Update Chromium to beta version 37.0.2062.68

Change-Id: I188e3b5aff1bec75566014291b654eb19f5bc8ca
Reviewed-by: Andras Becsi <andras.becsi@digia.com>

109 files changed, 2315 insertions, 1240 deletions

diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
new file mode 100644
index 00000000000..05cb6f19096
--- /dev/null
+++ b/chromium/content/public/browser/BUILD.gn
@@ -0,0 +1,39 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//content/browser/browser.gni")
+import("//build/config/ui.gni")
+
+source_set("browser") {
+  if (is_ios) {
+    # iOS doesn't get the normal file list and only takes these whitelisted
+    # files.
+    sources = [
+      "browser_main_parts.cc",
+      "content_browser_client.cc",
+      "favicon_status.cc",
+      "navigation_details.cc",
+      "notification_registrar.cc",
+      "page_navigator.cc",
+      "web_ui_controller.cc",
+    ]
+  } else {
+    sources = rebase_path(content_browser_gypi_values.public_browser_sources,
+                          ".", "//content")
+  }
+
+  if (use_aura) {
+    sources -= [ "context_factory.h" ]
+  }
+
+  configs += [ "//content:content_implementation" ]
+
+  deps = [
+    "//content/browser",
+    "//skia",
+  ]
+
+  # We expose skia headers in the public API.
+  forward_dependent_configs_from = [ "//skia" ]
+}
diff --git a/chromium/content/public/browser/android/OWNERS b/chromium/content/public/browser/android/OWNERS
index 29d0acf8c4e..1df84db9b51 100644
--- a/chromium/content/public/browser/android/OWNERS
+++ b/chromium/content/public/browser/android/OWNERS
@@ -1,3 +1,4 @@
 bulach@chromium.org
+mkosiba@chromium.org
 tedchoc@chromium.org
 yfriedman@chromium.org
diff --git a/chromium/content/public/browser/android/compositor.h b/chromium/content/public/browser/android/compositor.h
index eb0c96e6413..a8f734cf7d5 100644
--- a/chromium/content/public/browser/android/compositor.h
+++ b/chromium/content/public/browser/android/compositor.h
@@ -7,13 +7,13 @@
 
 #include "base/callback.h"
 #include "cc/resources/ui_resource_bitmap.h"
-#include "cc/resources/ui_resource_client.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/android/ui_resource_provider.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/size.h"
 
-#include "third_party/WebKit/public/platform/WebGraphicsContext3D.h"
+class SkBitmap;
 
 namespace cc {
 class Layer;
@@ -25,6 +25,7 @@ class JavaBitmap;
 
 namespace content {
 class CompositorClient;
+class UIResourceProvider;
 
 // An interface to the browser-side compositor.
 class CONTENT_EXPORT Compositor {
@@ -61,46 +62,16 @@ class CONTENT_EXPORT Compositor {
   // Set the output surface which the compositor renders into.
   virtual void SetSurface(jobject surface) = 0;
 
-  // Attempts to composite and read back the result into the provided buffer.
-  // The buffer must be at least window width * height * 4 (RGBA) bytes large.
-  // The buffer is not modified if false is returned.
-  virtual bool CompositeAndReadback(void *pixels, const gfx::Rect& rect) = 0;
-
-  // Composite immediately. Used in single-threaded mode.
-  virtual void Composite() = 0;
-
-  // Generates a UIResource and returns a UIResourceId.  May return 0.
-  virtual cc::UIResourceId GenerateUIResource(
-      const cc::UIResourceBitmap& bitmap) = 0;
-
-  // Deletes a UIResource.
-  virtual void DeleteUIResource(cc::UIResourceId resource_id) = 0;
-
-  // Generates an OpenGL texture and returns a texture handle.  May return 0
-  // if the current context is lost.
-  virtual blink::WebGLId GenerateTexture(gfx::JavaBitmap& bitmap) = 0;
-
-  // Generates an OpenGL compressed texture and returns a texture handle.  May
-  // return 0 if the current context is lost.
-  virtual blink::WebGLId GenerateCompressedTexture(gfx::Size& size,
-                                                    int data_size,
-                                                    void* data) = 0;
-
-  // Deletes an OpenGL texture.
-  virtual void DeleteTexture(blink::WebGLId texture_id) = 0;
-
-  // Grabs a copy of |texture_id| and saves it into |bitmap|.  No scaling is
-  // done.  It is assumed that the texture size matches that of the bitmap.
-  virtual bool CopyTextureToBitmap(blink::WebGLId texture_id,
-                                   gfx::JavaBitmap& bitmap) = 0;
-
-  // Grabs a copy of |texture_id| and saves it into |bitmap|.  No scaling is
-  // done. |src_rect| allows the caller to specify which rect of |texture_id|
-  // to copy to |bitmap|.  It needs to match the size of |bitmap|.  Returns
-  // true if the |texture_id| was copied into |bitmap|, false if not.
-  virtual bool CopyTextureToBitmap(blink::WebGLId texture_id,
-                                   const gfx::Rect& src_rect,
-                                   gfx::JavaBitmap& bitmap) = 0;
+  // Tells the view tree to assume a transparent background when rendering.
+  virtual void SetHasTransparentBackground(bool flag) = 0;
+
+  // Request layout and draw. You only need to call this if you need to trigger
+  // Composite *without* having modified the layer tree.
+  virtual void SetNeedsComposite() = 0;
+
+  // Returns the UI resource provider associated with the compositor.
+  virtual UIResourceProvider& GetUIResourceProvider() = 0;
+
  protected:
   Compositor() {}
 };
diff --git a/chromium/content/public/browser/android/compositor_client.h b/chromium/content/public/browser/android/compositor_client.h
index d835de199d7..84a263e0ed6 100644
--- a/chromium/content/public/browser/android/compositor_client.h
+++ b/chromium/content/public/browser/android/compositor_client.h
@@ -11,24 +11,15 @@ namespace content {
 
 class CONTENT_EXPORT CompositorClient {
  public:
-  // Tells the client that it should schedule a composite.
-  virtual void ScheduleComposite() = 0;
+  // Gives the client a chance for layout changes before compositing.
+  virtual void Layout() {}
 
   // The compositor has completed swapping a frame.
-  virtual void OnSwapBuffersCompleted() {}
-
-  // The compositor will eventually swap a frame.
-  virtual void OnSwapBuffersPosted() {}
+  virtual void OnSwapBuffersCompleted(int pending_swap_buffers) {}
 
   // Tells the client that GL resources were lost and need to be reinitialized.
   virtual void DidLoseResources() {}
 
-  // Tells the client that UI resources were lost and need to be reinitialized.
-  virtual void DidLoseUIResources() {}
-
-  // Mark the UI Resources as being invalid for use.
-  virtual void UIResourcesAreInvalid() {}
-
  protected:
   CompositorClient() {}
   virtual ~CompositorClient() {}
diff --git a/chromium/content/public/browser/android/content_view_core.h b/chromium/content/public/browser/android/content_view_core.h
index 9adaf4c39ce..cf620c0136e 100644
--- a/chromium/content/public/browser/android/content_view_core.h
+++ b/chromium/content/public/browser/android/content_view_core.h
@@ -11,13 +11,15 @@
 #include "base/callback.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/navigation_controller.h"
+#include "ui/gfx/rect.h"
+
+class SkBitmap;
 
 namespace cc {
 class Layer;
 }
 
 namespace gfx {
-class Rect;
 class Size;
 class SizeF;
 class Vector2dF;
@@ -46,14 +48,17 @@ class CONTENT_EXPORT ContentViewCore {
   virtual ui::WindowAndroid* GetWindowAndroid() const = 0;
   virtual scoped_refptr<cc::Layer> GetLayer() const = 0;
   virtual void LoadUrl(NavigationController::LoadURLParams& params) = 0;
-  virtual jint GetCurrentRenderProcessId(JNIEnv* env, jobject obj) = 0;
   virtual void ShowPastePopup(int x, int y) = 0;
-  virtual unsigned int GetScaledContentTexture(
+
+  // Request a scaled content readback. The result is passed through the
+  // callback. The boolean parameter indicates whether the readback was a
+  // success or not. The content is passed through the SkBitmap parameter.
+  virtual void GetScaledContentBitmap(
       float scale,
-      gfx::Size* out_size) = 0;
+      jobject bitmap_config,
+      gfx::Rect src_rect,
+      const base::Callback<void(bool, const SkBitmap&)>& result_callback) = 0;
   virtual float GetDpiScale() const = 0;
-  virtual void RequestContentClipping(const gfx::Rect& clipping,
-                                      const gfx::Size& content_size) = 0;
   virtual void PauseVideo() = 0;
   virtual void PauseOrResumeGeolocation(bool should_pause) = 0;
 
@@ -63,6 +68,13 @@ class CONTENT_EXPORT ContentViewCore {
       const gfx::Vector2dF& scroll_offset,
       float page_scale_factor)> UpdateFrameInfoCallback;
 
+  // Text surrounding selection.
+  virtual void RequestTextSurroundingSelection(
+      int max_length,
+      const base::Callback<void(const base::string16& content,
+                                int start_offset,
+                                int end_offset)>& callback) = 0;
+
  protected:
   virtual ~ContentViewCore() {};
 };
diff --git a/chromium/content/public/browser/android/external_video_surface_container.h b/chromium/content/public/browser/android/external_video_surface_container.h
new file mode 100644
index 00000000000..38cbe5987ba
--- /dev/null
+++ b/chromium/content/public/browser/android/external_video_surface_container.h
@@ -0,0 +1,52 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_EXTERNAL_VIDEO_SURFACE_CONTAINER_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_EXTERNAL_VIDEO_SURFACE_CONTAINER_H_
+
+#include <jni.h>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+
+namespace gfx {
+class RectF;
+}
+
+namespace content {
+class WebContents;
+
+// An interface used for managing the video surface for the hole punching.
+class CONTENT_EXPORT ExternalVideoSurfaceContainer {
+ public:
+  typedef base::Callback<void(int, jobject)> SurfaceCreatedCB;
+  typedef base::Callback<void(int)> SurfaceDestroyedCB;
+
+  // Called when a media player wants to request an external video surface.
+  // Whenever the surface is created and visible, |surface_created_cb| will be
+  // called.  And whenever it is destroyed or invisible, |surface_destroyed_cb|
+  // will be called.
+  virtual void RequestExternalVideoSurface(
+      int player_id,
+      const SurfaceCreatedCB& surface_created_cb,
+      const SurfaceDestroyedCB& surface_destroyed_cb) = 0;
+
+  // Called when a media player wants to release an external video surface.
+  virtual void ReleaseExternalVideoSurface(int player_id) = 0;
+
+  // Called when the position and size of the video element which uses
+  // the external video surface is changed.
+  // |rect| contains the new position and size in css pixels.
+  virtual void OnExternalVideoSurfacePositionChanged(
+      int player_id, const gfx::RectF& rect) = 0;
+
+  // Called when the page that contains the video element is scrolled or zoomed.
+  virtual void OnFrameInfoUpdated() = 0;
+
+  virtual ~ExternalVideoSurfaceContainer() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_EXTERNAL_VIDEO_SURFACE_CONTAINER_H_
diff --git a/chromium/content/public/browser/android/layer_tree_build_helper.h b/chromium/content/public/browser/android/layer_tree_build_helper.h
new file mode 100644
index 00000000000..4f23a4bed12
--- /dev/null
+++ b/chromium/content/public/browser/android/layer_tree_build_helper.h
@@ -0,0 +1,31 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_LAYER_TREE_BUILD_HELPER_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_LAYER_TREE_BUILD_HELPER_H_
+
+#include "base/memory/ref_counted.h"
+
+namespace cc {
+class Layer;
+}
+
+namespace content {
+
+// A Helper class to build a layer tree to be composited
+// given a content root layer.
+class LayerTreeBuildHelper {
+ public:
+  LayerTreeBuildHelper() {};
+  virtual scoped_refptr<cc::Layer> GetLayerTree(
+      scoped_refptr<cc::Layer> content_root_layer) = 0;
+  virtual ~LayerTreeBuildHelper() {};
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(LayerTreeBuildHelper);
+};
+
+}
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_LAYER_TREE_BUILD_HELPER_H_
diff --git a/chromium/content/public/browser/android/synchronous_compositor.h b/chromium/content/public/browser/android/synchronous_compositor.h
index c77d2a87100..62485f155f8 100644
--- a/chromium/content/public/browser/android/synchronous_compositor.h
+++ b/chromium/content/public/browser/android/synchronous_compositor.h
@@ -7,21 +7,29 @@
 
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
+#include "gpu/command_buffer/service/in_process_command_buffer.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/size.h"
 
 class SkCanvas;
 
+namespace cc {
+class CompositorFrame;
+class CompositorFrameAck;
+}
+
 namespace gfx {
-class GLSurface;
 class Transform;
 };
 
-namespace content {
+namespace gpu {
+class GLInProcessContext;
+}
 
-class WebContents;
+namespace content {
 
 class SynchronousCompositorClient;
+class WebContents;
 
 struct CONTENT_EXPORT SynchronousCompositorMemoryPolicy {
   // Memory limit for rendering and pre-rendering.
@@ -52,27 +60,42 @@ class CONTENT_EXPORT SynchronousCompositor {
   // the caller.
   virtual void SetClient(SynchronousCompositorClient* client) = 0;
 
+  static void SetGpuService(
+      scoped_refptr<gpu::InProcessCommandBuffer::Service> service);
+
+  // By default, synchronous compopsitor records the full layer, not only
+  // what is inside and around the view port. This can be used to switch
+  // between this record-full-layer behavior and normal record-around-viewport
+  // behavior.
+  static void SetRecordFullDocument(bool record_full_document);
+
   // Synchronously initialize compositor for hardware draw. Can only be called
   // while compositor is in software only mode, either after compositor is
   // first created or after ReleaseHwDraw is called. It is invalid to
-  // DemandDrawHw before this returns true. |surface| is the GLSurface that
-  // should be used to create the underlying hardware context.
-  virtual bool InitializeHwDraw(scoped_refptr<gfx::GLSurface> surface) = 0;
+  // DemandDrawHw before this returns true.
+  virtual bool InitializeHwDraw() = 0;
 
   // Reverse of InitializeHwDraw above. Can only be called while hardware draw
   // is already initialized. Brings compositor back to software only mode and
   // releases all hardware resources.
   virtual void ReleaseHwDraw() = 0;
 
+  // Get the share context of the compositor. The returned context is owned
+  // by the compositor and is only valid between InitializeHwDraw and
+  // ReleaseHwDraw.
+  virtual gpu::GLInProcessContext* GetShareContext() = 0;
+
   // "On demand" hardware draw. The content is first clipped to |damage_area|,
-  // then transformed through |transform|, and finally clipped to |view_size|
-  // and by the existing stencil buffer if any.
-  virtual bool DemandDrawHw(
+  // then transformed through |transform|, and finally clipped to |view_size|.
+  virtual scoped_ptr<cc::CompositorFrame> DemandDrawHw(
       gfx::Size surface_size,
       const gfx::Transform& transform,
       gfx::Rect viewport,
-      gfx::Rect clip,
-      bool stencil_enabled) = 0;
+      gfx::Rect clip) = 0;
+
+  // For delegated rendering, return resources from parent compositor to this.
+  // Note that all resources must be returned before ReleaseHwDraw.
+  virtual void ReturnResources(const cc::CompositorFrameAck& frame_ack) = 0;
 
   // "On demand" SW draw, into the supplied canvas (observing the transform
   // and clip set there-in).
diff --git a/chromium/content/public/browser/android/synchronous_compositor_client.h b/chromium/content/public/browser/android/synchronous_compositor_client.h
index fd57c6d49a7..2247f3d9b98 100644
--- a/chromium/content/public/browser/android/synchronous_compositor_client.h
+++ b/chromium/content/public/browser/android/synchronous_compositor_client.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_ANDROID_SYNCHRONOUS_COMPOSITOR_CLIENT_H_
 
 #include "base/basictypes.h"
+#include "ui/gfx/geometry/size_f.h"
 #include "ui/gfx/vector2d_f.h"
 
 namespace content {
@@ -25,13 +26,14 @@ class SynchronousCompositorClient {
   virtual void DidDestroyCompositor(SynchronousCompositor* compositor) = 0;
 
   // See LayerScrollOffsetDelegate for details.
-  virtual void SetMaxRootLayerScrollOffset(
-      gfx::Vector2dF max_scroll_offset) = 0;
-  virtual void SetTotalRootLayerScrollOffset(gfx::Vector2dF new_value) = 0;
   virtual gfx::Vector2dF GetTotalRootLayerScrollOffset() = 0;
+  virtual void UpdateRootLayerState(const gfx::Vector2dF& total_scroll_offset,
+                                    const gfx::Vector2dF& max_scroll_offset,
+                                    const gfx::SizeF& scrollable_size,
+                                    float page_scale_factor,
+                                    float min_page_scale_factor,
+                                    float max_page_scale_factor) = 0;
   virtual bool IsExternalFlingActive() const = 0;
-  virtual void SetRootLayerPageScaleFactor(float page_scale_factor) = 0;
-  virtual void SetRootLayerScrollableSize(gfx::SizeF scrollable_size) = 0;
 
   virtual void DidOverscroll(gfx::Vector2dF accumulated_overscroll,
                              gfx::Vector2dF latest_overscroll_delta,
diff --git a/chromium/content/public/browser/android/ui_resource_client_android.h b/chromium/content/public/browser/android/ui_resource_client_android.h
new file mode 100644
index 00000000000..83228bd0f56
--- /dev/null
+++ b/chromium/content/public/browser/android/ui_resource_client_android.h
@@ -0,0 +1,30 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_CLIENT_ANDROID_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_CLIENT_ANDROID_H_
+
+#include "cc/resources/ui_resource_client.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+class UIResourceProvider;
+
+// Android's UIResourceClient has one extra callback (UIResourceIsInvalid).
+// This signal is intended for the case when the LayerTreeHost is cleared and
+// the user needs to recreate their resources.
+// TODO(powei): This interface can be removed once crbug.com/374906 has been
+// addressed.
+class CONTENT_EXPORT UIResourceClientAndroid : public cc::UIResourceClient {
+ public:
+  // This method indicates that the UI resource the user holds is no longer
+  // valid. The user should not call DeleteUIResource on any resource generated
+  // before this signal.
+  virtual void UIResourceIsInvalid() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_CLIENT_ANDROID_H_
diff --git a/chromium/content/public/browser/android/ui_resource_provider.h b/chromium/content/public/browser/android/ui_resource_provider.h
new file mode 100644
index 00000000000..38511e13436
--- /dev/null
+++ b/chromium/content/public/browser/android/ui_resource_provider.h
@@ -0,0 +1,27 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_PROVIDER_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_PROVIDER_H_
+
+#include "cc/resources/ui_resource_client.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+class UIResourceClientAndroid;
+
+class CONTENT_EXPORT UIResourceProvider {
+ public:
+  virtual ~UIResourceProvider() {}
+
+  virtual cc::UIResourceId CreateUIResource(
+      UIResourceClientAndroid* client) = 0;
+
+  virtual void DeleteUIResource(cc::UIResourceId resource_id) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_PROVIDER_H_
diff --git a/chromium/content/public/browser/ax_event_notification_details.cc b/chromium/content/public/browser/ax_event_notification_details.cc
new file mode 100644
index 00000000000..87ff4df41ee
--- /dev/null
+++ b/chromium/content/public/browser/ax_event_notification_details.cc
@@ -0,0 +1,23 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/ax_event_notification_details.h"
+
+namespace content {
+
+AXEventNotificationDetails::AXEventNotificationDetails(
+    const std::vector<ui::AXNodeData>& nodes,
+    ui::AXEvent event_type,
+    int id,
+    int process_id,
+    int routing_id)
+    : nodes(nodes),
+      event_type(event_type),
+      id(id),
+      process_id(process_id),
+      routing_id(routing_id) {}
+
+AXEventNotificationDetails::~AXEventNotificationDetails() {}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/ax_event_notification_details.h b/chromium/content/public/browser/ax_event_notification_details.h
new file mode 100644
index 00000000000..3065e59d52f
--- /dev/null
+++ b/chromium/content/public/browser/ax_event_notification_details.h
@@ -0,0 +1,37 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_AX_EVENT_NOTIFICATION_DETAILS_H_
+#define CONTENT_PUBLIC_BROWSER_AX_EVENT_NOTIFICATION_DETAILS_H_
+
+#include <vector>
+
+#include "content/common/content_export.h"
+#include "ui/accessibility/ax_enums.h"
+#include "ui/accessibility/ax_node_data.h"
+
+namespace content {
+
+// Use this object in conjunction with the
+// |WebContentsObserver::AccessibilityEventReceived| method.
+struct CONTENT_EXPORT AXEventNotificationDetails {
+ public:
+  AXEventNotificationDetails(const std::vector<ui::AXNodeData>& nodes,
+                             ui::AXEvent event_type,
+                             int id,
+                             int process_id,
+                             int routing_id);
+
+  ~AXEventNotificationDetails();
+
+  std::vector<ui::AXNodeData> nodes;
+  ui::AXEvent event_type;
+  int id;
+  int process_id;
+  int routing_id;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_AX_EVENT_NOTIFICATION_DETAILS_H_
diff --git a/chromium/content/public/browser/blob_handle.h b/chromium/content/public/browser/blob_handle.h
new file mode 100644
index 00000000000..e4d7a2de9f9
--- /dev/null
+++ b/chromium/content/public/browser/blob_handle.h
@@ -0,0 +1,25 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
+#define CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
+
+#include <string>
+
+namespace content {
+
+// A handle to Blobs that can be stored outside of content/. This class holds
+// a reference to the Blob and should be used to keep alive a Blob.
+class BlobHandle {
+ public:
+  virtual ~BlobHandle() {}
+  virtual std::string GetUUID() = 0;
+
+ protected:
+  BlobHandle() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
diff --git a/chromium/content/public/browser/browser_accessibility_state.h b/chromium/content/public/browser/browser_accessibility_state.h
index 6f8d6d2c8c1..6c91e1b7b76 100644
--- a/chromium/content/public/browser/browser_accessibility_state.h
+++ b/chromium/content/public/browser/browser_accessibility_state.h
@@ -24,9 +24,15 @@ class CONTENT_EXPORT BrowserAccessibilityState {
   // Enables accessibility for all running tabs.
   virtual void EnableAccessibility() = 0;
 
-  // Disables accessibility for all running tabs.
+  // Disables accessibility for all running tabs. (Only if accessibility is not
+  // required by a command line flag or by a platform requirement.)
   virtual void DisableAccessibility() = 0;
 
+  // Resets accessibility to the platform default for all running tabs.
+  // This is probably off, but may be on, if --force_renderer_accessibility is
+  // passed, or EditableTextOnly if this is Win7.
+  virtual void ResetAccessibilityMode() = 0;
+
   // Called when screen reader client is detected.
   virtual void OnScreenReaderDetected() = 0;
 
diff --git a/chromium/content/public/browser/browser_child_process_host.h b/chromium/content/public/browser/browser_child_process_host.h
index 7776a0d3df5..078eb860cf0 100644
--- a/chromium/content/public/browser/browser_child_process_host.h
+++ b/chromium/content/public/browser/browser_child_process_host.h
@@ -15,9 +15,8 @@
 #include "content/public/common/process_type.h"
 #include "ipc/ipc_sender.h"
 
-class CommandLine;
-
 namespace base {
+class CommandLine;
 class FilePath;
 }
 
@@ -44,13 +43,8 @@ class CONTENT_EXPORT BrowserChildProcessHost : public IPC::Sender {
   // Derived classes call this to launch the child process asynchronously.
   // Takes ownership of |cmd_line| and |delegate|.
   virtual void Launch(
-#if defined(OS_WIN)
       SandboxedProcessLauncherDelegate* delegate,
-#elif defined(OS_POSIX)
-      bool use_zygote,
-      const base::EnvironmentMap& environ,
-#endif
-      CommandLine* cmd_line) = 0;
+      base::CommandLine* cmd_line) = 0;
 
   virtual const ChildProcessData& GetData() const = 0;
 
diff --git a/chromium/content/public/browser/browser_child_process_host_delegate.h b/chromium/content/public/browser/browser_child_process_host_delegate.h
index 2efbeab7469..25ff00a4cb4 100644
--- a/chromium/content/public/browser/browser_child_process_host_delegate.h
+++ b/chromium/content/public/browser/browser_child_process_host_delegate.h
@@ -24,6 +24,10 @@ class CONTENT_EXPORT BrowserChildProcessHostDelegate : public IPC::Listener {
   // Called when the process has been started.
   virtual void OnProcessLaunched() {}
 
+  // Called if the process failed to launch.  In this case the process never
+  // started so there is no available exit code.
+  virtual void OnProcessLaunchFailed() {}
+
   // Called if the process crashed. |exit_code| is the status returned when the
   // process crashed (for posix, as returned from waitpid(), for Windows, as
   // returned from GetExitCodeProcess()).
diff --git a/chromium/content/public/browser/browser_child_process_observer.h b/chromium/content/public/browser/browser_child_process_observer.h
index 12e4355c762..41c9c9d5b08 100644
--- a/chromium/content/public/browser/browser_child_process_observer.h
+++ b/chromium/content/public/browser/browser_child_process_observer.h
@@ -11,8 +11,9 @@ namespace content {
 
 struct ChildProcessData;
 
-// An observer API implemented by classes which are interested
-// in browser child process events.
+// An observer API implemented by classes which are interested in browser child
+// process events. Note that render processes cannot be observed through this
+// interface; use RenderProcessHostObserver instead.
 class CONTENT_EXPORT BrowserChildProcessObserver {
  public:
   // Called when a child process host has connected to a child process.
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index d6d89501039..1c09777f42b 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -31,10 +31,12 @@ class SpecialStoragePolicy;
 
 namespace content {
 
+class BlobHandle;
+class BrowserPluginGuestManager;
 class DownloadManager;
 class DownloadManagerDelegate;
-class GeolocationPermissionContext;
 class IndexedDBContext;
+class PushMessagingService;
 class ResourceContext;
 class SiteInstance;
 class StoragePartition;
@@ -76,6 +78,13 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   static content::StoragePartition* GetDefaultStoragePartition(
       BrowserContext* browser_context);
 
+  typedef base::Callback<void(scoped_ptr<BlobHandle>)> BlobCallback;
+
+  // |callback| returns a NULL scoped_ptr on failure.
+  static void CreateMemoryBackedBlob(BrowserContext* browser_context,
+                                     const char* data, size_t length,
+                                     const BlobCallback& callback);
+
   // Ensures that the corresponding ResourceContext is initialized. Normally the
   // BrowserContext initializs the corresponding getters when its objects are
   // created, but if the embedder wants to pass the ResourceContext to another
@@ -87,9 +96,6 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // across the next restart.
   static void SaveSessionState(BrowserContext* browser_context);
 
-  // Tells the HTML5 objects on this context to purge any uneeded memory.
-  static void PurgeMemory(BrowserContext* browser_context);
-
   virtual ~BrowserContext();
 
   // Returns the path of the directory where this context's data is stored.
@@ -125,24 +131,6 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
           const base::FilePath& partition_path,
           bool in_memory) = 0;
 
-  typedef base::Callback<void(bool)> MIDISysExPermissionCallback;
-
-  // Requests a permission to use system exclusive messages in MIDI events.
-  // |callback| will be invoked when the request is resolved.
-  virtual void RequestMIDISysExPermission(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame,
-      const MIDISysExPermissionCallback& callback) = 0;
-
-  // Cancels a pending MIDI permission request.
-  virtual void CancelMIDISysExPermissionRequest(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame) = 0;
-
   // Returns the resource context.
   virtual ResourceContext* GetResourceContext() = 0;
 
@@ -151,12 +139,16 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // ensuring that it outlives DownloadManager. It's valid to return NULL.
   virtual DownloadManagerDelegate* GetDownloadManagerDelegate() = 0;
 
-  // Returns the geolocation permission context for this context. It's valid to
-  // return NULL, in which case geolocation requests will always be allowed.
-  virtual GeolocationPermissionContext* GetGeolocationPermissionContext() = 0;
+  // Returns the guest manager for this context.
+  virtual BrowserPluginGuestManager* GetGuestManager() = 0;
 
   // Returns a special storage policy implementation, or NULL.
   virtual quota::SpecialStoragePolicy* GetSpecialStoragePolicy() = 0;
+
+  // Returns a push messaging service. The embedder owns the service, and is
+  // responsible for ensuring that it outlives RenderProcessHost. It's valid to
+  // return NULL.
+  virtual PushMessagingService* GetPushMessagingService() = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_main_runner.h b/chromium/content/public/browser/browser_main_runner.h
index 4340687796e..dcde509e583 100644
--- a/chromium/content/public/browser/browser_main_runner.h
+++ b/chromium/content/public/browser/browser_main_runner.h
@@ -21,7 +21,8 @@ class CONTENT_EXPORT BrowserMainRunner {
   static BrowserMainRunner* Create();
 
   // Initialize all necessary browser state. The |parameters| values will be
-  // copied.
+  // copied. Returning a non-negative value indicates that initialization
+  // failed, and the returned value is used as the exit code for the process.
   virtual int Initialize(const content::MainFunctionParams& parameters) = 0;
 
   // Perform the default run logic.
diff --git a/chromium/content/public/browser/browser_message_filter.cc b/chromium/content/public/browser/browser_message_filter.cc
index cca9d309f01..6b3432204b9 100644
--- a/chromium/content/public/browser/browser_message_filter.cc
+++ b/chromium/content/public/browser/browser_message_filter.cc
@@ -11,26 +11,28 @@
 #include "base/process/kill.h"
 #include "base/process/process_handle.h"
 #include "base/task_runner.h"
+#include "content/browser/browser_child_process_host_impl.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
 #include "ipc/ipc_sync_message.h"
+#include "ipc/message_filter.h"
 
 using content::BrowserMessageFilter;
 
 namespace content {
 
-class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
+class BrowserMessageFilter::Internal : public IPC::MessageFilter {
  public:
   explicit Internal(BrowserMessageFilter* filter) : filter_(filter) {}
 
  private:
   virtual ~Internal() {}
 
-  // IPC::ChannelProxy::MessageFilter implementation:
-  virtual void OnFilterAdded(IPC::Channel* channel) OVERRIDE {
-    filter_->channel_ = channel;
-    filter_->OnFilterAdded(channel);
+  // IPC::MessageFilter implementation:
+  virtual void OnFilterAdded(IPC::Sender* sender) OVERRIDE {
+    filter_->sender_ = sender;
+    filter_->OnFilterAdded(sender);
   }
 
   virtual void OnFilterRemoved() OVERRIDE {
@@ -38,7 +40,7 @@ class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
   }
 
   virtual void OnChannelClosing() OVERRIDE {
-    filter_->channel_ = NULL;
+    filter_->sender_ = NULL;
     filter_->OnChannelClosing();
   }
 
@@ -76,17 +78,19 @@ class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
     return true;
   }
 
+  virtual bool GetSupportedMessageClasses(
+      std::vector<uint32>* supported_message_classes) const OVERRIDE {
+    supported_message_classes->assign(
+        filter_->message_classes_to_filter().begin(),
+        filter_->message_classes_to_filter().end());
+    return true;
+  }
+
   // Dispatches a message to the derived class.
   bool DispatchMessage(const IPC::Message& message) {
-    bool message_was_ok = true;
-    bool rv = filter_->OnMessageReceived(message, &message_was_ok);
+    bool rv = filter_->OnMessageReceived(message);
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO) || rv) <<
         "Must handle messages that were dispatched to another thread!";
-    if (!message_was_ok) {
-      content::RecordAction(UserMetricsAction("BadMessageTerminate_BMF"));
-      filter_->BadMessageReceived();
-    }
-
     return rv;
   }
 
@@ -95,12 +99,28 @@ class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
   DISALLOW_COPY_AND_ASSIGN(Internal);
 };
 
-BrowserMessageFilter::BrowserMessageFilter()
-    : internal_(NULL), channel_(NULL),
+BrowserMessageFilter::BrowserMessageFilter(uint32 message_class_to_filter)
+    : internal_(NULL),
+      sender_(NULL),
 #if defined(OS_WIN)
       peer_handle_(base::kNullProcessHandle),
 #endif
-      peer_pid_(base::kNullProcessId) {
+      peer_pid_(base::kNullProcessId),
+      message_classes_to_filter_(1, message_class_to_filter) {}
+
+BrowserMessageFilter::BrowserMessageFilter(
+    const uint32* message_classes_to_filter,
+    size_t num_message_classes_to_filter)
+    : internal_(NULL),
+      sender_(NULL),
+#if defined(OS_WIN)
+      peer_handle_(base::kNullProcessHandle),
+#endif
+      peer_pid_(base::kNullProcessId),
+      message_classes_to_filter_(
+          message_classes_to_filter,
+          message_classes_to_filter + num_message_classes_to_filter) {
+  DCHECK(num_message_classes_to_filter);
 }
 
 base::ProcessHandle BrowserMessageFilter::PeerHandle() {
@@ -141,8 +161,8 @@ bool BrowserMessageFilter::Send(IPC::Message* message) {
     return true;
   }
 
-  if (channel_)
-    return channel_->Send(message);
+  if (sender_)
+    return sender_->Send(message);
 
   delete message;
   return false;
@@ -180,11 +200,13 @@ bool BrowserMessageFilter::CheckCanDispatchOnUI(const IPC::Message& message,
 
 void BrowserMessageFilter::BadMessageReceived() {
   CommandLine* command_line = CommandLine::ForCurrentProcess();
+  if (command_line->HasSwitch(switches::kDisableKillAfterBadIPC))
+    return;
 
-  if (!command_line->HasSwitch(switches::kDisableKillAfterBadIPC)) {
-    base::KillProcess(PeerHandle(), content::RESULT_CODE_KILLED_BAD_MESSAGE,
-                      false);
-  }
+  BrowserChildProcessHostImpl::HistogramBadMessageTerminated(
+      PROCESS_TYPE_RENDERER);
+  base::KillProcess(PeerHandle(), content::RESULT_CODE_KILLED_BAD_MESSAGE,
+                    false);
 }
 
 BrowserMessageFilter::~BrowserMessageFilter() {
@@ -194,7 +216,7 @@ BrowserMessageFilter::~BrowserMessageFilter() {
 #endif
 }
 
-IPC::ChannelProxy::MessageFilter* BrowserMessageFilter::GetFilter() {
+IPC::MessageFilter* BrowserMessageFilter::GetFilter() {
   // We create this on demand so that if a filter is used in a unit test but
   // never attached to a channel, we don't leak Internal and this;
   DCHECK(!internal_) << "Should only be called once.";
diff --git a/chromium/content/public/browser/browser_message_filter.h b/chromium/content/public/browser/browser_message_filter.h
index ad1f0693790..81f06a90343 100644
--- a/chromium/content/public/browser/browser_message_filter.h
+++ b/chromium/content/public/browser/browser_message_filter.h
@@ -19,6 +19,10 @@ namespace base {
 class TaskRunner;
 }
 
+namespace IPC {
+class MessageFilter;
+}
+
 namespace content {
 struct BrowserMessageFilterTraits;
 
@@ -29,11 +33,13 @@ class CONTENT_EXPORT BrowserMessageFilter
           BrowserMessageFilter, BrowserMessageFilterTraits>,
       public IPC::Sender {
  public:
-  BrowserMessageFilter();
+  explicit BrowserMessageFilter(uint32 message_class_to_filter);
+  BrowserMessageFilter(const uint32* message_classes_to_filter,
+                       size_t num_message_classes_to_filter);
 
-  // These match the corresponding IPC::ChannelProxy::MessageFilter methods and
-  // are always called on the IO thread.
-  virtual void OnFilterAdded(IPC::Channel* channel) {}
+  // These match the corresponding IPC::MessageFilter methods and are always
+  // called on the IO thread.
+  virtual void OnFilterAdded(IPC::Sender* sender) {}
   virtual void OnFilterRemoved() {}
   virtual void OnChannelClosing() {}
   virtual void OnChannelConnected(int32 peer_pid) {}
@@ -69,8 +75,7 @@ class CONTENT_EXPORT BrowserMessageFilter
   // Your function will normally be called on the IO thread.  However, if your
   // OverrideXForMessage modifies the thread used to dispatch the message,
   // your function will be called on the requested thread.
-  virtual bool OnMessageReceived(const IPC::Message& message,
-                                 bool* message_was_ok) = 0;
+  virtual bool OnMessageReceived(const IPC::Message& message) = 0;
 
   // Can be called on any thread, after OnChannelConnected is called.
   base::ProcessHandle PeerHandle();
@@ -91,6 +96,10 @@ class CONTENT_EXPORT BrowserMessageFilter
   // Can be called on any thread.
   virtual void BadMessageReceived();
 
+  const std::vector<uint32>& message_classes_to_filter() const {
+    return message_classes_to_filter_;
+  }
+
  protected:
   virtual ~BrowserMessageFilter();
 
@@ -106,17 +115,19 @@ class CONTENT_EXPORT BrowserMessageFilter
   // This is private because the only classes that need access to it are made
   // friends above. This is only guaranteed to be valid on creation, after that
   // this class could outlive the filter.
-  IPC::ChannelProxy::MessageFilter* GetFilter();
+  IPC::MessageFilter* GetFilter();
 
-  // This implements IPC::ChannelProxy::MessageFilter so that we can hide that
-  // from child classes. Internal keeps a reference to this class, which is why
-  // there's a weak pointer back. This class could outlive Internal based on
-  // what the child class does in its OnDestruct method.
+  // This implements IPC::MessageFilter so that we can hide that from child
+  // classes. Internal keeps a reference to this class, which is why there's a
+  // weak pointer back. This class could outlive Internal based on what the
+  // child class does in its OnDestruct method.
   Internal* internal_;
 
-  IPC::Channel* channel_;
+  IPC::Sender* sender_;
   base::ProcessId peer_pid_;
 
+  std::vector<uint32> message_classes_to_filter_;
+
 #if defined(OS_WIN)
   base::Lock peer_handle_lock_;
   base::ProcessHandle peer_handle_;
diff --git a/chromium/content/public/browser/browser_plugin_guest_delegate.cc b/chromium/content/public/browser/browser_plugin_guest_delegate.cc
deleted file mode 100644
index 52577612aa1..00000000000
--- a/chromium/content/public/browser/browser_plugin_guest_delegate.cc
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/browser/browser_plugin_guest_delegate.h"
-
-namespace content {
-
-bool BrowserPluginGuestDelegate::HandleKeyboardEvent(
-    const NativeWebKeyboardEvent& event) {
-  return false;
-}
-
-bool BrowserPluginGuestDelegate::IsDragAndDropEnabled() {
-  return false;
-}
-
-bool BrowserPluginGuestDelegate::IsOverridingUserAgent() const {
-  return false;
-}
-
-bool BrowserPluginGuestDelegate::RequestPermission(
-    BrowserPluginPermissionType permission_type,
-    const base::DictionaryValue& request_info,
-    const PermissionResponseCallback& callback,
-    bool allowed_by_default) {
-  return false;
-}
-
-GURL BrowserPluginGuestDelegate::ResolveURL(const std::string& src) {
-  return GURL(src);
-}
-
-}  // namespace content
diff --git a/chromium/content/public/browser/browser_plugin_guest_delegate.h b/chromium/content/public/browser/browser_plugin_guest_delegate.h
index c0d2ded0290..7abd7371a25 100644
--- a/chromium/content/public/browser/browser_plugin_guest_delegate.h
+++ b/chromium/content/public/browser/browser_plugin_guest_delegate.h
@@ -7,16 +7,19 @@
 
 #include "base/callback_forward.h"
 #include "base/process/kill.h"
-#include "base/strings/string16.h"
-#include "base/values.h"
 #include "content/common/content_export.h"
-#include "content/public/common/browser_plugin_permission_type.h"
-#include "ui/gfx/size.h"
-#include "url/gurl.h"
+
+namespace base {
+class DictionaryValue;
+}  // namespace base
+
+namespace gfx {
+class Size;
+}  // namespace gfx
 
 namespace content {
 
-struct NativeWebKeyboardEvent;
+class WebContents;
 
 // Objects implement this interface to get notified about changes in the guest
 // WebContents and to provide necessary functionality.
@@ -24,70 +27,34 @@ class CONTENT_EXPORT BrowserPluginGuestDelegate {
  public:
   virtual ~BrowserPluginGuestDelegate() {}
 
-  // Add a message to the console.
-  virtual void AddMessageToConsole(int32 level,
-                                   const base::string16& message,
-                                   int32 line_no,
-                                   const base::string16& source_id) {}
-
-  // Request the delegate to close this guest, and do whatever cleanup it needs
-  // to do.
-  virtual void Close() {}
+  // Notification that the embedder will begin attachment. This is called
+  // prior to resuming resource loads.
+  virtual void WillAttach(content::WebContents* embedder_web_contents,
+                          const base::DictionaryValue& extra_params) {}
 
   // Notification that the embedder has completed attachment.
   virtual void DidAttach() {}
 
-  // Informs the delegate that the guest render process is gone. |status|
-  // indicates whether the guest was killed, crashed, or was terminated
-  // gracefully.
-  virtual void GuestProcessGone(base::TerminationStatus status) {}
-
-  // Informs the delegate that the embedder has been destroyed.
-  virtual void EmbedderDestroyed() {}
-
-  virtual bool HandleKeyboardEvent(const NativeWebKeyboardEvent& event);
-
-  virtual bool IsDragAndDropEnabled();
-
-  // Returns whether the user agent for the guest is being overridden.
-  virtual bool IsOverridingUserAgent() const;
-
-  // Notification that a load in the guest resulted in abort. Note that |url|
-  // may be invalid.
-  virtual void LoadAbort(bool is_top_level,
-                         const GURL& url,
-                         const std::string& error_type) {}
-
-  // Notification that the page has made some progress loading. |progress| is a
-  // value between 0.0 (nothing loaded) and 1.0 (page loaded completely).
-  virtual void LoadProgressed(double progress) {}
-
-  // Notification that the guest is no longer hung.
-  virtual void RendererResponsive() {}
-
-  // Notification that the guest is hung.
-  virtual void RendererUnresponsive() {}
-
-  typedef base::Callback<void(bool /* allow */,
-                              const std::string& /* user_input */)>
-      PermissionResponseCallback;
-
-  // Request permission from the delegate to perform an action of the provided
-  // |permission_type|. Details of the permission request are found in
-  // |request_info|. A |callback| is provided to make the decision.
-  // Returns whether the delegate has, or will handle the permission request.
-  virtual bool RequestPermission(
-      BrowserPluginPermissionType permission_type,
-      const base::DictionaryValue& request_info,
-      const PermissionResponseCallback& callback,
-      bool allowed_by_default);
-
-  // Requests resolution of a potentially relative URL.
-  virtual GURL ResolveURL(const std::string& src);
-
   // Notifies that the content size of the guest has changed in autosize mode.
   virtual void SizeChanged(const gfx::Size& old_size,
                            const gfx::Size& new_size) {}
+
+  // Asks the delegate if the given guest can lock the pointer.
+  // Invoking the |callback| synchronously is OK.
+  virtual void RequestPointerLockPermission(
+      bool user_gesture,
+      bool last_unlocked_by_target,
+      const base::Callback<void(bool)>& callback) {}
+
+  // Requests that the delegate destroy itself along with its associated
+  // WebContents.
+  virtual void Destroy() {}
+
+  // Registers a |callback| with the delegate that the delegate would call when
+  // it is about to be destroyed.
+  typedef base::Callback<void()> DestructionCallback;
+  virtual void RegisterDestructionCallback(
+      const DestructionCallback& callback) {}
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_plugin_guest_manager.cc b/chromium/content/public/browser/browser_plugin_guest_manager.cc
new file mode 100644
index 00000000000..abb0bb06e16
--- /dev/null
+++ b/chromium/content/public/browser/browser_plugin_guest_manager.cc
@@ -0,0 +1,29 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/browser_plugin_guest_manager.h"
+
+#include "base/values.h"
+
+namespace content {
+
+content::WebContents* BrowserPluginGuestManager::CreateGuest(
+    SiteInstance* embedder_site_instance,
+    int instance_id,
+    scoped_ptr<base::DictionaryValue> extra_params) {
+  return NULL;
+}
+
+int BrowserPluginGuestManager::GetNextInstanceID() {
+  return 0;
+}
+
+bool BrowserPluginGuestManager::ForEachGuest(
+    WebContents* embedder_web_contents,
+    const GuestCallback& callback) {
+  return false;
+}
+
+}  // content
+
diff --git a/chromium/content/public/browser/browser_plugin_guest_manager.h b/chromium/content/public/browser/browser_plugin_guest_manager.h
new file mode 100644
index 00000000000..3e7dd26fb57
--- /dev/null
+++ b/chromium/content/public/browser/browser_plugin_guest_manager.h
@@ -0,0 +1,63 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_BROWSER_PLUGIN_GUEST_MANAGER_H_
+#define CONTENT_PUBLIC_BROWSER_BROWSER_PLUGIN_GUEST_MANAGER_H_
+
+#include <string>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+
+class GURL;
+
+namespace base {
+class DictionaryValue;
+}  // namespace base
+
+namespace content {
+
+class SiteInstance;
+class WebContents;
+
+// A BrowserPluginGuestManager offloads guest management and routing
+// operations outside of the content layer.
+class CONTENT_EXPORT BrowserPluginGuestManager {
+ public:
+  virtual ~BrowserPluginGuestManager() {}
+
+  // Requests the allocation of a new guest WebContents.
+  virtual content::WebContents* CreateGuest(
+      content::SiteInstance* embedder_site_instance,
+      int instance_id,
+      scoped_ptr<base::DictionaryValue> extra_params);
+
+  // Return a new instance ID.
+  // TODO(fsamuel): Remove this. Once the instance ID concept is moved
+  // entirely out of content and into chrome, this API will be unnecessary.
+  virtual int GetNextInstanceID();
+
+  typedef base::Callback<void(WebContents*)> GuestByInstanceIDCallback;
+  // Requests a guest WebContents associated with the provided
+  // |guest_instance_id|. If a guest associated with the provided ID
+  // does not exist, then the |callback| will be called with a NULL
+  // WebContents. If the provided |embedder_render_process_id| does
+  // not own the requested guest, then the embedder will be killed,
+  // and the |callback| will not be called.
+  virtual void MaybeGetGuestByInstanceIDOrKill(
+      int guest_instance_id,
+      int embedder_render_process_id,
+      const GuestByInstanceIDCallback& callback) {}
+
+  // Iterates over all WebContents belonging to a given |embedder_web_contents|,
+  // calling |callback| for each. If one of the callbacks returns true, then
+  // the iteration exits early.
+  typedef base::Callback<bool(WebContents*)> GuestCallback;
+  virtual bool ForEachGuest(WebContents* embedder_web_contents,
+                            const GuestCallback& callback);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_BROWSER_PLUGIN_GUEST_MANAGER_H_
diff --git a/chromium/content/public/browser/browser_ppapi_host.h b/chromium/content/public/browser/browser_ppapi_host.h
index 45f997ea06b..81b78b69141 100644
--- a/chromium/content/public/browser/browser_ppapi_host.h
+++ b/chromium/content/public/browser/browser_ppapi_host.h
@@ -34,6 +34,17 @@ namespace content {
 // lives entirely on the I/O thread.
 class CONTENT_EXPORT BrowserPpapiHost {
  public:
+  struct OnKeepaliveInstanceStruct {
+    int render_process_id;
+    int render_frame_id;
+    GURL document_url;
+  };
+  typedef std::vector<OnKeepaliveInstanceStruct> OnKeepaliveInstanceData;
+  typedef base::Callback<
+      void (const OnKeepaliveInstanceData& instance_data,
+            const base::FilePath& profile_data_directory)>
+      OnKeepaliveCallback;
+
   // Creates a browser host and sets up an out-of-process proxy for an external
   // pepper plugin process.
   static BrowserPpapiHost* CreateExternalPluginProcess(
@@ -56,7 +67,7 @@ class CONTENT_EXPORT BrowserPpapiHost {
   // Returns true if the given PP_Instance is valid.
   virtual bool IsValidInstance(PP_Instance instance) const = 0;
 
-  // Retrieves the process/view Ids associated with the RenderView containing
+  // Retrieves the process/frame Ids associated with the RenderFrame containing
   // the given instance and returns true on success. If the instance is
   // invalid, the ids will be 0 and false will be returned.
   //
@@ -64,10 +75,10 @@ class CONTENT_EXPORT BrowserPpapiHost {
   // validated, and the resource hosts will be deleted when the resource is
   // destroyed. So it should not generally be necessary to check for errors
   // from this function except as a last-minute sanity check if you convert the
-  // IDs to a RenderView/ProcessHost on the UI thread.
-  virtual bool GetRenderViewIDsForInstance(PP_Instance instance,
-                                           int* render_process_id,
-                                           int* render_view_id) const = 0;
+  // IDs to a RenderFrame/ProcessHost on the UI thread.
+  virtual bool GetRenderFrameIDsForInstance(PP_Instance instance,
+                                            int* render_process_id,
+                                            int* render_frame_id) const = 0;
 
   // Returns the name of the plugin.
   virtual const std::string& GetPluginName() = 0;
@@ -81,6 +92,10 @@ class CONTENT_EXPORT BrowserPpapiHost {
   // Get the Document/Plugin URLs for the given PP_Instance.
   virtual GURL GetDocumentURLForInstance(PP_Instance instance) = 0;
   virtual GURL GetPluginURLForInstance(PP_Instance instance) = 0;
+
+  // Sets a callback the BrowserPpapiHost will run when the plugin messages
+  // that it is active.
+  virtual void SetOnKeepaliveCallback(const OnKeepaliveCallback& callback) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_thread.h b/chromium/content/public/browser/browser_thread.h
index 55cb62b2235..6c83633e1f5 100644
--- a/chromium/content/public/browser/browser_thread.h
+++ b/chromium/content/public/browser/browser_thread.h
@@ -10,15 +10,12 @@
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/location.h"
+#include "base/logging.h"
 #include "base/message_loop/message_loop_proxy.h"
 #include "base/task_runner_util.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 
-#if defined(UNIT_TEST)
-#include "base/logging.h"
-#endif  // UNIT_TEST
-
 namespace base {
 class MessageLoop;
 class SequencedWorkerPool;
@@ -30,6 +27,13 @@ namespace content {
 class BrowserThreadDelegate;
 class BrowserThreadImpl;
 
+// Use DCHECK_CURRENTLY_ON(BrowserThread::ID) to assert that a function can only
+// be called on the named BrowserThread.
+#define DCHECK_CURRENTLY_ON(thread_identifier)                      \
+  (DCHECK(::content::BrowserThread::CurrentlyOn(thread_identifier)) \
+   << ::content::BrowserThread::GetDCheckCurrentlyOnErrorMessage(   \
+          thread_identifier))
+
 ///////////////////////////////////////////////////////////////////////////////
 // BrowserThread
 //
@@ -181,24 +185,24 @@ class CONTENT_EXPORT BrowserThread {
   // Returns the thread pool used for blocking file I/O. Use this object to
   // perform random blocking operations such as file writes or querying the
   // Windows registry.
-  static base::SequencedWorkerPool* GetBlockingPool();
+  static base::SequencedWorkerPool* GetBlockingPool() WARN_UNUSED_RESULT;
 
   // Callable on any thread.  Returns whether the given well-known thread is
   // initialized.
-  static bool IsThreadInitialized(ID identifier);
+  static bool IsThreadInitialized(ID identifier) WARN_UNUSED_RESULT;
 
   // Callable on any thread.  Returns whether you're currently on a particular
-  // thread.
-  static bool CurrentlyOn(ID identifier);
+  // thread.  To DCHECK this, use the DCHECK_CURRENTLY_ON() macro above.
+  static bool CurrentlyOn(ID identifier) WARN_UNUSED_RESULT;
 
   // Callable on any thread.  Returns whether the threads message loop is valid.
   // If this returns false it means the thread is in the process of shutting
   // down.
-  static bool IsMessageLoopValid(ID identifier);
+  static bool IsMessageLoopValid(ID identifier) WARN_UNUSED_RESULT;
 
   // If the current message loop is one of the known threads, returns true and
   // sets identifier to its ID.  Otherwise returns false.
-  static bool GetCurrentThreadIdentifier(ID* identifier);
+  static bool GetCurrentThreadIdentifier(ID* identifier) WARN_UNUSED_RESULT;
 
   // Callers can hold on to a refcounted MessageLoopProxy beyond the lifetime
   // of the thread.
@@ -266,6 +270,9 @@ class CONTENT_EXPORT BrowserThread {
   struct DeleteOnFileThread : public DeleteOnThread<FILE> { };
   struct DeleteOnDBThread : public DeleteOnThread<DB> { };
 
+  // Returns an appropriate error message for when DCHECK_CURRENTLY_ON() fails.
+  static std::string GetDCheckCurrentlyOnErrorMessage(ID expected);
+
  private:
   friend class BrowserThreadImpl;
 
diff --git a/chromium/content/public/browser/child_process_data.h b/chromium/content/public/browser/child_process_data.h
index 3683be9c330..395c4876b8d 100644
--- a/chromium/content/public/browser/child_process_data.h
+++ b/chromium/content/public/browser/child_process_data.h
@@ -25,7 +25,9 @@ struct ChildProcessData {
   // one run of the browser.
   int id;
 
-  // The handle to the process.
+  // The handle to the process. May have value kNullProcessHandle if no process
+  // exists - either because it hasn't been started yet or it's running in the
+  // current process.
   base::ProcessHandle handle;
 
   explicit ChildProcessData(int process_type)
diff --git a/chromium/content/public/browser/child_process_security_policy.h b/chromium/content/public/browser/child_process_security_policy.h
index 2f462b28a18..261bf58f181 100644
--- a/chromium/content/public/browser/child_process_security_policy.h
+++ b/chromium/content/public/browser/child_process_security_policy.h
@@ -51,6 +51,12 @@ class ChildProcessSecurityPolicy {
   virtual void GrantCreateReadWriteFile(int child_id,
                                         const base::FilePath& file) = 0;
 
+  // This permission grants copy-into permission for |dir|.
+  virtual void GrantCopyInto(int child_id, const base::FilePath& dir) = 0;
+
+  // This permission grants delete permission for |dir|.
+  virtual void GrantDeleteFrom(int child_id, const base::FilePath& dir) = 0;
+
   // These methods verify whether or not the child process has been granted
   // permissions perform these functions on |file|.
 
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index acb9fe849ff..e8da55e8aff 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -15,12 +15,6 @@ BrowserMainParts* ContentBrowserClient::CreateBrowserMainParts(
   return NULL;
 }
 
-WebContentsViewPort* ContentBrowserClient::OverrideCreateWebContentsView(
-    WebContents* web_contents,
-    RenderViewHostDelegateView** render_view_host_delegate_view) {
-  return NULL;
-}
-
 WebContentsViewDelegate* ContentBrowserClient::GetWebContentsViewDelegate(
     WebContents* web_contents) {
   return NULL;
@@ -38,7 +32,8 @@ bool ContentBrowserClient::ShouldUseProcessPerSite(
 
 net::URLRequestContextGetter* ContentBrowserClient::CreateRequestContext(
     BrowserContext* browser_context,
-    ProtocolHandlerMap* protocol_handlers) {
+    ProtocolHandlerMap* protocol_handlers,
+    URLRequestInterceptorScopedVector request_interceptors) {
   return NULL;
 }
 
@@ -47,7 +42,8 @@ ContentBrowserClient::CreateRequestContextForStoragePartition(
     BrowserContext* browser_context,
     const base::FilePath& partition_path,
     bool in_memory,
-    ProtocolHandlerMap* protocol_handlers) {
+    ProtocolHandlerMap* protocol_handlers,
+    URLRequestInterceptorScopedVector request_interceptors) {
   return NULL;
 }
 
@@ -70,6 +66,10 @@ bool ContentBrowserClient::IsSuitableHost(RenderProcessHost* process_host,
   return true;
 }
 
+bool ContentBrowserClient::MayReuseHost(RenderProcessHost* process_host) {
+  return true;
+}
+
 bool ContentBrowserClient::ShouldTryToUseExistingProcessHost(
       BrowserContext* browser_context, const GURL& url) {
   return false;
@@ -105,7 +105,7 @@ std::string ContentBrowserClient::GetAcceptLangs(BrowserContext* context) {
   return std::string();
 }
 
-gfx::ImageSkia* ContentBrowserClient::GetDefaultFavicon() {
+const gfx::ImageSkia* ContentBrowserClient::GetDefaultFavicon() {
   static gfx::ImageSkia* empty = new gfx::ImageSkia();
   return empty;
 }
@@ -121,7 +121,7 @@ bool ContentBrowserClient::AllowGetCookie(const GURL& url,
                                           const net::CookieList& cookie_list,
                                           ResourceContext* context,
                                           int render_process_id,
-                                          int render_view_id) {
+                                          int render_frame_id) {
   return true;
 }
 
@@ -130,7 +130,7 @@ bool ContentBrowserClient::AllowSetCookie(const GURL& url,
                                           const std::string& cookie_line,
                                           ResourceContext* context,
                                           int render_process_id,
-                                          int render_view_id,
+                                          int render_frame_id,
                                           net::CookieOptions* options) {
   return true;
 }
@@ -145,14 +145,14 @@ bool ContentBrowserClient::AllowWorkerDatabase(
     const base::string16& display_name,
     unsigned long estimated_size,
     ResourceContext* context,
-    const std::vector<std::pair<int, int> >& render_views) {
+    const std::vector<std::pair<int, int> >& render_frames) {
   return true;
 }
 
 bool ContentBrowserClient::AllowWorkerFileSystem(
     const GURL& url,
     ResourceContext* context,
-    const std::vector<std::pair<int, int> >& render_views) {
+    const std::vector<std::pair<int, int> >& render_frames) {
   return true;
 }
 
@@ -160,7 +160,7 @@ bool ContentBrowserClient::AllowWorkerIndexedDB(
     const GURL& url,
     const base::string16& name,
     ResourceContext* context,
-    const std::vector<std::pair<int, int> >& render_views) {
+    const std::vector<std::pair<int, int> >& render_frames) {
   return true;
 }
 
@@ -211,20 +211,47 @@ blink::WebNotificationPresenter::Permission
   return blink::WebNotificationPresenter::PermissionAllowed;
 }
 
+void ContentBrowserClient::RequestGeolocationPermission(
+    WebContents* web_contents,
+    int bridge_id,
+    const GURL& requesting_frame,
+    bool user_gesture,
+    base::Callback<void(bool)> result_callback,
+    base::Closure* cancel_callback) {
+  result_callback.Run(true);
+}
+
+void ContentBrowserClient::RequestMidiSysExPermission(
+    WebContents* web_contents,
+    int bridge_id,
+    const GURL& requesting_frame,
+    bool user_gesture,
+    base::Callback<void(bool)> result_callback,
+    base::Closure* cancel_callback) {
+  result_callback.Run(true);
+}
+
+void ContentBrowserClient::RequestProtectedMediaIdentifierPermission(
+    WebContents* web_contents,
+    const GURL& origin,
+    base::Callback<void(bool)> result_callback,
+    base::Closure* cancel_callback) {
+  result_callback.Run(true);
+}
+
 bool ContentBrowserClient::CanCreateWindow(
     const GURL& opener_url,
     const GURL& opener_top_level_frame_url,
     const GURL& source_origin,
     WindowContainerType container_type,
     const GURL& target_url,
-    const content::Referrer& referrer,
+    const Referrer& referrer,
     WindowOpenDisposition disposition,
     const blink::WebWindowFeatures& features,
     bool user_gesture,
     bool opener_suppressed,
-    content::ResourceContext* context,
+    ResourceContext* context,
     int render_process_id,
-    bool is_guest,
     int opener_id,
     bool* no_javascript_access) {
   *no_javascript_access = false;
@@ -266,11 +293,6 @@ BrowserPpapiHost*
   return NULL;
 }
 
-bool ContentBrowserClient::SupportsBrowserPlugin(
-    BrowserContext* browser_context, const GURL& site_url) {
-  return false;
-}
-
 bool ContentBrowserClient::AllowPepperSocketAPI(
     BrowserContext* browser_context,
     const GURL& url,
@@ -292,20 +314,39 @@ VibrationProvider* ContentBrowserClient::OverrideVibrationProvider() {
   return NULL;
 }
 
-#if defined(OS_WIN)
-const wchar_t* ContentBrowserClient::GetResourceDllName() {
+DevToolsManagerDelegate* ContentBrowserClient::GetDevToolsManagerDelegate() {
   return NULL;
 }
-#endif
 
 bool ContentBrowserClient::IsPluginAllowedToCallRequestOSFileHandle(
-    content::BrowserContext* browser_context,
+    BrowserContext* browser_context,
     const GURL& url) {
   return false;
 }
 
-bool ContentBrowserClient::IsPluginAllowedToUseDevChannelAPIs() {
+bool ContentBrowserClient::IsPluginAllowedToUseDevChannelAPIs(
+    BrowserContext* browser_context,
+    const GURL& url) {
   return false;
 }
 
+net::CookieStore* ContentBrowserClient::OverrideCookieStoreForRenderProcess(
+    int render_process_id) {
+  return NULL;
+}
+
+#if defined(OS_WIN)
+const wchar_t* ContentBrowserClient::GetResourceDllName() {
+  return NULL;
+}
+#endif
+
+#if defined(VIDEO_HOLE)
+ExternalVideoSurfaceContainer*
+ContentBrowserClient::OverrideCreateExternalVideoSurfaceContainer(
+    WebContents* web_contents) {
+  return NULL;
+}
+#endif
+
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index 8633105ed1a..d355596d8f7 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -16,40 +16,46 @@
 #include "base/memory/scoped_vector.h"
 #include "base/values.h"
 #include "content/public/browser/certificate_request_result_type.h"
-#include "content/public/browser/file_descriptor_info.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/socket_permission_request.h"
 #include "content/public/common/window_container_type.h"
 #include "net/base/mime_util.h"
 #include "net/cookies/canonical_cookie.h"
+#include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "third_party/WebKit/public/web/WebNotificationPresenter.h"
 #include "ui/base/window_open_disposition.h"
+#include "webkit/browser/fileapi/file_system_context.h"
 #include "webkit/common/resource_type.h"
 
 #if defined(OS_POSIX) && !defined(OS_MACOSX)
 #include "base/posix/global_descriptors.h"
 #endif
 
-class CommandLine;
+#if defined(OS_POSIX)
+#include "content/public/browser/file_descriptor_info.h"
+#endif
+
 class GURL;
 struct WebPreferences;
 
-namespace blink {
-struct WebWindowFeatures;
-}
-
 namespace base {
+class CommandLine;
 class DictionaryValue;
 class FilePath;
 }
 
+namespace blink {
+struct WebWindowFeatures;
+}
+
 namespace gfx {
 class ImageSkia;
 }
 
 namespace net {
 class CookieOptions;
+class CookieStore;
 class HttpNetworkSession;
 class NetLog;
 class SSLCertRequestInfo;
@@ -82,19 +88,21 @@ class BrowserMainParts;
 class BrowserPluginGuestDelegate;
 class BrowserPpapiHost;
 class BrowserURLHandler;
+class DesktopNotificationDelegate;
+class DevToolsManagerDelegate;
+class ExternalVideoSurfaceContainer;
 class LocationProvider;
 class MediaObserver;
 class QuotaPermissionContext;
+class RenderFrameHost;
 class RenderProcessHost;
 class RenderViewHost;
-class RenderViewHostDelegateView;
 class ResourceContext;
 class SiteInstance;
 class SpeechRecognitionManagerDelegate;
 class VibrationProvider;
 class WebContents;
 class WebContentsViewDelegate;
-class WebContentsViewPort;
 struct MainFunctionParams;
 struct Referrer;
 struct ShowDesktopNotificationHostMsgParams;
@@ -105,6 +113,10 @@ typedef std::map<
   std::string, linked_ptr<net::URLRequestJobFactory::ProtocolHandler> >
     ProtocolHandlerMap;
 
+// A scoped vector of protocol interceptors.
+typedef ScopedVector<net::URLRequestInterceptor>
+    URLRequestInterceptorScopedVector;
+
 // Embedder API (or SPI) for participating in browser logic, to be implemented
 // by the client of the content browser. See ChromeContentBrowserClient for the
 // principal implementation. The methods are assumed to be called on the UI
@@ -123,14 +135,6 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual BrowserMainParts* CreateBrowserMainParts(
       const MainFunctionParams& parameters);
 
-  // Allows an embedder to return their own WebContentsViewPort implementation.
-  // Return NULL to let the default one for the platform be created. Otherwise
-  // |render_view_host_delegate_view| also needs to be provided, and it is
-  // owned by the embedder.
-  virtual WebContentsViewPort* OverrideCreateWebContentsView(
-      WebContents* web_contents,
-      RenderViewHostDelegateView** render_view_host_delegate_view);
-
   // If content creates the WebContentsView implementation, it will ask the
   // embedder to return an (optional) delegate to customize it. The view will
   // own the delegate.
@@ -148,26 +152,17 @@ class CONTENT_EXPORT ContentBrowserClient {
   // the delegate in the content embedder that will service the guest in the
   // content layer. The content layer takes ownership of the |guest_delegate|.
   virtual void GuestWebContentsCreated(
+      int guest_instance_id,
       SiteInstance* guest_site_instance,
       WebContents* guest_web_contents,
       WebContents* opener_web_contents,
       BrowserPluginGuestDelegate** guest_delegate,
       scoped_ptr<base::DictionaryValue> extra_params) {}
 
-  // Notifies that a guest WebContents has been attached to a BrowserPlugin.
-  // A guest is attached to a BrowserPlugin when the guest has acquired an
-  // embedder WebContents. This happens on initial navigation or when a new
-  // window is attached to a BrowserPlugin. |extra_params| are params sent
-  // from javascript.
-  virtual void GuestWebContentsAttached(
-      WebContents* guest_web_contents,
-      WebContents* embedder_web_contents,
-      const base::DictionaryValue& extra_params) {}
-
-  // Notifies that a RenderProcessHost has been created. This is called before
+  // Notifies that a render process will be created. This is called before
   // the content layer adds its own BrowserMessageFilters, so that the
   // embedder's IPC filters have priority.
-  virtual void RenderProcessHostCreated(RenderProcessHost* host) {}
+  virtual void RenderProcessWillLaunch(RenderProcessHost* host) {}
 
   // Notifies that a BrowserChildProcessHost has been created.
   virtual void BrowserChildProcessHostCreated(BrowserChildProcessHost* host) {}
@@ -185,16 +180,23 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Returns a list additional WebUI schemes, if any.  These additional schemes
   // act as aliases to the chrome: scheme.  The additional schemes may or may
   // not serve specific WebUI pages depending on the particular URLDataSource
-  // and its override of URLDataSource::ShouldServiceRequest.
+  // and its override of URLDataSource::ShouldServiceRequest. For all schemes
+  // returned here, view-source is allowed.
   virtual void GetAdditionalWebUISchemes(
       std::vector<std::string>* additional_schemes) {}
 
+  // Returns a list of webUI hosts to ignore the storage partition check in
+  // URLRequestChromeJob::CheckStoragePartitionMatches.
+  virtual void GetAdditionalWebUIHostsToIgnoreParititionCheck(
+      std::vector<std::string>* hosts) {}
+
   // Creates the main net::URLRequestContextGetter. Should only be called once
   // per ContentBrowserClient object.
   // TODO(ajwong): Remove once http://crbug.com/159193 is resolved.
   virtual net::URLRequestContextGetter* CreateRequestContext(
       BrowserContext* browser_context,
-      ProtocolHandlerMap* protocol_handlers);
+      ProtocolHandlerMap* protocol_handlers,
+      URLRequestInterceptorScopedVector request_interceptors);
 
   // Creates the net::URLRequestContextGetter for a StoragePartition. Should
   // only be called once per partition_path per ContentBrowserClient object.
@@ -203,7 +205,8 @@ class CONTENT_EXPORT ContentBrowserClient {
       BrowserContext* browser_context,
       const base::FilePath& partition_path,
       bool in_memory,
-      ProtocolHandlerMap* protocol_handlers);
+      ProtocolHandlerMap* protocol_handlers,
+      URLRequestInterceptorScopedVector request_interceptors);
 
   // Returns whether a specified URL is handled by the embedder's internal
   // protocol handlers.
@@ -224,6 +227,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool IsSuitableHost(RenderProcessHost* process_host,
                               const GURL& site_url);
 
+  // Returns whether a new view for a new site instance can be added to a
+  // given |process_host|.
+  virtual bool MayReuseHost(RenderProcessHost* process_host);
+
   // Returns whether a new process should be created or an existing one should
   // be reused based on the URL we want to load. This should return false,
   // unless there is a good reason otherwise.
@@ -236,6 +243,14 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Called from a site instance's destructor.
   virtual void SiteInstanceDeleting(SiteInstance* site_instance) {}
 
+  // Called when a worker process is created.
+  virtual void WorkerProcessCreated(SiteInstance* site_instance,
+                                    int worker_process_id) {}
+
+  // Called when a worker process is terminated.
+  virtual void WorkerProcessTerminated(SiteInstance* site_instance,
+                                       int worker_process_id) {}
+
   // Returns true if for the navigation from |current_url| to |new_url|
   // in |site_instance|, a new SiteInstance and BrowsingInstance should be
   // created (even if we are in a process model that doesn't usually swap.)
@@ -263,7 +278,7 @@ class CONTENT_EXPORT ContentBrowserClient {
 
   // Allows the embedder to pass extra command line flags.
   // switches::kProcessType will already be set at this point.
-  virtual void AppendExtraCommandLineSwitches(CommandLine* command_line,
+  virtual void AppendExtraCommandLineSwitches(base::CommandLine* command_line,
                                               int child_process_id) {}
 
   // Returns the locale used by the application.
@@ -275,7 +290,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual std::string GetAcceptLangs(BrowserContext* context);
 
   // Returns the default favicon.  The callee doesn't own the given bitmap.
-  virtual gfx::ImageSkia* GetDefaultFavicon();
+  virtual const gfx::ImageSkia* GetDefaultFavicon();
 
   // Allow the embedder to control if an AppCache can be used for the given url.
   // This is called on the IO thread.
@@ -290,7 +305,7 @@ class CONTENT_EXPORT ContentBrowserClient {
                               const net::CookieList& cookie_list,
                               ResourceContext* context,
                               int render_process_id,
-                              int render_view_id);
+                              int render_frame_id);
 
   // Allow the embedder to control if the given cookie can be set.
   // This is called on the IO thread.
@@ -299,15 +314,15 @@ class CONTENT_EXPORT ContentBrowserClient {
                               const std::string& cookie_line,
                               ResourceContext* context,
                               int render_process_id,
-                              int render_view_id,
+                              int render_frame_id,
                               net::CookieOptions* options);
 
   // This is called on the IO thread.
   virtual bool AllowSaveLocalState(ResourceContext* context);
 
   // Allow the embedder to control if access to web database by a shared worker
-  // is allowed. |render_views| is a vector of pairs of
-  // RenderProcessID/RenderViewID of RenderViews that are using this worker.
+  // is allowed. |render_frame| is a vector of pairs of
+  // RenderProcessID/RenderFrameID of RenderFrame that are using this worker.
   // This is called on the IO thread.
   virtual bool AllowWorkerDatabase(
       const GURL& url,
@@ -315,7 +330,7 @@ class CONTENT_EXPORT ContentBrowserClient {
       const base::string16& display_name,
       unsigned long estimated_size,
       ResourceContext* context,
-      const std::vector<std::pair<int, int> >& render_views);
+      const std::vector<std::pair<int, int> >& render_frames);
 
   // Allow the embedder to control if access to file system by a shared worker
   // is allowed.
@@ -323,7 +338,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool AllowWorkerFileSystem(
       const GURL& url,
       ResourceContext* context,
-      const std::vector<std::pair<int, int> >& render_views);
+      const std::vector<std::pair<int, int> >& render_frames);
 
   // Allow the embedder to control if access to IndexedDB by a shared worker
   // is allowed.
@@ -332,7 +347,7 @@ class CONTENT_EXPORT ContentBrowserClient {
       const GURL& url,
       const base::string16& name,
       ResourceContext* context,
-      const std::vector<std::pair<int, int> >& render_views);
+      const std::vector<std::pair<int, int> >& render_frames);
 
   // Allow the embedder to override the request context based on the URL for
   // certain operations, like cookie access. Returns NULL to indicate the
@@ -344,7 +359,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Allow the embedder to specify a string version of the storage partition
   // config with a site.
   virtual std::string GetStoragePartitionIdForSite(
-      content::BrowserContext* browser_context,
+      BrowserContext* browser_context,
       const GURL& site);
 
   // Allows the embedder to provide a validation check for |partition_id|s.
@@ -369,7 +384,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // |in_memory| values. When a partition is not to be persisted, the
   // |in_memory| value must be set to true.
   virtual void GetStoragePartitionConfigForSite(
-      content::BrowserContext* browser_context,
+      BrowserContext* browser_context,
       const GURL& site,
       bool can_be_default,
       std::string* partition_domain,
@@ -387,7 +402,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // or denied immediately, and the callback won't be run.
   virtual void AllowCertificateError(
       int render_process_id,
-      int render_view_id,
+      int render_frame_id,
       int cert_error,
       const net::SSLInfo& ssl_info,
       const GURL& request_url,
@@ -401,7 +416,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // certificate was selected NULL is returned to the |callback|.
   virtual void SelectClientCertificate(
       int render_process_id,
-      int render_view_id,
+      int render_frame_id,
       const net::HttpNetworkSession* network_session,
       net::SSLCertRequestInfo* cert_request_info,
       const base::Callback<void(net::X509Certificate*)>& callback) {}
@@ -409,25 +424,23 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Adds a new installable certificate or private key.
   // Typically used to install an X.509 user certificate.
   // Note that it's up to the embedder to verify that the data is
-  // well-formed. |cert_data| will be NULL if file_size is 0.
-  virtual void AddCertificate(
-      net::URLRequest* request,
-      net::CertificateMimeType cert_type,
-      const void* cert_data,
-      size_t cert_size,
-      int render_process_id,
-      int render_view_id) {}
+  // well-formed. |cert_data| will be NULL if |cert_size| is 0.
+  virtual void AddCertificate(net::CertificateMimeType cert_type,
+                              const void* cert_data,
+                              size_t cert_size,
+                              int render_process_id,
+                              int render_frame_id) {}
 
   // Returns a class to get notifications about media event. The embedder can
   // return NULL if they're not interested.
   virtual MediaObserver* GetMediaObserver();
 
-  // Asks permission to show desktop notifications.
+  // Asks permission to show desktop notifications. |callback| needs to be run
+  // when the user approves the request.
   virtual void RequestDesktopNotificationPermission(
       const GURL& source_origin,
-      int callback_context,
-      int render_process_id,
-      int render_view_id) {}
+      RenderFrameHost* render_frame_host,
+      const base::Closure& callback) {}
 
   // Checks if the given page has permission to show desktop notifications.
   // This is called on the IO thread.
@@ -437,19 +450,46 @@ class CONTENT_EXPORT ContentBrowserClient {
           ResourceContext* context,
           int render_process_id);
 
-  // Show a desktop notification.  If |worker| is true, the request came from an
-  // HTML5 web worker, otherwise, it came from a renderer.
+  // Show a desktop notification. If |cancel_callback| is non-null, it's set to
+  // a callback which can be used to cancel the notification.
   virtual void ShowDesktopNotification(
       const ShowDesktopNotificationHostMsgParams& params,
-      int render_process_id,
-      int render_view_id,
-      bool worker) {}
-
-  // Cancels a displayed desktop notification.
-  virtual void CancelDesktopNotification(
-      int render_process_id,
-      int render_view_id,
-      int notification_id) {}
+      RenderFrameHost* render_frame_host,
+      DesktopNotificationDelegate* delegate,
+      base::Closure* cancel_callback) {}
+
+  // The renderer is requesting permission to use Geolocation. When the answer
+  // to a permission request has been determined, |result_callback| should be
+  // called with the result. If |cancel_callback| is non-null, it's set to a
+  // callback which can be used to cancel the permission request.
+  virtual void RequestGeolocationPermission(
+      WebContents* web_contents,
+      int bridge_id,
+      const GURL& requesting_frame,
+      bool user_gesture,
+      base::Callback<void(bool)> result_callback,
+      base::Closure* cancel_callback);
+
+  // Requests a permission to use system exclusive messages in MIDI events.
+  // |result_callback| will be invoked when the request is resolved. If
+  // |cancel_callback| is non-null, it's set to a callback which can be used to
+  // cancel the permission request.
+  virtual void RequestMidiSysExPermission(
+      WebContents* web_contents,
+      int bridge_id,
+      const GURL& requesting_frame,
+      bool user_gesture,
+      base::Callback<void(bool)> result_callback,
+      base::Closure* cancel_callback);
+
+  // Request permission to access protected media identifier. |result_callback
+  // will tell whether it's permitted. If |cancel_callback| is non-null, it's
+  // set to a callback which can be used to cancel the permission request.
+  virtual void RequestProtectedMediaIdentifierPermission(
+      WebContents* web_contents,
+      const GURL& origin,
+      base::Callback<void(bool)> result_callback,
+      base::Closure* cancel_callback);
 
   // Returns true if the given page is allowed to open a window of the given
   // type. If true is returned, |no_javascript_access| will indicate whether
@@ -460,14 +500,13 @@ class CONTENT_EXPORT ContentBrowserClient {
                                const GURL& source_origin,
                                WindowContainerType container_type,
                                const GURL& target_url,
-                               const content::Referrer& referrer,
+                               const Referrer& referrer,
                                WindowOpenDisposition disposition,
                                const blink::WebWindowFeatures& features,
                                bool user_gesture,
                                bool opener_suppressed,
-                               content::ResourceContext* context,
+                               ResourceContext* context,
                                int render_process_id,
-                               bool is_guest,
                                int opener_id,
                                bool* no_javascript_access);
 
@@ -531,14 +570,9 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void DidCreatePpapiPlugin(BrowserPpapiHost* browser_host) {}
 
   // Gets the host for an external out-of-process plugin.
-  virtual content::BrowserPpapiHost* GetExternalBrowserPpapiHost(
+  virtual BrowserPpapiHost* GetExternalBrowserPpapiHost(
       int plugin_child_id);
 
-  // Returns true if the given browser_context and site_url support hosting
-  // BrowserPlugins.
-  virtual bool SupportsBrowserPlugin(BrowserContext* browser_context,
-                                     const GURL& site_url);
-
   // Returns true if the socket operation specified by |params| is allowed from
   // the given |browser_context| and |url|. If |params| is NULL, this method
   // checks the basic "socket" permission, which is for those operations that
@@ -559,6 +593,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void GetAdditionalAllowedSchemesForFileSystem(
       std::vector<std::string>* additional_schemes) {}
 
+  // Returns auto mount handlers for URL requests for FileSystem APIs.
+  virtual void GetURLRequestAutoMountHandlers(
+      std::vector<fileapi::URLRequestAutoMountHandler>* handlers) {}
+
   // Returns additional file system backends for FileSystem API.
   // |browser_context| is needed in the additional FileSystemBackends.
   // It has mount points to create objects returned by additional
@@ -582,11 +620,32 @@ class CONTENT_EXPORT ContentBrowserClient {
   // information.
   virtual VibrationProvider* OverrideVibrationProvider();
 
+  // Creates a new DevToolsManagerDelegate. The caller owns the returned value.
+  // It's valid to return NULL.
+  virtual DevToolsManagerDelegate* GetDevToolsManagerDelegate();
+
+  // Returns true if plugin referred to by the url can use
+  // pp::FileIO::RequestOSFileHandle.
+  virtual bool IsPluginAllowedToCallRequestOSFileHandle(
+      BrowserContext* browser_context,
+      const GURL& url);
+
+  // Returns true if dev channel APIs are available for plugins.
+  virtual bool IsPluginAllowedToUseDevChannelAPIs(
+      BrowserContext* browser_context,
+      const GURL& url);
+
+  // Returns a special cookie store to use for a given render process, or NULL
+  // if the default cookie store should be used
+  // This is called on the IO thread.
+  virtual net::CookieStore* OverrideCookieStoreForRenderProcess(
+      int render_process_id);
+
 #if defined(OS_POSIX) && !defined(OS_MACOSX)
   // Populates |mappings| with all files that need to be mapped before launching
   // a child process.
   virtual void GetAdditionalMappedFilesForChildProcess(
-      const CommandLine& command_line,
+      const base::CommandLine& command_line,
       int child_process_id,
       std::vector<FileDescriptorInfo>* mappings) {}
 #endif
@@ -602,14 +661,12 @@ class CONTENT_EXPORT ContentBrowserClient {
                                 bool* success) {}
 #endif
 
-  // Returns true if plugin referred to by the url can use
-  // pp::FileIO::RequestOSFileHandle.
-  virtual bool IsPluginAllowedToCallRequestOSFileHandle(
-      content::BrowserContext* browser_context,
-      const GURL& url);
-
-  // Returns true if dev channel APIs are available for plugins.
-  virtual bool IsPluginAllowedToUseDevChannelAPIs();
+#if defined(VIDEO_HOLE)
+  // Allows an embedder to provide its own ExternalVideoSurfaceContainer
+  // implementation.  Return NULL to disable external surface video.
+  virtual ExternalVideoSurfaceContainer*
+  OverrideCreateExternalVideoSurfaceContainer(WebContents* web_contents);
+#endif
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/context_factory.h b/chromium/content/public/browser/context_factory.h
new file mode 100644
index 00000000000..07f2462279b
--- /dev/null
+++ b/chromium/content/public/browser/context_factory.h
@@ -0,0 +1,22 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_CONTEXT_FACTORY_H_
+#define CONTENT_PUBLIC_BROWSER_CONTEXT_FACTORY_H_
+
+#include "content/common/content_export.h"
+
+namespace ui {
+class ContextFactory;
+}
+
+namespace content {
+
+// Returns the singleton ContextFactory used by content. The return value is
+// owned by content.
+CONTENT_EXPORT ui::ContextFactory* GetContextFactory();
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_CONTEXT_FACTORY_H_
diff --git a/chromium/content/public/browser/cookie_store_factory.h b/chromium/content/public/browser/cookie_store_factory.h
index 300178ed85c..ec2243fcb10 100644
--- a/chromium/content/public/browser/cookie_store_factory.h
+++ b/chromium/content/public/browser/cookie_store_factory.h
@@ -5,11 +5,17 @@
 #ifndef CONTENT_PUBLIC_BROWSER_COOKIE_STORE_FACTORY_H_
 #define CONTENT_PUBLIC_BROWSER_COOKIE_STORE_FACTORY_H_
 
+#include "base/files/file_path.h"
+#include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
-#include "net/cookies/cookie_monster.h"
 
 namespace base {
-class FilePath;
+class SequencedTaskRunner;
+}
+
+namespace net {
+class CookieMonsterDelegate;
+class CookieStore;
 }
 
 namespace quota {
@@ -19,24 +25,72 @@ class SpecialStoragePolicy;
 namespace content {
 class CookieCryptoDelegate;
 
-// All blocking database accesses will be performed on |background_task_runner|.
-// Callbacks for data load events will be performed on |client_task_runner|.
-CONTENT_EXPORT net::CookieStore* CreatePersistentCookieStore(
-    const base::FilePath& path,
-    bool restore_old_session_cookies,
-    quota::SpecialStoragePolicy* storage_policy,
-    net::CookieMonster::Delegate* cookie_monster_delegate,
-    const scoped_refptr<base::SequencedTaskRunner>& client_task_runner,
-    const scoped_refptr<base::SequencedTaskRunner>& background_task_runner,
-    scoped_ptr<CookieCryptoDelegate> crypto_delegate);
-
-// Uses the default client_task_runner and background_task_runner.
-CONTENT_EXPORT net::CookieStore* CreatePersistentCookieStore(
-    const base::FilePath& path,
-    bool restore_old_session_cookies,
-    quota::SpecialStoragePolicy* storage_policy,
-    net::CookieMonster::Delegate* cookie_monster_delegate,
-    scoped_ptr<CookieCryptoDelegate> crypto_delegate);
+struct CONTENT_EXPORT CookieStoreConfig {
+  // Specifies how session cookies are persisted in the backing data store.
+  //
+  // EPHEMERAL_SESSION_COOKIES specifies session cookies will not be written
+  // out in a manner that allows for restoration.
+  //
+  // PERSISTANT_SESSION_COOKIES specifies that session cookies are not restored
+  // when the cookie store is opened, however they will be written in a manner
+  // that allows for them to be restored if the cookie store is opened again
+  // using RESTORED_SESSION_COOKIES.
+  //
+  // RESTORED_SESSION_COOKIES is the: same as PERSISTANT_SESSION_COOKIES
+  // except when the cookie store is opened, the previously written session
+  // cookies are loaded first.
+  enum SessionCookieMode {
+    EPHEMERAL_SESSION_COOKIES,
+    PERSISTANT_SESSION_COOKIES,
+    RESTORED_SESSION_COOKIES
+  };
+
+  // Convenience constructor for an in-memory cookie store with no delegate.
+  CookieStoreConfig();
+
+  // If |path| is empty, then this specifies an in-memory cookie store.
+  // With in-memory cookie stores, |session_cookie_mode| must be
+  // EPHEMERAL_SESSION_COOKIES.
+  //
+  // Note: If |crypto_delegate| is non-NULL, it must outlive any CookieStores
+  // created using this config.
+  CookieStoreConfig(const base::FilePath& path,
+                    SessionCookieMode session_cookie_mode,
+                    quota::SpecialStoragePolicy* storage_policy,
+                    net::CookieMonsterDelegate* cookie_delegate);
+  ~CookieStoreConfig();
+
+  const base::FilePath path;
+  const SessionCookieMode session_cookie_mode;
+  const scoped_refptr<quota::SpecialStoragePolicy> storage_policy;
+  const scoped_refptr<net::CookieMonsterDelegate> cookie_delegate;
+
+  // The following are infrequently used cookie store parameters.
+  // Rather than clutter the constructor API, these are assigned a default
+  // value on CookieStoreConfig construction. Clients should then override
+  // them as necessary.
+
+  // Used to provide encryption hooks for the cookie store. The
+  // CookieCryptoDelegate must outlive any cookie store created with this
+  // config.
+  content::CookieCryptoDelegate* crypto_delegate;
+
+  // Callbacks for data load events will be performed on |client_task_runner|.
+  // If NULL, uses the task runner for BrowserThread::IO.
+  //
+  // Only used for persistent cookie stores.
+  scoped_refptr<base::SequencedTaskRunner> client_task_runner;
+
+  // All blocking database accesses will be performed on
+  // |background_task_runner|.  If NULL, uses a SequencedTaskRunner from the
+  // BrowserThread blocking pool.
+  //
+  // Only used for persistent cookie stores.
+  scoped_refptr<base::SequencedTaskRunner> background_task_runner;
+};
+
+CONTENT_EXPORT net::CookieStore* CreateCookieStore(
+    const CookieStoreConfig& config);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/desktop_notification_delegate.h b/chromium/content/public/browser/desktop_notification_delegate.h
new file mode 100644
index 00000000000..27c5fd7f28c
--- /dev/null
+++ b/chromium/content/public/browser/desktop_notification_delegate.h
@@ -0,0 +1,31 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_DESKTOP_NOTIFICATION_DELEGATE_H_
+#define CONTENT_PUBLIC_BROWSER_DESKTOP_NOTIFICATION_DELEGATE_H_
+
+namespace content {
+
+// A delegate used by ContentBrowserClient::ShowDesktopNotification to report
+// the result of a desktop notification.
+class DesktopNotificationDelegate {
+ public:
+  virtual ~DesktopNotificationDelegate() {}
+
+  // The notification was shown.
+  virtual void NotificationDisplayed() = 0;
+
+  // The notification couldn't be shown due to an error.
+  virtual void NotificationError() = 0;
+
+  // The notification was closed.
+  virtual void NotificationClosed(bool by_user) = 0;
+
+  // The user clicked on the notification.
+  virtual void NotificationClick() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_DESKTOP_NOTIFICATION_DELEGATE_H_
diff --git a/chromium/content/public/browser/devtools_agent_host.h b/chromium/content/public/browser/devtools_agent_host.h
index 3b0881c1ab7..dd18a53886b 100644
--- a/chromium/content/public/browser/devtools_agent_host.h
+++ b/chromium/content/public/browser/devtools_agent_host.h
@@ -14,6 +14,7 @@
 
 namespace content {
 
+class DevToolsExternalAgentProxyDelegate;
 class RenderViewHost;
 class WebContents;
 
@@ -24,6 +25,11 @@ class CONTENT_EXPORT DevToolsAgentHost
   // Returns DevToolsAgentHost with a given |id| or NULL of it does not exist.
   static scoped_refptr<DevToolsAgentHost> GetForId(const std::string& id);
 
+  // Returns DevToolsAgentHost that can be used for inspecting |web_contents|.
+  // New DevToolsAgentHost will be created if it does not exist.
+  static scoped_refptr<DevToolsAgentHost> GetOrCreateFor(
+      WebContents* web_contents);
+
   // Returns DevToolsAgentHost that can be used for inspecting |rvh|.
   // New DevToolsAgentHost will be created if it does not exist.
   static scoped_refptr<DevToolsAgentHost> GetOrCreateFor(RenderViewHost* rvh);
@@ -37,10 +43,11 @@ class CONTENT_EXPORT DevToolsAgentHost
   static scoped_refptr<DevToolsAgentHost> GetForWorker(int worker_process_id,
                                                        int worker_route_id);
 
-  // Returns true iff an instance of DevToolsAgentHost exists for the shared
-  // worker with given process host id and routing id.
-  static bool HasForWorker(int worker_process_id,
-                           int worker_route_id);
+  // Creates DevToolsAgentHost that communicates to the target by means of
+  // provided |delegate|. |delegate| ownership is passed to the created agent
+  // host.
+  static scoped_refptr<DevToolsAgentHost> Create(
+      DevToolsExternalAgentProxyDelegate* delegate);
 
   static bool IsDebuggerAttached(WebContents* web_contents);
 
@@ -66,6 +73,9 @@ class CONTENT_EXPORT DevToolsAgentHost
   // Attaches render view host to this host.
   virtual void ConnectRenderViewHost(RenderViewHost* rvh) = 0;
 
+  // Returns true if DevToolsAgentHost is for worker.
+  virtual bool IsWorker() const = 0;
+
  protected:
   friend class base::RefCounted<DevToolsAgentHost>;
   virtual ~DevToolsAgentHost() {}
diff --git a/chromium/content/public/browser/devtools_external_agent_proxy.h b/chromium/content/public/browser/devtools_external_agent_proxy.h
index 25d701688b3..d95fd7ab32b 100644
--- a/chromium/content/public/browser/devtools_external_agent_proxy.h
+++ b/chromium/content/public/browser/devtools_external_agent_proxy.h
@@ -17,15 +17,6 @@ class DevToolsExternalAgentProxyDelegate;
 // Describes interface for communication with an external DevTools agent.
 class DevToolsExternalAgentProxy {
  public:
-  // Creates DevToolsExternalAgentProxy to communicate with an agent
-  // via the provided |delegate|.
-  // Caller get the proxy ownership and keeps the |delegate| ownership.
-  static CONTENT_EXPORT DevToolsExternalAgentProxy* Create(
-      DevToolsExternalAgentProxyDelegate* delegate);
-
-  // Returns the local DevToolsAgentHost for the external agent.
-  virtual scoped_refptr<DevToolsAgentHost> GetAgentHost() = 0;
-
   // Sends the message to the client host.
   virtual void DispatchOnClientHost(const std::string& message) = 0;
 
diff --git a/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h b/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h
index d68854f23ce..3d55c9a7ec5 100644
--- a/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h
+++ b/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h
@@ -11,20 +11,21 @@
 
 namespace content {
 
+class DevToolsExternalAgentProxy;
+
 // Describes the interface for sending messages to an external DevTools agent.
 class DevToolsExternalAgentProxyDelegate {
  public:
+   virtual ~DevToolsExternalAgentProxyDelegate() {}
+
    // Informs the agent that a client host has attached.
-   virtual void Attach() = 0;
+   virtual void Attach(DevToolsExternalAgentProxy* proxy) = 0;
 
    // Informs the agent that a client host has detached.
    virtual void Detach() = 0;
 
    // Sends a message to the agent.
    virtual void SendMessageToBackend(const std::string& message) = 0;
-
- protected:
-  virtual ~DevToolsExternalAgentProxyDelegate() {}
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/devtools_http_handler.h b/chromium/content/public/browser/devtools_http_handler.h
index 4af55059da9..cdceff8dfd4 100644
--- a/chromium/content/public/browser/devtools_http_handler.h
+++ b/chromium/content/public/browser/devtools_http_handler.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/files/file_path.h"
 #include "content/common/content_export.h"
 
 class GURL;
@@ -34,10 +35,15 @@ class DevToolsHttpHandler {
       const std::string& name);
 
   // Takes ownership over |socket_factory| and |delegate|.
+  // If |active_port_output_directory| is non-empty, it is assumed the
+  // socket_factory was initialized with an ephemeral port (0). The
+  // port selected by the OS will be written to a well-known file in
+  // the output directory.
   CONTENT_EXPORT static DevToolsHttpHandler* Start(
       const net::StreamListenSocketFactory* socket_factory,
       const std::string& frontend_url,
-      DevToolsHttpHandlerDelegate* delegate);
+      DevToolsHttpHandlerDelegate* delegate,
+      const base::FilePath& active_port_output_directory);
 
   // Called from the main thread in order to stop protocol handler.
   // Automatically destroys the handler instance.
diff --git a/chromium/content/public/browser/devtools_manager_delegate.h b/chromium/content/public/browser/devtools_manager_delegate.h
new file mode 100644
index 00000000000..d34e7af3957
--- /dev/null
+++ b/chromium/content/public/browser/devtools_manager_delegate.h
@@ -0,0 +1,36 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_DEVTOOLS_MANAGER_DELEGATE_H_
+#define CONTENT_PUBLIC_BROWSER_DEVTOOLS_MANAGER_DELEGATE_H_
+
+namespace base {
+class DictionaryValue;
+}
+
+namespace content {
+
+class BrowserContext;
+class DevToolsAgentHost;
+
+class DevToolsManagerDelegate {
+ public:
+  virtual ~DevToolsManagerDelegate() {}
+
+  // Opens the inspector for |agent_host|.
+  virtual void Inspect(BrowserContext* browser_context,
+                       DevToolsAgentHost* agent_host) = 0;
+
+  virtual void DevToolsAgentStateChanged(DevToolsAgentHost* agent_host,
+                                         bool attached) = 0;
+
+  // Result ownership is passed to the caller.
+  virtual base::DictionaryValue* HandleCommand(
+      DevToolsAgentHost* agent_host,
+      base::DictionaryValue* command) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_DEVTOOLS_MANAGER_DELEGATE_H_
diff --git a/chromium/content/public/browser/devtools_protocol_constants_generator.py b/chromium/content/public/browser/devtools_protocol_constants_generator.py
new file mode 100755
index 00000000000..3447fb1dfbf
--- /dev/null
+++ b/chromium/content/public/browser/devtools_protocol_constants_generator.py
@@ -0,0 +1,211 @@
+#!/usr/bin/python
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+import string
+import json
+
+package = sys.argv[1]
+output_cc_path = sys.argv[2]
+output_h_path = sys.argv[3]
+blink_protocol_path = sys.argv[4]
+browser_protocol_path = sys.argv[5] if len(sys.argv) > 5 else None
+
+template_h = string.Template("""\
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ${PACKAGE}_BROWSER_DEVTOOLS_DEVTOOLS_PROTOCOL_CONSTANTS_H_
+#define ${PACKAGE}_BROWSER_DEVTOOLS_DEVTOOLS_PROTOCOL_CONSTANTS_H_
+
+// THIS FILE IS AUTOGENERATED. DO NOT EDIT.
+// Generated by
+//  content/public/browser/devtools_protocol_constants_generator.py from
+//  third_party/WebKit/Source/devtools/protocol.json and
+//  content/browser/devtools/browser_protocol.json
+
+#include <string>
+
+namespace $package {
+namespace devtools {
+
+extern const char kProtocolVersion[];
+
+bool IsSupportedProtocolVersion(const std::string& version);
+
+extern const char kResult[];
+$contents
+
+}  // devtools
+}  // $package
+
+#endif  // ${PACKAGE}_BROWSER_DEVTOOLS_DEVTOOLS_PROTOCOL_CONSTANTS_H_
+""")
+
+template_cc = string.Template("""\
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// THIS FILE IS AUTOGENERATED. DO NOT EDIT.
+// Generated by
+//  content/public/browser/devtools_protocol_constants_generator.py from
+//  third_party/WebKit/Source/devtools/protocol.json and
+//  content/browser/devtools/browser_protocol.json
+
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
+#include "$package/browser/devtools/devtools_protocol_constants.h"
+
+namespace $package {
+namespace devtools {
+
+const char kProtocolVersion[] = "$major.$minor";
+
+bool IsSupportedProtocolVersion(const std::string& version) {
+  std::vector<std::string> tokens;
+  Tokenize(version, ".", &tokens);
+  int major, minor;
+  return tokens.size() == 2 &&
+      base::StringToInt(tokens[0], &major) && major == $major &&
+      base::StringToInt(tokens[1], &minor) && minor <= $minor;
+}
+
+const char kResult[] = "result";
+$contents
+
+}  // devtools
+}  // $package
+""")
+
+def Capitalize(s):
+  return s[:1].capitalize() + s[1:]
+
+references = []
+
+def CreateNamespace(domain_name, data, keys, prefixes, name = None):
+  result = {}
+  if name:
+    result["kName"] = name
+  for i, key in enumerate(keys):
+    if key in data:
+      for parameter in data[key]:
+        parameter_name = parameter["name"];
+        result[prefixes[i] + Capitalize(parameter_name)] = parameter_name
+        if "enum" in parameter:
+          enum_name = Capitalize(parameter_name)
+          result[enum_name] = {}
+          for enum in parameter["enum"]:
+            result[enum_name]["kEnum" + Capitalize(enum)] = enum
+        reference = ""
+        if "$ref" in parameter:
+          reference = parameter["$ref"]
+        if "items" in parameter and "$ref" in parameter["items"]:
+          reference = parameter["items"]["$ref"]
+        if reference:
+          if not "." in reference:
+            reference = domain_name + "." + reference
+          references.append(reference)
+  return result
+
+def IsHandledInBrowser(item):
+  return "handlers" in item and "browser" in item["handlers"]
+
+def FormatContents(tree, indent, format_string):
+  outer = dict((key, value) for key, value in tree.iteritems()
+                if not isinstance(value, dict))
+  inner = dict((key, value) for key, value in tree.iteritems()
+              if isinstance(value, dict))
+  body = ""
+  body += "".join(indent + format_string.format(key, value)
+                 for (key, value) in sorted(outer.items()))
+  body += "".join(FormatNamespace(key, value, indent, format_string)
+                 for (key, value) in sorted(inner.items()))
+  return body
+
+def FormatNamespace(title, tree, indent, format_string):
+  if (not tree):
+    return ""
+  body = '\n' + indent + "namespace " + title + " {\n"
+  body += FormatContents(tree, indent + "  ", format_string)
+  body += indent + "} // " + title + "\n"
+  return body
+
+def CreateHeader(tree, output_file):
+  contents = FormatContents(tree, "", "extern const char {0}[];\n")
+  output_file.write(template_h.substitute({
+      "contents": contents,
+      "package": package,
+      "PACKAGE": package.upper()
+  }))
+
+def CreateBody(tree, version, output_file):
+  contents = FormatContents(tree, "", "const char {0}[] = \"{1}\";\n")
+  output_file.write(template_cc.substitute({
+      "major": version["major"],
+      "minor": version["minor"],
+      "contents": contents,
+      "package": package
+  }))
+
+blink_protocol_data = open(blink_protocol_path).read()
+blink_protocol = json.loads(blink_protocol_data)
+blink_version = blink_protocol["version"]
+
+domains = blink_protocol["domains"]
+
+if browser_protocol_path:
+  browser_protocol_data = open(browser_protocol_path).read()
+  browser_protocol = json.loads(browser_protocol_data)
+  domains = domains + browser_protocol["domains"]
+
+namespace_tree = {}
+
+for domain in domains:
+  domain_value = {}
+  domain_namespace_name = Capitalize(domain["domain"])
+  if "commands" in domain:
+    for command in domain["commands"]:
+      if (IsHandledInBrowser(command)):
+        domain_value[command["name"]] = CreateNamespace(domain["domain"],
+            command, ["parameters", "returns"], ["kParam", "kResponse"],
+            domain_namespace_name + "." + command["name"])
+
+  if "events" in domain:
+    for event in domain["events"]:
+      if IsHandledInBrowser(event):
+        domain_value[event["name"]] = CreateNamespace(domain["domain"],
+            event, ["parameters"], ["kParam"],
+            domain_namespace_name + "." + event["name"])
+  if domain_value:
+    namespace_tree[domain_namespace_name] = domain_value
+
+while (references):
+  reference = references.pop();
+  path = reference.split(".");
+  parent_namespace = namespace_tree;
+  for path_segment in path[0:-1]:
+    if path_segment not in parent_namespace:
+      parent_namespace[path_segment] = {}
+    parent_namespace = parent_namespace[path_segment]
+  if (path[-1] not in parent_namespace):
+    try:
+      domain = [d for d in domains if d["domain"] == path[0]][0]
+      ref_type = [t for t in domain["types"] if t["id"] == path[1]][0]
+      parent_namespace[ref_type["id"]] = CreateNamespace(path[0],
+          ref_type, ["properties"], ["kParam"])
+    except IndexError:
+      sys.stderr.write("Failed to resolve type [{0}].\n".format(reference))
+      sys.exit(1)
+
+for (namespace_name, namespace) in namespace_tree.items():
+  namespace["kName"] = namespace_name
+
+with open(output_cc_path, "w") as f:
+  CreateBody(namespace_tree, blink_version, f)
+
+with open(output_h_path, "w") as f:
+  CreateHeader(namespace_tree, f)
diff --git a/chromium/content/public/browser/devtools_target.h b/chromium/content/public/browser/devtools_target.h
index 3fcac0572f3..80085350ae1 100644
--- a/chromium/content/public/browser/devtools_target.h
+++ b/chromium/content/public/browser/devtools_target.h
@@ -28,6 +28,9 @@ class DevToolsTarget {
   // Returns the unique target id.
   virtual std::string GetId() const = 0;
 
+  // Returns the id of the parent target, or empty string if no parent.
+  virtual std::string GetParentId() const = 0;
+
   // Returns the target type.
   virtual std::string GetType() const = 0;
 
@@ -38,10 +41,10 @@ class DevToolsTarget {
   virtual std::string GetDescription() const = 0;
 
   // Returns the url associated with this target.
-  virtual GURL GetUrl() const = 0;
+  virtual GURL GetURL() const = 0;
 
   // Returns the favicon url for this target.
-  virtual GURL GetFaviconUrl() const = 0;
+  virtual GURL GetFaviconURL() const = 0;
 
   // Returns the time when the target was last active.
   virtual base::TimeTicks GetLastActivityTime() const = 0;
diff --git a/chromium/content/public/browser/download_interrupt_reason_values.h b/chromium/content/public/browser/download_interrupt_reason_values.h
index fcfa74aa636..b05207a5fb9 100644
--- a/chromium/content/public/browser/download_interrupt_reason_values.h
+++ b/chromium/content/public/browser/download_interrupt_reason_values.h
@@ -70,6 +70,12 @@ INTERRUPT_REASON(NETWORK_DISCONNECTED, 22)
 // "Server Down".
 INTERRUPT_REASON(NETWORK_SERVER_DOWN, 23)
 
+// The network request was invalid. This may be due to the original URL or a
+// redirected URL:
+// - Having an unsupported scheme.
+// - Being an invalid URL.
+// - Being disallowed by policy.
+INTERRUPT_REASON(NETWORK_INVALID_REQUEST, 24)
 
 // Server responses.
 
diff --git a/chromium/content/public/browser/download_interrupt_reasons.h b/chromium/content/public/browser/download_interrupt_reasons.h
index ebeef3a9b3d..78a81a035e4 100644
--- a/chromium/content/public/browser/download_interrupt_reasons.h
+++ b/chromium/content/public/browser/download_interrupt_reasons.h
@@ -21,7 +21,7 @@ enum DownloadInterruptReason {
 #undef INTERRUPT_REASON
 };
 
-std::string CONTENT_EXPORT InterruptReasonDebugString(
+std::string CONTENT_EXPORT DownloadInterruptReasonToString(
     DownloadInterruptReason error);
 
 }  // namespace content
diff --git a/chromium/content/public/browser/download_item.h b/chromium/content/public/browser/download_item.h
index 5ef9597a05f..1e66f8b8a0d 100644
--- a/chromium/content/public/browser/download_item.h
+++ b/chromium/content/public/browser/download_item.h
@@ -181,6 +181,8 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
   virtual const std::vector<GURL>& GetUrlChain() const = 0;
   virtual const GURL& GetOriginalUrl() const = 0;
   virtual const GURL& GetReferrerUrl() const = 0;
+  virtual const GURL& GetTabUrl() const = 0;
+  virtual const GURL& GetTabReferrerUrl() const = 0;
   virtual std::string GetSuggestedFilename() const = 0;
   virtual std::string GetContentDisposition() const = 0;
   virtual std::string GetMimeType() const = 0;
@@ -236,10 +238,16 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
   virtual bool GetFileExternallyRemoved() const = 0;
 
   // If the file is successfully deleted, then GetFileExternallyRemoved() will
-  // become true and DownloadItem::OnDownloadUpdated() will be called. Does
-  // nothing if GetState() == COMPLETE or GetFileExternallyRemoved() is already
-  // true.
-  virtual void DeleteFile() = 0;
+  // become true, GetFullPath() will become empty, and
+  // DownloadItem::OnDownloadUpdated() will be called. Does nothing if
+  // GetState() == COMPLETE or GetFileExternallyRemoved() is already true or
+  // GetFullPath() is already empty. The callback is always run, and it is
+  // always run asynchronously. It will be passed true if the file is
+  // successfully deleted or if GetFilePath() was already empty or if
+  // GetFileExternallyRemoved() was already true. The callback will be passed
+  // false if the DownloadItem was not yet complete or if the file could not be
+  // deleted for any reason.
+  virtual void DeleteFile(const base::Callback<void(bool)>& callback) = 0;
 
   // True if the file that will be written by the download is dangerous
   // and we will require a call to ValidateDangerousDownload() to complete.
diff --git a/chromium/content/public/browser/download_manager.h b/chromium/content/public/browser/download_manager.h
index 6bb1f35156d..0c9bbacaa47 100644
--- a/chromium/content/public/browser/download_manager.h
+++ b/chromium/content/public/browser/download_manager.h
@@ -142,6 +142,8 @@ class CONTENT_EXPORT DownloadManager : public base::SupportsUserData::Data {
       const base::FilePath& target_path,
       const std::vector<GURL>& url_chain,
       const GURL& referrer_url,
+      const std::string& mime_type,
+      const std::string& original_mime_type,
       const base::Time& start_time,
       const base::Time& end_time,
       const std::string& etag,
diff --git a/chromium/content/public/browser/download_save_info.h b/chromium/content/public/browser/download_save_info.h
index 1f449111f09..0912461da98 100644
--- a/chromium/content/public/browser/download_save_info.h
+++ b/chromium/content/public/browser/download_save_info.h
@@ -5,10 +5,9 @@
 #ifndef CONTENT_PUBLIC_BROWSER_DOWNLOAD_SAVE_INFO_H_
 #define CONTENT_PUBLIC_BROWSER_DOWNLOAD_SAVE_INFO_H_
 
+#include "base/files/file.h"
 #include "base/files/file_path.h"
-#include "base/memory/linked_ptr.h"
 #include "content/common/content_export.h"
-#include "net/base/file_stream.h"
 
 namespace content {
 
@@ -29,8 +28,8 @@ struct CONTENT_EXPORT DownloadSaveInfo {
   // a path (only a filename), and is only effective if |file_path| is empty.
   base::string16 suggested_name;
 
-  // If non-NULL, contains the source data stream for the file contents.
-  scoped_ptr<net::FileStream> file_stream;
+  // If valid, contains the source data stream for the file contents.
+  base::File file;
 
   // The file offset at which to start the download.  May be 0.
   int64 offset;
diff --git a/chromium/content/public/browser/download_url_parameters.h b/chromium/content/public/browser/download_url_parameters.h
index b48bc2a2e15..fbf298410e1 100644
--- a/chromium/content/public/browser/download_url_parameters.h
+++ b/chromium/content/public/browser/download_url_parameters.h
@@ -10,9 +10,9 @@
 
 #include "base/basictypes.h"
 #include "base/callback.h"
+#include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_save_info.h"
 #include "content/public/common/referrer.h"
-#include "net/base/net_errors.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -39,7 +39,8 @@ class WebContents;
 class CONTENT_EXPORT DownloadUrlParameters {
  public:
   // If there is an error, then |item| will be NULL.
-  typedef base::Callback<void(DownloadItem*, net::Error)> OnStartedCallback;
+  typedef base::Callback<void(DownloadItem*, DownloadInterruptReason)>
+      OnStartedCallback;
 
   typedef std::pair<std::string, std::string> RequestHeadersNameValuePair;
   typedef std::vector<RequestHeadersNameValuePair> RequestHeadersType;
@@ -97,15 +98,15 @@ class CONTENT_EXPORT DownloadUrlParameters {
     save_info_.hash_state = hash_state;
   }
   void set_prompt(bool prompt) { save_info_.prompt_for_save_location = prompt; }
-  void set_file_stream(scoped_ptr<net::FileStream> file_stream) {
-    save_info_.file_stream = file_stream.Pass();
+  void set_file(base::File file) {
+    save_info_.file = file.Pass();
   }
 
   const OnStartedCallback& callback() const { return callback_; }
   bool content_initiated() const { return content_initiated_; }
   int load_flags() const { return load_flags_; }
-  const std::string& last_modified() { return last_modified_; }
-  const std::string& etag() { return etag_; }
+  const std::string& last_modified() const { return last_modified_; }
+  const std::string& etag() const { return etag_; }
   const std::string& method() const { return method_; }
   const std::string& post_body() const { return post_body_; }
   int64 post_id() const { return post_id_; }
@@ -135,10 +136,8 @@ class CONTENT_EXPORT DownloadUrlParameters {
   const GURL& url() const { return url_; }
 
   // Note that this is state changing--the DownloadUrlParameters object
-  // will not have a file_stream attached to it after this call.
-  scoped_ptr<net::FileStream> GetFileStream() {
-    return save_info_.file_stream.Pass();
-  }
+  // will not have a file attached to it after this call.
+  base::File GetFile() { return save_info_.file.Pass(); }
 
  private:
   OnStartedCallback callback_;
diff --git a/chromium/content/public/browser/geolocation_permission_context.h b/chromium/content/public/browser/geolocation_permission_context.h
deleted file mode 100644
index e1faa09a32a..00000000000
--- a/chromium/content/public/browser/geolocation_permission_context.h
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_GEOLOCATION_GEOLOCATION_PERMISSION_CONTEXT_H_
-#define CONTENT_BROWSER_GEOLOCATION_GEOLOCATION_PERMISSION_CONTEXT_H_
-
-#include "base/callback.h"
-#include "base/memory/ref_counted.h"
-#include "content/common/content_export.h"
-
-class GURL;
-
-namespace content {
-
-// GeolocationPermissionContext must be implemented by the embedder, to provide
-// the policy and logic for the Geolocation permissions flow.
-// This includes both prompting the user and persisting results, as required.
-class CONTENT_EXPORT GeolocationPermissionContext
-    : public base::RefCountedThreadSafe<GeolocationPermissionContext> {
- public:
-  // The renderer is requesting permission to use Geolocation.
-  // When the answer to a permission request has been determined, |callback|
-  // should be called with the result.
-  virtual void RequestGeolocationPermission(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame,
-      base::Callback<void(bool)> callback) = 0;
-
-  // The renderer is cancelling a pending permission request.
-  virtual void CancelGeolocationPermissionRequest(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame) = 0;
-
- protected:
-   virtual ~GeolocationPermissionContext() {}
-
- private:
-  friend class base::RefCountedThreadSafe<GeolocationPermissionContext>;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_GEOLOCATION_GEOLOCATION_PERMISSION_CONTEXT_H_
diff --git a/chromium/content/public/browser/geolocation_provider.h b/chromium/content/public/browser/geolocation_provider.h
index 5e27db48880..dea3c7ee3f4 100644
--- a/chromium/content/public/browser/geolocation_provider.h
+++ b/chromium/content/public/browser/geolocation_provider.h
@@ -5,33 +5,36 @@
 #ifndef CONTENT_PUBLIC_BROWSER_GEOLOCATION_PROVIDER_H_
 #define CONTENT_PUBLIC_BROWSER_GEOLOCATION_PROVIDER_H_
 
-#include "base/callback_forward.h"
+#include "base/callback_list.h"
 #include "content/common/content_export.h"
 
 namespace content {
 struct Geoposition;
 
-class CONTENT_EXPORT GeolocationProvider {
+// This is the main API to the geolocation subsystem. The application will hold
+// a single instance of this class and can register multiple clients to be
+// notified of location changes:
+// * Callbacks are registered by AddLocationUpdateCallback() and will keep
+//   receiving updates until the returned subscription object is destructed.
+// The application must instantiate the GeolocationProvider on the UI thread and
+// must communicate with it on the same thread.
+// The underlying location arbitrator will only be enabled whilst there is at
+// least one registered observer or pending callback (and only after
+// UserDidOptIntoLocationServices). The arbitrator and the location providers it
+// uses run on a separate Geolocation thread.
+class GeolocationProvider {
  public:
-  // This method, and all below, can only be called on the IO thread unless
-  // otherwise specified.
-  static GeolocationProvider* GetInstance();
+  CONTENT_EXPORT static GeolocationProvider* GetInstance();
 
   typedef base::Callback<void(const Geoposition&)> LocationUpdateCallback;
+  typedef base::CallbackList<void(const Geoposition&)>::Subscription
+      Subscription;
 
   // |use_high_accuracy| is used as a 'hint' for the provider preferences for
   // this particular observer, however the observer could receive updates for
   // best available locations from any active provider whilst it is registered.
-  // If an existing observer is added a second time, its options are updated
-  // but only a single call to RemoveLocationUpdateCallback() is required to
-  // remove it.
-  virtual void AddLocationUpdateCallback(const LocationUpdateCallback& callback,
-                                         bool use_high_accuracy) = 0;
-
-  // Remove a previously registered observer. No-op if not previously registered
-  // via AddLocationUpdateCallback(). Returns true if the observer was removed.
-  virtual bool RemoveLocationUpdateCallback(
-      const LocationUpdateCallback& callback) = 0;
+  virtual scoped_ptr<Subscription> AddLocationUpdateCallback(
+      const LocationUpdateCallback& callback, bool use_high_accuracy) = 0;
 
   // Calling this method indicates the user has opted into using location
   // services, including sending network requests to [Google servers to] resolve
@@ -39,21 +42,17 @@ class CONTENT_EXPORT GeolocationProvider {
   // go/chrome-privacy-doc.
   virtual void UserDidOptIntoLocationServices() = 0;
 
-  // Overrides the current location for testing. This function may be called on
-  // any thread. The completion callback will be invoked asynchronously on the
-  // calling thread when the override operation is completed.
+  // Overrides the current location for testing.
   //
-  // This function allows the current location to be faked without having to
-  // manually instantiate a GeolocationProvider backed by a MockLocationProvider
-  // that serves a fake location.
+  // Overrides the location for automation/testing. Suppresses any further
+  // updates from the actual providers and sends an update with the overridden
+  // position to all registered clients.
   //
   // Do not use this function in unit tests. The function instantiates the
   // singleton geolocation stack in the background and manipulates it to report
   // a fake location. Neither step can be undone, breaking unit test isolation
   // (crbug.com/125931).
-  static void OverrideLocationForTesting(
-      const Geoposition& position,
-      const base::Closure& completion_callback);
+  virtual void OverrideLocationForTesting(const Geoposition& position) = 0;
 
  protected:
   virtual~GeolocationProvider() {}
diff --git a/chromium/content/public/browser/host_zoom_map.h b/chromium/content/public/browser/host_zoom_map.h
index 72c9a1fb62f..e65b443d2b4 100644
--- a/chromium/content/public/browser/host_zoom_map.h
+++ b/chromium/content/public/browser/host_zoom_map.h
@@ -18,6 +18,7 @@ namespace content {
 
 class BrowserContext;
 class ResourceContext;
+class WebContents;
 
 // Maps hostnames to custom zoom levels.  Written on the UI thread and read on
 // any thread.  One instance per browser context. Must be created on the UI
@@ -49,9 +50,20 @@ class HostZoomMap {
     double zoom_level;
   };
 
+  typedef std::vector<ZoomLevelChange> ZoomLevelVector;
+
   CONTENT_EXPORT static HostZoomMap* GetForBrowserContext(
       BrowserContext* browser_context);
 
+  // Returns the current zoom level for the specified WebContents. May be
+  // temporary or host-specific.
+  CONTENT_EXPORT static double GetZoomLevel(const WebContents* web_contents);
+
+  // Sets the current zoom level for the specified WebContents. The level may
+  // be temporary or host-specific depending on the particular WebContents.
+  CONTENT_EXPORT static void SetZoomLevel(const WebContents* web_contents,
+                                          double level);
+
   // Copy the zoom levels from the given map. Can only be called on the UI
   // thread.
   virtual void CopyFrom(HostZoomMap* copy) = 0;
@@ -66,6 +78,16 @@ class HostZoomMap {
       const std::string& scheme,
       const std::string& host) const = 0;
 
+  // Returns true if the specified |scheme| and/or |host| has a zoom level
+  // currently set.
+  //
+  // This may be called on any thread.
+  virtual bool HasZoomLevel(const std::string& scheme,
+                            const std::string& host) const = 0;
+
+  // Returns all non-temporary zoom levels. Can be called on any thread.
+  virtual ZoomLevelVector GetAllZoomLevels() const = 0;
+
   // Here |host| is the host portion of URL, or (in the absence of a host)
   // the complete spec of the URL.
   // Sets the zoom level for the |host| to |level|.  If the level matches the
@@ -87,6 +109,25 @@ class HostZoomMap {
                                             const std::string& host,
                                             double level) = 0;
 
+  // Returns whether the view manages its zoom level independently of other
+  // views displaying content from the same host.
+  virtual bool UsesTemporaryZoomLevel(int render_process_id,
+                                      int render_view_id) const = 0;
+
+  // Sets the temporary zoom level that's only valid for the lifetime of this
+  // WebContents.
+  //
+  // This should only be called on the UI thread.
+  virtual void SetTemporaryZoomLevel(int render_process_id,
+                                     int render_view_id,
+                                     double level) = 0;
+
+  // Clears the temporary zoom level stored for this WebContents.
+  //
+  // This should only be called on the UI thread.
+  virtual void ClearTemporaryZoomLevel(int render_process_id,
+                                       int render_view_id) = 0;
+
   // Get/Set the default zoom level for pages that don't override it.
   virtual double GetDefaultZoomLevel() const = 0;
   virtual void SetDefaultZoomLevel(double level) = 0;;
diff --git a/chromium/content/public/browser/location_provider.h b/chromium/content/public/browser/location_provider.h
new file mode 100644
index 00000000000..8752a902e1e
--- /dev/null
+++ b/chromium/content/public/browser/location_provider.h
@@ -0,0 +1,58 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_LOCATION_PROVIDER_H_
+#define CONTENT_PUBLIC_BROWSER_LOCATION_PROVIDER_H_
+
+#include "base/callback.h"
+#include "base/compiler_specific.h"
+#include "content/public/common/geoposition.h"
+
+namespace content {
+
+class LocationProvider;
+
+// The interface for providing location information.
+class LocationProvider {
+ public:
+  virtual ~LocationProvider() {}
+
+  typedef base::Callback<void(const LocationProvider*, const Geoposition&)>
+      LocationProviderUpdateCallback;
+
+  // This callback will be used to notify when a new Geoposition becomes
+  // available.
+  virtual void SetUpdateCallback(
+      const LocationProviderUpdateCallback& callback) = 0;
+
+  // StartProvider maybe called multiple times, e.g. to alter the
+  // |high_accuracy| setting. Returns false if a fatal error was encountered
+  // which prevented the provider from starting.
+  virtual bool StartProvider(bool high_accuracy) = 0;
+
+  // Stops the provider from sending more requests.
+  // Important: a LocationProvider may be instantiated and StartProvider() may
+  // be called before the user has granted permission via OnPermissionGranted().
+  // This is to allow underlying providers to warm up, load their internal
+  // libraries, etc. No |LocationProviderUpdateCallback| can be run and no
+  // network requests can be done until OnPermissionGranted() has been called.
+  virtual void StopProvider() = 0;
+
+  // Gets the current best position estimate.
+  virtual void GetPosition(Geoposition* position) = 0;
+
+  // Provides a hint to the provider that new location data is needed as soon
+  // as possible.
+  virtual void RequestRefresh() = 0;
+
+  // Called everytime permission is granted to a page for using geolocation.
+  // This may either be through explicit user action (e.g. responding to the
+  // infobar prompt) or inferred from a persisted site permission.
+  // Note: See |StartProvider()| for more information.
+  virtual void OnPermissionGranted() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_LOCATION_PROVIDER_H_
diff --git a/chromium/content/public/browser/media_capture_devices.h b/chromium/content/public/browser/media_capture_devices.h
new file mode 100644
index 00000000000..925fff66c25
--- /dev/null
+++ b/chromium/content/public/browser/media_capture_devices.h
@@ -0,0 +1,32 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_MEDIA_CAPTURE_DEVICES_H_
+#define CONTENT_PUBLIC_BROWSER_MEDIA_CAPTURE_DEVICES_H_
+
+#include "content/public/common/media_stream_request.h"
+
+namespace content {
+
+// This is a singleton class, used to get Audio/Video devices, it must be
+// called in UI thread.
+class CONTENT_EXPORT  MediaCaptureDevices {
+ public:
+  // Get signleton instance of MediaCaptureDevices.
+  static MediaCaptureDevices* GetInstance();
+
+  // Return all Audio/Video devices.
+  virtual const MediaStreamDevices& GetAudioCaptureDevices() = 0;
+  virtual const MediaStreamDevices& GetVideoCaptureDevices() = 0;
+
+ private:
+  // This interface should only be implemented inside content.
+  friend class MediaCaptureDevicesImpl;
+  MediaCaptureDevices() {}
+  virtual ~MediaCaptureDevices() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_MEDIA_CAPTURE_DEVICES_H_
diff --git a/chromium/content/public/browser/media_device_id.cc b/chromium/content/public/browser/media_device_id.cc
index 65ac7e2dc44..2e405dd2183 100644
--- a/chromium/content/public/browser/media_device_id.cc
+++ b/chromium/content/public/browser/media_device_id.cc
@@ -6,6 +6,8 @@
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
+#include "content/browser/browser_main_loop.h"
+#include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "crypto/hmac.h"
 
 namespace content {
@@ -36,4 +38,20 @@ bool DoesMediaDeviceIDMatchHMAC(const ResourceContext::SaltCallback& sc,
   return guid_from_raw_device_id == device_guid;
 }
 
+bool GetMediaDeviceIDForHMAC(MediaStreamType stream_type,
+                             const ResourceContext::SaltCallback& rc,
+                             const GURL& security_origin,
+                             const std::string& source_id,
+                             std::string* device_id) {
+  content::MediaStreamManager* manager =
+      content::BrowserMainLoop::GetInstance()->media_stream_manager();
+
+  return manager->TranslateSourceIdToDeviceId(
+      content::MEDIA_DEVICE_VIDEO_CAPTURE,
+      rc,
+      security_origin,
+      source_id,
+      device_id);
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/media_device_id.h b/chromium/content/public/browser/media_device_id.h
index e14809cedd1..3a42060f834 100644
--- a/chromium/content/public/browser/media_device_id.h
+++ b/chromium/content/public/browser/media_device_id.h
@@ -14,6 +14,7 @@
 
 #include "content/common/content_export.h"
 #include "content/public/browser/resource_context.h"
+#include "content/public/common/media_stream_request.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -33,6 +34,13 @@ CONTENT_EXPORT bool DoesMediaDeviceIDMatchHMAC(
     const std::string& device_guid,
     const std::string& raw_unique_id);
 
+CONTENT_EXPORT bool GetMediaDeviceIDForHMAC(
+    MediaStreamType stream_type,
+    const ResourceContext::SaltCallback& rc,
+    const GURL& security_origin,
+    const std::string& source_id,
+    std::string* device_id);
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_MEDIA_DEVICE_ID_H_
diff --git a/chromium/content/public/browser/media_devices_monitor.h b/chromium/content/public/browser/media_devices_monitor.h
deleted file mode 100644
index 044c8ada064..00000000000
--- a/chromium/content/public/browser/media_devices_monitor.h
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_MEDIA_DEVICES_MONITOR_H_
-#define CONTENT_PUBLIC_BROWSER_MEDIA_DEVICES_MONITOR_H_
-
-#include "content/common/content_export.h"
-
-namespace content {
-
-// Called to ensure the MediaStreamManager has started monitoring the capture
-// devices, this will trigger OnAudioCaptureDevicesChanged() and
-// OnVideoCaptureDevicesChanged() callbacks.
-CONTENT_EXPORT void EnsureMonitorCaptureDevices();
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_MEDIA_DEVICES_MONITOR_H_
diff --git a/chromium/content/public/browser/media_observer.h b/chromium/content/public/browser/media_observer.h
index 1c264aa5a01..dca5b85564f 100644
--- a/chromium/content/public/browser/media_observer.h
+++ b/chromium/content/public/browser/media_observer.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_MEDIA_OBSERVER_H_
 #define CONTENT_PUBLIC_BROWSER_MEDIA_OBSERVER_H_
 
+#include "base/callback_forward.h"
 #include "content/public/browser/media_request_state.h"
 #include "content/public/common/media_stream_request.h"
 
@@ -15,37 +16,44 @@ namespace content {
 class MediaObserver {
  public:
   // Called when a audio capture device is plugged in or unplugged.
-  virtual void OnAudioCaptureDevicesChanged(
-      const MediaStreamDevices& devices) = 0;
+  virtual void OnAudioCaptureDevicesChanged() = 0;
 
   // Called when a video capture device is plugged in or unplugged.
-  virtual void OnVideoCaptureDevicesChanged(
-      const MediaStreamDevices& devices) = 0;
+  virtual void OnVideoCaptureDevicesChanged() = 0;
 
   // Called when a media request changes state.
   virtual void OnMediaRequestStateChanged(
       int render_process_id,
       int render_view_id,
       int page_request_id,
+      const GURL& security_origin,
       const MediaStreamDevice& device,
       MediaRequestState state) = 0;
 
-  // Called when an audio stream transitions into a playing or paused state, and
-  // also at regular intervals to report the current power level of the audio
-  // signal in dBFS (decibels relative to full-scale) units.  |clipped| is true
-  // if any part of the audio signal has been clipped since the last call.  See
-  // media/audio/audio_power_monitor.h for more info.
-  virtual void OnAudioStreamPlayingChanged(
+  // Called when an audio stream is being created.
+  virtual void OnCreatingAudioStream(int render_process_id,
+                                     int render_frame_id) = 0;
+
+  // Called when an audio stream transitions into a playing state.
+  // |power_read_callback| is a thread-safe callback, provided for polling the
+  // current audio signal power level, and any copies/references to it must be
+  // destroyed when OnAudioStreamStopped() is called.
+  //
+  // The callback returns the current power level (in dBFS units) and the clip
+  // status (true if any part of the audio signal has clipped since the last
+  // callback run).  See media/audio/audio_power_monitor.h for more info.
+  typedef base::Callback<std::pair<float, bool>()> ReadPowerAndClipCallback;
+  virtual void OnAudioStreamPlaying(
       int render_process_id,
-      int render_view_id,
+      int render_frame_id,
       int stream_id,
-      bool is_playing,
-      float power_dbfs,
-      bool clipped) = 0;
+      const ReadPowerAndClipCallback& power_read_callback) = 0;
 
-  // Called when the audio stream is being created.
-  virtual void OnCreatingAudioStream(int render_process_id,
-                                     int render_view_id) = 0;
+  // Called when an audio stream has stopped.
+  virtual void OnAudioStreamStopped(
+      int render_process_id,
+      int render_frame_id,
+      int stream_id) = 0;
 
  protected:
   virtual ~MediaObserver() {}
diff --git a/chromium/content/public/browser/native_web_keyboard_event.h b/chromium/content/public/browser/native_web_keyboard_event.h
index 1585fbd6762..3e4db80d49d 100644
--- a/chromium/content/public/browser/native_web_keyboard_event.h
+++ b/chromium/content/public/browser/native_web_keyboard_event.h
@@ -28,7 +28,7 @@ struct CONTENT_EXPORT NativeWebKeyboardEvent :
                          wchar_t character,
                          int state,
                          double time_stamp_seconds);
-#elif defined(OS_MACOSX) || defined(TOOLKIT_GTK)
+#elif defined(OS_MACOSX)
   // TODO(suzhe): Limit these constructors to Linux native Gtk port.
   // For Linux Views port, after using RenderWidgetHostViewViews to replace
   // RenderWidgetHostViewGtk, we can use constructors for TOOLKIT_VIEWS defined
@@ -67,7 +67,7 @@ struct CONTENT_EXPORT NativeWebKeyboardEvent :
   // Currently, it's only used by Linux and Mac ports.
   bool skip_in_browser;
 
-#if defined(TOOLKIT_GTK)
+#if defined(USE_AURA)
   // True if the key event matches an edit command. In order to ensure the edit
   // command always work in web page, the browser should not pre-handle this key
   // event as a reserved accelerator. See http://crbug.com/54573
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index 8c0596e7e2b..08ea0b9985d 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -13,6 +13,7 @@
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/global_request_id.h"
+#include "content/public/browser/session_storage_namespace.h"
 #include "content/public/common/page_transition_types.h"
 #include "content/public/common/referrer.h"
 #include "url/gurl.h"
@@ -27,14 +28,8 @@ namespace content {
 
 class BrowserContext;
 class NavigationEntry;
-class SessionStorageNamespace;
 class WebContents;
 
-// Used to store the mapping of a StoragePartition id to
-// SessionStorageNamespace.
-typedef std::map<std::string, scoped_refptr<SessionStorageNamespace> >
-    SessionStorageNamespaceMap;
-
 // A NavigationController maintains the back-forward list for a WebContents and
 // manages all navigation within that list.
 //
@@ -220,22 +215,22 @@ class NavigationController {
   // Active entry --------------------------------------------------------------
 
   // THIS IS DEPRECATED. DO NOT USE. Use GetVisibleEntry instead.
+  // See http://crbug.com/273710.
   //
   // Returns the active entry, which is the transient entry if any, the pending
   // entry if a navigation is in progress or the last committed entry otherwise.
   // NOTE: This can be NULL!!
-  //
-  // If you are trying to get the current state of the NavigationController,
-  // this is the method you will typically want to call.  If you want to display
-  // the active entry to the user (e.g., in the location bar), use
-  // GetVisibleEntry instead.
   virtual NavigationEntry* GetActiveEntry() const = 0;
 
-  // Returns the same entry as GetActiveEntry, except that it ignores pending
-  // history navigation entries.  This should be used when displaying info to
-  // the user, so that the location bar and other indicators do not update for
-  // a back/forward navigation until the pending entry commits.  This approach
-  // guards against URL spoofs on slow history navigations.
+  // Returns the entry that should be displayed to the user in the address bar.
+  // This is the transient entry if any, the pending entry if a navigation is
+  // in progress *and* is safe to display to the user (see below), or the last
+  // committed entry otherwise.
+  // NOTE: This can be NULL if no entry has committed!
+  //
+  // A pending entry is safe to display if it started in the browser process or
+  // if it's a renderer-initiated navigation in a new tab which hasn't been
+  // accessed by another tab.  (If it has been accessed, it risks a URL spoof.)
   virtual NavigationEntry* GetVisibleEntry() const = 0;
 
   // Returns the index from which we would go back/forward or reload.  This is
@@ -356,7 +351,7 @@ class NavigationController {
   // which cannot be used on iOS.
 #if !defined(OS_IOS)
   // Returns all the SessionStorageNamespace objects that this
-  // NavigationController knows about.
+  // NavigationController knows about, the map key is a StoragePartition id.
   virtual const SessionStorageNamespaceMap&
       GetSessionStorageNamespaceMap() const = 0;
 
diff --git a/chromium/content/public/browser/navigation_details.h b/chromium/content/public/browser/navigation_details.h
index 5a01aec7754..5103f640b49 100644
--- a/chromium/content/public/browser/navigation_details.h
+++ b/chromium/content/public/browser/navigation_details.h
@@ -51,8 +51,8 @@ struct CONTENT_EXPORT LoadCommittedDetails {
 
   // When the committed load is a web page from the renderer, this string
   // specifies the security state if the page is secure.
-  // See ViewHostMsg_FrameNavigate_Params.security_info, where it comes from.
-  // Use SSLManager::DeserializeSecurityInfo to decode it.
+  // See FrameHostMsg_DidCommitProvisionalLoad_Params.security_info, where it
+  // comes from. Use SSLManager::DeserializeSecurityInfo to decode it.
   std::string serialized_security_info;
 
   // Returns whether the main frame navigated to a different page (e.g., not
diff --git a/chromium/content/public/browser/navigation_entry.h b/chromium/content/public/browser/navigation_entry.h
index e23773f1a2c..6d69b0de4bc 100644
--- a/chromium/content/public/browser/navigation_entry.h
+++ b/chromium/content/public/browser/navigation_entry.h
@@ -209,6 +209,14 @@ class NavigationEntry {
   //     status code wasn't available.
   virtual void SetHttpStatusCode(int http_status_code) = 0;
   virtual int GetHttpStatusCode() const = 0;
+
+  // The redirect chain traversed during this navigation, from the initial
+  // redirecting URL to the final non-redirecting current URL.
+  virtual void SetRedirectChain(const std::vector<GURL>& redirects) = 0;
+  virtual const std::vector<GURL>& GetRedirectChain() const = 0;
+
+  // True if this entry is restored and hasn't been loaded.
+  virtual bool IsRestored() const = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/notification_types.h b/chromium/content/public/browser/notification_types.h
index 3366f169cb4..08ffd3306de 100644
--- a/chromium/content/public/browser/notification_types.h
+++ b/chromium/content/public/browser/notification_types.h
@@ -72,7 +72,7 @@ enum NotificationType {
   // Other load-related (not from NavigationController) ----------------------
 
   // Corresponds to ViewHostMsg_DocumentOnLoadCompletedInMainFrame. The source
-  // is the WebContents and the details the page_id.
+  // is the WebContents.
   // DEPRECATED: Use WebContentsObserver::DocumentOnLoadCompletedInMainFrame()
   NOTIFICATION_LOAD_COMPLETED_MAIN_FRAME,
 
@@ -179,11 +179,6 @@ enum NotificationType {
   // painted. The source is the RenderWidgetHost, the details are not used.
   NOTIFICATION_RENDER_WIDGET_HOST_DID_UPDATE_BACKING_STORE,
 
-  // This notifies the observer that a PaintAtSizeACK was received. The source
-  // is the RenderWidgetHost, the details are an instance of
-  // std::pair<int, gfx::Size>.
-  NOTIFICATION_RENDER_WIDGET_HOST_DID_RECEIVE_PAINT_AT_SIZE_ACK,
-
   // This notifies the observer that a HandleInputEventACK was received. The
   // source is the RenderWidgetHost, the details are the type of event
   // received.
diff --git a/chromium/content/public/browser/page_navigator.cc b/chromium/content/public/browser/page_navigator.cc
index 164bc4e0bc1..dc9b3c53aaa 100644
--- a/chromium/content/public/browser/page_navigator.cc
+++ b/chromium/content/public/browser/page_navigator.cc
@@ -15,7 +15,6 @@ OpenURLParams::OpenURLParams(
     : url(url),
       referrer(referrer),
       uses_post(false),
-      source_frame_id(-1),
       frame_tree_node_id(-1),
       disposition(disposition),
       transition(transition),
@@ -27,7 +26,6 @@ OpenURLParams::OpenURLParams(
 OpenURLParams::OpenURLParams(
     const GURL& url,
     const Referrer& referrer,
-    int64 source_frame_id,
     int64 frame_tree_node_id,
     WindowOpenDisposition disposition,
     PageTransition transition,
@@ -35,7 +33,6 @@ OpenURLParams::OpenURLParams(
     : url(url),
       referrer(referrer),
       uses_post(false),
-      source_frame_id(source_frame_id),
       frame_tree_node_id(frame_tree_node_id),
       disposition(disposition),
       transition(transition),
@@ -46,7 +43,6 @@ OpenURLParams::OpenURLParams(
 
 OpenURLParams::OpenURLParams()
     : uses_post(false),
-      source_frame_id(-1),
       frame_tree_node_id(-1),
       disposition(UNKNOWN),
       transition(PageTransitionFromInt(0)),
diff --git a/chromium/content/public/browser/page_navigator.h b/chromium/content/public/browser/page_navigator.h
index 7cd9afbadbf..849d4ca68b1 100644
--- a/chromium/content/public/browser/page_navigator.h
+++ b/chromium/content/public/browser/page_navigator.h
@@ -32,7 +32,6 @@ struct CONTENT_EXPORT OpenURLParams {
                 bool is_renderer_initiated);
   OpenURLParams(const GURL& url,
                 const Referrer& referrer,
-                int64 source_frame_id,
                 int64 frame_tree_node_id,
                 WindowOpenDisposition disposition,
                 PageTransition transition,
@@ -60,10 +59,6 @@ struct CONTENT_EXPORT OpenURLParams {
   // is terminated by \r\n.  May be empty if no extra headers are needed.
   std::string extra_headers;
 
-  // The renderer-specific source frame id or -1 to indicate the main frame.
-  // TODO(creis): This appears to be dead code and should be removed.
-  int64 source_frame_id;
-
   // The browser-global FrameTreeNode ID or -1 to indicate the main frame.
   int64 frame_tree_node_id;
 
diff --git a/chromium/content/public/browser/plugin_service.h b/chromium/content/public/browser/plugin_service.h
index 4cf5f988ac0..696800f3f28 100644
--- a/chromium/content/public/browser/plugin_service.h
+++ b/chromium/content/public/browser/plugin_service.h
@@ -161,7 +161,8 @@ class PluginService {
 #endif
 
   // Returns true iff PPAPI "dev channel" methods are supported.
-  virtual bool PpapiDevChannelSupported() = 0;
+  virtual bool PpapiDevChannelSupported(BrowserContext* browser_context,
+                                        const GURL& document_url) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/push_messaging_service.h b/chromium/content/public/browser/push_messaging_service.h
new file mode 100644
index 00000000000..37150db783b
--- /dev/null
+++ b/chromium/content/public/browser/push_messaging_service.h
@@ -0,0 +1,33 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_PUSH_MESSAGING_SERVICE_H_
+#define CONTENT_PUBLIC_BROWSER_PUSH_MESSAGING_SERVICE_H_
+
+#include <string>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// A push service-agnostic interface that the Push API uses for talking to
+// push messaging services like GCM.
+class CONTENT_EXPORT PushMessagingService {
+ public:
+  typedef base::Callback<void(const GURL& /* endpoint */,
+                              const std::string& /* registration_id */,
+                              bool /* success */)>
+      RegisterCallback;
+
+  virtual ~PushMessagingService() {}
+  virtual void Register(const std::string& app_id,
+                        const std::string& sender_id,
+                        const RegisterCallback& callback) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_PUSH_MESSAGING_SERVICE_H_
diff --git a/chromium/content/public/browser/quota_permission_context.h b/chromium/content/public/browser/quota_permission_context.h
index 27844de5ff7..5950f233ff5 100644
--- a/chromium/content/public/browser/quota_permission_context.h
+++ b/chromium/content/public/browser/quota_permission_context.h
@@ -7,6 +7,7 @@
 
 #include "base/callback.h"
 #include "base/memory/ref_counted.h"
+#include "content/public/common/storage_quota_params.h"
 #include "webkit/common/quota/quota_types.h"
 
 class GURL;
@@ -26,11 +27,8 @@ class QuotaPermissionContext
   typedef base::Callback<void(QuotaPermissionResponse)> PermissionCallback;
 
   virtual void RequestQuotaPermission(
-      const GURL& origin_url,
-      quota::StorageType type,
-      int64 new_quota,
+      const StorageQuotaParams& params,
       int render_process_id,
-      int render_view_id,
       const PermissionCallback& callback) = 0;
 
  protected:
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index 1455f856f24..ac6ba5aa8d7 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -5,21 +5,75 @@
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_
 
+#include <string>
+
+#include "base/callback_forward.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "ui/gfx/native_widget_types.h"
+#include "url/gurl.h"
+
+namespace base {
+class Value;
+}
 
 namespace content {
+class RenderProcessHost;
+class RenderViewHost;
+class SiteInstance;
 
 // The interface provides a communication conduit with a frame in the renderer.
 class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
                                        public IPC::Sender {
  public:
+  // Returns the RenderFrameHost given its ID and the ID of its render process.
+  // Returns NULL if the IDs do not correspond to a live RenderFrameHost.
+  static RenderFrameHost* FromID(int render_process_id, int render_frame_id);
+
   virtual ~RenderFrameHost() {}
 
   // Returns the route id for this frame.
   virtual int GetRoutingID() = 0;
 
+  // Returns the SiteInstance grouping all RenderFrameHosts that have script
+  // access to this RenderFrameHost, and must therefore live in the same
+  // process.
+  virtual SiteInstance* GetSiteInstance() = 0;
+
+  // Returns the process for this frame.
+  virtual RenderProcessHost* GetProcess() = 0;
+
+  // Returns the current RenderFrameHost of the parent frame, or NULL if there
+  // is no parent. The result may be in a different process than the current
+  // RenderFrameHost.
+  virtual RenderFrameHost* GetParent() = 0;
+
+  // Returns the assigned name of the frame, the name of the iframe tag
+  // declaring it. For example, <iframe name="framename">[...]</iframe>. It is
+  // quite possible for a frame to have no name, in which case GetFrameName will
+  // return an empty string.
+  virtual const std::string& GetFrameName() = 0;
+
+  // Returns true if the frame is out of process.
+  virtual bool IsCrossProcessSubframe() = 0;
+
+  // Returns the last committed URL of the frame.
+  virtual GURL GetLastCommittedURL() = 0;
+
+  // Returns the associated widget's native view.
+  virtual gfx::NativeView GetNativeView() = 0;
+
+  // Runs some JavaScript in this frame's context. If a callback is provided, it
+  // will be used to return the result, when the result is available.
+  typedef base::Callback<void(const base::Value*)> JavaScriptResultCallback;
+  virtual void ExecuteJavaScript(const base::string16& javascript) = 0;
+  virtual void ExecuteJavaScript(const base::string16& javascript,
+                                 const JavaScriptResultCallback& callback) = 0;
+
+  // Temporary until we get rid of RenderViewHost.
+  virtual RenderViewHost* GetRenderViewHost() = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index 76558254871..ee650367fcc 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -14,7 +14,6 @@
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_sender.h"
 #include "ui/gfx/native_widget_types.h"
-#include "ui/surface/transport_dib.h"
 
 class GURL;
 struct ViewMsg_SwapOut_Params;
@@ -29,9 +28,7 @@ class BrowserMessageFilter;
 class RenderProcessHostObserver;
 class RenderWidgetHost;
 class StoragePartition;
-
-typedef base::Thread* (*RendererMainThreadFactoryFunction)(
-    const std::string& id);
+struct GlobalRequestID;
 
 // Interface that represents the browser side of the browser <-> renderer
 // communication channel. There will generally be one RenderProcessHost per
@@ -98,9 +95,11 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   virtual void WidgetHidden() = 0;
   virtual int VisibleWidgetCount() const = 0;
 
-  // Indicates whether the current RenderProcessHost associated with a guest
-  // renderer process.
-  virtual bool IsGuest() const = 0;
+  // Indicates whether the current RenderProcessHost is associated with an
+  // isolated guest renderer process. Not all guest renderers are created equal.
+  // A guest, as indicated by BrowserPluginGuest::IsGuest, may coexist with
+  // other non-guest renderers in the same process if IsIsolatedGuest is false.
+  virtual bool IsIsolatedGuest() const = 0;
 
   // Returns the storage partition associated with this process.
   //
@@ -130,19 +129,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // the first IPC arrives.
   virtual base::ProcessHandle GetHandle() const = 0;
 
-  // Transport DIB functions ---------------------------------------------------
-
-  // Return the TransportDIB for the given id. On Linux, this can involve
-  // mapping shared memory. On Mac, the shared memory is created in the browser
-  // process and the cached metadata is returned. On Windows, this involves
-  // duplicating the handle from the remote process.  The RenderProcessHost
-  // still owns the returned DIB.
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id) = 0;
-
-  // Return the TransportDIB for the given id. In contrast to GetTransportDIB,
-  // the caller owns the resulting TransportDIB.
-  virtual TransportDIB* MapTransportDIB(TransportDIB::Id dib_id) = 0;
-
   // Returns the user browser context associated with this renderer process.
   virtual content::BrowserContext* GetBrowserContext() const = 0;
 
@@ -150,12 +136,14 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // |partition|.
   virtual bool InSameStoragePartition(StoragePartition* partition) const = 0;
 
-  // Returns the unique ID for this child process. This can be used later in
-  // a call to FromID() to get back to this object (this is used to avoid
+  // Returns the unique ID for this child process host. This can be used later
+  // in a call to FromID() to get back to this object (this is used to avoid
   // sending non-threadsafe pointers to other threads).
   //
-  // This ID will be unique for all child processes, including workers, plugins,
-  // etc.
+  // This ID will be unique across all child process hosts, including workers,
+  // plugins, etc.
+  //
+  // This will never return ChildProcessHost::kInvalidUniqueID.
   virtual int GetID() const = 0;
 
   // Returns true iff channel_ has been set to non-NULL. Use this for checking
@@ -201,15 +189,49 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // 10 milliseconds.
   virtual base::TimeDelta GetChildProcessIdleTime() const = 0;
 
-  // Signals that a compositing surface has been updated after a lost context
-  // event, so that we can process requests from the renderer to create contexts
-  // with that surface.
-  virtual void SurfaceUpdated(int32 surface_id) = 0;
-
   // Called to resume the requests for a view created through window.open that
   // were initially blocked.
   virtual void ResumeRequestsForView(int route_id) = 0;
 
+  // Checks that the given renderer can request |url|, if not it sets it to
+  // about:blank.
+  // |empty_allowed| must be set to false for navigations for security reasons.
+  virtual void FilterURL(bool empty_allowed, GURL* url) = 0;
+
+#if defined(ENABLE_WEBRTC)
+  virtual void EnableAecDump(const base::FilePath& file) = 0;
+  virtual void DisableAecDump() = 0;
+
+  // When set, |callback| receives log messages regarding, for example, media
+  // devices (webcams, mics, etc) that were initially requested in the render
+  // process associated with this RenderProcessHost.
+  virtual void SetWebRtcLogMessageCallback(
+      base::Callback<void(const std::string&)> callback) = 0;
+
+  typedef base::Callback<void(scoped_ptr<uint8[]> packet_header,
+                              size_t header_length,
+                              size_t packet_length,
+                              bool incoming)> WebRtcRtpPacketCallback;
+
+  typedef base::Callback<void(bool incoming, bool outgoing)>
+      WebRtcStopRtpDumpCallback;
+
+  // Starts passing RTP packets to |packet_callback| and returns the callback
+  // used to stop dumping.
+  virtual WebRtcStopRtpDumpCallback StartRtpDump(
+      bool incoming,
+      bool outgoing,
+      const WebRtcRtpPacketCallback& packet_callback) = 0;
+#endif
+
+  // Tells the ResourceDispatcherHost to resume a deferred navigation without
+  // transferring it to a new renderer process.
+  virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id) = 0;
+
+  // Notifies the renderer that the timezone configuration of the system might
+  // have changed.
+  virtual void NotifyTimezoneChange() = 0;
+
   // Static management functions -----------------------------------------------
 
   // Flag to run the renderer in process.  This is primarily
@@ -263,9 +285,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // Returns the current max number of renderer processes used by the content
   // module.
   static size_t GetMaxRendererProcessCount();
-
-  static void RegisterRendererMainThreadFactory(
-      RendererMainThreadFactoryFunction create);
 };
 
 }  // namespace content.
diff --git a/chromium/content/public/browser/render_process_host_observer.h b/chromium/content/public/browser/render_process_host_observer.h
index 221673734fb..867bc7cc3a0 100644
--- a/chromium/content/public/browser/render_process_host_observer.h
+++ b/chromium/content/public/browser/render_process_host_observer.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_OBSERVER_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_OBSERVER_H_
 
+#include "base/process/kill.h"
+#include "base/process/process_handle.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -15,7 +17,18 @@ class RenderProcessHost;
 // in RenderProcessHost lifecycle events.
 class CONTENT_EXPORT RenderProcessHostObserver {
  public:
-  // Called when the observed RenderProcessHost itself is destroyed.
+  // This method is invoked when a render process exited (either normally or
+  // with a crash). To determine if the process closed normally or crashed,
+  // examine the |status| parameter.
+  //
+  // Note that this is equivalent to WebContentsObserver::RenderProcessGone().
+  virtual void RenderProcessExited(RenderProcessHost* host,
+                                   base::ProcessHandle handle,
+                                   base::TerminationStatus status,
+                                   int exit_code) {}
+
+  // This method is invoked when the observed RenderProcessHost itself is
+  // destroyed. This is guaranteed to be the last call made to the observer.
   virtual void RenderProcessHostDestroyed(RenderProcessHost* host) {}
 
  protected:
diff --git a/chromium/content/public/browser/render_view_host.h b/chromium/content/public/browser/render_view_host.h
index f2efd36c8ba..559c0ef4c69 100644
--- a/chromium/content/public/browser/render_view_host.h
+++ b/chromium/content/public/browser/render_view_host.h
@@ -12,7 +12,7 @@
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/common/file_chooser_params.h"
 #include "content/public/common/page_zoom.h"
-#include "content/public/common/stop_find_action.h"
+#include "mojo/public/cpp/system/core.h"
 #include "third_party/WebKit/public/web/WebDragOperation.h"
 
 class GURL;
@@ -36,7 +36,6 @@ struct SelectedFileInfo;
 }
 
 namespace blink {
-struct WebFindOptions;
 struct WebMediaPlayerAction;
 struct WebPluginAction;
 }
@@ -44,11 +43,10 @@ struct WebPluginAction;
 namespace content {
 
 class ChildProcessSecurityPolicy;
-class RenderProcessHost;
+class RenderFrameHost;
 class RenderViewHostDelegate;
 class SessionStorageNamespace;
 class SiteInstance;
-struct CustomContextMenuContext;
 struct DropData;
 
 // A RenderViewHost is responsible for creating and talking to a RenderView
@@ -72,21 +70,20 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // because RenderWidgetHost is a virtual base class.
   static RenderViewHost* From(RenderWidgetHost* rwh);
 
-  // Checks that the given renderer can request |url|, if not it sets it to
-  // about:blank.
-  // |empty_allowed| must be set to false for navigations for security reasons.
-  static void FilterURL(const RenderProcessHost* process,
-                        bool empty_allowed,
-                        GURL* url);
-
   virtual ~RenderViewHost() {}
 
+  // Returns the main frame for this render view.
+  virtual RenderFrameHost* GetMainFrame() = 0;
+
   // Tell the render view to enable a set of javascript bindings. The argument
   // should be a combination of values from BindingsPolicy.
   virtual void AllowBindings(int binding_flags) = 0;
 
-  // Tells the renderer to clear the focused node (if any).
-  virtual void ClearFocusedNode() = 0;
+  // Tells the renderer to clear the focused element (if any).
+  virtual void ClearFocusedElement() = 0;
+
+  // Returns true if the current focused element is editable.
+  virtual bool IsFocusedElementEditable() = 0;
 
   // Causes the renderer to close the current page, including running its
   // onunload event handler.  A ClosePage_ACK message will be sent to the
@@ -97,15 +94,9 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // image at that location).
   virtual void CopyImageAt(int x, int y) = 0;
 
-  // Notifies the renderer about the result of a desktop notification.
-  virtual void DesktopNotificationPermissionRequestDone(
-      int callback_context) = 0;
-  virtual void DesktopNotificationPostDisplay(int callback_context) = 0;
-  virtual void DesktopNotificationPostError(int notification_id,
-                                    const base::string16& message) = 0;
-  virtual void DesktopNotificationPostClose(int notification_id,
-                                            bool by_user) = 0;
-  virtual void DesktopNotificationPostClick(int notification_id) = 0;
+  // Saves the image at location x, y to the disk (if there indeed is an
+  // image at that location).
+  virtual void SaveImageAt(int x, int y) = 0;
 
   // Notifies the listener that a directory enumeration is complete.
   virtual void DirectoryEnumerationFinished(
@@ -122,11 +113,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
       int client_x, int client_y, int screen_x, int screen_y,
       blink::WebDragOperation operation) = 0;
 
-  // Notifies the renderer that a drag and drop operation is in progress, with
-  // droppable items positioned over the renderer's view.
-  virtual void DragSourceMovedTo(
-      int client_x, int client_y, int screen_x, int screen_y) = 0;
-
   // Notifies the renderer that we're done with the drag and drop operation.
   // This allows the renderer to reset some state.
   virtual void DragSourceSystemDragEnded() = 0;
@@ -159,28 +145,12 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // Instructs the RenderView to send back updates to the preferred size.
   virtual void EnablePreferredSizeMode() = 0;
 
-  // Executes custom context menu action that was provided from WebKit.
-  virtual void ExecuteCustomContextMenuCommand(
-      int action, const CustomContextMenuContext& context) = 0;
-
   // Tells the renderer to perform the given action on the media player
   // located at the given point.
   virtual void ExecuteMediaPlayerActionAtLocation(
       const gfx::Point& location,
       const blink::WebMediaPlayerAction& action) = 0;
 
-  // Runs some javascript within the context of a frame in the page.
-  virtual void ExecuteJavascriptInWebFrame(const base::string16& frame_xpath,
-                                           const base::string16& jscript) = 0;
-
-  // Runs some javascript within the context of a frame in the page. The result
-  // is sent back via the provided callback.
-  typedef base::Callback<void(const base::Value*)> JavascriptResultCallback;
-  virtual void ExecuteJavascriptInWebFrameCallbackResult(
-      const base::string16& frame_xpath,
-      const base::string16& jscript,
-      const JavascriptResultCallback& callback) = 0;
-
   // Tells the renderer to perform the given action on the plugin located at
   // the given point.
   virtual void ExecutePluginActionAtLocation(
@@ -189,23 +159,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // Asks the renderer to exit fullscreen
   virtual void ExitFullscreen() = 0;
 
-  // Finds text on a page.
-  virtual void Find(int request_id, const base::string16& search_text,
-                    const blink::WebFindOptions& options) = 0;
-
-  // Notifies the renderer that the user has closed the FindInPage window
-  // (and what action to take regarding the selection).
-  virtual void StopFinding(StopFindAction action) = 0;
-
-  // Causes the renderer to invoke the onbeforeunload event handler.  The
-  // result will be returned via ViewMsg_ShouldClose. See also ClosePage and
-  // SwapOut, which fire the PageUnload event.
-  //
-  // Set bool for_cross_site_transition when this close is just for the current
-  // RenderView in the case of a cross-site transition. False means we're
-  // closing the entire tab.
-  virtual void FirePageBeforeUnload(bool for_cross_site_transition) = 0;
-
   // Notifies the Listener that one or more files have been chosen by the user
   // from a file chooser dialog for the form. |permissions| is the file
   // selection mode in which the chooser dialog was created.
@@ -221,33 +174,14 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
 
   virtual SiteInstance* GetSiteInstance() const = 0;
 
-  // Requests the renderer to evaluate an xpath to a frame and insert css
-  // into that frame's document.
-  virtual void InsertCSS(const base::string16& frame_xpath,
-                         const std::string& css) = 0;
-
   // Returns true if the RenderView is active and has not crashed. Virtual
   // because it is overridden by TestRenderViewHost.
   virtual bool IsRenderViewLive() const = 0;
 
-  // Returns true if the RenderView is responsible for displaying a subframe
-  // in a different process from its parent page.
-  virtual bool IsSubframe() const = 0;
-
-  // Let the renderer know that the menu has been closed.
-  virtual void NotifyContextMenuClosed(
-      const CustomContextMenuContext& context) = 0;
-
   // Notification that a move or resize renderer's containing window has
   // started.
   virtual void NotifyMoveOrResizeStarted() = 0;
 
-  // Reloads the current focused frame.
-  virtual void ReloadFrame() = 0;
-
-  // Sets the alternate error page URL (link doctor) for the renderer process.
-  virtual void SetAltErrorPageURL(const GURL& url) = 0;
-
   // Sets a property with the given name and value on the Web UI binding object.
   // Must call AllowWebUIBindings() on this renderer first.
   virtual void SetWebUIProperty(const std::string& name,
@@ -260,17 +194,12 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // RenderViewHostDelegate.
   virtual void SyncRendererPrefs() = 0;
 
-  virtual void ToggleSpeechInput() = 0;
-
   // Returns the current WebKit preferences.
   virtual WebPreferences GetWebkitPreferences() = 0;
 
   // Passes a list of Webkit preferences to the renderer.
   virtual void UpdateWebkitPreferences(const WebPreferences& prefs) = 0;
 
-  // Informs the renderer process of a change in timezone.
-  virtual void NotifyTimezoneChange() = 0;
-
   // Retrieves the list of AudioOutputController objects associated
   // with this object and passes it to the callback you specify, on
   // the same thread on which you called the method.
@@ -281,6 +210,12 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   virtual void GetAudioOutputControllers(
       const GetAudioOutputControllersCallback& callback) const = 0;
 
+  // Sets the mojo handle for WebUI pages.
+  virtual void SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) = 0;
+
+  // Notify the render view host to select the word around the caret.
+  virtual void SelectWordAroundCaret() = 0;
+
 #if defined(OS_ANDROID)
   // Selects and zooms to the find result nearest to the point (x,y)
   // defined in find-in-page coordinates.
@@ -288,9 +223,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
 
   // Asks the renderer to send the rects of the current find matches.
   virtual void RequestFindMatchRects(int current_version) = 0;
-
-  // Disables fullscreen media playback for encrypted video.
-  virtual void DisableFullscreenEncryptedMediaPlayback() = 0;
 #endif
 
  private:
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index 944ecbbcc75..30308736a76 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -12,12 +12,11 @@
 #include "ipc/ipc_sender.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "third_party/WebKit/public/web/WebTextDirection.h"
+#include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/size.h"
 #include "ui/surface/transport_dib.h"
 
-#if defined(TOOLKIT_GTK)
-#include "ui/base/x/x11_util.h"
-#elif defined(OS_MACOSX)
+#if defined(OS_MACOSX)
 #include "skia/ext/platform_device.h"
 #endif
 
@@ -107,12 +106,6 @@ class RenderWidgetHostView;
 // the RenderWidgetHost's IPC message map.
 class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
  public:
-  // Free all backing stores used for rendering to drop memory usage.
-  static void RemoveAllBackingStores();
-
-  // Returns the size of all the backing stores used for rendering
-  static size_t BackingStoreMemorySize();
-
   // Returns the RenderWidgetHost given its ID and the ID of its render process.
   // Returns NULL if the IDs do not correspond to a live RenderWidgetHost.
   static RenderWidgetHost* FromID(int32 process_id, int32 routing_id);
@@ -123,18 +116,6 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
 
   virtual ~RenderWidgetHost() {}
 
-  // Edit operations.
-  virtual void Undo() = 0;
-  virtual void Redo() = 0;
-  virtual void Cut() = 0;
-  virtual void Copy() = 0;
-  virtual void CopyToFindPboard() = 0;
-  virtual void Paste() = 0;
-  virtual void PasteAndMatchStyle() = 0;
-  virtual void Delete() = 0;
-  virtual void SelectAll() = 0;
-  virtual void Unselect() = 0;
-
   // Update the text direction of the focused input element and notify it to a
   // renderer process.
   // These functions have two usage scenarios: changing the text direction
@@ -199,20 +180,51 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   virtual void CopyFromBackingStore(
       const gfx::Rect& src_rect,
       const gfx::Size& accelerated_dst_size,
-      const base::Callback<void(bool, const SkBitmap&)>& callback) = 0;
-#if defined(TOOLKIT_GTK)
-  // Paint the backing store into the target's |dest_rect|.
-  virtual bool CopyFromBackingStoreToGtkWindow(const gfx::Rect& dest_rect,
-                                               GdkWindow* target) = 0;
-#elif defined(OS_MACOSX)
-  virtual gfx::Size GetBackingStoreSize() = 0;
-  virtual bool CopyFromBackingStoreToCGContext(const CGRect& dest_rect,
-                                               CGContextRef target) = 0;
+      const base::Callback<void(bool, const SkBitmap&)>& callback,
+      const SkBitmap::Config& bitmap_config) = 0;
+  // Ensures that the view does not drop the backing store even when hidden.
+  virtual bool CanCopyFromBackingStore() = 0;
+#if defined(OS_ANDROID)
+  virtual void LockBackingStore() = 0;
+  virtual void UnlockBackingStore() = 0;
 #endif
 
   // Send a command to the renderer to turn on full accessibility.
   virtual void EnableFullAccessibilityMode() = 0;
 
+  // Check whether this RenderWidget has full accessibility mode.
+  virtual bool IsFullAccessibilityModeForTesting() = 0;
+
+  // Send a command to the renderer to turn on tree only accessibility.
+  virtual void EnableTreeOnlyAccessibilityMode() = 0;
+
+  // Check whether this RenderWidget has tree-only accessibility mode.
+  virtual bool IsTreeOnlyAccessibilityModeForTesting() = 0;
+
+  // Relay a request from assistive technology to perform the default action
+  // on a given node.
+  virtual void AccessibilityDoDefaultAction(int object_id) = 0;
+
+  // Relay a request from assistive technology to set focus to a given node.
+  virtual void AccessibilitySetFocus(int object_id) = 0;
+
+  // Relay a request from assistive technology to make a given object
+  // visible by scrolling as many scrollable containers as necessary.
+  // In addition, if it's not possible to make the entire object visible,
+  // scroll so that the |subfocus| rect is visible at least. The subfocus
+  // rect is in local coordinates of the object itself.
+  virtual void AccessibilityScrollToMakeVisible(
+      int acc_obj_id, gfx::Rect subfocus) = 0;
+
+  // Relay a request from assistive technology to move a given object
+  // to a specific location, in the WebContents area coordinate space, i.e.
+  // (0, 0) is the top-left corner of the WebContents.
+  virtual void AccessibilityScrollToPoint(int acc_obj_id, gfx::Point point) = 0;
+
+  // Relay a request from assistive technology to set text selection.
+  virtual void AccessibilitySetTextSelection(
+      int acc_obj_id, int start_offset, int end_offset) = 0;
+
   // Forwards the given message to the renderer. These are called by
   // the view when it has received a message.
   virtual void ForwardMouseEvent(
@@ -240,28 +252,6 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // Returns true if this is a RenderViewHost, false if not.
   virtual bool IsRenderView() const = 0;
 
-  // This tells the renderer to paint into a bitmap and return it,
-  // regardless of whether the tab is hidden or not.  It resizes the
-  // web widget to match the |page_size| and then returns the bitmap
-  // scaled so it matches the |desired_size|, so that the scaling
-  // happens on the rendering thread.  When the bitmap is ready, the
-  // renderer sends a PaintAtSizeACK to this host, and a
-  // RENDER_WIDGET_HOST_DID_RECEIVE_PAINT_AT_SIZE_ACK notification is issued.
-  // Note that this bypasses most of the update logic that is normally invoked,
-  // and doesn't put the results into the backing store.
-  virtual void PaintAtSize(TransportDIB::Handle dib_handle,
-                           int tag,
-                           const gfx::Size& page_size,
-                           const gfx::Size& desired_size) = 0;
-
-  // Makes an IPC call to tell webkit to replace the currently selected word
-  // or a word around the cursor.
-  virtual void Replace(const base::string16& word) = 0;
-
-  // Makes an IPC call to tell webkit to replace the misspelling in the current
-  // selection.
-  virtual void ReplaceMisspelling(const base::string16& word) = 0;
-
   // Called to notify the RenderWidget that the resize rect has changed without
   // the size of the RenderWidget itself changing.
   virtual void ResizeRectChanged(const gfx::Rect& new_rect) = 0;
@@ -300,15 +290,7 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // Get the screen info corresponding to this render widget.
   virtual void GetWebScreenInfo(blink::WebScreenInfo* result) = 0;
 
-  // Grabs snapshot from renderer side and returns the bitmap to a callback.
-  // If |src_rect| is empty, the whole contents is copied. This is an expensive
-  // operation due to the IPC, but it can be used as a fallback method when
-  // CopyFromBackingStore fails due to the backing store not being available or,
-  // in composited mode, when the accelerated surface is not available to the
-  // browser side.
-  virtual void GetSnapshotFromRenderer(
-      const gfx::Rect& src_subrect,
-      const base::Callback<void(bool, const SkBitmap&)>& callback) = 0;
+  virtual SkBitmap::Config PreferredReadbackFormat() = 0;
 
  protected:
   friend class RenderWidgetHostImpl;
diff --git a/chromium/content/public/browser/render_widget_host_view.h b/chromium/content/public/browser/render_widget_host_view.h
index d815cdfd2b1..fff83a76f75 100644
--- a/chromium/content/public/browser/render_widget_host_view.h
+++ b/chromium/content/public/browser/render_widget_host_view.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_VIEW_H_
 
 #include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -13,10 +14,6 @@
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "ui/gfx/native_widget_types.h"
 
-#if defined(TOOLKIT_GTK)
-#include <gdk/gdk.h>
-#endif
-
 class GURL;
 
 namespace gfx {
@@ -24,10 +21,14 @@ class Rect;
 class Size;
 }
 
+namespace ui {
+class TextInputClient;
+}
+
 namespace content {
 
-class BrowserAccessibilityManager;
 class RenderWidgetHost;
+class RenderWidgetHostViewFrameSubscriber;
 
 // RenderWidgetHostView is an interface implemented by an object that acts as
 // the "View" portion of a RenderWidgetHost. The RenderWidgetHost and its
@@ -39,26 +40,12 @@ class RenderWidgetHost;
 //
 // RenderWidgetHostView Class Hierarchy:
 //   RenderWidgetHostView - Public interface.
-//   RenderWidgetHostViewPort - Private interface for content/ and ports.
 //   RenderWidgetHostViewBase - Common implementation between platforms.
-//   RenderWidgetHostViewWin, ... - Platform specific implementations.
+//   RenderWidgetHostViewAura, ... - Platform specific implementations.
 class CONTENT_EXPORT RenderWidgetHostView {
  public:
   virtual ~RenderWidgetHostView() {}
 
-  // Platform-specific creator. Use this to construct new RenderWidgetHostViews
-  // rather than using RenderWidgetHostViewWin & friends.
-  //
-  // This function must NOT size it, because the RenderView in the renderer
-  // wouldn't have been created yet. The widget would set its "waiting for
-  // resize ack" flag, and the ack would never come becasue no RenderView
-  // received it.
-  //
-  // The RenderWidgetHost must already be created (because we can't know if it's
-  // going to be a regular RenderWidgetHost or a RenderViewHost (a subclass).
-  static RenderWidgetHostView* CreateViewForWidget(
-      RenderWidgetHost* widget);
-
   // Initialize this object for use as a drawing area.  |parent_view| may be
   // left as NULL on platforms where a parent view is not required to initialize
   // a child window.
@@ -80,6 +67,13 @@ class CONTENT_EXPORT RenderWidgetHostView {
   virtual gfx::NativeViewId GetNativeViewId() const = 0;
   virtual gfx::NativeViewAccessible GetNativeViewAccessible() = 0;
 
+  // Returns a ui::TextInputClient to support text input or NULL if this RWHV
+  // doesn't support text input.
+  // Note: Not all the platforms use ui::InputMethod and ui::TextInputClient for
+  // text input.  Some platforms (Mac and Android for example) use their own
+  // text input system.
+  virtual ui::TextInputClient* GetTextInputClient() = 0;
+
   // Set focus to the associated View component.
   virtual void Focus() = 0;
   // Returns true if the View currently has the focus.
@@ -108,9 +102,9 @@ class CONTENT_EXPORT RenderWidgetHostView {
   virtual base::string16 GetSelectedText() const = 0;
 
   // Subclasses should override this method to do what is appropriate to set
-  // the custom background for their platform.
-  virtual void SetBackground(const SkBitmap& background) = 0;
-  virtual const SkBitmap& GetBackground() = 0;
+  // the background to be transparent or opaque.
+  virtual void SetBackgroundOpaque(bool opaque) = 0;
+  virtual bool GetBackgroundOpaque() = 0;
 
   // Return value indicates whether the mouse is locked successfully or not.
   virtual bool LockMouse() = 0;
@@ -118,6 +112,25 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // Returns true if the mouse pointer is currently locked.
   virtual bool IsMouseLocked() = 0;
 
+  // Retrives the size of the viewport for the visible region. May be smaller
+  // than the view size if a portion of the view is obstructed (e.g. by a
+  // virtual keyboard).
+  virtual gfx::Size GetVisibleViewportSize() const = 0;
+
+  // Set insets for the visible region of the root window. Used to compute the
+  // visible viewport.
+  virtual void SetInsets(const gfx::Insets& insets) = 0;
+
+  // Begin subscribing for presentation events and captured frames.
+  // |subscriber| is now owned by this object, it will be called only on the
+  // UI thread.
+  virtual void BeginFrameSubscription(
+      scoped_ptr<RenderWidgetHostViewFrameSubscriber> subscriber) = 0;
+
+  // End subscribing for frame presentation events. FrameSubscriber will be
+  // deleted after this call.
+  virtual void EndFrameSubscription() = 0;
+
 #if defined(OS_MACOSX)
   // Set the view's active state (i.e., tint state of controls).
   virtual void SetActive(bool active) = 0;
@@ -151,18 +164,6 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // Stops speaking, if it is currently in progress.
   virtual void StopSpeaking() = 0;
 #endif  // defined(OS_MACOSX)
-
-#if defined(TOOLKIT_GTK)
-  // Gets the event for the last mouse down.
-  virtual GdkEventButton* GetLastMouseDown() = 0;
-  // Builds a submenu containing all the gtk input method commands.
-  virtual gfx::NativeView BuildInputMethodsGtkMenu() = 0;
-#endif  // defined(TOOLKIT_GTK)
-
-#if defined(OS_WIN) && !defined(USE_AURA)
-  // The region specified will be transparent to mouse clicks.
-  virtual void SetClickthroughRegion(SkRegion* region) = 0;
-#endif
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/render_widget_host_view_frame_subscriber.h b/chromium/content/public/browser/render_widget_host_view_frame_subscriber.h
new file mode 100644
index 00000000000..0b658595caf
--- /dev/null
+++ b/chromium/content/public/browser/render_widget_host_view_frame_subscriber.h
@@ -0,0 +1,70 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PORT_BROWSER_RENDER_WIDGET_HOST_VIEW_FRAME_SUBSCRIBER_H_
+#define CONTENT_PORT_BROWSER_RENDER_WIDGET_HOST_VIEW_FRAME_SUBSCRIBER_H_
+
+#include "base/callback.h"
+#include "base/time/time.h"
+
+namespace gfx {
+class Rect;
+class Size;
+}  // namespace gfx
+
+namespace media {
+class VideoFrame;
+}  // namespace media
+
+namespace content {
+
+// Defines an interface for listening to events of frame presentation and to
+// instruct the platform layer (i.e. RenderWidgetHostView) to copy a frame.
+//
+// Further processing is possible (e.g. scale and color space conversion)
+// through this interface. See ShouldCaptureFrame() for details.
+//
+// It is platform dependent which thread this object lives on, but it is
+// guaranteed to be used on a single thread.
+class RenderWidgetHostViewFrameSubscriber {
+ public:
+  virtual ~RenderWidgetHostViewFrameSubscriber() {}
+
+  // Called when a captured frame is available or the frame is no longer
+  // needed by the platform layer.
+  //
+  // If |frame_captured| is true then frame provided contains valid content and
+  // |timestamp| is the time when the frame was painted.
+  //
+  // If |frame_captured| is false then the content in frame provided is
+  // invalid. There was an error during the process of frame capture or the
+  // platform layer is shutting down. |timestamp| is also invalid in this case.
+  typedef base::Callback<void(base::TimeTicks /* timestamp */,
+                              bool /* frame_captured */)> DeliverFrameCallback;
+
+  // Called when a new frame is going to be presented at time
+  // |present_time|. Implementation can decide whether the current frame should
+  // be captured or not.
+  //
+  // Return true if the current frame should be captured. If so, |storage|
+  // should will be set to hold an appropriately sized and allocated buffer
+  // into which to copy the frame. The platform presenter will perform scaling
+  // and color space conversion to fit into the output frame.
+  //
+  // Destination format is determined by |storage|, currently only
+  // media::VideoFrame::YV12 is supported. Platform layer will perform color
+  // space conversion if needed.
+  //
+  // When the frame is available |callback| will be called. It is up to the
+  // platform layer to decide when to deliver a captured frame.
+  //
+  // Return false if the current frame should not be captured.
+  virtual bool ShouldCaptureFrame(base::TimeTicks present_time,
+                                  scoped_refptr<media::VideoFrame>* storage,
+                                  DeliverFrameCallback* callback) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PORT_BROWSER_RENDER_WIDGET_HOST_VIEW_FRAME_SUBSCRIBER_H_
diff --git a/chromium/content/public/browser/render_widget_host_view_mac_delegate.h b/chromium/content/public/browser/render_widget_host_view_mac_delegate.h
index 6bcf744631d..c00d8bd3109 100644
--- a/chromium/content/public/browser/render_widget_host_view_mac_delegate.h
+++ b/chromium/content/public/browser/render_widget_host_view_mac_delegate.h
@@ -7,6 +7,10 @@
 
 #import <Cocoa/Cocoa.h>
 
+namespace blink {
+class WebMouseWheelEvent;
+}
+
 // This protocol is used as a delegate for the NSView class used in the
 // hierarchy. There are two ways to extend the view:
 // - Implement the methods listed in the protocol below.
@@ -27,15 +31,6 @@
 // normal processing should take place.
 - (BOOL)handleEvent:(NSEvent*)event;
 
-// Notification that a wheel event was unhandled.
-- (void)gotUnhandledWheelEvent;
-
-// Notification of scroll offset pinning.
-- (void)scrollOffsetPinnedToLeft:(BOOL)left toRight:(BOOL)right;
-
-// Notification of whether the view has a horizontal scrollbar.
-- (void)setHasHorizontalScrollbar:(BOOL)has_horizontal_scrollbar;
-
 // Provides validation of user interface items. If the return value is NO, then
 // the delegate is unaware of that item and |valid| is undefined.  Otherwise,
 // |valid| contains the validity of the specified item.
@@ -55,6 +50,16 @@
 - (void)touchesCancelledWithEvent:(NSEvent*)event;
 - (void)touchesEndedWithEvent:(NSEvent*)event;
 
+// These methods control whether a given view is allowed to rubberband in the
+// given direction. This is inversely related to whether the view is allowed to
+// 2-finger history swipe in the given direction.
+- (BOOL)canRubberbandLeft:(NSView*)view;
+- (BOOL)canRubberbandRight:(NSView*)view;
+
+// The browser process received an ACK from the renderer after it processed
+// |event|.
+- (void)rendererHandledWheelEvent:(const blink::WebMouseWheelEvent&)event
+                         consumed:(BOOL)consumed;
 @end
 
 #endif  // CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_VIEW_MAC_DELEGATE_H_
diff --git a/chromium/content/public/browser/resource_dispatcher_host.h b/chromium/content/public/browser/resource_dispatcher_host.h
index 0d4a624f2e8..7db278c8aac 100644
--- a/chromium/content/public/browser/resource_dispatcher_host.h
+++ b/chromium/content/public/browser/resource_dispatcher_host.h
@@ -6,7 +6,8 @@
 #define CONTENT_PUBLIC_BROWSER_RESOURCE_DISPATCHER_HOST_H_
 
 #include "base/callback_forward.h"
-#include "net/base/net_errors.h"
+#include "base/memory/scoped_ptr.h"
+#include "content/public/browser/download_interrupt_reasons.h"
 
 namespace net {
 class URLRequest;
@@ -22,8 +23,8 @@ struct Referrer;
 
 class CONTENT_EXPORT ResourceDispatcherHost {
  public:
-  typedef base::Callback<void(DownloadItem*, net::Error)>
-    DownloadStartedCallback;
+  typedef base::Callback<void(DownloadItem*, DownloadInterruptReason)>
+      DownloadStartedCallback;
 
   // Returns the singleton instance of the ResourceDispatcherHost.
   static ResourceDispatcherHost* Get();
@@ -45,8 +46,8 @@ class CONTENT_EXPORT ResourceDispatcherHost {
   // will be used.  (Note that this will result in re-use of an existing
   // download item if the download id was already assigned.)  If the download
   // is started, |started_callback| will be called on the UI thread with the
-  // DownloadItem; otherwise an error code will be returned.
-  virtual net::Error BeginDownload(
+  // DownloadItem; otherwise an interrupt reason will be returned.
+  virtual DownloadInterruptReason BeginDownload(
       scoped_ptr<net::URLRequest> request,
       const Referrer& referrer,
       bool is_content_initiated,
diff --git a/chromium/content/public/browser/resource_dispatcher_host_delegate.cc b/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
index 4457de11bef..607b1af81d2 100644
--- a/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
+++ b/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
@@ -28,15 +28,6 @@ void ResourceDispatcherHostDelegate::RequestBeginning(
     ScopedVector<ResourceThrottle>* throttles) {
 }
 
-void ResourceDispatcherHostDelegate::WillTransferRequestToNewProcess(
-      int old_child_id,
-      int old_route_id,
-      int old_request_id,
-      int new_child_id,
-      int new_route_id,
-      int new_request_id) {
-}
-
 void ResourceDispatcherHostDelegate::DownloadStarting(
     net::URLRequest* request,
     ResourceContext* resource_context,
@@ -48,18 +39,6 @@ void ResourceDispatcherHostDelegate::DownloadStarting(
     ScopedVector<ResourceThrottle>* throttles) {
 }
 
-bool ResourceDispatcherHostDelegate::AcceptSSLClientCertificateRequest(
-    net::URLRequest* request,
-    net::SSLCertRequestInfo* cert_request_info) {
-  return false;
-}
-
-bool ResourceDispatcherHostDelegate::AcceptAuthRequest(
-    net::URLRequest* request,
-    net::AuthChallengeInfo* auth_info) {
-  return false;
-}
-
 ResourceDispatcherHostLoginDelegate*
     ResourceDispatcherHostDelegate::CreateLoginDelegate(
         net::AuthChallengeInfo* auth_info,
@@ -80,21 +59,16 @@ bool ResourceDispatcherHostDelegate::ShouldForceDownloadResource(
 }
 
 bool ResourceDispatcherHostDelegate::ShouldInterceptResourceAsStream(
-    content::ResourceContext* resource_context,
-    const GURL& url,
+    net::URLRequest* request,
     const std::string& mime_type,
     GURL* origin,
-    std::string* target_id) {
+    std::string* payload) {
   return false;
 }
 
 void ResourceDispatcherHostDelegate::OnStreamCreated(
-    content::ResourceContext* resource_context,
-    int render_process_id,
-    int render_view_id,
-    const std::string& target_id,
-    scoped_ptr<StreamHandle> stream,
-    int64 expected_content_size) {
+    net::URLRequest* request,
+    scoped_ptr<content::StreamHandle> stream) {
 }
 
 void ResourceDispatcherHostDelegate::OnResponseStarted(
@@ -111,6 +85,10 @@ void ResourceDispatcherHostDelegate::OnRequestRedirected(
     ResourceResponse* response) {
 }
 
+void ResourceDispatcherHostDelegate::RequestComplete(
+    net::URLRequest* url_request) {
+}
+
 ResourceDispatcherHostDelegate::ResourceDispatcherHostDelegate() {
 }
 
diff --git a/chromium/content/public/browser/resource_dispatcher_host_delegate.h b/chromium/content/public/browser/resource_dispatcher_host_delegate.h
index 3bc9b85a927..cb8b683cfa4 100644
--- a/chromium/content/public/browser/resource_dispatcher_host_delegate.h
+++ b/chromium/content/public/browser/resource_dispatcher_host_delegate.h
@@ -33,7 +33,6 @@ class Sender;
 
 namespace net {
 class AuthChallengeInfo;
-class SSLCertRequestInfo;
 class URLRequest;
 }
 
@@ -65,15 +64,6 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
       int route_id,
       ScopedVector<ResourceThrottle>* throttles);
 
-  // Called if a navigation request is transferred from one process to another.
-  virtual void WillTransferRequestToNewProcess(
-      int old_child_id,
-      int old_route_id,
-      int old_request_id,
-      int new_child_id,
-      int new_route_id,
-      int new_request_id);
-
   // Allows an embedder to add additional resource handlers for a download.
   // |must_download| is set if the request must be handled as a download.
   virtual void DownloadStarting(
@@ -86,19 +76,6 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
       bool must_download,
       ScopedVector<ResourceThrottle>* throttles);
 
-  // Called when an SSL Client Certificate is requested. If false is returned,
-  // the request is canceled. Otherwise, the certificate is chosen.
-  virtual bool AcceptSSLClientCertificateRequest(
-      net::URLRequest* request,
-      net::SSLCertRequestInfo* cert_request_info);
-
-  // Called when authentication is required and credentials are needed. If
-  // false is returned, CancelAuth() is called on the URLRequest and the error
-  // page is shown. If true is returned, the user will be prompted for
-  // authentication credentials.
-  virtual bool AcceptAuthRequest(net::URLRequest* request,
-                                 net::AuthChallengeInfo* auth_info);
-
   // Creates a ResourceDispatcherHostLoginDelegate that asks the user for a
   // username and password.
   virtual ResourceDispatcherHostLoginDelegate* CreateLoginDelegate(
@@ -116,32 +93,28 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
   virtual bool ShouldForceDownloadResource(
       const GURL& url, const std::string& mime_type);
 
-  // Returns true and sets |origin| and |target_id| if a Stream should be
-  // created for the resource.
+  // Returns true and sets |origin| if a Stream should be created for the
+  // resource.
   // If true is returned, a new Stream will be created and OnStreamCreated()
   // will be called with
-  // - the |target_id| returned by this function
   // - a StreamHandle instance for the Stream. The handle contains the URL for
   //   reading the Stream etc.
   // The Stream's origin will be set to |origin|.
+  //
+  // If the stream will be rendered in a BrowserPlugin, |payload| will contain
+  // the data that should be given to the old ResourceHandler to forward to the
+  // renderer process.
   virtual bool ShouldInterceptResourceAsStream(
-      content::ResourceContext* resource_context,
-      const GURL& url,
+      net::URLRequest* request,
       const std::string& mime_type,
       GURL* origin,
-      std::string* target_id);
+      std::string* payload);
 
-  // Informs the delegate that a Stream was created. |target_id| will be filled
-  // with the parameter returned by ShouldInterceptResourceAsStream(). The
-  // Stream can be read from the blob URL of the Stream, but can only be read
-  // once.
+  // Informs the delegate that a Stream was created. The Stream can be read from
+  // the blob URL of the Stream, but can only be read once.
   virtual void OnStreamCreated(
-      content::ResourceContext* resource_context,
-      int render_process_id,
-      int render_view_id,
-      const std::string& target_id,
-      scoped_ptr<StreamHandle> stream,
-      int64 expected_content_size);
+      net::URLRequest* request,
+      scoped_ptr<content::StreamHandle> stream);
 
   // Informs the delegate that a response has started.
   virtual void OnResponseStarted(
@@ -157,6 +130,9 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
       ResourceContext* resource_context,
       ResourceResponse* response);
 
+  // Notification that a request has completed.
+  virtual void RequestComplete(net::URLRequest* url_request);
+
  protected:
   ResourceDispatcherHostDelegate();
   virtual ~ResourceDispatcherHostDelegate();
diff --git a/chromium/content/public/browser/resource_request_details.cc b/chromium/content/public/browser/resource_request_details.cc
index 7b92c845689..a5b91b90d05 100644
--- a/chromium/content/public/browser/resource_request_details.cc
+++ b/chromium/content/public/browser/resource_request_details.cc
@@ -6,6 +6,7 @@
 
 #include "content/browser/worker_host/worker_service_impl.h"
 #include "content/public/browser/resource_request_info.h"
+#include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 
 namespace content {
@@ -24,7 +25,10 @@ ResourceRequestDetails::ResourceRequestDetails(const net::URLRequest* request,
       socket_address(request->GetSocketAddress()) {
   const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request);
   resource_type = info->GetResourceType();
-  frame_id = info->GetFrameID();
+  render_frame_id = info->GetRenderFrameID();
+  http_response_code =
+      request->response_info().headers.get() ?
+          request->response_info().headers.get()->response_code() : -1;
 
   // If request is from the worker process on behalf of a renderer, use
   // the renderer process id, since it consumes the notification response
@@ -33,10 +37,10 @@ ResourceRequestDetails::ResourceRequestDetails(const net::URLRequest* request,
   // of ssl state change (http://crbug.com/25357). For now, just notify
   // the first one (works for dedicated workers and shared workers with
   // a single process).
+  int worker_render_frame_id;
   if (!WorkerServiceImpl::GetInstance()->GetRendererForWorker(
-          info->GetChildID(), &origin_child_id, &origin_route_id)) {
+          info->GetChildID(), &origin_child_id, &worker_render_frame_id)) {
     origin_child_id = info->GetChildID();
-    origin_route_id = info->GetRouteID();
   }
 }
 
diff --git a/chromium/content/public/browser/resource_request_details.h b/chromium/content/public/browser/resource_request_details.h
index 1c20557fd59..0127fefef22 100644
--- a/chromium/content/public/browser/resource_request_details.h
+++ b/chromium/content/public/browser/resource_request_details.h
@@ -34,13 +34,15 @@ struct ResourceRequestDetails {
   bool has_upload;
   int load_flags;
   int origin_child_id;
-  int origin_route_id;
   net::URLRequestStatus status;
   int ssl_cert_id;
   net::CertStatus ssl_cert_status;
   ResourceType::Type resource_type;
   net::HostPortPair socket_address;
-  int64 frame_id;
+  int render_frame_id;
+  // HTTP response code. See HttpResponseHeaders::response_code().
+  // -1 if there are no response headers yet.
+  int http_response_code;
 };
 
 // Details about a redirection of a resource request.
diff --git a/chromium/content/public/browser/resource_request_info.h b/chromium/content/public/browser/resource_request_info.h
index 1c191ab607d..f0badee0f7c 100644
--- a/chromium/content/public/browser/resource_request_info.h
+++ b/chromium/content/public/browser/resource_request_info.h
@@ -9,6 +9,7 @@
 #include "content/common/content_export.h"
 #include "content/public/common/page_transition_types.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
+#include "third_party/WebKit/public/web/WebPageVisibilityState.h"
 #include "webkit/common/resource_type.h"
 
 namespace net {
@@ -35,16 +36,17 @@ class ResourceRequestInfo {
       ResourceContext* context,
       int render_process_id,
       int render_view_id,
+      int render_frame_id,
       bool is_async);
 
-  // Returns the associated RenderView for a given process. Returns false, if
-  // there is no associated RenderView. This method does not rely on the
+  // Returns the associated RenderFrame for a given process. Returns false, if
+  // there is no associated RenderFrame. This method does not rely on the
   // request being allocated by the ResourceDispatcherHost, but works for all
-  // URLRequests that are associated with a RenderView.
-  CONTENT_EXPORT static bool GetRenderViewForRequest(
+  // URLRequests that are associated with a RenderFrame.
+  CONTENT_EXPORT static bool GetRenderFrameForRequest(
       const net::URLRequest* request,
       int* render_process_id,
-      int* render_view_id);
+      int* render_frame_id);
 
   // Returns the associated ResourceContext.
   virtual ResourceContext* GetContext() const = 0;
@@ -69,25 +71,29 @@ class ResourceRequestInfo {
   // just use GetRouteID above.
   virtual int GetRenderFrameID() const = 0;
 
-  // True if GetFrameID() represents a main frame in the RenderView.
+  // True if GetRenderFrameID() represents a main frame in the RenderView.
   virtual bool IsMainFrame() const = 0;
 
-  // Frame ID that sent this resource request. -1 if unknown / invalid.
-  virtual int64 GetFrameID() const = 0;
-
-  // True if GetParentFrameID() represents a main frame in the RenderView.
+  // True if GetParentRenderFrameID() represents a main frame in the RenderView.
   virtual bool ParentIsMainFrame() const = 0;
 
-  // Frame ID of parent frame of frame that sent this resource request.
+  // Routing ID of parent frame of frame that sent this resource request.
   // -1 if unknown / invalid.
-  virtual int64 GetParentFrameID() const = 0;
+  virtual int GetParentRenderFrameID() const = 0;
 
   // Returns the associated resource type.
   virtual ResourceType::Type GetResourceType() const = 0;
 
+  // Returns the process type that initiated this request.
+  virtual int GetProcessType() const = 0;
+
   // Returns the associated referrer policy.
   virtual blink::WebReferrerPolicy GetReferrerPolicy() const = 0;
 
+  // Returns the associated visibility state at the time the request was started
+  // in the renderer.
+  virtual blink::WebPageVisibilityState GetVisibilityState() const = 0;
+
   // Returns the associated page transition type.
   virtual PageTransition GetPageTransition() const = 0;
 
@@ -99,9 +105,9 @@ class ResourceRequestInfo {
   // the requested URL may be being loaded by an external program.
   virtual bool WasIgnoredByHandler() const = 0;
 
-  // Returns false if there is NOT an associated render view.
-  virtual bool GetAssociatedRenderView(int* render_process_id,
-                                       int* render_view_id) const = 0;
+  // Returns false if there is NOT an associated render frame.
+  virtual bool GetAssociatedRenderFrame(int* render_process_id,
+                                        int* render_frame_id) const = 0;
 
   // Returns true if this is associated with an asynchronous request.
   virtual bool IsAsync() const = 0;
diff --git a/chromium/content/public/browser/resource_throttle.h b/chromium/content/public/browser/resource_throttle.h
index 7bcab8813c1..469782d9dfd 100644
--- a/chromium/content/public/browser/resource_throttle.h
+++ b/chromium/content/public/browser/resource_throttle.h
@@ -25,6 +25,7 @@ class ResourceThrottle {
   virtual void WillStartRequest(bool* defer) {}
   virtual void WillRedirectRequest(const GURL& new_url, bool* defer) {}
   virtual void WillProcessResponse(bool* defer) {}
+  virtual void OnBeforeNetworkStart(bool* defer) {}
 
   // Returns the name of the throttle, as a UTF-8 C-string, for logging
   // purposes.  NULL is not allowed.  Caller does *not* take ownership of the
diff --git a/chromium/content/public/browser/service_worker_context.h b/chromium/content/public/browser/service_worker_context.h
new file mode 100644
index 00000000000..2d0805e9b99
--- /dev/null
+++ b/chromium/content/public/browser/service_worker_context.h
@@ -0,0 +1,64 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_H_
+#define CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_H_
+
+#include "base/basictypes.h"
+#include "base/callback_forward.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// Represents the per-StoragePartition ServiceWorker data.  Must be used from
+// the UI thread.
+class ServiceWorkerContext {
+ public:
+  // https://rawgithub.com/slightlyoff/ServiceWorker/master/spec/service_worker/index.html#url-scope:
+  // roughly, must be of the form "<origin>/<path>/*".
+  typedef GURL Scope;
+
+  typedef base::Callback<void(bool success)> ResultCallback;
+
+  // Equivalent to calling navigator.serviceWorker.register(script_url, {scope:
+  // pattern}) from a renderer, except that |pattern| is an absolute URL instead
+  // of relative to some current origin.  |callback| is passed true when the JS
+  // promise is fulfilled or false when the JS promise is rejected.
+  //
+  // The registration can fail if:
+  //  * |script_url| is on a different origin from |pattern|
+  //  * Fetching |script_url| fails.
+  //  * |script_url| fails to parse or its top-level execution fails.
+  //    TODO: The error message for this needs to be available to developers.
+  //  * Something unexpected goes wrong, like a renderer crash or a full disk.
+  virtual void RegisterServiceWorker(const Scope& pattern,
+                                     const GURL& script_url,
+                                     const ResultCallback& callback) = 0;
+
+  // Equivalent to calling navigator.serviceWorker.unregister(pattern) from a
+  // renderer, except that |pattern| is an absolute URL instead of relative to
+  // some current origin.  |callback| is passed true when the JS promise is
+  // fulfilled or false when the JS promise is rejected.
+  //
+  // Unregistration can fail if:
+  //  * No Service Worker was registered for |pattern|.
+  //  * Something unexpected goes wrong, like a renderer crash.
+  virtual void UnregisterServiceWorker(const Scope& pattern,
+                                       const ResultCallback& callback) = 0;
+
+  // TODO(jyasskin): Provide a way to SendMessage to a Scope.
+
+  // Synchronously releases all of the RenderProcessHosts that have Service
+  // Workers running inside them, and prevents any new Service Worker instances
+  // from starting up.
+  virtual void Terminate() = 0;
+
+ protected:
+  ServiceWorkerContext() {}
+  virtual ~ServiceWorkerContext() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_H_
diff --git a/chromium/content/public/browser/session_storage_namespace.h b/chromium/content/public/browser/session_storage_namespace.h
index ec49419ffb3..374b7b050fb 100644
--- a/chromium/content/public/browser/session_storage_namespace.h
+++ b/chromium/content/public/browser/session_storage_namespace.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_SESSION_STORAGE_NAMESPACE_H_
 #define CONTENT_PUBLIC_BROWSER_SESSION_STORAGE_NAMESPACE_H_
 
+#include <map>
 #include <string>
 
 #include "base/basictypes.h"
@@ -79,6 +80,10 @@ class SessionStorageNamespace
   virtual ~SessionStorageNamespace() {}
 };
 
+// Used to store mappings of StoragePartition id to SessionStorageNamespace.
+typedef std::map<std::string, scoped_refptr<SessionStorageNamespace> >
+    SessionStorageNamespaceMap;
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_SESSION_STORAGE_NAMESPACE_H_
diff --git a/chromium/content/public/browser/site_instance.h b/chromium/content/public/browser/site_instance.h
index 2cede0abf41..9c9e6633864 100644
--- a/chromium/content/public/browser/site_instance.h
+++ b/chromium/content/public/browser/site_instance.h
@@ -12,7 +12,6 @@
 
 namespace content {
 class BrowserContext;
-class BrowsingInstance;
 class RenderProcessHost;
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -107,6 +106,10 @@ class CONTENT_EXPORT SiteInstance : public base::RefCounted<SiteInstance> {
   // origins (e.g., postMessage) should be supported.
   virtual bool IsRelatedSiteInstance(const SiteInstance* instance) = 0;
 
+  // Returns the total active WebContents count for this SiteInstance and all
+  // related SiteInstances in the same BrowsingInstance.
+  virtual size_t GetRelatedActiveContentsCount() = 0;
+
   // Factory method to create a new SiteInstance.  This will create a new
   // new BrowsingInstance, so it should only be used when creating a new tab
   // from scratch (or similar circumstances).  Callers should ensure that
diff --git a/chromium/content/public/browser/speech_recognition_session_config.h b/chromium/content/public/browser/speech_recognition_session_config.h
index 813fbd1056a..1cde6430b0d 100644
--- a/chromium/content/public/browser/speech_recognition_session_config.h
+++ b/chromium/content/public/browser/speech_recognition_session_config.h
@@ -22,7 +22,9 @@ struct CONTENT_EXPORT SpeechRecognitionSessionConfig {
   SpeechRecognitionSessionConfig();
   ~SpeechRecognitionSessionConfig();
 
+  // TODO(hans): The legacy API is dead; remove this flag (crbug.com/223198).
   bool is_legacy_api;
+
   std::string language;
   SpeechRecognitionGrammarArray grammars;
   std::string origin_url;
diff --git a/chromium/content/public/browser/speech_recognition_session_context.cc b/chromium/content/public/browser/speech_recognition_session_context.cc
index f362ef34f18..9b6575b4f0e 100644
--- a/chromium/content/public/browser/speech_recognition_session_context.cc
+++ b/chromium/content/public/browser/speech_recognition_session_context.cc
@@ -14,8 +14,7 @@ SpeechRecognitionSessionContext::SpeechRecognitionSessionContext()
       guest_render_view_id(MSG_ROUTING_NONE),
       embedder_render_process_id(0),
       embedder_render_view_id(MSG_ROUTING_NONE),
-      request_id(0),
-      requested_by_page_element(true) {
+      request_id(0) {
 }
 
 SpeechRecognitionSessionContext::~SpeechRecognitionSessionContext() {
diff --git a/chromium/content/public/browser/speech_recognition_session_context.h b/chromium/content/public/browser/speech_recognition_session_context.h
index 5606b78f352..d092a5daf04 100644
--- a/chromium/content/public/browser/speech_recognition_session_context.h
+++ b/chromium/content/public/browser/speech_recognition_session_context.h
@@ -46,14 +46,6 @@ struct CONTENT_EXPORT SpeechRecognitionSessionContext {
 
   int request_id;
 
-  // Determines whether recognition was requested by a page element (in which
-  // case its coordinates are passed in |element_rect|).
-  bool requested_by_page_element;
-
-  // The coordinates of the page element for placing the bubble (valid only when
-  // |requested_by_page_element| = true).
-  gfx::Rect element_rect;
-
   // A texual description of the context (website, extension name) that is
   // requesting recognition, for prompting security notifications to the user.
   std::string context_name;
diff --git a/chromium/content/public/browser/storage_partition.h b/chromium/content/public/browser/storage_partition.h
index 579ccbcbb44..3a4139d633b 100644
--- a/chromium/content/public/browser/storage_partition.h
+++ b/chromium/content/public/browser/storage_partition.h
@@ -38,6 +38,7 @@ namespace content {
 class BrowserContext;
 class IndexedDBContext;
 class DOMStorageContext;
+class ServiceWorkerContext;
 
 // Defines what persistent state a child process can access.
 //
@@ -56,6 +57,7 @@ class StoragePartition {
   virtual webkit_database::DatabaseTracker* GetDatabaseTracker() = 0;
   virtual DOMStorageContext* GetDOMStorageContext() = 0;
   virtual IndexedDBContext* GetIndexedDBContext() = 0;
+  virtual ServiceWorkerContext* GetServiceWorkerContext() = 0;
 
   enum RemoveDataMask {
     REMOVE_DATA_MASK_APPCACHE = 1 << 0,
@@ -113,7 +115,7 @@ class StoragePartition {
   // scheduled.
   virtual void ClearData(uint32 remove_mask,
                          uint32 quota_storage_remove_mask,
-                         const GURL* storage_origin,
+                         const GURL& storage_origin,
                          const OriginMatcherFunction& origin_matcher,
                          const base::Time begin,
                          const base::Time end,
diff --git a/chromium/content/public/browser/stream_handle.h b/chromium/content/public/browser/stream_handle.h
index 5965a40350e..94591d7d41d 100644
--- a/chromium/content/public/browser/stream_handle.h
+++ b/chromium/content/public/browser/stream_handle.h
@@ -6,9 +6,14 @@
 #define CONTENT_PUBLIC_BROWSER_STREAM_HANDLE_H_
 
 #include "base/callback.h"
+#include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "url/gurl.h"
 
+namespace net {
+class HttpResponseHeaders;
+}
+
 namespace content {
 
 class CONTENT_EXPORT StreamHandle {
@@ -23,6 +28,12 @@ class CONTENT_EXPORT StreamHandle {
 
   // Get the MIME type associated with this Stream.
   virtual const std::string& GetMimeType() = 0;
+
+  // Get the HTTP response headers associated with this Stream.
+  virtual scoped_refptr<net::HttpResponseHeaders> GetResponseHeaders() = 0;
+
+  // Add a callback which will be called when the Stream is closed.
+  virtual void AddCloseListener(const base::Closure& callback) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/url_data_source.cc b/chromium/content/public/browser/url_data_source.cc
index d9506f50cf3..148e62ab229 100644
--- a/chromium/content/public/browser/url_data_source.cc
+++ b/chromium/content/public/browser/url_data_source.cc
@@ -46,8 +46,8 @@ bool URLDataSource::ShouldDenyXFrameOptions() const {
 }
 
 bool URLDataSource::ShouldServiceRequest(const net::URLRequest* request) const {
-  if (request->url().SchemeIs(chrome::kChromeDevToolsScheme) ||
-      request->url().SchemeIs(chrome::kChromeUIScheme))
+  if (request->url().SchemeIs(kChromeDevToolsScheme) ||
+      request->url().SchemeIs(kChromeUIScheme))
     return true;
   return false;
 }
diff --git a/chromium/content/public/browser/url_data_source.h b/chromium/content/public/browser/url_data_source.h
index d93e51e4d87..33c185b63b8 100644
--- a/chromium/content/public/browser/url_data_source.h
+++ b/chromium/content/public/browser/url_data_source.h
@@ -36,7 +36,11 @@ class CONTENT_EXPORT URLDataSource {
 
   // The name of this source.
   // E.g., for favicons, this could be "favicon", which results in paths for
-  // specific resources like "favicon/34" getting sent to this source.
+  // specific resources like "favicon/34" getting sent to this source. For
+  // sources where a scheme is used instead of the hostname as the unique
+  // identifier, the suffix "://" must be added to the return value, eg. for a
+  // URLDataSource which would display resources with URLs on the form
+  // your-scheme://anything , GetSource() must return "your-scheme://".
   virtual std::string GetSource() const = 0;
 
   // Used by StartDataRequest so that the child class can return the data when
@@ -49,7 +53,7 @@ class CONTENT_EXPORT URLDataSource {
   // called either in this callback or asynchronously with the response.
   virtual void StartDataRequest(const std::string& path,
                                 int render_process_id,
-                                int render_view_id,
+                                int render_frame_id,
                                 const GotDataCallback& callback) = 0;
 
   // Return the mimetype that should be sent with this response, or empty
diff --git a/chromium/content/public/browser/user_metrics.h b/chromium/content/public/browser/user_metrics.h
index e9480acaea3..118d8a93ae3 100644
--- a/chromium/content/public/browser/user_metrics.h
+++ b/chromium/content/public/browser/user_metrics.h
@@ -8,50 +8,17 @@
 #include <string>
 
 #include "base/callback.h"
+#include "base/metrics/user_metrics_action.h"
 #include "content/common/content_export.h"
-#include "content/public/common/user_metrics_action.h"
 
 namespace content {
 
-// This module provides some helper functions for logging actions tracked by
-// the user metrics system.
-
-// Record that the user performed an action.
-// "Action" here means a user-generated event:
-//   good: "Reload", "CloseTab", and "IMEInvoked"
-//   not good: "SSLDialogShown", "PageLoaded", "DiskFull"
-// We use this to gather anonymized information about how users are
-// interacting with the browser.
-// WARNING: In calls to this function, UserMetricsAction and a
-// string literal parameter must be on the same line, e.g.
-//   content::RecordAction(
-//       content::UserMetricsAction("my extremely long action name"));
-// This ensures that our processing scripts can associate this action's hash
-// with its metric name. Therefore, it will be possible to retrieve the metric
-// name from the hash later on.
-//
-// Once a new recorded action is added, run
-// tools/metrics/actions/extract_actions.py --hash
-// to generate a new mapping of [action hashes -> metric names] and send it
-// out for review to be updated.
-//
-// For more complicated situations (like when there are many different
-// possible actions), see RecordComputedAction.
-CONTENT_EXPORT void RecordAction(const UserMetricsAction& action);
-
-// This function has identical input and behavior to RecordAction, but is
-// not automatically found by the action-processing scripts.  It can be used
-// when it's a pain to enumerate all possible actions, but if you use this
-// you need to also update the rules for extracting known actions in
-// tools/metrics/actions/extract_actions.py.
-CONTENT_EXPORT void RecordComputedAction(const std::string& action);
-
-// Called with the action string.
-typedef base::Callback<void(const std::string&)> ActionCallback;
+// Wrappers around functions defined in base/metrics/user_metrics.h, refer to
+// that header for full documentation. These wrappers can be called from any
+// thread (they will post back to the UI thread to do the recording).
 
-// Add/remove action callbacks (see above).
-CONTENT_EXPORT void AddActionCallback(const ActionCallback& callback);
-CONTENT_EXPORT void RemoveActionCallback(const ActionCallback& callback);
+CONTENT_EXPORT void RecordAction(const base::UserMetricsAction& action);
+CONTENT_EXPORT void RecordComputedAction(const std::string& action);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/utility_process_host.h b/chromium/content/public/browser/utility_process_host.h
index 1f027a8610b..756d50f1d1e 100644
--- a/chromium/content/public/browser/utility_process_host.h
+++ b/chromium/content/public/browser/utility_process_host.h
@@ -20,9 +20,6 @@ namespace content {
 class UtilityProcessHostClient;
 struct ChildProcessData;
 
-typedef base::Thread* (*UtilityMainThreadFactoryFunction)(
-    const std::string& id);
-
 // This class acts as the browser-side host to a utility child process.  A
 // utility process is a short-lived process that is created to run a specific
 // task.  This class lives solely on the IO thread.
@@ -61,15 +58,17 @@ class UtilityProcessHost : public IPC::Sender,
   // Make the process run without a sandbox.
   virtual void DisableSandbox() = 0;
 
+#if defined(OS_WIN)
+  // Make the process run elevated.
+  virtual void ElevatePrivileges() = 0;
+#endif
+
   // Returns information about the utility child process.
   virtual const ChildProcessData& GetData() = 0;
 
 #if defined(OS_POSIX)
   virtual void SetEnv(const base::EnvironmentMap& env) = 0;
 #endif
-
-  CONTENT_EXPORT static void RegisterUtilityMainThreadFactory(
-      UtilityMainThreadFactoryFunction create);
 };
 
 };  // namespace content
diff --git a/chromium/content/public/browser/utility_process_host_client.h b/chromium/content/public/browser/utility_process_host_client.h
index 73d707bb18a..bd7e89d6203 100644
--- a/chromium/content/public/browser/utility_process_host_client.h
+++ b/chromium/content/public/browser/utility_process_host_client.h
@@ -23,6 +23,9 @@ class UtilityProcessHostClient
   // Called when the process has crashed.
   virtual void OnProcessCrashed(int exit_code) {}
 
+  // Called when the process fails to launch, i.e. it has no exit code.
+  virtual void OnProcessLaunchFailed() {}
+
   // Allow the client to filter IPC messages.
   virtual bool OnMessageReceived(const IPC::Message& message) = 0;
 
diff --git a/chromium/content/public/browser/vibration_provider.h b/chromium/content/public/browser/vibration_provider.h
new file mode 100644
index 00000000000..71eba76a2da
--- /dev/null
+++ b/chromium/content/public/browser/vibration_provider.h
@@ -0,0 +1,23 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_VIBRATION_PROVIDER_H_
+#define CONTENT_PUBLIC_BROWSER_VIBRATION_PROVIDER_H_
+
+namespace content {
+
+class VibrationProvider {
+ public:
+  // Device should start vibrating for N milliseconds.
+  virtual void Vibrate(int64 milliseconds) = 0;
+
+  // Cancels vibration of the device.
+  virtual void CancelVibration() = 0;
+
+  virtual ~VibrationProvider() {}
+};
+
+}  // namespace content
+
+#endif // CONTENT_PUBLIC_BROWSER_VIBRATION_PROVIDER_H_
diff --git a/chromium/content/public/browser/web_contents.cc b/chromium/content/public/browser/web_contents.cc
index d8547679ba1..549e881c748 100644
--- a/chromium/content/public/browser/web_contents.cc
+++ b/chromium/content/public/browser/web_contents.cc
@@ -12,9 +12,11 @@ WebContents::CreateParams::CreateParams(BrowserContext* context)
     : browser_context(context),
       site_instance(NULL),
       opener(NULL),
+      opener_suppressed(false),
       routing_id(MSG_ROUTING_NONE),
       main_frame_routing_id(MSG_ROUTING_NONE),
       initially_hidden(false),
+      guest_instance_id(0),
       context(NULL) {}
 
 WebContents::CreateParams::CreateParams(
@@ -22,9 +24,14 @@ WebContents::CreateParams::CreateParams(
     : browser_context(context),
       site_instance(site),
       opener(NULL),
+      opener_suppressed(false),
       routing_id(MSG_ROUTING_NONE),
       main_frame_routing_id(MSG_ROUTING_NONE),
       initially_hidden(false),
+      guest_instance_id(0),
       context(NULL) {}
 
+WebContents::CreateParams::~CreateParams() {
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index 0f59c773096..0e388764929 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -18,23 +18,24 @@
 #include "content/public/browser/page_navigator.h"
 #include "content/public/browser/save_page_type.h"
 #include "content/public/browser/web_ui.h"
+#include "content/public/common/stop_find_action.h"
 #include "ipc/ipc_sender.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/native_widget_types.h"
-#include "ui/gfx/size.h"
+#include "ui/gfx/rect.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/scoped_java_ref.h"
 #endif
 
 namespace base {
+class DictionaryValue;
 class TimeTicks;
 }
 
-namespace gfx {
-class Rect;
-class Size;
+namespace blink {
+struct WebFindOptions;
 }
 
 namespace net {
@@ -52,7 +53,8 @@ class RenderViewHost;
 class RenderWidgetHostView;
 class SiteInstance;
 class WebContentsDelegate;
-class WebContentsView;
+struct CustomContextMenuContext;
+struct DropData;
 struct RendererPreferences;
 
 // WebContents is the core class in content/. A WebContents renders web content
@@ -62,7 +64,7 @@ struct RendererPreferences;
 //   scoped_ptr<content::WebContents> web_contents(
 //       content::WebContents::Create(
 //           content::WebContents::CreateParams(browser_context)));
-//   gfx::NativeView view = web_contents->GetView()->GetNativeView();
+//   gfx::NativeView view = web_contents->GetNativeView();
 //   // |view| is an HWND, NSView*, GtkWidget*, etc.; insert it into the view
 //   // hierarchy wherever it needs to go.
 //
@@ -81,6 +83,7 @@ class WebContents : public PageNavigator,
  public:
   struct CONTENT_EXPORT CreateParams {
     explicit CreateParams(BrowserContext* context);
+    ~CreateParams();
     CreateParams(BrowserContext* context, SiteInstance* site);
 
     BrowserContext* browser_context;
@@ -90,7 +93,13 @@ class WebContents : public PageNavigator,
     // privileged process.
     SiteInstance* site_instance;
 
+    // The opener WebContents is the WebContents that initiated this request,
+    // if any.
     WebContents* opener;
+
+    // If the opener is suppressed, then the new WebContents doesn't hold a
+    // reference to its opener.
+    bool opener_suppressed;
     int routing_id;
     int main_frame_routing_id;
 
@@ -100,6 +109,14 @@ class WebContents : public PageNavigator,
     // True if the contents should be initially hidden.
     bool initially_hidden;
 
+    // If this instance ID is non-zero then it indicates that this WebContents
+    // should behave as a guest.
+    int guest_instance_id;
+
+    // TODO(fsamuel): This is temporary. Remove this once all guests are created
+    // from the content embedder.
+    scoped_ptr<base::DictionaryValue> guest_extra_params;
+
     // Used to specify the location context which display the new view should
     // belong. This can be NULL if not needed.
     gfx::NativeView context;
@@ -127,6 +144,8 @@ class WebContents : public PageNavigator,
   CONTENT_EXPORT static WebContents* FromRenderViewHost(
       const RenderViewHost* rvh);
 
+  CONTENT_EXPORT static WebContents* FromRenderFrameHost(RenderFrameHost* rfh);
+
   virtual ~WebContents() {}
 
   // Intrinsic tab state -------------------------------------------------------
@@ -156,7 +175,7 @@ class WebContents : public PageNavigator,
   virtual const GURL& GetVisibleURL() const = 0;
 
   // Gets the last committed URL. It represents the current page that is
-  // displayed in  this WebContents. It represents the current security
+  // displayed in this WebContents. It represents the current security
   // context.
   virtual const GURL& GetLastCommittedURL() const = 0;
 
@@ -167,30 +186,20 @@ class WebContents : public PageNavigator,
   // Returns the main frame for the currently active view.
   virtual RenderFrameHost* GetMainFrame() = 0;
 
+  // Returns the focused frame for the currently active view.
+  virtual RenderFrameHost* GetFocusedFrame() = 0;
+
+  // Calls |on_frame| for each frame in the currently active view.
+  virtual void ForEachFrame(
+      const base::Callback<void(RenderFrameHost*)>& on_frame) = 0;
+
+  // Sends the given IPC to all frames in the currently active view. This is a
+  // convenience method instead of calling ForEach.
+  virtual void SendToAllFrames(IPC::Message* message) = 0;
+
   // Gets the current RenderViewHost for this tab.
   virtual RenderViewHost* GetRenderViewHost() const = 0;
 
-  typedef base::Callback<void(RenderViewHost* /* render_view_host */,
-                              int /* x */,
-                              int /* y */)> GetRenderViewHostCallback;
-  // Gets the RenderViewHost at coordinates (|x|, |y|) for this WebContents via
-  // |callback|.
-  // This can be different than the current RenderViewHost if there is a
-  // BrowserPlugin at the specified position.
-  virtual void GetRenderViewHostAtPosition(
-      int x,
-      int y,
-      const GetRenderViewHostCallback& callback) = 0;
-
-  // Returns the WebContents embedding this WebContents, if any.
-  // If this is a top-level WebContents then it returns NULL.
-  virtual WebContents* GetEmbedderWebContents() const = 0;
-
-  // Gets the instance ID of the current WebContents if it is embedded
-  // within a BrowserPlugin. The instance ID of a WebContents uniquely
-  // identifies it within its embedder WebContents.
-  virtual int GetEmbeddedInstanceID() const = 0;
-
   // Gets the current RenderViewHost's routing id. Returns
   // MSG_ROUTING_NONE when there is no RenderViewHost.
   virtual int GetRoutingID() const = 0;
@@ -203,9 +212,6 @@ class WebContents : public PageNavigator,
   // NULL.
   virtual RenderWidgetHostView* GetFullscreenRenderWidgetHostView() const = 0;
 
-  // The WebContentsView will never change and is guaranteed non-NULL.
-  virtual WebContentsView* GetView() const = 0;
-
   // Create a WebUI page for the given url. In most cases, this doesn't need to
   // be called by embedders since content will create its own WebUI objects as
   // necessary. However if the embedder wants to create its own WebUI object and
@@ -220,7 +226,7 @@ class WebContents : public PageNavigator,
   virtual void SetUserAgentOverride(const std::string& override) = 0;
   virtual const std::string& GetUserAgentOverride() const = 0;
 
-#if defined(OS_WIN) && defined(USE_AURA)
+#if defined(OS_WIN)
   virtual void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) = 0;
 #endif
@@ -249,25 +255,30 @@ class WebContents : public PageNavigator,
   // returns the current SiteInstance.
   virtual SiteInstance* GetPendingSiteInstance() const = 0;
 
-  // Return whether this WebContents is loading a resource.
+  // Returns whether this WebContents is loading a resource.
   virtual bool IsLoading() const = 0;
 
+  // Returns whether this WebContents is loading and and the load is to a
+  // different top-level document (rather than being a navigation within the
+  // same document). This being true implies that IsLoading() is also true.
+  virtual bool IsLoadingToDifferentDocument() const = 0;
+
   // Returns whether this WebContents is waiting for a first-response for the
   // main resource of the page.
   virtual bool IsWaitingForResponse() const = 0;
 
-  // Return the current load state and the URL associated with it.
+  // Returns the current load state and the URL associated with it.
   virtual const net::LoadStateWithParam& GetLoadState() const = 0;
   virtual const base::string16& GetLoadStateHost() const = 0;
 
-  // Return the upload progress.
+  // Returns the upload progress.
   virtual uint64 GetUploadSize() const = 0;
   virtual uint64 GetUploadPosition() const = 0;
 
   // Returns a set of the site URLs currently committed in this tab.
   virtual std::set<GURL> GetSitesInTab() const = 0;
 
-  // Return the character encoding of the page.
+  // Returns the character encoding of the page.
   virtual const std::string& GetEncoding() const = 0;
 
   // True if this is a secure page which displayed insecure content.
@@ -277,8 +288,11 @@ class WebContents : public PageNavigator,
 
   // Indicates whether the WebContents is being captured (e.g., for screenshots
   // or mirroring).  Increment calls must be balanced with an equivalent number
-  // of decrement calls.
-  virtual void IncrementCapturerCount() = 0;
+  // of decrement calls.  |capture_size| specifies the capturer's video
+  // resolution, but can be empty to mean "unspecified."  The first screen
+  // capturer that provides a non-empty |capture_size| will override the value
+  // returned by GetPreferredSize() until all captures have ended.
+  virtual void IncrementCapturerCount(const gfx::Size& capture_size) = 0;
   virtual void DecrementCapturerCount() = 0;
   virtual int GetCapturerCount() const = 0;
 
@@ -296,8 +310,9 @@ class WebContents : public PageNavigator,
   // change. See InvalidateType enum.
   virtual void NotifyNavigationStateChanged(unsigned changed_flags) = 0;
 
-  // Get the last time that the WebContents was made visible with WasShown()
-  virtual base::TimeTicks GetLastSelectedTime() const = 0;
+  // Get the last time that the WebContents was made active (either when it was
+  // created or shown with WasShown()).
+  virtual base::TimeTicks GetLastActiveTime() const = 0;
 
   // Invoked when the WebContents becomes shown/hidden.
   virtual void WasShown() = 0;
@@ -309,6 +324,17 @@ class WebContents : public PageNavigator,
   // returns false.
   virtual bool NeedToFireBeforeUnload() = 0;
 
+  // Runs the beforeunload handler for the main frame. See also ClosePage and
+  // SwapOut in RenderViewHost, which run the unload handler.
+  //
+  // |for_cross_site_transition| indicates whether this call is for the current
+  // frame during a cross-process navigation. False means we're closing the
+  // entire tab.
+  //
+  // TODO(creis): We should run the beforeunload handler for every frame that
+  // has one.
+  virtual void DispatchBeforeUnload(bool for_cross_site_transition) = 0;
+
   // Commands ------------------------------------------------------------------
 
   // Stop any pending navigation.
@@ -318,7 +344,74 @@ class WebContents : public PageNavigator,
   // heap-allocated pointer is owned by the caller.
   virtual WebContents* Clone() = 0;
 
+  // Reloads the focused frame.
+  virtual void ReloadFocusedFrame(bool ignore_cache) = 0;
+
+  // Editing commands ----------------------------------------------------------
+
+  virtual void Undo() = 0;
+  virtual void Redo() = 0;
+  virtual void Cut() = 0;
+  virtual void Copy() = 0;
+  virtual void CopyToFindPboard() = 0;
+  virtual void Paste() = 0;
+  virtual void PasteAndMatchStyle() = 0;
+  virtual void Delete() = 0;
+  virtual void SelectAll() = 0;
+  virtual void Unselect() = 0;
+
+  // Replaces the currently selected word or a word around the cursor.
+  virtual void Replace(const base::string16& word) = 0;
+
+  // Replaces the misspelling in the current selection.
+  virtual void ReplaceMisspelling(const base::string16& word) = 0;
+
+  // Let the renderer know that the menu has been closed.
+  virtual void NotifyContextMenuClosed(
+      const CustomContextMenuContext& context) = 0;
+
+  // Executes custom context menu action that was provided from Blink.
+  virtual void ExecuteCustomContextMenuCommand(
+      int action, const CustomContextMenuContext& context) = 0;
+
   // Views and focus -----------------------------------------------------------
+
+  // Returns the native widget that contains the contents of the tab.
+  virtual gfx::NativeView GetNativeView() = 0;
+
+  // Returns the native widget with the main content of the tab (i.e. the main
+  // render view host, though there may be many popups in the tab as children of
+  // the container).
+  virtual gfx::NativeView GetContentNativeView() = 0;
+
+  // Returns the outermost native view. This will be used as the parent for
+  // dialog boxes.
+  virtual gfx::NativeWindow GetTopLevelNativeWindow() = 0;
+
+  // Computes the rectangle for the native widget that contains the contents of
+  // the tab in the screen coordinate system.
+  virtual gfx::Rect GetContainerBounds() = 0;
+
+  // Get the bounds of the View, relative to the parent.
+  virtual gfx::Rect GetViewBounds() = 0;
+
+  // Returns the current drop data, if any.
+  virtual DropData* GetDropData() = 0;
+
+  // Sets focus to the native widget for this tab.
+  virtual void Focus() = 0;
+
+  // Sets focus to the appropriate element when the WebContents is shown the
+  // first time.
+  virtual void SetInitialFocus() = 0;
+
+  // Stores the currently focused view.
+  virtual void StoreFocus() = 0;
+
+  // Restores focus to the last focus view. If StoreFocus has not yet been
+  // invoked, SetInitialFocus is invoked.
+  virtual void RestoreFocus() = 0;
+
   // Focuses the first (last if |reverse| is true) element in the page.
   // Invoked when this tab is getting the focus through tab traversal (|reverse|
   // is true when using Shift-Tab).
@@ -359,9 +452,6 @@ class WebContents : public PageNavigator,
       const base::Callback<void(
           int64 /* size of the file */)>& callback) = 0;
 
-  // Returns true if the active NavigationEntry's page_id equals page_id.
-  virtual bool IsActiveEntry(int32 page_id) = 0;
-
   // Returns the contents MIME type after a navigation.
   virtual const std::string& GetContentsMimeType() const = 0;
 
@@ -402,9 +492,6 @@ class WebContents : public PageNavigator,
   virtual void SetClosedByUserGesture(bool value) = 0;
   virtual bool GetClosedByUserGesture() const = 0;
 
-  // Gets the zoom level for this tab.
-  virtual double GetZoomLevel() const = 0;
-
   // Gets the zoom percent for this tab.
   virtual int GetZoomPercent(bool* enable_increment,
                              bool* enable_decrement) const = 0;
@@ -466,14 +553,46 @@ class WebContents : public PageNavigator,
                             uint32_t max_bitmap_size,
                             const ImageDownloadCallback& callback) = 0;
 
-  // Sets the zoom level for the current page and all BrowserPluginGuests
-  // within the page.
-  virtual void SetZoomLevel(double level) = 0;
+  // Returns true if the WebContents is responsible for displaying a subframe
+  // in a different process from its parent page.
+  // TODO: this doesn't really belong here. With site isolation, this should be
+  // removed since we can then embed iframes in different processes.
+  virtual bool IsSubframe() const = 0;
+
+  // Finds text on a page.
+  virtual void Find(int request_id,
+                    const base::string16& search_text,
+                    const blink::WebFindOptions& options) = 0;
+
+  // Notifies the renderer that the user has closed the FindInPage window
+  // (and what action to take regarding the selection).
+  virtual void StopFinding(StopFindAction action) = 0;
+
+  // Requests the renderer to insert CSS into the main frame's document.
+  virtual void InsertCSS(const std::string& css) = 0;
 
 #if defined(OS_ANDROID)
   CONTENT_EXPORT static WebContents* FromJavaWebContents(
       jobject jweb_contents_android);
   virtual base::android::ScopedJavaLocalRef<jobject> GetJavaWebContents() = 0;
+#elif defined(OS_MACOSX)
+  // The web contents view assumes that its view will never be overlapped by
+  // another view (either partially or fully). This allows it to perform
+  // optimizations. If the view is in a view hierarchy where it might be
+  // overlapped by another view, notify the view by calling this with |true|.
+  virtual void SetAllowOverlappingViews(bool overlapping) = 0;
+
+  // Returns true if overlapping views are allowed, false otherwise.
+  virtual bool GetAllowOverlappingViews() = 0;
+
+  // To draw two overlapping web contents view, the underlaying one should
+  // know about the overlaying one. Caller must ensure that |overlay| exists
+  // until |RemoveOverlayView| is called.
+  virtual void SetOverlayView(WebContents* overlay,
+                              const gfx::Point& offset) = 0;
+
+  // Removes the previously set overlay view.
+  virtual void RemoveOverlayView() = 0;
 #endif  // OS_ANDROID
 
  private:
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index 63ad65baeab..0028339ab63 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -27,8 +27,6 @@ bool WebContentsDelegate::IsPopupOrPanel(const WebContents* source) const {
   return false;
 }
 
-bool WebContentsDelegate::CanLoadDataURLsInWebUI() const { return false; }
-
 bool WebContentsDelegate::CanOverscrollContent() const { return false; }
 
 gfx::Rect WebContentsDelegate::GetRootWindowResizerRect() const {
@@ -39,6 +37,10 @@ bool WebContentsDelegate::ShouldSuppressDialogs() {
   return false;
 }
 
+bool WebContentsDelegate::ShouldPreserveAbortedURLs(WebContents* source) {
+  return false;
+}
+
 bool WebContentsDelegate::AddMessageToConsole(WebContents* source,
                                               int32 level,
                                               const base::string16& message,
@@ -71,7 +73,7 @@ int WebContentsDelegate::GetExtraRenderViewHeight() const {
 
 void WebContentsDelegate::CanDownload(
     RenderViewHost* render_view_host,
-    int request_id,
+    const GURL& url,
     const std::string& request_method,
     const base::Callback<void(bool)>& callback) {
   callback.Run(true);
@@ -110,6 +112,12 @@ bool WebContentsDelegate::PreHandleKeyboardEvent(
   return false;
 }
 
+bool WebContentsDelegate::PreHandleGestureEvent(
+    WebContents* source,
+    const blink::WebGestureEvent& event) {
+  return false;
+}
+
 bool WebContentsDelegate::CanDragEnter(
     WebContents* source,
     const DropData& data,
@@ -156,7 +164,9 @@ void WebContentsDelegate::RequestMediaAccessPermission(
     WebContents* web_contents,
     const MediaStreamRequest& request,
     const MediaResponseCallback& callback) {
-  callback.Run(MediaStreamDevices(), scoped_ptr<MediaStreamUI>());
+  callback.Run(MediaStreamDevices(),
+               MEDIA_DEVICE_INVALID_STATE,
+               scoped_ptr<MediaStreamUI>());
 }
 
 bool WebContentsDelegate::RequestPpapiBrokerPermission(
@@ -186,8 +196,12 @@ void WebContentsDelegate::Detach(WebContents* web_contents) {
 }
 
 gfx::Size WebContentsDelegate::GetSizeForNewRenderView(
-    const WebContents* web_contents) const {
+   WebContents* web_contents) const {
   return gfx::Size();
 }
 
+bool WebContentsDelegate::IsNeverVisible(WebContents* web_contents) {
+  return false;
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index e1319c0a433..52e4747ca59 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -55,6 +55,7 @@ class Size;
 }
 
 namespace blink {
+class WebGestureEvent;
 class WebLayer;
 struct WebWindowFeatures;
 }
@@ -88,9 +89,9 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual void NavigationStateChanged(const WebContents* source,
                                       unsigned changed_flags) {}
 
-  // Adds the navigation request headers to |headers|. Use
-  // net::HttpUtil::AppendHeaderIfMissing to build the set of headers.
-  virtual void AddNavigationHeaders(const GURL& url, std::string* headers) {}
+  // Called to inform the delegate that the WebContent's visible SSL state (as
+  // defined by SSLStatus) changed.
+  virtual void VisibleSSLStateChanged(const WebContents* source) {}
 
   // Creates a new tab with the already-created WebContents 'new_contents'.
   // The window for the added contents should be reparented correctly when this
@@ -115,7 +116,10 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Notifies the delegate that this contents is starting or is done loading
   // some resource. The delegate should use this notification to represent
   // loading feedback. See WebContents::IsLoading()
-  virtual void LoadingStateChanged(WebContents* source) {}
+  // |to_different_document| will be true unless the load is a fragment
+  // navigation, or triggered by history.pushState/replaceState.
+  virtual void LoadingStateChanged(WebContents* source,
+                                   bool to_different_document) {}
 
   // Notifies the delegate that the page has made some progress loading.
   // |progress| is a value between 0.0 (nothing loaded) to 1.0 (page fully
@@ -162,10 +166,6 @@ class CONTENT_EXPORT WebContentsDelegate {
   // delegate.
   virtual void OverscrollUpdate(int delta_y) {}
 
-  // Check whether this contents is permitted to load data URLs in WebUI mode.
-  // This is normally disallowed for security.
-  virtual bool CanLoadDataURLsInWebUI() const;
-
   // Return the rect where to display the resize corner, if any, otherwise
   // an empty rect.
   virtual gfx::Rect GetRootWindowResizerRect() const;
@@ -177,6 +177,11 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Default is false.
   virtual bool ShouldSuppressDialogs();
 
+  // Returns whether pending NavigationEntries for aborted browser-initiated
+  // navigations should be preserved (and thus returned from GetVisibleURL).
+  // Defaults to false.
+  virtual bool ShouldPreserveAbortedURLs(WebContents* source);
+
   // Add a message to the console. Returning true indicates that the delegate
   // handled the message. If false is returned the default logging mechanism
   // will be used for the message.
@@ -210,11 +215,6 @@ class CONTENT_EXPORT WebContentsDelegate {
   // to live. Default is true.
   virtual bool ShouldFocusPageAfterCrash();
 
-  // Called when a popup select is about to be displayed. The delegate can use
-  // this to disable inactive rendering for the frame in the window the select
-  // is opened within if necessary.
-  virtual void RenderWidgetShowing() {}
-
   // This is called when WebKit tells us that it is done tabbing through
   // controls on the page. Provides a way for WebContentsDelegates to handle
   // this. Returns true if the delegate successfully handled it.
@@ -230,7 +230,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Asks the delegate if the given tab can download.
   // Invoking the |callback| synchronously is OK.
   virtual void CanDownload(RenderViewHost* render_view_host,
-                           int request_id,
+                           const GURL& url,
                            const std::string& request_method,
                            const base::Callback<void(bool)>& callback);
 
@@ -271,6 +271,15 @@ class CONTENT_EXPORT WebContentsDelegate {
   // pressed, or a touch-gesture begins).
   virtual void HandlePointerActivate() {}
 
+  // Allows delegates to handle gesture events before sending to the renderer.
+  // Returns true if the |event| was handled and thus shouldn't be processed
+  // by the renderer's event handler. Note that the touch events that create
+  // the gesture are always passed to the renderer since the gesture is created
+  // and dispatched after the touches return without being "preventDefault()"ed.
+  virtual bool PreHandleGestureEvent(
+      WebContents* source,
+      const blink::WebGestureEvent& event);
+
   virtual void HandleGestureBegin() {}
   virtual void HandleGestureEnd() {}
 
@@ -294,6 +303,8 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Allows delegate to control whether a WebContents will be created. Returns
   // true to allow the creation. Default is to allow it. In cases where the
   // delegate handles the creation/navigation itself, it will use |target_url|.
+  // The embedder has to synchronously adopt |route_id| or else the view will
+  // be destroyed.
   virtual bool ShouldCreateWebContents(
       WebContents* web_contents,
       int route_id,
@@ -306,7 +317,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Notifies the delegate about the creation of a new WebContents. This
   // typically happens when popups are created.
   virtual void WebContentsCreated(WebContents* source_contents,
-                                  int64 source_frame_id,
+                                  int opener_render_frame_id,
                                   const base::string16& frame_name,
                                   const GURL& target_url,
                                   WebContents* new_contents) {}
@@ -364,16 +375,12 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual bool IsFullscreenForTabOrPending(
       const WebContents* web_contents) const;
 
-  // Called when a Javascript out of memory notification is received.
-  virtual void JSOutOfMemory(WebContents* web_contents) {}
-
   // Register a new handler for URL requests with the given scheme.
   // |user_gesture| is true if the registration is made in the context of a user
   // gesture.
   virtual void RegisterProtocolHandler(WebContents* web_contents,
                                        const std::string& protocol,
                                        const GURL& url,
-                                       const base::string16& title,
                                        bool user_gesture) {}
 
   // Result of string search in the page. This includes the number of matches
@@ -393,13 +400,6 @@ class CONTENT_EXPORT WebContentsDelegate {
                                    int version,
                                    const std::vector<gfx::RectF>& rects,
                                    const gfx::RectF& active_rect) {}
-
-  // Request permission to access protected media identifier. The callback will
-  // tell whether it's allowed.
-  virtual void RequestProtectedMediaIdentifierPermission(
-      const WebContents* web_contents,
-      const GURL& frame_url,
-      const base::Callback<void(bool)>& callback) {}
 #endif
 
   // Invoked when the preferred size of the contents has been changed.
@@ -450,15 +450,14 @@ class CONTENT_EXPORT WebContentsDelegate {
   // This is optional for implementations of WebContentsDelegate; if the
   // delegate doesn't provide a size, the current WebContentsView's size will be
   // used.
-  virtual gfx::Size GetSizeForNewRenderView(
-      const WebContents* web_contents) const;
+  virtual gfx::Size GetSizeForNewRenderView(WebContents* web_contents) const;
 
   // Notification that validation of a form displayed by the |web_contents|
   // has failed. There can only be one message per |web_contents| at a time.
   virtual void ShowValidationMessage(WebContents* web_contents,
                                      const gfx::Rect& anchor_in_root_view,
-                                     const string16& main_text,
-                                     const string16& sub_text) {}
+                                     const base::string16& main_text,
+                                     const base::string16& sub_text) {}
 
   // Notification that the delegate should hide any showing form validation
   // message.
@@ -469,6 +468,9 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual void MoveValidationMessage(WebContents* web_contents,
                                      const gfx::Rect& anchor_in_root_view) {}
 
+  // Returns true if the WebContents is never visible.
+  virtual bool IsNeverVisible(WebContents* web_contents);
+
  protected:
   virtual ~WebContentsDelegate();
 
diff --git a/chromium/content/public/browser/web_contents_observer.cc b/chromium/content/public/browser/web_contents_observer.cc
index fc0fcf253ac..3178b188bd5 100644
--- a/chromium/content/public/browser/web_contents_observer.cc
+++ b/chromium/content/public/browser/web_contents_observer.cc
@@ -41,6 +41,12 @@ void WebContentsObserver::Observe(WebContents* web_contents) {
   }
 }
 
+bool WebContentsObserver::OnMessageReceived(
+    const IPC::Message& message,
+    RenderFrameHost* render_frame_host) {
+  return false;
+}
+
 bool WebContentsObserver::OnMessageReceived(const IPC::Message& message) {
   return false;
 }
@@ -61,12 +67,9 @@ int WebContentsObserver::routing_id() const {
   return web_contents_->GetRoutingID();
 }
 
-void WebContentsObserver::WebContentsImplDestroyed() {
-  // Do cleanup so that 'this' can safely be deleted from WebContentsDestroyed.
+void WebContentsObserver::ResetWebContents() {
   web_contents_->RemoveObserver(this);
-  WebContentsImpl* contents = web_contents_;
   web_contents_ = NULL;
-  WebContentsDestroyed(contents);
 }
 
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index ce6c2da8ccc..72c6ff60680 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -9,9 +9,11 @@
 #include "base/process/process_handle.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/navigation_controller.h"
+#include "content/public/common/frame_navigate_params.h"
 #include "content/public/common/page_transition_types.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 
 namespace content {
@@ -21,6 +23,7 @@ class RenderFrameHost;
 class RenderViewHost;
 class WebContents;
 class WebContentsImpl;
+struct AXEventNotificationDetails;
 struct FaviconURL;
 struct FrameNavigateParams;
 struct LoadCommittedDetails;
@@ -52,11 +55,13 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // deleted.
   virtual void RenderFrameDeleted(RenderFrameHost* render_frame_host) {}
 
-  // Only one of the two methods below will be called when a RVH is created for
-  // a WebContents, depending on whether it's for an interstitial or not.
+  // This is called when a RVH is created for a WebContents, but not if it's an
+  // interstitial.
   virtual void RenderViewCreated(RenderViewHost* render_view_host) {}
-  virtual void RenderViewForInterstitialPageCreated(
-      RenderViewHost* render_view_host) {}
+
+  // Called for every RenderFrameHost that's created for an interstitial.
+  virtual void RenderFrameForInterstitialPageCreated(
+      RenderFrameHost* render_frame_host) {}
 
   // This method is invoked when the RenderView of the current RenderViewHost
   // is ready, e.g. because we recreated it after a crash.
@@ -70,9 +75,11 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
 
   // This method is invoked when the process for the current RenderView crashes.
   // The WebContents continues to use the RenderViewHost, e.g. when the user
-  // reloads the current page.
-  // When the RenderViewHost is deleted, the RenderViewDeleted method will be
-  // invoked.
+  // reloads the current page. When the RenderViewHost itself is deleted, the
+  // RenderViewDeleted method will be invoked.
+  //
+  // Note that this is equivalent to
+  // RenderProcessHostObserver::RenderProcessExited().
   virtual void RenderProcessGone(base::TerminationStatus status) {}
 
   // This method is invoked when a WebContents swaps its render view host with
@@ -123,7 +130,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // WebContentsObserver::DidGetRedirectForResourceRequest instead.
   virtual void ProvisionalChangeToMainFrameUrl(
       const GURL& url,
-      RenderViewHost* render_view_host) {}
+      RenderFrameHost* render_frame_host) {}
 
   // This method is invoked when the provisional load was successfully
   // committed. The |render_view_host| is now the current RenderViewHost of the
@@ -167,7 +174,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
 
   // This method is invoked once the onload handler of the main frame has
   // completed.
-  virtual void DocumentOnLoadCompletedInMainFrame(int32 page_id) {}
+  virtual void DocumentOnLoadCompletedInMainFrame() {}
 
   // This method is invoked when the document in the given frame finished
   // loading. At this point, scripts marked as defer were executed, and
@@ -207,6 +214,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // This method is invoked when a redirect was received while requesting a
   // resource.
   virtual void DidGetRedirectForResourceRequest(
+      RenderViewHost* render_view_host,
       const ResourceRedirectDetails& details) {}
 
   // This method is invoked when a new non-pending navigation entry is created.
@@ -232,7 +240,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
 
   // This method is invoked when the renderer has completed its first paint
   // after a non-empty layout.
-  virtual void DidFirstVisuallyNonEmptyPaint(int32 page_id) {}
+  virtual void DidFirstVisuallyNonEmptyPaint() {}
 
   // These two methods correspond to the points in time when the spinner of the
   // tab starts and stops spinning.
@@ -286,24 +294,23 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
                                         WebContents* new_web_contents) {}
 
   // Invoked when the WebContents is being destroyed. Gives subclasses a chance
-  // to cleanup. At the time this is invoked |web_contents()| returns NULL.
-  // It is safe to delete 'this' from here.
-  virtual void WebContentsDestroyed(WebContents* web_contents) {}
+  // to cleanup. After the whole loop over all WebContentsObservers has been
+  // finished, web_contents() returns NULL.
+  virtual void WebContentsDestroyed() {}
 
   // Called when the user agent override for a WebContents has been changed.
   virtual void UserAgentOverrideSet(const std::string& user_agent) {}
 
   // Invoked when new FaviconURL candidates are received from the renderer.
-  virtual void DidUpdateFaviconURL(int32 page_id,
-                                   const std::vector<FaviconURL>& candidates) {}
+  virtual void DidUpdateFaviconURL(const std::vector<FaviconURL>& candidates) {}
 
   // Invoked when a pepper plugin creates and shows or destroys a fullscreen
   // render widget.
   virtual void DidShowFullscreenWidget(int routing_id) {}
   virtual void DidDestroyFullscreenWidget(int routing_id) {}
 
-  // Invoked when visible SSL state (as defined by SSLStatus) changes.
-  virtual void DidChangeVisibleSSLState() {}
+  // Invoked when the renderer has toggled the tab into/out of fullscreen mode.
+  virtual void DidToggleFullscreenModeForTab(bool entered_fullscreen) {}
 
   // Invoked when an interstitial page is attached or detached.
   virtual void DidAttachInterstitialPage() {}
@@ -318,6 +325,17 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // Invoked when a user cancels a before unload dialog.
   virtual void BeforeUnloadDialogCancelled() {}
 
+  // Invoked when an accessibility event is received from the renderer.
+  virtual void AccessibilityEventReceived(
+      const std::vector<AXEventNotificationDetails>& details) {}
+
+  // Invoked when theme color is changed to |theme_color|.
+  virtual void DidChangeThemeColor(SkColor theme_color) {}
+
+  // Invoked if an IPC message is coming from a specific RenderFrameHost.
+  virtual bool OnMessageReceived(const IPC::Message& message,
+                                 RenderFrameHost* render_frame_host);
+
   // IPC::Listener implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
@@ -345,9 +363,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
  private:
   friend class WebContentsImpl;
 
-  // Invoked from WebContentsImpl. Invokes WebContentsDestroyed and NULL out
-  // |web_contents_|.
-  void WebContentsImplDestroyed();
+  void ResetWebContents();
 
   WebContentsImpl* web_contents_;
 
diff --git a/chromium/content/public/browser/web_contents_view.h b/chromium/content/public/browser/web_contents_view.h
deleted file mode 100644
index 8405945e68e..00000000000
--- a/chromium/content/public/browser/web_contents_view.h
+++ /dev/null
@@ -1,107 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_H_
-#define CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_H_
-
-#include <string>
-
-#include "base/basictypes.h"
-#include "base/process/kill.h"
-#include "content/common/content_export.h"
-#include "ui/gfx/native_widget_types.h"
-#include "ui/gfx/rect.h"
-#include "ui/gfx/size.h"
-
-namespace content {
-struct DropData;
-
-// The WebContentsView is an interface that is implemented by the platform-
-// dependent web contents views. The WebContents uses this interface to talk to
-// them.
-class CONTENT_EXPORT WebContentsView {
- public:
-  virtual ~WebContentsView() {}
-
-  // Returns the native widget that contains the contents of the tab.
-  virtual gfx::NativeView GetNativeView() const = 0;
-
-  // Returns the native widget with the main content of the tab (i.e. the main
-  // render view host, though there may be many popups in the tab as children of
-  // the container).
-  virtual gfx::NativeView GetContentNativeView() const = 0;
-
-  // Returns the outermost native view. This will be used as the parent for
-  // dialog boxes.
-  virtual gfx::NativeWindow GetTopLevelNativeWindow() const = 0;
-
-  // Computes the rectangle for the native widget that contains the contents of
-  // the tab in the screen coordinate system.
-  virtual void GetContainerBounds(gfx::Rect* out) const = 0;
-
-  // Helper function for GetContainerBounds. Most callers just want to know the
-  // size, and this makes it more clear.
-  gfx::Size GetContainerSize() const {
-    gfx::Rect rc;
-    GetContainerBounds(&rc);
-    return gfx::Size(rc.width(), rc.height());
-  }
-
-  // Used to notify the view that a tab has crashed.
-  virtual void OnTabCrashed(base::TerminationStatus status, int error_code) = 0;
-
-  // TODO(brettw) this is a hack. It's used in two places at the time of this
-  // writing: (1) when render view hosts switch, we need to size the replaced
-  // one to be correct, since it wouldn't have known about sizes that happened
-  // while it was hidden; (2) in constrained windows.
-  //
-  // (1) will be fixed once interstitials are cleaned up. (2) seems like it
-  // should be cleaned up or done some other way, since this works for normal
-  // WebContents without the special code.
-  virtual void SizeContents(const gfx::Size& size) = 0;
-
-  // Sets focus to the native widget for this tab.
-  virtual void Focus() = 0;
-
-  // Sets focus to the appropriate element when the WebContents is shown the
-  // first time.
-  virtual void SetInitialFocus() = 0;
-
-  // Stores the currently focused view.
-  virtual void StoreFocus() = 0;
-
-  // Restores focus to the last focus view. If StoreFocus has not yet been
-  // invoked, SetInitialFocus is invoked.
-  virtual void RestoreFocus() = 0;
-
-  // Returns the current drop data, if any.
-  virtual DropData* GetDropData() const = 0;
-
-  // Get the bounds of the View, relative to the parent.
-  virtual gfx::Rect GetViewBounds() const = 0;
-
-#if defined(OS_MACOSX)
-  // The web contents view assumes that its view will never be overlapped by
-  // another view (either partially or fully). This allows it to perform
-  // optimizations. If the view is in a view hierarchy where it might be
-  // overlapped by another view, notify the view by calling this with |true|.
-  virtual void SetAllowOverlappingViews(bool overlapping) = 0;
-
-  // Returns true if overlapping views are allowed, false otherwise.
-  virtual bool GetAllowOverlappingViews() const = 0;
-
-  // To draw two overlapping web contents view, the underlaying one should
-  // know about the overlaying one. Caller must ensure that |overlay| exists
-  // until |RemoveOverlayView| is called.
-  virtual void SetOverlayView(WebContentsView* overlay,
-                              const gfx::Point& offset) = 0;
-
-  // Removes the previously set overlay view.
-  virtual void RemoveOverlayView() = 0;
-#endif
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_H_
diff --git a/chromium/content/public/browser/web_contents_view_delegate.h b/chromium/content/public/browser/web_contents_view_delegate.h
index 0e61017b6b9..b0e3f6255b9 100644
--- a/chromium/content/public/browser/web_contents_view_delegate.h
+++ b/chromium/content/public/browser/web_contents_view_delegate.h
@@ -5,9 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_WIN_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_WIN_DELEGATE_H_
 
-#if defined(TOOLKIT_GTK)
-#include <gtk/gtk.h>
-#elif defined(OS_MACOSX)
+#if defined(OS_MACOSX)
 #import <Cocoa/Cocoa.h>
 #endif
 
@@ -27,7 +25,7 @@ class FocusStoreGtk;
 }
 
 namespace content {
-
+class RenderFrameHost;
 class RenderWidgetHost;
 class WebDragDestDelegate;
 struct ContextMenuParams;
@@ -42,9 +40,10 @@ class CONTENT_EXPORT WebContentsViewDelegate {
   virtual WebDragDestDelegate* GetDragDestDelegate() = 0;
 
   // Shows a context menu.
-  virtual void ShowContextMenu(const content::ContextMenuParams& params) = 0;
+  virtual void ShowContextMenu(RenderFrameHost* render_frame_host,
+                               const ContextMenuParams& params) = 0;
 
-#if defined(OS_WIN) || defined(USE_AURA)
+#if defined(USE_AURA)
   // These methods allow the embedder to intercept WebContentsViewWin's
   // implementation of these WebContentsView methods. See the WebContentsView
   // interface documentation for more information about these methods.
@@ -53,25 +52,6 @@ class CONTENT_EXPORT WebContentsViewDelegate {
   virtual bool Focus() = 0;
   virtual void TakeFocus(bool reverse) = 0;
   virtual void SizeChanged(const gfx::Size& size) = 0;
-#elif defined(TOOLKIT_GTK)
-  // Initializes the WebContentsViewDelegate.
-  virtual void Initialize(GtkWidget* expanded_container,
-                          ui::FocusStoreGtk* focus_store) = 0;
-
-  // Returns the top widget that contains |view| passed in from WrapView. This
-  // is exposed through WebContentsViewGtk::GetNativeView() when a wrapper is
-  // supplied to a WebContentsViewGtk.
-  virtual gfx::NativeView GetNativeView() const = 0;
-
-  // Handles a focus event from the renderer process.
-  virtual void Focus() = 0;
-
-  // Gives the delegate a first chance at focus events from our render widget
-  // host, before the main view invokes its default behaviour. Returns TRUE if
-  // |return_value| has been set and that value should be returned to GTK+.
-  virtual gboolean OnNativeViewFocusEvent(GtkWidget* widget,
-                                          GtkDirectionType type,
-                                          gboolean* return_value) = 0;
 #elif defined(OS_MACOSX)
   // Returns a newly-created delegate for the RenderWidgetHostViewMac, to handle
   // events on the responder chain.
diff --git a/chromium/content/public/browser/web_drag_dest_delegate.h b/chromium/content/public/browser/web_drag_dest_delegate.h
index a556b88af0b..0f13c947800 100644
--- a/chromium/content/public/browser/web_drag_dest_delegate.h
+++ b/chromium/content/public/browser/web_drag_dest_delegate.h
@@ -5,16 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_DRAG_DEST_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_DRAG_DEST_DELEGATE_H_
 
-#if defined(TOOLKIT_GTK)
-#include <gtk/gtk.h>
-#endif  // TOOLKIT_GTK
-
 #include "base/strings/string16.h"
 
-#if defined(OS_WIN)
-#include "ui/base/dragdrop/drop_target_win.h"
-#endif
-
 class GURL;
 
 namespace ui {
@@ -34,38 +26,17 @@ class WebDragDestDelegate {
   virtual void DragInitialize(WebContents* contents) = 0;
 
   // Notifications of drag progression.
-#if defined(OS_WIN) && !defined(USE_AURA)
-  virtual void OnDragOver(IDataObject* data_object) = 0;
-  virtual void OnDragEnter(IDataObject* data_object) = 0;
-  virtual void OnDrop(IDataObject* data_object) = 0;
-  virtual void OnDragLeave(IDataObject* data_object) = 0;
-#else
   virtual void OnDragOver() = 0;
   virtual void OnDragEnter() = 0;
   virtual void OnDrop() = 0;
   // This should also clear any state kept about this drag.
   virtual void OnDragLeave() = 0;
-#endif
-
-#if defined(TOOLKIT_GTK)
-  // Returns the bookmark atom type. GTK and Views return different values here.
-  virtual GdkAtom GetBookmarkTargetAtom() const = 0;
 
-  // Called when WebDragDestkGtk detects that there's bookmark data in a
-  // drag. Not every drag will trigger these.
-  virtual void OnReceiveDataFromGtk(GtkSelectionData* data) = 0;
-  virtual void OnReceiveProcessedData(const GURL& url,
-                                      const base::string16& title) = 0;
-#elif defined(USE_AURA)
+#if defined(USE_AURA)
   // Called at the start of every drag to supply the data associated with the
   // drag.
   virtual void OnReceiveDragData(const ui::OSExchangeData& data) = 0;
-#elif defined(OS_WIN)
-  // Allows the delegate to set data on the drag. If it doesn't want to set
-  // data, it should return false.
-  virtual bool AddDragData(const DropData& drop_data,
-                           ui::OSExchangeData* data) = 0;
-#endif  // TOOLKIT_GTK
+#endif  // USE_AURA
 
   virtual ~WebDragDestDelegate() {}
 };
diff --git a/chromium/content/public/browser/web_ui.h b/chromium/content/public/browser/web_ui.h
index 5427673ad43..52ce114dcf3 100644
--- a/chromium/content/public/browser/web_ui.h
+++ b/chromium/content/public/browser/web_ui.h
@@ -12,7 +12,6 @@
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "content/public/common/page_transition_types.h"
-#include "ui/base/layout.h"
 
 class GURL;
 
@@ -55,7 +54,7 @@ class CONTENT_EXPORT WebUI {
   // Returns the device scale factor of the monitor that the renderer is on.
   // Whenever possible, WebUI should push resources with this scale factor to
   // Javascript.
-  virtual ui::ScaleFactor GetDeviceScaleFactor() const = 0;
+  virtual float GetDeviceScaleFactor() const = 0;
 
   // Gets a custom tab title provided by the Web UI. If there is no title
   // override, the string will be empty which should trigger the default title
@@ -73,8 +72,10 @@ class CONTENT_EXPORT WebUI {
   virtual int GetBindings() const = 0;
   virtual void SetBindings(int bindings) = 0;
 
-  // Sets the path for the iframe if this WebUI is embedded in a page.
-  virtual void SetFrameXPath(const std::string& xpath) = 0;
+  // Overrides which frame gets JavaScript messages; this is useful if this
+  // WebUI is embedded in a page. If no override is set, the main frame will
+  // receive the JavaScript messages.
+  virtual void OverrideJavaScriptFrame(const std::string& frame_name) = 0;
 
   // Takes ownership of |handler|, which will be destroyed when the WebUI is.
   virtual void AddMessageHandler(WebUIMessageHandler* handler) = 0;
diff --git a/chromium/content/public/browser/web_ui_data_source.h b/chromium/content/public/browser/web_ui_data_source.h
index b5cc6d577ba..2acb117b2c0 100644
--- a/chromium/content/public/browser/web_ui_data_source.h
+++ b/chromium/content/public/browser/web_ui_data_source.h
@@ -25,6 +25,12 @@ class WebUIDataSource {
 
   CONTENT_EXPORT static WebUIDataSource* Create(const std::string& source_name);
 
+  // Adds the necessary resources for mojo bindings returning the
+  // WebUIDataSource that handles the resources. Callers do not own the return
+  // value.
+  CONTENT_EXPORT static WebUIDataSource* AddMojoDataSource(
+      BrowserContext* browser_context);
+
   // Adds a WebUI data source to |browser_context|.
   CONTENT_EXPORT static void Add(BrowserContext* browser_context,
                                  WebUIDataSource* source);
@@ -55,7 +61,7 @@ class WebUIDataSource {
   virtual void SetUseJsonJSFormatV2() = 0;
 
   // Adds a mapping between a path name and a resource to return.
-  virtual void AddResourcePath(const std::string &path, int resource_id) = 0;
+  virtual void AddResourcePath(const std::string& path, int resource_id) = 0;
 
   // Sets the resource to returned when no other paths match.
   virtual void SetDefaultResource(int resource_id) = 0;
diff --git a/chromium/content/public/browser/worker_service.h b/chromium/content/public/browser/worker_service.h
index 7ce2bf4ec1f..83a8bd83e0c 100644
--- a/chromium/content/public/browser/worker_service.h
+++ b/chromium/content/public/browser/worker_service.h
@@ -26,6 +26,9 @@ class WorkerService {
   // Returns the WorkerService singleton.
   CONTENT_EXPORT static WorkerService* GetInstance();
 
+  // Determines whether embedded SharedWorker is enabled.
+  CONTENT_EXPORT static bool EmbeddedSharedWorkerEnabled();
+
   // Terminates the given worker. Returns true if the process was found.
   virtual bool TerminateWorker(int process_id, int route_id) = 0;
 
diff --git a/chromium/content/public/browser/zygote_host_linux.h b/chromium/content/public/browser/zygote_host_linux.h
index 77cc00b2fb1..ebe5ee7387f 100644
--- a/chromium/content/public/browser/zygote_host_linux.h
+++ b/chromium/content/public/browser/zygote_host_linux.h
@@ -26,9 +26,6 @@ class ZygoteHost {
   // Returns the pid of the Zygote process.
   virtual pid_t GetPid() const = 0;
 
-  // Returns the pid of the Sandbox Helper process.
-  virtual pid_t GetSandboxHelperPid() const = 0;
-
   // Returns an int which is a bitmask of kSandboxLinux* values. Only valid
   // after the first render has been forked.
   virtual int GetSandboxStatus() const = 0;