Update to new stable branch 1750

This also includes an updated ninja and chromium dependencies
needed on Windows.

Change-Id: Icd597d80ed3fa4425933c9f1334c3c2e31291c42
Reviewed-by: Zoltan Arvai <zarvai@inf.u-szeged.hu>
Reviewed-by: Zeno Albisser <zeno.albisser@digia.com>

13 files changed, 516 insertions, 200 deletions

diff --git a/chromium/content/renderer/browser_plugin/browser_plugin.cc b/chromium/content/renderer/browser_plugin/browser_plugin.cc
index 71aac853dbb..5f88fe142f9 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin.cc
+++ b/chromium/content/renderer/browser_plugin/browser_plugin.cc
@@ -43,13 +43,13 @@
 #include "base/sys_info.h"
 #endif
 
-using WebKit::WebCanvas;
-using WebKit::WebPluginContainer;
-using WebKit::WebPluginParams;
-using WebKit::WebPoint;
-using WebKit::WebRect;
-using WebKit::WebURL;
-using WebKit::WebVector;
+using blink::WebCanvas;
+using blink::WebPluginContainer;
+using blink::WebPluginParams;
+using blink::WebPoint;
+using blink::WebRect;
+using blink::WebURL;
+using blink::WebVector;
 
 namespace content {
 
@@ -59,17 +59,15 @@ static std::string GetInternalEventName(const char* event_name) {
   return base::StringPrintf("-internal-%s", event_name);
 }
 
-typedef std::map<WebKit::WebPluginContainer*,
+typedef std::map<blink::WebPluginContainer*,
                  BrowserPlugin*> PluginContainerMap;
 static base::LazyInstance<PluginContainerMap> g_plugin_container_map =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
-BrowserPlugin::BrowserPlugin(
-    RenderViewImpl* render_view,
-    WebKit::WebFrame* frame,
-    const WebPluginParams& params)
+BrowserPlugin::BrowserPlugin(RenderViewImpl* render_view,
+                             blink::WebFrame* frame)
     : guest_instance_id_(browser_plugin::kInstanceIDNone),
       attached_(false),
       render_view_(render_view->AsWeakPtr()),
@@ -90,6 +88,7 @@ BrowserPlugin::BrowserPlugin(
       mouse_locked_(false),
       browser_plugin_manager_(render_view->GetBrowserPluginManager()),
       compositing_enabled_(false),
+      embedder_frame_url_(frame->document().url()),
       weak_ptr_factory_(this) {
 }
 
@@ -107,7 +106,7 @@ BrowserPlugin::~BrowserPlugin() {
 
 /*static*/
 BrowserPlugin* BrowserPlugin::FromContainer(
-    WebKit::WebPluginContainer* container) {
+    blink::WebPluginContainer* container) {
   PluginContainerMap* browser_plugins = g_plugin_container_map.Pointer();
   PluginContainerMap::iterator it = browser_plugins->find(container);
   return it == browser_plugins->end() ? NULL : it->second;
@@ -121,6 +120,8 @@ bool BrowserPlugin::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_BuffersSwapped, OnBuffersSwapped)
     IPC_MESSAGE_HANDLER_GENERIC(BrowserPluginMsg_CompositorFrameSwapped,
                                 OnCompositorFrameSwapped(message))
+    IPC_MESSAGE_HANDLER(BrowserPluginMsg_CopyFromCompositingSurface,
+                        OnCopyFromCompositingSurface)
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_GuestContentWindowReady,
                         OnGuestContentWindowReady)
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_GuestGone, OnGuestGone)
@@ -140,14 +141,14 @@ void BrowserPlugin::UpdateDOMAttribute(const std::string& attribute_name,
   if (!container())
     return;
 
-  WebKit::WebElement element = container()->element();
-  WebKit::WebString web_attribute_name =
-      WebKit::WebString::fromUTF8(attribute_name);
+  blink::WebElement element = container()->element();
+  blink::WebString web_attribute_name =
+      blink::WebString::fromUTF8(attribute_name);
   if (!HasDOMAttribute(attribute_name) ||
       (std::string(element.getAttribute(web_attribute_name).utf8()) !=
           attribute_value)) {
     element.setAttribute(web_attribute_name,
-        WebKit::WebString::fromUTF8(attribute_value));
+        blink::WebString::fromUTF8(attribute_value));
   }
 }
 
@@ -156,7 +157,7 @@ void BrowserPlugin::RemoveDOMAttribute(const std::string& attribute_name) {
     return;
 
   container()->element().removeAttribute(
-      WebKit::WebString::fromUTF8(attribute_name));
+      blink::WebString::fromUTF8(attribute_name));
 }
 
 std::string BrowserPlugin::GetDOMAttributeValue(
@@ -165,7 +166,7 @@ std::string BrowserPlugin::GetDOMAttributeValue(
     return std::string();
 
   return container()->element().getAttribute(
-      WebKit::WebString::fromUTF8(attribute_name)).utf8();
+      blink::WebString::fromUTF8(attribute_name)).utf8();
 }
 
 bool BrowserPlugin::HasDOMAttribute(const std::string& attribute_name) const {
@@ -173,13 +174,17 @@ bool BrowserPlugin::HasDOMAttribute(const std::string& attribute_name) const {
     return false;
 
   return container()->element().hasAttribute(
-      WebKit::WebString::fromUTF8(attribute_name));
+      blink::WebString::fromUTF8(attribute_name));
 }
 
 std::string BrowserPlugin::GetNameAttribute() const {
   return GetDOMAttributeValue(browser_plugin::kAttributeName);
 }
 
+bool BrowserPlugin::GetAllowTransparencyAttribute() const {
+  return HasDOMAttribute(browser_plugin::kAttributeAllowTransparency);
+}
+
 std::string BrowserPlugin::GetSrcAttribute() const {
   return GetDOMAttributeValue(browser_plugin::kAttributeSrc);
 }
@@ -257,6 +262,21 @@ void BrowserPlugin::ParseNameAttribute() {
                                        GetNameAttribute()));
 }
 
+void BrowserPlugin::ParseAllowTransparencyAttribute() {
+  if (!HasGuestInstanceID())
+    return;
+
+  bool opaque = !GetAllowTransparencyAttribute();
+
+  if (compositing_helper_)
+    compositing_helper_->SetContentsOpaque(opaque);
+
+  browser_plugin_manager()->Send(new BrowserPluginHostMsg_SetContentsOpaque(
+        render_view_routing_id_,
+        guest_instance_id_,
+        opaque));
+}
+
 bool BrowserPlugin::ParseSrcAttribute(std::string* error_message) {
   if (!valid_partition_id_) {
     *error_message = browser_plugin::kErrorInvalidPartition;
@@ -370,10 +390,12 @@ void BrowserPlugin::Attach(scoped_ptr<base::DictionaryValue> extra_params) {
   BrowserPluginHostMsg_Attach_Params attach_params;
   attach_params.focused = ShouldGuestBeFocused();
   attach_params.visible = visible_;
+  attach_params.opaque = !GetAllowTransparencyAttribute();
   attach_params.name = GetNameAttribute();
   attach_params.storage_partition_id = storage_partition_id_;
   attach_params.persist_storage = persist_storage_;
   attach_params.src = GetSrcAttribute();
+  attach_params.embedder_frame_url = embedder_frame_url_;
   GetDamageBufferWithSizeParams(&attach_params.auto_size_params,
                                 &attach_params.resize_guest_params,
                                 false);
@@ -436,6 +458,23 @@ void BrowserPlugin::OnCompositorFrameSwapped(const IPC::Message& message) {
                                                 param.e /* host_id */);
 }
 
+void BrowserPlugin::OnCopyFromCompositingSurface(int guest_instance_id,
+                                                 int request_id,
+                                                 gfx::Rect source_rect,
+                                                 gfx::Size dest_size) {
+  if (!compositing_enabled_) {
+    browser_plugin_manager()->Send(
+        new BrowserPluginHostMsg_CopyFromCompositingSurfaceAck(
+            render_view_routing_id_,
+            guest_instance_id_,
+            request_id,
+            SkBitmap()));
+    return;
+  }
+  compositing_helper_->CopyFromCompositingSurface(request_id, source_rect,
+                                                  dest_size);
+}
+
 void BrowserPlugin::OnGuestContentWindowReady(int guest_instance_id,
                                               int content_window_routing_id) {
   DCHECK(content_window_routing_id != MSG_ROUTING_NONE);
@@ -445,6 +484,14 @@ void BrowserPlugin::OnGuestContentWindowReady(int guest_instance_id,
 void BrowserPlugin::OnGuestGone(int guest_instance_id) {
   guest_crashed_ = true;
 
+  // Turn off compositing so we can display the sad graphic. Changes to
+  // compositing state will show up at a later time after a layout and commit.
+  EnableCompositing(false);
+  if (compositing_helper_) {
+    compositing_helper_->OnContainerDestroy();
+    compositing_helper_ = NULL;
+  }
+
   // Queue up showing the sad graphic to give content embedders an opportunity
   // to fire their listeners and potentially overlay the webview with custom
   // behavior. If the BrowserPlugin is destroyed in the meantime, then the
@@ -479,8 +526,8 @@ void BrowserPlugin::OnShouldAcceptTouchEvents(int guest_instance_id,
                                               bool accept) {
   if (container()) {
     container()->requestTouchEventType(accept ?
-        WebKit::WebPluginContainer::TouchEventRequestTypeRaw :
-        WebKit::WebPluginContainer::TouchEventRequestTypeNone);
+        blink::WebPluginContainer::TouchEventRequestTypeRaw :
+        blink::WebPluginContainer::TouchEventRequestTypeNone);
   }
 }
 
@@ -634,29 +681,29 @@ NPObject* BrowserPlugin::GetContentWindow() const {
       content_window_routing_id_);
   if (!guest_render_view)
     return NULL;
-  WebKit::WebFrame* guest_frame = guest_render_view->GetWebView()->mainFrame();
+  blink::WebFrame* guest_frame = guest_render_view->GetWebView()->mainFrame();
   return guest_frame->windowObject();
 }
 
 // static
-bool BrowserPlugin::AttachWindowTo(const WebKit::WebNode& node, int window_id) {
+bool BrowserPlugin::AttachWindowTo(const blink::WebNode& node, int window_id) {
   if (node.isNull())
     return false;
 
   if (!node.isElementNode())
     return false;
 
-  WebKit::WebElement shim_element = node.toConst<WebKit::WebElement>();
+  blink::WebElement shim_element = node.toConst<blink::WebElement>();
   // The shim containing the BrowserPlugin must be attached to a document.
   if (shim_element.document().isNull())
     return false;
 
-  WebKit::WebNode shadow_root = shim_element.shadowRoot();
+  blink::WebNode shadow_root = shim_element.shadowRoot();
   if (shadow_root.isNull() || !shadow_root.hasChildNodes())
     return false;
 
-  WebKit::WebNode plugin_element = shadow_root.firstChild();
-  WebKit::WebPluginContainer* plugin_container =
+  blink::WebNode plugin_element = shadow_root.firstChild();
+  blink::WebPluginContainer* plugin_container =
       plugin_element.pluginContainer();
   if (!plugin_container)
     return false;
@@ -743,8 +790,6 @@ void BrowserPlugin::ShowSadGraphic() {
   // NULL so we shouldn't attempt to access it.
   if (container_)
     container_->invalidate();
-  // Turn off compositing so we can display the sad graphic.
-  EnableCompositing(false);
 }
 
 void BrowserPlugin::ParseAttributes() {
@@ -780,7 +825,7 @@ void BrowserPlugin::TriggerEvent(const std::string& event_name,
   if (!container())
     return;
 
-  WebKit::WebFrame* frame = container()->element().document().frame();
+  blink::WebFrame* frame = container()->element().document().frame();
   if (!frame)
     return;
 
@@ -801,18 +846,22 @@ void BrowserPlugin::TriggerEvent(const std::string& event_name,
       return;
   }
 
-  WebKit::WebDOMEvent dom_event = frame->document().createEvent("CustomEvent");
-  WebKit::WebDOMCustomEvent event = dom_event.to<WebKit::WebDOMCustomEvent>();
+  blink::WebDOMEvent dom_event = frame->document().createEvent("CustomEvent");
+  blink::WebDOMCustomEvent event = dom_event.to<blink::WebDOMCustomEvent>();
 
   // The events triggered directly from the plugin <object> are internal events
   // whose implementation details can (and likely will) change over time. The
   // wrapper/shim (e.g. <webview> tag) should receive these events, and expose a
   // more appropriate (and stable) event to the consumers as part of the API.
   event.initCustomEvent(
-      WebKit::WebString::fromUTF8(GetInternalEventName(event_name.c_str())),
-      false, false,
-      WebKit::WebSerializedScriptValue::serialize(
-          v8::String::New(json_string.c_str(), json_string.size())));
+      blink::WebString::fromUTF8(GetInternalEventName(event_name.c_str())),
+      false,
+      false,
+      blink::WebSerializedScriptValue::serialize(
+          v8::String::NewFromUtf8(context->GetIsolate(),
+                                  json_string.c_str(),
+                                  v8::String::kNormalString,
+                                  json_string.size())));
   container()->element().dispatchEvent(event);
 }
 
@@ -833,7 +882,7 @@ bool BrowserPlugin::ShouldGuestBeFocused() const {
   return plugin_focused_ && embedder_focused;
 }
 
-WebKit::WebPluginContainer* BrowserPlugin::container() const {
+blink::WebPluginContainer* BrowserPlugin::container() const {
   return container_;
 }
 
@@ -874,21 +923,24 @@ void BrowserPlugin::EnableCompositing(bool enable) {
                                              render_view_routing_id_);
     }
   } else {
-    // We're switching back to the software path. We create a new damage
-    // buffer that can accommodate the current size of the container.
-    BrowserPluginHostMsg_ResizeGuest_Params params;
-    // Request a full repaint from the guest even if its size is not actually
-    // changing.
-    PopulateResizeGuestParameters(&params,
-                                  plugin_rect(),
-                                  true /* needs_repaint */);
-    paint_ack_received_ = false;
-    browser_plugin_manager()->Send(new BrowserPluginHostMsg_ResizeGuest(
-        render_view_routing_id_,
-        guest_instance_id_,
-        params));
+    if (paint_ack_received_) {
+      // We're switching back to the software path. We create a new damage
+      // buffer that can accommodate the current size of the container.
+      BrowserPluginHostMsg_ResizeGuest_Params params;
+      // Request a full repaint from the guest even if its size is not actually
+      // changing.
+      PopulateResizeGuestParameters(&params,
+                                    plugin_rect(),
+                                    true /* needs_repaint */);
+      paint_ack_received_ = false;
+      browser_plugin_manager()->Send(new BrowserPluginHostMsg_ResizeGuest(
+          render_view_routing_id_,
+          guest_instance_id_,
+          params));
+    }
   }
   compositing_helper_->EnableCompositing(enable);
+  compositing_helper_->SetContentsOpaque(!GetAllowTransparencyAttribute());
 }
 
 void BrowserPlugin::destroy() {
@@ -916,7 +968,7 @@ NPObject* BrowserPlugin::scriptableObject() {
 
   NPObject* browser_plugin_np_object(bindings_->np_object());
   // The object is expected to be retained before it is returned.
-  WebKit::WebBindings::retainObject(browser_plugin_np_object);
+  blink::WebBindings::retainObject(browser_plugin_np_object);
   return browser_plugin_np_object;
 }
 
@@ -932,6 +984,10 @@ bool BrowserPlugin::supportsEditCommands() const {
   return true;
 }
 
+bool BrowserPlugin::supportsInputMethod() const {
+  return true;
+}
+
 bool BrowserPlugin::canProcessDrag() const {
   return true;
 }
@@ -988,7 +1044,7 @@ bool BrowserPlugin::InBounds(const gfx::Point& position) const {
 
 gfx::Point BrowserPlugin::ToLocalCoordinates(const gfx::Point& point) const {
   if (container_)
-    return container_->windowToLocalPoint(WebKit::WebPoint(point));
+    return container_->windowToLocalPoint(blink::WebPoint(point));
   return gfx::Point(point.x() - plugin_rect_.x(), point.y() - plugin_rect_.y());
 }
 
@@ -1000,6 +1056,7 @@ bool BrowserPlugin::ShouldForwardToBrowserPlugin(
     case BrowserPluginMsg_Attach_ACK::ID:
     case BrowserPluginMsg_BuffersSwapped::ID:
     case BrowserPluginMsg_CompositorFrameSwapped::ID:
+    case BrowserPluginMsg_CopyFromCompositingSurface::ID:
     case BrowserPluginMsg_GuestContentWindowReady::ID:
     case BrowserPluginMsg_GuestGone::ID:
     case BrowserPluginMsg_SetCursor::ID:
@@ -1180,34 +1237,34 @@ bool BrowserPlugin::acceptsInputEvents() {
   return true;
 }
 
-bool BrowserPlugin::handleInputEvent(const WebKit::WebInputEvent& event,
-                                     WebKit::WebCursorInfo& cursor_info) {
+bool BrowserPlugin::handleInputEvent(const blink::WebInputEvent& event,
+                                     blink::WebCursorInfo& cursor_info) {
   if (guest_crashed_ || !HasGuestInstanceID())
     return false;
 
-  if (event.type == WebKit::WebInputEvent::ContextMenu)
+  if (event.type == blink::WebInputEvent::ContextMenu)
     return true;
 
-  const WebKit::WebInputEvent* modified_event = &event;
-  scoped_ptr<WebKit::WebTouchEvent> touch_event;
+  const blink::WebInputEvent* modified_event = &event;
+  scoped_ptr<blink::WebTouchEvent> touch_event;
   // WebKit gives BrowserPlugin a list of touches that are down, but the browser
   // process expects a list of all touches. We modify the TouchEnd event here to
   // match these expectations.
-  if (event.type == WebKit::WebInputEvent::TouchEnd) {
-    const WebKit::WebTouchEvent* orig_touch_event =
-        static_cast<const WebKit::WebTouchEvent*>(&event);
-    touch_event.reset(new WebKit::WebTouchEvent());
-    memcpy(touch_event.get(), orig_touch_event, sizeof(WebKit::WebTouchEvent));
+  if (event.type == blink::WebInputEvent::TouchEnd) {
+    const blink::WebTouchEvent* orig_touch_event =
+        static_cast<const blink::WebTouchEvent*>(&event);
+    touch_event.reset(new blink::WebTouchEvent());
+    memcpy(touch_event.get(), orig_touch_event, sizeof(blink::WebTouchEvent));
     if (touch_event->changedTouchesLength > 0) {
       memcpy(&touch_event->touches[touch_event->touchesLength],
              &touch_event->changedTouches,
-            touch_event->changedTouchesLength * sizeof(WebKit::WebTouchPoint));
+            touch_event->changedTouchesLength * sizeof(blink::WebTouchPoint));
     }
     touch_event->touchesLength += touch_event->changedTouchesLength;
     modified_event = touch_event.get();
   }
 
-  if (WebKit::WebInputEvent::isKeyboardEventType(event.type) &&
+  if (blink::WebInputEvent::isKeyboardEventType(event.type) &&
       !edit_commands_.empty()) {
     browser_plugin_manager()->Send(
         new BrowserPluginHostMsg_SetEditCommandsForNextKeyEvent(
@@ -1226,11 +1283,11 @@ bool BrowserPlugin::handleInputEvent(const WebKit::WebInputEvent& event,
   return true;
 }
 
-bool BrowserPlugin::handleDragStatusUpdate(WebKit::WebDragStatus drag_status,
-                                           const WebKit::WebDragData& drag_data,
-                                           WebKit::WebDragOperationsMask mask,
-                                           const WebKit::WebPoint& position,
-                                           const WebKit::WebPoint& screen) {
+bool BrowserPlugin::handleDragStatusUpdate(blink::WebDragStatus drag_status,
+                                           const blink::WebDragData& drag_data,
+                                           blink::WebDragOperationsMask mask,
+                                           const blink::WebPoint& position,
+                                           const blink::WebPoint& screen) {
   if (guest_crashed_ || !HasGuestInstanceID())
     return false;
   browser_plugin_manager()->Send(
@@ -1245,7 +1302,7 @@ bool BrowserPlugin::handleDragStatusUpdate(WebKit::WebDragStatus drag_status,
 }
 
 void BrowserPlugin::didReceiveResponse(
-    const WebKit::WebURLResponse& response) {
+    const blink::WebURLResponse& response) {
 }
 
 void BrowserPlugin::didReceiveData(const char* data, int data_length) {
@@ -1254,20 +1311,20 @@ void BrowserPlugin::didReceiveData(const char* data, int data_length) {
 void BrowserPlugin::didFinishLoading() {
 }
 
-void BrowserPlugin::didFailLoading(const WebKit::WebURLError& error) {
+void BrowserPlugin::didFailLoading(const blink::WebURLError& error) {
 }
 
-void BrowserPlugin::didFinishLoadingFrameRequest(const WebKit::WebURL& url,
+void BrowserPlugin::didFinishLoadingFrameRequest(const blink::WebURL& url,
                                                  void* notify_data) {
 }
 
 void BrowserPlugin::didFailLoadingFrameRequest(
-    const WebKit::WebURL& url,
+    const blink::WebURL& url,
     void* notify_data,
-    const WebKit::WebURLError& error) {
+    const blink::WebURLError& error) {
 }
 
-bool BrowserPlugin::executeEditCommand(const WebKit::WebString& name) {
+bool BrowserPlugin::executeEditCommand(const blink::WebString& name) {
   browser_plugin_manager()->Send(new BrowserPluginHostMsg_ExecuteEditCommand(
       render_view_routing_id_,
       guest_instance_id_,
@@ -1277,13 +1334,61 @@ bool BrowserPlugin::executeEditCommand(const WebKit::WebString& name) {
   return true;
 }
 
-bool BrowserPlugin::executeEditCommand(const WebKit::WebString& name,
-                                       const WebKit::WebString& value) {
+bool BrowserPlugin::executeEditCommand(const blink::WebString& name,
+                                       const blink::WebString& value) {
   edit_commands_.push_back(EditCommand(name.utf8(), value.utf8()));
   // BrowserPlugin swallows edit commands.
   return true;
 }
 
+bool BrowserPlugin::setComposition(
+    const blink::WebString& text,
+    const blink::WebVector<blink::WebCompositionUnderline>& underlines,
+    int selectionStart,
+    int selectionEnd) {
+  if (!HasGuestInstanceID())
+    return false;
+  std::vector<blink::WebCompositionUnderline> std_underlines;
+  for (size_t i = 0; i < underlines.size(); ++i) {
+    std_underlines.push_back(underlines[i]);
+  }
+  browser_plugin_manager()->Send(new BrowserPluginHostMsg_ImeSetComposition(
+      render_view_routing_id_,
+      guest_instance_id_,
+      text.utf8(),
+      std_underlines,
+      selectionStart,
+      selectionEnd));
+  // TODO(kochi): This assumes the IPC handling always succeeds.
+  return true;
+}
+
+bool BrowserPlugin::confirmComposition(
+    const blink::WebString& text,
+    blink::WebWidget::ConfirmCompositionBehavior selectionBehavior) {
+  if (!HasGuestInstanceID())
+    return false;
+  bool keep_selection = (selectionBehavior == blink::WebWidget::KeepSelection);
+  browser_plugin_manager()->Send(new BrowserPluginHostMsg_ImeConfirmComposition(
+      render_view_routing_id_,
+      guest_instance_id_,
+      text.utf8(),
+      keep_selection));
+  // TODO(kochi): This assumes the IPC handling always succeeds.
+  return true;
+}
+
+void BrowserPlugin::extendSelectionAndDelete(int before, int after) {
+  if (!HasGuestInstanceID())
+    return;
+  browser_plugin_manager()->Send(
+      new BrowserPluginHostMsg_ExtendSelectionAndDelete(
+          render_view_routing_id_,
+          guest_instance_id_,
+          before,
+          after));
+}
+
 void BrowserPlugin::OnLockMouseACK(bool succeeded) {
   mouse_locked_ = succeeded;
   browser_plugin_manager()->Send(new BrowserPluginHostMsg_LockMouse_ACK(
@@ -1300,7 +1405,7 @@ void BrowserPlugin::OnMouseLockLost() {
 }
 
 bool BrowserPlugin::HandleMouseLockedInputEvent(
-    const WebKit::WebMouseEvent& event) {
+    const blink::WebMouseEvent& event) {
   browser_plugin_manager()->Send(
       new BrowserPluginHostMsg_HandleInputEvent(render_view_routing_id_,
                                                 guest_instance_id_,
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin.h b/chromium/content/renderer/browser_plugin/browser_plugin.h
index ba30ac909d8..d2b21aa7742 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin.h
+++ b/chromium/content/renderer/browser_plugin/browser_plugin.h
@@ -14,12 +14,13 @@
 #include "base/memory/shared_memory.h"
 #endif
 #include "base/values.h"
-#include "content/public/common/browser_plugin_permission_type.h"
 #include "content/renderer/browser_plugin/browser_plugin_backing_store.h"
 #include "content/renderer/browser_plugin/browser_plugin_bindings.h"
 #include "content/renderer/mouse_lock_dispatcher.h"
 #include "content/renderer/render_view_impl.h"
+#include "third_party/WebKit/public/web/WebCompositionUnderline.h"
 #include "third_party/WebKit/public/web/WebDragStatus.h"
+#include "third_party/WebKit/public/web/WebWidget.h"
 
 struct BrowserPluginHostMsg_AutoSize_Params;
 struct BrowserPluginHostMsg_ResizeGuest_Params;
@@ -34,7 +35,7 @@ class BrowserPluginManager;
 class MockBrowserPlugin;
 
 class CONTENT_EXPORT BrowserPlugin :
-    NON_EXPORTED_BASE(public WebKit::WebPlugin),
+    NON_EXPORTED_BASE(public blink::WebPlugin),
     public MouseLockDispatcher::LockTarget {
  public:
   RenderViewImpl* render_view() const { return render_view_.get(); }
@@ -42,7 +43,7 @@ class CONTENT_EXPORT BrowserPlugin :
   int guest_instance_id() const { return guest_instance_id_; }
   bool attached() const { return attached_; }
 
-  static BrowserPlugin* FromContainer(WebKit::WebPluginContainer* container);
+  static BrowserPlugin* FromContainer(blink::WebPluginContainer* container);
 
   bool OnMessageReceived(const IPC::Message& msg);
 
@@ -61,6 +62,11 @@ class CONTENT_EXPORT BrowserPlugin :
   std::string GetNameAttribute() const;
   // Parse the name attribute value.
   void ParseNameAttribute();
+  // Get the allowtransparency attribute value.
+  bool GetAllowTransparencyAttribute() const;
+  // Parse the allowtransparency attribute and adjust transparency of
+  // BrowserPlugin accordingly.
+  void ParseAllowTransparencyAttribute();
   // Get the src attribute value of the BrowserPlugin instance.
   std::string GetSrcAttribute() const;
   // Parse the src attribute value of the BrowserPlugin instance.
@@ -102,7 +108,7 @@ class CONTENT_EXPORT BrowserPlugin :
 
   // Attaches the window identified by |window_id| to the the given node
   // encapsulating a BrowserPlugin.
-  static bool AttachWindowTo(const WebKit::WebNode& node,
+  static bool AttachWindowTo(const blink::WebNode& node,
                              int window_id);
 
   // Informs the guest of an updated focus state.
@@ -139,55 +145,65 @@ class CONTENT_EXPORT BrowserPlugin :
   // Returns whether a message should be forwarded to BrowserPlugin.
   static bool ShouldForwardToBrowserPlugin(const IPC::Message& message);
 
-  // WebKit::WebPlugin implementation.
-  virtual WebKit::WebPluginContainer* container() const OVERRIDE;
-  virtual bool initialize(WebKit::WebPluginContainer* container) OVERRIDE;
+  // blink::WebPlugin implementation.
+  virtual blink::WebPluginContainer* container() const OVERRIDE;
+  virtual bool initialize(blink::WebPluginContainer* container) OVERRIDE;
   virtual void destroy() OVERRIDE;
   virtual NPObject* scriptableObject() OVERRIDE;
   virtual struct _NPP* pluginNPP() OVERRIDE;
   virtual bool supportsKeyboardFocus() const OVERRIDE;
   virtual bool supportsEditCommands() const OVERRIDE;
+  virtual bool supportsInputMethod() const OVERRIDE;
   virtual bool canProcessDrag() const OVERRIDE;
   virtual void paint(
-      WebKit::WebCanvas* canvas,
-      const WebKit::WebRect& rect) OVERRIDE;
+      blink::WebCanvas* canvas,
+      const blink::WebRect& rect) OVERRIDE;
   virtual void updateGeometry(
-      const WebKit::WebRect& frame_rect,
-      const WebKit::WebRect& clip_rect,
-      const WebKit::WebVector<WebKit::WebRect>& cut_outs_rects,
+      const blink::WebRect& frame_rect,
+      const blink::WebRect& clip_rect,
+      const blink::WebVector<blink::WebRect>& cut_outs_rects,
       bool is_visible) OVERRIDE;
   virtual void updateFocus(bool focused) OVERRIDE;
   virtual void updateVisibility(bool visible) OVERRIDE;
   virtual bool acceptsInputEvents() OVERRIDE;
   virtual bool handleInputEvent(
-      const WebKit::WebInputEvent& event,
-      WebKit::WebCursorInfo& cursor_info) OVERRIDE;
-  virtual bool handleDragStatusUpdate(WebKit::WebDragStatus drag_status,
-                                      const WebKit::WebDragData& drag_data,
-                                      WebKit::WebDragOperationsMask mask,
-                                      const WebKit::WebPoint& position,
-                                      const WebKit::WebPoint& screen) OVERRIDE;
+      const blink::WebInputEvent& event,
+      blink::WebCursorInfo& cursor_info) OVERRIDE;
+  virtual bool handleDragStatusUpdate(blink::WebDragStatus drag_status,
+                                      const blink::WebDragData& drag_data,
+                                      blink::WebDragOperationsMask mask,
+                                      const blink::WebPoint& position,
+                                      const blink::WebPoint& screen) OVERRIDE;
   virtual void didReceiveResponse(
-      const WebKit::WebURLResponse& response) OVERRIDE;
+      const blink::WebURLResponse& response) OVERRIDE;
   virtual void didReceiveData(const char* data, int data_length) OVERRIDE;
   virtual void didFinishLoading() OVERRIDE;
-  virtual void didFailLoading(const WebKit::WebURLError& error) OVERRIDE;
+  virtual void didFailLoading(const blink::WebURLError& error) OVERRIDE;
   virtual void didFinishLoadingFrameRequest(
-      const WebKit::WebURL& url,
+      const blink::WebURL& url,
       void* notify_data) OVERRIDE;
   virtual void didFailLoadingFrameRequest(
-      const WebKit::WebURL& url,
+      const blink::WebURL& url,
       void* notify_data,
-      const WebKit::WebURLError& error) OVERRIDE;
-  virtual bool executeEditCommand(const WebKit::WebString& name) OVERRIDE;
-  virtual bool executeEditCommand(const WebKit::WebString& name,
-                                  const WebKit::WebString& value) OVERRIDE;
+      const blink::WebURLError& error) OVERRIDE;
+  virtual bool executeEditCommand(const blink::WebString& name) OVERRIDE;
+  virtual bool executeEditCommand(const blink::WebString& name,
+                                  const blink::WebString& value) OVERRIDE;
+  virtual bool setComposition(
+      const blink::WebString& text,
+      const blink::WebVector<blink::WebCompositionUnderline>& underlines,
+      int selectionStart,
+      int selectionEnd) OVERRIDE;
+  virtual bool confirmComposition(
+      const blink::WebString& text,
+      blink::WebWidget::ConfirmCompositionBehavior selectionBehavior) OVERRIDE;
+  virtual void extendSelectionAndDelete(int before, int after) OVERRIDE;
 
   // MouseLockDispatcher::LockTarget implementation.
   virtual void OnLockMouseACK(bool succeeded) OVERRIDE;
   virtual void OnMouseLockLost() OVERRIDE;
   virtual bool HandleMouseLockedInputEvent(
-          const WebKit::WebMouseEvent& event) OVERRIDE;
+          const blink::WebMouseEvent& event) OVERRIDE;
 
  private:
   friend class base::DeleteHelper<BrowserPlugin>;
@@ -199,16 +215,11 @@ class CONTENT_EXPORT BrowserPlugin :
   friend class MockBrowserPlugin;
 
   // A BrowserPlugin object is a controller that represents an instance of a
-  // browser plugin within the embedder renderer process. Each BrowserPlugin
-  // within a RenderView has a unique instance_id that is used to track per-
-  // BrowserPlugin state in the browser process. Once a BrowserPlugin does
-  // an initial navigation or is attached to a newly created guest, it acquires
-  // a guest_instance_id as well. The guest instance ID uniquely identifies a
-  // guest WebContents that's hosted by this BrowserPlugin.
-  BrowserPlugin(
-      RenderViewImpl* render_view,
-      WebKit::WebFrame* frame,
-      const WebKit::WebPluginParams& params);
+  // browser plugin within the embedder renderer process. Once a BrowserPlugin
+  // does an initial navigation or is attached to a newly created guest, it
+  // acquires a guest_instance_id as well. The guest instance ID uniquely
+  // identifies a guest WebContents that's hosted by this BrowserPlugin.
+  BrowserPlugin(RenderViewImpl* render_view, blink::WebFrame* frame);
 
   virtual ~BrowserPlugin();
 
@@ -287,6 +298,10 @@ class CONTENT_EXPORT BrowserPlugin :
   void OnBuffersSwapped(int instance_id,
                         const BrowserPluginMsg_BuffersSwapped_Params& params);
   void OnCompositorFrameSwapped(const IPC::Message& message);
+  void OnCopyFromCompositingSurface(int instance_id,
+                                    int request_id,
+                                    gfx::Rect source_rect,
+                                    gfx::Size dest_size);
   void OnGuestContentWindowReady(int instance_id,
                                  int content_window_routing_id);
   void OnGuestGone(int instance_id);
@@ -308,7 +323,7 @@ class CONTENT_EXPORT BrowserPlugin :
   // If the |render_view_| is destroyed before the BrowserPlugin is destroyed
   // then we will attempt to access a NULL pointer.
   int render_view_routing_id_;
-  WebKit::WebPluginContainer* container_;
+  blink::WebPluginContainer* container_;
   scoped_ptr<BrowserPluginBindings> bindings_;
   scoped_ptr<BrowserPluginBackingStore> backing_store_;
   scoped_ptr<base::SharedMemory> current_damage_buffer_;
@@ -339,9 +354,6 @@ class CONTENT_EXPORT BrowserPlugin :
   bool before_first_navigation_;
   bool mouse_locked_;
 
-  typedef std::pair<int, base::WeakPtr<BrowserPlugin> > TrackedV8ObjectID;
-  std::map<int, TrackedV8ObjectID*> tracked_v8_objects_;
-
   // BrowserPlugin outlives RenderViewImpl in Chrome Apps and so we need to
   // store the BrowserPlugin's BrowserPluginManager in a member variable to
   // avoid accessing the RenderViewImpl.
@@ -354,6 +366,9 @@ class CONTENT_EXPORT BrowserPlugin :
   // Used to identify the plugin to WebBindings.
   scoped_ptr<struct _NPP> npp_;
 
+  // URL for the embedder frame.
+  GURL embedder_frame_url_;
+
   // Weak factory used in v8 |MakeWeak| callback, since the v8 callback might
   // get called after BrowserPlugin has been destroyed.
   base::WeakPtrFactory<BrowserPlugin> weak_ptr_factory_;
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_bindings.cc b/chromium/content/renderer/browser_plugin/browser_plugin_bindings.cc
index 5dd5231703c..2e0ab773315 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_bindings.cc
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_bindings.cc
@@ -28,12 +28,12 @@
 #include "third_party/npapi/bindings/npapi.h"
 #include "v8/include/v8.h"
 
-using WebKit::WebBindings;
-using WebKit::WebElement;
-using WebKit::WebDOMEvent;
-using WebKit::WebDOMMessageEvent;
-using WebKit::WebPluginContainer;
-using WebKit::WebString;
+using blink::WebBindings;
+using blink::WebElement;
+using blink::WebDOMEvent;
+using blink::WebDOMMessageEvent;
+using blink::WebPluginContainer;
+using blink::WebString;
 
 namespace content {
 
@@ -242,7 +242,7 @@ class BrowserPluginBindingAttach: public BrowserPluginMethodBinding {
       return false;
 
     scoped_ptr<V8ValueConverter> converter(V8ValueConverter::create());
-    v8::Handle<v8::Value> obj(WebKit::WebBindings::toV8Value(&args[0]));
+    v8::Handle<v8::Value> obj(blink::WebBindings::toV8Value(&args[0]));
     scoped_ptr<base::Value> value(
         converter->FromV8Value(obj, bindings->instance()->render_view()->
             GetWebView()->mainFrame()->mainWorldScriptContext()));
@@ -272,7 +272,7 @@ class BrowserPluginBindingAttachWindowTo : public BrowserPluginMethodBinding {
   virtual bool Invoke(BrowserPluginBindings* bindings,
                       const NPVariant* args,
                       NPVariant* result) OVERRIDE {
-    WebKit::WebNode node;
+    blink::WebNode node;
     WebBindings::getNode(NPVARIANT_TO_OBJECT(args[0]), &node);
     int window_id = IntFromNPVariant(args[1]);
     BOOLEAN_TO_NPVARIANT(BrowserPlugin::AttachWindowTo(node, window_id),
@@ -312,6 +312,41 @@ class BrowserPluginPropertyBinding {
   DISALLOW_COPY_AND_ASSIGN(BrowserPluginPropertyBinding);
 };
 
+class BrowserPluginPropertyBindingAllowTransparency
+    : public BrowserPluginPropertyBinding {
+ public:
+  BrowserPluginPropertyBindingAllowTransparency()
+      : BrowserPluginPropertyBinding(
+          browser_plugin::kAttributeAllowTransparency) {
+  }
+  virtual bool GetProperty(BrowserPluginBindings* bindings,
+                           NPVariant* result) OVERRIDE {
+    bool allow_transparency =
+        bindings->instance()->GetAllowTransparencyAttribute();
+    BOOLEAN_TO_NPVARIANT(allow_transparency, *result);
+    return true;
+  }
+  virtual bool SetProperty(BrowserPluginBindings* bindings,
+                           NPObject* np_obj,
+                           const NPVariant* variant) OVERRIDE {
+    std::string value = StringFromNPVariant(*variant);
+    if (!bindings->instance()->HasDOMAttribute(name())) {
+      UpdateDOMAttribute(bindings, value);
+      bindings->instance()->ParseAllowTransparencyAttribute();
+    } else {
+      UpdateDOMAttribute(bindings, value);
+    }
+    return true;
+  }
+  virtual void RemoveProperty(BrowserPluginBindings* bindings,
+                              NPObject* np_obj) OVERRIDE {
+    bindings->instance()->RemoveDOMAttribute(name());
+    bindings->instance()->ParseAllowTransparencyAttribute();
+  }
+ private:
+  DISALLOW_COPY_AND_ASSIGN(BrowserPluginPropertyBindingAllowTransparency);
+};
+
 class BrowserPluginPropertyBindingAutoSize
     : public BrowserPluginPropertyBinding {
  public:
@@ -638,6 +673,8 @@ BrowserPluginBindings::BrowserPluginBindings(BrowserPlugin* instance)
   method_bindings_.push_back(new BrowserPluginBindingAttach);
   method_bindings_.push_back(new BrowserPluginBindingAttachWindowTo);
 
+  property_bindings_.push_back(
+      new BrowserPluginPropertyBindingAllowTransparency);
   property_bindings_.push_back(new BrowserPluginPropertyBindingAutoSize);
   property_bindings_.push_back(new BrowserPluginPropertyBindingContentWindow);
   property_bindings_.push_back(new BrowserPluginPropertyBindingMaxHeight);
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_browsertest.cc b/chromium/content/renderer/browser_plugin/browser_plugin_browsertest.cc
index d12b45bdfc2..36ee92cf0fa 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_browsertest.cc
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_browsertest.cc
@@ -16,14 +16,15 @@
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/renderer_webkitplatformsupport_impl.h"
 #include "skia/ext/platform_canvas.h"
-#include "third_party/WebKit/public/web/WebCursorInfo.h"
+#include "third_party/WebKit/public/platform/WebCursorInfo.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "third_party/WebKit/public/web/WebScriptSource.h"
 
 namespace {
 const char kHTMLForBrowserPluginObject[] =
     "<object id='browserplugin' width='640px' height='480px'"
-    " src='foo' type='%s'>";
+    " src='foo' type='%s'></object>"
+    "<script>document.querySelector('object').nonExistentAttribute;</script>";
 
 const char kHTMLForBrowserPluginWithAllAttributes[] =
     "<object id='browserplugin' width='640' height='480' type='%s'"
@@ -61,7 +62,7 @@ class TestContentRendererClient : public ContentRendererClient {
   virtual ~TestContentRendererClient() {
   }
   virtual bool AllowBrowserPlugin(
-      WebKit::WebPluginContainer* container) OVERRIDE {
+      blink::WebPluginContainer* container) OVERRIDE {
     // Allow BrowserPlugin for tests.
     return true;
   }
@@ -114,7 +115,7 @@ std::string BrowserPluginTest::ExecuteScriptAndReturnString(
     const std::string& script) {
   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
   v8::Handle<v8::Value> value = GetMainFrame()->executeScriptAndReturnValue(
-      WebKit::WebScriptSource(WebKit::WebString::fromUTF8(script.c_str())));
+      blink::WebScriptSource(blink::WebString::fromUTF8(script.c_str())));
   if (value.IsEmpty() || !value->IsString())
     return std::string();
 
@@ -129,7 +130,7 @@ int BrowserPluginTest::ExecuteScriptAndReturnInt(
     const std::string& script) {
   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
   v8::Handle<v8::Value> value = GetMainFrame()->executeScriptAndReturnValue(
-      WebKit::WebScriptSource(WebKit::WebString::fromUTF8(script.c_str())));
+      blink::WebScriptSource(blink::WebString::fromUTF8(script.c_str())));
   if (value.IsEmpty() || !value->IsInt32())
     return 0;
 
@@ -142,7 +143,7 @@ bool BrowserPluginTest::ExecuteScriptAndReturnBool(
     const std::string& script, bool* result) {
   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
   v8::Handle<v8::Value> value = GetMainFrame()->executeScriptAndReturnValue(
-      WebKit::WebScriptSource(WebKit::WebString::fromUTF8(script.c_str())));
+      blink::WebScriptSource(blink::WebString::fromUTF8(script.c_str())));
   if (value.IsEmpty() || !value->IsBoolean())
     return false;
 
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc b/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc
index c7e1ae88432..a3ce8444df1 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc
@@ -4,19 +4,25 @@
 
 #include "content/renderer/browser_plugin/browser_plugin_compositing_helper.h"
 
+#include "cc/layers/delegated_frame_provider.h"
+#include "cc/layers/delegated_frame_resource_collection.h"
 #include "cc/layers/delegated_renderer_layer.h"
 #include "cc/layers/solid_color_layer.h"
 #include "cc/layers/texture_layer.h"
 #include "cc/output/context_provider.h"
+#include "cc/output/copy_output_request.h"
+#include "cc/output/copy_output_result.h"
 #include "cc/resources/single_release_callback.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/gpu/client/context_provider_command_buffer.h"
 #include "content/renderer/browser_plugin/browser_plugin_manager.h"
 #include "content/renderer/render_thread_impl.h"
+#include "skia/ext/image_operations.h"
 #include "third_party/WebKit/public/platform/WebGraphicsContext3D.h"
 #include "third_party/WebKit/public/web/WebPluginContainer.h"
 #include "third_party/khronos/GLES2/gl2.h"
 #include "ui/gfx/size_conversions.h"
+#include "ui/gfx/skia_util.h"
 #include "webkit/renderer/compositor_bindings/web_layer_impl.h"
 
 namespace content {
@@ -30,7 +36,7 @@ BrowserPluginCompositingHelper::SwapBuffersInfo::SwapBuffersInfo()
 }
 
 BrowserPluginCompositingHelper::BrowserPluginCompositingHelper(
-    WebKit::WebPluginContainer* container,
+    blink::WebPluginContainer* container,
     BrowserPluginManager* manager,
     int instance_id,
     int host_routing_id)
@@ -41,6 +47,8 @@ BrowserPluginCompositingHelper::BrowserPluginCompositingHelper(
       last_host_id_(0),
       last_mailbox_valid_(false),
       ack_pending_(true),
+      software_ack_pending_(false),
+      opaque_(true),
       container_(container),
       browser_plugin_manager_(manager) {
 }
@@ -48,12 +56,45 @@ BrowserPluginCompositingHelper::BrowserPluginCompositingHelper(
 BrowserPluginCompositingHelper::~BrowserPluginCompositingHelper() {
 }
 
+void BrowserPluginCompositingHelper::CopyFromCompositingSurface(
+    int request_id,
+    gfx::Rect source_rect,
+    gfx::Size dest_size) {
+  CHECK(background_layer_);
+  scoped_ptr<cc::CopyOutputRequest> request =
+      cc::CopyOutputRequest::CreateBitmapRequest(base::Bind(
+          &BrowserPluginCompositingHelper::CopyFromCompositingSurfaceHasResult,
+          this,
+          request_id,
+          dest_size));
+  request->set_area(source_rect);
+  background_layer_->RequestCopyOfOutput(request.Pass());
+}
+
 void BrowserPluginCompositingHelper::DidCommitCompositorFrame() {
-  if (!delegated_layer_.get() || !ack_pending_)
+  if (software_ack_pending_) {
+    cc::CompositorFrameAck ack;
+    if (!unacked_software_frames_.empty()) {
+      ack.last_software_frame_id = unacked_software_frames_.back();
+      unacked_software_frames_.pop_back();
+    }
+
+    browser_plugin_manager_->Send(
+        new BrowserPluginHostMsg_CompositorFrameACK(
+            host_routing_id_,
+            instance_id_,
+            last_route_id_,
+            last_output_surface_id_,
+            last_host_id_,
+            ack));
+
+    software_ack_pending_ = false;
+  }
+  if (!resource_collection_.get() || !ack_pending_)
     return;
 
   cc::CompositorFrameAck ack;
-  delegated_layer_->TakeUnusedResourcesForChildCompositor(&ack.resources);
+  resource_collection_->TakeUnusedResourcesForChildCompositor(&ack.resources);
 
   browser_plugin_manager_->Send(
       new BrowserPluginHostMsg_CompositorFrameACK(
@@ -79,7 +120,7 @@ void BrowserPluginCompositingHelper::EnableCompositing(bool enable) {
   container_->setWebLayer(enable ? web_layer_.get() : NULL);
 }
 
-void BrowserPluginCompositingHelper::CheckSizeAndAdjustLayerBounds(
+void BrowserPluginCompositingHelper::CheckSizeAndAdjustLayerProperties(
     const gfx::Size& new_size,
     float device_scale_factor,
     cc::Layer* layer) {
@@ -92,6 +133,10 @@ void BrowserPluginCompositingHelper::CheckSizeAndAdjustLayerBounds(
         gfx::ScaleSize(buffer_size_, 1.0f / device_scale_factor));
     layer->SetBounds(device_scale_adjusted_size);
   }
+
+  // Manually manage background layer for transparent webview.
+  if (!opaque_)
+    background_layer_->SetIsDrawable(false);
 }
 
 void BrowserPluginCompositingHelper::MailboxReleased(
@@ -112,6 +157,9 @@ void BrowserPluginCompositingHelper::MailboxReleased(
       last_route_id_ != mailbox.route_id)
     return;
 
+  if (mailbox.type == SOFTWARE_COMPOSITOR_FRAME)
+    unacked_software_frames_.push_back(mailbox.software_frame_id);
+
   // We need to send an ACK to for every buffer sent to us.
   // However, if a buffer is freed up from
   // the compositor in cases like switching back to SW mode without a new
@@ -152,20 +200,8 @@ void BrowserPluginCompositingHelper::MailboxReleased(
              ack));
       break;
     }
-    case SOFTWARE_COMPOSITOR_FRAME: {
-      cc::CompositorFrameAck ack;
-      ack.last_software_frame_id = mailbox.software_frame_id;
-
-      browser_plugin_manager_->Send(
-         new BrowserPluginHostMsg_CompositorFrameACK(
-             host_routing_id_,
-             instance_id_,
-             mailbox.route_id,
-             mailbox.output_surface_id,
-             mailbox.host_id,
-             ack));
+    case SOFTWARE_COMPOSITOR_FRAME:
       break;
-    }
   }
 }
 
@@ -174,6 +210,13 @@ void BrowserPluginCompositingHelper::OnContainerDestroy() {
     container_->setWebLayer(NULL);
   container_ = NULL;
 
+  if (resource_collection_)
+    resource_collection_->SetClient(NULL);
+
+  ack_pending_ = false;
+  software_ack_pending_ = false;
+  resource_collection_ = NULL;
+  frame_provider_ = NULL;
   texture_layer_ = NULL;
   delegated_layer_ = NULL;
   background_layer_ = NULL;
@@ -208,7 +251,7 @@ void BrowserPluginCompositingHelper::OnBuffersSwappedPrivate(
   if (!texture_layer_.get()) {
     texture_layer_ = cc::TextureLayer::CreateForMailbox(NULL);
     texture_layer_->SetIsDrawable(true);
-    texture_layer_->SetContentsOpaque(true);
+    SetContentsOpaque(opaque_);
 
     background_layer_->AddChild(texture_layer_);
   }
@@ -223,9 +266,9 @@ void BrowserPluginCompositingHelper::OnBuffersSwappedPrivate(
   // when a new buffer arrives.
   // Visually, this will either display a smaller part of the buffer
   // or introduce a gutter around it.
-  CheckSizeAndAdjustLayerBounds(mailbox.size,
-                                device_scale_factor,
-                                texture_layer_.get());
+  CheckSizeAndAdjustLayerProperties(mailbox.size,
+                                    device_scale_factor,
+                                    texture_layer_.get());
 
   bool is_software_frame = mailbox.type == SOFTWARE_COMPOSITOR_FRAME;
   bool current_mailbox_valid = is_software_frame ?
@@ -310,39 +353,80 @@ void BrowserPluginCompositingHelper::OnCompositorFrameSwapped(
       LOG(ERROR) << "Failed to map shared memory of size "
                  << size_in_bytes;
       // Send ACK right away.
-      ack_pending_ = true;
+      software_ack_pending_ = true;
       MailboxReleased(swap_info, 0, false);
+      DidCommitCompositorFrame();
       return;
     }
 
     swap_info.shared_memory = shared_memory.release();
     OnBuffersSwappedPrivate(swap_info, 0,
                             frame->metadata.device_scale_factor);
+    software_ack_pending_ = true;
+    last_route_id_ = route_id;
+    last_output_surface_id_ = output_surface_id;
+    last_host_id_ = host_id;
     return;
   }
 
   DCHECK(!texture_layer_.get());
-  if (!delegated_layer_.get()) {
-    delegated_layer_ = cc::DelegatedRendererLayer::Create(NULL);
-    delegated_layer_->SetIsDrawable(true);
-    delegated_layer_->SetContentsOpaque(true);
 
+  cc::DelegatedFrameData* frame_data = frame->delegated_frame_data.get();
+  // Do nothing if we are getting destroyed or have no frame data.
+  if (!frame_data || !background_layer_)
+    return;
+
+  DCHECK(!frame_data->render_pass_list.empty());
+  cc::RenderPass* root_pass = frame_data->render_pass_list.back();
+  gfx::Size frame_size = root_pass->output_rect.size();
+
+  if (last_route_id_ != route_id ||
+      last_output_surface_id_ != output_surface_id ||
+      last_host_id_ != host_id) {
+    // Resource ids are scoped by the output surface.
+    // If the originating output surface doesn't match the last one, it
+    // indicates the guest's output surface may have been recreated, in which
+    // case we should recreate the DelegatedRendererLayer, to avoid matching
+    // resources from the old one with resources from the new one which would
+    // have the same id.
+    frame_provider_ = NULL;
+
+    // Drop the cc::DelegatedFrameResourceCollection so that we will not return
+    // any resources from the old output surface with the new output surface id.
+    if (resource_collection_) {
+      resource_collection_->SetClient(NULL);
+
+      if (resource_collection_->LoseAllResources())
+        SendReturnedDelegatedResources();
+      resource_collection_ = NULL;
+    }
+    last_output_surface_id_ = output_surface_id;
+    last_route_id_ = route_id;
+    last_host_id_ = host_id;
+  }
+  if (!resource_collection_) {
+    resource_collection_ = new cc::DelegatedFrameResourceCollection;
+    resource_collection_->SetClient(this);
+  }
+  if (!frame_provider_.get() || frame_provider_->frame_size() != frame_size) {
+    frame_provider_ = new cc::DelegatedFrameProvider(
+        resource_collection_.get(), frame->delegated_frame_data.Pass());
+    if (delegated_layer_.get())
+      delegated_layer_->RemoveFromParent();
+    delegated_layer_ =
+        cc::DelegatedRendererLayer::Create(frame_provider_.get());
+    delegated_layer_->SetIsDrawable(true);
+    SetContentsOpaque(opaque_);
     background_layer_->AddChild(delegated_layer_);
+  } else {
+    frame_provider_->SetFrameData(frame->delegated_frame_data.Pass());
   }
 
-  cc::DelegatedFrameData *frame_data = frame->delegated_frame_data.get();
-  if (!frame_data)
-    return;
-
-  CheckSizeAndAdjustLayerBounds(
+  CheckSizeAndAdjustLayerProperties(
       frame_data->render_pass_list.back()->output_rect.size(),
       frame->metadata.device_scale_factor,
       delegated_layer_.get());
 
-  delegated_layer_->SetFrameData(frame->delegated_frame_data.Pass());
-  last_route_id_ = route_id;
-  last_output_surface_id_ = output_surface_id;
-  last_host_id_ = host_id;
   ack_pending_ = true;
 }
 
@@ -353,4 +437,57 @@ void BrowserPluginCompositingHelper::UpdateVisibility(bool visible) {
     delegated_layer_->SetIsDrawable(visible);
 }
 
+void BrowserPluginCompositingHelper::UnusedResourcesAreAvailable() {
+  if (ack_pending_)
+    return;
+
+  SendReturnedDelegatedResources();
+}
+
+void BrowserPluginCompositingHelper::SendReturnedDelegatedResources() {
+  cc::CompositorFrameAck ack;
+  if (resource_collection_)
+    resource_collection_->TakeUnusedResourcesForChildCompositor(&ack.resources);
+  DCHECK(!ack.resources.empty());
+
+  browser_plugin_manager_->Send(
+      new BrowserPluginHostMsg_ReclaimCompositorResources(
+          host_routing_id_,
+          instance_id_,
+          last_route_id_,
+          last_output_surface_id_,
+          last_host_id_,
+          ack));
+}
+
+void BrowserPluginCompositingHelper::SetContentsOpaque(bool opaque) {
+  opaque_ = opaque;
+
+  if (texture_layer_.get())
+    texture_layer_->SetContentsOpaque(opaque_);
+  if (delegated_layer_.get())
+    delegated_layer_->SetContentsOpaque(opaque_);
+}
+
+void BrowserPluginCompositingHelper::CopyFromCompositingSurfaceHasResult(
+    int request_id,
+    gfx::Size dest_size,
+    scoped_ptr<cc::CopyOutputResult> result) {
+  scoped_ptr<SkBitmap> bitmap;
+  if (result && result->HasBitmap() && !result->size().IsEmpty())
+    bitmap = result->TakeBitmap();
+
+  SkBitmap resized_bitmap;
+  if (bitmap) {
+    resized_bitmap = skia::ImageOperations::Resize(*bitmap,
+                       skia::ImageOperations::RESIZE_BEST,
+                       dest_size.width(),
+                       dest_size.height());
+  }
+  browser_plugin_manager_->Send(
+      new BrowserPluginHostMsg_CopyFromCompositingSurfaceAck(
+          host_routing_id_, instance_id_, request_id,
+          resized_bitmap));
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.h b/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.h
index 268a9b46259..7f9a473a619 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.h
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_compositing_helper.h
@@ -6,9 +6,11 @@
 #define  CONTENT_RENDERER_BROWSER_PLUGIN_BROWSER_PLUGIN_COMPOSITING_HELPER_H_
 
 #include <string>
+#include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "cc/layers/delegated_frame_resource_collection.h"
 #include "content/common/content_export.h"
 #include "gpu/command_buffer/common/mailbox.h"
 #include "ui/gfx/size.h"
@@ -19,28 +21,40 @@ class SharedMemory;
 
 namespace cc {
 class CompositorFrame;
+class CopyOutputResult;
 class Layer;
 class SolidColorLayer;
 class TextureLayer;
+class DelegatedFrameProvider;
+class DelegatedFrameResourceCollection;
 class DelegatedRendererLayer;
 }
 
-namespace WebKit {
+namespace blink {
 class WebPluginContainer;
 class WebLayer;
 }
 
+namespace gfx {
+class Rect;
+class Size;
+}
+
 namespace content {
 
 class BrowserPluginManager;
 
 class CONTENT_EXPORT BrowserPluginCompositingHelper :
-    public base::RefCounted<BrowserPluginCompositingHelper> {
+    public base::RefCounted<BrowserPluginCompositingHelper>,
+    public cc::DelegatedFrameResourceCollectionClient {
  public:
-  BrowserPluginCompositingHelper(WebKit::WebPluginContainer* container,
+  BrowserPluginCompositingHelper(blink::WebPluginContainer* container,
                                  BrowserPluginManager* manager,
                                  int instance_id,
                                  int host_routing_id);
+  void CopyFromCompositingSurface(int request_id,
+                                  gfx::Rect source_rect,
+                                  gfx::Size dest_size);
   void DidCommitCompositorFrame();
   void EnableCompositing(bool);
   void OnContainerDestroy();
@@ -54,6 +68,11 @@ class CONTENT_EXPORT BrowserPluginCompositingHelper :
                                 uint32 output_surface_id,
                                 int host_id);
   void UpdateVisibility(bool);
+
+  // cc::DelegatedFrameProviderClient implementation.
+  virtual void UnusedResourcesAreAvailable() OVERRIDE;
+  void SetContentsOpaque(bool);
+
  protected:
   // Friend RefCounted so that the dtor can be non-public.
   friend class base::RefCounted<BrowserPluginCompositingHelper>;
@@ -75,16 +94,22 @@ class CONTENT_EXPORT BrowserPluginCompositingHelper :
     unsigned software_frame_id;
     base::SharedMemory* shared_memory;
   };
-  ~BrowserPluginCompositingHelper();
-  void CheckSizeAndAdjustLayerBounds(const gfx::Size& new_size,
-                                     float device_scale_factor,
-                                     cc::Layer* layer);
+  virtual ~BrowserPluginCompositingHelper();
+  void CheckSizeAndAdjustLayerProperties(const gfx::Size& new_size,
+                                         float device_scale_factor,
+                                         cc::Layer* layer);
   void OnBuffersSwappedPrivate(const SwapBuffersInfo& mailbox,
                                unsigned sync_point,
                                float device_scale_factor);
   void MailboxReleased(SwapBuffersInfo mailbox,
                        unsigned sync_point,
                        bool lost_resource);
+  void SendReturnedDelegatedResources();
+  void CopyFromCompositingSurfaceHasResult(
+      int request_id,
+      gfx::Size dest_size,
+      scoped_ptr<cc::CopyOutputResult> result);
+
   int instance_id_;
   int host_routing_id_;
   int last_route_id_;
@@ -92,14 +117,20 @@ class CONTENT_EXPORT BrowserPluginCompositingHelper :
   int last_host_id_;
   bool last_mailbox_valid_;
   bool ack_pending_;
+  bool software_ack_pending_;
+  bool opaque_;
+  std::vector<unsigned> unacked_software_frames_;
 
   gfx::Size buffer_size_;
 
+  scoped_refptr<cc::DelegatedFrameResourceCollection> resource_collection_;
+  scoped_refptr<cc::DelegatedFrameProvider> frame_provider_;
+
   scoped_refptr<cc::SolidColorLayer> background_layer_;
   scoped_refptr<cc::TextureLayer> texture_layer_;
   scoped_refptr<cc::DelegatedRendererLayer> delegated_layer_;
-  scoped_ptr<WebKit::WebLayer> web_layer_;
-  WebKit::WebPluginContainer* container_;
+  scoped_ptr<blink::WebLayer> web_layer_;
+  blink::WebPluginContainer* container_;
 
   scoped_refptr<BrowserPluginManager> browser_plugin_manager_;
 };
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_manager.h b/chromium/content/renderer/browser_plugin/browser_plugin_manager.h
index 7e08a1ef4a9..8a57c3d5407 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_manager.h
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_manager.h
@@ -12,7 +12,7 @@
 #include "content/public/renderer/render_view_observer.h"
 #include "ipc/ipc_sender.h"
 
-namespace WebKit {
+namespace blink {
 class WebFrame;
 struct WebPluginParams;
 }
@@ -45,9 +45,7 @@ class CONTENT_EXPORT BrowserPluginManager
   // BrowserPluginManager via AddBrowserPlugin. When it is destroyed, it is
   // responsible for removing its association via RemoveBrowserPlugin.
   virtual BrowserPlugin* CreateBrowserPlugin(
-      RenderViewImpl* render_view,
-      WebKit::WebFrame* frame,
-      const WebKit::WebPluginParams& params) = 0;
+      RenderViewImpl* render_view, blink::WebFrame* frame) = 0;
 
   // Asynchronously requests a new browser-process-allocated instance ID.
   // After the browser process allocates an ID, it calls back into the
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.cc b/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.cc
index e7732f8afe9..542af453d35 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.cc
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.cc
@@ -24,9 +24,8 @@ BrowserPluginManagerImpl::~BrowserPluginManagerImpl() {
 
 BrowserPlugin* BrowserPluginManagerImpl::CreateBrowserPlugin(
     RenderViewImpl* render_view,
-    WebKit::WebFrame* frame,
-    const WebKit::WebPluginParams& params) {
-  return new BrowserPlugin(render_view, frame, params);
+    blink::WebFrame* frame) {
+  return new BrowserPlugin(render_view, frame);
 }
 
 void BrowserPluginManagerImpl::AllocateInstanceID(
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.h b/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.h
index 30ee72cfc98..a046995af63 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.h
+++ b/chromium/content/renderer/browser_plugin/browser_plugin_manager_impl.h
@@ -23,8 +23,7 @@ class BrowserPluginManagerImpl : public BrowserPluginManager {
   // BrowserPluginManager implementation.
   virtual BrowserPlugin* CreateBrowserPlugin(
       RenderViewImpl* render_view,
-      WebKit::WebFrame* frame,
-      const WebKit::WebPluginParams& params) OVERRIDE;
+      blink::WebFrame* frame) OVERRIDE;
   virtual void AllocateInstanceID(
       const base::WeakPtr<BrowserPlugin>& browser_plugin) OVERRIDE;
 
diff --git a/chromium/content/renderer/browser_plugin/mock_browser_plugin.cc b/chromium/content/renderer/browser_plugin/mock_browser_plugin.cc
index 39b2d2dc047..a19d0aa516e 100644
--- a/chromium/content/renderer/browser_plugin/mock_browser_plugin.cc
+++ b/chromium/content/renderer/browser_plugin/mock_browser_plugin.cc
@@ -8,9 +8,8 @@
 namespace content {
 
 MockBrowserPlugin::MockBrowserPlugin(RenderViewImpl* render_view,
-                                     WebKit::WebFrame* frame,
-                                     const WebKit::WebPluginParams& params)
-    : BrowserPlugin(render_view, frame, params) {
+                                     blink::WebFrame* frame)
+    : BrowserPlugin(render_view, frame) {
 }
 
 MockBrowserPlugin::~MockBrowserPlugin() {}
diff --git a/chromium/content/renderer/browser_plugin/mock_browser_plugin.h b/chromium/content/renderer/browser_plugin/mock_browser_plugin.h
index acd001b64ca..ee0f5542f9e 100644
--- a/chromium/content/renderer/browser_plugin/mock_browser_plugin.h
+++ b/chromium/content/renderer/browser_plugin/mock_browser_plugin.h
@@ -12,8 +12,7 @@ namespace content {
 class MockBrowserPlugin : public BrowserPlugin {
  public:
   MockBrowserPlugin(RenderViewImpl* render_view,
-                    WebKit::WebFrame* frame,
-                    const WebKit::WebPluginParams& params);
+                    blink::WebFrame* frame);
 
   virtual ~MockBrowserPlugin();
 
diff --git a/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.cc b/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.cc
index 9007f6e00e1..4a606862ef1 100644
--- a/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.cc
+++ b/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.cc
@@ -21,10 +21,8 @@ MockBrowserPluginManager::~MockBrowserPluginManager() {
 }
 
 BrowserPlugin* MockBrowserPluginManager::CreateBrowserPlugin(
-    RenderViewImpl* render_view,
-    WebKit::WebFrame* frame,
-    const WebKit::WebPluginParams& params) {
-  return new MockBrowserPlugin(render_view, frame, params);
+    RenderViewImpl* render_view, blink::WebFrame* frame) {
+  return new MockBrowserPlugin(render_view, frame);
 }
 
 void MockBrowserPluginManager::AllocateInstanceID(
diff --git a/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.h b/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.h
index 78ae0bef9b2..83d55a5d352 100644
--- a/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.h
+++ b/chromium/content/renderer/browser_plugin/mock_browser_plugin_manager.h
@@ -19,9 +19,7 @@ class MockBrowserPluginManager : public BrowserPluginManager {
 
   // BrowserPluginManager implementation.
   virtual BrowserPlugin* CreateBrowserPlugin(
-      RenderViewImpl* render_view,
-      WebKit::WebFrame* frame,
-      const WebKit::WebPluginParams& params) OVERRIDE;
+      RenderViewImpl* render_view, blink::WebFrame* frame) OVERRIDE;
   virtual void AllocateInstanceID(
       const base::WeakPtr<BrowserPlugin>& browser_plugin) OVERRIDE;