Merge Webkit at r70949: Initial merge by git.

Change-Id: I77b8645c083b5d0da8dba73ed01d4014aab9848e
author: John Reck <jreck@google.com> 2010-11-04 12:00:17 -0700
committer: John Reck <jreck@google.com> 2010-11-09 11:35:04 -0800
commit: e14391e94c850b8bd03680c23b38978db68687a8 (patch)
tree: 3fed87e6620fecaf3edc7259ae58a11662bedcb2 /WebKit
parent: 1bd705833a68f07850cf7e204b26f8d328d16951 (diff)
download: external_webkit-e14391e94c850b8bd03680c23b38978db68687a8.zip
external_webkit-e14391e94c850b8bd03680c23b38978db68687a8.tar.gz
external_webkit-e14391e94c850b8bd03680c23b38978db68687a8.tar.bz2
163 files changed, 3916 insertions, 715 deletions
diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index 4c9ebbe..9a6a950 100644
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,42 @@
+2010-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Stop allowing deprecated methods to be used in NetscapePluginHostProxy.mm now
+        that deprecated methods are no longer used.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2010-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * WebKit.xcodeproj/project.pbxproj: Allow deprecated methods to be used in NetscapePluginHostProxy.mm.
+
+2010-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/48186> Remove unneeded WebHTMLRepresentationInternal.h header
+
+        Reviewed by Sam Weinig.
+
+        The only method defined in WebHTMLRepresentationInternal.h is
+        also defined in WebHTMLRepresentation.h, so use that instead.
+
+        * WebKit.xcodeproj/project.pbxproj: Removed references to
+        WebHTMLRepresentationInternal.h.
+
+2010-10-21  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/48047> Fix warnings found by check-Xcode-source-file-types
+
+        Reviewed by Adam Roben.
+
+        Fixes the following warning:
+
+            WARNING: Incorrect file type 'sourcecode.cpp.objcpp' for file 'WebStringTruncator.h'.
+            1 issues found for WebKit/WebKit.xcodeproj/project.pbxproj.
+
+        * WebKit.xcodeproj/project.pbxproj: Removed explicit file type
+        for WebStringTruncator.h to make it match other header files.
+
 2010-10-20  Nikolas Zimmermann  <nzimmermann@rim.com>
 
         Not reviewed.
diff --git a/WebKit/WebKit.xcodeproj/project.pbxproj b/WebKit/WebKit.xcodeproj/project.pbxproj
index 3eaa49f..be3caeb 100644
--- a/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -87,7 +87,6 @@
 		37D1DCA91065928C0068F7EF /* WebJSPDFDoc.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37D1DCA71065928C0068F7EF /* WebJSPDFDoc.mm */; };
 		41F4484F10338E8C0030E55E /* WebWorkersPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41F4485010338E8C0030E55E /* WebWorkersPrivate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */; };
-		441793A60E34EE150055E1AE /* WebHTMLRepresentationInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 441793A50E34EE150055E1AE /* WebHTMLRepresentationInternal.h */; };
 		44BB8B141241A022001E3A22 /* WebArchiveInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 44BB8B131241A022001E3A22 /* WebArchiveInternal.h */; };
 		4BF99F900AE050BC00815C2B /* WebEditorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 4BF99F8E0AE050BC00815C2B /* WebEditorClient.h */; settings = {ATTRIBUTES = (); }; };
 		4BF99F910AE050BC00815C2B /* WebEditorClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4BF99F8F0AE050BC00815C2B /* WebEditorClient.mm */; };
@@ -485,7 +484,6 @@
 		39446080020F50ED0ECA1767 /* WebHistoryItem.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebHistoryItem.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebWorkersPrivate.h; path = mac/Workers/WebWorkersPrivate.h; sourceTree = "<group>"; };
 		41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebWorkersPrivate.mm; path = mac/Workers/WebWorkersPrivate.mm; sourceTree = "<group>"; };
-		441793A50E34EE150055E1AE /* WebHTMLRepresentationInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebHTMLRepresentationInternal.h; sourceTree = "<group>"; };
 		449098B90F8F82DF0076A327 /* FeatureDefines.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = FeatureDefines.xcconfig; sourceTree = "<group>"; };
 		44BB8B131241A022001E3A22 /* WebArchiveInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebArchiveInternal.h; sourceTree = "<group>"; };
 		4BF99F8E0AE050BC00815C2B /* WebEditorClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebEditorClient.h; sourceTree = "<group>"; };
@@ -717,7 +715,7 @@
 		F53444CF02E87CBA018635CA /* WebKitStatistics.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebKitStatistics.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F53444D202E87D4B018635CA /* WebKitStatisticsPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebKitStatisticsPrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F5927D4E02D26C5E01CA2DBB /* WebKitErrors.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebKitErrors.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		F59668C802AD2923018635CA /* WebStringTruncator.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; indentWidth = 4; path = WebStringTruncator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		F59668C802AD2923018635CA /* WebStringTruncator.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebStringTruncator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F59668C902AD2923018635CA /* WebStringTruncator.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; indentWidth = 4; path = WebStringTruncator.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F59EAE3E0253C7EE018635CA /* WebCoreStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreStatistics.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F59EAE410253C8DE018635CA /* WebCoreStatistics.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreStatistics.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -1253,7 +1251,6 @@
 			children = (
 				35081D9202B6D4D80ACA2ACA /* WebHTMLRepresentation.h */,
 				35081D9302B6D4D80ACA2ACA /* WebHTMLRepresentation.mm */,
-				441793A50E34EE150055E1AE /* WebHTMLRepresentationInternal.h */,
 				F5A55DC702BAA2E8018635CC /* WebHTMLRepresentationPrivate.h */,
 				35081D9402B6D4D80ACA2ACA /* WebHTMLView.h */,
 				35081D9502B6D4D80ACA2ACA /* WebHTMLView.mm */,
@@ -1495,7 +1492,6 @@
 				939810140824BF01008DF038 /* WebHistoryPrivate.h in Headers */,
 				1AAF5FBF0EDE3A92008D883D /* WebHostedNetscapePluginView.h in Headers */,
 				939810550824BF01008DF038 /* WebHTMLRepresentation.h in Headers */,
-				441793A60E34EE150055E1AE /* WebHTMLRepresentationInternal.h in Headers */,
 				939810560824BF01008DF038 /* WebHTMLRepresentationPrivate.h in Headers */,
 				939810570824BF01008DF038 /* WebHTMLView.h in Headers */,
 				939810A10824BF01008DF038 /* WebHTMLViewInternal.h in Headers */,
diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
index bd2faa8..9eeb48b 100644
--- a/WebKit/chromium/ChangeLog
+++ b/WebKit/chromium/ChangeLog
@@ -1,3 +1,703 @@
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * src/BackForwardListClientImpl.h: Use BackForwardListImpl.h.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl): Cast to BackForwardList* before calling setClient.
+
+2010-10-28  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by ap.
+
+        [Chrome] Fix an appcache regression introduced in r69226
+        https://bugs.webkit.org/show_bug.cgi?id=48592
+        Provide a noop method body ApplicationCacheHost::maybeLoadMainResourceForRedirect.
+
+        * src/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::maybeLoadMainResourceForRedirect):
+
+2010-10-29  Aaron Colwell  <acolwell@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Fix globalAlpha support when using drawImage() to copy a video frame
+        to a 2D canvas context.
+        https://bugs.webkit.org/show_bug.cgi?id=48094
+
+        This fix applies the globalAlpha value to the canvas before passing it
+        down to the lower layers that don't have access to the graphics
+        context. This makes sure that any drawing on the canvas will have the
+        proper global alpha value applied.
+
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::paint):
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * src/FrameLoaderClientImpl.h:
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidBecomeFrameset):
+
+2010-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add close button to network view, make tests pass
+        for resource manager on all ports.
+        https://bugs.webkit.org/show_bug.cgi?id=48628
+
+        * src/js/Tests.js:
+
+2010-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Roben and David Kilzer.
+
+        Fix and cleanup of build systems
+        https://bugs.webkit.org/show_bug.cgi?id=48342
+
+        * features.gypi: Remove unnecessary ENABLE_SANDBOX.
+
+2010-10-29  Leandro Gracia Gil  <leandrogracia@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Patch the current speech input implementation to use the nearest
+        language tag. The language is now passed to the startRecognition
+        methods so that language-specific recognition could be used. Also added
+        a second parameter to setMockSpeechInputResult for the language used in
+        speech recognition.
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        This is the 2nd of a 4-sided patch in Chromium and WebKit. For more
+        details see http://codereview.chromium.org/3615005/show,
+        http://codereview.chromium.org/3595018/show and
+        https://bugs.webkit.org/show_bug.cgi?id=47420.
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::create):
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel, Peter Kasting, and Darin Fisher.
+        (Eric reviewed the CoreGraphics interactions, Peter reviewed the image
+        decoder interaction, and Darin Fisher SGTMed the policy decision.)
+
+        [chromium] Chromium Mac should use WebKit's image decoders
+        https://bugs.webkit.org/show_bug.cgi?id=47974
+
+        Enable WebKit's image decoders.
+
+        * features.gypi:
+
+2010-10-28  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [Chromium] History related tests REGRESSED after r70723
+        https://bugs.webkit.org/show_bug.cgi?id=48513
+
+        Since r70723 made BackForwardList::currentItem no longer be virtual,
+        we were not reaching the implementation in Chromium's 
+        BackForwardListClientImpl, and for Chromium currentItem is not the same
+        as itemAtIndex(0).
+        
+        The fix is to make itemAtIndex(0) have the currentItem() behavior, which
+        lets us keep currentItem as non-virtual (and remove its implementation
+        from the Chromium side).
+        
+        This also switches Chromium to use the default implementation of 
+        backItem() and forwardItem() (vs. the old stubs that just had
+        ASSERT_NOT_REACHED) since they're actually reacheable with Chromium
+        code thanks to the calls in FrameLoader::checkDidPerformFirstNavigation.
+
+        * src/BackForwardListClientImpl.cpp:
+        (WebKit::BackForwardListClientImpl::itemAtIndex):
+        * src/BackForwardListClientImpl.h:
+
+2010-10-28  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Support FileSystem in chromium DRT
+        https://bugs.webkit.org/show_bug.cgi?id=47643
+        Update the chromium DEPS to pick up corresponding webkit_support change.
+        Also add a temporary glue implementation with FIXME comment to
+        WebFrameClient::openFileSystem.
+
+        * DEPS:
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::openFileSystem):
+
+2010-10-28  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Remove obsolete public/API methods in chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=48504
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+
+2010-10-27  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Metadata queries should return full file info, not just modification time
+        https://bugs.webkit.org/show_bug.cgi?id=48098
+
+        * src/AssertMatchingEnums.cpp: Ensure WebFileInfo and FileMetadata use the same values for file/directory indicators.
+        * src/WebFileSystemCallbacksImpl.cpp:
+        (WebKit::WebFileSystemCallbacksImpl::didReadMetadata): Pass through the new information.
+
+2010-10-27  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] WebGL does not work with the compositor in test_shell
+        https://bugs.webkit.org/show_bug.cgi?id=48470
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::resolveMultisampledFramebuffer):
+         - Properly restore the draw framebuffer after resolving.
+        (WebKit::WebGraphicsContext3DDefaultImpl::prepareTexture):
+         - Make the context current before calling resolveMultisampledFramebuffer.
+
+2010-10-27  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Include caps lock state when converting NSEvent modifiers to
+        WebInputEvent
+
+        https://bugs.webkit.org/show_bug.cgi?id=47917
+
+        * src/mac/WebInputEventFactory.mm:
+        (WebKit::modifiersFromEvent):
+
+2010-10-27  Chris Rogers  <crogers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add ENABLE_WEB_AUDIO feature enable flag (initially disabled) for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=48465
+
+        * features.gypi:
+
+2010-10-25  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        compile TestNetscapePlugIn on chromium linux
+        https://bugs.webkit.org/show_bug.cgi?id=48274
+
+        * WebKit.gyp: Enable compilation of TestNetscapePlugIn on Linux.
+
+2010-10-27  Satish Sampath  <satish@chromium.org>
+
+        Unreviewed, rolling out r70665.
+        http://trac.webkit.org/changeset/70665
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        Need to address Alexey's review comments.
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-27  ZHenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Must enable GL_POINT_SPRITE in GraphicsContext3D implementations
+        https://bugs.webkit.org/show_bug.cgi?id=45908
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp: Enable for chromium --in-process-webgl port.
+        (WebKit::WebGraphicsContext3DDefaultImpl::initialize):
+
+2010-10-27  Leandro Gracia Gil  <leandrogracia@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Patch the current speech input implementation to use the nearest
+        language tag. The language is now passed to the startRecognition
+        methods so that language-specific recognition could be used. Also added
+        a second parameter to setMockSpeechInputResult for the language used in
+        speech recognition.
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        This is the 2nd of a 4-sided patch in Chromium and WebKit. For more
+        details see http://codereview.chromium.org/3615005/show and
+        http://codereview.chromium.org/3595018/show. The last of the 4 patches
+        depends also on the language tag validation provided by this patch:
+        https://bugs.webkit.org/show_bug.cgi?id=48225.
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::create):
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-26  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by David Levin.
+
+        Fix compile when ACCELERATED_COMPOSITING flag is not set
+        https://bugs.webkit.org/show_bug.cgi?id=48373
+
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl):
+        (WebKit::WebMediaPlayerClientImpl::readyStateChanged):
+        (WebKit::WebMediaPlayerClientImpl::load):
+        * src/WebMediaPlayerClientImpl.h:
+
+2010-10-26  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Tony Chang.
+
+        Rolling in r70512 again.
+        
+        spellcheck='' should be the same as spellcheck="true"
+        https://bugs.webkit.org/show_bug.cgi?id=25539
+
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::shouldSpellcheckByDefault):
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::transferLoadingResourceFromPage):
+        Empty method.
+        * src/FrameLoaderClientImpl.h:
+
+2010-10-26  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Add a 'grammar' attribute for speech input.
+        https://bugs.webkit.org/show_bug.cgi?id=48339
+
+        To differentiate between various types of speech input, we add a 'x-webkit-grammar' attribute to a
+        speech enabled input element. This is passed without validation to the speech recognizer. Typical values
+        could be "builtin:search", "builtin:dictation" and even an externally hosted SRGS grammar XML file URI.
+        It is up to the recognizer to interpret the value and use it as an aid in recognition.
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+
+2010-10-26  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: update stale comments referring to WebIndexedDatabase.
+        https://bugs.webkit.org/show_bug.cgi?id=48325
+
+        WebIndexedDatabase was renamed to WebIDBFactory in
+        http://trac.webkit.org/changeset/64344, but some comments referring to
+        it were left unchanged.
+
+        * public/WebIDBCursor.h:
+        * public/WebIDBDatabase.h:
+        * public/WebIDBDatabaseError.h:
+        * public/WebIDBIndex.h:
+        * public/WebIDBObjectStore.h:
+        * public/WebIDBTransaction.h:
+        * src/WebIDBDatabaseImpl.h:
+
+2010-10-22  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Implement copy-texture-to-parent-texture API for WebGraphicsContext3DDefaultImpl.
+        https://bugs.webkit.org/show_bug.cgi?id=48152
+        
+        This allows the in-process implementation to do accelerated canvas and
+        accelerated compositing together.  It requires some changes landed
+        in chromium 63528, so this patch also rolls chromium DEPS to 63722
+        (current LKGR).
+
+        Covered by fast/canvas/arc360.html, and many more when run with
+        --accelerated-compositing and --accelerated-2d-canvas.
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::WebGraphicsContext3DDefaultImpl):
+        Add member vars to save the currently-bound texture and for the
+        texture-to-texture FBO.
+        (WebKit::WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl):
+        Delete the texture-to-texture FBO on destruction.
+
+        (WebKit::WebGraphicsContext3DDefaultImpl::initialize):
+        Generate the texture-to-texture FBO.
+        (WebKit::WebGraphicsContext3DDefaultImpl::supportsCopyTextureToParentTextureCHROMIUM):
+        Check for support of the glGetTexLevelParameteriv function (required
+        for this implementation).
+        (WebKit::WebGraphicsContext3DDefaultImpl::copyTextureToParentTextureCHROMIUM):
+        Implement the extension:  bind the FBO, bind the child texture, then
+        do a glCopyTexImage2D() into the parent texture.
+        (WebKit::WebGraphicsContext3DDefaultImpl::bindTexture):
+        Record the newly-bound texture in m_boundTexture.
+        * src/WebGraphicsContext3DDefaultImpl.h:
+        Add the two new member variables.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::graphicsContext3D):
+        Make sure the graphics context is reshaped to the correct size on all
+        platforms.
+
+2010-10-26  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Check getGraphicsResetStatusARB and reinitialize the
+        renderer in an error is returned.
+        https://bugs.webkit.org/show_bug.cgi?id=47848
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::composite): added getGraphicsResetStatusARB check
+        (WebKit::WebViewImpl::reallocateRenderer): added
+        * src/WebViewImpl.h:
+
+2010-10-26  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Andreas Kling.
+
+        Valgrind failure in GraphicsContext3DInternal::reshape
+        https://bugs.webkit.org/show_bug.cgi?id=48284
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::WebGraphicsContext3DDefaultImpl):
+
+2010-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Fix IndexedDB crashes
+        https://bugs.webkit.org/show_bug.cgi?id=48266
+
+        Make WebIDBObjectStoreImpl match the way that WebIDBIndexImpl passes
+        in cursor parameters (which is the correct way). KeyRange knows how
+        to convert itself to a WebCore type--even if the value is null.
+
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+
+2010-10-26  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Remove obsolete public/API methods in chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=48330
+
+        * public/WebSpeechInputListener.h:
+
+2010-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Quota for IndexedDB should be per origin not per database
+        https://bugs.webkit.org/show_bug.cgi?id=48064
+
+        * public/WebIDBFactory.h:
+        * public/WebSecurityOrigin.h:
+        * src/WebIDBFactory.cpp:
+        (WebKit::WebIDBFactory::databaseFileName):
+        * src/WebSecurityOrigin.cpp:
+        (WebKit::WebSecurityOrigin::get):
+
+2010-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70512.
+        http://trac.webkit.org/changeset/70512
+        https://bugs.webkit.org/show_bug.cgi?id=48314
+
+        crashes many tests (Requested by inferno-sec on #webkit).
+
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::shouldSpellcheckByDefault):
+
+2010-10-25  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Tony Chang.
+
+        spellcheck='' should be the same as spellcheck="true"
+        https://bugs.webkit.org/show_bug.cgi?id=25539
+
+        Followed API rename in WebCore.
+
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::shouldSpellcheckByDefault):
+
+2010-10-25  Satish Sampath  <satish@chromium.org>
+
+        Unreviewed, fix for a build break caused by my earlier patch.
+
+        * public/WebSpeechInputListener.h:
+        (WebKit::WebSpeechInputListener::setRecognitionResult): Explicitly invoking the correct constructor.
+
+2010-10-21  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Allow embedder to pass on all the speech recognition results to the input element.
+        https://bugs.webkit.org/show_bug.cgi?id=48068
+
+        * WebKit.gyp: Added new files
+        * public/WebSpeechInputListener.h:
+        * public/WebSpeechInputResult.h: Added, wrapper around WebCore::SpeechInputResult
+        (WebKit::WebSpeechInputResult::WebSpeechInputResult):
+        (WebKit::WebSpeechInputResult::~WebSpeechInputResult):
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::setRecognitionResult): Accepts an array instead of a single string.
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setRecognitionResult):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebSpeechInputResult.cpp: Added.
+        (WebKit::WebSpeechInputResult::reset):
+        (WebKit::WebSpeechInputResult::WebSpeechInputResult):
+        (WebKit::WebSpeechInputResult::set):
+        (WebKit::WebSpeechInputResult::operator PassRefPtr<WebCore::SpeechInputResult>):
+
+2010-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70451.
+        http://trac.webkit.org/changeset/70451
+        https://bugs.webkit.org/show_bug.cgi?id=48249
+
+        Broke set-unloaded-frame-location.html under Qt (Requested by
+        caseq on #webkit).
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeScript):
+        (WebKit::WebFrameImpl::executeScriptInIsolatedWorld):
+        (WebKit::WebFrameImpl::executeScriptAndReturnValue):
+
+2010-10-25  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Replaces script line number with TextPosition structure.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeScript):
+        (WebKit::WebFrameImpl::executeScriptInIsolatedWorld):
+        (WebKit::WebFrameImpl::executeScriptAndReturnValue):
+
+2010-10-20  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Jian Li.
+
+        Renumber FileError/FileException error codes per latest File API spec changes
+        https://bugs.webkit.org/show_bug.cgi?id=47936
+
+        * public/WebFileError.h:
+        * src/AssertMatchingEnums.cpp:
+        * src/AsyncFileWriterChromium.cpp:
+        (WebCore::AsyncFileWriterChromium::didFail):
+
+2010-10-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70361.
+        http://trac.webkit.org/changeset/70361
+        https://bugs.webkit.org/show_bug.cgi?id=48217
+
+        Chromium tests NoInitialAutocompleteForReadOnly and
+        InitialAutocomplete don't complete (Requested by yuzo on
+        #webkit).
+
+        * public/WebDocument.h:
+
+2010-10-22  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Turning on the Autocomplete implementation on the Chromium side.
+        https://bugs.webkit.org/show_bug.cgi?id=41283
+
+        * public/WebDocument.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createWindow):
+        * src/ChromeClientImpl.h:
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchCreatePage):
+        * src/FrameLoaderClientImpl.h:
+        Add NavigationAction parameter.
+
+2010-10-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70301.
+        http://trac.webkit.org/changeset/70301
+        https://bugs.webkit.org/show_bug.cgi?id=48126
+
+        "Lang attribute layout tests failing" (Requested by satish on
+        #webkit).
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-22  Leandro Gracia Gil  <leandrogracia@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Patch the current speech input implementation to use and validate the
+        nearest language tag. The language is now passed to the startRecognition
+        methods so that language-specific recognition could be used. Also added
+        a second parameter to setMockSpeechInputResult for the language used in
+        speech recognition.
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        This is the 2nd of a 4-sided patch in Chromium and WebKit. For more
+        details see http://codereview.chromium.org/3615005/show and
+        http://codereview.chromium.org/3595018/show.
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::create):
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-21  Yuzo Fujishima  <yuzo@google.com>
+
+        Unreviewed build fix attempt for Chromium Linux Debug Clang
+
+        * public/WebExternalPopupMenu.h:
+
+2010-10-21  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] roll chromium DEPS to include forwarding headers refactor
+        https://bugs.webkit.org/show_bug.cgi?id=48097
+
+        * DEPS: Roll chromium forward to include new forwarding headers script
+        * WebKit.gyp: This dependency always existed, it's just exposed now
+            that the header files are in a different include dir.
+
+2010-10-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Chromium: use dedicated event listener type in EventListenerWrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=48059
+
+        * src/EventListenerWrapper.cpp:
+        (WebKit::EventListenerWrapper::EventListenerWrapper):
+
+2010-10-21  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Adding an API that allows external
+        popup menus, without the use of WebCore::PopupMenuChromium.
+        Once this is hooked up in Chromium, the plan is to remove
+        entirely the external case from PopupMenuChromium.
+        https://bugs.webkit.org/show_bug.cgi?id=46016
+
+        * WebKit.gyp:
+        * public/WebExternalPopupMenu.h: Added.
+        * public/WebExternalPopupMenuClient.h: Added.
+        * public/WebMenuItemInfo.h:
+        (WebKit::WebMenuItemInfo::WebMenuItemInfo):
+        * public/WebView.h:
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::createExternalPopupMenu):
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createPopupMenu):
+        * src/ExternalPopupMenu.cpp: Added.
+        * src/ExternalPopupMenu.h: Added.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebView::setUseExternalPopupMenus):
+        (WebKit::WebViewImpl::useExternalPopupMenus):
+        * src/WebViewImpl.h:
+
 2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r70165.
@@ -66,10 +766,10 @@
         (WebKit::WebViewImpl::WebViewImpl):
         * src/WebViewImpl.h:
 
-2010-10-19  Leandro Gracia Gil  <leandrogracia@google.com>
+2010-10-20  Leandro Gracia Gil  <leandrogracia@google.com>
 
         Reviewed by Jeremy Orlow.
- 
+
         Patch the current speech input implementation to use and validate the
         nearest language tag. The language is now passed to the startRecognition
         methods so that language-specific recognition could be used. Also added
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
index 86a9387..aaf0b0a 100644
--- a/WebKit/chromium/DEPS
+++ b/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '63057'
+  'chromium_rev': '64214'
 }
 
 deps = {
diff --git a/WebKit/chromium/WebKit.gyp b/WebKit/chromium/WebKit.gyp
index e1e1a5f..f121c5f 100644
--- a/WebKit/chromium/WebKit.gyp
+++ b/WebKit/chromium/WebKit.gyp
@@ -150,6 +150,8 @@
                 'public/WebEditingAction.h',
                 'public/WebElement.h',
                 'public/WebExceptionCode.h',
+                'public/WebExternalPopupMenu.h',
+                'public/WebExternalPopupMenuClient.h',
                 'public/WebFileChooserCompletion.h',
                 'public/WebFileChooserParams.h',
                 'public/WebFileError.h',
@@ -255,6 +257,7 @@
                 'public/WebSpeechInputController.h',
                 'public/WebSpeechInputControllerMock.h',
                 'public/WebSpeechInputListener.h',
+                'public/WebSpeechInputResult.h',
                 'public/WebStorageArea.h',
                 'public/WebStorageEventDispatcher.h',
                 'public/WebStorageNamespace.h',
@@ -325,6 +328,8 @@
                 'src/EditorClientImpl.h',
                 'src/EventListenerWrapper.cpp',
                 'src/EventListenerWrapper.h',
+                'src/ExternalPopupMenu.cpp',
+                'src/ExternalPopupMenu.h',
                 'src/FrameLoaderClientImpl.cpp',
                 'src/FrameLoaderClientImpl.h',
                 'src/FrameNetworkingContextImpl.h',
@@ -514,6 +519,7 @@
                 'src/WebSharedWorkerImpl.h',
                 'src/WebSpeechInputControllerMockImpl.cpp',
                 'src/WebSpeechInputControllerMockImpl.h',
+                'src/WebSpeechInputResult.cpp',
                 'src/WebStorageAreaImpl.cpp',
                 'src/WebStorageAreaImpl.h',
                 'src/WebStorageEventDispatcherImpl.cpp',
@@ -875,6 +881,9 @@
                     'sources/': [
                         ['exclude', 'Win\\.cpp$'],
                     ],
+                    'dependencies': [
+                        'TestNetscapePlugIn',
+                    ],
                     'actions': [
                         {
                             'action_name': 'repack_locale',
@@ -902,7 +911,6 @@
                     'dependencies': [
                         'copy_mesa',
                         'LayoutTestHelper',
-                        'TestNetscapePlugIn',
                     ],
                     'mac_bundle_resources': [
                         '<(ahem_path)',
@@ -957,6 +965,11 @@
                         ['exclude', '(Gtk|Linux)\\.cpp$']
                     ]
                 }],
+                ['inside_chromium_build==0', {
+                    'dependencies': [
+                        '<(chromium_src_dir)/webkit/support/setup_third_party.gyp:third_party_headers',
+                    ]
+                }],
             ],
         },
     ], # targets
@@ -967,6 +980,54 @@
                 'type': 'executable',
                 'sources': ['../../WebKitTools/DumpRenderTree/chromium/LayoutTestHelperWin.cpp'],
             }],
+        }, {  # OS!="win"
+            'targets': [
+                {
+                    'target_name': 'TestNetscapePlugIn',
+                    'type': 'loadable_module',
+                    'sources': [ '<@(test_plugin_files)' ],
+                    'dependencies': [
+                        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+                    ],
+                    'include_dirs': [
+                        '<(chromium_src_dir)',
+                        '../../WebKitTools/DumpRenderTree/TestNetscapePlugIn',
+                        '../../WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders',
+                    ],
+
+                    'conditions': [
+                        ['OS=="mac"', {
+                            'mac_bundle': 1,
+                            # It would be nice to name this
+                            # TestNetscapePlugIn, but that name is already
+                            # used by the fork of this plugin in Chromium.
+                            'product_name': 'WebKitTestNetscapePlugIn',
+                            'product_extension': 'plugin',
+                            'link_settings': {
+                                'libraries': [
+                                    '$(SDKROOT)/System/Library/Frameworks/Carbon.framework',
+                                    '$(SDKROOT)/System/Library/Frameworks/Cocoa.framework',
+                                    '$(SDKROOT)/System/Library/Frameworks/QuartzCore.framework',
+                                ]
+                            },
+                            'xcode_settings': {
+                                'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',
+                                # This is a temporary fork of
+                                # DRT/TestNetscapePlugIn/mac/Info.plist.  Once
+                                # we get rid of our forked plugin in the
+                                # chromium repo, we can share the same
+                                # Info.plist.
+                                'INFOPLIST_FILE': '../../WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist',
+                            },
+                        }],
+                        ['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris"', {
+                            'cflags': [
+                                '-fvisibility=default',
+                            ],
+                        }],
+                    ],
+                },
+            ],
         }],
         ['OS=="mac"', {
             'targets': [
@@ -989,42 +1050,6 @@
                         'files': ['<(PRODUCT_DIR)/osmesa.so'],
                     }],
                 },
-                {
-                    'target_name': 'TestNetscapePlugIn',
-                    'type': 'loadable_module',
-                    'sources': [ '<@(test_plugin_files)' ],
-                    'dependencies': [
-                        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
-                    ],
-                    'include_dirs': [
-                        '<(chromium_src_dir)',
-                        '../../WebKitTools/DumpRenderTree/TestNetscapePlugIn',
-                        '../../WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders',
-                    ],
-
-                    # Mac specific stuff.
-                    'mac_bundle': 1,
-                    # It would be nice to name this TestNetscapePlugIn, but
-                    # that name is already used by the fork of this plugin in
-                    # Chromium.
-                    'product_name': 'WebKitTestNetscapePlugIn',
-                    'product_extension': 'plugin',
-                    'link_settings': {
-                        'libraries': [
-                            '$(SDKROOT)/System/Library/Frameworks/Carbon.framework',
-                            '$(SDKROOT)/System/Library/Frameworks/Cocoa.framework',
-                            '$(SDKROOT)/System/Library/Frameworks/QuartzCore.framework',
-                        ]
-                    },
-                    'xcode_settings': {
-                        'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',
-                        # This is a temporary fork of
-                        # DRT/TestNetscapePlugIn/mac/Info.plist.  Once we get
-                        # rid of our forked plugin in the chromium repo, we
-                        # can share the same Info.plist.
-                        'INFOPLIST_FILE': '../../WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist',
-                    },
-                }
             ],
         }],
     ], # conditions
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
index 1e78b04..cd6bf20 100644
--- a/WebKit/chromium/features.gypi
+++ b/WebKit/chromium/features.gypi
@@ -69,7 +69,6 @@
         'ENABLE_ORIENTATION_EVENTS=0',
         'ENABLE_PROGRESS_TAG=1',
         'ENABLE_RUBY=1',
-        'ENABLE_SANDBOX=1',
         'ENABLE_SHARED_WORKERS=1',
         'ENABLE_SVG=1',
         'ENABLE_SVG_ANIMATION=1',
@@ -80,6 +79,7 @@
         'ENABLE_TOUCH_EVENTS=1',
         'ENABLE_V8_SCRIPT_DEBUG_SERVER=1',
         'ENABLE_VIDEO=1',
+        'ENABLE_WEB_AUDIO=0',
         'ENABLE_WEB_SOCKETS=1',
         'ENABLE_WEB_TIMING=1',
         'ENABLE_WORKERS=1',
@@ -88,6 +88,7 @@
         'ENABLE_XSLT=1',
         'WTF_USE_ACCELERATED_COMPOSITING=1',
         'WTF_USE_WEBP=1',
+        'WTF_USE_WEBKIT_IMAGE_DECODERS=1',
       ],
 
       'use_accelerated_compositing%': 1,
diff --git a/WebKit/chromium/public/WebExternalPopupMenu.h b/WebKit/chromium/public/WebExternalPopupMenu.h
new file mode 100644
index 0000000..49630cf
--- /dev/null
+++ b/WebKit/chromium/public/WebExternalPopupMenu.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebExternalPopupMenu_h
+#define WebExternalPopupMenu_h
+
+namespace WebKit {
+
+struct WebRect;
+
+class WebExternalPopupMenu {
+public:
+    virtual void show(const WebRect& bounds) = 0;
+    virtual void close() = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebExternalPopupMenu_h
diff --git a/WebKit/chromium/public/WebExternalPopupMenuClient.h b/WebKit/chromium/public/WebExternalPopupMenuClient.h
new file mode 100644
index 0000000..e01bc2d
--- /dev/null
+++ b/WebKit/chromium/public/WebExternalPopupMenuClient.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebExternalPopupMenuClient_h
+#define WebExternalPopupMenuClient_h
+
+namespace WebKit {
+
+class WebExternalPopupMenuClient {
+public:
+    // Should be called when the currently selected item in the popup menu
+    // changed. Can be -1 if there is no selection.
+    virtual void didChangeSelection(int index) = 0;
+
+    // Should be called when an index has been accepted.
+    // Note that it is not safe to access this WebExternalPopupClientMenu after
+    // this has been called as it might not be valid anymore.
+    virtual void didAcceptIndex(int index) = 0;
+
+    // Should be called when the popup menu was discarded (closed without a
+    // selection.
+    // Note that it is not safe to access this WebExternalPopupClientMenu after
+    // this has been called as it might not be valid anymore.
+    virtual void didCancel() = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebExternalPopupMenuClient_h
diff --git a/WebKit/chromium/public/WebFileError.h b/WebKit/chromium/public/WebFileError.h
index cfe8882..e7a17c3 100644
--- a/WebKit/chromium/public/WebFileError.h
+++ b/WebKit/chromium/public/WebFileError.h
@@ -34,15 +34,18 @@ namespace WebKit {
 
 // File-related error code defined in HTML5 File API.
 enum WebFileError {
-    WebFileErrorNoModificationAllowed = 7,
-    WebFileErrorNotFound = 8,
-    WebFileErrorInvalidState = 11,
-    WebFileErrorInvalidModification = 13,
-    WebFileErrorSecurity = 18,
-    WebFileErrorAbort = 20,
-    WebFileErrorQuotaExceeded = 22,
-    WebFileErrorNotReadable = 24,
-    WebFileErrorEncoding = 26,
+    WebFileErrorNotFound = 1,
+    WebFileErrorSecurity = 2,
+    WebFileErrorAbort = 3,
+    WebFileErrorNotReadable = 4,
+    WebFileErrorEncoding = 5,
+    WebFileErrorNoModificationAllowed = 6,
+    WebFileErrorInvalidState = 7,
+    WebFileErrorSyntax = 8,
+    WebFileErrorInvalidModification = 9,
+    WebFileErrorQuotaExceeded = 10,
+    WebFileErrorTypeMismatch = 11,
+    WebFileErrorPathExists = 12,
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebFrameClient.h b/WebKit/chromium/public/WebFrameClient.h
index 458604e..c5cfc21 100644
--- a/WebKit/chromium/public/WebFrameClient.h
+++ b/WebKit/chromium/public/WebFrameClient.h
@@ -355,10 +355,8 @@ public:
         WebFrame*, WebFileSystem::Type, long long size,
         bool create, WebFileSystemCallbacks*) { }
 
-    // This method will be deleted once chromium uses the new method above.
-    virtual void openFileSystem(
-        WebFrame*, WebFileSystem::Type, long long size,
-        WebFileSystemCallbacks*) { }
+    // FIXME: This method should be deleted once chromium implements the new method above.
+    virtual void openFileSystem(WebFrame* frame, WebFileSystem::Type type, long long size, WebFileSystemCallbacks* callbacks) { return openFileSystem(frame, type, size, true, callbacks); }
 
 protected:
     ~WebFrameClient() { }
diff --git a/WebKit/chromium/public/WebIDBCursor.h b/WebKit/chromium/public/WebIDBCursor.h
index 2e5e98b..98f7a6b 100644
--- a/WebKit/chromium/public/WebIDBCursor.h
+++ b/WebKit/chromium/public/WebIDBCursor.h
@@ -35,7 +35,7 @@
 
 namespace WebKit {
 
-// See comment in WebIndexedDatabase for a high level overview these classes.
+// See comment in WebIDBFactory for a high level overview these classes.
 class WebIDBCursor {
 public:
     virtual ~WebIDBCursor() { }
diff --git a/WebKit/chromium/public/WebIDBDatabase.h b/WebKit/chromium/public/WebIDBDatabase.h
index c67a117..19096cc 100644
--- a/WebKit/chromium/public/WebIDBDatabase.h
+++ b/WebKit/chromium/public/WebIDBDatabase.h
@@ -37,7 +37,7 @@ class WebIDBCallbacks;
 class WebIDBObjectStore;
 class WebIDBTransaction;
 
-// See comment in WebIndexedDatabase for a high level overview of these classes.
+// See comment in WebIDBFactory for a high level overview of these classes.
 class WebIDBDatabase {
 public:
     virtual ~WebIDBDatabase() { }
diff --git a/WebKit/chromium/public/WebIDBDatabaseError.h b/WebKit/chromium/public/WebIDBDatabaseError.h
index a237d5f..c181f78 100644
--- a/WebKit/chromium/public/WebIDBDatabaseError.h
+++ b/WebKit/chromium/public/WebIDBDatabaseError.h
@@ -37,7 +37,7 @@ namespace WebCore { class IDBDatabaseError; }
 
 namespace WebKit {
 
-// See comment in WebIndexedDatabase for a high level overview these classes.
+// See comment in WebIDBFactory for a high level overview these classes.
 class WebIDBDatabaseError {
 public:
     ~WebIDBDatabaseError() { reset(); }
diff --git a/WebKit/chromium/public/WebIDBFactory.h b/WebKit/chromium/public/WebIDBFactory.h
index c7fbe02..66ceadb 100755
--- a/WebKit/chromium/public/WebIDBFactory.h
+++ b/WebKit/chromium/public/WebIDBFactory.h
@@ -58,6 +58,8 @@ public:
     }
 
     // The file name that would be used for persisting a given indexed database on the file system.
+    WEBKIT_API static WebString databaseFileName(const WebSecurityOrigin&);
+    // FIXME: Remove after roll.
     WEBKIT_API static WebString databaseFileName(const WebString& name, const WebSecurityOrigin&);
 };
 
diff --git a/WebKit/chromium/public/WebIDBIndex.h b/WebKit/chromium/public/WebIDBIndex.h
index 7c77878..0c0d79a 100644
--- a/WebKit/chromium/public/WebIDBIndex.h
+++ b/WebKit/chromium/public/WebIDBIndex.h
@@ -36,7 +36,7 @@ class WebIDBCallbacks;
 class WebIDBKey;
 class WebIDBKeyRange;
 
-// See comment in WebIndexedDatabase for a high level overview of these classes.
+// See comment in WebIDBFactory for a high level overview of these classes.
 class WebIDBIndex {
 public:
     virtual ~WebIDBIndex() { }
diff --git a/WebKit/chromium/public/WebIDBKey.h b/WebKit/chromium/public/WebIDBKey.h
index 60d3325..171fe78 100644
--- a/WebKit/chromium/public/WebIDBKey.h
+++ b/WebKit/chromium/public/WebIDBKey.h
@@ -82,7 +82,6 @@ public:
 #endif
 
 private:
-
     WebPrivatePtr<WebCore::IDBKey> m_private;
 };
 
diff --git a/WebKit/chromium/public/WebIDBObjectStore.h b/WebKit/chromium/public/WebIDBObjectStore.h
index f5f1473..89dae02 100755
--- a/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/WebKit/chromium/public/WebIDBObjectStore.h
@@ -38,7 +38,7 @@ namespace WebKit {
 class WebIDBKeyRange;
 class WebIDBTransaction;
 
-// See comment in WebIndexedDatabase for a high level overview these classes.
+// See comment in WebIDBFactory for a high level overview these classes.
 class WebIDBObjectStore {
 public:
     virtual ~WebIDBObjectStore() { }
diff --git a/WebKit/chromium/public/WebIDBTransaction.h b/WebKit/chromium/public/WebIDBTransaction.h
index 6a739c3..385dd1e 100644
--- a/WebKit/chromium/public/WebIDBTransaction.h
+++ b/WebKit/chromium/public/WebIDBTransaction.h
@@ -35,7 +35,7 @@ namespace WebKit {
 class WebIDBObjectStore;
 class WebIDBTransactionCallbacks;
 
-// See comment in WebIndexedDatabase for a high level overview of these classes.
+// See comment in WebIDBFactory for a high level overview of these classes.
 class WebIDBTransaction {
 public:
     virtual ~WebIDBTransaction() { }
diff --git a/WebKit/chromium/public/WebMenuItemInfo.h b/WebKit/chromium/public/WebMenuItemInfo.h
index d513e66..445dfb4 100644
--- a/WebKit/chromium/public/WebMenuItemInfo.h
+++ b/WebKit/chromium/public/WebMenuItemInfo.h
@@ -44,6 +44,15 @@ struct WebMenuItemInfo {
         Group,
         Separator,
     };
+
+    WebMenuItemInfo() 
+        : type(Option)
+        , action(0)
+        , enabled(false)
+        , checked(false)
+    {
+    }
+
     WebString label;
     Type type;
     unsigned action;
diff --git a/WebKit/chromium/public/WebSecurityOrigin.h b/WebKit/chromium/public/WebSecurityOrigin.h
index efcb2e9..a241682 100644
--- a/WebKit/chromium/public/WebSecurityOrigin.h
+++ b/WebKit/chromium/public/WebSecurityOrigin.h
@@ -100,6 +100,7 @@ public:
     WebSecurityOrigin(const WTF::PassRefPtr<WebCore::SecurityOrigin>&);
     WebSecurityOrigin& operator=(const WTF::PassRefPtr<WebCore::SecurityOrigin>&);
     operator WTF::PassRefPtr<WebCore::SecurityOrigin>() const;
+    WebCore::SecurityOrigin* get() const;
 #endif
 
 private:
diff --git a/WebKit/chromium/public/WebSpeechInputController.h b/WebKit/chromium/public/WebSpeechInputController.h
index 5408741..6ed546f 100644
--- a/WebKit/chromium/public/WebSpeechInputController.h
+++ b/WebKit/chromium/public/WebSpeechInputController.h
@@ -35,7 +35,9 @@
 
 namespace WebKit {
 
+class WebString;
 struct WebRect;
+class WebString;
 
 // Provides an embedder API called by WebKit.
 class WebSpeechInputController {
@@ -43,7 +45,7 @@ public:
     // Starts speech recognition. Speech will get recorded until the endpointer detects silence,
     // runs to the limit or stopRecording is called. Progress indications and the recognized
     // text are returned via the listener interface.
-    virtual bool startRecognition(int requestId, const WebRect&)
+    virtual bool startRecognition(int requestId, const WebRect& elementRect, const WebString& language, const WebString& grammar)
     {
         WEBKIT_ASSERT_NOT_REACHED();
         return false;
diff --git a/WebKit/chromium/public/WebSpeechInputControllerMock.h b/WebKit/chromium/public/WebSpeechInputControllerMock.h
index 9a26235..b4c50a0 100644
--- a/WebKit/chromium/public/WebSpeechInputControllerMock.h
+++ b/WebKit/chromium/public/WebSpeechInputControllerMock.h
@@ -44,6 +44,10 @@ public:
         WebSpeechInputListener* listener);
     virtual ~WebSpeechInputControllerMock() { }
 
+    virtual void setMockRecognitionResult(const WebString& result, const WebString& language) = 0;
+
+    // FIXME: this is a fix for a two-sided patch. Delete as soon as the chromium side is patched.
+    // Chromium patch not uploaded yet, but will depend on http://codereview.chromium.org/3615005/show patch.
     virtual void setMockRecognitionResult(const WebString& result) = 0;
 };
 
diff --git a/WebKit/chromium/public/WebSpeechInputListener.h b/WebKit/chromium/public/WebSpeechInputListener.h
index 6dc3d49..091f984 100644
--- a/WebKit/chromium/public/WebSpeechInputListener.h
+++ b/WebKit/chromium/public/WebSpeechInputListener.h
@@ -31,6 +31,8 @@
 #ifndef WebSpeechInputListener_h
 #define WebSpeechInputListener_h
 
+#include "WebSpeechInputResult.h"
+
 namespace WebKit {
 
 class WebString;
@@ -47,19 +49,19 @@ public:
     // WebSpeechInputController::stopRecording() was called.
     // Typically after this call the listener would update the UI to reflect that recognition is
     // in progress.
-    virtual void didCompleteRecording(int) = 0;
+    virtual void didCompleteRecording(int) { WEBKIT_ASSERT_NOT_REACHED(); }
 
     // Gives results from speech recognition, either partial or the final results.
     // This method can potentially get called multiple times if there are partial results
     // available as the user keeps speaking. If the speech could not be recognized properly
     // or if there was any other errors in the process, this method may never be called.
-    virtual void setRecognitionResult(int, const WebString&) = 0;
+    virtual void setRecognitionResult(int, const WebSpeechInputResultArray&) { WEBKIT_ASSERT_NOT_REACHED(); }
 
     // Informs that speech recognition has completed. This gets invoked irrespective of whether
     // recognition was succesful or not, whether setRecognitionResult() was invoked or not. The
     // handler typically frees up any temporary resources allocated and waits for the next speech
     // recognition request.
-    virtual void didCompleteRecognition(int) = 0;
+    virtual void didCompleteRecognition(int) { WEBKIT_ASSERT_NOT_REACHED(); }
 
 protected:
     ~WebSpeechInputListener() { }
diff --git a/WebKit/chromium/public/WebSpeechInputResult.h b/WebKit/chromium/public/WebSpeechInputResult.h
new file mode 100644
index 0000000..8f1a8f5
--- /dev/null
+++ b/WebKit/chromium/public/WebSpeechInputResult.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSpeechInputResult_h
+#define WebSpeechInputResult_h
+
+#include "WebCommon.h"
+#include "WebPrivatePtr.h"
+#include "WebString.h"
+#include "WebVector.h"
+
+namespace WebCore {
+class SpeechInputResult;
+}
+
+namespace WebKit {
+
+// This class holds one speech recognition result including the text and other related
+// fields, as received from the embedder.
+class WebSpeechInputResult {
+public:
+    WebSpeechInputResult() { }
+    ~WebSpeechInputResult() { reset(); }
+
+    WEBKIT_API void set(const WebString& utterance, double confidence);
+    WEBKIT_API void reset();
+
+#if WEBKIT_IMPLEMENTATION
+    WebSpeechInputResult(const WTF::PassRefPtr<WebCore::SpeechInputResult>&);
+    operator WTF::PassRefPtr<WebCore::SpeechInputResult>() const;
+#endif
+
+private:
+    WebPrivatePtr<WebCore::SpeechInputResult> m_private;
+};
+
+typedef WebVector<WebSpeechInputResult> WebSpeechInputResultArray;
+
+} // namespace WebKit
+
+#endif // WebSpeechInputResult_h
diff --git a/WebKit/chromium/public/WebView.h b/WebKit/chromium/public/WebView.h
index e504bd7..ce8e512 100644
--- a/WebKit/chromium/public/WebView.h
+++ b/WebKit/chromium/public/WebView.h
@@ -69,13 +69,13 @@ public:
         UserContentInjectInAllFrames,
         UserContentInjectInTopFrameOnly
     };
-    
+
     // Controls which documents user styles are injected into.
     enum UserStyleInjectionTime {
         UserStyleInjectInExistingDocuments,
         UserStyleInjectInSubsequentDocuments
     };
-    
+
 
     // Initialization ------------------------------------------------------
 
@@ -315,6 +315,12 @@ public:
     virtual void performCustomContextMenuAction(unsigned action) = 0;
 
 
+    // Popup menu ----------------------------------------------------------
+
+    // Sets whether select popup menus should be rendered by the browser.
+    WEBKIT_API static void setUseExternalPopupMenus(bool);
+
+
     // Visited link state --------------------------------------------------
 
     // Tells all WebView instances to update the visited link state for the
diff --git a/WebKit/chromium/public/WebViewClient.h b/WebKit/chromium/public/WebViewClient.h
index 858cb2a..edd9579 100644
--- a/WebKit/chromium/public/WebViewClient.h
+++ b/WebKit/chromium/public/WebViewClient.h
@@ -48,6 +48,8 @@ class WebAccessibilityObject;
 class WebDeviceOrientationClient;
 class WebDragData;
 class WebElement;
+class WebExternalPopupMenu;
+class WebExternalPopupMenuClient;
 class WebFileChooserCompletion;
 class WebFrame;
 class WebGeolocationService;
@@ -87,6 +89,8 @@ public:
     // responsible for rendering the contents of the popup menu.
     virtual WebWidget* createPopupMenu(WebPopupType) { return 0; }
     virtual WebWidget* createPopupMenu(const WebPopupMenuInfo&) { return 0; }
+    virtual WebExternalPopupMenu* createExternalPopupMenu(
+        const WebPopupMenuInfo&, WebExternalPopupMenuClient*) { return 0; }
 
     // Create a session storage namespace object associated with this WebView.
     virtual WebStorageNamespace* createSessionStorageNamespace(unsigned quota) { return 0; }
diff --git a/WebKit/chromium/src/ApplicationCacheHost.cpp b/WebKit/chromium/src/ApplicationCacheHost.cpp
index f1b1a91..a6e66c6 100644
--- a/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -113,6 +113,11 @@ void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
     }
 }
 
+void ApplicationCacheHost::maybeLoadMainResourceForRedirect(ResourceRequest&, SubstituteData&)
+{
+    // N/A to the chromium port
+}
+
 bool ApplicationCacheHost::maybeLoadFallbackForMainResponse(const ResourceRequest&, const ResourceResponse& response)
 {
     if (m_internal) {
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
index 9647a44..c6ab85a 100644
--- a/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -37,6 +37,8 @@
 #include "ApplicationCacheHost.h"
 #include "AsyncFileSystem.h"
 #include "EditorInsertAction.h"
+#include "FileError.h"
+#include "FileMetadata.h"
 #include "FontDescription.h"
 #include "FontSmoothingMode.h"
 #include "HTMLInputElement.h"
@@ -56,6 +58,8 @@
 #include "WebClipboard.h"
 #include "WebCursorInfo.h"
 #include "WebEditingAction.h"
+#include "WebFileError.h"
+#include "WebFileInfo.h"
 #include "WebFileSystem.h"
 #include "WebFontDescription.h"
 #include "WebIDBKey.h"
@@ -361,4 +365,20 @@ COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::NumberType, IDBKey::NumberType);
 #if ENABLE(FILE_SYSTEM)
 COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypeTemporary, AsyncFileSystem::Temporary);
 COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypePersistent, AsyncFileSystem::Persistent);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileInfo::TypeUnknown, FileMetadata::TypeUnknown);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileInfo::TypeFile, FileMetadata::TypeFile);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileInfo::TypeDirectory, FileMetadata::TypeDirectory);
 #endif
+
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorNotFound, FileError::NOT_FOUND_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorSecurity, FileError::SECURITY_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorAbort, FileError::ABORT_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorNotReadable, FileError::NOT_READABLE_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorEncoding, FileError::ENCODING_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorNoModificationAllowed, FileError::NO_MODIFICATION_ALLOWED_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorInvalidState, FileError::INVALID_STATE_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorSyntax, FileError::SYNTAX_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorInvalidModification, FileError::INVALID_MODIFICATION_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorQuotaExceeded, FileError::QUOTA_EXCEEDED_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorTypeMismatch, FileError::TYPE_MISMATCH_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorPathExists, FileError::PATH_EXISTS_ERR);
diff --git a/WebKit/chromium/src/AsyncFileWriterChromium.cpp b/WebKit/chromium/src/AsyncFileWriterChromium.cpp
index 8969094..71cf3b5 100644
--- a/WebKit/chromium/src/AsyncFileWriterChromium.cpp
+++ b/WebKit/chromium/src/AsyncFileWriterChromium.cpp
@@ -85,7 +85,7 @@ void AsyncFileWriterChromium::didTruncate()
 
 void AsyncFileWriterChromium::didFail(WebKit::WebFileError error)
 {
-    m_client->didFail(error);
+    m_client->didFail(static_cast<FileError::ErrorCode>(error));
 }
 
 } // namespace
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.cpp b/WebKit/chromium/src/BackForwardListClientImpl.cpp
index 2976329..af659bc 100644
--- a/WebKit/chromium/src/BackForwardListClientImpl.cpp
+++ b/WebKit/chromium/src/BackForwardListClientImpl.cpp
@@ -84,14 +84,15 @@ void BackForwardListClientImpl::goToItem(HistoryItem* item)
         m_pendingHistoryItem = 0;
 }
 
-HistoryItem* BackForwardListClientImpl::currentItem()
-{
-    return m_currentItem.get();
-}
-
 HistoryItem* BackForwardListClientImpl::itemAtIndex(int index)
 {
-    if (!m_webView->client() || index > forwardListCount() || -index > backListCount())
+    if (!m_webView->client())
+        return 0;
+
+    if (!index)
+        return m_currentItem.get();
+
+    if (index > forwardListCount() || -index > backListCount())
         return 0;
 
     // Since we don't keep the entire back/forward list, we have no way to
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.h b/WebKit/chromium/src/BackForwardListClientImpl.h
index 1d8beb0..b795ecf 100644
--- a/WebKit/chromium/src/BackForwardListClientImpl.h
+++ b/WebKit/chromium/src/BackForwardListClientImpl.h
@@ -31,7 +31,7 @@
 #ifndef BackForwardListClientImpl_h
 #define BackForwardListClientImpl_h
 
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 
 namespace WebKit {
 class WebViewImpl;
@@ -50,7 +50,6 @@ private:
     // WebCore::BackForwardListClient methods:
     virtual void addItem(PassRefPtr<WebCore::HistoryItem>);
     virtual void goToItem(WebCore::HistoryItem*);
-    virtual WebCore::HistoryItem* currentItem();
     virtual WebCore::HistoryItem* itemAtIndex(int index);
     virtual int backListCount();
     virtual int forwardListCount();
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
index 4f1705f..df13b29 100644
--- a/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -40,6 +40,7 @@
 #include "DatabaseTracker.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "ExternalPopupMenu.h"
 #include "FileChooser.h"
 #include "FloatRect.h"
 #include "FrameLoadRequest.h"
@@ -51,6 +52,7 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "IntRect.h"
+#include "NavigationAction.h"
 #include "Node.h"
 #include "NotificationPresenterImpl.h"
 #include "Page.h"
@@ -251,7 +253,7 @@ void ChromeClientImpl::focusedNodeChanged(Node* node)
 }
 
 Page* ChromeClientImpl::createWindow(
-    Frame* frame, const FrameLoadRequest& r, const WindowFeatures& features)
+    Frame* frame, const FrameLoadRequest& r, const WindowFeatures& features, const NavigationAction&)
 {
     if (!m_webView->client())
         return 0;
@@ -833,6 +835,9 @@ bool ChromeClientImpl::selectItemWritingDirectionIsNatural()
 
 PassRefPtr<PopupMenu> ChromeClientImpl::createPopupMenu(PopupMenuClient* client) const
 {
+    if (WebViewImpl::useExternalPopupMenus())
+        return adoptRef(new ExternalPopupMenu(client, m_webView->client()));
+    
     return adoptRef(new PopupMenuChromium(client));
 }
 
diff --git a/WebKit/chromium/src/ChromeClientImpl.h b/WebKit/chromium/src/ChromeClientImpl.h
index b1208f7..039fc1b 100644
--- a/WebKit/chromium/src/ChromeClientImpl.h
+++ b/WebKit/chromium/src/ChromeClientImpl.h
@@ -71,7 +71,7 @@ public:
     virtual void takeFocus(WebCore::FocusDirection);
     virtual void focusedNodeChanged(WebCore::Node*);
     virtual WebCore::Page* createWindow(
-        WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
+        WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&);
     virtual void show();
     virtual bool canRunModal();
     virtual void runModal();
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index d9ccb17..d33a06b 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -241,7 +241,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         if (m_webView->focusedWebCoreFrame()->editor()->isContinuousSpellCheckingEnabled()) {
             data.isSpellCheckingEnabled = true;
             // Spellchecking might be enabled for the field, but could be disabled on the node.
-            if (m_webView->focusedWebCoreFrame()->editor()->spellCheckingEnabledInFocusedNode())
+            if (m_webView->focusedWebCoreFrame()->editor()->isSpellCheckingEnabledInFocusedNode())
                 data.misspelledWord = selectMisspelledWord(defaultMenu, selectedFrame);
         }
     }
diff --git a/WebKit/chromium/src/EditorClientImpl.cpp b/WebKit/chromium/src/EditorClientImpl.cpp
index 11977b6..bc1d206 100644
--- a/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/WebKit/chromium/src/EditorClientImpl.cpp
@@ -124,7 +124,7 @@ bool EditorClientImpl::shouldSpellcheckByDefault()
     const Editor* editor = frame->editor();
     if (!editor)
         return false;
-    if (editor->spellCheckingEnabledInFocusedNode())
+    if (editor->isSpellCheckingEnabledInFocusedNode())
         return true;
     const Document* document = frame->document();
     if (!document)
diff --git a/WebKit/chromium/src/EventListenerWrapper.cpp b/WebKit/chromium/src/EventListenerWrapper.cpp
index 706ba21..6360932 100644
--- a/WebKit/chromium/src/EventListenerWrapper.cpp
+++ b/WebKit/chromium/src/EventListenerWrapper.cpp
@@ -40,7 +40,7 @@
 namespace WebKit {
 
 EventListenerWrapper::EventListenerWrapper(WebDOMEventListener* webDOMEventListener)
-    : EventListener(EventListener::JSEventListenerType)
+    : EventListener(EventListener::NativeEventListenerType)
     , m_webDOMEventListener(webDOMEventListener)
 {
 }
diff --git a/WebKit/chromium/src/ExternalPopupMenu.cpp b/WebKit/chromium/src/ExternalPopupMenu.cpp
new file mode 100644
index 0000000..a0243eb
--- /dev/null
+++ b/WebKit/chromium/src/ExternalPopupMenu.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ExternalPopupMenu.h"
+
+#include "FrameView.h"
+#include "IntPoint.h"
+#include "PopupMenuClient.h"
+#include "TextDirection.h"
+#include "WebExternalPopupMenu.h"
+#include "WebMenuItemInfo.h"
+#include "WebPopupMenuInfo.h"
+#include "WebVector.h"
+#include "WebViewClient.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+ExternalPopupMenu::ExternalPopupMenu(PopupMenuClient* popupMenuClient,
+                                     WebViewClient* webViewClient)
+    : m_popupMenuClient(popupMenuClient)
+    , m_webViewClient(webViewClient)
+    , m_webExternalPopupMenu(0)
+{
+}
+
+ExternalPopupMenu::~ExternalPopupMenu()
+{
+}
+
+void ExternalPopupMenu::show(const IntRect& rect, FrameView* v, int index)
+{
+    // WebCore reuses the PopupMenu of a page.
+    // For simplicity, we do recreate the actual external popup everytime.
+    hide();
+
+    WebPopupMenuInfo info;
+    getPopupMenuInfo(&info);
+    m_webExternalPopupMenu =
+        m_webViewClient->createExternalPopupMenu(info, this);
+    m_webExternalPopupMenu->show(v->contentsToWindow(rect));
+}
+
+void ExternalPopupMenu::hide()
+{
+    if (m_popupMenuClient)
+        m_popupMenuClient->popupDidHide();
+    if (!m_webExternalPopupMenu)
+        return;
+    m_webExternalPopupMenu->close();
+    m_webExternalPopupMenu = 0;
+}
+
+void ExternalPopupMenu::updateFromElement()
+{
+}
+
+void ExternalPopupMenu::disconnectClient()
+{
+    hide();
+    m_popupMenuClient = 0;
+}
+
+void ExternalPopupMenu::didChangeSelection(int index)
+{
+    if (m_popupMenuClient)
+        m_popupMenuClient->selectionChanged(index);
+}
+
+void ExternalPopupMenu::didAcceptIndex(int index)
+{
+    if (m_popupMenuClient) {
+        m_popupMenuClient->valueChanged(index);
+        m_popupMenuClient->popupDidHide();
+    }
+    m_webExternalPopupMenu = 0;
+}
+
+void ExternalPopupMenu::didCancel()
+{
+    if (m_popupMenuClient)
+        m_popupMenuClient->popupDidHide();
+    m_webExternalPopupMenu = 0;
+}
+
+void ExternalPopupMenu::getPopupMenuInfo(WebPopupMenuInfo* info)
+{
+    int itemCount = m_popupMenuClient->listSize();
+    WebVector<WebPopupMenuInfo::Item> items(
+        static_cast<size_t>(itemCount));
+    for (int i = 0; i < itemCount; ++i) {
+        WebPopupMenuInfo::Item& popupItem = items[i];
+        popupItem.label = m_popupMenuClient->itemText(i);
+        if (m_popupMenuClient->itemIsSeparator(i))
+            popupItem.type = WebMenuItemInfo::Separator;
+        else if (m_popupMenuClient->itemIsLabel(i))
+            popupItem.type = WebMenuItemInfo::Group;
+        else
+            popupItem.type = WebMenuItemInfo::Option;
+        popupItem.enabled = m_popupMenuClient->itemIsEnabled(i);
+    }
+
+    info->itemHeight = m_popupMenuClient->menuStyle().font().height();
+    info->itemFontSize =
+        static_cast<int>(m_popupMenuClient->menuStyle().font().size());
+    info->selectedIndex = m_popupMenuClient->selectedIndex();
+    info->rightAligned =
+        m_popupMenuClient->menuStyle().textDirection() == WebCore::RTL;
+    info->items.swap(items);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/ExternalPopupMenu.h b/WebKit/chromium/src/ExternalPopupMenu.h
new file mode 100644
index 0000000..6963e8d
--- /dev/null
+++ b/WebKit/chromium/src/ExternalPopupMenu.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ExternalPopupMenu_h
+#define ExternalPopupMenu_h
+
+#include "PopupMenu.h"
+#include "WebExternalPopupMenuClient.h"
+
+namespace WebCore {
+class FrameView;
+class IntRect;
+class PopupMenuClient;
+}
+
+namespace WebKit {
+
+class WebExternalPopupMenu;
+class WebViewClient;
+struct WebPopupMenuInfo;
+
+// The ExternalPopupMenu connects the actual implementation of the popup menu
+// to the WebCore popup menu.
+class ExternalPopupMenu : public WebCore::PopupMenu,
+                          public WebExternalPopupMenuClient {
+public:
+    ExternalPopupMenu(WebCore::PopupMenuClient*, WebViewClient*);
+    virtual ~ExternalPopupMenu();
+
+private:
+    // WebCore::PopupMenu methods:
+    virtual void show(const WebCore::IntRect&, WebCore::FrameView*, int index);
+    virtual void hide();
+    virtual void updateFromElement();
+    virtual void disconnectClient();
+
+    // WebExternalPopupClient methods:
+    virtual void didChangeSelection(int index);
+    virtual void didAcceptIndex(int index);
+    virtual void didCancel();
+
+    // Fills |info| with the popup menu information contained in the
+    // WebCore::PopupMenuClient associated with this ExternalPopupMenu.
+    void getPopupMenuInfo(WebPopupMenuInfo* info);
+
+    WebCore::PopupMenuClient* m_popupMenuClient;
+    WebViewClient* m_webViewClient;
+
+    // The actual implementor of the show menu.
+    WebExternalPopupMenu* m_webExternalPopupMenu;
+}; 
+
+} // namespace WebKit
+
+#endif // ExternalPopupMenu_h
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index b4c62f4..29141ac 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -812,11 +812,11 @@ void FrameLoaderClientImpl::dispatchDidFirstVisuallyNonEmptyLayout()
         m_webFrame->client()->didFirstVisuallyNonEmptyLayout(m_webFrame);
 }
 
-Frame* FrameLoaderClientImpl::dispatchCreatePage()
+Frame* FrameLoaderClientImpl::dispatchCreatePage(const NavigationAction& action)
 {
     struct WindowFeatures features;
     Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
-        m_webFrame->frame(), FrameLoadRequest(), features);
+        m_webFrame->frame(), FrameLoadRequest(), features, action);
 
     // Make sure that we have a valid disposition.  This should have been set in
     // the preceeding call to dispatchDecidePolicyForNewWindowAction.
@@ -1342,6 +1342,10 @@ void FrameLoaderClientImpl::transitionToCommittedForNewPage()
     makeDocumentView();
 }
 
+void FrameLoaderClientImpl::dispatchDidBecomeFrameset(bool)
+{
+}
+
 bool FrameLoaderClientImpl::canCachePage() const
 {
     // Since we manage the cache, always report this page as non-cacheable to
@@ -1385,6 +1389,11 @@ void FrameLoaderClientImpl::didTransferChildFrameToNewDocument(Page*)
     m_webFrame->setClient(newParent->client());
 }
 
+void FrameLoaderClientImpl::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
+    notImplemented();
+}
+
 PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
     const IntSize& size, // FIXME: how do we use this?
     HTMLPlugInElement* element,
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.h b/WebKit/chromium/src/FrameLoaderClientImpl.h
index 0b15db6..ef00ed3 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -112,7 +112,7 @@ public:
     virtual void dispatchDidFinishLoad();
     virtual void dispatchDidFirstLayout();
     virtual void dispatchDidFirstVisuallyNonEmptyLayout();
-    virtual WebCore::Frame* dispatchCreatePage();
+    virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
     virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction function, const WTF::String& mime_type, const WebCore::ResourceRequest&);
     virtual void dispatchDecidePolicyForNewWindowAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState> form_state, const WTF::String& frame_name);
@@ -169,6 +169,7 @@ public:
     virtual void savePlatformDataToCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedForNewPage();
+    virtual void dispatchDidBecomeFrameset(bool);
     virtual bool canCachePage() const;
     virtual void download(
         WebCore::ResourceHandle*, const WebCore::ResourceRequest&,
@@ -180,6 +181,7 @@ public:
         const WTF::String& referrer, bool allowsScrolling,
         int marginWidth, int marginHeight);
     virtual void didTransferChildFrameToNewDocument(WebCore::Page*);
+    virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page*);
     virtual PassRefPtr<WebCore::Widget> createPlugin(
         const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&,
         const Vector<WTF::String>&, const Vector<WTF::String>&,
diff --git a/WebKit/chromium/src/SpeechInputClientImpl.cpp b/WebKit/chromium/src/SpeechInputClientImpl.cpp
index 963d440..b5ed384 100644
--- a/WebKit/chromium/src/SpeechInputClientImpl.cpp
+++ b/WebKit/chromium/src/SpeechInputClientImpl.cpp
@@ -32,15 +32,21 @@
 #include "SpeechInputClientImpl.h"
 
 #include "PlatformString.h"
+#include "SpeechInputListener.h"
 #include "WebSpeechInputController.h"
 #include "WebString.h"
 #include "WebViewClient.h"
-#include "page/SpeechInputListener.h"
+#include <wtf/PassOwnPtr.h>
 
 #if ENABLE(INPUT_SPEECH)
 
 namespace WebKit {
 
+PassOwnPtr<SpeechInputClientImpl> SpeechInputClientImpl::create(WebViewClient* client)
+{
+    return adoptPtr(new SpeechInputClientImpl(client));
+}
+
 SpeechInputClientImpl::SpeechInputClientImpl(WebViewClient* web_view_client)
     : m_controller(web_view_client ? web_view_client->speechInputController(this) : 0)
     , m_listener(0)
@@ -56,10 +62,10 @@ void SpeechInputClientImpl::setListener(WebCore::SpeechInputListener* listener)
     m_listener = listener;
 }
 
-bool SpeechInputClientImpl::startRecognition(int requestId, const WebCore::IntRect& elementRect)
+bool SpeechInputClientImpl::startRecognition(int requestId, const WebCore::IntRect& elementRect, const AtomicString& language, const String& grammar)
 {
     ASSERT(m_listener);
-    return m_controller->startRecognition(requestId, elementRect);
+    return m_controller->startRecognition(requestId, elementRect, language, grammar);
 }
 
 void SpeechInputClientImpl::stopRecording(int requestId)
@@ -86,10 +92,13 @@ void SpeechInputClientImpl::didCompleteRecognition(int requestId)
     m_listener->didCompleteRecognition(requestId);
 }
 
-void SpeechInputClientImpl::setRecognitionResult(int requestId, const WebString& result)
+void SpeechInputClientImpl::setRecognitionResult(int requestId, const WebSpeechInputResultArray& results)
 {
     ASSERT(m_listener);
-    m_listener->setRecognitionResult(requestId, result);
+    WebCore::SpeechInputResultArray webcoreResults(results.size());
+    for (size_t i = 0; i < results.size(); ++i)
+        webcoreResults[i] = results[i];
+    m_listener->setRecognitionResult(requestId, webcoreResults);
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/SpeechInputClientImpl.h b/WebKit/chromium/src/SpeechInputClientImpl.h
index 817b32b..520803a 100644
--- a/WebKit/chromium/src/SpeechInputClientImpl.h
+++ b/WebKit/chromium/src/SpeechInputClientImpl.h
@@ -33,8 +33,11 @@
 
 #if ENABLE(INPUT_SPEECH)
 
+#include "SpeechInputClient.h"
 #include "WebSpeechInputListener.h"
-#include "page/SpeechInputClient.h"
+#include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 class SpeechInputListener;
@@ -49,21 +52,23 @@ class SpeechInputClientImpl
     : public WebCore::SpeechInputClient,
       public WebSpeechInputListener {
 public:
-    SpeechInputClientImpl(WebViewClient*);
+    static PassOwnPtr<SpeechInputClientImpl> create(WebViewClient*);
     virtual ~SpeechInputClientImpl();
 
     // SpeechInputClient methods.
     void setListener(WebCore::SpeechInputListener*);
-    bool startRecognition(int, const WebCore::IntRect&);
+    bool startRecognition(int requestId, const WebCore::IntRect& elementRect, const AtomicString& language, const String& grammar);
     void stopRecording(int);
     void cancelRecognition(int);
 
     // WebSpeechInputListener methods.
     void didCompleteRecording(int);
-    void setRecognitionResult(int, const WebString&);
+    void setRecognitionResult(int, const WebSpeechInputResultArray&);
     void didCompleteRecognition(int);
 
 private:
+    SpeechInputClientImpl(WebViewClient*);
+
     WebSpeechInputController* m_controller; // To call into the embedder.
     WebCore::SpeechInputListener* m_listener;
 };
diff --git a/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp b/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
index f44e8f1..52a4032 100644
--- a/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
@@ -34,6 +34,7 @@
 
 #include "AsyncFileSystemCallbacks.h"
 #include "AsyncFileSystemChromium.h"
+#include "FileMetadata.h"
 #include "ScriptExecutionContext.h"
 #include "WebFileSystemEntry.h"
 #include "WebFileInfo.h"
@@ -63,9 +64,13 @@ void WebFileSystemCallbacksImpl::didSucceed()
     delete this;
 }
 
-void WebFileSystemCallbacksImpl::didReadMetadata(const WebFileInfo& info)
+void WebFileSystemCallbacksImpl::didReadMetadata(const WebFileInfo& webFileInfo)
 {
-    m_callbacks->didReadMetadata(info.modificationTime);
+    FileMetadata fileMetadata;
+    fileMetadata.modificationTime = webFileInfo.modificationTime;
+    fileMetadata.length = webFileInfo.length;
+    fileMetadata.type = static_cast<FileMetadata::Type>(webFileInfo.type);
+    m_callbacks->didReadMetadata(fileMetadata);
     delete this;
 }
 
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
index 1625eb8..e805c55 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
@@ -73,10 +73,14 @@ WebGraphicsContext3DDefaultImpl::WebGraphicsContext3DDefaultImpl()
     , m_texture(0)
     , m_fbo(0)
     , m_depthStencilBuffer(0)
+    , m_cachedWidth(0)
+    , m_cachedHeight(0)
     , m_multisampleFBO(0)
     , m_multisampleDepthStencilBuffer(0)
     , m_multisampleColorBuffer(0)
     , m_boundFBO(0)
+    , m_boundTexture(0)
+    , m_copyTextureToParentTextureFBO(0)
 #ifdef FLIP_FRAMEBUFFER_VERTICALLY
     , m_scanline(0)
 #endif
@@ -101,6 +105,7 @@ WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl()
                 glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
         }
         glDeleteTextures(1, &m_texture);
+        glDeleteFramebuffersEXT(1, &m_copyTextureToParentTextureFBO);
 #ifdef FLIP_FRAMEBUFFER_VERTICALLY
         if (m_scanline)
             delete[] m_scanline;
@@ -165,12 +170,15 @@ bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attribute
     validateAttributes();
 
     glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
+    glEnable(GL_POINT_SPRITE);
 
     if (!angleCreateCompilers()) {
         angleDestroyCompilers();
         return false;
     }
 
+    glGenFramebuffersEXT(1, &m_copyTextureToParentTextureFBO);
+
     m_initialized = true;
     return true;
 }
@@ -211,12 +219,10 @@ void WebGraphicsContext3DDefaultImpl::validateAttributes()
 void WebGraphicsContext3DDefaultImpl::resolveMultisampledFramebuffer(unsigned x, unsigned y, unsigned width, unsigned height)
 {
     if (m_attributes.antialias) {
-        bool mustRestoreFBO = (m_boundFBO != m_multisampleFBO);
         glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
         glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
         glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
-        if (mustRestoreFBO)
-            glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
     }
 }
 
@@ -280,6 +286,7 @@ void WebGraphicsContext3DDefaultImpl::prepareTexture()
 {
     if (!m_renderDirectlyToWebView) {
         // We need to prepare our rendering results for the compositor.
+        makeContextCurrent();
         resolveMultisampledFramebuffer(0, 0, m_cachedWidth, m_cachedHeight);
     }
 }
@@ -558,12 +565,33 @@ void WebGraphicsContext3DDefaultImpl::unmapTexSubImage2DCHROMIUM(const void* mem
 
 bool WebGraphicsContext3DDefaultImpl::supportsCopyTextureToParentTextureCHROMIUM()
 {
-    // We don't claim support for this extension at this time
-    return false;
+    // This extension requires this desktopGL-only function (GLES2 doesn't
+    // support it), so check for its existence here.
+    return glGetTexLevelParameteriv;
 }
 
 void WebGraphicsContext3DDefaultImpl::copyTextureToParentTextureCHROMIUM(unsigned id, unsigned id2)
 {
+    makeContextCurrent();
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_copyTextureToParentTextureFBO);
+    glFramebufferTexture2DEXT(GL_FRAMEBUFFER,
+                              GL_COLOR_ATTACHMENT0,
+                              GL_TEXTURE_2D,
+                              id,
+                              0); // level
+    glBindTexture(GL_TEXTURE_2D, id2);
+    GLsizei width, height;
+    glGetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_WIDTH, &width);
+    glGetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_HEIGHT, &height);
+    glCopyTexImage2D(GL_TEXTURE_2D,
+                     0, // level
+                     GL_RGBA,
+                     0, 0, // x, y
+                     width,
+                     height,
+                     0); // border
+    glBindTexture(GL_TEXTURE_2D, m_boundTexture);
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
 // Helper macros to reduce the amount of code.
@@ -688,7 +716,12 @@ void WebGraphicsContext3DDefaultImpl::bindFramebuffer(unsigned long target, WebG
 
 DELEGATE_TO_GL_2(bindRenderbuffer, BindRenderbufferEXT, unsigned long, WebGLId)
 
-DELEGATE_TO_GL_2(bindTexture, BindTexture, unsigned long, WebGLId)
+void WebGraphicsContext3DDefaultImpl::bindTexture(unsigned long target, WebGLId texture)
+{
+    makeContextCurrent();
+    glBindTexture(target, texture);
+    m_boundTexture = texture;
+}
 
 DELEGATE_TO_GL_4(blendColor, BlendColor, double, double, double, double)
 
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
index 124ceac..5eebf12 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
@@ -288,6 +288,12 @@ private:
     // For tracking which FBO is bound
     unsigned int m_boundFBO;
 
+    // For tracking which texture is bound
+    unsigned int m_boundTexture;
+    
+    // FBO used for copying child texture to parent texture.
+    unsigned m_copyTextureToParentTextureFBO;
+
 #ifdef FLIP_FRAMEBUFFER_VERTICALLY
     unsigned char* m_scanline;
     void flipVertically(unsigned char* framebuffer,
diff --git a/WebKit/chromium/src/WebIDBDatabaseImpl.h b/WebKit/chromium/src/WebIDBDatabaseImpl.h
index fda4265..94f1101 100644
--- a/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -39,7 +39,7 @@ namespace WebKit {
 class WebIDBObjectStore;
 class WebIDBTransaction;
 
-// See comment in WebIndexedDatabase for a high level overview these classes.
+// See comment in WebIDBFactory for a high level overview these classes.
 class WebIDBDatabaseImpl : public WebIDBDatabase {
 public:
     WebIDBDatabaseImpl(WTF::PassRefPtr<WebCore::IDBDatabaseBackendInterface>);
diff --git a/WebKit/chromium/src/WebIDBFactory.cpp b/WebKit/chromium/src/WebIDBFactory.cpp
index b186b68..40eff97 100755
--- a/WebKit/chromium/src/WebIDBFactory.cpp
+++ b/WebKit/chromium/src/WebIDBFactory.cpp
@@ -31,22 +31,23 @@
 #include "config.h"
 #include "WebIDBFactory.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 #include "IDBFactoryBackendImpl.h"
-#include "SecurityOrigin.h"
+#include "WebSecurityOrigin.h"
+#include <wtf/UnusedParam.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-WebString WebIDBFactory::databaseFileName(const WebString& name, const WebSecurityOrigin& origin)
+WebString WebIDBFactory::databaseFileName(const WebSecurityOrigin& origin)
 {
-    RefPtr<SecurityOrigin> securityOrigin;
-    securityOrigin = origin;
-    return IDBFactoryBackendImpl::databaseFileName(name, securityOrigin.get());
+    return IDBFactoryBackendImpl::databaseFileName(origin.get());
 }
 
+WebString WebIDBFactory::databaseFileName(const WebString& name, const WebSecurityOrigin& origin)
+{
+    UNUSED_PARAM(name);
+    return databaseFileName(origin);
 }
 
-#endif // ENABLE(INDEXED_DATABASE)
+}
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 96495fe..5dd2652 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -104,7 +104,7 @@ void WebIDBObjectStoreImpl::removeIndex(const WebString& name, const WebIDBTrans
 
 void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->openCursor(IDBKeyRange::create(keyRange.left(), keyRange.right(), keyRange.flags()), direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
+    m_objectStore->openCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index e19308a..65f0fde 100644
--- a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -99,8 +99,10 @@ WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl()
 {
     // VideoLayerChromium may outlive this object so make sure all frames are
     // released.
+#if USE(ACCELERATED_COMPOSITING)
     if (m_videoLayer.get())
         m_videoLayer->releaseCurrentFrame();
+#endif
 }
 
 void WebMediaPlayerClientImpl::networkStateChanged()
@@ -113,8 +115,10 @@ void WebMediaPlayerClientImpl::readyStateChanged()
 {
     ASSERT(m_mediaPlayer);
     m_mediaPlayer->readyStateChanged();
+#if USE(ACCELERATED_COMPOSITING)
     if (hasVideo() && supportsAcceleratedRendering() && !m_videoLayer.get())
         m_videoLayer = VideoLayerChromium::create(0, this);
+#endif
 }
 
 void WebMediaPlayerClientImpl::volumeChanged(float newVolume)
@@ -185,8 +189,10 @@ void WebMediaPlayerClientImpl::load(const String& url)
 
     // Video frame object is owned by WebMediaPlayer. Before destroying
     // WebMediaPlayer all frames need to be released.
+#if USE(ACCELERATED_COMPOSITING)
     if (m_videoLayer.get())
         m_videoLayer->releaseCurrentFrame();
+#endif
 
     m_webMediaPlayer.set(createWebMediaPlayer(this, frame));
     if (m_webMediaPlayer.get())
@@ -396,7 +402,14 @@ void WebMediaPlayerClientImpl::paint(GraphicsContext* context, const IntRect& re
     // check.
     if (m_webMediaPlayer.get() && !context->paintingDisabled()) {
 #if WEBKIT_USING_SKIA
-        m_webMediaPlayer->paint(context->platformContext()->canvas(), rect);
+        PlatformGraphicsContext* platformContext = context->platformContext();
+        WebCanvas* canvas = platformContext->canvas();
+
+        canvas->saveLayerAlpha(0, platformContext->getNormalizedAlpha());
+
+        m_webMediaPlayer->paint(canvas, rect);
+
+        canvas->restore();
 #elif WEBKIT_USING_CG
         m_webMediaPlayer->paint(context->platformContext(), rect);
 #else
@@ -418,13 +431,6 @@ bool WebMediaPlayerClientImpl::hasSingleSecurityOrigin() const
     return false;
 }
 
-#if USE(ACCELERATED_COMPOSITING)
-bool WebMediaPlayerClientImpl::supportsAcceleratedRendering() const
-{
-    return m_supportsAcceleratedCompositing;
-}
-#endif
-
 MediaPlayer::MovieLoadType WebMediaPlayerClientImpl::movieLoadType() const
 {
     if (m_webMediaPlayer.get())
@@ -433,6 +439,12 @@ MediaPlayer::MovieLoadType WebMediaPlayerClientImpl::movieLoadType() const
     return MediaPlayer::Unknown;
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+bool WebMediaPlayerClientImpl::supportsAcceleratedRendering() const
+{
+    return m_supportsAcceleratedCompositing;
+}
+
 VideoFrameChromium* WebMediaPlayerClientImpl::getCurrentFrame()
 {
     VideoFrameChromium* videoFrame = 0;
@@ -454,6 +466,7 @@ void WebMediaPlayerClientImpl::putCurrentFrame(VideoFrameChromium* videoFrame)
         delete videoFrame;
     }
 }
+#endif
 
 MediaPlayerPrivateInterface* WebMediaPlayerClientImpl::create(MediaPlayer* player)
 {
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index 6535094..ca7c43c 100644
--- a/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -48,7 +48,9 @@ class WebMediaPlayer;
 // This class serves as a bridge between WebCore::MediaPlayer and
 // WebKit::WebMediaPlayer.
 class WebMediaPlayerClientImpl : public WebCore::MediaPlayerPrivateInterface
+#if USE(ACCELERATED_COMPOSITING)
                                , public WebCore::VideoFrameProvider
+#endif
                                , public WebMediaPlayerClient {
 
 public:
@@ -110,15 +112,14 @@ public:
     virtual void setSize(const WebCore::IntSize&);
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect&);
     virtual bool hasSingleSecurityOrigin() const;
+    virtual WebCore::MediaPlayer::MovieLoadType movieLoadType() const;
 #if USE(ACCELERATED_COMPOSITING)
     virtual bool supportsAcceleratedRendering() const;
-#endif
-
-    virtual WebCore::MediaPlayer::MovieLoadType movieLoadType() const;
 
     // VideoFrameProvider methods:
     virtual WebCore::VideoFrameChromium* getCurrentFrame();
     virtual void putCurrentFrame(WebCore::VideoFrameChromium*);
+#endif
 
 private:
     WebMediaPlayerClientImpl();
diff --git a/WebKit/chromium/src/WebSecurityOrigin.cpp b/WebKit/chromium/src/WebSecurityOrigin.cpp
index 8685738..adccb31 100644
--- a/WebKit/chromium/src/WebSecurityOrigin.cpp
+++ b/WebKit/chromium/src/WebSecurityOrigin.cpp
@@ -143,6 +143,11 @@ WebSecurityOrigin::operator WTF::PassRefPtr<WebCore::SecurityOrigin>() const
     return PassRefPtr<SecurityOrigin>(const_cast<WebSecurityOriginPrivate*>(m_private));
 }
 
+SecurityOrigin* WebSecurityOrigin::get() const
+{
+    return m_private;
+}
+
 void WebSecurityOrigin::assign(WebSecurityOriginPrivate* p)
 {
     // p is already ref'd for us by the caller
diff --git a/WebKit/chromium/src/WebSpeechInputControllerMockImpl.cpp b/WebKit/chromium/src/WebSpeechInputControllerMockImpl.cpp
index 60c4fed..3b56338 100644
--- a/WebKit/chromium/src/WebSpeechInputControllerMockImpl.cpp
+++ b/WebKit/chromium/src/WebSpeechInputControllerMockImpl.cpp
@@ -57,7 +57,12 @@ WebSpeechInputControllerMockImpl::~WebSpeechInputControllerMockImpl()
 
 void WebSpeechInputControllerMockImpl::setMockRecognitionResult(const WebString& result)
 {
-    m_webcoreMock->setRecognitionResult(result);
+    m_webcoreMock->setRecognitionResult(result, WebString::fromUTF8(""));
+}
+
+void WebSpeechInputControllerMockImpl::setMockRecognitionResult(const WebString& result, const WebString &language)
+{
+    m_webcoreMock->setRecognitionResult(result, language);
 }
 
 void WebSpeechInputControllerMockImpl::didCompleteRecording(int requestId)
@@ -70,14 +75,14 @@ void WebSpeechInputControllerMockImpl::didCompleteRecognition(int requestId)
     m_listener->didCompleteRecognition(requestId);
 }
 
-void WebSpeechInputControllerMockImpl::setRecognitionResult(int requestId, const WTF::String& result)
+void WebSpeechInputControllerMockImpl::setRecognitionResult(int requestId, const WebCore::SpeechInputResultArray& result)
 {
     m_listener->setRecognitionResult(requestId, result);
 }
 
-bool WebSpeechInputControllerMockImpl::startRecognition(int requestId, const WebRect& elementRect)
+bool WebSpeechInputControllerMockImpl::startRecognition(int requestId, const WebRect& elementRect, const WebString& language, const WebString& grammar)
 {
-    return m_webcoreMock->startRecognition(requestId, elementRect);
+    return m_webcoreMock->startRecognition(requestId, elementRect, language, grammar);
 }
 
 void WebSpeechInputControllerMockImpl::cancelRecognition(int requestId)
diff --git a/WebKit/chromium/src/WebSpeechInputControllerMockImpl.h b/WebKit/chromium/src/WebSpeechInputControllerMockImpl.h
index edbfca3..c98f92a 100644
--- a/WebKit/chromium/src/WebSpeechInputControllerMockImpl.h
+++ b/WebKit/chromium/src/WebSpeechInputControllerMockImpl.h
@@ -54,14 +54,18 @@ public:
     // WebCore::SpeechInputListener methods.
     void didCompleteRecording(int requestId);
     void didCompleteRecognition(int requestId);
-    void setRecognitionResult(int requestId, const WTF::String& result);
+    void setRecognitionResult(int requestId, const WebCore::SpeechInputResultArray& result);
 
     // WebSpeechInputController methods.
-    bool startRecognition(int requestId, const WebRect& elementRect);
+    bool startRecognition(int requestId, const WebRect& elementRect, const WebString& language, const WebString& grammar);
     void cancelRecognition(int requestId);
     void stopRecording(int requestId);
 
     // WebSpeechInputControllerMock methods.
+    void setMockRecognitionResult(const WebString& result, const WebString& language);
+
+    // FIXME: this is a fix for a two-sided patch. Delete as soon as the chromium side is patched.
+    // Chromium patch not uploaded yet, but will depend on http://codereview.chromium.org/3615005/show patch.
     void setMockRecognitionResult(const WebString& result);
 
 private:
@@ -72,4 +76,3 @@ private:
 } // namespace WebKit
 
 #endif // WebSpeechInputControllerMockImpl_h
-
diff --git a/WebKit/mac/WebView/WebHTMLRepresentationInternal.h b/WebKit/chromium/src/WebSpeechInputResult.cpp
index d42b400..1cafc84 100644
--- a/WebKit/mac/WebView/WebHTMLRepresentationInternal.h
+++ b/WebKit/chromium/src/WebSpeechInputResult.cpp
@@ -1,18 +1,15 @@
 /*
- * Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,8 +23,32 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import <WebKit/WebHTMLRepresentationPrivate.h>
+#include "config.h"
+#include "WebSpeechInputResult.h"
 
-@interface WebHTMLRepresentation (WebInternal)
-+ (NSArray *)supportedNonImageMIMETypes;
-@end
+#include "SpeechInputResult.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebKit {
+
+void WebSpeechInputResult::reset()
+{
+    m_private.reset();
+}
+
+WebSpeechInputResult::WebSpeechInputResult(const PassRefPtr<WebCore::SpeechInputResult>& value)
+    : m_private(value)
+{
+}
+
+void WebSpeechInputResult::set(const WebString& utterance, double confidence)
+{
+    m_private = WebCore::SpeechInputResult::create(utterance, confidence);
+}
+
+WebSpeechInputResult::operator PassRefPtr<WebCore::SpeechInputResult>() const
+{
+    return m_private.get();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index aeab400..57d0ca4 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -33,6 +33,7 @@
 
 #include "AutoFillPopupMenuClient.h"
 #include "AXObjectCache.h"
+#include "BackForwardListImpl.h"
 #include "Chrome.h"
 #include "ColorSpace.h"
 #include "CompositionUnderlineVectorBuilder.h"
@@ -88,6 +89,7 @@
 #include "SecurityOrigin.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "SpeechInputClientImpl.h"
 #include "Timer.h"
 #include "TypingCommand.h"
 #include "UserGestureIndicator.h"
@@ -182,6 +184,8 @@ static const PopupContainerSettings autoFillPopupSettings = {
     PopupContainerSettings::DOMElementDirection,
 };
 
+static bool shouldUseExternalPopupMenus = false;
+
 // WebView ----------------------------------------------------------------
 
 WebView* WebView::create(WebViewClient* client, WebDevToolsAgentClient* devToolsClient)
@@ -193,6 +197,11 @@ WebView* WebView::create(WebViewClient* client, WebDevToolsAgentClient* devTools
     return adoptRef(new WebViewImpl(client, devToolsClient)).leakRef();
 }
 
+void WebView::setUseExternalPopupMenus(bool useExternalPopupMenus)
+{
+    shouldUseExternalPopupMenus = useExternalPopupMenus;
+}
+
 void WebView::updateVisitedLinkState(unsigned long long linkHash)
 {
     Page::visitedStateChanged(PageGroup::pageGroup(pageGroupName), linkHash);
@@ -275,7 +284,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_compositorCreationFailed(false)
 #endif
 #if ENABLE(INPUT_SPEECH)
-    , m_speechInputClient(client)
+    , m_speechInputClient(SpeechInputClientImpl::create(client))
 #endif
     , m_deviceOrientationClientProxy(new DeviceOrientationClientProxy(client ? client->deviceOrientationClient() : 0))
 {
@@ -298,13 +307,13 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     pageClients.dragClient = &m_dragClientImpl;
     pageClients.inspectorClient = &m_inspectorClientImpl;
 #if ENABLE(INPUT_SPEECH)
-    pageClients.speechInputClient = &m_speechInputClient;
+    pageClients.speechInputClient = m_speechInputClient.get();
 #endif
     pageClients.deviceOrientationClient = m_deviceOrientationClientProxy.get();
 
     m_page.set(new Page(pageClients));
 
-    m_page->backForwardList()->setClient(&m_backForwardListClientImpl);
+    static_cast<BackForwardListImpl*>(m_page->backForwardList())->setClient(&m_backForwardListClientImpl);
     m_page->setGroupName(pageGroupName);
 
     m_inspectorSettingsMap.set(new SettingsMap);
@@ -1039,6 +1048,10 @@ void WebViewImpl::composite(bool finish)
 
     // Put result onscreen.
     m_layerRenderer->present();
+
+    GraphicsContext3D* context = m_layerRenderer->context();
+    if (context->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR)
+        reallocateRenderer();
 #endif
 }
 
@@ -2107,6 +2120,11 @@ void WebViewImpl::didCommitLoad(bool* isNewNavigation)
     m_observedNewNavigation = false;
 }
 
+bool WebViewImpl::useExternalPopupMenus()
+{
+    return shouldUseExternalPopupMenus;
+}
+
 bool WebViewImpl::navigationPolicyFromMouseEvent(unsigned short button,
                                                  bool ctrl, bool shift,
                                                  bool alt, bool meta,
@@ -2476,6 +2494,22 @@ void WebViewImpl::doComposite()
     // Draw the actual layers...
     m_layerRenderer->drawLayers(visibleRect, contentRect);
 }
+
+void WebViewImpl::reallocateRenderer()
+{
+    GraphicsContext3D* context = m_layerRenderer->context();
+    RefPtr<GraphicsContext3D> newContext = GraphicsContext3D::create(context->getContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
+    // GraphicsContext3D::create might fail and return 0, in that case LayerRendererChromium::create will also return 0.
+    RefPtr<LayerRendererChromium> layerRenderer = LayerRendererChromium::create(newContext);
+
+    // Reattach the root layer.  Child layers will get reattached as a side effect of updateLayersRecursive.
+    if (layerRenderer)
+        m_layerRenderer->transferRootLayer(layerRenderer.get());
+    m_layerRenderer = layerRenderer;
+
+    // Enable or disable accelerated compositing and request a refresh.
+    setRootGraphicsLayer(m_layerRenderer ? m_layerRenderer->rootLayer() : 0);
+}
 #endif
 
 
@@ -2491,10 +2525,8 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
         else {
             GraphicsContext3D::Attributes attributes;
             m_temporaryOnscreenGraphicsContext3D = GraphicsContext3D::create(GraphicsContext3D::Attributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
-#if OS(DARWIN)
             if (m_temporaryOnscreenGraphicsContext3D)
                 m_temporaryOnscreenGraphicsContext3D->reshape(std::max(1, m_size.width), std::max(1, m_size.height));
-#endif
             context = m_temporaryOnscreenGraphicsContext3D.get();
         }
         return GraphicsContext3DInternal::extractWebGraphicsContext3D(context);
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
index 050b5e1..0388770 100644
--- a/WebKit/chromium/src/WebViewImpl.h
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -49,7 +49,6 @@
 #include "IntRect.h"
 #include "LayerRendererChromium.h"
 #include "NotificationPresenterImpl.h"
-#include "SpeechInputClientImpl.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -74,6 +73,7 @@ class AutoFillPopupMenuClient;
 class ContextMenuClientImpl;
 class DeviceOrientationClientProxy;
 class DragScrollTimer;
+class SpeechInputClientImpl;
 class WebAccessibilityObject;
 class WebDevToolsAgentClient;
 class WebDevToolsAgentPrivate;
@@ -273,6 +273,10 @@ public:
     // load.
     void didCommitLoad(bool* isNewNavigation);
 
+    // Returns true if popup menus should be rendered by the browser, false if
+    // they should be rendered by WebKit (which is the default).
+    static bool useExternalPopupMenus();
+
     bool contextMenuAllowed() const
     {
         return m_contextMenuAllowed;
@@ -406,6 +410,7 @@ private:
     void updateRootLayerContents(const WebCore::IntRect&);
     void doComposite();
     void doPixelReadbackToCanvas(WebCanvas*, const WebCore::IntRect&);
+    void reallocateRenderer();
 #endif
 
     WebViewClient* m_client;
@@ -543,7 +548,7 @@ private:
     static const WebInputEvent* m_currentInputEvent;
 
 #if ENABLE(INPUT_SPEECH)
-    SpeechInputClientImpl m_speechInputClient;
+    OwnPtr<SpeechInputClientImpl> m_speechInputClient;
 #endif
     // If we attempt to fetch the on-screen GraphicsContext3D before
     // the compositor has been turned on, we need to instantiate it
diff --git a/WebKit/chromium/src/js/Tests.js b/WebKit/chromium/src/js/Tests.js
index 5cebb52..2b264ee 100644
--- a/WebKit/chromium/src/js/Tests.js
+++ b/WebKit/chromium/src/js/Tests.js
@@ -245,146 +245,6 @@ TestSuite.prototype.testEnableResourcesTab = function()
 
 
 /**
- * Tests that correct content length is reported for resources.
- */
-TestSuite.prototype.testResourceContentLength = function()
-{
-    this.showPanel("resources");
-    var test = this;
-
-    var png = false;
-    var html = false;
-    this.addSniffer(WebInspector, "updateResource",
-        function(payload) {
-            if (!payload.didLengthChange)
-                return;
-            var resource = WebInspector.resources[payload.id];
-            if (!resource || !resource.url)
-                return;
-            if (resource.url.search("image.html") !== -1) {
-              var expectedLength = 87;
-              test.assertTrue(
-                  resource.resourceSize <= expectedLength,
-                  "image.html content length is greater thatn expected.");
-              if (expectedLength === resource.resourceSize)
-                  html = true;
-            } else if (resource.url.search("image.png") !== -1) {
-              var expectedLength = 257796;
-              test.assertTrue(
-                  resource.resourceSize <= expectedLength,
-                  "image.png content length is greater than expected.");
-              if (expectedLength === resource.resourceSize)
-                  png = true;
-            }
-            if (html && png) {
-              // Wait 1 second before releasing control to check that the content
-              // lengths are not updated anymore.
-              setTimeout(function() {
-                  test.releaseControl();
-              }, 1000);
-            }
-        }, true);
-
-    // Make sure resource tracking is on.
-    WebInspector.panels.resources._enableResourceTracking();
-    // Reload inspected page to update all resources.
-    test.evaluateInConsole_(
-        "window.location.reload(true);",
-         function(resultText) {
-             test.assertEquals("undefined", resultText, "Unexpected result of reload().");
-         });
-
-    // We now have some time to report results to controller.
-    this.takeControl();
-};
-
-
-/**
- * Tests resource headers.
- */
-TestSuite.prototype.testResourceHeaders = function()
-{
-    this.showPanel("resources");
-
-    var test = this;
-
-    var responseOk = false;
-    var timingOk = false;
-
-    this.addSniffer(WebInspector, "updateResource",
-        function(payload) {
-            var resource = this.resources[payload.id];
-            if (!resource || resource.mainResource) {
-                // We are only interested in secondary resources in this test.
-                return;
-            }
-
-            var requestHeaders = JSON.stringify(resource.requestHeaders);
-            test.assertContains(requestHeaders, "Accept");
-
-            if (payload.didResponseChange) {
-                var responseHeaders = JSON.stringify(resource.responseHeaders);
-                test.assertContains(responseHeaders, "Content-type");
-                test.assertContains(responseHeaders, "Content-Length");
-                test.assertTrue(typeof resource.responseReceivedTime !== "undefined");
-                responseOk = true;
-            }
-
-            if (payload.didTimingChange) {
-                test.assertTrue(typeof resource.startTime !== "undefined");
-                timingOk = true;
-            }
-
-            if (payload.didCompletionChange) {
-                test.assertTrue(responseOk);
-                test.assertTrue(timingOk);
-                test.assertTrue(typeof resource.endTime !== "undefined");
-                test.releaseControl();
-            }
-        }, true);
-
-    WebInspector.panels.resources._enableResourceTracking();
-    this.takeControl();
-};
-
-
-/**
- * Tests the mime type of a cached (HTTP 304) resource.
- */
-TestSuite.prototype.testCachedResourceMimeType = function()
-{
-    this.showPanel("resources");
-
-    var test = this;
-    var hasReloaded = false;
-
-    this.addSniffer(WebInspector, "updateResource",
-        function(payload) {
-            var resource = this.resources[payload.id];
-            if (!resource || resource.mainResource) {
-                // We are only interested in secondary resources in this test.
-                return;
-            }
-
-            if (payload.didResponseChange) {
-                // Test server uses a default mime type for JavaScript files.
-                test.assertEquals("text/html", payload.mimeType);
-                if (!hasReloaded) {
-                    hasReloaded = true;
-                    // Reload inspected page to update all resources.
-                    test.evaluateInConsole_("window.location.reload(true);", function() {});
-                } else
-                    test.releaseControl();
-            }
-
-        }, true);
-
-    WebInspector.panels.resources._enableResourceTracking();
-    this.takeControl();
-};
-
-
-/**
  * Tests that profiler works.
  */
 TestSuite.prototype.testProfilerTab = function()
diff --git a/WebKit/chromium/src/mac/WebInputEventFactory.mm b/WebKit/chromium/src/mac/WebInputEventFactory.mm
index b4e09c0..015409e 100644
--- a/WebKit/chromium/src/mac/WebInputEventFactory.mm
+++ b/WebKit/chromium/src/mac/WebInputEventFactory.mm
@@ -856,6 +856,8 @@ static inline int modifiersFromEvent(NSEvent* event) {
         modifiers |= WebInputEvent::AltKey;
     if ([event modifierFlags] & NSCommandKeyMask)
         modifiers |= WebInputEvent::MetaKey;
+    if ([event modifierFlags] & NSAlphaShiftKeyMask)
+        modifiers |= WebInputEvent::CapsLockOn;
     // TODO(port): Set mouse button states
 
     return modifiers;
diff --git a/WebKit/efl/ChangeLog b/WebKit/efl/ChangeLog
index 1795645..bf9af1e 100644
--- a/WebKit/efl/ChangeLog
+++ b/WebKit/efl/ChangeLog
@@ -1,3 +1,60 @@
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * ewk/ewk_history.cpp:
+        (ewk_history_new):
+        * ewk/ewk_private.h:
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+        (ewk_view_history_enable_get):
+        (ewk_view_history_enable_set):
+        (ewk_view_history_get):
+        Use BackForwardListImpl.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidBecomeFrameset):
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::transferLoadingResourceFromPage):
+        Empty method.
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::createWindow):
+        * WebCoreSupport/ChromeClientEfl.h:
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchCreatePage):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+        Add NavigationAction parameter.
+
 2010-10-19  Ryuan Choi  <ryuan.choi@samsung.com>
 
         Reviewed by Eric Seidel.
diff --git a/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index 257e824..d99f0bc 100644
--- a/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -46,6 +46,7 @@
 #include "HitTestResult.h"
 #include "IntRect.h"
 #include "KURL.h"
+#include "NavigationAction.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -143,7 +144,7 @@ void ChromeClientEfl::unfocus()
     evas_object_focus_set(m_view, EINA_FALSE);
 }
 
-Page* ChromeClientEfl::createWindow(Frame*, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& features)
+Page* ChromeClientEfl::createWindow(Frame*, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& features, const NavigationAction&)
 {
     Evas_Object* newView = ewk_view_window_create(m_view, EINA_TRUE, &features);
     if (!newView)
diff --git a/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index 4339b9a..f0aeb8d 100644
--- a/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -54,7 +54,7 @@ public:
 
     virtual void focusedNodeChanged(Node*);
 
-    virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&);
+    virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&, const NavigationAction&);
     virtual void show();
 
     virtual bool canRunModal();
diff --git a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
index 1b82239..627c1b9 100644
--- a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
@@ -384,6 +384,10 @@ void FrameLoaderClientEfl::didTransferChildFrameToNewDocument(Page*)
 {
 }
 
+void FrameLoaderClientEfl::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
+}
+
 void FrameLoaderClientEfl::redirectDataToPlugin(Widget* pluginWidget)
 {
     ASSERT(!m_pluginView);
@@ -860,7 +864,7 @@ bool FrameLoaderClientEfl::canCachePage() const
     return false;
 }
 
-Frame* FrameLoaderClientEfl::dispatchCreatePage()
+Frame* FrameLoaderClientEfl::dispatchCreatePage(const NavigationAction&)
 {
     if (!m_view)
         return 0;
@@ -919,6 +923,10 @@ void FrameLoaderClientEfl::transitionToCommittedForNewPage()
         ewk_view_frame_main_cleared(m_view);
 }
 
+void FrameLoaderClientEfl::dispatchDidBecomeFrameset(bool)
+{
+}
+
 PassRefPtr<FrameNetworkingContext> FrameLoaderClientEfl::createNetworkingContext()
 {
     return FrameNetworkingContextEfl::create(ewk_frame_core_get(m_frame));
diff --git a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
index 1b880e6..a9dd8c1 100644
--- a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
+++ b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
@@ -111,7 +111,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     virtual void dispatchDidFirstLayout();
     virtual void dispatchDidFirstVisuallyNonEmptyLayout();
 
-    virtual Frame* dispatchCreatePage();
+    virtual Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
 
     virtual void dispatchDecidePolicyForMIMEType(FramePolicyFunction, const String& MIMEType, const ResourceRequest&);
@@ -135,6 +135,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
     virtual void didTransferChildFrameToNewDocument(Page*);
+    virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const ResourceRequest&, WebCore::Page*);
 
     virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const WTF::Vector<String>&, const WTF::Vector<String>&, const String&, bool);
     virtual void redirectDataToPlugin(Widget* pluginWidget);
@@ -198,6 +199,8 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     virtual void transitionToCommittedFromCachedFrame(CachedFrame*);
     virtual void transitionToCommittedForNewPage();
 
+    virtual void dispatchDidBecomeFrameset(bool);
+
     virtual bool canCachePage() const;
     virtual void download(ResourceHandle*, const ResourceRequest&, const ResourceRequest&, const ResourceResponse&);
 
diff --git a/WebKit/efl/ewk/ewk_history.cpp b/WebKit/efl/ewk/ewk_history.cpp
index 8387da1..0a9d349 100644
--- a/WebKit/efl/ewk/ewk_history.cpp
+++ b/WebKit/efl/ewk/ewk_history.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "ewk_history.h"
 
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 #include "EWebKit.h"
 #include "HistoryItem.h"
 #include "Image.h"
@@ -32,7 +32,7 @@
 #include <eina_safety_checks.h>
 
 struct _Ewk_History {
-    WebCore::BackForwardList *core;
+    WebCore::BackForwardListImpl *core;
 };
 
 #define EWK_HISTORY_CORE_GET_OR_RETURN(history, core_, ...)      \
@@ -48,7 +48,7 @@ struct _Ewk_History {
         ERR("history->core is disabled!.");                      \
         return __VA_ARGS__;                                      \
     }                                                            \
-    WebCore::BackForwardList *core_ = (history)->core
+    WebCore::BackForwardListImpl *core_ = (history)->core
 
 
 struct _Ewk_History_Item {
@@ -666,11 +666,11 @@ Eina_Bool ewk_history_item_visit_last_failed(const Ewk_History_Item* item)
  * Creates history for given view. Called internally by ewk_view and
  * should never be called from outside.
  *
- * @param core WebCore::BackForwardList instance to use internally.
+ * @param core WebCore::BackForwardListImpl instance to use internally.
  *
  * @return newly allocated history instance or @c NULL on errors.
  */
-Ewk_History* ewk_history_new(WebCore::BackForwardList* core)
+Ewk_History* ewk_history_new(WebCore::BackForwardListImpl* core)
 {
     Ewk_History* history;
     EINA_SAFETY_ON_NULL_RETURN_VAL(core, 0);
diff --git a/WebKit/efl/ewk/ewk_private.h b/WebKit/efl/ewk/ewk_private.h
index e2624a3..c1599e3 100644
--- a/WebKit/efl/ewk/ewk_private.h
+++ b/WebKit/efl/ewk/ewk_private.h
@@ -21,7 +21,7 @@
 #ifndef ewk_private_h
 #define ewk_private_h
 
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 #include "EWebKit.h"
 #include "Frame.h"
 #include "Page.h"
@@ -108,7 +108,7 @@ void ewk_view_download_request(Evas_Object *o, Ewk_Download *download);
 
 int ewk_view_dpi_get();
 
-Ewk_History *ewk_history_new(WebCore::BackForwardList *history);
+Ewk_History *ewk_history_new(WebCore::BackForwardListImpl *history);
 void ewk_history_free(Ewk_History *history);
 
 Ewk_Context_Menu *ewk_context_menu_new(Evas_Object *view, WebCore::ContextMenuController *controller);
diff --git a/WebKit/efl/ewk/ewk_view.cpp b/WebKit/efl/ewk/ewk_view.cpp
index f1ca733..5ff3ade 100644
--- a/WebKit/efl/ewk/ewk_view.cpp
+++ b/WebKit/efl/ewk/ewk_view.cpp
@@ -22,6 +22,7 @@
 #include "config.h"
 #include "ewk_view.h"
 
+#include "BackForwardListImpl.h"
 #include "Chrome.h"
 #include "ChromeClientEfl.h"
 #include "ContextMenuClientEfl.h"
@@ -634,7 +635,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* sd)
         goto error_main_frame;
     }
 
-    priv->history = ewk_history_new(priv->page->backForwardList());
+    priv->history = ewk_history_new(static_cast<WebCore::BackForwardListImpl*>(priv->page->backForwardList()));
     if (!priv->history) {
         CRITICAL("Could not create history instance for view.");
         goto error_history;
@@ -1762,7 +1763,7 @@ Eina_Bool ewk_view_history_enable_get(const Evas_Object* o)
 {
     EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
     EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
-    return priv->page->backForwardList()->enabled();
+    return static_cast<WebCore::BackForwardListImpl*>(priv->page->backForwardList())->enabled();
 }
 
 /**
@@ -1778,7 +1779,7 @@ Eina_Bool ewk_view_history_enable_set(Evas_Object* o, Eina_Bool enable)
 {
     EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
     EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
-    priv->page->backForwardList()->setEnabled(enable);
+    static_cast<WebCore::BackForwardListImpl*>(priv->page->backForwardList())->setEnabled(enable);
     return EINA_TRUE;
 }
 
@@ -1802,7 +1803,7 @@ Ewk_History* ewk_view_history_get(const Evas_Object* o)
 {
     EWK_VIEW_SD_GET_OR_RETURN(o, sd, 0);
     EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, 0);
-    if (!priv->page->backForwardList()->enabled()) {
+    if (!static_cast<WebCore::BackForwardListImpl*>(priv->page->backForwardList())->enabled()) {
         ERR("asked history, but it's disabled! Returning 0!");
         return 0;
     }
diff --git a/WebKit/gtk/ChangeLog b/WebKit/gtk/ChangeLog
index cde04c9..cd11751 100644
--- a/WebKit/gtk/ChangeLog
+++ b/WebKit/gtk/ChangeLog
@@ -1,3 +1,188 @@
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebbackforwardlist.cpp:
+        (webkit_web_back_forward_list_dispose):
+        (webkit_web_back_forward_list_new_with_web_view):
+        (webkit_web_back_forward_list_go_forward):
+        (webkit_web_back_forward_list_go_back):
+        (webkit_web_back_forward_list_contains_item):
+        (webkit_web_back_forward_list_go_to_item):
+        (webkit_web_back_forward_list_get_forward_list_with_limit):
+        (webkit_web_back_forward_list_get_back_list_with_limit):
+        (webkit_web_back_forward_list_get_back_item):
+        (webkit_web_back_forward_list_get_current_item):
+        (webkit_web_back_forward_list_get_forward_item):
+        (webkit_web_back_forward_list_get_nth_item):
+        (webkit_web_back_forward_list_get_back_length):
+        (webkit_web_back_forward_list_get_forward_length):
+        (webkit_web_back_forward_list_get_limit):
+        (webkit_web_back_forward_list_set_limit):
+        (webkit_web_back_forward_list_add_item):
+        (webkit_web_back_forward_list_clear):
+        (WebKit::core):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_set_maintains_back_forward_list):
+        (webkit_web_view_get_back_forward_list):
+        Use BackForwardListImpl.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidBecomeFrameset):
+
+2010-10-29  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add the GtkScrollablePolicy property to the webview
+        https://bugs.webkit.org/show_bug.cgi?id=48357
+
+        Added the GtkScrollablePolicy properties to the webview widget, it
+        is now required for GtkScrollable widgets in GTK+ 3.x.
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (setHorizontalScrollPolicy): Added.
+        (setVerticalScrollPolicy): Added.
+        (getHorizontalScrollPolicy): Added.
+        (getVerticalScrollPolicy): Added.
+        (webkit_web_view_get_property):
+        (webkit_web_view_set_property):
+        (webkit_web_view_class_init):
+
+2010-10-28  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] WebKitWebFrame's load-status is not properly notified to the tests
+        https://bugs.webkit.org/show_bug.cgi?id=48048
+
+        "frame-created" signal must be issued before loading any data,
+        that way clients can correctly capture all the loading related
+        signals for that frame.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::createFrame):
+
+2010-10-27  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        getTextAtOffset returns incorrect results if a link includes text and an image
+        https://bugs.webkit.org/show_bug.cgi?id=47365
+
+        New test to make sure this bug is actually fixed.
+
+        * tests/testatk.c:
+        (testWebkitAtkLinksWithInlineImages): New test.
+        (main): Added new test.
+
+2010-10-26  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement DumpRenderTreeSupportGtk (similarly to DumpRenderTreeSupportQt idea)
+        https://bugs.webkit.org/show_bug.cgi?id=48199
+
+        Implemented an initial version of the DumpRenderTreeSupportGtk class.
+        The main idea is that it groups together the bodies of many LayoutTestController
+        methods, so they can directly access WebCore features. This way we eliminate the
+        need of adding APIs to WebKitGTK just to expand its test coverage through DRT.
+
+        The DumpRenderTreeSupportGtk class so far includes a getter and setter for the WebKitTabToLinksPreferenceKey
+        property as a sample implementation. Also it makes it possible to unskip fast/events/tab-focus-anchor.html and
+        to fix stderr messages from all 22 spatial-navigation tests in fast/events/spatial-navigation.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::tabsToLinks):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp: Added.
+        (DumpRenderTreeSupportGtk::DumpRenderTreeSupportGtk):
+        (DumpRenderTreeSupportGtk::~DumpRenderTreeSupportGtk):
+        (DumpRenderTreeSupportGtk::setDumpRenderTreeModeEnabled):
+        (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled): Getter to the WebKitTabToLinksPreferenceKey property.
+        (DumpRenderTreeSupportGtk::setLinksIncludedInFocusChain): Setter to the WebKitTabToLinksPreferenceKey property.
+        (DumpRenderTreeSupportGtk::linksIncludedInFocusChain):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h: Added.
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::transferLoadingResourceFromPage):
+        Empty method.
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2010-10-26  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [Gtk] Layout tables should indicate that they are not data tables via an object attribute
+        https://bugs.webkit.org/show_bug.cgi?id=35422
+
+        New unit test to check the 'layout-guess' attribute in tables.
+
+        * tests/testatk.c:
+        (atkAttributeSetAttributeNameHasValue): New, looks for a attribute
+        with a specific value, by the name of attribute.
+        (atkAttributeSetContainsAttributeName): New, just checks whether
+        an attribute with a specified name is present in the set.
+        (atkAttributeSetAttributeHasValue): Modified to relay on the new
+        function atkAttributeSetAttributeNameHasValue().
+        (testWebkitAtkLayoutAndDataTables): New test.
+        (main): Added the new test.
+
+2010-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Port to new GtkScrollable interface in GTK+ 3.x
+        https://bugs.webkit.org/show_bug.cgi?id=48202
+
+        Use the new GtkScrollable interface when compiling against GTK+
+        3.x.
+
+        * webkit/webkitwebview.cpp:
+        (setHorizontalAdjustment):
+        (setVerticalAdjustment):
+        (getHorizontalAdjustment):
+        (getVerticalAdjustment):
+        (webkit_web_view_get_property):
+        (webkit_web_view_set_property):
+        (webkit_web_view_class_init):
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::createWindow):
+        * WebCoreSupport/ChromeClientGtk.h:
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchCreatePage):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+        Add NavigationAction parameter.
+
 2010-10-20  Philippe Normand  <pnormand@igalia.com>
 
         Reviewed by Xan Lopez.
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 7e4090b..e864ea7 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -25,6 +25,7 @@
 #include "ChromeClientGtk.h"
 
 #include "Console.h"
+#include "DumpRenderTreeSupportGtk.h"
 #include "FileSystem.h"
 #include "FileChooser.h"
 #include "FloatRect.h"
@@ -35,6 +36,7 @@
 #include "HitTestResult.h"
 #include "Icon.h"
 #include "KURL.h"
+#include "NavigationAction.h"
 #include "PlatformString.h"
 #include "PopupMenuClient.h"
 #include "PopupMenuGtk.h"
@@ -137,7 +139,7 @@ void ChromeClient::unfocus()
         gtk_window_set_focus(GTK_WINDOW(window), NULL);
 }
 
-Page* ChromeClient::createWindow(Frame* frame, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& coreFeatures)
+Page* ChromeClient::createWindow(Frame* frame, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& coreFeatures, const NavigationAction&)
 {
     WebKitWebView* webView = 0;
 
@@ -330,6 +332,9 @@ bool ChromeClient::shouldInterruptJavaScript()
 
 bool ChromeClient::tabsToLinks() const
 {
+    if (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled())
+        return DumpRenderTreeSupportGtk::linksIncludedInFocusChain();
+
     return true;
 }
 
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index 21c4677..b925313 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -56,7 +56,7 @@ namespace WebKit {
 
         virtual void focusedNodeChanged(WebCore::Node*);
 
-        virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
+        virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&);
         virtual void show();
 
         virtual bool canRunModal();
diff --git a/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp b/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
new file mode 100644
index 0000000..8296206
--- /dev/null
+++ b/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DumpRenderTreeSupportGtk.h"
+
+#include "webkitwebview.h"
+#include "webkitprivate.h"
+
+using namespace WebCore;
+
+bool DumpRenderTreeSupportGtk::s_drtRun = false;
+bool DumpRenderTreeSupportGtk::s_linksIncludedInTabChain = true;
+
+DumpRenderTreeSupportGtk::DumpRenderTreeSupportGtk()
+{
+}
+
+DumpRenderTreeSupportGtk::~DumpRenderTreeSupportGtk()
+{
+}
+
+void DumpRenderTreeSupportGtk::setDumpRenderTreeModeEnabled(bool enabled)
+{
+    s_drtRun = enabled;
+}
+
+bool DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled()
+{
+    return s_drtRun;
+}
+void DumpRenderTreeSupportGtk::setLinksIncludedInFocusChain(bool enabled)
+{
+    s_linksIncludedInTabChain = enabled;
+}
+
+bool DumpRenderTreeSupportGtk::linksIncludedInFocusChain()
+{
+    return s_linksIncludedInTabChain;
+}
+
diff --git a/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h b/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
new file mode 100644
index 0000000..5b494ff
--- /dev/null
+++ b/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DumpRenderTreeSupportGtk_h
+#define DumpRenderTreeSupportGtk_h
+
+class DumpRenderTreeSupportGtk {
+
+public:
+    DumpRenderTreeSupportGtk();
+    ~DumpRenderTreeSupportGtk();
+
+    static void setDumpRenderTreeModeEnabled(bool);
+    static bool dumpRenderTreeModeEnabled();
+
+    static void setLinksIncludedInFocusChain(bool);
+    static bool linksIncludedInFocusChain();
+
+private:
+    static bool s_drtRun;
+    static bool s_linksIncludedInTabChain;
+};
+
+#endif
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index fa17632..20aafc2 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -592,13 +592,14 @@ PassRefPtr<Frame> FrameLoaderClient::createFrame(const KURL& url, const String&
     if (!childFrame->page())
         return 0;
 
+    g_signal_emit_by_name(webView, "frame-created", kitFrame);
+
     childFrame->loader()->loadURLIntoChildFrame(url, referrer, childFrame.get());
 
     // The frame's onload handler may have removed it from the document.
     if (!childFrame->tree()->parent())
         return 0;
 
-    g_signal_emit_by_name(webView, "frame-created", kitFrame);
     return childFrame.release();
 }
 
@@ -619,6 +620,10 @@ void FrameLoaderClient::didTransferChildFrameToNewDocument(WebCore::Page*)
     ASSERT(core(getViewFromFrame(m_frame)) == coreFrame->page());
 }
 
+void FrameLoaderClient::transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page*)
+{
+}
+
 void FrameLoaderClient::redirectDataToPlugin(Widget* pluginWidget)
 {
     ASSERT(!m_pluginView);
@@ -1200,7 +1205,7 @@ bool FrameLoaderClient::canCachePage() const
     return true;
 }
 
-Frame* FrameLoaderClient::dispatchCreatePage()
+Frame* FrameLoaderClient::dispatchCreatePage(const NavigationAction&)
 {
     WebKitWebView* webView = getViewFromFrame(m_frame);
     WebKitWebView* newWebView = 0;
@@ -1308,6 +1313,10 @@ void FrameLoaderClient::transitionToCommittedForNewPage()
     postCommitFrameViewSetup(m_frame, frame->view(), true);
 }
 
+void FrameLoaderClient::dispatchDidBecomeFrameset(bool)
+{
+}
+
 PassRefPtr<FrameNetworkingContext> FrameLoaderClient::createNetworkingContext()
 {
     return FrameNetworkingContextGtk::create(core(m_frame));
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
index 206e780..ffb3c56 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
@@ -91,7 +91,7 @@ namespace WebKit {
         virtual void dispatchDidFirstLayout();
         virtual void dispatchDidFirstVisuallyNonEmptyLayout();
 
-        virtual WebCore::Frame* dispatchCreatePage();
+        virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
         virtual void dispatchShow();
 
         virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction, const WTF::String& MIMEType, const WebCore::ResourceRequest&);
@@ -115,6 +115,7 @@ namespace WebKit {
         virtual PassRefPtr<WebCore::Frame> createFrame(const WebCore::KURL& url, const WTF::String& name, WebCore::HTMLFrameOwnerElement* ownerElement,
                                    const WTF::String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
         virtual void didTransferChildFrameToNewDocument(WebCore::Page*);
+        virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page*);
         virtual PassRefPtr<WebCore::Widget> createPlugin(const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&, const WTF::Vector<WTF::String>&, const WTF::Vector<WTF::String>&, const WTF::String&, bool);
         virtual void redirectDataToPlugin(WebCore::Widget* pluginWidget);
         virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(const WebCore::IntSize&, WebCore::HTMLAppletElement*, const WebCore::KURL& baseURL, const WTF::Vector<WTF::String>& paramNames, const WTF::Vector<WTF::String>& paramValues);
@@ -180,6 +181,8 @@ namespace WebKit {
         virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
         virtual void transitionToCommittedForNewPage();
 
+        virtual void dispatchDidBecomeFrameset(bool);
+
         virtual bool canCachePage() const;
         virtual void download(WebCore::ResourceHandle*, const WebCore::ResourceRequest&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&);
 
diff --git a/WebKit/gtk/tests/testatk.c b/WebKit/gtk/tests/testatk.c
index c8df4ef..bd6473a 100644
--- a/WebKit/gtk/tests/testatk.c
+++ b/WebKit/gtk/tests/testatk.c
@@ -46,6 +46,10 @@ static const char* contentsInTableWithHeaders = "<html><body><table><tr><th>foo<
 
 static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /></form></body></html>";
 
+static const char* layoutAndDataTables = "<html><body><table><tr><th>Odd</th><th>Even</th></tr><tr><td>1</td><td>2</td></tr></table><table><tr><td>foo</td><td>bar</td></tr></table></body></html>";
+
+static const char* linksWithInlineImages = "<html><head><style>a.http:before {content: url(no-image.png);}</style><body><p><a class='http' href='foo'>foo</a> bar baz</p><p>foo <a class='http' href='bar'>bar</a> baz</p><p>foo bar <a class='http' href='baz'>baz</a></p></body></html>";
+
 static const char* listsOfItems = "<html><body><ul><li>text only</li><li><a href='foo'>link only</a></li><li>text and a <a href='bar'>link</a></li></ul><ol><li>text only</li><li><a href='foo'>link only</a></li><li>text and a <a href='bar'>link</a></li></ol></body></html>";
 
 static const char* textForSelections = "<html><body><p>A paragraph with plain text</p><p>A paragraph with <a href='http://webkit.org'>a link</a> in the middle</p></body></html>";
@@ -596,15 +600,25 @@ static gint compAtkAttributeName(AtkAttribute* a1, AtkAttribute* a2)
     return g_strcmp0(a1->name, a2->name);
 }
 
-static gboolean atkAttributeSetAttributeHasValue(AtkAttributeSet* set, AtkTextAttribute attribute, const gchar* value)
+static gboolean atkAttributeSetAttributeNameHasValue(AtkAttributeSet* set, const gchar* attributeName, const gchar* value)
 {
-    GSList *element;
+    GSList* element;
     AtkAttribute at;
-    gboolean result;
-    at.name = (gchar *)atk_text_attribute_get_name(attribute);
+    at.name = (gchar*)attributeName;
     element = g_slist_find_custom(set, &at, (GCompareFunc)compAtkAttributeName);
-    result = element && !g_strcmp0(((AtkAttribute*)(element->data))->value, value);
-    return result;
+    return element && !g_strcmp0(((AtkAttribute*)(element->data))->value, value);
+}
+
+static gboolean atkAttributeSetContainsAttributeName(AtkAttributeSet* set, const gchar* attributeName)
+{
+    AtkAttribute at;
+    at.name = (gchar*)attributeName;
+    return g_slist_find_custom(set, &at, (GCompareFunc)compAtkAttributeName) ? true : false;
+}
+
+static gboolean atkAttributeSetAttributeHasValue(AtkAttributeSet* set, AtkTextAttribute attribute, const gchar* value)
+{
+    return atkAttributeSetAttributeNameHasValue(set, atk_text_attribute_get_name(attribute), value);
 }
 
 static gboolean atkAttributeSetAreEqual(AtkAttributeSet* set1, AtkAttributeSet* set2)
@@ -964,6 +978,98 @@ static void testWebkitAtkGetExtents(void)
     g_object_unref(webView);
 }
 
+static void testWebkitAtkLayoutAndDataTables(void)
+{
+    WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, layoutAndDataTables, 0, 0, 0);
+
+    // Manually spin the main context to get the accessible objects
+    while (g_main_context_pending(0))
+        g_main_context_iteration(0, TRUE);
+
+    AtkObject* obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+
+    // Check the non-layout table (data table)
+
+    AtkObject* table1 = atk_object_ref_accessible_child(obj, 0);
+    g_assert(ATK_IS_TABLE(table1));
+    AtkAttributeSet* set1 = atk_object_get_attributes(table1);
+    g_assert(set1);
+    g_assert(!atkAttributeSetContainsAttributeName(set1, "layout-guess"));
+    atk_attribute_set_free(set1);
+
+    // Check the layout table
+
+    AtkObject* table2 = atk_object_ref_accessible_child(obj, 1);
+    g_assert(ATK_IS_TABLE(table2));
+    AtkAttributeSet* set2 = atk_object_get_attributes(table2);
+    g_assert(set2);
+    g_assert(atkAttributeSetContainsAttributeName(set2, "layout-guess"));
+    g_assert(atkAttributeSetAttributeNameHasValue(set2, "layout-guess", "true"));
+    atk_attribute_set_free(set2);
+
+    g_object_unref(table1);
+    g_object_unref(table2);
+    g_object_unref(webView);
+}
+
+static void testWebkitAtkLinksWithInlineImages(void)
+{
+    WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, linksWithInlineImages, 0, 0, 0);
+
+    // Manually spin the main context to get the accessible objects
+    while (g_main_context_pending(0))
+        g_main_context_iteration(0, TRUE);
+
+    AtkObject* object = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(object);
+
+    // First paragraph (link at the beginning)
+    AtkObject* paragraph = atk_object_ref_accessible_child(object, 0);
+    g_assert(ATK_IS_TEXT(paragraph));
+    gint startOffset;
+    gint endOffset;
+    gchar* text = atk_text_get_text_at_offset(ATK_TEXT(paragraph), 0, ATK_TEXT_BOUNDARY_LINE_START, &startOffset, &endOffset);
+    g_assert(text);
+    g_assert_cmpstr(text, ==, "foo bar baz");
+    g_assert_cmpint(startOffset, ==, 0);
+    g_assert_cmpint(endOffset, ==, 11);
+    g_free(text);
+    g_object_unref(paragraph);
+
+    // Second paragraph (link in the middle)
+    paragraph = atk_object_ref_accessible_child(object, 1);
+    g_assert(ATK_IS_TEXT(paragraph));
+    text = atk_text_get_text_at_offset(ATK_TEXT(paragraph), 0, ATK_TEXT_BOUNDARY_LINE_START, &startOffset, &endOffset);
+    g_assert(text);
+    g_assert_cmpstr(text, ==, "foo bar baz");
+    g_assert_cmpint(startOffset, ==, 0);
+    g_assert_cmpint(endOffset, ==, 11);
+    g_free(text);
+    g_object_unref(paragraph);
+
+    // Third paragraph (link at the end)
+    paragraph = atk_object_ref_accessible_child(object, 2);
+    g_assert(ATK_IS_TEXT(paragraph));
+    text = atk_text_get_text_at_offset(ATK_TEXT(paragraph), 0, ATK_TEXT_BOUNDARY_LINE_START, &startOffset, &endOffset);
+    g_assert(text);
+    g_assert_cmpstr(text, ==, "foo bar baz");
+    g_assert_cmpint(startOffset, ==, 0);
+    g_assert_cmpint(endOffset, ==, 11);
+    g_free(text);
+    g_object_unref(paragraph);
+
+    g_object_unref(webView);
+}
+
 static void testWebkitAtkListsOfItems(void)
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
@@ -1116,6 +1222,8 @@ int main(int argc, char** argv)
     g_test_add_func("/webkit/atk/textAttributes", testWebkitAtkTextAttributes);
     g_test_add_func("/webkit/atk/textSelections", testWekitAtkTextSelections);
     g_test_add_func("/webkit/atk/getExtents", testWebkitAtkGetExtents);
+    g_test_add_func("/webkit/atk/layoutAndDataTables", testWebkitAtkLayoutAndDataTables);
+    g_test_add_func("/webkit/atk/linksWithInlineImages", testWebkitAtkLinksWithInlineImages);
     g_test_add_func("/webkit/atk/listsOfItems", testWebkitAtkListsOfItems);
     g_test_add_func("/webkit/atk/textChangedNotifications", testWebkitAtkTextChangedNotifications);
     return g_test_run ();
diff --git a/WebKit/gtk/webkit/webkitprivate.h b/WebKit/gtk/webkit/webkitprivate.h
index 616ee6b..261c437 100644
--- a/WebKit/gtk/webkit/webkitprivate.h
+++ b/WebKit/gtk/webkit/webkitprivate.h
@@ -46,7 +46,7 @@
 #include <webkit/webkitsecurityorigin.h>
 
 #include "ArchiveResource.h"
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 #include "DataObjectGtk.h"
 #include "DragActions.h"
 #include "Frame.h"
@@ -92,7 +92,7 @@ namespace WebKit {
     WebCore::HistoryItem* core(WebKitWebHistoryItem*);
     WebKitWebHistoryItem* kit(PassRefPtr<WebCore::HistoryItem>);
 
-    WebCore::BackForwardList* core(WebKitWebBackForwardList*);
+    WebCore::BackForwardListImpl* core(WebKitWebBackForwardList*);
 
     WebKitWebNavigationReason kit(WebCore::NavigationType type);
     WebCore::NavigationType core(WebKitWebNavigationReason reason);
@@ -154,6 +154,13 @@ extern "C" {
         PlatformRefPtr<GtkAdjustment> horizontalAdjustment;
         PlatformRefPtr<GtkAdjustment> verticalAdjustment;
 
+#ifndef GTK_API_VERSION_2
+        // GtkScrollablePolicy needs to be checked when
+        // driving the scrollable adjustment values
+        GtkScrollablePolicy horizontalScrollingPolicy;
+        GtkScrollablePolicy verticalScrollingPolicy;
+#endif
+
         gboolean zoomFullContent;
         WebKitLoadStatus loadStatus;
         CString encoding;
diff --git a/WebKit/gtk/webkit/webkitwebbackforwardlist.cpp b/WebKit/gtk/webkit/webkitwebbackforwardlist.cpp
index 4789de9..c5913fd 100644
--- a/WebKit/gtk/webkit/webkitwebbackforwardlist.cpp
+++ b/WebKit/gtk/webkit/webkitwebbackforwardlist.cpp
@@ -27,7 +27,7 @@
 
 #include <glib.h>
 
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 #include "HistoryItem.h"
 
 /**
@@ -53,7 +53,7 @@
 using namespace WebKit;
 
 struct _WebKitWebBackForwardListPrivate {
-    WebCore::BackForwardList* backForwardList;
+    WebCore::BackForwardListImpl* backForwardList;
     gboolean disposed;
 };
 
@@ -64,7 +64,7 @@ G_DEFINE_TYPE(WebKitWebBackForwardList, webkit_web_back_forward_list, G_TYPE_OBJ
 static void webkit_web_back_forward_list_dispose(GObject* object)
 {
     WebKitWebBackForwardList* list = WEBKIT_WEB_BACK_FORWARD_LIST(object);
-    WebCore::BackForwardList* backForwardList = core(list);
+    WebCore::BackForwardListImpl* backForwardList = core(list);
     WebKitWebBackForwardListPrivate* priv = list->priv;
 
     if (!priv->disposed) {
@@ -115,7 +115,7 @@ WebKitWebBackForwardList* webkit_web_back_forward_list_new_with_web_view(WebKitW
     webBackForwardList = WEBKIT_WEB_BACK_FORWARD_LIST(g_object_new(WEBKIT_TYPE_WEB_BACK_FORWARD_LIST, NULL));
     WebKitWebBackForwardListPrivate* priv = webBackForwardList->priv;
 
-    priv->backForwardList = core(webView)->backForwardList();
+    priv->backForwardList = static_cast<BackForwardListImpl*>(core(webView)->backForwardList());
     priv->backForwardList->setEnabled(TRUE);
 
     return webBackForwardList;
@@ -131,7 +131,7 @@ void webkit_web_back_forward_list_go_forward(WebKitWebBackForwardList* webBackFo
 {
     g_return_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList));
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (backForwardList->enabled())
         backForwardList->goForward();
 }
@@ -146,7 +146,7 @@ void webkit_web_back_forward_list_go_back(WebKitWebBackForwardList* webBackForwa
 {
     g_return_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList));
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (backForwardList->enabled())
         backForwardList->goBack();
 }
@@ -169,7 +169,7 @@ gboolean webkit_web_back_forward_list_contains_item(WebKitWebBackForwardList* we
 
     g_return_val_if_fail(historyItem != NULL, FALSE);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
 
     return (backForwardList->enabled() ? backForwardList->containsItem(historyItem) : FALSE);
 }
@@ -187,7 +187,7 @@ void webkit_web_back_forward_list_go_to_item(WebKitWebBackForwardList* webBackFo
     g_return_if_fail(WEBKIT_IS_WEB_HISTORY_ITEM(webHistoryItem));
 
     WebCore::HistoryItem* historyItem = core(webHistoryItem);
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
 
     if (backForwardList->enabled() && historyItem)
         backForwardList->goToItem(historyItem);
@@ -206,7 +206,7 @@ GList* webkit_web_back_forward_list_get_forward_list_with_limit(WebKitWebBackFor
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return NULL;
 
@@ -236,7 +236,7 @@ GList* webkit_web_back_forward_list_get_back_list_with_limit(WebKitWebBackForwar
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return NULL;
 
@@ -265,7 +265,7 @@ WebKitWebHistoryItem* webkit_web_back_forward_list_get_back_item(WebKitWebBackFo
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return NULL;
 
@@ -288,7 +288,7 @@ WebKitWebHistoryItem* webkit_web_back_forward_list_get_current_item(WebKitWebBac
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return NULL;
 
@@ -311,7 +311,7 @@ WebKitWebHistoryItem* webkit_web_back_forward_list_get_forward_item(WebKitWebBac
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return NULL;
 
@@ -333,7 +333,7 @@ WebKitWebHistoryItem* webkit_web_back_forward_list_get_nth_item(WebKitWebBackFor
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList)
         return NULL;
 
@@ -354,7 +354,7 @@ gint webkit_web_back_forward_list_get_back_length(WebKitWebBackForwardList* webB
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), 0);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return 0;
 
@@ -373,7 +373,7 @@ gint webkit_web_back_forward_list_get_forward_length(WebKitWebBackForwardList* w
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), 0);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return 0;
 
@@ -392,7 +392,7 @@ gint webkit_web_back_forward_list_get_limit(WebKitWebBackForwardList* webBackFor
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), 0);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled())
         return 0;
 
@@ -412,7 +412,7 @@ void webkit_web_back_forward_list_set_limit(WebKitWebBackForwardList* webBackFor
 {
     g_return_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList));
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (backForwardList)
         backForwardList->setCapacity(limit);
 }
@@ -435,7 +435,7 @@ void webkit_web_back_forward_list_add_item(WebKitWebBackForwardList *webBackForw
 
     g_object_ref(webHistoryItem);
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     WebCore::HistoryItem* historyItem = core(webHistoryItem);
 
     backForwardList->addItem(historyItem);
@@ -454,7 +454,7 @@ void webkit_web_back_forward_list_clear(WebKitWebBackForwardList* webBackForward
 {
     g_return_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList));
 
-    WebCore::BackForwardList* backForwardList = core(webBackForwardList);
+    WebCore::BackForwardListImpl* backForwardList = core(webBackForwardList);
     if (!backForwardList || !backForwardList->enabled() || !backForwardList->entries().size())
         return;
 
@@ -464,7 +464,7 @@ void webkit_web_back_forward_list_clear(WebKitWebBackForwardList* webBackForward
     backForwardList->setCapacity(capacity);
 }
 
-WebCore::BackForwardList* WebKit::core(WebKitWebBackForwardList* webBackForwardList)
+WebCore::BackForwardListImpl* WebKit::core(WebKitWebBackForwardList* webBackForwardList)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_BACK_FORWARD_LIST(webBackForwardList), NULL);
 
diff --git a/WebKit/gtk/webkit/webkitwebview.cpp b/WebKit/gtk/webkit/webkitwebview.cpp
index f5d0ef6..a295fce 100644
--- a/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/WebKit/gtk/webkit/webkitwebview.cpp
@@ -42,7 +42,7 @@
 
 #include "AXObjectCache.h"
 #include "AbstractDatabase.h"
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 #include "Cache.h"
 #include "ChromeClientGtk.h"
 #include "ClipboardUtilitiesGtk.h"
@@ -196,12 +196,25 @@ enum {
     PROP_CUSTOM_ENCODING,
     PROP_ICON_URI,
     PROP_IM_CONTEXT,
+#ifdef GTK_API_VERSION_2
     PROP_VIEW_MODE
+#else
+    PROP_VIEW_MODE,
+    PROP_HADJUSTMENT,
+    PROP_VADJUSTMENT,
+    PROP_HSCROLL_POLICY,
+    PROP_VSCROLL_POLICY
+#endif
 };
 
 static guint webkit_web_view_signals[LAST_SIGNAL] = { 0, };
 
+#ifdef GTK_API_VERSION_2
 G_DEFINE_TYPE(WebKitWebView, webkit_web_view, GTK_TYPE_CONTAINER)
+#else
+G_DEFINE_TYPE_WITH_CODE(WebKitWebView, webkit_web_view, GTK_TYPE_CONTAINER,
+                        G_IMPLEMENT_INTERFACE(GTK_TYPE_SCROLLABLE, 0))
+#endif
 
 static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GParamSpec* pspec, WebKitWebView* webView);
 static void webkit_web_view_set_window_features(WebKitWebView* webView, WebKitWebWindowFeatures* webWindowFeatures);
@@ -385,6 +398,65 @@ static gboolean webkit_web_view_popup_menu_handler(GtkWidget* widget)
     return webkit_web_view_forward_context_menu_event(WEBKIT_WEB_VIEW(widget), event);
 }
 
+#ifndef GTK_API_VERSION_2
+static void setHorizontalAdjustment(WebKitWebView* webView, GtkAdjustment* adjustment)
+{
+    if (!core(webView))
+        return;
+
+    webView->priv->horizontalAdjustment = adjustment;
+    FrameView* view = core(webkit_web_view_get_main_frame(webView))->view();
+    if (!view)
+        return;
+    view->setHorizontalAdjustment(adjustment);
+}
+
+static void setVerticalAdjustment(WebKitWebView* webView, GtkAdjustment* adjustment)
+{
+    if (!core(webView))
+        return;
+
+    webView->priv->verticalAdjustment = adjustment;
+    FrameView* view = core(webkit_web_view_get_main_frame(webView))->view();
+    if (!view)
+        return;
+    view->setVerticalAdjustment(adjustment);
+}
+
+static GtkAdjustment* getHorizontalAdjustment(WebKitWebView* webView)
+{
+    return webView->priv->horizontalAdjustment.get();
+}
+
+static GtkAdjustment* getVerticalAdjustment(WebKitWebView* webView)
+{
+    return webView->priv->verticalAdjustment.get();
+}
+
+static void setHorizontalScrollPolicy(WebKitWebView* webView, GtkScrollablePolicy policy)
+{
+    webView->priv->horizontalScrollingPolicy = policy;
+    gtk_widget_queue_resize(GTK_WIDGET(webView));
+}
+
+static void setVerticalScrollPolicy(WebKitWebView* webView, GtkScrollablePolicy policy)
+{
+    webView->priv->verticalScrollingPolicy = policy;
+    gtk_widget_queue_resize(GTK_WIDGET(webView));
+}
+
+static GtkScrollablePolicy getHorizontalScrollPolicy(WebKitWebView* webView)
+{
+    return webView->priv->horizontalScrollingPolicy;
+}
+
+static GtkScrollablePolicy getVerticalScrollPolicy(WebKitWebView* webView)
+{
+    return webView->priv->verticalScrollingPolicy;
+}
+
+#endif
+
 static void webkit_web_view_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(object);
@@ -444,6 +516,20 @@ static void webkit_web_view_get_property(GObject* object, guint prop_id, GValue*
     case PROP_VIEW_MODE:
         g_value_set_enum(value, webkit_web_view_get_view_mode(webView));
         break;
+#ifndef GTK_API_VERSION_2
+    case PROP_HADJUSTMENT:
+        g_value_set_object(value, getHorizontalAdjustment(webView));
+        break;
+    case PROP_VADJUSTMENT:
+        g_value_set_object(value, getVerticalAdjustment(webView));
+        break;
+    case PROP_HSCROLL_POLICY:
+        g_value_set_enum(value, getHorizontalScrollPolicy(webView));
+        break;
+    case PROP_VSCROLL_POLICY:
+        g_value_set_enum(value, getVerticalScrollPolicy(webView));
+        break;
+#endif
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
     }
@@ -478,6 +564,20 @@ static void webkit_web_view_set_property(GObject* object, guint prop_id, const G
     case PROP_VIEW_MODE:
         webkit_web_view_set_view_mode(webView, static_cast<WebKitWebViewViewMode>(g_value_get_enum(value)));
         break;
+#ifndef GTK_API_VERSION_2
+    case PROP_HADJUSTMENT:
+        setHorizontalAdjustment(webView, static_cast<GtkAdjustment*>(g_value_get_object(value)));
+        break;
+    case PROP_VADJUSTMENT:
+        setVerticalAdjustment(webView, static_cast<GtkAdjustment*>(g_value_get_object(value)));
+        break;
+    case PROP_HSCROLL_POLICY:
+        setHorizontalScrollPolicy(webView, static_cast<GtkScrollablePolicy>(g_value_get_enum(value)));
+        break;
+    case PROP_VSCROLL_POLICY:
+        setVerticalScrollPolicy(webView, static_cast<GtkScrollablePolicy>(g_value_get_enum(value)));
+        break;
+#endif
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
     }
@@ -908,6 +1008,7 @@ static void webkit_web_view_realize(GtkWidget* widget)
     gtk_im_context_set_client_window(priv->imContext.get(), window);
 }
 
+#ifdef GTK_API_VERSION_2
 static void webkit_web_view_set_scroll_adjustments(WebKitWebView* webView, GtkAdjustment* hadj, GtkAdjustment* vadj)
 {
     if (!core(webView))
@@ -921,6 +1022,7 @@ static void webkit_web_view_set_scroll_adjustments(WebKitWebView* webView, GtkAd
         return;
     view->setGtkAdjustments(hadj, vadj);
 }
+#endif
 
 static void webkit_web_view_container_add(GtkContainer* container, GtkWidget* widget)
 {
@@ -2525,6 +2627,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
     /*
      * make us scrollable (e.g. addable to a GtkScrolledWindow)
      */
+#ifdef GTK_API_VERSION_2
     webViewClass->set_scroll_adjustments = webkit_web_view_set_scroll_adjustments;
     GTK_WIDGET_CLASS(webViewClass)->set_scroll_adjustments_signal = g_signal_new("set-scroll-adjustments",
             G_TYPE_FROM_CLASS(webViewClass),
@@ -2534,6 +2637,12 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             webkit_marshal_VOID__OBJECT_OBJECT,
             G_TYPE_NONE, 2,
             GTK_TYPE_ADJUSTMENT, GTK_TYPE_ADJUSTMENT);
+#else
+    g_object_class_override_property(objectClass, PROP_HADJUSTMENT, "hadjustment");
+    g_object_class_override_property(objectClass, PROP_VADJUSTMENT, "vadjustment");
+    g_object_class_override_property(objectClass, PROP_HSCROLL_POLICY, "hscroll-policy");
+    g_object_class_override_property(objectClass, PROP_VSCROLL_POLICY, "vscroll-policy");
+#endif
 
     /*
      * Key bindings
@@ -3322,7 +3431,7 @@ void webkit_web_view_set_maintains_back_forward_list(WebKitWebView* webView, gbo
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    core(webView)->backForwardList()->setEnabled(flag);
+    static_cast<BackForwardListImpl*>(core(webView)->backForwardList())->setEnabled(flag);
 }
 
 /**
@@ -3337,7 +3446,7 @@ void webkit_web_view_set_maintains_back_forward_list(WebKitWebView* webView, gbo
 WebKitWebBackForwardList* webkit_web_view_get_back_forward_list(WebKitWebView* webView)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
-    if (!core(webView) || !core(webView)->backForwardList()->enabled())
+    if (!core(webView) || !static_cast<BackForwardListImpl*>(core(webView)->backForwardList())->enabled())
         return 0;
     return webView->priv->backForwardList.get();
 }
diff --git a/WebKit/haiku/ChangeLog b/WebKit/haiku/ChangeLog
index d55ce71..7ed4fad 100644
--- a/WebKit/haiku/ChangeLog
+++ b/WebKit/haiku/ChangeLog
@@ -1,3 +1,43 @@
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchDidBecomeFrameset):
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::transferLoadingResourceFromPage):
+        Empty method.
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebCoreSupport/ChromeClientHaiku.cpp:
+        (WebCore::ChromeClientHaiku::createWindow):
+        * WebCoreSupport/ChromeClientHaiku.h:
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchCreatePage):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+        Add NavigationAction parameter.
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
index 6c54424..134cabe 100644
--- a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
@@ -34,6 +34,7 @@
 #include "FrameView.h"
 #include "HitTestResult.h"
 #include "Icon.h"
+#include "NavigationAction.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -107,7 +108,7 @@ void ChromeClientHaiku::focusedNodeChanged(Node*)
 {
 }
 
-Page* ChromeClientHaiku::createWindow(Frame*, const FrameLoadRequest&, const WebCore::WindowFeatures&)
+Page* ChromeClientHaiku::createWindow(Frame*, const FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&)
 {
     notImplemented();
     return 0;
diff --git a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
index 6a5b381..9409c69 100644
--- a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
+++ b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
@@ -60,7 +60,7 @@ namespace WebCore {
 
         void focusedNodeChanged(Node*);
 
-        Page* createWindow(Frame*, const FrameLoadRequest&, const WebCore::WindowFeatures&);
+        Page* createWindow(Frame*, const FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&);
         Page* createModalDialog(Frame*, const FrameLoadRequest&);
         void show();
 
diff --git a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
index cae0ed1..74625c5 100644
--- a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
@@ -645,7 +645,7 @@ void FrameLoaderClientHaiku::dispatchDidFailLoad(const ResourceError&)
     notImplemented();
 }
 
-Frame* FrameLoaderClientHaiku::dispatchCreatePage()
+Frame* FrameLoaderClientHaiku::dispatchCreatePage(const WebCore::NavigationAction&)
 {
     notImplemented();
     return false;
@@ -745,6 +745,10 @@ void FrameLoaderClientHaiku::didTransferChildFrameToNewDocument(Page*)
 {
 }
 
+void FrameLoaderClientHaiku::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
+}
+
 ObjectContentType FrameLoaderClientHaiku::objectContentType(const KURL& url, const String& mimeType)
 {
     notImplemented();
@@ -853,4 +857,8 @@ void FrameLoaderClientHaiku::transitionToCommittedForNewPage()
         m_frame->view()->setScrollbarModes(owner->scrollingMode(), owner->scrollingMode());
 }
 
+void FrameLoaderClientHaiku::dispatchDidBecomeFrameset(bool)
+{
+}
+
 } // namespace WebCore
diff --git a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
index 1701cb0..dcdb1a0 100644
--- a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
+++ b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
@@ -151,6 +151,8 @@ namespace WebCore {
         virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
         virtual void transitionToCommittedForNewPage();
 
+        virtual void dispatchDidBecomeFrameset(bool);
+
         virtual void updateGlobalHistory();
         virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(HistoryItem*) const;
@@ -199,7 +201,7 @@ namespace WebCore {
 
         virtual void dispatchDidFailProvisionalLoad(const ResourceError&);
         virtual void dispatchDidFailLoad(const ResourceError&);
-        virtual Frame* dispatchCreatePage();
+        virtual Frame* dispatchCreatePage(const NavigationAction&);
         virtual void dispatchDecidePolicyForMIMEType(FramePolicyFunction,
                                                      const String&,
                                                      const ResourceRequest&);
@@ -222,6 +224,7 @@ namespace WebCore {
                                               HTMLFrameOwnerElement*, const String& referrer,
                                               bool allowsScrolling, int marginWidth, int marginHeight);
         virtual void didTransferChildFrameToNewDocument(WebCore::Page*);
+        virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const ResourceRequest&, WebCore::Page*);
         virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&,
                                                 const Vector<String>&, const Vector<String>&, const String&,
                                                 bool loadManually);
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index 8f1ea42..e7abf3d 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,312 @@
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * History/WebBackForwardList.mm:
+        Use BackForwardListImpl.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Comment for usesDocumentViews explains it backwards. This flag is true in ToT, and we do
+        create views for subframes.
+
+        * WebView/WebViewData.h: Double negation is better than a lie.
+
+2010-10-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Full screen video in Safari (still) exits full-screen if you switch to another 
+        app on a multi-display system.
+        https://bugs.webkit.org/show_bug.cgi?id=47364
+        <rdar://problem/8382299>
+        
+        The FullScreen window does not technically close when it deactivates, but the 
+        two NSWindows that make up the FullScreen feature should not hide when deactivated.
+        
+        * WebView/WebVideoFullscreenController.mm:
+        (createBackgroundFullscreenWindow): Do not set hidesOnDeactivate.
+        (-[WebVideoFullscreenWindow initWithContentRect:styleMask:backing:defer:]): Ditto.
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindow initWithContentRect:styleMask:backing:defer:]): Ditto.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidBecomeFrameset):
+
+2010-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Roben and David Kilzer.
+
+        Fix and cleanup of build systems
+        https://bugs.webkit.org/show_bug.cgi?id=48342
+
+        * Configurations/FeatureDefines.xcconfig: Remove unnecessary ENABLE_SANDBOX.
+
+2010-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        LLVM compiler build fix
+
+        * Misc/WebDownload.mm:
+        (-[WebDownload initWithRequest:delegate:]): Changed the delegate type from id to
+        id<NSURLDownloadDelegate> to match the method signature in NSURLDownload.
+
+2010-10-28  Ivan Krstić  <ike@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Remove unused experimental proxied panel interface.
+        <rdar://problem/7237059>
+
+        * Plugins/Hosted/NetscapePluginHostManager.h:
+        * Plugins/Hosted/NetscapePluginHostManager.mm:
+        (WebKit::NetscapePluginHostManager::hostForPlugin):
+        (WebKit::NetscapePluginHostManager::spawnPluginHost):
+        (WebKit::NetscapePluginHostManager::instantiatePlugin):
+        * Plugins/Hosted/NetscapePluginHostProxy.mm:
+        * Plugins/Hosted/WebKitPluginClient.defs:
+        * Plugins/Hosted/WebKitPluginHost.defs:
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        * WebView/WebPreferencesPrivate.h:
+
+2010-10-27  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Improve memSize calculation in [WebView _setCacheModel]
+        https://bugs.webkit.org/show_bug.cgi?id=48484
+
+        * WebView/WebView.mm:
+        (roundUpToPowerOf2): Added. Utility function to calculate the nearest power of 2.
+        (+[WebView _setCacheModel:]): Update memSize calculation to set it to the next
+        bigger power of 2. Also update WebCore cache settings.
+
+2010-10-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKitTestRunner needs to support layoutTestController.dumpBackForwardList
+        https://bugs.webkit.org/show_bug.cgi?id=42322
+        rdar://problem/8193631
+
+        WebKitTestRunner needs to support layoutTestController.clearBackForwardList
+        https://bugs.webkit.org/show_bug.cgi?id=42333
+        rdar://problem/8193643
+
+        * History/WebBackForwardList.mm:
+        (core): Return BackForwardListImpl.
+        (kit): Take BackForwardListImpl.
+        (-[WebBackForwardList initWithBackForwardList:]): Use BackForwardListImpl.
+        (-[WebBackForwardList dealloc]): Ditto.
+        (-[WebBackForwardList finalize]): Ditto.
+        (-[WebBackForwardList description]): Ditto.
+        (-[WebBackForwardList setPageCacheSize:]): Ditto.
+        (-[WebBackForwardList pageCacheSize]): Ditto.
+        * History/WebBackForwardListInternal.h: Ditto.
+        * WebView/WebFrameView.mm:
+        (-[WebFrameView keyDown:]): Ditto.
+        * WebView/WebView.mm:
+        (-[WebView initWithCoder:]): Ditto.
+        (-[WebView encodeWithCoder:]): Ditto.
+        (-[WebView backForwardList]): Ditto.
+        (-[WebView setMaintainsBackForwardList:]): Ditto.
+
+2010-10-27  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Add ENABLE_WEB_AUDIO feature enable flag (initially disabled) to build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=48279
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-27  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=48385 Add WebKit 
+        SPI to scale a WebView
+        -and corresponding-
+        <rdar://problem/8107667>
+
+        This patch adds SPI to Mac WebKit that scales the page by the given 
+        scale factor.
+
+        * WebView/WebView.mm:
+        (-[WebView _scaleWebView:]):
+        (-[WebView _viewScaleFactor]):
+        * WebView/WebViewPrivate.h:
+
+2010-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70335): Incorrect article layout in Safari Reader
+        https://bugs.webkit.org/show_bug.cgi?id=48436
+
+        * Misc/WebKitVersionChecks.h: Added WEBKIT_FIRST_VERSION_WITH_GET_MATCHED_CSS_RULES_RESTRICTIONS.
+        * WebView/WebView.mm:
+        (-[WebView _needsUnrestrictedGetMatchedCSSRules]): Added. Returns YES for Safari linked against
+        versions of WebKit that did not have the cross-origin restrictions in getMatchedCSSRules().
+        (-[WebView _preferencesChangedNotification:]): Call Settings::setCrossOriginCheckInGetMatchedCSSRulesDisabled()
+        based on the above.
+
+2010-10-18  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Safari fullscreen media element tickles when it should not.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=47861
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController updatePowerAssertions]):
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::didTransferChildFrameToNewDocument):
+        Empty method.
+        (WebFrameLoaderClient::transferLoadingResourceFromPage):
+        Update resource tracking for a resource load that has been transferred
+        to a new page.
+
+2010-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove exec and globalData arguments from jsNumber
+        https://bugs.webkit.org/show_bug.cgi?id=48270
+
+        Mechanical removal of exec parameter to jsNumber
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::demarshalValueFromArray):
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyInstance::numberValue):
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Expose HitTestResult::absoluteMediaURL() via WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=48219
+
+        * Misc/WebElementDictionary.mm:
+        (+[WebElementDictionary initializeLookupTable]): Map WebElementMediaURLKey to
+        _absoluteMediaURL.
+        (-[WebElementDictionary _absoluteMediaURL]): Added. Returns absoluteMediaURL().
+        * WebKit.exp: Export WebElementMediaURLKey.
+        * WebView/WebView.mm: Define WebElementMediaURLKey.
+        * WebView/WebViewPrivate.h: Declare WebElementMediaURLKey.
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed deprecated methods from the WebHTMLHighlighter private protocol.
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::customHighlightRect): Call -highlightRectForLine:representedNode:
+        unconditionally.
+        (WebChromeClient::paintCustomHighlight): Call
+        -paintHighlightForBox:onLine:behindText:entireLine:representedNode: unconditionally.
+        * WebView/WebHTMLViewPrivate.h:
+
+2010-10-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Unify globalData APIs
+        https://bugs.webkit.org/show_bug.cgi?id=47969
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+        (WebKit::NetscapePluginInstanceProxy::construct):
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame evaluateWebScript:]):
+
+2010-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/48186> Remove unneeded WebHTMLRepresentationInternal.h header
+
+        Reviewed by Sam Weinig.
+
+        The only method defined in WebHTMLRepresentationInternal.h is
+        also defined in WebHTMLRepresentation.h, so use that instead.
+
+        * WebView/WebHTMLRepresentationInternal.h: Removed.
+
+2010-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48083
+        <rdar://problem/8489082> Need WebKit2 API for private browsing (48083)
+
+        * WebCoreSupport/WebSystemInterface.mm: (InitWebCoreSystemInterface): Initialize the new method.
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::createWindow):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchCreatePage):
+        Add NavigationAction parameter.
+
+2010-10-21  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        WebKit shouldn't load a plug-in based on file extension if a MIME type
+        is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=48046
+
+        If a MIME type is specified in an object or embed element, and that MIME
+        type isn't supported by an installed plug-in, WebKit shouldn't attempt
+        to find a plug-in based on the file extension of the url attribute.
+        Doing so can lead to cases where a plug-in is loaded that can't handle
+        resources of the MIME type specified by the author.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::createPlugin): Only check for a pluginPackage by
+        extension if MIME type is the empty string.
+
 2010-10-20  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 8732c18..d08fadf 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -94,9 +94,6 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_RUBY = $(ENABLE_RUBY_$(REAL_PLATFORM_NAME));
 ENABLE_RUBY_macosx = ENABLE_RUBY;
 
-ENABLE_SANDBOX = $(ENABLE_SANDBOX_$(REAL_PLATFORM_NAME));
-ENABLE_SANDBOX_macosx = ENABLE_SANDBOX;
-
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
 ENABLE_SHARED_WORKERS_macosx = ENABLE_SHARED_WORKERS;
 
@@ -112,6 +109,8 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 
+ENABLE_WEB_AUDIO = ;
+
 ENABLE_WEB_SOCKETS = $(ENABLE_WEB_SOCKETS_$(REAL_PLATFORM_NAME));
 ENABLE_WEB_SOCKETS_macosx = ENABLE_WEB_SOCKETS;
 
@@ -125,4 +124,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebKit/mac/History/WebBackForwardList.mm b/WebKit/mac/History/WebBackForwardList.mm
index 617ee0e..e794c2f 100644
--- a/WebKit/mac/History/WebBackForwardList.mm
+++ b/WebKit/mac/History/WebBackForwardList.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2005, 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,8 +53,10 @@
 
 using namespace WebCore;
 
-typedef HashMap<BackForwardList*, WebBackForwardList*> BackForwardListMap;
+typedef HashMap<BackForwardListImpl*, WebBackForwardList*> BackForwardListMap;
 
+// FIXME: Instead of this we could just create a class derived from BackForwardListImpl
+// with a pointer to a WebBackForwardList in it.
 static BackForwardListMap& backForwardLists()
 {
     DEFINE_STATIC_LOCAL(BackForwardListMap, staticBackForwardLists, ());
@@ -63,15 +65,15 @@ static BackForwardListMap& backForwardLists()
 
 @implementation WebBackForwardList (WebBackForwardListInternal)
 
-BackForwardList* core(WebBackForwardList *webBackForwardList)
+BackForwardListImpl* core(WebBackForwardList *webBackForwardList)
 {
     if (!webBackForwardList)
         return 0;
 
-    return reinterpret_cast<BackForwardList*>(webBackForwardList->_private);
+    return reinterpret_cast<BackForwardListImpl*>(webBackForwardList->_private);
 }
 
-WebBackForwardList *kit(BackForwardList* backForwardList)
+WebBackForwardList *kit(BackForwardListImpl* backForwardList)
 {
     if (!backForwardList)
         return nil;
@@ -82,7 +84,7 @@ WebBackForwardList *kit(BackForwardList* backForwardList)
     return [[[WebBackForwardList alloc] initWithBackForwardList:backForwardList] autorelease];
 }
 
-- (id)initWithBackForwardList:(PassRefPtr<BackForwardList>)backForwardList
+- (id)initWithBackForwardList:(PassRefPtr<BackForwardListImpl>)backForwardList
 {   
     WebCoreThreadViolationCheckRoundOne();
     self = [super init];
@@ -117,7 +119,7 @@ WebBackForwardList *kit(BackForwardList* backForwardList)
     if (WebCoreObjCScheduleDeallocateOnMainThread([WebBackForwardList class], self))
         return;
 
-    BackForwardList* backForwardList = core(self);
+    BackForwardListImpl* backForwardList = core(self);
     ASSERT(backForwardList);
     if (backForwardList) {
         ASSERT(backForwardList->closed());
@@ -131,7 +133,7 @@ WebBackForwardList *kit(BackForwardList* backForwardList)
 - (void)finalize
 {
     WebCoreThreadViolationCheckRoundOne();
-    BackForwardList* backForwardList = core(self);
+    BackForwardListImpl* backForwardList = core(self);
     ASSERT(backForwardList);
     if (backForwardList) {
         ASSERT(backForwardList->closed());
@@ -265,7 +267,7 @@ static bool bumperCarBackForwardHackNeeded()
     [result appendString:@"\n--------------------------------------------\n"];    
     [result appendString:@"WebBackForwardList:\n"];
     
-    BackForwardList* backForwardList = core(self);
+    BackForwardListImpl* backForwardList = core(self);
     HistoryItemVector& entries = backForwardList->entries();
     
     unsigned size = entries.size();
@@ -293,14 +295,12 @@ static bool bumperCarBackForwardHackNeeded()
 
 - (void)setPageCacheSize:(NSUInteger)size
 {
-    ASSERT(core(self)->isBackForwardListImpl());
-    [kit(static_cast<BackForwardListImpl*>(core(self))->page()) setUsesPageCache:size != 0];
+    [kit(core(self)->page()) setUsesPageCache:size != 0];
 }
 
 - (NSUInteger)pageCacheSize
 {
-    ASSERT(core(self)->isBackForwardListImpl());
-    return [kit(static_cast<BackForwardListImpl*>(core(self))->page()) usesPageCache] ? pageCache()->capacity() : 0;
+    return [kit(core(self)->page()) usesPageCache] ? pageCache()->capacity() : 0;
 }
 
 - (int)backListCount
diff --git a/WebKit/mac/History/WebBackForwardListInternal.h b/WebKit/mac/History/WebBackForwardListInternal.h
index 3448647..1afb833 100644
--- a/WebKit/mac/History/WebBackForwardListInternal.h
+++ b/WebKit/mac/History/WebBackForwardListInternal.h
@@ -30,12 +30,12 @@
 #import <wtf/PassRefPtr.h>
 
 namespace WebCore {
-    class BackForwardList;
+    class BackForwardListImpl;
 }
 
-WebCore::BackForwardList* core(WebBackForwardList *);
-WebBackForwardList *kit(WebCore::BackForwardList*);
+WebCore::BackForwardListImpl* core(WebBackForwardList *);
+WebBackForwardList *kit(WebCore::BackForwardListImpl*);
 
 @interface WebBackForwardList (WebBackForwardListInternal)
-- (id)initWithBackForwardList:(PassRefPtr<WebCore::BackForwardList>)backForwardList;
+- (id)initWithBackForwardList:(PassRefPtr<WebCore::BackForwardListImpl>)backForwardList;
 @end
diff --git a/WebKit/mac/Misc/WebDownload.mm b/WebKit/mac/Misc/WebDownload.mm
index 82c1259..a4d919a 100644
--- a/WebKit/mac/Misc/WebDownload.mm
+++ b/WebKit/mac/Misc/WebDownload.mm
@@ -219,7 +219,7 @@ using namespace WebCore;
     [super dealloc];
 }
 
-- (id)initWithRequest:(NSURLRequest *)request delegate:(id)delegate
+- (id)initWithRequest:(NSURLRequest *)request delegate:(id<NSURLDownloadDelegate>)delegate
 {
     [self _setRealDelegate:delegate];
     return [super initWithRequest:request delegate:_webInternal];
diff --git a/WebKit/mac/Misc/WebElementDictionary.mm b/WebKit/mac/Misc/WebElementDictionary.mm
index 6b2eb3d..71c4cc7 100644
--- a/WebKit/mac/Misc/WebElementDictionary.mm
+++ b/WebKit/mac/Misc/WebElementDictionary.mm
@@ -85,6 +85,7 @@ static void cacheValueForKey(const void *key, const void *value, void *self)
     addLookupKey(WebElementImageRectKey, @selector(_imageRect));
     addLookupKey(WebElementImageURLKey, @selector(_absoluteImageURL));
     addLookupKey(WebElementIsSelectedKey, @selector(_isSelected));
+    addLookupKey(WebElementMediaURLKey, @selector(_absoluteMediaURL));
     addLookupKey(WebElementSpellingToolTipKey, @selector(_spellingToolTip));
     addLookupKey(WebElementTitleKey, @selector(_title));
     addLookupKey(WebElementLinkURLKey, @selector(_absoluteLinkURL));
@@ -216,6 +217,11 @@ static NSString* NSStringOrNil(String coreString)
     return _result->absoluteImageURL();
 }
 
+- (NSURL *)_absoluteMediaURL
+{
+    return _result->absoluteMediaURL();
+}
+
 - (NSNumber *)_isSelected
 {
     return [NSNumber numberWithBool:_result->isSelected()];
diff --git a/WebKit/mac/Misc/WebKitVersionChecks.h b/WebKit/mac/Misc/WebKitVersionChecks.h
index 4bf2c83..9d59665 100644
--- a/WebKit/mac/Misc/WebKitVersionChecks.h
+++ b/WebKit/mac/Misc/WebKitVersionChecks.h
@@ -55,6 +55,7 @@
 #define WEBKIT_FIRST_VERSION_WITHOUT_CONTENT_SNIFFING_FOR_FILE_URLS 0x02120A00 // 530.10.0
 #define WEBKIT_FIRST_VERSION_WITHOUT_LINK_ELEMENT_TEXT_CSS_QUIRK 0x02130200 // 531.2.0
 #define WEBKIT_FIRST_VERSION_WITH_HTML5_PARSER 0x02160900 // 534.9.0
+#define WEBKIT_FIRST_VERSION_WITH_GET_MATCHED_CSS_RULES_RESTRICTIONS 0x02160B00 // 534.11.0
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
index 2645c55..4e59456 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
@@ -53,12 +53,12 @@ public:
     void didCreateWindow();
     
 private:
-    NetscapePluginHostProxy* hostForPlugin(const WTF::String& pluginPath, cpu_type_t pluginArchitecture, const WTF::String& bundleIdentifier, bool useProxiedOpenPanel);
+    NetscapePluginHostProxy* hostForPlugin(const WTF::String& pluginPath, cpu_type_t pluginArchitecture, const WTF::String& bundleIdentifier);
 
     NetscapePluginHostManager();
     ~NetscapePluginHostManager();
     
-    bool spawnPluginHost(const WTF::String& pluginPath, cpu_type_t pluginArchitecture, mach_port_t clientPort, mach_port_t& pluginHostPort, ProcessSerialNumber& pluginHostPSN, bool useProxiedOpenPanel);
+    bool spawnPluginHost(const WTF::String& pluginPath, cpu_type_t pluginArchitecture, mach_port_t clientPort, mach_port_t& pluginHostPort, ProcessSerialNumber& pluginHostPSN);
     
     bool initializeVendorPort();
     
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
index 322e0e8..d8cd081 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
@@ -31,10 +31,7 @@
 #import "NetscapePluginInstanceProxy.h"
 #import "WebLocalizableStrings.h"
 #import "WebKitSystemInterface.h"
-#import "WebHostedNetscapePluginView.h"
 #import "WebNetscapePluginPackage.h"
-#import "WebPreferencesPrivate.h"
-#import "WebView.h"
 #import <mach/mach_port.h>
 #import <servers/bootstrap.h>
 #import <spawn.h>
@@ -70,7 +67,7 @@ NetscapePluginHostManager::~NetscapePluginHostManager()
 {
 }
 
-NetscapePluginHostProxy* NetscapePluginHostManager::hostForPlugin(const WTF::String& pluginPath, cpu_type_t pluginArchitecture, const String& bundleIdentifier, bool useProxiedOpenPanel)
+NetscapePluginHostProxy* NetscapePluginHostManager::hostForPlugin(const WTF::String& pluginPath, cpu_type_t pluginArchitecture, const String& bundleIdentifier)
 {
     pair<PluginHostMap::iterator, bool> result = m_pluginHosts.add(pluginPath, 0);
     
@@ -86,7 +83,7 @@ NetscapePluginHostProxy* NetscapePluginHostManager::hostForPlugin(const WTF::Str
     
     mach_port_t pluginHostPort;
     ProcessSerialNumber pluginHostPSN;
-    if (!spawnPluginHost(pluginPath, pluginArchitecture, clientPort, pluginHostPort, pluginHostPSN, useProxiedOpenPanel)) {
+    if (!spawnPluginHost(pluginPath, pluginArchitecture, clientPort, pluginHostPort, pluginHostPSN)) {
         mach_port_destroy(mach_task_self(), clientPort);
         m_pluginHosts.remove(result.first);
         return 0;
@@ -103,7 +100,7 @@ NetscapePluginHostProxy* NetscapePluginHostManager::hostForPlugin(const WTF::Str
     return hostProxy;
 }
 
-bool NetscapePluginHostManager::spawnPluginHost(const String& pluginPath, cpu_type_t pluginArchitecture, mach_port_t clientPort, mach_port_t& pluginHostPort, ProcessSerialNumber& pluginHostPSN, bool useProxiedOpenPanel)
+bool NetscapePluginHostManager::spawnPluginHost(const String& pluginPath, cpu_type_t pluginArchitecture, mach_port_t clientPort, mach_port_t& pluginHostPort, ProcessSerialNumber& pluginHostPSN)
 {
     if (m_pluginVendorPort == MACH_PORT_NULL) {
         if (!initializeVendorPort())
@@ -123,7 +120,6 @@ bool NetscapePluginHostManager::spawnPluginHost(const String& pluginPath, cpu_ty
                                       pluginHostAppExecutablePath, @"pluginHostPath",
                                       [NSNumber numberWithInt:pluginArchitecture], @"cpuType",
                                       localization.get(), @"localization",
-                                      [NSNumber numberWithBool:useProxiedOpenPanel], @"useProxiedOpenPanel",
                                       nil];
 
     NSData *data = [NSPropertyListSerialization dataFromPropertyList:launchProperties format:NSPropertyListBinaryFormat_v1_0 errorDescription:0];
@@ -217,8 +213,7 @@ void NetscapePluginHostManager::pluginHostDied(NetscapePluginHostProxy* pluginHo
 
 PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePlugin(const String& pluginPath, cpu_type_t pluginArchitecture, const String& bundleIdentifier, WebHostedNetscapePluginView *pluginView, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame, bool isPrivateBrowsingEnabled, bool isAcceleratedCompositingEnabled)
 {
-    WebPreferences *preferences = [[pluginView webView] preferences];
-    NetscapePluginHostProxy* hostProxy = hostForPlugin(pluginPath, pluginArchitecture, bundleIdentifier, [preferences usesProxiedOpenPanel]);
+    NetscapePluginHostProxy* hostProxy = hostForPlugin(pluginPath, pluginArchitecture, bundleIdentifier);
     if (!hostProxy)
         return 0;
 
@@ -257,7 +252,7 @@ PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePl
         pluginHostDied(hostProxy);
 
         // Try to spawn it again.
-        hostProxy = hostForPlugin(pluginPath, pluginArchitecture, bundleIdentifier, [preferences usesProxiedOpenPanel]);
+        hostProxy = hostForPlugin(pluginPath, pluginArchitecture, bundleIdentifier);
         
         // Create a new instance.
         instance = NetscapePluginInstanceProxy::create(hostProxy, pluginView, fullFrame);
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
index 207f062..067b8bb 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
@@ -1120,61 +1120,6 @@ kern_return_t WKPCResolveURL(mach_port_t clientPort, uint32_t pluginID, data_t u
     return KERN_SUCCESS;
 }
 
-#if !defined(BUILDING_ON_SNOW_LEOPARD)
-kern_return_t WKPCRunSyncOpenPanel(mach_port_t clientPort, data_t panelData, mach_msg_type_number_t panelDataLength)
-{
-    DataDeallocator panelDataDeallocator(panelData, panelDataLength);
-
-    NetscapePluginHostProxy* hostProxy = pluginProxyMap().get(clientPort);
-    if (!hostProxy)
-        return KERN_FAILURE;
-
-    NSOpenPanel *sheet = [NSOpenPanel openPanel];
-    NSDictionary *panelState = [NSPropertyListSerialization propertyListFromData:[NSData dataWithBytes:panelData length:panelDataLength]
-                                                                mutabilityOption:NSPropertyListImmutable
-                                                                          format:NULL
-                                                                errorDescription:nil];
-    
-    [sheet setCanChooseFiles:[[panelState objectForKey:@"canChooseFiles"] boolValue]];
-    [sheet setCanChooseDirectories:[[panelState objectForKey:@"canChooseDirectories"] boolValue]];
-    [sheet setResolvesAliases:[[panelState objectForKey:@"resolvesAliases"] boolValue]];
-    [sheet setAllowsMultipleSelection:[[panelState objectForKey:@"allowsMultipleSelection"] boolValue]];
-    [sheet setCanCreateDirectories:[[panelState objectForKey:@"canCreateDirectories"] boolValue]];
-    [sheet setShowsHiddenFiles:[[panelState objectForKey:@"showsHiddenFiles"] boolValue]];
-    [sheet setExtensionHidden:[[panelState objectForKey:@"isExtensionHidden"] boolValue]];
-    [sheet setCanSelectHiddenExtension:[[panelState objectForKey:@"canSelectHiddenExtension"] boolValue]];
-    [sheet setAllowsOtherFileTypes:[[panelState objectForKey:@"allowsOtherFileTypes"] boolValue]];
-    [sheet setTreatsFilePackagesAsDirectories:[[panelState objectForKey:@"treatsFilePackagesAsDirectories"] boolValue]];
-    [sheet setPrompt:[panelState objectForKey:@"prompt"]];
-    [sheet setNameFieldLabel:[panelState objectForKey:@"nameFieldLabel"]];
-    [sheet setMessage:[panelState objectForKey:@"message"]];
-    [sheet setAllowedFileTypes:[panelState objectForKey:@"allowedFileTypes"]];
-    [sheet setRequiredFileType:[panelState objectForKey:@"requiredFileType"]];    
-    [sheet setTitle:[panelState objectForKey:@"title"]];
-    [sheet runModal];
-
-    NetscapePluginHostProxy* newHostProxy = pluginProxyMap().get(clientPort);
-    if (newHostProxy != hostProxy)
-        return KERN_FAILURE;
-
-    NSDictionary *ret = [NSDictionary dictionaryWithObjectsAndKeys:
-                         [sheet filenames], @"filenames",
-                         WKNoteOpenPanelFiles([sheet filenames]), @"extensions",
-                         nil];
-    
-    RetainPtr<NSData*> data = [NSPropertyListSerialization dataFromPropertyList:ret format:NSPropertyListBinaryFormat_v1_0 errorDescription:0];
-    ASSERT(data);
-
-    _WKPHSyncOpenPanelReply(hostProxy->port(), const_cast<char *>(static_cast<const char*>([data.get() bytes])), [data.get() length]);
-    return KERN_SUCCESS;
-}
-#else
-kern_return_t WKPCRunSyncOpenPanel(mach_port_t clientPort, data_t panelData, mach_msg_type_number_t panelDataLength)
-{
-    return KERN_FAILURE;
-}
-#endif // !defined(BUILDING_ON_SNOW_LEOPARD)
-
 kern_return_t WKPCSetException(mach_port_t clientPort, data_t message, mach_msg_type_number_t messageCnt)
 {
     DataDeallocator deallocator(message, messageCnt);
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index 0b9036a..a2d4a96 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -872,9 +872,9 @@ bool NetscapePluginInstanceProxy::evaluate(uint32_t objectID, const String& scri
     bool oldAllowPopups = frame->script()->allowPopupsFromPlugin();
     frame->script()->setAllowPopupsFromPlugin(allowPopups);
     
-    globalObject->globalData()->timeoutChecker.start();
+    globalObject->globalData().timeoutChecker.start();
     Completion completion = JSC::evaluate(exec, globalObject->globalScopeChain(), makeSource(script));
-    globalObject->globalData()->timeoutChecker.stop();
+    globalObject->globalData().timeoutChecker.stop();
     ComplType type = completion.complType();
 
     frame->script()->setAllowPopupsFromPlugin(oldAllowPopups);
@@ -921,9 +921,9 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
     ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
-    globalObject->globalData()->timeoutChecker.start();
+    globalObject->globalData().timeoutChecker.start();
     JSValue value = call(exec, function, callType, callData, object, argList);
-    globalObject->globalData()->timeoutChecker.stop();
+    globalObject->globalData().timeoutChecker.stop();
         
     marshalValue(exec, value, resultData, resultLength);
     exec->clearException();
@@ -956,9 +956,9 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
     ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
-    globalObject->globalData()->timeoutChecker.start();
+    globalObject->globalData().timeoutChecker.start();
     JSValue value = call(exec, object, callType, callData, object, argList);
-    globalObject->globalData()->timeoutChecker.stop();
+    globalObject->globalData().timeoutChecker.stop();
     
     marshalValue(exec, value, resultData, resultLength);
     exec->clearException();
@@ -992,9 +992,9 @@ bool NetscapePluginInstanceProxy::construct(uint32_t objectID, data_t argumentsD
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
     ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
-    globalObject->globalData()->timeoutChecker.start();
+    globalObject->globalData().timeoutChecker.start();
     JSValue value = JSC::construct(exec, object, constructType, constructData, argList);
-    globalObject->globalData()->timeoutChecker.stop();
+    globalObject->globalData().timeoutChecker.stop();
     
     marshalValue(exec, value, resultData, resultLength);
     exec->clearException();
@@ -1334,7 +1334,7 @@ bool NetscapePluginInstanceProxy::demarshalValueFromArray(ExecState* exec, NSArr
             result = jsBoolean([[array objectAtIndex:index++] boolValue]);
             return true;
         case DoubleValueType:
-            result = jsNumber(exec, [[array objectAtIndex:index++] doubleValue]);
+            result = jsNumber([[array objectAtIndex:index++] doubleValue]);
             return true;
         case StringValueType: {
             NSString *string = [array objectAtIndex:index++];
diff --git a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
index 11ade8c..927a008 100644
--- a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
+++ b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
@@ -273,10 +273,10 @@ JSValue ProxyInstance::stringValue(ExecState* exec) const
     return jsEmptyString(exec);
 }
 
-JSValue ProxyInstance::numberValue(ExecState* exec) const
+JSValue ProxyInstance::numberValue(ExecState*) const
 {
     // FIXME: Implement something sensible.
-    return jsNumber(exec, 0);
+    return jsNumber(0);
 }
 
 JSValue ProxyInstance::booleanValue() const
diff --git a/WebKit/mac/Plugins/Hosted/WebKitPluginClient.defs b/WebKit/mac/Plugins/Hosted/WebKitPluginClient.defs
index 4129ca1..15fc5fa 100644
--- a/WebKit/mac/Plugins/Hosted/WebKitPluginClient.defs
+++ b/WebKit/mac/Plugins/Hosted/WebKitPluginClient.defs
@@ -231,9 +231,6 @@ simpleroutine PCBooleanAndDataReply(clientPort :mach_port_t;
                                     returnValue :boolean_t;
                                     result :data_t);  
 
-simpleroutine PCRunSyncOpenPanel(clientPort :mach_port_t;
-                                 panelData :data_t);
-
 simpleroutine PCSetFullscreenWindowIsShowing(clientPort :mach_port_t;
                                              isShowing :boolean_t);
 
diff --git a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
index 5d9df45..fa808ac 100644
--- a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
+++ b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
@@ -240,9 +240,6 @@ simpleroutine PHPluginInstancePrivateBrowsingModeDidChange(pluginHostPort :mach_
                                                            pluginID :uint32_t;
                                                            privateBrowsingEnabled :boolean_t);
 
-simpleroutine PHSyncOpenPanelReply(pluginHostPort :mach_port_t;
-                                   filenames :data_t);
-
 simpleroutine PHPluginInstanceSnapshot(pluginHostPort :mach_port_t;
                                     pluginID :uint32_t;
                                     requestID :uint32_t;
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.h b/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 5f3b727..209c2b9 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -55,7 +55,7 @@ public:
 
     virtual void focusedNodeChanged(WebCore::Node*);
 
-    virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
+    virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&);
     virtual void show();
 
     virtual bool canRunModal();
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index 68e17be..3610896 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -60,6 +60,7 @@
 #import <WebCore/HitTestResult.h>
 #import <WebCore/Icon.h>
 #import <WebCore/IntRect.h>
+#import <WebCore/NavigationAction.h>
 #import <WebCore/Page.h>
 #import <WebCore/PlatformScreen.h>
 #import <WebCore/PlatformString.h>
@@ -199,7 +200,7 @@ void WebChromeClient::focusedNodeChanged(Node*)
 {
 }
 
-Page* WebChromeClient::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features)
+Page* WebChromeClient::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features, const NavigationAction&)
 {
     NSURLRequest *URLRequest = nil;
     if (!request.isEmpty())
@@ -640,9 +641,7 @@ FloatRect WebChromeClient::customHighlightRect(Node* node, const AtomicString& t
 
     WebHTMLView *webHTMLView = (WebHTMLView *)documentView;
     id<WebHTMLHighlighter> highlighter = [webHTMLView _highlighterForType:type];
-    if ([(NSObject *)highlighter respondsToSelector:@selector(highlightRectForLine:representedNode:)])
-        return [highlighter highlightRectForLine:lineRect representedNode:kit(node)];
-    return [highlighter highlightRectForLine:lineRect];
+    return [highlighter highlightRectForLine:lineRect representedNode:kit(node)];
 
     END_BLOCK_OBJC_EXCEPTIONS;
 
@@ -660,10 +659,7 @@ void WebChromeClient::paintCustomHighlight(Node* node, const AtomicString& type,
 
     WebHTMLView *webHTMLView = (WebHTMLView *)documentView;
     id<WebHTMLHighlighter> highlighter = [webHTMLView _highlighterForType:type];
-    if ([(NSObject *)highlighter respondsToSelector:@selector(paintHighlightForBox:onLine:behindText:entireLine:representedNode:)])
-        [highlighter paintHighlightForBox:boxRect onLine:lineRect behindText:behindText entireLine:entireLine representedNode:kit(node)];
-    else
-        [highlighter paintHighlightForBox:boxRect onLine:lineRect behindText:behindText entireLine:entireLine];
+    [highlighter paintHighlightForBox:boxRect onLine:lineRect behindText:behindText entireLine:entireLine representedNode:kit(node)];
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index 0baa55c..2b3b2cc 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -111,7 +111,7 @@ private:
     virtual void dispatchDidFirstLayout();
     virtual void dispatchDidFirstVisuallyNonEmptyLayout();
 
-    virtual WebCore::Frame* dispatchCreatePage();
+    virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
 
     virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction,
@@ -175,6 +175,8 @@ private:
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedForNewPage();
 
+    virtual void dispatchDidBecomeFrameset(bool);
+
     virtual bool canHandleRequest(const WebCore::ResourceRequest&) const;
     virtual bool canShowMIMEType(const WTF::String& MIMEType) const;
     virtual bool canShowMIMETypeAsHTML(const WTF::String& MIMEType) const;
@@ -194,6 +196,7 @@ private:
     virtual PassRefPtr<WebCore::Frame> createFrame(const WebCore::KURL& url, const WTF::String& name, WebCore::HTMLFrameOwnerElement*,
                                         const WTF::String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
     virtual void didTransferChildFrameToNewDocument(WebCore::Page* oldPage);
+    virtual void transferLoadingResourceFromPage(unsigned long identifier, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page* oldPage);
     virtual PassRefPtr<WebCore::Widget> createPlugin(const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&, const Vector<WTF::String>&,
                                           const Vector<WTF::String>&, const WTF::String&, bool);
     virtual void redirectDataToPlugin(WebCore::Widget* pluginWidget);
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index c3fd457..3053b49 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -697,7 +697,7 @@ void WebFrameLoaderClient::dispatchDidFirstVisuallyNonEmptyLayout()
         CallFrameLoadDelegate(implementations->didFirstVisuallyNonEmptyLayoutInFrameFunc, webView, @selector(webView:didFirstVisuallyNonEmptyLayoutInFrame:), m_webFrame.get());
 }
 
-Frame* WebFrameLoaderClient::dispatchCreatePage()
+Frame* WebFrameLoaderClient::dispatchCreatePage(const NavigationAction&)
 {
     WebView *currentWebView = getWebView(m_webFrame.get());
     NSDictionary *features = [[NSDictionary alloc] init];
@@ -1253,6 +1253,10 @@ void WebFrameLoaderClient::transitionToCommittedForNewPage()
     }
 }
 
+void WebFrameLoaderClient::dispatchDidBecomeFrameset(bool)
+{
+}
+
 RetainPtr<WebFramePolicyListener> WebFrameLoaderClient::setUpPolicyListener(FramePolicyFunction function)
 {
     // FIXME: <rdar://5634381> We need to support multiple active policy listeners.
@@ -1385,11 +1389,16 @@ PassRefPtr<Frame> WebFrameLoaderClient::createFrame(const KURL& url, const Strin
 
 void WebFrameLoaderClient::didTransferChildFrameToNewDocument(Page* oldPage)
 {
-    if (oldPage == core(m_webFrame.get())->page())
-        return;
+}
+
+void WebFrameLoaderClient::transferLoadingResourceFromPage(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request, Page* oldPage)
+{
+    ASSERT(oldPage != core(m_webFrame.get())->page());
+    ASSERT(![getWebView(m_webFrame.get()) _objectForIdentifier:identifier]);
+
+    assignIdentifierToInitialRequest(identifier, loader, request);
 
-    // Update resource tracking now that frame is in a different page.
-    // TODO(jennb): update resource tracking [bug 44713]
+    [kit(oldPage) _removeObjectForIdentifier:identifier];
 }
 
 ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const String& mimeType)
@@ -1629,7 +1638,7 @@ PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize& size, HTMLP
     }
     
     NSString *extension = [[pluginURL path] pathExtension];
-    if (!pluginPackage && [extension length] != 0) {
+    if (!pluginPackage && [extension length] && ![MIMEType length]) {
         pluginPackage = [webView _pluginForExtension:extension];
         if (pluginPackage) {
             NSString *newMIMEType = [pluginPackage MIMETypeForExtension:extension];
diff --git a/WebKit/mac/WebCoreSupport/WebSystemInterface.mm b/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
index 03cb33f..df3ea4d 100644
--- a/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
+++ b/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
@@ -73,6 +73,7 @@ void InitWebCoreSystemInterface(void)
     INIT(SetCGFontRenderingMode);
     INIT(SetCONNECTProxyAuthorizationForStream);
     INIT(SetCONNECTProxyForStream);
+    INIT(SetCookieStoragePrivateBrowsingEnabled);
     INIT(SetDragImage);
     INIT(SetNSURLConnectionDefersCallbacks);
     INIT(SetNSURLRequestShouldContentSniff);
@@ -113,10 +114,6 @@ void InitWebCoreSystemInterface(void)
     INIT(SupportsMultipartXMixedReplace);
 #endif
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    INIT(NoteOpenPanelFiles);
-#endif
-
 #if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
     INIT(GetHyphenationLocationBeforeIndex);
 #endif
diff --git a/WebKit/mac/WebKit.exp b/WebKit/mac/WebKit.exp
index 463ab00..7c20307 100644
--- a/WebKit/mac/WebKit.exp
+++ b/WebKit/mac/WebKit.exp
@@ -65,6 +65,7 @@ _WebElementImageKey
 _WebElementImageRectKey
 _WebElementImageURLKey
 _WebElementIsSelectedKey
+_WebElementMediaURLKey
 _WebElementLinkIsLiveKey
 _WebElementLinkLabelKey
 _WebElementLinkTargetFrameKey
diff --git a/WebKit/mac/WebView/WebFrameView.mm b/WebKit/mac/WebView/WebFrameView.mm
index e76e3ca..0db12c0 100644
--- a/WebKit/mac/WebView/WebFrameView.mm
+++ b/WebKit/mac/WebView/WebFrameView.mm
@@ -55,7 +55,7 @@
 #import "WebViewInternal.h"
 #import "WebViewPrivate.h"
 #import <Foundation/NSURLRequest.h>
-#import <WebCore/BackForwardList.h>
+#import <WebCore/BackForwardListImpl.h>
 #import <WebCore/DragController.h>
 #import <WebCore/EventHandler.h>
 #import <WebCore/Frame.h>
@@ -708,7 +708,7 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
     int index, count;
     BOOL callSuper = YES;
     Frame* coreFrame = [self _web_frame];
-    BOOL maintainsBackForwardList = coreFrame && coreFrame->page()->backForwardList()->enabled() ? YES : NO;
+    BOOL maintainsBackForwardList = coreFrame && static_cast<BackForwardListImpl*>(coreFrame->page()->backForwardList())->enabled() ? YES : NO;
     
     count = [characters length];
     for (index = 0; index < count; ++index) {
diff --git a/WebKit/mac/WebView/WebHTMLViewPrivate.h b/WebKit/mac/WebView/WebHTMLViewPrivate.h
index 1218efc..c62713f 100644
--- a/WebKit/mac/WebView/WebHTMLViewPrivate.h
+++ b/WebKit/mac/WebView/WebHTMLViewPrivate.h
@@ -46,10 +46,6 @@
 @protocol WebHTMLHighlighter
 - (NSRect)highlightRectForLine:(NSRect)lineRect representedNode:(DOMNode *)node;
 - (void)paintHighlightForBox:(NSRect)boxRect onLine:(NSRect)lineRect behindText:(BOOL)text entireLine:(BOOL)line representedNode:(DOMNode *)node;
-
-// the following methods are deprecated and will be removed once Mail switches to the new methods <rdar://problem/5050528>
-- (NSRect)highlightRectForLine:(NSRect)lineRect;
-- (void)paintHighlightForBox:(NSRect)boxRect onLine:(NSRect)lineRect behindText:(BOOL)text entireLine:(BOOL)line;
 @end
 
 extern const float _WebHTMLViewPrintingMinimumShrinkFactor;
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index cd9ed8f..5c6b530 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -93,7 +93,6 @@
 #define WebKitShowRepaintCounterPreferenceKey @"WebKitShowRepaintCounter"
 #define WebKitWebGLEnabledPreferenceKey @"WebKitWebGLEnabled"
 #define WebKitAccelerated2dCanvasEnabledPreferenceKey @"WebKitAccelerated2dCanvasEnabled"
-#define WebKitUsesProxiedOpenPanelPreferenceKey @"WebKitUsesProxiedOpenPanel"
 #define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 #define WebKitFrameFlatteningEnabledPreferenceKey @"WebKitFrameFlatteningEnabled"
 #define WebKitSpatialNavigationEnabledPreferenceKey @"WebKitSpatialNavigationEnabled"
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index ccfb632..ed06188 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -362,7 +362,6 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:NO],   WebKitShowRepaintCounterPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitAccelerated2dCanvasEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitUsesProxiedOpenPanelPreferenceKey,
         [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitFrameFlatteningEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitSpatialNavigationEnabledPreferenceKey,
@@ -1284,16 +1283,6 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitAccelerated2dCanvasEnabledPreferenceKey];
 }
 
-- (BOOL)usesProxiedOpenPanel
-{
-    return [self _boolValueForKey:WebKitUsesProxiedOpenPanelPreferenceKey];
-}
-
-- (void)setUsesProxiedOpenPanel:(BOOL)enabled
-{
-    [self _setBoolValue:enabled forKey:WebKitUsesProxiedOpenPanelPreferenceKey];
-}
-
 - (unsigned)pluginAllowedRunTime
 {
     return [self _integerValueForKey:WebKitPluginAllowedRunTimePreferenceKey];
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index 47e6d71..2ec08e8 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -193,9 +193,6 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)paginateDuringLayoutEnabled;
 - (void)setPaginateDuringLayoutEnabled:(BOOL)flag;
 
-- (BOOL)usesProxiedOpenPanel;
-- (void)setUsesProxiedOpenPanel:(BOOL)enabled;
-
 - (BOOL)memoryInfoEnabled;
 - (void)setMemoryInfoEnabled:(BOOL)enabled;
 
diff --git a/WebKit/mac/WebView/WebScriptDebugDelegate.mm b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
index 9ffd36e..63a91a9 100644
--- a/WebKit/mac/WebView/WebScriptDebugDelegate.mm
+++ b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
@@ -236,7 +236,7 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     // WebScriptCallFrame. Instead, we need to set the dynamic global object
     // and evaluate the JS in the global object's global call frame.
     JSGlobalObject* globalObject = _private->debugger->globalObject();
-    if (self == _private->debugger->globalCallFrame() && !globalObject->globalData()->dynamicGlobalObject) {
+    if (self == _private->debugger->globalCallFrame() && !globalObject->globalData().dynamicGlobalObject) {
         JSGlobalObject* globalObject = _private->debugger->globalObject();
 
         DynamicGlobalObjectScope globalObjectScope(globalObject->globalExec(), globalObject);
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.mm b/WebKit/mac/WebView/WebVideoFullscreenController.mm
index 1efb93f..2687b14 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.mm
@@ -246,7 +246,6 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
     [window setOpaque:YES];
     [window setBackgroundColor:[NSColor blackColor]];
     [window setLevel:level];
-    [window setHidesOnDeactivate:YES];
     [window setReleasedWhenClosed:NO];
     return window;
 }
@@ -414,11 +413,11 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
     if (rate && !_isEndingFullscreen) {
         [self _disableIdleSystemSleep];
         [self _disableIdleDisplaySleep];
-        [self _disableTickleTimer];
+        [self _enableTickleTimer];
     } else {
         [self _enableIdleSystemSleep];
         [self _enableIdleDisplaySleep];
-        [self _enableTickleTimer];
+        [self _disableTickleTimer];
     }
 #endif
 }
@@ -475,7 +474,6 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
         return nil;
     [self setOpaque:NO];
     [self setBackgroundColor:[NSColor clearColor]];
-    [self setHidesOnDeactivate:YES];
     [self setIgnoresMouseEvents:NO];
     [self setAcceptsMouseMovedEvents:YES];
     return self;
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
index 1aa501e..6907311 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
@@ -91,7 +91,6 @@ static inline CGFloat webkit_CGFloor(CGFloat value)
     [self setAcceptsMouseMovedEvents:YES];
     [self setIgnoresMouseEvents:NO];
     [self setMovableByWindowBackground:YES];
-    [self setHidesOnDeactivate:YES];
 
     return self;
 }
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 9b267ef..7456898 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -110,7 +110,7 @@
 #import <JavaScriptCore/JSValueRef.h>
 #import <WebCore/AbstractDatabase.h>
 #import <WebCore/ApplicationCacheStorage.h>
-#import <WebCore/BackForwardList.h>
+#import <WebCore/BackForwardListImpl.h>
 #import <WebCore/Cache.h>
 #import <WebCore/ColorMac.h>
 #import <WebCore/CSSComputedStyleDeclaration.h>
@@ -144,6 +144,7 @@
 #import <WebCore/PageGroup.h>
 #import <WebCore/PlatformMouseEvent.h>
 #import <WebCore/ProgressTracker.h>
+#import <WebCore/RenderView.h>
 #import <WebCore/RenderWidget.h>
 #import <WebCore/ResourceHandle.h>
 #import <WebCore/RuntimeApplicationChecks.h>
@@ -403,6 +404,7 @@ NSString *WebElementLinkLabelKey =          @"WebElementLinkLabel";
 NSString *WebElementLinkTargetFrameKey =    @"WebElementTargetFrame";
 NSString *WebElementLinkTitleKey =          @"WebElementLinkTitle";
 NSString *WebElementLinkURLKey =            @"WebElementLinkURL";
+NSString *WebElementMediaURLKey =           @"WebElementMediaURL";
 NSString *WebElementSpellingToolTipKey =    @"WebElementSpellingToolTip";
 NSString *WebElementTitleKey =              @"WebElementTitle";
 NSString *WebElementLinkIsLiveKey =         @"WebElementLinkIsLive";
@@ -1397,6 +1399,12 @@ static bool fastDocumentTeardownEnabled()
         || [[self preferences] usePreHTML5ParserQuirks];
 }
 
+- (BOOL)_needsUnrestrictedGetMatchedCSSRules
+{
+    static bool needsUnrestrictedGetMatchedCSSRules = !WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_GET_MATCHED_CSS_RULES_RESTRICTIONS) && applicationIsSafari();
+    return needsUnrestrictedGetMatchedCSSRules;
+}
+
 - (void)_preferencesChangedNotification:(NSNotification *)notification
 {
     WebPreferences *preferences = (WebPreferences *)[notification object];
@@ -1495,6 +1503,7 @@ static bool fastDocumentTeardownEnabled()
     settings->setMemoryInfoEnabled([preferences memoryInfoEnabled]);
     settings->setHyperlinkAuditingEnabled([preferences hyperlinkAuditingEnabled]);
     settings->setUsePreHTML5ParserQuirks([self _needsPreHTML5ParserQuirks]);
+    settings->setCrossOriginCheckInGetMatchedCSSRulesDisabled([self _needsUnrestrictedGetMatchedCSSRules]);
 
     // Application Cache Preferences are stored on the global cache storage manager, not in Settings.
     [WebApplicationCache setDefaultOriginQuota:[preferences applicationCacheDefaultOriginQuota]];
@@ -2617,6 +2626,24 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     SchemeRegistry::registerURLSchemeAsSecure(scheme);
 }
 
+- (void)_scaleWebView:(float)scale
+{
+    Frame* coreFrame = [self _mainCoreFrame];
+    if (!coreFrame)
+        return;
+
+    coreFrame->scalePage(scale);
+}
+
+- (float)_viewScaleFactor
+{
+    Frame* coreFrame = [self _mainCoreFrame];
+    if (!coreFrame)
+        return 1;
+
+    return coreFrame->pageScaleFactor();
+}
+
 @end
 
 @implementation _WebSafeForwarder
@@ -2979,7 +3006,7 @@ static bool needsWebViewInitThreadWorkaround()
 
         LOG(Encoding, "FrameName = %@, GroupName = %@, useBackForwardList = %d\n", frameName, groupName, (int)useBackForwardList);
         [result _commonInitializationWithFrameName:frameName groupName:groupName usesDocumentViews:YES];
-        [result page]->backForwardList()->setEnabled(useBackForwardList);
+        static_cast<BackForwardListImpl*>([result page]->backForwardList())->setEnabled(useBackForwardList);
         result->_private->allowsUndo = allowsUndo;
         if (preferences)
             [result setPreferences:preferences];
@@ -3003,7 +3030,7 @@ static bool needsWebViewInitThreadWorkaround()
     // Restore the subviews we set aside.
     _subviews = originalSubviews;
 
-    BOOL useBackForwardList = _private->page && _private->page->backForwardList()->enabled();
+    BOOL useBackForwardList = _private->page && static_cast<BackForwardListImpl*>(_private->page->backForwardList())->enabled();
     if ([encoder allowsKeyedCoding]) {
         [encoder encodeObject:[[self mainFrame] name] forKey:@"FrameName"];
         [encoder encodeObject:[self groupName] forKey:@"GroupName"];
@@ -3314,16 +3341,17 @@ static bool needsWebViewInitThreadWorkaround()
 {
     if (!_private->page)
         return nil;
-    if (!_private->page->backForwardList()->enabled())
+    BackForwardListImpl* list = static_cast<BackForwardListImpl*>(_private->page->backForwardList());
+    if (!list->enabled())
         return nil;
-    return kit(_private->page->backForwardList());
+    return kit(list);
 }
 
 - (void)setMaintainsBackForwardList:(BOOL)flag
 {
     if (!_private->page)
         return;
-    _private->page->backForwardList()->setEnabled(flag);
+    static_cast<BackForwardListImpl*>(_private->page->backForwardList())->setEnabled(flag);
 }
 
 - (BOOL)goBack
@@ -5280,6 +5308,11 @@ static WebFrameView *containingFrameView(NSView *view)
 
 @implementation WebView (WebFileInternal)
 
+static inline uint64_t roundUpToPowerOf2(uint64_t num)
+{
+    return powf(2.0, ceilf(log2f(num)));
+}
+
 + (void)_setCacheModel:(WebCacheModel)cacheModel
 {
     if (s_didSetCacheModel && cacheModel == s_cacheModel)
@@ -5289,9 +5322,7 @@ static WebFrameView *containingFrameView(NSView *view)
     if (!nsurlCacheDirectory)
         nsurlCacheDirectory = NSHomeDirectory();
 
-    // As a fudge factor, use 1000 instead of 1024, in case the reported byte 
-    // count doesn't align exactly to a megabyte boundary.
-    uint64_t memSize = WebMemorySize() / 1024 / 1000;
+    static uint64_t memSize = roundUpToPowerOf2(WebMemorySize() / 1024 / 1024);
     unsigned long long diskFreeSize = WebVolumeFreeSize(nsurlCacheDirectory) / 1024 / 1000;
     NSURLCache *nsurlCache = [NSURLCache sharedURLCache];
 
@@ -5311,10 +5342,10 @@ static WebFrameView *containingFrameView(NSView *view)
         pageCacheCapacity = 0;
 
         // Object cache capacities (in bytes)
-        if (memSize >= 2048)
+        if (memSize >= 4096)
+            cacheTotalCapacity = 128 * 1024 * 1024;
+        else if (memSize >= 2048)
             cacheTotalCapacity = 96 * 1024 * 1024;
-        else if (memSize >= 1536)
-            cacheTotalCapacity = 64 * 1024 * 1024;
         else if (memSize >= 1024)
             cacheTotalCapacity = 32 * 1024 * 1024;
         else if (memSize >= 512)
@@ -5343,10 +5374,10 @@ static WebFrameView *containingFrameView(NSView *view)
             pageCacheCapacity = 0;
 
         // Object cache capacities (in bytes)
-        if (memSize >= 2048)
+        if (memSize >= 4096)
+            cacheTotalCapacity = 128 * 1024 * 1024;
+        else if (memSize >= 2048)
             cacheTotalCapacity = 96 * 1024 * 1024;
-        else if (memSize >= 1536)
-            cacheTotalCapacity = 64 * 1024 * 1024;
         else if (memSize >= 1024)
             cacheTotalCapacity = 32 * 1024 * 1024;
         else if (memSize >= 512)
@@ -5395,10 +5426,10 @@ static WebFrameView *containingFrameView(NSView *view)
         // (Testing indicates that value / MB depends heavily on content and
         // browsing pattern. Even growth above 128MB can have substantial 
         // value / MB for some content / browsing patterns.)
-        if (memSize >= 2048)
+        if (memSize >= 4096)
+            cacheTotalCapacity = 192 * 1024 * 1024;
+        else if (memSize >= 2048)
             cacheTotalCapacity = 128 * 1024 * 1024;
-        else if (memSize >= 1536)
-            cacheTotalCapacity = 96 * 1024 * 1024;
         else if (memSize >= 1024)
             cacheTotalCapacity = 64 * 1024 * 1024;
         else if (memSize >= 512)
diff --git a/WebKit/mac/WebView/WebViewData.h b/WebKit/mac/WebView/WebViewData.h
index 639c3e0..8b834ca 100644
--- a/WebKit/mac/WebView/WebViewData.h
+++ b/WebKit/mac/WebView/WebViewData.h
@@ -138,7 +138,7 @@ extern int pluginDatabaseClientCount;
 
     BOOL shouldUpdateWhileOffscreen;
     
-    // When this flag is set, we will not make any subviews underneath this WebView.  This means no WebFrameViews and no WebHTMLViews.
+    // When this flag is unset, we will not make any subviews underneath this WebView.  This means no WebFrameViews and no WebHTMLViews.
     BOOL usesDocumentViews;
 
     BOOL includesFlattenedCompositingLayersWhenDrawingToBitmap;
diff --git a/WebKit/mac/WebView/WebViewPrivate.h b/WebKit/mac/WebView/WebViewPrivate.h
index 749eeb3..b951689 100644
--- a/WebKit/mac/WebView/WebViewPrivate.h
+++ b/WebKit/mac/WebView/WebViewPrivate.h
@@ -67,6 +67,7 @@ extern NSString *_WebMainFrameDocumentKey;
 extern NSString *WebElementTitleKey;             // NSString of the title of the element (used by Safari)
 extern NSString *WebElementSpellingToolTipKey;   // NSString of a tooltip representing misspelling or bad grammar (used internally)
 extern NSString *WebElementIsContentEditableKey; // NSNumber indicating whether the inner non-shared node is content editable (used internally)
+extern NSString *WebElementMediaURLKey;          // NSURL of the media element
 
 // other WebElementDictionary keys
 extern NSString *WebElementLinkIsLiveKey;        // NSNumber of BOOL indictating whether the link is live or not
@@ -541,6 +542,9 @@ Could be worth adding to the API.
 + (void)_setDomainRelaxationForbidden:(BOOL)forbidden forURLScheme:(NSString *)scheme;
 + (void)_registerURLSchemeAsSecure:(NSString *)scheme;
 
+- (void)_scaleWebView:(float)scale;
+- (float)_viewScaleFactor;
+
 @end
 
 @interface WebView (WebViewPrintingPrivate)
diff --git a/WebKit/qt/Api/qwebelement.cpp b/WebKit/qt/Api/qwebelement.cpp
index 261631c..68fa17a 100644
--- a/WebKit/qt/Api/qwebelement.cpp
+++ b/WebKit/qt/Api/qwebelement.cpp
@@ -26,6 +26,7 @@
 #include "CSSRule.h"
 #include "CSSRuleList.h"
 #include "CSSStyleRule.h"
+#include "CSSStyleSelector.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "FrameView.h"
@@ -852,8 +853,8 @@ QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy str
         // by importance and inheritance order. This include external CSS
         // declarations, as well as embedded and inline style declarations.
 
-        DOMWindow* domWindow = m_element->document()->frame()->domWindow();
-        if (RefPtr<CSSRuleList> rules = domWindow->getMatchedCSSRules(m_element, "")) {
+        Document* doc = m_element->document();
+        if (RefPtr<CSSRuleList> rules = doc->styleSelector()->styleRulesForElement(m_element, /*authorOnly*/ true)) {
             for (int i = rules->length(); i > 0; --i) {
                 CSSStyleRule* rule = static_cast<CSSStyleRule*>(rules->item(i - 1));
 
diff --git a/WebKit/qt/Api/qwebframe.h b/WebKit/qt/Api/qwebframe.h
index e78fb07..a598a56 100644
--- a/WebKit/qt/Api/qwebframe.h
+++ b/WebKit/qt/Api/qwebframe.h
@@ -56,6 +56,7 @@ namespace WebCore {
     class WidgetPrivate;
     class FrameLoaderClientQt;
     class ChromeClientQt;
+    class PlatformLayerProxyQt;
 }
 class QWebFrameData;
 class QWebHitTestResultPrivate;
@@ -231,6 +232,7 @@ private:
     friend class WebCore::WidgetPrivate;
     friend class WebCore::FrameLoaderClientQt;
     friend class WebCore::ChromeClientQt;
+    friend class WebCore::PlatformLayerProxyQt;
     QWebFramePrivate *d;
 };
 
diff --git a/WebKit/qt/Api/qwebframe_p.h b/WebKit/qt/Api/qwebframe_p.h
index 79187ab..5660bd1 100644
--- a/WebKit/qt/Api/qwebframe_p.h
+++ b/WebKit/qt/Api/qwebframe_p.h
@@ -38,6 +38,7 @@ namespace WebCore {
     class FrameView;
     class HTMLFrameOwnerElement;
     class Scrollbar;
+    class TextureMapperContentLayer;
 }
 class QWebPage;
 
@@ -72,6 +73,9 @@ public:
         , allowsScrolling(true)
         , marginWidth(-1)
         , marginHeight(-1)
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+        , rootGraphicsLayer(0)
+#endif
         , zoomTextOnly(false)
         {}
     void init(QWebFrame* qframe, QWebFrameData* frameData);
@@ -100,6 +104,9 @@ public:
     bool allowsScrolling;
     int marginWidth;
     int marginHeight;
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    WebCore::TextureMapperContentLayer* rootGraphicsLayer;
+#endif
     bool zoomTextOnly;
 };
 
diff --git a/WebKit/qt/Api/qwebhistory.cpp b/WebKit/qt/Api/qwebhistory.cpp
index 25d77a4..a9761de 100644
--- a/WebKit/qt/Api/qwebhistory.cpp
+++ b/WebKit/qt/Api/qwebhistory.cpp
@@ -256,8 +256,8 @@ QWebHistory::~QWebHistory()
 */
 void QWebHistory::clear()
 {
-    //shortcut to private BackForwardList
-    WebCore::BackForwardList* lst = d->lst;
+    //shortcut to private BackForwardListImpl
+    WebCore::BackForwardListImpl* lst = d->lst;
 
     //clear visited links
     WebCore::Page* page = static_cast<WebCore::BackForwardListImpl*>(lst)->page();
diff --git a/WebKit/qt/Api/qwebhistory_p.h b/WebKit/qt/Api/qwebhistory_p.h
index 1df2349..44793b9 100644
--- a/WebKit/qt/Api/qwebhistory_p.h
+++ b/WebKit/qt/Api/qwebhistory_p.h
@@ -20,7 +20,7 @@
 #ifndef QWEBHISTORY_P_H
 #define QWEBHISTORY_P_H
 
-#include "BackForwardList.h"
+#include "BackForwardListImpl.h"
 #include "HistoryItem.h"
 #include <QtCore/qglobal.h>
 #include <QtCore/qshareddata.h>
@@ -52,7 +52,7 @@ public:
 
 class QWebHistoryPrivate : public QSharedData {
 public:
-    QWebHistoryPrivate(WebCore::BackForwardList* l)
+    QWebHistoryPrivate(WebCore::BackForwardListImpl* l)
     {
         l->ref();
         lst = l;
@@ -64,7 +64,7 @@ public:
 
     QWebPagePrivate* page();
 
-    WebCore::BackForwardList* lst;
+    WebCore::BackForwardListImpl* lst;
 };
 
 
diff --git a/WebKit/qt/Api/qwebpage.cpp b/WebKit/qt/Api/qwebpage.cpp
index 454376c..40f41c5 100644
--- a/WebKit/qt/Api/qwebpage.cpp
+++ b/WebKit/qt/Api/qwebpage.cpp
@@ -33,69 +33,71 @@
 #include "qwebsettings.h"
 #include "qwebkitversion.h"
 
-#include "Chrome.h"
-#include "ContextMenuController.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "FrameLoader.h"
-#include "FrameLoaderClientQt.h"
-#include "FrameView.h"
-#include "FormState.h"
 #include "ApplicationCacheStorage.h"
+#include "BackForwardListImpl.h"
+#include "Cache.h"
+#include "Chrome.h"
 #include "ChromeClientQt.h"
 #include "ContextMenu.h"
 #include "ContextMenuClientQt.h"
+#include "ContextMenuController.h"
 #include "DeviceMotionClientQt.h"
 #include "DeviceOrientationClientQt.h"
 #include "DocumentLoader.h"
 #include "DragClientQt.h"
 #include "DragController.h"
 #include "DragData.h"
+#include "Editor.h"
 #include "EditorClientQt.h"
-#include "SchemeRegistry.h"
-#include "SecurityOrigin.h"
-#include "Settings.h"
-#include "Page.h"
-#include "Pasteboard.h"
-#include "FrameLoader.h"
+#include "FocusController.h"
+#include "FormState.h"
+#include "Frame.h"
 #include "FrameLoadRequest.h"
-#include "KURL.h"
-#include "Logging.h"
+#include "FrameLoader.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClientQt.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GeolocationPermissionClientQt.h"
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HashMap.h"
+#include "HitTestResult.h"
 #include "Image.h"
 #include "InspectorClientQt.h"
 #include "InspectorController.h"
-#include "FocusController.h"
-#include "Editor.h"
-#include "Scrollbar.h"
+#include "InspectorServerQt.h"
+#include "KURL.h"
+#include "LocalizedStrings.h"
+#include "Logging.h"
+#include "MIMETypeRegistry.h"
+#include "NavigationAction.h"
 #include "NetworkingContext.h"
+#include "NotificationPresenterClientQt.h"
+#include "Page.h"
+#include "PageClientQt.h"
+#include "PageGroup.h"
+#include "Pasteboard.h"
 #include "PlatformKeyboardEvent.h"
+#include "PlatformTouchEvent.h"
 #include "PlatformWheelEvent.h"
 #include "PluginDatabase.h"
+#include "PluginDatabase.h"
+#include "PluginPackage.h"
 #include "ProgressTracker.h"
 #include "RefPtr.h"
 #include "RenderTextControl.h"
+#include "SchemeRegistry.h"
+#include "Scrollbar.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
 #include "TextIterator.h"
-#include "HashMap.h"
-#include "HTMLFormElement.h"
-#include "HTMLInputElement.h"
-#include "HTMLNames.h"
-#include "HitTestResult.h"
-#include "InspectorServerQt.h"
-#include "WindowFeatures.h"
 #include "WebPlatformStrategies.h"
-#include "LocalizedStrings.h"
-#include "Cache.h"
-#include "runtime/InitializeThreading.h"
-#include "PageGroup.h"
-#include "GeolocationPermissionClientQt.h"
-#include "NotificationPresenterClientQt.h"
-#include "PageClientQt.h"
-#include "PlatformTouchEvent.h"
+#include "WindowFeatures.h"
 #include "WorkerThread.h"
+#include "runtime/InitializeThreading.h"
 #include "wtf/Threading.h"
-#include "MIMETypeRegistry.h"
-#include "PluginDatabase.h"
-#include "PluginPackage.h"
 
 #include <QApplication>
 #include <QBasicTimer>
@@ -311,7 +313,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 
     settings = new QWebSettings(page->settings());
 
-    history.d = new QWebHistoryPrivate(page->backForwardList());
+    history.d = new QWebHistoryPrivate(static_cast<WebCore::BackForwardListImpl*>(page->backForwardList()));
     memset(actions, 0, sizeof(actions));
 
     PageGroup::setShouldTrackVisitedLinks(true);
@@ -323,6 +325,11 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 
 QWebPagePrivate::~QWebPagePrivate()
 {
+    if (inspector && inspectorIsInternalOnly) {
+        // Since we have to delete an internal inspector,
+        // call setInspector(0) directly to prevent potential crashes
+        setInspector(0);
+    }
 #ifndef QT_NO_CONTEXTMENU
     delete currentContextMenu;
 #endif
@@ -332,6 +339,9 @@ QWebPagePrivate::~QWebPagePrivate()
     delete settings;
     delete page;
     
+    if (inspector)
+        inspector->setPage(0);
+
 #if ENABLE(NOTIFICATIONS)
     NotificationPresenterClientQt::notificationPresenter()->removeClient();
 #endif
@@ -1008,7 +1018,6 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
 {
     WebCore::Frame *frame = page->focusController()->focusedOrMainFrame();
     WebCore::Editor *editor = frame->editor();
-    QInputMethodEvent::Attribute selection(QInputMethodEvent::Selection, 0, 0, QVariant());
 
     if (!editor->canEdit()) {
         ev->ignore();
@@ -1016,14 +1025,9 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
     }
 
     RenderObject* renderer = 0;
-    RenderTextControl* renderTextControl = 0;
-
     if (frame->selection()->rootEditableElement())
         renderer = frame->selection()->rootEditableElement()->shadowAncestorNode()->renderer();
 
-    if (renderer && renderer->isTextControl())
-        renderTextControl = toRenderTextControl(renderer);
-
     Vector<CompositionUnderline> underlines;
     bool hasSelection = false;
 
@@ -1048,8 +1052,21 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
             break;
         }
         case QInputMethodEvent::Selection: {
-            selection = a;
             hasSelection = true;
+            // A selection in the inputMethodEvent is always reflected in the visible text
+            if (renderer && renderer->node())
+                setSelectionRange(renderer->node(), qMin(a.start, (a.start + a.length)), qMax(a.start, (a.start + a.length)));
+
+            if (!ev->preeditString().isEmpty()) {
+                editor->setComposition(ev->preeditString(), underlines,
+                                      (a.length < 0) ? a.start + a.length : a.start,
+                                      (a.length < 0) ? a.start : a.start + a.length);
+            } else {
+                // If we are in the middle of a composition, an empty pre-edit string and a selection of zero
+                // cancels the current composition
+                if (editor->hasComposition() && (a.start + a.length == 0))
+                    editor->setComposition(QString(), underlines, 0, 0);
+            }
             break;
         }
         }
@@ -1057,22 +1074,8 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
 
     if (!ev->commitString().isEmpty())
         editor->confirmComposition(ev->commitString());
-    else {
-        // 1. empty preedit with a selection attribute, and start/end of 0 cancels composition
-        // 2. empty preedit with a selection attribute, and start/end of non-0 updates selection of current preedit text
-        // 3. populated preedit with a selection attribute, and start/end of 0 or non-0 updates selection of supplied preedit text
-        // 4. otherwise event is updating supplied pre-edit text
-        QString preedit = ev->preeditString();
-        if (hasSelection) {
-            QString text = (renderTextControl) ? QString(renderTextControl->text()) : QString();
-            if (preedit.isEmpty() && selection.start + selection.length > 0)
-                preedit = text;
-            editor->setComposition(preedit, underlines,
-                                   (selection.length < 0) ? selection.start + selection.length : selection.start,
-                                   (selection.length < 0) ? selection.start : selection.start + selection.length);
-        } else if (!preedit.isEmpty())
-            editor->setComposition(preedit, underlines, preedit.length(), 0);
-    }
+    else if (!hasSelection && !ev->preeditString().isEmpty())
+        editor->setComposition(ev->preeditString(), underlines, 0, ev->preeditString().length());
 
     ev->accept();
 }
@@ -1329,9 +1332,8 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
             if (renderTextControl) {
                 QString text = renderTextControl->text();
                 RefPtr<Range> range = editor->compositionRange();
-                if (range) {
+                if (range)
                     text.remove(range->startPosition().offsetInContainerNode(), TextIterator::rangeLength(range.get()));
-                }
                 return QVariant(text);
             }
             return QVariant();
@@ -1760,14 +1762,6 @@ QWebPage::~QWebPage()
     FrameLoader *loader = d->mainFrame->d->frame->loader();
     if (loader)
         loader->detachFromParent();
-    if (d->inspector) {
-        // Since we have to delete an internal inspector,
-        // call setInspector(0) directly to prevent potential crashes
-        if (d->inspectorIsInternalOnly)
-            d->setInspector(0);
-        else
-            d->inspector->setPage(0);
-    }
     delete d;
 }
 
@@ -1850,7 +1844,7 @@ void QWebPage::setView(QWidget* view)
     }
 
     if (view)
-        d->client = new PageClientQWidget(view);
+        d->client = new PageClientQWidget(view, this);
 }
 
 /*!
@@ -2089,8 +2083,9 @@ static void openNewWindow(const QUrl& url, WebCore::Frame* frame)
 {
     if (Page* oldPage = frame->page()) {
         WindowFeatures features;
+        NavigationAction action;
         if (Page* newPage = oldPage->chrome()->createWindow(frame,
-                frameLoadRequest(url, frame), features))
+                frameLoadRequest(url, frame), features, action))
             newPage->chrome()->show();
     }
 }
@@ -2292,6 +2287,9 @@ static QSize queryDeviceSizeForScreenContainingWidget(const QWidget* widget)
     automatically. For testing purposes the size can be overridden by setting two
     environment variables QTWEBKIT_DEVICE_WIDTH and QTWEBKIT_DEVICE_HEIGHT, which
     both needs to be set.
+
+    An invalid instance will be returned in the case an empty size is passed to the
+    method.
 */
 
 QWebPage::ViewportAttributes QWebPage::viewportAttributesForSize(const QSize& availableSize) const
@@ -2301,6 +2299,9 @@ QWebPage::ViewportAttributes QWebPage::viewportAttributesForSize(const QSize& av
 
     ViewportAttributes result;
 
+     if (availableSize.isEmpty())
+         return result; // Returns an invalid instance.
+
     int deviceWidth = getintenv("QTWEBKIT_DEVICE_WIDTH");
     int deviceHeight = getintenv("QTWEBKIT_DEVICE_HEIGHT");
 
@@ -2823,6 +2824,7 @@ bool QWebPage::event(QEvent *ev)
 #endif
     case QEvent::InputMethod:
         d->inputMethodEvent(static_cast<QInputMethodEvent*>(ev));
+        break;
     case QEvent::ShortcutOverride:
         d->shortcutOverrideEvent(static_cast<QKeyEvent*>(ev));
         break;
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index c1bf664..98d6d45 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,296 @@
+2010-10-29  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] QWebPage's InputMethod event handling calls ShortcutOverride handler too
+        https://bugs.webkit.org/show_bug.cgi?id=48692
+
+        * Api/qwebpage.cpp:
+        (QWebPage::event): Add missing break statement.
+
+2010-10-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove RenderTextControl::setSelectionRange
+        https://bugs.webkit.org/show_bug.cgi?id=47870
+
+        Converted RenderTextControll::setSelectionRange to a global function.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::inputMethodEvent): Calls setSelectionRange.
+
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::clear):
+        * Api/qwebhistory_p.h:
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        Use BackForwardListImpl.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidBecomeFrameset):
+
+2010-10-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix tst_QWebFrame on XVFB.
+        https://bugs.webkit.org/show_bug.cgi?id=48637
+
+        These tests relied on a window manager to activate the window.
+
+        Fixes:
+        - tst_QWebFrame::popupFocus()
+        - tst_QwebFrame::inputFieldFocus()
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2010-10-28  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        Build fix,
+
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::PlatformLayerProxyQGraphicsObject::PlatformLayerProxyQGraphicsObject):
+        (WebCore::PageClientQGraphicsWidget::~PageClientQGraphicsWidget):
+        (WebCore::PageClientQGraphicsWidget::setRootGraphicsLayer):
+        * WebCoreSupport/PageClientQt.h:
+
+2010-10-28  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QWebElement: Don't retrieve CSS rules through DOMWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=48519
+
+        JavaScript is prevented from retrieving cross-domain CSS rules since r70335.
+        This patch allow QWebElement to retrive style without this limitation
+        by asking the Document directly instead of going through DOMWindow.
+
+        Fixes:
+        - tst_QWebFrame::setHtmlWithResource()
+        - tst_QWebElement::style()
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+
+2010-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Make Qt viewportAttributesForSize not assert on (0, 0) size
+        https://bugs.webkit.org/show_bug.cgi?id=48524
+
+        We now return an invalid (isValid() == false) ViewportAttributes
+        instance when the supplied size is (0, 0).
+
+        * Api/qwebpage.cpp:
+        (QWebPage::viewportAttributesForSize):
+
+2010-10-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix tst_QWebFrame::popupFocus().
+        https://bugs.webkit.org/show_bug.cgi?id=48432
+
+        - Call setFocus() before show() to work around a but in Qt.
+        - Remove the check on combo at the end since hidePopup() leads
+          indirectly to its destruction and segfault.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::transferLoadingResourceFromPage):
+        Emtpy method.
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2010-10-26  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Skipping popup focus test for symbian
+        https://bugs.webkit.org/show_bug.cgi?id=48324
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2010-10-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Unit tests: setHtml("data:text/html,...") -> load(QUrl("data:text/html,..."))
+        https://bugs.webkit.org/show_bug.cgi?id=48319
+
+        These tests were failing since the new HTML parser.
+        This patch removes the content type from the error page as well.
+
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::frame):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadFinished):
+        (ErrorPage::extension):
+        (tst_QWebPage::errorPageExtension):
+        (tst_QWebPage::errorPageExtensionInIFrames):
+        (tst_QWebPage::errorPageExtensionInFrameset):
+
+2010-10-25  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        Glue layer (WebCoreSupport) changes to allow connecting TextureMapper to a Qt PageClient, i.e.
+        a QWebView or a QGraphicsWebView. This enables the new type, TextureMapperPlatformLayer, to be recognized both by
+        the compositor and by the page client.
+        Note that this is temporarily an opt-in, under USE(TEXTURE_MAPPER)
+
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::QWebFramePrivate):
+        * Api/qwebpage.cpp:
+        (QWebPage::setView):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::attachRootGraphicsLayer):
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::PlatformLayerProxyQt::PlatformLayerProxyQt):
+        (WebCore::PlatformLayerProxyQt::~PlatformLayerProxyQt):
+        (WebCore::PlatformLayerProxyQt::setSizeChanged):
+        (WebCore::PlatformLayerProxyQWidget::PlatformLayerProxyQWidget):
+        (WebCore::PlatformLayerProxyQWidget::eventFilter):
+        (WebCore::PlatformLayerProxyQWidget::setNeedsDisplay):
+        (WebCore::PlatformLayerProxyQWidget::setNeedsDisplayInRect):
+        (WebCore::PlatformLayerProxyQGraphicsObject::PlatformLayerProxyQGraphicsWidget):
+        (WebCore::PlatformLayerProxyQGraphicsObject::setNeedsDisplay):
+        (WebCore::PlatformLayerProxyQGraphicsObject::setNeedsDisplayInRect):
+        (WebCore::PageClientQWidget::setRootGraphicsLayer):
+        (WebCore::PageClientQWidget::markForSync):
+        (WebCore::PageClientQWidget::syncLayers):
+        (WebCore::PageClientQGraphicsWidget::updateCompositingScrollPosition):
+        (WebCore::PageClientQGraphicsWidget::createOrDeleteOverlay):
+        (WebCore::PageClientQGraphicsWidget::setRootGraphicsLayer):
+        * WebCoreSupport/PageClientQt.h:
+        (WebCore::PageClientQWidget::PageClientQWidget):
+        (WebCore::PageClientQWidget::allowsAcceleratedCompositing):
+        (WebCore::PageClientQGraphicsWidget::PageClientQGraphicsWidget):
+
+2010-10-25  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Dump the gesture status of frame in frame load callbacks in DumpRenderTree
+        by adding a new method dumpUserGestureInFrameLoadCallbacks.
+        Now only dump the gesture status in "DidStartProvisionalLoad" callback.
+        https://bugs.webkit.org/show_bug.cgi?id=47849
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::dumpUserGestureInFrameLoader):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (drtPrintFrameUserGestureStatus):
+        (WebCore::FrameLoaderClientQt::dispatchDidHandleOnloadEvents):
+        (WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidStartProvisionalLoad):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * Api/qwebpage.cpp:
+        (openNewWindow):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::createWindow):
+        * WebCoreSupport/ChromeClientQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchCreatePage):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        Add NavigationAction parameter.
+
+2010-10-22  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] InspectorClientQt crashes when deleting a qwebpage which has an inspector
+        https://bugs.webkit.org/show_bug.cgi?id=48079
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::~QWebPagePrivate):
+        (QWebPage::~QWebPage):
+
+2010-10-22  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] All widgets are rendered incorrectly when rendered through a cache
+        https://bugs.webkit.org/show_bug.cgi?id=47767
+
+        Add a new test for rendering with tiling.
+
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::widgetsRenderingThroughCache):
+
+2010-10-21  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Sending a QInputMethodEvent::Selection event forces the
+             Editor to go into Composition mode
+
+        Improve QWebPage handling of input method events:
+         - Selections don't trigger entering composition mode.
+         - Handle multiple selections
+
+        Also remove redundant cancellation of composition in tst_qwebpage.
+        There is no composition in progress at that point.
+
+        Finally, move infiniteLoopJS() to the end of the tst_qwebpage unit
+        tests - so you don't have to wait for it to complete when running
+        other tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=39625
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::inputMethodEvent):
+        (QWebPage::inputMethodQuery):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
 2010-10-20  Luiz Agostini  <luiz.agostini@openbossa.org>
 
         Reviewed by Antonio Gomes.
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 3bcc8f8..f0d3903 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -39,11 +39,12 @@
 #include "FrameView.h"
 #include "Geolocation.h"
 #if USE(ACCELERATED_COMPOSITING)
-#include "GraphicsLayerQt.h"
+#include "GraphicsLayer.h"
 #endif
 #include "GeolocationPermissionClientQt.h"
 #include "HitTestResult.h"
 #include "Icon.h"
+#include "NavigationAction.h"
 #include "NetworkingContext.h"
 #include "NotImplemented.h"
 #include "NotificationPresenterClientQt.h"
@@ -169,7 +170,7 @@ void ChromeClientQt::focusedNodeChanged(WebCore::Node*)
 }
 
 
-Page* ChromeClientQt::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features)
+Page* ChromeClientQt::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features, const NavigationAction&)
 {
     QWebPage* newPage = m_webPage->createWindow(features.dialog ? QWebPage::WebModalDialog : QWebPage::WebBrowserWindow);
     if (!newPage)
@@ -590,7 +591,7 @@ void ChromeClientQt::cancelGeolocationPermissionRequestForFrame(Frame* frame, Ge
 void ChromeClientQt::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
 {
     if (platformPageClient())
-        platformPageClient()->setRootGraphicsLayer(graphicsLayer ? graphicsLayer->nativeLayer() : 0);
+        platformPageClient()->setRootGraphicsLayer(graphicsLayer ? graphicsLayer->platformLayer() : 0);
 }
 
 void ChromeClientQt::setNeedsOneShotDrawingSynchronization()
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 0a449f6..bbd2452 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -73,7 +73,7 @@ namespace WebCore {
 
         virtual void focusedNodeChanged(Node*);
 
-        virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&);
+        virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&, const NavigationAction&);
         virtual void show();
 
         virtual bool canRunModal();
diff --git a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 28f6810..4309e5c 100644
--- a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -561,6 +561,11 @@ void DumpRenderTreeSupportQt::dumpFrameLoader(bool b)
     FrameLoaderClientQt::dumpFrameLoaderCallbacks = b;
 }
 
+void DumpRenderTreeSupportQt::dumpUserGestureInFrameLoader(bool b)
+{
+    FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = b;
+}
+
 void DumpRenderTreeSupportQt::dumpResourceLoadCallbacks(bool b)
 {
     FrameLoaderClientQt::dumpResourceLoadCallbacks = b;
diff --git a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 0e76f04..356b226 100644
--- a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -101,6 +101,7 @@ public:
     static QString plainText(const QVariant& rng);
 
     static void dumpFrameLoader(bool b);
+    static void dumpUserGestureInFrameLoader(bool b);
     static void dumpResourceLoadCallbacks(bool b);
     static void dumpResourceResponseMIMETypes(bool b);
     static void dumpResourceLoadCallbacksPath(const QString& path);
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 4ebc7e1..1b57138 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -106,6 +106,13 @@ static QString drtDescriptionSuitableForTestResult(WebCore::Frame* _frame)
     }
 }
 
+static QString drtPrintFrameUserGestureStatus(WebCore::Frame* frame)
+{
+    if (frame->loader()->isProcessingUserGesture())
+        return QString::fromLatin1("Frame with user gesture \"%1\"").arg(QLatin1String("true"));
+    return QString::fromLatin1("Frame with user gesture \"%1\"").arg(QLatin1String("false"));
+}
+
 static QString drtDescriptionSuitableForTestResult(const WebCore::KURL& _url)
 {
     if (_url.isEmpty() || !_url.isLocalFile())
@@ -159,6 +166,7 @@ namespace WebCore
 {
 
 bool FrameLoaderClientQt::dumpFrameLoaderCallbacks = false;
+bool FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = false;
 bool FrameLoaderClientQt::dumpResourceLoadCallbacks = false;
 bool FrameLoaderClientQt::sendRequestReturnsNullOnRedirect = false;
 bool FrameLoaderClientQt::sendRequestReturnsNull = false;
@@ -274,6 +282,9 @@ void FrameLoaderClientQt::transitionToCommittedForNewPage()
                         vScrollbar, vLock);
 }
 
+void FrameLoaderClientQt::dispatchDidBecomeFrameset(bool)
+{
+}
 
 void FrameLoaderClientQt::makeRepresentation(DocumentLoader*)
 {
@@ -314,7 +325,6 @@ void FrameLoaderClientQt::dispatchDidHandleOnloadEvents()
     // don't need this one
     if (dumpFrameLoaderCallbacks)
         printf("%s - didHandleOnloadEventsForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
-
 }
 
 
@@ -373,7 +383,7 @@ void FrameLoaderClientQt::dispatchDidPushStateWithinPage()
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidPushStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
-        
+
     notImplemented();
 }
 
@@ -381,7 +391,7 @@ void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidReplaceStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
-        
+
     notImplemented();
 }
 
@@ -389,7 +399,7 @@ void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidPopStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
-        
+
     notImplemented();
 }
 
@@ -403,6 +413,9 @@ void FrameLoaderClientQt::dispatchDidStartProvisionalLoad()
     if (dumpFrameLoaderCallbacks)
         printf("%s - didStartProvisionalLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
+    if (dumpUserGestureInFrameLoaderCallbacks)
+        printf("%s - in didStartProvisionalLoadForFrame\n", qPrintable(drtPrintFrameUserGestureStatus(m_frame)));
+
     if (m_webFrame)
         emit m_webFrame->provisionalLoad();
 }
@@ -1102,7 +1115,7 @@ void FrameLoaderClientQt::dispatchDidFailLoad(const WebCore::ResourceError& erro
         callErrorPageExtension(error);
 }
 
-WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage()
+WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage(const WebCore::NavigationAction&)
 {
     if (!m_webFrame)
         return 0;
@@ -1262,6 +1275,10 @@ void FrameLoaderClientQt::didTransferChildFrameToNewDocument(Page*)
     }
 }
 
+void FrameLoaderClientQt::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
+}
+
 ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const String& _mimeType)
 {
 //    qDebug()<<" ++++++++++++++++ url is "<<url.prettyURL()<<", mime = "<<_mimeType;
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index ec6a3b6..275b0e8 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -120,7 +120,7 @@ public:
     virtual void dispatchDidFirstLayout();
     virtual void dispatchDidFirstVisuallyNonEmptyLayout();
 
-    virtual WebCore::Frame* dispatchCreatePage();
+    virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
 
     virtual void dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const WTF::String&, const WebCore::ResourceRequest&);
@@ -193,12 +193,15 @@ public:
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedForNewPage();
 
+    virtual void dispatchDidBecomeFrameset(bool);
+
     virtual bool canCachePage() const;
     virtual void download(WebCore::ResourceHandle*, const WebCore::ResourceRequest&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&);
 
     virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
     virtual void didTransferChildFrameToNewDocument(WebCore::Page*);
+    virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page*);
     virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool);
     virtual void redirectDataToPlugin(Widget* pluginWidget);
 
@@ -233,6 +236,7 @@ public:
     virtual PassRefPtr<FrameNetworkingContext> createNetworkingContext();
 
     static bool dumpFrameLoaderCallbacks;
+    static bool dumpUserGestureInFrameLoaderCallbacks;
     static bool dumpResourceLoadCallbacks;
     static bool dumpResourceResponseMIMETypes;
     static QString dumpResourceLoadCallbacksPath;
diff --git a/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index 9aa01a2..4d42c39 100644
--- a/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -21,13 +21,127 @@
 #include "config.h"
 
 #include "PageClientQt.h"
+#include "texmap/TextureMapperPlatformLayer.h"
 
 #if defined(Q_WS_X11)
 #include <QX11Info>
 #endif
 
+#ifdef QT_OPENGL_LIB
+#include <QGLWidget>
+#endif
 namespace WebCore {
 
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)    
+class PlatformLayerProxyQt : public QObject, public virtual TextureMapperLayerClient {
+public:
+    PlatformLayerProxyQt(QWebFrame* frame, TextureMapperContentLayer* layer, QObject* object)
+        : QObject(object)
+        , m_frame(frame)
+        , m_layer(layer)
+    {
+        if (m_layer)
+            m_layer->setPlatformLayerClient(this);
+        m_frame->d->rootGraphicsLayer = m_layer;
+    }
+
+    virtual ~PlatformLayerProxyQt()
+    {
+        if (m_layer)
+            m_layer->setPlatformLayerClient(0);
+        if (m_frame->d)
+            m_frame->d->rootGraphicsLayer = 0;
+    }
+
+    // Since we just paint the composited tree and never create a special item for it, we don't have to handle its size changes.
+    void setSizeChanged(const IntSize&) { }
+
+private:
+    QWebFrame* m_frame;
+    TextureMapperContentLayer* m_layer;
+};
+
+class PlatformLayerProxyQWidget : public PlatformLayerProxyQt {
+public:
+    PlatformLayerProxyQWidget(QWebFrame* frame, TextureMapperContentLayer* layer, QWidget* widget)
+        : PlatformLayerProxyQt(frame, layer, widget)
+        , m_widget(widget)
+    {
+        if (m_widget)
+            m_widget->installEventFilter(this);
+    }
+
+    // We don't want a huge region-clip on the compositing layers; instead we unite the rectangles together
+    // and clear them when the paint actually occurs.
+    bool eventFilter(QObject* object, QEvent* event)
+    {
+        if (object == m_widget && event->type() == QEvent::Paint)
+            m_dirtyRect = QRect();
+        return QObject::eventFilter(object, event);
+    }
+
+    void setNeedsDisplay()
+    {
+        if (m_widget)
+            m_widget->update();
+    }
+
+    void setNeedsDisplayInRect(const IntRect& rect)
+    {
+        m_dirtyRect |= rect;
+        m_widget->update(m_dirtyRect);
+    }
+
+private:
+    QRect m_dirtyRect;
+    QWidget* m_widget;
+};
+
+class PlatformLayerProxyQGraphicsObject : public PlatformLayerProxyQt {
+public:
+    PlatformLayerProxyQGraphicsObject(QWebFrame* frame, TextureMapperContentLayer* layer, QGraphicsObject* object)
+        : PlatformLayerProxyQt(frame, layer, object)
+        , m_graphicsItem(object)
+    {
+    }
+
+    void setNeedsDisplay()
+    {
+        if (m_graphicsItem)
+            m_graphicsItem->update();
+    }
+
+    void setNeedsDisplayInRect(const IntRect& rect)
+    {
+        if (m_graphicsItem)
+            m_graphicsItem->update(QRectF(rect));
+    }
+
+private:
+    QGraphicsItem* m_graphicsItem;
+};
+
+void PageClientQWidget::setRootGraphicsLayer(TextureMapperPlatformLayer* layer)
+{
+    if (layer) {
+        platformLayerProxy = new PlatformLayerProxyQWidget(page->mainFrame(), static_cast<TextureMapperContentLayer*>(layer), view);
+        return;
+    }
+    delete platformLayerProxy;
+    platformLayerProxy = 0;
+}
+
+void PageClientQWidget::markForSync(bool scheduleSync)
+{
+    syncTimer.startOneShot(0);
+}
+
+void PageClientQWidget::syncLayers(Timer<PageClientQWidget>*)
+{
+    QWebFramePrivate::core(page->mainFrame())->view()->syncCompositingStateRecursive();
+}
+#endif
+
 void PageClientQWidget::scroll(int dx, int dy, const QRect& rectToScroll)
 {
     view->scroll(qreal(dx), qreal(dy), rectToScroll);
@@ -53,6 +167,13 @@ void PageClientQWidget::setInputMethodHints(Qt::InputMethodHints hints)
     view->setInputMethodHints(hints);
 }
 
+PageClientQWidget::~PageClientQWidget()
+{
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    delete platformLayerProxy;
+#endif
+}
+
 #ifndef QT_NO_CURSOR
 QCursor PageClientQWidget::cursor() const
 {
@@ -107,12 +228,16 @@ PageClientQGraphicsWidget::~PageClientQGraphicsWidget()
 {
     delete overlay;
 #if USE(ACCELERATED_COMPOSITING)
+#if USE(TEXTURE_MAPPER)
+    delete platformLayerProxy;
+#else
     if (!rootGraphicsLayer)
         return;
     // we don't need to delete the root graphics layer. The lifecycle is managed in GraphicsLayerQt.cpp.
     rootGraphicsLayer.data()->setParentItem(0);
     view->scene()->removeItem(rootGraphicsLayer.data());
 #endif
+#endif
 }
 
 void PageClientQGraphicsWidget::scroll(int dx, int dy, const QRect& rectToScroll)
@@ -134,6 +259,8 @@ void PageClientQGraphicsWidget::update(const QRect& dirtyRect)
 
 void PageClientQGraphicsWidget::createOrDeleteOverlay()
 {
+    // We don't use an overlay with TextureMapper. Instead, the overlay is drawn inside QWebFrame.
+#if !USE(TEXTURE_MAPPER)
     bool useOverlay = false;
     if (!viewResizesToContents) {
 #if USE(ACCELERATED_COMPOSITING)
@@ -154,6 +281,7 @@ void PageClientQGraphicsWidget::createOrDeleteOverlay()
         overlay->deleteLater();
         overlay = 0;
     }
+#endif // !USE(TEXTURE_MAPPER)
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -165,7 +293,18 @@ void PageClientQGraphicsWidget::syncLayers()
     }
 }
 
-void PageClientQGraphicsWidget::setRootGraphicsLayer(QGraphicsItem* layer)
+#if USE(TEXTURE_MAPPER)
+void PageClientQGraphicsWidget::setRootGraphicsLayer(TextureMapperPlatformLayer* layer)
+{
+    if (layer) {
+        platformLayerProxy = new PlatformLayerProxyQGraphicsObject(page->mainFrame(), static_cast<TextureMapperContentLayer*>(layer), view);
+        return;
+    }
+    delete platformLayerProxy;
+    platformLayerProxy = 0;
+}
+#else
+void PageClientQGraphicsWidget::setRootGraphicsLayer(QGraphicsObject* layer)
 {
     if (rootGraphicsLayer) {
         rootGraphicsLayer.data()->setParentItem(0);
@@ -173,7 +312,7 @@ void PageClientQGraphicsWidget::setRootGraphicsLayer(QGraphicsItem* layer)
         QWebFramePrivate::core(page->mainFrame())->view()->syncCompositingStateRecursive();
     }
 
-    rootGraphicsLayer = layer ? layer->toGraphicsObject() : 0;
+    rootGraphicsLayer = layer;
 
     if (layer) {
         layer->setFlag(QGraphicsItem::ItemClipsChildrenToShape, true);
@@ -182,6 +321,7 @@ void PageClientQGraphicsWidget::setRootGraphicsLayer(QGraphicsItem* layer)
     }
     createOrDeleteOverlay();
 }
+#endif
 
 void PageClientQGraphicsWidget::markForSync(bool scheduleSync)
 {
diff --git a/WebKit/qt/WebCoreSupport/PageClientQt.h b/WebKit/qt/WebCoreSupport/PageClientQt.h
index 7014fd2..924d2a7 100644
--- a/WebKit/qt/WebCoreSupport/PageClientQt.h
+++ b/WebKit/qt/WebCoreSupport/PageClientQt.h
@@ -41,15 +41,25 @@
 
 #include <Settings.h>
 
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#include "texmap/TextureMapperPlatformLayer.h"
+#endif
+
 namespace WebCore {
 
 class PageClientQWidget : public QWebPageClient {
 public:
-    PageClientQWidget(QWidget* view)
-        : view(view)
+    PageClientQWidget(QWidget* newView, QWebPage* newPage)
+        : view(newView)
+        , page(newPage)
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+        , syncTimer(this, &PageClientQWidget::syncLayers)
+        , platformLayerProxy(0)
+#endif
     {
         Q_ASSERT(view);
     }
+    virtual ~PageClientQWidget();
 
     virtual bool isQWidgetClient() const { return true; }
 
@@ -78,6 +88,21 @@ public:
     virtual QRectF windowRect() const;
 
     QWidget* view;
+    QWebPage* page;
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    virtual void setRootGraphicsLayer(TextureMapperPlatformLayer* layer);
+    virtual void markForSync(bool scheduleSync);
+    void syncLayers(Timer<PageClientQWidget>*);
+#endif
+
+    // QGraphicsWebView can render composited layers
+    virtual bool allowsAcceleratedCompositing() const { return true; }
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    Timer<PageClientQWidget> syncTimer;
+    PlatformLayerProxyQt* platformLayerProxy;
+#endif
 };
 
 // the overlay is here for one reason only: to have the scroll-bars and other
@@ -116,11 +141,14 @@ class QGraphicsItemOverlay : public QGraphicsObject {
 
 class PageClientQGraphicsWidget : public QWebPageClient {
 public:
-    PageClientQGraphicsWidget(QGraphicsWebView* v, QWebPage* p)
-        : view(v)
-        , page(p)
+    PageClientQGraphicsWidget(QGraphicsWebView* newView, QWebPage* newPage)
+        : view(newView)
+        , page(newPage)
         , viewResizesToContents(false)
 #if USE(ACCELERATED_COMPOSITING)
+#if USE(TEXTURE_MAPPER)
+        , platformLayerProxy(0)
+#endif
         , shouldSync(false)
 #endif
         , overlay(0)
@@ -168,7 +196,7 @@ public:
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual void setRootGraphicsLayer(QGraphicsItem* layer);
+    virtual void setRootGraphicsLayer(PlatformLayer* layer);
     virtual void markForSync(bool scheduleSync);
     void syncLayers();
 
@@ -183,8 +211,11 @@ public:
     bool viewResizesToContents;
 
 #if USE(ACCELERATED_COMPOSITING)
+#if USE(TEXTURE_MAPPER)
+    PlatformLayerProxyQt* platformLayerProxy;
+#else
     QWeakPointer<QGraphicsObject> rootGraphicsLayer;
-
+#endif
     // we have to flush quite often, so we use a meta-method instead of QTimer::singleShot for putting the event in the queue
     QMetaMethod syncMetaMethod;
 
diff --git a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index a04ff17..09a21e1 100644
--- a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -35,6 +35,7 @@ private slots:
     void microFocusCoordinates();
     void focusInputTypes();
     void crashOnSetScaleBeforeSetUrl();
+    void widgetsRenderingThroughCache();
 };
 
 void tst_QGraphicsWebView::qgraphicswebview()
@@ -123,11 +124,11 @@ void tst_QGraphicsWebView::crashOnViewlessWebPages()
     // page, so we first connect the signal afterward.
     connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), page, SLOT(aborting()));
 
-    page->mainFrame()->setHtml(QString("data:text/html,"
-                                            "<frameset cols=\"25%,75%\">"
-                                                "<frame src=\"data:text/html,foo \">"
-                                                "<frame src=\"data:text/html,bar\">"
-                                            "</frameset>"));
+    page->mainFrame()->load(QUrl("data:text/html,"
+                                 "<frameset cols=\"25%,75%\">"
+                                     "<frame src=\"data:text/html,foo \">"
+                                     "<frame src=\"data:text/html,bar\">"
+                                 "</frameset>"));
 
     QVERIFY(waitForSignal(page, SIGNAL(loadFinished(bool))));
     delete page;
@@ -140,6 +141,41 @@ void tst_QGraphicsWebView::crashOnSetScaleBeforeSetUrl()
     delete webView;
 }
 
+void tst_QGraphicsWebView::widgetsRenderingThroughCache()
+{
+    // Widgets should be rendered the same way with and without
+    // intermediate cache (tiling for example).
+    // See bug https://bugs.webkit.org/show_bug.cgi?id=47767 where
+    // widget are rendered as disabled when caching is using.
+
+    QGraphicsWebView* webView = new QGraphicsWebView;
+    webView->setHtml(QLatin1String("<body style=\"background-color: white\"><input type=range></input><input type=checkbox></input><input type=radio></input><input type=file></input></body>"));
+
+    QGraphicsView view;
+    view.show();
+    QGraphicsScene* scene = new QGraphicsScene(&view);
+    view.setScene(scene);
+    scene->addItem(webView);
+    view.setGeometry(QRect(0, 0, 500, 500));
+    QWidget *const widget = &view;
+    QTest::qWaitForWindowShown(widget);
+
+    // 1. Reference without tiling.
+    webView->settings()->setAttribute(QWebSettings::TiledBackingStoreEnabled, false);
+    QPixmap referencePixmap(view.size());
+    widget->render(&referencePixmap);
+
+    // 2. With tiling.
+    webView->settings()->setAttribute(QWebSettings::TiledBackingStoreEnabled, true);
+    QPixmap viewWithTiling(view.size());
+    widget->render(&viewWithTiling);
+    QApplication::processEvents();
+    viewWithTiling.fill();
+    widget->render(&viewWithTiling);
+
+    QCOMPARE(referencePixmap.toImage(), viewWithTiling.toImage());
+}
+
 void tst_QGraphicsWebView::microFocusCoordinates()
 {
     QWebPage* page = new QWebPage;
diff --git a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index 2f1097a..9bd255f 100644
--- a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -430,9 +430,9 @@ void tst_QWebElement::frame()
     QWebElement doc = m_mainFrame->documentElement();
     QVERIFY(doc.webFrame() == m_mainFrame);
 
-    m_view->setHtml(QString("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
-                            "<p>frame1\">"
-                            "<frame src=\"data:text/html,<p>frame2\"></frameset>"), QUrl());
+    m_mainFrame->load(QUrl("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
+                           "<p>frame1\">"
+                           "<frame src=\"data:text/html,<p>frame2\"></frameset>"));
 
     waitForSignal(m_page, SIGNAL(loadFinished(bool)));
 
diff --git a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index ec8a39e..d74b631 100644
--- a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -602,8 +602,8 @@ private slots:
     void setHtmlWithJSAlert();
     void ipv6HostEncoding();
     void metaData();
-#if !defined(Q_WS_MAEMO_5)
-    // as maemo 5 does not use QComboBoxes to implement the popups
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_OS_SYMBIAN)
+    // as maemo 5 && symbian do not use QComboBoxes to implement the popups
     // this test does not make sense for it.
     void popupFocus();
 #endif
@@ -2585,7 +2585,7 @@ void tst_QWebFrame::metaData()
     QCOMPARE(metaData.value("nonexistant"), QString());
 }
 
-#if !defined(Q_WS_MAEMO_5)
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_OS_SYMBIAN)
 void tst_QWebFrame::popupFocus()
 {
     QWebView view;
@@ -2603,9 +2603,11 @@ void tst_QWebFrame::popupFocus()
                  "    </body>"
                  "</html>");
     view.resize(400, 100);
+    // Call setFocus before show to work around http://bugreports.qt.nokia.com/browse/QTBUG-14762
+    view.setFocus();
     view.show();
     QTest::qWaitForWindowShown(&view);
-    view.setFocus();
+    view.activateWindow();
     QTRY_VERIFY(view.hasFocus());
 
     // open the popup by clicking. check if focus is on the popup
@@ -2618,7 +2620,7 @@ void tst_QWebFrame::popupFocus()
 
     // hide the popup and check if focus is on the page
     combo->hidePopup();
-    QTRY_VERIFY(view.hasFocus() && !combo->view()->hasFocus()); // Focus should be back on the WebView
+    QTRY_VERIFY(view.hasFocus()); // Focus should be back on the WebView
 }
 #endif
 
@@ -2629,6 +2631,7 @@ void tst_QWebFrame::inputFieldFocus()
     view.resize(400, 100);
     view.show();
     QTest::qWaitForWindowShown(&view);
+    view.activateWindow();
     view.setFocus();
     QTRY_VERIFY(view.hasFocus());
 
diff --git a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 0462953..e6b5909 100644
--- a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -77,7 +77,6 @@ private slots:
     void cleanupTestCase();
 
     void acceptNavigationRequest();
-    void infiniteLoopJS();
     void geolocationRequestJS();
     void loadFinished();
     void acceptNavigationRequestWithNewWindow();
@@ -128,6 +127,7 @@ private slots:
     void testStopScheduledPageRefresh();
     void findText();
     void supportedContentType();
+    void infiniteLoopJS();
     
 private:
     QWebView* m_view;
@@ -285,9 +285,9 @@ void tst_QWebPage::loadFinished()
     QSignalSpy spyLoadStarted(m_view, SIGNAL(loadStarted()));
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
-    m_view->setHtml(QString("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
-                            "<head><meta http-equiv='refresh' content='1'></head>foo \">"
-                            "<frame src=\"data:text/html,bar\"></frameset>"), QUrl());
+    m_view->page()->mainFrame()->load(QUrl("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
+                                           "<head><meta http-equiv='refresh' content='1'></head>foo \">"
+                                           "<frame src=\"data:text/html,bar\"></frameset>"));
     QTRY_COMPARE(spyLoadFinished.count(), 1);
 
     QTRY_VERIFY(spyLoadStarted.count() > 1);
@@ -295,8 +295,8 @@ void tst_QWebPage::loadFinished()
 
     spyLoadFinished.clear();
 
-    m_view->setHtml(QString("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
-                            "foo \"><frame src=\"data:text/html,bar\"></frameset>"), QUrl());
+    m_view->page()->mainFrame()->load(QUrl("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
+                                           "foo \"><frame src=\"data:text/html,bar\"></frameset>"));
     QTRY_COMPARE(spyLoadFinished.count(), 1);
     QCOMPARE(spyLoadFinished.count(), 1);
 }
@@ -1516,11 +1516,6 @@ void tst_QWebPage::inputMethods()
     QString selectionValue = variant.value<QString>();
     QCOMPARE(selectionValue, QString("eb"));
 
-    //Cancel current composition first
-    inputAttributes << QInputMethodEvent::Attribute(QInputMethodEvent::Selection, 0, 0, QVariant());
-    QInputMethodEvent eventSelection2("",inputAttributes);
-    page->event(&eventSelection2);
-
     //Set selection with negative length
     inputAttributes << QInputMethodEvent::Attribute(QInputMethodEvent::Selection, 6, -5, QVariant());
     QInputMethodEvent eventSelection3("",inputAttributes);
@@ -1887,7 +1882,8 @@ public:
     {
         ErrorPageExtensionReturn* errorPage = static_cast<ErrorPageExtensionReturn*>(output);
 
-        errorPage->content = "data:text/html,error";
+        errorPage->contentType = "text/html";
+        errorPage->content = "error";
         return true;
     }
 };
@@ -1904,7 +1900,7 @@ void tst_QWebPage::errorPageExtension()
 
     page->mainFrame()->setUrl(QUrl("http://non.existent/url"));
     QTRY_COMPARE(spyLoadFinished.count(), 2);
-    QCOMPARE(page->mainFrame()->toPlainText(), QString("data:text/html,error"));
+    QCOMPARE(page->mainFrame()->toPlainText(), QString("error"));
     QCOMPARE(page->history()->count(), 2);
     QCOMPARE(page->history()->currentItem().url(), QUrl("http://non.existent/url"));
     QCOMPARE(page->history()->canGoBack(), true);
@@ -1931,14 +1927,15 @@ void tst_QWebPage::errorPageExtensionInIFrames()
     ErrorPage* page = new ErrorPage;
     m_view->setPage(page);
 
-    m_view->setHtml(QString("data:text/html,"
-                            "<h1>h1</h1>"
-                            "<iframe src='data:text/html,<p/>p'></iframe>"
-                            "<iframe src='non-existent.html'></iframe>"));
+    m_view->page()->mainFrame()->load(QUrl(
+        "data:text/html,"
+        "<h1>h1</h1>"
+        "<iframe src='data:text/html,<p/>p'></iframe>"
+        "<iframe src='http://non.existent/url'></iframe>"));
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
     QTRY_COMPARE(spyLoadFinished.count(), 1);
 
-    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("data:text/html,error"));
+    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("error"));
 
     m_view->setPage(0);
 }
@@ -1952,7 +1949,7 @@ void tst_QWebPage::errorPageExtensionInFrameset()
 
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
     QTRY_COMPARE(spyLoadFinished.count(), 1);
-    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("data:text/html,error"));
+    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("error"));
 
     m_view->setPage(0);
 }
diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 0f4c32c..fb8f19e 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,151 @@
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * WebBackForwardList.cpp:
+        (backForwardListWrappers):
+        (WebBackForwardList::WebBackForwardList):
+        (WebBackForwardList::createInstance):
+        * WebBackForwardList.h:
+        * WebView.cpp:
+        (WebView::backForwardList):
+        Use BackForwardListImpl.
+
+2010-10-29  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebKitPrefix.h: Touched to force a rebuild.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidBecomeFrameset):
+
+2010-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix.
+
+        * WebView.cpp: Conditionalize includes for CFNetwork-specific
+        Cookie implementation.
+        * WebView.h: Conditionalize includes for ACCELERATED_COMPOSITION.
+        WinCairo doesn't use CoreAnimation.
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::transferLoadingResourceFromPage):
+        Empty method.
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
+2010-10-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Replace _countof with WTF_ARRAY_LENGTH
+        https://bugs.webkit.org/show_bug.cgi?id=48229
+
+        * WebCoreSupport/WebContextMenuClient.cpp:
+        (isPreInspectElementTagSafari):
+        * WebView.cpp:
+        (WebView::interpretKeyEvent):
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * Interfaces/WebKit.idl: Touched.
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Expose HitTestResult::absoluteMediaURL() via WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=48219
+
+        * Interfaces/IWebView.idl: Added WebElementMediaURLKey.
+        * WebElementPropertyBag.cpp:
+        (WebElementPropertyBag::Read): Map WebElementMediaURLKey to absoluteMediaURL().
+
+2010-10-22  Andy Estes  <aestes@apple.com>
+
+        Fix the Windows build.
+
+        * WebCookieManagerCFNet.cpp: Rename CookieStorageWin.h to CookieStorageCFNet.h.
+        * WebView.cpp: Ditto.
+
+2010-10-22  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Windows client needs updating when live iframe element is moved between pages
+        https://bugs.webkit.org/show_bug.cgi?id=46915
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::didTransferChildFrameToNewDocument):
+        Update WebView in WebFrame to match that of the current page.
+        * WebFrame.cpp:
+        (WebFrame::setWebView):
+        Added.
+        * WebFrame.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * WebCoreSupport/WebChromeClient.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::createWindow):
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchCreatePage):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        Add NavigationAction parameter.
+
+2010-10-21 MORITA Hajime  <morrita@google.com>
+
+        Unreviewed, touched it to fix the build.
+
+        * Interfaces/WebKit.idl:
+
+2010-10-21  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        [Win][DRT] should have LayoutTestController.hasSpellingMarker()
+        https://bugs.webkit.org/show_bug.cgi?id=47885
+
+        Added IWebFramePrivate::hasSpellingMarker() and impelmented it for
+        LayoutTestController.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        (WebFrame::hasSpellingMarker):
+        * WebFrame.h:
+
 2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by David Levin.
diff --git a/WebKit/win/Interfaces/IWebFramePrivate.idl b/WebKit/win/Interfaces/IWebFramePrivate.idl
index 190681c..279cbbf 100755
--- a/WebKit/win/Interfaces/IWebFramePrivate.idl
+++ b/WebKit/win/Interfaces/IWebFramePrivate.idl
@@ -117,4 +117,6 @@ interface IWebFramePrivate : IUnknown
     HRESULT resumeAnimations();
 
     HRESULT loadPlainTextString([in] BSTR string, [in] BSTR url);
+
+    HRESULT hasSpellingMarker([in] UINT from, [in] UINT length, [out, retval] BOOL* result);
 }
diff --git a/WebKit/win/Interfaces/IWebView.idl b/WebKit/win/Interfaces/IWebView.idl
index e3ec98a..6c414f8 100644
--- a/WebKit/win/Interfaces/IWebView.idl
+++ b/WebKit/win/Interfaces/IWebView.idl
@@ -82,6 +82,7 @@ const LPCOLESTR WebElementImageKey = L"WebElementImageKey";
 const LPCOLESTR WebElementImageRectKey = L"WebElementImageRectKey";
 const LPCOLESTR WebElementImageURLKey = L"WebElementImageURLKey";
 const LPCOLESTR WebElementIsSelectedKey = L"WebElementIsSelectedKey";
+const LPCOLESTR WebElementMediaURLKey = L"WebElementMediaURLKey";
 const LPCOLESTR WebElementSpellingToolTipKey = L"WebElementSpellingToolTipKey";
 const LPCOLESTR WebElementTitleKey = L"WebElementTitleKey";
 const LPCOLESTR WebElementLinkURLKey = L"WebElementLinkURLKey";
diff --git a/WebKit/win/Interfaces/WebKit.idl b/WebKit/win/Interfaces/WebKit.idl
index 470b052..e936af6 100644
--- a/WebKit/win/Interfaces/WebKit.idl
+++ b/WebKit/win/Interfaces/WebKit.idl
@@ -22,7 +22,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
-
+ 
 cpp_quote("/*")
 cpp_quote(" * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.")
 cpp_quote(" *")
@@ -300,4 +300,3 @@ library WebKit
         [default] interface IWebUserContentURLPattern;
     }
 }
-
diff --git a/WebKit/win/WebBackForwardList.cpp b/WebKit/win/WebBackForwardList.cpp
index e8c2930..2faaf7e 100644
--- a/WebKit/win/WebBackForwardList.cpp
+++ b/WebKit/win/WebBackForwardList.cpp
@@ -32,7 +32,7 @@
 #include "WebKit.h"
 #include "WebPreferences.h"
 
-#include <WebCore/BackForwardList.h>
+#include <WebCore/BackForwardListImpl.h>
 #include <WebCore/HistoryItem.h>
 
 using std::min;
@@ -40,13 +40,15 @@ using namespace WebCore;
 
 // WebBackForwardList ----------------------------------------------------------------
 
-static HashMap<BackForwardList*, WebBackForwardList*>& backForwardListWrappers()
+// FIXME: Instead of this we could just create a class derived from BackForwardListImpl
+// with a pointer to a WebBackForwardList in it.
+static HashMap<BackForwardListImpl*, WebBackForwardList*>& backForwardListWrappers()
 {
-    static HashMap<BackForwardList*, WebBackForwardList*> staticBackForwardListWrappers;
+    static HashMap<BackForwardListImpl*, WebBackForwardList*> staticBackForwardListWrappers;
     return staticBackForwardListWrappers;
 }
 
-WebBackForwardList::WebBackForwardList(PassRefPtr<BackForwardList> backForwardList)
+WebBackForwardList::WebBackForwardList(PassRefPtr<BackForwardListImpl> backForwardList)
     : m_refCount(0)
     , m_backForwardList(backForwardList)
 {
@@ -68,7 +70,7 @@ WebBackForwardList::~WebBackForwardList()
     gClassNameCount.remove("WebBackForwardList");
 }
 
-WebBackForwardList* WebBackForwardList::createInstance(PassRefPtr<BackForwardList> backForwardList)
+WebBackForwardList* WebBackForwardList::createInstance(PassRefPtr<BackForwardListImpl> backForwardList)
 {
     WebBackForwardList* instance;
 
diff --git a/WebKit/win/WebBackForwardList.h b/WebKit/win/WebBackForwardList.h
index 9375193..aebfa15 100644
--- a/WebKit/win/WebBackForwardList.h
+++ b/WebKit/win/WebBackForwardList.h
@@ -34,15 +34,15 @@
 #include <WTF/RefPtr.h>
 
 namespace WebCore {
-    class BackForwardList;
+    class BackForwardListImpl;
 }
 
 class WebBackForwardList : public IWebBackForwardList, IWebBackForwardListPrivate
 {
 public:
-    static WebBackForwardList* createInstance(PassRefPtr<WebCore::BackForwardList>);
+    static WebBackForwardList* createInstance(PassRefPtr<WebCore::BackForwardListImpl>);
 protected:
-    WebBackForwardList(PassRefPtr<WebCore::BackForwardList>);
+    WebBackForwardList(PassRefPtr<WebCore::BackForwardListImpl>);
     ~WebBackForwardList();
 
 public:
@@ -109,7 +109,7 @@ public:
 
 protected:
     ULONG m_refCount;
-    RefPtr<WebCore::BackForwardList> m_backForwardList;
+    RefPtr<WebCore::BackForwardListImpl> m_backForwardList;
 };
 
 #endif
diff --git a/WebKit/win/WebCookieManagerCFNet.cpp b/WebKit/win/WebCookieManagerCFNet.cpp
index 415a679..c2ef493 100644
--- a/WebKit/win/WebCookieManagerCFNet.cpp
+++ b/WebKit/win/WebCookieManagerCFNet.cpp
@@ -28,7 +28,7 @@
 #include "WebCookieManager.h"
 
 #include <CFNetwork/CFHTTPCookiesPriv.h>
-#include <WebCore/CookieStorageWin.h>
+#include <WebCore/CookieStorageCFNet.h>
 
 using namespace WebCore;
 
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.cpp b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
index 7a025a7..b1332ed 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
@@ -38,7 +38,6 @@
 #include "WebDesktopNotificationsDelegate.h"
 #include "WebSecurityOrigin.h"
 #include "WebView.h"
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/Console.h>
 #include <WebCore/ContextMenu.h>
@@ -48,23 +47,23 @@
 #include <WebCore/FrameLoadRequest.h>
 #include <WebCore/FrameView.h>
 #include <WebCore/Geolocation.h>
-#if USE(ACCELERATED_COMPOSITING)
-#include <WebCore/GraphicsLayer.h>
-#endif
 #include <WebCore/HTMLNames.h>
 #include <WebCore/Icon.h>
 #include <WebCore/LocalWindowsContext.h>
 #include <WebCore/LocalizedStrings.h>
+#include <WebCore/NavigationAction.h>
 #include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/SecurityOrigin.h>
 #include <WebCore/PopupMenuWin.h>
 #include <WebCore/SearchPopupMenuWin.h>
 #include <WebCore/WindowFeatures.h>
-#pragma warning(pop)
-
 #include <tchar.h>
 
+#if USE(ACCELERATED_COMPOSITING)
+#include <WebCore/GraphicsLayer.h>
+#endif
+
 using namespace WebCore;
 
 // When you call GetOpenFileName, if the size of the buffer is too small,
@@ -195,7 +194,7 @@ static COMPtr<IPropertyBag> createWindowFeaturesPropertyBag(const WindowFeatures
     return COMPtr<IPropertyBag>(AdoptCOM, COMPropertyBag<COMVariant>::adopt(map));
 }
 
-Page* WebChromeClient::createWindow(Frame*, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& features)
+Page* WebChromeClient::createWindow(Frame*, const FrameLoadRequest& frameLoadRequest, const WindowFeatures& features, const NavigationAction&)
 {
     COMPtr<IWebUIDelegate> delegate = uiDelegate();
     if (!delegate)
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.h b/WebKit/win/WebCoreSupport/WebChromeClient.h
index 5a796eb..5167c06 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -58,7 +58,7 @@ public:
 
     virtual void focusedNodeChanged(WebCore::Node*);
 
-    virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
+    virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&);
     virtual void show();
 
     virtual bool canRunModal();
diff --git a/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp b/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
index ab1f79e..24178f2 100644
--- a/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
@@ -60,7 +60,7 @@ static bool isPreInspectElementTagSafari(IWebUIDelegate* uiDelegate)
         return false;
 
     TCHAR modulePath[MAX_PATH];
-    DWORD length = ::GetModuleFileName(0, modulePath, _countof(modulePath));
+    DWORD length = ::GetModuleFileName(0, modulePath, WTF_ARRAY_LENGTH(modulePath));
     if (!length)
         return false;
 
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index ffc41b2..6591347 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -426,7 +426,7 @@ void WebFrameLoaderClient::dispatchDidFirstVisuallyNonEmptyLayout()
         frameLoadDelegatePrivate->didFirstVisuallyNonEmptyLayoutInFrame(webView, m_webFrame);
 }
 
-Frame* WebFrameLoaderClient::dispatchCreatePage()
+Frame* WebFrameLoaderClient::dispatchCreatePage(const NavigationAction&)
 {
     WebView* webView = m_webFrame->webView();
 
@@ -714,6 +714,10 @@ void WebFrameLoaderClient::transitionToCommittedForNewPage()
     core(m_webFrame)->createView(IntRect(rect).size(), backgroundColor, transparent, IntSize(), false);
 }
 
+void WebFrameLoaderClient::dispatchDidBecomeFrameset(bool)
+{
+}
+
 bool WebFrameLoaderClient::canCachePage() const
 {
     return true;
@@ -730,6 +734,15 @@ PassRefPtr<Frame> WebFrameLoaderClient::createFrame(const KURL& url, const Strin
 
 void WebFrameLoaderClient::didTransferChildFrameToNewDocument(Page*)
 {
+    Frame* coreFrame = core(m_webFrame);
+    ASSERT(coreFrame);
+    WebView* webView = kit(coreFrame->page());
+    if (m_webFrame->webView() != webView)
+        m_webFrame->setWebView(webView);
+}
+
+void WebFrameLoaderClient::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
 }
 
 PassRefPtr<Frame> WebFrameLoaderClient::createFrame(const KURL& URL, const String& name, HTMLFrameOwnerElement* ownerElement, const String& referrer)
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
index 7ec344c..981daec 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
@@ -78,7 +78,7 @@ public:
     virtual void dispatchDidFirstLayout();
     virtual void dispatchDidFirstVisuallyNonEmptyLayout();
 
-    virtual WebCore::Frame* dispatchCreatePage();
+    virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
 
     virtual void dispatchDidLoadMainResource(WebCore::DocumentLoader*);
@@ -108,11 +108,14 @@ public:
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedForNewPage();
 
+    virtual void dispatchDidBecomeFrameset(bool);
+
     virtual bool canCachePage() const;
 
     virtual PassRefPtr<WebCore::Frame> createFrame(const WebCore::KURL& url, const WTF::String& name, WebCore::HTMLFrameOwnerElement* ownerElement,
                                const WTF::String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
     virtual void didTransferChildFrameToNewDocument(WebCore::Page*);
+    virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page*);
     virtual PassRefPtr<WebCore::Widget> createPlugin(const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&, const Vector<WTF::String>&, const Vector<WTF::String>&, const WTF::String&, bool loadManually);
     virtual void redirectDataToPlugin(WebCore::Widget* pluginWidget);
 
diff --git a/WebKit/win/WebElementPropertyBag.cpp b/WebKit/win/WebElementPropertyBag.cpp
index e68b92e..e68360c 100644
--- a/WebKit/win/WebElementPropertyBag.cpp
+++ b/WebKit/win/WebElementPropertyBag.cpp
@@ -159,7 +159,10 @@ HRESULT STDMETHODCALLTYPE WebElementPropertyBag::Read(LPCOLESTR pszPropName, VAR
         else
             V_BOOL(pVar) = VARIANT_FALSE;
         return S_OK;
-    } else if (isEqual(WebElementSpellingToolTipKey, key)) {
+    }
+    if (isEqual(WebElementMediaURLKey, key))
+        return convertStringToVariant(pVar, m_result->absoluteMediaURL().string());
+    if (isEqual(WebElementSpellingToolTipKey, key)) {
         TextDirection dir;
         return convertStringToVariant(pVar, m_result->spellingToolTip(dir));
     } else if (isEqual(WebElementTitleKey, key)) {
diff --git a/WebKit/win/WebFrame.cpp b/WebKit/win/WebFrame.cpp
index 8dfe8bb..9db6a2a 100644
--- a/WebKit/win/WebFrame.cpp
+++ b/WebKit/win/WebFrame.cpp
@@ -1019,6 +1019,18 @@ HRESULT STDMETHODCALLTYPE WebFrame::unused2()
     return E_NOTIMPL;
 }
 
+HRESULT STDMETHODCALLTYPE WebFrame::hasSpellingMarker(
+        /* [in] */ UINT from,
+        /* [in] */ UINT length,
+        /* [retval][out] */ BOOL* result)
+{
+    Frame* coreFrame = core(this);
+    if (!coreFrame)
+        return E_FAIL;
+    *result = coreFrame->editor()->selectionStartHasSpellingMarkerFor(from, length);
+    return S_OK;
+}
+
 // IWebDocumentText -----------------------------------------------------------
 
 HRESULT STDMETHODCALLTYPE WebFrame::supportsTextEncoding( 
@@ -2574,6 +2586,11 @@ WebView* WebFrame::webView() const
     return d->webView;
 }
 
+void WebFrame::setWebView(WebView* webView)
+{
+    d->webView = webView;
+}
+
 COMPtr<IAccessible> WebFrame::accessible() const
 {
     Frame* coreFrame = core(this);
diff --git a/WebKit/win/WebFrame.h b/WebKit/win/WebFrame.h
index 147daa8..bdc28ab 100644
--- a/WebKit/win/WebFrame.h
+++ b/WebKit/win/WebFrame.h
@@ -273,6 +273,11 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE layerTreeAsText(BSTR*);
 
+    virtual HRESULT STDMETHODCALLTYPE hasSpellingMarker(
+        /* [in] */ UINT from,
+        /* [in] */ UINT length,
+        /* [retval][out] */ BOOL *result);
+
     // IWebDocumentText
     virtual HRESULT STDMETHODCALLTYPE supportsTextEncoding( 
         /* [retval][out] */ BOOL* result);
@@ -371,6 +376,7 @@ public:
     WebCore::KURL url() const;
 
     WebView* webView() const;
+    void setWebView(WebView*);
 
     COMPtr<IAccessible> accessible() const;
 
diff --git a/WebKit/win/WebKitPrefix.h b/WebKit/win/WebKitPrefix.h
index 9b2fc85..5c2001f 100644
--- a/WebKit/win/WebKitPrefix.h
+++ b/WebKit/win/WebKitPrefix.h
@@ -34,7 +34,7 @@
 #define WINVER 0x0500
 #endif
 
-// If we don't define these, they get defined in windef.h. 
+// If we don't define these, they get defined in windef.h.
 // We want to use std::min and std::max.
 #ifndef max
 #define max max
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index b57e06a..fb62809 100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -67,13 +67,12 @@
 #include <WebCore/AXObjectCache.h>
 #include <WebCore/ApplicationCacheStorage.h>
 #include <WebCore/BString.h>
-#include <WebCore/BackForwardList.h>
+#include <WebCore/BackForwardListImpl.h>
 #include <WebCore/BitmapInfo.h>
 #include <WebCore/Cache.h>
 #include <WebCore/Chrome.h>
 #include <WebCore/ContextMenu.h>
 #include <WebCore/ContextMenuController.h>
-#include <WebCore/CookieStorageWin.h>
 #include <WebCore/Cursor.h>
 #include <WebCore/Document.h>
 #include <WebCore/DragController.h>
@@ -148,6 +147,7 @@
 #if USE(CFNETWORK)
 #include <CFNetwork/CFURLCachePriv.h>
 #include <CFNetwork/CFURLProtocolPriv.h>
+#include <WebCore/CookieStorageCFNet.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h> 
 #endif
 
@@ -1833,10 +1833,10 @@ const char* WebView::interpretKeyEvent(const KeyboardEvent* evt)
         keyDownCommandsMap = new HashMap<int, const char*>;
         keyPressCommandsMap = new HashMap<int, const char*>;
 
-        for (unsigned i = 0; i < _countof(keyDownEntries); i++)
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyDownEntries); ++i)
             keyDownCommandsMap->set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey, keyDownEntries[i].name);
 
-        for (unsigned i = 0; i < _countof(keyPressEntries); i++)
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyPressEntries); ++i)
             keyPressCommandsMap->set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode, keyPressEntries[i].name);
     }
 
@@ -2870,13 +2870,14 @@ HRESULT STDMETHODCALLTYPE WebView::focusedFrame(
 
     return webFrame->QueryInterface(IID_IWebFrame, (void**) frame);
 }
+
 HRESULT STDMETHODCALLTYPE WebView::backForwardList( 
     /* [out][retval] */ IWebBackForwardList** list)
 {
     if (!m_useBackForwardList)
         return E_FAIL;
  
-    *list = WebBackForwardList::createInstance(m_page->backForwardList());
+    *list = WebBackForwardList::createInstance(static_cast<WebCore::BackForwardListImpl*>(m_page->backForwardList()));
 
     return S_OK;
 }
diff --git a/WebKit/win/WebView.h b/WebKit/win/WebView.h
index 61eb946..424b03a 100644
--- a/WebKit/win/WebView.h
+++ b/WebKit/win/WebView.h
@@ -35,12 +35,15 @@
 #include <WebCore/RefCountedGDIHandle.h>
 #include <WebCore/SuspendableTimer.h>
 #include <WebCore/WindowMessageListener.h>
-#include <WebCore/WKCACFLayer.h>
-#include <WebCore/WKCACFLayerRenderer.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
+#if USE(ACCELERATED_COMPOSITING)
+#include <WebCore/WKCACFLayer.h>
+#include <WebCore/WKCACFLayerRenderer.h>
+#endif
+
 class FullscreenVideoController;
 class WebBackForwardList;
 class WebFrame;
diff --git a/WebKit/wince/ChangeLog b/WebKit/wince/ChangeLog
index 8d99b5c..bbf5d59 100644
--- a/WebKit/wince/ChangeLog
+++ b/WebKit/wince/ChangeLog
@@ -1,3 +1,68 @@
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::dispatchDidBecomeFrameset):
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::transferLoadingResourceFromPage):
+        Empty method.
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+
+2010-10-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Replace _countof with WTF_ARRAY_LENGTH
+        https://bugs.webkit.org/show_bug.cgi?id=48229
+
+        * WebCoreSupport/EditorClientWinCE.cpp:
+        (WebKit::EditorClientWinCE::interpretKeyEvent):
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebCoreSupport/ChromeClientWinCE.cpp:
+        (WebKit::ChromeClientWinCE::createWindow):
+        * WebCoreSupport/ChromeClientWinCE.h:
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::dispatchCreatePage):
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+        Add NavigationAction parameter.
+
+2010-10-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Implement EditorClient::handleKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=48118
+
+        Copy the implementation from the EFL port.
+
+        * WebCoreSupport/EditorClientWinCE.cpp:
+        (WebKit::EditorClientWinCE::interpretKeyEvent):
+        (WebKit::EditorClientWinCE::handleEditingKeyboardEvent):
+        (WebKit::EditorClientWinCE::handleKeyboardEvent):
+        * WebCoreSupport/EditorClientWinCE.h:
+
 2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
 
         Reviewed by Dirk Schulze.
diff --git a/WebKit/wince/WebCoreSupport/ChromeClientWinCE.cpp b/WebKit/wince/WebCoreSupport/ChromeClientWinCE.cpp
index 468d86c..c99635a 100644
--- a/WebKit/wince/WebCoreSupport/ChromeClientWinCE.cpp
+++ b/WebKit/wince/WebCoreSupport/ChromeClientWinCE.cpp
@@ -28,6 +28,7 @@
 #include "FileChooser.h"
 #include "Icon.h"
 #include "NotImplemented.h"
+#include "NavigationAction.h"
 #include "PopupMenuWin.h"
 #include "SearchPopupMenuWin.h"
 #include "WebView.h"
@@ -83,7 +84,7 @@ void ChromeClientWinCE::unfocus()
     notImplemented();
 }
 
-Page* ChromeClientWinCE::createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&)
+Page* ChromeClientWinCE::createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&, const NavigationAction&)
 {
     notImplemented();
     return 0;
diff --git a/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h b/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
index be9f643..3818ce0 100644
--- a/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
+++ b/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
@@ -56,7 +56,7 @@ public:
     // Frame wants to create the new Page.  Also, the newly created window
     // should not be shown to the user until the ChromeClient of the newly
     // created Page has its show method called.
-    virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
+    virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, const WebCore::NavigationAction&);
     virtual void show();
 
     virtual bool canRunModal();
diff --git a/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp b/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp
index a806cf9..7dee562 100644
--- a/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp
+++ b/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp
@@ -1,32 +1,35 @@
 /*
- * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *  Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ *  Copyright (C) 2008 Nuanti Ltd.
+ *  Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
+ *  Copyright (C) 2009-2010 ProFUSION embedded systems
+ *  Copyright (C) 2009-2010 Samsung Electronics
+ *  Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
 #include "config.h"
 #include "EditorClientWinCE.h"
 
 #include "EditCommand.h"
+#include "Frame.h"
+#include "KeyboardEvent.h"
 #include "NotImplemented.h"
+#include "PlatformKeyboardEvent.h"
+#include "Settings.h"
 
 using namespace WebCore;
 
@@ -217,9 +220,191 @@ void EditorClientWinCE::toggleGrammarChecking()
     notImplemented();
 }
 
+static const unsigned CtrlKey = 1 << 0;
+static const unsigned AltKey = 1 << 1;
+static const unsigned ShiftKey = 1 << 2;
+
+struct KeyDownEntry {
+    unsigned virtualKey;
+    unsigned modifiers;
+    const char* name;
+};
+
+struct KeyPressEntry {
+    unsigned charCode;
+    unsigned modifiers;
+    const char* name;
+};
+
+static const KeyDownEntry keyDownEntries[] = {
+    { VK_LEFT,   0,                  "MoveLeft"                                    },
+    { VK_LEFT,   ShiftKey,           "MoveLeftAndModifySelection"                  },
+    { VK_LEFT,   CtrlKey,            "MoveWordLeft"                                },
+    { VK_LEFT,   CtrlKey | ShiftKey, "MoveWordLeftAndModifySelection"              },
+    { VK_RIGHT,  0,                  "MoveRight"                                   },
+    { VK_RIGHT,  ShiftKey,           "MoveRightAndModifySelection"                 },
+    { VK_RIGHT,  CtrlKey,            "MoveWordRight"                               },
+    { VK_RIGHT,  CtrlKey | ShiftKey, "MoveWordRightAndModifySelection"             },
+    { VK_UP,     0,                  "MoveUp"                                      },
+    { VK_UP,     ShiftKey,           "MoveUpAndModifySelection"                    },
+    { VK_PRIOR,  ShiftKey,           "MovePageUpAndModifySelection"                },
+    { VK_DOWN,   0,                  "MoveDown"                                    },
+    { VK_DOWN,   ShiftKey,           "MoveDownAndModifySelection"                  },
+    { VK_NEXT,   ShiftKey,           "MovePageDownAndModifySelection"              },
+    { VK_PRIOR,  0,                  "MovePageUp"                                  },
+    { VK_NEXT,   0,                  "MovePageDown"                                },
+    { VK_HOME,   0,                  "MoveToBeginningOfLine"                       },
+    { VK_HOME,   ShiftKey,           "MoveToBeginningOfLineAndModifySelection"     },
+    { VK_HOME,   CtrlKey,            "MoveToBeginningOfDocument"                   },
+    { VK_HOME,   CtrlKey | ShiftKey, "MoveToBeginningOfDocumentAndModifySelection" },
+
+    { VK_END,    0,                  "MoveToEndOfLine"                             },
+    { VK_END,    ShiftKey,           "MoveToEndOfLineAndModifySelection"           },
+    { VK_END,    CtrlKey,            "MoveToEndOfDocument"                         },
+    { VK_END,    CtrlKey | ShiftKey, "MoveToEndOfDocumentAndModifySelection"       },
+
+    { VK_BACK,   0,                  "DeleteBackward"                              },
+    { VK_BACK,   ShiftKey,           "DeleteBackward"                              },
+    { VK_DELETE, 0,                  "DeleteForward"                               },
+    { VK_BACK,   CtrlKey,            "DeleteWordBackward"                          },
+    { VK_DELETE, CtrlKey,            "DeleteWordForward"                           },
+
+    { 'B',       CtrlKey,            "ToggleBold"                                  },
+    { 'I',       CtrlKey,            "ToggleItalic"                                },
+
+    { VK_ESCAPE, 0,                  "Cancel"                                      },
+    { VK_TAB,    0,                  "InsertTab"                                   },
+    { VK_TAB,    ShiftKey,           "InsertBacktab"                               },
+    { VK_RETURN, 0,                  "InsertNewline"                               },
+    { VK_RETURN, CtrlKey,            "InsertNewline"                               },
+    { VK_RETURN, AltKey,             "InsertNewline"                               },
+    { VK_RETURN, AltKey | ShiftKey,  "InsertNewline"                               },
+
+    // It's not quite clear whether clipboard shortcuts and Undo/Redo should be handled
+    // in the application or in WebKit. We chose WebKit for now.
+    { 'C',       CtrlKey,            "Copy"                                        },
+    { 'V',       CtrlKey,            "Paste"                                       },
+    { 'X',       CtrlKey,            "Cut"                                         },
+    { 'A',       CtrlKey,            "SelectAll"                                   },
+    { VK_INSERT, CtrlKey,            "Copy"                                        },
+    { VK_DELETE, ShiftKey,           "Cut"                                         },
+    { VK_INSERT, ShiftKey,           "Paste"                                       },
+    { 'Z',       CtrlKey,            "Undo"                                        },
+    { 'Z',       CtrlKey | ShiftKey, "Redo"                                        }
+};
+
+static const KeyPressEntry keyPressEntries[] = {
+    { '\t',   0,                  "InsertTab"                                   },
+    { '\t',   ShiftKey,           "InsertBacktab"                               },
+    { '\r',   0,                  "InsertNewline"                               },
+    { '\r',   CtrlKey,            "InsertNewline"                               },
+    { '\r',   AltKey,             "InsertNewline"                               },
+    { '\r',   AltKey | ShiftKey,  "InsertNewline"                               }
+};
+
+const char* EditorClientWinCE::interpretKeyEvent(const KeyboardEvent* event)
+{
+    ASSERT(event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent);
+
+    static HashMap<int, const char*>* keyDownCommandsMap = 0;
+    static HashMap<int, const char*>* keyPressCommandsMap = 0;
+
+    if (!keyDownCommandsMap) {
+        keyDownCommandsMap = new HashMap<int, const char*>;
+        keyPressCommandsMap = new HashMap<int, const char*>;
+
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyDownEntries); ++i)
+            keyDownCommandsMap->set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey, keyDownEntries[i].name);
+
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyPressEntries); ++i)
+            keyPressCommandsMap->set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode, keyPressEntries[i].name);
+    }
+
+    unsigned modifiers = 0;
+    if (event->shiftKey())
+        modifiers |= ShiftKey;
+    if (event->altKey())
+        modifiers |= AltKey;
+    if (event->ctrlKey())
+        modifiers |= CtrlKey;
+
+    if (event->type() == eventNames().keydownEvent) {
+        int mapKey = modifiers << 16 | event->keyCode();
+        return mapKey ? keyDownCommandsMap->get(mapKey) : 0;
+    }
+
+    int mapKey = modifiers << 16 | event->charCode();
+    return mapKey ? keyPressCommandsMap->get(mapKey) : 0;
+}
+
+bool EditorClientWinCE::handleEditingKeyboardEvent(KeyboardEvent* event)
+{
+    Node* node = event->target()->toNode();
+    ASSERT(node);
+    Frame* frame = node->document()->frame();
+    ASSERT(frame);
+
+    const PlatformKeyboardEvent* keyEvent = event->keyEvent();
+    if (!keyEvent)
+        return false;
+
+    bool caretBrowsing = frame->settings()->caretBrowsingEnabled();
+    if (caretBrowsing) {
+        switch (keyEvent->windowsVirtualKeyCode()) {
+        case VK_LEFT:
+            frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::AlterationExtend : SelectionController::AlterationMove,
+                    SelectionController::DirectionLeft,
+                    keyEvent->ctrlKey() ? WordGranularity : CharacterGranularity,
+                    true);
+            return true;
+        case VK_RIGHT:
+            frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::AlterationExtend : SelectionController::AlterationMove,
+                    SelectionController::DirectionRight,
+                    keyEvent->ctrlKey() ? WordGranularity : CharacterGranularity,
+                    true);
+            return true;
+        case VK_UP:
+            frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::AlterationExtend : SelectionController::AlterationMove,
+                    SelectionController::DirectionBackward,
+                    keyEvent->ctrlKey() ? ParagraphGranularity : LineGranularity,
+                    true);
+            return true;
+        case VK_DOWN:
+            frame->selection()->modify(keyEvent->shiftKey() ? SelectionController::AlterationExtend : SelectionController::AlterationMove,
+                    SelectionController::DirectionForward,
+                    keyEvent->ctrlKey() ? ParagraphGranularity : LineGranularity,
+                    true);
+            return true;
+        }
+    }
+
+    Editor::Command command = frame->editor()->command(interpretKeyEvent(event));
+
+    if (keyEvent->type() == PlatformKeyboardEvent::RawKeyDown) {
+        // WebKit doesn't have enough information about mode to decide how commands that just insert text if executed via Editor should be treated,
+        // so we leave it upon WebCore to either handle them immediately (e.g. Tab that changes focus) or let a keypress event be generated
+        // (e.g. Tab that inserts a Tab character, or Enter).
+        return !command.isTextInsertion() && command.execute(event);
+    }
+
+    if (command.execute(event))
+        return true;
+
+    // Don't insert null or control characters as they can result in unexpected behaviour
+    if (event->charCode() < ' ')
+        return false;
+
+    // Don't insert anything if a modifier is pressed
+    if (keyEvent->ctrlKey() || keyEvent->altKey())
+        return false;
+
+    return frame->editor()->insertText(event->keyEvent()->text(), event);
+}
+
 void EditorClientWinCE::handleKeyboardEvent(KeyboardEvent* event)
 {
-    notImplemented();
+    if (handleEditingKeyboardEvent(event))
+        event->setDefaultHandled();
 }
 
 void EditorClientWinCE::handleInputMethodKeydown(KeyboardEvent* event)
diff --git a/WebKit/wince/WebCoreSupport/EditorClientWinCE.h b/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
index 0ad0a19..be85b3f 100644
--- a/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
+++ b/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
@@ -76,6 +76,8 @@ public:
     virtual void undo();
     virtual void redo();
 
+    virtual const char* interpretKeyEvent(const WebCore::KeyboardEvent*);
+    virtual bool handleEditingKeyboardEvent(WebCore::KeyboardEvent*);
     virtual void handleKeyboardEvent(WebCore::KeyboardEvent*);
     virtual void handleInputMethodKeydown(WebCore::KeyboardEvent*);
 
diff --git a/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp b/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
index e841ab9..0b95213 100644
--- a/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
+++ b/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
@@ -165,6 +165,10 @@ void FrameLoaderClientWinCE::didTransferChildFrameToNewDocument(Page*)
 {
 }
 
+void FrameLoaderClientWinCE::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
+}
+
 void FrameLoaderClientWinCE::redirectDataToPlugin(Widget* pluginWidget)
 {
     ASSERT(!m_pluginView);
@@ -557,7 +561,7 @@ bool FrameLoaderClientWinCE::canCachePage() const
     return true;
 }
 
-Frame* FrameLoaderClientWinCE::dispatchCreatePage()
+Frame* FrameLoaderClientWinCE::dispatchCreatePage(const NavigationAction&)
 {
     notImplemented();
     return 0;
@@ -626,6 +630,10 @@ void FrameLoaderClientWinCE::transitionToCommittedForNewPage()
         m_frame->ownerRenderer()->setWidget(frameView);
 }
 
+void FrameLoaderClientWinCE::dispatchDidBecomeFrameset(bool)
+{
+}
+
 PassRefPtr<WebCore::FrameNetworkingContext> FrameLoaderClientWinCE::createNetworkingContext()
 {
     return FrameNetworkingContextWinCE::create(m_frame, userAgent(KURL()));
diff --git a/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h b/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
index b64efed..46b3a19 100644
--- a/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
+++ b/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
@@ -85,7 +85,7 @@ public:
     virtual void dispatchDidFirstLayout();
     virtual void dispatchDidFirstVisuallyNonEmptyLayout();
 
-    virtual WebCore::Frame* dispatchCreatePage();
+    virtual WebCore::Frame* dispatchCreatePage(const WebCore::NavigationAction&);
     virtual void dispatchShow();
 
     virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction, const WTF::String& MIMEType, const WebCore::ResourceRequest&);
@@ -109,6 +109,7 @@ public:
     virtual PassRefPtr<WebCore::Frame> createFrame(const WebCore::KURL& url, const WTF::String& name, WebCore::HTMLFrameOwnerElement* ownerElement,
                                const WTF::String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
     virtual void didTransferChildFrameToNewDocument(WebCore::Page*);
+    virtual void transferLoadingResourceFromPage(unsigned long, WebCore::DocumentLoader*, const WebCore::ResourceRequest&, WebCore::Page*);
     virtual PassRefPtr<WebCore::Widget> createPlugin(const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&, const WTF::Vector<WTF::String>&, const WTF::Vector<WTF::String>&, const WTF::String&, bool);
     virtual void redirectDataToPlugin(WebCore::Widget* pluginWidget);
     virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(const WebCore::IntSize&, WebCore::HTMLAppletElement*, const WebCore::KURL& baseURL, const WTF::Vector<WTF::String>& paramNames, const WTF::Vector<WTF::String>& paramValues);
@@ -174,6 +175,8 @@ public:
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedForNewPage();
 
+    virtual void dispatchDidBecomeFrameset(bool);
+
     virtual bool canCachePage() const;
     virtual void download(WebCore::ResourceHandle*, const WebCore::ResourceRequest&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&);
 
diff --git a/WebKit/wx/ChangeLog b/WebKit/wx/ChangeLog
index b7ec1f6..123b839 100644
--- a/WebKit/wx/ChangeLog
+++ b/WebKit/wx/ChangeLog
@@ -1,3 +1,54 @@
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change BackForwardList clients to use BackForwardListImpl to prepare for further refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=48574
+
+        * WebFrame.cpp:
+        (wxWebFrame::CanGoBack): Use canGoBackOrForward.
+        (wxWebFrame::CanGoForward): Ditto.
+
+2010-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48576
+        Let WebKit2 client know when a frame is a frameset
+
+        Added a blank implementation of the new FrameLoaderClient method.
+
+        * WebKitSupport/FrameLoaderClientWx.h:
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchDidBecomeFrameset):
+
+2010-10-26  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Resource tracking failure when trying to move a frame between documents
+        https://bugs.webkit.org/show_bug.cgi?id=44713
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::transferLoadingResourceFromPage):
+        Empty method.
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2010-10-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs to pass the current event modifier flags when requesting a new window
+        https://bugs.webkit.org/show_bug.cgi?id=48140
+
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::createWindow):
+        * WebKitSupport/ChromeClientWx.h:
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchCreatePage):
+        * WebKitSupport/FrameLoaderClientWx.h:
+        Add NavigationAction parameter.
+
 2010-10-13  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/WebKit/wx/WebFrame.cpp b/WebKit/wx/WebFrame.cpp
index 1c2eebd..1d5f03a 100644
--- a/WebKit/wx/WebFrame.cpp
+++ b/WebKit/wx/WebFrame.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "BackForwardList.h"
+
 #include "Document.h"
 #include "Editor.h"
 #include "Element.h"
@@ -318,16 +318,16 @@ bool wxWebFrame::GoForward()
 
 bool wxWebFrame::CanGoBack()
 {
-    if (m_impl->frame && m_impl->frame->page() && m_impl->frame->page()->backForwardList())
-        return m_impl->frame->page()->backForwardList()->backItem() != NULL;
+    if (m_impl->frame && m_impl->frame->page())
+        return m_impl->frame->page()->canGoBackOrForward(-1);
 
     return false;
 }
 
 bool wxWebFrame::CanGoForward()
 {
-    if (m_impl->frame && m_impl->frame->page() && m_impl->frame->page()->backForwardList())
-        return m_impl->frame->page()->backForwardList()->forwardItem() != NULL;
+    if (m_impl->frame && m_impl->frame->page())
+        return m_impl->frame->page()->canGoBackOrForward(1);
 
     return false;
 }
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
index 11c5643..97b98cf 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
@@ -37,6 +37,7 @@
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "Icon.h"
+#include "NavigationAction.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -136,7 +137,7 @@ void ChromeClientWx::focusedNodeChanged(Node*)
 {
 }
 
-Page* ChromeClientWx::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features)
+Page* ChromeClientWx::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features, const NavigationAction&)
 {
     Page* myPage = 0;
     wxWebViewNewWindowEvent wkEvent(m_webView);
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.h b/WebKit/wx/WebKitSupport/ChromeClientWx.h
index 5b60446..755beb7 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.h
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.h
@@ -57,7 +57,7 @@ public:
 
     virtual void focusedNodeChanged(Node*);
 
-    virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&);
+    virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&, const NavigationAction&);
     virtual Page* createModalDialog(Frame*, const FrameLoadRequest&);
     virtual void show();
 
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index 7963ef9..8748a98 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -766,7 +766,7 @@ void FrameLoaderClientWx::dispatchDidFailLoad(const ResourceError&)
     notImplemented();
 }
 
-Frame* FrameLoaderClientWx::dispatchCreatePage()
+Frame* FrameLoaderClientWx::dispatchCreatePage(const NavigationAction&)
 {
     notImplemented();
     return false;
@@ -863,6 +863,10 @@ void FrameLoaderClientWx::didTransferChildFrameToNewDocument(Page*)
 {
 }
 
+void FrameLoaderClientWx::transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*)
+{
+}
+
 ObjectContentType FrameLoaderClientWx::objectContentType(const KURL& url, const String& mimeType)
 {
     notImplemented();
@@ -962,6 +966,10 @@ void FrameLoaderClientWx::transitionToCommittedForNewPage()
         m_frame->createView(size, backgroundColor, transparent, IntSize(), false); 
 }
 
+void FrameLoaderClientWx::dispatchDidBecomeFrameset(bool)
+{
+}
+
 bool FrameLoaderClientWx::shouldUsePluginDocument(const String &mimeType) const
 {
     // NOTE: Plugin Documents are used for viewing PDFs, etc. inline, and should
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
index 9c260fe..cb34b0f 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
@@ -152,6 +152,8 @@ namespace WebCore {
         virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
         virtual void transitionToCommittedForNewPage();
         
+        virtual void dispatchDidBecomeFrameset(bool);
+
         virtual void updateGlobalHistory();
         virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(HistoryItem*) const;
@@ -190,7 +192,7 @@ namespace WebCore {
 
         virtual void dispatchDidFailProvisionalLoad(const ResourceError&);
         virtual void dispatchDidFailLoad(const ResourceError&);
-        virtual Frame* dispatchCreatePage();
+        virtual Frame* dispatchCreatePage(const WebCore::NavigationAction&);
         virtual void dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const String&, const ResourceRequest&);
         virtual void dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String&);
         virtual void dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>);
@@ -204,6 +206,7 @@ namespace WebCore {
         virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
         virtual void didTransferChildFrameToNewDocument(Page*);
+        virtual void transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*);
         virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) ;
         virtual void redirectDataToPlugin(Widget* pluginWidget);
         virtual ResourceError pluginWillHandleLoadError(const ResourceResponse&);
author	John Reck <jreck@google.com>	2010-11-04 12:00:17 -0700
committer	John Reck <jreck@google.com>	2010-11-09 11:35:04 -0800
commit	e14391e94c850b8bd03680c23b38978db68687a8 (patch)
tree	3fed87e6620fecaf3edc7259ae58a11662bedcb2 /WebKit
parent	1bd705833a68f07850cf7e204b26f8d328d16951 (diff)
download	external_webkit-e14391e94c850b8bd03680c23b38978db68687a8.zip external_webkit-e14391e94c850b8bd03680c23b38978db68687a8.tar.gz external_webkit-e14391e94c850b8bd03680c23b38978db68687a8.tar.bz2