Merge chromium at 9.0.597.55: Initial merge by git.

Change-Id: Id686a88437441ec7e17abb3328a404c7b6c3c6ad

62 files changed, 840 insertions, 677 deletions

diff --git a/webkit/glue/form_field.cc b/webkit/glue/form_field.cc
index 30d22ad..bcc9926 100644
--- a/webkit/glue/form_field.cc
+++ b/webkit/glue/form_field.cc
@@ -20,13 +20,15 @@ using WebKit::WebVector;
 namespace webkit_glue {
 
 FormField::FormField()
-    : size_(0) {
+    : max_length_(0),
+      is_autofilled_(false) {
 }
 
 // TODO(jhawkins): This constructor should probably be deprecated and the
 // functionality moved to FormManager.
 FormField::FormField(WebFormControlElement element)
-    : size_(0) {
+    : max_length_(0),
+      is_autofilled_(false) {
   name_ = element.nameForAutofill();
 
   // TODO(jhawkins): Extract the field label.  For now we just use the field
@@ -37,7 +39,8 @@ FormField::FormField(WebFormControlElement element)
   if (form_control_type_ == ASCIIToUTF16("text")) {
     const WebInputElement& input_element = element.toConst<WebInputElement>();
     value_ = input_element.value();
-    size_ = input_element.size();
+    max_length_ = input_element.size();
+    is_autofilled_ = input_element.isAutofilled();
   } else if (form_control_type_ == ASCIIToUTF16("select-one")) {
     WebSelectElement select_element = element.to<WebSelectElement>();
     value_ = select_element.value();
@@ -58,12 +61,14 @@ FormField::FormField(const string16& label,
                      const string16& name,
                      const string16& value,
                      const string16& form_control_type,
-                     int size)
+                     int max_length,
+                     bool is_autofilled)
   : label_(label),
     name_(name),
     value_(value),
     form_control_type_(form_control_type),
-    size_(size) {
+    max_length_(max_length),
+    is_autofilled_(is_autofilled) {
 }
 
 FormField::~FormField() {
@@ -75,7 +80,7 @@ bool FormField::operator==(const FormField& field) const {
   return (label_ == field.label_ &&
           name_ == field.name_ &&
           form_control_type_ == field.form_control_type_ &&
-          size_ == field.size_);
+          max_length_ == field.max_length_);
 }
 
 bool FormField::operator!=(const FormField& field) const {
@@ -87,7 +92,7 @@ bool FormField::StrictlyEqualsHack(const FormField& field) const {
           name_ == field.name_ &&
           value_ == field.value_ &&
           form_control_type_ == field.form_control_type_ &&
-          size_ == field.size_);
+          max_length_ == field.max_length_);
 }
 
 std::ostream& operator<<(std::ostream& os, const FormField& field) {
@@ -100,7 +105,7 @@ std::ostream& operator<<(std::ostream& os, const FormField& field) {
       << " "
       << UTF16ToUTF8(field.form_control_type())
       << " "
-      << field.size();
+      << field.max_length();
 }
 
 }  // namespace webkit_glue
diff --git a/webkit/glue/form_field.h b/webkit/glue/form_field.h
index 1ed8d68..23b7380 100644
--- a/webkit/glue/form_field.h
+++ b/webkit/glue/form_field.h
@@ -21,14 +21,17 @@ class FormField {
             const string16& name,
             const string16& value,
             const string16& form_control_type,
-            int size);
+            int max_length,
+            bool is_autofilled);
   virtual ~FormField();
 
   const string16& label() const { return label_; }
   const string16& name() const { return name_; }
   const string16& value() const { return value_; }
   const string16& form_control_type() const { return form_control_type_; }
-  int size() const { return size_; }
+  int max_length() const { return max_length_; }
+  bool is_autofilled() const { return is_autofilled_; }
+
   // Returns option string for elements for which they make sense (select-one,
   // for example) for the rest of elements return an empty array.
   const std::vector<string16>& option_strings() const {
@@ -41,7 +44,8 @@ class FormField {
   void set_form_control_type(const string16& form_control_type) {
     form_control_type_ = form_control_type;
   }
-  void set_size(int size) { size_ = size; }
+  void set_max_length(int max_length) { max_length_ = max_length; }
+  void set_autofilled(bool is_autofilled) { is_autofilled_ = is_autofilled; }
   void set_option_strings(const std::vector<string16>& strings) {
     option_strings_ = strings;
   }
@@ -62,7 +66,8 @@ class FormField {
   string16 name_;
   string16 value_;
   string16 form_control_type_;
-  int size_;
+  int max_length_;
+  bool is_autofilled_;
   std::vector<string16> option_strings_;
 };
 
diff --git a/webkit/glue/password_form_dom_manager.cc b/webkit/glue/password_form_dom_manager.cc
index adbb8dd..97f3eef 100644
--- a/webkit/glue/password_form_dom_manager.cc
+++ b/webkit/glue/password_form_dom_manager.cc
@@ -40,23 +40,25 @@ void PasswordFormDomManager::InitFillData(
   // Fill basic form data.
   result->basic_data.origin = form_on_page.origin;
   result->basic_data.action = form_on_page.action;
-  // TODO(jhawkins): Is it right to use an empty string for the form control
-  // type?  I don't think the password autocomplete really cares, but we should
-  // correct this anyway.
-  // TODO(dhollowa): Similarly, |size| ideally should be set from the form
-  // control itself.  But it is currently unused.
+  // Three of the parameters below are set to default values because they are
+  // currently not used by the password autocomplete code:
+  // * The form control type is initialized to an empty string.
+  // * The field |max_length| is initialized to 0.
+  // * The field autofilled state is initialized to false.
   result->basic_data.fields.push_back(
       FormField(string16(),
                 form_on_page.username_element,
                 preferred_match->username_value,
                 string16(),
-                0));
+                0,
+                false));
   result->basic_data.fields.push_back(
       FormField(string16(),
                 form_on_page.password_element,
                 preferred_match->password_value,
                 string16(),
-                0));
+                0,
+                false));
   result->wait_for_username = wait_for_username_before_autofill;
 
   // Copy additional username/value pairs.
diff --git a/webkit/glue/plugins/mac_accelerated_surface_container.cc b/webkit/glue/plugins/mac_accelerated_surface_container.cc
deleted file mode 100644
index 8eca9d2..0000000
--- a/webkit/glue/plugins/mac_accelerated_surface_container.cc
+++ /dev/null
@@ -1,158 +0,0 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "webkit/glue/plugins/mac_accelerated_surface_container.h"
-
-#include "app/surface/io_surface_support_mac.h"
-#include "base/logging.h"
-#include "webkit/glue/plugins/mac_accelerated_surface_container_manager.h"
-#include "webkit/glue/plugins/webplugin.h"
-
-MacAcceleratedSurfaceContainer::MacAcceleratedSurfaceContainer()
-    : x_(0),
-      y_(0),
-      surface_(NULL),
-      width_(0),
-      height_(0),
-      texture_(0) {
-}
-
-MacAcceleratedSurfaceContainer::~MacAcceleratedSurfaceContainer() {
-  ReleaseIOSurface();
-}
-
-void MacAcceleratedSurfaceContainer::ReleaseIOSurface() {
-  if (surface_) {
-    CFRelease(surface_);
-    surface_ = NULL;
-  }
-}
-
-void MacAcceleratedSurfaceContainer::SetSizeAndIOSurface(
-    int32 width,
-    int32 height,
-    uint64 io_surface_identifier,
-    MacAcceleratedSurfaceContainerManager* manager) {
-  ReleaseIOSurface();
-  IOSurfaceSupport* io_surface_support = IOSurfaceSupport::Initialize();
-  if (io_surface_support) {
-    surface_ = io_surface_support->IOSurfaceLookup(
-        static_cast<uint32>(io_surface_identifier));
-    EnqueueTextureForDeletion(manager);
-    width_ = width;
-    height_ = height;
-  }
-}
-
-void MacAcceleratedSurfaceContainer::SetSizeAndTransportDIB(
-    int32 width,
-    int32 height,
-    TransportDIB::Handle transport_dib,
-    MacAcceleratedSurfaceContainerManager* manager) {
-  if (TransportDIB::is_valid(transport_dib)) {
-    transport_dib_.reset(TransportDIB::Map(transport_dib));
-    EnqueueTextureForDeletion(manager);
-    width_ = width;
-    height_ = height;
-  }
-}
-
-void MacAcceleratedSurfaceContainer::MoveTo(
-    const webkit_glue::WebPluginGeometry& geom) {
-  x_ = geom.window_rect.x();
-  y_ = geom.window_rect.y();
-  // TODO(kbr): may need to pay attention to cutout rects.
-  clipRect_ = geom.clip_rect;
-}
-
-void MacAcceleratedSurfaceContainer::Draw(CGLContextObj context) {
-  IOSurfaceSupport* io_surface_support = IOSurfaceSupport::Initialize();
-  GLenum target = GL_TEXTURE_RECTANGLE_ARB;
-  if (!texture_) {
-    if ((io_surface_support && !surface_) ||
-        (!io_surface_support && !transport_dib_.get()))
-      return;
-    glGenTextures(1, &texture_);
-    glBindTexture(target, texture_);
-    glTexParameterf(target, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
-    glTexParameterf(target, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
-    // When using an IOSurface, the texture does not need to be repeatedly
-    // uploaded, so bind the IOSurface once during texture gen in this case.
-    if (io_surface_support) {
-      DCHECK(surface_);
-      // Don't think we need to identify a plane.
-      GLuint plane = 0;
-      io_surface_support->CGLTexImageIOSurface2D(context,
-                                                 target,
-                                                 GL_RGBA,
-                                                 width_,
-                                                 height_,
-                                                 GL_BGRA,
-                                                 GL_UNSIGNED_INT_8_8_8_8_REV,
-                                                 surface_,
-                                                 plane);
-    } else {
-      // Reserve space on the card for the actual texture upload, done with the
-      // glTexSubImage2D() call, below.
-      glTexImage2D(target,
-                   0,  // mipmap level 0
-                   GL_RGBA,  // internal format
-                   width_,
-                   height_,
-                   0,  // no border
-                   GL_BGRA,  // The GPU plugin read BGRA pixels
-                   GL_UNSIGNED_INT_8_8_8_8_REV,
-                   NULL);  // No data, this call just reserves room.
-    }
-  }
-
-  // If using TransportDIBs, the texture needs to be uploaded every frame.
-  if (transport_dib_.get() != NULL) {
-    void* pixel_memory = transport_dib_->memory();
-    if (pixel_memory) {
-      glBindTexture(target, texture_);
-      glPixelStorei(GL_UNPACK_ALIGNMENT, 1);  // Needed for NPOT textures.
-      glTexSubImage2D(target,
-                      0,  // mipmap level 0
-                      0,  // x-offset
-                      0,  // y-offset
-                      width_,
-                      height_,
-                      GL_BGRA,  // The GPU plugin gave us BGRA pixels
-                      GL_UNSIGNED_INT_8_8_8_8_REV,
-                      pixel_memory);
-    }
-  }
-
-  if (texture_) {
-    // TODO(kbr): convert this to use only OpenGL ES 2.0 functionality
-    glBindTexture(target, texture_);
-    glEnable(target);
-    glBegin(GL_TRIANGLE_STRIP);
-    // TODO(kbr): may need to pay attention to cutout rects.
-    int clipX = clipRect_.x();
-    int clipY = clipRect_.y();
-    int clipWidth = clipRect_.width();
-    int clipHeight = clipRect_.height();
-    int x = x_ + clipX;
-    int y = y_ + clipY;
-    glTexCoord2f(clipX, height_ - clipY);
-    glVertex3f(x, y, 0);
-    glTexCoord2f(clipX + clipWidth, height_ - clipY);
-    glVertex3f(x + clipWidth, y, 0);
-    glTexCoord2f(clipX, height_ - clipY - clipHeight);
-    glVertex3f(x, y + clipHeight, 0);
-    glTexCoord2f(clipX + clipWidth, height_ - clipY - clipHeight);
-    glVertex3f(x + clipWidth, y + clipHeight, 0);
-    glEnd();
-    glDisable(target);
-  }
-}
-
-void MacAcceleratedSurfaceContainer::EnqueueTextureForDeletion(
-    MacAcceleratedSurfaceContainerManager* manager) {
-  manager->EnqueueTextureForDeletion(texture_);
-  texture_ = 0;
-}
-
diff --git a/webkit/glue/plugins/mac_accelerated_surface_container.h b/webkit/glue/plugins/mac_accelerated_surface_container.h
deleted file mode 100644
index 0fd1793..0000000
--- a/webkit/glue/plugins/mac_accelerated_surface_container.h
+++ /dev/null
@@ -1,110 +0,0 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WEBKIT_GLUE_PLUGINS_MAC_ACCELERATED_SURFACE_CONTAINER_H_
-#define WEBKIT_GLUE_PLUGINS_MAC_ACCELERATED_SURFACE_CONTAINER_H_
-
-// The "GPU plugin" is currently implemented as a special kind of
-// NPAPI plugin to provide high-performance on-screen 3D rendering for
-// Pepper 3D.
-//
-// On Windows and X11 platforms the GPU plugin relies on cross-process
-// parenting of windows, which is not supported via any public APIs in
-// the Mac OS X window system.
-//
-// To achieve full hardware acceleration we use the new IOSurface APIs
-// introduced in Mac OS X 10.6. The GPU plugin's process produces an
-// IOSurface and renders into it using OpenGL. It uses the
-// IOSurfaceGetID and IOSurfaceLookup APIs to pass a reference to this
-// surface to the browser process for on-screen rendering. The GPU
-// plugin essentially looks like a windowless plugin; the browser
-// process gets all of the mouse events, because the plugin process
-// does not have an on-screen window.
-//
-// This class encapsulates some of the management of these data
-// structures, in conjunction with the MacAcceleratedSurfaceContainerManager.
-
-#include <CoreFoundation/CoreFoundation.h>
-#include <OpenGL/OpenGL.h>
-
-#include "app/gfx/native_widget_types.h"
-#include "app/surface/transport_dib.h"
-#include "base/basictypes.h"
-#include "base/scoped_ptr.h"
-#include "base/gfx/rect.h"
-
-namespace webkit_glue {
-struct WebPluginGeometry;
-}
-
-class MacAcceleratedSurfaceContainerManager;
-
-class MacAcceleratedSurfaceContainer {
- public:
-  MacAcceleratedSurfaceContainer();
-  virtual ~MacAcceleratedSurfaceContainer();
-
-  // Sets the backing store and size of this accelerated surface container.
-  // There are two versions: the IOSurface version is used on systems where the
-  // IOSurface API is supported (Mac OS X 10.6 and later); the TransportDIB is
-  // used on Mac OS X 10.5 and earlier.
-  void SetSizeAndIOSurface(int32 width,
-                           int32 height,
-                           uint64 io_surface_identifier,
-                           MacAcceleratedSurfaceContainerManager* manager);
-  void SetSizeAndTransportDIB(int32 width,
-                              int32 height,
-                              TransportDIB::Handle transport_dib,
-                              MacAcceleratedSurfaceContainerManager* manager);
-
-  // Tells the accelerated surface container that it has moved relative to the
-  // origin of the window, for example because of a scroll event.
-  void MoveTo(const webkit_glue::WebPluginGeometry& geom);
-
-  // Draws this accelerated surface's contents, texture mapped onto a quad in
-  // the given OpenGL context. TODO(kbr): figure out and define exactly how the
-  // coordinate system will work out.
-  void Draw(CGLContextObj context);
-
-  // Enqueue our texture for later deletion. Call this before deleting
-  // this object.
-  void EnqueueTextureForDeletion(MacAcceleratedSurfaceContainerManager* manager);
-
- private:
-  // The x and y coordinates of the plugin window on the web page.
-  int x_;
-  int y_;
-
-  void ReleaseIOSurface();
-
-  // The IOSurfaceRef, if any, that has been handed from the GPU
-  // plugin process back to the browser process for drawing.
-  // This is held as a CFTypeRef because we can't refer to the
-  // IOSurfaceRef type when building on 10.5.
-  CFTypeRef surface_;
-
-  // The TransportDIB which is used in pre-10.6 systems where the IOSurface
-  // API is not supported.  This is a weak reference to the actual TransportDIB
-  // whic is owned by the GPU process.
-  scoped_ptr<TransportDIB> transport_dib_;
-
-  // The width and height of the surface.
-  int32 width_;
-  int32 height_;
-
-  // The clip rectangle, relative to the (x_, y_) origin.
-  gfx::Rect clipRect_;
-
-  // The "live" OpenGL texture referring to this IOSurfaceRef. Note
-  // that per the CGLTexImageIOSurface2D API we do not need to
-  // explicitly update this texture's contents once created. All we
-  // need to do is ensure it is re-bound before attempting to draw
-  // with it.
-  GLuint texture_;
-
-  DISALLOW_COPY_AND_ASSIGN(MacAcceleratedSurfaceContainer);
-};
-
-#endif  // WEBKIT_GLUE_PLUGINS_MAC_ACCELERATED_SURFACE_CONTAINER_H_
-
diff --git a/webkit/glue/plugins/mac_accelerated_surface_container_manager.cc b/webkit/glue/plugins/mac_accelerated_surface_container_manager.cc
deleted file mode 100644
index 635348f..0000000
--- a/webkit/glue/plugins/mac_accelerated_surface_container_manager.cc
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "webkit/glue/plugins/mac_accelerated_surface_container_manager.h"
-
-#include "base/logging.h"
-#include "webkit/glue/plugins/mac_accelerated_surface_container.h"
-#include "webkit/glue/plugins/webplugin.h"
-
-MacAcceleratedSurfaceContainerManager::MacAcceleratedSurfaceContainerManager()
-    : current_id_(0) {
-}
-
-gfx::PluginWindowHandle
-MacAcceleratedSurfaceContainerManager::AllocateFakePluginWindowHandle() {
-  MacAcceleratedSurfaceContainer* container =
-      new MacAcceleratedSurfaceContainer();
-  gfx::PluginWindowHandle res =
-      static_cast<gfx::PluginWindowHandle>(++current_id_);
-  plugin_window_to_container_map_.insert(std::make_pair(res, container));
-  return res;
-}
-
-void MacAcceleratedSurfaceContainerManager::DestroyFakePluginWindowHandle(
-    gfx::PluginWindowHandle id) {
-  MacAcceleratedSurfaceContainer* container = MapIDToContainer(id);
-  if (container)
-    delete container;
-  plugin_window_to_container_map_.erase(id);
-}
-
-void MacAcceleratedSurfaceContainerManager::SetSizeAndIOSurface(
-    gfx::PluginWindowHandle id,
-    int32 width,
-    int32 height,
-    uint64 io_surface_identifier) {
-  MacAcceleratedSurfaceContainer* container = MapIDToContainer(id);
-  if (container)
-    container->SetSizeAndIOSurface(width, height,
-                                      io_surface_identifier, this);
-}
-
-void MacAcceleratedSurfaceContainerManager::SetSizeAndTransportDIB(
-    gfx::PluginWindowHandle id,
-    int32 width,
-    int32 height,
-    TransportDIB::Handle transport_dib) {
-  MacAcceleratedSurfaceContainer* container = MapIDToContainer(id);
-  if (container)
-    container->SetSizeAndTransportDIB(width, height,
-                                      transport_dib, this);
-}
-
-void MacAcceleratedSurfaceContainerManager::MovePluginContainer(
-    const webkit_glue::WebPluginGeometry& move) {
-  MacAcceleratedSurfaceContainer* container = MapIDToContainer(move.window);
-  if (container)
-    container->MoveTo(move);
-}
-
-void MacAcceleratedSurfaceContainerManager::Draw(CGLContextObj context) {
-  glClearColor(0, 0, 0, 0);
-  glClear(GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT);
-
-  GLenum target = GL_TEXTURE_RECTANGLE_ARB;
-  glTexEnvi(target, GL_TEXTURE_ENV_MODE, GL_REPLACE);
-
-  for (PluginWindowToContainerMap::const_iterator i =
-          plugin_window_to_container_map_.begin();
-       i != plugin_window_to_container_map_.end(); ++i) {
-    MacAcceleratedSurfaceContainer* container = i->second;
-    container->Draw(context);
-  }
-
-  // Unbind any texture from the texture target to ensure that the
-  // next time through we will have to re-bind the texture and thereby
-  // pick up modifications from the other process.
-  glBindTexture(target, 0);
-
-  glFlush();
-}
-
-void MacAcceleratedSurfaceContainerManager::EnqueueTextureForDeletion(
-    GLuint texture) {
-  if (texture) {
-    textures_pending_deletion_.push_back(texture);
-  }
-}
-
-MacAcceleratedSurfaceContainer*
-    MacAcceleratedSurfaceContainerManager::MapIDToContainer(
-        gfx::PluginWindowHandle id) {
-  PluginWindowToContainerMap::const_iterator i =
-      plugin_window_to_container_map_.find(id);
-  if (i != plugin_window_to_container_map_.end())
-    return i->second;
-
-  LOG(ERROR) << "Request for plugin container for unknown window id " << id;
-
-  return NULL;
-}
-
diff --git a/webkit/glue/plugins/mac_accelerated_surface_container_manager.h b/webkit/glue/plugins/mac_accelerated_surface_container_manager.h
deleted file mode 100644
index da86e36..0000000
--- a/webkit/glue/plugins/mac_accelerated_surface_container_manager.h
+++ /dev/null
@@ -1,78 +0,0 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WEBKIT_GLUE_PLUGINS_MAC_ACCELERATED_SURFACE_CONTAINER_MANAGER_H_
-#define WEBKIT_GLUE_PLUGINS_MAC_ACCELERATED_SURFACE_CONTAINER_MANAGER_H_
-
-#include <OpenGL/OpenGL.h>
-#include <map>
-#include <vector>
-
-#include "app/gfx/native_widget_types.h"
-#include "app/surface/transport_dib.h"
-#include "base/basictypes.h"
-
-namespace webkit_glue {
-struct WebPluginGeometry;
-}
-
-class MacAcceleratedSurfaceContainer;
-
-// Helper class that manages the backing store and on-screen rendering
-// of instances of the GPU plugin on the Mac.
-class MacAcceleratedSurfaceContainerManager {
- public:
-  MacAcceleratedSurfaceContainerManager();
-
-  // Allocates a new "fake" PluginWindowHandle, which is used as the
-  // key for the other operations.
-  gfx::PluginWindowHandle AllocateFakePluginWindowHandle();
-
-  // Destroys a fake PluginWindowHandle and associated storage.
-  void DestroyFakePluginWindowHandle(gfx::PluginWindowHandle id);
-
-  // Sets the size and backing store of the plugin instance.  There are two
-  // versions: the IOSurface version is used on systems where the IOSurface
-  // API is supported (Mac OS X 10.6 and later); the TransportDIB is used on
-  // Mac OS X 10.5 and earlier.
-  void SetSizeAndIOSurface(gfx::PluginWindowHandle id,
-                           int32 width,
-                           int32 height,
-                           uint64 io_surface_identifier);
-  void SetSizeAndTransportDIB(gfx::PluginWindowHandle id,
-                              int32 width,
-                              int32 height,
-                              TransportDIB::Handle transport_dib);
-
-  // Takes an update from WebKit about a plugin's position and size and moves
-  // the plugin accordingly.
-  void MovePluginContainer(const webkit_glue::WebPluginGeometry& move);
-
-  // Draws all of the managed plugin containers into the given OpenGL
-  // context, which must already be current.
-  void Draw(CGLContextObj context);
-
-  // Called by the container to enqueue its OpenGL texture objects for
-  // deletion.
-  void EnqueueTextureForDeletion(GLuint texture);
-
- private:
-  uint32 current_id_;
-
-  // Maps a "fake" plugin window handle to the corresponding container.
-  MacAcceleratedSurfaceContainer* MapIDToContainer(gfx::PluginWindowHandle id);
-
-  // A map that associates plugin window handles with their containers.
-  typedef std::map<gfx::PluginWindowHandle, MacAcceleratedSurfaceContainer*>
-      PluginWindowToContainerMap;
-  PluginWindowToContainerMap plugin_window_to_container_map_;
-
-  // A list of OpenGL textures waiting to be deleted
-  std::vector<GLuint> textures_pending_deletion_;
-
-  DISALLOW_COPY_AND_ASSIGN(MacAcceleratedSurfaceContainerManager);
-};
-
-#endif  // WEBKIT_GLUE_PLUGINS_MAC_ACCELERATED_SURFACE_CONTAINER_MANAGER_H_
-
diff --git a/webkit/glue/plugins/pepper_audio.cc b/webkit/glue/plugins/pepper_audio.cc
index d98ef1b..1731d8a 100644
--- a/webkit/glue/plugins/pepper_audio.cc
+++ b/webkit/glue/plugins/pepper_audio.cc
@@ -7,6 +7,7 @@
 #include "base/logging.h"
 #include "ppapi/c/dev/ppb_audio_dev.h"
 #include "ppapi/c/dev/ppb_audio_trusted_dev.h"
+#include "ppapi/c/pp_completion_callback.h"
 #include "webkit/glue/plugins/pepper_common.h"
 
 namespace pepper {
@@ -77,13 +78,15 @@ const PPB_AudioConfig_Dev ppb_audioconfig = {
 // PPB_Audio -------------------------------------------------------------------
 
 PP_Resource Create(PP_Instance instance_id, PP_Resource config_id,
-                   PPB_Audio_Callback callback, void* user_data) {
+                   PPB_Audio_Callback user_callback, void* user_data) {
   PluginInstance* instance = ResourceTracker::Get()->GetInstance(instance_id);
   if (!instance)
     return 0;
-  // TODO(neb): Require callback to be present for untrusted plugins.
-  scoped_refptr<Audio> audio(new Audio(instance->module()));
-  if (!audio->Init(instance->delegate(), config_id, callback, user_data))
+  if (!user_callback)
+    return 0;
+  scoped_refptr<Audio> audio(new Audio(instance->module(), instance_id));
+  if (!audio->Init(instance->delegate(), config_id,
+                   user_callback, user_data))
     return 0;
   return audio->GetReference();
 }
@@ -118,19 +121,50 @@ const PPB_Audio_Dev ppb_audio = {
 
 // PPB_AudioTrusted ------------------------------------------------------------
 
-PP_Resource GetBuffer(PP_Resource audio_id) {
-  // TODO(neb): Implement me!
-  return 0;
+PP_Resource CreateTrusted(PP_Instance instance_id) {
+  PluginInstance* instance = ResourceTracker::Get()->GetInstance(instance_id);
+  if (!instance)
+    return 0;
+  scoped_refptr<Audio> audio(new Audio(instance->module(), instance_id));
+  return audio->GetReference();
+}
+
+int32_t Open(PP_Resource audio_id,
+             PP_Resource config_id,
+             PP_CompletionCallback created) {
+  scoped_refptr<Audio> audio = Resource::GetAs<Audio>(audio_id);
+  if (!audio)
+    return PP_ERROR_BADRESOURCE;
+  if (!created.func)
+    return PP_ERROR_BADARGUMENT;
+  PP_Instance instance_id = audio->pp_instance();
+  PluginInstance* instance = ResourceTracker::Get()->GetInstance(instance_id);
+  if (!instance)
+    return PP_ERROR_FAILED;
+  return audio->Open(instance->delegate(), config_id, created);
+}
+
+int32_t GetSyncSocket(PP_Resource audio_id, int* sync_socket) {
+  scoped_refptr<Audio> audio = Resource::GetAs<Audio>(audio_id);
+  if (audio)
+    return audio->GetSyncSocket(sync_socket);
+  return PP_ERROR_BADRESOURCE;
 }
 
-int GetOSDescriptor(PP_Resource audio_id) {
-  // TODO(neb): Implement me!
-  return -1;
+int32_t GetSharedMemory(PP_Resource audio_id,
+                        int* shm_handle,
+                        int32_t* shm_size) {
+  scoped_refptr<Audio> audio = Resource::GetAs<Audio>(audio_id);
+  if (audio)
+    return audio->GetSharedMemory(shm_handle, shm_size);
+  return PP_ERROR_BADRESOURCE;
 }
 
 const PPB_AudioTrusted_Dev ppb_audiotrusted = {
-  &GetBuffer,
-  &GetOSDescriptor
+  &CreateTrusted,
+  &Open,
+  &GetSyncSocket,
+  &GetSharedMemory,
 };
 
 }  // namespace
@@ -165,25 +199,38 @@ AudioConfig* AudioConfig::AsAudioConfig() {
 
 // Audio -----------------------------------------------------------------------
 
-Audio::Audio(PluginModule* module)
+Audio::Audio(PluginModule* module, PP_Instance instance_id)
     : Resource(module),
       playing_(false),
+      pp_instance_(instance_id),
+      audio_(NULL),
       socket_(NULL),
       shared_memory_(NULL),
       shared_memory_size_(0),
       callback_(NULL),
-      user_data_(NULL) {
+      user_data_(NULL),
+      create_callback_pending_(false) {
+  create_callback_ = PP_MakeCompletionCallback(NULL, NULL);
 }
 
 Audio::~Audio() {
   // Calling ShutDown() makes sure StreamCreated cannot be called anymore.
   audio_->ShutDown();
+  audio_ = NULL;
+
   // Closing the socket causes the thread to exit - wait for it.
   socket_->Close();
   if (audio_thread_.get()) {
     audio_thread_->Join();
     audio_thread_.reset();
   }
+
+  // If the completion callback hasn't fired yet, do so here
+  // with an error condition.
+  if (create_callback_pending_) {
+    PP_RunCompletionCallback(&create_callback_, PP_ERROR_ABORTED);
+    create_callback_pending_ = false;
+  }
   // Shared memory destructor will unmap the memory automatically.
 }
 
@@ -199,19 +246,73 @@ Audio* Audio::AsAudio() {
   return this;
 }
 
-bool Audio::Init(PluginDelegate* plugin_delegate, PP_Resource config_id,
+bool Audio::Init(PluginDelegate* plugin_delegate,
+                 PP_Resource config_id,
                  PPB_Audio_Callback callback, void* user_data) {
-  CHECK(!audio_.get());
+  CHECK(!audio_);
   config_ = Resource::GetAs<AudioConfig>(config_id);
   if (!config_)
     return false;
   callback_ = callback;
   user_data_ = user_data;
-  // When the stream is created, we'll get called back in StreamCreated().
-  audio_.reset(plugin_delegate->CreateAudio(config_->sample_rate(),
-                                            config_->sample_frame_count(),
-                                            this));
-  return audio_.get() != NULL;
+
+  // When the stream is created, we'll get called back on StreamCreated().
+  audio_ = plugin_delegate->CreateAudio(config_->sample_rate(),
+                                        config_->sample_frame_count(),
+                                        this);
+  return audio_ != NULL;
+}
+
+int32_t Audio::Open(PluginDelegate* plugin_delegate,
+                    PP_Resource config_id,
+                    PP_CompletionCallback create_callback) {
+  DCHECK(!audio_);
+  config_ = Resource::GetAs<AudioConfig>(config_id);
+  if (!config_)
+    return PP_ERROR_BADRESOURCE;
+
+  // When the stream is created, we'll get called back on StreamCreated().
+  audio_ = plugin_delegate->CreateAudio(config_->sample_rate(),
+                                        config_->sample_frame_count(),
+                                        this);
+  if (!audio_)
+    return PP_ERROR_FAILED;
+
+  // At this point, we are guaranteeing ownership of the completion
+  // callback.  Audio promises to fire the completion callback
+  // once and only once.
+  create_callback_ = create_callback;
+  create_callback_pending_ = true;
+  return PP_ERROR_WOULDBLOCK;
+}
+
+int32_t Audio::GetSyncSocket(int* sync_socket) {
+  if (socket_ != NULL) {
+#if defined(OS_POSIX)
+    *sync_socket = socket_->handle();
+#elif defined(OS_WIN)
+    *sync_socket = reinterpret_cast<int>(socket_->handle());
+#else
+    #error "Platform not supported."
+#endif
+    return PP_OK;
+  }
+  return PP_ERROR_FAILED;
+}
+
+int32_t Audio::GetSharedMemory(int* shm_handle, int32_t* shm_size) {
+  if (shared_memory_ != NULL) {
+#if defined(OS_POSIX)
+    *shm_handle = shared_memory_->handle().fd;
+#elif defined(OS_WIN)
+    *shm_handle = reinterpret_cast<int>(shared_memory_->handle());
+#else
+    #error "Platform not supported."
+#endif
+    *shm_size = shared_memory_size_;
+    return PP_OK;
+  }
+  return PP_ERROR_FAILED;
 }
 
 bool Audio::StartPlayback() {
@@ -250,8 +351,17 @@ void Audio::StreamCreated(base::SharedMemoryHandle shared_memory_handle,
   shared_memory_.reset(new base::SharedMemory(shared_memory_handle, false));
   shared_memory_size_ = shared_memory_size;
 
+  // Trusted side of proxy can specify a callback to recieve handles.
+  if (create_callback_pending_) {
+    PP_RunCompletionCallback(&create_callback_, 0);
+    create_callback_pending_ = false;
+  }
+
+  // Trusted, non-proxy audio will invoke buffer filling callback on a
+  // dedicated thread, see Audio::Run() below.
   if (callback_) {
     shared_memory_->Map(shared_memory_size_);
+
     // In common case StartPlayback() was called before StreamCreated().
     if (playing_) {
       audio_thread_.reset(new base::DelegateSimpleThread(this,
@@ -277,4 +387,3 @@ void Audio::Run() {
 }
 
 }  // namespace pepper
-
diff --git a/webkit/glue/plugins/pepper_audio.h b/webkit/glue/plugins/pepper_audio.h
index ccba021..8c14666 100644
--- a/webkit/glue/plugins/pepper_audio.h
+++ b/webkit/glue/plugins/pepper_audio.h
@@ -13,6 +13,7 @@
 #include "ppapi/c/dev/ppb_audio_dev.h"
 #include "ppapi/c/dev/ppb_audio_config_dev.h"
 #include "ppapi/c/dev/ppb_audio_trusted_dev.h"
+#include "ppapi/c/pp_completion_callback.h"
 #include "webkit/glue/plugins/pepper_plugin_delegate.h"
 #include "webkit/glue/plugins/pepper_plugin_instance.h"
 #include "webkit/glue/plugins/pepper_plugin_module.h"
@@ -46,19 +47,32 @@ class Audio : public Resource,
               public PluginDelegate::PlatformAudio::Client,
               public base::DelegateSimpleThread::Delegate {
  public:
-  explicit Audio(PluginModule* module);
+  explicit Audio(PluginModule* module, PP_Instance instance_id);
   virtual ~Audio();
 
   static const PPB_Audio_Dev* GetInterface();
   static const PPB_AudioTrusted_Dev* GetTrustedInterface();
 
-  bool Init(PluginDelegate* plugin_delegate, PP_Resource config_id,
-            PPB_Audio_Callback callback, void* user_data);
+  bool Init(PluginDelegate* plugin_delegate,
+            PP_Resource config_id,
+            PPB_Audio_Callback user_callback, void* user_data);
+
+  int32_t Open(PluginDelegate* plugin_delegate,
+               PP_Resource config_id,
+               PP_CompletionCallback create_callback);
 
   PP_Resource GetCurrentConfiguration() {
     return config_->GetReference();
   }
 
+  PP_Instance pp_instance() {
+    return pp_instance_;
+  }
+
+  int32_t GetSyncSocket(int* sync_socket);
+
+  int32_t GetSharedMemory(int* shm_handle, int32_t* shm_size);
+
   bool StartPlayback();
 
   bool StopPlayback();
@@ -83,8 +97,11 @@ class Audio : public Resource,
   // AudioConfig used for creating this Audio object.
   scoped_refptr<AudioConfig> config_;
 
+  // Instance id
+  PP_Instance pp_instance_;
+
   // PluginDelegate audio object that we delegate audio IPC through.
-  scoped_ptr<PluginDelegate::PlatformAudio> audio_;
+  PluginDelegate::PlatformAudio* audio_;
 
   // Socket used to notify us when audio is ready to accept new samples. This
   // pointer is created in StreamCreated().
@@ -106,9 +123,14 @@ class Audio : public Resource,
 
   // User data pointer passed verbatim to the callback function.
   void* user_data_;
+
+  // Is a create callback pending to fire?
+  bool create_callback_pending_;
+
+  // Trusted callback invoked from StreamCreated.
+  PP_CompletionCallback create_callback_;
 };
 
 }  // namespace pepper
 
 #endif  // WEBKIT_GLUE_PLUGINS_PEPPER_DEVICE_CONTEXT_AUDIO_H_
-
diff --git a/webkit/glue/plugins/pepper_graphics_3d_gl.cc b/webkit/glue/plugins/pepper_graphics_3d_gl.cc
index 6c301e4..0a7076f 100644
--- a/webkit/glue/plugins/pepper_graphics_3d_gl.cc
+++ b/webkit/glue/plugins/pepper_graphics_3d_gl.cc
@@ -514,47 +514,6 @@ void Viewport(GLint x, GLint y, GLsizei width, GLsizei height) {
 void SwapBuffers() {
   Graphics3D::GetCurrent()->impl()->SwapBuffers();
 }
-GLuint GetMaxValueInBuffer(
-    GLuint buffer_id, GLsizei count, GLenum type, GLuint offset) {
-  return Graphics3D::GetCurrent()->impl()->GetMaxValueInBuffer(
-      buffer_id, count, type, offset);
-}
-void GenSharedIds(
-    GLuint namespace_id, GLuint id_offset, GLsizei n, GLuint* ids) {
-  Graphics3D::GetCurrent()->impl()->GenSharedIds(
-      namespace_id, id_offset, n, ids);
-}
-void DeleteSharedIds(GLuint namespace_id, GLsizei n, const GLuint* ids) {
-  Graphics3D::GetCurrent()->impl()->DeleteSharedIds(namespace_id, n, ids);
-}
-void RegisterSharedIds(GLuint namespace_id, GLsizei n, const GLuint* ids) {
-  Graphics3D::GetCurrent()->impl()->RegisterSharedIds(namespace_id, n, ids);
-}
-GLboolean CommandBufferEnable(const char* feature) {
-  return Graphics3D::GetCurrent()->impl()->CommandBufferEnable(feature);
-}
-void* MapBufferSubData(
-    GLuint target, GLintptr offset, GLsizeiptr size, GLenum access) {
-  return Graphics3D::GetCurrent()->impl()->MapBufferSubData(
-      target, offset, size, access);
-}
-void UnmapBufferSubData(const void* mem) {
-  Graphics3D::GetCurrent()->impl()->UnmapBufferSubData(mem);
-}
-void* MapTexSubImage2D(
-    GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width,
-    GLsizei height, GLenum format, GLenum type, GLenum access) {
-  return Graphics3D::GetCurrent()->impl()->MapTexSubImage2D(
-      target, level, xoffset, yoffset, width, height, format, type, access);
-}
-void UnmapTexSubImage2D(const void* mem) {
-  Graphics3D::GetCurrent()->impl()->UnmapTexSubImage2D(mem);
-}
-void CopyTextureToParentTexture(
-    GLuint client_child_id, GLuint client_parent_id) {
-  Graphics3D::GetCurrent()->impl()->CopyTextureToParentTexture(
-      client_child_id, client_parent_id);
-}
 
 const struct PPB_OpenGLES_Dev ppb_opengles = {
   &ActiveTexture,
@@ -699,17 +658,7 @@ const struct PPB_OpenGLES_Dev ppb_opengles = {
   &VertexAttrib4fv,
   &VertexAttribPointer,
   &Viewport,
-  &SwapBuffers,
-  &GetMaxValueInBuffer,
-  &GenSharedIds,
-  &DeleteSharedIds,
-  &RegisterSharedIds,
-  &CommandBufferEnable,
-  &MapBufferSubData,
-  &UnmapBufferSubData,
-  &MapTexSubImage2D,
-  &UnmapTexSubImage2D,
-  &CopyTextureToParentTexture
+  &SwapBuffers
 };
 
 }  // namespace
diff --git a/webkit/glue/plugins/pepper_plugin_delegate.h b/webkit/glue/plugins/pepper_plugin_delegate.h
index 5e6f9a2..7032c2c 100644
--- a/webkit/glue/plugins/pepper_plugin_delegate.h
+++ b/webkit/glue/plugins/pepper_plugin_delegate.h
@@ -12,7 +12,6 @@
 #include "base/ref_counted.h"
 #include "base/shared_memory.h"
 #include "base/sync_socket.h"
-#include "base/task.h"
 #include "gfx/size.h"
 #include "googleurl/src/gurl.h"
 #include "ppapi/c/pp_completion_callback.h"
@@ -130,8 +129,6 @@ class PluginDelegate {
                                  base::SyncSocket::Handle socket) = 0;
     };
 
-    virtual ~PlatformAudio() {}
-
     // Starts the playback. Returns false on error or if called before the
     // stream is created or after the stream is closed.
     virtual bool StartPlayback() = 0;
@@ -143,6 +140,9 @@ class PluginDelegate {
     // Closes the stream. Make sure to call this before the object is
     // destructed.
     virtual void ShutDown() = 0;
+
+   protected:
+    virtual ~PlatformAudio() {}
   };
 
   class PlatformVideoDecoder {
diff --git a/webkit/glue/plugins/pepper_plugin_instance.cc b/webkit/glue/plugins/pepper_plugin_instance.cc
index b4cd681..f705178 100644
--- a/webkit/glue/plugins/pepper_plugin_instance.cc
+++ b/webkit/glue/plugins/pepper_plugin_instance.cc
@@ -244,6 +244,13 @@ void ZoomChanged(PP_Instance instance_id, double factor) {
   PluginInstance* instance = ResourceTracker::Get()->GetInstance(instance_id);
   if (!instance)
     return;
+
+  // We only want to tell the page to change its zoom if the whole page is the
+  // PDF.  If we're in an iframe, then don't do anything.
+  WebFrame* frame = instance->container()->element().document().frame();
+  if (!frame->view()->mainFrame()->document().isPluginDocument())
+    return;
+
   double zoom_level = WebView::zoomFactorToZoomLevel(factor);
   // The conversino from zoom level to factor, and back, can introduce rounding
   // errors.  i.e. WebKit originally tells us 3.0, but by the time we tell the
diff --git a/webkit/glue/plugins/pepper_plugin_module.h b/webkit/glue/plugins/pepper_plugin_module.h
index 6ba3146..80eccda 100644
--- a/webkit/glue/plugins/pepper_plugin_module.h
+++ b/webkit/glue/plugins/pepper_plugin_module.h
@@ -11,6 +11,7 @@
 #include "base/basictypes.h"
 #include "base/native_library.h"
 #include "base/ref_counted.h"
+#include "base/scoped_ptr.h"
 #include "base/weak_ptr.h"
 #include "ppapi/c/pp_module.h"
 #include "ppapi/c/ppb.h"
diff --git a/webkit/glue/plugins/pepper_private.cc b/webkit/glue/plugins/pepper_private.cc
index bd1c77b..0675bee 100644
--- a/webkit/glue/plugins/pepper_private.cc
+++ b/webkit/glue/plugins/pepper_private.cc
@@ -94,6 +94,8 @@ PP_Var GetLocalizedString(PP_Module module_id, PP_ResourceString string_id) {
     rv = UTF16ToUTF8(webkit_glue::GetLocalizedString(IDS_PDF_NEED_PASSWORD));
   } else if (string_id == PP_RESOURCESTRING_PDFLOADING) {
     rv = UTF16ToUTF8(webkit_glue::GetLocalizedString(IDS_PDF_PAGE_LOADING));
+  } else if (string_id == PP_RESOURCESTRING_PDFLOAD_FAILED) {
+    rv = UTF16ToUTF8(webkit_glue::GetLocalizedString(IDS_PDF_PAGE_LOAD_FAILED));
   } else {
     NOTREACHED();
   }
diff --git a/webkit/glue/plugins/plugin_group.cc b/webkit/glue/plugins/plugin_group.cc
index 5dddbce..e68649c 100644
--- a/webkit/glue/plugins/plugin_group.cc
+++ b/webkit/glue/plugins/plugin_group.cc
@@ -26,7 +26,7 @@ static const PluginGroupDefinition kGroupDefinitions[] = {
     "http://www.apple.com/quicktime/download/" },
   { "java-runtime-environment", "Java", "Java", "", "", "",
     "http://support.apple.com/kb/HT1338" },
-  { "adobe-flash-player", "Flash", "Shockwave Flash", "", "", "10.1.85",
+  { "adobe-flash-player", "Flash", "Shockwave Flash", "", "", "10.1.102",
     "http://get.adobe.com/flashplayer/" },
   { "silverlight-3", "Silverlight 3", "Silverlight", "0", "4", "3.0.50106.0",
     "http://www.microsoft.com/getsilverlight/" },
@@ -47,10 +47,10 @@ static const PluginGroupDefinition kGroupDefinitions[] = {
   { "java-runtime-environment", "Java 6", "Java", "", "6", "6.0.220",
     "http://www.java.com/" },
   { "adobe-reader", PluginGroup::kAdobeReader9GroupName, "Adobe Acrobat", "9",
-    "10", "9.4.0", "http://get.adobe.com/reader/" },
+    "10", "9.4.1", "http://get.adobe.com/reader/" },
   { "adobe-reader-8", PluginGroup::kAdobeReader8GroupName, "Adobe Acrobat", "0",
     "9", "8.2.5", "http://get.adobe.com/reader/" },
-  { "adobe-flash-player", "Flash", "Shockwave Flash", "", "", "10.1.85",
+  { "adobe-flash-player", "Flash", "Shockwave Flash", "", "", "10.1.102",
     "http://get.adobe.com/flashplayer/" },
   { "silverlight-3", "Silverlight 3", "Silverlight", "0", "4", "3.0.50106.0",
     "http://www.microsoft.com/getsilverlight/" },
diff --git a/webkit/glue/plugins/plugin_host.cc b/webkit/glue/plugins/plugin_host.cc
index 4cee55d..28aba02 100644
--- a/webkit/glue/plugins/plugin_host.cc
+++ b/webkit/glue/plugins/plugin_host.cc
@@ -136,8 +136,7 @@ void PluginHost::InitializeHostFuncs() {
   host_funcs_.convertpoint = NPN_ConvertPoint;
   host_funcs_.handleevent = NPN_HandleEvent;
   host_funcs_.unfocusinstance = NPN_UnfocusInstance;
-  // TODO: Implement redirect handling: http://crbug.com/63030
-  host_funcs_.urlredirectresponse = NULL;
+  host_funcs_.urlredirectresponse = NPN_URLRedirectResponse;
 }
 
 void PluginHost::PatchNPNetscapeFuncs(NPNetscapeFuncs* overrides) {
@@ -1102,5 +1101,11 @@ NPBool NPN_UnfocusInstance(NPP id, NPFocusDirection direction) {
   return false;
 }
 
+void NPN_URLRedirectResponse(NPP instance, void* notify_data, NPBool allow) {
+  scoped_refptr<NPAPI::PluginInstance> plugin(FindInstance(instance));
+  if (plugin.get()) {
+    plugin->URLRedirectResponse(!!allow, notify_data);
+  }
+}
 
 }  // extern "C"
diff --git a/webkit/glue/plugins/plugin_instance.cc b/webkit/glue/plugins/plugin_instance.cc
index b271e4d..4ccbadf 100644
--- a/webkit/glue/plugins/plugin_instance.cc
+++ b/webkit/glue/plugins/plugin_instance.cc
@@ -54,7 +54,8 @@ PluginInstance::PluginInstance(PluginLib *plugin, const std::string &mime_type)
       in_close_streams_(false),
       next_timer_id_(1),
       next_notify_id_(0),
-      next_range_request_id_(0) {
+      next_range_request_id_(0),
+      handles_url_redirects_(false) {
   npp_ = new NPP_t();
   npp_->ndata = 0;
   npp_->pdata = 0;
@@ -153,6 +154,12 @@ bool PluginInstance::Start(const GURL& url,
 
   NPError err = NPP_New(mode, param_count,
       const_cast<char **>(param_names), const_cast<char **>(param_values));
+
+  if (err == NPERR_NO_ERROR) {
+    handles_url_redirects_ =
+        ((npp_functions_->version >= NPVERS_HAS_URL_REDIRECT_HANDLING) &&
+         (npp_functions_->urlredirectnotify));
+  }
   return err == NPERR_NO_ERROR;
 }
 
@@ -342,6 +349,22 @@ bool PluginInstance::NPP_Print(NPPrint* platform_print) {
   return false;
 }
 
+NPError PluginInstance::NPP_ClearSiteData(uint64 flags,
+                                          const char* domain,
+                                          uint64 max_age) {
+  DCHECK(npp_functions_ != 0);
+  // TODO(bauerb): Call NPAPI function when it is defined in the header.
+  return NPERR_NO_ERROR;
+}
+
+void PluginInstance::NPP_URLRedirectNotify(const char* url, int32_t status,
+                                           void* notify_data) {
+  DCHECK(npp_functions_ != 0);
+  if (npp_functions_->urlredirectnotify != 0) {
+    npp_functions_->urlredirectnotify(npp_, url, status, notify_data);
+  }
+}
+
 void PluginInstance::SendJavaScriptStream(const GURL& url,
                                           const std::string& result,
                                           bool success,
@@ -548,7 +571,8 @@ void PluginInstance::RequestURL(const char* url,
   }
 
   webplugin_->HandleURLRequest(
-      url, method, target, buf, len, notify_id, popups_allowed());
+      url, method, target, buf, len, notify_id, popups_allowed(),
+      notify ? handles_url_redirects_ : false);
 }
 
 bool PluginInstance::ConvertPoint(double source_x, double source_y,
@@ -634,4 +658,23 @@ void PluginInstance::GetNotifyData(
   }
 }
 
+void PluginInstance::URLRedirectResponse(bool allow, void* notify_data) {
+  // The notify_data passed in allows us to identify the matching stream.
+  std::vector<scoped_refptr<PluginStream> >::iterator stream_index;
+  for (stream_index = open_streams_.begin();
+          stream_index != open_streams_.end(); ++stream_index) {
+    PluginStream* plugin_stream = *stream_index;
+    if (plugin_stream->notify_data() == notify_data) {
+      webkit_glue::WebPluginResourceClient* resource_client =
+          plugin_stream->AsResourceClient();
+      webplugin_->URLRedirectResponse(allow, resource_client->ResourceId());
+      if (allow) {
+        plugin_stream->UpdateUrl(
+            plugin_stream->pending_redirect_url().c_str());
+      }
+      break;
+    }
+  }
+}
+
 }  // namespace NPAPI
diff --git a/webkit/glue/plugins/plugin_instance.h b/webkit/glue/plugins/plugin_instance.h
index c853bfa..fa0320e 100644
--- a/webkit/glue/plugins/plugin_instance.h
+++ b/webkit/glue/plugins/plugin_instance.h
@@ -198,6 +198,9 @@ class PluginInstance : public base::RefCountedThreadSafe<PluginInstance> {
   short NPP_HandleEvent(void*);
   void NPP_Destroy();
   bool NPP_Print(NPPrint* platform_print);
+  NPError NPP_ClearSiteData(uint64, const char*, uint64);
+  void NPP_URLRedirectNotify(const char* url, int32_t status,
+                             void* notify_data);
 
   void SendJavaScriptStream(const GURL& url,
                             const std::string& result,
@@ -233,6 +236,12 @@ class PluginInstance : public base::RefCountedThreadSafe<PluginInstance> {
                   bool notify,
                   void* notify_data);
 
+  // Handles NPN_URLRedirectResponse calls issued by plugins in response to
+  // HTTP URL redirect notifications.
+  void URLRedirectResponse(bool allow, void* notify_data);
+
+  bool handles_url_redirects() const { return handles_url_redirects_; }
+
  private:
   friend class base::RefCountedThreadSafe<PluginInstance>;
 
@@ -335,6 +344,9 @@ class PluginInstance : public base::RefCountedThreadSafe<PluginInstance> {
   typedef std::map<int, scoped_refptr<PluginStream> > PendingRangeRequestMap;
   PendingRangeRequestMap pending_range_requests_;
   int next_range_request_id_;
+  // The plugin handles the NPAPI URL redirect notification API.
+  // See here https://wiki.mozilla.org/NPAPI:HTTPRedirectHandling
+  bool handles_url_redirects_;
 
   DISALLOW_COPY_AND_ASSIGN(PluginInstance);
 };
diff --git a/webkit/glue/plugins/plugin_lib.cc b/webkit/glue/plugins/plugin_lib.cc
index 292cd63..4ae4da4 100644
--- a/webkit/glue/plugins/plugin_lib.cc
+++ b/webkit/glue/plugins/plugin_lib.cc
@@ -165,7 +165,22 @@ bool PluginLib::Load() {
   base::NativeLibrary library = 0;
 
   if (!internal_) {
+#if defined(OS_WIN)
+    // This is to work around a bug in the Real player recorder plugin which
+    // intercepts LoadLibrary calls from chrome.dll and wraps NPAPI functions
+    // provided by the plugin. It crashes if the media player plugin is being
+    // loaded. Workaround is to load the dll dynamically by getting the
+    // LoadLibrary API address from kernel32.dll which bypasses the recorder
+    // plugin.
+    if (web_plugin_info_.name.find(L"Windows Media Player") !=
+        std::wstring::npos) {
+      library = base::LoadNativeLibraryDynamically(web_plugin_info_.path);
+    } else {
+      library = base::LoadNativeLibrary(web_plugin_info_.path);
+    }
+#else  // OS_WIN
     library = base::LoadNativeLibrary(web_plugin_info_.path);
+#endif  // OS_WIN
     if (library == 0) {
       LOG_IF(ERROR, PluginList::DebugPluginLoading())
           << "Couldn't load plugin " << web_plugin_info_.path.value();
diff --git a/webkit/glue/plugins/plugin_list_mac.mm b/webkit/glue/plugins/plugin_list_mac.mm
index ee6c6ad..6e5019d 100644
--- a/webkit/glue/plugins/plugin_list_mac.mm
+++ b/webkit/glue/plugins/plugin_list_mac.mm
@@ -30,14 +30,6 @@ void GetPluginCommonDirectory(std::vector<FilePath>* plugin_dirs,
   plugin_dirs->push_back(FilePath(mac_util::PathFromFSRef(ref)));
 }
 
-void GetPluginPrivateDirectory(std::vector<FilePath>* plugin_dirs) {
-  NSString* plugin_path = [[NSBundle mainBundle] builtInPlugInsPath];
-  if (!plugin_path)
-    return;
-
-  plugin_dirs->push_back(FilePath([plugin_path fileSystemRepresentation]));
-}
-
 // Returns true if the plugin should be prevented from loading.
 bool IsBlacklistedPlugin(const WebPluginInfo& info) {
   // We blacklist Gears by included MIME type, since that is more stable than
@@ -68,10 +60,6 @@ void PluginList::GetPluginDirectories(std::vector<FilePath>* plugin_dirs) {
 
   // Load from the machine-wide area
   GetPluginCommonDirectory(plugin_dirs, false);
-
-  // Load any bundled plugins (deprecated)
-  // TODO(stuartmorgan): Remove this once it's not used in TestShell.
-  GetPluginPrivateDirectory(plugin_dirs);
 }
 
 void PluginList::LoadPluginsFromDir(const FilePath &path,
diff --git a/webkit/glue/plugins/plugin_stream.h b/webkit/glue/plugins/plugin_stream.h
index c17faaf..b277465 100644
--- a/webkit/glue/plugins/plugin_stream.h
+++ b/webkit/glue/plugins/plugin_stream.h
@@ -83,6 +83,8 @@ class PluginStream : public base::RefCounted<PluginStream> {
 
   void* notify_data() const { return notify_data_; }
 
+  std::string pending_redirect_url() const { return pending_redirect_url_; }
+
  protected:
   friend class base::RefCounted<PluginStream>;
 
@@ -92,6 +94,11 @@ class PluginStream : public base::RefCounted<PluginStream> {
   // Check if the stream is open.
   bool open() { return opened_; }
 
+  // If the plugin participates in HTTP URL redirect handling then this member
+  // holds the url being redirected to while we wait for the plugin to make a
+  // decision on whether to allow or deny the redirect.
+  std::string pending_redirect_url_;
+
  private:
 
   // Open a temporary file for this stream.
diff --git a/webkit/glue/plugins/plugin_stream_url.cc b/webkit/glue/plugins/plugin_stream_url.cc
index 6694139..1af4485 100644
--- a/webkit/glue/plugins/plugin_stream_url.cc
+++ b/webkit/glue/plugins/plugin_stream_url.cc
@@ -4,8 +4,10 @@
 
 #include "webkit/glue/plugins/plugin_stream_url.h"
 
+#include "net/http/http_response_headers.h"
 #include "webkit/glue/plugins/plugin_host.h"
 #include "webkit/glue/plugins/plugin_instance.h"
+#include "webkit/glue/plugins/plugin_lib.h"
 #include "webkit/glue/plugins/webplugin.h"
 
 namespace NPAPI {
@@ -37,7 +39,17 @@ bool PluginStreamUrl::Close(NPReason reason) {
   return result;
 }
 
-void PluginStreamUrl::WillSendRequest(const GURL& url) {
+void PluginStreamUrl::WillSendRequest(const GURL& url, int http_status_code) {
+  if (notify_needed()) {
+    // If the plugin participates in HTTP url redirect handling then notify it.
+    if (net::HttpResponseHeaders::IsRedirectResponseCode(http_status_code) &&
+        instance()->handles_url_redirects()) {
+      pending_redirect_url_ = url.spec();
+      instance()->NPP_URLRedirectNotify(url.spec().c_str(), http_status_code,
+          notify_data());
+      return;
+    }
+  }
   url_ = url;
   UpdateUrl(url.spec().c_str());
 }
diff --git a/webkit/glue/plugins/plugin_stream_url.h b/webkit/glue/plugins/plugin_stream_url.h
index 01a6da9..8c03edc 100644
--- a/webkit/glue/plugins/plugin_stream_url.h
+++ b/webkit/glue/plugins/plugin_stream_url.h
@@ -43,7 +43,7 @@ class PluginStreamUrl : public PluginStream,
   //
   // WebPluginResourceClient methods
   //
-  void WillSendRequest(const GURL& url);
+  void WillSendRequest(const GURL& url, int http_status_code);
   void DidReceiveResponse(const std::string& mime_type,
                           const std::string& headers,
                           uint32 expected_length,
@@ -55,7 +55,9 @@ class PluginStreamUrl : public PluginStream,
   bool IsMultiByteResponseExpected() {
     return seekable();
   }
-
+  int ResourceId() {
+    return id_;
+  }
 
  private:
   GURL url_;
diff --git a/webkit/glue/plugins/plugin_stream_win.cc b/webkit/glue/plugins/plugin_stream_win.cc
index fffa6fe..0b6fcbd 100644
--- a/webkit/glue/plugins/plugin_stream_win.cc
+++ b/webkit/glue/plugins/plugin_stream_win.cc
@@ -32,6 +32,7 @@ void PluginStream::UpdateUrl(const char* url) {
   DCHECK(!opened_);
   free(const_cast<char*>(stream_.url));
   stream_.url = _strdup(url);
+  pending_redirect_url_.clear();
 }
 
 void PluginStream::WriteAsFile() {
diff --git a/webkit/glue/plugins/ppb_private.h b/webkit/glue/plugins/ppb_private.h
index 0f2c448..b3d2b67 100644
--- a/webkit/glue/plugins/ppb_private.h
+++ b/webkit/glue/plugins/ppb_private.h
@@ -18,7 +18,8 @@ struct PP_FontDescription_Dev;
 
 typedef enum {
   PP_RESOURCESTRING_PDFGETPASSWORD = 0,
-  PP_RESOURCESTRING_PDFLOADING = 1
+  PP_RESOURCESTRING_PDFLOADING = 1,
+  PP_RESOURCESTRING_PDFLOAD_FAILED = 2,
 } PP_ResourceString;
 
 typedef enum {
diff --git a/webkit/glue/plugins/test/plugin_client.cc b/webkit/glue/plugins/test/plugin_client.cc
index d617e16..8358340 100644
--- a/webkit/glue/plugins/test/plugin_client.cc
+++ b/webkit/glue/plugins/test/plugin_client.cc
@@ -34,6 +34,7 @@ NPError PluginClient::GetEntryPoints(NPPluginFuncs* pFuncs) {
   pFuncs->getvalue      = NPP_GetValue;
   pFuncs->setvalue      = NPP_SetValue;
   pFuncs->javaClass     = NULL;
+  pFuncs->urlredirectnotify = NPP_URLRedirectNotify;
 
   return NPERR_NO_ERROR;
 }
@@ -114,8 +115,8 @@ NPError NPP_Destroy(NPP instance, NPSavedData** save) {
   if (instance == NULL)
     return NPERR_INVALID_INSTANCE_ERROR;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   NPError rv = plugin->Destroy();
   delete plugin;
@@ -126,8 +127,8 @@ NPError NPP_SetWindow(NPP instance, NPWindow* pNPWindow) {
   if (instance == NULL)
     return NPERR_INVALID_INSTANCE_ERROR;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->SetWindow(pNPWindow);
 }
@@ -137,8 +138,8 @@ NPError NPP_NewStream(NPP instance, NPMIMEType type,
   if (instance == NULL)
     return NPERR_INVALID_INSTANCE_ERROR;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->NewStream(type, stream, seekable, stype);
 }
@@ -147,8 +148,8 @@ int32 NPP_WriteReady(NPP instance, NPStream *stream) {
   if (instance == NULL)
     return NPERR_INVALID_INSTANCE_ERROR;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->WriteReady(stream);
 }
@@ -158,8 +159,8 @@ int32 NPP_Write(NPP instance, NPStream *stream, int32 offset,
   if (instance == NULL)
     return NPERR_INVALID_INSTANCE_ERROR;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->Write(stream, offset, len, buffer);
 }
@@ -168,8 +169,8 @@ NPError NPP_DestroyStream(NPP instance, NPStream *stream, NPError reason) {
   if (instance == NULL)
     return NPERR_INVALID_INSTANCE_ERROR;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->DestroyStream(stream, reason);
 }
@@ -178,8 +179,8 @@ void NPP_StreamAsFile(NPP instance, NPStream* stream, const char* fname) {
   if (instance == NULL)
     return;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->StreamAsFile(stream, fname);
 }
@@ -196,8 +197,8 @@ void NPP_URLNotify(NPP instance, const char* url, NPReason reason,
   if (instance == NULL)
     return;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->URLNotify(url, reason, notifyData);
 }
@@ -222,9 +223,18 @@ int16 NPP_HandleEvent(NPP instance, void* event) {
   if (instance == NULL)
     return 0;
 
-  NPAPIClient::PluginTest *plugin =
-    (NPAPIClient::PluginTest*)instance->pdata;
+  NPAPIClient::PluginTest* plugin =
+      reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
 
   return plugin->HandleEvent(event);
 }
+
+void NPP_URLRedirectNotify(NPP instance, const char* url, int32_t status,
+                           void* notify_data) {
+  if (instance) {
+    NPAPIClient::PluginTest* plugin =
+        reinterpret_cast<NPAPIClient::PluginTest*>(instance->pdata);
+    plugin->URLRedirectNotify(url, status, notify_data);
+  }
+}
 } // extern "C"
diff --git a/webkit/glue/plugins/test/plugin_create_instance_in_paint.cc b/webkit/glue/plugins/test/plugin_create_instance_in_paint.cc
index 305e86f..f98f89b 100644
--- a/webkit/glue/plugins/test/plugin_create_instance_in_paint.cc
+++ b/webkit/glue/plugins/test/plugin_create_instance_in_paint.cc
@@ -64,6 +64,7 @@ LRESULT CALLBACK CreateInstanceInPaintTest::WindowProc(
         reinterpret_cast<CreateInstanceInPaintTest*>
             (::GetProp(window, L"Plugin_Instance"));
     if (this_instance->test_id() == "1" && !this_instance->created_) {
+      ::RemoveProp(window, L"Plugin_Instance");
       this_instance->created_ = true;
       this_instance->HostFunctions()->geturlnotify(
           this_instance->id(), "javascript:CreateNewInstance()", NULL,
diff --git a/webkit/glue/plugins/test/plugin_get_javascript_url_test.cc b/webkit/glue/plugins/test/plugin_get_javascript_url_test.cc
index 344cae3..50f5e5a 100644
--- a/webkit/glue/plugins/test/plugin_get_javascript_url_test.cc
+++ b/webkit/glue/plugins/test/plugin_get_javascript_url_test.cc
@@ -23,7 +23,8 @@ const int kNPNEvaluateTimerElapse = 50;
 
 namespace NPAPIClient {
 
-ExecuteGetJavascriptUrlTest::ExecuteGetJavascriptUrlTest(NPP id, NPNetscapeFuncs *host_functions)
+ExecuteGetJavascriptUrlTest::ExecuteGetJavascriptUrlTest(
+    NPP id, NPNetscapeFuncs *host_functions)
   : PluginTest(id, host_functions),
     test_started_(false),
 #ifdef OS_WIN
@@ -67,6 +68,8 @@ void CALLBACK ExecuteGetJavascriptUrlTest::TimerProc(
       reinterpret_cast<ExecuteGetJavascriptUrlTest*>
           (::GetProp(window, L"Plugin_Instance"));
 
+  ::RemoveProp(window, L"Plugin_Instance");
+
   NPObject *window_obj = NULL;
   this_instance->HostFunctions()->getvalue(this_instance->id(),
                                            NPNVWindowNPObject,
@@ -90,8 +93,10 @@ void CALLBACK ExecuteGetJavascriptUrlTest::TimerProc(
 }
 #endif
 
-NPError ExecuteGetJavascriptUrlTest::NewStream(NPMIMEType type, NPStream* stream,
-                              NPBool seekable, uint16* stype) {
+NPError ExecuteGetJavascriptUrlTest::NewStream(NPMIMEType type,
+                                               NPStream* stream,
+                                               NPBool seekable,
+                                               uint16* stype) {
   if (stream == NULL) {
     SetError("NewStream got null stream");
     return NPERR_INVALID_PARAM;
@@ -123,8 +128,8 @@ int32 ExecuteGetJavascriptUrlTest::WriteReady(NPStream *stream) {
   return STREAM_CHUNK;
 }
 
-int32 ExecuteGetJavascriptUrlTest::Write(NPStream *stream, int32 offset, int32 len,
-                              void *buffer) {
+int32 ExecuteGetJavascriptUrlTest::Write(NPStream *stream, int32 offset,
+                                         int32 len, void *buffer) {
   if (stream == NULL) {
     SetError("Write got null stream");
     return -1;
@@ -155,7 +160,8 @@ int32 ExecuteGetJavascriptUrlTest::Write(NPStream *stream, int32 offset, int32 l
 }
 
 
-NPError ExecuteGetJavascriptUrlTest::DestroyStream(NPStream *stream, NPError reason) {
+NPError ExecuteGetJavascriptUrlTest::DestroyStream(NPStream *stream,
+                                                   NPError reason) {
   if (stream == NULL) {
     SetError("NewStream got null stream");
     return NPERR_INVALID_PARAM;
@@ -184,7 +190,8 @@ NPError ExecuteGetJavascriptUrlTest::DestroyStream(NPStream *stream, NPError rea
   return NPERR_NO_ERROR;
 }
 
-void ExecuteGetJavascriptUrlTest::URLNotify(const char* url, NPReason reason, void* data) {
+void ExecuteGetJavascriptUrlTest::URLNotify(const char* url, NPReason reason,
+                                            void* data) {
   COMPILE_ASSERT(sizeof(unsigned long) <= sizeof(data),
                  cast_validity_check);
 
diff --git a/webkit/glue/plugins/test/plugin_geturl_test.cc b/webkit/glue/plugins/test/plugin_geturl_test.cc
index aedf582..5363a66 100644
--- a/webkit/glue/plugins/test/plugin_geturl_test.cc
+++ b/webkit/glue/plugins/test/plugin_geturl_test.cc
@@ -24,6 +24,13 @@
 // url for testing GetURL with a bogus URL.
 #define BOGUS_URL "bogoproto:///x:/asdf.xysdhffieasdf.asdhj/"
 
+// url for testing redirect notifications sent to plugins.
+#define REDIRECT_SRC_URL \
+    "http://mock.http/npapi/plugin_read_page_redirect_src.html"
+
+// The notification id for the redirect notification url.
+#define REDIRECT_SRC_URL_NOTIFICATION_ID 4
+
 // The identifier for the bogus url stream.
 #define BOGUS_URL_STREAM_ID 3
 
@@ -38,7 +45,9 @@ PluginGetURLTest::PluginGetURLTest(NPP id, NPNetscapeFuncs *host_functions)
     tests_in_progress_(0),
     test_file_(NULL),
     expect_404_response_(false),
-    npn_evaluate_context_(false) {
+    npn_evaluate_context_(false),
+    handle_url_redirects_(false),
+    received_url_redirect_notification_(false) {
 }
 
 NPError PluginGetURLTest::New(uint16 mode, int16 argc, const char* argn[],
@@ -62,6 +71,10 @@ NPError PluginGetURLTest::New(uint16 mode, int16 argc, const char* argn[],
     referrer_target_url_ = referrer_target_url;
   }
 
+  if (!base::strcasecmp(GetArgValue("name", argc, argn, argv),
+                        "geturlredirectnotify")) {
+    handle_url_redirects_ = true;
+  }
   return PluginTest::New(mode, argc, argn, argv, saved);
 }
 
@@ -85,6 +98,11 @@ NPError PluginGetURLTest::SetWindow(NPWindow* pNPWindow) {
       HostFunctions()->geturl(id(), referrer_target_url_.c_str(), "_blank");
       HostFunctions()->poppopupsenabledstate(id());
       return NPERR_NO_ERROR;
+    } else if (handle_url_redirects_) {
+      HostFunctions()->geturlnotify(
+          id(), REDIRECT_SRC_URL, NULL,
+          reinterpret_cast<void*>(REDIRECT_SRC_URL_NOTIFICATION_ID));
+      return NPERR_NO_ERROR;
     }
 
     std::string url = SELF_URL;
@@ -179,6 +197,9 @@ NPError PluginGetURLTest::NewStream(NPMIMEType type, NPStream* stream,
     case BOGUS_URL_STREAM_ID:
       SetError("Unexpected NewStream for BOGUS_URL");
       break;
+    case REDIRECT_SRC_URL_NOTIFICATION_ID:
+      SetError("Should not redirect to URL when plugin denied it.");
+      break;
     default:
       SetError("Unexpected NewStream callback");
       break;
@@ -364,6 +385,13 @@ void PluginGetURLTest::URLNotify(const char* url, NPReason reason, void* data) {
       }
       tests_in_progress_--;
       break;
+    case REDIRECT_SRC_URL_NOTIFICATION_ID: {
+      if (!received_url_redirect_notification_) {
+        SetError("Failed to receive URLRedirect notification");
+      }
+      tests_in_progress_--;
+      break;
+    }
     default:
       SetError("Unexpected NewStream callback");
       break;
@@ -373,4 +401,14 @@ void PluginGetURLTest::URLNotify(const char* url, NPReason reason, void* data) {
       SignalTestCompleted();
 }
 
+void PluginGetURLTest::URLRedirectNotify(const char* url,
+                                         int32_t status,
+                                         void* notify_data) {
+  if (!base::strcasecmp(url, "http://mock.http/npapi/plugin_read_page.html")) {
+    received_url_redirect_notification_ = true;
+    // Disallow redirect notification.
+    HostFunctions()->urlredirectresponse(id(), notify_data, false);
+  }
+}
+
 } // namespace NPAPIClient
diff --git a/webkit/glue/plugins/test/plugin_geturl_test.h b/webkit/glue/plugins/test/plugin_geturl_test.h
index 9d5b826..df8d741 100644
--- a/webkit/glue/plugins/test/plugin_geturl_test.h
+++ b/webkit/glue/plugins/test/plugin_geturl_test.h
@@ -36,6 +36,8 @@ class PluginGetURLTest : public PluginTest {
   virtual NPError DestroyStream(NPStream *stream, NPError reason);
   virtual void    StreamAsFile(NPStream* stream, const char* fname);
   virtual void    URLNotify(const char* url, NPReason reason, void* data);
+  virtual void    URLRedirectNotify(const char* url, int32_t status,
+                                    void* notify_data);
 
  private:
   bool tests_started_;
@@ -45,6 +47,10 @@ class PluginGetURLTest : public PluginTest {
   bool expect_404_response_;
   // This flag is set to true in the context of the NPN_Evaluate call.
   bool npn_evaluate_context_;
+  // The following two flags handle URL redirect notifications received by
+  // plugins.
+  bool handle_url_redirects_;
+  bool received_url_redirect_notification_;
   std::string page_not_found_url_;
   std::string fail_write_url_;
   std::string referrer_target_url_;
diff --git a/webkit/glue/plugins/test/plugin_npobject_lifetime_test.cc b/webkit/glue/plugins/test/plugin_npobject_lifetime_test.cc
index 7277211..4564506 100644
--- a/webkit/glue/plugins/test/plugin_npobject_lifetime_test.cc
+++ b/webkit/glue/plugins/test/plugin_npobject_lifetime_test.cc
@@ -46,6 +46,8 @@ void CALLBACK NPObjectLifetimeTest::TimerProc(
       reinterpret_cast<NPObjectLifetimeTest*>
           (::GetProp(window, L"Plugin_Instance"));
   KillTimer(window, this_instance->timer_id_);
+  ::RemoveProp(window,  L"Plugin_Instance");
+
   this_instance->timer_id_ = 0;
 
   this_instance->other_plugin_instance_object_ =
diff --git a/webkit/glue/plugins/test/plugin_test.cc b/webkit/glue/plugins/test/plugin_test.cc
index 141c91a..6717e4b 100644
--- a/webkit/glue/plugins/test/plugin_test.cc
+++ b/webkit/glue/plugins/test/plugin_test.cc
@@ -147,4 +147,9 @@ int16 PluginTest::HandleEvent(void* event) {
   return 0;
 }
 
+void PluginTest::URLRedirectNotify(const char* url, int32_t status,
+                                   void* notify_data) {
+  // There is no default action
+}
+
 } // namespace NPAPIClient
diff --git a/webkit/glue/plugins/test/plugin_test.h b/webkit/glue/plugins/test/plugin_test.h
index eed6e3f..f3f8937 100644
--- a/webkit/glue/plugins/test/plugin_test.h
+++ b/webkit/glue/plugins/test/plugin_test.h
@@ -43,6 +43,8 @@ class PluginTest {
   virtual void    StreamAsFile(NPStream* stream, const char* fname);
   virtual void    URLNotify(const char* url, NPReason reason, void* data);
   virtual int16   HandleEvent(void* event);
+  virtual void    URLRedirectNotify(const char* url, int32_t status,
+                                    void* notify_data);
   // Returns true if the test has not had any errors.
   bool Succeeded() { return test_status_.length() == 0; }
 
diff --git a/webkit/glue/plugins/test/plugin_test_factory.cc b/webkit/glue/plugins/test/plugin_test_factory.cc
index ea9b290..b4ae4f1 100644
--- a/webkit/glue/plugins/test/plugin_test_factory.cc
+++ b/webkit/glue/plugins/test/plugin_test_factory.cc
@@ -34,7 +34,8 @@ PluginTest* CreatePluginTest(const std::string& test_name,
     new_test = new PluginArgumentsTest(instance, host_functions);
   } else if (test_name == "geturl" || test_name == "geturl_404_response" ||
              test_name == "geturl_fail_write" ||
-             test_name == "plugin_referrer_test") {
+             test_name == "plugin_referrer_test" ||
+             test_name == "geturlredirectnotify") {
     new_test = new PluginGetURLTest(instance, host_functions);
   } else if (test_name == "npobject_proxy") {
     new_test = new NPObjectProxyTest(instance, host_functions);
diff --git a/webkit/glue/plugins/test/plugin_windowed_test.cc b/webkit/glue/plugins/test/plugin_windowed_test.cc
index 0c46d68..2ed3ae6 100644
--- a/webkit/glue/plugins/test/plugin_windowed_test.cc
+++ b/webkit/glue/plugins/test/plugin_windowed_test.cc
@@ -138,6 +138,10 @@ LRESULT CALLBACK WindowedPluginTest::WindowProc(
       this_ptr->done_ = true;
       CallJSFunction(this_ptr, "PluginCreated");
     }
+
+    if (this_ptr->done_) {
+      ::RemoveProp(window, L"Plugin_Instance");
+    }
   }
 
   return DefWindowProc(window, message, wparam, lparam);
diff --git a/webkit/glue/plugins/webplugin.h b/webkit/glue/plugins/webplugin.h
index 36426fa..5fbef1f 100644
--- a/webkit/glue/plugins/webplugin.h
+++ b/webkit/glue/plugins/webplugin.h
@@ -126,7 +126,8 @@ class WebPlugin {
                                 const char* buf,
                                 unsigned int len,
                                 int notify_id,
-                                bool popups_allowed) = 0;
+                                bool popups_allowed,
+                                bool notify_redirects) = 0;
 
   // Cancels document load.
   virtual void CancelDocumentLoad() = 0;
@@ -168,13 +169,17 @@ class WebPlugin {
   // This API is only for use with Pepper, and is only overridden
   // by in-renderer implementations.
   virtual WebPluginDelegate* delegate() { return NULL; }
+
+  // Handles NPN_URLRedirectResponse calls issued by plugins in response to
+  // HTTP URL redirect notifications.
+  virtual void URLRedirectResponse(bool allow, int resource_id) = 0;
 };
 
 // Simpler version of ResourceHandleClient that lends itself to proxying.
 class WebPluginResourceClient {
  public:
   virtual ~WebPluginResourceClient() {}
-  virtual void WillSendRequest(const GURL& url) = 0;
+  virtual void WillSendRequest(const GURL& url, int http_status_code) = 0;
   // The request_is_seekable parameter indicates whether byte range requests
   // can be issued for the underlying stream.
   virtual void DidReceiveResponse(const std::string& mime_type,
@@ -187,6 +192,7 @@ class WebPluginResourceClient {
   virtual void DidFinishLoading() = 0;
   virtual void DidFail() = 0;
   virtual bool IsMultiByteResponseExpected() = 0;
+  virtual int ResourceId() = 0;
 };
 
 }  // namespace webkit_glue
diff --git a/webkit/glue/plugins/webplugin_accelerated_surface_mac.h b/webkit/glue/plugins/webplugin_accelerated_surface_mac.h
index ba3f8ca..13980ca 100644
--- a/webkit/glue/plugins/webplugin_accelerated_surface_mac.h
+++ b/webkit/glue/plugins/webplugin_accelerated_surface_mac.h
@@ -28,6 +28,7 @@ class WebPluginAcceleratedSurface {
   virtual void SetSize(const gfx::Size& size) = 0;
 
   // Returns the context used to draw into this surface.
+  // If initializing the surface failed, this will be NULL.
   virtual CGLContextObj context() = 0;
 
   // Readies the surface for drawing. Must be called before any drawing session.
diff --git a/webkit/glue/plugins/webplugin_delegate_impl.cc b/webkit/glue/plugins/webplugin_delegate_impl.cc
index 6907c6f..e3e4f9d 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl.cc
+++ b/webkit/glue/plugins/webplugin_delegate_impl.cc
@@ -86,9 +86,9 @@ bool WebPluginDelegateImpl::Initialize(
     argc++;
   }
 
-  bool start_result = instance_->Start(
+  creation_succeeded_ = instance_->Start(
       url, argn.get(), argv.get(), argc, load_manually);
-  if (!start_result)
+  if (!creation_succeeded_)
     return false;
 
   windowless_ = instance_->windowless();
@@ -120,7 +120,8 @@ void WebPluginDelegateImpl::DestroyInstance() {
     instance_->CloseStreams();
 
     window_.window = NULL;
-    if (!(quirks_ & PLUGIN_QUIRK_DONT_SET_NULL_WINDOW_HANDLE_ON_DESTROY)) {
+    if (creation_succeeded_ &&
+        !(quirks_ & PLUGIN_QUIRK_DONT_SET_NULL_WINDOW_HANDLE_ON_DESTROY)) {
       instance_->NPP_SetWindow(&window_);
     }
 
diff --git a/webkit/glue/plugins/webplugin_delegate_impl.h b/webkit/glue/plugins/webplugin_delegate_impl.h
index 30a4a58..4046c95 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl.h
+++ b/webkit/glue/plugins/webplugin_delegate_impl.h
@@ -502,6 +502,9 @@ class WebPluginDelegateImpl : public webkit_glue::WebPluginDelegate {
   // https://bugs.webkit.org/show_bug.cgi?id=46013 for details.
   bool containing_view_has_focus_;
 
+  // True if NPP_New did not return an error.
+  bool creation_succeeded_;
+
   DISALLOW_COPY_AND_ASSIGN(WebPluginDelegateImpl);
 };
 
diff --git a/webkit/glue/plugins/webplugin_delegate_impl_gtk.cc b/webkit/glue/plugins/webplugin_delegate_impl_gtk.cc
index bceda0e..609b41e 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl_gtk.cc
+++ b/webkit/glue/plugins/webplugin_delegate_impl_gtk.cc
@@ -55,7 +55,8 @@ WebPluginDelegateImpl::WebPluginDelegateImpl(
       first_set_window_call_(true),
       plugin_has_focus_(false),
       has_webkit_focus_(false),
-      containing_view_has_focus_(true) {
+      containing_view_has_focus_(true),
+      creation_succeeded_(false) {
   memset(&window_, 0, sizeof(window_));
   if (instance_->mime_type() == "application/x-shockwave-flash") {
     // Flash is tied to Firefox's whacky behavior with windowless plugins. See
diff --git a/webkit/glue/plugins/webplugin_delegate_impl_mac.mm b/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
index cca8695..552484a 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
+++ b/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
@@ -270,7 +270,8 @@ WebPluginDelegateImpl::WebPluginDelegateImpl(
       first_set_window_call_(true),
       plugin_has_focus_(false),
       has_webkit_focus_(false),
-      containing_view_has_focus_(true) {
+      containing_view_has_focus_(true),
+      creation_succeeded_(false) {
   memset(&window_, 0, sizeof(window_));
 #ifndef NP_NO_CARBON
   memset(&np_cg_context_, 0, sizeof(np_cg_context_));
@@ -376,9 +377,14 @@ bool WebPluginDelegateImpl::PlatformInitialize() {
         layer_ = layer;
         surface_ = plugin_->GetAcceleratedSurface();
 
-        renderer_ = [[CARenderer rendererWithCGLContext:surface_->context()
-                                                options:NULL] retain];
-        [renderer_ setLayer:layer_];
+        // If surface initialization fails for some reason, just continue
+        // without any drawing; returning false would be a more confusing user
+        // experience (since it triggers a missing plugin placeholder).
+        if (surface_->context()) {
+          renderer_ = [[CARenderer rendererWithCGLContext:surface_->context()
+                                                  options:NULL] retain];
+          [renderer_ setLayer:layer_];
+        }
         plugin_->BindFakePluginWindowHandle(false);
       }
       break;
@@ -978,17 +984,18 @@ void WebPluginDelegateImpl::SetImeEnabled(bool enabled) {
 
 void WebPluginDelegateImpl::DrawLayerInSurface() {
   // If we haven't plumbed up the surface yet, don't try to draw.
-  if (!windowed_handle())
+  if (!windowed_handle() || !renderer_)
     return;
 
-  surface_->StartDrawing();
-
   [renderer_ beginFrameAtTime:CACurrentMediaTime() timeStamp:NULL];
   if (CGRectIsEmpty([renderer_ updateBounds])) {
     // If nothing has changed, we are done.
     [renderer_ endFrame];
     return;
   }
+
+  surface_->StartDrawing();
+
   CGRect layerRect = [layer_ bounds];
   [renderer_ addUpdateRect:layerRect];
   [renderer_ render];
diff --git a/webkit/glue/plugins/webplugin_delegate_impl_win.cc b/webkit/glue/plugins/webplugin_delegate_impl_win.cc
index da7a68f..e1acba1 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl_win.cc
+++ b/webkit/glue/plugins/webplugin_delegate_impl_win.cc
@@ -270,7 +270,8 @@ WebPluginDelegateImpl::WebPluginDelegateImpl(
       first_set_window_call_(true),
       plugin_has_focus_(false),
       has_webkit_focus_(false),
-      containing_view_has_focus_(true) {
+      containing_view_has_focus_(true),
+      creation_succeeded_(false) {
   memset(&window_, 0, sizeof(window_));
 
   const WebPluginInfo& plugin_info = instance_->plugin_lib()->plugin_info();
diff --git a/webkit/glue/plugins/webplugin_impl.cc b/webkit/glue/plugins/webplugin_impl.cc
index 80774ff..cd91744 100644
--- a/webkit/glue/plugins/webplugin_impl.cc
+++ b/webkit/glue/plugins/webplugin_impl.cc
@@ -14,6 +14,7 @@
 #include "googleurl/src/gurl.h"
 #include "net/base/escape.h"
 #include "net/base/net_errors.h"
+#include "net/http/http_response_headers.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebConsoleMessage.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebCookieJar.h"
@@ -216,6 +217,7 @@ struct WebPluginImpl::ClientInfo {
   WebKit::WebURLRequest request;
   bool pending_failure_notification;
   linked_ptr<WebKit::WebURLLoader> loader;
+  bool notify_redirects;
 };
 
 bool WebPluginImpl::initialize(WebPluginContainer* container) {
@@ -770,6 +772,22 @@ void WebPluginImpl::OnMissingPluginStatus(int status) {
   NOTREACHED();
 }
 
+void WebPluginImpl::URLRedirectResponse(bool allow, int resource_id) {
+  for (size_t i = 0; i < clients_.size(); ++i) {
+    if (clients_[i].id == static_cast<unsigned long>(resource_id)) {
+      if (clients_[i].loader.get()) {
+        if (allow) {
+          clients_[i].loader->setDefersLoading(false);
+        } else {
+          clients_[i].loader->cancel();
+          clients_[i].client->DidFail();
+        }
+      }
+      break;
+    }
+  }
+}
+
 void WebPluginImpl::Invalidate() {
   if (container_)
     container_->invalidate();
@@ -782,7 +800,8 @@ void WebPluginImpl::InvalidateRect(const gfx::Rect& rect) {
 
 void WebPluginImpl::OnDownloadPluginSrcUrl() {
   HandleURLRequestInternal(
-      plugin_url_.spec().c_str(), "GET", NULL, NULL, 0, 0, false, DOCUMENT_URL);
+      plugin_url_.spec().c_str(), "GET", NULL, NULL, 0, 0, false, DOCUMENT_URL,
+      false);
 }
 
 WebPluginResourceClient* WebPluginImpl::GetClientFromLoader(
@@ -806,10 +825,32 @@ WebPluginImpl::ClientInfo* WebPluginImpl::GetClientInfoFromLoader(
 
 void WebPluginImpl::willSendRequest(WebURLLoader* loader,
                                     WebURLRequest& request,
-                                    const WebURLResponse&) {
-  WebPluginResourceClient* client = GetClientFromLoader(loader);
-  if (client)
-    client->WillSendRequest(request.url());
+                                    const WebURLResponse& response) {
+  WebPluginImpl::ClientInfo* client_info = GetClientInfoFromLoader(loader);
+  if (client_info) {
+    if (net::HttpResponseHeaders::IsRedirectResponseCode(
+            response.httpStatusCode())) {
+      // If the plugin does not participate in url redirect notifications then
+      // just block cross origin 307 POST redirects.
+      if (!client_info->notify_redirects) {
+        if (response.httpStatusCode() == 307 &&
+            LowerCaseEqualsASCII(request.httpMethod().utf8(), "post")) {
+          GURL original_request_url(response.url());
+          GURL response_url(request.url());
+          if (original_request_url.GetOrigin() != response_url.GetOrigin()) {
+            loader->setDefersLoading(true);
+            loader->cancel();
+            client_info->client->DidFail();
+            return;
+          }
+        }
+      } else {
+        loader->setDefersLoading(true);
+      }
+    }
+    client_info->client->WillSendRequest(request.url(),
+                                         response.httpStatusCode());
+  }
 }
 
 void WebPluginImpl::didSendData(WebURLLoader* loader,
@@ -998,11 +1039,13 @@ void WebPluginImpl::HandleURLRequest(const char* url,
                                      const char* buf,
                                      unsigned int len,
                                      int notify_id,
-                                     bool popups_allowed) {
+                                     bool popups_allowed,
+                                     bool notify_redirects) {
   // GetURL/PostURL requests initiated explicitly by plugins should specify the
   // plugin SRC url as the referrer if it is available.
   HandleURLRequestInternal(
-      url, method, target, buf, len, notify_id, popups_allowed, PLUGIN_SRC);
+      url, method, target, buf, len, notify_id, popups_allowed, PLUGIN_SRC,
+      notify_redirects);
 }
 
 void WebPluginImpl::HandleURLRequestInternal(const char* url,
@@ -1012,7 +1055,8 @@ void WebPluginImpl::HandleURLRequestInternal(const char* url,
                                              unsigned int len,
                                              int notify_id,
                                              bool popups_allowed,
-                                             Referrer referrer_flag) {
+                                             Referrer referrer_flag,
+                                             bool notify_redirects) {
   // For this request, we either route the output to a frame
   // because a target has been specified, or we handle the request
   // here, i.e. by executing the script if it is a javascript url
@@ -1070,7 +1114,7 @@ void WebPluginImpl::HandleURLRequestInternal(const char* url,
     return;
 
   InitiateHTTPRequest(resource_id, resource_client, complete_url, method, buf,
-                      len, NULL, referrer_flag);
+                      len, NULL, referrer_flag, notify_redirects);
 }
 
 unsigned long WebPluginImpl::GetNextResourceId() {
@@ -1089,7 +1133,8 @@ bool WebPluginImpl::InitiateHTTPRequest(unsigned long resource_id,
                                         const char* buf,
                                         int buf_len,
                                         const char* range_info,
-                                        Referrer referrer_flag) {
+                                        Referrer referrer_flag,
+                                        bool notify_redirects) {
   if (!client) {
     NOTREACHED();
     return false;
@@ -1106,6 +1151,7 @@ bool WebPluginImpl::InitiateHTTPRequest(unsigned long resource_id,
   info.request.setTargetType(WebURLRequest::TargetIsObject);
   info.request.setHTTPMethod(WebString::fromUTF8(method));
   info.pending_failure_notification = false;
+  info.notify_redirects = notify_redirects;
 
   if (range_info) {
     info.request.addHTTPHeaderField(WebString::fromUTF8("Range"),
@@ -1167,7 +1213,7 @@ void WebPluginImpl::InitiateHTTPRangeRequest(
       delegate_->CreateSeekableResourceClient(resource_id, range_request_id);
   InitiateHTTPRequest(
       resource_id, resource_client, complete_url, "GET", NULL, 0, range_info,
-      load_manually_ ? NO_REFERRER : PLUGIN_SRC);
+      load_manually_ ? NO_REFERRER : PLUGIN_SRC, false);
 }
 
 void WebPluginImpl::SetDeferResourceLoading(unsigned long resource_id,
diff --git a/webkit/glue/plugins/webplugin_impl.h b/webkit/glue/plugins/webplugin_impl.h
index 58289d6..4f3b6c7 100644
--- a/webkit/glue/plugins/webplugin_impl.h
+++ b/webkit/glue/plugins/webplugin_impl.h
@@ -127,6 +127,8 @@ class WebPluginImpl : public WebPlugin,
                                    std::string* json_retval);
   virtual void OnMissingPluginStatus(int status);
 
+  virtual void URLRedirectResponse(bool allow, int resource_id);
+
   // Given a (maybe partial) url, completes using the base url.
   GURL CompleteURL(const char* url);
 
@@ -179,7 +181,8 @@ class WebPluginImpl : public WebPlugin,
                            const char* buf,
                            int len,
                            const char* range_info,
-                           Referrer referrer_flag);
+                           Referrer referrer_flag,
+                           bool notify_redirects);
 
   gfx::Rect GetWindowClipRect(const gfx::Rect& rect);
 
@@ -196,7 +199,7 @@ class WebPluginImpl : public WebPlugin,
   // to relay the callbacks to the plugin.
   virtual void willSendRequest(WebKit::WebURLLoader* loader,
                                WebKit::WebURLRequest& request,
-                               const WebKit::WebURLResponse&);
+                               const WebKit::WebURLResponse& response);
   virtual void didSendData(WebKit::WebURLLoader* loader,
                            unsigned long long bytes_sent,
                            unsigned long long total_bytes_to_be_sent);
@@ -223,7 +226,8 @@ class WebPluginImpl : public WebPlugin,
                         const char* buf,
                         unsigned int len,
                         int notify_id,
-                        bool popups_allowed);
+                        bool popups_allowed,
+                        bool notify_redirects);
 
   void CancelDocumentLoad();
 
@@ -247,7 +251,8 @@ class WebPluginImpl : public WebPlugin,
                                 unsigned int len,
                                 int notify_id,
                                 bool popups_allowed,
-                                Referrer referrer_flag);
+                                Referrer referrer_flag,
+                                bool notify_redirects);
 
   // Tears down the existing plugin instance and creates a new plugin instance
   // to handle the response identified by the loader parameter.
diff --git a/webkit/glue/plugins/webview_plugin.cc b/webkit/glue/plugins/webview_plugin.cc
index feb5720..31403fe 100644
--- a/webkit/glue/plugins/webview_plugin.cc
+++ b/webkit/glue/plugins/webview_plugin.cc
@@ -7,6 +7,7 @@
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebCursorInfo.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebElement.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebPluginContainer.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebSize.h"
@@ -86,6 +87,8 @@ void WebViewPlugin::ReplayReceivedData(WebPlugin* plugin) {
 
 bool WebViewPlugin::initialize(WebPluginContainer* container) {
   container_ = container;
+  if (container_)
+    old_title_ = container_->element().getAttribute("title");
   return true;
 }
 
@@ -94,6 +97,8 @@ void WebViewPlugin::destroy() {
     delegate_->WillDestroyPlugin();
     delegate_ = NULL;
   }
+  if (container_)
+    container_->element().setAttribute("title", old_title_);
   container_ = NULL;
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
@@ -163,6 +168,12 @@ void WebViewPlugin::didFailLoading(const WebURLError& error) {
   error_.reset(new WebURLError(error));
 }
 
+void WebViewPlugin::setToolTipText(const WebKit::WebString& text,
+                                   WebKit::WebTextDirection hint) {
+  if (container_)
+    container_->element().setAttribute("title", text);
+}
+
 void WebViewPlugin::startDragging(const WebDragData&,
                                   WebDragOperationsMask,
                                   const WebImage&,
diff --git a/webkit/glue/plugins/webview_plugin.h b/webkit/glue/plugins/webview_plugin.h
index 9695aa2..95f32a5 100644
--- a/webkit/glue/plugins/webview_plugin.h
+++ b/webkit/glue/plugins/webview_plugin.h
@@ -12,6 +12,8 @@
 #include "third_party/WebKit/WebKit/chromium/public/WebCursorInfo.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebFrameClient.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebPlugin.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebTextDirection.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebURLResponse.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebViewClient.h"
 
@@ -93,6 +95,9 @@ class WebViewPlugin: public WebKit::WebPlugin, public WebKit::WebViewClient,
   // WebViewClient methods:
   virtual bool acceptsLoadDrops() { return false; }
 
+  virtual void setToolTipText(const WebKit::WebString&,
+                              WebKit::WebTextDirection);
+
   virtual void startDragging(const WebKit::WebDragData& drag_data,
                              WebKit::WebDragOperationsMask mask,
                              const WebKit::WebImage& image,
@@ -125,6 +130,7 @@ class WebViewPlugin: public WebKit::WebPlugin, public WebKit::WebViewClient,
   std::list<std::string> data_;
   bool finished_loading_;
   scoped_ptr<WebKit::WebURLError> error_;
+  WebKit::WebString old_title_;
 };
 
 #endif  // WEBKIT_GLUE_PLUGINS_WEBVIEW_PLUGIN_H_
diff --git a/webkit/glue/resource_loader_bridge.cc b/webkit/glue/resource_loader_bridge.cc
index fe4db75..86029e2 100644
--- a/webkit/glue/resource_loader_bridge.cc
+++ b/webkit/glue/resource_loader_bridge.cc
@@ -27,7 +27,9 @@ ResourceLoadTimingInfo::ResourceLoadTimingInfo()
 ResourceLoadTimingInfo::~ResourceLoadTimingInfo() {
 }
 
-ResourceDevToolsInfo::ResourceDevToolsInfo() {}
+ResourceDevToolsInfo::ResourceDevToolsInfo()
+    : http_status_code(0) {
+}
 
 ResourceDevToolsInfo::~ResourceDevToolsInfo() {}
 
diff --git a/webkit/glue/resource_loader_bridge.h b/webkit/glue/resource_loader_bridge.h
index 52447b4..bd2f8b9 100644
--- a/webkit/glue/resource_loader_bridge.h
+++ b/webkit/glue/resource_loader_bridge.h
@@ -105,6 +105,8 @@ struct ResourceDevToolsInfo : base::RefCounted<ResourceDevToolsInfo> {
   ResourceDevToolsInfo();
   ~ResourceDevToolsInfo();
 
+  int32 http_status_code;
+  std::string http_status_text;
   HeadersVector request_headers;
   HeadersVector response_headers;
 };
diff --git a/webkit/glue/webcursor.h b/webkit/glue/webcursor.h
index 35eb001..daad15f 100644
--- a/webkit/glue/webcursor.h
+++ b/webkit/glue/webcursor.h
@@ -6,6 +6,7 @@
 #define WEBKIT_GLUE_WEBCURSOR_H_
 
 #include "base/basictypes.h"
+#include "gfx/native_widget_types.h"
 #include "gfx/point.h"
 #include "gfx/size.h"
 
@@ -65,6 +66,9 @@ class WebCursor {
   // compare the bitmaps to verify whether they are equal.
   bool IsEqual(const WebCursor& other) const;
 
+  // Returns a native cursor representing the current WebCursor instance.
+  gfx::NativeCursor GetNativeCursor();
+
 #if defined(OS_WIN)
   // Returns a HCURSOR representing the current WebCursor instance.
   // The ownership of the HCURSOR (does not apply to external cursors) remains
@@ -85,7 +89,7 @@ class WebCursor {
 
   // Return a new GdkCursor* for this cursor.  Only valid if GetCursorType
   // returns GDK_CURSOR_IS_PIXMAP.
-  GdkCursor* GetCustomCursor() const;
+  GdkCursor* GetCustomCursor();
 #elif defined(OS_MACOSX)
   // Gets an NSCursor* for this cursor.
   NSCursor* GetCursor() const;
@@ -147,6 +151,11 @@ class WebCursor {
   // A custom cursor created from custom bitmap data by Webkit.
   HCURSOR custom_cursor_;
 #endif  // OS_WIN
+
+#if defined(USE_X11)
+  // A custom cursor created that should be unref'ed from the destructor.
+  GdkCursor* unref_;
+#endif
 };
 
 #endif  // WEBKIT_GLUE_WEBCURSOR_H_
diff --git a/webkit/glue/webcursor_gtk.cc b/webkit/glue/webcursor_gtk.cc
index 54c8837..1ff8316 100644
--- a/webkit/glue/webcursor_gtk.cc
+++ b/webkit/glue/webcursor_gtk.cc
@@ -22,9 +22,12 @@ namespace {
 // It attempts to create a custom cursor from the data inlined in
 // webcursor_gtk_data.h.
 GdkCursor* GetInlineCustomCursor(CustomCursorType type) {
+  static GdkCursor* CustomCursorsGdk[G_N_ELEMENTS(CustomCursors)];
+  GdkCursor* cursor = CustomCursorsGdk[type];
+  if (cursor)
+    return cursor;
   const CustomCursor& custom = CustomCursors[type];
-  GdkCursor* cursor = gdk_cursor_new_from_name(gdk_display_get_default(),
-                                               custom.name);
+  cursor = gdk_cursor_new_from_name(gdk_display_get_default(), custom.name);
   if (!cursor) {
     const GdkColor fg = { 0, 0, 0, 0 };
     const GdkColor bg = { 65535, 65535, 65535, 65535 };
@@ -37,6 +40,7 @@ GdkCursor* GetInlineCustomCursor(CustomCursorType type) {
     g_object_unref(source);
     g_object_unref(mask);
   }
+  CustomCursorsGdk[type] = cursor;
   return cursor;
 }
 
@@ -45,11 +49,13 @@ GdkCursor* GetInlineCustomCursor(CustomCursorType type) {
 #if !GTK_CHECK_VERSION(2, 16, 0)
 // Get/create a custom cursor which is invisible.
 GdkCursor* GetInvisibleCustomCursor() {
+  static GdkCursor* cursor = NULL;
+  if (cursor)
+    return cursor;
   const char bits[] = { 0 };
   const GdkColor color = { 0, 0, 0, 0 };
   GdkPixmap* bitmap = gdk_bitmap_create_from_data(NULL, bits, 1, 1);
-  GdkCursor* cursor =
-      gdk_cursor_new_from_pixmap(bitmap, bitmap, &color, &color, 0, 0);
+  cursor = gdk_cursor_new_from_pixmap(bitmap, bitmap, &color, &color, 0, 0);
   g_object_unref(bitmap);
   return cursor;
 }
@@ -91,12 +97,12 @@ int WebCursor::GetCursorType() const {
     case WebCursorInfo::TypeWestResize:
       return GDK_LEFT_SIDE;
     case WebCursorInfo::TypeNorthSouthResize:
-      NOTIMPLEMENTED(); return GDK_LAST_CURSOR;
+      return GDK_SB_V_DOUBLE_ARROW;
     case WebCursorInfo::TypeEastWestResize:
-      NOTIMPLEMENTED(); return GDK_LAST_CURSOR;
+      return GDK_SB_H_DOUBLE_ARROW;
     case WebCursorInfo::TypeNorthEastSouthWestResize:
-      NOTIMPLEMENTED(); return GDK_LAST_CURSOR;
     case WebCursorInfo::TypeNorthWestSouthEastResize:
+      // There isn't really a useful cursor available for these.
       NOTIMPLEMENTED(); return GDK_LAST_CURSOR;
     case WebCursorInfo::TypeColumnResize:
       return GDK_SB_H_DOUBLE_ARROW;  // TODO(evanm): is this correct?
@@ -154,7 +160,14 @@ int WebCursor::GetCursorType() const {
   return GDK_LAST_CURSOR;
 }
 
-GdkCursor* WebCursor::GetCustomCursor() const {
+gfx::NativeCursor WebCursor::GetNativeCursor() {
+  int type = GetCursorType();
+  if (type == GDK_CURSOR_IS_PIXMAP)
+    return GetCustomCursor();
+  return gfx::GetCursor(type);
+}
+
+GdkCursor* WebCursor::GetCustomCursor() {
   switch (type_) {
 // See comment above |GetInvisibleCustomCursor()|.
 #if !GTK_CHECK_VERSION(2, 16, 0)
@@ -186,10 +199,14 @@ GdkCursor* WebCursor::GetCustomCursor() const {
 
   gdk_pixbuf_unref(pixbuf);
 
+  if (unref_)
+    gdk_cursor_unref(unref_);
+  unref_ = cursor;
   return cursor;
 }
 
 void WebCursor::InitPlatformData() {
+  unref_ = NULL;
   return;
 }
 
@@ -206,9 +223,15 @@ bool WebCursor::IsPlatformDataEqual(const WebCursor& other) const {
 }
 
 void WebCursor::CleanupPlatformData() {
+  if (unref_) {
+    gdk_cursor_unref(unref_);
+    unref_ = NULL;
+  }
   return;
 }
 
 void WebCursor::CopyPlatformData(const WebCursor& other) {
+  if (other.unref_)
+    unref_ = gdk_cursor_ref(other.unref_);
   return;
 }
diff --git a/webkit/glue/webcursor_mac.mm b/webkit/glue/webcursor_mac.mm
index 6b2729e..1aeb1e0 100644
--- a/webkit/glue/webcursor_mac.mm
+++ b/webkit/glue/webcursor_mac.mm
@@ -160,6 +160,10 @@ NSCursor* WebCursor::GetCursor() const {
   return nil;
 }
 
+gfx::NativeCursor WebCursor::GetNativeCursor() {
+  return GetCursor();
+}
+
 void WebCursor::InitFromThemeCursor(ThemeCursor cursor) {
   WebKit::WebCursorInfo cursor_info;
 
diff --git a/webkit/glue/webcursor_win.cc b/webkit/glue/webcursor_win.cc
index 4435e06..2141969 100644
--- a/webkit/glue/webcursor_win.cc
+++ b/webkit/glue/webcursor_win.cc
@@ -186,6 +186,10 @@ HCURSOR WebCursor::GetCursor(HINSTANCE module_handle){
   return custom_cursor_;
 }
 
+gfx::NativeCursor WebCursor::GetNativeCursor() {
+  return GetCursor(NULL);
+}
+
 void WebCursor::InitFromExternalCursor(HCURSOR cursor) {
   WebCursorInfo::Type cursor_type = ToCursorType(cursor);
 
diff --git a/webkit/glue/webkit_strings.grd b/webkit/glue/webkit_strings.grd
index 3cc2a98..651acf0 100644
--- a/webkit/glue/webkit_strings.grd
+++ b/webkit/glue/webkit_strings.grd
@@ -297,6 +297,93 @@ below:
         1024 (Medium Grade)
       </message>
 
+      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_MULTIPLE_FILE" desc="Heading or short sentence shown when a file upload control in a web page requires one or more files selected, but the user didn't specify any files.">
+        Please select one or more files.
+      </message>
+      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH" desc="Heading or short sentence shown when a form control in a web page requires specific type such as email address or URL, but the specified value does not comform to the type.">
+        Invalid value.
+      </message>
+      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_MULTIPLE_EMAIL" desc="Heading or short sentence shown there is a field which accepts multiple e-mail addresses and a user specified a value which is not a comma-separated e-mail addresses.">
+        Please enter a comma separated list of email addresses.
+      </message>
+      <message name="IDS_FORM_VALIDATION_RANGE_UNDERFLOW" desc="Heading or short sentence shown when a form control value in a web page needs to be larger than or equal to a minimum value specified by the page author, but a user specified a too small value.">
+        Value must be greater than or equal to <ph name="MINIMUM">$1<ex>0</ex></ph>.
+      </message>
+      <message name="IDS_FORM_VALIDATION_RANGE_OVERFLOW" desc="Heading or short sentence shown when a form control value in a web page needs to be smaller than or equal to a maximum value specified by the page author, but a user specified a too large value.">
+        Value must be less than or equal to <ph name="MAXIMUM">$1<ex>100</ex></ph>.
+      </message>
+      <message name="IDS_FORM_VALIDATION_STEP_MISMATCH" desc="Heading or short sentence shown when a form control value in a web page should be aligned to a step value specified by the page author, but a user speficified non-aligned value. e.g. A number type field, minimum value is 0, and step value is 4. If A user-specified value is not a multiple of 4, this warning message is shown.">
+        Invalid value.
+      </message>
+
+<!-- The following IDS_FORM_VALIDATION_* messages were taken from Mozilla's dom.properties file.
+
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 2001
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Mitch <mstoltz@netscape.com> (original author)
+#   Ehsan Akhgari <ehsan.akhgari@gmail.com>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+-->
+      <message name="IDS_FORM_VALIDATION_VALUE_MISSING" desc="Heading or short sentence shown when a text form control in a web page requires a value, but the user didn't specify any value.">
+        Please fill out this field.
+      </message>
+      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_CHECKBOX" desc="Heading or short sentence shown when a checkbox control in a web page requires to be checked, but the user didn't check it.">
+        Please check this box if you want to proceed.
+      </message>
+      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_FILE" desc="Heading or short sentence shown when a file upload control in a web page requires a file selected, but the user didn't specify any file.">
+        Please select a file.
+      </message>
+      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_RADIO" desc="Heading or short sentence shown when a radio button of a radio button group in a web page requires to be selected, but the user selected nothing.">
+        Please select one of these options.
+      </message>
+      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_SELECT" desc="Heading or short sentence shown when a value of a menu-list control in a web page requires to be selected, but the user selected nothing.">
+        Please select an item in the list.
+      </message>
+      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL" desc="Heading or short sentence shown when there is an email field in a form and a user specified a value which doesn't look like an e-mail address.">
+        Please enter an email address.
+      </message>
+      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_URL" desc="Heading or short sentence shown when there is a URL field in a form and a user specified a value which doesn't look like a URL.">
+        Please enter a URL.
+      </message>
+      <message name="IDS_FORM_VALIDATION_PATTERN_MISMATCH" desc="Heading or short sentence shown when a form control value needs to satisfy a pattern specified by the page author, but a user specified unmatched value.">
+        Please match the requested format.
+      </message>
+      <message name="IDS_FORM_VALIDATION_TOO_LONG" desc="Heading or short sentence shown when a form control in a web page needs to be shoter than a length specified by the page author, but a user specified long value.">
+        Please shorten this text to <ph name="MAX_CHARACTERS">$2<ex>100</ex></ph> characters or less (you are currently using <ph name="CURRENT_LENGTH">$1<ex>101</ex></ph> characters).
+      </message>
+
       <message name="IDS_DEFAULT_PLUGIN_GET_PLUGIN_MSG" desc="Message displayed by the default plugin in its main window">
         <ph name="PLUGIN">$1<ex>Realplayer</ex></ph> plug-in is not installed
       </message>
@@ -370,6 +457,11 @@ below:
       <message name="IDS_PDF_LOADING_PROGRESS" desc="A message displayed on the PDF control to indicate loading progress.">
         Loading document: <ph name="PAGE_NUMBER">%d<ex>3</ex></ph>/<ph name="NUMBER_OF_PAGES">%d<ex>15</ex></ph> pages...
       </message>
+
+      <message name="IDS_PDF_PAGE_LOAD_FAILED" desc="A message displayed on the PDF control to indicate that the PDF document failed to load.">
+        Failed to load PDF document
+      </message>
+
     </messages>
   </release>
 </grit>
diff --git a/webkit/glue/webkitclient_impl.cc b/webkit/glue/webkitclient_impl.cc
index 0c5766a..12d5702 100644
--- a/webkit/glue/webkitclient_impl.cc
+++ b/webkit/glue/webkitclient_impl.cc
@@ -16,6 +16,7 @@
 #include "base/lock.h"
 #include "base/message_loop.h"
 #include "base/metrics/stats_counters.h"
+#include "base/metrics/histogram.h"
 #include "base/process_util.h"
 #include "base/platform_file.h"
 #include "base/singleton.h"
@@ -156,10 +157,36 @@ static int ToMessageID(WebLocalizedString::Name name) {
       return IDS_KEYGEN_HIGH_GRADE_KEY;
     case WebLocalizedString::KeygenMenuMediumGradeKeySize:
       return IDS_KEYGEN_MED_GRADE_KEY;
-    // TODO(tkent): Remove default: when we merge the next
-    // WebLocalizedString.h change.
-    default:
-      break;
+    case WebLocalizedString::ValidationValueMissing:
+      return IDS_FORM_VALIDATION_VALUE_MISSING;
+    case WebLocalizedString::ValidationValueMissingForCheckbox:
+      return IDS_FORM_VALIDATION_VALUE_MISSING_CHECKBOX;
+    case WebLocalizedString::ValidationValueMissingForFile:
+      return IDS_FORM_VALIDATION_VALUE_MISSING_FILE;
+    case WebLocalizedString::ValidationValueMissingForMultipleFile:
+      return IDS_FORM_VALIDATION_VALUE_MISSING_MULTIPLE_FILE;
+    case WebLocalizedString::ValidationValueMissingForRadio:
+      return IDS_FORM_VALIDATION_VALUE_MISSING_RADIO;
+    case WebLocalizedString::ValidationValueMissingForSelect:
+      return IDS_FORM_VALIDATION_VALUE_MISSING_SELECT;
+    case WebLocalizedString::ValidationTypeMismatch:
+      return IDS_FORM_VALIDATION_TYPE_MISMATCH;
+    case WebLocalizedString::ValidationTypeMismatchForEmail:
+      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL;
+    case WebLocalizedString::ValidationTypeMismatchForMultipleEmail:
+      return IDS_FORM_VALIDATION_TYPE_MISMATCH_MULTIPLE_EMAIL;
+    case WebLocalizedString::ValidationTypeMismatchForURL:
+      return IDS_FORM_VALIDATION_TYPE_MISMATCH_URL;
+    case WebLocalizedString::ValidationPatternMismatch:
+      return IDS_FORM_VALIDATION_PATTERN_MISMATCH;
+    case WebLocalizedString::ValidationTooLong:
+      return IDS_FORM_VALIDATION_TOO_LONG;
+    case WebLocalizedString::ValidationRangeUnderflow:
+      return IDS_FORM_VALIDATION_RANGE_UNDERFLOW;
+    case WebLocalizedString::ValidationRangeOverflow:
+      return IDS_FORM_VALIDATION_RANGE_OVERFLOW;
+    case WebLocalizedString::ValidationStepMismatch:
+      return IDS_FORM_VALIDATION_STEP_MISMATCH;
   }
   return -1;
 }
@@ -228,6 +255,30 @@ void WebKitClientImpl::incrementStatsCounter(const char* name) {
   base::StatsCounter(name).Increment();
 }
 
+void WebKitClientImpl::histogramCustomCounts(
+    const char* name, int sample, int min, int max, int bucket_count) {
+  // Copied from histogram macro, but without the static variable caching
+  // the histogram because name is dynamic.
+  scoped_refptr<base::Histogram> counter =
+      base::Histogram::FactoryGet(name, min, max, bucket_count,
+          base::Histogram::kUmaTargetedHistogramFlag);
+  DCHECK_EQ(name, counter->histogram_name());
+  if (counter.get())
+    counter->Add(sample);
+}
+
+void WebKitClientImpl::histogramEnumeration(
+    const char* name, int sample, int boundary_value) {
+  // Copied from histogram macro, but without the static variable caching
+  // the histogram because name is dynamic.
+  scoped_refptr<base::Histogram> counter =
+      base::LinearHistogram::FactoryGet(name, 1, boundary_value,
+          boundary_value + 1, base::Histogram::kUmaTargetedHistogramFlag);
+  DCHECK_EQ(name, counter->histogram_name());
+  if (counter.get())
+    counter->Add(sample);
+}
+
 void WebKitClientImpl::traceEventBegin(const char* name, void* id,
                                        const char* extra) {
   TRACE_EVENT_BEGIN(name, id, extra);
@@ -311,12 +362,30 @@ WebString WebKitClientImpl::queryLocalizedString(
 
 WebString WebKitClientImpl::queryLocalizedString(
     WebLocalizedString::Name name, int numeric_value) {
+  return queryLocalizedString(name, base::IntToString16(numeric_value));
+}
+
+WebString WebKitClientImpl::queryLocalizedString(
+    WebLocalizedString::Name name, const WebString& value) {
+  int message_id = ToMessageID(name);
+  if (message_id < 0)
+    return WebString();
+  return ReplaceStringPlaceholders(GetLocalizedString(message_id), value, NULL);
+}
+
+WebString WebKitClientImpl::queryLocalizedString(
+    WebLocalizedString::Name name,
+    const WebString& value1,
+    const WebString& value2) {
   int message_id = ToMessageID(name);
   if (message_id < 0)
     return WebString();
-  return ReplaceStringPlaceholders(GetLocalizedString(message_id),
-                                   base::IntToString16(numeric_value),
-                                   NULL);
+  std::vector<string16> values;
+  values.reserve(2);
+  values.push_back(value1);
+  values.push_back(value2);
+  return ReplaceStringPlaceholders(
+      GetLocalizedString(message_id), values, NULL);
 }
 
 double WebKitClientImpl::currentTime() {
diff --git a/webkit/glue/webkitclient_impl.h b/webkit/glue/webkitclient_impl.h
index 68d0eaf..2836e8e 100644
--- a/webkit/glue/webkitclient_impl.h
+++ b/webkit/glue/webkitclient_impl.h
@@ -45,6 +45,10 @@ class WebKitClientImpl : public WebKit::WebKitClient {
   virtual void getPluginList(bool refresh, WebKit::WebPluginListBuilder*);
   virtual void decrementStatsCounter(const char* name);
   virtual void incrementStatsCounter(const char* name);
+  virtual void histogramCustomCounts(
+    const char* name, int sample, int min, int max, int bucket_count);
+  virtual void histogramEnumeration(
+    const char* name, int sample, int boundary_value);
   virtual void traceEventBegin(const char* name, void* id, const char* extra);
   virtual void traceEventEnd(const char* name, void* id, const char* extra);
   virtual WebKit::WebData loadResource(const char* name);
@@ -52,6 +56,11 @@ class WebKitClientImpl : public WebKit::WebKitClient {
       WebKit::WebLocalizedString::Name name);
   virtual WebKit::WebString queryLocalizedString(
       WebKit::WebLocalizedString::Name name, int numeric_value);
+  virtual WebKit::WebString queryLocalizedString(
+      WebKit::WebLocalizedString::Name name, const WebKit::WebString& value);
+  virtual WebKit::WebString queryLocalizedString(
+      WebKit::WebLocalizedString::Name name,
+      const WebKit::WebString& value1, const WebKit::WebString& value2);
   virtual void suddenTerminationChanged(bool enabled) { }
   virtual double currentTime();
   virtual void setSharedTimerFiredFunction(void (*func)());
diff --git a/webkit/glue/webmediaplayer_impl.cc b/webkit/glue/webmediaplayer_impl.cc
index bbf6172..58489cc 100644
--- a/webkit/glue/webmediaplayer_impl.cc
+++ b/webkit/glue/webmediaplayer_impl.cc
@@ -225,28 +225,32 @@ void WebMediaPlayerImpl::Proxy::PutCurrentFrame(
 
 WebMediaPlayerImpl::WebMediaPlayerImpl(
     WebKit::WebMediaPlayerClient* client,
-    media::MediaFilterCollection* collection,
-    MediaResourceLoaderBridgeFactory* bridge_factory_simple,
-    MediaResourceLoaderBridgeFactory* bridge_factory_buffered,
-    bool use_simple_data_source,
-    scoped_refptr<WebVideoRenderer> web_video_renderer)
+    media::MediaFilterCollection* collection)
     : network_state_(WebKit::WebMediaPlayer::Empty),
       ready_state_(WebKit::WebMediaPlayer::HaveNothing),
       main_loop_(NULL),
       filter_collection_(collection),
+      pipeline_(NULL),
       pipeline_thread_("PipelineThread"),
       paused_(true),
       playback_rate_(0.0f),
       client_(client),
+      proxy_(NULL),
       pipeline_stopped_(false, false) {
   // Saves the current message loop.
   DCHECK(!main_loop_);
   main_loop_ = MessageLoop::current();
+}
 
+bool WebMediaPlayerImpl::Initialize(
+    MediaResourceLoaderBridgeFactory* bridge_factory_simple,
+    MediaResourceLoaderBridgeFactory* bridge_factory_buffered,
+    bool use_simple_data_source,
+    scoped_refptr<WebVideoRenderer> web_video_renderer) {
   // Create the pipeline and its thread.
   if (!pipeline_thread_.Start()) {
     NOTREACHED() << "Could not start PipelineThread";
-    return;
+    return false;
   }
 
   pipeline_ = new media::PipelineImpl(pipeline_thread_.message_loop());
@@ -290,6 +294,8 @@ WebMediaPlayerImpl::WebMediaPlayerImpl(
   filter_collection_->AddAudioDecoder(new media::FFmpegAudioDecoder());
   filter_collection_->AddVideoDecoder(new media::FFmpegVideoDecoder(NULL));
   filter_collection_->AddAudioRenderer(new media::NullAudioRenderer());
+
+  return true;
 }
 
 WebMediaPlayerImpl::~WebMediaPlayerImpl() {
@@ -776,10 +782,12 @@ void WebMediaPlayerImpl::Destroy() {
 
   // Make sure to kill the pipeline so there's no more media threads running.
   // Note: stopping the pipeline might block for a long time.
-  pipeline_->Stop(NewCallback(this,
-      &WebMediaPlayerImpl::PipelineStoppedCallback));
-  pipeline_stopped_.Wait();
-  pipeline_thread_.Stop();
+  if (pipeline_) {
+    pipeline_->Stop(NewCallback(this,
+        &WebMediaPlayerImpl::PipelineStoppedCallback));
+    pipeline_stopped_.Wait();
+    pipeline_thread_.Stop();
+  }
 
   // And then detach the proxy, it may live on the render thread for a little
   // longer until all the tasks are finished.
diff --git a/webkit/glue/webmediaplayer_impl.h b/webkit/glue/webmediaplayer_impl.h
index 9361020..26825da 100644
--- a/webkit/glue/webmediaplayer_impl.h
+++ b/webkit/glue/webmediaplayer_impl.h
@@ -169,14 +169,18 @@ class WebMediaPlayerImpl : public WebKit::WebMediaPlayer,
   // |collection| can override the default filters by adding extra filters to
   // |collection| before calling this method.
   //
+  // Callers must call |Initialize()| before they can use the object.
   WebMediaPlayerImpl(WebKit::WebMediaPlayerClient* client,
-                     media::MediaFilterCollection* collection,
-                     MediaResourceLoaderBridgeFactory* bridge_factory_simple,
-                     MediaResourceLoaderBridgeFactory* bridge_factory_buffered,
-                     bool use_simple_data_source,
-                     scoped_refptr<WebVideoRenderer> web_video_renderer);
+                     media::MediaFilterCollection* collection);
   virtual ~WebMediaPlayerImpl();
 
+  // Finalizes initialization of the object.
+  bool Initialize(
+      MediaResourceLoaderBridgeFactory* bridge_factory_simple,
+      MediaResourceLoaderBridgeFactory* bridge_factory_buffered,
+      bool use_simple_data_source,
+      scoped_refptr<WebVideoRenderer> web_video_renderer);
+
   virtual void load(const WebKit::WebURL& url);
   virtual void cancelLoad();
 
diff --git a/webkit/glue/webmenurunner_mac.mm b/webkit/glue/webmenurunner_mac.mm
index b7e48ba..3e1376a 100644
--- a/webkit/glue/webmenurunner_mac.mm
+++ b/webkit/glue/webmenurunner_mac.mm
@@ -91,8 +91,7 @@ BOOL gNewNSMenuAPI;
                                         attributes:attrs]);
     [menuItem setAttributedTitle:attrTitle];
   }
-  if (gNewNSMenuAPI)
-    [menuItem setTag:[menu_ numberOfItems] - 1];
+  [menuItem setTag:[menu_ numberOfItems] - 1];
 }
 
 // Reflects the result of the user's interaction with the popup menu. If NO, the
@@ -113,8 +112,13 @@ BOOL gNewNSMenuAPI;
            withBounds:(NSRect)bounds
          initialIndex:(int)index {
   if (gNewNSMenuAPI) {
-    NSMenuItem* selectedItem = [menu_ itemAtIndex:index];
-    [selectedItem setState:NSOnState];
+    // index might be out of bounds, in which case we set no selection.
+    NSMenuItem* selectedItem = [menu_ itemWithTag:index];
+    if (selectedItem) {
+      [selectedItem setState:NSOnState];
+    } else {
+      selectedItem = [menu_ itemWithTag:0];
+    }
     NSPoint anchor = NSMakePoint(NSMinX(bounds) + kPopupXOffset,
                                  NSMaxY(bounds));
     [menu_ popUpMenuPositioningItem:selectedItem
@@ -128,7 +132,9 @@ BOOL gNewNSMenuAPI;
                                                               pullsDown:NO];
     [button autorelease];
     [button setMenu:menu_];
-    [button selectItemAtIndex:index];
+    // We use selectItemWithTag below so if the index is out-of-bounds nothing
+    // bad happens.
+    [button selectItemWithTag:index];
     [button setFont:[NSFont menuFontOfSize:fontSize_]];
 
     // Create a dummy view to associate the popup with, since the OS will use
diff --git a/webkit/glue/webpasswordautocompletelistener_unittest.cc b/webkit/glue/webpasswordautocompletelistener_unittest.cc
index 5de593c..2eeb890 100644
--- a/webkit/glue/webpasswordautocompletelistener_unittest.cc
+++ b/webkit/glue/webpasswordautocompletelistener_unittest.cc
@@ -104,12 +104,14 @@ class PasswordManagerAutocompleteTests : public testing::Test {
                                                 string16(),
                                                 username1_,
                                                 string16(),
-                                                0));
+                                                0,
+                                                false));
     data_.basic_data.fields.push_back(FormField(string16(),
                                                 string16(),
                                                 password1_,
                                                 string16(),
-                                                0));
+                                                0,
+                                                false));
     data_.additional_logins[username2_] = password2_;
 
     username_delegate_ = new TestWebInputElementDelegate();
diff --git a/webkit/glue/webpreferences.cc b/webkit/glue/webpreferences.cc
index afd41cf..afc39bd 100644
--- a/webkit/glue/webpreferences.cc
+++ b/webkit/glue/webpreferences.cc
@@ -57,11 +57,13 @@ WebPreferences::WebPreferences()
       hyperlink_auditing_enabled(true),
       user_style_sheet_enabled(false),
       author_and_user_styles_enabled(true),
+      frame_flattening_enabled(false),
       allow_universal_access_from_file_urls(false),
       allow_file_access_from_file_urls(false),
       experimental_webgl_enabled(false),
       show_composited_layer_borders(false),
       accelerated_compositing_enabled(false),
+      accelerated_layers_enabled(false),
       accelerated_2d_canvas_enabled(false),
       memory_info_enabled(false) {
 }
@@ -117,6 +119,8 @@ void WebPreferences::Apply(WebView* web_view) const {
   // change this, since it would break existing rich text editors.
   settings->setEditableLinkBehaviorNeverLive();
 
+  settings->setFrameFlatteningEnabled(frame_flattening_enabled);
+
   settings->setFontRenderingModeNormal();
   settings->setJavaEnabled(java_enabled);
 
@@ -137,8 +141,9 @@ void WebPreferences::Apply(WebView* web_view) const {
 
   // Enable experimental WebGL support if requested on command line
   // and support is compiled in.
-  settings->setExperimentalWebGLEnabled(
-      WebRuntimeFeatures::isWebGLEnabled() || experimental_webgl_enabled);
+  bool enable_webgl =
+      WebRuntimeFeatures::isWebGLEnabled() || experimental_webgl_enabled;
+  settings->setExperimentalWebGLEnabled(enable_webgl);
 
   // Display colored borders around composited render layers if requested
   // on command line.
@@ -150,6 +155,21 @@ void WebPreferences::Apply(WebView* web_view) const {
   // Enable gpu-accelerated 2d canvas if requested on the command line.
   settings->setAccelerated2dCanvasEnabled(accelerated_2d_canvas_enabled);
 
+  // Enabling accelerated layers from the command line enabled accelerated
+  // 3D CSS, Video, Plugins, and Animations.
+  settings->setAcceleratedCompositingFor3DTransformsEnabled(
+      accelerated_layers_enabled);
+  settings->setAcceleratedCompositingForVideoEnabled(
+      accelerated_layers_enabled);
+  settings->setAcceleratedCompositingForPluginsEnabled(
+      accelerated_layers_enabled);
+  settings->setAcceleratedCompositingForAnimationEnabled(
+      accelerated_layers_enabled);
+
+  // WebGL and accelerated 2D canvas are always gpu composited.
+  settings->setAcceleratedCompositingForCanvasEnabled(
+      enable_webgl || accelerated_2d_canvas_enabled);
+
   // Enable memory info reporting to page if requested on the command line.
   settings->setMemoryInfoEnabled(memory_info_enabled);
 
diff --git a/webkit/glue/webpreferences.h b/webkit/glue/webpreferences.h
index e9f0c01..6cb8044 100644
--- a/webkit/glue/webpreferences.h
+++ b/webkit/glue/webpreferences.h
@@ -61,11 +61,13 @@ struct WebPreferences {
   bool user_style_sheet_enabled;
   GURL user_style_sheet_location;
   bool author_and_user_styles_enabled;
+  bool frame_flattening_enabled;
   bool allow_universal_access_from_file_urls;
   bool allow_file_access_from_file_urls;
   bool experimental_webgl_enabled;
   bool show_composited_layer_borders;
   bool accelerated_compositing_enabled;
+  bool accelerated_layers_enabled;
   bool accelerated_2d_canvas_enabled;
   bool memory_info_enabled;
 
diff --git a/webkit/glue/weburlloader_impl.cc b/webkit/glue/weburlloader_impl.cc
index 9f7c325..a7f219d 100644
--- a/webkit/glue/weburlloader_impl.cc
+++ b/webkit/glue/weburlloader_impl.cc
@@ -18,7 +18,7 @@
 #include "net/base/net_util.h"
 #include "net/http/http_response_headers.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebHTTPHeaderVisitor.h"
-#include "third_party/WebKit/WebKit/chromium/public/WebResourceRawHeaders.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebHTTPLoadInfo.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebSecurityPolicy.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebURL.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebURLError.h"
@@ -37,7 +37,7 @@ using base::TimeDelta;
 using WebKit::WebData;
 using WebKit::WebHTTPBody;
 using WebKit::WebHTTPHeaderVisitor;
-using WebKit::WebResourceRawHeaders;
+using WebKit::WebHTTPLoadInfo;
 using WebKit::WebSecurityPolicy;
 using WebKit::WebString;
 using WebKit::WebURL;
@@ -208,22 +208,26 @@ void PopulateURLResponse(
   response->setLoadTiming(timing);
 
   if (info.devtools_info.get()) {
-    WebResourceRawHeaders rawHeaders;
+    WebHTTPLoadInfo load_info;
+
+    load_info.setHTTPStatusCode(info.devtools_info->http_status_code);
+    load_info.setHTTPStatusText(WebString::fromUTF8(
+        info.devtools_info->http_status_text));
 
     const HeadersVector& request_headers = info.devtools_info->request_headers;
-    for (HeadersVector::const_iterator it = request_headers .begin();
+    for (HeadersVector::const_iterator it = request_headers.begin();
          it != request_headers.end(); ++it) {
-      rawHeaders.addRequestHeader(WebString::fromUTF8(it->first),
+      load_info.addRequestHeader(WebString::fromUTF8(it->first),
           WebString::fromUTF8(it->second));
     }
     const HeadersVector& response_headers =
         info.devtools_info->response_headers;
     for (HeadersVector::const_iterator it = response_headers.begin();
          it != response_headers.end(); ++it) {
-      rawHeaders.addResponseHeader(WebString::fromUTF8(it->first),
+      load_info.addResponseHeader(WebString::fromUTF8(it->first),
           WebString::fromUTF8(it->second));
     }
-    response->setResourceRawHeaders(rawHeaders);
+    response->setHTTPLoadInfo(load_info);
   }
 
   const net::HttpResponseHeaders* headers = info.headers;