Merge from Chromium at DEPS revision 257591

This commit was generated by merge_to_master.py.

Change-Id: I834f3ca85c1ef7ec2c1061847a3d92aa461da043
diff --git a/Source/web/ApplicationCacheHost.cpp b/Source/web/ApplicationCacheHost.cpp
deleted file mode 100644
index 220c9b9..0000000
--- a/Source/web/ApplicationCacheHost.cpp
+++ /dev/null
@@ -1,251 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "core/loader/appcache/ApplicationCacheHost.h"
-
-#include "public/platform/WebURL.h"
-#include "public/platform/WebURLError.h"
-#include "public/platform/WebURLResponse.h"
-#include "public/platform/WebVector.h"
-#include "ApplicationCacheHostInternal.h"
-#include "WebFrameImpl.h"
-#include "bindings/v8/ExceptionStatePlaceholder.h"
-#include "core/events/ProgressEvent.h"
-#include "core/inspector/InspectorApplicationCacheAgent.h"
-#include "core/inspector/InspectorInstrumentation.h"
-#include "core/loader/DocumentLoader.h"
-#include "core/loader/FrameLoader.h"
-#include "core/loader/appcache/ApplicationCache.h"
-#include "core/frame/Frame.h"
-#include "core/page/Page.h"
-#include "core/frame/Settings.h"
-#include "platform/exported/WrappedResourceRequest.h"
-#include "platform/exported/WrappedResourceResponse.h"
-#include "platform/weborigin/SecurityOrigin.h"
-
-using namespace blink;
-
-namespace WebCore {
-
-// We provide a custom implementation of this class that calls out to the
-// embedding application instead of using WebCore's built in appcache system.
-// This file replaces webcore/appcache/ApplicationCacheHost.cpp in our build.
-
-ApplicationCacheHost::ApplicationCacheHost(DocumentLoader* documentLoader)
-    : m_domApplicationCache(0)
-    , m_documentLoader(documentLoader)
-    , m_defersEvents(true)
-{
-    ASSERT(m_documentLoader);
-}
-
-ApplicationCacheHost::~ApplicationCacheHost()
-{
-}
-
-void ApplicationCacheHost::willStartLoadingMainResource(ResourceRequest& request)
-{
-    // We defer creating the outer host object to avoid spurious creation/destruction
-    // around creating empty documents. At this point, we're initiating a main resource
-    // load for the document, so its for real.
-
-    if (!isApplicationCacheEnabled())
-        return;
-
-    m_internal = adoptPtr(new ApplicationCacheHostInternal(this));
-    if (m_internal->m_outerHost) {
-        WrappedResourceRequest wrapped(request);
-        m_internal->m_outerHost->willStartMainResourceRequest(wrapped, WebFrameImpl::fromFrame(m_documentLoader->frame()));
-    } else
-        m_internal.clear();
-
-    // NOTE: The semantics of this method, and others in this interface, are subtly different
-    // than the method names would suggest. For example, in this method never returns an appcached
-    // response in the SubstituteData out argument, instead we return the appcached response thru
-    // the usual resource loading pipeline.
-}
-
-void ApplicationCacheHost::selectCacheWithoutManifest()
-{
-    if (m_internal)
-        m_internal->m_outerHost->selectCacheWithoutManifest();
-}
-
-void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
-{
-    if (m_internal) {
-        if (!m_internal->m_outerHost->selectCacheWithManifest(manifestURL)) {
-            // It's a foreign entry, restart the current navigation from the top
-            // of the navigation algorithm. The navigation will not result in the
-            // same resource being loaded, because "foreign" entries are never picked
-            // during navigation.
-            // see WebCore::ApplicationCacheGroup::selectCache()
-            Frame* frame = m_documentLoader->frame();
-            frame->navigationScheduler().scheduleLocationChange(frame->document(),
-                frame->document()->url(), Referrer(frame->document()->referrer(), frame->document()->referrerPolicy()));
-        }
-    }
-}
-
-void ApplicationCacheHost::didReceiveResponseForMainResource(const ResourceResponse& response)
-{
-    if (m_internal) {
-        WrappedResourceResponse wrapped(response);
-        m_internal->m_outerHost->didReceiveResponseForMainResource(wrapped);
-    }
-}
-
-void ApplicationCacheHost::mainResourceDataReceived(const char* data, int length)
-{
-    if (m_internal)
-        m_internal->m_outerHost->didReceiveDataForMainResource(data, length);
-}
-
-void ApplicationCacheHost::failedLoadingMainResource()
-{
-    if (m_internal)
-        m_internal->m_outerHost->didFinishLoadingMainResource(false);
-}
-
-void ApplicationCacheHost::finishedLoadingMainResource()
-{
-    if (m_internal)
-        m_internal->m_outerHost->didFinishLoadingMainResource(true);
-}
-
-void ApplicationCacheHost::willStartLoadingResource(ResourceRequest& request)
-{
-    // FIXME: look into the purpose of the unused KURL& originalURL parameter
-    if (m_internal) {
-        WrappedResourceRequest wrapped(request);
-        m_internal->m_outerHost->willStartSubResourceRequest(wrapped);
-    }
-}
-
-void ApplicationCacheHost::setApplicationCache(ApplicationCache* domApplicationCache)
-{
-    ASSERT(!m_domApplicationCache || !domApplicationCache);
-    m_domApplicationCache = domApplicationCache;
-}
-
-void ApplicationCacheHost::notifyApplicationCache(EventID id, int total, int done)
-{
-    if (id != PROGRESS_EVENT)
-        InspectorInstrumentation::updateApplicationCacheStatus(m_documentLoader->frame());
-
-    if (m_defersEvents) {
-        // Event dispatching is deferred until document.onload has fired.
-        m_deferredEvents.append(DeferredEvent(id, total, done));
-        return;
-    }
-    dispatchDOMEvent(id, total, done);
-}
-
-ApplicationCacheHost::CacheInfo ApplicationCacheHost::applicationCacheInfo()
-{
-    if (!m_internal)
-        return CacheInfo(KURL(), 0, 0, 0);
-
-    blink::WebApplicationCacheHost::CacheInfo webInfo;
-    m_internal->m_outerHost->getAssociatedCacheInfo(&webInfo);
-    return CacheInfo(webInfo.manifestURL, webInfo.creationTime, webInfo.updateTime, webInfo.totalSize);
-}
-
-void ApplicationCacheHost::fillResourceList(ResourceInfoList* resources)
-{
-    if (!m_internal)
-        return;
-
-    blink::WebVector<blink::WebApplicationCacheHost::ResourceInfo> webResources;
-    m_internal->m_outerHost->getResourceList(&webResources);
-    for (size_t i = 0; i < webResources.size(); ++i) {
-        resources->append(ResourceInfo(
-            webResources[i].url, webResources[i].isMaster, webResources[i].isManifest, webResources[i].isFallback,
-            webResources[i].isForeign, webResources[i].isExplicit, webResources[i].size));
-    }
-}
-
-void ApplicationCacheHost::stopDeferringEvents()
-{
-    RefPtr<DocumentLoader> protect(documentLoader());
-    for (unsigned i = 0; i < m_deferredEvents.size(); ++i) {
-        const DeferredEvent& deferred = m_deferredEvents[i];
-        dispatchDOMEvent(deferred.eventID, deferred.progressTotal, deferred.progressDone);
-    }
-    m_deferredEvents.clear();
-    m_defersEvents = false;
-}
-
-void ApplicationCacheHost::dispatchDOMEvent(EventID id, int total, int done)
-{
-    if (m_domApplicationCache) {
-        const AtomicString& eventType = ApplicationCache::toEventType(id);
-        RefPtr<Event> event;
-        if (id == PROGRESS_EVENT)
-            event = ProgressEvent::create(eventType, true, done, total);
-        else
-            event = Event::create(eventType);
-        m_domApplicationCache->dispatchEvent(event, ASSERT_NO_EXCEPTION);
-    }
-}
-
-ApplicationCacheHost::Status ApplicationCacheHost::status() const
-{
-    return m_internal ? static_cast<Status>(m_internal->m_outerHost->status()) : UNCACHED;
-}
-
-bool ApplicationCacheHost::update()
-{
-    return m_internal ? m_internal->m_outerHost->startUpdate() : false;
-}
-
-bool ApplicationCacheHost::swapCache()
-{
-    bool success = m_internal ? m_internal->m_outerHost->swapCache() : false;
-    if (success)
-        InspectorInstrumentation::updateApplicationCacheStatus(m_documentLoader->frame());
-    return success;
-}
-
-void ApplicationCacheHost::abort()
-{
-    if (m_internal)
-        m_internal->m_outerHost->abort();
-}
-
-bool ApplicationCacheHost::isApplicationCacheEnabled()
-{
-    ASSERT(m_documentLoader->frame());
-    return m_documentLoader->frame()->settings()
-           && m_documentLoader->frame()->settings()->offlineWebApplicationCacheEnabled();
-}
-
-}  // namespace WebCore
diff --git a/Source/web/ApplicationCacheHostInternal.h b/Source/web/ApplicationCacheHostInternal.h
deleted file mode 100644
index c77f922..0000000
--- a/Source/web/ApplicationCacheHostInternal.h
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "WebApplicationCacheHostClient.h"
-#include "WebFrameClient.h"
-#include "WebFrameImpl.h"
-#include "core/loader/DocumentLoader.h"
-#include "core/loader/appcache/ApplicationCacheHost.h"
-#include "public/platform/WebURL.h"
-
-namespace WebCore {
-
-class ApplicationCacheHostInternal FINAL : public blink::WebApplicationCacheHostClient {
-public:
-    ApplicationCacheHostInternal(ApplicationCacheHost* host)
-        : m_innerHost(host)
-    {
-        blink::WebFrameImpl* webFrame = blink::WebFrameImpl::fromFrame(host->m_documentLoader->frame());
-        ASSERT(webFrame);
-        m_outerHost = adoptPtr(webFrame->client()->createApplicationCacheHost(webFrame, this));
-    }
-
-    virtual void didChangeCacheAssociation() OVERRIDE
-    {
-        // FIXME: Prod the inspector to update it's notion of what cache the page is using.
-    }
-
-    virtual void notifyEventListener(blink::WebApplicationCacheHost::EventID eventID) OVERRIDE
-    {
-        m_innerHost->notifyApplicationCache(static_cast<ApplicationCacheHost::EventID>(eventID), 0, 0);
-    }
-
-    virtual void notifyProgressEventListener(const blink::WebURL&, int progressTotal, int progressDone) OVERRIDE
-    {
-        m_innerHost->notifyApplicationCache(ApplicationCacheHost::PROGRESS_EVENT, progressTotal, progressDone);
-    }
-
-    static blink::WebApplicationCacheHost* toWebApplicationCacheHost(ApplicationCacheHost* innerHost)
-    {
-        if (innerHost && innerHost->m_internal)
-            return innerHost->m_internal->m_outerHost.get();
-        return 0;
-    }
-
-private:
-    friend class ApplicationCacheHost;
-    ApplicationCacheHost* m_innerHost;
-    OwnPtr<blink::WebApplicationCacheHost> m_outerHost;
-};
-
-}
diff --git a/Source/web/AssertMatchingEnums.cpp b/Source/web/AssertMatchingEnums.cpp
index 610a92b..6a55312 100644
--- a/Source/web/AssertMatchingEnums.cpp
+++ b/Source/web/AssertMatchingEnums.cpp
@@ -33,27 +33,6 @@
 
 #include "config.h"
 
-#include "WebAXEnums.h"
-#include "WebAXObject.h"
-#include "WebApplicationCacheHost.h"
-#include "WebConsoleMessage.h"
-#include "WebContentSecurityPolicy.h"
-#include "WebFontDescription.h"
-#include "WebFormElement.h"
-#include "WebGeolocationError.h"
-#include "WebGeolocationPosition.h"
-#include "WebIconURL.h"
-#include "WebInputElement.h"
-#include "WebNavigatorContentUtilsClient.h"
-#include "WebNotificationPresenter.h"
-#include "WebPageVisibilityState.h"
-#include "WebSettings.h"
-#include "WebSpeechRecognizerClient.h"
-#include "WebTextAffinity.h"
-#include "WebTextCheckingResult.h"
-#include "WebTextCheckingType.h"
-#include "WebTextDecorationType.h"
-#include "WebView.h"
 #include "bindings/v8/SerializedScriptValue.h"
 #include "core/accessibility/AXObject.h"
 #include "core/accessibility/AXObjectCache.h"
@@ -62,7 +41,7 @@
 #include "core/dom/IconURL.h"
 #include "core/editing/TextAffinity.h"
 #include "core/fileapi/FileError.h"
-#include "core/frame/ContentSecurityPolicy.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/shadow/TextControlInnerElements.h"
@@ -86,17 +65,19 @@
 #include "platform/Cursor.h"
 #include "platform/FileMetadata.h"
 #include "platform/FileSystemType.h"
-#include "platform/drm/ContentDecryptionModuleSession.h"
+#include "platform/PlatformMouseEvent.h"
 #include "platform/fonts/FontDescription.h"
 #include "platform/fonts/FontSmoothingMode.h"
 #include "platform/graphics/filters/FilterOperation.h"
 #include "platform/graphics/media/MediaPlayer.h"
 #include "platform/mediastream/MediaStreamSource.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/network/ResourceResponse.h"
 #include "platform/text/TextChecking.h"
 #include "platform/text/TextDecoration.h"
 #include "platform/weborigin/ReferrerPolicy.h"
+#include "public/platform/WebApplicationCacheHost.h"
 #include "public/platform/WebClipboard.h"
 #include "public/platform/WebCursorInfo.h"
 #include "public/platform/WebFileError.h"
@@ -116,13 +97,35 @@
 #include "public/platform/WebMediaStreamSource.h"
 #include "public/platform/WebReferrerPolicy.h"
 #include "public/platform/WebScrollbar.h"
+#include "public/platform/WebScrollbarBehavior.h"
 #include "public/platform/WebStorageQuotaError.h"
 #include "public/platform/WebStorageQuotaType.h"
 #include "public/platform/WebURLRequest.h"
 #include "public/platform/WebURLResponse.h"
+#include "public/web/WebAXEnums.h"
+#include "public/web/WebAXObject.h"
+#include "public/web/WebConsoleMessage.h"
+#include "public/web/WebContentSecurityPolicy.h"
+#include "public/web/WebFontDescription.h"
+#include "public/web/WebFormElement.h"
+#include "public/web/WebGeolocationError.h"
+#include "public/web/WebGeolocationPosition.h"
+#include "public/web/WebIconURL.h"
+#include "public/web/WebInputElement.h"
+#include "public/web/WebInputEvent.h"
 #include "public/web/WebNavigationPolicy.h"
+#include "public/web/WebNavigatorContentUtilsClient.h"
+#include "public/web/WebNotificationPresenter.h"
+#include "public/web/WebPageVisibilityState.h"
 #include "public/web/WebSerializedScriptValueVersion.h"
+#include "public/web/WebSettings.h"
+#include "public/web/WebSpeechRecognizerClient.h"
+#include "public/web/WebTextAffinity.h"
+#include "public/web/WebTextCheckingResult.h"
+#include "public/web/WebTextCheckingType.h"
+#include "public/web/WebTextDecorationType.h"
 #include "public/web/WebTouchAction.h"
+#include "public/web/WebView.h"
 #include "wtf/Assertions.h"
 #include "wtf/text/StringImpl.h"
 
@@ -151,6 +154,7 @@
 COMPILE_ASSERT_MATCHING_ENUM(WebAXEventRowCollapsed, AXObjectCache::AXRowCollapsed);
 COMPILE_ASSERT_MATCHING_ENUM(WebAXEventRowCountChanged, AXObjectCache::AXRowCountChanged);
 COMPILE_ASSERT_MATCHING_ENUM(WebAXEventRowExpanded, AXObjectCache::AXRowExpanded);
+COMPILE_ASSERT_MATCHING_ENUM(WebAXEventScrollPositionChanged, AXObjectCache::AXScrollPositionChanged);
 COMPILE_ASSERT_MATCHING_ENUM(WebAXEventScrolledToAnchor, AXObjectCache::AXScrolledToAnchor);
 COMPILE_ASSERT_MATCHING_ENUM(WebAXEventSelectedChildrenChanged, AXObjectCache::AXSelectedChildrenChanged);
 COMPILE_ASSERT_MATCHING_ENUM(WebAXEventSelectedTextChanged, AXObjectCache::AXSelectedTextChanged);
@@ -423,19 +427,10 @@
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::PreloadMetaData, MediaPlayer::MetaData);
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::PreloadAuto, MediaPlayer::Auto);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::MediaKeyExceptionNoError, MediaPlayer::NoError);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::MediaKeyExceptionInvalidPlayerState, MediaPlayer::InvalidPlayerState);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::MediaKeyExceptionKeySystemNotSupported, MediaPlayer::KeySystemNotSupported);
-
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayerClient::MediaKeyErrorCodeUnknown, MediaPlayerClient::UnknownError);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayerClient::MediaKeyErrorCodeClient, MediaPlayerClient::ClientError);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayerClient::MediaKeyErrorCodeService, MediaPlayerClient::ServiceError);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayerClient::MediaKeyErrorCodeOutput, MediaPlayerClient::OutputError);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayerClient::MediaKeyErrorCodeHardwareChange, MediaPlayerClient::HardwareChangeError);
-COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayerClient::MediaKeyErrorCodeDomain, MediaPlayerClient::DomainError);
-
-COMPILE_ASSERT_MATCHING_ENUM(WebContentDecryptionModuleSession::Client::MediaKeyErrorCodeUnknown, ContentDecryptionModuleSessionClient::UnknownError);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentDecryptionModuleSession::Client::MediaKeyErrorCodeClient, ContentDecryptionModuleSessionClient::ClientError);
+COMPILE_ASSERT_MATCHING_ENUM(WebMouseEvent::ButtonNone, NoButton);
+COMPILE_ASSERT_MATCHING_ENUM(WebMouseEvent::ButtonLeft, LeftButton);
+COMPILE_ASSERT_MATCHING_ENUM(WebMouseEvent::ButtonMiddle, MiddleButton);
+COMPILE_ASSERT_MATCHING_ENUM(WebMouseEvent::ButtonRight, RightButton);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionAllowed, NotificationClient::PermissionAllowed);
 COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionNotAllowed, NotificationClient::PermissionNotAllowed);
@@ -466,6 +461,11 @@
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleDark, ScrollbarOverlayStyleDark);
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleLight, ScrollbarOverlayStyleLight);
 
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbarBehavior::ButtonNone, NoButton);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbarBehavior::ButtonLeft, LeftButton);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbarBehavior::ButtonMiddle, MiddleButton);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbarBehavior::ButtonRight, RightButton);
+
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorMac, EditingMacBehavior);
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorWin, EditingWindowsBehavior);
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorUnix, EditingUnixBehavior);
@@ -567,8 +567,8 @@
 COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyNever, ReferrerPolicyNever);
 COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyOrigin, ReferrerPolicyOrigin);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReport, ContentSecurityPolicy::Report);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforce, ContentSecurityPolicy::Enforce);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReport, ContentSecurityPolicyHeaderTypeReport);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforce, ContentSecurityPolicyHeaderTypeEnforce);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::Unknown, ResourceResponse::Unknown);
 COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::HTTP_0_9, ResourceResponse::HTTP_0_9);
@@ -613,5 +613,6 @@
 COMPILE_ASSERT_MATCHING_ENUM(WebTouchActionAuto, TouchActionAuto);
 COMPILE_ASSERT_MATCHING_ENUM(WebTouchActionPanX, TouchActionPanX);
 COMPILE_ASSERT_MATCHING_ENUM(WebTouchActionPanY, TouchActionPanY);
+COMPILE_ASSERT_MATCHING_ENUM(WebTouchActionPinchZoom, TouchActionPinchZoom);
 
 COMPILE_ASSERT_MATCHING_UINT64(kSerializedScriptValueVersion, SerializedScriptValue::wireFormatVersion);
diff --git a/Source/web/AssociatedURLLoader.cpp b/Source/web/AssociatedURLLoader.cpp
index dde2fb4..44d1a61 100644
--- a/Source/web/AssociatedURLLoader.cpp
+++ b/Source/web/AssociatedURLLoader.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "AssociatedURLLoader.h"
 
-#include "WebApplicationCacheHost.h"
 #include "WebDataSource.h"
 #include "WebFrameImpl.h"
 #include "core/fetch/CrossOriginAccessControl.h"
@@ -278,7 +277,7 @@
     // If an error has already been received, start a timer to report it to the client
     // after AssociatedURLLoader::loadAsynchronously has returned to the caller.
     if (m_didFail)
-        m_errorTimer.startOneShot(0);
+        m_errorTimer.startOneShot(0, FROM_HERE);
 }
 
 void AssociatedURLLoader::ClientAdapter::notifyError(Timer<ClientAdapter>* timer)
diff --git a/Source/web/ChromeClientImpl.cpp b/Source/web/ChromeClientImpl.cpp
index f28aec8..b7e4aa5 100644
--- a/Source/web/ChromeClientImpl.cpp
+++ b/Source/web/ChromeClientImpl.cpp
@@ -213,7 +213,14 @@
     m_webView->client()->setKeyboardFocusURL(focusURL);
 }
 
-Page* ChromeClientImpl::createWindow(Frame* frame, const FrameLoadRequest& r, const WindowFeatures& features,
+void ChromeClientImpl::focusedFrameChanged(WebCore::LocalFrame* frame)
+{
+    WebFrameImpl* webframe = WebFrameImpl::fromFrame(frame);
+    if (webframe && webframe->client())
+        webframe->client()->frameFocused();
+}
+
+Page* ChromeClientImpl::createWindow(LocalFrame* frame, const FrameLoadRequest& r, const WindowFeatures& features,
     NavigationPolicy navigationPolicy, ShouldSendReferrer shouldSendReferrer)
 {
     if (!m_webView->client())
@@ -223,7 +230,8 @@
     if (policy == WebNavigationPolicyIgnore)
         policy = getNavigationPolicy();
 
-    DocumentFullscreen::webkitCancelFullScreen(frame->document());
+    ASSERT(frame->document());
+    DocumentFullscreen::webkitCancelFullScreen(*frame->document());
 
     WebViewImpl* newView = toWebViewImpl(
         m_webView->client()->createView(WebFrameImpl::fromFrame(frame), WrappedResourceRequest(r.resourceRequest()), features, r.frameName(), policy, shouldSendReferrer == NeverSendReferrer));
@@ -376,7 +384,7 @@
     return !!m_webView->client();
 }
 
-bool ChromeClientImpl::runBeforeUnloadConfirmPanel(const String& message, Frame* frame)
+bool ChromeClientImpl::runBeforeUnloadConfirmPanel(const String& message, LocalFrame* frame)
 {
     if (m_webView->client()) {
         return m_webView->client()->runModalBeforeUnloadDialog(
@@ -388,7 +396,7 @@
 void ChromeClientImpl::closeWindowSoon()
 {
     // Make sure this Page can no longer be found by JS.
-    m_webView->page()->clearPageGroup();
+    Page::ordinaryPages().remove(m_webView->page());
 
     // Make sure that all loading is stopped.  Ensures that JS stops executing!
     m_webView->mainFrame()->stopLoading();
@@ -397,9 +405,9 @@
         m_webView->client()->closeWidgetSoon();
 }
 
-// Although a Frame is passed in, we don't actually use it, since we
+// Although a LocalFrame is passed in, we don't actually use it, since we
 // already know our own m_webView.
-void ChromeClientImpl::runJavaScriptAlert(Frame* frame, const String& message)
+void ChromeClientImpl::runJavaScriptAlert(LocalFrame* frame, const String& message)
 {
     if (m_webView->client()) {
         if (WebUserGestureIndicator::isProcessingUserGesture())
@@ -410,7 +418,7 @@
 }
 
 // See comments for runJavaScriptAlert().
-bool ChromeClientImpl::runJavaScriptConfirm(Frame* frame, const String& message)
+bool ChromeClientImpl::runJavaScriptConfirm(LocalFrame* frame, const String& message)
 {
     if (m_webView->client()) {
         if (WebUserGestureIndicator::isProcessingUserGesture())
@@ -422,7 +430,7 @@
 }
 
 // See comments for runJavaScriptAlert().
-bool ChromeClientImpl::runJavaScriptPrompt(Frame* frame,
+bool ChromeClientImpl::runJavaScriptPrompt(LocalFrame* frame,
                                            const String& message,
                                            const String& defaultValue,
                                            String& result)
@@ -494,8 +502,9 @@
             int dy = scrollDelta.height();
             m_webView->client()->didScrollRect(dx, dy, intersection(scrollRect, clipRect));
         }
-    } else
-        m_webView->scrollRootLayerRect(scrollDelta, clipRect);
+    } else {
+        m_webView->scrollRootLayer();
+    }
 }
 
 IntRect ChromeClientImpl::rootViewToScreen(const IntRect& rect) const
@@ -515,7 +524,7 @@
     return m_webView->client() ? m_webView->client()->screenInfo() : WebScreenInfo();
 }
 
-void ChromeClientImpl::contentsSizeChanged(Frame* frame, const IntSize& size) const
+void ChromeClientImpl::contentsSizeChanged(LocalFrame* frame, const IntSize& size) const
 {
     m_webView->didChangeContentsSize();
 
@@ -523,6 +532,8 @@
     webframe->didChangeContentsSize(size);
     if (webframe->client())
         webframe->client()->didChangeContentsSize(webframe, size);
+
+    frame->loader().restoreScrollPositionAndViewState();
 }
 
 void ChromeClientImpl::deviceOrPageScaleFactorChanged() const
@@ -530,7 +541,7 @@
     m_webView->deviceOrPageScaleFactorChanged();
 }
 
-void ChromeClientImpl::layoutUpdated(Frame* frame) const
+void ChromeClientImpl::layoutUpdated(LocalFrame* frame) const
 {
     m_webView->layoutUpdated(WebFrameImpl::fromFrame(frame));
 }
@@ -543,11 +554,11 @@
 
     WebURL url;
     // Find out if the mouse is over a link, and if so, let our UI know...
-    if (result.isLiveLink() && !result.absoluteLinkURL().string().isEmpty())
+    if (result.isLiveLink() && !result.absoluteLinkURL().string().isEmpty()) {
         url = result.absoluteLinkURL();
-    else if (result.innerNonSharedNode()
-             && (result.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
-                 || result.innerNonSharedNode()->hasTagName(HTMLNames::embedTag))) {
+    } else if (result.innerNonSharedNode()
+        && (isHTMLObjectElement(*result.innerNonSharedNode())
+            || isHTMLEmbedElement(*result.innerNonSharedNode()))) {
         RenderObject* object = result.innerNonSharedNode()->renderer();
         if (object && object->isWidget()) {
             Widget* widget = toRenderWidget(object)->widget();
@@ -577,7 +588,7 @@
     m_webView->updatePageDefinedViewportConstraints(description);
 }
 
-void ChromeClientImpl::print(Frame* frame)
+void ChromeClientImpl::print(LocalFrame* frame)
 {
     if (m_webView->client())
         m_webView->client()->printPage(WebFrameImpl::fromFrame(frame));
@@ -603,7 +614,7 @@
 #endif
 }
 
-void ChromeClientImpl::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileChooser)
+void ChromeClientImpl::runOpenPanel(LocalFrame* frame, PassRefPtr<FileChooser> fileChooser)
 {
     WebViewClient* client = m_webView->client();
     if (!client)
@@ -667,15 +678,6 @@
     setCursor(cursor);
 }
 
-void ChromeClientImpl::formStateDidChange(const Node* node)
-{
-    // The current history item is not updated yet.  That happens lazily when
-    // WebFrame::currentHistoryItem is requested.
-    WebFrameImpl* webframe = WebFrameImpl::fromFrame(node->document().frame());
-    if (webframe->client())
-        webframe->client()->didUpdateCurrentHistoryItem(webframe);
-}
-
 void ChromeClientImpl::postAccessibilityNotification(AXObject* obj, AXObjectCache::AXNotification notification)
 {
     // Alert assistive technology about the accessibility object notification.
@@ -692,7 +694,7 @@
 
 bool ChromeClientImpl::paintCustomOverhangArea(GraphicsContext* context, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect)
 {
-    Frame* frame = m_webView->mainFrameImpl()->frame();
+    LocalFrame* frame = m_webView->mainFrameImpl()->frame();
     WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
     if (pluginContainer)
         return pluginContainer->paintCustomOverhangArea(context, horizontalOverhangArea, verticalOverhangArea, dirtyRect);
@@ -704,9 +706,9 @@
     return m_webView->graphicsLayerFactory();
 }
 
-void ChromeClientImpl::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
+void ChromeClientImpl::attachRootGraphicsLayer(GraphicsLayer* rootLayer)
 {
-    m_webView->setRootGraphicsLayer(graphicsLayer);
+    m_webView->setRootGraphicsLayer(rootLayer);
 }
 
 ChromeClient::CompositingTriggerFlags ChromeClientImpl::allowedCompositingTriggers() const
@@ -749,7 +751,7 @@
     return m_webView->hasOpenedPopup();
 }
 
-PassRefPtr<PopupMenu> ChromeClientImpl::createPopupMenu(Frame& frame, PopupMenuClient* client) const
+PassRefPtr<PopupMenu> ChromeClientImpl::createPopupMenu(LocalFrame& frame, PopupMenuClient* client) const
 {
     if (WebViewImpl::useExternalPopupMenus())
         return adoptRef(new ExternalPopupMenu(frame, client, *m_webView));
@@ -919,6 +921,8 @@
     }
 }
 
+// FIXME: This function is to be removed once both chromium and blink changes
+// for BUG332557 are in.
 void ChromeClientImpl::didChangeValueInTextField(HTMLInputElement& inputElement)
 {
     if (!m_webView->autofillClient())
@@ -926,6 +930,13 @@
     m_webView->autofillClient()->textFieldDidChange(WebInputElement(&inputElement));
 }
 
+void ChromeClientImpl::didChangeValueInTextField(HTMLFormControlElement& element)
+{
+    if (!m_webView->autofillClient())
+        return;
+    m_webView->autofillClient()->textFieldDidChange(WebFormControlElement(&element));
+}
+
 void ChromeClientImpl::didEndEditingOnTextField(HTMLInputElement& inputElement)
 {
     if (m_webView->autofillClient())
diff --git a/Source/web/ChromeClientImpl.h b/Source/web/ChromeClientImpl.h
index 907eb23..738b58b 100644
--- a/Source/web/ChromeClientImpl.h
+++ b/Source/web/ChromeClientImpl.h
@@ -48,6 +48,7 @@
 class Event;
 class FileChooser;
 class GraphicsLayerFactory;
+class HTMLFormControlElement;
 class HTMLInputElement;
 class KeyboardEvent;
 class PopupMenuClient;
@@ -82,8 +83,9 @@
     virtual bool canTakeFocus(WebCore::FocusType) OVERRIDE;
     virtual void takeFocus(WebCore::FocusType) OVERRIDE;
     virtual void focusedNodeChanged(WebCore::Node*) OVERRIDE;
+    virtual void focusedFrameChanged(WebCore::LocalFrame*) OVERRIDE;
     virtual WebCore::Page* createWindow(
-        WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, WebCore::NavigationPolicy, WebCore::ShouldSendReferrer) OVERRIDE;
+        WebCore::LocalFrame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&, WebCore::NavigationPolicy, WebCore::ShouldSendReferrer) OVERRIDE;
     virtual void show(WebCore::NavigationPolicy) OVERRIDE;
     virtual bool canRunModal() OVERRIDE;
     virtual void runModal() OVERRIDE;
@@ -103,12 +105,12 @@
         const WTF::String& sourceID, const WTF::String& stackTrace) OVERRIDE;
     virtual bool canRunBeforeUnloadConfirmPanel() OVERRIDE;
     virtual bool runBeforeUnloadConfirmPanel(
-        const WTF::String& message, WebCore::Frame*) OVERRIDE;
+        const WTF::String& message, WebCore::LocalFrame*) OVERRIDE;
     virtual void closeWindowSoon() OVERRIDE;
-    virtual void runJavaScriptAlert(WebCore::Frame*, const WTF::String&) OVERRIDE;
-    virtual bool runJavaScriptConfirm(WebCore::Frame*, const WTF::String&) OVERRIDE;
+    virtual void runJavaScriptAlert(WebCore::LocalFrame*, const WTF::String&) OVERRIDE;
+    virtual bool runJavaScriptConfirm(WebCore::LocalFrame*, const WTF::String&) OVERRIDE;
     virtual bool runJavaScriptPrompt(
-        WebCore::Frame*, const WTF::String& message,
+        WebCore::LocalFrame*, const WTF::String& message,
         const WTF::String& defaultValue, WTF::String& result) OVERRIDE;
     virtual void setStatusbarText(const WTF::String& message) OVERRIDE;
     virtual bool tabsToLinks() OVERRIDE;
@@ -122,30 +124,29 @@
         const WebCore::IntRect& clipRect) OVERRIDE;
     virtual WebCore::IntRect rootViewToScreen(const WebCore::IntRect&) const OVERRIDE;
     virtual WebScreenInfo screenInfo() const OVERRIDE;
-    virtual void contentsSizeChanged(WebCore::Frame*, const WebCore::IntSize&) const OVERRIDE;
+    virtual void contentsSizeChanged(WebCore::LocalFrame*, const WebCore::IntSize&) const OVERRIDE;
     virtual void deviceOrPageScaleFactorChanged() const OVERRIDE;
-    virtual void layoutUpdated(WebCore::Frame*) const OVERRIDE;
+    virtual void layoutUpdated(WebCore::LocalFrame*) const OVERRIDE;
     virtual void mouseDidMoveOverElement(
         const WebCore::HitTestResult&, unsigned modifierFlags) OVERRIDE;
     virtual void setToolTip(const WTF::String& tooltipText, WebCore::TextDirection) OVERRIDE;
     virtual void dispatchViewportPropertiesDidChange(const WebCore::ViewportDescription&) const OVERRIDE;
-    virtual void print(WebCore::Frame*) OVERRIDE;
+    virtual void print(WebCore::LocalFrame*) OVERRIDE;
     virtual void annotatedRegionsChanged() OVERRIDE;
     virtual bool paintCustomOverhangArea(WebCore::GraphicsContext*, const WebCore::IntRect&, const WebCore::IntRect&, const WebCore::IntRect&) OVERRIDE;
     virtual PassOwnPtr<WebCore::ColorChooser> createColorChooser(WebCore::ColorChooserClient*, const WebCore::Color&) OVERRIDE;
     virtual PassRefPtr<WebCore::DateTimeChooser> openDateTimeChooser(WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&) OVERRIDE;
     virtual void openTextDataListChooser(WebCore::HTMLInputElement&) OVERRIDE;
-    virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>) OVERRIDE;
+    virtual void runOpenPanel(WebCore::LocalFrame*, PassRefPtr<WebCore::FileChooser>) OVERRIDE;
     virtual void enumerateChosenDirectory(WebCore::FileChooser*) OVERRIDE;
     virtual void setCursor(const WebCore::Cursor&) OVERRIDE;
-    virtual void formStateDidChange(const WebCore::Node*) OVERRIDE;
     virtual void needTouchEvents(bool needTouchEvents) OVERRIDE;
     virtual void setTouchAction(WebCore::TouchAction) OVERRIDE;
 
     virtual WebCore::GraphicsLayerFactory* graphicsLayerFactory() const OVERRIDE;
 
     // Pass 0 as the GraphicsLayer to detatch the root layer.
-    virtual void attachRootGraphicsLayer(WebCore::Frame*, WebCore::GraphicsLayer*) OVERRIDE;
+    virtual void attachRootGraphicsLayer(WebCore::GraphicsLayer*) OVERRIDE;
 
     virtual CompositingTriggerFlags allowedCompositingTriggers() const OVERRIDE;
 
@@ -161,7 +162,7 @@
     void setNewWindowNavigationPolicy(WebNavigationPolicy);
 
     virtual bool hasOpenedPopup() const OVERRIDE;
-    virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::Frame&, WebCore::PopupMenuClient*) const OVERRIDE;
+    virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::LocalFrame&, WebCore::PopupMenuClient*) const OVERRIDE;
     WebCore::PagePopup* openPagePopup(WebCore::PagePopupClient*, const WebCore::IntRect&);
     void closePagePopup(WebCore::PagePopup*);
     virtual void setPagePopupDriver(WebCore::PagePopupDriver*) OVERRIDE;
@@ -179,7 +180,10 @@
     virtual void requestPointerUnlock() OVERRIDE;
 
     virtual void didAssociateFormControls(const Vector<RefPtr<WebCore::Element> >&) OVERRIDE;
+    // FIXME: This function is to be removed once both chromium and blink changes
+    // for BUG332557 are in.
     virtual void didChangeValueInTextField(WebCore::HTMLInputElement&) OVERRIDE;
+    virtual void didChangeValueInTextField(WebCore::HTMLFormControlElement&) OVERRIDE;
     virtual void didEndEditingOnTextField(WebCore::HTMLInputElement&) OVERRIDE;
     virtual void handleKeyboardEventOnTextField(WebCore::HTMLInputElement&, WebCore::KeyboardEvent&) OVERRIDE;
 
diff --git a/Source/web/ContextFeaturesClientImpl.cpp b/Source/web/ContextFeaturesClientImpl.cpp
index 6ccbb48..6b2729b 100644
--- a/Source/web/ContextFeaturesClientImpl.cpp
+++ b/Source/web/ContextFeaturesClientImpl.cpp
@@ -79,7 +79,7 @@
     };
 
     static const char* supplementName();
-    static ContextFeaturesCache* from(Document*);
+    static ContextFeaturesCache& from(Document&);
 
     Entry& entryFor(ContextFeatures::FeatureType type)
     {
@@ -100,7 +100,7 @@
     return "ContextFeaturesCache";
 }
 
-ContextFeaturesCache* ContextFeaturesCache::from(Document* document)
+ContextFeaturesCache& ContextFeaturesCache::from(Document& document)
 {
     ContextFeaturesCache* cache = static_cast<ContextFeaturesCache*>(DocumentSupplement::from(document, supplementName()));
     if (!cache) {
@@ -108,7 +108,7 @@
         DocumentSupplement::provideTo(document, supplementName(), adoptPtr(cache));
     }
 
-    return cache;
+    return *cache;
 }
 
 void ContextFeaturesCache::validateAgainst(Document* document)
@@ -123,7 +123,8 @@
 
 bool ContextFeaturesClientImpl::isEnabled(Document* document, ContextFeatures::FeatureType type, bool defaultValue)
 {
-    ContextFeaturesCache::Entry& cache = ContextFeaturesCache::from(document)->entryFor(type);
+    ASSERT(document);
+    ContextFeaturesCache::Entry& cache = ContextFeaturesCache::from(*document).entryFor(type);
     if (cache.needsRefresh(defaultValue))
         cache.set(askIfIsEnabled(document, type, defaultValue), defaultValue);
     return cache.isEnabled();
@@ -131,7 +132,8 @@
 
 void ContextFeaturesClientImpl::urlDidChange(Document* document)
 {
-    ContextFeaturesCache::from(document)->validateAgainst(document);
+    ASSERT(document);
+    ContextFeaturesCache::from(*document).validateAgainst(document);
 }
 
 bool ContextFeaturesClientImpl::askIfIsEnabled(Document* document, ContextFeatures::FeatureType type, bool defaultValue)
diff --git a/Source/web/ContextMenuClientImpl.cpp b/Source/web/ContextMenuClientImpl.cpp
index e74d78d..536d72c 100644
--- a/Source/web/ContextMenuClientImpl.cpp
+++ b/Source/web/ContextMenuClientImpl.cpp
@@ -36,6 +36,7 @@
 #include "WebContextMenuData.h"
 #include "WebDataSourceImpl.h"
 #include "WebFormElement.h"
+#include "WebFrameClient.h"
 #include "WebFrameImpl.h"
 #include "WebMenuItemInfo.h"
 #include "WebPlugin.h"
@@ -83,7 +84,7 @@
 // Figure out the URL of a page or subframe. Returns |page_type| as the type,
 // which indicates page or subframe, or ContextNodeType::NONE if the URL could not
 // be determined for some reason.
-static WebURL urlFromFrame(Frame* frame)
+static WebURL urlFromFrame(LocalFrame* frame)
 {
     if (frame) {
         DocumentLoader* dl = frame->loader().documentLoader();
@@ -107,7 +108,7 @@
 // is to be invoked. This function also sets the word on which context menu
 // has been invoked to be the selected word, as required. This function changes
 // the selection only when there were no selected characters on OS X.
-static String selectMisspelledWord(Frame* selectedFrame)
+static String selectMisspelledWord(LocalFrame* selectedFrame)
 {
     // First select from selectedText to check for multiple word selection.
     String misspelledWord = selectedFrame->selectedText().stripWhiteSpace();
@@ -150,7 +151,7 @@
     return isSpaceOrNewline(c) || WTF::Unicode::isPunct(c);
 }
 
-static String selectMisspellingAsync(Frame* selectedFrame, DocumentMarker& marker)
+static String selectMisspellingAsync(LocalFrame* selectedFrame, DocumentMarker& marker)
 {
     VisibleSelection selection = selectedFrame->selection().selection();
     if (!selection.isCaretOrRange())
@@ -158,7 +159,7 @@
 
     // Caret and range selections always return valid normalized ranges.
     RefPtr<Range> selectionRange = selection.toNormalizedRange();
-    Vector<DocumentMarker*> markers = selectedFrame->document()->markers()->markersInRange(selectionRange.get(), DocumentMarker::MisspellingMarkers());
+    Vector<DocumentMarker*> markers = selectedFrame->document()->markers().markersInRange(selectionRange.get(), DocumentMarker::MisspellingMarkers());
     if (markers.size() != 1)
         return String();
     marker = *markers[0];
@@ -185,7 +186,7 @@
         return;
 
     HitTestResult r = m_webView->page()->contextMenuController().hitTestResult();
-    Frame* selectedFrame = r.innerNodeFrame();
+    LocalFrame* selectedFrame = r.innerNodeFrame();
 
     WebContextMenuData data;
     IntPoint mousePoint = selectedFrame->view()->contentsToWindow(r.roundedPointInInnerNodeFrame());
@@ -224,9 +225,9 @@
         // We know that if absoluteMediaURL() is not empty, then this
         // is a media element.
         HTMLMediaElement* mediaElement = toHTMLMediaElement(r.innerNonSharedNode());
-        if (mediaElement->hasTagName(HTMLNames::videoTag))
+        if (isHTMLVideoElement(*mediaElement))
             data.mediaType = WebContextMenuData::MediaTypeVideo;
-        else if (mediaElement->hasTagName(HTMLNames::audioTag))
+        else if (isHTMLAudioElement(*mediaElement))
             data.mediaType = WebContextMenuData::MediaTypeAudio;
 
         if (mediaElement->error())
@@ -245,8 +246,7 @@
             data.mediaFlags |= WebContextMenuData::MediaHasVideo;
         if (mediaElement->controls())
             data.mediaFlags |= WebContextMenuData::MediaControls;
-    } else if (r.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
-               || r.innerNonSharedNode()->hasTagName(HTMLNames::embedTag)) {
+    } else if (isHTMLObjectElement(*r.innerNonSharedNode()) || isHTMLEmbedElement(*r.innerNonSharedNode())) {
         RenderObject* object = r.innerNonSharedNode()->renderer();
         if (object && object->isWidget()) {
             Widget* widget = toRenderWidget(object)->widget();
@@ -295,14 +295,14 @@
     }
 
     if (r.isSelected()) {
-        if (!r.innerNonSharedNode()->hasTagName(HTMLNames::inputTag) || !toHTMLInputElement(r.innerNonSharedNode())->isPasswordField())
+        if (!isHTMLInputElement(*r.innerNonSharedNode()) || !toHTMLInputElement(r.innerNonSharedNode())->isPasswordField())
             data.selectedText = selectedFrame->selectedText().stripWhiteSpace();
     }
 
     if (r.isContentEditable()) {
         data.isEditable = true;
 #if ENABLE(INPUT_SPEECH)
-        if (r.innerNonSharedNode()->hasTagName(HTMLNames::inputTag))
+        if (isHTMLInputElement(*r.innerNonSharedNode()))
             data.isSpeechInputEnabled = toHTMLInputElement(r.innerNonSharedNode())->isSpeechEnabled();
 #endif
         // When Chrome enables asynchronous spellchecking, its spellchecker adds spelling markers to misspelled
@@ -337,13 +337,11 @@
             }
         }
         HTMLFormElement* form = selectedFrame->selection().currentForm();
-        if (form && r.innerNonSharedNode()->hasTagName(HTMLNames::inputTag)) {
-            HTMLInputElement* selectedElement = toHTMLInputElement(r.innerNonSharedNode());
-            if (selectedElement) {
-                WebSearchableFormData ws = WebSearchableFormData(WebFormElement(form), WebInputElement(selectedElement));
-                if (ws.url().isValid())
-                    data.keywordURL = ws.url();
-            }
+        if (form && isHTMLInputElement(*r.innerNonSharedNode())) {
+            HTMLInputElement& selectedElement = toHTMLInputElement(*r.innerNonSharedNode());
+            WebSearchableFormData ws = WebSearchableFormData(WebFormElement(form), WebInputElement(&selectedElement));
+            if (ws.url().isValid())
+                data.keywordURL = ws.url();
         }
     }
 
@@ -365,15 +363,21 @@
 
     data.node = r.innerNonSharedNode();
 
-    WebFrame* selected_web_frame = WebFrameImpl::fromFrame(selectedFrame);
-    if (m_webView->client())
-        m_webView->client()->showContextMenu(selected_web_frame, data);
+    WebFrameImpl* selectedWebFrame = WebFrameImpl::fromFrame(selectedFrame);
+    if (selectedWebFrame->client())
+        selectedWebFrame->client()->showContextMenu(data);
 }
 
 void ContextMenuClientImpl::clearContextMenu()
 {
-    if (m_webView->client())
-        m_webView->client()->clearContextMenu();
+    HitTestResult r = m_webView->page()->contextMenuController().hitTestResult();
+    LocalFrame* selectedFrame = r.innerNodeFrame();
+    if (!selectedFrame)
+        return;
+
+    WebFrameImpl* selectedWebFrame = WebFrameImpl::fromFrame(selectedFrame);
+    if (selectedWebFrame->client())
+        selectedWebFrame->client()->clearContextMenu();
 }
 
 static void populateSubMenuItems(const Vector<ContextMenuItem>& inputMenu, WebVector<WebMenuItemInfo>& subMenuItems)
diff --git a/Source/web/DatabaseClientImpl.cpp b/Source/web/DatabaseClientImpl.cpp
index 86c6714..c62af14 100644
--- a/Source/web/DatabaseClientImpl.cpp
+++ b/Source/web/DatabaseClientImpl.cpp
@@ -63,7 +63,7 @@
         if (webFrame->permissionClient())
             return webFrame->permissionClient()->allowDatabase(webFrame, name, displayName, estimatedSize);
     } else {
-        WorkerGlobalScope* workerGlobalScope = toWorkerGlobalScope(executionContext);
+        WorkerGlobalScope& workerGlobalScope = *toWorkerGlobalScope(executionContext);
         return WorkerPermissionClient::from(workerGlobalScope)->allowDatabase(name, displayName, estimatedSize);
     }
     return true;
diff --git a/Source/web/DragClientImpl.cpp b/Source/web/DragClientImpl.cpp
index a0b096b..01d809f 100644
--- a/Source/web/DragClientImpl.cpp
+++ b/Source/web/DragClientImpl.cpp
@@ -34,7 +34,7 @@
 #include "WebViewImpl.h"
 #include "core/clipboard/Clipboard.h"
 #include "core/clipboard/DataObject.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "platform/DragImage.h"
 #include "platform/geometry/IntSize.h"
 #include "platform/graphics/skia/NativeImageSkia.h"
@@ -63,13 +63,13 @@
                                const IntPoint& dragImageOrigin,
                                const IntPoint& eventPos,
                                Clipboard* clipboard,
-                               Frame* frame,
+                               LocalFrame* frame,
                                bool isLinkDrag)
 {
     // Add a ref to the frame just in case a load occurs mid-drag.
-    RefPtr<Frame> frameProtector = frame;
+    RefPtr<LocalFrame> frameProtector = frame;
 
-    WebDragData dragData = clipboard->dataObject();
+    WebDragData dragData(clipboard->dataObject());
     WebDragOperationsMask dragOperationMask = static_cast<WebDragOperationsMask>(clipboard->sourceOperation());
     WebImage image;
     IntSize offsetSize(eventPos - dragImageOrigin);
diff --git a/Source/web/DragClientImpl.h b/Source/web/DragClientImpl.h
index b0097a4..7c47496 100644
--- a/Source/web/DragClientImpl.h
+++ b/Source/web/DragClientImpl.h
@@ -55,7 +55,7 @@
         const WebCore::IntPoint& dragImageOrigin,
         const WebCore::IntPoint& eventPos,
         WebCore::Clipboard* clipboard,
-        WebCore::Frame* frame,
+        WebCore::LocalFrame* frame,
         bool isLinkDrag = false) OVERRIDE;
 
 private:
diff --git a/Source/web/EditorClientImpl.cpp b/Source/web/EditorClientImpl.cpp
index e4c936d..8a44151 100644
--- a/Source/web/EditorClientImpl.cpp
+++ b/Source/web/EditorClientImpl.cpp
@@ -58,7 +58,7 @@
         m_webView->client()->didChangeContents();
 }
 
-bool EditorClientImpl::canCopyCut(Frame* frame, bool defaultValue) const
+bool EditorClientImpl::canCopyCut(LocalFrame* frame, bool defaultValue) const
 {
     WebFrameImpl* webFrame = WebFrameImpl::fromFrame(frame);
     if (!webFrame->permissionClient())
@@ -66,7 +66,7 @@
     return webFrame->permissionClient()->allowWriteToClipboard(webFrame, defaultValue);
 }
 
-bool EditorClientImpl::canPaste(Frame* frame, bool defaultValue) const
+bool EditorClientImpl::canPaste(LocalFrame* frame, bool defaultValue) const
 {
     WebFrameImpl* webFrame = WebFrameImpl::fromFrame(frame);
     if (!webFrame->permissionClient())
diff --git a/Source/web/EditorClientImpl.h b/Source/web/EditorClientImpl.h
index 2df4155..4397089 100644
--- a/Source/web/EditorClientImpl.h
+++ b/Source/web/EditorClientImpl.h
@@ -35,7 +35,7 @@
 #include "wtf/Forward.h"
 
 namespace WebCore {
-class Frame;
+class LocalFrame;
 class HTMLInputElement;
 }
 
@@ -50,8 +50,8 @@
 
     virtual void respondToChangedContents() OVERRIDE;
     virtual void respondToChangedSelection(WebCore::SelectionType) OVERRIDE;
-    virtual bool canCopyCut(WebCore::Frame*, bool defaultValue) const OVERRIDE;
-    virtual bool canPaste(WebCore::Frame*, bool defaultValue) const OVERRIDE;
+    virtual bool canCopyCut(WebCore::LocalFrame*, bool defaultValue) const OVERRIDE;
+    virtual bool canPaste(WebCore::LocalFrame*, bool defaultValue) const OVERRIDE;
     virtual void didExecuteCommand(String commandName) OVERRIDE;
     virtual bool handleKeyboardEvent() OVERRIDE;
 
diff --git a/Source/web/ExternalPopupMenu.cpp b/Source/web/ExternalPopupMenu.cpp
index 3226b49..a1075db 100644
--- a/Source/web/ExternalPopupMenu.cpp
+++ b/Source/web/ExternalPopupMenu.cpp
@@ -36,8 +36,8 @@
 #include "WebPopupMenuInfo.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "platform/PopupMenuClient.h"
 #include "platform/geometry/FloatQuad.h"
 #include "platform/geometry/IntPoint.h"
@@ -48,7 +48,7 @@
 
 namespace blink {
 
-ExternalPopupMenu::ExternalPopupMenu(Frame& frame, PopupMenuClient* popupMenuClient, WebViewImpl& webView)
+ExternalPopupMenu::ExternalPopupMenu(LocalFrame& frame, PopupMenuClient* popupMenuClient, WebViewImpl& webView)
     : m_popupMenuClient(popupMenuClient)
     , m_frameView(frame.view())
     , m_webView(webView)
@@ -81,7 +81,7 @@
             m_syntheticEvent = adoptPtr(new WebMouseEvent);
             *m_syntheticEvent = *static_cast<const WebMouseEvent*>(currentEvent);
             m_syntheticEvent->type = WebInputEvent::MouseUp;
-            m_dispatchEventTimer.startOneShot(0);
+            m_dispatchEventTimer.startOneShot(0, FROM_HERE);
             // FIXME: show() is asynchronous. If preparing a popup is slow and
             // a user released the mouse button before showing the popup,
             // mouseup and click events are correctly dispatched. Dispatching
diff --git a/Source/web/ExternalPopupMenu.h b/Source/web/ExternalPopupMenu.h
index 0407851..ec0b832 100644
--- a/Source/web/ExternalPopupMenu.h
+++ b/Source/web/ExternalPopupMenu.h
@@ -39,7 +39,7 @@
 
 namespace WebCore {
 class FloatQuad;
-class Frame;
+class LocalFrame;
 class FrameView;
 class IntRect;
 class IntSize;
@@ -57,7 +57,7 @@
 // to the WebCore popup menu.
 class ExternalPopupMenu FINAL : public WebCore::PopupMenu, public WebExternalPopupMenuClient {
 public:
-    ExternalPopupMenu(WebCore::Frame&, WebCore::PopupMenuClient*, WebViewImpl&);
+    ExternalPopupMenu(WebCore::LocalFrame&, WebCore::PopupMenuClient*, WebViewImpl&);
     virtual ~ExternalPopupMenu();
 
 private:
diff --git a/Source/web/FindInPageCoordinates.cpp b/Source/web/FindInPageCoordinates.cpp
index 1cff915..77d9617 100644
--- a/Source/web/FindInPageCoordinates.cpp
+++ b/Source/web/FindInPageCoordinates.cpp
@@ -33,7 +33,7 @@
 
 #include "core/dom/Node.h"
 #include "core/dom/Range.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "core/rendering/RenderBlock.h"
 #include "core/rendering/RenderBox.h"
 #include "core/rendering/RenderObject.h"
diff --git a/Source/web/FrameLoaderClientImpl.cpp b/Source/web/FrameLoaderClientImpl.cpp
index 26bddc9..8cdf3eb 100644
--- a/Source/web/FrameLoaderClientImpl.cpp
+++ b/Source/web/FrameLoaderClientImpl.cpp
@@ -60,9 +60,7 @@
 #include "core/events/MouseEvent.h"
 #include "core/dom/WheelController.h"
 #include "core/html/HTMLAppletElement.h"
-#include "core/html/HTMLFormElement.h" // needed by core/loader/FormState.h
 #include "core/loader/DocumentLoader.h"
-#include "core/loader/FormState.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/HistoryItem.h"
@@ -76,6 +74,7 @@
 #include "core/rendering/HitTestResult.h"
 #include "modules/device_orientation/DeviceMotionController.h"
 #include "modules/device_orientation/DeviceOrientationController.h"
+#include "modules/screen_orientation/ScreenOrientationController.h"
 #include "platform/MIMETypeRegistry.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/exported/WrappedResourceRequest.h"
@@ -84,6 +83,7 @@
 #include "platform/network/SocketStreamHandleInternal.h"
 #include "platform/plugins/PluginData.h"
 #include "public/platform/Platform.h"
+#include "public/platform/WebApplicationCacheHost.h"
 #include "public/platform/WebMimeRegistry.h"
 #include "public/platform/WebRTCPeerConnectionHandler.h"
 #include "public/platform/WebServiceWorkerProvider.h"
@@ -116,11 +116,13 @@
         m_webFrame->client()->didClearWindowObject(m_webFrame, world->worldId());
         Document* document = m_webFrame->frame()->document();
         if (document) {
-            WheelController::from(document);
+            WheelController::from(*document);
             if (RuntimeEnabledFeatures::deviceMotionEnabled())
-                DeviceMotionController::from(document);
+                DeviceMotionController::from(*document);
             if (RuntimeEnabledFeatures::deviceOrientationEnabled())
-                DeviceOrientationController::from(document);
+                DeviceOrientationController::from(*document);
+            if (RuntimeEnabledFeatures::screenOrientationEnabled())
+                ScreenOrientationController::from(*document);
         }
     }
 }
@@ -131,12 +133,6 @@
         m_webFrame->client()->didCreateDocumentElement(m_webFrame);
 }
 
-void FrameLoaderClientImpl::didExhaustMemoryAvailableForScript()
-{
-    if (m_webFrame->client())
-        m_webFrame->client()->didExhaustMemoryAvailableForScript(m_webFrame);
-}
-
 void FrameLoaderClientImpl::didCreateScriptContext(v8::Handle<v8::Context> context, int extensionGroup, int worldId)
 {
     WebViewImpl* webview = m_webFrame->viewImpl();
@@ -168,6 +164,12 @@
         m_webFrame->client()->didChangeScrollOffset(m_webFrame);
 }
 
+void FrameLoaderClientImpl::didUpdateCurrentHistoryItem()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didUpdateCurrentHistoryItem(m_webFrame);
+}
+
 bool FrameLoaderClientImpl::allowScript(bool enabledPerSettings)
 {
     if (m_webFrame->permissionClient())
@@ -234,6 +236,18 @@
     return m_webFrame->viewImpl();
 }
 
+Frame* FrameLoaderClientImpl::opener() const
+{
+    WebFrameImpl* opener = toWebFrameImpl(m_webFrame->opener());
+    return opener ? opener->frame() : 0;
+}
+
+void FrameLoaderClientImpl::setOpener(Frame* opener)
+{
+    // FIXME: Temporary hack to stage converting locations that really should be Frame.
+    m_webFrame->setOpener(WebFrameImpl::fromFrame(toLocalFrame(opener)));
+}
+
 Frame* FrameLoaderClientImpl::parent() const
 {
     WebFrameImpl* frame = toWebFrameImpl(m_webFrame->parent());
@@ -287,9 +301,9 @@
     m_webFrame->setClient(0);
 
     client->frameDetached(m_webFrame);
-    // Clear our reference to WebCore::Frame at the very end, in case the client
+    // Clear our reference to WebCore::LocalFrame at the very end, in case the client
     // refers to it.
-    m_webFrame->setWebCoreFrame(0);
+    m_webFrame->setWebCoreFrame(nullptr);
 }
 
 void FrameLoaderClientImpl::dispatchWillRequestAfterPreconnect(ResourceRequest& request)
@@ -396,7 +410,7 @@
         m_webFrame->client()->didChangeIcon(m_webFrame, static_cast<WebIconURL::Type>(type));
 }
 
-void FrameLoaderClientImpl::dispatchDidCommitLoad(Frame* frame, HistoryItem* item, HistoryCommitType commitType)
+void FrameLoaderClientImpl::dispatchDidCommitLoad(LocalFrame* frame, HistoryItem* item, HistoryCommitType commitType)
 {
     m_webFrame->frame()->page()->historyController().updateForCommit(frame, item, commitType);
     m_webFrame->viewImpl()->didCommitLoad(commitType == StandardCommit, false);
@@ -464,16 +478,16 @@
     }
 }
 
-void FrameLoaderClientImpl::dispatchWillSendSubmitEvent(PassRefPtr<FormState> prpFormState)
+void FrameLoaderClientImpl::dispatchWillSendSubmitEvent(HTMLFormElement* form)
 {
     if (m_webFrame->client())
-        m_webFrame->client()->willSendSubmitEvent(m_webFrame, WebFormElement(prpFormState->form()));
+        m_webFrame->client()->willSendSubmitEvent(m_webFrame, WebFormElement(form));
 }
 
-void FrameLoaderClientImpl::dispatchWillSubmitForm(PassRefPtr<FormState> formState)
+void FrameLoaderClientImpl::dispatchWillSubmitForm(HTMLFormElement* form)
 {
     if (m_webFrame->client())
-        m_webFrame->client()->willSubmitForm(m_webFrame, WebFormElement(formState->form()));
+        m_webFrame->client()->willSubmitForm(m_webFrame, WebFormElement(form));
 }
 
 void FrameLoaderClientImpl::postProgressStartedNotification(LoadStartType loadStartType)
@@ -503,7 +517,8 @@
 void FrameLoaderClientImpl::loadURLExternally(const ResourceRequest& request, NavigationPolicy policy, const String& suggestedName)
 {
     if (m_webFrame->client()) {
-        DocumentFullscreen::webkitCancelFullScreen(m_webFrame->frame()->document());
+        ASSERT(m_webFrame->frame()->document());
+        DocumentFullscreen::webkitCancelFullScreen(*m_webFrame->frame()->document());
         WrappedResourceRequest webreq(request);
         m_webFrame->client()->loadURLExternally(
             m_webFrame, webreq, static_cast<WebNavigationPolicy>(policy), suggestedName);
@@ -531,12 +546,6 @@
         m_webFrame->client()->didAccessInitialDocument(m_webFrame);
 }
 
-void FrameLoaderClientImpl::didDisownOpener()
-{
-    if (m_webFrame->client())
-        m_webFrame->client()->didDisownOpener(m_webFrame);
-}
-
 void FrameLoaderClientImpl::didDisplayInsecureContent()
 {
     if (m_webFrame->client())
@@ -567,7 +576,7 @@
         client->didMatchCSS(m_webFrame, WebVector<WebString>(addedSelectors), WebVector<WebString>(removedSelectors));
 }
 
-PassRefPtr<DocumentLoader> FrameLoaderClientImpl::createDocumentLoader(Frame* frame, const ResourceRequest& request, const SubstituteData& data)
+PassRefPtr<DocumentLoader> FrameLoaderClientImpl::createDocumentLoader(LocalFrame* frame, const ResourceRequest& request, const SubstituteData& data)
 {
     RefPtr<WebDataSourceImpl> ds = WebDataSourceImpl::create(frame, request, data);
     if (m_webFrame->client())
@@ -599,7 +608,7 @@
     m_webFrame->createFrameView();
 }
 
-PassRefPtr<Frame> FrameLoaderClientImpl::createFrame(
+PassRefPtr<LocalFrame> FrameLoaderClientImpl::createFrame(
     const KURL& url,
     const AtomicString& name,
     const Referrer& referrer,
@@ -611,16 +620,16 @@
 }
 
 PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
-    const IntSize& size, // FIXME: how do we use this?
     HTMLPlugInElement* element,
     const KURL& url,
     const Vector<String>& paramNames,
     const Vector<String>& paramValues,
     const String& mimeType,
-    bool loadManually)
+    bool loadManually,
+    DetachedPluginPolicy policy)
 {
     if (!m_webFrame->client())
-        return 0;
+        return nullptr;
 
     WebPluginParams params;
     params.url = url;
@@ -631,31 +640,29 @@
 
     WebPlugin* webPlugin = m_webFrame->client()->createPlugin(m_webFrame, params);
     if (!webPlugin)
-        return 0;
+        return nullptr;
 
     // The container takes ownership of the WebPlugin.
     RefPtr<WebPluginContainerImpl> container =
         WebPluginContainerImpl::create(element, webPlugin);
 
     if (!webPlugin->initialize(container.get()))
-        return 0;
+        return nullptr;
 
-    // The element might have been removed during plugin initialization!
-    if (!element->renderer())
-        return 0;
+    if (policy != AllowDetachedPlugin && !element->renderer())
+        return nullptr;
 
     return container;
 }
 
 PassRefPtr<Widget> FrameLoaderClientImpl::createJavaAppletWidget(
-    const IntSize& size,
     HTMLAppletElement* element,
     const KURL& /* baseURL */,
     const Vector<String>& paramNames,
     const Vector<String>& paramValues)
 {
-    return createPlugin(size, element, KURL(), paramNames, paramValues,
-        "application/x-java-applet", false);
+    return createPlugin(element, KURL(), paramNames, paramValues,
+        "application/x-java-applet", false, FailOnDetachedPlugin);
 }
 
 ObjectContentType FrameLoaderClientImpl::objectContentType(
@@ -743,10 +750,10 @@
     m_webFrame->client()->willStartUsingPeerConnectionHandler(webFrame(), handler);
 }
 
-void FrameLoaderClientImpl::didRequestAutocomplete(PassRefPtr<FormState> formState)
+void FrameLoaderClientImpl::didRequestAutocomplete(HTMLFormElement* form)
 {
     if (m_webFrame->viewImpl() && m_webFrame->viewImpl()->autofillClient())
-        m_webFrame->viewImpl()->autofillClient()->didRequestAutocomplete(m_webFrame, WebFormElement(formState->form()));
+        m_webFrame->viewImpl()->autofillClient()->didRequestAutocomplete(m_webFrame, WebFormElement(form));
 }
 
 bool FrameLoaderClientImpl::allowWebGL(bool enabledPerSettings)
@@ -767,13 +774,16 @@
 {
     if (m_webFrame->client())
         m_webFrame->client()->willInsertBody(m_webFrame);
+
+    if (m_webFrame->viewImpl())
+        m_webFrame->viewImpl()->willInsertBody(m_webFrame);
 }
 
-PassOwnPtr<WebServiceWorkerProvider> FrameLoaderClientImpl::createServiceWorkerProvider(PassOwnPtr<WebServiceWorkerProviderClient> client)
+PassOwnPtr<WebServiceWorkerProvider> FrameLoaderClientImpl::createServiceWorkerProvider()
 {
     if (!m_webFrame->client())
         return nullptr;
-    return adoptPtr(m_webFrame->client()->createServiceWorkerProvider(m_webFrame, client.leakPtr()));
+    return adoptPtr(m_webFrame->client()->createServiceWorkerProvider(m_webFrame));
 }
 
 SharedWorkerRepositoryClient* FrameLoaderClientImpl::sharedWorkerRepositoryClient()
@@ -781,6 +791,13 @@
     return m_webFrame->sharedWorkerRepositoryClient();
 }
 
+PassOwnPtr<WebApplicationCacheHost> FrameLoaderClientImpl::createApplicationCacheHost(WebApplicationCacheHostClient* client)
+{
+    if (!m_webFrame->client())
+        return nullptr;
+    return adoptPtr(m_webFrame->client()->createApplicationCacheHost(m_webFrame, client));
+}
+
 void FrameLoaderClientImpl::didStopAllLoaders()
 {
     if (m_webFrame->client())
diff --git a/Source/web/FrameLoaderClientImpl.h b/Source/web/FrameLoaderClientImpl.h
index fef39a2..b08e6a0 100644
--- a/Source/web/FrameLoaderClientImpl.h
+++ b/Source/web/FrameLoaderClientImpl.h
@@ -58,9 +58,6 @@
     virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*) OVERRIDE;
     virtual void documentElementAvailable() OVERRIDE;
 
-    // Script in the page tried to allocate too much memory.
-    virtual void didExhaustMemoryAvailableForScript();
-
     virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId) OVERRIDE;
     virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId) OVERRIDE;
 
@@ -69,6 +66,8 @@
     virtual bool allowScriptExtension(const String& extensionName, int extensionGroup, int worldId) OVERRIDE;
 
     virtual bool hasWebView() const OVERRIDE;
+    virtual WebCore::Frame* opener() const OVERRIDE;
+    virtual void setOpener(WebCore::Frame*) OVERRIDE;
     virtual WebCore::Frame* parent() const OVERRIDE;
     virtual WebCore::Frame* top() const OVERRIDE;
     virtual WebCore::Frame* previousSibling() const OVERRIDE;
@@ -89,7 +88,7 @@
     virtual void dispatchDidStartProvisionalLoad() OVERRIDE;
     virtual void dispatchDidReceiveTitle(const String&) OVERRIDE;
     virtual void dispatchDidChangeIcons(WebCore::IconType) OVERRIDE;
-    virtual void dispatchDidCommitLoad(WebCore::Frame*, WebCore::HistoryItem*, WebCore::HistoryCommitType) OVERRIDE;
+    virtual void dispatchDidCommitLoad(WebCore::LocalFrame*, WebCore::HistoryItem*, WebCore::HistoryCommitType) OVERRIDE;
     virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&) OVERRIDE;
     virtual void dispatchDidFailLoad(const WebCore::ResourceError&) OVERRIDE;
     virtual void dispatchDidFinishDocumentLoad() OVERRIDE;
@@ -97,31 +96,29 @@
     virtual void dispatchDidFirstVisuallyNonEmptyLayout() OVERRIDE;
     virtual WebCore::NavigationPolicy decidePolicyForNavigation(const WebCore::ResourceRequest&, WebCore::DocumentLoader*, WebCore::NavigationPolicy) OVERRIDE;
     virtual void dispatchWillRequestResource(WebCore::FetchRequest*) OVERRIDE;
-    virtual void dispatchWillSendSubmitEvent(PassRefPtr<WebCore::FormState>) OVERRIDE;
-    virtual void dispatchWillSubmitForm(PassRefPtr<WebCore::FormState>) OVERRIDE;
+    virtual void dispatchWillSendSubmitEvent(WebCore::HTMLFormElement*) OVERRIDE;
+    virtual void dispatchWillSubmitForm(WebCore::HTMLFormElement*) OVERRIDE;
     virtual void postProgressStartedNotification(WebCore::LoadStartType) OVERRIDE;
     virtual void postProgressEstimateChangedNotification() OVERRIDE;
     virtual void postProgressFinishedNotification() OVERRIDE;
     virtual void loadURLExternally(const WebCore::ResourceRequest&, WebCore::NavigationPolicy, const String& suggestedName = String()) OVERRIDE;
     virtual bool navigateBackForward(int offset) const OVERRIDE;
     virtual void didAccessInitialDocument() OVERRIDE;
-    virtual void didDisownOpener() OVERRIDE;
     virtual void didDisplayInsecureContent() OVERRIDE;
     virtual void didRunInsecureContent(WebCore::SecurityOrigin*, const WebCore::KURL& insecureURL) OVERRIDE;
     virtual void didDetectXSS(const WebCore::KURL&, bool didBlockEntirePage) OVERRIDE;
     virtual void didDispatchPingLoader(const WebCore::KURL&) OVERRIDE;
     virtual void selectorMatchChanged(const Vector<String>& addedSelectors, const Vector<String>& removedSelectors) OVERRIDE;
-    virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(WebCore::Frame*, const WebCore::ResourceRequest&, const WebCore::SubstituteData&) OVERRIDE;
+    virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(WebCore::LocalFrame*, const WebCore::ResourceRequest&, const WebCore::SubstituteData&) OVERRIDE;
     virtual WTF::String userAgent(const WebCore::KURL&) OVERRIDE;
     virtual WTF::String doNotTrackValue() OVERRIDE;
     virtual void transitionToCommittedForNewPage() OVERRIDE;
-    virtual PassRefPtr<WebCore::Frame> createFrame(const WebCore::KURL&, const WTF::AtomicString& name, const WebCore::Referrer&, WebCore::HTMLFrameOwnerElement*) OVERRIDE;
+    virtual PassRefPtr<WebCore::LocalFrame> createFrame(const WebCore::KURL&, const WTF::AtomicString& name, const WebCore::Referrer&, WebCore::HTMLFrameOwnerElement*) OVERRIDE;
     virtual PassRefPtr<WebCore::Widget> createPlugin(
-        const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&,
+        WebCore::HTMLPlugInElement*, const WebCore::KURL&,
         const Vector<WTF::String>&, const Vector<WTF::String>&,
-        const WTF::String&, bool loadManually) OVERRIDE;
+        const WTF::String&, bool loadManually, DetachedPluginPolicy) OVERRIDE;
     virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(
-        const WebCore::IntSize&,
         WebCore::HTMLAppletElement*,
         const WebCore::KURL& /* base_url */,
         const Vector<WTF::String>& paramNames,
@@ -129,6 +126,7 @@
     virtual WebCore::ObjectContentType objectContentType(
         const WebCore::KURL&, const WTF::String& mimeType, bool shouldPreferPlugInsForImages) OVERRIDE;
     virtual void didChangeScrollOffset() OVERRIDE;
+    virtual void didUpdateCurrentHistoryItem() OVERRIDE;
     virtual bool allowScript(bool enabledPerSettings) OVERRIDE;
     virtual bool allowScriptFromSource(bool enabledPerSettings, const WebCore::KURL& scriptURL) OVERRIDE;
     virtual bool allowPlugins(bool enabledPerSettings) OVERRIDE;
@@ -146,16 +144,18 @@
 
     virtual void dispatchWillStartUsingPeerConnectionHandler(blink::WebRTCPeerConnectionHandler*) OVERRIDE;
 
-    virtual void didRequestAutocomplete(PassRefPtr<WebCore::FormState>) OVERRIDE;
+    virtual void didRequestAutocomplete(WebCore::HTMLFormElement*) OVERRIDE;
 
     virtual bool allowWebGL(bool enabledPerSettings) OVERRIDE;
     virtual void didLoseWebGLContext(int arbRobustnessContextLostReason) OVERRIDE;
 
     virtual void dispatchWillInsertBody() OVERRIDE;
 
-    virtual PassOwnPtr<WebServiceWorkerProvider> createServiceWorkerProvider(PassOwnPtr<WebServiceWorkerProviderClient>) OVERRIDE;
+    virtual PassOwnPtr<WebServiceWorkerProvider> createServiceWorkerProvider() OVERRIDE;
     virtual WebCore::SharedWorkerRepositoryClient* sharedWorkerRepositoryClient() OVERRIDE;
 
+    virtual PassOwnPtr<WebApplicationCacheHost> createApplicationCacheHost(WebApplicationCacheHostClient*) OVERRIDE;
+
     virtual void didStopAllLoaders() OVERRIDE;
 
 private:
diff --git a/Source/web/FullscreenController.cpp b/Source/web/FullscreenController.cpp
index 651ef36..46314ce 100644
--- a/Source/web/FullscreenController.cpp
+++ b/Source/web/FullscreenController.cpp
@@ -37,8 +37,8 @@
 #include "WebViewImpl.h"
 #include "core/dom/Document.h"
 #include "core/dom/FullscreenElementStack.h"
+#include "core/frame/LocalFrame.h"
 #include "core/html/HTMLMediaElement.h"
-#include "core/frame/Frame.h"
 #include "platform/LayoutTestSupport.h"
 
 using namespace WebCore;
@@ -65,7 +65,7 @@
     // Ensure that this element's document is still attached.
     Document& doc = m_provisionalFullScreenElement->document();
     if (doc.frame()) {
-        FullscreenElementStack::from(&doc)->webkitWillEnterFullScreenForElement(m_provisionalFullScreenElement.get());
+        FullscreenElementStack::from(doc).webkitWillEnterFullScreenForElement(m_provisionalFullScreenElement.get());
         m_fullScreenFrame = doc.frame();
     }
     m_provisionalFullScreenElement.clear();
@@ -77,18 +77,18 @@
         return;
 
     if (Document* doc = m_fullScreenFrame->document()) {
-        if (FullscreenElementStack::isFullScreen(doc)) {
+        if (FullscreenElementStack::isFullScreen(*doc)) {
             if (!m_exitFullscreenPageScaleFactor) {
                 m_exitFullscreenPageScaleFactor = m_webViewImpl->pageScaleFactor();
                 m_exitFullscreenScrollOffset = m_webViewImpl->mainFrame()->scrollOffset();
                 m_webViewImpl->setPageScaleFactorPreservingScrollOffset(1.0f);
             }
 
-            FullscreenElementStack::from(doc)->webkitDidEnterFullScreenForElement(0);
+            FullscreenElementStack::from(*doc).webkitDidEnterFullScreenForElement(0);
             if (RuntimeEnabledFeatures::overlayFullscreenVideoEnabled()) {
-                Element* element = FullscreenElementStack::currentFullScreenElementFrom(doc);
+                Element* element = FullscreenElementStack::currentFullScreenElementFrom(*doc);
                 ASSERT(element);
-                if (element->isMediaElement() && m_webViewImpl->layerTreeView())
+                if (isHTMLMediaElement(*element) && m_webViewImpl->layerTreeView())
                     m_webViewImpl->layerTreeView()->setHasTransparentBackground(true);
             }
         }
@@ -101,10 +101,10 @@
         return;
 
     if (Document* doc = m_fullScreenFrame->document()) {
-        FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(doc);
+        FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(*doc);
         if (!fullscreen)
             return;
-        if (fullscreen->isFullScreen(doc)) {
+        if (fullscreen->isFullScreen(*doc)) {
             // When the client exits from full screen we have to call webkitCancelFullScreen to
             // notify the document. While doing that, suppress notifications back to the client.
             m_isCancelingFullScreen = true;
@@ -123,7 +123,7 @@
         return;
 
     if (Document* doc = m_fullScreenFrame->document()) {
-        if (FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(doc)) {
+        if (FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(*doc)) {
             if (fullscreen->webkitIsFullScreen()) {
                 if (m_exitFullscreenPageScaleFactor) {
                     m_webViewImpl->setPageScaleFactor(m_exitFullscreenPageScaleFactor,
@@ -157,7 +157,7 @@
     }
 
     if (RuntimeEnabledFeatures::overlayFullscreenVideoEnabled()
-        && element && element->isMediaElement()
+        && isHTMLMediaElement(element)
         // FIXME: There is no embedder-side handling in layout test mode.
         && !isRunningLayoutTest()) {
         HTMLMediaElement* mediaElement = toHTMLMediaElement(element);
@@ -181,7 +181,7 @@
     if (m_isCancelingFullScreen)
         return;
     if (RuntimeEnabledFeatures::overlayFullscreenVideoEnabled()
-        && element && element->isMediaElement()
+        && isHTMLMediaElement(element)
         // FIXME: There is no embedder-side handling in layout test mode.
         && !isRunningLayoutTest()) {
         HTMLMediaElement* mediaElement = toHTMLMediaElement(element);
diff --git a/Source/web/FullscreenController.h b/Source/web/FullscreenController.h
index 5f00369..db413cb 100644
--- a/Source/web/FullscreenController.h
+++ b/Source/web/FullscreenController.h
@@ -37,7 +37,7 @@
 
 namespace WebCore {
 class Element;
-class Frame;
+class LocalFrame;
 }
 
 namespace blink {
@@ -68,7 +68,7 @@
     RefPtr<WebCore::Element> m_provisionalFullScreenElement;
 
     // If set, the WebView is in fullscreen mode for an element in this frame.
-    RefPtr<WebCore::Frame> m_fullScreenFrame;
+    RefPtr<WebCore::LocalFrame> m_fullScreenFrame;
 
     bool m_isCancelingFullScreen;
 };
diff --git a/Source/web/IDBFactoryBackendProxy.cpp b/Source/web/IDBFactoryBackendProxy.cpp
index a18facb..2550490 100644
--- a/Source/web/IDBFactoryBackendProxy.cpp
+++ b/Source/web/IDBFactoryBackendProxy.cpp
@@ -61,7 +61,7 @@
         return !webFrame->permissionClient() || webFrame->permissionClient()->allowIndexedDB(webFrame, name, origin);
     }
 
-    WorkerGlobalScope* workerGlobalScope = toWorkerGlobalScope(context);
+    WorkerGlobalScope& workerGlobalScope = *toWorkerGlobalScope(context);
     return WorkerPermissionClient::from(workerGlobalScope)->allowIndexedDB(name);
 }
 
diff --git a/Source/web/InspectorClientImpl.cpp b/Source/web/InspectorClientImpl.cpp
index 004f247..42521e3 100644
--- a/Source/web/InspectorClientImpl.cpp
+++ b/Source/web/InspectorClientImpl.cpp
@@ -38,6 +38,7 @@
 #include "core/frame/DOMWindow.h"
 #include "core/page/Page.h"
 #include "core/frame/Settings.h"
+#include "platform/JSONValues.h"
 #include "platform/geometry/FloatRect.h"
 #include "public/platform/WebRect.h"
 #include "public/platform/WebURL.h"
@@ -70,11 +71,16 @@
         agent->hideHighlight();
 }
 
-bool InspectorClientImpl::sendMessageToFrontend(const WTF::String& message)
+void InspectorClientImpl::sendMessageToFrontend(PassRefPtr<WebCore::JSONObject> message)
 {
     if (WebDevToolsAgentImpl* agent = devToolsAgent())
-        return agent->sendMessageToFrontend(message);
-    return false;
+        agent->sendMessageToFrontend(message);
+}
+
+void InspectorClientImpl::flush()
+{
+    if (WebDevToolsAgentImpl* agent = devToolsAgent())
+        agent->flush();
 }
 
 void InspectorClientImpl::updateInspectorStateCookie(const WTF::String& inspectorState)
@@ -160,10 +166,16 @@
         agent->dispatchMouseEvent(event);
 }
 
-void InspectorClientImpl::setTraceEventCallback(TraceEventCallback callback)
+void InspectorClientImpl::setTraceEventCallback(const String& categoryFilter, TraceEventCallback callback)
 {
     if (WebDevToolsAgentImpl* agent = devToolsAgent())
-        agent->setTraceEventCallback(callback);
+        agent->setTraceEventCallback(categoryFilter, callback);
+}
+
+void InspectorClientImpl::resetTraceEventCallback()
+{
+    if (WebDevToolsAgentImpl* agent = devToolsAgent())
+        agent->resetTraceEventCallback();
 }
 
 void InspectorClientImpl::startGPUEventsRecording()
diff --git a/Source/web/InspectorClientImpl.h b/Source/web/InspectorClientImpl.h
index e402d46..7b2b81a 100644
--- a/Source/web/InspectorClientImpl.h
+++ b/Source/web/InspectorClientImpl.h
@@ -51,7 +51,8 @@
     virtual void highlight() OVERRIDE;
     virtual void hideHighlight() OVERRIDE;
 
-    virtual bool sendMessageToFrontend(const WTF::String&) OVERRIDE;
+    virtual void sendMessageToFrontend(PassRefPtr<WebCore::JSONObject>) OVERRIDE;
+    virtual void flush() OVERRIDE;
 
     virtual void updateInspectorStateCookie(const WTF::String&) OVERRIDE;
 
@@ -74,7 +75,8 @@
     virtual void dispatchKeyEvent(const WebCore::PlatformKeyboardEvent&) OVERRIDE;
     virtual void dispatchMouseEvent(const WebCore::PlatformMouseEvent&) OVERRIDE;
 
-    virtual void setTraceEventCallback(TraceEventCallback) OVERRIDE;
+    virtual void setTraceEventCallback(const String& categoryFilter, TraceEventCallback) OVERRIDE;
+    virtual void resetTraceEventCallback() OVERRIDE;
 
     virtual void startGPUEventsRecording() OVERRIDE;
     virtual void stopGPUEventsRecording() OVERRIDE;
diff --git a/Source/web/InspectorFrontendClientImpl.cpp b/Source/web/InspectorFrontendClientImpl.cpp
index f0c528f..7d7e727 100644
--- a/Source/web/InspectorFrontendClientImpl.cpp
+++ b/Source/web/InspectorFrontendClientImpl.cpp
@@ -36,8 +36,8 @@
 #include "WebDevToolsFrontendImpl.h"
 #include "bindings/v8/ScriptController.h"
 #include "core/dom/Document.h"
+#include "core/frame/LocalFrame.h"
 #include "core/inspector/InspectorFrontendHost.h"
-#include "core/frame/Frame.h"
 #include "core/page/Page.h"
 #include "public/platform/WebFloatPoint.h"
 #include "public/platform/WebString.h"
@@ -78,7 +78,7 @@
     if (scriptController) {
         String installAdditionalAPI =
             "" // Wrap messages that go to embedder.
-            "(function(host, methodNames) {"
+            "(function(host, methodEntries) {"
             "    host._lastCallId = 0;"
             "    host._callbacks = [];"
             "    host.embedderMessageAck = function(id, error)"
@@ -88,40 +88,41 @@
             "        if (callback)"
             "            callback(error);"
             "    };"
-            "    function dispatch(methodName)"
+            "    function dispatch(methodName, argumentCount)"
             "    {"
             "        var callId = ++host._lastCallId;"
-            "        var argsArray = Array.prototype.slice.call(arguments, 1);"
+            "        var argsArray = Array.prototype.slice.call(arguments, 2);"
             "        var callback = argsArray[argsArray.length - 1];"
             "        if (typeof callback === \"function\") {"
             "            argsArray.pop();"
             "            host._callbacks[callId] = callback;"
             "        }"
             "        var message = { \"id\": callId, \"method\": methodName };"
+            "        argsArray = argsArray.slice(0, argumentCount);"
             "        if (argsArray.length)"
             "            message.params = argsArray;"
             "        host.sendMessageToEmbedder(JSON.stringify(message));"
             "    };"
-            "    methodNames.forEach(function(methodName) { host[methodName] = dispatch.bind(null, methodName); });"
+            "    methodEntries.forEach(function(methodEntry) { host[methodEntry[0]] = dispatch.bind(null, methodEntry[0], methodEntry[1]); });"
             "})(InspectorFrontendHost,"
-            "    ['addFileSystem',"
-            "     'append',"
-            "     'bringToFront',"
-            "     'closeWindow',"
-            "     'indexPath',"
-            "     'inspectElementCompleted',"
-            "     'moveWindowBy',"
-            "     'openInNewTab',"
-            "     'removeFileSystem',"
-            "     'requestFileSystems',"
-            "     'resetZoom',"
-            "     'save',"
-            "     'searchInPath',"
-            "     'setContentsResizingStrategy',"
-            "     'setIsDocked',"
-            "     'stopIndexing',"
-            "     'zoomIn',"
-            "     'zoomOut']);"
+            "    [['addFileSystem', 0],"
+            "     ['append', 2],"
+            "     ['bringToFront', 0],"
+            "     ['closeWindow', 0],"
+            "     ['indexPath', 2],"
+            "     ['inspectElementCompleted', 0],"
+            "     ['moveWindowBy', 2],"
+            "     ['openInNewTab', 1],"
+            "     ['removeFileSystem', 1],"
+            "     ['requestFileSystems', 0],"
+            "     ['resetZoom', 0],"
+            "     ['save', 3],"
+            "     ['searchInPath', 3],"
+            "     ['setContentsResizingStrategy', 2],"
+            "     ['setIsDocked', 1],"
+            "     ['stopIndexing', 1],"
+            "     ['zoomIn', 0],"
+            "     ['zoomOut', 0]]);"
             ""
             "" // Support for legacy front-ends (<M34). Do not add items here.
             "InspectorFrontendHost.requestSetDockSide = function(dockSide)"
diff --git a/Source/web/LinkHighlight.cpp b/Source/web/LinkHighlight.cpp
index be749e3..df2bc6f 100644
--- a/Source/web/LinkHighlight.cpp
+++ b/Source/web/LinkHighlight.cpp
@@ -32,13 +32,13 @@
 #include "WebKit.h"
 #include "WebViewImpl.h"
 #include "core/dom/Node.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
-#include "core/rendering/CompositedLayerMapping.h"
+#include "core/frame/LocalFrame.h"
 #include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderLayerModelObject.h"
 #include "core/rendering/RenderObject.h"
 #include "core/rendering/RenderView.h"
+#include "core/rendering/compositing/CompositedLayerMapping.h"
 #include "core/rendering/style/ShadowData.h"
 #include "platform/graphics/Color.h"
 #include "public/platform/Platform.h"
@@ -309,11 +309,11 @@
     }
 }
 
-void LinkHighlight::notifyAnimationStarted(double, double, blink::WebAnimation::TargetProperty)
+void LinkHighlight::notifyAnimationStarted(double, blink::WebAnimation::TargetProperty)
 {
 }
 
-void LinkHighlight::notifyAnimationFinished(double, double, blink::WebAnimation::TargetProperty)
+void LinkHighlight::notifyAnimationFinished(double, blink::WebAnimation::TargetProperty)
 {
     // Since WebViewImpl may hang on to us for a while, make sure we
     // release resources as soon as possible.
diff --git a/Source/web/LinkHighlight.h b/Source/web/LinkHighlight.h
index 7919556..a22ed5f 100644
--- a/Source/web/LinkHighlight.h
+++ b/Source/web/LinkHighlight.h
@@ -63,8 +63,8 @@
     virtual void paintContents(WebCanvas*, const WebRect& clipRect, bool canPaintLCDText, WebFloatRect& opaque) OVERRIDE;
 
     // WebAnimationDelegate implementation.
-    virtual void notifyAnimationStarted(double wallClockTime, double monotonicTime, blink::WebAnimation::TargetProperty) OVERRIDE;
-    virtual void notifyAnimationFinished(double wallClockTime, double monotonicTime, blink::WebAnimation::TargetProperty) OVERRIDE;
+    virtual void notifyAnimationStarted(double monotonicTime, blink::WebAnimation::TargetProperty) OVERRIDE;
+    virtual void notifyAnimationFinished(double monotonicTime, blink::WebAnimation::TargetProperty) OVERRIDE;
 
     // LinkHighlightClient inplementation.
     virtual void invalidate() OVERRIDE;
diff --git a/Source/web/LocalFileSystemClient.cpp b/Source/web/LocalFileSystemClient.cpp
index 3280435..cebefbc 100644
--- a/Source/web/LocalFileSystemClient.cpp
+++ b/Source/web/LocalFileSystemClient.cpp
@@ -35,7 +35,9 @@
 #include "WorkerPermissionClient.h"
 #include "core/dom/Document.h"
 #include "core/workers/WorkerGlobalScope.h"
+#include "platform/PermissionCallbacks.h"
 #include "platform/weborigin/SecurityOrigin.h"
+#include "public/platform/WebPermissionCallbacks.h"
 #include "public/web/WebPermissionClient.h"
 #include "wtf/text/WTFString.h"
 
@@ -54,13 +56,31 @@
 
 bool LocalFileSystemClient::allowFileSystem(ExecutionContext* context)
 {
+    ASSERT(context);
     if (context->isDocument()) {
         Document* document = toDocument(context);
         WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
         return !webFrame->permissionClient() || webFrame->permissionClient()->allowFileSystem(webFrame);
     }
     ASSERT(context->isWorkerGlobalScope());
-    return WorkerPermissionClient::from(toWorkerGlobalScope(context))->allowFileSystem();
+    return WorkerPermissionClient::from(*toWorkerGlobalScope(context))->allowFileSystem();
+}
+
+void LocalFileSystemClient::requestFileSystemAccess(ExecutionContext* context, PassOwnPtr<WebCore::PermissionCallbacks> callbacks)
+{
+    ASSERT(context);
+    if (context->isDocument()) {
+        Document* document = toDocument(context);
+        WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
+        if (!webFrame->permissionClient()) {
+            callbacks->onAllowed();
+            return;
+        }
+        webFrame->permissionClient()->requestFileSystemAccess(webFrame, callbacks);
+        return;
+    }
+    ASSERT(context->isWorkerGlobalScope());
+    WorkerPermissionClient::from(*toWorkerGlobalScope(context))->requestFileSystemAccess(callbacks);
 }
 
 LocalFileSystemClient::LocalFileSystemClient()
diff --git a/Source/web/LocalFileSystemClient.h b/Source/web/LocalFileSystemClient.h
index 39db56e..0b6075b 100644
--- a/Source/web/LocalFileSystemClient.h
+++ b/Source/web/LocalFileSystemClient.h
@@ -43,6 +43,7 @@
     virtual ~LocalFileSystemClient();
 
     virtual bool allowFileSystem(WebCore::ExecutionContext*) OVERRIDE;
+    virtual void requestFileSystemAccess(WebCore::ExecutionContext*, PassOwnPtr<WebCore::PermissionCallbacks>) OVERRIDE;
 
 private:
     LocalFileSystemClient();
diff --git a/Source/web/MIDIClientProxy.cpp b/Source/web/MIDIClientProxy.cpp
index bc0c54d..36a7ccb 100644
--- a/Source/web/MIDIClientProxy.cpp
+++ b/Source/web/MIDIClientProxy.cpp
@@ -34,7 +34,6 @@
 #include "WebMIDIClient.h"
 #include "WebMIDIPermissionRequest.h"
 #include "modules/webmidi/MIDIAccess.h"
-#include "wtf/RefPtr.h"
 
 using WebCore::MIDIAccess;
 
@@ -45,7 +44,7 @@
 {
 }
 
-void MIDIClientProxy::requestSysExPermission(PassRefPtr<MIDIAccess> access)
+void MIDIClientProxy::requestSysExPermission(PassRefPtrWillBeRawPtr<MIDIAccess> access)
 {
     if (m_client)
         m_client->requestSysExPermission(WebMIDIPermissionRequest(access));
diff --git a/Source/web/MIDIClientProxy.h b/Source/web/MIDIClientProxy.h
index 610e2ba..76c30df 100644
--- a/Source/web/MIDIClientProxy.h
+++ b/Source/web/MIDIClientProxy.h
@@ -31,8 +31,8 @@
 #ifndef MIDIClientProxy_h
 #define MIDIClientProxy_h
 
+#include "heap/Handle.h"
 #include "modules/webmidi/MIDIClient.h"
-#include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 class MIDIAccess;
@@ -47,7 +47,7 @@
     explicit MIDIClientProxy(WebMIDIClient*);
 
     // WebCore::MIDIClient
-    virtual void requestSysExPermission(PassRefPtr<WebCore::MIDIAccess>) OVERRIDE;
+    virtual void requestSysExPermission(PassRefPtrWillBeRawPtr<WebCore::MIDIAccess>) OVERRIDE;
     virtual void cancelSysExPermissionRequest(WebCore::MIDIAccess*) OVERRIDE;
 
 private:
diff --git a/Source/web/NotificationPresenterImpl.cpp b/Source/web/NotificationPresenterImpl.cpp
index 1cc5847..ab377c7 100644
--- a/Source/web/NotificationPresenterImpl.cpp
+++ b/Source/web/NotificationPresenterImpl.cpp
@@ -34,36 +34,15 @@
 #include "WebNotification.h"
 #include "WebNotificationPermissionCallback.h"
 #include "WebNotificationPresenter.h"
+#include "WebSecurityOrigin.h"
 #include "core/dom/ExecutionContext.h"
-#include "modules/notifications/NotificationBase.h"
+#include "modules/notifications/Notification.h"
 #include "platform/weborigin/SecurityOrigin.h"
 
 using namespace WebCore;
 
 namespace blink {
 
-#if ENABLE(LEGACY_NOTIFICATIONS)
-class VoidCallbackClient : public WebNotificationPermissionCallback {
-public:
-    explicit VoidCallbackClient(PassOwnPtr<VoidCallback> callback)
-        : m_callback(callback)
-    {
-    }
-
-    virtual void permissionRequestComplete()
-    {
-        if (m_callback)
-            m_callback->handleEvent();
-        delete this;
-    }
-
-private:
-    virtual ~VoidCallbackClient() { }
-
-    OwnPtr<VoidCallback> m_callback;
-};
-#endif // ENABLE(LEGACY_NOTIFICATIONS)
-
 class NotificationPermissionCallbackClient : public WebNotificationPermissionCallback {
 public:
     NotificationPermissionCallbackClient(WebNotificationPresenter* presenter, PassRefPtr<SecurityOrigin> securityOrigin, PassOwnPtr<NotificationPermissionCallback> callback)
@@ -76,7 +55,7 @@
     virtual void permissionRequestComplete()
     {
         if (m_callback)
-            m_callback->handleEvent(NotificationBase::permissionString(static_cast<NotificationClient::Permission>(m_presenter->checkPermission(WebSecurityOrigin(m_securityOrigin)))));
+            m_callback->handleEvent(Notification::permissionString(static_cast<NotificationClient::Permission>(m_presenter->checkPermission(WebSecurityOrigin(m_securityOrigin)))));
         delete this;
     }
 
@@ -98,19 +77,22 @@
     return !!m_presenter;
 }
 
-bool NotificationPresenterImpl::show(NotificationBase* notification)
+bool NotificationPresenterImpl::show(Notification* notification)
 {
-    return m_presenter->show(PassRefPtr<NotificationBase>(notification));
+    return m_presenter->show(PassRefPtr<Notification>(notification));
 }
 
-void NotificationPresenterImpl::cancel(NotificationBase* notification)
+void NotificationPresenterImpl::close(Notification* notification)
 {
-    m_presenter->cancel(PassRefPtr<NotificationBase>(notification));
+    m_presenter->close(PassRefPtr<Notification>(notification));
+
+    // FIXME: Remove the duplicated call to cancel() when Chromium updated to override close() instead.
+    m_presenter->cancel(PassRefPtr<Notification>(notification));
 }
 
-void NotificationPresenterImpl::notificationObjectDestroyed(NotificationBase* notification)
+void NotificationPresenterImpl::notificationObjectDestroyed(Notification* notification)
 {
-    m_presenter->objectDestroyed(PassRefPtr<NotificationBase>(notification));
+    m_presenter->objectDestroyed(PassRefPtr<Notification>(notification));
 }
 
 NotificationClient::Permission NotificationPresenterImpl::checkPermission(ExecutionContext* context)
@@ -119,13 +101,6 @@
     return static_cast<NotificationClient::Permission>(result);
 }
 
-#if ENABLE(LEGACY_NOTIFICATIONS)
-void NotificationPresenterImpl::requestPermission(ExecutionContext* context, PassOwnPtr<VoidCallback> callback)
-{
-    m_presenter->requestPermission(WebSecurityOrigin(context->securityOrigin()), new VoidCallbackClient(callback));
-}
-#endif // ENABLE(LEGACY_NOTIFICATIONS)
-
 void NotificationPresenterImpl::requestPermission(ExecutionContext* context, WTF::PassOwnPtr<NotificationPermissionCallback> callback)
 {
     m_presenter->requestPermission(WebSecurityOrigin(context->securityOrigin()), new NotificationPermissionCallbackClient(m_presenter, context->securityOrigin(), callback));
diff --git a/Source/web/NotificationPresenterImpl.h b/Source/web/NotificationPresenterImpl.h
index 085dea5..65eb260 100644
--- a/Source/web/NotificationPresenterImpl.h
+++ b/Source/web/NotificationPresenterImpl.h
@@ -31,10 +31,8 @@
 #ifndef NotificationPresenterImpl_h
 #define NotificationPresenterImpl_h
 
-#include "core/html/VoidCallback.h"
 #include "modules/notifications/NotificationClient.h"
 
-#include "wtf/HashMap.h"
 #include "wtf/PassRefPtr.h"
 
 namespace blink {
@@ -49,13 +47,10 @@
     bool isInitialized();
 
     // WebCore::NotificationPresenter implementation.
-    virtual bool show(WebCore::NotificationBase*) OVERRIDE;
-    virtual void cancel(WebCore::NotificationBase*) OVERRIDE;
-    virtual void notificationObjectDestroyed(WebCore::NotificationBase*) OVERRIDE;
+    virtual bool show(WebCore::Notification*) OVERRIDE;
+    virtual void close(WebCore::Notification*) OVERRIDE;
+    virtual void notificationObjectDestroyed(WebCore::Notification*) OVERRIDE;
     virtual WebCore::NotificationClient::Permission checkPermission(WebCore::ExecutionContext*) OVERRIDE;
-#if ENABLE(LEGACY_NOTIFICATIONS)
-    virtual void requestPermission(WebCore::ExecutionContext*, WTF::PassOwnPtr<WebCore::VoidCallback>) OVERRIDE;
-#endif
     virtual void requestPermission(WebCore::ExecutionContext*, WTF::PassOwnPtr<WebCore::NotificationPermissionCallback>) OVERRIDE;
 
 private:
diff --git a/Source/web/PageOverlay.cpp b/Source/web/PageOverlay.cpp
index d9583aa..6536dbd 100644
--- a/Source/web/PageOverlay.cpp
+++ b/Source/web/PageOverlay.cpp
@@ -72,7 +72,7 @@
 
     virtual ~OverlayGraphicsLayerClientImpl() { }
 
-    virtual void notifyAnimationStarted(const GraphicsLayer*, double wallClockTime, double monotonicTime) OVERRIDE { }
+    virtual void notifyAnimationStarted(const GraphicsLayer*, double monotonicTime) OVERRIDE { }
 
     virtual void paintContents(const GraphicsLayer*, GraphicsContext& gc, GraphicsLayerPaintingPhase, const IntRect& inClip)
     {
@@ -101,6 +101,8 @@
 
     if (m_layer) {
         m_layer->removeFromParent();
+        if (WebCore::Page* page = m_viewImpl->page())
+            page->inspectorController().didRemovePageOverlay(m_layer.get());
         m_layer = nullptr;
         m_layerClient = nullptr;
     }
@@ -115,6 +117,9 @@
         m_layer = GraphicsLayer::create(m_viewImpl->graphicsLayerFactory(), m_layerClient.get());
         m_layer->setDrawsContent(true);
 
+        if (WebCore::Page* page = m_viewImpl->page())
+            page->inspectorController().willAddPageOverlay(m_layer.get());
+
         // Compositor hit-testing does not know how to deal with layers that may be
         // transparent to events (see http://crbug.com/269598). So require
         // scrolling and touches on this layer to go to the main thread.
diff --git a/Source/web/PageWidgetDelegate.cpp b/Source/web/PageWidgetDelegate.cpp
index f4c3103..0c7ab2a 100644
--- a/Source/web/PageWidgetDelegate.cpp
+++ b/Source/web/PageWidgetDelegate.cpp
@@ -34,12 +34,12 @@
 #include "PageOverlayList.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
+#include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/AutoscrollController.h"
 #include "core/page/EventHandler.h"
-#include "core/frame/Frame.h"
-#include "core/frame/FrameView.h"
-#include "core/rendering/RenderLayerCompositor.h"
 #include "core/rendering/RenderView.h"
+#include "core/rendering/compositing/RenderLayerCompositor.h"
 #include "platform/graphics/GraphicsContext.h"
 #include "wtf/CurrentTime.h"
 
@@ -63,7 +63,7 @@
     if (!view)
         return;
     page->autoscrollController().animate(monotonicFrameBeginTime);
-    view->serviceScriptedAnimations(monotonicFrameBeginTime);
+    page->animator().serviceScriptedAnimations(monotonicFrameBeginTime);
 }
 
 void PageWidgetDelegate::layout(Page* page)
@@ -81,13 +81,7 @@
 
     // setFrameRect may have the side-effect of causing existing page layout to
     // be invalidated, so layout needs to be called last.
-    view->updateLayoutAndStyleIfNeededRecursive();
-
-    // For now, as we know this is the point in code where the compositor has
-    // actually asked for Blink to update the composited layer tree. So finally
-    // do all the deferred work for updateCompositingLayers() here.
-    if (RenderView* renderView = view->renderView())
-        renderView->compositor()->updateCompositingLayers();
+    view->updateLayoutAndStyleForPainting();
 }
 
 void PageWidgetDelegate::paint(Page* page, PageOverlayList* overlays, WebCanvas* canvas, const WebRect& rect, CanvasBackground background)
@@ -115,7 +109,7 @@
 
 bool PageWidgetDelegate::handleInputEvent(Page* page, PageWidgetEventHandler& handler, const WebInputEvent& event)
 {
-    Frame* frame = page ? page->mainFrame() : 0;
+    LocalFrame* frame = page ? page->mainFrame() : 0;
     switch (event.type) {
 
     // FIXME: WebKit seems to always return false on mouse events processing
@@ -195,32 +189,32 @@
 // ----------------------------------------------------------------
 // Default handlers for PageWidgetEventHandler
 
-void PageWidgetEventHandler::handleMouseMove(Frame& mainFrame, const WebMouseEvent& event)
+void PageWidgetEventHandler::handleMouseMove(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     mainFrame.eventHandler().handleMouseMoveEvent(PlatformMouseEventBuilder(mainFrame.view(), event));
 }
 
-void PageWidgetEventHandler::handleMouseLeave(Frame& mainFrame, const WebMouseEvent& event)
+void PageWidgetEventHandler::handleMouseLeave(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     mainFrame.eventHandler().handleMouseLeaveEvent(PlatformMouseEventBuilder(mainFrame.view(), event));
 }
 
-void PageWidgetEventHandler::handleMouseDown(Frame& mainFrame, const WebMouseEvent& event)
+void PageWidgetEventHandler::handleMouseDown(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     mainFrame.eventHandler().handleMousePressEvent(PlatformMouseEventBuilder(mainFrame.view(), event));
 }
 
-void PageWidgetEventHandler::handleMouseUp(Frame& mainFrame, const WebMouseEvent& event)
+void PageWidgetEventHandler::handleMouseUp(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     mainFrame.eventHandler().handleMouseReleaseEvent(PlatformMouseEventBuilder(mainFrame.view(), event));
 }
 
-bool PageWidgetEventHandler::handleMouseWheel(Frame& mainFrame, const WebMouseWheelEvent& event)
+bool PageWidgetEventHandler::handleMouseWheel(LocalFrame& mainFrame, const WebMouseWheelEvent& event)
 {
     return mainFrame.eventHandler().handleWheelEvent(PlatformWheelEventBuilder(mainFrame.view(), event));
 }
 
-bool PageWidgetEventHandler::handleTouchEvent(Frame& mainFrame, const WebTouchEvent& event)
+bool PageWidgetEventHandler::handleTouchEvent(LocalFrame& mainFrame, const WebTouchEvent& event)
 {
     return mainFrame.eventHandler().handleTouchEvent(PlatformTouchEventBuilder(mainFrame.view(), event));
 }
diff --git a/Source/web/PageWidgetDelegate.h b/Source/web/PageWidgetDelegate.h
index 42cf03e..66e29c5 100644
--- a/Source/web/PageWidgetDelegate.h
+++ b/Source/web/PageWidgetDelegate.h
@@ -37,7 +37,7 @@
 #include "wtf/OwnPtr.h"
 
 namespace WebCore {
-class Frame;
+class LocalFrame;
 class Page;
 }
 
@@ -53,15 +53,15 @@
 
 class PageWidgetEventHandler {
 public:
-    virtual void handleMouseMove(WebCore::Frame& mainFrame, const WebMouseEvent&);
-    virtual void handleMouseLeave(WebCore::Frame& mainFrame, const WebMouseEvent&);
-    virtual void handleMouseDown(WebCore::Frame& mainFrame, const WebMouseEvent&);
-    virtual void handleMouseUp(WebCore::Frame& mainFrame, const WebMouseEvent&);
-    virtual bool handleMouseWheel(WebCore::Frame& mainFrame, const WebMouseWheelEvent&);
+    virtual void handleMouseMove(WebCore::LocalFrame& mainFrame, const WebMouseEvent&);
+    virtual void handleMouseLeave(WebCore::LocalFrame& mainFrame, const WebMouseEvent&);
+    virtual void handleMouseDown(WebCore::LocalFrame& mainFrame, const WebMouseEvent&);
+    virtual void handleMouseUp(WebCore::LocalFrame& mainFrame, const WebMouseEvent&);
+    virtual bool handleMouseWheel(WebCore::LocalFrame& mainFrame, const WebMouseWheelEvent&);
     virtual bool handleKeyEvent(const WebKeyboardEvent&) = 0;
     virtual bool handleCharEvent(const WebKeyboardEvent&) = 0;
     virtual bool handleGestureEvent(const WebGestureEvent&) = 0;
-    virtual bool handleTouchEvent(WebCore::Frame& mainFrame, const WebTouchEvent&);
+    virtual bool handleTouchEvent(WebCore::LocalFrame& mainFrame, const WebTouchEvent&);
     virtual ~PageWidgetEventHandler() { }
 };
 
diff --git a/Source/web/PinchViewports.cpp b/Source/web/PinchViewports.cpp
deleted file mode 100644
index 82f97a6..0000000
--- a/Source/web/PinchViewports.cpp
+++ /dev/null
@@ -1,231 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "PinchViewports.h"
-
-#include "WebSettingsImpl.h"
-#include "WebViewImpl.h"
-#include "core/frame/Frame.h"
-#include "core/frame/FrameView.h"
-#include "core/page/scrolling/ScrollingCoordinator.h"
-#include "core/rendering/RenderLayerCompositor.h"
-#include "platform/geometry/FloatSize.h"
-#include "platform/graphics/GraphicsLayer.h"
-#include "platform/scroll/Scrollbar.h"
-#include "public/platform/Platform.h"
-#include "public/platform/WebCompositorSupport.h"
-#include "public/platform/WebLayer.h"
-#include "public/platform/WebLayerTreeView.h"
-#include "public/platform/WebScrollbarLayer.h"
-
-using WebCore::GraphicsLayer;
-
-namespace blink {
-
-PassOwnPtr<PinchViewports> PinchViewports::create(WebViewImpl* owner)
-{
-    return adoptPtr(new PinchViewports(owner));
-}
-
-PinchViewports::PinchViewports(WebViewImpl* owner)
-    : m_owner(owner)
-    , m_innerViewportContainerLayer(GraphicsLayer::create(m_owner->graphicsLayerFactory(), this))
-    , m_pageScaleLayer(GraphicsLayer::create(m_owner->graphicsLayerFactory(), this))
-    , m_innerViewportScrollLayer(GraphicsLayer::create(m_owner->graphicsLayerFactory(), this))
-    , m_overlayScrollbarHorizontal(GraphicsLayer::create(m_owner->graphicsLayerFactory(), this))
-    , m_overlayScrollbarVertical(GraphicsLayer::create(m_owner->graphicsLayerFactory(), this))
-{
-    ASSERT(m_owner);
-    WebCore::ScrollingCoordinator* coordinator = m_owner->page()->scrollingCoordinator();
-    ASSERT(coordinator);
-    coordinator->setLayerIsContainerForFixedPositionLayers(m_innerViewportScrollLayer.get(), true);
-
-    // No need for the inner viewport to clip, since the compositing
-    // surface takes care of it -- and clipping here would interfere with
-    // dynamically-sized viewports on Android.
-    m_innerViewportContainerLayer->setMasksToBounds(false);
-
-    m_innerViewportScrollLayer->platformLayer()->setScrollClipLayer(
-        m_innerViewportContainerLayer->platformLayer());
-    m_innerViewportScrollLayer->platformLayer()->setUserScrollable(true, true);
-
-    m_innerViewportContainerLayer->addChild(m_pageScaleLayer.get());
-    m_pageScaleLayer->addChild(m_innerViewportScrollLayer.get());
-    m_innerViewportContainerLayer->addChild(m_overlayScrollbarHorizontal.get());
-    m_innerViewportContainerLayer->addChild(m_overlayScrollbarVertical.get());
-
-    // Setup the inner viewport overlay scrollbars.
-    setupScrollbar(WebScrollbar::Horizontal);
-    setupScrollbar(WebScrollbar::Vertical);
-}
-
-PinchViewports::~PinchViewports() { }
-
-void PinchViewports::setViewportSize(const WebCore::IntSize& newSize)
-{
-    m_innerViewportContainerLayer->setSize(newSize);
-    // The innerviewport scroll layer always has the same size as its clip layer, but
-    // the page scale layer lives between them, allowing for non-zero max scroll
-    // offset when page scale > 1.
-    m_innerViewportScrollLayer->setSize(newSize);
-
-    // Need to re-compute sizes for the overlay scrollbars.
-    setupScrollbar(WebScrollbar::Horizontal);
-    setupScrollbar(WebScrollbar::Vertical);
-}
-
-// Modifies the top of the graphics layer tree to add layers needed to support
-// the inner/outer viewport fixed-position model for pinch zoom. When finished,
-// the tree will look like this (with * denoting added layers):
-//
-// *innerViewportContainerLayer (fixed pos container)
-//  +- *pageScaleLayer
-//  |   +- *innerViewportScrollLayer
-//  |       +-- overflowControlsHostLayer (root layer)
-//  |           +-- outerViewportContainerLayer (fixed pos container) [frame container layer in RenderLayerCompositor]
-//  |           |   +-- outerViewportScrollLayer [frame scroll layer in RenderLayerCompositor]
-//  |           |       +-- content layers ...
-//  |           +-- horizontal ScrollbarLayer (non-overlay)
-//  |           +-- verticalScrollbarLayer (non-overlay)
-//  |           +-- scroll corner (non-overlay)
-//  +- *horizontalScrollbarLayer (overlay)
-//  +- *verticalScrollbarLayer (overlay)
-//
-void PinchViewports::setOverflowControlsHostLayer(GraphicsLayer* layer)
-{
-    if (layer) {
-        ASSERT(!m_innerViewportScrollLayer->children().size());
-        m_innerViewportScrollLayer->addChild(layer);
-    } else {
-        m_innerViewportScrollLayer->removeAllChildren();
-        return;
-    }
-
-    WebCore::Page* page = m_owner->page();
-    if (!page)
-        return;
-
-    // We only need to disable the existing (outer viewport) scrollbars
-    // if the existing ones are already overlay.
-    // FIXME: If we knew in advance before the overflowControlsHostLayer goes
-    // away, we would re-enable the drawing of these scrollbars.
-    if (GraphicsLayer* scrollbar = m_owner->compositor()->layerForHorizontalScrollbar())
-        scrollbar->setDrawsContent(!page->mainFrame()->view()->hasOverlayScrollbars());
-    if (GraphicsLayer* scrollbar = m_owner->compositor()->layerForVerticalScrollbar())
-        scrollbar->setDrawsContent(!page->mainFrame()->view()->hasOverlayScrollbars());
-}
-
-void PinchViewports::setupScrollbar(WebScrollbar::Orientation orientation)
-{
-    bool isHorizontal = orientation == WebScrollbar::Horizontal;
-    GraphicsLayer* scrollbarGraphicsLayer = isHorizontal ?
-        m_overlayScrollbarHorizontal.get() : m_overlayScrollbarVertical.get();
-    OwnPtr<WebScrollbarLayer>& webScrollbarLayer = isHorizontal ?
-        m_webOverlayScrollbarHorizontal : m_webOverlayScrollbarVertical;
-
-    const int overlayScrollbarThickness = m_owner->settingsImpl()->pinchOverlayScrollbarThickness();
-
-    if (!webScrollbarLayer) {
-        WebCore::ScrollingCoordinator* coordinator = m_owner->page()->scrollingCoordinator();
-        ASSERT(coordinator);
-        WebCore::ScrollbarOrientation webcoreOrientation = isHorizontal ? WebCore::HorizontalScrollbar : WebCore::VerticalScrollbar;
-        webScrollbarLayer = coordinator->createSolidColorScrollbarLayer(webcoreOrientation, overlayScrollbarThickness, false);
-
-        webScrollbarLayer->setClipLayer(m_innerViewportContainerLayer->platformLayer());
-        scrollbarGraphicsLayer->setContentsToPlatformLayer(webScrollbarLayer->layer());
-        scrollbarGraphicsLayer->setDrawsContent(false);
-    }
-
-    int xPosition = isHorizontal ? 0 : m_innerViewportContainerLayer->size().width() - overlayScrollbarThickness;
-    int yPosition = isHorizontal ? m_innerViewportContainerLayer->size().height() - overlayScrollbarThickness : 0;
-    int width = isHorizontal ? m_innerViewportContainerLayer->size().width() - overlayScrollbarThickness : overlayScrollbarThickness;
-    int height = isHorizontal ? overlayScrollbarThickness : m_innerViewportContainerLayer->size().height() - overlayScrollbarThickness;
-
-    // Use the GraphicsLayer to position the scrollbars.
-    scrollbarGraphicsLayer->setPosition(WebCore::IntPoint(xPosition, yPosition));
-    scrollbarGraphicsLayer->setSize(WebCore::IntSize(width, height));
-    scrollbarGraphicsLayer->setContentsRect(WebCore::IntRect(0, 0, width, height));
-}
-
-void PinchViewports::registerViewportLayersWithTreeView(WebLayerTreeView* layerTreeView) const
-{
-    ASSERT(layerTreeView);
-
-    WebCore::RenderLayerCompositor* compositor = m_owner->compositor();
-    // Get the outer viewport scroll layer.
-    WebLayer* scrollLayer = compositor->scrollLayer()->platformLayer();
-
-    m_webOverlayScrollbarHorizontal->setScrollLayer(scrollLayer);
-    m_webOverlayScrollbarVertical->setScrollLayer(scrollLayer);
-
-    ASSERT(compositor);
-    layerTreeView->registerViewportLayers(
-        m_pageScaleLayer->platformLayer(),
-        m_innerViewportScrollLayer->platformLayer(),
-        scrollLayer);
-}
-
-void PinchViewports::clearViewportLayersForTreeView(WebLayerTreeView* layerTreeView) const
-{
-    ASSERT(layerTreeView);
-
-    layerTreeView->clearViewportLayers();
-}
-
-void PinchViewports::notifyAnimationStarted(const GraphicsLayer*, double wallClockTime, double monotonicTime)
-{
-}
-
-void PinchViewports::paintContents(const GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip)
-{
-}
-
-String PinchViewports::debugName(const GraphicsLayer* graphicsLayer)
-{
-    String name;
-    if (graphicsLayer == m_innerViewportContainerLayer.get()) {
-        name = "Inner Viewport Container Layer";
-    } else if (graphicsLayer == m_pageScaleLayer.get()) {
-        name =  "Page Scale Layer";
-    } else if (graphicsLayer == m_innerViewportScrollLayer.get()) {
-        name =  "Inner Viewport Scroll Layer";
-    } else if (graphicsLayer == m_overlayScrollbarHorizontal.get()) {
-        name =  "Overlay Scrollbar Horizontal Layer";
-    } else if (graphicsLayer == m_overlayScrollbarVertical.get()) {
-        name =  "Overlay Scrollbar Vertical Layer";
-    } else {
-        ASSERT_NOT_REACHED();
-    }
-
-    return name;
-}
-
-} // namespace blink
diff --git a/Source/web/PinchViewports.h b/Source/web/PinchViewports.h
deleted file mode 100644
index 5d3f8a9..0000000
--- a/Source/web/PinchViewports.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef PinchViewports_h
-#define PinchViewports_h
-
-#include "platform/geometry/IntSize.h"
-#include "platform/graphics/GraphicsLayerClient.h"
-#include "public/platform/WebScrollbar.h"
-#include "public/platform/WebSize.h"
-#include "wtf/OwnPtr.h"
-#include "wtf/PassOwnPtr.h"
-
-namespace WebCore {
-class GraphicsContext;
-class GraphicsLayer;
-class IntRect;
-class IntSize;
-}
-
-namespace blink {
-
-class WebLayerTreeView;
-class WebScrollbarLayer;
-class WebViewImpl;
-
-class PinchViewports FINAL : WebCore::GraphicsLayerClient {
-public:
-    static PassOwnPtr<PinchViewports> create(WebViewImpl* owner);
-    virtual ~PinchViewports();
-
-    void setOverflowControlsHostLayer(WebCore::GraphicsLayer*);
-    WebCore::GraphicsLayer* rootGraphicsLayer()
-    {
-        return m_innerViewportContainerLayer.get();
-    }
-    void setViewportSize(const WebCore::IntSize&);
-
-    void registerViewportLayersWithTreeView(WebLayerTreeView*) const;
-    void clearViewportLayersForTreeView(WebLayerTreeView*) const;
-
-    // GraphicsLayerClient implementation.
-    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double wallClockTime, double monotonicTime) OVERRIDE;
-    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip) OVERRIDE;
-
-    virtual String debugName(const WebCore::GraphicsLayer*) OVERRIDE;
-
-private:
-    explicit PinchViewports(WebViewImpl* owner);
-
-    void setupScrollbar(blink::WebScrollbar::Orientation);
-
-    WebViewImpl* m_owner;
-    OwnPtr<WebCore::GraphicsLayer> m_innerViewportContainerLayer;
-    OwnPtr<WebCore::GraphicsLayer> m_pageScaleLayer;
-    OwnPtr<WebCore::GraphicsLayer> m_innerViewportScrollLayer;
-    OwnPtr<WebCore::GraphicsLayer> m_overlayScrollbarHorizontal;
-    OwnPtr<WebCore::GraphicsLayer> m_overlayScrollbarVertical;
-    OwnPtr<WebScrollbarLayer> m_webOverlayScrollbarHorizontal;
-    OwnPtr<WebScrollbarLayer> m_webOverlayScrollbarVertical;
-};
-
-} // namespace blink
-
-#endif // PinchViewports_h
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp
index 30133af..f9c3e51 100644
--- a/Source/web/PopupContainer.cpp
+++ b/Source/web/PopupContainer.cpp
@@ -37,10 +37,10 @@
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
 #include "core/dom/Document.h"
+#include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/Chrome.h"
 #include "core/page/ChromeClient.h"
-#include "core/frame/Frame.h"
-#include "core/frame/FrameView.h"
 #include "core/page/Page.h"
 #include "platform/PlatformGestureEvent.h"
 #include "platform/PlatformKeyboardEvent.h"
@@ -472,6 +472,8 @@
         return;
 
     WebWidget* webwidget = webView->client()->createPopupMenu(WebPopupTypeSelect);
+    if (!webwidget)
+        return;
     // We only notify when the WebView has to handle the popup, as when
     // the popup is handled externally, the fact that a popup is showing is
     // transparent to the WebView.
diff --git a/Source/web/PopupListBox.cpp b/Source/web/PopupListBox.cpp
index 44502e0..5237011 100644
--- a/Source/web/PopupListBox.cpp
+++ b/Source/web/PopupListBox.cpp
@@ -129,7 +129,7 @@
 {
     if (m_capturingScrollbar) {
         m_capturingScrollbar->mouseUp(event);
-        m_capturingScrollbar = 0;
+        m_capturingScrollbar = nullptr;
         return true;
     }
 
@@ -142,7 +142,7 @@
 
         // Clear m_focusedElement here, because we cannot clear in hidePopup()
         // which is called before dispatchMouseEvent() is called.
-        m_focusedElement = 0;
+        m_focusedElement = nullptr;
     }
 
     return true;
@@ -472,7 +472,7 @@
         FontDescription d = itemFont.fontDescription();
         d.setWeight(FontWeightBold);
         Font font(d);
-        font.update(0);
+        font.update(nullptr);
         return font;
     }
 
diff --git a/Source/web/PopupMenuChromium.cpp b/Source/web/PopupMenuChromium.cpp
index 34a78d4..1e42b1a 100644
--- a/Source/web/PopupMenuChromium.cpp
+++ b/Source/web/PopupMenuChromium.cpp
@@ -33,15 +33,15 @@
 #include "PopupMenuChromium.h"
 
 #include "PopupContainer.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 
 namespace blink {
 
 using namespace WebCore;
 
-PopupMenuChromium::PopupMenuChromium(Frame& frame, PopupMenuClient* client)
+PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
     : m_popupClient(client)
     , m_frameView(frame.view())
 {
diff --git a/Source/web/PopupMenuChromium.h b/Source/web/PopupMenuChromium.h
index d5afc30..b6c0332 100644
--- a/Source/web/PopupMenuChromium.h
+++ b/Source/web/PopupMenuChromium.h
@@ -35,7 +35,7 @@
 #include "wtf/RefPtr.h"
 
 namespace WebCore {
-class Frame;
+class LocalFrame;
 class FrameView;
 class PopupMenuClient;
 }
@@ -46,7 +46,7 @@
 
 class PopupMenuChromium FINAL : public WebCore::PopupMenu {
 public:
-    PopupMenuChromium(WebCore::Frame&, WebCore::PopupMenuClient*);
+    PopupMenuChromium(WebCore::LocalFrame&, WebCore::PopupMenuClient*);
     virtual ~PopupMenuChromium();
 
     virtual void show(const WebCore::FloatQuad& controlPosition, const WebCore::IntSize& controlSize, int index) OVERRIDE;
diff --git a/Source/web/ScrollbarGroup.cpp b/Source/web/ScrollbarGroup.cpp
index e9df6d4..4e5a4c9 100644
--- a/Source/web/ScrollbarGroup.cpp
+++ b/Source/web/ScrollbarGroup.cpp
@@ -125,12 +125,6 @@
     return true;
 }
 
-ScrollableArea* ScrollbarGroup::enclosingScrollableArea() const
-{
-    // FIXME: Return a parent scrollable area that can be scrolled.
-    return 0;
-}
-
 void ScrollbarGroup::setFrameRect(const IntRect& frameRect)
 {
     m_frameRect = frameRect;
diff --git a/Source/web/ScrollbarGroup.h b/Source/web/ScrollbarGroup.h
index 33209fd..9ee7019 100644
--- a/Source/web/ScrollbarGroup.h
+++ b/Source/web/ScrollbarGroup.h
@@ -54,7 +54,6 @@
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&) OVERRIDE;
     virtual void invalidateScrollCornerRect(const WebCore::IntRect&) OVERRIDE;
     virtual bool isActive() const OVERRIDE;
-    virtual ScrollableArea* enclosingScrollableArea() const OVERRIDE;
     virtual WebCore::IntRect scrollCornerRect() const OVERRIDE { return WebCore::IntRect(); }
     virtual bool isScrollCornerVisible() const OVERRIDE;
     virtual void getTickmarks(Vector<WebCore::IntRect>&) const OVERRIDE;
diff --git a/Source/web/ServiceWorkerGlobalScopeClientImpl.cpp b/Source/web/ServiceWorkerGlobalScopeClientImpl.cpp
index 475fa60..10b5cff 100644
--- a/Source/web/ServiceWorkerGlobalScopeClientImpl.cpp
+++ b/Source/web/ServiceWorkerGlobalScopeClientImpl.cpp
@@ -32,6 +32,9 @@
 #include "ServiceWorkerGlobalScopeClientImpl.h"
 
 #include "WebServiceWorkerContextClient.h"
+#include "modules/serviceworkers/Response.h"
+#include "platform/NotImplemented.h"
+#include "public/platform/WebServiceWorkerResponse.h"
 #include "wtf/PassOwnPtr.h"
 
 namespace blink {
@@ -51,6 +54,20 @@
         m_client->didHandleInstallEvent(installEventID);
 }
 
+void ServiceWorkerGlobalScopeClientImpl::didHandleFetchEvent(int fetchEventID, PassRefPtr<WebCore::Response> response)
+{
+    if (!m_client)
+        return;
+    if (!response) {
+        m_client->didHandleFetchEvent(fetchEventID);
+        return;
+    }
+
+    WebServiceWorkerResponse webResponse;
+    response->populateWebServiceWorkerResponse(webResponse);
+    m_client->didHandleFetchEvent(fetchEventID, webResponse);
+}
+
 ServiceWorkerGlobalScopeClientImpl::ServiceWorkerGlobalScopeClientImpl(PassOwnPtr<WebServiceWorkerContextClient> client)
     : m_client(client)
 {
diff --git a/Source/web/ServiceWorkerGlobalScopeClientImpl.h b/Source/web/ServiceWorkerGlobalScopeClientImpl.h
index eee1c9c..3a4947a 100644
--- a/Source/web/ServiceWorkerGlobalScopeClientImpl.h
+++ b/Source/web/ServiceWorkerGlobalScopeClientImpl.h
@@ -44,6 +44,7 @@
     virtual ~ServiceWorkerGlobalScopeClientImpl();
 
     virtual void didHandleInstallEvent(int installEventID) OVERRIDE;
+    virtual void didHandleFetchEvent(int fetchEventID, PassRefPtr<WebCore::Response>) OVERRIDE;
 
 private:
     ServiceWorkerGlobalScopeClientImpl(PassOwnPtr<WebServiceWorkerContextClient>);
diff --git a/Source/web/ServiceWorkerGlobalScopeProxy.cpp b/Source/web/ServiceWorkerGlobalScopeProxy.cpp
index 90713a5..80307f0 100644
--- a/Source/web/ServiceWorkerGlobalScopeProxy.cpp
+++ b/Source/web/ServiceWorkerGlobalScopeProxy.cpp
@@ -37,6 +37,7 @@
 #include "core/dom/ExecutionContext.h"
 #include "core/events/ThreadLocalEventNames.h"
 #include "core/workers/WorkerGlobalScope.h"
+#include "modules/serviceworkers/FetchEvent.h"
 #include "modules/serviceworkers/InstallEvent.h"
 #include "modules/serviceworkers/WaitUntilObserver.h"
 #include "platform/NotImplemented.h"
@@ -65,6 +66,14 @@
     observer->didDispatchEvent();
 }
 
+void ServiceWorkerGlobalScopeProxy::dispatchFetchEvent(int eventID)
+{
+    ASSERT(m_workerGlobalScope);
+    RefPtr<RespondWithObserver> observer = RespondWithObserver::create(m_workerGlobalScope, eventID);
+    m_workerGlobalScope->dispatchEvent(FetchEvent::create(observer));
+    observer->didDispatchEvent();
+}
+
 void ServiceWorkerGlobalScopeProxy::reportException(const String& errorMessage, int lineNumber, int columnNumber, const String& sourceURL)
 {
     m_client.reportException(errorMessage, lineNumber, columnNumber, sourceURL);
diff --git a/Source/web/ServiceWorkerGlobalScopeProxy.h b/Source/web/ServiceWorkerGlobalScopeProxy.h
index 79e0b27..6a96665 100644
--- a/Source/web/ServiceWorkerGlobalScopeProxy.h
+++ b/Source/web/ServiceWorkerGlobalScopeProxy.h
@@ -67,6 +67,7 @@
 
     // WebServiceWorkerContextProxy overrides:
     virtual void dispatchInstallEvent(int) OVERRIDE;
+    virtual void dispatchFetchEvent(int) OVERRIDE;
 
     // WorkerReportingProxy overrides:
     virtual void reportException(const String& errorMessage, int lineNumber, int columnNumber, const String& sourceURL) OVERRIDE;
diff --git a/Source/web/SharedWorkerRepositoryClientImpl.cpp b/Source/web/SharedWorkerRepositoryClientImpl.cpp
index 404288c..11793f7 100644
--- a/Source/web/SharedWorkerRepositoryClientImpl.cpp
+++ b/Source/web/SharedWorkerRepositoryClientImpl.cpp
@@ -43,7 +43,7 @@
 #include "core/dom/ExecutionContext.h"
 #include "core/events/Event.h"
 #include "core/events/ThreadLocalEventNames.h"
-#include "core/frame/ContentSecurityPolicy.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/workers/SharedWorker.h"
 #include "core/workers/WorkerScriptLoader.h"
@@ -60,7 +60,7 @@
 // Callback class that keeps the SharedWorker and WebSharedWorker objects alive while connecting.
 class SharedWorkerConnector : private WebSharedWorkerConnector::ConnectListener {
 public:
-    SharedWorkerConnector(PassRefPtr<SharedWorker> worker, const KURL& url, const String& name, PassOwnPtr<WebMessagePortChannel> channel, PassOwnPtr<WebSharedWorkerConnector> webWorkerConnector)
+    SharedWorkerConnector(PassRefPtrWillBeRawPtr<SharedWorker> worker, const KURL& url, const String& name, PassOwnPtr<WebMessagePortChannel> channel, PassOwnPtr<WebSharedWorkerConnector> webWorkerConnector)
         : m_worker(worker)
         , m_url(url)
         , m_name(name)
@@ -75,7 +75,7 @@
     virtual void connected() OVERRIDE;
     virtual void scriptLoadFailed() OVERRIDE;
 
-    RefPtr<SharedWorker> m_worker;
+    RefPtrWillBePersistent<SharedWorker> m_worker;
     KURL m_url;
     String m_name;
     OwnPtr<WebSharedWorkerConnector> m_webWorkerConnector;
@@ -111,7 +111,7 @@
     return reinterpret_cast<WebSharedWorkerRepositoryClient::DocumentID>(document);
 }
 
-void SharedWorkerRepositoryClientImpl::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<WebMessagePortChannel> port, const KURL& url, const String& name, ExceptionState& exceptionState)
+void SharedWorkerRepositoryClientImpl::connect(PassRefPtrWillBeRawPtr<SharedWorker> worker, PassOwnPtr<WebMessagePortChannel> port, const KURL& url, const String& name, ExceptionState& exceptionState)
 {
     ASSERT(m_client);
 
diff --git a/Source/web/SharedWorkerRepositoryClientImpl.h b/Source/web/SharedWorkerRepositoryClientImpl.h
index 07488bd..6a051dd 100644
--- a/Source/web/SharedWorkerRepositoryClientImpl.h
+++ b/Source/web/SharedWorkerRepositoryClientImpl.h
@@ -50,7 +50,7 @@
 
     virtual ~SharedWorkerRepositoryClientImpl() { }
 
-    virtual void connect(PassRefPtr<WebCore::SharedWorker>, PassOwnPtr<WebMessagePortChannel>, const WebCore::KURL&, const String& name, WebCore::ExceptionState&) OVERRIDE;
+    virtual void connect(PassRefPtrWillBeRawPtr<WebCore::SharedWorker>, PassOwnPtr<WebMessagePortChannel>, const WebCore::KURL&, const String& name, WebCore::ExceptionState&) OVERRIDE;
     virtual void documentDetached(WebCore::Document*) OVERRIDE;
 
 private:
diff --git a/Source/web/SpeechInputClientImpl.cpp b/Source/web/SpeechInputClientImpl.cpp
index 1026596..42d5e35 100644
--- a/Source/web/SpeechInputClientImpl.cpp
+++ b/Source/web/SpeechInputClientImpl.cpp
@@ -98,7 +98,7 @@
     ASSERT(m_listener);
     WebCore::SpeechInputResultArray webcoreResults(results.size());
     for (size_t i = 0; i < results.size(); ++i)
-        webcoreResults[i] = results[i];
+        webcoreResults[i] = PassRefPtrWillBeRawPtr<WebCore::SpeechInputResult>(results[i]);
     m_listener->setRecognitionResult(requestId, webcoreResults);
 }
 
diff --git a/Source/web/SpeechRecognitionClientProxy.cpp b/Source/web/SpeechRecognitionClientProxy.cpp
index 4d5b1eb..30ec726 100644
--- a/Source/web/SpeechRecognitionClientProxy.cpp
+++ b/Source/web/SpeechRecognitionClientProxy.cpp
@@ -76,67 +76,67 @@
 
 void SpeechRecognitionClientProxy::didStartAudio(const WebSpeechRecognitionHandle& handle)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didStartAudio();
 }
 
 void SpeechRecognitionClientProxy::didStartSound(const WebSpeechRecognitionHandle& handle)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didStartSound();
     recognition->didStartSpeech();
 }
 
 void SpeechRecognitionClientProxy::didEndSound(const WebSpeechRecognitionHandle& handle)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didEndSpeech();
     recognition->didEndSound();
 }
 
 void SpeechRecognitionClientProxy::didEndAudio(const WebSpeechRecognitionHandle& handle)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didEndAudio();
 }
 
 void SpeechRecognitionClientProxy::didReceiveResults(const WebSpeechRecognitionHandle& handle, const WebVector<WebSpeechRecognitionResult>& newFinalResults, const WebVector<WebSpeechRecognitionResult>& currentInterimResults)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
 
-    Vector<RefPtr<SpeechRecognitionResult> > finalResultsVector(newFinalResults.size());
+    WillBeHeapVector<RefPtrWillBeMember<SpeechRecognitionResult> > finalResultsVector(newFinalResults.size());
     for (size_t i = 0; i < newFinalResults.size(); ++i)
-        finalResultsVector[i] = static_cast<PassRefPtr<SpeechRecognitionResult> >(newFinalResults[i]);
+        finalResultsVector[i] = PassRefPtrWillBeRawPtr<SpeechRecognitionResult>(newFinalResults[i]);
 
-    Vector<RefPtr<SpeechRecognitionResult> > interimResultsVector(currentInterimResults.size());
+    WillBeHeapVector<RefPtrWillBeMember<SpeechRecognitionResult> > interimResultsVector(currentInterimResults.size());
     for (size_t i = 0; i < currentInterimResults.size(); ++i)
-        interimResultsVector[i] = static_cast<PassRefPtr<SpeechRecognitionResult> >(currentInterimResults[i]);
+        interimResultsVector[i] = PassRefPtrWillBeRawPtr<SpeechRecognitionResult>(currentInterimResults[i]);
 
     recognition->didReceiveResults(finalResultsVector, interimResultsVector);
 }
 
 void SpeechRecognitionClientProxy::didReceiveNoMatch(const WebSpeechRecognitionHandle& handle, const WebSpeechRecognitionResult& result)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didReceiveNoMatch(result);
 }
 
 void SpeechRecognitionClientProxy::didReceiveError(const WebSpeechRecognitionHandle& handle, const WebString& message, WebSpeechRecognizerClient::ErrorCode code)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     SpeechRecognitionError::ErrorCode errorCode = static_cast<SpeechRecognitionError::ErrorCode>(code);
     recognition->didReceiveError(SpeechRecognitionError::create(errorCode, message));
 }
 
 void SpeechRecognitionClientProxy::didStart(const WebSpeechRecognitionHandle& handle)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didStart();
 }
 
 void SpeechRecognitionClientProxy::didEnd(const WebSpeechRecognitionHandle& handle)
 {
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    RefPtrWillBeRawPtr<SpeechRecognition> recognition = PassRefPtrWillBeRawPtr<SpeechRecognition>(handle);
     recognition->didEnd();
 }
 
diff --git a/Source/web/SpellCheckerClientImpl.cpp b/Source/web/SpellCheckerClientImpl.cpp
index 0d1246e..224be4e 100644
--- a/Source/web/SpellCheckerClientImpl.cpp
+++ b/Source/web/SpellCheckerClientImpl.cpp
@@ -34,7 +34,7 @@
 #include "core/dom/DocumentMarkerController.h"
 #include "core/editing/Editor.h"
 #include "core/editing/SpellChecker.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/Page.h"
 #include "core/frame/Settings.h"
 
@@ -56,7 +56,7 @@
 {
     // Spellcheck should be enabled for all editable areas (such as textareas,
     // contentEditable regions, designMode docs and inputs).
-    const Frame* frame = m_webView->focusedWebCoreFrame();
+    const LocalFrame* frame = m_webView->focusedWebCoreFrame();
     if (!frame)
         return false;
     if (frame->spellChecker().isSpellCheckingEnabledInFocusedNode())
@@ -68,9 +68,9 @@
     // If |element| is null, we default to allowing spellchecking. This is done
     // in order to mitigate the issue when the user clicks outside the textbox,
     // as a result of which |element| becomes null, resulting in all the spell
-    // check markers being deleted. Also, the Frame will decide not to do
+    // check markers being deleted. Also, the LocalFrame will decide not to do
     // spellchecking if the user can't edit - so returning true here will not
-    // cause any problems to the Frame's behavior.
+    // cause any problems to the LocalFrame's behavior.
     if (!element)
         return true;
     const RenderObject* renderer = element->renderer();
@@ -94,13 +94,13 @@
     if (isContinuousSpellCheckingEnabled()) {
         m_spellCheckThisFieldStatus = SpellCheckForcedOff;
         if (Page* page = m_webView->page()) {
-            for (Frame* frame = page->mainFrame(); frame && frame->document(); frame = frame->tree().traverseNext()) {
-                frame->document()->markers()->removeMarkers(DocumentMarker::MisspellingMarkers());
+            for (LocalFrame* frame = page->mainFrame(); frame && frame->document(); frame = frame->tree().traverseNext()) {
+                frame->document()->markers().removeMarkers(DocumentMarker::MisspellingMarkers());
             }
         }
     } else {
         m_spellCheckThisFieldStatus = SpellCheckForcedOn;
-        if (Frame* frame = m_webView->focusedWebCoreFrame()) {
+        if (LocalFrame* frame = m_webView->focusedWebCoreFrame()) {
             VisibleSelection frameSelection = frame->selection().selection();
             // If a selection is in an editable element spell check its content.
             if (Element* rootEditableElement = frameSelection.rootEditableElement()) {
@@ -112,13 +112,13 @@
 
 bool SpellCheckerClientImpl::isGrammarCheckingEnabled()
 {
-    const Frame* frame = m_webView->focusedWebCoreFrame();
+    const LocalFrame* frame = m_webView->focusedWebCoreFrame();
     return frame && frame->settings() && (frame->settings()->asynchronousSpellCheckingEnabled() || frame->settings()->unifiedTextCheckerEnabled());
 }
 
 bool SpellCheckerClientImpl::shouldEraseMarkersAfterChangeSelection(TextCheckingType type) const
 {
-    const Frame* frame = m_webView->focusedWebCoreFrame();
+    const LocalFrame* frame = m_webView->focusedWebCoreFrame();
     return !frame || !frame->settings() || (!frame->settings()->asynchronousSpellCheckingEnabled() && !frame->settings()->unifiedTextCheckerEnabled());
 }
 
diff --git a/Source/web/SpellCheckerClientImpl.h b/Source/web/SpellCheckerClientImpl.h
index 53243d5..2fca3f7 100644
--- a/Source/web/SpellCheckerClientImpl.h
+++ b/Source/web/SpellCheckerClientImpl.h
@@ -35,7 +35,7 @@
 #include "platform/text/TextCheckerClient.h"
 
 namespace WebCore {
-class Frame;
+class LocalFrame;
 class HTMLInputElement;
 }
 
diff --git a/Source/web/StorageClientImpl.cpp b/Source/web/StorageClientImpl.cpp
index a5470b4..81871af 100644
--- a/Source/web/StorageClientImpl.cpp
+++ b/Source/web/StorageClientImpl.cpp
@@ -45,7 +45,7 @@
     return adoptPtr(new WebCore::StorageNamespace(adoptPtr(m_webView->client()->createSessionStorageNamespace())));
 }
 
-bool StorageClientImpl::canAccessStorage(WebCore::Frame* frame, WebCore::StorageType type) const
+bool StorageClientImpl::canAccessStorage(WebCore::LocalFrame* frame, WebCore::StorageType type) const
 {
     WebFrameImpl* webFrame = WebFrameImpl::fromFrame(frame);
     return !webFrame->permissionClient() || webFrame->permissionClient()->allowStorage(webFrame, type == WebCore::LocalStorage);
diff --git a/Source/web/StorageClientImpl.h b/Source/web/StorageClientImpl.h
index 90e3c33..bc783af 100644
--- a/Source/web/StorageClientImpl.h
+++ b/Source/web/StorageClientImpl.h
@@ -16,7 +16,7 @@
     explicit StorageClientImpl(WebViewImpl*);
 
     virtual PassOwnPtr<WebCore::StorageNamespace> createSessionStorageNamespace() OVERRIDE;
-    virtual bool canAccessStorage(WebCore::Frame*, WebCore::StorageType) const OVERRIDE;
+    virtual bool canAccessStorage(WebCore::LocalFrame*, WebCore::StorageType) const OVERRIDE;
 
 private:
     WebViewImpl* m_webView;
diff --git a/Source/web/StorageQuotaClientImpl.cpp b/Source/web/StorageQuotaClientImpl.cpp
index 0ada0d4..13960f6 100644
--- a/Source/web/StorageQuotaClientImpl.cpp
+++ b/Source/web/StorageQuotaClientImpl.cpp
@@ -79,8 +79,8 @@
 {
     ASSERT(executionContext);
 
-    ScriptPromise promise = ScriptPromise::createPending(executionContext);
-    RefPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(promise, executionContext);
+    RefPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(executionContext);
+    ScriptPromise promise = resolver->promise();
 
     if (executionContext->isDocument()) {
         Document* document = toDocument(executionContext);
diff --git a/Source/web/TextFinder.cpp b/Source/web/TextFinder.cpp
new file mode 100644
index 0000000..a82113d
--- /dev/null
+++ b/Source/web/TextFinder.cpp
@@ -0,0 +1,2491 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// How ownership works
+// -------------------
+//
+// Big oh represents a refcounted relationship: owner O--- ownee
+//
+// WebView (for the toplevel frame only)
+//    O
+//    |           WebFrame
+//    |              O
+//    |              |
+//   Page O------- LocalFrame (m_mainFrame) O-------O FrameView
+//                   ||
+//                   ||
+//               FrameLoader
+//
+// FrameLoader and LocalFrame are formerly one object that was split apart because
+// it got too big. They basically have the same lifetime, hence the double line.
+//
+// From the perspective of the embedder, WebFrame is simply an object that it
+// allocates by calling WebFrame::create() and must be freed by calling close().
+// Internally, WebFrame is actually refcounted and it holds a reference to its
+// corresponding LocalFrame in WebCore.
+//
+// How frames are destroyed
+// ------------------------
+//
+// The main frame is never destroyed and is re-used. The FrameLoader is re-used
+// and a reference to the main frame is kept by the Page.
+//
+// When frame content is replaced, all subframes are destroyed. This happens
+// in FrameLoader::detachFromParent for each subframe in a pre-order depth-first
+// traversal. Note that child node order may not match DOM node order!
+// detachFromParent() calls FrameLoaderClient::detachedFromParent(), which calls
+// WebFrame::frameDetached(). This triggers WebFrame to clear its reference to
+// LocalFrame, and also notifies the embedder via WebFrameClient that the frame is
+// detached. Most embedders will invoke close() on the WebFrame at this point,
+// triggering its deletion unless something else is still retaining a reference.
+//
+// Thie client is expected to be set whenever the WebFrameImpl is attached to
+// the DOM.
+
+#include "config.h"
+#include "TextFinder.h"
+
+#include <algorithm>
+#include "AssociatedURLLoader.h"
+#include "DOMUtilitiesPrivate.h"
+#include "EventListenerWrapper.h"
+#include "FindInPageCoordinates.h"
+#include "HTMLNames.h"
+#include "PageOverlay.h"
+#include "SharedWorkerRepositoryClientImpl.h"
+#include "WebConsoleMessage.h"
+#include "WebDOMEvent.h"
+#include "WebDOMEventListener.h"
+#include "WebDataSourceImpl.h"
+#include "WebDevToolsAgentPrivate.h"
+#include "WebDocument.h"
+#include "WebFindOptions.h"
+#include "WebFormElement.h"
+#include "WebFrameClient.h"
+#include "WebHistoryItem.h"
+#include "WebIconURL.h"
+#include "WebInputElement.h"
+#include "WebNode.h"
+#include "WebPerformance.h"
+#include "WebPlugin.h"
+#include "WebPluginContainerImpl.h"
+#include "WebPrintParams.h"
+#include "WebRange.h"
+#include "WebScriptSource.h"
+#include "WebSecurityOrigin.h"
+#include "WebSerializedScriptValue.h"
+#include "WebViewImpl.h"
+#include "bindings/v8/DOMWrapperWorld.h"
+#include "bindings/v8/ExceptionState.h"
+#include "bindings/v8/ExceptionStatePlaceholder.h"
+#include "bindings/v8/ScriptController.h"
+#include "bindings/v8/ScriptSourceCode.h"
+#include "bindings/v8/ScriptValue.h"
+#include "bindings/v8/V8GCController.h"
+#include "bindings/v8/V8PerIsolateData.h"
+#include "core/dom/Document.h"
+#include "core/dom/DocumentMarker.h"
+#include "core/dom/DocumentMarkerController.h"
+#include "core/dom/IconURL.h"
+#include "core/dom/MessagePort.h"
+#include "core/dom/Node.h"
+#include "core/dom/NodeTraversal.h"
+#include "core/dom/shadow/ShadowRoot.h"
+#include "core/editing/Editor.h"
+#include "core/editing/FrameSelection.h"
+#include "core/editing/InputMethodController.h"
+#include "core/editing/PlainTextRange.h"
+#include "core/editing/SpellChecker.h"
+#include "core/editing/TextAffinity.h"
+#include "core/editing/TextIterator.h"
+#include "core/editing/htmlediting.h"
+#include "core/editing/markup.h"
+#include "core/frame/Console.h"
+#include "core/frame/DOMWindow.h"
+#include "core/frame/FrameView.h"
+#include "core/html/HTMLCollection.h"
+#include "core/html/HTMLFormElement.h"
+#include "core/html/HTMLFrameOwnerElement.h"
+#include "core/html/HTMLHeadElement.h"
+#include "core/html/HTMLInputElement.h"
+#include "core/html/HTMLLinkElement.h"
+#include "core/html/PluginDocument.h"
+#include "core/inspector/InspectorController.h"
+#include "core/inspector/ScriptCallStack.h"
+#include "core/loader/DocumentLoader.h"
+#include "core/loader/FrameLoadRequest.h"
+#include "core/loader/FrameLoader.h"
+#include "core/loader/HistoryItem.h"
+#include "core/loader/SubstituteData.h"
+#include "core/page/Chrome.h"
+#include "core/page/EventHandler.h"
+#include "core/page/FocusController.h"
+#include "core/page/FrameTree.h"
+#include "core/page/Page.h"
+#include "core/page/PrintContext.h"
+#include "core/frame/Settings.h"
+#include "core/rendering/HitTestResult.h"
+#include "core/rendering/RenderBox.h"
+#include "core/rendering/RenderFrame.h"
+#include "core/rendering/RenderLayer.h"
+#include "core/rendering/RenderObject.h"
+#include "core/rendering/RenderTreeAsText.h"
+#include "core/rendering/RenderView.h"
+#include "core/rendering/style/StyleInheritedData.h"
+#include "core/timing/Performance.h"
+#include "core/xml/DocumentXPathEvaluator.h"
+#include "core/xml/XPathResult.h"
+#include "platform/TraceEvent.h"
+#include "platform/UserGestureIndicator.h"
+#include "platform/clipboard/ClipboardUtilities.h"
+#include "platform/fonts/FontCache.h"
+#include "platform/graphics/GraphicsContext.h"
+#include "platform/graphics/GraphicsLayerClient.h"
+#include "platform/graphics/skia/SkiaUtils.h"
+#include "platform/network/ResourceRequest.h"
+#include "platform/scroll/ScrollbarTheme.h"
+#include "platform/scroll/ScrollTypes.h"
+#include "platform/weborigin/KURL.h"
+#include "platform/weborigin/SchemeRegistry.h"
+#include "platform/weborigin/SecurityPolicy.h"
+#include "public/platform/Platform.h"
+#include "public/platform/WebFloatPoint.h"
+#include "public/platform/WebFloatRect.h"
+#include "public/platform/WebLayer.h"
+#include "public/platform/WebPoint.h"
+#include "public/platform/WebRect.h"
+#include "public/platform/WebSize.h"
+#include "public/platform/WebURLError.h"
+#include "public/platform/WebVector.h"
+#include "wtf/CurrentTime.h"
+#include "wtf/HashMap.h"
+
+using namespace WebCore;
+
+namespace blink {
+
+static int frameCount = 0;
+
+// Key for a StatsCounter tracking how many WebFrames are active.
+static const char webFrameActiveCount[] = "WebFrameActiveCount";
+
+static void frameContentAsPlainText(size_t maxChars, LocalFrame* frame, StringBuilder& output)
+{
+    Document* document = frame->document();
+    if (!document)
+        return;
+
+    if (!frame->view())
+        return;
+
+    // TextIterator iterates over the visual representation of the DOM. As such,
+    // it requires you to do a layout before using it (otherwise it'll crash).
+    document->updateLayout();
+
+    // Select the document body.
+    RefPtr<Range> range(document->createRange());
+    TrackExceptionState exceptionState;
+    range->selectNodeContents(document->body(), exceptionState);
+
+    if (!exceptionState.hadException()) {
+        // The text iterator will walk nodes giving us text. This is similar to
+        // the plainText() function in core/editing/TextIterator.h, but we implement the maximum
+        // size and also copy the results directly into a wstring, avoiding the
+        // string conversion.
+        for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
+            it.appendTextToStringBuilder(output, 0, maxChars - output.length());
+            if (output.length() >= maxChars)
+                return; // Filled up the buffer.
+        }
+    }
+
+    // The separator between frames when the frames are converted to plain text.
+    const LChar frameSeparator[] = { '\n', '\n' };
+    const size_t frameSeparatorLength = WTF_ARRAY_LENGTH(frameSeparator);
+
+    // Recursively walk the children.
+    const FrameTree& frameTree = frame->tree();
+    for (LocalFrame* curChild = frameTree.firstChild(); curChild; curChild = curChild->tree().nextSibling()) {
+        // Ignore the text of non-visible frames.
+        RenderView* contentRenderer = curChild->contentRenderer();
+        RenderPart* ownerRenderer = curChild->ownerRenderer();
+        if (!contentRenderer || !contentRenderer->width() || !contentRenderer->height()
+            || (contentRenderer->x() + contentRenderer->width() <= 0) || (contentRenderer->y() + contentRenderer->height() <= 0)
+            || (ownerRenderer && ownerRenderer->style() && ownerRenderer->style()->visibility() != VISIBLE)) {
+            continue;
+        }
+
+        // Make sure the frame separator won't fill up the buffer, and give up if
+        // it will. The danger is if the separator will make the buffer longer than
+        // maxChars. This will cause the computation above:
+        //   maxChars - output->size()
+        // to be a negative number which will crash when the subframe is added.
+        if (output.length() >= maxChars - frameSeparatorLength)
+            return;
+
+        output.append(frameSeparator, frameSeparatorLength);
+        frameContentAsPlainText(maxChars, curChild, output);
+        if (output.length() >= maxChars)
+            return; // Filled up the buffer.
+    }
+}
+
+WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(LocalFrame* frame)
+{
+    if (!frame)
+        return 0;
+    if (!frame->document() || !frame->document()->isPluginDocument())
+        return 0;
+    PluginDocument* pluginDocument = toPluginDocument(frame->document());
+    return toWebPluginContainerImpl(pluginDocument->pluginWidget());
+}
+
+WebPluginContainerImpl* WebFrameImpl::pluginContainerFromNode(WebCore::LocalFrame* frame, const WebNode& node)
+{
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame);
+    if (pluginContainer)
+        return pluginContainer;
+    return toWebPluginContainerImpl(node.pluginContainer());
+}
+
+// Simple class to override some of PrintContext behavior. Some of the methods
+// made virtual so that they can be overridden by ChromePluginPrintContext.
+class ChromePrintContext : public PrintContext {
+    WTF_MAKE_NONCOPYABLE(ChromePrintContext);
+public:
+    ChromePrintContext(LocalFrame* frame)
+        : PrintContext(frame)
+        , m_printedPageWidth(0)
+    {
+    }
+
+    virtual ~ChromePrintContext() { }
+
+    virtual void begin(float width, float height)
+    {
+        ASSERT(!m_printedPageWidth);
+        m_printedPageWidth = width;
+        PrintContext::begin(m_printedPageWidth, height);
+    }
+
+    virtual void end()
+    {
+        PrintContext::end();
+    }
+
+    virtual float getPageShrink(int pageNumber) const
+    {
+        IntRect pageRect = m_pageRects[pageNumber];
+        return m_printedPageWidth / pageRect.width();
+    }
+
+    // Spools the printed page, a subrect of frame(). Skip the scale step.
+    // NativeTheme doesn't play well with scaling. Scaling is done browser side
+    // instead. Returns the scale to be applied.
+    // On Linux, we don't have the problem with NativeTheme, hence we let WebKit
+    // do the scaling and ignore the return value.
+    virtual float spoolPage(GraphicsContext& context, int pageNumber)
+    {
+        IntRect pageRect = m_pageRects[pageNumber];
+        float scale = m_printedPageWidth / pageRect.width();
+
+        context.save();
+#if OS(POSIX) && !OS(MACOSX)
+        context.scale(WebCore::FloatSize(scale, scale));
+#endif
+        context.translate(static_cast<float>(-pageRect.x()), static_cast<float>(-pageRect.y()));
+        context.clip(pageRect);
+        frame()->view()->paintContents(&context, pageRect);
+        if (context.supportsURLFragments())
+            outputLinkedDestinations(context, frame()->document(), pageRect);
+        context.restore();
+        return scale;
+    }
+
+    void spoolAllPagesWithBoundaries(GraphicsContext& graphicsContext, const FloatSize& pageSizeInPixels)
+    {
+        if (!frame()->document() || !frame()->view() || !frame()->document()->renderer())
+            return;
+
+        frame()->document()->updateLayout();
+
+        float pageHeight;
+        computePageRects(FloatRect(FloatPoint(0, 0), pageSizeInPixels), 0, 0, 1, pageHeight);
+
+        const float pageWidth = pageSizeInPixels.width();
+        size_t numPages = pageRects().size();
+        int totalHeight = numPages * (pageSizeInPixels.height() + 1) - 1;
+
+        // Fill the whole background by white.
+        graphicsContext.setFillColor(Color::white);
+        graphicsContext.fillRect(FloatRect(0, 0, pageWidth, totalHeight));
+
+        int currentHeight = 0;
+        for (size_t pageIndex = 0; pageIndex < numPages; pageIndex++) {
+            // Draw a line for a page boundary if this isn't the first page.
+            if (pageIndex > 0) {
+                graphicsContext.save();
+                graphicsContext.setStrokeColor(Color(0, 0, 255));
+                graphicsContext.setFillColor(Color(0, 0, 255));
+                graphicsContext.drawLine(IntPoint(0, currentHeight), IntPoint(pageWidth, currentHeight));
+                graphicsContext.restore();
+            }
+
+            graphicsContext.save();
+
+            graphicsContext.translate(0, currentHeight);
+#if OS(WIN) || OS(MACOSX)
+            // Account for the disabling of scaling in spoolPage. In the context
+            // of spoolAllPagesWithBoundaries the scale HAS NOT been pre-applied.
+            float scale = getPageShrink(pageIndex);
+            graphicsContext.scale(WebCore::FloatSize(scale, scale));
+#endif
+            spoolPage(graphicsContext, pageIndex);
+            graphicsContext.restore();
+
+            currentHeight += pageSizeInPixels.height() + 1;
+        }
+    }
+
+    virtual void computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight)
+    {
+        PrintContext::computePageRects(printRect, headerHeight, footerHeight, userScaleFactor, outPageHeight);
+    }
+
+    virtual int pageCount() const
+    {
+        return PrintContext::pageCount();
+    }
+
+private:
+    // Set when printing.
+    float m_printedPageWidth;
+};
+
+// Simple class to override some of PrintContext behavior. This is used when
+// the frame hosts a plugin that supports custom printing. In this case, we
+// want to delegate all printing related calls to the plugin.
+class ChromePluginPrintContext : public ChromePrintContext {
+public:
+    ChromePluginPrintContext(LocalFrame* frame, WebPluginContainerImpl* plugin, const WebPrintParams& printParams)
+        : ChromePrintContext(frame), m_plugin(plugin), m_pageCount(0), m_printParams(printParams)
+    {
+    }
+
+    virtual ~ChromePluginPrintContext() { }
+
+    virtual void begin(float width, float height)
+    {
+    }
+
+    virtual void end()
+    {
+        m_plugin->printEnd();
+    }
+
+    virtual float getPageShrink(int pageNumber) const
+    {
+        // We don't shrink the page (maybe we should ask the widget ??)
+        return 1.0;
+    }
+
+    virtual void computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight)
+    {
+        m_printParams.printContentArea = IntRect(printRect);
+        m_pageCount = m_plugin->printBegin(m_printParams);
+    }
+
+    virtual int pageCount() const
+    {
+        return m_pageCount;
+    }
+
+    // Spools the printed page, a subrect of frame(). Skip the scale step.
+    // NativeTheme doesn't play well with scaling. Scaling is done browser side
+    // instead. Returns the scale to be applied.
+    virtual float spoolPage(GraphicsContext& context, int pageNumber)
+    {
+        m_plugin->printPage(pageNumber, &context);
+        return 1.0;
+    }
+
+private:
+    // Set when printing.
+    WebPluginContainerImpl* m_plugin;
+    int m_pageCount;
+    WebPrintParams m_printParams;
+
+};
+
+static WebDataSource* DataSourceForDocLoader(DocumentLoader* loader)
+{
+    return loader ? WebDataSourceImpl::fromDocumentLoader(loader) : 0;
+}
+
+WebFrameImpl::FindMatch::FindMatch(PassRefPtr<Range> range, int ordinal)
+    : m_range(range)
+    , m_ordinal(ordinal)
+{
+}
+
+class WebFrameImpl::DeferredScopeStringMatches {
+public:
+    DeferredScopeStringMatches(WebFrameImpl* webFrame, int identifier, const WebString& searchText, const WebFindOptions& options, bool reset)
+        : m_timer(this, &DeferredScopeStringMatches::doTimeout)
+        , m_webFrame(webFrame)
+        , m_identifier(identifier)
+        , m_searchText(searchText)
+        , m_options(options)
+        , m_reset(reset)
+    {
+        m_timer.startOneShot(0.0);
+    }
+
+private:
+    void doTimeout(Timer<DeferredScopeStringMatches>*)
+    {
+        m_webFrame->callScopeStringMatches(this, m_identifier, m_searchText, m_options, m_reset);
+    }
+
+    Timer<DeferredScopeStringMatches> m_timer;
+    RefPtr<WebFrameImpl> m_webFrame;
+    int m_identifier;
+    WebString m_searchText;
+    WebFindOptions m_options;
+    bool m_reset;
+};
+
+// WebFrame -------------------------------------------------------------------
+
+int WebFrame::instanceCount()
+{
+    return frameCount;
+}
+
+WebFrame* WebFrame::frameForCurrentContext()
+{
+    v8::Handle<v8::Context> context = v8::Isolate::GetCurrent()->GetCurrentContext();
+    if (context.IsEmpty())
+        return 0;
+    return frameForContext(context);
+}
+
+WebFrame* WebFrame::frameForContext(v8::Handle<v8::Context> context)
+{
+   return WebFrameImpl::fromFrame(toFrameIfNotDetached(context));
+}
+
+WebFrame* WebFrame::fromFrameOwnerElement(const WebElement& element)
+{
+    return WebFrameImpl::fromFrameOwnerElement(PassRefPtr<Element>(element).get());
+}
+
+void WebFrameImpl::close()
+{
+    m_client = 0;
+    deref(); // Balances ref() acquired in WebFrame::create
+}
+
+WebString WebFrameImpl::uniqueName() const
+{
+    return frame()->tree().uniqueName();
+}
+
+WebString WebFrameImpl::assignedName() const
+{
+    return frame()->tree().name();
+}
+
+void WebFrameImpl::setName(const WebString& name)
+{
+    frame()->tree().setName(name);
+}
+
+WebVector<WebIconURL> WebFrameImpl::iconURLs(int iconTypesMask) const
+{
+    // The URL to the icon may be in the header. As such, only
+    // ask the loader for the icon if it's finished loading.
+    if (frame()->loader().state() == FrameStateComplete)
+        return frame()->document()->iconURLs(iconTypesMask);
+    return WebVector<WebIconURL>();
+}
+
+void WebFrameImpl::setIsRemote(bool isRemote)
+{
+    m_isRemote = isRemote;
+    if (isRemote)
+        client()->initializeChildFrame(frame()->view()->frameRect(), frame()->view()->visibleContentScaleFactor());
+}
+
+void WebFrameImpl::setRemoteWebLayer(WebLayer* webLayer)
+{
+    if (!frame())
+        return;
+
+    if (frame()->remotePlatformLayer())
+        GraphicsLayer::unregisterContentsLayer(frame()->remotePlatformLayer());
+    if (webLayer)
+        GraphicsLayer::registerContentsLayer(webLayer);
+    frame()->setRemotePlatformLayer(webLayer);
+    frame()->ownerElement()->setNeedsStyleRecalc(WebCore::SubtreeStyleChange, WebCore::StyleChangeFromRenderer);
+}
+
+void WebFrameImpl::setPermissionClient(WebPermissionClient* permissionClient)
+{
+    m_permissionClient = permissionClient;
+}
+
+void WebFrameImpl::setSharedWorkerRepositoryClient(WebSharedWorkerRepositoryClient* client)
+{
+    m_sharedWorkerRepositoryClient = SharedWorkerRepositoryClientImpl::create(client);
+}
+
+WebSize WebFrameImpl::scrollOffset() const
+{
+    FrameView* view = frameView();
+    if (!view)
+        return WebSize();
+    return view->scrollOffset();
+}
+
+WebSize WebFrameImpl::minimumScrollOffset() const
+{
+    FrameView* view = frameView();
+    if (!view)
+        return WebSize();
+    return toIntSize(view->minimumScrollPosition());
+}
+
+WebSize WebFrameImpl::maximumScrollOffset() const
+{
+    FrameView* view = frameView();
+    if (!view)
+        return WebSize();
+    return toIntSize(view->maximumScrollPosition());
+}
+
+void WebFrameImpl::setScrollOffset(const WebSize& offset)
+{
+    if (FrameView* view = frameView())
+        view->setScrollOffset(IntPoint(offset.width, offset.height));
+}
+
+WebSize WebFrameImpl::contentsSize() const
+{
+    return frame()->view()->contentsSize();
+}
+
+bool WebFrameImpl::hasVisibleContent() const
+{
+    return frame()->view()->visibleWidth() > 0 && frame()->view()->visibleHeight() > 0;
+}
+
+WebRect WebFrameImpl::visibleContentRect() const
+{
+    return frame()->view()->visibleContentRect();
+}
+
+bool WebFrameImpl::hasHorizontalScrollbar() const
+{
+    return frame() && frame()->view() && frame()->view()->horizontalScrollbar();
+}
+
+bool WebFrameImpl::hasVerticalScrollbar() const
+{
+    return frame() && frame()->view() && frame()->view()->verticalScrollbar();
+}
+
+WebView* WebFrameImpl::view() const
+{
+    return viewImpl();
+}
+
+WebFrame* WebFrameImpl::opener() const
+{
+    return m_opener;
+}
+
+void WebFrameImpl::setOpener(WebFrame* opener)
+{
+    WebFrameImpl* openerImpl = toWebFrameImpl(opener);
+    if (m_opener && !openerImpl && m_client)
+        m_client->didDisownOpener(this);
+
+    if (m_opener)
+        m_opener->m_openedFrames.remove(this);
+    if (openerImpl)
+        openerImpl->m_openedFrames.add(this);
+    m_opener = openerImpl;
+
+    ASSERT(m_frame);
+    if (m_frame && m_frame->document())
+        m_frame->document()->initSecurityContext();
+}
+
+void WebFrameImpl::appendChild(WebFrame* child)
+{
+    // FIXME: Original code asserts that the frames have the same Page. We
+    // should add an equivalent check... figure out what.
+    WebFrameImpl* childImpl = toWebFrameImpl(child);
+    childImpl->m_parent = this;
+    WebFrameImpl* oldLast = m_lastChild;
+    m_lastChild = childImpl;
+
+    if (oldLast) {
+        childImpl->m_previousSibling = oldLast;
+        oldLast->m_nextSibling = childImpl;
+    } else {
+        m_firstChild = childImpl;
+    }
+    // FIXME: Not sure if this is a legitimate assert.
+    ASSERT(frame());
+    frame()->tree().invalidateScopedChildCount();
+}
+
+void WebFrameImpl::removeChild(WebFrame* child)
+{
+    WebFrameImpl* childImpl = toWebFrameImpl(child);
+    childImpl->m_parent = 0;
+
+    if (m_firstChild == childImpl)
+        m_firstChild = childImpl->m_nextSibling;
+    else
+        childImpl->m_previousSibling->m_nextSibling = childImpl->m_nextSibling;
+
+    if (m_lastChild == childImpl)
+        m_lastChild = childImpl->m_previousSibling;
+    else
+        childImpl->m_nextSibling->m_previousSibling = childImpl->m_previousSibling;
+
+    childImpl->m_previousSibling = childImpl->m_nextSibling = 0;
+    // FIXME: Not sure if this is a legitimate assert.
+    ASSERT(frame());
+    frame()->tree().invalidateScopedChildCount();
+}
+
+WebFrame* WebFrameImpl::parent() const
+{
+    return m_parent;
+}
+
+WebFrame* WebFrameImpl::top() const
+{
+    WebFrameImpl* frame = const_cast<WebFrameImpl*>(this);
+    for (WebFrameImpl* parent = frame; parent; parent = parent->m_parent)
+        frame = parent;
+    return frame;
+}
+
+WebFrame* WebFrameImpl::previousSibling() const
+{
+    return m_previousSibling;
+}
+
+WebFrame* WebFrameImpl::nextSibling() const
+{
+    return m_nextSibling;
+}
+
+WebFrame* WebFrameImpl::firstChild() const
+{
+    return m_firstChild;
+}
+
+WebFrame* WebFrameImpl::lastChild() const
+{
+    return m_lastChild;
+}
+
+WebFrame* WebFrameImpl::traversePrevious(bool wrap) const
+{
+    if (!frame())
+        return 0;
+    return fromFrame(frame()->tree().traversePreviousWithWrap(wrap));
+}
+
+WebFrame* WebFrameImpl::traverseNext(bool wrap) const
+{
+    if (!frame())
+        return 0;
+    return fromFrame(frame()->tree().traverseNextWithWrap(wrap));
+}
+
+WebFrame* WebFrameImpl::findChildByName(const WebString& name) const
+{
+    if (!frame())
+        return 0;
+    return fromFrame(frame()->tree().child(name));
+}
+
+WebFrame* WebFrameImpl::findChildByExpression(const WebString& xpath) const
+{
+    if (xpath.isEmpty())
+        return 0;
+
+    Document* document = frame()->document();
+    ASSERT(document);
+
+    RefPtrWillBeRawPtr<XPathResult> xpathResult = DocumentXPathEvaluator::evaluate(*document, xpath, document, nullptr, XPathResult::ORDERED_NODE_ITERATOR_TYPE, 0, IGNORE_EXCEPTION);
+    if (!xpathResult)
+        return 0;
+
+    Node* node = xpathResult->iterateNext(IGNORE_EXCEPTION);
+    if (!node || !node->isFrameOwnerElement())
+        return 0;
+    return fromFrame(toHTMLFrameOwnerElement(node)->contentFrame());
+}
+
+WebDocument WebFrameImpl::document() const
+{
+    if (!frame() || !frame()->document())
+        return WebDocument();
+    return WebDocument(frame()->document());
+}
+
+WebPerformance WebFrameImpl::performance() const
+{
+    if (!frame())
+        return WebPerformance();
+    return WebPerformance(&frame()->domWindow()->performance());
+}
+
+NPObject* WebFrameImpl::windowObject() const
+{
+    if (!frame())
+        return 0;
+    return frame()->script().windowScriptNPObject();
+}
+
+void WebFrameImpl::bindToWindowObject(const WebString& name, NPObject* object)
+{
+    bindToWindowObject(name, object, 0);
+}
+
+void WebFrameImpl::bindToWindowObject(const WebString& name, NPObject* object, void*)
+{
+    if (!frame() || !frame()->script().canExecuteScripts(NotAboutToExecuteScript))
+        return;
+    frame()->script().bindToWindowObject(frame(), String(name), object);
+}
+
+void WebFrameImpl::executeScript(const WebScriptSource& source)
+{
+    ASSERT(frame());
+    TextPosition position(OrdinalNumber::fromOneBasedInt(source.startLine), OrdinalNumber::first());
+    frame()->script().executeScriptInMainWorld(ScriptSourceCode(source.code, source.url, position));
+}
+
+void WebFrameImpl::executeScriptInIsolatedWorld(int worldID, const WebScriptSource* sourcesIn, unsigned numSources, int extensionGroup)
+{
+    ASSERT(frame());
+    RELEASE_ASSERT(worldID > 0);
+    RELEASE_ASSERT(worldID < EmbedderWorldIdLimit);
+
+    Vector<ScriptSourceCode> sources;
+    for (unsigned i = 0; i < numSources; ++i) {
+        TextPosition position(OrdinalNumber::fromOneBasedInt(sourcesIn[i].startLine), OrdinalNumber::first());
+        sources.append(ScriptSourceCode(sourcesIn[i].code, sourcesIn[i].url, position));
+    }
+
+    frame()->script().executeScriptInIsolatedWorld(worldID, sources, extensionGroup, 0);
+}
+
+void WebFrameImpl::setIsolatedWorldSecurityOrigin(int worldID, const WebSecurityOrigin& securityOrigin)
+{
+    ASSERT(frame());
+    DOMWrapperWorld::setIsolatedWorldSecurityOrigin(worldID, securityOrigin.get());
+}
+
+void WebFrameImpl::setIsolatedWorldContentSecurityPolicy(int worldID, const WebString& policy)
+{
+    ASSERT(frame());
+    DOMWrapperWorld::setIsolatedWorldContentSecurityPolicy(worldID, policy);
+}
+
+void WebFrameImpl::addMessageToConsole(const WebConsoleMessage& message)
+{
+    ASSERT(frame());
+
+    MessageLevel webCoreMessageLevel;
+    switch (message.level) {
+    case WebConsoleMessage::LevelDebug:
+        webCoreMessageLevel = DebugMessageLevel;
+        break;
+    case WebConsoleMessage::LevelLog:
+        webCoreMessageLevel = LogMessageLevel;
+        break;
+    case WebConsoleMessage::LevelWarning:
+        webCoreMessageLevel = WarningMessageLevel;
+        break;
+    case WebConsoleMessage::LevelError:
+        webCoreMessageLevel = ErrorMessageLevel;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    frame()->document()->addConsoleMessage(OtherMessageSource, webCoreMessageLevel, message.text);
+}
+
+void WebFrameImpl::collectGarbage()
+{
+    if (!frame())
+        return;
+    if (!frame()->settings()->scriptEnabled())
+        return;
+    V8GCController::collectGarbage(v8::Isolate::GetCurrent());
+}
+
+bool WebFrameImpl::checkIfRunInsecureContent(const WebURL& url) const
+{
+    ASSERT(frame());
+    return frame()->loader().mixedContentChecker()->canRunInsecureContent(frame()->document()->securityOrigin(), url);
+}
+
+v8::Handle<v8::Value> WebFrameImpl::executeScriptAndReturnValue(const WebScriptSource& source)
+{
+    ASSERT(frame());
+
+    // FIXME: This fake user gesture is required to make a bunch of pyauto
+    // tests pass. If this isn't needed in non-test situations, we should
+    // consider removing this code and changing the tests.
+    // http://code.google.com/p/chromium/issues/detail?id=86397
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingNewUserGesture);
+
+    TextPosition position(OrdinalNumber::fromOneBasedInt(source.startLine), OrdinalNumber::first());
+    return frame()->script().executeScriptInMainWorldAndReturnValue(ScriptSourceCode(source.code, source.url, position)).v8Value();
+}
+
+void WebFrameImpl::executeScriptInIsolatedWorld(int worldID, const WebScriptSource* sourcesIn, unsigned numSources, int extensionGroup, WebVector<v8::Local<v8::Value> >* results)
+{
+    ASSERT(frame());
+    RELEASE_ASSERT(worldID > 0);
+    RELEASE_ASSERT(worldID < EmbedderWorldIdLimit);
+
+    Vector<ScriptSourceCode> sources;
+
+    for (unsigned i = 0; i < numSources; ++i) {
+        TextPosition position(OrdinalNumber::fromOneBasedInt(sourcesIn[i].startLine), OrdinalNumber::first());
+        sources.append(ScriptSourceCode(sourcesIn[i].code, sourcesIn[i].url, position));
+    }
+
+    if (results) {
+        Vector<ScriptValue> scriptResults;
+        frame()->script().executeScriptInIsolatedWorld(worldID, sources, extensionGroup, &scriptResults);
+        WebVector<v8::Local<v8::Value> > v8Results(scriptResults.size());
+        for (unsigned i = 0; i < scriptResults.size(); i++)
+            v8Results[i] = v8::Local<v8::Value>::New(toIsolate(frame()), scriptResults[i].v8Value());
+        results->swap(v8Results);
+    } else {
+        frame()->script().executeScriptInIsolatedWorld(worldID, sources, extensionGroup, 0);
+    }
+}
+
+v8::Handle<v8::Value> WebFrameImpl::callFunctionEvenIfScriptDisabled(v8::Handle<v8::Function> function, v8::Handle<v8::Value> receiver, int argc, v8::Handle<v8::Value> argv[])
+{
+    ASSERT(frame());
+    return frame()->script().callFunction(function, receiver, argc, argv);
+}
+
+v8::Local<v8::Context> WebFrameImpl::mainWorldScriptContext() const
+{
+    return toV8Context(V8PerIsolateData::mainThreadIsolate(), frame(), DOMWrapperWorld::mainWorld());
+}
+
+void WebFrameImpl::reload(bool ignoreCache)
+{
+    ASSERT(frame());
+    frame()->loader().reload(ignoreCache ? EndToEndReload : NormalReload);
+}
+
+void WebFrameImpl::reloadWithOverrideURL(const WebURL& overrideUrl, bool ignoreCache)
+{
+    ASSERT(frame());
+    frame()->loader().reload(ignoreCache ? EndToEndReload : NormalReload, overrideUrl);
+}
+
+void WebFrameImpl::loadRequest(const WebURLRequest& request)
+{
+    ASSERT(frame());
+    ASSERT(!request.isNull());
+    const ResourceRequest& resourceRequest = request.toResourceRequest();
+
+    if (resourceRequest.url().protocolIs("javascript")) {
+        loadJavaScriptURL(resourceRequest.url());
+        return;
+    }
+
+    frame()->loader().load(FrameLoadRequest(0, resourceRequest));
+}
+
+void WebFrameImpl::loadHistoryItem(const WebHistoryItem& item, WebURLRequest::CachePolicy cachePolicy)
+{
+    ASSERT(frame());
+    RefPtr<HistoryItem> historyItem = PassRefPtr<HistoryItem>(item);
+    ASSERT(historyItem);
+    frame()->page()->historyController().goToItem(historyItem.get(), static_cast<ResourceRequestCachePolicy>(cachePolicy));
+}
+
+void WebFrameImpl::loadData(const WebData& data, const WebString& mimeType, const WebString& textEncoding, const WebURL& baseURL, const WebURL& unreachableURL, bool replace)
+{
+    ASSERT(frame());
+
+    // If we are loading substitute data to replace an existing load, then
+    // inherit all of the properties of that original request.  This way,
+    // reload will re-attempt the original request.  It is essential that
+    // we only do this when there is an unreachableURL since a non-empty
+    // unreachableURL informs FrameLoader::reload to load unreachableURL
+    // instead of the currently loaded URL.
+    ResourceRequest request;
+    if (replace && !unreachableURL.isEmpty() && frame()->loader().provisionalDocumentLoader())
+        request = frame()->loader().provisionalDocumentLoader()->originalRequest();
+    request.setURL(baseURL);
+
+    FrameLoadRequest frameRequest(0, request, SubstituteData(data, mimeType, textEncoding, unreachableURL));
+    ASSERT(frameRequest.substituteData().isValid());
+    frameRequest.setLockBackForwardList(replace);
+    frame()->loader().load(frameRequest);
+}
+
+void WebFrameImpl::loadHTMLString(const WebData& data, const WebURL& baseURL, const WebURL& unreachableURL, bool replace)
+{
+    ASSERT(frame());
+    loadData(data, WebString::fromUTF8("text/html"), WebString::fromUTF8("UTF-8"), baseURL, unreachableURL, replace);
+}
+
+bool WebFrameImpl::isLoading() const
+{
+    if (!frame())
+        return false;
+    return frame()->loader().isLoading();
+}
+
+void WebFrameImpl::stopLoading()
+{
+    if (!frame())
+        return;
+    // FIXME: Figure out what we should really do here.  It seems like a bug
+    // that FrameLoader::stopLoading doesn't call stopAllLoaders.
+    frame()->loader().stopAllLoaders();
+}
+
+WebDataSource* WebFrameImpl::provisionalDataSource() const
+{
+    ASSERT(frame());
+
+    // We regard the policy document loader as still provisional.
+    DocumentLoader* documentLoader = frame()->loader().provisionalDocumentLoader();
+    if (!documentLoader)
+        documentLoader = frame()->loader().policyDocumentLoader();
+
+    return DataSourceForDocLoader(documentLoader);
+}
+
+WebDataSource* WebFrameImpl::dataSource() const
+{
+    ASSERT(frame());
+    return DataSourceForDocLoader(frame()->loader().documentLoader());
+}
+
+WebHistoryItem WebFrameImpl::previousHistoryItem() const
+{
+    ASSERT(frame());
+    // We use the previous item here because documentState (filled-out forms)
+    // only get saved to history when it becomes the previous item.  The caller
+    // is expected to query the history item after a navigation occurs, after
+    // the desired history item has become the previous entry.
+    return WebHistoryItem(frame()->page()->historyController().previousItemForExport());
+}
+
+WebHistoryItem WebFrameImpl::currentHistoryItem() const
+{
+    ASSERT(frame());
+
+    // We're shutting down.
+    if (!frame()->loader().documentLoader())
+        return WebHistoryItem();
+
+    // Lazily update the document state if it was dirtied. Doing it here
+    // avoids synchronously serializing forms as they're changing.
+    frame()->loader().saveDocumentState();
+
+    return WebHistoryItem(frame()->page()->historyController().currentItemForExport());
+}
+
+void WebFrameImpl::enableViewSourceMode(bool enable)
+{
+    if (frame())
+        frame()->setInViewSourceMode(enable);
+}
+
+bool WebFrameImpl::isViewSourceModeEnabled() const
+{
+    if (!frame())
+        return false;
+    return frame()->inViewSourceMode();
+}
+
+void WebFrameImpl::setReferrerForRequest(WebURLRequest& request, const WebURL& referrerURL)
+{
+    String referrer = referrerURL.isEmpty() ? frame()->document()->outgoingReferrer() : String(referrerURL.spec().utf16());
+    referrer = SecurityPolicy::generateReferrerHeader(frame()->document()->referrerPolicy(), request.url(), referrer);
+    if (referrer.isEmpty())
+        return;
+    request.setHTTPReferrer(referrer, static_cast<WebReferrerPolicy>(frame()->document()->referrerPolicy()));
+}
+
+void WebFrameImpl::dispatchWillSendRequest(WebURLRequest& request)
+{
+    ResourceResponse response;
+    frame()->loader().client()->dispatchWillSendRequest(0, 0, request.toMutableResourceRequest(), response);
+}
+
+WebURLLoader* WebFrameImpl::createAssociatedURLLoader(const WebURLLoaderOptions& options)
+{
+    return new AssociatedURLLoader(this, options);
+}
+
+unsigned WebFrameImpl::unloadListenerCount() const
+{
+    return frame()->domWindow()->pendingUnloadEventListeners();
+}
+
+void WebFrameImpl::replaceSelection(const WebString& text)
+{
+    bool selectReplacement = false;
+    bool smartReplace = true;
+    frame()->editor().replaceSelectionWithText(text, selectReplacement, smartReplace);
+}
+
+void WebFrameImpl::insertText(const WebString& text)
+{
+    if (frame()->inputMethodController().hasComposition())
+        frame()->inputMethodController().confirmComposition(text);
+    else
+        frame()->editor().insertText(text, 0);
+}
+
+void WebFrameImpl::setMarkedText(const WebString& text, unsigned location, unsigned length)
+{
+    Vector<CompositionUnderline> decorations;
+    frame()->inputMethodController().setComposition(text, decorations, location, length);
+}
+
+void WebFrameImpl::unmarkText()
+{
+    frame()->inputMethodController().cancelComposition();
+}
+
+bool WebFrameImpl::hasMarkedText() const
+{
+    return frame()->inputMethodController().hasComposition();
+}
+
+WebRange WebFrameImpl::markedRange() const
+{
+    return frame()->inputMethodController().compositionRange();
+}
+
+bool WebFrameImpl::firstRectForCharacterRange(unsigned location, unsigned length, WebRect& rect) const
+{
+    if ((location + length < location) && (location + length))
+        length = 0;
+
+    Element* editable = frame()->selection().rootEditableElementOrDocumentElement();
+    ASSERT(editable);
+    RefPtr<Range> range = PlainTextRange(location, location + length).createRange(*editable);
+    if (!range)
+        return false;
+    IntRect intRect = frame()->editor().firstRectForRange(range.get());
+    rect = WebRect(intRect);
+    rect = frame()->view()->contentsToWindow(rect);
+    return true;
+}
+
+size_t WebFrameImpl::characterIndexForPoint(const WebPoint& webPoint) const
+{
+    if (!frame())
+        return kNotFound;
+
+    IntPoint point = frame()->view()->windowToContents(webPoint);
+    HitTestResult result = frame()->eventHandler().hitTestResultAtPoint(point, HitTestRequest::ReadOnly | HitTestRequest::Active | HitTestRequest::ConfusingAndOftenMisusedDisallowShadowContent);
+    RefPtr<Range> range = frame()->rangeForPoint(result.roundedPointInInnerNodeFrame());
+    if (!range)
+        return kNotFound;
+    Element* editable = frame()->selection().rootEditableElementOrDocumentElement();
+    ASSERT(editable);
+    return PlainTextRange::create(*editable, *range.get()).start();
+}
+
+bool WebFrameImpl::executeCommand(const WebString& name, const WebNode& node)
+{
+    ASSERT(frame());
+
+    if (name.length() <= 2)
+        return false;
+
+    // Since we don't have NSControl, we will convert the format of command
+    // string and call the function on Editor directly.
+    String command = name;
+
+    // Make sure the first letter is upper case.
+    command.replace(0, 1, command.substring(0, 1).upper());
+
+    // Remove the trailing ':' if existing.
+    if (command[command.length() - 1] == UChar(':'))
+        command = command.substring(0, command.length() - 1);
+
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromNode(frame(), node);
+    if (pluginContainer && pluginContainer->executeEditCommand(name))
+        return true;
+
+    bool result = true;
+
+    // Specially handling commands that Editor::execCommand does not directly
+    // support.
+    if (command == "DeleteToEndOfParagraph") {
+        if (!frame()->editor().deleteWithDirection(DirectionForward, ParagraphBoundary, true, false))
+            frame()->editor().deleteWithDirection(DirectionForward, CharacterGranularity, true, false);
+    } else if (command == "Indent") {
+        frame()->editor().indent();
+    } else if (command == "Outdent") {
+        frame()->editor().outdent();
+    } else if (command == "DeleteBackward") {
+        result = frame()->editor().command(AtomicString("BackwardDelete")).execute();
+    } else if (command == "DeleteForward") {
+        result = frame()->editor().command(AtomicString("ForwardDelete")).execute();
+    } else if (command == "AdvanceToNextMisspelling") {
+        // Wee need to pass false here or else the currently selected word will never be skipped.
+        frame()->spellChecker().advanceToNextMisspelling(false);
+    } else if (command == "ToggleSpellPanel") {
+        frame()->spellChecker().showSpellingGuessPanel();
+    } else {
+        result = frame()->editor().command(command).execute();
+    }
+    return result;
+}
+
+bool WebFrameImpl::executeCommand(const WebString& name, const WebString& value, const WebNode& node)
+{
+    ASSERT(frame());
+    String webName = name;
+
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromNode(frame(), node);
+    if (pluginContainer && pluginContainer->executeEditCommand(name, value))
+        return true;
+
+    // moveToBeginningOfDocument and moveToEndfDocument are only handled by WebKit for editable nodes.
+    if (!frame()->editor().canEdit() && webName == "moveToBeginningOfDocument")
+        return viewImpl()->bubblingScroll(ScrollUp, ScrollByDocument);
+
+    if (!frame()->editor().canEdit() && webName == "moveToEndOfDocument")
+        return viewImpl()->bubblingScroll(ScrollDown, ScrollByDocument);
+
+    if (webName == "showGuessPanel") {
+        frame()->spellChecker().showSpellingGuessPanel();
+        return true;
+    }
+
+    return frame()->editor().command(webName).execute(value);
+}
+
+bool WebFrameImpl::isCommandEnabled(const WebString& name) const
+{
+    ASSERT(frame());
+    return frame()->editor().command(name).isEnabled();
+}
+
+void WebFrameImpl::enableContinuousSpellChecking(bool enable)
+{
+    if (enable == isContinuousSpellCheckingEnabled())
+        return;
+    frame()->spellChecker().toggleContinuousSpellChecking();
+}
+
+bool WebFrameImpl::isContinuousSpellCheckingEnabled() const
+{
+    return frame()->spellChecker().isContinuousSpellCheckingEnabled();
+}
+
+void WebFrameImpl::requestTextChecking(const WebElement& webElement)
+{
+    if (webElement.isNull())
+        return;
+    frame()->spellChecker().requestTextChecking(*webElement.constUnwrap<Element>());
+}
+
+void WebFrameImpl::replaceMisspelledRange(const WebString& text)
+{
+    // If this caret selection has two or more markers, this function replace the range covered by the first marker with the specified word as Microsoft Word does.
+    if (pluginContainerFromFrame(frame()))
+        return;
+    RefPtr<Range> caretRange = frame()->selection().toNormalizedRange();
+    if (!caretRange)
+        return;
+    Vector<DocumentMarker*> markers = frame()->document()->markers().markersInRange(caretRange.get(), DocumentMarker::MisspellingMarkers());
+    if (markers.size() < 1 || markers[0]->startOffset() >= markers[0]->endOffset())
+        return;
+    RefPtr<Range> markerRange = Range::create(caretRange->ownerDocument(), caretRange->startContainer(), markers[0]->startOffset(), caretRange->endContainer(), markers[0]->endOffset());
+    if (!markerRange)
+        return;
+    frame()->selection().setSelection(markerRange.get(), CharacterGranularity);
+    frame()->editor().replaceSelectionWithText(text, false, false);
+}
+
+void WebFrameImpl::removeSpellingMarkers()
+{
+    frame()->document()->markers().removeMarkers(DocumentMarker::MisspellingMarkers());
+}
+
+bool WebFrameImpl::hasSelection() const
+{
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+    if (pluginContainer)
+        return pluginContainer->plugin()->hasSelection();
+
+    // frame()->selection()->isNone() never returns true.
+    return frame()->selection().start() != frame()->selection().end();
+}
+
+WebRange WebFrameImpl::selectionRange() const
+{
+    return frame()->selection().toNormalizedRange();
+}
+
+WebString WebFrameImpl::selectionAsText() const
+{
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+    if (pluginContainer)
+        return pluginContainer->plugin()->selectionAsText();
+
+    RefPtr<Range> range = frame()->selection().toNormalizedRange();
+    if (!range)
+        return WebString();
+
+    String text = range->text();
+#if OS(WIN)
+    replaceNewlinesWithWindowsStyleNewlines(text);
+#endif
+    replaceNBSPWithSpace(text);
+    return text;
+}
+
+WebString WebFrameImpl::selectionAsMarkup() const
+{
+    WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame());
+    if (pluginContainer)
+        return pluginContainer->plugin()->selectionAsMarkup();
+
+    RefPtr<Range> range = frame()->selection().toNormalizedRange();
+    if (!range)
+        return WebString();
+
+    return createMarkup(range.get(), 0, AnnotateForInterchange, false, ResolveNonLocalURLs);
+}
+
+void WebFrameImpl::selectWordAroundPosition(LocalFrame* frame, VisiblePosition position)
+{
+    VisibleSelection selection(position);
+    selection.expandUsingGranularity(WordGranularity);
+
+    TextGranularity granularity = selection.isRange() ? WordGranularity : CharacterGranularity;
+    frame->selection().setSelection(selection, granularity);
+}
+
+bool WebFrameImpl::selectWordAroundCaret()
+{
+    FrameSelection& selection = frame()->selection();
+    ASSERT(!selection.isNone());
+    if (selection.isNone() || selection.isRange())
+        return false;
+    selectWordAroundPosition(frame(), selection.selection().visibleStart());
+    return true;
+}
+
+void WebFrameImpl::selectRange(const WebPoint& base, const WebPoint& extent)
+{
+    moveRangeSelection(base, extent);
+}
+
+void WebFrameImpl::selectRange(const WebRange& webRange)
+{
+    if (RefPtr<Range> range = static_cast<PassRefPtr<Range> >(webRange))
+        frame()->selection().setSelectedRange(range.get(), WebCore::VP_DEFAULT_AFFINITY, false);
+}
+
+void WebFrameImpl::moveRangeSelection(const WebPoint& base, const WebPoint& extent)
+{
+    VisiblePosition basePosition = visiblePositionForWindowPoint(base);
+    VisiblePosition extentPosition = visiblePositionForWindowPoint(extent);
+    VisibleSelection newSelection = VisibleSelection(basePosition, extentPosition);
+    frame()->selection().setSelection(newSelection, CharacterGranularity);
+}
+
+void WebFrameImpl::moveCaretSelection(const WebPoint& point)
+{
+    Element* editable = frame()->selection().rootEditableElement();
+    if (!editable)
+        return;
+
+    VisiblePosition position = visiblePositionForWindowPoint(point);
+    frame()->selection().moveTo(position, UserTriggered);
+}
+
+void WebFrameImpl::setCaretVisible(bool visible)
+{
+    frame()->selection().setCaretVisible(visible);
+}
+
+VisiblePosition WebFrameImpl::visiblePositionForWindowPoint(const WebPoint& point)
+{
+    FloatPoint unscaledPoint(point);
+    unscaledPoint.scale(1 / view()->pageScaleFactor(), 1 / view()->pageScaleFactor());
+
+    HitTestRequest request = HitTestRequest::Move | HitTestRequest::ReadOnly | HitTestRequest::Active | HitTestRequest::IgnoreClipping | HitTestRequest::ConfusingAndOftenMisusedDisallowShadowContent;
+    HitTestResult result(frame()->view()->windowToContents(roundedIntPoint(unscaledPoint)));
+    frame()->document()->renderView()->layer()->hitTest(request, result);
+
+    if (Node* node = result.targetNode())
+        return frame()->selection().selection().visiblePositionRespectingEditingBoundary(result.localPoint(), node);
+    return VisiblePosition();
+}
+
+int WebFrameImpl::printBegin(const WebPrintParams& printParams, const WebNode& constrainToNode)
+{
+    ASSERT(!frame()->document()->isFrameSet());
+    WebPluginContainerImpl* pluginContainer = 0;
+    if (constrainToNode.isNull()) {
+        // If this is a plugin document, check if the plugin supports its own
+        // printing. If it does, we will delegate all printing to that.
+        pluginContainer = pluginContainerFromFrame(frame());
+    } else {
+        // We only support printing plugin nodes for now.
+        pluginContainer = toWebPluginContainerImpl(constrainToNode.pluginContainer());
+    }
+
+    if (pluginContainer && pluginContainer->supportsPaginatedPrint())
+        m_printContext = adoptPtr(new ChromePluginPrintContext(frame(), pluginContainer, printParams));
+    else
+        m_printContext = adoptPtr(new ChromePrintContext(frame()));
+
+    FloatRect rect(0, 0, static_cast<float>(printParams.printContentArea.width), static_cast<float>(printParams.printContentArea.height));
+    m_printContext->begin(rect.width(), rect.height());
+    float pageHeight;
+    // We ignore the overlays calculation for now since they are generated in the
+    // browser. pageHeight is actually an output parameter.
+    m_printContext->computePageRects(rect, 0, 0, 1.0, pageHeight);
+
+    return m_printContext->pageCount();
+}
+
+float WebFrameImpl::getPrintPageShrink(int page)
+{
+    ASSERT(m_printContext && page >= 0);
+    return m_printContext->getPageShrink(page);
+}
+
+float WebFrameImpl::printPage(int page, WebCanvas* canvas)
+{
+#if ENABLE(PRINTING)
+    ASSERT(m_printContext && page >= 0 && frame() && frame()->document());
+
+    GraphicsContext graphicsContext(canvas);
+    graphicsContext.setPrinting(true);
+    return m_printContext->spoolPage(graphicsContext, page);
+#else
+    return 0;
+#endif
+}
+
+void WebFrameImpl::printEnd()
+{
+    ASSERT(m_printContext);
+    m_printContext->end();
+    m_printContext.clear();
+}
+
+bool WebFrameImpl::isPrintScalingDisabledForPlugin(const WebNode& node)
+{
+    WebPluginContainerImpl* pluginContainer =  node.isNull() ? pluginContainerFromFrame(frame()) : toWebPluginContainerImpl(node.pluginContainer());
+
+    if (!pluginContainer || !pluginContainer->supportsPaginatedPrint())
+        return false;
+
+    return pluginContainer->isPrintScalingDisabled();
+}
+
+bool WebFrameImpl::hasCustomPageSizeStyle(int pageIndex)
+{
+    return frame()->document()->styleForPage(pageIndex)->pageSizeType() != PAGE_SIZE_AUTO;
+}
+
+bool WebFrameImpl::isPageBoxVisible(int pageIndex)
+{
+    return frame()->document()->isPageBoxVisible(pageIndex);
+}
+
+void WebFrameImpl::pageSizeAndMarginsInPixels(int pageIndex, WebSize& pageSize, int& marginTop, int& marginRight, int& marginBottom, int& marginLeft)
+{
+    IntSize size = pageSize;
+    frame()->document()->pageSizeAndMarginsInPixels(pageIndex, size, marginTop, marginRight, marginBottom, marginLeft);
+    pageSize = size;
+}
+
+WebString WebFrameImpl::pageProperty(const WebString& propertyName, int pageIndex)
+{
+    ASSERT(m_printContext);
+    return m_printContext->pageProperty(frame(), propertyName.utf8().data(), pageIndex);
+}
+
+bool WebFrameImpl::find(int identifier, const WebString& searchText, const WebFindOptions& options, bool wrapWithinFrame, WebRect* selectionRect)
+{
+    if (!frame() || !frame()->page())
+        return false;
+
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+
+    if (!options.findNext)
+        frame()->page()->unmarkAllTextMatches();
+    else
+        setMarkerActive(m_activeMatch.get(), false);
+
+    if (m_activeMatch && &m_activeMatch->ownerDocument() != frame()->document())
+        m_activeMatch = nullptr;
+
+    // If the user has selected something since the last Find operation we want
+    // to start from there. Otherwise, we start searching from where the last Find
+    // operation left off (either a Find or a FindNext operation).
+    VisibleSelection selection(frame()->selection().selection());
+    bool activeSelection = !selection.isNone();
+    if (activeSelection) {
+        m_activeMatch = selection.firstRange().get();
+        frame()->selection().clear();
+    }
+
+    ASSERT(frame() && frame()->view());
+    const FindOptions findOptions = (options.forward ? 0 : Backwards)
+        | (options.matchCase ? 0 : CaseInsensitive)
+        | (wrapWithinFrame ? WrapAround : 0)
+        | (options.wordStart ? AtWordStarts : 0)
+        | (options.medialCapitalAsWordStart ? TreatMedialCapitalAsWordStart : 0)
+        | (options.findNext ? 0 : StartInSelection);
+    m_activeMatch = frame()->editor().findStringAndScrollToVisible(searchText, m_activeMatch.get(), findOptions);
+
+    if (!m_activeMatch) {
+        // If we're finding next the next active match might not be in the current frame.
+        // In this case we don't want to clear the matches cache.
+        if (!options.findNext)
+            clearFindMatchesCache();
+        invalidateArea(InvalidateAll);
+        return false;
+    }
+
+#if OS(ANDROID)
+    viewImpl()->zoomToFindInPageRect(frameView()->contentsToWindow(enclosingIntRect(RenderObject::absoluteBoundingBoxRectForRange(m_activeMatch.get()))));
+#endif
+
+    setMarkerActive(m_activeMatch.get(), true);
+    WebFrameImpl* oldActiveFrame = mainFrameImpl->m_currentActiveMatchFrame;
+    mainFrameImpl->m_currentActiveMatchFrame = this;
+
+    // Make sure no node is focused. See http://crbug.com/38700.
+    frame()->document()->setFocusedElement(nullptr);
+
+    if (!options.findNext || activeSelection) {
+        // This is either a Find operation or a Find-next from a new start point
+        // due to a selection, so we set the flag to ask the scoping effort
+        // to find the active rect for us and report it back to the UI.
+        m_locatingActiveRect = true;
+    } else {
+        if (oldActiveFrame != this) {
+            if (options.forward)
+                m_activeMatchIndexInCurrentFrame = 0;
+            else
+                m_activeMatchIndexInCurrentFrame = m_lastMatchCount - 1;
+        } else {
+            if (options.forward)
+                ++m_activeMatchIndexInCurrentFrame;
+            else
+                --m_activeMatchIndexInCurrentFrame;
+
+            if (m_activeMatchIndexInCurrentFrame + 1 > m_lastMatchCount)
+                m_activeMatchIndexInCurrentFrame = 0;
+            if (m_activeMatchIndexInCurrentFrame == -1)
+                m_activeMatchIndexInCurrentFrame = m_lastMatchCount - 1;
+        }
+        if (selectionRect) {
+            *selectionRect = frameView()->contentsToWindow(m_activeMatch->boundingBox());
+            reportFindInPageSelection(*selectionRect, m_activeMatchIndexInCurrentFrame + 1, identifier);
+        }
+    }
+
+    return true;
+}
+
+void WebFrameImpl::stopFinding(bool clearSelection)
+{
+    if (!clearSelection)
+        setFindEndstateFocusAndSelection();
+    cancelPendingScopingEffort();
+
+    // Remove all markers for matches found and turn off the highlighting.
+    frame()->document()->markers().removeMarkers(DocumentMarker::TextMatch);
+    frame()->editor().setMarkedTextMatchesAreHighlighted(false);
+    clearFindMatchesCache();
+
+    // Let the frame know that we don't want tickmarks or highlighting anymore.
+    invalidateArea(InvalidateAll);
+}
+
+void WebFrameImpl::scopeStringMatches(int identifier, const WebString& searchText, const WebFindOptions& options, bool reset)
+{
+    if (reset) {
+        // This is a brand new search, so we need to reset everything.
+        // Scoping is just about to begin.
+        m_scopingInProgress = true;
+
+        // Need to keep the current identifier locally in order to finish the
+        // request in case the frame is detached during the process.
+        m_findRequestIdentifier = identifier;
+
+        // Clear highlighting for this frame.
+        if (frame() && frame()->page() && frame()->editor().markedTextMatchesAreHighlighted())
+            frame()->page()->unmarkAllTextMatches();
+
+        // Clear the tickmarks and results cache.
+        clearFindMatchesCache();
+
+        // Clear the counters from last operation.
+        m_lastMatchCount = 0;
+        m_nextInvalidateAfter = 0;
+
+        m_resumeScopingFromRange = nullptr;
+
+        // The view might be null on detached frames.
+        if (frame() && frame()->page())
+            viewImpl()->mainFrameImpl()->m_framesScopingCount++;
+
+        // Now, defer scoping until later to allow find operation to finish quickly.
+        scopeStringMatchesSoon(identifier, searchText, options, false); // false means just reset, so don't do it again.
+        return;
+    }
+
+    if (!shouldScopeMatches(searchText)) {
+        // Note that we want to defer the final update when resetting even if shouldScopeMatches returns false.
+        // This is done in order to prevent sending a final message based only on the results of the first frame
+        // since m_framesScopingCount would be 0 as other frames have yet to reset.
+        finishCurrentScopingEffort(identifier);
+        return;
+    }
+
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+    RefPtr<Range> searchRange(rangeOfContents(frame()->document()));
+
+    Node* originalEndContainer = searchRange->endContainer();
+    int originalEndOffset = searchRange->endOffset();
+
+    TrackExceptionState exceptionState, exceptionState2;
+    if (m_resumeScopingFromRange) {
+        // This is a continuation of a scoping operation that timed out and didn't
+        // complete last time around, so we should start from where we left off.
+        searchRange->setStart(m_resumeScopingFromRange->startContainer(), m_resumeScopingFromRange->startOffset(exceptionState2) + 1, exceptionState);
+        if (exceptionState.hadException() || exceptionState2.hadException()) {
+            if (exceptionState2.hadException()) // A non-zero |exceptionState| happens when navigating during search.
+                ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+
+    // This timeout controls how long we scope before releasing control.  This
+    // value does not prevent us from running for longer than this, but it is
+    // periodically checked to see if we have exceeded our allocated time.
+    const double maxScopingDuration = 0.1; // seconds
+
+    int matchCount = 0;
+    bool timedOut = false;
+    double startTime = currentTime();
+    do {
+        // Find next occurrence of the search string.
+        // FIXME: (http://b/1088245) This WebKit operation may run for longer
+        // than the timeout value, and is not interruptible as it is currently
+        // written. We may need to rewrite it with interruptibility in mind, or
+        // find an alternative.
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(),
+                                                searchText,
+                                                options.matchCase ? 0 : CaseInsensitive));
+        if (resultRange->collapsed(exceptionState)) {
+            if (!resultRange->startContainer()->isInShadowTree())
+                break;
+
+            searchRange->setStartAfter(
+                resultRange->startContainer()->deprecatedShadowAncestorNode(), exceptionState);
+            searchRange->setEnd(originalEndContainer, originalEndOffset, exceptionState);
+            continue;
+        }
+
+        ++matchCount;
+
+        // Catch a special case where Find found something but doesn't know what
+        // the bounding box for it is. In this case we set the first match we find
+        // as the active rect.
+        IntRect resultBounds = resultRange->boundingBox();
+        IntRect activeSelectionRect;
+        if (m_locatingActiveRect) {
+            activeSelectionRect = m_activeMatch.get() ?
+                m_activeMatch->boundingBox() : resultBounds;
+        }
+
+        // If the Find function found a match it will have stored where the
+        // match was found in m_activeSelectionRect on the current frame. If we
+        // find this rect during scoping it means we have found the active
+        // tickmark.
+        bool foundActiveMatch = false;
+        if (m_locatingActiveRect && (activeSelectionRect == resultBounds)) {
+            // We have found the active tickmark frame.
+            mainFrameImpl->m_currentActiveMatchFrame = this;
+            foundActiveMatch = true;
+            // We also know which tickmark is active now.
+            m_activeMatchIndexInCurrentFrame = matchCount - 1;
+            // To stop looking for the active tickmark, we set this flag.
+            m_locatingActiveRect = false;
+
+            // Notify browser of new location for the selected rectangle.
+            reportFindInPageSelection(
+                frameView()->contentsToWindow(resultBounds),
+                m_activeMatchIndexInCurrentFrame + 1,
+                identifier);
+        }
+
+        addMarker(resultRange.get(), foundActiveMatch);
+
+        m_findMatchesCache.append(FindMatch(resultRange.get(), m_lastMatchCount + matchCount));
+
+        // Set the new start for the search range to be the end of the previous
+        // result range. There is no need to use a VisiblePosition here,
+        // since findPlainText will use a TextIterator to go over the visible
+        // text nodes.
+        searchRange->setStart(resultRange->endContainer(exceptionState), resultRange->endOffset(exceptionState), exceptionState);
+
+        Node* shadowTreeRoot = searchRange->shadowRoot();
+        if (searchRange->collapsed(exceptionState) && shadowTreeRoot)
+            searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->countChildren(), exceptionState);
+
+        m_resumeScopingFromRange = resultRange;
+        timedOut = (currentTime() - startTime) >= maxScopingDuration;
+    } while (!timedOut);
+
+    // Remember what we search for last time, so we can skip searching if more
+    // letters are added to the search string (and last outcome was 0).
+    m_lastSearchString = searchText;
+
+    if (matchCount > 0) {
+        frame()->editor().setMarkedTextMatchesAreHighlighted(true);
+
+        m_lastMatchCount += matchCount;
+
+        // Let the mainframe know how much we found during this pass.
+        mainFrameImpl->increaseMatchCount(matchCount, identifier);
+    }
+
+    if (timedOut) {
+        // If we found anything during this pass, we should redraw. However, we
+        // don't want to spam too much if the page is extremely long, so if we
+        // reach a certain point we start throttling the redraw requests.
+        if (matchCount > 0)
+            invalidateIfNecessary();
+
+        // Scoping effort ran out of time, lets ask for another time-slice.
+        scopeStringMatchesSoon(
+            identifier,
+            searchText,
+            options,
+            false); // don't reset.
+        return; // Done for now, resume work later.
+    }
+
+    finishCurrentScopingEffort(identifier);
+}
+
+void WebFrameImpl::flushCurrentScopingEffort(int identifier)
+{
+    if (!frame() || !frame()->page())
+        return;
+
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+
+    // This frame has no further scoping left, so it is done. Other frames might,
+    // of course, continue to scope matches.
+    mainFrameImpl->m_framesScopingCount--;
+
+    // If this is the last frame to finish scoping we need to trigger the final
+    // update to be sent.
+    if (!mainFrameImpl->m_framesScopingCount)
+        mainFrameImpl->increaseMatchCount(0, identifier);
+}
+
+void WebFrameImpl::finishCurrentScopingEffort(int identifier)
+{
+    flushCurrentScopingEffort(identifier);
+
+    m_scopingInProgress = false;
+    m_lastFindRequestCompletedWithNoMatches = !m_lastMatchCount;
+
+    // This frame is done, so show any scrollbar tickmarks we haven't drawn yet.
+    invalidateArea(InvalidateScrollbar);
+}
+
+void WebFrameImpl::cancelPendingScopingEffort()
+{
+    deleteAllValues(m_deferredScopingWork);
+    m_deferredScopingWork.clear();
+
+    m_activeMatchIndexInCurrentFrame = -1;
+
+    // Last request didn't complete.
+    if (m_scopingInProgress)
+        m_lastFindRequestCompletedWithNoMatches = false;
+
+    m_scopingInProgress = false;
+}
+
+void WebFrameImpl::increaseMatchCount(int count, int identifier)
+{
+    // This function should only be called on the mainframe.
+    ASSERT(!parent());
+
+    if (count)
+        ++m_findMatchMarkersVersion;
+
+    m_totalMatchCount += count;
+
+    // Update the UI with the latest findings.
+    if (client())
+        client()->reportFindInPageMatchCount(identifier, m_totalMatchCount, !m_framesScopingCount);
+}
+
+void WebFrameImpl::reportFindInPageSelection(const WebRect& selectionRect, int activeMatchOrdinal, int identifier)
+{
+    // Update the UI with the latest selection rect.
+    if (client())
+        client()->reportFindInPageSelection(identifier, ordinalOfFirstMatchForFrame(this) + activeMatchOrdinal, selectionRect);
+}
+
+void WebFrameImpl::resetMatchCount()
+{
+    if (m_totalMatchCount > 0)
+        ++m_findMatchMarkersVersion;
+
+    m_totalMatchCount = 0;
+    m_framesScopingCount = 0;
+}
+
+void WebFrameImpl::sendOrientationChangeEvent(int orientation)
+{
+    if (frame())
+        frame()->sendOrientationChangeEvent(orientation);
+}
+
+void WebFrameImpl::dispatchMessageEventWithOriginCheck(const WebSecurityOrigin& intendedTargetOrigin, const WebDOMEvent& event)
+{
+    ASSERT(!event.isNull());
+    frame()->domWindow()->dispatchMessageEventWithOriginCheck(intendedTargetOrigin.get(), event, nullptr);
+}
+
+int WebFrameImpl::findMatchMarkersVersion() const
+{
+    ASSERT(!parent());
+    return m_findMatchMarkersVersion;
+}
+
+void WebFrameImpl::clearFindMatchesCache()
+{
+    if (!m_findMatchesCache.isEmpty())
+        viewImpl()->mainFrameImpl()->m_findMatchMarkersVersion++;
+
+    m_findMatchesCache.clear();
+    m_findMatchRectsAreValid = false;
+}
+
+bool WebFrameImpl::isActiveMatchFrameValid() const
+{
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+    WebFrameImpl* activeMatchFrame = mainFrameImpl->activeMatchFrame();
+    return activeMatchFrame && activeMatchFrame->m_activeMatch && activeMatchFrame->frame()->tree().isDescendantOf(mainFrameImpl->frame());
+}
+
+void WebFrameImpl::updateFindMatchRects()
+{
+    IntSize currentContentsSize = contentsSize();
+    if (m_contentsSizeForCurrentFindMatchRects != currentContentsSize) {
+        m_contentsSizeForCurrentFindMatchRects = currentContentsSize;
+        m_findMatchRectsAreValid = false;
+    }
+
+    size_t deadMatches = 0;
+    for (Vector<FindMatch>::iterator it = m_findMatchesCache.begin(); it != m_findMatchesCache.end(); ++it) {
+        if (!it->m_range->boundaryPointsValid() || !it->m_range->startContainer()->inDocument())
+            it->m_rect = FloatRect();
+        else if (!m_findMatchRectsAreValid)
+            it->m_rect = findInPageRectFromRange(it->m_range.get());
+
+        if (it->m_rect.isEmpty())
+            ++deadMatches;
+    }
+
+    // Remove any invalid matches from the cache.
+    if (deadMatches) {
+        Vector<FindMatch> filteredMatches;
+        filteredMatches.reserveCapacity(m_findMatchesCache.size() - deadMatches);
+
+        for (Vector<FindMatch>::const_iterator it = m_findMatchesCache.begin(); it != m_findMatchesCache.end(); ++it)
+            if (!it->m_rect.isEmpty())
+                filteredMatches.append(*it);
+
+        m_findMatchesCache.swap(filteredMatches);
+    }
+
+    // Invalidate the rects in child frames. Will be updated later during traversal.
+    if (!m_findMatchRectsAreValid)
+        for (WebFrame* child = firstChild(); child; child = child->nextSibling())
+            toWebFrameImpl(child)->m_findMatchRectsAreValid = false;
+
+    m_findMatchRectsAreValid = true;
+}
+
+WebFloatRect WebFrameImpl::activeFindMatchRect()
+{
+    ASSERT(!parent());
+
+    if (!isActiveMatchFrameValid())
+        return WebFloatRect();
+
+    return WebFloatRect(findInPageRectFromRange(m_currentActiveMatchFrame->m_activeMatch.get()));
+}
+
+void WebFrameImpl::findMatchRects(WebVector<WebFloatRect>& outputRects)
+{
+    ASSERT(!parent());
+
+    Vector<WebFloatRect> matchRects;
+    for (WebFrameImpl* frame = this; frame; frame = toWebFrameImpl(frame->traverseNext(false)))
+        frame->appendFindMatchRects(matchRects);
+
+    outputRects = matchRects;
+}
+
+void WebFrameImpl::appendFindMatchRects(Vector<WebFloatRect>& frameRects)
+{
+    updateFindMatchRects();
+    frameRects.reserveCapacity(frameRects.size() + m_findMatchesCache.size());
+    for (Vector<FindMatch>::const_iterator it = m_findMatchesCache.begin(); it != m_findMatchesCache.end(); ++it) {
+        ASSERT(!it->m_rect.isEmpty());
+        frameRects.append(it->m_rect);
+    }
+}
+
+int WebFrameImpl::selectNearestFindMatch(const WebFloatPoint& point, WebRect* selectionRect)
+{
+    ASSERT(!parent());
+
+    WebFrameImpl* bestFrame = 0;
+    int indexInBestFrame = -1;
+    float distanceInBestFrame = FLT_MAX;
+
+    for (WebFrameImpl* frame = this; frame; frame = toWebFrameImpl(frame->traverseNext(false))) {
+        float distanceInFrame;
+        int indexInFrame = frame->nearestFindMatch(point, distanceInFrame);
+        if (distanceInFrame < distanceInBestFrame) {
+            bestFrame = frame;
+            indexInBestFrame = indexInFrame;
+            distanceInBestFrame = distanceInFrame;
+        }
+    }
+
+    if (indexInBestFrame != -1)
+        return bestFrame->selectFindMatch(static_cast<unsigned>(indexInBestFrame), selectionRect);
+
+    return -1;
+}
+
+int WebFrameImpl::nearestFindMatch(const FloatPoint& point, float& distanceSquared)
+{
+    updateFindMatchRects();
+
+    int nearest = -1;
+    distanceSquared = FLT_MAX;
+    for (size_t i = 0; i < m_findMatchesCache.size(); ++i) {
+        ASSERT(!m_findMatchesCache[i].m_rect.isEmpty());
+        FloatSize offset = point - m_findMatchesCache[i].m_rect.center();
+        float width = offset.width();
+        float height = offset.height();
+        float currentDistanceSquared = width * width + height * height;
+        if (currentDistanceSquared < distanceSquared) {
+            nearest = i;
+            distanceSquared = currentDistanceSquared;
+        }
+    }
+    return nearest;
+}
+
+int WebFrameImpl::selectFindMatch(unsigned index, WebRect* selectionRect)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(index < m_findMatchesCache.size());
+
+    RefPtr<Range> range = m_findMatchesCache[index].m_range;
+    if (!range->boundaryPointsValid() || !range->startContainer()->inDocument())
+        return -1;
+
+    // Check if the match is already selected.
+    WebFrameImpl* activeMatchFrame = viewImpl()->mainFrameImpl()->m_currentActiveMatchFrame;
+    if (this != activeMatchFrame || !m_activeMatch || !areRangesEqual(m_activeMatch.get(), range.get())) {
+        if (isActiveMatchFrameValid())
+            activeMatchFrame->setMarkerActive(activeMatchFrame->m_activeMatch.get(), false);
+
+        m_activeMatchIndexInCurrentFrame = m_findMatchesCache[index].m_ordinal - 1;
+
+        // Set this frame as the active frame (the one with the active highlight).
+        viewImpl()->mainFrameImpl()->m_currentActiveMatchFrame = this;
+        viewImpl()->setFocusedFrame(this);
+
+        m_activeMatch = range.release();
+        setMarkerActive(m_activeMatch.get(), true);
+
+        // Clear any user selection, to make sure Find Next continues on from the match we just activated.
+        frame()->selection().clear();
+
+        // Make sure no node is focused. See http://crbug.com/38700.
+        frame()->document()->setFocusedElement(nullptr);
+    }
+
+    IntRect activeMatchRect;
+    IntRect activeMatchBoundingBox = enclosingIntRect(RenderObject::absoluteBoundingBoxRectForRange(m_activeMatch.get()));
+
+    if (!activeMatchBoundingBox.isEmpty()) {
+        if (m_activeMatch->firstNode() && m_activeMatch->firstNode()->renderer())
+            m_activeMatch->firstNode()->renderer()->scrollRectToVisible(activeMatchBoundingBox,
+                    ScrollAlignment::alignCenterIfNeeded, ScrollAlignment::alignCenterIfNeeded);
+
+        // Zoom to the active match.
+        activeMatchRect = frameView()->contentsToWindow(activeMatchBoundingBox);
+        viewImpl()->zoomToFindInPageRect(activeMatchRect);
+    }
+
+    if (selectionRect)
+        *selectionRect = activeMatchRect;
+
+    return ordinalOfFirstMatchForFrame(this) + m_activeMatchIndexInCurrentFrame + 1;
+}
+
+WebString WebFrameImpl::contentAsText(size_t maxChars) const
+{
+    if (!frame())
+        return WebString();
+    StringBuilder text;
+    frameContentAsPlainText(maxChars, frame(), text);
+    return text.toString();
+}
+
+WebString WebFrameImpl::contentAsMarkup() const
+{
+    if (!frame())
+        return WebString();
+    return createFullMarkup(frame()->document());
+}
+
+WebString WebFrameImpl::renderTreeAsText(RenderAsTextControls toShow) const
+{
+    RenderAsTextBehavior behavior = RenderAsTextBehaviorNormal;
+
+    if (toShow & RenderAsTextDebug)
+        behavior |= RenderAsTextShowCompositedLayers | RenderAsTextShowAddresses | RenderAsTextShowIDAndClass | RenderAsTextShowLayerNesting;
+
+    if (toShow & RenderAsTextPrinting)
+        behavior |= RenderAsTextPrintingMode;
+
+    return externalRepresentation(frame(), behavior);
+}
+
+WebString WebFrameImpl::markerTextForListItem(const WebElement& webElement) const
+{
+    return WebCore::markerTextForListItem(const_cast<Element*>(webElement.constUnwrap<Element>()));
+}
+
+void WebFrameImpl::printPagesWithBoundaries(WebCanvas* canvas, const WebSize& pageSizeInPixels)
+{
+    ASSERT(m_printContext);
+
+    GraphicsContext graphicsContext(canvas);
+    graphicsContext.setPrinting(true);
+
+    m_printContext->spoolAllPagesWithBoundaries(graphicsContext, FloatSize(pageSizeInPixels.width, pageSizeInPixels.height));
+}
+
+WebRect WebFrameImpl::selectionBoundsRect() const
+{
+    return hasSelection() ? WebRect(IntRect(frame()->selection().bounds(false))) : WebRect();
+}
+
+bool WebFrameImpl::selectionStartHasSpellingMarkerFor(int from, int length) const
+{
+    if (!frame())
+        return false;
+    return frame()->spellChecker().selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
+}
+
+WebString WebFrameImpl::layerTreeAsText(bool showDebugInfo) const
+{
+    if (!frame())
+        return WebString();
+
+    return WebString(frame()->layerTreeAsText(showDebugInfo ? LayerTreeIncludesDebugInfo : LayerTreeNormal));
+}
+
+// WebFrameImpl public ---------------------------------------------------------
+
+WebFrame* WebFrame::create(WebFrameClient* client)
+{
+    return WebFrameImpl::create(client);
+}
+
+WebFrameImpl* WebFrameImpl::create(WebFrameClient* client)
+{
+    return adoptRef(new WebFrameImpl(client)).leakRef();
+}
+
+WebFrameImpl::WebFrameImpl(WebFrameClient* client)
+    : m_frameLoaderClientImpl(this)
+    , m_parent(0)
+    , m_previousSibling(0)
+    , m_nextSibling(0)
+    , m_firstChild(0)
+    , m_lastChild(0)
+    , m_opener(0)
+    , m_client(client)
+    , m_permissionClient(0)
+    , m_currentActiveMatchFrame(0)
+    , m_activeMatchIndexInCurrentFrame(-1)
+    , m_locatingActiveRect(false)
+    , m_resumeScopingFromRange(nullptr)
+    , m_lastMatchCount(-1)
+    , m_totalMatchCount(-1)
+    , m_framesScopingCount(-1)
+    , m_findRequestIdentifier(-1)
+    , m_scopingInProgress(false)
+    , m_lastFindRequestCompletedWithNoMatches(false)
+    , m_nextInvalidateAfter(0)
+    , m_findMatchMarkersVersion(0)
+    , m_findMatchRectsAreValid(false)
+    , m_inputEventsScaleFactorForEmulation(1)
+{
+    blink::Platform::current()->incrementStatsCounter(webFrameActiveCount);
+    frameCount++;
+}
+
+WebFrameImpl::~WebFrameImpl()
+{
+    HashSet<WebFrameImpl*>::iterator end = m_openedFrames.end();
+    for (HashSet<WebFrameImpl*>::iterator it = m_openedFrames.begin(); it != end; ++it)
+        (*it)->m_opener = 0;
+
+    blink::Platform::current()->decrementStatsCounter(webFrameActiveCount);
+    frameCount--;
+
+    cancelPendingScopingEffort();
+}
+
+void WebFrameImpl::setWebCoreFrame(PassRefPtr<WebCore::LocalFrame> frame)
+{
+    m_frame = frame;
+}
+
+void WebFrameImpl::initializeAsMainFrame(WebCore::Page* page)
+{
+    setWebCoreFrame(LocalFrame::create(&m_frameLoaderClientImpl, &page->frameHost(), 0));
+
+    // We must call init() after m_frame is assigned because it is referenced
+    // during init().
+    m_frame->init();
+}
+
+PassRefPtr<LocalFrame> WebFrameImpl::createChildFrame(const FrameLoadRequest& request, HTMLFrameOwnerElement* ownerElement)
+{
+    ASSERT(m_client);
+    WebFrameImpl* webframe = toWebFrameImpl(m_client->createChildFrame(this, request.frameName()));
+    if (!webframe)
+        return nullptr;
+
+    RefPtr<LocalFrame> childFrame = LocalFrame::create(&webframe->m_frameLoaderClientImpl, frame()->host(), ownerElement);
+    webframe->setWebCoreFrame(childFrame);
+
+    childFrame->tree().setName(request.frameName());
+
+    // FIXME: This comment is not quite accurate anymore.
+    // LocalFrame::init() can trigger onload event in the parent frame,
+    // which may detach this frame and trigger a null-pointer access
+    // in FrameTree::removeChild. Move init() after appendChild call
+    // so that webframe->mFrame is in the tree before triggering
+    // onload event handler.
+    // Because the event handler may set webframe->mFrame to null,
+    // it is necessary to check the value after calling init() and
+    // return without loading URL.
+    // NOTE: m_client will be null if this frame has been detached.
+    // (b:791612)
+    childFrame->init(); // create an empty document
+    if (!childFrame->tree().parent())
+        return nullptr;
+
+    // If we're moving in the back/forward list, we might want to replace the content
+    // of this child frame with whatever was there at that point.
+    HistoryItem* childItem = 0;
+    if (isBackForwardLoadType(frame()->loader().loadType()) && !frame()->document()->loadEventFinished())
+        childItem = frame()->page()->historyController().itemForNewChildFrame(childFrame.get());
+
+    if (childItem)
+        childFrame->loader().loadHistoryItem(childItem);
+    else
+        childFrame->loader().load(FrameLoadRequest(0, request.resourceRequest(), "_self"));
+
+    // A synchronous navigation (about:blank) would have already processed
+    // onload, so it is possible for the frame to have already been destroyed by
+    // script in the page.
+    // NOTE: m_client will be null if this frame has been detached.
+    if (!childFrame->tree().parent())
+        return nullptr;
+
+    return childFrame.release();
+}
+
+void WebFrameImpl::didChangeContentsSize(const IntSize& size)
+{
+    // This is only possible on the main frame.
+    if (m_totalMatchCount > 0) {
+        ASSERT(!parent());
+        ++m_findMatchMarkersVersion;
+    }
+}
+
+void WebFrameImpl::createFrameView()
+{
+    TRACE_EVENT0("webkit", "WebFrameImpl::createFrameView");
+
+    ASSERT(frame()); // If frame() doesn't exist, we probably didn't init properly.
+
+    WebViewImpl* webView = viewImpl();
+    bool isMainFrame = webView->mainFrameImpl()->frame() == frame();
+    if (isMainFrame)
+        webView->suppressInvalidations(true);
+
+    frame()->createView(webView->size(), webView->baseBackgroundColor(), webView->isTransparent());
+    if (webView->shouldAutoResize() && isMainFrame)
+        frame()->view()->enableAutoSizeMode(true, webView->minAutoSize(), webView->maxAutoSize());
+
+    frame()->view()->setInputEventsTransformForEmulation(m_inputEventsOffsetForEmulation, m_inputEventsScaleFactorForEmulation);
+
+    if (isMainFrame)
+        webView->suppressInvalidations(false);
+}
+
+WebFrameImpl* WebFrameImpl::fromFrame(LocalFrame* frame)
+{
+    if (!frame)
+        return 0;
+    return toFrameLoaderClientImpl(frame->loader().client())->webFrame();
+}
+
+WebFrameImpl* WebFrameImpl::fromFrameOwnerElement(Element* element)
+{
+    // FIXME: Why do we check specifically for <iframe> and <frame> here? Why can't we get the WebFrameImpl from an <object> element, for example.
+    if (!element || !element->isFrameOwnerElement() || (!isHTMLIFrameElement(*element) && !isHTMLFrameElement(*element)))
+        return 0;
+    return fromFrame(toHTMLFrameOwnerElement(element)->contentFrame());
+}
+
+WebViewImpl* WebFrameImpl::viewImpl() const
+{
+    if (!frame())
+        return 0;
+    return WebViewImpl::fromPage(frame()->page());
+}
+
+WebDataSourceImpl* WebFrameImpl::dataSourceImpl() const
+{
+    return static_cast<WebDataSourceImpl*>(dataSource());
+}
+
+WebDataSourceImpl* WebFrameImpl::provisionalDataSourceImpl() const
+{
+    return static_cast<WebDataSourceImpl*>(provisionalDataSource());
+}
+
+void WebFrameImpl::setFindEndstateFocusAndSelection()
+{
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+
+    if (this == mainFrameImpl->activeMatchFrame() && m_activeMatch.get()) {
+        // If the user has set the selection since the match was found, we
+        // don't focus anything.
+        VisibleSelection selection(frame()->selection().selection());
+        if (!selection.isNone())
+            return;
+
+        // Try to find the first focusable node up the chain, which will, for
+        // example, focus links if we have found text within the link.
+        Node* node = m_activeMatch->firstNode();
+        if (node && node->isInShadowTree()) {
+            Node* host = node->deprecatedShadowAncestorNode();
+            ASSERT(host);
+            if (isHTMLInputElement(*host) || isHTMLTextAreaElement(*host))
+                node = host;
+        }
+        for (; node; node = node->parentNode()) {
+            if (!node->isElementNode())
+                continue;
+            Element* element = toElement(node);
+            if (element->isFocusable()) {
+                // Found a focusable parent node. Set the active match as the
+                // selection and focus to the focusable node.
+                frame()->selection().setSelection(m_activeMatch.get());
+                frame()->document()->setFocusedElement(element);
+                return;
+            }
+        }
+
+        // Iterate over all the nodes in the range until we find a focusable node.
+        // This, for example, sets focus to the first link if you search for
+        // text and text that is within one or more links.
+        node = m_activeMatch->firstNode();
+        for (; node && node != m_activeMatch->pastLastNode(); node = NodeTraversal::next(*node)) {
+            if (!node->isElementNode())
+                continue;
+            Element* element = toElement(node);
+            if (element->isFocusable()) {
+                frame()->document()->setFocusedElement(element);
+                return;
+            }
+        }
+
+        // No node related to the active match was focusable, so set the
+        // active match as the selection (so that when you end the Find session,
+        // you'll have the last thing you found highlighted) and make sure that
+        // we have nothing focused (otherwise you might have text selected but
+        // a link focused, which is weird).
+        frame()->selection().setSelection(m_activeMatch.get());
+        frame()->document()->setFocusedElement(nullptr);
+
+        // Finally clear the active match, for two reasons:
+        // We just finished the find 'session' and we don't want future (potentially
+        // unrelated) find 'sessions' operations to start at the same place.
+        // The WebFrameImpl could get reused and the m_activeMatch could end up pointing
+        // to a document that is no longer valid. Keeping an invalid reference around
+        // is just asking for trouble.
+        m_activeMatch = nullptr;
+    }
+}
+
+void WebFrameImpl::didFail(const ResourceError& error, bool wasProvisional)
+{
+    if (!client())
+        return;
+    WebURLError webError = error;
+    if (wasProvisional)
+        client()->didFailProvisionalLoad(this, webError);
+    else
+        client()->didFailLoad(this, webError);
+}
+
+void WebFrameImpl::setCanHaveScrollbars(bool canHaveScrollbars)
+{
+    frame()->view()->setCanHaveScrollbars(canHaveScrollbars);
+}
+
+void WebFrameImpl::setInputEventsTransformForEmulation(const IntSize& offset, float contentScaleFactor)
+{
+    m_inputEventsOffsetForEmulation = offset;
+    m_inputEventsScaleFactorForEmulation = contentScaleFactor;
+    if (frame()->view())
+        frame()->view()->setInputEventsTransformForEmulation(m_inputEventsOffsetForEmulation, m_inputEventsScaleFactorForEmulation);
+}
+
+void WebFrameImpl::invalidateArea(AreaToInvalidate area)
+{
+    ASSERT(frame() && frame()->view());
+    FrameView* view = frame()->view();
+
+    if ((area & InvalidateAll) == InvalidateAll)
+        view->invalidateRect(view->frameRect());
+    else {
+        if ((area & InvalidateContentArea) == InvalidateContentArea) {
+            IntRect contentArea(
+                view->x(), view->y(), view->visibleWidth(), view->visibleHeight());
+            IntRect frameRect = view->frameRect();
+            contentArea.move(-frameRect.x(), -frameRect.y());
+            view->invalidateRect(contentArea);
+        }
+    }
+
+    if ((area & InvalidateScrollbar) == InvalidateScrollbar) {
+        // Invalidate the vertical scroll bar region for the view.
+        Scrollbar* scrollbar = view->verticalScrollbar();
+        if (scrollbar)
+            scrollbar->invalidate();
+    }
+}
+
+void WebFrameImpl::addMarker(Range* range, bool activeMatch)
+{
+    frame()->document()->markers().addTextMatchMarker(range, activeMatch);
+}
+
+void WebFrameImpl::setMarkerActive(Range* range, bool active)
+{
+    if (!range || range->collapsed(IGNORE_EXCEPTION))
+        return;
+    frame()->document()->markers().setMarkersActive(range, active);
+}
+
+int WebFrameImpl::ordinalOfFirstMatchForFrame(WebFrameImpl* frame) const
+{
+    int ordinal = 0;
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+    // Iterate from the main frame up to (but not including) |frame| and
+    // add up the number of matches found so far.
+    for (WebFrameImpl* it = mainFrameImpl; it != frame; it = toWebFrameImpl(it->traverseNext(true))) {
+        if (it->m_lastMatchCount > 0)
+            ordinal += it->m_lastMatchCount;
+    }
+    return ordinal;
+}
+
+bool WebFrameImpl::shouldScopeMatches(const String& searchText)
+{
+    // Don't scope if we can't find a frame or a view.
+    // The user may have closed the tab/application, so abort.
+    // Also ignore detached frames, as many find operations report to the main frame.
+    if (!frame() || !frame()->view() || !frame()->page() || !hasVisibleContent())
+        return false;
+
+    ASSERT(frame()->document() && frame()->view());
+
+    // If the frame completed the scoping operation and found 0 matches the last
+    // time it was searched, then we don't have to search it again if the user is
+    // just adding to the search string or sending the same search string again.
+    if (m_lastFindRequestCompletedWithNoMatches && !m_lastSearchString.isEmpty()) {
+        // Check to see if the search string prefixes match.
+        String previousSearchPrefix =
+            searchText.substring(0, m_lastSearchString.length());
+
+        if (previousSearchPrefix == m_lastSearchString)
+            return false; // Don't search this frame, it will be fruitless.
+    }
+
+    return true;
+}
+
+void WebFrameImpl::scopeStringMatchesSoon(int identifier, const WebString& searchText, const WebFindOptions& options, bool reset)
+{
+    m_deferredScopingWork.append(new DeferredScopeStringMatches(this, identifier, searchText, options, reset));
+}
+
+void WebFrameImpl::callScopeStringMatches(DeferredScopeStringMatches* caller, int identifier, const WebString& searchText, const WebFindOptions& options, bool reset)
+{
+    m_deferredScopingWork.remove(m_deferredScopingWork.find(caller));
+    scopeStringMatches(identifier, searchText, options, reset);
+
+    // This needs to happen last since searchText is passed by reference.
+    delete caller;
+}
+
+void WebFrameImpl::invalidateIfNecessary()
+{
+    if (m_lastMatchCount <= m_nextInvalidateAfter)
+        return;
+
+    // FIXME: (http://b/1088165) Optimize the drawing of the tickmarks and
+    // remove this. This calculation sets a milestone for when next to
+    // invalidate the scrollbar and the content area. We do this so that we
+    // don't spend too much time drawing the scrollbar over and over again.
+    // Basically, up until the first 500 matches there is no throttle.
+    // After the first 500 matches, we set set the milestone further and
+    // further out (750, 1125, 1688, 2K, 3K).
+    static const int startSlowingDownAfter = 500;
+    static const int slowdown = 750;
+
+    int i = m_lastMatchCount / startSlowingDownAfter;
+    m_nextInvalidateAfter += i * slowdown;
+    invalidateArea(InvalidateScrollbar);
+}
+
+void WebFrameImpl::loadJavaScriptURL(const KURL& url)
+{
+    // This is copied from ScriptController::executeScriptIfJavaScriptURL.
+    // Unfortunately, we cannot just use that method since it is private, and
+    // it also doesn't quite behave as we require it to for bookmarklets.  The
+    // key difference is that we need to suppress loading the string result
+    // from evaluating the JS URL if executing the JS URL resulted in a
+    // location change.  We also allow a JS URL to be loaded even if scripts on
+    // the page are otherwise disabled.
+
+    if (!frame()->document() || !frame()->page())
+        return;
+
+    RefPtr<Document> ownerDocument(frame()->document());
+
+    // Protect privileged pages against bookmarklets and other javascript manipulations.
+    if (SchemeRegistry::shouldTreatURLSchemeAsNotAllowingJavascriptURLs(frame()->document()->url().protocol()))
+        return;
+
+    String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingNewUserGesture);
+    ScriptValue result = frame()->script().executeScriptInMainWorldAndReturnValue(ScriptSourceCode(script));
+
+    String scriptResult;
+    if (!result.getString(scriptResult))
+        return;
+
+    if (!frame()->navigationScheduler().locationChangePending())
+        frame()->document()->loader()->replaceDocument(scriptResult, ownerDocument.get());
+}
+
+void WebFrameImpl::willDetachParent()
+{
+    // Do not expect string scoping results from any frames that got detached
+    // in the middle of the operation.
+    if (m_scopingInProgress) {
+
+        // There is a possibility that the frame being detached was the only
+        // pending one. We need to make sure final replies can be sent.
+        flushCurrentScopingEffort(m_findRequestIdentifier);
+
+        cancelPendingScopingEffort();
+    }
+}
+
+} // namespace blink
diff --git a/Source/web/TextFinder.h b/Source/web/TextFinder.h
new file mode 100644
index 0000000..f1d573f
--- /dev/null
+++ b/Source/web/TextFinder.h
@@ -0,0 +1,518 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextFinder_h
+#define TextFinder_h
+
+#include "WebFrame.h"
+
+#include "FrameLoaderClientImpl.h"
+#include "core/frame/LocalFrame.h"
+#include "platform/geometry/FloatRect.h"
+#include "public/platform/WebFileSystemType.h"
+#include "wtf/Compiler.h"
+#include "wtf/HashSet.h"
+#include "wtf/OwnPtr.h"
+#include "wtf/RefCounted.h"
+#include "wtf/text/WTFString.h"
+
+namespace WebCore {
+class GraphicsContext;
+class HTMLInputElement;
+class HistoryItem;
+class IntSize;
+class KURL;
+class Node;
+class Range;
+class SubstituteData;
+struct FrameLoadRequest;
+struct WindowFeatures;
+}
+
+namespace blink {
+class ChromePrintContext;
+class SharedWorkerRepositoryClientImpl;
+class WebDataSourceImpl;
+class WebInputElement;
+class WebFrameClient;
+class WebPerformance;
+class WebPluginContainerImpl;
+class WebView;
+class WebViewImpl;
+struct WebPrintParams;
+
+template <typename T> class WebVector;
+
+// Implementation of WebFrame, note that this is a reference counted object.
+class WebFrameImpl FINAL
+    : public WebFrame
+    , public RefCounted<WebFrameImpl> {
+public:
+    // WebFrame methods:
+    virtual void close() OVERRIDE;
+    virtual WebString uniqueName() const OVERRIDE;
+    virtual WebString assignedName() const OVERRIDE;
+    virtual void setName(const WebString&) OVERRIDE;
+    virtual WebVector<WebIconURL> iconURLs(int iconTypesMask) const OVERRIDE;
+    virtual void setIsRemote(bool) OVERRIDE;
+    virtual void setRemoteWebLayer(WebLayer*) OVERRIDE;
+    virtual void setPermissionClient(WebPermissionClient*) OVERRIDE;
+    virtual void setSharedWorkerRepositoryClient(WebSharedWorkerRepositoryClient*) OVERRIDE;
+    virtual WebSize scrollOffset() const OVERRIDE;
+    virtual void setScrollOffset(const WebSize&) OVERRIDE;
+    virtual WebSize minimumScrollOffset() const OVERRIDE;
+    virtual WebSize maximumScrollOffset() const OVERRIDE;
+    virtual WebSize contentsSize() const OVERRIDE;
+    virtual bool hasVisibleContent() const OVERRIDE;
+    virtual WebRect visibleContentRect() const OVERRIDE;
+    virtual bool hasHorizontalScrollbar() const OVERRIDE;
+    virtual bool hasVerticalScrollbar() const OVERRIDE;
+    virtual WebView* view() const OVERRIDE;
+    virtual WebFrame* opener() const OVERRIDE;
+    virtual void setOpener(WebFrame*) OVERRIDE;
+    virtual void appendChild(WebFrame*) OVERRIDE;
+    virtual void removeChild(WebFrame*) OVERRIDE;
+    virtual WebFrame* parent() const OVERRIDE;
+    virtual WebFrame* top() const OVERRIDE;
+    virtual WebFrame* previousSibling() const OVERRIDE;
+    virtual WebFrame* nextSibling() const OVERRIDE;
+    virtual WebFrame* firstChild() const OVERRIDE;
+    virtual WebFrame* lastChild() const OVERRIDE;
+    virtual WebFrame* traversePrevious(bool wrap) const OVERRIDE;
+    virtual WebFrame* traverseNext(bool wrap) const OVERRIDE;
+    virtual WebFrame* findChildByName(const WebString&) const OVERRIDE;
+    virtual WebFrame* findChildByExpression(const WebString&) const OVERRIDE;
+    virtual WebDocument document() const OVERRIDE;
+    virtual WebPerformance performance() const OVERRIDE;
+    virtual NPObject* windowObject() const OVERRIDE;
+    virtual void bindToWindowObject(const WebString& name, NPObject*) OVERRIDE;
+    virtual void bindToWindowObject(const WebString& name, NPObject*, void*) OVERRIDE;
+    virtual void executeScript(const WebScriptSource&) OVERRIDE;
+    virtual void executeScriptInIsolatedWorld(
+        int worldID, const WebScriptSource* sources, unsigned numSources,
+        int extensionGroup) OVERRIDE;
+    virtual void setIsolatedWorldSecurityOrigin(int worldID, const WebSecurityOrigin&) OVERRIDE;
+    virtual void setIsolatedWorldContentSecurityPolicy(int worldID, const WebString&) OVERRIDE;
+    virtual void addMessageToConsole(const WebConsoleMessage&) OVERRIDE;
+    virtual void collectGarbage() OVERRIDE;
+    virtual bool checkIfRunInsecureContent(const WebURL&) const OVERRIDE;
+    virtual v8::Handle<v8::Value> executeScriptAndReturnValue(
+        const WebScriptSource&) OVERRIDE;
+    virtual void executeScriptInIsolatedWorld(
+        int worldID, const WebScriptSource* sourcesIn, unsigned numSources,
+        int extensionGroup, WebVector<v8::Local<v8::Value> >* results) OVERRIDE;
+    virtual v8::Handle<v8::Value> callFunctionEvenIfScriptDisabled(
+        v8::Handle<v8::Function>,
+        v8::Handle<v8::Value>,
+        int argc,
+        v8::Handle<v8::Value> argv[]) OVERRIDE;
+    virtual v8::Local<v8::Context> mainWorldScriptContext() const OVERRIDE;
+    virtual void reload(bool ignoreCache) OVERRIDE;
+    virtual void reloadWithOverrideURL(const WebURL& overrideUrl, bool ignoreCache) OVERRIDE;
+    virtual void loadRequest(const WebURLRequest&) OVERRIDE;
+    virtual void loadHistoryItem(const WebHistoryItem&, WebURLRequest::CachePolicy) OVERRIDE;
+    virtual void loadData(
+        const WebData&, const WebString& mimeType, const WebString& textEncoding,
+        const WebURL& baseURL, const WebURL& unreachableURL, bool replace) OVERRIDE;
+    virtual void loadHTMLString(
+        const WebData& html, const WebURL& baseURL, const WebURL& unreachableURL,
+        bool replace) OVERRIDE;
+    virtual bool isLoading() const OVERRIDE;
+    virtual void stopLoading() OVERRIDE;
+    virtual WebDataSource* provisionalDataSource() const OVERRIDE;
+    virtual WebDataSource* dataSource() const OVERRIDE;
+    virtual WebHistoryItem previousHistoryItem() const OVERRIDE;
+    virtual WebHistoryItem currentHistoryItem() const OVERRIDE;
+    virtual void enableViewSourceMode(bool enable) OVERRIDE;
+    virtual bool isViewSourceModeEnabled() const OVERRIDE;
+    virtual void setReferrerForRequest(WebURLRequest&, const WebURL& referrer) OVERRIDE;
+    virtual void dispatchWillSendRequest(WebURLRequest&) OVERRIDE;
+    virtual WebURLLoader* createAssociatedURLLoader(const WebURLLoaderOptions&) OVERRIDE;
+    virtual unsigned unloadListenerCount() const OVERRIDE;
+    virtual void replaceSelection(const WebString&) OVERRIDE;
+    virtual void insertText(const WebString&) OVERRIDE;
+    virtual void setMarkedText(const WebString&, unsigned location, unsigned length) OVERRIDE;
+    virtual void unmarkText() OVERRIDE;
+    virtual bool hasMarkedText() const OVERRIDE;
+    virtual WebRange markedRange() const OVERRIDE;
+    virtual bool firstRectForCharacterRange(unsigned location, unsigned length, WebRect&) const OVERRIDE;
+    virtual size_t characterIndexForPoint(const WebPoint&) const OVERRIDE;
+    virtual bool executeCommand(const WebString&, const WebNode& = WebNode()) OVERRIDE;
+    virtual bool executeCommand(const WebString&, const WebString& value, const WebNode& = WebNode()) OVERRIDE;
+    virtual bool isCommandEnabled(const WebString&) const OVERRIDE;
+    virtual void enableContinuousSpellChecking(bool) OVERRIDE;
+    virtual bool isContinuousSpellCheckingEnabled() const OVERRIDE;
+    virtual void requestTextChecking(const WebElement&) OVERRIDE;
+    virtual void replaceMisspelledRange(const WebString&) OVERRIDE;
+    virtual void removeSpellingMarkers() OVERRIDE;
+    virtual bool hasSelection() const OVERRIDE;
+    virtual WebRange selectionRange() const OVERRIDE;
+    virtual WebString selectionAsText() const OVERRIDE;
+    virtual WebString selectionAsMarkup() const OVERRIDE;
+    virtual bool selectWordAroundCaret() OVERRIDE;
+    virtual void selectRange(const WebPoint& base, const WebPoint& extent) OVERRIDE;
+    virtual void selectRange(const WebRange&) OVERRIDE;
+    virtual void moveRangeSelection(const WebPoint& base, const WebPoint& extent) OVERRIDE;
+    virtual void moveCaretSelection(const WebPoint&) OVERRIDE;
+    virtual void setCaretVisible(bool) OVERRIDE;
+    virtual int printBegin(const WebPrintParams&, const WebNode& constrainToNode) OVERRIDE;
+    virtual float printPage(int pageToPrint, WebCanvas*) OVERRIDE;
+    virtual float getPrintPageShrink(int page) OVERRIDE;
+    virtual void printEnd() OVERRIDE;
+    virtual bool isPrintScalingDisabledForPlugin(const WebNode&) OVERRIDE;
+    virtual bool hasCustomPageSizeStyle(int pageIndex) OVERRIDE;
+    virtual bool isPageBoxVisible(int pageIndex) OVERRIDE;
+    virtual void pageSizeAndMarginsInPixels(int pageIndex,
+                                            WebSize& pageSize,
+                                            int& marginTop,
+                                            int& marginRight,
+                                            int& marginBottom,
+                                            int& marginLeft) OVERRIDE;
+    virtual WebString pageProperty(const WebString& propertyName, int pageIndex) OVERRIDE;
+    virtual void printPagesWithBoundaries(WebCanvas*, const WebSize&) OVERRIDE;
+    virtual bool find(
+        int identifier, const WebString& searchText, const WebFindOptions&,
+        bool wrapWithinFrame, WebRect* selectionRect) OVERRIDE;
+    virtual void stopFinding(bool clearSelection) OVERRIDE;
+    virtual void scopeStringMatches(
+        int identifier, const WebString& searchText, const WebFindOptions&,
+        bool reset) OVERRIDE;
+    virtual void cancelPendingScopingEffort() OVERRIDE;
+    virtual void increaseMatchCount(int count, int identifier) OVERRIDE;
+    virtual void resetMatchCount() OVERRIDE;
+    virtual int findMatchMarkersVersion() const OVERRIDE;
+    virtual WebFloatRect activeFindMatchRect() OVERRIDE;
+    virtual void findMatchRects(WebVector<WebFloatRect>&) OVERRIDE;
+    virtual int selectNearestFindMatch(const WebFloatPoint&, WebRect* selectionRect) OVERRIDE;
+
+    virtual void sendOrientationChangeEvent(int orientation) OVERRIDE;
+
+    virtual void dispatchMessageEventWithOriginCheck(
+        const WebSecurityOrigin& intendedTargetOrigin,
+        const WebDOMEvent&) OVERRIDE;
+
+    virtual WebString contentAsText(size_t maxChars) const OVERRIDE;
+    virtual WebString contentAsMarkup() const OVERRIDE;
+    virtual WebString renderTreeAsText(RenderAsTextControls toShow = RenderAsTextNormal) const OVERRIDE;
+    virtual WebString markerTextForListItem(const WebElement&) const OVERRIDE;
+    virtual WebRect selectionBoundsRect() const OVERRIDE;
+
+    virtual bool selectionStartHasSpellingMarkerFor(int from, int length) const OVERRIDE;
+    virtual WebString layerTreeAsText(bool showDebugInfo = false) const OVERRIDE;
+
+    void willDetachParent();
+
+    static WebFrameImpl* create(WebFrameClient*);
+    virtual ~WebFrameImpl();
+
+    // Called by the WebViewImpl to initialize the main frame for the page.
+    void initializeAsMainFrame(WebCore::Page*);
+
+    PassRefPtr<WebCore::LocalFrame> createChildFrame(
+        const WebCore::FrameLoadRequest&, WebCore::HTMLFrameOwnerElement*);
+
+    void didChangeContentsSize(const WebCore::IntSize&);
+
+    void createFrameView();
+
+    static WebFrameImpl* fromFrame(WebCore::LocalFrame* frame);
+    static WebFrameImpl* fromFrameOwnerElement(WebCore::Element* element);
+
+    // If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
+    // that hosts the plugin.
+    static WebPluginContainerImpl* pluginContainerFromFrame(WebCore::LocalFrame*);
+
+    // If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
+    // that hosts the plugin. If the provided node is a plugin, then it runs its
+    // WebPluginContainerImpl.
+    static WebPluginContainerImpl* pluginContainerFromNode(WebCore::LocalFrame*, const WebNode&);
+
+    WebViewImpl* viewImpl() const;
+
+    WebCore::FrameView* frameView() const { return frame() ? frame()->view() : 0; }
+
+    // Getters for the impls corresponding to Get(Provisional)DataSource. They
+    // may return 0 if there is no corresponding data source.
+    WebDataSourceImpl* dataSourceImpl() const;
+    WebDataSourceImpl* provisionalDataSourceImpl() const;
+
+    // Returns which frame has an active match. This function should only be
+    // called on the main frame, as it is the only frame keeping track. Returned
+    // value can be 0 if no frame has an active match.
+    WebFrameImpl* activeMatchFrame() const { return m_currentActiveMatchFrame; }
+
+    // Returns the active match in the current frame. Could be a null range if
+    // the local frame has no active match.
+    WebCore::Range* activeMatch() const { return m_activeMatch.get(); }
+
+    // When a Find operation ends, we want to set the selection to what was active
+    // and set focus to the first focusable node we find (starting with the first
+    // node in the matched range and going up the inheritance chain). If we find
+    // nothing to focus we focus the first focusable node in the range. This
+    // allows us to set focus to a link (when we find text inside a link), which
+    // allows us to navigate by pressing Enter after closing the Find box.
+    void setFindEndstateFocusAndSelection();
+
+    void didFail(const WebCore::ResourceError&, bool wasProvisional);
+
+    // Sets whether the WebFrameImpl allows its document to be scrolled.
+    // If the parameter is true, allow the document to be scrolled.
+    // Otherwise, disallow scrolling.
+    virtual void setCanHaveScrollbars(bool) OVERRIDE;
+
+    WebCore::LocalFrame* frame() const { return m_frame.get(); }
+    WebFrameClient* client() const { return m_client; }
+    void setClient(WebFrameClient* client) { m_client = client; }
+
+    WebPermissionClient* permissionClient() { return m_permissionClient; }
+    SharedWorkerRepositoryClientImpl* sharedWorkerRepositoryClient() const { return m_sharedWorkerRepositoryClient.get(); }
+
+    void setInputEventsTransformForEmulation(const WebCore::IntSize&, float);
+
+    static void selectWordAroundPosition(WebCore::LocalFrame*, WebCore::VisiblePosition);
+
+private:
+    class DeferredScopeStringMatches;
+    friend class DeferredScopeStringMatches;
+    friend class FrameLoaderClientImpl;
+
+    struct FindMatch {
+        RefPtr<WebCore::Range> m_range;
+
+        // 1-based index within this frame.
+        int m_ordinal;
+
+        // In find-in-page coordinates.
+        // Lazily calculated by updateFindMatchRects.
+        WebCore::FloatRect m_rect;
+
+        FindMatch(PassRefPtr<WebCore::Range>, int ordinal);
+    };
+
+    // A bit mask specifying area of the frame to invalidate.
+    enum AreaToInvalidate {
+      InvalidateNothing,
+      InvalidateContentArea,
+      InvalidateScrollbar,   // Vertical scrollbar only.
+      InvalidateAll          // Both content area and the scrollbar.
+    };
+
+    explicit WebFrameImpl(WebFrameClient*);
+
+    // Sets the local WebCore frame and registers destruction observers.
+    void setWebCoreFrame(PassRefPtr<WebCore::LocalFrame>);
+
+    // Notifies the delegate about a new selection rect.
+    void reportFindInPageSelection(
+        const WebRect& selectionRect, int activeMatchOrdinal, int identifier);
+
+    // Clear the find-in-page matches cache forcing rects to be fully
+    // calculated again next time updateFindMatchRects is called.
+    void clearFindMatchesCache();
+
+    // Check if the activeMatchFrame still exists in the frame tree.
+    bool isActiveMatchFrameValid() const;
+
+    // Return the index in the find-in-page cache of the match closest to the
+    // provided point in find-in-page coordinates, or -1 in case of error.
+    // The squared distance to the closest match is returned in the distanceSquared parameter.
+    int nearestFindMatch(const WebCore::FloatPoint&, float& distanceSquared);
+
+    // Select a find-in-page match marker in the current frame using a cache
+    // match index returned by nearestFindMatch. Returns the ordinal of the new
+    // selected match or -1 in case of error. Also provides the bounding box of
+    // the marker in window coordinates if selectionRect is not null.
+    int selectFindMatch(unsigned index, WebRect* selectionRect);
+
+    // Compute and cache the rects for FindMatches if required.
+    // Rects are automatically invalidated in case of content size changes,
+    // propagating the invalidation to child frames.
+    void updateFindMatchRects();
+
+    // Append the find-in-page match rects of the current frame to the provided vector.
+    void appendFindMatchRects(Vector<WebFloatRect>& frameRects);
+
+    // Invalidates a certain area within the frame.
+    void invalidateArea(AreaToInvalidate);
+
+    // Add a WebKit TextMatch-highlight marker to nodes in a range.
+    void addMarker(WebCore::Range*, bool activeMatch);
+
+    // Sets the markers within a range as active or inactive.
+    void setMarkerActive(WebCore::Range*, bool active);
+
+    // Returns the ordinal of the first match in the frame specified. This
+    // function enumerates the frames, starting with the main frame and up to (but
+    // not including) the frame passed in as a parameter and counts how many
+    // matches have been found.
+    int ordinalOfFirstMatchForFrame(WebFrameImpl*) const;
+
+    // Determines whether the scoping effort is required for a particular frame.
+    // It is not necessary if the frame is invisible, for example, or if this
+    // is a repeat search that already returned nothing last time the same prefix
+    // was searched.
+    bool shouldScopeMatches(const WTF::String& searchText);
+
+    // Removes the current frame from the global scoping effort and triggers any
+    // updates if appropriate. This method does not mark the scoping operation
+    // as finished.
+    void flushCurrentScopingEffort(int identifier);
+
+    // Finishes the current scoping effort and triggers any updates if appropriate.
+    void finishCurrentScopingEffort(int identifier);
+
+    // Queue up a deferred call to scopeStringMatches.
+    void scopeStringMatchesSoon(
+        int identifier, const WebString& searchText, const WebFindOptions&,
+        bool reset);
+
+    // Called by a DeferredScopeStringMatches instance.
+    void callScopeStringMatches(
+        DeferredScopeStringMatches*, int identifier, const WebString& searchText,
+        const WebFindOptions&, bool reset);
+
+    // Determines whether to invalidate the content area and scrollbar.
+    void invalidateIfNecessary();
+
+    void loadJavaScriptURL(const WebCore::KURL&);
+
+    // Returns a hit-tested VisiblePosition for the given point
+    WebCore::VisiblePosition visiblePositionForWindowPoint(const WebPoint&);
+
+    FrameLoaderClientImpl m_frameLoaderClientImpl;
+
+    // The embedder retains a reference to the WebCore LocalFrame while it is active in the DOM. This
+    // reference is released when the frame is removed from the DOM or the entire page is closed.
+    // FIXME: These will need to change to WebFrame when we introduce WebFrameProxy.
+    RefPtr<WebCore::LocalFrame> m_frame;
+    WebFrameImpl* m_parent;
+    WebFrameImpl* m_previousSibling;
+    WebFrameImpl* m_nextSibling;
+    WebFrameImpl* m_firstChild;
+    WebFrameImpl* m_lastChild;
+
+    WebFrameImpl* m_opener;
+    WTF::HashSet<WebFrameImpl*> m_openedFrames;
+
+    // Indicate whether the current LocalFrame is local or remote. Remote frames are
+    // rendered in a different process from their parent frames.
+    bool m_isRemote;
+
+    WebFrameClient* m_client;
+    WebPermissionClient* m_permissionClient;
+    OwnPtr<SharedWorkerRepositoryClientImpl> m_sharedWorkerRepositoryClient;
+
+    // A way for the main frame to keep track of which frame has an active
+    // match. Should be 0 for all other frames.
+    WebFrameImpl* m_currentActiveMatchFrame;
+
+    // The range of the active match for the current frame.
+    RefPtr<WebCore::Range> m_activeMatch;
+
+    // The index of the active match for the current frame.
+    int m_activeMatchIndexInCurrentFrame;
+
+    // This flag is used by the scoping effort to determine if we need to figure
+    // out which rectangle is the active match. Once we find the active
+    // rectangle we clear this flag.
+    bool m_locatingActiveRect;
+
+    // The scoping effort can time out and we need to keep track of where we
+    // ended our last search so we can continue from where we left of.
+    RefPtr<WebCore::Range> m_resumeScopingFromRange;
+
+    // Keeps track of the last string this frame searched for. This is used for
+    // short-circuiting searches in the following scenarios: When a frame has
+    // been searched and returned 0 results, we don't need to search that frame
+    // again if the user is just adding to the search (making it more specific).
+    WTF::String m_lastSearchString;
+
+    // Keeps track of how many matches this frame has found so far, so that we
+    // don't loose count between scoping efforts, and is also used (in conjunction
+    // with m_lastSearchString) to figure out if we need to search the frame again.
+    int m_lastMatchCount;
+
+    // This variable keeps a cumulative total of matches found so far for ALL the
+    // frames on the page, and is only incremented by calling IncreaseMatchCount
+    // (on the main frame only). It should be -1 for all other frames.
+    int m_totalMatchCount;
+
+    // This variable keeps a cumulative total of how many frames are currently
+    // scoping, and is incremented/decremented on the main frame only.
+    // It should be -1 for all other frames.
+    int m_framesScopingCount;
+
+    // Identifier of the latest find-in-page request. Required to be stored in
+    // the frame in order to reply if required in case the frame is detached.
+    int m_findRequestIdentifier;
+
+    // Keeps track of whether there is an scoping effort ongoing in the frame.
+    bool m_scopingInProgress;
+
+    // Keeps track of whether the last find request completed its scoping effort
+    // without finding any matches in this frame.
+    bool m_lastFindRequestCompletedWithNoMatches;
+
+    // Keeps track of when the scoping effort should next invalidate the scrollbar
+    // and the frame area.
+    int m_nextInvalidateAfter;
+
+    // A list of all of the pending calls to scopeStringMatches.
+    Vector<DeferredScopeStringMatches*> m_deferredScopingWork;
+
+    // Version number incremented on the main frame only whenever the document
+    // find-in-page match markers change. It should be 0 for all other frames.
+    int m_findMatchMarkersVersion;
+
+    // Local cache of the find match markers currently displayed for this frame.
+    Vector<FindMatch> m_findMatchesCache;
+
+    // Determines if the rects in the find-in-page matches cache of this frame
+    // are invalid and should be recomputed.
+    bool m_findMatchRectsAreValid;
+
+    // Contents size when find-in-page match rects were last computed for this
+    // frame's cache.
+    WebCore::IntSize m_contentsSizeForCurrentFindMatchRects;
+
+    // Valid between calls to BeginPrint() and EndPrint(). Containts the print
+    // information. Is used by PrintPage().
+    OwnPtr<ChromePrintContext> m_printContext;
+
+    // Stores the additional input events offset and scale when device metrics emulation is enabled.
+    WebCore::IntSize m_inputEventsOffsetForEmulation;
+    float m_inputEventsScaleFactorForEmulation;
+};
+
+DEFINE_TYPE_CASTS(WebFrameImpl, WebFrame, frame, true, true);
+
+} // namespace blink
+
+#endif
diff --git a/Source/web/ValidationMessageClientImpl.cpp b/Source/web/ValidationMessageClientImpl.cpp
index 8761e3e..164569f 100644
--- a/Source/web/ValidationMessageClientImpl.cpp
+++ b/Source/web/ValidationMessageClientImpl.cpp
@@ -92,7 +92,7 @@
     m_finishTime = monotonicallyIncreasingTime() + std::max(minimumSecondToShowValidationMessage, (message.length() + title.length()) * secondPerCharacter);
     // FIXME: We should invoke checkAnchorStatus actively when layout, scroll,
     // or page scale change happen.
-    m_timer.startRepeating(statusCheckInterval);
+    m_timer.startRepeating(statusCheckInterval, FROM_HERE);
 }
 
 void ValidationMessageClientImpl::hideValidationMessage(const Element& anchor)
diff --git a/Source/web/WebAXObject.cpp b/Source/web/WebAXObject.cpp
index af98cf2..8a6dd28 100644
--- a/Source/web/WebAXObject.cpp
+++ b/Source/web/WebAXObject.cpp
@@ -414,6 +414,46 @@
     return WebString(m_private->accessKey());
 }
 
+WebAXObject WebAXObject::ariaActiveDescendant() const
+{
+    if (isDetached())
+        return WebAXObject();
+
+    return WebAXObject(m_private->activeDescendant());
+}
+
+bool WebAXObject::ariaControls(WebVector<WebAXObject>& controlsElements) const
+{
+    if (isDetached())
+        return false;
+
+    AXObject::AccessibilityChildrenVector controls;
+    m_private->ariaControlsElements(controls);
+
+    WebVector<WebAXObject> result(controls.size());
+    for (size_t i = 0; i < controls.size(); i++)
+        result[i] = WebAXObject(controls[i]);
+    controlsElements.swap(result);
+
+    return true;
+}
+
+bool WebAXObject::ariaDescribedby(WebVector<WebAXObject>& describedbyElements) const
+{
+    if (isDetached())
+        return false;
+
+    AXObject::AccessibilityChildrenVector describedby;
+    m_private->ariaDescribedbyElements(describedby);
+
+    WebVector<WebAXObject> result(describedby.size());
+    for (size_t i = 0; i < describedby.size(); i++)
+        result[i] = WebAXObject(describedby[i]);
+    describedbyElements.swap(result);
+
+    return true;
+}
+
 bool WebAXObject::ariaHasPopup() const
 {
     if (isDetached())
@@ -422,6 +462,38 @@
     return m_private->ariaHasPopup();
 }
 
+bool WebAXObject::ariaFlowTo(WebVector<WebAXObject>& flowToElements) const
+{
+    if (isDetached())
+        return false;
+
+    AXObject::AccessibilityChildrenVector flowTo;
+    m_private->ariaFlowToElements(flowTo);
+
+    WebVector<WebAXObject> result(flowTo.size());
+    for (size_t i = 0; i < flowTo.size(); i++)
+        result[i] = WebAXObject(flowTo[i]);
+    flowToElements.swap(result);
+
+    return true;
+}
+
+bool WebAXObject::ariaLabelledby(WebVector<WebAXObject>& labelledbyElements) const
+{
+    if (isDetached())
+        return false;
+
+    AXObject::AccessibilityChildrenVector labelledby;
+    m_private->ariaLabelledbyElements(labelledby);
+
+    WebVector<WebAXObject> result(labelledby.size());
+    for (size_t i = 0; i < labelledby.size(); i++)
+        result[i] = WebAXObject(labelledby[i]);
+    labelledbyElements.swap(result);
+
+    return true;
+}
+
 bool WebAXObject::ariaLiveRegionAtomic() const
 {
     if (isDetached())
@@ -454,6 +526,22 @@
     return m_private->ariaLiveRegionStatus();
 }
 
+bool WebAXObject::ariaOwns(WebVector<WebAXObject>& ownsElements) const
+{
+    if (isDetached())
+        return false;
+
+    AXObject::AccessibilityChildrenVector owns;
+    m_private->ariaOwnsElements(owns);
+
+    WebVector<WebAXObject> result(owns.size());
+    for (size_t i = 0; i < owns.size(); i++)
+        result[i] = WebAXObject(owns[i]);
+    ownsElements.swap(result);
+
+    return true;
+}
+
 WebRect WebAXObject::boundingBoxRect() const
 {
     if (isDetached())
diff --git a/Source/web/WebBindings.cpp b/Source/web/WebBindings.cpp
index 3ddba39..1b138c6 100644
--- a/Source/web/WebBindings.cpp
+++ b/Source/web/WebBindings.cpp
@@ -46,7 +46,7 @@
 #include "bindings/v8/npruntime_priv.h"
 #include "core/dom/Range.h"
 #include "core/frame/DOMWindow.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "public/platform/WebArrayBuffer.h"
 #include "wtf/ArrayBufferView.h"
 
@@ -318,7 +318,7 @@
     for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, v8::Number::New(isolate, data[i]));
 
-    DOMWindow* window = toDOMWindow(isolate->GetCurrentContext());
+    DOMWindow* window = currentDOMWindow(isolate);
     return npCreateV8ScriptObject(0, result, window, isolate);
 }
 
@@ -329,7 +329,7 @@
     for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, v8String(isolate, data[i]));
 
-    DOMWindow* window = toDOMWindow(isolate->GetCurrentContext());
+    DOMWindow* window = currentDOMWindow(isolate);
     return npCreateV8ScriptObject(0, result, window, isolate);
 }
 
diff --git a/Source/web/WebBlob.cpp b/Source/web/WebBlob.cpp
index 4829660..df23d07 100644
--- a/Source/web/WebBlob.cpp
+++ b/Source/web/WebBlob.cpp
@@ -45,7 +45,7 @@
 {
     OwnPtr<BlobData> blobData = BlobData::create();
     blobData->appendFile(path);
-    RefPtr<Blob> blob = Blob::create(BlobDataHandle::create(blobData.release(), size));
+    RefPtrWillBeRawPtr<Blob> blob = Blob::create(BlobDataHandle::create(blobData.release(), size));
     return WebBlob(blob);
 }
 
@@ -77,27 +77,22 @@
     return m_private->uuid();
 }
 
-v8::Handle<v8::Value>  WebBlob::toV8Value()
+v8::Handle<v8::Value> WebBlob::toV8Value()
 {
     if (!m_private.get())
         return v8::Handle<v8::Value>();
     return toV8(m_private.get(), v8::Handle<v8::Object>(), v8::Isolate::GetCurrent());
 }
 
-WebBlob::WebBlob(const WTF::PassRefPtr<WebCore::Blob>& blob)
+WebBlob::WebBlob(const PassRefPtrWillBeRawPtr<WebCore::Blob>& blob)
     : m_private(blob)
 {
 }
 
-WebBlob& WebBlob::operator=(const WTF::PassRefPtr<WebCore::Blob>& blob)
+WebBlob& WebBlob::operator=(const PassRefPtrWillBeRawPtr<WebCore::Blob>& blob)
 {
     m_private = blob;
     return *this;
 }
 
-WebBlob::operator WTF::PassRefPtr<WebCore::Blob>() const
-{
-    return m_private.get();
-}
-
 } // namespace blink
diff --git a/Source/web/WebCrossOriginPreflightResultCache.cpp b/Source/web/WebCrossOriginPreflightResultCache.cpp
deleted file mode 100644
index 2e0274f..0000000
--- a/Source/web/WebCrossOriginPreflightResultCache.cpp
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebCrossOriginPreflightResultCache.h"
-
-#include "core/loader/CrossOriginPreflightResultCache.h"
-
-namespace blink {
-
-void WebCrossOriginPreflightResultCache::clear()
-{
-    WebCore::CrossOriginPreflightResultCache::shared().empty();
-}
-
-} // namespace blink
diff --git a/Source/web/WebDOMActivityLogger.cpp b/Source/web/WebDOMActivityLogger.cpp
index d7a933f..7ca839f 100644
--- a/Source/web/WebDOMActivityLogger.cpp
+++ b/Source/web/WebDOMActivityLogger.cpp
@@ -31,10 +31,10 @@
 #include "config.h"
 #include "WebDOMActivityLogger.h"
 
-#include "bindings/v8/DOMWrapperWorld.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8DOMActivityLogger.h"
 #include "core/dom/Document.h"
+#include "core/frame/DOMWindow.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/text/WTFString.h"
 
@@ -53,7 +53,7 @@
     {
         KURL url;
         String title;
-        if (Document* document = currentDocument(v8::Isolate::GetCurrent())) {
+        if (Document* document = currentDOMWindow(v8::Isolate::GetCurrent())->document()) {
             url = document->url();
             title = document->title();
         }
@@ -66,13 +66,13 @@
 
 bool hasDOMActivityLogger(int worldId)
 {
-    return DOMWrapperWorld::activityLogger(worldId);
+    return V8DOMActivityLogger::activityLogger(worldId);
 }
 
 void setDOMActivityLogger(int worldId, WebDOMActivityLogger* logger)
 {
     ASSERT(logger);
-    DOMWrapperWorld::setActivityLogger(worldId, adoptPtr(new DOMActivityLoggerContainer(adoptPtr(logger))));
+    V8DOMActivityLogger::setActivityLogger(worldId, adoptPtr(new DOMActivityLoggerContainer(adoptPtr(logger))));
 }
 
 } // namespace blink
diff --git a/Source/web/WebDOMError.cpp b/Source/web/WebDOMError.cpp
index 75f323f..5cbf706 100644
--- a/Source/web/WebDOMError.cpp
+++ b/Source/web/WebDOMError.cpp
@@ -76,20 +76,15 @@
     return toV8(m_private.get(), v8::Handle<v8::Object>(), v8::Isolate::GetCurrent());
 }
 
-WebDOMError::WebDOMError(const WTF::PassRefPtr<WebCore::DOMError>& error)
+WebDOMError::WebDOMError(const PassRefPtrWillBeRawPtr<WebCore::DOMError>& error)
     : m_private(error)
 {
 }
 
-WebDOMError& WebDOMError::operator=(const WTF::PassRefPtr<WebCore::DOMError>& error)
+WebDOMError& WebDOMError::operator=(const PassRefPtrWillBeRawPtr<WebCore::DOMError>& error)
 {
     m_private = error;
     return *this;
 }
 
-WebDOMError::operator WTF::PassRefPtr<WebCore::DOMError>() const
-{
-    return m_private.get();
-}
-
 } // namespace blink
diff --git a/Source/web/WebDOMEvent.cpp b/Source/web/WebDOMEvent.cpp
index 1d8e159..2d833bb 100644
--- a/Source/web/WebDOMEvent.cpp
+++ b/Source/web/WebDOMEvent.cpp
@@ -43,7 +43,7 @@
 
 void WebDOMEvent::reset()
 {
-    assign(0);
+    assign(nullptr);
 }
 
 void WebDOMEvent::assign(const WebDOMEvent& other)
diff --git a/Source/web/WebDOMFileSystem.cpp b/Source/web/WebDOMFileSystem.cpp
index 669724f..406e4de 100644
--- a/Source/web/WebDOMFileSystem.cpp
+++ b/Source/web/WebDOMFileSystem.cpp
@@ -32,8 +32,14 @@
 #include "WebDOMFileSystem.h"
 
 #include "V8DOMFileSystem.h"
+#include "V8DirectoryEntry.h"
+#include "V8FileEntry.h"
+#include "WebFrameImpl.h"
 #include "bindings/v8/WrapperTypeInfo.h"
+#include "core/dom/Document.h"
 #include "modules/filesystem/DOMFileSystem.h"
+#include "modules/filesystem/DirectoryEntry.h"
+#include "modules/filesystem/FileEntry.h"
 #include <v8.h>
 
 using namespace WebCore;
@@ -50,6 +56,20 @@
     return WebDOMFileSystem(domFileSystem);
 }
 
+WebDOMFileSystem WebDOMFileSystem::create(
+    WebFrame* frame,
+    WebFileSystemType type,
+    const WebString& name,
+    const WebURL& rootURL,
+    SerializableType serializableType)
+{
+    ASSERT(frame && toWebFrameImpl(frame)->frame());
+    RefPtrWillBeRawPtr<DOMFileSystem> domFileSystem = DOMFileSystem::create(toWebFrameImpl(frame)->frame()->document(), name, static_cast<WebCore::FileSystemType>(type), rootURL);
+    if (serializableType == SerializableTypeSerializable)
+        domFileSystem->makeClonable();
+    return WebDOMFileSystem(domFileSystem);
+}
+
 void WebDOMFileSystem::reset()
 {
     m_private.reset();
@@ -90,20 +110,34 @@
     return m_private->rootURL();
 }
 
-WebDOMFileSystem::WebDOMFileSystem(const WTF::PassRefPtr<DOMFileSystem>& domFileSystem)
+v8::Handle<v8::Value> WebDOMFileSystem::toV8Value()
+{
+    if (!m_private.get())
+        return v8::Handle<v8::Value>();
+    return toV8(m_private.get(), v8::Handle<v8::Object>(), toIsolate(m_private->executionContext()));
+}
+
+v8::Handle<v8::Value> WebDOMFileSystem::createV8Entry(
+    const WebString& path,
+    EntryType entryType)
+{
+    if (!m_private.get())
+        return v8::Handle<v8::Value>();
+    if (entryType == EntryTypeDirectory)
+        return toV8(DirectoryEntry::create(m_private.get(), path), v8::Handle<v8::Object>(), toIsolate(m_private->executionContext()));
+    ASSERT(entryType == EntryTypeFile);
+    return toV8(FileEntry::create(m_private.get(), path), v8::Handle<v8::Object>(), toIsolate(m_private->executionContext()));
+}
+
+WebDOMFileSystem::WebDOMFileSystem(const PassRefPtrWillBeRawPtr<DOMFileSystem>& domFileSystem)
     : m_private(domFileSystem)
 {
 }
 
-WebDOMFileSystem& WebDOMFileSystem::operator=(const WTF::PassRefPtr<WebCore::DOMFileSystem>& domFileSystem)
+WebDOMFileSystem& WebDOMFileSystem::operator=(const PassRefPtrWillBeRawPtr<WebCore::DOMFileSystem>& domFileSystem)
 {
     m_private = domFileSystem;
     return *this;
 }
 
-WebDOMFileSystem::operator WTF::PassRefPtr<WebCore::DOMFileSystem>() const
-{
-    return m_private.get();
-}
-
 } // namespace blink
diff --git a/Source/web/WebDOMMediaStreamTrack.cpp b/Source/web/WebDOMMediaStreamTrack.cpp
index 82d64ec..d576d44 100644
--- a/Source/web/WebDOMMediaStreamTrack.cpp
+++ b/Source/web/WebDOMMediaStreamTrack.cpp
@@ -47,12 +47,12 @@
         v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(value);
         return WebDOMMediaStreamTrack(WebCore::V8MediaStreamTrack::toNative(object));
     }
-    return WebDOMMediaStreamTrack(0);
+    return WebDOMMediaStreamTrack(nullptr);
 }
 
 void WebDOMMediaStreamTrack::reset()
 {
-    m_private = 0;
+    m_private.reset();
 }
 
 void WebDOMMediaStreamTrack::assign(const WebDOMMediaStreamTrack& b)
diff --git a/Source/web/WebDataSourceImpl.cpp b/Source/web/WebDataSourceImpl.cpp
index b2fcfe3..93be359 100644
--- a/Source/web/WebDataSourceImpl.cpp
+++ b/Source/web/WebDataSourceImpl.cpp
@@ -31,9 +31,7 @@
 #include "config.h"
 #include "WebDataSourceImpl.h"
 
-#include "ApplicationCacheHostInternal.h"
 #include "core/dom/Document.h"
-#include "core/loader/FrameLoader.h"
 #include "public/platform/WebURL.h"
 #include "public/platform/WebURLError.h"
 #include "public/platform/WebVector.h"
@@ -48,7 +46,7 @@
     return nextPluginLoadObserver;
 }
 
-PassRefPtr<WebDataSourceImpl> WebDataSourceImpl::create(Frame* frame, const ResourceRequest& request, const SubstituteData& data)
+PassRefPtr<WebDataSourceImpl> WebDataSourceImpl::create(LocalFrame* frame, const ResourceRequest& request, const SubstituteData& data)
 {
     return adoptRef(new WebDataSourceImpl(frame, request, data));
 }
@@ -126,11 +124,6 @@
     m_extraData = adoptPtr(extraData);
 }
 
-WebApplicationCacheHost* WebDataSourceImpl::applicationCacheHost()
-{
-    return ApplicationCacheHostInternal::toWebApplicationCacheHost(DocumentLoader::applicationCacheHost());
-}
-
 void WebDataSourceImpl::setNavigationStartTime(double navigationStart)
 {
     timing()->setNavigationStart(navigationStart);
@@ -160,7 +153,7 @@
     nextPluginLoadObserver() = observer;
 }
 
-WebDataSourceImpl::WebDataSourceImpl(Frame* frame, const ResourceRequest& request, const SubstituteData& data)
+WebDataSourceImpl::WebDataSourceImpl(LocalFrame* frame, const ResourceRequest& request, const SubstituteData& data)
     : DocumentLoader(frame, request, data)
 {
     if (!nextPluginLoadObserver())
diff --git a/Source/web/WebDataSourceImpl.h b/Source/web/WebDataSourceImpl.h
index 0949cae..1200661 100644
--- a/Source/web/WebDataSourceImpl.h
+++ b/Source/web/WebDataSourceImpl.h
@@ -47,7 +47,7 @@
 
 class WebDataSourceImpl FINAL : public WebCore::DocumentLoader, public WebDataSource {
 public:
-    static PassRefPtr<WebDataSourceImpl> create(WebCore::Frame*, const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+    static PassRefPtr<WebDataSourceImpl> create(WebCore::LocalFrame*, const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
 
     static WebDataSourceImpl* fromDocumentLoader(WebCore::DocumentLoader* loader)
     {
@@ -68,7 +68,6 @@
     virtual double triggeringEventTime() const OVERRIDE;
     virtual ExtraData* extraData() const OVERRIDE;
     virtual void setExtraData(ExtraData*) OVERRIDE;
-    virtual WebApplicationCacheHost* applicationCacheHost() OVERRIDE;
     virtual void setNavigationStartTime(double) OVERRIDE;
 
     static WebNavigationType toWebNavigationType(WebCore::NavigationType type);
@@ -77,7 +76,7 @@
     static void setNextPluginLoadObserver(PassOwnPtr<WebPluginLoadObserver>);
 
 private:
-    WebDataSourceImpl(WebCore::Frame*, const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+    WebDataSourceImpl(WebCore::LocalFrame*, const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
     virtual ~WebDataSourceImpl();
 
     // Mutable because the const getters will magically sync these to the
diff --git a/Source/web/WebDevToolsAgentImpl.cpp b/Source/web/WebDevToolsAgentImpl.cpp
index 06d397a..44305b6 100644
--- a/Source/web/WebDevToolsAgentImpl.cpp
+++ b/Source/web/WebDevToolsAgentImpl.cpp
@@ -46,15 +46,13 @@
 #include "bindings/v8/PageScriptDebugServer.h"
 #include "bindings/v8/ScriptController.h"
 #include "bindings/v8/V8Binding.h"
-#include "bindings/v8/V8Utilities.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/fetch/MemoryCache.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/inspector/InjectedScriptHost.h"
 #include "core/inspector/InspectorController.h"
 #include "core/page/Page.h"
-#include "core/page/PageGroup.h"
 #include "core/rendering/RenderView.h"
 #include "platform/JSONValues.h"
 #include "platform/graphics/GraphicsContext.h"
@@ -122,8 +120,9 @@
         Vector<WebViewImpl*> views;
 
         // 1. Disable input events.
-        HashSet<Page*>::const_iterator end =  page->group().pages().end();
-        for (HashSet<Page*>::const_iterator it =  page->group().pages().begin(); it != end; ++it) {
+        const HashSet<Page*>& pages = Page::ordinaryPages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it =  pages.begin(); it != end; ++it) {
             WebViewImpl* view = WebViewImpl::fromPage(*it);
             if (!view)
                 continue;
@@ -278,7 +277,7 @@
     // Skip non main world contexts.
     if (worldId)
         return;
-    if (WebCore::Frame* frame = webframe->frame())
+    if (WebCore::LocalFrame* frame = webframe->frame())
         frame->script().setContextDebugId(m_hostId);
 }
 
@@ -466,9 +465,14 @@
     m_client->dumpUncountedAllocatedObjects(&provider);
 }
 
-void WebDevToolsAgentImpl::setTraceEventCallback(TraceEventCallback callback)
+void WebDevToolsAgentImpl::setTraceEventCallback(const String& categoryFilter, TraceEventCallback callback)
 {
-    m_client->setTraceEventCallback(callback);
+    m_client->setTraceEventCallback(categoryFilter, callback);
+}
+
+void WebDevToolsAgentImpl::resetTraceEventCallback()
+{
+    m_client->resetTraceEventCallback();
 }
 
 void WebDevToolsAgentImpl::startGPUEventsRecording()
@@ -528,7 +532,7 @@
     return 0;
 }
 
-Frame* WebDevToolsAgentImpl::mainFrame()
+LocalFrame* WebDevToolsAgentImpl::mainFrame()
 {
     if (Page* page = m_webViewImpl->page())
         return page->mainFrame();
@@ -556,13 +560,16 @@
     m_webViewImpl->removePageOverlay(this);
 }
 
-bool WebDevToolsAgentImpl::sendMessageToFrontend(const String& message)
+void WebDevToolsAgentImpl::sendMessageToFrontend(PassRefPtr<WebCore::JSONObject> message)
 {
-    WebDevToolsAgentImpl* devToolsAgent = static_cast<WebDevToolsAgentImpl*>(m_webViewImpl->devToolsAgent());
-    if (!devToolsAgent)
-        return false;
-    m_client->sendMessageToInspectorFrontend(message);
-    return true;
+    m_frontendMessageQueue.append(message);
+}
+
+void WebDevToolsAgentImpl::flush()
+{
+    for (size_t i = 0; i < m_frontendMessageQueue.size(); ++i)
+        m_client->sendMessageToInspectorFrontend(m_frontendMessageQueue[i]->toJSONString());
+    m_frontendMessageQueue.clear();
 }
 
 void WebDevToolsAgentImpl::updateInspectorStateCookie(const String& state)
@@ -606,6 +613,8 @@
 {
     if (InspectorController* ic = inspectorController())
         ic->didProcessTask();
+    if (m_attached)
+        flush();
 }
 
 WebString WebDevToolsAgent::inspectorProtocolVersion()
diff --git a/Source/web/WebDevToolsAgentImpl.h b/Source/web/WebDevToolsAgentImpl.h
index 8a1d9c6..19e5a86 100644
--- a/Source/web/WebDevToolsAgentImpl.h
+++ b/Source/web/WebDevToolsAgentImpl.h
@@ -40,10 +40,11 @@
 #include "public/platform/WebThread.h"
 #include "wtf/Forward.h"
 #include "wtf/OwnPtr.h"
+#include "wtf/Vector.h"
 
 namespace WebCore {
 class Document;
-class Frame;
+class LocalFrame;
 class FrameView;
 class GraphicsContext;
 class InspectorClient;
@@ -102,7 +103,8 @@
     virtual void highlight() OVERRIDE;
     virtual void hideHighlight() OVERRIDE;
     virtual void updateInspectorStateCookie(const WTF::String&) OVERRIDE;
-    virtual bool sendMessageToFrontend(const WTF::String&) OVERRIDE;
+    virtual void sendMessageToFrontend(PassRefPtr<WebCore::JSONObject> message) OVERRIDE;
+    virtual void flush() OVERRIDE;
 
     virtual void clearBrowserCache() OVERRIDE;
     virtual void clearBrowserCookies() OVERRIDE;
@@ -111,7 +113,8 @@
 
     virtual void getAllocatedObjects(HashSet<const void*>&) OVERRIDE;
     virtual void dumpUncountedAllocatedObjects(const HashMap<const void*, size_t>&) OVERRIDE;
-    virtual void setTraceEventCallback(TraceEventCallback) OVERRIDE;
+    virtual void setTraceEventCallback(const WTF::String& categoryFilter, TraceEventCallback) OVERRIDE;
+    virtual void resetTraceEventCallback() OVERRIDE;
     virtual void startGPUEventsRecording() OVERRIDE;
     virtual void stopGPUEventsRecording() OVERRIDE;
 
@@ -130,7 +133,7 @@
     void disableViewportEmulation();
 
     WebCore::InspectorController* inspectorController();
-    WebCore::Frame* mainFrame();
+    WebCore::LocalFrame* mainFrame();
 
     int m_hostId;
     WebDevToolsAgentClient* m_client;
@@ -141,6 +144,8 @@
     bool m_emulateViewportEnabled;
     bool m_originalViewportEnabled;
     bool m_isOverlayScrollbarsEnabled;
+    typedef Vector<RefPtr<WebCore::JSONObject> > FrontendMessageQueue;
+    FrontendMessageQueue m_frontendMessageQueue;
 };
 
 } // namespace blink
diff --git a/Source/web/WebDevToolsFrontendImpl.cpp b/Source/web/WebDevToolsFrontendImpl.cpp
index dde86a7..c36baf8 100644
--- a/Source/web/WebDevToolsFrontendImpl.cpp
+++ b/Source/web/WebDevToolsFrontendImpl.cpp
@@ -42,7 +42,6 @@
 #include "bindings/v8/ScriptController.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8DOMWrapper.h"
-#include "bindings/v8/V8Utilities.h"
 #include "core/clipboard/Pasteboard.h"
 #include "core/dom/Document.h"
 #include "core/dom/Node.h"
@@ -51,7 +50,7 @@
 #include "core/inspector/InspectorFrontendHost.h"
 #include "core/page/ContextMenuController.h"
 #include "core/frame/DOMWindow.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/Page.h"
 #include "core/frame/Settings.h"
 #include "platform/ContextMenuItem.h"
@@ -116,7 +115,7 @@
     // We should call maybeDispatch asynchronously here because we are not allowed to update activeDOMObjects list in
     // resume (See ExecutionContext::resumeActiveDOMObjects).
     if (!m_inspectorFrontendDispatchTimer.isActive())
-        m_inspectorFrontendDispatchTimer.startOneShot(0);
+        m_inspectorFrontendDispatchTimer.startOneShot(0, FROM_HERE);
 }
 
 void WebDevToolsFrontendImpl::maybeDispatch(WebCore::Timer<WebDevToolsFrontendImpl>*)
diff --git a/Source/web/WebDocument.cpp b/Source/web/WebDocument.cpp
index 7e1c0ce..1b69b3f 100644
--- a/Source/web/WebDocument.cpp
+++ b/Source/web/WebDocument.cpp
@@ -196,9 +196,9 @@
     return WebElement(constUnwrap<Document>()->getElementById(id));
 }
 
-WebNode WebDocument::focusedNode() const
+WebElement WebDocument::focusedElement() const
 {
-    return WebNode(constUnwrap<Document>()->focusedElement());
+    return WebElement(constUnwrap<Document>()->focusedElement());
 }
 
 WebDocumentType WebDocument::doctype() const
@@ -210,7 +210,7 @@
 {
     RefPtr<Document> document = unwrap<Document>();
     ASSERT(document);
-    RefPtr<StyleSheetContents> parsedSheet = StyleSheetContents::create(CSSParserContext(*document.get(), 0));
+    RefPtrWillBeRawPtr<StyleSheetContents> parsedSheet = StyleSheetContents::create(CSSParserContext(*document.get(), 0));
     parsedSheet->parseString(sourceCode);
     document->styleEngine()->addAuthorSheet(parsedSheet);
 }
@@ -225,14 +225,14 @@
 
 void WebDocument::cancelFullScreen()
 {
-    if (FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(unwrap<Document>()))
+    if (FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(*unwrap<Document>()))
         fullscreen->webkitCancelFullScreen();
 }
 
 WebElement WebDocument::fullScreenElement() const
 {
     Element* fullScreenElement = 0;
-    if (FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(const_cast<WebDocument*>(this)->unwrap<Document>()))
+    if (FullscreenElementStack* fullscreen = FullscreenElementStack::fromIfExists(*const_cast<WebDocument*>(this)->unwrap<Document>()))
         fullScreenElement = fullscreen->webkitCurrentFullScreenElement();
     return WebElement(fullScreenElement);
 }
diff --git a/Source/web/WebDragData.cpp b/Source/web/WebDragData.cpp
index adff6b4..84f50a3 100644
--- a/Source/web/WebDragData.cpp
+++ b/Source/web/WebDragData.cpp
@@ -32,6 +32,7 @@
 
 #include "core/clipboard/DataObject.h"
 #include "core/clipboard/DataTransferItem.h"
+#include "heap/Handle.h"
 #include "modules/filesystem/DraggedIsolatedFileSystem.h"
 #include "platform/clipboard/ClipboardMimeTypes.h"
 #include "public/platform/WebData.h"
@@ -46,25 +47,40 @@
 
 namespace blink {
 
-class WebDragDataPrivate : public DataObject {
-};
-
 void WebDragData::initialize()
 {
-    assign(static_cast<WebDragDataPrivate*>(DataObject::create().leakRef()));
+    m_private = DataObject::create();
 }
 
 void WebDragData::reset()
 {
-    assign(0);
+    m_private.reset();
 }
 
 void WebDragData::assign(const WebDragData& other)
 {
-    WebDragDataPrivate* p = const_cast<WebDragDataPrivate*>(other.m_private);
-    if (p)
-        p->ref();
-    assign(p);
+    m_private = other.m_private;
+}
+
+WebDragData::WebDragData(const PassRefPtrWillBeRawPtr<WebCore::DataObject>& object)
+{
+    m_private = object;
+}
+
+WebDragData& WebDragData::operator=(const PassRefPtrWillBeRawPtr<WebCore::DataObject>& object)
+{
+    m_private = object;
+    return *this;
+}
+
+DataObject* WebDragData::getValue() const
+{
+    return m_private.get();
+}
+
+void WebDragData::ensureMutable()
+{
+    ASSERT(!isNull());
 }
 
 WebVector<WebDragData::Item> WebDragData::items() const
@@ -83,7 +99,7 @@
                 item.binaryData = originalItem->sharedBuffer();
             } else if (originalItem->isFilename()) {
                 item.storageType = Item::StorageTypeFilename;
-                RefPtr<WebCore::Blob> blob = originalItem->getAsFile();
+                RefPtrWillBeRawPtr<WebCore::Blob> blob = originalItem->getAsFile();
                 if (blob->isFile()) {
                     File* file = toFile(blob.get());
                     item.filenameData = file->path();
@@ -132,7 +148,7 @@
 WebString WebDragData::filesystemId() const
 {
     ASSERT(!isNull());
-    DraggedIsolatedFileSystem* filesystem = DraggedIsolatedFileSystem::from(m_private);
+    DraggedIsolatedFileSystem* filesystem = DraggedIsolatedFileSystem::from(m_private.get());
     if (filesystem)
         return filesystem->filesystemId();
     return WebString();
@@ -142,37 +158,7 @@
 {
     // The ID is an opaque string, given by and validated by chromium port.
     ensureMutable();
-    DraggedIsolatedFileSystem::provideTo(m_private, DraggedIsolatedFileSystem::supplementName(), DraggedIsolatedFileSystem::create(filesystemId));
-}
-
-WebDragData::WebDragData(const WTF::PassRefPtr<WebCore::DataObject>& data)
-    : m_private(static_cast<WebDragDataPrivate*>(data.leakRef()))
-{
-}
-
-WebDragData& WebDragData::operator=(const WTF::PassRefPtr<WebCore::DataObject>& data)
-{
-    assign(static_cast<WebDragDataPrivate*>(data.leakRef()));
-    return *this;
-}
-
-WebDragData::operator WTF::PassRefPtr<WebCore::DataObject>() const
-{
-    return PassRefPtr<DataObject>(const_cast<WebDragDataPrivate*>(m_private));
-}
-
-void WebDragData::assign(WebDragDataPrivate* p)
-{
-    // p is already ref'd for us by the caller
-    if (m_private)
-        m_private->deref();
-    m_private = p;
-}
-
-void WebDragData::ensureMutable()
-{
-    ASSERT(!isNull());
-    ASSERT(m_private->hasOneRef());
+    DraggedIsolatedFileSystem::provideTo(*m_private.get(), DraggedIsolatedFileSystem::supplementName(), DraggedIsolatedFileSystem::create(filesystemId));
 }
 
 } // namespace blink
diff --git a/Source/web/WebElement.cpp b/Source/web/WebElement.cpp
index 1fac295..2130461 100644
--- a/Source/web/WebElement.cpp
+++ b/Source/web/WebElement.cpp
@@ -125,14 +125,14 @@
 {
     if (index >= attributeCount())
         return WebString();
-    return constUnwrap<Element>()->attributeItem(index)->localName();
+    return constUnwrap<Element>()->attributeItem(index).localName();
 }
 
 WebString WebElement::attributeValue(unsigned index) const
 {
     if (index >= attributeCount())
         return WebString();
-    return constUnwrap<Element>()->attributeItem(index)->value();
+    return constUnwrap<Element>()->attributeItem(index).value();
 }
 
 WebString WebElement::innerText()
diff --git a/Source/web/WebEmbeddedWorkerImpl.cpp b/Source/web/WebEmbeddedWorkerImpl.cpp
index dc692bc..57e6730 100644
--- a/Source/web/WebEmbeddedWorkerImpl.cpp
+++ b/Source/web/WebEmbeddedWorkerImpl.cpp
@@ -47,9 +47,11 @@
 #include "core/workers/WorkerScriptLoader.h"
 #include "core/workers/WorkerScriptLoaderClient.h"
 #include "core/workers/WorkerThreadStartupData.h"
+#include "heap/Handle.h"
 #include "modules/serviceworkers/ServiceWorkerThread.h"
 #include "platform/NotImplemented.h"
 #include "platform/SharedBuffer.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "wtf/Functional.h"
 
 using namespace WebCore;
@@ -236,7 +238,7 @@
     providePermissionClientToWorker(workerClients.get(), m_permissionClient.release());
     provideServiceWorkerGlobalScopeClientToWorker(workerClients.get(), ServiceWorkerGlobalScopeClientImpl::create(m_workerContextClient.release()));
 
-    OwnPtr<WorkerThreadStartupData> startupData =
+    OwnPtrWillBeRawPtr<WorkerThreadStartupData> startupData =
         WorkerThreadStartupData::create(
             m_mainScriptLoader->url(),
             m_workerStartData.userAgent,
@@ -244,7 +246,7 @@
             startMode,
             // FIXME: fill appropriate CSP info and policy type.
             String(),
-            ContentSecurityPolicy::Enforce,
+            ContentSecurityPolicyHeaderTypeEnforce,
             workerClients.release());
 
     m_mainScriptLoader.clear();
diff --git a/Source/web/WebFontCache.cpp b/Source/web/WebFontCache.cpp
deleted file mode 100644
index f17337c..0000000
--- a/Source/web/WebFontCache.cpp
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebFontCache.h"
-
-#include "platform/fonts/FontCache.h"
-
-using namespace WebCore;
-
-namespace blink {
-
-// static
-void WebFontCache::clear()
-{
-    FontCache::fontCache()->invalidate();
-}
-
-}  // namespace blink
diff --git a/Source/web/WebFontDescription.cpp b/Source/web/WebFontDescription.cpp
index be66125..2236e71 100644
--- a/Source/web/WebFontDescription.cpp
+++ b/Source/web/WebFontDescription.cpp
@@ -42,8 +42,8 @@
     family = desc.family().family();
     genericFamily = static_cast<GenericFamily>(desc.genericFamily());
     size = desc.specifiedSize();
-    italic = desc.italic();
-    smallCaps = desc.smallCaps();
+    italic = desc.style() == FontStyleItalic;
+    smallCaps = desc.variant() == FontVariantSmallCaps;
     weight = static_cast<Weight>(desc.weight());
     smoothing = static_cast<Smoothing>(desc.fontSmoothing());
     letterSpacing = desc.letterSpacing();
@@ -60,8 +60,8 @@
     desc.setGenericFamily(static_cast<FontDescription::GenericFamilyType>(genericFamily));
     desc.setSpecifiedSize(size);
     desc.setComputedSize(size);
-    desc.setItalic(italic);
-    desc.setSmallCaps(smallCaps);
+    desc.setStyle(italic ? FontStyleItalic : FontStyleNormal);
+    desc.setVariant(smallCaps ? FontVariantSmallCaps : FontVariantNormal);
     desc.setWeight(static_cast<FontWeight>(weight));
     desc.setFontSmoothing(static_cast<FontSmoothingMode>(smoothing));
     desc.setLetterSpacing(letterSpacing);
diff --git a/Source/web/WebFontImpl.cpp b/Source/web/WebFontImpl.cpp
index 724146f..f6bffae 100644
--- a/Source/web/WebFontImpl.cpp
+++ b/Source/web/WebFontImpl.cpp
@@ -54,7 +54,7 @@
 WebFontImpl::WebFontImpl(const FontDescription& desc)
     : m_font(desc)
 {
-    m_font.update(0);
+    m_font.update(nullptr);
 }
 
 WebFontDescription WebFontImpl::fontDescription() const
diff --git a/Source/web/WebFormControlElement.cpp b/Source/web/WebFormControlElement.cpp
index d833087..bbabc8e 100644
--- a/Source/web/WebFormControlElement.cpp
+++ b/Source/web/WebFormControlElement.cpp
@@ -33,6 +33,10 @@
 
 #include "core/html/HTMLFormControlElement.h"
 #include "core/html/HTMLFormElement.h"
+#include "core/html/HTMLInputElement.h"
+#include "core/html/HTMLSelectElement.h"
+#include "core/html/HTMLTextAreaElement.h"
+
 #include "wtf/PassRefPtr.h"
 
 using namespace WebCore;
@@ -79,6 +83,97 @@
     return constUnwrap<HTMLFormControlElement>()->nameForAutofill();
 }
 
+bool WebFormControlElement::autoComplete() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->shouldAutocomplete();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->shouldAutocomplete();
+    return false;
+}
+
+void WebFormControlElement::setValue(const WebString& value, bool sendChangeEvent)
+{
+    if (isHTMLInputElement(*m_private))
+        unwrap<HTMLInputElement>()->setValue(value, sendChangeEvent ? DispatchChangeEvent : DispatchNoEvent);
+    if (isHTMLTextAreaElement(*m_private))
+        unwrap<HTMLTextAreaElement>()->setValue(value);
+    if (isHTMLSelectElement(*m_private))
+        unwrap<HTMLSelectElement>()->setValue(value);
+}
+
+WebString WebFormControlElement::value() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->value();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->value();
+    if (isHTMLSelectElement(*m_private))
+        return constUnwrap<HTMLSelectElement>()->value();
+    return WebString();
+}
+
+void WebFormControlElement::setSuggestedValue(const WebString& value)
+{
+    if (isHTMLInputElement(*m_private))
+        unwrap<HTMLInputElement>()->setSuggestedValue(value);
+    if (isHTMLTextAreaElement(*m_private))
+        unwrap<HTMLTextAreaElement>()->setSuggestedValue(value);
+}
+
+WebString WebFormControlElement::suggestedValue() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->suggestedValue();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->suggestedValue();
+    return WebString();
+}
+
+WebString WebFormControlElement::editingValue() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->innerTextValue();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->innerTextValue();
+    return WebString();
+}
+
+void WebFormControlElement::setSelectionRange(int start, int end)
+{
+    if (isHTMLInputElement(*m_private))
+        unwrap<HTMLInputElement>()->setSelectionRange(start, end);
+    if (isHTMLTextAreaElement(*m_private))
+        unwrap<HTMLTextAreaElement>()->setSelectionRange(start, end);
+}
+
+int WebFormControlElement::selectionStart() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->selectionStart();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->selectionStart();
+    return 0;
+}
+
+int WebFormControlElement::selectionEnd() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->selectionEnd();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->selectionEnd();
+    return 0;
+}
+
+WebString WebFormControlElement::directionForFormData() const
+{
+    if (isHTMLInputElement(*m_private))
+        return constUnwrap<HTMLInputElement>()->directionForFormData();
+    if (isHTMLTextAreaElement(*m_private))
+        return constUnwrap<HTMLTextAreaElement>()->directionForFormData();
+    return WebString();
+}
+
 WebFormElement WebFormControlElement::form() const
 {
     return WebFormElement(constUnwrap<HTMLFormControlElement>()->form());
diff --git a/Source/web/WebFormElement.cpp b/Source/web/WebFormElement.cpp
index 43a014d..18d6fbb 100644
--- a/Source/web/WebFormElement.cpp
+++ b/Source/web/WebFormElement.cpp
@@ -37,7 +37,6 @@
 #include "core/html/HTMLFormControlElement.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLInputElement.h"
-#include "core/loader/FormState.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebURL.h"
 #include "wtf/PassRefPtr.h"
diff --git a/Source/web/WebFrameImpl.cpp b/Source/web/WebFrameImpl.cpp
index 8a611c0..93c0a0e 100644
--- a/Source/web/WebFrameImpl.cpp
+++ b/Source/web/WebFrameImpl.cpp
@@ -38,18 +38,18 @@
 //    |           WebFrame
 //    |              O
 //    |              |
-//   Page O------- Frame (m_mainFrame) O-------O FrameView
+//   Page O------- LocalFrame (m_mainFrame) O-------O FrameView
 //                   ||
 //                   ||
 //               FrameLoader
 //
-// FrameLoader and Frame are formerly one object that was split apart because
+// FrameLoader and LocalFrame are formerly one object that was split apart because
 // it got too big. They basically have the same lifetime, hence the double line.
 //
 // From the perspective of the embedder, WebFrame is simply an object that it
 // allocates by calling WebFrame::create() and must be freed by calling close().
 // Internally, WebFrame is actually refcounted and it holds a reference to its
-// corresponding Frame in WebCore.
+// corresponding LocalFrame in WebCore.
 //
 // How frames are destroyed
 // ------------------------
@@ -62,7 +62,7 @@
 // traversal. Note that child node order may not match DOM node order!
 // detachFromParent() calls FrameLoaderClient::detachedFromParent(), which calls
 // WebFrame::frameDetached(). This triggers WebFrame to clear its reference to
-// Frame, and also notifies the embedder via WebFrameClient that the frame is
+// LocalFrame, and also notifies the embedder via WebFrameClient that the frame is
 // detached. Most embedders will invoke close() on the WebFrame at this point,
 // triggering its deletion unless something else is still retaining a reference.
 //
@@ -80,9 +80,6 @@
 #include "HTMLNames.h"
 #include "PageOverlay.h"
 #include "SharedWorkerRepositoryClientImpl.h"
-#include "V8DOMFileSystem.h"
-#include "V8DirectoryEntry.h"
-#include "V8FileEntry.h"
 #include "WebConsoleMessage.h"
 #include "WebDOMEvent.h"
 #include "WebDOMEventListener.h"
@@ -143,7 +140,6 @@
 #include "core/inspector/InspectorController.h"
 #include "core/inspector/ScriptCallStack.h"
 #include "core/loader/DocumentLoader.h"
-#include "core/loader/FormState.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/HistoryItem.h"
@@ -166,10 +162,6 @@
 #include "core/timing/Performance.h"
 #include "core/xml/DocumentXPathEvaluator.h"
 #include "core/xml/XPathResult.h"
-#include "modules/filesystem/DOMFileSystem.h"
-#include "modules/filesystem/DirectoryEntry.h"
-#include "modules/filesystem/FileEntry.h"
-#include "platform/FileSystemType.h"
 #include "platform/TraceEvent.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/clipboard/ClipboardUtilities.h"
@@ -184,7 +176,6 @@
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "public/platform/Platform.h"
-#include "public/platform/WebFileSystem.h"
 #include "public/platform/WebFloatPoint.h"
 #include "public/platform/WebFloatRect.h"
 #include "public/platform/WebLayer.h"
@@ -205,7 +196,7 @@
 // Key for a StatsCounter tracking how many WebFrames are active.
 static const char webFrameActiveCount[] = "WebFrameActiveCount";
 
-static void frameContentAsPlainText(size_t maxChars, Frame* frame, StringBuilder& output)
+static void frameContentAsPlainText(size_t maxChars, LocalFrame* frame, StringBuilder& output)
 {
     Document* document = frame->document();
     if (!document)
@@ -241,7 +232,7 @@
 
     // Recursively walk the children.
     const FrameTree& frameTree = frame->tree();
-    for (Frame* curChild = frameTree.firstChild(); curChild; curChild = curChild->tree().nextSibling()) {
+    for (LocalFrame* curChild = frameTree.firstChild(); curChild; curChild = curChild->tree().nextSibling()) {
         // Ignore the text of non-visible frames.
         RenderView* contentRenderer = curChild->contentRenderer();
         RenderPart* ownerRenderer = curChild->ownerRenderer();
@@ -266,7 +257,7 @@
     }
 }
 
-WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(Frame* frame)
+WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(LocalFrame* frame)
 {
     if (!frame)
         return 0;
@@ -276,7 +267,7 @@
     return toWebPluginContainerImpl(pluginDocument->pluginWidget());
 }
 
-WebPluginContainerImpl* WebFrameImpl::pluginContainerFromNode(WebCore::Frame* frame, const WebNode& node)
+WebPluginContainerImpl* WebFrameImpl::pluginContainerFromNode(WebCore::LocalFrame* frame, const WebNode& node)
 {
     WebPluginContainerImpl* pluginContainer = pluginContainerFromFrame(frame);
     if (pluginContainer)
@@ -289,7 +280,7 @@
 class ChromePrintContext : public PrintContext {
     WTF_MAKE_NONCOPYABLE(ChromePrintContext);
 public:
-    ChromePrintContext(Frame* frame)
+    ChromePrintContext(LocalFrame* frame)
         : PrintContext(frame)
         , m_printedPageWidth(0)
     {
@@ -403,7 +394,7 @@
 // want to delegate all printing related calls to the plugin.
 class ChromePluginPrintContext : public ChromePrintContext {
 public:
-    ChromePluginPrintContext(Frame* frame, WebPluginContainerImpl* plugin, const WebPrintParams& printParams)
+    ChromePluginPrintContext(LocalFrame* frame, WebPluginContainerImpl* plugin, const WebPrintParams& printParams)
         : ChromePrintContext(frame), m_plugin(plugin), m_pageCount(0), m_printParams(printParams)
     {
     }
@@ -474,7 +465,7 @@
         , m_options(options)
         , m_reset(reset)
     {
-        m_timer.startOneShot(0.0);
+        m_timer.startOneShot(0.0, FROM_HERE);
     }
 
 private:
@@ -537,11 +528,6 @@
     frame()->tree().setName(name);
 }
 
-long long WebFrameImpl::embedderIdentifier() const
-{
-    return m_frameInit->frameID();
-}
-
 WebVector<WebIconURL> WebFrameImpl::iconURLs(int iconTypesMask) const
 {
     // The URL to the icon may be in the header. As such, only
@@ -643,14 +629,24 @@
 
 WebFrame* WebFrameImpl::opener() const
 {
-    if (!frame())
-        return 0;
-    return fromFrame(frame()->loader().opener());
+    return m_opener;
 }
 
-void WebFrameImpl::setOpener(const WebFrame* webFrame)
+void WebFrameImpl::setOpener(WebFrame* opener)
 {
-    frame()->loader().setOpener(webFrame ? toWebFrameImpl(webFrame)->frame() : 0);
+    WebFrameImpl* openerImpl = toWebFrameImpl(opener);
+    if (m_opener && !openerImpl && m_client)
+        m_client->didDisownOpener(this);
+
+    if (m_opener)
+        m_opener->m_openedFrames.remove(this);
+    if (openerImpl)
+        openerImpl->m_openedFrames.add(this);
+    m_opener = openerImpl;
+
+    ASSERT(m_frame);
+    if (m_frame && m_frame->document())
+        m_frame->document()->initSecurityContext();
 }
 
 void WebFrameImpl::appendChild(WebFrame* child)
@@ -754,8 +750,9 @@
         return 0;
 
     Document* document = frame()->document();
+    ASSERT(document);
 
-    RefPtr<XPathResult> xpathResult = DocumentXPathEvaluator::evaluate(document, xpath, document, 0, XPathResult::ORDERED_NODE_ITERATOR_TYPE, 0, IGNORE_EXCEPTION);
+    RefPtrWillBeRawPtr<XPathResult> xpathResult = DocumentXPathEvaluator::evaluate(*document, xpath, document, nullptr, XPathResult::ORDERED_NODE_ITERATOR_TYPE, 0, IGNORE_EXCEPTION);
     if (!xpathResult)
         return 0;
 
@@ -776,7 +773,7 @@
 {
     if (!frame())
         return WebPerformance();
-    return WebPerformance(frame()->domWindow()->performance());
+    return WebPerformance(&frame()->domWindow()->performance());
 }
 
 NPObject* WebFrameImpl::windowObject() const
@@ -912,7 +909,7 @@
     }
 }
 
-v8::Handle<v8::Value> WebFrameImpl::callFunctionEvenIfScriptDisabled(v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> argv[])
+v8::Handle<v8::Value> WebFrameImpl::callFunctionEvenIfScriptDisabled(v8::Handle<v8::Function> function, v8::Handle<v8::Value> receiver, int argc, v8::Handle<v8::Value> argv[])
 {
     ASSERT(frame());
     return frame()->script().callFunction(function, receiver, argc, argv);
@@ -923,30 +920,6 @@
     return toV8Context(V8PerIsolateData::mainThreadIsolate(), frame(), DOMWrapperWorld::mainWorld());
 }
 
-v8::Handle<v8::Value> WebFrameImpl::createFileSystem(WebFileSystemType type, const WebString& name, const WebString& path)
-{
-    ASSERT(frame());
-    return toV8(DOMFileSystem::create(frame()->document(), name, static_cast<WebCore::FileSystemType>(type), KURL(ParsedURLString, path.utf8().data())), v8::Handle<v8::Object>(), toIsolate(frame()));
-}
-
-v8::Handle<v8::Value> WebFrameImpl::createSerializableFileSystem(WebFileSystemType type, const WebString& name, const WebString& path)
-{
-    ASSERT(frame());
-    RefPtr<DOMFileSystem> fileSystem = DOMFileSystem::create(frame()->document(), name, static_cast<WebCore::FileSystemType>(type), KURL(ParsedURLString, path.utf8().data()));
-    fileSystem->makeClonable();
-    return toV8(fileSystem.release(), v8::Handle<v8::Object>(), toIsolate(frame()));
-}
-
-v8::Handle<v8::Value> WebFrameImpl::createFileEntry(WebFileSystemType type, const WebString& fileSystemName, const WebString& fileSystemPath, const WebString& filePath, bool isDirectory)
-{
-    ASSERT(frame());
-
-    RefPtr<DOMFileSystemBase> fileSystem = DOMFileSystem::create(frame()->document(), fileSystemName, static_cast<WebCore::FileSystemType>(type), KURL(ParsedURLString, fileSystemPath.utf8().data()));
-    if (isDirectory)
-        return toV8(DirectoryEntry::create(fileSystem, filePath), v8::Handle<v8::Object>(), toIsolate(frame()));
-    return toV8(FileEntry::create(fileSystem, filePath), v8::Handle<v8::Object>(), toIsolate(frame()));
-}
-
 void WebFrameImpl::reload(bool ignoreCache)
 {
     ASSERT(frame());
@@ -1059,6 +1032,11 @@
     // We're shutting down.
     if (!frame()->loader().documentLoader())
         return WebHistoryItem();
+
+    // Lazily update the document state if it was dirtied. Doing it here
+    // avoids synchronously serializing forms as they're changing.
+    frame()->loader().saveDocumentState();
+
     return WebHistoryItem(frame()->page()->historyController().currentItemForExport());
 }
 
@@ -1272,19 +1250,19 @@
     RefPtr<Range> caretRange = frame()->selection().toNormalizedRange();
     if (!caretRange)
         return;
-    Vector<DocumentMarker*> markers = frame()->document()->markers()->markersInRange(caretRange.get(), DocumentMarker::MisspellingMarkers());
+    Vector<DocumentMarker*> markers = frame()->document()->markers().markersInRange(caretRange.get(), DocumentMarker::MisspellingMarkers());
     if (markers.size() < 1 || markers[0]->startOffset() >= markers[0]->endOffset())
         return;
     RefPtr<Range> markerRange = Range::create(caretRange->ownerDocument(), caretRange->startContainer(), markers[0]->startOffset(), caretRange->endContainer(), markers[0]->endOffset());
     if (!markerRange)
         return;
-    frame()->selection().setSelection(markerRange.get(), CharacterGranularity);
+    frame()->selection().setSelection(VisibleSelection(markerRange.get()), CharacterGranularity);
     frame()->editor().replaceSelectionWithText(text, false, false);
 }
 
 void WebFrameImpl::removeSpellingMarkers()
 {
-    frame()->document()->markers()->removeMarkers(DocumentMarker::MisspellingMarkers());
+    frame()->document()->markers().removeMarkers(DocumentMarker::MisspellingMarkers());
 }
 
 bool WebFrameImpl::hasSelection() const
@@ -1333,7 +1311,7 @@
     return createMarkup(range.get(), 0, AnnotateForInterchange, false, ResolveNonLocalURLs);
 }
 
-void WebFrameImpl::selectWordAroundPosition(Frame* frame, VisiblePosition position)
+void WebFrameImpl::selectWordAroundPosition(LocalFrame* frame, VisiblePosition position)
 {
     VisibleSelection selection(position);
     selection.expandUsingGranularity(WordGranularity);
@@ -1500,7 +1478,7 @@
         setMarkerActive(m_activeMatch.get(), false);
 
     if (m_activeMatch && &m_activeMatch->ownerDocument() != frame()->document())
-        m_activeMatch = 0;
+        m_activeMatch = nullptr;
 
     // If the user has selected something since the last Find operation we want
     // to start from there. Otherwise, we start searching from where the last Find
@@ -1539,7 +1517,7 @@
     mainFrameImpl->m_currentActiveMatchFrame = this;
 
     // Make sure no node is focused. See http://crbug.com/38700.
-    frame()->document()->setFocusedElement(0);
+    frame()->document()->setFocusedElement(nullptr);
 
     if (!options.findNext || activeSelection) {
         // This is either a Find operation or a Find-next from a new start point
@@ -1579,7 +1557,7 @@
     cancelPendingScopingEffort();
 
     // Remove all markers for matches found and turn off the highlighting.
-    frame()->document()->markers()->removeMarkers(DocumentMarker::TextMatch);
+    frame()->document()->markers().removeMarkers(DocumentMarker::TextMatch);
     frame()->editor().setMarkedTextMatchesAreHighlighted(false);
     clearFindMatchesCache();
 
@@ -1609,7 +1587,7 @@
         m_lastMatchCount = 0;
         m_nextInvalidateAfter = 0;
 
-        m_resumeScopingFromRange = 0;
+        m_resumeScopingFromRange = nullptr;
 
         // The view might be null on detached frames.
         if (frame() && frame()->page())
@@ -1718,7 +1696,7 @@
 
         Node* shadowTreeRoot = searchRange->shadowRoot();
         if (searchRange->collapsed(exceptionState) && shadowTreeRoot)
-            searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->childNodeCount(), exceptionState);
+            searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->countChildren(), exceptionState);
 
         m_resumeScopingFromRange = resultRange;
         timedOut = (currentTime() - startTime) >= maxScopingDuration;
@@ -1838,7 +1816,7 @@
 void WebFrameImpl::dispatchMessageEventWithOriginCheck(const WebSecurityOrigin& intendedTargetOrigin, const WebDOMEvent& event)
 {
     ASSERT(!event.isNull());
-    frame()->domWindow()->dispatchMessageEventWithOriginCheck(intendedTargetOrigin.get(), event, 0);
+    frame()->domWindow()->dispatchMessageEventWithOriginCheck(intendedTargetOrigin.get(), event, nullptr);
 }
 
 int WebFrameImpl::findMatchMarkersVersion() const
@@ -2004,7 +1982,7 @@
         frame()->selection().clear();
 
         // Make sure no node is focused. See http://crbug.com/38700.
-        frame()->document()->setFocusedElement(0);
+        frame()->document()->setFocusedElement(nullptr);
     }
 
     IntRect activeMatchRect;
@@ -2097,41 +2075,25 @@
     return WebFrameImpl::create(client);
 }
 
-WebFrame* WebFrame::create(WebFrameClient* client, long long embedderIdentifier)
-{
-    return WebFrameImpl::create(client, embedderIdentifier);
-}
-
-long long WebFrame::generateEmbedderIdentifier()
-{
-    static long long next = 0;
-    // Assume that 64-bit will not wrap to -1.
-    return ++next;
-}
-
 WebFrameImpl* WebFrameImpl::create(WebFrameClient* client)
 {
-    return WebFrameImpl::create(client, generateEmbedderIdentifier());
+    return adoptRef(new WebFrameImpl(client)).leakRef();
 }
 
-WebFrameImpl* WebFrameImpl::create(WebFrameClient* client, long long embedderIdentifier)
-{
-    return adoptRef(new WebFrameImpl(client, embedderIdentifier)).leakRef();
-}
-
-WebFrameImpl::WebFrameImpl(WebFrameClient* client, long long embedderIdentifier)
-    : m_frameInit(WebFrameInit::create(this, embedderIdentifier))
+WebFrameImpl::WebFrameImpl(WebFrameClient* client)
+    : m_frameLoaderClientImpl(this)
     , m_parent(0)
     , m_previousSibling(0)
     , m_nextSibling(0)
     , m_firstChild(0)
     , m_lastChild(0)
+    , m_opener(0)
     , m_client(client)
     , m_permissionClient(0)
     , m_currentActiveMatchFrame(0)
     , m_activeMatchIndexInCurrentFrame(-1)
     , m_locatingActiveRect(false)
-    , m_resumeScopingFromRange(0)
+    , m_resumeScopingFromRange(nullptr)
     , m_lastMatchCount(-1)
     , m_totalMatchCount(-1)
     , m_framesScopingCount(-1)
@@ -2149,43 +2111,44 @@
 
 WebFrameImpl::~WebFrameImpl()
 {
+    HashSet<WebFrameImpl*>::iterator end = m_openedFrames.end();
+    for (HashSet<WebFrameImpl*>::iterator it = m_openedFrames.begin(); it != end; ++it)
+        (*it)->m_opener = 0;
+
     blink::Platform::current()->decrementStatsCounter(webFrameActiveCount);
     frameCount--;
 
     cancelPendingScopingEffort();
 }
 
-void WebFrameImpl::setWebCoreFrame(PassRefPtr<WebCore::Frame> frame)
+void WebFrameImpl::setWebCoreFrame(PassRefPtr<WebCore::LocalFrame> frame)
 {
     m_frame = frame;
 }
 
 void WebFrameImpl::initializeAsMainFrame(WebCore::Page* page)
 {
-    m_frameInit->setFrameHost(&page->frameHost());
-    setWebCoreFrame(Frame::create(m_frameInit));
+    setWebCoreFrame(LocalFrame::create(&m_frameLoaderClientImpl, &page->frameHost(), 0));
 
     // We must call init() after m_frame is assigned because it is referenced
     // during init().
     m_frame->init();
 }
 
-PassRefPtr<Frame> WebFrameImpl::createChildFrame(const FrameLoadRequest& request, HTMLFrameOwnerElement* ownerElement)
+PassRefPtr<LocalFrame> WebFrameImpl::createChildFrame(const FrameLoadRequest& request, HTMLFrameOwnerElement* ownerElement)
 {
     ASSERT(m_client);
     WebFrameImpl* webframe = toWebFrameImpl(m_client->createChildFrame(this, request.frameName()));
     if (!webframe)
-        return 0;
+        return nullptr;
 
-    webframe->m_frameInit->setFrameHost(frame()->host());
-    webframe->m_frameInit->setOwnerElement(ownerElement);
-    RefPtr<Frame> childFrame = Frame::create(webframe->m_frameInit);
+    RefPtr<LocalFrame> childFrame = LocalFrame::create(&webframe->m_frameLoaderClientImpl, frame()->host(), ownerElement);
     webframe->setWebCoreFrame(childFrame);
 
     childFrame->tree().setName(request.frameName());
 
     // FIXME: This comment is not quite accurate anymore.
-    // Frame::init() can trigger onload event in the parent frame,
+    // LocalFrame::init() can trigger onload event in the parent frame,
     // which may detach this frame and trigger a null-pointer access
     // in FrameTree::removeChild. Move init() after appendChild call
     // so that webframe->mFrame is in the tree before triggering
@@ -2197,7 +2160,7 @@
     // (b:791612)
     childFrame->init(); // create an empty document
     if (!childFrame->tree().parent())
-        return 0;
+        return nullptr;
 
     // If we're moving in the back/forward list, we might want to replace the content
     // of this child frame with whatever was there at that point.
@@ -2215,7 +2178,7 @@
     // script in the page.
     // NOTE: m_client will be null if this frame has been detached.
     if (!childFrame->tree().parent())
-        return 0;
+        return nullptr;
 
     return childFrame.release();
 }
@@ -2250,17 +2213,20 @@
         webView->suppressInvalidations(false);
 }
 
-WebFrameImpl* WebFrameImpl::fromFrame(Frame* frame)
+WebFrameImpl* WebFrameImpl::fromFrame(LocalFrame* frame)
 {
     if (!frame)
         return 0;
-    return toFrameLoaderClientImpl(frame->loader().client())->webFrame();
+    FrameLoaderClient* client = frame->loader().client();
+    if (!client || !client->isFrameLoaderClientImpl())
+        return 0;
+    return toFrameLoaderClientImpl(client)->webFrame();
 }
 
 WebFrameImpl* WebFrameImpl::fromFrameOwnerElement(Element* element)
 {
     // FIXME: Why do we check specifically for <iframe> and <frame> here? Why can't we get the WebFrameImpl from an <object> element, for example.
-    if (!element || !element->isFrameOwnerElement() || (!element->hasTagName(HTMLNames::iframeTag) && !element->hasTagName(HTMLNames::frameTag)))
+    if (!element || !element->isFrameOwnerElement() || (!isHTMLIFrameElement(*element) && !isHTMLFrameElement(*element)))
         return 0;
     return fromFrame(toHTMLFrameOwnerElement(element)->contentFrame());
 }
@@ -2297,9 +2263,10 @@
         // example, focus links if we have found text within the link.
         Node* node = m_activeMatch->firstNode();
         if (node && node->isInShadowTree()) {
-            Node* host = node->deprecatedShadowAncestorNode();
-            if (host->hasTagName(HTMLNames::inputTag) || host->hasTagName(HTMLNames::textareaTag))
-                node = host;
+            if (Node* host = node->shadowHost()) {
+                if (isHTMLInputElement(*host) || isHTMLTextAreaElement(*host))
+                    node = host;
+            }
         }
         for (; node; node = node->parentNode()) {
             if (!node->isElementNode())
@@ -2308,7 +2275,7 @@
             if (element->isFocusable()) {
                 // Found a focusable parent node. Set the active match as the
                 // selection and focus to the focusable node.
-                frame()->selection().setSelection(m_activeMatch.get());
+                frame()->selection().setSelection(VisibleSelection(m_activeMatch.get()));
                 frame()->document()->setFocusedElement(element);
                 return;
             }
@@ -2333,8 +2300,8 @@
         // you'll have the last thing you found highlighted) and make sure that
         // we have nothing focused (otherwise you might have text selected but
         // a link focused, which is weird).
-        frame()->selection().setSelection(m_activeMatch.get());
-        frame()->document()->setFocusedElement(0);
+        frame()->selection().setSelection(VisibleSelection(m_activeMatch.get()));
+        frame()->document()->setFocusedElement(nullptr);
 
         // Finally clear the active match, for two reasons:
         // We just finished the find 'session' and we don't want future (potentially
@@ -2342,7 +2309,7 @@
         // The WebFrameImpl could get reused and the m_activeMatch could end up pointing
         // to a document that is no longer valid. Keeping an invalid reference around
         // is just asking for trouble.
-        m_activeMatch = 0;
+        m_activeMatch = nullptr;
     }
 }
 
@@ -2397,14 +2364,14 @@
 
 void WebFrameImpl::addMarker(Range* range, bool activeMatch)
 {
-    frame()->document()->markers()->addTextMatchMarker(range, activeMatch);
+    frame()->document()->markers().addTextMatchMarker(range, activeMatch);
 }
 
 void WebFrameImpl::setMarkerActive(Range* range, bool active)
 {
     if (!range || range->collapsed(IGNORE_EXCEPTION))
         return;
-    frame()->document()->markers()->setMarkersActive(range, active);
+    frame()->document()->markers().setMarkersActive(range, active);
 }
 
 int WebFrameImpl::ordinalOfFirstMatchForFrame(WebFrameImpl* frame) const
diff --git a/Source/web/WebFrameImpl.h b/Source/web/WebFrameImpl.h
index 90a8bac..bb7df4d 100644
--- a/Source/web/WebFrameImpl.h
+++ b/Source/web/WebFrameImpl.h
@@ -34,10 +34,11 @@
 #include "WebFrame.h"
 
 #include "FrameLoaderClientImpl.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "platform/geometry/FloatRect.h"
 #include "public/platform/WebFileSystemType.h"
 #include "wtf/Compiler.h"
+#include "wtf/HashSet.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
@@ -79,7 +80,6 @@
     virtual WebString uniqueName() const OVERRIDE;
     virtual WebString assignedName() const OVERRIDE;
     virtual void setName(const WebString&) OVERRIDE;
-    virtual long long embedderIdentifier() const OVERRIDE;
     virtual WebVector<WebIconURL> iconURLs(int iconTypesMask) const OVERRIDE;
     virtual void setIsRemote(bool) OVERRIDE;
     virtual void setRemoteWebLayer(WebLayer*) OVERRIDE;
@@ -96,7 +96,7 @@
     virtual bool hasVerticalScrollbar() const OVERRIDE;
     virtual WebView* view() const OVERRIDE;
     virtual WebFrame* opener() const OVERRIDE;
-    virtual void setOpener(const WebFrame*) OVERRIDE;
+    virtual void setOpener(WebFrame*) OVERRIDE;
     virtual void appendChild(WebFrame*) OVERRIDE;
     virtual void removeChild(WebFrame*) OVERRIDE;
     virtual WebFrame* parent() const OVERRIDE;
@@ -130,21 +130,10 @@
         int extensionGroup, WebVector<v8::Local<v8::Value> >* results) OVERRIDE;
     virtual v8::Handle<v8::Value> callFunctionEvenIfScriptDisabled(
         v8::Handle<v8::Function>,
-        v8::Handle<v8::Object>,
+        v8::Handle<v8::Value>,
         int argc,
         v8::Handle<v8::Value> argv[]) OVERRIDE;
     virtual v8::Local<v8::Context> mainWorldScriptContext() const OVERRIDE;
-    virtual v8::Handle<v8::Value> createFileSystem(WebFileSystemType,
-        const WebString& name,
-        const WebString& path) OVERRIDE;
-    virtual v8::Handle<v8::Value> createSerializableFileSystem(WebFileSystemType,
-        const WebString& name,
-        const WebString& path) OVERRIDE;
-    virtual v8::Handle<v8::Value> createFileEntry(WebFileSystemType,
-        const WebString& fileSystemName,
-        const WebString& fileSystemPath,
-        const WebString& filePath,
-        bool isDirectory) OVERRIDE;
     virtual void reload(bool ignoreCache) OVERRIDE;
     virtual void reloadWithOverrideURL(const WebURL& overrideUrl, bool ignoreCache) OVERRIDE;
     virtual void loadRequest(const WebURLRequest&) OVERRIDE;
@@ -241,32 +230,29 @@
     void willDetachParent();
 
     static WebFrameImpl* create(WebFrameClient*);
-    // FIXME: Move the embedderIdentifier concept fully to the embedder and
-    // remove this factory method.
-    static WebFrameImpl* create(WebFrameClient*, long long embedderIdentifier);
     virtual ~WebFrameImpl();
 
     // Called by the WebViewImpl to initialize the main frame for the page.
     void initializeAsMainFrame(WebCore::Page*);
 
-    PassRefPtr<WebCore::Frame> createChildFrame(
+    PassRefPtr<WebCore::LocalFrame> createChildFrame(
         const WebCore::FrameLoadRequest&, WebCore::HTMLFrameOwnerElement*);
 
     void didChangeContentsSize(const WebCore::IntSize&);
 
     void createFrameView();
 
-    static WebFrameImpl* fromFrame(WebCore::Frame* frame);
+    static WebFrameImpl* fromFrame(WebCore::LocalFrame* frame);
     static WebFrameImpl* fromFrameOwnerElement(WebCore::Element* element);
 
     // If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
     // that hosts the plugin.
-    static WebPluginContainerImpl* pluginContainerFromFrame(WebCore::Frame*);
+    static WebPluginContainerImpl* pluginContainerFromFrame(WebCore::LocalFrame*);
 
     // If the frame hosts a PluginDocument, this method returns the WebPluginContainerImpl
     // that hosts the plugin. If the provided node is a plugin, then it runs its
     // WebPluginContainerImpl.
-    static WebPluginContainerImpl* pluginContainerFromNode(WebCore::Frame*, const WebNode&);
+    static WebPluginContainerImpl* pluginContainerFromNode(WebCore::LocalFrame*, const WebNode&);
 
     WebViewImpl* viewImpl() const;
 
@@ -301,7 +287,7 @@
     // Otherwise, disallow scrolling.
     virtual void setCanHaveScrollbars(bool) OVERRIDE;
 
-    WebCore::Frame* frame() const { return m_frame.get(); }
+    WebCore::LocalFrame* frame() const { return m_frame.get(); }
     WebFrameClient* client() const { return m_client; }
     void setClient(WebFrameClient* client) { m_client = client; }
 
@@ -310,7 +296,7 @@
 
     void setInputEventsTransformForEmulation(const WebCore::IntSize&, float);
 
-    static void selectWordAroundPosition(WebCore::Frame*, WebCore::VisiblePosition);
+    static void selectWordAroundPosition(WebCore::LocalFrame*, WebCore::VisiblePosition);
 
 private:
     class DeferredScopeStringMatches;
@@ -338,10 +324,10 @@
       InvalidateAll          // Both content area and the scrollbar.
     };
 
-    WebFrameImpl(WebFrameClient*, long long frame_identifier);
+    explicit WebFrameImpl(WebFrameClient*);
 
     // Sets the local WebCore frame and registers destruction observers.
-    void setWebCoreFrame(PassRefPtr<WebCore::Frame>);
+    void setWebCoreFrame(PassRefPtr<WebCore::LocalFrame>);
 
     // Notifies the delegate about a new selection rect.
     void reportFindInPageSelection(
@@ -420,35 +406,22 @@
     // Returns a hit-tested VisiblePosition for the given point
     WebCore::VisiblePosition visiblePositionForWindowPoint(const WebPoint&);
 
-    class WebFrameInit : public WebCore::FrameInit {
-    public:
-        static PassRefPtr<WebFrameInit> create(WebFrameImpl* webFrameImpl, int64_t frameID)
-        {
-            return adoptRef(new WebFrameInit(webFrameImpl, frameID));
-        }
+    FrameLoaderClientImpl m_frameLoaderClientImpl;
 
-    private:
-        WebFrameInit(WebFrameImpl* webFrameImpl, int64_t frameID)
-            : WebCore::FrameInit(frameID)
-            , m_frameLoaderClientImpl(webFrameImpl)
-        {
-            setFrameLoaderClient(&m_frameLoaderClientImpl);
-        }
-
-        FrameLoaderClientImpl m_frameLoaderClientImpl;
-    };
-    RefPtr<WebFrameInit> m_frameInit;
-
-    // The embedder retains a reference to the WebCore Frame while it is active in the DOM. This
+    // The embedder retains a reference to the WebCore LocalFrame while it is active in the DOM. This
     // reference is released when the frame is removed from the DOM or the entire page is closed.
-    RefPtr<WebCore::Frame> m_frame;
+    // FIXME: These will need to change to WebFrame when we introduce WebFrameProxy.
+    RefPtr<WebCore::LocalFrame> m_frame;
     WebFrameImpl* m_parent;
     WebFrameImpl* m_previousSibling;
     WebFrameImpl* m_nextSibling;
     WebFrameImpl* m_firstChild;
     WebFrameImpl* m_lastChild;
 
-    // Indicate whether the current Frame is local or remote. Remote frames are
+    WebFrameImpl* m_opener;
+    WTF::HashSet<WebFrameImpl*> m_openedFrames;
+
+    // Indicate whether the current LocalFrame is local or remote. Remote frames are
     // rendered in a different process from their parent frames.
     bool m_isRemote;
 
diff --git a/Source/web/WebHelperPluginImpl.cpp b/Source/web/WebHelperPluginImpl.cpp
index a63f4ca..8abb23b 100644
--- a/Source/web/WebHelperPluginImpl.cpp
+++ b/Source/web/WebHelperPluginImpl.cpp
@@ -31,239 +31,82 @@
 #include "config.h"
 #include "WebHelperPluginImpl.h"
 
-#include "PageWidgetDelegate.h"
-#include "WebDocument.h"
-#include "WebFrameClient.h"
 #include "WebFrameImpl.h"
 #include "WebPlugin.h"
 #include "WebPluginContainerImpl.h"
-#include "WebViewClient.h"
-#include "WebViewImpl.h"
-#include "WebWidgetClient.h"
-#include "core/html/HTMLCollection.h"
-#include "core/html/HTMLPlugInElement.h"
-#include "core/loader/EmptyClients.h"
-#include "core/loader/FrameLoadRequest.h"
-#include "core/page/FocusController.h"
-#include "core/frame/FrameView.h"
-#include "core/page/Page.h"
-#include "core/frame/Settings.h"
+#include "core/html/HTMLObjectElement.h"
+#include "core/loader/FrameLoader.h"
+#include "core/loader/FrameLoaderClient.h"
 
 using namespace WebCore;
 
 namespace blink {
 
-static const char documentStartLiteral[] = "<!DOCTYPE html><head><meta charset='UTF-8'></head><body>\n<object type=\"";
-static const char documentEndLiteral[] = "\"></object></body>\n";
+DEFINE_TYPE_CASTS(WebHelperPluginImpl, WebHelperPlugin, plugin, true, true);
 
-static void writeDocument(const WebString& pluginType, const WebURL& url, WebCore::FrameLoader& loader)
+WebHelperPlugin* WebHelperPlugin::create(const WebString& pluginType, WebFrame* frame)
 {
-    RefPtr<SharedBuffer> data = SharedBuffer::create();
-    data->append(documentStartLiteral, sizeof(documentStartLiteral) - 1);
-    data->append(pluginType.utf8().data(), pluginType.utf8().length());
-    data->append(documentEndLiteral, sizeof(documentEndLiteral) - 1);
-
-    loader.load(FrameLoadRequest(0, ResourceRequest(url.isValid() ? KURL(url) : blankURL()), SubstituteData(data, "text/html", "UTF-8", KURL(), ForceSynchronousLoad)));
+    OwnPtr<WebHelperPlugin> plugin = adoptPtr<WebHelperPlugin>(new WebHelperPluginImpl());
+    if (!toWebHelperPluginImpl(plugin.get())->initialize(pluginType, toWebFrameImpl(frame)))
+        return 0;
+    return plugin.leakPtr();
 }
 
-class HelperPluginChromeClient : public EmptyChromeClient {
-    WTF_MAKE_NONCOPYABLE(HelperPluginChromeClient);
-    WTF_MAKE_FAST_ALLOCATED;
-
-public:
-    explicit HelperPluginChromeClient(WebHelperPluginImpl* widget)
-        : m_widget(widget)
-    {
-        ASSERT(m_widget->m_widgetClient);
-    }
-
-private:
-    virtual void closeWindowSoon() OVERRIDE
-    {
-        // This should never be called since the only way to close the
-        // invisible page is via closeAndDelete().
-        RELEASE_ASSERT_NOT_REACHED();
-    }
-
-    virtual void* webView() const OVERRIDE
-    {
-        return m_widget->m_webView;
-    }
-
-    WebHelperPluginImpl* m_widget;
-};
-
-// HelperPluginFrameClient acts as a filter to only forward messages onto the
-// main render frame that WebHelperPlugin actually needs. This prevents
-// having the WebHelperPlugin's frame accidentally signaling events on the
-// client that are meant only for WebFrames which are part of the main DOM.
-class HelperPluginFrameClient : public WebFrameClient {
-public:
-    HelperPluginFrameClient(WebFrameClient* hostWebFrameClient)
-        : m_hostWebFrameClient(hostWebFrameClient)
-    {
-    }
-
-    virtual ~HelperPluginFrameClient()
-    {
-    }
-
-    virtual WebPlugin* createPlugin(blink::WebFrame* frame, const WebPluginParams& params)
-    {
-        return m_hostWebFrameClient->createPlugin(frame, params);
-    }
-
-private:
-    WebFrameClient* m_hostWebFrameClient;
-};
-
-
-// WebHelperPluginImpl ----------------------------------------------------------------
-
-WebHelperPluginImpl::WebHelperPluginImpl(WebWidgetClient* client)
-    : m_widgetClient(client)
-    , m_webView(0)
-    , m_mainFrame(0)
+WebHelperPluginImpl::WebHelperPluginImpl()
+    : m_destructionTimer(this, &WebHelperPluginImpl::reallyDestroy)
 {
-    ASSERT(client);
 }
 
 WebHelperPluginImpl::~WebHelperPluginImpl()
 {
-    ASSERT(!m_page);
-    ASSERT(!m_widgetClient); // Should only be called via close().
 }
 
-bool WebHelperPluginImpl::initialize(const String& pluginType, const WebDocument& hostDocument, WebViewImpl* webView)
+bool WebHelperPluginImpl::initialize(const String& pluginType, WebFrameImpl* frame)
 {
-    ASSERT(webView);
-    m_webView = webView;
+    ASSERT(!m_objectElement && !m_pluginContainer);
+    if (!frame->frame()->loader().client())
+        return false;
 
-    return initializePage(pluginType, hostDocument);
+    m_objectElement = HTMLObjectElement::create(*frame->frame()->document(), 0, false);
+    Vector<String> attributeNames;
+    Vector<String> attributeValues;
+    ASSERT(frame->frame()->document()->url().isValid());
+    m_pluginContainer = adoptRef(toWebPluginContainerImpl(frame->frame()->loader().client()->createPlugin(
+        m_objectElement.get(),
+        frame->frame()->document()->url(),
+        attributeNames,
+        attributeValues,
+        pluginType,
+        false,
+        FrameLoaderClient::AllowDetachedPlugin).leakRef()));
+
+    if (!m_pluginContainer)
+        return false;
+
+    // Getting a placeholder plugin is also failure, since it's not the plugin the caller needed.
+    return !getPlugin()->isPlaceholder();
 }
 
-void WebHelperPluginImpl::closeAndDelete()
+void WebHelperPluginImpl::reallyDestroy(Timer<WebHelperPluginImpl>*)
 {
-    if (m_page) {
-        m_page->clearPageGroup();
-        m_page->mainFrame()->loader().stopAllLoaders();
-    }
-
-    // We must destroy the page now in case the host page is being destroyed, in
-    // which case some of the objects the page depends on may have been
-    // destroyed by the time this->close() is called asynchronously.
-    destroyPage();
-
-    // closeWidgetSoon() will call this->close() later.
-    m_widgetClient->closeWidgetSoon();
-
-    m_mainFrame->close();
-    m_mainFrame = 0;
-}
-
-void WebHelperPluginImpl::closeAndDeleteSoon()
-{
-    m_webView->closeAndDeleteHelperPluginSoon(this);
-}
-
-void WebHelperPluginImpl::initializeFrame(WebFrameClient* client)
-{
-    ASSERT(m_page);
-    ASSERT(!m_frameClient);
-    m_frameClient = adoptPtr(new HelperPluginFrameClient(client));
-    m_mainFrame = WebFrameImpl::create(m_frameClient.get());
-    m_mainFrame->initializeAsMainFrame(m_page.get());
-}
-
-// Returns a pointer to the WebPlugin by finding the single <object> tag in the page.
-WebPlugin* WebHelperPluginImpl::getPlugin()
-{
-    ASSERT(m_page);
-
-    RefPtr<HTMLCollection> objectElements = m_page->mainFrame()->document()->getElementsByTagName(WebCore::HTMLNames::objectTag.localName());
-    ASSERT(objectElements && objectElements->length() == 1);
-    if (!objectElements || objectElements->length() < 1)
-        return 0;
-    Element* element = objectElements->item(0);
-    ASSERT(element->hasTagName(WebCore::HTMLNames::objectTag));
-    WebCore::Widget* widget = toHTMLPlugInElement(element)->pluginWidget();
-    if (!widget)
-        return 0;
-    WebPlugin* plugin = toWebPluginContainerImpl(widget)->plugin();
-    ASSERT(plugin);
-    // If the plugin is a placeholder, it is not useful to the caller, and it
-    // could be replaced at any time. Therefore, do not return it.
-    if (plugin->isPlaceholder())
-        return 0;
-
-    // The plugin was instantiated and will outlive this object.
-    return plugin;
-}
-
-bool WebHelperPluginImpl::initializePage(const WebString& pluginType, const WebDocument& hostDocument)
-{
-    Page::PageClients pageClients;
-    fillWithEmptyClients(pageClients);
-    m_chromeClient = adoptPtr(new HelperPluginChromeClient(this));
-    pageClients.chromeClient = m_chromeClient.get();
-
-    m_page = adoptPtr(new Page(pageClients));
-    ASSERT(!m_page->settings().scriptEnabled());
-    m_page->settings().setPluginsEnabled(true);
-
-    m_webView->client()->initializeHelperPluginWebFrame(this);
-
-    // The page's main frame was set in initializeFrame() as a result of the above call.
-    Frame* frame = m_page->mainFrame();
-    ASSERT(frame);
-    frame->loader().forceSandboxFlags(SandboxAll & ~SandboxPlugins);
-    frame->setView(FrameView::create(frame));
-    // No need to set a size or make it not transparent.
-
-    writeDocument(pluginType, hostDocument.url(), frame->loader());
-
-    return true;
-}
-
-void WebHelperPluginImpl::destroyPage()
-{
-    if (!m_page)
-        return;
-
-    if (m_page->mainFrame())
-        m_page->mainFrame()->loader().frameDetached();
-
-    m_page.clear();
-}
-
-void WebHelperPluginImpl::layout()
-{
-    PageWidgetDelegate::layout(m_page.get());
-}
-
-void WebHelperPluginImpl::setFocus(bool)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void WebHelperPluginImpl::close()
-{
-    RELEASE_ASSERT(!m_page); // Should only be called via closeAndDelete().
-    RELEASE_ASSERT(!m_mainFrame); // This function must be called asynchronously, after closeAndDelete() completes.
-    m_widgetClient = 0;
     delete this;
 }
 
-// WebHelperPlugin ----------------------------------------------------------------
-
-WebHelperPlugin* WebHelperPlugin::create(WebWidgetClient* client)
+void WebHelperPluginImpl::destroy()
 {
-    RELEASE_ASSERT(client);
+    // Defer deletion so we don't do too much work when called via stopActiveDOMObjects().
+    // FIXME: It's not clear why we still need this. The original code held a Page and a
+    // WebFrame, and destroying it would cause JavaScript triggered by frame detach to run,
+    // which isn't allowed inside stopActiveDOMObjects(). Removing this causes one Chrome test
+    // to fail with a timeout.
+    m_destructionTimer.startOneShot(0, FROM_HERE);
+}
 
-    // The returned object is owned by the caller, which must destroy it by
-    // calling closeAndDelete(). The WebWidgetClient must not call close()
-    // other than as a result of closeAndDelete().
-    return new WebHelperPluginImpl(client);
+WebPlugin* WebHelperPluginImpl::getPlugin()
+{
+    ASSERT(m_pluginContainer);
+    ASSERT(m_pluginContainer->plugin());
+    return m_pluginContainer->plugin();
 }
 
 } // namespace blink
diff --git a/Source/web/WebHelperPluginImpl.h b/Source/web/WebHelperPluginImpl.h
index 2f9ec7b..c48b25c 100644
--- a/Source/web/WebHelperPluginImpl.h
+++ b/Source/web/WebHelperPluginImpl.h
@@ -32,64 +32,47 @@
 #define WebHelperPluginImpl_h
 
 #include "WebHelperPlugin.h"
-#include "wtf/OwnPtr.h"
+#include "platform/Timer.h"
+#include "wtf/FastAllocBase.h"
+#include "wtf/Noncopyable.h"
+#include "wtf/PassOwnPtr.h"
+#include "wtf/RefPtr.h"
+#include "wtf/text/WTFString.h"
 
 namespace WebCore {
-class Page;
-}
+class HTMLObjectElement;
+} // namespace WebCore
 
 namespace blink {
 
-class HelperPluginChromeClient;
-class HelperPluginFrameClient;
-class WebDocument;
 class WebFrameImpl;
-class WebViewImpl;
-class WebWidgetClient;
+class WebPluginContainerImpl;
 
-// Hosts a simple page that instantiates a plugin using an <object> tag.
-// The widget is offscreen, and the plugin will not receive painting, resize, etc. events.
+// Utility class to host helper plugins for media. Internally, it creates a detached
+// HTMLPluginElement to host the plugin and uses FrameLoaderClient::createPlugin() to instantiate
+// the requested plugin.
 class WebHelperPluginImpl FINAL : public WebHelperPlugin {
     WTF_MAKE_NONCOPYABLE(WebHelperPluginImpl);
     WTF_MAKE_FAST_ALLOCATED;
-
 public:
     // WebHelperPlugin methods:
-    virtual void initializeFrame(WebFrameClient*) OVERRIDE;
     virtual WebPlugin* getPlugin() OVERRIDE;
-    virtual void closeAndDeleteSoon() OVERRIDE;
-
-    bool initialize(const String& pluginType, const WebDocument& hostDocument, WebViewImpl*);
-    // Called asynchronously and only by WebViewImpl.
-    void closeAndDelete();
+    virtual void destroy() OVERRIDE;
 
 private:
-    explicit WebHelperPluginImpl(WebWidgetClient*);
-    bool initializePage(const WebString& pluginType, const WebDocument& hostDocument);
-    void destroyPage();
+    friend class WebHelperPlugin;
 
-    // This object needs to be destroyed by calling closeAndDelete().
+    WebHelperPluginImpl();
     virtual ~WebHelperPluginImpl();
 
-    // WebWidget methods:
-    virtual void layout() OVERRIDE;
-    virtual void setFocus(bool) OVERRIDE;
-    virtual void close() OVERRIDE;
-    virtual bool isHelperPlugin() const OVERRIDE { return true; }
+    bool initialize(const String& pluginType, WebFrameImpl*);
+    void reallyDestroy(WebCore::Timer<WebHelperPluginImpl>*);
 
-    WebWidgetClient* m_widgetClient;
-    WebViewImpl* m_webView;
-    WebFrameImpl* m_mainFrame;
-    OwnPtr<WebCore::Page> m_page;
-    OwnPtr<HelperPluginChromeClient> m_chromeClient;
-    OwnPtr<HelperPluginFrameClient> m_frameClient;
-
-    friend class WebHelperPlugin;
-    friend class HelperPluginChromeClient;
+    WebCore::Timer<WebHelperPluginImpl> m_destructionTimer;
+    RefPtr<WebCore::HTMLObjectElement> m_objectElement;
+    RefPtr<WebPluginContainerImpl> m_pluginContainer;
 };
 
-DEFINE_TYPE_CASTS(WebHelperPluginImpl, WebWidget, widget, widget->isHelperPlugin(), widget.isHelperPlugin());
-
 } // namespace blink
 
 #endif // WebHelperPluginImpl_h
diff --git a/Source/web/WebHistoryItem.cpp b/Source/web/WebHistoryItem.cpp
index 79e59a3..eeef08f 100644
--- a/Source/web/WebHistoryItem.cpp
+++ b/Source/web/WebHistoryItem.cpp
@@ -96,17 +96,6 @@
     m_private->setURLString(KURL(ParsedURLString, url).string());
 }
 
-WebString WebHistoryItem::originalURLString() const
-{
-    return m_private->originalURLString();
-}
-
-void WebHistoryItem::setOriginalURLString(const WebString& originalURLString)
-{
-    ensureMutable();
-    m_private->setOriginalURLString(originalURLString);
-}
-
 WebString WebHistoryItem::referrer() const
 {
     return m_private->referrer().referrer;
@@ -193,17 +182,6 @@
     m_private->setDocumentSequenceNumber(documentSequenceNumber);
 }
 
-long long WebHistoryItem::targetFrameID() const
-{
-    return m_private->targetFrameID();
-}
-
-void WebHistoryItem::setTargetFrameID(long long targetFrameID)
-{
-    ensureMutable();
-    m_private->setTargetFrameID(targetFrameID);
-}
-
 WebSerializedScriptValue WebHistoryItem::stateObject() const
 {
     return WebSerializedScriptValue(m_private->stateObject());
diff --git a/Source/web/WebIDBDatabaseError.cpp b/Source/web/WebIDBDatabaseError.cpp
index 9e5aaa6..43d647b 100644
--- a/Source/web/WebIDBDatabaseError.cpp
+++ b/Source/web/WebIDBDatabaseError.cpp
@@ -58,7 +58,7 @@
     m_private.reset();
 }
 
-WebIDBDatabaseError::operator PassRefPtr<DOMError>() const
+WebIDBDatabaseError::operator PassRefPtrWillBeRawPtr<DOMError>() const
 {
     return m_private.get();
 }
diff --git a/Source/web/WebIDBKey.cpp b/Source/web/WebIDBKey.cpp
index c61b0d6..589b20b 100644
--- a/Source/web/WebIDBKey.cpp
+++ b/Source/web/WebIDBKey.cpp
@@ -187,7 +187,7 @@
 
 void WebIDBKey::assignNull()
 {
-    m_private = 0;
+    m_private.reset();
 }
 
 void WebIDBKey::reset()
diff --git a/Source/web/WebIDBKeyRange.cpp b/Source/web/WebIDBKeyRange.cpp
index 7ebf607..c6d1914 100644
--- a/Source/web/WebIDBKeyRange.cpp
+++ b/Source/web/WebIDBKeyRange.cpp
@@ -42,7 +42,7 @@
 void WebIDBKeyRange::assign(const WebIDBKey& lower, const WebIDBKey& upper, bool lowerOpen, bool upperOpen)
 {
     if (!lower.isValid() && !upper.isValid())
-        m_private = 0;
+        m_private.reset();
     else
         m_private = IDBKeyRange::create(lower, upper, lowerOpen ? IDBKeyRange::LowerBoundOpen : IDBKeyRange::LowerBoundClosed, upperOpen ? IDBKeyRange::UpperBoundOpen : IDBKeyRange::UpperBoundClosed);
 }
diff --git a/Source/web/WebInputElement.cpp b/Source/web/WebInputElement.cpp
index c8e145e..e11deb6 100644
--- a/Source/web/WebInputElement.cpp
+++ b/Source/web/WebInputElement.cpp
@@ -77,11 +77,6 @@
     return constUnwrap<HTMLInputElement>()->isCheckbox();
 }
 
-bool WebInputElement::autoComplete() const
-{
-    return constUnwrap<HTMLInputElement>()->shouldAutocomplete();
-}
-
 int WebInputElement::maxLength() const
 {
     return constUnwrap<HTMLInputElement>()->maxLength();
@@ -102,51 +97,11 @@
     return constUnwrap<HTMLInputElement>()->size();
 }
 
-void WebInputElement::setValue(const WebString& value, bool sendChangeEvent)
-{
-    unwrap<HTMLInputElement>()->setValue(value, sendChangeEvent ? DispatchChangeEvent : DispatchNoEvent);
-}
-
-WebString WebInputElement::value() const
-{
-    return constUnwrap<HTMLInputElement>()->value();
-}
-
-WebString WebInputElement::editingValue() const
-{
-    return constUnwrap<HTMLInputElement>()->innerTextValue();
-}
-
 void WebInputElement::setEditingValue(const WebString& value)
 {
     unwrap<HTMLInputElement>()->setEditingValue(value);
 }
 
-void WebInputElement::setSuggestedValue(const WebString& value)
-{
-    unwrap<HTMLInputElement>()->setSuggestedValue(value);
-}
-
-WebString WebInputElement::suggestedValue() const
-{
-    return constUnwrap<HTMLInputElement>()->suggestedValue();
-}
-
-void WebInputElement::setSelectionRange(int start, int end)
-{
-    unwrap<HTMLInputElement>()->setSelectionRange(start, end);
-}
-
-int WebInputElement::selectionStart() const
-{
-    return constUnwrap<HTMLInputElement>()->selectionStart();
-}
-
-int WebInputElement::selectionEnd() const
-{
-    return constUnwrap<HTMLInputElement>()->selectionEnd();
-}
-
 bool WebInputElement::isValidValue(const WebString& value) const
 {
     return constUnwrap<HTMLInputElement>()->isValidValue(value);
@@ -226,11 +181,6 @@
     return HTMLInputElement::maximumLength;
 }
 
-WebString WebInputElement::directionForFormData() const
-{
-    return constUnwrap<HTMLInputElement>()->directionForFormData();
-}
-
 // FIXME: Remove this once password_generation_manager.h stops using it.
 WebElement WebInputElement::decorationElementFor(void*)
 {
@@ -265,7 +215,7 @@
 
 WebInputElement* toWebInputElement(WebElement* webElement)
 {
-    if (!webElement->unwrap<Element>()->hasTagName(HTMLNames::inputTag))
+    if (!isHTMLInputElement(*webElement->unwrap<Element>()))
         return 0;
 
     return static_cast<WebInputElement*>(webElement);
diff --git a/Source/web/WebInputEventConversion.cpp b/Source/web/WebInputEventConversion.cpp
index 755c16b..36b26c7 100644
--- a/Source/web/WebInputEventConversion.cpp
+++ b/Source/web/WebInputEventConversion.cpp
@@ -407,7 +407,7 @@
     m_id = point.id;
     m_state = toPlatformTouchPointState(point.state);
     m_pos = widget->convertFromContainingWindow(IntPoint((point.position.x - offset.width()) / scale, (point.position.y - offset.height()) / scale));
-    m_screenPos = point.screenPosition;
+    m_screenPos = IntPoint(point.screenPosition.x, point.screenPosition.y);
     m_radiusY = point.radiusY / scale;
     m_radiusX = point.radiusX / scale;
     m_rotationAngle = point.rotationAngle;
@@ -704,7 +704,7 @@
 
         WebTouchPoint point;
         point.id = touch->identifier();
-        point.screenPosition = WebPoint(touch->screenX(), touch->screenY());
+        point.screenPosition = WebFloatPoint(touch->screenX(), touch->screenY());
         point.position = convertAbsoluteLocationForRenderObject(touch->absoluteLocation(), *renderObject);
         point.radiusX = touch->webkitRadiusX();
         point.radiusY = touch->webkitRadiusY();
diff --git a/Source/web/WebInputEventFactoryMac.mm b/Source/web/WebInputEventFactoryMac.mm
index 516ae2f..303fb04 100644
--- a/Source/web/WebInputEventFactoryMac.mm
+++ b/Source/web/WebInputEventFactoryMac.mm
@@ -366,19 +366,6 @@
     return windowsKeyCodeForKeyCode([event keyCode]);
 }
 
-static WebInputEvent::Type gestureEventTypeForEvent(NSEvent *event)
-{
-    switch ([event type]) {
-    case NSEventTypeBeginGesture:
-        return WebInputEvent::GestureScrollBegin;
-    case NSEventTypeEndGesture:
-        return WebInputEvent::GestureScrollEnd;
-    default:
-        ASSERT_NOT_REACHED();
-        return WebInputEvent::GestureScrollEnd;
-    }
-}
-
 static inline NSString* textFromEvent(NSEvent* event)
 {
     if ([event type] == NSFlagsChanged)
@@ -1138,10 +1125,21 @@
     result.globalX = temp.globalX;
     result.globalY = temp.globalY;
 
-    result.type = gestureEventTypeForEvent(event);
     result.modifiers = modifiersFromEvent(event);
     result.timeStampSeconds = [event timestamp];
 
+    // MacOS X gestures are used only for pinch support.
+    result.sourceDevice = WebGestureEvent::Touchpad;
+    switch ([event type]) {
+    case NSEventTypeMagnify:
+        result.type = WebInputEvent::GesturePinchUpdate;
+        result.data.pinchUpdate.scale = [event magnification];
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        result.type = WebInputEvent::Undefined;
+    }
+
     return result;
 }
 
diff --git a/Source/web/WebKitUnitTests.isolate b/Source/web/WebKitUnitTests.isolate
index 32bd871..2ac4a56 100644
--- a/Source/web/WebKitUnitTests.isolate
+++ b/Source/web/WebKitUnitTests.isolate
@@ -43,4 +43,8 @@
       },
     }],
   ],
+  # Required on Android to copy icudtl.dat to a device.
+  'includes': [
+    "../../../../third_party/icu/icu.isolate",
+  ],
 }
diff --git a/Source/web/WebLeakDetector.cpp b/Source/web/WebLeakDetector.cpp
index b0093a1..66e3283 100644
--- a/Source/web/WebLeakDetector.cpp
+++ b/Source/web/WebLeakDetector.cpp
@@ -35,6 +35,7 @@
 #include "bindings/v8/V8Binding.h"
 #include "core/fetch/MemoryCache.h"
 #include "core/fetch/ResourceFetcher.h"
+#include "core/frame/DOMWindow.h"
 #include "core/inspector/InspectorCounters.h"
 #include "public/web/WebDocument.h"
 #include "public/web/WebFrame.h"
@@ -53,7 +54,7 @@
 
     // FIXME: HTML5 Notification should be closed because notification affects the result of number of DOM objects.
 
-    ResourceFetcher* fetcher = currentDocument(context->GetIsolate())->fetcher();
+    ResourceFetcher* fetcher = currentDOMWindow(context->GetIsolate())->document()->fetcher();
     if (fetcher)
         fetcher->garbageCollectDocumentResources();
 
diff --git a/Source/web/WebMIDIPermissionRequest.cpp b/Source/web/WebMIDIPermissionRequest.cpp
index a3d1a36..b6147bd 100644
--- a/Source/web/WebMIDIPermissionRequest.cpp
+++ b/Source/web/WebMIDIPermissionRequest.cpp
@@ -40,12 +40,7 @@
 
 namespace blink {
 
-WebMIDIPermissionRequest::WebMIDIPermissionRequest(const PassRefPtr<WebCore::MIDIAccess>& midi)
-    : m_private(midi)
-{
-}
-
-WebMIDIPermissionRequest::WebMIDIPermissionRequest(WebCore::MIDIAccess* midi)
+WebMIDIPermissionRequest::WebMIDIPermissionRequest(const PassRefPtrWillBeRawPtr<WebCore::MIDIAccess>& midi)
     : m_private(midi)
 {
 }
diff --git a/Source/web/WebMediaPlayerClientImpl.cpp b/Source/web/WebMediaPlayerClientImpl.cpp
index 5ff8923..5e1183c 100644
--- a/Source/web/WebMediaPlayerClientImpl.cpp
+++ b/Source/web/WebMediaPlayerClientImpl.cpp
@@ -8,13 +8,14 @@
 #include "WebDocument.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebHelperPlugin.h"
 #include "WebViewImpl.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "core/html/HTMLMediaElement.h"
 #include "core/html/TimeRanges.h"
-#include "core/rendering/RenderLayerCompositor.h"
 #include "core/rendering/RenderView.h"
+#include "core/rendering/compositing/RenderLayerCompositor.h"
+#include "modules/encryptedmedia/HTMLMediaElementEncryptedMedia.h"
+#include "modules/encryptedmedia/MediaKeyNeededEvent.h"
 #include "modules/mediastream/MediaStreamRegistry.h"
 #include "platform/audio/AudioBus.h"
 #include "platform/audio/AudioSourceProviderClient.h"
@@ -51,16 +52,16 @@
 
 namespace blink {
 
-static PassOwnPtr<WebMediaPlayer> createWebMediaPlayer(WebMediaPlayerClient* client, const WebURL& url, Frame* frame)
+static PassOwnPtr<WebMediaPlayer> createWebMediaPlayer(WebMediaPlayerClient* client, const WebURL& url, LocalFrame* frame)
 {
     WebFrameImpl* webFrame = WebFrameImpl::fromFrame(frame);
 
-    if (!webFrame->client())
+    if (!webFrame || !webFrame->client())
         return nullptr;
     return adoptPtr(webFrame->client()->createMediaPlayer(webFrame, url, client));
 }
 
-WebMediaPlayer* WebMediaPlayerClientImpl::mediaPlayer() const
+WebMediaPlayer* WebMediaPlayerClientImpl::webMediaPlayer() const
 {
     return m_webMediaPlayer.get();
 }
@@ -69,11 +70,10 @@
 
 WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl()
 {
+    HTMLMediaElementEncryptedMedia::playerDestroyed(mediaElement());
+
     // Explicitly destroy the WebMediaPlayer to allow verification of tear down.
     m_webMediaPlayer.clear();
-
-    // Ensure the m_webMediaPlayer destroyed any WebHelperPlugin used.
-    ASSERT(!m_helperPlugin);
 }
 
 void WebMediaPlayerClientImpl::networkStateChanged()
@@ -113,7 +113,7 @@
 
 double WebMediaPlayerClientImpl::volume() const
 {
-    return m_volume;
+    return mediaElement().playerVolume();
 }
 
 void WebMediaPlayerClientImpl::playbackStateChanged()
@@ -128,48 +128,22 @@
 
 void WebMediaPlayerClientImpl::keyAdded(const WebString& keySystem, const WebString& sessionId)
 {
-    m_client->mediaPlayerKeyAdded(keySystem, sessionId);
+    HTMLMediaElementEncryptedMedia::keyAdded(mediaElement(), keySystem, sessionId);
 }
 
 void WebMediaPlayerClientImpl::keyError(const WebString& keySystem, const WebString& sessionId, MediaKeyErrorCode errorCode, unsigned short systemCode)
 {
-    m_client->mediaPlayerKeyError(keySystem, sessionId, static_cast<MediaPlayerClient::MediaKeyErrorCode>(errorCode), systemCode);
+    HTMLMediaElementEncryptedMedia::keyError(mediaElement(), keySystem, sessionId, errorCode, systemCode);
 }
 
 void WebMediaPlayerClientImpl::keyMessage(const WebString& keySystem, const WebString& sessionId, const unsigned char* message, unsigned messageLength, const WebURL& defaultURL)
 {
-    m_client->mediaPlayerKeyMessage(keySystem, sessionId, message, messageLength, defaultURL);
+    HTMLMediaElementEncryptedMedia::keyMessage(mediaElement(), keySystem, sessionId, message, messageLength, defaultURL);
 }
 
 void WebMediaPlayerClientImpl::keyNeeded(const WebString& contentType, const unsigned char* initData, unsigned initDataLength)
 {
-    m_client->mediaPlayerKeyNeeded(contentType, initData, initDataLength);
-}
-
-WebPlugin* WebMediaPlayerClientImpl::createHelperPlugin(const WebString& pluginType, WebFrame* frame)
-{
-    ASSERT(!m_helperPlugin);
-
-    m_helperPlugin = adoptPtr(frame->view()->createHelperPlugin(pluginType, frame->document()));
-    if (!m_helperPlugin)
-        return 0;
-
-    WebPlugin* plugin = m_helperPlugin->getPlugin();
-    if (!plugin) {
-        // There is no need to keep the helper plugin around and the caller
-        // should not be expected to call close after a failure (null pointer).
-        closeHelperPluginSoon(frame);
-        return 0;
-    }
-
-    return plugin;
-}
-
-// FIXME: |frame| no longer needed.
-void WebMediaPlayerClientImpl::closeHelperPluginSoon(WebFrame* frame)
-{
-    ASSERT(m_helperPlugin);
-    m_helperPlugin.clear();
+    HTMLMediaElementEncryptedMedia::keyNeeded(mediaElement(), contentType, initData, initDataLength);
 }
 
 void WebMediaPlayerClientImpl::setWebLayer(blink::WebLayer* layer)
@@ -179,12 +153,12 @@
 
 void WebMediaPlayerClientImpl::addTextTrack(WebInbandTextTrack* textTrack)
 {
-    m_client->mediaPlayerDidAddTrack(textTrack);
+    m_client->mediaPlayerDidAddTextTrack(textTrack);
 }
 
 void WebMediaPlayerClientImpl::removeTextTrack(WebInbandTextTrack* textTrack)
 {
-    m_client->mediaPlayerDidRemoveTrack(textTrack);
+    m_client->mediaPlayerDidRemoveTextTrack(textTrack);
 }
 
 void WebMediaPlayerClientImpl::mediaSourceOpened(WebMediaSource* webMediaSource)
@@ -227,7 +201,7 @@
 #endif
 
     // FIXME: Remove this cast
-    Frame* frame = static_cast<HTMLMediaElement*>(m_client)->document().frame();
+    LocalFrame* frame = mediaElement().document().frame();
 
     WebURL poster = m_client->mediaPlayerPosterURL();
 
@@ -244,11 +218,13 @@
         m_audioSourceProvider.wrap(m_webMediaPlayer->audioSourceProvider());
 #endif
 
+        m_webMediaPlayer->setVolume(mediaElement().playerVolume());
+
         // Tell WebMediaPlayer about the poster image URL.
         m_webMediaPlayer->setPoster(poster);
 
         // Tell WebMediaPlayer about any connected CDM (may be null).
-        m_webMediaPlayer->setContentDecryptionModule(m_cdm);
+        m_webMediaPlayer->setContentDecryptionModule(HTMLMediaElementEncryptedMedia::contentDecryptionModule(mediaElement()));
 
         WebMediaPlayer::CORSMode corsMode = static_cast<WebMediaPlayer::CORSMode>(m_client->mediaPlayerCORSMode());
         m_webMediaPlayer->load(m_loadType, m_url, corsMode);
@@ -284,40 +260,6 @@
     return m_webMediaPlayer && m_webMediaPlayer->canEnterFullscreen();
 }
 
-MediaPlayer::MediaKeyException WebMediaPlayerClientImpl::generateKeyRequest(const String& keySystem, const unsigned char* initData, unsigned initDataLength)
-{
-    if (!m_webMediaPlayer)
-        return MediaPlayer::InvalidPlayerState;
-
-    WebMediaPlayer::MediaKeyException result = m_webMediaPlayer->generateKeyRequest(keySystem, initData, initDataLength);
-    return static_cast<MediaPlayer::MediaKeyException>(result);
-}
-
-MediaPlayer::MediaKeyException WebMediaPlayerClientImpl::addKey(const String& keySystem, const unsigned char* key, unsigned keyLength, const unsigned char* initData, unsigned initDataLength, const String& sessionId)
-{
-    if (!m_webMediaPlayer)
-        return MediaPlayer::InvalidPlayerState;
-
-    WebMediaPlayer::MediaKeyException result = m_webMediaPlayer->addKey(keySystem, key, keyLength, initData, initDataLength, sessionId);
-    return static_cast<MediaPlayer::MediaKeyException>(result);
-}
-
-MediaPlayer::MediaKeyException WebMediaPlayerClientImpl::cancelKeyRequest(const String& keySystem, const String& sessionId)
-{
-    if (!m_webMediaPlayer)
-        return MediaPlayer::InvalidPlayerState;
-
-    WebMediaPlayer::MediaKeyException result = m_webMediaPlayer->cancelKeyRequest(keySystem, sessionId);
-    return static_cast<MediaPlayer::MediaKeyException>(result);
-}
-
-void WebMediaPlayerClientImpl::setContentDecryptionModule(WebContentDecryptionModule* cdm)
-{
-    m_cdm = cdm;
-    if (m_webMediaPlayer)
-        m_webMediaPlayer->setContentDecryptionModule(cdm);
-}
-
 void WebMediaPlayerClientImpl::prepareToPlay()
 {
     if (m_delayingLoad)
@@ -398,20 +340,6 @@
     return false;
 }
 
-void WebMediaPlayerClientImpl::setVolume(double volume)
-{
-    m_volume = volume;
-    if (m_webMediaPlayer && !m_muted)
-        m_webMediaPlayer->setVolume(volume);
-}
-
-void WebMediaPlayerClientImpl::setMuted(bool muted)
-{
-    m_muted = muted;
-    if (m_webMediaPlayer)
-        m_webMediaPlayer->setVolume(muted ? 0 : m_volume);
-}
-
 void WebMediaPlayerClientImpl::setPoster(const KURL& poster)
 {
     if (m_webMediaPlayer)
@@ -461,10 +389,7 @@
         // paint the video frame into the context.
 #if OS(ANDROID)
         if (m_loadType != WebMediaPlayer::LoadTypeMediaStream) {
-            OwnPtr<blink::WebGraphicsContext3DProvider> provider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
-            if (!provider)
-                return;
-            paintOnAndroid(context, provider->context3d(), rect, context->getNormalizedAlpha());
+            paintOnAndroid(context, rect, context->getNormalizedAlpha());
             return;
         }
 #endif
@@ -568,8 +493,12 @@
 }
 
 #if OS(ANDROID)
-void WebMediaPlayerClientImpl::paintOnAndroid(WebCore::GraphicsContext* context, WebGraphicsContext3D* context3D, const IntRect& rect, uint8_t alpha)
+void WebMediaPlayerClientImpl::paintOnAndroid(WebCore::GraphicsContext* context, const IntRect& rect, uint8_t alpha)
 {
+    OwnPtr<blink::WebGraphicsContext3DProvider> provider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
+    if (!provider)
+        return;
+    WebGraphicsContext3D* context3D = provider->context3d();
     if (!context || !context3D || !m_webMediaPlayer || context->paintingDisabled())
         return;
 
@@ -580,9 +509,6 @@
     // which is not supported by Skia yet. The bitmap's size needs to be the same as the video and use naturalSize() here.
     // Check if we could reuse existing texture based bitmap.
     // Otherwise, release existing texture based bitmap and allocate a new one based on video size.
-    OwnPtr<blink::WebGraphicsContext3DProvider> provider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
-    if (!provider)
-        return;
     if (!ensureTextureBackedSkBitmap(provider->grContext(), m_bitmap, naturalSize(), kTopLeft_GrSurfaceOrigin, kSkia8888_GrPixelConfig))
         return;
 
@@ -618,15 +544,17 @@
     , m_delayingLoad(false)
     , m_preload(MediaPlayer::Auto)
     , m_needsWebLayerForVideo(false)
-    , m_volume(1.0)
-    , m_muted(false)
     , m_rate(1.0)
-    , m_cdm(0)
     , m_loadType(WebMediaPlayer::LoadTypeURL)
 {
     ASSERT(m_client);
 }
 
+WebCore::HTMLMediaElement& WebMediaPlayerClientImpl::mediaElement() const
+{
+    return *static_cast<HTMLMediaElement*>(m_client);
+}
+
 #if ENABLE(WEB_AUDIO)
 void WebMediaPlayerClientImpl::AudioSourceProviderImpl::wrap(WebAudioSourceProvider* provider)
 {
diff --git a/Source/web/WebMediaPlayerClientImpl.h b/Source/web/WebMediaPlayerClientImpl.h
index 91cd9d7..3136927 100644
--- a/Source/web/WebMediaPlayerClientImpl.h
+++ b/Source/web/WebMediaPlayerClientImpl.h
@@ -48,11 +48,11 @@
 
 namespace WebCore {
 class AudioSourceProviderClient;
+class HTMLMediaElement;
 }
 
 namespace blink {
 
-class WebHelperPlugin;
 class WebAudioSourceProvider;
 class WebContentDecryptionModule;
 class WebMediaPlayer;
@@ -67,9 +67,6 @@
 
     virtual ~WebMediaPlayerClientImpl();
 
-    // Returns the encapsulated blink::WebMediaPlayer.
-    WebMediaPlayer* mediaPlayer() const;
-
     // WebMediaPlayerClient methods:
     virtual void networkStateChanged() OVERRIDE;
     virtual void readyStateChanged() OVERRIDE;
@@ -81,12 +78,13 @@
     virtual double volume() const OVERRIDE;
     virtual void playbackStateChanged() OVERRIDE;
     virtual WebMediaPlayer::Preload preload() const OVERRIDE;
+
+    // WebEncryptedMediaPlayerClient methods:
     virtual void keyAdded(const WebString& keySystem, const WebString& sessionId) OVERRIDE;
     virtual void keyError(const WebString& keySystem, const WebString& sessionId, MediaKeyErrorCode, unsigned short systemCode) OVERRIDE;
     virtual void keyMessage(const WebString& keySystem, const WebString& sessionId, const unsigned char* message, unsigned messageLength, const WebURL& defaultURL) OVERRIDE;
     virtual void keyNeeded(const WebString& contentType, const unsigned char* initData, unsigned initDataLength) OVERRIDE;
-    virtual WebPlugin* createHelperPlugin(const WebString& pluginType, WebFrame*) OVERRIDE;
-    virtual void closeHelperPluginSoon(WebFrame*) OVERRIDE;
+
     virtual bool needsWebLayerForVideo() const OVERRIDE;
     virtual void setWebLayer(WebLayer*) OVERRIDE;
     virtual void addTextTrack(WebInbandTextTrack*) OVERRIDE;
@@ -96,8 +94,8 @@
     virtual void requestSeek(double) OVERRIDE;
 
     // MediaPlayer methods:
+    virtual WebMediaPlayer* webMediaPlayer() const OVERRIDE;
     virtual void load(WebMediaPlayer::LoadType, const WTF::String& url) OVERRIDE;
-
     virtual void play() OVERRIDE;
     virtual void pause() OVERRIDE;
     virtual void prepareToPlay() OVERRIDE;
@@ -112,8 +110,6 @@
     virtual double rate() const OVERRIDE;
     virtual void setRate(double) OVERRIDE;
     virtual bool paused() const OVERRIDE;
-    virtual void setVolume(double) OVERRIDE;
-    virtual void setMuted(bool) OVERRIDE;
     virtual void setPoster(const WebCore::KURL&) OVERRIDE;
     virtual WebCore::MediaPlayer::NetworkState networkState() const OVERRIDE;
     virtual WebCore::MediaPlayer::ReadyState readyState() const OVERRIDE;
@@ -139,22 +135,19 @@
     virtual WebCore::AudioSourceProvider* audioSourceProvider() OVERRIDE;
 #endif
 
-    virtual WebCore::MediaPlayer::MediaKeyException generateKeyRequest(const String& keySystem, const unsigned char* initData, unsigned initDataLength) OVERRIDE;
-    virtual WebCore::MediaPlayer::MediaKeyException addKey(const String& keySystem, const unsigned char* key, unsigned keyLength, const unsigned char* initData, unsigned initDataLength, const String& sessionId) OVERRIDE;
-    virtual WebCore::MediaPlayer::MediaKeyException cancelKeyRequest(const String& keySystem, const String& sessionId) OVERRIDE;
-    virtual void setContentDecryptionModule(WebContentDecryptionModule*) OVERRIDE;
-
 private:
     explicit WebMediaPlayerClientImpl(WebCore::MediaPlayerClient*);
 
     void startDelayedLoad();
     void loadInternal();
 
+    WebCore::HTMLMediaElement& mediaElement() const;
+
 #if OS(ANDROID)
     // FIXME: This path "only works" on Android. It is a workaround for the problem that Skia could not handle Android's GL_TEXTURE_EXTERNAL_OES
     // texture internally. It should be removed and replaced by the normal paint path.
     // https://code.google.com/p/skia/issues/detail?id=1189
-    void paintOnAndroid(WebCore::GraphicsContext*, WebGraphicsContext3D*, const WebCore::IntRect&, uint8_t alpha);
+    void paintOnAndroid(WebCore::GraphicsContext*, const WebCore::IntRect&, uint8_t alpha);
     SkBitmap m_bitmap;
 #endif
 
@@ -163,12 +156,8 @@
     WebCore::KURL m_url;
     bool m_delayingLoad;
     WebCore::MediaPlayer::Preload m_preload;
-    OwnPtr<WebHelperPlugin> m_helperPlugin;
     bool m_needsWebLayerForVideo;
-    double m_volume;
-    bool m_muted;
     double m_rate;
-    WebContentDecryptionModule* m_cdm;
 
 #if ENABLE(WEB_AUDIO)
     // AudioClientImpl wraps an AudioSourceProviderClient.
diff --git a/Source/web/WebNode.cpp b/Source/web/WebNode.cpp
index 780cc6e..eb3f9e9 100644
--- a/Source/web/WebNode.cpp
+++ b/Source/web/WebNode.cpp
@@ -50,6 +50,7 @@
 #include "core/editing/markup.h"
 #include "core/events/Event.h"
 #include "core/html/HTMLCollection.h"
+#include "core/html/HTMLElement.h"
 #include "core/rendering/RenderObject.h"
 #include "core/rendering/RenderWidget.h"
 #include "platform/Widget.h"
@@ -127,7 +128,7 @@
 
 bool WebNode::hasChildNodes() const
 {
-    return m_private->hasChildNodes();
+    return m_private->hasChildren();
 }
 
 WebNodeList WebNode::childNodes()
@@ -236,9 +237,9 @@
 {
     if (isNull())
         return 0;
-    const Node* coreNode = constUnwrap<Node>();
-    if (coreNode->hasTagName(HTMLNames::objectTag) || coreNode->hasTagName(HTMLNames::embedTag)) {
-        RenderObject* object = coreNode->renderer();
+    const Node& coreNode = *constUnwrap<Node>();
+    if (isHTMLObjectElement(coreNode) || isHTMLEmbedElement(coreNode)) {
+        RenderObject* object = coreNode.renderer();
         if (object && object->isWidget()) {
             Widget* widget = WebCore::toRenderWidget(object)->widget();
             if (widget && widget->isPluginContainer())
diff --git a/Source/web/WebNotification.cpp b/Source/web/WebNotification.cpp
index 1e70be9..3642e21 100644
--- a/Source/web/WebNotification.cpp
+++ b/Source/web/WebNotification.cpp
@@ -31,53 +31,33 @@
 #include "config.h"
 #include "WebNotification.h"
 
-#include "WebTextDirection.h"
 #include "core/events/Event.h"
-#include "core/page/WindowFocusAllowedIndicator.h"
-#include "modules/notifications/NotificationBase.h"
-#include "platform/UserGestureIndicator.h"
-#include "public/platform/WebString.h"
+#include "modules/notifications/Notification.h"
 #include "public/platform/WebURL.h"
 #include "wtf/PassRefPtr.h"
 
-using namespace WebCore;
+using WebCore::Notification;
 
 namespace blink {
 
-class WebNotificationPrivate : public NotificationBase {
-};
-
 void WebNotification::reset()
 {
-    assign(0);
+    m_private.reset();
 }
 
 void WebNotification::assign(const WebNotification& other)
 {
-    WebNotificationPrivate* p = const_cast<WebNotificationPrivate*>(other.m_private);
-    if (p)
-        p->ref(); // FIXME: We should use WebPrivatePtr.
-    assign(p);
+    m_private = other.m_private;
+}
+
+bool WebNotification::equals(const WebNotification& other) const
+{
+    return m_private.get() == other.m_private.get();
 }
 
 bool WebNotification::lessThan(const WebNotification& other) const
 {
-    return reinterpret_cast<uintptr_t>(m_private) < reinterpret_cast<uintptr_t>(other.m_private);
-}
-
-bool WebNotification::isHTML() const
-{
-    return false;
-}
-
-WebURL WebNotification::url() const
-{
-    return WebURL();
-}
-
-WebURL WebNotification::iconURL() const
-{
-    return m_private->iconURL();
+    return m_private.get() < other.m_private.get();
 }
 
 WebString WebNotification::title() const
@@ -85,29 +65,39 @@
     return m_private->title();
 }
 
+WebTextDirection WebNotification::direction() const
+{
+    return (m_private->direction() == WebCore::RTL) ?
+        WebTextDirectionRightToLeft :
+        WebTextDirectionLeftToRight;
+}
+
+WebString WebNotification::lang() const
+{
+    return m_private->lang();
+}
+
 WebString WebNotification::body() const
 {
     return m_private->body();
 }
 
-WebTextDirection WebNotification::direction() const
-{
-    return (m_private->direction() == RTL) ?
-        WebTextDirectionRightToLeft :
-        WebTextDirectionLeftToRight;
-}
-
-WebString WebNotification::replaceId() const
+WebString WebNotification::tag() const
 {
     return m_private->tag();
 }
 
-void WebNotification::dispatchDisplayEvent()
+WebURL WebNotification::iconURL() const
+{
+    return m_private->iconURL();
+}
+
+void WebNotification::dispatchShowEvent()
 {
     m_private->dispatchShowEvent();
 }
 
-void WebNotification::dispatchErrorEvent(const blink::WebString& /* errorMessage */)
+void WebNotification::dispatchErrorEvent(const WebString& /* errorMessage */)
 {
     // FIXME: errorMessage not supported by WebCore yet
     m_private->dispatchErrorEvent();
@@ -124,28 +114,20 @@
     m_private->dispatchClickEvent();
 }
 
-WebNotification::WebNotification(const WTF::PassRefPtr<NotificationBase>& notification)
-    : m_private(static_cast<WebNotificationPrivate*>(notification.leakRef()))
+WebNotification::WebNotification(const WTF::PassRefPtr<WebCore::Notification>& notification)
+    : m_private(notification)
 {
 }
 
-WebNotification& WebNotification::operator=(const WTF::PassRefPtr<NotificationBase>& notification)
+WebNotification& WebNotification::operator=(const WTF::PassRefPtr<Notification>& notification)
 {
-    assign(static_cast<WebNotificationPrivate*>(notification.leakRef()));
+    m_private = notification;
     return *this;
 }
 
-WebNotification::operator WTF::PassRefPtr<NotificationBase>() const
+WebNotification::operator WTF::PassRefPtr<Notification>() const
 {
-    return WTF::PassRefPtr<NotificationBase>(const_cast<WebNotificationPrivate*>(m_private));
-}
-
-void WebNotification::assign(WebNotificationPrivate* p)
-{
-    // p is already ref'd for us by the caller
-    if (m_private)
-        m_private->deref();
-    m_private = p;
+    return m_private.get();
 }
 
 } // namespace blink
diff --git a/Source/web/WebPagePopupImpl.cpp b/Source/web/WebPagePopupImpl.cpp
index 539f512..2a20ed1 100644
--- a/Source/web/WebPagePopupImpl.cpp
+++ b/Source/web/WebPagePopupImpl.cpp
@@ -37,14 +37,14 @@
 #include "WebViewImpl.h"
 #include "WebWidgetClient.h"
 #include "core/dom/ContextFeatures.h"
+#include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/loader/EmptyClients.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/page/Chrome.h"
 #include "core/page/DOMWindowPagePopup.h"
 #include "core/page/EventHandler.h"
 #include "core/page/FocusController.h"
-#include "core/frame/Frame.h"
-#include "core/frame/FrameView.h"
 #include "core/page/Page.h"
 #include "core/page/PagePopupClient.h"
 #include "core/frame/Settings.h"
@@ -138,6 +138,16 @@
         m_popup->widgetClient()->hasTouchEventHandlers(needsTouchEvents);
     }
 
+    virtual GraphicsLayerFactory* graphicsLayerFactory() const OVERRIDE
+    {
+        return m_popup->m_webView->graphicsLayerFactory();
+    }
+
+    virtual void attachRootGraphicsLayer(GraphicsLayer* graphicsLayer) OVERRIDE
+    {
+        m_popup->setRootGraphicsLayer(graphicsLayer);
+    }
+
     WebPagePopupImpl* m_popup;
 };
 
@@ -157,6 +167,10 @@
 WebPagePopupImpl::WebPagePopupImpl(WebWidgetClient* client)
     : m_widgetClient(client)
     , m_closing(false)
+    , m_layerTreeView(0)
+    , m_rootLayer(0)
+    , m_rootGraphicsLayer(0)
+    , m_isAcceleratedCompositingActive(false)
 {
     ASSERT(client);
 }
@@ -197,15 +211,16 @@
     m_page->settings().setDeviceSupportsTouch(m_webView->page()->settings().deviceSupportsTouch());
 
     static ContextFeaturesClient* pagePopupFeaturesClient =  new PagePopupFeaturesClient();
-    provideContextFeaturesTo(m_page.get(), pagePopupFeaturesClient);
+    provideContextFeaturesTo(*m_page, pagePopupFeaturesClient);
     static FrameLoaderClient* emptyFrameLoaderClient =  new EmptyFrameLoaderClient();
-    RefPtr<Frame> frame = Frame::create(FrameInit::create(0, &m_page->frameHost(), emptyFrameLoaderClient));
+    RefPtr<LocalFrame> frame = LocalFrame::create(emptyFrameLoaderClient, &m_page->frameHost(), 0);
     frame->setView(FrameView::create(frame.get()));
     frame->init();
     frame->view()->resize(m_popupClient->contentSize());
     frame->view()->setTransparent(false);
 
-    DOMWindowPagePopup::install(frame->domWindow(), m_popupClient);
+    ASSERT(frame->domWindow());
+    DOMWindowPagePopup::install(*frame->domWindow(), m_popupClient);
 
     RefPtr<SharedBuffer> data = SharedBuffer::create();
     m_popupClient->writeDocument(data.get());
@@ -224,6 +239,49 @@
     m_page.clear();
 }
 
+void WebPagePopupImpl::setRootGraphicsLayer(GraphicsLayer* layer)
+{
+    m_rootGraphicsLayer = layer;
+    m_rootLayer = layer ? layer->platformLayer() : 0;
+
+    setIsAcceleratedCompositingActive(layer);
+    if (m_layerTreeView) {
+        if (m_rootLayer) {
+            m_layerTreeView->setRootLayer(*m_rootLayer);
+        } else {
+            m_layerTreeView->clearRootLayer();
+        }
+    }
+}
+
+void WebPagePopupImpl::setIsAcceleratedCompositingActive(bool enter)
+{
+    if (m_isAcceleratedCompositingActive == enter)
+        return;
+
+    if (!enter) {
+        m_isAcceleratedCompositingActive = false;
+        m_widgetClient->didDeactivateCompositor();
+    } else if (m_layerTreeView) {
+        m_isAcceleratedCompositingActive = true;
+        m_widgetClient->didActivateCompositor(0);
+    } else {
+        TRACE_EVENT0("webkit", "WebPagePopupImpl::setIsAcceleratedCompositingActive(true)");
+
+        m_widgetClient->initializeLayerTreeView();
+        m_layerTreeView = m_widgetClient->layerTreeView();
+        if (m_layerTreeView) {
+            m_layerTreeView->setVisible(true);
+            m_widgetClient->didActivateCompositor(0);
+            m_isAcceleratedCompositingActive = true;
+            m_layerTreeView->setDeviceScaleFactor(m_widgetClient->deviceScaleFactor());
+        } else {
+            m_isAcceleratedCompositingActive = false;
+            m_widgetClient->didDeactivateCompositor();
+        }
+    }
+}
+
 WebSize WebPagePopupImpl::size()
 {
     return m_popupClient->contentSize();
@@ -234,6 +292,37 @@
     PageWidgetDelegate::animate(m_page.get(), monotonicallyIncreasingTime());
 }
 
+void WebPagePopupImpl::enterForceCompositingMode(bool enter)
+{
+    if (!m_page)
+        return;
+    if (m_page->settings().forceCompositingMode() == enter)
+        return;
+
+    TRACE_EVENT1("webkit", "WebPagePopupImpl::enterForceCompositingMode", "enter", enter);
+    m_page->settings().setForceCompositingMode(enter);
+    if (enter) {
+        LocalFrame* mainFrame = m_page->mainFrame();
+        if (!mainFrame)
+            return;
+        mainFrame->view()->updateCompositingLayersAfterStyleChange();
+    }
+}
+
+void WebPagePopupImpl::didExitCompositingMode()
+{
+    setIsAcceleratedCompositingActive(false);
+    m_widgetClient->didInvalidateRect(IntRect(0, 0, size().width, size().height));
+    if (m_page)
+        m_page->mainFrame()->document()->setNeedsStyleRecalc(SubtreeStyleChange);
+}
+
+void WebPagePopupImpl::willCloseLayerTreeView()
+{
+    setIsAcceleratedCompositingActive(false);
+    m_layerTreeView = 0;
+}
+
 void WebPagePopupImpl::layout()
 {
     PageWidgetDelegate::layout(m_page.get());
@@ -273,7 +362,7 @@
 {
     if (m_closing || !m_page || !m_page->mainFrame() || !m_page->mainFrame()->view())
         return false;
-    Frame& frame = *m_page->mainFrame();
+    LocalFrame& frame = *m_page->mainFrame();
     return frame.eventHandler().handleGestureEvent(PlatformGestureEventBuilder(frame.view(), event));
 }
 
@@ -311,9 +400,9 @@
 void WebPagePopupImpl::closePopup()
 {
     if (m_page) {
-        m_page->clearPageGroup();
         m_page->mainFrame()->loader().stopAllLoaders();
-        DOMWindowPagePopup::uninstall(m_page->mainFrame()->domWindow());
+        ASSERT(m_page->mainFrame()->domWindow());
+        DOMWindowPagePopup::uninstall(*m_page->mainFrame()->domWindow());
     }
     m_closing = true;
 
diff --git a/Source/web/WebPagePopupImpl.h b/Source/web/WebPagePopupImpl.h
index 66485f5..5b35c39 100644
--- a/Source/web/WebPagePopupImpl.h
+++ b/Source/web/WebPagePopupImpl.h
@@ -38,6 +38,7 @@
 #include "wtf/RefCounted.h"
 
 namespace WebCore {
+class GraphicsLayer;
 class Page;
 class PagePopupClient;
 class PlatformKeyboardEvent;
@@ -46,6 +47,8 @@
 namespace blink {
 
 class PagePopupChromeClient;
+class WebLayerTreeView;
+class WebLayer;
 class WebViewImpl;
 
 class WebPagePopupImpl FINAL :
@@ -69,6 +72,9 @@
     virtual WebSize size() OVERRIDE;
     virtual void animate(double) OVERRIDE;
     virtual void layout() OVERRIDE;
+    virtual void enterForceCompositingMode(bool enter) OVERRIDE;
+    virtual void didExitCompositingMode() OVERRIDE;
+    virtual void willCloseLayerTreeView() OVERRIDE;
     virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable) OVERRIDE;
     virtual void resize(const WebSize&) OVERRIDE;
     virtual void close() OVERRIDE;
@@ -84,6 +90,8 @@
     explicit WebPagePopupImpl(WebWidgetClient*);
     bool initializePage();
     void destroyPage();
+    void setRootGraphicsLayer(WebCore::GraphicsLayer*);
+    void setIsAcceleratedCompositingActive(bool enter);
 
     WebWidgetClient* m_widgetClient;
     WebRect m_windowRectInScreen;
@@ -93,6 +101,11 @@
     WebCore::PagePopupClient* m_popupClient;
     bool m_closing;
 
+    WebLayerTreeView* m_layerTreeView;
+    WebLayer* m_rootLayer;
+    WebCore::GraphicsLayer* m_rootGraphicsLayer;
+    bool m_isAcceleratedCompositingActive;
+
     friend class WebPagePopup;
     friend class PagePopupChromeClient;
 };
diff --git a/Source/web/WebPageSerializer.cpp b/Source/web/WebPageSerializer.cpp
index 35beb60..4df430c 100644
--- a/Source/web/WebPageSerializer.cpp
+++ b/Source/web/WebPageSerializer.cpp
@@ -40,12 +40,12 @@
 #include "WebViewImpl.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
+#include "core/frame/LocalFrame.h"
 #include "core/html/HTMLAllCollection.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/HTMLTableElement.h"
 #include "core/loader/DocumentLoader.h"
-#include "core/frame/Frame.h"
 #include "core/page/PageSerializer.h"
 #include "platform/SerializedResource.h"
 #include "platform/mhtml/MHTMLArchive.h"
@@ -104,16 +104,17 @@
 }
 
 void retrieveResourcesForElement(Element* element,
-                                 Vector<Frame*>* visitedFrames,
-                                 Vector<Frame*>* framesToVisit,
+                                 Vector<LocalFrame*>* visitedFrames,
+                                 Vector<LocalFrame*>* framesToVisit,
                                  Vector<KURL>* frameURLs,
                                  Vector<KURL>* resourceURLs)
 {
+    ASSERT(element);
     // If the node is a frame, we'll process it later in retrieveResourcesForFrame.
-    if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)
-        || element->hasTagName(HTMLNames::objectTag) || element->hasTagName(HTMLNames::embedTag))
+    if ((isHTMLIFrameElement(*element) || isHTMLFrameElement(*element)
+        || isHTMLObjectElement(*element) || isHTMLEmbedElement(*element))
             && element->isFrameOwnerElement()) {
-        if (Frame* frame = toHTMLFrameOwnerElement(element)->contentFrame()) {
+        if (LocalFrame* frame = toHTMLFrameOwnerElement(element)->contentFrame()) {
             if (!visitedFrames->contains(frame))
                 framesToVisit->append(frame);
             return;
@@ -133,10 +134,10 @@
         resourceURLs->append(url);
 }
 
-void retrieveResourcesForFrame(Frame* frame,
+void retrieveResourcesForFrame(LocalFrame* frame,
                                const blink::WebVector<blink::WebCString>& supportedSchemes,
-                               Vector<Frame*>* visitedFrames,
-                               Vector<Frame*>* framesToVisit,
+                               Vector<LocalFrame*>* visitedFrames,
+                               Vector<LocalFrame*>* framesToVisit,
                                Vector<KURL>* frameURLs,
                                Vector<KURL>* resourceURLs)
 {
@@ -240,15 +241,15 @@
     if (!mainFrame)
         return false;
 
-    Vector<Frame*> framesToVisit;
-    Vector<Frame*> visitedFrames;
+    Vector<LocalFrame*> framesToVisit;
+    Vector<LocalFrame*> visitedFrames;
     Vector<KURL> frameKURLs;
     Vector<KURL> resourceKURLs;
 
     // Let's retrieve the resources from every frame in this page.
     framesToVisit.append(mainFrame->frame());
     while (!framesToVisit.isEmpty()) {
-        Frame* frame = framesToVisit[0];
+        LocalFrame* frame = framesToVisit[0];
         framesToVisit.remove(0);
         retrieveResourcesForFrame(frame, supportedSchemes,
                                   &visitedFrames, &framesToVisit,
diff --git a/Source/web/WebPageSerializerImpl.cpp b/Source/web/WebPageSerializerImpl.cpp
index a2b7705..68b0e9d 100644
--- a/Source/web/WebPageSerializerImpl.cpp
+++ b/Source/web/WebPageSerializerImpl.cpp
@@ -132,12 +132,13 @@
         // Skip the open tag of original META tag which declare charset since we
         // have overrided the META which have correct charset declaration after
         // serializing open tag of HEAD element.
-        if (element->hasTagName(HTMLNames::metaTag)) {
-            const HTMLMetaElement* meta = toHTMLMetaElement(element);
+        ASSERT(element);
+        if (isHTMLMetaElement(*element)) {
+            const HTMLMetaElement& meta = toHTMLMetaElement(*element);
             // Check whether the META tag has declared charset or not.
-            String equiv = meta->httpEquiv();
+            String equiv = meta.httpEquiv();
             if (equalIgnoringCase(equiv, "content-type")) {
-                String content = meta->content();
+                String content = meta.content();
                 if (content.length() && content.contains("charset", false)) {
                     // Find META tag declared charset, we need to skip it when
                     // serializing DOM.
@@ -145,7 +146,7 @@
                     *needSkip = true;
                 }
             }
-        } else if (element->hasTagName(HTMLNames::htmlTag)) {
+        } else if (isHTMLHtmlElement(*element)) {
             // Check something before processing the open tag of HEAD element.
             // First we add doc type declaration if original document has it.
             if (!param->haveSeenDocType) {
@@ -156,7 +157,7 @@
             // Add MOTW declaration before html tag.
             // See http://msdn2.microsoft.com/en-us/library/ms537628(VS.85).aspx.
             result.append(WebPageSerializer::generateMarkOfTheWebDeclaration(param->url));
-        } else if (element->hasTagName(HTMLNames::baseTag)) {
+        } else if (isHTMLBaseElement(*element)) {
             // Comment the BASE tag when serializing dom.
             result.append("<!--");
         }
@@ -197,7 +198,7 @@
         return result.toString();
     // Check after processing the open tag of HEAD element
     if (!param->haveAddedCharsetDeclaration
-        && element->hasTagName(HTMLNames::headTag)) {
+        && isHTMLHeadElement(*element)) {
         param->haveAddedCharsetDeclaration = true;
         // Check meta element. WebKit only pre-parse the first 512 bytes
         // of the document. If the whole <HEAD> is larger and meta is the
@@ -212,8 +213,7 @@
         param->haveAddedContentsBeforeEnd = true;
         // Will search each META which has charset declaration, and skip them all
         // in PreActionBeforeSerializeOpenTag.
-    } else if (element->hasTagName(HTMLNames::scriptTag)
-               || element->hasTagName(HTMLNames::styleTag)) {
+    } else if (isHTMLScriptElement(*element) || isHTMLScriptElement(*element)) {
         param->isInScriptOrStyleTag = true;
     }
 
@@ -231,10 +231,9 @@
     // Skip the end tag of original META tag which declare charset.
     // Need not to check whether it's META tag since we guarantee
     // skipMetaElement is definitely META tag if it's not 0.
-    if (param->skipMetaElement == element)
+    if (param->skipMetaElement == element) {
         *needSkip = true;
-    else if (element->hasTagName(HTMLNames::scriptTag)
-             || element->hasTagName(HTMLNames::styleTag)) {
+    } else if (isHTMLScriptElement(*element) || isHTMLScriptElement(*element)) {
         ASSERT(param->isInScriptOrStyleTag);
         param->isInScriptOrStyleTag = false;
     }
@@ -252,7 +251,7 @@
     if (!param->isHTMLDocument)
         return result.toString();
     // Comment the BASE tag when serializing DOM.
-    if (element->hasTagName(HTMLNames::baseTag)) {
+    if (isHTMLBaseElement(*element)) {
         result.append("-->");
         // Append a new base tag declaration.
         result.append(WebPageSerializer::generateBaseTagDeclaration(
@@ -309,15 +308,15 @@
         for (unsigned i = 0; i < numAttrs; i++) {
             result.append(' ');
             // Add attribute pair
-            const Attribute *attribute = element->attributeItem(i);
-            result.append(attribute->name().toString());
+            const Attribute& attribute = element->attributeItem(i);
+            result.append(attribute.name().toString());
             result.appendLiteral("=\"");
-            if (!attribute->value().isEmpty()) {
-                const String& attrValue = attribute->value();
+            if (!attribute.value().isEmpty()) {
+                const String& attrValue = attribute.value();
 
                 // Check whether we need to replace some resource links
                 // with local resource paths.
-                const QualifiedName& attrName = attribute->name();
+                const QualifiedName& attrName = attribute.name();
                 if (elementHasLegalLinkAttribute(element, attrName)) {
                     // For links start with "javascript:", we do not change it.
                     if (attrValue.startsWith("javascript:", false))
@@ -352,7 +351,7 @@
     // Do post action for open tag.
     String addedContents = postActionAfterSerializeOpenTag(element, param);
     // Complete the open tag for element when it has child/children.
-    if (element->hasChildNodes() || param->haveAddedContentsBeforeEnd)
+    if (element->hasChildren() || param->haveAddedContentsBeforeEnd)
         result.append('>');
     // Append the added contents generate in  post action of open tag.
     result.append(addedContents);
@@ -371,7 +370,7 @@
     if (needSkip)
         return;
     // Write end tag when element has child/children.
-    if (element->hasChildNodes() || param->haveAddedContentsBeforeEnd) {
+    if (element->hasChildren() || param->haveAddedContentsBeforeEnd) {
         result.appendLiteral("</");
         result.append(element->nodeName().lower());
         result.append('>');
diff --git a/Source/web/WebPasswordFormUtils.cpp b/Source/web/WebPasswordFormUtils.cpp
index 582d75c..cc3dd6d 100644
--- a/Source/web/WebPasswordFormUtils.cpp
+++ b/Source/web/WebPasswordFormUtils.cpp
@@ -69,15 +69,15 @@
         if (control->isActivatedSubmit())
             fields->submit = control;
 
-        if (!control->hasTagName(HTMLNames::inputTag))
+        if (!isHTMLInputElement(*control))
             continue;
 
-        HTMLInputElement* inputElement = toHTMLInputElement(control);
-        if (inputElement->isDisabledFormControl())
+        HTMLInputElement& inputElement = toHTMLInputElement(*control);
+        if (inputElement.isDisabledFormControl())
             continue;
 
         if ((fields->passwords.size() < maxPasswords)
-            && inputElement->isPasswordField()) {
+            && inputElement.isPasswordField()) {
             // We assume that the username is the input element before the
             // first password element.
             if (fields->passwords.isEmpty() && latestInputElement) {
@@ -86,17 +86,17 @@
                 if (!fields->alternateUserNames.isEmpty() && !latestInputElement->value().isEmpty())
                     fields->alternateUserNames.removeLast();
             }
-            fields->passwords.append(inputElement);
+            fields->passwords.append(&inputElement);
         }
 
         // Various input types such as text, url, email can be a username field.
-        if (inputElement->isTextField() && !inputElement->isPasswordField()) {
-            latestInputElement = inputElement;
+        if (inputElement.isTextField() && !inputElement.isPasswordField()) {
+            latestInputElement = &inputElement;
             // We ignore elements that have no value. Unlike userName, alternateUserNames
             // is used only for autofill, not for form identification, and blank autofill
             // entries are not useful.
-            if (!inputElement->value().isEmpty())
-                fields->alternateUserNames.append(inputElement->value());
+            if (!inputElement.value().isEmpty())
+                fields->alternateUserNames.append(inputElement.value());
         }
     }
 }
diff --git a/Source/web/WebPluginContainerImpl.cpp b/Source/web/WebPluginContainerImpl.cpp
index 67823f3..6558f1a 100644
--- a/Source/web/WebPluginContainerImpl.cpp
+++ b/Source/web/WebPluginContainerImpl.cpp
@@ -60,8 +60,8 @@
 #include "core/loader/FormState.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/page/FocusController.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/Page.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/plugins/PluginOcclusionSupport.h"
@@ -174,13 +174,33 @@
     Widget::hide();
 }
 
+static bool eventHasUserGesture(const WebInputEvent* webEvent, const Event* event)
+{
+    if (!WebInputEvent::isUserGestureEventType(webEvent->type))
+        return false;
+    if (WebInputEvent::isKeyboardEventType(webEvent->type))
+        return event->isKeyboardEvent();
+    switch (webEvent->type) {
+    case WebInputEvent::MouseDown:
+        return event->type() == EventTypeNames::mousedown;
+    case WebInputEvent::MouseUp:
+        return event->type() == EventTypeNames::mouseup;
+    case WebInputEvent::TouchStart:
+        return event->type() == EventTypeNames::touchstart;
+    case WebInputEvent::TouchEnd:
+        return event->type() == EventTypeNames::touchend;
+    default:
+        return false;
+    }
+}
+
 void WebPluginContainerImpl::handleEvent(Event* event)
 {
     if (!m_webPlugin->acceptsInputEvents())
         return;
 
     const WebInputEvent* currentInputEvent = WebViewImpl::currentInputEvent();
-    UserGestureIndicator gestureIndicator(currentInputEvent && WebInputEvent::isUserGestureEventType(currentInputEvent->type) ? DefinitelyProcessingNewUserGesture : PossiblyProcessingUserGesture);
+    UserGestureIndicator gestureIndicator(currentInputEvent && eventHasUserGesture(currentInputEvent, event) ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
 
     RefPtr<WebPluginContainerImpl> protector(this);
     // The events we pass are defined at:
@@ -279,7 +299,7 @@
 
 float WebPluginContainerImpl::pageZoomFactor()
 {
-    Frame* frame = m_element->document().frame();
+    LocalFrame* frame = m_element->document().frame();
     if (!frame)
         return 1.0;
     return frame->pageZoomFactor();
@@ -413,7 +433,7 @@
 
 void WebPluginContainerImpl::clearScriptObjects()
 {
-    Frame* frame = m_element->document().frame();
+    LocalFrame* frame = m_element->document().frame();
     if (!frame)
         return;
     frame->script().cleanupScriptObjectsForPlugin(this);
@@ -426,7 +446,7 @@
 
 WebString WebPluginContainerImpl::executeScriptURL(const WebURL& url, bool popupsAllowed)
 {
-    Frame* frame = m_element->document().frame();
+    LocalFrame* frame = m_element->document().frame();
     if (!frame)
         return WebString();
 
@@ -447,7 +467,7 @@
 
 void WebPluginContainerImpl::loadFrameRequest(const WebURLRequest& request, const WebString& target, bool notifyNeeded, void* notifyData)
 {
-    Frame* frame = m_element->document().frame();
+    LocalFrame* frame = m_element->document().frame();
     if (!frame || !frame->loader().documentLoader())
         return;  // FIXME: send a notification in this case?
 
@@ -474,7 +494,7 @@
 
 bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 {
-    Frame* frame = m_element->document().frame();
+    LocalFrame* frame = m_element->document().frame();
     if (!frame)
         return false;
 
@@ -693,8 +713,10 @@
     }
 
     WebCursorInfo cursorInfo;
-    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo)) {
+        event->stopPropagation();
         event->setDefaultHandled();
+    }
 
     // A windowless plugin can change the cursor in response to a mouse move
     // event.  We need to reflect the changed cursor in the frame view as the
@@ -723,7 +745,7 @@
         return;
 
     Clipboard* clipboard = event->dataTransfer();
-    WebDragData dragData = clipboard->dataObject();
+    WebDragData dragData(clipboard->dataObject());
     WebDragOperationsMask dragOperationMask = static_cast<WebDragOperationsMask>(clipboard->sourceOperation());
     WebPoint dragScreenLocation(event->screenX(), event->screenY());
     WebPoint dragLocation(event->absoluteLocation().x() - location().x(), event->absoluteLocation().y() - location().y());
@@ -738,8 +760,10 @@
         return;
 
     WebCursorInfo cursorInfo;
-    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo)) {
+        event->stopPropagation();
         event->setDefaultHandled();
+    }
 }
 
 void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
@@ -781,8 +805,10 @@
         view->client()->handleCurrentKeyboardEvent();
 
     WebCursorInfo cursorInfo;
-    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo)) {
+        event->stopPropagation();
         event->setDefaultHandled();
+    }
 }
 
 void WebPluginContainerImpl::handleTouchEvent(TouchEvent* event)
@@ -799,8 +825,10 @@
             focusPlugin();
 
         WebCursorInfo cursorInfo;
-        if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+        if (m_webPlugin->handleInputEvent(webEvent, cursorInfo)) {
+            event->stopPropagation();
             event->setDefaultHandled();
+        }
         // FIXME: Can a plugin change the cursor from a touch-event callback?
         return;
     }
@@ -825,6 +853,7 @@
         return;
     WebCursorInfo cursorInfo;
     if (m_webPlugin->handleInputEvent(webEvent, cursorInfo)) {
+        event->stopPropagation();
         event->setDefaultHandled();
         return;
     }
@@ -847,13 +876,15 @@
         return;
 
     WebCursorInfo cursorInfo;
-    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo)) {
+        event->stopPropagation();
         event->setDefaultHandled();
+    }
 }
 
 void WebPluginContainerImpl::focusPlugin()
 {
-    Frame& containingFrame = toFrameView(parent())->frame();
+    LocalFrame& containingFrame = toFrameView(parent())->frame();
     if (Page* currentPage = containingFrame.page())
         currentPage->focusController().setFocusedElement(m_element, &containingFrame);
     else
@@ -890,7 +921,7 @@
         // Take our element and get the clip rect from the enclosing layer and
         // frame view.
         clipRect.intersect(
-            m_element->document().view()->windowClipRectForFrameOwner(m_element, true));
+            m_element->document().view()->windowClipRectForFrameOwner(m_element));
     }
 
     return clipRect;
diff --git a/Source/web/WebPopupMenuImpl.cpp b/Source/web/WebPopupMenuImpl.cpp
index 06d36f4..36570d8 100644
--- a/Source/web/WebPopupMenuImpl.cpp
+++ b/Source/web/WebPopupMenuImpl.cpp
@@ -52,6 +52,7 @@
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebContentLayer.h"
+#include "public/platform/WebFloatRect.h"
 #include "public/platform/WebLayerTreeView.h"
 #include "public/platform/WebRect.h"
 #include <skia/ext/platform_canvas.h>
diff --git a/Source/web/WebPopupMenuImpl.h b/Source/web/WebPopupMenuImpl.h
index 442c0e2..6b63d34 100644
--- a/Source/web/WebPopupMenuImpl.h
+++ b/Source/web/WebPopupMenuImpl.h
@@ -40,7 +40,7 @@
 #include "wtf/RefCounted.h"
 
 namespace WebCore {
-class Frame;
+class LocalFrame;
 class FramelessScrollView;
 class KeyboardEvent;
 class Page;
diff --git a/Source/web/WebRange.cpp b/Source/web/WebRange.cpp
index ea433bc..70d5f19 100644
--- a/Source/web/WebRange.cpp
+++ b/Source/web/WebRange.cpp
@@ -42,8 +42,8 @@
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/editing/FrameSelection.h"
 #include "core/editing/PlainTextRange.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "public/platform/WebFloatQuad.h"
 #include "public/platform/WebString.h"
 #include "wtf/PassRefPtr.h"
@@ -116,7 +116,7 @@
 // static
 WebRange WebRange::fromDocumentRange(WebFrame* frame, int start, int length)
 {
-    WebCore::Frame* webFrame = toWebFrameImpl(frame)->frame();
+    WebCore::LocalFrame* webFrame = toWebFrameImpl(frame)->frame();
     Element* selectionRoot = webFrame->selection().rootEditableElement();
     ContainerNode* scope = selectionRoot ? selectionRoot : webFrame->document()->documentElement();
     return PlainTextRange(start, start + length).createRange(*scope);
@@ -127,7 +127,7 @@
     if (isNull())
         return WebVector<WebFloatQuad>();
 
-    Frame* frame = m_private->ownerDocument().frame();
+    LocalFrame* frame = m_private->ownerDocument().frame();
     if (!frame)
         return WebVector<WebFloatQuad>();
 
diff --git a/Source/web/WebRuntimeFeatures.cpp b/Source/web/WebRuntimeFeatures.cpp
index a22cbd5..da0480b 100644
--- a/Source/web/WebRuntimeFeatures.cpp
+++ b/Source/web/WebRuntimeFeatures.cpp
@@ -49,6 +49,14 @@
     RuntimeEnabledFeatures::setExperimentalFeaturesEnabled(enable);
 }
 
+void WebRuntimeFeatures::enableBleedingEdgeFastPaths(bool enable)
+{
+    ASSERT(enable);
+    RuntimeEnabledFeatures::setBleedingEdgeFastPathsEnabled(enable);
+    RuntimeEnabledFeatures::setSubpixelFontScalingEnabled(enable || RuntimeEnabledFeatures::subpixelFontScalingEnabled());
+    RuntimeEnabledFeatures::setCSSWillChangeEnabled(enable);
+}
+
 void WebRuntimeFeatures::enableTestOnlyFeatures(bool enable)
 {
     RuntimeEnabledFeatures::setTestFeaturesEnabled(enable);
@@ -128,21 +136,11 @@
     RuntimeEnabledFeatures::setFileSystemEnabled(enable);
 }
 
-void WebRuntimeFeatures::enableFullscreen(bool enable)
-{
-    RuntimeEnabledFeatures::setFullscreenEnabled(enable);
-}
-
 void WebRuntimeFeatures::enableGamepad(bool enable)
 {
     RuntimeEnabledFeatures::setGamepadEnabled(enable);
 }
 
-void WebRuntimeFeatures::enableGeolocation(bool enable)
-{
-    RuntimeEnabledFeatures::setGeolocationEnabled(enable);
-}
-
 void WebRuntimeFeatures::enableLazyLayout(bool enable)
 {
     // FIXME: Remove this once Chromium stops calling this.
@@ -279,11 +277,6 @@
     RuntimeEnabledFeatures::setOverlayScrollbarsEnabled(enable);
 }
 
-void WebRuntimeFeatures::enableInputModeAttribute(bool enable)
-{
-    RuntimeEnabledFeatures::setInputModeAttributeEnabled(enable);
-}
-
 void WebRuntimeFeatures::enableOverlayFullscreenVideo(bool enable)
 {
     RuntimeEnabledFeatures::setOverlayFullscreenVideoEnabled(enable);
diff --git a/Source/web/WebScriptController.cpp b/Source/web/WebScriptController.cpp
index f5aa23e..bb6120c 100644
--- a/Source/web/WebScriptController.cpp
+++ b/Source/web/WebScriptController.cpp
@@ -42,14 +42,4 @@
     ScriptController::registerExtensionIfNeeded(extension);
 }
 
-void WebScriptController::enableV8SingleThreadMode()
-{
-    // FIXME: remove this method after all it's usages are gone.
-}
-
-void WebScriptController::flushConsoleMessages()
-{
-    // FIXME: remove this method after all it's usages are gone.
-}
-
 } // namespace blink
diff --git a/Source/web/WebSearchableFormData.cpp b/Source/web/WebSearchableFormData.cpp
index 83579af..f4c9855 100644
--- a/Source/web/WebSearchableFormData.cpp
+++ b/Source/web/WebSearchableFormData.cpp
@@ -135,11 +135,12 @@
 // in its default state if the checked state matches the state of the checked attribute.
 bool IsInDefaultState(HTMLFormControlElement* formElement)
 {
-    if (formElement->hasTagName(HTMLNames::inputTag)) {
-        const HTMLInputElement* inputElement = toHTMLInputElement(formElement);
-        if (inputElement->isCheckbox() || inputElement->isRadioButton())
-            return inputElement->checked() == inputElement->hasAttribute(checkedAttr);
-    } else if (formElement->hasTagName(HTMLNames::selectTag)) {
+    ASSERT(formElement);
+    if (isHTMLInputElement(*formElement)) {
+        const HTMLInputElement& inputElement = toHTMLInputElement(*formElement);
+        if (inputElement.isCheckbox() || inputElement.isRadioButton())
+            return inputElement.checked() == inputElement.hasAttribute(checkedAttr);
+    } else if (isHTMLSelectElement(*formElement)) {
         return IsSelectInDefaultState(toHTMLSelectElement(formElement));
     }
     return true;
@@ -164,17 +165,17 @@
         if (control->isDisabledFormControl() || control->name().isNull())
             continue;
 
-        if (!IsInDefaultState(control) || control->hasTagName(textareaTag))
+        if (!IsInDefaultState(control) || isHTMLTextAreaElement(*control))
             return 0;
 
-        if (control->hasTagName(HTMLNames::inputTag) && control->willValidate()) {
-            const HTMLInputElement* input = toHTMLInputElement(control);
+        if (isHTMLInputElement(*control) && control->willValidate()) {
+            const HTMLInputElement& input = toHTMLInputElement(*control);
 
             // Return nothing if a file upload field or a password field are found.
-            if (input->isFileUpload() || input->isPasswordField())
+            if (input.isFileUpload() || input.isPasswordField())
                 return 0;
 
-            if (input->isTextField()) {
+            if (input.isTextField()) {
                 if (textElement) {
                     // The auto-complete bar only knows how to fill in one value.
                     // This form has multiple fields; don't treat it as searchable.
@@ -211,17 +212,13 @@
         if (!control->appendFormData(dataList, false))
             continue;
 
-        const Vector<FormDataList::Item>& items = dataList.items();
+        const WillBeHeapVector<FormDataList::Item>& items = dataList.items();
 
-        for (Vector<FormDataList::Item>::const_iterator j(items.begin()); j != items.end(); ++j) {
-            // Handle ISINDEX / <input name=isindex> specially, but only if it's
-            // the first entry.
-            if (!encodedString->isEmpty() || j->data() != "isindex") {
-                if (!encodedString->isEmpty())
-                    encodedString->append('&');
-                FormDataBuilder::encodeStringAsFormData(*encodedString, j->data());
-                encodedString->append('=');
-            }
+        for (WillBeHeapVector<FormDataList::Item>::const_iterator j(items.begin()); j != items.end(); ++j) {
+            if (!encodedString->isEmpty())
+                encodedString->append('&');
+            FormDataBuilder::encodeStringAsFormData(*encodedString, j->data());
+            encodedString->append('=');
             ++j;
             if (control == textElement) {
                 encodedString->append("{searchTerms}", 13);
diff --git a/Source/web/WebSelectElement.cpp b/Source/web/WebSelectElement.cpp
index 425244b..cfda345 100644
--- a/Source/web/WebSelectElement.cpp
+++ b/Source/web/WebSelectElement.cpp
@@ -41,16 +41,6 @@
 
 namespace blink {
 
-void WebSelectElement::setValue(const WebString& value)
-{
-    unwrap<HTMLSelectElement>()->setValue(value);
-}
-
-WebString WebSelectElement::value() const
-{
-    return constUnwrap<HTMLSelectElement>()->value();
-}
-
 WebVector<WebElement> WebSelectElement::listItems() const
 {
     const Vector<HTMLElement*>& sourceItems = constUnwrap<HTMLSelectElement>()->listItems();
diff --git a/Source/web/WebSettingsImpl.cpp b/Source/web/WebSettingsImpl.cpp
index 60a63ec..795fd55 100644
--- a/Source/web/WebSettingsImpl.cpp
+++ b/Source/web/WebSettingsImpl.cpp
@@ -56,7 +56,6 @@
     , m_viewportMetaLayoutSizeQuirk(false)
     , m_viewportMetaNonUserScalableQuirk(false)
     , m_clobberUserAgentInitialScaleQuirk(false)
-    , m_pinchOverlayScrollbarThickness(0)
     , m_mainFrameResizesAreOrientationChanges(false)
 {
     ASSERT(settings);
@@ -483,6 +482,11 @@
     m_settings->setAcceleratedCompositingForFixedRootBackgroundEnabled(enabled);
 }
 
+void WebSettingsImpl::setAcceleratedCompositingForGpuRasterizationHintEnabled(bool enabled)
+{
+    m_settings->setAcceleratedCompositingForGpuRasterizationHintEnabled(enabled);
+}
+
 void WebSettingsImpl::setAcceleratedCompositingForPluginsEnabled(bool enabled)
 {
     m_settings->setAcceleratedCompositingForPluginsEnabled(enabled);
@@ -704,6 +708,11 @@
     m_settings->setCookieEnabled(enabled);
 }
 
+void WebSettingsImpl::setNavigateOnDragDrop(bool enabled)
+{
+    m_settings->setNavigateOnDragDrop(enabled);
+}
+
 void WebSettingsImpl::setGestureTapHighlightEnabled(bool enableHighlight)
 {
     m_gestureTapHighlightEnabled = enableHighlight;
@@ -741,7 +750,7 @@
 
 void WebSettingsImpl::setPinchOverlayScrollbarThickness(int thickness)
 {
-    m_pinchOverlayScrollbarThickness = thickness;
+    m_settings->setPinchOverlayScrollbarThickness(thickness);
 }
 
 void WebSettingsImpl::setPinchVirtualViewportEnabled(bool enabled)
diff --git a/Source/web/WebSettingsImpl.h b/Source/web/WebSettingsImpl.h
index b2c1ca0..3736cec 100644
--- a/Source/web/WebSettingsImpl.h
+++ b/Source/web/WebSettingsImpl.h
@@ -62,6 +62,7 @@
     virtual void setCompositorDrivenAcceleratedScrollingEnabled(bool) OVERRIDE;
     virtual void setAcceleratedCompositingForTransitionEnabled(bool) OVERRIDE;
     virtual void setAcceleratedCompositingForFixedRootBackgroundEnabled(bool) OVERRIDE;
+    virtual void setAcceleratedCompositingForGpuRasterizationHintEnabled(bool) OVERRIDE;
     virtual void setAcceleratedCompositingForPluginsEnabled(bool) OVERRIDE;
     virtual void setAcceleratedCompositingForScrollableFramesEnabled(bool) OVERRIDE;
     virtual void setAcceleratedCompositingForVideoEnabled(bool) OVERRIDE;
@@ -80,6 +81,7 @@
     virtual void setCompositedScrollingForFramesEnabled(bool) OVERRIDE;
     virtual void setCompositorTouchHitTesting(bool) OVERRIDE;
     virtual void setCookieEnabled(bool) OVERRIDE;
+    virtual void setNavigateOnDragDrop(bool) OVERRIDE;
     virtual void setCursiveFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) OVERRIDE;
     virtual void setDNSPrefetchingEnabled(bool) OVERRIDE;
     virtual void setDOMPasteAllowed(bool) OVERRIDE;
@@ -197,7 +199,6 @@
     bool viewportMetaLayoutSizeQuirk() const { return m_viewportMetaLayoutSizeQuirk; }
     bool viewportMetaNonUserScalableQuirk() const { return m_viewportMetaNonUserScalableQuirk; }
     bool clobberUserAgentInitialScaleQuirk() const { return m_clobberUserAgentInitialScaleQuirk; }
-    int pinchOverlayScrollbarThickness() const { return m_pinchOverlayScrollbarThickness; }
 
 private:
     WebCore::Settings* m_settings;
@@ -223,7 +224,6 @@
     // the Android SDK prior to and including version 18. Presumably, this
     // can be removed any time after 2015. See http://crbug.com/313754.
     bool m_clobberUserAgentInitialScaleQuirk;
-    int m_pinchOverlayScrollbarThickness;
     bool m_mainFrameResizesAreOrientationChanges;
 };
 
diff --git a/Source/web/WebSharedWorkerImpl.cpp b/Source/web/WebSharedWorkerImpl.cpp
index 19be967..7898c73 100644
--- a/Source/web/WebSharedWorkerImpl.cpp
+++ b/Source/web/WebSharedWorkerImpl.cpp
@@ -50,14 +50,15 @@
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/FrameLoader.h"
 #include "core/page/Page.h"
-#include "core/page/PageGroup.h"
 #include "core/workers/SharedWorkerGlobalScope.h"
 #include "core/workers/SharedWorkerThread.h"
 #include "core/workers/WorkerClients.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkerScriptLoader.h"
 #include "core/workers/WorkerThreadStartupData.h"
+#include "heap/Handle.h"
 #include "modules/webdatabase/DatabaseTask.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceResponse.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
@@ -238,12 +239,20 @@
 
 void WebSharedWorkerImpl::postMessageToPageInspector(const String& message)
 {
-    callOnMainThread(bind(&WebSharedWorkerClient::dispatchDevToolsMessage, m_clientWeakPtr, message.isolatedCopy()));
+    // Note that we need to keep the closure creation on a separate line so
+    // that the temporary created by isolatedCopy() will always be destroyed
+    // before the copy in the closure is used on the main thread.
+    const Closure& boundFunction = bind(&WebSharedWorkerClient::dispatchDevToolsMessage, m_clientWeakPtr, message.isolatedCopy());
+    callOnMainThread(boundFunction);
 }
 
 void WebSharedWorkerImpl::updateInspectorStateCookie(const String& cookie)
 {
-    callOnMainThread(bind(&WebSharedWorkerClient::saveDevToolsAgentState, m_clientWeakPtr, cookie.isolatedCopy()));
+    // Note that we need to keep the closure creation on a separate line so
+    // that the temporary created by isolatedCopy() will always be destroyed
+    // before the copy in the closure is used on the main thread.
+    const Closure& boundFunction = bind(&WebSharedWorkerClient::saveDevToolsAgentState, m_clientWeakPtr, cookie.isolatedCopy());
+    callOnMainThread(boundFunction);
 }
 
 void WebSharedWorkerImpl::workerGlobalScopeClosed()
@@ -342,13 +351,13 @@
     provideDatabaseClientToWorker(workerClients.get(), DatabaseClientImpl::create());
     WebSecurityOrigin webSecurityOrigin(m_loadingDocument->securityOrigin());
     providePermissionClientToWorker(workerClients.get(), adoptPtr(client()->createWorkerPermissionClientProxy(webSecurityOrigin)));
-    OwnPtr<WorkerThreadStartupData> startupData = WorkerThreadStartupData::create(m_url, m_loadingDocument->userAgent(m_url), m_mainScriptLoader->script(), startMode, m_contentSecurityPolicy, static_cast<WebCore::ContentSecurityPolicy::HeaderType>(m_policyType), workerClients.release());
+    OwnPtrWillBeRawPtr<WorkerThreadStartupData> startupData = WorkerThreadStartupData::create(m_url, m_loadingDocument->userAgent(m_url), m_mainScriptLoader->script(), startMode, m_contentSecurityPolicy, static_cast<WebCore::ContentSecurityPolicyHeaderType>(m_policyType), workerClients.release());
     setWorkerThread(SharedWorkerThread::create(m_name, *this, *this, startupData.release()));
     InspectorInstrumentation::scriptImported(m_loadingDocument.get(), m_mainScriptLoader->identifier(), m_mainScriptLoader->script());
     m_mainScriptLoader.clear();
 
     if (m_attachDevToolsOnStart)
-        workerThread()->runLoop().postTaskForMode(createCallbackTask(connectToWorkerContextInspectorTask, true), WorkerDebuggerAgent::debuggerTaskMode);
+        workerThread()->runLoop().postDebuggerTask(createCallbackTask(connectToWorkerContextInspectorTask, true));
 
     workerThread()->start();
     if (client())
@@ -379,13 +388,13 @@
 {
     m_pauseWorkerContextOnStart = false;
     if (workerThread())
-        workerThread()->runLoop().postTaskForMode(createCallbackTask(resumeWorkerContextTask, true), WorkerDebuggerAgent::debuggerTaskMode);
+        workerThread()->runLoop().postDebuggerTask(createCallbackTask(resumeWorkerContextTask, true));
 }
 
 void WebSharedWorkerImpl::attachDevTools()
 {
     if (workerThread())
-        workerThread()->runLoop().postTaskForMode(createCallbackTask(connectToWorkerContextInspectorTask, true), WorkerDebuggerAgent::debuggerTaskMode);
+        workerThread()->runLoop().postDebuggerTask(createCallbackTask(connectToWorkerContextInspectorTask, true));
     else
         m_attachDevToolsOnStart = true;
 }
@@ -399,7 +408,7 @@
 
 void WebSharedWorkerImpl::reattachDevTools(const WebString& savedState)
 {
-    workerThread()->runLoop().postTaskForMode(createCallbackTask(reconnectToWorkerContextInspectorTask, String(savedState)), WorkerDebuggerAgent::debuggerTaskMode);
+    workerThread()->runLoop().postDebuggerTask(createCallbackTask(reconnectToWorkerContextInspectorTask, String(savedState)));
 }
 
 static void disconnectFromWorkerContextInspectorTask(ExecutionContext* context, bool)
@@ -410,7 +419,7 @@
 void WebSharedWorkerImpl::detachDevTools()
 {
     m_attachDevToolsOnStart = false;
-    workerThread()->runLoop().postTaskForMode(createCallbackTask(disconnectFromWorkerContextInspectorTask, true), WorkerDebuggerAgent::debuggerTaskMode);
+    workerThread()->runLoop().postDebuggerTask(createCallbackTask(disconnectFromWorkerContextInspectorTask, true));
 }
 
 static void dispatchOnInspectorBackendTask(ExecutionContext* context, const String& message)
@@ -420,7 +429,7 @@
 
 void WebSharedWorkerImpl::dispatchDevToolsMessage(const WebString& message)
 {
-    workerThread()->runLoop().postTaskForMode(createCallbackTask(dispatchOnInspectorBackendTask, String(message)), WorkerDebuggerAgent::debuggerTaskMode);
+    workerThread()->runLoop().postDebuggerTask(createCallbackTask(dispatchOnInspectorBackendTask, String(message)));
     WorkerDebuggerAgent::interruptAndDispatchInspectorCommands(workerThread());
 }
 
diff --git a/Source/web/WebSpeechGrammar.cpp b/Source/web/WebSpeechGrammar.cpp
index 1b9aaa5..3bc20aa 100644
--- a/Source/web/WebSpeechGrammar.cpp
+++ b/Source/web/WebSpeechGrammar.cpp
@@ -41,12 +41,12 @@
     m_private = other.m_private;
 }
 
-WebSpeechGrammar::WebSpeechGrammar(const PassRefPtr<WebCore::SpeechGrammar>& value)
+WebSpeechGrammar::WebSpeechGrammar(const PassRefPtrWillBeRawPtr<WebCore::SpeechGrammar>& value)
     : m_private(value)
 {
 }
 
-WebSpeechGrammar& WebSpeechGrammar::operator=(const WTF::PassRefPtr<WebCore::SpeechGrammar>& value)
+WebSpeechGrammar& WebSpeechGrammar::operator=(const PassRefPtrWillBeRawPtr<WebCore::SpeechGrammar>& value)
 {
     m_private = value;
     return *this;
diff --git a/Source/web/WebSpeechInputResult.cpp b/Source/web/WebSpeechInputResult.cpp
index 6120d8f..a6fa69c 100644
--- a/Source/web/WebSpeechInputResult.cpp
+++ b/Source/web/WebSpeechInputResult.cpp
@@ -38,7 +38,7 @@
     m_private.reset();
 }
 
-WebSpeechInputResult::WebSpeechInputResult(const PassRefPtr<WebCore::SpeechInputResult>& value)
+WebSpeechInputResult::WebSpeechInputResult(const PassRefPtrWillBeRawPtr<WebCore::SpeechInputResult>& value)
     : m_private(value)
 {
 }
@@ -53,7 +53,7 @@
     m_private = WebCore::SpeechInputResult::create(*other.m_private.get());
 }
 
-WebSpeechInputResult::operator PassRefPtr<WebCore::SpeechInputResult>() const
+WebSpeechInputResult::operator PassRefPtrWillBeRawPtr<WebCore::SpeechInputResult>() const
 {
     return m_private.get();
 }
diff --git a/Source/web/WebSpeechRecognitionHandle.cpp b/Source/web/WebSpeechRecognitionHandle.cpp
index 4f89c5c..51fdcff 100644
--- a/Source/web/WebSpeechRecognitionHandle.cpp
+++ b/Source/web/WebSpeechRecognitionHandle.cpp
@@ -52,18 +52,18 @@
     return m_private.get() < other.m_private.get();
 }
 
-WebSpeechRecognitionHandle::WebSpeechRecognitionHandle(const PassRefPtr<SpeechRecognition>& speechRecognition)
+WebSpeechRecognitionHandle::WebSpeechRecognitionHandle(const PassRefPtrWillBeRawPtr<SpeechRecognition>& speechRecognition)
     : m_private(speechRecognition)
 {
 }
 
-WebSpeechRecognitionHandle& WebSpeechRecognitionHandle::operator=(const PassRefPtr<SpeechRecognition>& speechRecognition)
+WebSpeechRecognitionHandle& WebSpeechRecognitionHandle::operator=(const PassRefPtrWillBeRawPtr<SpeechRecognition>& speechRecognition)
 {
     m_private = speechRecognition;
     return *this;
 }
 
-WebSpeechRecognitionHandle::operator PassRefPtr<SpeechRecognition>() const
+WebSpeechRecognitionHandle::operator PassRefPtrWillBeRawPtr<SpeechRecognition>() const
 {
     return m_private.get();
 }
diff --git a/Source/web/WebSpeechRecognitionResult.cpp b/Source/web/WebSpeechRecognitionResult.cpp
index fee75e2..1807c8f 100644
--- a/Source/web/WebSpeechRecognitionResult.cpp
+++ b/Source/web/WebSpeechRecognitionResult.cpp
@@ -34,16 +34,6 @@
 #include "wtf/RefPtr.h"
 #include "wtf/Vector.h"
 
-// FIXME: oilpan: If the WebCore-qualified Oilpan transition types
-// used below map to CPP #defines, move the type names they expand to
-// into the WebCore namespace. When Oilpan is always enabled, this
-// block can be removed.
-namespace WebCore {
-using WTF::RawPtr;
-using WTF::RefPtr;
-using WTF::Vector;
-};
-
 namespace blink {
 
 void WebSpeechRecognitionResult::assign(const WebSpeechRecognitionResult& other)
@@ -55,7 +45,7 @@
 {
     ASSERT(transcripts.size() == confidences.size());
 
-    WebCore::WillBeHeapVector<WebCore::RefPtrWillBeMember<WebCore::SpeechRecognitionAlternative> > alternatives(transcripts.size());
+    WillBeHeapVector<RefPtrWillBeMember<WebCore::SpeechRecognitionAlternative> > alternatives(transcripts.size());
     for (size_t i = 0; i < transcripts.size(); ++i)
         alternatives[i] = WebCore::SpeechRecognitionAlternative::create(transcripts[i], confidences[i]);
 
@@ -67,7 +57,7 @@
     m_private.reset();
 }
 
-WebSpeechRecognitionResult::operator PassRefPtr<WebCore::SpeechRecognitionResult>() const
+WebSpeechRecognitionResult::operator PassRefPtrWillBeRawPtr<WebCore::SpeechRecognitionResult>() const
 {
     return m_private.get();
 }
diff --git a/Source/web/WebTextAreaElement.cpp b/Source/web/WebTextAreaElement.cpp
index c4ecd8b..7ea4e8b 100644
--- a/Source/web/WebTextAreaElement.cpp
+++ b/Source/web/WebTextAreaElement.cpp
@@ -40,26 +40,6 @@
 
 namespace blink {
 
-void WebTextAreaElement::setValue(const WebString& value)
-{
-    unwrap<HTMLTextAreaElement>()->setValue(value);
-}
-
-WebString WebTextAreaElement::value() const
-{
-    return constUnwrap<HTMLTextAreaElement>()->value();
-}
-
-void WebTextAreaElement::setSuggestedValue(const WebString& value)
-{
-    unwrap<HTMLTextAreaElement>()->setSuggestedValue(value);
-}
-
-WebString WebTextAreaElement::suggestedValue() const
-{
-    return constUnwrap<HTMLTextAreaElement>()->suggestedValue();
-}
-
 WebTextAreaElement::WebTextAreaElement(const PassRefPtr<HTMLTextAreaElement>& element)
     : WebFormControlElement(element)
 {
diff --git a/Source/web/WebUserGestureIndicator.cpp b/Source/web/WebUserGestureIndicator.cpp
index 6d7ef34..deea3a3 100644
--- a/Source/web/WebUserGestureIndicator.cpp
+++ b/Source/web/WebUserGestureIndicator.cpp
@@ -38,35 +38,6 @@
 
 namespace blink {
 
-class WebUserGestureHandlerHolder : public UserGestureHandler {
-public:
-    WebUserGestureHandlerHolder()
-        : m_handler(0)
-    {
-        UserGestureIndicator::setHandler(this);
-    }
-
-    virtual void onGesture()
-    {
-        if (m_handler)
-            m_handler->onGesture();
-    }
-
-    void setHandler(WebUserGestureHandler* handler)
-    {
-        m_handler = handler;
-    }
-
-private:
-    WebUserGestureHandler* m_handler;
-};
-
-WebUserGestureHandlerHolder* gestureHandler()
-{
-    DEFINE_STATIC_LOCAL(WebUserGestureHandlerHolder, handler, ());
-    return &handler;
-}
-
 bool WebUserGestureIndicator::isProcessingUserGesture()
 {
     return UserGestureIndicator::processingUserGesture();
@@ -82,9 +53,4 @@
     return WebUserGestureToken(UserGestureIndicator::currentToken());
 }
 
-void WebUserGestureIndicator::setHandler(WebUserGestureHandler* handler)
-{
-    gestureHandler()->setHandler(handler);
-}
-
 } // namespace blink
diff --git a/Source/web/WebUserMediaRequest.cpp b/Source/web/WebUserMediaRequest.cpp
index 3f7b9d7..fcf1db4 100644
--- a/Source/web/WebUserMediaRequest.cpp
+++ b/Source/web/WebUserMediaRequest.cpp
@@ -107,10 +107,10 @@
     m_private->succeed(streamDescriptor);
 }
 
-void WebUserMediaRequest::requestFailed(const WebString& description)
+void WebUserMediaRequest::requestDenied(const WebString& description)
 {
     ASSERT(!isNull());
-    m_private->fail(description);
+    m_private->failPermissionDenied(description);
 }
 
 void WebUserMediaRequest::requestFailedConstraint(const WebString& constraintName, const WebString& description)
@@ -119,6 +119,12 @@
     m_private->failConstraint(constraintName, description);
 }
 
+void WebUserMediaRequest::requestFailedUASpecific(const WebString& name, const WebString& constraintName, const WebString& description)
+{
+    ASSERT(!isNull());
+    m_private->failUASpecific(name, constraintName, description);
+}
+
 bool WebUserMediaRequest::equals(const WebUserMediaRequest& other) const
 {
     if (isNull() || other.isNull())
diff --git a/Source/web/WebViewImpl.cpp b/Source/web/WebViewImpl.cpp
index d676350..5f30203 100644
--- a/Source/web/WebViewImpl.cpp
+++ b/Source/web/WebViewImpl.cpp
@@ -42,7 +42,6 @@
 #include "LinkHighlight.h"
 #include "LocalFileSystemClient.h"
 #include "MIDIClientProxy.h"
-#include "PinchViewports.h"
 #include "PopupContainer.h"
 #include "PrerendererClientImpl.h"
 #include "RuntimeEnabledFeatures.h"
@@ -57,8 +56,6 @@
 #include "WebDevToolsAgentImpl.h"
 #include "WebDevToolsAgentPrivate.h"
 #include "WebFrameImpl.h"
-#include "WebHelperPlugin.h"
-#include "WebHelperPluginImpl.h"
 #include "WebHitTestResult.h"
 #include "WebInputElement.h"
 #include "WebInputEventConversion.h"
@@ -87,8 +84,10 @@
 #include "core/editing/TextIterator.h"
 #include "core/events/KeyboardEvent.h"
 #include "core/events/WheelEvent.h"
-#include "core/frame/Frame.h"
+#include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
+#include "core/frame/PinchViewport.h"
 #include "core/frame/Settings.h"
 #include "core/frame/SmartClip.h"
 #include "core/html/HTMLInputElement.h"
@@ -110,15 +109,14 @@
 #include "core/page/FrameTree.h"
 #include "core/page/InjectedStyleSheets.h"
 #include "core/page/Page.h"
-#include "core/page/PageGroup.h"
-#include "core/page/PageGroupLoadDeferrer.h"
 #include "core/page/PagePopupClient.h"
 #include "core/page/PointerLockController.h"
+#include "core/page/ScopedPageLoadDeferrer.h"
 #include "core/page/TouchDisambiguation.h"
-#include "core/rendering/RenderLayerCompositor.h"
 #include "core/rendering/RenderView.h"
 #include "core/rendering/RenderWidget.h"
 #include "core/rendering/TextAutosizer.h"
+#include "core/rendering/compositing/RenderLayerCompositor.h"
 #include "modules/device_orientation/DeviceOrientationInspectorAgent.h"
 #include "modules/geolocation/GeolocationController.h"
 #include "modules/indexeddb/InspectorIndexedDBAgent.h"
@@ -202,9 +200,9 @@
 
 // Used to defer all page activity in cases where the embedder wishes to run
 // a nested event loop. Using a stack enables nesting of message loop invocations.
-static Vector<PageGroupLoadDeferrer*>& pageGroupLoadDeferrerStack()
+static Vector<ScopedPageLoadDeferrer*>& pageLoadDeferrerStack()
 {
-    DEFINE_STATIC_LOCAL(Vector<PageGroupLoadDeferrer*>, deferrerStack, ());
+    DEFINE_STATIC_LOCAL(Vector<ScopedPageLoadDeferrer*>, deferrerStack, ());
     return deferrerStack;
 }
 
@@ -268,21 +266,15 @@
 
 void WebView::willEnterModalLoop()
 {
-    PageGroup* pageGroup = PageGroup::sharedGroup();
-    if (pageGroup->pages().isEmpty())
-        pageGroupLoadDeferrerStack().append(static_cast<PageGroupLoadDeferrer*>(0));
-    else {
-        // Pick any page in the page group since we are deferring all pages.
-        pageGroupLoadDeferrerStack().append(new PageGroupLoadDeferrer(*pageGroup->pages().begin(), true));
-    }
+    pageLoadDeferrerStack().append(new ScopedPageLoadDeferrer());
 }
 
 void WebView::didExitModalLoop()
 {
-    ASSERT(pageGroupLoadDeferrerStack().size());
+    ASSERT(pageLoadDeferrerStack().size());
 
-    delete pageGroupLoadDeferrerStack().last();
-    pageGroupLoadDeferrerStack().removeLast();
+    delete pageLoadDeferrerStack().last();
+    pageLoadDeferrerStack().removeLast();
 }
 
 void WebViewImpl::setMainFrame(WebFrame* frame)
@@ -305,7 +297,8 @@
 
 void WebViewImpl::setPrerendererClient(WebPrerendererClient* prerendererClient)
 {
-    providePrerendererClientTo(m_page.get(), new PrerendererClientImpl(prerendererClient));
+    ASSERT(m_page);
+    providePrerendererClientTo(*m_page, new PrerendererClientImpl(prerendererClient));
 }
 
 void WebViewImpl::setSpellCheckClient(WebSpellCheckClient* spellCheckClient)
@@ -357,6 +350,7 @@
     , m_layerTreeView(0)
     , m_rootLayer(0)
     , m_rootGraphicsLayer(0)
+    , m_rootTransformLayer(0)
     , m_graphicsLayerFactory(adoptPtr(new GraphicsLayerFactoryChromium(this)))
     , m_isAcceleratedCompositingActive(false)
     , m_layerTreeViewCommitsDeferred(false)
@@ -381,7 +375,6 @@
     , m_baseBackgroundColor(Color::white)
     , m_backgroundColorOverride(Color::transparent)
     , m_zoomFactorOverride(0)
-    , m_helperPluginCloseTimer(this, &WebViewImpl::closePendingHelperPlugins)
 {
     Page::PageClients pageClients;
     pageClients.chromeClient = &m_chromeClientImpl;
@@ -394,30 +387,30 @@
     pageClients.storageClient = &m_storageClientImpl;
 
     m_page = adoptPtr(new Page(pageClients));
-    provideUserMediaTo(m_page.get(), &m_userMediaClientImpl);
-    provideMIDITo(m_page.get(), m_midiClientProxy.get());
+    provideUserMediaTo(*m_page, &m_userMediaClientImpl);
+    provideMIDITo(*m_page, m_midiClientProxy.get());
 #if ENABLE(INPUT_SPEECH)
-    provideSpeechInputTo(m_page.get(), m_speechInputClient.get());
+    provideSpeechInputTo(*m_page, m_speechInputClient.get());
 #endif
-    provideSpeechRecognitionTo(m_page.get(), m_speechRecognitionClient.get());
-    provideNotification(m_page.get(), notificationPresenterImpl());
-    provideNavigatorContentUtilsTo(m_page.get(), m_navigatorContentUtilsClient.get());
+    provideSpeechRecognitionTo(*m_page, m_speechRecognitionClient.get());
+    provideNotification(*m_page, notificationPresenterImpl());
+    provideNavigatorContentUtilsTo(*m_page, m_navigatorContentUtilsClient.get());
 
-    provideContextFeaturesTo(m_page.get(), m_featureSwitchClient.get());
+    provideContextFeaturesTo(*m_page, m_featureSwitchClient.get());
     if (RuntimeEnabledFeatures::deviceOrientationEnabled())
-        DeviceOrientationInspectorAgent::provideTo(m_page.get());
-    provideGeolocationTo(m_page.get(), m_geolocationClientProxy.get());
+        DeviceOrientationInspectorAgent::provideTo(*m_page);
+    provideGeolocationTo(*m_page, m_geolocationClientProxy.get());
     m_geolocationClientProxy->setController(GeolocationController::from(m_page.get()));
 
-    provideLocalFileSystemTo(m_page.get(), LocalFileSystemClient::create());
-    provideDatabaseClientTo(m_page.get(), DatabaseClientImpl::create());
+    provideLocalFileSystemTo(*m_page, LocalFileSystemClient::create());
+    provideDatabaseClientTo(*m_page, DatabaseClientImpl::create());
     InspectorIndexedDBAgent::provideTo(m_page.get());
-    provideStorageQuotaClientTo(m_page.get(), StorageQuotaClientImpl::create());
+    provideStorageQuotaClientTo(*m_page, StorageQuotaClientImpl::create());
     m_validationMessage = ValidationMessageClientImpl::create(*this);
     m_page->setValidationMessageClient(m_validationMessage.get());
-    provideWorkerGlobalScopeProxyProviderTo(m_page.get(), WorkerGlobalScopeProxyProviderImpl::create());
+    provideWorkerGlobalScopeProxyProviderTo(*m_page, WorkerGlobalScopeProxyProviderImpl::create());
 
-    m_page->setGroupType(Page::SharedPageGroup);
+    m_page->makeOrdinary();
 
     if (m_client) {
         setDeviceScaleFactor(m_client->screenInfo().deviceScaleFactor);
@@ -430,8 +423,6 @@
 WebViewImpl::~WebViewImpl()
 {
     ASSERT(!m_page);
-    ASSERT(!m_helperPluginCloseTimer.isActive());
-    ASSERT(m_helperPluginsPendingClose.isEmpty());
 }
 
 WebFrameImpl* WebViewImpl::mainFrameImpl()
@@ -451,13 +442,13 @@
         m_page->setTabKeyCyclesThroughElements(value);
 }
 
-void WebViewImpl::handleMouseLeave(Frame& mainFrame, const WebMouseEvent& event)
+void WebViewImpl::handleMouseLeave(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     m_client->setMouseOverURL(WebURL());
     PageWidgetEventHandler::handleMouseLeave(mainFrame, event);
 }
 
-void WebViewImpl::handleMouseDown(Frame& mainFrame, const WebMouseEvent& event)
+void WebViewImpl::handleMouseDown(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     // If there is a popup open, close it as the user is clicking on the page (outside of the
     // popup). We also save it so we can prevent a click on an element from immediately
@@ -528,7 +519,7 @@
 
     // Find the right target frame. See issue 1186900.
     HitTestResult result = hitTestResultForWindowPos(pme.position());
-    Frame* targetFrame;
+    LocalFrame* targetFrame;
     if (result.innerNonSharedNode())
         targetFrame = result.innerNonSharedNode()->document().frame();
     else
@@ -545,7 +536,7 @@
     // implementation...
 }
 
-void WebViewImpl::handleMouseUp(Frame& mainFrame, const WebMouseEvent& event)
+void WebViewImpl::handleMouseUp(LocalFrame& mainFrame, const WebMouseEvent& event)
 {
     PageWidgetEventHandler::handleMouseUp(mainFrame, event);
 
@@ -557,7 +548,7 @@
 #endif
 }
 
-bool WebViewImpl::handleMouseWheel(Frame& mainFrame, const WebMouseWheelEvent& event)
+bool WebViewImpl::handleMouseWheel(LocalFrame& mainFrame, const WebMouseWheelEvent& event)
 {
     hidePopups();
     return PageWidgetEventHandler::handleMouseWheel(mainFrame, event);
@@ -850,6 +841,33 @@
     m_showScrollBottleneckRects = show;
 }
 
+void WebViewImpl::getSelectionRootBounds(WebRect& bounds) const
+{
+    const LocalFrame* frame = focusedWebCoreFrame();
+    if (!frame)
+        return;
+
+    Element* root = frame->selection().rootEditableElementOrDocumentElement();
+    if (!root)
+        return;
+
+    // If the selection is inside a form control, the root will be a <div> that
+    // behaves as the editor but we want to return the actual element's bounds.
+    // In practice, that means <textarea> and <input> controls that behave like
+    // a text field.
+    Element* shadowHost = root->shadowHost();
+    if (shadowHost
+        && (isHTMLTextAreaElement(*shadowHost)
+            || (isHTMLInputElement(*shadowHost)
+                && toHTMLInputElement(*shadowHost).isText())))
+        root = shadowHost;
+
+    IntRect boundingBox = root->pixelSnappedBoundingBox();
+    boundingBox = root->document().frame()->view()->contentsToWindow(boundingBox);
+    boundingBox.scale(pageScaleFactor());
+    bounds = boundingBox;
+}
+
 bool WebViewImpl::handleKeyEvent(const WebKeyboardEvent& event)
 {
     ASSERT((event.type == WebInputEvent::RawKeyDown)
@@ -880,7 +898,7 @@
         return true;
     }
 
-    RefPtr<Frame> frame = focusedWebCoreFrame();
+    RefPtr<LocalFrame> frame = focusedWebCoreFrame();
     if (!frame)
         return false;
 
@@ -935,7 +953,7 @@
     if (m_pagePopup)
         return m_pagePopup->handleKeyEvent(PlatformKeyboardEventBuilder(event));
 
-    Frame* frame = focusedWebCoreFrame();
+    LocalFrame* frame = focusedWebCoreFrame();
     if (!frame)
         return suppress;
 
@@ -983,7 +1001,7 @@
     // Return the bounding box in the window coordinate system.
     if (node) {
         IntRect rect = node->Node::pixelSnappedBoundingBox();
-        Frame* frame = node->document().frame();
+        LocalFrame* frame = node->document().frame();
         return frame->view()->contentsToWindow(rect);
     }
     return WebRect();
@@ -1093,7 +1111,7 @@
     scroll = clampOffsetAtScale(scroll, scale);
 }
 
-static bool invokesHandCursor(Node* node, bool shiftKey, Frame* frame)
+static bool invokesHandCursor(Node* node, bool shiftKey, LocalFrame* frame)
 {
     if (!node || !node->renderer())
         return false;
@@ -1149,10 +1167,16 @@
 
 void WebViewImpl::enableTapHighlights(Vector<Node*>& highlightNodes)
 {
+    if (highlightNodes.isEmpty())
+        return;
+
     // Always clear any existing highlight when this is invoked, even if we
     // don't get a new target to highlight.
     m_linkHighlights.clear();
 
+    // LinkHighlight reads out layout and compositing state, so we need to make sure that's all up to date.
+    layout();
+
     for (size_t i = 0; i < highlightNodes.size(); ++i) {
         Node* node = highlightNodes[i];
 
@@ -1274,7 +1298,7 @@
     page()->contextMenuController().clearContextMenu();
 
     m_contextMenuAllowed = true;
-    Frame* focusedFrame = page()->focusController().focusedOrMainFrame();
+    LocalFrame* focusedFrame = page()->focusController().focusedOrMainFrame();
     bool handled = focusedFrame->eventHandler().sendContextMenuEventForKey();
     m_contextMenuAllowed = false;
     return handled;
@@ -1283,7 +1307,7 @@
 
 bool WebViewImpl::keyEventDefault(const WebKeyboardEvent& event)
 {
-    Frame* frame = focusedWebCoreFrame();
+    LocalFrame* frame = focusedWebCoreFrame();
     if (!frame)
         return false;
 
@@ -1396,7 +1420,7 @@
 
 bool WebViewImpl::bubblingScroll(ScrollDirection scrollDirection, ScrollGranularity scrollGranularity)
 {
-    Frame* frame = focusedWebCoreFrame();
+    LocalFrame* frame = focusedWebCoreFrame();
     if (!frame)
         return false;
 
@@ -1407,15 +1431,17 @@
 {
     ASSERT(!m_selectPopup);
     m_selectPopup = popupContainer;
-    Document* document = mainFrameImpl()->frame()->document();
+    ASSERT(mainFrameImpl()->frame()->document());
+    Document& document = *mainFrameImpl()->frame()->document();
     WheelController::from(document)->didAddWheelEventHandler(document);
 }
 
 void WebViewImpl::popupClosed(PopupContainer* popupContainer)
 {
     ASSERT(m_selectPopup);
-    m_selectPopup = 0;
-    Document* document = mainFrameImpl()->frame()->document();
+    m_selectPopup = nullptr;
+    ASSERT(mainFrameImpl()->frame()->document());
+    Document& document = *mainFrameImpl()->frame()->document();
     WheelController::from(document)->didRemoveWheelEventHandler(document);
 }
 
@@ -1431,7 +1457,7 @@
     m_pagePopup = toWebPagePopupImpl(popupWidget);
     if (!m_pagePopup->initialize(this, client, originBoundsInRootView)) {
         m_pagePopup->closePopup();
-        m_pagePopup = 0;
+        m_pagePopup = nullptr;
     }
     return m_pagePopup.get();
 }
@@ -1444,45 +1470,10 @@
     if (m_pagePopup.get() != popupImpl)
         return;
     m_pagePopup->closePopup();
-    m_pagePopup = 0;
+    m_pagePopup = nullptr;
 }
 
-WebHelperPlugin* WebViewImpl::createHelperPlugin(const WebString& pluginType, const WebDocument& hostDocument)
-{
-    WebWidget* popupWidget = m_client->createPopupMenu(WebPopupTypeHelperPlugin);
-    ASSERT(popupWidget);
-    WebHelperPluginImpl* helperPlugin = toWebHelperPluginImpl(popupWidget);
-
-    if (!helperPlugin->initialize(pluginType, hostDocument, this)) {
-        closeAndDeleteHelperPluginSoon(helperPlugin);
-        return 0;
-    }
-
-    return helperPlugin;
-}
-
-void WebViewImpl::closeAndDeleteHelperPluginSoon(WebHelperPluginImpl* helperPlugin)
-{
-    m_helperPluginsPendingClose.append(helperPlugin);
-    if (!m_helperPluginCloseTimer.isActive())
-        m_helperPluginCloseTimer.startOneShot(0);
-}
-
-void WebViewImpl::closePendingHelperPlugins(Timer<WebViewImpl>* timer)
-{
-    ASSERT_UNUSED(timer, !timer || timer == &m_helperPluginCloseTimer);
-    ASSERT(!m_helperPluginsPendingClose.isEmpty());
-
-    Vector<WebHelperPluginImpl*> helperPlugins;
-    helperPlugins.swap(m_helperPluginsPendingClose);
-    for (Vector<WebHelperPluginImpl*>::iterator it = helperPlugins.begin();
-        it != helperPlugins.end(); ++it) {
-        (*it)->closeAndDelete();
-    }
-    ASSERT(m_helperPluginsPendingClose.isEmpty());
-}
-
-Frame* WebViewImpl::focusedWebCoreFrame() const
+LocalFrame* WebViewImpl::focusedWebCoreFrame() const
 {
     return m_page ? m_page->focusController().focusedOrMainFrame() : 0;
 }
@@ -1499,6 +1490,9 @@
 void WebViewImpl::close()
 {
     if (m_page) {
+        // Disable all agents prior to deleting the page.
+        m_page->inspectorController().inspectedPageDestroyed();
+
         // Initiate shutdown for the entire frameset.  This will cause a lot of
         // notifications to be sent.
         if (m_page->mainFrame())
@@ -1511,13 +1505,6 @@
     if (m_devToolsAgent)
         m_devToolsAgent.clear();
 
-    // Helper Plugins must be closed now since doing so accesses RenderViewImpl,
-    // which will be destroyed after this function returns.
-    if (m_helperPluginCloseTimer.isActive()) {
-        m_helperPluginCloseTimer.stop();
-        closePendingHelperPlugins(0);
-    }
-
     // Reset the delegate to prevent notifications being sent as we're being
     // deleted.
     m_client = 0;
@@ -1530,7 +1517,7 @@
     if (mainFrameImpl() && mainFrameImpl()->frameView())
         mainFrameImpl()->frameView()->willStartLiveResize();
 
-    Frame* frame = mainFrameImpl()->frame();
+    LocalFrame* frame = mainFrameImpl()->frame();
     WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
     if (pluginContainer)
         pluginContainer->willStartLiveResize();
@@ -1574,8 +1561,8 @@
     WebFrameImpl* webFrame = mainFrameImpl();
     if (webFrame->frameView()) {
         webFrame->frameView()->resize(m_size);
-        if (m_pinchViewports)
-            m_pinchViewports->setViewportSize(m_size);
+        if (page()->settings().pinchVirtualViewportEnabled())
+            page()->frameHost().pinchViewport().setViewportSize(m_size);
     }
 
     if (settings()->viewportEnabled() && !m_fixedLayoutSizeLock) {
@@ -1609,7 +1596,7 @@
     if (mainFrameImpl() && mainFrameImpl()->frameView())
         mainFrameImpl()->frameView()->willEndLiveResize();
 
-    Frame* frame = mainFrameImpl()->frame();
+    LocalFrame* frame = mainFrameImpl()->frame();
     WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
     if (pluginContainer)
         pluginContainer->willEndLiveResize();
@@ -1689,7 +1676,7 @@
     if (enter) {
         if (!m_page)
             return;
-        Frame* mainFrame = m_page->mainFrame();
+        LocalFrame* mainFrame = m_page->mainFrame();
         if (!mainFrame)
             return;
         mainFrame->view()->updateCompositingLayersAfterStyleChange();
@@ -1861,7 +1848,7 @@
 void WebViewImpl::mouseCaptureLost()
 {
     TRACE_EVENT_ASYNC_END0("input", "capturing mouse", this);
-    m_mouseCaptureNode = 0;
+    m_mouseCaptureNode = nullptr;
 }
 
 void WebViewImpl::setFocus(bool enable)
@@ -1869,7 +1856,7 @@
     m_page->focusController().setFocused(enable);
     if (enable) {
         m_page->focusController().setActive(true);
-        RefPtr<Frame> focusedFrame = m_page->focusController().focusedFrame();
+        RefPtr<LocalFrame> focusedFrame = m_page->focusController().focusedFrame();
         if (focusedFrame) {
             Element* element = focusedFrame->document()->focusedElement();
             if (element && focusedFrame->selection().selection().isNone()) {
@@ -1896,11 +1883,11 @@
         if (!m_page)
             return;
 
-        Frame* frame = m_page->mainFrame();
+        LocalFrame* frame = m_page->mainFrame();
         if (!frame)
             return;
 
-        RefPtr<Frame> focusedFrame = m_page->focusController().focusedFrame();
+        RefPtr<LocalFrame> focusedFrame = m_page->focusController().focusedFrame();
         if (focusedFrame) {
             // Finish an ongoing composition to delete the composition node.
             if (focusedFrame->inputMethodController().hasComposition()) {
@@ -1923,7 +1910,7 @@
     int selectionStart,
     int selectionEnd)
 {
-    Frame* focused = focusedWebCoreFrame();
+    LocalFrame* focused = focusedWebCoreFrame();
     if (!focused || !m_imeAcceptEvents)
         return false;
 
@@ -1989,7 +1976,7 @@
 
 bool WebViewImpl::confirmComposition(const WebString& text, ConfirmCompositionBehavior selectionBehavior)
 {
-    Frame* focused = focusedWebCoreFrame();
+    LocalFrame* focused = focusedWebCoreFrame();
     if (!focused || !m_imeAcceptEvents)
         return false;
 
@@ -2001,7 +1988,7 @@
 
 bool WebViewImpl::compositionRange(size_t* location, size_t* length)
 {
-    Frame* focused = focusedWebCoreFrame();
+    LocalFrame* focused = focusedWebCoreFrame();
     if (!focused || !m_imeAcceptEvents)
         return false;
 
@@ -2023,7 +2010,7 @@
 {
     WebTextInputInfo info;
 
-    Frame* focused = focusedWebCoreFrame();
+    LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return info;
 
@@ -2071,42 +2058,42 @@
     if (!element)
         return WebTextInputTypeNone;
 
-    if (element->hasTagName(HTMLNames::inputTag)) {
-        HTMLInputElement* input = toHTMLInputElement(element);
+    if (isHTMLInputElement(*element)) {
+        HTMLInputElement& input = toHTMLInputElement(*element);
 
-        if (input->isDisabledOrReadOnly())
+        if (input.isDisabledOrReadOnly())
             return WebTextInputTypeNone;
 
-        if (input->isPasswordField())
+        if (input.isPasswordField())
             return WebTextInputTypePassword;
-        if (input->isSearchField())
+        if (input.isSearchField())
             return WebTextInputTypeSearch;
-        if (input->isEmailField())
+        if (input.isEmailField())
             return WebTextInputTypeEmail;
-        if (input->isNumberField())
+        if (input.isNumberField())
             return WebTextInputTypeNumber;
-        if (input->isTelephoneField())
+        if (input.isTelephoneField())
             return WebTextInputTypeTelephone;
-        if (input->isURLField())
+        if (input.isURLField())
             return WebTextInputTypeURL;
-        if (input->isDateField())
+        if (input.isDateField())
             return WebTextInputTypeDate;
-        if (input->isDateTimeLocalField())
+        if (input.isDateTimeLocalField())
             return WebTextInputTypeDateTimeLocal;
-        if (input->isMonthField())
+        if (input.isMonthField())
             return WebTextInputTypeMonth;
-        if (input->isTimeField())
+        if (input.isTimeField())
             return WebTextInputTypeTime;
-        if (input->isWeekField())
+        if (input.isWeekField())
             return WebTextInputTypeWeek;
-        if (input->isTextField())
+        if (input.isTextField())
             return WebTextInputTypeText;
 
         return WebTextInputTypeNone;
     }
 
-    if (element->hasTagName(HTMLNames::textareaTag)) {
-        if (toHTMLTextAreaElement(element)->isDisabledOrReadOnly())
+    if (isHTMLTextAreaElement(*element)) {
+        if (toHTMLTextAreaElement(*element).isDisabledOrReadOnly())
             return WebTextInputTypeNone;
         return WebTextInputTypeTextArea;
     }
@@ -2133,15 +2120,15 @@
     if (!element)
         return WebString();
 
-    if (element->hasTagName(HTMLNames::inputTag)) {
-        const HTMLInputElement* input = toHTMLInputElement(element);
-        if (input->supportsInputModeAttribute())
-            return input->fastGetAttribute(HTMLNames::inputmodeAttr).lower();
+    if (isHTMLInputElement(*element)) {
+        const HTMLInputElement& input = toHTMLInputElement(*element);
+        if (input.supportsInputModeAttribute())
+            return input.fastGetAttribute(HTMLNames::inputmodeAttr).lower();
         return WebString();
     }
-    if (element->hasTagName(HTMLNames::textareaTag)) {
-        const HTMLTextAreaElement* textarea = toHTMLTextAreaElement(element);
-        return textarea->fastGetAttribute(HTMLNames::inputmodeAttr).lower();
+    if (isHTMLTextAreaElement(*element)) {
+        const HTMLTextAreaElement& textarea = toHTMLTextAreaElement(*element);
+        return textarea.fastGetAttribute(HTMLNames::inputmodeAttr).lower();
     }
 
     return WebString();
@@ -2149,7 +2136,7 @@
 
 bool WebViewImpl::selectionBounds(WebRect& anchor, WebRect& focus) const
 {
-    const Frame* frame = focusedWebCoreFrame();
+    const LocalFrame* frame = focusedWebCoreFrame();
     if (!frame)
         return false;
     FrameSelection& selection = frame->selection();
@@ -2193,18 +2180,18 @@
     if (!m_imeAcceptEvents)
         return 0;
 
-    Frame* focusedFrame = focusedWebCoreFrame();
+    LocalFrame* focusedFrame = focusedWebCoreFrame();
     if (!focusedFrame)
         return 0;
 
     Element* target = focusedFrame->document()->focusedElement();
     if (target && target->hasInputMethodContext())
-        return target->inputMethodContext();
+        return &target->inputMethodContext();
 
     return 0;
 }
 
-WebPlugin* WebViewImpl::focusedPluginIfInputMethodSupported(Frame* frame)
+WebPlugin* WebViewImpl::focusedPluginIfInputMethodSupported(LocalFrame* frame)
 {
     WebPluginContainerImpl* container = WebFrameImpl::pluginContainerFromNode(frame, WebNode(focusedElement()));
     if (container && container->supportsInputMethod())
@@ -2232,7 +2219,7 @@
 
 bool WebViewImpl::selectionTextDirection(WebTextDirection& start, WebTextDirection& end) const
 {
-    const Frame* frame = focusedWebCoreFrame();
+    const LocalFrame* frame = focusedWebCoreFrame();
     if (!frame)
         return false;
     FrameSelection& selection = frame->selection();
@@ -2245,14 +2232,14 @@
 
 bool WebViewImpl::isSelectionAnchorFirst() const
 {
-    if (const Frame* frame = focusedWebCoreFrame())
+    if (const LocalFrame* frame = focusedWebCoreFrame())
         return frame->selection().selection().isBaseFirst();
     return false;
 }
 
 bool WebViewImpl::setEditableSelectionOffsets(int start, int end)
 {
-    const Frame* focused = focusedWebCoreFrame();
+    const LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return false;
     return focused->inputMethodController().setEditableSelectionOffsets(PlainTextRange(start, end));
@@ -2260,7 +2247,7 @@
 
 bool WebViewImpl::setCompositionFromExistingText(int compositionStart, int compositionEnd, const WebVector<WebCompositionUnderline>& underlines)
 {
-    const Frame* focused = focusedWebCoreFrame();
+    const LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return false;
 
@@ -2280,7 +2267,7 @@
 
 WebVector<WebCompositionUnderline> WebViewImpl::compositionUnderlines() const
 {
-    const Frame* focused = focusedWebCoreFrame();
+    const LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return WebVector<WebCompositionUnderline>();
     const Vector<CompositionUnderline>& underlines = focused->inputMethodController().customCompositionUnderlines();
@@ -2294,7 +2281,7 @@
 
 void WebViewImpl::extendSelectionAndDelete(int before, int after)
 {
-    Frame* focused = focusedWebCoreFrame();
+    LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return;
     if (WebPlugin* plugin = focusedPluginIfInputMethodSupported(focused)) {
@@ -2306,7 +2293,7 @@
 
 bool WebViewImpl::isSelectionEditable() const
 {
-    if (const Frame* frame = focusedWebCoreFrame())
+    if (const LocalFrame* frame = focusedWebCoreFrame())
         return frame->selection().isContentEditable();
     return false;
 }
@@ -2325,7 +2312,7 @@
 
 bool WebViewImpl::caretOrSelectionRange(size_t* location, size_t* length)
 {
-    const Frame* focused = focusedWebCoreFrame();
+    const LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return false;
 
@@ -2344,7 +2331,7 @@
     // the text direction of the selected node and updates its DOM "dir"
     // attribute and its CSS "direction" property.
     // So, we just call the function as Safari does.
-    const Frame* focused = focusedWebCoreFrame();
+    const LocalFrame* focused = focusedWebCoreFrame();
     if (!focused)
         return;
 
@@ -2451,7 +2438,7 @@
     // FIXME: This should really cause a recursive depth-first walk of all
     // frames in the tree, calling each frame's onbeforeunload.  At the moment,
     // we're consistent with Safari 3.1, not IE/FF.
-    Frame* frame = m_page->mainFrame();
+    LocalFrame* frame = m_page->mainFrame();
     if (!frame)
         return true;
 
@@ -2474,7 +2461,7 @@
 {
     if (!relativeToFrame)
         relativeToFrame = mainFrame();
-    Frame* frame = toWebFrameImpl(relativeToFrame)->frame();
+    LocalFrame* frame = toWebFrameImpl(relativeToFrame)->frame();
     frame = frame->tree().find(name);
     return WebFrameImpl::fromFrame(frame);
 }
@@ -2488,11 +2475,11 @@
 {
     if (!frame) {
         // Clears the focused frame if any.
-        if (Frame* focusedFrame = focusedWebCoreFrame())
+        if (LocalFrame* focusedFrame = focusedWebCoreFrame())
             focusedFrame->selection().setFocused(false);
         return;
     }
-    Frame* webcoreFrame = toWebFrameImpl(frame)->frame();
+    LocalFrame* webcoreFrame = toWebFrameImpl(frame)->frame();
     webcoreFrame->page()->focusController().setFocusedFrame(webcoreFrame);
 }
 
@@ -2500,15 +2487,15 @@
 {
     if (!m_page)
         return;
-    Frame* frame = page()->focusController().focusedOrMainFrame();
+    LocalFrame* frame = page()->focusController().focusedOrMainFrame();
     if (Document* document = frame->document())
-        document->setFocusedElement(0);
+        document->setFocusedElement(nullptr);
     page()->focusController().setInitialFocus(reverse ? FocusTypeBackward : FocusTypeForward);
 }
 
-void WebViewImpl::clearFocusedNode()
+void WebViewImpl::clearFocusedElement()
 {
-    RefPtr<Frame> frame = focusedWebCoreFrame();
+    RefPtr<LocalFrame> frame = focusedWebCoreFrame();
     if (!frame)
         return;
 
@@ -2519,7 +2506,7 @@
     RefPtr<Element> oldFocusedElement = document->focusedElement();
 
     // Clear the focused node.
-    document->setFocusedElement(0);
+    document->setFocusedElement(nullptr);
 
     if (!oldFocusedElement)
         return;
@@ -2540,7 +2527,7 @@
 
 void WebViewImpl::scrollFocusedNodeIntoRect(const WebRect& rect)
 {
-    Frame* frame = page()->mainFrame();
+    LocalFrame* frame = page()->mainFrame();
     Element* element = focusedElement();
     if (!frame || !frame->view() || !element)
         return;
@@ -2639,7 +2626,7 @@
     else
         m_zoomLevel = zoomLevel;
 
-    Frame* frame = mainFrameImpl()->frame();
+    LocalFrame* frame = mainFrameImpl()->frame();
     WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
     if (pluginContainer)
         pluginContainer->plugin()->setZoomLevel(m_zoomLevel, false);
@@ -2666,7 +2653,7 @@
 
 float WebViewImpl::setTextZoomFactor(float textZoomFactor)
 {
-    Frame* frame = mainFrameImpl()->frame();
+    LocalFrame* frame = mainFrameImpl()->frame();
     if (WebFrameImpl::pluginContainerFromFrame(frame))
         return 1;
 
@@ -2714,15 +2701,7 @@
     if (!view)
         return offset;
 
-    IntPoint maxScrollExtent(contentsSize().width() - view->scrollOrigin().x(), contentsSize().height() - view->scrollOrigin().y());
-    FloatSize scaledSize = view->unscaledVisibleContentSize();
-    scaledSize.scale(1 / scale);
-
-    IntPoint clampedOffset = offset;
-    clampedOffset = clampedOffset.shrunkTo(maxScrollExtent - expandedIntSize(scaledSize));
-    clampedOffset = clampedOffset.expandedTo(-view->scrollOrigin());
-
-    return clampedOffset;
+    return view->clampOffsetAtScale(offset, scale);
 }
 
 void WebViewImpl::setPageScaleFactor(float scaleFactor, const WebPoint& origin)
@@ -2858,7 +2837,7 @@
 
 void WebViewImpl::updatePageDefinedViewportConstraints(const ViewportDescription& description)
 {
-    if (!settings()->viewportEnabled() || !page() || !m_size.width || !m_size.height)
+    if (!settings()->viewportEnabled() || !page() || (!m_size.width && !m_size.height))
         return;
 
     ViewportDescription adjustedDescription = description;
@@ -2868,7 +2847,7 @@
         const int legacyWidthSnappingMagicNumber = 320;
         if (adjustedDescription.maxWidth.isFixed() && adjustedDescription.maxWidth.value() <= legacyWidthSnappingMagicNumber)
             adjustedDescription.maxWidth = Length(DeviceWidth);
-        if (adjustedDescription.maxHeight.isFixed() && adjustedDescription.maxWidth.value() <= m_size.height)
+        if (adjustedDescription.maxHeight.isFixed() && adjustedDescription.maxHeight.value() <= m_size.height)
             adjustedDescription.maxHeight = Length(DeviceHeight);
         adjustedDescription.minWidth = adjustedDescription.maxWidth;
         adjustedDescription.minHeight = adjustedDescription.maxHeight;
@@ -2977,7 +2956,6 @@
 
     // Clear out the values for the current history item. This will prevent the history item from clobbering the
     // value determined during page scale initialization, which may be less than 1.
-    page()->mainFrame()->loader().saveDocumentAndScrollState();
     page()->mainFrame()->loader().clearScrollPositionAndViewState();
     m_pageScaleConstraintsSet.setNeedsReset(true);
 
@@ -2992,7 +2970,7 @@
     if (!page())
         return;
 
-    Frame* frame = page()->mainFrame();
+    LocalFrame* frame = page()->mainFrame();
     if (!frame)
         return;
 
@@ -3013,7 +2991,7 @@
 {
     HitTestResult result = hitTestResultForWindowPos(location);
     RefPtr<Node> node = result.innerNonSharedNode();
-    if (!node->hasTagName(HTMLNames::videoTag) && !node->hasTagName(HTMLNames::audioTag))
+    if (!isHTMLVideoElement(*node) && !isHTMLAudioElement(*node))
         return;
 
     RefPtr<HTMLMediaElement> mediaElement =
@@ -3044,7 +3022,7 @@
 {
     HitTestResult result = hitTestResultForWindowPos(location);
     RefPtr<Node> node = result.innerNonSharedNode();
-    if (!node->hasTagName(HTMLNames::objectTag) && !node->hasTagName(HTMLNames::embedTag))
+    if (!isHTMLObjectElement(*node) && !isHTMLEmbedElement(*node))
         return;
 
     RenderObject* object = node->renderer();
@@ -3133,7 +3111,7 @@
 {
     ASSERT(!m_currentDragData);
 
-    m_currentDragData = webDragData;
+    m_currentDragData = webDragData.getValue();
     m_operationsAllowed = operationsAllowed;
 
     return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter, keyModifiers);
@@ -3165,7 +3143,7 @@
     // FIXME: why is the drag scroll timer not stopped here?
 
     m_dragOperation = WebDragOperationNone;
-    m_currentDragData = 0;
+    m_currentDragData = nullptr;
 }
 
 void WebViewImpl::dragTargetDrop(const WebPoint& clientPoint,
@@ -3196,14 +3174,14 @@
     m_page->dragController().performDrag(&dragData);
 
     m_dragOperation = WebDragOperationNone;
-    m_currentDragData = 0;
+    m_currentDragData = nullptr;
 }
 
 void WebViewImpl::spellingMarkers(WebVector<uint32_t>* markers)
 {
     Vector<uint32_t> result;
-    for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree().traverseNext()) {
-        const Vector<DocumentMarker*>& documentMarkers = frame->document()->markers()->markers();
+    for (LocalFrame* frame = m_page->mainFrame(); frame; frame = frame->tree().traverseNext()) {
+        const Vector<DocumentMarker*>& documentMarkers = frame->document()->markers().markers();
         for (size_t i = 0; i < documentMarkers.size(); ++i)
             result.append(documentMarkers[i]->hash());
     }
@@ -3373,14 +3351,14 @@
 
     page()->contextMenuController().clearContextMenu();
     m_contextMenuAllowed = true;
-    if (Frame* focusedFrame = page()->focusController().focusedOrMainFrame())
+    if (LocalFrame* focusedFrame = page()->focusController().focusedOrMainFrame())
         focusedFrame->eventHandler().sendContextMenuEventForKey();
     m_contextMenuAllowed = false;
 }
 
 WebString WebViewImpl::getSmartClipData(WebRect rect)
 {
-    Frame* frame = focusedWebCoreFrame();
+    LocalFrame* frame = focusedWebCoreFrame();
     if (!frame)
         return WebString();
     return WebCore::SmartClip(frame).dataForRect(rect).toString();
@@ -3396,7 +3374,7 @@
 void WebViewImpl::setIsTransparent(bool isTransparent)
 {
     // Set any existing frames to be transparent.
-    Frame* frame = m_page->mainFrame();
+    LocalFrame* frame = m_page->mainFrame();
     while (frame) {
         frame->view()->setTransparent(isTransparent);
         frame = frame->tree().traverseNext();
@@ -3413,6 +3391,8 @@
 
 void WebViewImpl::setBaseBackgroundColor(WebColor color)
 {
+    layout();
+
     if (m_baseBackgroundColor == color)
         return;
 
@@ -3480,18 +3460,35 @@
     resetSavedScrollAndScaleState();
 }
 
+void WebViewImpl::willInsertBody(WebFrameImpl* webframe)
+{
+    if (webframe != mainFrameImpl())
+        return;
+
+    // If we get to the <body> tag and we have no pending stylesheet loads, we
+    // can be fairly confident we'll have something sensible to paint soon and
+    // can turn off deferred commits.
+    if (m_page->mainFrame()->document()->haveStylesheetsLoaded())
+        resumeTreeViewCommits();
+}
+
+void WebViewImpl::resumeTreeViewCommits()
+{
+    if (m_layerTreeViewCommitsDeferred) {
+        if (m_layerTreeView)
+            m_layerTreeView->setDeferCommits(false);
+        m_layerTreeViewCommitsDeferred = false;
+    }
+}
+
 void WebViewImpl::layoutUpdated(WebFrameImpl* webframe)
 {
     if (!m_client || webframe != mainFrameImpl())
         return;
 
-    if (m_layerTreeViewCommitsDeferred) {
-        // If we finished a layout while in deferred commit mode,
-        // that means it's time to start producing frames again so un-defer.
-        if (m_layerTreeView)
-            m_layerTreeView->setDeferCommits(false);
-        m_layerTreeViewCommitsDeferred = false;
-    }
+    // If we finished a layout while in deferred commit mode,
+    // that means it's time to start producing frames again so un-defer.
+    resumeTreeViewCommits();
 
     if (m_shouldAutoResize && mainFrameImpl()->frame() && mainFrameImpl()->frame()->view()) {
         WebSize frameSize = mainFrameImpl()->frame()->view()->frameRect().size();
@@ -3526,7 +3523,7 @@
     return shouldUseExternalPopupMenus;
 }
 
-void WebViewImpl::startDragging(Frame* frame,
+void WebViewImpl::startDragging(LocalFrame* frame,
                                 const WebDragData& dragData,
                                 WebDragOperationsMask mask,
                                 const WebImage& dragImage,
@@ -3573,9 +3570,15 @@
 
 void WebViewImpl::setOverlayLayer(WebCore::GraphicsLayer* layer)
 {
-    if (m_rootGraphicsLayer) {
-        if (layer->parent() != m_rootGraphicsLayer)
-            m_rootGraphicsLayer->addChild(layer);
+    if (!m_rootGraphicsLayer)
+        return;
+
+    if (!m_rootTransformLayer)
+        m_rootTransformLayer = m_page->mainFrame()->view()->renderView()->compositor()->ensureRootTransformLayer();
+
+    if (m_rootTransformLayer) {
+        if (layer->parent() != m_rootTransformLayer)
+            m_rootTransformLayer->addChild(layer);
     }
 }
 
@@ -3588,7 +3591,7 @@
 
 Element* WebViewImpl::focusedElement() const
 {
-    Frame* frame = m_page->focusController().focusedFrame();
+    LocalFrame* frame = m_page->focusController().focusedFrame();
     if (!frame)
         return 0;
 
@@ -3628,24 +3631,26 @@
 
 void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
 {
+    bool pinchVirtualViewportEnabled = page()->settings().pinchVirtualViewportEnabled();
     suppressInvalidations(true);
 
-    if (page()->settings().pinchVirtualViewportEnabled()) {
-        if (!m_pinchViewports)
-            m_pinchViewports = PinchViewports::create(this);
-
-        m_pinchViewports->setOverflowControlsHostLayer(layer);
-        m_pinchViewports->setViewportSize(mainFrameImpl()->frame()->view()->frameRect().size());
+    if (pinchVirtualViewportEnabled) {
+        PinchViewport& pinchViewport = page()->frameHost().pinchViewport();
+        pinchViewport.attachToLayerTree(layer, graphicsLayerFactory());
+        pinchViewport.setViewportSize(mainFrameImpl()->frame()->view()->frameRect().size());
         if (layer) {
-            m_rootGraphicsLayer = m_pinchViewports->rootGraphicsLayer();
-            m_rootLayer = m_pinchViewports->rootGraphicsLayer()->platformLayer();
+            m_rootGraphicsLayer = pinchViewport.rootGraphicsLayer();
+            m_rootLayer = pinchViewport.rootGraphicsLayer()->platformLayer();
+            m_rootTransformLayer = 0;
         } else {
             m_rootGraphicsLayer = 0;
             m_rootLayer = 0;
+            m_rootTransformLayer = 0;
         }
     } else {
         m_rootGraphicsLayer = layer;
         m_rootLayer = layer ? layer->platformLayer() : 0;
+        m_rootTransformLayer = 0;
     }
 
     setIsAcceleratedCompositingActive(layer);
@@ -3657,8 +3662,8 @@
             m_layerTreeView->setRootLayer(*m_rootLayer);
             // We register viewport layers here since there may not be a layer
             // tree view prior to this point.
-            if (m_pinchViewports) {
-                m_pinchViewports->registerViewportLayersWithTreeView(m_layerTreeView);
+            if (pinchVirtualViewportEnabled) {
+                page()->frameHost().pinchViewport().registerViewportLayersWithTreeView(m_layerTreeView);
             } else {
                 GraphicsLayer* rootScrollLayer = compositor()->scrollLayer();
                 ASSERT(rootScrollLayer);
@@ -3667,8 +3672,8 @@
             }
         } else {
             m_layerTreeView->clearRootLayer();
-            if (m_pinchViewports)
-                m_pinchViewports->clearViewportLayersForTreeView(m_layerTreeView);
+            if (pinchVirtualViewportEnabled)
+                page()->frameHost().pinchViewport().clearViewportLayersForTreeView(m_layerTreeView);
             else
                 m_layerTreeView->clearViewportLayers();
         }
@@ -3682,7 +3687,7 @@
     m_layerTreeView->setNeedsAnimate();
 }
 
-void WebViewImpl::scrollRootLayerRect(const IntSize&, const IntRect&)
+void WebViewImpl::scrollRootLayer()
 {
     updateLayerTreeViewport();
 }
@@ -3883,11 +3888,19 @@
 
 void WebViewImpl::updateRootLayerTransform()
 {
-    if (m_rootGraphicsLayer) {
+    // If we don't have a root graphics layer, we won't bother trying to find
+    // or update the transform layer.
+    if (!m_rootGraphicsLayer)
+        return;
+
+    if (!m_rootTransformLayer)
+        m_rootTransformLayer = m_page->mainFrame()->view()->renderView()->compositor()->ensureRootTransformLayer();
+
+    if (m_rootTransformLayer) {
         WebCore::TransformationMatrix transform;
         transform.translate(m_rootLayerOffset.width, m_rootLayerOffset.height);
         transform = transform.scale(m_rootLayerScale);
-        m_rootGraphicsLayer->setTransform(transform);
+        m_rootTransformLayer->setTransform(transform);
     }
 }
 
@@ -3904,7 +3917,7 @@
 
     // Ignore when tapping on links or nodes listening to click events, unless the click event is on the
     // body element, in which case it's unlikely that the original node itself was intended to be clickable.
-    for (; node && !node->hasTagName(HTMLNames::bodyTag); node = node->parentNode()) {
+    for (; node && !isHTMLBodyElement(*node); node = node->parentNode()) {
         if (node->isLink() || node->willRespondToTouchEvents() || node->willRespondToMouseClickEvents())
             return false;
     }
diff --git a/Source/web/WebViewImpl.h b/Source/web/WebViewImpl.h
index 0bad5b6..b07a110 100644
--- a/Source/web/WebViewImpl.h
+++ b/Source/web/WebViewImpl.h
@@ -48,7 +48,6 @@
 #include "WebNavigationPolicy.h"
 #include "WebView.h"
 #include "core/page/PagePopupDriver.h"
-#include "platform/Timer.h"
 #include "platform/geometry/IntPoint.h"
 #include "platform/geometry/IntRect.h"
 #include "platform/graphics/GraphicsLayer.h"
@@ -65,13 +64,12 @@
 namespace WebCore {
 class DataObject;
 class Color;
-class Frame;
+class LocalFrame;
 class GraphicsLayerFactory;
 class HistoryItem;
 class HitTestResult;
 class KeyboardEvent;
 class Page;
-class PageGroup;
 class PagePopup;
 class PagePopupClient;
 class PlatformKeyboardEvent;
@@ -86,7 +84,6 @@
 class GeolocationClientProxy;
 class LinkHighlight;
 class MIDIClientProxy;
-class PinchViewports;
 class PopupContainer;
 class PrerendererClientImpl;
 class SpeechInputClientImpl;
@@ -97,11 +94,8 @@
 class WebActiveGestureAnimation;
 class WebDevToolsAgentClient;
 class WebDevToolsAgentPrivate;
-class WebDocument;
 class WebFrameImpl;
 class WebGestureEvent;
-class WebHelperPlugin;
-class WebHelperPluginImpl;
 class WebImage;
 class WebKeyboardEvent;
 class WebLayerTreeView;
@@ -205,7 +199,7 @@
     virtual WebFrame* focusedFrame() OVERRIDE;
     virtual void setFocusedFrame(WebFrame*) OVERRIDE;
     virtual void setInitialFocus(bool reverse) OVERRIDE;
-    virtual void clearFocusedNode() OVERRIDE;
+    virtual void clearFocusedElement() OVERRIDE;
     virtual void scrollFocusedNodeIntoView() OVERRIDE;
     virtual void scrollFocusedNodeIntoRect(const WebRect&) OVERRIDE;
     virtual void zoomToFindInPageRect(const WebRect&) OVERRIDE;
@@ -241,9 +235,6 @@
     virtual void performMediaPlayerAction(
         const WebMediaPlayerAction& action,
         const WebPoint& location) OVERRIDE;
-    virtual WebHelperPlugin* createHelperPlugin(
-        const WebString& pluginType,
-        const WebDocument& hostDocument) OVERRIDE;
     virtual void performPluginAction(
         const WebPluginAction&,
         const WebPoint&) OVERRIDE;
@@ -302,6 +293,7 @@
     virtual void setShowFPSCounter(bool) OVERRIDE;
     virtual void setContinuousPaintingEnabled(bool) OVERRIDE;
     virtual void setShowScrollBottleneckRects(bool) OVERRIDE;
+    virtual void getSelectionRootBounds(WebRect& bounds) const OVERRIDE;
 
     // WebViewImpl
 
@@ -324,7 +316,7 @@
         return m_lastMouseDownPoint;
     }
 
-    WebCore::Frame* focusedWebCoreFrame() const;
+    WebCore::LocalFrame* focusedWebCoreFrame() const;
 
     // Returns the currently focused Element or null if no element has focus.
     WebCore::Element* focusedElement() const;
@@ -396,6 +388,7 @@
     // unless the view did not need a layout.
     void layoutUpdated(WebFrameImpl*);
 
+    void willInsertBody(WebFrameImpl*);
     void didChangeContentsSize();
     void deviceOrPageScaleFactorChanged();
 
@@ -428,7 +421,7 @@
 
     // Start a system drag and drop operation.
     void startDragging(
-        WebCore::Frame*,
+        WebCore::LocalFrame*,
         const WebDragData& dragData,
         WebDragOperationsMask mask,
         const WebImage& dragImage,
@@ -459,7 +452,7 @@
     bool allowsAcceleratedCompositing();
     void setRootGraphicsLayer(WebCore::GraphicsLayer*);
     void scheduleCompositingLayerSync();
-    void scrollRootLayerRect(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& clipRect);
+    void scrollRootLayer();
     WebCore::GraphicsLayerFactory* graphicsLayerFactory() const;
     WebCore::RenderLayerCompositor* compositor() const;
     void registerForAnimations(WebLayer*);
@@ -534,6 +527,7 @@
 private:
     float legibleScale() const;
     void refreshPageScaleFactorAfterLayout();
+    void resumeTreeViewCommits();
     void setUserAgentPageScaleConstraints(WebCore::PageScaleConstraints newConstraints);
     float clampPageScaleFactorToLimits(float) const;
     WebCore::IntSize contentsSize() const;
@@ -598,23 +592,16 @@
     void pointerLockMouseEvent(const WebInputEvent&);
 
     // PageWidgetEventHandler functions
-    virtual void handleMouseLeave(WebCore::Frame&, const WebMouseEvent&) OVERRIDE;
-    virtual void handleMouseDown(WebCore::Frame&, const WebMouseEvent&) OVERRIDE;
-    virtual void handleMouseUp(WebCore::Frame&, const WebMouseEvent&) OVERRIDE;
-    virtual bool handleMouseWheel(WebCore::Frame&, const WebMouseWheelEvent&) OVERRIDE;
+    virtual void handleMouseLeave(WebCore::LocalFrame&, const WebMouseEvent&) OVERRIDE;
+    virtual void handleMouseDown(WebCore::LocalFrame&, const WebMouseEvent&) OVERRIDE;
+    virtual void handleMouseUp(WebCore::LocalFrame&, const WebMouseEvent&) OVERRIDE;
+    virtual bool handleMouseWheel(WebCore::LocalFrame&, const WebMouseWheelEvent&) OVERRIDE;
     virtual bool handleGestureEvent(const WebGestureEvent&) OVERRIDE;
     virtual bool handleKeyEvent(const WebKeyboardEvent&) OVERRIDE;
     virtual bool handleCharEvent(const WebKeyboardEvent&) OVERRIDE;
 
-    friend class WebHelperPluginImpl;
-    // Take ownership of the Helper Plugin and destroy it asynchronously.
-    // Called by WebHelperPluginImpl::closeAndDeleteSoon() to ensure the Helper
-    // Plugin is closed at the correct time.
-    void closeAndDeleteHelperPluginSoon(WebHelperPluginImpl*);
-    void closePendingHelperPlugins(WebCore::Timer<WebViewImpl>*);
-
     WebCore::InputMethodContext* inputMethodContext();
-    WebPlugin* focusedPluginIfInputMethodSupported(WebCore::Frame*);
+    WebPlugin* focusedPluginIfInputMethodSupported(WebCore::LocalFrame*);
 
     WebViewClient* m_client; // Can be 0 (e.g. unittests, shared workers, etc.)
     WebAutofillClient* m_autofillClient;
@@ -647,7 +634,7 @@
     OwnPtr<WebSettingsImpl> m_webSettings;
 
     // A copy of the web drop data object we received from the browser.
-    RefPtr<WebCore::DataObject> m_currentDragData;
+    RefPtrWillBePersistent<WebCore::DataObject> m_currentDragData;
 
     // The point relative to the client area where the mouse was last pressed
     // down. This is used by the drag client to determine what was under the
@@ -744,6 +731,7 @@
     WebLayerTreeView* m_layerTreeView;
     WebLayer* m_rootLayer;
     WebCore::GraphicsLayer* m_rootGraphicsLayer;
+    WebCore::GraphicsLayer* m_rootTransformLayer;
     OwnPtr<WebCore::GraphicsLayerFactory> m_graphicsLayerFactory;
     bool m_isAcceleratedCompositingActive;
     bool m_layerTreeViewCommitsDeferred;
@@ -751,7 +739,6 @@
     // If true, the graphics context is being restored.
     bool m_recreatingGraphicsContext;
     static const WebInputEvent* m_currentInputEvent;
-    OwnPtr<PinchViewports> m_pinchViewports;
 
 #if ENABLE(INPUT_SPEECH)
     OwnPtr<SpeechInputClientImpl> m_speechInputClient;
@@ -780,9 +767,6 @@
     WebColor m_baseBackgroundColor;
     WebColor m_backgroundColorOverride;
     float m_zoomFactorOverride;
-
-    WebCore::Timer<WebViewImpl> m_helperPluginCloseTimer;
-    Vector<WebHelperPluginImpl*> m_helperPluginsPendingClose;
 };
 
 // We have no ways to check if the specified WebView is an instance of
diff --git a/Source/web/WorkerGlobalScopeProxyProviderImpl.cpp b/Source/web/WorkerGlobalScopeProxyProviderImpl.cpp
index 5a900df..e33ef91 100644
--- a/Source/web/WorkerGlobalScopeProxyProviderImpl.cpp
+++ b/Source/web/WorkerGlobalScopeProxyProviderImpl.cpp
@@ -42,6 +42,8 @@
 #include "core/workers/Worker.h"
 #include "core/workers/WorkerClients.h"
 #include "core/workers/WorkerMessagingProxy.h"
+#include "modules/serviceworkers/ServiceWorkerContainerClient.h"
+#include "public/platform/WebServiceWorkerProvider.h"
 #include "public/platform/WebString.h"
 #include "public/web/WebFrameClient.h"
 #include "public/web/WebWorkerPermissionClientProxy.h"
@@ -59,6 +61,7 @@
         provideLocalFileSystemToWorker(workerClients.get(), LocalFileSystemClient::create());
         provideDatabaseClientToWorker(workerClients.get(), DatabaseClientImpl::create());
         providePermissionClientToWorker(workerClients.get(), adoptPtr(webFrame->client()->createWorkerPermissionClientProxy(webFrame)));
+        provideServiceWorkerContainerClientToWorker(workerClients.get(), adoptPtr(webFrame->client()->createServiceWorkerProvider(webFrame)));
         return new WorkerMessagingProxy(worker, workerClients.release());
     }
     ASSERT_NOT_REACHED();
diff --git a/Source/web/WorkerPermissionClient.cpp b/Source/web/WorkerPermissionClient.cpp
index 61cefce..860165c 100644
--- a/Source/web/WorkerPermissionClient.cpp
+++ b/Source/web/WorkerPermissionClient.cpp
@@ -32,6 +32,7 @@
 #include "WorkerPermissionClient.h"
 
 #include "core/workers/WorkerGlobalScope.h"
+#include "public/platform/WebPermissionCallbacks.h"
 #include "public/platform/WebString.h"
 #include "public/web/WebWorkerPermissionClientProxy.h"
 #include "wtf/PassOwnPtr.h"
@@ -63,6 +64,16 @@
     return m_proxy->allowFileSystem();
 }
 
+void WorkerPermissionClient::requestFileSystemAccess(const WebPermissionCallbacks& callbacks)
+{
+    if (!m_proxy) {
+        WebPermissionCallbacks permissionCallbacks(callbacks);
+        permissionCallbacks.doAllow();
+        return;
+    }
+    m_proxy->requestFileSystemAccess(callbacks);
+}
+
 bool WorkerPermissionClient::allowIndexedDB(const WebString& name)
 {
     if (!m_proxy)
@@ -75,9 +86,11 @@
     return "WorkerPermissionClient";
 }
 
-WorkerPermissionClient* WorkerPermissionClient::from(ExecutionContext* context)
+WorkerPermissionClient* WorkerPermissionClient::from(ExecutionContext& context)
 {
-    return static_cast<WorkerPermissionClient*>(Supplement<WorkerClients>::from(toWorkerGlobalScope(context)->clients(), supplementName()));
+    WorkerClients* clients = toWorkerGlobalScope(context).clients();
+    ASSERT(clients);
+    return static_cast<WorkerPermissionClient*>(Supplement<WorkerClients>::from(*clients, supplementName()));
 }
 
 WorkerPermissionClient::WorkerPermissionClient(PassOwnPtr<WebWorkerPermissionClientProxy> proxy)
@@ -87,7 +100,8 @@
 
 void providePermissionClientToWorker(WorkerClients* clients, PassOwnPtr<WebWorkerPermissionClientProxy> proxy)
 {
-    WorkerPermissionClient::provideTo(clients, WorkerPermissionClient::supplementName(), WorkerPermissionClient::create(proxy));
+    ASSERT(clients);
+    WorkerPermissionClient::provideTo(*clients, WorkerPermissionClient::supplementName(), WorkerPermissionClient::create(proxy));
 }
 
 } // namespace blink
diff --git a/Source/web/WorkerPermissionClient.h b/Source/web/WorkerPermissionClient.h
index 25f4215..8bbf0b4 100644
--- a/Source/web/WorkerPermissionClient.h
+++ b/Source/web/WorkerPermissionClient.h
@@ -41,6 +41,7 @@
 namespace blink {
 
 class WebFrame;
+class WebPermissionCallbacks;
 class WebString;
 class WebWorkerPermissionClientProxy;
 
@@ -52,10 +53,11 @@
 
     bool allowDatabase(const WebString& name, const WebString& displayName, unsigned long estimatedSize);
     bool allowFileSystem();
+    void requestFileSystemAccess(const WebPermissionCallbacks&);
     bool allowIndexedDB(const WebString& name);
 
     static const char* supplementName();
-    static WorkerPermissionClient* from(WebCore::ExecutionContext*);
+    static WorkerPermissionClient* from(WebCore::ExecutionContext&);
 
 private:
     explicit WorkerPermissionClient(PassOwnPtr<WebWorkerPermissionClientProxy>);
diff --git a/Source/web/blink_web.target.darwin-arm.mk b/Source/web/blink_web.target.darwin-arm.mk
index 417d4df..19ed636 100644
--- a/Source/web/blink_web.target.darwin-arm.mk
+++ b/Source/web/blink_web.target.darwin-arm.mk
@@ -83,7 +83,6 @@
 	$(gyp_shared_intermediate_dir)/blink
 
 LOCAL_SRC_FILES := \
-	third_party/WebKit/Source/web/ApplicationCacheHost.cpp \
 	third_party/WebKit/Source/web/AssertMatchingEnums.cpp \
 	third_party/WebKit/Source/web/AssociatedURLLoader.cpp \
 	third_party/WebKit/Source/web/BackForwardClientImpl.cpp \
@@ -117,7 +116,6 @@
 	third_party/WebKit/Source/web/PageOverlayList.cpp \
 	third_party/WebKit/Source/web/PageScaleConstraintsSet.cpp \
 	third_party/WebKit/Source/web/PageWidgetDelegate.cpp \
-	third_party/WebKit/Source/web/PinchViewports.cpp \
 	third_party/WebKit/Source/web/PopupContainer.cpp \
 	third_party/WebKit/Source/web/PopupListBox.cpp \
 	third_party/WebKit/Source/web/PopupMenuChromium.cpp \
@@ -143,7 +141,6 @@
 	third_party/WebKit/Source/web/WebCachedURLRequest.cpp \
 	third_party/WebKit/Source/web/WebColorName.cpp \
 	third_party/WebKit/Source/web/WebColorSuggestion.cpp \
-	third_party/WebKit/Source/web/WebCrossOriginPreflightResultCache.cpp \
 	third_party/WebKit/Source/web/WebCustomElement.cpp \
 	third_party/WebKit/Source/web/WebDOMActivityLogger.cpp \
 	third_party/WebKit/Source/web/WebDOMCustomEvent.cpp \
@@ -170,7 +167,6 @@
 	third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp \
 	third_party/WebKit/Source/web/WebEntities.cpp \
 	third_party/WebKit/Source/web/WebFileChooserCompletionImpl.cpp \
-	third_party/WebKit/Source/web/WebFontCache.cpp \
 	third_party/WebKit/Source/web/WebFontDescription.cpp \
 	third_party/WebKit/Source/web/WebFontImpl.cpp \
 	third_party/WebKit/Source/web/WebFormControlElement.cpp \
@@ -300,6 +296,7 @@
 
 MY_DEFS_Debug := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -307,9 +304,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -318,12 +315,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -333,11 +327,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -440,6 +440,7 @@
 
 MY_DEFS_Release := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -447,9 +448,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -458,12 +459,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -473,11 +471,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -547,9 +551,11 @@
 LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
 LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
 LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
+LOCAL_ASFLAGS := $(LOCAL_CFLAGS)
 ### Rules for final target.
 
 LOCAL_LDFLAGS_Debug := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -561,7 +567,6 @@
 	-Wl,--no-undefined \
 	-Wl,--exclude-libs=ALL \
 	-Wl,--icf=safe \
-	-Wl,--fatal-warnings \
 	-Wl,--gc-sections \
 	-Wl,--warn-shared-textrel \
 	-Wl,-O1 \
@@ -569,6 +574,7 @@
 
 
 LOCAL_LDFLAGS_Release := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -583,7 +589,6 @@
 	-Wl,-O1 \
 	-Wl,--as-needed \
 	-Wl,--gc-sections \
-	-Wl,--fatal-warnings \
 	-Wl,--warn-shared-textrel
 
 
diff --git a/Source/web/blink_web.target.darwin-mips.mk b/Source/web/blink_web.target.darwin-mips.mk
index bf86458..801eb1b 100644
--- a/Source/web/blink_web.target.darwin-mips.mk
+++ b/Source/web/blink_web.target.darwin-mips.mk
@@ -83,7 +83,6 @@
 	$(gyp_shared_intermediate_dir)/blink
 
 LOCAL_SRC_FILES := \
-	third_party/WebKit/Source/web/ApplicationCacheHost.cpp \
 	third_party/WebKit/Source/web/AssertMatchingEnums.cpp \
 	third_party/WebKit/Source/web/AssociatedURLLoader.cpp \
 	third_party/WebKit/Source/web/BackForwardClientImpl.cpp \
@@ -117,7 +116,6 @@
 	third_party/WebKit/Source/web/PageOverlayList.cpp \
 	third_party/WebKit/Source/web/PageScaleConstraintsSet.cpp \
 	third_party/WebKit/Source/web/PageWidgetDelegate.cpp \
-	third_party/WebKit/Source/web/PinchViewports.cpp \
 	third_party/WebKit/Source/web/PopupContainer.cpp \
 	third_party/WebKit/Source/web/PopupListBox.cpp \
 	third_party/WebKit/Source/web/PopupMenuChromium.cpp \
@@ -143,7 +141,6 @@
 	third_party/WebKit/Source/web/WebCachedURLRequest.cpp \
 	third_party/WebKit/Source/web/WebColorName.cpp \
 	third_party/WebKit/Source/web/WebColorSuggestion.cpp \
-	third_party/WebKit/Source/web/WebCrossOriginPreflightResultCache.cpp \
 	third_party/WebKit/Source/web/WebCustomElement.cpp \
 	third_party/WebKit/Source/web/WebDOMActivityLogger.cpp \
 	third_party/WebKit/Source/web/WebDOMCustomEvent.cpp \
@@ -170,7 +167,6 @@
 	third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp \
 	third_party/WebKit/Source/web/WebEntities.cpp \
 	third_party/WebKit/Source/web/WebFileChooserCompletionImpl.cpp \
-	third_party/WebKit/Source/web/WebFontCache.cpp \
 	third_party/WebKit/Source/web/WebFontDescription.cpp \
 	third_party/WebKit/Source/web/WebFontImpl.cpp \
 	third_party/WebKit/Source/web/WebFormControlElement.cpp \
@@ -299,6 +295,7 @@
 
 MY_DEFS_Debug := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -306,9 +303,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -317,12 +314,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -332,11 +326,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -438,6 +438,7 @@
 
 MY_DEFS_Release := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -445,9 +446,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -456,12 +457,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -471,11 +469,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -545,9 +549,11 @@
 LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
 LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
 LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
+LOCAL_ASFLAGS := $(LOCAL_CFLAGS)
 ### Rules for final target.
 
 LOCAL_LDFLAGS_Debug := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -557,7 +563,6 @@
 	-nostdlib \
 	-Wl,--no-undefined \
 	-Wl,--exclude-libs=ALL \
-	-Wl,--fatal-warnings \
 	-Wl,--gc-sections \
 	-Wl,--warn-shared-textrel \
 	-Wl,-O1 \
@@ -565,6 +570,7 @@
 
 
 LOCAL_LDFLAGS_Release := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -577,7 +583,6 @@
 	-Wl,-O1 \
 	-Wl,--as-needed \
 	-Wl,--gc-sections \
-	-Wl,--fatal-warnings \
 	-Wl,--warn-shared-textrel
 
 
diff --git a/Source/web/blink_web.target.darwin-x86.mk b/Source/web/blink_web.target.darwin-x86.mk
index 0a1a36b..9fcddf0 100644
--- a/Source/web/blink_web.target.darwin-x86.mk
+++ b/Source/web/blink_web.target.darwin-x86.mk
@@ -83,7 +83,6 @@
 	$(gyp_shared_intermediate_dir)/blink
 
 LOCAL_SRC_FILES := \
-	third_party/WebKit/Source/web/ApplicationCacheHost.cpp \
 	third_party/WebKit/Source/web/AssertMatchingEnums.cpp \
 	third_party/WebKit/Source/web/AssociatedURLLoader.cpp \
 	third_party/WebKit/Source/web/BackForwardClientImpl.cpp \
@@ -117,7 +116,6 @@
 	third_party/WebKit/Source/web/PageOverlayList.cpp \
 	third_party/WebKit/Source/web/PageScaleConstraintsSet.cpp \
 	third_party/WebKit/Source/web/PageWidgetDelegate.cpp \
-	third_party/WebKit/Source/web/PinchViewports.cpp \
 	third_party/WebKit/Source/web/PopupContainer.cpp \
 	third_party/WebKit/Source/web/PopupListBox.cpp \
 	third_party/WebKit/Source/web/PopupMenuChromium.cpp \
@@ -143,7 +141,6 @@
 	third_party/WebKit/Source/web/WebCachedURLRequest.cpp \
 	third_party/WebKit/Source/web/WebColorName.cpp \
 	third_party/WebKit/Source/web/WebColorSuggestion.cpp \
-	third_party/WebKit/Source/web/WebCrossOriginPreflightResultCache.cpp \
 	third_party/WebKit/Source/web/WebCustomElement.cpp \
 	third_party/WebKit/Source/web/WebDOMActivityLogger.cpp \
 	third_party/WebKit/Source/web/WebDOMCustomEvent.cpp \
@@ -170,7 +167,6 @@
 	third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp \
 	third_party/WebKit/Source/web/WebEntities.cpp \
 	third_party/WebKit/Source/web/WebFileChooserCompletionImpl.cpp \
-	third_party/WebKit/Source/web/WebFontCache.cpp \
 	third_party/WebKit/Source/web/WebFontDescription.cpp \
 	third_party/WebKit/Source/web/WebFontImpl.cpp \
 	third_party/WebKit/Source/web/WebFormControlElement.cpp \
@@ -275,11 +271,10 @@
 	-fvisibility=hidden \
 	-pipe \
 	-fPIC \
-	-m32 \
-	-mmmx \
-	-march=pentium4 \
 	-msse2 \
 	-mfpmath=sse \
+	-mmmx \
+	-m32 \
 	-fuse-ld=gold \
 	-ffunction-sections \
 	-funwind-tables \
@@ -302,6 +297,7 @@
 
 MY_DEFS_Debug := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -309,9 +305,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -320,12 +316,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -335,11 +328,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -416,11 +415,10 @@
 	-fvisibility=hidden \
 	-pipe \
 	-fPIC \
-	-m32 \
-	-mmmx \
-	-march=pentium4 \
 	-msse2 \
 	-mfpmath=sse \
+	-mmmx \
+	-m32 \
 	-fuse-ld=gold \
 	-ffunction-sections \
 	-funwind-tables \
@@ -443,6 +441,7 @@
 
 MY_DEFS_Release := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -450,9 +449,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -461,12 +460,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -476,11 +472,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -549,9 +551,11 @@
 LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
 LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
 LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
+LOCAL_ASFLAGS := $(LOCAL_CFLAGS)
 ### Rules for final target.
 
 LOCAL_LDFLAGS_Debug := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -561,7 +565,6 @@
 	-nostdlib \
 	-Wl,--no-undefined \
 	-Wl,--exclude-libs=ALL \
-	-Wl,--fatal-warnings \
 	-Wl,--gc-sections \
 	-Wl,--warn-shared-textrel \
 	-Wl,-O1 \
@@ -569,6 +572,7 @@
 
 
 LOCAL_LDFLAGS_Release := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -581,7 +585,6 @@
 	-Wl,-O1 \
 	-Wl,--as-needed \
 	-Wl,--gc-sections \
-	-Wl,--fatal-warnings \
 	-Wl,--warn-shared-textrel
 
 
diff --git a/Source/web/blink_web.target.linux-arm.mk b/Source/web/blink_web.target.linux-arm.mk
index 417d4df..19ed636 100644
--- a/Source/web/blink_web.target.linux-arm.mk
+++ b/Source/web/blink_web.target.linux-arm.mk
@@ -83,7 +83,6 @@
 	$(gyp_shared_intermediate_dir)/blink
 
 LOCAL_SRC_FILES := \
-	third_party/WebKit/Source/web/ApplicationCacheHost.cpp \
 	third_party/WebKit/Source/web/AssertMatchingEnums.cpp \
 	third_party/WebKit/Source/web/AssociatedURLLoader.cpp \
 	third_party/WebKit/Source/web/BackForwardClientImpl.cpp \
@@ -117,7 +116,6 @@
 	third_party/WebKit/Source/web/PageOverlayList.cpp \
 	third_party/WebKit/Source/web/PageScaleConstraintsSet.cpp \
 	third_party/WebKit/Source/web/PageWidgetDelegate.cpp \
-	third_party/WebKit/Source/web/PinchViewports.cpp \
 	third_party/WebKit/Source/web/PopupContainer.cpp \
 	third_party/WebKit/Source/web/PopupListBox.cpp \
 	third_party/WebKit/Source/web/PopupMenuChromium.cpp \
@@ -143,7 +141,6 @@
 	third_party/WebKit/Source/web/WebCachedURLRequest.cpp \
 	third_party/WebKit/Source/web/WebColorName.cpp \
 	third_party/WebKit/Source/web/WebColorSuggestion.cpp \
-	third_party/WebKit/Source/web/WebCrossOriginPreflightResultCache.cpp \
 	third_party/WebKit/Source/web/WebCustomElement.cpp \
 	third_party/WebKit/Source/web/WebDOMActivityLogger.cpp \
 	third_party/WebKit/Source/web/WebDOMCustomEvent.cpp \
@@ -170,7 +167,6 @@
 	third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp \
 	third_party/WebKit/Source/web/WebEntities.cpp \
 	third_party/WebKit/Source/web/WebFileChooserCompletionImpl.cpp \
-	third_party/WebKit/Source/web/WebFontCache.cpp \
 	third_party/WebKit/Source/web/WebFontDescription.cpp \
 	third_party/WebKit/Source/web/WebFontImpl.cpp \
 	third_party/WebKit/Source/web/WebFormControlElement.cpp \
@@ -300,6 +296,7 @@
 
 MY_DEFS_Debug := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -307,9 +304,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -318,12 +315,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -333,11 +327,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -440,6 +440,7 @@
 
 MY_DEFS_Release := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -447,9 +448,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -458,12 +459,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -473,11 +471,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -547,9 +551,11 @@
 LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
 LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
 LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
+LOCAL_ASFLAGS := $(LOCAL_CFLAGS)
 ### Rules for final target.
 
 LOCAL_LDFLAGS_Debug := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -561,7 +567,6 @@
 	-Wl,--no-undefined \
 	-Wl,--exclude-libs=ALL \
 	-Wl,--icf=safe \
-	-Wl,--fatal-warnings \
 	-Wl,--gc-sections \
 	-Wl,--warn-shared-textrel \
 	-Wl,-O1 \
@@ -569,6 +574,7 @@
 
 
 LOCAL_LDFLAGS_Release := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -583,7 +589,6 @@
 	-Wl,-O1 \
 	-Wl,--as-needed \
 	-Wl,--gc-sections \
-	-Wl,--fatal-warnings \
 	-Wl,--warn-shared-textrel
 
 
diff --git a/Source/web/blink_web.target.linux-mips.mk b/Source/web/blink_web.target.linux-mips.mk
index bf86458..801eb1b 100644
--- a/Source/web/blink_web.target.linux-mips.mk
+++ b/Source/web/blink_web.target.linux-mips.mk
@@ -83,7 +83,6 @@
 	$(gyp_shared_intermediate_dir)/blink
 
 LOCAL_SRC_FILES := \
-	third_party/WebKit/Source/web/ApplicationCacheHost.cpp \
 	third_party/WebKit/Source/web/AssertMatchingEnums.cpp \
 	third_party/WebKit/Source/web/AssociatedURLLoader.cpp \
 	third_party/WebKit/Source/web/BackForwardClientImpl.cpp \
@@ -117,7 +116,6 @@
 	third_party/WebKit/Source/web/PageOverlayList.cpp \
 	third_party/WebKit/Source/web/PageScaleConstraintsSet.cpp \
 	third_party/WebKit/Source/web/PageWidgetDelegate.cpp \
-	third_party/WebKit/Source/web/PinchViewports.cpp \
 	third_party/WebKit/Source/web/PopupContainer.cpp \
 	third_party/WebKit/Source/web/PopupListBox.cpp \
 	third_party/WebKit/Source/web/PopupMenuChromium.cpp \
@@ -143,7 +141,6 @@
 	third_party/WebKit/Source/web/WebCachedURLRequest.cpp \
 	third_party/WebKit/Source/web/WebColorName.cpp \
 	third_party/WebKit/Source/web/WebColorSuggestion.cpp \
-	third_party/WebKit/Source/web/WebCrossOriginPreflightResultCache.cpp \
 	third_party/WebKit/Source/web/WebCustomElement.cpp \
 	third_party/WebKit/Source/web/WebDOMActivityLogger.cpp \
 	third_party/WebKit/Source/web/WebDOMCustomEvent.cpp \
@@ -170,7 +167,6 @@
 	third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp \
 	third_party/WebKit/Source/web/WebEntities.cpp \
 	third_party/WebKit/Source/web/WebFileChooserCompletionImpl.cpp \
-	third_party/WebKit/Source/web/WebFontCache.cpp \
 	third_party/WebKit/Source/web/WebFontDescription.cpp \
 	third_party/WebKit/Source/web/WebFontImpl.cpp \
 	third_party/WebKit/Source/web/WebFormControlElement.cpp \
@@ -299,6 +295,7 @@
 
 MY_DEFS_Debug := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -306,9 +303,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -317,12 +314,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -332,11 +326,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -438,6 +438,7 @@
 
 MY_DEFS_Release := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -445,9 +446,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -456,12 +457,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -471,11 +469,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -545,9 +549,11 @@
 LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
 LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
 LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
+LOCAL_ASFLAGS := $(LOCAL_CFLAGS)
 ### Rules for final target.
 
 LOCAL_LDFLAGS_Debug := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -557,7 +563,6 @@
 	-nostdlib \
 	-Wl,--no-undefined \
 	-Wl,--exclude-libs=ALL \
-	-Wl,--fatal-warnings \
 	-Wl,--gc-sections \
 	-Wl,--warn-shared-textrel \
 	-Wl,-O1 \
@@ -565,6 +570,7 @@
 
 
 LOCAL_LDFLAGS_Release := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -577,7 +583,6 @@
 	-Wl,-O1 \
 	-Wl,--as-needed \
 	-Wl,--gc-sections \
-	-Wl,--fatal-warnings \
 	-Wl,--warn-shared-textrel
 
 
diff --git a/Source/web/blink_web.target.linux-x86.mk b/Source/web/blink_web.target.linux-x86.mk
index 0a1a36b..9fcddf0 100644
--- a/Source/web/blink_web.target.linux-x86.mk
+++ b/Source/web/blink_web.target.linux-x86.mk
@@ -83,7 +83,6 @@
 	$(gyp_shared_intermediate_dir)/blink
 
 LOCAL_SRC_FILES := \
-	third_party/WebKit/Source/web/ApplicationCacheHost.cpp \
 	third_party/WebKit/Source/web/AssertMatchingEnums.cpp \
 	third_party/WebKit/Source/web/AssociatedURLLoader.cpp \
 	third_party/WebKit/Source/web/BackForwardClientImpl.cpp \
@@ -117,7 +116,6 @@
 	third_party/WebKit/Source/web/PageOverlayList.cpp \
 	third_party/WebKit/Source/web/PageScaleConstraintsSet.cpp \
 	third_party/WebKit/Source/web/PageWidgetDelegate.cpp \
-	third_party/WebKit/Source/web/PinchViewports.cpp \
 	third_party/WebKit/Source/web/PopupContainer.cpp \
 	third_party/WebKit/Source/web/PopupListBox.cpp \
 	third_party/WebKit/Source/web/PopupMenuChromium.cpp \
@@ -143,7 +141,6 @@
 	third_party/WebKit/Source/web/WebCachedURLRequest.cpp \
 	third_party/WebKit/Source/web/WebColorName.cpp \
 	third_party/WebKit/Source/web/WebColorSuggestion.cpp \
-	third_party/WebKit/Source/web/WebCrossOriginPreflightResultCache.cpp \
 	third_party/WebKit/Source/web/WebCustomElement.cpp \
 	third_party/WebKit/Source/web/WebDOMActivityLogger.cpp \
 	third_party/WebKit/Source/web/WebDOMCustomEvent.cpp \
@@ -170,7 +167,6 @@
 	third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp \
 	third_party/WebKit/Source/web/WebEntities.cpp \
 	third_party/WebKit/Source/web/WebFileChooserCompletionImpl.cpp \
-	third_party/WebKit/Source/web/WebFontCache.cpp \
 	third_party/WebKit/Source/web/WebFontDescription.cpp \
 	third_party/WebKit/Source/web/WebFontImpl.cpp \
 	third_party/WebKit/Source/web/WebFormControlElement.cpp \
@@ -275,11 +271,10 @@
 	-fvisibility=hidden \
 	-pipe \
 	-fPIC \
-	-m32 \
-	-mmmx \
-	-march=pentium4 \
 	-msse2 \
 	-mfpmath=sse \
+	-mmmx \
+	-m32 \
 	-fuse-ld=gold \
 	-ffunction-sections \
 	-funwind-tables \
@@ -302,6 +297,7 @@
 
 MY_DEFS_Debug := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -309,9 +305,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -320,12 +316,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -335,11 +328,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -416,11 +415,10 @@
 	-fvisibility=hidden \
 	-pipe \
 	-fPIC \
-	-m32 \
-	-mmmx \
-	-march=pentium4 \
 	-msse2 \
 	-mfpmath=sse \
+	-mmmx \
+	-m32 \
 	-fuse-ld=gold \
 	-ffunction-sections \
 	-funwind-tables \
@@ -443,6 +441,7 @@
 
 MY_DEFS_Release := \
 	'-DV8_DEPRECATION_WARNINGS' \
+	'-DBLINK_SCALE_FILTERS_AT_RECORD_TIME' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
 	'-DDISABLE_NACL' \
@@ -450,9 +449,9 @@
 	'-DUSE_LIBJPEG_TURBO=1' \
 	'-DUSE_PROPRIETARY_CODECS' \
 	'-DENABLE_CONFIGURATION_POLICY' \
+	'-DENABLE_NEW_GAMEPAD_API=1' \
 	'-DDISCARDABLE_MEMORY_ALWAYS_SUPPORTED_NATIVELY' \
 	'-DSYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE' \
-	'-DUSE_OPENSSL=1' \
 	'-DENABLE_EGLIMAGE=1' \
 	'-DCLD_VERSION=1' \
 	'-DENABLE_PRINTING=1' \
@@ -461,12 +460,9 @@
 	'-DINSIDE_BLINK' \
 	'-DENABLE_CUSTOM_SCHEME_HANDLER=0' \
 	'-DENABLE_SVG_FONTS=1' \
-	'-DENABLE_GDI_FONTS_ON_WINDOWS=0' \
-	'-DENABLE_HARFBUZZ_ON_WINDOWS=1' \
 	'-DWTF_USE_CONCATENATED_IMPULSE_RESPONSES=1' \
 	'-DENABLE_FAST_MOBILE_SCROLLING=1' \
 	'-DENABLE_INPUT_SPEECH=0' \
-	'-DENABLE_LEGACY_NOTIFICATIONS=0' \
 	'-DENABLE_MEDIA_CAPTURE=1' \
 	'-DENABLE_OPENTYPE_VERTICAL=1' \
 	'-DU_USING_ICU_NAMESPACE=0' \
@@ -476,11 +472,17 @@
 	'-DSK_ENABLE_LEGACY_API_ALIASING=1' \
 	'-DSK_ATTR_DEPRECATED=SK_NOTHING_ARG1' \
 	'-DGR_GL_IGNORE_ES3_MSAA=0' \
+	'-DSK_SUPPORT_LEGACY_LAYERRASTERIZER_API=1' \
+	'-DSK_WILL_NEVER_DRAW_PERSPECTIVE_TEXT' \
 	'-DSK_SUPPORT_LEGACY_COMPATIBLEDEVICE_CONFIG=1' \
 	'-DSK_SUPPORT_LEGACY_PUBLICEFFECTCONSTRUCTORS=1' \
+	'-DSK_SUPPORT_LEGACY_GETCLIPTYPE' \
+	'-DSK_SUPPORT_LEGACY_GETTOTALCLIP' \
+	'-DSK_SUPPORT_LEGACY_GETTOPDEVICE' \
 	'-DSK_BUILD_FOR_ANDROID' \
 	'-DSK_USE_POSIX_THREADS' \
 	'-DSK_DEFERRED_CANVAS_USES_FACTORIES=1' \
+	'-DUSE_OPENSSL=1' \
 	'-D__STDC_CONSTANT_MACROS' \
 	'-D__STDC_FORMAT_MACROS' \
 	'-DANDROID' \
@@ -549,9 +551,11 @@
 LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
 LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
 LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
+LOCAL_ASFLAGS := $(LOCAL_CFLAGS)
 ### Rules for final target.
 
 LOCAL_LDFLAGS_Debug := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -561,7 +565,6 @@
 	-nostdlib \
 	-Wl,--no-undefined \
 	-Wl,--exclude-libs=ALL \
-	-Wl,--fatal-warnings \
 	-Wl,--gc-sections \
 	-Wl,--warn-shared-textrel \
 	-Wl,-O1 \
@@ -569,6 +572,7 @@
 
 
 LOCAL_LDFLAGS_Release := \
+	-Wl,--fatal-warnings \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -581,7 +585,6 @@
 	-Wl,-O1 \
 	-Wl,--as-needed \
 	-Wl,--gc-sections \
-	-Wl,--fatal-warnings \
 	-Wl,--warn-shared-textrel
 
 
diff --git a/Source/web/mac/WebScrollbarTheme.mm b/Source/web/mac/WebScrollbarTheme.mm
index 7adb6ce..fae1f1a 100644
--- a/Source/web/mac/WebScrollbarTheme.mm
+++ b/Source/web/mac/WebScrollbarTheme.mm
@@ -45,14 +45,14 @@
 
 void WebScrollbarTheme::updateScrollbars(
     float initialButtonDelay, float autoscrollButtonDelay,
-    bool jumpOnTrackClick, ScrollerStyle preferredScrollerStyle, bool redraw)
+    ScrollerStyle preferredScrollerStyle, bool redraw)
 {
     ScrollbarTheme* theme = ScrollbarTheme::theme();
     if (theme->isMockTheme())
         return;
 
     static_cast<ScrollbarThemeMacCommon*>(ScrollbarTheme::theme())->preferencesChanged(
-        initialButtonDelay, autoscrollButtonDelay, jumpOnTrackClick, preferredScrollerStyle, redraw);
+        initialButtonDelay, autoscrollButtonDelay, preferredScrollerStyle, redraw);
 }
 
 } // namespace blink
diff --git a/Source/web/mac/WebSubstringUtil.mm b/Source/web/mac/WebSubstringUtil.mm
index c072cf0..6e50c37 100644
--- a/Source/web/mac/WebSubstringUtil.mm
+++ b/Source/web/mac/WebSubstringUtil.mm
@@ -44,35 +44,28 @@
 #include "core/editing/PlainTextRange.h"
 #include "core/editing/TextIterator.h"
 #include "core/html/HTMLElement.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 #include "core/frame/FrameView.h"
 #include "core/rendering/RenderObject.h"
 #include "core/rendering/style/RenderStyle.h"
+#include "core/rendering/HitTestResult.h"
 #include "platform/fonts/Font.h"
 #include "platform/mac/ColorMac.h"
 #include "public/platform/WebRect.h"
+#include "public/web/WebHitTestResult.h"
+#include "public/web/WebRange.h"
+#include "public/web/WebView.h"
 
 using namespace WebCore;
 
-namespace blink {
-
-NSAttributedString* WebSubstringUtil::attributedSubstringInRange(WebFrame* webFrame, size_t location, size_t length)
+static NSAttributedString* attributedSubstringFromRange(const Range* range)
 {
-    Frame* frame = toWebFrameImpl(webFrame)->frame();
-    if (frame->view()->needsLayout())
-        frame->view()->layout();
-
-    Element* editable = frame->selection().rootEditableElementOrDocumentElement();
-    ASSERT(editable);
-    RefPtr<Range> range(PlainTextRange(location, location + length).createRange(*editable));
-    if (!range)
-        return nil;
-
     NSMutableAttributedString* string = [[NSMutableAttributedString alloc] init];
     NSMutableDictionary* attrs = [NSMutableDictionary dictionary];
+    size_t length = range->endOffset() - range->startOffset();
 
     unsigned position = 0;
-    for (TextIterator it(range.get()); !it.atEnd() && [string length] < length; it.advance()) {
+    for (TextIterator it(range); !it.atEnd() && [string length] < length; it.advance()) {
         unsigned numCharacters = it.length();
         if (!numCharacters)
             continue;
@@ -115,4 +108,56 @@
     return [string autorelease];
 }
 
+namespace blink {
+
+NSAttributedString* WebSubstringUtil::attributedWordAtPoint(WebView* view, WebPoint point, WebPoint& baselinePoint)
+{
+    HitTestResult result = view->hitTestResultAt(point);
+    LocalFrame* frame = result.targetNode()->document().frame();
+    FrameView* frameView = frame->view();
+
+    RefPtr<Range> range = frame->rangeForPoint(result.roundedPointInInnerNodeFrame());
+    if (!range)
+        return nil;
+
+    // Expand to word under point.
+    VisibleSelection selection(range.get());
+    selection.expandUsingGranularity(WordGranularity);
+    RefPtr<Range> wordRange = selection.toNormalizedRange();
+
+    // Convert to NSAttributedString.
+    NSAttributedString* string = attributedSubstringFromRange(wordRange.get());
+
+    // Compute bottom left corner and convert to AppKit coordinates.
+    IntRect stringRect = enclosingIntRect(wordRange->boundingRect());
+    IntPoint stringPoint = frameView->contentsToWindow(stringRect).minXMaxYCorner();
+    stringPoint.setY(frameView->height() - stringPoint.y());
+
+    // Adjust for the font's descender. AppKit wants the baseline point.
+    if ([string length]) {
+        NSDictionary* attributes = [string attributesAtIndex:0 effectiveRange:NULL];
+        NSFont* font = [attributes objectForKey:NSFontAttributeName];
+        if (font)
+            stringPoint.move(0, ceil(-[font descender]));
+    }
+
+    baselinePoint = stringPoint;
+    return string;
+}
+
+NSAttributedString* WebSubstringUtil::attributedSubstringInRange(WebFrame* webFrame, size_t location, size_t length)
+{
+    LocalFrame* frame = toWebFrameImpl(webFrame)->frame();
+    if (frame->view()->needsLayout())
+        frame->view()->layout();
+
+    Element* editable = frame->selection().rootEditableElementOrDocumentElement();
+    ASSERT(editable);
+    RefPtr<Range> range(PlainTextRange(location, location + length).createRange(*editable));
+    if (!range)
+        return nil;
+
+    return attributedSubstringFromRange(range.get());
+}
+
 } // namespace blink
diff --git a/Source/web/resources/calendarPicker.js b/Source/web/resources/calendarPicker.js
index 7f28be8..d811070 100644
--- a/Source/web/resources/calendarPicker.js
+++ b/Source/web/resources/calendarPicker.js
@@ -1522,16 +1522,29 @@
     value = Math.min(this.maximumContentOffset - this._height, Math.max(this.minimumContentOffset, Math.floor(value)));
     if (this._contentOffset === value)
         return;
-    var newPartitionNumber = Math.floor(value / ScrollView.PartitionHeight);    
+    this._contentOffset = value;
+    this._updateScrollContent();
+    if (this.delegate)
+        this.delegate.scrollViewDidChangeContentOffset(this);
+};
+
+ScrollView.prototype._updateScrollContent = function() {
+    var newPartitionNumber = Math.floor(this._contentOffset / ScrollView.PartitionHeight);
     var partitionChanged = this._partitionNumber !== newPartitionNumber;
     this._partitionNumber = newPartitionNumber;
-    this._contentOffset = value;
     this.contentElement.style.webkitTransform = "translate(0, " + (-this.contentPositionForContentOffset(this._contentOffset)) + "px)";
-    if (this.delegate) {
-        this.delegate.scrollViewDidChangeContentOffset(this);
-        if (partitionChanged)
-            this.delegate.scrollViewDidChangePartition(this);
-    }
+    if (this.delegate && partitionChanged)
+        this.delegate.scrollViewDidChangePartition(this);
+};
+
+/**
+ * @param {!View|Node} parent
+ * @param {?View|Node=} before
+ * @override
+ */
+ScrollView.prototype.attachTo = function(parent, before) {
+    View.prototype.attachTo.call(this, parent, before);
+    this._updateScrollContent();
 };
 
 /**
diff --git a/Source/web/tests/AssociatedURLLoaderTest.cpp b/Source/web/tests/AssociatedURLLoaderTest.cpp
index 6969078..04b1264 100644
--- a/Source/web/tests/AssociatedURLLoaderTest.cpp
+++ b/Source/web/tests/AssociatedURLLoaderTest.cpp
@@ -120,9 +120,9 @@
         Platform::current()->unitTestSupport()->serveAsynchronousMockedRequests();
     }
 
-    WebURLLoader* createAssociatedURLLoader(const WebURLLoaderOptions options = WebURLLoaderOptions())
+    PassOwnPtr<WebURLLoader> createAssociatedURLLoader(const WebURLLoaderOptions options = WebURLLoaderOptions())
     {
-        return mainFrame()->createAssociatedURLLoader(options);
+        return adoptPtr(mainFrame()->createAssociatedURLLoader(options));
     }
 
     // WebURLLoaderClient implementation.
@@ -276,7 +276,7 @@
     WTF::String m_frameFilePath;
     FrameTestHelpers::WebViewHelper m_helper;
 
-    WebURLLoader* m_expectedLoader;
+    OwnPtr<WebURLLoader> m_expectedLoader;
     WebURLResponse m_actualResponse;
     WebURLResponse m_expectedResponse;
     WebURLRequest m_expectedNewRequest;
diff --git a/Source/web/tests/BitmapImageTest.cpp b/Source/web/tests/BitmapImageTest.cpp
index 8d1ab7a..e454d6c 100644
--- a/Source/web/tests/BitmapImageTest.cpp
+++ b/Source/web/tests/BitmapImageTest.cpp
@@ -75,7 +75,7 @@
 
     void loadImage(const char* fileName)
     {
-        RefPtr<SharedBuffer> imageData = readFile("/LayoutTests/fast/images/resources/animated-10color.gif");
+        RefPtr<SharedBuffer> imageData = readFile(fileName);
         ASSERT_TRUE(imageData.get());
 
         m_image->setData(imageData, true);
@@ -100,6 +100,11 @@
         return size;
     }
 
+    void advanceAnimation()
+    {
+        m_image->advanceAnimation(0);
+    }
+
 protected:
     virtual void SetUp() OVERRIDE
     {
@@ -143,4 +148,14 @@
     EXPECT_EQ(0u, decodedSize());
 }
 
+TEST_F(BitmapImageTest, maybeAnimated)
+{
+    loadImage("/LayoutTests/fast/images/resources/gif-loop-count.gif");
+    for (size_t i = 0; i < frameCount(); ++i) {
+        EXPECT_TRUE(m_image->maybeAnimated());
+        advanceAnimation();
+    }
+    EXPECT_FALSE(m_image->maybeAnimated());
+}
+
 } // namespace
diff --git a/Source/web/tests/Canvas2DLayerBridgeTest.cpp b/Source/web/tests/Canvas2DLayerBridgeTest.cpp
index 9d1b37c..382b97e 100644
--- a/Source/web/tests/Canvas2DLayerBridgeTest.cpp
+++ b/Source/web/tests/Canvas2DLayerBridgeTest.cpp
@@ -30,6 +30,7 @@
 #include "SkSurface.h"
 #include "platform/graphics/ImageBuffer.h"
 #include "public/platform/Platform.h"
+#include "public/platform/WebExternalBitmap.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"
 #include "public/platform/WebThread.h"
 #include "third_party/skia/include/core/SkDevice.h"
@@ -90,6 +91,23 @@
     RefPtr<Canvas2DLayerBridge> m_layerBridge;
 };
 
+class NullWebExternalBitmap : public WebExternalBitmap {
+public:
+    virtual WebSize size()
+    {
+        return WebSize();
+    }
+
+    virtual void setSize(WebSize)
+    {
+    }
+
+    virtual uint8* pixels()
+    {
+        return 0;
+    }
+};
+
 } // namespace
 
 class Canvas2DLayerBridgeTest : public Test {
@@ -98,7 +116,8 @@
     {
         MockCanvasContext mainMock;
         OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
-        OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(SkSurface::NewRasterPMColor(300, 150)));
+        RefPtr<SkSurface> surface = adoptRef(SkSurface::NewRasterPMColor(300, 150));
+        OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
 
         ::testing::Mock::VerifyAndClearExpectations(&mainMock);
 
@@ -116,6 +135,20 @@
 
         ::testing::Mock::VerifyAndClearExpectations(&mainMock);
     }
+
+    void prepareMailboxWithBitmapTest()
+    {
+        MockCanvasContext mainMock;
+        RefPtr<SkSurface> surface = adoptRef(SkSurface::NewRasterPMColor(300, 150));
+        OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
+        OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
+        Canvas2DLayerBridgePtr bridge(adoptRef(new Canvas2DLayerBridge(mainMockProvider.release(), canvas.release(), 0, NonOpaque)));
+        bridge->m_lastImageId = 1;
+
+        NullWebExternalBitmap bitmap;
+        bridge->prepareMailbox(0, &bitmap);
+        EXPECT_EQ(0u, bridge->m_lastImageId);
+    }
 };
 
 namespace {
@@ -125,4 +158,9 @@
     fullLifecycleTest();
 }
 
+TEST_F(Canvas2DLayerBridgeTest, prepareMailboxWithBitmapTest)
+{
+    prepareMailboxWithBitmapTest();
+}
+
 } // namespace
diff --git a/Source/web/tests/Canvas2DLayerManagerTest.cpp b/Source/web/tests/Canvas2DLayerManagerTest.cpp
index 7383e66..ab47ff4 100644
--- a/Source/web/tests/Canvas2DLayerManagerTest.cpp
+++ b/Source/web/tests/Canvas2DLayerManagerTest.cpp
@@ -128,7 +128,8 @@
 
 static PassOwnPtr<SkDeferredCanvas> createCanvas()
 {
-    return adoptPtr(SkDeferredCanvas::Create(SkSurface::NewRasterPMColor(1, 1)));
+    RefPtr<SkSurface> surface = adoptRef(SkSurface::NewRasterPMColor(1, 1));
+    return adoptPtr(SkDeferredCanvas::Create(surface.get()));
 }
 
 } // unnamed namespace
diff --git a/Source/web/tests/CompositedLayerMappingTest.cpp b/Source/web/tests/CompositedLayerMappingTest.cpp
index 2b3ad66..077cd36 100644
--- a/Source/web/tests/CompositedLayerMappingTest.cpp
+++ b/Source/web/tests/CompositedLayerMappingTest.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#include "core/rendering/CompositedLayerMapping.h"
+#include "core/rendering/compositing/CompositedLayerMapping.h"
 
 #include "FrameTestHelpers.h"
 #include "URLTestHelpers.h"
diff --git a/Source/web/tests/DragImageTest.cpp b/Source/web/tests/DragImageTest.cpp
index 019760b..3277f07 100644
--- a/Source/web/tests/DragImageTest.cpp
+++ b/Source/web/tests/DragImageTest.cpp
@@ -77,7 +77,7 @@
     virtual PassRefPtr<NativeImageSkia> nativeImageForCurrentFrame() OVERRIDE
     {
         if (m_size.isZero())
-            return 0;
+            return nullptr;
 
         return m_nativeImage;
     }
diff --git a/Source/web/tests/FakeWebPlugin.cpp b/Source/web/tests/FakeWebPlugin.cpp
index 47076e4..20e8224 100644
--- a/Source/web/tests/FakeWebPlugin.cpp
+++ b/Source/web/tests/FakeWebPlugin.cpp
@@ -55,6 +55,7 @@
 {
     m_container = 0;
     m_frame = 0;
+    delete this;
 }
 
 } // namespace  WebKit
diff --git a/Source/web/tests/FakeWebPlugin.h b/Source/web/tests/FakeWebPlugin.h
index 06413d5..f4792b7 100644
--- a/Source/web/tests/FakeWebPlugin.h
+++ b/Source/web/tests/FakeWebPlugin.h
@@ -46,7 +46,6 @@
 class FakeWebPlugin : public WebPlugin {
 public:
     FakeWebPlugin(blink::WebFrame*, const blink::WebPluginParams&);
-    virtual ~FakeWebPlugin();
 
     // WebPlugin methods:
     virtual bool initialize(blink::WebPluginContainer*) OVERRIDE;
@@ -68,6 +67,9 @@
     virtual void didFailLoadingFrameRequest(const blink::WebURL&, void* notifyData, const blink::WebURLError&) OVERRIDE { }
     virtual bool isPlaceholder() OVERRIDE { return false; }
 
+protected:
+    virtual ~FakeWebPlugin();
+
 private:
     WebFrame* m_frame;
     WebPluginContainer* m_container;
diff --git a/Source/web/tests/FrameTestHelpers.cpp b/Source/web/tests/FrameTestHelpers.cpp
index fc25299..63f5d58 100644
--- a/Source/web/tests/FrameTestHelpers.cpp
+++ b/Source/web/tests/FrameTestHelpers.cpp
@@ -91,7 +91,7 @@
 {
     // Pending tasks include Timers that have been scheduled.
     WebCore::Timer<QuitTask> quitOnTimeout(new QuitTask, &QuitTask::PostThis);
-    quitOnTimeout.startOneShot(0);
+    quitOnTimeout.startOneShot(0, FROM_HERE);
     Platform::current()->currentThread()->enterRunLoop();
 }
 
diff --git a/Source/web/tests/GIFImageDecoderTest.cpp b/Source/web/tests/GIFImageDecoderTest.cpp
index 0e3c909..c17188e 100644
--- a/Source/web/tests/GIFImageDecoderTest.cpp
+++ b/Source/web/tests/GIFImageDecoderTest.cpp
@@ -281,6 +281,7 @@
 
     // Compute hashes when the file is progressively decoded.
     decoder = createDecoder();
+    EXPECT_EQ(cAnimationLoopOnce, decoder->repetitionCount());
     for (size_t i = 1; i <= fullLength; i += increment) {
         RefPtr<SharedBuffer> data = SharedBuffer::create(fullData->data(), i);
         decoder->setData(data.get(), i == fullLength);
@@ -291,6 +292,7 @@
         }
         progressiveHashes.append(hashSkBitmap(frame->getSkBitmap()));
     }
+    EXPECT_EQ(cAnimationNone, decoder->repetitionCount());
 
     bool match = true;
     for (size_t i = 0; i < truncatedHashes.size(); ++i) {
@@ -334,6 +336,7 @@
     EXPECT_FALSE(decoder->failed());
     EXPECT_TRUE(decoder->frameIsCompleteAtIndex(0));
     EXPECT_TRUE(decoder->frameIsCompleteAtIndex(1));
+    EXPECT_EQ(cAnimationLoopInfinite, decoder->repetitionCount());
 }
 
 TEST(GIFImageDecoderTest, frameIsCompleteLoading)
diff --git a/Source/web/tests/GraphicsContextTest.cpp b/Source/web/tests/GraphicsContextTest.cpp
index 1fb9130..07f74fd 100644
--- a/Source/web/tests/GraphicsContextTest.cpp
+++ b/Source/web/tests/GraphicsContextTest.cpp
@@ -573,7 +573,7 @@
     EXPECT_PIXELS_MATCH(bitmap, context.opaqueRegion().asRect());
 
     context.save();
-    context.setAlpha(0.5);
+    context.setAlphaAsFloat(0.5);
     context.drawImage(opaqueImage.get(), IntPoint(25, 15), CompositeSourceIn);
     context.restore();
     EXPECT_EQ_RECT(IntRect(10, 25, 90, 75), context.opaqueRegion().asRect());
@@ -588,7 +588,7 @@
     EXPECT_PIXELS_MATCH(bitmap, context.opaqueRegion().asRect());
 
     context.save();
-    context.setAlpha(0.5);
+    context.setAlphaAsFloat(0.5);
     context.drawImage(opaqueImage.get(), IntPoint(15, 25), CompositeSourceIn);
     context.restore();
     EXPECT_EQ_RECT(IntRect(25, 10, 75, 90), context.opaqueRegion().asRect());
diff --git a/Source/web/tests/GraphicsLayerTest.cpp b/Source/web/tests/GraphicsLayerTest.cpp
index e9bdfd7..fff5d6d 100644
--- a/Source/web/tests/GraphicsLayerTest.cpp
+++ b/Source/web/tests/GraphicsLayerTest.cpp
@@ -48,7 +48,7 @@
 
 class MockGraphicsLayerClient : public GraphicsLayerClient {
 public:
-    virtual void notifyAnimationStarted(const GraphicsLayer*, double wallClockTime, double monotonicTime) OVERRIDE { }
+    virtual void notifyAnimationStarted(const GraphicsLayer*, double monotonicTime) OVERRIDE { }
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) OVERRIDE { }
     virtual String debugName(const GraphicsLayer*) OVERRIDE { return String(); }
 };
@@ -134,7 +134,6 @@
     virtual int visibleHeight() const OVERRIDE { return 10; }
     virtual IntSize contentsSize() const OVERRIDE { return IntSize(100, 100); }
     virtual bool scrollbarsCanBeActive() const OVERRIDE { return false; }
-    virtual ScrollableArea* enclosingScrollableArea() const OVERRIDE { return 0; }
     virtual IntRect scrollableAreaBoundingBox() const OVERRIDE { return IntRect(); }
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) OVERRIDE { }
     virtual void invalidateScrollCornerRect(const IntRect&) OVERRIDE { }
@@ -166,16 +165,4 @@
     EXPECT_EQ(scrollPosition, WebPoint(scrollableArea.scrollPosition()));
 }
 
-TEST_F(GraphicsLayerTest, DISABLED_setContentsToSolidColor)
-{
-    m_graphicsLayer->setContentsToSolidColor(Color::transparent);
-    EXPECT_FALSE(m_graphicsLayer->contentsLayer());
-
-    m_graphicsLayer->setContentsToSolidColor(Color::white);
-    EXPECT_TRUE(m_graphicsLayer->contentsLayer());
-
-    m_graphicsLayer->setContentsToSolidColor(Color());
-    EXPECT_FALSE(m_graphicsLayer->contentsLayer());
-}
-
 } // namespace
diff --git a/Source/web/tests/ImageLayerChromiumTest.cpp b/Source/web/tests/ImageLayerChromiumTest.cpp
index cb261df..da06d30 100644
--- a/Source/web/tests/ImageLayerChromiumTest.cpp
+++ b/Source/web/tests/ImageLayerChromiumTest.cpp
@@ -37,7 +37,7 @@
 
 class MockGraphicsLayerClient : public GraphicsLayerClient {
   public:
-    virtual void notifyAnimationStarted(const GraphicsLayer*, double wallClockTime, double monotonicTime) OVERRIDE { }
+    virtual void notifyAnimationStarted(const GraphicsLayer*, double monotonicTime) OVERRIDE { }
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) OVERRIDE { }
     virtual String debugName(const GraphicsLayer*) OVERRIDE { return String(); }
 };
@@ -77,7 +77,7 @@
     virtual PassRefPtr<NativeImageSkia> nativeImageForCurrentFrame() OVERRIDE
     {
         if (m_size.isZero())
-            return 0;
+            return nullptr;
 
         return m_nativeImage;
     }
diff --git a/Source/web/tests/PopupMenuTest.cpp b/Source/web/tests/PopupMenuTest.cpp
index 5153c51..1014591 100644
--- a/Source/web/tests/PopupMenuTest.cpp
+++ b/Source/web/tests/PopupMenuTest.cpp
@@ -103,7 +103,7 @@
         FontDescription fontDescription;
         fontDescription.setComputedSize(12.0);
         Font font(fontDescription);
-        font.update(0);
+        font.update(nullptr);
         return PopupMenuStyle(Color::black, Color::white, font, true, false, Length(), TextDirection(), false /* has text direction override */);
     }
     virtual PopupMenuStyle menuStyle() const { return itemStyle(0); }
@@ -123,7 +123,7 @@
     virtual FontSelector* fontSelector() const { return 0; }
     virtual HostWindow* hostWindow() const { return 0; }
 
-    virtual PassRefPtr<Scrollbar> createScrollbar(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize) { return 0; }
+    virtual PassRefPtr<Scrollbar> createScrollbar(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize) { return nullptr; }
 
     void setDisabledIndex(unsigned index) { m_disabledIndexSet.insert(index); }
     void setFocusedNode(Node* node) { m_node = node; }
@@ -190,7 +190,7 @@
 
     virtual void TearDown()
     {
-        m_popupMenu = 0;
+        m_popupMenu = nullptr;
         Platform::current()->unitTestSupport()->unregisterAllMockedURLs();
     }
 
diff --git a/Source/web/tests/ProgrammaticScrollTest.cpp b/Source/web/tests/ProgrammaticScrollTest.cpp
index c6975fe..3d47b0d 100644
--- a/Source/web/tests/ProgrammaticScrollTest.cpp
+++ b/Source/web/tests/ProgrammaticScrollTest.cpp
@@ -58,13 +58,14 @@
     webView->layout();
 
     WebViewImpl* webViewImpl = toWebViewImpl(webView);
-    Frame* frame = webViewImpl->mainFrameImpl()->frame();
+    LocalFrame* frame = webViewImpl->mainFrameImpl()->frame();
     frame->loader().setLoadType(FrameLoadTypeBackForward);
 
-    // Scale and scroll the page and save that state. Then scale and scroll again and restore.
-    webViewImpl->setPageScaleFactor(2.0f, WebPoint(0, 200));
-    frame->loader().saveDocumentAndScrollState();
-    webViewImpl->setPageScaleFactor(3.0f, WebPoint(0, 300));
+    webViewImpl->setPageScaleFactor(3.0f, WebPoint(0, 500));
+    frame->view()->setWasScrolledByUser(false);
+    frame->loader().currentItem()->setPageScaleFactor(2);
+    frame->loader().currentItem()->setScrollPoint(WebPoint(0, 200));
+
     // Flip back the wasScrolledByUser flag which was set to true by setPageScaleFactor
     // because otherwise FrameLoader::restoreScrollPositionAndViewState does nothing.
     frame->view()->setWasScrolledByUser(false);
@@ -86,19 +87,15 @@
     webView->layout();
 
     WebViewImpl* webViewImpl = toWebViewImpl(webView);
-    Frame* frame = webViewImpl->mainFrameImpl()->frame();
+    LocalFrame* frame = webViewImpl->mainFrameImpl()->frame();
     frame->loader().setLoadType(FrameLoadTypeBackForward);
 
-    // Scale and scroll the page and save that state, but then set scale to zero. Then scale and
-    // scroll again and restore.
-    webViewImpl->setPageScaleFactor(2.0f, WebPoint(0, 400));
-    frame->loader().saveDocumentAndScrollState();
     webViewImpl->setPageScaleFactor(3.0f, WebPoint(0, 500));
-    // Flip back the wasScrolledByUser flag which was set to true by setPageScaleFactor
-    // because otherwise FrameLoader::restoreScrollPositionAndViewState does nothing.
     frame->view()->setWasScrolledByUser(false);
+    frame->loader().currentItem()->setPageScaleFactor(0);
+    frame->loader().currentItem()->setScrollPoint(WebPoint(0, 400));
+
     // FrameLoader::restoreScrollPositionAndViewState flows differently if scale is zero.
-    frame->loader().currentItem()->setPageScaleFactor(0.0f);
     frame->loader().restoreScrollPositionAndViewState();
 
     // Expect that only the scroll position was restored, and that it was not a programmatic scroll.
diff --git a/Source/web/tests/RenderTableCellTest.cpp b/Source/web/tests/RenderTableCellTest.cpp
index ca2a9a1..973a043 100644
--- a/Source/web/tests/RenderTableCellTest.cpp
+++ b/Source/web/tests/RenderTableCellTest.cpp
@@ -32,7 +32,7 @@
 #include "WebFrameImpl.h"
 #include "WebView.h"
 #include "core/dom/Document.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 
 #include <gtest/gtest.h>
 
diff --git a/Source/web/tests/RenderTableRowTest.cpp b/Source/web/tests/RenderTableRowTest.cpp
index 7175242..18ec779 100644
--- a/Source/web/tests/RenderTableRowTest.cpp
+++ b/Source/web/tests/RenderTableRowTest.cpp
@@ -32,7 +32,7 @@
 #include "WebFrameImpl.h"
 #include "WebView.h"
 #include "core/dom/Document.h"
-#include "core/frame/Frame.h"
+#include "core/frame/LocalFrame.h"
 
 #include <gtest/gtest.h>
 
diff --git a/Source/web/tests/ScrollAnimatorNoneTest.cpp b/Source/web/tests/ScrollAnimatorNoneTest.cpp
index 791176b..40067da 100644
--- a/Source/web/tests/ScrollAnimatorNoneTest.cpp
+++ b/Source/web/tests/ScrollAnimatorNoneTest.cpp
@@ -81,8 +81,6 @@
 
 class MockScrollAnimatorNone : public ScrollAnimatorNone {
 public:
-    MockScrollAnimatorNone()
-        : ScrollAnimatorNone(new MockScrollableArea(true)) { }
     MockScrollAnimatorNone(ScrollableArea* scrollableArea)
         : ScrollAnimatorNone(scrollableArea) { }
 
@@ -182,6 +180,8 @@
     struct SavePerAxisData : public ScrollAnimatorNone::PerAxisData {
         SavePerAxisData(const ScrollAnimatorNone::PerAxisData& data)
             : ScrollAnimatorNone::PerAxisData(&m_mockScrollAnimatorNone, 0, 768)
+            , m_mockScrollableArea(true)
+            , m_mockScrollAnimatorNone(&m_mockScrollableArea)
         {
             this->m_currentVelocity = data.m_currentVelocity;
             this->m_desiredPosition = data.m_desiredPosition;
@@ -203,10 +203,13 @@
         {
             return m_currentVelocity == other.m_currentVelocity && m_desiredPosition == other.m_desiredPosition && m_desiredVelocity == other.m_desiredVelocity && m_startPosition == other.m_startPosition && m_startTime == other.m_startTime && m_startVelocity == other.m_startVelocity && m_animationTime == other.m_animationTime && m_lastAnimationTime == other.m_lastAnimationTime && m_attackPosition == other.m_attackPosition && m_attackTime == other.m_attackTime && m_attackCurve == other.m_attackCurve && m_releasePosition == other.m_releasePosition && m_releaseTime == other.m_releaseTime && m_releaseCurve == other.m_releaseCurve;
         }
+        MockScrollableArea m_mockScrollableArea;
         MockScrollAnimatorNone m_mockScrollAnimatorNone;
     };
 
     ScrollAnimatorNoneTest()
+        : m_mockScrollableArea(true)
+        , m_mockScrollAnimatorNone(&m_mockScrollableArea)
     {
     }
 
@@ -241,6 +244,7 @@
     static double kStartTime;
     static double kEndTime;
     float m_currentPosition;
+    MockScrollableArea m_mockScrollableArea;
     MockScrollAnimatorNone m_mockScrollAnimatorNone;
     bool m_scrollingDown;
     ScrollAnimatorNone::PerAxisData* m_data;
diff --git a/Source/web/tests/ScrollingCoordinatorChromiumTest.cpp b/Source/web/tests/ScrollingCoordinatorChromiumTest.cpp
index ff2b734..39e2b86 100644
--- a/Source/web/tests/ScrollingCoordinatorChromiumTest.cpp
+++ b/Source/web/tests/ScrollingCoordinatorChromiumTest.cpp
@@ -33,9 +33,9 @@
 #include "WebSettings.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
-#include "core/rendering/CompositedLayerMapping.h"
-#include "core/rendering/RenderLayerCompositor.h"
 #include "core/rendering/RenderView.h"
+#include "core/rendering/compositing/CompositedLayerMapping.h"
+#include "core/rendering/compositing/RenderLayerCompositor.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebLayer.h"
@@ -108,7 +108,7 @@
     }
 
     WebViewImpl* webViewImpl() const { return m_helper.webViewImpl(); }
-    Frame* frame() const { return m_helper.webViewImpl()->mainFrameImpl()->frame(); }
+    LocalFrame* frame() const { return m_helper.webViewImpl()->mainFrameImpl()->frame(); }
 
 protected:
     std::string m_baseURL;
diff --git a/Source/web/tests/TouchActionTest.cpp b/Source/web/tests/TouchActionTest.cpp
index 9cb4f7c..9e0e093 100644
--- a/Source/web/tests/TouchActionTest.cpp
+++ b/Source/web/tests/TouchActionTest.cpp
@@ -44,8 +44,8 @@
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/dom/shadow/ShadowRoot.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/EventHandler.h"
 #include "core/rendering/HitTestResult.h"
 #include "core/rendering/RenderTreeAsText.h"
@@ -169,7 +169,7 @@
     WebView* webView = m_webViewHelper.initializeAndLoad(m_baseURL + file, true, 0, &client);
 
     // Set size to enable hit testing, and avoid line wrapping for consistency with browser.
-    webView->resize(WebSize(700, 1000));
+    webView->resize(WebSize(800, 1200));
 
     // Scroll to verify the code properly transforms windows to client co-ords.
     const int kScrollOffset = 100;
@@ -235,7 +235,7 @@
             contextStream << "=" << clientPoint.x() << "," << clientPoint.y() << ").";
             std::string failureContextPos = contextStream.str();
 
-            WebCore::Frame* frame = root->document().frame();
+            WebCore::LocalFrame* frame = root->document().frame();
             WebCore::FrameView* frameView = frame->view();
             WebCore::IntRect visibleRect = frameView->windowClipRect();
             ASSERT_TRUE(visibleRect.contains(clientPoint)) << failureContextPos
@@ -272,6 +272,8 @@
                         EXPECT_EQ(WebTouchActionPanY, client.lastTouchAction()) << failureContextPos;
                     } else if (expectedAction == "pan-x-y") {
                         EXPECT_EQ((WebTouchActionPanX | WebTouchActionPanY), client.lastTouchAction()) << failureContextPos;
+                    } else if (expectedAction == "manipulation") {
+                        EXPECT_EQ((WebTouchActionPanX | WebTouchActionPanY | WebTouchActionPinchZoom), client.lastTouchAction()) << failureContextPos;
                     } else {
                         FAIL() << "Unrecognized expected-action \"" << expectedAction.ascii().data()
                             << "\" " << failureContextPos;
diff --git a/Source/web/tests/UniscribeHelperTest.cpp b/Source/web/tests/UniscribeHelperTest.cpp
deleted file mode 100644
index 61ff136..0000000
--- a/Source/web/tests/UniscribeHelperTest.cpp
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <gtest/gtest.h>
-
-#include "platform/fonts/win/UniscribeHelper.h"
-#include "wtf/text/WTFString.h"
-
-using namespace WebCore;
-
-namespace {
-
-class UniscribeTest : public testing::Test {
-public:
-    UniscribeTest()
-    {
-    }
-
-    // Returns an HFONT with the given name. The caller does not have to free
-    // this, it will be automatically freed at the end of the test. Returns 0
-    // on failure. On success, the
-    HFONT MakeFont(const wchar_t* fontName, SCRIPT_CACHE** cache)
-    {
-        LOGFONT lf;
-        memset(&lf, 0, sizeof(LOGFONT));
-        lf.lfHeight = 20;
-        wcscpy_s(lf.lfFaceName, fontName);
-
-        HFONT hfont = CreateFontIndirect(&lf);
-        if (!hfont)
-            return 0;
-
-        *cache = new SCRIPT_CACHE;
-        **cache = 0;
-        createdFonts.append(std::make_pair(hfont, *cache));
-        return hfont;
-    }
-
-protected:
-    // Default font properties structure for tests to use.
-    SCRIPT_FONTPROPERTIES properties;
-
-private:
-    virtual void SetUp()
-    {
-        memset(&properties, 0, sizeof(SCRIPT_FONTPROPERTIES));
-        properties.cBytes = sizeof(SCRIPT_FONTPROPERTIES);
-        properties.wgBlank = ' ';
-        properties.wgDefault = '?'; // Used when the char is not in the font.
-        properties.wgInvalid = '#'; // Used for invalid characters.
-    }
-
-    virtual void TearDown()
-    {
-        // Free any allocated fonts.
-        for (size_t i = 0; i < createdFonts.size(); i++) {
-            DeleteObject(createdFonts[i].first);
-            ScriptFreeCache(createdFonts[i].second);
-            delete createdFonts[i].second;
-        }
-        createdFonts.clear();
-    }
-
-    // Tracks allocated fonts so we can delete them at the end of the test.
-    // The script cache pointer is heap allocated and must be freed.
-    Vector< std::pair<HFONT, SCRIPT_CACHE*> > createdFonts;
-};
-
-} // namespace
-
-// This test tests giving Uniscribe a very large buffer, which will cause a
-// failure.
-TEST_F(UniscribeTest, TooBig)
-{
-    // Make a large string with an e with a zillion combining accents.
-    String input(L"e");
-    for (int i = 0; i < 100000; i++)
-        input.append(static_cast<UChar>(0x301)); // Combining acute accent.
-
-    SCRIPT_CACHE* scriptCache;
-    HFONT hfont = MakeFont(L"Times New Roman", &scriptCache);
-    ASSERT_TRUE(hfont);
-
-    // Test a long string without the normal length protection we have. This
-    // will cause shaping to fail.
-    {
-        Vector<UChar> inputCharacters;
-        input.appendTo(inputCharacters);
-        UniscribeHelper uniscribe(
-            inputCharacters.data(), static_cast<int>(inputCharacters.size()),
-            false, hfont, scriptCache, &properties, 0);
-        uniscribe.initWithOptionalLengthProtection(false);
-
-        // There should be one shaping entry, with nothing in it.
-        ASSERT_EQ(1, uniscribe.m_shapes.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_glyphs.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_logs.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_visualAttributes.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_advance.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_offsets.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_justify.size());
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_abc.abcA);
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_abc.abcB);
-        EXPECT_EQ(0, uniscribe.m_shapes[0].m_abc.abcC);
-
-        // The sizes of the other stuff should match the shaping entry.
-        EXPECT_EQ(1, uniscribe.m_runs.size());
-        EXPECT_EQ(1, uniscribe.m_screenOrder.size());
-
-        // Check that the various querying functions handle the empty case
-        // properly.
-        EXPECT_EQ(0, uniscribe.width());
-        EXPECT_EQ(0, uniscribe.firstGlyphForCharacter(0));
-        EXPECT_EQ(0, uniscribe.firstGlyphForCharacter(1000));
-        EXPECT_EQ(0, uniscribe.xToCharacter(0));
-        EXPECT_EQ(0, uniscribe.xToCharacter(1000));
-    }
-
-    // Now test the very large string and make sure it is handled properly by
-    // the length protection.
-    {
-        Vector<UChar> inputCharacters;
-        input.appendTo(inputCharacters);
-        UniscribeHelper uniscribe(
-            inputCharacters.data(), static_cast<int>(inputCharacters.size()),
-            false, hfont, scriptCache, &properties, 0);
-        uniscribe.initWithOptionalLengthProtection(true);
-
-        // There should be 0 runs and shapes.
-        EXPECT_EQ(0, uniscribe.m_runs.size());
-        EXPECT_EQ(0, uniscribe.m_shapes.size());
-        EXPECT_EQ(0, uniscribe.m_screenOrder.size());
-
-        EXPECT_EQ(0, uniscribe.width());
-        EXPECT_EQ(0, uniscribe.firstGlyphForCharacter(0));
-        EXPECT_EQ(0, uniscribe.firstGlyphForCharacter(1000));
-        EXPECT_EQ(0, uniscribe.xToCharacter(0));
-        EXPECT_EQ(0, uniscribe.xToCharacter(1000));
-    }
-}
diff --git a/Source/web/tests/ViewportTest.cpp b/Source/web/tests/ViewportTest.cpp
index 3532824..3ad4aee 100644
--- a/Source/web/tests/ViewportTest.cpp
+++ b/Source/web/tests/ViewportTest.cpp
@@ -38,8 +38,8 @@
 #include "WebSettings.h"
 #include "WebViewClient.h"
 #include "core/dom/ViewportDescription.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 #include "core/page/Page.h"
 #include "core/page/PageScaleConstraints.h"
 #include "core/frame/Settings.h"
@@ -55,7 +55,7 @@
 #include <vector>
 
 using namespace blink;
-using WebCore::Frame;
+using WebCore::LocalFrame;
 using WebCore::FrameView;
 using WebCore::IntPoint;
 using WebCore::IntRect;
diff --git a/Source/web/tests/WEBPImageDecoderTest.cpp b/Source/web/tests/WEBPImageDecoderTest.cpp
index 4f2d6ea..a49917b 100644
--- a/Source/web/tests/WEBPImageDecoderTest.cpp
+++ b/Source/web/tests/WEBPImageDecoderTest.cpp
@@ -584,3 +584,13 @@
     // Chunk size in RIFF header doesn't match the file size.
     testInvalidImage("/LayoutTests/fast/images/resources/truncated2.webp", true);
 }
+
+TEST(StaticWebPTests, notAnimated)
+{
+    OwnPtr<WEBPImageDecoder> decoder = createDecoder();
+    RefPtr<SharedBuffer> data = readFile("/LayoutTests/fast/images/resources/webp-color-profile-lossy.webp");
+    ASSERT_TRUE(data.get());
+    decoder->setData(data.get(), true);
+    EXPECT_EQ(1u, decoder->frameCount());
+    EXPECT_EQ(cAnimationNone, decoder->repetitionCount());
+}
diff --git a/Source/web/tests/WebFrameTest.cpp b/Source/web/tests/WebFrameTest.cpp
index c1b744a..d39bc92 100644
--- a/Source/web/tests/WebFrameTest.cpp
+++ b/Source/web/tests/WebFrameTest.cpp
@@ -34,6 +34,7 @@
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <v8.h>
 #include "FrameTestHelpers.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SkBitmap.h"
@@ -65,28 +66,28 @@
 #include "core/editing/SpellChecker.h"
 #include "core/editing/VisiblePosition.h"
 #include "core/events/MouseEvent.h"
+#include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
+#include "core/frame/Settings.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/page/EventHandler.h"
-#include "core/frame/Frame.h"
-#include "core/frame/FrameView.h"
-#include "core/frame/Settings.h"
 #include "core/rendering/HitTestResult.h"
-#include "core/rendering/RenderLayerCompositor.h"
 #include "core/rendering/RenderView.h"
 #include "core/rendering/TextAutosizer.h"
+#include "core/rendering/compositing/RenderLayerCompositor.h"
+#include "platform/UserGestureIndicator.h"
 #include "platform/geometry/FloatRect.h"
 #include "platform/network/ResourceError.h"
 #include "platform/scroll/ScrollbarTheme.h"
-#include "v8.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebFloatRect.h"
 #include "public/platform/WebThread.h"
 #include "public/platform/WebURL.h"
 #include "public/platform/WebURLResponse.h"
 #include "public/platform/WebUnitTestSupport.h"
-#include "wtf/dtoa/utils.h"
 #include "wtf/Forward.h"
+#include "wtf/dtoa/utils.h"
 #include <map>
 
 using namespace blink;
@@ -332,7 +333,7 @@
     EXPECT_EQ("http://www.test.com:0/" + fileName, content);
 }
 
-class CSSCallbackWebFrameClient : public WebFrameClient {
+class CSSCallbackWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     CSSCallbackWebFrameClient() : m_updateCount(0) { }
     virtual void didMatchCSS(WebFrame*, const WebVector<WebString>& newlyMatchingSelectors, const WebVector<WebString>& stoppedMatchingSelectors) OVERRIDE;
@@ -635,7 +636,7 @@
     FrameTestHelpers::WebViewHelper webViewHelper;
     webViewHelper.initializeAndLoad("about:blank");
 
-    RefPtr<WebCore::Frame> frame = webViewHelper.webViewImpl()->page()->mainFrame();
+    RefPtr<WebCore::LocalFrame> frame = webViewHelper.webViewImpl()->page()->mainFrame();
     WebCore::NonThrowableExceptionState exceptionState;
     frame->domWindow()->postMessage(WebCore::SerializedScriptValue::create("message"), 0, "*", frame->domWindow(), exceptionState);
     webViewHelper.reset();
@@ -859,6 +860,23 @@
     EXPECT_EQ(980, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->contentsSize().width());
 }
 
+TEST_F(WebFrameTest, ZeroHeightPositiveWidthNotIgnored)
+{
+    UseMockScrollbarSettings mockScrollbarSettings;
+
+    FixedLayoutTestWebViewClient client;
+    client.m_screenInfo.deviceScaleFactor = 1;
+    int viewportWidth = 1280;
+    int viewportHeight = 0;
+
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    webViewHelper.initialize(true, 0, &client, enableViewportSettings);
+    webViewHelper.webView()->resize(WebSize(viewportWidth, viewportHeight));
+
+    EXPECT_EQ(viewportWidth, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->layoutSize().width());
+    EXPECT_EQ(viewportHeight, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->layoutSize().height());
+}
+
 TEST_F(WebFrameTest, DeviceScaleFactorUsesDefaultWithoutViewportTag)
 {
     UseMockScrollbarSettings mockScrollbarSettings;
@@ -1393,6 +1411,17 @@
     document->setViewportDescription(description);
     webViewHelper.webView()->layout();
     EXPECT_EQ(600, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->layoutSize().width());
+
+    description = document->viewportDescription();
+    description.maxHeight = WebCore::Length(1000, WebCore::Fixed);
+    document->setViewportDescription(description);
+    webViewHelper.webView()->layout();
+    EXPECT_EQ(1000, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->layoutSize().height());
+
+    description.maxHeight = WebCore::Length(320, WebCore::Fixed);
+    document->setViewportDescription(description);
+    webViewHelper.webView()->layout();
+    EXPECT_EQ(800, webViewHelper.webViewImpl()->mainFrameImpl()->frameView()->layoutSize().height());
 }
 
 TEST_F(WebFrameTest, ZeroValuesQuirk)
@@ -1566,11 +1595,27 @@
     webViewHelper.webView()->layout();
 
     webViewHelper.webView()->setPageScaleFactor(3, WebPoint());
-    webViewHelper.webViewImpl()->page()->mainFrame()->loader().saveDocumentAndScrollState();
-    webViewHelper.webView()->setPageScaleFactor(1, WebPoint());
-    webViewHelper.webViewImpl()->page()->mainFrame()->loader().setLoadType(WebCore::FrameLoadTypeBackForward);
-    webViewHelper.webViewImpl()->page()->mainFrame()->loader().restoreScrollPositionAndViewState();
-    EXPECT_EQ(3, webViewHelper.webView()->pageScaleFactor());
+    EXPECT_EQ(3, webViewHelper.webViewImpl()->page()->mainFrame()->loader().currentItem()->pageScaleFactor());
+}
+
+TEST_F(WebFrameTest, initialScaleWrittenToHistoryItem)
+{
+    UseMockScrollbarSettings mockScrollbarSettings;
+    registerMockedHttpURLLoad("fixed_layout.html");
+
+    FixedLayoutTestWebViewClient client;
+    client.m_screenInfo.deviceScaleFactor = 1;
+    int viewportWidth = 640;
+    int viewportHeight = 480;
+
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    webViewHelper.initializeAndLoad(m_baseURL + "fixed_layout.html", true, 0, &client, enableViewportSettings);
+    webViewHelper.webView()->resize(WebSize(viewportWidth, viewportHeight));
+    webViewHelper.webView()->layout();
+
+    int defaultFixedLayoutWidth = 980;
+    float minimumPageScaleFactor = viewportWidth / (float) defaultFixedLayoutWidth;
+    EXPECT_EQ(minimumPageScaleFactor, webViewHelper.webViewImpl()->page()->mainFrame()->loader().currentItem()->pageScaleFactor());
 }
 
 TEST_F(WebFrameTest, pageScaleFactorShrinksViewport)
@@ -1595,11 +1640,11 @@
 
     webViewHelper.webView()->setPageScaleFactor(2, WebPoint());
 
-    WebCore::IntSize unscaledSize = view->unscaledVisibleContentSize(WebCore::ScrollableArea::IncludeScrollbars);
+    WebCore::IntSize unscaledSize = view->unscaledVisibleContentSize(WebCore::IncludeScrollbars);
     EXPECT_EQ(viewportWidth, unscaledSize.width());
     EXPECT_EQ(viewportHeight, unscaledSize.height());
 
-    WebCore::IntSize unscaledSizeMinusScrollbar = view->unscaledVisibleContentSize(WebCore::ScrollableArea::ExcludeScrollbars);
+    WebCore::IntSize unscaledSizeMinusScrollbar = view->unscaledVisibleContentSize(WebCore::ExcludeScrollbars);
     EXPECT_EQ(viewportWidthMinusScrollbar, unscaledSizeMinusScrollbar.width());
     EXPECT_EQ(viewportHeightMinusScrollbar, unscaledSizeMinusScrollbar.height());
 
@@ -2561,7 +2606,7 @@
     EXPECT_FALSE(needAnimation);
 }
 
-class TestReloadDoesntRedirectWebFrameClient : public WebFrameClient {
+class TestReloadDoesntRedirectWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     virtual WebNavigationPolicy decidePolicyForNavigation(
         WebFrame*, WebDataSource::ExtraData*, const WebURLRequest&, WebNavigationType,
@@ -2690,7 +2735,7 @@
     webViewHelper.initializeAndLoad(m_baseURL + "iframe_clear_focused_node_test.html", true);
 
     // Clear the focused node.
-    webViewHelper.webView()->clearFocusedNode();
+    webViewHelper.webView()->clearFocusedElement();
 
     // Now retrieve the FocusedNode and test it should be null.
     EXPECT_EQ(0, webViewHelper.webViewImpl()->focusedElement());
@@ -2894,7 +2939,7 @@
     WebRange range = frame->selectionRange();
     EXPECT_EQ(5, range.startOffset());
     EXPECT_EQ(9, range.endOffset());
-    EXPECT_TRUE(frame->document().focusedNode().isNull());
+    EXPECT_TRUE(frame->document().focusedElement().isNull());
 
     // Find in an <input> value.
     EXPECT_TRUE(frame->find(findIdentifier, WebString::fromUTF8("bar2"), options, false, 0));
@@ -2904,7 +2949,7 @@
     ASSERT_FALSE(range.isNull());
     EXPECT_EQ(5, range.startOffset());
     EXPECT_EQ(9, range.endOffset());
-    EXPECT_EQ(WebString::fromUTF8("INPUT"), frame->document().focusedNode().nodeName());
+    EXPECT_EQ(WebString::fromUTF8("INPUT"), frame->document().focusedElement().tagName());
 
     // Find in a <textarea> content.
     EXPECT_TRUE(frame->find(findIdentifier, WebString::fromUTF8("bar3"), options, false, 0));
@@ -2914,7 +2959,7 @@
     ASSERT_FALSE(range.isNull());
     EXPECT_EQ(5, range.startOffset());
     EXPECT_EQ(9, range.endOffset());
-    EXPECT_EQ(WebString::fromUTF8("TEXTAREA"), frame->document().focusedNode().nodeName());
+    EXPECT_EQ(WebString::fromUTF8("TEXTAREA"), frame->document().focusedElement().tagName());
 
     // Find in a contentEditable element.
     EXPECT_TRUE(frame->find(findIdentifier, WebString::fromUTF8("bar4"), options, false, 0));
@@ -2925,7 +2970,7 @@
     EXPECT_EQ(0, range.startOffset());
     EXPECT_EQ(4, range.endOffset());
     // "bar4" is surrounded by <span>, but the focusable node should be the parent <div>.
-    EXPECT_EQ(WebString::fromUTF8("DIV"), frame->document().focusedNode().nodeName());
+    EXPECT_EQ(WebString::fromUTF8("DIV"), frame->document().focusedElement().tagName());
 
     // Find in <select> content.
     EXPECT_FALSE(frame->find(findIdentifier, WebString::fromUTF8("bar5"), options, false, 0));
@@ -3017,7 +3062,7 @@
     EXPECT_TRUE(selectionHtml.isEmpty());
 }
 
-class TestExecuteScriptDuringDidCreateScriptContext : public WebFrameClient {
+class TestExecuteScriptDuringDidCreateScriptContext : public FrameTestHelpers::TestWebFrameClient {
 public:
     virtual void didCreateScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int extensionGroup, int worldId) OVERRIDE
     {
@@ -3234,7 +3279,7 @@
     WebString searchText = WebString::fromUTF8(kFindString);
     WebFrameImpl* mainFrame = toWebFrameImpl(webViewHelper.webView()->mainFrame());
     RefPtr<WebFrameImpl> secondFrame = toWebFrameImpl(mainFrame->traverseNext(false));
-    RefPtr<WebCore::Frame> holdSecondFrame = secondFrame->frame();
+    RefPtr<WebCore::LocalFrame> holdSecondFrame = secondFrame->frame();
 
     // Detach the frame before finding.
     EXPECT_TRUE(mainFrame->document().getElementById("frame").remove());
@@ -3275,7 +3320,7 @@
     WebString searchText = WebString::fromUTF8(kFindString);
     WebFrameImpl* mainFrame = toWebFrameImpl(webViewHelper.webView()->mainFrame());
     WebFrameImpl* secondFrame = toWebFrameImpl(mainFrame->traverseNext(false));
-    RefPtr<WebCore::Frame> holdSecondFrame = secondFrame->frame();
+    RefPtr<WebCore::LocalFrame> holdSecondFrame = secondFrame->frame();
 
     for (WebFrame* frame = mainFrame; frame; frame = frame->traverseNext(false))
         EXPECT_TRUE(frame->find(kFindIdentifier, searchText, options, false, 0));
@@ -3316,7 +3361,7 @@
     WebString searchText = WebString::fromUTF8(kFindString);
     WebFrameImpl* mainFrame = toWebFrameImpl(webViewHelper.webView()->mainFrame());
     WebFrameImpl* secondFrame = toWebFrameImpl(mainFrame->traverseNext(false));
-    RefPtr<WebCore::Frame> holdSecondFrame = secondFrame->frame();
+    RefPtr<WebCore::LocalFrame> holdSecondFrame = secondFrame->frame();
 
     for (WebFrame* frame = mainFrame; frame; frame = frame->traverseNext(false))
         EXPECT_TRUE(frame->find(kFindIdentifier, searchText, options, false, 0));
@@ -3905,7 +3950,7 @@
     EXPECT_FALSE(client.triggered());
 }
 
-class TestSubstituteDataWebFrameClient : public WebFrameClient {
+class TestSubstituteDataWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     TestSubstituteDataWebFrameClient()
         : m_commitCalled(false)
@@ -3955,7 +4000,6 @@
     WebHistoryItem errorHistoryItem;
     errorHistoryItem.initialize();
     errorHistoryItem.setURLString(WebString::fromUTF8(errorURL.c_str(), errorURL.length()));
-    errorHistoryItem.setOriginalURLString(WebString::fromUTF8(errorURL.c_str(), errorURL.length()));
     Platform::current()->unitTestSupport()->registerMockedErrorURL(URLTestHelpers::toKURL(errorURL), response, error);
     frame->loadHistoryItem(errorHistoryItem);
     Platform::current()->unitTestSupport()->serveAsynchronousMockedRequests();
@@ -3965,7 +4009,7 @@
     EXPECT_TRUE(webFrameClient.commitCalled());
 }
 
-class TestWillInsertBodyWebFrameClient : public WebFrameClient {
+class TestWillInsertBodyWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     TestWillInsertBodyWebFrameClient() : m_numBodies(0), m_didLoad(false)
     {
@@ -4069,7 +4113,7 @@
     RefPtr<Range> selectionRange = frame->frame()->selection().toNormalizedRange();
 
     EXPECT_EQ(1, spellcheck.numberOfTimesChecked());
-    EXPECT_EQ(1U, document->markers()->markersInRange(selectionRange.get(), DocumentMarker::Spelling).size());
+    EXPECT_EQ(1U, document->markers().markersInRange(selectionRange.get(), DocumentMarker::Spelling).size());
 
     frame->replaceMisspelledRange("welcome");
     EXPECT_EQ("_welcome_.", frame->contentAsText(std::numeric_limits<size_t>::max()).utf8());
@@ -4101,7 +4145,7 @@
     frame->selectRange(WebRange::fromDocumentRange(frame, allTextBeginOffset, allTextLength));
     RefPtr<Range> selectionRange = frame->frame()->selection().toNormalizedRange();
 
-    EXPECT_EQ(0U, document->markers()->markersInRange(selectionRange.get(), DocumentMarker::Spelling).size());
+    EXPECT_EQ(0U, document->markers().markersInRange(selectionRange.get(), DocumentMarker::Spelling).size());
 }
 
 TEST_F(WebFrameTest, MarkerHashIdentifiers) {
@@ -4251,13 +4295,13 @@
 
     element->focus();
     document->execCommand("InsertText", false, "welcome ");
-    document->markers()->addMarker(rangeOfContents(element->toNode()).get(), DocumentMarker::Spelling);
-    document->markers()->addMarker(rangeOfContents(element->toNode()).get(), DocumentMarker::Grammar);
-    document->markers()->addMarker(rangeOfContents(element->toNode()).get(), DocumentMarker::InvisibleSpellcheck);
-    EXPECT_EQ(3U, document->markers()->markers().size());
+    document->markers().addMarker(rangeOfContents(element->toNode()).get(), DocumentMarker::Spelling);
+    document->markers().addMarker(rangeOfContents(element->toNode()).get(), DocumentMarker::Grammar);
+    document->markers().addMarker(rangeOfContents(element->toNode()).get(), DocumentMarker::InvisibleSpellcheck);
+    EXPECT_EQ(3U, document->markers().markers().size());
 
     spellcheck.kickNoResults();
-    EXPECT_EQ(0U, document->markers()->markers().size());
+    EXPECT_EQ(0U, document->markers().markers().size());
 }
 
 TEST_F(WebFrameTest, SpellcheckResultsSavedInDocument)
@@ -4282,26 +4326,26 @@
     document->execCommand("InsertText", false, "wellcome ");
 
     spellcheck.kick();
-    ASSERT_EQ(1U, document->markers()->markers().size());
-    ASSERT_NE(static_cast<DocumentMarker*>(0), document->markers()->markers()[0]);
-    EXPECT_EQ(DocumentMarker::Spelling, document->markers()->markers()[0]->type());
+    ASSERT_EQ(1U, document->markers().markers().size());
+    ASSERT_NE(static_cast<DocumentMarker*>(0), document->markers().markers()[0]);
+    EXPECT_EQ(DocumentMarker::Spelling, document->markers().markers()[0]->type());
 
     document->execCommand("InsertText", false, "wellcome ");
 
     spellcheck.kickGrammar();
-    ASSERT_EQ(1U, document->markers()->markers().size());
-    ASSERT_NE(static_cast<DocumentMarker*>(0), document->markers()->markers()[0]);
-    EXPECT_EQ(DocumentMarker::Grammar, document->markers()->markers()[0]->type());
+    ASSERT_EQ(1U, document->markers().markers().size());
+    ASSERT_NE(static_cast<DocumentMarker*>(0), document->markers().markers()[0]);
+    EXPECT_EQ(DocumentMarker::Grammar, document->markers().markers()[0]->type());
 
     document->execCommand("InsertText", false, "wellcome ");
 
     spellcheck.kickInvisibleSpellcheck();
-    ASSERT_EQ(1U, document->markers()->markers().size());
-    ASSERT_NE(static_cast<DocumentMarker*>(0), document->markers()->markers()[0]);
-    EXPECT_EQ(DocumentMarker::InvisibleSpellcheck, document->markers()->markers()[0]->type());
+    ASSERT_EQ(1U, document->markers().markers().size());
+    ASSERT_NE(static_cast<DocumentMarker*>(0), document->markers().markers()[0]);
+    EXPECT_EQ(DocumentMarker::InvisibleSpellcheck, document->markers().markers()[0]->type());
 }
 
-class TestAccessInitialDocumentWebFrameClient : public WebFrameClient {
+class TestAccessInitialDocumentWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     TestAccessInitialDocumentWebFrameClient() : m_didAccessInitialDocument(false)
     {
@@ -4453,7 +4497,7 @@
     EXPECT_TRUE(webFrameClient.m_didAccessInitialDocument);
 }
 
-class TestMainFrameUserOrProgrammaticScrollFrameClient : public WebFrameClient {
+class TestMainFrameUserOrProgrammaticScrollFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     TestMainFrameUserOrProgrammaticScrollFrameClient() { reset(); }
     void reset()
@@ -4472,7 +4516,7 @@
         EXPECT_FALSE(m_didScrollMainFrame);
         WebCore::FrameView* view = toWebFrameImpl(frame)->frameView();
         // FrameView can be scrolled in FrameView::setFixedVisibleContentRect
-        // which is called from Frame::createView (before the frame is associated
+        // which is called from LocalFrame::createView (before the frame is associated
         // with the the view).
         if (view) {
             m_didScrollMainFrame = true;
@@ -4585,7 +4629,7 @@
     EXPECT_TRUE(webViewHelper.webView()->mainFrame()->document().firstPartyForCookies() == redirectURL);
 }
 
-class TestNavigationPolicyWebFrameClient : public WebFrameClient {
+class TestNavigationPolicyWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
 
     virtual void didNavigateWithinPage(WebFrame*, bool)
@@ -4606,12 +4650,66 @@
     destination.setFragmentIdentifier("test");
 
     RefPtr<WebCore::Event> event = WebCore::MouseEvent::create(WebCore::EventTypeNames::click, false, false,
-        document->domWindow(), 0, 0, 0, 0, 0, 0, 0, false, false, false, false, 1, 0, 0);
+        document->domWindow(), 0, 0, 0, 0, 0, 0, 0, false, false, false, false, 1, nullptr, nullptr);
     WebCore::FrameLoadRequest frameRequest(document, WebCore::ResourceRequest(destination));
     frameRequest.setTriggeringEvent(event);
     webViewHelper.webViewImpl()->page()->mainFrame()->loader().load(frameRequest);
 }
 
+class TestNewWindowWebViewClient : public WebViewClient {
+public:
+    virtual WebView* createView(WebFrame*, const WebURLRequest&, const WebWindowFeatures&,
+        const WebString&, WebNavigationPolicy, bool) OVERRIDE
+    {
+        EXPECT_TRUE(false);
+        return 0;
+    }
+};
+
+class TestNewWindowWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
+public:
+    TestNewWindowWebFrameClient()
+        : m_decidePolicyCallCount(0)
+    {
+    }
+
+    virtual WebNavigationPolicy decidePolicyForNavigation(WebFrame*, WebDataSource::ExtraData*, const WebURLRequest&,
+        WebNavigationType, WebNavigationPolicy policy, bool) OVERRIDE
+    {
+        m_decidePolicyCallCount++;
+        return policy;
+    }
+
+    int decidePolicyCallCount() const { return m_decidePolicyCallCount; }
+
+private:
+    int m_decidePolicyCallCount;
+};
+
+TEST_F(WebFrameTest, ModifiedClickNewWindow)
+{
+    registerMockedHttpURLLoad("ctrl_click.html");
+    registerMockedHttpURLLoad("hello_world.html");
+    TestNewWindowWebViewClient webViewClient;
+    TestNewWindowWebFrameClient webFrameClient;
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    webViewHelper.initializeAndLoad(m_baseURL + "ctrl_click.html", true, &webFrameClient, &webViewClient);
+
+    WebCore::Document* document = webViewHelper.webViewImpl()->page()->mainFrame()->document();
+    WebCore::KURL destination = toKURL(m_baseURL + "hello_world.html");
+
+    // ctrl+click event
+    RefPtr<WebCore::Event> event = WebCore::MouseEvent::create(WebCore::EventTypeNames::click, false, false,
+        document->domWindow(), 0, 0, 0, 0, 0, 0, 0, true, false, false, false, 0, nullptr, nullptr);
+    WebCore::FrameLoadRequest frameRequest(document, WebCore::ResourceRequest(destination));
+    frameRequest.setTriggeringEvent(event);
+    WebCore::UserGestureIndicator gesture(WebCore::DefinitelyProcessingUserGesture);
+    webViewHelper.webViewImpl()->page()->mainFrame()->loader().load(frameRequest);
+
+    // decidePolicyForNavigation should be called both for the original request and the ctrl+click.
+    EXPECT_EQ(2, webFrameClient.decidePolicyCallCount());
+}
+
 TEST_F(WebFrameTest, BackToReload)
 {
     registerMockedHttpURLLoad("fragment_middle_click.html");
@@ -4793,7 +4891,7 @@
     EXPECT_EQ(item.urlString().utf8(), m_baseURL + "iframe_reload.html");
 }
 
-class TestSameDocumentWebFrameClient : public WebFrameClient {
+class TestSameDocumentWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     TestSameDocumentWebFrameClient()
         : m_frameLoadTypeSameSeen(false)
@@ -5067,12 +5165,17 @@
 public:
     FailCreateChildFrame() : m_callCount(0) { }
 
-    WebFrame* createChildFrame(WebFrame* parent, const WebString& frameName)
+    virtual WebFrame* createChildFrame(WebFrame* parent, const WebString& frameName) OVERRIDE
     {
         ++m_callCount;
         return 0;
     }
 
+    virtual void frameDetached(WebFrame* frame) OVERRIDE
+    {
+        frame->close();
+    }
+
     int callCount() const { return m_callCount; }
 
 private:
@@ -5128,4 +5231,16 @@
     EXPECT_EQ(200, leftRightFixed->offsetWidth());
 }
 
+TEST_F(WebFrameTest, FrameViewSetFrameRect)
+{
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    webViewHelper.initializeAndLoad("about:blank");
+
+    WebCore::FrameView* frameView = webViewHelper.webViewImpl()->mainFrameImpl()->frameView();
+    frameView->setFrameRect(WebCore::IntRect(0, 0, 200, 200));
+    EXPECT_EQ_RECT(WebCore::IntRect(0, 0, 200, 200), frameView->frameRect());
+    frameView->setFrameRect(WebCore::IntRect(100, 100, 200, 200));
+    EXPECT_EQ_RECT(WebCore::IntRect(100, 100, 200, 200), frameView->frameRect());
+}
+
 } // namespace
diff --git a/Source/web/tests/WebHelperPluginTest.cpp b/Source/web/tests/WebHelperPluginTest.cpp
new file mode 100644
index 0000000..3d0bc91
--- /dev/null
+++ b/Source/web/tests/WebHelperPluginTest.cpp
@@ -0,0 +1,94 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+#include "WebHelperPlugin.h"
+
+#include "FakeWebPlugin.h"
+#include "FrameTestHelpers.h"
+#include "WebFrameClient.h"
+#include <gtest/gtest.h>
+
+namespace blink {
+
+namespace {
+
+class FakePlaceholderWebPlugin : public FakeWebPlugin {
+public:
+    FakePlaceholderWebPlugin(blink::WebFrame* frame, const blink::WebPluginParams& params)
+        : FakeWebPlugin(frame, params)
+    {
+    }
+    virtual ~FakePlaceholderWebPlugin() { }
+
+    virtual bool isPlaceholder() OVERRIDE { return true; }
+};
+
+class WebHelperPluginFrameClient : public FrameTestHelpers::TestWebFrameClient {
+public:
+    WebHelperPluginFrameClient() : m_createPlaceholder(false) { }
+    virtual ~WebHelperPluginFrameClient() { }
+
+    virtual WebPlugin* createPlugin(WebFrame* frame, const WebPluginParams& params) OVERRIDE
+    {
+        return m_createPlaceholder ? new FakePlaceholderWebPlugin(frame, params) : new FakeWebPlugin(frame, params);
+    }
+
+    void setCreatePlaceholder(bool createPlaceholder) { m_createPlaceholder = createPlaceholder; }
+
+private:
+    bool m_createPlaceholder;
+};
+
+class WebHelperPluginTest : public testing::Test {
+protected:
+    virtual void SetUp() OVERRIDE
+    {
+        m_helper.initializeAndLoad("about:blank", false, &m_frameClient);
+    }
+
+
+    void destroyHelperPlugin()
+    {
+        m_plugin.clear();
+        // WebHelperPlugin is destroyed by a task posted to the message loop.
+        FrameTestHelpers::runPendingTasks();
+    }
+
+    FrameTestHelpers::WebViewHelper m_helper;
+    WebHelperPluginFrameClient m_frameClient;
+    OwnPtr<WebHelperPlugin> m_plugin;
+};
+
+TEST_F(WebHelperPluginTest, CreateAndDestroyAfterWebViewDestruction)
+{
+    m_plugin = adoptPtr(WebHelperPlugin::create("hello", m_helper.webView()->mainFrame()));
+    EXPECT_TRUE(m_plugin);
+    EXPECT_TRUE(m_plugin->getPlugin());
+
+    m_helper.reset();
+    destroyHelperPlugin();
+}
+
+TEST_F(WebHelperPluginTest, CreateAndDestroyBeforeWebViewDestruction)
+{
+    m_plugin = adoptPtr(WebHelperPlugin::create("hello", m_helper.webView()->mainFrame()));
+    EXPECT_TRUE(m_plugin);
+    EXPECT_TRUE(m_plugin->getPlugin());
+
+    destroyHelperPlugin();
+    m_helper.reset();
+}
+
+TEST_F(WebHelperPluginTest, CreateFailsWithPlaceholder)
+{
+    m_frameClient.setCreatePlaceholder(true);
+
+    m_plugin = adoptPtr(WebHelperPlugin::create("hello", m_helper.webView()->mainFrame()));
+    EXPECT_EQ(0, m_plugin.get());
+}
+
+} // namespace
+
+} // namespace
diff --git a/Source/web/tests/WebInputEventConversionTest.cpp b/Source/web/tests/WebInputEventConversionTest.cpp
index c3e9959..d293855 100644
--- a/Source/web/tests/WebInputEventConversionTest.cpp
+++ b/Source/web/tests/WebInputEventConversionTest.cpp
@@ -44,8 +44,8 @@
 #include "core/dom/Touch.h"
 #include "core/events/TouchEvent.h"
 #include "core/dom/TouchList.h"
-#include "core/frame/Frame.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
 
 using namespace blink;
 using namespace WebCore;
@@ -222,12 +222,19 @@
         webTouchEvent.type = WebInputEvent::TouchMove;
         webTouchEvent.touchesLength = 1;
         webTouchEvent.touches[0].state = WebTouchPoint::StateMoved;
-        webTouchEvent.touches[0].screenPosition.x = 10;
-        webTouchEvent.touches[0].screenPosition.y = 10;
-        webTouchEvent.touches[0].position.x = 10;
-        webTouchEvent.touches[0].position.y = 10;
-        webTouchEvent.touches[0].radiusX = 10;
-        webTouchEvent.touches[0].radiusY = 10;
+        webTouchEvent.touches[0].screenPosition.x = 10.6f;
+        webTouchEvent.touches[0].screenPosition.y = 10.4f;
+        webTouchEvent.touches[0].position.x = 10.6f;
+        webTouchEvent.touches[0].position.y = 10.4f;
+        webTouchEvent.touches[0].radiusX = 10.6f;
+        webTouchEvent.touches[0].radiusY = 10.4f;
+
+        EXPECT_FLOAT_EQ(10.6f, webTouchEvent.touches[0].screenPosition.x);
+        EXPECT_FLOAT_EQ(10.4f, webTouchEvent.touches[0].screenPosition.y);
+        EXPECT_FLOAT_EQ(10.6f, webTouchEvent.touches[0].position.x);
+        EXPECT_FLOAT_EQ(10.4f, webTouchEvent.touches[0].position.y);
+        EXPECT_FLOAT_EQ(10.6f, webTouchEvent.touches[0].radiusX);
+        EXPECT_FLOAT_EQ(10.4f, webTouchEvent.touches[0].radiusY);
 
         PlatformTouchEventBuilder platformTouchBuilder(view, webTouchEvent);
         EXPECT_EQ(10, platformTouchBuilder.touchPoints()[0].screenPos().x());
@@ -274,8 +281,8 @@
     }
 
     {
-        RefPtr<Touch> touch = Touch::create(webViewImpl->page()->mainFrame(), document.get(), 0, 10, 10, 10, 10, 10, 10, 0, 0);
-        RefPtr<TouchList> touchList = TouchList::create();
+        RefPtrWillBeRawPtr<Touch> touch = Touch::create(webViewImpl->page()->mainFrame(), document.get(), 0, 10, 10, 10, 10, 10, 10, 0, 0);
+        RefPtrWillBeRawPtr<TouchList> touchList = TouchList::create();
         touchList->append(touch);
         RefPtr<TouchEvent> touchEvent = TouchEvent::create(touchList.get(), touchList.get(), touchList.get(), WebCore::EventTypeNames::touchmove, domWindow, 10, 10, 10, 10, false, false, false, false);
 
diff --git a/Source/web/tests/WebPluginContainerTest.cpp b/Source/web/tests/WebPluginContainerTest.cpp
index 973d45d..77634a2 100644
--- a/Source/web/tests/WebPluginContainerTest.cpp
+++ b/Source/web/tests/WebPluginContainerTest.cpp
@@ -84,7 +84,7 @@
     virtual WebString selectionAsMarkup() const { return WebString("y"); }
 };
 
-class TestPluginWebFrameClient : public WebFrameClient {
+class TestPluginWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
     virtual WebPlugin* createPlugin(WebFrame* frame, const WebPluginParams& params) OVERRIDE
     {
         if (params.mimeType == WebString::fromUTF8("application/x-webkit-test-webplugin"))
diff --git a/Source/web/tests/WebUserGestureTokenTest.cpp b/Source/web/tests/WebUserGestureTokenTest.cpp
index 67790e0..0c39c39 100644
--- a/Source/web/tests/WebUserGestureTokenTest.cpp
+++ b/Source/web/tests/WebUserGestureTokenTest.cpp
@@ -42,19 +42,6 @@
 
 namespace {
 
-class GestureHandlerTest : public WebUserGestureHandler {
-public:
-    GestureHandlerTest()
-        : m_reached(false) { }
-
-    void onGesture()
-    {
-        m_reached = true;
-    }
-
-    bool m_reached;
-};
-
 TEST(WebUserGestureTokenTest, Basic)
 {
     WebUserGestureToken token;
@@ -87,14 +74,6 @@
         WebScopedUserGesture indicator(token);
         EXPECT_FALSE(WebUserGestureIndicator::isProcessingUserGesture());
     }
-
-    {
-        GestureHandlerTest handler;
-        WebUserGestureIndicator::setHandler(&handler);
-        UserGestureIndicator indicator(DefinitelyProcessingNewUserGesture);
-        EXPECT_TRUE(handler.m_reached);
-        WebUserGestureIndicator::setHandler(0);
-    }
 }
 
 }
diff --git a/Source/web/tests/WebViewTest.cpp b/Source/web/tests/WebViewTest.cpp
index 1a29fca..1789b3c 100644
--- a/Source/web/tests/WebViewTest.cpp
+++ b/Source/web/tests/WebViewTest.cpp
@@ -42,10 +42,10 @@
 #include "WebFrame.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebHelperPlugin.h"
 #include "WebHitTestResult.h"
 #include "WebInputEvent.h"
 #include "WebSettings.h"
+#include "WebSettingsImpl.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
 #include "WebWidget.h"
@@ -59,12 +59,13 @@
 #include "core/page/Chrome.h"
 #include "core/frame/Settings.h"
 #include "platform/KeyboardCodes.h"
-#include "platform/Timer.h"
 #include "platform/graphics/Color.h"
 #include "public/platform/Platform.h"
+#include "public/platform/WebDragData.h"
 #include "public/platform/WebSize.h"
 #include "public/platform/WebThread.h"
 #include "public/platform/WebUnitTestSupport.h"
+#include "public/web/WebDragOperation.h"
 #include "public/web/WebWidgetClient.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkBitmapDevice.h"
@@ -152,52 +153,25 @@
     int m_longpressY;
 };
 
-class HelperPluginCreatingWebViewClient : public WebViewClient {
+class FakeCompositingWebViewClient : public WebViewClient {
 public:
-    // WebViewClient methods
-    virtual blink::WebWidget* createPopupMenu(blink::WebPopupType popupType) OVERRIDE
-    {
-        EXPECT_EQ(WebPopupTypeHelperPlugin, popupType);
-        // The caller owns the object, but we retain a pointer for use in closeWidgetNow().
-        m_helperPluginWebWidget = blink::WebHelperPlugin::create(this);
-        return m_helperPluginWebWidget;
-    }
-
-    virtual void initializeHelperPluginWebFrame(blink::WebHelperPlugin* plugin) OVERRIDE
-    {
-        ASSERT_TRUE(m_webFrameClient);
-        plugin->initializeFrame(m_webFrameClient);
-    }
-
-    // WebWidgetClient methods
-    virtual void closeWidgetSoon() OVERRIDE
-    {
-        ASSERT_TRUE(m_helperPluginWebWidget);
-        // m_helperPluginWebWidget->close() must be called asynchronously.
-        if (!m_closeTimer.isActive())
-            m_closeTimer.startOneShot(0);
-    }
-
-    void closeWidgetNow(WebCore::Timer<HelperPluginCreatingWebViewClient>* timer)
-    {
-        m_helperPluginWebWidget->close();
-        m_helperPluginWebWidget = 0;
-    }
-
-    // Local methods
-    HelperPluginCreatingWebViewClient()
-        : m_helperPluginWebWidget(0)
-        , m_webFrameClient(0)
-        , m_closeTimer(this, &HelperPluginCreatingWebViewClient::closeWidgetNow)
+    virtual ~FakeCompositingWebViewClient()
     {
     }
 
-    void setWebFrameClient(WebFrameClient* client) { m_webFrameClient = client; }
+    virtual void initializeLayerTreeView() OVERRIDE
+    {
+        m_layerTreeView = adoptPtr(Platform::current()->unitTestSupport()->createLayerTreeViewForTesting(WebUnitTestSupport::TestViewTypeUnitTest));
+        ASSERT(m_layerTreeView);
+    }
+
+    virtual WebLayerTreeView* layerTreeView() OVERRIDE
+    {
+        return m_layerTreeView.get();
+    }
 
 private:
-    WebWidget* m_helperPluginWebWidget;
-    WebFrameClient* m_webFrameClient;
-    WebCore::Timer<HelperPluginCreatingWebViewClient> m_closeTimer;
+    OwnPtr<WebLayerTreeView> m_layerTreeView;
 };
 
 class DateTimeChooserWebViewClient : public WebViewClient {
@@ -237,6 +211,11 @@
     }
 
 protected:
+    void registerMockedHttpURLLoad(const std::string& fileName)
+    {
+        URLTestHelpers::registerMockedURLFromBaseURL(WebString::fromUTF8(m_baseURL.c_str()), WebString::fromUTF8(fileName.c_str()));
+    }
+
     void testAutoResize(const WebSize& minAutoResize, const WebSize& maxAutoResize,
                         const std::string& pageWidth, const std::string& pageHeight,
                         int expectedWidth, int expectedHeight,
@@ -244,6 +223,7 @@
 
     void testTextInputType(WebTextInputType expectedType, const std::string& htmlFile);
     void testInputMode(const WebString& expectedInputMode, const std::string& htmlFile);
+    void testSelectionRootBounds(const char* htmlFile, float pageScaleFactor);
 
     std::string m_baseURL;
     FrameTestHelpers::WebViewHelper m_webViewHelper;
@@ -801,23 +781,10 @@
     EXPECT_EQ(2.0f, webViewImpl->pageScaleFactor());
     EXPECT_EQ(116, webViewImpl->mainFrame()->scrollOffset().width);
     EXPECT_EQ(84, webViewImpl->mainFrame()->scrollOffset().height);
-    webViewImpl->page()->mainFrame()->loader().saveDocumentAndScrollState();
-
-    // Confirm that restoring the page state restores the parameters.
-    webViewImpl->setPageScaleFactor(1.5f, WebPoint(16, 24));
-    EXPECT_EQ(1.5f, webViewImpl->pageScaleFactor());
-    EXPECT_EQ(16, webViewImpl->mainFrame()->scrollOffset().width);
-    EXPECT_EQ(24, webViewImpl->mainFrame()->scrollOffset().height);
-    // WebViewImpl::setPageScaleFactor is performing user scrolls, which will set the
-    // wasScrolledByUser flag on the main frame, and prevent restoreScrollPositionAndViewState
-    // from restoring the scrolling position.
-    webViewImpl->page()->mainFrame()->view()->setWasScrolledByUser(false);
-    webViewImpl->page()->mainFrame()->loader().setLoadType(WebCore::FrameLoadTypeBackForward);
-    webViewImpl->page()->mainFrame()->loader().restoreScrollPositionAndViewState();
-    EXPECT_EQ(2.0f, webViewImpl->pageScaleFactor());
-    EXPECT_EQ(116, webViewImpl->mainFrame()->scrollOffset().width);
-    EXPECT_EQ(84, webViewImpl->mainFrame()->scrollOffset().height);
-    webViewImpl->page()->mainFrame()->loader().saveDocumentAndScrollState();
+    webViewImpl->page()->mainFrame()->loader().saveScrollState();
+    EXPECT_EQ(2.0f, webViewImpl->page()->mainFrame()->loader().currentItem()->pageScaleFactor());
+    EXPECT_EQ(116, webViewImpl->page()->mainFrame()->loader().currentItem()->scrollPoint().x());
+    EXPECT_EQ(84, webViewImpl->page()->mainFrame()->loader().currentItem()->scrollPoint().y());
 
     // Confirm that resetting the page state resets the saved scroll position.
     // The HistoryController treats a page scale factor of 0.0f as special and avoids
@@ -826,10 +793,9 @@
     EXPECT_EQ(1.0f, webViewImpl->pageScaleFactor());
     EXPECT_EQ(0, webViewImpl->mainFrame()->scrollOffset().width);
     EXPECT_EQ(0, webViewImpl->mainFrame()->scrollOffset().height);
-    webViewImpl->page()->mainFrame()->loader().restoreScrollPositionAndViewState();
-    EXPECT_EQ(1.0f, webViewImpl->pageScaleFactor());
-    EXPECT_EQ(0, webViewImpl->mainFrame()->scrollOffset().width);
-    EXPECT_EQ(0, webViewImpl->mainFrame()->scrollOffset().height);
+    EXPECT_EQ(0.0f, webViewImpl->page()->mainFrame()->loader().currentItem()->pageScaleFactor());
+    EXPECT_EQ(0, webViewImpl->page()->mainFrame()->loader().currentItem()->scrollPoint().x());
+    EXPECT_EQ(0, webViewImpl->page()->mainFrame()->loader().currentItem()->scrollPoint().y());
 }
 
 class EnterFullscreenWebViewClient : public WebViewClient {
@@ -880,6 +846,53 @@
     m_webViewHelper.reset(); // Explicitly reset to break dependency on locally scoped client.
 }
 
+static void DragAndDropURL(WebViewImpl* webView, const std::string& url)
+{
+    blink::WebDragData dragData;
+    dragData.initialize();
+
+    WebDragData::Item item;
+    item.storageType = WebDragData::Item::StorageTypeString;
+    item.stringType = "text/uri-list";
+    item.stringData = WebString::fromUTF8(url);
+    dragData.addItem(item);
+
+    const WebPoint clientPoint(0, 0);
+    const WebPoint screenPoint(0, 0);
+    webView->dragTargetDragEnter(dragData, clientPoint, screenPoint, blink::WebDragOperationCopy, 0);
+    webView->dragTargetDrop(clientPoint, screenPoint, 0);
+    FrameTestHelpers::runPendingTasks();
+    Platform::current()->unitTestSupport()->serveAsynchronousMockedRequests();
+}
+
+TEST_F(WebViewTest, DragDropURL)
+{
+    URLTestHelpers::registerMockedURLFromBaseURL(WebString::fromUTF8(m_baseURL.c_str()), "foo.html");
+    URLTestHelpers::registerMockedURLFromBaseURL(WebString::fromUTF8(m_baseURL.c_str()), "bar.html");
+
+    const std::string fooUrl = m_baseURL + "foo.html";
+    const std::string barUrl = m_baseURL + "bar.html";
+
+    WebViewImpl* webView = m_webViewHelper.initializeAndLoad(fooUrl);
+
+    ASSERT_TRUE(webView);
+
+    // Drag and drop barUrl and verify that we've navigated to it.
+    DragAndDropURL(webView, barUrl);
+    EXPECT_EQ(barUrl, webView->mainFrame()->document().url().string().utf8());
+
+    // Drag and drop fooUrl and verify that we've navigated back to it.
+    DragAndDropURL(webView, fooUrl);
+    EXPECT_EQ(fooUrl, webView->mainFrame()->document().url().string().utf8());
+
+    // Disable navigation on drag-and-drop.
+    webView->settingsImpl()->setNavigateOnDragDrop(false);
+
+    // Attempt to drag and drop to barUrl and verify that no navigation has occurred.
+    DragAndDropURL(webView, barUrl);
+    EXPECT_EQ(fooUrl, webView->mainFrame()->document().url().string().utf8());
+}
+
 class ContentDetectorClient : public WebViewClient {
 public:
     ContentDetectorClient() { reset(); }
@@ -1077,6 +1090,41 @@
     EXPECT_EQ(length, testWord.length());
 }
 
+static void configueCompositingWebView(WebSettings* settings)
+{
+    settings->setForceCompositingMode(true);
+    settings->setAcceleratedCompositingEnabled(true);
+    settings->setAcceleratedCompositingForFixedPositionEnabled(true);
+    settings->setAcceleratedCompositingForOverflowScrollEnabled(true);
+    settings->setAcceleratedCompositingForScrollableFramesEnabled(true);
+    settings->setCompositedScrollingForFramesEnabled(true);
+    settings->setFixedPositionCreatesStackingContext(true);
+}
+
+TEST_F(WebViewTest, ShowPressOnTransformedLink)
+{
+    OwnPtr<FakeCompositingWebViewClient> fakeCompositingWebViewClient = adoptPtr(new FakeCompositingWebViewClient());
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    WebViewImpl* webViewImpl = webViewHelper.initialize(true, 0, fakeCompositingWebViewClient.get(), &configueCompositingWebView);
+
+    int pageWidth = 640;
+    int pageHeight = 480;
+    webViewImpl->resize(WebSize(pageWidth, pageHeight));
+
+    WebURL baseURL = URLTestHelpers::toKURL("http://example.com/");
+    webViewImpl->mainFrame()->loadHTMLString(
+        "<a href='http://www.test.com' style='position: absolute; left: 20px; top: 20px; width: 200px; -webkit-transform:translateZ(0);'>A link to highlight</a>", baseURL);
+    Platform::current()->unitTestSupport()->serveAsynchronousMockedRequests();
+
+    WebGestureEvent event;
+    event.type = WebInputEvent::GestureShowPress;
+    event.x = 20;
+    event.y = 20;
+
+    // Just make sure we don't hit any asserts.
+    webViewImpl->handleInputEvent(event);
+}
+
 class MockAutofillClient : public WebAutofillClient {
 public:
     MockAutofillClient()
@@ -1087,6 +1135,8 @@
     virtual ~MockAutofillClient() { }
 
     virtual void setIgnoreTextChanges(bool ignore) OVERRIDE { m_ignoreTextChanges = ignore; }
+    // FIXME: This function is to be removed once both chromium and blink changes
+    // for BUG332557 are in.
     virtual void textFieldDidChange(const WebInputElement&) OVERRIDE
     {
         if (m_ignoreTextChanges)
@@ -1094,6 +1144,13 @@
         else
             ++m_textChangesWhileNotIgnored;
     }
+    virtual void textFieldDidChange(const WebFormControlElement&) OVERRIDE
+    {
+        if (m_ignoreTextChanges)
+            ++m_textChangesWhileIgnored;
+        else
+            ++m_textChangesWhileNotIgnored;
+    }
 
     void clearChangeCounts()
     {
@@ -1214,25 +1271,6 @@
     }
 }
 
-TEST_F(WebViewTest, HelperPlugin)
-{
-    HelperPluginCreatingWebViewClient client;
-    WebViewImpl* webViewImpl = m_webViewHelper.initialize(true, 0, &client);
-
-    WebFrameImpl* frame = toWebFrameImpl(webViewImpl->mainFrame());
-    client.setWebFrameClient(frame->client());
-
-    OwnPtr<WebHelperPlugin> helperPlugin = adoptPtr(webViewImpl->createHelperPlugin("dummy-plugin-type", frame->document()));
-    EXPECT_TRUE(helperPlugin);
-    EXPECT_EQ(0, helperPlugin->getPlugin()); // Invalid plugin type means no plugin.
-
-    helperPlugin.clear();
-    runPendingTasks();
-
-    m_webViewHelper.reset(); // Explicitly reset to break dependency on locally scoped client.
-}
-
-
 class ViewCreatingWebViewClient : public WebViewClient {
 public:
     ViewCreatingWebViewClient()
@@ -1621,4 +1659,92 @@
     EXPECT_EQ(0, client.getAndResetHasTouchEventHandlerCallCount(true));
 }
 
+static WebRect ExpectedRootBounds(WebCore::Document* document, float scaleFactor)
+{
+    WebCore::Element* element = document->getElementById("root");
+    if (!element)
+        element = document->getElementById("target");
+    if (element->hasTagName(WebCore::HTMLNames::iframeTag))
+        return ExpectedRootBounds(toHTMLIFrameElement(element)->contentDocument(), scaleFactor);
+
+    WebCore::IntRect boundingBox = element->pixelSnappedBoundingBox();
+    boundingBox = document->frame()->view()->contentsToWindow(boundingBox);
+    boundingBox.scale(scaleFactor);
+    return boundingBox;
+}
+
+void WebViewTest::testSelectionRootBounds(const char* htmlFile, float pageScaleFactor)
+{
+    std::string url = m_baseURL + htmlFile;
+
+    WebView* webView = m_webViewHelper.initializeAndLoad(url, true);
+    webView->resize(WebSize(640, 480));
+    webView->setPageScaleFactor(pageScaleFactor, WebPoint(0, 0));
+    webView->layout();
+    runPendingTasks();
+
+    WebFrameImpl* frame = toWebFrameImpl(webView->mainFrame());
+    EXPECT_TRUE(frame->frame()->document()->isHTMLDocument());
+    WebCore::HTMLDocument* document = WebCore::toHTMLDocument(frame->frame()->document());
+
+    WebRect expectedRootBounds = ExpectedRootBounds(document, webView->pageScaleFactor());
+    WebRect actualRootBounds;
+    webView->getSelectionRootBounds(actualRootBounds);
+    ASSERT_EQ(expectedRootBounds, actualRootBounds);
+
+    WebRect anchor, focus;
+    webView->selectionBounds(anchor, focus);
+    WebCore::IntRect expectedIntRect = expectedRootBounds;
+    ASSERT_TRUE(expectedIntRect.contains(anchor));
+    // The "overflow" tests have the focus boundary outside of the element box.
+    ASSERT_EQ(url.find("overflow") == std::string::npos, expectedIntRect.contains(focus));
+}
+
+TEST_F(WebViewTest, GetSelectionRootBounds)
+{
+    // Register all the pages we will be using.
+    registerMockedHttpURLLoad("select_range_basic.html");
+    registerMockedHttpURLLoad("select_range_div_editable.html");
+    registerMockedHttpURLLoad("select_range_scroll.html");
+    registerMockedHttpURLLoad("select_range_span_editable.html");
+    registerMockedHttpURLLoad("select_range_input.html");
+    registerMockedHttpURLLoad("select_range_input_overflow.html");
+    registerMockedHttpURLLoad("select_range_textarea.html");
+    registerMockedHttpURLLoad("select_range_textarea_overflow.html");
+    registerMockedHttpURLLoad("select_range_iframe.html");
+    registerMockedHttpURLLoad("select_range_iframe_div_editable.html");
+    registerMockedHttpURLLoad("select_range_iframe_scroll.html");
+    registerMockedHttpURLLoad("select_range_iframe_span_editable.html");
+    registerMockedHttpURLLoad("select_range_iframe_input.html");
+    registerMockedHttpURLLoad("select_range_iframe_input_overflow.html");
+    registerMockedHttpURLLoad("select_range_iframe_textarea.html");
+    registerMockedHttpURLLoad("select_range_iframe_textarea_overflow.html");
+
+    // Test with simple pages.
+    testSelectionRootBounds("select_range_basic.html", 1.0f);
+    testSelectionRootBounds("select_range_div_editable.html", 1.0f);
+    testSelectionRootBounds("select_range_scroll.html", 1.0f);
+    testSelectionRootBounds("select_range_span_editable.html", 1.0f);
+    testSelectionRootBounds("select_range_input.html", 1.0f);
+    testSelectionRootBounds("select_range_input_overflow.html", 1.0f);
+    testSelectionRootBounds("select_range_textarea.html", 1.0f);
+    testSelectionRootBounds("select_range_textarea_overflow.html", 1.0f);
+
+    // Test with the same pages as above in iframes.
+    testSelectionRootBounds("select_range_iframe.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_div_editable.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_scroll.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_span_editable.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_input.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_input_overflow.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_textarea.html", 1.0f);
+    testSelectionRootBounds("select_range_iframe_textarea_overflow.html", 1.0f);
+
+    // Basic page with scale factor.
+    testSelectionRootBounds("select_range_basic.html", 0.0f);
+    testSelectionRootBounds("select_range_basic.html", 0.1f);
+    testSelectionRootBounds("select_range_basic.html", 1.5f);
+    testSelectionRootBounds("select_range_basic.html", 2.0f);
+}
+
 } // namespace
diff --git a/Source/web/tests/data/bar.html b/Source/web/tests/data/bar.html
new file mode 100644
index 0000000..e980633
--- /dev/null
+++ b/Source/web/tests/data/bar.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+bar
+</body>
+</html>
diff --git a/Source/web/tests/data/ctrl_click.html b/Source/web/tests/data/ctrl_click.html
new file mode 100644
index 0000000..e1cae6b
--- /dev/null
+++ b/Source/web/tests/data/ctrl_click.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<a href="hello_world.html">Click</a>
+</body>
+</html>
diff --git a/Source/web/tests/data/foo.html b/Source/web/tests/data/foo.html
new file mode 100644
index 0000000..3ea88a4
--- /dev/null
+++ b/Source/web/tests/data/foo.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+foo
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_basic.html b/Source/web/tests/data/select_range_basic.html
index 8ffc3fc..a12fa02 100644
--- a/Source/web/tests/data/select_range_basic.html
+++ b/Source/web/tests/data/select_range_basic.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html id='root'>
 <body>
 Some extra text.
 <span id='target'>Some test text for testing.</span>
diff --git a/Source/web/tests/data/select_range_iframe.html b/Source/web/tests/data/select_range_iframe.html
index f78089a..7a185c3 100644
--- a/Source/web/tests/data/select_range_iframe.html
+++ b/Source/web/tests/data/select_range_iframe.html
@@ -2,9 +2,9 @@
 <html>
 <body>
 This is a test case for selecting a range within an iframe.
-<iframe width=400 height=200 id="iframe" src="select_range_basic.html"></iframe>
+<iframe id='target' width='400' height='200' src='select_range_basic.html'></iframe>
 <script>
-    document.getElementById('iframe').contentWindow.focus();
+    document.getElementById('target').contentWindow.focus();
 </script>
 </body>
 </html>
diff --git a/Source/web/tests/data/select_range_iframe_div_editable.html b/Source/web/tests/data/select_range_iframe_div_editable.html
new file mode 100644
index 0000000..a691c04
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_div_editable.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_div_editable.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_iframe_input.html b/Source/web/tests/data/select_range_iframe_input.html
new file mode 100644
index 0000000..5538a13
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_input.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_input.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_iframe_input_overflow.html b/Source/web/tests/data/select_range_iframe_input_overflow.html
new file mode 100644
index 0000000..fc4621b
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_input_overflow.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_input_overflow.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_iframe_scroll.html b/Source/web/tests/data/select_range_iframe_scroll.html
new file mode 100644
index 0000000..fcd1ee2
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_scroll.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_scroll.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_iframe_span_editable.html b/Source/web/tests/data/select_range_iframe_span_editable.html
new file mode 100644
index 0000000..1924c76
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_span_editable.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_span_editable.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_iframe_textarea.html b/Source/web/tests/data/select_range_iframe_textarea.html
new file mode 100644
index 0000000..6539756
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_textarea.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_textarea.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_iframe_textarea_overflow.html b/Source/web/tests/data/select_range_iframe_textarea_overflow.html
new file mode 100644
index 0000000..1a15aae
--- /dev/null
+++ b/Source/web/tests/data/select_range_iframe_textarea_overflow.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+This is a test case for selecting a range within an iframe.
+<iframe id='target' width='400' height='200' src='select_range_textarea_overflow.html'></iframe>
+<script>
+    document.getElementById('target').contentWindow.focus();
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_input.html b/Source/web/tests/data/select_range_input.html
new file mode 100644
index 0000000..41c107d
--- /dev/null
+++ b/Source/web/tests/data/select_range_input.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input id='target' value="simple text">
+<script>
+    var input = document.getElementById('target');
+    input.focus();
+    input.setSelectionRange(0, input.value.length);
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_input_overflow.html b/Source/web/tests/data/select_range_input_overflow.html
new file mode 100644
index 0000000..9ee4cfc
--- /dev/null
+++ b/Source/web/tests/data/select_range_input_overflow.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input id='target' value="simple text" size='3'>
+<script>
+    var input = document.getElementById('target');
+    input.focus();
+    input.setSelectionRange(0, input.value.length);
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_scroll.html b/Source/web/tests/data/select_range_scroll.html
index a67f189..efa98a9 100644
--- a/Source/web/tests/data/select_range_scroll.html
+++ b/Source/web/tests/data/select_range_scroll.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html id='root'>
 <body>
 <div style='height:3000px'>
     <span id="target">Some offscreen test text for testing.</span>
diff --git a/Source/web/tests/data/select_range_textarea.html b/Source/web/tests/data/select_range_textarea.html
new file mode 100644
index 0000000..4cd9adc
--- /dev/null
+++ b/Source/web/tests/data/select_range_textarea.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+<textarea id='target'>simple text</textarea>
+<script>
+    var textarea = document.getElementById('target');
+    textarea.focus();
+    textarea.setSelectionRange(0, textarea.value.length);
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/select_range_textarea_overflow.html b/Source/web/tests/data/select_range_textarea_overflow.html
new file mode 100644
index 0000000..c0da18b
--- /dev/null
+++ b/Source/web/tests/data/select_range_textarea_overflow.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<textarea id='target' rows='2' cols='3'>
+  simple text that should be a bit longer than that
+</textarea>
+<script>
+    var textarea = document.getElementById('target');
+    textarea.focus();
+    textarea.setSelectionRange(0, textarea.value.length);
+</script>
+</body>
+</html>
diff --git a/Source/web/tests/data/touch-action-pan.html b/Source/web/tests/data/touch-action-pan.html
index b99b97f..46e0d34 100644
--- a/Source/web/tests/data/touch-action-pan.html
+++ b/Source/web/tests/data/touch-action-pan.html
@@ -9,6 +9,7 @@
 <div class='ta-panx' expected-action='pan-x'>Simple div with touch-action: pan-x</div>
 <div class='ta-pany' expected-action='pan-y'>Simple div with touch-action: pan-y</div>
 <div class='ta-panxy' expected-action='pan-x-y'>Simple div with touch-action: pan-x pan-y</div>
+<div class='ta-manipulation' expected-action='manipulation'>Simple div with touch-action: manipulation</div>
 
 <div class='ta-none' style='height: 0; margin-bottom: 50px'>
   <div class='ta-panx' expected-action='none'>
@@ -52,4 +53,16 @@
   <div class='scroll ta-pany' expected-action='pan-y'>      
     Touch-action: pan-x is not propagated into overflow-scroll elements
   </div>
+</div>
+
+ <div class='ta-panx'>
+  <div class='ta-manipulation' expected-action='pan-x'>
+    Explicitly setting touch-action: manipulation does nothing to prevent propagation of 'pan-x'
+  </div>
+ </div>
+
+ <div class='ta-manipulation'>
+  <div class='ta-auto' expected-action='manipulation'>
+    Explicitly setting touch-action: auto does nothing to prevent propagation of 'manipulation'
+  </div>
 </div>
\ No newline at end of file
diff --git a/Source/web/tests/data/touch-action-simple.html b/Source/web/tests/data/touch-action-simple.html
index 6219b14..b98e8d7 100644
--- a/Source/web/tests/data/touch-action-simple.html
+++ b/Source/web/tests/data/touch-action-simple.html
@@ -21,15 +21,38 @@
   </div>
 </div>
 
+<div class='ta-none' style='height: 0; margin-bottom: 50px'>
+  <span expected-action='none' style='display:inline-block'>
+    touch-action should be inherited by inline-block elements
+  </span>
+</div>
+
+<div class='ta-none' style='height: 0; margin-bottom: 50px'>
+  <span expected-action='none' style='display:table-cell'>
+    touch-action should be inherited by table-cell elements
+  </span>
+</div>
+
 <div style='padding: 20px 0'>
   <span class='ta-none' expected-action='auto'>Touch-action should be ignored on inline elements
     <div expected-action='auto'>And not propagated to any block children</div>
   </span>
 </div>
-<p>Below case is broken, should be AUTO - <a href='http://crbug.com/319479'>Bug 319479</a></p>
-<div class='ta-none' style='height: 0; margin-bottom: 100px'>
-  <span expected-action='none'>
+
+<div class='ta-none' style='height: 0; margin-bottom: 50px'>
+  <span expected-action='auto'>
     touch-action should not be inherited by inline elements
-    <div expected-action='none'>But is inherited by any block descendants of them</div>
   </span>
 </div>
+
+<div class='ta-none' style='height: 0; margin-bottom: 100px'>
+  <span>
+    <div expected-action='none'>touch-action should be inherited by any block descendants of inline elements</div>
+  </span>
+</div>
+
+<div class='ta-none' style='height: 0; margin-bottom: 50px'>
+  <svg expected-action='none' xmlns="http://www.w3.org/2000/svg">
+  touch-action should be inherited by svg root element
+  </svg>
+</div>
\ No newline at end of file
diff --git a/Source/web/tests/data/touch-action-tests.css b/Source/web/tests/data/touch-action-tests.css
index b945ac3..f7b41a5 100644
--- a/Source/web/tests/data/touch-action-tests.css
+++ b/Source/web/tests/data/touch-action-tests.css
@@ -23,6 +23,11 @@
   touch-action: pan-x pan-y;
 }
 
+.ta-manipulation {
+  -ms-touch-action: manipulation;
+  touch-action: manipulation;
+}
+
 /* Make it easy to visualize div boundaries */
 [expected-action] {
   margin: 15px;
@@ -46,6 +51,9 @@
 [expected-action=pan-x-y]::before {
   content: "PAN-X PAN-Y \2190 ";
 }
+[expected-action=manipulation]::before {
+  content: "MANIPULATION \2190 ";
+}
 
 body {
   /* Leave gap for test to scroll down */
diff --git a/Source/web/web.gypi b/Source/web/web.gypi
index f102558..094b414 100644
--- a/Source/web/web.gypi
+++ b/Source/web/web.gypi
@@ -1,8 +1,6 @@
 {
   'variables': {
     'web_files': [
-      'ApplicationCacheHost.cpp',
-      'ApplicationCacheHostInternal.h',
       'AssertMatchingEnums.cpp',
       'AssociatedURLLoader.cpp',
       'AssociatedURLLoader.h',
@@ -69,8 +67,6 @@
       'PageScaleConstraintsSet.h',
       'PageWidgetDelegate.cpp',
       'PageWidgetDelegate.h',
-      'PinchViewports.cpp',
-      'PinchViewports.h',
       'PopupContainer.cpp',
       'PopupContainer.h',
       'PopupListBox.cpp',
@@ -112,7 +108,6 @@
       'WebCachedURLRequest.cpp',
       'WebColorName.cpp',
       'WebColorSuggestion.cpp',
-      'WebCrossOriginPreflightResultCache.cpp',
       'WebCustomElement.cpp',
       'WebDOMActivityLogger.cpp',
       'WebDOMCustomEvent.cpp',
@@ -146,7 +141,6 @@
       'WebEntities.h',
       'WebFileChooserCompletionImpl.cpp',
       'WebFileChooserCompletionImpl.h',
-      'WebFontCache.cpp',
       'WebFontDescription.cpp',
       'WebFontImpl.cpp',
       'WebFontImpl.h',
@@ -310,6 +304,7 @@
       'tests/URLTestHelpers.h',
       'tests/ViewportTest.cpp',
       'tests/WebFrameTest.cpp',
+      'tests/WebHelperPluginTest.cpp',
       'tests/WebImageTest.cpp',
       'tests/WebInputEventConversionTest.cpp',
       'tests/WebInputEventFactoryTestMac.mm',
@@ -335,13 +330,6 @@
           ],
         }
       ],
-      ['OS=="win" and "ENABLE_HARFBUZZ_ON_WINDOWS=0" in feature_defines',
-        {
-          'web_unittest_files': [
-            'tests/UniscribeHelperTest.cpp',
-          ]
-        }
-      ],
       ['OS=="mac"',
         {
           'web_unittest_files': [
diff --git a/Source/web/web_tests.gyp b/Source/web/web_tests.gyp
index e957a7d..961b73b 100644
--- a/Source/web/web_tests.gyp
+++ b/Source/web/web_tests.gyp
@@ -169,7 +169,8 @@
                         '../../public/web/mac',
                     ],
                 }],
-                [ 'os_posix==1 and OS!="mac" and OS!="android" and OS!="ios" and linux_use_tcmalloc==1', {
+                # TODO(dmikurube): Kill linux_use_tcmalloc. http://crbug.com/345554
+                [ 'os_posix==1 and OS!="mac" and OS!="android" and OS!="ios" and ((use_allocator!="none" and use_allocator!="see_use_tcmalloc") or (use_allocator=="see_use_tcmalloc" and linux_use_tcmalloc==1))', {
                     'dependencies': [
                         '<(DEPTH)/base/allocator/allocator.gyp:allocator',
                     ],