodes() || param->hasAddedContentsBeforeEnd) {
+    if (element->hasChildNodes() || param->haveAddedContentsBeforeEnd) {
         result += "</";
         result += element->nodeName().lower();
         result += ">";
@@ -422,7 +420,7 @@ void WebPageSerializerImpl::buildContentForNode(const Node* node,
         break;
     // Document type node can be in DOM?
     case Node::DOCUMENT_TYPE_NODE:
-        param->hasDoctype = true;
+        param->haveSeenDocType = true;
     default:
         // For other type node, call default action.
         saveHTMLContentToBuffer(createMarkup(node), param);
@@ -456,7 +454,7 @@ WebPageSerializerImpl::WebPageSerializerImpl(WebFrame* frame,
         m_localLinks.set(url.string(), localPaths[i]);
     }
 
-    ASSERT(!m_dataBuffer.length());
+    ASSERT(m_dataBuffer.isEmpty());
 }
 
 void WebPageSerializerImpl::collectTargetFrames()
@@ -491,55 +489,37 @@ void WebPageSerializerImpl::collectTargetFrames()
 
 bool WebPageSerializerImpl::serialize()
 {
-    // Collect target frames.
     if (!m_framesCollected)
         collectTargetFrames();
+
     bool didSerialization = false;
-    // Get KURL for main frame.
-    KURL mainPageURL = m_specifiedWebFrameImpl->frame()->loader()->url();
+    KURL mainURL = m_specifiedWebFrameImpl->frame()->document()->url();
 
-    // Go through all frames for serializing DOM for whole page, include
-    // sub-frames.
-    for (int i = 0; i < static_cast<int>(m_frames.size()); ++i) {
-        // Get current serializing frame.
-        WebFrameImpl* currentFrame = m_frames[i];
-        // Get current using document.
-        Document* currentDoc = currentFrame->frame()->document();
-        // Get current frame's URL.
-        const KURL& currentFrameURL = currentFrame->frame()->loader()->url();
-
-        // Check whether we have done this document.
-        if (currentFrameURL.isValid() && m_localLinks.contains(currentFrameURL.string())) {
-            // A new document, we will serialize it.
-            didSerialization = true;
-            // Get target encoding for current document.
-            String encoding = currentFrame->frame()->loader()->writer()->encoding();
-            // Create the text encoding object with target encoding.
-            TextEncoding textEncoding(encoding);
-            // Construct serialize parameter for late processing document.
-            SerializeDomParam param(currentFrameURL,
-                                    encoding.length() ? textEncoding : UTF8Encoding(),
-                                    currentDoc,
-                                    currentFrameURL == mainPageURL ? m_localDirectoryName : "");
-
-            // Process current document.
-            Element* rootElement = currentDoc->documentElement();
-            if (rootElement)
-                buildContentForNode(rootElement, &param);
-
-            // Flush the remainder data and finish serializing current frame.
-            encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsFinished,
-                                 &param,
-                                 1);
-        }
+    for (unsigned i = 0; i < m_frames.size(); ++i) {
+        WebFrameImpl* webFrame = m_frames[i];
+        Document* document = webFrame->frame()->document();
+        const KURL& url = document->url();
+
+        if (!url.isValid() || !m_localLinks.contains(url.string()))
+            continue;
+
+        didSerialization = true;
+
+        String encoding = webFrame->frame()->loader()->writer()->encoding();
+        const TextEncoding& textEncoding = encoding.isEmpty() ? UTF8Encoding() : TextEncoding(encoding);
+        String directoryName = url == mainURL ? m_localDirectoryName : "";
+
+        SerializeDomParam param(url, textEncoding, document, directoryName);
+
+        Element* documentElement = document->documentElement();
+        if (documentElement)
+            buildContentForNode(documentElement, &param);
+
+        encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsFinished, &param, ForceFlush);
     }
 
-    // We have done call frames, so we send message to embedder to tell it that
-    // frames are finished serializing.
-    ASSERT(!m_dataBuffer.length());
-    m_client->didSerializeDataForFrame(KURL(),
-                                       WebCString("", 0),
-                                       WebPageSerializerClient::AllFramesAreFinished);
+    ASSERT(m_dataBuffer.isEmpty());
+    m_client->didSerializeDataForFrame(KURL(), WebCString("", 0), WebPageSerializerClient::AllFramesAreFinished);
     return didSerialization;
 }
 
diff --git a/WebKit/chromium/src/WebPageSerializerImpl.h b/WebKit/chromium/src/WebPageSerializerImpl.h
index a7f2fb4..5ee8805 100644
--- a/WebKit/chromium/src/WebPageSerializerImpl.h
+++ b/WebKit/chromium/src/WebPageSerializerImpl.h
@@ -31,12 +31,12 @@
 #ifndef WebPageSerializerImpl_h
 #define WebPageSerializerImpl_h
 
-#include "PlatformString.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringHash.h>
-#include "StringBuilder.h"
+#include <wtf/text/WTFString.h>
 
 #include "WebEntities.h"
 #include "WebPageSerializer.h"
@@ -98,7 +98,7 @@ private:
     // original link.
     LinkLocalPathMap m_localLinks;
     // Data buffer for saving result of serialized DOM data.
-    WebCore::StringBuilder m_dataBuffer;
+    StringBuilder m_dataBuffer;
     // Passing true to recursive_serialization_ indicates we will serialize not
     // only the specified frame but also all sub-frames in the specific frame.
     // Otherwise we only serialize the specified frame excluded all sub-frames.
@@ -116,42 +116,26 @@ private:
     WebEntities m_xmlEntities;
 
     struct SerializeDomParam {
-        // Frame URL of current processing document presented by GURL
-        const WebCore::KURL& currentFrameURL;
-        // Current using text encoding object.
+        const WebCore::KURL& url;
         const WebCore::TextEncoding& textEncoding;
-
-        // Document object of current frame.
-        WebCore::Document* doc;
-        // Local directory name of all local resource files.
+        WebCore::Document* document;
         const WTF::String& directoryName;
-
-        // Flag indicates current doc is html document or not. It's a cache value
-        // of Document.isHTMLDocument().
-        bool isHTMLDocument;
-        // Flag which indicate whether we have met document type declaration.
-        bool hasDoctype;
-        // Flag which indicate whether will process meta issue.
-        bool hasCheckedMeta;
+        bool isHTMLDocument; // document.isHTMLDocument()
+        bool haveSeenDocType;
+        bool haveAddedCharsetDeclaration;
         // This meta element need to be skipped when serializing DOM.
         const WebCore::Element* skipMetaElement;
         // Flag indicates we are in script or style tag.
         bool isInScriptOrStyleTag;
-        // Flag indicates whether we have written xml document declaration.
-        // It is only used in xml document
-        bool hasDocDeclaration;
+        bool haveAddedXMLProcessingDirective;
         // Flag indicates whether we have added additional contents before end tag.
         // This flag will be re-assigned in each call of function
         // PostActionAfterSerializeOpenTag and it could be changed in function
         // PreActionBeforeSerializeEndTag if the function adds new contents into
         // serialization stream.
-        bool hasAddedContentsBeforeEnd;
+        bool haveAddedContentsBeforeEnd;
 
-        // Constructor.
-        SerializeDomParam(const WebCore::KURL& currentFrameURL,
-                          const WebCore::TextEncoding& textEncoding,
-                          WebCore::Document* doc,
-                          const WTF::String& directoryName);
+        SerializeDomParam(const WebCore::KURL&, const WebCore::TextEncoding&, WebCore::Document*, const WTF::String& directoryName);
     };
 
     // Collect all target frames which need to be serialized.
@@ -177,12 +161,18 @@ private:
     // Save generated html content to data buffer.
     void saveHTMLContentToBuffer(const WTF::String& content,
                                  SerializeDomParam* param);
+
+    enum FlushOption {
+        ForceFlush,
+        DoNotForceFlush,
+    };
+
     // Flushes the content buffer by encoding and sending the content to the
     // WebPageSerializerClient. Content is not flushed if the buffer is not full
     // unless force is 1.
     void encodeAndFlushBuffer(WebPageSerializerClient::PageSerializationStatus status,
                               SerializeDomParam* param,
-                              bool force);
+                              FlushOption);
     // Serialize open tag of an specified element.
     void openTagToString(const WebCore::Element* element,
                          SerializeDomParam* param);
diff --git a/WebKit/chromium/src/WebPasswordFormUtils.cpp b/WebKit/chromium/src/WebPasswordFormUtils.cpp
index 6968e1a..b4997e5 100644
--- a/WebKit/chromium/src/WebPasswordFormUtils.cpp
+++ b/WebKit/chromium/src/WebPasswordFormUtils.cpp
@@ -98,9 +98,8 @@ void findPasswordFormFields(HTMLFormElement* form, PasswordFormFields* fields)
             if (!inputElement->isEnabledFormControl())
                 continue;
 
-            // FIXME: This needs to use a function other than deprecatedInputType.
-            // Does this really want to special-case TEXT, and not other text-field-like input elements?
-            if ((inputElement->deprecatedInputType() == HTMLInputElement::TEXT)
+            // Various input types such as text, url, email can be a username field.
+            if ((inputElement->isTextField() && !inputElement->isPasswordField())
                 && (inputElement->autoComplete())) {
                 fields->userName = inputElement;
                 break;
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.cpp b/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 7f74db2..58deecc 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -48,6 +48,7 @@
 #include "WebURLError.h"
 #include "WebURLRequest.h"
 #include "WebVector.h"
+#include "WebViewImpl.h"
 #include "WrappedResourceResponse.h"
 
 #include "EventNames.h"
@@ -348,6 +349,12 @@ void WebPluginContainerImpl::loadFrameRequest(
         SendReferrer);
 }
 
+void WebPluginContainerImpl::zoomLevelChanged(double zoomLevel)
+{
+    WebViewImpl* view = WebViewImpl::fromPage(m_element->document()->frame()->page());
+    view->fullFramePluginZoomLevelChanged(zoomLevel);
+}
+
 void WebPluginContainerImpl::didReceiveResponse(const ResourceResponse& response)
 {
     // Make sure that the plugin receives window geometry before data, or else
@@ -461,6 +468,16 @@ void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
         }
     }
 
+    const WebInputEvent* currentInputEvent = WebViewImpl::currentInputEvent();
+
+    // Copy stashed info over, and only copy here in order not to interfere
+    // the ctrl-c logic above.
+    if (currentInputEvent
+        && WebInputEvent::isKeyboardEventType(currentInputEvent->type)) {
+        webEvent.modifiers |= currentInputEvent->modifiers &
+            (WebInputEvent::CapsLockOn | WebInputEvent::NumLockOn);
+    }
+
     WebCursorInfo cursorInfo;
     if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
         event->setDefaultHandled();
@@ -541,11 +558,20 @@ static bool checkStackOnTop(
                     return false;
             }
 
-            // For compatibility with IE: when the plugin is not positioned,
-            // it stacks behind the iframe, even if it's later in the
-            // document order.
-            if (ro2->style()->position() == StaticPosition)
+            // If the plugin does not have an explicit z-index it stacks behind the iframe.
+            // This is for maintaining compatibility with IE.
+            if (ro2->style()->position() == StaticPosition) {
+                // The 0'th elements of these RenderObject arrays represent the plugin node and
+                // the iframe.
+                const RenderObject* pluginRenderObject = pluginZstack[0];
+                const RenderObject* iframeRenderObject = iframeZstack[0];
+
+                if (pluginRenderObject->style() && iframeRenderObject->style()) {
+                    if (pluginRenderObject->style()->zIndex() > iframeRenderObject->style()->zIndex())
+                        return false;
+                }
                 return true;
+            }
 
             // Inspect the document order.  Later order means higher
             // stacking.
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.h b/WebKit/chromium/src/WebPluginContainerImpl.h
index 2a46e00..27f5f2e 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -73,6 +73,7 @@ public:
     virtual void setParentVisible(bool);
     virtual void setParent(WebCore::ScrollView*);
     virtual void widgetPositionsUpdated();
+    virtual bool isPluginContainer() const { return true; }
 
     // WebPluginContainer methods
     virtual WebElement element();
@@ -83,6 +84,7 @@ public:
     virtual NPObject* scriptableObjectForElement();
     virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
     virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
+    virtual void zoomLevelChanged(double zoomLevel);
 
     // This cannot be null.
     WebPlugin* plugin() { return m_webPlugin; }
diff --git a/WebKit/chromium/src/WebResourceRawHeaders.cpp b/WebKit/chromium/src/WebResourceRawHeaders.cpp
new file mode 100644
index 0000000..259365e
--- /dev/null
+++ b/WebKit/chromium/src/WebResourceRawHeaders.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebResourceRawHeaders.h"
+
+#include "ResourceRawHeaders.h"
+#include "ResourceResponse.h"
+#include "WebHTTPHeaderVisitor.h"
+#include "WebString.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebResourceRawHeaders::initialize()
+{
+    m_private = adoptRef(new ResourceRawHeaders());
+}
+
+void WebResourceRawHeaders::reset()
+{
+    m_private.reset();
+}
+
+void WebResourceRawHeaders::assign(const WebResourceRawHeaders& r)
+{
+    m_private = r.m_private;
+}
+
+WebResourceRawHeaders::WebResourceRawHeaders(WTF::PassRefPtr<WebCore::ResourceRawHeaders> value)
+{
+    m_private = value;
+}
+
+WebResourceRawHeaders::operator WTF::PassRefPtr<WebCore::ResourceRawHeaders>() const
+{
+    return m_private.get();
+}
+
+static void addHeader(HTTPHeaderMap* map, const WebString& name, const WebString& value)
+{
+    pair<HTTPHeaderMap::iterator, bool> result = map->add(name, value);
+    if (!result.second)
+        result.first->second += String("\n") + value;
+}
+
+void WebResourceRawHeaders::addRequestHeader(const WebString& name, const WebString& value)
+{
+    ASSERT(!m_private.isNull());
+    addHeader(&m_private->requestHeaders, name, value);
+}
+
+void WebResourceRawHeaders::addResponseHeader(const WebString& name, const WebString& value)
+{
+    ASSERT(!m_private.isNull());
+    addHeader(&m_private->responseHeaders, name, value);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebRuntimeFeatures.cpp b/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 2279eeb..edb0413 100644
--- a/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -171,14 +171,14 @@ bool WebRuntimeFeatures::isGeolocationEnabled()
 void WebRuntimeFeatures::enableIndexedDatabase(bool enable)
 {
 #if ENABLE(INDEXED_DATABASE)
-    RuntimeEnabledFeatures::setIndexedDBEnabled(enable);
+    RuntimeEnabledFeatures::setWebkitIndexedDBEnabled(enable);
 #endif
 }
 
 bool WebRuntimeFeatures::isIndexedDatabaseEnabled()
 {
 #if ENABLE(INDEXED_DATABASE)
-    return RuntimeEnabledFeatures::indexedDBEnabled();
+    return RuntimeEnabledFeatures::webkitIndexedDBEnabled();
 #else
     return false;
 #endif
diff --git a/WebKit/chromium/src/WebScriptController.cpp b/WebKit/chromium/src/WebScriptController.cpp
index 8877ba0..0aa11a6 100644
--- a/WebKit/chromium/src/WebScriptController.cpp
+++ b/WebKit/chromium/src/WebScriptController.cpp
@@ -46,18 +46,6 @@ void WebScriptController::registerExtension(v8::Extension* extension)
     V8Proxy::registerExtension(extension);
 }
 
-void WebScriptController::registerExtension(v8::Extension* extension,
-                                            const WebString& schemeRestriction)
-{
-    V8Proxy::registerExtension(extension, schemeRestriction);
-}
-
-void WebScriptController::registerExtension(v8::Extension* extension,
-                                            int extensionGroup)
-{
-    V8Proxy::registerExtension(extension, extensionGroup);
-}
-
 void WebScriptController::enableV8SingleThreadMode()
 {
     enableStringImplCache();
diff --git a/WebKit/chromium/src/WebSearchableFormData.cpp b/WebKit/chromium/src/WebSearchableFormData.cpp
index 5fc51ca..50192eb 100644
--- a/WebKit/chromium/src/WebSearchableFormData.cpp
+++ b/WebKit/chromium/src/WebSearchableFormData.cpp
@@ -166,26 +166,19 @@ bool HasSuitableTextElement(const HTMLFormElement* form, Vector<char>* encodedSt
 
         bool isTextElement = false;
         if (formElement->hasTagName(HTMLNames::inputTag)) {
-            if (static_cast<const HTMLInputElement*>(formElement)->isFileUpload()) {
+            const HTMLInputElement* input = static_cast<const HTMLInputElement*>(formElement);
+            if (input->isFileUpload()) {
                 // Too big, don't try to index this.
                 return 0;
             }
 
-            if (static_cast<const HTMLInputElement*>(formElement)->isPasswordField()) {
+            if (input->isPasswordField()) {
                 // Don't store passwords! This is most likely an https anyway.
                 return 0;
             }
 
-            // FIXME: This needs to use a function on HTMLInputElement other than deprecatedInputType.
-            // Also, it's not clear why TEXT should be handled differently than, say, SEARCH.
-            switch (static_cast<const HTMLInputElement*>(formElement)->deprecatedInputType()) {
-            case HTMLInputElement::TEXT:
-            case HTMLInputElement::ISINDEX:
+            if (input->isTextField())
                 isTextElement = true;
-                break;
-            default:
-                break;
-            }
       }
 
       FormDataList dataList(encoding);
diff --git a/WebKit/chromium/src/WebThreadSafeData.cpp b/WebKit/chromium/src/WebThreadSafeData.cpp
new file mode 100755
index 0000000..facaba3
--- /dev/null
+++ b/WebKit/chromium/src/WebThreadSafeData.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebThreadSafeData.h"
+
+#include "BlobData.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebThreadSafeData::reset()
+{
+    m_private.reset();
+}
+
+void WebThreadSafeData::assign(const WebThreadSafeData& other)
+{
+    m_private = other.m_private;
+}
+
+size_t WebThreadSafeData::size() const
+{
+    if (m_private.isNull())
+        return 0;
+    return m_private->length();
+}
+
+const char* WebThreadSafeData::data() const
+{
+    if (m_private.isNull())
+        return 0;
+    return m_private->data();
+}
+
+WebThreadSafeData::WebThreadSafeData(const PassRefPtr<RawData>& data)
+    : m_private(data.releaseRef())
+{
+}
+
+WebThreadSafeData& WebThreadSafeData::operator=(const PassRefPtr<RawData>& data)
+{
+    m_private = data;
+    return *this;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLRequest.cpp b/WebKit/chromium/src/WebURLRequest.cpp
index 2950076..b243420 100644
--- a/WebKit/chromium/src/WebURLRequest.cpp
+++ b/WebKit/chromium/src/WebURLRequest.cpp
@@ -201,6 +201,16 @@ bool WebURLRequest::reportLoadTiming() const
     return m_private->m_resourceRequest->reportLoadTiming();
 }
 
+void WebURLRequest::setReportRawHeaders(bool reportRawHeaders)
+{
+    m_private->m_resourceRequest->setReportRawHeaders(reportRawHeaders);
+}
+
+bool WebURLRequest::reportRawHeaders() const
+{
+    return m_private->m_resourceRequest->reportRawHeaders();
+}
+
 void WebURLRequest::setReportLoadTiming(bool reportLoadTiming)
 {
     m_private->m_resourceRequest->setReportLoadTiming(reportLoadTiming);
diff --git a/WebKit/chromium/src/WebURLResponse.cpp b/WebKit/chromium/src/WebURLResponse.cpp
index aae413c..5343921 100644
--- a/WebKit/chromium/src/WebURLResponse.cpp
+++ b/WebKit/chromium/src/WebURLResponse.cpp
@@ -129,6 +129,16 @@ void WebURLResponse::setLoadTiming(const WebURLLoadTiming& timing)
     m_private->m_resourceResponse->setResourceLoadTiming(loadTiming.release());
 }
 
+WebResourceRawHeaders WebURLResponse::resourceRawHeaders()
+{
+    return WebResourceRawHeaders(m_private->m_resourceResponse->resourceRawHeaders());
+}
+
+void WebURLResponse::setResourceRawHeaders(const WebResourceRawHeaders& value)
+{
+    m_private->m_resourceResponse->setResourceRawHeaders(value);
+}
+
 double WebURLResponse::responseTime() const
 {
     return m_private->m_resourceResponse->responseTime();
diff --git a/WebKit/chromium/src/WebURLResponsePrivate.h b/WebKit/chromium/src/WebURLResponsePrivate.h
index dc5ce22..4181e4c 100644
--- a/WebKit/chromium/src/WebURLResponsePrivate.h
+++ b/WebKit/chromium/src/WebURLResponsePrivate.h
@@ -31,6 +31,7 @@
 #ifndef WebURLResponsePrivate_h
 #define WebURLResponsePrivate_h
 
+#include "WebResourceRawHeaders.h"
 #include "WebString.h"
 
 namespace WebCore { class ResourceResponse; }
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index c3df0c7..aeab400 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -88,7 +88,6 @@
 #include "SecurityOrigin.h"
 #include "SelectionController.h"
 #include "Settings.h"
-#include "SharedGraphicsContext3D.h"
 #include "Timer.h"
 #include "TypingCommand.h"
 #include "UserGestureIndicator.h"
@@ -143,9 +142,10 @@ namespace WebKit {
 // zooms text in or out (ie., change by 20%).  The min and max values limit
 // text zoom to half and 3x the original text size.  These three values match
 // those in Apple's port in WebKit/WebKit/WebView/WebView.mm
-static const double textSizeMultiplierRatio = 1.2;
-static const double minTextSizeMultiplier = 0.5;
-static const double maxTextSizeMultiplier = 3.0;
+const double WebView::textSizeMultiplierRatio = 1.2;
+const double WebView::minTextSizeMultiplier = 0.5;
+const double WebView::maxTextSizeMultiplier = 3.0;
+
 
 // The group name identifies a namespace of pages.  Page group is used on OSX
 // for some programs that use HTML views to display things that don't seem like
@@ -250,7 +250,8 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_newNavigationLoader(0)
 #endif
     , m_zoomLevel(0)
-    , m_zoomTextOnly(false)
+    , m_minimumZoomLevel(zoomFactorToZoomLevel(minTextSizeMultiplier))
+    , m_maximumZoomLevel(zoomFactorToZoomLevel(maxTextSizeMultiplier))
     , m_contextMenuAllowed(false)
     , m_doingDragAndDrop(false)
     , m_ignoreInputEvents(false)
@@ -985,7 +986,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
         gc.scale(FloatSize(1.0f, -1.0f));
         // Use invertRect in next line, so that transform above inverts it back to
         // desired destination rect.
-        gc.drawImageBuffer(imageBuffer.get(), DeviceColorSpace, invertRect.location());
+        gc.drawImageBuffer(imageBuffer.get(), ColorSpaceDeviceRGB, invertRect.location());
         gc.restore();
     }
 }
@@ -1481,6 +1482,10 @@ void WebViewImpl::setInitialFocus(bool reverse)
     keyboardEvent.windowsKeyCode = 0x09;
     PlatformKeyboardEventBuilder platformEvent(keyboardEvent);
     RefPtr<KeyboardEvent> webkitEvent = KeyboardEvent::create(platformEvent, 0);
+
+    Frame* frame = page()->focusController()->focusedOrMainFrame();
+    if (Document* document = frame->document())
+        document->setFocusedNode(0);
     page()->focusController()->setInitialFocus(
         reverse ? FocusDirectionBackward : FocusDirectionForward,
         webkitEvent.get());
@@ -1520,36 +1525,69 @@ void WebViewImpl::clearFocusedNode()
     }
 }
 
-int WebViewImpl::zoomLevel()
+void WebViewImpl::scrollFocusedNodeIntoView()
+{
+    Node* focusedNode = focusedWebCoreNode();
+    if (focusedNode && focusedNode->isElementNode()) {
+        Element* elementNode = static_cast<Element*>(focusedNode);
+        elementNode->scrollIntoViewIfNeeded(true);
+    }
+}
+
+double WebViewImpl::zoomLevel()
 {
     return m_zoomLevel;
 }
 
-int WebViewImpl::setZoomLevel(bool textOnly, int zoomLevel)
+double WebViewImpl::setZoomLevel(bool textOnly, double zoomLevel)
 {
-    float zoomFactor = static_cast<float>(
-        std::max(std::min(std::pow(textSizeMultiplierRatio, zoomLevel),
-                          maxTextSizeMultiplier),
-                 minTextSizeMultiplier));
+    if (zoomLevel < m_minimumZoomLevel)
+        m_zoomLevel = m_minimumZoomLevel;
+    else if (zoomLevel > m_maximumZoomLevel)
+        m_zoomLevel = m_maximumZoomLevel;
+    else
+        m_zoomLevel = zoomLevel;
+
     Frame* frame = mainFrameImpl()->frame();
+    WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
+    if (pluginContainer)
+        pluginContainer->plugin()->setZoomLevel(m_zoomLevel, textOnly);
+    else {
+        double zoomFactor = zoomLevelToZoomFactor(m_zoomLevel);
+        if (textOnly)
+            frame->setPageAndTextZoomFactors(1, zoomFactor);
+        else
+            frame->setPageAndTextZoomFactors(zoomFactor, 1);
+    }
+    return m_zoomLevel;
+}
 
-    float oldZoomFactor = m_zoomTextOnly ? frame->textZoomFactor() : frame->pageZoomFactor();
+void WebViewImpl::zoomLimitsChanged(double minimumZoomLevel,
+                                    double maximumZoomLevel)
+{
+    m_minimumZoomLevel = minimumZoomLevel;
+    m_maximumZoomLevel = maximumZoomLevel;
+    m_client->zoomLimitsChanged(m_minimumZoomLevel, m_maximumZoomLevel);
+}
 
-    if (textOnly)
-        frame->setPageAndTextZoomFactors(1, zoomFactor);
-    else
-        frame->setPageAndTextZoomFactors(zoomFactor, 1);
+void WebViewImpl::fullFramePluginZoomLevelChanged(double zoomLevel)
+{
+    if (zoomLevel == m_zoomLevel)
+        return;
 
-    if (oldZoomFactor != zoomFactor || textOnly != m_zoomTextOnly) {
-        WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
-        if (pluginContainer)
-            pluginContainer->plugin()->setZoomFactor(zoomFactor, textOnly);
-    }
+    m_zoomLevel = std::max(std::min(zoomLevel, m_maximumZoomLevel), m_minimumZoomLevel);
+    m_client->zoomLevelChanged();
+}
 
-    m_zoomLevel = zoomLevel;
-    m_zoomTextOnly = textOnly;
+double WebView::zoomLevelToZoomFactor(double zoomLevel)
+{
+    return std::pow(textSizeMultiplierRatio, zoomLevel);
+}
 
-    return m_zoomLevel;
+double WebView::zoomFactorToZoomLevel(double factor)
+{
+    // Since factor = 1.2^level, level = log(factor) / log(1.2)
+    return log(factor) / log(textSizeMultiplierRatio);
 }
 
 void WebViewImpl::performMediaPlayerAction(const WebMediaPlayerAction& action,
@@ -1652,6 +1690,21 @@ WebDragOperation WebViewImpl::dragTargetDragEnter(
     return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
 }
 
+WebDragOperation WebViewImpl::dragTargetDragEnterNew(
+    int identity,
+    const WebPoint& clientPoint,
+    const WebPoint& screenPoint,
+    WebDragOperationsMask operationsAllowed)
+{
+    ASSERT(!m_currentDragData.get());
+
+    m_currentDragData = ChromiumDataObject::createReadable(Clipboard::DragAndDrop);
+    m_dragIdentity = identity;
+    m_operationsAllowed = operationsAllowed;
+
+    return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
+}
+
 WebDragOperation WebViewImpl::dragTargetDragOver(
     const WebPoint& clientPoint,
     const WebPoint& screenPoint,
@@ -2228,10 +2281,11 @@ void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect&
         return;
 
     IntRect contentRect = view->visibleContentRect(false);
+    IntRect screenRect = view->contentsToWindow(contentRect);
 
     // We support fast scrolling in one direction at a time.
     if (scrollDelta.width() && scrollDelta.height()) {
-        invalidateRootLayerRect(WebRect(contentRect));
+        invalidateRootLayerRect(WebRect(screenRect));
         return;
     }
 
@@ -2241,29 +2295,43 @@ void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect&
     IntRect damagedContentsRect;
     if (scrollDelta.width()) {
         int dx = scrollDelta.width();
-        damagedContentsRect.setY(contentRect.y());
-        damagedContentsRect.setHeight(contentRect.height());
+        damagedContentsRect.setY(screenRect.y());
+        damagedContentsRect.setHeight(screenRect.height());
         if (dx > 0) {
-            damagedContentsRect.setX(contentRect.x());
+            damagedContentsRect.setX(screenRect.x());
             damagedContentsRect.setWidth(dx);
         } else {
-            damagedContentsRect.setX(contentRect.right() + dx);
+            damagedContentsRect.setX(screenRect.right() + dx);
             damagedContentsRect.setWidth(-dx);
         }
     } else {
         int dy = scrollDelta.height();
-        damagedContentsRect.setX(contentRect.x());
-        damagedContentsRect.setWidth(contentRect.width());
+        damagedContentsRect.setX(screenRect.x());
+        damagedContentsRect.setWidth(screenRect.width());
         if (dy > 0) {
-            damagedContentsRect.setY(contentRect.y());
+            damagedContentsRect.setY(screenRect.y());
             damagedContentsRect.setHeight(dy);
         } else {
-            damagedContentsRect.setY(contentRect.bottom() + dy);
+            damagedContentsRect.setY(screenRect.bottom() + dy);
             damagedContentsRect.setHeight(-dy);
         }
     }
 
     m_rootLayerScrollDamage.unite(damagedContentsRect);
+
+    // Scroll any existing damage that intersects with clip rect
+    if (clipRect.intersects(m_rootLayerDirtyRect)) {
+        // Find the inner damage
+        IntRect innerDamage(clipRect);
+        innerDamage.intersect(m_rootLayerDirtyRect);
+
+        // Move the damage
+        innerDamage.move(scrollDelta.width(), scrollDelta.height());
+        
+        // Merge it back into the damaged rect
+        m_rootLayerDirtyRect.unite(innerDamage);
+    }
+
     setRootLayerNeedsDisplay();
 }
 
@@ -2278,15 +2346,10 @@ void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
 
     if (!page())
         return;
-    FrameView* view = page()->mainFrame()->view();
-
-    // rect is in viewport space. Convert to content space
-    // so that invalidations and scroll invalidations play well with one-another.
-    IntRect contentRect = view->windowToContents(rect);
 
     // FIXME: add a smarter damage aggregation logic and/or unify with 
     // LayerChromium's damage logic
-    m_rootLayerDirtyRect.unite(contentRect);
+    m_rootLayerDirtyRect.unite(rect);
     setRootLayerNeedsDisplay();
 }
 
@@ -2306,7 +2369,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         return;
     }
 
-    OwnPtr<GraphicsContext3D> context = m_temporaryOnscreenGraphicsContext3D.release();
+    RefPtr<GraphicsContext3D> context = m_temporaryOnscreenGraphicsContext3D.release();
     if (!context) {
         context = GraphicsContext3D::create(GraphicsContext3D::Attributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
         if (context)
@@ -2396,10 +2459,7 @@ void WebViewImpl::doComposite()
     damageRects.append(m_rootLayerScrollDamage);
     damageRects.append(m_rootLayerDirtyRect);
     for (size_t i = 0; i < damageRects.size(); ++i) {
-        // The damage rect for the root layer is in content space [e.g. unscrolled].
-        // Convert from content space to viewPort space.
-        const IntRect damagedContentRect = damageRects[i];
-        IntRect damagedRect = view->contentsToWindow(damagedContentRect);
+        IntRect damagedRect = damageRects[i];
 
         // Intersect this rectangle with the viewPort.
         damagedRect.intersect(viewPort);
@@ -2419,19 +2479,6 @@ void WebViewImpl::doComposite()
 #endif
 
 
-SharedGraphicsContext3D* WebViewImpl::getSharedGraphicsContext3D()
-{
-    if (!m_sharedContext3D) {
-        GraphicsContext3D::Attributes attr;
-        OwnPtr<GraphicsContext3D> context = GraphicsContext3D::create(attr, m_page->chrome());
-        if (!context)
-            return 0;
-        m_sharedContext3D = SharedGraphicsContext3D::create(context.release());
-    }
-
-    return m_sharedContext3D.get();
-}
-
 WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
 {
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
index 9db914d..050b5e1 100644
--- a/WebKit/chromium/src/WebViewImpl.h
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -132,8 +132,11 @@ public:
     virtual void setFocusedFrame(WebFrame* frame);
     virtual void setInitialFocus(bool reverse);
     virtual void clearFocusedNode();
-    virtual int zoomLevel();
-    virtual int setZoomLevel(bool textOnly, int zoomLevel);
+    virtual void scrollFocusedNodeIntoView();
+    virtual double zoomLevel();
+    virtual double setZoomLevel(bool textOnly, double zoomLevel);
+    virtual void zoomLimitsChanged(double minimumZoomLevel,
+                                   double maximumZoomLevel);
     virtual void performMediaPlayerAction(
         const WebMediaPlayerAction& action,
         const WebPoint& location);
@@ -152,6 +155,11 @@ public:
         const WebPoint& clientPoint,
         const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed);
+    virtual WebDragOperation dragTargetDragEnterNew(
+        int identity,
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed);
     virtual WebDragOperation dragTargetDragOver(
         const WebPoint& clientPoint,
         const WebPoint& screenPoint,
@@ -338,17 +346,19 @@ public:
     // WebGL. Returns 0 if compositing support is not compiled in.
     virtual WebGraphicsContext3D* graphicsContext3D();
 
-    virtual WebCore::SharedGraphicsContext3D* getSharedGraphicsContext3D();
-
     WebCore::PopupContainer* selectPopup() const { return m_selectPopup.get(); }
 
-    bool zoomTextOnly() const { return m_zoomTextOnly; }
-
     // Returns true if the event leads to scrolling.
     static bool mapKeyCodeForScroll(int keyCode,
                                    WebCore::ScrollDirection* scrollDirection,
                                    WebCore::ScrollGranularity* scrollGranularity);
 
+    // Called by a full frame plugin inside this view to inform it that its
+    // zoom level has been updated.  The plugin should only call this function
+    // if the zoom change was triggered by the browser, it's only needed in case
+    // a plugin can update its own zoom, say because of its own UI.
+    void fullFramePluginZoomLevelChanged(double zoomLevel);
+
 private:
     friend class WebView;  // So WebView::Create can call our constructor
     friend class WTF::RefCounted<WebViewImpl>;
@@ -440,9 +450,11 @@ private:
 
     // Keeps track of the current zoom level. 0 means no zoom, positive numbers
     // mean zoom in, negative numbers mean zoom out.
-    int m_zoomLevel;
+    double m_zoomLevel;
+
+    double m_minimumZoomLevel;
 
-    bool m_zoomTextOnly;
+    double m_maximumZoomLevel;
 
     bool m_contextMenuAllowed;
 
@@ -536,10 +548,7 @@ private:
     // If we attempt to fetch the on-screen GraphicsContext3D before
     // the compositor has been turned on, we need to instantiate it
     // early. This member holds on to the GC3D in this case.
-    OwnPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
-
-    RefPtr<WebCore::SharedGraphicsContext3D> m_sharedContext3D;
-
+    RefPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
 };
 
diff --git a/WebKit/chromium/src/WebWorkerBase.cpp b/WebKit/chromium/src/WebWorkerBase.cpp
index 622f5c2..de4858c 100644
--- a/WebKit/chromium/src/WebWorkerBase.cpp
+++ b/WebKit/chromium/src/WebWorkerBase.cpp
@@ -237,13 +237,23 @@ bool WebWorkerBase::allowDatabase(WebFrame*, const WebString& name, const WebStr
 }
 
 #if ENABLE(FILE_SYSTEM)
-void WebWorkerBase::openFileSystem(WebFileSystem::Type type, long long size, WebFileSystemCallbacks* callbacks)
+void WebWorkerBase::openFileSystem(WebFileSystem::Type type, long long size, WebFileSystemCallbacks* callbacks, bool synchronous)
 {
+    WorkerRunLoop& runLoop = m_workerThread->runLoop();
     WorkerScriptController* controller = WorkerScriptController::controllerForContext();
     WorkerContext* workerContext = controller->workerContext();
 
+    // Create a unique mode for this openFileSystem call.
+    String mode = openFileSystemMode;
+    mode.append(String::number(runLoop.createUniqueId()));
+
     RefPtr<WorkerFileSystemCallbacksBridge> bridge = WorkerFileSystemCallbacksBridge::create(this, workerContext, callbacks);
-    bridge->postOpenFileSystemToMainThread(commonClient(), type, size, openFileSystemMode);
+    bridge->postOpenFileSystemToMainThread(commonClient(), type, size, mode);
+
+    if (synchronous) {
+        if (runLoop.runInMode(workerContext, mode) == MessageQueueTerminated)
+            bridge->stop();
+    }
 }
 #endif
 
diff --git a/WebKit/chromium/src/WebWorkerBase.h b/WebKit/chromium/src/WebWorkerBase.h
index 1f4bc03..fe84bf7 100644
--- a/WebKit/chromium/src/WebWorkerBase.h
+++ b/WebKit/chromium/src/WebWorkerBase.h
@@ -93,7 +93,7 @@ public:
 
 #if ENABLE(FILE_SYSTEM)
     // Requests to open a file system for this worker. (Note that this is not the implementation for WebFrameClient::openFileSystem.)
-    void openFileSystem(WebFileSystem::Type, long long size, WebFileSystemCallbacks*);
+    void openFileSystem(WebFileSystem::Type, long long size, WebFileSystemCallbacks*, bool synchronous);
 #endif
 
     // Executes the given task on the main thread.
diff --git a/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
new file mode 100644
index 0000000..1e70619
--- /dev/null
+++ b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerAsyncFileSystemChromium.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystemCallbacks.h"
+#include "FileSystem.h"
+#include "NotImplemented.h"
+#include "WebFileSystem.h"
+#include "WebFileSystemCallbacksImpl.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebWorkerBase.h"
+#include "WorkerContext.h"
+#include "WorkerFileSystemCallbacksBridge.h"
+#include "WorkerScriptController.h"
+#include "WorkerThread.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+namespace WebCore {
+
+static const char fileSystemOperationsMode[] = "fileSystemOperationsMode";
+
+WorkerAsyncFileSystemChromium::WorkerAsyncFileSystemChromium(ScriptExecutionContext* context, const String& rootPath, bool synchronous)
+    : AsyncFileSystem(rootPath)
+    , m_scriptExecutionContext(context)
+    , m_webFileSystem(WebKit::webKitClient()->fileSystem())
+    , m_workerContext(static_cast<WorkerContext*>(context))
+    , m_synchronous(synchronous)
+{
+    ASSERT(m_webFileSystem);
+    ASSERT(m_scriptExecutionContext->isWorkerContext());
+
+    WorkerLoaderProxy* workerLoaderProxy = &m_workerContext->thread()->workerLoaderProxy();
+    m_worker = static_cast<WebWorkerBase*>(workerLoaderProxy);
+}
+
+WorkerAsyncFileSystemChromium::~WorkerAsyncFileSystemChromium()
+{
+}
+
+bool WorkerAsyncFileSystemChromium::waitForOperationToComplete()
+{
+    if (!m_bridgeForCurrentOperation.get())
+        return false;
+
+    RefPtr<WorkerFileSystemCallbacksBridge> bridge = m_bridgeForCurrentOperation.release();
+    if (m_workerContext->thread()->runLoop().runInMode(m_workerContext, m_modeForCurrentOperation) == MessageQueueTerminated) {
+        bridge->stop();
+        return false;
+    }
+    return true;
+}
+
+void WorkerAsyncFileSystemChromium::move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postMoveToMainThread(m_webFileSystem, sourcePath, destinationPath, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postCopyToMainThread(m_webFileSystem, sourcePath, destinationPath, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postRemoveToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postRemoveRecursivelyToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postReadMetadataToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postCreateFileToMainThread(m_webFileSystem, path, exclusive, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postCreateDirectoryToMainThread(m_webFileSystem, path, exclusive, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postFileExistsToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postDirectoryExistsToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postReadDirectoryToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::createWriter(AsyncFileWriterClient*, const String&, PassOwnPtr<AsyncFileSystemCallbacks>)
+{
+    notImplemented();
+}
+
+PassRefPtr<WorkerFileSystemCallbacksBridge> WorkerAsyncFileSystemChromium::createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    ASSERT(!m_synchronous || !m_bridgeForCurrentOperation.get());
+
+    m_modeForCurrentOperation = fileSystemOperationsMode;
+    m_modeForCurrentOperation.append(String::number(m_workerContext->thread()->runLoop().createUniqueId()));
+
+    m_bridgeForCurrentOperation = WorkerFileSystemCallbacksBridge::create(m_worker, m_scriptExecutionContext, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+    return m_bridgeForCurrentOperation;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
new file mode 100644
index 0000000..0b4b708
--- /dev/null
+++ b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerAsyncFileSystemChromium_h
+#define WorkerAsyncFileSystemChromium_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "PlatformString.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebKit {
+class WebFileSystem;
+class WebWorkerBase;
+class WorkerFileSystemCallbacksBridge;
+}
+
+namespace WebCore {
+
+class AsyncFileSystemCallbacks;
+class ScriptExecutionContext;
+class WorkerContext;
+
+class WorkerAsyncFileSystemChromium : public AsyncFileSystem {
+public:
+    static PassOwnPtr<AsyncFileSystem> create(ScriptExecutionContext* context, const String& rootPath, bool synchronous)
+    {
+        return adoptPtr(new WorkerAsyncFileSystemChromium(context, rootPath, synchronous));
+    }
+
+    virtual ~WorkerAsyncFileSystemChromium();
+
+    // Runs one pending operation (to wait for completion in the sync-mode).
+    virtual bool waitForOperationToComplete();
+
+    virtual void move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+
+private:
+    WorkerAsyncFileSystemChromium(ScriptExecutionContext*, const String& rootPath, bool synchronous);
+
+    PassRefPtr<WebKit::WorkerFileSystemCallbacksBridge> createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks>);
+
+    ScriptExecutionContext* m_scriptExecutionContext;
+    WebKit::WebFileSystem* m_webFileSystem;
+    WebKit::WebWorkerBase* m_worker;
+    WorkerContext* m_workerContext;
+    RefPtr<WebKit::WorkerFileSystemCallbacksBridge> m_bridgeForCurrentOperation;
+    String m_modeForCurrentOperation;
+    bool m_synchronous;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // WorkerAsyncFileSystemChromium_h
diff --git a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index d112886..6c31221 100644
--- a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -35,7 +35,9 @@
 
 #include "CrossThreadTask.h"
 #include "WebCommonWorkerClient.h"
+#include "WebFileInfo.h"
 #include "WebFileSystemCallbacks.h"
+#include "WebFileSystemEntry.h"
 #include "WebString.h"
 #include "WebWorkerBase.h"
 #include "WorkerContext.h"
@@ -44,6 +46,37 @@
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
 
+namespace WebCore {
+
+template<> struct CrossThreadCopierBase<false, false, WebKit::WebFileInfo> {
+    typedef WebKit::WebFileInfo Type;
+    static Type copy(const WebKit::WebFileInfo& info)
+    {
+        // Perform per-field copy to make sure we don't do any (unexpected) non-thread safe copy here.
+        struct WebKit::WebFileInfo newInfo;
+        newInfo.modificationTime = info.modificationTime;
+        newInfo.length = info.length;
+        newInfo.type = info.type;
+        return newInfo;
+    }
+};
+
+template<> struct CrossThreadCopierBase<false, false, WebKit::WebVector<WebKit::WebFileSystemEntry> > {
+    typedef WebKit::WebVector<WebKit::WebFileSystemEntry> Type;
+    static Type copy(const WebKit::WebVector<WebKit::WebFileSystemEntry>& entries)
+    {
+        WebKit::WebVector<WebKit::WebFileSystemEntry> newEntries(entries.size());
+        for (size_t i = 0; i < entries.size(); ++i) {
+            String name = entries[i].name;
+            newEntries[i].isDirectory = entries[i].isDirectory;
+            newEntries[i].name = name.crossThreadString();
+        }
+        return newEntries;
+    }
+};
+
+}
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -51,9 +84,11 @@ namespace WebKit {
 // FileSystemCallbacks that are to be dispatched on the main thread.
 class MainThreadFileSystemCallbacks : public WebFileSystemCallbacks {
 public:
-    static PassOwnPtr<MainThreadFileSystemCallbacks> create(PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
+    // Callbacks are self-destructed and we always return leaked pointer here.
+    static MainThreadFileSystemCallbacks* createLeakedPtr(PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
     {
-        return adoptPtr(new MainThreadFileSystemCallbacks(bridge, mode));
+        OwnPtr<MainThreadFileSystemCallbacks> callbacks = adoptPtr(new MainThreadFileSystemCallbacks(bridge, mode));
+        return callbacks.leakPtr();
     }
 
     virtual ~MainThreadFileSystemCallbacks()
@@ -74,17 +109,20 @@ public:
 
     virtual void didSucceed()
     {
-        WEBKIT_ASSERT_NOT_REACHED();
+        m_bridge->didSucceedOnMainThread(m_mode);
+        delete this;
     }
 
     virtual void didReadMetadata(const WebFileInfo& info)
     {
-        WEBKIT_ASSERT_NOT_REACHED();
+        m_bridge->didReadMetadataOnMainThread(info, m_mode);
+        delete this;
     }
 
     virtual void didReadDirectory(const WebVector<WebFileSystemEntry>& entries, bool hasMore)
     {
-        WEBKIT_ASSERT_NOT_REACHED();
+        m_bridge->didReadDirectoryOnMainThread(entries, hasMore, m_mode);
+        delete this;
     }
 
 private:
@@ -114,33 +152,148 @@ void WorkerFileSystemCallbacksBridge::stop()
 
 void WorkerFileSystemCallbacksBridge::postOpenFileSystemToMainThread(WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, const String& mode)
 {
-    m_selfRef = this;
-    ASSERT(m_workerContext->isContextThread());
-    ASSERT(m_worker);
-    m_worker->dispatchTaskToMainThread(createCallbackTask(&openFileSystemOnMainThread, commonClient, type, size, this, mode));
+    dispatchTaskToMainThread(createCallbackTask(&openFileSystemOnMainThread, commonClient, type, size, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postMoveToMainThread(WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, const String& mode)
+{
+    dispatchTaskToMainThread(createCallbackTask(&moveOnMainThread, fileSystem, sourcePath, destinationPath, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postCopyToMainThread(WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, const String& mode)
+{
+    dispatchTaskToMainThread(createCallbackTask(&copyOnMainThread, fileSystem, sourcePath, destinationPath, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postRemoveToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&removeOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postRemoveRecursivelyToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&removeRecursivelyOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postReadMetadataToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&readMetadataOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postCreateFileToMainThread(WebFileSystem* fileSystem, const String& path, bool exclusive, const String& mode)
+{
+    dispatchTaskToMainThread(createCallbackTask(&createFileOnMainThread, fileSystem, path, exclusive, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postCreateDirectoryToMainThread(WebFileSystem* fileSystem, const String& path, bool exclusive, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&createDirectoryOnMainThread, fileSystem, path, exclusive, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postFileExistsToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&fileExistsOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postDirectoryExistsToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&directoryExistsOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postReadDirectoryToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&readDirectoryOnMainThread, fileSystem, path, this, mode));
 }
 
 void WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread(ScriptExecutionContext*, WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
 {
-    ASSERT(isMainThread());
     if (!commonClient)
         bridge->didFailOnMainThread(WebFileErrorAbort, mode);
     else {
-        // MainThreadFileSystemCallbacks is self-destructed, so we leak ptr here.
-        commonClient->openFileSystem(type, size, MainThreadFileSystemCallbacks::create(bridge, mode).leakPtr());
+        commonClient->openFileSystem(type, size, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
     }
 }
 
+void WorkerFileSystemCallbacksBridge::moveOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->move(sourcePath, destinationPath, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::copyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->copy(sourcePath, destinationPath, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::removeOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->remove(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::removeRecursivelyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->removeRecursively(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::readMetadataOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->readMetadata(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::createFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->createFile(path, exclusive, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::createDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->createDirectory(path, exclusive, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::fileExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->fileExists(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::directoryExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->directoryExists(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::readDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->readDirectory(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
 void WorkerFileSystemCallbacksBridge::didFailOnMainThread(WebFileError error, const String& mode)
 {
-    ASSERT(isMainThread());
-    mayPostTaskToWorker(createCallbackTask(&didFailOnWorkerThread, m_selfRef, error), mode);
+    mayPostTaskToWorker(createCallbackTask(&didFailOnWorkerThread, this, error), mode);
 }
 
 void WorkerFileSystemCallbacksBridge::didOpenFileSystemOnMainThread(const String& name, const String& rootPath, const String& mode)
 {
-    ASSERT(isMainThread());
-    mayPostTaskToWorker(createCallbackTask(&didOpenFileSystemOnWorkerThread, m_selfRef, name, rootPath), mode);
+    mayPostTaskToWorker(createCallbackTask(&didOpenFileSystemOnWorkerThread, this, name, rootPath), mode);
+}
+
+void WorkerFileSystemCallbacksBridge::didSucceedOnMainThread(const String& mode)
+{
+    mayPostTaskToWorker(createCallbackTask(&didSucceedOnWorkerThread, this), mode);
+}
+
+void WorkerFileSystemCallbacksBridge::didReadMetadataOnMainThread(const WebFileInfo& info, const String& mode)
+{
+    mayPostTaskToWorker(createCallbackTask(&didReadMetadataOnWorkerThread, this, info), mode);
+}
+
+void WorkerFileSystemCallbacksBridge::didReadDirectoryOnMainThread(const WebVector<WebFileSystemEntry>& entries, bool hasMore, const String& mode)
+{
+    mayPostTaskToWorker(createCallbackTask(&didReadDirectoryOnWorkerThread, this, entries, hasMore), mode);
 }
 
 WorkerFileSystemCallbacksBridge::WorkerFileSystemCallbacksBridge(WebWorkerBase* worker, ScriptExecutionContext* scriptExecutionContext, WebFileSystemCallbacks* callbacks)
@@ -157,30 +310,79 @@ WorkerFileSystemCallbacksBridge::~WorkerFileSystemCallbacksBridge()
     ASSERT(!m_callbacksOnWorkerThread);
 }
 
-void WorkerFileSystemCallbacksBridge::didFailOnWorkerThread(ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, WebFileError error)
+void WorkerFileSystemCallbacksBridge::didFailOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, WebFileError error)
 {
-    if (bridge->m_callbacksOnWorkerThread) {
-        ASSERT(bridge->m_workerContext->isContextThread());
-        bridge->m_callbacksOnWorkerThread->didFail(error);
-        bridge->m_callbacksOnWorkerThread = 0;
-    }
+    bridge->m_callbacksOnWorkerThread->didFail(error);
 }
 
-void WorkerFileSystemCallbacksBridge::didOpenFileSystemOnWorkerThread(ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& name, const String& rootPath)
+void WorkerFileSystemCallbacksBridge::didOpenFileSystemOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, const String& name, const String& rootPath)
 {
-    if (bridge->m_callbacksOnWorkerThread) {
-        ASSERT(bridge->m_workerContext->isContextThread());
-        bridge->m_callbacksOnWorkerThread->didOpenFileSystem(name, rootPath);
-        bridge->m_callbacksOnWorkerThread = 0;
+    bridge->m_callbacksOnWorkerThread->didOpenFileSystem(name, rootPath);
+}
+
+void WorkerFileSystemCallbacksBridge::didSucceedOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge)
+{
+    bridge->m_callbacksOnWorkerThread->didSucceed();
+}
+
+void WorkerFileSystemCallbacksBridge::didReadMetadataOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, const WebFileInfo& info)
+{
+    bridge->m_callbacksOnWorkerThread->didReadMetadata(info);
+}
+
+void WorkerFileSystemCallbacksBridge::didReadDirectoryOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, const WebVector<WebFileSystemEntry>& entries, bool hasMore)
+{
+    bridge->m_callbacksOnWorkerThread->didReadDirectory(entries, hasMore);
+}
+
+bool WorkerFileSystemCallbacksBridge::derefIfWorkerIsStopped()
+{
+    WebWorkerBase* worker = 0;
+    {
+        MutexLocker locker(m_mutex);
+        worker = m_worker;
+    }
+
+    if (!worker) {
+        m_selfRef.clear();
+        return true;
     }
+    return false;
+}
+
+void WorkerFileSystemCallbacksBridge::runTaskOnMainThread(WebCore::ScriptExecutionContext* scriptExecutionContext, WorkerFileSystemCallbacksBridge* bridge, PassOwnPtr<WebCore::ScriptExecutionContext::Task> taskToRun)
+{
+    ASSERT(isMainThread());
+    if (bridge->derefIfWorkerIsStopped())
+        return;
+    taskToRun->performTask(scriptExecutionContext);
+}
+
+void WorkerFileSystemCallbacksBridge::runTaskOnWorkerThread(WebCore::ScriptExecutionContext* scriptExecutionContext, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, PassOwnPtr<WebCore::ScriptExecutionContext::Task> taskToRun)
+{
+    if (!bridge->m_callbacksOnWorkerThread)
+        return;
+    ASSERT(bridge->m_workerContext->isContextThread());
+    taskToRun->performTask(scriptExecutionContext);
+    bridge->m_callbacksOnWorkerThread = 0;
+}
+
+void WorkerFileSystemCallbacksBridge::dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task> task)
+{
+    ASSERT(!m_selfRef);
+    ASSERT(m_worker);
+    ASSERT(m_workerContext->isContextThread());
+    m_selfRef = this;
+    m_worker->dispatchTaskToMainThread(createCallbackTask(&runTaskOnMainThread, this, task));
 }
 
 void WorkerFileSystemCallbacksBridge::mayPostTaskToWorker(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
+    ASSERT(isMainThread());
     { // Let go of the mutex before possibly deleting this due to m_selfRef.clear().
         MutexLocker locker(m_mutex);
         if (m_worker)
-            m_worker->postTaskForModeToWorkerContext(task, mode);
+            m_worker->postTaskForModeToWorkerContext(createCallbackTask(&runTaskOnWorkerThread, m_selfRef, task), mode);
     }
     m_selfRef.clear();
 }
diff --git a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
index 899127e..fa57f38 100644
--- a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
+++ b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
@@ -68,10 +68,6 @@ struct WebFileSystemEntry;
 //      releases a self-reference to the bridge.
 class WorkerFileSystemCallbacksBridge : public ThreadSafeShared<WorkerFileSystemCallbacksBridge>, public WebCore::WorkerContext::Observer {
 public:
-    static PassRefPtr<WorkerFileSystemCallbacksBridge> create(WebWorkerBase* worker, WebCore::ScriptExecutionContext* workerContext, WebFileSystemCallbacks* callbacks)
-    {
-        return WTF::adoptRef(new WorkerFileSystemCallbacksBridge(worker, workerContext, callbacks));
-    }
     ~WorkerFileSystemCallbacksBridge();
 
     // WorkerContext::Observer method.
@@ -82,26 +78,64 @@ public:
 
     void stop();
 
-    // Posts an initial request task to the main thread. It is supposed to be called immediately after the bridge is constructed. (It doesn't check if the context has been stopped or not.)
+    static PassRefPtr<WorkerFileSystemCallbacksBridge> create(WebWorkerBase* worker, WebCore::ScriptExecutionContext* workerContext, WebFileSystemCallbacks* callbacks)
+    {
+        return adoptRef(new WorkerFileSystemCallbacksBridge(worker, workerContext, callbacks));
+    }
+
+    // Methods that create an instance and post an initial request task to the main thread. They must be called on the worker thread.
     void postOpenFileSystemToMainThread(WebCommonWorkerClient*, WebFileSystem::Type, long long size, const String& mode);
+    void postMoveToMainThread(WebFileSystem*, const String& srcPath, const String& destPath, const String& mode);
+    void postCopyToMainThread(WebFileSystem*, const String& srcPath, const String& destPath, const String& mode);
+    void postRemoveToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postRemoveRecursivelyToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postReadMetadataToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postCreateFileToMainThread(WebFileSystem*, const String& path, bool exclusive, const String& mode);
+    void postCreateDirectoryToMainThread(WebFileSystem*, const String& path, bool exclusive, const String& mode);
+    void postFileExistsToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postDirectoryExistsToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postReadDirectoryToMainThread(WebFileSystem*, const String& path, const String& mode);
 
     // Callback methods that are called on the main thread.
     void didFailOnMainThread(WebFileError, const String& mode);
     void didOpenFileSystemOnMainThread(const String& name, const String& rootPath, const String& mode);
+    void didSucceedOnMainThread(const String& mode);
+    void didReadMetadataOnMainThread(const WebFileInfo&, const String& mode);
+    void didReadDirectoryOnMainThread(const WebVector<WebFileSystemEntry>&, bool hasMore, const String& mode);
 
 private:
     WorkerFileSystemCallbacksBridge(WebWorkerBase*, WebCore::ScriptExecutionContext*, WebFileSystemCallbacks*);
 
-    // Method that is to be called on the main thread.
+    // Methods that are to be called on the main thread.
     static void openFileSystemOnMainThread(WebCore::ScriptExecutionContext*, WebCommonWorkerClient*, WebFileSystem::Type, long long size, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void moveOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& srcPath, const String& destPath, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void copyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& srcPath, const String& destPath, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void removeOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void removeRecursivelyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void readMetadataOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void createFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void createDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void fileExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void directoryExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void readDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
 
     friend class MainThreadFileSystemCallbacks;
 
     // Methods that dispatch WebFileSystemCallbacks on the worker threads.
     // They release a selfRef of the WorkerFileSystemCallbacksBridge.
-    static void didFailOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, WebFileError);
-    static void didOpenFileSystemOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& name, const String& rootPath);
+    static void didFailOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, WebFileError);
+    static void didOpenFileSystemOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const String& name, const String& rootPath);
+    static void didSucceedOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*);
+    static void didReadMetadataOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const WebFileInfo&);
+    static void didReadDirectoryOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const WebVector<WebFileSystemEntry>&, bool hasMore);
+
+    // For early-exist; this deref's selfRef and returns true if the worker is already null.
+    bool derefIfWorkerIsStopped();
+
+    static void runTaskOnMainThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
+    static void runTaskOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
 
+    void dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     void mayPostTaskToWorker(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode);
 
     // m_selfRef keeps a reference to itself until a task is created for the worker thread (at which point the task holds the reference).
diff --git a/WebKit/chromium/src/gtk/WebInputEventFactory.cpp b/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
index 0d55c43..71d1b39 100644
--- a/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
+++ b/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
@@ -52,7 +52,7 @@ bool countsAsDoubleClick(gint timeDiff, gint xDiff, gint yDiff)
     gint doubleClickDistance = 5;
     g_object_get(G_OBJECT(settings),
                  "gtk-double-click-time", &doubleClickTime,
-                 "gtk-double-click-distance", &doubleClickDistance, 0);
+                 "gtk-double-click-distance", &doubleClickDistance, NULL);
     return timeDiff <= doubleClickTime && abs(xDiff) <= doubleClickDistance && abs(yDiff) <= doubleClickDistance;
 }
 
diff --git a/WebKit/chromium/src/js/DevTools.js b/WebKit/chromium/src/js/DevTools.js
index a66e174..4c23057 100644
--- a/WebKit/chromium/src/js/DevTools.js
+++ b/WebKit/chromium/src/js/DevTools.js
@@ -162,3 +162,25 @@ WebInspector.resetToolbarColors = function()
 
 }
 
+////////////////////////////////////////////////////////
+// Platform-specific WebInspector extensions support. //
+////////////////////////////////////////////////////////
+
+WebInspector.platformExtensionAPI = function(tabId)
+{
+    function getTabId()
+    {
+        return tabId;
+    }
+    webInspector.inspectedWindow.__proto__.__defineGetter__("tabId", getTabId);
+}
+
+WebInspector.buildPlatformExtensionAPI = function()
+{
+    return "(" + WebInspector.platformExtensionAPI + ")(" + WebInspector._inspectedTabId + ");";
+}
+
+WebInspector.setInspectedTabId = function(tabId)
+{
+    WebInspector._inspectedTabId = tabId;
+}