diff --git a/CHROMIUM_BUILD_COMPATIBILITY.txt b/CHROMIUM_BUILD_COMPATIBILITY.txt
index 234aca352..456f35e8d 100644
--- a/CHROMIUM_BUILD_COMPATIBILITY.txt
+++ b/CHROMIUM_BUILD_COMPATIBILITY.txt
@@ -47,3 +47,4 @@ Date       | CEF Revision                    | Chromium Revision
 2009-10-25 | /trunk@61                       | /trunk@30028
 2009-11-02 | /trunk@63                       | /trunk@30778
 2009-11-04 | /trunk@64                       | /trunk@31062
+2010-01-11 | /trunk@65                       | /trunk@35902
diff --git a/cef.gyp b/cef.gyp
index af94fe9dc..1128b8d57 100644
--- a/cef.gyp
+++ b/cef.gyp
@@ -145,6 +145,7 @@
         '../third_party/WebKit/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
         '../third_party/WebKit/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '../third_party/WebKit/WebCore/WebCore.gyp/WebCore.gyp:webcore',
+        '../third_party/WebKit/WebKit/chromium/WebKit.gyp:webkit',
         '../third_party/zlib/zlib.gyp:zlib',
         '../webkit/api/WebKit.gyp:webkit',
         '../webkit/webkit.gyp:appcache',
@@ -307,6 +308,7 @@
         '../third_party/WebKit/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
         '../third_party/WebKit/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '../third_party/WebKit/WebCore/WebCore.gyp/WebCore.gyp:webcore',
+        '../third_party/WebKit/WebKit/chromium/WebKit.gyp:webkit',
         '../third_party/zlib/zlib.gyp:zlib',
         '../webkit/api/WebKit.gyp:webkit',
         '../webkit/webkit.gyp:appcache',
diff --git a/libcef/browser_appcache_system.cc b/libcef/browser_appcache_system.cc
index 1748d631b..378aa1515 100644
--- a/libcef/browser_appcache_system.cc
+++ b/libcef/browser_appcache_system.cc
@@ -3,20 +3,47 @@
 // LICENSE file.
 
 #include "browser_appcache_system.h"
+#include "browser_resource_loader_bridge.h"
 
 #include "base/lock.h"
 #include "base/task.h"
 #include "base/waitable_event.h"
 #include "webkit/appcache/appcache_interceptor.h"
 #include "webkit/appcache/web_application_cache_host_impl.h"
-#include "browser_resource_loader_bridge.h"
 
 using WebKit::WebApplicationCacheHost;
 using WebKit::WebApplicationCacheHostClient;
 using appcache::WebApplicationCacheHostImpl;
 using appcache::AppCacheBackendImpl;
 using appcache::AppCacheInterceptor;
+using appcache::AppCacheThread;
 
+namespace appcache {
+
+// An impl of AppCacheThread we need to provide to the appcache lib.
+
+bool AppCacheThread::PostTask(
+    int id,
+    const tracked_objects::Location& from_here,
+    Task* task) {
+  if (BrowserAppCacheSystem::thread_provider()) {
+    return BrowserAppCacheSystem::thread_provider()->PostTask(
+        id, from_here, task);
+  }
+  scoped_ptr<Task> task_ptr(task);
+  MessageLoop* loop = BrowserAppCacheSystem::GetMessageLoop(id);
+  if (loop)
+    loop->PostTask(from_here, task_ptr.release());
+  return loop ? true : false;
+}
+
+bool AppCacheThread::CurrentlyOn(int id) {
+  if (BrowserAppCacheSystem::thread_provider())
+    return BrowserAppCacheSystem::thread_provider()->CurrentlyOn(id);
+  return MessageLoop::current() == BrowserAppCacheSystem::GetMessageLoop(id);
+}
+
+}  // namespace appcache
 
 // BrowserFrontendProxy --------------------------------------------------------
 // Proxies method calls from the backend IO thread to the frontend UI thread.
@@ -72,6 +99,10 @@ class BrowserFrontendProxy
   }
 
  private:
+  friend class base::RefCountedThreadSafe<BrowserFrontendProxy>;
+
+  ~BrowserFrontendProxy() {}
+
   BrowserAppCacheSystem* system_;
 };
 
@@ -215,6 +246,10 @@ class BrowserBackendProxy
   }
 
  private:
+  friend class base::RefCountedThreadSafe<BrowserBackendProxy>;
+
+  ~BrowserBackendProxy() {}
+
   BrowserAppCacheSystem* system_;
   base::WaitableEvent event_;
   bool bool_result_;
@@ -239,7 +274,8 @@ BrowserAppCacheSystem::BrowserAppCacheSystem()
           backend_proxy_(new BrowserBackendProxy(this))),
       ALLOW_THIS_IN_INITIALIZER_LIST(
           frontend_proxy_(new BrowserFrontendProxy(this))),
-      backend_impl_(NULL), service_(NULL) {
+      backend_impl_(NULL), service_(NULL), db_thread_("AppCacheDBThread"),
+      thread_provider_(NULL) {
   DCHECK(!instance_);
   instance_ = this;
 }
@@ -254,6 +290,7 @@ void BrowserAppCacheSystem::InitOnUIThread(
     const FilePath& cache_directory) {
   DCHECK(!ui_message_loop_);
   DCHECK(!cache_directory.empty());
+  AppCacheThread::InitIDs(DB_THREAD_ID, IO_THREAD_ID);
   ui_message_loop_ = MessageLoop::current();
   cache_directory_ = cache_directory;
 }
@@ -266,6 +303,9 @@ void BrowserAppCacheSystem::InitOnIOThread(URLRequestContext* request_context) {
   io_message_loop_ = MessageLoop::current();
   io_message_loop_->AddDestructionObserver(this);
 
+  if (!db_thread_.IsRunning())
+    db_thread_.Start();
+
   // Recreate and initialize per each IO thread.
   service_ = new appcache::AppCacheService();
   backend_impl_ = new appcache::AppCacheBackendImpl();
@@ -313,11 +353,11 @@ void BrowserAppCacheSystem::WillDestroyCurrentMessageLoop() {
   DCHECK(is_io_thread());
   DCHECK(backend_impl_->hosts().empty());
 
-  io_message_loop_ = NULL;
   delete backend_impl_;
   delete service_;
   backend_impl_ = NULL;
   service_ = NULL;
+  io_message_loop_ = NULL;
 
   // Just in case the main thread is waiting on it.
   backend_proxy_->SignalEvent();
diff --git a/libcef/browser_appcache_system.h b/libcef/browser_appcache_system.h
index fbb63be3f..ec8a5d6b8 100644
--- a/libcef/browser_appcache_system.h
+++ b/libcef/browser_appcache_system.h
@@ -7,9 +7,11 @@
 
 #include "base/file_path.h"
 #include "base/message_loop.h"
+#include "base/thread.h"
 #include "webkit/appcache/appcache_backend_impl.h"
 #include "webkit/appcache/appcache_frontend_impl.h"
 #include "webkit/appcache/appcache_service.h"
+#include "webkit/appcache/appcache_thread.h"
 #include "webkit/glue/resource_type.h"
 
 namespace WebKit {
@@ -71,12 +73,37 @@ class BrowserAppCacheSystem : public MessageLoop::DestructionObserver {
       instance_->GetExtraResponseBits(request, cache_id, manifest_url);
   }
 
+  // Some unittests create their own IO and DB threads.
+
+  enum AppCacheThreadID {
+    DB_THREAD_ID,
+    IO_THREAD_ID,
+  };
+
+  class ThreadProvider {
+   public:
+    virtual ~ThreadProvider() {}
+    virtual bool PostTask(
+        int id,
+        const tracked_objects::Location& from_here,
+        Task* task) = 0;
+    virtual bool CurrentlyOn(int id) = 0;
+  };
+
+  static void set_thread_provider(ThreadProvider* provider) {
+    DCHECK(instance_);
+    DCHECK(!provider || !instance_->thread_provider_);
+    instance_->thread_provider_ = provider;
+  }
+
+  static ThreadProvider* thread_provider() {
+    return instance_ ? instance_->thread_provider_ : NULL;
+  }
+
  private:
   friend class BrowserBackendProxy;
   friend class BrowserFrontendProxy;
-
-  // A low-tech singleton.
-  static BrowserAppCacheSystem* instance_;
+  friend class appcache::AppCacheThread;
 
   // Instance methods called by our static public methods
   void InitOnUIThread(const FilePath& cache_directory);
@@ -101,6 +128,16 @@ class BrowserAppCacheSystem : public MessageLoop::DestructionObserver {
   bool is_initailized_on_ui_thread() {
     return ui_message_loop_ && !cache_directory_.empty();
   }
+  static MessageLoop* GetMessageLoop(int id) {
+    if (instance_) {
+      if (id == IO_THREAD_ID)
+        return instance_->io_message_loop_;
+      if (id == DB_THREAD_ID)
+        return instance_->db_thread_.message_loop();
+      NOTREACHED() << "Invalid AppCacheThreadID value";
+    }
+    return NULL;
+  }
 
   // IOThread DestructionObserver
   virtual void WillDestroyCurrentMessageLoop();
@@ -117,6 +154,15 @@ class BrowserAppCacheSystem : public MessageLoop::DestructionObserver {
   // is started new instances will be created.
   appcache::AppCacheBackendImpl* backend_impl_;
   appcache::AppCacheService* service_;
+
+  // We start a thread for use as the DB thread.
+  base::Thread db_thread_;
+
+  // Some unittests create there own IO and DB threads.
+  ThreadProvider* thread_provider_;
+
+  // A low-tech singleton.
+  static BrowserAppCacheSystem* instance_;
 };
 
 #endif  // _BROWSER_APPCACHE_SYSTEM_H
diff --git a/libcef/browser_database_system.cc b/libcef/browser_database_system.cc
index c9b720840..af9c11851 100644
--- a/libcef/browser_database_system.cc
+++ b/libcef/browser_database_system.cc
@@ -11,12 +11,15 @@
 #endif
 
 #include "base/file_util.h"
-#include "base/logging.h"
 #include "base/platform_thread.h"
 #include "base/process_util.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDatabase.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "webkit/database/database_util.h"
 #include "webkit/database/vfs_backend.h"
-#include "webkit/glue/webkit_glue.h"
 
+using webkit_database::DatabaseTracker;
+using webkit_database::DatabaseUtil;
 using webkit_database::VfsBackend;
 
 BrowserDatabaseSystem* BrowserDatabaseSystem::instance_ = NULL;
@@ -26,57 +29,46 @@ BrowserDatabaseSystem* BrowserDatabaseSystem::GetInstance() {
   return instance_;
 }
 
-BrowserDatabaseSystem::BrowserDatabaseSystem()
-    : hack_main_db_handle_(base::kInvalidPlatformFileValue) {
+BrowserDatabaseSystem::BrowserDatabaseSystem() {
   temp_dir_.CreateUniqueTempDir();
+  db_tracker_ = new DatabaseTracker(temp_dir_.path());
   DCHECK(!instance_);
   instance_ = this;
 }
 
 BrowserDatabaseSystem::~BrowserDatabaseSystem() {
-  base::ClosePlatformFile(hack_main_db_handle_);
   instance_ = NULL;
 }
 
 base::PlatformFile BrowserDatabaseSystem::OpenFile(
-      const FilePath& file_name, int desired_flags,
+      const string16& vfs_file_name, int desired_flags,
       base::PlatformFile* dir_handle) {
   base::PlatformFile file_handle = base::kInvalidPlatformFileValue;
-  VfsBackend::OpenFile(GetDBFileFullPath(file_name), GetDBDir(), desired_flags,
-                       base::GetCurrentProcessHandle(), &file_handle,
-                       dir_handle);
-
-  // HACK: Currently, the DB object that keeps track of the main database
-  // (DatabaseTracker) is a singleton that is declared as a static variable
-  // in a function, so it gets destroyed at the very end of the program.
-  // Because of that, we have a handle opened to the main DB file until the
-  // very end of the program, which prevents temp_dir_'s destructor from
-  // deleting the database directory.
-  //
-  // We will properly solve this problem when we reimplement DatabaseTracker.
-  // For now, however, we are going to take advantage of the fact that in order
-  // to do anything related to DBs, we have to call openDatabase() first, which
-  // opens a handle to the main DB before opening handles to any other DB files.
-  // We are going to cache the first file handle we get, and we are going to
-  // manually close it in the destructor.
-  if (hack_main_db_handle_ == base::kInvalidPlatformFileValue) {
-    hack_main_db_handle_ = file_handle;
+  FilePath file_name = GetFullFilePathForVfsFile(vfs_file_name);
+  if (file_name.empty()) {
+    VfsBackend::OpenTempFileInDirectory(
+        db_tracker_->DatabaseDirectory(), desired_flags,
+        base::GetCurrentProcessHandle(), &file_handle, dir_handle);
+  } else {
+    VfsBackend::OpenFile(file_name, desired_flags,
+                         base::GetCurrentProcessHandle(), &file_handle,
+                         dir_handle);
   }
 
   return file_handle;
 }
 
 int BrowserDatabaseSystem::DeleteFile(
-    const FilePath& file_name, bool sync_dir) {
+    const string16& vfs_file_name, bool sync_dir) {
   // We try to delete the file multiple times, because that's what the default
   // VFS does (apparently deleting a file can sometimes fail on Windows).
   // We sleep for 10ms between retries for the same reason.
   const int kNumDeleteRetries = 3;
   int num_retries = 0;
   int error_code = SQLITE_OK;
+  FilePath file_name = GetFullFilePathForVfsFile(vfs_file_name);
   do {
-    error_code = VfsBackend::DeleteFile(
-        GetDBFileFullPath(file_name), GetDBDir(), sync_dir);
+    error_code = VfsBackend::DeleteFile(file_name, sync_dir);
   } while ((++num_retries < kNumDeleteRetries) &&
            (error_code == SQLITE_IOERR_DELETE) &&
            (PlatformThread::Sleep(10), 1));
@@ -84,25 +76,99 @@ int BrowserDatabaseSystem::DeleteFile(
   return error_code;
 }
 
-long BrowserDatabaseSystem::GetFileAttributes(
-    const FilePath& file_name) {
-  return VfsBackend::GetFileAttributes(GetDBFileFullPath(file_name));
+long BrowserDatabaseSystem::GetFileAttributes(const string16& vfs_file_name) {
+  return VfsBackend::GetFileAttributes(
+      GetFullFilePathForVfsFile(vfs_file_name));
 }
 
-long long BrowserDatabaseSystem::GetFileSize(
-    const FilePath& file_name) {
-  return VfsBackend::GetFileSize(GetDBFileFullPath(file_name));
+long long BrowserDatabaseSystem::GetFileSize(const string16& vfs_file_name) {
+  return VfsBackend::GetFileSize(GetFullFilePathForVfsFile(vfs_file_name));
+}
+
+void BrowserDatabaseSystem::DatabaseOpened(const string16& origin_identifier,
+                                          const string16& database_name,
+                                          const string16& description,
+                                          int64 estimated_size) {
+  int64 database_size = 0;
+  int64 space_available = 0;
+  database_connections_.AddConnection(origin_identifier, database_name);
+  db_tracker_->DatabaseOpened(origin_identifier, database_name, description,
+                              estimated_size, &database_size, &space_available);
+  SetFullFilePathsForVfsFile(origin_identifier, database_name);
+
+  OnDatabaseSizeChanged(origin_identifier, database_name,
+                        database_size, space_available);
+}
+
+void BrowserDatabaseSystem::DatabaseModified(const string16& origin_identifier,
+                                            const string16& database_name) {
+  DCHECK(database_connections_.IsDatabaseOpened(
+      origin_identifier, database_name));
+  db_tracker_->DatabaseModified(origin_identifier, database_name);
+}
+
+void BrowserDatabaseSystem::DatabaseClosed(const string16& origin_identifier,
+                                          const string16& database_name) {
+  DCHECK(database_connections_.IsDatabaseOpened(
+      origin_identifier, database_name));
+  db_tracker_->DatabaseClosed(origin_identifier, database_name);
+  database_connections_.RemoveConnection(origin_identifier, database_name);
+}
+
+void BrowserDatabaseSystem::OnDatabaseSizeChanged(
+    const string16& origin_identifier,
+    const string16& database_name,
+    int64 database_size,
+    int64 space_available) {
+  if (database_connections_.IsOriginUsed(origin_identifier)) {
+    WebKit::WebDatabase::updateDatabaseSize(
+        origin_identifier, database_name, database_size, space_available);
+  }
+}
+
+void BrowserDatabaseSystem::databaseOpened(const WebKit::WebDatabase& database) {
+  DatabaseOpened(database.securityOrigin().databaseIdentifier(),
+                 database.name(), database.displayName(),
+                 database.estimatedSize());
+}
+
+void BrowserDatabaseSystem::databaseModified(
+    const WebKit::WebDatabase& database) {
+  DatabaseModified(database.securityOrigin().databaseIdentifier(),
+                   database.name());
+}
+
+void BrowserDatabaseSystem::databaseClosed(const WebKit::WebDatabase& database) {
+  DatabaseClosed(database.securityOrigin().databaseIdentifier(),
+                 database.name());
 }
 
 void BrowserDatabaseSystem::ClearAllDatabases() {
-  // TODO(dumi): implement this once we refactor DatabaseTracker
-  //file_util::Delete(GetDBDir(), true);
+  db_tracker_->CloseDatabases(database_connections_);
+  database_connections_.RemoveAllConnections();
+  db_tracker_->CloseTrackerDatabaseAndClearCaches();
+  file_util::Delete(db_tracker_->DatabaseDirectory(), true);
+  file_names_.clear();
 }
 
-FilePath BrowserDatabaseSystem::GetDBDir() {
-  return temp_dir_.path().Append(FILE_PATH_LITERAL("databases"));
+void BrowserDatabaseSystem::SetFullFilePathsForVfsFile(
+    const string16& origin_identifier,
+    const string16& database_name) {
+  string16 vfs_file_name = origin_identifier + ASCIIToUTF16("/") +
+      database_name + ASCIIToUTF16("#");
+  FilePath file_name =
+      DatabaseUtil::GetFullFilePathForVfsFile(db_tracker_, vfs_file_name);
+
+  AutoLock file_names_auto_lock(file_names_lock_);
+  file_names_[vfs_file_name] = file_name;
+  file_names_[vfs_file_name + ASCIIToUTF16("-journal")] =
+      FilePath::FromWStringHack(file_name.ToWStringHack() +
+                                ASCIIToWide("-journal"));
 }
 
-FilePath BrowserDatabaseSystem::GetDBFileFullPath(const FilePath& file_name) {
-  return GetDBDir().Append(file_name);
-}
+FilePath BrowserDatabaseSystem::GetFullFilePathForVfsFile(
+    const string16& vfs_file_name) {
+  AutoLock file_names_auto_lock(file_names_lock_);
+  DCHECK(file_names_.find(vfs_file_name) != file_names_.end());
+  return file_names_[vfs_file_name];
+}
\ No newline at end of file
diff --git a/libcef/browser_database_system.h b/libcef/browser_database_system.h
index b5e15f827..6748d2097 100644
--- a/libcef/browser_database_system.h
+++ b/libcef/browser_database_system.h
@@ -6,33 +6,76 @@
 #define _BROWSER_DATABASE_SYSTEM_H
 
 #include "base/file_path.h"
+#include "base/hash_tables.h"
+#include "base/lock.h"
 #include "base/platform_file.h"
+#include "base/ref_counted.h"
 #include "base/scoped_temp_dir.h"
+#include "base/string16.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDatabaseObserver.h"
+#include "webkit/database/database_connections.h"
+#include "webkit/database/database_tracker.h"
 
-class BrowserDatabaseSystem {
+class BrowserDatabaseSystem : public webkit_database::DatabaseTracker::Observer,
+                             public WebKit::WebDatabaseObserver {
  public:
   static BrowserDatabaseSystem* GetInstance();
   BrowserDatabaseSystem();
   ~BrowserDatabaseSystem();
 
-  base::PlatformFile OpenFile(
-      const FilePath& file_name, int desired_flags,
-      base::PlatformFile* dir_handle);
-  int DeleteFile(const FilePath& file_name, bool sync_dir);
-  long GetFileAttributes(const FilePath& file_name);
-  long long GetFileSize(const FilePath& file_name);
+  // VFS functions
+  base::PlatformFile OpenFile(const string16& vfs_file_name,
+                              int desired_flags,
+                              base::PlatformFile* dir_handle);
+  int DeleteFile(const string16& vfs_file_name, bool sync_dir);
+  long GetFileAttributes(const string16& vfs_file_name);
+  long long GetFileSize(const string16& vfs_file_name);
+
+  // database tracker functions
+  void DatabaseOpened(const string16& origin_identifier,
+                      const string16& database_name,
+                      const string16& description,
+                      int64 estimated_size);
+  void DatabaseModified(const string16& origin_identifier,
+                        const string16& database_name);
+  void DatabaseClosed(const string16& origin_identifier,
+                      const string16& database_name);
+
+  // DatabaseTracker::Observer implementation
+  virtual void OnDatabaseSizeChanged(const string16& origin_identifier,
+                                     const string16& database_name,
+                                     int64 database_size,
+                                     int64 space_available);
+
+  // WebDatabaseObserver implementation
+  virtual void databaseOpened(const WebKit::WebDatabase& database);
+  virtual void databaseModified(const WebKit::WebDatabase& database);
+  virtual void databaseClosed(const WebKit::WebDatabase& database);
+
   void ClearAllDatabases();
 
  private:
-  FilePath GetDBDir();
-  FilePath GetDBFileFullPath(const FilePath& file_name);
+  // The calls that come from the database tracker run on the main thread.
+  // Therefore, we can only call DatabaseUtil::GetFullFilePathForVfsFile()
+  // on the main thread. However, the VFS calls run on the DB thread and
+  // they need to crack VFS file paths. To resolve this problem, we store
+  // a map of vfs_file_names to file_paths. The map is updated on the main
+  // thread on each DatabaseOpened() call that comes from the database
+  // tracker, and is read on the DB thread by each VFS call.
+  void SetFullFilePathsForVfsFile(const string16& origin_identifier,
+                                  const string16& database_name);
+  FilePath GetFullFilePathForVfsFile(const string16& vfs_file_name);
 
   static BrowserDatabaseSystem* instance_;
 
   ScopedTempDir temp_dir_;
 
-  // HACK: see OpenFile's implementation
-  base::PlatformFile hack_main_db_handle_;
+  scoped_refptr<webkit_database::DatabaseTracker> db_tracker_;
+
+  Lock file_names_lock_;
+  base::hash_map<string16, FilePath> file_names_;
+
+  webkit_database::DatabaseConnections database_connections_;
 };
 
 #endif  // _BROWSER_DATABASE_SYSTEM_H
diff --git a/libcef/browser_drag_delegate.cc b/libcef/browser_drag_delegate.cc
index 152b47745..cdbb3b7cf 100644
--- a/libcef/browser_drag_delegate.cc
+++ b/libcef/browser_drag_delegate.cc
@@ -5,8 +5,8 @@
 
 #include "browser_drag_delegate.h"
 
-#include "webkit/api/public/WebPoint.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebPoint.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 
 using WebKit::WebPoint;
 using WebKit::WebView;
@@ -40,10 +40,3 @@ void BrowserDragDelegate::OnDragSourceDrop() {
   webview_->dragSourceEndedAt(client, screen, WebKit::WebDragOperationCopy);
   // TODO(snej): Pass the real drag operation instead
 }
-
-void BrowserDragDelegate::OnDragSourceMove() {
-  gfx::Point client;
-  gfx::Point screen;
-  GetCursorPositions(source_hwnd_, &client, &screen);
-  webview_->dragSourceMovedTo(client, screen);
-}
diff --git a/libcef/browser_drop_delegate.cc b/libcef/browser_drop_delegate.cc
index 958304bdd..87e57166a 100644
--- a/libcef/browser_drop_delegate.cc
+++ b/libcef/browser_drop_delegate.cc
@@ -5,9 +5,9 @@
 
 #include "browser_drop_delegate.h"
 
-#include "webkit/api/public/WebDragData.h"
-#include "webkit/api/public/WebPoint.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDragData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebPoint.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/glue/webdropdata.h"
 
 using WebKit::WebDragOperation;
diff --git a/libcef/browser_impl.cc b/libcef/browser_impl.cc
index 565ff89b8..6dbd2daf7 100644
--- a/libcef/browser_impl.cc
+++ b/libcef/browser_impl.cc
@@ -8,13 +8,13 @@
 #include "request_impl.h"
 
 #include "base/string_util.h"
-#include "webkit/api/public/WebFrame.h"
-#include "webkit/api/public/WebHTTPBody.h"
-#include "webkit/api/public/WebScriptSource.h"
-#include "webkit/api/public/WebString.h"
-#include "webkit/api/public/WebURL.h"
-#include "webkit/api/public/WebURLRequest.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebHTTPBody.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebScriptSource.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURL.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURLRequest.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/glue/glue_serialize.h"
 #include "webkit/glue/glue_util.h"
 
diff --git a/libcef/browser_impl_win.cc b/libcef/browser_impl_win.cc
index ef6bbe89c..4f4b3da67 100644
--- a/libcef/browser_impl_win.cc
+++ b/libcef/browser_impl_win.cc
@@ -12,10 +12,10 @@
 #include "base/string_util.h"
 #include "base/win_util.h"
 #include "skia/ext/vector_canvas.h"
-#include "webkit/api/public/WebFrame.h"
-#include "webkit/api/public/WebRect.h"
-#include "webkit/api/public/WebSize.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebRect.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSize.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/glue/webkit_glue.h"
 
 #include <shellapi.h>
diff --git a/libcef/browser_navigation_controller.h b/libcef/browser_navigation_controller.h
index f13cdf6d5..337b98952 100644
--- a/libcef/browser_navigation_controller.h
+++ b/libcef/browser_navigation_controller.h
@@ -13,8 +13,8 @@
 #include "base/linked_ptr.h"
 #include "base/ref_counted.h"
 #include "googleurl/src/gurl.h"
-#include "webkit/api/public/WebDataSource.h"
-#include "webkit/api/public/WebHTTPBody.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDataSource.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebHTTPBody.h"
 
 #include "include/cef.h"
 
diff --git a/libcef/browser_request_context.cc b/libcef/browser_request_context.cc
index 6e69b5f2f..775c6792d 100644
--- a/libcef/browser_request_context.cc
+++ b/libcef/browser_request_context.cc
@@ -43,7 +43,7 @@ void BrowserRequestContext::Init(
       net::ProxyService::CreateSystemProxyConfigService(NULL, NULL));
   host_resolver_ = net::CreateSystemHostResolver();
   proxy_service_ = net::ProxyService::Create(proxy_config_service.release(),
-                                             false, NULL, NULL);
+                                             false, NULL, NULL, NULL);
   ssl_config_service_ = net::SSLConfigService::CreateSystemSSLConfigService();
 
   net::HttpCache *cache;
diff --git a/libcef/browser_request_context.h b/libcef/browser_request_context.h
index 2a98d0079..e117fb656 100644
--- a/libcef/browser_request_context.h
+++ b/libcef/browser_request_context.h
@@ -23,11 +23,11 @@ class BrowserRequestContext : public URLRequestContext {
                         net::HttpCache::Mode cache_mode,
                         bool no_proxy);
 
-  ~BrowserRequestContext();
-
   virtual const std::string& GetUserAgent(const GURL& url) const;
 
  private:
+  ~BrowserRequestContext();
+
   void Init(const FilePath& cache_path, net::HttpCache::Mode cache_mode,
             bool no_proxy);
 };
diff --git a/libcef/browser_resource_loader_bridge.cc b/libcef/browser_resource_loader_bridge.cc
index 613a48818..4c89cbb99 100644
--- a/libcef/browser_resource_loader_bridge.cc
+++ b/libcef/browser_resource_loader_bridge.cc
@@ -55,8 +55,8 @@
 #include "net/http/http_util.h"
 #include "net/proxy/proxy_service.h"
 #include "net/url_request/url_request.h"
-#include "webkit/api/public/WebFrame.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/appcache/appcache_interfaces.h"
 #include "webkit/glue/resource_loader_bridge.h"
 
@@ -127,12 +127,6 @@ class RequestProxy : public URLRequest::Delegate,
   {
   }
 
-  virtual ~RequestProxy() {
-    // If we have a request, then we'd better be on the io thread!
-    DCHECK(!request_.get() ||
-           MessageLoop::current() == io_thread->message_loop());
-  }
-
   void DropPeer() {
     peer_ = NULL;
   }
@@ -153,6 +147,14 @@ class RequestProxy : public URLRequest::Delegate,
   }
 
  protected:
+  friend class base::RefCountedThreadSafe<RequestProxy>;
+
+  virtual ~RequestProxy() {
+    // If we have a request, then we'd better be on the io thread!
+    DCHECK(!request_.get() ||
+           MessageLoop::current() == io_thread->message_loop());
+  }
+
   // --------------------------------------------------------------------------
   // The following methods are called on the owner's thread in response to
   // various URLRequest callbacks.  The event hooks, defined below, trigger
@@ -165,9 +167,14 @@ class RequestProxy : public URLRequest::Delegate,
 
   void NotifyReceivedRedirect(const GURL& new_url,
                               const ResourceLoaderBridge::ResponseInfo& info) {
-    if (peer_ && peer_->OnReceivedRedirect(new_url, info)) {
+    bool has_new_first_party_for_cookies = false;
+    GURL new_first_party_for_cookies;
+    if (peer_ && peer_->OnReceivedRedirect(new_url, info,
+                                           &has_new_first_party_for_cookies,
+                                           &new_first_party_for_cookies)) {
       io_thread->message_loop()->PostTask(FROM_HERE, NewRunnableMethod(
-          this, &RequestProxy::AsyncFollowDeferredRedirect));
+          this, &RequestProxy::AsyncFollowDeferredRedirect,
+          has_new_first_party_for_cookies, new_first_party_for_cookies));
     } else {
       Cancel();
     }
@@ -316,11 +323,14 @@ class RequestProxy : public URLRequest::Delegate,
     Done();
   }
 
-  void AsyncFollowDeferredRedirect() {
+  void AsyncFollowDeferredRedirect(bool has_new_first_party_for_cookies,
+                                   const GURL& new_first_party_for_cookies) {
     // This can be null in cases where the request is already done.
     if (!request_.get())
       return;
 
+    if (has_new_first_party_for_cookies)
+      request_->set_first_party_for_cookies(new_first_party_for_cookies);
     request_->FollowDeferredRedirect();
   }
 
@@ -577,25 +587,18 @@ class SyncRequestProxy : public RequestProxy {
 class ResourceLoaderBridgeImpl : public ResourceLoaderBridge {
  public:
   ResourceLoaderBridgeImpl(CefRefPtr<CefBrowser> browser,
-                           const std::string& method,
-                           const GURL& url,
-                           const GURL& first_party_for_cookies,
-                           const GURL& referrer,
-                           const std::string& headers,
-                           int load_flags,
-                           ResourceType::Type request_type,
-                           int appcache_host_id)
+      const webkit_glue::ResourceLoaderBridge::RequestInfo& request_info)
       : browser_(browser),
         params_(new RequestParams),
         proxy_(NULL) {
-    params_->method = method;
-    params_->url = url;
-    params_->first_party_for_cookies = first_party_for_cookies;
-    params_->referrer = referrer;
-    params_->headers = headers;
-    params_->load_flags = load_flags;
-    params_->request_type = request_type;
-    params_->appcache_host_id = appcache_host_id;
+    params_->method = request_info.method;
+    params_->url = request_info.url;
+    params_->first_party_for_cookies = request_info.first_party_for_cookies;
+    params_->referrer = request_info.referrer;
+    params_->headers = request_info.headers;
+    params_->load_flags = request_info.load_flags;
+    params_->request_type = request_info.request_type;
+    params_->appcache_host_id = request_info.appcache_host_id;
   }
 
   virtual ~ResourceLoaderBridgeImpl() {
@@ -690,6 +693,11 @@ class CookieSetter : public base::RefCountedThreadSafe<CookieSetter> {
     DCHECK(MessageLoop::current() == io_thread->message_loop());
     request_context->cookie_store()->SetCookie(url, cookie);
   }
+
+ private:
+  friend class base::RefCountedThreadSafe<CookieSetter>;
+
+  ~CookieSetter() {}
 };
 
 class CookieGetter : public base::RefCountedThreadSafe<CookieGetter> {
@@ -709,6 +717,10 @@ class CookieGetter : public base::RefCountedThreadSafe<CookieGetter> {
   }
 
  private:
+  friend class base::RefCountedThreadSafe<CookieGetter>;
+
+  ~CookieGetter() {}
+
   base::WaitableEvent event_;
   std::string result_;
 };
@@ -719,25 +731,12 @@ class CookieGetter : public base::RefCountedThreadSafe<CookieGetter> {
 
 namespace webkit_glue {
 
-// factory function
+// Factory function.
 ResourceLoaderBridge* ResourceLoaderBridge::Create(
-    const std::string& method,
-    const GURL& url,
-    const GURL& first_party_for_cookies,
-    const GURL& referrer,
-    const std::string& frame_origin,
-    const std::string& main_frame_origin,
-    const std::string& headers,
-    int load_flags,
-    int requestor_pid,
-    ResourceType::Type request_type,
-    int appcache_host_id,
-    int routing_id) {
-  CefRefPtr<CefBrowser> browser = _Context->GetBrowserByID(routing_id);
-  return new ResourceLoaderBridgeImpl(browser, method, url,
-                                      first_party_for_cookies,
-                                      referrer, headers, load_flags,
-                                      request_type, appcache_host_id);
+    const webkit_glue::ResourceLoaderBridge::RequestInfo& request_info) {
+  CefRefPtr<CefBrowser> browser =
+      _Context->GetBrowserByID(request_info.routing_id);
+  return new ResourceLoaderBridgeImpl(browser, request_info);
 }
 
 // Issue the proxy resolve request on the io thread, and wait 
diff --git a/libcef/browser_socket_stream_bridge.cc b/libcef/browser_socket_stream_bridge.cc
index d987ccd6c..61f5917ee 100644
--- a/libcef/browser_socket_stream_bridge.cc
+++ b/libcef/browser_socket_stream_bridge.cc
@@ -11,9 +11,9 @@
 #include "googleurl/src/gurl.h"
 #include "net/socket_stream/socket_stream.h"
 #include "net/url_request/url_request_context.h"
-#include "webkit/api/public/WebSocketStreamHandle.h"
 #include "webkit/glue/websocketstreamhandle_bridge.h"
 #include "webkit/glue/websocketstreamhandle_delegate.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSocketStreamHandle.h"
 
 using webkit_glue::WebSocketStreamHandleBridge;
 
diff --git a/libcef/browser_webkit_glue.cc b/libcef/browser_webkit_glue.cc
index a1927743e..e87711f1c 100644
--- a/libcef/browser_webkit_glue.cc
+++ b/libcef/browser_webkit_glue.cc
@@ -9,7 +9,7 @@
 MSVC_PUSH_WARNING_LEVEL(0);
 #include "Cache.h"
 #include "TextEncoding.h"
-#include "webkit/api/src/WebFrameImpl.h"
+#include "third_party/WebKit/WebKit/chromium/src/WebFrameImpl.h"
 MSVC_POP_WARNING();
 
 #include "browser_webkit_glue.h"
@@ -22,7 +22,7 @@ MSVC_POP_WARNING();
 #include "base/string16.h"
 #include "base/win_util.h"
 #include "net/base/mime_util.h"
-#include "webkit/api/public/WebFrame.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
 #include "webkit/glue/glue_util.h"
 #include "webkit/glue/webkit_glue.h"
 
diff --git a/libcef/browser_webkit_glue_win.cc b/libcef/browser_webkit_glue_win.cc
index 8316b3900..336e5ce06 100644
--- a/libcef/browser_webkit_glue_win.cc
+++ b/libcef/browser_webkit_glue_win.cc
@@ -20,9 +20,9 @@ MSVC_POP_WARNING();
 #include "app/gfx/gdi_util.h"
 #include "base/logging.h"
 #include "skia/ext/platform_canvas.h"
-#include "webkit/api/public/WebRect.h"
-#include "webkit/api/public/WebSize.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebRect.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSize.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/glue/webkit_glue.h"
 #include "webkit/glue/plugins/plugin_list.h"
 
diff --git a/libcef/browser_webkit_init.h b/libcef/browser_webkit_init.h
index adc0ab54b..da095223f 100644
--- a/libcef/browser_webkit_init.h
+++ b/libcef/browser_webkit_init.h
@@ -16,17 +16,18 @@
 #include "webkit/database/vfs_backend.h"
 #include "webkit/extensions/v8/gears_extension.h"
 #include "webkit/extensions/v8/interval_extension.h"
-#include "webkit/api/public/WebCString.h"
-#include "webkit/api/public/WebData.h"
-#include "webkit/api/public/WebRuntimeFeatures.h"
-#include "webkit/api/public/WebKit.h"
-#include "webkit/api/public/WebScriptController.h"
-#include "webkit/api/public/WebSecurityPolicy.h"
-#include "webkit/api/public/WebStorageArea.h"
-#include "webkit/api/public/WebStorageEventDispatcher.h"
-#include "webkit/api/public/WebStorageNamespace.h"
-#include "webkit/api/public/WebString.h"
-#include "webkit/api/public/WebURL.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebCString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDatabase.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebKit.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebRuntimeFeatures.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebScriptController.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSecurityPolicy.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebStorageArea.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebStorageEventDispatcher.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebStorageNamespace.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURL.h"
 #include "webkit/glue/simple_webmimeregistry_impl.h"
 #include "webkit/glue/webclipboard_impl.h"
 #include "webkit/glue/webkit_glue.h"
@@ -48,6 +49,8 @@ class BrowserWebKitInit : public webkit_glue::WebKitClientImpl {
     WebKit::WebScriptController::registerExtension(
         extensions_v8::IntervalExtension::Get());
     WebKit::WebRuntimeFeatures::enableSockets(true);
+    WebKit::WebRuntimeFeatures::enableApplicationCache(true);
+    WebKit::WebRuntimeFeatures::enableDatabase(true);
 
     // Load libraries for media and enable the media player.
     FilePath module_path;
@@ -60,6 +63,8 @@ class BrowserWebKitInit : public webkit_glue::WebKitClientImpl {
     // content during the run. Upon exit that directory is deleted.
     if (appcache_dir_.CreateUniqueTempDir())
       BrowserAppCacheSystem::InitializeOnUIThread(appcache_dir_.path());
+
+    WebKit::WebDatabase::setObserver(&database_system_);
   }
 
   ~BrowserWebKitInit() {
@@ -83,27 +88,27 @@ class BrowserWebKitInit : public webkit_glue::WebKitClientImpl {
   }
 
   virtual WebKit::WebKitClient::FileHandle databaseOpenFile(
-      const WebKit::WebString& file_name, int desired_flags,
+      const WebKit::WebString& vfs_file_name, int desired_flags,
       WebKit::WebKitClient::FileHandle* dir_handle) {
     return BrowserDatabaseSystem::GetInstance()->OpenFile(
-        webkit_glue::WebStringToFilePath(file_name),
-        desired_flags, dir_handle);
+        vfs_file_name, desired_flags, dir_handle);
   }
 
-  virtual int databaseDeleteFile(const WebKit::WebString& file_name,
+  virtual int databaseDeleteFile(const WebKit::WebString& vfs_file_name,
                                  bool sync_dir) {
     return BrowserDatabaseSystem::GetInstance()->DeleteFile(
-        webkit_glue::WebStringToFilePath(file_name), sync_dir);
+        vfs_file_name, sync_dir);
   }
 
-  virtual long databaseGetFileAttributes(const WebKit::WebString& file_name) {
+  virtual long databaseGetFileAttributes(
+      const WebKit::WebString& vfs_file_name) {
     return BrowserDatabaseSystem::GetInstance()->GetFileAttributes(
-        webkit_glue::WebStringToFilePath(file_name));
+        vfs_file_name);
   }
 
-  virtual long long databaseGetFileSize(const WebKit::WebString& file_name) {
-    return BrowserDatabaseSystem::GetInstance()->GetFileSize(
-        webkit_glue::WebStringToFilePath(file_name));
+  virtual long long databaseGetFileSize(
+      const WebKit::WebString& vfs_file_name) {
+    return BrowserDatabaseSystem::GetInstance()->GetFileSize(vfs_file_name);
   }
 
   virtual bool getFileSize(const WebKit::WebString& path, long long& result) {
@@ -178,7 +183,8 @@ class BrowserWebKitInit : public webkit_glue::WebKitClientImpl {
 
   void dispatchStorageEvent(const WebKit::WebString& key,
       const WebKit::WebString& old_value, const WebKit::WebString& new_value,
-      const WebKit::WebString& origin, bool is_local_storage) {
+      const WebKit::WebString& origin, const WebKit::WebURL& url,
+      bool is_local_storage) {
     // TODO(jorlow): Implement
     if (!is_local_storage)
       return;
@@ -187,8 +193,8 @@ class BrowserWebKitInit : public webkit_glue::WebKitClientImpl {
       dom_storage_event_dispatcher_.reset(
           WebKit::WebStorageEventDispatcher::create());
     }
-    dom_storage_event_dispatcher_->dispatchStorageEvent(key, old_value,
-        new_value, origin, is_local_storage);
+    dom_storage_event_dispatcher_->dispatchStorageEvent(
+        key, old_value, new_value, origin, url, is_local_storage);
   }
 
   virtual WebKit::WebApplicationCacheHost* createApplicationCacheHost(
@@ -200,7 +206,7 @@ class BrowserWebKitInit : public webkit_glue::WebKitClientImpl {
       return NULL;
   }
 
-private:
+ private:
   webkit_glue::SimpleWebMimeRegistryImpl mime_registry_;
   webkit_glue::WebClipboardImpl clipboard_;
   ScopedTempDir appcache_dir_;
diff --git a/libcef/browser_webview_delegate.cc b/libcef/browser_webview_delegate.cc
index 5ca9ca3f0..3e2d97972 100644
--- a/libcef/browser_webview_delegate.cc
+++ b/libcef/browser_webview_delegate.cc
@@ -7,8 +7,6 @@
 // as the WebViewDelegate for the BrowserWebHost.  The host is expected to
 // have initialized a MessageLoop before these methods are called.
 
-#include "third_party/webkit/webcore/config.h"
-#undef LOG
 #include "browser_webview_delegate.h"
 #include "browser_impl.h"
 #include "browser_navigation_controller.h"
@@ -25,27 +23,27 @@
 #include "base/string_util.h"
 #include "base/trace_event.h"
 #include "net/base/net_errors.h"
-#include "webkit/api/public/WebConsoleMessage.h"
-#include "webkit/api/public/WebContextMenuData.h"
-#include "webkit/api/public/WebCString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebConsoleMessage.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebContextMenuData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebCString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDataSource.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebDragData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebHistoryItem.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebKit.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebNode.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebPoint.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebPopupMenu.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebRange.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebScreenInfo.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebString.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURL.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURLError.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURLRequest.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURLResponse.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/appcache/appcache_interfaces.h"
-#include "webkit/api/public/WebData.h"
-#include "webkit/api/public/WebDataSource.h"
-#include "webkit/api/public/WebDragData.h"
-#include "webkit/api/public/WebFrame.h"
-#include "webkit/api/public/WebHistoryItem.h"
-#include "webkit/api/public/WebKit.h"
-#include "webkit/api/public/WebNode.h"
-#include "webkit/api/public/WebPoint.h"
-#include "webkit/api/public/WebPopupMenu.h"
-#include "webkit/api/public/WebRange.h"
-#include "webkit/api/public/WebScreenInfo.h"
-#include "webkit/api/public/WebString.h"
-#include "webkit/api/public/WebURL.h"
-#include "webkit/api/public/WebURLError.h"
-#include "webkit/api/public/WebURLRequest.h"
-#include "webkit/api/public/WebURLResponse.h"
-#include "webkit/api/public/WebView.h"
 #include "webkit/glue/glue_serialize.h"
 #include "webkit/glue/glue_util.h"
 #include "webkit/glue/media/buffered_data_source.h"
@@ -74,7 +72,7 @@ using WebKit::WebDataSource;
 using WebKit::WebDragData;
 using WebKit::WebDragOperationsMask;
 using WebKit::WebEditingAction;
-using WebKit::WebForm;
+using WebKit::WebFormElement;
 using WebKit::WebFrame;
 using WebKit::WebHistoryItem;
 using WebKit::WebMediaPlayer;
@@ -222,6 +220,18 @@ bool BrowserWebViewDelegate::isSelectTrailingWhitespaceEnabled() {
   return select_trailing_whitespace_enabled_;
 }
 
+bool BrowserWebViewDelegate::handleCurrentKeyboardEvent() {
+  if (edit_command_name_.empty())
+    return false;
+
+  WebFrame* frame = browser_->GetWebView()->focusedFrame();
+  if (!frame)
+    return false;
+
+  return frame->executeCommand(WebString::fromUTF8(edit_command_name_),
+                               WebString::fromUTF8(edit_command_value_));
+}
+
 bool BrowserWebViewDelegate::runFileChooser(
       bool multi_select, const WebKit::WebString& title,
       const WebKit::WebString& initial_value,
diff --git a/libcef/browser_webview_delegate.h b/libcef/browser_webview_delegate.h
index e97cc1c32..9a56f6067 100644
--- a/libcef/browser_webview_delegate.h
+++ b/libcef/browser_webview_delegate.h
@@ -21,10 +21,10 @@
 #include "base/basictypes.h"
 #include "base/scoped_ptr.h"
 #include "base/weak_ptr.h"
-#include "webkit/api/public/WebContextMenuData.h"
-#include "webkit/api/public/WebFrameClient.h"
-#include "webkit/api/public/WebRect.h"
-#include "webkit/api/public/WebViewClient.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebContextMenuData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrameClient.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebRect.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebViewClient.h"
 #include "webkit/glue/webcursor.h"
 #include "webkit/glue/webplugin_page_delegate.h"
 #if defined(OS_WIN)
@@ -69,6 +69,7 @@ class BrowserWebViewDelegate : public WebKit::WebViewClient,
       const WebKit::WebString& style, const WebKit::WebRange& range);
   virtual bool isSmartInsertDeleteEnabled();
   virtual bool isSelectTrailingWhitespaceEnabled();
+  virtual bool handleCurrentKeyboardEvent();
   virtual bool runFileChooser(
       bool multi_select, const WebKit::WebString& title,
       const WebKit::WebString& initial_value,
@@ -210,6 +211,16 @@ class BrowserWebViewDelegate : public WebKit::WebViewClient,
     return block_redirects_;
   }
 
+  void SetEditCommand(const std::string& name, const std::string& value) {
+    edit_command_name_ = name;
+    edit_command_value_ = value;
+  }
+
+  void ClearEditCommand() {
+    edit_command_name_.clear();
+    edit_command_value_.clear();
+  }
+
   CefBrowserImpl* GetBrowser() { return browser_; }
 
  protected:
@@ -286,6 +297,10 @@ class BrowserWebViewDelegate : public WebKit::WebViewClient,
   // true if we should block any redirects
   bool block_redirects_;
 
+  // Edit command associated to the current keyboard event.
+  std::string edit_command_name_;
+  std::string edit_command_value_;
+
   DISALLOW_COPY_AND_ASSIGN(BrowserWebViewDelegate);
 };
 
diff --git a/libcef/browser_webview_delegate_win.cc b/libcef/browser_webview_delegate_win.cc
index beac2daed..90bd6e99a 100644
--- a/libcef/browser_webview_delegate_win.cc
+++ b/libcef/browser_webview_delegate_win.cc
@@ -25,11 +25,11 @@
 #include "base/string_util.h"
 #include "base/trace_event.h"
 #include "net/base/net_errors.h"
-#include "webkit/api/public/WebContextMenuData.h"
-#include "webkit/api/public/WebCursorInfo.h"
-#include "webkit/api/public/WebFrame.h"
-#include "webkit/api/public/WebRect.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebContextMenuData.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebCursorInfo.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebRect.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/glue/webdropdata.h"
 #include "webkit/glue/webpreferences.h"
 #include "webkit/glue/webplugin.h"
diff --git a/libcef/context.cc b/libcef/context.cc
index 20bd1a964..88706e502 100644
--- a/libcef/context.cc
+++ b/libcef/context.cc
@@ -19,7 +19,7 @@
 #include "base/stats_table.h"
 #include "base/string_util.h"
 #include "net/base/net_module.h"
-#include "webkit/api/public/WebScriptController.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebScriptController.h"
 #include "webkit/extensions/v8/gc_extension.h"
 #include "webkit/glue/webplugin.h"
 #include "webkit/glue/plugins/plugin_lib.h"
@@ -342,6 +342,7 @@ bool CefContext::Initialize(bool multi_threaded_message_loop,
       webprefs_->javascript_can_open_windows_automatically = true;
       webprefs_->dom_paste_enabled = true;
       webprefs_->developer_extras_enabled = true;
+      webprefs_->site_specific_quirks_enabled = true;
       webprefs_->shrinks_standalone_images_to_fit = false;
       webprefs_->uses_universal_detector = false;
       webprefs_->text_areas_are_resizable = true;
@@ -350,7 +351,6 @@ bool CefContext::Initialize(bool multi_threaded_message_loop,
       webprefs_->xss_auditor_enabled = false;
       webprefs_->remote_fonts_enabled = true;
       webprefs_->local_storage_enabled = true;
-      webprefs_->session_storage_enabled = true;
       webprefs_->application_cache_enabled = true;
       webprefs_->databases_enabled = true;
 
diff --git a/libcef/request_impl.cc b/libcef/request_impl.cc
index 44dc813b7..39f7deea2 100644
--- a/libcef/request_impl.cc
+++ b/libcef/request_impl.cc
@@ -9,7 +9,7 @@
 #include "net/http/http_response_headers.h"
 #include "net/http/http_util.h"
 #include "net/url_request/url_request.h"
-#include "webkit/api/public/WebHTTPHeaderVisitor.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebHTTPHeaderVisitor.h"
 #include "webkit/glue/glue_util.h"
 
 using net::HttpResponseHeaders;
diff --git a/libcef/request_impl.h b/libcef/request_impl.h
index 21b8e5c8d..bd797b53e 100644
--- a/libcef/request_impl.h
+++ b/libcef/request_impl.h
@@ -7,8 +7,8 @@
 
 #include "../include/cef.h"
 #include "net/base/upload_data.h"
-#include "webkit/api/public/WebHTTPBody.h"
-#include "webkit/api/public/WebURLRequest.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebHTTPBody.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebURLRequest.h"
 
 class URLRequest;
 
diff --git a/libcef/scheme_impl.cc b/libcef/scheme_impl.cc
index 91afc116d..fcabaddd1 100644
--- a/libcef/scheme_impl.cc
+++ b/libcef/scheme_impl.cc
@@ -360,7 +360,7 @@ private:
 CefUrlRequestFilter* CefUrlRequestFilter::shared_instance_ = NULL;
 
 
-class SchemeRequestJobWrapper {
+class SchemeRequestJobWrapper : public CefThreadSafeBase<CefBase> {
 public:
   SchemeRequestJobWrapper(const std::string& scheme_name,
       const std::string& host_name,
@@ -379,9 +379,6 @@ public:
         scheme_name_, host_name_, factory_);
   }
 
-  void AddRef() {}
-  void Release() { delete this; }
-
   static bool ImplementsThreadSafeReferenceCounting() { return true; }
 
 private:
@@ -398,10 +395,16 @@ bool CefRegisterScheme(const std::wstring& scheme_name,
   if(!_Context.get())
     return false;
 
-  SchemeRequestJobWrapper* wrapper = new SchemeRequestJobWrapper(
-      WideToUTF8(scheme_name), WideToUTF8(host_name), factory);
+  // Use a smart pointer for the wrapper object because
+  // RunnableMethodTraits::RetainCallee() (originating from NewRunnableMethod)
+  // will call AddRef() and Release() on the object in debug mode, resulting in
+  // the object being deleted if it doesn't already have a reference.
+  CefRefPtr<SchemeRequestJobWrapper> wrapper(
+      new SchemeRequestJobWrapper(WideToUTF8(scheme_name),
+          WideToUTF8(host_name), factory));
 
-  PostTask(FROM_HERE, NewRunnableMethod(wrapper,
+  PostTask(FROM_HERE, NewRunnableMethod(wrapper.get(),
       &SchemeRequestJobWrapper::RegisterScheme));
+
   return true;
 }
diff --git a/libcef/v8_impl.cc b/libcef/v8_impl.cc
index c30de5676..62e455cdd 100644
--- a/libcef/v8_impl.cc
+++ b/libcef/v8_impl.cc
@@ -7,8 +7,8 @@
 #include "tracker.h"
 #include "base/lazy_instance.h"
 #include "base/string_util.h"
-#include "webkit/api/public/WebKit.h"
-#include "webkit/api/public/WebScriptController.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebKit.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebScriptController.h"
 
 // Memory manager.
 
diff --git a/libcef/webview_host.cc b/libcef/webview_host.cc
index c3f972a3d..c3c315a4d 100644
--- a/libcef/webview_host.cc
+++ b/libcef/webview_host.cc
@@ -8,7 +8,7 @@
 #include "base/gfx/rect.h"
 #include "base/gfx/size.h"
 #include "base/win_util.h"
-#include "webkit/api/public/WebView.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebView.h"
 #include "webkit/glue/webpreferences.h"
 
 using namespace WebKit;
diff --git a/libcef/webwidget_host.cc b/libcef/webwidget_host.cc
index 5c1c16741..f58970f20 100644
--- a/libcef/webwidget_host.cc
+++ b/libcef/webwidget_host.cc
@@ -8,12 +8,12 @@
 #include "base/gfx/rect.h"
 #include "base/logging.h"
 #include "base/win_util.h"
-#include "webkit/api/public/WebInputEvent.h"
-#include "webkit/api/public/WebPopupMenu.h"
-#include "webkit/api/public/WebScreenInfo.h"
-#include "webkit/api/public/WebSize.h"
-#include "webkit/api/public/win/WebInputEventFactory.h"
-#include "webkit/api/public/win/WebScreenInfoFactory.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebInputEvent.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebPopupMenu.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebScreenInfo.h"
+#include "third_party/WebKit/WebKit/chromium/public/WebSize.h"
+#include "third_party/WebKit/WebKit/chromium/public/win/WebInputEventFactory.h"
+#include "third_party/WebKit/WebKit/chromium/public/win/WebScreenInfoFactory.h"
 
 using WebKit::WebInputEvent;
 using WebKit::WebInputEventFactory;
diff --git a/libcef/webwidget_host.h b/libcef/webwidget_host.h
index 35ca8fbe9..37b700fdd 100644
--- a/libcef/webwidget_host.h
+++ b/libcef/webwidget_host.h
@@ -53,6 +53,8 @@ class WebWidgetHost {
 
   WebKit::WebScreenInfo GetScreenInfo();
 
+  void PaintRect(const gfx::Rect& rect);
+
  protected:
   WebWidgetHost();
   ~WebWidgetHost();
@@ -97,8 +99,6 @@ class WebWidgetHost {
 
   void TrackMouseLeave(bool enable);
   void ResetScrollRect();
-  void PaintRect(const gfx::Rect& rect);
-
   void set_painting(bool value) {
 #ifndef NDEBUG
     painting_ = value;