Update Chromium to beta version 37.0.2062.68

Change-Id: I188e3b5aff1bec75566014291b654eb19f5bc8ca Reviewed-by: Andras Becsi <andras.becsi@digia.com>
author: Jocelyn Turcotte <jocelyn.turcotte@digia.com> 2014-08-08 14:30:41 +0200
committer: Jocelyn Turcotte <jocelyn.turcotte@digia.com> 2014-08-12 13:49:54 +0200
commit: ab0a50979b9eb4dfa3320eff7e187e41efedf7a9 (patch)
tree: 498dfb8a97ff3361a9f7486863a52bb4e26bb898 /chromium/third_party/WebKit/public/web
parent: 4ce69f7403811819800e7c5ae1318b2647e778d1 (diff)
123 files changed, 1718 insertions, 1862 deletions
diff --git a/chromium/third_party/WebKit/public/web/DEPS b/chromium/third_party/WebKit/public/web/DEPS
new file mode 100644
index 00000000000..a06a7c3f37b
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/DEPS
@@ -0,0 +1,7 @@
+include_rules = [
+    "+../platform",
+    "+core",
+
+    # For subdirectories.
+    "+../../platform",
+]
diff --git a/chromium/third_party/WebKit/public/web/OWNERS b/chromium/third_party/WebKit/public/web/OWNERS
new file mode 100644
index 00000000000..a56fa87dcfe
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/OWNERS
@@ -0,0 +1,2 @@
+per-file WebAXEnums.h=dmazzoni@chromium.org
+per-file WebAXEnums.h=aboxhall@chromium.org
diff --git a/chromium/third_party/WebKit/public/web/WebAXEnums.h b/chromium/third_party/WebKit/public/web/WebAXEnums.h
index 2989a8cd073..e8880d9630e 100644
--- a/chromium/third_party/WebKit/public/web/WebAXEnums.h
+++ b/chromium/third_party/WebKit/public/web/WebAXEnums.h
@@ -56,6 +56,7 @@ enum WebAXEvent {
     WebAXEventRowCollapsed,
     WebAXEventRowCountChanged,
     WebAXEventRowExpanded,
+    WebAXEventScrollPositionChanged,
     WebAXEventScrolledToAnchor,
     WebAXEventSelectedChildrenChanged,
     WebAXEventSelectedTextChanged,
@@ -98,6 +99,7 @@ enum WebAXRole {
     WebAXRoleDocument,
     WebAXRoleDrawer,
     WebAXRoleEditableText,
+    WebAXRoleEmbeddedObject,
     WebAXRoleFooter,
     WebAXRoleForm,
     WebAXRoleGrid,
@@ -106,6 +108,7 @@ enum WebAXRole {
     WebAXRoleHeading,
     WebAXRoleHelpTag,
     WebAXRoleHorizontalRule,
+    WebAXRoleIframe,
     WebAXRoleIgnored,
     WebAXRoleImageMapLink,
     WebAXRoleImageMap,
diff --git a/chromium/third_party/WebKit/public/web/WebAXObject.h b/chromium/third_party/WebKit/public/web/WebAXObject.h
index e9335c686ca..c5990347fb5 100644
--- a/chromium/third_party/WebKit/public/web/WebAXObject.h
+++ b/chromium/third_party/WebKit/public/web/WebAXObject.h
@@ -76,19 +76,19 @@ public:
     BLINK_EXPORT static void enableAccessibility();
     BLINK_EXPORT static bool accessibilityEnabled();
 
-    BLINK_EXPORT void startCachingComputedObjectAttributesUntilTreeMutates();
-    BLINK_EXPORT void stopCachingComputedObjectAttributes();
-
     // Temporary: this flag will only be toggleable until Chromium has it on by default.
     BLINK_EXPORT static void enableInlineTextBoxAccessibility();
 
     BLINK_EXPORT int axID() const;
 
-    // Update the underlying tree, and return true if this object is
+    // Update layout on the underlying tree, and return true if this object is
     // still valid (not detached). Note that calling this method
     // can cause other WebAXObjects to become invalid, too,
     // so always call isDetached if updateBackingStoreAndCheckValidity
     // has been called on any object, or if any other WebCore code has run.
+    BLINK_EXPORT bool updateLayoutAndCheckValidity();
+
+    // FIXME: Deprecated - remove once callers use updateLayoutAndCheckValidity, instead.
     BLINK_EXPORT bool updateBackingStoreAndCheckValidity();
 
     BLINK_EXPORT WebString accessibilityDescription() const;
@@ -123,11 +123,17 @@ public:
     BLINK_EXPORT bool isVisited() const;
 
     BLINK_EXPORT WebString accessKey() const;
+    BLINK_EXPORT WebAXObject ariaActiveDescendant() const;
+    BLINK_EXPORT bool ariaControls(WebVector<WebAXObject>& controlsElements) const;
+    BLINK_EXPORT bool ariaDescribedby(WebVector<WebAXObject>& describedbyElements) const;
+    BLINK_EXPORT bool ariaFlowTo(WebVector<WebAXObject>& flowToElements) const;
     BLINK_EXPORT bool ariaHasPopup() const;
+    BLINK_EXPORT bool ariaLabelledby(WebVector<WebAXObject>& labelledbyElements) const;
     BLINK_EXPORT bool ariaLiveRegionAtomic() const;
     BLINK_EXPORT bool ariaLiveRegionBusy() const;
     BLINK_EXPORT WebString ariaLiveRegionRelevant() const;
     BLINK_EXPORT WebString ariaLiveRegionStatus() const;
+    BLINK_EXPORT bool ariaOwns(WebVector<WebAXObject>& ownsElements) const;
     BLINK_EXPORT WebRect boundingBoxRect() const;
     BLINK_EXPORT bool canvasHasFallbackContent() const;
     BLINK_EXPORT WebPoint clickPoint() const;
diff --git a/chromium/third_party/WebKit/public/web/WebActiveWheelFlingParameters.h b/chromium/third_party/WebKit/public/web/WebActiveWheelFlingParameters.h
index 82a09a38a40..2a125b9a675 100644
--- a/chromium/third_party/WebKit/public/web/WebActiveWheelFlingParameters.h
+++ b/chromium/third_party/WebKit/public/web/WebActiveWheelFlingParameters.h
@@ -28,6 +28,7 @@
 
 #include "../platform/WebCommon.h"
 #include "../platform/WebFloatPoint.h"
+#include "../platform/WebGestureDevice.h"
 #include "../platform/WebPoint.h"
 #include "../platform/WebSize.h"
 #include "WebInputEvent.h"
@@ -39,13 +40,13 @@ struct WebActiveWheelFlingParameters {
     WebPoint point;
     WebPoint globalPoint;
     int modifiers;
-    WebGestureEvent::SourceDevice sourceDevice;
+    WebGestureDevice sourceDevice;
     WebSize cumulativeScroll;
     double startTime;
 
     WebActiveWheelFlingParameters()
         : modifiers(0)
-        , sourceDevice(WebGestureEvent::Touchpad)
+        , sourceDevice(WebGestureDeviceTouchpad)
         , startTime(0)
     {
     }
diff --git a/chromium/third_party/WebKit/public/web/WebApplicationCacheHost.h b/chromium/third_party/WebKit/public/web/WebApplicationCacheHost.h
deleted file mode 100644
index d45369394fa..00000000000
--- a/chromium/third_party/WebKit/public/web/WebApplicationCacheHost.h
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebApplicationCacheHost_h
-#define WebApplicationCacheHost_h
-
-#include "../platform/WebCommon.h"
-#include "../platform/WebURL.h"
-#include "../platform/WebVector.h"
-
-namespace blink {
-
-class WebApplicationCacheHostClient;
-class WebFrame;
-class WebURL;
-class WebURLRequest;
-class WebURLResponse;
-struct WebURLError;
-
-// This interface is used by webkit to call out to the embedder. Webkit uses
-// the WebFrameClient::createApplicationCacheHost method to create instances,
-// and calls delete when the instance is no longer needed.
-class WebApplicationCacheHost {
-public:
-    // These values must match WebCore::ApplicationCacheHost::Status values
-    enum Status {
-        Uncached,
-        Idle,
-        Checking,
-        Downloading,
-        UpdateReady,
-        Obsolete
-    };
-
-    // These values must match WebCore::ApplicationCacheHost::EventID values
-    enum EventID {
-        CheckingEvent,
-        ErrorEvent,
-        NoUpdateEvent,
-        DownloadingEvent,
-        ProgressEvent,
-        UpdateReadyEvent,
-        CachedEvent,
-        ObsoleteEvent
-    };
-
-    virtual ~WebApplicationCacheHost() { }
-
-    // Called for every request made within the context.
-    virtual void willStartMainResourceRequest(WebURLRequest& r, const WebFrame*) { }
-    virtual void willStartSubResourceRequest(WebURLRequest&) { }
-
-    // One or the other selectCache methods is called after having parsed the <html> tag.
-    // The latter returns false if the current document has been identified as a "foreign"
-    // entry, in which case the frame navigation will be restarted by webkit.
-    virtual void selectCacheWithoutManifest() { }
-    virtual bool selectCacheWithManifest(const WebURL& manifestURL) { return true; }
-
-    // Called as the main resource is retrieved.
-    virtual void didReceiveResponseForMainResource(const WebURLResponse&) { }
-    virtual void didReceiveDataForMainResource(const char* data, int len) { }
-    virtual void didFinishLoadingMainResource(bool success) { }
-
-    // Called on behalf of the scriptable interface.
-    virtual Status status() { return Uncached; }
-    virtual bool startUpdate() { return false; }
-    virtual bool swapCache() { return false; }
-    virtual void abort() { }
-
-    // Structures and methods to support inspecting Application Caches.
-    struct CacheInfo {
-        WebURL manifestURL; // Empty if there is no associated cache.
-        double creationTime;
-        double updateTime;
-        long long totalSize;
-        CacheInfo() : creationTime(0), updateTime(0), totalSize(0) { }
-    };
-    struct ResourceInfo {
-        WebURL url;
-        long long size;
-        bool isMaster;
-        bool isManifest;
-        bool isExplicit;
-        bool isForeign;
-        bool isFallback;
-        ResourceInfo() : size(0), isMaster(false), isManifest(false), isExplicit(false), isForeign(false), isFallback(false) { }
-    };
-    virtual void getAssociatedCacheInfo(CacheInfo*) { }
-    virtual void getResourceList(WebVector<ResourceInfo>*) { }
-    virtual void deleteAssociatedCacheGroup() { }
-};
-
-}  // namespace blink
-
-#endif  // WebApplicationCacheHost_h
diff --git a/chromium/third_party/WebKit/public/web/WebCrossOriginPreflightResultCache.h b/chromium/third_party/WebKit/public/web/WebArrayBufferConverter.h
index b4902683d2e..1b8eea6aa57 100644
--- a/chromium/third_party/WebKit/public/web/WebCrossOriginPreflightResultCache.h
+++ b/chromium/third_party/WebKit/public/web/WebArrayBufferConverter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,23 +28,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCrossOriginPreflightResultCache_h
-#define WebCrossOriginPreflightResultCache_h
+#ifndef WebArrayBufferConverter_h
+#define WebArrayBufferConverter_h
 
-#include "../platform/WebCommon.h"
+#include "public/platform/WebArrayBuffer.h"
+
+namespace v8 {
+class Isolate;
+class Object;
+class Value;
+template <class T> class Handle;
+}
 
 namespace blink {
 
-// An interface to configure WebKit's cross-origin preflight result cache.
-class WebCrossOriginPreflightResultCache {
+class WebArrayBufferConverter {
 public:
-    // Clears the cache.
-    BLINK_EXPORT static void clear();
-
-private:
-    WebCrossOriginPreflightResultCache();  // Not intended to be instanced.
+    BLINK_EXPORT static v8::Handle<v8::Value> toV8Value(WebArrayBuffer*, v8::Handle<v8::Object>, v8::Isolate*);
+    BLINK_EXPORT static WebArrayBuffer* createFromV8Value(v8::Handle<v8::Value>, v8::Isolate*);
 };
 
 } // namespace blink
 
-#endif
+#endif // WebArrayBufferConverter_h
diff --git a/chromium/third_party/WebKit/public/web/WebAutofillClient.h b/chromium/third_party/WebKit/public/web/WebAutofillClient.h
index 9e63a01b30f..7fef5f0ad72 100644
--- a/chromium/third_party/WebKit/public/web/WebAutofillClient.h
+++ b/chromium/third_party/WebKit/public/web/WebAutofillClient.h
@@ -33,66 +33,27 @@
 
 namespace blink {
 
+class WebFormControlElement;
 class WebFormElement;
-class WebFrame;
 class WebInputElement;
 class WebKeyboardEvent;
 class WebNode;
-class WebString;
 
 template <typename T> class WebVector;
 
 class WebAutofillClient {
 public:
-    enum {
-        MenuItemIDAutocompleteEntry = 0,
-        MenuItemIDWarningMessage = -1,
-        MenuItemIDPasswordEntry = -2,
-        MenuItemIDSeparator = -3,
-        MenuItemIDClearForm = -4,
-        MenuItemIDAutofillOptions = -5,
-        MenuItemIDDataListEntry = -6
-    };
-
-    // Informs the browser that the user has accepted an Autofill suggestion for
-    // a WebNode. A positive |itemID| is a unique id used to identify the set
-    // of Autofill profiles. If it is AutocompleteEntryMenuItemID, then the
-    // suggestion is an Autocomplete suggestion; and |value| stores the
-    // suggested text. |index| is an index of the selected suggestion in the
-    // list of suggestions provided by the client.
-    virtual void didAcceptAutofillSuggestion(const WebNode&,
-                                             const WebString& value,
-                                             const WebString& label,
-                                             int itemID,
-                                             unsigned index) { }
-
-    // Informs the browser that the user has selected an Autofill suggestion for
-    // a WebNode.  This happens when the user hovers over a suggestion or uses
-    // the arrow keys to navigate to a suggestion.
-    virtual void didSelectAutofillSuggestion(const WebNode&,
-                                             const WebString& name,
-                                             const WebString& label,
-                                             int itemID) { }
-
-    // Informs the browser that the user has cleared the selection from the
-    // Autofill suggestions popup. This happens when a user uses the arrow
-    // keys to navigate outside the range of possible selections.
-    virtual void didClearAutofillSelection(const WebNode&) { }
-
     // Informs the browser an interactive autocomplete has been requested.
-    virtual void didRequestAutocomplete(WebFrame*, const WebFormElement&) { }
-
-    // Instructs the browser to remove the Autocomplete entry specified from
-    // its DB.
-    virtual void removeAutocompleteSuggestion(const WebString& name,
-                                              const WebString& value) { }
+    virtual void didRequestAutocomplete(const WebFormElement&) { }
 
     // These methods are called when the users edits a text-field.
     virtual void textFieldDidEndEditing(const WebInputElement&) { }
-    virtual void textFieldDidChange(const WebInputElement&) { }
+    virtual void textFieldDidChange(const WebFormControlElement&) { }
     virtual void textFieldDidReceiveKeyDown(const WebInputElement&, const WebKeyboardEvent&) { }
     // This is called when a datalist indicator is clicked.
     virtual void openTextDataListChooser(const WebInputElement&) { }
+    // Called the first time the user interacts with the page after a load.
+    virtual void firstUserGestureObserved() { }
 
     // Informs the client whether or not any subsequent text changes should be ignored.
     virtual void setIgnoreTextChanges(bool ignore) { }
diff --git a/chromium/third_party/WebKit/public/web/WebBindings.h b/chromium/third_party/WebKit/public/web/WebBindings.h
index a83120a5282..494e73610d2 100644
--- a/chromium/third_party/WebKit/public/web/WebBindings.h
+++ b/chromium/third_party/WebKit/public/web/WebBindings.h
@@ -135,6 +135,11 @@ public:
     // _NPN_UnregisterObject
     BLINK_EXPORT static void unregisterObject(NPObject*);
 
+    // Unlike unregisterObject, only drops the V8 wrapper object,
+    // not touching the NPObject itself, except for decrementing
+    // its references counter.
+    BLINK_EXPORT static void dropV8WrapperForObject(NPObject*);
+
     // NPN_UTF8FromIdentifier
     BLINK_EXPORT static NPUTF8* utf8FromIdentifier(NPIdentifier);
 
diff --git a/chromium/third_party/WebKit/public/web/WebBlob.h b/chromium/third_party/WebKit/public/web/WebBlob.h
index 07d39844f80..3d0d829c98b 100644
--- a/chromium/third_party/WebKit/public/web/WebBlob.h
+++ b/chromium/third_party/WebKit/public/web/WebBlob.h
@@ -37,7 +37,13 @@
 #include "public/platform/WebString.h"
 #include "public/platform/WebURL.h"
 
+#if BLINK_IMPLEMENTATION
+#include "platform/heap/Handle.h"
+#endif
+
 namespace v8 {
+class Isolate;
+class Object;
 class Value;
 template <class T> class Handle;
 }
@@ -58,6 +64,7 @@ public:
         return *this;
     }
 
+    BLINK_EXPORT static WebBlob createFromUUID(const WebString& uuid, const WebString& type, long long size);
     BLINK_EXPORT static WebBlob createFromFile(const WebString& path, long long size);
     BLINK_EXPORT static WebBlob fromV8Value(v8::Handle<v8::Value>);
 
@@ -67,12 +74,11 @@ public:
 
     bool isNull() const { return m_private.isNull(); }
 
-    BLINK_EXPORT v8::Handle<v8::Value>  toV8Value();
+    BLINK_EXPORT v8::Handle<v8::Value>  toV8Value(v8::Handle<v8::Object> creationContext, v8::Isolate*);
 
 #if BLINK_IMPLEMENTATION
-    WebBlob(const WTF::PassRefPtr<WebCore::Blob>&);
-    WebBlob& operator=(const WTF::PassRefPtr<WebCore::Blob>&);
-    operator WTF::PassRefPtr<WebCore::Blob>() const;
+    explicit WebBlob(const PassRefPtrWillBeRawPtr<WebCore::Blob>&);
+    WebBlob& operator=(const PassRefPtrWillBeRawPtr<WebCore::Blob>&);
 #endif
 
 protected:
diff --git a/chromium/third_party/WebKit/public/web/WebCompositionUnderline.h b/chromium/third_party/WebKit/public/web/WebCompositionUnderline.h
index 2c586620537..21c065ba487 100644
--- a/chromium/third_party/WebKit/public/web/WebCompositionUnderline.h
+++ b/chromium/third_party/WebKit/public/web/WebCompositionUnderline.h
@@ -42,18 +42,36 @@ struct WebCompositionUnderline {
         : startOffset(0)
         , endOffset(0)
         , color(0)
-        , thick(false) { }
+        , thick(false)
+        , backgroundColor(0) { }
 
+    // FIXME(huangs): remove this constructor.
     WebCompositionUnderline(unsigned s, unsigned e, WebColor c, bool t)
         : startOffset(s)
         , endOffset(e)
         , color(c)
-        , thick(t) { }
+        , thick(t)
+        , backgroundColor(0) { }
 
+    WebCompositionUnderline(unsigned s, unsigned e, WebColor c, bool t, WebColor bc)
+        : startOffset(s)
+        , endOffset(e)
+        , color(c)
+        , thick(t)
+        , backgroundColor(bc) { }
+
+    bool operator<(const WebCompositionUnderline& other) const
+    {
+        return startOffset != other.startOffset ? startOffset < other.startOffset : endOffset < other.endOffset;
+    }
+
+    // Need to update IPC_STRUCT_TRAITS_BEGIN(blink::WebCompositionUnderline)
+    // if members change.
     unsigned startOffset;
     unsigned endOffset;
     WebColor color;
     bool thick;
+    WebColor backgroundColor;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebConsoleMessage.h b/chromium/third_party/WebKit/public/web/WebConsoleMessage.h
index cf6a54ecf43..616e8ebb0fd 100644
--- a/chromium/third_party/WebKit/public/web/WebConsoleMessage.h
+++ b/chromium/third_party/WebKit/public/web/WebConsoleMessage.h
@@ -42,6 +42,7 @@ struct WebConsoleMessage {
         LevelInfo = 5,
         LevelWarning = 2,
         LevelError = 3,
+        LevelLast = LevelInfo
     };
 
     Level level;
diff --git a/chromium/third_party/WebKit/public/web/WebContentSecurityPolicy.h b/chromium/third_party/WebKit/public/web/WebContentSecurityPolicy.h
index f649e439818..ee2d8569fb6 100644
--- a/chromium/third_party/WebKit/public/web/WebContentSecurityPolicy.h
+++ b/chromium/third_party/WebKit/public/web/WebContentSecurityPolicy.h
@@ -36,6 +36,7 @@ namespace blink {
 enum WebContentSecurityPolicyType {
     WebContentSecurityPolicyTypeReport,
     WebContentSecurityPolicyTypeEnforce,
+    WebContentSecurityPolicyTypeLast = WebContentSecurityPolicyTypeEnforce
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebContextMenuData.h b/chromium/third_party/WebKit/public/web/WebContextMenuData.h
index 8c8459d2f59..09cb0f4251f 100644
--- a/chromium/third_party/WebKit/public/web/WebContextMenuData.h
+++ b/chromium/third_party/WebKit/public/web/WebContextMenuData.h
@@ -55,10 +55,13 @@ struct WebContextMenuData {
         MediaTypeVideo,
         // An audio node is selected.
         MediaTypeAudio,
+        // A canvas node is selected.
+        MediaTypeCanvas,
         // A file node is selected.
         MediaTypeFile,
         // A plugin node is selected.
         MediaTypePlugin,
+        MediaTypeLast = MediaTypePlugin
     };
     // The type of media the context menu is being invoked on.
     MediaType mediaType;
@@ -99,7 +102,7 @@ struct WebContextMenuData {
         MediaLoop = 0x8,
         MediaCanSave = 0x10,
         MediaHasAudio = 0x20,
-        MediaHasVideo = 0x40,
+        MediaCanToggleControls = 0x40,
         MediaControls = 0x80,
         MediaCanPrint = 0x100,
         MediaCanRotate = 0x200,
@@ -111,9 +114,6 @@ struct WebContextMenuData {
     // The raw text of the selection in context.
     WebString selectedText;
 
-    // Whether speech input is enabled.
-    bool isSpeechInputEnabled;
-
     // Whether spell checking is enabled.
     bool isSpellCheckingEnabled;
 
@@ -172,7 +172,6 @@ struct WebContextMenuData {
         : mediaType(MediaTypeNone)
         , hasImageContents(true)
         , mediaFlags(MediaNone)
-        , isSpeechInputEnabled(false)
         , isSpellCheckingEnabled(false)
         , isEditable(false)
         , writingDirectionDefault(CheckableMenuItemDisabled)
diff --git a/chromium/third_party/WebKit/public/web/WebCryptoNormalize.h b/chromium/third_party/WebKit/public/web/WebCryptoNormalize.h
new file mode 100644
index 00000000000..16ad8042b94
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebCryptoNormalize.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2014 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCryptoNormalize_h
+#define WebCryptoNormalize_h
+
+#include "../platform/WebCommon.h"
+
+#include "../platform/WebCryptoAlgorithm.h"
+
+namespace v8 {
+class Isolate;
+class Object;
+template <class T> class Handle;
+}
+
+namespace blink {
+
+class WebString;
+
+// Converts a javascript Dictionary to a WebCryptoAlgorithm object.
+//
+// This corresponds with "normalizing" [1] the algorithm, and then validating
+// the expected parameters for the algorithm/operation combination.
+//
+// On failure returns an null WebCryptoAlgorithm, sets the int to the
+// ExceptionCode and the WebString to a (non-localized) debug string.
+//
+// [1] http://www.w3.org/TR/WebCryptoAPI/#algorithm-normalizing-rules
+BLINK_EXPORT WebCryptoAlgorithm normalizeCryptoAlgorithm(v8::Handle<v8::Object>, WebCryptoOperation, int* exceptionCode, WebString* errorDetails, v8::Isolate*);
+
+} // namespace blink
+
+#endif
diff --git a/chromium/third_party/WebKit/public/web/WebDOMActivityLogger.h b/chromium/third_party/WebKit/public/web/WebDOMActivityLogger.h
index 9664be51107..7cc4d205c5f 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMActivityLogger.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMActivityLogger.h
@@ -41,16 +41,23 @@ namespace blink {
 class WebDOMActivityLogger {
 public:
     virtual ~WebDOMActivityLogger() { }
-    virtual void log(const WebString& apiName, int argc, const v8::Handle<v8::Value>* argv, const WebString& extraInfo, const WebURL& url, const WebString& title) { }
+
+    virtual void logGetter(const WebString& apiName, const WebURL& url, const WebString& title) { }
+    virtual void logSetter(const WebString& apiName, const v8::Handle<v8::Value>& newValue, const WebURL& url, const WebString& title) { }
+    virtual void logSetter(const WebString& apiName, const v8::Handle<v8::Value>& newValue, const v8::Handle<v8::Value>& oldValue, const WebURL& url, const WebString& title) { }
+    virtual void logMethod(const WebString& apiName, int argc, const v8::Handle<v8::Value>* argv, const WebURL& url, const WebString& title) { }
 };
 
-// Checks if a logger already exists for the world identified
-// by worldId (worldId may be 0 identifying the main world).
-BLINK_EXPORT bool hasDOMActivityLogger(int worldId);
+// Checks if a logger already exists for the world identified by worldId and
+// extensionID (worldId may be 0 identifying the main world). Extension ID is
+// used only in the case of main world and ignored otherwise.
+BLINK_EXPORT bool hasDOMActivityLogger(int worldId, const WebString& extensionId);
 
-// Checks if the provided logger is non-null and if so associates it
-// with the world identified by worldId (worldId may be 0 identifying the main world).
-BLINK_EXPORT void setDOMActivityLogger(int worldId, WebDOMActivityLogger*);
+// Checks if the provided logger is non-null and if so associates it with the
+// world identified by worldId and extension ID (worldId may be 0 identifying
+// the main world). The extension ID is ignored for other worlds than the main
+// one.
+BLINK_EXPORT void setDOMActivityLogger(int worldId, const WebString& extensionId, WebDOMActivityLogger*);
 
 } // namespace blink
 
diff --git a/chromium/third_party/WebKit/public/web/WebDOMCustomEvent.h b/chromium/third_party/WebKit/public/web/WebDOMCustomEvent.h
index e6f2f671409..f8189634249 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMCustomEvent.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMCustomEvent.h
@@ -35,7 +35,6 @@
 
 namespace blink {
 
-class WebFrame;
 class WebString;
 
 class WebDOMCustomEvent : public WebDOMEvent {
diff --git a/chromium/third_party/WebKit/public/web/WebDOMError.h b/chromium/third_party/WebKit/public/web/WebDOMError.h
index 4ca7733d47e..ec7e9c7d026 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMError.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMError.h
@@ -36,6 +36,8 @@
 #include "public/platform/WebString.h"
 
 namespace v8 {
+class Isolate;
+class Object;
 class Value;
 template <class T> class Handle;
 }
@@ -64,12 +66,11 @@ public:
     BLINK_EXPORT WebString name() const;
     BLINK_EXPORT WebString message() const;
 
-    BLINK_EXPORT v8::Handle<v8::Value> toV8Value();
+    BLINK_EXPORT v8::Handle<v8::Value> toV8Value(v8::Handle<v8::Object> creationContext, v8::Isolate*);
 
 #if BLINK_IMPLEMENTATION
-    WebDOMError(const WTF::PassRefPtr<WebCore::DOMError>&);
-    WebDOMError& operator=(const WTF::PassRefPtr<WebCore::DOMError>&);
-    operator WTF::PassRefPtr<WebCore::DOMError>() const;
+    explicit WebDOMError(const PassRefPtrWillBeRawPtr<WebCore::DOMError>&);
+    WebDOMError& operator=(const PassRefPtrWillBeRawPtr<WebCore::DOMError>&);
 #endif
 
 protected:
diff --git a/chromium/third_party/WebKit/public/web/WebDOMEvent.h b/chromium/third_party/WebKit/public/web/WebDOMEvent.h
index 4be814f37e6..2ee49325cea 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMEvent.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMEvent.h
@@ -90,11 +90,10 @@ public:
     BLINK_EXPORT bool isPopStateEvent() const;
     BLINK_EXPORT bool isProgressEvent() const;
     BLINK_EXPORT bool isXMLHttpRequestProgressEvent() const;
-    BLINK_EXPORT bool isBeforeLoadEvent() const;
 
 #if BLINK_IMPLEMENTATION
-    WebDOMEvent(const WTF::PassRefPtr<WebCore::Event>&);
-    operator WTF::PassRefPtr<WebCore::Event>() const;
+    WebDOMEvent(const PassRefPtrWillBeRawPtr<WebCore::Event>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::Event>() const;
 #endif
 
     template<typename T> T to()
@@ -112,9 +111,8 @@ public:
     }
 
 protected:
-    typedef WebCore::Event WebDOMEventPrivate;
 #if BLINK_IMPLEMENTATION
-    void assign(const WTF::PassRefPtr<WebDOMEventPrivate>&);
+    void assign(const PassRefPtrWillBeRawPtr<WebCore::Event>&);
 
     template<typename T> T* unwrap()
     {
@@ -127,7 +125,7 @@ protected:
     }
 #endif
 
-    WebPrivatePtr<WebDOMEventPrivate> m_private;
+    WebPrivatePtr<WebCore::Event> m_private;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebDOMFileSystem.h b/chromium/third_party/WebKit/public/web/WebDOMFileSystem.h
index b69d3d49467..6af71cfe00d 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMFileSystem.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMFileSystem.h
@@ -35,8 +35,15 @@
 #include "../platform/WebPrivatePtr.h"
 #include "../platform/WebString.h"
 #include "../platform/WebURL.h"
+#include "WebFrame.h"
+
+#if BLINK_IMPLEMENTATION
+#include "platform/heap/Handle.h"
+#endif
 
 namespace v8 {
+class Isolate;
+class Object;
 class Value;
 template <class T> class Handle;
 }
@@ -47,6 +54,15 @@ namespace blink {
 
 class WebDOMFileSystem {
 public:
+    enum SerializableType {
+        SerializableTypeSerializable,
+        SerializableTypeNotSerializable,
+    };
+    enum EntryType {
+        EntryTypeFile,
+        EntryTypeDirectory,
+    };
+
     ~WebDOMFileSystem() { reset(); }
 
     WebDOMFileSystem() { }
@@ -58,6 +74,17 @@ public:
     }
 
     BLINK_EXPORT static WebDOMFileSystem fromV8Value(v8::Handle<v8::Value>);
+    // Create file system URL from the given entry.
+    BLINK_EXPORT static WebURL createFileSystemURL(v8::Handle<v8::Value> entry);
+
+    // FIXME: Deprecate the last argument when all filesystems become
+    // serializable.
+    BLINK_EXPORT static WebDOMFileSystem create(
+        WebLocalFrame*,
+        WebFileSystemType,
+        const WebString& name,
+        const WebURL& rootURL,
+        SerializableType = SerializableTypeNotSerializable);
 
     BLINK_EXPORT void reset();
     BLINK_EXPORT void assign(const WebDOMFileSystem&);
@@ -66,12 +93,17 @@ public:
     BLINK_EXPORT WebFileSystem::Type type() const;
     BLINK_EXPORT WebURL rootURL() const;
 
+    BLINK_EXPORT v8::Handle<v8::Value> toV8Value(v8::Handle<v8::Object> creationContext, v8::Isolate*);
+    BLINK_EXPORT v8::Handle<v8::Value> createV8Entry(
+        const WebString& path,
+        EntryType,
+        v8::Handle<v8::Object> creationContext, v8::Isolate*);
+
     bool isNull() const { return m_private.isNull(); }
 
 #if BLINK_IMPLEMENTATION
-    WebDOMFileSystem(const WTF::PassRefPtr<WebCore::DOMFileSystem>&);
-    WebDOMFileSystem& operator=(const WTF::PassRefPtr<WebCore::DOMFileSystem>&);
-    operator WTF::PassRefPtr<WebCore::DOMFileSystem>() const;
+    WebDOMFileSystem(WebCore::DOMFileSystem*);
+    WebDOMFileSystem& operator=(WebCore::DOMFileSystem*);
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/WebDOMMediaStreamTrack.h b/chromium/third_party/WebKit/public/web/WebDOMMediaStreamTrack.h
index 5eed104dae1..76097214816 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMMediaStreamTrack.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMMediaStreamTrack.h
@@ -68,7 +68,7 @@ public:
 
 private:
 #if BLINK_IMPLEMENTATION
-    WebDOMMediaStreamTrack(WTF::PassRefPtr<WebCore::MediaStreamTrack>);
+    WebDOMMediaStreamTrack(PassRefPtrWillBeRawPtr<WebCore::MediaStreamTrack>);
 #endif
 
     WebPrivatePtr<WebCore::MediaStreamTrack> m_private;
diff --git a/chromium/third_party/WebKit/public/web/WebDOMMessageEvent.h b/chromium/third_party/WebKit/public/web/WebDOMMessageEvent.h
index 92623f16589..c220c0efd26 100644
--- a/chromium/third_party/WebKit/public/web/WebDOMMessageEvent.h
+++ b/chromium/third_party/WebKit/public/web/WebDOMMessageEvent.h
@@ -55,7 +55,7 @@ public:
     BLINK_EXPORT WebMessagePortChannelArray releaseChannels();
 
 #if BLINK_IMPLEMENTATION
-    explicit WebDOMMessageEvent(const WTF::PassRefPtr<WebCore::MessageEvent>& e) : WebDOMEvent(e) { }
+    explicit WebDOMMessageEvent(const PassRefPtrWillBeRawPtr<WebCore::MessageEvent>& e) : WebDOMEvent(e) { }
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebDataSource.h b/chromium/third_party/WebKit/public/web/WebDataSource.h
index eedbaf3c7f5..6437ab70a7d 100644
--- a/chromium/third_party/WebKit/public/web/WebDataSource.h
+++ b/chromium/third_party/WebKit/public/web/WebDataSource.h
@@ -102,13 +102,6 @@ public:
     virtual ExtraData* extraData() const = 0;
     virtual void setExtraData(ExtraData*) = 0;
 
-    // The application cache host associated with this datasource.
-    virtual WebApplicationCacheHost* applicationCacheHost() = 0;
-
-    // Set deferMainResourceDataLoad flag on the loader.  This is used for
-    // testing.
-    virtual void setDeferMainResourceDataLoad(bool) = 0;
-
     // Sets the navigation start time for this datasource. Ordinarily,
     // navigation start is determined in WebCore. But, in some situations,
     // the embedder might have a better value and can override it here. This
diff --git a/chromium/third_party/WebKit/public/web/WebDevToolsAgent.h b/chromium/third_party/WebKit/public/web/WebDevToolsAgent.h
index 73a8f82ca4b..2adad796c95 100644
--- a/chromium/third_party/WebKit/public/web/WebDevToolsAgent.h
+++ b/chromium/third_party/WebKit/public/web/WebDevToolsAgent.h
@@ -37,7 +37,6 @@
 namespace blink {
 class WebDevToolsAgentClient;
 class WebDevToolsMessageTransport;
-class WebFrame;
 class WebString;
 class WebURLRequest;
 class WebURLResponse;
@@ -51,14 +50,12 @@ class WebDevToolsAgent {
 public:
     virtual ~WebDevToolsAgent() {}
 
-    // Returns WebKit WebInspector protocol version.
-    BLINK_EXPORT static WebString inspectorProtocolVersion();
-
-    // Returns true if and only if the given protocol version is supported by the WebKit Web Inspector.
-    BLINK_EXPORT static bool supportsInspectorProtocolVersion(const WebString& version);
-
+    // FIXME: remove once migrated to the one with host_id.
     virtual void attach() = 0;
     virtual void reattach(const WebString& savedState) = 0;
+
+    virtual void attach(const WebString& hostId) = 0;
+    virtual void reattach(const WebString& hostId, const WebString& savedState) = 0;
     virtual void detach() = 0;
 
     virtual void didNavigate() = 0;
@@ -74,20 +71,19 @@ public:
     virtual void willComposite() = 0;
     virtual void didComposite() = 0;
 
-    // FIXME: remove it once the client side stops firing these.
-    virtual void processGPUEvent(double timestamp, int phase, bool foreign) = 0;
-
     class GPUEvent {
     public:
-        GPUEvent(double timestamp, int phase, bool foreign, size_t usedGPUMemoryBytes) :
+        GPUEvent(double timestamp, int phase, bool foreign, uint64_t usedGPUMemoryBytes) :
             timestamp(timestamp),
             phase(phase),
             foreign(foreign),
-            usedGPUMemoryBytes(usedGPUMemoryBytes) { }
+            usedGPUMemoryBytes(usedGPUMemoryBytes),
+            limitGPUMemoryBytes(0) { }
         double timestamp;
         int phase;
         bool foreign;
-        size_t usedGPUMemoryBytes;
+        uint64_t usedGPUMemoryBytes;
+        uint64_t limitGPUMemoryBytes;
     };
     virtual void processGPUEvent(const GPUEvent&) = 0;
 
diff --git a/chromium/third_party/WebKit/public/web/WebDevToolsAgentClient.h b/chromium/third_party/WebKit/public/web/WebDevToolsAgentClient.h
index f89ccb1640b..23730ee6749 100644
--- a/chromium/third_party/WebKit/public/web/WebDevToolsAgentClient.h
+++ b/chromium/third_party/WebKit/public/web/WebDevToolsAgentClient.h
@@ -36,6 +36,7 @@
 
 namespace blink {
 class WebString;
+struct WebDeviceEmulationParams;
 struct WebDevToolsMessageData;
 struct WebRect;
 struct WebSize;
@@ -46,8 +47,12 @@ public:
     virtual void sendDebuggerOutput(const WebString&) { }
 
     // Returns the identifier of the entity hosting this agent.
+    // FIXME: remove once migrated to debuggerId().
     virtual int hostIdentifier() { return -1; }
 
+    // Returns unique identifier of the entity within process.
+    virtual int debuggerId() { return hostIdentifier(); }
+
     // Save the agent state in order to pass it later into WebDevToolsAgent::reattach
     // if the same client is reattached to another agent.
     virtual void saveAgentRuntimeState(const WebString&) { }
@@ -59,9 +64,8 @@ public:
         virtual void quitNow() = 0;
     };
     virtual WebKitClientMessageLoop* createClientMessageLoop() { return 0; }
-
-    virtual void clearBrowserCache() { }
-    virtual void clearBrowserCookies() { }
+    virtual void willEnterDebugLoop() { }
+    virtual void didExitDebugLoop() { }
 
     class AllocatedObjectVisitor {
     public:
@@ -83,24 +87,22 @@ public:
         int numArgs, const char* const* argNames, const unsigned char* argTypes, const unsigned long long* argValues,
         unsigned char flags, double timestamp);
 
-    virtual void setTraceEventCallback(TraceEventCallback) { }
+    virtual void setTraceEventCallback(const WebString& categoryFilter, TraceEventCallback) { }
+    virtual void resetTraceEventCallback() { }
+    virtual void enableTracing(const WebString& categoryFilter) { }
+    virtual void disableTracing() { }
 
     virtual void startGPUEventsRecording() { }
     virtual void stopGPUEventsRecording() { }
 
-    // Called to emulate device dimensions, scale factor and input. Window should
-    // occupy the whole device screen, while the view should be located at |viewRect|.
-    // x-coordinate of |screenRect| defines the left and right gutters' width,
-    // y-coordinate defines the top and bottom gutters' height.
-    // With |fitToView| set, contents should be scaled down to fit into embedder window.
-    // All sizes are measured in device independent pixels.
-    virtual void enableDeviceEmulation(
-        const WebRect& screenRect, const WebRect& viewRect,
-        float deviceScaleFactor, bool fitToView) { }
+    // Enables device emulation as specified in params.
+    virtual void enableDeviceEmulation(const WebDeviceEmulationParams& params) { }
 
     // Cancel emulation started via |enableDeviceEmulation| call.
     virtual void disableDeviceEmulation() { }
 
+    virtual void setTouchEventEmulationEnabled(bool enabled, bool allowPinch) { }
+
 protected:
     ~WebDevToolsAgentClient() { }
 };
diff --git a/chromium/third_party/WebKit/public/web/WebDeviceEmulationParams.h b/chromium/third_party/WebKit/public/web/WebDeviceEmulationParams.h
new file mode 100644
index 00000000000..ac4dbbd78d8
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebDeviceEmulationParams.h
@@ -0,0 +1,52 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebDeviceEmulationParams_h
+#define WebDeviceEmulationParams_h
+
+#include "public/platform/WebFloatPoint.h"
+#include "public/platform/WebRect.h"
+#include "public/platform/WebSize.h"
+
+namespace blink {
+
+// All sizes are measured in device independent pixels.
+struct WebDeviceEmulationParams {
+    // For mobile, screen has the same size as view, which is positioned at (0;0).
+    // For desktop, screen size and view position are preserved.
+    enum ScreenPosition {
+        Desktop,
+        Mobile
+    };
+
+    ScreenPosition screenPosition;
+
+    // If zero, the original device scale factor is preserved.
+    float deviceScaleFactor;
+
+    // Emulated view size. Empty size means no override.
+    WebSize viewSize;
+
+    // Whether emulated view should be scaled down if necessary to fit into available space.
+    bool fitToView;
+
+    // Insets of emulated view inside available view space, in fit to view mode.
+    WebSize viewInsets;
+
+    // Offset of emulated view inside available space, not in fit to view mode.
+    WebFloatPoint offset;
+
+    // Scale of emulated view inside available space, not in fit to view mode.
+    float scale;
+
+    WebDeviceEmulationParams()
+        : screenPosition(Desktop)
+        , deviceScaleFactor(0)
+        , fitToView(false)
+        , scale(1) { }
+};
+
+} // namespace blink
+
+#endif
diff --git a/chromium/third_party/WebKit/public/web/WebDocument.h b/chromium/third_party/WebKit/public/web/WebDocument.h
index d0eba00d1ee..4e8b2f6f3b0 100644
--- a/chromium/third_party/WebKit/public/web/WebDocument.h
+++ b/chromium/third_party/WebKit/public/web/WebDocument.h
@@ -35,6 +35,7 @@
 #include "../platform/WebVector.h"
 #include "WebDraggableRegion.h"
 #include "WebExceptionCode.h"
+#include "WebFrame.h"
 #include "WebNode.h"
 #include "WebSecurityOrigin.h"
 
@@ -56,8 +57,7 @@ class WebAXObject;
 class WebDocumentType;
 class WebElement;
 class WebFormElement;
-class WebFrame;
-class WebNodeCollection;
+class WebElementCollection;
 class WebNodeList;
 class WebString;
 class WebURL;
@@ -65,11 +65,6 @@ class WebURL;
 // Provides readonly access to some properties of a DOM document.
 class WebDocument : public WebNode {
 public:
-    // FIXME: Stop using this from Chromium code and get rid of this enum.
-    enum UserStyleLevel {
-        UserStyleAuthorLevel
-    };
-
     WebDocument() { }
     WebDocument(const WebDocument& e) : WebNode(e) { }
 
@@ -87,12 +82,14 @@ public:
     BLINK_EXPORT WebString encoding() const;
     BLINK_EXPORT WebString contentLanguage() const;
     BLINK_EXPORT WebString referrer() const;
-
+    BLINK_EXPORT WebColor themeColor() const;
+    // TODO: Remove when chromium is changed to themeColor().
+    BLINK_EXPORT WebColor brandColor() const { return 0; }
     // The url of the OpenSearch Desription Document (if any).
     BLINK_EXPORT WebURL openSearchDescriptionURL() const;
 
     // Returns the frame the document belongs to or 0 if the document is frameless.
-    BLINK_EXPORT WebFrame* frame() const;
+    BLINK_EXPORT WebLocalFrame* frame() const;
     BLINK_EXPORT bool isHTMLDocument() const;
     BLINK_EXPORT bool isXHTMLDocument() const;
     BLINK_EXPORT bool isPluginDocument() const;
@@ -107,12 +104,12 @@ public:
     BLINK_EXPORT WebElement body() const;
     BLINK_EXPORT WebElement head();
     BLINK_EXPORT WebString title() const;
-    BLINK_EXPORT WebNodeCollection all();
+    BLINK_EXPORT WebElementCollection all();
     BLINK_EXPORT void forms(WebVector<WebFormElement>&) const;
     BLINK_EXPORT void images(WebVector<WebElement>&);
     BLINK_EXPORT WebURL completeURL(const WebString&) const;
     BLINK_EXPORT WebElement getElementById(const WebString&) const;
-    BLINK_EXPORT WebNode focusedNode() const;
+    BLINK_EXPORT WebElement focusedElement() const;
     BLINK_EXPORT WebDocumentType doctype() const;
     BLINK_EXPORT void cancelFullScreen();
     BLINK_EXPORT WebElement fullScreenElement() const;
@@ -130,8 +127,6 @@ public:
     // Gets the accessibility object for an object on this page by ID.
     BLINK_EXPORT WebAXObject accessibilityObjectFromID(int axID) const;
     // Inserts the given CSS source code as a stylesheet in the document.
-    // FIXME: Delete insertUserStyleSheet once Chromium code stops calling it.
-    BLINK_EXPORT void insertUserStyleSheet(const WebString& sourceCode, UserStyleLevel);
     BLINK_EXPORT void insertStyleSheet(const WebString& sourceCode);
 
     // Arranges to call WebFrameClient::didMatchCSS(frame(), ...) when one of
@@ -144,9 +139,9 @@ public:
     BLINK_EXPORT v8::Handle<v8::Value> registerEmbedderCustomElement(const WebString& name, v8::Handle<v8::Value> options, WebExceptionCode&);
 
 #if BLINK_IMPLEMENTATION
-    WebDocument(const WTF::PassRefPtr<WebCore::Document>&);
-    WebDocument& operator=(const WTF::PassRefPtr<WebCore::Document>&);
-    operator WTF::PassRefPtr<WebCore::Document>() const;
+    WebDocument(const PassRefPtrWillBeRawPtr<WebCore::Document>&);
+    WebDocument& operator=(const PassRefPtrWillBeRawPtr<WebCore::Document>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::Document>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebDocumentType.h b/chromium/third_party/WebKit/public/web/WebDocumentType.h
index 87608658908..a23eebd9554 100644
--- a/chromium/third_party/WebKit/public/web/WebDocumentType.h
+++ b/chromium/third_party/WebKit/public/web/WebDocumentType.h
@@ -57,9 +57,9 @@ public:
     BLINK_EXPORT WebString name() const;
 
 #if BLINK_IMPLEMENTATION
-    WebDocumentType(const WTF::PassRefPtr<WebCore::DocumentType>&);
-    WebDocumentType& operator=(const WTF::PassRefPtr<WebCore::DocumentType>&);
-    operator WTF::PassRefPtr<WebCore::DocumentType>() const;
+    WebDocumentType(const PassRefPtrWillBeRawPtr<WebCore::DocumentType>&);
+    WebDocumentType& operator=(const PassRefPtrWillBeRawPtr<WebCore::DocumentType>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::DocumentType>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebDragStatus.h b/chromium/third_party/WebKit/public/web/WebDragStatus.h
index 0e41f233277..81ba39024ac 100644
--- a/chromium/third_party/WebKit/public/web/WebDragStatus.h
+++ b/chromium/third_party/WebKit/public/web/WebDragStatus.h
@@ -38,7 +38,8 @@ enum WebDragStatus {
     WebDragStatusEnter,
     WebDragStatusOver,
     WebDragStatusLeave,
-    WebDragStatusDrop
+    WebDragStatusDrop,
+    WebDragStatusLast = WebDragStatusDrop
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebElement.h b/chromium/third_party/WebKit/public/web/WebElement.h
index 3bfd310f39d..9308da0ad79 100644
--- a/chromium/third_party/WebKit/public/web/WebElement.h
+++ b/chromium/third_party/WebKit/public/web/WebElement.h
@@ -89,9 +89,9 @@ struct WebRect;
         BLINK_EXPORT WebImage imageContents();
 
 #if BLINK_IMPLEMENTATION
-        WebElement(const WTF::PassRefPtr<WebCore::Element>&);
-        WebElement& operator=(const WTF::PassRefPtr<WebCore::Element>&);
-        operator WTF::PassRefPtr<WebCore::Element>() const;
+        WebElement(const PassRefPtrWillBeRawPtr<WebCore::Element>&);
+        WebElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::Element>&);
+        operator PassRefPtrWillBeRawPtr<WebCore::Element>() const;
 #endif
     };
 
diff --git a/chromium/third_party/WebKit/public/web/WebNodeCollection.h b/chromium/third_party/WebKit/public/web/WebElementCollection.h
index a01ac7b9bae..28a8ac9b0a9 100644
--- a/chromium/third_party/WebKit/public/web/WebNodeCollection.h
+++ b/chromium/third_party/WebKit/public/web/WebElementCollection.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2014 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,48 +29,50 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebNodeCollection_h
-#define WebNodeCollection_h
+#ifndef WebElementCollection_h
+#define WebElementCollection_h
 
 #include "../platform/WebCommon.h"
+#include "../platform/WebPrivatePtr.h"
 
 namespace WebCore { class HTMLCollection; }
 #if BLINK_IMPLEMENTATION
+#include "platform/heap/Handle.h"
 namespace WTF { template <typename T> class PassRefPtr; }
 #endif
 
 namespace blink {
-class WebNode;
+class WebElement;
 
 // Provides readonly access to some properties of a DOM node.
-class WebNodeCollection {
+class WebElementCollection {
 public:
-    ~WebNodeCollection() { reset(); }
+    ~WebElementCollection() { reset(); }
 
-    WebNodeCollection() : m_private(0), m_current(0) { }
-    WebNodeCollection(const WebNodeCollection& n) : m_private(0) { assign(n); }
-    WebNodeCollection& operator=(const WebNodeCollection& n)
+    WebElementCollection() : m_current(0) { }
+    WebElementCollection(const WebElementCollection& n) { assign(n); }
+    WebElementCollection& operator=(const WebElementCollection& n)
     {
         assign(n);
         return *this;
     }
 
-    bool isNull() const { return !m_private; }
+    bool isNull() const { return m_private.isNull(); }
 
     BLINK_EXPORT void reset();
-    BLINK_EXPORT void assign(const WebNodeCollection&);
+    BLINK_EXPORT void assign(const WebElementCollection&);
 
     BLINK_EXPORT unsigned length() const;
-    BLINK_EXPORT WebNode nextItem() const;
-    BLINK_EXPORT WebNode firstItem() const;
+    BLINK_EXPORT WebElement nextItem() const;
+    BLINK_EXPORT WebElement firstItem() const;
 
 #if BLINK_IMPLEMENTATION
-    WebNodeCollection(const WTF::PassRefPtr<WebCore::HTMLCollection>&);
+    WebElementCollection(const PassRefPtrWillBeRawPtr<WebCore::HTMLCollection>&);
+    WebElementCollection& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLCollection>&);
 #endif
 
 private:
-    void assign(WebCore::HTMLCollection*);
-    WebCore::HTMLCollection* m_private;
+    WebPrivatePtr<WebCore::HTMLCollection> m_private;
     mutable unsigned m_current;
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebEmbeddedWorker.h b/chromium/third_party/WebKit/public/web/WebEmbeddedWorker.h
index 21af406f706..4ba3c9262a1 100644
--- a/chromium/third_party/WebKit/public/web/WebEmbeddedWorker.h
+++ b/chromium/third_party/WebKit/public/web/WebEmbeddedWorker.h
@@ -36,6 +36,7 @@
 namespace blink {
 
 class WebServiceWorkerContextClient;
+class WebString;
 class WebWorkerPermissionClientProxy;
 struct WebEmbeddedWorkerStartData;
 
@@ -56,6 +57,17 @@ public:
     // Starts and terminates WorkerThread and WorkerGlobalScope.
     virtual void startWorkerContext(const WebEmbeddedWorkerStartData&) = 0;
     virtual void terminateWorkerContext() = 0;
+
+    // Resumes starting a worker startup that was paused via
+    // WebEmbeddedWorkerStartData.pauseAfterDownloadMode.
+    virtual void resumeAfterDownload() = 0;
+
+    // Inspector related methods.
+    virtual void resumeWorkerContext() = 0;
+    virtual void attachDevTools() = 0;
+    virtual void reattachDevTools(const WebString& savedState) = 0;
+    virtual void detachDevTools() = 0;
+    virtual void dispatchDevToolsMessage(const WebString&) = 0;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebEmbeddedWorkerStartData.h b/chromium/third_party/WebKit/public/web/WebEmbeddedWorkerStartData.h
index c5cf380e489..25751e69620 100644
--- a/chromium/third_party/WebKit/public/web/WebEmbeddedWorkerStartData.h
+++ b/chromium/third_party/WebKit/public/web/WebEmbeddedWorkerStartData.h
@@ -37,15 +37,27 @@
 
 namespace blink {
 
+// FIXME: delete after waitForDebugger is in use in both chrome and blink.
 enum WebEmbeddedWorkerStartMode {
     WebEmbeddedWorkerStartModeDontPauseOnStart,
     WebEmbeddedWorkerStartModePauseOnStart
 };
 
 struct WebEmbeddedWorkerStartData {
+    enum PauseAfterDownloadMode {
+        DontPauseAfterDownload,
+        PauseAfterDownload,
+    };
+    enum WaitForDebuggerMode {
+        DontWaitForDebugger,
+        WaitForDebugger
+    };
+
     WebURL scriptURL;
     WebString userAgent;
-    WebEmbeddedWorkerStartMode startMode;
+    WebEmbeddedWorkerStartMode startMode; // FIXME: ditto delete
+    PauseAfterDownloadMode pauseAfterDownloadMode;
+    WaitForDebuggerMode waitForDebuggerMode;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebFontDescription.h b/chromium/third_party/WebKit/public/web/WebFontDescription.h
index d40030caae6..b7b29ba0e11 100644
--- a/chromium/third_party/WebKit/public/web/WebFontDescription.h
+++ b/chromium/third_party/WebKit/public/web/WebFontDescription.h
@@ -95,7 +95,7 @@ struct WebFontDescription {
     short wordSpacing;
 
 #if BLINK_IMPLEMENTATION
-    WebFontDescription(const WebCore::FontDescription&, short fontLetterSpacing, short fontWordSpacing);
+    WebFontDescription(const WebCore::FontDescription&);
 
     operator WebCore::FontDescription() const;
 #endif
diff --git a/chromium/third_party/WebKit/public/web/WebFormControlElement.h b/chromium/third_party/WebKit/public/web/WebFormControlElement.h
index a6abd72ffa5..e8862d1d549 100644
--- a/chromium/third_party/WebKit/public/web/WebFormControlElement.h
+++ b/chromium/third_party/WebKit/public/web/WebFormControlElement.h
@@ -59,11 +59,55 @@ public:
     BLINK_EXPORT WebString formControlName() const;
     BLINK_EXPORT WebString formControlType() const;
 
+    // FIXME: remove this method when no longer used.
     BLINK_EXPORT void dispatchFormControlChangeEvent();
 
     BLINK_EXPORT bool isAutofilled() const;
     BLINK_EXPORT void setAutofilled(bool);
 
+    // Returns true if autocomplete attribute of the element is not set as "off".
+    BLINK_EXPORT bool autoComplete() const;
+
+    // Sets value for input element, textarea element and select element. For select
+    // element it finds the option with value matches the given parameter and make the
+    // option as the current selection.
+    BLINK_EXPORT void setValue(const WebString&, bool sendEvents = false);
+    // Returns value of element. For select element, it returns the value of
+    // the selected option if present. If no selected option, an empty string
+    // is returned. If element doesn't fall into input element, textarea element
+    // and select element categories, a null string is returned.
+    BLINK_EXPORT WebString value() const;
+    // Sets suggested value for element. For select element it finds the option
+    // with value matches the given parameter and make the option as the suggested
+    // selection. The goal of introducing suggested value is to not leak any information
+    // to JavaScript.
+    BLINK_EXPORT void setSuggestedValue(const WebString&);
+    // Returns suggested value of element. If element doesn't fall into input element,
+    // textarea element and select element categories, a null string is returned.
+    BLINK_EXPORT WebString suggestedValue() const;
+
+    // Returns the non-sanitized, exact value inside the text input field
+    // or insisde the textarea. If neither input element nor textarea element,
+    // a null string is returned.
+    BLINK_EXPORT WebString editingValue() const;
+
+    // Sets character selection range.
+    BLINK_EXPORT void setSelectionRange(int start, int end);
+    // Returned value represents a cursor/caret position at the current
+    // selection's start for text input field or textarea. If neither input
+    // element nor textarea element, 0 is returned.
+    BLINK_EXPORT int selectionStart() const;
+    // Returned value represents a cursor/caret position at the current
+    // selection's end for text input field or textarea. If neither input
+    // element nor textarea element, 0 is returned.
+    BLINK_EXPORT int selectionEnd() const;
+
+    // Returns direction of text of element.
+    BLINK_EXPORT WebString directionForFormData() const;
+
+    // Returns true if sumit is activated.
+    BLINK_EXPORT bool isActivatedSubmit() const;
+
     // Returns the name that should be used for the specified |element| when
     // storing autofill data.  This is either the field name or its id, an empty
     // string if it has no name and no id.
@@ -72,9 +116,9 @@ public:
     BLINK_EXPORT WebFormElement form() const;
 
 #if BLINK_IMPLEMENTATION
-    WebFormControlElement(const WTF::PassRefPtr<WebCore::HTMLFormControlElement>&);
-    WebFormControlElement& operator=(const WTF::PassRefPtr<WebCore::HTMLFormControlElement>&);
-    operator WTF::PassRefPtr<WebCore::HTMLFormControlElement>() const;
+    WebFormControlElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLFormControlElement>&);
+    WebFormControlElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLFormControlElement>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::HTMLFormControlElement>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebFormElement.h b/chromium/third_party/WebKit/public/web/WebFormElement.h
index 0d012053883..3181e827693 100644
--- a/chromium/third_party/WebKit/public/web/WebFormElement.h
+++ b/chromium/third_party/WebKit/public/web/WebFormElement.h
@@ -68,7 +68,9 @@ namespace blink {
         // FIXME: Deprecate and replace with WebVector<WebElement>.
         BLINK_EXPORT void getNamedElements(const WebString&, WebVector<WebNode>&);
         BLINK_EXPORT void getFormControlElements(WebVector<WebFormControlElement>&) const;
-        BLINK_EXPORT bool checkValidityWithoutDispatchingEvents();
+
+        // NOTE: This function dispatches "invalid" events. Only call this if required by a specification (e.g. requestAutocomplete()).
+        BLINK_EXPORT bool checkValidity();
 
         enum AutocompleteResult {
             AutocompleteResultSuccess,
@@ -79,9 +81,9 @@ namespace blink {
         BLINK_EXPORT void finishRequestAutocomplete(WebFormElement::AutocompleteResult);
 
 #if BLINK_IMPLEMENTATION
-        WebFormElement(const WTF::PassRefPtr<WebCore::HTMLFormElement>&);
-        WebFormElement& operator=(const WTF::PassRefPtr<WebCore::HTMLFormElement>&);
-        operator WTF::PassRefPtr<WebCore::HTMLFormElement>() const;
+        WebFormElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLFormElement>&);
+        WebFormElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLFormElement>&);
+        operator PassRefPtrWillBeRawPtr<WebCore::HTMLFormElement>() const;
 #endif
     };
 
diff --git a/chromium/third_party/WebKit/public/web/WebFrame.h b/chromium/third_party/WebKit/public/web/WebFrame.h
index f99ae66f4ba..669b865c08d 100644
--- a/chromium/third_party/WebKit/public/web/WebFrame.h
+++ b/chromium/third_party/WebKit/public/web/WebFrame.h
@@ -31,18 +31,24 @@
 #ifndef WebFrame_h
 #define WebFrame_h
 
-#include "../platform/WebCanvas.h"
-#include "../platform/WebFileSystem.h"
-#include "../platform/WebFileSystemType.h"
-#include "../platform/WebMessagePortChannel.h"
-#include "../platform/WebReferrerPolicy.h"
-#include "../platform/WebURL.h"
+#include "WebCompositionUnderline.h"
+#include "WebHistoryItem.h"
 #include "WebIconURL.h"
 #include "WebNode.h"
 #include "WebURLLoaderOptions.h"
+#include "public/platform/WebCanvas.h"
+#include "public/platform/WebMessagePortChannel.h"
+#include "public/platform/WebPrivateOwnPtr.h"
+#include "public/platform/WebReferrerPolicy.h"
+#include "public/platform/WebURL.h"
+#include "public/platform/WebURLRequest.h"
 
 struct NPObject;
 
+#if BLINK_IMPLEMENTATION
+namespace WebCore { class Frame; }
+#endif
+
 namespace v8 {
 class Context;
 class Function;
@@ -54,19 +60,22 @@ template <class T> class Local;
 
 namespace blink {
 
+class OpenedFrameTracker;
 class WebData;
 class WebDataSource;
 class WebDocument;
 class WebElement;
 class WebFormElement;
 class WebFrameClient;
-class WebHistoryItem;
 class WebInputElement;
 class WebLayer;
+class WebLocalFrame;
 class WebPerformance;
 class WebPermissionClient;
 class WebRange;
+class WebRemoteFrame;
 class WebSecurityOrigin;
+class WebSharedWorkerRepositoryClient;
 class WebString;
 class WebURL;
 class WebURLLoader;
@@ -85,6 +94,12 @@ struct WebURLLoaderOptions;
 
 template <typename T> class WebVector;
 
+// Frames may be rendered in process ('local') or out of process ('remote').
+// A remote frame is always cross-site; a local frame may be either same-site or
+// cross-site.
+// WebFrame is the base class for both WebLocalFrame and WebRemoteFrame and
+// contains methods that are valid on both local and remote frames, such as
+// getting a frame's parent or its opener.
 class WebFrame {
 public:
     // Control of renderTreeAsText output
@@ -95,39 +110,15 @@ public:
     };
     typedef unsigned RenderAsTextControls;
 
-    // Creates a WebFrame. Delete this WebFrame by calling WebFrame::close().
-    // It is valid to pass a null client pointer.
-    BLINK_EXPORT static WebFrame* create(WebFrameClient*);
-
-    // Same as create(WebFrameClient*) except the embedder may explicitly pass
-    // in the identifier for the WebFrame. This can be used with
-    // generateEmbedderIdentifier() if constructing the WebFrameClient for this
-    // frame requires the identifier.
-    //
-    // FIXME: Move the embedderIdentifier concept fully to the embedder and
-    // remove this factory method.
-    BLINK_EXPORT static WebFrame* create(WebFrameClient*, long long embedderIdentifier);
-
-    // Generates an identifier suitable for use with create() above.
-    // Never returns -1.
-    BLINK_EXPORT static long long generateEmbedderIdentifier();
-
     // Returns the number of live WebFrame objects, used for leak checking.
     BLINK_EXPORT static int instanceCount();
 
-    // Returns the WebFrame associated with the current V8 context. This
-    // function can return 0 if the context is associated with a Document that
-    // is not currently being displayed in a Frame.
-    BLINK_EXPORT static WebFrame* frameForCurrentContext();
+    virtual bool isWebLocalFrame() const = 0;
+    virtual WebLocalFrame* toWebLocalFrame() = 0;
+    virtual bool isWebRemoteFrame() const = 0;
+    virtual WebRemoteFrame* toWebRemoteFrame() = 0;
 
-    // Returns the frame corresponding to the given context. This can return 0
-    // if the context is detached from the frame, or if the context doesn't
-    // correspond to a frame (e.g., workers).
-    BLINK_EXPORT static WebFrame* frameForContext(v8::Handle<v8::Context>);
-
-    // Returns the frame inside a given frame or iframe element. Returns 0 if
-    // the given element is not a frame, iframe or if the frame is empty.
-    BLINK_EXPORT static WebFrame* fromFrameOwnerElement(const WebElement&);
+    BLINK_EXPORT void swap(WebFrame*);
 
     // This method closes and deletes the WebFrame.
     virtual void close() = 0;
@@ -146,17 +137,16 @@ public:
     // frame name unique within the hierarchy.
     virtual void setName(const WebString&) = 0;
 
-    // A globally unique identifier for this frame.
-    // FIXME: Convert users to embedderIdentifier() and remove identifier().
-    long long identifier() const { return embedderIdentifier(); }
-    virtual long long embedderIdentifier() const = 0;
-
     // The urls of the given combination types of favicon (if any) specified by
     // the document loaded in this frame. The iconTypesMask is a bit-mask of
     // WebIconURL::Type values, used to select from the available set of icon
     // URLs
     virtual WebVector<WebIconURL> iconURLs(int iconTypesMask) const = 0;
 
+    // Notify the WebFrame as to whether its frame will be rendered in a
+    // separate renderer process.
+    virtual void setIsRemote(bool) = 0;
+
     // For a WebFrame with contents being rendered in another process, this
     // sets a layer for use by the in-process compositor. WebLayer should be
     // null if the content is being rendered in the current process.
@@ -164,6 +154,7 @@ public:
 
     // Initializes the various client interfaces.
     virtual void setPermissionClient(WebPermissionClient*) = 0;
+    virtual void setSharedWorkerRepositoryClient(WebSharedWorkerRepositoryClient*) = 0;
 
 
     // Geometry -----------------------------------------------------------
@@ -201,39 +192,42 @@ public:
     virtual WebView* view() const = 0;
 
     // Returns the frame that opened this frame or 0 if there is none.
-    virtual WebFrame* opener() const = 0;
+    BLINK_EXPORT WebFrame* opener() const;
 
     // Sets the frame that opened this one or 0 if there is none.
-    virtual void setOpener(const WebFrame*) = 0;
+    virtual void setOpener(WebFrame*);
 
     // Reset the frame that opened this frame to 0.
     // This is executed between layout tests runs
     void clearOpener() { setOpener(0); }
 
+    // Adds the given frame as a child of this frame.
+    BLINK_EXPORT void appendChild(WebFrame*);
+
+    // Removes the given child from this frame.
+    virtual void removeChild(WebFrame*);
+
     // Returns the parent frame or 0 if this is a top-most frame.
-    virtual WebFrame* parent() const = 0;
+    BLINK_EXPORT WebFrame* parent() const;
 
     // Returns the top-most frame in the hierarchy containing this frame.
-    virtual WebFrame* top() const = 0;
+    BLINK_EXPORT WebFrame* top() const;
 
     // Returns the first/last child frame.
-    virtual WebFrame* firstChild() const = 0;
-    virtual WebFrame* lastChild() const = 0;
+    BLINK_EXPORT WebFrame* firstChild() const;
+    BLINK_EXPORT WebFrame* lastChild() const;
 
-    // Returns the next/previous sibling frame.
-    virtual WebFrame* nextSibling() const = 0;
-    virtual WebFrame* previousSibling() const = 0;
+    // Returns the previous/next sibling frame.
+    BLINK_EXPORT WebFrame* previousSibling() const;
+    BLINK_EXPORT WebFrame* nextSibling() const;
 
-    // Returns the next/previous frame in "frame traversal order"
+    // Returns the previous/next frame in "frame traversal order",
     // optionally wrapping around.
-    virtual WebFrame* traverseNext(bool wrap) const = 0;
-    virtual WebFrame* traversePrevious(bool wrap) const = 0;
+    BLINK_EXPORT WebFrame* traversePrevious(bool wrap) const;
+    BLINK_EXPORT WebFrame* traverseNext(bool wrap) const;
 
     // Returns the child frame identified by the given name.
-    virtual WebFrame* findChildByName(const WebString& name) const = 0;
-
-    // Returns the child frame identified by the given xpath expression.
-    virtual WebFrame* findChildByExpression(const WebString& xpath) const = 0;
+    BLINK_EXPORT WebFrame* findChildByName(const WebString& name) const;
 
 
     // Content ------------------------------------------------------------
@@ -243,6 +237,16 @@ public:
     virtual WebPerformance performance() const = 0;
 
 
+    // Closing -------------------------------------------------------------
+
+    // Runs beforeunload handlers for this frame, returning false if a
+    // handler suppressed unloading.
+    virtual bool dispatchBeforeUnloadEvent() = 0;
+
+    // Runs unload handlers for this frame.
+    virtual void dispatchUnloadEvent() = 0;
+
+
     // Scripting ----------------------------------------------------------
 
     // Returns a NPObject corresponding to this frame's DOMWindow.
@@ -311,7 +315,7 @@ public:
     // canExecute().
     virtual v8::Handle<v8::Value> callFunctionEvenIfScriptDisabled(
         v8::Handle<v8::Function>,
-        v8::Handle<v8::Object>,
+        v8::Handle<v8::Value>,
         int argc,
         v8::Handle<v8::Value> argv[]) = 0;
 
@@ -322,23 +326,6 @@ public:
     // be calling this API.
     virtual v8::Local<v8::Context> mainWorldScriptContext() const = 0;
 
-    // Creates an instance of file system object.
-    virtual v8::Handle<v8::Value> createFileSystem(WebFileSystemType,
-        const WebString& name,
-        const WebString& rootURL) = 0;
-    // Creates an instance of serializable file system object.
-    // FIXME: Remove this API after we have a better way of creating serialized
-    // file system object.
-    virtual v8::Handle<v8::Value> createSerializableFileSystem(WebFileSystemType,
-        const WebString& name,
-        const WebString& rootURL) = 0;
-    // Creates an instance of file or directory entry object.
-    virtual v8::Handle<v8::Value> createFileEntry(WebFileSystemType,
-        const WebString& fileSystemName,
-        const WebString& fileSystemRootURL,
-        const WebString& filePath,
-        bool isDirectory) = 0;
-
     // Navigation ----------------------------------------------------------
 
     // Reload the current document.
@@ -353,8 +340,11 @@ public:
     virtual void loadRequest(const WebURLRequest&) = 0;
 
     // Load the given history state, corresponding to a back/forward
-    // navigation.
-    virtual void loadHistoryItem(const WebHistoryItem&) = 0;
+    // navigation of a frame. Multiple frames may be navigated via separate calls.
+    virtual void loadHistoryItem(
+        const WebHistoryItem&,
+        WebHistoryLoadType,
+        WebURLRequest::CachePolicy = WebURLRequest::UseProtocolCachePolicy) = 0;
 
     // Loads the given data with specific mime type and optional text
     // encoding.  For HTML data, baseURL indicates the security origin of
@@ -388,14 +378,6 @@ public:
     // Returns the data source that is currently loaded.
     virtual WebDataSource* dataSource() const = 0;
 
-    // Returns the previous history item.  Check WebHistoryItem::isNull()
-    // before using.
-    virtual WebHistoryItem previousHistoryItem() const = 0;
-
-    // Returns the current history item.  Check WebHistoryItem::isNull()
-    // before using.
-    virtual WebHistoryItem currentHistoryItem() const = 0;
-
     // View-source rendering mode.  Set this before loading an URL to cause
     // it to be rendered in view-source mode.
     virtual void enableViewSourceMode(bool) = 0;
@@ -484,6 +466,10 @@ public:
     virtual void moveRangeSelection(const WebPoint& base, const WebPoint& extent) = 0;
     virtual void moveCaretSelection(const WebPoint&) = 0;
 
+    virtual bool setEditableSelectionOffsets(int start, int end) = 0;
+    virtual bool setCompositionFromExistingText(int compositionStart, int compositionEnd, const WebVector<WebCompositionUnderline>& underlines) = 0;
+    virtual void extendSelectionAndDelete(int before, int after) = 0;
+
     virtual void setCaretVisible(bool) = 0;
 
     // Printing ------------------------------------------------------------
@@ -617,13 +603,26 @@ public:
     virtual int selectNearestFindMatch(const WebFloatPoint&,
                                        WebRect* selectionRect) = 0;
 
+
+    // Set the tickmarks for the frame. This will override the default tickmarks
+    // generated by find results. If this is called with an empty array, the
+    // default behavior will be restored.
+    virtual void setTickmarks(const WebVector<WebRect>&) = 0;
+
     // OrientationChange event ---------------------------------------------
 
+    // Notify the frame that the screen orientation has changed.
+    virtual void sendOrientationChangeEvent() = 0;
+
+    // FIXME: this is only there for backward compatibility, it will be removed.
     // Orientation is the interface orientation in degrees.
     // Some examples are:
     //  0 is straight up; -90 is when the device is rotated 90 clockwise;
     //  90 is when rotated counter clockwise.
-    virtual void sendOrientationChangeEvent(int orientation) = 0;
+    void sendOrientationChangeEvent(int orientation)
+    {
+        sendOrientationChangeEvent();
+    }
 
     // Events --------------------------------------------------------------
 
@@ -674,10 +673,31 @@ public:
     // text form. This is used only by layout tests.
     virtual WebString layerTreeAsText(bool showDebugInfo = false) const = 0;
 
+#if BLINK_IMPLEMENTATION
+    static WebFrame* fromFrame(WebCore::Frame*);
+#endif
+
 protected:
-    ~WebFrame() { }
+    explicit WebFrame();
+    virtual ~WebFrame();
+
+private:
+    friend class OpenedFrameTracker;
+
+    WebFrame* m_parent;
+    WebFrame* m_previousSibling;
+    WebFrame* m_nextSibling;
+    WebFrame* m_firstChild;
+    WebFrame* m_lastChild;
+
+    WebFrame* m_opener;
+    WebPrivateOwnPtr<OpenedFrameTracker> m_openedFrameTracker;
 };
 
+#if BLINK_IMPLEMENTATION
+WebCore::Frame* toWebCoreFrame(const WebFrame*);
+#endif
+
 } // namespace blink
 
 #endif
diff --git a/chromium/third_party/WebKit/public/web/WebFrameClient.h b/chromium/third_party/WebKit/public/web/WebFrameClient.h
index 13c4494fcb1..271c652da28 100644
--- a/chromium/third_party/WebKit/public/web/WebFrameClient.h
+++ b/chromium/third_party/WebKit/public/web/WebFrameClient.h
@@ -31,8 +31,12 @@
 #ifndef WebFrameClient_h
 #define WebFrameClient_h
 
+#include "../platform/WebColor.h"
 #include "WebDOMMessageEvent.h"
 #include "WebDataSource.h"
+#include "WebFrame.h"
+#include "WebHistoryCommitType.h"
+#include "WebHistoryItem.h"
 #include "WebIconURL.h"
 #include "WebNavigationPolicy.h"
 #include "WebNavigationType.h"
@@ -41,6 +45,7 @@
 #include "public/platform/WebCommon.h"
 #include "public/platform/WebFileSystem.h"
 #include "public/platform/WebFileSystemType.h"
+#include "public/platform/WebStorageQuotaCallbacks.h"
 #include "public/platform/WebStorageQuotaType.h"
 #include "public/platform/WebURLError.h"
 #include "public/platform/WebURLRequest.h"
@@ -51,27 +56,38 @@ namespace blink {
 class WebApplicationCacheHost;
 class WebApplicationCacheHostClient;
 class WebCachedURLRequest;
+class WebColorChooser;
+class WebColorChooserClient;
+class WebContentDecryptionModule;
 class WebCookieJar;
 class WebDataSource;
 class WebDOMEvent;
 class WebFormElement;
-class WebFrame;
+class WebGeolocationClient;
+class WebInputEvent;
 class WebMediaPlayer;
 class WebMediaPlayerClient;
+class WebMIDIClient;
+class WebNotificationPresenter;
 class WebServiceWorkerProvider;
 class WebServiceWorkerProviderClient;
+class WebSocketHandle;
 class WebNode;
 class WebPlugin;
 class WebRTCPeerConnectionHandler;
+class WebScreenOrientationClient;
 class WebSharedWorker;
 class WebSharedWorkerClient;
 class WebSocketStreamHandle;
-class WebStorageQuotaCallbacks;
 class WebString;
 class WebURL;
 class WebURLLoader;
 class WebURLResponse;
+class WebUserMediaClient;
 class WebWorkerPermissionClientProxy;
+struct WebColorSuggestion;
+struct WebConsoleMessage;
+struct WebContextMenuData;
 struct WebPluginParams;
 struct WebRect;
 struct WebSize;
@@ -82,67 +98,84 @@ public:
     // Factory methods -----------------------------------------------------
 
     // May return null.
-    virtual WebPlugin* createPlugin(WebFrame*, const WebPluginParams&) { return 0; }
+    virtual WebPlugin* createPlugin(WebLocalFrame*, const WebPluginParams&) { return 0; }
 
     // May return null.
-    virtual WebMediaPlayer* createMediaPlayer(WebFrame*, const WebURL&, WebMediaPlayerClient*) { return 0; }
+    virtual WebMediaPlayer* createMediaPlayer(WebLocalFrame*, const WebURL&, WebMediaPlayerClient*) { return 0; }
 
     // May return null.
-    virtual WebApplicationCacheHost* createApplicationCacheHost(WebFrame*, WebApplicationCacheHostClient*) { return 0; }
+    virtual WebContentDecryptionModule* createContentDecryptionModule(WebLocalFrame*, const WebSecurityOrigin&, const WebString& keySystem) { return 0; }
 
-    // May return null. Takes ownership of the client.
-    virtual WebServiceWorkerProvider* createServiceWorkerProvider(WebFrame*, WebServiceWorkerProviderClient*) { return 0; }
+    // May return null.
+    virtual WebApplicationCacheHost* createApplicationCacheHost(WebLocalFrame*, WebApplicationCacheHostClient*) { return 0; }
+
+    // May return null.
+    virtual WebServiceWorkerProvider* createServiceWorkerProvider(WebLocalFrame* frame) { return 0; }
 
     // May return null.
-    virtual WebWorkerPermissionClientProxy* createWorkerPermissionClientProxy(WebFrame*) { return 0; }
+    virtual WebWorkerPermissionClientProxy* createWorkerPermissionClientProxy(WebLocalFrame*) { return 0; }
 
 
     // Services ------------------------------------------------------------
 
     // A frame specific cookie jar.  May return null, in which case
     // WebKitPlatformSupport::cookieJar() will be called to access cookies.
-    virtual WebCookieJar* cookieJar(WebFrame*) { return 0; }
+    virtual WebCookieJar* cookieJar(WebLocalFrame*) { return 0; }
 
 
     // General notifications -----------------------------------------------
 
+    // Indicates if creating a plugin without an associated renderer is supported.
+    virtual bool canCreatePluginWithoutRenderer(const WebString& mimeType) { return false; }
+
     // Indicates that another page has accessed the DOM of the initial empty
     // document of a main frame. After this, it is no longer safe to show a
     // pending navigation's URL, because a URL spoof is possible.
-    virtual void didAccessInitialDocument(WebFrame*) { }
+    virtual void didAccessInitialDocument(WebLocalFrame*) { }
 
     // A child frame was created in this frame. This is called when the frame
     // is created and initialized. Takes the name of the new frame, the parent
     // frame and returns a new WebFrame. The WebFrame is considered in-use
     // until frameDetached() is called on it.
-    virtual WebFrame* createChildFrame(WebFrame* parent, const WebString& frameName) { return 0; }
-    // FIXME: Remove when all embedders use createChildFrame().
-    virtual void didCreateFrame(WebFrame* parent, WebFrame* child) { }
+    // Note: If you override this, you should almost certainly be overriding
+    // frameDetached().
+    virtual WebFrame* createChildFrame(WebLocalFrame* parent, const WebString& frameName) { return 0; }
 
     // This frame set its opener to null, disowning it.
     // See http://html.spec.whatwg.org/#dom-opener.
-    virtual void didDisownOpener(WebFrame*) { }
+    virtual void didDisownOpener(WebLocalFrame*) { }
 
     // This frame has been detached from the view, but has not been closed yet.
     virtual void frameDetached(WebFrame*) { }
 
+    // This frame has become focused..
+    virtual void frameFocused() { }
+
     // This frame is about to be closed. This is called after frameDetached,
     // when the document is being unloaded, due to new one committing.
     virtual void willClose(WebFrame*) { }
 
     // This frame's name has changed.
-    virtual void didChangeName(WebFrame*, const WebString&) { }
+    virtual void didChangeName(WebLocalFrame*, const WebString&) { }
 
     // Called when a watched CSS selector matches or stops matching.
-    virtual void didMatchCSS(WebFrame*, const WebVector<WebString>& newlyMatchingSelectors, const WebVector<WebString>& stoppedMatchingSelectors) { }
+    virtual void didMatchCSS(WebLocalFrame*, const WebVector<WebString>& newlyMatchingSelectors, const WebVector<WebString>& stoppedMatchingSelectors) { }
+
+
+    // Console messages ----------------------------------------------------
+
+    // Whether or not we should report a detailed message for the given source.
+    virtual bool shouldReportDetailedMessageForSource(const WebString& source) { return false; }
+
+    // A new message was added to the console.
+    virtual void didAddMessageToConsole(const WebConsoleMessage&, const WebString& sourceName, unsigned sourceLine, const WebString& stackTrace) { }
+
 
     // Load commands -------------------------------------------------------
 
     // The client should handle the navigation externally.
     virtual void loadURLExternally(
-        WebFrame*, const WebURLRequest&, WebNavigationPolicy) { }
-    virtual void loadURLExternally(
-        WebFrame*, const WebURLRequest&, WebNavigationPolicy, const WebString& downloadName) { }
+        WebLocalFrame*, const WebURLRequest&, WebNavigationPolicy, const WebString& downloadName) { }
 
 
     // Navigational queries ------------------------------------------------
@@ -150,151 +183,232 @@ public:
     // The client may choose to alter the navigation policy.  Otherwise,
     // defaultPolicy should just be returned.
     virtual WebNavigationPolicy decidePolicyForNavigation(
-        WebFrame*, WebDataSource::ExtraData*, const WebURLRequest&, WebNavigationType,
+        WebLocalFrame*, WebDataSource::ExtraData*, const WebURLRequest&, WebNavigationType,
         WebNavigationPolicy defaultPolicy, bool isRedirect) { return defaultPolicy; }
 
+    // During a history navigation, we may choose to load new subframes from history as well.
+    // This returns such a history item if appropriate.
+    virtual WebHistoryItem historyItemForNewChildFrame(WebFrame*) { return WebHistoryItem(); }
+
 
     // Navigational notifications ------------------------------------------
 
+    // These notifications bracket any loading that occurs in the WebFrame.
+    virtual void didStartLoading(bool toDifferentDocument) { }
+    virtual void didStopLoading() { }
+
+    // Notification that some progress was made loading the current frame.
+    // loadProgress is a value between 0 (nothing loaded) and 1.0 (frame fully
+    // loaded).
+    virtual void didChangeLoadProgress(double loadProgress) { }
+
     // A form submission has been requested, but the page's submit event handler
     // hasn't yet had a chance to run (and possibly alter/interrupt the submit.)
-    virtual void willSendSubmitEvent(WebFrame*, const WebFormElement&) { }
+    virtual void willSendSubmitEvent(WebLocalFrame*, const WebFormElement&) { }
 
     // A form submission is about to occur.
-    virtual void willSubmitForm(WebFrame*, const WebFormElement&) { }
+    virtual void willSubmitForm(WebLocalFrame*, const WebFormElement&) { }
 
     // A datasource has been created for a new navigation.  The given
     // datasource will become the provisional datasource for the frame.
-    virtual void didCreateDataSource(WebFrame*, WebDataSource*) { }
+    virtual void didCreateDataSource(WebLocalFrame*, WebDataSource*) { }
 
     // A new provisional load has been started.
-    virtual void didStartProvisionalLoad(WebFrame*) { }
+    virtual void didStartProvisionalLoad(WebLocalFrame*) { }
 
     // The provisional load was redirected via a HTTP 3xx response.
-    virtual void didReceiveServerRedirectForProvisionalLoad(WebFrame*) { }
+    virtual void didReceiveServerRedirectForProvisionalLoad(WebLocalFrame*) { }
 
     // The provisional load failed.
-    virtual void didFailProvisionalLoad(WebFrame*, const WebURLError&) { }
+    virtual void didFailProvisionalLoad(WebLocalFrame*, const WebURLError&) { }
 
     // The provisional datasource is now committed.  The first part of the
     // response body has been received, and the encoding of the response
     // body is known.
-    virtual void didCommitProvisionalLoad(WebFrame*, bool isNewNavigation) { }
+    virtual void didCommitProvisionalLoad(WebLocalFrame*, const WebHistoryItem&, WebHistoryCommitType) { }
 
     // The window object for the frame has been cleared of any extra
     // properties that may have been set by script from the previously
     // loaded document.
-    virtual void didClearWindowObject(WebFrame*) { }
+    virtual void didClearWindowObject(WebLocalFrame* frame) { }
 
     // The document element has been created.
-    virtual void didCreateDocumentElement(WebFrame*) { }
+    virtual void didCreateDocumentElement(WebLocalFrame*) { }
 
     // The page title is available.
-    virtual void didReceiveTitle(WebFrame* frame, const WebString& title, WebTextDirection direction) { }
+    virtual void didReceiveTitle(WebLocalFrame* frame, const WebString& title, WebTextDirection direction) { }
 
     // The icon for the page have changed.
-    virtual void didChangeIcon(WebFrame*, WebIconURL::Type) { }
+    virtual void didChangeIcon(WebLocalFrame*, WebIconURL::Type) { }
 
     // The frame's document finished loading.
-    virtual void didFinishDocumentLoad(WebFrame*) { }
+    virtual void didFinishDocumentLoad(WebLocalFrame*) { }
 
     // The 'load' event was dispatched.
-    virtual void didHandleOnloadEvents(WebFrame*) { }
+    virtual void didHandleOnloadEvents(WebLocalFrame*) { }
 
     // The frame's document or one of its subresources failed to load.
-    virtual void didFailLoad(WebFrame*, const WebURLError&) { }
+    virtual void didFailLoad(WebLocalFrame*, const WebURLError&) { }
 
     // The frame's document and all of its subresources succeeded to load.
-    virtual void didFinishLoad(WebFrame*) { }
+    virtual void didFinishLoad(WebLocalFrame*) { }
 
     // The navigation resulted in no change to the documents within the page.
     // For example, the navigation may have just resulted in scrolling to a
     // named anchor or a PopState event may have been dispatched.
-    virtual void didNavigateWithinPage(WebFrame*, bool isNewNavigation) { }
+    virtual void didNavigateWithinPage(WebLocalFrame*, const WebHistoryItem&, WebHistoryCommitType) { }
 
     // Called upon update to scroll position, document state, and other
     // non-navigational events related to the data held by WebHistoryItem.
     // WARNING: This method may be called very frequently.
-    virtual void didUpdateCurrentHistoryItem(WebFrame*) { }
+    virtual void didUpdateCurrentHistoryItem(WebLocalFrame*) { }
+
+    // The frame's manifest has changed.
+    virtual void didChangeManifest(WebLocalFrame*) { }
+
+    // TODO: Remove when chromium is changed to use didChangeThemeColor().
+    virtual void didChangeBrandColor() { }
+
+    // The frame's theme color has changed.
+    virtual void didChangeThemeColor() { }
+
+    // Misc ----------------------------------------------------------------
+
+    // Called to retrieve the provider of desktop notifications.
+    virtual WebNotificationPresenter* notificationPresenter() { return 0; }
+
+
+    // Editing -------------------------------------------------------------
+
+    // These methods allow the client to intercept and overrule editing
+    // operations.
+    virtual void didChangeSelection(bool isSelectionEmpty) { }
+
+
+    // Dialogs -------------------------------------------------------------
+
+    // This method opens the color chooser and returns a new WebColorChooser
+    // instance. If there is a WebColorChooser already from the last time this
+    // was called, it ends the color chooser by calling endChooser, and replaces
+    // it with the new one. The given list of suggestions can be used to show a
+    // simple interface with a limited set of choices.
+
+    virtual WebColorChooser* createColorChooser(
+        WebColorChooserClient*,
+        const WebColor&,
+        const WebVector<WebColorSuggestion>&) { return 0; }
+
+    // Displays a modal alert dialog containing the given message. Returns
+    // once the user dismisses the dialog.
+    virtual void runModalAlertDialog(const WebString& message) { }
+
+    // Displays a modal confirmation dialog with the given message as
+    // description and OK/Cancel choices. Returns true if the user selects
+    // 'OK' or false otherwise.
+    virtual bool runModalConfirmDialog(const WebString& message) { return false; }
+
+    // Displays a modal input dialog with the given message as description
+    // and OK/Cancel choices. The input field is pre-filled with
+    // defaultValue. Returns true if the user selects 'OK' or false
+    // otherwise. Upon returning true, actualValue contains the value of
+    // the input field.
+    virtual bool runModalPromptDialog(
+        const WebString& message, const WebString& defaultValue,
+        WebString* actualValue) { return false; }
+
+    // Displays a modal confirmation dialog containing the given message as
+    // description and OK/Cancel choices, where 'OK' means that it is okay
+    // to proceed with closing the view. Returns true if the user selects
+    // 'OK' or false otherwise.
+    virtual bool runModalBeforeUnloadDialog(
+        bool isReload, const WebString& message) { return true; }
+
+
+    // UI ------------------------------------------------------------------
+
+    // Shows a context menu with commands relevant to a specific element on
+    // the given frame. Additional context data is supplied.
+    virtual void showContextMenu(const WebContextMenuData&) { }
+
+    // Called when the data attached to the currently displayed context menu is
+    // invalidated. The context menu may be closed if possible.
+    virtual void clearContextMenu() { }
 
 
     // Low-level resource notifications ------------------------------------
 
     // An element will request a resource.
-    virtual void willRequestResource(WebFrame*, const WebCachedURLRequest&) { }
+    virtual void willRequestResource(WebLocalFrame*, const WebCachedURLRequest&) { }
 
     // The request is after preconnect is triggered.
-    virtual void willRequestAfterPreconnect(WebFrame*, WebURLRequest&) { }
+    virtual void willRequestAfterPreconnect(WebLocalFrame*, WebURLRequest&) { }
 
     // A request is about to be sent out, and the client may modify it.  Request
     // is writable, and changes to the URL, for example, will change the request
     // made.  If this request is the result of a redirect, then redirectResponse
     // will be non-null and contain the response that triggered the redirect.
     virtual void willSendRequest(
-        WebFrame*, unsigned identifier, WebURLRequest&,
+        WebLocalFrame*, unsigned identifier, WebURLRequest&,
         const WebURLResponse& redirectResponse) { }
 
     // Response headers have been received for the resource request given
     // by identifier.
     virtual void didReceiveResponse(
-        WebFrame*, unsigned identifier, const WebURLResponse&) { }
+        WebLocalFrame*, unsigned identifier, const WebURLResponse&) { }
 
     virtual void didChangeResourcePriority(
-        WebFrame*, unsigned identifier, const blink::WebURLRequest::Priority&) { }
+        WebLocalFrame* webFrame, unsigned identifier, const blink::WebURLRequest::Priority& priority, int) { }
 
     // The resource request given by identifier succeeded.
     virtual void didFinishResourceLoad(
-        WebFrame*, unsigned identifier) { }
+        WebLocalFrame*, unsigned identifier) { }
 
     // The specified request was satified from WebCore's memory cache.
     virtual void didLoadResourceFromMemoryCache(
-        WebFrame*, const WebURLRequest&, const WebURLResponse&) { }
+        WebLocalFrame*, const WebURLRequest&, const WebURLResponse&) { }
 
     // This frame has displayed inactive content (such as an image) from an
     // insecure source.  Inactive content cannot spread to other frames.
-    virtual void didDisplayInsecureContent(WebFrame*) { }
+    virtual void didDisplayInsecureContent(WebLocalFrame*) { }
 
     // The indicated security origin has run active content (such as a
     // script) from an insecure source.  Note that the insecure content can
     // spread to other frames in the same origin.
-    virtual void didRunInsecureContent(WebFrame*, const WebSecurityOrigin&, const WebURL& insecureURL) { }
+    virtual void didRunInsecureContent(WebLocalFrame*, const WebSecurityOrigin&, const WebURL& insecureURL) { }
 
     // A reflected XSS was encountered in the page and suppressed.
-    virtual void didDetectXSS(WebFrame*, const WebURL&, bool didBlockEntirePage) { }
+    virtual void didDetectXSS(WebLocalFrame*, const WebURL&, bool didBlockEntirePage) { }
 
     // A PingLoader was created, and a request dispatched to a URL.
-    virtual void didDispatchPingLoader(WebFrame*, const WebURL&) { }
+    virtual void didDispatchPingLoader(WebLocalFrame*, const WebURL&) { }
 
     // The loaders in this frame have been stopped.
-    virtual void didAbortLoading(WebFrame*) { }
+    virtual void didAbortLoading(WebLocalFrame*) { }
 
-    // Script notifications ------------------------------------------------
 
-    // Script in the page tried to allocate too much memory.
-    virtual void didExhaustMemoryAvailableForScript(WebFrame*) { }
+    // Script notifications ------------------------------------------------
 
     // Notifies that a new script context has been created for this frame.
     // This is similar to didClearWindowObject but only called once per
     // frame context.
-    virtual void didCreateScriptContext(WebFrame*, v8::Handle<v8::Context>, int extensionGroup, int worldId) { }
+    virtual void didCreateScriptContext(WebLocalFrame*, v8::Handle<v8::Context>, int extensionGroup, int worldId) { }
 
     // WebKit is about to release its reference to a v8 context for a frame.
-    virtual void willReleaseScriptContext(WebFrame*, v8::Handle<v8::Context>, int worldId) { }
+    virtual void willReleaseScriptContext(WebLocalFrame*, v8::Handle<v8::Context>, int worldId) { }
+
 
     // Geometry notifications ----------------------------------------------
 
     // The frame's document finished the initial non-empty layout of a page.
-    virtual void didFirstVisuallyNonEmptyLayout(WebFrame*) { }
-
-    // The size of the content area changed.
-    virtual void didChangeContentsSize(WebFrame*, const WebSize&) { }
+    virtual void didFirstVisuallyNonEmptyLayout(WebLocalFrame*) { }
 
     // The main frame scrolled.
-    virtual void didChangeScrollOffset(WebFrame*) { }
+    virtual void didChangeScrollOffset(WebLocalFrame*) { }
 
     // If the frame is loading an HTML document, this will be called to
     // notify that the <body> will be attached soon.
-    virtual void willInsertBody(WebFrame*) { }
+    virtual void willInsertBody(WebLocalFrame*) { }
+
 
     // Find-in-page notifications ------------------------------------------
 
@@ -313,6 +427,7 @@ public:
     virtual void reportFindInPageSelection(
         int identifier, int activeMatchOrdinal, const WebRect& selection) { }
 
+
     // Quota ---------------------------------------------------------
 
     // Requests a new quota size for the origin's storage.
@@ -323,22 +438,40 @@ public:
     // is called with an error code otherwise.
     // Note that the requesting quota size may not always be granted and
     // a smaller amount of quota than requested might be returned.
-    // The callbacks object is deleted when the callback method is called
-    // and does not need to be (and should not be) deleted manually.
     virtual void requestStorageQuota(
-        WebFrame*, WebStorageQuotaType,
+        WebLocalFrame*, WebStorageQuotaType,
         unsigned long long newQuotaInBytes,
-        WebStorageQuotaCallbacks*) { }
+        WebStorageQuotaCallbacks) { }
 
     // WebSocket -----------------------------------------------------
 
-    // A WebSocket object is going to open new stream connection.
+    // A WebSocket object is going to open a new socket stream connection. Used
+    // by the old WebSocket implementation.
     virtual void willOpenSocketStream(WebSocketStreamHandle*) { }
 
+    // A WebSocket object is going to open a new WebSocket connection. Used by
+    // the new WebSocket implementation.
+    virtual void willOpenWebSocket(WebSocketHandle*) { }
+
+
+    // Geolocation ---------------------------------------------------------
+
+    // Access the embedder API for (client-based) geolocation client .
+    virtual WebGeolocationClient* geolocationClient() { return 0; }
+
+
     // MediaStream -----------------------------------------------------
 
     // A new WebRTCPeerConnectionHandler is created.
-    virtual void willStartUsingPeerConnectionHandler(WebFrame*, WebRTCPeerConnectionHandler*) { }
+    virtual void willStartUsingPeerConnectionHandler(WebLocalFrame*, WebRTCPeerConnectionHandler*) { }
+
+    virtual WebUserMediaClient* userMediaClient() { return 0; }
+
+
+    // Web MIDI -------------------------------------------------------------
+
+    virtual WebMIDIClient* webMIDIClient() { return 0; }
+
 
     // Messages ------------------------------------------------------
 
@@ -346,7 +479,7 @@ public:
     // gives the embedder a chance to handle it instead of WebKit. Returns true
     // if the embedder handled it.
     virtual bool willCheckAndDispatchMessageEvent(
-        WebFrame* sourceFrame,
+        WebLocalFrame* sourceFrame,
         WebFrame* targetFrame,
         WebSecurityOrigin target,
         WebDOMMessageEvent event) { return false; }
@@ -354,11 +487,12 @@ public:
     // Asks the embedder if a specific user agent should be used for the given
     // URL. Non-empty strings indicate an override should be used. Otherwise,
     // Platform::current()->userAgent() will be called to provide one.
-    virtual WebString userAgentOverride(WebFrame*, const WebURL& url) { return WebString(); }
+    virtual WebString userAgentOverride(WebLocalFrame*, const WebURL& url) { return WebString(); }
 
     // Asks the embedder what value the network stack will send for the DNT
     // header. An empty string indicates that no DNT header will be send.
-    virtual WebString doNotTrackValue(WebFrame*) { return WebString(); }
+    virtual WebString doNotTrackValue(WebLocalFrame*) { return WebString(); }
+
 
     // WebGL ------------------------------------------------------
 
@@ -366,15 +500,28 @@ public:
     // This call is placed here instead of WebPermissionClient because this
     // class is implemented in content/, and putting it here avoids adding
     // more public content/ APIs.
-    virtual bool allowWebGL(WebFrame*, bool defaultValue) { return defaultValue; }
+    virtual bool allowWebGL(WebLocalFrame*, bool defaultValue) { return defaultValue; }
 
     // Notifies the client that a WebGL context was lost on this page with the
     // given reason (one of the GL_ARB_robustness status codes; see
     // Extensions3D.h in WebCore/platform/graphics).
-    virtual void didLoseWebGLContext(WebFrame*, int) { }
+    virtual void didLoseWebGLContext(WebLocalFrame*, int) { }
+
+    // FIXME: Remove this method once we have input routing in the browser
+    // process. See http://crbug.com/339659.
+    virtual void forwardInputEvent(const WebInputEvent*) { }
+
+    // Send initial drawing parameters to a child frame that is being rendered out of process.
+    virtual void initializeChildFrame(const WebRect& frameRect, float scaleFactor) { }
+
+
+    // Screen Orientation --------------------------------------------------
+
+    // Access the embedder API for (client-based) screen orientation client .
+    virtual WebScreenOrientationClient* webScreenOrientationClient() { return 0; }
 
 protected:
-    ~WebFrameClient() { }
+    virtual ~WebFrameClient() { }
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebGeolocationClientMock.h b/chromium/third_party/WebKit/public/web/WebGeolocationClientMock.h
deleted file mode 100644
index f20e6cc60b8..00000000000
--- a/chromium/third_party/WebKit/public/web/WebGeolocationClientMock.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (c) 2010, Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebGeolocationClientMock_h
-#define WebGeolocationClientMock_h
-
-#include "../platform/WebCommon.h"
-#include "../platform/WebPrivateOwnPtr.h"
-#include "WebGeolocationClient.h"
-
-namespace WebCore {
-class GeolocationClientMock;
-}
-
-namespace blink {
-class WebGeolocationPosition;
-class WebString;
-
-class WebGeolocationClientMock : public WebGeolocationClient {
-public:
-    BLINK_EXPORT static WebGeolocationClientMock* create();
-    ~WebGeolocationClientMock() { reset(); }
-
-    BLINK_EXPORT void setPosition(double latitude, double longitude, double accuracy);
-    BLINK_EXPORT void setPositionUnavailableError(const WebString& message);
-    BLINK_EXPORT void setPermission(bool);
-    BLINK_EXPORT int numberOfPendingPermissionRequests() const;
-    BLINK_EXPORT void resetMock();
-
-    virtual void startUpdating();
-    virtual void stopUpdating();
-    virtual void setEnableHighAccuracy(bool);
-
-    virtual void geolocationDestroyed();
-    virtual void setController(WebGeolocationController*);
-
-    virtual void requestPermission(const WebGeolocationPermissionRequest&);
-    virtual void cancelPermissionRequest(const WebGeolocationPermissionRequest&);
-
-    virtual bool lastPosition(WebGeolocationPosition& webPosition);
-
-private:
-    WebGeolocationClientMock();
-    BLINK_EXPORT void reset();
-
-    WebPrivateOwnPtr<WebCore::GeolocationClientMock> m_clientMock;
-};
-}
-
-#endif // WebGeolocationClientMock_h
diff --git a/chromium/third_party/WebKit/public/web/WebGeolocationError.h b/chromium/third_party/WebKit/public/web/WebGeolocationError.h
index 949b3ccec68..6e25662176f 100644
--- a/chromium/third_party/WebKit/public/web/WebGeolocationError.h
+++ b/chromium/third_party/WebKit/public/web/WebGeolocationError.h
@@ -29,10 +29,6 @@
 #include "../platform/WebCommon.h"
 #include "../platform/WebPrivatePtr.h"
 
-#if BLINK_IMPLEMENTATION
-#include "wtf/PassRefPtr.h"
-#endif
-
 namespace WebCore { class GeolocationError; }
 
 namespace blink {
@@ -55,9 +51,9 @@ public:
     BLINK_EXPORT void reset();
 
 #if BLINK_IMPLEMENTATION
-    WebGeolocationError(WTF::PassRefPtr<WebCore::GeolocationError>);
-    WebGeolocationError& operator=(WTF::PassRefPtr<WebCore::GeolocationError>);
-    operator WTF::PassRefPtr<WebCore::GeolocationError>() const;
+    WebGeolocationError(WebCore::GeolocationError*);
+    WebGeolocationError& operator=(WebCore::GeolocationError*);
+    operator WebCore::GeolocationError*() const;
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequest.h b/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequest.h
index 5236f6d2587..38ed97a41e4 100644
--- a/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequest.h
+++ b/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequest.h
@@ -43,20 +43,19 @@ class WebSecurityOrigin;
 // WebGeolocationClient::cancelPermissionRequest (request cancelled).
 class WebGeolocationPermissionRequest {
 public:
+    ~WebGeolocationPermissionRequest() { reset(); }
     BLINK_EXPORT WebSecurityOrigin securityOrigin() const;
     BLINK_EXPORT void setIsAllowed(bool);
 
 #if BLINK_IMPLEMENTATION
-    WebGeolocationPermissionRequest(WebCore::Geolocation* geolocation)
-        : m_private(geolocation)
-    {
-    }
-
-    WebCore::Geolocation* geolocation() const { return m_private; }
+    WebGeolocationPermissionRequest(WebCore::Geolocation*);
+    WebCore::Geolocation* geolocation() const { return m_private.get(); }
 #endif
 
 private:
-    WebCore::Geolocation* m_private;
+    BLINK_EXPORT void reset();
+
+    WebPrivatePtr<WebCore::Geolocation> m_private;
 };
 }
 
diff --git a/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequestManager.h b/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequestManager.h
index eca31d6b04d..23c3edd1444 100644
--- a/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequestManager.h
+++ b/chromium/third_party/WebKit/public/web/WebGeolocationPermissionRequestManager.h
@@ -54,7 +54,6 @@ private:
     BLINK_EXPORT void reset();
 
     WebPrivateOwnPtr<WebGeolocationPermissionRequestManagerPrivate> m_private;
-    int m_lastId;
 };
 
 }
diff --git a/chromium/third_party/WebKit/public/web/WebGeolocationPosition.h b/chromium/third_party/WebKit/public/web/WebGeolocationPosition.h
index 84d13636327..43ad42a6d42 100644
--- a/chromium/third_party/WebKit/public/web/WebGeolocationPosition.h
+++ b/chromium/third_party/WebKit/public/web/WebGeolocationPosition.h
@@ -29,10 +29,6 @@
 #include "../platform/WebCommon.h"
 #include "../platform/WebPrivatePtr.h"
 
-#if BLINK_IMPLEMENTATION
-#include "wtf/PassRefPtr.h"
-#endif
-
 namespace WebCore { class GeolocationPosition; }
 
 namespace blink {
@@ -52,9 +48,9 @@ public:
     BLINK_EXPORT void reset();
 
 #if BLINK_IMPLEMENTATION
-    WebGeolocationPosition(WTF::PassRefPtr<WebCore::GeolocationPosition>);
-    WebGeolocationPosition& operator=(WTF::PassRefPtr<WebCore::GeolocationPosition>);
-    operator WTF::PassRefPtr<WebCore::GeolocationPosition>() const;
+    WebGeolocationPosition(WebCore::GeolocationPosition*);
+    WebGeolocationPosition& operator=(WebCore::GeolocationPosition*);
+    operator WebCore::GeolocationPosition*() const;
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/gtk/WebInputEventFactory.h b/chromium/third_party/WebKit/public/web/WebHeap.h
index aa55faceb91..6f23c21fa6c 100644
--- a/chromium/third_party/WebKit/public/web/gtk/WebInputEventFactory.h
+++ b/chromium/third_party/WebKit/public/web/WebHeap.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,32 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebInputEventFactory_h
-#define WebInputEventFactory_h
+#ifndef WebHeap_h
+#define WebHeap_h
 
-#include "../../platform/WebCommon.h"
-
-typedef struct _GdkEventButton GdkEventButton;
-typedef struct _GdkEventMotion GdkEventMotion;
-typedef struct _GdkEventCrossing GdkEventCrossing;
-typedef struct _GdkEventScroll GdkEventScroll;
-typedef struct _GdkEventKey GdkEventKey;
+#include "public/platform/WebCommon.h"
 
 namespace blink {
 
-class WebKeyboardEvent;
-class WebMouseEvent;
-class WebMouseWheelEvent;
-
-class WebInputEventFactory {
+class WebHeap {
 public:
-    BLINK_EXPORT static WebKeyboardEvent keyboardEvent(const GdkEventKey*);
-    BLINK_EXPORT static WebKeyboardEvent keyboardEvent(wchar_t character, int state, double timeStampSeconds);
-    BLINK_EXPORT static WebMouseEvent mouseEvent(const GdkEventButton*);
-    BLINK_EXPORT static WebMouseEvent mouseEvent(const GdkEventMotion*);
-    BLINK_EXPORT static WebMouseEvent mouseEvent(const GdkEventCrossing*);
-    BLINK_EXPORT static WebMouseWheelEvent mouseWheelEvent(const GdkEventScroll*);
-    BLINK_EXPORT static bool isSystemKeyEvent(const WebKeyboardEvent&);
+    // Attach thread to the garbage collector managed heap. Thread can
+    // allocate or use garbage collector managed objects only while it is
+    // attached.
+    BLINK_EXPORT static void attachThread();
+
+    // Detach thread from the garbage collector managed heap. Thread can
+    // no longer allocate or use garbage collector managed objects.
+    BLINK_EXPORT static void detachThread();
+
+    // While this object is active on the stack current thread is marked as
+    // being at safepoint. It can't manipulate garbage collector managed objects
+    // until it leaves safepoint, but it can block indefinitely.
+    // When thread is not at safe-point it must not block indefinitely because
+    // garbage collector might want to stop it.
+    class SafePointScope {
+    public:
+        BLINK_EXPORT SafePointScope();
+        BLINK_EXPORT ~SafePointScope();
+    };
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebHelperPlugin.h b/chromium/third_party/WebKit/public/web/WebHelperPlugin.h
index cb96a14a8fa..57ec1fd2f1b 100644
--- a/chromium/third_party/WebKit/public/web/WebHelperPlugin.h
+++ b/chromium/third_party/WebKit/public/web/WebHelperPlugin.h
@@ -32,29 +32,43 @@
 #define WebHelperPlugin_h
 
 #include "../platform/WebCommon.h"
-#include "WebWidget.h"
+#include "WebFrame.h"
 
 namespace blink {
 
-class WebFrameClient;
 class WebPlugin;
-class WebWidgetClient;
+class WebString;
 
-class WebHelperPlugin : public WebWidget {
+class WebHelperPlugin {
 public:
-    BLINK_EXPORT static WebHelperPlugin* create(WebWidgetClient*);
+    // May return null if initialization fails. If the returned pointer is
+    // non-null, the caller must free it by calling destroy().
+    BLINK_EXPORT static WebHelperPlugin* create(const WebString& PluginType, WebLocalFrame*);
 
-    virtual void initializeFrame(WebFrameClient*) = 0;
-
-    // The returned pointer may be 0 even if initialization was successful.
-    // For example, if the plugin cannot be found or the plugin is disabled.
-    // If not 0, the returned pointer is valid for the lifetime of this object.
+    // Returns a WebPlugin corresponding to the instantiated plugin. This will
+    // never return null.
     virtual WebPlugin* getPlugin() = 0;
 
+    // Initiates destruction of the WebHelperPlugin.
+    virtual void destroy() = 0;
+
 protected:
-    ~WebHelperPlugin() { }
+    virtual ~WebHelperPlugin() { }
 };
 
 } // namespace blink
 
+namespace WTF {
+
+template<typename T> struct OwnedPtrDeleter;
+template<> struct OwnedPtrDeleter<blink::WebHelperPlugin> {
+    static void deletePtr(blink::WebHelperPlugin* plugin)
+    {
+        if (plugin)
+            plugin->destroy();
+    }
+};
+
+} // namespace WTF
+
 #endif
diff --git a/chromium/third_party/WebKit/public/web/WebHistoryCommitType.h b/chromium/third_party/WebKit/public/web/WebHistoryCommitType.h
new file mode 100644
index 00000000000..d0c7138e55b
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebHistoryCommitType.h
@@ -0,0 +1,29 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebHistoryCommitType_h
+#define WebHistoryCommitType_h
+
+namespace blink {
+
+enum WebHistoryCommitType {
+    // The default case (link clicks, user-typed urls, etc.), appends
+    // a new history entry to the back/forward list.
+    WebStandardCommit,
+    // A load that originated from history, whether from the
+    // back/forward list or session restore. The back/forward list is
+    // not modified, but our position in the list is.
+    WebBackForwardCommit,
+    // Each history entry is represented by a tree, where each node
+    // contains the history state of a single frame in the page. Initial
+    // loads in a new subframe append a new node to that tree.
+    WebInitialCommitInChildFrame,
+    // Reloads, client redirects, etc. Loads that neither originate from
+    // nor add entries to the back/forward list.
+    WebHistoryInertCommit
+};
+
+} // namespace blink
+
+#endif
diff --git a/chromium/third_party/WebKit/public/web/WebHistoryItem.h b/chromium/third_party/WebKit/public/web/WebHistoryItem.h
index a9084030415..a35f6eb8535 100644
--- a/chromium/third_party/WebKit/public/web/WebHistoryItem.h
+++ b/chromium/third_party/WebKit/public/web/WebHistoryItem.h
@@ -33,6 +33,7 @@
 
 #include "../platform/WebCommon.h"
 #include "../platform/WebPrivatePtr.h"
+#include "../platform/WebReferrerPolicy.h"
 
 namespace WebCore { class HistoryItem; }
 
@@ -40,9 +41,15 @@ namespace blink {
 class WebHTTPBody;
 class WebString;
 class WebSerializedScriptValue;
+struct WebFloatPoint;
 struct WebPoint;
 template <typename T> class WebVector;
 
+enum WebHistoryLoadType {
+    WebHistorySameDocumentLoad,
+    WebHistoryDifferentDocumentLoad
+};
+
 // Represents a frame-level navigation entry in session history.  A
 // WebHistoryItem is a node in a tree.
 //
@@ -69,15 +76,16 @@ public:
     BLINK_EXPORT WebString urlString() const;
     BLINK_EXPORT void setURLString(const WebString&);
 
-    BLINK_EXPORT WebString originalURLString() const;
-    BLINK_EXPORT void setOriginalURLString(const WebString&);
-
     BLINK_EXPORT WebString referrer() const;
-    BLINK_EXPORT void setReferrer(const WebString&);
+    BLINK_EXPORT WebReferrerPolicy referrerPolicy() const;
+    BLINK_EXPORT void setReferrer(const WebString&, WebReferrerPolicy);
 
     BLINK_EXPORT WebString target() const;
     BLINK_EXPORT void setTarget(const WebString&);
 
+    BLINK_EXPORT WebFloatPoint pinchViewportScrollOffset() const;
+    BLINK_EXPORT void setPinchViewportScrollOffset(const WebFloatPoint&);
+
     BLINK_EXPORT WebPoint scrollOffset() const;
     BLINK_EXPORT void setScrollOffset(const WebPoint&);
 
@@ -93,9 +101,6 @@ public:
     BLINK_EXPORT long long documentSequenceNumber() const;
     BLINK_EXPORT void setDocumentSequenceNumber(long long);
 
-    BLINK_EXPORT long long targetFrameID() const;
-    BLINK_EXPORT void setTargetFrameID(long long);
-
     BLINK_EXPORT WebSerializedScriptValue stateObject() const;
     BLINK_EXPORT void setStateObject(const WebSerializedScriptValue&);
 
@@ -105,10 +110,6 @@ public:
     BLINK_EXPORT WebHTTPBody httpBody() const;
     BLINK_EXPORT void setHTTPBody(const WebHTTPBody&);
 
-    BLINK_EXPORT WebVector<WebHistoryItem> children() const;
-    BLINK_EXPORT void setChildren(const WebVector<WebHistoryItem>&);
-    BLINK_EXPORT void appendToChildren(const WebHistoryItem&);
-
     BLINK_EXPORT WebVector<WebString> getReferencedFilePaths() const;
 
 #if BLINK_IMPLEMENTATION
@@ -118,7 +119,6 @@ public:
 #endif
 
 private:
-    void ensureMutable();
     WebPrivatePtr<WebCore::HistoryItem> m_private;
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebIconURL.h b/chromium/third_party/WebKit/public/web/WebIconURL.h
index 429c5c36bee..98450d97565 100644
--- a/chromium/third_party/WebKit/public/web/WebIconURL.h
+++ b/chromium/third_party/WebKit/public/web/WebIconURL.h
@@ -34,7 +34,9 @@
 #if BLINK_IMPLEMENTATION
 #include "core/dom/IconURL.h"
 #endif
-#include "../platform/WebURL.h"
+#include "public/platform/WebSize.h"
+#include "public/platform/WebURL.h"
+#include "public/platform/WebVector.h"
 
 namespace blink {
 
@@ -68,10 +70,16 @@ public:
         return m_iconURL;
     }
 
+    const WebVector<WebSize>& sizes() const
+    {
+        return m_sizes;
+    }
+
 #if BLINK_IMPLEMENTATION
     WebIconURL(const WebCore::IconURL& iconURL)
         : m_iconType(static_cast<Type>(iconURL.m_iconType))
         , m_iconURL(iconURL.m_iconURL)
+        , m_sizes(iconURL.m_sizes)
     {
     }
 #endif
@@ -79,6 +87,7 @@ public:
 private:
     Type m_iconType;
     WebURL m_iconURL;
+    WebVector<WebSize> m_sizes;
 };
 
 }
diff --git a/chromium/third_party/WebKit/public/web/WebInputElement.h b/chromium/third_party/WebKit/public/web/WebInputElement.h
index c74de0bdb8e..86cf6f1e145 100644
--- a/chromium/third_party/WebKit/public/web/WebInputElement.h
+++ b/chromium/third_party/WebKit/public/web/WebInputElement.h
@@ -39,17 +39,11 @@ namespace WebCore { class HTMLInputElement; }
 
 namespace blink {
 
-    class WebNodeCollection;
+    class WebElementCollection;
 
     // Provides readonly access to some properties of a DOM input element node.
     class WebInputElement : public WebFormControlElement {
     public:
-        enum SpeechInputState {
-            Idle,
-            Recording,
-            Recognizing,
-        };
-
         WebInputElement() : WebFormControlElement() { }
         WebInputElement(const WebInputElement& element) : WebFormControlElement(element) { }
 
@@ -69,52 +63,33 @@ namespace blink {
         BLINK_EXPORT bool isImageButton() const;
         BLINK_EXPORT bool isRadioButton() const;
         BLINK_EXPORT bool isCheckbox() const;
-        BLINK_EXPORT bool autoComplete() const;
         BLINK_EXPORT int maxLength() const;
-        BLINK_EXPORT bool isActivatedSubmit() const;
         BLINK_EXPORT void setActivatedSubmit(bool);
         BLINK_EXPORT int size() const;
-        BLINK_EXPORT void setValue(const WebString&, bool sendChangeEvent = false);
-        BLINK_EXPORT void setChecked(bool, bool sendChangeEvent = false);
-        BLINK_EXPORT WebString value() const;
-        // This returns the non-sanitized, exact value inside the text field.
-        BLINK_EXPORT WebString editingValue() const;
+        BLINK_EXPORT void setChecked(bool, bool sendEvents = false);
         // Sets the value inside the text field without being sanitized.
         // Can't be used if a renderer doesn't exist or on a non text field type.
         // Caret will be moved to the end.
         BLINK_EXPORT void setEditingValue(const WebString&);
-        BLINK_EXPORT void setSuggestedValue(const WebString&);
-        BLINK_EXPORT WebString suggestedValue() const;
-        BLINK_EXPORT void setSelectionRange(int, int);
-        BLINK_EXPORT int selectionStart() const;
-        BLINK_EXPORT int selectionEnd() const;
         BLINK_EXPORT bool isValidValue(const WebString&) const;
         BLINK_EXPORT bool isChecked() const;
         BLINK_EXPORT bool isMultiple() const;
 
-        BLINK_EXPORT WebNodeCollection dataListOptions() const;
+        BLINK_EXPORT WebElementCollection dataListOptions() const;
 
         // Return the localized value for this input type.
         BLINK_EXPORT WebString localizeValue(const WebString&) const;
 
-        BLINK_EXPORT bool isSpeechInputEnabled() const;
-        BLINK_EXPORT SpeechInputState getSpeechInputState() const;
-        BLINK_EXPORT void startSpeechInput();
-        BLINK_EXPORT void stopSpeechInput();
-
         // Exposes the default value of the maxLength attribute.
         BLINK_EXPORT static int defaultMaxLength();
 
-        // Returns the direction of the text in this element.
-        BLINK_EXPORT WebString directionForFormData() const;
-
-        BLINK_EXPORT WebElement decorationElementFor(void*);
-        BLINK_EXPORT WebElement passwordGeneratorButtonElement() const;
+        // If true, forces the text of the element to be visible.
+        BLINK_EXPORT void setShouldRevealPassword(bool value);
 
 #if BLINK_IMPLEMENTATION
-        WebInputElement(const WTF::PassRefPtr<WebCore::HTMLInputElement>&);
-        WebInputElement& operator=(const WTF::PassRefPtr<WebCore::HTMLInputElement>&);
-        operator WTF::PassRefPtr<WebCore::HTMLInputElement>() const;
+        WebInputElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLInputElement>&);
+        WebInputElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLInputElement>&);
+        operator PassRefPtrWillBeRawPtr<WebCore::HTMLInputElement>() const;
 #endif
     };
 
diff --git a/chromium/third_party/WebKit/public/web/WebInputEvent.h b/chromium/third_party/WebKit/public/web/WebInputEvent.h
index 69687fc27b0..58c4a0bb39e 100644
--- a/chromium/third_party/WebKit/public/web/WebInputEvent.h
+++ b/chromium/third_party/WebKit/public/web/WebInputEvent.h
@@ -32,6 +32,7 @@
 #define WebInputEvent_h
 
 #include "../platform/WebCommon.h"
+#include "../platform/WebGestureDevice.h"
 #include "../platform/WebRect.h"
 #include "WebTouchPoint.h"
 
@@ -58,15 +59,6 @@ namespace blink {
 
 class WebInputEvent {
 public:
-    WebInputEvent(unsigned sizeParam = sizeof(WebInputEvent))
-    {
-        memset(this, 0, sizeParam);
-        timeStampSeconds = 0.0;
-        size = sizeParam;
-        type = Undefined;
-        modifiers = 0;
-    }
-
     // When we use an input method (or an input method editor), we receive
     // two events for a keypress. The former event is a keydown, which
     // provides a keycode, and the latter is a textinput, which provides
@@ -93,26 +85,32 @@ public:
 
     enum Type {
         Undefined = -1,
+        TypeFirst = Undefined,
 
         // WebMouseEvent
         MouseDown,
+        MouseTypeFirst = MouseDown,
         MouseUp,
         MouseMove,
         MouseEnter,
         MouseLeave,
         ContextMenu,
+        MouseTypeLast = ContextMenu,
 
         // WebMouseWheelEvent
         MouseWheel,
 
         // WebKeyboardEvent
         RawKeyDown,
+        KeyboardTypeFirst = RawKeyDown,
         KeyDown,
         KeyUp,
         Char,
+        KeyboardTypeLast = Char,
 
         // WebGestureEvent
         GestureScrollBegin,
+        GestureTypeFirst = GestureScrollBegin,
         GestureScrollEnd,
         GestureScrollUpdate,
         GestureScrollUpdateWithoutPropagation,
@@ -130,12 +128,17 @@ public:
         GesturePinchBegin,
         GesturePinchEnd,
         GesturePinchUpdate,
+        GestureTypeLast = GesturePinchUpdate,
 
         // WebTouchEvent
         TouchStart,
+        TouchTypeFirst = TouchStart,
         TouchMove,
         TouchEnd,
         TouchCancel,
+        TouchTypeLast = TouchCancel,
+
+        TypeLast = TouchTypeLast
     };
 
     enum Modifiers {
@@ -183,63 +186,35 @@ public:
     // Returns true if the WebInputEvent |type| is a mouse event.
     static bool isMouseEventType(int type)
     {
-        return type == MouseDown
-            || type == MouseUp
-            || type == MouseMove
-            || type == MouseEnter
-            || type == MouseLeave
-            || type == ContextMenu;
+        return MouseTypeFirst <= type && type <= MouseTypeLast;
     }
 
     // Returns true if the WebInputEvent |type| is a keyboard event.
     static bool isKeyboardEventType(int type)
     {
-        return type == RawKeyDown
-            || type == KeyDown
-            || type == KeyUp
-            || type == Char;
+        return KeyboardTypeFirst <= type && type <= KeyboardTypeLast;
     }
 
     // Returns true if the WebInputEvent |type| is a touch event.
     static bool isTouchEventType(int type)
     {
-        return type == TouchStart
-            || type == TouchMove
-            || type == TouchEnd
-            || type == TouchCancel;
+        return TouchTypeFirst <= type && type <= TouchTypeLast;
     }
 
-    // Returns true if the WebInputEvent |type| should be handled as user gesture.
-    static bool isUserGestureEventType(int type)
+    // Returns true if the WebInputEvent is a gesture event.
+    static bool isGestureEventType(int type)
     {
-        return isKeyboardEventType(type)
-            || type == MouseDown
-            || type == MouseUp
-            || type == TouchStart
-            || type == TouchEnd;
+        return GestureTypeFirst <= type && type <= GestureTypeLast;
     }
 
-    // Returns true if the WebInputEvent is a gesture event.
-    static bool isGestureEventType(int type)
+protected:
+    explicit WebInputEvent(unsigned sizeParam)
     {
-        return type == GestureScrollBegin
-            || type == GestureScrollEnd
-            || type == GestureScrollUpdate
-            || type == GestureScrollUpdateWithoutPropagation
-            || type == GestureFlingStart
-            || type == GestureFlingCancel
-            || type == GesturePinchBegin
-            || type == GesturePinchEnd
-            || type == GesturePinchUpdate
-            || type == GestureTap
-            || type == GestureTapUnconfirmed
-            || type == GestureTapDown
-            || type == GestureTapCancel
-            || type == GestureShowPress
-            || type == GestureDoubleTap
-            || type == GestureTwoFingerTap
-            || type == GestureLongPress
-            || type == GestureLongTap;
+        memset(this, 0, sizeParam);
+        timeStampSeconds = 0.0;
+        size = sizeParam;
+        type = Undefined;
+        modifiers = 0;
     }
 };
 
@@ -291,8 +266,8 @@ public:
     // This is a string identifying the key pressed.
     char keyIdentifier[keyIdentifierLengthCap];
 
-    WebKeyboardEvent(unsigned sizeParam = sizeof(WebKeyboardEvent))
-        : WebInputEvent(sizeParam)
+    WebKeyboardEvent()
+        : WebInputEvent(sizeof(WebKeyboardEvent))
         , windowsKeyCode(0)
         , nativeKeyCode(0)
         , isSystemKey(false)
@@ -314,7 +289,6 @@ public:
 
 class WebMouseEvent : public WebInputEvent {
 public:
-    // These values defined for WebCore::MouseButton
     enum Button {
         ButtonNone = -1,
         ButtonLeft,
@@ -333,7 +307,23 @@ public:
     int movementY;
     int clickCount;
 
-    WebMouseEvent(unsigned sizeParam = sizeof(WebMouseEvent))
+    WebMouseEvent()
+        : WebInputEvent(sizeof(WebMouseEvent))
+        , button(ButtonNone)
+        , x(0)
+        , y(0)
+        , windowX(0)
+        , windowY(0)
+        , globalX(0)
+        , globalY(0)
+        , movementX(0)
+        , movementY(0)
+        , clickCount(0)
+    {
+    }
+
+protected:
+    explicit WebMouseEvent(unsigned sizeParam)
         : WebInputEvent(sizeParam)
         , button(ButtonNone)
         , x(0)
@@ -379,8 +369,26 @@ public:
     Phase phase;
     Phase momentumPhase;
 
-    WebMouseWheelEvent(unsigned sizeParam = sizeof(WebMouseWheelEvent))
-        : WebMouseEvent(sizeParam)
+    // See comment at the top of the file for why an int is used here.
+    // Rubberbanding is an OSX visual effect. When a user scrolls the content
+    // area with a track pad, and the content area is already at its limit in
+    // the direction being scrolled, the entire content area is allowed to
+    // scroll slightly off screen, revealing a grey background. When the user
+    // lets go, the content area snaps back into place. Blink is responsible
+    // for this rubberbanding effect, but the embedder may wish to disable
+    // rubber banding in the left or right direction, if the scroll should have
+    // an alternate effect. The common case is that a scroll in the left or
+    // right directions causes a back or forwards navigation, respectively.
+    //
+    // These flags prevent rubber banding from starting in a given direction,
+    // but have no effect on an ongoing rubber banding. A rubber banding that
+    // started in the vertical direction is allowed to continue in the right
+    // direction, even if canRubberbandRight is 0.
+    int canRubberbandLeft;
+    int canRubberbandRight;
+
+    WebMouseWheelEvent()
+        : WebMouseEvent(sizeof(WebMouseWheelEvent))
         , deltaX(0.0f)
         , deltaY(0.0f)
         , wheelTicksX(0.0f)
@@ -391,6 +399,8 @@ public:
         , hasPreciseScrollingDeltas(false)
         , phase(PhaseNone)
         , momentumPhase(PhaseNone)
+        , canRubberbandLeft(true)
+        , canRubberbandRight(true)
     {
     }
 };
@@ -399,18 +409,15 @@ public:
 
 class WebGestureEvent : public WebInputEvent {
 public:
-    enum SourceDevice {
-        Touchpad,
-        Touchscreen,
-    };
-
     int x;
     int y;
     int globalX;
     int globalY;
-    SourceDevice sourceDevice;
+    WebGestureDevice sourceDevice;
 
     union {
+        // Tap information must be set for GestureTap, GestureTapUnconfirmed,
+        // and GestureDoubleTap events.
         struct {
             int tapCount;
             float width;
@@ -438,6 +445,13 @@ public:
         } twoFingerTap;
 
         struct {
+            // Initial motion that triggered the scroll.
+            // May be redundant with deltaX/deltaY in the first scrollUpdate.
+            float deltaXHint;
+            float deltaYHint;
+        } scrollBegin;
+
+        struct {
             float deltaX;
             float deltaY;
             float velocityX;
@@ -454,8 +468,8 @@ public:
         } pinchUpdate;
     } data;
 
-    WebGestureEvent(unsigned sizeParam = sizeof(WebGestureEvent))
-        : WebInputEvent(sizeParam)
+    WebGestureEvent()
+        : WebInputEvent(sizeof(WebGestureEvent))
         , x(0)
         , y(0)
         , globalX(0)
@@ -485,11 +499,17 @@ public:
     // List of all touches which are currently down and are targeting the event recipient.
     WebTouchPoint targetTouches[touchesLengthCap];
 
-    WebTouchEvent(unsigned sizeParam = sizeof(WebTouchEvent))
-        : WebInputEvent(sizeParam)
+    // Whether the event can be canceled (with preventDefault). If true then the browser
+    // must wait for an ACK for this event. If false then no ACK IPC is expected.
+    // See comment at the top for why an int is used here instead of a bool.
+    int cancelable;
+
+    WebTouchEvent()
+        : WebInputEvent(sizeof(WebTouchEvent))
         , touchesLength(0)
         , changedTouchesLength(0)
         , targetTouchesLength(0)
+        , cancelable(true)
     {
     }
 };
diff --git a/chromium/third_party/WebKit/public/web/WebKit.h b/chromium/third_party/WebKit/public/web/WebKit.h
index 6b4382f46ed..fedf1ff6170 100644
--- a/chromium/third_party/WebKit/public/web/WebKit.h
+++ b/chromium/third_party/WebKit/public/web/WebKit.h
@@ -74,6 +74,10 @@ BLINK_EXPORT void shutdownWithoutV8();
 BLINK_EXPORT void setLayoutTestMode(bool);
 BLINK_EXPORT bool layoutTestMode();
 
+// Alters the rendering of fonts for layout tests.
+BLINK_EXPORT void setFontAntialiasingEnabledForTest(bool);
+BLINK_EXPORT bool fontAntialiasingEnabledForTest();
+
 // Enables the named log channel. See WebCore/platform/Logging.h for details.
 BLINK_EXPORT void enableLogChannel(const char*);
 
diff --git a/chromium/third_party/WebKit/public/web/WebLabelElement.h b/chromium/third_party/WebKit/public/web/WebLabelElement.h
index f1ed8516123..8efa52d6387 100644
--- a/chromium/third_party/WebKit/public/web/WebLabelElement.h
+++ b/chromium/third_party/WebKit/public/web/WebLabelElement.h
@@ -57,9 +57,9 @@ public:
     BLINK_EXPORT WebElement correspondingControl();
 
 #if BLINK_IMPLEMENTATION
-    WebLabelElement(const WTF::PassRefPtr<WebCore::HTMLLabelElement>&);
-    WebLabelElement& operator=(const WTF::PassRefPtr<WebCore::HTMLLabelElement>&);
-    operator WTF::PassRefPtr<WebCore::HTMLLabelElement>() const;
+    WebLabelElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLLabelElement>&);
+    WebLabelElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLLabelElement>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::HTMLLabelElement>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebLeakDetector.h b/chromium/third_party/WebKit/public/web/WebLeakDetector.h
new file mode 100644
index 00000000000..187b86c9a11
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebLeakDetector.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2014 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebLeakDetector_h
+#define WebLeakDetector_h
+
+#include "WebFrame.h"
+#include "public/platform/WebCommon.h"
+
+namespace blink {
+
+class WebLeakDetectorClient {
+public:
+    struct Result {
+        unsigned numberOfLiveNodes;
+        unsigned numberOfLiveDocuments;
+    };
+
+    virtual void onLeakDetectionComplete(const Result&) = 0;
+};
+
+class WebLeakDetector {
+public:
+    virtual ~WebLeakDetector() { }
+
+    BLINK_EXPORT static WebLeakDetector* create(WebLeakDetectorClient*);
+
+    // Cleans up the DOM objects and counts them. |WebLeakDetectorClient::onLeakDetectionComplete()| is called when done.
+    // This is supposed to be used for detecting DOM-object leaks.
+    virtual void collectGarbageAndGetDOMCounts(WebLocalFrame*) = 0;
+
+    // FIXME: old API to be removed.
+    static void collectGarbargeAndGetDOMCounts(WebLocalFrame*, unsigned*, unsigned*) { }
+};
+
+} // namespace blink
+
+#endif // WebLeakDetector_h
diff --git a/chromium/third_party/WebKit/public/web/WebLocalFrame.h b/chromium/third_party/WebKit/public/web/WebLocalFrame.h
new file mode 100644
index 00000000000..333748b65d2
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebLocalFrame.h
@@ -0,0 +1,41 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebLocalFrame_h
+#define WebLocalFrame_h
+
+#include "WebFrame.h"
+
+namespace blink {
+
+// Interface for interacting with in process frames. This contains methods that
+// require interacting with a frame's document.
+// FIXME: Move lots of methods from WebFrame in here.
+class WebLocalFrame : public WebFrame {
+public:
+    // Creates a WebFrame. Delete this WebFrame by calling WebFrame::close().
+    // It is valid to pass a null client pointer.
+    BLINK_EXPORT static WebLocalFrame* create(WebFrameClient*);
+
+    // Returns the WebFrame associated with the current V8 context. This
+    // function can return 0 if the context is associated with a Document that
+    // is not currently being displayed in a Frame.
+    BLINK_EXPORT static WebLocalFrame* frameForCurrentContext();
+
+    // Returns the frame corresponding to the given context. This can return 0
+    // if the context is detached from the frame, or if the context doesn't
+    // correspond to a frame (e.g., workers).
+    BLINK_EXPORT static WebLocalFrame* frameForContext(v8::Handle<v8::Context>);
+
+    // Returns the frame inside a given frame or iframe element. Returns 0 if
+    // the given element is not a frame, iframe or if the frame is empty.
+    BLINK_EXPORT static WebLocalFrame* fromFrameOwnerElement(const WebElement&);
+
+    // Navigation Transitions  ---------------------------------------------
+    virtual void addStyleSheetByURL(const WebString& url) = 0;
+};
+
+} // namespace blink
+
+#endif // WebLocalFrame_h
diff --git a/chromium/third_party/WebKit/public/web/WebMIDIClient.h b/chromium/third_party/WebKit/public/web/WebMIDIClient.h
index 9435b938b2d..157c6be9db8 100644
--- a/chromium/third_party/WebKit/public/web/WebMIDIClient.h
+++ b/chromium/third_party/WebKit/public/web/WebMIDIClient.h
@@ -38,10 +38,17 @@ class WebMIDIClient {
 public:
     virtual ~WebMIDIClient() { }
 
-    // Request a permission to use system exclusive messages. Called when MIDIOptions.sysex is true.
-    virtual void requestSysExPermission(const WebMIDIPermissionRequest&) = 0;
-    // Cancel the request since the requesting frame may be moving to a new page.
-    virtual void cancelSysExPermissionRequest(const WebMIDIPermissionRequest&) = 0;
+    // Request a permission to use system exclusive messages. Called when
+    // MIDIOptions.sysex is true.
+    // Once the request is done, any WebMIDIPermissionRequest instances equal to
+    // |request| must not be accessed after that.
+    virtual void requestSysexPermission(const WebMIDIPermissionRequest& /* request */) = 0;
+
+    // Cancel the request since the requesting frame may be moving to
+    // a new page.
+    // Once canceled, any WebMIDIPermissionRequest instances equal to
+    // |request| must not be accessed after that.
+    virtual void cancelSysexPermissionRequest(const WebMIDIPermissionRequest& /* request */) = 0;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebMIDIClientMock.h b/chromium/third_party/WebKit/public/web/WebMIDIClientMock.h
index 95ba401fa2c..0ed583386a8 100644
--- a/chromium/third_party/WebKit/public/web/WebMIDIClientMock.h
+++ b/chromium/third_party/WebKit/public/web/WebMIDIClientMock.h
@@ -46,12 +46,12 @@ public:
     BLINK_EXPORT WebMIDIClientMock();
     virtual ~WebMIDIClientMock() { reset(); }
 
-    BLINK_EXPORT void setSysExPermission(bool);
+    BLINK_EXPORT void setSysexPermission(bool);
     BLINK_EXPORT void resetMock();
 
     // WebMIDIClient
-    virtual void requestSysExPermission(const WebMIDIPermissionRequest&) OVERRIDE;
-    virtual void cancelSysExPermissionRequest(const WebMIDIPermissionRequest&) OVERRIDE;
+    virtual void requestSysexPermission(const WebMIDIPermissionRequest&) OVERRIDE;
+    virtual void cancelSysexPermissionRequest(const WebMIDIPermissionRequest&) OVERRIDE;
 
 private:
     BLINK_EXPORT void reset();
diff --git a/chromium/third_party/WebKit/public/web/WebMIDIPermissionRequest.h b/chromium/third_party/WebKit/public/web/WebMIDIPermissionRequest.h
index fde2901c836..b863fe35eb5 100644
--- a/chromium/third_party/WebKit/public/web/WebMIDIPermissionRequest.h
+++ b/chromium/third_party/WebKit/public/web/WebMIDIPermissionRequest.h
@@ -32,42 +32,37 @@
 #define WebMIDIPermissionRequest_h
 
 #include "../platform/WebCommon.h"
-#include "../platform/WebPrivatePtr.h"
 
 namespace WebCore {
-class MIDIAccess;
+class MIDIAccessInitializer;
 }
 
 namespace blink {
 
 class WebSecurityOrigin;
 
-// WebMIDIPermissionRequest encapsulates a WebCore MIDIAccess object and represents
-// a request from WebCore for permissions.
-// The underlying MIDIAccess object is guaranteed to be valid until the invocation of
-// either WebMIDIPermissionRequest::setIsAllowed (request complete) or
-// WebMIDIClient::cancelPermissionRequest (request canceled).
+// WebMIDIPermissionRequest encapsulates a WebCore MIDIAccessInitializer
+// object and represents a request from WebCore for permissions.
+// The request must not outlive the underlying initializer object.
+// In other words, the request must be canceled when the underlying
+// initializer dies while requesting,
 class WebMIDIPermissionRequest {
 public:
-    WebMIDIPermissionRequest(const WebMIDIPermissionRequest& o) { assign(o); }
-    ~WebMIDIPermissionRequest() { reset(); };
-
+    BLINK_EXPORT WebMIDIPermissionRequest(const WebMIDIPermissionRequest& other)
+        : m_initializer(other.m_initializer) { }
     BLINK_EXPORT WebSecurityOrigin securityOrigin() const;
     BLINK_EXPORT void setIsAllowed(bool);
 
-    BLINK_EXPORT void reset();
-    BLINK_EXPORT void assign(const WebMIDIPermissionRequest&);
     BLINK_EXPORT bool equals(const WebMIDIPermissionRequest&) const;
 
 #if BLINK_IMPLEMENTATION
-    explicit WebMIDIPermissionRequest(const PassRefPtr<WebCore::MIDIAccess>&);
-    explicit WebMIDIPermissionRequest(WebCore::MIDIAccess*);
+    explicit WebMIDIPermissionRequest(WebCore::MIDIAccessInitializer*);
 
-    WebCore::MIDIAccess* midiAccess() const { return m_private.get(); }
+    WebCore::MIDIAccessInitializer* midiAccessInitializer() const { return m_initializer; }
 #endif
 
 private:
-    WebPrivatePtr<WebCore::MIDIAccess> m_private;
+    WebCore::MIDIAccessInitializer* m_initializer;
 };
 
 inline bool operator==(const WebMIDIPermissionRequest& a, const WebMIDIPermissionRequest& b)
diff --git a/chromium/third_party/WebKit/public/web/WebMediaDevicesRequest.h b/chromium/third_party/WebKit/public/web/WebMediaDevicesRequest.h
new file mode 100644
index 00000000000..268df831f26
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebMediaDevicesRequest.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2014 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaDevicesRequest_h
+#define WebMediaDevicesRequest_h
+
+#include "WebSecurityOrigin.h"
+#include "public/platform/WebCommon.h"
+#include "public/platform/WebPrivatePtr.h"
+#include "public/platform/WebString.h"
+
+namespace WebCore {
+class MediaDevicesRequest;
+}
+
+namespace blink {
+class WebDocument;
+class WebMediaDeviceInfo;
+template <typename T> class WebVector;
+
+class WebMediaDevicesRequest {
+public:
+    WebMediaDevicesRequest() { }
+    WebMediaDevicesRequest(const WebMediaDevicesRequest& request) { assign(request); }
+    ~WebMediaDevicesRequest() { reset(); }
+
+    WebMediaDevicesRequest& operator=(const WebMediaDevicesRequest& other)
+    {
+        assign(other);
+        return *this;
+    }
+
+    BLINK_EXPORT void reset();
+    bool isNull() const { return m_private.isNull(); }
+    BLINK_EXPORT bool equals(const WebMediaDevicesRequest&) const;
+    BLINK_EXPORT void assign(const WebMediaDevicesRequest&);
+
+    BLINK_EXPORT WebSecurityOrigin securityOrigin() const;
+    BLINK_EXPORT WebDocument ownerDocument() const;
+
+    BLINK_EXPORT void requestSucceeded(WebVector<WebMediaDeviceInfo>);
+
+#if BLINK_IMPLEMENTATION
+    WebMediaDevicesRequest(const PassRefPtrWillBeRawPtr<WebCore::MediaDevicesRequest>&);
+    WebMediaDevicesRequest(WebCore::MediaDevicesRequest*);
+    operator WebCore::MediaDevicesRequest*() const;
+#endif
+
+private:
+    WebPrivatePtr<WebCore::MediaDevicesRequest> m_private;
+};
+
+inline bool operator==(const WebMediaDevicesRequest& a, const WebMediaDevicesRequest& b)
+{
+    return a.equals(b);
+}
+
+} // namespace blink
+
+#endif // WebMediaDevicesRequest_h
diff --git a/chromium/third_party/WebKit/public/web/WebMediaPlayerAction.h b/chromium/third_party/WebKit/public/web/WebMediaPlayerAction.h
index 7a3d591b557..4add3cee0c8 100644
--- a/chromium/third_party/WebKit/public/web/WebMediaPlayerAction.h
+++ b/chromium/third_party/WebKit/public/web/WebMediaPlayerAction.h
@@ -39,7 +39,8 @@ struct WebMediaPlayerAction {
         Play,
         Mute,
         Loop,
-        Controls
+        Controls,
+        TypeLast = Controls
     };
 
     Type type;
diff --git a/chromium/third_party/WebKit/public/web/WebNavigationPolicy.h b/chromium/third_party/WebKit/public/web/WebNavigationPolicy.h
index 36be0db8c55..a7255b1df1a 100644
--- a/chromium/third_party/WebKit/public/web/WebNavigationPolicy.h
+++ b/chromium/third_party/WebKit/public/web/WebNavigationPolicy.h
@@ -36,6 +36,7 @@ namespace blink {
 enum WebNavigationPolicy {
     WebNavigationPolicyIgnore,
     WebNavigationPolicyDownload,
+    WebNavigationPolicyDownloadTo,
     WebNavigationPolicyCurrentTab,
     WebNavigationPolicyNewBackgroundTab,
     WebNavigationPolicyNewForegroundTab,
diff --git a/chromium/third_party/WebKit/public/web/WebFontCache.h b/chromium/third_party/WebKit/public/web/WebNavigatorContentUtilsClient.h
index 9d8df81c158..17350bb46d5 100644
--- a/chromium/third_party/WebKit/public/web/WebFontCache.h
+++ b/chromium/third_party/WebKit/public/web/WebNavigatorContentUtilsClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2014, Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,23 +28,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebFontCache_h
-#define WebFontCache_h
-
-#include "../platform/WebCommon.h"
+#ifndef WebNavigatorContentUtilsClient_h
+#define WebNavigatorContentUtilsClient_h
 
 namespace blink {
 
-// An interface to query and configure WebKit's font cache.
-class WebFontCache {
-public:
-    // Clears the cache.
-    BLINK_EXPORT static void clear();
-
-private:
-    WebFontCache();  // Not intended to be instanced.
+// The following enum should be consistent with the CustomHandlersState enum
+// defined in WebCore.
+enum WebCustomHandlersState {
+    WebCustomHandlersNew,
+    WebCustomHandlersRegistered,
+    WebCustomHandlersDeclined
 };
 
-}  // namespace blink
+} // namespace blink
 
 #endif
diff --git a/chromium/third_party/WebKit/public/web/WebNetworkStateNotifier.h b/chromium/third_party/WebKit/public/web/WebNetworkStateNotifier.h
index 5b2ec92fc71..c8d64d5be9d 100644
--- a/chromium/third_party/WebKit/public/web/WebNetworkStateNotifier.h
+++ b/chromium/third_party/WebKit/public/web/WebNetworkStateNotifier.h
@@ -32,12 +32,14 @@
 #define WebNetworkStateNotifier_h
 
 #include "../platform/WebCommon.h"
+#include "../platform/WebConnectionType.h"
 
 namespace blink {
 
 class WebNetworkStateNotifier {
 public:
     BLINK_EXPORT static void setOnLine(bool);
+    BLINK_EXPORT static void setWebConnectionType(WebConnectionType);
 
 private:
     WebNetworkStateNotifier();
diff --git a/chromium/third_party/WebKit/public/web/WebNode.h b/chromium/third_party/WebKit/public/web/WebNode.h
index 4afdbcb07b3..ba967ff7602 100644
--- a/chromium/third_party/WebKit/public/web/WebNode.h
+++ b/chromium/third_party/WebKit/public/web/WebNode.h
@@ -44,7 +44,7 @@ class WebDOMEventListener;
 class WebDOMEventListenerPrivate;
 class WebDocument;
 class WebElement;
-class WebFrame;
+class WebElementCollection;
 class WebNodeList;
 class WebPluginContainer;
 
@@ -80,15 +80,15 @@ public:
         AttributeNode = 2,
         TextNode = 3,
         CDataSectionNode = 4,
-        // EntityReferenceNodes are deprecated and impossible to create in WebKit.
-        EntityNode = 6,
+        // EntityReferenceNodes are impossible to create in Blink.
+        // EntityNodes are impossible to create in Blink.
         ProcessingInstructionsNode = 7,
         CommentNode = 8,
         DocumentNode = 9,
         DocumentTypeNode = 10,
         DocumentFragmentNode = 11,
-        NotationNode = 12,
-        XPathNamespaceNode = 13,
+        // NotationNodes are impossible to create in Blink.
+        // XPathNamespaceNodes are impossible to create in Blink.
         ShadowRootNode = 14
     };
 
@@ -113,7 +113,7 @@ public:
     BLINK_EXPORT void addEventListener(const WebString& eventType, WebDOMEventListener* listener, bool useCapture);
     BLINK_EXPORT bool dispatchEvent(const WebDOMEvent&);
     BLINK_EXPORT void simulateClick();
-    BLINK_EXPORT WebNodeList getElementsByTagName(const WebString&) const;
+    BLINK_EXPORT WebElementCollection getElementsByTagName(const WebString&) const;
     BLINK_EXPORT WebElement querySelector(const WebString&, WebExceptionCode&) const;
     BLINK_EXPORT WebElement rootEditableElement() const;
     BLINK_EXPORT bool focused() const;
@@ -141,9 +141,21 @@ public:
     }
 
 #if BLINK_IMPLEMENTATION
-    WebNode(const WTF::PassRefPtr<WebCore::Node>&);
-    WebNode& operator=(const WTF::PassRefPtr<WebCore::Node>&);
-    operator WTF::PassRefPtr<WebCore::Node>() const;
+    WebNode(const PassRefPtrWillBeRawPtr<WebCore::Node>&);
+    WebNode& operator=(const PassRefPtrWillBeRawPtr<WebCore::Node>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::Node>() const;
+#if ENABLE(OILPAN)
+    // This constructor enables creation of WebNodes from Members
+    // holding WebCore::Node-derived objects (this shows up in WebVector
+    // assignments, for instance.) It is needed because a RawPtr<T> constructor
+    // from a Member<U> isn't provided, hence the above constructor
+    // won't be usable.
+    template<typename U>
+    WebNode(const WebCore::Member<U>& other, EnsurePtrConvertibleArgDecl(U, WebCore::Node))
+        : m_private(other.get())
+    {
+    }
+#endif
 #endif
 
 #if BLINK_IMPLEMENTATION
diff --git a/chromium/third_party/WebKit/public/web/WebNodeList.h b/chromium/third_party/WebKit/public/web/WebNodeList.h
index 80484366318..96ad0addb09 100644
--- a/chromium/third_party/WebKit/public/web/WebNodeList.h
+++ b/chromium/third_party/WebKit/public/web/WebNodeList.h
@@ -31,10 +31,12 @@
 #ifndef WebNodeList_h
 #define WebNodeList_h
 
-#include "../platform/WebCommon.h"
+#include "public/platform/WebCommon.h"
+#include "public/platform/WebPrivatePtr.h"
 
 namespace WebCore { class NodeList; }
 #if BLINK_IMPLEMENTATION
+#include "platform/heap/Handle.h"
 namespace WTF { template <typename T> class PassRefPtr; }
 #endif
 
@@ -46,8 +48,8 @@ class WebNodeList {
 public:
     ~WebNodeList() { reset(); }
 
-    WebNodeList() : m_private(0) { }
-    WebNodeList(const WebNodeList& n) : m_private(0) { assign(n); }
+    WebNodeList() { }
+    WebNodeList(const WebNodeList& n) { assign(n); }
     WebNodeList& operator=(const WebNodeList& n)
     {
         assign(n);
@@ -61,12 +63,12 @@ public:
     BLINK_EXPORT WebNode item(size_t) const;
 
 #if BLINK_IMPLEMENTATION
-    WebNodeList(const WTF::PassRefPtr<WebCore::NodeList>&);
+    WebNodeList(const PassRefPtrWillBeRawPtr<WebCore::NodeList>&);
+    WebNodeList& operator=(const PassRefPtrWillBeRawPtr<WebCore::NodeList>&);
 #endif
 
 private:
-    void assign(WebCore::NodeList*);
-    WebCore::NodeList* m_private;
+    WebPrivatePtr<WebCore::NodeList> m_private;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebNotification.h b/chromium/third_party/WebKit/public/web/WebNotification.h
index 7194602f5c9..1b9587a7cd2 100644
--- a/chromium/third_party/WebKit/public/web/WebNotification.h
+++ b/chromium/third_party/WebKit/public/web/WebNotification.h
@@ -32,80 +32,73 @@
 #define WebNotification_h
 
 #include "../platform/WebCommon.h"
+#include "../platform/WebPrivatePtr.h"
+#include "../platform/WebString.h"
 #include "WebTextDirection.h"
 
+namespace WebCore { class Notification; }
+
 #if BLINK_IMPLEMENTATION
-namespace WebCore { class NotificationBase; }
 namespace WTF { template <typename T> class PassRefPtr; }
 #endif
 
-namespace WTF {
-class AtomicString;
-}
-
 namespace blink {
 
-class WebNotificationPrivate;
 class WebURL;
-class WebString;
 
 // Represents access to a desktop notification.
 class WebNotification {
 public:
-    WebNotification() : m_private(0) { }
-    WebNotification(const WebNotification& other) : m_private(0) { assign(other); }
-
-    ~WebNotification() { reset(); }
-
-    BLINK_EXPORT void reset();
-    BLINK_EXPORT void assign(const WebNotification&);
-
+    WebNotification() { }
+    WebNotification(const WebNotification& other) { assign(other); }
     WebNotification& operator=(const WebNotification& other)
     {
         assign(other);
         return *this;
     }
 
-    // Operators required to put WebNotification in an ordered map.
-    bool equals(const WebNotification& other) const { return m_private == other.m_private; }
-    BLINK_EXPORT bool lessThan(const WebNotification& other) const;
+    ~WebNotification() { reset(); }
 
-    // DEPRECATED: Always returns false.
-    BLINK_EXPORT bool isHTML() const;
+    BLINK_EXPORT void reset();
+    BLINK_EXPORT void assign(const WebNotification&);
 
-    // DEPRECATED: Always returns an invalid URL.
-    BLINK_EXPORT WebURL url() const;
+    // Operators required to put WebNotification in an std::map. Mind that the
+    // order of the notifications in an ordered map will be arbitrary.
+    BLINK_EXPORT bool equals(const WebNotification& other) const;
+    BLINK_EXPORT bool lessThan(const WebNotification& other) const;
 
-    BLINK_EXPORT WebURL iconURL() const;
     BLINK_EXPORT WebString title() const;
-    BLINK_EXPORT WebString body() const;
-    BLINK_EXPORT WebTextDirection direction() const;
 
-    BLINK_EXPORT WebString replaceId() const;
+    BLINK_EXPORT WebTextDirection direction() const;
+    BLINK_EXPORT WebString lang() const;
+    BLINK_EXPORT WebString body() const;
+    BLINK_EXPORT WebString tag() const;
+    BLINK_EXPORT WebURL iconURL() const;
 
     // Called to indicate the notification has been displayed.
-    BLINK_EXPORT void dispatchDisplayEvent();
+    BLINK_EXPORT void dispatchShowEvent();
 
     // Called to indicate an error has occurred with this notification.
     BLINK_EXPORT void dispatchErrorEvent(const WebString& errorMessage);
 
-    // Called to indicate the notification has been closed.  If it was
-    // closed by the user (as opposed to automatically by the system),
-    // the byUser parameter will be true.
+    // Called to indicate the notification has been closed. |byUser| indicates
+    // whether it was closed by the user instead of automatically by the system.
     BLINK_EXPORT void dispatchCloseEvent(bool byUser);
 
     // Called to indicate the notification was clicked on.
     BLINK_EXPORT void dispatchClickEvent();
 
+    // FIXME: Remove these methods once Chromium switched to the new APIs.
+    WebString replaceId() const { return tag(); }
+    void dispatchDisplayEvent() { dispatchShowEvent(); }
+
 #if BLINK_IMPLEMENTATION
-    WebNotification(const WTF::PassRefPtr<WebCore::NotificationBase>&);
-    WebNotification& operator=(const WTF::PassRefPtr<WebCore::NotificationBase>&);
-    operator WTF::PassRefPtr<WebCore::NotificationBase>() const;
+    WebNotification(WebCore::Notification*);
+    WebNotification& operator=(WebCore::Notification*);
 #endif
 
 private:
-    void assign(WebNotificationPrivate*);
-    WebNotificationPrivate* m_private;
+    WebPrivatePtr<WebCore::Notification> m_private;
 };
 
 inline bool operator==(const WebNotification& a, const WebNotification& b)
diff --git a/chromium/third_party/WebKit/public/web/WebNotificationPresenter.h b/chromium/third_party/WebKit/public/web/WebNotificationPresenter.h
index 4249d04341b..9277a165478 100644
--- a/chromium/third_party/WebKit/public/web/WebNotificationPresenter.h
+++ b/chromium/third_party/WebKit/public/web/WebNotificationPresenter.h
@@ -32,13 +32,13 @@
 #define WebNotificationPresenter_h
 
 #include "../platform/WebString.h"
-#include "WebNotificationPermissionCallback.h"
-#include "WebSecurityOrigin.h"
 
 namespace blink {
 
 class WebDocument;
 class WebNotification;
+class WebNotificationPermissionCallback;
+class WebSecurityOrigin;
 
 // Provides the services to show desktop notifications to the user.
 class WebNotificationPresenter {
@@ -52,7 +52,9 @@ public:
     // Shows a notification.
     virtual bool show(const WebNotification&) = 0;
 
-    // Cancels a notification previously shown, and removes it if being shown.
+    // Closes a notification previously shown, and removes it if being shown.
+    // FIXME: Remove cancel() once Chromium updated to the new name, and make close() pure virtual.
+    virtual void close(const WebNotification&) { }
     virtual void cancel(const WebNotification&) = 0;
 
     // Indiciates that the notification object subscribed to events for a previously shown notification is
diff --git a/chromium/third_party/WebKit/public/web/WebOptionElement.h b/chromium/third_party/WebKit/public/web/WebOptionElement.h
index 6c941e40514..ec3bf76ff42 100644
--- a/chromium/third_party/WebKit/public/web/WebOptionElement.h
+++ b/chromium/third_party/WebKit/public/web/WebOptionElement.h
@@ -62,9 +62,9 @@ public:
     BLINK_EXPORT bool isEnabled() const;
 
 #if BLINK_IMPLEMENTATION
-    WebOptionElement(const WTF::PassRefPtr<WebCore::HTMLOptionElement>&);
-    WebOptionElement& operator=(const WTF::PassRefPtr<WebCore::HTMLOptionElement>&);
-    operator WTF::PassRefPtr<WebCore::HTMLOptionElement>() const;
+    WebOptionElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLOptionElement>&);
+    WebOptionElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLOptionElement>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::HTMLOptionElement>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebPageSerializer.h b/chromium/third_party/WebKit/public/web/WebPageSerializer.h
index 89a3a31b832..b018a110126 100644
--- a/chromium/third_party/WebKit/public/web/WebPageSerializer.h
+++ b/chromium/third_party/WebKit/public/web/WebPageSerializer.h
@@ -34,9 +34,9 @@
 #include "../platform/WebCString.h"
 #include "../platform/WebCommon.h"
 #include "../platform/WebURL.h"
+#include "WebFrame.h"
 
 namespace blink {
-class WebFrame;
 class WebPageSerializerClient;
 class WebString;
 class WebView;
@@ -88,12 +88,13 @@ public:
     // saved links, which matched with vector:links one by one.
     // The parameter localDirectoryName is relative path of directory which
     // contain all saved auxiliary files included all sub frames and resources.
-    BLINK_EXPORT static bool serialize(WebFrame*,
-                                        bool recursive,
-                                        WebPageSerializerClient*,
-                                        const WebVector<WebURL>& links,
-                                        const WebVector<WebString>& localPaths,
-                                        const WebString& localDirectoryName);
+    BLINK_EXPORT static bool serialize(
+        WebLocalFrame*,
+        bool recursive,
+        WebPageSerializerClient*,
+        const WebVector<WebURL>& links,
+        const WebVector<WebString>& localPaths,
+        const WebString& localDirectoryName);
 
     // Retrieve all the resource for the passed view, including the main frame
     // and sub-frames. Returns true if all resources were retrieved
diff --git a/chromium/third_party/WebKit/public/web/WebPageVisibilityState.h b/chromium/third_party/WebKit/public/web/WebPageVisibilityState.h
index fe02afd42d3..ecd0b7a07f3 100644
--- a/chromium/third_party/WebKit/public/web/WebPageVisibilityState.h
+++ b/chromium/third_party/WebKit/public/web/WebPageVisibilityState.h
@@ -39,6 +39,7 @@ enum WebPageVisibilityState {
     WebPageVisibilityStateVisible,
     WebPageVisibilityStateHidden,
     WebPageVisibilityStatePrerender,
+    WebPageVisibilityStateLast = WebPageVisibilityStatePrerender
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebPasswordFormData.h b/chromium/third_party/WebKit/public/web/WebPasswordFormData.h
deleted file mode 100644
index 84dc700a59f..00000000000
--- a/chromium/third_party/WebKit/public/web/WebPasswordFormData.h
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebPasswordFormData_h
-#define WebPasswordFormData_h
-
-#include "../platform/WebString.h"
-#include "../platform/WebURL.h"
-#include "../platform/WebVector.h"
-#include "WebFormElement.h"
-
-namespace blink {
-
-struct WebPasswordFormData {
-    // If the provided form is suitable for password completion, isValid() will
-    // return true;
-    BLINK_EXPORT WebPasswordFormData(const WebFormElement&);
-
-    // If creation failed, return false.
-    bool isValid() const { return action.isValid(); }
-
-    // The action target of the form. This is the primary data used by the
-    // PasswordManager for form autofill; that is, the action of the saved
-    // credentials must match the action of the form on the page to be autofilled.
-    // If this is empty / not available, it will result in a "restricted"
-    // IE-like autofill policy, where we wait for the user to type in his
-    // username before autofilling the password. In these cases, after successful
-    // login the action URL will automatically be assigned by the
-    // PasswordManager.
-    //
-    // When parsing an HTML form, this must always be set.
-    WebURL action;
-
-    // The "Realm" for the sign-on (scheme, host, port for SCHEME_HTML, and
-    // contains the HTTP realm for dialog-based forms).
-    // The signon_realm is effectively the primary key used for retrieving
-    // data from the database, so it must not be empty.
-    WebString signonRealm;
-
-    // The URL (minus query parameters) containing the form. This is the primary
-    // data used by the PasswordManager to decide (in longest matching prefix
-    // fashion) whether or not a given PasswordForm result from the database is a
-    // good fit for a particular form on a page, so it must not be empty.
-    WebURL origin;
-
-    // The name of the submit button used. Optional; only used in scoring
-    // of PasswordForm results from the database to make matches as tight as
-    // possible.
-    //
-    // When parsing an HTML form, this must always be set.
-    WebString submitElement;
-
-    // The name of the username input element. Optional (improves scoring).
-    //
-    // When parsing an HTML form, this must always be set.
-    WebString userNameElement;
-
-    // The username. Optional.
-    //
-    // When parsing an HTML form, this is typically empty unless the site
-    // has implemented some form of autofill.
-    WebString userNameValue;
-
-    // If the form has more than one field which could possibly contain the
-    // username, the extra are placed here. Used for autofill in cases where
-    // our heuristics for determining the username are wrong. Optional.
-    //
-    // When parsing an HTML form, this is typically empty.
-    WebVector<WebString> possibleUserNames;
-
-    // The name of the password input element, Optional (improves scoring).
-    //
-    // When parsing an HTML form, this must always be set.
-    WebString passwordElement;
-
-    // The password. Required.
-    //
-    // When parsing an HTML form, this is typically empty.
-    WebString passwordValue;
-
-    // Value of shouldAutocomplete for the password element.
-    bool passwordShouldAutocomplete;
-
-    // If the form was a change password form, the name of the
-    // 'old password' input element. Optional.
-    WebString oldPasswordElement;
-
-    // The old password. Optional.
-    WebString oldPasswordValue;
-
-    WebPasswordFormData()
-        : passwordShouldAutocomplete(false)
-    {
-    }
-};
-
-} // namespace blink
-
-#endif
diff --git a/chromium/third_party/WebKit/public/web/WebPerformance.h b/chromium/third_party/WebKit/public/web/WebPerformance.h
index 99d973a8953..a858f352240 100644
--- a/chromium/third_party/WebKit/public/web/WebPerformance.h
+++ b/chromium/third_party/WebKit/public/web/WebPerformance.h
@@ -35,6 +35,10 @@
 #include "../platform/WebPrivatePtr.h"
 #include "WebNavigationType.h"
 
+#if BLINK_IMPLEMENTATION
+#include "platform/heap/Handle.h"
+#endif
+
 namespace WebCore { class Performance; }
 
 namespace blink {
@@ -82,9 +86,8 @@ public:
     BLINK_EXPORT double loadEventEnd() const;
 
 #if BLINK_IMPLEMENTATION
-    WebPerformance(const WTF::PassRefPtr<WebCore::Performance>&);
-    WebPerformance& operator=(const WTF::PassRefPtr<WebCore::Performance>&);
-    operator WTF::PassRefPtr<WebCore::Performance>() const;
+    WebPerformance(const PassRefPtrWillBeRawPtr<WebCore::Performance>&);
+    WebPerformance& operator=(const PassRefPtrWillBeRawPtr<WebCore::Performance>&);
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/WebPermissionClient.h b/chromium/third_party/WebKit/public/web/WebPermissionClient.h
index 1fe2ad1976a..b1e9f58c7ef 100644
--- a/chromium/third_party/WebKit/public/web/WebPermissionClient.h
+++ b/chromium/third_party/WebKit/public/web/WebPermissionClient.h
@@ -31,12 +31,11 @@
 #ifndef WebPermissionClient_h
 #define WebPermissionClient_h
 
-#define WEBPERMISSIONCLIENT_USES_FRAME_FOR_ALL_METHODS
+#include "public/platform/WebPermissionCallbacks.h"
 
 namespace blink {
 
 class WebDocument;
-class WebFrame;
 class WebSecurityOrigin;
 class WebString;
 class WebURL;
@@ -44,80 +43,73 @@ class WebURL;
 class WebPermissionClient {
 public:
     // Controls whether access to Web Databases is allowed for this frame.
-    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize) { return true; }
+    virtual bool allowDatabase(const WebString& name, const WebString& displayName, unsigned long estimatedSize) { return true; }
 
     // Controls whether access to File System is allowed for this frame.
-    virtual bool allowFileSystem(WebFrame*) { return true; }
+    virtual bool requestFileSystemAccessSync() { return true; }
+
+    // Controls whether access to File System is allowed for this frame.
+    virtual void requestFileSystemAccessAsync(const WebPermissionCallbacks& callbacks) { WebPermissionCallbacks permissionCallbacks(callbacks); permissionCallbacks.doAllow(); }
 
     // Controls whether images are allowed for this frame.
-    virtual bool allowImage(WebFrame* frame, bool enabledPerSettings, const WebURL& imageURL) { return enabledPerSettings; }
+    virtual bool allowImage(bool enabledPerSettings, const WebURL& imageURL) { return enabledPerSettings; }
 
     // Controls whether access to Indexed DB are allowed for this frame.
-    virtual bool allowIndexedDB(WebFrame*, const WebString& name, const WebSecurityOrigin&) { return true; }
+    virtual bool allowIndexedDB(const WebString& name, const WebSecurityOrigin&) { return true; }
 
     // Controls whether plugins are allowed for this frame.
-    virtual bool allowPlugins(WebFrame*, bool enabledPerSettings) { return enabledPerSettings; }
+    virtual bool allowPlugins(bool enabledPerSettings) { return enabledPerSettings; }
 
     // Controls whether scripts are allowed to execute for this frame.
-    virtual bool allowScript(WebFrame*, bool enabledPerSettings) { return enabledPerSettings; }
+    virtual bool allowScript(bool enabledPerSettings) { return enabledPerSettings; }
 
     // Controls whether scripts loaded from the given URL are allowed to execute for this frame.
-    virtual bool allowScriptFromSource(WebFrame*, bool enabledPerSettings, const WebURL& scriptURL) { return enabledPerSettings; }
+    virtual bool allowScriptFromSource(bool enabledPerSettings, const WebURL& scriptURL) { return enabledPerSettings; }
 
     // Controls whether insecrure content is allowed to display for this frame.
-    virtual bool allowDisplayingInsecureContent(WebFrame*, bool enabledPerSettings, const WebSecurityOrigin&, const WebURL&) { return enabledPerSettings; }
+    virtual bool allowDisplayingInsecureContent(bool enabledPerSettings, const WebSecurityOrigin&, const WebURL&) { return enabledPerSettings; }
 
     // Controls whether insecrure scripts are allowed to execute for this frame.
-    virtual bool allowRunningInsecureContent(WebFrame*, bool enabledPerSettings, const WebSecurityOrigin&, const WebURL&) { return enabledPerSettings; }
+    virtual bool allowRunningInsecureContent(bool enabledPerSettings, const WebSecurityOrigin&, const WebURL&) { return enabledPerSettings; }
 
     // Controls whether the given script extension should run in a new script
     // context in this frame. If extensionGroup is 0, the script context is the
     // frame's main context. Otherwise, it is a context created by
-    // WebFrame::executeScriptInIsolatedWorld with that same extensionGroup
+    // WebLocalFrame::executeScriptInIsolatedWorld with that same extensionGroup
     // value.
-    virtual bool allowScriptExtension(WebFrame*, const WebString& extensionName, int extensionGroup) { return true; }
+    virtual bool allowScriptExtension(const WebString& extensionName, int extensionGroup) { return true; }
 
-    virtual bool allowScriptExtension(WebFrame* webFrame, const WebString& extensionName, int extensionGroup, int worldId)
+    virtual bool allowScriptExtension(const WebString& extensionName, int extensionGroup, int worldId)
     {
-        return allowScriptExtension(webFrame, extensionName, extensionGroup);
+        return allowScriptExtension(extensionName, extensionGroup);
     }
 
     // Controls whether HTML5 Web Storage is allowed for this frame.
     // If local is true, then this is for local storage, otherwise it's for session storage.
-    virtual bool allowStorage(WebFrame*, bool local) { return true; }
+    virtual bool allowStorage(bool local) { return true; }
 
     // Controls whether access to read the clipboard is allowed for this frame.
-    virtual bool allowReadFromClipboard(WebFrame*, bool defaultValue) { return defaultValue; }
+    virtual bool allowReadFromClipboard(bool defaultValue) { return defaultValue; }
 
     // Controls whether access to write the clipboard is allowed for this frame.
-    virtual bool allowWriteToClipboard(WebFrame*, bool defaultValue) { return defaultValue; }
+    virtual bool allowWriteToClipboard(bool defaultValue) { return defaultValue; }
 
-#if defined(WEBPERMISSIONCLIENT_USES_FRAME_FOR_ALL_METHODS)
     // Controls whether enabling Web Components API for this frame.
-    virtual bool allowWebComponents(WebFrame*, bool defaultValue) { return defaultValue; }
+    virtual bool allowWebComponents(bool defaultValue) { return defaultValue; }
 
     // Controls whether to enable MutationEvents for this frame.
     // The common use case of this method is actually to selectively disable MutationEvents,
     // but it's been named for consistency with the rest of the interface.
-    virtual bool allowMutationEvents(WebFrame*, bool defaultValue) { return defaultValue; }
+    virtual bool allowMutationEvents(bool defaultValue) { return defaultValue; }
 
     // Controls whether pushState and related History APIs are enabled for this frame.
-    virtual bool allowPushState(WebFrame*) { return true; }
-#else
-    // These methods are deprecated and will be removed after Chrome uses the new versions above.
-    virtual bool allowWebComponents(const WebDocument&, bool defaultValue) { return defaultValue; }
-    virtual bool allowMutationEvents(const WebDocument&, bool defaultValue) { return defaultValue; }
-    virtual bool allowPushState(const WebDocument&) { return true; }
-#endif
-
-    // Controls whether WebGL extension WEBGL_debug_renderer_info is allowed for this frame.
-    virtual bool allowWebGLDebugRendererInfo(WebFrame*) { return false; }
+    virtual bool allowPushState() { return true; }
 
     // Notifies the client that the frame would have instantiated a plug-in if plug-ins were enabled.
-    virtual void didNotAllowPlugins(WebFrame*) { }
+    virtual void didNotAllowPlugins() { }
 
     // Notifies the client that the frame would have executed script if script were enabled.
-    virtual void didNotAllowScript(WebFrame*) { }
+    virtual void didNotAllowScript() { }
 
 protected:
     ~WebPermissionClient() { }
diff --git a/chromium/third_party/WebKit/public/web/WebPlugin.h b/chromium/third_party/WebKit/public/web/WebPlugin.h
index 9f046f2decb..a99c3ee217b 100644
--- a/chromium/third_party/WebKit/public/web/WebPlugin.h
+++ b/chromium/third_party/WebKit/public/web/WebPlugin.h
@@ -45,7 +45,6 @@ namespace blink {
 
 class WebDataSource;
 class WebDragData;
-class WebFrame;
 class WebInputEvent;
 class WebPluginContainer;
 class WebURLResponse;
@@ -65,6 +64,7 @@ public:
     virtual void destroy() = 0;
 
     virtual WebPluginContainer* container() const { return 0; }
+    virtual void containerDidDetachFromParent() { }
 
     virtual NPObject* scriptableObject() = 0;
     virtual struct _NPP* pluginNPP() { return 0; }
@@ -169,6 +169,7 @@ public:
     virtual void rotateView(RotationType type) { }
 
     virtual bool isPlaceholder() { return true; }
+    virtual bool shouldPersist() const { return false; }
 
 protected:
     ~WebPlugin() { }
diff --git a/chromium/third_party/WebKit/public/web/WebPluginAction.h b/chromium/third_party/WebKit/public/web/WebPluginAction.h
index fc039984ea3..69c89210ef7 100644
--- a/chromium/third_party/WebKit/public/web/WebPluginAction.h
+++ b/chromium/third_party/WebKit/public/web/WebPluginAction.h
@@ -37,7 +37,8 @@ struct WebPluginAction {
     enum Type {
         Unknown,
         Rotate90Clockwise,
-        Rotate90Counterclockwise
+        Rotate90Counterclockwise,
+        TypeLast = Rotate90Counterclockwise
     };
 
     Type type;
diff --git a/chromium/third_party/WebKit/public/web/WebPluginDocument.h b/chromium/third_party/WebKit/public/web/WebPluginDocument.h
index 86b3ba7bcf5..27eb1423128 100644
--- a/chromium/third_party/WebKit/public/web/WebPluginDocument.h
+++ b/chromium/third_party/WebKit/public/web/WebPluginDocument.h
@@ -56,9 +56,9 @@ public:
     BLINK_EXPORT WebPlugin* plugin();
 
 #if BLINK_IMPLEMENTATION
-    WebPluginDocument(const WTF::PassRefPtr<WebCore::PluginDocument>&);
-    WebPluginDocument& operator=(const WTF::PassRefPtr<WebCore::PluginDocument>&);
-    operator WTF::PassRefPtr<WebCore::PluginDocument>() const;
+    WebPluginDocument(const PassRefPtrWillBeRawPtr<WebCore::PluginDocument>&);
+    WebPluginDocument& operator=(const PassRefPtrWillBeRawPtr<WebCore::PluginDocument>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::PluginDocument>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebPopupMenu.h b/chromium/third_party/WebKit/public/web/WebPopupMenu.h
index 29276729784..c7e84e0be6b 100644
--- a/chromium/third_party/WebKit/public/web/WebPopupMenu.h
+++ b/chromium/third_party/WebKit/public/web/WebPopupMenu.h
@@ -41,9 +41,6 @@ class WebWidgetClient;
 class WebPopupMenu : public WebWidget {
 public:
     BLINK_EXPORT static WebPopupMenu* create(WebWidgetClient*);
-
-    // Sets the minimum height of a popup listbox row.
-    BLINK_EXPORT static void setMinimumRowHeight(int);
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebPopupType.h b/chromium/third_party/WebKit/public/web/WebPopupType.h
index c82dcce2dbc..f9b4956305d 100644
--- a/chromium/third_party/WebKit/public/web/WebPopupType.h
+++ b/chromium/third_party/WebKit/public/web/WebPopupType.h
@@ -38,7 +38,7 @@ enum WebPopupType {
     WebPopupTypeSelect, // An HTML select (combo-box) popup.
     WebPopupTypeSuggestion, // An autofill/autocomplete popup.
     WebPopupTypePage, // An HTML-capable popup.
-    WebPopupTypeHelperPlugin, // An off-screen helper plugin.
+    WebPopupTypeLast = WebPopupTypePage
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebPrintScalingOption.h b/chromium/third_party/WebKit/public/web/WebPrintScalingOption.h
index adecf04afb2..b071e400263 100644
--- a/chromium/third_party/WebKit/public/web/WebPrintScalingOption.h
+++ b/chromium/third_party/WebKit/public/web/WebPrintScalingOption.h
@@ -37,6 +37,7 @@ enum WebPrintScalingOption {
     WebPrintScalingOptionNone, // Prints the upper left of a page without scaling. Crop the page contents that don't fit on the paper.
     WebPrintScalingOptionFitToPrintableArea, // Reduces or enlarges each page to fit the printable area of the selected printer paper size.
     WebPrintScalingOptionSourceSize, // Print output page size is same as the actual source page size. Do not scale/center/fit to printable area.
+    WebPrintScalingOptionLast = WebPrintScalingOptionSourceSize
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebRange.h b/chromium/third_party/WebKit/public/web/WebRange.h
index 3eeeeb0d0c1..cd318a1cf1f 100644
--- a/chromium/third_party/WebKit/public/web/WebRange.h
+++ b/chromium/third_party/WebKit/public/web/WebRange.h
@@ -31,20 +31,17 @@
 #ifndef WebRange_h
 #define WebRange_h
 
-#include "../platform/WebCommon.h"
-#include "../platform/WebVector.h"
+#include "WebFrame.h"
+#include "public/platform/WebCommon.h"
+#include "public/platform/WebPrivatePtr.h"
+#include "public/platform/WebVector.h"
 
-#if BLINK_IMPLEMENTATION
 namespace WebCore { class Range; }
-namespace WTF { template <typename T> class PassRefPtr; }
-#endif
 
 namespace blink {
 
 struct WebFloatQuad;
-class WebFrame;
 class WebNode;
-class WebRangePrivate;
 class WebString;
 
 // Provides readonly access to some properties of a DOM range.
@@ -52,8 +49,8 @@ class WebRange {
 public:
     ~WebRange() { reset(); }
 
-    WebRange() : m_private(0) { }
-    WebRange(const WebRange& r) : m_private(0) { assign(r); }
+    WebRange() { }
+    WebRange(const WebRange& r) { assign(r); }
     WebRange& operator=(const WebRange& r)
     {
         assign(r);
@@ -63,7 +60,7 @@ public:
     BLINK_EXPORT void reset();
     BLINK_EXPORT void assign(const WebRange&);
 
-    bool isNull() const { return !m_private; }
+    bool isNull() const { return m_private.isNull(); }
 
     BLINK_EXPORT int startOffset() const;
     BLINK_EXPORT int endOffset() const;
@@ -75,19 +72,17 @@ public:
 
     BLINK_EXPORT WebRange expandedToParagraph() const;
 
-    BLINK_EXPORT static WebRange fromDocumentRange(WebFrame*, int start, int length);
+    BLINK_EXPORT static WebRange fromDocumentRange(WebLocalFrame*, int start, int length);
 
     BLINK_EXPORT WebVector<WebFloatQuad> textQuads() const;
 
 #if BLINK_IMPLEMENTATION
-    WebRange(const WTF::PassRefPtr<WebCore::Range>&);
-    WebRange& operator=(const WTF::PassRefPtr<WebCore::Range>&);
-    operator WTF::PassRefPtr<WebCore::Range>() const;
+    WebRange(const PassRefPtrWillBeRawPtr<WebCore::Range>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::Range>() const;
 #endif
 
 private:
-    void assign(WebRangePrivate*);
-    WebRangePrivate* m_private;
+    WebPrivatePtr<WebCore::Range> m_private;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebRemoteFrame.h b/chromium/third_party/WebKit/public/web/WebRemoteFrame.h
new file mode 100644
index 00000000000..9afc010d821
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/WebRemoteFrame.h
@@ -0,0 +1,22 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebRemoteFrame_h
+#define WebRemoteFrame_h
+
+#include "public/web/WebFrame.h"
+
+namespace blink {
+
+class WebRemoteFrame : public WebFrame {
+public:
+    BLINK_EXPORT static WebRemoteFrame* create(WebFrameClient*);
+
+    virtual WebLocalFrame* createLocalChild(const WebString& name, WebFrameClient*) = 0;
+    virtual WebRemoteFrame* createRemoteChild(const WebString& name, WebFrameClient*) = 0;
+};
+
+} // namespace blink
+
+#endif // WebRemoteFrame_h
diff --git a/chromium/third_party/WebKit/public/web/WebRuntimeFeatures.h b/chromium/third_party/WebKit/public/web/WebRuntimeFeatures.h
index 745f24cf989..37eb1ea74fa 100644
--- a/chromium/third_party/WebKit/public/web/WebRuntimeFeatures.h
+++ b/chromium/third_party/WebKit/public/web/WebRuntimeFeatures.h
@@ -36,29 +36,17 @@
 namespace blink {
 
 // This class is used to enable runtime features of Blink.
-// All features are disabled by default.
-// Most clients should call enableStableFeatures() to enable
-// features Blink has made API commitments to.
+// Stable features are enabled by default.
 class WebRuntimeFeatures {
 public:
-    BLINK_EXPORT static void enableStableFeatures(bool);
     BLINK_EXPORT static void enableExperimentalFeatures(bool);
     BLINK_EXPORT static void enableTestOnlyFeatures(bool);
 
     BLINK_EXPORT static void enableApplicationCache(bool);
-    BLINK_EXPORT static bool isApplicationCacheEnabled();
 
     BLINK_EXPORT static void enableDatabase(bool);
-    BLINK_EXPORT static bool isDatabaseEnabled();
-
-    BLINK_EXPORT static void enableDeviceMotion(bool);
-    BLINK_EXPORT static bool isDeviceMotionEnabled();
-
-    BLINK_EXPORT static void enableDeviceOrientation(bool);
-    BLINK_EXPORT static bool isDeviceOrientationEnabled();
 
     BLINK_EXPORT static void enableDialogElement(bool);
-    BLINK_EXPORT static bool isDialogElementEnabled();
 
     BLINK_EXPORT static void enableEncryptedMedia(bool);
     BLINK_EXPORT static bool isEncryptedMediaEnabled();
@@ -66,109 +54,84 @@ public:
     BLINK_EXPORT static void enablePrefixedEncryptedMedia(bool);
     BLINK_EXPORT static bool isPrefixedEncryptedMediaEnabled();
 
-    BLINK_EXPORT static void enableDirectWrite(bool);
-    BLINK_EXPORT static bool isDirectWriteEnabled();
+    BLINK_EXPORT static void enableBleedingEdgeFastPaths(bool);
 
     BLINK_EXPORT static void enableExperimentalCanvasFeatures(bool);
-    BLINK_EXPORT static bool isExperimentalCanvasFeaturesEnabled();
+
+    BLINK_EXPORT static void enableFastMobileScrolling(bool);
 
     BLINK_EXPORT static void enableFastTextAutosizing(bool);
-    BLINK_EXPORT static bool isFastTextAutosizingEnabled();
 
     BLINK_EXPORT static void enableFileSystem(bool);
-    BLINK_EXPORT static bool isFileSystemEnabled();
-
-    BLINK_EXPORT static void enableFullscreen(bool);
-    BLINK_EXPORT static bool isFullscreenEnabled();
 
     BLINK_EXPORT static void enableGamepad(bool);
-    BLINK_EXPORT static bool isGamepadEnabled();
-
-    BLINK_EXPORT static void enableGeolocation(bool);
-    BLINK_EXPORT static bool isGeolocationEnabled();
-
-    BLINK_EXPORT static void enableLazyLayout(bool);
 
     BLINK_EXPORT static void enableLocalStorage(bool);
-    BLINK_EXPORT static bool isLocalStorageEnabled();
 
     BLINK_EXPORT static void enableMediaPlayer(bool);
-    BLINK_EXPORT static bool isMediaPlayerEnabled();
 
-    BLINK_EXPORT static void enableWebKitMediaSource(bool);
-    BLINK_EXPORT static bool isWebKitMediaSourceEnabled();
+    BLINK_EXPORT static void enableSubpixelFontScaling(bool);
 
     BLINK_EXPORT static void enableMediaSource(bool);
-    BLINK_EXPORT static bool isMediaSourceEnabled();
 
     BLINK_EXPORT static void enableMediaStream(bool);
-    BLINK_EXPORT static bool isMediaStreamEnabled();
 
     BLINK_EXPORT static void enableNotifications(bool);
-    BLINK_EXPORT static bool isNotificationsEnabled();
 
     BLINK_EXPORT static void enableNavigatorContentUtils(bool);
-    BLINK_EXPORT static bool isNavigatorContentUtilsEnabled();
+
+    BLINK_EXPORT static void enableOrientationEvent(bool);
 
     BLINK_EXPORT static void enablePagePopup(bool);
-    BLINK_EXPORT static bool isPagePopupEnabled();
 
     BLINK_EXPORT static void enablePeerConnection(bool);
-    BLINK_EXPORT static bool isPeerConnectionEnabled();
 
     BLINK_EXPORT static void enableRequestAutocomplete(bool);
-    BLINK_EXPORT static bool isRequestAutocompleteEnabled();
 
     BLINK_EXPORT static void enableScriptedSpeech(bool);
-    BLINK_EXPORT static bool isScriptedSpeechEnabled();
 
     BLINK_EXPORT static void enableServiceWorker(bool);
-    BLINK_EXPORT static bool isServiceWorkerEnabled();
 
     BLINK_EXPORT static void enableSessionStorage(bool);
-    BLINK_EXPORT static bool isSessionStorageEnabled();
-
-    BLINK_EXPORT static void enableSpeechInput(bool);
-    BLINK_EXPORT static bool isSpeechInputEnabled();
 
     BLINK_EXPORT static void enableSpeechSynthesis(bool);
-    BLINK_EXPORT static bool isSpeechSynthesisEnabled();
 
     BLINK_EXPORT static void enableTouch(bool);
-    BLINK_EXPORT static bool isTouchEnabled();
 
-    BLINK_EXPORT static void enableWebAnimationsCSS(bool);
+    BLINK_EXPORT static void enableTouchIconLoading(bool);
+
     BLINK_EXPORT static void enableWebAnimationsSVG(bool);
 
     BLINK_EXPORT static void enableWebAudio(bool);
-    BLINK_EXPORT static bool isWebAudioEnabled();
 
     BLINK_EXPORT static void enableWebGLDraftExtensions(bool);
-    BLINK_EXPORT static bool isWebGLDraftExtensionsEnabled();
 
-    BLINK_EXPORT static void enableWebMIDI(bool);
-    BLINK_EXPORT static bool isWebMIDIEnabled();
+    BLINK_EXPORT static void enableWebGLImageChromium(bool);
 
-    BLINK_EXPORT static void enableDataListElement(bool);
-    BLINK_EXPORT static bool isDataListElementEnabled();
+    BLINK_EXPORT static void enableWebMIDI(bool);
 
     BLINK_EXPORT static void enableHTMLImports(bool);
-    BLINK_EXPORT static bool isHTMLImportsEnabled();
 
     BLINK_EXPORT static void enableXSLT(bool);
 
-    BLINK_EXPORT static void enableEmbedderCustomElements(bool);
-
     BLINK_EXPORT static void enableOverlayScrollbars(bool);
 
-    BLINK_EXPORT static void enableInputModeAttribute(bool);
-
     BLINK_EXPORT static void enableOverlayFullscreenVideo(bool);
 
     BLINK_EXPORT static void enableSharedWorker(bool);
 
     BLINK_EXPORT static void enableRepaintAfterLayout(bool);
 
+    BLINK_EXPORT static void enableExperimentalWebSocket(bool);
+
+    BLINK_EXPORT static void enableTargetedStyleRecalc(bool);
+
+    BLINK_EXPORT static void enablePreciseMemoryInfo(bool);
+
+    BLINK_EXPORT static void enableLayerSquashing(bool);
+
+    BLINK_EXPORT static void enableShowModalDialog(bool);
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/chromium/third_party/WebKit/public/web/WebPasswordGeneratorClient.h b/chromium/third_party/WebKit/public/web/WebScopedWindowFocusAllowedIndicator.h
index 254bedd15cb..f3f07b9a37e 100644
--- a/chromium/third_party/WebKit/public/web/WebPasswordGeneratorClient.h
+++ b/chromium/third_party/WebKit/public/web/WebScopedWindowFocusAllowedIndicator.h
@@ -28,20 +28,29 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebPasswordGeneratorClient_h
-#define WebPasswordGeneratorClient_h
+#ifndef WebScopedWindowFocusAllowedIndicator_h
+#define WebScopedWindowFocusAllowedIndicator_h
 
-namespace blink {
+#include "public/platform/WebPrivateOwnPtr.h"
 
-class WebInputElement;
+namespace WebCore {
+class WindowFocusAllowedIndicator;
+}
 
-class WebPasswordGeneratorClient {
+namespace blink {
+
+class WebScopedWindowFocusAllowedIndicator {
 public:
-    virtual void openPasswordGenerator(WebInputElement&) = 0;
+    WebScopedWindowFocusAllowedIndicator() { initialize(); }
+    ~WebScopedWindowFocusAllowedIndicator() { reset(); }
+
+private:
+    BLINK_EXPORT void initialize();
+    BLINK_EXPORT void reset();
 
-    virtual ~WebPasswordGeneratorClient() { }
+    WebPrivateOwnPtr<WebCore::WindowFocusAllowedIndicator> m_indicator;
 };
 
 }
 
-#endif // WebPasswordGeneratorClient_h
+#endif // WebScopedWindowFocusAllowedIndicator_h
diff --git a/chromium/third_party/WebKit/public/web/WebScriptController.h b/chromium/third_party/WebKit/public/web/WebScriptController.h
index e4a9841c5bb..0f507544d61 100644
--- a/chromium/third_party/WebKit/public/web/WebScriptController.h
+++ b/chromium/third_party/WebKit/public/web/WebScriptController.h
@@ -46,15 +46,6 @@ public:
     // v8::Extension object passed.
     BLINK_EXPORT static void registerExtension(v8::Extension*);
 
-    // Enables special settings which are only applicable if V8 is executed
-    // in the single thread which must be the main thread.
-    // FIXME: make a try to dynamically detect when this condition is broken
-    // and automatically switch off single thread mode.
-    BLINK_EXPORT static void enableV8SingleThreadMode();
-
-    // Process any pending JavaScript console messages.
-    BLINK_EXPORT static void flushConsoleMessages();
-
 private:
     WebScriptController();
 };
diff --git a/chromium/third_party/WebKit/public/web/WebSelectElement.h b/chromium/third_party/WebKit/public/web/WebSelectElement.h
index 836959c24fc..6fbe0c27c2f 100644
--- a/chromium/third_party/WebKit/public/web/WebSelectElement.h
+++ b/chromium/third_party/WebKit/public/web/WebSelectElement.h
@@ -54,14 +54,12 @@ public:
     }
     void assign(const WebSelectElement& element) { WebFormControlElement::assign(element); }
 
-    BLINK_EXPORT void setValue(const WebString&);
-    BLINK_EXPORT WebString value() const;
     BLINK_EXPORT WebVector<WebElement> listItems() const;
 
 #if BLINK_IMPLEMENTATION
-    WebSelectElement(const WTF::PassRefPtr<WebCore::HTMLSelectElement>&);
-    WebSelectElement& operator=(const WTF::PassRefPtr<WebCore::HTMLSelectElement>&);
-    operator WTF::PassRefPtr<WebCore::HTMLSelectElement>() const;
+    WebSelectElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLSelectElement>&);
+    WebSelectElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLSelectElement>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::HTMLSelectElement>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebSerializedScriptValueVersion.h b/chromium/third_party/WebKit/public/web/WebSerializedScriptValueVersion.h
index f00ae5ebf72..e285efa1539 100644
--- a/chromium/third_party/WebKit/public/web/WebSerializedScriptValueVersion.h
+++ b/chromium/third_party/WebKit/public/web/WebSerializedScriptValueVersion.h
@@ -38,7 +38,7 @@ namespace blink {
 // Embedders may serialize this as out-of-band metadata along with
 // collections of serialized data so that version skew can be detected
 // before deserializing individual values.
-const unsigned kSerializedScriptValueVersion = 4;
+const unsigned kSerializedScriptValueVersion = 6;
 
 } // namespace blink
 
diff --git a/chromium/third_party/WebKit/public/web/WebServiceWorkerContextClient.h b/chromium/third_party/WebKit/public/web/WebServiceWorkerContextClient.h
index 22e104a7110..0a787469810 100644
--- a/chromium/third_party/WebKit/public/web/WebServiceWorkerContextClient.h
+++ b/chromium/third_party/WebKit/public/web/WebServiceWorkerContextClient.h
@@ -32,30 +32,54 @@
 #define WebServiceWorkerContextClient_h
 
 #include "WebWorkerPermissionClientProxy.h"
+#include "public/platform/WebMessagePortChannel.h"
+#include "public/platform/WebServiceWorkerClientsInfo.h"
+#include "public/platform/WebServiceWorkerEventResult.h"
+#include "public/platform/WebURL.h"
 
 namespace blink {
 
-class WebString;
+class WebDataSource;
 class WebServiceWorkerContextProxy;
+class WebServiceWorkerNetworkProvider;
+class WebServiceWorkerResponse;
+class WebString;
 
-// This interface is implemented by the client. It is suppoed to be created
-// on the main thread and then passed on to the worker thread to be owned
+// This interface is implemented by the client. It is supposed to be created
+// on the main thread and then passed on to the worker thread.
 // by a newly created WorkerGlobalScope. All methods of this class, except
-// for workerContextFailedToStart(), are called on the worker thread.
+// for createServiceWorkerNetworkProvider() and workerContextFailedToStart(),
+// are called on the worker thread.
+// FIXME: Split this into EmbeddedWorkerContextClient and
+// ServiceWorkerScriptContextClient when we decide to use EmbeddedWorker
+// framework for other implementation (like SharedWorker).
 class WebServiceWorkerContextClient {
 public:
     virtual ~WebServiceWorkerContextClient() { }
 
+    // ServiceWorker specific method. Called when script accesses the
+    // the |scope| attribute of the ServiceWorkerGlobalScope. Immutable per spec.
+    virtual WebURL scope() const { return WebURL(); }
+
+    // If the worker was started with WebEmbeddedWorkerStartData indicating to pause
+    // after download, this method is called after the main script resource has been
+    // downloaded. The scope will not be created and the script will not be loaded until
+    // WebEmbeddedWorker.resumeAfterDownload() is invoked.
+    virtual void didPauseAfterDownload() { }
+
     // A new WorkerGlobalScope is created and started to run on the
     // worker thread.
     // This also gives back a proxy to the client to talk to the
     // newly created WorkerGlobalScope. The proxy is held by WorkerGlobalScope
     // and should not be held by the caller. No proxy methods should be called
-    // after workerContextDestroyed() is called.
+    // after willDestroyWorkerContext() is called.
     virtual void workerContextStarted(WebServiceWorkerContextProxy*) { }
 
-    // WorkerGlobalScope is destroyed. The client should clear the
-    // WebServiceWorkerGlobalScopeProxy when this is called.
+    // WorkerGlobalScope is about to be destroyed. The client should clear
+    // the WebServiceWorkerGlobalScopeProxy when this is called.
+    virtual void willDestroyWorkerContext() { }
+
+    // WorkerGlobalScope is destroyed and the worker is ready to be terminated.
     virtual void workerContextDestroyed() { }
 
     // Starting worker context is failed. This could happen when loading
@@ -63,8 +87,47 @@ public:
     // This is called on the main thread.
     virtual void workerContextFailedToStart() { }
 
+    // Called when the WorkerGlobalScope had an error or an exception.
+    virtual void reportException(const WebString& errorMessage, int lineNumber, int columnNumber, const WebString& sourceURL) { }
+
+    // Called when the console message is reported.
+    virtual void reportConsoleMessage(int source, int level, const WebString& message, int lineNumber, const WebString& sourceURL) { }
+
+    // Inspector related messages.
     virtual void dispatchDevToolsMessage(const WebString&) { }
     virtual void saveDevToolsAgentState(const WebString&) { }
+
+    // ServiceWorker specific method.
+    virtual void didHandleActivateEvent(int eventID, blink::WebServiceWorkerEventResult result) { }
+
+    // ServiceWorker specific method. Called after InstallEvent (dispatched
+    // via WebServiceWorkerContextProxy) is handled by the ServiceWorker's
+    // script context.
+    virtual void didHandleInstallEvent(int installEventID, blink::WebServiceWorkerEventResult result) { }
+
+    // ServiceWorker specific methods. Called after FetchEvent is handled by the
+    // ServiceWorker's script context. When no response is provided, the browser
+    // should fallback to native fetch.
+    virtual void didHandleFetchEvent(int fetchEventID) { }
+    virtual void didHandleFetchEvent(int fetchEventID, const WebServiceWorkerResponse& response) { }
+
+    // ServiceWorker specific method. Called after SyncEvent (dispatched via
+    // WebServiceWorkerContextProxy) is handled by the ServiceWorker's script
+    // context.
+    virtual void didHandleSyncEvent(int syncEventID) { }
+
+    // Ownership of the returned object is transferred to the caller.
+    virtual WebServiceWorkerNetworkProvider* createServiceWorkerNetworkProvider(blink::WebDataSource*) { return 0; }
+
+    // Ownership of the passed callbacks is transferred to the callee, callee
+    // should delete the callbacks after calling either onSuccess or onError.
+    // WebServiceWorkerClientsInfo and WebServiceWorkerError ownerships are
+    // passed to the WebServiceWorkerClientsCallbacks implementation.
+    virtual void getClients(WebServiceWorkerClientsCallbacks*) { BLINK_ASSERT_NOT_REACHED(); }
+
+    // Callee receives ownership of the passed vector.
+    // FIXME: Blob refs should be passed to maintain ref counts. crbug.com/351753
+    virtual void postMessageToClient(int clientID, const WebString&, WebMessagePortChannelArray*) { BLINK_ASSERT_NOT_REACHED(); }
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebServiceWorkerContextProxy.h b/chromium/third_party/WebKit/public/web/WebServiceWorkerContextProxy.h
index f00f1cd2241..6c6328d0bff 100644
--- a/chromium/third_party/WebKit/public/web/WebServiceWorkerContextProxy.h
+++ b/chromium/third_party/WebKit/public/web/WebServiceWorkerContextProxy.h
@@ -31,8 +31,11 @@
 #ifndef WebServiceWorkerContextProxy_h
 #define WebServiceWorkerContextProxy_h
 
+#include "public/platform/WebMessagePortChannel.h"
+
 namespace blink {
 
+class WebServiceWorkerRequest;
 class WebString;
 
 // A proxy interface to talk to the worker's GlobalScope implementation.
@@ -41,13 +44,18 @@ class WebServiceWorkerContextProxy {
 public:
     virtual ~WebServiceWorkerContextProxy() { }
 
-    // FIXME: Add service-worker specific methods.
+    virtual void dispatchActivateEvent(int eventID) = 0;
+    // FIXME: This needs to pass the active service worker info.
+    virtual void dispatchInstallEvent(int installEventID) = 0;
+    virtual void dispatchFetchEvent(int fetchEventID, const WebServiceWorkerRequest& webRequest) = 0;
+
+    virtual void dispatchMessageEvent(const WebString& message, const WebMessagePortChannelArray& channels) = 0;
+
+    virtual void dispatchPushEvent(int eventID, const WebString& data) = 0;
 
-    virtual void resumeWorkerContext() { }
-    virtual void attachDevTools() { }
-    virtual void reattachDevTools(const WebString& savedState) { }
-    virtual void detachDevTools() { }
-    virtual void dispatchDevToolsMessage(const WebString&) { }
+    // Once the ServiceWorker has finished handling the sync event
+    // didHandleSyncEvent is called on the context client.
+    virtual void dispatchSyncEvent(int syncEventID) = 0;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebApplicationCacheHostClient.h b/chromium/third_party/WebKit/public/web/WebServiceWorkerNetworkProvider.h
index 72f841282e6..a48be056d0a 100644
--- a/chromium/third_party/WebKit/public/web/WebApplicationCacheHostClient.h
+++ b/chromium/third_party/WebKit/public/web/WebServiceWorkerNetworkProvider.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,30 +28,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebApplicationCacheHostClient_h
-#define WebApplicationCacheHostClient_h
-
-#include "../platform/WebCommon.h"
-#include "WebApplicationCacheHost.h"
+#ifndef WebServiceWorkerNetworkProvider_h
+#define WebServiceWorkerNetworkProvider_h
 
 namespace blink {
 
-// This interface is used by the embedder to call into webkit.
-class WebApplicationCacheHostClient {
-public:
-    // Called when a different cache, including possibly no cache, is associated with the host.
-    virtual void didChangeCacheAssociation() = 0;
+class WebDataSource;
+class WebURLRequest;
 
-    // Called to fire events in the scriptable interface.
-    virtual void notifyEventListener(WebApplicationCacheHost::EventID) = 0;
-    virtual void notifyProgressEventListener(const WebURL&, int num_total, int num_complete) = 0;
+// This interface is implemented by the client and is only called on the main thread.
+class WebServiceWorkerNetworkProvider {
+public:
+    virtual ~WebServiceWorkerNetworkProvider() { }
 
-protected:
-    // Should not be deleted by the embedder.
-    virtual ~WebApplicationCacheHostClient() { }
+    // A request is about to be sent out, and the client may modify it. Request
+    // is writable, and changes to the URL, for example, will change the request
+    // made.
+    virtual void willSendRequest(blink::WebDataSource*, blink::WebURLRequest&) { }
 };
 
-}  // namespace blink
-
-#endif  // WebApplicationCacheHostClient_h
+} // namespace blink
 
+#endif // WebServiceWorkerNetworkProvider_h
diff --git a/chromium/third_party/WebKit/public/web/WebSettings.h b/chromium/third_party/WebKit/public/web/WebSettings.h
index 3512c274a99..3ea9d69d5ce 100644
--- a/chromium/third_party/WebKit/public/web/WebSettings.h
+++ b/chromium/third_party/WebKit/public/web/WebSettings.h
@@ -53,6 +53,7 @@ public:
     };
 
     virtual bool mainFrameResizesAreOrientationChanges() const = 0;
+    virtual bool shrinksViewportContentToFit() const = 0;
     virtual bool scrollAnimatorEnabled() const = 0;
     virtual bool touchEditingEnabled() const = 0;
     virtual bool viewportEnabled() const = 0;
@@ -60,23 +61,33 @@ public:
     virtual void setAccelerated2dCanvasEnabled(bool) = 0;
     virtual void setAccelerated2dCanvasMSAASampleCount(int) = 0;
     virtual void setAcceleratedCompositingEnabled(bool) = 0;
-    virtual void setAcceleratedCompositingFor3DTransformsEnabled(bool) = 0;
-    virtual void setAcceleratedCompositingForAnimationEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForCanvasEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForFiltersEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForFixedPositionEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForFixedRootBackgroundEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForOverflowScrollEnabled(bool) = 0;
     virtual void setCompositorDrivenAcceleratedScrollingEnabled(bool) = 0;
-    virtual void setAcceleratedCompositingForTransitionEnabled(bool)  = 0;
-    virtual void setAcceleratedCompositingForPluginsEnabled(bool) = 0;
-    virtual void setAcceleratedCompositingForScrollableFramesEnabled(bool) = 0;
+    // Not implemented yet, see http://crbug.com/178119
+    virtual void setAcceleratedCompositingForTransitionEnabled(bool) { };
     virtual void setAcceleratedCompositingForVideoEnabled(bool) = 0;
-    virtual void setAcceleratedFiltersEnabled(bool) = 0;
+    // If set to true, allows frames with an https origin to display passive
+    // contents at an insecure URL. Otherwise, disallows it. The
+    // FrameLoaderClient set to the frame may override the value set by this
+    // method.
     virtual void setAllowDisplayOfInsecureContent(bool) = 0;
     virtual void setAllowFileAccessFromFileURLs(bool) = 0;
     virtual void setAllowCustomScrollbarInMainFrame(bool) = 0;
+    // If set to true, allows frames with an https origin to run active
+    // contents at an insecure URL. This includes WebSockets. Otherwise,
+    // disallows it. The FrameLoaderClient set to the frame may override the
+    // value set by this method.
     virtual void setAllowRunningOfInsecureContent(bool) = 0;
+    // If set to true, allows frames with an https origin to connect WebSockets
+    // with an insecure URL (ws://). Otherwise, disallows it. Only when this is
+    // set to true, this value overrides the value set by
+    // setAllowRunningOfInsecureContent() for WebSockets. The FrameLoaderClient
+    // set to the frame may override the value set by this method.
+    virtual void setAllowConnectingInsecureWebSocket(bool) = 0;
     virtual void setAllowScriptsToCloseWindows(bool) = 0;
     virtual void setAllowUniversalAccessFromFileURLs(bool) = 0;
     virtual void setAntialiased2dCanvasEnabled(bool) = 0;
@@ -86,7 +97,9 @@ public:
     virtual void setClobberUserAgentInitialScaleQuirk(bool) = 0;
     virtual void setCompositedScrollingForFramesEnabled(bool) = 0;
     virtual void setCompositorTouchHitTesting(bool) = 0;
+    virtual void setContainerCullingEnabled(bool) = 0;
     virtual void setCookieEnabled(bool) = 0;
+    virtual void setNavigateOnDragDrop(bool) = 0;
     virtual void setCursiveFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setDNSPrefetchingEnabled(bool) = 0;
     virtual void setDOMPasteAllowed(bool) = 0;
@@ -95,24 +108,20 @@ public:
     virtual void setDefaultTextEncodingName(const WebString&) = 0;
     virtual void setDefaultVideoPosterURL(const WebString&) = 0;
     void setDeferred2dCanvasEnabled(bool) { } // temporary stub
+    virtual void setDeferredFiltersEnabled(bool) = 0;
     virtual void setDeferredImageDecodingEnabled(bool) = 0;
     virtual void setDeviceScaleAdjustment(float) = 0;
     virtual void setDeviceSupportsMouse(bool) = 0;
     virtual void setDeviceSupportsTouch(bool) = 0;
     virtual void setDoubleTapToZoomEnabled(bool) = 0;
     virtual void setDownloadableBinaryFontsEnabled(bool) = 0;
-    virtual void setEditableLinkBehaviorNeverLive() = 0;
     virtual void setEditingBehavior(EditingBehavior) = 0;
     virtual void setEnableScrollAnimator(bool) = 0;
     virtual void setEnableTouchAdjustment(bool) = 0;
     virtual void setRegionBasedColumnsEnabled(bool) = 0;
     virtual void setExperimentalWebGLEnabled(bool) = 0;
-    virtual void setExperimentalWebSocketEnabled(bool) = 0;
     virtual void setFantasyFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setFixedFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
-    virtual void setFixedPositionCreatesStackingContext(bool) = 0;
-    virtual void setForceCompositingMode(bool) = 0;
-    virtual void setFullScreenEnabled(bool) = 0;
     virtual void setGestureTapHighlightEnabled(bool) = 0;
     virtual void setHyperlinkAuditingEnabled(bool) = 0;
     virtual void setIgnoreMainFrameOverflowHiddenQuirk(bool) = 0;
@@ -122,16 +131,14 @@ public:
     virtual void setJavaScriptCanOpenWindowsAutomatically(bool) = 0;
     virtual void setJavaScriptEnabled(bool) = 0;
     virtual void setLayerSquashingEnabled(bool) = 0;
-    virtual void setLayoutFallbackWidth(int) = 0;
     virtual void setLoadsImagesAutomatically(bool) = 0;
     virtual void setLoadWithOverviewMode(bool) = 0;
     virtual void setLocalStorageEnabled(bool) = 0;
     virtual void setMainFrameClipsContent(bool) = 0;
     virtual void setMainFrameResizesAreOrientationChanges(bool) = 0;
     virtual void setMaxTouchPoints(int) = 0;
+    virtual void setMediaControlsOverlayPlayButtonEnabled(bool) = 0;
     virtual void setMediaPlaybackRequiresUserGesture(bool) = 0;
-    virtual void setMediaFullscreenRequiresUserGesture(bool) = 0;
-    virtual void setMemoryInfoEnabled(bool) = 0;
     virtual void setMinimumAccelerated2dCanvasSize(int) = 0;
     virtual void setMinimumFontSize(int) = 0;
     virtual void setMinimumLogicalFontSize(int) = 0;
@@ -146,7 +153,6 @@ public:
     virtual void setPinchOverlayScrollbarThickness(int) = 0;
     virtual void setPinchVirtualViewportEnabled(bool) = 0;
     virtual void setPluginsEnabled(bool) = 0;
-    virtual void setPrivilegedWebGLExtensionsEnabled(bool) = 0;
     virtual void setRenderVSyncNotificationEnabled(bool) = 0;
     virtual void setReportScreenSizeInPhysicalPixelsQuirk(bool) = 0;
     virtual void setSansSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
@@ -159,6 +165,7 @@ public:
     virtual void setShowFPSCounter(bool) = 0;
     virtual void setShowPaintRects(bool) = 0;
     virtual void setShrinksStandaloneImagesToFit(bool) = 0;
+    virtual void setShrinksViewportContentToFit(bool) = 0;
     virtual void setSmartInsertDeleteEnabled(bool) = 0;
     // Spatial navigation feature, when enabled, improves the experience
     // of keyboard-controlling the web pages which originally were not designed
@@ -175,15 +182,15 @@ public:
     virtual void setTextAreasAreResizable(bool) = 0;
     virtual void setTextAutosizingEnabled(bool) = 0;
     virtual void setAccessibilityFontScaleFactor(float) = 0;
-    virtual void setThreadedHTMLParser(bool) = 0;
     virtual void setTouchDragDropEnabled(bool) = 0;
     virtual void setTouchEditingEnabled(bool) = 0;
     virtual void setUnifiedTextCheckerEnabled(bool) = 0;
     virtual void setUnsafePluginPastingEnabled(bool) = 0;
-    virtual void setUsesEncodingDetector(bool) = 0;
+    virtual void setUseExpandedHeuristicsForGpuRasterization(bool) = 0;
     virtual void setUseLegacyBackgroundSizeShorthandBehavior(bool) = 0;
     virtual void setUseSolidColorScrollbars(bool) = 0;
     virtual void setUseWideViewport(bool) = 0;
+    virtual void setUsesEncodingDetector(bool) = 0;
     virtual void setValidationMessageTimerMagnification(int) = 0;
     virtual void setViewportEnabled(bool) = 0;
     virtual void setViewportMetaEnabled(bool) = 0;
@@ -191,7 +198,6 @@ public:
     virtual void setViewportMetaMergeContentQuirk(bool) = 0;
     virtual void setViewportMetaNonUserScalableQuirk(bool) = 0;
     virtual void setViewportMetaZeroValuesQuirk(bool) = 0;
-    virtual void setVisualWordMovementEnabled(bool) = 0;
     virtual void setWebAudioEnabled(bool) = 0;
     virtual void setWebGLErrorsToConsoleEnabled(bool) = 0;
     virtual void setWebSecurityEnabled(bool) = 0;
diff --git a/chromium/third_party/WebKit/public/web/WebSharedWorker.h b/chromium/third_party/WebKit/public/web/WebSharedWorker.h
index 377a8fae8ab..27365ad89b2 100644
--- a/chromium/third_party/WebKit/public/web/WebSharedWorker.h
+++ b/chromium/third_party/WebKit/public/web/WebSharedWorker.h
@@ -33,7 +33,6 @@
 
 #include "../platform/WebCommon.h"
 #include "WebContentSecurityPolicy.h"
-#include "WebSharedWorkerConnector.h"
 
 namespace WebCore {
 class ScriptExecutionContext;
@@ -47,13 +46,19 @@ class WebSharedWorkerClient;
 class WebURL;
 
 // This is the interface to a SharedWorker thread.
-// FIXME(horo): Make WebSharedWorker independent from WebSharedWorkerConnector.
-class WebSharedWorker : public WebSharedWorkerConnector {
+class WebSharedWorker {
 public:
     // Invoked from the worker thread to instantiate a WebSharedWorker that interacts with the WebKit worker components.
     BLINK_EXPORT static WebSharedWorker* create(WebSharedWorkerClient*);
 
-    virtual ~WebSharedWorker() {};
+    virtual void startWorkerContext(
+        const WebURL& scriptURL,
+        const WebString& name,
+        const WebString& contentSecurityPolicy,
+        WebContentSecurityPolicyType) = 0;
+
+    // Sends a connect event to the SharedWorker context.
+    virtual void connect(WebMessagePortChannel*) = 0;
 
     // Invoked to shutdown the worker when there are no more associated documents.
     virtual void terminateWorkerContext() = 0;
@@ -61,12 +66,12 @@ public:
     // Notification when the WebCommonWorkerClient is destroyed.
     virtual void clientDestroyed() = 0;
 
-    virtual void pauseWorkerContextOnStart() { }
-    virtual void resumeWorkerContext() { }
-    virtual void attachDevTools() { }
-    virtual void reattachDevTools(const WebString& savedState) { }
-    virtual void detachDevTools() { }
-    virtual void dispatchDevToolsMessage(const WebString&) { }
+    virtual void pauseWorkerContextOnStart() = 0;
+    virtual void resumeWorkerContext() = 0;
+    virtual void attachDevTools() = 0;
+    virtual void reattachDevTools(const WebString& savedState) = 0;
+    virtual void detachDevTools() = 0;
+    virtual void dispatchDevToolsMessage(const WebString&) = 0;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebSharedWorkerClient.h b/chromium/third_party/WebKit/public/web/WebSharedWorkerClient.h
index 1d953c4def3..89362f35c9d 100644
--- a/chromium/third_party/WebKit/public/web/WebSharedWorkerClient.h
+++ b/chromium/third_party/WebKit/public/web/WebSharedWorkerClient.h
@@ -50,6 +50,9 @@ class WebSharedWorkerClient {
 public:
     virtual void workerContextClosed() = 0;
     virtual void workerContextDestroyed() = 0;
+    virtual void workerScriptLoaded() = 0;
+    virtual void workerScriptLoadFailed() = 0;
+    virtual void selectAppCacheID(long long) = 0;
 
     // Returns the notification presenter for this worker context. Pointer
     // is owned by the object implementing WebSharedWorkerClient.
@@ -68,9 +71,6 @@ public:
 
     virtual void dispatchDevToolsMessage(const WebString&) { }
     virtual void saveDevToolsAgentState(const WebString&) { }
-
-protected:
-    ~WebSharedWorkerClient() { }
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebSharedWorkerConnector.h b/chromium/third_party/WebKit/public/web/WebSharedWorkerConnector.h
index 8e1d2d682d2..0371737102f 100644
--- a/chromium/third_party/WebKit/public/web/WebSharedWorkerConnector.h
+++ b/chromium/third_party/WebKit/public/web/WebSharedWorkerConnector.h
@@ -45,27 +45,15 @@ class WebSharedWorkerConnector {
 public:
     virtual ~WebSharedWorkerConnector() { }
 
-    // Returns false if the thread hasn't been started yet (script loading has not taken place).
-    // FIXME(atwilson): Remove this when we move the initial script loading into the worker process.
-    virtual bool isStarted() = 0;
-
-    virtual void startWorkerContext(
-        const WebURL& scriptURL,
-        const WebString& name,
-        const WebString& userAgent,
-        const WebString& sourceCode,
-        const WebString& contentSecurityPolicy,
-        WebContentSecurityPolicyType,
-        long long scriptResourceAppCacheID) = 0;
-
     class ConnectListener {
     public:
         // Invoked once the connect event has been sent so the caller can free this object.
         virtual void connected() = 0;
+        virtual void scriptLoadFailed() = 0;
     };
 
     // Sends a connect event to the SharedWorker context. The listener is invoked when this async operation completes.
-    virtual void connect(WebMessagePortChannel*, ConnectListener* = 0) = 0;
+    virtual void connect(WebMessagePortChannel*, ConnectListener*) = 0;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebSharedWorkerRepositoryClient.h b/chromium/third_party/WebKit/public/web/WebSharedWorkerRepositoryClient.h
index 97129a3239f..45a4a6914d8 100644
--- a/chromium/third_party/WebKit/public/web/WebSharedWorkerRepositoryClient.h
+++ b/chromium/third_party/WebKit/public/web/WebSharedWorkerRepositoryClient.h
@@ -31,10 +31,11 @@
 #ifndef WebSharedWorkerRepositoryClient_h
 #define WebSharedWorkerRepositoryClient_h
 
-#include "WebSharedWorker.h"
+#include "WebSharedWorkerConnector.h"
 
 namespace blink {
 
+enum WebContentSecurityPolicyType;
 class WebString;
 class WebURL;
 
@@ -43,15 +44,9 @@ public:
     // Unique identifier for the parent document of a worker (unique within a given process).
     typedef unsigned long long DocumentID;
 
-    // Creates a new shared worker. This may return null.
-    // FIXME(horo):Remove this method.
-    virtual WebSharedWorker* createSharedWorker(const WebURL&, const WebString&, DocumentID) { return 0; }
-
     // Creates a new shared worker connector. This may return null.
-    virtual WebSharedWorkerConnector* createSharedWorkerConnector(const WebURL& url, const WebString& name, DocumentID id)
-    {
-        return createSharedWorker(url, name, id);
-    }
+    virtual WebSharedWorkerConnector* createSharedWorkerConnector(const WebURL& url, const WebString& name, DocumentID id, const WebString& contentSecurityPolicy, WebContentSecurityPolicyType) { return 0; }
+
 
     // Invoked when a document has been detached. DocumentID can be re-used after documentDetached() is invoked.
     virtual void documentDetached(DocumentID) { }
diff --git a/chromium/third_party/WebKit/public/web/WebSocket.h b/chromium/third_party/WebKit/public/web/WebSocket.h
index 589a5098000..01755bfb8ae 100644
--- a/chromium/third_party/WebKit/public/web/WebSocket.h
+++ b/chromium/third_party/WebKit/public/web/WebSocket.h
@@ -33,6 +33,7 @@
 
 #include "../platform/WebCommon.h"
 #include "../platform/WebPrivatePtr.h"
+#include "../platform/WebString.h"
 
 namespace WebCore { class WebSocketChannel; }
 
@@ -40,7 +41,6 @@ namespace blink {
 
 class WebArrayBuffer;
 class WebDocument;
-class WebString;
 class WebURL;
 class WebSocketClient;
 
@@ -84,11 +84,11 @@ public:
     virtual bool setBinaryType(BinaryType) = 0;
 
     virtual void connect(const WebURL&, const WebString& protocol) = 0;
-    virtual WebString subprotocol() = 0;
-    virtual WebString extensions() = 0;
+    virtual WebString subprotocol() { return WebString(); }
+    virtual WebString extensions() { return WebString(); }
     virtual bool sendText(const WebString&) = 0;
     virtual bool sendArrayBuffer(const WebArrayBuffer&) = 0;
-    virtual unsigned long bufferedAmount() const = 0;
+    virtual unsigned long bufferedAmount() const { return 0; }
     virtual void close(int code, const WebString& reason) = 0;
     virtual void fail(const WebString& reason) = 0;
     virtual void disconnect() = 0;
diff --git a/chromium/third_party/WebKit/public/web/WebSocketClient.h b/chromium/third_party/WebKit/public/web/WebSocketClient.h
index 35896f82b0b..666a018cd37 100644
--- a/chromium/third_party/WebKit/public/web/WebSocketClient.h
+++ b/chromium/third_party/WebKit/public/web/WebSocketClient.h
@@ -46,13 +46,18 @@ public:
     };
 
     virtual ~WebSocketClient() { }
-    virtual void didConnect() { }
+    virtual void didConnect(const WebString& subprotocol, const WebString& extensions) { }
     virtual void didReceiveMessage(const WebString& message) { }
     virtual void didReceiveArrayBuffer(const WebArrayBuffer& arrayBuffer) { }
     virtual void didReceiveMessageError() { }
-    virtual void didUpdateBufferedAmount(unsigned long bufferedAmount) { }
+    virtual void didConsumeBufferedAmount(unsigned long consumed) { }
     virtual void didStartClosingHandshake() { }
-    virtual void didClose(unsigned long bufferedAmount, ClosingHandshakeCompletionStatus, unsigned short code, const WebString& reason) { }
+    virtual void didClose(ClosingHandshakeCompletionStatus, unsigned short code, const WebString& reason) { }
+
+    // FIXME: Deperecate these methods.
+    virtual void didConnect() { }
+    virtual void didUpdateBufferedAmount(unsigned long bufferedAmount) { }
+    virtual void didClose(unsigned long unhandledBufferedAmount, ClosingHandshakeCompletionStatus, unsigned short code, const WebString& reason) { }
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebSpeechGrammar.h b/chromium/third_party/WebKit/public/web/WebSpeechGrammar.h
index 6c6f1379fd0..f0c4cd2c014 100644
--- a/chromium/third_party/WebKit/public/web/WebSpeechGrammar.h
+++ b/chromium/third_party/WebKit/public/web/WebSpeechGrammar.h
@@ -49,8 +49,8 @@ public:
     BLINK_EXPORT void assign(const WebSpeechGrammar&);
 
 #if BLINK_IMPLEMENTATION
-    WebSpeechGrammar(const WTF::PassRefPtr<WebCore::SpeechGrammar>&);
-    WebSpeechGrammar& operator=(const WTF::PassRefPtr<WebCore::SpeechGrammar>&);
+    explicit WebSpeechGrammar(WebCore::SpeechGrammar*);
+    WebSpeechGrammar& operator=(WebCore::SpeechGrammar*);
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/WebSpeechInputController.h b/chromium/third_party/WebKit/public/web/WebSpeechInputController.h
deleted file mode 100644
index 6556330ef7e..00000000000
--- a/chromium/third_party/WebKit/public/web/WebSpeechInputController.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebSpeechInputController_h
-#define WebSpeechInputController_h
-
-#include "../platform/WebCommon.h"
-
-namespace blink {
-
-struct WebRect;
-class WebSecurityOrigin;
-class WebString;
-
-// Provides an embedder API called by WebKit.
-class WebSpeechInputController {
-public:
-    // Starts speech recognition. Speech will get recorded until the endpointer detects silence,
-    // runs to the limit or stopRecording is called. Progress indications and the recognized
-    // text are returned via the listener interface. elementRect is the position
-    // of the element where the user clicked in the RootView coordinate system.
-    virtual bool startRecognition(int requestId, const WebRect& elementRect, const WebString& language, const WebString& grammar, const WebSecurityOrigin& origin)
-    {
-        BLINK_ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    // Cancels an ongoing recognition and discards any audio recorded so far. No partial
-    // recognition results are returned to the listener.
-    virtual void cancelRecognition(int) { BLINK_ASSERT_NOT_REACHED(); }
-
-    // Stops audio recording and performs recognition with the audio recorded until now
-    // (does not discard audio). This is an optional call and is typically invoked if the user
-    // wants to stop recording audio as soon as they finished speaking. Otherwise, the speech
-    // recording 'endpointer' should detect silence in the input and stop recording automatically.
-    // Call startRecognition() to record audio and recognize speech again.
-    virtual void stopRecording(int) { BLINK_ASSERT_NOT_REACHED(); }
-
-protected:
-    virtual ~WebSpeechInputController() { }
-};
-
-} // namespace blink
-
-#endif // WebSpeechInputController_h
diff --git a/chromium/third_party/WebKit/public/web/WebSpeechInputListener.h b/chromium/third_party/WebKit/public/web/WebSpeechInputListener.h
deleted file mode 100644
index e352a194cd7..00000000000
--- a/chromium/third_party/WebKit/public/web/WebSpeechInputListener.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebSpeechInputListener_h
-#define WebSpeechInputListener_h
-
-#include "WebSpeechInputResult.h"
-
-namespace blink {
-
-class WebString;
-
-// Provides a WebKit API called by the embedder.
-// A typical sequence of calls to the listener would be
-//   1 call to didCompleteRecording
-//   0 or more calls to setRecognitionResult
-//   1 call to didCompleteRecognition
-class WebSpeechInputListener {
-public:
-    // Informs that audio recording has completed and recognition is underway. This gets invoked
-    // irrespective of whether recording was stopped automatically by the 'endpointer' or if
-    // WebSpeechInputController::stopRecording() was called.
-    // Typically after this call the listener would update the UI to reflect that recognition is
-    // in progress.
-    virtual void didCompleteRecording(int) { BLINK_ASSERT_NOT_REACHED(); }
-
-    // Gives results from speech recognition, either partial or the final results.
-    // This method can potentially get called multiple times if there are partial results
-    // available as the user keeps speaking. If the speech could not be recognized properly
-    // or if there was any other errors in the process, this method may never be called.
-    virtual void setRecognitionResult(int, const WebSpeechInputResultArray&) { BLINK_ASSERT_NOT_REACHED(); }
-
-    // Informs that speech recognition has completed. This gets invoked irrespective of whether
-    // recognition was succesful or not, whether setRecognitionResult() was invoked or not. The
-    // handler typically frees up any temporary resources allocated and waits for the next speech
-    // recognition request.
-    virtual void didCompleteRecognition(int) { BLINK_ASSERT_NOT_REACHED(); }
-
-protected:
-    ~WebSpeechInputListener() { }
-};
-
-} // namespace blink
-
-#endif // WebSpeechInputListener_h
diff --git a/chromium/third_party/WebKit/public/web/WebSpeechInputResult.h b/chromium/third_party/WebKit/public/web/WebSpeechInputResult.h
deleted file mode 100644
index 2222690eb53..00000000000
--- a/chromium/third_party/WebKit/public/web/WebSpeechInputResult.h
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebSpeechInputResult_h
-#define WebSpeechInputResult_h
-
-#include "../platform/WebCommon.h"
-#include "../platform/WebPrivatePtr.h"
-#include "../platform/WebString.h"
-#include "../platform/WebVector.h"
-
-namespace WebCore {
-class SpeechInputResult;
-}
-
-namespace blink {
-
-// This class holds one speech recognition result including the text and other related
-// fields, as received from the embedder.
-class WebSpeechInputResult {
-public:
-    WebSpeechInputResult() { }
-    WebSpeechInputResult(const WebSpeechInputResult& other) { assign(other); }
-    ~WebSpeechInputResult() { reset(); }
-
-    WebSpeechInputResult& operator=(const WebSpeechInputResult& other)
-    {
-        assign(other);
-        return *this;
-    }
-
-    BLINK_EXPORT void assign(const WebString& utterance, double confidence);
-    BLINK_EXPORT void assign(const WebSpeechInputResult& other);
-    BLINK_EXPORT void reset();
-
-#if BLINK_IMPLEMENTATION
-    WebSpeechInputResult(const WTF::PassRefPtr<WebCore::SpeechInputResult>&);
-    operator WTF::PassRefPtr<WebCore::SpeechInputResult>() const;
-#endif
-
-private:
-    WebPrivatePtr<WebCore::SpeechInputResult> m_private;
-};
-
-typedef WebVector<WebSpeechInputResult> WebSpeechInputResultArray;
-
-} // namespace blink
-
-#endif // WebSpeechInputResult_h
diff --git a/chromium/third_party/WebKit/public/web/WebSpeechRecognitionHandle.h b/chromium/third_party/WebKit/public/web/WebSpeechRecognitionHandle.h
index 432d8fdfcdc..c56a1be1eed 100644
--- a/chromium/third_party/WebKit/public/web/WebSpeechRecognitionHandle.h
+++ b/chromium/third_party/WebKit/public/web/WebSpeechRecognitionHandle.h
@@ -62,9 +62,9 @@ public:
     BLINK_EXPORT bool lessThan(const WebSpeechRecognitionHandle&) const;
 
 #if BLINK_IMPLEMENTATION
-    WebSpeechRecognitionHandle(const WTF::PassRefPtr<WebCore::SpeechRecognition>&);
-    WebSpeechRecognitionHandle& operator=(const WTF::PassRefPtr<WebCore::SpeechRecognition>&);
-    operator WTF::PassRefPtr<WebCore::SpeechRecognition>() const;
+    explicit WebSpeechRecognitionHandle(WebCore::SpeechRecognition*);
+    WebSpeechRecognitionHandle& operator=(WebCore::SpeechRecognition*);
+    operator WebCore::SpeechRecognition*() const;
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/WebSpeechRecognitionResult.h b/chromium/third_party/WebKit/public/web/WebSpeechRecognitionResult.h
index e070ca2533f..d34e00bde9e 100644
--- a/chromium/third_party/WebKit/public/web/WebSpeechRecognitionResult.h
+++ b/chromium/third_party/WebKit/public/web/WebSpeechRecognitionResult.h
@@ -48,7 +48,7 @@ public:
     BLINK_EXPORT void reset();
 
 #if BLINK_IMPLEMENTATION
-    operator WTF::PassRefPtr<WebCore::SpeechRecognitionResult>() const;
+    operator WebCore::SpeechRecognitionResult*() const;
 #endif
 
 private:
diff --git a/chromium/third_party/WebKit/public/web/WebSurroundingText.h b/chromium/third_party/WebKit/public/web/WebSurroundingText.h
index aa6e268faa5..b5abbc83462 100644
--- a/chromium/third_party/WebKit/public/web/WebSurroundingText.h
+++ b/chromium/third_party/WebKit/public/web/WebSurroundingText.h
@@ -38,8 +38,11 @@ namespace blink {
 
 class WebHitTestResult;
 class WebNode;
+class WebRange;
 struct WebPoint;
 
+// WebSurroundingText is a Blink API that gives access to the SurroundingText
+// API. It allows caller to know the text surrounding a point or a range.
 class WebSurroundingText {
 public:
     WebSurroundingText() { }
@@ -48,17 +51,34 @@ public:
     BLINK_EXPORT bool isNull() const;
     BLINK_EXPORT void reset();
 
-    // Initializes the object to get the surrounding text centered in the position relative to a provided node.
+    // Initializes the object to get the surrounding text centered in the
+    // position relative to a provided node.
     // The maximum length of the contents retrieved is defined by maxLength.
     BLINK_EXPORT void initialize(const WebNode&, const WebPoint&, size_t maxLength);
 
+    // Initializes the object to get the text surrounding a given range.
+    // The maximum length of the contents retrieved is defined by maxLength.
+    // It does not include the text inside the range.
+    BLINK_EXPORT void initialize(const WebRange&, size_t maxLength);
+
     // Surrounding text content retrieved.
     BLINK_EXPORT WebString textContent() const;
 
-    // Offset in the text content of the initial hit position (or provided offset in the node).
+    // Offset in the text content of the initial hit position (or provided
+    // offset in the node).
+    // This should only be called when WebSurroundingText has been initialized
+    // with a WebPoint.
+    // DEPRECATED: use startOffsetInTextContent() or endOffsetInTextContent().
     BLINK_EXPORT size_t hitOffsetInTextContent() const;
 
-    // Convert start/end positions in the content text string into a WebKit text range.
+    // Start offset of the initial text in the text content.
+    BLINK_EXPORT size_t startOffsetInTextContent() const;
+
+    // End offset of the initial text in the text content.
+    BLINK_EXPORT size_t endOffsetInTextContent() const;
+
+    // Convert start/end positions in the content text string into a WebKit text
+    // range.
     BLINK_EXPORT WebRange rangeFromContentOffsets(size_t startOffsetInContent, size_t endOffsetInContent);
 
 protected:
diff --git a/chromium/third_party/WebKit/public/web/WebTestingSupport.h b/chromium/third_party/WebKit/public/web/WebTestingSupport.h
index 5d3ace80639..33f316a7742 100644
--- a/chromium/third_party/WebKit/public/web/WebTestingSupport.h
+++ b/chromium/third_party/WebKit/public/web/WebTestingSupport.h
@@ -27,15 +27,14 @@
 #define WebTestingSupport_h
 
 #include "../platform/WebCommon.h"
+#include "WebFrame.h"
 
 namespace blink {
 
-class WebFrame;
-
 class WebTestingSupport {
 public:
-    BLINK_EXPORT static void injectInternalsObject(WebFrame*);
-    BLINK_EXPORT static void resetInternalsObject(WebFrame*);
+    BLINK_EXPORT static void injectInternalsObject(WebLocalFrame*);
+    BLINK_EXPORT static void resetInternalsObject(WebLocalFrame*);
 };
 
 }
diff --git a/chromium/third_party/WebKit/public/web/WebTextAreaElement.h b/chromium/third_party/WebKit/public/web/WebTextAreaElement.h
index fae3995b0a0..489a30882b5 100644
--- a/chromium/third_party/WebKit/public/web/WebTextAreaElement.h
+++ b/chromium/third_party/WebKit/public/web/WebTextAreaElement.h
@@ -52,13 +52,10 @@ public:
     }
     void assign(const WebTextAreaElement& element) { WebFormControlElement::assign(element); }
 
-    BLINK_EXPORT void setValue(const WebString&);
-    BLINK_EXPORT WebString value() const;
-
 #if BLINK_IMPLEMENTATION
-    WebTextAreaElement(const WTF::PassRefPtr<WebCore::HTMLTextAreaElement>&);
-    WebTextAreaElement& operator=(const WTF::PassRefPtr<WebCore::HTMLTextAreaElement>&);
-    operator WTF::PassRefPtr<WebCore::HTMLTextAreaElement>() const;
+    WebTextAreaElement(const PassRefPtrWillBeRawPtr<WebCore::HTMLTextAreaElement>&);
+    WebTextAreaElement& operator=(const PassRefPtrWillBeRawPtr<WebCore::HTMLTextAreaElement>&);
+    operator PassRefPtrWillBeRawPtr<WebCore::HTMLTextAreaElement>() const;
 #endif
 };
 
diff --git a/chromium/third_party/WebKit/public/web/WebTextDirection.h b/chromium/third_party/WebKit/public/web/WebTextDirection.h
index 3bdbb9e0231..a236c86c6bf 100644
--- a/chromium/third_party/WebKit/public/web/WebTextDirection.h
+++ b/chromium/third_party/WebKit/public/web/WebTextDirection.h
@@ -38,6 +38,7 @@ enum WebTextDirection {
     WebTextDirectionDefault,  // Natural writing direction ("inherit")
     WebTextDirectionLeftToRight,
     WebTextDirectionRightToLeft,
+    WebTextDirectionLast = WebTextDirectionRightToLeft
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebTouchAction.h b/chromium/third_party/WebKit/public/web/WebTouchAction.h
index 0c793d0916b..2643199d264 100755..100644
--- a/chromium/third_party/WebKit/public/web/WebTouchAction.h
+++ b/chromium/third_party/WebKit/public/web/WebTouchAction.h
@@ -38,7 +38,8 @@ enum WebTouchAction {
     WebTouchActionAuto = 0x0,
     WebTouchActionNone = 0x1,
     WebTouchActionPanX = 0x2,
-    WebTouchActionPanY = 0x4
+    WebTouchActionPanY = 0x4,
+    WebTouchActionPinchZoom = 0x8,
 };
 inline WebTouchAction operator| (WebTouchAction a, WebTouchAction b) { return WebTouchAction(int(a) | int(b)); }
 inline WebTouchAction& operator|= (WebTouchAction& a, WebTouchAction b) { return a = a | b; }
diff --git a/chromium/third_party/WebKit/public/web/WebTouchPoint.h b/chromium/third_party/WebKit/public/web/WebTouchPoint.h
index 0093f0f6f56..fc0231a5cab 100644
--- a/chromium/third_party/WebKit/public/web/WebTouchPoint.h
+++ b/chromium/third_party/WebKit/public/web/WebTouchPoint.h
@@ -32,7 +32,7 @@
 #define WebTouchPoint_h
 
 #include "../platform/WebCommon.h"
-#include "../platform/WebPoint.h"
+#include "../platform/WebFloatPoint.h"
 
 namespace blink {
 
@@ -59,11 +59,11 @@ public:
 
     int id;
     State state;
-    WebPoint screenPosition;
-    WebPoint position;
+    WebFloatPoint screenPosition;
+    WebFloatPoint position;
 
-    int radiusX;
-    int radiusY;
+    float radiusX;
+    float radiusY;
     float rotationAngle;
     float force;
 };
diff --git a/chromium/third_party/WebKit/public/web/WebUserGestureIndicator.h b/chromium/third_party/WebKit/public/web/WebUserGestureIndicator.h
index 6696086cd13..b7c7f3cfcf1 100644
--- a/chromium/third_party/WebKit/public/web/WebUserGestureIndicator.h
+++ b/chromium/third_party/WebKit/public/web/WebUserGestureIndicator.h
@@ -37,12 +37,6 @@ namespace blink {
 
 class WebUserGestureToken;
 
-class WebUserGestureHandler {
-public:
-    virtual ~WebUserGestureHandler() { }
-    virtual void onGesture() = 0;
-};
-
 class WebUserGestureIndicator {
 public:
     // Returns true if a user gesture is currently being processed.
@@ -55,8 +49,6 @@ public:
     // continue processing the user gesture later on using a
     // WebScopedUserGesture.
     BLINK_EXPORT static WebUserGestureToken currentUserGestureToken();
-
-    BLINK_EXPORT static void setHandler(WebUserGestureHandler*);
 };
 
 }
diff --git a/chromium/third_party/WebKit/public/web/WebUserMediaClient.h b/chromium/third_party/WebKit/public/web/WebUserMediaClient.h
index 877fc7bbaec..54fa97b2354 100644
--- a/chromium/third_party/WebKit/public/web/WebUserMediaClient.h
+++ b/chromium/third_party/WebKit/public/web/WebUserMediaClient.h
@@ -33,7 +33,7 @@
 
 namespace blink {
 
-class WebMediaStreamSource;
+class WebMediaDevicesRequest;
 class WebUserMediaRequest;
 template <typename T> class WebVector;
 
@@ -43,6 +43,8 @@ public:
 
     virtual void requestUserMedia(const WebUserMediaRequest&) = 0;
     virtual void cancelUserMediaRequest(const WebUserMediaRequest&) = 0;
+    virtual void requestMediaDevices(const WebMediaDevicesRequest&) { }
+    virtual void cancelMediaDevicesRequest(const WebMediaDevicesRequest&) { }
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/WebUserMediaRequest.h b/chromium/third_party/WebKit/public/web/WebUserMediaRequest.h
index 562e77b09d1..aa85ad68999 100644
--- a/chromium/third_party/WebKit/public/web/WebUserMediaRequest.h
+++ b/chromium/third_party/WebKit/public/web/WebUserMediaRequest.h
@@ -74,11 +74,15 @@ public:
 
     BLINK_EXPORT void requestSucceeded(const WebMediaStream&);
 
-    BLINK_EXPORT void requestFailed(const WebString& description = WebString());
+    BLINK_EXPORT void requestDenied(const WebString& description = WebString());
     BLINK_EXPORT void requestFailedConstraint(const WebString& constraintName, const WebString& description = WebString());
+    BLINK_EXPORT void requestFailedUASpecific(const WebString& name, const WebString& constraintName = WebString(), const WebString& description = WebString());
+
+    // DEPRECATED
+    BLINK_EXPORT void requestFailed(const WebString& description = WebString()) { requestDenied(description); }
 
 #if BLINK_IMPLEMENTATION
-    WebUserMediaRequest(const PassRefPtr<WebCore::UserMediaRequest>&);
+    WebUserMediaRequest(const PassRefPtrWillBeRawPtr<WebCore::UserMediaRequest>&);
     WebUserMediaRequest(WebCore::UserMediaRequest*);
     operator WebCore::UserMediaRequest*() const;
 #endif
diff --git a/chromium/third_party/WebKit/public/web/WebValidationMessageClient.h b/chromium/third_party/WebKit/public/web/WebValidationMessageClient.h
deleted file mode 100644
index 8d827ec5030..00000000000
--- a/chromium/third_party/WebKit/public/web/WebValidationMessageClient.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebValidationMessageClient_h
-#define WebValidationMessageClient_h
-
-#include "WebTextDirection.h"
-
-namespace blink {
-
-class WebString;
-struct WebRect;
-
-// Client interface to handle form validation message UI.
-// Depecated: This wil be removed when Chromium code siwtches to WebViewClient
-// functions.
-class WebValidationMessageClient {
-public:
-    // Show a notification popup for the specified form vaidation messages
-    // besides the anchor rectangle. An implementation of this function should
-    // not hide the popup until hideValidationMessage call.
-    virtual void showValidationMessage(const WebRect& anchorInRootView, const WebString& mainText, const WebString& supplementalText, WebTextDirection hint) { }
-
-    // Hide notifation popup for form validation messages.
-    virtual void hideValidationMessage() { }
-
-    // Move the existing notifation popup for the new anchor position.
-    virtual void moveValidationMessage(const WebRect& anchorInRootView) { }
-
-protected:
-    virtual ~WebValidationMessageClient() { }
-};
-
-} // namespace blink
-
-#endif
diff --git a/chromium/third_party/WebKit/public/web/WebView.h b/chromium/third_party/WebKit/public/web/WebView.h
index 6509d981719..098baacc4a5 100644
--- a/chromium/third_party/WebKit/public/web/WebView.h
+++ b/chromium/third_party/WebKit/public/web/WebView.h
@@ -35,6 +35,8 @@
 #include "../platform/WebString.h"
 #include "../platform/WebVector.h"
 #include "WebDragOperation.h"
+#include "WebHistoryCommitType.h"
+#include "WebHistoryItem.h"
 #include "WebPageVisibilityState.h"
 #include "WebWidget.h"
 
@@ -51,20 +53,17 @@ class WebGraphicsContext3D;
 class WebHitTestResult;
 class WebNode;
 class WebPageOverlay;
-class WebPermissionClient;
 class WebPrerendererClient;
 class WebRange;
 class WebSettings;
 class WebSpellCheckClient;
 class WebString;
-class WebPasswordGeneratorClient;
-class WebSharedWorkerRepositoryClient;
-class WebValidationMessageClient;
 class WebViewClient;
 struct WebActiveWheelFlingParameters;
 struct WebMediaPlayerAction;
 struct WebPluginAction;
 struct WebPoint;
+struct WebFloatPoint;
 struct WebWindowFeatures;
 
 class WebView : public WebWidget {
@@ -93,19 +92,12 @@ public:
     // This WebFrame will receive events for the main frame and must not
     // be null.
     virtual void setMainFrame(WebFrame*) = 0;
-    // FIXME: Remove initializeMainFrame() after clients have migrated to
-    // setMainFrame().
-    virtual void initializeMainFrame(WebFrameClient*) = 0;
 
     // Initializes the various client interfaces.
     virtual void setAutofillClient(WebAutofillClient*) = 0;
     virtual void setDevToolsAgentClient(WebDevToolsAgentClient*) = 0;
-    virtual void setPermissionClient(WebPermissionClient*) = 0;
     virtual void setPrerendererClient(WebPrerendererClient*) = 0;
     virtual void setSpellCheckClient(WebSpellCheckClient*) = 0;
-    virtual void setValidationMessageClient(WebValidationMessageClient*) = 0;
-    virtual void setPasswordGeneratorClient(WebPasswordGeneratorClient*) = 0;
-    virtual void setSharedWorkerRepositoryClient(WebSharedWorkerRepositoryClient*) = 0;
 
     // Options -------------------------------------------------------------
 
@@ -154,15 +146,9 @@ public:
     // WebWindowFeatures are ignored.
     virtual void setWindowFeatures(const WebWindowFeatures&) = 0;
 
-
-    // Closing -------------------------------------------------------------
-
-    // Runs beforeunload handlers for the current page, returning false if
-    // any handler suppressed unloading.
-    virtual bool dispatchBeforeUnloadEvent() = 0;
-
-    // Runs unload handlers for the current page.
-    virtual void dispatchUnloadEvent() = 0;
+    // Marks the WebView as being opened by a DOM call. This is relevant
+    // for whether window.close() may be called.
+    virtual void setOpenedByDOM() = 0;
 
 
     // Frames --------------------------------------------------------------
@@ -187,13 +173,10 @@ public:
     // Focus the first (last if reverse is true) focusable node.
     virtual void setInitialFocus(bool reverse) = 0;
 
-    // Clears the focused node (and selection if a text field is focused)
+    // Clears the focused element (and selection if a text field is focused)
     // to ensure that a text field on the page is not eating keystrokes we
     // send it.
-    virtual void clearFocusedNode() = 0;
-
-    // Scrolls the node currently in focus into view.
-    virtual void scrollFocusedNodeIntoView() = 0;
+    virtual void clearFocusedElement() = 0;
 
     // Scrolls the node currently in focus into |rect|, where |rect| is in
     // window space.
@@ -251,15 +234,31 @@ public:
     // is scaled up, < 1.0 is scaled down.
     virtual float pageScaleFactor() const = 0;
 
-    // Scales the page and the scroll offset by a given factor, while ensuring
-    // that the new scroll position does not go beyond the edge of the page.
-    virtual void setPageScaleFactorPreservingScrollOffset(float) = 0;
-
+    // TODO: Obsolete, the origin parameter is ambiguous with two viewports. Remove
+    // once Chromium side users are removed.
     // Scales a page by a factor of scaleFactor and then sets a scroll position to (x, y).
     // setPageScaleFactor() magnifies and shrinks a page without affecting layout.
     // On the other hand, zooming affects layout of the page.
     virtual void setPageScaleFactor(float scaleFactor, const WebPoint& origin) = 0;
 
+    // TODO: Reevaluate if this is needed once all users are converted to using the
+    // virtual viewport pinch model.
+    // Temporary to keep old style pinch viewport working while we gradually bring up
+    // virtual viewport pinch.
+    virtual void setMainFrameScrollOffset(const WebPoint& origin) = 0;
+
+    // Scales the page without affecting layout by using the pinch-to-zoom viewport.
+    virtual void setPageScaleFactor(float) = 0;
+
+    // Sets the offset of the pinch-to-zoom viewport within the main frame, in
+    // partial CSS pixels. The offset will be clamped so the pinch viewport
+    // stays within the frame's bounds.
+    virtual void setPinchViewportOffset(const WebFloatPoint&) = 0;
+
+    // Gets the pinch viewport's current offset within the page's main frame,
+    // in partial CSS pixels.
+    virtual WebFloatPoint pinchViewportOffset() const = 0;
+
     // PageScaleFactor will be force-clamped between minPageScale and maxPageScale
     // (and these values will persist until setPageScaleFactorLimits is called
     // again).
@@ -268,14 +267,6 @@ public:
     virtual float minimumPageScaleFactor() const = 0;
     virtual float maximumPageScaleFactor() const = 0;
 
-    // Save the WebView's current scroll and scale state. Each call to this function
-    // overwrites the previously saved scroll and scale state.
-    virtual void saveScrollAndScaleState() = 0;
-
-    // Restore the previously saved scroll and scale state. After restoring the
-    // state, this function deletes any saved scroll and scale state.
-    virtual void restoreScrollAndScaleState() = 0;
-
     // Reset any saved values for the scroll and scale state.
     virtual void resetScrollAndScaleState() = 0;
 
@@ -334,16 +325,15 @@ public:
     // WebView (if there is such an image)
     virtual void copyImageAt(const WebPoint&) = 0;
 
+    // Save as the image located at a particular point in the
+    // WebView (if there is such an image)
+    virtual void saveImageAt(const WebPoint&) = 0;
+
     // Notifies the WebView that a drag has terminated.
     virtual void dragSourceEndedAt(
         const WebPoint& clientPoint, const WebPoint& screenPoint,
         WebDragOperation operation) = 0;
 
-    // Notifies the WebView that a drag is going on.
-    virtual void dragSourceMovedTo(
-        const WebPoint& clientPoint, const WebPoint& screenPoint,
-        WebDragOperation operation) = 0;
-
     // Notfies the WebView that the system drag and drop operation has ended.
     virtual void dragSourceSystemDragEnded() = 0;
 
@@ -409,26 +399,6 @@ public:
     virtual WebAXObject accessibilityObject() = 0;
 
 
-    // Autofill  -----------------------------------------------------------
-
-    // Notifies the WebView that Autofill suggestions are available for a node.
-    // |itemIDs| is a vector of IDs for the menu items. A positive itemID is a
-    // unique ID for the Autofill entries. Other MenuItemIDs are defined in
-    // WebAutofillClient.h
-    virtual void applyAutofillSuggestions(
-        const WebNode&,
-        const WebVector<WebString>& names,
-        const WebVector<WebString>& labels,
-        const WebVector<WebString>& icons,
-        const WebVector<int>& itemIDs,
-        int separatorIndex = -1) = 0;
-
-    // Hides any popup (suggestions, selects...) that might be showing.
-    virtual void hidePopups() = 0;
-
-    virtual void selectAutofillSuggestionAtIndex(unsigned listIndex) = 0;
-
-
     // Context menu --------------------------------------------------------
 
     virtual void performCustomContextMenuAction(unsigned action) = 0;
@@ -447,6 +417,9 @@ public:
     // Sets whether select popup menus should be rendered by the browser.
     BLINK_EXPORT static void setUseExternalPopupMenus(bool);
 
+    // Hides any popup (suggestions, selects...) that might be showing.
+    virtual void hidePopups() = 0;
+
 
     // Visited link state --------------------------------------------------
 
@@ -487,17 +460,16 @@ public:
     // Cancels an active fling, returning true if a fling was active.
     virtual bool endActiveFlingAnimation() = 0;
 
-    virtual bool setEditableSelectionOffsets(int start, int end) = 0;
-    virtual bool setCompositionFromExistingText(int compositionStart, int compositionEnd, const WebVector<WebCompositionUnderline>& underlines) = 0;
-    virtual void extendSelectionAndDelete(int before, int after) = 0;
-
-    virtual bool isSelectionEditable() const = 0;
-
     virtual void setShowPaintRects(bool) = 0;
     virtual void setShowFPSCounter(bool) = 0;
     virtual void setContinuousPaintingEnabled(bool) = 0;
     virtual void setShowScrollBottleneckRects(bool) = 0;
 
+    // Compute the bounds of the root element of the current selection and fills
+    // the out-parameter on success. |bounds| coordinates will be relative to
+    // the contents window and will take into account the current scale level.
+    virtual void getSelectionRootBounds(WebRect& bounds) const = 0;
+
     // Visibility -----------------------------------------------------------
 
     // Sets the visibility of the WebView.
@@ -517,6 +489,14 @@ public:
     virtual void addPageOverlay(WebPageOverlay*, int /*z-order*/) = 0;
     virtual void removePageOverlay(WebPageOverlay*) = 0;
 
+
+    // i18n -----------------------------------------------------------------
+
+    // Inform the WebView that the accept languages have changed.
+    // If the WebView wants to get the accept languages value, it will have
+    // to call the WebViewClient::acceptLanguages().
+    virtual void acceptLanguagesChanged() = 0;
+
     // Testing functionality for TestRunner ---------------------------------
 
 protected:
diff --git a/chromium/third_party/WebKit/public/web/WebViewClient.h b/chromium/third_party/WebKit/public/web/WebViewClient.h
index 847237d5b92..748a9d3dcfa 100644
--- a/chromium/third_party/WebKit/public/web/WebViewClient.h
+++ b/chromium/third_party/WebKit/public/web/WebViewClient.h
@@ -31,7 +31,6 @@
 #ifndef WebViewClient_h
 #define WebViewClient_h
 
-#include "../platform/WebColor.h"
 #include "../platform/WebGraphicsContext3D.h"
 #include "../platform/WebString.h"
 #include "WebAXEnums.h"
@@ -39,6 +38,8 @@
 #include "WebDragOperation.h"
 #include "WebFileChooserCompletion.h"
 #include "WebFileChooserParams.h"
+#include "WebFrame.h"
+#include "WebNavigatorContentUtilsClient.h"
 #include "WebPageVisibilityState.h"
 #include "WebPopupType.h"
 #include "WebTextAffinity.h"
@@ -48,8 +49,6 @@
 namespace blink {
 
 class WebAXObject;
-class WebColorChooser;
-class WebColorChooserClient;
 class WebCompositorOutputSurface;
 class WebDateTimeChooserCompletion;
 class WebDragData;
@@ -57,31 +56,21 @@ class WebElement;
 class WebExternalPopupMenu;
 class WebExternalPopupMenuClient;
 class WebFileChooserCompletion;
-class WebFrame;
-class WebGeolocationClient;
-class WebGeolocationService;
 class WebGestureEvent;
-class WebHelperPlugin;
 class WebHitTestResult;
 class WebImage;
 class WebInputElement;
 class WebKeyboardEvent;
-class WebMIDIClient;
 class WebNode;
-class WebNotificationPresenter;
+class WebPushClient;
 class WebRange;
-class WebSpeechInputController;
-class WebSpeechInputListener;
 class WebSpeechRecognizer;
 class WebStorageNamespace;
 class WebURL;
 class WebURLRequest;
-class WebUserMediaClient;
 class WebView;
 class WebWidget;
-struct WebColorSuggestion;
 struct WebConsoleMessage;
-struct WebContextMenuData;
 struct WebDateTimeChooserParams;
 struct WebPoint;
 struct WebPopupMenuInfo;
@@ -103,7 +92,7 @@ public:
     // could be fulfilled.  The client should not load the request.
     // The policy parameter indicates how the new view will be displayed in
     // WebWidgetClient::show.
-    virtual WebView* createView(WebFrame* creator,
+    virtual WebView* createView(WebLocalFrame* creator,
                                 const WebURLRequest& request,
                                 const WebWindowFeatures& features,
                                 const WebString& name,
@@ -125,21 +114,11 @@ public:
 
     // Misc ----------------------------------------------------------------
 
-    // Whether or not we should report a detailed message for the given source.
-    virtual bool shouldReportDetailedMessageForSource(const WebString& source) { return false; }
-
-    // A new message was added to the console.
-    virtual void didAddMessageToConsole(
-        const WebConsoleMessage&, const WebString& sourceName, unsigned sourceLine, const WebString& stackTrace) { }
-
     // Called when script in the page calls window.print().  If frame is
     // non-null, then it selects a particular frame, including its
     // children, to print.  Otherwise, the main frame and its children
     // should be printed.
-    virtual void printPage(WebFrame*) { }
-
-    // Called to retrieve the provider of desktop notifications.
-    virtual WebNotificationPresenter* notificationPresenter() { return 0; }
+    virtual void printPage(WebLocalFrame*) { }
 
     // This method enumerates all the files in the path. It returns immediately
     // and asynchronously invokes the WebFileChooserCompletion with all the
@@ -147,29 +126,13 @@ public:
     // will never be called.
     virtual bool enumerateChosenDirectory(const WebString& path, WebFileChooserCompletion*) { return false; }
 
-    // Creates the main WebFrame for the specified WebHelperPlugin.
-    // Called by WebHelperPlugin to provide the WebFrameClient interface for the WebFrame.
-    virtual void initializeHelperPluginWebFrame(WebHelperPlugin*) { }
-
-    // Navigational --------------------------------------------------------
-
-    // These notifications bracket any loading that occurs in the WebView.
-    virtual void didStartLoading() { }
-    virtual void didStopLoading() { }
-
-    // Notification that some progress was made loading the current page.
-    // loadProgress is a value between 0 (nothing loaded) and 1.0 (frame fully
-    // loaded).
-    virtual void didChangeLoadProgress(WebFrame*, double loadProgress) { }
 
     // Editing -------------------------------------------------------------
 
     // These methods allow the client to intercept and overrule editing
     // operations.
     virtual void didCancelCompositionOnSelectionChange() { }
-    virtual void didChangeSelection(bool isSelectionEmpty) { }
     virtual void didChangeContents() { }
-    virtual void didExecuteCommand(const WebString& commandName) { }
 
     // This method is called in response to WebView's handleInputEvent()
     // when the default action for the current keyboard event is not
@@ -180,22 +143,8 @@ public:
     // indicating that the default action should be suppressed.
     virtual bool handleCurrentKeyboardEvent() { return false; }
 
-    // Dialogs -------------------------------------------------------------
-
-    // This method opens the color chooser and returns a new WebColorChooser
-    // instance. If there is a WebColorChooser already from the last time this
-    // was called, it ends the color chooser by calling endChooser, and replaces
-    // it with the new one. The given list of suggestions can be used to show a
-    // simple interface with a limited set of choices.
-
-    // FIXME: Should be removed when the chromium side change lands.
-    virtual WebColorChooser* createColorChooser(WebColorChooserClient*,
-                                                const WebColor&) { return 0; }
 
-    virtual WebColorChooser* createColorChooser(
-        WebColorChooserClient*,
-        const WebColor&,
-        const WebVector<WebColorSuggestion>&) { return 0; }
+    // Dialogs -------------------------------------------------------------
 
     // This method returns immediately after showing the dialog. When the
     // dialog is closed, it should call the WebFileChooserCompletion to
@@ -222,33 +171,6 @@ public:
     // Move the existing notifation popup to the new anchor position.
     virtual void moveValidationMessage(const WebRect& anchorInRootView) { }
 
-    // Displays a modal alert dialog containing the given message.  Returns
-    // once the user dismisses the dialog.
-    virtual void runModalAlertDialog(
-        WebFrame*, const WebString& message) { }
-
-    // Displays a modal confirmation dialog with the given message as
-    // description and OK/Cancel choices.  Returns true if the user selects
-    // 'OK' or false otherwise.
-    virtual bool runModalConfirmDialog(
-        WebFrame*, const WebString& message) { return false; }
-
-    // Displays a modal input dialog with the given message as description
-    // and OK/Cancel choices.  The input field is pre-filled with
-    // defaultValue.  Returns true if the user selects 'OK' or false
-    // otherwise.  Upon returning true, actualValue contains the value of
-    // the input field.
-    virtual bool runModalPromptDialog(
-        WebFrame*, const WebString& message, const WebString& defaultValue,
-        WebString* actualValue) { return false; }
-
-    // Displays a modal confirmation dialog containing the given message as
-    // description and OK/Cancel choices, where 'OK' means that it is okay
-    // to proceed with closing the view.  Returns true if the user selects
-    // 'OK' or false otherwise.
-    virtual bool runModalBeforeUnloadDialog(
-        WebFrame*, const WebString& message) { return true; }
-
 
     // UI ------------------------------------------------------------------
 
@@ -261,16 +183,8 @@ public:
     // Called when keyboard focus switches to an anchor with the given URL.
     virtual void setKeyboardFocusURL(const WebURL&) { }
 
-    // Shows a context menu with commands relevant to a specific element on
-    // the given frame. Additional context data is supplied.
-    virtual void showContextMenu(WebFrame*, const WebContextMenuData&) { }
-
-    // Called when the data attached to the currently displayed context menu is
-    // invalidated. The context menu may be closed if possible.
-    virtual void clearContextMenu() { }
-
     // Called when a drag-n-drop operation should begin.
-    virtual void startDragging(WebFrame*, const WebDragData&, WebDragOperationsMask, const WebImage&, const WebPoint& dragImageOffset) { }
+    virtual void startDragging(WebLocalFrame*, const WebDragData&, WebDragOperationsMask, const WebImage&, const WebPoint& dragImageOffset) { }
 
     // Called to determine if drag-n-drop operations may initiate a page
     // navigation.
@@ -284,8 +198,6 @@ public:
     // Called when a new node gets focused.
     virtual void focusedNodeChanged(const WebNode&) { }
 
-    virtual void numberOfWheelEventHandlersChanged(unsigned) { }
-
     // Indicates two things:
     //   1) This view may have a new layout now.
     //   2) Calling layout() is a no-op.
@@ -299,6 +211,7 @@ public:
     // Returns comma separated list of accept languages.
     virtual WebString acceptLanguages() { return WebString(); }
 
+
     // Session history -----------------------------------------------------
 
     // Tells the embedder to navigate back or forward in session history by
@@ -317,6 +230,7 @@ public:
     // Notifies embedder about an accessibility event.
     virtual void postAccessibilityEvent(const WebAXObject&, WebAXEvent) { }
 
+
     // Developer tools -----------------------------------------------------
 
     // Called to notify the client that the inspector's settings were
@@ -325,22 +239,13 @@ public:
 
     virtual void didUpdateInspectorSetting(const WebString& key, const WebString& value) { }
 
-    // Geolocation ---------------------------------------------------------
-
-    // Access the embedder API for (client-based) geolocation client .
-    virtual WebGeolocationClient* geolocationClient() { return 0; }
-    // Access the embedder API for (non-client-based) geolocation services.
-    virtual WebGeolocationService* geolocationService() { return 0; }
 
     // Speech --------------------------------------------------------------
 
-    // Access the embedder API for speech input services.
-    virtual WebSpeechInputController* speechInputController(
-        WebSpeechInputListener*) { return 0; }
-
     // Access the embedder API for speech recognition services.
     virtual WebSpeechRecognizer* speechRecognizer() { return 0; }
 
+
     // Zoom ----------------------------------------------------------------
 
     // Informs the browser that the zoom levels for this frame have changed from
@@ -351,11 +256,24 @@ public:
     // action that wasn't initiated by the client.
     virtual void zoomLevelChanged() { }
 
+
+    // Navigator Content Utils  --------------------------------------------
+
     // Registers a new URL handler for the given protocol.
     virtual void registerProtocolHandler(const WebString& scheme,
-                                         const WebString& baseUrl,
-                                         const WebString& url,
-                                         const WebString& title) { }
+        const WebURL& baseUrl,
+        const WebURL& url,
+        const WebString& title) { }
+
+    // Unregisters a given URL handler for the given protocol.
+    virtual void unregisterProtocolHandler(const WebString& scheme, const WebURL& baseUrl, const WebURL& url) { }
+
+    // Check if a given URL handler is registered for the given protocol.
+    virtual WebCustomHandlersState isProtocolHandlerRegistered(const WebString& scheme, const WebURL& baseUrl, const WebURL& url)
+    {
+        return WebCustomHandlersNew;
+    }
+
 
     // Visibility -----------------------------------------------------------
 
@@ -365,13 +283,10 @@ public:
         return WebPageVisibilityStateVisible;
     }
 
-    // Media Streams -------------------------------------------------------
-
-    virtual WebUserMediaClient* userMediaClient() { return 0; }
 
-    // Web MIDI -------------------------------------------------------------
+    // Push Messaging -------------------------------------------------------
 
-    virtual WebMIDIClient* webMIDIClient() { return 0; }
+    virtual WebPushClient* webPushClient() { return 0; }
 
 
     // Content detection ----------------------------------------------------
@@ -387,6 +302,7 @@ public:
     // Cancels any previously scheduled content intents that have not yet launched.
     virtual void cancelScheduledContentIntents() { }
 
+
     // Draggable regions ----------------------------------------------------
 
     // Informs the browser that the draggable regions have been updated.
diff --git a/chromium/third_party/WebKit/public/web/WebWidget.h b/chromium/third_party/WebKit/public/web/WebWidget.h
index d0b35d3f96f..54b00f3506d 100644
--- a/chromium/third_party/WebKit/public/web/WebWidget.h
+++ b/chromium/third_party/WebKit/public/web/WebWidget.h
@@ -41,6 +41,7 @@
 
 namespace blink {
 
+class WebCompositeAndReadbackAsyncCallback;
 class WebInputEvent;
 class WebLayerTreeView;
 class WebMouseEvent;
@@ -66,6 +67,13 @@ public:
     // Called to resize the WebWidget.
     virtual void resize(const WebSize&) { }
 
+    // Resizes the unscaled pinch viewport. Normally the unscaled pinch
+    // viewport is the same size as the main frame. The passed size becomes the
+    // size of the viewport when unscaled (i.e. scale = 1). This is used to
+    // shrink the visible viewport to allow things like the ChromeOS virtual
+    // keyboard to overlay over content but allow scrolling it into view.
+    virtual void resizePinchViewport(const WebSize&) { }
+
     // Ends a group of resize events that was started with a call to
     // willStartLiveResize.
     virtual void willEndLiveResize() { }
@@ -86,29 +94,6 @@ public:
     // and it may result in calls to WebWidgetClient::didInvalidateRect.
     virtual void layout() { }
 
-    // Called to toggle the WebWidget in or out of force compositing mode. This
-    // should be called before paint.
-    virtual void enterForceCompositingMode(bool enter) { }
-
-    // Called to notify the WebWidget that the widget has exited compositing
-    // mode and cannot reenter.
-    virtual void didExitCompositingMode() { }
-
-    enum PaintOptions {
-        // Attempt to fulfill the painting request by reading back from the
-        // compositor, assuming we're using a compositor to render.
-        ReadbackFromCompositorIfAvailable,
-
-        // Force the widget to rerender onto the canvas using software. This
-        // mode ignores 3d transforms and ignores GPU-resident content, such
-        // as video, canvas, and WebGL.
-        //
-        // Note: This option exists on OS(ANDROID) and will hopefully be
-        //       removed once the link disambiguation feature renders using
-        //       the compositor.
-        ForceSoftwareRenderingAndIgnoreGPUResidentContent,
-    };
-
     // Called to paint the rectangular region within the WebWidget
     // onto the specified canvas at (viewPort.x,viewPort.y). You MUST call
     // Layout before calling this method. It is okay to call paint
@@ -116,7 +101,14 @@ public:
     // changes are made to the WebWidget (e.g., once events are
     // processed, it should be assumed that another call to layout is
     // warranted before painting again).
-    virtual void paint(WebCanvas*, const WebRect& viewPort, PaintOptions = ReadbackFromCompositorIfAvailable) { }
+    virtual void paint(WebCanvas*, const WebRect& viewPort) { }
+
+    virtual void paintCompositedDeprecated(WebCanvas*, const WebRect&) { }
+
+    // The caller is responsible for keeping the WebCompositeAndReadbackAsyncCallback
+    // object alive until it is called. This should only be called when
+    // isAcceleratedCompositingActive() is true.
+    virtual void compositeAndReadbackAsync(WebCompositeAndReadbackAsyncCallback*) { }
 
     // Returns true if we've started tracking repaint rectangles.
     virtual bool isTrackingRepaints() const { return false; }
@@ -226,8 +218,6 @@ public:
     virtual bool isPagePopup() const { return false; }
     // Returns true if the WebWidget created is of type WebPopupMenu.
     virtual bool isPopupMenu() const { return false; }
-    // Returns true if the WebWidget created is of type WebHelperPlugin.
-    virtual bool isHelperPlugin() const { return false; }
 
     // The WebLayerTreeView initialized on this WebWidgetClient will be going away and
     // is no longer safe to access.
diff --git a/chromium/third_party/WebKit/public/web/WebWidgetClient.h b/chromium/third_party/WebKit/public/web/WebWidgetClient.h
index cbc98b8a3f3..277e84a14c4 100644
--- a/chromium/third_party/WebKit/public/web/WebWidgetClient.h
+++ b/chromium/third_party/WebKit/public/web/WebWidgetClient.h
@@ -58,12 +58,6 @@ public:
     // Called when the Widget has changed size as a result of an auto-resize.
     virtual void didAutoResize(const WebSize& newSize) { }
 
-    // Called when the compositor is enabled or disabled. The parameter to
-    // didActivateCompositor() is meaningless.
-    // FIXME: Remove parameter from didActivateCompositor().
-    virtual void didActivateCompositor(int deprecated) { }
-    virtual void didDeactivateCompositor() { }
-
     // Attempt to initialize compositing for this widget. If this is successful,
     // layerTreeView() will return a valid WebLayerTreeView.
     virtual void initializeLayerTreeView() { }
@@ -71,6 +65,8 @@ public:
     // Return a compositing view used for this widget. This is owned by the
     // WebWidgetClient.
     virtual WebLayerTreeView* layerTreeView() { return 0; }
+    // FIXME: Remove all overrides of this and change layerTreeView() above to ASSERT_NOT_REACHED.
+    virtual bool allowsBrokenNullLayerTreeView() const { return false; }
 
     // Sometimes the WebWidget enters a state where it will generate a sequence
     // of invalidations that should not, by themselves, trigger the compositor
@@ -101,11 +97,6 @@ public:
     // Called when a call to WebWidget::animate is required
     virtual void scheduleAnimation() { }
 
-    // Called to query the state of the rendering back-end. Should return true
-    // when scheduleAnimation (or possibly some other cause for another frame)
-    // was called, but before WebWidget::animate actually does a frame.
-    virtual bool isCompositorFramePending() const { return false; }
-
     // Called when the widget acquires or loses focus, respectively.
     virtual void didFocus() { }
     virtual void didBlur() { }
@@ -182,6 +173,10 @@ public:
     // of the touch actions that are permitted for this touch.
     virtual void setTouchAction(WebTouchAction touchAction) { }
 
+    // Called when value of focused text field gets dirty, e.g. value is
+    // modified by script, not by user input.
+    virtual void didUpdateTextOfFocusedElementByNonUserInput() { }
+
 protected:
     ~WebWidgetClient() { }
 };
diff --git a/chromium/third_party/WebKit/public/web/WebWorkerPermissionClientProxy.h b/chromium/third_party/WebKit/public/web/WebWorkerPermissionClientProxy.h
index cbb68242d08..eb420128a7b 100644
--- a/chromium/third_party/WebKit/public/web/WebWorkerPermissionClientProxy.h
+++ b/chromium/third_party/WebKit/public/web/WebWorkerPermissionClientProxy.h
@@ -31,8 +31,11 @@
 #ifndef WebWorkerPermissionClientProxy_h
 #define WebWorkerPermissionClientProxy_h
 
+#include "public/platform/WebPermissionCallbacks.h"
+
 namespace blink {
 
+class WebPermissionCallbacks;
 class WebString;
 
 // Proxy interface to talk to the document's PermissionClient implementation.
@@ -48,7 +51,7 @@ public:
         return true;
     }
 
-    virtual bool allowFileSystem()
+    virtual bool requestFileSystemAccessSync()
     {
         return true;
     }
diff --git a/chromium/third_party/WebKit/public/web/android/DEPS b/chromium/third_party/WebKit/public/web/android/DEPS
new file mode 100644
index 00000000000..6a8ad02cebf
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/android/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+    "+..",
+]
diff --git a/chromium/third_party/WebKit/public/web/android/WebInputEventFactory.h b/chromium/third_party/WebKit/public/web/android/WebInputEventFactory.h
deleted file mode 100644
index 22b0affbeeb..00000000000
--- a/chromium/third_party/WebKit/public/web/android/WebInputEventFactory.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebInputEventFactory_h
-#define WebInputEventFactory_h
-
-#include "../../platform/WebCommon.h"
-#include "../WebInputEvent.h"
-
-namespace blink {
-
-class WebKeyboardEvent;
-
-class WebInputEventFactory {
-public:
-    enum MouseEventType {
-        MouseEventTypeDown = 0,
-        MouseEventTypeUp,
-        MouseEventTypeMove,
-    };
-
-    enum MouseWheelDirectionType {
-        MouseWheelDirectionTypeUp = 0,
-        MouseWheelDirectionTypeDown,
-        MouseWheelDirectionTypeLeft,
-        MouseWheelDirectionTypeRight,
-    };
-
-    BLINK_EXPORT static WebKeyboardEvent keyboardEvent(WebInputEvent::Type,
-                                                        int modifiers,
-                                                        double timeStampSeconds,
-                                                        int keycode,
-                                                        WebUChar unicodeCharacter,
-                                                        bool isSystemKey);
-
-    BLINK_EXPORT static WebMouseEvent mouseEvent(MouseEventType,
-                                                  WebMouseEvent::Button,
-                                                  double timeStampSeconds,
-                                                  int windowX,
-                                                  int windowY,
-                                                  int modifiers,
-                                                  int clickCount);
-
-    BLINK_EXPORT static WebMouseWheelEvent mouseWheelEvent(MouseWheelDirectionType,
-                                                            double timeStampSeconds,
-                                                            int windowX,
-                                                            int windowY);
-
-    BLINK_EXPORT static WebGestureEvent gestureEvent(WebInputEvent::Type,
-                                                      double timeStampSeconds,
-                                                      int x,
-                                                      int y,
-                                                      float deltaX,
-                                                      float deltaY,
-                                                      int modifiers);
-
-    BLINK_EXPORT static WebGestureEvent gestureEvent(WebInputEvent::Type,
-                                                      double timeStampSeconds,
-                                                      int x,
-                                                      int y,
-                                                      int modifiers);
-
-    BLINK_EXPORT static bool isSystemKeyEvent(const WebKeyboardEvent&);
-};
-
-} // namespace blink
-
-#endif
diff --git a/chromium/third_party/WebKit/public/web/mac/WebInputEventFactory.h b/chromium/third_party/WebKit/public/web/mac/WebInputEventFactory.h
index 5aad96d2280..93621bf6085 100644
--- a/chromium/third_party/WebKit/public/web/mac/WebInputEventFactory.h
+++ b/chromium/third_party/WebKit/public/web/mac/WebInputEventFactory.h
@@ -53,7 +53,7 @@ public:
     BLINK_EXPORT static WebKeyboardEvent keyboardEvent(NSEvent*);
     BLINK_EXPORT static WebKeyboardEvent keyboardEvent(wchar_t character, int modifiers, double timeStampSeconds);
     BLINK_EXPORT static WebMouseEvent mouseEvent(NSEvent*, NSView*);
-    BLINK_EXPORT static WebMouseWheelEvent mouseWheelEvent(NSEvent*, NSView*);
+    BLINK_EXPORT static WebMouseWheelEvent mouseWheelEvent(NSEvent*, NSView*, bool canRubberbandLeft, bool canRubberbandRight);
     BLINK_EXPORT static WebGestureEvent gestureEvent(NSEvent *, NSView *);
     BLINK_EXPORT static bool isSystemKeyEvent(const WebKeyboardEvent&);
 };
diff --git a/chromium/third_party/WebKit/public/web/mac/WebScrollbarTheme.h b/chromium/third_party/WebKit/public/web/mac/WebScrollbarTheme.h
index 66cff89944e..50b543b54d8 100644
--- a/chromium/third_party/WebKit/public/web/mac/WebScrollbarTheme.h
+++ b/chromium/third_party/WebKit/public/web/mac/WebScrollbarTheme.h
@@ -35,16 +35,22 @@
 
 namespace blink {
 
+// This enum must match NSScrollerStyle in the 10.7 SDK.
+enum ScrollerStyle {
+    ScrollerStyleLegacy  = 0,
+    ScrollerStyleOverlay = 1
+};
+
 class WebScrollbarTheme {
 public:
     // Updates the scrollbar appearance and behavior.
     // |initialButtonDelay| is the current value of NSScrollerButtonDelay from NSUserDefaults.
     // |autoscrollButtonDelay| is the current value of NSScrollerButtonPeriod from NSUserDefaults.
-    // |jumpOnTrackClick| is the current value of AppleScrollerPagingBehavior from NSUserDefaults.
+    // |preferredScrollerStyle| is the current value of +[NSScroller preferredScrollerStyle].
     // |redraw| is true if the update requires a redraw to include the change.
     BLINK_EXPORT static void updateScrollbars(
         float initialButtonDelay, float autoscrollButtonDelay,
-        bool jumpOnTrackClick, bool redraw);
+        ScrollerStyle preferredScrollerStyle, bool redraw);
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/public/web/mac/WebSubstringUtil.h b/chromium/third_party/WebKit/public/web/mac/WebSubstringUtil.h
index 3668cfb2ff9..730036d7481 100644
--- a/chromium/third_party/WebKit/public/web/mac/WebSubstringUtil.h
+++ b/chromium/third_party/WebKit/public/web/mac/WebSubstringUtil.h
@@ -32,9 +32,11 @@
 #define WebSubstringUtil_h
 
 #include "../../platform/WebCommon.h"
+#include "public/web/WebFrame.h"
 
 namespace blink {
-class WebFrame;
+class WebView;
+struct WebPoint;
 }
 
 #if __OBJC__
@@ -47,9 +49,17 @@ namespace blink {
 
 class WebSubstringUtil {
 public:
+    // Returns an autoreleased NSAttributedString that is the word under
+    // the given point, or nil on error.
+    // Upon return, |baselinePoint| is set to the left baseline point in
+    // AppKit coordinates.
+    BLINK_EXPORT static NSAttributedString* attributedWordAtPoint(WebView*,
+        WebPoint,
+        WebPoint& baselinePoint);
+
     // Returns an autoreleased NSAttributedString that is a substring of the
     // Frame at the given range, or nil on error.
-    BLINK_EXPORT static NSAttributedString* attributedSubstringInRange(WebFrame*,
+    BLINK_EXPORT static NSAttributedString* attributedSubstringInRange(WebLocalFrame*,
         size_t location,
         size_t length);
 };
diff --git a/chromium/third_party/WebKit/public/web/win/WebFontRendering.h b/chromium/third_party/WebKit/public/web/win/WebFontRendering.h
new file mode 100644
index 00000000000..45229845d6d
--- /dev/null
+++ b/chromium/third_party/WebKit/public/web/win/WebFontRendering.h
@@ -0,0 +1,25 @@
+// Copyright 2014 Google Inc. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebFontRendering_h
+#define WebFontRendering_h
+
+#include "public/platform/WebCommon.h"
+
+class SkTypeface;
+struct IDWriteFactory;
+
+namespace blink {
+
+class WebFontRendering {
+public:
+    BLINK_EXPORT static void setUseDirectWrite(bool);
+    BLINK_EXPORT static void setDirectWriteFactory(IDWriteFactory*);
+    BLINK_EXPORT static void setUseSubpixelPositioning(bool);
+    BLINK_EXPORT static void addSideloadedFontForTesting(SkTypeface*);
+};
+
+} // namespace blink
+
+#endif
diff --git a/chromium/third_party/WebKit/public/web/win/WebInputEventFactory.h b/chromium/third_party/WebKit/public/web/win/WebInputEventFactory.h
deleted file mode 100644
index 0dbebc43c03..00000000000
--- a/chromium/third_party/WebKit/public/web/win/WebInputEventFactory.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebInputEventFactory_h
-#define WebInputEventFactory_h
-
-#include "../../platform/WebCommon.h"
-
-#include <windows.h>
-
-namespace blink {
-
-class WebKeyboardEvent;
-class WebMouseEvent;
-class WebMouseWheelEvent;
-
-class WebInputEventFactory {
-public:
-    BLINK_EXPORT static WebKeyboardEvent keyboardEvent(HWND, UINT, WPARAM, LPARAM);
-    BLINK_EXPORT static WebMouseEvent mouseEvent(HWND, UINT, WPARAM, LPARAM);
-    BLINK_EXPORT static WebMouseWheelEvent mouseWheelEvent(HWND, UINT, WPARAM, LPARAM);
-
-    // Windows only provides information on whether a click was a single or
-    // double click, while we need to know the click count past two. The
-    // WebInputEventFactory keeps internal state to allow it to synthesize
-    // that information. In some cases, like fast-running tests, that
-    // information is known to be stale and needs to be reset; that is the
-    // function of resetLastClickState().
-    BLINK_EXPORT static void resetLastClickState();
-    BLINK_EXPORT static bool isSystemKeyEvent(const WebKeyboardEvent&);
-};
-
-} // namespace blink
-
-#endif
author	Jocelyn Turcotte <jocelyn.turcotte@digia.com>	2014-08-08 14:30:41 +0200
committer	Jocelyn Turcotte <jocelyn.turcotte@digia.com>	2014-08-12 13:49:54 +0200
commit	ab0a50979b9eb4dfa3320eff7e187e41efedf7a9 (patch)
tree	498dfb8a97ff3361a9f7486863a52bb4e26bb898 /chromium/third_party/WebKit/public/web
parent	4ce69f7403811819800e7c5ae1318b2647e778d1 (diff)