Merge WebKit at r74534: Initial merge by git.

Change-Id: I6ccd1154fa1b19c2ec2a66878eb675738735f1eb

50 files changed, 850 insertions, 308 deletions

diff --git a/WebKit/chromium/src/ApplicationCacheHost.cpp b/WebKit/chromium/src/ApplicationCacheHost.cpp
index a6e66c6..85dfd20 100644
--- a/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -106,9 +106,9 @@ void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
             // same resource being loaded, because "foreign" entries are never picked
             // during navigation.
             // see WebCore::ApplicationCacheGroup::selectCache()
-            const KURL& docURL = m_documentLoader->frame()->document()->url();
-            String referrer = m_documentLoader->frameLoader()->referrer();
-            m_documentLoader->frame()->navigationScheduler()->scheduleLocationChange(docURL, referrer);
+            Frame* frame = m_documentLoader->frame();
+            frame->navigationScheduler()->scheduleLocationChange(frame->document()->securityOrigin(),
+                frame->document()->url(), frame->loader()->referrer());
         }
     }
 }
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
index ceeed8d..ba9b4e7 100644
--- a/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -365,6 +365,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebView::UserStyleInjectInSubsequentDocuments, Inje
 
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::NullType, IDBKey::NullType);
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::StringType, IDBKey::StringType);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::DateType, IDBKey::DateType);
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::NumberType, IDBKey::NumberType);
 
 #if ENABLE(FILE_SYSTEM)
diff --git a/WebKit/chromium/src/AssociatedURLLoader.cpp b/WebKit/chromium/src/AssociatedURLLoader.cpp
index f494a0e..34a4055 100644
--- a/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -42,7 +42,8 @@ namespace WebKit {
 
 AssociatedURLLoader::AssociatedURLLoader(PassRefPtr<WebFrameImpl> frameImpl)
     : m_frameImpl(frameImpl),
-      m_realLoader(webKitClient()->createURLLoader())
+      m_realLoader(webKitClient()->createURLLoader()),
+      m_realClient(0)
 {
 }
 
@@ -52,6 +53,8 @@ AssociatedURLLoader::~AssociatedURLLoader()
 
 void AssociatedURLLoader::loadSynchronously(const WebURLRequest& request, WebURLResponse& response, WebURLError& error, WebData& data)
 {
+    ASSERT(!m_realClient);
+
     WebURLRequest requestCopy(request);
     prepareRequest(requestCopy);
 
@@ -60,10 +63,13 @@ void AssociatedURLLoader::loadSynchronously(const WebURLRequest& request, WebURL
 
 void AssociatedURLLoader::loadAsynchronously(const WebURLRequest& request, WebURLLoaderClient* client)
 {
+    ASSERT(!m_realClient);
+
     WebURLRequest requestCopy(request);
     prepareRequest(requestCopy);
 
-    m_realLoader->loadAsynchronously(requestCopy, client);
+    m_realClient = client;
+    m_realLoader->loadAsynchronously(requestCopy, this);
 }
 
 void AssociatedURLLoader::cancel()
@@ -84,4 +90,44 @@ void AssociatedURLLoader::prepareRequest(WebURLRequest& request)
     m_frameImpl->dispatchWillSendRequest(request);
 }
 
+void AssociatedURLLoader::willSendRequest(WebURLLoader*, WebURLRequest& newRequest, const WebURLResponse& redirectResponse)
+{
+    m_realClient->willSendRequest(this, newRequest, redirectResponse);
+}
+
+void AssociatedURLLoader::didSendData(WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    m_realClient->didSendData(this, bytesSent, totalBytesToBeSent);
+}
+
+void AssociatedURLLoader::didReceiveResponse(WebURLLoader*, const WebURLResponse& response)
+{
+    m_realClient->didReceiveResponse(this, response);
+}
+
+void AssociatedURLLoader::didDownloadData(WebURLLoader*, int dataLength)
+{
+    m_realClient->didDownloadData(this, dataLength);
+}
+
+void AssociatedURLLoader::didReceiveData(WebURLLoader*, const char* data, int dataLength)
+{
+    m_realClient->didReceiveData(this, data, dataLength);
+}
+
+void AssociatedURLLoader::didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength)
+{
+    m_realClient->didReceiveCachedMetadata(this, data, dataLength);
+}
+
+void AssociatedURLLoader::didFinishLoading(WebURLLoader*, double finishTime)
+{
+    m_realClient->didFinishLoading(this, finishTime);
+}
+
+void AssociatedURLLoader::didFail(WebURLLoader*, const WebURLError& error)
+{
+    m_realClient->didFail(this, error);
+}
+
 } // namespace WebKit
diff --git a/WebKit/chromium/src/AssociatedURLLoader.h b/WebKit/chromium/src/AssociatedURLLoader.h
index 4c9f54e..91cb0bf 100644
--- a/WebKit/chromium/src/AssociatedURLLoader.h
+++ b/WebKit/chromium/src/AssociatedURLLoader.h
@@ -32,6 +32,7 @@
 #define AssociatedURLLoader_h
 
 #include "WebURLLoader.h"
+#include "WebURLLoaderClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -41,7 +42,8 @@ class WebFrameImpl;
 
 // This class is used to implement WebFrame::createAssociatedURLLoader.
 // FIXME: Implement in terms of WebCore::SubresourceLoader.
-class AssociatedURLLoader : public WebURLLoader {
+class AssociatedURLLoader : public WebURLLoader,
+                            public WebURLLoaderClient {
 public:
     AssociatedURLLoader(PassRefPtr<WebFrameImpl>);
     ~AssociatedURLLoader();
@@ -52,11 +54,22 @@ public:
     virtual void cancel();
     virtual void setDefersLoading(bool);
 
+    // WebURLLoaderClient methods:
+    virtual void willSendRequest(WebURLLoader*, WebURLRequest& newRequest, const WebURLResponse& redirectResponse);
+    virtual void didSendData(WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+    virtual void didReceiveResponse(WebURLLoader*, const WebURLResponse&);
+    virtual void didDownloadData(WebURLLoader*, int dataLength);
+    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength);
+    virtual void didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength);
+    virtual void didFinishLoading(WebURLLoader*, double finishTime);
+    virtual void didFail(WebURLLoader*, const WebURLError&);
+
 private:
     void prepareRequest(WebURLRequest&);
 
     RefPtr<WebFrameImpl> m_frameImpl;
     OwnPtr<WebURLLoader> m_realLoader;
+    WebURLLoaderClient* m_realClient;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/AutoFillPopupMenuClient.cpp b/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
index 32abd6f..704ba69 100644
--- a/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
+++ b/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
@@ -51,7 +51,6 @@ AutoFillPopupMenuClient::AutoFillPopupMenuClient()
     : m_separatorIndex(-1)
     , m_selectedIndex(-1)
     , m_textField(0)
-    , m_AutocompleteModeEnabled(false)
 {
 }
 
@@ -123,36 +122,20 @@ bool AutoFillPopupMenuClient::canRemoveSuggestionAtIndex(unsigned listIndex)
 
 void AutoFillPopupMenuClient::valueChanged(unsigned listIndex, bool fireEvents)
 {
-    // DEPRECATED: Will be removed once AutoFill and Autocomplete merge is
-    // completed.
-    if (m_AutocompleteModeEnabled) {
-        m_textField->setValue(getSuggestion(listIndex));
-
-        WebViewImpl* webView = getWebView();
-        if (!webView)
-            return;
-
-        EditorClientImpl* editor =
-            static_cast<EditorClientImpl*>(webView->page()->editorClient());
-        ASSERT(editor);
-        editor->onAutocompleteSuggestionAccepted(
-            static_cast<HTMLInputElement*>(m_textField.get()));
-    } else {
-      WebViewImpl* webView = getWebView();
-      if (!webView)
-          return;
-
-      if (m_separatorIndex != -1 && listIndex > static_cast<unsigned>(m_separatorIndex))
-          --listIndex;
-
-      ASSERT(listIndex < m_names.size());
-
-      webView->client()->didAcceptAutoFillSuggestion(WebNode(getTextField()),
-                                                     m_names[listIndex],
-                                                     m_labels[listIndex],
-                                                     m_uniqueIDs[listIndex],
-                                                     listIndex);
-    }
+    WebViewImpl* webView = getWebView();
+    if (!webView)
+        return;
+
+    if (m_separatorIndex != -1 && listIndex > static_cast<unsigned>(m_separatorIndex))
+        --listIndex;
+
+    ASSERT(listIndex < m_names.size());
+
+    webView->client()->didAcceptAutoFillSuggestion(WebNode(getTextField()),
+                                                   m_names[listIndex],
+                                                   m_labels[listIndex],
+                                                   m_uniqueIDs[listIndex],
+                                                   listIndex);
 }
 
 void AutoFillPopupMenuClient::selectionChanged(unsigned listIndex, bool fireEvents)
diff --git a/WebKit/chromium/src/AutoFillPopupMenuClient.h b/WebKit/chromium/src/AutoFillPopupMenuClient.h
index e3edfd3..0129a81 100644
--- a/WebKit/chromium/src/AutoFillPopupMenuClient.h
+++ b/WebKit/chromium/src/AutoFillPopupMenuClient.h
@@ -114,10 +114,6 @@ public:
                         const WebVector<int>& uniqueIDs,
                         int separatorIndex);
 
-    // DEPRECATED: Will be removed once Autocomplete and AutoFill merge is
-    // complete.
-    void setAutocompleteMode(bool enabled) { m_AutocompleteModeEnabled = enabled; }
-
 private:
     // Convert the specified index from an index into the visible list (which might
     // include a separator entry) to an index to |m_names| and |m_labels|.
@@ -147,10 +143,6 @@ private:
     RefPtr<WebCore::HTMLInputElement> m_textField;
     OwnPtr<WebCore::PopupMenuStyle> m_regularStyle;
     OwnPtr<WebCore::PopupMenuStyle> m_warningStyle;
-
-    // DEPRECATED: Will be removed once Autocomplete and AutoFill merge is
-    // complete.
-    bool m_AutocompleteModeEnabled;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
index 7b67ede..28d78d0 100644
--- a/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -776,11 +776,13 @@ NotificationPresenter* ChromeClientImpl::notificationPresenter() const
 }
 #endif
 
+// FIXME: Remove ChromeClientImpl::requestGeolocationPermissionForFrame and ChromeClientImpl::cancelGeolocationPermissionRequestForFrame
+// once all ports have moved to client-based geolocation (see https://bugs.webkit.org/show_bug.cgi?id=40373 ).
+// For client-based geolocation, these methods are now implemented as WebGeolocationClient::requestPermission and WebGeolocationClient::cancelPermissionRequest.
+// (see https://bugs.webkit.org/show_bug.cgi?id=50061 ).
 void ChromeClientImpl::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
-#if ENABLE(CLIENT_BASED_GEOLOCATION)
-    // FIXME: Implement Client-based Geolocation Permissions
-#else
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
     GeolocationServiceChromium* geolocationService = static_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
     geolocationService->geolocationServiceBridge()->attachBridgeIfNeeded();
     m_webView->client()->geolocationService()->requestPermissionForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
@@ -789,9 +791,7 @@ void ChromeClientImpl::requestGeolocationPermissionForFrame(Frame* frame, Geoloc
 
 void ChromeClientImpl::cancelGeolocationPermissionRequestForFrame(Frame* frame, Geolocation* geolocation)
 {
-#if ENABLE(CLIENT_BASED_GEOLOCATION)
-    // FIXME: Implement Client-based Geolocation Permissions
-#else
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
     GeolocationServiceChromium* geolocationService = static_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
     m_webView->client()->geolocationService()->cancelPermissionRequestForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
 #endif
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
index e9d1da6..e94a04f 100644
--- a/WebKit/chromium/src/ChromiumBridge.cpp
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -134,7 +134,7 @@ static WebCookieJar* getCookieJar(const Document* document)
     WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(document->frame());
     if (!frameImpl || !frameImpl->client())
         return 0;
-    WebCookieJar* cookieJar = frameImpl->client()->cookieJar();
+    WebCookieJar* cookieJar = frameImpl->client()->cookieJar(frameImpl);
     if (!cookieJar)
         cookieJar = webKitClient()->cookieJar();
     return cookieJar;
@@ -636,7 +636,7 @@ PassOwnPtr<AudioBus> ChromiumBridge::loadPlatformAudioResource(const char* name,
 PassOwnPtr<AudioBus> ChromiumBridge::decodeAudioFileData(const char* data, size_t size, double sampleRate)
 {
     WebAudioBus webAudioBus;
-    if (webKitClient()->decodeAudioFileData(&webAudioBus, data, size, sampleRate))
+    if (webKitClient()->loadAudioResource(&webAudioBus, data, size, sampleRate))
         return webAudioBus.release();
     return 0;
 }
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index d33a06b..7bd1a2b 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -34,6 +34,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSStyleDeclaration.h"
 #include "ContextMenu.h"
+#include "ContextMenuController.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Editor.h"
@@ -45,6 +46,7 @@
 #include "HTMLNames.h"
 #include "KURL.h"
 #include "MediaError.h"
+#include "Page.h"
 #include "PlatformString.h"
 #include "RenderWidget.h"
 #include "TextBreakIterator.h"
@@ -110,7 +112,7 @@ static String selectMisspelledWord(const ContextMenu* defaultMenu, Frame* select
 
     // Selection is empty, so change the selection to the word under the cursor.
     HitTestResult hitTestResult = selectedFrame->eventHandler()->
-        hitTestResultAtPoint(defaultMenu->hitTestResult().point(), true);
+        hitTestResultAtPoint(selectedFrame->page()->contextMenuController()->hitTestResult().point(), true);
     Node* innerNode = hitTestResult.innerNode();
     VisiblePosition pos(innerNode->renderer()->positionForPoint(
         hitTestResult.localPoint()));
@@ -144,7 +146,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
     if (!m_webView->contextMenuAllowed())
         return 0;
 
-    HitTestResult r = defaultMenu->hitTestResult();
+    HitTestResult r = m_webView->page()->contextMenuController()->hitTestResult();
     Frame* selectedFrame = r.innerNonSharedNode()->document()->frame();
 
     WebContextMenuData data;
diff --git a/WebKit/chromium/src/EditorClientImpl.cpp b/WebKit/chromium/src/EditorClientImpl.cpp
index bc1d206..6f1739f 100644
--- a/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/WebKit/chromium/src/EditorClientImpl.cpp
@@ -929,7 +929,8 @@ bool EditorClientImpl::spellingUIIsShowing()
     return false;
 }
 
-void EditorClientImpl::getGuessesForWord(const String&,
+void EditorClientImpl::getGuessesForWord(const String& word,
+                                         const String& context,
                                          WTF::Vector<String>& guesses)
 {
     notImplemented();
diff --git a/WebKit/chromium/src/EditorClientImpl.h b/WebKit/chromium/src/EditorClientImpl.h
index b05a592..9dbd6af 100644
--- a/WebKit/chromium/src/EditorClientImpl.h
+++ b/WebKit/chromium/src/EditorClientImpl.h
@@ -107,9 +107,11 @@ public:
     virtual void showSpellingUI(bool show);
     virtual bool spellingUIIsShowing();
     virtual void getGuessesForWord(const WTF::String& word,
+                                   const WTF::String& context,
                                    WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
 
     // Shows the form autofill popup for |node| if it is an HTMLInputElement and
     // it is empty.  This is called when you press the up or down arrow in a
diff --git a/WebKit/chromium/src/Extensions3DChromium.cpp b/WebKit/chromium/src/Extensions3DChromium.cpp
index fe04986..ca2215e 100644
--- a/WebKit/chromium/src/Extensions3DChromium.cpp
+++ b/WebKit/chromium/src/Extensions3DChromium.cpp
@@ -48,6 +48,15 @@ bool Extensions3DChromium::supports(const String& name)
     return m_internal->supportsExtension(name);
 }
 
+void Extensions3DChromium::ensureEnabled(const String& name)
+{
+#ifndef NDEBUG
+    bool result =
+#endif
+        m_internal->ensureExtensionEnabled(name);
+    ASSERT(result);
+}
+
 int Extensions3DChromium::getGraphicsResetStatusARB()
 {
     return m_internal->isContextLost() ? static_cast<int>(Extensions3D::UNKNOWN_CONTEXT_RESET_ARB) : static_cast<int>(GraphicsContext3D::NO_ERROR);
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index 9d79599..9beef26 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -817,7 +817,8 @@ Frame* FrameLoaderClientImpl::dispatchCreatePage(const NavigationAction& action)
 {
     struct WindowFeatures features;
     Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
-        m_webFrame->frame(), FrameLoadRequest(), features, action);
+        m_webFrame->frame(), FrameLoadRequest(m_webFrame->frame()->document()->securityOrigin()),
+        features, action);
 
     // Make sure that we have a valid disposition.  This should have been set in
     // the preceeding call to dispatchDecidePolicyForNewWindowAction.
@@ -1378,7 +1379,8 @@ PassRefPtr<Frame> FrameLoaderClientImpl::createFrame(
     int marginWidth,
     int marginHeight)
 {
-    FrameLoadRequest frameRequest(ResourceRequest(url, referrer), name);
+    FrameLoadRequest frameRequest(m_webFrame->frame()->document()->securityOrigin(),
+        ResourceRequest(url, referrer), name);
     return m_webFrame->createChildFrame(frameRequest, ownerElement);
 }
 
diff --git a/WebKit/chromium/src/GeolocationClientProxy.cpp b/WebKit/chromium/src/GeolocationClientProxy.cpp
new file mode 100644
index 0000000..b2536dd
--- /dev/null
+++ b/WebKit/chromium/src/GeolocationClientProxy.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeolocationClientProxy.h"
+
+#include "Geolocation.h"
+#include "GeolocationPosition.h"
+#include "WebGeolocationClient.h"
+#include "WebGeolocationController.h"
+#include "WebGeolocationPermissionRequest.h"
+#include "WebGeolocationPosition.h"
+
+namespace WebKit {
+
+GeolocationClientProxy::GeolocationClientProxy(WebGeolocationClient* client)
+    : m_client(client)
+{
+}
+
+GeolocationClientProxy::~GeolocationClientProxy()
+{
+}
+
+void GeolocationClientProxy::setController(WebCore::GeolocationController* controller)
+{
+    // We support there not being a client, provided we don't do any Geolocation.
+    if (m_client) {
+        // Ownership of the WebGeolocationController is transferred to the client.
+        m_client->setController(new WebGeolocationController(controller));
+    }
+}
+
+void GeolocationClientProxy::geolocationDestroyed()
+{
+    if (m_client)
+        m_client->geolocationDestroyed();
+}
+
+void GeolocationClientProxy::startUpdating()
+{
+    m_client->startUpdating();
+}
+
+void GeolocationClientProxy::stopUpdating()
+{
+    m_client->stopUpdating();
+}
+
+void GeolocationClientProxy::setEnableHighAccuracy(bool highAccuracy)
+{
+    m_client->setEnableHighAccuracy(highAccuracy);
+}
+
+WebCore::GeolocationPosition* GeolocationClientProxy::lastPosition()
+{
+    WebGeolocationPosition webPosition;
+    if (m_client->lastPosition(webPosition))
+        m_lastPosition = webPosition;
+    else
+        m_lastPosition.clear();
+
+    return m_lastPosition.get();
+}
+
+void GeolocationClientProxy::requestPermission(WebCore::Geolocation* geolocation)
+{
+    m_client->requestPermission(WebGeolocationPermissionRequest(geolocation));
+}
+
+void GeolocationClientProxy::cancelPermissionRequest(WebCore::Geolocation* geolocation)
+{
+    m_client->cancelPermissionRequest(WebGeolocationPermissionRequest(geolocation));
+}
+
+}
diff --git a/WebKit/chromium/src/GeolocationClientProxy.h b/WebKit/chromium/src/GeolocationClientProxy.h
new file mode 100644
index 0000000..ee175dc
--- /dev/null
+++ b/WebKit/chromium/src/GeolocationClientProxy.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationClientProxy_h
+#define GeolocationClientProxy_h
+
+#include "GeolocationClient.h"
+#include "WebGeolocationController.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class GeolocationPosition;
+}
+
+namespace WebKit {
+class WebGeolocationClient;
+
+class GeolocationClientProxy : public WebCore::GeolocationClient {
+public:
+    GeolocationClientProxy(WebGeolocationClient* client);
+    ~GeolocationClientProxy();
+    void setController(WebCore::GeolocationController *controller);
+    virtual void geolocationDestroyed();
+    virtual void startUpdating();
+    virtual void stopUpdating();
+    virtual void setEnableHighAccuracy(bool);
+    virtual WebCore::GeolocationPosition* lastPosition();
+
+    virtual void requestPermission(WebCore::Geolocation*);
+    virtual void cancelPermissionRequest(WebCore::Geolocation*);
+
+private:
+    WebGeolocationClient* m_client;
+    RefPtr<WebCore::GeolocationPosition> m_lastPosition;
+};
+
+} // namespace WebKit
+
+#endif // GeolocationClientProxy_h
diff --git a/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index cc0c5bc..2dff52b 100644
--- a/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -681,17 +681,54 @@ Extensions3D* GraphicsContext3DInternal::getExtensions()
     return m_extensions.get();
 }
 
-bool GraphicsContext3DInternal::supportsExtension(const String& name)
+namespace {
+
+void splitStringHelper(const String& str, HashSet<String>& set)
+{
+    Vector<String> substrings;
+    str.split(" ", substrings);
+    for (size_t i = 0; i < substrings.size(); ++i)
+        set.add(substrings[i]);
+}
+
+} // anonymous namespace
+
+void GraphicsContext3DInternal::initializeExtensions()
 {
     if (!m_initializedAvailableExtensions) {
         String extensionsString = getString(GraphicsContext3D::EXTENSIONS);
-        Vector<String> availableExtensions;
-        extensionsString.split(" ", availableExtensions);
-        for (size_t i = 0; i < availableExtensions.size(); ++i)
-            m_availableExtensions.add(availableExtensions[i]);
+        splitStringHelper(extensionsString, m_enabledExtensions);
+
+        String requestableExtensionsString = m_impl->getRequestableExtensionsCHROMIUM();
+        splitStringHelper(requestableExtensionsString, m_requestableExtensions);
+
         m_initializedAvailableExtensions = true;
     }
-    return m_availableExtensions.contains(name);
+}
+
+
+bool GraphicsContext3DInternal::supportsExtension(const String& name)
+{
+    initializeExtensions();
+    return m_enabledExtensions.contains(name) || m_requestableExtensions.contains(name);
+}
+
+bool GraphicsContext3DInternal::ensureExtensionEnabled(const String& name)
+{
+    initializeExtensions();
+
+    if (m_enabledExtensions.contains(name))
+        return true;
+
+    if (m_requestableExtensions.contains(name)) {
+        m_impl->requestExtensionCHROMIUM(name.ascii().data());
+        m_enabledExtensions.clear();
+        m_requestableExtensions.clear();
+        m_initializedAvailableExtensions = false;
+    }
+
+    initializeExtensions();
+    return m_enabledExtensions.contains(name);
 }
 
 DELEGATE_TO_IMPL_4R(mapBufferSubDataCHROMIUM, unsigned, int, int, unsigned, void*)
diff --git a/WebKit/chromium/src/GraphicsContext3DInternal.h b/WebKit/chromium/src/GraphicsContext3DInternal.h
index 220cbb8..ad54a4f 100644
--- a/WebKit/chromium/src/GraphicsContext3DInternal.h
+++ b/WebKit/chromium/src/GraphicsContext3DInternal.h
@@ -265,6 +265,7 @@ public:
     // Extensions3D support.
     Extensions3D* getExtensions();
     bool supportsExtension(const String& name);
+    bool ensureExtensionEnabled(const String& name);
 
     // EXT_texture_format_BGRA8888
     bool supportsBGRA();
@@ -285,7 +286,8 @@ private:
     OwnPtr<Extensions3DChromium> m_extensions;
     WebKit::WebViewImpl* m_webViewImpl;
     bool m_initializedAvailableExtensions;
-    HashSet<String> m_availableExtensions;
+    HashSet<String> m_enabledExtensions;
+    HashSet<String> m_requestableExtensions;
 #if USE(ACCELERATED_COMPOSITING)
     RefPtr<WebGLLayerChromium> m_compositingLayer;
 #endif
@@ -301,6 +303,8 @@ private:
 #if PLATFORM(CG)
     unsigned char* m_renderOutput;
 #endif
+
+    void initializeExtensions();
 };
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBCursorBackendProxy.cpp b/WebKit/chromium/src/IDBCursorBackendProxy.cpp
index 94491f9..ec7bf63 100644
--- a/WebKit/chromium/src/IDBCursorBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBCursorBackendProxy.cpp
@@ -85,9 +85,9 @@ void IDBCursorBackendProxy::continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<
     m_idbCursor->continueFunction(key, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-void IDBCursorBackendProxy::remove(PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
+void IDBCursorBackendProxy::deleteFunction(PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->remove(new WebIDBCallbacksImpl(callbacks), ec);
+    m_idbCursor->deleteFunction(new WebIDBCallbacksImpl(callbacks), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBCursorBackendProxy.h b/WebKit/chromium/src/IDBCursorBackendProxy.h
index 0a7a288..650dded 100644
--- a/WebKit/chromium/src/IDBCursorBackendProxy.h
+++ b/WebKit/chromium/src/IDBCursorBackendProxy.h
@@ -47,7 +47,7 @@ public:
     virtual PassRefPtr<IDBAny> value() const;
     virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
     virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
-    virtual void remove(PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<IDBCallbacks>, ExceptionCode&);
 
 private:
     IDBCursorBackendProxy(PassOwnPtr<WebKit::WebIDBCursor>);
diff --git a/WebKit/chromium/src/IDBDatabaseProxy.cpp b/WebKit/chromium/src/IDBDatabaseProxy.cpp
index 685f53c..f070d64 100644
--- a/WebKit/chromium/src/IDBDatabaseProxy.cpp
+++ b/WebKit/chromium/src/IDBDatabaseProxy.cpp
@@ -61,11 +61,6 @@ String IDBDatabaseProxy::name() const
     return m_webIDBDatabase->name();
 }
 
-String IDBDatabaseProxy::description() const
-{
-    return m_webIDBDatabase->description();
-}
-
 String IDBDatabaseProxy::version() const
 {
     return m_webIDBDatabase->version();
diff --git a/WebKit/chromium/src/IDBDatabaseProxy.h b/WebKit/chromium/src/IDBDatabaseProxy.h
index 84693f2..c51a604 100644
--- a/WebKit/chromium/src/IDBDatabaseProxy.h
+++ b/WebKit/chromium/src/IDBDatabaseProxy.h
@@ -43,7 +43,6 @@ public:
     virtual ~IDBDatabaseProxy();
 
     virtual String name() const;
-    virtual String description() const;
     virtual String version() const;
     virtual PassRefPtr<DOMStringList> objectStoreNames() const;
 
diff --git a/WebKit/chromium/src/LocalizedStrings.cpp b/WebKit/chromium/src/LocalizedStrings.cpp
index e7b39d5..ab14009 100644
--- a/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/WebKit/chromium/src/LocalizedStrings.cpp
@@ -43,6 +43,7 @@
 #include <wtf/text/WTFString.h>
 
 using WebKit::WebLocalizedString;
+using WebKit::WebString;
 
 namespace WebCore {
 
@@ -51,9 +52,14 @@ static String query(WebLocalizedString::Name name)
     return WebKit::webKitClient()->queryLocalizedString(name);
 }
 
-static String query(WebLocalizedString::Name name, int numericValue)
+static String query(WebLocalizedString::Name name, const WebString& parameter)
 {
-    return WebKit::webKitClient()->queryLocalizedString(name, numericValue);
+    return WebKit::webKitClient()->queryLocalizedString(name, parameter);
+}
+
+static String query(WebLocalizedString::Name name, const WebString& parameter1, const WebString& parameter2)
+{
+    return WebKit::webKitClient()->queryLocalizedString(name, parameter1, parameter2);
 }
 
 String searchableIndexIntroduction()
@@ -191,7 +197,7 @@ String crashedPluginText()
 
 String multipleFileUploadText(unsigned numberOfFiles)
 {
-    return query(WebLocalizedString::MultipleFileUploadText, numberOfFiles);
+    return query(WebLocalizedString::MultipleFileUploadText, String::number(numberOfFiles));
 }
 
 // Used in FTPDirectoryDocument.cpp
@@ -350,28 +356,24 @@ String validationMessagePatternMismatchText()
     return query(WebLocalizedString::ValidationPatternMismatch);
 }
 
-String validationMessageTooLongText(int, int)
+String validationMessageTooLongText(int valueLength, int maxLength)
 {
-    // FIXME: pass the arguments.
-    return query(WebLocalizedString::ValidationTooLong);
+    return query(WebLocalizedString::ValidationTooLong, String::number(valueLength), String::number(maxLength));
 }
 
-String validationMessageRangeUnderflowText(const String&)
+String validationMessageRangeUnderflowText(const String& minimum)
 {
-    // FIXME: pass the arguments.
-    return query(WebLocalizedString::ValidationRangeUnderflow);
+    return query(WebLocalizedString::ValidationRangeUnderflow, minimum);
 }
 
-String validationMessageRangeOverflowText(const String&)
+String validationMessageRangeOverflowText(const String& maximum)
 {
-    // FIXME: pass the arguments.
-    return query(WebLocalizedString::ValidationRangeOverflow);
+    return query(WebLocalizedString::ValidationRangeOverflow, maximum);
 }
 
-String validationMessageStepMismatchText(const String&, const String&)
+String validationMessageStepMismatchText(const String& base, const String& step)
 {
-    // FIXME: pass the arguments.
-    return query(WebLocalizedString::ValidationStepMismatch);
+    return query(WebLocalizedString::ValidationStepMismatch, base, step);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/StorageAreaProxy.cpp b/WebKit/chromium/src/StorageAreaProxy.cpp
index 5311b65..ed89b2c 100644
--- a/WebKit/chromium/src/StorageAreaProxy.cpp
+++ b/WebKit/chromium/src/StorageAreaProxy.cpp
@@ -129,7 +129,7 @@ void StorageAreaProxy::storageEvent(const String& key, const String& oldValue, c
             ExceptionCode ec = 0;
             Storage* storage = frames[i]->domWindow()->sessionStorage(ec);
             if (!ec)
-                frames[i]->document()->enqueueEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
+                frames[i]->document()->enqueueWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
         }
     } else {
         // Send events to every page.
@@ -146,7 +146,7 @@ void StorageAreaProxy::storageEvent(const String& key, const String& oldValue, c
             ExceptionCode ec = 0;
             Storage* storage = frames[i]->domWindow()->localStorage(ec);
             if (!ec)
-                frames[i]->document()->enqueueEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
+                frames[i]->document()->enqueueWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
         }
     }
 }
diff --git a/WebKit/chromium/src/WebAccessibilityObject.cpp b/WebKit/chromium/src/WebAccessibilityObject.cpp
index 9df69cf..50baa27 100644
--- a/WebKit/chromium/src/WebAccessibilityObject.cpp
+++ b/WebKit/chromium/src/WebAccessibilityObject.cpp
@@ -44,6 +44,7 @@
 #include "WebPoint.h"
 #include "WebRect.h"
 #include "WebString.h"
+#include "WebURL.h"
 
 using namespace WebCore;
 
@@ -379,7 +380,7 @@ WebAccessibilityObject WebAccessibilityObject::hitTest(const WebPoint& point) co
 
     m_private->updateBackingStore();
     IntPoint contentsPoint = m_private->documentFrameView()->windowToContents(point);
-    RefPtr<AccessibilityObject> hit = m_private->doAccessibilityHitTest(contentsPoint);
+    RefPtr<AccessibilityObject> hit = m_private->accessibilityHitTest(contentsPoint);
 
     if (hit.get())
         return WebAccessibilityObject(hit);
@@ -461,6 +462,14 @@ WebString WebAccessibilityObject::title() const
     return m_private->title();
 }
 
+WebURL WebAccessibilityObject::url() const
+{
+    if (!m_private)
+        return WebURL();
+    
+    m_private->updateBackingStore();
+    return m_private->url();
+}
 
 WebNode WebAccessibilityObject::node() const
 {
diff --git a/WebKit/chromium/src/WebAudioBus.cpp b/WebKit/chromium/src/WebAudioBus.cpp
index ceccafc..9d4590e 100644
--- a/WebKit/chromium/src/WebAudioBus.cpp
+++ b/WebKit/chromium/src/WebAudioBus.cpp
@@ -44,14 +44,6 @@ namespace WebKit {
 class WebAudioBusPrivate : public AudioBus {
 };
 
-WebAudioBus::~WebAudioBus()
-{
-#if ENABLE(WEB_AUDIO)
-    delete m_private;
-    m_private = 0;
-#endif
-}
-
 void WebAudioBus::initialize(unsigned numberOfChannels, size_t length, double sampleRate)
 {        
 #if ENABLE(WEB_AUDIO)
@@ -66,6 +58,16 @@ void WebAudioBus::initialize(unsigned numberOfChannels, size_t length, double sa
 #endif
 }
 
+void WebAudioBus::reset()
+{
+#if ENABLE(WEB_AUDIO)
+    delete m_private;
+    m_private = 0;
+#else
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 unsigned WebAudioBus::numberOfChannels() const
 {
 #if ENABLE(WEB_AUDIO)
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 880adb4..9f4ce87 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -33,6 +33,7 @@
 
 #include "DebuggerAgentImpl.h"
 #include "DebuggerAgentManager.h"
+#include "ExceptionCode.h"
 #include "InjectedScriptHost.h"
 #include "InspectorBackendDispatcher.h"
 #include "InspectorController.h"
@@ -44,6 +45,7 @@
 #include "ResourceResponse.h"
 #include "ScriptDebugServer.h"
 #include "V8Binding.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WebDataSource.h"
@@ -74,6 +76,7 @@ using WebCore::ResourceRequest;
 using WebCore::ResourceResponse;
 using WTF::String;
 using WebCore::V8DOMWrapper;
+using WebCore::V8Node;
 using WebCore::V8Proxy;
 
 namespace WebKit {
@@ -243,6 +246,14 @@ void WebDevToolsAgentImpl::inspectElementAt(const WebPoint& point)
     m_webViewImpl->inspectElementAt(point);
 }
 
+void WebDevToolsAgentImpl::inspectNode(v8::Handle<v8::Value> node)
+{
+    if (!V8Node::HasInstance(node))
+        V8Proxy::setDOMException(WebCore::TYPE_MISMATCH_ERR);
+    else
+        inspectorController()->inspect(V8Node::toNative(v8::Handle<v8::Object>::Cast(node)));
+}
+
 void WebDevToolsAgentImpl::setRuntimeProperty(const WebString& name, const WebString& value)
 {
     if (name == kApuAgentFeatureName)
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.h b/WebKit/chromium/src/WebDevToolsAgentImpl.h
index feb4bdd..487cf0c 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.h
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.h
@@ -75,6 +75,7 @@ public:
     virtual void didNavigate();
     virtual void dispatchOnInspectorBackend(const WebString& message);
     virtual void inspectElementAt(const WebPoint& point);
+    virtual void inspectNode(v8::Handle<v8::Value> node);
     virtual void evaluateInWebInspector(long callId, const WebString& script);
     virtual void setRuntimeProperty(const WebString& name, const WebString& value);
     virtual void setTimelineProfilingEnabled(bool enable);
diff --git a/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp b/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
index ea59ab6..345e43e 100644
--- a/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
@@ -111,7 +111,11 @@ void WebDevToolsFrontendImpl::dispatchOnInspectorFrontend(const WebString& messa
     v8::HandleScope scope;
     v8::Handle<v8::Context> frameContext = V8Proxy::context(frame->frame());
     v8::Context::Scope contextScope(frameContext);
-    v8::Handle<v8::Value> dispatchFunction = frameContext->Global()->Get(v8::String::New("WebInspector_syncDispatch"));
+    v8::Handle<v8::Value> inspectorBackendValue = frameContext->Global()->Get(v8::String::New("InspectorBackend"));
+    if (!inspectorBackendValue->IsObject())
+        return;
+    v8::Handle<v8::Object> inspectorBackend = v8::Handle<v8::Object>::Cast(inspectorBackendValue);
+    v8::Handle<v8::Value> dispatchFunction = inspectorBackend->Get(v8::String::New("dispatch"));
      // The frame might have navigated away from the front-end page (which is still weird).
     if (!dispatchFunction->IsFunction())
         return;
@@ -120,7 +124,7 @@ void WebDevToolsFrontendImpl::dispatchOnInspectorFrontend(const WebString& messa
     args.append(ToV8String(message));
     v8::TryCatch tryCatch;
     tryCatch.SetVerbose(true);
-    function->Call(frameContext->Global(), args.size(), args.data());
+    function->Call(inspectorBackend, args.size(), args.data());
 }
 
 void WebDevToolsFrontendImpl::frontendLoaded()
diff --git a/WebKit/chromium/src/WebFormElement.cpp b/WebKit/chromium/src/WebFormElement.cpp
index 7a01053..6b6e9be 100644
--- a/WebKit/chromium/src/WebFormElement.cpp
+++ b/WebKit/chromium/src/WebFormElement.cpp
@@ -92,9 +92,12 @@ void WebFormElement::getFormControlElements(WebVector<WebFormControlElement>& re
     // re-evaluating size each time. Also, consider refactoring this code so that
     // we don't call form->associatedElements() multiple times.
     for (size_t i = 0; i < form->associatedElements().size(); i++) {
-        if (form->associatedElements()[i]->hasLocalName(HTMLNames::inputTag)
-            || form->associatedElements()[i]->hasLocalName(HTMLNames::selectTag))
-            tempVector.append(form->associatedElements()[i]);
+        if (!form->associatedElements()[i]->isFormControlElement())
+            continue;
+        HTMLFormControlElement* element = static_cast<HTMLFormControlElement*>(form->associatedElements()[i]);
+        if (element->hasLocalName(HTMLNames::inputTag)
+            || element->hasLocalName(HTMLNames::selectTag))
+            tempVector.append(element);
     }
     result.assign(tempVector);
 }
diff --git a/WebKit/chromium/src/WebGeolocationClientMock.cpp b/WebKit/chromium/src/WebGeolocationClientMock.cpp
new file mode 100644
index 0000000..1ec3dd1
--- /dev/null
+++ b/WebKit/chromium/src/WebGeolocationClientMock.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebGeolocationClientMock.h"
+
+#include "CurrentTime.h"
+#include "Geolocation.h"
+#include "GeolocationClientMock.h"
+#include "GeolocationError.h"
+#include "GeolocationPosition.h"
+#include "PositionError.h"
+#include "WebGeolocationController.h"
+#include "WebGeolocationError.h"
+#include "WebGeolocationPermissionRequest.h"
+#include "WebGeolocationPosition.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebGeolocationClientMock* WebGeolocationClientMock::create()
+{
+    return new WebGeolocationClientMock();
+}
+
+void WebGeolocationClientMock::setPosition(double latitude, double longitude, double accuracy)
+{
+    WebGeolocationPosition webPosition(currentTime(), latitude, longitude, accuracy,
+                                       false, 0, false, 0, false, 0, false, 0);
+    m_clientMock->setPosition(webPosition);
+}
+
+void WebGeolocationClientMock::setError(int errorCode, const WebString& message)
+{
+    WebGeolocationError::Error code;
+    switch (errorCode) {
+    case PositionError::PERMISSION_DENIED:
+        code = WebGeolocationError::ErrorPermissionDenied;
+        break;
+    case PositionError::POSITION_UNAVAILABLE:
+        code = WebGeolocationError::ErrorPositionUnavailable;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    WebGeolocationError webError(code, message);
+    m_clientMock->setError(webError);
+}
+
+void WebGeolocationClientMock::setPermission(bool allowed)
+{
+    m_clientMock->setPermission(allowed);
+}
+
+void WebGeolocationClientMock::resetMock()
+{
+    m_clientMock->reset();
+}
+
+void WebGeolocationClientMock::startUpdating()
+{
+    m_clientMock->startUpdating();
+}
+
+void WebGeolocationClientMock::stopUpdating()
+{
+    m_clientMock->stopUpdating();
+}
+
+void WebGeolocationClientMock::setEnableHighAccuracy(bool accuracy)
+{
+    m_clientMock->setEnableHighAccuracy(accuracy);
+}
+
+void WebGeolocationClientMock::geolocationDestroyed()
+{
+    m_clientMock->geolocationDestroyed();
+}
+
+void WebGeolocationClientMock::setController(WebGeolocationController* controller)
+{
+    m_clientMock->setController(controller->controller());
+    delete controller;
+}
+
+void WebGeolocationClientMock::requestPermission(const WebGeolocationPermissionRequest& request)
+{
+    m_clientMock->requestPermission(request.geolocation());
+}
+
+void WebGeolocationClientMock::cancelPermissionRequest(const WebGeolocationPermissionRequest& request)
+{
+    m_clientMock->cancelPermissionRequest(request.geolocation());
+}
+
+bool WebGeolocationClientMock::lastPosition(WebGeolocationPosition& webPosition)
+{
+    RefPtr<GeolocationPosition> position = m_clientMock->lastPosition();
+    if (!position)
+        return false;
+
+    webPosition = position.release();
+    return true;
+}
+
+WebGeolocationClientMock::WebGeolocationClientMock()
+{
+    m_clientMock.reset(new GeolocationClientMock());
+}
+
+void WebGeolocationClientMock::reset()
+{
+    m_clientMock.reset(0);
+}
+
+} // WebKit
diff --git a/WebKit/chromium/src/WebGeolocationController.cpp b/WebKit/chromium/src/WebGeolocationController.cpp
new file mode 100644
index 0000000..12cbaa0
--- /dev/null
+++ b/WebKit/chromium/src/WebGeolocationController.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebGeolocationController.h"
+
+#include "GeolocationController.h"
+#include "GeolocationError.h"
+#include "GeolocationPosition.h"
+#include "WebGeolocationError.h"
+#include "WebGeolocationPosition.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebGeolocationController::positionChanged(const WebGeolocationPosition& webPosition)
+{
+    m_private->positionChanged(PassRefPtr<GeolocationPosition>(webPosition).get());
+}
+
+void WebGeolocationController::errorOccurred(const WebGeolocationError& webError)
+{
+    m_private->errorOccurred(PassRefPtr<GeolocationError>(webError).get());
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp b/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
new file mode 100644
index 0000000..8d8c53e
--- /dev/null
+++ b/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebGeolocationPermissionRequest.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "Geolocation.h"
+#include "WebSecurityOrigin.h"
+#include "WebURL.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebSecurityOrigin WebGeolocationPermissionRequest::securityOrigin() const
+{
+    return WebSecurityOrigin::create(m_private->frame()->document()->url());
+}
+
+void WebGeolocationPermissionRequest::setIsAllowed(bool allowed)
+{
+    m_private->setIsAllowed(allowed);
+}
+
+}
diff --git a/WebKit/chromium/src/WebGeolocationPermissionRequestManager.cpp b/WebKit/chromium/src/WebGeolocationPermissionRequestManager.cpp
new file mode 100644
index 0000000..4c0ed9c
--- /dev/null
+++ b/WebKit/chromium/src/WebGeolocationPermissionRequestManager.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebGeolocationPermissionRequestManager.h"
+
+#include "WebGeolocationPermissionRequest.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+class Geolocation;
+}
+
+using namespace WebCore;
+
+typedef HashMap<Geolocation*, int> GeolocationIdMap;
+typedef HashMap<int, Geolocation*> IdGeolocationMap;
+
+namespace WebKit {
+class WebGeolocationPermissionRequestManagerPrivate {
+public:
+    GeolocationIdMap m_geolocationIdMap;
+    IdGeolocationMap m_idGeolocationMap;
+};
+}
+
+using namespace WebKit;
+
+int WebGeolocationPermissionRequestManager::add(const WebKit::WebGeolocationPermissionRequest& permissionRequest)
+{
+    Geolocation* geolocation = permissionRequest.geolocation();
+    ASSERT(!m_private->m_geolocationIdMap.contains(geolocation));
+    int id = ++m_lastId;
+    m_private->m_geolocationIdMap.add(geolocation, id);
+    m_private->m_idGeolocationMap.add(id, geolocation);
+    return id;
+}
+
+bool WebGeolocationPermissionRequestManager::remove(const WebKit::WebGeolocationPermissionRequest& permissionRequest, int& id)
+{
+    Geolocation* geolocation = permissionRequest.geolocation();
+    GeolocationIdMap::iterator it = m_private->m_geolocationIdMap.find(geolocation);
+    if (it == m_private->m_geolocationIdMap.end())
+        return false;
+    id = it->second;
+    m_private->m_geolocationIdMap.remove(it);
+    m_private->m_idGeolocationMap.remove(id);
+    return true;
+}
+
+bool WebGeolocationPermissionRequestManager::remove(int id, WebKit::WebGeolocationPermissionRequest& permissionRequest)
+{
+    IdGeolocationMap::iterator it = m_private->m_idGeolocationMap.find(id);
+    if (it == m_private->m_idGeolocationMap.end())
+        return false;
+    Geolocation* geolocation = it->second;
+    permissionRequest = WebGeolocationPermissionRequest(geolocation);
+    m_private->m_idGeolocationMap.remove(it);
+    m_private->m_geolocationIdMap.remove(geolocation);
+    return true;
+}
+
+void WebGeolocationPermissionRequestManager::init()
+{
+    m_lastId = 0;
+    m_private.reset(new WebGeolocationPermissionRequestManagerPrivate);
+}
+
+void WebGeolocationPermissionRequestManager::reset()
+{
+    m_private.reset(0);
+}
+
diff --git a/WebKit/chromium/src/WebGeolocationServiceMock.cpp b/WebKit/chromium/src/WebGeolocationServiceMock.cpp
index 07d3f44..667b8b1 100644
--- a/WebKit/chromium/src/WebGeolocationServiceMock.cpp
+++ b/WebKit/chromium/src/WebGeolocationServiceMock.cpp
@@ -41,39 +41,6 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(GEOLOCATION)
-
-#if ENABLE(CLIENT_BASED_GEOLOCATION)
-// FIXME: Implement mock bindings for client-based geolocation. Ultimately
-// move to another class and remove WebGeolocationService*.
-
-namespace WebKit {
-
-class WebGeolocationServiceMockClientBasedImpl : public WebGeolocationServiceMock {
-};
-
-WebGeolocationServiceMock* WebGeolocationServiceMock::createWebGeolocationServiceMock()
-{
-    return new WebGeolocationServiceMockClientBasedImpl;
-}
-
-void WebGeolocationServiceMock::setMockGeolocationPermission(bool allowed)
-{
-    // FIXME: Implement mock binding
-}
-
-void WebGeolocationServiceMock::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
-{
-    // FIXME: Implement mock binding
-}
-
-void WebGeolocationServiceMock::setMockGeolocationError(int errorCode, const WebString& message)
-{
-    // FIXME: Implement mock binding
-}
-
-} // namespace WebKit
-
-#else
 using WebCore::Coordinates;
 using WebCore::Frame;
 using WebCore::Geolocation;
@@ -272,6 +239,4 @@ void WebGeolocationServiceMockImpl::notifyPendingPermissions()
 }
 
 } // namespace WebKit
-
-#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
 #endif // ENABLE(GEOLOCATION)
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
index 9a74601..9a4a362 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
@@ -624,6 +624,15 @@ void WebGraphicsContext3DDefaultImpl::copyTextureToParentTextureCHROMIUM(unsigne
     glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
+WebString WebGraphicsContext3DDefaultImpl::getRequestableExtensionsCHROMIUM()
+{
+    return WebString();
+}
+
+void WebGraphicsContext3DDefaultImpl::requestExtensionCHROMIUM(const char*)
+{
+}
+
 // Helper macros to reduce the amount of code.
 
 #define DELEGATE_TO_GL(name, glname)                                           \
@@ -1260,68 +1269,13 @@ DELEGATE_TO_GL_2(sampleCoverage, SampleCoverage, double, bool)
 
 DELEGATE_TO_GL_4(scissor, Scissor, long, long, unsigned long, unsigned long)
 
-unsigned bytesPerComponent(unsigned type)
-{
-    switch (type) {
-    case GL_BYTE:
-    case GL_UNSIGNED_BYTE:
-        return 1;
-    case GL_SHORT:
-    case GL_UNSIGNED_SHORT:
-    case GL_UNSIGNED_SHORT_5_6_5:
-    case GL_UNSIGNED_SHORT_4_4_4_4:
-    case GL_UNSIGNED_SHORT_5_5_5_1:
-        return 2;
-    case GL_FLOAT:
-        return 4;
-    default:
-        return 4;
-    }
-}
-
-unsigned componentsPerPixel(unsigned format, unsigned type)
-{
-    switch (type) {
-    case GL_UNSIGNED_SHORT_5_6_5:
-    case GL_UNSIGNED_SHORT_4_4_4_4:
-    case GL_UNSIGNED_SHORT_5_5_5_1:
-        return 1;
-    default:
-        break;
-    }
-    switch (format) {
-    case GL_LUMINANCE:
-        return 1;
-    case GL_LUMINANCE_ALPHA:
-        return 2;
-    case GL_RGB:
-        return 3;
-    case GL_RGBA:
-    case GL_BGRA_EXT:
-        return 4;
-    default:
-        return 4;
-    }
-}
-
-// N.B.:  This code does not protect against integer overflow (as the command
-// buffer implementation does), so it should not be considered robust enough
-// for use in the browser.  Since this implementation is only used for layout
-// tests, this should be ok for now.
-size_t imageSizeInBytes(unsigned width, unsigned height, unsigned format, unsigned type)
-{
-    return width * height * bytesPerComponent(type) * componentsPerPixel(format, type);
-}
-
 void WebGraphicsContext3DDefaultImpl::texImage2D(unsigned target, unsigned level, unsigned internalFormat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, const void* pixels)
 {
-    OwnArrayPtr<uint8> zero;
-    if (!pixels) {
-        size_t size = imageSizeInBytes(width, height, format, type);
-        zero.set(new uint8[size]);
-        memset(zero.get(), 0, size);
-        pixels = zero.get();
+    if (width && height && !pixels) {
+        synthesizeGLError(GL_INVALID_VALUE);
+        return;
     }
+    makeContextCurrent();
     glTexImage2D(target, level, internalFormat, width, height, border, format, type, pixels);
 }
 
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
index 32e3671..b656d0c 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
@@ -85,6 +85,9 @@ public:
     virtual void unmapTexSubImage2DCHROMIUM(const void*);
     virtual void copyTextureToParentTextureCHROMIUM(unsigned texture, unsigned parentTexture);
 
+    virtual WebString getRequestableExtensionsCHROMIUM();
+    virtual void requestExtensionCHROMIUM(const char*);
+
     virtual void activeTexture(unsigned long texture);
     virtual void attachShader(WebGLId program, WebGLId shader);
     virtual void bindAttribLocation(WebGLId program, unsigned long index, const char* name);
diff --git a/WebKit/chromium/src/WebIDBCursorImpl.cpp b/WebKit/chromium/src/WebIDBCursorImpl.cpp
index eca5d42..5165574 100644
--- a/WebKit/chromium/src/WebIDBCursorImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCursorImpl.cpp
@@ -80,9 +80,9 @@ void WebIDBCursorImpl::continueFunction(const WebIDBKey& key, WebIDBCallbacks* c
     m_idbCursorBackend->continueFunction(key, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-void WebIDBCursorImpl::remove(WebIDBCallbacks* callbacks, WebExceptionCode& ec)
+void WebIDBCursorImpl::deleteFunction(WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->remove(IDBCallbacksProxy::create(callbacks), ec);
+    m_idbCursorBackend->deleteFunction(IDBCallbacksProxy::create(callbacks), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBCursorImpl.h b/WebKit/chromium/src/WebIDBCursorImpl.h
index 39fa44b..7f8ebd7 100644
--- a/WebKit/chromium/src/WebIDBCursorImpl.h
+++ b/WebKit/chromium/src/WebIDBCursorImpl.h
@@ -47,7 +47,7 @@ public:
     virtual void value(WebSerializedScriptValue&, WebIDBKey&) const;
     virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*, WebExceptionCode&);
     virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*, WebExceptionCode&);
-    virtual void remove(WebIDBCallbacks*, WebExceptionCode&);
+    virtual void deleteFunction(WebIDBCallbacks*, WebExceptionCode&);
 
  private:
     WTF::RefPtr<WebCore::IDBCursorBackendInterface> m_idbCursorBackend;
diff --git a/WebKit/chromium/src/WebIDBDatabaseError.cpp b/WebKit/chromium/src/WebIDBDatabaseError.cpp
index cbbe14a..7413ae6 100644
--- a/WebKit/chromium/src/WebIDBDatabaseError.cpp
+++ b/WebKit/chromium/src/WebIDBDatabaseError.cpp
@@ -47,7 +47,7 @@ void WebIDBDatabaseError::assign(const WebIDBDatabaseError& value)
 
 void WebIDBDatabaseError::assign(unsigned short code, const WebString& message)
 {
-    m_private = IDBDatabaseError::create(code, message);
+    m_private = IDBDatabaseError::createWithoutOffset(code, message);
 }
 
 void WebIDBDatabaseError::reset()
diff --git a/WebKit/chromium/src/WebIDBKey.cpp b/WebKit/chromium/src/WebIDBKey.cpp
index b7a7db8..7e84df1 100644
--- a/WebKit/chromium/src/WebIDBKey.cpp
+++ b/WebKit/chromium/src/WebIDBKey.cpp
@@ -48,6 +48,27 @@ WebIDBKey WebIDBKey::createNull()
     return key;
 }
 
+WebIDBKey WebIDBKey::createString(const WebString& string)
+{
+    WebIDBKey key;
+    key.assignString(string);
+    return key;
+}
+
+WebIDBKey WebIDBKey::createDate(double date)
+{
+    WebIDBKey key;
+    key.assignDate(date);
+    return key;
+}
+
+WebIDBKey WebIDBKey::createNumber(double number)
+{
+    WebIDBKey key;
+    key.assignNumber(number);
+    return key;
+}
+
 WebIDBKey WebIDBKey::createInvalid()
 {
     WebIDBKey key;
@@ -69,17 +90,22 @@ void WebIDBKey::assign(const WebIDBKey& value)
 
 void WebIDBKey::assignNull()
 {
-    m_private = IDBKey::create();
+    m_private = IDBKey::createNull();
+}
+
+void WebIDBKey::assignString(const WebString& string)
+{
+    m_private = IDBKey::createString(string);
 }
 
-void WebIDBKey::assign(const WebString& string)
+void WebIDBKey::assignDate(double date)
 {
-    m_private = IDBKey::create(string);
+    m_private = IDBKey::createDate(date);
 }
 
-void WebIDBKey::assign(double number)
+void WebIDBKey::assignNumber(double number)
 {
-    m_private = IDBKey::create(number);
+    m_private = IDBKey::createNumber(number);
 }
 
 void WebIDBKey::assignInvalid()
@@ -104,6 +130,11 @@ WebString WebIDBKey::string() const
     return m_private->string();
 }
 
+double WebIDBKey::date() const
+{
+    return m_private->date();
+}
+
 double WebIDBKey::number() const
 {
     return m_private->number();
diff --git a/WebKit/chromium/src/WebIDBKeyRange.cpp b/WebKit/chromium/src/WebIDBKeyRange.cpp
index ec5b7c2..517ff00 100644
--- a/WebKit/chromium/src/WebIDBKeyRange.cpp
+++ b/WebKit/chromium/src/WebIDBKeyRange.cpp
@@ -47,33 +47,11 @@ void WebIDBKeyRange::assign(const WebIDBKey& lower, const WebIDBKey& upper, bool
         m_private = IDBKeyRange::create(lower, upper, lowerOpen, upperOpen);
 }
 
-// FIXME: Remove this after next roll.
-void WebIDBKeyRange::assign(const WebIDBKey& lower, const WebIDBKey& upper, unsigned short flags)
-{
-    bool lowerOpen = !!(flags & 1);
-    bool upperOpen = !!(flags & 2);
-
-    if (lower.type() == WebIDBKey::InvalidType && upper.type() == WebIDBKey::InvalidType)
-        m_private = 0;
-    else
-        m_private = IDBKeyRange::create(lower, upper, lowerOpen, upperOpen);
-}
-
 void WebIDBKeyRange::reset()
 {
     m_private.reset();
 }
 
-WebIDBKey WebIDBKeyRange::left() const
-{
-    return lower();
-}
-
-WebIDBKey WebIDBKeyRange::right() const
-{
-    return upper();
-}
-
 WebIDBKey WebIDBKeyRange::lower() const
 {
     if (!m_private.get())
@@ -98,20 +76,6 @@ bool WebIDBKeyRange::upperOpen() const
     return m_private.get() && m_private->upperOpen();
 }
 
-// FIXME: Remove this after next roll.
-unsigned short WebIDBKeyRange::flags() const
-{
-    if (!m_private.get())
-        return 0;
-
-    unsigned short flags = 0;
-    if (m_private->lowerOpen())
-        flags |= 1;
-    if (m_private->upperOpen())
-        flags |= 2;
-    return flags;
-}
-
 WebIDBKeyRange::WebIDBKeyRange(const PassRefPtr<IDBKeyRange>& value)
     : m_private(value)
 {
diff --git a/WebKit/chromium/src/WebImageDecoder.cpp b/WebKit/chromium/src/WebImageDecoder.cpp
index 0cfd458..a17897c 100644
--- a/WebKit/chromium/src/WebImageDecoder.cpp
+++ b/WebKit/chromium/src/WebImageDecoder.cpp
@@ -56,10 +56,10 @@ void WebImageDecoder::init(Type type)
 {
     switch (type) {
     case TypeBMP:
-        m_private = new BMPImageDecoder(true, false);
+        m_private = new BMPImageDecoder(ImageSource::AlphaPremultiplied, ImageSource::GammaAndColorProfileApplied);
         break;
     case TypeICO:
-        m_private = new ICOImageDecoder(true, false);
+        m_private = new ICOImageDecoder(ImageSource::AlphaPremultiplied, ImageSource::GammaAndColorProfileApplied);
         break;
     }
 }
diff --git a/WebKit/chromium/src/WebPasswordFormUtils.cpp b/WebKit/chromium/src/WebPasswordFormUtils.cpp
index b4997e5..5f8a1ec 100644
--- a/WebKit/chromium/src/WebPasswordFormUtils.cpp
+++ b/WebKit/chromium/src/WebPasswordFormUtils.cpp
@@ -65,9 +65,11 @@ void findPasswordFormFields(HTMLFormElement* form, PasswordFormFields* fields)
 
     int firstPasswordIndex = 0;
     // First, find the password fields and activated submit button
-    const Vector<HTMLFormControlElement*>& formElements = form->associatedElements();
+    const Vector<FormAssociatedElement*>& formElements = form->associatedElements();
     for (size_t i = 0; i < formElements.size(); i++) {
-        HTMLFormControlElement* formElement = formElements[i];
+        if (!formElements[i]->isFormControlElement())
+            continue;
+        HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(formElements[i]);
         if (formElement->isActivatedSubmit())
             fields->submit = formElement;
 
@@ -90,7 +92,9 @@ void findPasswordFormFields(HTMLFormElement* form, PasswordFormFields* fields)
     if (!fields->passwords.isEmpty()) {
         // Then, search backwards for the username field
         for (int i = firstPasswordIndex - 1; i >= 0; i--) {
-            HTMLFormControlElement* formElement = formElements[i];
+            if (!formElements[i]->isFormControlElement())
+                continue;
+            HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(formElements[i]);
             if (!formElement->hasLocalName(HTMLNames::inputTag))
                 continue;
 
diff --git a/WebKit/chromium/src/WebPerformance.cpp b/WebKit/chromium/src/WebPerformance.cpp
index de9c1f6..8c377db 100644
--- a/WebKit/chromium/src/WebPerformance.cpp
+++ b/WebKit/chromium/src/WebPerformance.cpp
@@ -55,12 +55,14 @@ void WebPerformance::assign(const WebPerformance& other)
 WebNavigationType WebPerformance::navigationType() const
 {
     switch (m_private->navigation()->type()) {
-    case PerformanceNavigation::NAVIGATE:
+    case PerformanceNavigation::TYPE_NAVIGATE:
         return WebNavigationTypeOther;
-    case PerformanceNavigation::RELOAD:
+    case PerformanceNavigation::TYPE_RELOAD:
         return WebNavigationTypeReload;
-    case PerformanceNavigation::BACK_FORWARD:
+    case PerformanceNavigation::TYPE_BACK_FORWARD:
         return WebNavigationTypeBackForward;
+    case PerformanceNavigation::TYPE_RESERVED:
+        return WebNavigationTypeOther;
     }
     ASSERT_NOT_REACHED();
     return WebNavigationTypeOther;
@@ -131,6 +133,31 @@ double WebPerformance::responseEnd() const
     return millisecondsToSeconds(m_private->timing()->responseEnd());
 }
 
+double WebPerformance::domLoading() const
+{
+    return millisecondsToSeconds(m_private->timing()->domLoading());
+}
+
+double WebPerformance::domInteractive() const
+{
+    return millisecondsToSeconds(m_private->timing()->domInteractive());
+}
+
+double WebPerformance::domContentLoadedEventStart() const
+{
+    return millisecondsToSeconds(m_private->timing()->domContentLoadedEventStart());
+}
+
+double WebPerformance::domContentLoadedEventEnd() const
+{
+    return millisecondsToSeconds(m_private->timing()->domContentLoadedEventEnd());
+}
+
+double WebPerformance::domComplete() const
+{
+    return millisecondsToSeconds(m_private->timing()->domComplete());
+}
+
 double WebPerformance::loadEventStart() const
 {
     return millisecondsToSeconds(m_private->timing()->loadEventStart());
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.cpp b/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 43d9757..90c7f65 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -365,8 +365,8 @@ void WebPluginContainerImpl::loadFrameRequest(
         WebDataSourceImpl::setNextPluginLoadObserver(observer);
     }
 
-    FrameLoadRequest frameRequest(request.toResourceRequest());
-    frameRequest.setFrameName(target);
+    FrameLoadRequest frameRequest(frame->document()->securityOrigin(),
+        request.toResourceRequest(), target);
 
     frame->loader()->loadFrameRequest(
         frameRequest,
diff --git a/WebKit/chromium/src/WebSearchableFormData.cpp b/WebKit/chromium/src/WebSearchableFormData.cpp
index 50192eb..178e4db 100644
--- a/WebKit/chromium/src/WebSearchableFormData.cpp
+++ b/WebKit/chromium/src/WebSearchableFormData.cpp
@@ -78,8 +78,10 @@ HTMLFormControlElement* GetButtonToActivate(HTMLFormElement* form)
 {
     HTMLFormControlElement* firstSubmitButton = 0;
     // FIXME: Consider refactoring this code so that we don't call form->associatedElements() twice.
-    for (Vector<HTMLFormControlElement*>::const_iterator i(form->associatedElements().begin()); i != form->associatedElements().end(); ++i) {
-      HTMLFormControlElement* formElement = *i;
+    for (Vector<FormAssociatedElement*>::const_iterator i(form->associatedElements().begin()); i != form->associatedElements().end(); ++i) {
+      if (!(*i)->isFormControlElement())
+          continue;
+      HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(*i);
       if (formElement->isActivatedSubmit())
           // There's a button that is already activated for submit, return 0.
           return 0;
@@ -156,8 +158,10 @@ bool HasSuitableTextElement(const HTMLFormElement* form, Vector<char>* encodedSt
 
     HTMLInputElement* textElement = 0;
     // FIXME: Consider refactoring this code so that we don't call form->associatedElements() twice.
-    for (Vector<HTMLFormControlElement*>::const_iterator i(form->associatedElements().begin()); i != form->associatedElements().end(); ++i) {
-        HTMLFormControlElement* formElement = *i;
+    for (Vector<FormAssociatedElement*>::const_iterator i(form->associatedElements().begin()); i != form->associatedElements().end(); ++i) {
+        if (!(*i)->isFormControlElement())
+            continue;
+        HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(*i);
         if (formElement->disabled() || formElement->name().isNull())
             continue;
 
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index 7bec254..ac05dd2 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -59,6 +59,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "GeolocationClientProxy.h"
 #include "GraphicsContext.h"
 #include "GraphicsContext3D.h"
 #include "GraphicsContext3DInternal.h"
@@ -310,6 +311,9 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_speechInputClient(SpeechInputClientImpl::create(client))
 #endif
     , m_deviceOrientationClientProxy(new DeviceOrientationClientProxy(client ? client->deviceOrientationClient() : 0))
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    , m_geolocationClientProxy(new GeolocationClientProxy(client ? client->geolocationClient() : 0))
+#endif
 {
     // WebKit/win/WebView.cpp does the same thing, except they call the
     // KJS specific wrapper around this method. We need to have threading
@@ -333,9 +337,16 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     pageClients.speechInputClient = m_speechInputClient.get();
 #endif
     pageClients.deviceOrientationClient = m_deviceOrientationClientProxy.get();
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    pageClients.geolocationClient = m_geolocationClientProxy.get();
+#endif
 
     m_page.set(new Page(pageClients));
 
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    m_geolocationClientProxy->setController(m_page->geolocationController());
+#endif
+
     static_cast<BackForwardListImpl*>(m_page->backForwardList())->setClient(&m_backForwardListClientImpl);
     m_page->setGroupName(pageGroupName);
 
@@ -1910,17 +1921,6 @@ void WebViewImpl::applyAutoFillSuggestions(
     const WebNode& node,
     const WebVector<WebString>& names,
     const WebVector<WebString>& labels,
-    const WebVector<int>& uniqueIDs,
-    int separatorIndex)
-{
-    WebVector<WebString> icons(names.size());
-    applyAutoFillSuggestions(node, names, labels, icons, uniqueIDs, separatorIndex);
-}
-
-void WebViewImpl::applyAutoFillSuggestions(
-    const WebNode& node,
-    const WebVector<WebString>& names,
-    const WebVector<WebString>& labels,
     const WebVector<WebString>& icons,
     const WebVector<int>& uniqueIDs,
     int separatorIndex)
@@ -1966,30 +1966,6 @@ void WebViewImpl::applyAutoFillSuggestions(
         m_autoFillPopup->show(focusedNode->getRect(), focusedNode->ownerDocument()->view(), 0);
         m_autoFillPopupShowing = true;
     }
-
-    // DEPRECATED: This special mode will go away once AutoFill and Autocomplete
-    // merge is complete.
-    if (m_autoFillPopupClient)
-        m_autoFillPopupClient->setAutocompleteMode(false);
-}
-
-// DEPRECATED: replacing with applyAutoFillSuggestions.
-void WebViewImpl::applyAutocompleteSuggestions(
-    const WebNode& node,
-    const WebVector<WebString>& suggestions,
-    int defaultSuggestionIndex)
-{
-    WebVector<WebString> names(suggestions.size());
-    WebVector<WebString> labels(suggestions.size());
-    WebVector<WebString> icons(suggestions.size());
-    WebVector<int> uniqueIDs(suggestions.size());
-
-    for (size_t i = 0; i < suggestions.size(); ++i)
-        names[i] = suggestions[i];
-
-    applyAutoFillSuggestions(node, names, labels, icons, uniqueIDs, -1);
-    if (m_autoFillPopupClient)
-        m_autoFillPopupClient->setAutocompleteMode(true);
 }
 
 void WebViewImpl::hidePopups()
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
index 0388770..6e8dcac 100644
--- a/WebKit/chromium/src/WebViewImpl.h
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -73,6 +73,7 @@ class AutoFillPopupMenuClient;
 class ContextMenuClientImpl;
 class DeviceOrientationClientProxy;
 class DragScrollTimer;
+class GeolocationClientProxy;
 class SpeechInputClientImpl;
 class WebAccessibilityObject;
 class WebDevToolsAgentClient;
@@ -179,13 +180,6 @@ public:
                                      const WebString& value);
     virtual WebDevToolsAgent* devToolsAgent();
     virtual WebAccessibilityObject accessibilityObject();
-    // DEPRECATED.
-    virtual void applyAutoFillSuggestions(
-        const WebNode&,
-        const WebVector<WebString>& names,
-        const WebVector<WebString>& labels,
-        const WebVector<int>& uniqueIDs,
-        int separatorIndex);
     virtual void applyAutoFillSuggestions(
         const WebNode&,
         const WebVector<WebString>& names,
@@ -193,11 +187,6 @@ public:
         const WebVector<WebString>& icons,
         const WebVector<int>& uniqueIDs,
         int separatorIndex);
-    // DEPRECATED: replacing with applyAutoFillSuggestions.
-    virtual void applyAutocompleteSuggestions(
-        const WebNode&,
-        const WebVector<WebString>& suggestions,
-        int defaultSuggestionIndex);
     virtual void hidePopups();
     virtual void setScrollbarColors(unsigned inactiveColor,
                                     unsigned activeColor,
@@ -555,6 +544,10 @@ private:
     // early. This member holds on to the GC3D in this case.
     RefPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    OwnPtr<GeolocationClientProxy> m_geolocationClientProxy;
+#endif
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/js/DevTools.js b/WebKit/chromium/src/js/DevTools.js
index 11ebc1f..d6536bc 100644
--- a/WebKit/chromium/src/js/DevTools.js
+++ b/WebKit/chromium/src/js/DevTools.js
@@ -47,7 +47,9 @@ var context = {};  // Used by WebCore's inspector routines.
     Preferences.onlineDetectionEnabled = false;
     Preferences.nativeInstrumentationEnabled = true;
     Preferences.fileSystemEnabled = false;
+    Preferences.resourceExportEnabled = true;
     Preferences.showTimingTab = true;
+    Preferences.showCookiesTab = true;
 })();
 
 var devtools = devtools || {};
diff --git a/WebKit/chromium/src/js/Tests.js b/WebKit/chromium/src/js/Tests.js
index 2b264ee..55b24ea 100644
--- a/WebKit/chromium/src/js/Tests.js
+++ b/WebKit/chromium/src/js/Tests.js
@@ -730,7 +730,7 @@ TestSuite.prototype._waitForScriptPause = function(expectations, callback)
     var test = this;
     // Wait until script is paused.
     test.addSniffer(
-        WebInspector,
+        WebInspector.debuggerModel,
         "pausedScript",
         function(details) {
             var callFrames = details.callFrames;
@@ -805,7 +805,7 @@ TestSuite.prototype._waitUntilScriptsAreParsed = function(expectedScripts, callb
         if (test._scriptsAreParsed(expectedScripts))
             callback();
         else
-            test.addSniffer(WebInspector, "parsedScriptSource", waitForAllScripts);
+            test.addSniffer(WebInspector.debuggerModel, "parsedScriptSource", waitForAllScripts);
     }
 
     waitForAllScripts();
@@ -852,7 +852,7 @@ TestSuite.prototype.testPauseInEval = function()
 
     devtools.tools.evaluateJavaScript("fib(10)");
 
-    this.addSniffer(WebInspector, "pausedScript",
+    this.addSniffer(WebInspector.debuggerModel, "pausedScript",
         function() {
             test.releaseControl();
         });