Merge the chrome_webkit_merge_branch back on to trunk. This brings us

up to webkit@36102.


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@2778 0039d316-1c4b-4281-b951-d872f2087c98

45 files changed, 388 insertions, 445 deletions

diff --git a/webkit/glue/autocomplete_input_listener_unittest.cc b/webkit/glue/autocomplete_input_listener_unittest.cc
index eee6856..b33d42a 100644
--- a/webkit/glue/autocomplete_input_listener_unittest.cc
+++ b/webkit/glue/autocomplete_input_listener_unittest.cc
@@ -30,6 +30,8 @@
 using webkit_glue::AutocompleteInputListener;
 using webkit_glue::AutocompleteEditDelegate;
 
+using WebCore::Event;
+
 class TestAutocompleteEditDelegate : public AutocompleteEditDelegate {
  public:
   TestAutocompleteEditDelegate() : caret_at_end_(false) {
@@ -106,8 +108,9 @@ class DomAutocompleteTests : public testing::Test {
   }
 
   void FireAndHandleInputEvent(AutocompleteInputListener* listener) {
-    WebCore::Event event(WebCore::EventNames::inputEvent, false, false);
-    listener->handleEvent(&event, false);
+    RefPtr<Event> event(Event::create(WebCore::EventNames::inputEvent,
+                                      false, false));
+    listener->handleEvent(event.get(), false);
   }
 
   void SimulateTypedInput(TestAutocompleteEditDelegate* delegate,
@@ -124,8 +127,9 @@ TEST_F(DomAutocompleteTests, OnBlur) {
   // Simulate a blur event and ensure it is properly dispatched.
   // Listener takes ownership of its delegate.
   TestAutocompleteInputListener listener(new TestAutocompleteEditDelegate());
-  WebCore::Event event(WebCore::EventNames::DOMFocusOutEvent, false, false);
-  listener.handleEvent(&event, false);
+  RefPtr<Event> event(Event::create(WebCore::EventNames::DOMFocusOutEvent,
+                                    false, false));
+  listener.handleEvent(event.get(), false);
   EXPECT_TRUE(listener.blurred());
 }
 
diff --git a/webkit/glue/chrome_client_impl.cc b/webkit/glue/chrome_client_impl.cc
index 3711abf..e44e48b 100644
--- a/webkit/glue/chrome_client_impl.cc
+++ b/webkit/glue/chrome_client_impl.cc
@@ -12,6 +12,7 @@
 #include "HitTestResult.h"
 #include "IntRect.h"
 #include "Page.h"
+#include "ScriptController.h"
 #include "WindowFeatures.h"
 #pragma warning(pop)
 #undef LOG
@@ -145,7 +146,7 @@ WebCore::Page* ChromeClientImpl::createWindow(
   if (!d)
     return NULL;
 
-  bool userGesture = frame->scriptBridge()->wasRunByUserGesture();
+  bool userGesture = frame->script()->processingUserGesture();
   WebViewImpl* new_view = static_cast<WebViewImpl*>(
       d->CreateWebView(webview_, userGesture));
   if (!new_view)
diff --git a/webkit/glue/context_menu_client_impl.cc b/webkit/glue/context_menu_client_impl.cc
index 824ccf1..fe287bf 100644
--- a/webkit/glue/context_menu_client_impl.cc
+++ b/webkit/glue/context_menu_client_impl.cc
@@ -81,7 +81,7 @@ static std::wstring GetMisspelledWord(WebCore::ContextMenu* default_menu,
   }
         
   if (selected_frame->shouldChangeSelection(selection))
-    selected_frame->selectionController()->setSelection(selection);
+    selected_frame->selection()->setSelection(selection);
        
   misspelled_word_string = CollapseWhitespace(
       webkit_glue::StringToStdWString(selected_frame->selectedText()),                  
diff --git a/webkit/glue/cpp_bound_class.cc b/webkit/glue/cpp_bound_class.cc
index b77aa4a..5a4c8c9 100644
--- a/webkit/glue/cpp_bound_class.cc
+++ b/webkit/glue/cpp_bound_class.cc
@@ -22,7 +22,7 @@
 #pragma warning(disable:4067)
 #include "npruntime_priv.h"
 
-#if USE(JAVASCRIPTCORE_BINDINGS)
+#if USE(JSC)
 #pragma warning(push, 0)
 #include "JSLock.h"
 #pragma warning(pop)
@@ -146,7 +146,7 @@ CppBoundClass::~CppBoundClass() {
   // Unregister objects we created and bound to a frame.
   for (BoundObjectList::iterator i = bound_objects_.begin(); 
       i != bound_objects_.end(); ++i) {
-#if USE(V8_BINDING)
+#if USE(V8)
     _NPN_UnregisterObject(*i);
 #endif
     NPN_ReleaseObject(*i);
@@ -236,7 +236,7 @@ bool CppBoundClass::IsMethodRegistered(std::string name) {
 
 void CppBoundClass::BindToJavascript(WebFrame* frame,
                                      const std::wstring& classname) {
-#if USE(JAVASCRIPTCORE_BINDINGS)
+#if USE(JSC)
   KJS::JSLock lock;
 #endif
 
diff --git a/webkit/glue/cpp_variant.cc b/webkit/glue/cpp_variant.cc
index efa90e7..076998f 100644
--- a/webkit/glue/cpp_variant.cc
+++ b/webkit/glue/cpp_variant.cc
@@ -12,7 +12,7 @@
 
 #include "npruntime_priv.h" // for NPN_InitializeVariantWithStringCopy
 
-#if USE(JAVASCRIPTCORE_BINDINGS)
+#if USE(JSC)
 #define _NPN_InitializeVariantWithStringCopy NPN_InitializeVariantWithStringCopy
 #endif
 
diff --git a/webkit/glue/cpp_variant_unittest.cc b/webkit/glue/cpp_variant_unittest.cc
index a323d1b..f8d0e27 100644
--- a/webkit/glue/cpp_variant_unittest.cc
+++ b/webkit/glue/cpp_variant_unittest.cc
@@ -11,7 +11,7 @@
 #include "npruntime_priv.h"  // for NPN_InitializeVariantWithStringCopy
 #pragma warning(pop)
 
-#if USE(JAVASCRIPTCORE_BINDINGS)
+#if USE(JSC)
 #define _NPN_InitializeVariantWithStringCopy NPN_InitializeVariantWithStringCopy
 #endif
 
diff --git a/webkit/glue/debugger.cc b/webkit/glue/debugger.cc
index 3286bcd..9c5dffe 100644
--- a/webkit/glue/debugger.cc
+++ b/webkit/glue/debugger.cc
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "config.h"  // webkit config for V8_BINDING
+#include "config.h"  // webkit config for V8
 #include "base/string_util.h"
 #include "webkit/glue/debugger.h"
 
-#if USE(V8_BINDING)
+#if USE(V8)
 #define USING_V8
 #include "v8/include/v8-debug.h"
 #endif
diff --git a/webkit/glue/dom_operations.cc b/webkit/glue/dom_operations.cc
index 923bf37..15f95d9 100644
--- a/webkit/glue/dom_operations.cc
+++ b/webkit/glue/dom_operations.cc
@@ -87,8 +87,7 @@ void GetSavableResourceLinkForElement(WebCore::Element* element,
   if (!value)
     return;
   // Get absolute URL.
-  GURL u(webkit_glue::KURLToGURL(current_doc->completeURL((*value).
-                                 deprecatedString())));
+  GURL u(webkit_glue::KURLToGURL(current_doc->completeURL((*value).string())));
   // ignore invalid URL
   if (!u.is_valid())
     return;
@@ -104,8 +103,7 @@ void GetSavableResourceLinkForElement(WebCore::Element* element,
   // Insert referrer for above new resource link.
   if (current_doc->frame()) {
     GURL u(webkit_glue::KURLToGURL(
-        current_doc->frame()->loader()->outgoingReferrer().
-        deprecatedString()));
+        WebCore::KURL(current_doc->frame()->loader()->outgoingReferrer())));
     result->referrers_list->push_back(u);
   } else {
     // Insert blank referrer.
@@ -505,7 +503,7 @@ const WebCore::AtomicString* GetSubResourceLinkFromElement(
   // If value has content and not start with "javascript:" then return it,
   // otherwise return NULL.
   if (value && !value->isEmpty() &&
-      !value->domString().startsWith("javascript:", false))
+      !value->startsWith("javascript:", false))
     return value;
 
   return NULL;
diff --git a/webkit/glue/dom_serializer.cc b/webkit/glue/dom_serializer.cc
index 1fed9fe..2afbe4c 100644
--- a/webkit/glue/dom_serializer.cc
+++ b/webkit/glue/dom_serializer.cc
@@ -62,6 +62,7 @@
 #include "HTMLMetaElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "markup.h"
 #include "PlatformString.h"
 #include "TextEncoding.h"
 #pragma warning(pop)
@@ -202,9 +203,7 @@ WebCore::String DomSerializer::PreActionBeforeSerializeOpenTag(
       // First we add doc type declaration if original doc has it.
       if (!param->has_doctype) {
         param->has_doctype = true;
-        WebCore::DocumentType* doc_type = param->doc->doctype();
-        if (doc_type)
-          result += doc_type->toString();
+        result += createMarkup(param->doc->doctype());
       }
 
       // Add MOTW declaration before html tag.
@@ -236,9 +235,7 @@ WebCore::String DomSerializer::PreActionBeforeSerializeOpenTag(
     // Add doc type declaration if original doc has it.
     if (!param->has_doctype) {
       param->has_doctype = true;
-      WebCore::DocumentType* doc_type = param->doc->doctype();
-      if (doc_type)
-        result += doc_type->toString();
+      result += createMarkup(param->doc->doctype());
     }
   }
 
@@ -323,12 +320,8 @@ void DomSerializer::SaveHtmlContentToBuffer(const WebCore::String& result,
   if (!result.length())
     return;
   // Convert the unicode content to target encoding
-  const UChar* ucode = result.characters();
-  // If the text encoding can not convert some unicode character to
-  // corresponding code, we allow using entity notation to replace
-  // the unicode character.
-  WebCore::CString encoding_result = param->text_encoding.encode(ucode,
-      result.length(), true);
+  WebCore::CString encoding_result = param->text_encoding.encode(
+      result.characters(), result.length(), WebCore::EntitiesForUnencodables);
 
   // if the data buffer will be full, then send it out first.
   if (encoding_result.length() + data_buffer_.size() >
@@ -461,22 +454,7 @@ void DomSerializer::BuildContentForNode(const WebCore::Node* node,
       break;
     }
     case WebCore::Node::TEXT_NODE: {
-      WebCore::String result;
-      WebCore::String s = node->toString();
-      if (param->is_html_document) {
-        // For html document, do not convert entity notation in code
-        // block of style tag and script tag.
-        if (param->is_in_script_or_style_tag)
-          result += s;
-        else
-          ConvertCorrespondingSymbolToEntity(&result, s,
-              param->is_html_document);
-      } else {
-        ConvertCorrespondingSymbolToEntity(&result, s,
-            param->is_html_document);
-      }
-
-      SaveHtmlContentToBuffer(result, param);
+      SaveHtmlContentToBuffer(createMarkup(node), param);
       break;
     }
     case WebCore::Node::ATTRIBUTE_NODE:
@@ -491,7 +469,7 @@ void DomSerializer::BuildContentForNode(const WebCore::Node* node,
       param->has_doctype = true;
     default: {
       // For other type node, call default action.
-      SaveHtmlContentToBuffer(node->toString(), param);
+      SaveHtmlContentToBuffer(createMarkup(node), param);
       break;
     }
   }
diff --git a/webkit/glue/dom_serializer_unittest.cc b/webkit/glue/dom_serializer_unittest.cc
index 662105e..da9d957 100644
--- a/webkit/glue/dom_serializer_unittest.cc
+++ b/webkit/glue/dom_serializer_unittest.cc
@@ -14,6 +14,7 @@
 #include "HTMLMetaElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "markup.h"
 #include "SharedBuffer.h"
 #include "SubstituteData.h"
 #pragma warning(pop)
@@ -111,7 +112,7 @@ class DomSerializerTests : public TestShellTest,
       ASSERT_TRUE(web_frame != NULL);
       int len = static_cast<int>(contents.size());
       RefPtr<WebCore::SharedBuffer> buf(
-          new WebCore::SharedBuffer(contents.data(), len));
+          WebCore::SharedBuffer::create(contents.data(), len));
 
       WebCore::SubstituteData subst_data(
           buf, WebCore::String("text/html"), encoding_info, WebCore::KURL());
@@ -317,7 +318,7 @@ TEST_F(DomSerializerTests, SerialzeXMLDocWithBuiltInEntities) {
   ASSERT_TRUE(HasSerializedFrame(page_url));
   const std::string& serialized_contents =
       GetSerializedContentForFrame(page_url);
-  ASSERT_EQ(serialized_contents, orginal_contents);
+  ASSERT_EQ(orginal_contents, serialized_contents);
 }
 
 // When serializing DOM, we add MOTW declaration before html tag.
@@ -506,7 +507,7 @@ TEST_F(DomSerializerTests, SerialzeHTMLDOMWithEntitiesInText) {
   ASSERT_TRUE(body_ele != NULL);
   WebCore::Node* text_node = body_ele->firstChild();
   ASSERT_TRUE(text_node->isTextNode());
-  ASSERT_TRUE(text_node->toString() == WebCore::String("&<>\"\'"));
+  ASSERT_TRUE(createMarkup(text_node) == "&amp;&lt;&gt;\"\'");
   // Do serialization.
   SerializeDomForURL(page_url, false);
   // Compare the serialized contents with original contents.
@@ -518,7 +519,7 @@ TEST_F(DomSerializerTests, SerialzeHTMLDOMWithEntitiesInText) {
   std::wstring motw_declaration =
     webkit_glue::DomSerializer::GenerateMarkOfTheWebDeclaration(page_url);
   orginal_contents = WideToASCII(motw_declaration) + orginal_contents;
-  ASSERT_EQ(serialized_contents, orginal_contents);
+  ASSERT_EQ(orginal_contents, serialized_contents);
 }
 
 // Test situation of html entities in attribute value when serializing
@@ -606,12 +607,12 @@ TEST_F(DomSerializerTests, SerialzeHTMLDOMWithBaseTag) {
           webkit_glue::GetSubResourceLinkFromElement(element);
       if (!value && element->hasTagName(WebCore::HTMLNames::aTag)) {
         value = &element->getAttribute(WebCore::HTMLNames::hrefAttr);
-        if (value->domString().isEmpty())
+        if (value->isEmpty())
           value = NULL;
       }
       // Each link is relative link.
       if (value) {
-        GURL link(webkit_glue::StringToStdWString(value->domString()).c_str());
+        GURL link(webkit_glue::StringToStdWString(value->string()).c_str());
         ASSERT_TRUE(link.scheme().empty());
       }
     }
@@ -620,7 +621,7 @@ TEST_F(DomSerializerTests, SerialzeHTMLDOMWithBaseTag) {
   // Make sure in original document, the base URL is not equal with the
   // |path_dir_url|.
   GURL original_base_url(
-      webkit_glue::DeprecatedStringToStdWString(doc->baseURL()).c_str());
+      webkit_glue::StringToStdWString(doc->baseURL()).c_str());
   ASSERT_TRUE(original_base_url != path_dir_url);
 
   // Do serialization.
@@ -657,12 +658,12 @@ TEST_F(DomSerializerTests, SerialzeHTMLDOMWithBaseTag) {
           webkit_glue::GetSubResourceLinkFromElement(element);
       if (!value && element->hasTagName(WebCore::HTMLNames::aTag)) {
         value = &element->getAttribute(WebCore::HTMLNames::hrefAttr);
-        if (value->domString().isEmpty())
+        if (value->isEmpty())
           value = NULL;
       }
       // Each link is absolute link.
       if (value) {
-        GURL link(webkit_glue::StringToStdWString(value->domString()).c_str());
+        GURL link(webkit_glue::StringToStdWString(value->string()).c_str());
         ASSERT_FALSE(link.scheme().empty());
       }
     }
@@ -671,6 +672,6 @@ TEST_F(DomSerializerTests, SerialzeHTMLDOMWithBaseTag) {
   ASSERT_TRUE(new_base_tag_count == original_base_tag_count + 1);
   // Make sure in new document, the base URL is equal with the |path_dir_url|.
   GURL new_base_url(
-    webkit_glue::DeprecatedStringToStdWString(doc->baseURL()).c_str());
+    webkit_glue::StringToStdWString(doc->baseURL()).c_str());
   ASSERT_TRUE(new_base_url == path_dir_url);
 }
diff --git a/webkit/glue/editor_client_impl.cc b/webkit/glue/editor_client_impl.cc
index 7aebe06..a3f10e8 100644
--- a/webkit/glue/editor_client_impl.cc
+++ b/webkit/glue/editor_client_impl.cc
@@ -160,7 +160,7 @@ bool EditorClientImpl::shouldInsertNode(WebCore::Node* node,
   return true;
 }
 
-bool EditorClientImpl::shouldInsertText(WebCore::String text,
+bool EditorClientImpl::shouldInsertText(const WebCore::String& text,
                                         WebCore::Range* range,
                                         WebCore::EditorInsertAction action) {
   if (use_editor_delegate_) {
@@ -506,7 +506,7 @@ const char* EditorClientImpl::interpretKeyEvent(
 
   if (evt->type() == WebCore::EventNames::keydownEvent) {
     int mapKey = modifiers << 16 | evt->keyCode();
-      return mapKey ? keyDownCommandsMap->get(mapKey) : 0;
+    return mapKey ? keyDownCommandsMap->get(mapKey) : 0;
   }
 
   int mapKey = modifiers << 16 | evt->charCode();
diff --git a/webkit/glue/editor_client_impl.h b/webkit/glue/editor_client_impl.h
index a9878e2..8ece82f 100644
--- a/webkit/glue/editor_client_impl.h
+++ b/webkit/glue/editor_client_impl.h
@@ -42,7 +42,7 @@ class EditorClientImpl : public WebCore::EditorClient {
   virtual bool shouldEndEditing(WebCore::Range* range);
   virtual bool shouldInsertNode(WebCore::Node* node, WebCore::Range* range,
                                 WebCore::EditorInsertAction action);
-  virtual bool shouldInsertText(WebCore::String text, WebCore::Range* range,
+  virtual bool shouldInsertText(const WebCore::String& text, WebCore::Range* range,
                                 WebCore::EditorInsertAction action);
   virtual bool shouldDeleteRange(WebCore::Range* range);
   virtual bool shouldChangeSelectedRange(WebCore::Range* fromRange, 
diff --git a/webkit/glue/event_conversion.cc b/webkit/glue/event_conversion.cc
index d3e37b6..ba5d418 100644
--- a/webkit/glue/event_conversion.cc
+++ b/webkit/glue/event_conversion.cc
@@ -135,6 +135,10 @@ MakePlatformWheelEvent::MakePlatformWheelEvent(Widget* widget,
   m_globalPosition = IntPoint(e.global_x, e.global_y);
   m_deltaX = static_cast<float>(e.delta_x);
   m_deltaY = static_cast<float>(e.delta_y);
+  m_charsToScrollPerDelta = 1;
+  m_linesToScrollPerDelta = 1;
+  m_pageXScrollMode = false;
+  m_pageYScrollMode = false;
   m_shiftKey = (e.modifiers & WebInputEvent::SHIFT_KEY) != 0;
   m_ctrlKey = (e.modifiers & WebInputEvent::CTRL_KEY) != 0;
   m_altKey = (e.modifiers & WebInputEvent::ALT_KEY) != 0;
diff --git a/webkit/glue/glue_serialize.cc b/webkit/glue/glue_serialize.cc
index 6ec5e7f..925da42 100644
--- a/webkit/glue/glue_serialize.cc
+++ b/webkit/glue/glue_serialize.cc
@@ -200,12 +200,12 @@ static void WriteFormData(const FormData* form_data, SerializeObject* obj) {
   }
 }
 
-static FormData* ReadFormData(const SerializeObject* obj) {
+static PassRefPtr<FormData> ReadFormData(const SerializeObject* obj) {
   int num_elements = ReadInteger(obj);
   if (num_elements == 0)
     return NULL;
 
-  FormData* form_data = new FormData();
+  RefPtr<FormData> form_data = FormData::create();
 
   for (int i = 0; i < num_elements; ++i) {
     int type = ReadInteger(obj);
@@ -219,7 +219,7 @@ static FormData* ReadFormData(const SerializeObject* obj) {
     }
   }
 
-  return form_data;
+  return form_data.release();
 }
 
 // Writes the HistoryItem data into the SerializeObject object for
@@ -259,14 +259,14 @@ static void WriteHistoryItem(const HistoryItem* item, SerializeObject* obj) {
 
 // Creates a new HistoryItem tree based on the serialized string.
 // Assumes the data is in the format returned by WriteHistoryItem.
-static HistoryItem* ReadHistoryItem(const SerializeObject* obj) {
+static PassRefPtr<HistoryItem> ReadHistoryItem(const SerializeObject* obj) {
   // See note in WriteHistoryItem. on this.
   obj->version = ReadInteger(obj);
 
   if (obj->version > kVersion)
     return NULL;
 
-  HistoryItem* item = new HistoryItem();
+  RefPtr<HistoryItem> item = HistoryItem::create();
 
   item->setURLString(ReadString(obj));
   item->setOriginalURLString(ReadString(obj));
@@ -302,7 +302,7 @@ static HistoryItem* ReadHistoryItem(const SerializeObject* obj) {
   for (int i = 0; i < num_children; ++i)
     item->addChildItem(ReadHistoryItem(obj));
 
-  return item;
+  return item.release();
 }
 
 // Serialize a HistoryItem to a string, using our JSON Value serializer.
@@ -351,7 +351,8 @@ void HistoryItemToVersionedString(PassRefPtr<HistoryItem> item, int version,
 }
 
 std::string CreateHistoryStateForURL(const GURL& url) {
-  RefPtr<HistoryItem> item(new HistoryItem(GURLToKURL(url), String()));
+  // TODO(eseide): We probably should be passing a list visit time other than 0
+  RefPtr<HistoryItem> item(HistoryItem::create(GURLToKURL(url), String(), 0));
   std::string data;
   HistoryItemToString(item, &data);
   return data;
diff --git a/webkit/glue/glue_serialize_unittest.cc b/webkit/glue/glue_serialize_unittest.cc
index 5ecf5bb..48bfb4c5 100644
--- a/webkit/glue/glue_serialize_unittest.cc
+++ b/webkit/glue/glue_serialize_unittest.cc
@@ -59,8 +59,8 @@ namespace {
 class GlueSerializeTest : public testing::Test {
  public:
   // Makes a FormData with some random data.
-  FormData* MakeFormData() {
-    FormData* form_data = new FormData();
+  PassRefPtr<FormData> MakeFormData() {
+    RefPtr<FormData> form_data = FormData::create();
 
     char d1[] = "first data block";
     form_data->appendData(d1, sizeof(d1)-1);
@@ -70,12 +70,12 @@ class GlueSerializeTest : public testing::Test {
     char d2[] = "data the second";
     form_data->appendData(d2, sizeof(d2)-1);
 
-    return form_data;
+    return form_data.release();
   }
 
   // Constructs a HistoryItem with some random data and an optional child.
   PassRefPtr<HistoryItem> MakeHistoryItem(bool with_form_data, bool pregnant) {
-    RefPtr<HistoryItem> item = new HistoryItem();
+    RefPtr<HistoryItem> item = HistoryItem::create();
 
     item->setURLString("urlString");
     item->setOriginalURLString("originalURLString");
@@ -98,8 +98,7 @@ class GlueSerializeTest : public testing::Test {
     // Form Data
     ResourceRequest dummy_request;  // only way to initialize HistoryItem
     if (with_form_data) {
-      FormData* form_data = MakeFormData();
-      dummy_request.setHTTPBody(form_data);
+      dummy_request.setHTTPBody(MakeFormData());
       dummy_request.setHTTPContentType("formContentType");
       dummy_request.setHTTPReferrer("formReferrer");
       dummy_request.setHTTPMethod("POST");
@@ -110,7 +109,7 @@ class GlueSerializeTest : public testing::Test {
     if (pregnant)
       item->addChildItem(MakeHistoryItem(false, false));
 
-    return item;
+    return item.release();
   }
 
   // Checks that a == b.
diff --git a/webkit/glue/glue_util.cc b/webkit/glue/glue_util.cc
index e2d40f6..ad2f2ce 100644
--- a/webkit/glue/glue_util.cc
+++ b/webkit/glue/glue_util.cc
@@ -10,7 +10,6 @@
 
 #pragma warning(push, 0)
 #include "CString.h"
-#include "DeprecatedString.h"
 #include "PlatformString.h"
 #pragma warning(pop)
 
@@ -66,43 +65,17 @@ WebCore::String StdStringToString(const std::string& str) {
   return WebCore::String(str.data(), static_cast<unsigned>(str.length()));
 }
 
-WebCore::DeprecatedString StdWStringToDeprecatedString(
-    const std::wstring& str) {
-#if defined(WCHAR_T_IS_UTF16)
-  return WebCore::DeprecatedString(
-      reinterpret_cast<const WebCore::DeprecatedChar*>(str.c_str()),
-      static_cast<int>(str.size()));
-#elif defined(WCHAR_T_IS_UTF32)
-  string16 str16 = WideToUTF16(str);
-  return WebCore::DeprecatedString(
-      reinterpret_cast<const WebCore::DeprecatedChar*>(str16.c_str()),
-      static_cast<int>(str16.size()));
-#endif
-}
-
-std::wstring DeprecatedStringToStdWString(
-    const WebCore::DeprecatedString& dep) {
-#if defined(WCHAR_T_IS_UTF16)
-  return std::wstring(reinterpret_cast<const wchar_t*>(dep.unicode()),
-                                                       dep.length());
-#elif defined(WCHAR_T_IS_UTF32)
-  string16 str16(reinterpret_cast<const char16*>(dep.unicode()),
-                                                       dep.length());
-  return UTF16ToWide(str16);
-#endif
-}
-
 // URL conversions -------------------------------------------------------------
 
 GURL KURLToGURL(const WebCore::KURL& url) {
 #ifdef USE_GOOGLE_URL_LIBRARY
   const WebCore::CString& spec = url.utf8String();
-  if (spec.isNull())
+  if (spec.isNull() || 0 == spec.length())
     return GURL();
   return GURL(spec.data(), spec.length(), url.parsed(), url.isValid());
 #else
-  const WebCore::DeprecatedString& spec = url.deprecatedString();
-  return GURL(WideToUTF8(DeprecatedStringToStdWString(spec))); 
+  const WebCore::String& spec = url.string();
+  return GURL(WideToUTF8(StringToStdWString(spec)));
 #endif
 }
 
@@ -113,7 +86,7 @@ WebCore::KURL GURLToKURL(const GURL& url) {
   return WebCore::KURL(spec.c_str(), static_cast<int>(spec.length()),
                        url.parsed_for_possibly_invalid_spec(), url.is_valid());
 #else
-  return WebCore::KURL(StdWStringToDeprecatedString(UTF8ToWide(spec)));
+  return WebCore::KURL(StdWStringToString(UTF8ToWide(spec)));
 #endif
 }
 
diff --git a/webkit/glue/glue_util.h b/webkit/glue/glue_util.h
index 2451a2d..c8303eb 100644
--- a/webkit/glue/glue_util.h
+++ b/webkit/glue/glue_util.h
@@ -12,7 +12,6 @@
 
 namespace WebCore {
   class CString;
-  class DeprecatedString;
   class KURL;
   class String;
 }
@@ -28,9 +27,6 @@ std::string StringToStdString(const WebCore::String& str);
 WebCore::String StdWStringToString(const std::wstring& str);
 WebCore::String StdStringToString(const std::string& str);
 
-WebCore::DeprecatedString StdWStringToDeprecatedString(const std::wstring& str);
-std::wstring DeprecatedStringToStdWString(const WebCore::DeprecatedString& dep);
-
 GURL KURLToGURL(const WebCore::KURL& url);
 WebCore::KURL GURLToKURL(const GURL& url);
 
diff --git a/webkit/glue/image_decoder.cc b/webkit/glue/image_decoder.cc
index 577b3183..b535fa1 100644
--- a/webkit/glue/image_decoder.cc
+++ b/webkit/glue/image_decoder.cc
@@ -45,7 +45,7 @@ SkBitmap ImageDecoder::Decode(const unsigned char* data, size_t size) {
 #elif defined(OS_MACOSX)
   WebCore::ImageSource source;
 #endif
-  WTF::RefPtr<WebCore::SharedBuffer> buffer(new WebCore::SharedBuffer(
+  WTF::RefPtr<WebCore::SharedBuffer> buffer(WebCore::SharedBuffer::create(
       data, static_cast<int>(size)));
 #if defined(OS_WIN)
   source.setData(buffer.get(), true,
diff --git a/webkit/glue/inspector_client_impl.cc b/webkit/glue/inspector_client_impl.cc
index 23ec5ed..4bd30236 100644
--- a/webkit/glue/inspector_client_impl.cc
+++ b/webkit/glue/inspector_client_impl.cc
@@ -129,6 +129,10 @@ void WebInspectorClient::detachWindow() {
   // TODO(jackson): Implement this
 }
 
+void WebInspectorClient::setAttachedWindowHeight(unsigned int height) {
+  // TODO(dglazkov): Implement this
+}
+
 static void invalidateNodeBoundingRect(WebViewImpl* web_view) {
   // TODO(ojan): http://b/1143996 Is it important to just invalidate the rect
   // of the node region given that this is not on a critical codepath?
diff --git a/webkit/glue/inspector_client_impl.h b/webkit/glue/inspector_client_impl.h
index 87e1e78..d34d0c7 100644
--- a/webkit/glue/inspector_client_impl.h
+++ b/webkit/glue/inspector_client_impl.h
@@ -27,6 +27,8 @@ public:
   virtual void attachWindow();
   virtual void detachWindow();
 
+  virtual void setAttachedWindowHeight(unsigned height);
+
   virtual void highlight(WebCore::Node*);
   virtual void hideHighlight();
 
diff --git a/webkit/glue/localized_strings.cc b/webkit/glue/localized_strings.cc
index 93d10bb..1d85676 100644
--- a/webkit/glue/localized_strings.cc
+++ b/webkit/glue/localized_strings.cc
@@ -32,8 +32,10 @@
 #include "webkit/glue/glue_util.h"
 #include "webkit/glue/webkit_glue.h"
 #include "base/logging.h"
+#include "base/file_util.h"
 #include "base/string_util.h"
 #include "build/build_config.h"
+#include "webkit/glue/glue_util.h"
 
 #if defined(OS_WIN)
 #include "webkit_strings.h"
@@ -70,7 +72,6 @@ String WebCore::fileButtonNoFileSelectedLabel() {
   return GetLocalizedString(IDS_FORM_FILE_NO_FILE_LABEL);
 }
 
-// TODO(tc): Do we actually plan on implementing search menu items?
 String WebCore::searchMenuNoRecentSearchesText() {
   return GetLocalizedString(IDS_RECENT_SEARCHES_NONE);
 }
@@ -117,6 +118,19 @@ String WebCore::AXLinkActionVerb() {
   return GetLocalizedString(IDS_AX_LINK_ACTION_VERB);
 }
 
+// Used in FTPDirectoryDocument.cpp
+String WebCore::unknownFileSizeText() {
+  return String();
+}
+
+// These two are used in FileChooserWin.cpp.
+String WebCore::uploadFileText() {
+  return String();
+}
+String WebCore::allFilesText() {
+  return String();
+}
+
 // The following two functions are not declared in LocalizedStrings.h.
 // They are used by the menu for the HTML keygen tag.
 namespace WebCore {
@@ -126,6 +140,15 @@ String keygenMenuHighGradeKeySize() {
 String keygenMenuMediumGradeKeySize() {
   return GetLocalizedString(IDS_KEYGEN_MED_GRADE_KEY);
 }
+
+// Used in ImageDocument.cpp as the title for pages when that page is an image.
+String WebCore::imageTitle(const String& filename, const IntSize& size) {
+  // C3 97 is UTF-8 for U+00D7 (multiplication sign).
+  std::string size_str = StringPrintf(" (%d\xC3\x97%d)",
+                                      size.width(), size.height());
+  return filename + webkit_glue::StdStringToString(size_str);
+}
+
 } //namespace WebCore
 
 #if defined(OS_WIN)
diff --git a/webkit/glue/password_form_dom_manager.cc b/webkit/glue/password_form_dom_manager.cc
index ccc89df..d1e1112 100644
--- a/webkit/glue/password_form_dom_manager.cc
+++ b/webkit/glue/password_form_dom_manager.cc
@@ -182,10 +182,10 @@ void PasswordFormDomManager::FindPasswordFormFields(
   DCHECK(form && fields);
   int first_password_index = 0;
   // First, find the password fields and activated submit button
-  const WTF::Vector<WebCore::HTMLGenericFormElement*>& form_elements =
+  const WTF::Vector<WebCore::HTMLFormControlElement*>& form_elements =
       form->formElements;
   for (size_t i = 0; i < form_elements.size(); i++) {
-    WebCore::HTMLGenericFormElement* form_element = form_elements[i];
+    WebCore::HTMLFormControlElement* form_element = form_elements[i];
     if (form_element->isActivatedSubmit())
       fields->submit = form_element;
 
@@ -209,7 +209,7 @@ void PasswordFormDomManager::FindPasswordFormFields(
   if (!fields->passwords.empty()) {
     // Then, search backwards for the username field
     for (int i = first_password_index - 1; i >= 0; i--) {
-      WebCore::HTMLGenericFormElement* form_element = form_elements[i];
+      WebCore::HTMLFormControlElement* form_element = form_elements[i];
       if (!form_element->hasLocalName(WebCore::HTMLNames::inputTag))
         continue;
 
@@ -231,7 +231,7 @@ void PasswordFormDomManager::FindPasswordFormFields(
 PasswordForm* PasswordFormDomManager::AssemblePasswordFormResult(
     const GURL& full_origin, 
     const GURL& full_action,
-    WebCore::HTMLGenericFormElement* submit,
+    WebCore::HTMLFormControlElement* submit,
     WebCore::HTMLInputElement* username,
     WebCore::HTMLInputElement* old_password,
     WebCore::HTMLInputElement* password) {
diff --git a/webkit/glue/password_form_dom_manager.h b/webkit/glue/password_form_dom_manager.h
index f03a322..9f827de 100644
--- a/webkit/glue/password_form_dom_manager.h
+++ b/webkit/glue/password_form_dom_manager.h
@@ -14,7 +14,7 @@
 namespace WebCore {
 class HTMLFormElement;
 class HTMLInputElement;
-class HTMLGenericFormElement;
+class HTMLFormControlElement;
 }
 
 class GURL;
@@ -61,7 +61,7 @@ class PasswordFormDomManager {
   struct PasswordFormFields {
     WebCore::HTMLInputElement* username;
     std::vector<WebCore::HTMLInputElement*> passwords;
-    WebCore::HTMLGenericFormElement* submit;
+    WebCore::HTMLFormControlElement* submit;
     PasswordFormFields() : username(NULL), submit(NULL) { 
     }
   };
@@ -121,7 +121,7 @@ class PasswordFormDomManager {
   static PasswordForm* AssemblePasswordFormResult(
       const GURL& full_origin, 
       const GURL& full_action,
-      WebCore::HTMLGenericFormElement* submit,
+      WebCore::HTMLFormControlElement* submit,
       WebCore::HTMLInputElement* username,
       WebCore::HTMLInputElement* old_password,
       WebCore::HTMLInputElement* password);
diff --git a/webkit/glue/plugins/plugin_lib.cc b/webkit/glue/plugins/plugin_lib.cc
index d70d3a2..9e1bb54 100644
--- a/webkit/glue/plugins/plugin_lib.cc
+++ b/webkit/glue/plugins/plugin_lib.cc
@@ -315,7 +315,7 @@ void PluginLib::Unload() {
     // so that the plugin will have a chance to unwind.
     bool defer_unload = webkit_glue::IsPluginRunningInRendererProcess();
 
-#if USE(JAVASCRIPTCORE_BINDINGS)
+#if USE(JSC)
     // The plugin NPAPI instances may still be around. Delay the
     // NP_Shutdown and FreeLibrary calls at least till the next
     // peek message.
diff --git a/webkit/glue/regular_expression_unittest.cc b/webkit/glue/regular_expression_unittest.cc
index f3a319c..3e22ada 100644
--- a/webkit/glue/regular_expression_unittest.cc
+++ b/webkit/glue/regular_expression_unittest.cc
@@ -13,9 +13,9 @@
 #include "webkit/glue/glue_util.h"
 
 using std::wstring;
-using webkit_glue::StdWStringToDeprecatedString;
-using WebCore::DeprecatedString;
+using webkit_glue::StdWStringToString;
 using WebCore::RegularExpression;
+using WebCore::String;
 
 namespace {
 
@@ -32,14 +32,14 @@ struct Match {
 
 TEST(RegexTest, Basic) {
   // Just make sure we're not completely broken.
-  const DeprecatedString pattern("the quick brown fox");
+  const String pattern("the quick brown fox");
   RegularExpression regex(pattern, /* case sensitive */ true);
-  EXPECT_EQ(0, regex.match(DeprecatedString("the quick brown fox")));
-  EXPECT_EQ(1, regex.match(DeprecatedString(" the quick brown fox")));
-  EXPECT_EQ(3, regex.match(DeprecatedString("foothe quick brown foxbar")));
+  EXPECT_EQ(0, regex.match("the quick brown fox"));
+  EXPECT_EQ(1, regex.match(" the quick brown fox"));
+  EXPECT_EQ(3, regex.match("foothe quick brown foxbar"));
 
-  EXPECT_EQ(-1, regex.match(DeprecatedString("The quick brown FOX")));
-  EXPECT_EQ(-1, regex.match(DeprecatedString("the quick brown fo")));
+  EXPECT_EQ(-1, regex.match("The quick brown FOX"));
+  EXPECT_EQ(-1, regex.match("the quick brown fo"));
 }
 
 TEST(RegexTest, Unicode) {
@@ -47,20 +47,20 @@ TEST(RegexTest, Unicode) {
 
   // Test 1
   wstring wstr_pattern(L"\x6240\x6709\x7f51\x9875");
-  DeprecatedString pattern = StdWStringToDeprecatedString(wstr_pattern);
+  String pattern = StdWStringToString(wstr_pattern);
   RegularExpression regex(pattern, /* case sensitive */ false);
 
-  EXPECT_EQ(0, regex.match(StdWStringToDeprecatedString(wstr_pattern)));
-  EXPECT_EQ(1, regex.match(StdWStringToDeprecatedString(
+  EXPECT_EQ(0, regex.match(StdWStringToString(wstr_pattern)));
+  EXPECT_EQ(1, regex.match(StdWStringToString(
       wstring(L" ") + wstr_pattern)));
-  EXPECT_EQ(3, regex.match(StdWStringToDeprecatedString(
+  EXPECT_EQ(3, regex.match(StdWStringToString(
       wstring(L"foo") + wstr_pattern + wstring(L"bar"))));
-  EXPECT_EQ(4, regex.match(StdWStringToDeprecatedString(
+  EXPECT_EQ(4, regex.match(StdWStringToString(
       wstring(L"\x4e2d\x6587\x7f51\x9875") + wstr_pattern)));
 
   // Test 2, mixed length
   wstr_pattern = L":[ \x2000]+:";
-  pattern = StdWStringToDeprecatedString(wstr_pattern);
+  pattern = StdWStringToString(wstr_pattern);
   regex = RegularExpression(pattern, /* case sensitive */ false);
   
   const Match matches[] = {
@@ -72,21 +72,21 @@ TEST(RegexTest, Unicode) {
     { L"::", -1, -1 },
   };
   for (size_t i = 0; i < arraysize(matches); ++i) {
-    EXPECT_EQ(matches[i].position, regex.match(StdWStringToDeprecatedString(
+    EXPECT_EQ(matches[i].position, regex.match(StdWStringToString(
         wstring(matches[i].text))));
     EXPECT_EQ(matches[i].length, regex.matchedLength());
   }
 
   // Test 3, empty match
   wstr_pattern = L"|x";
-  pattern = StdWStringToDeprecatedString(wstr_pattern);
+  pattern = StdWStringToString(wstr_pattern);
   regex = RegularExpression(pattern, /* case sensitive */ false);
   
   const Match matches2[] = {
     { L"", 0, 0 },
   };
   for (size_t i = 0; i < arraysize(matches2); ++i) {
-    EXPECT_EQ(matches2[i].position, regex.match(StdWStringToDeprecatedString(
+    EXPECT_EQ(matches2[i].position, regex.match(StdWStringToString(
         wstring(matches2[i].text))));
     EXPECT_EQ(matches2[i].length, regex.matchedLength());
   }
diff --git a/webkit/glue/resource_handle_win.cc b/webkit/glue/resource_handle_win.cc
index da485c1..66b1e4b 100644
--- a/webkit/glue/resource_handle_win.cc
+++ b/webkit/glue/resource_handle_win.cc
@@ -26,7 +26,9 @@
 
 #pragma warning(push, 0)
 #include "CString.h"
+#include "Console.h"
 #include "DocLoader.h"
+#include "DOMWindow.h"
 #include "FormData.h"
 #include "FrameLoader.h"
 #include "LogWin.h"
@@ -342,7 +344,7 @@ bool ResourceHandleInternal::Start(
     // WinInet dies if blank headers are set.  TODO(darin): Is this still an
     // issue now that we are using WinHTTP?
     if ((*it).first.isEmpty()) {
-      webframe->frame()->page()->chrome()->addMessageToConsole(
+      webframe->frame()->domWindow()->console()->addMessage(
         JSMessageSource,
         ErrorMessageLevel,
         "Refused to set blank header",
diff --git a/webkit/glue/searchable_form_data.cc b/webkit/glue/searchable_form_data.cc
index 5a59f03..cdbf6ab 100644
--- a/webkit/glue/searchable_form_data.cc
+++ b/webkit/glue/searchable_form_data.cc
@@ -12,9 +12,9 @@
 #include "FormData.h"
 #include "FormDataList.h"
 #include "FrameLoader.h"
+#include "HTMLFormControlElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLOptionElement.h"
-#include "HTMLGenericFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLOptionsCollection.h"
@@ -22,6 +22,7 @@
 #include "ResourceRequest.h"
 #include "String.h"
 #include "TextEncoding.h"
+#include <wtf/Vector.h>
 #pragma warning(pop)
 
 #undef LOG
@@ -38,47 +39,39 @@ using WebCore::HTMLOptionElement;
 
 namespace {
 
+// TODO(eseidel): appendString and appendEncodedString do *not* follow Google
+// style because they are copy/paste from WebKit and will go away as soon as the
+// WebKit functions are made public.
+static void appendString(Vector<char>& buffer, const char* string)
+{
+    buffer.append(string, strlen(string));
+}
+
 // TODO (sky): This comes straight out of HTMLFormElement, will work with 
 // WebKit folks to make public.
-WebCore::DeprecatedCString encodeCString(const WebCore::CString& cstr) {
-    WebCore::DeprecatedCString e = cstr.deprecatedCString();
+static void appendEncodedString(Vector<char>& buffer, const WebCore::CString& string)
+{
+    static const char hexDigits[17] = "0123456789ABCDEF";
 
     // http://www.w3.org/TR/html4/interact/forms.html#h-17.13.4.1
-    // same safe characters as Netscape for compatibility
-    static const char *safe = "-._*";
-    int elen = e.length();
-    WebCore::DeprecatedCString encoded((elen + e.contains('\n')) * 3 + 1);
-    int enclen = 0;
-
-    for (int pos = 0; pos < elen; pos++) {
-        unsigned char c = e[pos];
+    int length = string.length();
+    for (int i = 0; i < length; i++) {
+        unsigned char c = string.data()[i];
 
+        // Same safe characters as Netscape for compatibility.
+        static const char safe[] = "-._*";
         if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || strchr(safe, c))
-            encoded[enclen++] = c;
+            buffer.append(c);
         else if (c == ' ')
-            encoded[enclen++] = '+';
-        else if (c == '\n' || (c == '\r' && e[pos + 1] != '\n')) {
-            encoded[enclen++] = '%';
-            encoded[enclen++] = '0';
-            encoded[enclen++] = 'D';
-            encoded[enclen++] = '%';
-            encoded[enclen++] = '0';
-            encoded[enclen++] = 'A';
-        } else if (c != '\r') {
-            encoded[enclen++] = '%';
-            unsigned int h = c / 16;
-            h += (h > 9) ? ('A' - 10) : '0';
-            encoded[enclen++] = h;
-
-            unsigned int l = c % 16;
-            l += (l > 9) ? ('A' - 10) : '0';
-            encoded[enclen++] = l;
+            buffer.append('+');
+        else if (c == '\n' || (c == '\r' && (i + 1 >= length || string.data()[i + 1] != '\n')))
+            appendString(buffer, "%0D%0A");
+        else if (c != '\r') {
+            buffer.append('%');
+            buffer.append(hexDigits[c >> 4]);
+            buffer.append(hexDigits[c & 0xF]);
         }
     }
-    encoded[enclen++] = '\0';
-    encoded.truncate(enclen);
-
-    return encoded;
 }
 
 // Returns true if the form element has an 'onsubmit' attribute.
@@ -101,7 +94,8 @@ void GetFormEncoding(WebCore::HTMLFormElement* form,
   WebCore::String str = 
     form->getAttribute(WebCore::HTMLNames::accept_charsetAttr);
   str.replace(',', ' ');
-  Vector<WebCore::String> charsets = str.split(' ');
+  Vector<WebCore::String> charsets;
+  str.split(' ', charsets);
   Vector<WebCore::String>::const_iterator end = charsets.end();
   for (Vector<WebCore::String>::const_iterator it = charsets.begin(); it != end; 
        ++it) {
@@ -129,14 +123,14 @@ bool IsHTTPFormSubmit(WebCore::HTMLFormElement* form) {
 
 // If the form does not have an activated submit button, the first submit
 // button is returned.
-WebCore::HTMLGenericFormElement* GetButtonToActivate(
+WebCore::HTMLFormControlElement* GetButtonToActivate(
     WebCore::HTMLFormElement* form) {
-  WTF::Vector<WebCore::HTMLGenericFormElement*> form_elements = 
+  WTF::Vector<WebCore::HTMLFormControlElement*> form_elements = 
       form->formElements;
-  WebCore::HTMLGenericFormElement* first_submit_button = NULL;
+  WebCore::HTMLFormControlElement* first_submit_button = NULL;
 
   for (unsigned i = 0; i < form_elements.size(); ++i) {
-    WebCore::HTMLGenericFormElement* current = form_elements[i];
+    WebCore::HTMLFormControlElement* current = form_elements[i];
     if (current->isActivatedSubmit()) {
       // There's a button that is already activated for submit, return NULL.
       return NULL;
@@ -198,7 +192,7 @@ bool IsCheckBoxOrRadioInDefaultState(HTMLInputElement* element) {
 // The default state is the state of the form element on initial load of the
 // page, and varies depending upon the form element. For example, a checkbox is
 // in its default state if the checked state matches the defaultChecked state.
-bool IsInDefaultState(WebCore::HTMLGenericFormElement* form_element) {
+bool IsInDefaultState(WebCore::HTMLFormControlElement* form_element) {
   if (form_element->hasTagName(WebCore::HTMLNames::inputTag)) {
     HTMLInputElement* input_element =
         static_cast<HTMLInputElement*>(form_element);
@@ -219,7 +213,7 @@ bool IsInDefaultState(WebCore::HTMLGenericFormElement* form_element) {
 // encoding_name.
 WebCore::HTMLInputElement* GetTextElement(
     WebCore::HTMLFormElement* form,
-    WebCore::DeprecatedCString* enc_string,
+    Vector<char>* enc_string,
     std::string* encoding_name) {
   WebCore::TextEncoding encoding;
   GetFormEncoding(form, &encoding);
@@ -231,10 +225,10 @@ WebCore::HTMLInputElement* GetTextElement(
   }
   *encoding_name = encoding.name();
   WebCore::HTMLInputElement* text_element = NULL;
-  WTF::Vector<WebCore::HTMLGenericFormElement*> form_elements = 
+  WTF::Vector<WebCore::HTMLFormControlElement*> form_elements = 
       form->formElements;
   for (unsigned i = 0; i < form_elements.size(); ++i) {
-    WebCore::HTMLGenericFormElement* form_element = form_elements[i];
+    WebCore::HTMLFormControlElement* form_element = form_elements[i];
     if (!form_element->disabled() && !form_element->name().isNull()) {
       bool is_text_element = false;
       if (!IsInDefaultState(form_element)) {
@@ -279,19 +273,19 @@ WebCore::HTMLInputElement* GetTextElement(
           // but only if its the first entry
           if (enc_string->isEmpty() && item.m_data == "isindex") {
             if (form_element == text_element)
-              *enc_string += "{searchTerms}";
+              appendString(*enc_string, "{searchTerms}");
             else
-              *enc_string += encodeCString(lst.list()[j + 1].m_data);
+              appendEncodedString(*enc_string, (lst.list()[j + 1].m_data));
             ++j;
           } else {
             if (!enc_string->isEmpty())
-              *enc_string += '&';
-            *enc_string += encodeCString(item.m_data);
-            *enc_string += "=";
+              enc_string->append('&');
+            appendEncodedString(*enc_string, item.m_data);
+            enc_string->append('=');
             if (form_element == text_element)
-              *enc_string += "{searchTerms}";
+              appendString(*enc_string, "{searchTerms}");
             else
-              *enc_string += encodeCString(lst.list()[j + 1].m_data);
+              appendEncodedString(*enc_string, lst.list()[j + 1].m_data);
             ++j;
           }
         }
@@ -313,8 +307,8 @@ SearchableFormData* SearchableFormData::Create(WebCore::Element* element) {
   if (frame == NULL)
     return NULL;
 
-  WebCore::HTMLGenericFormElement* input_element = 
-    static_cast<WebCore::HTMLGenericFormElement*>(element);
+  WebCore::HTMLFormControlElement* input_element = 
+    static_cast<WebCore::HTMLFormControlElement*>(element);
 
   WebCore::HTMLFormElement* form = input_element->form();
   if (form == NULL)
@@ -334,8 +328,8 @@ SearchableFormData* SearchableFormData::Create(WebCore::HTMLFormElement* form) {
       !IsHTTPFormSubmit(form))
     return NULL;
 
-  WebCore::DeprecatedCString enc_string = "";
-  WebCore::HTMLGenericFormElement* first_submit_button = 
+  Vector<char> enc_string;
+  WebCore::HTMLFormControlElement* first_submit_button = 
     GetButtonToActivate(form);
 
   if (first_submit_button) {
@@ -359,12 +353,11 @@ SearchableFormData* SearchableFormData::Create(WebCore::HTMLFormElement* form) {
 
   // It's a valid form.
   // Generate the URL and create a new SearchableFormData.
-  RefPtr<WebCore::FormData> form_data = new WebCore::FormData;
-  form_data->appendData(enc_string.data(), enc_string.length());
+  RefPtr<WebCore::FormData> form_data = WebCore::FormData::create(enc_string);
   WebCore::String action = WebCore::parseURL(form->action());
   WebCore::FrameLoader* loader = frame->loader();
   WebCore::KURL url = loader->completeURL(action.isNull() ? "" : action);
-  url.setQuery(form_data->flattenToString().deprecatedString());
+  url.setQuery(form_data->flattenToString());
   std::wstring current_value = webkit_glue::StringToStdWString(
     static_cast<WebCore::HTMLInputElement*>(text_element)->value());
   std::wstring text_name = 
diff --git a/webkit/glue/webcursor.cc b/webkit/glue/webcursor.cc
index e1d97db..19b34b0 100644
--- a/webkit/glue/webcursor.cc
+++ b/webkit/glue/webcursor.cc
@@ -7,24 +7,31 @@
 #include "webkit/glue/webkit_resources.h"
 
 WebCursor::WebCursor()
-  : type_(ARROW),
-    hotspot_x_(0),
-    hotspot_y_(0) {
+    : type_(ARROW),
+      hotspot_x_(0),
+      hotspot_y_(0) {
   memset(&bitmap_, 0, sizeof(bitmap_));
 }
 
 WebCursor::WebCursor(Type cursor_type)
-  : type_(cursor_type),
-    hotspot_x_(0),
-    hotspot_y_(0) {
+    : type_(cursor_type),
+      hotspot_x_(0),
+      hotspot_y_(0) {
   memset(&bitmap_, 0, sizeof(bitmap_));
 }
 
 WebCursor::WebCursor(const SkBitmap* bitmap, int hotspot_x, int hotspot_y)
-  : type_(CUSTOM) {
-  hotspot_x_ = hotspot_x;
-  hotspot_y_ = hotspot_y;
-  bitmap_ = *bitmap;
+    : type_(ARROW),
+      hotspot_x_(0),
+      hotspot_y_(0) {
+  if (bitmap) {
+    type_ = CUSTOM;
+    hotspot_x_ = hotspot_x;
+    hotspot_y_ = hotspot_y;
+    bitmap_ = *bitmap;
+  } else {
+    memset(&bitmap_, 0, sizeof(bitmap_));
+  }
 }
 
 WebCursor::~WebCursor() {
diff --git a/webkit/glue/webdatasource.h b/webkit/glue/webdatasource.h
index 4c7200a..02d9a48 100644
--- a/webkit/glue/webdatasource.h
+++ b/webkit/glue/webdatasource.h
@@ -85,6 +85,9 @@ class WebDataSource {
   // script to do the actuall submission.
   virtual bool IsFormSubmit() const = 0;
 
+  // Returns the page title.
+  virtual std::wstring GetPageTitle() const = 0;
+
   /*
   These functions are not implemented yet, and we are not yet sure whether or not
   we need them, so we have commented them out both here and in the 
@@ -129,12 +132,6 @@ class WebDataSource {
   virtual bool IsLoading() = 0;
 
   //
-  //  @method pageTitle
-  //  @result Returns nil or the page title.
-  //  - (NSString *)pageTitle;
-  virtual void GetPageTitle(std::wstring* title) = 0;
-
-  //
   //  @method webArchive
   //  @result A WebArchive representing the data source, its subresources and child frames.
   //  @description This method constructs a WebArchive using the original downloaded data.
diff --git a/webkit/glue/webdatasource_impl.cc b/webkit/glue/webdatasource_impl.cc
index 7f018b2..3aca942 100644
--- a/webkit/glue/webdatasource_impl.cc
+++ b/webkit/glue/webdatasource_impl.cc
@@ -46,7 +46,7 @@ WebDataSourceImpl::WebDataSourceImpl(WebFrameImpl* frame,
                                      WebDocumentLoaderImpl* loader) :
   frame_(frame),
   loader_(loader),
-  initial_request_(loader->initialRequest()),
+  initial_request_(loader->originalRequest()),
   request_(loader->request()) {
 }
 
@@ -68,7 +68,7 @@ const WebRequest& WebDataSourceImpl::GetInitialRequest() const {
   // WebKit may change the frame load request as it sees fit, so we must sync
   // our request object.
   initial_request_.set_frame_load_request(
-      WebCore::FrameLoadRequest(loader_->initialRequest()));
+      WebCore::FrameLoadRequest(loader_->originalRequest()));
   return initial_request_;
 }
 
@@ -128,6 +128,10 @@ bool WebDataSourceImpl::IsFormSubmit() const {
   return loader_->is_form_submit();
 }
 
+std::wstring WebDataSourceImpl::GetPageTitle() const {
+  return webkit_glue::StringToStdWString(loader_->title());
+}
+
 /*
 See comment in webdatasource.h
 
@@ -152,11 +156,6 @@ bool WebDataSourceImpl::IsLoading() {
   DebugBreak();
 }
 
-std::wstring WebDataSourceImpl::GetPageTitle() {
-  DebugBreak();
-  return L"";
-}
-
 void WebDataSourceImpl::GetWebArchive(IWebArchive** archive) {
   DebugBreak();
 }
diff --git a/webkit/glue/webdatasource_impl.h b/webkit/glue/webdatasource_impl.h
index baa476b..e4394bb 100644
--- a/webkit/glue/webdatasource_impl.h
+++ b/webkit/glue/webdatasource_impl.h
@@ -73,6 +73,8 @@ class WebDataSourceImpl : public WebDataSource {
 
   virtual bool IsFormSubmit() const;
 
+  virtual std::wstring GetPageTitle() const;
+
 private:
   WebFrameImpl* frame_;
   WebDocumentLoaderImpl* loader_;
diff --git a/webkit/glue/webframe.h b/webkit/glue/webframe.h
index a63158a..2169549 100644
--- a/webkit/glue/webframe.h
+++ b/webkit/glue/webframe.h
@@ -354,6 +354,9 @@ class WebFrame : public base::RefCounted<WebFrame> {
   // but no additional loads should occur.
   virtual bool IsReloadAllowingStaleData() const = 0;
 
+  // Only for test_shell
+  virtual int PendingFrameUnloadEventCount() const = 0;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(WebFrame);
 };
diff --git a/webkit/glue/webframe_impl.cc b/webkit/glue/webframe_impl.cc
index c68b9b5..c291a1c 100644
--- a/webkit/glue/webframe_impl.cc
+++ b/webkit/glue/webframe_impl.cc
@@ -85,10 +85,13 @@
 #pragma warning(push, 0)
 #include "HTMLFormElement.h"  // need this before Document.h
 #include "Chrome.h"
+#include "Console.h"
 #include "Document.h"
 #include "DocumentFragment.h"  // Only needed for ReplaceSelectionCommand.h :(
 #include "DocumentLoader.h"
+#include "DOMWindow.h"
 #include "Editor.h"
+#include "EventHandler.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoadRequest.h"
@@ -111,6 +114,7 @@
 #include "ResourceHandleWin.h"
 #endif
 #include "ResourceRequest.h"
+#include "ScriptController.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "SkiaUtils.h"
@@ -145,8 +149,8 @@
 
 using WebCore::ChromeClientWin;
 using WebCore::Color;
-using WebCore::DeprecatedString;
 using WebCore::Document;
+using WebCore::DocumentFragment;
 using WebCore::DocumentLoader;
 using WebCore::ExceptionCode;
 using WebCore::GraphicsContext;
@@ -300,14 +304,12 @@ WebFrameImpl::~WebFrameImpl() {
 void WebFrameImpl::InitMainFrame(WebViewImpl* webview_impl) {
   webview_impl_ = webview_impl;  // owning ref
 
-  Frame* frame = new Frame(webview_impl_->page(), 0, &frame_loader_client_);
+  frame_ = Frame::create(webview_impl_->page(), 0, &frame_loader_client_);
 
   // Add reference on behalf of FrameLoader.  See comments in
   // WebFrameLoaderClient::frameLoaderDestroyed for more info.
   AddRef();
 
-  frame_ = frame;
-
   // We must call init() after frame_ is assigned because it is referenced
   // during init().
   frame_->init();
@@ -343,11 +345,10 @@ void WebFrameImpl::InternalLoadRequest(const WebRequest* request,
 
     // TODO(darin): Is this the best API to use here?  It works and seems good,
     // but will it change out from under us?
-    DeprecatedString script =
-        KURL::decode_string(kurl.deprecatedString().mid(sizeof("javascript:")-1));
+    String script =
+        decodeURLEscapeSequences(kurl.string().substring(sizeof("javascript:")-1));
     bool succ = false;
-    WebCore::String value =
-        frame_->loader()->executeScript(script, &succ, true);
+    String value = frame_->loader()->executeScript(script, &succ, true);
     if (succ && !frame_->loader()->isScheduledLocationChangePending()) {
       // TODO(darin): We need to figure out how to represent this in session
       // history.  Hint: don't re-eval script when the user or script navigates
@@ -388,7 +389,7 @@ void WebFrameImpl::InternalLoadRequest(const WebRequest* request,
     // WebKit hoarks. This is probably the wrong thing to do, but it seems to
     // work.
     if (!current_item) {
-      current_item = new HistoryItem(KURL("about:blank"), "");
+      current_item = HistoryItem::create();
       frame_->loader()->setCurrentHistoryItem(current_item);
       frame_->page()->backForwardList()->setCurrentItem(current_item.get());
 
@@ -419,7 +420,7 @@ void WebFrameImpl::LoadAlternateHTMLString(const WebRequest* request,
                                            const GURL& display_url,
                                            bool replace) {
   int len = static_cast<int>(html_text.size());
-  RefPtr<SharedBuffer> buf(new SharedBuffer(html_text.data(), len));
+  RefPtr<SharedBuffer> buf = SharedBuffer::create(html_text.data(), len);
 
   SubstituteData subst_data(
       buf, String("text/html"), String("UTF-8"),
@@ -464,7 +465,7 @@ GURL WebFrameImpl::GetOSDDURL() const {
                 child, WebCore::HTMLNames::linkTag);
         if (link_element && link_element->type() == kOSDType &&
             link_element->rel() == kOSDRel && !link_element->href().isEmpty()) {
-          return GURL(link_element->href().charactersWithNullTermination());
+          return webkit_glue::KURLToGURL(link_element->href());
         }
       }
     }
@@ -693,23 +694,24 @@ WebView* WebFrameImpl::GetView() const {
 
 void WebFrameImpl::BindToWindowObject(const std::wstring& name,
                                       NPObject* object) {
-    assert(frame_);
-    if (!frame_ || !frame_->scriptBridge()->isEnabled())
-      return;
+  assert(frame_);
+  if (!frame_ || !frame_->script()->isEnabled())
+    return;
 
-    String key = webkit_glue::StdWStringToString(name);
-    frame_->scriptBridge()->BindToWindowObject(frame_.get(), key, object);
+  String key = webkit_glue::StdWStringToString(name);
+  frame_->script()->BindToWindowObject(frame_.get(), key, object);
 }
 
 
 // Call JavaScript garbage collection.
 void WebFrameImpl::CallJSGC() {
-    if (!frame_) return;
-    if (!frame_->settings()->isJavaScriptEnabled()) return;
-    frame_->scriptBridge()->CollectGarbage();
+  if (!frame_)
+    return;
+  if (!frame_->settings()->isJavaScriptEnabled())
+    return;
+  frame_->script()->collectGarbage();
 }
 
-
 void WebFrameImpl::GetContentAsPlainText(int max_chars,
                                          std::wstring* text) const {
   text->clear();
@@ -802,10 +804,10 @@ bool WebFrameImpl::Find(const FindInPageRequest& request,
   // If the user has selected something since the last Find operation we want
   // to start from there. Otherwise, we start searching from where the last Find
   // operation left off (either a Find or a FindNext operation).
-  Selection selection(frame()->selectionController()->selection());
+  Selection selection(frame()->selection()->selection());
   if (selection.isNone() && last_active_range_) {
     selection = Selection(last_active_range_.get());
-    frame()->selectionController()->setSelection(selection);
+    frame()->selection()->setSelection(selection);
   }
 
   DCHECK(frame() && frame()->view());
@@ -823,7 +825,7 @@ bool WebFrameImpl::Find(const FindInPageRequest& request,
     main_frame_impl->active_tickmark_frame_ = this;
 
     // We found something, so we can now query the selection for its position.
-    Selection new_selection(frame()->selectionController()->selection());
+    Selection new_selection(frame()->selection()->selection());
 
     // If we thought we found something, but it couldn't be selected (perhaps
     // because it was marked -webkit-user-select: none), we can't set it to
@@ -942,7 +944,7 @@ bool WebFrameImpl::FindNext(const FindInPageRequest& request,
   }
 
   Selection selection(tickmarks_[active_tickmark_].get());
-  frame()->selectionController()->setSelection(selection);
+  frame()->selection()->setSelection(selection);
   frame()->revealSelection();  // Scroll the selection into view if necessary.
   // Make sure we save where the selection was after the operation so that
   // we can set the selection to it for the next Find operation (if needed).
@@ -1088,7 +1090,7 @@ void WebFrameImpl::ScopeStringMatches(FindInPageRequest request,
     // This is a continuation of a scoping operation that timed out and didn't
     // complete last time around, so we should start from where we left off.
     RefPtr<Range> start_range = tickmarks_.last();
-    searchRange->setStart(start_range->startNode(),
+    searchRange->setStart(start_range->startContainer(),
                           start_range->startOffset(ec2) + 1, ec);
     if (ec != 0 || ec2 != 0) {
       NOTREACHED();
@@ -1234,7 +1236,7 @@ void WebFrameImpl::SetFindEndstateFocusAndSelection() {
     RefPtr<Range> range = tickmarks_[active_tickmark_];
 
     // Set the selection to what the active match is.
-    frame()->selectionController()->setSelectedRange(
+    frame()->selection()->setSelectedRange(
         range.get(), WebCore::DOWNSTREAM, false);
 
     // We will be setting focus ourselves, so we want the view to forget its
@@ -1243,7 +1245,7 @@ void WebFrameImpl::SetFindEndstateFocusAndSelection() {
 
     // Try to find the first focusable node up the chain, which will, for
     // example, focus links if we have found text within the link.
-    Node* node = range->startNode();
+    Node* node = range->firstNode();
     while (node && !node->isFocusable() && node != frame()->document())
       node = node->parent();
 
@@ -1254,8 +1256,8 @@ void WebFrameImpl::SetFindEndstateFocusAndSelection() {
       // Iterate over all the nodes in the range until we find a focusable node.
       // This, for example, sets focus to the first link if you search for
       // text and text that is within one or more links.
-      node = range->startNode();
-      while (node && node != range->pastEndNode()) {
+      node = range->firstNode();
+      while (node && node != range->pastLastNode()) {
         if (node->isFocusable()) {
           frame()->document()->setFocusedNode(node);
           break;
@@ -1277,7 +1279,7 @@ void WebFrameImpl::StopFinding(bool clear_selection) {
 }
 
 void WebFrameImpl::SelectAll() {
-  frame()->selectionController()->selectAll();
+  frame()->selection()->selectAll();
 
   WebViewDelegate* d = GetView()->GetDelegate();
   if (d)
@@ -1354,7 +1356,10 @@ void WebFrameImpl::Paste() {
 
 void WebFrameImpl::Replace(const std::wstring& wtext) {
   String text = webkit_glue::StdWStringToString(wtext);
-  frame()->editor()->replaceSelectionWithText(text, false, true);
+  RefPtr<DocumentFragment> fragment =
+      createFragmentFromText(frame()->selection()->toRange().get(), text);
+  WebCore::applyCommand(WebCore::ReplaceSelectionCommand::create(
+      frame()->document(), fragment.get(), false, true, true));
 }
 
 void WebFrameImpl::Delete() {
@@ -1382,7 +1387,7 @@ void WebFrameImpl::Redo() {
 }
 
 void WebFrameImpl::ClearSelection() {
-  frame()->selectionController()->clear();
+  frame()->selection()->clear();
 }
 
 void WebFrameImpl::CreateFrameView() {
@@ -1453,12 +1458,9 @@ WebFrameImpl* WebFrameImpl::FromFrame(WebCore::Frame* frame) {
 
 void WebFrameImpl::Layout() {
   // layout this frame
-  if (frame_->document())
-    frame_->document()->updateLayout();
-  // layout child frames
-  Frame* child = frame_->tree()->firstChild();
-  for (; child; child = child->tree()->nextSibling())
-    FromFrame(child)->Layout();
+  FrameView* view = frame_->view();
+  if (view)
+    view->layout();
 }
 
 void WebFrameImpl::Paint(gfx::PlatformCanvas* canvas, const gfx::Rect& rect) {
@@ -1629,18 +1631,16 @@ void WebFrameImpl::CreateChildFrame(const FrameLoadRequest& r,
   webframe->margin_height_ = margin_height;
 
   webframe->frame_ =
-    new Frame(frame_->page(), owner_element, &webframe->frame_loader_client_);
+    Frame::create(frame_->page(), owner_element, &webframe->frame_loader_client_);
   webframe->frame_->tree()->setName(r.frameName());
 
   webframe->webview_impl_ = webview_impl_;  // owning ref
 
-
-  // Note that Frames already start out with a refcount of 1.
   // We wait until loader()->load() returns before deref-ing the Frame.
   // Otherwise the danger is that the onload handler can cause
   // the Frame to be dealloc-ed, and subsequently trash memory.
   // (b:1055700)
-  WTF::RefPtr<Frame> protector(WTF::adoptRef(webframe->frame_.get()));
+  WTF::RefPtr<Frame> protector(webframe->frame_.get());
 
   frame_->tree()->appendChild(webframe->frame_);
 
@@ -1678,7 +1678,7 @@ void WebFrameImpl::CreateChildFrame(const FrameLoadRequest& r,
       // onLoad handlers, of any redirects that happened. An example of where
       // this is needed is Radar 3213556.
       new_url = KURL(KURL(""),
-                     childItem->originalURLString().deprecatedString());
+                     childItem->originalURLString());
 
       // These behaviors implied by these loadTypes should apply to the child
       // frames
@@ -1696,10 +1696,9 @@ void WebFrameImpl::CreateChildFrame(const FrameLoadRequest& r,
     }
   }
 
-  webframe->frame_->loader()->load(new_url,
-                                   r.resourceRequest().httpReferrer(),
-                                   childLoadType,
-                                   String(), NULL, NULL);
+  webframe->frame_->loader()->loadURLIntoChildFrame(new_url,
+        r.resourceRequest().httpReferrer(),
+        webframe->frame_.get());
 
   // A synchronous navigation (about:blank) would have already processed
   // onload, so it is possible for the frame to have already been destroyed by
@@ -1737,7 +1736,7 @@ void WebFrameImpl::AddMessageToConsole(const std::wstring& msg,
       return;
   }
 
-  frame()->page()->chrome()->addMessageToConsole(
+  frame()->domWindow()->console()->addMessage(
       WebCore::OtherMessageSource, webcore_message_level,
       webkit_glue::StdWStringToString(msg), 1, String());
 }
@@ -1862,3 +1861,7 @@ bool WebFrameImpl::IsReloadAllowingStaleData() const {
   }
   return false;
 }
+
+int WebFrameImpl::PendingFrameUnloadEventCount() const {
+  return frame()->eventHandler()->pendingFrameUnloadEventCount();
+}
diff --git a/webkit/glue/webframe_impl.h b/webkit/glue/webframe_impl.h
index dfca6e3..61751cb 100644
--- a/webkit/glue/webframe_impl.h
+++ b/webkit/glue/webframe_impl.h
@@ -429,6 +429,9 @@ class WebFrameImpl : public WebFrame {
   // was searched.
   bool ShouldScopeMatches(FindInPageRequest request);
 
+  // Only for test_shell
+  int PendingFrameUnloadEventCount() const;
+
   // Determines whether to invalidate the content area and scrollbar.
   void InvalidateIfNecessary();
 
diff --git a/webkit/glue/webframeloaderclient_impl.cc b/webkit/glue/webframeloaderclient_impl.cc
index d8fed70..c620c97 100644
--- a/webkit/glue/webframeloaderclient_impl.cc
+++ b/webkit/glue/webframeloaderclient_impl.cc
@@ -119,11 +119,6 @@ bool WebFrameLoaderClient::hasFrameView() const {
   return webframe_->webview_impl() != NULL;
 }
 
-bool WebFrameLoaderClient::privateBrowsingEnabled() const {
-  // FIXME
-  return false;
-}
-
 void WebFrameLoaderClient::makeDocumentView() {
   webframe_->CreateFrameView();
 }
@@ -132,9 +127,6 @@ void WebFrameLoaderClient::makeRepresentation(DocumentLoader*) {
   has_representation_ = true;
 }
 
-void WebFrameLoaderClient::setDocumentViewFromCachedPage(CachedPage*) {
-  // FIXME
-}
 void WebFrameLoaderClient::forceLayout() {
   // FIXME
 }
@@ -159,10 +151,6 @@ void WebFrameLoaderClient::detachedFromParent4() {
   webframe_->Closing();
 }
 
-void WebFrameLoaderClient::loadedFromCachedPage() {
-  // FIXME
-}
-
 // This function is responsible for associating the |identifier| with a given
 // subresource load.  The following functions that accept an |identifier| are
 // called for each subresource, so they should not be dispatched to the
@@ -402,6 +390,11 @@ bool WebFrameLoaderClient::dispatchDidLoadResourceFromMemoryCache(
 
 void WebFrameLoaderClient::dispatchDidHandleOnloadEvents() {
   WebViewImpl* webview = webframe_->webview_impl();
+  // During the onload event of a subframe, the subframe can be removed.  In
+  // that case, we have no webview.  This is covered by
+  // LayoutTests/fast/dom/replaceChild.html
+  if (!webview)
+    return;
   WebViewDelegate* d = webview->delegate();
 
   if (d)
@@ -856,6 +849,7 @@ void WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction(
     WebCore::FramePolicyFunction function,
     const WebCore::NavigationAction& action,
     const WebCore::ResourceRequest& request,
+    PassRefPtr<WebCore::FormState> form_state,
     const WebCore::String& frame_name) {
   WindowOpenDisposition disposition;
   if (!ActionSpecifiesDisposition(action, &disposition))
@@ -899,7 +893,8 @@ static WebNavigationType NavigationTypeToWebNavigationType(
 void WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(
     WebCore::FramePolicyFunction function,
     const WebCore::NavigationAction& action,
-    const WebCore::ResourceRequest& request) {
+    const WebCore::ResourceRequest& request,
+    PassRefPtr<WebCore::FormState> form_state) {
   PolicyAction policy_action = PolicyUse;
 
   WebViewImpl* wv = webframe_->webview_impl();
@@ -991,10 +986,6 @@ void WebFrameLoaderClient::setMainDocumentError(DocumentLoader*,
   }
 }
 
-void WebFrameLoaderClient::clearUnarchivingState(DocumentLoader*) {
-  // FIXME
-}
-
 void WebFrameLoaderClient::postProgressStartedNotification() {
   if (hasWebView()) {
     WebViewDelegate* d = webframe_->webview_impl()->delegate();
@@ -1081,15 +1072,7 @@ void WebFrameLoaderClient::finishedLoading(DocumentLoader* dl) {
   }
 }
 
-void WebFrameLoaderClient::finalSetupForReplace(DocumentLoader*) {
-  // FIXME
-}
-
-void WebFrameLoaderClient::updateGlobalHistoryForStandardLoad(const KURL& kurl) {
-}
-
-void WebFrameLoaderClient::updateGlobalHistoryForReload(const KURL&) {
-  // FIXME: this is for updating the visit time.
+void WebFrameLoaderClient::updateGlobalHistory(const KURL& kurl) {
 }
 
 bool WebFrameLoaderClient::shouldGoToHistoryItem(HistoryItem*) const {
@@ -1121,11 +1104,17 @@ ResourceError WebFrameLoaderClient::cannotShowMIMETypeError(const ResourceRespon
   // FIXME
   return ResourceError();
 }
+
 ResourceError WebFrameLoaderClient::fileDoesNotExistError(const ResourceResponse&) {
   // FIXME
   return ResourceError();
 }
 
+ResourceError WebFrameLoaderClient::pluginWillHandleLoadError(const WebCore::ResourceResponse&) {
+  // FIXME
+  return ResourceError();
+}
+
 bool WebFrameLoaderClient::shouldFallBack(const ResourceError& error) {
   // This method is called when we fail to load the URL for an <object> tag
   // that has fallback content (child elements) and is being loaded as a frame.
@@ -1136,25 +1125,6 @@ bool WebFrameLoaderClient::shouldFallBack(const ResourceError& error) {
   return error.errorCode() != net::ERR_ABORTED;
 }
 
-void WebFrameLoaderClient::setDefersLoading(bool) {
-  // FIXME
-}
-
-bool WebFrameLoaderClient::willUseArchive(ResourceLoader*, const ResourceRequest&, const KURL& originalURL) const {
-  // FIXME
-  return false;
-}
-bool WebFrameLoaderClient::isArchiveLoadPending(ResourceLoader*) const {
-  // FIXME
-  return false;
-}
-void WebFrameLoaderClient::cancelPendingArchiveLoad(ResourceLoader*) {
-  // FIXME
-}
-void WebFrameLoaderClient::clearArchivedResources() {
-  // FIXME
-}
-
 bool WebFrameLoaderClient::canHandleRequest(const ResourceRequest&) const {
   // FIXME: this appears to be used only by the context menu code to determine
   // if "open" should be displayed in the menu when clicking on a link.
diff --git a/webkit/glue/webframeloaderclient_impl.h b/webkit/glue/webframeloaderclient_impl.h
index 7612d88..a842f1a 100644
--- a/webkit/glue/webframeloaderclient_impl.h
+++ b/webkit/glue/webframeloaderclient_impl.h
@@ -44,11 +44,7 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
   virtual bool hasWebView() const; // mainly for assertions
   virtual bool hasFrameView() const; // ditto
 
-  virtual bool privateBrowsingEnabled() const;
-
-  virtual void makeDocumentView();
   virtual void makeRepresentation(WebCore::DocumentLoader*);
-  virtual void setDocumentViewFromCachedPage(WebCore::CachedPage*);
   virtual void forceLayout();
   virtual void forceLayoutForNonHTML();
 
@@ -58,8 +54,6 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
   virtual void detachedFromParent3();
   virtual void detachedFromParent4();
 
-  virtual void loadedFromCachedPage();
-
   virtual void assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader*, const WebCore::ResourceRequest&);
 
   virtual void dispatchWillSendRequest(WebCore::DocumentLoader*, unsigned long identifier, WebCore::ResourceRequest&, const WebCore::ResourceResponse& redirectResponse);
@@ -91,8 +85,8 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
   virtual void dispatchShow();
 
   virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction function, const WebCore::String& mime_type, const WebCore::ResourceRequest&);
-  virtual void dispatchDecidePolicyForNewWindowAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, const WebCore::String& frame_name);
-  virtual void dispatchDecidePolicyForNavigationAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request);
+  virtual void dispatchDecidePolicyForNewWindowAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState> form_state, const WebCore::String& frame_name);
+  virtual void dispatchDecidePolicyForNavigationAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState> form_state);
   virtual void cancelPolicyCheck();
 
   virtual void dispatchUnableToImplementPolicy(const WebCore::ResourceError&);
@@ -102,7 +96,6 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
   virtual void dispatchDidLoadMainResource(WebCore::DocumentLoader*);
   virtual void revertToProvisionalState(WebCore::DocumentLoader*);
   virtual void setMainDocumentError(WebCore::DocumentLoader*, const WebCore::ResourceError&);
-  virtual void clearUnarchivingState(WebCore::DocumentLoader*);
 
   // Maybe these should go into a ProgressTrackerClient some day
   virtual void willChangeEstimatedProgress() { }
@@ -120,10 +113,8 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
 
   virtual void committedLoad(WebCore::DocumentLoader*, const char*, int);
   virtual void finishedLoading(WebCore::DocumentLoader*);
-  virtual void finalSetupForReplace(WebCore::DocumentLoader*);
 
-  virtual void updateGlobalHistoryForStandardLoad(const WebCore::KURL&);
-  virtual void updateGlobalHistoryForReload(const WebCore::KURL&);
+  virtual void updateGlobalHistory(const WebCore::KURL&);
   virtual bool shouldGoToHistoryItem(WebCore::HistoryItem*) const;
 
   virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&);
@@ -133,16 +124,10 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
 
   virtual WebCore::ResourceError cannotShowMIMETypeError(const WebCore::ResourceResponse&);
   virtual WebCore::ResourceError fileDoesNotExistError(const WebCore::ResourceResponse&);
+  virtual WebCore::ResourceError pluginWillHandleLoadError(const WebCore::ResourceResponse&);
 
   virtual bool shouldFallBack(const WebCore::ResourceError&);
 
-  virtual void setDefersLoading(bool);
-
-  virtual bool willUseArchive(WebCore::ResourceLoader*, const WebCore::ResourceRequest&, const WebCore::KURL& originalURL) const;
-  virtual bool isArchiveLoadPending(WebCore::ResourceLoader*) const;
-  virtual void cancelPendingArchiveLoad(WebCore::ResourceLoader*);
-  virtual void clearArchivedResources();
-
   virtual bool canHandleRequest(const WebCore::ResourceRequest&) const;
   virtual bool canShowMIMEType(const WebCore::String& MIMEType) const;
   virtual bool representationExistsForURLScheme(const WebCore::String& URLScheme) const;
@@ -202,10 +187,7 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
 
   virtual void unloadListenerChanged();
 
-#if defined(OS_MACOSX)
-// The above should have && !defined(BUILDING_CHROMIUM__) at the end but can't
-// for now, since we need to add that extra define all the way down to the
-// WebCore core. TODO(avi): Get that define into WebCore.
+#if defined(__APPLE__) && !defined(BUILDING_CHROMIUM__)
   virtual NSCachedURLResponse* willCacheResponse(WebCore::DocumentLoader*,
                                                  unsigned long identifier,
                                                  NSCachedURLResponse*) const;
@@ -218,6 +200,8 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
                           const std::string& html);
 
  private:
+  void makeDocumentView();
+
   // Given a NavigationAction, determine the associated window opening
   // disposition.  For example, a middle click means "open in background tab".
   static bool ActionSpecifiesDisposition(
diff --git a/webkit/glue/webkit_glue.cc b/webkit/glue/webkit_glue.cc
index 9e40a85..e24f05c 100644
--- a/webkit/glue/webkit_glue.cc
+++ b/webkit/glue/webkit_glue.cc
@@ -27,13 +27,11 @@ MSVC_PUSH_WARNING_LEVEL(0);
 #include "Page.h"
 #include "PlatformString.h"
 #include "RenderTreeAsText.h"
+#include "RenderView.h"
+#include "ScriptController.h"
 #include "SharedBuffer.h"
 MSVC_POP_WARNING();
 
-#if USE(V8_BINDING) || USE(JAVASCRIPTCORE_BINDINGS)
-#include "JSBridge.h"  // for set flags
-#endif
-
 #undef LOG
 #undef notImplemented
 #include "webkit/glue/webkit_glue.h"
@@ -53,15 +51,15 @@ MSVC_POP_WARNING();
 namespace webkit_glue {
 
 void SetJavaScriptFlags(const std::wstring& str) {
-#if USE(V8_BINDING) || USE(JAVASCRIPTCORE_BINDINGS)
+#if USE(V8) || USE(JSC)
   std::string utf8_str = WideToUTF8(str);
-  WebCore::JSBridge::setFlags(utf8_str.data(), static_cast<int>(utf8_str.size()));
+  WebCore::ScriptController::setFlags(utf8_str.data(), static_cast<int>(utf8_str.size()));
 #endif
 }
 
 void SetRecordPlaybackMode(bool value) {
-#if USE(V8_BINDING) || USE(JAVASCRIPTCORE_BINDINGS)
-  WebCore::JSBridge::setRecordPlaybackMode(value);
+#if USE(V8) || USE(JSC)
+  WebCore::ScriptController::setRecordPlaybackMode(value);
 #endif
 }
 
@@ -127,7 +125,11 @@ std::wstring DumpDocumentText(WebFrame* web_frame) {
 
   // We use the document element's text instead of the body text here because
   // not all documents have a body, such as XML documents.
-  return StringToStdWString(frame->document()->documentElement()->innerText());
+  WebCore::Element* documentElement = frame->document()->documentElement();
+  if (!documentElement) {
+    return std::wstring();
+  }
+  return StringToStdWString(documentElement->innerText());
 }
 
 std::wstring DumpFramesAsText(WebFrame* web_frame, bool recursive) {
@@ -159,8 +161,9 @@ std::wstring DumpRenderer(WebFrame* web_frame) {
   WebFrameImpl* webFrameImpl = static_cast<WebFrameImpl*>(web_frame);
   WebCore::Frame* frame = webFrameImpl->frame();
 
-  // This implicitly converts from a DeprecatedString.
-  return StringToStdWString(WebCore::externalRepresentation(frame->renderer()));
+  WebCore::String frameText =
+      WebCore::externalRepresentation(frame->contentRenderer());
+  return StringToStdWString(frameText);
 }
 
 std::wstring DumpFrameScrollPosition(WebFrame* web_frame, bool recursive) {
@@ -268,8 +271,8 @@ void ResetBeforeTestRun(WebView* view) {
 
   // This is papering over b/850700.  But it passes a few more tests, so we'll
   // keep it for now.
-  if (frame && frame->scriptBridge())
-    frame->scriptBridge()->setEventHandlerLineno(0);
+  if (frame && frame->script())
+    frame->script()->setEventHandlerLineno(0);
 
   // Reset the last click information so the clicks generated from previous
   // test aren't inherited (otherwise can mistake single/double/triple clicks)
@@ -296,8 +299,8 @@ void CheckForLeaks() {
 bool DecodeImage(const std::string& image_data, SkBitmap* image) {
 #if defined(OS_WIN)  // TODO(port): unnecessary after the webkit merge lands.
    RefPtr<WebCore::SharedBuffer> buffer(
-       new WebCore::SharedBuffer(image_data.data(),
-                                 static_cast<int>(image_data.length())));
+       WebCore::SharedBuffer::create(image_data.data(),
+                                     static_cast<int>(image_data.length())));
   WebCore::ImageSource image_source;
   image_source.setData(buffer.get(), true);
 
diff --git a/webkit/glue/webkit_glue.h b/webkit/glue/webkit_glue.h
index 78c953a..8263f74 100644
--- a/webkit/glue/webkit_glue.h
+++ b/webkit/glue/webkit_glue.h
@@ -115,20 +115,9 @@ bool DecodeImage(const std::string& image_data, SkBitmap* image);
 //-----------------------------------------------------------------------------
 // Functions implemented by the embedder, called by WebKit:
 
-// This function is called to check if the given URL string exists in the
-// user's browsing history db.  The given URL may NOT be in canonical form and
-// it will NOT be null-terminated; use the length instead.  This function also
-// causes the hostnames' DNS record to be prefetched if is_dns_prefetch_enabled
-// is true or document_host matches the URL being checked. The hostname will
-// likewise not be null-terminated; use document_host_length instead.
-bool HistoryContains(const char16* url, int url_length, 
-                     const char* document_host, int document_host_length,
-                     bool is_dns_prefetch_enabled);
-
 // This function is called to request a prefetch of the DNS resolution for the
-// embedded URL's hostname.  The given URL may NOT be in canonical form and
-// it will NOT be null-terminated; use the length instead.
-void DnsPrefetchUrl(const char16* url, int url_length);
+// provided hostname.
+void PrefetchDns(const std::string& hostname);
 
 // This function is called to request a prefetch of the entire URL, loading it
 // into our cache for (expected) future needs.  The given URL may NOT be in 
@@ -182,6 +171,10 @@ std::wstring GetLocalizedString(int message_id);
 // specified as BINDATA in the relevant .rc file.
 std::string GetDataResource(int resource_id);
 
+// Returns an SkBitmap for a resource.  This resource must have been
+// specified as BINDATA in the relevant .rc file.
+SkBitmap* GetBitmapResource(int resource_id);
+
 #ifdef _WIN32
 // Loads and returns a cursor.
 HCURSOR LoadCursor(int cursor_id);
diff --git a/webkit/glue/webkit_resources.h b/webkit/glue/webkit_resources.h
index 075d0fd..cc6bbd0 100644
--- a/webkit/glue/webkit_resources.h
+++ b/webkit/glue/webkit_resources.h
@@ -4,6 +4,15 @@
 #define IDR_BROKENIMAGE                 2000
 #define IDR_TICKMARK_DASH               2001
 #define IDR_FEED_PREVIEW                2002
+#define IDC_PAN_MIDDLE                  2003
+#define IDC_PAN_NORTH                   2004
+#define IDC_PAN_NORTH_EAST              2005
+#define IDC_PAN_EAST                    2006
+#define IDC_PAN_SOUTH_EAST              2007
+#define IDC_PAN_SOUTH                   2008
+#define IDC_PAN_SOUTH_WEST              2009
+#define IDC_PAN_WEST                    2010
+#define IDC_PAN_NORTH_WEST              2011
 
 #define IDC_ALIAS                       2100
 #define IDC_CELL                        2101
diff --git a/webkit/glue/webkit_resources.rc b/webkit/glue/webkit_resources.rc
index b71c338..8588ab5 100644
--- a/webkit/glue/webkit_resources.rc
+++ b/webkit/glue/webkit_resources.rc
@@ -16,8 +16,16 @@
 
 IDR_BROKENIMAGE            BINDATA "webkit\\glue\\resources\\broken-image.gif"
 IDR_TICKMARK_DASH          BINDATA "webkit\\glue\\resources\\dash.png"
-
 IDR_FEED_PREVIEW           BINDATA "webkit\\glue\\resources\\feed.html"
+IDC_PAN_MIDDLE             BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panIcon.png"
+IDC_PAN_NORTH              BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panNorthCursor.png"
+IDC_PAN_NORTH_EAST         BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panNorthEastCursor.png"
+IDC_PAN_EAST               BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panEastCursor.png"
+IDC_PAN_SOUTH_EAST         BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panSouthEastCursor.png"
+IDC_PAN_SOUTH              BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panSouthCursor.png"
+IDC_PAN_SOUTH_WEST         BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panSouthWestCursor.png"
+IDC_PAN_WEST               BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panWestCursor.png"
+IDC_PAN_NORTH_WEST         BINDATA "third_party\\WebKit\\WebKit\\win\\WebKit.vcproj\\panNorthWestCursor.png"
 
 /////////////////////////////////////////////////////////////////////////////
 //
diff --git a/webkit/glue/webplugin_impl.cc b/webkit/glue/webplugin_impl.cc
index dd28c1d..a35704c 100644
--- a/webkit/glue/webplugin_impl.cc
+++ b/webkit/glue/webplugin_impl.cc
@@ -28,6 +28,7 @@
 #include "ResourceHandle.h"
 #include "ResourceHandleClient.h"
 #include "ResourceResponse.h"
+#include "ScriptController.h"
 #include "ScrollView.h"
 #include "Widget.h"
 #pragma warning(pop)
@@ -313,7 +314,6 @@ bool WebPluginImpl::ExecuteScript(const std::string& url,
   // For KJS, keeping a pointer to the JSBridge is enough, but for V8
   // we also need to addref the frame.
   WTF::RefPtr<WebCore::Frame> cur_frame(frame());
-  WebCore::JSBridge* bridge = cur_frame->scriptBridge();
 
   bool succ = false;
   WebCore::String result_str = frame()->loader()->executeScript(script_str,
@@ -357,11 +357,11 @@ bool WebPluginImpl::SetPostData(WebCore::ResourceRequest* request,
     request->addHTTPHeaderField(webkit_glue::StdStringToString(names[i]),
                                 webkit_glue::StdStringToString(values[i]));
 
-  WebCore::FormData *data = new WebCore::FormData();
+  RefPtr<WebCore::FormData> data = WebCore::FormData::create();
   if (body.size())
     data->appendData(&body.front(), body.size());
 
-  request->setHTTPBody(data);  // request refcounts FormData
+  request->setHTTPBody(data.release());
 
   return rv;
 }
@@ -381,7 +381,7 @@ RoutingStatus WebPluginImpl::RouteToFrame(const char *method,
     return NOT_ROUTED;
 
   // Take special action for javascript URLs
-  WebCore::DeprecatedString str_target = target;
+  WebCore::String str_target = target;
   if (is_javascript_url) {
     WebCore::Frame *frameTarget = frame()->tree()->find(str_target);
     // For security reasons, do not allow javascript on frames
@@ -402,17 +402,16 @@ RoutingStatus WebPluginImpl::RouteToFrame(const char *method,
   WebCore::String complete_url_str = frame()->document()->completeURL(
       WebCore::String(url));
 
-  WebCore::KURL complete_url_kurl(complete_url_str.deprecatedString());
+  WebCore::KURL complete_url_kurl(complete_url_str);
 
   if (strcmp(method, "GET") != 0) {
-    const WebCore::DeprecatedString& protocol_scheme =
+    const WebCore::String& protocol_scheme =
           complete_url_kurl.protocol();
     // We're only going to route HTTP/HTTPS requests
     if ((protocol_scheme != "http") && (protocol_scheme != "https"))
       return INVALID_URL;
   }
 
-  // url.deprecatedString());
   *completeURL = webkit_glue::KURLToGURL(complete_url_kurl);
   WebCore::ResourceRequest request(complete_url_kurl);
   request.setHTTPMethod(method);
@@ -436,12 +435,12 @@ RoutingStatus WebPluginImpl::RouteToFrame(const char *method,
   WebCore::FrameLoader *loader = frame()->loader();
   // we actually don't know whether usergesture is true or false,
   // passing true since all we can do is assume it is okay.
-  loader->load(load_request,
-               false,  // lock history
-               true,   // user gesture
-               0,      // event
-               0,      // form element
-               HashMap<WebCore::String, WebCore::String>());
+  loader->loadFrameRequestWithFormAndValues(
+      load_request,
+      false,  // lock history
+      0,      // event
+      0,      // form element
+      HashMap<WebCore::String, WebCore::String>());
 
   // load() can cause the frame to go away.
   if (webframe_) {
@@ -464,7 +463,7 @@ NPObject* WebPluginImpl::GetWindowScriptNPObject() {
     return 0;
   }
 
-  return frame()->windowScriptNPObject();
+  return frame()->script()->windowScriptNPObject();
 }
 
 NPObject* WebPluginImpl::GetPluginElement() {
@@ -635,7 +634,7 @@ void WebPluginImpl::paint(WebCore::GraphicsContext* gc,
                 static_cast<float>(origin.y()));
 
   // HDC is only used when in windowless mode.
-  HDC hdc = gc->getWindowsContext();
+  HDC hdc = gc->getWindowsContext(damage_rect); // Is this the right rect?
 
   WebCore::IntRect window_rect =
       WebCore::IntRect(view->contentsToWindow(damage_rect.location()),
@@ -643,7 +642,7 @@ void WebPluginImpl::paint(WebCore::GraphicsContext* gc,
 
   delegate_->Paint(hdc, gfx::Rect(window_rect));
 
-  gc->releaseWindowsContext(hdc);
+  gc->releaseWindowsContext(hdc, damage_rect);
   gc->restore();
 }
 
@@ -655,9 +654,11 @@ void WebPluginImpl::print(WebCore::GraphicsContext* gc) {
     return;
 
   gc->save();
-  HDC hdc = gc->getWindowsContext();
+  // Our implementation of getWindowsContext doesn't care about any of the
+  // parameters, so just pass some random ones in.
+  HDC hdc = gc->getWindowsContext(WebCore::IntRect(), true, true);
   delegate_->Print(hdc);
-  gc->releaseWindowsContext(hdc);
+  gc->releaseWindowsContext(hdc, WebCore::IntRect(), true, true);
   gc->restore();
 }
 
@@ -884,8 +885,7 @@ void WebPluginImpl::didReceiveResponse(WebCore::ResourceHandle* handle,
   // fate of the HTTP requests issued via NPN_GetURLNotify. Webkit and FF
   // destroy the stream and invoke the NPP_DestroyStream function on the
   // plugin if the HTTP request fails.
-  const WebCore::DeprecatedString& protocol_scheme =
-      response.url().protocol();
+  const WebCore::String& protocol_scheme = response.url().protocol();
   if ((protocol_scheme == "http") || (protocol_scheme == "https")) {
     if (response.httpStatusCode() < 100 || response.httpStatusCode() >= 400) {
       // The plugin instance could be in the process of deletion here.
@@ -960,7 +960,7 @@ void WebPluginImpl::SetContainer(WebPluginContainer* container) {
     // of those sub JSObjects.
     if (frame()) {
       ASSERT(widget_ != NULL);
-      frame()->cleanupScriptObjectsForPlugin(widget_);
+      frame()->script()->cleanupScriptObjectsForPlugin(widget_);
     }
 
     // Call PluginDestroyed() first to prevent the plugin from calling us back
@@ -1039,12 +1039,12 @@ void WebPluginImpl::HandleURLRequest(const char *method,
     // Convert the javascript: URL to javascript by unescaping. WebCore uses
     // decode_string for this, so we do, too.
     std::string escaped_script = original_url.substr(strlen("javascript:"));
-    WebCore::DeprecatedString script = WebCore::KURL::decode_string(
-        WebCore::DeprecatedString(escaped_script.data(),
+    WebCore::String script = WebCore::decodeURLEscapeSequences(
+        WebCore::String(escaped_script.data(),
                                   static_cast<int>(escaped_script.length())));
 
     ExecuteScript(original_url,
-                  webkit_glue::DeprecatedStringToStdWString(script), notify,
+                  webkit_glue::StringToStdWString(script), notify,
                   reinterpret_cast<int>(notify_data), popups_allowed);
   } else {
     std::string complete_url_string;
@@ -1077,18 +1077,20 @@ bool WebPluginImpl::InitiateHTTPRequest(int resource_id,
                                         WebPluginResourceClient* client,
                                         const char* method, const char* buf,
                                         int buf_len,
-                                        const GURL& complete_url_string,
+                                        const GURL& url,
                                         const char* range_info) {
   if (!client) {
     NOTREACHED();
     return false;
   }
 
+  WebCore::KURL kurl = webkit_glue::GURLToKURL(url);
+
   ClientInfo info;
   info.id = resource_id;
   info.client = client;
   info.request.setFrame(frame());
-  info.request.setURL(webkit_glue::GURLToKURL(complete_url_string));
+  info.request.setURL(kurl);
   info.request.setOriginPid(delegate_->GetProcessId());
   info.request.setResourceType(ResourceType::OBJECT);
   info.request.setHTTPMethod(method);
@@ -1105,10 +1107,8 @@ bool WebPluginImpl::InitiateHTTPRequest(int resource_id,
     referrer = webkit_glue::StdStringToString(plugin_url_.spec());
   }
 
-  if (!WebCore::FrameLoader::shouldHideReferrer(
-          complete_url_string.spec().c_str(), referrer)) {
+  if (!WebCore::FrameLoader::shouldHideReferrer(kurl, referrer))
     info.request.setHTTPReferrer(referrer);
-  }
 
   if (lstrcmpA(method, "POST") == 0) {
     // Adds headers or form data to a request.  This must be called before
diff --git a/webkit/glue/webplugin_impl.h b/webkit/glue/webplugin_impl.h
index e83427f..b7a4dab 100644
--- a/webkit/glue/webplugin_impl.h
+++ b/webkit/glue/webplugin_impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef WEBKIT_GLUE_WEBPLUGIN_IMPL_H__
-#define WEBKIT_GLUE_WEBPLUGIN_IMPL_H__
+#ifndef WEBKIT_GLUE_WEBPLUGIN_IMPL_H_
+#define WEBKIT_GLUE_WEBPLUGIN_IMPL_H_
 
 #include <string>
 #include <map>
@@ -29,7 +29,6 @@ class WebPluginImpl;
 class MultipartResponseDelegate;
 
 namespace WebCore {
-  class DeprecatedString;
   class Element;
   class Event;
   class Frame;
@@ -151,7 +150,7 @@ class WebPluginImpl : public WebPlugin,
   // Returns true on success.
   bool InitiateHTTPRequest(int resource_id, WebPluginResourceClient* client,
                            const char* method, const char* buf, int buf_len,
-                           const GURL& complete_url_string,
+                           const GURL& url,
                            const char* range_info);
 
   gfx::Rect GetWindowClipRect(const gfx::Rect& rect);
@@ -287,8 +286,7 @@ class WebPluginImpl : public WebPlugin,
   // The plugin source URL.
   GURL plugin_url_;
 
-  DISALLOW_EVIL_CONSTRUCTORS(WebPluginImpl);
+  DISALLOW_COPY_AND_ASSIGN(WebPluginImpl);
 };
 
-#endif  // #ifndef WEBKIT_GLUE_WEBPLUGIN_IMPL_H__
-
+#endif  // #ifndef WEBKIT_GLUE_WEBPLUGIN_IMPL_H_
diff --git a/webkit/glue/webpreferences.h b/webkit/glue/webpreferences.h
index 23624fe..d66e41a 100644
--- a/webkit/glue/webpreferences.h
+++ b/webkit/glue/webpreferences.h
@@ -69,7 +69,6 @@ struct WebPreferences {
         shrinks_standalone_images_to_fit(true),
         uses_universal_detector(false),  // Disabled: page cycler regression
         text_areas_are_resizable(true),
-        dashboard_compatibility_mode(false),
         java_enabled(true),
         allow_scripts_to_close_windows(false),
         uses_page_cache(false),
diff --git a/webkit/glue/webtextinput_impl.cc b/webkit/glue/webtextinput_impl.cc
index cfbf91c5..17d5f8e 100644
--- a/webkit/glue/webtextinput_impl.cc
+++ b/webkit/glue/webtextinput_impl.cc
@@ -117,7 +117,7 @@ void WebTextInputImpl::MarkedRange(std::string* range_str) {
 
 void WebTextInputImpl::SelectedRange(std::string* range_str) {
   WTF::RefPtr<WebCore::Range> range
-      = GetFrame()->selectionController()->toRange();
+      = GetFrame()->selection()->toRange();
 
   // Range::toString() returns a string different from what test expects.
   // So we need to construct the string ourselves.
diff --git a/webkit/glue/webview_impl.cc b/webkit/glue/webview_impl.cc
index 519ce78..60a6fb7 100644
--- a/webkit/glue/webview_impl.cc
+++ b/webkit/glue/webview_impl.cc
@@ -126,7 +126,8 @@ WebView* WebView::Create(WebViewDelegate* delegate,
   instance->delegate_ = delegate;
   // Restrict the access to the local file system
   // (see WebView.mm WebView::_commonInitializationWithFrameName).
-  FrameLoader::setRestrictAccessToLocal(true);
+  FrameLoader::setLocalLoadPolicy(
+      FrameLoader::AllowLocalLoadsForLocalOnly);
   return instance;
 }
 
@@ -143,6 +144,11 @@ WebViewImpl::WebViewImpl()
       suppress_next_keypress_event_(false),
       window_open_disposition_(IGNORE_ACTION),
       ime_accept_events_(true) {
+  // WebKit/win/WebView.cpp does the same thing, except they call teh
+  // KJS specific wrapper around this method. We need to have threading
+  // initialized because icu requires it.
+  WTF::initializeThreading();
+
   // set to impossible point so we always get the first mouse pos
   last_mouse_position_.SetPoint(-1, -1);
 
@@ -377,12 +383,16 @@ bool WebViewImpl::CharEvent(const WebKeyboardEvent& event) {
 * webkit\webkit\win\WebView.cpp. The only significant change in this
 * function is the code to convert from a Keyboard event to the Right
 * Mouse button up event.
+* 
+* This function is an ugly copy/paste and should be cleaned up when the
+* WebKitWin version is cleaned: https://bugs.webkit.org/show_bug.cgi?id=20438
 */
 #if defined(OS_WIN)
 // TODO(pinkerton): implement on non-windows
 bool WebViewImpl::SendContextMenuEvent(const WebKeyboardEvent& event) {
   static const int kContextMenuMargin = 1;
-  FrameView* view = page()->mainFrame()->view();
+  Frame* main_frame = page()->mainFrame();
+  FrameView* view = main_frame->view();
   if (!view)
     return false;
 
@@ -392,9 +402,8 @@ bool WebViewImpl::SendContextMenuEvent(const WebKeyboardEvent& event) {
 
   // The context menu event was generated from the keyboard, so show the
   // context menu by the current selection.
-  Position start =
-      page()->mainFrame()->selectionController()->selection().start();
-  Position end = page()->mainFrame()->selectionController()->selection().end();
+  Position start = main_frame->selection()->selection().start();
+  Position end = main_frame->selection()->selection().end();
 
   if (!start.node() || !end.node()) {
     location =
@@ -404,26 +413,12 @@ bool WebViewImpl::SendContextMenuEvent(const WebKeyboardEvent& event) {
     RenderObject* renderer = start.node()->renderer();
     if (!renderer)
       return false;
-    // Calculate the rect of the first line of the selection (cribbed from
-    // -[WebCoreFrameBridge firstRectForDOMRange:]).
-    int extra_width_to_EOL = 0;
-    IntRect start_caret_rect = renderer->caretRect(start.offset(), DOWNSTREAM,
-                                                   &extra_width_to_EOL);
-    IntRect end_caret_rect = renderer->caretRect(end.offset(), UPSTREAM);
-    IntRect first_rect;
-    if (start_caret_rect.y() == end_caret_rect.y()) {
-      first_rect = IntRect(std::min(start_caret_rect.x(), end_caret_rect.x()),
-                           start_caret_rect.y(),
-                           abs(end_caret_rect.x() - start_caret_rect.x()),
-                           max(start_caret_rect.height(),
-                               end_caret_rect.height()));
-    } else {
-      first_rect = IntRect(start_caret_rect.x(), start_caret_rect.y(),
-                           start_caret_rect.width() + extra_width_to_EOL,
-                           start_caret_rect.height());
-    }
-    location = IntPoint(right_aligned ? first_rect.right() :
-                            first_rect.x(), first_rect.bottom());
+
+    RefPtr<Range> selection = main_frame->selection()->toRange();
+    IntRect first_rect = main_frame->firstRectForRange(selection.get());
+
+    int x = right_aligned ? first_rect.right() : first_rect.x();
+    location = IntPoint(x, first_rect.bottom());
   }
 
   location = view->contentsToWindow(location);
@@ -636,7 +631,7 @@ void WebViewImpl::SetFocusedFrame(WebFrame* frame) {
     // Clears the focused frame if any.
     Frame* frame = GetFocusedWebCoreFrame();
     if (frame)
-      frame->selectionController()->setFocused(false);
+      frame->selection()->setFocused(false);
     return;
   }
   WebFrameImpl* frame_impl = static_cast<WebFrameImpl*>(frame);
@@ -788,14 +783,14 @@ void WebViewImpl::SetFocus(bool enable) {
     GetFocusedFrame();
     if (main_frame_ && main_frame_->frame()) {
       Frame* frame = main_frame_->frame();
-      if (!frame->selectionController()->isFocusedAndActive()) {
+      if (!frame->selection()->isFocusedAndActive()) {
         // No one has focus yet, try to restore focus.
         RestoreFocus();
         frame->page()->focusController()->setActive(true);
       }
       Frame* focused_frame =
           frame->page()->focusController()->focusedOrMainFrame();
-      frame->selectionController()->setFocused(frame == focused_frame);
+      frame->selection()->setFocused(frame == focused_frame);
     }
     ime_accept_events_ = true;
   } else {
@@ -838,7 +833,7 @@ void WebViewImpl::SetFocus(bool enable) {
     }
     // Make sure the main frame doesn't think it has focus.
     if (frame != focused.get())
-      frame->selectionController()->setFocused(false);
+      frame->selection()->setFocused(false);
   }
 }
 
@@ -971,7 +966,7 @@ bool WebViewImpl::ImeUpdateStatus(bool* enable_ime, const void **id,
   const Editor* editor = focused->editor();
   if (!editor || !editor->canEdit())
     return false;
-  const SelectionController* controller = focused->selectionController();
+  const SelectionController* controller = focused->selection();
   if (!controller)
     return false;
   const Node* node = controller->start().node();
@@ -1022,11 +1017,11 @@ void WebViewImpl::SetInitialFocus(bool reverse) {
     // We have to set the key type explicitly to avoid an assert in the
     // KeyboardEvent constructor.
     platform_event.SetKeyType(PlatformKeyboardEvent::RawKeyDown);
-    KeyboardEvent webkit_event(platform_event, NULL);
+    RefPtr<KeyboardEvent> webkit_event = KeyboardEvent::create(platform_event, NULL);
     page()->focusController()->setInitialFocus(
         reverse ? WebCore::FocusDirectionBackward :
                   WebCore::FocusDirectionForward,
-        &webkit_event);
+        webkit_event.get());
   }
 }
 
@@ -1122,8 +1117,6 @@ void WebViewImpl::SetPreferences(const WebPreferences& preferences) {
   // change this, since it would break existing rich text editors.
   settings->setEditableLinkBehavior(WebCore::EditableLinkNeverLive);
 
-  settings->setUsesDashboardBackwardCompatibilityMode(
-      preferences.dashboard_compatibility_mode);
   settings->setFontRenderingMode(NormalRenderingMode);
   settings->setJavaEnabled(preferences.java_enabled);
 
@@ -1132,13 +1125,6 @@ void WebViewImpl::SetPreferences(const WebPreferences& preferences) {
   // draw some form controls.  We let it know each time the size changes.
   WebCore::RenderThemeWin::setDefaultFontSize(preferences.default_font_size);
 #endif
-
-  // Used to make sure if the frameview needs layout, layout is triggered
-  // during Document::updateLayout().  TODO(tc): See bug 1199269 for more
-  // details.
-  FrameView* frameview = main_frame()->frameview();
-  if (frameview && frameview->needsLayout())
-    frameview->setNeedsLayout();
 }
 
 const WebPreferences& WebViewImpl::GetPreferences() {
@@ -1173,10 +1159,10 @@ void WebViewImpl::MakeTextLarger() {
   double multiplier = std::min(std::pow(kTextSizeMultiplierRatio,
                                         text_zoom_level_ + 1),
                                kMaxTextSizeMultiplier);
-  int zoom_factor = static_cast<int>(100.0 * multiplier);
+  float zoom_factor = static_cast<float>(multiplier);
   if (zoom_factor != frame->zoomFactor()) {
     ++text_zoom_level_;
-    frame->setZoomFactor(zoom_factor);
+    frame->setZoomFactor(zoom_factor, true);
   }
 }
 
@@ -1185,16 +1171,16 @@ void WebViewImpl::MakeTextSmaller() {
   double multiplier = std::max(std::pow(kTextSizeMultiplierRatio,
                                         text_zoom_level_ - 1),
                                kMinTextSizeMultiplier);
-  int zoom_factor = static_cast<int>(100.0 * multiplier);
+  float zoom_factor = static_cast<float>(multiplier);
   if (zoom_factor != frame->zoomFactor()) {
     --text_zoom_level_;
-    frame->setZoomFactor(zoom_factor);
+    frame->setZoomFactor(zoom_factor, true);
   }
 }
 
 void WebViewImpl::MakeTextStandardSize() {
   text_zoom_level_ = 0;
-  main_frame()->frame()->setZoomFactor(100);
+  main_frame()->frame()->setZoomFactor(1.0f, true);
 }
 
 void WebViewImpl::CopyImageAt(int x, int y) {