Merge WebKit at r63173 : Initial merge by git.

Change-Id: Ife5af0c7c6261fbbc8ae6bc08c390efa9ef10b44

39 files changed, 740 insertions, 110 deletions

diff --git a/WebKit/chromium/src/ApplicationCacheHost.cpp b/WebKit/chromium/src/ApplicationCacheHost.cpp
index 5fa4a66..b90126f 100644
--- a/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -37,6 +37,7 @@
 #include "DocumentLoader.h"
 #include "DOMApplicationCache.h"
 #include "Frame.h"
+#include "ProgressEvent.h"
 #include "Settings.h"
 #include "WebURL.h"
 #include "WebURLError.h"
@@ -195,34 +196,42 @@ void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplic
     m_domApplicationCache = domApplicationCache;
 }
 
-void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
+void ApplicationCacheHost::notifyDOMApplicationCache(EventID id, int total, int done)
 {
     if (m_defersEvents) {
-        m_deferredEvents.append(id);
+        // Event dispatching is deferred until document.onload has fired.
+        m_deferredEvents.append(DeferredEvent(id, total, done));
         return;
     }
-    if (m_domApplicationCache) {
-        ExceptionCode ec = 0;
-        m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
-        ASSERT(!ec);
-    }
+    dispatchDOMEvent(id, total, done);
 }
 
 void ApplicationCacheHost::stopDeferringEvents()
 {
     RefPtr<DocumentLoader> protect(documentLoader());
     for (unsigned i = 0; i < m_deferredEvents.size(); ++i) {
-        EventID id = m_deferredEvents[i];
-        if (m_domApplicationCache) {
-            ExceptionCode ec = 0;
-            m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
-            ASSERT(!ec);
-        }
+        const DeferredEvent& deferred = m_deferredEvents[i];
+        dispatchDOMEvent(deferred.eventID, deferred.progressTotal, deferred.progressDone);
     }
     m_deferredEvents.clear();
     m_defersEvents = false;
 }
 
+void ApplicationCacheHost::dispatchDOMEvent(EventID id, int total, int done)
+{
+    if (m_domApplicationCache) {
+        const AtomicString& eventType = DOMApplicationCache::toEventType(id);
+        ExceptionCode ec = 0;
+        RefPtr<Event> event;
+        if (id == PROGRESS_EVENT)
+            event = ProgressEvent::create(eventType, true, done, total);
+        else
+            event = Event::create(eventType, false, false);
+        m_domApplicationCache->dispatchEvent(event, ec);
+        ASSERT(!ec);
+    }
+}
+
 ApplicationCacheHost::Status ApplicationCacheHost::status() const
 {
     return m_internal ? static_cast<Status>(m_internal->m_outerHost->status()) : UNCACHED;
diff --git a/WebKit/chromium/src/ApplicationCacheHostInternal.h b/WebKit/chromium/src/ApplicationCacheHostInternal.h
index edaaca9..902b9b5 100644
--- a/WebKit/chromium/src/ApplicationCacheHostInternal.h
+++ b/WebKit/chromium/src/ApplicationCacheHostInternal.h
@@ -55,18 +55,12 @@ public:
 
     virtual void notifyEventListener(WebKit::WebApplicationCacheHost::EventID eventID)
     {
-        m_innerHost->notifyDOMApplicationCache(static_cast<ApplicationCacheHost::EventID>(eventID));
+        m_innerHost->notifyDOMApplicationCache(static_cast<ApplicationCacheHost::EventID>(eventID), 0, 0);
     }
 
-    virtual void notifyProgressEventListener(const WebKit::WebURL&, int num_total, int num_complete) 
+    virtual void notifyProgressEventListener(const WebKit::WebURL&, int progressTotal, int progressDone) 
     {
-        // FIXME: Modify webcore's progress event handling to carry the extra info and alter the
-        // layout tests to not fail when the more recently specified 'final' event is raised.
-        // For now, we're eating the extra info and that last event.
-        // See https://bugs.webkit.org/show_bug.cgi?id=37602
-        if (num_complete == num_total)
-            return;
-        notifyEventListener(WebKit::WebApplicationCacheHost::ProgressEvent);
+        m_innerHost->notifyDOMApplicationCache(ApplicationCacheHost::PROGRESS_EVENT, progressTotal, progressDone);
     }
 
     static WebKit::WebApplicationCacheHost* toWebApplicationCacheHost(ApplicationCacheHost* innerHost)
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
index 5736ca0..1f946f3 100644
--- a/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -37,6 +37,7 @@
 #include "ApplicationCacheHost.h"
 #include "EditorInsertAction.h"
 #include "HTMLInputElement.h"
+#include "IDBKey.h"
 #include "MediaPlayer.h"
 #include "NotificationPresenter.h"
 #include "PasteboardPrivate.h"
@@ -44,11 +45,14 @@
 #include "Settings.h"
 #include "StringImpl.h"
 #include "TextAffinity.h"
+#include "UserContentTypes.h"
+#include "UserScriptTypes.h"
 #include "WebAccessibilityObject.h"
 #include "WebApplicationCacheHost.h"
 #include "WebClipboard.h"
 #include "WebCursorInfo.h"
 #include "WebEditingAction.h"
+#include "WebIDBKey.h"
 #include "WebInputElement.h"
 #include "WebMediaPlayer.h"
 #include "WebNotificationPresenter.h"
@@ -56,6 +60,7 @@
 #include "WebSettings.h"
 #include "WebTextAffinity.h"
 #include "WebTextCaseSensitivity.h"
+#include "WebView.h"
 #include <wtf/Assertions.h>
 
 #define COMPILE_ASSERT_MATCHING_ENUM(webkit_name, webcore_name) \
@@ -312,3 +317,12 @@ COMPILE_ASSERT_MATCHING_ENUM(WebTextAffinityDownstream, DOWNSTREAM);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCaseSensitive, TextCaseSensitive);
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCaseInsensitive, TextCaseInsensitive);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebView::UserScriptInjectAtDocumentStart, InjectAtDocumentStart);
+COMPILE_ASSERT_MATCHING_ENUM(WebView::UserScriptInjectAtDocumentEnd, InjectAtDocumentEnd);
+COMPILE_ASSERT_MATCHING_ENUM(WebView::UserContentInjectInAllFrames, InjectInAllFrames);
+COMPILE_ASSERT_MATCHING_ENUM(WebView::UserContentInjectInTopFrameOnly, InjectInTopFrameOnly);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::NullType, IDBKey::NullType);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::StringType, IDBKey::StringType);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::NumberType, IDBKey::NumberType);
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index f757d9c..d0d09bf 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -54,6 +54,7 @@
 #include "WebDataSourceImpl.h"
 #include "WebFrameImpl.h"
 #include "WebMenuItemInfo.h"
+#include "WebPlugin.h"
 #include "WebPluginContainerImpl.h"
 #include "WebPoint.h"
 #include "WebString.h"
@@ -209,7 +210,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
             Widget* widget = toRenderWidget(object)->widget();
             if (widget) {
                 WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
-                WebString text = plugin->selectedText();
+                WebString text = plugin->plugin()->selectionAsText();
                 if (!text.isEmpty()) {
                     data.selectedText = text;
                     data.editFlags |= WebContextMenuData::CanCopy;
diff --git a/WebKit/chromium/src/EditorClientImpl.cpp b/WebKit/chromium/src/EditorClientImpl.cpp
index 864988a..4ae4934 100644
--- a/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/WebKit/chromium/src/EditorClientImpl.cpp
@@ -43,9 +43,11 @@
 
 #include "DOMUtilitiesPrivate.h"
 #include "WebEditingAction.h"
+#include "WebElement.h"
 #include "WebFrameImpl.h"
 #include "WebKit.h"
 #include "WebInputElement.h"
+#include "WebInputEventConversion.h"
 #include "WebNode.h"
 #include "WebPasswordAutocompleteListener.h"
 #include "WebRange.h"
@@ -90,7 +92,7 @@ bool EditorClientImpl::shouldShowDeleteInterface(HTMLElement* elem)
     // Normally, we don't care to show WebCore's deletion UI, so we only enable
     // it if in testing mode and the test specifically requests it by using this
     // magic class name.
-    return WebKit::layoutTestMode()
+    return layoutTestMode()
            && elem->getAttribute(HTMLNames::classAttr) == "needsDeletionUI";
 }
 
@@ -644,12 +646,19 @@ void EditorClientImpl::handleInputMethodKeydown(KeyboardEvent* keyEvent)
     // We handle IME within chrome.
 }
 
-void EditorClientImpl::textFieldDidBeginEditing(Element*)
+void EditorClientImpl::textFieldDidBeginEditing(Element* element)
 {
+    HTMLInputElement* inputElement = toHTMLInputElement(element);
+    if (m_webView->client() && inputElement)
+        m_webView->client()->textFieldDidBeginEditing(WebInputElement(inputElement));
 }
 
 void EditorClientImpl::textFieldDidEndEditing(Element* element)
 {
+    HTMLInputElement* inputElement = toHTMLInputElement(element);
+    if (m_webView->client() && inputElement)
+        m_webView->client()->textFieldDidEndEditing(WebInputElement(inputElement));
+
     // Notification that focus was lost.  Be careful with this, it's also sent
     // when the page is being closed.
 
@@ -664,7 +673,6 @@ void EditorClientImpl::textFieldDidEndEditing(Element* element)
         return; // The page is getting closed, don't fill the password.
 
     // Notify any password-listener of the focus change.
-    HTMLInputElement* inputElement = WebKit::toHTMLInputElement(element);
     if (!inputElement)
         return;
 
@@ -682,15 +690,18 @@ void EditorClientImpl::textFieldDidEndEditing(Element* element)
 void EditorClientImpl::textDidChangeInTextField(Element* element)
 {
     ASSERT(element->hasLocalName(HTMLNames::inputTag));
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
+    if (m_webView->client())
+        m_webView->client()->textFieldDidChange(WebInputElement(inputElement));
+
     // Note that we only show the autofill popup in this case if the caret is at
     // the end.  This matches FireFox and Safari but not IE.
-    autofill(static_cast<HTMLInputElement*>(element), false, false,
-             true);
+    autofill(inputElement, false, false, true);
 }
 
 bool EditorClientImpl::showFormAutofillForNode(Node* node)
 {
-    HTMLInputElement* inputElement = WebKit::toHTMLInputElement(node);
+    HTMLInputElement* inputElement = toHTMLInputElement(node);
     if (inputElement)
         return autofill(inputElement, true, true, false);
     return false;
@@ -792,6 +803,9 @@ void EditorClientImpl::cancelPendingAutofill()
 
 void EditorClientImpl::onAutocompleteSuggestionAccepted(HTMLInputElement* textField)
 {
+    if (m_webView->client())
+        m_webView->client()->didAcceptAutocompleteSuggestion(WebInputElement(textField));
+
     WebFrameImpl* webframe = WebFrameImpl::fromFrame(textField->document()->frame());
     if (!webframe)
         return;
@@ -802,6 +816,12 @@ void EditorClientImpl::onAutocompleteSuggestionAccepted(HTMLInputElement* textFi
 bool EditorClientImpl::doTextFieldCommandFromEvent(Element* element,
                                                    KeyboardEvent* event)
 {
+    HTMLInputElement* inputElement = toHTMLInputElement(element);
+    if (m_webView->client() && inputElement) {
+        m_webView->client()->textFieldDidReceiveKeyDown(WebInputElement(inputElement),
+                                                        WebKeyboardEventBuilder(*event));
+    }
+
     // Remember if backspace was pressed for the autofill.  It is not clear how to
     // find if backspace was pressed from textFieldDidBeginEditing and
     // textDidChangeInTextField as when these methods are called the value of the
diff --git a/WebKit/chromium/src/GLES2Context.cpp b/WebKit/chromium/src/GLES2Context.cpp
index b6d619c..f342436 100644
--- a/WebKit/chromium/src/GLES2Context.cpp
+++ b/WebKit/chromium/src/GLES2Context.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 
 #include "GLES2Context.h"
+#include "IntSize.h"
 #include "WebGLES2Context.h"
 #include "WebKit.h"
 #include "WebKitClient.h"
@@ -56,7 +57,8 @@ public:
     GLES2ContextInternal() {}
     ~GLES2ContextInternal() {}
 
-    bool initialize(Page*);
+    bool initializeOnscreen(Page*);
+    bool initializeOffscreen(GLES2Context*);
 
     WebGLES2Context* getWebGLES2Context() { return m_impl; }
 
@@ -64,7 +66,7 @@ private:
     WebGLES2Context* m_impl;
 };
 
-bool GLES2ContextInternal::initialize(Page* page)
+bool GLES2ContextInternal::initializeOnscreen(Page* page)
 {
     ASSERT(page);
     WebViewImpl* webView = WebViewImpl::fromPage(page);
@@ -75,10 +77,22 @@ bool GLES2ContextInternal::initialize(Page* page)
     return true;
 }
 
-PassOwnPtr<GLES2Context> GLES2Context::create(Page* page)
+bool GLES2ContextInternal::initializeOffscreen(GLES2Context* parent)
+{
+    m_impl = webKitClient()->createGLES2Context();
+    if (!m_impl)
+        return false;
+    if (!m_impl->initialize(0, parent ? parent->m_internal->m_impl : 0)) {
+        delete m_impl;
+        return false;
+    }
+    return true;
+}
+
+PassOwnPtr<GLES2Context> GLES2Context::createOnscreen(Page* page)
 {
     GLES2ContextInternal* internal = new GLES2ContextInternal();
-    if (!internal->initialize(page)) {
+    if (!internal->initializeOnscreen(page)) {
         delete internal;
         return 0;
     }
@@ -87,6 +101,19 @@ PassOwnPtr<GLES2Context> GLES2Context::create(Page* page)
     return result;
 }
 
+PassOwnPtr<GLES2Context> GLES2Context::createOffscreen(GLES2Context* parent)
+{
+    GLES2ContextInternal* internal = new GLES2ContextInternal();
+    if (!internal->initializeOffscreen(parent)) {
+        delete internal;
+        return 0;
+    }
+    PassOwnPtr<GLES2Context> result = new GLES2Context();
+    result->m_internal.set(internal);
+    return result;
+}
+
+
 GLES2Context::~GLES2Context()
 {
 }
@@ -115,4 +142,18 @@ bool GLES2Context::swapBuffers()
     return webContext->swapBuffers();
 }
 
+void GLES2Context::resizeOffscreenContent(const IntSize& size)
+{
+    WebGLES2Context* webContext = m_internal->getWebGLES2Context();
+    ASSERT(webContext);
+    webContext->resizeOffscreenContent(size);
+}
+
+unsigned GLES2Context::getOffscreenContentParentTextureId()
+{
+    WebGLES2Context* webContext = m_internal->getWebGLES2Context();
+    ASSERT(webContext);
+    return webContext->getOffscreenContentParentTextureId();
+}
+
 }  // namespace WebCore
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.cpp b/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 7a6571a..3591bee 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -35,6 +35,7 @@
 #include "WebIDBDatabaseImpl.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBIndexImpl.h"
+#include "WebIDBKey.h"
 #include "WebIDBObjectStoreImpl.h"
 #include "WebSerializedScriptValue.h"
 
@@ -44,7 +45,7 @@ namespace WebCore {
 
 PassRefPtr<IDBCallbacksProxy> IDBCallbacksProxy::create(PassOwnPtr<WebKit::WebIDBCallbacks> callbacks)
 {
-    return new IDBCallbacksProxy(callbacks);
+    return adoptRef(new IDBCallbacksProxy(callbacks));
 }
 
 IDBCallbacksProxy::IDBCallbacksProxy(PassOwnPtr<WebKit::WebIDBCallbacks> callbacks)
@@ -82,7 +83,8 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBIndex> idbIndex)
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
-    ASSERT_NOT_REACHED();
+    m_callbacks->onSuccess(WebKit::WebIDBKey(idbKey));
+    m_callbacks.clear();
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBObjectStore> idbObjectStore)
@@ -100,4 +102,3 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<SerializedScriptValue> serializedSc
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
-
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.h b/WebKit/chromium/src/IDBCallbacksProxy.h
index fc424f8..c5a8858 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -42,11 +42,6 @@ class WebIDBCallbacks;
 
 namespace WebCore {
 
-class IDBDatabaseError;
-class IDBDatabase;
-class IDBObjectStore;
-class SerializedScriptValue;
-
 class IDBCallbacksProxy : public IDBCallbacks {
 public:
     static PassRefPtr<IDBCallbacksProxy> create(PassOwnPtr<WebKit::WebIDBCallbacks>);
diff --git a/WebKit/chromium/src/IDBObjectStoreProxy.cpp b/WebKit/chromium/src/IDBObjectStoreProxy.cpp
index 5942e2a..cec4ed3 100755
--- a/WebKit/chromium/src/IDBObjectStoreProxy.cpp
+++ b/WebKit/chromium/src/IDBObjectStoreProxy.cpp
@@ -31,7 +31,9 @@
 #include "IDBIndexProxy.h"
 #include "WebIDBCallbacksImpl.h"
 #include "WebIDBIndex.h"
+#include "WebIDBKey.h"
 #include "WebIDBObjectStore.h"
+#include "WebSerializedScriptValue.h"
 
 #if ENABLE(INDEXED_DATABASE)
 
@@ -66,6 +68,21 @@ PassRefPtr<DOMStringList> IDBObjectStoreProxy::indexNames() const
     return m_webIDBObjectStore->indexNames();
 }
 
+void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+{
+    m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks));
+}
+
+void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks> callbacks)
+{
+    m_webIDBObjectStore->put(value, key, addOnly, new WebIDBCallbacksImpl(callbacks));
+}
+
+void IDBObjectStoreProxy::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+{
+    m_webIDBObjectStore->remove(key, new WebIDBCallbacksImpl(callbacks));
+}
+
 void IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks> callbacks)
 {
     m_webIDBObjectStore->createIndex(name, keyPath, unique, new WebIDBCallbacksImpl(callbacks));
diff --git a/WebKit/chromium/src/IDBObjectStoreProxy.h b/WebKit/chromium/src/IDBObjectStoreProxy.h
index 78983cb..b8e4a01 100755
--- a/WebKit/chromium/src/IDBObjectStoreProxy.h
+++ b/WebKit/chromium/src/IDBObjectStoreProxy.h
@@ -43,15 +43,19 @@ class IDBIndex;
 class IDBObjectStoreProxy : public IDBObjectStore {
 public:
     static PassRefPtr<IDBObjectStore> create(PassOwnPtr<WebKit::WebIDBObjectStore>);
-    virtual ~IDBObjectStoreProxy();
+    ~IDBObjectStoreProxy();
 
-    virtual String name() const;
-    virtual String keyPath() const;
-    virtual PassRefPtr<DOMStringList> indexNames() const;
+    String name() const;
+    String keyPath() const;
+    PassRefPtr<DOMStringList> indexNames() const;
 
-    virtual void createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBIndex> index(const String& name);
-    virtual void removeIndex(const String& name, PassRefPtr<IDBCallbacks>);
+    void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>);
+    void remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+
+    void createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks>);
+    PassRefPtr<IDBIndex> index(const String& name);
+    void removeIndex(const String& name, PassRefPtr<IDBCallbacks>);
 
 private:
     IDBObjectStoreProxy(PassOwnPtr<WebKit::WebIDBObjectStore>);
diff --git a/WebKit/chromium/src/NotificationPresenterImpl.cpp b/WebKit/chromium/src/NotificationPresenterImpl.cpp
index dca1856..1931465 100644
--- a/WebKit/chromium/src/NotificationPresenterImpl.cpp
+++ b/WebKit/chromium/src/NotificationPresenterImpl.cpp
@@ -35,6 +35,7 @@
 
 #include "KURL.h"
 #include "Notification.h"
+#include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
 
 #include "WebNotification.h"
@@ -91,15 +92,15 @@ void NotificationPresenterImpl::notificationObjectDestroyed(Notification* notifi
     m_presenter->objectDestroyed(PassRefPtr<Notification>(notification));
 }
 
-NotificationPresenter::Permission NotificationPresenterImpl::checkPermission(const KURL& sourceURL)
+NotificationPresenter::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
 {
-    int result = m_presenter->checkPermission(sourceURL);
+    int result = m_presenter->checkPermission(context->url());
     return static_cast<NotificationPresenter::Permission>(result);
 }
 
-void NotificationPresenterImpl::requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback)
+void NotificationPresenterImpl::requestPermission(ScriptExecutionContext* context, PassRefPtr<VoidCallback> callback)
 {
-    m_presenter->requestPermission(WebSecurityOrigin(origin), new VoidCallbackClient(callback));
+    m_presenter->requestPermission(WebSecurityOrigin(context->securityOrigin()), new VoidCallbackClient(callback));
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/NotificationPresenterImpl.h b/WebKit/chromium/src/NotificationPresenterImpl.h
index 479538f..bb156dd 100644
--- a/WebKit/chromium/src/NotificationPresenterImpl.h
+++ b/WebKit/chromium/src/NotificationPresenterImpl.h
@@ -54,8 +54,9 @@ public:
     virtual bool show(WebCore::Notification* object);
     virtual void cancel(WebCore::Notification* object);
     virtual void notificationObjectDestroyed(WebCore::Notification* object);
-    virtual WebCore::NotificationPresenter::Permission checkPermission(const WebCore::KURL& sourceURL);
-    virtual void requestPermission(WebCore::SecurityOrigin* origin, WTF::PassRefPtr<WebCore::VoidCallback> callback);
+    virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::ScriptExecutionContext*);
+    virtual void requestPermission(WebCore::ScriptExecutionContext* , WTF::PassRefPtr<WebCore::VoidCallback> callback);
+    virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) {}
 
 private:
     // WebNotificationPresenter that this object delegates to.
diff --git a/WebKit/chromium/src/SharedWorkerRepository.cpp b/WebKit/chromium/src/SharedWorkerRepository.cpp
index 2c4e918..88d3ec5 100644
--- a/WebKit/chromium/src/SharedWorkerRepository.cpp
+++ b/WebKit/chromium/src/SharedWorkerRepository.cpp
@@ -220,7 +220,7 @@ void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr
 
     // The loader object manages its own lifecycle (and the lifecycles of the two worker objects).
     // It will free itself once loading is completed.
-    SharedWorkerScriptLoader* loader = new SharedWorkerScriptLoader(worker, url, name, port.release(), webWorker.release());
+    SharedWorkerScriptLoader* loader = new SharedWorkerScriptLoader(worker, url, name, port, webWorker.release());
     loader->load();
 }
 
diff --git a/WebKit/chromium/src/WebDataSourceImpl.cpp b/WebKit/chromium/src/WebDataSourceImpl.cpp
index 5a315cf..ac2a02d 100644
--- a/WebKit/chromium/src/WebDataSourceImpl.cpp
+++ b/WebKit/chromium/src/WebDataSourceImpl.cpp
@@ -156,7 +156,7 @@ void WebDataSourceImpl::setNextPluginLoadObserver(PassOwnPtr<WebPluginLoadObserv
 {
     // This call should always be followed up with the creation of a
     // WebDataSourceImpl, so we should never leak this object.
-    m_nextPluginLoadObserver = observer.release();
+    m_nextPluginLoadObserver = observer.leakPtr();
 }
 
 WebDataSourceImpl::WebDataSourceImpl(const ResourceRequest& request, const SubstituteData& data)
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 20ab1d3..4205c62 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -520,10 +520,10 @@ void WebDevToolsAgentImpl::identifierForInitialRequest(
     }
 }
 
-void WebDevToolsAgentImpl::willSendRequest(unsigned long resourceId, const WebURLRequest& request)
+void WebDevToolsAgentImpl::willSendRequest(unsigned long resourceId, WebURLRequest& request)
 {
     if (InspectorController* ic = inspectorController())
-        ic->willSendRequest(resourceId, request.toResourceRequest(), ResourceResponse());
+        ic->willSendRequest(resourceId, request.toMutableResourceRequest(), ResourceResponse());
 }
 
 void WebDevToolsAgentImpl::didReceiveData(unsigned long resourceId, int length)
@@ -598,6 +598,11 @@ bool WebDevToolsAgentImpl::sendMessageToFrontend(const WebCore::String& message)
     if (!devToolsAgent)
         return false;
 
+    if (devToolsAgent->m_apuAgentEnabled && devToolsAgent->m_apuAgentDelegateStub) {
+        devToolsAgent->m_apuAgentDelegateStub->dispatchToApu(message);
+        return true;
+    }
+
     WebVector<WebString> arguments(size_t(1));
     arguments[0] = message;
     WebDevToolsMessageData data;
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.h b/WebKit/chromium/src/WebDevToolsAgentImpl.h
index c97b21f..12f51f9 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.h
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.h
@@ -89,7 +89,7 @@ public:
     virtual void setTimelineProfilingEnabled(bool enable);
 
     virtual void identifierForInitialRequest(unsigned long, WebFrame*, const WebURLRequest&);
-    virtual void willSendRequest(unsigned long, const WebURLRequest&);
+    virtual void willSendRequest(unsigned long, WebURLRequest&);
     virtual void didReceiveData(unsigned long, int length);
     virtual void didReceiveResponse(unsigned long, const WebURLResponse&);
     virtual void didFinishLoading(unsigned long);
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
index ff4883e..535d128 100644
--- a/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -130,6 +130,7 @@
 #include "WebHistoryItem.h"
 #include "WebInputElement.h"
 #include "WebPasswordAutocompleteListener.h"
+#include "WebPlugin.h"
 #include "WebPluginContainerImpl.h"
 #include "WebRange.h"
 #include "WebRect.h"
@@ -248,9 +249,7 @@ static void frameContentAsPlainText(size_t maxChars, Frame* frame,
     }
 }
 
-// If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
-// that hosts the plugin.
-static WebPluginContainerImpl* pluginContainerFromFrame(Frame* frame)
+WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(Frame* frame)
 {
     if (!frame)
         return 0;
@@ -348,7 +347,7 @@ public:
 
     virtual void end()
     {
-        WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(m_frame);
+        WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(m_frame);
         if (pluginContainer && pluginContainer->supportsPaginatedPrint())
             pluginContainer->printEnd();
         else
@@ -363,7 +362,7 @@ public:
 
     virtual void computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight)
     {
-        WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(m_frame);
+        WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(m_frame);
         if (pluginContainer && pluginContainer->supportsPaginatedPrint())
             m_pageCount = pluginContainer->printBegin(IntRect(printRect), m_printerDPI);
         else
@@ -380,7 +379,7 @@ public:
     // instead.  Returns the scale to be applied.
     virtual float spoolPage(GraphicsContext& ctx, int pageNumber)
     {
-        WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(m_frame);
+        WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(m_frame);
         if (pluginContainer && pluginContainer->supportsPaginatedPrint())
             pluginContainer->printPage(pageNumber, &ctx);
         else
@@ -1094,6 +1093,14 @@ bool WebFrameImpl::executeCommand(const WebString& name)
     if (command[command.length() - 1] == UChar(':'))
         command = command.substring(0, command.length() - 1);
 
+    if (command == "Copy") {
+        WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+        if (pluginContainer) {
+            pluginContainer->copy();
+            return true;
+        }
+    }
+
     bool rv = true;
 
     // Specially handling commands that Editor::execCommand does not directly
@@ -1164,6 +1171,10 @@ bool WebFrameImpl::isContinuousSpellCheckingEnabled() const
 
 bool WebFrameImpl::hasSelection() const
 {
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+    if (pluginContainer)
+        return pluginContainer->plugin()->hasSelection();
+
     // frame()->selection()->isNone() never returns true.
     return (frame()->selection()->start() != frame()->selection()->end());
 }
@@ -1175,6 +1186,10 @@ WebRange WebFrameImpl::selectionRange() const
 
 WebString WebFrameImpl::selectionAsText() const
 {
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+    if (pluginContainer)
+        return pluginContainer->plugin()->selectionAsText();
+
     RefPtr<Range> range = frame()->selection()->toNormalizedRange();
     if (!range.get())
         return WebString();
@@ -1189,6 +1204,10 @@ WebString WebFrameImpl::selectionAsText() const
 
 WebString WebFrameImpl::selectionAsMarkup() const
 {
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+    if (pluginContainer)
+        return pluginContainer->plugin()->selectionAsMarkup();
+
     RefPtr<Range> range = frame()->selection()->toNormalizedRange();
     if (!range.get())
         return WebString();
@@ -1960,7 +1979,7 @@ bool WebFrameImpl::registerPasswordListener(
     WebInputElement inputElement,
     WebPasswordAutocompleteListener* listener)
 {
-    RefPtr<HTMLInputElement> element = inputElement.operator PassRefPtr<HTMLInputElement>();
+    RefPtr<HTMLInputElement> element(inputElement.unwrap<HTMLInputElement>());
     if (!m_passwordListeners.add(element, listener).second) {
         delete listener;
         return false;
@@ -1971,8 +1990,8 @@ bool WebFrameImpl::registerPasswordListener(
 void WebFrameImpl::notifiyPasswordListenerOfAutocomplete(
     const WebInputElement& inputElement)
 {
-    RefPtr<HTMLInputElement> element = inputElement.operator PassRefPtr<HTMLInputElement>();
-    WebPasswordAutocompleteListener* listener = getPasswordListener(element.get());
+    const HTMLInputElement* element = inputElement.constUnwrap<HTMLInputElement>();
+    WebPasswordAutocompleteListener* listener = getPasswordListener(element);
     // Password listeners need to autocomplete other fields that depend on the
     // input element with autofill suggestions.
     if (listener)
@@ -1980,9 +1999,9 @@ void WebFrameImpl::notifiyPasswordListenerOfAutocomplete(
 }
 
 WebPasswordAutocompleteListener* WebFrameImpl::getPasswordListener(
-    HTMLInputElement* inputElement)
+    const HTMLInputElement* inputElement)
 {
-    return m_passwordListeners.get(RefPtr<HTMLInputElement>(inputElement));
+    return m_passwordListeners.get(RefPtr<HTMLInputElement>(const_cast<HTMLInputElement*>(inputElement)));
 }
 
 // WebFrameImpl private --------------------------------------------------------
diff --git a/WebKit/chromium/src/WebFrameImpl.h b/WebKit/chromium/src/WebFrameImpl.h
index aa1edd6..2511fce 100644
--- a/WebKit/chromium/src/WebFrameImpl.h
+++ b/WebKit/chromium/src/WebFrameImpl.h
@@ -56,6 +56,7 @@ class WebDataSourceImpl;
 class WebInputElement;
 class WebFrameClient;
 class WebPasswordAutocompleteListener;
+class WebPluginContainerImpl;
 class WebView;
 class WebViewImpl;
 
@@ -197,6 +198,10 @@ public:
     static WebFrameImpl* fromFrame(WebCore::Frame* frame);
     static WebFrameImpl* fromFrameOwnerElement(WebCore::Element* element);
 
+    // If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
+    // that hosts the plugin.
+    static WebPluginContainerImpl* pluginContainerFromFrame(WebCore::Frame*);
+
     WebViewImpl* viewImpl() const;
 
     WebCore::Frame* frame() const { return m_frame; }
@@ -231,7 +236,7 @@ public:
     // user name input element, or 0 if none available.
     // Note that the returned listener is owner by the WebFrameImpl and should not
     // be kept around as it is deleted when the page goes away.
-    WebPasswordAutocompleteListener* getPasswordListener(WebCore::HTMLInputElement*);
+    WebPasswordAutocompleteListener* getPasswordListener(const WebCore::HTMLInputElement*);
 
     WebFrameClient* client() const { return m_client; }
     void setClient(WebFrameClient* client) { m_client = client; }
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index 891e3b3..21c9eed 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -30,11 +30,13 @@
 #include "IDBDatabaseError.h"
 #include "IDBDatabaseProxy.h"
 #include "IDBIndexProxy.h"
+#include "IDBKey.h"
 #include "IDBObjectStoreProxy.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBDatabase.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBIndex.h"
+#include "WebIDBKey.h"
 #include "WebIDBObjectStore.h"
 #include "WebSerializedScriptValue.h"
 
@@ -69,6 +71,12 @@ void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBDatabase* webKitInstance)
     m_callbacks.clear();
 }
 
+void WebIDBCallbacksImpl::onSuccess(const WebKit::WebIDBKey& key)
+{
+    m_callbacks->onSuccess(key);
+    m_callbacks.clear();
+}
+
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBIndex* webKitInstance)
 {
     m_callbacks->onSuccess(IDBIndexProxy::create(webKitInstance));
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.h b/WebKit/chromium/src/WebIDBCallbacksImpl.h
index 519f692..a4d53b5 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -44,6 +44,7 @@ public:
     virtual void onError(const WebKit::WebIDBDatabaseError&);
     virtual void onSuccess(); // For "null".
     virtual void onSuccess(WebKit::WebIDBDatabase*);
+    virtual void onSuccess(const WebKit::WebIDBKey&);
     virtual void onSuccess(WebKit::WebIDBIndex*);
     virtual void onSuccess(WebKit::WebIDBObjectStore*);
     virtual void onSuccess(const WebKit::WebSerializedScriptValue&);
diff --git a/WebKit/chromium/src/WebIDBKey.cpp b/WebKit/chromium/src/WebIDBKey.cpp
new file mode 100644
index 0000000..a52ea56
--- /dev/null
+++ b/WebKit/chromium/src/WebIDBKey.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebIDBKey.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBKey.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebIDBKey::~WebIDBKey()
+{
+    m_private.reset();
+}
+
+WebIDBKey WebIDBKey::createNull()
+{
+    WebIDBKey key;
+    key.assignNull();
+    return key;
+}
+
+WebIDBKey WebIDBKey::createInvalid()
+{
+    WebIDBKey key;
+    key.assignInvalid();
+    return key;
+}
+
+void WebIDBKey::assign(const WebIDBKey& value)
+{
+    m_private = value.m_private;
+}
+
+void WebIDBKey::assignNull()
+{
+    m_private = IDBKey::create();
+}
+
+void WebIDBKey::assign(const WebString& string)
+{
+    m_private = IDBKey::create(string);
+}
+
+void WebIDBKey::assign(int32_t number)
+{
+    m_private = IDBKey::create(number);
+}
+
+void WebIDBKey::assignInvalid()
+{
+    m_private = 0;
+}
+
+WebIDBKey::Type WebIDBKey::type() const
+{
+    if (!m_private.get())
+        return InvalidType;
+    return Type(m_private->type());
+}
+
+WebString WebIDBKey::string() const
+{
+    return m_private->string();
+}
+
+int32_t WebIDBKey::number() const
+{
+    return m_private->number();
+}
+
+WebIDBKey::WebIDBKey(const PassRefPtr<IDBKey>& value)
+    : m_private(value)
+{
+}
+
+WebIDBKey& WebIDBKey::operator=(const PassRefPtr<IDBKey>& value)
+{
+    m_private = value;
+    return *this;
+}
+
+WebIDBKey::operator PassRefPtr<IDBKey>() const
+{
+    return m_private.get();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index a41010a..d8e98db 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -30,6 +30,8 @@
 #include "IDBCallbacksProxy.h"
 #include "IDBObjectStore.h"
 #include "WebIDBIndexImpl.h"
+#include "WebIDBKey.h"
+#include "WebSerializedScriptValue.h"
 
 #if ENABLE(INDEXED_DATABASE)
 
@@ -61,6 +63,21 @@ WebDOMStringList WebIDBObjectStoreImpl::indexNames() const
     return m_objectStore->indexNames();
 }
 
+void WebIDBObjectStoreImpl::get(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+{
+    m_objectStore->get(key, IDBCallbacksProxy::create(callbacks));
+}
+
+void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks)
+{
+    m_objectStore->put(value, key, addOnly, IDBCallbacksProxy::create(callbacks));
+}
+
+void WebIDBObjectStoreImpl::remove(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+{
+    m_objectStore->remove(key, IDBCallbacksProxy::create(callbacks));
+}
+
 void WebIDBObjectStoreImpl::createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks)
 {
     m_objectStore->createIndex(name, keyPath, unique, IDBCallbacksProxy::create(callbacks));
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index f59840f..4064b7f 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -41,15 +41,19 @@ class WebIDBIndex;
 class WebIDBObjectStoreImpl : public WebIDBObjectStore {
 public:
     WebIDBObjectStoreImpl(WTF::PassRefPtr<WebCore::IDBObjectStore> objectStore);
-    virtual ~WebIDBObjectStoreImpl();
+    ~WebIDBObjectStoreImpl();
 
-    virtual WebString name() const;
-    virtual WebString keyPath() const;
-    virtual WebDOMStringList indexNames() const;
+    WebString name() const;
+    WebString keyPath() const;
+    WebDOMStringList indexNames() const;
 
-    virtual void createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks);
-    virtual WebIDBIndex* index(const WebString& name);
-    virtual void removeIndex(const WebString& name, WebIDBCallbacks* callbacks);
+    void get(const WebIDBKey& key, WebIDBCallbacks*);
+    void put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks*);
+    void remove(const WebIDBKey& key, WebIDBCallbacks*);
+
+    void createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks);
+    WebIDBIndex* index(const WebString& name);
+    void removeIndex(const WebString& name, WebIDBCallbacks* callbacks);
 
  private:
     WTF::RefPtr<WebCore::IDBObjectStore> m_objectStore;
diff --git a/WebKit/chromium/src/WebInputElement.cpp b/WebKit/chromium/src/WebInputElement.cpp
index 18bafd6..3b88335 100644
--- a/WebKit/chromium/src/WebInputElement.cpp
+++ b/WebKit/chromium/src/WebInputElement.cpp
@@ -45,6 +45,11 @@ bool WebInputElement::autoComplete() const
     return constUnwrap<HTMLInputElement>()->autoComplete();
 }
 
+bool WebInputElement::isReadOnly() const
+{
+    return constUnwrap<HTMLInputElement>()->readOnly();
+}
+
 bool WebInputElement::isEnabledFormControl() const
 {
     return constUnwrap<HTMLInputElement>()->isEnabledFormControl();
@@ -85,6 +90,16 @@ WebString WebInputElement::value() const
     return constUnwrap<HTMLInputElement>()->value();
 }
 
+void WebInputElement::setSuggestedValue(const WebString& value)
+{
+    unwrap<HTMLInputElement>()->setSuggestedValue(value);
+}
+
+WebString WebInputElement::suggestedValue() const
+{
+    return constUnwrap<HTMLInputElement>()->suggestedValue();
+}
+
 void WebInputElement::setPlaceholder(const WebString& value)
 {
     unwrap<HTMLInputElement>()->setPlaceholder(value);
@@ -115,6 +130,16 @@ void WebInputElement::setSelectionRange(int start, int end)
     unwrap<HTMLInputElement>()->setSelectionRange(start, end);
 }
 
+int WebInputElement::selectionStart()
+{
+    return unwrap<HTMLInputElement>()->selectionStart();
+}
+
+int WebInputElement::selectionEnd()
+{
+    return unwrap<HTMLInputElement>()->selectionEnd();
+}
+
 WebInputElement::WebInputElement(const PassRefPtr<HTMLInputElement>& elem)
     : WebFormControlElement(elem)
 {
diff --git a/WebKit/chromium/src/WebNode.cpp b/WebKit/chromium/src/WebNode.cpp
index 31ad70f..69c35e7 100644
--- a/WebKit/chromium/src/WebNode.cpp
+++ b/WebKit/chromium/src/WebNode.cpp
@@ -67,6 +67,11 @@ bool WebNode::equals(const WebNode& n) const
     return (m_private.get() == n.m_private.get());
 }
 
+bool WebNode::lessThan(const WebNode& n) const
+{
+    return (m_private.get() < n.m_private.get());
+}
+
 WebNode::NodeType WebNode::nodeType() const
 {
     return static_cast<NodeType>(m_private->nodeType());
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.cpp b/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 41758d2..e24e372 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -33,14 +33,18 @@
 
 #include "Chrome.h"
 #include "ChromeClientImpl.h"
+#include "WebClipboard.h"
 #include "WebCursorInfo.h"
 #include "WebDataSourceImpl.h"
 #include "WebElement.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
 #include "WebKit.h"
+#include "WebKitClient.h"
 #include "WebPlugin.h"
 #include "WebRect.h"
+#include "WebString.h"
+#include "WebURL.h"
 #include "WebURLError.h"
 #include "WebURLRequest.h"
 #include "WebVector.h"
@@ -57,6 +61,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
@@ -246,9 +251,12 @@ void WebPluginContainerImpl::printEnd()
     return m_webPlugin->printEnd();
 }
 
-WebString WebPluginContainerImpl::selectedText()
+void WebPluginContainerImpl::copy()
 {
-    return m_webPlugin->selectedText();
+    if (!plugin()->hasSelection())
+        return;
+
+    webKitClient()->clipboard()->writeHTML(plugin()->selectionAsMarkup(), WebURL(), plugin()->selectionAsText(), false);
 }
 
 WebElement WebPluginContainerImpl::element()
@@ -441,6 +449,19 @@ void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
     if (webEvent.type == WebInputEvent::Undefined)
         return;
 
+    if (webEvent.type == WebInputEvent::KeyDown) {
+#if defined(OS_MACOSX)
+        if (webEvent.modifiers == WebInputEvent::MetaKey
+#else
+        if (webEvent.modifiers == WebInputEvent::ControlKey
+#endif
+            && webEvent.windowsKeyCode == VKEY_C) {
+            copy();
+            event->setDefaultHandled();
+            return;
+        }
+    }
+
     WebCursorInfo cursorInfo;
     if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
         event->setDefaultHandled();
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.h b/WebKit/chromium/src/WebPluginContainerImpl.h
index dd0871a..2a46e00 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -102,7 +102,8 @@ public:
     // Ends the print operation.
     void printEnd();
 
-    WebString selectedText();
+    // Copy the selected text.
+    void copy();
 
     // Resource load events for the plugin's source data:
     void didReceiveResponse(const WebCore::ResourceResponse&);
diff --git a/WebKit/chromium/src/WebPopupMenuImpl.cpp b/WebKit/chromium/src/WebPopupMenuImpl.cpp
index dbf9183..2abdc62 100644
--- a/WebKit/chromium/src/WebPopupMenuImpl.cpp
+++ b/WebKit/chromium/src/WebPopupMenuImpl.cpp
@@ -56,7 +56,8 @@ namespace WebKit {
 
 WebPopupMenu* WebPopupMenu::create(WebWidgetClient* client)
 {
-    return new WebPopupMenuImpl(client);
+    // Pass the WebPopupMenuImpl's self-reference to the caller.
+    return adoptRef(new WebPopupMenuImpl(client)).leakRef();
 }
 
 // WebWidget ------------------------------------------------------------------
diff --git a/WebKit/chromium/src/WebSerializedScriptValue.cpp b/WebKit/chromium/src/WebSerializedScriptValue.cpp
index ce8517a..7149a4d 100644
--- a/WebKit/chromium/src/WebSerializedScriptValue.cpp
+++ b/WebKit/chromium/src/WebSerializedScriptValue.cpp
@@ -43,6 +43,11 @@ WebSerializedScriptValue WebSerializedScriptValue::fromString(const WebString& s
     return SerializedScriptValue::createFromWire(s);
 }
 
+WebSerializedScriptValue WebSerializedScriptValue::createInvalid()
+{
+    return SerializedScriptValue::create();
+}
+
 void WebSerializedScriptValue::reset()
 {
     m_private.reset();
diff --git a/WebKit/chromium/src/WebSharedWorkerImpl.cpp b/WebKit/chromium/src/WebSharedWorkerImpl.cpp
index 51bbf1b..e73c0f4 100644
--- a/WebKit/chromium/src/WebSharedWorkerImpl.cpp
+++ b/WebKit/chromium/src/WebSharedWorkerImpl.cpp
@@ -85,7 +85,7 @@ void WebSharedWorkerImpl::connectTask(ScriptExecutionContext* context, WebShared
 {
     // Wrap the passed-in channel in a MessagePort, and send it off via a connect event.
     RefPtr<MessagePort> port = MessagePort::create(*context);
-    port->entangle(channel.release());
+    port->entangle(channel);
     ASSERT(context->isWorkerContext());
     WorkerContext* workerContext = static_cast<WorkerContext*>(context);
     ASSERT(workerContext->isSharedWorkerContext());
diff --git a/WebKit/chromium/src/WebURLLoadTiming.cpp b/WebKit/chromium/src/WebURLLoadTiming.cpp
new file mode 100644
index 0000000..27ed362
--- /dev/null
+++ b/WebKit/chromium/src/WebURLLoadTiming.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebURLLoadTiming.h"
+
+#include "ResourceLoadTiming.h"
+#include "WebString.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebURLLoadTiming::initialize()
+{
+    m_private = ResourceLoadTiming::create();
+}
+
+void WebURLLoadTiming::reset()
+{
+    m_private.reset();
+}
+
+void WebURLLoadTiming::assign(const WebURLLoadTiming& other)
+{
+    m_private = other.m_private;
+}
+
+double WebURLLoadTiming::requestTime() const
+{
+    return m_private->requestTime;
+}
+
+void WebURLLoadTiming::setRequestTime(double time)
+{
+    m_private->requestTime = time;
+}
+
+int WebURLLoadTiming::proxyStart() const
+{
+    return m_private->proxyStart;
+}
+
+void WebURLLoadTiming::setProxyStart(int start)
+{
+    m_private->proxyStart = start;
+}
+
+int WebURLLoadTiming::proxyEnd() const
+{
+    return m_private->proxyEnd;
+}
+
+void WebURLLoadTiming::setProxyEnd(int end)
+{
+    m_private->proxyEnd = end;
+}
+
+int WebURLLoadTiming::dnsStart() const
+{
+    return m_private->dnsStart;
+}
+
+void WebURLLoadTiming::setDNSStart(int start)
+{
+    m_private->dnsStart = start;
+}
+
+int WebURLLoadTiming::dnsEnd() const
+{
+    return m_private->dnsEnd;
+}
+
+void WebURLLoadTiming::setDNSEnd(int end)
+{
+    m_private->dnsEnd = end;
+}
+
+int WebURLLoadTiming::connectStart() const
+{
+    return m_private->connectStart;
+}
+
+void WebURLLoadTiming::setConnectStart(int start)
+{
+    m_private->connectStart = start;
+}
+
+int WebURLLoadTiming::connectEnd() const
+{
+    return m_private->connectEnd;
+}
+
+void WebURLLoadTiming::setConnectEnd(int end)
+{
+    m_private->connectEnd = end;
+}
+
+int WebURLLoadTiming::sendStart() const
+{
+    return m_private->sendStart;
+}
+
+void WebURLLoadTiming::setSendStart(int start)
+{
+    m_private->sendStart = start;
+}
+
+int WebURLLoadTiming::sendEnd() const
+{
+    return m_private->sendEnd;
+}
+
+void WebURLLoadTiming::setSendEnd(int end)
+{
+    m_private->sendEnd = end;
+}
+
+int WebURLLoadTiming::receiveHeadersEnd() const
+{
+    return m_private->receiveHeadersEnd;
+}
+
+void WebURLLoadTiming::setReceiveHeadersEnd(int end)
+{
+    m_private->receiveHeadersEnd = end;
+}
+
+int WebURLLoadTiming::sslStart() const
+{
+    return m_private->sslStart;
+}
+
+void WebURLLoadTiming::setSSLStart(int start)
+{
+    m_private->sslStart = start;
+}
+
+int WebURLLoadTiming::sslEnd() const
+{
+    return m_private->sslEnd;
+}
+
+void WebURLLoadTiming::setSSLEnd(int end)
+{
+    m_private->sslEnd = end;
+}
+
+WebURLLoadTiming::WebURLLoadTiming(const PassRefPtr<ResourceLoadTiming>& value)
+    : m_private(value)
+{
+}
+
+WebURLLoadTiming& WebURLLoadTiming::operator=(const PassRefPtr<ResourceLoadTiming>& value)
+{
+    m_private = value;
+    return *this;
+}
+
+WebURLLoadTiming::operator PassRefPtr<ResourceLoadTiming>() const
+{
+    return m_private.get();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLRequest.cpp b/WebKit/chromium/src/WebURLRequest.cpp
index 46fa842..3b2d251 100644
--- a/WebKit/chromium/src/WebURLRequest.cpp
+++ b/WebKit/chromium/src/WebURLRequest.cpp
@@ -194,6 +194,16 @@ void WebURLRequest::setReportUploadProgress(bool reportUploadProgress)
     m_private->m_resourceRequest->setReportUploadProgress(reportUploadProgress);
 }
 
+bool WebURLRequest::reportLoadTiming() const
+{
+    return m_private->m_resourceRequest->reportLoadTiming();
+}
+
+void WebURLRequest::setReportLoadTiming(bool reportLoadTiming)
+{
+    m_private->m_resourceRequest->setReportLoadTiming(reportLoadTiming);
+}
+
 WebURLRequest::TargetType WebURLRequest::targetType() const
 {
     return static_cast<TargetType>(m_private->m_resourceRequest->targetType());
diff --git a/WebKit/chromium/src/WebURLResponse.cpp b/WebKit/chromium/src/WebURLResponse.cpp
index 3f3ddba..2b7facc 100644
--- a/WebKit/chromium/src/WebURLResponse.cpp
+++ b/WebKit/chromium/src/WebURLResponse.cpp
@@ -32,12 +32,16 @@
 #include "WebURLResponse.h"
 
 #include "ResourceResponse.h"
+#include "ResourceLoadTiming.h"
 
 #include "WebHTTPHeaderVisitor.h"
 #include "WebString.h"
 #include "WebURL.h"
+#include "WebURLLoadTiming.h"
 #include "WebURLResponsePrivate.h"
 
+#include <wtf/RefPtr.h>
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -93,6 +97,27 @@ void WebURLResponse::setURL(const WebURL& url)
     m_private->m_resourceResponse->setURL(url);
 }
 
+unsigned WebURLResponse::connectionID() const
+{
+    return m_private->m_resourceResponse->connectionID();
+}
+
+void WebURLResponse::setConnectionID(unsigned connectionID)
+{
+    m_private->m_resourceResponse->setConnectionID(connectionID);
+}
+
+WebURLLoadTiming WebURLResponse::loadTiming()
+{
+    return WebURLLoadTiming(m_private->m_resourceResponse->resourceLoadTiming());
+}
+
+void WebURLResponse::setLoadTiming(const WebURLLoadTiming& timing)
+{
+    RefPtr<ResourceLoadTiming> loadTiming = PassRefPtr<ResourceLoadTiming>(timing);
+    m_private->m_resourceResponse->setResourceLoadTiming(loadTiming.release());
+}
+
 double WebURLResponse::responseTime() const
 {
     return m_private->m_resourceResponse->responseTime();
@@ -267,6 +292,16 @@ const ResourceResponse& WebURLResponse::toResourceResponse() const
     return *m_private->m_resourceResponse;
 }
 
+bool WebURLResponse::wasCached() const
+{
+    return m_private->m_resourceResponse->wasCached();
+}
+
+void WebURLResponse::setWasCached(bool value)
+{
+    m_private->m_resourceResponse->setWasCached(value);
+}
+
 bool WebURLResponse::wasFetchedViaSPDY() const
 {
     return m_private->m_resourceResponse->wasFetchedViaSPDY();
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index 45b9117..d1ca71e 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -84,6 +84,7 @@
 #include "Settings.h"
 #include "Timer.h"
 #include "TypingCommand.h"
+#include "Vector.h"
 #include "WebAccessibilityObject.h"
 #include "WebDevToolsAgentPrivate.h"
 #include "WebDevToolsAgentImpl.h"
@@ -96,6 +97,8 @@
 #include "WebKitClient.h"
 #include "WebMediaPlayerAction.h"
 #include "WebNode.h"
+#include "WebPlugin.h"
+#include "WebPluginContainerImpl.h"
 #include "WebPoint.h"
 #include "WebPopupMenuImpl.h"
 #include "WebRect.h"
@@ -137,8 +140,8 @@ static const double maxTextSizeMultiplier = 3.0;
 const char* pageGroupName = "default";
 
 // Used to defer all page activity in cases where the embedder wishes to run
-// a nested event loop.
-static PageGroupLoadDeferrer* pageGroupLoadDeferrer;
+// a nested event loop. Using a stack enables nesting of message loop invocations.
+static Vector<PageGroupLoadDeferrer*> pageGroupLoadDeferrerStack;
 
 // Ensure that the WebDragOperation enum values stay in sync with the original
 // DragOperation constants.
@@ -168,7 +171,8 @@ static const PopupContainerSettings autoFillPopupSettings = {
 
 WebView* WebView::create(WebViewClient* client, WebDevToolsAgentClient* devToolsClient)
 {
-    return new WebViewImpl(client, devToolsClient);
+    // Pass the WebViewImpl's self-reference to the caller.
+    return adoptRef(new WebViewImpl(client, devToolsClient)).leakRef();
 }
 
 void WebView::updateVisitedLinkState(unsigned long long linkHash)
@@ -183,23 +187,23 @@ void WebView::resetVisitedLinkState()
 
 void WebView::willEnterModalLoop()
 {
-    // It is not valid to nest more than once.
-    ASSERT(!pageGroupLoadDeferrer);
-
     PageGroup* pageGroup = PageGroup::pageGroup(pageGroupName);
     ASSERT(pageGroup);
 
     if (pageGroup->pages().isEmpty())
-        return;
-
-    // Pick any page in the page group since we are deferring all pages.
-    pageGroupLoadDeferrer = new PageGroupLoadDeferrer(*pageGroup->pages().begin(), true);
+        pageGroupLoadDeferrerStack.append(static_cast<PageGroupLoadDeferrer*>(0));
+    else {
+        // Pick any page in the page group since we are deferring all pages.
+        pageGroupLoadDeferrerStack.append(new PageGroupLoadDeferrer(*pageGroup->pages().begin(), true));
+    }
 }
 
 void WebView::didExitModalLoop()
 {
-    delete pageGroupLoadDeferrer;
-    pageGroupLoadDeferrer = 0;
+    ASSERT(pageGroupLoadDeferrerStack.size());
+
+    delete pageGroupLoadDeferrerStack.last();
+    pageGroupLoadDeferrerStack.removeLast();
 }
 
 void WebViewImpl::initializeMainFrame(WebFrameClient* frameClient)
@@ -263,7 +267,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     if (devToolsClient)
         m_devToolsAgent = new WebDevToolsAgentImpl(this, devToolsClient);
 
-    m_page.set(new Page(&m_chromeClientImpl, &m_contextMenuClientImpl, &m_editorClientImpl, &m_dragClientImpl, &m_inspectorClientImpl, 0, 0, 0));
+    m_page.set(new Page(&m_chromeClientImpl, &m_contextMenuClientImpl, &m_editorClientImpl, &m_dragClientImpl, &m_inspectorClientImpl, 0, 0, 0, 0));
 
     // the page will take ownership of the various clients
 
@@ -1434,8 +1438,11 @@ int WebViewImpl::setZoomLevel(bool textOnly, int zoomLevel)
     if (!view)
         return m_zoomLevel;
     if (zoomFactor != view->zoomFactor()) {
-        m_zoomLevel = zoomLevel;
         view->setZoomFactor(zoomFactor, textOnly ? ZoomTextOnly : ZoomPage);
+        WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
+        if (pluginContainer)
+            pluginContainer->plugin()->setZoomFactor(zoomFactor, textOnly);
+        m_zoomLevel = zoomLevel;
     }
     return m_zoomLevel;
 }
@@ -1864,7 +1871,10 @@ void WebViewImpl::setSelectionColors(unsigned activeBackgroundColor,
 #endif
 }
 
-void WebView::addUserScript(const WebString& sourceCode, const WebVector<WebString>& patternsIn, bool runAtStart)
+void WebView::addUserScript(const WebString& sourceCode,
+                            const WebVector<WebString>& patternsIn,
+                            WebView::UserScriptInjectAt injectAt,
+                            WebView::UserContentInjectIn injectIn)
 {
     OwnPtr<Vector<String> > patterns(new Vector<String>);
     for (size_t i = 0; i < patternsIn.size(); ++i)
@@ -1873,10 +1883,13 @@ void WebView::addUserScript(const WebString& sourceCode, const WebVector<WebStri
     PageGroup* pageGroup = PageGroup::pageGroup(pageGroupName);
     RefPtr<DOMWrapperWorld> world(DOMWrapperWorld::create());
     pageGroup->addUserScriptToWorld(world.get(), sourceCode, WebURL(), patterns.release(), 0,
-                                    runAtStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
+                                    static_cast<UserScriptInjectionTime>(injectAt),
+                                    static_cast<UserContentInjectedFrames>(injectIn));
 }
 
-void WebView::addUserStyleSheet(const WebString& sourceCode, const WebVector<WebString>& patternsIn)
+void WebView::addUserStyleSheet(const WebString& sourceCode,
+                                const WebVector<WebString>& patternsIn,
+                                WebView::UserContentInjectIn injectIn)
 {
     OwnPtr<Vector<String> > patterns(new Vector<String>);
     for (size_t i = 0; i < patternsIn.size(); ++i)
@@ -1884,7 +1897,8 @@ void WebView::addUserStyleSheet(const WebString& sourceCode, const WebVector<Web
 
     PageGroup* pageGroup = PageGroup::pageGroup(pageGroupName);
     RefPtr<DOMWrapperWorld> world(DOMWrapperWorld::create());
-    pageGroup->addUserStyleSheetToWorld(world.get(), sourceCode, WebURL(), patterns.release(), 0);
+    pageGroup->addUserStyleSheetToWorld(world.get(), sourceCode, WebURL(), patterns.release(), 0,
+                                        static_cast<UserContentInjectedFrames>(injectIn));
 }
 
 void WebView::removeAllUserContent()
diff --git a/WebKit/chromium/src/WebWorkerBase.cpp b/WebKit/chromium/src/WebWorkerBase.cpp
index 0ad0ccd..9593f5f 100644
--- a/WebKit/chromium/src/WebWorkerBase.cpp
+++ b/WebKit/chromium/src/WebWorkerBase.cpp
@@ -185,7 +185,7 @@ void WebWorkerBase::initializeLoader(const WebURL& url)
 
 void WebWorkerBase::dispatchTaskToMainThread(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
-    return callOnMainThread(invokeTaskMethod, task.release());
+    callOnMainThread(invokeTaskMethod, task.leakPtr());
 }
 
 void WebWorkerBase::invokeTaskMethod(void* param)
diff --git a/WebKit/chromium/src/WebWorkerClientImpl.cpp b/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 13b7fe6..18282e3 100644
--- a/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -360,7 +360,7 @@ void WebWorkerClientImpl::postMessageToWorkerObjectTask(
 
     if (thisPtr->m_worker) {
         OwnPtr<MessagePortArray> ports =
-            MessagePort::entanglePorts(*context, channels.release());
+            MessagePort::entanglePorts(*context, channels);
         RefPtr<SerializedScriptValue> serializedMessage =
             SerializedScriptValue::createFromWire(message);
         thisPtr->m_worker->dispatchEvent(MessageEvent::create(ports.release(),
diff --git a/WebKit/chromium/src/WebWorkerImpl.cpp b/WebKit/chromium/src/WebWorkerImpl.cpp
index 857c50f..165af68 100644
--- a/WebKit/chromium/src/WebWorkerImpl.cpp
+++ b/WebKit/chromium/src/WebWorkerImpl.cpp
@@ -86,7 +86,7 @@ void WebWorkerImpl::postMessageToWorkerContextTask(WebCore::ScriptExecutionConte
         static_cast<DedicatedWorkerContext*>(context);
 
     OwnPtr<MessagePortArray> ports =
-        MessagePort::entanglePorts(*context, channels.release());
+        MessagePort::entanglePorts(*context, channels);
     RefPtr<SerializedScriptValue> serializedMessage =
         SerializedScriptValue::createFromWire(message);
     workerContext->dispatchEvent(MessageEvent::create(
diff --git a/WebKit/chromium/src/js/DebuggerScript.js b/WebKit/chromium/src/js/DebuggerScript.js
index 25d1903..70c2fbe 100644
--- a/WebKit/chromium/src/js/DebuggerScript.js
+++ b/WebKit/chromium/src/js/DebuggerScript.js
@@ -84,7 +84,7 @@ DebuggerScript._formatScript = function(script)
         id: script.id,
         name: script.name,
         source: script.source,
-        lineOffset: script.line_offset,
+        lineOffset: DebuggerScript._v8ToWebkitLineNumber(script.line_offset),
         lineCount: script.lineCount(),
         scriptWorldType: scriptWorldType
     };
diff --git a/WebKit/chromium/src/js/Tests.js b/WebKit/chromium/src/js/Tests.js
index cd4d9fb..81432eb 100644
--- a/WebKit/chromium/src/js/Tests.js
+++ b/WebKit/chromium/src/js/Tests.js
@@ -852,7 +852,7 @@ TestSuite.prototype.showMainPageScriptSource_ = function(scriptName, callback)
  */
 TestSuite.prototype.evaluateInConsole_ = function(code, callback)
 {
-    WebInspector.console.visible = true;
+    WebInspector.showConsole();
     WebInspector.console.prompt.text = code;
     WebInspector.console.promptElement.dispatchEvent( TestSuite.createKeyEvent("Enter"));
 
@@ -952,8 +952,12 @@ TestSuite.prototype.testCompletionOnPause = function()
         showConsole);
 
     function showConsole() {
-        test.addSniffer(WebInspector.console, "afterShow", testLocalsCompletion);
-        WebInspector.showConsole();
+        if (WebInspector.currentFocusElement === WebInspector.console.promptElement)
+            testLocalsCompletion();
+        else {
+            test.addSniffer(WebInspector.console, "afterShow", testLocalsCompletion);
+            WebInspector.showConsole();
+        }
     }
 
     function testLocalsCompletion() {
@@ -1775,7 +1779,7 @@ TestSuite.prototype.testConsoleEval = function()
  */
 TestSuite.prototype.testConsoleLog = function()
 {
-    WebInspector.console.visible = true;
+    WebInspector.showConsole();
     var messages = WebInspector.console.messages;
     var index = 0;
 
@@ -1817,7 +1821,7 @@ TestSuite.prototype.testConsoleLog = function()
  */
 TestSuite.prototype.testEvalGlobal = function()
 {
-    WebInspector.console.visible = true;
+    WebInspector.showConsole();
 
     var inputs = ["foo", "foobar"];
     var expectations = ["foo", "fooValue", "foobar", "ReferenceError: foobar is not defined"];
@@ -1850,6 +1854,48 @@ TestSuite.prototype.testEvalGlobal = function()
 
 
 /**
+ * Tests the message loop re-entrancy.
+ */
+TestSuite.prototype.testMessageLoopReentrant = function()
+{
+    var test = this;
+    this.showPanel("scripts");
+
+    var breakpointLine = 16;
+
+    WebInspector.showConsole();
+
+    this._waitUntilScriptsAreParsed(["debugger_test_page.html"],
+        function() {
+          test.showMainPageScriptSource_(
+              "debugger_test_page.html",
+              function(view, url) {
+                view._addBreakpoint(breakpointLine);
+
+                test.evaluateInConsole_(
+                    'setTimeout("calculate()", 0)',
+                    function(resultText) {
+                      test.assertTrue(!isNaN(resultText), "Failed to get timer id: " + resultText);
+                    });
+
+              });
+        });
+
+    // Wait until script is paused.
+    this.addSniffer(
+        WebInspector,
+        "pausedScript",
+        function(callFrames) {
+            test.evaluateInConsole_(
+                'document.cookie',
+                test.releaseControl.bind(test)); // This callback will be invoked only if the test succeeds (i.e. no crash).
+        });
+
+    this.takeControl();
+};
+
+
+/**
  * Tests that Storage panel can be open and that local DOM storage is added
  * to the panel.
  */