Merge commit 'goog/master' into merge

Conflicts:
	WebCore/bindings/v8/ScriptController.cpp
	WebCore/page/Geolocation.cpp
	WebCore/platform/android/GeolocationServiceAndroid.cpp

13 files changed, 381 insertions, 70 deletions

diff --git a/WebKit/Android.mk b/WebKit/Android.mk
index 784326c..c309910 100644
--- a/WebKit/Android.mk
+++ b/WebKit/Android.mk
@@ -36,6 +36,7 @@ LOCAL_SRC_FILES := \
 	android/jni/GeolocationPermissionsBridge.cpp \
 	android/jni/JavaBridge.cpp \
 	android/jni/JavaSharedClient.cpp \
+	android/jni/MockGeolocation.cpp \
 	android/jni/PictureSet.cpp \
 	android/jni/WebCoreFrameBridge.cpp \
 	android/jni/WebCoreJni.cpp \
diff --git a/WebKit/android/TimeCounter.cpp b/WebKit/android/TimeCounter.cpp
index 5f69cf6..7abc113 100644
--- a/WebKit/android/TimeCounter.cpp
+++ b/WebKit/android/TimeCounter.cpp
@@ -65,6 +65,8 @@ uint32_t TimeCounter::sCounter[TimeCounter::TotalTimeCounterCount];
 uint32_t TimeCounter::sLastCounter[TimeCounter::TotalTimeCounterCount];
 uint32_t TimeCounter::sStartTime[TimeCounter::TotalTimeCounterCount];
 
+int QemuTracerAuto::reentry_count = 0;
+
 static const char* timeCounterNames[] = {
     "css parsing", 
     "javascript",
diff --git a/WebKit/android/TimeCounter.h b/WebKit/android/TimeCounter.h
index c78d10f..29c3eb9 100644
--- a/WebKit/android/TimeCounter.h
+++ b/WebKit/android/TimeCounter.h
@@ -28,6 +28,7 @@
 
 #ifdef ANDROID_INSTRUMENT
 
+#include "hardware_legacy/qemu_tracing.h"
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
@@ -95,6 +96,23 @@ private:
     uint32_t m_startTime;
 };
 
+class QemuTracerAuto {
+public:
+    QemuTracerAuto() {
+        if (!reentry_count)
+            qemu_start_tracing();
+        reentry_count++;
+    }
+
+    ~QemuTracerAuto() {
+        reentry_count--;
+        if (!reentry_count)
+            qemu_stop_tracing();
+    }
+private:
+    static int reentry_count;
+};
+
 }
 #endif
 
diff --git a/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp b/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp
index 4918ee9..d2e45ff 100644
--- a/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp
+++ b/WebKit/android/WebCoreSupport/EditorClientAndroid.cpp
@@ -36,6 +36,7 @@
 #include "NotImplemented.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformString.h"
+#include "WebViewCore.h"
 
 namespace android {
     
@@ -225,8 +226,23 @@ void EditorClientAndroid::textDidChangeInTextArea(Element*) {}
 void EditorClientAndroid::textDidChangeInTextField(Element*) {}
 void EditorClientAndroid::textFieldDidBeginEditing(Element*) {}
 void EditorClientAndroid::ignoreWordInSpellDocument(String const&) {}
-void EditorClientAndroid::respondToChangedSelection() {}
-bool EditorClientAndroid::shouldChangeSelectedRange(Range*, Range*, EAffinity, bool) { return m_notFromClick; }
+
+// We need to pass the selection up to the WebTextView
+void EditorClientAndroid::respondToChangedSelection() {
+    if (m_uiGeneratedSelectionChange)
+        return;
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame || !frame->view())
+        return;
+    WebViewCore* webViewCore = WebViewCore::getWebViewCore(frame->view());
+    webViewCore->updateTextSelection();
+}
+
+bool EditorClientAndroid::shouldChangeSelectedRange(Range*, Range*, EAffinity,
+        bool) {
+    return m_shouldChangeSelectedRange;
+}
+
 bool EditorClientAndroid::doTextFieldCommandFromEvent(Element*, KeyboardEvent*) { return false; }
 void EditorClientAndroid::textWillBeDeletedInTextField(Element*) {}
 void EditorClientAndroid::updateSpellingUIWithGrammarString(String const&, GrammarDetail const&) {}
diff --git a/WebKit/android/WebCoreSupport/EditorClientAndroid.h b/WebKit/android/WebCoreSupport/EditorClientAndroid.h
index 9697d66..3569f10 100644
--- a/WebKit/android/WebCoreSupport/EditorClientAndroid.h
+++ b/WebKit/android/WebCoreSupport/EditorClientAndroid.h
@@ -35,7 +35,10 @@ namespace android {
 
 class EditorClientAndroid : public EditorClient {
 public:
-    EditorClientAndroid() { m_notFromClick = true; }
+    EditorClientAndroid() {
+        m_shouldChangeSelectedRange = true;
+        m_uiGeneratedSelectionChange = false;
+    }
     virtual void pageDestroyed();
     
     virtual bool shouldDeleteRange(Range*);
@@ -105,10 +108,12 @@ public:
 
     // Android specific:
     void setPage(Page* page) { m_page = page; }
-    void setFromClick(bool fromClick) { m_notFromClick = !fromClick; }
+    void setShouldChangeSelectedRange(bool shouldChangeSelectedRange) { m_shouldChangeSelectedRange = shouldChangeSelectedRange; }
+    void setUiGeneratedSelectionChange(bool uiGenerated) { m_uiGeneratedSelectionChange = uiGenerated; }
 private:
     Page* m_page;
-    bool  m_notFromClick;
+    bool  m_shouldChangeSelectedRange;
+    bool  m_uiGeneratedSelectionChange;
 };
 
 }
diff --git a/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp b/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp
index 14e34fd..103dc4b 100644
--- a/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp
+++ b/WebKit/android/WebCoreSupport/FrameLoaderClientAndroid.cpp
@@ -426,9 +426,15 @@ static bool TreatAsAttachment(const String& content_disposition) {
 }
 
 void FrameLoaderClientAndroid::dispatchDecidePolicyForMIMEType(FramePolicyFunction func,
-                                const String& MIMEType, const ResourceRequest&) {
+                                const String& MIMEType, const ResourceRequest& request) {
     ASSERT(m_frame);
     ASSERT(func);
+    if (!func)
+        return;
+    if (request.isNull()) {
+        (m_frame->loader()->*func)(PolicyIgnore);
+        return;
+    }
     // Default to Use (display internally).
     PolicyAction action = PolicyUse;
     // Check if we should Download instead.
@@ -461,13 +467,20 @@ void FrameLoaderClientAndroid::dispatchDecidePolicyForMIMEType(FramePolicyFuncti
 }
 
 void FrameLoaderClientAndroid::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction func,
-                                const NavigationAction&, const ResourceRequest& req, 
+                                const NavigationAction&, const ResourceRequest& request,
                                 PassRefPtr<FormState> formState, const String& frameName) {
     ASSERT(m_frame);
+    ASSERT(func);
+    if (!func)
+        return;
+    if (request.isNull()) {
+        (m_frame->loader()->*func)(PolicyIgnore);
+        return;
+    }
     // If we get to this point it means that a link has a target that was not
     // found by the frame tree. Instead of creating a new frame, return the
     // current frame in dispatchCreatePage.
-    if (canHandleRequest(req))
+    if (canHandleRequest(request))
         (m_frame->loader()->*func)(PolicyUse);
     else
         (m_frame->loader()->*func)(PolicyIgnore);
@@ -486,6 +499,12 @@ void FrameLoaderClientAndroid::dispatchDecidePolicyForNavigationAction(FramePoli
                                 PassRefPtr<FormState> formState) {
     ASSERT(m_frame);
     ASSERT(func);
+    if (!func)
+        return;
+    if (request.isNull()) {
+        (m_frame->loader()->*func)(PolicyIgnore);
+        return;
+    }
     if (action.type() == NavigationTypeFormResubmitted) {
         m_webFrame->decidePolicyForFormResubmission(func);
         return;
diff --git a/WebKit/android/jni/MockGeolocation.cpp b/WebKit/android/jni/MockGeolocation.cpp
new file mode 100755
index 0000000..2f6ca60
--- /dev/null
+++ b/WebKit/android/jni/MockGeolocation.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// The functions in this file are used to configure the mock GeolocationService
+// for the LayoutTests.
+
+#include "config.h"
+
+#include <JNIHelp.h>
+#include "Coordinates.h"
+#include "GeolocationService.h"
+#include "Geoposition.h"
+#include "JavaSharedClient.h"
+#include "jni_utility.h"
+#include "PositionError.h"
+#include "WebCoreJni.h"
+#include <wtf/CurrentTime.h>
+
+using namespace WebCore;
+
+namespace android {
+
+static const char* javaMockGeolocationClass = "android/webkit/MockGeolocation";
+
+static void setPosition(JNIEnv* env, jobject, double latitude, double longitude, double accuracy)
+{
+    RefPtr<Coordinates> coordinates = Coordinates::create(latitude,
+                                                          longitude,
+                                                          false, 0.0,  // altitude,
+                                                          accuracy,
+                                                          false, 0.0,  // altitudeAccuracy,
+                                                          false, 0.0,  // heading
+                                                          false, 0.0);  // speed
+    RefPtr<Geoposition> position = Geoposition::create(coordinates.release(), WTF::currentTime());
+    GeolocationService::setMockPosition(position.release());
+}
+
+static void setError(JNIEnv* env, jobject, int code, jstring message)
+{
+    PositionError::ErrorCode codeEnum;
+    switch (code) {
+        case PositionError::UNKNOWN_ERROR:
+            codeEnum = PositionError::UNKNOWN_ERROR;
+            break;
+        case PositionError::PERMISSION_DENIED:
+            codeEnum = PositionError::PERMISSION_DENIED;
+            break;
+        case PositionError::POSITION_UNAVAILABLE:
+            codeEnum = PositionError::POSITION_UNAVAILABLE;
+            break;
+        case PositionError::TIMEOUT:
+            codeEnum = PositionError::TIMEOUT;
+            break;
+        default:
+            ASSERT(false);
+    }
+    String messageString = to_string(env, message);
+    RefPtr<PositionError> error = PositionError::create(codeEnum, messageString);
+    GeolocationService::setMockError(error.release());
+}
+
+static JNINativeMethod gMockGeolocationMethods[] = {
+    { "nativeSetPosition", "(DDD)V", (void*) setPosition },
+    { "nativeSetError", "(ILjava/lang/String;)V", (void*) setError }
+};
+
+int register_mock_geolocation(JNIEnv* env)
+{
+    jclass mockGeolocation = env->FindClass(javaMockGeolocationClass);
+    LOG_ASSERT(mockGeolocation, "Unable to find class");
+    return jniRegisterNativeMethods(env, javaMockGeolocationClass, gMockGeolocationMethods, NELEM(gMockGeolocationMethods));
+}
+
+}
diff --git a/WebKit/android/jni/WebCoreFrameBridge.cpp b/WebKit/android/jni/WebCoreFrameBridge.cpp
index d042c92..17b908d 100644
--- a/WebKit/android/jni/WebCoreFrameBridge.cpp
+++ b/WebKit/android/jni/WebCoreFrameBridge.cpp
@@ -1137,6 +1137,9 @@ static void ClearCache(JNIEnv *env, jobject obj)
 #if USE(JSC)    
     // force JavaScript to GC when clear cache
     WebCore::gcController().garbageCollectSoon();
+#elif USE(V8)
+    WebCore::Frame* pFrame = GET_NATIVE_FRAME(env, obj);
+    pFrame->script()->collectGarbage(); 
 #endif  // USE(JSC)
 }
 
diff --git a/WebKit/android/jni/WebCoreJniOnLoad.cpp b/WebKit/android/jni/WebCoreJniOnLoad.cpp
index 3a29f43..25afc61 100644
--- a/WebKit/android/jni/WebCoreJniOnLoad.cpp
+++ b/WebKit/android/jni/WebCoreJniOnLoad.cpp
@@ -45,6 +45,7 @@ extern int register_webcorejni(JNIEnv*);
 extern int register_webstorage(JNIEnv*);
 #endif
 extern int register_geolocation_permissions(JNIEnv*);
+extern int register_mock_geolocation(JNIEnv*);
 
 }
 
@@ -66,7 +67,8 @@ static RegistrationMethod gWebCoreRegMethods[] = {
     { "WebStorage", android::register_webstorage },
 #endif
     { "WebView", android::register_webview },
-    { "GeolocationPermissions", android::register_geolocation_permissions }
+    { "GeolocationPermissions", android::register_geolocation_permissions },
+    { "MockGeolocation", android::register_mock_geolocation }
 };
 
 EXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved)
diff --git a/WebKit/android/jni/WebViewCore.cpp b/WebKit/android/jni/WebViewCore.cpp
index 8e56fcc..3ede30a 100644
--- a/WebKit/android/jni/WebViewCore.cpp
+++ b/WebKit/android/jni/WebViewCore.cpp
@@ -171,6 +171,7 @@ struct WebViewCore::JavaGlue {
     jmethodID   m_sendNotifyProgressFinished;
     jmethodID   m_sendViewInvalidate;
     jmethodID   m_updateTextfield;
+    jmethodID   m_updateTextSelection;
     jmethodID   m_clearTextEntry;
     jmethodID   m_restoreScale;
     jmethodID   m_restoreScreenWidthScale;
@@ -244,6 +245,7 @@ WebViewCore::WebViewCore(JNIEnv* env, jobject javaWebViewCore, WebCore::Frame* m
     m_javaGlue->m_sendNotifyProgressFinished = GetJMethod(env, clazz, "sendNotifyProgressFinished", "()V");
     m_javaGlue->m_sendViewInvalidate = GetJMethod(env, clazz, "sendViewInvalidate", "(IIII)V");
     m_javaGlue->m_updateTextfield = GetJMethod(env, clazz, "updateTextfield", "(IZLjava/lang/String;I)V");
+    m_javaGlue->m_updateTextSelection = GetJMethod(env, clazz, "updateTextSelection", "(IIII)V");
     m_javaGlue->m_clearTextEntry = GetJMethod(env, clazz, "clearTextEntry", "()V");
     m_javaGlue->m_restoreScale = GetJMethod(env, clazz, "restoreScale", "(I)V");
     m_javaGlue->m_restoreScreenWidthScale = GetJMethod(env, clazz, "restoreScreenWidthScale", "(I)V");
@@ -438,7 +440,7 @@ void WebViewCore::recordPictureSet(PictureSet* content)
         // If the frame doesn't have an owner then it is the top frame and the
         // view size is the frame size.
         WebCore::RenderPart* owner = frame->ownerRenderer();
-        if (owner) {
+        if (owner && owner->style()->visibility() == VISIBLE) {
             int x = owner->x();
             int y = owner->y();
 
@@ -1086,7 +1088,7 @@ void WebViewCore::updateCacheOnNodeChange()
         return;
     if (CacheBuilder::validNode(m_mainFrame, frame, node)) {
         RenderObject* renderer = node->renderer();
-        if (renderer) {
+        if (renderer && renderer->style()->visibility() != HIDDEN) {
             IntRect absBox = renderer->absoluteBoundingBoxRect();
             int globalX, globalY;
             CacheBuilder::GetGlobalOffset(frame, &globalX, &globalY);
@@ -1499,7 +1501,13 @@ void WebViewCore::setSelection(int start, int end)
         start = end;
         end = temp;
     }
+    // Tell our EditorClient that this change was generated from the UI, so it
+    // does not need to echo it to the UI.
+    EditorClientAndroid* client = static_cast<EditorClientAndroid*>(
+            m_mainFrame->editor()->client());
+    client->setUiGeneratedSelectionChange(true);
     rtc->setSelectionRange(start, end);
+    client->setUiGeneratedSelectionChange(false);
     focus->document()->frame()->revealSelection();
     setFocusControllerActive(true);
 }
@@ -1524,8 +1532,14 @@ void WebViewCore::replaceTextfieldText(int oldStart,
     if (!focus)
         return;
     setSelection(oldStart, oldEnd);
+    // Prevent our editor client from passing a message to change the
+    // selection.
+    EditorClientAndroid* client = static_cast<EditorClientAndroid*>(
+            m_mainFrame->editor()->client());
+    client->setUiGeneratedSelectionChange(true);
     WebCore::TypingCommand::insertText(focus->document(), replace,
         false);
+    client->setUiGeneratedSelectionChange(false);
     setSelection(start, end);
     m_textGeneration = textGeneration;
 }
@@ -1547,7 +1561,13 @@ void WebViewCore::passToJs(int generation, const WebCore::String& current,
     }
     // Block text field updates during a key press.
     m_blockTextfieldUpdates = true;
+    // Also prevent our editor client from passing a message to change the
+    // selection.
+    EditorClientAndroid* client = static_cast<EditorClientAndroid*>(
+            m_mainFrame->editor()->client());
+    client->setUiGeneratedSelectionChange(true);
     key(event);
+    client->setUiGeneratedSelectionChange(false);
     m_blockTextfieldUpdates = false;
     m_textGeneration = generation;
     setFocusControllerActive(true);
@@ -1783,8 +1803,14 @@ void WebViewCore::click(WebCore::Frame* frame, WebCore::Node* node) {
             " node=%p", m_mousePos.x(), m_mousePos.y(),
             m_scrollOffsetX, m_scrollOffsetY, pt.x(), pt.y(), node);
     }
-    if (node)
+    if (node) {
+        EditorClientAndroid* client
+                = static_cast<EditorClientAndroid*>(
+                m_mainFrame->editor()->client());
+        client->setShouldChangeSelectedRange(false);
         handleMouseClick(frame, node);
+        client->setShouldChangeSelectedRange(true);
+    }
 }
 
 bool WebViewCore::handleTouchEvent(int action, int x, int y)
@@ -1816,7 +1842,7 @@ bool WebViewCore::handleTouchEvent(int action, int x, int y)
 }
 
 void WebViewCore::touchUp(int touchGeneration,
-    WebCore::Frame* frame, WebCore::Node* node, int x, int y, int size)
+    WebCore::Frame* frame, WebCore::Node* node, int x, int y)
 {
     if (m_touchGeneration > touchGeneration) {
         DBG_NAV_LOGD("m_touchGeneration=%d > touchGeneration=%d"
@@ -1828,12 +1854,30 @@ void WebViewCore::touchUp(int touchGeneration,
     if (frame && CacheBuilder::validNode(m_mainFrame, frame, 0)) {
         frame->loader()->resetMultipleFormSubmissionProtection();
     }
-    EditorClientAndroid* client = static_cast<EditorClientAndroid*>(m_mainFrame->editor()->client());
-    client->setFromClick(true);
+    // If the click is on an unselected textfield/area we do not want to allow
+    // the click to change the selection, because we will set it ourselves
+    // elsewhere - beginning for textareas, end for textfields
+    bool needToIgnoreChangesToSelectedRange = true;
+    WebCore::Node* focusNode = currentFocus();
+    if (focusNode) {
+        WebCore::RenderObject* renderer = focusNode->renderer();
+        if (renderer && (renderer->isTextField() || renderer->isTextArea())) {
+            // Now check to see if the click is inside the focused textfield
+            if (focusNode->getRect().contains(x, y))
+                needToIgnoreChangesToSelectedRange = false;
+        }
+    }
+    EditorClientAndroid* client = 0;
+    if (needToIgnoreChangesToSelectedRange) {
+        client = static_cast<EditorClientAndroid*>(
+                m_mainFrame->editor()->client());
+        client->setShouldChangeSelectedRange(false);
+    }
     DBG_NAV_LOGD("touchGeneration=%d handleMouseClick frame=%p node=%p"
         " x=%d y=%d", touchGeneration, frame, node, x, y);
     handleMouseClick(frame, node);
-    client->setFromClick(false);
+    if (needToIgnoreChangesToSelectedRange)
+        client->setShouldChangeSelectedRange(true);
 }
 
 // Common code for both clicking with the trackball and touchUp
@@ -2056,6 +2100,21 @@ WebViewCore::getWebViewJavaObject()
     return env->GetObjectField(m_javaGlue->object(env).get(), gWebViewCoreFields.m_webView);
 }
 
+void WebViewCore::updateTextSelection() {
+    WebCore::Node* focusNode = currentFocus();
+    if (!focusNode)
+        return;
+    RenderObject* renderer = focusNode->renderer();
+    if (!renderer || (!renderer->isTextArea() && !renderer->isTextField()))
+        return;
+    RenderTextControl* rtc = static_cast<RenderTextControl*>(renderer);
+    JNIEnv* env = JSC::Bindings::getJNIEnv();
+    env->CallVoidMethod(m_javaGlue->object(env).get(),
+            m_javaGlue->m_updateTextSelection, reinterpret_cast<int>(focusNode),
+            rtc->selectionStart(), rtc->selectionEnd(), m_textGeneration);
+    checkException(env);
+}
+
 void WebViewCore::updateTextfield(WebCore::Node* ptr, bool changeToPassword,
         const WebCore::String& text)
 {
@@ -2369,7 +2428,7 @@ static jboolean HandleTouchEvent(JNIEnv *env, jobject obj, jint action, jint x,
 }
 
 static void TouchUp(JNIEnv *env, jobject obj, jint touchGeneration,
-        jint frame, jint node, jint x, jint y, jint size)
+        jint frame, jint node, jint x, jint y)
 {
 #ifdef ANDROID_INSTRUMENT
     TimeCounterAuto counter(TimeCounter::WebViewCoreTimeCounter);
@@ -2377,7 +2436,7 @@ static void TouchUp(JNIEnv *env, jobject obj, jint touchGeneration,
     WebViewCore* viewImpl = GET_NATIVE_VIEW(env, obj);
     LOG_ASSERT(viewImpl, "viewImpl not set in %s", __FUNCTION__);
     viewImpl->touchUp(touchGeneration,
-        (WebCore::Frame*) frame, (WebCore::Node*) node, x, y, size);
+        (WebCore::Frame*) frame, (WebCore::Node*) node, x, y);
 }
 
 static jstring RetrieveHref(JNIEnv *env, jobject obj, jint frame,
@@ -2702,7 +2761,7 @@ static JNINativeMethod gJavaWebViewCoreMethods[] = {
         (void*) FindAddress },
     { "nativeHandleTouchEvent", "(III)Z",
             (void*) HandleTouchEvent },
-    { "nativeTouchUp", "(IIIIII)V",
+    { "nativeTouchUp", "(IIIII)V",
         (void*) TouchUp },
     { "nativeRetrieveHref", "(II)Ljava/lang/String;",
         (void*) RetrieveHref },
diff --git a/WebKit/android/jni/WebViewCore.h b/WebKit/android/jni/WebViewCore.h
index 22e00e2..1408cb7 100644
--- a/WebKit/android/jni/WebViewCore.h
+++ b/WebKit/android/jni/WebViewCore.h
@@ -173,6 +173,15 @@ namespace android {
          */
         void updateTextfield(WebCore::Node* pointer,
                 bool changeToPassword, const WebCore::String& text);
+
+        /**
+         * Tell the java side to update the current selection in the focused
+         * textfield to the WebTextView.  This function finds the currently
+         * focused textinput, and passes its selection to java.
+         * If there is no focus, or it is not a text input, this does nothing.
+         */
+        void updateTextSelection();
+
         void clearTextEntry();
         // JavaScript support
         void jsAlert(const WebCore::String& url, const WebCore::String& text);
@@ -260,8 +269,8 @@ namespace android {
          * Handle motionUp event from the UI thread (called touchUp in the
          * WebCore thread).
          */
-        void touchUp(int touchGeneration,
-            WebCore::Frame* frame, WebCore::Node* node, int x, int y, int size);
+        void touchUp(int touchGeneration, WebCore::Frame* frame,
+                WebCore::Node* node, int x, int y);
 
         /**
          * Sets the index of the label from a popup
diff --git a/WebKit/android/nav/WebView.cpp b/WebKit/android/nav/WebView.cpp
index a920777..59d0c6f 100644
--- a/WebKit/android/nav/WebView.cpp
+++ b/WebKit/android/nav/WebView.cpp
@@ -131,7 +131,7 @@ WebView(JNIEnv* env, jobject javaWebView, int viewImpl)
     m_javaGlue.m_sendPluginState = GetJMethod(env, clazz, "sendPluginState", "(I)V");
     m_javaGlue.m_sendMoveMouse = GetJMethod(env, clazz, "sendMoveMouse", "(IIII)V");
     m_javaGlue.m_sendMoveMouseIfLatest = GetJMethod(env, clazz, "sendMoveMouseIfLatest", "(Z)V");
-    m_javaGlue.m_sendMotionUp = GetJMethod(env, clazz, "sendMotionUp", "(IIIIII)V");
+    m_javaGlue.m_sendMotionUp = GetJMethod(env, clazz, "sendMotionUp", "(IIIII)V");
     m_javaGlue.m_getScaledMaxXScroll = GetJMethod(env, clazz, "getScaledMaxXScroll", "()I");
     m_javaGlue.m_getScaledMaxYScroll = GetJMethod(env, clazz, "getScaledMaxYScroll", "()I");
     m_javaGlue.m_getVisibleRect = GetJMethod(env, clazz, "sendOurVisibleRect", "()Landroid/graphics/Rect;");
@@ -909,6 +909,26 @@ void setNavBounds(const WebCore::IntRect& rect)
     root->rootHistory()->setNavBounds(rect);
 }
 
+/**
+ * This function is only to be called by WebTextView, when there is a motion up
+ * on an already focused text input.  Unlike motionUp which may change our
+ * cursor, it simply passes the click, so it can change the selection.
+ * Variables are in content space, relative to the page.
+ */
+void textInputMotionUp(int x, int y)
+{
+    const CachedRoot* root = getFrameCache(DontAllowNewer);
+    if (!root) {
+        return;
+    }
+    const CachedFrame* frame;
+    const CachedNode* node = root->currentCursor(&frame);
+    if (node) {
+        sendMotionUp(static_cast<WebCore::Frame*>(frame->framePointer()),
+                static_cast<WebCore::Node*>(node->nodePointer()), x, y);
+    }
+}
+
 bool motionUp(int x, int y, int slop)
 {
     bool pageScrolled = false;
@@ -931,7 +951,7 @@ bool motionUp(int x, int y, int slop)
             pageScrolled = true;
         }
         sendMotionUp(frame ? (WebCore::Frame*) frame->framePointer() : 0,
-            0, x, y, slop);
+            0, x, y);
         viewInvalidate();
         clearTextEntry();
         setPluginReceivesEvents(false);
@@ -948,8 +968,7 @@ bool motionUp(int x, int y, int slop)
     if (type == NORMAL_CACHEDNODETYPE) {
         sendMotionUp(
             frame ? (WebCore::Frame*) frame->framePointer() : 0,
-            result ? (WebCore::Node*) result->nodePointer() : 0, rx, ry,
-            slop);
+            result ? (WebCore::Node*) result->nodePointer() : 0, rx, ry);
     }
     viewInvalidate();
     if (result->isTextField() || result->isTextArea()) {
@@ -1177,7 +1196,7 @@ void sendMoveMouseIfLatest(bool disableFocusController)
 }
 
 void sendMotionUp(
-    WebCore::Frame* framePtr, WebCore::Node* nodePtr, int x, int y, int slop)
+    WebCore::Frame* framePtr, WebCore::Node* nodePtr, int x, int y)
 {
     m_viewImpl->m_touchGeneration = m_viewImpl->m_generation = ++m_generation;
     DBG_NAV_LOGD("m_generation=%d framePtr=%p nodePtr=%p x=%d y=%d slop=%d",
@@ -1185,7 +1204,7 @@ void sendMotionUp(
     LOG_ASSERT(m_javaGlue.m_obj, "A WebView was not associated with this WebViewNative!");
     JNIEnv* env = JSC::Bindings::getJNIEnv();
     env->CallVoidMethod(m_javaGlue.object(env).get(), m_javaGlue.m_sendMotionUp,
-        m_generation, (jint) framePtr, (jint) nodePtr, x, y, slop);
+        m_generation, (jint) framePtr, (jint) nodePtr, x, y);
     checkException(env);
 }
 
@@ -1699,6 +1718,12 @@ static jint nativeTextGeneration(JNIEnv *env, jobject obj)
     return root ? root->textGeneration() : 0;
 }
 
+static void nativeTextInputMotionUp(JNIEnv *env, jobject obj, int x, int y)
+{
+    WebView* view = GET_NATIVE_VIEW(env, obj);
+    view->textInputMotionUp(x, y);
+}
+
 static bool nativeMotionUp(JNIEnv *env, jobject obj,
     int x, int y, int slop)
 {
@@ -2057,6 +2082,8 @@ static JNINativeMethod gJavaWebViewMethods[] = {
         (void*) nativeImageURI },
     { "nativeInstrumentReport", "()V",
         (void*) nativeInstrumentReport },
+    { "nativeTextInputMotionUp", "(II)V",
+        (void*) nativeTextInputMotionUp },
     { "nativeMotionUp", "(III)Z",
         (void*) nativeMotionUp },
     { "nativeMoveCursor", "(IIZ)Z",
diff --git a/WebKit/android/plugins/android_npapi.h b/WebKit/android/plugins/android_npapi.h
index 0ab3879..1c7655b 100644
--- a/WebKit/android/plugins/android_npapi.h
+++ b/WebKit/android/plugins/android_npapi.h
@@ -87,6 +87,10 @@ struct ANPMatrix;
 struct ANPPaint;
 struct ANPPath;
 struct ANPRegion;
+/** The ANPSurface acts as a handle between the plugin and the native libraries
+    that render the surface to the screen.
+ */
+struct ANPSurface;
 struct ANPTypeface;
 
 enum ANPMatrixFlags {
@@ -101,7 +105,7 @@ typedef uint32_t ANPMatrixFlag;
 ///////////////////////////////////////////////////////////////////////////////
 // NPN_GetValue
 
-/*  queries for a specific ANPInterface.
+/** queries for a specific ANPInterface.
 
     Maybe called with NULL for the NPP instance
 
@@ -119,7 +123,7 @@ typedef uint32_t ANPMatrixFlag;
 #define kSurfaceInterfaceV0_ANPGetValue     ((NPNVariable)1009)
 #define kSystemInterfaceV0_ANPGetValue      ((NPNVariable)1010)
 
-/*  queries for which drawing model is desired (for the draw event)
+/** queries for which drawing model is desired (for the draw event)
 
     Should be called inside NPP_New(...)
 
@@ -132,11 +136,11 @@ typedef uint32_t ANPMatrixFlag;
 
 /** Request to set the drawing model.
 
-    NPN_SetValue(inst, ANPRequestDrawingModel_EnumValue, (void*)foo_DrawingModel)
+    NPN_SetValue(inst, ANPRequestDrawingModel_EnumValue, (void*)foo_ANPDrawingModel)
  */
 #define kRequestDrawingModel_ANPSetValue    ((NPPVariable)1000)
 
-/*  These are used as bitfields in ANPSupportedDrawingModels_EnumValue,
+/** These are used as bitfields in ANPSupportedDrawingModels_EnumValue,
     and as-is in ANPRequestDrawingModel_EnumValue. The drawing model determines
     how to interpret the ANPDrawingContext provided in the Draw event and how
     to interpret the NPWindow->window field.
@@ -146,6 +150,14 @@ enum ANPDrawingModels {
         NPWindow->window is reserved (ignore)
      */
     kBitmap_ANPDrawingModel  = 0,
+    /** Draw into a surface (e.g. raster, opengl, etc.)using the surface interface.
+        Unlike the bitmap model a surface model is opaque so no html content behind
+        the plugin will be  visible. Unless the surface needs to be transparent the
+        surface model should be chosen over the bitmap model as it will have faster
+        performance. An example surface is the raster surface where the service
+        interface is used to lock/unlock and draw into bitmap without waiting for
+        draw events.
+     */
     kSurface_ANPDrawingModel = 1,
 };
 typedef int32_t ANPDrawingModel;
@@ -158,7 +170,7 @@ typedef int32_t ANPDrawingModel;
  */
 #define kAcceptEvents_ANPSetValue           ((NPPVariable)1001)
 
-/*  The EventFlags are a set of bits used to determine which types of events the
+/** The EventFlags are a set of bits used to determine which types of events the
     plugin wishes to receive. For example, if the value is 0x03 then both key
     and touch events will be provided to the plugin.
  */
@@ -168,8 +180,8 @@ enum ANPEventFlag {
 };
 typedef uint32_t ANPEventFlags;
 
-/*  Interfaces provide additional functionality to the plugin via function ptrs.
-    Once an interface is retrived, it is valid for the lifetime of the plugin
+/** Interfaces provide additional functionality to the plugin via function ptrs.
+    Once an interface is retrieved, it is valid for the lifetime of the plugin
     (just like browserfuncs).
 
     All ANPInterfaces begin with an inSize field, which must be set by the
@@ -188,8 +200,9 @@ enum ANPLogTypes {
 typedef int32_t ANPLogType;
 
 struct ANPLogInterfaceV0 : ANPInterface {
-    // dumps printf messages to the log file
-    // e.g. interface->log(instance, kWarning_ANPLogType, "value is %d", value);
+    /** dumps printf messages to the log file
+        e.g. interface->log(instance, kWarning_ANPLogType, "value is %d", value);
+     */
     void (*log)(NPP instance, ANPLogType, const char format[], ...);
 };
 
@@ -200,14 +213,13 @@ struct ANPBitmapInterfaceV0 : ANPInterface {
     bool (*getPixelPacking)(ANPBitmapFormat, ANPPixelPacking* packing);
 };
 
-/** The ANPSurface acts as a handle between the plugin and the native libraries
-    that render the surface to the screen.
- */
-struct ANPSurface;
-
 struct ANPSurfaceInterfaceV0 : ANPInterface {
     /** Creates a new raster surface handle based on the given bitmap format. If
-        raster surfaces or the bitmap format is not supported then NULL is returned.
+        raster surfaces or the bitmap format is not supported then NULL is
+        returned.  Setting the fixedSize parameter to true notifies the browser
+        that it is responsible for scaling the bitmap when zoomed.  Setting the
+        fixedSize to false will cause a kChanged_ANPSurfaceAction to be fired
+        each time the user changes the zoom level.
      */
     ANPSurface* (*newRasterSurface)(NPP instance, ANPBitmapFormat, bool fixedSize);
     /** Given a valid surface handle (i.e. one created by calling newSurface)
@@ -230,10 +242,10 @@ struct ANPSurfaceInterfaceV0 : ANPInterface {
 };
 
 struct ANPMatrixInterfaceV0 : ANPInterface {
-    /*  Return a new identity matrix
+    /** Return a new identity matrix
      */
     ANPMatrix*  (*newMatrix)();
-    /*  Delete a matrix previously allocated by newMatrix()
+    /** Delete a matrix previously allocated by newMatrix()
      */
     void        (*deleteMatrix)(ANPMatrix*);
 
@@ -241,14 +253,14 @@ struct ANPMatrixInterfaceV0 : ANPInterface {
 
     void        (*copy)(ANPMatrix* dst, const ANPMatrix* src);
 
-    /*  Return the matrix values in a float array (allcoated by the caller),
+    /** Return the matrix values in a float array (allcoated by the caller),
         where the values are treated as follows:
         w  = x * [6] + y * [7] + [8];
         x' = (x * [0] + y * [1] + [2]) / w;
         y' = (x * [3] + y * [4] + [5]) / w;
      */
     void        (*get3x3)(const ANPMatrix*, float[9]);
-    /*  Initialize the matrix from values in a float array,
+    /** Initialize the matrix from values in a float array,
         where the values are treated as follows:
          w  = x * [6] + y * [7] + [8];
          x' = (x * [0] + y * [1] + [2]) / w;
@@ -268,12 +280,12 @@ struct ANPMatrixInterfaceV0 : ANPInterface {
     void        (*preConcat)(ANPMatrix*, const ANPMatrix*);
     void        (*postConcat)(ANPMatrix*, const ANPMatrix*);
 
-    /*  Return true if src is invertible, and if so, return its inverse in dst.
+    /** Return true if src is invertible, and if so, return its inverse in dst.
         If src is not invertible, return false and ignore dst.
      */
     bool        (*invert)(ANPMatrix* dst, const ANPMatrix* src);
 
-    /*  Transform the x,y pairs in src[] by this matrix, and store the results
+    /** Transform the x,y pairs in src[] by this matrix, and store the results
         in dst[]. The count parameter is treated as the number of pairs in the
         array. It is legal for src and dst to point to the same memory, but
         illegal for the two arrays to partially overlap.
@@ -283,28 +295,28 @@ struct ANPMatrixInterfaceV0 : ANPInterface {
 };
 
 struct ANPPathInterfaceV0 : ANPInterface {
-    /* Return a new path */
+    /** Return a new path */
     ANPPath* (*newPath)();
 
-    /* Delete a path previously allocated by ANPPath() */
+    /** Delete a path previously allocated by ANPPath() */
     void (*deletePath)(ANPPath*);
 
-    /* Make a deep copy of the src path, into the dst path (already allocated
-       by the caller).
+    /** Make a deep copy of the src path, into the dst path (already allocated
+        by the caller).
      */
     void (*copy)(ANPPath* dst, const ANPPath* src);
 
-    /* Returns true if the two paths are the same (i.e. have the same points)
+    /** Returns true if the two paths are the same (i.e. have the same points)
      */
     bool (*equal)(const ANPPath* path0, const ANPPath* path1);
 
-    /* Remove any previous points, initializing the path back to empty. */
+    /** Remove any previous points, initializing the path back to empty. */
     void (*reset)(ANPPath*);
 
-    /* Return true if the path is empty (has no lines, quads or cubics). */
+    /** Return true if the path is empty (has no lines, quads or cubics). */
     bool (*isEmpty)(const ANPPath*);
 
-    /* Return the path's bounds in bounds. */
+    /** Return the path's bounds in bounds. */
     void (*getBounds)(const ANPPath*, ANPRectF* bounds);
 
     void (*moveTo)(ANPPath*, float x, float y);
@@ -314,14 +326,14 @@ struct ANPPathInterfaceV0 : ANPInterface {
                     float x2, float y2);
     void (*close)(ANPPath*);
 
-    /*  Offset the src path by [dx, dy]. If dst is null, apply the
+    /** Offset the src path by [dx, dy]. If dst is null, apply the
         change directly to the src path. If dst is not null, write the
         changed path into dst, and leave the src path unchanged. In that case
         dst must have been previously allocated by the caller.
      */
     void (*offset)(ANPPath* src, float dx, float dy, ANPPath* dst);
 
-    /*  Transform the path by the matrix. If dst is null, apply the
+    /** Transform the path by the matrix. If dst is null, apply the
         change directly to the src path. If dst is not null, write the
         changed path into dst, and leave the src path unchanged. In that case
         dst must have been previously allocated by the caller.
@@ -400,15 +412,15 @@ typedef uint32_t ANPTypefaceStyle;
 typedef uint32_t ANPFontTableTag;
 
 struct ANPFontMetrics {
-    //! The greatest distance above the baseline for any glyph (will be <= 0)
+    /** The greatest distance above the baseline for any glyph (will be <= 0) */
     float   fTop;
-    //! The recommended distance above the baseline (will be <= 0)
+    /** The recommended distance above the baseline (will be <= 0) */
     float   fAscent;
-    //! The recommended distance below the baseline (will be >= 0)
+    /** The recommended distance below the baseline (will be >= 0) */
     float   fDescent;
-    //! The greatest distance below the baseline for any glyph (will be >= 0)
+    /** The greatest distance below the baseline for any glyph (will be >= 0) */
     float   fBottom;
-    //! The recommended distance to add between lines of text (will be >= 0)
+    /** The recommended distance to add between lines of text (will be >= 0) */
     float   fLeading;
 };
 
@@ -491,7 +503,7 @@ struct ANPTypefaceInterfaceV0 : ANPInterface {
 };
 
 struct ANPPaintInterfaceV0 : ANPInterface {
-    /*  Return a new paint object, which holds all of the color and style
+    /** Return a new paint object, which holds all of the color and style
         attributes that affect how things (geometry, text, bitmaps) are drawn
         in a ANPCanvas.
 
@@ -563,7 +575,7 @@ struct ANPPaintInterfaceV0 : ANPInterface {
 };
 
 struct ANPCanvasInterfaceV0 : ANPInterface {
-    /*  Return a canvas that will draw into the specified bitmap. Note: the
+    /** Return a canvas that will draw into the specified bitmap. Note: the
         canvas copies the fields of the bitmap, so it need not persist after
         this call, but the canvas DOES point to the same pixel memory that the
         bitmap did, so the canvas should not be used after that pixel memory
@@ -587,15 +599,15 @@ struct ANPCanvasInterfaceV0 : ANPInterface {
     void        (*clipRect)(ANPCanvas*, const ANPRectF*);
     void        (*clipPath)(ANPCanvas*, const ANPPath*);
 
-    /*  Return the current matrix on the canvas
+    /** Return the current matrix on the canvas
      */
     void        (*getTotalMatrix)(ANPCanvas*, ANPMatrix*);
-    /*  Return the current clip bounds in local coordinates, expanding it to
+    /** Return the current clip bounds in local coordinates, expanding it to
         account for antialiasing edge effects if aa is true. If the
         current clip is empty, return false and ignore the bounds argument.
      */
     bool        (*getLocalClipBounds)(ANPCanvas*, ANPRectF* bounds, bool aa);
-    /*  Return the current clip bounds in device coordinates in bounds. If the
+    /** Return the current clip bounds in device coordinates in bounds. If the
         current clip is empty, return false and ignore the bounds argument.
      */
     bool        (*getDeviceClipBounds)(ANPCanvas*, ANPRectI* bounds);
@@ -718,13 +730,19 @@ typedef void (*ANPAudioCallbackProc)(ANPAudioEvent event, void* user,
 struct ANPAudioTrack;   // abstract type for audio tracks
 
 struct ANPAudioTrackInterfaceV0 : ANPInterface {
-    /*  Create a new audio track, or NULL on failure.
+    /** Create a new audio track, or NULL on failure. The track is initially in
+        the stopped state and therefore ANPAudioCallbackProc will not be called
+        until the track is started.
      */
     ANPAudioTrack*  (*newTrack)(uint32_t sampleRate,    // sampling rate in Hz
                                 ANPSampleFormat,
                                 int channelCount,       // MONO=1, STEREO=2
                                 ANPAudioCallbackProc,
                                 void* user);
+    /** Deletes a track that was created using newTrack.  The track can be
+        deleted in any state and it waits for the ANPAudioCallbackProc thread
+        to exit before returning.
+     */
     void (*deleteTrack)(ANPAudioTrack*);
 
     void (*start)(ANPAudioTrack*);
@@ -742,8 +760,20 @@ struct ANPAudioTrackInterfaceV0 : ANPInterface {
 enum ANPEventTypes {
     kNull_ANPEventType          = 0,
     kKey_ANPEventType           = 1,
+    /** Mouse events are triggered by either clicking with the navigational pad
+        or by tapping the touchscreen (if the kDown_ANPTouchAction is handled by
+        the plugin then no mouse event is generated).  The kKey_ANPEventFlag has
+        to be set to true in order to receive these events.
+     */
     kMouse_ANPEventType         = 2,
+    /** Touch events are generated when the user touches on the screen. The
+        kTouch_ANPEventFlag has to be set to true in order to receive these
+        events.
+     */
     kTouch_ANPEventType         = 3,
+    /** Only triggered by a plugin using the kBitmap_ANPDrawingModel. This event
+        signals that the plugin needs to redraw itself into the provided bitmap.
+     */
     kDraw_ANPEventType          = 4,
     kLifecycle_ANPEventType     = 5,
     kSurface_ANPEventType       = 6,
@@ -773,6 +803,11 @@ enum ANPMouseActions {
 typedef int32_t ANPMouseAction;
 
 enum ANPTouchActions {
+    /** This occurs when the user first touches on the screen. As such, this
+        action will always occur prior to any of the other touch actions. If
+        the plugin chooses to not handle this action then no other events
+        related to that particular touch gesture will be generated.
+     */
     kDown_ANPTouchAction   = 0,
     kUp_ANPTouchAction     = 1,
     kMove_ANPTouchAction   = 2,
@@ -781,10 +816,26 @@ enum ANPTouchActions {
 typedef int32_t ANPTouchAction;
 
 enum ANPLifecycleActions {
+    /** The web view containing this plugin has been paused.  See documentation
+        on the android activity lifecycle for more information.
+     */
     kPause_ANPLifecycleAction      = 0,
+    /** The web view containing this plugin has been resumed. See documentation
+        on the android activity lifecycle for more information.
+     */
     kResume_ANPLifecycleAction     = 1,
+    /** The plugin has focus and is now the recipient of input events (e.g. key,
+        touch, etc.)
+     */
     kGainFocus_ANPLifecycleAction  = 2,
+    /** The plugin has lost focus and will not receive any input events until it
+        regains focus. This event is always preceded by a GainFocus action.
+     */
     kLoseFocus_ANPLifecycleAction  = 3,
+    /** The browser is running low on available memory and is requesting that
+        the plugin free any unused/inactive resources to prevent a performance
+        degradation.
+     */
     kFreeMemory_ANPLifecycleAction = 4,
     /** The page has finished loading. This happens when the page's top level
         frame reports that it has completed loading.
@@ -798,7 +849,10 @@ enum ANPSurfaceActions {
         lock/unlock before this action will fail.
      */
     kCreated_ANPSurfaceAction    = 0,
-    /** The surface's dimension has changed.
+    /** The surface's dimension has changed.  If the surface is responsible for
+        manually scaling then this action will be generated each time the zoom
+        level of browser is changed.  This event is also triggered when the
+        plugin's dimensions in the DOM are changed (e.g. css or javascript).
      */
     kChanged_ANPSurfaceAction    = 1,
     /** The surface has been destroyed. This happens when the view system has