Merge WebKit at r67178 : Initial merge by git.

Change-Id: I57e01163b6866cb029cdadf405a0394a3918bc18

43 files changed, 1471 insertions, 311 deletions

diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
index 527e8ef..e9f6354 100644
--- a/WebKit/chromium/ChangeLog
+++ b/WebKit/chromium/ChangeLog
@@ -1,3 +1,437 @@
+2010-09-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Move functions from Frame to Editor as planned
+        https://bugs.webkit.org/show_bug.cgi?id=45218
+
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::selectMisspelledWord):
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::find):
+        (WebKit::WebFrameImpl::stopFinding):
+        (WebKit::WebFrameImpl::scopeStringMatches):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::caretOrSelectionBounds):
+        Changed call sites to use editor().
+
+2010-09-09  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Memory leak in red/black tree
+        https://bugs.webkit.org/show_bug.cgi?id=45472
+
+        Fixed memory leak in red/black tree where it was using operator
+        new directly to allocate its internal nodes rather than the arena
+        with which it was configured. Added allocateObject variant to
+        arena supporting single-argument constructors. Added test to
+        red/black tree unit tests to cover this functionality, and
+        refactored TrackedAllocator into helper file to share between
+        arena and red/black tree tests.
+
+        * WebKit.gyp:
+        * tests/ArenaTestHelpers.h: Added.
+        (WebCore::ArenaTestHelpers::TrackedAllocator::create):
+        (WebCore::ArenaTestHelpers::TrackedAllocator::allocate):
+        (WebCore::ArenaTestHelpers::TrackedAllocator::free):
+        (WebCore::ArenaTestHelpers::TrackedAllocator::isEmpty):
+        (WebCore::ArenaTestHelpers::TrackedAllocator::numRegions):
+        (WebCore::ArenaTestHelpers::TrackedAllocator::TrackedAllocator):
+        * tests/PODArenaTest.cpp:
+        * tests/PODRedBlackTreeTest.cpp:
+        (WebCore::TEST):
+
+2010-09-09  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] make linux checksums computed from pngs to match windows
+        https://bugs.webkit.org/show_bug.cgi?id=45465
+
+        * src/WebKit.cpp:
+        (WebKit::areLayoutTestImagesOpaque): Make linux match windows.
+
+2010-09-09  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Add methods used to determine accessibility state.
+        https://bugs.webkit.org/show_bug.cgi?id=45434
+        
+
+        * public/WebAccessibilityObject.h:
+        * src/WebAccessibilityObject.cpp:
+        (WebKit::WebAccessibilityObject::canSetSelectedAttribute):
+        (WebKit::WebAccessibilityObject::isCollapsed):
+        (WebKit::WebAccessibilityObject::isLinked):
+        (WebKit::WebAccessibilityObject::isReadOnly):
+        (WebKit::WebAccessibilityObject::isVisible):
+
+2010-09-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: add a sanity test for DOM storage view in the storage panel
+        https://bugs.webkit.org/show_bug.cgi?id=45294
+
+        * src/js/Tests.js: removed testStoragePanel which was superseded by inspector layout tests.
+
+2010-09-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: test that debugger won't pause on syntax errors
+        https://bugs.webkit.org/show_bug.cgi?id=45388
+
+        * src/js/Tests.js: removed testAutoContinueOnSyntaxError which is now covered by 
+        inspector/debugger-autocontinue-on-syntax-error.html layout test
+
+2010-09-08  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        Add smooth scrolling framework, and a Windows implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32356
+
+        * src/WebScrollbarImpl.cpp: Plumb new ScrollbarClient functions.  Allow wheel scrolls to be animated.
+        (WebKit::WebScrollbarImpl::setLocation):
+        (WebKit::WebScrollbarImpl::setValue):
+        (WebKit::WebScrollbarImpl::scroll):
+        (WebKit::WebScrollbarImpl::onMouseWheel):
+        (WebKit::WebScrollbarImpl::onKeyDown):
+        (WebKit::WebScrollbarImpl::setScrollOffsetFromAnimation):
+        * src/WebScrollbarImpl.h: Plumb new ScrollbarClient functions.
+        * src/win/WebInputEventFactory.cpp: Update comments now that we have smooth scrolling.
+        (WebKit::WebInputEventFactory::mouseWheelEvent):
+
+2010-09-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: remove some obsolete interactive tests
+        https://bugs.webkit.org/show_bug.cgi?id=45371
+
+        * src/js/Tests.js:
+
+2010-09-08  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Plug leak in WebDeviceOrientationClientMock
+        https://bugs.webkit.org/show_bug.cgi?id=45305
+
+        WebDeviceOrientationClientMock is responsible for destroying the
+        WebDeviceOrientationController object pointed to by the argument
+        passed to the setController() member function.
+
+        Also use the new WebPrivateOnwPtr for m_clientMock.
+
+        * public/WebDeviceOrientationClientMock.h:
+        * src/WebDeviceOrientationClientMock.cpp:
+        (WebKit::WebDeviceOrientationClientMock::setController):
+        (WebKit::WebDeviceOrientationClientMock::initialize):
+        (WebKit::WebDeviceOrientationClientMock::reset):
+
+2010-09-07  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Make a public flag for how DRT generates bitmaps on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=45133
+
+        This is so it's possible for me to fix
+        http://code.google.com/p/chromium/issues/detail?id=21386 .
+
+        * public/WebKit.h: Add areLayoutTestImagesOpaque()
+        * src/WebKit.cpp:
+        (WebKit::areLayoutTestImagesOpaque):
+
+2010-09-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r66886.
+        http://trac.webkit.org/changeset/66886
+        https://bugs.webkit.org/show_bug.cgi?id=45112
+
+        Made
+
+        * public/WebGeolocationService.h:
+        * src/WebGeolocationServiceBridgeImpl.cpp:
+        (WebKit::WebGeolocationServiceBridgeImpl::WebGeolocationServiceBridgeImpl):
+        (WebKit::WebGeolocationServiceBridgeImpl::~WebGeolocationServiceBridgeImpl):
+        (WebKit::WebGeolocationServiceBridgeImpl::startUpdating):
+        (WebKit::WebGeolocationServiceBridgeImpl::stopUpdating):
+        (WebKit::WebGeolocationServiceBridgeImpl::suspend):
+        (WebKit::WebGeolocationServiceBridgeImpl::resume):
+        (WebKit::WebGeolocationServiceBridgeImpl::attachBridgeIfNeeded):
+        (WebKit::WebGeolocationServiceBridgeImpl::setIsAllowed):
+        (WebKit::WebGeolocationServiceBridgeImpl::setLastPosition):
+        (WebKit::WebGeolocationServiceBridgeImpl::setLastError):
+        (WebKit::WebGeolocationServiceBridgeImpl::getWebViewClient):
+        (WebKit::WebGeolocationServiceBridgeImpl::onWebGeolocationServiceDestroyed):
+        * src/WebGeolocationServiceMock.cpp:
+
+2010-09-07  Jonathan Dixon  <joth@chromium.org>
+        
+        Reviewed by Jeremy Orlow.
+        
+        Access to out-of-scope WebGeolocationServiceBridgeImpl
+        https://bugs.webkit.org/show_bug.cgi?id=45112
+
+        Keep the WebGeolocationService pointer for lifetime of the bridge, to
+        ensure it can be detached reliably
+
+        * public/WebGeolocationServiceBridge.h:
+        (WebKit::WebGeolocationServiceBridge::~WebGeolocationServiceBridge):
+        * src/WebGeolocationServiceBridgeImpl.cpp:
+        (WebKit::WebGeolocationServiceBridgeImpl::WebGeolocationServiceBridgeImpl):
+        (WebKit::WebGeolocationServiceBridgeImpl::~WebGeolocationServiceBridgeImpl):
+        (WebKit::WebGeolocationServiceBridgeImpl::startUpdating):
+        (WebKit::WebGeolocationServiceBridgeImpl::stopUpdating):
+        (WebKit::WebGeolocationServiceBridgeImpl::suspend):
+        (WebKit::WebGeolocationServiceBridgeImpl::resume):
+        (WebKit::WebGeolocationServiceBridgeImpl::attachBridgeIfNeeded):
+
+2010-09-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: upstream two debugger tests
+        https://bugs.webkit.org/show_bug.cgi?id=45262
+
+        * src/js/Tests.js:
+
+2010-09-06  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Add new interface and empty impl. as precursor to bug 45112
+        https://bugs.webkit.org/show_bug.cgi?id=45257
+
+        * public/WebGeolocationServiceBridge.h:
+        (WebKit::WebGeolocationServiceBridge::~WebGeolocationServiceBridge):
+        * src/WebGeolocationServiceBridgeImpl.cpp:
+        (WebKit::WebGeolocationServiceBridgeImpl::onWebGeolocationServiceDestroyed):
+
+2010-09-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix chromium devtools tests
+        https://bugs.webkit.org/show_bug.cgi?id=45258
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype._waitForScriptPause):
+
+2010-08-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Add index insertion support to IndexedDB.
+        https://bugs.webkit.org/show_bug.cgi?id=44695
+
+        Add asserts on the [] operator.
+
+        * public/WebVector.h:
+        (WebKit::WebVector::operator[]):
+
+2010-09-06  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] bypass caches when query memory usage from post GC and in crash handler.
+        https://bugs.webkit.org/show_bug.cgi?id=45036
+
+        Add Chromium-specific API to query actual memory usage which bypasses any caches.
+
+        * public/WebKitClient.h:
+        (WebKit::WebKitClient::actualMemoryUsageMB):
+        * src/ChromiumBridge.cpp:
+        (WebCore::ChromiumBridge::actualMemoryUsageMB):
+
+2010-09-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Make Chromium/Mac generate continuous mousewheel events with the same wheelDelta values as Safari/Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=45155
+
+        * src/mac/WebInputEventFactory.mm:
+        (WebKit::WebInputEventFactory::mouseWheelEvent):
+
+2010-09-05  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: remove WebDevToolsAgentClient::forceRepaint which is not used
+        https://bugs.webkit.org/show_bug.cgi?id=45179
+
+        * public/WebDevToolsAgentClient.h:
+        * src/DebuggerAgentImpl.cpp:
+        (WebKit::DebuggerAgentImpl::debuggerOutput):
+        * src/WebDevToolsAgentImpl.cpp:
+        * src/WebDevToolsAgentImpl.h:
+
+2010-09-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add unit tests for interval tree
+        https://bugs.webkit.org/show_bug.cgi?id=45161
+
+        * WebKit.gyp:
+        * tests/PODIntervalTreeTest.cpp: Added.
+        (WebCore::valueToString):
+        (WebCore::TEST):
+        (WebCore::UserData1::valueToString):
+        (WebCore::EndpointType1::valueToString):
+
+2010-09-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add unit tests for red-black tree and (POD) arena
+        https://bugs.webkit.org/show_bug.cgi?id=45060
+
+        * WebKit.gyp:
+        * tests/PODArenaTest.cpp: Added.
+        (WebCore::TestClass1::TestClass2::TestClass2):
+        (WebCore::TEST_F):
+        * tests/PODRedBlackTreeTest.cpp: Added.
+        (WebCore::TEST):
+        * tests/TreeTestHelpers.cpp: Added.
+        (WebCore::TreeTestHelpers::generateSeed):
+        (WebCore::TreeTestHelpers::initRandom):
+        (WebCore::TreeTestHelpers::nextRandom):
+        * tests/TreeTestHelpers.h: Added.
+
+2010-09-03  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        Add NetworkingContext to avoid layer violations
+        https://bugs.webkit.org/show_bug.cgi?id=42292
+
+        Add Chromium's implementation of NetworkingContext.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::createNetworkingContext):
+        * src/FrameLoaderClientImpl.h:
+
+2010-09-02  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Revert to software compositing if the accelerated
+        compositor fails to initialize. If we tried to initialize the compositor
+        for this WebView and failed, next time the associated chrome client is
+        asked whether it can do accelerated compositing it will return false.
+        https://bugs.webkit.org/show_bug.cgi?id=45124
+        
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::allowsAcceleratedCompositing):
+        * src/ChromeClientImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::allowsAcceleratedCompositing):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::getOnscreenGLES2Context):
+        * src/WebViewImpl.h:
+
+2010-09-03  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add one more include to fix the mac compile.
+
+        * src/GraphicsContext3D.cpp:
+
+2010-09-03  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Compile fixes for 66746.
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3DInternal::paintRenderingResultsToCanvas):
+
+2010-09-03  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, remove svn:executable flag from images and css files.
+
+        * src/js/Images/segmentChromium.png: Removed property svn:executable.
+        * src/js/Images/segmentHoverChromium.png: Removed property svn:executable.
+        * src/js/Images/segmentHoverEndChromium.png: Removed property svn:executable.
+        * src/js/Images/segmentSelectedChromium.png: Removed property svn:executable.
+        * src/js/Images/segmentSelectedEndChromium.png: Removed property svn:executable.
+        * src/js/Images/statusbarBackgroundChromium.png: Removed property svn:executable.
+        * src/js/Images/statusbarBottomBackgroundChromium.png: Removed property svn:executable.
+        * src/js/Images/statusbarButtonsChromium.png: Removed property svn:executable.
+        * src/js/Images/statusbarMenuButtonChromium.png: Removed property svn:executable.
+        * src/js/Images/statusbarMenuButtonSelectedChromium.png: Removed property svn:executable.
+        * src/js/devTools.css: Removed property svn:executable.
+
+2010-09-03  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Chris Marrin.
+
+        Multiple accelerated 2D canvases should be able to use the same GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=44926
+
+        Adds a SharedContext3D to WebViewImpl. The SharedContext3D has to live on WebViewImpl to be
+        tied to the lifetime of the compositor context.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::getSharedGraphicsContext3D):
+        * src/ChromeClientImpl.h:
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3DInternal::initialize):
+        (WebCore::GraphicsContext3DInternal::platformLayer):
+        (WebCore::GraphicsContext3D::platformLayer):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::getSharedGraphicsContext3D):
+        * src/WebViewImpl.h:
+
+2010-08-31  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        IDBCursor.continue() should reuse the .openCursor's IDBRequest object
+        https://bugs.webkit.org/show_bug.cgi?id=44953
+
+        * src/WebIDBCallbacksImpl.cpp:
+        (WebCore::WebIDBCallbacksImpl::onError):
+        (WebCore::WebIDBCallbacksImpl::onSuccess):
+
+2010-09-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        REGRESSION: Crash occurs at objc_msgSend when closing a window that is displaying the web inspector
+        https://bugs.webkit.org/show_bug.cgi?id=44230
+
+        * src/InspectorFrontendClientImpl.cpp:
+        (WebKit::InspectorFrontendClientImpl::disconnectFromBackend):
+        * src/InspectorFrontendClientImpl.h:
+
+2010-09-02  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Remove obsolete public/API methods in chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=45108
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+
+2010-09-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [DRT/Chromium] Remove dependency to base/task.h and base/timer.h
+        https://bugs.webkit.org/show_bug.cgi?id=45091
+
+        * DEPS: Roll Chromium revision to 58277 in order to have
+        webkit_support::PostDelayedTask().
+
 2010-09-02  Ilya Sherman  <isherman@google.com>
 
         Reviewed by Eric Seidel.
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
index 6252f08..2fc218b 100644
--- a/WebKit/chromium/DEPS
+++ b/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '57823',
+  'chromium_rev': '58277',
 }
 
 deps = {
diff --git a/WebKit/chromium/WebKit.gyp b/WebKit/chromium/WebKit.gyp
index c75cac7..11246fa 100644
--- a/WebKit/chromium/WebKit.gyp
+++ b/WebKit/chromium/WebKit.gyp
@@ -733,13 +733,19 @@
                         'src',
                     ],
                     'sources': [
+                        'tests/ArenaTestHelpers.h',
                         'tests/DragImageTest.cpp',
                         'tests/IDBBindingUtilitiesTest.cpp',
                         'tests/IDBKeyPathTest.cpp',
                         'tests/KeyboardTest.cpp',
                         'tests/KURLTest.cpp',
+                        'tests/PODArenaTest.cpp',
+                        'tests/PODIntervalTreeTest.cpp',
+                        'tests/PODRedBlackTreeTest.cpp',
                         'tests/RunAllTests.cpp',
                         'tests/TilingDataTest.cpp',
+                        'tests/TreeTestHelpers.cpp',
+                        'tests/TreeTestHelpers.h',
                     ],
                     'conditions': [
                         ['OS=="win"', {
diff --git a/WebKit/chromium/public/WebAccessibilityObject.h b/WebKit/chromium/public/WebAccessibilityObject.h
index ddb9bda..6b55376 100644
--- a/WebKit/chromium/public/WebAccessibilityObject.h
+++ b/WebKit/chromium/public/WebAccessibilityObject.h
@@ -81,17 +81,22 @@ public:
     WEBKIT_API WebAccessibilityObject parentObject() const;
     WEBKIT_API WebAccessibilityObject previousSibling() const;
 
+    WEBKIT_API bool canSetSelectedAttribute() const;
     WEBKIT_API bool isAnchor() const;
     WEBKIT_API bool isChecked() const;
+    WEBKIT_API bool isCollapsed() const;
     WEBKIT_API bool isFocused() const;
     WEBKIT_API bool isEnabled() const;
     WEBKIT_API bool isHovered() const;
     WEBKIT_API bool isIndeterminate() const;
+    WEBKIT_API bool isLinked() const;
     WEBKIT_API bool isMultiSelectable() const;
     WEBKIT_API bool isOffScreen() const;
     WEBKIT_API bool isPasswordField() const;
     WEBKIT_API bool isPressed() const;
     WEBKIT_API bool isReadOnly() const;
+    WEBKIT_API bool isSelected() const;
+    WEBKIT_API bool isVisible() const;
     WEBKIT_API bool isVisited() const;
 
     WEBKIT_API WebRect boundingBoxRect() const;
diff --git a/WebKit/chromium/public/WebDevToolsAgentClient.h b/WebKit/chromium/public/WebDevToolsAgentClient.h
index 087ac0b..b373b60 100644
--- a/WebKit/chromium/public/WebDevToolsAgentClient.h
+++ b/WebKit/chromium/public/WebDevToolsAgentClient.h
@@ -44,9 +44,6 @@ public:
     virtual void sendDebuggerOutput(const WebString&) { }
     virtual void sendDispatchToAPU(const WebString&) { }
 
-    // Invalidates widget which leads to the repaint.
-    virtual void forceRepaint() { }
-
     // Returns the identifier of the entity hosting this agent.
     virtual int hostIdentifier() { return -1; }
 
diff --git a/WebKit/chromium/public/WebDeviceOrientationClientMock.h b/WebKit/chromium/public/WebDeviceOrientationClientMock.h
index fce964b..9cbccf7 100644
--- a/WebKit/chromium/public/WebDeviceOrientationClientMock.h
+++ b/WebKit/chromium/public/WebDeviceOrientationClientMock.h
@@ -28,6 +28,7 @@
 
 #include "WebCommon.h"
 #include "WebDeviceOrientationClient.h"
+#include "WebPrivateOwnPtr.h"
 
 namespace WebCore { class DeviceOrientationClientMock; }
 
@@ -49,7 +50,7 @@ private:
     WEBKIT_API void initialize();
     WEBKIT_API void reset();
 
-    WebCore::DeviceOrientationClientMock* m_clientMock;
+    WebPrivateOwnPtr<WebCore::DeviceOrientationClientMock> m_clientMock;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebGeolocationServiceBridge.h b/WebKit/chromium/public/WebGeolocationServiceBridge.h
index 9f0ffd4..422b32b 100644
--- a/WebKit/chromium/public/WebGeolocationServiceBridge.h
+++ b/WebKit/chromium/public/WebGeolocationServiceBridge.h
@@ -47,6 +47,10 @@ public:
     virtual void setIsAllowed(bool allowed) = 0;
     virtual void setLastPosition(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed, long long timestamp) = 0;
     virtual void setLastError(int errorCode, const WebString& message) = 0;
+    virtual void onWebGeolocationServiceDestroyed() = 0;
+
+protected:
+    virtual ~WebGeolocationServiceBridge() {}
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebKit.h b/WebKit/chromium/public/WebKit.h
index 732cac6..5550db1 100644
--- a/WebKit/chromium/public/WebKit.h
+++ b/WebKit/chromium/public/WebKit.h
@@ -55,6 +55,11 @@ WEBKIT_API WebKitClient* webKitClient();
 WEBKIT_API void setLayoutTestMode(bool);
 WEBKIT_API bool layoutTestMode();
 
+// This is a temporary flag while we try to get Linux to match Windows'
+// checksum computation.  It specifies whether or not the baseline images
+// should be opaque or not.
+WEBKIT_API bool areLayoutTestImagesOpaque();
+
 // Enables the named log channel.  See WebCore/platform/Logging.h for details.
 WEBKIT_API void enableLogChannel(const char*);
 
diff --git a/WebKit/chromium/public/WebKitClient.h b/WebKit/chromium/public/WebKitClient.h
index 9c0b4c2..0f282e0 100644
--- a/WebKit/chromium/public/WebKitClient.h
+++ b/WebKit/chromium/public/WebKitClient.h
@@ -163,6 +163,9 @@ public:
     // That is committed size for Windows and virtual memory size for POSIX
     virtual size_t memoryUsageMB() { return 0; }
 
+    // Same as above, but always returns actual value, without any caches.
+    virtual size_t actualMemoryUsageMB() { return 0; }
+
 
     // Message Ports -------------------------------------------------------
 
diff --git a/WebKit/chromium/public/WebSpeechInputController.h b/WebKit/chromium/public/WebSpeechInputController.h
index 0315722..5408741 100644
--- a/WebKit/chromium/public/WebSpeechInputController.h
+++ b/WebKit/chromium/public/WebSpeechInputController.h
@@ -45,11 +45,6 @@ public:
     // text are returned via the listener interface.
     virtual bool startRecognition(int requestId, const WebRect&)
     {
-        return startRecognition(requestId);
-    }
-    // FIXME: Remove this once chromium has picked up this change.
-    virtual bool startRecognition(int)
-    {
         WEBKIT_ASSERT_NOT_REACHED();
         return false;
     }
diff --git a/WebKit/chromium/public/WebVector.h b/WebKit/chromium/public/WebVector.h
index 0520895..cf3ec95 100644
--- a/WebKit/chromium/public/WebVector.h
+++ b/WebKit/chromium/public/WebVector.h
@@ -115,8 +115,16 @@ public:
     size_t size() const { return m_size; }
     bool isEmpty() const { return !m_size; }
 
-    T& operator[](size_t i) { return m_ptr[i]; }
-    const T& operator[](size_t i) const { return m_ptr[i]; }
+    T& operator[](size_t i)
+    {
+        WEBKIT_ASSERT(i < m_size);
+        return m_ptr[i];
+    }
+    const T& operator[](size_t i) const
+    {
+        WEBKIT_ASSERT(i < m_size);
+        return m_ptr[i];
+    }
 
     T* data() { return m_ptr; }
     const T* data() const { return m_ptr; }
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
index e6f1400..8a3eda6 100644
--- a/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -59,6 +59,7 @@
 #include "SearchPopupMenuChromium.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
+#include "SharedGraphicsContext3D.h"
 #include "WebGeolocationService.h"
 #if USE(V8)
 #include "V8Proxy.h"
@@ -749,8 +750,18 @@ void ChromeClientImpl::scheduleCompositingLayerSync()
 {
     m_webView->setRootLayerNeedsDisplay();
 }
+
+bool ChromeClientImpl::allowsAcceleratedCompositing() const
+{
+    return m_webView->allowsAcceleratedCompositing();
+}
 #endif
 
+WebCore::SharedGraphicsContext3D* ChromeClientImpl::getSharedGraphicsContext3D()
+{
+    return m_webView->getSharedGraphicsContext3D();
+}
+
 bool ChromeClientImpl::supportsFullscreenForNode(const WebCore::Node* node)
 {
     if (m_webView->client() && node->hasTagName(WebCore::HTMLNames::videoTag))
diff --git a/WebKit/chromium/src/ChromeClientImpl.h b/WebKit/chromium/src/ChromeClientImpl.h
index bff9f90..d16d8f6 100644
--- a/WebKit/chromium/src/ChromeClientImpl.h
+++ b/WebKit/chromium/src/ChromeClientImpl.h
@@ -150,8 +150,13 @@ public:
     // Sets a flag to specify that the view needs to be updated, so we need
     // to do an eager layout before the drawing.
     virtual void scheduleCompositingLayerSync();
+
+    // Returns true if accelerated compositing is supported.
+    virtual bool allowsAcceleratedCompositing() const;
 #endif
 
+    virtual WebCore::SharedGraphicsContext3D* getSharedGraphicsContext3D();
+
     virtual bool supportsFullscreenForNode(const WebCore::Node*);
     virtual void enterFullscreenForNode(WebCore::Node*);
     virtual void exitFullscreenForNode(WebCore::Node*);
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
index 911dcf3..3ced7b8 100644
--- a/WebKit/chromium/src/ChromiumBridge.cpp
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -823,6 +823,11 @@ int ChromiumBridge::memoryUsageMB()
     return static_cast<int>(webKitClient()->memoryUsageMB());
 }
 
+int ChromiumBridge::actualMemoryUsageMB()
+{
+    return static_cast<int>(webKitClient()->actualMemoryUsageMB());
+}
+
 int ChromiumBridge::screenDepth(Widget* widget)
 {
     WebWidgetClient* client = toWebWidgetClient(widget);
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index 1dc2ee7..ef611e1 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -98,7 +98,7 @@ static bool isASingleWord(const String& text)
 static String selectMisspelledWord(const ContextMenu* defaultMenu, Frame* selectedFrame)
 {
     // First select from selectedText to check for multiple word selection.
-    String misspelledWord = selectedFrame->selectedText().stripWhiteSpace();
+    String misspelledWord = selectedFrame->editor()->selectedText().stripWhiteSpace();
 
     // If some texts were already selected, we don't change the selection.
     if (!misspelledWord.isEmpty()) {
@@ -119,7 +119,7 @@ static String selectMisspelledWord(const ContextMenu* defaultMenu, Frame* select
         return misspelledWord; // It is empty.
 
     WebFrameImpl::selectWordAroundPosition(selectedFrame, pos);
-    misspelledWord = selectedFrame->selectedText().stripWhiteSpace();
+    misspelledWord = selectedFrame->editor()->selectedText().stripWhiteSpace();
 
 #if OS(DARWIN)
     // If misspelled word is still empty, then that portion should not be
@@ -233,7 +233,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         data.frameURL = urlFromFrame(selectedFrame);
 
     if (r.isSelected())
-        data.selectedText = selectedFrame->selectedText().stripWhiteSpace();
+        data.selectedText = selectedFrame->editor()->selectedText().stripWhiteSpace();
 
     if (r.isContentEditable()) {
         data.isEditable = true;
diff --git a/WebKit/chromium/src/DebuggerAgentImpl.cpp b/WebKit/chromium/src/DebuggerAgentImpl.cpp
index 46c6e7c..5dd5c58 100644
--- a/WebKit/chromium/src/DebuggerAgentImpl.cpp
+++ b/WebKit/chromium/src/DebuggerAgentImpl.cpp
@@ -60,7 +60,6 @@ DebuggerAgentImpl::~DebuggerAgentImpl()
 void DebuggerAgentImpl::debuggerOutput(const String& command)
 {
     m_webdevtoolsAgentClient->sendDebuggerOutput(command);
-    m_webdevtoolsAgent->forceRepaint();
 }
 
 WebCore::Page* DebuggerAgentImpl::page()
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index 74186bf..ea668c7 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -37,6 +37,7 @@
 #include "FormState.h"
 #include "FrameLoader.h"
 #include "FrameLoadRequest.h"
+#include "FrameNetworkingContextImpl.h"
 #include "FrameView.h"
 #include "HTTPParsers.h"
 #include "HistoryItem.h"
@@ -1512,4 +1513,9 @@ PassOwnPtr<WebPluginLoadObserver> FrameLoaderClientImpl::pluginLoadObserver()
     return ds->releasePluginLoadObserver();
 }
 
+PassRefPtr<FrameNetworkingContext> FrameLoaderClientImpl::createNetworkingContext()
+{
+    return FrameNetworkingContextImpl::create(m_webFrame->frame());
+}
+
 } // namespace WebKit
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.h b/WebKit/chromium/src/FrameLoaderClientImpl.h
index 3a8a714..361bae4 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -198,6 +198,8 @@ public:
     virtual void didNotAllowScript();
     virtual void didNotAllowPlugins();
 
+    virtual PassRefPtr<WebCore::FrameNetworkingContext> createNetworkingContext();
+
 private:
     void makeDocumentView();
 
diff --git a/WebKit/chromium/src/GraphicsContext3D.cpp b/WebKit/chromium/src/GraphicsContext3D.cpp
index 6bc5ffe..3051b9b 100644
--- a/WebKit/chromium/src/GraphicsContext3D.cpp
+++ b/WebKit/chromium/src/GraphicsContext3D.cpp
@@ -35,7 +35,7 @@
 #include "GraphicsContext3D.h"
 
 #include "CachedImage.h"
-#include "CanvasLayerChromium.h"
+#include "WebGLLayerChromium.h"
 #include "CanvasRenderingContext.h"
 #include "Chrome.h"
 #include "ChromeClientImpl.h"
@@ -55,6 +55,7 @@
 
 #if PLATFORM(CG)
 #include "GraphicsContext.h"
+#include "WebGLRenderingContext.h"
 #include <CoreGraphics/CGContext.h>
 #include <CoreGraphics/CGImage.h>
 #endif
@@ -103,7 +104,7 @@ public:
     void prepareTexture();
 
 #if USE(ACCELERATED_COMPOSITING)
-    CanvasLayerChromium* platformLayer() const;
+    WebGLLayerChromium* platformLayer() const;
 #endif
     bool isGLES2Compliant() const;
     bool isGLES2NPOTStrict() const;
@@ -298,7 +299,7 @@ private:
     OwnPtr<WebKit::WebGraphicsContext3D> m_impl;
     WebKit::WebViewImpl* m_webViewImpl;
 #if USE(ACCELERATED_COMPOSITING)
-    RefPtr<CanvasLayerChromium> m_compositingLayer;
+    RefPtr<WebGLLayerChromium> m_compositingLayer;
 #endif
 #if PLATFORM(SKIA)
     // If the width and height of the Canvas's backing store don't
@@ -360,7 +361,7 @@ bool GraphicsContext3DInternal::initialize(GraphicsContext3D::Attributes attrs,
     m_impl.set(webContext);
 
 #if USE(ACCELERATED_COMPOSITING)
-    m_compositingLayer = CanvasLayerChromium::create(0);
+    m_compositingLayer = WebGLLayerChromium::create(0);
 #endif
     return true;
 }
@@ -381,7 +382,7 @@ void GraphicsContext3DInternal::prepareTexture()
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-CanvasLayerChromium* GraphicsContext3DInternal::platformLayer() const
+WebGLLayerChromium* GraphicsContext3DInternal::platformLayer() const
 {
     return m_compositingLayer.get();
 }
@@ -436,10 +437,10 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
         canvas.drawBitmapRect(m_resizingBitmap, 0, dst);
     }
 #elif PLATFORM(CG)
-    if (m_renderOutput)
-        context->graphicsContext3D()->paintToCanvas(m_renderOutput, m_impl->width(), m_impl->height(),
-                                                    canvas->width(), canvas->height(),
-                                                    imageBuffer->context()->platformContext());
+    if (m_renderOutput && context->is3d()) {
+        WebGLRenderingContext* webGLContext = static_cast<WebGLRenderingContext*>(context);
+        webGLContext->graphicsContext3D()->paintToCanvas(m_renderOutput, m_impl->width(), m_impl->height(), canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
+    }
 #else
 #error Must port to your platform
 #endif
@@ -1039,7 +1040,7 @@ void GraphicsContext3D::prepareTexture()
 #if USE(ACCELERATED_COMPOSITING)
 PlatformLayer* GraphicsContext3D::platformLayer() const
 {
-    CanvasLayerChromium* canvasLayer = m_internal->platformLayer();
+    WebGLLayerChromium* canvasLayer = m_internal->platformLayer();
     canvasLayer->setContext(this);
     return canvasLayer;
 }
diff --git a/WebKit/chromium/src/InspectorFrontendClientImpl.cpp b/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
index 46f2cb6..51864f1 100644
--- a/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
+++ b/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
@@ -105,6 +105,11 @@ void InspectorFrontendClientImpl::closeWindow()
     m_client->closeWindow();
 }
 
+void InspectorFrontendClientImpl::disconnectFromBackend()
+{
+    m_client->closeWindow();
+}
+
 void InspectorFrontendClientImpl::requestAttachWindow()
 {
     m_client->requestDockWindow();
diff --git a/WebKit/chromium/src/InspectorFrontendClientImpl.h b/WebKit/chromium/src/InspectorFrontendClientImpl.h
index 1507bf2..fc21f3e 100644
--- a/WebKit/chromium/src/InspectorFrontendClientImpl.h
+++ b/WebKit/chromium/src/InspectorFrontendClientImpl.h
@@ -61,6 +61,7 @@ public:
 
     virtual void bringToFront();
     virtual void closeWindow();
+    virtual void disconnectFromBackend();
 
     virtual void requestAttachWindow();
     virtual void requestDetachWindow();
diff --git a/WebKit/chromium/src/WebAccessibilityObject.cpp b/WebKit/chromium/src/WebAccessibilityObject.cpp
index 4263e8b..3a3e94b 100644
--- a/WebKit/chromium/src/WebAccessibilityObject.cpp
+++ b/WebKit/chromium/src/WebAccessibilityObject.cpp
@@ -182,6 +182,15 @@ WebAccessibilityObject WebAccessibilityObject::previousSibling() const
     return WebAccessibilityObject(m_private->previousSibling());
 }
 
+bool WebAccessibilityObject::canSetSelectedAttribute() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->canSetSelectedAttribute();
+}
+
 bool WebAccessibilityObject::isAnchor() const
 {
     if (!m_private)
@@ -200,6 +209,15 @@ bool WebAccessibilityObject::isChecked() const
     return m_private->isChecked();
 }
 
+bool WebAccessibilityObject::isCollapsed() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isCollapsed();
+}
+
 
 bool WebAccessibilityObject::isFocused() const
 {
@@ -237,6 +255,15 @@ bool WebAccessibilityObject::isIndeterminate() const
     return m_private->isIndeterminate();
 }
 
+bool WebAccessibilityObject::isLinked() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isLinked();
+}
+
 bool WebAccessibilityObject::isMultiSelectable() const
 {
     if (!m_private)
@@ -282,6 +309,24 @@ bool WebAccessibilityObject::isReadOnly() const
     return m_private->isReadOnly();
 }
 
+bool WebAccessibilityObject::isSelected() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isSelected();
+}
+
+bool WebAccessibilityObject::isVisible() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isVisible();
+}
+
 bool WebAccessibilityObject::isVisited() const
 {
     if (!m_private)
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index fbb06f8..971c290 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -239,11 +239,6 @@ void WebDevToolsAgentImpl::didClearWindowObject(WebFrameImpl* webframe)
     DebuggerAgentManager::setHostId(webframe, m_hostId);
 }
 
-void WebDevToolsAgentImpl::forceRepaint()
-{
-    m_client->forceRepaint();
-}
-
 void WebDevToolsAgentImpl::dispatchOnInspectorBackend(const WebString& message)
 {
     inspectorController()->inspectorBackendDispatcher()->dispatch(message);
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.h b/WebKit/chromium/src/WebDevToolsAgentImpl.h
index da584fb..36cafcf 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.h
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.h
@@ -99,8 +99,6 @@ public:
     virtual void timelineProfilerWasStopped();
     virtual bool sendMessageToFrontend(const WTF::String&);
 
-    void forceRepaint();
-
     int hostId() { return m_hostId; }
 
 private:
diff --git a/WebKit/chromium/src/WebDeviceOrientationClientMock.cpp b/WebKit/chromium/src/WebDeviceOrientationClientMock.cpp
index 4011d12..820c970 100644
--- a/WebKit/chromium/src/WebDeviceOrientationClientMock.cpp
+++ b/WebKit/chromium/src/WebDeviceOrientationClientMock.cpp
@@ -35,6 +35,7 @@ namespace WebKit {
 void WebDeviceOrientationClientMock::setController(WebDeviceOrientationController* controller)
 {
     m_clientMock->setController(controller->controller());
+    delete controller;
 }
 
 void WebDeviceOrientationClientMock::startUpdating()
@@ -59,13 +60,12 @@ void WebDeviceOrientationClientMock::setOrientation(WebDeviceOrientation& orient
 
 void WebDeviceOrientationClientMock::initialize()
 {
-    m_clientMock = new WebCore::DeviceOrientationClientMock();
+    m_clientMock.reset(new WebCore::DeviceOrientationClientMock());
 }
 
 void WebDeviceOrientationClientMock::reset()
 {
-    delete m_clientMock;
-    m_clientMock = 0;
+    m_clientMock.reset(0);
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
index eb0db7e..a2d6a46 100644
--- a/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -1356,7 +1356,7 @@ bool WebFrameImpl::find(int identifier,
     }
 
     ASSERT(frame() && frame()->view());
-    bool found = frame()->findString(
+    bool found = frame()->editor()->findString(
         searchText, options.forward, options.matchCase, wrapWithinFrame,
         startInSelection);
     if (found) {
@@ -1439,7 +1439,7 @@ void WebFrameImpl::stopFinding(bool clearSelection)
 
     // Remove all markers for matches found and turn off the highlighting.
     frame()->document()->markers()->removeMarkers(DocumentMarker::TextMatch);
-    frame()->setMarkedTextMatchesAreHighlighted(false);
+    frame()->editor()->setMarkedTextMatchesAreHighlighted(false);
 
     // Let the frame know that we don't want tickmarks or highlighting anymore.
     invalidateArea(InvalidateAll);
@@ -1460,7 +1460,7 @@ void WebFrameImpl::scopeStringMatches(int identifier,
         // Scoping is just about to begin.
         m_scopingComplete = false;
         // Clear highlighting for this frame.
-        if (frame()->markedTextMatchesAreHighlighted())
+        if (frame()->editor()->markedTextMatchesAreHighlighted())
             frame()->page()->unmarkAllTextMatches();
         // Clear the counters from last operation.
         m_lastMatchCount = 0;
@@ -1585,7 +1585,7 @@ void WebFrameImpl::scopeStringMatches(int identifier,
     m_lastSearchString = searchText;
 
     if (matchCount > 0) {
-        frame()->setMarkedTextMatchesAreHighlighted(true);
+        frame()->editor()->setMarkedTextMatchesAreHighlighted(true);
 
         m_lastMatchCount += matchCount;
 
diff --git a/WebKit/chromium/src/WebGeolocationServiceBridgeImpl.cpp b/WebKit/chromium/src/WebGeolocationServiceBridgeImpl.cpp
index 3c3a1db..bbb7162 100644
--- a/WebKit/chromium/src/WebGeolocationServiceBridgeImpl.cpp
+++ b/WebKit/chromium/src/WebGeolocationServiceBridgeImpl.cpp
@@ -79,6 +79,7 @@ public:
     virtual void setIsAllowed(bool allowed);
     virtual void setLastPosition(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed, long long timestamp);
     virtual void setLastError(int errorCode, const WebString& message);
+    virtual void onWebGeolocationServiceDestroyed();
 
 private:
     WebViewClient* getWebViewClient();
@@ -176,6 +177,10 @@ WebViewClient* WebGeolocationServiceBridgeImpl::getWebViewClient()
     return webViewClient;
 }
 
+void WebGeolocationServiceBridgeImpl::onWebGeolocationServiceDestroyed()
+{
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(GEOLOCATION)
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index e543123..fe67789 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -57,49 +57,41 @@ WebIDBCallbacksImpl::~WebIDBCallbacksImpl()
 void WebIDBCallbacksImpl::onError(const WebKit::WebIDBDatabaseError& error)
 {
     m_callbacks->onError(error);
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess()
 {
     m_callbacks->onSuccess();
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBCursor* cursor)
 {
     m_callbacks->onSuccess(IDBCursorBackendProxy::create(cursor));
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBDatabase* webKitInstance)
 {
     m_callbacks->onSuccess(IDBDatabaseProxy::create(webKitInstance));
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess(const WebKit::WebIDBKey& key)
 {
     m_callbacks->onSuccess(key);
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBIndex* webKitInstance)
 {
     m_callbacks->onSuccess(IDBIndexBackendProxy::create(webKitInstance));
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBObjectStore* webKitInstance)
 {
     m_callbacks->onSuccess(IDBObjectStoreProxy::create(webKitInstance));
-    m_callbacks.clear();
 }
 
 void WebIDBCallbacksImpl::onSuccess(const WebKit::WebSerializedScriptValue& serializedScriptValue)
 {
     m_callbacks->onSuccess(serializedScriptValue);
-    m_callbacks.clear();
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebKit.cpp b/WebKit/chromium/src/WebKit.cpp
index cadcb6c..f3336ea 100644
--- a/WebKit/chromium/src/WebKit.cpp
+++ b/WebKit/chromium/src/WebKit.cpp
@@ -103,6 +103,11 @@ bool layoutTestMode()
     return s_layoutTestMode;
 }
 
+bool areLayoutTestImagesOpaque()
+{
+    return true;
+}
+
 void enableLogChannel(const char* name)
 {
     WTFLogChannel* channel = WebCore::getChannelFromName(name);
diff --git a/WebKit/chromium/src/WebScrollbarImpl.cpp b/WebKit/chromium/src/WebScrollbarImpl.cpp
index c0131cb..8b9e287 100644
--- a/WebKit/chromium/src/WebScrollbarImpl.cpp
+++ b/WebKit/chromium/src/WebScrollbarImpl.cpp
@@ -94,7 +94,7 @@ int WebScrollbarImpl::value() const
 
 void WebScrollbarImpl::setValue(int position)
 {
-    m_scrollbar->setValue(position);
+    m_scrollbar->setValue(position, Scrollbar::NotFromScrollAnimator);
 }
 
 void WebScrollbarImpl::setDocumentSize(int size)
@@ -218,7 +218,7 @@ bool WebScrollbarImpl::onMouseWheel(const WebInputEvent& event)
                 if (negative)
                     delta *= -1;
             }
-            m_scrollbar->setValue(m_scrollbar->value() - delta);
+            m_scrollbar->scroll((m_scrollbar->orientation() == HorizontalScrollbar) ? WebCore::ScrollLeft : WebCore::ScrollUp, WebCore::ScrollByPixel, delta);
             return true;
         }
 
@@ -262,6 +262,16 @@ bool WebScrollbarImpl::onKeyDown(const WebInputEvent& event)
     return false;
 }
 
+int WebScrollbarImpl::scrollSize(WebCore::ScrollbarOrientation orientation) const
+{
+    return (orientation == m_scrollbar->orientation()) ? (m_scrollbar->totalSize() - m_scrollbar->visibleSize()) : 0;
+}
+
+void WebScrollbarImpl::setScrollOffsetFromAnimation(const WebCore::IntPoint& offset)
+{
+    m_scrollbar->setValue((m_scrollbar->orientation() == HorizontalScrollbar) ? offset.x() : offset.y(), Scrollbar::FromScrollAnimator);
+}
+
 void WebScrollbarImpl::valueChanged(WebCore::Scrollbar*)
 {
     m_client->valueChanged(this);
diff --git a/WebKit/chromium/src/WebScrollbarImpl.h b/WebKit/chromium/src/WebScrollbarImpl.h
index a041ccc..5512867 100644
--- a/WebKit/chromium/src/WebScrollbarImpl.h
+++ b/WebKit/chromium/src/WebScrollbarImpl.h
@@ -58,6 +58,8 @@ public:
     virtual bool handleInputEvent(const WebInputEvent&);
 
     // WebCore::ScrollbarClient methods
+    virtual int scrollSize(WebCore::ScrollbarOrientation orientation) const;
+    virtual void setScrollOffsetFromAnimation(const WebCore::IntPoint&);
     virtual void valueChanged(WebCore::Scrollbar*);
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&);
     virtual bool isActive() const;
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index 4b129d6..137bf06 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -58,6 +58,7 @@
 #include "GLES2Context.h"
 #include "GLES2ContextInternal.h"
 #include "GraphicsContext.h"
+#include "GraphicsContext3D.h"
 #include "HTMLInputElement.h"
 #include "HTMLMediaElement.h"
 #include "HitTestResult.h"
@@ -86,6 +87,7 @@
 #include "SecurityOrigin.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "SharedGraphicsContext3D.h"
 #include "Timer.h"
 #include "TypingCommand.h"
 #include "UserGestureIndicator.h"
@@ -263,6 +265,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
 #if USE(ACCELERATED_COMPOSITING)
     , m_layerRenderer(0)
     , m_isAcceleratedCompositingActive(false)
+    , m_compositorCreationFailed(false)
 #endif
 #if ENABLE(INPUT_SPEECH)
     , m_speechInputClient(client)
@@ -967,6 +970,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         IntRect contentRect = view->visibleContentRect(false);
 
         // Ask the layer compositor to redraw all the layers.
+        ASSERT(m_layerRenderer->hardwareCompositing());
         m_layerRenderer->drawLayers(rect, visibleRect, contentRect, IntPoint(view->scrollX(), view->scrollY()));
     }
 #endif
@@ -1274,7 +1278,7 @@ WebRect WebViewImpl::caretOrSelectionBounds()
         if (!node || !node->renderer())
             return rect;
         RefPtr<Range> range = controller->toNormalizedRange();
-        rect = view->contentsToWindow(focused->firstRectForRange(range.get()));
+        rect = view->contentsToWindow(focused->editor()->firstRectForRange(range.get()));
     }
     return rect;
 }
@@ -2103,6 +2107,11 @@ bool WebViewImpl::tabsToLinks() const
 }
 
 #if USE(ACCELERATED_COMPOSITING)
+bool WebViewImpl::allowsAcceleratedCompositing()
+{
+    return !m_compositorCreationFailed;
+}
+
 void WebViewImpl::setRootGraphicsLayer(WebCore::PlatformLayer* layer)
 {
     setIsAcceleratedCompositingActive(layer ? true : false);
@@ -2117,15 +2126,15 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
     if (active) {
         m_layerRenderer = LayerRendererChromium::create(getOnscreenGLES2Context());
-        if (m_layerRenderer->hardwareCompositing()) {
+        if (m_layerRenderer) {
             m_isAcceleratedCompositingActive = true;
             
             // Force a redraw the entire view so that the compositor gets the entire view,
             // rather than just the currently-dirty subset.
             m_client->didInvalidateRect(IntRect(0, 0, m_size.width, m_size.height));
         } else {
-            m_layerRenderer.clear();
             m_isAcceleratedCompositingActive = false;
+            m_compositorCreationFailed = true;
         }
     } else {
         m_layerRenderer = 0;
@@ -2212,17 +2221,21 @@ void WebViewImpl::setRootLayerNeedsDisplay()
 
 PassOwnPtr<GLES2Context> WebViewImpl::getOnscreenGLES2Context()
 {
-    return GLES2Context::create(GLES2ContextInternal::create(gles2Context(), false));
+    WebGLES2Context* context = gles2Context();
+    if (!context)
+        return 0;
+    return GLES2Context::create(GLES2ContextInternal::create(context, false));
 }
 
-PassOwnPtr<GLES2Context> WebViewImpl::getOffscreenGLES2Context()
+SharedGraphicsContext3D* WebViewImpl::getSharedGraphicsContext3D()
 {
-    WebGLES2Context* context = webKitClient()->createGLES2Context();
-    if (!context)
-        return 0;
-    if (!context->initialize(0, gles2Context()))
-        return 0;
-    return GLES2Context::create(GLES2ContextInternal::create(context, true));
+    if (!m_sharedContext3D) {
+        GraphicsContext3D::Attributes attr;
+        OwnPtr<GraphicsContext3D> context = GraphicsContext3D::create(attr, m_page->chrome());
+        m_sharedContext3D = SharedGraphicsContext3D::create(context.release());
+    }
+
+    return m_sharedContext3D.get();
 }
 
 // Returns the GLES2 context associated with this View. If one doesn't exist
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
index c296121..a42099c 100644
--- a/WebKit/chromium/src/WebViewImpl.h
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -324,15 +324,16 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     void setRootLayerNeedsDisplay();
     void setRootGraphicsLayer(WebCore::PlatformLayer*);
+    bool allowsAcceleratedCompositing();
 #endif
     // Onscreen contexts display to the screen associated with this view.
     // Offscreen contexts render offscreen but can share resources with the
     // onscreen context and thus can be composited.
     PassOwnPtr<WebCore::GLES2Context> getOnscreenGLES2Context();
-    PassOwnPtr<WebCore::GLES2Context> getOffscreenGLES2Context();
 
     // Returns an onscreen context
     virtual WebGLES2Context* gles2Context();
+    virtual WebCore::SharedGraphicsContext3D* getSharedGraphicsContext3D();
 
     WebCore::PopupContainer* selectPopup() const { return m_selectPopup.get(); }
 
@@ -512,6 +513,7 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     OwnPtr<WebCore::LayerRendererChromium> m_layerRenderer;
     bool m_isAcceleratedCompositingActive;
+    bool m_compositorCreationFailed;
 #endif
     static const WebInputEvent* m_currentInputEvent;
 
@@ -521,6 +523,8 @@ private:
 
     OwnPtr<WebGLES2Context> m_gles2Context;
 
+    RefPtr<WebCore::SharedGraphicsContext3D> m_sharedContext3D;
+
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
 };
 
diff --git a/WebKit/chromium/src/js/Tests.js b/WebKit/chromium/src/js/Tests.js
index 41574b4..2233463 100644
--- a/WebKit/chromium/src/js/Tests.js
+++ b/WebKit/chromium/src/js/Tests.js
@@ -219,40 +219,6 @@ TestSuite.prototype.addSniffer = function(receiver, methodName, override, opt_st
 
 
 /**
- * Tests that the real injected host is present in the context.
- */
-TestSuite.prototype.testHostIsPresent = function()
-{
-    this.assertTrue(typeof InspectorFrontendHost === "object" && !InspectorFrontendHost.isStub);
-};
-
-
-/**
- * Tests elements tree has an "HTML" root.
- */
-TestSuite.prototype.testElementsTreeRoot = function()
-{
-    var doc = WebInspector.domAgent.document;
-    this.assertEquals("HTML", doc.documentElement.nodeName);
-    this.assertTrue(doc.documentElement.hasChildNodes());
-};
-
-
-/**
- * Tests that main resource is present in the system and that it is
- * the only resource.
- */
-TestSuite.prototype.testMainResource = function()
-{
-    var tokens = [];
-    var resources = WebInspector.resources;
-    for (var id in resources)
-        tokens.push(resources[id].lastPathComponent);
-    this.assertEquals("simple_page.html", tokens.join(","));
-};
-
-
-/**
  * Tests that resources tab is enabled when corresponding item is selected.
  */
 TestSuite.prototype.testEnableResourcesTab = function()
@@ -628,71 +594,6 @@ TestSuite.prototype.testNoScriptDuplicatesOnPanelSwitch = function()
 };
 
 
-/**
- * Tests that a breakpoint can be set.
- */
-TestSuite.prototype.testSetBreakpoint = function()
-{
-    var test = this;
-    this.showPanel("scripts");
-
-    var breakpointLine = 16
-
-    this._waitUntilScriptsAreParsed(["debugger_test_page.html"],
-        function() {
-          test.showMainPageScriptSource_(
-              "debugger_test_page.html",
-              function(view, url) {
-                view._addBreakpoint(breakpointLine);
-
-                test.evaluateInConsole_(
-                    'setTimeout("calculate()" , 0)',
-                    function(resultText) {
-                      test.assertTrue(!isNaN(resultText), "Failed to get timer id: " + resultText);
-                    });
-              });
-        });
-
-    this._waitForScriptPause(
-        {
-            functionsOnStack: ["calculate", ""],
-            lineNumber: breakpointLine,
-            lineText: "  result = fib(lastVal++);"
-        },
-        function() {
-            test.releaseControl();
-        });
-
-    this.takeControl();
-};
-
-
-/**
- * Tests that pause on exception works.
- */
-TestSuite.prototype.testPauseOnException = function()
-{
-    this.showPanel("scripts");
-    var test = this;
-
-    InspectorBackend.setPauseOnExceptionsState(WebInspector.ScriptsPanel.PauseOnExceptionsState.PauseOnUncaughtExceptions);
-
-    this._executeCodeWhenScriptsAreParsed("handleClick()", ["pause_on_exception.html"]);
-
-    this._waitForScriptPause(
-        {
-            functionsOnStack: ["throwAnException", "handleClick", ""],
-            lineNumber: 6,
-            lineText: "  return unknown_var;"
-        },
-        function() {
-            test.releaseControl();
-        });
-
-    this.takeControl();
-};
-
-
 // Tests that debugger works correctly if pause event occurs when DevTools
 // frontend is being loaded.
 TestSuite.prototype.testPauseWhenLoadingDevTools = function()
@@ -864,54 +765,6 @@ TestSuite.prototype.evaluateInConsole_ = function(code, callback)
 
 
 /**
- * Tests eval on call frame.
- */
-TestSuite.prototype.testEvalOnCallFrame = function()
-{
-    this.showPanel("scripts");
-
-    var breakpointLine = 16;
-
-    var test = this;
-    this._waitUntilScriptsAreParsed(["debugger_test_page.html"],
-        function() {
-          test.showMainPageScriptSource_(
-              "debugger_test_page.html",
-              function(view, url) {
-                  view._addBreakpoint(breakpointLine);
-
-                  // Since breakpoints are ignored in evals' calculate() function is
-                  // execute after zero-timeout so that the breakpoint is hit.
-                  test.evaluateInConsole_(
-                      'setTimeout("calculate(123)" , 0)',
-                      function(resultText) {
-                          test.assertTrue(!isNaN(resultText), "Failed to get timer id: " + resultText);
-                          waitForBreakpointHit();
-                      });
-              });
-        });
-
-    function waitForBreakpointHit() {
-      test.addSniffer(WebInspector,
-          "pausedScript",
-          function(callFrames) {
-            test.assertEquals(2, callFrames.length, "Unexpected stack depth on the breakpoint. " + JSON.stringify(callFrames, null, 4));
-            test.assertEquals("calculate", callFrames[0].functionName, "Unexpected top frame function.");
-            // Evaluate "e+1" where "e" is an argument of "calculate" function.
-            test.evaluateInConsole_(
-                "e+1",
-                function(resultText) {
-                    test.assertEquals("124", resultText, 'Unexpected "e+1" value.');
-                    test.releaseControl();
-                });
-          });
-    }
-
-    this.takeControl();
-};
-
-
-/**
  * Tests that console auto completion works when script execution is paused.
  */
 TestSuite.prototype.testCompletionOnPause = function()
@@ -968,16 +821,6 @@ TestSuite.prototype.testCompletionOnPause = function()
 
 
 /**
- * Tests that inspected page doesn't hang on reload if it contains a syntax
- * error and DevTools window is open.
- */
-TestSuite.prototype.testAutoContinueOnSyntaxError = function()
-{
-    // TODO(yurys): provide an implementation that works with ScriptDebugServer.
-};
-
-
-/**
  * Checks current execution line against expectations.
  * @param {WebInspector.SourceFrame} sourceFrame
  * @param {number} lineNumber Expected line number
@@ -1029,7 +872,8 @@ TestSuite.prototype._waitForScriptPause = function(expectations, callback)
     test.addSniffer(
         WebInspector,
         "pausedScript",
-        function(callFrames) {
+        function(details) {
+            var callFrames = details.callFrames;
             var functionsOnStack = [];
             for (var i = 0; i < callFrames.length; i++)
                 functionsOnStack.push(callFrames[i].functionName);
@@ -1393,85 +1237,6 @@ TestSuite.createKeyEvent = function(keyIdentifier)
 
 
 /**
- * Tests the message loop re-entrancy.
- */
-TestSuite.prototype.testMessageLoopReentrant = function()
-{
-    var test = this;
-    this.showPanel("scripts");
-
-    var breakpointLine = 16;
-
-    WebInspector.showConsole();
-
-    this._waitUntilScriptsAreParsed(["debugger_test_page.html"],
-        function() {
-          test.showMainPageScriptSource_(
-              "debugger_test_page.html",
-              function(view, url) {
-                view._addBreakpoint(breakpointLine);
-
-                test.evaluateInConsole_(
-                    'setTimeout("calculate()", 0)',
-                    function(resultText) {
-                      test.assertTrue(!isNaN(resultText), "Failed to get timer id: " + resultText);
-                    });
-
-              });
-        });
-
-    // Wait until script is paused.
-    this.addSniffer(
-        WebInspector,
-        "pausedScript",
-        function(callFrames) {
-            test.evaluateInConsole_(
-                'document.cookie',
-                test.releaseControl.bind(test)); // This callback will be invoked only if the test succeeds (i.e. no crash).
-        });
-
-    this.takeControl();
-};
-
-
-/**
- * Tests that Storage panel can be open and that local DOM storage is added
- * to the panel.
- */
-TestSuite.prototype.testShowStoragePanel = function()
-{
-    var test = this;
-    this.addSniffer(WebInspector.panels.storage, "addDOMStorage",
-        function(storage) {
-            var orig = storage.getEntries;
-            storage.getEntries = function(callback) {
-                orig.call(this, function(entries) {
-                    callback(entries);
-                    test.releaseControl();
-                });
-            };
-            try {
-                WebInspector.currentPanel.selectDOMStorage(storage.id);
-                storage.getEntries = orig;
-            } catch (e) {
-                test.fail("Exception in selectDOMStorage: " + e);
-            }
-        });
-    this.showPanel("storage");
-
-    // Access localStorage so that it's pushed to the frontend.
-    this.evaluateInConsole_(
-        'setTimeout("localStorage.x = 10" , 0)',
-        function(resultText) {
-            test.assertTrue(!isNaN(resultText), "Failed to get timer id: " + resultText);
-        });
-
-    // Wait until DOM storage is added to the panel.
-    this.takeControl();
-};
-
-
-/**
  * Test runner for the test suite.
  */
 var uiTests = {};
diff --git a/WebKit/chromium/src/js/devTools.css b/WebKit/chromium/src/js/devTools.css
index 9495fb8..9495fb8 100755..100644
--- a/WebKit/chromium/src/js/devTools.css
+++ b/WebKit/chromium/src/js/devTools.css
diff --git a/WebKit/chromium/src/mac/WebInputEventFactory.mm b/WebKit/chromium/src/mac/WebInputEventFactory.mm
index 694155f..b4e09c0 100644
--- a/WebKit/chromium/src/mac/WebInputEventFactory.mm
+++ b/WebKit/chromium/src/mac/WebInputEventFactory.mm
@@ -1178,22 +1178,19 @@ WebMouseWheelEvent WebInputEventFactory::mouseWheelEvent(NSEvent* event, NSView*
     // the point delta data instead, since we cannot distinguish trackpad data
     // from data from any other continuous device.
 
+    // Conversion between wheel delta amounts and number of pixels to scroll.
+    static const double scrollbarPixelsPerCocoaTick = 40.0;
+
     if (CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventIsContinuous)) {
-        result.wheelTicksY = result.deltaY =
-            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventPointDeltaAxis1);
-        result.wheelTicksX = result.deltaX =
-            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventPointDeltaAxis2);
+        result.deltaX = CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventPointDeltaAxis2);
+        result.deltaY = CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventPointDeltaAxis1);
+        result.wheelTicksX = result.deltaX / scrollbarPixelsPerCocoaTick;
+        result.wheelTicksY = result.deltaY / scrollbarPixelsPerCocoaTick;
     } else {
-        result.wheelTicksY =
-            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventDeltaAxis1);
-        result.wheelTicksX =
-            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventDeltaAxis2);
-
-        // Convert wheel delta amount to a number of pixels to scroll.
-        static const double scrollbarPixelsPerCocoaTick = 40.0;
-
         result.deltaX = [event deltaX] * scrollbarPixelsPerCocoaTick;
         result.deltaY = [event deltaY] * scrollbarPixelsPerCocoaTick;
+        result.wheelTicksY = CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventDeltaAxis1);
+        result.wheelTicksX = CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventDeltaAxis2);
     }
 
     result.timeStampSeconds = [event timestamp];
diff --git a/WebKit/chromium/src/win/WebInputEventFactory.cpp b/WebKit/chromium/src/win/WebInputEventFactory.cpp
index 4d83f22..d1d5869 100644
--- a/WebKit/chromium/src/win/WebInputEventFactory.cpp
+++ b/WebKit/chromium/src/win/WebInputEventFactory.cpp
@@ -403,6 +403,9 @@ WebMouseWheelEvent WebInputEventFactory::mouseWheelEvent(HWND hwnd, UINT message
     // smooth scrolling while Firefox doesn't, so it can get away with somewhat
     // larger scroll values without feeling as jerky.  Here we use 100 px per
     // three lines (the default scroll amount is three lines per wheel tick).
+    // Even though we have smooth scrolling, we don't make this as large as IE
+    // because subjectively IE feels like it scrolls farther than you want while
+    // reading articles.
     static const float scrollbarPixelsPerLine = 100.0f / 3.0f;
     wheelDelta /= WHEEL_DELTA;
     float scrollDelta = wheelDelta;
diff --git a/WebKit/chromium/tests/ArenaTestHelpers.h b/WebKit/chromium/tests/ArenaTestHelpers.h
new file mode 100644
index 0000000..87f827d
--- /dev/null
+++ b/WebKit/chromium/tests/ArenaTestHelpers.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ArenaTestHelpers_h
+#define ArenaTestHelpers_h
+
+#include "PODArena.h"
+#include <gtest/gtest.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+namespace ArenaTestHelpers {
+
+// An allocator for the PODArena which tracks the regions which have
+// been allocated.
+class TrackedAllocator : public PODArena::FastMallocAllocator {
+public:
+    static PassRefPtr<TrackedAllocator> create()
+    {
+        return adoptRef(new TrackedAllocator);
+    }
+
+    virtual void* allocate(size_t size)
+    {
+        void* result = PODArena::FastMallocAllocator::allocate(size);
+        m_allocatedRegions.append(result);
+        return result;
+    }
+
+    virtual void free(void* ptr)
+    {
+        size_t slot = m_allocatedRegions.find(ptr);
+        ASSERT_GE(slot, 0);
+        m_allocatedRegions.remove(slot);
+        PODArena::FastMallocAllocator::free(ptr);
+    }
+
+    bool isEmpty() const
+    {
+        return !numRegions();
+    }
+
+    int numRegions() const
+    {
+        return m_allocatedRegions.size();
+    }
+
+private:
+    TrackedAllocator() { }
+    Vector<void*> m_allocatedRegions;
+};
+
+} // namespace ArenaTestHelpers
+} // namespace WebCore
+
+#endif // ArenaTestHelpers_h
diff --git a/WebKit/chromium/tests/PODArenaTest.cpp b/WebKit/chromium/tests/PODArenaTest.cpp
new file mode 100644
index 0000000..c5b1ede
--- /dev/null
+++ b/WebKit/chromium/tests/PODArenaTest.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "PODArena.h"
+
+#include "ArenaTestHelpers.h"
+#include <algorithm>
+#include <gtest/gtest.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+using ArenaTestHelpers::TrackedAllocator;
+
+namespace {
+
+// A couple of simple structs to allocate.
+struct TestClass1 {
+    TestClass1()
+        : x(0), y(0), z(0), w(1) { }
+
+    float x, y, z, w;
+};
+
+struct TestClass2 {
+    TestClass2()
+        : a(1), b(2), c(3), d(4) { }
+
+    float a, b, c, d;
+};
+
+} // anonymous namespace
+
+class PODArenaTest : public testing::Test {
+};
+
+// Make sure the arena can successfully allocate from more than one
+// region.
+TEST_F(PODArenaTest, CanAllocateFromMoreThanOneRegion)
+{
+    RefPtr<TrackedAllocator> allocator = TrackedAllocator::create();
+    RefPtr<PODArena> arena = PODArena::create(allocator);
+    int numIterations = 10 * PODArena::DefaultChunkSize / sizeof(TestClass1);
+    for (int i = 0; i < numIterations; ++i)
+        arena->allocateObject<TestClass1>();
+    EXPECT_GT(allocator->numRegions(), 1);
+}
+
+// Make sure the arena frees all allocated regions during destruction.
+TEST_F(PODArenaTest, FreesAllAllocatedRegions)
+{
+    RefPtr<TrackedAllocator> allocator = TrackedAllocator::create();
+    {
+        RefPtr<PODArena> arena = PODArena::create(allocator);
+        for (int i = 0; i < 3; i++)
+            arena->allocateObject<TestClass1>();
+        EXPECT_GT(allocator->numRegions(), 0);
+    }
+    EXPECT_TRUE(allocator->isEmpty());
+}
+
+// Make sure the arena runs constructors of the objects allocated within.
+TEST_F(PODArenaTest, RunsConstructors)
+{
+    RefPtr<PODArena> arena = PODArena::create();
+    for (int i = 0; i < 10000; i++) {
+        TestClass1* tc1 = arena->allocateObject<TestClass1>();
+        EXPECT_EQ(0, tc1->x);
+        EXPECT_EQ(0, tc1->y);
+        EXPECT_EQ(0, tc1->z);
+        EXPECT_EQ(1, tc1->w);
+        TestClass2* tc2 = arena->allocateObject<TestClass2>();
+        EXPECT_EQ(1, tc2->a);
+        EXPECT_EQ(2, tc2->b);
+        EXPECT_EQ(3, tc2->c);
+        EXPECT_EQ(4, tc2->d);
+    }
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/tests/PODIntervalTreeTest.cpp b/WebKit/chromium/tests/PODIntervalTreeTest.cpp
new file mode 100644
index 0000000..3a8a245
--- /dev/null
+++ b/WebKit/chromium/tests/PODIntervalTreeTest.cpp
@@ -0,0 +1,323 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Tests for the interval tree class.
+
+#include "config.h"
+
+#include "PODIntervalTree.h"
+
+#include "Logging.h"
+#include "TreeTestHelpers.h"
+#include <gtest/gtest.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+using TreeTestHelpers::generateSeed;
+using TreeTestHelpers::initRandom;
+using TreeTestHelpers::nextRandom;
+
+inline String valueToString(const float& value)
+{
+    return String::number(value);
+}
+
+inline String valueToString(void* const& value)
+{
+    return String::format("0x%p", value);
+}
+
+TEST(PODIntervalTreeTest, TestInsertion)
+{
+    PODIntervalTree<float> tree;
+    tree.add(PODInterval<float>(2, 4));
+    ASSERT_TRUE(tree.checkInvariants());
+}
+
+TEST(PODIntervalTreeTest, TestInsertionAndQuery)
+{
+    PODIntervalTree<float> tree;
+    tree.add(PODInterval<float>(2, 4));
+    ASSERT_TRUE(tree.checkInvariants());
+    Vector<PODInterval<float> > result = tree.allOverlaps(PODInterval<float>(1, 3));
+    EXPECT_EQ(1U, result.size());
+    EXPECT_EQ(2, result[0].low());
+    EXPECT_EQ(4, result[0].high());
+}
+
+TEST(PODIntervalTreeTest, TestQueryAgainstZeroSizeInterval)
+{
+    PODIntervalTree<float> tree;
+    tree.add(PODInterval<float>(1, 2.5));
+    tree.add(PODInterval<float>(3.5, 5));
+    tree.add(PODInterval<float>(2, 4));
+    ASSERT_TRUE(tree.checkInvariants());
+    Vector<PODInterval<float> > result = tree.allOverlaps(PODInterval<float>(3, 3));
+    EXPECT_EQ(1U, result.size());
+    EXPECT_EQ(2, result[0].low());
+    EXPECT_EQ(4, result[0].high());
+}
+
+TEST(PODIntervalTreeTest, TestDuplicateElementInsertion)
+{
+    PODIntervalTree<float, int*> tree;
+    int tmp1 = 1;
+    int tmp2 = 2;
+    typedef PODIntervalTree<float, int*>::IntervalType IntervalType;
+    IntervalType interval1(1, 3, &tmp1);
+    IntervalType interval2(1, 3, &tmp2);
+    tree.add(interval1);
+    tree.add(interval2);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(interval1));
+    EXPECT_TRUE(tree.contains(interval2));
+    EXPECT_TRUE(tree.remove(interval1));
+    EXPECT_TRUE(tree.contains(interval2));
+    EXPECT_FALSE(tree.contains(interval1));
+    EXPECT_TRUE(tree.remove(interval2));
+    EXPECT_EQ(0, tree.size());
+}
+
+namespace {
+
+struct UserData1 {
+public:
+    UserData1()
+        : a(0), b(1) { }
+
+    float a;
+    int b;
+};
+
+inline String valueToString(const UserData1& value)
+{
+    return String("[UserData1 a=") + String::number(value.a) + " b=" + String::number(value.b) + "]";
+}
+
+} // anonymous namespace
+
+TEST(PODIntervalTreeTest, TestInsertionOfComplexUserData)
+{
+    PODIntervalTree<float, UserData1> tree;
+    UserData1 data1;
+    data1.a = 5;
+    data1.b = 6;
+    tree.add(tree.createInterval(2, 4, data1));
+    ASSERT_TRUE(tree.checkInvariants());
+}
+
+TEST(PODIntervalTreeTest, TestQueryingOfComplexUserData)
+{
+    PODIntervalTree<float, UserData1> tree;
+    UserData1 data1;
+    data1.a = 5;
+    data1.b = 6;
+    tree.add(tree.createInterval(2, 4, data1));
+    ASSERT_TRUE(tree.checkInvariants());
+    Vector<PODInterval<float, UserData1> > overlaps = tree.allOverlaps(tree.createInterval(3, 5, data1));
+    EXPECT_EQ(1U, overlaps.size());
+    EXPECT_EQ(5, overlaps[0].data().a);
+    EXPECT_EQ(6, overlaps[0].data().b);
+}
+
+namespace {
+
+class EndpointType1 {
+public:
+    explicit EndpointType1(int value)
+        : m_value(value) { }
+
+    int value() const { return m_value; }
+
+    bool operator<(const EndpointType1& other) const { return m_value < other.m_value; }
+    bool operator==(const EndpointType1& other) const { return m_value == other.m_value; }
+
+private:
+    int m_value;
+    // These operators should not be called by the interval tree.
+    bool operator>(const EndpointType1& other);
+    bool operator<=(const EndpointType1& other);
+    bool operator>=(const EndpointType1& other);
+    bool operator!=(const EndpointType1& other);
+};
+
+inline String valueToString(const EndpointType1& value)
+{
+    return String("[EndpointType1 value=") + String::number(value.value()) + "]";
+}
+
+} // anonymous namespace
+
+TEST(PODIntervalTreeTest, TestTreeDoesNotRequireMostOperators)
+{
+    PODIntervalTree<EndpointType1> tree;
+    tree.add(tree.createInterval(EndpointType1(1), EndpointType1(2)));
+    ASSERT_TRUE(tree.checkInvariants());
+}
+
+// Uncomment to debug a failure of the insertion and deletion test.
+// #define DEBUG_INSERTION_AND_DELETION_TEST
+
+namespace {
+
+void InsertionAndDeletionTest(int32_t seed, int treeSize)
+{
+    initRandom(seed);
+    int maximumValue = treeSize;
+    // Build the tree
+    PODIntervalTree<int> tree;
+    Vector<PODInterval<int> > addedElements;
+    Vector<PODInterval<int> > removedElements;
+    for (int i = 0; i < treeSize; i++) {
+        int left = nextRandom(maximumValue);
+        int length = nextRandom(maximumValue);
+        PODInterval<int> interval(left, left + length);
+        tree.add(interval);
+#ifdef DEBUG_INSERTION_AND_DELETION_TEST
+        LOG_ERROR("*** Adding element %s", valueToString(interval).ascii().data());
+#endif
+        addedElements.append(interval);
+    }
+    // Churn the tree's contents.
+    // First remove half of the elements in random order.
+    for (int i = 0; i < treeSize / 2; i++) {
+        int index = nextRandom(addedElements.size());
+#ifdef DEBUG_INSERTION_AND_DELETION_TEST
+        LOG_ERROR("*** Removing element %s", valueToString(addedElements[index]).ascii().data());
+#endif
+        ASSERT_TRUE(tree.contains(addedElements[index])) << "Test failed for seed " << seed;
+        tree.remove(addedElements[index]);
+        removedElements.append(addedElements[index]);
+        addedElements.remove(index);
+        ASSERT_TRUE(tree.checkInvariants()) << "Test failed for seed " << seed;
+    }
+    // Now randomly add or remove elements.
+    for (int i = 0; i < 2 * treeSize; i++) {
+        bool add = false;
+        if (!addedElements.size())
+            add = true;
+        else if (!removedElements.size())
+            add = false;
+        else
+            add = (nextRandom(2) == 1);
+        if (add) {
+            int index = nextRandom(removedElements.size());
+#ifdef DEBUG_INSERTION_AND_DELETION_TEST
+            LOG_ERROR("*** Adding element %s", valueToString(removedElements[index]).ascii().data());
+#endif
+            tree.add(removedElements[index]);
+            addedElements.append(removedElements[index]);
+            removedElements.remove(index);
+        } else {
+            int index = nextRandom(addedElements.size());
+#ifdef DEBUG_INSERTION_AND_DELETION_TEST
+            LOG_ERROR("*** Removing element %s", valueToString(addedElements[index]).ascii().data());
+#endif
+            ASSERT_TRUE(tree.contains(addedElements[index])) << "Test failed for seed " << seed;
+            ASSERT_TRUE(tree.remove(addedElements[index])) << "Test failed for seed " << seed;
+            removedElements.append(addedElements[index]);
+            addedElements.remove(index);
+        }
+        ASSERT_TRUE(tree.checkInvariants()) << "Test failed for seed " << seed;
+    }
+}
+
+} // anonymous namespace
+
+TEST(PODIntervalTreeTest, RandomDeletionAndInsertionRegressionTest1)
+{
+    InsertionAndDeletionTest(13972, 100);
+}
+
+TEST(PODIntervalTreeTest, RandomDeletionAndInsertionRegressionTest2)
+{
+    InsertionAndDeletionTest(1283382113, 10);
+}
+
+TEST(PODIntervalTreeTest, RandomDeletionAndInsertionRegressionTest3)
+{
+    // This is the sequence of insertions and deletions that triggered
+    // the failure in RandomDeletionAndInsertionRegressionTest2.
+    PODIntervalTree<int> tree;
+    tree.add(tree.createInterval(0, 5));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(4, 5));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(8, 9));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(1, 4));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(3, 5));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(4, 12));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(0, 2));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(0, 2));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(9, 13));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(0, 1));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(0, 2));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(9, 13));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(0, 2));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(0, 1));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(4, 5));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(4, 12));
+    ASSERT_TRUE(tree.checkInvariants());
+}
+
+TEST(PODIntervalTreeTest, RandomDeletionAndInsertionRegressionTest4)
+{
+    // Even further reduced test case for RandomDeletionAndInsertionRegressionTest3.
+    PODIntervalTree<int> tree;
+    tree.add(tree.createInterval(0, 5));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(8, 9));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(1, 4));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(3, 5));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(tree.createInterval(4, 12));
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(tree.createInterval(4, 12));
+    ASSERT_TRUE(tree.checkInvariants());
+}
+
+TEST(PODIntervalTreeTest, TestRandomDeletionAndInsertion)
+{
+    InsertionAndDeletionTest(generateSeed(), 1000);
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/tests/PODRedBlackTreeTest.cpp b/WebKit/chromium/tests/PODRedBlackTreeTest.cpp
new file mode 100644
index 0000000..0cc10e7
--- /dev/null
+++ b/WebKit/chromium/tests/PODRedBlackTreeTest.cpp
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Tests for the red-black tree class.
+
+#include "config.h"
+
+#include "PODRedBlackTree.h"
+
+#include "ArenaTestHelpers.h"
+#include "TreeTestHelpers.h"
+#include <gtest/gtest.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+using ArenaTestHelpers::TrackedAllocator;
+using TreeTestHelpers::generateSeed;
+using TreeTestHelpers::initRandom;
+using TreeTestHelpers::nextRandom;
+
+TEST(PODRedBlackTreeTest, TestTreeAllocatesFromArena)
+{
+    RefPtr<TrackedAllocator> allocator = TrackedAllocator::create();
+    {
+        RefPtr<PODArena> arena = PODArena::create(allocator);
+        PODRedBlackTree<int> tree(arena);
+        int numAdditions = 2 * PODArena::DefaultChunkSize / sizeof(int);
+        for (int i = 0; i < numAdditions; ++i)
+            tree.add(i);
+        EXPECT_GT(allocator->numRegions(), 1);
+    }
+    EXPECT_EQ(allocator->numRegions(), 0);
+}
+
+TEST(PODRedBlackTreeTest, TestSingleElementInsertion)
+{
+    PODRedBlackTree<int> tree;
+    tree.add(5);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(5));
+}
+
+TEST(PODRedBlackTreeTest, TestMultipleElementInsertion)
+{
+    PODRedBlackTree<int> tree;
+    tree.add(4);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(4));
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(3));
+    tree.add(5);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(5));
+    EXPECT_TRUE(tree.contains(4));
+    EXPECT_TRUE(tree.contains(3));
+}
+
+TEST(PODRedBlackTreeTest, TestDuplicateElementInsertion)
+{
+    PODRedBlackTree<int> tree;
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_EQ(3, tree.size());
+    EXPECT_TRUE(tree.contains(3));
+}
+
+TEST(PODRedBlackTreeTest, TestSingleElementInsertionAndDeletion)
+{
+    PODRedBlackTree<int> tree;
+    tree.add(5);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(5));
+    tree.remove(5);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_FALSE(tree.contains(5));
+}
+
+TEST(PODRedBlackTreeTest, TestMultipleElementInsertionAndDeletion)
+{
+    PODRedBlackTree<int> tree;
+    tree.add(4);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(4));
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(3));
+    tree.add(5);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(5));
+    EXPECT_TRUE(tree.contains(4));
+    EXPECT_TRUE(tree.contains(3));
+    tree.remove(4);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(3));
+    EXPECT_FALSE(tree.contains(4));
+    EXPECT_TRUE(tree.contains(5));
+    tree.remove(5);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_TRUE(tree.contains(3));
+    EXPECT_FALSE(tree.contains(4));
+    EXPECT_FALSE(tree.contains(5));
+    EXPECT_EQ(1, tree.size());
+}
+
+TEST(PODRedBlackTreeTest, TestDuplicateElementInsertionAndDeletion)
+{
+    PODRedBlackTree<int> tree;
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_EQ(3, tree.size());
+    EXPECT_TRUE(tree.contains(3));
+    tree.remove(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.remove(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_EQ(1, tree.size());
+    EXPECT_TRUE(tree.contains(3));
+    tree.remove(3);
+    ASSERT_TRUE(tree.checkInvariants());
+    EXPECT_EQ(0, tree.size());
+    EXPECT_FALSE(tree.contains(3));
+}
+
+TEST(PODRedBlackTreeTest, FailingInsertionRegressionTest1)
+{
+    // These numbers came from a previously-failing randomized test run.
+    PODRedBlackTree<int> tree;
+    tree.add(5113);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(4517);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(3373);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(9307);
+    ASSERT_TRUE(tree.checkInvariants());
+    tree.add(7077);
+    ASSERT_TRUE(tree.checkInvariants());
+}
+
+namespace {
+void InsertionAndDeletionTest(const int32_t seed, const int treeSize)
+{
+    initRandom(seed);
+    const int maximumValue = treeSize;
+    // Build the tree.
+    PODRedBlackTree<int> tree;
+    Vector<int> values;
+    for (int i = 0; i < treeSize; i++) {
+        int value = nextRandom(maximumValue);
+        tree.add(value);
+        ASSERT_TRUE(tree.checkInvariants()) << "Test failed for seed " << seed;
+        values.append(value);
+    }
+    // Churn the tree's contents.
+    for (int i = 0; i < treeSize; i++) {
+        // Pick a random value to remove.
+        int index = nextRandom(treeSize);
+        int value = values[index];
+        // Remove this value.
+        tree.remove(value);
+        ASSERT_TRUE(tree.checkInvariants()) << "Test failed for seed " << seed;
+        // Replace it with a new one.
+        value = nextRandom(maximumValue);
+        values[index] = value;
+        tree.add(value);
+        ASSERT_TRUE(tree.checkInvariants()) << "Test failed for seed " << seed;
+    }
+}
+} // anonymous namespace
+
+TEST(PODRedBlackTreeTest, RandomDeletionAndInsertionRegressionTest1)
+{
+    InsertionAndDeletionTest(12311, 100);
+}
+
+TEST(PODRedBlackTreeTest, TestRandomDeletionAndInsertion)
+{
+    InsertionAndDeletionTest(generateSeed(), 100);
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/tests/TreeTestHelpers.cpp b/WebKit/chromium/tests/TreeTestHelpers.cpp
new file mode 100644
index 0000000..103b871
--- /dev/null
+++ b/WebKit/chromium/tests/TreeTestHelpers.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "TreeTestHelpers.h"
+
+#include <cstdlib>
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+namespace TreeTestHelpers {
+
+int32_t generateSeed()
+{
+    // A seed of 1 has the special behavior of resetting the random
+    // number generator. Assume that if we call this routine that we
+    // don't want this behavior.
+    int32_t seed;
+    do {
+        seed = static_cast<int32_t>(currentTime());
+    } while (seed <= 1);
+    return seed;
+}
+
+void initRandom(const int32_t seed)
+{
+    srand(seed);
+}
+
+int32_t nextRandom(const int32_t maximumValue)
+{
+    // rand_r is not available on Windows
+    return rand() % maximumValue;
+}
+
+} // namespace TreeTestHelpers
+} // namespace WebCore
diff --git a/WebKit/chromium/tests/TreeTestHelpers.h b/WebKit/chromium/tests/TreeTestHelpers.h
new file mode 100644
index 0000000..af07b2a
--- /dev/null
+++ b/WebKit/chromium/tests/TreeTestHelpers.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Simple pseudorandom number generator helper functions, used by the
+// red-black and interval tree tests.
+//
+// These are **not** thread safe!
+
+#ifndef TreeTestHelpers_h
+#define TreeTestHelpers_h
+
+#include <stdint.h>
+
+namespace WebCore {
+namespace TreeTestHelpers {
+
+// Generates a seed value to be passed to initRandom().
+int32_t generateSeed();
+
+// Initializes the pseudo-random number generator with a specific seed.
+void initRandom(const int32_t seed);
+
+// Produces the next pseudo-random number in the sequence, in the
+// range from [0..maximumValue). Negative numbers are not allowed and will
+// produce undefined results.
+int32_t nextRandom(const int32_t maximumValue);
+
+} // namespace TreeTestHelpers
+} // namespace WebCore
+
+#endif // TreeTestHelpers_h