Update Chromium snapshot to stable version 33.0.1750.170

This is meant as a baseline commit hence it does not
include the patches we need to apply for QtWebEngine.
All patches should be rebased on top of this commit
so we can get rid of the external patches directory.
In future these baseline commits always have to include
the exact Chromium version returned by version_resolver.py's
currentVersion() in their first line, so that we can
retrieve the patches on top to apply on the upstream
repository. This also includes a ninja update.

Change-Id: I60abeadb785a3b7d149c58b65ddb5a823fed3083
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

171 files changed, 1593 insertions, 1084 deletions

diff --git a/chromium/base/atomicops_internals_arm_gcc.h b/chromium/base/atomicops_internals_arm_gcc.h
index 1964041b8a7..9f4fe2e586e 100644
--- a/chromium/base/atomicops_internals_arm_gcc.h
+++ b/chromium/base/atomicops_internals_arm_gcc.h
@@ -53,7 +53,7 @@ inline void MemoryBarrier() {
 #if defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__) || \
     defined(__ARM_ARCH_7R__) || defined(__ARM_ARCH_7M__) || \
     defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) || \
-    defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) || defined(__ARM_ARCH_6ZK__) || \
+    defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) || \
     defined(__ARM_ARCH_6KZ__) || defined(__ARM_ARCH_6T2__)
 
 inline Atomic32 NoBarrier_CompareAndSwap(volatile Atomic32* ptr,
diff --git a/chromium/base/base.gyp b/chromium/base/base.gyp
index b5af9d76e1a..407d49d0582 100644
--- a/chromium/base/base.gyp
+++ b/chromium/base/base.gyp
@@ -35,7 +35,7 @@
         ],
       },
       'conditions': [
-        ['desktop_linux == 1 or chromeos == 1 or qt_os == "embedded_linux"', {
+        ['desktop_linux == 1 or chromeos == 1', {
           'conditions': [
             ['chromeos==1', {
               'sources/': [ ['include', '_chromeos\\.cc$'] ]
diff --git a/chromium/base/base.gypi b/chromium/base/base.gypi
index 45d71802744..11edab00968 100644
--- a/chromium/base/base.gypi
+++ b/chromium/base/base.gypi
@@ -722,18 +722,6 @@
                 'atomicops_internals_x86_gcc.cc',
               ],
           }],
-          # We need to include xdg for embedded linux,
-          # but we indeed do not want atomicops for x86.
-          ['qt_os == "embedded_linux"', {
-              'sources/': [
-                ['include', '^nix/'],
-              ],
-          }],
-          ['use_qt==1 and target_arch=="ia32"', {
-              'sources/': [
-                ['include', 'atomicops_internals_x86_gcc.cc'],
-              ],
-          }],
           ['<(use_glib)==0 or >(nacl_untrusted_build)==1', {
               'sources!': [
                 'message_loop/message_pump_glib.cc',
diff --git a/chromium/base/callback_forward.h b/chromium/base/callback_forward.h
index 8538bb2488a..79832481af2 100644
--- a/chromium/base/callback_forward.h
+++ b/chromium/base/callback_forward.h
@@ -5,6 +5,13 @@
 #ifndef BASE_CALLBACK_FORWARD_H_
 #define BASE_CALLBACK_FORWARD_H_
 
-#include "base/callback.h"
+namespace base {
+
+template <typename Sig>
+class Callback;
+
+typedef Callback<void(void)> Closure;
+
+}  // namespace base
 
 #endif  // BASE_CALLBACK_FORWARD_H
diff --git a/chromium/base/message_loop/message_pump_gtk.cc b/chromium/base/message_loop/message_pump_gtk.cc
index 6023c1141ed..86d2415a412 100644
--- a/chromium/base/message_loop/message_pump_gtk.cc
+++ b/chromium/base/message_loop/message_pump_gtk.cc
@@ -79,9 +79,6 @@ void MessagePumpGtk::DispatchEvents(GdkEvent* event) {
   DidProcessEvent(event);
 }
 
-// FIXME: Get our own MessagePumpUI to avoid this.
-// Comment out this version so that our Qt version in shared_globals.cpp is used.
-/*
 // static
 Display* MessagePumpGtk::GetDefaultXDisplay() {
   static GdkDisplay* display = gdk_display_get_default();
@@ -93,7 +90,6 @@ Display* MessagePumpGtk::GetDefaultXDisplay() {
   }
   return GDK_DISPLAY_XDISPLAY(display);
 }
-*/
 
 void MessagePumpGtk::AddObserver(MessagePumpGdkObserver* observer) {
   observers_.AddObserver(observer);
diff --git a/chromium/base/message_loop/message_pump_x11.cc b/chromium/base/message_loop/message_pump_x11.cc
index 001775c5d00..35dcc040348 100644
--- a/chromium/base/message_loop/message_pump_x11.cc
+++ b/chromium/base/message_loop/message_pump_x11.cc
@@ -141,15 +141,12 @@ MessagePumpX11::~MessagePumpX11() {
   g_xdisplay = NULL;
 }
 
-#if !defined(TOOLKIT_QT)
-// Qt uses it's own version.
 // static
 Display* MessagePumpX11::GetDefaultXDisplay() {
   if (!g_xdisplay)
     g_xdisplay = XOpenDisplay(NULL);
   return g_xdisplay;
 }
-#endif
 
 #if defined(TOOLKIT_GTK)
 // static
diff --git a/chromium/base/platform_file_win.cc b/chromium/base/platform_file_win.cc
index 07b5c48c22b..b5e07d7665f 100644
--- a/chromium/base/platform_file_win.cc
+++ b/chromium/base/platform_file_win.cc
@@ -86,6 +86,20 @@ PlatformFile CreatePlatformFileUnsafe(const FilePath& name,
   HANDLE file = CreateFile(name.value().c_str(), access, sharing, NULL,
                            disposition, create_flags, NULL);
 
+  if (INVALID_HANDLE_VALUE != file){
+    // Don't allow directories to be opened without the proper flag (block ADS).
+    if (!(flags & PLATFORM_FILE_BACKUP_SEMANTICS)) {
+      BY_HANDLE_FILE_INFORMATION info = { 0 };
+      BOOL result = GetFileInformationByHandle(file, &info);
+      DCHECK(result);
+      if (info.dwFileAttributes & (FILE_ATTRIBUTE_DIRECTORY |
+                                   FILE_ATTRIBUTE_REPARSE_POINT)) {
+        CloseHandle(file);
+        file = INVALID_HANDLE_VALUE;
+      }
+    }
+  }
+
   if (created && (INVALID_HANDLE_VALUE != file)) {
     if (flags & (PLATFORM_FILE_OPEN_ALWAYS))
       *created = (ERROR_ALREADY_EXISTS != GetLastError());
diff --git a/chromium/base/process/process_iterator_mac.cc b/chromium/base/process/process_iterator_mac.cc
index e35c2ae19ba..29daa2d489f 100644
--- a/chromium/base/process/process_iterator_mac.cc
+++ b/chromium/base/process/process_iterator_mac.cc
@@ -7,7 +7,6 @@
 #include <errno.h>
 #include <sys/sysctl.h>
 #include <sys/types.h>
-#include <unistd.h>
 
 #include "base/logging.h"
 #include "base/strings/string_util.h"
diff --git a/chromium/base/run_loop.h b/chromium/base/run_loop.h
index 055b1b8146d..0dce6346e76 100644
--- a/chromium/base/run_loop.h
+++ b/chromium/base/run_loop.h
@@ -10,8 +10,6 @@
 #include "base/memory/weak_ptr.h"
 #include "base/message_loop/message_loop.h"
 
-class WebEngineContext;
-
 namespace base {
 #if defined(OS_ANDROID)
 class MessagePumpForUI;
@@ -78,7 +76,6 @@ class BASE_EXPORT RunLoop {
 
  private:
   friend class MessageLoop;
-  friend class ::WebEngineContext;
 #if defined(OS_ANDROID)
   // Android doesn't support the blocking MessageLoop::Run, so it calls
   // BeforeRun and AfterRun directly.
diff --git a/chromium/build/common.gypi b/chromium/build/common.gypi
index e975a96cd52..d7b385cc0ee 100644
--- a/chromium/build/common.gypi
+++ b/chromium/build/common.gypi
@@ -343,7 +343,7 @@
       # Run tools/clang/scripts/update.sh to make sure they are compiled.
       # This causes 'clang_chrome_plugins_flags' to be set.
       # Has no effect if 'clang' is not set as well.
-      'clang_use_chrome_plugins%': 0,
+      'clang_use_chrome_plugins%': 1,
 
       # Enable building with ASAN (Clang's -fsanitize=address option).
       # -fsanitize=address only works with clang, but asan=1 implies clang=1
@@ -1232,9 +1232,6 @@
     # rlz codes for searches but do not use the library.
     'enable_rlz%': 0,
 
-    # Compile with libc++ instead of libstdc++.
-    'use_libcpp%' : 0,
-
     # Turns on the i18n support in V8.
     'v8_enable_i18n_support': 1,
 
@@ -1515,10 +1512,10 @@
           # someplace that Xcode doesn't know about, set mac_sdk_path to the
           # path to the SDK; when set to a non-empty string, SDK detection
           # based on mac_sdk_min will be bypassed entirely.
-          'mac_sdk_min%': '10.7',
+          'mac_sdk_min%': '10.6',
           'mac_sdk_path%': '',
 
-          'mac_deployment_target%': '10.7',
+          'mac_deployment_target%': '10.6',
         },
 
         'mac_sdk_min': '<(mac_sdk_min)',
@@ -1528,7 +1525,6 @@
         # Compile in Breakpad support by default so that it can be
         # tested, even if it is not enabled by default at runtime.
         'mac_breakpad_compiled_in%': 1,
-
         'conditions': [
           # mac_product_name is set to the name of the .app bundle as it should
           # appear on disk.  This duplicates data from
@@ -2138,17 +2134,6 @@
       ['use_clipboard_aurax11==1', {
         'defines': ['USE_CLIPBOARD_AURAX11=1'],
       }],
-      ['use_libcpp==1', {
-        'defines': ['USE_UNORDERED_CONTAINERS=1'],
-        'cflags_cc': [
-          '-Wno-deprecated-declarations',
-          '-Wno-newline-eof',
-          '-Wno-unused-value',
-          '-Wno-unused-variable',
-          '-Wno-unused-function',
-          '-stdlib=libc++'
-        ],
-      }],
       ['enable_one_click_signin==1', {
         'defines': ['ENABLE_ONE_CLICK_SIGNIN'],
       }],
@@ -3350,7 +3335,7 @@
               # Clang considers the `register` keyword as deprecated, but e.g.
               # code generated by flex (used in angle) contains that keyword.
               # http://crbug.com/255186
-              '-Wno-deprecated',
+              '-Wno-deprecated-register',
             ],
             'cflags!': [
               # Clang doesn't seem to know know this flag.
@@ -4058,19 +4043,7 @@
                 # Clang considers the `register` keyword as deprecated, but e.g.
                 # code generated by flex (used in angle) contains that keyword.
                 # http://crbug.com/255186
-                '-Wno-deprecated',
-              ],
-            }],
-            ['use_libcpp==1', {
-              'OTHER_CPLUSPLUSFLAGS': ['-stdlib=libc++'],
-              'USE_LIBCPP': 'YES',
-              'WARNING_CFLAGS': [
-                '-Wno-deprecated-declarations',
-                '-Wno-newline-eof',
-                '-Wno-unused-value',
-                '-Wno-unused-variable',
-                '-Wno-unused-function',
-                '-Wno-header-hygiene',
+                '-Wno-deprecated-register',
               ],
             }],
             ['clang==1 and clang_use_chrome_plugins==1', {
diff --git a/chromium/build/linux/python_arch.sh b/chromium/build/linux/python_arch.sh
index e0f63bc6b04..3a41f94a980 100755
--- a/chromium/build/linux/python_arch.sh
+++ b/chromium/build/linux/python_arch.sh
@@ -11,9 +11,7 @@
 #
 
 file_out=$(file --dereference "$1")
-# The POSIX spec says that `file` should not exit(1) if the file does not
-# exist, so do our own -e check to catch things.
-if [ $? -ne 0 ] || [ ! -e "$1" ] ; then
+if [ $? -ne 0 ]; then
   echo unknown
   exit 0
 fi
diff --git a/chromium/build/linux/system.gyp b/chromium/build/linux/system.gyp
index 9911317e2fb..4a7e857efc1 100644
--- a/chromium/build/linux/system.gyp
+++ b/chromium/build/linux/system.gyp
@@ -29,7 +29,7 @@
         'use_system_ssl%': 1,
       },
     }],
-    [ 'chromeos==0 and use_qt==0', {
+    [ 'chromeos==0', {
       # Hide GTK and related dependencies for Chrome OS, so they won't get
       # added back to Chrome OS. Don't try to use GTK on Chrome OS.
       'targets': [
@@ -506,8 +506,6 @@
     {
       'target_name': 'libpci',
       'type': 'static_library',
-      'conditions': [
-      ['use_x11==1', {
       'cflags': [
         '<!@(<(pkg-config) --cflags libpci)',
       ],
@@ -568,8 +566,6 @@
           'process_outputs_as_sources': 1,
         },
       ],
-      }],
-      ],
     },
     {
       'target_name': 'libresolv',
@@ -664,8 +660,6 @@
       'type': 'none',
       'toolsets': ['host', 'target'],
       'conditions': [
-      ['use_pango==1', {
-      'conditions': [
         ['_toolset=="target"', {
           'direct_dependent_settings': {
             'cflags': [
@@ -696,8 +690,6 @@
           },
         }],
       ],
-      }],
-      ],
     },
     {
       'target_name': 'ssl',
diff --git a/chromium/build/util/LASTCHANGE b/chromium/build/util/LASTCHANGE
index b9510addb6c..8eb16b7d774 100644
--- a/chromium/build/util/LASTCHANGE
+++ b/chromium/build/util/LASTCHANGE
@@ -1 +1 @@
-LASTCHANGE=255236
+LASTCHANGE=258314
diff --git a/chromium/build/util/LASTCHANGE.blink b/chromium/build/util/LASTCHANGE.blink
index 2b43df4ca86..2193b4ba815 100644
--- a/chromium/build/util/LASTCHANGE.blink
+++ b/chromium/build/util/LASTCHANGE.blink
@@ -1 +1 @@
-LASTCHANGE=168543
+LASTCHANGE=169177
diff --git a/chromium/cc/base/util.h b/chromium/cc/base/util.h
index bd511786dca..1d716ae2a42 100644
--- a/chromium/cc/base/util.h
+++ b/chromium/cc/base/util.h
@@ -8,9 +8,6 @@
 #include <limits>
 
 #include "base/basictypes.h"
-#include "cc/resources/resource_provider.h"
-#include "third_party/khronos/GLES2/gl2.h"
-#include "third_party/khronos/GLES2/gl2ext.h"
 
 namespace cc {
 
@@ -27,36 +24,6 @@ template <typename T> T RoundDown(T n, T mul) {
                  : ((n - mul + 1) / mul) * mul;
 }
 
-inline GLenum GLDataType(ResourceFormat format) {
-  DCHECK_LE(format, RESOURCE_FORMAT_MAX);
-  static const unsigned format_gl_data_type[RESOURCE_FORMAT_MAX + 1] = {
-    GL_UNSIGNED_BYTE,           // RGBA_8888
-    GL_UNSIGNED_SHORT_4_4_4_4,  // RGBA_4444
-    GL_UNSIGNED_BYTE,           // BGRA_8888
-    GL_UNSIGNED_BYTE,           // LUMINANCE_8
-    GL_UNSIGNED_SHORT_5_6_5,    // RGB_565,
-    GL_UNSIGNED_BYTE            // ETC1
-  };
-  return format_gl_data_type[format];
-}
-
-inline GLenum GLDataFormat(ResourceFormat format) {
-  DCHECK_LE(format, RESOURCE_FORMAT_MAX);
-  static const unsigned format_gl_data_format[RESOURCE_FORMAT_MAX + 1] = {
-    GL_RGBA,           // RGBA_8888
-    GL_RGBA,           // RGBA_4444
-    GL_BGRA_EXT,       // BGRA_8888
-    GL_LUMINANCE,      // LUMINANCE_8
-    GL_RGB,            // RGB_565
-    GL_ETC1_RGB8_OES   // ETC1
-  };
-  return format_gl_data_format[format];
-}
-
-inline GLenum GLInternalFormat(ResourceFormat format) {
-  return GLDataFormat(format);
-}
-
 }  // namespace cc
 
 #endif  // CC_BASE_UTIL_H_
diff --git a/chromium/cc/layers/texture_layer.cc b/chromium/cc/layers/texture_layer.cc
index 5c954c140c2..195d05ddaba 100644
--- a/chromium/cc/layers/texture_layer.cc
+++ b/chromium/cc/layers/texture_layer.cc
@@ -13,8 +13,6 @@
 #include "cc/resources/single_release_callback.h"
 #include "cc/trees/blocking_task_runner.h"
 #include "cc/trees/layer_tree_host.h"
-#include "third_party/khronos/GLES2/gl2.h"
-#include "third_party/khronos/GLES2/gl2ext.h"
 
 namespace cc {
 
diff --git a/chromium/cc/output/delegating_renderer.cc b/chromium/cc/output/delegating_renderer.cc
index 1b5716160fa..c76f250754a 100644
--- a/chromium/cc/output/delegating_renderer.cc
+++ b/chromium/cc/output/delegating_renderer.cc
@@ -25,7 +25,6 @@
 #include "gpu/command_buffer/client/context_support.h"
 #include "gpu/command_buffer/common/gpu_memory_allocation.h"
 #include "third_party/WebKit/public/platform/WebGraphicsContext3D.h"
-#include "third_party/khronos/GLES2/gl2.h"
 #include "third_party/khronos/GLES2/gl2ext.h"
 
 using blink::WebGraphicsContext3D;
diff --git a/chromium/cc/output/gl_renderer.cc b/chromium/cc/output/gl_renderer.cc
index f0e32f43083..04db7b0609b 100644
--- a/chromium/cc/output/gl_renderer.cc
+++ b/chromium/cc/output/gl_renderer.cc
@@ -16,7 +16,6 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "build/build_config.h"
-#include "cc/base/util.h"
 #include "cc/base/math_util.h"
 #include "cc/layers/video_layer_impl.h"
 #include "cc/output/compositor_frame.h"
diff --git a/chromium/cc/quads/content_draw_quad_base.h b/chromium/cc/quads/content_draw_quad_base.h
index 6229d615ce1..cbf18ca2b15 100644
--- a/chromium/cc/quads/content_draw_quad_base.h
+++ b/chromium/cc/quads/content_draw_quad_base.h
@@ -8,6 +8,7 @@
 #include "base/memory/scoped_ptr.h"
 #include "cc/base/cc_export.h"
 #include "cc/quads/draw_quad.h"
+#include "third_party/khronos/GLES2/gl2.h"
 #include "ui/gfx/point.h"
 #include "ui/gfx/size.h"
 
diff --git a/chromium/cc/resources/resource_provider.h b/chromium/cc/resources/resource_provider.h
index 2478661d62c..6e5c61a2bfa 100644
--- a/chromium/cc/resources/resource_provider.h
+++ b/chromium/cc/resources/resource_provider.h
@@ -25,6 +25,8 @@
 #include "cc/resources/single_release_callback.h"
 #include "cc/resources/texture_mailbox.h"
 #include "cc/resources/transferable_resource.h"
+#include "third_party/khronos/GLES2/gl2.h"
+#include "third_party/khronos/GLES2/gl2ext.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "ui/gfx/size.h"
@@ -34,9 +36,6 @@ namespace gles {
 class GLES2Interface;
 }
 }
-// A correct fix would be not to use GL types in this interal API file.
-typedef unsigned int     GLenum;
-typedef int              GLint;
 
 namespace gfx {
 class Rect;
@@ -526,6 +525,36 @@ inline unsigned BitsPerPixel(ResourceFormat format) {
   return format_bits_per_pixel[format];
 }
 
+inline GLenum GLDataType(ResourceFormat format) {
+  DCHECK_LE(format, RESOURCE_FORMAT_MAX);
+  static const unsigned format_gl_data_type[RESOURCE_FORMAT_MAX + 1] = {
+    GL_UNSIGNED_BYTE,           // RGBA_8888
+    GL_UNSIGNED_SHORT_4_4_4_4,  // RGBA_4444
+    GL_UNSIGNED_BYTE,           // BGRA_8888
+    GL_UNSIGNED_BYTE,           // LUMINANCE_8
+    GL_UNSIGNED_SHORT_5_6_5,    // RGB_565,
+    GL_UNSIGNED_BYTE            // ETC1
+  };
+  return format_gl_data_type[format];
+}
+
+inline GLenum GLDataFormat(ResourceFormat format) {
+  DCHECK_LE(format, RESOURCE_FORMAT_MAX);
+  static const unsigned format_gl_data_format[RESOURCE_FORMAT_MAX + 1] = {
+    GL_RGBA,           // RGBA_8888
+    GL_RGBA,           // RGBA_4444
+    GL_BGRA_EXT,       // BGRA_8888
+    GL_LUMINANCE,      // LUMINANCE_8
+    GL_RGB,            // RGB_565
+    GL_ETC1_RGB8_OES   // ETC1
+  };
+  return format_gl_data_format[format];
+}
+
+inline GLenum GLInternalFormat(ResourceFormat format) {
+  return GLDataFormat(format);
+}
+
 }  // namespace cc
 
 #endif  // CC_RESOURCES_RESOURCE_PROVIDER_H_
diff --git a/chromium/cc/trees/layer_tree_impl.h b/chromium/cc/trees/layer_tree_impl.h
index 85a71f5cd72..2f27460fe04 100644
--- a/chromium/cc/trees/layer_tree_impl.h
+++ b/chromium/cc/trees/layer_tree_impl.h
@@ -14,7 +14,6 @@
 #include "cc/base/scoped_ptr_vector.h"
 #include "cc/base/swap_promise.h"
 #include "cc/layers/layer_impl.h"
-#include "cc/trees/layer_tree_host.h"
 #include "cc/resources/ui_resource_client.h"
 
 #if defined(COMPILER_GCC)
diff --git a/chromium/chrome/VERSION b/chromium/chrome/VERSION
index 2dd6ae2b0a3..671368857f3 100644
--- a/chromium/chrome/VERSION
+++ b/chromium/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=33
 MINOR=0
 BUILD=1750
-PATCH=149
+PATCH=170
diff --git a/chromium/content/browser/browser_main_loop.cc b/chromium/content/browser/browser_main_loop.cc
index c2787e08c72..1930bc083a7 100644
--- a/chromium/content/browser/browser_main_loop.cc
+++ b/chromium/content/browser/browser_main_loop.cc
@@ -654,7 +654,7 @@ int BrowserMainLoop::CreateThreads() {
             "BrowserMainLoop::CreateThreads:start",
             "Thread", "BrowserThread::FILE");
         thread_to_start = &file_thread_;
-#if defined(OS_WIN) && !defined(TOOLKIT_QT)
+#if defined(OS_WIN)
         // On Windows, the FILE thread needs to be have a UI message loop
         // which pumps messages in such a way that Google Update can
         // communicate back to us.
diff --git a/chromium/content/browser/devtools/worker_devtools_manager.cc b/chromium/content/browser/devtools/worker_devtools_manager.cc
index 983c55cfb2b..f0608815f33 100644
--- a/chromium/content/browser/devtools/worker_devtools_manager.cc
+++ b/chromium/content/browser/devtools/worker_devtools_manager.cc
@@ -51,6 +51,19 @@ base::LazyInstance<AgentHosts>::Leaky g_orphan_map = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
+struct WorkerDevToolsManager::TerminatedInspectedWorker {
+  TerminatedInspectedWorker(WorkerId id,
+                            const GURL& url,
+                            const base::string16& name)
+      : old_worker_id(id),
+        worker_url(url),
+        worker_name(name) {}
+  WorkerId old_worker_id;
+  GURL worker_url;
+  base::string16 worker_name;
+};
+
+
 class WorkerDevToolsManager::WorkerDevToolsAgentHost
     : public IPCDevToolsAgentHost {
  public:
@@ -189,6 +202,19 @@ class WorkerDevToolsManager::DetachedClientHosts {
   }
 };
 
+struct WorkerDevToolsManager::InspectedWorker {
+  InspectedWorker(WorkerProcessHost* host, int route_id, const GURL& url,
+                  const base::string16& name)
+      : host(host),
+        route_id(route_id),
+        worker_url(url),
+        worker_name(name) {}
+  WorkerProcessHost* const host;
+  int const route_id;
+  GURL worker_url;
+  base::string16 worker_name;
+};
+
 // static
 WorkerDevToolsManager* WorkerDevToolsManager::GetInstance() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
diff --git a/chromium/content/browser/devtools/worker_devtools_manager.h b/chromium/content/browser/devtools/worker_devtools_manager.h
index 955b1db5d47..8a9a7084226 100644
--- a/chromium/content/browser/devtools/worker_devtools_manager.h
+++ b/chromium/content/browser/devtools/worker_devtools_manager.h
@@ -54,20 +54,7 @@ class WorkerDevToolsManager {
  private:
   friend struct DefaultSingletonTraits<WorkerDevToolsManager>;
   class DetachedClientHosts;
-
-  struct InspectedWorker {
-    InspectedWorker(WorkerProcessHost* host, int route_id, const GURL& url,
-                    const base::string16& name)
-        : host(host),
-          route_id(route_id),
-          worker_url(url),
-          worker_name(name) {}
-    WorkerProcessHost* const host;
-    int const route_id;
-    GURL worker_url;
-    base::string16 worker_name;
-  };
-
+  struct InspectedWorker;
   typedef std::list<InspectedWorker> InspectedWorkersList;
 
   WorkerDevToolsManager();
@@ -97,16 +84,7 @@ class WorkerDevToolsManager {
 
   InspectedWorkersList inspected_workers_;
 
-  struct TerminatedInspectedWorker {
-    TerminatedInspectedWorker(WorkerId id, const GURL& url, const base::string16& name)
-        : old_worker_id(id),
-          worker_url(url),
-          worker_name(name) {}
-    WorkerId old_worker_id;
-    GURL worker_url;
-    base::string16 worker_name;
-  };
-
+  struct TerminatedInspectedWorker;
   typedef std::list<TerminatedInspectedWorker> TerminatedInspectedWorkers;
   // List of terminated workers for which there may be a devtools client on
   // the UI thread. Worker entry is added into this list when inspected worker
diff --git a/chromium/content/browser/gpu/gpu_process_host.cc b/chromium/content/browser/gpu/gpu_process_host.cc
index c28ba8b7499..1b7da1c8d7c 100644
--- a/chromium/content/browser/gpu/gpu_process_host.cc
+++ b/chromium/content/browser/gpu/gpu_process_host.cc
@@ -577,13 +577,7 @@ bool GpuProcessHost::Init() {
         switches::kDisableGpuWatchdog);
 
     in_process_gpu_thread_.reset(g_gpu_main_thread_factory(channel_id));
-#if defined(OS_WIN) && defined(TOOLKIT_QT)
-    base::Thread::Options options;
-    options.message_loop_type = base::MessageLoop::TYPE_DEFAULT;
-    in_process_gpu_thread_->StartWithOptions(options);
-#else
     in_process_gpu_thread_->Start();
-#endif
 
     OnProcessLaunched();  // Fake a callback that the process is ready.
   } else if (!LaunchGpuProcess(channel_id)) {
diff --git a/chromium/content/browser/media/webrtc_identity_store_backend.cc b/chromium/content/browser/media/webrtc_identity_store_backend.cc
index 697de93c927..d599dcda742 100644
--- a/chromium/content/browser/media/webrtc_identity_store_backend.cc
+++ b/chromium/content/browser/media/webrtc_identity_store_backend.cc
@@ -46,6 +46,43 @@ static bool InitDB(sql::Connection* db) {
       "creation_time INTEGER)");
 }
 
+struct WebRTCIdentityStoreBackend::IdentityKey {
+  IdentityKey(const GURL& origin, const std::string& identity_name)
+      : origin(origin), identity_name(identity_name) {}
+
+  bool operator<(const IdentityKey& other) const {
+    return origin < other.origin ||
+           (origin == other.origin && identity_name < other.identity_name);
+  }
+
+  GURL origin;
+  std::string identity_name;
+};
+
+struct WebRTCIdentityStoreBackend::Identity {
+  Identity(const std::string& common_name,
+           const std::string& certificate,
+           const std::string& private_key)
+      : common_name(common_name),
+        certificate(certificate),
+        private_key(private_key),
+        creation_time(base::Time::Now().ToInternalValue()) {}
+
+  Identity(const std::string& common_name,
+           const std::string& certificate,
+           const std::string& private_key,
+           int64 creation_time)
+      : common_name(common_name),
+        certificate(certificate),
+        private_key(private_key),
+        creation_time(creation_time) {}
+
+  std::string common_name;
+  std::string certificate;
+  std::string private_key;
+  int64 creation_time;
+};
+
 struct WebRTCIdentityStoreBackend::PendingFindRequest {
   PendingFindRequest(const GURL& origin,
                      const std::string& identity_name,
diff --git a/chromium/content/browser/media/webrtc_identity_store_backend.h b/chromium/content/browser/media/webrtc_identity_store_backend.h
index 9be3fc2345e..92b68b62d67 100644
--- a/chromium/content/browser/media/webrtc_identity_store_backend.h
+++ b/chromium/content/browser/media/webrtc_identity_store_backend.h
@@ -11,7 +11,8 @@
 #include "base/time/time.h"
 #include "sql/connection.h"
 #include "sql/meta_table.h"
-#include "url/gurl.h"
+
+class GURL;
 
 namespace base {
 class FilePath;
@@ -93,44 +94,7 @@ class WebRTCIdentityStoreBackend
   };
   struct PendingFindRequest;
   struct IdentityKey;
-
-  struct IdentityKey {
-    IdentityKey(const GURL& origin, const std::string& identity_name)
-        : origin(origin), identity_name(identity_name) {}
-
-    bool operator<(const IdentityKey& other) const {
-      return origin < other.origin ||
-             (origin == other.origin && identity_name < other.identity_name);
-    }
-
-    GURL origin;
-    std::string identity_name;
-  };
-
-  struct Identity {
-    Identity(const std::string& common_name,
-             const std::string& certificate,
-             const std::string& private_key)
-        : common_name(common_name),
-          certificate(certificate),
-          private_key(private_key),
-          creation_time(base::Time::Now().ToInternalValue()) {}
-
-    Identity(const std::string& common_name,
-             const std::string& certificate,
-             const std::string& private_key,
-             int64 creation_time)
-        : common_name(common_name),
-          certificate(certificate),
-          private_key(private_key),
-          creation_time(creation_time) {}
-
-    std::string common_name;
-    std::string certificate;
-    std::string private_key;
-    int64 creation_time;
-  };
-
+  struct Identity;
   typedef std::map<IdentityKey, Identity> IdentityMap;
 
   ~WebRTCIdentityStoreBackend();
diff --git a/chromium/content/browser/message_port_service.cc b/chromium/content/browser/message_port_service.cc
index 25c2b44200d..0d9f6084e86 100644
--- a/chromium/content/browser/message_port_service.cc
+++ b/chromium/content/browser/message_port_service.cc
@@ -9,6 +9,28 @@
 
 namespace content {
 
+struct MessagePortService::MessagePort {
+  // |filter| and |route_id| are what we need to send messages to the port.
+  // |filter| is just a weak pointer since we get notified when its process has
+  // gone away and remove it.
+  MessagePortMessageFilter* filter;
+  int route_id;
+  // A globally unique id for this message port.
+  int message_port_id;
+  // The globally unique id of the entangled message port.
+  int entangled_message_port_id;
+  // If true, all messages to this message port are queued and not delivered.
+  // This is needed so that when a message port is sent between processes all
+  // pending message get transferred. There are two possibilities for pending
+  // messages: either they are already received by the child process, or they're
+  // in-flight. This flag ensures that the latter type get flushed through the
+  // system.
+  // This flag should only be set to true in response to
+  // MessagePortHostMsg_QueueMessages.
+  bool queue_messages;
+  QueuedMessages queued_messages;
+};
+
 MessagePortService* MessagePortService::GetInstance() {
   return Singleton<MessagePortService>::get();
 }
diff --git a/chromium/content/browser/message_port_service.h b/chromium/content/browser/message_port_service.h
index 3e197a48aeb..668959167f7 100644
--- a/chromium/content/browser/message_port_service.h
+++ b/chromium/content/browser/message_port_service.h
@@ -64,28 +64,7 @@ class MessagePortService {
   // verify that the message port id exists.
   void Erase(int message_port_id);
 
-  struct MessagePort {
-    // |filter| and |route_id| are what we need to send messages to the port.
-    // |filter| is just a weak pointer since we get notified when its process has
-    // gone away and remove it.
-    MessagePortMessageFilter* filter;
-    int route_id;
-    // A globally unique id for this message port.
-    int message_port_id;
-    // The globally unique id of the entangled message port.
-    int entangled_message_port_id;
-    // If true, all messages to this message port are queued and not delivered.
-    // This is needed so that when a message port is sent between processes all
-    // pending message get transferred. There are two possibilities for pending
-    // messages: either they are already received by the child process, or they're
-    // in-flight. This flag ensures that the latter type get flushed through the
-    // system.
-    // This flag should only be set to true in response to
-    // MessagePortHostMsg_QueueMessages.
-    bool queue_messages;
-    QueuedMessages queued_messages;
-  };
-
+  struct MessagePort;
   typedef std::map<int, MessagePort> MessagePorts;
   MessagePorts message_ports_;
 
diff --git a/chromium/content/browser/renderer_host/clipboard_message_filter.cc b/chromium/content/browser/renderer_host/clipboard_message_filter.cc
index 6ba95f8f12c..bacce45dde4 100644
--- a/chromium/content/browser/renderer_host/clipboard_message_filter.cc
+++ b/chromium/content/browser/renderer_host/clipboard_message_filter.cc
@@ -31,6 +31,33 @@ void WriteObjectsOnUIThread(ui::Clipboard::ObjectMap* objects) {
   clipboard->WriteObjects(ui::CLIPBOARD_TYPE_COPY_PASTE, *objects);
 }
 
+enum BitmapPolicy {
+  kFilterBitmap,
+  kAllowBitmap,
+};
+void SanitizeObjectMap(ui::Clipboard::ObjectMap* objects,
+                       BitmapPolicy bitmap_policy) {
+  if (bitmap_policy != kAllowBitmap)
+    objects->erase(ui::Clipboard::CBF_SMBITMAP);
+
+  ui::Clipboard::ObjectMap::iterator data_it =
+      objects->find(ui::Clipboard::CBF_DATA);
+  if (data_it != objects->end()) {
+    const ui::Clipboard::FormatType& web_custom_format =
+        ui::Clipboard::GetWebCustomDataFormatType();
+    if (data_it->second.size() != 2 ||
+        !web_custom_format.Equals(
+            ui::Clipboard::FormatType::Deserialize(std::string(
+                &data_it->second[0].front(),
+                data_it->second[0].size())))) {
+      // CBF_DATA should always have two parameters associated with it, and the
+      // associated FormatType should always be web custom data. If not, then
+      // data is malformed and we'll ignore it.
+      objects->erase(ui::Clipboard::CBF_DATA);
+    }
+  }
+}
+
 }  // namespace
 
 
@@ -101,6 +128,7 @@ void ClipboardMessageFilter::OnWriteObjectsSync(
   // to the clipboard later.
   scoped_ptr<ui::Clipboard::ObjectMap> long_living_objects(
       new ui::Clipboard::ObjectMap(objects));
+  SanitizeObjectMap(long_living_objects.get(), kAllowBitmap);
   // Splice the shared memory handle into the data. |long_living_objects| now
   // contains a heap-allocated SharedMemory object that references
   // |bitmap_handle|. This reference will keep the shared memory section alive
@@ -123,7 +151,7 @@ void ClipboardMessageFilter::OnWriteObjectsAsync(
   // be removed otherwise we might dereference a rubbish pointer.
   scoped_ptr<ui::Clipboard::ObjectMap> sanitized_objects(
       new ui::Clipboard::ObjectMap(objects));
-  sanitized_objects->erase(ui::Clipboard::CBF_SMBITMAP);
+  SanitizeObjectMap(sanitized_objects.get(), kFilterBitmap);
 
 #if defined(OS_WIN)
   // We cannot write directly from the IO thread, and cannot service the IPC
diff --git a/chromium/content/browser/renderer_host/render_process_host_impl.cc b/chromium/content/browser/renderer_host/render_process_host_impl.cc
index b5a5c497106..5d975e9119d 100644
--- a/chromium/content/browser/renderer_host/render_process_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_impl.cc
@@ -512,7 +512,7 @@ bool RenderProcessHostImpl::Init() {
     in_process_renderer_.reset(g_renderer_main_thread_factory(channel_id));
 
     base::Thread::Options options;
-#if defined(OS_WIN) && !defined(OS_MACOSX) && !defined(TOOLKIT_QT)
+#if defined(OS_WIN) && !defined(OS_MACOSX)
     // In-process plugins require this to be a UI message loop.
     options.message_loop_type = base::MessageLoop::TYPE_UI;
 #else
diff --git a/chromium/content/browser/renderer_host/render_sandbox_host_linux.cc b/chromium/content/browser/renderer_host/render_sandbox_host_linux.cc
index f4e1cfc6e41..19cbc5b4b35 100644
--- a/chromium/content/browser/renderer_host/render_sandbox_host_linux.cc
+++ b/chromium/content/browser/renderer_host/render_sandbox_host_linux.cc
@@ -709,7 +709,7 @@ void RenderSandboxHostLinux::Init(const std::string& sandbox_path) {
   childs_lifeline_fd_ = pipefds[1];
 
   // We need to be monothreaded before we fork().
-#if !defined(TOOLKIT_GTK) && !defined(TOOLKIT_QT)
+#if !defined(TOOLKIT_GTK)
   // Exclude gtk port as TestSuite in base/tests/test_suite.cc is calling
   // gtk_init.
   // TODO(oshima): Remove ifdef when above issues are resolved.
diff --git a/chromium/content/browser/web_contents/web_contents_impl.cc b/chromium/content/browser/web_contents/web_contents_impl.cc
index ee5b901ddc8..6b6cf00819e 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl.cc
@@ -1464,7 +1464,7 @@ void WebContentsImpl::CreateNewWidget(int render_process_id,
   // Save the created widget associated with the route so we can show it later.
   pending_widget_views_[route_id] = widget_view;
 
-#if defined(OS_MACOSX) && !defined(TOOLKIT_QT)
+#if defined(OS_MACOSX)
   // A RenderWidgetHostViewMac has lifetime scoped to the view. We'll retain it
   // to allow it to survive the trip without being hosted.
   base::mac::NSObjectRetain(widget_view->GetNativeView());
@@ -1529,7 +1529,7 @@ void WebContentsImpl::ShowCreatedWidget(int route_id,
   // used to implement Pepper Flash fullscreen.
   render_widget_host_impl->set_allow_privileged_mouse_lock(is_fullscreen);
 
-#if defined(OS_MACOSX) && !defined(TOOLKIT_QT)
+#if defined(OS_MACOSX)
   // A RenderWidgetHostViewMac has lifetime scoped to the view. Now that it's
   // properly embedded (or purposefully ignored) we can release the retain we
   // took in CreateNewWidget().
diff --git a/chromium/content/common/child_process_host_impl.cc b/chromium/content/common/child_process_host_impl.cc
index 260749655a9..1467536ac91 100644
--- a/chromium/content/common/child_process_host_impl.cc
+++ b/chromium/content/common/child_process_host_impl.cc
@@ -107,7 +107,7 @@ base::FilePath ChildProcessHost::GetChildPath(int flags) {
   if (child_path.empty())
     PathService::Get(CHILD_PROCESS_EXE, &child_path);
 
-#if defined(OS_MACOSX) && 0
+#if defined(OS_MACOSX)
   DCHECK(!(flags & CHILD_NO_PIE && flags & CHILD_ALLOW_HEAP_EXECUTION));
 
   // If needed, choose an executable with special flags set that inform the
diff --git a/chromium/content/common/gpu/gpu_channel_manager.cc b/chromium/content/common/gpu/gpu_channel_manager.cc
index fe3f7b34f12..8b466bd0b2b 100644
--- a/chromium/content/common/gpu/gpu_channel_manager.cc
+++ b/chromium/content/common/gpu/gpu_channel_manager.cc
@@ -11,7 +11,6 @@
 #include "content/common/gpu/gpu_memory_manager.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/gpu/sync_point_manager.h"
-#include "content/public/browser/content_browser_client.h"
 #include "gpu/command_buffer/service/feature_info.h"
 #include "gpu/command_buffer/service/gpu_switches.h"
 #include "gpu/command_buffer/service/mailbox_manager.h"
@@ -125,12 +124,7 @@ void GpuChannelManager::OnEstablishChannel(int client_id, bool share_context) {
       DCHECK(!mailbox_manager_.get());
       mailbox_manager_ = new gpu::gles2::MailboxManager;
     }
-    // Qt: Ask the browser client at the top to manage the context sharing.
-    // This can only work with --in-process-gpu or --single-process.
-    if (GetContentClient()->browser() && GetContentClient()->browser()->GetInProcessGpuShareGroup())
-      share_group = GetContentClient()->browser()->GetInProcessGpuShareGroup();
-    else
-      share_group = share_group_.get();
+    share_group = share_group_.get();
     mailbox_manager = mailbox_manager_.get();
   }
 
diff --git a/chromium/content/common/gpu/gpu_channel_manager.h b/chromium/content/common/gpu/gpu_channel_manager.h
index 1ab04d94324..eb4d224d9b7 100644
--- a/chromium/content/common/gpu/gpu_channel_manager.h
+++ b/chromium/content/common/gpu/gpu_channel_manager.h
@@ -90,8 +90,6 @@ class GpuChannelManager : public IPC::Listener,
 
   gpu::gles2::ProgramCache* program_cache();
 
-  gpu::gles2::MailboxManager* mailbox_manager() { return mailbox_manager_.get(); }
-
   GpuMemoryManager* gpu_memory_manager() { return &gpu_memory_manager_; }
 
   GpuEventsDispatcher* gpu_devtools_events_dispatcher() {
diff --git a/chromium/content/common/gpu/gpu_messages.h b/chromium/content/common/gpu/gpu_messages.h
index 084b2d80676..936a8a020d3 100644
--- a/chromium/content/common/gpu/gpu_messages.h
+++ b/chromium/content/common/gpu/gpu_messages.h
@@ -116,12 +116,10 @@ IPC_STRUCT_BEGIN(GpuStreamTextureMsg_MatrixChanged_Params)
 IPC_STRUCT_END()
 #endif
 
-#if defined(OS_WIN)
-IPC_STRUCT_TRAITS_BEGIN(gpu::DxDiagNode)
+  IPC_STRUCT_TRAITS_BEGIN(gpu::DxDiagNode)
   IPC_STRUCT_TRAITS_MEMBER(values)
   IPC_STRUCT_TRAITS_MEMBER(children)
 IPC_STRUCT_TRAITS_END()
-#endif
 
 IPC_STRUCT_TRAITS_BEGIN(gpu::GpuPerformanceStats)
   IPC_STRUCT_TRAITS_MEMBER(graphics)
diff --git a/chromium/content/common/plugin_list_posix.cc b/chromium/content/common/plugin_list_posix.cc
index 0e822767c02..acd7830f738 100644
--- a/chromium/content/common/plugin_list_posix.cc
+++ b/chromium/content/common/plugin_list_posix.cc
@@ -151,7 +151,6 @@ bool IsUndesirablePlugin(const WebPluginInfo& info) {
 // http://code.google.com/p/chromium/issues/detail?id=38229
 bool IsBlacklistedPlugin(const base::FilePath& path) {
   const char* kBlackListedPlugins[] = {
-    "skypebuttons.so",    // Crash on dlopen since it uses Qt4
     "nppdf.so",           // Adobe PDF
   };
   std::string filename = path.BaseName().value();
diff --git a/chromium/content/content_browser.gypi b/chromium/content/content_browser.gypi
index 28878f77e47..99cc728c4ea 100644
--- a/chromium/content/content_browser.gypi
+++ b/chromium/content/content_browser.gypi
@@ -1323,7 +1323,6 @@
       'dependencies': [
         'browser/devtools/devtools_resources.gyp:devtools_resources',
         '../cc/cc.gyp:cc',
-        '../gpu/gpu.gyp:gpu_ipc',
         '../net/net.gyp:http_server',
         '../third_party/leveldatabase/leveldatabase.gyp:leveldatabase',
         '../ui/surface/surface.gyp:surface',
@@ -1548,7 +1547,7 @@
         ['exclude', '^browser/gamepad/gamepad_platform_data_fetcher_linux\\.cc$'],
       ],
     }],
-    ['use_aura!=1 and use_qt!=1 and OS!="win"', {
+    ['use_aura!=1 and OS!="win"', {
       'sources!': [
         'browser/renderer_host/ui_events_helper.cc',
         'browser/renderer_host/ui_events_helper.h',
diff --git a/chromium/content/gpu/gpu_child_thread.cc b/chromium/content/gpu/gpu_child_thread.cc
index a84a9e0a436..170b3648b56 100644
--- a/chromium/content/gpu/gpu_child_thread.cc
+++ b/chromium/content/gpu/gpu_child_thread.cc
@@ -40,8 +40,6 @@ bool GpuProcessLogMessageHandler(int severity,
 
 }  // namespace
 
-GpuChildThread* GpuChildThread::instance_ = 0;
-
 GpuChildThread::GpuChildThread(GpuWatchdogThread* watchdog_thread,
                                bool dead_on_arrival,
                                const gpu::GPUInfo& gpu_info,
@@ -55,8 +53,6 @@ GpuChildThread::GpuChildThread(GpuWatchdogThread* watchdog_thread,
   target_services_ = NULL;
 #endif
   g_thread_safe_sender.Get() = thread_safe_sender();
-
-  instance_ = this;
 }
 
 GpuChildThread::GpuChildThread(const std::string& channel_id)
@@ -75,8 +71,6 @@ GpuChildThread::GpuChildThread(const std::string& channel_id)
     VLOG(1) << "gfx::GLSurface::InitializeOneOff()";
   }
   g_thread_safe_sender.Get() = thread_safe_sender();
-
-  instance_ = this;
 }
 
 GpuChildThread::~GpuChildThread() {
diff --git a/chromium/content/gpu/gpu_child_thread.h b/chromium/content/gpu/gpu_child_thread.h
index 82bb32a67aa..ff0c9258cd1 100644
--- a/chromium/content/gpu/gpu_child_thread.h
+++ b/chromium/content/gpu/gpu_child_thread.h
@@ -56,10 +56,6 @@ class GpuChildThread : public ChildThread {
   virtual bool Send(IPC::Message* msg) OVERRIDE;
   virtual bool OnControlMessageReceived(const IPC::Message& msg) OVERRIDE;
 
-  GpuChannelManager* ChannelManager() const { return gpu_channel_manager_.get(); }
-
-  static GpuChildThread* instance() { return instance_; }
-
  private:
   // Message handlers.
   void OnInitialize();
@@ -98,8 +94,6 @@ class GpuChildThread : public ChildThread {
   // Whether the GPU thread is running in the browser process.
   bool in_browser_process_;
 
-  static GpuChildThread* instance_;
-
   DISALLOW_COPY_AND_ASSIGN(GpuChildThread);
 };
 
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index 639998fa5d9..8633105ed1a 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -45,7 +45,6 @@ class FilePath;
 }
 
 namespace gfx {
-class GLShareGroup;
 class ImageSkia;
 }
 
@@ -583,10 +582,6 @@ class CONTENT_EXPORT ContentBrowserClient {
   // information.
   virtual VibrationProvider* OverrideVibrationProvider();
 
-  // Allow an embedder to provide a share group reimplementation to connect renderer
-  // GL contexts with the root compositor.
-  virtual gfx::GLShareGroup* GetInProcessGpuShareGroup() { return 0; }
-
 #if defined(OS_POSIX) && !defined(OS_MACOSX)
   // Populates |mappings| with all files that need to be mapped before launching
   // a child process.
diff --git a/chromium/content/renderer/gpu/mailbox_output_surface.cc b/chromium/content/renderer/gpu/mailbox_output_surface.cc
index b23575da9ac..09e1ec0f7ac 100644
--- a/chromium/content/renderer/gpu/mailbox_output_surface.cc
+++ b/chromium/content/renderer/gpu/mailbox_output_surface.cc
@@ -5,7 +5,6 @@
 #include "content/renderer/gpu/mailbox_output_surface.h"
 
 #include "base/logging.h"
-#include "cc/base/util.h"
 #include "cc/output/compositor_frame.h"
 #include "cc/output/compositor_frame_ack.h"
 #include "cc/output/gl_frame_data.h"
diff --git a/chromium/content/renderer/media/media_stream_dispatcher.cc b/chromium/content/renderer/media/media_stream_dispatcher.cc
index 96f92fbfa9c..6890ffc5d6f 100644
--- a/chromium/content/renderer/media/media_stream_dispatcher.cc
+++ b/chromium/content/renderer/media/media_stream_dispatcher.cc
@@ -30,6 +30,37 @@ bool RemoveStreamDeviceFromArray(const StreamDeviceInfo device_info,
 
 }  // namespace
 
+// A request is identified by pair (request_id, handler), or ipc_request.
+// There could be multiple clients making requests and each has its own
+// request_id sequence.
+// The ipc_request is garanteed to be unique when it's created in
+// MediaStreamDispatcher.
+struct MediaStreamDispatcher::Request {
+  Request(const base::WeakPtr<MediaStreamDispatcherEventHandler>& handler,
+          int request_id,
+          int ipc_request)
+      : handler(handler),
+        request_id(request_id),
+        ipc_request(ipc_request) {
+  }
+  bool IsThisRequest(
+      int request_id1,
+      const base::WeakPtr<MediaStreamDispatcherEventHandler>& handler1) {
+    return (request_id1 == request_id && handler1.get() == handler.get());
+  }
+  base::WeakPtr<MediaStreamDispatcherEventHandler> handler;
+  int request_id;
+  int ipc_request;
+};
+
+struct MediaStreamDispatcher::Stream {
+  Stream() {}
+  ~Stream() {}
+  base::WeakPtr<MediaStreamDispatcherEventHandler> handler;
+  StreamDeviceInfoArray audio_array;
+  StreamDeviceInfoArray video_array;
+};
+
 MediaStreamDispatcher::MediaStreamDispatcher(RenderViewImpl* render_view)
     : RenderViewObserver(render_view),
       main_loop_(base::MessageLoopProxy::current()),
diff --git a/chromium/content/renderer/media/media_stream_dispatcher.h b/chromium/content/renderer/media/media_stream_dispatcher.h
index 4c08958488a..89d7c0daafa 100644
--- a/chromium/content/renderer/media/media_stream_dispatcher.h
+++ b/chromium/content/renderer/media/media_stream_dispatcher.h
@@ -99,38 +99,11 @@ class CONTENT_EXPORT MediaStreamDispatcher
   FRIEND_TEST_ALL_PREFIXES(MediaStreamDispatcherTest, TestFailure);
   FRIEND_TEST_ALL_PREFIXES(MediaStreamDispatcherTest, CancelGenerateStream);
 
-  // A request is identified by pair (request_id, handler), or ipc_request.
-  // There could be multiple clients making requests and each has its own
-  // request_id sequence.
-  // The ipc_request is garanteed to be unique when it's created in
-  // MediaStreamDispatcher.
-  struct Request {
-    Request(const base::WeakPtr<MediaStreamDispatcherEventHandler>& handler,
-            int request_id,
-            int ipc_request)
-        : handler(handler),
-          request_id(request_id),
-          ipc_request(ipc_request) {
-    }
-    bool IsThisRequest(
-        int request_id1,
-        const base::WeakPtr<MediaStreamDispatcherEventHandler>& handler1) {
-      return (request_id1 == request_id && handler1.get() == handler.get());
-    }
-    base::WeakPtr<MediaStreamDispatcherEventHandler> handler;
-    int request_id;
-    int ipc_request;
-  };
+  struct Request;
 
   // Private class for keeping track of opened devices and who have
   // opened it.
-  struct Stream {
-    Stream() {}
-    ~Stream() {}
-    base::WeakPtr<MediaStreamDispatcherEventHandler> handler;
-    StreamDeviceInfoArray audio_array;
-    StreamDeviceInfoArray video_array;
-  };
+  struct Stream;
 
   // RenderViewObserver OVERRIDE.
   virtual bool Send(IPC::Message* message) OVERRIDE;
diff --git a/chromium/content/renderer/npapi/webplugin_delegate_proxy.cc b/chromium/content/renderer/npapi/webplugin_delegate_proxy.cc
index a6418fb5a8f..d7f847240b0 100644
--- a/chromium/content/renderer/npapi/webplugin_delegate_proxy.cc
+++ b/chromium/content/renderer/npapi/webplugin_delegate_proxy.cc
@@ -6,7 +6,7 @@
 
 #if defined(TOOLKIT_GTK)
 #include <gtk/gtk.h>
-#elif defined(USE_CAIRO)
+#elif defined(USE_X11)
 #include <cairo/cairo.h>
 #endif
 
diff --git a/chromium/content/renderer/pepper/message_channel.cc b/chromium/content/renderer/pepper/message_channel.cc
index 7c5961cfbe2..51132a6dc42 100644
--- a/chromium/content/renderer/pepper/message_channel.cc
+++ b/chromium/content/renderer/pepper/message_channel.cc
@@ -292,6 +292,18 @@ NPClass message_channel_class = {
 }  // namespace
 
 // MessageChannel --------------------------------------------------------------
+struct MessageChannel::VarConversionResult {
+  VarConversionResult(const ppapi::ScopedPPVar& r, bool s)
+      : result(r),
+        success(s),
+        conversion_completed(true) {}
+  VarConversionResult()
+      : success(false),
+        conversion_completed(false) {}
+  ppapi::ScopedPPVar result;
+  bool success;
+  bool conversion_completed;
+};
 
 MessageChannel::MessageChannelNPObject::MessageChannelNPObject() {
 }
diff --git a/chromium/content/renderer/pepper/message_channel.h b/chromium/content/renderer/pepper/message_channel.h
index 43aa0f95a62..e0020e688c1 100644
--- a/chromium/content/renderer/pepper/message_channel.h
+++ b/chromium/content/renderer/pepper/message_channel.h
@@ -11,12 +11,15 @@
 
 #include "base/memory/weak_ptr.h"
 #include "ppapi/shared_impl/resource.h"
-#include "ppapi/shared_impl/scoped_pp_var.h"
 #include "third_party/WebKit/public/web/WebSerializedScriptValue.h"
 #include "third_party/npapi/bindings/npruntime.h"
 
 struct PP_Var;
 
+namespace ppapi {
+class ScopedPPVar;
+}
+
 namespace content {
 
 class PepperPluginInstanceImpl;
@@ -87,18 +90,7 @@ class MessageChannel {
 
  private:
   // Struct for storing the result of a NPVariant being converted to a PP_Var.
-  struct VarConversionResult {
-    VarConversionResult(const ppapi::ScopedPPVar& r, bool s)
-        : result(r),
-          success(s),
-          conversion_completed(true) {}
-    VarConversionResult()
-        : success(false),
-          conversion_completed(false) {}
-    ppapi::ScopedPPVar result;
-    bool success;
-    bool conversion_completed;
-  };
+  struct VarConversionResult;
 
   // This is called when an NPVariant is finished being converted.
   // |result_iteartor| is an iterator into |converted_var_queue_| where the
diff --git a/chromium/content/renderer/pepper/pepper_platform_context_3d.cc b/chromium/content/renderer/pepper/pepper_platform_context_3d.cc
index b9fd07b67d5..6c3408bd429 100644
--- a/chromium/content/renderer/pepper/pepper_platform_context_3d.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_context_3d.cc
@@ -107,6 +107,7 @@ bool PlatformContext3D::Init(const int32* attrib_list,
   if (!command_buffer_->ProduceFrontBuffer(names[0]))
     return false;
   mailbox_ = names[0];
+  sync_point_ = command_buffer_->InsertSyncPoint();
 
   command_buffer_->SetChannelErrorCallback(
       base::Bind(&PlatformContext3D::OnContextLost,
@@ -118,8 +119,15 @@ bool PlatformContext3D::Init(const int32* attrib_list,
   return true;
 }
 
-void PlatformContext3D::GetBackingMailbox(gpu::Mailbox* mailbox) {
+void PlatformContext3D::GetBackingMailbox(gpu::Mailbox* mailbox,
+                                          uint32* sync_point) {
   *mailbox = mailbox_;
+  *sync_point = sync_point_;
+}
+
+void PlatformContext3D::InsertSyncPointForBackingMailbox() {
+  DCHECK(command_buffer_);
+  sync_point_ = command_buffer_->InsertSyncPoint();
 }
 
 bool PlatformContext3D::IsOpaque() {
diff --git a/chromium/content/renderer/pepper/pepper_platform_context_3d.h b/chromium/content/renderer/pepper/pepper_platform_context_3d.h
index 2520bbd65da..dcd42caa611 100644
--- a/chromium/content/renderer/pepper/pepper_platform_context_3d.h
+++ b/chromium/content/renderer/pepper/pepper_platform_context_3d.h
@@ -31,7 +31,11 @@ class PlatformContext3D {
   bool Init(const int32* attrib_list, PlatformContext3D* share_context);
 
   // Retrieves the mailbox name for the front buffer backing the context.
-  void GetBackingMailbox(gpu::Mailbox* mailbox);
+  void GetBackingMailbox(gpu::Mailbox* mailbox, uint32* sync_point);
+
+  // Inserts a new sync point to associate with the backing mailbox, that should
+  // be waited on before using the mailbox.
+  void InsertSyncPointForBackingMailbox();
 
   // Returns true if the backing texture is always opaque.
   bool IsOpaque();
@@ -68,6 +72,7 @@ class PlatformContext3D {
 
   scoped_refptr<GpuChannelHost> channel_;
   gpu::Mailbox mailbox_;
+  uint32 sync_point_;
   bool has_alpha_;
   CommandBufferProxyImpl* command_buffer_;
   base::Closure context_lost_callback_;
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
index c6d6582132c..405d6ceb4c4 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -700,9 +700,21 @@ void PepperPluginInstanceImpl::ScrollRect(int dx,
   }
 }
 
+static void IgnoreCallback(unsigned, bool) {}
+
 void PepperPluginInstanceImpl::CommitBackingTexture() {
-  if (texture_layer_.get())
-    texture_layer_->SetNeedsDisplay();
+  if (!texture_layer_.get())
+    return;
+  PlatformContext3D* context = bound_graphics_3d_->platform_context();
+  gpu::Mailbox mailbox;
+  uint32 sync_point = 0;
+  context->GetBackingMailbox(&mailbox, &sync_point);
+  DCHECK(!mailbox.IsZero());
+  DCHECK_NE(sync_point, 0u);
+  texture_layer_->SetTextureMailbox(
+      cc::TextureMailbox(mailbox, sync_point),
+      cc::SingleReleaseCallback::Create(base::Bind(&IgnoreCallback)));
+  texture_layer_->SetNeedsDisplay();
 }
 
 void PepperPluginInstanceImpl::InstanceCrashed() {
@@ -1857,16 +1869,16 @@ bool PepperPluginInstanceImpl::PrintPDFOutput(PP_Resource print_output,
 #endif
 }
 
-static void IgnoreCallback(unsigned, bool) {}
-
 void PepperPluginInstanceImpl::UpdateLayer() {
   if (!container_)
     return;
 
   gpu::Mailbox mailbox;
+  uint32 sync_point = 0;
   if (bound_graphics_3d_.get()) {
     PlatformContext3D* context = bound_graphics_3d_->platform_context();
-    context->GetBackingMailbox(&mailbox);
+    context->GetBackingMailbox(&mailbox, &sync_point);
+    DCHECK_EQ(mailbox.IsZero(), sync_point == 0);
   }
   bool want_3d_layer = !mailbox.IsZero();
   bool want_2d_layer = bound_graphics_2d_platform_ &&
@@ -1895,7 +1907,7 @@ void PepperPluginInstanceImpl::UpdateLayer() {
       texture_layer_ = cc::TextureLayer::CreateForMailbox(NULL);
       opaque = bound_graphics_3d_->IsOpaque();
       texture_layer_->SetTextureMailbox(
-          cc::TextureMailbox(mailbox, 0),
+          cc::TextureMailbox(mailbox, sync_point),
           cc::SingleReleaseCallback::Create(base::Bind(&IgnoreCallback)));
     } else {
       DCHECK(bound_graphics_2d_platform_);
diff --git a/chromium/content/renderer/pepper/ppb_graphics_3d_impl.cc b/chromium/content/renderer/pepper/ppb_graphics_3d_impl.cc
index 1564279f7b4..989b9994395 100644
--- a/chromium/content/renderer/pepper/ppb_graphics_3d_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_graphics_3d_impl.cc
@@ -197,6 +197,10 @@ int32 PPB_Graphics3D_Impl::DoSwapBuffers() {
   if (gles2_impl())
     gles2_impl()->SwapBuffers();
 
+  // Since the backing texture has been updated, a new sync point should be
+  // inserted.
+  platform_context_->InsertSyncPointForBackingMailbox();
+
   if (bound_to_instance_) {
     // If we are bound to the instance, we need to ask the compositor
     // to commit our backing texture so that the graphics appears on the page.
diff --git a/chromium/content/renderer/render_thread_impl.cc b/chromium/content/renderer/render_thread_impl.cc
index 609b965f468..e910b8bf80d 100644
--- a/chromium/content/renderer/render_thread_impl.cc
+++ b/chromium/content/renderer/render_thread_impl.cc
@@ -314,7 +314,7 @@ void RenderThreadImpl::Init() {
   v8::V8::SetCreateHistogramFunction(CreateHistogram);
   v8::V8::SetAddHistogramSampleFunction(AddHistogramSample);
 
-#if (defined(OS_MACOSX) || defined(OS_ANDROID)) && !defined(TOOLKIT_QT)
+#if defined(OS_MACOSX) || defined(OS_ANDROID)
   // On Mac and Android, the select popups are rendered by the browser.
   blink::WebView::setUseExternalPopupMenus(true);
 #endif
diff --git a/chromium/content/renderer/renderer_main.cc b/chromium/content/renderer/renderer_main.cc
index 5330d21a564..63c72ae934b 100644
--- a/chromium/content/renderer/renderer_main.cc
+++ b/chromium/content/renderer/renderer_main.cc
@@ -161,8 +161,6 @@ int RendererMain(const MainFunctionParams& parameters) {
   // As long as we use Cocoa in the renderer (for the forseeable future as of
   // now; see http://crbug.com/306348 for info) we need to have a UI loop.
   base::MessageLoop main_message_loop(base::MessageLoop::TYPE_UI);
-#elif defined(OS_WIN) && defined(TOOLKIT_QT)
-  base::MessageLoop main_message_loop(base::MessageLoop::TYPE_DEFAULT);
 #else
   // The main message loop of the renderer services doesn't have IO or UI tasks,
   // unless in-process-plugins is used.
@@ -225,6 +223,7 @@ int RendererMain(const MainFunctionParams& parameters) {
     if (!no_sandbox) {
       run_loop = platform.EnableSandbox();
     } else {
+      LOG(ERROR) << "Running without renderer sandbox";
 #ifndef NDEBUG
       // For convenience, we print the stack trace for crashes. We can't get
       // symbols when the sandbox is enabled, so only try when the sandbox is
diff --git a/chromium/content/renderer/renderer_webcolorchooser_impl.h b/chromium/content/renderer/renderer_webcolorchooser_impl.h
index d7534788738..0fa608f4359 100644
--- a/chromium/content/renderer/renderer_webcolorchooser_impl.h
+++ b/chromium/content/renderer/renderer_webcolorchooser_impl.h
@@ -36,6 +36,11 @@ class RendererWebColorChooserImpl : public blink::WebColorChooser,
 
   blink::WebColorChooserClient* client() { return client_; }
 
+  // Don't destroy the RendererWebColorChooserImpl when the RenderViewImpl goes
+  // away. RendererWebColorChooserImpl is owned by
+  // blink::ColorChooserUIController.
+  virtual void OnDestruct() OVERRIDE {}
+
  private:
   // RenderViewObserver implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
diff --git a/chromium/content/zygote/zygote_main_linux.cc b/chromium/content/zygote/zygote_main_linux.cc
index 2e5cc7e98d5..8e91c2f17e5 100644
--- a/chromium/content/zygote/zygote_main_linux.cc
+++ b/chromium/content/zygote/zygote_main_linux.cc
@@ -181,6 +181,8 @@ static void InitLibcLocaltimeFunctions() {
 // references to localtime() will resolve to this function. Notice that we need
 // to set visibility attribute to "default" to export the symbol, as it is set
 // to "hidden" by default in chrome per build/common.gypi.
+__attribute__ ((__visibility__("default")))
+struct tm* localtime_override(const time_t* timep) __asm__ ("localtime");
 
 __attribute__ ((__visibility__("default")))
 struct tm* localtime_override(const time_t* timep) {
@@ -197,6 +199,10 @@ struct tm* localtime_override(const time_t* timep) {
   }
 }
 
+// Use same trick to override localtime64(), localtime_r() and localtime64_r().
+__attribute__ ((__visibility__("default")))
+struct tm* localtime64_override(const time_t* timep) __asm__ ("localtime64");
+
 __attribute__ ((__visibility__("default")))
 struct tm* localtime64_override(const time_t* timep) {
   if (g_am_zygote_or_renderer) {
@@ -213,6 +219,10 @@ struct tm* localtime64_override(const time_t* timep) {
 }
 
 __attribute__ ((__visibility__("default")))
+struct tm* localtime_r_override(const time_t* timep,
+                                struct tm* result) __asm__ ("localtime_r");
+
+__attribute__ ((__visibility__("default")))
 struct tm* localtime_r_override(const time_t* timep, struct tm* result) {
   if (g_am_zygote_or_renderer) {
     ProxyLocaltimeCallToBrowser(*timep, result, NULL, 0);
@@ -225,6 +235,10 @@ struct tm* localtime_r_override(const time_t* timep, struct tm* result) {
 }
 
 __attribute__ ((__visibility__("default")))
+struct tm* localtime64_r_override(const time_t* timep,
+                                  struct tm* result) __asm__ ("localtime64_r");
+
+__attribute__ ((__visibility__("default")))
 struct tm* localtime64_r_override(const time_t* timep, struct tm* result) {
   if (g_am_zygote_or_renderer) {
     ProxyLocaltimeCallToBrowser(*timep, result, NULL, 0);
diff --git a/chromium/gpu/command_buffer/service/query_manager.cc b/chromium/gpu/command_buffer/service/query_manager.cc
index 85e273c6c3a..db508e0a7f7 100644
--- a/chromium/gpu/command_buffer/service/query_manager.cc
+++ b/chromium/gpu/command_buffer/service/query_manager.cc
@@ -98,6 +98,9 @@ bool AsyncPixelTransfersCompletedQuery::End(uint32 submit_count) {
   mem_params.shm_size = buffer.size;
   mem_params.shm_data_offset = shm_offset();
   mem_params.shm_data_size = sizeof(QuerySync);
+  uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size;
+  if (end > mem_params.shm_size || end < mem_params.shm_data_offset)
+    return false;
 
   observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count);
 
diff --git a/chromium/gpu/command_buffer_client.gypi b/chromium/gpu/command_buffer_client.gypi
index 827474cfda0..cb52ee75fb3 100644
--- a/chromium/gpu/command_buffer_client.gypi
+++ b/chromium/gpu/command_buffer_client.gypi
@@ -14,9 +14,6 @@
   'dependencies': [
     '../third_party/khronos/khronos.gyp:khronos_headers',
   ],
-  'export_dependent_settings': [
-    '../third_party/khronos/khronos.gyp:khronos_headers',
-  ],
   'sources': [
     'command_buffer/client/cmd_buffer_helper.cc',
     'command_buffer/client/cmd_buffer_helper.h',
diff --git a/chromium/gpu/command_buffer_common.gypi b/chromium/gpu/command_buffer_common.gypi
index ab9a635a368..87eeb5bf9d8 100644
--- a/chromium/gpu/command_buffer_common.gypi
+++ b/chromium/gpu/command_buffer_common.gypi
@@ -6,9 +6,6 @@
   'dependencies': [
     '../third_party/khronos/khronos.gyp:khronos_headers',
   ],
-  'export_dependent_settings': [
-    '../third_party/khronos/khronos.gyp:khronos_headers',
-  ],
   'sources': [
     'command_buffer/common/bitfield_helpers.h',
     'command_buffer/common/buffer.h',
diff --git a/chromium/gpu/config/dx_diag_node.cc b/chromium/gpu/config/dx_diag_node.cc
index c1e84ae4088..e0902cab8cf 100644
--- a/chromium/gpu/config/dx_diag_node.cc
+++ b/chromium/gpu/config/dx_diag_node.cc
@@ -4,8 +4,6 @@
 
 #include "gpu/config/dx_diag_node.h"
 
-#if defined(OS_WIN)
-
 namespace gpu {
 
 DxDiagNode::DxDiagNode() {}
@@ -13,5 +11,3 @@ DxDiagNode::DxDiagNode() {}
 DxDiagNode::~DxDiagNode() {}
 
 }  // namespace gpu
-
-#endif // defined(OS_WIN)
diff --git a/chromium/gpu/config/dx_diag_node.h b/chromium/gpu/config/dx_diag_node.h
index 7f77362d084..33d29b3ec79 100644
--- a/chromium/gpu/config/dx_diag_node.h
+++ b/chromium/gpu/config/dx_diag_node.h
@@ -8,10 +8,6 @@
 #ifndef GPU_CONFIG_DX_DIAG_NODE_H_
 #define GPU_CONFIG_DX_DIAG_NODE_H_
 
-#include "build/build_config.h"
-
-#if defined(OS_WIN)
-
 #include <map>
 #include <string>
 
@@ -28,6 +24,4 @@ struct GPU_EXPORT DxDiagNode {
 
 }  // namespace gpu
 
-#endif // defined(OS_WIN)
-
 #endif  // GPU_CONFIG_DX_DIAG_NODE_H_
diff --git a/chromium/gpu/gpu.gyp b/chromium/gpu/gpu.gyp
index c3c9502c724..46831eef47a 100644
--- a/chromium/gpu/gpu.gyp
+++ b/chromium/gpu/gpu.gyp
@@ -23,9 +23,6 @@
         'command_buffer/command_buffer.gyp:gles2_utils',
         'gles2_cmd_helper',
       ],
-      'export_dependent_settings': [
-        '../third_party/khronos/khronos.gyp:khronos_headers',
-      ],
       'defines': [
         'GLES2_IMPL_IMPLEMENTATION',
       ],
@@ -93,9 +90,6 @@
         'command_buffer_client',
         'gles2_implementation',
       ],
-      'export_dependent_settings': [
-        'command_buffer_client',
-      ],
       'defines': [
         'GLES2_C_LIB_IMPLEMENTATION',
       ],
@@ -121,9 +115,6 @@
         'command_buffer_client',
         'gles2_implementation_client_side_arrays_no_check',
       ],
-      'export_dependent_settings': [
-        'command_buffer_client',
-      ],
       'sources': [
         '<@(gles2_c_lib_source_files)',
       ],
@@ -387,9 +378,6 @@
             'gpu_config',
             'gpu_ipc',
           ],
-          'export_dependent_settings': [
-            'command_buffer_common',
-          ],
           'sources': [
             'gpu_export.h',
           ],
@@ -432,9 +420,6 @@
           'dependencies': [
             'command_buffer_common',
           ],
-          'export_dependent_settings': [
-            'command_buffer_common',
-          ],
           # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
           'msvs_disabled_warnings': [4267, ],
         },
@@ -460,9 +445,6 @@
           'dependencies': [
             'command_buffer_common',
           ],
-          'export_dependent_settings': [
-            'command_buffer_common',
-          ],
         },
         {
           'target_name': 'gpu_config',
diff --git a/chromium/ipc/ipc_message_start.h b/chromium/ipc/ipc_message_start.h
index 3016f5d3461..7ce2bdd8542 100644
--- a/chromium/ipc/ipc_message_start.h
+++ b/chromium/ipc/ipc_message_start.h
@@ -10,7 +10,6 @@
 // code to figure out the message class from its ID.
 enum IPCMessageStart {
   AutomationMsgStart = 0,
-  QtMsgStart,
   FrameMsgStart,
   ViewMsgStart,
   InputMsgStart,
diff --git a/chromium/media/filters/ffmpeg_audio_decoder.cc b/chromium/media/filters/ffmpeg_audio_decoder.cc
index bb64c36af62..00f7566789b 100644
--- a/chromium/media/filters/ffmpeg_audio_decoder.cc
+++ b/chromium/media/filters/ffmpeg_audio_decoder.cc
@@ -23,6 +23,12 @@
 
 namespace media {
 
+// Helper structure for managing multiple decoded audio frames per packet.
+struct QueuedAudioBuffer {
+  AudioDecoder::Status status;
+  scoped_refptr<AudioBuffer> buffer;
+};
+
 // Returns true if the decode result was end of stream.
 static inline bool IsEndOfStream(int result,
                                  int decoded_size,
diff --git a/chromium/media/filters/ffmpeg_audio_decoder.h b/chromium/media/filters/ffmpeg_audio_decoder.h
index 296384796a2..40103b8d751 100644
--- a/chromium/media/filters/ffmpeg_audio_decoder.h
+++ b/chromium/media/filters/ffmpeg_audio_decoder.h
@@ -26,15 +26,10 @@ namespace media {
 
 class AudioTimestampHelper;
 class DecoderBuffer;
+struct QueuedAudioBuffer;
 class ScopedPtrAVFreeContext;
 class ScopedPtrAVFreeFrame;
 
-// Helper structure for managing multiple decoded audio frames per packet.
-struct QueuedAudioBuffer {
-  AudioDecoder::Status status;
-  scoped_refptr<AudioBuffer> buffer;
-};
-
 class MEDIA_EXPORT FFmpegAudioDecoder : public AudioDecoder {
  public:
   explicit FFmpegAudioDecoder(
diff --git a/chromium/net/base/net_error_list.h b/chromium/net/base/net_error_list.h
index 0585c3e18ca..3416cd07c15 100644
--- a/chromium/net/base/net_error_list.h
+++ b/chromium/net/base/net_error_list.h
@@ -570,6 +570,9 @@ NET_ERROR(RESPONSE_HEADERS_TRUNCATED, -357)
 // to read any requests sent, so they may be resent.
 NET_ERROR(QUIC_HANDSHAKE_FAILED, -358)
 
+// An https resource was requested over an insecure QUIC connection.
+NET_ERROR(REQUEST_FOR_SECURE_RESOURCE_OVER_INSECURE_QUIC, -359)
+
 // The cache does not have the requested entry.
 NET_ERROR(CACHE_MISS, -400)
 
diff --git a/chromium/net/cert/mock_cert_verifier.cc b/chromium/net/cert/mock_cert_verifier.cc
index a30e3d54c86..ea5538e8c86 100644
--- a/chromium/net/cert/mock_cert_verifier.cc
+++ b/chromium/net/cert/mock_cert_verifier.cc
@@ -13,6 +13,25 @@
 
 namespace net {
 
+struct MockCertVerifier::Rule {
+  Rule(X509Certificate* cert,
+       const std::string& hostname,
+       const CertVerifyResult& result,
+       int rv)
+      : cert(cert),
+        hostname(hostname),
+        result(result),
+        rv(rv) {
+    DCHECK(cert);
+    DCHECK(result.verified_cert.get());
+  }
+
+  scoped_refptr<X509Certificate> cert;
+  std::string hostname;
+  CertVerifyResult result;
+  int rv;
+};
+
 MockCertVerifier::MockCertVerifier() : default_result_(ERR_CERT_INVALID) {}
 
 MockCertVerifier::~MockCertVerifier() {}
diff --git a/chromium/net/cert/mock_cert_verifier.h b/chromium/net/cert/mock_cert_verifier.h
index 704c66b2b80..5af7b7e7a06 100644
--- a/chromium/net/cert/mock_cert_verifier.h
+++ b/chromium/net/cert/mock_cert_verifier.h
@@ -57,25 +57,7 @@ class MockCertVerifier : public CertVerifier {
                                int rv);
 
  private:
-  struct Rule {
-    Rule(X509Certificate* cert,
-         const std::string& hostname,
-         const CertVerifyResult& result,
-         int rv)
-        : cert(cert),
-          hostname(hostname),
-          result(result),
-          rv(rv) {
-      DCHECK(cert);
-      DCHECK(result.verified_cert.get());
-    }
-
-    scoped_refptr<X509Certificate> cert;
-    std::string hostname;
-    CertVerifyResult result;
-    int rv;
-  };
-
+  struct Rule;
   typedef std::list<Rule> RuleList;
 
   int default_result_;
diff --git a/chromium/net/dns/mock_host_resolver.cc b/chromium/net/dns/mock_host_resolver.cc
index 25918ba3247..ff5ffbc2f75 100644
--- a/chromium/net/dns/mock_host_resolver.cc
+++ b/chromium/net/dns/mock_host_resolver.cc
@@ -212,6 +212,37 @@ void MockHostResolverBase::ResolveNow(size_t id) {
 
 //-----------------------------------------------------------------------------
 
+struct RuleBasedHostResolverProc::Rule {
+  enum ResolverType {
+    kResolverTypeFail,
+    kResolverTypeSystem,
+    kResolverTypeIPLiteral,
+  };
+
+  ResolverType resolver_type;
+  std::string host_pattern;
+  AddressFamily address_family;
+  HostResolverFlags host_resolver_flags;
+  std::string replacement;
+  std::string canonical_name;
+  int latency_ms;  // In milliseconds.
+
+  Rule(ResolverType resolver_type,
+       const std::string& host_pattern,
+       AddressFamily address_family,
+       HostResolverFlags host_resolver_flags,
+       const std::string& replacement,
+       const std::string& canonical_name,
+       int latency_ms)
+      : resolver_type(resolver_type),
+        host_pattern(host_pattern),
+        address_family(address_family),
+        host_resolver_flags(host_resolver_flags),
+        replacement(replacement),
+        canonical_name(canonical_name),
+        latency_ms(latency_ms) {}
+};
+
 RuleBasedHostResolverProc::RuleBasedHostResolverProc(HostResolverProc* previous)
     : HostResolverProc(previous) {
 }
diff --git a/chromium/net/dns/mock_host_resolver.h b/chromium/net/dns/mock_host_resolver.h
index f8a424011a9..3593fbdfe91 100644
--- a/chromium/net/dns/mock_host_resolver.h
+++ b/chromium/net/dns/mock_host_resolver.h
@@ -209,37 +209,7 @@ class RuleBasedHostResolverProc : public HostResolverProc {
                       int* os_error) OVERRIDE;
 
  private:
-  struct Rule {
-    enum ResolverType {
-      kResolverTypeFail,
-      kResolverTypeSystem,
-      kResolverTypeIPLiteral,
-    };
-
-    ResolverType resolver_type;
-    std::string host_pattern;
-    AddressFamily address_family;
-    HostResolverFlags host_resolver_flags;
-    std::string replacement;
-    std::string canonical_name;
-    int latency_ms;  // In milliseconds.
-
-    Rule(ResolverType resolver_type,
-         const std::string& host_pattern,
-         AddressFamily address_family,
-         HostResolverFlags host_resolver_flags,
-         const std::string& replacement,
-         const std::string& canonical_name,
-         int latency_ms)
-        : resolver_type(resolver_type),
-          host_pattern(host_pattern),
-          address_family(address_family),
-          host_resolver_flags(host_resolver_flags),
-          replacement(replacement),
-          canonical_name(canonical_name),
-          latency_ms(latency_ms) {}
-  };
-
+  struct Rule;
   typedef std::list<Rule> RuleList;
 
   virtual ~RuleBasedHostResolverProc();
diff --git a/chromium/net/net.gyp b/chromium/net/net.gyp
index 69f482751c9..c2d618ef220 100644
--- a/chromium/net/net.gyp
+++ b/chromium/net/net.gyp
@@ -1366,7 +1366,7 @@
               '../build/linux/system.gyp:gio',
             ],
         }],
-        [ 'desktop_linux == 1 or chromeos == 1 or qt_os == "embedded_linux"', {
+        [ 'desktop_linux == 1 or chromeos == 1', {
             'conditions': [
               ['use_openssl==1', {
                 'dependencies': [
diff --git a/chromium/net/quic/quic_http_stream.cc b/chromium/net/quic/quic_http_stream.cc
index 56dbbab13e5..f8b2e6517dc 100644
--- a/chromium/net/quic/quic_http_stream.cc
+++ b/chromium/net/quic/quic_http_stream.cc
@@ -58,6 +58,13 @@ int QuicHttpStream::InitializeStream(const HttpRequestInfo* request_info,
     return was_handshake_confirmed_ ? ERR_CONNECTION_CLOSED :
         ERR_QUIC_HANDSHAKE_FAILED;
 
+  if (request_info->url.SchemeIsSecure()) {
+    SSLInfo ssl_info;
+    if (!session_->GetSSLInfo(&ssl_info) || !ssl_info.cert) {
+      return ERR_REQUEST_FOR_SECURE_RESOURCE_OVER_INSECURE_QUIC;
+    }
+  }
+
   stream_net_log_ = stream_net_log;
   request_info_ = request_info;
   priority_ = priority;
diff --git a/chromium/sandbox/linux/services/libc_urandom_override.cc b/chromium/sandbox/linux/services/libc_urandom_override.cc
index 6e8e12995a4..c5c49bac8ca 100644
--- a/chromium/sandbox/linux/services/libc_urandom_override.cc
+++ b/chromium/sandbox/linux/services/libc_urandom_override.cc
@@ -121,6 +121,8 @@ static void InitLibcFileIOFunctions() {
 // the code below defines fopen_override() function with asm name
 // "fopen", so that all references to fopen() will resolve to this
 // function.
+__attribute__ ((__visibility__("default")))
+FILE* fopen_override(const char* path, const char* mode)  __asm__ ("fopen");
 
 __attribute__ ((__visibility__("default")))
 FILE* fopen_override(const char* path, const char* mode) {
@@ -139,7 +141,7 @@ FILE* fopen_override(const char* path, const char* mode) {
 }
 
 __attribute__ ((__visibility__("default")))
-FILE* fopen64_override(const char* path, const char* mode) {
+FILE* fopen64(const char* path, const char* mode) {
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int fd = HANDLE_EINTR(dup(base::GetUrandomFD()));
     if (fd < 0) {
@@ -160,6 +162,11 @@ FILE* fopen64_override(const char* path, const char* mode) {
 #if HAVE_XSTAT
 
 __attribute__ ((__visibility__("default")))
+int xstat_override(int version,
+                   const char *path,
+                   struct stat *buf)  __asm__ ("__xstat");
+
+__attribute__ ((__visibility__("default")))
 int xstat_override(int version, const char *path, struct stat *buf) {
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int result = __fxstat(version, base::GetUrandomFD(), buf);
@@ -172,6 +179,11 @@ int xstat_override(int version, const char *path, struct stat *buf) {
 }
 
 __attribute__ ((__visibility__("default")))
+int xstat64_override(int version,
+                     const char *path,
+                     struct stat64 *buf)  __asm__ ("__xstat64");
+
+__attribute__ ((__visibility__("default")))
 int xstat64_override(int version, const char *path, struct stat64 *buf) {
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int result = __fxstat64(version, base::GetUrandomFD(), buf);
@@ -186,6 +198,10 @@ int xstat64_override(int version, const char *path, struct stat64 *buf) {
 #else
 
 __attribute__ ((__visibility__("default")))
+int stat_override(const char *path,
+                  struct stat *buf)  __asm__ ("stat");
+
+__attribute__ ((__visibility__("default")))
 int stat_override(const char *path, struct stat *buf) {
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int result = fstat(base::GetUrandomFD(), buf);
@@ -198,6 +214,10 @@ int stat_override(const char *path, struct stat *buf) {
 }
 
 __attribute__ ((__visibility__("default")))
+int stat64_override(const char *path,
+                    struct stat64 *buf)  __asm__ ("stat64");
+
+__attribute__ ((__visibility__("default")))
 int stat64_override(const char *path, struct stat64 *buf) {
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int result = fstat64(base::GetUrandomFD(), buf);
diff --git a/chromium/skia/skia_chrome.gypi b/chromium/skia/skia_chrome.gypi
index 5559f57c1aa..6dcc6654fdd 100644
--- a/chromium/skia/skia_chrome.gypi
+++ b/chromium/skia/skia_chrome.gypi
@@ -117,7 +117,7 @@
   'target_conditions': [
     # Pull in specific linux files for android (which have been filtered out
     # by file name rules).
-    [ 'OS == "android" or qt_os == "embedded_linux"', {
+    [ 'OS == "android"', {
       'sources/': [
         ['include', 'ext/platform_device_linux\\.cc$'],
       ],
diff --git a/chromium/skia/skia_library.gypi b/chromium/skia/skia_library.gypi
index effde33097b..b957fa665b5 100644
--- a/chromium/skia/skia_library.gypi
+++ b/chromium/skia/skia_library.gypi
@@ -270,7 +270,7 @@
         '../third_party/skia/src/opts/opts_check_SSE2.cpp'
       ],
     }],
-    [ 'desktop_linux == 1 or chromeos == 1 or qt_os=="embedded_linux"', {
+    [ 'desktop_linux == 1 or chromeos == 1', {
       'dependencies': [
         '../build/linux/system.gyp:fontconfig',
         '../build/linux/system.gyp:freetype2',
diff --git a/chromium/third_party/WebKit/Source/bindings/scripts/code_generator_v8.pm b/chromium/third_party/WebKit/Source/bindings/scripts/code_generator_v8.pm
index 1c2706031c9..e19e9aa9015 100644
--- a/chromium/third_party/WebKit/Source/bindings/scripts/code_generator_v8.pm
+++ b/chromium/third_party/WebKit/Source/bindings/scripts/code_generator_v8.pm
@@ -1980,7 +1980,7 @@ END
         die "[PutForwards=x] could not find $destinationAttrName in interface $attrType" unless $destinationAttribute;
         $code .= <<END;
     ${implClassName}* proxyImp = ${v8ClassName}::toNative(info.Holder());
-    ${attrType}* imp = proxyImp->${attrName}();
+    RefPtr<${attrType}> imp = proxyImp->${attrName}();
     if (!imp)
         return;
 END
diff --git a/chromium/third_party/WebKit/Source/build/scripts/scripts.gypi b/chromium/third_party/WebKit/Source/build/scripts/scripts.gypi
index c7bdc4f1e1b..2cf0a34fee4 100644
--- a/chromium/third_party/WebKit/Source/build/scripts/scripts.gypi
+++ b/chromium/third_party/WebKit/Source/build/scripts/scripts.gypi
@@ -43,9 +43,9 @@
             ['OS=="win"', {
                 # Using native perl rather than cygwin perl cuts execution time
                 # of idl preprocessing rules by a bit more than 50%.
-                'perl_exe%': '<(DEPTH)/third_party/perl/perl/bin/perl.exe',
-                'gperf_exe%': '<(DEPTH)/third_party/gperf/bin/gperf.exe',
-                'bison_exe%': '<(DEPTH)/third_party/bison/bin/bison.exe',
+                'perl_exe': '<(DEPTH)/third_party/perl/perl/bin/perl.exe',
+                'gperf_exe': '<(DEPTH)/third_party/gperf/bin/gperf.exe',
+                'bison_exe': '<(DEPTH)/third_party/bison/bin/bison.exe',
                 # Using cl instead of cygwin gcc cuts the processing time from
                 # 1m58s to 0m52s.
                 'preprocessor': '--preprocessor "cl.exe -nologo -EP -TP"',
diff --git a/chromium/third_party/WebKit/Source/config.h b/chromium/third_party/WebKit/Source/config.h
index d7501db1e45..e556d5b95dc 100644
--- a/chromium/third_party/WebKit/Source/config.h
+++ b/chromium/third_party/WebKit/Source/config.h
@@ -97,6 +97,7 @@
 
 #if OS(MACOSX)
 #define WTF_USE_CF 1
+#define WTF_USE_RUBBER_BANDING 1
 
 /* We can't override the global operator new and delete on OS(MACOSX) because
  * some object are allocated by WebKit and deallocated by the embedder. */
diff --git a/chromium/third_party/WebKit/Source/core/core.gyp b/chromium/third_party/WebKit/Source/core/core.gyp
index 8b8a8b589c5..882565dec88 100644
--- a/chromium/third_party/WebKit/Source/core/core.gyp
+++ b/chromium/third_party/WebKit/Source/core/core.gyp
@@ -821,7 +821,6 @@
         'webcore_derived',
         '../wtf/wtf.gyp:wtf',
         '<(DEPTH)/skia/skia.gyp:skia',
-        '<(DEPTH)/third_party/khronos/khronos.gyp:khronos_headers',
         '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/url/url.gyp:url_lib',
@@ -831,7 +830,6 @@
         '../wtf/wtf.gyp:wtf',
         'webcore_derived',
         '<(DEPTH)/skia/skia.gyp:skia',
-        '<(DEPTH)/third_party/khronos/khronos.gyp:khronos_headers',
         '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/url/url.gyp:url_lib',
diff --git a/chromium/third_party/WebKit/Source/core/css/CSSFontSelector.cpp b/chromium/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
index 166e2c3e4ba..9b83e9e2182 100644
--- a/chromium/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
+++ b/chromium/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
@@ -167,12 +167,15 @@ static AtomicString familyNameFromSettings(const GenericFontFamilySettings& sett
 {
     UScriptCode script = fontDescription.script();
 
+#if OS(ANDROID)
     if (fontDescription.genericFamily() == FontDescription::StandardFamily && !fontDescription.isSpecifiedFont())
-        return settings.standard(script);
+        return FontCache::getGenericFamilyNameForScript(FontFamilyNames::webkit_standard, script);
 
-#if OS(ANDROID)
-    return FontCache::getGenericFamilyNameForScript(genericFamilyName, script);
+    if (genericFamilyName.startsWith("-webkit-"))
+        return FontCache::getGenericFamilyNameForScript(genericFamilyName, script);
 #else
+    if (fontDescription.genericFamily() == FontDescription::StandardFamily && !fontDescription.isSpecifiedFont())
+        return settings.standard(script);
     if (genericFamilyName == FontFamilyNames::webkit_serif)
         return settings.serif(script);
     if (genericFamilyName == FontFamilyNames::webkit_sans_serif)
diff --git a/chromium/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp b/chromium/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp
index 31303805178..9eeec75b2c7 100644
--- a/chromium/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp
+++ b/chromium/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp
@@ -180,11 +180,15 @@ void CSSToStyleMap::mapFillRepeatY(CSSPropertyID, FillLayer* layer, CSSValue* va
 
 void CSSToStyleMap::mapFillSize(CSSPropertyID, FillLayer* layer, CSSValue* value) const
 {
-    if (!value->isPrimitiveValue()) {
-        layer->setSizeType(SizeNone);
+    if (value->isInitialValue()) {
+        layer->setSizeType(FillLayer::initialFillSizeType(layer->type()));
+        layer->setSizeLength(FillLayer::initialFillSizeLength(layer->type()));
         return;
     }
 
+    if (!value->isPrimitiveValue())
+        return;
+
     CSSPrimitiveValue* primitiveValue = toCSSPrimitiveValue(value);
     if (primitiveValue->getValueID() == CSSValueContain)
         layer->setSizeType(Contain);
@@ -195,7 +199,7 @@ void CSSToStyleMap::mapFillSize(CSSPropertyID, FillLayer* layer, CSSValue* value
 
     LengthSize b = FillLayer::initialFillSizeLength(layer->type());
 
-    if (value->isInitialValue() || primitiveValue->getValueID() == CSSValueContain || primitiveValue->getValueID() == CSSValueCover) {
+    if (primitiveValue->getValueID() == CSSValueContain || primitiveValue->getValueID() == CSSValueCover) {
         layer->setSizeLength(b);
         return;
     }
diff --git a/chromium/third_party/WebKit/Source/platform/fonts/mac/ComplexTextControllerCoreText.mm b/chromium/third_party/WebKit/Source/platform/fonts/mac/ComplexTextControllerCoreText.mm
index 42cdbedf9f2..822aa8cb8f0 100644
--- a/chromium/third_party/WebKit/Source/platform/fonts/mac/ComplexTextControllerCoreText.mm
+++ b/chromium/third_party/WebKit/Source/platform/fonts/mac/ComplexTextControllerCoreText.mm
@@ -223,9 +223,14 @@ void ComplexTextController::collectComplexTextRunsForCharacters(const UChar* cp,
         static CFDictionaryRef ltrTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, ltrOptionValues, WTF_ARRAY_LENGTH(optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
         static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, WTF_ARRAY_LENGTH(optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+        ProviderInfo info = { cp, length, stringAttributes.get() };
+        RetainPtr<CTTypesetterRef> typesetter(AdoptCF, WKCreateCTTypesetterWithUniCharProviderAndOptions(&provideStringAndAttributes, 0, &info, m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
+#else
         RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, cp, length, kCFAllocatorNull));
         RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), stringAttributes.get()));
         RetainPtr<CTTypesetterRef> typesetter(AdoptCF, CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
+#endif
 
         line.adoptCF(CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
     } else {
diff --git a/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp b/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
index cadbc144e41..b129dc6e10e 100644
--- a/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
+++ b/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
@@ -138,16 +138,6 @@ private:
         m_popup->widgetClient()->hasTouchEventHandlers(needsTouchEvents);
     }
 
-    virtual GraphicsLayerFactory* graphicsLayerFactory() const OVERRIDE
-    {
-        return m_popup->m_webView->graphicsLayerFactory();
-    }
-
-    virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer* graphicsLayer) OVERRIDE
-    {
-        m_popup->setRootGraphicsLayer(graphicsLayer);
-    }
-
     WebPagePopupImpl* m_popup;
 };
 
@@ -167,10 +157,6 @@ bool PagePopupFeaturesClient::isEnabled(Document*, ContextFeatures::FeatureType
 WebPagePopupImpl::WebPagePopupImpl(WebWidgetClient* client)
     : m_widgetClient(client)
     , m_closing(false)
-    , m_layerTreeView(0)
-    , m_rootLayer(0)
-    , m_rootGraphicsLayer(0)
-    , m_isAcceleratedCompositingActive(false)
 {
     ASSERT(client);
 }
@@ -238,49 +224,6 @@ void WebPagePopupImpl::destroyPage()
     m_page.clear();
 }
 
-void WebPagePopupImpl::setRootGraphicsLayer(GraphicsLayer* layer)
-{
-    m_rootGraphicsLayer = layer;
-    m_rootLayer = layer ? layer->platformLayer() : 0;
-
-    setIsAcceleratedCompositingActive(layer);
-    if (m_layerTreeView) {
-        if (m_rootLayer) {
-            m_layerTreeView->setRootLayer(*m_rootLayer);
-        } else {
-            m_layerTreeView->clearRootLayer();
-        }
-    }
-}
-
-void WebPagePopupImpl::setIsAcceleratedCompositingActive(bool enter)
-{
-    if (m_isAcceleratedCompositingActive == enter)
-        return;
-
-    if (!enter) {
-        m_isAcceleratedCompositingActive = false;
-        m_widgetClient->didDeactivateCompositor();
-    } else if (m_layerTreeView) {
-        m_isAcceleratedCompositingActive = true;
-        m_widgetClient->didActivateCompositor(0);
-    } else {
-        TRACE_EVENT0("webkit", "WebPagePopupImpl::setIsAcceleratedCompositingActive(true)");
-
-        m_widgetClient->initializeLayerTreeView();
-        m_layerTreeView = m_widgetClient->layerTreeView();
-        if (m_layerTreeView) {
-            m_layerTreeView->setVisible(true);
-            m_widgetClient->didActivateCompositor(0);
-            m_isAcceleratedCompositingActive = true;
-            m_layerTreeView->setDeviceScaleFactor(m_widgetClient->deviceScaleFactor());
-        } else {
-            m_isAcceleratedCompositingActive = false;
-            m_widgetClient->didDeactivateCompositor();
-        }
-    }
-}
-
 WebSize WebPagePopupImpl::size()
 {
     return m_popupClient->contentSize();
@@ -291,36 +234,6 @@ void WebPagePopupImpl::animate(double)
     PageWidgetDelegate::animate(m_page.get(), monotonicallyIncreasingTime());
 }
 
-void WebPagePopupImpl::enterForceCompositingMode(bool enter)
-{
-    if (m_page->settings().forceCompositingMode() == enter)
-        return;
-
-    TRACE_EVENT1("webkit", "WebPagePopupImpl::enterForceCompositingMode", "enter", enter);
-    m_page->settings().setForceCompositingMode(enter);
-    if (enter) {
-        if (!m_page)
-            return;
-        Frame* mainFrame = m_page->mainFrame();
-        if (!mainFrame)
-            return;
-        mainFrame->view()->updateCompositingLayersAfterStyleChange();
-    }
-}
-
-void WebPagePopupImpl::didExitCompositingMode()
-{
-    setIsAcceleratedCompositingActive(false);
-    m_widgetClient->didInvalidateRect(IntRect(0, 0, size().width, size().height));
-    m_page->mainFrame()->document()->setNeedsStyleRecalc(SubtreeStyleChange);
-}
-
-void WebPagePopupImpl::willCloseLayerTreeView()
-{
-    setIsAcceleratedCompositingActive(false);
-    m_layerTreeView = 0;
-}
-
 void WebPagePopupImpl::layout()
 {
     PageWidgetDelegate::layout(m_page.get());
diff --git a/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.h b/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.h
index 050f3aeb373..660c47f75ff 100644
--- a/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.h
+++ b/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.h
@@ -38,7 +38,6 @@
 #include "wtf/RefCounted.h"
 
 namespace WebCore {
-class GraphicsLayer;
 class Page;
 class PagePopupClient;
 class PlatformKeyboardEvent;
@@ -47,8 +46,6 @@ class PlatformKeyboardEvent;
 namespace blink {
 
 class PagePopupChromeClient;
-class WebLayerTreeView;
-class WebLayer;
 class WebViewImpl;
 
 class WebPagePopupImpl : public WebPagePopup,
@@ -71,9 +68,6 @@ private:
     virtual WebSize size() OVERRIDE;
     virtual void animate(double) OVERRIDE;
     virtual void layout() OVERRIDE;
-    virtual void enterForceCompositingMode(bool enter) OVERRIDE;
-    virtual void didExitCompositingMode() OVERRIDE;
-    virtual void willCloseLayerTreeView() OVERRIDE;
     virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable) OVERRIDE;
     virtual void resize(const WebSize&) OVERRIDE;
     virtual void close() OVERRIDE;
@@ -89,8 +83,6 @@ private:
     explicit WebPagePopupImpl(WebWidgetClient*);
     bool initializePage();
     void destroyPage();
-    void setRootGraphicsLayer(WebCore::GraphicsLayer*);
-    void setIsAcceleratedCompositingActive(bool enter);
 
     WebWidgetClient* m_widgetClient;
     WebRect m_windowRectInScreen;
@@ -100,11 +92,6 @@ private:
     WebCore::PagePopupClient* m_popupClient;
     bool m_closing;
 
-    WebLayerTreeView* m_layerTreeView;
-    WebLayer* m_rootLayer;
-    WebCore::GraphicsLayer* m_rootGraphicsLayer;
-    bool m_isAcceleratedCompositingActive;
-
     friend class WebPagePopup;
     friend class PagePopupChromeClient;
 };
diff --git a/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.cpp b/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.cpp
index e8adfd7c0df..05c1d05281a 100644
--- a/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.cpp
+++ b/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.cpp
@@ -49,10 +49,6 @@
 #include "platform/graphics/GraphicsContext.h"
 #include "platform/graphics/skia/SkiaUtils.h"
 #include "platform/scroll/FramelessScrollView.h"
-#include "public/platform/Platform.h"
-#include "public/platform/WebCompositorSupport.h"
-#include "public/platform/WebContentLayer.h"
-#include "public/platform/WebLayerTreeView.h"
 #include "public/platform/WebRect.h"
 #include <skia/ext/platform_canvas.h>
 
@@ -72,10 +68,6 @@ WebPopupMenu* WebPopupMenu::create(WebWidgetClient* client)
 
 WebPopupMenuImpl::WebPopupMenuImpl(WebWidgetClient* client)
     : m_client(client)
-    , m_layerTreeView(0)
-    , m_isAcceleratedCompositingActive(false)
-    // Set to impossible point so we always get the first mouse position.
-    , m_lastMousePosition(WebPoint(-1, -1))
     , m_widget(0)
 {
     // Set to impossible point so we always get the first mouse position.
@@ -88,12 +80,6 @@ WebPopupMenuImpl::~WebPopupMenuImpl()
         m_widget->setClient(0);
 }
 
-void WebPopupMenuImpl::willCloseLayerTreeView()
-{
-    enterForceCompositingMode(false);
-    m_layerTreeView = 0;
-}
-
 void WebPopupMenuImpl::initialize(FramelessScrollView* widget, const WebRect& bounds)
 {
     m_widget = widget;
@@ -188,9 +174,6 @@ void WebPopupMenuImpl::resize(const WebSize& newSize)
         WebRect damagedRect(0, 0, m_size.width, m_size.height);
         m_client->didInvalidateRect(damagedRect);
     }
-
-    if (m_rootLayer)
-        m_rootLayer->layer()->setBounds(newSize);
 }
 
 void WebPopupMenuImpl::willEndLiveResize()
@@ -205,54 +188,6 @@ void WebPopupMenuImpl::layout()
 {
 }
 
-void WebPopupMenuImpl::enterForceCompositingMode(bool enter)
-{
-    if (m_isAcceleratedCompositingActive == enter)
-        return;
-
-    if (!enter) {
-        m_isAcceleratedCompositingActive = false;
-        m_client->didDeactivateCompositor();
-    } else if (m_layerTreeView) {
-        m_isAcceleratedCompositingActive = true;
-        m_client->didActivateCompositor(0);
-    } else {
-        TRACE_EVENT0("webkit", "WebPopupMenuImpl::enterForceCompositingMode(true)");
-
-        m_client->initializeLayerTreeView();
-        m_layerTreeView = m_client->layerTreeView();
-        if (m_layerTreeView) {
-            m_layerTreeView->setVisible(true);
-            m_client->didActivateCompositor(0);
-            m_isAcceleratedCompositingActive = true;
-            m_layerTreeView->setDeviceScaleFactor(m_client->deviceScaleFactor());
-            m_rootLayer = adoptPtr(Platform::current()->compositorSupport()->createContentLayer(this));
-            m_rootLayer->layer()->setBounds(m_size);
-            m_layerTreeView->setRootLayer(*m_rootLayer->layer());
-        } else {
-            m_isAcceleratedCompositingActive = false;
-            m_client->didDeactivateCompositor();
-        }
-    }
-}
-
-void WebPopupMenuImpl::didExitCompositingMode()
-{
-    enterForceCompositingMode(false);
-    m_client->didInvalidateRect(IntRect(0, 0, m_size.width, m_size.height));
-}
-
-void WebPopupMenuImpl::paintContents(WebCanvas* canvas, const WebRect& rect, bool, WebFloatRect&)
-{
-    if (!m_widget)
-        return;
-
-    if (!rect.isEmpty()) {
-        GraphicsContext context(canvas);
-        m_widget->paint(&context, rect);
-    }
-}
-
 void WebPopupMenuImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions)
 {
     if (!m_widget)
@@ -408,8 +343,6 @@ void WebPopupMenuImpl::invalidateContentsAndRootView(const IntRect& paintRect)
         return;
     if (m_client)
         m_client->didInvalidateRect(paintRect);
-    if (m_rootLayer)
-        m_rootLayer->layer()->invalidateRect(FloatRect(paintRect));
 }
 
 void WebPopupMenuImpl::invalidateContentsForSlowScroll(const IntRect& updateRect)
@@ -428,8 +361,6 @@ void WebPopupMenuImpl::scroll(const IntSize& scrollDelta, const IntRect& scrollR
         int dy = scrollDelta.height();
         m_client->didScrollRect(dx, dy, clipRect);
     }
-    if (m_rootLayer)
-        m_rootLayer->layer()->invalidateRect(FloatRect(clipRect));
 }
 
 IntPoint WebPopupMenuImpl::screenToRootView(const IntPoint& point) const
diff --git a/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.h b/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.h
index 0384675c75e..e5777bea8ce 100644
--- a/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.h
+++ b/chromium/third_party/WebKit/Source/web/WebPopupMenuImpl.h
@@ -33,7 +33,6 @@
 
 #include "WebPopupMenu.h"
 #include "platform/scroll/FramelessScrollViewClient.h"
-#include "public/platform/WebContentLayerClient.h"
 #include "public/platform/WebPoint.h"
 #include "public/platform/WebSize.h"
 #include "wtf/OwnPtr.h"
@@ -50,50 +49,44 @@ class Widget;
 }
 
 namespace blink {
-class WebContentLayer;
 class WebGestureEvent;
 class WebKeyboardEvent;
-class WebLayerTreeView;
 class WebMouseEvent;
 class WebMouseWheelEvent;
 class WebRange;
 struct WebRect;
 class WebTouchEvent;
 
-class WebPopupMenuImpl : public WebPopupMenu, public WebCore::FramelessScrollViewClient, public WebContentLayerClient, public RefCounted<WebPopupMenuImpl> {
+class WebPopupMenuImpl : public WebPopupMenu,
+                         public WebCore::FramelessScrollViewClient,
+                         public RefCounted<WebPopupMenuImpl> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     // WebWidget functions:
-    virtual void close() OVERRIDE FINAL;
-    virtual WebSize size() OVERRIDE FINAL { return m_size; }
-    virtual void willStartLiveResize() OVERRIDE FINAL;
-    virtual void resize(const WebSize&) OVERRIDE FINAL;
-    virtual void willEndLiveResize() OVERRIDE FINAL;
-    virtual void animate(double frameBeginTime) OVERRIDE FINAL;
-    virtual void layout() OVERRIDE FINAL;
-    virtual void enterForceCompositingMode(bool enable) OVERRIDE FINAL;
-    virtual void didExitCompositingMode() OVERRIDE FINAL;
-    virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable) OVERRIDE FINAL;
-    virtual void themeChanged() OVERRIDE FINAL;
-    virtual bool handleInputEvent(const WebInputEvent&) OVERRIDE FINAL;
-    virtual void mouseCaptureLost() OVERRIDE FINAL;
-    virtual void setFocus(bool enable) OVERRIDE FINAL;
+    virtual void close() OVERRIDE;
+    virtual WebSize size() OVERRIDE { return m_size; }
+    virtual void willStartLiveResize() OVERRIDE;
+    virtual void resize(const WebSize&) OVERRIDE;
+    virtual void willEndLiveResize() OVERRIDE;
+    virtual void animate(double frameBeginTime) OVERRIDE;
+    virtual void layout() OVERRIDE;
+    virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable) OVERRIDE;
+    virtual void themeChanged() OVERRIDE;
+    virtual bool handleInputEvent(const WebInputEvent&) OVERRIDE;
+    virtual void mouseCaptureLost() OVERRIDE;
+    virtual void setFocus(bool enable) OVERRIDE;
     virtual bool setComposition(
         const WebString& text,
         const WebVector<WebCompositionUnderline>& underlines,
-        int selectionStart, int selectionEnd) OVERRIDE FINAL;
-    virtual bool confirmComposition() OVERRIDE FINAL;
-    virtual bool confirmComposition(ConfirmCompositionBehavior selectionBehavior) OVERRIDE FINAL;
-    virtual bool confirmComposition(const WebString& text) OVERRIDE FINAL;
-    virtual bool compositionRange(size_t* location, size_t* length) OVERRIDE FINAL;
-    virtual bool caretOrSelectionRange(size_t* location, size_t* length) OVERRIDE FINAL;
-    virtual void setTextDirection(WebTextDirection) OVERRIDE FINAL;
-    virtual bool isAcceleratedCompositingActive() const OVERRIDE FINAL { return false; }
-    virtual bool isPopupMenu() const OVERRIDE FINAL { return true; }
-    virtual void willCloseLayerTreeView() OVERRIDE FINAL;
-
-    // WebContentLayerClient
-    virtual void paintContents(WebCanvas*, const WebRect& clip, bool canPaintLCDTest, WebFloatRect& opaque) OVERRIDE FINAL;
+        int selectionStart, int selectionEnd) OVERRIDE;
+    virtual bool confirmComposition() OVERRIDE;
+    virtual bool confirmComposition(ConfirmCompositionBehavior selectionBehavior) OVERRIDE;
+    virtual bool confirmComposition(const WebString& text) OVERRIDE;
+    virtual bool compositionRange(size_t* location, size_t* length) OVERRIDE;
+    virtual bool caretOrSelectionRange(size_t* location, size_t* length) OVERRIDE;
+    virtual void setTextDirection(WebTextDirection) OVERRIDE;
+    virtual bool isAcceleratedCompositingActive() const OVERRIDE { return false; }
+    virtual bool isPopupMenu() const OVERRIDE { return true; }
 
     // WebPopupMenuImpl
     void initialize(WebCore::FramelessScrollView* widget, const WebRect& bounds);
@@ -134,10 +127,6 @@ public:
     WebWidgetClient* m_client;
     WebSize m_size;
 
-    WebLayerTreeView* m_layerTreeView;
-    OwnPtr<WebContentLayer> m_rootLayer;
-    bool m_isAcceleratedCompositingActive;
-
     WebPoint m_lastMousePosition;
 
     // This is a non-owning ref. The popup will notify us via popupClosed()
diff --git a/chromium/third_party/harfbuzz-ng/src/hb-ot-shape-private.hh b/chromium/third_party/harfbuzz-ng/src/hb-ot-shape-private.hh
index 817147199fd..cbfab5b40c9 100644
--- a/chromium/third_party/harfbuzz-ng/src/hb-ot-shape-private.hh
+++ b/chromium/third_party/harfbuzz-ng/src/hb-ot-shape-private.hh
@@ -66,7 +66,7 @@ struct hb_ot_shape_planner_t
   hb_ot_map_builder_t map;
 
   hb_ot_shape_planner_t (const hb_shape_plan_t *master_plan) :
-			 face (master_plan->face),
+			 face (master_plan->face_unsafe),
 			 props (master_plan->props),
 			 shaper (NULL),
 			 map (face, &props) {}
diff --git a/chromium/third_party/harfbuzz-ng/src/hb-shape-plan-private.hh b/chromium/third_party/harfbuzz-ng/src/hb-shape-plan-private.hh
index dd014e38d01..adb1576a0df 100644
--- a/chromium/third_party/harfbuzz-ng/src/hb-shape-plan-private.hh
+++ b/chromium/third_party/harfbuzz-ng/src/hb-shape-plan-private.hh
@@ -39,7 +39,7 @@ struct hb_shape_plan_t
   ASSERT_POD ();
 
   hb_bool_t default_shaper_list;
-  hb_face_t *face;
+  hb_face_t *face_unsafe; /* We don't carry a reference to face. */
   hb_segment_properties_t props;
 
   hb_shape_func_t *shaper_func;
diff --git a/chromium/third_party/harfbuzz-ng/src/hb-shape-plan.cc b/chromium/third_party/harfbuzz-ng/src/hb-shape-plan.cc
index b44a9e2ab77..13544056d72 100644
--- a/chromium/third_party/harfbuzz-ng/src/hb-shape-plan.cc
+++ b/chromium/third_party/harfbuzz-ng/src/hb-shape-plan.cc
@@ -46,7 +46,7 @@ hb_shape_plan_plan (hb_shape_plan_t    *shape_plan,
 
 #define HB_SHAPER_PLAN(shaper) \
 	HB_STMT_START { \
-	  if (hb_##shaper##_shaper_face_data_ensure (shape_plan->face)) { \
+	  if (hb_##shaper##_shaper_face_data_ensure (shape_plan->face_unsafe)) { \
 	    HB_SHAPER_DATA (shaper, shape_plan) = \
 	      HB_SHAPER_DATA_CREATE_FUNC (shaper, shape_plan) (shape_plan, user_features, num_user_features); \
 	    shape_plan->shaper_func = _hb_##shaper##_shape; \
@@ -117,7 +117,7 @@ hb_shape_plan_create (hb_face_t                     *face,
 
   hb_face_make_immutable (face);
   shape_plan->default_shaper_list = shaper_list == NULL;
-  shape_plan->face = hb_face_reference (face);
+  shape_plan->face_unsafe = face;
   shape_plan->props = *props;
 
   hb_shape_plan_plan (shape_plan, user_features, num_user_features, shaper_list);
@@ -190,8 +190,6 @@ hb_shape_plan_destroy (hb_shape_plan_t *shape_plan)
 #include "hb-shaper-list.hh"
 #undef HB_SHAPER_IMPLEMENT
 
-  hb_face_destroy (shape_plan->face);
-
   free (shape_plan);
 }
 
@@ -264,7 +262,7 @@ hb_shape_plan_execute (hb_shape_plan_t    *shape_plan,
 		hb_object_is_inert (buffer)))
     return false;
 
-  assert (shape_plan->face == font->face);
+  assert (shape_plan->face_unsafe == font->face);
   assert (hb_segment_properties_equal (&shape_plan->props, &buffer->props));
 
 #define HB_SHAPER_EXECUTE(shaper) \
@@ -395,9 +393,6 @@ retry:
     goto retry;
   }
 
-  /* Release our reference on face. */
-  hb_face_destroy (face);
-
   return hb_shape_plan_reference (shape_plan);
 }
 
diff --git a/chromium/third_party/icu/icu.gyp b/chromium/third_party/icu/icu.gyp
index 416050d66d8..4d8259af005 100644
--- a/chromium/third_party/icu/icu.gyp
+++ b/chromium/third_party/icu/icu.gyp
@@ -642,8 +642,6 @@
                 ],
               },
             },{ # OS!="android"
-              'conditions': [
-              ['qt_os!="embedded_linux"', {
               'link_settings': {
                 'ldflags': [
                   '<!@(icu-config --ldflags)',
@@ -652,8 +650,6 @@
                   '<!@(icu-config --ldflags-libsonly)',
                 ],
               },
-              }],
-              ],
             }],
           ],
         },
diff --git a/chromium/third_party/khronos/khronos.gyp b/chromium/third_party/khronos/khronos.gyp
index 88130d26b9d..8a855728d52 100644
--- a/chromium/third_party/khronos/khronos.gyp
+++ b/chromium/third_party/khronos/khronos.gyp
@@ -7,7 +7,7 @@
     {
       'target_name': 'khronos_headers',
       'type': 'none',
-      'direct_dependent_settings': {
+      'all_dependent_settings': {
         'include_dirs': [
           '.',
           '../../gpu',  # Contains GLES2/gl2chromium.h
diff --git a/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.cc b/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.cc
index 3bdc4039c85..51da9ac6b14 100644
--- a/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.cc
+++ b/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.cc
@@ -1620,6 +1620,19 @@ int WebRtcVoiceEngine::CreateSoundclipVoiceChannel() {
   return CreateVoiceChannel(voe_wrapper_sc_.get());
 }
 
+// This struct relies on the generated copy constructor and assignment operator
+// since it is used in an stl::map.
+struct WebRtcVoiceMediaChannel::WebRtcVoiceChannelInfo {
+  WebRtcVoiceChannelInfo() : channel(-1), renderer(NULL) {}
+  WebRtcVoiceChannelInfo(int ch, AudioRenderer* r)
+      : channel(ch),
+        renderer(r) {}
+  ~WebRtcVoiceChannelInfo() {}
+
+  int channel;
+  AudioRenderer* renderer;
+};
+
 // WebRtcVoiceMediaChannel
 WebRtcVoiceMediaChannel::WebRtcVoiceMediaChannel(WebRtcVoiceEngine *engine)
     : WebRtcMediaChannel<VoiceMediaChannel, WebRtcVoiceEngine>(
diff --git a/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.h b/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.h
index 6a2c6d80f8f..23d97f5e103 100644
--- a/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.h
+++ b/chromium/third_party/libjingle/source/talk/media/webrtc/webrtcvoiceengine.h
@@ -388,18 +388,7 @@ class WebRtcVoiceMediaChannel
   static Error WebRtcErrorToChannelError(int err_code);
 
  private:
-  // This struct relies on the generated copy constructor and assignment operator
-  // since it is used in an stl::map.
-  struct WebRtcVoiceChannelInfo {
-    WebRtcVoiceChannelInfo() : channel(-1), renderer(NULL) {}
-    WebRtcVoiceChannelInfo(int ch, AudioRenderer* r)
-        : channel(ch),
-          renderer(r) {}
-    ~WebRtcVoiceChannelInfo() {}
-
-    int channel;
-    AudioRenderer* renderer;
-  };
+  struct WebRtcVoiceChannelInfo;
   typedef std::map<uint32, WebRtcVoiceChannelInfo> ChannelMap;
 
   void SetNack(int channel, bool nack_enabled);
diff --git a/chromium/third_party/libvpx/libvpx.gyp b/chromium/third_party/libvpx/libvpx.gyp
index 32a4bb10afa..3f668df2eeb 100644
--- a/chromium/third_party/libvpx/libvpx.gyp
+++ b/chromium/third_party/libvpx/libvpx.gyp
@@ -404,7 +404,6 @@
                 '-s', '<(PRODUCT_DIR)/obj/libvpx_asm_offsets_vp8/vp8_asm_enc_offsets.obj',
                 '-s', '<(ninja_obj_dir)/encoder/libvpx_asm_offsets_vp8.vp8_asm_enc_offsets.obj',
                 '-s', '<(PRODUCT_DIR)/obj/Source/WebKit/chromium/third_party/libvpx/<(libvpx_source)/vp8/encoder/libvpx_asm_offsets_vp8.vp8_asm_enc_offsets.obj',
-                '-s', '<(qtwe_chromium_obj_dir)/third_party/libvpx/<(libvpx_source)/vp8/encoder/libvpx_asm_offsets_vp8.vp8_asm_enc_offsets.obj',
               ],
               'process_output_as_sources': 1,
               'msvs_cygwin_shell': 1,
@@ -503,7 +502,6 @@
                 '-s', '<(PRODUCT_DIR)/obj/libvpx_asm_offsets_vpx_scale/vpx_scale_asm_offsets.obj',
                 '-s', '<(ninja_obj_dir)/encoder/libvpx_asm_offsets_vpx_scale.vpx_scale_asm_offsets.obj',
                 '-s', '<(PRODUCT_DIR)/obj/Source/WebKit/chromium/third_party/libvpx/<(libvpx_source)/vpx_scale/libvpx_asm_offsets_vpx_scale.vpx_scale_asm_offsets.obj',
-                '-s', '<(qtwe_chromium_obj_dir)/third_party/libvpx/<(libvpx_source)/vpx_scale/libvpx_asm_offsets_vpx_scale.vpx_scale_asm_offsets.obj',
               ],
               'process_output_as_sources': 1,
               'msvs_cygwin_shell': 1,
diff --git a/chromium/third_party/openssl/openssl.gypi b/chromium/third_party/openssl/openssl.gypi
index 38eb4b5e34a..856b72ef9ef 100644
--- a/chromium/third_party/openssl/openssl.gypi
+++ b/chromium/third_party/openssl/openssl.gypi
@@ -566,6 +566,7 @@
       'openssl/crypto/aes/asm/aes-armv4.S',
       'openssl/crypto/bn/asm/armv4-gf2m.S',
       'openssl/crypto/bn/asm/armv4-mont.S',
+      'openssl/crypto/chacha/chacha_vec_arm.S',
       'openssl/crypto/modes/asm/ghash-armv4.S',
       'openssl/crypto/poly1305/poly1305_arm.c',
       'openssl/crypto/poly1305/poly1305_arm_asm.S',
@@ -573,18 +574,6 @@
       'openssl/crypto/sha/asm/sha256-armv4.S',
       'openssl/crypto/sha/asm/sha512-armv4.S',
     ],
-    'conditions': [
-      ['arm_float_abi=="hard"', {
-        'openssl_arm_sources+': [
-          'openssl/crypto/chacha/chacha_vec.c',
-        ],
-      },
-      {
-        'openssl_arm_sources+': [
-          'openssl/crypto/chacha/chacha_vec_arm.S',
-        ],
-      }],
-    ],
     'openssl_arm_defines': [
       'OPENSSL_BN_ASM_GF2m',
       'OPENSSL_BN_ASM_MONT',
diff --git a/chromium/third_party/protobuf/config.h b/chromium/third_party/protobuf/config.h
index affcf55be5f..dcc0041c2fe 100644
--- a/chromium/third_party/protobuf/config.h
+++ b/chromium/third_party/protobuf/config.h
@@ -1,32 +1,31 @@
 /* config.h.  Generated from config.h.in by configure.  */
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
-#if defined(USE_UNORDERED_CONTAINERS)
-
-#define HASH_MAP_H <unordered_map>
-#define HASH_SET_H <unordered_set>
-#define HASH_NAMESPACE std
-#define HASH_MAP_CLASS unordered_map
-#define HASH_SET_CLASS unordered_set
+/* the name of <hash_set> */
+#define HASH_MAP_CLASS hash_map
 
+/* the location of <hash_map> */
+#if defined(USE_STLPORT)
+#define HASH_MAP_H <hash_map>
 #else
+#define HASH_MAP_H <ext/hash_map>
+#endif
 
+/* the namespace of hash_map/hash_set */
 #if defined(USE_STLPORT)
-#define HASH_MAP_H <hash_map>
-#define HASH_SET_H <hash_set>
 #define HASH_NAMESPACE std
 #else
-#define HASH_MAP_H <ext/hash_map>
-#define HASH_SET_H <ext/hash_set>
 #define HASH_NAMESPACE __gnu_cxx
 #endif
 
 /* the name of <hash_set> */
-#define HASH_MAP_CLASS hash_map
-
-/* the name of <hash_set> */
 #define HASH_SET_CLASS hash_set
 
+/* the location of <hash_set> */
+#if defined(USE_STLPORT)
+#define HASH_SET_H <hash_set>
+#else
+#define HASH_SET_H <ext/hash_set>
 #endif
 
 /* Define to 1 if you have the <dlfcn.h> header file. */
diff --git a/chromium/tools/grit/grit/node/misc.py b/chromium/tools/grit/grit/node/misc.py
index 3daf89cfbae..345081f5a26 100755
--- a/chromium/tools/grit/grit/node/misc.py
+++ b/chromium/tools/grit/grit/node/misc.py
@@ -49,7 +49,6 @@ def _ReadFirstIdsFromFile(filename, defines):
   def ReplaceVariable(matchobj):
     for key, value in defines.iteritems():
       if matchobj.group(1) == key:
-        value = os.path.abspath(value)
         return value
     return ''
 
@@ -432,11 +431,6 @@ class GritNode(base.Node):
         abs_filename = os.path.abspath(filename_or_stream)
         if abs_filename[:len(src_root_dir)] != src_root_dir:
           filename = os.path.basename(filename_or_stream)
-          # If the file is not within src_root_dir and the basename is not
-          # found as a key, fall back to using the absolute file name.
-          if not filename in first_ids:
-            filename = abs_filename
-            filename = filename.replace('\\', '/')
         else:
           filename = abs_filename[len(src_root_dir) + 1:]
           filename = filename.replace('\\', '/')
diff --git a/chromium/tools/gyp/pylib/gyp/generator/ninja.py b/chromium/tools/gyp/pylib/gyp/generator/ninja.py
index 909c8d820b7..a40c7fe2464 100644
--- a/chromium/tools/gyp/pylib/gyp/generator/ninja.py
+++ b/chromium/tools/gyp/pylib/gyp/generator/ninja.py
@@ -1101,49 +1101,6 @@ class NinjaWriter:
       else:
         command = command + '_notoc'
 
-      if config.get('let_qmake_do_the_linking', 0):
-        def toAbsPaths(paths):
-          return [os.path.relpath(path, self.toplevel_build) if os.path.isabs(path) else path
-                  for path in paths]
-        def qmakeLiteral(s):
-          return s.replace('"', '\\"')
-
-        # Generate this file for all solink targets, this assumes that
-        # a .pro file will pick up this pri file and do the rest of the work.
-        pri_file = open(os.path.join(self.toplevel_build, self.name + "_linking.pri"), 'w')
-
-        if self.flavor == 'win':
-          # qmake will take care of the manifest
-          ldflags = filter(lambda x: not x.lower().startswith('/manifest'), ldflags)
-
-        # Replace "$!PRODUCT_DIR" with "$$PWD" in link flags (which might contain some -L directives).
-        prefixed_lflags = [self.ExpandSpecial(f, '$$PWD') for f in ldflags]
-        prefixed_library_dirs = ['-L' + self.ExpandSpecial(f, '$$PWD') for f in config.get('library_dirs', [])]
-        prefixed_libraries = gyp.common.uniquer([self.ExpandSpecial(f, '$$PWD') for f in spec.get('libraries', [])])
-        if self.flavor == 'mac':
-          prefixed_libraries = self.xcode_settings.AdjustLibraries(prefixed_libraries)
-        elif self.flavor == 'win':
-          prefixed_libraries = self.msvs_settings.AdjustLibraries(prefixed_libraries)
-
-        # Make sure that we have relative paths to our out/(Release|Debug), where we generate our .pri file, and then prepend $$PWD to them.
-        prefixed_object_and_archives = ['$$PWD/' + o for o in toAbsPaths(link_deps)]
-
-        pri_file.write("QMAKE_LFLAGS += %s\n" % qmakeLiteral(' '.join(prefixed_lflags)))
-        # Follow the logic of the solink rule.
-        if self.flavor != 'mac' and self.flavor != 'win':
-          pri_file.write("LIBS_PRIVATE += -Wl,--whole-archive %s -Wl,--no-whole-archive\n" % qmakeLiteral(' '.join(prefixed_object_and_archives)))
-        else:
-          pri_file.write("LIBS_PRIVATE += %s\n" % qmakeLiteral(' '.join(prefixed_object_and_archives)))
-        # External libs have to come after objects/archives, the linker resolve them in order.
-        pri_file.write("LIBS_PRIVATE += %s\n" % qmakeLiteral(' '.join(prefixed_library_dirs + prefixed_libraries)))
-        # Make sure that if ninja modifies one of the inputs, qmake/make will link again.
-        pri_file.write("POST_TARGETDEPS += %s\n" % qmakeLiteral(' '.join(prefixed_object_and_archives)))
-        pri_file.close()
-
-        # In this mode we prevent letting ninja link at all.
-        command = 'phony'
-        command_suffix = ''
-
     if len(solibs):
       extra_bindings.append(('solibs', gyp.common.EncodePOSIXShellList(solibs)))
 
@@ -1516,13 +1473,8 @@ def CalculateVariables(default_variables, params):
     default_variables.setdefault('SHARED_LIB_SUFFIX', '.so')
     default_variables.setdefault('SHARED_LIB_DIR',
                                  os.path.join('$!PRODUCT_DIR', 'lib'))
-    # Take into account the fact that toplevel_dir might not be equal to depth
-    toplevel_offset = ''
-    if 'options' in params:
-      options = params['options']
-      toplevel_offset = os.path.relpath(options.depth, options.toplevel_dir)
     default_variables.setdefault('LIB_DIR',
-                                 os.path.join('$!PRODUCT_DIR', 'obj', toplevel_offset))
+                                 os.path.join('$!PRODUCT_DIR', 'obj'))
 
 def ComputeOutputDir(params):
   """Returns the path from the toplevel_dir to the build output directory."""
diff --git a/chromium/tools/gyp/pylib/gyp/xcode_emulation.py b/chromium/tools/gyp/pylib/gyp/xcode_emulation.py
index 31191da432c..5e50f10df8e 100644
--- a/chromium/tools/gyp/pylib/gyp/xcode_emulation.py
+++ b/chromium/tools/gyp/pylib/gyp/xcode_emulation.py
@@ -609,9 +609,6 @@ class XcodeSettings(object):
     for ldflag in self._Settings().get('OTHER_LDFLAGS', []):
       ldflags.append(self._MapLinkerFlagFilename(ldflag, gyp_to_build_path))
 
-    if self._Test('USE_LIBCPP', 'YES', default='NO'):
-      ldflags.append('-stdlib=libc++')
-
     if self._Test('DEAD_CODE_STRIPPING', 'YES', default='NO'):
       ldflags.append('-Wl,-dead_strip')
 
diff --git a/chromium/tools/metrics/histograms/histograms.xml b/chromium/tools/metrics/histograms/histograms.xml
index b3d10545612..d4fc0cab5d8 100644
--- a/chromium/tools/metrics/histograms/histograms.xml
+++ b/chromium/tools/metrics/histograms/histograms.xml
@@ -5493,6 +5493,21 @@ other types of suffix sets.
   <summary>Events in Google Now component extension.</summary>
 </histogram>
 
+<histogram name="GoogleUpdate.EffectivePolicy" enum="UpdatePolicy">
+  <summary>
+    The effective update policy for Chrome on Windows. Recorded once per startup
+    (following a 45 seconds delay).
+  </summary>
+</histogram>
+
+<histogram name="GoogleUpdate.UpdatePolicyIsOverridden" enum="Boolean">
+  <summary>
+    True if the effective update policy for Chrome on Windows is the result of
+    an app-specific override; false if it is the default for all apps. Recorded
+    once per startup (following a 45 seconds delay).
+  </summary>
+</histogram>
+
 <histogram name="GPU.AcceleratedSurfaceRefreshRate" units="hz">
   <summary>
     Refresh rate of the display in Hz.  This is recorded every time we present a
@@ -30797,6 +30812,13 @@ other types of suffix sets.
   <int value="2" label="Forced Full"/>
 </enum>
 
+<enum name="UpdatePolicy" type="int">
+  <int value="0" label="UPDATES_DISABLED"/>
+  <int value="1" label="AUTOMATIC_UPDATES"/>
+  <int value="2" label="MANUAL_UPDATES_ONLY"/>
+  <int value="3" label="AUTO_UPDATES_ONLY"/>
+</enum>
+
 <enum name="UrlResolutionResult" type="int">
   <int value="0" label="Absolute URL"/>
   <int value="1" label="Resolutions Differ"/>
diff --git a/chromium/ui/aura/aura.gyp b/chromium/ui/aura/aura.gyp
index 139e0469ef2..68164d4321a 100644
--- a/chromium/ui/aura/aura.gyp
+++ b/chromium/ui/aura/aura.gyp
@@ -243,6 +243,7 @@
       'type': 'executable',
       'dependencies': [
         '../../base/base.gyp:test_support_base',
+        '../../chrome/chrome_resources.gyp:packed_resources',
         '../../skia/skia.gyp:skia',
         '../../testing/gtest.gyp:gtest',
         '../compositor/compositor.gyp:compositor',
diff --git a/chromium/ui/base/clipboard/clipboard.h b/chromium/ui/base/clipboard/clipboard.h
index 5cf936cdd6f..f818bd6a6df 100644
--- a/chromium/ui/base/clipboard/clipboard.h
+++ b/chromium/ui/base/clipboard/clipboard.h
@@ -88,7 +88,6 @@ class UI_EXPORT Clipboard : NON_EXPORTED_BASE(public base::ThreadChecker) {
     bool operator<(const FormatType& other) const;
 #endif
 
-#if !defined(TOOLKIT_QT)
 #if defined(OS_WIN)
     const FORMATETC& ToFormatEtc() const { return data_; }
 #elif defined(OS_MACOSX)
@@ -98,15 +97,12 @@ class UI_EXPORT Clipboard : NON_EXPORTED_BASE(public base::ThreadChecker) {
 #elif defined(USE_AURA)
     const std::string& ToString() const { return data_; }
 #endif
-#else
-    const std::string& ToString() const { return data_; }
-#endif // !defined(TOOLKIT_QT)
+
+    bool Equals(const FormatType& other) const;
 
    private:
     friend class Clipboard;
 
-    bool Equals(const FormatType& other) const;
-
     // Platform-specific glue used internally by the Clipboard class. Each
     // plaform should define,at least one of each of the following:
     // 1. A constructor that wraps that native clipboard format descriptor.
@@ -115,10 +111,7 @@ class UI_EXPORT Clipboard : NON_EXPORTED_BASE(public base::ThreadChecker) {
     //
     // Note that in some cases, the accessor for the wrapped descriptor may be
     // public, as these format types can be used by drag and drop code as well.
-#if defined(TOOLKIT_QT)
-    explicit FormatType(const std::string& native_format);
-    std::string data_;
-#elif defined(OS_WIN)
+#if defined(OS_WIN)
     explicit FormatType(UINT native_format);
     FormatType(UINT native_format, LONG index);
     UINT ToUINT() const { return data_.cfFormat; }
@@ -346,7 +339,7 @@ class UI_EXPORT Clipboard : NON_EXPORTED_BASE(public base::ThreadChecker) {
   void WriteData(const FormatType& format,
                  const char* data_data,
                  size_t data_len);
-#if !defined(TOOLKIT_QT) && defined(OS_WIN)
+#if defined(OS_WIN)
   void WriteBitmapFromHandle(HBITMAP source_hbitmap,
                              const gfx::Size& size);
 
diff --git a/chromium/ui/base/clipboard/clipboard_mac.mm b/chromium/ui/base/clipboard/clipboard_mac.mm
index 8aee1d3bbfa..c4b69e804ef 100644
--- a/chromium/ui/base/clipboard/clipboard_mac.mm
+++ b/chromium/ui/base/clipboard/clipboard_mac.mm
@@ -70,6 +70,10 @@ Clipboard::FormatType& Clipboard::FormatType::operator=(
   return *this;
 }
 
+bool Clipboard::FormatType::Equals(const FormatType& other) const {
+  return [data_ isEqualToString:other.data_];
+}
+
 Clipboard::FormatType::~FormatType() {
   [data_ release];
 }
diff --git a/chromium/ui/base/clipboard/clipboard_win.cc b/chromium/ui/base/clipboard/clipboard_win.cc
index 92632c74a96..24875aae013 100644
--- a/chromium/ui/base/clipboard/clipboard_win.cc
+++ b/chromium/ui/base/clipboard/clipboard_win.cc
@@ -203,6 +203,10 @@ bool Clipboard::FormatType::operator<(const FormatType& other) const {
   return ToUINT() < other.ToUINT();
 }
 
+bool Clipboard::FormatType::Equals(const FormatType& other) const {
+  return ToUINT() == other.ToUINT();
+}
+
 Clipboard::Clipboard() {
   if (base::MessageLoop::current()->type() == base::MessageLoop::TYPE_UI)
     clipboard_owner_.reset(new base::win::MessageWindow());
diff --git a/chromium/ui/compositor/test/test_compositor_host_ozone.cc b/chromium/ui/compositor/test/test_compositor_host_ozone.cc
new file mode 100644
index 00000000000..78431bee417
--- /dev/null
+++ b/chromium/ui/compositor/test/test_compositor_host_ozone.cc
@@ -0,0 +1,69 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/compositor/test/test_compositor_host.h"
+
+#include "base/basictypes.h"
+#include "base/bind.h"
+#include "base/compiler_specific.h"
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "ui/compositor/compositor.h"
+#include "ui/gfx/rect.h"
+
+namespace ui {
+
+class TestCompositorHostOzone : public TestCompositorHost {
+ public:
+  TestCompositorHostOzone(const gfx::Rect& bounds);
+  virtual ~TestCompositorHostOzone();
+
+ private:
+  // Overridden from TestCompositorHost:
+  virtual void Show() OVERRIDE;
+  virtual ui::Compositor* GetCompositor() OVERRIDE;
+
+  void Draw();
+
+  gfx::Rect bounds_;
+
+  scoped_ptr<ui::Compositor> compositor_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestCompositorHostOzone);
+};
+
+TestCompositorHostOzone::TestCompositorHostOzone(const gfx::Rect& bounds)
+    : bounds_(bounds) {}
+
+TestCompositorHostOzone::~TestCompositorHostOzone() {}
+
+void TestCompositorHostOzone::Show() {
+  // Ozone should rightly have a backing native framebuffer
+  // An in-memory array draw into by OSMesa is a reasonble
+  // fascimile of a dumb framebuffer at present.
+  // GLSurface will allocate the array so long as it is provided
+  // with a non-0 widget.
+  // TODO(rjkroege): Use a "real" ozone widget when it is
+  // available: http://crbug.com/255128
+  compositor_.reset(new ui::Compositor(1));
+  compositor_->SetScaleAndSize(1.0f, bounds_.size());
+}
+
+ui::Compositor* TestCompositorHostOzone::GetCompositor() {
+  return compositor_.get();
+}
+
+void TestCompositorHostOzone::Draw() {
+  if (compositor_.get())
+    compositor_->Draw();
+}
+
+// static
+TestCompositorHost* TestCompositorHost::Create(const gfx::Rect& bounds) {
+  return new TestCompositorHostOzone(bounds);
+}
+
+}  // namespace ui
diff --git a/chromium/ui/events/event.cc b/chromium/ui/events/event.cc
index 39d2b9a57f9..246e39721f2 100644
--- a/chromium/ui/events/event.cc
+++ b/chromium/ui/events/event.cc
@@ -273,13 +273,7 @@ void LocatedEvent::UpdateForRootTransform(
 MouseEvent::MouseEvent(const base::NativeEvent& native_event)
     : LocatedEvent(native_event),
       changed_button_flags_(
-// GetChangedMouseButtonFlagsFromNative isn't implemented on Mac. MouseEvent shouldn't be used.
-#if !defined(OS_MACOSX)
-          GetChangedMouseButtonFlagsFromNative(native_event)
-#else
-          0
-#endif
-      ) {
+          GetChangedMouseButtonFlagsFromNative(native_event)) {
   if (type() == ET_MOUSE_PRESSED || type() == ET_MOUSE_RELEASED)
     SetClickCount(GetRepeatCount(*this));
 }
@@ -644,8 +638,6 @@ void TranslatedKeyEvent::ConvertToKeyEvent() {
 
 ScrollEvent::ScrollEvent(const base::NativeEvent& native_event)
     : MouseEvent(native_event) {
-// GetScrollOffsets and GetFlingData aren't implemented on Mac. ScrollEvent shouldn't be used.
-#if !defined(OS_MACOSX)
   if (type() == ET_SCROLL) {
     GetScrollOffsets(native_event,
                      &x_offset_, &y_offset_,
@@ -657,9 +649,7 @@ ScrollEvent::ScrollEvent(const base::NativeEvent& native_event)
                  &x_offset_, &y_offset_,
                  &x_offset_ordinal_, &y_offset_ordinal_,
                  NULL);
-  } else
-#endif
-  {
+  } else {
     NOTREACHED() << "Unexpected event type " << type()
         << " when constructing a ScrollEvent.";
   }
diff --git a/chromium/ui/gl/gl_share_group.cc b/chromium/ui/gl/gl_share_group.cc
index 347873dc3ab..8e8958b49a4 100644
--- a/chromium/ui/gl/gl_share_group.cc
+++ b/chromium/ui/gl/gl_share_group.cc
@@ -18,9 +18,6 @@ GLShareGroup::GLShareGroup()
 }
 
 void GLShareGroup::AddContext(GLContext* context) {
-  if (contexts_.empty())
-    AboutToAddFirstContext();
-
   contexts_.insert(context);
 }
 
diff --git a/chromium/ui/gl/gl_share_group.h b/chromium/ui/gl/gl_share_group.h
index f1b03690f34..1deed63c541 100644
--- a/chromium/ui/gl/gl_share_group.h
+++ b/chromium/ui/gl/gl_share_group.h
@@ -31,7 +31,7 @@ class GL_EXPORT GLShareGroup : public base::RefCounted<GLShareGroup> {
 
   // Returns a pointer to any initialized context in the share group
   // or NULL if there are no initialized contexts in the share group.
-  virtual GLContext* GetContext();
+  GLContext* GetContext();
 
   // Sets and returns the unique shared GL context. Used for context
   // virtualization.
@@ -45,13 +45,10 @@ class GL_EXPORT GLShareGroup : public base::RefCounted<GLShareGroup> {
   int GetRendererID();
 #endif
 
- protected:
-  virtual ~GLShareGroup();
-  virtual void AboutToAddFirstContext() { }
-
  private:
   friend class base::RefCounted<GLShareGroup>;
 
+  ~GLShareGroup();
 
   // References to GLContext are by raw pointer to avoid a reference count
   // cycle.
diff --git a/chromium/ui/ui.gyp b/chromium/ui/ui.gyp
index aa0f3be2fb6..5d61dc44043 100644
--- a/chromium/ui/ui.gyp
+++ b/chromium/ui/ui.gyp
@@ -350,7 +350,7 @@
             ],
           },
         }],
-        ['toolkit_views==1 or use_qt==1', {
+        ['toolkit_views==1', {
           'dependencies': [
             'events/events.gyp:events',
           ],
diff --git a/chromium/v8/build/toolchain.gypi b/chromium/v8/build/toolchain.gypi
index 2dc3c04e1f1..99f357a965a 100644
--- a/chromium/v8/build/toolchain.gypi
+++ b/chromium/v8/build/toolchain.gypi
@@ -444,7 +444,7 @@
               ['v8_optimized_debug==0', {
                 'Optimization': '0',
                 'conditions': [
-                  ['component=="shared_library" or use_qt==1', {
+                  ['component=="shared_library"', {
                     'RuntimeLibrary': '3',  # /MDd
                   }, {
                     'RuntimeLibrary': '1',  # /MTd
@@ -459,7 +459,7 @@
                 'StringPooling': 'true',
                 'BasicRuntimeChecks': '0',
                 'conditions': [
-                  ['component=="shared_library" or use_qt==1', {
+                  ['component=="shared_library"', {
                     'RuntimeLibrary': '3',  # /MDd
                   }, {
                     'RuntimeLibrary': '1',  # /MTd
@@ -474,7 +474,7 @@
                 'StringPooling': 'true',
                 'BasicRuntimeChecks': '0',
                 'conditions': [
-                  ['component=="shared_library" or use_qt==1', {
+                  ['component=="shared_library"', {
                     'RuntimeLibrary': '3',  #/MDd
                   }, {
                     'RuntimeLibrary': '1',  #/MTd
@@ -666,7 +666,7 @@
                 'FavorSizeOrSpeed': '0',
                 'StringPooling': 'true',
                 'conditions': [
-                  ['component=="shared_library" or use_qt==1', {
+                  ['component=="shared_library"', {
                     'RuntimeLibrary': '2',  #/MD
                   }, {
                     'RuntimeLibrary': '0',  #/MT
diff --git a/chromium/v8/src/arm/lithium-arm.cc b/chromium/v8/src/arm/lithium-arm.cc
index 6119b248810..0b7a02eb664 100644
--- a/chromium/v8/src/arm/lithium-arm.cc
+++ b/chromium/v8/src/arm/lithium-arm.cc
@@ -631,15 +631,6 @@ LInstruction* LChunkBuilder::MarkAsCall(LInstruction* instr,
   instr->MarkAsCall();
   instr = AssignPointerMap(instr);
 
-  if (hinstr->HasObservableSideEffects()) {
-    ASSERT(hinstr->next()->IsSimulate());
-    HSimulate* sim = HSimulate::cast(hinstr->next());
-    ASSERT(instruction_pending_deoptimization_environment_ == NULL);
-    ASSERT(pending_deoptimization_ast_id_.IsNone());
-    instruction_pending_deoptimization_environment_ = instr;
-    pending_deoptimization_ast_id_ = sim->ast_id();
-  }
-
   // If instruction does not have side-effects lazy deoptimization
   // after the call will try to deoptimize to the point before the call.
   // Thus we still need to attach environment to this call even if
@@ -921,6 +912,26 @@ void LChunkBuilder::VisitInstruction(HInstruction* current) {
       instr = AssignEnvironment(instr);
     }
     chunk_->AddInstruction(instr, current_block_);
+
+    if (instr->IsCall()) {
+      HValue* hydrogen_value_for_lazy_bailout = current;
+      LInstruction* instruction_needing_environment = NULL;
+      if (current->HasObservableSideEffects()) {
+        HSimulate* sim = HSimulate::cast(current->next());
+        instruction_needing_environment = instr;
+        sim->ReplayEnvironment(current_block_->last_environment());
+        hydrogen_value_for_lazy_bailout = sim;
+      }
+      LInstruction* bailout = AssignEnvironment(new(zone()) LLazyBailout());
+      bailout->set_hydrogen_value(hydrogen_value_for_lazy_bailout);
+      chunk_->AddInstruction(bailout, current_block_);
+      if (instruction_needing_environment != NULL) {
+        // Store the lazy deopt environment with the instruction if needed.
+        // Right now it is only used for LInstanceOfKnownGlobal.
+        instruction_needing_environment->
+            SetDeferredLazyDeoptimizationEnvironment(bailout->environment());
+      }
+    }
   }
   current_instruction_ = old_current;
 }
@@ -2579,21 +2590,6 @@ LInstruction* LChunkBuilder::DoIsConstructCallAndBranch(
 
 LInstruction* LChunkBuilder::DoSimulate(HSimulate* instr) {
   instr->ReplayEnvironment(current_block_->last_environment());
-
-  // If there is an instruction pending deoptimization environment create a
-  // lazy bailout instruction to capture the environment.
-  if (pending_deoptimization_ast_id_ == instr->ast_id()) {
-    LInstruction* result = new(zone()) LLazyBailout;
-    result = AssignEnvironment(result);
-    // Store the lazy deopt environment with the instruction if needed. Right
-    // now it is only used for LInstanceOfKnownGlobal.
-    instruction_pending_deoptimization_environment_->
-        SetDeferredLazyDeoptimizationEnvironment(result->environment());
-    instruction_pending_deoptimization_environment_ = NULL;
-    pending_deoptimization_ast_id_ = BailoutId::None();
-    return result;
-  }
-
   return NULL;
 }
 
diff --git a/chromium/v8/src/arm/lithium-arm.h b/chromium/v8/src/arm/lithium-arm.h
index cfafc0645a0..4f420a3d262 100644
--- a/chromium/v8/src/arm/lithium-arm.h
+++ b/chromium/v8/src/arm/lithium-arm.h
@@ -2753,9 +2753,7 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
         next_block_(NULL),
         argument_count_(0),
         allocator_(allocator),
-        position_(RelocInfo::kNoPosition),
-        instruction_pending_deoptimization_environment_(NULL),
-        pending_deoptimization_ast_id_(BailoutId::None()) { }
+        position_(RelocInfo::kNoPosition) { }
 
   // Build the sequence for the graph.
   LPlatformChunk* Build();
@@ -2908,8 +2906,6 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
   int argument_count_;
   LAllocator* allocator_;
   int position_;
-  LInstruction* instruction_pending_deoptimization_environment_;
-  BailoutId pending_deoptimization_ast_id_;
 
   DISALLOW_COPY_AND_ASSIGN(LChunkBuilder);
 };
diff --git a/chromium/v8/src/arm/lithium-codegen-arm.cc b/chromium/v8/src/arm/lithium-codegen-arm.cc
index 56990ca2284..0a3f043bc76 100644
--- a/chromium/v8/src/arm/lithium-codegen-arm.cc
+++ b/chromium/v8/src/arm/lithium-codegen-arm.cc
@@ -259,6 +259,13 @@ void LCodeGen::GenerateOsrPrologue() {
 }
 
 
+void LCodeGen::GenerateBodyInstructionPre(LInstruction* instr) {
+  if (!instr->IsLazyBailout() && !instr->IsGap()) {
+    safepoints_.BumpLastLazySafepointIndex();
+  }
+}
+
+
 bool LCodeGen::GenerateDeferredCode() {
   ASSERT(is_generating());
   if (deferred_.length() > 0) {
@@ -2190,7 +2197,6 @@ void LCodeGen::DoArithmeticT(LArithmeticT* instr) {
   // is in the correct position.
   Assembler::BlockConstPoolScope block_const_pool(masm());
   CallCode(stub.GetCode(isolate()), RelocInfo::CODE_TARGET, instr);
-  __ nop();  // Signals no inlined code.
 }
 
 
diff --git a/chromium/v8/src/arm/lithium-codegen-arm.h b/chromium/v8/src/arm/lithium-codegen-arm.h
index 3f2ba35899a..de27a36fdcb 100644
--- a/chromium/v8/src/arm/lithium-codegen-arm.h
+++ b/chromium/v8/src/arm/lithium-codegen-arm.h
@@ -191,6 +191,7 @@ class LCodeGen: public LCodeGenBase {
 
   // Code generation passes.  Returns true if code generation should
   // continue.
+  void GenerateBodyInstructionPre(LInstruction* instr) V8_OVERRIDE;
   bool GeneratePrologue();
   bool GenerateDeferredCode();
   bool GenerateDeoptJumpTable();
diff --git a/chromium/v8/src/arraybuffer.js b/chromium/v8/src/arraybuffer.js
index 6125f0f61cb..cfaa8d7efca 100644
--- a/chromium/v8/src/arraybuffer.js
+++ b/chromium/v8/src/arraybuffer.js
@@ -57,17 +57,18 @@ function ArrayBufferSlice(start, end) {
 
   var relativeStart = TO_INTEGER(start);
   var first;
+  var byte_length = %ArrayBufferGetByteLength(this);
   if (relativeStart < 0) {
-    first = MathMax(this.byteLength + relativeStart, 0);
+    first = MathMax(byte_length + relativeStart, 0);
   } else {
-    first = MathMin(relativeStart, this.byteLength);
+    first = MathMin(relativeStart, byte_length);
   }
-  var relativeEnd = IS_UNDEFINED(end) ? this.byteLength : TO_INTEGER(end);
+  var relativeEnd = IS_UNDEFINED(end) ? byte_length : TO_INTEGER(end);
   var fin;
   if (relativeEnd < 0) {
-    fin = MathMax(this.byteLength + relativeEnd, 0);
+    fin = MathMax(byte_length + relativeEnd, 0);
   } else {
-    fin = MathMin(relativeEnd, this.byteLength);
+    fin = MathMin(relativeEnd, byte_length);
   }
 
   if (fin < first) {
diff --git a/chromium/v8/src/cpu.cc b/chromium/v8/src/cpu.cc
index e67b397f917..2bf51a7f6c0 100644
--- a/chromium/v8/src/cpu.cc
+++ b/chromium/v8/src/cpu.cc
@@ -380,12 +380,10 @@ CPU::CPU() : stepping_(0),
     // ARMv6 device that reports architecture 7.
     if (architecture_ == 7) {
       char* processor = cpu_info.ExtractField("Processor");
-      char* model_name = cpu_info.ExtractField("model name");
-      if (HasListItem(processor, "(v6l)") || HasListItem(model_name, "(v6l)")) {
+      if (HasListItem(processor, "(v6l)")) {
         architecture_ = 6;
       }
       delete[] processor;
-      delete[] model_name;
     }
   }
 
diff --git a/chromium/v8/src/deoptimizer.cc b/chromium/v8/src/deoptimizer.cc
index 76f2fa9bd76..6c3100a6381 100644
--- a/chromium/v8/src/deoptimizer.cc
+++ b/chromium/v8/src/deoptimizer.cc
@@ -393,9 +393,33 @@ void Deoptimizer::DeoptimizeMarkedCodeForContext(Context* context) {
     element = next;
   }
 
+#ifdef DEBUG
+  // Make sure all activations of optimized code can deopt at their current PC.
+  for (StackFrameIterator it(isolate, isolate->thread_local_top());
+       !it.done(); it.Advance()) {
+    StackFrame::Type type = it.frame()->type();
+    if (type == StackFrame::OPTIMIZED) {
+      Code* code = it.frame()->LookupCode();
+      if (FLAG_trace_deopt) {
+        JSFunction* function =
+            static_cast<OptimizedFrame*>(it.frame())->function();
+        CodeTracer::Scope scope(isolate->GetCodeTracer());
+        PrintF(scope.file(), "[deoptimizer patches for lazy deopt: ");
+        function->PrintName(scope.file());
+        PrintF(scope.file(),
+               " / %" V8PRIxPTR "]\n", reinterpret_cast<intptr_t>(function));
+      }
+      SafepointEntry safepoint = code->GetSafepointEntry(it.frame()->pc());
+      int deopt_index = safepoint.deoptimization_index();
+      CHECK(deopt_index != Safepoint::kNoDeoptimizationIndex);
+    }
+  }
+#endif
+
   // TODO(titzer): we need a handle scope only because of the macro assembler,
   // which is only used in EnsureCodeForDeoptimizationEntry.
   HandleScope scope(isolate);
+
   // Now patch all the codes for deoptimization.
   for (int i = 0; i < codes.length(); i++) {
     // It is finally time to die, code object.
diff --git a/chromium/v8/src/heap.cc b/chromium/v8/src/heap.cc
index 1e9091b30d8..d9dc8c19b07 100644
--- a/chromium/v8/src/heap.cc
+++ b/chromium/v8/src/heap.cc
@@ -561,6 +561,9 @@ void Heap::GarbageCollectionEpilogue() {
   if (FLAG_code_stats) ReportCodeStatistics("After GC");
 #endif
   if (FLAG_deopt_every_n_garbage_collections > 0) {
+    // TODO(jkummerow/ulan/jarin): This is not safe! We can't assume that
+    // the topmost optimized frame can be deoptimized safely, because it
+    // might not have a lazy bailout point right after its current PC.
     if (++gcs_since_last_deopt_ == FLAG_deopt_every_n_garbage_collections) {
       Deoptimizer::DeoptimizeAll(isolate());
       gcs_since_last_deopt_ = 0;
diff --git a/chromium/v8/src/hydrogen-instructions.cc b/chromium/v8/src/hydrogen-instructions.cc
index d418954aad2..6bf662a638f 100644
--- a/chromium/v8/src/hydrogen-instructions.cc
+++ b/chromium/v8/src/hydrogen-instructions.cc
@@ -2436,6 +2436,7 @@ void HSimulate::PrintDataTo(StringStream* stream) {
 
 
 void HSimulate::ReplayEnvironment(HEnvironment* env) {
+  if (done_with_replay_) return;
   ASSERT(env != NULL);
   env->set_ast_id(ast_id());
   env->Drop(pop_count());
@@ -2447,6 +2448,7 @@ void HSimulate::ReplayEnvironment(HEnvironment* env) {
       env->Push(value);
     }
   }
+  done_with_replay_ = true;
 }
 
 
@@ -2572,7 +2574,11 @@ HConstant::HConstant(int32_t integer_value,
     boolean_value_(integer_value != 0),
     int32_value_(integer_value),
     double_value_(FastI2D(integer_value)) {
-  set_type(has_smi_value_ ? HType::Smi() : HType::TaggedNumber());
+  // It's possible to create a constant with a value in Smi-range but stored
+  // in a (pre-existing) HeapNumber. See crbug.com/349878.
+  bool could_be_heapobject = r.IsTagged() && !object.handle().is_null();
+  bool is_smi = has_smi_value_ && !could_be_heapobject;
+  set_type(is_smi ? HType::Smi() : HType::TaggedNumber());
   Initialize(r);
 }
 
@@ -2592,7 +2598,11 @@ HConstant::HConstant(double double_value,
     int32_value_(DoubleToInt32(double_value)),
     double_value_(double_value) {
   has_smi_value_ = has_int32_value_ && Smi::IsValid(int32_value_);
-  set_type(has_smi_value_ ? HType::Smi() : HType::TaggedNumber());
+  // It's possible to create a constant with a value in Smi-range but stored
+  // in a (pre-existing) HeapNumber. See crbug.com/349878.
+  bool could_be_heapobject = r.IsTagged() && !object.handle().is_null();
+  bool is_smi = has_smi_value_ && !could_be_heapobject;
+  set_type(is_smi ? HType::Smi() : HType::TaggedNumber());
   Initialize(r);
 }
 
@@ -2991,7 +3001,7 @@ void HCompareObjectEqAndBranch::PrintDataTo(StringStream* stream) {
 bool HCompareObjectEqAndBranch::KnownSuccessorBlock(HBasicBlock** block) {
   if (left()->IsConstant() && right()->IsConstant()) {
     bool comparison_result =
-        HConstant::cast(left())->Equals(HConstant::cast(right()));
+        HConstant::cast(left())->DataEquals(HConstant::cast(right()));
     *block = comparison_result
         ? FirstSuccessor()
         : SecondSuccessor();
diff --git a/chromium/v8/src/hydrogen-instructions.h b/chromium/v8/src/hydrogen-instructions.h
index cf83928529c..158e4c103ad 100644
--- a/chromium/v8/src/hydrogen-instructions.h
+++ b/chromium/v8/src/hydrogen-instructions.h
@@ -1802,7 +1802,8 @@ class HSimulate V8_FINAL : public HInstruction {
         values_(2, zone),
         assigned_indexes_(2, zone),
         zone_(zone),
-        removable_(removable) {}
+        removable_(removable),
+        done_with_replay_(false) {}
   ~HSimulate() {}
 
   virtual void PrintDataTo(StringStream* stream) V8_OVERRIDE;
@@ -1885,7 +1886,8 @@ class HSimulate V8_FINAL : public HInstruction {
   ZoneList<HValue*> values_;
   ZoneList<int> assigned_indexes_;
   Zone* zone_;
-  RemovableSimulate removable_;
+  RemovableSimulate removable_ : 2;
+  bool done_with_replay_ : 1;
 
 #ifdef DEBUG
   Handle<JSFunction> closure_;
@@ -3657,15 +3659,6 @@ class HConstant V8_FINAL : public HTemplateInstruction<0> {
     return object_;
   }
 
-#ifdef DEBUG
-  virtual void Verify() V8_OVERRIDE { }
-#endif
-
-  DECLARE_CONCRETE_INSTRUCTION(Constant)
-
- protected:
-  virtual Range* InferRange(Zone* zone) V8_OVERRIDE;
-
   virtual bool DataEquals(HValue* other) V8_OVERRIDE {
     HConstant* other_constant = HConstant::cast(other);
     if (has_int32_value_) {
@@ -3690,6 +3683,15 @@ class HConstant V8_FINAL : public HTemplateInstruction<0> {
     }
   }
 
+#ifdef DEBUG
+  virtual void Verify() V8_OVERRIDE { }
+#endif
+
+  DECLARE_CONCRETE_INSTRUCTION(Constant)
+
+ protected:
+  virtual Range* InferRange(Zone* zone) V8_OVERRIDE;
+
  private:
   friend class HGraph;
   HConstant(Handle<Object> handle, Representation r = Representation::None());
@@ -4335,24 +4337,6 @@ class HCompareMinusZeroAndBranch V8_FINAL : public HUnaryControlInstruction {
 
 class HCompareObjectEqAndBranch : public HTemplateControlInstruction<2, 2> {
  public:
-  HCompareObjectEqAndBranch(HValue* left,
-                            HValue* right,
-                            HBasicBlock* true_target = NULL,
-                            HBasicBlock* false_target = NULL) {
-    // TODO(danno): make this private when the IfBuilder properly constructs
-    // control flow instructions.
-    ASSERT(!left->IsConstant() ||
-           (!HConstant::cast(left)->HasInteger32Value() ||
-            HConstant::cast(left)->HasSmiValue()));
-    ASSERT(!right->IsConstant() ||
-           (!HConstant::cast(right)->HasInteger32Value() ||
-            HConstant::cast(right)->HasSmiValue()));
-    SetOperandAt(0, left);
-    SetOperandAt(1, right);
-    SetSuccessorAt(0, true_target);
-    SetSuccessorAt(1, false_target);
-  }
-
   DECLARE_INSTRUCTION_FACTORY_P2(HCompareObjectEqAndBranch, HValue*, HValue*);
   DECLARE_INSTRUCTION_FACTORY_P4(HCompareObjectEqAndBranch, HValue*, HValue*,
                                  HBasicBlock*, HBasicBlock*);
@@ -4373,6 +4357,23 @@ class HCompareObjectEqAndBranch : public HTemplateControlInstruction<2, 2> {
   }
 
   DECLARE_CONCRETE_INSTRUCTION(CompareObjectEqAndBranch)
+
+ private:
+  HCompareObjectEqAndBranch(HValue* left,
+                            HValue* right,
+                            HBasicBlock* true_target = NULL,
+                            HBasicBlock* false_target = NULL) {
+    ASSERT(!left->IsConstant() ||
+           (!HConstant::cast(left)->HasInteger32Value() ||
+            HConstant::cast(left)->HasSmiValue()));
+    ASSERT(!right->IsConstant() ||
+           (!HConstant::cast(right)->HasInteger32Value() ||
+            HConstant::cast(right)->HasSmiValue()));
+    SetOperandAt(0, left);
+    SetOperandAt(1, right);
+    SetSuccessorAt(0, true_target);
+    SetSuccessorAt(1, false_target);
+  }
 };
 
 
diff --git a/chromium/v8/src/hydrogen.cc b/chromium/v8/src/hydrogen.cc
index cdf69e7c72c..c40d2e77ffc 100644
--- a/chromium/v8/src/hydrogen.cc
+++ b/chromium/v8/src/hydrogen.cc
@@ -7553,11 +7553,12 @@ bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
   HValue* function = Top();
 
   AddCheckConstantFunction(expr->holder(), function, function_map);
-  Drop(1);
 
   CHECK_ALIVE_OR_RETURN(VisitForValue(args->at(0)), true);
   HValue* receiver = Pop();
 
+  Drop(1);  // Pop the function.
+
   if (function_state()->outer() == NULL) {
     HInstruction* elements = Add<HArgumentsElements>(false);
     HInstruction* length = Add<HArgumentsLength>(elements);
diff --git a/chromium/v8/src/ia32/lithium-codegen-ia32.cc b/chromium/v8/src/ia32/lithium-codegen-ia32.cc
index df2d4c5294d..80369516dc8 100644
--- a/chromium/v8/src/ia32/lithium-codegen-ia32.cc
+++ b/chromium/v8/src/ia32/lithium-codegen-ia32.cc
@@ -384,6 +384,9 @@ void LCodeGen::GenerateOsrPrologue() {
 
 
 void LCodeGen::GenerateBodyInstructionPre(LInstruction* instr) {
+  if (!instr->IsLazyBailout() && !instr->IsGap()) {
+    safepoints_.BumpLastLazySafepointIndex();
+  }
   if (!CpuFeatures::IsSupported(SSE2)) FlushX87StackIfNecessary(instr);
 }
 
@@ -2358,7 +2361,6 @@ void LCodeGen::DoArithmeticT(LArithmeticT* instr) {
 
   BinaryOpICStub stub(instr->op(), NO_OVERWRITE);
   CallCode(stub.GetCode(isolate()), RelocInfo::CODE_TARGET, instr);
-  __ nop();  // Signals no inlined code.
 }
 
 
diff --git a/chromium/v8/src/ia32/lithium-ia32.cc b/chromium/v8/src/ia32/lithium-ia32.cc
index aa35e9d6b40..5c92580c354 100644
--- a/chromium/v8/src/ia32/lithium-ia32.cc
+++ b/chromium/v8/src/ia32/lithium-ia32.cc
@@ -696,15 +696,6 @@ LInstruction* LChunkBuilder::MarkAsCall(LInstruction* instr,
   instr->MarkAsCall();
   instr = AssignPointerMap(instr);
 
-  if (hinstr->HasObservableSideEffects()) {
-    ASSERT(hinstr->next()->IsSimulate());
-    HSimulate* sim = HSimulate::cast(hinstr->next());
-    ASSERT(instruction_pending_deoptimization_environment_ == NULL);
-    ASSERT(pending_deoptimization_ast_id_.IsNone());
-    instruction_pending_deoptimization_environment_ = instr;
-    pending_deoptimization_ast_id_ = sim->ast_id();
-  }
-
   // If instruction does not have side-effects lazy deoptimization
   // after the call will try to deoptimize to the point before the call.
   // Thus we still need to attach environment to this call even if
@@ -995,6 +986,26 @@ void LChunkBuilder::VisitInstruction(HInstruction* current) {
       chunk_->AddInstruction(clobber, current_block_);
     }
     chunk_->AddInstruction(instr, current_block_);
+
+    if (instr->IsCall()) {
+      HValue* hydrogen_value_for_lazy_bailout = current;
+      LInstruction* instruction_needing_environment = NULL;
+      if (current->HasObservableSideEffects()) {
+        HSimulate* sim = HSimulate::cast(current->next());
+        instruction_needing_environment = instr;
+        sim->ReplayEnvironment(current_block_->last_environment());
+        hydrogen_value_for_lazy_bailout = sim;
+      }
+      LInstruction* bailout = AssignEnvironment(new(zone()) LLazyBailout());
+      bailout->set_hydrogen_value(hydrogen_value_for_lazy_bailout);
+      chunk_->AddInstruction(bailout, current_block_);
+      if (instruction_needing_environment != NULL) {
+        // Store the lazy deopt environment with the instruction if needed.
+        // Right now it is only used for LInstanceOfKnownGlobal.
+        instruction_needing_environment->
+            SetDeferredLazyDeoptimizationEnvironment(bailout->environment());
+      }
+    }
   }
   current_instruction_ = old_current;
 }
@@ -2692,22 +2703,6 @@ LInstruction* LChunkBuilder::DoIsConstructCallAndBranch(
 
 LInstruction* LChunkBuilder::DoSimulate(HSimulate* instr) {
   instr->ReplayEnvironment(current_block_->last_environment());
-
-  // If there is an instruction pending deoptimization environment create a
-  // lazy bailout instruction to capture the environment.
-  if (!pending_deoptimization_ast_id_.IsNone()) {
-    ASSERT(pending_deoptimization_ast_id_ == instr->ast_id());
-    LLazyBailout* lazy_bailout = new(zone()) LLazyBailout;
-    LInstruction* result = AssignEnvironment(lazy_bailout);
-    // Store the lazy deopt environment with the instruction if needed. Right
-    // now it is only used for LInstanceOfKnownGlobal.
-    instruction_pending_deoptimization_environment_->
-        SetDeferredLazyDeoptimizationEnvironment(result->environment());
-    instruction_pending_deoptimization_environment_ = NULL;
-    pending_deoptimization_ast_id_ = BailoutId::None();
-    return result;
-  }
-
   return NULL;
 }
 
diff --git a/chromium/v8/src/ia32/lithium-ia32.h b/chromium/v8/src/ia32/lithium-ia32.h
index ea4fef8a710..c865d8d0e9a 100644
--- a/chromium/v8/src/ia32/lithium-ia32.h
+++ b/chromium/v8/src/ia32/lithium-ia32.h
@@ -2767,9 +2767,7 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
         current_block_(NULL),
         next_block_(NULL),
         argument_count_(0),
-        allocator_(allocator),
-        instruction_pending_deoptimization_environment_(NULL),
-        pending_deoptimization_ast_id_(BailoutId::None()) { }
+        allocator_(allocator) { }
 
   // Build the sequence for the graph.
   LPlatformChunk* Build();
@@ -2931,8 +2929,6 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
   HBasicBlock* next_block_;
   int argument_count_;
   LAllocator* allocator_;
-  LInstruction* instruction_pending_deoptimization_environment_;
-  BailoutId pending_deoptimization_ast_id_;
 
   DISALLOW_COPY_AND_ASSIGN(LChunkBuilder);
 };
diff --git a/chromium/v8/src/ic.cc b/chromium/v8/src/ic.cc
index fc1ca53290e..cd508707e7f 100644
--- a/chromium/v8/src/ic.cc
+++ b/chromium/v8/src/ic.cc
@@ -1746,14 +1746,15 @@ Handle<Code> KeyedStoreIC::StoreElementStub(Handle<JSObject> receiver,
       transitioned_receiver_map =
           ComputeTransitionedMap(receiver, store_mode);
     }
-    if (IsTransitionOfMonomorphicTarget(MapToType(transitioned_receiver_map))) {
+    if (receiver_map.is_identical_to(previous_receiver_map) ||
+        IsTransitionOfMonomorphicTarget(MapToType(transitioned_receiver_map))) {
       // Element family is the same, use the "worst" case map.
       store_mode = GetNonTransitioningStoreMode(store_mode);
       return isolate()->stub_cache()->ComputeKeyedStoreElement(
           transitioned_receiver_map, strict_mode(), store_mode);
     } else if (*previous_receiver_map == receiver->map() &&
                old_store_mode == STANDARD_STORE &&
-               (IsGrowStoreMode(store_mode) ||
+               (store_mode == STORE_AND_GROW_NO_TRANSITION ||
                 store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
                 store_mode == STORE_NO_TRANSITION_HANDLE_COW)) {
       // A "normal" IC that handles stores can switch to a version that can
diff --git a/chromium/v8/src/mips/lithium-codegen-mips.cc b/chromium/v8/src/mips/lithium-codegen-mips.cc
index 3bf0d130829..423ff9f5058 100644
--- a/chromium/v8/src/mips/lithium-codegen-mips.cc
+++ b/chromium/v8/src/mips/lithium-codegen-mips.cc
@@ -256,6 +256,13 @@ void LCodeGen::GenerateOsrPrologue() {
 }
 
 
+void LCodeGen::GenerateBodyInstructionPre(LInstruction* instr) {
+  if (!instr->IsLazyBailout() && !instr->IsGap()) {
+    safepoints_.BumpLastLazySafepointIndex();
+  }
+}
+
+
 bool LCodeGen::GenerateDeferredCode() {
   ASSERT(is_generating());
   if (deferred_.length() > 0) {
diff --git a/chromium/v8/src/mips/lithium-codegen-mips.h b/chromium/v8/src/mips/lithium-codegen-mips.h
index 9fbd336b1e6..71cc34fb8b4 100644
--- a/chromium/v8/src/mips/lithium-codegen-mips.h
+++ b/chromium/v8/src/mips/lithium-codegen-mips.h
@@ -191,6 +191,7 @@ class LCodeGen: public LCodeGenBase {
 
   // Code generation passes.  Returns true if code generation should
   // continue.
+  void GenerateBodyInstructionPre(LInstruction* instr) V8_OVERRIDE;
   bool GeneratePrologue();
   bool GenerateDeferredCode();
   bool GenerateDeoptJumpTable();
diff --git a/chromium/v8/src/mips/lithium-mips.cc b/chromium/v8/src/mips/lithium-mips.cc
index a441ba515a9..0358feeef55 100644
--- a/chromium/v8/src/mips/lithium-mips.cc
+++ b/chromium/v8/src/mips/lithium-mips.cc
@@ -636,15 +636,6 @@ LInstruction* LChunkBuilder::MarkAsCall(LInstruction* instr,
   instr->MarkAsCall();
   instr = AssignPointerMap(instr);
 
-  if (hinstr->HasObservableSideEffects()) {
-    ASSERT(hinstr->next()->IsSimulate());
-    HSimulate* sim = HSimulate::cast(hinstr->next());
-    ASSERT(instruction_pending_deoptimization_environment_ == NULL);
-    ASSERT(pending_deoptimization_ast_id_.IsNone());
-    instruction_pending_deoptimization_environment_ = instr;
-    pending_deoptimization_ast_id_ = sim->ast_id();
-  }
-
   // If instruction does not have side-effects lazy deoptimization
   // after the call will try to deoptimize to the point before the call.
   // Thus we still need to attach environment to this call even if
@@ -929,6 +920,26 @@ void LChunkBuilder::VisitInstruction(HInstruction* current) {
       instr = AssignEnvironment(instr);
     }
     chunk_->AddInstruction(instr, current_block_);
+
+    if (instr->IsCall()) {
+      HValue* hydrogen_value_for_lazy_bailout = current;
+      LInstruction* instruction_needing_environment = NULL;
+      if (current->HasObservableSideEffects()) {
+        HSimulate* sim = HSimulate::cast(current->next());
+        instruction_needing_environment = instr;
+        sim->ReplayEnvironment(current_block_->last_environment());
+        hydrogen_value_for_lazy_bailout = sim;
+      }
+      LInstruction* bailout = AssignEnvironment(new(zone()) LLazyBailout());
+      bailout->set_hydrogen_value(hydrogen_value_for_lazy_bailout);
+      chunk_->AddInstruction(bailout, current_block_);
+      if (instruction_needing_environment != NULL) {
+        // Store the lazy deopt environment with the instruction if needed.
+        // Right now it is only used for LInstanceOfKnownGlobal.
+        instruction_needing_environment->
+            SetDeferredLazyDeoptimizationEnvironment(bailout->environment());
+      }
+    }
   }
   current_instruction_ = old_current;
 }
@@ -2505,21 +2516,6 @@ LInstruction* LChunkBuilder::DoIsConstructCallAndBranch(
 
 LInstruction* LChunkBuilder::DoSimulate(HSimulate* instr) {
   instr->ReplayEnvironment(current_block_->last_environment());
-
-  // If there is an instruction pending deoptimization environment create a
-  // lazy bailout instruction to capture the environment.
-  if (pending_deoptimization_ast_id_ == instr->ast_id()) {
-    LInstruction* result = new(zone()) LLazyBailout;
-    result = AssignEnvironment(result);
-    // Store the lazy deopt environment with the instruction if needed. Right
-    // now it is only used for LInstanceOfKnownGlobal.
-    instruction_pending_deoptimization_environment_->
-        SetDeferredLazyDeoptimizationEnvironment(result->environment());
-    instruction_pending_deoptimization_environment_ = NULL;
-    pending_deoptimization_ast_id_ = BailoutId::None();
-    return result;
-  }
-
   return NULL;
 }
 
diff --git a/chromium/v8/src/mips/lithium-mips.h b/chromium/v8/src/mips/lithium-mips.h
index dbb78ea0846..8d34399057b 100644
--- a/chromium/v8/src/mips/lithium-mips.h
+++ b/chromium/v8/src/mips/lithium-mips.h
@@ -2729,9 +2729,7 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
         next_block_(NULL),
         argument_count_(0),
         allocator_(allocator),
-        position_(RelocInfo::kNoPosition),
-        instruction_pending_deoptimization_environment_(NULL),
-        pending_deoptimization_ast_id_(BailoutId::None()) { }
+        position_(RelocInfo::kNoPosition) { }
 
   // Build the sequence for the graph.
   LPlatformChunk* Build();
@@ -2883,8 +2881,6 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
   int argument_count_;
   LAllocator* allocator_;
   int position_;
-  LInstruction* instruction_pending_deoptimization_environment_;
-  BailoutId pending_deoptimization_ast_id_;
 
   DISALLOW_COPY_AND_ASSIGN(LChunkBuilder);
 };
diff --git a/chromium/v8/src/runtime.cc b/chromium/v8/src/runtime.cc
index c909f34db17..8333380e83b 100644
--- a/chromium/v8/src/runtime.cc
+++ b/chromium/v8/src/runtime.cc
@@ -980,6 +980,10 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_TypedArrayInitializeFromArrayLike) {
   Runtime::ArrayIdToTypeAndSize(arrayId, &array_type, &element_size);
 
   Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
+  if (source->IsJSTypedArray() &&
+      JSTypedArray::cast(*source)->type() == array_type) {
+    length_obj = Handle<Object>(JSTypedArray::cast(*source)->length(), isolate);
+  }
   size_t length = NumberToSize(isolate, *length_obj);
 
   if ((length > static_cast<unsigned>(Smi::kMaxValue)) ||
diff --git a/chromium/v8/src/safepoint-table.h b/chromium/v8/src/safepoint-table.h
index ea35253ff84..cd094c55bf2 100644
--- a/chromium/v8/src/safepoint-table.h
+++ b/chromium/v8/src/safepoint-table.h
@@ -219,6 +219,9 @@ class SafepointTableBuilder BASE_EMBEDDED {
   // Record deoptimization index for lazy deoptimization for the last
   // outstanding safepoints.
   void RecordLazyDeoptimizationIndex(int index);
+  void BumpLastLazySafepointIndex() {
+    last_lazy_safepoint_ = deopt_index_list_.length();
+  }
 
   // Emit the safepoint table after the body. The number of bits per
   // entry must be enough to hold all the pointer indexes.
diff --git a/chromium/v8/src/serialize.h b/chromium/v8/src/serialize.h
index ee9df39ad86..9229bad4061 100644
--- a/chromium/v8/src/serialize.h
+++ b/chromium/v8/src/serialize.h
@@ -60,7 +60,7 @@ const int kReferenceTypeShift = kReferenceIdBits;
 const int kDebugRegisterBits = 4;
 const int kDebugIdShift = kDebugRegisterBits;
 
-const int kDeoptTableSerializeEntryCount = 8;
+const int kDeoptTableSerializeEntryCount = 12;
 
 // ExternalReferenceTable is a helper class that defines the relationship
 // between external references and their encodings. It is used to build
diff --git a/chromium/v8/src/typedarray.js b/chromium/v8/src/typedarray.js
index 21dd9c82d14..0a06ebbdd42 100644
--- a/chromium/v8/src/typedarray.js
+++ b/chromium/v8/src/typedarray.js
@@ -49,7 +49,7 @@ endmacro
 
 macro TYPED_ARRAY_CONSTRUCTOR(ARRAY_ID, NAME, ELEMENT_SIZE)
   function NAMEConstructByArrayBuffer(obj, buffer, byteOffset, length) {
-    var bufferByteLength = buffer.byteLength;
+    var bufferByteLength = %ArrayBufferGetByteLength(buffer);
     var offset;
     if (IS_UNDEFINED(byteOffset)) {
       offset = 0;
@@ -313,7 +313,7 @@ function DataViewConstructor(buffer, byteOffset, byteLength) { // length = 3
     if (!IS_ARRAYBUFFER(buffer)) {
       throw MakeTypeError('data_view_not_array_buffer', []);
     }
-    var bufferByteLength = buffer.byteLength;
+    var bufferByteLength = %ArrayBufferGetByteLength(buffer);
     var offset = IS_UNDEFINED(byteOffset) ?
       0 : ToPositiveInteger(byteOffset, 'invalid_data_view_offset');
     if (offset > bufferByteLength) {
diff --git a/chromium/v8/src/version.cc b/chromium/v8/src/version.cc
index 17793d535d1..2d89ca8bd50 100644
--- a/chromium/v8/src/version.cc
+++ b/chromium/v8/src/version.cc
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     23
 #define BUILD_NUMBER      17
-#define PATCH_LEVEL       22
+#define PATCH_LEVEL       28
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
 #define IS_CANDIDATE_VERSION 0
diff --git a/chromium/v8/src/x64/lithium-codegen-x64.cc b/chromium/v8/src/x64/lithium-codegen-x64.cc
index ff6f1e6ef3d..80024e78e17 100644
--- a/chromium/v8/src/x64/lithium-codegen-x64.cc
+++ b/chromium/v8/src/x64/lithium-codegen-x64.cc
@@ -268,6 +268,13 @@ void LCodeGen::GenerateOsrPrologue() {
 }
 
 
+void LCodeGen::GenerateBodyInstructionPre(LInstruction* instr) {
+  if (!instr->IsLazyBailout() && !instr->IsGap()) {
+    safepoints_.BumpLastLazySafepointIndex();
+  }
+}
+
+
 bool LCodeGen::GenerateJumpTable() {
   Label needs_frame;
   if (jump_table_.length() > 0) {
@@ -1953,7 +1960,6 @@ void LCodeGen::DoArithmeticT(LArithmeticT* instr) {
 
   BinaryOpICStub stub(instr->op(), NO_OVERWRITE);
   CallCode(stub.GetCode(isolate()), RelocInfo::CODE_TARGET, instr);
-  __ nop();  // Signals no inlined code.
 }
 
 
@@ -3601,10 +3607,11 @@ void LCodeGen::DoMathRound(LMathRound* instr) {
   const XMMRegister xmm_scratch = double_scratch0();
   Register output_reg = ToRegister(instr->result());
   XMMRegister input_reg = ToDoubleRegister(instr->value());
+  XMMRegister input_temp = ToDoubleRegister(instr->temp());
   static int64_t one_half = V8_INT64_C(0x3FE0000000000000);  // 0.5
   static int64_t minus_one_half = V8_INT64_C(0xBFE0000000000000);  // -0.5
 
-  Label done, round_to_zero, below_one_half, do_not_compensate, restore;
+  Label done, round_to_zero, below_one_half;
   Label::Distance dist = DeoptEveryNTimes() ? Label::kFar : Label::kNear;
   __ movq(kScratchRegister, one_half);
   __ movq(xmm_scratch, kScratchRegister);
@@ -3628,21 +3635,19 @@ void LCodeGen::DoMathRound(LMathRound* instr) {
 
   // CVTTSD2SI rounds towards zero, we use ceil(x - (-0.5)) and then
   // compare and compensate.
-  __ movq(kScratchRegister, input_reg);  // Back up input_reg.
-  __ subsd(input_reg, xmm_scratch);
-  __ cvttsd2si(output_reg, input_reg);
+  __ movq(input_temp, input_reg);  // Do not alter input_reg.
+  __ subsd(input_temp, xmm_scratch);
+  __ cvttsd2si(output_reg, input_temp);
   // Catch minint due to overflow, and to prevent overflow when compensating.
   __ cmpl(output_reg, Immediate(0x80000000));
   __ RecordComment("D2I conversion overflow");
   DeoptimizeIf(equal, instr->environment());
 
   __ Cvtlsi2sd(xmm_scratch, output_reg);
-  __ ucomisd(input_reg, xmm_scratch);
-  __ j(equal, &restore, Label::kNear);
+  __ ucomisd(xmm_scratch, input_temp);
+  __ j(equal, &done, dist);
   __ subl(output_reg, Immediate(1));
   // No overflow because we already ruled out minint.
-  __ bind(&restore);
-  __ movq(input_reg, kScratchRegister);  // Restore input_reg.
   __ jmp(&done, dist);
 
   __ bind(&round_to_zero);
@@ -4124,44 +4129,51 @@ void LCodeGen::ApplyCheckIf(Condition cc, LBoundsCheck* check) {
 
 
 void LCodeGen::DoBoundsCheck(LBoundsCheck* instr) {
-  if (instr->hydrogen()->skip_check()) return;
+  HBoundsCheck* hinstr = instr->hydrogen();
+  if (hinstr->skip_check()) return;
+
+  Representation representation = hinstr->length()->representation();
+  ASSERT(representation.Equals(hinstr->index()->representation()));
+  ASSERT(representation.IsSmiOrInteger32());
 
   if (instr->length()->IsRegister()) {
     Register reg = ToRegister(instr->length());
-    if (!instr->hydrogen()->length()->representation().IsSmi()) {
-      __ AssertZeroExtended(reg);
-    }
+
     if (instr->index()->IsConstantOperand()) {
       int32_t constant_index =
           ToInteger32(LConstantOperand::cast(instr->index()));
-      if (instr->hydrogen()->length()->representation().IsSmi()) {
+      if (representation.IsSmi()) {
         __ Cmp(reg, Smi::FromInt(constant_index));
       } else {
-        __ cmpq(reg, Immediate(constant_index));
+        __ cmpl(reg, Immediate(constant_index));
       }
     } else {
       Register reg2 = ToRegister(instr->index());
-      if (!instr->hydrogen()->index()->representation().IsSmi()) {
-        __ AssertZeroExtended(reg2);
+      if (representation.IsSmi()) {
+        __ cmpq(reg, reg2);
+      } else {
+        __ cmpl(reg, reg2);
       }
-      __ cmpq(reg, reg2);
     }
   } else {
     Operand length = ToOperand(instr->length());
     if (instr->index()->IsConstantOperand()) {
       int32_t constant_index =
           ToInteger32(LConstantOperand::cast(instr->index()));
-      if (instr->hydrogen()->length()->representation().IsSmi()) {
+      if (representation.IsSmi()) {
         __ Cmp(length, Smi::FromInt(constant_index));
       } else {
-        __ cmpq(length, Immediate(constant_index));
+        __ cmpl(length, Immediate(constant_index));
       }
     } else {
-      __ cmpq(length, ToRegister(instr->index()));
+      if (representation.IsSmi()) {
+        __ cmpq(length, ToRegister(instr->index()));
+      } else {
+        __ cmpl(length, ToRegister(instr->index()));
+      }
     }
   }
-  Condition condition =
-      instr->hydrogen()->allow_equality() ? below : below_equal;
+  Condition condition = hinstr->allow_equality() ? below : below_equal;
   ApplyCheckIf(condition, instr);
 }
 
diff --git a/chromium/v8/src/x64/lithium-codegen-x64.h b/chromium/v8/src/x64/lithium-codegen-x64.h
index 53d26460b32..63bfe187f14 100644
--- a/chromium/v8/src/x64/lithium-codegen-x64.h
+++ b/chromium/v8/src/x64/lithium-codegen-x64.h
@@ -159,6 +159,7 @@ class LCodeGen: public LCodeGenBase {
 
   // Code generation passes.  Returns true if code generation should
   // continue.
+  void GenerateBodyInstructionPre(LInstruction* instr) V8_OVERRIDE;
   bool GeneratePrologue();
   bool GenerateDeferredCode();
   bool GenerateJumpTable();
diff --git a/chromium/v8/src/x64/lithium-x64.cc b/chromium/v8/src/x64/lithium-x64.cc
index 473e93dde6f..449eb2b6a11 100644
--- a/chromium/v8/src/x64/lithium-x64.cc
+++ b/chromium/v8/src/x64/lithium-x64.cc
@@ -640,15 +640,6 @@ LInstruction* LChunkBuilder::MarkAsCall(LInstruction* instr,
   instr->MarkAsCall();
   instr = AssignPointerMap(instr);
 
-  if (hinstr->HasObservableSideEffects()) {
-    ASSERT(hinstr->next()->IsSimulate());
-    HSimulate* sim = HSimulate::cast(hinstr->next());
-    ASSERT(instruction_pending_deoptimization_environment_ == NULL);
-    ASSERT(pending_deoptimization_ast_id_.IsNone());
-    instruction_pending_deoptimization_environment_ = instr;
-    pending_deoptimization_ast_id_ = sim->ast_id();
-  }
-
   // If instruction does not have side-effects lazy deoptimization
   // after the call will try to deoptimize to the point before the call.
   // Thus we still need to attach environment to this call even if
@@ -924,6 +915,26 @@ void LChunkBuilder::VisitInstruction(HInstruction* current) {
       instr = AssignEnvironment(instr);
     }
     chunk_->AddInstruction(instr, current_block_);
+
+    if (instr->IsCall()) {
+      HValue* hydrogen_value_for_lazy_bailout = current;
+      LInstruction* instruction_needing_environment = NULL;
+      if (current->HasObservableSideEffects()) {
+        HSimulate* sim = HSimulate::cast(current->next());
+        instruction_needing_environment = instr;
+        sim->ReplayEnvironment(current_block_->last_environment());
+        hydrogen_value_for_lazy_bailout = sim;
+      }
+      LInstruction* bailout = AssignEnvironment(new(zone()) LLazyBailout());
+      bailout->set_hydrogen_value(hydrogen_value_for_lazy_bailout);
+      chunk_->AddInstruction(bailout, current_block_);
+      if (instruction_needing_environment != NULL) {
+        // Store the lazy deopt environment with the instruction if needed.
+        // Right now it is only used for LInstanceOfKnownGlobal.
+        instruction_needing_environment->
+            SetDeferredLazyDeoptimizationEnvironment(bailout->environment());
+      }
+    }
   }
   current_instruction_ = old_current;
 }
@@ -1208,8 +1219,9 @@ LInstruction* LChunkBuilder::DoMathFloor(HUnaryMathOperation* instr) {
 
 
 LInstruction* LChunkBuilder::DoMathRound(HUnaryMathOperation* instr) {
-  LOperand* input = UseRegisterAtStart(instr->value());
-  LMathRound* result = new(zone()) LMathRound(input);
+  LOperand* input = UseRegister(instr->value());
+  LOperand* temp = FixedTemp(xmm4);
+  LMathRound* result = new(zone()) LMathRound(input, temp);
   return AssignEnvironment(DefineAsRegister(result));
 }
 
@@ -2528,21 +2540,6 @@ LInstruction* LChunkBuilder::DoIsConstructCallAndBranch(
 
 LInstruction* LChunkBuilder::DoSimulate(HSimulate* instr) {
   instr->ReplayEnvironment(current_block_->last_environment());
-
-  // If there is an instruction pending deoptimization environment create a
-  // lazy bailout instruction to capture the environment.
-  if (pending_deoptimization_ast_id_ == instr->ast_id()) {
-    LLazyBailout* lazy_bailout = new(zone()) LLazyBailout;
-    LInstruction* result = AssignEnvironment(lazy_bailout);
-    // Store the lazy deopt environment with the instruction if needed. Right
-    // now it is only used for LInstanceOfKnownGlobal.
-    instruction_pending_deoptimization_environment_->
-        SetDeferredLazyDeoptimizationEnvironment(result->environment());
-    instruction_pending_deoptimization_environment_ = NULL;
-    pending_deoptimization_ast_id_ = BailoutId::None();
-    return result;
-  }
-
   return NULL;
 }
 
diff --git a/chromium/v8/src/x64/lithium-x64.h b/chromium/v8/src/x64/lithium-x64.h
index 44bd992f7dd..dc15c97c44c 100644
--- a/chromium/v8/src/x64/lithium-x64.h
+++ b/chromium/v8/src/x64/lithium-x64.h
@@ -730,13 +730,15 @@ class LMathFloor V8_FINAL : public LTemplateInstruction<1, 1, 0> {
 };
 
 
-class LMathRound V8_FINAL : public LTemplateInstruction<1, 1, 0> {
+class LMathRound V8_FINAL : public LTemplateInstruction<1, 1, 1> {
  public:
-  explicit LMathRound(LOperand* value) {
+  explicit LMathRound(LOperand* value, LOperand* temp) {
     inputs_[0] = value;
+    temps_[0] = temp;
   }
 
   LOperand* value() { return inputs_[0]; }
+  LOperand* temp() { return temps_[0]; }
 
   DECLARE_CONCRETE_INSTRUCTION(MathRound, "math-round")
   DECLARE_HYDROGEN_ACCESSOR(UnaryMathOperation)
@@ -2685,9 +2687,7 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
         current_block_(NULL),
         next_block_(NULL),
         argument_count_(0),
-        allocator_(allocator),
-        instruction_pending_deoptimization_environment_(NULL),
-        pending_deoptimization_ast_id_(BailoutId::None()) { }
+        allocator_(allocator) { }
 
   // Build the sequence for the graph.
   LPlatformChunk* Build();
@@ -2838,8 +2838,6 @@ class LChunkBuilder V8_FINAL BASE_EMBEDDED {
   HBasicBlock* next_block_;
   int argument_count_;
   LAllocator* allocator_;
-  LInstruction* instruction_pending_deoptimization_environment_;
-  BailoutId pending_deoptimization_ast_id_;
 
   DISALLOW_COPY_AND_ASSIGN(LChunkBuilder);
 };
diff --git a/chromium/webkit/common/gpu/webkit_gpu.gyp b/chromium/webkit/common/gpu/webkit_gpu.gyp
index 1a0190ccdaa..a28e4e851a4 100644
--- a/chromium/webkit/common/gpu/webkit_gpu.gyp
+++ b/chromium/webkit/common/gpu/webkit_gpu.gyp
@@ -28,9 +28,6 @@
             '<(DEPTH)/ui/gl/gl.gyp:gl',
             '<(DEPTH)/ui/gfx/gfx.gyp:gfx',
           ],
-          'export_dependent_settings': [
-            '<(DEPTH)/gpu/gpu.gyp:gles2_implementation',
-          ],
           'sources': [
             # This list contains all .h and .cc in gpu except for test code.
             'context_provider_in_process.cc',
diff --git a/ninja/.clang-format b/ninja/.clang-format
new file mode 100644
index 00000000000..1841c036f9c
--- /dev/null
+++ b/ninja/.clang-format
@@ -0,0 +1,25 @@
+# Copyright 2014 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This isn't meant to be authoritative, but it's good enough to be useful.
+# Still use your best judgement for formatting decisions: clang-format
+# sometimes makes strange choices.
+
+BasedOnStyle: Google
+AllowShortFunctionsOnASingleLine: Inline
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+ConstructorInitializerAllOnOneLineOrOnePerLine: false
+Cpp11BracedListStyle: false
+IndentCaseLabels: false
diff --git a/ninja/configure.py b/ninja/configure.py
index da2f6ef478d..c5a6abdd93c 100755
--- a/ninja/configure.py
+++ b/ninja/configure.py
@@ -377,18 +377,21 @@ all_targets += ninja_test
 
 
 n.comment('Ancillary executables.')
-objs = cxx('parser_perftest')
-all_targets += n.build(binary('parser_perftest'), 'link', objs,
-                       implicit=ninja_lib, variables=[('libs', libs)])
 objs = cxx('build_log_perftest')
 all_targets += n.build(binary('build_log_perftest'), 'link', objs,
                        implicit=ninja_lib, variables=[('libs', libs)])
 objs = cxx('canon_perftest')
 all_targets += n.build(binary('canon_perftest'), 'link', objs,
                        implicit=ninja_lib, variables=[('libs', libs)])
+objs = cxx('depfile_parser_perftest')
+all_targets += n.build(binary('depfile_parser_perftest'), 'link', objs,
+                       implicit=ninja_lib, variables=[('libs', libs)])
 objs = cxx('hash_collision_bench')
 all_targets += n.build(binary('hash_collision_bench'), 'link', objs,
                               implicit=ninja_lib, variables=[('libs', libs)])
+objs = cxx('manifest_parser_perftest')
+all_targets += n.build(binary('manifest_parser_perftest'), 'link', objs,
+                              implicit=ninja_lib, variables=[('libs', libs)])
 n.newline()
 
 n.comment('Generate a graph using the "graph" tool.')
diff --git a/ninja/doc/manual.asciidoc b/ninja/doc/manual.asciidoc
index 67fcbfd2788..18760dde3f4 100644
--- a/ninja/doc/manual.asciidoc
+++ b/ninja/doc/manual.asciidoc
@@ -648,6 +648,21 @@ build heavy_object2.obj: cc heavy_obj2.cc
 
 ----------------
 
+The `console` pool
+^^^^^^^^^^^^^^^^^^
+
+_Available since Ninja 1.5._
+
+There exists a pre-defined pool named `console` with a depth of 1. It has
+the special property that any task in the pool has direct access to the
+standard input, output and error streams provided to Ninja, which are
+normally connected to the user's console (hence the name) but could be
+redirected. This can be useful for interactive tasks or long-running tasks
+which produce status updates on the console (such as test suites).
+
+While a task in the `console` pool is running, Ninja's regular output (such
+as progress status and output from concurrent tasks) is buffered until
+it completes.
 
 Ninja file reference
 --------------------
diff --git a/ninja/misc/bash-completion b/ninja/misc/bash-completion
index 2d6975b9450..6edf4dfea02 100644
--- a/ninja/misc/bash-completion
+++ b/ninja/misc/bash-completion
@@ -16,25 +16,43 @@
 #   . path/to/ninja/misc/bash-completion
 
 _ninja_target() {
-    local cur targets dir line targets_command OPTIND
-    cur="${COMP_WORDS[COMP_CWORD]}"
+    local cur prev targets dir line targets_command OPTIND
 
-		if [[ "$cur" == "--"* ]]; then
-			# there is currently only one argument that takes --
-			COMPREPLY=($(compgen -P '--' -W 'version' -- "${cur:2}"))
-		else
-			dir="."
-			line=$(echo ${COMP_LINE} | cut -d" " -f 2-)
-			# filter out all non relevant arguments but keep C for dirs
-			while getopts C:f:j:l:k:nvd:t: opt "${line[@]}"; do
-				case $opt in
-					C) dir="$OPTARG" ;;
-				esac
-			done;
-			targets_command="ninja -C ${dir} -t targets all"
-			targets=$((${targets_command} 2>/dev/null) | awk -F: '{print $1}')
-			COMPREPLY=($(compgen -W "$targets" -- "$cur"))
-		fi
+    # When available, use bash_completion to:
+    #   1) Complete words when the cursor is in the middle of the word
+    #   2) Complete paths with files or directories, as appropriate
+    if _get_comp_words_by_ref cur prev &>/dev/null ; then
+        case $prev in
+            -f)
+                _filedir
+                return 0
+                ;;
+            -C)
+                _filedir -d
+                return 0
+                ;;
+        esac
+    else
+        cur="${COMP_WORDS[COMP_CWORD]}"
+    fi
+
+    if [[ "$cur" == "--"* ]]; then
+        # there is currently only one argument that takes --
+	COMPREPLY=($(compgen -P '--' -W 'version' -- "${cur:2}"))
+    else
+	dir="."
+	line=$(echo ${COMP_LINE} | cut -d" " -f 2-)
+        # filter out all non relevant arguments but keep C for dirs
+	while getopts :C:f:j:l:k:nvd:t: opt $line; do
+	    case $opt in
+                # eval for tilde expansion
+		C) eval dir="$OPTARG" ;;
+	    esac
+	done;
+	targets_command="eval ninja -C \"${dir}\" -t targets all"
+	targets=$((${targets_command} 2>/dev/null) | awk -F: '{print $1}')
+	COMPREPLY=($(compgen -W "$targets" -- "$cur"))
+    fi
     return
 }
 complete -F _ninja_target ninja
diff --git a/ninja/misc/ninja_syntax.py b/ninja/misc/ninja_syntax.py
index d69e3e49e2d..14b932ff4c8 100644
--- a/ninja/misc/ninja_syntax.py
+++ b/ninja/misc/ninja_syntax.py
@@ -8,10 +8,9 @@ use Python.
 """
 
 import textwrap
-import re
 
 def escape_path(word):
-    return word.replace('$ ','$$ ').replace(' ','$ ').replace(':', '$:')
+    return word.replace('$ ', '$$ ').replace(' ', '$ ').replace(':', '$:')
 
 class Writer(object):
     def __init__(self, output, width=78):
@@ -61,21 +60,20 @@ class Writer(object):
     def build(self, outputs, rule, inputs=None, implicit=None, order_only=None,
               variables=None):
         outputs = self._as_list(outputs)
-        all_inputs = self._as_list(inputs)[:]
-        out_outputs = list(map(escape_path, outputs))
-        all_inputs = list(map(escape_path, all_inputs))
+        out_outputs = [escape_path(x) for x in outputs]
+        all_inputs = [escape_path(x) for x in self._as_list(inputs)]
 
         if implicit:
-            implicit = map(escape_path, self._as_list(implicit))
+            implicit = [escape_path(x) for x in self._as_list(implicit)]
             all_inputs.append('|')
             all_inputs.extend(implicit)
         if order_only:
-            order_only = map(escape_path, self._as_list(order_only))
+            order_only = [escape_path(x) for x in self._as_list(order_only)]
             all_inputs.append('||')
             all_inputs.extend(order_only)
 
         self._line('build %s: %s' % (' '.join(out_outputs),
-                                        ' '.join([rule] + all_inputs)))
+                                     ' '.join([rule] + all_inputs)))
 
         if variables:
             if isinstance(variables, dict):
@@ -98,13 +96,13 @@ class Writer(object):
         self._line('default %s' % ' '.join(self._as_list(paths)))
 
     def _count_dollars_before_index(self, s, i):
-      """Returns the number of '$' characters right in front of s[i]."""
-      dollar_count = 0
-      dollar_index = i - 1
-      while dollar_index > 0 and s[dollar_index] == '$':
-        dollar_count += 1
-        dollar_index -= 1
-      return dollar_count
+        """Returns the number of '$' characters right in front of s[i]."""
+        dollar_count = 0
+        dollar_index = i - 1
+        while dollar_index > 0 and s[dollar_index] == '$':
+            dollar_count += 1
+            dollar_index -= 1
+        return dollar_count
 
     def _line(self, text, indent=0):
         """Write 'text' word-wrapped at self.width characters."""
@@ -117,19 +115,19 @@ class Writer(object):
             available_space = self.width - len(leading_space) - len(' $')
             space = available_space
             while True:
-              space = text.rfind(' ', 0, space)
-              if space < 0 or \
-                 self._count_dollars_before_index(text, space) % 2 == 0:
-                break
+                space = text.rfind(' ', 0, space)
+                if (space < 0 or
+                    self._count_dollars_before_index(text, space) % 2 == 0):
+                    break
 
             if space < 0:
                 # No such space; just use the first unescaped space we can find.
                 space = available_space - 1
                 while True:
-                  space = text.find(' ', space + 1)
-                  if space < 0 or \
-                     self._count_dollars_before_index(text, space) % 2 == 0:
-                    break
+                    space = text.find(' ', space + 1)
+                    if (space < 0 or
+                        self._count_dollars_before_index(text, space) % 2 == 0):
+                        break
             if space < 0:
                 # Give up on breaking.
                 break
diff --git a/ninja/misc/write_fake_manifests.py b/ninja/misc/write_fake_manifests.py
new file mode 100644
index 00000000000..837007e603b
--- /dev/null
+++ b/ninja/misc/write_fake_manifests.py
@@ -0,0 +1,219 @@
+#!/usr/bin/env python
+
+"""Writes large manifest files, for manifest parser performance testing.
+
+The generated manifest files are (eerily) similar in appearance and size to the
+ones used in the Chromium project.
+
+Usage:
+  python misc/write_fake_manifests.py outdir  # Will run for about 5s.
+
+The program contains a hardcoded random seed, so it will generate the same
+output every time it runs.  By changing the seed, it's easy to generate many
+different sets of manifest files.
+"""
+
+import argparse
+import contextlib
+import os
+import random
+import sys
+
+import ninja_syntax
+
+
+def paretoint(avg, alpha):
+    """Returns a random integer that's avg on average, following a power law.
+    alpha determines the shape of the power curve. alpha has to be larger
+    than 1. The closer alpha is to 1, the higher the variation of the returned
+    numbers."""
+    return int(random.paretovariate(alpha) * avg / (alpha / (alpha - 1)))
+
+
+# Based on http://neugierig.org/software/chromium/class-name-generator.html
+def moar(avg_options, p_suffix):
+    kStart = ['render', 'web', 'browser', 'tab', 'content', 'extension', 'url',
+              'file', 'sync', 'content', 'http', 'profile']
+    kOption = ['view', 'host', 'holder', 'container', 'impl', 'ref',
+               'delegate', 'widget', 'proxy', 'stub', 'context',
+               'manager', 'master', 'watcher', 'service', 'file', 'data',
+               'resource', 'device', 'info', 'provider', 'internals', 'tracker',
+               'api', 'layer']
+    kOS = ['win', 'mac', 'aura', 'linux', 'android', 'unittest', 'browsertest']
+    num_options = min(paretoint(avg_options, alpha=4), 5)
+    # The original allows kOption to repeat as long as no consecutive options
+    # repeat.  This version doesn't allow any option repetition.
+    name = [random.choice(kStart)] + random.sample(kOption, num_options)
+    if random.random() < p_suffix:
+        name.append(random.choice(kOS))
+    return '_'.join(name)
+
+
+class GenRandom(object):
+    def __init__(self):
+        self.seen_names = set([None])
+        self.seen_defines = set([None])
+
+    def _unique_string(self, seen, avg_options=1.3, p_suffix=0.1):
+        s = None
+        while s in seen:
+            s = moar(avg_options, p_suffix)
+        seen.add(s)
+        return s
+
+    def _n_unique_strings(self, n):
+        seen = set([None])
+        return [self._unique_string(seen, avg_options=3, p_suffix=0.4)
+                for _ in xrange(n)]
+
+    def target_name(self):
+        return self._unique_string(p_suffix=0, seen=self.seen_names)
+
+    def path(self):
+        return os.path.sep.join([
+            self._unique_string(self.seen_names, avg_options=1, p_suffix=0)
+            for _ in xrange(1 + paretoint(0.6, alpha=4))])
+
+    def src_obj_pairs(self, path, name):
+        num_sources = paretoint(55, alpha=2) + 1
+        return [(os.path.join('..', '..', path, s + '.cc'),
+                 os.path.join('obj', path, '%s.%s.o' % (name, s)))
+                for s in self._n_unique_strings(num_sources)]
+
+    def defines(self):
+        return [
+            '-DENABLE_' + self._unique_string(self.seen_defines).upper()
+            for _ in xrange(paretoint(20, alpha=3))]
+
+
+LIB, EXE = 0, 1
+class Target(object):
+    def __init__(self, gen, kind):
+        self.name = gen.target_name()
+        self.dir_path = gen.path()
+        self.ninja_file_path = os.path.join(
+            'obj', self.dir_path, self.name + '.ninja')
+        self.src_obj_pairs = gen.src_obj_pairs(self.dir_path, self.name)
+        if kind == LIB:
+            self.output = os.path.join('lib' + self.name + '.a')
+        elif kind == EXE:
+            self.output = os.path.join(self.name)
+        self.defines = gen.defines()
+        self.deps = []
+        self.kind = kind
+        self.has_compile_depends = random.random() < 0.4
+
+    @property
+    def includes(self):
+        return ['-I' + dep.dir_path for dep in self.deps]
+
+
+def write_target_ninja(ninja, target):
+    compile_depends = None
+    if target.has_compile_depends:
+      compile_depends = os.path.join(
+          'obj', target.dir_path, target.name + '.stamp')
+      ninja.build(compile_depends, 'stamp', target.src_obj_pairs[0][0])
+      ninja.newline()
+
+    ninja.variable('defines', target.defines)
+    if target.deps:
+        ninja.variable('includes', target.includes)
+    ninja.variable('cflags', ['-Wall', '-fno-rtti', '-fno-exceptions'])
+    ninja.newline()
+
+    for src, obj in target.src_obj_pairs:
+        ninja.build(obj, 'cxx', src, implicit=compile_depends)
+    ninja.newline()
+
+    deps = [dep.output for dep in target.deps]
+    libs = [dep.output for dep in target.deps if dep.kind == LIB]
+    if target.kind == EXE:
+        ninja.variable('ldflags', '-Wl,pie')
+        ninja.variable('libs', libs)
+    link = { LIB: 'alink', EXE: 'link'}[target.kind]
+    ninja.build(target.output, link, [obj for _, obj in target.src_obj_pairs],
+                implicit=deps)
+
+
+def write_master_ninja(master_ninja, targets):
+    """Writes master build.ninja file, referencing all given subninjas."""
+    master_ninja.variable('cxx', 'c++')
+    master_ninja.variable('ld', '$cxx')
+    master_ninja.newline()
+
+    master_ninja.pool('link_pool', depth=4)
+    master_ninja.newline()
+
+    master_ninja.rule('cxx', description='CXX $out',
+      command='$cxx -MMD -MF $out.d $defines $includes $cflags -c $in -o $out',
+      depfile='$out.d', deps='gcc')
+    master_ninja.rule('alink', description='LIBTOOL-STATIC $out',
+      command='rm -f $out && libtool -static -o $out $in')
+    master_ninja.rule('link', description='LINK $out', pool='link_pool',
+      command='$ld $ldflags -o $out $in $libs')
+    master_ninja.rule('stamp', description='STAMP $out', command='touch $out')
+    master_ninja.newline()
+
+    for target in targets:
+        master_ninja.subninja(target.ninja_file_path)
+    master_ninja.newline()
+
+    master_ninja.comment('Short names for targets.')
+    for target in targets:
+        if target.name != target.output:
+            master_ninja.build(target.name, 'phony', target.output)
+    master_ninja.newline()
+
+    master_ninja.build('all', 'phony', [target.output for target in targets])
+    master_ninja.default('all')
+
+
+@contextlib.contextmanager
+def FileWriter(path):
+    """Context manager for a ninja_syntax object writing to a file."""
+    try:
+        os.makedirs(os.path.dirname(path))
+    except OSError:
+        pass
+    f = open(path, 'w')
+    yield ninja_syntax.Writer(f)
+    f.close()
+
+
+def random_targets():
+    num_targets = 800
+    gen = GenRandom()
+
+    # N-1 static libraries, and 1 executable depending on all of them.
+    targets = [Target(gen, LIB) for i in xrange(num_targets - 1)]
+    for i in range(len(targets)):
+        targets[i].deps = [t for t in targets[0:i] if random.random() < 0.05]
+
+    last_target = Target(gen, EXE)
+    last_target.deps = targets[:]
+    last_target.src_obj_pairs = last_target.src_obj_pairs[0:10]  # Trim.
+    targets.append(last_target)
+    return targets
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('outdir', help='output directory')
+    args = parser.parse_args()
+    root_dir = args.outdir
+
+    random.seed(12345)
+
+    targets = random_targets()
+    for target in targets:
+        with FileWriter(os.path.join(root_dir, target.ninja_file_path)) as n:
+            write_target_ninja(n, target)
+
+    with FileWriter(os.path.join(root_dir, 'build.ninja')) as master_ninja:
+        master_ninja.width = 120
+        write_master_ninja(master_ninja, targets)
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/ninja/misc/zsh-completion b/ninja/misc/zsh-completion
index cd0edfbd97a..2fe16fb0499 100644
--- a/ninja/misc/zsh-completion
+++ b/ninja/misc/zsh-completion
@@ -1,3 +1,4 @@
+#compdef ninja
 # Copyright 2011 Google Inc. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +16,47 @@
 # Add the following to your .zshrc to tab-complete ninja targets
 #   . path/to/ninja/misc/zsh-completion
 
-_ninja() {
-  reply=(`(ninja -t targets all 2&>/dev/null) | awk -F: '{print $1}'`)
+__get_targets() {
+  ninja -t targets 2>/dev/null | while read -r a b; do echo $a | cut -d ':' -f1; done;
 }
-compctl -K _ninja ninja
+
+__get_tools() {
+  ninja -t list 2>/dev/null | while read -r a b; do echo $a; done | tail -n +2
+}
+
+__get_modes() {
+  ninja -d list 2>/dev/null | while read -r a b; do echo $a; done | tail -n +2 | head -n -1
+}
+
+__modes() {
+  local -a modes
+  modes=(${(fo)"$(__get_modes)"})
+  _describe 'modes' modes
+}
+
+__tools() {
+  local -a tools
+  tools=(${(fo)"$(__get_tools)"})
+  _describe 'tools' tools
+}
+
+__targets() {
+  local -a targets
+  targets=(${(fo)"$(__get_targets)"})
+  _describe 'targets' targets
+}
+
+_arguments \
+  {-h,--help}'[Show help]' \
+  '--version[Print ninja version]' \
+  '-C+[Change to directory before doing anything else]:directories:_directories' \
+  '-f+[Specify input build file (default=build.ninja)]:files:_files' \
+  '-j+[Run N jobs in parallel (default=number of CPUs available)]:number of jobs' \
+  '-l+[Do not start new jobs if the load average is greater than N]:number of jobs' \
+  '-k+[Keep going until N jobs fail (default=1)]:number of jobs' \
+  '-n[Dry run (do not run commands but act like they succeeded)]' \
+  '-v[Show all command lines while building]' \
+  '-d+[Enable debugging (use -d list to list modes)]:modes:__modes' \
+  '-t+[Run a subtool (use -t list to list subtools)]:tools:__tools' \
+  '*::targets:__targets'
+
diff --git a/ninja/src/build.cc b/ninja/src/build.cc
index f91ff2fb2b3..91f1754c150 100644
--- a/ninja/src/build.cc
+++ b/ninja/src/build.cc
@@ -97,6 +97,9 @@ void BuildStatus::BuildEdgeStarted(Edge* edge) {
   ++started_edges_;
 
   PrintStatus(edge);
+
+  if (edge->use_console())
+    printer_.SetConsoleLocked(true);
 }
 
 void BuildStatus::BuildEdgeFinished(Edge* edge,
@@ -112,10 +115,13 @@ void BuildStatus::BuildEdgeFinished(Edge* edge,
   *end_time = (int)(now - start_time_millis_);
   running_edges_.erase(i);
 
+  if (edge->use_console())
+    printer_.SetConsoleLocked(false);
+
   if (config_.verbosity == BuildConfig::QUIET)
     return;
 
-  if (printer_.is_smart_terminal())
+  if (!edge->use_console() && printer_.is_smart_terminal())
     PrintStatus(edge);
 
   // Print the command that is spewing before printing its output.
@@ -145,6 +151,7 @@ void BuildStatus::BuildEdgeFinished(Edge* edge,
 }
 
 void BuildStatus::BuildFinished() {
+  printer_.SetConsoleLocked(false);
   printer_.PrintOnNewLine("");
 }
 
@@ -488,7 +495,7 @@ bool RealCommandRunner::CanRunMore() {
 
 bool RealCommandRunner::StartCommand(Edge* edge) {
   string command = edge->EvaluateCommand();
-  Subprocess* subproc = subprocs_.Add(command);
+  Subprocess* subproc = subprocs_.Add(command, edge->use_console());
   if (!subproc)
     return false;
   subproc_to_edge_.insert(make_pair(subproc, edge));
@@ -610,6 +617,7 @@ bool Builder::Build(string* err) {
     if (failures_allowed && command_runner_->CanRunMore()) {
       if (Edge* edge = plan_.FindWork()) {
         if (!StartEdge(edge, err)) {
+          Cleanup();
           status_->BuildFinished();
           return false;
         }
@@ -630,6 +638,7 @@ bool Builder::Build(string* err) {
       CommandRunner::Result result;
       if (!command_runner_->WaitForCommand(&result) ||
           result.status == ExitInterrupted) {
+        Cleanup();
         status_->BuildFinished();
         *err = "interrupted by user";
         return false;
@@ -637,6 +646,7 @@ bool Builder::Build(string* err) {
 
       --pending_commands;
       if (!FinishCommand(&result, err)) {
+        Cleanup();
         status_->BuildFinished();
         return false;
       }
diff --git a/ninja/src/build_test.cc b/ninja/src/build_test.cc
index 86a911bd281..c414c88fa86 100644
--- a/ninja/src/build_test.cc
+++ b/ninja/src/build_test.cc
@@ -44,6 +44,8 @@ struct PlanTest : public StateTestWithBuiltinRules {
     ASSERT_FALSE(plan_.FindWork());
     sort(ret->begin(), ret->end(), CompareEdgesByOutput::cmp);
   }
+
+  void TestPoolWithDepthOne(const char *test_case);
 };
 
 TEST_F(PlanTest, Basic) {
@@ -197,15 +199,8 @@ TEST_F(PlanTest, DependencyCycle) {
   ASSERT_EQ("dependency cycle: out -> mid -> in -> pre -> out", err);
 }
 
-TEST_F(PlanTest, PoolWithDepthOne) {
-  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
-"pool foobar\n"
-"  depth = 1\n"
-"rule poolcat\n"
-"  command = cat $in > $out\n"
-"  pool = foobar\n"
-"build out1: poolcat in\n"
-"build out2: poolcat in\n"));
+void PlanTest::TestPoolWithDepthOne(const char* test_case) {
+  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_, test_case));
   GetNode("out1")->MarkDirty();
   GetNode("out2")->MarkDirty();
   string err;
@@ -239,6 +234,26 @@ TEST_F(PlanTest, PoolWithDepthOne) {
   ASSERT_EQ(0, edge);
 }
 
+TEST_F(PlanTest, PoolWithDepthOne) {
+  TestPoolWithDepthOne(
+"pool foobar\n"
+"  depth = 1\n"
+"rule poolcat\n"
+"  command = cat $in > $out\n"
+"  pool = foobar\n"
+"build out1: poolcat in\n"
+"build out2: poolcat in\n");
+}
+
+TEST_F(PlanTest, ConsolePool) {
+  TestPoolWithDepthOne(
+"rule poolcat\n"
+"  command = cat $in > $out\n"
+"  pool = console\n"
+"build out1: poolcat in\n"
+"build out2: poolcat in\n");
+}
+
 TEST_F(PlanTest, PoolsWithDepthTwo) {
   ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
 "pool foobar\n"
@@ -515,7 +530,8 @@ bool FakeCommandRunner::StartCommand(Edge* edge) {
     }
   } else if (edge->rule().name() == "true" ||
              edge->rule().name() == "fail" ||
-             edge->rule().name() == "interrupt") {
+             edge->rule().name() == "interrupt" ||
+             edge->rule().name() == "console") {
     // Don't do anything.
   } else {
     printf("unknown command\n");
@@ -539,6 +555,15 @@ bool FakeCommandRunner::WaitForCommand(Result* result) {
     return true;
   }
 
+  if (edge->rule().name() == "console") {
+    if (edge->use_console())
+      result->status = ExitSuccess;
+    else
+      result->status = ExitFailure;
+    last_command_ = NULL;
+    return true;
+  }
+
   if (edge->rule().name() == "fail")
     result->status = ExitFailure;
   else
@@ -1911,3 +1936,20 @@ TEST_F(BuildWithDepsLogTest, RestatMissingDepfileDepslog) {
   RebuildTarget("out", manifest, "build_log", "ninja_deps2");
   ASSERT_EQ(0u, command_runner_.commands_ran_.size());
 }
+
+TEST_F(BuildTest, Console) {
+  ASSERT_NO_FATAL_FAILURE(AssertParse(&state_,
+"rule console\n"
+"  command = console\n"
+"  pool = console\n"
+"build cons: console in.txt\n"));
+
+  fs_.Create("in.txt", "");
+
+  string err;
+  EXPECT_TRUE(builder_.AddTarget("cons", &err));
+  ASSERT_EQ("", err);
+  EXPECT_TRUE(builder_.Build(&err));
+  EXPECT_EQ("", err);
+  ASSERT_EQ(1u, command_runner_.commands_ran_.size());
+}
diff --git a/ninja/src/clean_test.cc b/ninja/src/clean_test.cc
index 04cff734aa7..4a00fd8fe37 100644
--- a/ninja/src/clean_test.cc
+++ b/ninja/src/clean_test.cc
@@ -286,8 +286,7 @@ TEST_F(CleanTest, CleanRspFile) {
 "  rspfile = $rspfile\n"
 "  rspfile_content=$in\n"
 "build out1: cc in1\n"
-"  rspfile = cc1.rsp\n"
-"  rspfile_content=$in\n"));
+"  rspfile = cc1.rsp\n"));
   fs_.Create("out1", "");
   fs_.Create("cc1.rsp", "");
 
@@ -307,10 +306,9 @@ TEST_F(CleanTest, CleanRsp) {
 "build out1: cat in1\n"
 "build in2: cat_rsp src2\n"
 "  rspfile=in2.rsp\n"
-"  rspfile_content=$in\n"
 "build out2: cat_rsp in2\n"
 "  rspfile=out2.rsp\n"
-"  rspfile_content=$in\n"));
+));
   fs_.Create("in1", "");
   fs_.Create("out1", "");
   fs_.Create("in2.rsp", "");
@@ -336,8 +334,6 @@ TEST_F(CleanTest, CleanRsp) {
   EXPECT_EQ(0, fs_.Stat("out2"));
   EXPECT_EQ(0, fs_.Stat("in2.rsp"));
   EXPECT_EQ(0, fs_.Stat("out2.rsp"));
-
-  fs_.files_removed_.clear();
 }
 
 TEST_F(CleanTest, CleanFailure) {
diff --git a/ninja/src/depfile_parser.cc b/ninja/src/depfile_parser.cc
index 49c7d7b316c..4ca3943ff35 100644
--- a/ninja/src/depfile_parser.cc
+++ b/ninja/src/depfile_parser.cc
@@ -64,7 +64,7 @@ bool DepfileParser::Parse(string* content, string* err) {
           0, 128, 128, 128, 128, 128, 128, 128, 
         128, 128, 128, 128, 128, 128, 128, 128, 
         128, 128, 128, 128, 128, 128, 128, 128, 
-        128, 128, 128,   0,   0,   0, 128,   0, 
+        128, 128, 128, 128,   0, 128, 128,   0, 
           0,   0,   0,   0,   0,   0,   0,   0, 
           0,   0,   0,   0,   0,   0,   0,   0, 
           0,   0,   0,   0,   0,   0,   0,   0, 
@@ -114,27 +114,29 @@ bool DepfileParser::Parse(string* content, string* err) {
             if (yych != '\\') goto yy9;
           }
         } else {
-          if (yych <= 'z') {
+          if (yych <= '{') {
             if (yych == '`') goto yy9;
             goto yy5;
           } else {
-            if (yych == '~') goto yy5;
+            if (yych <= '|') goto yy9;
+            if (yych <= '~') goto yy5;
             goto yy9;
           }
         }
       }
       ++in;
-      if ((yych = *in) <= '#') {
-        if (yych <= '\n') {
+      if ((yych = *in) <= '"') {
+        if (yych <= '\f') {
           if (yych <= 0x00) goto yy3;
-          if (yych <= '\t') goto yy14;
+          if (yych != '\n') goto yy14;
         } else {
+          if (yych <= '\r') goto yy3;
           if (yych == ' ') goto yy16;
-          if (yych <= '"') goto yy14;
-          goto yy16;
+          goto yy14;
         }
       } else {
         if (yych <= 'Z') {
+          if (yych <= '#') goto yy16;
           if (yych == '*') goto yy16;
           goto yy14;
         } else {
@@ -224,7 +226,7 @@ yy16:
     } else if (!out_.str_) {
       out_ = StringPiece(filename, len);
     } else if (out_ != StringPiece(filename, len)) {
-      *err = "depfile has multiple output paths.";
+      *err = "depfile has multiple output paths";
       return false;
     }
   }
diff --git a/ninja/src/depfile_parser.in.cc b/ninja/src/depfile_parser.in.cc
index 8bb6d8444d7..b59baf05c93 100644
--- a/ninja/src/depfile_parser.in.cc
+++ b/ninja/src/depfile_parser.in.cc
@@ -67,13 +67,13 @@ bool DepfileParser::Parse(string* content, string* err) {
         *out++ = '$';
         continue;
       }
-      '\\' [^\000\n] {
+      '\\' [^\000\r\n] {
         // Let backslash before other characters through verbatim.
         *out++ = '\\';
         *out++ = yych;
         continue;
       }
-      [a-zA-Z0-9+,/_:.~()@=!-]+ {
+      [a-zA-Z0-9+,/_:.~()}{@=!-]+ {
         // Got a span of plain text.
         int len = (int)(in - start);
         // Need to shift it over if we're overwriting backslashes.
@@ -108,7 +108,7 @@ bool DepfileParser::Parse(string* content, string* err) {
     } else if (!out_.str_) {
       out_ = StringPiece(filename, len);
     } else if (out_ != StringPiece(filename, len)) {
-      *err = "depfile has multiple output paths.";
+      *err = "depfile has multiple output paths";
       return false;
     }
   }
diff --git a/ninja/src/parser_perftest.cc b/ninja/src/depfile_parser_perftest.cc
index b21522168df..b21522168df 100644
--- a/ninja/src/parser_perftest.cc
+++ b/ninja/src/depfile_parser_perftest.cc
diff --git a/ninja/src/depfile_parser_test.cc b/ninja/src/depfile_parser_test.cc
index 0f6771a9901..a5f33214099 100644
--- a/ninja/src/depfile_parser_test.cc
+++ b/ninja/src/depfile_parser_test.cc
@@ -58,6 +58,17 @@ TEST_F(DepfileParserTest, Continuation) {
   EXPECT_EQ(2u, parser_.ins_.size());
 }
 
+TEST_F(DepfileParserTest, CarriageReturnContinuation) {
+  string err;
+  EXPECT_TRUE(Parse(
+"foo.o: \\\r\n"
+"  bar.h baz.h\r\n",
+      &err));
+  ASSERT_EQ("", err);
+  EXPECT_EQ("foo.o", parser_.out_.AsString());
+  EXPECT_EQ(2u, parser_.ins_.size());
+}
+
 TEST_F(DepfileParserTest, BackSlashes) {
   string err;
   EXPECT_TRUE(Parse(
@@ -109,16 +120,19 @@ TEST_F(DepfileParserTest, SpecialChars) {
   string err;
   EXPECT_TRUE(Parse(
 "C:/Program\\ Files\\ (x86)/Microsoft\\ crtdefs.h: \n"
-" en@quot.header~ t+t-x!=1",
+" en@quot.header~ t+t-x!=1 \n"
+" openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif",
       &err));
   ASSERT_EQ("", err);
   EXPECT_EQ("C:/Program Files (x86)/Microsoft crtdefs.h",
             parser_.out_.AsString());
-  ASSERT_EQ(2u, parser_.ins_.size());
+  ASSERT_EQ(3u, parser_.ins_.size());
   EXPECT_EQ("en@quot.header~",
             parser_.ins_[0].AsString());
   EXPECT_EQ("t+t-x!=1",
             parser_.ins_[1].AsString());
+  EXPECT_EQ("openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif",
+            parser_.ins_[2].AsString());
 }
 
 TEST_F(DepfileParserTest, UnifyMultipleOutputs) {
@@ -136,4 +150,5 @@ TEST_F(DepfileParserTest, RejectMultipleDifferentOutputs) {
   // check that multiple different outputs are rejected by the parser
   string err;
   EXPECT_FALSE(Parse("foo bar: x y z", &err));
+  ASSERT_EQ("depfile has multiple output paths", err);
 }
diff --git a/ninja/src/disk_interface.cc b/ninja/src/disk_interface.cc
index 3233144c893..4dfae1a3f9c 100644
--- a/ninja/src/disk_interface.cc
+++ b/ninja/src/disk_interface.cc
@@ -14,6 +14,8 @@
 
 #include "disk_interface.h"
 
+#include <algorithm>
+
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
@@ -31,15 +33,16 @@ namespace {
 
 string DirName(const string& path) {
 #ifdef _WIN32
-  const char kPathSeparator = '\\';
+  const char kPathSeparators[] = "\\/";
 #else
-  const char kPathSeparator = '/';
+  const char kPathSeparators[] = "/";
 #endif
-
-  string::size_type slash_pos = path.rfind(kPathSeparator);
+  string::size_type slash_pos = path.find_last_of(kPathSeparators);
   if (slash_pos == string::npos)
     return string();  // Nothing to do.
-  while (slash_pos > 0 && path[slash_pos - 1] == kPathSeparator)
+  const char* const kEnd = kPathSeparators + strlen(kPathSeparators);
+  while (slash_pos > 0 &&
+         std::find(kPathSeparators, kEnd, path[slash_pos - 1]) != kEnd)
     --slash_pos;
   return path.substr(0, slash_pos);
 }
@@ -146,6 +149,9 @@ bool RealDiskInterface::WriteFile(const string& path, const string& contents) {
 
 bool RealDiskInterface::MakeDir(const string& path) {
   if (::MakeDir(path) < 0) {
+    if (errno == EEXIST) {
+      return true;
+    }
     Error("mkdir(%s): %s", path.c_str(), strerror(errno));
     return false;
   }
diff --git a/ninja/src/disk_interface_test.cc b/ninja/src/disk_interface_test.cc
index 55822a68ea0..51a1d14d894 100644
--- a/ninja/src/disk_interface_test.cc
+++ b/ninja/src/disk_interface_test.cc
@@ -93,7 +93,18 @@ TEST_F(DiskInterfaceTest, ReadFile) {
 }
 
 TEST_F(DiskInterfaceTest, MakeDirs) {
-  EXPECT_TRUE(disk_.MakeDirs("path/with/double//slash/"));
+  string path = "path/with/double//slash/";
+  EXPECT_TRUE(disk_.MakeDirs(path.c_str()));
+  FILE* f = fopen((path + "a_file").c_str(), "w");
+  EXPECT_TRUE(f);
+  EXPECT_EQ(0, fclose(f));
+#ifdef _WIN32
+  string path2 = "another\\with\\back\\\\slashes\\";
+  EXPECT_TRUE(disk_.MakeDirs(path2.c_str()));
+  FILE* f2 = fopen((path2 + "a_file").c_str(), "w");
+  EXPECT_TRUE(f2);
+  EXPECT_EQ(0, fclose(f2));
+#endif
 }
 
 TEST_F(DiskInterfaceTest, RemoveFile) {
diff --git a/ninja/src/graph.cc b/ninja/src/graph.cc
index 65f92442170..71213421449 100644
--- a/ninja/src/graph.cc
+++ b/ninja/src/graph.cc
@@ -305,6 +305,10 @@ bool Edge::is_phony() const {
   return rule_ == &State::kPhonyRule;
 }
 
+bool Edge::use_console() const {
+  return pool() == &State::kConsolePool;
+}
+
 void Node::Dump(const char* prefix) const {
   printf("%s <%s 0x%p> mtime: %d%s, (:%s), ",
          prefix, path().c_str(), this,
diff --git a/ninja/src/graph.h b/ninja/src/graph.h
index 868413c3bce..6cd7f25452c 100644
--- a/ninja/src/graph.h
+++ b/ninja/src/graph.h
@@ -183,6 +183,7 @@ struct Edge {
   }
 
   bool is_phony() const;
+  bool use_console() const;
 };
 
 
diff --git a/ninja/src/line_printer.cc b/ninja/src/line_printer.cc
index 3537e886e69..ef1609c28f5 100644
--- a/ninja/src/line_printer.cc
+++ b/ninja/src/line_printer.cc
@@ -26,7 +26,7 @@
 
 #include "util.h"
 
-LinePrinter::LinePrinter() : have_blank_line_(true) {
+LinePrinter::LinePrinter() : have_blank_line_(true), console_locked_(false) {
 #ifndef _WIN32
   const char* term = getenv("TERM");
   smart_terminal_ = isatty(1) && term && string(term) != "dumb";
@@ -43,6 +43,12 @@ LinePrinter::LinePrinter() : have_blank_line_(true) {
 }
 
 void LinePrinter::Print(string to_print, LineType type) {
+  if (console_locked_) {
+    line_buffer_ = to_print;
+    line_type_ = type;
+    return;
+  }
+
 #ifdef _WIN32
   CONSOLE_SCREEN_BUFFER_INFO csbi;
   GetConsoleScreenBufferInfo(console_, &csbi);
@@ -101,13 +107,46 @@ void LinePrinter::Print(string to_print, LineType type) {
   }
 }
 
-void LinePrinter::PrintOnNewLine(const string& to_print) {
-  if (!have_blank_line_)
-    printf("\n");
-  if (!to_print.empty()) {
+void LinePrinter::PrintOrBuffer(const char* data, size_t size) {
+  if (console_locked_) {
+    output_buffer_.append(data, size);
+  } else {
     // Avoid printf and C strings, since the actual output might contain null
     // bytes like UTF-16 does (yuck).
-    fwrite(&to_print[0], sizeof(char), to_print.size(), stdout);
+    fwrite(data, 1, size, stdout);
+  }
+}
+
+void LinePrinter::PrintOnNewLine(const string& to_print) {
+  if (console_locked_ && !line_buffer_.empty()) {
+    output_buffer_.append(line_buffer_);
+    output_buffer_.append(1, '\n');
+    line_buffer_.clear();
+  }
+  if (!have_blank_line_) {
+    PrintOrBuffer("\n", 1);
+  }
+  if (!to_print.empty()) {
+    PrintOrBuffer(&to_print[0], to_print.size());
   }
   have_blank_line_ = to_print.empty() || *to_print.rbegin() == '\n';
 }
+
+void LinePrinter::SetConsoleLocked(bool locked) {
+  if (locked == console_locked_)
+    return;
+
+  if (locked)
+    PrintOnNewLine("");
+
+  console_locked_ = locked;
+
+  if (!locked) {
+    PrintOnNewLine(output_buffer_);
+    if (!line_buffer_.empty()) {
+      Print(line_buffer_, line_type_);
+    }
+    output_buffer_.clear();
+    line_buffer_.clear();
+  }
+}
diff --git a/ninja/src/line_printer.h b/ninja/src/line_printer.h
index aea28172729..55225e52117 100644
--- a/ninja/src/line_printer.h
+++ b/ninja/src/line_printer.h
@@ -15,6 +15,7 @@
 #ifndef NINJA_LINE_PRINTER_H_
 #define NINJA_LINE_PRINTER_H_
 
+#include <stddef.h>
 #include <string>
 using namespace std;
 
@@ -37,6 +38,10 @@ struct LinePrinter {
   /// Prints a string on a new line, not overprinting previous output.
   void PrintOnNewLine(const string& to_print);
 
+  /// Lock or unlock the console.  Any output sent to the LinePrinter while the
+  /// console is locked will not be printed until it is unlocked.
+  void SetConsoleLocked(bool locked);
+
  private:
   /// Whether we can do fancy terminal control codes.
   bool smart_terminal_;
@@ -44,9 +49,24 @@ struct LinePrinter {
   /// Whether the caret is at the beginning of a blank line.
   bool have_blank_line_;
 
+  /// Whether console is locked.
+  bool console_locked_;
+
+  /// Buffered current line while console is locked.
+  string line_buffer_;
+
+  /// Buffered line type while console is locked.
+  LineType line_type_;
+
+  /// Buffered console output while console is locked.
+  string output_buffer_;
+
 #ifdef _WIN32
   void* console_;
 #endif
+
+  /// Print the given data to the console, or buffer it if it is locked.
+  void PrintOrBuffer(const char *data, size_t size);
 };
 
 #endif  // NINJA_LINE_PRINTER_H_
diff --git a/ninja/src/manifest_parser.cc b/ninja/src/manifest_parser.cc
index 20be7f3777f..6fa4f7c8b44 100644
--- a/ninja/src/manifest_parser.cc
+++ b/ninja/src/manifest_parser.cc
@@ -296,16 +296,17 @@ bool ManifestParser::ParseEdge(string* err) {
   if (!ExpectToken(Lexer::NEWLINE, err))
     return false;
 
-  // XXX scoped_ptr to handle error case.
-  BindingEnv* env = new BindingEnv(env_);
-
-  while (lexer_.PeekToken(Lexer::INDENT)) {
+  // Bindings on edges are rare, so allocate per-edge envs only when needed.
+  bool hasIdent = lexer_.PeekToken(Lexer::INDENT);
+  BindingEnv* env = hasIdent ? new BindingEnv(env_) : env_;
+  while (hasIdent) {
     string key;
     EvalString val;
     if (!ParseLet(&key, &val, err))
       return false;
 
     env->AddBinding(key, val.Evaluate(env_));
+    hasIdent = lexer_.PeekToken(Lexer::INDENT);
   }
 
   Edge* edge = state_->AddEdge(rule);
diff --git a/ninja/src/manifest_parser_perftest.cc b/ninja/src/manifest_parser_perftest.cc
new file mode 100644
index 00000000000..e40468fbdb0
--- /dev/null
+++ b/ninja/src/manifest_parser_perftest.cc
@@ -0,0 +1,114 @@
+// Copyright 2014 Google Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Tests manifest parser performance.  Expects to be run in ninja's root
+// directory.
+
+#include <numeric>
+#include <stdio.h>
+
+#ifdef _WIN32
+#include "getopt.h"
+#include <direct.h>
+#else
+#include <getopt.h>
+#include <unistd.h>
+#endif
+
+#include "disk_interface.h"
+#include "graph.h"
+#include "manifest_parser.h"
+#include "metrics.h"
+#include "state.h"
+#include "util.h"
+
+struct RealFileReader : public ManifestParser::FileReader {
+  virtual bool ReadFile(const string& path, string* content, string* err) {
+    return ::ReadFile(path, content, err) == 0;
+  }
+};
+
+bool WriteFakeManifests(const string& dir) {
+  RealDiskInterface disk_interface;
+  if (disk_interface.Stat(dir + "/build.ninja") > 0)
+    return true;
+
+  printf("Creating manifest data..."); fflush(stdout);
+  int err = system(("python misc/write_fake_manifests.py " + dir).c_str());
+  printf("done.\n");
+  return err == 0;
+}
+
+int LoadManifests(bool measure_command_evaluation) {
+  string err;
+  RealFileReader file_reader;
+  State state;
+  ManifestParser parser(&state, &file_reader);
+  if (!parser.Load("build.ninja", &err)) {
+    fprintf(stderr, "Failed to read test data: %s\n", err.c_str());
+    exit(1);
+  }
+  // Doing an empty build involves reading the manifest and evaluating all
+  // commands required for the requested targets. So include command
+  // evaluation in the perftest by default.
+  int optimization_guard = 0;
+  if (measure_command_evaluation)
+    for (size_t i = 0; i < state.edges_.size(); ++i)
+      optimization_guard += state.edges_[i]->EvaluateCommand().size();
+  return optimization_guard;
+}
+
+int main(int argc, char* argv[]) {
+  bool measure_command_evaluation = true;
+  int opt;
+  while ((opt = getopt(argc, argv, const_cast<char*>("fh"))) != -1) {
+    switch (opt) {
+    case 'f':
+      measure_command_evaluation = false;
+      break;
+    case 'h':
+    default:
+      printf("usage: manifest_parser_perftest\n"
+"\n"
+"options:\n"
+"  -f     only measure manifest load time, not command evaluation time\n"
+             );
+    return 1;
+    }
+  }
+
+  const char kManifestDir[] = "build/manifest_perftest";
+
+  if (!WriteFakeManifests(kManifestDir)) {
+    fprintf(stderr, "Failed to write test data\n");
+    return 1;
+  }
+
+  chdir(kManifestDir);
+
+  const int kNumRepetitions = 5;
+  vector<int> times;
+  for (int i = 0; i < kNumRepetitions; ++i) {
+    int64_t start = GetTimeMillis();
+    int optimization_guard = LoadManifests(measure_command_evaluation);
+    int delta = (int)(GetTimeMillis() - start);
+    printf("%dms (hash: %x)\n", delta, optimization_guard);
+    times.push_back(delta);
+  }
+
+  int min = *min_element(times.begin(), times.end());
+  int max = *max_element(times.begin(), times.end());
+  float total = accumulate(times.begin(), times.end(), 0.0f);
+  printf("min %dms  max %dms  avg %.1fms\n", min, max, total / times.size());
+}
diff --git a/ninja/src/msvc_helper-win32.cc b/ninja/src/msvc_helper-win32.cc
index d2e2eb536c4..e4652794a7b 100644
--- a/ninja/src/msvc_helper-win32.cc
+++ b/ninja/src/msvc_helper-win32.cc
@@ -141,7 +141,7 @@ int CLWrapper::Run(const string& command, string* output) {
   STARTUPINFO startup_info = {};
   startup_info.cb = sizeof(STARTUPINFO);
   startup_info.hStdInput = nul;
-  startup_info.hStdError = stdout_write;
+  startup_info.hStdError = ::GetStdHandle(STD_ERROR_HANDLE);
   startup_info.hStdOutput = stdout_write;
   startup_info.dwFlags |= STARTF_USESTDHANDLES;
 
diff --git a/ninja/src/msvc_helper_test.cc b/ninja/src/msvc_helper_test.cc
index 48fbe21dfee..391c04568c3 100644
--- a/ninja/src/msvc_helper_test.cc
+++ b/ninja/src/msvc_helper_test.cc
@@ -119,3 +119,10 @@ TEST(MSVCHelperTest, EnvBlock) {
   cl.Run("cmd /c \"echo foo is %foo%", &output);
   ASSERT_EQ("foo is bar\r\n", output);
 }
+
+TEST(MSVCHelperTest, NoReadOfStderr) {
+  CLWrapper cl;
+  string output;
+  cl.Run("cmd /c \"echo to stdout&& echo to stderr 1>&2", &output);
+  ASSERT_EQ("to stdout\r\n", output);
+}
diff --git a/ninja/src/ninja.cc b/ninja/src/ninja.cc
index 03ca83b544c..50de43edbab 100644
--- a/ninja/src/ninja.cc
+++ b/ninja/src/ninja.cc
@@ -631,6 +631,8 @@ int NinjaMain::ToolCompilationDatabase(int argc, char* argv[]) {
   putchar('[');
   for (vector<Edge*>::iterator e = state_.edges_.begin();
        e != state_.edges_.end(); ++e) {
+    if ((*e)->inputs_.empty())
+      continue;
     for (int i = 0; i != argc; ++i) {
       if ((*e)->rule_->name() == argv[i]) {
         if (!first)
diff --git a/ninja/src/state.cc b/ninja/src/state.cc
index 33f8423312a..7258272056c 100644
--- a/ninja/src/state.cc
+++ b/ninja/src/state.cc
@@ -69,11 +69,13 @@ bool Pool::WeightedEdgeCmp(const Edge* a, const Edge* b) {
 }
 
 Pool State::kDefaultPool("", 0);
+Pool State::kConsolePool("console", 1);
 const Rule State::kPhonyRule("phony");
 
 State::State() {
   AddRule(&kPhonyRule);
   AddPool(&kDefaultPool);
+  AddPool(&kConsolePool);
 }
 
 void State::AddRule(const Rule* rule) {
diff --git a/ninja/src/state.h b/ninja/src/state.h
index bcb0eff75ff..c382dc014cc 100644
--- a/ninja/src/state.h
+++ b/ninja/src/state.h
@@ -82,6 +82,7 @@ struct Pool {
 /// Global state (file status, loaded rules) for a single run.
 struct State {
   static Pool kDefaultPool;
+  static Pool kConsolePool;
   static const Rule kPhonyRule;
 
   State();
diff --git a/ninja/src/subprocess-posix.cc b/ninja/src/subprocess-posix.cc
index a9af756dca4..743e4066136 100644
--- a/ninja/src/subprocess-posix.cc
+++ b/ninja/src/subprocess-posix.cc
@@ -25,7 +25,8 @@
 
 #include "util.h"
 
-Subprocess::Subprocess() : fd_(-1), pid_(-1) {
+Subprocess::Subprocess(bool use_console) : fd_(-1), pid_(-1),
+                                           use_console_(use_console) {
 }
 Subprocess::~Subprocess() {
   if (fd_ >= 0)
@@ -58,29 +59,34 @@ bool Subprocess::Start(SubprocessSet* set, const string& command) {
     // Track which fd we use to report errors on.
     int error_pipe = output_pipe[1];
     do {
-      if (setpgid(0, 0) < 0)
-        break;
-
       if (sigaction(SIGINT, &set->old_act_, 0) < 0)
         break;
       if (sigprocmask(SIG_SETMASK, &set->old_mask_, 0) < 0)
         break;
 
-      // Open /dev/null over stdin.
-      int devnull = open("/dev/null", O_RDONLY);
-      if (devnull < 0)
-        break;
-      if (dup2(devnull, 0) < 0)
-        break;
-      close(devnull);
-
-      if (dup2(output_pipe[1], 1) < 0 ||
-          dup2(output_pipe[1], 2) < 0)
-        break;
-
-      // Now can use stderr for errors.
-      error_pipe = 2;
-      close(output_pipe[1]);
+      if (!use_console_) {
+        // Put the child in its own process group, so ctrl-c won't reach it.
+        if (setpgid(0, 0) < 0)
+          break;
+
+        // Open /dev/null over stdin.
+        int devnull = open("/dev/null", O_RDONLY);
+        if (devnull < 0)
+          break;
+        if (dup2(devnull, 0) < 0)
+          break;
+        close(devnull);
+
+        if (dup2(output_pipe[1], 1) < 0 ||
+            dup2(output_pipe[1], 2) < 0)
+          break;
+
+        // Now can use stderr for errors.
+        error_pipe = 2;
+        close(output_pipe[1]);
+      }
+      // In the console case, output_pipe is still inherited by the child and
+      // closed when the subprocess finishes, which then notifies ninja.
 
       execl("/bin/sh", "/bin/sh", "-c", command.c_str(), (char *) NULL);
     } while (false);
@@ -168,8 +174,8 @@ SubprocessSet::~SubprocessSet() {
     Fatal("sigprocmask: %s", strerror(errno));
 }
 
-Subprocess *SubprocessSet::Add(const string& command) {
-  Subprocess *subprocess = new Subprocess;
+Subprocess *SubprocessSet::Add(const string& command, bool use_console) {
+  Subprocess *subprocess = new Subprocess(use_console);
   if (!subprocess->Start(this, command)) {
     delete subprocess;
     return 0;
@@ -279,7 +285,10 @@ Subprocess* SubprocessSet::NextFinished() {
 void SubprocessSet::Clear() {
   for (vector<Subprocess*>::iterator i = running_.begin();
        i != running_.end(); ++i)
-    kill(-(*i)->pid_, SIGINT);
+    // Since the foreground process is in our process group, it will receive a
+    // SIGINT at the same time as us.
+    if (!(*i)->use_console_)
+      kill(-(*i)->pid_, SIGINT);
   for (vector<Subprocess*>::iterator i = running_.begin();
        i != running_.end(); ++i)
     delete *i;
diff --git a/ninja/src/subprocess-win32.cc b/ninja/src/subprocess-win32.cc
index 1b230b640b1..fad66e895c0 100644
--- a/ninja/src/subprocess-win32.cc
+++ b/ninja/src/subprocess-win32.cc
@@ -14,13 +14,16 @@
 
 #include "subprocess.h"
 
+#include <assert.h>
 #include <stdio.h>
 
 #include <algorithm>
 
 #include "util.h"
 
-Subprocess::Subprocess() : child_(NULL) , overlapped_(), is_reading_(false) {
+Subprocess::Subprocess(bool use_console) : child_(NULL) , overlapped_(),
+                                           is_reading_(false),
+                                           use_console_(use_console) {
 }
 
 Subprocess::~Subprocess() {
@@ -86,18 +89,25 @@ bool Subprocess::Start(SubprocessSet* set, const string& command) {
   STARTUPINFOA startup_info;
   memset(&startup_info, 0, sizeof(startup_info));
   startup_info.cb = sizeof(STARTUPINFO);
-  startup_info.dwFlags = STARTF_USESTDHANDLES;
-  startup_info.hStdInput = nul;
-  startup_info.hStdOutput = child_pipe;
-  startup_info.hStdError = child_pipe;
+  if (!use_console_) {
+    startup_info.dwFlags = STARTF_USESTDHANDLES;
+    startup_info.hStdInput = nul;
+    startup_info.hStdOutput = child_pipe;
+    startup_info.hStdError = child_pipe;
+  }
+  // In the console case, child_pipe is still inherited by the child and closed
+  // when the subprocess finishes, which then notifies ninja.
 
   PROCESS_INFORMATION process_info;
   memset(&process_info, 0, sizeof(process_info));
 
+  // Ninja handles ctrl-c, except for subprocesses in console pools.
+  DWORD process_flags = use_console_ ? 0 : CREATE_NEW_PROCESS_GROUP;
+
   // Do not prepend 'cmd /c' on Windows, this breaks command
   // lines greater than 8,191 chars.
   if (!CreateProcessA(NULL, (char*)command.c_str(), NULL, NULL,
-                      /* inherit handles */ TRUE, CREATE_NEW_PROCESS_GROUP,
+                      /* inherit handles */ TRUE, process_flags,
                       NULL, NULL,
                       &startup_info, &process_info)) {
     DWORD error = GetLastError();
@@ -213,8 +223,8 @@ BOOL WINAPI SubprocessSet::NotifyInterrupted(DWORD dwCtrlType) {
   return FALSE;
 }
 
-Subprocess *SubprocessSet::Add(const string& command) {
-  Subprocess *subprocess = new Subprocess;
+Subprocess *SubprocessSet::Add(const string& command, bool use_console) {
+  Subprocess *subprocess = new Subprocess(use_console);
   if (!subprocess->Start(this, command)) {
     delete subprocess;
     return 0;
@@ -266,7 +276,9 @@ Subprocess* SubprocessSet::NextFinished() {
 void SubprocessSet::Clear() {
   for (vector<Subprocess*>::iterator i = running_.begin();
        i != running_.end(); ++i) {
-    if ((*i)->child_) {
+    // Since the foreground process is in our process group, it will receive a
+    // CTRL_C_EVENT or CTRL_BREAK_EVENT at the same time as us.
+    if ((*i)->child_ && !(*i)->use_console_) {
       if (!GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT,
                                     GetProcessId((*i)->child_))) {
         Win32Fatal("GenerateConsoleCtrlEvent");
diff --git a/ninja/src/subprocess.h b/ninja/src/subprocess.h
index 4c1629c89b3..b7a1a4c048e 100644
--- a/ninja/src/subprocess.h
+++ b/ninja/src/subprocess.h
@@ -44,7 +44,7 @@ struct Subprocess {
   const string& GetOutput() const;
 
  private:
-  Subprocess();
+  Subprocess(bool use_console);
   bool Start(struct SubprocessSet* set, const string& command);
   void OnPipeReady();
 
@@ -64,6 +64,7 @@ struct Subprocess {
   int fd_;
   pid_t pid_;
 #endif
+  bool use_console_;
 
   friend struct SubprocessSet;
 };
@@ -75,7 +76,7 @@ struct SubprocessSet {
   SubprocessSet();
   ~SubprocessSet();
 
-  Subprocess* Add(const string& command);
+  Subprocess* Add(const string& command, bool use_console = false);
   bool DoWork();
   Subprocess* NextFinished();
   void Clear();
diff --git a/ninja/src/subprocess_test.cc b/ninja/src/subprocess_test.cc
index 9f8dcea68cb..775a13a6c93 100644
--- a/ninja/src/subprocess_test.cc
+++ b/ninja/src/subprocess_test.cc
@@ -95,6 +95,21 @@ TEST_F(SubprocessTest, InterruptParent) {
   ADD_FAILURE() << "We should have been interrupted";
 }
 
+TEST_F(SubprocessTest, Console) {
+  // Skip test if we don't have the console ourselves.
+  if (isatty(0) && isatty(1) && isatty(2)) {
+    Subprocess* subproc = subprocs_.Add("test -t 0 -a -t 1 -a -t 2",
+                                        /*use_console=*/true);
+    ASSERT_NE((Subprocess *) 0, subproc);
+
+    while (!subproc->Done()) {
+      subprocs_.DoWork();
+    }
+
+    EXPECT_EQ(ExitSuccess, subproc->Finish());
+  }
+}
+
 #endif
 
 TEST_F(SubprocessTest, SetWithSingle) {