Merge webkit.org at r55033 : Initial merge by git

Change-Id: I98a4af828067cc243ec3dc5e5826154dd88074b5

37 files changed, 802 insertions, 244 deletions

diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
index 9cd3644..245cd9e 100644
--- a/WebKit/chromium/ChangeLog
+++ b/WebKit/chromium/ChangeLog
@@ -1,3 +1,277 @@
+2010-02-19  James Hawkins  <jhawkins@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Use the m_suggestionsPopupClient pointer to refer to the
+        popup client, as the Autocomplete popup might not be the current
+        popup.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35172
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::autocompleteHandleKeyEvent):
+        (WebKit::WebViewImpl::refreshSuggestionsPopup):
+
+2010-02-19  James Hawkins  <jhawkins@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Rename EditorClientImpl::onAutofillSuggestionAccepted to
+        onAutocompleteSuggestionAccepted to better match the purpose of the
+        function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35171
+
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::onAutocompleteSuggestionAccepted):
+        * src/EditorClientImpl.h:
+        * src/SuggestionsPopupMenuClient.cpp:
+        (WebKit::SuggestionsPopupMenuClient::valueChanged):
+
+2010-02-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add an isImageBlocked bool to the WebContextMenuData struct.
+        https://bugs.webkit.org/show_bug.cgi?id=35136
+        
+        This lets us properly enable/disable the "Copy Image" context menu entry
+        (and, in the future, maybe add a "Load Image" function).
+
+        * public/WebContextMenuData.h:
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+
+2010-02-19  Marcus Bulach  <bulach@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Fixes GeolocationServiceBridgeImpl::stopUpdating (it can be called multiple times).
+
+        * src/GeolocationServiceBridgeChromium.cpp:
+        (WebKit::GeolocationServiceBridgeImpl::stopUpdating):
+
+2010-02-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Chromium build fix: reverting r54997 and r54998.
+
+        * DEPS:
+
+2010-02-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Chromium tests fix: update devtools code to match new
+        web inspector object proxy format.
+
+        * src/js/DebuggerAgent.js:
+        (devtools.DebuggerAgent.prototype.formatCallFrame_):
+        (devtools.DebuggerAgent.formatObjectProxy_):
+
+2010-02-12  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed. Fix Chromium build.
+
+        * DEPS: Bump Google URL revision to 123.
+
+2010-02-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't truncate long lines when evaluating expressions on a breakpoint.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35102
+
+        * src/js/DebuggerAgent.js:
+
+2010-02-18  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Adam Barth.
+
+        Exposing the title in WebDocument.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35058
+
+        * public/WebDocument.h:
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::title):
+
+2010-02-17  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin, Darin Fisher, Simon Hausmann.
+
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::detachedFromParent3):
+        (WebKit::FrameLoaderClientImpl::didTransferChildFrameToNewDocument):
+        Since Chromium's WebFrameClient is destroyed once a window is closed,
+        if Frame moves between Pages, the client of corresponding WebFrame
+        should be replaced as well.
+
+        * src/FrameLoaderClientImpl.h:
+        * src/WebFrameImpl.h:
+        (WebKit::WebFrameImpl::setClient):
+
+2010-02-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] expose cache-bypass flag in reload() API
+        https://bugs.webkit.org/show_bug.cgi?id=34969
+
+        This flag is used to force a reload to ignore caches.
+        (Aka "shift-reload".)
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::reload):
+        * src/WebFrameImpl.h:
+
+2010-02-17  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces new Icon loading interface in order to support
+        asynchronous loading.
+        https://bugs.webkit.org/show_bug.cgi?id=32054
+
+        Add an empty implementation of ChromeClient::iconForFiles().
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::iconForFiles):
+        * src/ChromeClientImpl.h:
+
+2010-02-17  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Refactor texImage2D and texSubImage2D taking Image to use common code
+        https://bugs.webkit.org/show_bug.cgi?id=34458
+
+        Merged the Safari and Chromium code which extracts the data from
+        Image objects into common entry points on GraphicsContext3D. This
+        immediately fixes the following three problems:
+          - Chromium not implementing texSubImage2D taking Image.
+          - Safari not obeying the flipY parameter to texImage2D or
+            texSubImage2D taking Image.
+          - Safari not obeying the premultipyAlpha parameter to texImage2D
+            or texSubImage2D taking Image.
+        Added new test verifying the behavior of texImage2D and
+        texSubImage2D and the flipY parameter. The premultiplyAlpha
+        parameter can not be tested yet as the implementation is not yet
+        spec compliant. This will be fixed in a follow-on bug.
+
+        Ran all WebGL demos in demo repository on Safari and Chromium;
+        textures are now the right way up in both browsers, and
+        transparent textures in Particles demo now look correct in Safari.
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2010-02-17  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Bug 34900: Implement accelerated compositing for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34900
+
+        * features.gypi: Added WTF_USE_ACCELERATED_COMPOSITING flag.
+
+2010-02-17  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Remove the obsolete chromium interface for handling DownloadURL.
+        https://bugs.webkit.org/show_bug.cgi?id=34982
+
+        * public/WebDragData.h:
+        * src/WebDragData.cpp:
+
+2010-02-16  James Hawkins  <jhawkins@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Remove calls to releaseRef when passing PassRefPtrs to base
+        classes.  releaseRef releases the original pointer without decreasing
+        the reference count, and the base class constructor increases the
+        reference count, leading to a leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35000
+
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::WebDocument):
+        * src/WebElement.cpp:
+        (WebKit::WebElement::WebElement):
+        * src/WebFormElement.cpp:
+        (WebKit::WebFormElement::WebFormElement):
+        * src/WebInputElement.cpp:
+        (WebKit::WebInputElement::WebInputElement):
+
+2010-02-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Fix StorageNamespaceProxy::copy() for test shell
+        https://bugs.webkit.org/show_bug.cgi?id=34949
+
+        Chromium passes back NULL when you call WebStorageNamespace::proxy()
+        but TestShell returns a valid object.  Both need to work via
+        the WebStorageNamespace.
+
+        * src/StorageNamespaceProxy.cpp:
+        (WebCore::StorageNamespaceProxy::copy):
+
+2010-02-14  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Add support for the showDebugBorders setting to Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34906
+
+        * public/WebSettings.h: Add declaration for setShowDebugBorders
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setShowDebugBorders): Add method implementation
+        * src/WebSettingsImpl.h: Added declaration for setShowDebugBorders
+
+2010-02-11  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Introduce WebCookieJar, and provide for a frame specific cookie jar.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34878
+
+        * WebKit.gyp:
+        * public/WebCookieJar.h: Added.
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::cookieJar):
+        * public/WebKitClient.h:
+        (WebKit::WebKitClient::cookieJar):
+        (WebKit::WebKitClient::setCookies):
+        (WebKit::WebKitClient::cookies):
+        (WebKit::WebKitClient::rawCookies):
+        (WebKit::WebKitClient::deleteCookie):
+        (WebKit::WebKitClient::cookiesEnabled):
+        * src/ChromiumBridge.cpp:
+        (WebCore::getCookieJar):
+        (WebCore::ChromiumBridge::setCookies):
+        (WebCore::ChromiumBridge::cookies):
+        (WebCore::ChromiumBridge::rawCookies):
+        (WebCore::ChromiumBridge::deleteCookie):
+        (WebCore::ChromiumBridge::cookiesEnabled):
+
+2010-02-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium: provide theme overrides for Chromium devtools on Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34856
+
+        * src/js/devTools.css:
+
 2010-02-12  Jeremy Orlow  <jorlow@chromium.org>
 
         Reviewed by Darin Fisher.
diff --git a/WebKit/chromium/WebKit.gyp b/WebKit/chromium/WebKit.gyp
index 4b0ad2b..0c76dd3 100644
--- a/WebKit/chromium/WebKit.gyp
+++ b/WebKit/chromium/WebKit.gyp
@@ -68,6 +68,7 @@
                 'WEBKIT_IMPLEMENTATION',
             ],
             'sources': [
+                'public/GeolocationServiceBridgeChromium.h',
                 'public/gtk/WebInputEventFactory.h',
                 'public/linux/WebFontRendering.h',
                 'public/linux/WebRenderTheme.h',
@@ -92,6 +93,7 @@
                 'public/WebConsoleMessage.h',
                 'public/WebContextMenuData.h',
                 'public/WebCookie.h',
+                'public/WebCookieJar.h',
                 'public/WebCrossOriginPreflightResultCache.h',
                 'public/WebCString.h',
                 'public/WebCursorInfo.h',
@@ -231,6 +233,7 @@
                 'src/EventListenerWrapper.h',
                 'src/FrameLoaderClientImpl.cpp',
                 'src/FrameLoaderClientImpl.h',
+                'src/GeolocationServiceBridgeChromium.cpp',		
                 'src/gtk/WebFontInfo.cpp',
                 'src/gtk/WebFontInfo.h',
                 'src/gtk/WebInputEventFactory.cpp',
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
index 6091b8f..0fc6516 100644
--- a/WebKit/chromium/features.gypi
+++ b/WebKit/chromium/features.gypi
@@ -68,6 +68,7 @@
         'ENABLE_VIDEO=1',
         'ENABLE_WEB_SOCKETS=1',
         'ENABLE_WORKERS=1',
+        'WTF_USE_ACCELERATED_COMPOSITING=0',
       ],
     },
     'feature_defines%': '<(feature_defines)',
diff --git a/WebKit/chromium/public/GeolocationServiceBridgeChromium.h b/WebKit/chromium/public/GeolocationServiceBridgeChromium.h
new file mode 100644
index 0000000..adca956
--- /dev/null
+++ b/WebKit/chromium/public/GeolocationServiceBridgeChromium.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationServiceBridgeChromium_h
+#define GeolocationServiceBridgeChromium_h
+
+namespace WebCore {
+class GeolocationServiceBridge;
+class GeolocationServiceChromium;
+}
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+
+// Provides a WebKit API called by the embedder.
+class WebGeolocationServiceBridge {
+public:
+    virtual void setIsAllowed(bool allowed) = 0;
+    virtual void setLastPosition(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed, long long timestamp) = 0;
+    virtual void setLastError(int errorCode, const WebString& message) = 0;
+};
+
+// Provides an embedder API called by WebKit.
+class WebGeolocationServiceInterface {
+public:
+    virtual void requestPermissionForFrame(int bridgeId, const WebURL& url) = 0;
+    virtual void startUpdating(int bridgeId, bool hasHighAccuracy) = 0;
+    virtual void stopUpdating(int bridgeId) = 0;
+    virtual void suspend(int bridgeId) = 0;
+    virtual void resume(int bridgeId) = 0;
+
+    // Attaches the GeolocationBridge to the embedder and returns its id, which
+    // should be used on subsequent calls for the methods above.
+    virtual int attachBridge(WebKit::WebGeolocationServiceBridge* geolocationServiceBridge) = 0;
+
+    // Dettaches the GeolocationService from the embedder.
+    virtual void dettachBridge(int bridgeId) = 0;
+};
+
+WebCore::GeolocationServiceBridge* createGeolocationServiceBridgeImpl(WebCore::GeolocationServiceChromium*);
+
+} // namespace WebKit
+
+#endif // GeolocationServiceBridgeChromium_h
diff --git a/WebKit/chromium/public/WebContextMenuData.h b/WebKit/chromium/public/WebContextMenuData.h
index 5d67046..384240d 100644
--- a/WebKit/chromium/public/WebContextMenuData.h
+++ b/WebKit/chromium/public/WebContextMenuData.h
@@ -63,6 +63,9 @@ struct WebContextMenuData {
     // The absolute URL of the image/video/audio that is in context.
     WebURL srcURL;
 
+    // Whether the image in context has been blocked.
+    bool isImageBlocked;
+
     // The absolute URL of the page in context.
     WebURL pageURL;
 
diff --git a/WebKit/chromium/public/WebCookieJar.h b/WebKit/chromium/public/WebCookieJar.h
new file mode 100644
index 0000000..df70341
--- /dev/null
+++ b/WebKit/chromium/public/WebCookieJar.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCookieJar_h
+#define WebCookieJar_h
+
+namespace WebKit {
+class WebString;
+class WebURL;
+struct WebCookie;
+template <typename T> class WebVector;
+
+class WebCookieJar {
+public:
+    virtual void setCookie(const WebURL&, const WebURL& firstPartyForCookies, const WebString& cookie) { }
+    virtual WebString cookies(const WebURL&, const WebURL& firstPartyForCookies) { return WebString(); }
+    virtual WebString cookieRequestHeaderFieldValue(const WebURL&, const WebURL& firstPartyForCookies) { return WebString(); }
+    virtual void rawCookies(const WebURL&, const WebURL& firstPartyForCookies, WebVector<WebCookie>&) { }
+    virtual void deleteCookie(const WebURL&, const WebString& cookieName) { }
+    virtual bool cookiesEnabled(const WebURL&, const WebURL& firstPartyForCookies) { return true; }
+
+protected:
+    ~WebCookieJar() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDocument.h b/WebKit/chromium/public/WebDocument.h
index e158c41..8964d3a 100644
--- a/WebKit/chromium/public/WebDocument.h
+++ b/WebKit/chromium/public/WebDocument.h
@@ -65,6 +65,7 @@ public:
     WEBKIT_API WebElement documentElement() const;
     WEBKIT_API WebElement body() const;
     WEBKIT_API WebElement head();
+    WEBKIT_API WebString title() const;
     WEBKIT_API WebNodeCollection all();
     WEBKIT_API WebURL completeURL(const WebString&) const;
     WEBKIT_API WebElement getElementById(const WebString& id) const;
diff --git a/WebKit/chromium/public/WebDragData.h b/WebKit/chromium/public/WebDragData.h
index 0b861c8..2979519 100644
--- a/WebKit/chromium/public/WebDragData.h
+++ b/WebKit/chromium/public/WebDragData.h
@@ -72,8 +72,6 @@ public:
     WEBKIT_API WebString urlTitle() const;
     WEBKIT_API void setURLTitle(const WebString&);
 
-    WEBKIT_API WebURL downloadURL() const;
-    WEBKIT_API void setDownloadURL(const WebURL&);
     WEBKIT_API WebString downloadMetadata() const;
     WEBKIT_API void setDownloadMetadata(const WebString&);
 
diff --git a/WebKit/chromium/public/WebFrame.h b/WebKit/chromium/public/WebFrame.h
index a56e6cb..f193b9e 100644
--- a/WebKit/chromium/public/WebFrame.h
+++ b/WebKit/chromium/public/WebFrame.h
@@ -241,7 +241,9 @@ public:
     // Navigation ----------------------------------------------------------
 
     // Reload the current document.
-    virtual void reload() = 0;
+    // True |ignoreCache| explicitly bypasses caches.
+    // False |ignoreCache| revalidates any existing cache entries.
+    virtual void reload(bool ignoreCache = false) = 0;
 
     // Load the given URL.
     virtual void loadRequest(const WebURLRequest&) = 0;
diff --git a/WebKit/chromium/public/WebFrameClient.h b/WebKit/chromium/public/WebFrameClient.h
index 4078151..ae2541a 100644
--- a/WebKit/chromium/public/WebFrameClient.h
+++ b/WebKit/chromium/public/WebFrameClient.h
@@ -38,6 +38,7 @@
 
 namespace WebKit {
 
+class WebCookieJar;
 class WebDataSource;
 class WebFormElement;
 class WebFrame;
@@ -74,6 +75,12 @@ public:
     // May return null.
     virtual WebMediaPlayer* createMediaPlayer(WebFrame*, WebMediaPlayerClient*) { return 0; }
 
+    
+    // Services ------------------------------------------------------------
+
+    // A frame specific cookie jar.  May return null.
+    virtual WebCookieJar* cookieJar() { return 0; }
+
 
     // General notifications -----------------------------------------------
 
diff --git a/WebKit/chromium/public/WebKitClient.h b/WebKit/chromium/public/WebKitClient.h
index fbaa218..c5a04b2 100644
--- a/WebKit/chromium/public/WebKitClient.h
+++ b/WebKit/chromium/public/WebKitClient.h
@@ -49,6 +49,7 @@ namespace WebKit {
 class WebApplicationCacheHost;
 class WebApplicationCacheHostClient;
 class WebClipboard;
+class WebCookieJar;
 class WebMessagePortChannel;
 class WebMimeRegistry;
 class WebPluginListBuilder;
@@ -75,6 +76,9 @@ public:
     // May return null on some platforms.
     virtual WebThemeEngine* themeEngine() { return 0; }
 
+    // May return null.
+    virtual WebCookieJar* cookieJar() { return 0; }
+
 
     // Application Cache --------------------------------------------
 
@@ -177,12 +181,12 @@ public:
 
     // Network -------------------------------------------------------------
 
-    virtual void setCookies(
-        const WebURL& url, const WebURL& firstPartyForCookies, const WebString& cookies) { }
-    virtual WebString cookies(const WebURL& url, const WebURL& firstPartyForCookies) { return WebString(); }
-    virtual bool rawCookies(const WebURL& url, const WebURL& firstPartyForCookies, WebVector<WebCookie>*) { return false; }
-    virtual void deleteCookie(const WebURL& url, const WebString& cookieName) { }
-    virtual bool cookiesEnabled(const WebURL& url, const WebURL& firstPartyForCookies) { return true; }
+    // These cookie methods are DEPRECATED in favor of cookieJar accessor.
+    virtual void setCookies(const WebURL&, const WebURL& firstPartyForCookies, const WebString& cookies) { }
+    virtual WebString cookies(const WebURL&, const WebURL& firstPartyForCookies) { return WebString(); }
+    virtual bool rawCookies(const WebURL&, const WebURL& firstPartyForCookies, WebVector<WebCookie>*) { return false; }
+    virtual void deleteCookie(const WebURL&, const WebString& cookieName) { }
+    virtual bool cookiesEnabled(const WebURL&, const WebURL& firstPartyForCookies) { return true; }
 
     // A suggestion to prefetch IP information for the given hostname.
     virtual void prefetchHostName(const WebString&) { }
diff --git a/WebKit/chromium/public/WebSettings.h b/WebKit/chromium/public/WebSettings.h
index d75ccde..d3a91d3 100644
--- a/WebKit/chromium/public/WebSettings.h
+++ b/WebKit/chromium/public/WebSettings.h
@@ -78,10 +78,12 @@ public:
     virtual void setShouldPaintCustomScrollbars(bool) = 0;
     virtual void setDatabasesEnabled(bool) = 0;
     virtual void setAllowUniversalAccessFromFileURLs(bool) = 0;
+    virtual void setAllowFileAccessFromFileURLs(bool) = 0;
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded() = 0;
     virtual void setOfflineWebApplicationCacheEnabled(bool) = 0;
     virtual void setExperimentalWebGLEnabled(bool) = 0;
     virtual void setGeolocationEnabled(bool) = 0;
+    virtual void setShowDebugBorders(bool) = 0;
 
 protected:
     ~WebSettings() { }
diff --git a/WebKit/chromium/public/WebViewClient.h b/WebKit/chromium/public/WebViewClient.h
index 4d272bb..a2de115 100644
--- a/WebKit/chromium/public/WebViewClient.h
+++ b/WebKit/chromium/public/WebViewClient.h
@@ -46,6 +46,7 @@ class WebAccessibilityObject;
 class WebDragData;
 class WebFileChooserCompletion;
 class WebFrame;
+class WebGeolocationServiceInterface;
 class WebNode;
 class WebNotificationPresenter;
 class WebRange;
@@ -277,6 +278,11 @@ public:
     virtual void removeAutofillSuggestions(const WebString& name,
                                            const WebString& value) { }
 
+    // Geolocation ---------------------------------------------------------
+
+    // Access the embedder API for geolocation services.
+    virtual WebKit::WebGeolocationServiceInterface* getGeolocationService() { return 0; }
+
 protected:
     ~WebViewClient() { }
 };
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
index ce2f00c..6e5bfc2 100644
--- a/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -43,6 +43,10 @@
 #include "FloatRect.h"
 #include "FrameLoadRequest.h"
 #include "FrameView.h"
+#include "Geolocation.h"
+#include "GeolocationService.h"
+#include "GeolocationServiceBridgeChromium.h"
+#include "GeolocationServiceChromium.h"
 #include "HitTestResult.h"
 #include "IntRect.h"
 #include "Node.h"
@@ -576,6 +580,11 @@ void ChromeClientImpl::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileCh
     chooserCompletion->didChooseFile(WebVector<WebString>());
 }
 
+void ChromeClientImpl::iconForFiles(const Vector<WebCore::String>&, PassRefPtr<WebCore::FileChooser>)
+{
+    notImplemented();
+}
+
 void ChromeClientImpl::popupOpened(PopupContainer* popupContainer,
                                    const IntRect& bounds,
                                    bool activatable,
@@ -674,4 +683,10 @@ NotificationPresenter* ChromeClientImpl::notificationPresenter() const
 }
 #endif
 
+void ChromeClientImpl::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
+{
+    GeolocationServiceChromium* geolocationService = reinterpret_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
+    m_webView->client()->getGeolocationService()->requestPermissionForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
+}
+
 } // namespace WebKit
diff --git a/WebKit/chromium/src/ChromeClientImpl.h b/WebKit/chromium/src/ChromeClientImpl.h
index 9e8c2e3..3a4035b 100644
--- a/WebKit/chromium/src/ChromeClientImpl.h
+++ b/WebKit/chromium/src/ChromeClientImpl.h
@@ -121,9 +121,9 @@ public:
 #if ENABLE(NOTIFICATIONS)
     virtual WebCore::NotificationPresenter* notificationPresenter() const;
 #endif
-    virtual void requestGeolocationPermissionForFrame(
-        WebCore::Frame*, WebCore::Geolocation*) { }
+    virtual void requestGeolocationPermissionForFrame(WebCore::Frame*, WebCore::Geolocation*);
     virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
+    virtual void iconForFiles(const Vector<WebCore::String>&, PassRefPtr<WebCore::FileChooser>);
     virtual bool setCursor(WebCore::PlatformCursorHandle) { return false; }
     virtual void formStateDidChange(const WebCore::Node*);
     virtual PassOwnPtr<WebCore::HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
index 0fd0825..e04226e 100644
--- a/WebKit/chromium/src/ChromiumBridge.cpp
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -37,6 +37,7 @@
 #include "ChromeClientImpl.h"
 #include "WebClipboard.h"
 #include "WebCookie.h"
+#include "WebCookieJar.h"
 #include "WebCursorInfo.h"
 #include "WebData.h"
 #include "WebFrameClient.h"
@@ -73,6 +74,7 @@
 #include "BitmapImage.h"
 #include "Cookie.h"
 #include "FrameView.h"
+#include "GeolocationServiceBridgeChromium.h"
 #include "GraphicsContext.h"
 #include "KURL.h"
 #include "NotImplemented.h"
@@ -112,6 +114,17 @@ static WebWidgetClient* toWebWidgetClient(Widget* widget)
     return chromeClientImpl->webView()->client();
 }
 
+static WebCookieJar* getCookieJar(const Document* document)
+{
+    WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(document->frame());
+    if (!frameImpl || !frameImpl->client())
+        return 0;
+    WebCookieJar* cookieJar = frameImpl->client()->cookieJar();
+    if (!cookieJar)
+        cookieJar = webKitClient()->cookieJar();
+    return cookieJar;
+}
+
 // Clipboard ------------------------------------------------------------------
 
 bool ChromiumBridge::clipboardIsFormatAvailable(
@@ -173,25 +186,51 @@ void ChromiumBridge::clipboardWriteImage(NativeImagePtr image,
 
 // Cookies --------------------------------------------------------------------
 
-void ChromiumBridge::setCookies(const KURL& url,
-                                const KURL& firstPartyForCookies,
-                                const String& cookie)
+void ChromiumBridge::setCookies(const Document* document, const KURL& url,
+                                const String& value)
 {
-    webKitClient()->setCookies(url, firstPartyForCookies, cookie);
+    WebCookieJar* cookieJar = getCookieJar(document);
+    if (cookieJar)
+        cookieJar->setCookie(url, document->firstPartyForCookies(), value);
+    else
+        webKitClient()->setCookies(url, document->firstPartyForCookies(), value); // DEPRECATED
+}
+
+String ChromiumBridge::cookies(const Document* document, const KURL& url)
+{
+    String result;
+    WebCookieJar* cookieJar = getCookieJar(document);
+    if (cookieJar)
+        result = cookieJar->cookies(url, document->firstPartyForCookies());
+    else
+        result = webKitClient()->cookies(url, document->firstPartyForCookies()); // DEPRECATED
+    return result;
 }
 
-String ChromiumBridge::cookies(const KURL& url,
-                               const KURL& firstPartyForCookies)
+String ChromiumBridge::cookieRequestHeaderFieldValue(const Document* document,
+                                                     const KURL& url)
 {
-    return webKitClient()->cookies(url, firstPartyForCookies);
+    String result;
+    WebCookieJar* cookieJar = getCookieJar(document);
+    if (cookieJar)
+        result = cookieJar->cookieRequestHeaderFieldValue(url, document->firstPartyForCookies());
+    else {
+        // FIXME: This does not return http-only cookies
+        result = webKitClient()->cookies(url, document->firstPartyForCookies()); // DEPRECATED
+    }
+    return result;
 }
 
-bool ChromiumBridge::rawCookies(const KURL& url, const KURL& firstPartyForCookies, Vector<Cookie>* rawCookies)
+bool ChromiumBridge::rawCookies(const Document* document, const KURL& url, Vector<Cookie>& rawCookies)
 {
-    rawCookies->clear();
+    rawCookies.clear();
     WebVector<WebCookie> webCookies;
-    if (!webKitClient()->rawCookies(url, firstPartyForCookies, &webCookies))
-        return false;
+
+    WebCookieJar* cookieJar = getCookieJar(document);
+    if (cookieJar)
+        cookieJar->rawCookies(url, document->firstPartyForCookies(), webCookies);
+    else
+        webKitClient()->rawCookies(url, document->firstPartyForCookies(), &webCookies); // DEPRECATED
 
     for (unsigned i = 0; i < webCookies.size(); ++i) {
         const WebCookie& webCookie = webCookies[i];
@@ -203,20 +242,29 @@ bool ChromiumBridge::rawCookies(const KURL& url, const KURL& firstPartyForCookie
                       webCookie.httpOnly,
                       webCookie.secure,
                       webCookie.session);
-        rawCookies->append(cookie);
+        rawCookies.append(cookie);
     }
     return true;
 }
 
-void ChromiumBridge::deleteCookie(const KURL& url, const String& cookieName)
+void ChromiumBridge::deleteCookie(const Document* document, const KURL& url, const String& cookieName)
 {
-    webKitClient()->deleteCookie(url, cookieName);
+    WebCookieJar* cookieJar = getCookieJar(document);
+    if (cookieJar)
+        cookieJar->deleteCookie(url, cookieName);
+    else
+        webKitClient()->deleteCookie(url, cookieName); // DEPRECATED
 }
 
-bool ChromiumBridge::cookiesEnabled(const KURL& url,
-                                    const KURL& firstPartyForCookies)
+bool ChromiumBridge::cookiesEnabled(const Document* document)
 {
-    return webKitClient()->cookiesEnabled(url, firstPartyForCookies);
+    bool result;
+    WebCookieJar* cookieJar = getCookieJar(document);
+    if (cookieJar)
+        result = cookieJar->cookiesEnabled(document->cookieURL(), document->firstPartyForCookies());
+    else
+        result = webKitClient()->cookiesEnabled(document->cookieURL(), document->firstPartyForCookies()); // DEPRECATED
+    return result;
 }
 
 // DNS ------------------------------------------------------------------------
@@ -310,6 +358,13 @@ String ChromiumBridge::getFontFamilyForCharacters(const UChar* characters, size_
 }
 #endif
 
+// Geolocation ----------------------------------------------------------------
+
+GeolocationServiceBridge* ChromiumBridge::createGeolocationServiceBridge(GeolocationServiceChromium* geolocationServiceChromium)
+{
+    return createGeolocationServiceBridgeImpl(geolocationServiceChromium);
+}
+
 // HTML5 DB -------------------------------------------------------------------
 
 #if ENABLE(DATABASE)
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index 8472082..06a29ff 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -182,6 +182,10 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         if (mediaElement->hasAudio())
             data.mediaFlags |= WebContextMenuData::MediaHasAudio;
     }
+
+    data.isImageBlocked =
+        (data.mediaType == WebContextMenuData::MediaTypeImage) && !r.image();
+
     // If it's not a link, an image, a media element, or an image/media link,
     // show a selection menu or a more generic page menu.
     data.frameEncoding = selectedFrame->loader()->encoding();
diff --git a/WebKit/chromium/src/EditorClientImpl.cpp b/WebKit/chromium/src/EditorClientImpl.cpp
index d5bddc5..cfd8ec4 100644
--- a/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/WebKit/chromium/src/EditorClientImpl.cpp
@@ -784,7 +784,7 @@ void EditorClientImpl::cancelPendingAutofill()
     m_autofillTimer.stop();
 }
 
-void EditorClientImpl::onAutofillSuggestionAccepted(HTMLInputElement* textField)
+void EditorClientImpl::onAutocompleteSuggestionAccepted(HTMLInputElement* textField)
 {
     WebFrameImpl* webframe = WebFrameImpl::fromFrame(textField->document()->frame());
     if (!webframe)
diff --git a/WebKit/chromium/src/EditorClientImpl.h b/WebKit/chromium/src/EditorClientImpl.h
index fd08b4d..006b609 100644
--- a/WebKit/chromium/src/EditorClientImpl.h
+++ b/WebKit/chromium/src/EditorClientImpl.h
@@ -118,10 +118,10 @@ public:
     virtual bool showFormAutofillForNode(WebCore::Node*);
 
     // Notification that the text changed due to acceptance of a suggestion
-    // provided by an autofill popup.  Having a separate callback in this case
-    // is a simple way to break the cycle that would otherwise occur if
+    // provided by an Autocomplete popup.  Having a separate callback in this
+    // case is a simple way to break the cycle that would otherwise occur if
     // textDidChangeInTextField was called.
-    virtual void onAutofillSuggestionAccepted(WebCore::HTMLInputElement*);
+    virtual void onAutocompleteSuggestionAccepted(WebCore::HTMLInputElement*);
 
 private:
     void modifySelection(WebCore::Frame*, WebCore::KeyboardEvent*);
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index b984308..8fb267d 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -235,7 +235,7 @@ void FrameLoaderClientImpl::detachedFromParent3()
     
     // Stop communicating with the WebFrameClient at this point since we are no
     // longer associated with the Page.
-    m_webFrame->dropClient();
+    m_webFrame->setClient(0);
 }
 
 // This function is responsible for associating the |identifier| with a given
@@ -1332,6 +1332,19 @@ PassRefPtr<Frame> FrameLoaderClientImpl::createFrame(
     return m_webFrame->createChildFrame(frameRequest, ownerElement);
 }
 
+void FrameLoaderClientImpl::didTransferChildFrameToNewDocument()
+{
+    ASSERT(m_webFrame->frame()->ownerElement());
+
+    WebFrameImpl* newParent = static_cast<WebFrameImpl*>(m_webFrame->parent());
+    if (!newParent || !newParent->client())
+        return;
+
+    // Replace the client since the old client may be destroyed when the
+    // previous page is closed.
+    m_webFrame->setClient(newParent->client());
+}
+
 PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
     const IntSize& size, // FIXME: how do we use this?
     HTMLPlugInElement* element,
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.h b/WebKit/chromium/src/FrameLoaderClientImpl.h
index 901600c..8a39393 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -174,6 +174,7 @@ public:
         WebCore::HTMLFrameOwnerElement* ownerElement,
         const WebCore::String& referrer, bool allowsScrolling,
         int marginWidth, int marginHeight);
+    virtual void didTransferChildFrameToNewDocument();
     virtual PassRefPtr<WebCore::Widget> createPlugin(
         const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&,
         const Vector<WebCore::String>&, const Vector<WebCore::String>&,
diff --git a/WebKit/chromium/src/GeolocationServiceBridgeChromium.cpp b/WebKit/chromium/src/GeolocationServiceBridgeChromium.cpp
new file mode 100644
index 0000000..abbb9c6
--- /dev/null
+++ b/WebKit/chromium/src/GeolocationServiceBridgeChromium.cpp
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "GeolocationServiceBridgeChromium.h"
+
+#include "Chrome.h"
+#include "ChromeClientImpl.h"
+#include "Frame.h"
+#include "Geolocation.h"
+#include "GeolocationServiceChromium.h"
+#include "Geoposition.h"
+#include "Page.h"
+#include "PositionError.h"
+#include "PositionOptions.h"
+#include "WebFrame.h"
+#include "WebFrameImpl.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+
+#if ENABLE(GEOLOCATION)
+
+using WebCore::Coordinates;
+using WebCore::Frame;
+using WebCore::Geolocation;
+using WebCore::GeolocationServiceBridge;
+using WebCore::GeolocationServiceChromium;
+using WebCore::GeolocationServiceClient;
+using WebCore::Geoposition;
+using WebCore::PositionError;
+using WebCore::PositionOptions;
+using WebCore::String;
+
+namespace WebKit {
+
+class GeolocationServiceBridgeImpl : public GeolocationServiceBridge, public WebGeolocationServiceBridge {
+public:
+    explicit GeolocationServiceBridgeImpl(GeolocationServiceChromium*);
+    virtual ~GeolocationServiceBridgeImpl();
+
+    // GeolocationServiceBridge
+    virtual bool startUpdating(PositionOptions*);
+    virtual void stopUpdating();
+    virtual void suspend();
+    virtual void resume();
+    virtual int getBridgeId() const;
+
+    // WebGeolocationServiceBridge
+    virtual void setIsAllowed(bool allowed);
+    virtual void setLastPosition(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed, long long timestamp);
+    virtual void setLastError(int errorCode, const WebString& message);
+
+private:
+    WebViewClient* getWebViewClient();
+
+    // GeolocationServiceChromium owns us, we only have a pointer back to it.
+    GeolocationServiceChromium* m_GeolocationServiceChromium;
+    int m_bridgeId;
+};
+
+GeolocationServiceBridge* createGeolocationServiceBridgeImpl(GeolocationServiceChromium* geolocationServiceChromium)
+{
+    return new GeolocationServiceBridgeImpl(geolocationServiceChromium);
+}
+
+GeolocationServiceBridgeImpl::GeolocationServiceBridgeImpl(GeolocationServiceChromium* geolocationServiceChromium)
+    : m_GeolocationServiceChromium(geolocationServiceChromium)
+{
+    // We need to attach ourselves here: Geolocation calls requestPermissionForFrame()
+    // directly, and we need to be attached so that the embedder can call
+    // our setIsAllowed().
+    m_bridgeId = getWebViewClient()->getGeolocationService()->attachBridge(this);
+    ASSERT(m_bridgeId);
+}
+
+GeolocationServiceBridgeImpl::~GeolocationServiceBridgeImpl()
+{
+    WebKit::WebViewClient* webViewClient = getWebViewClient();
+    // Geolocation has an OwnPtr to us, and it's destroyed after the frame has
+    // been potentially disconnected. In this case, it calls stopUpdating()
+    // has been called and we have already dettached ourselves.
+    if (!webViewClient) {
+        ASSERT(!m_bridgeId);
+    } else if (m_bridgeId)
+        webViewClient->getGeolocationService()->dettachBridge(m_bridgeId);
+}
+
+bool GeolocationServiceBridgeImpl::startUpdating(PositionOptions* positionOptions)
+{
+    if (!m_bridgeId)
+        m_bridgeId = getWebViewClient()->getGeolocationService()->attachBridge(this);
+    getWebViewClient()->getGeolocationService()->startUpdating(m_bridgeId, positionOptions->enableHighAccuracy());
+    //// FIXME: this will trigger a permission request regardless.
+    //// Is it correct? confirm with andreip.
+    // positionChanged();
+    return true;
+}
+
+void GeolocationServiceBridgeImpl::stopUpdating()
+{
+    if (m_bridgeId) {
+        WebGeolocationServiceInterface* geolocationService = getWebViewClient()->getGeolocationService();
+        geolocationService->stopUpdating(m_bridgeId);
+        geolocationService->dettachBridge(m_bridgeId);
+        m_bridgeId = 0;
+    }
+}
+
+void GeolocationServiceBridgeImpl::suspend()
+{
+    getWebViewClient()->getGeolocationService()->suspend(m_bridgeId);
+}
+
+void GeolocationServiceBridgeImpl::resume()
+{
+    getWebViewClient()->getGeolocationService()->resume(m_bridgeId);
+}
+
+int GeolocationServiceBridgeImpl::getBridgeId() const
+{
+    return m_bridgeId;
+}
+
+void GeolocationServiceBridgeImpl::setIsAllowed(bool allowed)
+{
+    m_GeolocationServiceChromium->setIsAllowed(allowed);
+}
+
+void GeolocationServiceBridgeImpl::setLastPosition(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed, long long timestamp)
+{
+    m_GeolocationServiceChromium->setLastPosition(latitude, longitude, providesAltitude, altitude, accuracy, providesAltitudeAccuracy, altitudeAccuracy, providesHeading, heading, providesSpeed, speed, timestamp);
+}
+
+void GeolocationServiceBridgeImpl::setLastError(int errorCode, const WebString& message)
+{
+    m_GeolocationServiceChromium->setLastError(errorCode, message);
+}
+
+WebViewClient* GeolocationServiceBridgeImpl::getWebViewClient()
+{
+    Frame* frame = m_GeolocationServiceChromium->frame();
+    if (!frame || !frame->page())
+        return 0;
+    WebKit::ChromeClientImpl* chromeClientImpl = static_cast<WebKit::ChromeClientImpl*>(frame->page()->chrome()->client());
+    WebKit::WebViewClient* webViewClient = chromeClientImpl->webView()->client();
+    return webViewClient;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/WebKit/chromium/src/GraphicsContext3D.cpp b/WebKit/chromium/src/GraphicsContext3D.cpp
index 83574da..807a794 100644
--- a/WebKit/chromium/src/GraphicsContext3D.cpp
+++ b/WebKit/chromium/src/GraphicsContext3D.cpp
@@ -65,17 +65,12 @@
 #if PLATFORM(CG)
 #include "GraphicsContext.h"
 #include <CoreGraphics/CGContext.h>
-#include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGImage.h>
 #include <OpenGL/OpenGL.h>
 #else
 #define FLIP_FRAMEBUFFER_VERTICALLY
 #endif
 
-#if PLATFORM(SKIA)
-#include "NativeImageSkia.h"
-#endif
-
 #if OS(DARWIN)
 #define USE_TEXTURE_RECTANGLE_FOR_FRAMEBUFFER
 #endif
@@ -1878,178 +1873,17 @@ int GraphicsContext3D::texImage2D(unsigned target,
     return 0;
 }
 
-// Remove premultiplied alpha from color channels.
-// FIXME: this is lossy. Must retrieve original values from HTMLImageElement.
-static void unmultiplyAlpha(unsigned char* rgbaData, int numPixels)
-{
-    for (int j = 0; j < numPixels; j++) {
-        float b = rgbaData[4*j+0] / 255.0f;
-        float g = rgbaData[4*j+1] / 255.0f;
-        float r = rgbaData[4*j+2] / 255.0f;
-        float a = rgbaData[4*j+3] / 255.0f;
-        if (a > 0.0f) {
-            b /= a;
-            g /= a;
-            r /= a;
-            b = (b > 1.0f) ? 1.0f : b;
-            g = (g > 1.0f) ? 1.0f : g;
-            r = (r > 1.0f) ? 1.0f : r;
-            rgbaData[4*j+0] = (unsigned char) (b * 255.0f);
-            rgbaData[4*j+1] = (unsigned char) (g * 255.0f);
-            rgbaData[4*j+2] = (unsigned char) (r * 255.0f);
-        }
-    }
-}
-
-// FIXME: this must be changed to refer to the original image data
-// rather than unmultiplying the alpha channel.
-static int texImage2DHelper(unsigned target, unsigned level,
-                            int width, int height,
-                            int rowBytes,
-                            bool flipY,
-                            bool premultiplyAlpha,
-                            GLenum format,
-                            bool skipAlpha,
-                            unsigned char* pixels)
-{
-    ASSERT(format == GL_RGBA || format == GL_BGRA);
-    GLint internalFormat = GL_RGBA8;
-    if (skipAlpha) {
-        internalFormat = GL_RGB8;
-        // Ignore the alpha channel
-        premultiplyAlpha = true;
-    }
-    if (flipY) {
-        // Need to flip images vertically. To avoid making a copy of
-        // the entire image, we perform a ton of glTexSubImage2D
-        // calls. FIXME: should rethink this strategy for efficiency.
-        glTexImage2D(target, level, internalFormat,
-                     width,
-                     height,
-                     0,
-                     format,
-                     GL_UNSIGNED_BYTE,
-                     0);
-        unsigned char* row = 0;
-        bool allocatedRow = false;
-        if (!premultiplyAlpha) {
-            row = new unsigned char[rowBytes];
-            allocatedRow = true;
-        }
-        for (int i = 0; i < height; i++) {
-            if (premultiplyAlpha)
-                row = pixels + (rowBytes * i);
-            else {
-                memcpy(row, pixels + (rowBytes * i), rowBytes);
-                unmultiplyAlpha(row, width);
-            }
-            glTexSubImage2D(target, level, 0, height - i - 1,
-                            width, 1,
-                            format,
-                            GL_UNSIGNED_BYTE,
-                            row);
-        }
-        if (allocatedRow)
-            delete[] row;
-    } else {
-        // The pixels of cube maps' faces are defined with a top-down
-        // scanline ordering, unlike GL_TEXTURE_2D, so when uploading
-        // these, the above vertical flip is the wrong thing to do.
-        if (premultiplyAlpha)
-            glTexImage2D(target, level, internalFormat,
-                         width,
-                         height,
-                         0,
-                         format,
-                         GL_UNSIGNED_BYTE,
-                         pixels);
-        else {
-            glTexImage2D(target, level, internalFormat,
-                         width,
-                         height,
-                         0,
-                         format,
-                         GL_UNSIGNED_BYTE,
-                         0);
-            unsigned char* row = new unsigned char[rowBytes];
-            for (int i = 0; i < height; i++) {
-                memcpy(row, pixels + (rowBytes * i), rowBytes);
-                unmultiplyAlpha(row, width);
-                glTexSubImage2D(target, level, 0, i,
-                                width, 1,
-                                format,
-                                GL_UNSIGNED_BYTE,
-                                row);
-            }
-            delete[] row;
-        }
-    }
-    return 0;
-}
-
 int GraphicsContext3D::texImage2D(unsigned target, unsigned level, Image* image,
                                   bool flipY, bool premultiplyAlpha)
 {
-    ASSERT(image);
-
-    int res = -1;
-#if PLATFORM(SKIA)
-    NativeImageSkia* skiaImage = image->nativeImageForCurrentFrame();
-    if (!skiaImage) {
-        ASSERT_NOT_REACHED();
+    Vector<uint8_t> imageData;
+    unsigned int format, internalFormat;
+    if (!extractImageData(image, flipY, premultiplyAlpha, imageData, &format, &internalFormat))
         return -1;
-    }
-    SkBitmap::Config skiaConfig = skiaImage->config();
-    // FIXME: must support more image configurations.
-    if (skiaConfig != SkBitmap::kARGB_8888_Config) {
-        ASSERT_NOT_REACHED();
-        return -1;
-    }
-    SkBitmap& skiaImageRef = *skiaImage;
-    SkAutoLockPixels lock(skiaImageRef);
-    int width = skiaImage->width();
-    int height = skiaImage->height();
-    unsigned char* pixels =
-        reinterpret_cast<unsigned char*>(skiaImage->getPixels());
-    int rowBytes = skiaImage->rowBytes();
-    res = texImage2DHelper(target, level,
-                           width, height,
-                           rowBytes,
-                           flipY, premultiplyAlpha,
-                           GL_BGRA,
-                           false,
-                           pixels);
-#elif PLATFORM(CG)
-    CGImageRef cgImage = image->nativeImageForCurrentFrame();
-    if (!cgImage) {
-        ASSERT_NOT_REACHED();
-        return -1;
-    }
-    int width = CGImageGetWidth(cgImage);
-    int height = CGImageGetHeight(cgImage);
-    int rowBytes = width * 4;
-    CGImageAlphaInfo info = CGImageGetAlphaInfo(cgImage);
-    bool skipAlpha = (info == kCGImageAlphaNone
-                   || info == kCGImageAlphaNoneSkipLast
-                   || info == kCGImageAlphaNoneSkipFirst);
-    unsigned char* imageData = new unsigned char[height * rowBytes];
-    CGColorSpaceRef colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB);
-    CGContextRef tmpContext = CGBitmapContextCreate(imageData, width, height, 8, rowBytes,
-                                                    colorSpace,
-                                                    kCGImageAlphaPremultipliedLast);
-    CGColorSpaceRelease(colorSpace);
-    CGContextSetBlendMode(tmpContext, kCGBlendModeCopy);
-    CGContextDrawImage(tmpContext,
-                       CGRectMake(0, 0, static_cast<CGFloat>(width), static_cast<CGFloat>(height)),
-                       cgImage);
-    CGContextRelease(tmpContext);
-    res = texImage2DHelper(target, level, width, height, rowBytes,
-                           flipY, premultiplyAlpha, GL_RGBA, skipAlpha, imageData);
-    delete[] imageData;
-#else
-#error Must port to your platform
-#endif
-    return res;
+    glTexImage2D(target, level, internalFormat,
+                 image->width(), image->height(), 0,
+                 format, GL_UNSIGNED_BYTE, imageData.data());
+    return 0;
 }
 
 GL_SAME_METHOD_3(TexParameterf, texParameterf, unsigned, unsigned, float);
@@ -2078,9 +1912,14 @@ int GraphicsContext3D::texSubImage2D(unsigned target,
                                      bool flipY,
                                      bool premultiplyAlpha)
 {
-    // FIXME: implement.
-    notImplemented();
-    return -1;
+    Vector<uint8_t> imageData;
+    unsigned int format, internalFormat;
+    if (!extractImageData(image, flipY, premultiplyAlpha, imageData, &format, &internalFormat))
+        return -1;
+    glTexSubImage2D(target, level, xoffset, yoffset,
+                    image->width(), image->height(),
+                    format, GL_UNSIGNED_BYTE, imageData.data());
+    return 0;
 }
 
 GL_SAME_METHOD_2(Uniform1f, uniform1f, long, float)
diff --git a/WebKit/chromium/src/StorageNamespaceProxy.cpp b/WebKit/chromium/src/StorageNamespaceProxy.cpp
index 1be1967..3c87554 100644
--- a/WebKit/chromium/src/StorageNamespaceProxy.cpp
+++ b/WebKit/chromium/src/StorageNamespaceProxy.cpp
@@ -67,13 +67,14 @@ StorageNamespaceProxy::~StorageNamespaceProxy()
 PassRefPtr<StorageNamespace> StorageNamespaceProxy::copy()
 {
     ASSERT(m_storageType == SessionStorage);
-    // The WebViewClient knows what its session storage namespace id is but we
-    // do not.  Returning 0 here causes it to be fetched (via the WebViewClient)
-    // on its next use.  Note that it is WebViewClient::createView's
-    // responsibility to clone the session storage namespace id and that the
-    // only time copy() is called is directly after the createView call...which
-    // is why all of this is safe.
-    return 0;
+    WebKit::WebStorageNamespace* newNamespace = m_storageNamespace->copy();
+    // Some embedders hook into WebViewClient::createView to make the copy of
+    // session storage and then return the object lazily.  Other embedders
+    // choose to make the copy now and return a pointer immediately.  So handle
+    // both cases.
+    if (!newNamespace)
+        return 0;
+    return adoptRef(new StorageNamespaceProxy(newNamespace, m_storageType));
 }
 
 PassRefPtr<StorageArea> StorageNamespaceProxy::storageArea(PassRefPtr<SecurityOrigin> origin)
diff --git a/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp b/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp
index b4a77a3..aaf9036 100644
--- a/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp
+++ b/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp
@@ -65,7 +65,7 @@ void SuggestionsPopupMenuClient::valueChanged(unsigned listIndex, bool fireEvent
     EditorClientImpl* editor =
         static_cast<EditorClientImpl*>(webView->page()->editorClient());
     ASSERT(editor);
-    editor->onAutofillSuggestionAccepted(
+    editor->onAutocompleteSuggestionAccepted(
         static_cast<HTMLInputElement*>(m_textField.get()));
 }
 
diff --git a/WebKit/chromium/src/WebDocument.cpp b/WebKit/chromium/src/WebDocument.cpp
index 84f3004..2a91e22 100644
--- a/WebKit/chromium/src/WebDocument.cpp
+++ b/WebKit/chromium/src/WebDocument.cpp
@@ -53,7 +53,7 @@ using namespace WebCore;
 namespace WebKit {
 
 WebDocument::WebDocument(const PassRefPtr<Document>& elem)
-    : WebNode(elem.releaseRef())
+    : WebNode(elem)
 {
 }
 
@@ -98,6 +98,11 @@ WebElement WebDocument::head()
     return WebElement(unwrap<Document>()->head());
 }
 
+WebString WebDocument::title() const
+{
+    return WebString(constUnwrap<Document>()->title());
+}
+
 WebNodeCollection WebDocument::all()
 {
     return WebNodeCollection(unwrap<Document>()->all());
diff --git a/WebKit/chromium/src/WebDragData.cpp b/WebKit/chromium/src/WebDragData.cpp
index b18ab1b..2f476a7 100644
--- a/WebKit/chromium/src/WebDragData.cpp
+++ b/WebKit/chromium/src/WebDragData.cpp
@@ -88,18 +88,6 @@ void WebDragData::setURLTitle(const WebString& urlTitle)
     m_private->urlTitle = urlTitle;
 }
 
-WebURL WebDragData::downloadURL() const
-{
-    ASSERT(!isNull());
-    return m_private->downloadURL;
-}
-
-void WebDragData::setDownloadURL(const WebURL& downloadURL)
-{
-    ensureMutable();
-    m_private->downloadURL = downloadURL;
-}
-
 WebString WebDragData::downloadMetadata() const
 {
     ASSERT(!isNull());
diff --git a/WebKit/chromium/src/WebElement.cpp b/WebKit/chromium/src/WebElement.cpp
index d0a0862..6501771 100644
--- a/WebKit/chromium/src/WebElement.cpp
+++ b/WebKit/chromium/src/WebElement.cpp
@@ -39,7 +39,7 @@ using namespace WebCore;
 namespace WebKit {
 
 WebElement::WebElement(const WTF::PassRefPtr<WebCore::Element>& elem)
-    : WebNode(elem.releaseRef())
+    : WebNode(elem)
 {
 }
 
diff --git a/WebKit/chromium/src/WebFormElement.cpp b/WebKit/chromium/src/WebFormElement.cpp
index 5471608..0024892 100644
--- a/WebKit/chromium/src/WebFormElement.cpp
+++ b/WebKit/chromium/src/WebFormElement.cpp
@@ -47,7 +47,7 @@ class WebFormPrivate : public HTMLFormElement {
 };
 
 WebFormElement::WebFormElement(const WTF::PassRefPtr<HTMLFormElement>& e)
-    : WebElement(e.releaseRef())
+    : WebElement(e)
 {
 }
 
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
index 2f911f1..665f6a3 100644
--- a/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -713,12 +713,13 @@ bool WebFrameImpl::insertStyleText(
     return success;
 }
 
-void WebFrameImpl::reload()
+void WebFrameImpl::reload(bool ignoreCache)
 {
     m_frame->loader()->history()->saveDocumentAndScrollState();
 
     stopLoading();  // Make sure existing activity stops.
-    m_frame->loader()->reload();
+
+    m_frame->loader()->reload(ignoreCache);
 }
 
 void WebFrameImpl::loadRequest(const WebURLRequest& request)
diff --git a/WebKit/chromium/src/WebFrameImpl.h b/WebKit/chromium/src/WebFrameImpl.h
index ccba6d4..f23106c 100644
--- a/WebKit/chromium/src/WebFrameImpl.h
+++ b/WebKit/chromium/src/WebFrameImpl.h
@@ -103,7 +103,7 @@ public:
     virtual v8::Local<v8::Context> mainWorldScriptContext() const;
 #endif
     virtual bool insertStyleText(const WebString& css, const WebString& id);
-    virtual void reload();
+    virtual void reload(bool ignoreCache);
     virtual void loadRequest(const WebURLRequest&);
     virtual void loadHistoryItem(const WebHistoryItem&);
     virtual void loadData(
@@ -221,7 +221,7 @@ public:
     WebPasswordAutocompleteListener* getPasswordListener(WebCore::HTMLInputElement*);
 
     WebFrameClient* client() const { return m_client; }
-    void dropClient() { m_client = 0; }
+    void setClient(WebFrameClient* client) { m_client = client; }
 
     static void selectWordAroundPosition(WebCore::Frame*, WebCore::VisiblePosition);
 
diff --git a/WebKit/chromium/src/WebInputElement.cpp b/WebKit/chromium/src/WebInputElement.cpp
index 9fd317f..4ee1b93 100644
--- a/WebKit/chromium/src/WebInputElement.cpp
+++ b/WebKit/chromium/src/WebInputElement.cpp
@@ -41,7 +41,7 @@ using namespace WebCore;
 namespace WebKit {
 
 WebInputElement::WebInputElement(const WTF::PassRefPtr<HTMLInputElement>& elem)
-    : WebElement(elem.releaseRef())
+    : WebElement(elem)
 {
 }
 
diff --git a/WebKit/chromium/src/WebSettingsImpl.cpp b/WebKit/chromium/src/WebSettingsImpl.cpp
index 5cfbd4f..a680321 100644
--- a/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -236,6 +236,11 @@ void WebSettingsImpl::setAllowUniversalAccessFromFileURLs(bool allow)
     m_settings->setAllowUniversalAccessFromFileURLs(allow);
 }
 
+void WebSettingsImpl::setAllowFileAccessFromFileURLs(bool allow)
+{
+    m_settings->setAllowFileAccessFromFileURLs(allow);
+}
+
 void WebSettingsImpl::setTextDirectionSubmenuInclusionBehaviorNeverIncluded()
 {
     // FIXME: If you ever need more behaviors than this, then we should probably
@@ -254,6 +259,11 @@ void WebSettingsImpl::setExperimentalWebGLEnabled(bool enabled)
     m_settings->setWebGLEnabled(enabled);
 }
 
+void WebSettingsImpl::setShowDebugBorders(bool show)
+{
+    m_settings->setShowDebugBorders(show);
+}
+
 void WebSettingsImpl::setGeolocationEnabled(bool enabled)
 {
     m_settings->setGeolocationEnabled(enabled);
diff --git a/WebKit/chromium/src/WebSettingsImpl.h b/WebKit/chromium/src/WebSettingsImpl.h
index 3b69fe6..64ccab5 100644
--- a/WebKit/chromium/src/WebSettingsImpl.h
+++ b/WebKit/chromium/src/WebSettingsImpl.h
@@ -80,10 +80,12 @@ public:
     virtual void setShouldPaintCustomScrollbars(bool);
     virtual void setDatabasesEnabled(bool);
     virtual void setAllowUniversalAccessFromFileURLs(bool);
+    virtual void setAllowFileAccessFromFileURLs(bool);
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
     virtual void setOfflineWebApplicationCacheEnabled(bool);
     virtual void setExperimentalWebGLEnabled(bool);
     virtual void setGeolocationEnabled(bool);
+    virtual void setShowDebugBorders(bool);
 
 private:
     WebCore::Settings* m_settings;
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index ce03523..97665d4 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -540,11 +540,11 @@ bool WebViewImpl::autocompleteHandleKeyEvent(const WebKeyboardEvent& event)
         int selectedIndex = m_suggestionsPopup->selectedIndex();
         HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
         WebString name = inputElement->name();
-        WebString value = m_autocompletePopupClient->itemText(selectedIndex);
+        WebString value = m_suggestionsPopupClient->itemText(selectedIndex);
         m_client->removeAutofillSuggestions(name, value);
         // Update the entries in the currently showing popup to reflect the
         // deletion.
-        m_autocompletePopupClient->removeSuggestionAtIndex(selectedIndex);
+        m_suggestionsPopupClient->removeSuggestionAtIndex(selectedIndex);
         refreshSuggestionsPopup();
         return false;
     }
@@ -1871,7 +1871,7 @@ void WebViewImpl::refreshSuggestionsPopup()
     ASSERT(m_suggestionsPopupShowing);
 
     // Hide the popup if it has become empty.
-    if (!m_autocompletePopupClient->listSize()) {
+    if (!m_suggestionsPopupClient->listSize()) {
         hideSuggestionsPopup();
         return;
     }
diff --git a/WebKit/chromium/src/js/DebuggerAgent.js b/WebKit/chromium/src/js/DebuggerAgent.js
index 301620a..bb655c7 100644
--- a/WebKit/chromium/src/js/DebuggerAgent.js
+++ b/WebKit/chromium/src/js/DebuggerAgent.js
@@ -1053,7 +1053,7 @@ devtools.DebuggerAgent.prototype.formatCallFrame_ = function(stackFrame)
     for (var i = 0; i < stackFrame.scopes.length; i++) {
         var scope = stackFrame.scopes[i];
         scope.frameNumber = stackFrame.index;
-        var scopeObjectProxy = new WebInspector.ObjectProxy(0, scope, [], 0, "", true);
+        var scopeObjectProxy = new WebInspector.ObjectProxy(0, scope, [], "", true);
         scopeObjectProxy.isScope = true;
         switch(scope.type) {
             case ScopeType.Global:
@@ -1149,7 +1149,7 @@ devtools.DebuggerAgent.formatObjectProxy_ = function(v)
     } else
         description = "<unresolved ref: " + v.ref + ", type: " + v.type + ">";
 
-    var proxy = new WebInspector.ObjectProxy(0, v, [], 0, description, hasChildren);
+    var proxy = new WebInspector.ObjectProxy(0, v, [], description, hasChildren);
     proxy.type = v.type;
     proxy.isV8Ref = true;
     return proxy;
@@ -1364,7 +1364,8 @@ devtools.CallFrame.prototype.evaluate_ = function(expression, callback)
             "frame": this.id,
             "global": false,
             "disable_break": false,
-            "compactFormat": true
+            "compactFormat": true,
+            "maxStringLength": -1
         },
         function(response) {
             var result = {};
diff --git a/WebKit/chromium/src/js/devTools.css b/WebKit/chromium/src/js/devTools.css
index 1fa935f..bb33f72 100755
--- a/WebKit/chromium/src/js/devTools.css
+++ b/WebKit/chromium/src/js/devTools.css
@@ -13,8 +13,8 @@ body.attached #toolbar {
     padding-left: 0;
 }
 
-
 /* Chrome theme overrides */
+
 body.platform-windows #toolbar {
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(242, 247, 253)), to(rgb(223, 234, 248)));
 }
@@ -23,6 +23,21 @@ body.platform-windows.inactive #toolbar {
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(248, 248, 248)), to(rgb(237, 237, 237)));
 }
 
+body.detached.platform-mac-leopard #toolbar {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(175, 175, 175)), to(rgb(151, 151, 151))) !important;
+}
+
+body.detached.platform-mac-leopard.inactive #toolbar {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(221, 221, 221)), to(rgb(207, 207, 207))) !important;
+}
+
+body.detached.platform-mac-snowleopard #toolbar {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(189, 189, 189)), to(rgb(151, 151, 151))) !important;
+}
+
+body.detached.platform-mac-snowleopard.inactive #toolbar {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(215, 215, 215)), to(rgb(207, 207, 207))) !important;
+}
 
 /* Heap Profiler Styles */