Merge webkit.org at r50258 : Initial merge by git.

Change-Id: I1a9e1dc4ed654b69174ad52a4f031a07240f37b0

50 files changed, 1332 insertions, 347 deletions

diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index 63c888a..9104b89 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,553 @@
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController _requestExit]): 
+            New, call media element's exitFullscreen method.
+        (-[WebVideoFullscreenController requestExitFullscreenWithAnimation:]): 
+            Call mediaElement->exitFullscreen() after a delay as it turns around and calls
+            WebVideoFullscreenController:exitFullscreen.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h:
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindow resignFirstResponder]):
+            New, don't give up responder status.
+        (-[WebVideoFullscreenHUDWindow performKeyEquivalent:]):
+            New, block all command key events.
+        (-[WebVideoFullscreenHUDWindowController exitFullscreen:]):
+            Remember when we are in the process of exiting fullscreen, don't allow recursion.
+
+        * WebView/WebView.mm:
+        (-[WebView _exitFullscreen]):
+            Early return if fullscreen controller is nil.
+
+        * WebView/WebWindowAnimation.h: 
+            Correct comment about _window retain status.
+        * WebView/WebWindowAnimation.m:
+        (-[WebWindowScaleAnimation dealloc]):
+            Don't release _window, we never reatained it.
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Add counterValueForElement in WebFrame to call WebCore::counterValueForElement.
+
+        * Misc/WebCoreStatistics.h:
+        * Misc/WebCoreStatistics.mm:
+        (-[WebFrame counterValueForElement:]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for refactoring in the date code.
+
+        * WebView/WebView.mm:
+        (aeDescFromJSValue): Since we just want a number of milliseconds, do that
+        instead of something more complicated.
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move some WebView event handling code into its own file, WebViewEventHandling.mm
+
+        * WebView/WebView.mm:
+        (-[WebView _close]):
+        (-[WebView _selectedOrMainFrame]):
+        * WebView/WebViewEventHandling.mm: Added.
+        (-[WebView _closingEventHandling]):
+        (-[WebView _setMouseDownEvent:]):
+        (-[WebView mouseDown:]):
+        (-[WebView mouseUp:]):
+        (+[WebView _updateMouseoverWithEvent:]):
+        (-[WebView _updateMouseoverWithFakeEvent]):
+        (_updateMouseoverWithEvent:fakeEvent::if):
+        (-[WebView _stopAutoscrollTimer]):
+        (-[WebView _setToolTip:]):
+        * WebView/WebViewInternal.h:
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        * WebView/WebHTMLViewPrivate.h:
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _compositingLayersHostingView]):
+        Add a private method that returns the NSView used to host compositing layers.
+        
+2009-10-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix engineering builds in the mysterious future.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * WebView/WebFramePrivate.h:
+        * WebView/WebFrame.mm:
+        (-[WebFrame contextForWorldID:]):
+
+2009-10-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/7322847>
+        Pressing space bar key in full screen mode should pause movie but doesn't
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController keyDown:]):  New, toggle playback on space key.
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Play button action is now called togglePlaying.
+        (-[WebVideoFullscreenHUDWindowController togglePlaying:]): Rename from playingChanged.
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Build fix following bug #30696.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::getWindowNPObject):
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+        (WebKit::NetscapePluginInstanceProxy::construct):
+        (WebKit::NetscapePluginInstanceProxy::getProperty):
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+        (WebKit::NetscapePluginInstanceProxy::removeProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasMethod):
+        (WebKit::NetscapePluginInstanceProxy::enumerate):
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Update to incorporate support for IsolatedWorlds in JSC bindings.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _attachScriptDebugger]):
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        (-[WebFrame globalContext]):
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame evaluateWebScript:]):
+        * WebView/WebView.mm:
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+
+2009-10-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein & Simon Fraser.
+
+        <rdar://problem/7297717>
+        https://bugs.webkit.org/show_bug.cgi?id=30323
+        Play/pause button in full-screen video controller does not reflect current state
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController setMediaElement:WebCore::]): Register for QTMovieRateDidChangeNotification
+        (-[WebVideoFullscreenController rateChanged:]): Call HUD controller when rate changes.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h:
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController scheduleTimeUpdate]): Call updateRate so play button
+        reflects playback state.
+        (-[WebVideoFullscreenHUDWindowController updateRate]): New, set play button state according to
+        movie state.
+        (-[WebVideoFullscreenHUDWindowController playingChanged:]): Only call [self playing] once.
+
+2009-10-21  John Sullivan  <sullivan@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebView/WebDynamicScrollBarsView.h:
+        Corrected a couple of long-obsolete comments regarding Safari's use of this class.
+
+2009-10-20  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        <rdar://problem/7319749> REGRESSION(r49806): Contextual Menu items missing
+        https://bugs.webkit.org/show_bug.cgi?id=30568
+
+        Revert accidental change from r49806.
+
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::getCustomMenuFromDefaultItems):
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Removed WebSocket runtime settings.
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        WebSocket runtime configuration is supported by chromium/v8 only.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Update call to loadFrameRequest to match new parameters.
+
+        * WebView/WebPDFView.mm:
+        (-[WebPDFView PDFViewWillClickOnLink:withURL:]): Update call to loadFrameRequest.
+
+2009-10-19  David Kilzer  <ddkilzer@apple.com>
+
+        Documentation fix for -[NSObject(WebResourceLoadDelegate) webView:resource:willSendRequest:redirectResponse:fromDataSource:]
+
+        Reviewed by Dan Bernstein.
+
+        * WebView/WebResourceLoadDelegate.h: Prepended "webView:" to the
+        @method declaration of
+        -webView:resource:willSendRequest:redirectResponse:fromDataSource:
+        which was absent before r3953 and was missed during the great
+        documentation clean up of r4269.
+
+2009-10-19  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView saveAndSetNewPortStateForUpdate:]):
+
+2009-10-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Split assertions of conjunctions into separate statements or remove
+        redundant assertions.
+
+        * Plugins/Hosted/NetscapePluginHostProxy.mm:
+        (WebKit::NetscapePluginHostProxy::deadNameNotificationCallback):
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView setAttributeKeys:andValues:]):
+        (-[WebHostedNetscapePluginView _webPluginContainerCancelCheckIfAllowedToLoadRequest:]):
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView halt]):
+        (-[WebBaseNetscapePluginView resumeFromHalt]):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView saveAndSetNewPortStateForUpdate:]):
+        (-[WebNetscapePluginView _webPluginContainerCancelCheckIfAllowedToLoadRequest:]):
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::getCustomMenuFromDefaultItems):
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::checkGrammarOfString):
+        (WebEditorClient::checkTextOfParagraph):
+        * WebView/WebTextCompletionController.mm:
+        (-[WebTextCompletionController _reflectSelection]):
+
+2009-10-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7309062> Crashes in WebCore::DocumentLoader::isStopping below WebKit::NetscapePluginInstanceProxy::loadRequest.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::loadRequest): Null-check the DocumentLoader before deferencing it.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        <rdar://problem/7304575>
+        
+        * Plugins/WebBaseNetscapePluginView.h: Added new boolean ivar and -hasBeenHalted instance method.
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView halt]):Update _hasBeenHalted.
+        (-[WebBaseNetscapePluginView hasBeenHalted]): Added.
+        * WebView/WebView.mm:
+        (+[WebView _hasPluginForNodeBeenHalted:]): Checks to see if a plug-in node's been halted.
+        * WebView/WebViewPrivate.h: Added -_hasPluginForNodeBeenHalted method.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlson.
+
+        Small code cleanup
+        
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::halt): Just call -[WebBaseNetscapePluginView halt].
+        (WebHaltablePlugin::restart): Just call -[WebBaseNetscapePluginView resumeFromHalt]
+        (-[WebBaseNetscapePluginView halt]): 
+        (-[WebBaseNetscapePluginView resumeFromHalt]):
+        * WebView/WebView.mm:
+        (_pluginViewForNode): Added a check if a render is a widget. This prevents a later assertion.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlson.
+
+        Last part of:
+        <rdar://problem/7273354>
+
+        * WebView/WebView.mm: 
+        (_pluginViewForNode): Added with code extracted from _isNodeHaltedPlugin
+        (+[WebView _isNodeHaltedPlugin:]): Made this a class method.
+        (+[WebView _restartHaltedPluginForNode:]): Added. Restarts a plug-in
+        * WebView/WebViewPrivate.h: Added +_restartHaltedPluginForNode to header.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders.
+
+        <rdar://problem/7273354> 
+
+        * Plugins/WebBaseNetscapePluginView.h: Added _isHalted ivar and three new methods: -halt, -resumeFromHalt, and -isHalted
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::halt): Call -halt instead of -stop.  
+        (WebHaltablePlugin::restart):Call -resumeFromHalt instead of -start. 
+        (-[WebBaseNetscapePluginView halt]): Added. Stop the plug-in, update _isHalted.
+        (-[WebBaseNetscapePluginView resumeFromHalt]): Added. Start the plug-in, update _isHalted.
+        (-[WebBaseNetscapePluginView isHalted]): Added.
+        * WebView/WebView.mm:
+        (-[WebView _isNodeHaltedPlugin:]): Added. Queries a DOMNode to determine if it's a halted plug-in.
+        * WebView/WebViewPrivate.h: Added _isNodeHaltedPlugin.
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7306052> Fullscreen max/min volume buttons non-functional
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Set volume buttons target and action.
+        (-[WebVideoFullscreenHUDWindowController decrementVolume:]): New, decrement the volume by 10%.
+        (-[WebVideoFullscreenHUDWindowController incrementVolume:]): New, increment the volume by 10%.
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController setVolume:]): Unmute movie before changing volume.
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Unbreak the world.
+        
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::restart):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlsson and Jon Honeycutt
+
+        <rdar://problem/7304295> snapshots of halted plug-ins are missing
+        
+        * Plugins/WebBaseNetscapePluginView.mm: Move bodies of WebHaltablePlugin virtual functions from WebHaltablePlugin class definition.
+        (WebHaltablePlugin::halt): Provide a substitute image to the RenderWidget for the plug-in view.
+        (WebHaltablePlugin::restart): Clear the substitute image.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some methods.  Split removal for user stylesheets and script into
+        separate functions based off the type of object being removed.
+
+        * WebView/WebView.mm:
+        (+[WebView _addUserScriptToGroup:worldID:source:url:whitelist:blacklist:injectionTime:]):
+        (+[WebView _addUserStyleSheetToGroup:worldID:source:url:whitelist:blacklist:]):
+        (+[WebView _removeUserScriptFromGroup:worldID:url:]):
+        (+[WebView _removeUserStyleSheetFromGroup:worldID:url:]):
+        (+[WebView _removeUserScriptsFromGroup:worldID:]):
+        (+[WebView _removeUserStyleSheetsFromGroup:worldID:]):
+        * WebView/WebViewPrivate.h:
+
+2009-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6660507> Add "privacy mode" to Netscape Plug-in API
+
+        Listen for WebPreferences notifications and update the _isPrivateBrowsingEnabled ivar 
+        when the value changes. Also call -[WebBaseNetscapePluginView privateBrowsingModeDidChange] when the
+        value changes. In process this just calls NPP_SetValue, and OOP it sends a MIG message to the plug-in host.
+        
+        * Plugins/Hosted/NetscapePluginHostManager.h:
+        * Plugins/Hosted/NetscapePluginHostManager.mm:
+        (WebKit::NetscapePluginHostManager::instantiatePlugin):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.h:
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::privateBrowsingModeDidChange):
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView createPlugin]):
+        (-[WebHostedNetscapePluginView privateBrowsingModeDidChange]):
+        * Plugins/Hosted/WebKitPluginHost.defs:
+        * Plugins/WebBaseNetscapePluginView.h:
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebBaseNetscapePluginView viewDidMoveToWindow]):
+        (-[WebBaseNetscapePluginView preferencesHaveChanged:]):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebNetscapePluginView getVariable:value:]):
+
+2009-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video keeps playing after going fullscreen, then closing window
+        https://bugs.webkit.org/show_bug.cgi?id=30164
+        
+        Clear the QTMovie on the QTMovieView when coming out of fullscreen,
+        to fix issue where the underlying movie keeps playing.
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController windowDidExitFullscreen]):
+
+2009-10-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7294267> REGRESSION (r48492): Gmail voice and video chat
+        doesn’t work
+        https://bugs.webkit.org/show_bug.cgi?id=30295
+
+        Test: plugins/setProperty.html
+
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyInstance::setFieldValue): Fixed a typo. The function
+        should return early if m_instanceProxy is null.
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        Update API call.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::restoreViewState):
+        * WebView/WebView.mm:
+        (-[WebView _loadBackForwardListFromOtherView:]):
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7290671> Crash after navigating away from a page with subframe containing plug-in
+
+        At the time that -stop is called on a WebBaseNetscapePluginView that is contained within a subframe
+        the WebFrame's data source has been zeroed out.  This was causing -[WebBaseNetscapePluginView webFrame]
+        to return nil during -stop, preventing the plug-in view from unregistering itself from the PluginHalter.
+        We fix this by having -webFrame retrieve the frame directly rather than retrieving it from the data source.
+
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView dataSource]): Get the data source from the WebFrame.
+        (-[WebBaseNetscapePluginView webFrame]): Get the Frame directly from the element's document rather
+        than taking a windy route through the WebDataSource.
+
+2009-10-09  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add SPI to specifically enable visited link tracking.
+
+        * History/WebHistory.mm:
+        (+[WebHistory _setVisitedLinkTrackingEnabled:]):
+        * History/WebHistoryPrivate.h:
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCoreSupport/WebPluginHalterClient.h:
+        Add declaration for new function.
+
+        * WebCoreSupport/WebPluginHalterClient.mm:
+        (WebPluginHalterClient::enabled):
+        Check whether the UIDelegate responds to shouldHaltPlugin.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        Remove the "enabled" preference key.
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        Remove the initialization of the pref.
+
+        * WebView/WebPreferencesPrivate.h:
+        Remove the getter/setter for this pref.
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+        Remove propagation of the pref. 
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        * WebView/WebView.mm:
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+
+2009-10-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Ask the History Delegate to populate the visited links hash.
+        <rdar://problem/7285293> and https://webkit.org/b/29904
+
+        * History/WebHistory.mm:
+        (+[WebHistory _removeAllVisitedLinks]):
+        * History/WebHistoryPrivate.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::populateVisitedLinks):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebDelegateImplementationCaching.mm:
+        (CallHistoryDelegate):
+        * WebView/WebHistoryDelegate.h:
+        * WebView/WebView.mm:
+        (-[WebView _cacheHistoryDelegateImplementations]):
+        (-[WebView addVisitedLinks:]):
+        * WebView/WebViewPrivate.h:
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL implementation.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        * WebView/WebPolicyDelegatePrivate.h:
+
 2009-10-07  Simon Fraser  <simon.fraser@apple.com>
 
         Re-land 49269-49271 since reverting them did not fix the tests.
diff --git a/WebKit/mac/Configurations/DebugRelease.xcconfig b/WebKit/mac/Configurations/DebugRelease.xcconfig
index 50071e7..11a94ca 100644
--- a/WebKit/mac/Configurations/DebugRelease.xcconfig
+++ b/WebKit/mac/Configurations/DebugRelease.xcconfig
@@ -28,6 +28,7 @@ ARCHS_ = $(ARCHS_1040);
 ARCHS_1040 = $(NATIVE_ARCH);
 ARCHS_1050 = $(NATIVE_ARCH);
 ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -36,6 +37,7 @@ MACOSX_DEPLOYMENT_TARGET_ = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
 
@@ -46,3 +48,4 @@ WEBKIT_SYSTEM_INTERFACE_LIBRARY_ = WebKitSystemInterfaceTiger;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1040 = WebKitSystemInterfaceTiger;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1050 = WebKitSystemInterfaceLeopard;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1060 = WebKitSystemInterfaceSnowLeopard;
+WEBKIT_SYSTEM_INTERFACE_LIBRARY_1070 = WebKitSystemInterfaceSnowLeopard;
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index ed387aa..42aa3cf 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -31,10 +31,12 @@
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
 ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1070 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
 ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
+ENABLE_3D_RENDERING_1070 = ENABLE_3D_RENDERING;
 
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
diff --git a/WebKit/mac/Configurations/Version.xcconfig b/WebKit/mac/Configurations/Version.xcconfig
index 66d574b..fabc009 100644
--- a/WebKit/mac/Configurations/Version.xcconfig
+++ b/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 2;
+MINOR_VERSION = 4;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -36,6 +36,7 @@ SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_V
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
 SYSTEM_VERSION_PREFIX_1060 = 6;
+SYSTEM_VERSION_PREFIX_1070 = 7;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
diff --git a/WebKit/mac/History/WebHistory.mm b/WebKit/mac/History/WebHistory.mm
index 6304fd2..af40a24 100644
--- a/WebKit/mac/History/WebHistory.mm
+++ b/WebKit/mac/History/WebHistory.mm
@@ -801,6 +801,16 @@ static inline WebHistoryDateKey dateKey(NSTimeInterval date)
     return [_historyPrivate data];
 }
 
++ (void)_setVisitedLinkTrackingEnabled:(BOOL)visitedLinkTrackingEnabled
+{
+    PageGroup::setShouldTrackVisitedLinks(visitedLinkTrackingEnabled);
+}
+
++ (void)_removeAllVisitedLinks
+{
+    PageGroup::removeAllVisitedLinks();
+}
+
 @end
 
 @implementation WebHistory (WebInternal)
diff --git a/WebKit/mac/History/WebHistoryPrivate.h b/WebKit/mac/History/WebHistoryPrivate.h
index 4ab0924..b93472f 100644
--- a/WebKit/mac/History/WebHistoryPrivate.h
+++ b/WebKit/mac/History/WebHistoryPrivate.h
@@ -53,5 +53,6 @@ extern NSString *WebHistoryItemsDiscardedWhileLoadingNotification;
 */
 - (NSData *)_data;
 
-
++ (void)_setVisitedLinkTrackingEnabled:(BOOL)visitedLinkTrackingEnabled;
++ (void)_removeAllVisitedLinks;
 @end
diff --git a/WebKit/mac/Misc/WebCoreStatistics.h b/WebKit/mac/Misc/WebCoreStatistics.h
index d4370bf..7a189ae 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.h
+++ b/WebKit/mac/Misc/WebCoreStatistics.h
@@ -30,6 +30,8 @@
 
 #import <WebKit/WebFrame.h>
 
+@class DOMElement;
+
 @interface WebCoreStatistics : NSObject
 {
 }
@@ -81,4 +83,5 @@
 
 @interface WebFrame (WebKitDebug)
 - (NSString *)renderTreeAsExternalRepresentation;
+- (NSString *)counterValueForElement:(DOMElement*)element;
 @end
diff --git a/WebKit/mac/Misc/WebCoreStatistics.mm b/WebKit/mac/Misc/WebCoreStatistics.mm
index 57b59a4..6bac46e 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.mm
+++ b/WebKit/mac/Misc/WebCoreStatistics.mm
@@ -28,6 +28,7 @@
 
 #import "WebCoreStatistics.h"
 
+#import "DOMElementInternal.h"
 #import "WebCache.h"
 #import "WebFrameInternal.h"
 #import <runtime/JSLock.h>
@@ -244,4 +245,9 @@ using namespace WebCore;
     return externalRepresentation(_private->coreFrame->contentRenderer());
 }
 
+- (NSString *)counterValueForElement:(DOMElement*)element
+{
+    return counterValueForElement(core(element));
+}
+
 @end
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
index a1d9bad..9e29062 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
@@ -43,7 +43,7 @@ class NetscapePluginHostManager {
 public:
     static NetscapePluginHostManager& shared();
     
-    PassRefPtr<NetscapePluginInstanceProxy> instantiatePlugin(WebNetscapePluginPackage *, WebHostedNetscapePluginView *, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame);
+    PassRefPtr<NetscapePluginInstanceProxy> instantiatePlugin(WebNetscapePluginPackage *, WebHostedNetscapePluginView *, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame, bool isPrivateBrowsingEnabled);
 
     void pluginHostDied(NetscapePluginHostProxy*);
 
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
index 4aa290a..6b36a6d 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
@@ -211,7 +211,7 @@ void NetscapePluginHostManager::pluginHostDied(NetscapePluginHostProxy* pluginHo
     }
 }
 
-PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePlugin(WebNetscapePluginPackage *pluginPackage, WebHostedNetscapePluginView *pluginView, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame)
+PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePlugin(WebNetscapePluginPackage *pluginPackage, WebHostedNetscapePluginView *pluginView, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame, bool isPrivateBrowsingEnabled)
 {
     NetscapePluginHostProxy* hostProxy = hostForPackage(pluginPackage);
     if (!hostProxy)
@@ -235,6 +235,7 @@ PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePl
         [properties.get() setObject:[sourceURL absoluteString] forKey:@"sourceURL"];
     
     [properties.get() setObject:[NSNumber numberWithBool:fullFrame] forKey:@"fullFrame"];
+    [properties.get() setObject:[NSNumber numberWithBool:isPrivateBrowsingEnabled] forKey:@"privateBrowsingEnabled"];
     
     NSData *data = [NSPropertyListSerialization dataFromPropertyList:properties.get() format:NSPropertyListBinaryFormat_v1_0 errorDescription:nil];
     ASSERT(data);
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
index e8874cd..970f5f5 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
@@ -187,7 +187,8 @@ NetscapePluginInstanceProxy* NetscapePluginHostProxy::pluginInstance(uint32_t pl
 
 void NetscapePluginHostProxy::deadNameNotificationCallback(CFMachPortRef port, void *msg, CFIndex size, void *info)
 {
-    ASSERT(msg && static_cast<mach_msg_header_t*>(msg)->msgh_id == MACH_NOTIFY_DEAD_NAME);
+    ASSERT(msg);
+    ASSERT(static_cast<mach_msg_header_t*>(msg)->msgh_id == MACH_NOTIFY_DEAD_NAME);
     
     static_cast<NetscapePluginHostProxy*>(info)->pluginHostDied();
 }
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
index 280f161..c950ab7 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
@@ -163,6 +163,7 @@ public:
     void resolveURL(const char* url, const char* target, data_t& resolvedURLData, mach_msg_type_number_t& resolvedURLLength);
     
     void didDraw();
+    void privateBrowsingModeDidChange(bool isPrivateBrowsingEnabled);
     
     // Reply structs
     struct Reply {
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index 21f35e2..4ae0220 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -575,9 +575,10 @@ NPError NetscapePluginInstanceProxy::loadRequest(NSURLRequest *request, const ch
         return NPERR_INVALID_URL;
 
     // Don't allow requests to be loaded when the document loader is stopping all loaders.
-    if ([[m_pluginView dataSource] _documentLoader]->isStopping())
+    DocumentLoader* documentLoader = [[m_pluginView dataSource] _documentLoader];
+    if (!documentLoader || documentLoader->isStopping())
         return NPERR_GENERIC_ERROR;
-    
+
     NSString *target = nil;
     if (cTarget) {
         // Find the frame given the target string.
@@ -587,7 +588,7 @@ NPError NetscapePluginInstanceProxy::loadRequest(NSURLRequest *request, const ch
 
     // don't let a plugin start any loads if it is no longer part of a document that is being 
     // displayed unless the loads are in the same frame as the plugin.
-    if ([[m_pluginView dataSource] _documentLoader] != core([m_pluginView webFrame])->loader()->activeDocumentLoader() &&
+    if (documentLoader != core([m_pluginView webFrame])->loader()->activeDocumentLoader() &&
         (!cTarget || [frame findFrameNamed:target] != frame)) {
         return NPERR_GENERIC_ERROR; 
     }
@@ -665,7 +666,7 @@ bool NetscapePluginInstanceProxy::getWindowNPObject(uint32_t& objectID)
     if (!frame->script()->isEnabled())
         objectID = 0;
     else
-        objectID = idForObject(frame->script()->windowShell()->window());
+        objectID = idForObject(frame->script()->windowShell(pluginWorld())->window());
         
     return true;
 }
@@ -703,7 +704,7 @@ bool NetscapePluginInstanceProxy::evaluate(uint32_t objectID, const String& scri
 
     JSLock lock(SilenceAssertionsOnly);
     
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     ExecState* exec = globalObject->globalExec();
 
     bool oldAllowPopups = frame->script()->allowPopupsFromPlugin();
@@ -744,7 +745,7 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
     JSValue function = object->get(exec, methodName);
     CallData callData;
@@ -755,7 +756,7 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
     MarkedArgumentBuffer argList;
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     globalObject->globalData()->timeoutChecker.start();
     JSValue value = call(exec, function, callType, callData, object, argList);
     globalObject->globalData()->timeoutChecker.stop();
@@ -778,7 +779,7 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     CallData callData;
     CallType callType = object->getCallData(callData);
@@ -788,7 +789,7 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
     MarkedArgumentBuffer argList;
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     globalObject->globalData()->timeoutChecker.start();
     JSValue value = call(exec, object, callType, callData, object, argList);
     globalObject->globalData()->timeoutChecker.stop();
@@ -811,7 +812,7 @@ bool NetscapePluginInstanceProxy::construct(uint32_t objectID, data_t argumentsD
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
 
     ConstructData constructData;
@@ -822,7 +823,7 @@ bool NetscapePluginInstanceProxy::construct(uint32_t objectID, data_t argumentsD
     MarkedArgumentBuffer argList;
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     globalObject->globalData()->timeoutChecker.start();
     JSValue value = JSC::construct(exec, object, constructType, constructData, argList);
     globalObject->globalData()->timeoutChecker.stop();
@@ -845,7 +846,7 @@ bool NetscapePluginInstanceProxy::getProperty(uint32_t objectID, const Identifie
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     JSValue value = object->get(exec, propertyName);
     
@@ -864,7 +865,7 @@ bool NetscapePluginInstanceProxy::getProperty(uint32_t objectID, unsigned proper
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     JSValue value = object->get(exec, propertyName);
     
@@ -886,7 +887,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, const Identifie
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
 
     JSValue value = demarshalValue(exec, valueData, valueLength);
@@ -910,7 +911,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, unsigned proper
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     
     JSValue value = demarshalValue(exec, valueData, valueLength);
@@ -933,7 +934,7 @@ bool NetscapePluginInstanceProxy::removeProperty(uint32_t objectID, const Identi
     if (!frame)
         return false;
 
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     if (!object->hasProperty(exec, propertyName)) {
         exec->clearException();
         return false;
@@ -958,7 +959,7 @@ bool NetscapePluginInstanceProxy::removeProperty(uint32_t objectID, unsigned pro
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     if (!object->hasProperty(exec, propertyName)) {
         exec->clearException();
         return false;
@@ -983,7 +984,7 @@ bool NetscapePluginInstanceProxy::hasProperty(uint32_t objectID, const Identifie
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     bool result = object->hasProperty(exec, propertyName);
     exec->clearException();
     
@@ -1003,7 +1004,7 @@ bool NetscapePluginInstanceProxy::hasProperty(uint32_t objectID, unsigned proper
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     bool result = object->hasProperty(exec, propertyName);
     exec->clearException();
     
@@ -1023,7 +1024,7 @@ bool NetscapePluginInstanceProxy::hasMethod(uint32_t objectID, const Identifier&
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
     JSValue func = object->get(exec, methodName);
     exec->clearException();
@@ -1043,7 +1044,7 @@ bool NetscapePluginInstanceProxy::enumerate(uint32_t objectID, data_t& resultDat
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
  
     PropertyNameArray propertyNames(exec);
@@ -1442,6 +1443,11 @@ void NetscapePluginInstanceProxy::resolveURL(const char* url, const char* target
     memcpy(resolvedURLData, resolvedURL.data(), resolvedURLLength);
 }
 
+void NetscapePluginInstanceProxy::privateBrowsingModeDidChange(bool isPrivateBrowsingEnabled)
+{
+    _WKPHPluginInstancePrivateBrowsingModeDidChange(m_pluginHostProxy->port(), m_pluginID, isPrivateBrowsingEnabled);
+}
+
 } // namespace WebKit
 
 #endif // USE(PLUGIN_HOST_PROCESS)
diff --git a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
index 0b3a32f..6be3953 100644
--- a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
+++ b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
@@ -370,7 +370,7 @@ JSC::JSValue ProxyInstance::fieldValue(ExecState* exec, const Field* field) cons
     
 void ProxyInstance::setFieldValue(ExecState* exec, const Field* field, JSValue value) const
 {
-    if (m_instanceProxy)
+    if (!m_instanceProxy)
         return;
     
     uint64_t serverIdentifier = static_cast<const ProxyField*>(field)->serverIdentifier();
diff --git a/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm b/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
index 34a2211..8de2aa6 100644
--- a/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
@@ -90,7 +90,8 @@ extern "C" {
 
 - (void)setAttributeKeys:(NSArray *)keys andValues:(NSArray *)values
 {
-    ASSERT(!_attributeKeys && !_attributeValues);
+    ASSERT(!_attributeKeys);
+    ASSERT(!_attributeValues);
     
     _attributeKeys.adoptNS([keys copy]);
     _attributeValues.adoptNS([values copy]);
@@ -102,7 +103,8 @@ extern "C" {
 
     NSString *userAgent = [[self webView] userAgentForURL:_baseURL.get()];
 
-    _proxy = NetscapePluginHostManager::shared().instantiatePlugin(_pluginPackage.get(), self, _MIMEType.get(), _attributeKeys.get(), _attributeValues.get(), userAgent, _sourceURL.get(), _mode == NP_FULL);
+    _proxy = NetscapePluginHostManager::shared().instantiatePlugin(_pluginPackage.get(), self, _MIMEType.get(), _attributeKeys.get(), _attributeValues.get(), userAgent, _sourceURL.get(), 
+                                                                   _mode == NP_FULL, _isPrivateBrowsingEnabled);
     if (!_proxy) 
         return NO;
 
@@ -128,6 +130,12 @@ extern "C" {
         [newLayer addSublayer:_pluginLayer.get()];
 }
 
+- (void)privateBrowsingModeDidChange
+{
+    if (_proxy)
+        _proxy->privateBrowsingModeDidChange(_isPrivateBrowsingEnabled);
+}
+
 - (void)loadStream
 {
 }
@@ -414,7 +422,7 @@ extern "C" {
     ASSERT([webPluginContainerCheck isKindOfClass:[WebPluginContainerCheck class]]);
     
     id contextInfo = [webPluginContainerCheck contextInfo];
-    ASSERT(contextInfo && [contextInfo isKindOfClass:[NSNumber class]]);
+    ASSERT([contextInfo isKindOfClass:[NSNumber class]]);
 
     if (!_proxy)
         return;
diff --git a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
index 04edf64..9882bb5 100644
--- a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
+++ b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
@@ -236,4 +236,8 @@ simpleroutine PHBooleanAndDataReply(pluginHostPort :mach_port_t;
              
 simpleroutine PHPluginInstanceDidDraw(pluginHostPort :mach_port_t;
                                       pluginID :uint32_t);
+simpleroutine PHPluginInstancePrivateBrowsingModeDidChange(pluginHostPort :mach_port_t;
+                                                           pluginID :uint32_t;
+                                                           privateBrowsingEnabled :boolean_t);
+
                               
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
index bd05ebe..246fcf1 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
@@ -62,6 +62,9 @@ class WebHaltablePlugin;
     BOOL _isStarted;
     BOOL _hasFocus;
     BOOL _isCompletelyObscured;
+    BOOL _isPrivateBrowsingEnabled;
+    BOOL _isHalted;
+    BOOL _hasBeenHalted;
     
     RefPtr<WebCore::HTMLPlugInElement> _element;
     RetainPtr<NSString> _MIMEType;
@@ -109,6 +112,11 @@ class WebHaltablePlugin;
 - (void)start;
 - (void)stop;
 
+- (void)halt;
+- (void)resumeFromHalt;
+- (BOOL)isHalted;
+- (BOOL)hasBeenHalted;
+
 - (void)addWindowObservers;
 - (void)removeWindowObservers;
 
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
index e730419..0b4d56a 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
@@ -43,6 +43,7 @@
 
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/AuthenticationMac.h>
+#import <WebCore/BitmapImage.h>
 #import <WebCore/Credential.h>
 #import <WebCore/CredentialStorage.h>
 #import <WebCore/CString.h>
@@ -55,6 +56,7 @@
 #import <WebCore/Page.h>
 #import <WebCore/ProtectionSpace.h>
 #import <WebCore/RenderView.h>
+#import <WebCore/RenderWidget.h>
 #import <WebKit/DOMPrivate.h>
 #import <runtime/InitializeThreading.h>
 #import <wtf/Assertions.h>
@@ -72,13 +74,28 @@ public:
     }
     
 private:
-    virtual void halt() { [m_view stop]; }
-    virtual void restart() { [m_view start]; }
-    virtual Node* node() const { return [m_view element]; }
+    virtual void halt();
+    virtual void restart();
+    virtual Node* node() const;
 
     WebBaseNetscapePluginView* m_view;
 };
 
+void WebHaltablePlugin::halt()
+{
+    [m_view halt];
+}
+
+void WebHaltablePlugin::restart()
+{ 
+    [m_view resumeFromHalt];
+}
+    
+Node* WebHaltablePlugin::node() const
+{
+    return [m_view element];
+}
+
 @implementation WebBaseNetscapePluginView
 
 + (void)initialize
@@ -243,6 +260,10 @@ private:
     ASSERT_NOT_REACHED();
 }
 
+- (void)privateBrowsingModeDidChange
+{
+}
+
 - (void)removeTrackingRect
 {
     if (_trackingTag) {
@@ -455,6 +476,51 @@ private:
     [self destroyPlugin];
 }
 
+- (void)halt
+{
+    ASSERT(!_isHalted);
+    ASSERT(_isStarted);
+    Element *element = [self element];
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    CGImageRef cgImage = CGImageRetain([core([self webFrame])->nodeImage(element) CGImageForProposedRect:nil context:nil hints:nil]);
+#else
+    RetainPtr<CGImageSourceRef> imageRef(AdoptCF, CGImageSourceCreateWithData((CFDataRef)[core([self webFrame])->nodeImage(element) TIFFRepresentation], 0));
+    CGImageRef cgImage = CGImageSourceCreateImageAtIndex(imageRef.get(), 0, 0);
+#endif
+    ASSERT(cgImage);
+    
+    // BitmapImage will release the passed in CGImage on destruction.
+    RefPtr<Image> nodeImage = BitmapImage::create(cgImage);
+    ASSERT(element->renderer());
+    toRenderWidget(element->renderer())->showSubstituteImage(nodeImage);
+    [self stop];
+    _isHalted = YES;  
+    _hasBeenHalted = YES;
+}
+
+- (void)resumeFromHalt
+{
+    ASSERT(_isHalted);
+    ASSERT(!_isStarted);
+    [self start];
+    
+    if (_isStarted)
+        _isHalted = NO;
+    
+    ASSERT([self element]->renderer());
+    toRenderWidget([self element]->renderer())->showSubstituteImage(0);
+}
+
+- (BOOL)isHalted
+{
+    return _isHalted;
+}
+
+- (BOOL)hasBeenHalted
+{
+    return _hasBeenHalted;
+}
+
 - (void)viewWillMoveToWindow:(NSWindow *)newWindow
 {
     // We must remove the tracking rect before we move to the new window.
@@ -506,6 +572,8 @@ private:
                                                      name:WebPreferencesChangedNotification
                                                    object:nil];
 
+        _isPrivateBrowsingEnabled = [[[self webView] preferences] privateBrowsingEnabled];
+        
         // View moved to an actual window. Start it if not already started.
         [self start];
 
@@ -586,9 +654,12 @@ private:
 - (void)preferencesHaveChanged:(NSNotification *)notification
 {
     WebPreferences *preferences = [[self webView] preferences];
-    BOOL arePlugInsEnabled = [preferences arePlugInsEnabled];
+
+    if ([notification object] != preferences)
+        return;
     
-    if ([notification object] == preferences && _isStarted != arePlugInsEnabled) {
+    BOOL arePlugInsEnabled = [preferences arePlugInsEnabled];
+    if (_isStarted != arePlugInsEnabled) {
         if (arePlugInsEnabled) {
             if ([self currentWindow]) {
                 [self start];
@@ -598,6 +669,12 @@ private:
             [self invalidatePluginContentRect:[self bounds]];
         }
     }
+    
+    BOOL isPrivateBrowsingEnabled = [preferences privateBrowsingEnabled];
+    if (isPrivateBrowsingEnabled != _isPrivateBrowsingEnabled) {
+        _isPrivateBrowsingEnabled = isPrivateBrowsingEnabled;
+        [self privateBrowsingModeDidChange];
+    }
 }
 
 - (void)renewGState
@@ -640,13 +717,12 @@ private:
 
 - (WebDataSource *)dataSource
 {
-    WebFrame *webFrame = kit(_element->document()->frame());
-    return [webFrame _dataSource];
+    return [[self webFrame] _dataSource];
 }
 
 - (WebFrame *)webFrame
 {
-    return [[self dataSource] webFrame];
+    return kit(_element->document()->frame());
 }
 
 - (WebView *)webView
diff --git a/WebKit/mac/Plugins/WebNetscapePluginView.mm b/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 5debb97..135d45a 100644
--- a/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -402,7 +402,8 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
                     QDErr err = NewGWorldFromPtr(&newOffscreenGWorld,
                         getQDPixelFormatForBitmapContext(currentContext), &offscreenBounds, 0, 0, 0,
                         static_cast<char*>(offscreenData), CGBitmapContextGetBytesPerRow(currentContext));
-                    ASSERT(newOffscreenGWorld && !err);
+                    ASSERT(newOffscreenGWorld);
+                    ASSERT(!err);
                     if (!err) {
                         if (offscreenGWorld)
                             DisposeGWorld(offscreenGWorld);
@@ -838,6 +839,21 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     _eventHandler->syntheticKeyDownWithCommandModifier(keyCode, character);
 }
 
+- (void)privateBrowsingModeDidChange
+{
+    if (!_isStarted)
+        return;
+    
+    NPBool value = _isPrivateBrowsingEnabled;
+
+    [self willCallPlugInFunction];
+    {
+        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        [_pluginPackage.get() pluginFuncs]->setvalue(plugin, NPNVprivateModeBool, &value);
+    }
+    [self didCallPlugInFunction];
+}
+
 #pragma mark WEB_NETSCAPE_PLUGIN
 
 - (BOOL)isNewWindowEqualToOldWindow
@@ -1271,7 +1287,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
 {
     ASSERT([webPluginContainerCheck isKindOfClass:[WebPluginContainerCheck class]]);
     WebPluginContainerCheck *check = (WebPluginContainerCheck *)webPluginContainerCheck;
-    ASSERT([check contextInfo] && [[check contextInfo] isKindOfClass:[WebNetscapeContainerCheckContextInfo class]]);
+    ASSERT([[check contextInfo] isKindOfClass:[WebNetscapeContainerCheckContextInfo class]]);
     
     [self cancelCheckIfAllowedToLoadURL:[[check contextInfo] checkRequestID]];
 }
@@ -2022,13 +2038,19 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
             return NPERR_NO_ERROR;
         }
 #endif /* NP_NO_CARBON */
-            
+
         case NPNVsupportsCocoaBool:
         {
             *(NPBool *)value = TRUE;
             return NPERR_NO_ERROR;
         }
 
+        case NPNVprivateModeBool:
+        {
+            *(NPBool *)value = _isPrivateBrowsingEnabled;
+            return NPERR_NO_ERROR;
+        }
+
         case WKNVBrowserContainerCheckFuncs:
         {
             *(WKNBrowserContainerCheckFuncs **)value = browserContainerCheckFuncs();
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index a3f004e..c107299 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -548,6 +548,15 @@ void WebChromeClient::reachedMaxAppCacheSize(int64_t spaceNeeded)
     
 void WebChromeClient::populateVisitedLinks()
 {
+    if ([m_webView historyDelegate]) {
+        WebHistoryDelegateImplementationCache* implementations = WebViewGetHistoryDelegateImplementations(m_webView);
+        
+        if (implementations->populateVisitedLinksFunc)
+            CallHistoryDelegate(implementations->populateVisitedLinksFunc, m_webView, @selector(populateVisitedLinksForWebView:));
+
+        return;
+    }
+
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     [[WebHistory optionalSharedHistory] _addVisitedLinksToPageGroup:[m_webView page]->group()];
     END_BLOCK_OBJC_EXCEPTIONS;
diff --git a/WebKit/mac/WebCoreSupport/WebEditorClient.mm b/WebKit/mac/WebCoreSupport/WebEditorClient.mm
index e8c37d5..1e03d88 100644
--- a/WebKit/mac/WebCoreSupport/WebEditorClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebEditorClient.mm
@@ -675,7 +675,8 @@ void WebEditorClient::checkGrammarOfString(const UChar* text, int length, Vector
         NSValue *detailRangeAsNSValue = [detail objectForKey:NSGrammarRange];
         ASSERT(detailRangeAsNSValue);
         NSRange detailNSRange = [detailRangeAsNSValue rangeValue];
-        ASSERT(detailNSRange.location != NSNotFound && detailNSRange.length > 0);
+        ASSERT(detailNSRange.location != NSNotFound);
+        ASSERT(detailNSRange.length > 0);
         grammarDetail.location = detailNSRange.location;
         grammarDetail.length = detailNSRange.length;
         grammarDetail.userDescription = [detail objectForKey:NSGrammarUserDescription];
@@ -696,7 +697,8 @@ void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64
     for (NSTextCheckingResult *incomingResult in incomingResults) {
         NSRange resultRange = [incomingResult range];
         NSTextCheckingType resultType = [incomingResult resultType];
-        ASSERT(resultRange.location != NSNotFound && resultRange.length > 0);
+        ASSERT(resultRange.location != NSNotFound);
+        ASSERT(resultRange.length > 0);
         if (NSTextCheckingTypeSpelling == resultType && 0 != (checkingTypes & NSTextCheckingTypeSpelling)) {
             TextCheckingResult result;
             result.type = TextCheckingTypeSpelling;
@@ -715,7 +717,8 @@ void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64
                 NSValue *detailRangeAsNSValue = [incomingDetail objectForKey:NSGrammarRange];
                 ASSERT(detailRangeAsNSValue);
                 NSRange detailNSRange = [detailRangeAsNSValue rangeValue];
-                ASSERT(detailNSRange.location != NSNotFound && detailNSRange.length > 0);
+                ASSERT(detailNSRange.location != NSNotFound);
+                ASSERT(detailNSRange.length > 0);
                 detail.location = detailNSRange.location;
                 detail.length = detailNSRange.length;
                 detail.userDescription = [incomingDetail objectForKey:NSGrammarUserDescription];
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index 6259c80..6d365dd 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -208,7 +208,6 @@ private:
     NSDictionary *actionDictionary(const WebCore::NavigationAction&, PassRefPtr<WebCore::FormState>) const;
     
     virtual bool canCachePage() const;
-    virtual bool shouldLoadMediaElementURL(const WebCore::KURL&) const;
     
     RetainPtr<WebFrame> m_webFrame;
 
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index ec05572..bc6c8f4 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -988,7 +988,7 @@ void WebFrameLoaderClient::saveViewStateToItem(HistoryItem* item)
 
 void WebFrameLoaderClient::restoreViewState()
 {
-    HistoryItem* currentItem = core(m_webFrame.get())->loader()->currentHistoryItem();
+    HistoryItem* currentItem = core(m_webFrame.get())->loader()->history()->currentItem();
     ASSERT(currentItem);
 
     // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
@@ -1738,18 +1738,7 @@ jobject WebFrameLoaderClient::javaApplet(NSView* view)
 }
 #endif
 
-bool WebFrameLoaderClient::shouldLoadMediaElementURL(const KURL& url) const {
-    WebView *webView = getWebView(m_webFrame.get());
-    
-    if (id policyDelegate = [webView policyDelegate]) {
-        if ([policyDelegate respondsToSelector:@selector(webView:shouldLoadMediaURL:inFrame:)])
-            return [policyDelegate webView:webView shouldLoadMediaURL:url inFrame:m_webFrame.get()];
-    }
-    return true;
-}
-
 @implementation WebFramePolicyListener
-
 + (void)initialize
 {
     JSC::initializeThreading();
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
index 48c655d..0bab4e3 100644
--- a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
@@ -36,6 +36,7 @@ public:
     WebPluginHalterClient(WebView *);
     
     virtual bool shouldHaltPlugin(WebCore::Node*) const;
+    virtual bool enabled() const;
     
 private:
     WebView *m_webView;
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
index 2384d0b..b83e4c8 100644
--- a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
@@ -42,3 +42,8 @@ bool WebPluginHalterClient::shouldHaltPlugin(Node* pluginNode) const
     ASSERT_ARG(pluginNode, pluginNode);    
     return CallUIDelegateReturningBoolean(NO, m_webView, @selector(webView:shouldHaltPlugin:), kit(pluginNode));
 }
+
+bool WebPluginHalterClient::enabled() const
+{
+    return [[m_webView UIDelegate] respondsToSelector:@selector(webView:shouldHaltPlugin:)];
+}
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.h b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
index 907ba42..edf3cad 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.h
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
@@ -86,6 +86,7 @@ struct WebHistoryDelegateImplementationCache {
     IMP clientRedirectFunc;
     IMP serverRedirectFunc;
     IMP setTitleFunc;
+    IMP populateVisitedLinksFunc;
 };
 
 WebResourceDelegateImplementationCache* WebViewGetResourceLoadDelegateImplementations(WebView *);
@@ -130,5 +131,6 @@ id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, id, NSInteger, id
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, id, id, id);
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, NSInteger, id);
 
+id CallHistoryDelegate(IMP, WebView *, SEL);
 id CallHistoryDelegate(IMP, WebView *, SEL, id, id);
 id CallHistoryDelegate(IMP, WebView *, SEL, id, id, id);
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
index 7757fc7..486d094 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
@@ -548,6 +548,11 @@ id CallScriptDebugDelegate(IMP implementation, WebView *self, SEL selector, id o
     return CallDelegate(implementation, self, self->_private->scriptDebugDelegate, selector, object1, integer1, integer2, object2);
 }
 
+id CallHistoryDelegate(IMP implementation, WebView *self, SEL selector)
+{
+    return CallDelegate(implementation, self, self->_private->historyDelegate, selector);
+}
+
 id CallHistoryDelegate(IMP implementation, WebView *self, SEL selector, id object1, id object2)
 {
     return CallDelegate(implementation, self, self->_private->historyDelegate, selector, object1, object2);
diff --git a/WebKit/mac/WebView/WebDynamicScrollBarsView.h b/WebKit/mac/WebView/WebDynamicScrollBarsView.h
index 40aadc0..15ed7e4 100644
--- a/WebKit/mac/WebView/WebDynamicScrollBarsView.h
+++ b/WebKit/mac/WebView/WebDynamicScrollBarsView.h
@@ -29,8 +29,7 @@
 // This is a Private header (containing SPI), despite the fact that its name
 // does not contain the word Private.
 
-// FIXME: Does Safari really need to use this any more? AppKit added autohidesScrollers
-// in Panther, and that was the original reason we needed this view in Safari.
+// This was once used by Safari, but has not been for a long time.
 
 // FIXME: <rdar://problem/5898985> Mail currently expects this header to define WebCoreScrollbarAlwaysOn.
 extern const int WebCoreScrollbarAlwaysOn;
@@ -47,5 +46,8 @@ extern const int WebCoreScrollbarAlwaysOn;
     BOOL horizontallyPinnedByPreviousWheelEvent;
     unsigned inUpdateScrollersLayoutPass;
 }
-- (void)setAllowsHorizontalScrolling:(BOOL)flag; // This method is used by Safari, so it cannot be removed.
+
+// This was originally added for Safari's benefit, but Safari has not used it for a long time.
+// Perhaps it can be removed.
+- (void)setAllowsHorizontalScrolling:(BOOL)flag;
 @end
diff --git a/WebKit/mac/WebView/WebFrame.mm b/WebKit/mac/WebView/WebFrame.mm
index 27aac67..94fe997 100644
--- a/WebKit/mac/WebView/WebFrame.mm
+++ b/WebKit/mac/WebView/WebFrame.mm
@@ -85,6 +85,7 @@
 #import <WebCore/markup.h>
 #import <WebCore/visible_units.h>
 #import <runtime/JSLock.h>
+#import <runtime/JSObject.h>
 #import <runtime/JSValue.h>
 #import <wtf/CurrentTime.h>
 
@@ -270,11 +271,12 @@ WebView *getWebView(WebFrame *webFrame)
     ScriptController* scriptController = _private->coreFrame->script();
 
     // Calling ScriptController::globalObject() would create a window shell, and dispatch corresponding callbacks, which may be premature
-    //  if the script debugger is attached before a document is created.
-    if (!scriptController->haveWindowShell())
+    // if the script debugger is attached before a document is created.  These calls use the debuggerWorld(), we will need to pass a world
+    // to be able to debug isolated worlds.
+    if (!scriptController->existingWindowShell(debuggerWorld()))
         return;
 
-    JSGlobalObject* globalObject = scriptController->globalObject();
+    JSGlobalObject* globalObject = scriptController->globalObject(debuggerWorld());
     if (!globalObject)
         return;
 
@@ -595,7 +597,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 {
     ASSERT(_private->coreFrame->document());
     
-    JSValue result = _private->coreFrame->loader()->executeScript(string, forceUserGesture).jsValue();
+    JSValue result = _private->coreFrame->script()->executeScript(string, forceUserGesture).jsValue();
 
     if (!_private->coreFrame) // In case the script removed our frame from the page.
         return @"";
@@ -607,7 +609,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
         return @"";
 
     JSLock lock(SilenceAssertionsOnly);
-    return String(result.toString(_private->coreFrame->script()->globalObject()->globalExec()));
+    return String(result.toString(_private->coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec()));
 }
 
 - (NSRect)_caretRectAtNode:(DOMNode *)node offset:(int)offset affinity:(NSSelectionAffinity)affinity
@@ -1202,6 +1204,42 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return SecurityOrigin::canLoad(URL, String(), _private->coreFrame->document());
 }
 
+- (NSString *)_stringByEvaluatingJavaScriptInIsolatedWorld:(unsigned)worldID WithGlobalObject:(JSObjectRef)globalObjectRef FromString:(NSString *)string
+{
+    // Start off with some guess at a frame and a global object, we'll try to do better...!
+    JSDOMWindow* anyWorldGlobalObject = _private->coreFrame->script()->globalObject(mainThreadNormalWorld());
+
+    // The global object is probably a shell object? - if so, we know how to use this!
+    JSC::JSObject* globalObjectObj = toJS(globalObjectRef);
+    if (!strcmp(globalObjectObj->classInfo()->className, "JSDOMWindowShell"))
+        anyWorldGlobalObject = static_cast<JSDOMWindowShell*>(globalObjectObj)->window();
+
+    // Get the frame frome the global object we've settled on.
+    Frame* frame = anyWorldGlobalObject->impl()->frame();
+    ASSERT(frame->document());
+    JSValue result = frame->script()->executeScriptInIsolatedWorld(worldID, string, true).jsValue();
+
+    if (!frame) // In case the script removed our frame from the page.
+        return @"";
+
+    // This bizarre set of rules matches behavior from WebKit for Safari 2.0.
+    // If you don't like it, use -[WebScriptObject evaluateWebScript:] or 
+    // JSEvaluateScript instead, since they have less surprising semantics.
+    if (!result || !result.isBoolean() && !result.isString() && !result.isNumber())
+        return @"";
+
+    JSLock lock(SilenceAssertionsOnly);
+    return String(result.toString(anyWorldGlobalObject->globalExec()));
+}
+
+- (JSGlobalContextRef)contextForWorldID:(unsigned)worldID;
+{
+    Frame* coreFrame = _private->coreFrame;
+    if (!coreFrame)
+        return 0;
+    return toGlobalRef(coreFrame->script()->globalObject(worldID)->globalExec());
+}
+
 @end
 
 @implementation WebFrame
@@ -1433,7 +1471,7 @@ static NSURL *createUniqueWebDataURL()
     Frame* coreFrame = _private->coreFrame;
     if (!coreFrame)
         return 0;
-    return toGlobalRef(coreFrame->script()->globalObject()->globalExec());
+    return toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
 }
 
 @end
diff --git a/WebKit/mac/WebView/WebFramePrivate.h b/WebKit/mac/WebView/WebFramePrivate.h
index 7446584..be13430 100644
--- a/WebKit/mac/WebView/WebFramePrivate.h
+++ b/WebKit/mac/WebView/WebFramePrivate.h
@@ -96,6 +96,9 @@ typedef enum {
 - (void)_recursive_pauseNullEventsForAllNetscapePlugins;
 #endif
 
+- (NSString *)_stringByEvaluatingJavaScriptInIsolatedWorld:(unsigned)worldID WithGlobalObject:(JSObjectRef)globalObject FromString:(NSString *)string;
+- (JSGlobalContextRef)contextForWorldID:(unsigned)worldID;
+
 // Pause a given CSS animation or transition on the target node at a specific time.
 // If the animation or transition is already paused, it will update its pause time.
 // This method is only intended to be used for testing the CSS animation and transition system.
diff --git a/WebKit/mac/WebView/WebHTMLView.mm b/WebKit/mac/WebView/WebHTMLView.mm
index 102f630..936b6d7 100644
--- a/WebKit/mac/WebView/WebHTMLView.mm
+++ b/WebKit/mac/WebView/WebHTMLView.mm
@@ -2173,6 +2173,15 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
 #endif
 }
 
+- (NSView *)_compositingLayersHostingView
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return _private->layerHostingView;
+#else
+    return 0;
+#endif
+}
+
 @end
 
 @implementation NSView (WebHTMLViewFileInternal)
diff --git a/WebKit/mac/WebView/WebHTMLViewPrivate.h b/WebKit/mac/WebView/WebHTMLViewPrivate.h
index bb59a7b..cb121d8 100644
--- a/WebKit/mac/WebView/WebHTMLViewPrivate.h
+++ b/WebKit/mac/WebView/WebHTMLViewPrivate.h
@@ -117,8 +117,8 @@
 - (void)_pauseNullEventsForAllNetscapePlugins;
 #endif
 
-// SPI for DumpRenderTree
 - (BOOL)_isUsingAcceleratedCompositing;
+- (NSView *)_compositingLayersHostingView;
 
 // SPI for printing (should be converted to API someday). When the WebHTMLView isn't being printed
 // directly, this method must be called before paginating, or the computed height might be incorrect.
diff --git a/WebKit/mac/WebView/WebHistoryDelegate.h b/WebKit/mac/WebView/WebHistoryDelegate.h
index 4029eb0..4415365 100644
--- a/WebKit/mac/WebView/WebHistoryDelegate.h
+++ b/WebKit/mac/WebView/WebHistoryDelegate.h
@@ -39,4 +39,6 @@
 
 - (void)webView:(WebView *)webView updateHistoryTitle:(NSString *)title forURL:(NSString *)url;
 
+- (void)populateVisitedLinksForWebView:(WebView *)webView;
+
 @end
diff --git a/WebKit/mac/WebView/WebPDFView.mm b/WebKit/mac/WebView/WebPDFView.mm
index dea3819..a38412e 100644
--- a/WebKit/mac/WebView/WebPDFView.mm
+++ b/WebKit/mac/WebView/WebPDFView.mm
@@ -953,7 +953,7 @@ static BOOL _PDFSelectionsAreEqual(PDFSelection *selectionA, PDFSelection *selec
     }
 
     // Call to the frame loader because this is where our security checks are made.
-    core([dataSource webFrame])->loader()->loadFrameRequest(ResourceRequest(URL), false, false, event.get(), 0);
+    core([dataSource webFrame])->loader()->loadFrameRequest(ResourceRequest(URL), false, false, event.get(), 0, SendReferrer);
 }
 
 - (void)PDFViewOpenPDFInNativeApplication:(PDFView *)sender
diff --git a/WebKit/mac/WebView/WebPolicyDelegatePrivate.h b/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
index efdf007..45f8f45 100644
--- a/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
@@ -49,6 +49,4 @@ typedef enum {
 @interface NSObject (WebPolicyDelegatePrivate)
 // Needed for <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
 - (BOOL)webView:(WebView *)webView shouldGoToHistoryItem:(WebHistoryItem *)item;
-
-- (BOOL)webView:(WebView *)webView shouldLoadMediaURL:(NSURL *)url inFrame:(WebFrame *)frame;
 @end
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index d6c9d3c..4a87337 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -56,7 +56,6 @@
 #define WebKitDatabasesEnabledPreferenceKey @"WebKitDatabasesEnabledPreferenceKey"
 #define WebKitLocalStorageEnabledPreferenceKey @"WebKitLocalStorageEnabledPreferenceKey"
 #define WebKitExperimentalNotificationsEnabledPreferenceKey @"WebKitExperimentalNotificationsEnabledPreferenceKey"
-#define WebKitExperimentalWebSocketsEnabledPreferenceKey @"WebKitExperimentalWebSocketsEnabledPreferenceKey"
 #define WebKitAllowAnimatedImagesPreferenceKey @"WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey @"WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey @"WebKitDisplayImagesKey"
@@ -87,7 +86,6 @@
 #define WebKitXSSAuditorEnabledPreferenceKey @"WebKitXSSAuditorEnabled"
 #define WebKitAcceleratedCompositingEnabledPreferenceKey @"WebKitAcceleratedCompositingEnabled"
 #define WebKitWebGLEnabledPreferenceKey @"WebKitWebGLEnabled"
-#define WebKitPluginHalterEnabledPreferenceKey @"WebKitPluginHalterEnabled"
 #define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 
 // These are private both because callers should be using the cover methods and because the
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index 2910d27..4914340 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -321,7 +321,6 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitDatabasesEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitLocalStorageEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitExperimentalNotificationsEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitExperimentalWebSocketsEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImagesPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImageLoopingPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitDisplayImagesKey,
@@ -353,7 +352,6 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitXSSAuditorEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitPluginHalterEnabledPreferenceKey,
         [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         nil];
 
@@ -1026,16 +1024,6 @@ static WebCacheModel cacheModelForMainBundle(void)
     [self _setBoolValue:experimentalNotificationsEnabled forKey:WebKitExperimentalNotificationsEnabledPreferenceKey];
 }
 
-- (BOOL)experimentalWebSocketsEnabled
-{
-    return [self _boolValueForKey:WebKitExperimentalWebSocketsEnabledPreferenceKey];
-}
-
-- (void)setExperimentalWebSocketsEnabled:(BOOL)experimentalWebSocketsEnabled
-{
-    [self _setBoolValue:experimentalWebSocketsEnabled forKey:WebKitExperimentalWebSocketsEnabledPreferenceKey];
-}
-
 + (WebPreferences *)_getInstanceForIdentifier:(NSString *)ident
 {
     LOG(Encoding, "requesting for %@\n", ident);
@@ -1173,16 +1161,6 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitWebGLEnabledPreferenceKey];
 }
 
-- (BOOL)pluginHalterEnabled
-{
-    return [self _boolValueForKey:WebKitPluginHalterEnabledPreferenceKey];
-}
-
-- (void)setPluginHalterEnabled:(BOOL)enabled
-{
-    [self _setBoolValue:enabled forKey:WebKitPluginHalterEnabledPreferenceKey];
-}
-
 - (unsigned)pluginAllowedRunTime
 {
     return [self _integerValueForKey:WebKitPluginAllowedRunTimePreferenceKey];
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index 6a25921..c558cbb 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -110,12 +110,6 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)experimentalNotificationsEnabled;
 - (void)setExperimentalNotificationsEnabled:(BOOL)notificationsEnabled;
 
-- (BOOL)experimentalWebSocketsEnabled;
-- (void)setExperimentalWebSocketsEnabled:(BOOL)websocketsEnabled;
-
-- (BOOL)pluginHalterEnabled;
-- (void)setPluginHalterEnabled:(BOOL)enabled;
-
 - (unsigned)pluginAllowedRunTime;
 - (void)setPluginAllowedRunTime:(unsigned)allowedRunTime;
 
diff --git a/WebKit/mac/WebView/WebResourceLoadDelegate.h b/WebKit/mac/WebView/WebResourceLoadDelegate.h
index f92466b..77d84ad 100644
--- a/WebKit/mac/WebView/WebResourceLoadDelegate.h
+++ b/WebKit/mac/WebView/WebResourceLoadDelegate.h
@@ -67,7 +67,7 @@
 - (id)webView:(WebView *)sender identifierForInitialRequest:(NSURLRequest *)request fromDataSource:(WebDataSource *)dataSource;
 
 /*!
-    @method resource:willSendRequest:redirectResponse:fromDataSource:
+    @method webView:resource:willSendRequest:redirectResponse:fromDataSource:
     @discussion This message is sent before a load is initiated.  The request may be modified
     as necessary by the receiver.
     @param webView The WebView sending the message.
diff --git a/WebKit/mac/WebView/WebScriptDebugDelegate.mm b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
index 8489c9b..ef2cb67 100644
--- a/WebKit/mac/WebView/WebScriptDebugDelegate.mm
+++ b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
@@ -249,7 +249,7 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     }
 
     JSValue exception;
-    JSValue result = _private->debuggerCallFrame->evaluate(String(script), exception);
+    JSValue result = DebuggerCallFrame_evaluateInWorld(*_private->debuggerCallFrame, String(script), exception);
     if (exception)
         return [self _convertValueToObjcValue:exception];
     return result ? [self _convertValueToObjcValue:result] : nil;
diff --git a/WebKit/mac/WebView/WebTextCompletionController.mm b/WebKit/mac/WebView/WebTextCompletionController.mm
index 6c37b98..4f8e6e0 100644
--- a/WebKit/mac/WebView/WebTextCompletionController.mm
+++ b/WebKit/mac/WebView/WebTextCompletionController.mm
@@ -298,7 +298,8 @@ using namespace std;
 - (void)_reflectSelection
 {
     int selectedRow = [_tableView selectedRow];
-    ASSERT(selectedRow >= 0 && selectedRow < (int)[_completions count]);
+    ASSERT(selectedRow >= 0);
+    ASSERT(selectedRow < (int)[_completions count]);
     [self _insertMatch:[_completions objectAtIndex:selectedRow]];
 }
 
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.mm b/WebKit/mac/WebView/WebVideoFullscreenController.mm
index 6592ad2..fe07f3e 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.mm
@@ -42,6 +42,10 @@
 SOFT_LINK_FRAMEWORK(QTKit)
 SOFT_LINK_CLASS(QTKit, QTMovieView)
 
+SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
+
+#define QTMovieRateDidChangeNotification getQTMovieRateDidChangeNotification()
+
 @interface WebVideoFullscreenWindow : NSWindow
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER)
 <NSAnimationDelegate>
@@ -76,6 +80,7 @@ SOFT_LINK_CLASS(QTKit, QTMovieView)
 {
     ASSERT(!_backgroundFullscreenWindow);
     ASSERT(!_fadeAnimation);
+    [[NSNotificationCenter defaultCenter] removeObserver:self];
     [super dealloc];
 }
 
@@ -109,7 +114,15 @@ SOFT_LINK_CLASS(QTKit, QTMovieView)
     _mediaElement = mediaElement;
     if ([self isWindowLoaded]) {
         QTMovieView *movieView = [[self fullscreenWindow] movieView];
-        [movieView setMovie:_mediaElement->platformMedia().qtMovie];
+        QTMovie *movie = _mediaElement->platformMedia().qtMovie;
+
+        ASSERT(movieView);
+        ASSERT(movie);
+        [movieView setMovie:movie];
+        [[NSNotificationCenter defaultCenter] addObserver:self
+                                                 selector:@selector(rateChanged:) 
+                                                     name:QTMovieRateDidChangeNotification 
+                                                   object:movie];
     }
 }
 
@@ -135,6 +148,9 @@ SOFT_LINK_CLASS(QTKit, QTMovieView)
 
 - (void)windowDidExitFullscreen
 {
+    // If we don't clear the movie, underlying movie data structures are leaked and the movie keeps playing <rdar://problem/7295070>
+    [[[self fullscreenWindow] movieView] setMovie:nil];
+
     [self clearFadeAnimation];
     [[self window] close];
     [self setWindow:nil];
@@ -264,14 +280,21 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
 #pragma mark -
 #pragma mark Window callback
 
+- (void)_requestExit
+{
+    if (_mediaElement)
+        _mediaElement->exitFullscreen();
+    _forceDisableAnimation = NO;
+}
+
 - (void)requestExitFullscreenWithAnimation:(BOOL)animation
 {
     if (_isEndingFullscreen)
         return;
 
     _forceDisableAnimation = !animation;
-    _mediaElement->exitFullscreen();
-    _forceDisableAnimation = NO;
+    [self performSelector:@selector(_requestExit) withObject:nil afterDelay:0];
+
 }
 
 - (void)requestExitFullscreen
@@ -283,6 +306,16 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
 {
     [_hudController fadeWindowIn];
 }
+
+#pragma mark -
+#pragma mark QTMovie callbacks
+
+- (void)rateChanged:(NSNotification *)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+    [_hudController updateRate];
+}
+
 @end
 
 @implementation WebVideoFullscreenWindow
@@ -439,6 +472,7 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
     [super resignKeyWindow];
     [[self windowController] requestExitFullscreenWithAnimation:NO];
 }
+
 @end
 
 #endif /* ENABLE(VIDEO) */
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
index 8b06c1c..1ffa596 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
@@ -38,6 +38,7 @@
     NSTrackingArea *_area;
 #endif
     BOOL _mouseIsInHUD;
+    BOOL _isEndingFullscreen;
 
     NSControl *_timeline;
     NSTextField *_remainingTimeText;
@@ -50,6 +51,7 @@
 - (void)fadeWindowIn;
 - (void)fadeWindowOut;
 - (void)closeWindow;
+- (void)updateRate;
 
 @end
 
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
index 2edfccc..c61ae7c 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
@@ -31,11 +31,16 @@
 #import "WebKitSystemInterface.h"
 #import "WebTypesInternal.h"
 #import <wtf/RetainPtr.h>
+#import <limits>
+
+using namespace std;
 
 #define HAVE_MEDIA_CONTROL (!defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
 
 @interface WebVideoFullscreenHUDWindowController (Private) <NSWindowDelegate>
 
+- (void)keyDown:(NSEvent *)event;
+
 - (void)updateTime;
 - (void)timelinePositionChanged:(id)sender;
 - (float)currentTime;
@@ -47,7 +52,7 @@
 - (double)volume;
 - (void)setVolume:(double)volume;
 
-- (void)playingChanged:(id)sender;
+- (void)togglePlaying:(id)sender;
 - (BOOL)playing;
 - (void)setPlaying:(BOOL)playing;
 
@@ -112,6 +117,23 @@
     [[self windowController] fadeWindowIn];
 }
 
+- (BOOL)resignFirstResponder
+{
+    return NO;
+}
+
+- (BOOL)performKeyEquivalent:(NSEvent *)event
+{
+    // Block all command key events while the fullscreen window is up.
+    if ([event type] != NSKeyDown)
+        return NO;
+    
+    if (!([event modifierFlags] & NSCommandKeyMask))
+        return NO;
+    
+    return YES;
+}
+
 @end
 
 //
@@ -162,11 +184,19 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 }
 #endif
 
+- (void)keyDown:(NSEvent *)event
+{
+    if ([[event characters] isEqualToString:@" "])
+        [_playButton performClick:self];
+    else
+        [super keyDown:event];
+}
+
 - (id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
 {
     return _delegate;
 }
-     
+
 - (void)setDelegate:(id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
 {
     _delegate = delegate;
@@ -178,6 +208,7 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 
     // First, update right away, then schedule future update
     [self updateTime];
+    [self updateRate];
 
     [_timelineUpdateTimer invalidate];
     [_timelineUpdateTimer release];
@@ -311,7 +342,7 @@ static NSTextField *createTimeTextField(NSRect frame)
     CGFloat center = (windowWidth - kButtonSize) / 2;
     _playButton = createControlWithMediaUIControlType(WKMediaUIControlPlayPauseButton, NSMakeRect(center, top - kButtonSize, kButtonSize, kButtonSize));
     [_playButton setTarget:self];
-    [_playButton setAction:@selector(playingChanged:)];
+    [_playButton setAction:@selector(togglePlaying:)];
     [contentView addSubview:_playButton];
 
     CGFloat closeToRight = windowWidth - 2 * kMargin - kButtonMiniSize;
@@ -324,6 +355,8 @@ static NSTextField *createTimeTextField(NSRect frame)
     CGFloat left = kMargin;
     NSControl *volumeDownButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeDownButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
     [contentView addSubview:volumeDownButton];
+    [volumeDownButton setTarget:self];
+    [volumeDownButton setAction:@selector(decrementVolume:)];
     [volumeDownButton release];
 
     static const int volumeSliderWidth = 50;
@@ -336,9 +369,11 @@ static NSTextField *createTimeTextField(NSRect frame)
     [contentView addSubview:_volumeSlider];
 
     left = kMargin + kButtonMiniSize + volumeSliderWidth + kButtonMiniSize / 2;
-    NSControl *button = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
-    [contentView addSubview:button];
-    [button release];
+    NSControl *volumeUpButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    [volumeUpButton setTarget:self];
+    [volumeUpButton setAction:@selector(incrementVolume:)];
+    [contentView addSubview:volumeUpButton];
+    [volumeUpButton release];
     
     static const int timeTextWidth = 50;
     static const int sliderHeight = 13;
@@ -426,6 +461,24 @@ static NSTextField *createTimeTextField(NSRect frame)
     [self setVolume:[_volumeSlider doubleValue]];
 }
 
+- (void)decrementVolume:(id)sender
+{
+    if (![_delegate mediaElement])
+        return;
+
+    double volume = [self volume] - 10;
+    [self setVolume:max(volume, 0.)];
+}
+
+- (void)incrementVolume:(id)sender
+{
+    if (![_delegate mediaElement])
+        return;
+
+    double volume = [self volume] + 10;
+    [self setVolume:min(volume, [self maxVolume])];
+}
+
 - (double)volume
 {
     return [_delegate mediaElement] ? [_delegate mediaElement]->volume() * [self maxVolume] : 0;
@@ -436,15 +489,23 @@ static NSTextField *createTimeTextField(NSRect frame)
     if (![_delegate mediaElement])
         return;
     WebCore::ExceptionCode e;
+    if ([_delegate mediaElement]->muted())
+        [_delegate mediaElement]->setMuted(false);
     [_delegate mediaElement]->setVolume(volume / [self maxVolume], e);
 }
 
-- (void)playingChanged:(id)sender
+- (void)updateRate
 {
-    [self setPlaying:![self playing]];
-    
+    [_playButton setIntValue:[self playing]];
+}
+
+- (void)togglePlaying:(id)sender
+{
+    BOOL nowPlaying = [self playing];
+    [self setPlaying:!nowPlaying];
+
     // Keep HUD visible when paused
-    if (![self playing])
+    if (!nowPlaying)
         [self fadeWindowIn];
     else if (!_mouseIsInHUD) {
         [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(fadeWindowOut) object:nil];
@@ -560,6 +621,9 @@ static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment al
 
 - (void)exitFullscreen:(id)sender
 {
+    if (_isEndingFullscreen)
+        return;
+    _isEndingFullscreen = YES;
     [_delegate requestExitFullscreen]; 
 }
 
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 83c7e20..25da631 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -34,6 +34,7 @@
 #import "DOMNodeInternal.h"
 #import "DOMRangeInternal.h"
 #import "WebBackForwardListInternal.h"
+#import "WebBaseNetscapePluginView.h"
 #import "WebCache.h"
 #import "WebChromeClient.h"
 #import "WebContextMenuClient.h"
@@ -124,6 +125,7 @@
 #import <WebCore/PageGroup.h>
 #import <WebCore/PlatformMouseEvent.h>
 #import <WebCore/ProgressTracker.h>
+#import <WebCore/RenderWidget.h>
 #import <WebCore/ResourceHandle.h>
 #import <WebCore/RuntimeApplicationChecks.h>
 #import <WebCore/ScriptController.h>
@@ -158,12 +160,6 @@
 #import <WebKit/WebDashboardRegion.h>
 #endif
 
-@class NSTextInputContext;
-
-@interface NSResponder (WebNSResponderDetails)
-- (NSTextInputContext *)inputContext;
-@end
-
 @interface NSSpellChecker (WebNSSpellCheckerDetails)
 - (void)_preflightChosenSpellServer;
 @end
@@ -330,19 +326,10 @@ macro(yankAndSelect) \
 static BOOL s_didSetCacheModel;
 static WebCacheModel s_cacheModel = WebCacheModelDocumentViewer;
 
-static WebView *lastMouseoverView;
-
 #ifndef NDEBUG
 static const char webViewIsOpen[] = "At least one WebView is still open.";
 #endif
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-@interface NSObject (NSTextInputContextDetails)
-- (BOOL)wantsToHandleMouseEvents;
-- (BOOL)handleMouseEvent:(NSEvent *)event;
-@end
-#endif
-
 @interface NSObject (WebValidateWithoutDelegate)
 - (BOOL)validateUserInterfaceItemWithoutDelegate:(id <NSValidatedUserInterfaceItem>)item;
 @end
@@ -357,7 +344,6 @@ static const char webViewIsOpen[] = "At least one WebView is still open.";
 @end
 
 @interface WebView (WebFileInternal)
-- (WebFrame *)_selectedOrMainFrame;
 - (BOOL)_isLoading;
 - (WebFrameView *)_frameViewAtWindowPoint:(NSPoint)point;
 - (WebFrame *)_focusedFrame;
@@ -985,8 +971,7 @@ static bool fastDocumentTeardownEnabled()
     if (!_private || _private->closed)
         return;
 
-    if (lastMouseoverView == self)
-        lastMouseoverView = nil;
+    [self _closingEventHandling];
 
 #ifndef NDEBUG
     WTF::RefCountedLeakCounter::cancelMessageSuppression(webViewIsOpen);
@@ -1187,7 +1172,7 @@ static bool fastDocumentTeardownEnabled()
             // If this item is showing , save away its current scroll and form state,
             // since that might have changed since loading and it is normally not saved
             // until we leave that page.
-            otherView->_private->page->mainFrame()->loader()->saveDocumentAndScrollState();
+            otherView->_private->page->mainFrame()->loader()->history()->saveDocumentAndScrollState();
         }
         RefPtr<HistoryItem> newItem = otherBackForwardList->itemAtIndex(i)->copy();
         if (i == 0) 
@@ -1282,7 +1267,6 @@ static bool fastDocumentTeardownEnabled()
     settings->setDatabasesEnabled([preferences databasesEnabled]);
     settings->setLocalStorageEnabled([preferences localStorageEnabled]);
     settings->setExperimentalNotificationsEnabled([preferences experimentalNotificationsEnabled]);
-    settings->setExperimentalWebSocketsEnabled([preferences experimentalWebSocketsEnabled]);
     settings->setPrivateBrowsingEnabled([preferences privateBrowsingEnabled]);
     settings->setSansSerifFontFamily([preferences sansSerifFontFamily]);
     settings->setSerifFontFamily([preferences serifFontFamily]);
@@ -1317,7 +1301,6 @@ static bool fastDocumentTeardownEnabled()
     settings->setXSSAuditorEnabled([preferences isXSSAuditorEnabled]);
     settings->setEnforceCSSMIMETypeInStrictMode(!WKAppVersionCheckLessThan(@"com.apple.iWeb", -1, 2.1));
     settings->setAcceleratedCompositingEnabled([preferences acceleratedCompositingEnabled]);
-    settings->setPluginHalterEnabled([preferences pluginHalterEnabled]);
     settings->setPluginAllowedRunTime([preferences pluginAllowedRunTime]);
     settings->setWebGLEnabled([preferences webGLEnabled]);
 }
@@ -1421,6 +1404,7 @@ static inline IMP getMethod(id o, SEL s)
     cache->clientRedirectFunc = getMethod(delegate, @selector(webView:didPerformClientRedirectFromURL:toURL:inFrame:));
     cache->serverRedirectFunc = getMethod(delegate, @selector(webView:didPerformServerRedirectFromURL:toURL:inFrame:));
     cache->setTitleFunc = getMethod(delegate, @selector(webView:updateHistoryTitle:forURL:));
+    cache->populateVisitedLinksFunc = getMethod(delegate, @selector(populateVisitedLinksForWebView:));
 }
 
 - (id)_policyDelegateForwarder
@@ -2114,6 +2098,47 @@ static inline IMP getMethod(id o, SEL s)
 #endif
 }
 
+static WebBaseNetscapePluginView *_pluginViewForNode(DOMNode *node)
+{
+    if (!node)
+        return nil;
+    
+    Node* coreNode = core(node);
+    if (!coreNode)
+        return nil;
+    
+    RenderObject* renderer = coreNode->renderer();
+    if (!renderer || !renderer->isWidget())
+        return nil;
+    
+    Widget* widget = toRenderWidget(renderer)->widget();
+    if (!widget || !widget->platformWidget())
+        return nil;
+    
+    NSView *view = widget->platformWidget();
+    if (![view isKindOfClass:[WebBaseNetscapePluginView class]])
+        return nil;
+    
+    return (WebBaseNetscapePluginView *)view;
+}
+
++ (BOOL)_isNodeHaltedPlugin:(DOMNode *)node
+{
+    return [_pluginViewForNode(node) isHalted];
+}
+
++ (BOOL)_hasPluginForNodeBeenHalted:(DOMNode *)node
+{
+    return [_pluginViewForNode(node) hasBeenHalted];
+}
++ (void)_restartHaltedPluginForNode:(DOMNode *)node
+{
+    if (!node)
+        return;
+    
+    [_pluginViewForNode(node) resumeFromHalt];
+}
+
 - (NSPasteboard *)_insertionPasteboard
 {
     return _private ? _private->insertionPasteboard : nil;
@@ -2150,7 +2175,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     return patternsVector;
 }
 
-+ (void)_addUserScriptToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID 
++ (void)_addUserScriptToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url
                     whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime
 {
     String group(groupName);
@@ -2161,11 +2186,11 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
     
-    pageGroup->addUserScript(source, url, toStringVector(whitelist), toStringVector(blacklist), worldID, 
-                             injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
+    pageGroup->addUserScriptToWorld(worldID, source, url, toStringVector(whitelist), toStringVector(blacklist), 
+                                    injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
 }
 
-+ (void)_addUserStyleSheetToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url
                         whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist
 {
     String group(groupName);
@@ -2176,10 +2201,23 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->addUserStyleSheet(source, url, toStringVector(whitelist), toStringVector(blacklist), worldID);
+    pageGroup->addUserStyleSheetToWorld(worldID, source, url, toStringVector(whitelist), toStringVector(blacklist));
+}
+
++ (void)_removeUserScriptFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->removeUserScriptFromWorld(worldID, url);
 }
 
-+ (void)_removeUserContentFromGroup:(NSString *)groupName url:(NSURL *)url worldID:(unsigned)worldID
++ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2189,10 +2227,10 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserContentWithURLForWorld(url, worldID);
+    pageGroup->removeUserStyleSheetFromWorld(worldID, url);
 }
 
-+ (void)_removeUserContentFromGroup:(NSString *)groupName worldID:(unsigned)worldID
++ (void)_removeUserScriptsFromGroup:(NSString *)groupName worldID:(unsigned)worldID
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2202,7 +2240,20 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserContentForWorld(worldID);
+    pageGroup->removeUserScriptsFromWorld(worldID);
+}
+
++ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName worldID:(unsigned)worldID
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->removeUserStyleSheetsFromWorld(worldID);
 }
 
 + (void)_removeAllUserContentFromGroup:(NSString *)groupName
@@ -3569,87 +3620,6 @@ static WebFrame *incrementFrame(WebFrame *frame, BOOL forward, BOOL wrapFlag)
     return [previousView previousValidKeyView];
 }
 
-- (void)mouseDown:(NSEvent *)event
-{
-    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
-    // do the same work in the usesDocumentViews case. We don't want to maintain two
-    // duplicate copies of this method.
-
-    if (_private->usesDocumentViews) {
-        [super mouseDown:event];
-        return;
-    }
-    
-    // There's a chance that responding to this event will run a nested event loop, and
-    // fetching a new event might release the old one. Retaining and then autoreleasing
-    // the current event prevents that from causing a problem inside WebKit or AppKit code.
-    [[event retain] autorelease];
-
-    RetainPtr<WebView> protector = self;
-    if ([[self inputContext] wantsToHandleMouseEvents] && [[self inputContext] handleMouseEvent:event])
-        return;
-
-    _private->handlingMouseDownEvent = YES;
-
-    // Record the mouse down position so we can determine drag hysteresis.
-    [self _setMouseDownEvent:event];
-
-    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
-    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
-        goto done;
-
-    [_private->completionController endRevertingChange:NO moveLeft:NO];
-
-    // If the web page handles the context menu event and menuForEvent: returns nil, we'll get control click events here.
-    // We don't want to pass them along to KHTML a second time.
-    if (!([event modifierFlags] & NSControlKeyMask)) {
-        _private->ignoringMouseDraggedEvents = NO;
-
-        // Don't do any mouseover while the mouse is down.
-        [self _cancelUpdateMouseoverTimer];
-
-        // Let WebCore get a chance to deal with the event. This will call back to us
-        // to start the autoscroll timer if appropriate.
-        if (Frame* frame = [self _mainCoreFrame])
-            frame->eventHandler()->mouseDown(event);
-    }
-
-done:
-    _private->handlingMouseDownEvent = NO;
-}
-
-- (void)mouseUp:(NSEvent *)event
-{
-    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
-    // do the same work in the usesDocumentViews case. We don't want to maintain two
-    // duplicate copies of this method.
-
-    if (_private->usesDocumentViews) {
-        [super mouseUp:event];
-        return;
-    }
-
-    // There's a chance that responding to this event will run a nested event loop, and
-    // fetching a new event might release the old one. Retaining and then autoreleasing
-    // the current event prevents that from causing a problem inside WebKit or AppKit code.
-    [[event retain] autorelease];
-
-    [self _setMouseDownEvent:nil];
-
-    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
-    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
-        return;
-
-    [self retain];
-
-    [self _stopAutoscrollTimer];
-    if (Frame* frame = [self _mainCoreFrame])
-        frame->eventHandler()->mouseUp(event);
-    [self _updateMouseoverWithFakeEvent];
-
-    [self release];
-}
-
 @end
 
 @implementation WebView (WebIBActions)
@@ -4051,9 +4021,8 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
         JSObject* object = jsValue.getObject();
         if (object->inherits(&DateInstance::info)) {
             DateInstance* date = static_cast<DateInstance*>(object);
-            double ms = 0;
-            int tzOffset = 0;
-            if (date->getTime(ms, tzOffset)) {
+            double ms = date->internalNumber();
+            if (!isnan(ms)) {
                 CFAbsoluteTime utcSeconds = ms / 1000 - kCFAbsoluteTimeIntervalSince1970;
                 LongDateTime ldt;
                 if (noErr == UCConvertCFAbsoluteTimeToLongDateTime(utcSeconds, &ldt))
@@ -4095,11 +4064,11 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
         return nil;
     if (!coreFrame->document())
         return nil;
-    JSValue result = coreFrame->loader()->executeScript(script, true).jsValue();
+    JSValue result = coreFrame->script()->executeScript(script, true).jsValue();
     if (!result) // FIXME: pass errors
         return 0;
     JSLock lock(SilenceAssertionsOnly);
-    return aeDescFromJSValue(coreFrame->script()->globalObject()->globalExec(), result);
+    return aeDescFromJSValue(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec(), result);
 }
 
 - (BOOL)canMarkAllTextMatches
@@ -4257,6 +4226,24 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
     return _private->page->mediaVolume();
 }
 
+- (void)addVisitedLinks:(NSArray *)visitedLinks
+{
+    PageGroup& group = core(self)->group();
+    
+    NSEnumerator *enumerator = [visitedLinks objectEnumerator];
+    while (NSString *url = [enumerator nextObject]) {
+        size_t length = [url length];
+        const UChar* characters = CFStringGetCharactersPtr(reinterpret_cast<CFStringRef>(url));
+        if (characters)
+            group.addVisitedLink(characters, length);
+        else {
+            Vector<UChar, 512> buffer(length);
+            [url getCharacters:buffer.data()];
+            group.addVisitedLink(buffer.data(), length);
+        }
+    }
+}
+
 @end
 
 @implementation WebView (WebViewPrintingPrivate)
@@ -5123,14 +5110,6 @@ static WebFrameView *containingFrameView(NSView *view)
     return nil;
 }
 
-- (WebFrame *)_selectedOrMainFrame
-{
-    WebFrame *result = [self selectedFrame];
-    if (result == nil)
-        result = [self mainFrame];
-    return result;
-}
-
 - (BOOL)_isLoading
 {
     WebFrame *mainFrame = [self mainFrame];
@@ -5401,102 +5380,6 @@ static WebFrameView *containingFrameView(NSView *view)
     _private->insertionPasteboard = pasteboard;
 }
 
-- (void)_setMouseDownEvent:(NSEvent *)event
-{
-    ASSERT(!event || [event type] == NSLeftMouseDown || [event type] == NSRightMouseDown || [event type] == NSOtherMouseDown);
-
-    if (event == _private->mouseDownEvent)
-        return;
-
-    [event retain];
-    [_private->mouseDownEvent release];
-    _private->mouseDownEvent = event;
-}
-
-- (void)_cancelUpdateMouseoverTimer
-{
-    if (_private->updateMouseoverTimer) {
-        CFRunLoopTimerInvalidate(_private->updateMouseoverTimer);
-        CFRelease(_private->updateMouseoverTimer);
-        _private->updateMouseoverTimer = NULL;
-    }
-}
-
-- (void)_stopAutoscrollTimer
-{
-    NSTimer *timer = _private->autoscrollTimer;
-    _private->autoscrollTimer = nil;
-    [_private->autoscrollTriggerEvent release];
-    _private->autoscrollTriggerEvent = nil;
-    [timer invalidate];
-    [timer release];
-}
-
-+ (void)_updateMouseoverWithEvent:(NSEvent *)event
-{
-    WebView *oldView = lastMouseoverView;
-
-    lastMouseoverView = nil;
-
-    NSView *contentView = [[event window] contentView];
-    NSPoint locationForHitTest = [[contentView superview] convertPoint:[event locationInWindow] fromView:nil];
-    for (NSView *hitView = [contentView hitTest:locationForHitTest]; hitView; hitView = [hitView superview]) {
-        if ([hitView isKindOfClass:[WebView class]]) {
-            lastMouseoverView = static_cast<WebView *>(hitView);
-            break;
-        }
-    }
-
-    if (lastMouseoverView && lastMouseoverView->_private->hoverFeedbackSuspended)
-        lastMouseoverView = nil;
-
-    if (lastMouseoverView != oldView) {
-        if (Frame* oldCoreFrame = [oldView _mainCoreFrame]) {
-            NSEvent *oldViewEvent = [NSEvent mouseEventWithType:NSMouseMoved
-                location:NSMakePoint(-1, -1)
-                modifierFlags:[[NSApp currentEvent] modifierFlags]
-                timestamp:[NSDate timeIntervalSinceReferenceDate]
-                windowNumber:[[oldView window] windowNumber]
-                context:[[NSApp currentEvent] context]
-                eventNumber:0 clickCount:0 pressure:0];
-            oldCoreFrame->eventHandler()->mouseMoved(oldViewEvent);
-        }
-    }
-
-    if (!lastMouseoverView)
-        return;
-
-    if (Frame* coreFrame = core([lastMouseoverView mainFrame]))
-        coreFrame->eventHandler()->mouseMoved(event);
-}
-
-- (void)_updateMouseoverWithFakeEvent
-{
-    [self _cancelUpdateMouseoverTimer];
-    
-    NSEvent *fakeEvent = [NSEvent mouseEventWithType:NSMouseMoved
-        location:[[self window] convertScreenToBase:[NSEvent mouseLocation]]
-        modifierFlags:[[NSApp currentEvent] modifierFlags]
-        timestamp:[NSDate timeIntervalSinceReferenceDate]
-        windowNumber:[[self window] windowNumber]
-        context:[[NSApp currentEvent] context]
-        eventNumber:0 clickCount:0 pressure:0];
-    
-    [[self class] _updateMouseoverWithEvent:fakeEvent];
-}
-
-- (void)_setToolTip:(NSString *)toolTip
-{
-    if (_private->usesDocumentViews) {
-        id documentView = [[[self _selectedOrMainFrame] frameView] documentView];
-        if ([documentView isKindOfClass:[WebHTMLView class]])
-            [documentView _setToolTip:toolTip];
-        return;
-    }
-
-    // FIXME (Viewless): Code to handle tooltips needs to move into WebView.
-}
-
 - (void)_selectionChanged
 {
     if (_private->usesDocumentViews) {
@@ -5514,6 +5397,14 @@ static WebFrameView *containingFrameView(NSView *view)
     return (_private && _private->page) ? _private->page->mainFrame() : 0;
 }
 
+- (WebFrame *)_selectedOrMainFrame
+{
+    WebFrame *result = [self selectedFrame];
+    if (result == nil)
+        result = [self mainFrame];
+    return result;
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 
 - (BOOL)_needsOneShotDrawingSynchronization
@@ -5653,6 +5544,8 @@ static void layerSyncRunLoopObserverCallBack(CFRunLoopObserverRef, CFRunLoopActi
 
 - (void)_exitFullscreen
 {
+    if (!_private->fullscreenController)
+        return;
     [_private->fullscreenController exitFullscreen];
     [_private->fullscreenController release];
     _private->fullscreenController = nil;
diff --git a/WebKit/mac/WebView/WebViewEventHandling.mm b/WebKit/mac/WebView/WebViewEventHandling.mm
new file mode 100644
index 0000000..a185667
--- /dev/null
+++ b/WebKit/mac/WebView/WebViewEventHandling.mm
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 David Smith (catfish.man@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebViewInternal.h"
+
+#import "WebFrameInternal.h"
+#import "WebHTMLView.h"
+#import "WebTextCompletionController.h"
+#import "WebViewData.h"
+#import <WebCore/Frame.h>
+
+using namespace WebCore;
+
+@class NSTextInputContext;
+
+@interface NSResponder (WebNSResponderDetails)
+- (NSTextInputContext *)inputContext;
+@end
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+@interface NSObject (NSTextInputContextDetails)
+- (BOOL)wantsToHandleMouseEvents;
+- (BOOL)handleMouseEvent:(NSEvent *)event;
+@end
+#endif
+
+@implementation WebView (WebViewEventHandling)
+
+static WebView *lastMouseoverView;
+
+- (void)_closingEventHandling
+{
+    if (lastMouseoverView == self)
+        lastMouseoverView = nil;
+}
+
+- (void)_setMouseDownEvent:(NSEvent *)event
+{
+    ASSERT(!event || [event type] == NSLeftMouseDown || [event type] == NSRightMouseDown || [event type] == NSOtherMouseDown);
+
+    if (event == _private->mouseDownEvent)
+        return;
+
+    [event retain];
+    [_private->mouseDownEvent release];
+    _private->mouseDownEvent = event;
+}
+
+- (void)mouseDown:(NSEvent *)event
+{
+    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
+    // do the same work in the usesDocumentViews case. We don't want to maintain two
+    // duplicate copies of this method.
+
+    if (_private->usesDocumentViews) {
+        [super mouseDown:event];
+        return;
+    }
+    
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[event retain] autorelease];
+
+    RetainPtr<WebView> protector = self;
+    if ([[self inputContext] wantsToHandleMouseEvents] && [[self inputContext] handleMouseEvent:event])
+        return;
+
+    _private->handlingMouseDownEvent = YES;
+
+    // Record the mouse down position so we can determine drag hysteresis.
+    [self _setMouseDownEvent:event];
+
+    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
+    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
+        goto done;
+
+    [_private->completionController endRevertingChange:NO moveLeft:NO];
+
+    // If the web page handles the context menu event and menuForEvent: returns nil, we'll get control click events here.
+    // We don't want to pass them along to KHTML a second time.
+    if (!([event modifierFlags] & NSControlKeyMask)) {
+        _private->ignoringMouseDraggedEvents = NO;
+
+        // Don't do any mouseover while the mouse is down.
+        [self _cancelUpdateMouseoverTimer];
+
+        // Let WebCore get a chance to deal with the event. This will call back to us
+        // to start the autoscroll timer if appropriate.
+        if (Frame* frame = [self _mainCoreFrame])
+            frame->eventHandler()->mouseDown(event);
+    }
+
+done:
+    _private->handlingMouseDownEvent = NO;
+}
+
+- (void)mouseUp:(NSEvent *)event
+{
+    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
+    // do the same work in the usesDocumentViews case. We don't want to maintain two
+    // duplicate copies of this method.
+
+    if (_private->usesDocumentViews) {
+        [super mouseUp:event];
+        return;
+    }
+
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[event retain] autorelease];
+
+    [self _setMouseDownEvent:nil];
+
+    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
+    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
+        return;
+
+    [self retain];
+
+    [self _stopAutoscrollTimer];
+    if (Frame* frame = [self _mainCoreFrame])
+        frame->eventHandler()->mouseUp(event);
+    [self _updateMouseoverWithFakeEvent];
+
+    [self release];
+}
+
++ (void)_updateMouseoverWithEvent:(NSEvent *)event
+{
+    WebView *oldView = lastMouseoverView;
+
+    lastMouseoverView = nil;
+
+    NSView *contentView = [[event window] contentView];
+    NSPoint locationForHitTest = [[contentView superview] convertPoint:[event locationInWindow] fromView:nil];
+    for (NSView *hitView = [contentView hitTest:locationForHitTest]; hitView; hitView = [hitView superview]) {
+        if ([hitView isKindOfClass:[WebView class]]) {
+            lastMouseoverView = static_cast<WebView *>(hitView);
+            break;
+        }
+    }
+
+    if (lastMouseoverView && lastMouseoverView->_private->hoverFeedbackSuspended)
+        lastMouseoverView = nil;
+
+    if (lastMouseoverView != oldView) {
+        if (Frame* oldCoreFrame = [oldView _mainCoreFrame]) {
+            NSEvent *oldViewEvent = [NSEvent mouseEventWithType:NSMouseMoved
+                location:NSMakePoint(-1, -1)
+                modifierFlags:[[NSApp currentEvent] modifierFlags]
+                timestamp:[NSDate timeIntervalSinceReferenceDate]
+                windowNumber:[[oldView window] windowNumber]
+                context:[[NSApp currentEvent] context]
+                eventNumber:0 clickCount:0 pressure:0];
+            oldCoreFrame->eventHandler()->mouseMoved(oldViewEvent);
+        }
+    }
+
+    if (!lastMouseoverView)
+        return;
+
+    if (Frame* coreFrame = core([lastMouseoverView mainFrame]))
+        coreFrame->eventHandler()->mouseMoved(event);
+}
+
+- (void)_updateMouseoverWithFakeEvent
+{
+    [self _cancelUpdateMouseoverTimer];
+    
+    NSEvent *fakeEvent = [NSEvent mouseEventWithType:NSMouseMoved
+        location:[[self window] convertScreenToBase:[NSEvent mouseLocation]]
+        modifierFlags:[[NSApp currentEvent] modifierFlags]
+        timestamp:[NSDate timeIntervalSinceReferenceDate]
+        windowNumber:[[self window] windowNumber]
+        context:[[NSApp currentEvent] context]
+        eventNumber:0 clickCount:0 pressure:0];
+    
+    [[self class] _updateMouseoverWithEvent:fakeEvent];
+}
+
+- (void)_cancelUpdateMouseoverTimer
+{
+    if (_private->updateMouseoverTimer) {
+        CFRunLoopTimerInvalidate(_private->updateMouseoverTimer);
+        CFRelease(_private->updateMouseoverTimer);
+        _private->updateMouseoverTimer = NULL;
+    }
+}
+
+- (void)_stopAutoscrollTimer
+{
+    NSTimer *timer = _private->autoscrollTimer;
+    _private->autoscrollTimer = nil;
+    [_private->autoscrollTriggerEvent release];
+    _private->autoscrollTriggerEvent = nil;
+    [timer invalidate];
+    [timer release];
+}
+
+- (void)_setToolTip:(NSString *)toolTip
+{
+    if (_private->usesDocumentViews) {
+        id documentView = [[[self _selectedOrMainFrame] frameView] documentView];
+        if ([documentView isKindOfClass:[WebHTMLView class]])
+            [documentView _setToolTip:toolTip];
+        return;
+    }
+
+    // FIXME (Viewless): Code to handle tooltips needs to move into WebView.
+}
+
+@end
diff --git a/WebKit/mac/WebView/WebViewInternal.h b/WebKit/mac/WebView/WebViewInternal.h
index 521aeee..15596db 100644
--- a/WebKit/mac/WebView/WebViewInternal.h
+++ b/WebKit/mac/WebView/WebViewInternal.h
@@ -65,6 +65,7 @@ namespace WebCore {
 @interface WebView (WebViewInternal)
 
 - (WebCore::Frame*)_mainCoreFrame;
+- (WebFrame *)_selectedOrMainFrame;
 
 - (WebCore::String)_userAgentForURL:(const WebCore::KURL&)url;
 - (WebCore::KeyboardUIMode)_keyboardUIMode;
@@ -76,12 +77,7 @@ namespace WebCore {
 - (void)_dispatchDidReceiveIconFromWebFrame:(WebFrame *)webFrame;
 #endif
 
-- (void)_setMouseDownEvent:(NSEvent *)event;
-- (void)_cancelUpdateMouseoverTimer;
-- (void)_stopAutoscrollTimer;
-- (void)_updateMouseoverWithFakeEvent;
 - (void)_selectionChanged;
-- (void)_setToolTip:(NSString *)toolTip;
 
 #if USE(ACCELERATED_COMPOSITING)
 - (BOOL)_needsOneShotDrawingSynchronization;
@@ -95,6 +91,14 @@ namespace WebCore {
 
 #endif
 
+@interface WebView (WebViewEventHandling)
+- (void)_closingEventHandling;
+- (void)_updateMouseoverWithFakeEvent;
+- (void)_cancelUpdateMouseoverTimer;
+- (void)_stopAutoscrollTimer;
+- (void)_setToolTip:(NSString *)toolTip;
+@end
+
 // FIXME: Temporary way to expose methods that are in the wrong category inside WebView.
 @interface WebView (WebViewOtherInternal)
 
diff --git a/WebKit/mac/WebView/WebViewPrivate.h b/WebKit/mac/WebView/WebViewPrivate.h
index fa5d28c..99bd5fa 100644
--- a/WebKit/mac/WebView/WebViewPrivate.h
+++ b/WebKit/mac/WebView/WebViewPrivate.h
@@ -200,6 +200,9 @@ typedef enum {
 - (void)setMediaVolume:(float)volume;
 - (float)mediaVolume;
 
+// Add visited links
+- (void)addVisitedLinks:(NSArray *)visitedLinks;
+
 @end
 
 @interface WebView (WebPrivate)
@@ -459,6 +462,11 @@ Could be worth adding to the API.
 // SPI for DumpRenderTree
 - (BOOL)_isUsingAcceleratedCompositing;
 
+// SPI for PluginHalter
++ (BOOL)_isNodeHaltedPlugin:(DOMNode *)node;
++ (BOOL)_hasPluginForNodeBeenHalted:(DOMNode *)node;
++ (void)_restartHaltedPluginForNode:(DOMNode *)node;
+
 // Which pasteboard text is coming from in editing delegate methods such as shouldInsertNode.
 - (NSPasteboard *)_insertionPasteboard;
 
@@ -471,10 +479,12 @@ Could be worth adding to the API.
 // Removes all white list entries created with _whiteListAccessFromOrigin.
 + (void)_resetOriginAccessWhiteLists;
 
-+ (void)_addUserScriptToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
-+ (void)_addUserStyleSheetToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
-+ (void)_removeUserContentFromGroup:(NSString *)groupName url:(NSURL *)url worldID:(unsigned)worldID;
-+ (void)_removeUserContentFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
++ (void)_addUserScriptToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
++ (void)_removeUserScriptFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url;
++ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url;
++ (void)_removeUserScriptsFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
++ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
 + (void)_removeAllUserContentFromGroup:(NSString *)groupName;
 
 /*!
diff --git a/WebKit/mac/WebView/WebWindowAnimation.h b/WebKit/mac/WebView/WebWindowAnimation.h
index c73dcce..ecf975b 100644
--- a/WebKit/mac/WebView/WebWindowAnimation.h
+++ b/WebKit/mac/WebView/WebWindowAnimation.h
@@ -46,7 +46,7 @@
 @interface WebWindowFadeAnimation : NSAnimation {
 @private
     CGFloat _initialAlpha, _finalAlpha;
-    NSWindow *_window; // (retain)
+    NSWindow *_window; // (assign)
     BOOL _isStopped;
     
 }
diff --git a/WebKit/mac/WebView/WebWindowAnimation.m b/WebKit/mac/WebView/WebWindowAnimation.m
index 3ab64bf..6eadb21 100644
--- a/WebKit/mac/WebView/WebWindowAnimation.m
+++ b/WebKit/mac/WebView/WebWindowAnimation.m
@@ -80,7 +80,6 @@ static CGFloat squaredDistance(NSPoint point1, NSPoint point2)
 
 - (void) dealloc
 {
-    [_window release];
     [_subAnimation release];
     [super dealloc];
 }