Merge Chromium.org at r11.0.672.0: Initial merge by git.

Change-Id: I8b4aaf611a2a405fe3fe10e8a94ea7658645c192

22 files changed, 359 insertions, 242 deletions

diff --git a/chrome/browser/in_process_webkit/browser_webkitclient_impl.cc b/chrome/browser/in_process_webkit/browser_webkitclient_impl.cc
index 57a0a14..da76fa2 100644
--- a/chrome/browser/in_process_webkit/browser_webkitclient_impl.cc
+++ b/chrome/browser/in_process_webkit/browser_webkitclient_impl.cc
@@ -10,10 +10,10 @@
 #include "chrome/browser/in_process_webkit/indexed_db_key_utility_client.h"
 #include "chrome/common/indexed_db_key.h"
 #include "chrome/common/serialized_script_value.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebData.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebSerializedScriptValue.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebURL.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebData.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSerializedScriptValue.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebURL.h"
 #include "webkit/glue/webkit_glue.h"
 
 BrowserWebKitClientImpl::BrowserWebKitClientImpl() {
@@ -147,19 +147,10 @@ int BrowserWebKitClientImpl::databaseDeleteFile(
   return file_util::Delete(path, false) ? 0 : 1;
 }
 
-void BrowserWebKitClientImpl::idbShutdown() {
-  if (indexed_db_key_utility_client_.get())
-    indexed_db_key_utility_client_->EndUtilityProcess();
-}
-
 void BrowserWebKitClientImpl::createIDBKeysFromSerializedValuesAndKeyPath(
     const WebKit::WebVector<WebKit::WebSerializedScriptValue>& values,
     const WebKit::WebString& keyPath,
     WebKit::WebVector<WebKit::WebIDBKey>& keys) {
-  if (!indexed_db_key_utility_client_.get()) {
-    indexed_db_key_utility_client_ = new IndexedDBKeyUtilityClient();
-    indexed_db_key_utility_client_->StartUtilityProcess();
-  }
 
   std::vector<SerializedScriptValue> std_values;
   size_t size = values.size();
@@ -168,8 +159,9 @@ void BrowserWebKitClientImpl::createIDBKeysFromSerializedValuesAndKeyPath(
     std_values.push_back(SerializedScriptValue(values[i]));
 
   std::vector<IndexedDBKey> std_keys;
-  indexed_db_key_utility_client_->CreateIDBKeysFromSerializedValuesAndKeyPath(
-      std_values, keyPath, &std_keys);
+  IndexedDBKeyUtilityClient::
+      CreateIDBKeysFromSerializedValuesAndKeyPath(std_values, keyPath,
+                                                  &std_keys);
 
   keys = std_keys;
 }
diff --git a/chrome/browser/in_process_webkit/browser_webkitclient_impl.h b/chrome/browser/in_process_webkit/browser_webkitclient_impl.h
index bc0dd5d..54ada73 100644
--- a/chrome/browser/in_process_webkit/browser_webkitclient_impl.h
+++ b/chrome/browser/in_process_webkit/browser_webkitclient_impl.h
@@ -6,7 +6,6 @@
 #define CHROME_BROWSER_IN_PROCESS_WEBKIT_BROWSER_WEBKITCLIENT_IMPL_H_
 #pragma once
 
-#include "base/ref_counted.h"
 #include "webkit/glue/webfileutilities_impl.h"
 #include "webkit/glue/webkitclient_impl.h"
 
@@ -49,7 +48,6 @@ class BrowserWebKitClientImpl : public webkit_glue::WebKitClientImpl {
   virtual WebKit::WebSharedWorkerRepository* sharedWorkerRepository();
   virtual int databaseDeleteFile(const WebKit::WebString& vfs_file_name,
                                  bool sync_dir);
-  virtual void idbShutdown();
   virtual void createIDBKeysFromSerializedValuesAndKeyPath(
       const WebKit::WebVector<WebKit::WebSerializedScriptValue>& values,
       const WebKit::WebString& keyPath,
@@ -57,7 +55,6 @@ class BrowserWebKitClientImpl : public webkit_glue::WebKitClientImpl {
 
  private:
   webkit_glue::WebFileUtilitiesImpl file_utilities_;
-  scoped_refptr<IndexedDBKeyUtilityClient> indexed_db_key_utility_client_;
 };
 
 #endif  // CHROME_BROWSER_IN_PROCESS_WEBKIT_BROWSER_WEBKITCLIENT_IMPL_H_
diff --git a/chrome/browser/in_process_webkit/dom_storage_area.cc b/chrome/browser/in_process_webkit/dom_storage_area.cc
index fdf2ebc..d2953a2 100644
--- a/chrome/browser/in_process_webkit/dom_storage_area.cc
+++ b/chrome/browser/in_process_webkit/dom_storage_area.cc
@@ -9,10 +9,10 @@
 #include "chrome/browser/in_process_webkit/dom_storage_context.h"
 #include "chrome/browser/in_process_webkit/dom_storage_namespace.h"
 #include "chrome/common/render_messages.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebSecurityOrigin.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebStorageArea.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebURL.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebStorageArea.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebURL.h"
 #include "webkit/glue/webkit_glue.h"
 
 using WebKit::WebSecurityOrigin;
diff --git a/chrome/browser/in_process_webkit/dom_storage_area.h b/chrome/browser/in_process_webkit/dom_storage_area.h
index cf5a0c7..950a2d2 100644
--- a/chrome/browser/in_process_webkit/dom_storage_area.h
+++ b/chrome/browser/in_process_webkit/dom_storage_area.h
@@ -13,7 +13,7 @@
 #include "base/string16.h"
 #include "chrome/common/dom_storage_common.h"
 #include "googleurl/src/gurl.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebStorageArea.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebStorageArea.h"
 
 class DOMStorageNamespace;
 class HostContentSettingsMap;
diff --git a/chrome/browser/in_process_webkit/dom_storage_context.cc b/chrome/browser/in_process_webkit/dom_storage_context.cc
index 1d6d627..45eae2a 100644
--- a/chrome/browser/in_process_webkit/dom_storage_context.cc
+++ b/chrome/browser/in_process_webkit/dom_storage_context.cc
@@ -15,8 +15,8 @@
 #include "chrome/browser/in_process_webkit/webkit_context.h"
 #include "chrome/common/dom_storage_common.h"
 #include "chrome/common/url_constants.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebSecurityOrigin.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebString.h"
 #include "webkit/glue/webkit_glue.h"
 
 using WebKit::WebSecurityOrigin;
@@ -49,20 +49,6 @@ const FilePath::CharType DOMStorageContext::kLocalStorageDirectory[] =
 const FilePath::CharType DOMStorageContext::kLocalStorageExtension[] =
     FILE_PATH_LITERAL(".localstorage");
 
-static const FilePath::CharType kLocalStorageOldPath[] =
-    FILE_PATH_LITERAL("localStorage");
-
-// TODO(jorlow): Remove after Chrome 4 ships.
-static void MigrateLocalStorageDirectory(const FilePath& data_path) {
-  FilePath new_path = data_path.Append(
-      DOMStorageContext::kLocalStorageDirectory);
-  FilePath old_path = data_path.Append(kLocalStorageOldPath);
-  if (!file_util::DirectoryExists(new_path) &&
-      file_util::DirectoryExists(old_path)) {
-    file_util::Move(old_path, new_path);
-  }
-}
-
 DOMStorageContext::DOMStorageContext(WebKitContext* webkit_context)
     : last_storage_area_id_(0),
       last_session_storage_namespace_id_on_ui_thread_(kLocalStorageNamespaceId),
@@ -258,10 +244,8 @@ void DOMStorageContext::DeleteAllLocalStorageFiles() {
 
 DOMStorageNamespace* DOMStorageContext::CreateLocalStorage() {
   FilePath dir_path;
-  if (!data_path_.empty()) {
-    MigrateLocalStorageDirectory(data_path_);
+  if (!data_path_.empty())
     dir_path = data_path_.Append(kLocalStorageDirectory);
-  }
   DOMStorageNamespace* new_namespace =
       DOMStorageNamespace::CreateLocalStorageNamespace(this, dir_path);
   RegisterStorageNamespace(new_namespace);
diff --git a/chrome/browser/in_process_webkit/dom_storage_context.h b/chrome/browser/in_process_webkit/dom_storage_context.h
index 68993f4..7b88671 100644
--- a/chrome/browser/in_process_webkit/dom_storage_context.h
+++ b/chrome/browser/in_process_webkit/dom_storage_context.h
@@ -30,6 +30,11 @@ class DOMStorageContext {
   explicit DOMStorageContext(WebKitContext* webkit_context);
   virtual ~DOMStorageContext();
 
+  // Invalid storage id.  No storage session will ever report this value.
+  // Used in DOMStorageMessageFilter::OnStorageAreaId when coping with
+  // interactions with non-existent storage sessions.
+  static const int64 kInvalidStorageId = -1;
+
   // Allocate a new storage area id.  Only call on the WebKit thread.
   int64 AllocateStorageAreaId();
 
diff --git a/chrome/browser/in_process_webkit/dom_storage_message_filter.cc b/chrome/browser/in_process_webkit/dom_storage_message_filter.cc
index 8b91c4c..eaaff5c 100644
--- a/chrome/browser/in_process_webkit/dom_storage_message_filter.cc
+++ b/chrome/browser/in_process_webkit/dom_storage_message_filter.cc
@@ -102,9 +102,8 @@ bool DOMStorageMessageFilter::OnMessageReceived(const IPC::Message& message,
   return handled;
 }
 
-void DOMStorageMessageFilter::BadMessageReceived() {
-  UserMetrics::RecordAction(UserMetricsAction("BadMessageTerminate_DSMF"));
-  BrowserMessageFilter::BadMessageReceived();
+void DOMStorageMessageFilter::OnDestruct() const {
+  BrowserThread::DeleteOnIOThread::Destruct(this);
 }
 
 void DOMStorageMessageFilter::OverrideThreadForMessage(
@@ -122,7 +121,7 @@ void DOMStorageMessageFilter::OnStorageAreaId(int64 namespace_id,
   DOMStorageNamespace* storage_namespace =
       Context()->GetStorageNamespace(namespace_id, true);
   if (!storage_namespace) {
-    BadMessageReceived();
+    *storage_area_id = DOMStorageContext::kInvalidStorageId;
     return;
   }
   DOMStorageArea* storage_area = storage_namespace->GetStorageArea(
@@ -135,10 +134,10 @@ void DOMStorageMessageFilter::OnLength(int64 storage_area_id,
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DOMStorageArea* storage_area = Context()->GetStorageArea(storage_area_id);
   if (!storage_area) {
-    BadMessageReceived();
-    return;
+    *length = 0;
+  } else {
+    *length = storage_area->Length();
   }
-  *length = storage_area->Length();
 }
 
 void DOMStorageMessageFilter::OnKey(int64 storage_area_id, unsigned index,
@@ -146,10 +145,10 @@ void DOMStorageMessageFilter::OnKey(int64 storage_area_id, unsigned index,
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DOMStorageArea* storage_area = Context()->GetStorageArea(storage_area_id);
   if (!storage_area) {
-    BadMessageReceived();
-    return;
+    *key = NullableString16(true);
+  } else {
+    *key = storage_area->Key(index);
   }
-  *key = storage_area->Key(index);
 }
 
 void DOMStorageMessageFilter::OnGetItem(int64 storage_area_id,
@@ -158,10 +157,10 @@ void DOMStorageMessageFilter::OnGetItem(int64 storage_area_id,
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DOMStorageArea* storage_area = Context()->GetStorageArea(storage_area_id);
   if (!storage_area) {
-    BadMessageReceived();
-    return;
+    *value = NullableString16(true);
+  } else {
+    *value = storage_area->GetItem(key);
   }
-  *value = storage_area->GetItem(key);
 }
 
 void DOMStorageMessageFilter::OnSetItem(
@@ -171,7 +170,8 @@ void DOMStorageMessageFilter::OnSetItem(
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DOMStorageArea* storage_area = Context()->GetStorageArea(storage_area_id);
   if (!storage_area) {
-    BadMessageReceived();
+    *old_value = NullableString16(true);
+    *result = WebKit::WebStorageArea::ResultOK;
     return;
   }
 
@@ -196,7 +196,7 @@ void DOMStorageMessageFilter::OnRemoveItem(
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DOMStorageArea* storage_area = Context()->GetStorageArea(storage_area_id);
   if (!storage_area) {
-    BadMessageReceived();
+    *old_value = NullableString16(true);
     return;
   }
 
@@ -209,7 +209,7 @@ void DOMStorageMessageFilter::OnClear(int64 storage_area_id, const GURL& url,
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DOMStorageArea* storage_area = Context()->GetStorageArea(storage_area_id);
   if (!storage_area) {
-    BadMessageReceived();
+    *something_cleared = false;
     return;
   }
 
diff --git a/chrome/browser/in_process_webkit/dom_storage_message_filter.h b/chrome/browser/in_process_webkit/dom_storage_message_filter.h
index bf56c04..a8e9368 100644
--- a/chrome/browser/in_process_webkit/dom_storage_message_filter.h
+++ b/chrome/browser/in_process_webkit/dom_storage_message_filter.h
@@ -35,6 +35,7 @@ class DOMStorageMessageFilter : public BrowserMessageFilter {
                                         BrowserThread::ID* thread);
   virtual bool OnMessageReceived(const IPC::Message& message,
                                  bool* message_was_ok);
+  virtual void OnDestruct() const;
 
   // Only call on the WebKit thread.
   static void DispatchStorageEvent(const NullableString16& key,
@@ -42,12 +43,10 @@ class DOMStorageMessageFilter : public BrowserMessageFilter {
       const string16& origin, const GURL& url, bool is_local_storage);
 
  private:
-  friend class base::RefCountedThreadSafe<DOMStorageMessageFilter>;
+  friend class BrowserThread;
+  friend class DeleteTask<DOMStorageMessageFilter>;
   ~DOMStorageMessageFilter();
 
-  // BrowserMessageFilter override.
-  virtual void BadMessageReceived();
-
   // Message Handlers.
   void OnStorageAreaId(int64 namespace_id, const string16& origin,
                        int64* storage_area_id);
diff --git a/chrome/browser/in_process_webkit/dom_storage_namespace.cc b/chrome/browser/in_process_webkit/dom_storage_namespace.cc
index a663a05..8097405 100644
--- a/chrome/browser/in_process_webkit/dom_storage_namespace.cc
+++ b/chrome/browser/in_process_webkit/dom_storage_namespace.cc
@@ -8,8 +8,8 @@
 #include "chrome/browser/in_process_webkit/dom_storage_area.h"
 #include "chrome/browser/in_process_webkit/dom_storage_context.h"
 #include "chrome/browser/in_process_webkit/dom_storage_message_filter.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebStorageArea.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebStorageNamespace.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebStorageArea.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebStorageNamespace.h"
 #include "webkit/glue/webkit_glue.h"
 
 using WebKit::WebStorageArea;
diff --git a/chrome/browser/in_process_webkit/dom_storage_namespace.h b/chrome/browser/in_process_webkit/dom_storage_namespace.h
index be38e34..79fc0db 100644
--- a/chrome/browser/in_process_webkit/dom_storage_namespace.h
+++ b/chrome/browser/in_process_webkit/dom_storage_namespace.h
@@ -10,7 +10,7 @@
 #include "base/scoped_ptr.h"
 #include "base/string16.h"
 #include "chrome/common/dom_storage_common.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebString.h"
 
 class DOMStorageArea;
 class DOMStorageContext;
diff --git a/chrome/browser/in_process_webkit/dom_storage_uitest.cc b/chrome/browser/in_process_webkit/dom_storage_uitest.cc
index 460d411..ac82728 100644
--- a/chrome/browser/in_process_webkit/dom_storage_uitest.cc
+++ b/chrome/browser/in_process_webkit/dom_storage_uitest.cc
@@ -1,9 +1,10 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/file_path.h"
 #include "base/file_util.h"
+#include "base/test/test_timeouts.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/automation/tab_proxy.h"
 #include "chrome/test/ui/ui_layout_test.h"
@@ -78,7 +79,8 @@ class DOMStorageTest : public UILayoutTest {
     ASSERT_TRUE(tab->SetCookie(url, ""));
     ASSERT_TRUE(tab->NavigateToURL(url));
 
-    WaitUntilCookieNonEmpty(tab.get(), url, "cleared", action_max_timeout_ms());
+    WaitUntilCookieNonEmpty(tab.get(), url, "cleared",
+                            TestTimeouts::action_max_timeout_ms());
   }
 
   // Runs each test in an array of strings until it hits a NULL.
diff --git a/chrome/browser/in_process_webkit/indexed_db_browsertest.cc b/chrome/browser/in_process_webkit/indexed_db_browsertest.cc
index fea58e0..c0320f7 100644
--- a/chrome/browser/in_process_webkit/indexed_db_browsertest.cc
+++ b/chrome/browser/in_process_webkit/indexed_db_browsertest.cc
@@ -12,7 +12,6 @@
 #include "chrome/browser/in_process_webkit/webkit_context.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/browser/ui/browser.h"
-#include "chrome/common/chrome_switches.h"
 #include "chrome/test/in_process_browser_test.h"
 #include "chrome/test/testing_profile.h"
 #include "chrome/test/thread_test_helper.h"
@@ -49,39 +48,39 @@ class IndexedDBBrowserTest : public InProcessBrowserTest {
   }
 };
 
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, CursorTest) {
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_CursorTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("cursor_test.html"))));
 }
 
-// TODO(hans): Keep an eye out for these tests going flaky. See crbug.com/63675.
-// Crashy, http://crbug.com/67422.
+// http://code.google.com/p/chromium/issues/detail?id=70773
 IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_IndexTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("index_test.html"))));
 }
 
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, KeyPathTest) {
+// http://code.google.com/p/chromium/issues/detail?id=70773
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_KeyPathTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("key_path_test.html"))));
 }
 
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, TransactionGetTest) {
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_TransactionGetTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("transaction_get_test.html"))));
 }
 
-// Crashy, http://crbug.com/68446.
+// http://code.google.com/p/chromium/issues/detail?id=70773
 IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_ObjectStoreTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("object_store_test.html"))));
 }
 
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DatabaseTest) {
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_DatabaseTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("database_test.html"))));
 }
 
-// Crashy, http://crbug.com/67422.
+// http://code.google.com/p/chromium/issues/detail?id=70773
 IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_TransactionTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("transaction_test.html"))));
 }
 
-// Crashy, http://crbug.com/66394.
+// http://code.google.com/p/chromium/issues/detail?id=70773
 IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_DoesntHangTest) {
   SimpleTest(testUrl(FilePath(
       FILE_PATH_LITERAL("transaction_run_forever.html"))));
@@ -91,7 +90,7 @@ IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_DoesntHangTest) {
 
 // In proc browser test is needed here because ClearLocalState indirectly calls
 // WebKit's isMainThread through WebSecurityOrigin->SecurityOrigin.
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, ClearLocalState) {
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_ClearLocalState) {
   // Create test files.
   ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
diff --git a/chrome/browser/in_process_webkit/indexed_db_callbacks.cc b/chrome/browser/in_process_webkit/indexed_db_callbacks.cc
index 41ac4ed..c4584c6 100644
--- a/chrome/browser/in_process_webkit/indexed_db_callbacks.cc
+++ b/chrome/browser/in_process_webkit/indexed_db_callbacks.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/in_process_webkit/indexed_db_callbacks.h"
 
+#include "chrome/common/indexed_db_messages.h"
+
 IndexedDBCallbacksBase::IndexedDBCallbacksBase(
     IndexedDBDispatcherHost* dispatcher_host,
     int32 response_id)
@@ -27,6 +29,10 @@ void IndexedDBCallbacksBase::onError(const WebKit::WebIDBDatabaseError& error) {
       response_id_, error.code(), error.message()));
 }
 
+void IndexedDBCallbacksBase::onBlocked() {
+  dispatcher_host_->Send(new IndexedDBMsg_CallbacksBlocked(response_id_));
+}
+
 void IndexedDBTransactionCallbacks::onAbort() {
   dispatcher_host_->Send(
       new IndexedDBMsg_TransactionCallbacksAbort(transaction_id_));
@@ -41,3 +47,31 @@ void IndexedDBTransactionCallbacks::onTimeout() {
   dispatcher_host_->Send(
       new IndexedDBMsg_TransactionCallbacksTimeout(transaction_id_));
 }
+
+void IndexedDBCallbacks<WebKit::WebIDBCursor>::onSuccess(
+    WebKit::WebIDBCursor* idb_object) {
+  int32 object_id = dispatcher_host()->Add(idb_object);
+  dispatcher_host()->Send(
+      new IndexedDBMsg_CallbacksSuccessIDBCursor(response_id(), object_id));
+}
+
+void IndexedDBCallbacks<WebKit::WebIDBCursor>::onSuccess(
+    const WebKit::WebSerializedScriptValue& value) {
+  dispatcher_host()->Send(
+      new IndexedDBMsg_CallbacksSuccessSerializedScriptValue(
+          response_id(), SerializedScriptValue(value)));
+}
+
+void IndexedDBCallbacks<WebKit::WebIDBKey>::onSuccess(
+    const WebKit::WebIDBKey& value) {
+  dispatcher_host()->Send(
+      new IndexedDBMsg_CallbacksSuccessIndexedDBKey(
+          response_id(), IndexedDBKey(value)));
+}
+
+void IndexedDBCallbacks<WebKit::WebSerializedScriptValue>::onSuccess(
+    const WebKit::WebSerializedScriptValue& value) {
+  dispatcher_host()->Send(
+      new IndexedDBMsg_CallbacksSuccessSerializedScriptValue(
+          response_id(), SerializedScriptValue(value)));
+}
diff --git a/chrome/browser/in_process_webkit/indexed_db_callbacks.h b/chrome/browser/in_process_webkit/indexed_db_callbacks.h
index 55bc77e..b900d15 100644
--- a/chrome/browser/in_process_webkit/indexed_db_callbacks.h
+++ b/chrome/browser/in_process_webkit/indexed_db_callbacks.h
@@ -9,12 +9,16 @@
 #include "base/basictypes.h"
 #include "base/ref_counted.h"
 #include "chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h"
-#include "chrome/common/indexed_db_messages.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBCallbacks.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBCursor.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabaseError.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBTransaction.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBTransactionCallbacks.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBCallbacks.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBCursor.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBDatabaseError.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBTransaction.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBTransactionCallbacks.h"
+
+class IndexedDBMsg_CallbacksSuccessIDBDatabase;
+class IndexedDBMsg_CallbacksSuccessIDBIndex;
+class IndexedDBMsg_CallbacksSuccessIDBObjectStore;
+class IndexedDBMsg_CallbacksSuccessIDBTransaction;
 
 // Template magic to figure out what message to send to the renderer based on
 // which (overloaded) onSuccess method we expect to be called.
@@ -41,6 +45,7 @@ class IndexedDBCallbacksBase : public WebKit::WebIDBCallbacks {
   virtual ~IndexedDBCallbacksBase();
 
   virtual void onError(const WebKit::WebIDBDatabaseError& error);
+  virtual void onBlocked();
 
  protected:
   IndexedDBDispatcherHost* dispatcher_host() const {
@@ -85,16 +90,8 @@ class IndexedDBCallbacks<WebKit::WebIDBCursor>
       IndexedDBDispatcherHost* dispatcher_host, int32 response_id)
       : IndexedDBCallbacksBase(dispatcher_host, response_id) { }
 
-  virtual void onSuccess(WebKit::WebIDBCursor* idb_object) {
-    int32 object_id = dispatcher_host()->Add(idb_object);
-    dispatcher_host()->Send(
-        new IndexedDBMsg_CallbacksSuccessIDBCursor(response_id(), object_id));
-  }
-
-  virtual void onSuccess() {
-    dispatcher_host()->Send(new IndexedDBMsg_CallbacksSuccessNull(
-        response_id()));
-  }
+  virtual void onSuccess(WebKit::WebIDBCursor* idb_object);
+  virtual void onSuccess(const WebKit::WebSerializedScriptValue& value);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBCallbacks);
@@ -111,11 +108,7 @@ class IndexedDBCallbacks<WebKit::WebIDBKey>
       IndexedDBDispatcherHost* dispatcher_host, int32 response_id)
       : IndexedDBCallbacksBase(dispatcher_host, response_id) { }
 
-  virtual void onSuccess(const WebKit::WebIDBKey& value) {
-    dispatcher_host()->Send(
-        new IndexedDBMsg_CallbacksSuccessIndexedDBKey(
-            response_id(), IndexedDBKey(value)));
-  }
+  virtual void onSuccess(const WebKit::WebIDBKey& value);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBCallbacks);
@@ -132,28 +125,7 @@ class IndexedDBCallbacks<WebKit::WebSerializedScriptValue>
       IndexedDBDispatcherHost* dispatcher_host, int32 response_id)
       : IndexedDBCallbacksBase(dispatcher_host, response_id) { }
 
-  virtual void onSuccess(const WebKit::WebSerializedScriptValue& value) {
-    dispatcher_host()->Send(
-        new IndexedDBMsg_CallbacksSuccessSerializedScriptValue(
-            response_id(), SerializedScriptValue(value)));
-  }
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBCallbacks);
-};
-
-// A WebIDBCallbacks implementation that doesn't return a result.
-template <>
-class IndexedDBCallbacks<void> : public IndexedDBCallbacksBase {
- public:
-  IndexedDBCallbacks(
-      IndexedDBDispatcherHost* dispatcher_host, int32 response_id)
-      : IndexedDBCallbacksBase(dispatcher_host, response_id) { }
-
-  virtual void onSuccess() {
-    dispatcher_host()->Send(
-        new IndexedDBMsg_CallbacksSuccessNull(response_id()));
-  }
+  virtual void onSuccess(const WebKit::WebSerializedScriptValue& value);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBCallbacks);
diff --git a/chrome/browser/in_process_webkit/indexed_db_context.cc b/chrome/browser/in_process_webkit/indexed_db_context.cc
index 86aa5fd..e2872a4 100644
--- a/chrome/browser/in_process_webkit/indexed_db_context.cc
+++ b/chrome/browser/in_process_webkit/indexed_db_context.cc
@@ -11,11 +11,11 @@
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/in_process_webkit/webkit_context.h"
 #include "chrome/common/url_constants.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebCString.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabase.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBFactory.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebSecurityOrigin.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebCString.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBDatabase.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBFactory.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebString.h"
 #include "webkit/glue/webkit_glue.h"
 
 using WebKit::WebIDBDatabase;
diff --git a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc
index 1463ab5..fad4720 100644
--- a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc
+++ b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.cc
@@ -18,17 +18,17 @@
 #include "chrome/common/indexed_db_messages.h"
 #include "chrome/common/result_codes.h"
 #include "googleurl/src/gurl.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebDOMStringList.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBCursor.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabase.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBDatabaseError.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBKeyRange.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBIndex.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBFactory.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBObjectStore.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebIDBTransaction.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebSecurityOrigin.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebVector.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDOMStringList.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBCursor.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBDatabase.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBDatabaseError.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBKeyRange.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBIndex.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBFactory.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBObjectStore.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebIDBTransaction.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebVector.h"
 #include "webkit/glue/webkit_glue.h"
 
 using WebKit::WebDOMStringList;
@@ -131,26 +131,46 @@ bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message,
 }
 
 int32 IndexedDBDispatcherHost::Add(WebIDBCursor* idb_cursor) {
+  if (!cursor_dispatcher_host_.get()) {
+    delete idb_cursor;
+    return 0;
+  }
   return cursor_dispatcher_host_->map_.Add(idb_cursor);
 }
 
 int32 IndexedDBDispatcherHost::Add(WebIDBDatabase* idb_database) {
+  if (!database_dispatcher_host_.get()) {
+    delete idb_database;
+    return 0;
+  }
   return database_dispatcher_host_->map_.Add(idb_database);
 }
 
 int32 IndexedDBDispatcherHost::Add(WebIDBIndex* idb_index) {
+  if (!index_dispatcher_host_.get())  {
+    delete idb_index;
+    return 0;
+  }
   if (!idb_index)
     return 0;
   return index_dispatcher_host_->map_.Add(idb_index);
 }
 
 int32 IndexedDBDispatcherHost::Add(WebIDBObjectStore* idb_object_store) {
+  if (!object_store_dispatcher_host_.get()) {
+    delete idb_object_store;
+    return 0;
+  }
   if (!idb_object_store)
     return 0;
   return object_store_dispatcher_host_->map_.Add(idb_object_store);
 }
 
 int32 IndexedDBDispatcherHost::Add(WebIDBTransaction* idb_transaction) {
+  if (!transaction_dispatcher_host_.get()) {
+    delete idb_transaction;
+    return 0;
+  }
   int32 id = transaction_dispatcher_host_->map_.Add(idb_transaction);
   idb_transaction->setCallbacks(new IndexedDBTransactionCallbacks(this, id));
   return id;
@@ -267,6 +287,7 @@ bool IndexedDBDispatcherHost::DatabaseDispatcherHost::OnMessageReceived(
                         OnDeleteObjectStore)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseSetVersion, OnSetVersion)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseTransaction, OnTransaction)
+    IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseClose, OnClose)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseDestroyed, OnDestroyed)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -380,7 +401,14 @@ void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnTransaction(
   *idb_transaction_id = *ec ? 0 : parent_->Add(transaction);
 }
 
-void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnDestroyed(
+void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnClose(
+    int32 idb_database_id) {
+  WebIDBDatabase* database = parent_->GetOrTerminateProcess(
+      &map_, idb_database_id);
+  database->close();
+}
+
+ void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnDestroyed(
     int32 object_id) {
   parent_->DestroyObject(&map_, object_id);
 }
@@ -556,6 +584,7 @@ bool IndexedDBDispatcherHost::ObjectStoreDispatcherHost::OnMessageReceived(
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStoreGet, OnGet)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStorePut, OnPut)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStoreDelete, OnDelete)
+    IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStoreClear, OnClear)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStoreCreateIndex, OnCreateIndex)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStoreIndex, OnIndex)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_ObjectStoreDeleteIndex, OnDeleteIndex)
@@ -630,7 +659,7 @@ void IndexedDBDispatcherHost::ObjectStoreDispatcherHost::OnPut(
   *ec = 0;
   scoped_ptr<WebIDBCallbacks> callbacks(
       new IndexedDBCallbacks<WebIDBKey>(parent_, params.response_id));
-  idb_object_store->put(params.serialized_value, params.key, params.add_only,
+  idb_object_store->put(params.serialized_value, params.key, params.put_mode,
                         callbacks.release(), *idb_transaction, *ec);
 }
 
@@ -650,11 +679,30 @@ void IndexedDBDispatcherHost::ObjectStoreDispatcherHost::OnDelete(
 
   *ec = 0;
   scoped_ptr<WebIDBCallbacks> callbacks(
-      new IndexedDBCallbacks<void>(parent_, response_id));
+      new IndexedDBCallbacks<WebSerializedScriptValue>(parent_, response_id));
   idb_object_store->deleteFunction(
       key, callbacks.release(), *idb_transaction, *ec);
 }
 
+void IndexedDBDispatcherHost::ObjectStoreDispatcherHost::OnClear(
+    int idb_object_store_id,
+    int32 response_id,
+    int32 transaction_id,
+    WebKit::WebExceptionCode* ec) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
+  WebIDBObjectStore* idb_object_store = parent_->GetOrTerminateProcess(
+      &map_, idb_object_store_id);
+  WebIDBTransaction* idb_transaction = parent_->GetOrTerminateProcess(
+      &parent_->transaction_dispatcher_host_->map_, transaction_id);
+  if (!idb_transaction || !idb_object_store)
+    return;
+
+  *ec = 0;
+  scoped_ptr<WebIDBCallbacks> callbacks(
+      new IndexedDBCallbacks<WebSerializedScriptValue>(parent_, response_id));
+  idb_object_store->clear(callbacks.release(), *idb_transaction, *ec);
+}
+
 void IndexedDBDispatcherHost::ObjectStoreDispatcherHost::OnCreateIndex(
    const IndexedDBHostMsg_ObjectStoreCreateIndex_Params& params,
    int32* index_id, WebKit::WebExceptionCode* ec) {
@@ -812,7 +860,7 @@ void IndexedDBDispatcherHost::CursorDispatcherHost::OnUpdate(
 
   *ec = 0;
   idb_cursor->update(
-      value, new IndexedDBCallbacks<void>(parent_, response_id), *ec);
+      value, new IndexedDBCallbacks<WebIDBKey>(parent_, response_id), *ec);
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnContinue(
@@ -841,7 +889,8 @@ void IndexedDBDispatcherHost::CursorDispatcherHost::OnDelete(
 
   *ec = 0;
   // TODO(jorlow): This should be delete.
-  idb_cursor->remove(new IndexedDBCallbacks<void>(parent_, response_id), *ec);
+  idb_cursor->remove(
+      new IndexedDBCallbacks<WebSerializedScriptValue>(parent_, response_id), *ec);
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
diff --git a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h
index ff21529..0d83c69 100644
--- a/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h
+++ b/chrome/browser/in_process_webkit/indexed_db_dispatcher_host.h
@@ -10,7 +10,7 @@
 #include "base/id_map.h"
 #include "chrome/browser/browser_message_filter.h"
 #include "chrome/browser/in_process_webkit/webkit_context.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebExceptionCode.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebExceptionCode.h"
 
 class HostContentSettingsMap;
 class IndexedDBKey;
@@ -105,6 +105,7 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
                        int32 mode, int32 timeout,
                        int32* idb_transaction_id,
                        WebKit::WebExceptionCode* ec);
+    void OnClose(int32 idb_database_id);
     void OnDestroyed(int32 idb_database_id);
 
     IndexedDBDispatcherHost* parent_;
@@ -168,6 +169,10 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
                   const IndexedDBKey& key,
                   int32 transaction_id,
                   WebKit::WebExceptionCode* ec);
+    void OnClear(int idb_object_store_id,
+                 int32 response_id,
+                 int32 transaction_id,
+                 WebKit::WebExceptionCode* ec);
     void OnCreateIndex(
         const IndexedDBHostMsg_ObjectStoreCreateIndex_Params& params,
         int32* index_id,
diff --git a/chrome/browser/in_process_webkit/indexed_db_key_utility_client.cc b/chrome/browser/in_process_webkit/indexed_db_key_utility_client.cc
index f708b43..e70b2a3 100644
--- a/chrome/browser/in_process_webkit/indexed_db_key_utility_client.cc
+++ b/chrome/browser/in_process_webkit/indexed_db_key_utility_client.cc
@@ -4,25 +4,155 @@
 
 #include "chrome/browser/in_process_webkit/indexed_db_key_utility_client.h"
 
-#include <vector>
-
+#include "base/lazy_instance.h"
+#include "base/synchronization/waitable_event.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/utility_process_host.h"
 #include "chrome/common/indexed_db_key.h"
 #include "chrome/common/serialized_script_value.h"
 
+// This class is used to obtain IndexedDBKeys from SerializedScriptValues
+// given an IDBKeyPath. It uses UtilityProcess to do this inside a sandbox
+// (a V8 lock is required there). At this level, all methods are synchronous
+// as required by the caller. The public API is used on WEBKIT thread,
+// but internally it moves around to UI and IO as needed.
+class KeyUtilityClientImpl
+    : public base::RefCountedThreadSafe<KeyUtilityClientImpl> {
+ public:
+  KeyUtilityClientImpl();
+
+  // Starts the UtilityProcess. Must be called before any other method.
+  void StartUtilityProcess();
+
+  // Stops the UtilityProcess. No further keys can be created after this.
+  void Shutdown();
+
+  // Synchronously obtain the |keys| from |values| for the given |key_path|.
+  void CreateIDBKeysFromSerializedValuesAndKeyPath(
+      const std::vector<SerializedScriptValue>& values,
+      const string16& key_path,
+      std::vector<IndexedDBKey>* keys);
+
+ private:
+  class Client : public UtilityProcessHost::Client {
+   public:
+    explicit Client(KeyUtilityClientImpl* parent);
+
+    // UtilityProcessHost::Client
+    virtual void OnProcessCrashed(int exit_code);
+    virtual void OnIDBKeysFromValuesAndKeyPathSucceeded(
+        int id, const std::vector<IndexedDBKey>& keys);
+    virtual void OnIDBKeysFromValuesAndKeyPathFailed(int id);
+
+   private:
+    KeyUtilityClientImpl* parent_;
+
+    DISALLOW_COPY_AND_ASSIGN(Client);
+  };
+
+  friend class base::RefCountedThreadSafe<KeyUtilityClientImpl>;
+  ~KeyUtilityClientImpl();
+
+  void GetRDHAndStartUtilityProcess();
+  void StartUtilityProcessInternal(ResourceDispatcherHost* rdh);
+  void EndUtilityProcessInternal();
+  void CallStartIDBKeyFromValueAndKeyPathFromIOThread(
+      const std::vector<SerializedScriptValue>& values,
+      const string16& key_path);
+
+  void SetKeys(const std::vector<IndexedDBKey>& keys);
+  void FinishCreatingKeys();
+
+  base::WaitableEvent waitable_event_;
+
+  // Used in both IO and WEBKIT threads, but guarded by WaitableEvent, i.e.,
+  // these members are only set / read when the other thread is blocked.
+  enum State {
+    STATE_UNINITIALIZED,
+    STATE_INITIALIZED,
+    STATE_CREATING_KEYS,
+    STATE_SHUTDOWN,
+  };
+  State state_;
+  std::vector<IndexedDBKey> keys_;
+
+  // Used in the IO thread.
+  UtilityProcessHost* utility_process_host_;
+  scoped_refptr<Client> client_;
+
+  DISALLOW_COPY_AND_ASSIGN(KeyUtilityClientImpl);
+};
+
+// IndexedDBKeyUtilityClient definitions.
+
+static base::LazyInstance<IndexedDBKeyUtilityClient> client_instance(
+    base::LINKER_INITIALIZED);
+
 IndexedDBKeyUtilityClient::IndexedDBKeyUtilityClient()
+    : is_shutdown_(false) {
+  // Note that creating the impl_ object is deferred until it is first needed,
+  // as this class can be constructed even though it never gets used.
+}
+
+IndexedDBKeyUtilityClient::~IndexedDBKeyUtilityClient() {
+  DCHECK(!impl_ || is_shutdown_);
+}
+
+//  static
+void IndexedDBKeyUtilityClient::Shutdown() {
+  IndexedDBKeyUtilityClient* instance = client_instance.Pointer();
+  if (!instance->impl_)
+    return;
+
+  instance->is_shutdown_ = true;
+  instance->impl_->Shutdown();
+}
+
+//  static
+void IndexedDBKeyUtilityClient::CreateIDBKeysFromSerializedValuesAndKeyPath(
+      const std::vector<SerializedScriptValue>& values,
+      const string16& key_path,
+      std::vector<IndexedDBKey>* keys) {
+  IndexedDBKeyUtilityClient* instance = client_instance.Pointer();
+
+  if (instance->is_shutdown_) {
+    keys->clear();
+    return;
+  }
+
+  if (!instance->impl_) {
+    instance->impl_ = new KeyUtilityClientImpl();
+    instance->impl_->StartUtilityProcess();
+  }
+
+  instance->impl_->CreateIDBKeysFromSerializedValuesAndKeyPath(values, key_path,
+                                                               keys);
+}
+
+// KeyUtilityClientImpl definitions.
+
+void KeyUtilityClientImpl::Shutdown() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+
+  utility_process_host_->EndBatchMode();
+  utility_process_host_ = NULL;
+  client_ = NULL;
+  state_ = STATE_SHUTDOWN;
+}
+
+KeyUtilityClientImpl::KeyUtilityClientImpl()
     : waitable_event_(false, false),
       state_(STATE_UNINITIALIZED),
       utility_process_host_(NULL) {
 }
 
-IndexedDBKeyUtilityClient::~IndexedDBKeyUtilityClient() {
+KeyUtilityClientImpl::~KeyUtilityClientImpl() {
   DCHECK(state_ == STATE_UNINITIALIZED || state_ == STATE_SHUTDOWN);
   DCHECK(!utility_process_host_);
   DCHECK(!client_.get());
 }
 
-void IndexedDBKeyUtilityClient::StartUtilityProcess() {
+void KeyUtilityClientImpl::StartUtilityProcess() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
   DCHECK(state_ == STATE_UNINITIALIZED);
 
@@ -32,21 +162,16 @@ void IndexedDBKeyUtilityClient::StartUtilityProcess() {
   DCHECK(ret && state_ == STATE_INITIALIZED);
 }
 
-void IndexedDBKeyUtilityClient::EndUtilityProcess() {
-  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
-  DCHECK(state_ == STATE_INITIALIZED);
-
-  EndUtilityProcessInternal();
-  bool ret = waitable_event_.Wait();
-
-  DCHECK(ret && state_ == STATE_SHUTDOWN);
-}
-
-void IndexedDBKeyUtilityClient::CreateIDBKeysFromSerializedValuesAndKeyPath(
+void KeyUtilityClientImpl::CreateIDBKeysFromSerializedValuesAndKeyPath(
     const std::vector<SerializedScriptValue>& values,
     const string16& key_path,
     std::vector<IndexedDBKey>* keys) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
+  if (state_ == STATE_SHUTDOWN) {
+    keys->clear();
+    return;
+  }
+
   DCHECK(state_ == STATE_INITIALIZED);
 
   state_ = STATE_CREATING_KEYS;
@@ -57,7 +182,7 @@ void IndexedDBKeyUtilityClient::CreateIDBKeysFromSerializedValuesAndKeyPath(
   *keys = keys_;
 }
 
-void IndexedDBKeyUtilityClient::GetRDHAndStartUtilityProcess() {
+void KeyUtilityClientImpl::GetRDHAndStartUtilityProcess() {
   // In order to start the UtilityProcess, we need to grab
   // a pointer to the ResourceDispatcherHost. This can only
   // be done on the UI thread. See the comment at the top of
@@ -67,14 +192,14 @@ void IndexedDBKeyUtilityClient::GetRDHAndStartUtilityProcess() {
         BrowserThread::UI, FROM_HERE,
         NewRunnableMethod(
             this,
-            &IndexedDBKeyUtilityClient::GetRDHAndStartUtilityProcess));
+            &KeyUtilityClientImpl::GetRDHAndStartUtilityProcess));
     return;
   }
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   StartUtilityProcessInternal(g_browser_process->resource_dispatcher_host());
 }
 
-void IndexedDBKeyUtilityClient::StartUtilityProcessInternal(
+void KeyUtilityClientImpl::StartUtilityProcessInternal(
     ResourceDispatcherHost* rdh) {
   DCHECK(rdh);
   // The ResourceDispatcherHost can only be used on the IO thread.
@@ -84,14 +209,14 @@ void IndexedDBKeyUtilityClient::StartUtilityProcessInternal(
         BrowserThread::IO, FROM_HERE,
         NewRunnableMethod(
             this,
-            &IndexedDBKeyUtilityClient::StartUtilityProcessInternal,
+            &KeyUtilityClientImpl::StartUtilityProcessInternal,
             rdh));
     return;
   }
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   DCHECK(state_ == STATE_UNINITIALIZED);
 
-  client_ = new IndexedDBKeyUtilityClient::Client(this);
+  client_ = new KeyUtilityClientImpl::Client(this);
   utility_process_host_ = new UtilityProcessHost(
       rdh, client_.get(), BrowserThread::IO);
   utility_process_host_->StartBatchMode();
@@ -99,13 +224,13 @@ void IndexedDBKeyUtilityClient::StartUtilityProcessInternal(
   waitable_event_.Signal();
 }
 
-void IndexedDBKeyUtilityClient::EndUtilityProcessInternal() {
+void KeyUtilityClientImpl::EndUtilityProcessInternal() {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         NewRunnableMethod(
             this,
-            &IndexedDBKeyUtilityClient::EndUtilityProcessInternal));
+            &KeyUtilityClientImpl::EndUtilityProcessInternal));
     return;
   }
 
@@ -116,14 +241,14 @@ void IndexedDBKeyUtilityClient::EndUtilityProcessInternal() {
   waitable_event_.Signal();
 }
 
-void IndexedDBKeyUtilityClient::CallStartIDBKeyFromValueAndKeyPathFromIOThread(
+void KeyUtilityClientImpl::CallStartIDBKeyFromValueAndKeyPathFromIOThread(
     const std::vector<SerializedScriptValue>& values,
     const string16& key_path) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         NewRunnableMethod(this,
-            &IndexedDBKeyUtilityClient::
+            &KeyUtilityClientImpl::
                 CallStartIDBKeyFromValueAndKeyPathFromIOThread,
             values, key_path));
     return;
@@ -134,33 +259,33 @@ void IndexedDBKeyUtilityClient::CallStartIDBKeyFromValueAndKeyPathFromIOThread(
       0, values, key_path);
 }
 
-void IndexedDBKeyUtilityClient::SetKeys(const std::vector<IndexedDBKey>& keys) {
+void KeyUtilityClientImpl::SetKeys(const std::vector<IndexedDBKey>& keys) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   keys_ = keys;
 }
 
-void IndexedDBKeyUtilityClient::FinishCreatingKeys() {
+void KeyUtilityClientImpl::FinishCreatingKeys() {
   DCHECK(state_ == STATE_CREATING_KEYS);
   state_ = STATE_INITIALIZED;
   waitable_event_.Signal();
 }
 
-IndexedDBKeyUtilityClient::Client::Client(IndexedDBKeyUtilityClient* parent)
+KeyUtilityClientImpl::Client::Client(KeyUtilityClientImpl* parent)
     : parent_(parent) {
 }
 
-void IndexedDBKeyUtilityClient::Client::OnProcessCrashed(int exit_code) {
+void KeyUtilityClientImpl::Client::OnProcessCrashed(int exit_code) {
   if (parent_->state_ == STATE_CREATING_KEYS)
     parent_->FinishCreatingKeys();
 }
 
-void IndexedDBKeyUtilityClient::Client::OnIDBKeysFromValuesAndKeyPathSucceeded(
+void KeyUtilityClientImpl::Client::OnIDBKeysFromValuesAndKeyPathSucceeded(
     int id, const std::vector<IndexedDBKey>& keys) {
   parent_->SetKeys(keys);
   parent_->FinishCreatingKeys();
 }
 
-void IndexedDBKeyUtilityClient::Client::OnIDBKeysFromValuesAndKeyPathFailed(
+void KeyUtilityClientImpl::Client::OnIDBKeysFromValuesAndKeyPathFailed(
     int id) {
   parent_->FinishCreatingKeys();
 }
diff --git a/chrome/browser/in_process_webkit/indexed_db_key_utility_client.h b/chrome/browser/in_process_webkit/indexed_db_key_utility_client.h
index 3a79c28..b36aafa 100644
--- a/chrome/browser/in_process_webkit/indexed_db_key_utility_client.h
+++ b/chrome/browser/in_process_webkit/indexed_db_key_utility_client.h
@@ -6,87 +6,43 @@
 #define CHROME_BROWSER_IN_PROCESS_WEBKIT_INDEXED_DB_KEY_UTILITY_CLIENT_H_
 #pragma once
 
+#include <vector>
+
 #include "base/ref_counted.h"
-#include "base/synchronization/waitable_event.h"
-#include "chrome/browser/utility_process_host.h"
+#include "base/string16.h"
 
 class IndexedDBKey;
 class SerializedScriptValue;
+class KeyUtilityClientImpl;
 
-// This class is responsible to obtain IndexedDBKeys from the
-// SerializedScriptValues given an IDBKeyPath. It uses UtilityProcess to do this
-// inside a sandbox (a V8 lock is required there). At this level, all methods
-// are synchronous as required by the caller. The public API is used on
-// WEBKIT thread, but internally it moves around to UI and IO as needed.
-class IndexedDBKeyUtilityClient
-    : public base::RefCountedThreadSafe<IndexedDBKeyUtilityClient> {
- public:
-  IndexedDBKeyUtilityClient();
-
-  // Starts the UtilityProcess. Must be called before any other method.
-  void StartUtilityProcess();
-
-  // Ends the UtilityProcess. Must be called after StartUtilityProcess() and
-  // before destruction.
-  // TODO(bulach): figure out an appropriate hook so that we can keep the
-  // UtilityProcess running for a longer period of time and avoid spinning it
-  // on every IDBObjectStore::Put call.
-  void EndUtilityProcess();
+namespace base {
+template <typename T>
+struct DefaultLazyInstanceTraits;
+}  // namespace base
 
+// Class for obtaining IndexedDBKeys from the SerializedScriptValues given
+// an IDBKeyPath. This class is a thin singleton wrapper around the
+// KeyUtilityClientImpl, which does the real work.
+class IndexedDBKeyUtilityClient {
+ public:
   // Synchronously obtain the |keys| from |values| for the given |key_path|.
-  void CreateIDBKeysFromSerializedValuesAndKeyPath(
+  static void CreateIDBKeysFromSerializedValuesAndKeyPath(
       const std::vector<SerializedScriptValue>& values,
       const string16& key_path,
       std::vector<IndexedDBKey>* keys);
 
- private:
-  class Client : public UtilityProcessHost::Client {
-   public:
-    explicit Client(IndexedDBKeyUtilityClient* parent);
-
-    // UtilityProcessHost::Client
-    virtual void OnProcessCrashed(int exit_code);
-    virtual void OnIDBKeysFromValuesAndKeyPathSucceeded(
-        int id, const std::vector<IndexedDBKey>& keys);
-    virtual void OnIDBKeysFromValuesAndKeyPathFailed(int id);
-
-   private:
-    IndexedDBKeyUtilityClient* parent_;
+  // Shut down the underlying implementation. Must be called on the IO thread.
+  static void Shutdown();
 
-    DISALLOW_COPY_AND_ASSIGN(Client);
-  };
-
-  friend class base::RefCountedThreadSafe<IndexedDBKeyUtilityClient>;
+ private:
+  friend struct base::DefaultLazyInstanceTraits<IndexedDBKeyUtilityClient>;
+  IndexedDBKeyUtilityClient();
   ~IndexedDBKeyUtilityClient();
 
-  void GetRDHAndStartUtilityProcess();
-  void StartUtilityProcessInternal(ResourceDispatcherHost* rdh);
-  void EndUtilityProcessInternal();
-  void CallStartIDBKeyFromValueAndKeyPathFromIOThread(
-      const std::vector<SerializedScriptValue>& values,
-      const string16& key_path);
-
-  void SetKeys(const std::vector<IndexedDBKey>& keys);
-  void FinishCreatingKeys();
-
-  base::WaitableEvent waitable_event_;
-
-  // Used in both IO and WEBKIT threads, but guarded by WaitableEvent, i.e.,
-  // these members are only set / read when the other thread is blocked.
-  enum State {
-    STATE_UNINITIALIZED,
-    STATE_INITIALIZED,
-    STATE_CREATING_KEYS,
-    STATE_SHUTDOWN,
-  };
-  State state_;
-  std::vector<IndexedDBKey> keys_;
-
-  // Used in the IO thread.
-  UtilityProcessHost* utility_process_host_;
-  scoped_refptr<Client> client_;
+  bool is_shutdown_;
 
-  DISALLOW_COPY_AND_ASSIGN(IndexedDBKeyUtilityClient);
+  // The real client; laziliy instantiated.
+  scoped_refptr<KeyUtilityClientImpl> impl_;
 };
 
 #endif  // CHROME_BROWSER_IN_PROCESS_WEBKIT_INDEXED_DB_KEY_UTILITY_CLIENT_H_
diff --git a/chrome/browser/in_process_webkit/webkit_context.cc b/chrome/browser/in_process_webkit/webkit_context.cc
index 5022ad5..0c72346 100644
--- a/chrome/browser/in_process_webkit/webkit_context.cc
+++ b/chrome/browser/in_process_webkit/webkit_context.cc
@@ -7,7 +7,6 @@
 #include "base/command_line.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/common/chrome_switches.h"
 
 WebKitContext::WebKitContext(Profile* profile, bool clear_local_state_on_exit)
     : data_path_(profile->IsOffTheRecord() ? FilePath() : profile->GetPath()),
diff --git a/chrome/browser/in_process_webkit/webkit_thread.cc b/chrome/browser/in_process_webkit/webkit_thread.cc
index 8ff8174..b2b469b 100644
--- a/chrome/browser/in_process_webkit/webkit_thread.cc
+++ b/chrome/browser/in_process_webkit/webkit_thread.cc
@@ -7,7 +7,7 @@
 #include "base/command_line.h"
 #include "chrome/browser/in_process_webkit/browser_webkitclient_impl.h"
 #include "chrome/common/chrome_switches.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebKit.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebKit.h"
 
 WebKitThread::WebKitThread() {
 }
diff --git a/chrome/browser/in_process_webkit/webkit_thread.h b/chrome/browser/in_process_webkit/webkit_thread.h
index 856007c..ed17434 100644
--- a/chrome/browser/in_process_webkit/webkit_thread.h
+++ b/chrome/browser/in_process_webkit/webkit_thread.h
@@ -7,7 +7,6 @@
 #pragma once
 
 #include "base/basictypes.h"
-#include "base/lock.h"
 #include "base/scoped_ptr.h"
 #include "base/threading/thread.h"
 #include "chrome/browser/browser_thread.h"