Imported WebKit commit 7e538425aa020340619e927792f3d895061fb54b (http://svn.webkit.org/repository/webkit/trunk@116286)

20 files changed, 376 insertions, 169 deletions

diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
index 01e73f95f..2efa0b891 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
@@ -102,7 +102,7 @@ JSObject* NPRuntimeObjectMap::getOrCreateJSObject(JSGlobalObject* globalObject,
         return jsNPObject;
 
     JSNPObject* jsNPObject = JSNPObject::create(globalObject, this, npObject);
-    m_jsNPObjects.set(npObject, JSC::PassWeak<JSNPObject>(globalObject->globalData(), jsNPObject, this, npObject));
+    m_jsNPObjects.set(npObject, JSC::PassWeak<JSNPObject>(jsNPObject, this, npObject));
 
     return jsNPObject;
 }
@@ -290,11 +290,13 @@ void NPRuntimeObjectMap::addToInvalidationQueue(NPObject* npObject)
 
 void NPRuntimeObjectMap::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
 {
+    JSNPObject* object = jsCast<JSNPObject*>(asObject(handle.get()));
+
     HashMap<NPObject*, JSC::Weak<JSNPObject> >::iterator found = m_jsNPObjects.find(static_cast<NPObject*>(context));
     ASSERT(found != m_jsNPObjects.end());
-    ASSERT_UNUSED(handle, asObject(handle.get()) == found->second);
-    JSNPObject* object = found->second.get();
+    ASSERT(found->second.was(object));
     m_jsNPObjects.remove(found);
+
     addToInvalidationQueue(object->leakNPObject());
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
index bdc6e9de9..fcd31f13b 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
@@ -417,9 +417,6 @@ static const unsigned WKNVAllowedToEnterSandbox = 74658;
 
 // WKNVSandboxFunctions = 74659 is defined in NetscapeSandboxFunctions.h
 
-// The Core Animation render server port.
-static const unsigned WKNVCALayerRenderServerPort = 71879;
-
 #endif
 
 static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
@@ -551,23 +548,9 @@ static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
            break;
 
        case NPNVToolkit: {
-#if PLATFORM(GTK)
-           *reinterpret_cast<uint32_t*>(value) = 2;
-#else
-           const uint32_t expectedGTKToolKitVersion = 2;
-
-           // Set the expected GTK version if we know that this plugin needs it or if the plugin call us
-           // with a null instance. The latter is the case with NSPluginWrapper plugins.
-           bool requiresGTKToolKitVersion;
-           if (!npp)
-               requiresGTKToolKitVersion = true;
-           else {
-               RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
-               requiresGTKToolKitVersion = plugin->quirks().contains(PluginQuirks::RequiresGTKToolKit);
-           }
-
-           *reinterpret_cast<uint32_t*>(value) = requiresGTKToolKitVersion ? expectedGTKToolKitVersion : 0;
-#endif
+           // Gtk based plugins need to be assured about the toolkit version.
+           const uint32_t expectedGtkToolKitVersion = 2;
+           *reinterpret_cast<uint32_t*>(value) = expectedGtkToolKitVersion;
            break;
        }
 
@@ -706,12 +689,6 @@ static void NPN_ReleaseObject(NPObject *npObject)
 
 static bool NPN_Invoke(NPP npp, NPObject *npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
 {
-    if (RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp)) {
-        bool returnValue;
-        if (plugin->tryToShortCircuitInvoke(npObject, methodName, arguments, argumentCount, returnValue, *result))
-            return returnValue;
-    }
-
     if (npObject->_class->invoke)
         return npObject->_class->invoke(npObject, methodName, arguments, argumentCount, result);
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.h
index 49a7f3a9d..583df9724 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.h
@@ -30,6 +30,9 @@
 
 namespace WebKit {
 
+// The Core Animation render server port.
+static const unsigned WKNVCALayerRenderServerPort = 71879;
+
 NPNetscapeFuncs* netscapeBrowserFuncs();
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index 1f09dc408..b63c73a4e 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -35,6 +35,8 @@
 #include <WebCore/HTTPHeaderMap.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/KURL.h>
+#include <runtime/JSObject.h>
+#include <runtime/ScopeChain.h>
 #include <utility>
 #include <wtf/text/CString.h>
 
@@ -66,12 +68,13 @@ NetscapePlugin::NetscapePlugin(PassRefPtr<NetscapePluginModule> pluginModule)
 #endif
     , m_isTransparent(false)
     , m_inNPPNew(false)
-    , m_loadManually(false)
+    , m_shouldUseManualLoader(false)
     , m_nextTimerID(0)
 #if PLATFORM(MAC)
     , m_drawingModel(static_cast<NPDrawingModel>(-1))
     , m_eventModel(static_cast<NPEventModel>(-1))
     , m_pluginReturnsNonretainedLayer(!m_pluginModule->pluginQuirks().contains(PluginQuirks::ReturnsRetainedCoreAnimationLayer))
+    , m_layerHostingMode(LayerHostingModeDefault)
     , m_currentMouseEvent(0)
     , m_pluginHasFocus(false)
     , m_windowHasFocus(false)
@@ -86,6 +89,9 @@ NetscapePlugin::NetscapePlugin(PassRefPtr<NetscapePluginModule> pluginModule)
 #elif PLUGIN_ARCHITECTURE(X11)
     , m_drawable(0)
     , m_pluginDisplay(0)
+#if PLATFORM(GTK)
+    , m_platformPluginWidget(0)
+#endif
 #endif
 {
     m_npp.ndata = this;
@@ -257,11 +263,6 @@ NPObject* NetscapePlugin::pluginElementNPObject()
     return controller()->pluginElementNPObject();
 }
 
-bool NetscapePlugin::tryToShortCircuitInvoke(NPObject* npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, bool& returnValue, NPVariant& result)
-{
-    return controller()->tryToShortCircuitInvoke(npObject, methodName, arguments, argumentCount, returnValue, result);
-}
-
 void NetscapePlugin::cancelStreamLoad(NetscapePluginStream* pluginStream)
 {
     if (pluginStream == m_manualStream) {
@@ -545,9 +546,9 @@ bool NetscapePlugin::allowPopups() const
 
 bool NetscapePlugin::initialize(const Parameters& parameters)
 {
-    uint16_t mode = parameters.loadManually ? NP_FULL : NP_EMBED;
+    uint16_t mode = parameters.isFullFramePlugin ? NP_FULL : NP_EMBED;
     
-    m_loadManually = parameters.loadManually;
+    m_shouldUseManualLoader = parameters.shouldUseManualLoader;
 
     CString mimeTypeCString = parameters.mimeType.utf8();
 
@@ -584,6 +585,8 @@ bool NetscapePlugin::initialize(const Parameters& parameters)
             }
         }
     }
+
+    m_layerHostingMode = parameters.layerHostingMode;
 #endif
 
     NetscapePlugin* previousNPPNewPlugin = currentNPPNewPlugin;
@@ -611,7 +614,7 @@ bool NetscapePlugin::initialize(const Parameters& parameters)
     }
 
     // Load the src URL if needed.
-    if (!parameters.loadManually && !parameters.url.isEmpty() && shouldLoadSrcURL())
+    if (!parameters.shouldUseManualLoader && !parameters.url.isEmpty() && shouldLoadSrcURL())
         loadURL("GET", parameters.url.string(), String(), HTTPHeaderMap(), Vector<uint8_t>(), false, 0);
     
     return true;
@@ -787,7 +790,7 @@ void NetscapePlugin::manualStreamDidReceiveResponse(const KURL& responseURL, uin
                                                     const String& mimeType, const String& headers, const String& /* suggestedFileName */)
 {
     ASSERT(m_isStarted);
-    ASSERT(m_loadManually);
+    ASSERT(m_shouldUseManualLoader);
     ASSERT(!m_manualStream);
     
     m_manualStream = NetscapePluginStream::create(this, 0, responseURL.string(), false, 0);
@@ -797,7 +800,7 @@ void NetscapePlugin::manualStreamDidReceiveResponse(const KURL& responseURL, uin
 void NetscapePlugin::manualStreamDidReceiveData(const char* bytes, int length)
 {
     ASSERT(m_isStarted);
-    ASSERT(m_loadManually);
+    ASSERT(m_shouldUseManualLoader);
     ASSERT(m_manualStream);
 
     m_manualStream->didReceiveData(bytes, length);
@@ -806,7 +809,7 @@ void NetscapePlugin::manualStreamDidReceiveData(const char* bytes, int length)
 void NetscapePlugin::manualStreamDidFinishLoading()
 {
     ASSERT(m_isStarted);
-    ASSERT(m_loadManually);
+    ASSERT(m_shouldUseManualLoader);
     ASSERT(m_manualStream);
 
     m_manualStream->didFinishLoading();
@@ -815,7 +818,7 @@ void NetscapePlugin::manualStreamDidFinishLoading()
 void NetscapePlugin::manualStreamDidFail(bool wasCancelled)
 {
     ASSERT(m_isStarted);
-    ASSERT(m_loadManually);
+    ASSERT(m_shouldUseManualLoader);
 
     if (!m_manualStream)
         return;
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
index adad2d015..660b68540 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
@@ -101,8 +101,6 @@ public:
     NPObject* windowScriptNPObject();
     NPObject* pluginElementNPObject();
 
-    bool tryToShortCircuitInvoke(NPObject*, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, bool& returnValue, NPVariant& result);
-
     void cancelStreamLoad(NetscapePluginStream*);
     void removePluginStream(NetscapePluginStream*);
 
@@ -207,9 +205,12 @@ private:
 
     virtual uint64_t pluginComplexTextInputIdentifier() const;
     virtual void sendComplexTextInput(const String& textInput);
+    virtual void setLayerHostingMode(LayerHostingMode) OVERRIDE;
 
     void pluginFocusOrWindowFocusChanged();
     void setComplexTextInputEnabled(bool);
+
+    void updatePluginLayer();
 #endif
 
     virtual void contentsScaleFactorChanged(float);
@@ -233,6 +234,11 @@ private:
     void scheduleWindowedGeometryUpdate();
 #endif
 
+#if PLUGIN_ARCHITECTURE(X11)
+    bool platformPostInitializeWindowed(bool needsXEmbed, uint64_t windowID);
+    bool platformPostInitializeWindowless();
+#endif
+
     uint64_t m_nextRequestID;
 
     typedef HashMap<uint64_t, std::pair<String, void*> > PendingURLNotifyMap;
@@ -262,7 +268,7 @@ private:
     bool m_isWindowed;
     bool m_isTransparent;
     bool m_inNPPNew;
-    bool m_loadManually;
+    bool m_shouldUseManualLoader;
     RefPtr<NetscapePluginStream> m_manualStream;
     Vector<bool, 8> m_popupEnabledStates;
 
@@ -303,6 +309,7 @@ private:
 
     RetainPtr<PlatformLayer> m_pluginLayer;
     bool m_pluginReturnsNonretainedLayer;
+    LayerHostingMode m_layerHostingMode;
 
     NPCocoaEvent* m_currentMouseEvent;
 
@@ -341,6 +348,9 @@ private:
 #elif PLUGIN_ARCHITECTURE(X11)
     Pixmap m_drawable;
     Display* m_pluginDisplay;
+#if PLATFORM(GTK)
+    GtkWidget* m_platformPluginWidget;
+#endif
 
 public: // Need to call it in the NPN_GetValue browser callback.
     static Display* x11HostDisplay();
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
index c8d53819f..d01134501 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "NetscapePlugin.h"
 
+#import "NetscapeBrowserFuncs.h"
 #import "PluginController.h"
 #import "WebEvent.h"
 #import <Carbon/Carbon.h>
@@ -167,6 +168,11 @@ NPError NetscapePlugin::popUpContextMenu(NPMenu* npMenu)
 
 mach_port_t NetscapePlugin::compositingRenderServerPort()
 {
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+    if (m_layerHostingMode == LayerHostingModeInWindowServer)
+        return MACH_PORT_NULL;
+#endif
+
     return controller()->compositingRenderServerPort();
 }
 
@@ -219,27 +225,7 @@ bool NetscapePlugin::platformPostInitialize()
         return false;
 #endif
 
-    if (m_drawingModel == NPDrawingModelCoreAnimation) {
-        void* value = 0;
-        // Get the Core Animation layer.
-        if (NPP_GetValue(NPPVpluginCoreAnimationLayer, &value) == NPERR_NO_ERROR && value) {
-            ASSERT(!m_pluginLayer);
-
-            // The original Core Animation drawing model required that plug-ins pass a retained layer
-            // to the browser, which the browser would then adopt. However, the final spec changed this
-            // (See https://wiki.mozilla.org/NPAPI:CoreAnimationDrawingModel for more information)
-            // after a version of WebKit1 with the original implementation had shipped, but that now means
-            // that any plug-ins that expect the WebKit1 behavior would leak the CALayer.
-            // For plug-ins that we know return retained layers, we have the ReturnsRetainedCoreAnimationLayer 
-            // plug-in quirk. Plug-ins can also check for whether the browser expects a non-retained layer to
-            // be returned by using NPN_GetValue and pass the WKNVExpectsNonretainedLayer parameter.
-            // https://bugs.webkit.org/show_bug.cgi?id=58282 describes the bug where WebKit expects retained layers.
-            if (m_pluginReturnsNonretainedLayer)
-                m_pluginLayer = reinterpret_cast<CALayer *>(value);
-            else
-                m_pluginLayer.adoptNS(reinterpret_cast<CALayer *>(value));
-        }
-    }
+    updatePluginLayer();
 
 #ifndef NP_NO_CARBON
     if (m_eventModel == NPEventModelCarbon) {
@@ -1022,6 +1008,19 @@ void NetscapePlugin::sendComplexTextInput(const String& textInput)
     }
 }
 
+void NetscapePlugin::setLayerHostingMode(LayerHostingMode layerHostingMode)
+{
+    m_layerHostingMode = layerHostingMode;
+
+    // Tell the plug-in about the new compositing render server port. If it returns OK we'll ask it again for a new layer.
+    mach_port_t port = NetscapePlugin::compositingRenderServerPort();
+    if (NPP_SetValue(static_cast<NPNVariable>(WKNVCALayerRenderServerPort), &port) != NPERR_NO_ERROR)
+        return;
+
+    m_pluginLayer = nullptr;
+    updatePluginLayer();
+}
+
 void NetscapePlugin::pluginFocusOrWindowFocusChanged()
 {
     bool pluginHasFocusAndWindowHasFocus = m_pluginHasFocus && m_windowHasFocus;
@@ -1056,6 +1055,37 @@ PlatformLayer* NetscapePlugin::pluginLayer()
     return static_cast<PlatformLayer*>(m_pluginLayer.get());
 }
 
+void NetscapePlugin::updatePluginLayer()
+{
+    if (m_drawingModel != NPDrawingModelCoreAnimation)
+        return;
+
+    void* value = 0;
+
+    // Get the Core Animation layer.
+    if (NPP_GetValue(NPPVpluginCoreAnimationLayer, &value) != NPERR_NO_ERROR)
+        return;
+
+    if (!value)
+        return;
+
+    ASSERT(!m_pluginLayer);
+
+    // The original Core Animation drawing model required that plug-ins pass a retained layer
+    // to the browser, which the browser would then adopt. However, the final spec changed this
+    // (See https://wiki.mozilla.org/NPAPI:CoreAnimationDrawingModel for more information)
+    // after a version of WebKit1 with the original implementation had shipped, but that now means
+    // that any plug-ins that expect the WebKit1 behavior would leak the CALayer.
+    // For plug-ins that we know return retained layers, we have the ReturnsRetainedCoreAnimationLayer
+    // plug-in quirk. Plug-ins can also check for whether the browser expects a non-retained layer to
+    // be returned by using NPN_GetValue and pass the WKNVExpectsNonretainedLayer parameter.
+    // https://bugs.webkit.org/show_bug.cgi?id=58282 describes the bug where WebKit expects retained layers.
+    if (m_pluginReturnsNonretainedLayer)
+        m_pluginLayer = reinterpret_cast<CALayer *>(value);
+    else
+        m_pluginLayer.adoptNS(reinterpret_cast<CALayer *>(value));
+}
+
 #ifndef NP_NO_CARBON
 void NetscapePlugin::nullEventTimerFired()
 {
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm
index 43aea5faa..f2386c479 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm
@@ -29,6 +29,7 @@
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 
 #import "PluginProcess.h"
+#import "NetscapePluginModule.h"
 #import "WebKitSystemInterface.h"
 #import <WebCore/FileSystem.h>
 #import <WebCore/SoftLinking.h>
@@ -59,22 +60,22 @@ static bool enteredSandbox;
 
 static CString readSandboxProfile()
 {
-    RetainPtr<CFURLRef> profileURL(AdoptCF, CFBundleCopyResourceURL(CFBundleGetMainBundle(), CFSTR("plugin"), CFSTR("sb"), 0));
+    RetainPtr<CFURLRef> profileURL(AdoptCF, CFBundleCopyResourceURL(CFBundleGetMainBundle(), CFSTR("com.apple.WebKit.PluginProcess"), CFSTR("sb"), 0));
     char profilePath[PATH_MAX];
     if (!CFURLGetFileSystemRepresentation(profileURL.get(), false, reinterpret_cast<UInt8*>(profilePath), sizeof(profilePath))) {
-        fprintf(stderr, "Could not get file system representation of plug-in sandbox URL\n");
+        WTFLogAlways("Could not get file system representation of plug-in sandbox URL\n");
         return CString();
     }
 
     FILE *file = fopen(profilePath, "r");
     if (!file) {
-        fprintf(stderr, "Could not open plug-in sandbox file '%s'\n", profilePath);
+        WTFLogAlways("Could not open plug-in sandbox file '%s'\n", profilePath);
         return CString();
     }
 
     struct stat fileInfo;
     if (stat(profilePath, &fileInfo)) {
-        fprintf(stderr, "Could not get plug-in sandbox file size '%s'\n", profilePath);
+        WTFLogAlways("Could not get plug-in sandbox file size '%s'\n", profilePath);
         return CString();
     }
 
@@ -82,7 +83,7 @@ static CString readSandboxProfile()
     CString result = CString::newUninitialized(fileInfo.st_size, characterBuffer);
 
     if (1 != fread(characterBuffer, fileInfo.st_size, 1, file)) {
-        fprintf(stderr, "Could not read plug-in sandbox file '%s'\n", profilePath);
+        WTFLogAlways("Could not read plug-in sandbox file '%s'\n", profilePath);
         return CString();
     }
 
@@ -100,6 +101,19 @@ NPError WKN_EnterSandbox(const char* readOnlyPaths[], const char* readWritePaths
     if (profile.isNull())
         exit(EX_NOPERM);
 
+#if !defined(BUILDING_ON_LION)
+    // Use private temporary and cache directories.
+    String systemDirectorySuffix = "com.apple.WebKit.PluginProcess+" + PluginProcess::shared().netscapePluginModule()->module()->bundleIdentifier();
+    setenv("DIRHELPER_USER_DIR_SUFFIX", fileSystemRepresentation(systemDirectorySuffix).data(), 0);
+    char temporaryDirectory[PATH_MAX];
+    if (!confstr(_CS_DARWIN_USER_TEMP_DIR, temporaryDirectory, sizeof(temporaryDirectory))) {
+        WTFLogAlways("PluginProcess: couldn't retrieve private temporary directory path: %d\n", errno);
+        exit(EX_NOPERM);
+    }
+    setenv("TMPDIR", temporaryDirectory, 1);
+#endif
+
+
     Vector<const char*> extendedReadOnlyPaths;
     if (readOnlyPaths) {
         for (unsigned i = 0; readOnlyPaths[i]; ++i)
@@ -122,15 +136,12 @@ NPError WKN_EnterSandbox(const char* readOnlyPaths[], const char* readWritePaths
             extendedReadWritePaths.append(readWritePaths[i]);
     }
 
-    // FIXME: <rdar://problem/10785457> Use a custom temporary directory.
     char darwinUserTempDirectory[PATH_MAX];
     if (confstr(_CS_DARWIN_USER_TEMP_DIR, darwinUserTempDirectory, PATH_MAX) > 0)
         extendedReadWritePaths.append(darwinUserTempDirectory);
 
-    // FIXME: <rdar://problem/10792047> Use a custom cache directory.
     char darwinUserCacheDirectory[PATH_MAX];
-    size_t darwinUserCachePathSize = confstr(_CS_DARWIN_USER_CACHE_DIR, darwinUserCacheDirectory, PATH_MAX);
-    if (darwinUserCachePathSize > 0)
+    if (confstr(_CS_DARWIN_USER_CACHE_DIR, darwinUserCacheDirectory, PATH_MAX) > 0)
         extendedReadWritePaths.append(darwinUserCacheDirectory);
 
     RetainPtr<CFStringRef> cachePath(AdoptCF, WKCopyFoundationCacheDirectory());
@@ -145,12 +156,12 @@ NPError WKN_EnterSandbox(const char* readOnlyPaths[], const char* readWritePaths
     const char* sandboxParameters[] = { "HOME_DIR", homeDirectory, 0, 0 };
 
     if (!WKEnterPluginSandbox(profile.data(), sandboxParameters, extendedReadOnlyPaths.data(), extendedReadWritePaths.data())) {
-        fprintf(stderr, "Couldn't initialize sandbox profile\n");
+        WTFLogAlways("Couldn't initialize sandbox profile\n");
         exit(EX_NOPERM);
     }
 
     if (noErr != WKEnableSandboxStyleFileQuarantine()) {
-        fprintf(stderr, "Couldn't enable file quarantine\n");
+        WTFLogAlways("Couldn't enable file quarantine\n");
         exit(EX_NOPERM);
     }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm
index 49385d9d9..844861299 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm
@@ -29,22 +29,29 @@
 #if ENABLE(PLUGIN_PROCESS)
 
 #import "PluginController.h"
+#import "PluginControllerProxyMessages.h"
+#import "PluginProcessConnection.h"
 #import <WebKitSystemInterface.h>
 
 namespace WebKit {
 
+static void makeRenderLayer(CALayer *pluginLayer, uint32_t layerHostingContextID)
+{
+    CALayer *renderLayer = WKMakeRenderLayer(layerHostingContextID);
+    [renderLayer setFrame:[pluginLayer bounds]];
+    [renderLayer setAutoresizingMask:kCALayerWidthSizable | kCALayerHeightSizable];
+    [pluginLayer setSublayers:[NSArray arrayWithObject:renderLayer]];
+}
+
 PlatformLayer* PluginProxy::pluginLayer()
 {
     if (!m_pluginLayer && m_remoteLayerClientID) {
-        CALayer *renderLayer = WKMakeRenderLayer(m_remoteLayerClientID);
-
         // Create a layer with flipped geometry and add the real plug-in layer as a sublayer
         // so the coordinate system will match the event coordinate system.
         m_pluginLayer.adoptNS([[CALayer alloc] init]);
         [m_pluginLayer.get() setGeometryFlipped:YES];
-        
-        [renderLayer setAutoresizingMask:kCALayerWidthSizable | kCALayerHeightSizable];
-        [m_pluginLayer.get() addSublayer:renderLayer];
+
+        makeRenderLayer(m_pluginLayer.get(), m_remoteLayerClientID);
     }
 
     return m_pluginLayer.get();
@@ -65,6 +72,20 @@ void PluginProxy::setComplexTextInputState(uint64_t complexTextInputState)
     controller()->setComplexTextInputState(static_cast<PluginComplexTextInputState>(complexTextInputState));
 }
 
+void PluginProxy::setLayerHostingMode(LayerHostingMode layerHostingMode)
+{
+    m_connection->connection()->send(Messages::PluginControllerProxy::SetLayerHostingMode(layerHostingMode), m_pluginInstanceID);
+}
+
+void PluginProxy::setLayerHostingContextID(uint32_t layerHostingContextID)
+{
+    ASSERT(m_pluginLayer.get());
+
+    m_remoteLayerClientID = layerHostingContextID;
+    makeRenderLayer(m_pluginLayer.get(), m_remoteLayerClientID);
+}
+
+
 } // namespace WebKit
 
 #endif // ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
index a1c2a31a2..6564fd15f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
@@ -29,6 +29,7 @@
 
 #include "NetscapePlugin.h"
 
+#include "PluginController.h"
 #include "WebEvent.h"
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/NotImplemented.h>
@@ -39,6 +40,10 @@
 #include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include <cairo/cairo-xlib.h>
+#include <gtk/gtk.h>
+#ifndef GTK_API_VERSION_2
+#include <gtk/gtkx.h>
+#endif
 #include <gdk/gdkx.h>
 #include <WebCore/GtkVersioning.h>
 #endif
@@ -144,26 +149,65 @@ Display* NetscapePlugin::x11HostDisplay()
 #endif
 }
 
-bool NetscapePlugin::platformPostInitialize()
-{
 #if PLATFORM(GTK)
-    if (moduleMixesGtkSymbols(m_pluginModule->module()))
-        return false;
+static gboolean socketPlugRemovedCallback(GtkSocket*)
+{
+    // Default action is to destroy the GtkSocket, so we just return TRUE here
+    // to be able to reuse the socket. For some obscure reason, newer versions
+    // of flash plugin remove the plug from the socket, probably because the plug
+    // created by the plugin is re-parented.
+    return TRUE;
+}
 #endif
 
-    if (m_isWindowed)
+bool NetscapePlugin::platformPostInitializeWindowed(bool needsXEmbed, uint64_t windowID)
+{
+    m_npWindow.type = NPWindowTypeWindow;
+    if (!needsXEmbed) {
+        notImplemented();
         return false;
+    }
 
-    if (!(m_pluginDisplay = getPluginDisplay()))
-        return false;
+    Display* display = x11HostDisplay();
 
-    NPSetWindowCallbackStruct* callbackStruct = new NPSetWindowCallbackStruct;
-    callbackStruct->type = 0;
+#if PLATFORM(GTK)
+    // It seems flash needs the socket to be in the same process,
+    // I guess it uses gdk_window_lookup(), so we create a new socket here
+    // containing a plug with the UI process socket embedded.
+    m_platformPluginWidget = gtk_plug_new(static_cast<Window>(windowID));
+    GtkWidget* socket = gtk_socket_new();
+    g_signal_connect(socket, "plug-removed", G_CALLBACK(socketPlugRemovedCallback), 0);
+    gtk_container_add(GTK_CONTAINER(m_platformPluginWidget), socket);
+    gtk_widget_show(socket);
+    gtk_widget_show(m_platformPluginWidget);
+
+    m_npWindow.window = GINT_TO_POINTER(gtk_socket_get_id(GTK_SOCKET(socket)));
+    GdkWindow* window = gtk_widget_get_window(socket);
+    NPSetWindowCallbackStruct* callbackStruct = static_cast<NPSetWindowCallbackStruct*>(m_npWindow.ws_info);
+    callbackStruct->display = GDK_WINDOW_XDISPLAY(window);
+    callbackStruct->visual = GDK_VISUAL_XVISUAL(gdk_window_get_visual(window));
+    callbackStruct->depth = gdk_visual_get_depth(gdk_window_get_visual(window));
+    callbackStruct->colormap = XCreateColormap(display, GDK_ROOT_WINDOW(), callbackStruct->visual, AllocNone);
+#endif
+
+    XFlush(display);
+
+    callSetWindow();
+
+    return true;
+}
+
+bool NetscapePlugin::platformPostInitializeWindowless()
+{
     Display* display = x11HostDisplay();
+    m_npWindow.type = NPWindowTypeDrawable;
+    m_npWindow.window = 0;
+
     int depth = displayDepth();
 #if PLATFORM(QT)
     ASSERT(depth == 16 || depth == 24 || depth == 32);
 #endif
+    NPSetWindowCallbackStruct* callbackStruct = static_cast<NPSetWindowCallbackStruct*>(m_npWindow.ws_info);
     callbackStruct->display = display;
     callbackStruct->depth = depth;
 
@@ -182,15 +226,45 @@ bool NetscapePlugin::platformPostInitialize()
     callbackStruct->visual = visual;
     callbackStruct->colormap = XCreateColormap(display, rootWindowID(), visual, AllocNone);
 
-    m_npWindow.type = NPWindowTypeDrawable;
-    m_npWindow.window = 0;
-    m_npWindow.ws_info = callbackStruct;
-
     callSetWindow();
 
     return true;
 }
 
+bool NetscapePlugin::platformPostInitialize()
+{
+#if PLATFORM(GTK)
+    if (moduleMixesGtkSymbols(m_pluginModule->module()))
+        return false;
+#endif
+
+    uint64_t windowID = 0;
+    bool needsXEmbed = false;
+    if (m_isWindowed) {
+        NPP_GetValue(NPPVpluginNeedsXEmbed, &needsXEmbed);
+        if (needsXEmbed) {
+            windowID = controller()->createPluginContainer();
+            if (!windowID)
+                return false;
+        } else {
+            notImplemented();
+            return false;
+        }
+    }
+
+    if (!(m_pluginDisplay = getPluginDisplay()))
+        return false;
+
+    NPSetWindowCallbackStruct* callbackStruct = new NPSetWindowCallbackStruct;
+    callbackStruct->type = 0;
+    m_npWindow.ws_info = callbackStruct;
+
+    if (m_isWindowed)
+        return platformPostInitializeWindowed(needsXEmbed, windowID);
+
+    return platformPostInitializeWindowless();
+}
+
 void NetscapePlugin::platformDestroy()
 {
     NPSetWindowCallbackStruct* callbackStruct = static_cast<NPSetWindowCallbackStruct*>(m_npWindow.ws_info);
@@ -213,7 +287,13 @@ bool NetscapePlugin::platformInvalidate(const IntRect&)
 void NetscapePlugin::platformGeometryDidChange()
 {
     if (m_isWindowed) {
-        notImplemented();
+        uint64_t windowID = 0;
+#if PLATFORM(GTK)
+        windowID = static_cast<uint64_t>(GDK_WINDOW_XID(gtk_plug_get_socket_window(GTK_PLUG(m_platformPluginWidget))));
+#endif
+        IntRect clipRect(m_clipRect);
+        clipRect.move(-m_frameRectInWindowCoordinates.x(), -m_frameRectInWindowCoordinates.y());
+        controller()->windowedPluginGeometryDidChange(m_frameRectInWindowCoordinates, clipRect, windowID);
         return;
     }
 
@@ -238,10 +318,8 @@ void NetscapePlugin::platformVisibilityDidChange()
 
 void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool /*isSnapshot*/)
 {
-    if (m_isWindowed) {
-        notImplemented();
+    if (m_isWindowed)
         return;
-    }
 
     if (!m_isStarted) {
         // FIXME: we should paint a missing plugin icon.
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
index e4a624a67..c4d178c6e 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -105,6 +105,7 @@ private:
     virtual void contentsScaleFactorChanged(float);
     virtual uint64_t pluginComplexTextInputIdentifier() const;
     virtual void sendComplexTextInput(const String& textInput);
+    virtual void setLayerHostingMode(LayerHostingMode) OVERRIDE;
 #endif
 
     virtual void privateBrowsingStateChanged(bool);
@@ -113,7 +114,7 @@ private:
     virtual WebCore::Scrollbar* horizontalScrollbar();
     virtual WebCore::Scrollbar* verticalScrollbar();
 
-    virtual RetainPtr<CGPDFDocumentRef> pdfDocumentForPrinting() const OVERRIDE { return m_pdfDocument; }
+    virtual RetainPtr<PDFDocument> pdfDocumentForPrinting() const OVERRIDE { return m_pdfDocument; }
 
     // ScrollableArea methods.
     virtual WebCore::IntRect scrollCornerRect() const;
@@ -150,7 +151,7 @@ private:
     String m_suggestedFilename;
     RetainPtr<CFMutableDataRef> m_dataBuffer;
 
-    RetainPtr<CGPDFDocumentRef> m_pdfDocument;
+    RetainPtr<PDFDocument> m_pdfDocument;
     Vector<WebCore::IntRect> m_pageBoxes;
     WebCore::IntSize m_pdfDocumentSize; // All pages, including gaps.
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.cpp b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.mm
index d5b8353ee..7dc0b0e64 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,31 +23,33 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "BuiltInPDFView.h"
-
-#include "PluginView.h"
-#include "ShareableBitmap.h"
-#include "WebEvent.h"
-#include "WebEventConversion.h"
-#include <JavaScriptCore/JSContextRef.h>
-#include <JavaScriptCore/JSObjectRef.h>
-#include <JavaScriptCore/JSStringRef.h>
-#include <JavaScriptCore/JSStringRefCF.h>
-#include <WebCore/ArchiveResource.h>
-#include <WebCore/Chrome.h>
-#include <WebCore/DocumentLoader.h>
-#include <WebCore/FocusController.h>
-#include <WebCore/Frame.h>
-#include <WebCore/FrameView.h>
-#include <WebCore/GraphicsContext.h>
-#include <WebCore/HTTPHeaderMap.h>
-#include <WebCore/LocalizedStrings.h>
-#include <WebCore/Page.h>
-#include <WebCore/PluginData.h>
-#include <WebCore/RenderBoxModelObject.h>
-#include <WebCore/ScrollAnimator.h>
-#include <WebCore/ScrollbarTheme.h>
+#import "config.h"
+#import "BuiltInPDFView.h"
+
+#import "PDFKitImports.h"
+#import "PluginView.h"
+#import "ShareableBitmap.h"
+#import "WebEvent.h"
+#import "WebEventConversion.h"
+#import <JavaScriptCore/JSContextRef.h>
+#import <JavaScriptCore/JSObjectRef.h>
+#import <JavaScriptCore/JSStringRef.h>
+#import <JavaScriptCore/JSStringRefCF.h>
+#import <PDFKit/PDFKit.h>
+#import <WebCore/ArchiveResource.h>
+#import <WebCore/Chrome.h>
+#import <WebCore/DocumentLoader.h>
+#import <WebCore/FocusController.h>
+#import <WebCore/Frame.h>
+#import <WebCore/FrameView.h>
+#import <WebCore/GraphicsContext.h>
+#import <WebCore/HTTPHeaderMap.h>
+#import <WebCore/LocalizedStrings.h>
+#import <WebCore/Page.h>
+#import <WebCore/PluginData.h>
+#import <WebCore/RenderBoxModelObject.h>
+#import <WebCore/ScrollAnimator.h>
+#import <WebCore/ScrollbarTheme.h>
 
 using namespace WebCore;
 using namespace std;
@@ -283,8 +285,7 @@ void BuiltInPDFView::pdfDocumentDidLoad()
 {
     addArchiveResource();
 
-    RetainPtr<CGDataProviderRef> pdfDataProvider(AdoptCF, CGDataProviderCreateWithCFData(m_dataBuffer.get()));
-    m_pdfDocument.adoptCF(CGPDFDocumentCreateWithProvider(pdfDataProvider.get()));
+    m_pdfDocument.adoptNS([[pdfDocumentClass() alloc] initWithData:(NSData *)m_dataBuffer.get()]);
 
     calculateSizes();
     updateScrollbars();
@@ -292,7 +293,7 @@ void BuiltInPDFView::pdfDocumentDidLoad()
     controller()->invalidate(IntRect(0, 0, m_pluginSize.width(), m_pluginSize.height()));
 
     Vector<RetainPtr<CFStringRef> > scripts;
-    getAllScriptsInPDFDocument(m_pdfDocument.get(), scripts);
+    getAllScriptsInPDFDocument([m_pdfDocument.get() documentRef], scripts);
 
     size_t scriptCount = scripts.size();
     if (!scriptCount)
@@ -312,9 +313,9 @@ void BuiltInPDFView::pdfDocumentDidLoad()
 
 void BuiltInPDFView::calculateSizes()
 {
-    size_t pageCount = CGPDFDocumentGetNumberOfPages(m_pdfDocument.get());
+    size_t pageCount = CGPDFDocumentGetNumberOfPages([m_pdfDocument.get() documentRef]);
     for (size_t i = 0; i < pageCount; ++i) {
-        CGPDFPageRef pdfPage = CGPDFDocumentGetPage(m_pdfDocument.get(), i + 1);
+        CGPDFPageRef pdfPage = CGPDFDocumentGetPage([m_pdfDocument.get() documentRef], i + 1);
         ASSERT(pdfPage);
 
         CGRect box = CGPDFPageGetBoxRect(pdfPage, kCGPDFCropBox);
@@ -331,7 +332,7 @@ bool BuiltInPDFView::initialize(const Parameters& parameters)
 {
     // Load the src URL if needed.
     m_sourceURL = parameters.url;
-    if (!parameters.loadManually && !parameters.url.isEmpty())
+    if (!parameters.shouldUseManualLoader && !parameters.url.isEmpty())
         controller()->loadURL(pdfDocumentRequestID, "GET", parameters.url.string(), String(), HTTPHeaderMap(), Vector<uint8_t>(), false);
 
     return true;
@@ -394,7 +395,7 @@ void BuiltInPDFView::paintContent(GraphicsContext* graphicsContext, const IntRec
         if (pageTop > contentRect.maxY())
             break;
         if (pageTop + pageBox.height() + extraOffsetForCenteringY + gutterHeight >= contentRect.y()) {
-            CGPDFPageRef pdfPage = CGPDFDocumentGetPage(m_pdfDocument.get(), i + 1);
+            CGPDFPageRef pdfPage = CGPDFDocumentGetPage([m_pdfDocument.get() documentRef], i + 1);
 
             graphicsContext->save();
             graphicsContext->translate(extraOffsetForCenteringX - pageBox.x(), -extraOffsetForCenteringY - pageBox.y() - pageBox.height());
@@ -640,6 +641,10 @@ void BuiltInPDFView::sendComplexTextInput(const String&)
 {
 }
 
+void BuiltInPDFView::setLayerHostingMode(LayerHostingMode)
+{
+}
+
 #endif
 
 void BuiltInPDFView::privateBrowsingStateChanged(bool)
@@ -706,7 +711,7 @@ bool BuiltInPDFView::isActive() const
     return false;
 }
 
-void BuiltInPDFView::invalidateScrollbarRect(Scrollbar* scrollbar, const LayoutRect& rect)
+void BuiltInPDFView::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
 {
     IntRect dirtyRect = rect;
     dirtyRect.moveBy(scrollbar->location());
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.cpp b/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
index 87c9940a5..bc884b962 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
@@ -38,9 +38,11 @@ void Plugin::Parameters::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(names);
     encoder->encode(values);
     encoder->encode(mimeType);
-    encoder->encode(loadManually);
-    encoder->encode(documentURL);
-    encoder->encode(toplevelDocumentURL);
+    encoder->encode(isFullFramePlugin);
+    encoder->encode(shouldUseManualLoader);
+#if PLATFORM(MAC)
+    encoder->encodeEnum(layerHostingMode);
+#endif
 }
 
 bool Plugin::Parameters::decode(CoreIPC::ArgumentDecoder* decoder, Parameters& parameters)
@@ -57,13 +59,14 @@ bool Plugin::Parameters::decode(CoreIPC::ArgumentDecoder* decoder, Parameters& p
         return false;
     if (!decoder->decode(parameters.mimeType))
         return false;
-    if (!decoder->decode(parameters.loadManually))
+    if (!decoder->decode(parameters.isFullFramePlugin))
         return false;
-    if (!decoder->decode(parameters.documentURL))
+    if (!decoder->decode(parameters.shouldUseManualLoader))
         return false;
-    if (!decoder->decode(parameters.toplevelDocumentURL))
+#if PLATFORM(MAC)
+    if (!decoder->decodeEnum(parameters.layerHostingMode))
         return false;
-
+#endif
     if (parameters.names.size() != parameters.values.size()) {
         decoder->markInvalid();
         return false;
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.h b/Source/WebKit2/WebProcess/Plugins/Plugin.h
index 4c656a3a7..4f10da9bc 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.h
@@ -33,6 +33,12 @@
 #include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
 
+#if PLATFORM(MAC)
+#include "LayerHostingContext.h"
+
+OBJC_CLASS PDFDocument;
+#endif
+
 struct NPObject;
 
 namespace CoreIPC {
@@ -64,14 +70,11 @@ public:
         Vector<String> names;
         Vector<String> values;
         String mimeType;
-        bool loadManually;
-
-        // The URL of the document that the plug-in is in.
-        String documentURL;
-
-        // The URL of the document in the main frame. Will be null if the document the plug-in
-        // doesn't have access to the main frame document.
-        String toplevelDocumentURL;
+        bool isFullFramePlugin;
+        bool shouldUseManualLoader;
+#if PLATFORM(MAC)
+        LayerHostingMode layerHostingMode;
+#endif
 
         void encode(CoreIPC::ArgumentEncoder*) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Parameters&);
@@ -200,6 +203,9 @@ public:
 
     // Send the complex text input to the plug-in.
     virtual void sendComplexTextInput(const String& textInput) = 0;
+
+    // Tells the plug-in about changes to the layer hosting mode.
+    virtual void setLayerHostingMode(LayerHostingMode) = 0;
 #endif
 
     // Tells the plug-in about scale factor changes.
@@ -219,8 +225,8 @@ public:
     virtual WebCore::Scrollbar* horizontalScrollbar() = 0;
     virtual WebCore::Scrollbar* verticalScrollbar() = 0;
 
-#if USE(CG)
-    virtual RetainPtr<CGPDFDocumentRef> pdfDocumentForPrinting() const { return 0; }
+#if PLATFORM(MAC)
+    virtual RetainPtr<PDFDocument> pdfDocumentForPrinting() const { return 0; }
 #endif
 
 protected:
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginController.h b/Source/WebKit2/WebProcess/Plugins/PluginController.h
index da48eb6e1..25032cca0 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginController.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginController.h
@@ -85,9 +85,6 @@ public:
     // Evaluates the given script string in the context of the given NPObject.
     virtual bool evaluate(NPObject*, const String& scriptString, NPVariant* result, bool allowPopups) = 0;
 
-    // Tries to short circuit the NPN_Invoke call with the given parameters. Returns true on success.
-    virtual bool tryToShortCircuitInvoke(NPObject*, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, bool& returnValue, NPVariant& result) = 0;
-
     // Set the statusbar text.
     virtual void setStatusbarText(const String&) = 0;
 
@@ -146,6 +143,12 @@ public:
     // Decrements a counter that, when it reaches 0, stops preventing the plug-in from being destroyed.
     virtual void unprotectPluginFromDestruction() = 0;
 
+#if PLUGIN_ARCHITECTURE(X11)
+    // Create a plugin container for windowed plugins
+    virtual uint64_t createPluginContainer() = 0;
+    virtual void windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID) = 0;
+#endif
+
     // Helper class for delaying destruction of a plug-in.
     class PluginDestructionProtector {
     public:
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
index b2152713b..8339ad45c 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
@@ -28,6 +28,8 @@
 
 #if ENABLE(PLUGIN_PROCESS)
 
+#include <runtime/JSObject.h>
+#include <runtime/ScopeChain.h>
 #include "NPRemoteObjectMap.h"
 #include "NPRuntimeObjectMap.h"
 #include "PluginProcessConnectionManager.h"
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
index 638250e8e..0771bc3d5 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
@@ -523,6 +523,18 @@ void PluginProxy::setStatusbarText(const String& statusbarText)
     controller()->setStatusbarText(statusbarText);
 }
 
+#if PLUGIN_ARCHITECTURE(X11)
+void PluginProxy::createPluginContainer(uint64_t& windowID)
+{
+    windowID = controller()->createPluginContainer();
+}
+
+void PluginProxy::windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID)
+{
+    controller()->windowedPluginGeometryDidChange(frameRect, clipRect, windowID);
+}
+#endif
+
 void PluginProxy::update(const IntRect& paintedRect)
 {
     if (paintedRect == pluginBounds())
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
index d2a538777..e4b428669 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
@@ -100,6 +100,7 @@ private:
     virtual void windowVisibilityChanged(bool);
     virtual uint64_t pluginComplexTextInputIdentifier() const;
     virtual void sendComplexTextInput(const String& textInput);
+    virtual void setLayerHostingMode(LayerHostingMode) OVERRIDE;
 #endif
 
     virtual void contentsScaleFactorChanged(float);
@@ -132,6 +133,11 @@ private:
 #if PLATFORM(MAC)
     void pluginFocusOrWindowFocusChanged(bool);
     void setComplexTextInputState(uint64_t);
+    void setLayerHostingContextID(uint32_t);
+#endif
+#if PLUGIN_ARCHITECTURE(X11)
+    void createPluginContainer(uint64_t& windowID);
+    void windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID);
 #endif
 
     String m_pluginPath;
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in b/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in
index ce756169a..a2ef31965 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in
@@ -60,8 +60,19 @@ messages -> PluginProxy {
     # Called when the plug-in's focus or its containing window focus changes.
     PluginFocusOrWindowFocusChanged(bool pluginHasFocusAndWindowHasFocus)
 
-    # Change whether complext text input is enabled for this plug-in.
+    # Change whether complex text input is enabled for this plug-in.
     SetComplexTextInputState(uint64_t complexTextInputState)
+
+    # Update the layer hosting context ID. Called whenever the layer hosting state changes.
+    SetLayerHostingContextID(uint32_t layerHostingContextID)
+#endif
+
+#if PLUGIN_ARCHITECTURE(X11)
+    # Create the plugin container for windowed plugins
+    CreatePluginContainer() -> (uint64_t windowID)
+
+    # Update geometry of windowed plugin widget
+    WindowedPluginGeometryDidChange(WebCore::IntRect frameRect, WebCore::IntRect clipRect, uint64_t windowID)
 #endif
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
index 8935dcf78..6799f11b3 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
@@ -29,6 +29,7 @@
 #include "NPRuntimeUtilities.h"
 #include "Plugin.h"
 #include "ShareableBitmap.h"
+#include "WebCoreArgumentCoders.h"
 #include "WebEvent.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
@@ -289,7 +290,7 @@ PluginView::~PluginView()
         m_plugin->destroyPlugin();
         m_isBeingDestroyed = false;
 #if PLATFORM(MAC)
-        setComplexTextInputState(PluginComplexTextInputDisabled);
+        pluginFocusOrWindowFocusChanged(false);
 #endif
     }
 
@@ -434,6 +435,19 @@ bool PluginView::sendComplexTextInput(uint64_t pluginComplexTextInputIdentifier,
     return true;
 }
 
+void PluginView::setLayerHostingMode(LayerHostingMode layerHostingMode)
+{
+    if (!m_plugin)
+        return;
+
+    if (!m_isInitialized) {
+        m_parameters.layerHostingMode = layerHostingMode;
+        return;
+    }
+
+    m_plugin->setLayerHostingMode(layerHostingMode);
+}
+
 #endif
 
 void PluginView::initializePlugin()
@@ -1063,12 +1077,6 @@ bool PluginView::evaluate(NPObject* npObject, const String& scriptString, NPVari
     return m_npRuntimeObjectMap.evaluate(npObject, scriptString, result);
 }
 
-bool PluginView::tryToShortCircuitInvoke(NPObject*, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, bool& returnValue, NPVariant& result)
-{
-    // Never try to short-circuit invoke in the web process.
-    return false;
-}
-
 void PluginView::setStatusbarText(const String& statusbarText)
 {
     if (!frame())
@@ -1244,4 +1252,18 @@ void PluginView::didFailLoad(WebFrame* webFrame, bool wasCancelled)
     m_plugin->frameDidFail(request->requestID(), wasCancelled);
 }
 
+#if PLUGIN_ARCHITECTURE(X11)
+uint64_t PluginView::createPluginContainer()
+{
+    uint64_t windowID = 0;
+    m_webPage->sendSync(Messages::WebPageProxy::CreatePluginContainer(), Messages::WebPageProxy::CreatePluginContainer::Reply(windowID));
+    return windowID;
+}
+
+void PluginView::windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID)
+{
+    m_webPage->send(Messages::WebPageProxy::WindowedPluginGeometryDidChange(frameRect, clipRect, windowID));
+}
+#endif
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.h b/Source/WebKit2/WebProcess/Plugins/PluginView.h
index cd6363a58..1bf76ae71 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.h
@@ -65,10 +65,8 @@ public:
     void setDeviceScaleFactor(float);
     void windowAndViewFramesChanged(const WebCore::IntRect& windowFrameInScreenCoordinates, const WebCore::IntRect& viewFrameInWindowCoordinates);
     bool sendComplexTextInput(uint64_t pluginComplexTextInputIdentifier, const String& textInput);
-#endif
-
-#if USE(CG)
-    RetainPtr<CGPDFDocumentRef> pdfDocumentForPrinting() const { return m_plugin->pdfDocumentForPrinting(); }
+    void setLayerHostingMode(LayerHostingMode);
+    RetainPtr<PDFDocument> pdfDocumentForPrinting() const { return m_plugin->pdfDocumentForPrinting(); }
 #endif
 
     // FIXME: Remove this; nobody should have to know about the plug-in view's renderer except the plug-in view itself.
@@ -141,7 +139,6 @@ private:
     virtual NPObject* windowScriptNPObject();
     virtual NPObject* pluginElementNPObject();
     virtual bool evaluate(NPObject*, const String&scriptString, NPVariant* result, bool allowPopups);
-    virtual bool tryToShortCircuitInvoke(NPObject*, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, bool& returnValue, NPVariant& result);
     virtual void setStatusbarText(const String&);
     virtual bool isAcceleratedCompositingEnabled();
     virtual void pluginProcessCrashed();
@@ -163,6 +160,10 @@ private:
     virtual bool isPrivateBrowsingEnabled();
     virtual void protectPluginFromDestruction();
     virtual void unprotectPluginFromDestruction();
+#if PLUGIN_ARCHITECTURE(X11)
+    virtual uint64_t createPluginContainer();
+    virtual void windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID);
+#endif
 
     // WebFrame::LoadListener
     virtual void didFinishLoad(WebFrame*);