Merge from Chromium at DEPS revision 260540

This commit was generated by merge_to_master.py.

Change-Id: I10b8e4931992bb84eb4da800a337bbd0a52f6588

57 files changed, 732 insertions, 193 deletions

diff --git a/content/app/android/child_process_service.cc b/content/app/android/child_process_service.cc
index dae54e5941..0a78803c02 100644
--- a/content/app/android/child_process_service.cc
+++ b/content/app/android/child_process_service.cc
@@ -13,6 +13,7 @@
 #include "base/logging.h"
 #include "base/posix/global_descriptors.h"
 #include "content/child/child_thread.h"
+#include "content/common/android/surface_texture_lookup.h"
 #include "content/common/android/surface_texture_peer.h"
 #include "content/common/gpu/gpu_surface_lookup.h"
 #include "content/public/app/android_library_loader_hooks.h"
@@ -29,8 +30,9 @@ namespace content {
 
 namespace {
 
-class SurfaceTexturePeerChildImpl : public content::SurfaceTexturePeer,
-                                    public content::GpuSurfaceLookup {
+class SurfaceTexturePeerChildImpl : public SurfaceTexturePeer,
+                                    public GpuSurfaceLookup,
+                                    public SurfaceTextureLookup {
  public:
   // |service| is the instance of
   // org.chromium.content.app.ChildProcessService.
@@ -38,12 +40,15 @@ class SurfaceTexturePeerChildImpl : public content::SurfaceTexturePeer,
       const base::android::ScopedJavaLocalRef<jobject>& service)
       : service_(service) {
     GpuSurfaceLookup::InitInstance(this);
+    SurfaceTextureLookup::InitInstance(this);
   }
 
   virtual ~SurfaceTexturePeerChildImpl() {
     GpuSurfaceLookup::InitInstance(NULL);
+    SurfaceTextureLookup::InitInstance(NULL);
   }
 
+  // Overridden from SurfaceTexturePeer:
   virtual void EstablishSurfaceTexturePeer(
       base::ProcessHandle pid,
       scoped_refptr<gfx::SurfaceTexture> surface_texture,
@@ -57,6 +62,7 @@ class SurfaceTexturePeerChildImpl : public content::SurfaceTexturePeer,
     CheckException(env);
   }
 
+  // Overridden from GpuSurfaceLookup:
   virtual gfx::AcceleratedWidget AcquireNativeWidget(int surface_id) OVERRIDE {
     JNIEnv* env = base::android::AttachCurrentThread();
     gfx::ScopedJavaSurface surface(
@@ -72,6 +78,24 @@ class SurfaceTexturePeerChildImpl : public content::SurfaceTexturePeer,
     return native_window;
   }
 
+  // Overridden from SurfaceTextureLookup:
+  virtual gfx::AcceleratedWidget AcquireNativeWidget(int primary_id,
+                                                     int secondary_id)
+      OVERRIDE {
+    JNIEnv* env = base::android::AttachCurrentThread();
+    gfx::ScopedJavaSurface surface(
+        content::Java_ChildProcessService_getSurfaceTextureSurface(
+            env, service_.obj(), primary_id, secondary_id));
+
+    if (surface.j_surface().is_null())
+      return NULL;
+
+    ANativeWindow* native_window =
+        ANativeWindow_fromSurface(env, surface.j_surface().obj());
+
+    return native_window;
+  }
+
  private:
   // The instance of org.chromium.content.app.ChildProcessService.
   base::android::ScopedJavaGlobalRef<jobject> service_;
@@ -100,6 +124,9 @@ void InternalInitChildProcess(const std::vector<int>& file_ids,
   for (size_t i = 0; i < file_ids.size(); ++i)
     base::GlobalDescriptors::GetInstance()->Set(file_ids[i], file_fds[i]);
 
+  // SurfaceTexturePeerChildImpl implements the SurfaceTextureLookup interface,
+  // which need to be set before we create a compositor thread that could be
+  // using it to initialize resources.
   content::SurfaceTexturePeer::InitInstance(
       new SurfaceTexturePeerChildImpl(service));
 
diff --git a/content/browser/accessibility/cross_platform_accessibility_browsertest.cc b/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
index 4bee21d479..06b72962fd 100644
--- a/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
+++ b/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
@@ -329,8 +329,9 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
   RecursiveAssertUniqueIds(root, &ids);
 }
 
+// TODO(dmazzoni): Needs to be rebaselined. http://crbug.com/347464
 IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
-                       IframeAccessibility) {
+                       DISABLED_IframeAccessibility) {
   // Create a data url and load it.
   const char url_str[] =
       "data:text/html,"
diff --git a/content/browser/accessibility/dump_accessibility_tree_browsertest.cc b/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
index f234df768c..94e85d4fe3 100644
--- a/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
+++ b/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
@@ -450,8 +450,10 @@ IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest,
   RunTest(FILE_PATH_LITERAL("modal-dialog-opened.html"));
 }
 
+// TODO(dmazzoni): rebaseline after Blink change lands.
+// http://crbug.com/347464
 IN_PROC_BROWSER_TEST_F(DumpAccessibilityTreeTest,
-                       AccessibilityModalDialogInIframeClosed) {
+                       DISABLED_AccessibilityModalDialogInIframeClosed) {
   RunTest(FILE_PATH_LITERAL("modal-dialog-in-iframe-closed.html"));
 }
 
diff --git a/content/browser/android/child_process_launcher_android.cc b/content/browser/android/child_process_launcher_android.cc
index cf915e4a42..ca99a78428 100644
--- a/content/browser/android/child_process_launcher_android.cc
+++ b/content/browser/android/child_process_launcher_android.cc
@@ -81,6 +81,7 @@ static void OnChildProcessStarted(JNIEnv*,
 
 void StartChildProcess(
     const CommandLine::StringVector& argv,
+    int child_process_id,
     const std::vector<content::FileDescriptorInfo>& files_to_register,
     const StartChildProcessCallback& callback) {
   JNIEnv* env = AttachCurrentThread();
@@ -119,6 +120,7 @@ void StartChildProcess(
   Java_ChildProcessLauncher_start(env,
       base::android::GetApplicationContext(),
       j_argv.obj(),
+      child_process_id,
       j_file_ids.obj(),
       j_file_fds.obj(),
       j_file_auto_close.obj(),
@@ -156,7 +158,19 @@ jobject GetViewSurface(JNIEnv* env, jclass clazz, jint surface_id) {
   // handled on a binder thread. Handling this on the UI thread will lead
   // to deadlocks.
   DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::UI));
-  return CompositorImpl::GetSurface(surface_id);
+  return CompositorImpl::GetSurface(surface_id).Release();
+}
+
+jobject GetSurfaceTextureSurface(JNIEnv* env,
+                                 jclass clazz,
+                                 jint surface_texture_id,
+                                 jint child_process_id) {
+  // This is a synchronous call from a renderer process and is expected to be
+  // handled on a binder thread. Handling this on the UI thread will lead
+  // to deadlocks.
+  DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::UI));
+  return CompositorImpl::GetSurfaceTextureSurface(surface_texture_id,
+                                                  child_process_id).Release();
 }
 
 jboolean IsSingleProcess(JNIEnv* env, jclass clazz) {
diff --git a/content/browser/android/child_process_launcher_android.h b/content/browser/android/child_process_launcher_android.h
index 5d4ee7442f..452b9b639c 100644
--- a/content/browser/android/child_process_launcher_android.h
+++ b/content/browser/android/child_process_launcher_android.h
@@ -22,6 +22,7 @@ typedef base::Callback<void(base::ProcessHandle)> StartChildProcessCallback;
 // retuned if the process could not be created.
 void StartChildProcess(
     const base::CommandLine::StringVector& argv,
+    int child_process_id,
     const std::vector<FileDescriptorInfo>& files_to_register,
     const StartChildProcessCallback& callback);
 
diff --git a/content/browser/android/content_video_view.cc b/content/browser/android/content_video_view.cc
index d483641ab3..f9afcb4ada 100644
--- a/content/browser/android/content_video_view.cc
+++ b/content/browser/android/content_video_view.cc
@@ -54,7 +54,13 @@ ContentVideoView::ContentVideoView(
 
 ContentVideoView::~ContentVideoView() {
   DCHECK(g_content_video_view);
-  DestroyContentVideoView(true);
+  JNIEnv* env = AttachCurrentThread();
+  ScopedJavaLocalRef<jobject> content_video_view = GetJavaObject(env);
+  if (!content_video_view.is_null()) {
+    Java_ContentVideoView_destroyContentVideoView(env,
+        content_video_view.obj(), true);
+    j_content_video_view_.reset();
+  }
   g_content_video_view = NULL;
 }
 
@@ -225,14 +231,4 @@ void ContentVideoView::CreatePowerSaveBlocker() {
   static_cast<PowerSaveBlockerImpl*>(power_save_blocker_.get())->
       InitDisplaySleepBlocker(GetNativeView());
 }
-
-void ContentVideoView::DestroyContentVideoView(bool native_view_destroyed) {
-  JNIEnv* env = AttachCurrentThread();
-  ScopedJavaLocalRef<jobject> content_video_view = GetJavaObject(env);
-  if (!content_video_view.is_null()) {
-    Java_ContentVideoView_destroyContentVideoView(env,
-        content_video_view.obj(), native_view_destroyed);
-    j_content_video_view_.reset();
-  }
-}
 }  // namespace content
diff --git a/content/browser/android/content_video_view.h b/content/browser/android/content_video_view.h
index b89b997dd6..40a85ceaca 100644
--- a/content/browser/android/content_video_view.h
+++ b/content/browser/android/content_video_view.h
@@ -76,10 +76,6 @@ class ContentVideoView {
   base::android::ScopedJavaLocalRef<jobject> GetJavaObject(JNIEnv* env);
 
  private:
-  // Destroy the |j_content_video_view_|. If |native_view_destroyed| is true,
-  // no further calls to the native object is allowed.
-  void DestroyContentVideoView(bool native_view_destroyed);
-
   // Creates the corresponding ContentVideoView Java object.
   JavaObjectWeakGlobalRef CreateJavaObject();
 
diff --git a/content/browser/child_process_launcher.cc b/content/browser/child_process_launcher.cc
index 4d2a1dca85..3f378b425f 100644
--- a/content/browser/child_process_launcher.cc
+++ b/content/browser/child_process_launcher.cc
@@ -216,7 +216,7 @@ class ChildProcessLauncher::Context
         GetAdditionalMappedFilesForChildProcess(*cmd_line, child_process_id,
                                                 &files_to_register);
 
-    StartChildProcess(cmd_line->argv(), files_to_register,
+    StartChildProcess(cmd_line->argv(), child_process_id, files_to_register,
         base::Bind(&ChildProcessLauncher::Context::OnChildProcessStarted,
                    this_object, client_thread_id, begin_launch_time));
 
diff --git a/content/browser/media/media_canplaytype_browsertest.cc b/content/browser/media/media_canplaytype_browsertest.cc
index 4a5b5a8507..ff1cb3ce89 100644
--- a/content/browser/media/media_canplaytype_browsertest.cc
+++ b/content/browser/media/media_canplaytype_browsertest.cc
@@ -83,6 +83,9 @@ private:
   DISALLOW_COPY_AND_ASSIGN(MediaCanPlayTypeTest);
 };
 
+// TODO(amogh.bihani): http://crbug.com/357665
+#if !defined(OS_ANDROID)
+
 IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_wav) {
   EXPECT_EQ(kMaybe, CanPlay("'audio/wav'"));
   EXPECT_EQ(kProbably, CanPlay("'audio/wav; codecs=\"1\"'"));
@@ -1097,4 +1100,6 @@ IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_HLS) {
   // ---------------------------------------------------------------------------
 }
 
+#endif  // !OS_ANDROID
+
 }  // namespace content
diff --git a/content/browser/renderer_host/compositor_impl_android.cc b/content/browser/renderer_host/compositor_impl_android.cc
index 5f80889ca6..0d25083944 100644
--- a/content/browser/renderer_host/compositor_impl_android.cc
+++ b/content/browser/renderer_host/compositor_impl_android.cc
@@ -12,11 +12,13 @@
 #include "base/android/scoped_java_ref.h"
 #include "base/bind.h"
 #include "base/command_line.h"
+#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread.h"
+#include "base/threading/thread_checker.h"
 #include "cc/base/switches.h"
 #include "cc/input/input_handler.h"
 #include "cc/layers/layer.h"
@@ -43,6 +45,9 @@
 #include "ui/gfx/android/device_display_info.h"
 #include "ui/gfx/android/java_bitmap.h"
 #include "ui/gfx/frame_time.h"
+#include "ui/gl/android/scoped_java_surface.h"
+#include "ui/gl/android/surface_texture.h"
+#include "ui/gl/android/surface_texture_tracker.h"
 #include "webkit/common/gpu/context_provider_in_process.h"
 #include "webkit/common/gpu/webgraphicscontext3d_in_process_command_buffer_impl.h"
 
@@ -131,6 +136,81 @@ class TransientUIResource : public cc::ScopedUIResource {
   bool retrieved_;
 };
 
+class SurfaceTextureTrackerImpl : public gfx::SurfaceTextureTracker {
+ public:
+  SurfaceTextureTrackerImpl() : next_surface_texture_id_(1) {
+    thread_checker_.DetachFromThread();
+  }
+
+  // Overridden from gfx::SurfaceTextureTracker:
+  virtual scoped_refptr<gfx::SurfaceTexture> AcquireSurfaceTexture(
+      int primary_id,
+      int secondary_id) OVERRIDE {
+    base::AutoLock lock(surface_textures_lock_);
+    scoped_ptr<SurfaceTextureInfo> info = surface_textures_.take_and_erase(
+        SurfaceTextureMapKey(primary_id, secondary_id));
+    return info ? info->surface_texture : NULL;
+  }
+
+  int AddSurfaceTexture(gfx::SurfaceTexture* surface_texture,
+                        int child_process_id) {
+    DCHECK(thread_checker_.CalledOnValidThread());
+    int surface_texture_id = next_surface_texture_id_++;
+    if (next_surface_texture_id_ == INT_MAX)
+      next_surface_texture_id_ = 1;
+
+    base::AutoLock lock(surface_textures_lock_);
+    SurfaceTextureMapKey key(surface_texture_id, child_process_id);
+    DCHECK(surface_textures_.find(key) == surface_textures_.end());
+    surface_textures_.set(
+        key, make_scoped_ptr(new SurfaceTextureInfo(surface_texture)));
+    return surface_texture_id;
+  }
+
+  void RemoveAllSurfaceTextures(int child_process_id) {
+    DCHECK(thread_checker_.CalledOnValidThread());
+    base::AutoLock lock(surface_textures_lock_);
+    SurfaceTextureMap::iterator it = surface_textures_.begin();
+    while (it != surface_textures_.end()) {
+      if (it->first.second == child_process_id)
+        surface_textures_.erase(it++);
+      else
+        ++it;
+    }
+  }
+
+  base::android::ScopedJavaLocalRef<jobject> GetSurface(
+      int surface_texture_id,
+      int child_process_id) const {
+    base::AutoLock lock(surface_textures_lock_);
+    SurfaceTextureMap::const_iterator it = surface_textures_.find(
+        SurfaceTextureMapKey(surface_texture_id, child_process_id));
+    return it == surface_textures_.end()
+               ? base::android::ScopedJavaLocalRef<jobject>()
+               : base::android::ScopedJavaLocalRef<jobject>(
+                     it->second->surface.j_surface());
+  }
+
+ private:
+  struct SurfaceTextureInfo {
+    explicit SurfaceTextureInfo(gfx::SurfaceTexture* surface_texture)
+        : surface_texture(surface_texture), surface(surface_texture) {}
+
+    scoped_refptr<gfx::SurfaceTexture> surface_texture;
+    gfx::ScopedJavaSurface surface;
+  };
+
+  typedef std::pair<int, int> SurfaceTextureMapKey;
+  typedef base::ScopedPtrHashMap<SurfaceTextureMapKey, SurfaceTextureInfo>
+      SurfaceTextureMap;
+  SurfaceTextureMap surface_textures_;
+  mutable base::Lock surface_textures_lock_;
+  int next_surface_texture_id_;
+  base::ThreadChecker thread_checker_;
+};
+base::LazyInstance<SurfaceTextureTrackerImpl> g_surface_texture_tracker =
+    LAZY_INSTANCE_INITIALIZER;
+
 static bool g_initialized = false;
 
 } // anonymous namespace
@@ -152,6 +232,9 @@ Compositor* Compositor::Create(CompositorClient* client,
 // static
 void Compositor::Initialize() {
   DCHECK(!CompositorImpl::IsInitialized());
+  // SurfaceTextureTracker instance must be set before we create a GPU thread
+  // that could be using it to initialize GLImage instances.
+  gfx::SurfaceTextureTracker::InitInstance(g_surface_texture_tracker.Pointer());
   g_initialized = true;
 }
 
@@ -161,16 +244,53 @@ bool CompositorImpl::IsInitialized() {
 }
 
 // static
-jobject CompositorImpl::GetSurface(int surface_id) {
+base::android::ScopedJavaLocalRef<jobject> CompositorImpl::GetSurface(
+    int surface_id) {
   base::AutoLock lock(g_surface_map_lock.Get());
   SurfaceMap* surfaces = g_surface_map.Pointer();
   SurfaceMap::iterator it = surfaces->find(surface_id);
-  jobject jsurface = it == surfaces->end() ? NULL : it->second.obj();
+  base::android::ScopedJavaLocalRef<jobject> jsurface(
+      it == surfaces->end()
+          ? base::android::ScopedJavaLocalRef<jobject>()
+          : base::android::ScopedJavaLocalRef<jobject>(it->second));
 
-  LOG_IF(WARNING, !jsurface) << "No surface for surface id " << surface_id;
+  LOG_IF(WARNING, !jsurface.is_null()) << "No surface for surface id "
+                                       << surface_id;
+  return jsurface;
+}
+
+// static
+base::android::ScopedJavaLocalRef<jobject>
+CompositorImpl::GetSurfaceTextureSurface(int surface_texture_id,
+                                         int child_process_id) {
+  base::android::ScopedJavaLocalRef<jobject> jsurface(
+      g_surface_texture_tracker.Pointer()->GetSurface(surface_texture_id,
+                                                      child_process_id));
+
+  LOG_IF(WARNING, jsurface.is_null()) << "No surface for surface texture id "
+                                      << surface_texture_id;
   return jsurface;
 }
 
+// static
+int CompositorImpl::CreateSurfaceTexture(int child_process_id) {
+  // Note: this needs to be 0 as the surface texture implemenation will take
+  // ownership of the texture and call glDeleteTextures when the GPU service
+  // attaches the surface texture to a real texture id. glDeleteTextures
+  // silently ignores 0.
+  const int kDummyTextureId = 0;
+  scoped_refptr<gfx::SurfaceTexture> surface_texture =
+      gfx::SurfaceTexture::Create(kDummyTextureId);
+  return g_surface_texture_tracker.Pointer()->AddSurfaceTexture(
+      surface_texture.get(), child_process_id);
+}
+
+// static
+void CompositorImpl::DestroyAllSurfaceTextures(int child_process_id) {
+  g_surface_texture_tracker.Pointer()->RemoveAllSurfaceTextures(
+      child_process_id);
+}
+
 CompositorImpl::CompositorImpl(CompositorClient* client,
                                gfx::NativeWindow root_window)
     : root_layer_(cc::Layer::Create()),
diff --git a/content/browser/renderer_host/compositor_impl_android.h b/content/browser/renderer_host/compositor_impl_android.h
index 15a16b34d1..56292efbda 100644
--- a/content/browser/renderer_host/compositor_impl_android.h
+++ b/content/browser/renderer_host/compositor_impl_android.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_COMPOSITOR_IMPL_ANDROID_H_
 #define CONTENT_BROWSER_RENDERER_HOST_COMPOSITOR_IMPL_ANDROID_H_
 
+#include "base/android/scoped_java_ref.h"
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "base/containers/scoped_ptr_hash_map.h"
@@ -47,7 +48,19 @@ class CONTENT_EXPORT CompositorImpl
   static bool IsInitialized();
 
   // Returns the Java Surface object for a given view surface id.
-  static jobject GetSurface(int surface_id);
+  static base::android::ScopedJavaLocalRef<jobject> GetSurface(int surface_id);
+
+  // Returns the Java Surface object for a given surface texture id.
+  static base::android::ScopedJavaLocalRef<jobject> GetSurfaceTextureSurface(
+      int surface_texture_id,
+      int child_process_id);
+
+  // Creates a surface texture and returns a surface texture id. Returns -1 on
+  // failure.
+  static int CreateSurfaceTexture(int child_process_id);
+
+  // Destroy all surface textures associated with |child_process_id|.
+  static void DestroyAllSurfaceTextures(int child_process_id);
 
   // Compositor implementation.
   virtual void SetRootLayer(scoped_refptr<cc::Layer> root) OVERRIDE;
diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc
index db7262029d..e5492e1cd8 100644
--- a/content/browser/renderer_host/render_message_filter.cc
+++ b/content/browser/renderer_host/render_message_filter.cc
@@ -87,6 +87,8 @@
 #include "content/common/sandbox_win.h"
 #endif
 #if defined(OS_ANDROID)
+#include "content/browser/renderer_host/compositor_impl_android.h"
+#include "content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.h"
 #include "media/base/android/webaudio_media_codec_bridge.h"
 #endif
 
@@ -374,6 +376,9 @@ void RenderMessageFilter::OnChannelClosing() {
   }
 #endif  // defined(ENABLE_PLUGINS)
   plugin_host_clients_.clear();
+#if defined(OS_ANDROID)
+  CompositorImpl::DestroyAllSurfaceTextures(render_process_id_);
+#endif
 }
 
 void RenderMessageFilter::OnChannelConnected(int32 peer_id) {
@@ -1300,6 +1305,22 @@ void RenderMessageFilter::OnAllocateGpuMemoryBuffer(
   }
 #endif
 
+#if defined(OS_ANDROID)
+  if (GpuMemoryBufferImplSurfaceTexture::IsFormatSupported(internalformat)) {
+    // Each surface texture is associated with a render process id. This allows
+    // the GPU service and Java Binder IPC to verify that a renderer is not
+    // trying to use a surface texture it doesn't own.
+    int surface_texture_id =
+        CompositorImpl::CreateSurfaceTexture(render_process_id_);
+    if (surface_texture_id != -1) {
+      handle->type = gfx::SURFACE_TEXTURE_BUFFER;
+      handle->surface_texture_id =
+          gfx::SurfaceTextureId(surface_texture_id, render_process_id_);
+      return;
+    }
+  }
+#endif
+
   uint64 stride = static_cast<uint64>(width) *
       GpuMemoryBufferImpl::BytesPerPixel(internalformat);
   if (stride > std::numeric_limits<uint32>::max()) {
diff --git a/content/browser/shared_worker/shared_worker_host.cc b/content/browser/shared_worker/shared_worker_host.cc
index 60189139b9..78ffb4b5cb 100644
--- a/content/browser/shared_worker/shared_worker_host.cc
+++ b/content/browser/shared_worker/shared_worker_host.cc
@@ -10,6 +10,7 @@
 #include "content/browser/message_port_service.h"
 #include "content/browser/shared_worker/shared_worker_instance.h"
 #include "content/browser/shared_worker/shared_worker_message_filter.h"
+#include "content/browser/worker_host/worker_document_set.h"
 #include "content/common/view_messages.h"
 #include "content/common/worker_messages.h"
 #include "content/public/browser/browser_thread.h"
@@ -31,8 +32,11 @@ void WorkerCrashCallback(int render_process_unique_id, int render_frame_id) {
 
 SharedWorkerHost::SharedWorkerHost(SharedWorkerInstance* instance)
     : instance_(instance),
+      worker_document_set_(new WorkerDocumentSet()),
       container_render_filter_(NULL),
       worker_route_id_(MSG_ROUTING_NONE),
+      load_failed_(false),
+      closed_(false),
       creation_time_(base::TimeTicks::Now()) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 }
@@ -42,9 +46,9 @@ SharedWorkerHost::~SharedWorkerHost() {
   UMA_HISTOGRAM_LONG_TIMES("SharedWorker.TimeToDeleted",
                            base::TimeTicks::Now() - creation_time_);
   // If we crashed, tell the RenderViewHosts.
-  if (instance_ && !instance_->load_failed()) {
+  if (instance_ && !load_failed_) {
     const WorkerDocumentSet::DocumentInfoSet& parents =
-        instance_->worker_document_set()->documents();
+        worker_document_set_->documents();
     for (WorkerDocumentSet::DocumentInfoSet::const_iterator parent_iter =
              parents.begin();
          parent_iter != parents.end();
@@ -80,9 +84,8 @@ void SharedWorkerHost::Init(SharedWorkerMessageFilter* filter) {
   params.route_id = worker_route_id_;
   Send(new WorkerProcessMsg_CreateWorker(params));
 
-  for (SharedWorkerInstance::FilterList::const_iterator i =
-           instance_->filters().begin();
-       i != instance_->filters().end(); ++i) {
+  for (FilterList::const_iterator i = filters_.begin(); i != filters_.end();
+       ++i) {
     i->filter()->Send(new ViewMsg_WorkerCreated(i->route_id()));
   }
 }
@@ -92,8 +95,7 @@ bool SharedWorkerHost::FilterMessage(const IPC::Message& message,
   if (!instance_)
     return false;
 
-  if (!instance_->closed() &&
-      instance_->HasFilter(filter, message.routing_id())) {
+  if (!closed_ && HasFilter(filter, message.routing_id())) {
     RelayMessage(message, filter);
     return true;
   }
@@ -104,9 +106,9 @@ bool SharedWorkerHost::FilterMessage(const IPC::Message& message,
 void SharedWorkerHost::FilterShutdown(SharedWorkerMessageFilter* filter) {
   if (!instance_)
     return;
-  instance_->RemoveFilters(filter);
-  instance_->worker_document_set()->RemoveAll(filter);
-  if (instance_->worker_document_set()->IsEmpty()) {
+  RemoveFilters(filter);
+  worker_document_set_->RemoveAll(filter);
+  if (worker_document_set_->IsEmpty()) {
     // This worker has no more associated documents - shut it down.
     Send(new WorkerMsg_TerminateWorkerContext(worker_route_id_));
   }
@@ -117,8 +119,8 @@ void SharedWorkerHost::DocumentDetached(SharedWorkerMessageFilter* filter,
   if (!instance_)
     return;
   // Walk all instances and remove the document from their document set.
-  instance_->worker_document_set()->Remove(filter, document_id);
-  if (instance_->worker_document_set()->IsEmpty()) {
+  worker_document_set_->Remove(filter, document_id);
+  if (worker_document_set_->IsEmpty()) {
     // This worker has no more associated documents - shut it down.
     Send(new WorkerMsg_TerminateWorkerContext(worker_route_id_));
   }
@@ -130,13 +132,14 @@ void SharedWorkerHost::WorkerContextClosed() {
   // Set the closed flag - this will stop any further messages from
   // being sent to the worker (messages can still be sent from the worker,
   // for exception reporting, etc).
-  instance_->set_closed(true);
+  closed_ = true;
 }
 
 void SharedWorkerHost::WorkerContextDestroyed() {
   if (!instance_)
     return;
   instance_.reset();
+  worker_document_set_ = NULL;
 }
 
 void SharedWorkerHost::WorkerScriptLoaded() {
@@ -150,10 +153,9 @@ void SharedWorkerHost::WorkerScriptLoadFailed() {
                       base::TimeTicks::Now() - creation_time_);
   if (!instance_)
     return;
-  instance_->set_load_failed(true);
-  for (SharedWorkerInstance::FilterList::const_iterator i =
-           instance_->filters().begin();
-       i != instance_->filters().end(); ++i) {
+  load_failed_ = true;
+  for (FilterList::const_iterator i = filters_.begin(); i != filters_.end();
+       ++i) {
     i->filter()->Send(new ViewMsg_WorkerScriptLoadFailed(i->route_id()));
   }
 }
@@ -161,9 +163,8 @@ void SharedWorkerHost::WorkerScriptLoadFailed() {
 void SharedWorkerHost::WorkerConnected(int message_port_id) {
   if (!instance_)
     return;
-  for (SharedWorkerInstance::FilterList::const_iterator i =
-           instance_->filters().begin();
-       i != instance_->filters().end(); ++i) {
+  for (FilterList::const_iterator i = filters_.begin(); i != filters_.end();
+       ++i) {
     if (i->message_port_id() != message_port_id)
       continue;
     i->filter()->Send(new ViewMsg_WorkerConnected(i->route_id()));
@@ -223,9 +224,8 @@ void SharedWorkerHost::RelayMessage(
         sent_message_port_id,
         container_render_filter_->message_port_message_filter(),
         new_routing_id);
-    instance_->SetMessagePortID(incoming_filter,
-                                message.routing_id(),
-                                sent_message_port_id);
+    SetMessagePortID(
+        incoming_filter, message.routing_id(), sent_message_port_id);
     // Resend the message with the new routing id.
     Send(new WorkerMsg_Connect(
         worker_route_id_, sent_message_port_id, new_routing_id));
@@ -251,7 +251,7 @@ SharedWorkerHost::GetRenderFrameIDsForWorker() {
   if (!instance_)
     return result;
   const WorkerDocumentSet::DocumentInfoSet& documents =
-      instance_->worker_document_set()->documents();
+      worker_document_set_->documents();
   for (WorkerDocumentSet::DocumentInfoSet::const_iterator doc =
            documents.begin();
        doc != documents.end();
@@ -262,4 +262,43 @@ SharedWorkerHost::GetRenderFrameIDsForWorker() {
   return result;
 }
 
+void SharedWorkerHost::AddFilter(SharedWorkerMessageFilter* filter,
+                                 int route_id) {
+  CHECK(filter);
+  if (!HasFilter(filter, route_id)) {
+    FilterInfo info(filter, route_id);
+    filters_.push_back(info);
+  }
+}
+
+void SharedWorkerHost::RemoveFilters(SharedWorkerMessageFilter* filter) {
+  for (FilterList::iterator i = filters_.begin(); i != filters_.end();) {
+    if (i->filter() == filter)
+      i = filters_.erase(i);
+    else
+      ++i;
+  }
+}
+
+bool SharedWorkerHost::HasFilter(SharedWorkerMessageFilter* filter,
+                                 int route_id) const {
+  for (FilterList::const_iterator i = filters_.begin(); i != filters_.end();
+       ++i) {
+    if (i->filter() == filter && i->route_id() == route_id)
+      return true;
+  }
+  return false;
+}
+
+void SharedWorkerHost::SetMessagePortID(SharedWorkerMessageFilter* filter,
+                                        int route_id,
+                                        int message_port_id) {
+  for (FilterList::iterator i = filters_.begin(); i != filters_.end(); ++i) {
+    if (i->filter() == filter && i->route_id() == route_id) {
+      i->set_message_port_id(message_port_id);
+      return;
+    }
+  }
+}
+
 }  // namespace content
diff --git a/content/browser/shared_worker/shared_worker_host.h b/content/browser/shared_worker/shared_worker_host.h
index f46e3b2a5b..3fdc29f7c9 100644
--- a/content/browser/shared_worker/shared_worker_host.h
+++ b/content/browser/shared_worker/shared_worker_host.h
@@ -5,12 +5,14 @@
 #ifndef CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_HOST_H_
 #define CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_HOST_H_
 
+#include <list>
 #include <vector>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "content/browser/shared_worker/shared_worker_message_filter.h"
+#include "content/browser/worker_host/worker_document_set.h"
 
 class GURL;
 
@@ -68,7 +70,12 @@ class SharedWorkerHost {
   // Terminates the given worker, i.e. based on a UI action.
   void TerminateWorker();
 
+  void AddFilter(SharedWorkerMessageFilter* filter, int route_id);
+
   SharedWorkerInstance* instance() { return instance_.get(); }
+  WorkerDocumentSet* worker_document_set() const {
+    return worker_document_set_.get();
+  }
   SharedWorkerMessageFilter* container_render_filter() const {
     return container_render_filter_;
   }
@@ -76,8 +83,28 @@ class SharedWorkerHost {
     return container_render_filter_->render_process_id();
   }
   int worker_route_id() const { return worker_route_id_; }
+  bool load_failed() const { return load_failed_; }
+  bool closed() const { return closed_; }
 
  private:
+  // Unique identifier for a worker client.
+  class FilterInfo {
+   public:
+    FilterInfo(SharedWorkerMessageFilter* filter, int route_id)
+        : filter_(filter), route_id_(route_id), message_port_id_(0) {}
+    SharedWorkerMessageFilter* filter() const { return filter_; }
+    int route_id() const { return route_id_; }
+    int message_port_id() const { return message_port_id_; }
+    void set_message_port_id(int id) { message_port_id_ = id; }
+
+   private:
+    SharedWorkerMessageFilter* filter_;
+    int route_id_;
+    int message_port_id_;
+  };
+
+  typedef std::list<FilterInfo> FilterList;
+
   // Relays |message| to the SharedWorker. Takes care of parsing the message if
   // it contains a message port and sending it a valid route id.
   void RelayMessage(const IPC::Message& message,
@@ -86,9 +113,19 @@ class SharedWorkerHost {
   // Return a vector of all the render process/render frame IDs.
   std::vector<std::pair<int, int> > GetRenderFrameIDsForWorker();
 
+  void RemoveFilters(SharedWorkerMessageFilter* filter);
+  bool HasFilter(SharedWorkerMessageFilter* filter, int route_id) const;
+  void SetMessagePortID(SharedWorkerMessageFilter* filter,
+                        int route_id,
+                        int message_port_id);
+
   scoped_ptr<SharedWorkerInstance> instance_;
+  scoped_refptr<WorkerDocumentSet> worker_document_set_;
+  FilterList filters_;
   SharedWorkerMessageFilter* container_render_filter_;
   int worker_route_id_;
+  bool load_failed_;
+  bool closed_;
   const base::TimeTicks creation_time_;
   DISALLOW_COPY_AND_ASSIGN(SharedWorkerHost);
 };
diff --git a/content/browser/shared_worker/shared_worker_instance.cc b/content/browser/shared_worker/shared_worker_instance.cc
index a55dd91815..506626a54e 100644
--- a/content/browser/shared_worker/shared_worker_instance.cc
+++ b/content/browser/shared_worker/shared_worker_instance.cc
@@ -5,7 +5,6 @@
 #include "content/browser/shared_worker/shared_worker_instance.h"
 
 #include "base/logging.h"
-#include "content/browser/worker_host/worker_document_set.h"
 
 namespace content {
 
@@ -17,40 +16,21 @@ SharedWorkerInstance::SharedWorkerInstance(
     ResourceContext* resource_context,
     const WorkerStoragePartition& partition)
     : url_(url),
-      closed_(false),
       name_(name),
       content_security_policy_(content_security_policy),
       security_policy_type_(security_policy_type),
-      worker_document_set_(new WorkerDocumentSet()),
       resource_context_(resource_context),
-      partition_(partition),
-      load_failed_(false) {
+      partition_(partition) {
   DCHECK(resource_context_);
 }
 
 SharedWorkerInstance::~SharedWorkerInstance() {
 }
 
-void SharedWorkerInstance::SetMessagePortID(
-    SharedWorkerMessageFilter* filter,
-    int route_id,
-    int message_port_id) {
-  for (FilterList::iterator i = filters_.begin(); i != filters_.end(); ++i) {
-    if (i->filter() == filter && i->route_id() == route_id) {
-      i->set_message_port_id(message_port_id);
-      return;
-    }
-  }
-}
-
 bool SharedWorkerInstance::Matches(const GURL& match_url,
                                    const base::string16& match_name,
                                    const WorkerStoragePartition& partition,
     ResourceContext* resource_context) const {
-  // Only match open shared workers.
-  if (closed_)
-    return false;
-
   // ResourceContext equivalence is being used as a proxy to ensure we only
   // matched shared workers within the same BrowserContext.
   if (resource_context_ != resource_context)
@@ -70,32 +50,4 @@ bool SharedWorkerInstance::Matches(const GURL& match_url,
   return name_ == match_name;
 }
 
-void SharedWorkerInstance::AddFilter(SharedWorkerMessageFilter* filter,
-                                     int route_id) {
-  CHECK(filter);
-  if (!HasFilter(filter, route_id)) {
-    FilterInfo info(filter, route_id);
-    filters_.push_back(info);
-  }
-}
-
-void SharedWorkerInstance::RemoveFilters(SharedWorkerMessageFilter* filter) {
-  for (FilterList::iterator i = filters_.begin(); i != filters_.end();) {
-    if (i->filter() == filter)
-      i = filters_.erase(i);
-    else
-      ++i;
-  }
-}
-
-bool SharedWorkerInstance::HasFilter(SharedWorkerMessageFilter* filter,
-                                     int route_id) const {
-  for (FilterList::const_iterator i = filters_.begin(); i != filters_.end();
-       ++i) {
-    if (i->filter() == filter && i->route_id() == route_id)
-      return true;
-  }
-  return false;
-}
-
 }  // namespace content
diff --git a/content/browser/shared_worker/shared_worker_instance.h b/content/browser/shared_worker/shared_worker_instance.h
index e714e431db..0d613167d4 100644
--- a/content/browser/shared_worker/shared_worker_instance.h
+++ b/content/browser/shared_worker/shared_worker_instance.h
@@ -5,11 +5,9 @@
 #ifndef CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_INSTANCE_H_
 #define CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_INSTANCE_H_
 
-#include <list>
 #include <string>
 
 #include "base/basictypes.h"
-#include "content/browser/worker_host/worker_document_set.h"
 #include "content/browser/worker_host/worker_storage_partition.h"
 #include "content/common/content_export.h"
 #include "third_party/WebKit/public/web/WebContentSecurityPolicy.h"
@@ -17,28 +15,9 @@
 
 namespace content {
 class ResourceContext;
-class SharedWorkerMessageFilter;
 
 class CONTENT_EXPORT SharedWorkerInstance {
  public:
-  // Unique identifier for a worker client.
-  class FilterInfo {
-   public:
-    FilterInfo(SharedWorkerMessageFilter* filter, int route_id)
-        : filter_(filter), route_id_(route_id), message_port_id_(0) { }
-    SharedWorkerMessageFilter* filter() const { return filter_; }
-    int route_id() const { return route_id_; }
-    int message_port_id() const { return message_port_id_; }
-    void set_message_port_id(int id) { message_port_id_ = id; }
-
-   private:
-    SharedWorkerMessageFilter* filter_;
-    int route_id_;
-    int message_port_id_;
-  };
-
-  typedef std::list<FilterInfo> FilterList;
-
   SharedWorkerInstance(const GURL& url,
                        const base::string16& name,
                        const base::string16& content_security_policy,
@@ -47,14 +26,6 @@ class CONTENT_EXPORT SharedWorkerInstance {
                        const WorkerStoragePartition& partition);
   ~SharedWorkerInstance();
 
-  void AddFilter(SharedWorkerMessageFilter* filter, int route_id);
-  void RemoveFilters(SharedWorkerMessageFilter* filter);
-  bool HasFilter(SharedWorkerMessageFilter* filter, int route_id) const;
-  void SetMessagePortID(SharedWorkerMessageFilter* filter,
-                        int route_id,
-                        int message_port_id);
-  const FilterList& filters() const { return filters_; }
-
   // Checks if this SharedWorkerInstance matches the passed url/name params
   // based on the algorithm in the WebWorkers spec - an instance matches if the
   // origins of the URLs match, and:
@@ -68,8 +39,6 @@ class CONTENT_EXPORT SharedWorkerInstance {
       ResourceContext* resource_context) const;
 
   // Accessors.
-  bool closed() const { return closed_; }
-  void set_closed(bool closed) { closed_ = closed; }
   const GURL& url() const { return url_; }
   const base::string16 name() const { return name_; }
   const base::string16 content_security_policy() const {
@@ -78,29 +47,20 @@ class CONTENT_EXPORT SharedWorkerInstance {
   blink::WebContentSecurityPolicyType security_policy_type() const {
     return security_policy_type_;
   }
-  WorkerDocumentSet* worker_document_set() const {
-    return worker_document_set_.get();
-  }
   ResourceContext* resource_context() const {
     return resource_context_;
   }
   const WorkerStoragePartition& partition() const {
     return partition_;
   }
-  void set_load_failed(bool failed) { load_failed_ = failed; }
-  bool load_failed() { return load_failed_; }
 
  private:
-  GURL url_;
-  bool closed_;
-  base::string16 name_;
-  base::string16 content_security_policy_;
-  blink::WebContentSecurityPolicyType security_policy_type_;
-  FilterList filters_;
-  scoped_refptr<WorkerDocumentSet> worker_document_set_;
+  const GURL url_;
+  const base::string16 name_;
+  const base::string16 content_security_policy_;
+  const blink::WebContentSecurityPolicyType security_policy_type_;
   ResourceContext* const resource_context_;
-  WorkerStoragePartition partition_;
-  bool load_failed_;
+  const WorkerStoragePartition partition_;
 };
 
 }  // namespace content
diff --git a/content/browser/shared_worker/shared_worker_service_impl.cc b/content/browser/shared_worker/shared_worker_service_impl.cc
index e48add9263..1f81ca30ee 100644
--- a/content/browser/shared_worker/shared_worker_service_impl.cc
+++ b/content/browser/shared_worker/shared_worker_service_impl.cc
@@ -129,22 +129,22 @@ void SharedWorkerServiceImpl::CreateWorker(
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   ScopedWorkerDependencyChecker checker(this);
   *url_mismatch = false;
-  SharedWorkerInstance* existing_instance =
-      FindSharedWorkerInstance(
-          params.url, params.name, partition, resource_context);
-  if (existing_instance) {
-    if (params.url != existing_instance->url()) {
+  SharedWorkerHost* existing_host = FindSharedWorkerHost(
+      params.url, params.name, partition, resource_context);
+  if (existing_host) {
+    if (params.url != existing_host->instance()->url()) {
       *url_mismatch = true;
       return;
     }
-    if (existing_instance->load_failed()) {
+    if (existing_host->load_failed()) {
       filter->Send(new ViewMsg_WorkerScriptLoadFailed(route_id));
       return;
     }
-    existing_instance->AddFilter(filter, route_id);
-    existing_instance->worker_document_set()->Add(
-        filter, params.document_id, filter->render_process_id(),
-        params.render_frame_route_id);
+    existing_host->AddFilter(filter, route_id);
+    existing_host->worker_document_set()->Add(filter,
+                                              params.document_id,
+                                              filter->render_process_id(),
+                                              params.render_frame_route_id);
     filter->Send(new ViewMsg_WorkerCreated(route_id));
     return;
   }
@@ -156,12 +156,13 @@ void SharedWorkerServiceImpl::CreateWorker(
       params.security_policy_type,
       resource_context,
       partition));
-  instance->AddFilter(filter, route_id);
-  instance->worker_document_set()->Add(
-      filter, params.document_id, filter->render_process_id(),
-      params.render_frame_route_id);
-
   scoped_ptr<SharedWorkerHost> host(new SharedWorkerHost(instance.release()));
+  host->AddFilter(filter, route_id);
+  host->worker_document_set()->Add(filter,
+                                   params.document_id,
+                                   filter->render_process_id(),
+                                   params.render_frame_route_id);
+
   host->Init(filter);
   const int worker_route_id = host->worker_route_id();
   worker_hosts_.set(std::make_pair(filter->render_process_id(),
@@ -298,7 +299,7 @@ SharedWorkerHost* SharedWorkerServiceImpl::FindSharedWorkerHost(
                                           worker_route_id));
 }
 
-SharedWorkerInstance* SharedWorkerServiceImpl::FindSharedWorkerInstance(
+SharedWorkerHost* SharedWorkerServiceImpl::FindSharedWorkerHost(
     const GURL& url,
     const base::string16& name,
     const WorkerStoragePartition& partition,
@@ -307,8 +308,9 @@ SharedWorkerInstance* SharedWorkerServiceImpl::FindSharedWorkerInstance(
        iter != worker_hosts_.end();
        ++iter) {
     SharedWorkerInstance* instance = iter->second->instance();
-    if (instance && instance->Matches(url, name, partition, resource_context))
-      return instance;
+    if (instance && !iter->second->closed() &&
+        instance->Matches(url, name, partition, resource_context))
+      return iter->second;
   }
   return NULL;
 }
@@ -322,9 +324,9 @@ SharedWorkerServiceImpl::GetRenderersWithWorkerDependency() {
     const int process_id = host_iter->first.first;
     if (dependent_renderers.count(process_id))
       continue;
-    SharedWorkerInstance* instance = host_iter->second->instance();
-    if (instance &&
-        instance->worker_document_set()->ContainsExternalRenderer(process_id)) {
+    if (host_iter->second->instance() &&
+        host_iter->second->worker_document_set()->ContainsExternalRenderer(
+            process_id)) {
       dependent_renderers.insert(process_id);
     }
   }
diff --git a/content/browser/shared_worker/shared_worker_service_impl.h b/content/browser/shared_worker/shared_worker_service_impl.h
index a60ec707f4..70887857ac 100644
--- a/content/browser/shared_worker/shared_worker_service_impl.h
+++ b/content/browser/shared_worker/shared_worker_service_impl.h
@@ -108,7 +108,7 @@ class CONTENT_EXPORT SharedWorkerServiceImpl
       SharedWorkerMessageFilter* filter,
       int worker_route_id);
 
-  SharedWorkerInstance* FindSharedWorkerInstance(
+  SharedWorkerHost* FindSharedWorkerHost(
       const GURL& url,
       const base::string16& name,
       const WorkerStoragePartition& worker_partition,
diff --git a/content/child/npapi/plugin_url_fetcher.cc b/content/child/npapi/plugin_url_fetcher.cc
index a1d15306df..6695f762a8 100644
--- a/content/child/npapi/plugin_url_fetcher.cc
+++ b/content/child/npapi/plugin_url_fetcher.cc
@@ -24,6 +24,7 @@
 #include "third_party/WebKit/public/platform/WebURLLoaderClient.h"
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 #include "webkit/child/multipart_response_delegate.h"
+#include "webkit/common/resource_response_info.h"
 
 namespace content {
 namespace {
diff --git a/content/child/resource_dispatcher.cc b/content/child/resource_dispatcher.cc
index 990bf84e97..be24da4af1 100644
--- a/content/child/resource_dispatcher.cc
+++ b/content/child/resource_dispatcher.cc
@@ -18,6 +18,7 @@
 #include "content/child/request_extra_data.h"
 #include "content/child/request_info.h"
 #include "content/child/site_isolation_policy.h"
+#include "content/child/sync_load_response.h"
 #include "content/common/inter_process_time_ticks_converter.h"
 #include "content/common/resource_messages.h"
 #include "content/common/service_worker/service_worker_types.h"
diff --git a/content/child/sync_load_response.cc b/content/child/sync_load_response.cc
new file mode 100644
index 0000000000..163153aa23
--- /dev/null
+++ b/content/child/sync_load_response.cc
@@ -0,0 +1,13 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/sync_load_response.h"
+
+namespace content {
+
+SyncLoadResponse::SyncLoadResponse() {}
+
+SyncLoadResponse::~SyncLoadResponse() {}
+
+}  // namespace content
diff --git a/content/child/sync_load_response.h b/content/child/sync_load_response.h
new file mode 100644
index 0000000000..d19985f375
--- /dev/null
+++ b/content/child/sync_load_response.h
@@ -0,0 +1,34 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_SYNC_LOAD_RESPONSE_H_
+#define CONTENT_CHILD_SYNC_LOAD_RESPONSE_H_
+
+#include <string>
+
+#include "url/gurl.h"
+#include "webkit/common/resource_response_info.h"
+
+namespace content {
+
+// See the SyncLoad method. (The name of this struct is not
+// suffixed with "Info" because it also contains the response data.)
+struct SyncLoadResponse : webkit_glue::ResourceResponseInfo {
+  SyncLoadResponse();
+  ~SyncLoadResponse();
+
+  // The response error code.
+  int error_code;
+
+  // The final URL of the response.  This may differ from the request URL in
+  // the case of a server redirect.
+  GURL url;
+
+  // The response data.
+  std::string data;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_SYNC_LOAD_RESPONSE_H_
diff --git a/content/child/web_url_loader_impl.cc b/content/child/web_url_loader_impl.cc
index b11a537b8f..13300df12f 100644
--- a/content/child/web_url_loader_impl.cc
+++ b/content/child/web_url_loader_impl.cc
@@ -16,6 +16,7 @@
 #include "content/child/ftp_directory_listing_response_delegate.h"
 #include "content/child/request_extra_data.h"
 #include "content/child/request_info.h"
+#include "content/child/sync_load_response.h"
 #include "content/common/resource_request_body.h"
 #include "net/base/data_url.h"
 #include "net/base/load_flags.h"
@@ -231,7 +232,7 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context>,
   void SetDefersLoading(bool value);
   void DidChangePriority(WebURLRequest::Priority new_priority);
   void Start(const WebURLRequest& request,
-             ResourceLoaderBridge::SyncLoadResponse* sync_load_response);
+             SyncLoadResponse* sync_load_response);
 
   // ResourceLoaderBridge::Peer methods:
   virtual void OnUploadProgress(uint64 position, uint64 size) OVERRIDE;
@@ -306,9 +307,8 @@ void WebURLLoaderImpl::Context::DidChangePriority(
         ConvertWebKitPriorityToNetPriority(new_priority));
 }
 
-void WebURLLoaderImpl::Context::Start(
-    const WebURLRequest& request,
-    ResourceLoaderBridge::SyncLoadResponse* sync_load_response) {
+void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
+                                      SyncLoadResponse* sync_load_response) {
   DCHECK(!bridge_.get());
 
   request_ = request;  // Save the request.
@@ -828,7 +828,7 @@ void WebURLLoaderImpl::loadSynchronously(const WebURLRequest& request,
                                          WebURLResponse& response,
                                          WebURLError& error,
                                          WebData& data) {
-  ResourceLoaderBridge::SyncLoadResponse sync_load_response;
+  SyncLoadResponse sync_load_response;
   context_->Start(request, &sync_load_response);
 
   const GURL& final_url = sync_load_response.url;
diff --git a/content/common/android/surface_texture_lookup.cc b/content/common/android/surface_texture_lookup.cc
new file mode 100644
index 0000000000..ee6715d3d8
--- /dev/null
+++ b/content/common/android/surface_texture_lookup.cc
@@ -0,0 +1,27 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/android/surface_texture_lookup.h"
+
+#include "base/logging.h"
+
+namespace content {
+
+namespace {
+SurfaceTextureLookup* g_instance = NULL;
+}  // namespace
+
+// static
+SurfaceTextureLookup* SurfaceTextureLookup::GetInstance() {
+  DCHECK(g_instance);
+  return g_instance;
+}
+
+// static
+void SurfaceTextureLookup::InitInstance(SurfaceTextureLookup* instance) {
+  DCHECK(!g_instance || !instance);
+  g_instance = instance;
+}
+
+}  // namespace content
diff --git a/content/common/android/surface_texture_lookup.h b/content/common/android/surface_texture_lookup.h
new file mode 100644
index 0000000000..a1ad0fb29e
--- /dev/null
+++ b/content/common/android/surface_texture_lookup.h
@@ -0,0 +1,26 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_ANDROID_SURFACE_TEXTURE_LOOKUP_H_
+#define CONTENT_COMMON_ANDROID_SURFACE_TEXTURE_LOOKUP_H_
+
+#include "ui/gfx/native_widget_types.h"
+
+namespace content {
+
+class SurfaceTextureLookup {
+ public:
+  static SurfaceTextureLookup* GetInstance();
+  static void InitInstance(SurfaceTextureLookup* instance);
+
+  virtual gfx::AcceleratedWidget AcquireNativeWidget(int primary_id,
+                                                     int secondary_id) = 0;
+
+ protected:
+  virtual ~SurfaceTextureLookup() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_ANDROID_SURFACE_TEXTURE_LOOKUP_H_
diff --git a/content/common/child_process_messages.h b/content/common/child_process_messages.h
index f220891c9b..8587f989af 100644
--- a/content/common/child_process_messages.h
+++ b/content/common/child_process_messages.h
@@ -60,12 +60,22 @@ IPC_STRUCT_TRAITS_END()
 IPC_ENUM_TRAITS_MAX_VALUE(gfx::GpuMemoryBufferType,
                           gfx::GPU_MEMORY_BUFFER_TYPE_LAST)
 
+#if defined(OS_ANDROID)
+IPC_STRUCT_TRAITS_BEGIN(gfx::SurfaceTextureId)
+  IPC_STRUCT_TRAITS_MEMBER(primary_id)
+  IPC_STRUCT_TRAITS_MEMBER(secondary_id)
+IPC_STRUCT_TRAITS_END()
+#endif
+
 IPC_STRUCT_TRAITS_BEGIN(gfx::GpuMemoryBufferHandle)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(handle)
 #if defined(OS_MACOSX)
   IPC_STRUCT_TRAITS_MEMBER(io_surface_id)
 #endif
+#if defined(OS_ANDROID)
+  IPC_STRUCT_TRAITS_MEMBER(surface_texture_id)
+#endif
 IPC_STRUCT_TRAITS_END()
 
 #undef IPC_MESSAGE_EXPORT
diff --git a/content/common/gpu/client/gpu_channel_host.cc b/content/common/gpu/client/gpu_channel_host.cc
index 45a0cc7e67..2a31c7c0ae 100644
--- a/content/common/gpu/client/gpu_channel_host.cc
+++ b/content/common/gpu/client/gpu_channel_host.cc
@@ -51,6 +51,9 @@ bool GpuChannelHost::IsValidGpuMemoryBuffer(
 #if defined(OS_MACOSX)
     case gfx::IO_SURFACE_BUFFER:
 #endif
+#if defined(OS_ANDROID)
+    case gfx::SURFACE_TEXTURE_BUFFER:
+#endif
       return true;
     default:
       return false;
@@ -288,6 +291,10 @@ gfx::GpuMemoryBufferHandle GpuChannelHost::ShareGpuMemoryBufferToGpuProcess(
     case gfx::IO_SURFACE_BUFFER:
       return source_handle;
 #endif
+#if defined(OS_ANDROID)
+    case gfx::SURFACE_TEXTURE_BUFFER:
+      return source_handle;
+#endif
     default:
       NOTREACHED();
       return gfx::GpuMemoryBufferHandle();
diff --git a/content/common/gpu/client/gpu_memory_buffer_impl_android.cc b/content/common/gpu/client/gpu_memory_buffer_impl_android.cc
index ffd4e381c7..a7f694f4a8 100644
--- a/content/common/gpu/client/gpu_memory_buffer_impl_android.cc
+++ b/content/common/gpu/client/gpu_memory_buffer_impl_android.cc
@@ -5,6 +5,7 @@
 #include "content/common/gpu/client/gpu_memory_buffer_impl.h"
 
 #include "content/common/gpu/client/gpu_memory_buffer_impl_shm.h"
+#include "content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.h"
 
 namespace content {
 
@@ -21,6 +22,14 @@ scoped_ptr<GpuMemoryBufferImpl> GpuMemoryBufferImpl::Create(
 
       return buffer.PassAs<GpuMemoryBufferImpl>();
     }
+    case gfx::SURFACE_TEXTURE_BUFFER: {
+      scoped_ptr<GpuMemoryBufferImplSurfaceTexture> buffer(
+          new GpuMemoryBufferImplSurfaceTexture(size, internalformat));
+      if (!buffer->Initialize(handle))
+        return scoped_ptr<GpuMemoryBufferImpl>();
+
+      return buffer.PassAs<GpuMemoryBufferImpl>();
+    }
     default:
       return scoped_ptr<GpuMemoryBufferImpl>();
   }
diff --git a/content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc b/content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc
new file mode 100644
index 0000000000..ee2f11114b
--- /dev/null
+++ b/content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc
@@ -0,0 +1,105 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.h"
+
+#include "base/debug/trace_event.h"
+#include "base/logging.h"
+#include "content/common/android/surface_texture_lookup.h"
+#include "ui/gl/gl_bindings.h"
+
+namespace content {
+
+// static
+bool GpuMemoryBufferImplSurfaceTexture::IsFormatSupported(
+    unsigned internalformat) {
+  switch (internalformat) {
+    case GL_RGBA8_OES:
+      return true;
+    default:
+      return false;
+  }
+}
+
+// static
+int GpuMemoryBufferImplSurfaceTexture::WindowFormat(unsigned internalformat) {
+  switch (internalformat) {
+    case GL_RGBA8_OES:
+      return WINDOW_FORMAT_RGBA_8888;
+    default:
+      NOTREACHED();
+      return 0;
+  }
+}
+
+GpuMemoryBufferImplSurfaceTexture::GpuMemoryBufferImplSurfaceTexture(
+    gfx::Size size,
+    unsigned internalformat)
+    : GpuMemoryBufferImpl(size, internalformat),
+      native_window_(NULL),
+      stride_(0u) {}
+
+GpuMemoryBufferImplSurfaceTexture::~GpuMemoryBufferImplSurfaceTexture() {
+  if (native_window_)
+    ANativeWindow_release(native_window_);
+}
+
+bool GpuMemoryBufferImplSurfaceTexture::Initialize(
+    gfx::GpuMemoryBufferHandle handle) {
+  TRACE_EVENT0("gpu", "GpuMemoryBufferImplSurfaceTexture::Initialize");
+
+  DCHECK(!native_window_);
+  native_window_ = SurfaceTextureLookup::GetInstance()->AcquireNativeWidget(
+      handle.surface_texture_id.primary_id,
+      handle.surface_texture_id.secondary_id);
+  if (!native_window_)
+    return false;
+
+  ANativeWindow_setBuffersGeometry(native_window_,
+                                   size_.width(),
+                                   size_.height(),
+                                   WindowFormat(internalformat_));
+
+  surface_texture_id_ = handle.surface_texture_id;
+  return true;
+}
+
+void GpuMemoryBufferImplSurfaceTexture::Map(AccessMode mode, void** vaddr) {
+  TRACE_EVENT0("gpu", "GpuMemoryBufferImplSurfaceTexture::Map");
+
+  DCHECK(!mapped_);
+  DCHECK(native_window_);
+  ANativeWindow_Buffer buffer;
+  int status = ANativeWindow_lock(native_window_, &buffer, NULL);
+  if (status) {
+    VLOG(1) << "ANativeWindow_lock failed with error code: " << status;
+    *vaddr = NULL;
+    return;
+  }
+
+  DCHECK_LE(size_.width(), buffer.stride);
+  *vaddr = buffer.bits;
+  stride_ = buffer.stride * BytesPerPixel(internalformat_);
+  mapped_ = true;
+}
+
+void GpuMemoryBufferImplSurfaceTexture::Unmap() {
+  TRACE_EVENT0("gpu", "GpuMemoryBufferImplSurfaceTexture::Unmap");
+
+  DCHECK(mapped_);
+  ANativeWindow_unlockAndPost(native_window_);
+  mapped_ = false;
+}
+
+uint32 GpuMemoryBufferImplSurfaceTexture::GetStride() const { return stride_; }
+
+gfx::GpuMemoryBufferHandle GpuMemoryBufferImplSurfaceTexture::GetHandle()
+    const {
+  gfx::GpuMemoryBufferHandle handle;
+  handle.type = gfx::SURFACE_TEXTURE_BUFFER;
+  handle.surface_texture_id = surface_texture_id_;
+  return handle;
+}
+
+}  // namespace content
diff --git a/content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.h b/content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.h
new file mode 100644
index 0000000000..77e8e767f2
--- /dev/null
+++ b/content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.h
@@ -0,0 +1,41 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_GPU_CLIENT_GPU_MEMORY_BUFFER_IMPL_SURFACE_TEXTURE_H_
+#define CONTENT_COMMON_GPU_CLIENT_GPU_MEMORY_BUFFER_IMPL_SURFACE_TEXTURE_H_
+
+#include "content/common/gpu/client/gpu_memory_buffer_impl.h"
+
+struct ANativeWindow;
+
+namespace content {
+
+// Provides implementation of a GPU memory buffer based on a surface texture id.
+class GpuMemoryBufferImplSurfaceTexture : public GpuMemoryBufferImpl {
+ public:
+  GpuMemoryBufferImplSurfaceTexture(gfx::Size size, unsigned internalformat);
+  virtual ~GpuMemoryBufferImplSurfaceTexture();
+
+  bool Initialize(gfx::GpuMemoryBufferHandle handle);
+
+  static bool IsFormatSupported(unsigned internalformat);
+  static int WindowFormat(unsigned internalformat);
+
+  // Overridden from gfx::GpuMemoryBuffer:
+  virtual void Map(AccessMode mode, void** vaddr) OVERRIDE;
+  virtual void Unmap() OVERRIDE;
+  virtual gfx::GpuMemoryBufferHandle GetHandle() const OVERRIDE;
+  virtual uint32 GetStride() const OVERRIDE;
+
+ private:
+  gfx::SurfaceTextureId surface_texture_id_;
+  ANativeWindow* native_window_;
+  size_t stride_;
+
+  DISALLOW_COPY_AND_ASSIGN(GpuMemoryBufferImplSurfaceTexture);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_GPU_CLIENT_GPU_MEMORY_BUFFER_IMPL_SURFACE_TEXTURE_H_
diff --git a/content/common/gpu/gpu_channel.h b/content/common/gpu/gpu_channel.h
index 760327e6ea..bc1f327075 100644
--- a/content/common/gpu/gpu_channel.h
+++ b/content/common/gpu/gpu_channel.h
@@ -76,6 +76,8 @@ class GpuChannel : public IPC::Listener,
 
   base::ProcessId renderer_pid() const { return channel_->peer_pid(); }
 
+  int client_id() const { return client_id_; }
+
   scoped_refptr<base::MessageLoopProxy> io_message_loop() const {
     return io_message_loop_;
   }
diff --git a/content/common/gpu/gpu_command_buffer_stub.cc b/content/common/gpu/gpu_command_buffer_stub.cc
index ef6a45a2e1..b44fa02b6f 100644
--- a/content/common/gpu/gpu_command_buffer_stub.cc
+++ b/content/common/gpu/gpu_command_buffer_stub.cc
@@ -880,6 +880,15 @@ void GpuCommandBufferStub::OnRegisterGpuMemoryBuffer(
     uint32 height,
     uint32 internalformat) {
   TRACE_EVENT0("gpu", "GpuCommandBufferStub::OnRegisterGpuMemoryBuffer");
+#if defined(OS_ANDROID)
+  // Verify that renderer is not trying to use a surface texture it doesn't own.
+  if (gpu_memory_buffer.type == gfx::SURFACE_TEXTURE_BUFFER &&
+      gpu_memory_buffer.surface_texture_id.secondary_id !=
+          channel()->client_id()) {
+    LOG(ERROR) << "Illegal surface texture ID for renderer.";
+    return;
+  }
+#endif
   if (gpu_control_) {
     gpu_control_->RegisterGpuMemoryBuffer(id,
                                           gpu_memory_buffer,
diff --git a/content/common/gpu/media/v4l2_video_decode_accelerator.cc b/content/common/gpu/media/v4l2_video_decode_accelerator.cc
index 587da6bbc0..e33148270a 100644
--- a/content/common/gpu/media/v4l2_video_decode_accelerator.cc
+++ b/content/common/gpu/media/v4l2_video_decode_accelerator.cc
@@ -288,8 +288,10 @@ bool V4L2VideoDecodeAccelerator::Initialize(media::VideoCodecProfile profile,
     return false;
   }
 
-  if (!StartDevicePoll())
-    return false;
+  // StartDevicePoll will NOTIFY_ERROR on failure, so IgnoreResult is fine here.
+  decoder_thread_.message_loop()->PostTask(FROM_HERE, base::Bind(
+      base::IgnoreResult(&V4L2VideoDecodeAccelerator::StartDevicePoll),
+      base::Unretained(this)));
 
   SetDecoderState(kInitialized);
 
@@ -1407,8 +1409,7 @@ void V4L2VideoDecodeAccelerator::DestroyTask() {
 bool V4L2VideoDecodeAccelerator::StartDevicePoll() {
   DVLOG(3) << "StartDevicePoll()";
   DCHECK(!device_poll_thread_.IsRunning());
-  if (decoder_thread_.IsRunning())
-    DCHECK_EQ(decoder_thread_.message_loop(), base::MessageLoop::current());
+  DCHECK_EQ(decoder_thread_.message_loop(), base::MessageLoop::current());
 
   // Start up the device poll thread and schedule its first DevicePollTask().
   if (!device_poll_thread_.Start()) {
diff --git a/content/content_child.gypi b/content/content_child.gypi
index 354faed59c..b744edae1d 100644
--- a/content/content_child.gypi
+++ b/content/content_child.gypi
@@ -161,10 +161,12 @@
     'child/site_isolation_policy.h',
     'child/socket_stream_dispatcher.cc',
     'child/socket_stream_dispatcher.h',
-    'child/touch_fling_gesture_curve.cc',
-    'child/touch_fling_gesture_curve.h',
+    'child/sync_load_response.cc',
+    'child/sync_load_response.h',
     'child/thread_safe_sender.cc',
     'child/thread_safe_sender.h',
+    'child/touch_fling_gesture_curve.cc',
+    'child/touch_fling_gesture_curve.h',
     'child/web_database_observer_impl.cc',
     'child/web_database_observer_impl.h',
     'child/web_discardable_memory_impl.cc',
diff --git a/content/content_child.target.darwin-arm.mk b/content/content_child.target.darwin-arm.mk
index 10fb0e4ae4..7eb5164100 100644
--- a/content/content_child.target.darwin-arm.mk
+++ b/content/content_child.target.darwin-arm.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.darwin-mips.mk b/content/content_child.target.darwin-mips.mk
index 8b451b6929..027ec85129 100644
--- a/content/content_child.target.darwin-mips.mk
+++ b/content/content_child.target.darwin-mips.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.darwin-x86.mk b/content/content_child.target.darwin-x86.mk
index d6430b85b4..b2ec7e813c 100644
--- a/content/content_child.target.darwin-x86.mk
+++ b/content/content_child.target.darwin-x86.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.darwin-x86_64.mk b/content/content_child.target.darwin-x86_64.mk
index 70b9749b73..725ff6c334 100644
--- a/content/content_child.target.darwin-x86_64.mk
+++ b/content/content_child.target.darwin-x86_64.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.linux-arm.mk b/content/content_child.target.linux-arm.mk
index 10fb0e4ae4..7eb5164100 100644
--- a/content/content_child.target.linux-arm.mk
+++ b/content/content_child.target.linux-arm.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.linux-mips.mk b/content/content_child.target.linux-mips.mk
index 8b451b6929..027ec85129 100644
--- a/content/content_child.target.linux-mips.mk
+++ b/content/content_child.target.linux-mips.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.linux-x86.mk b/content/content_child.target.linux-x86.mk
index d6430b85b4..b2ec7e813c 100644
--- a/content/content_child.target.linux-x86.mk
+++ b/content/content_child.target.linux-x86.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_child.target.linux-x86_64.mk b/content/content_child.target.linux-x86_64.mk
index 70b9749b73..725ff6c334 100644
--- a/content/content_child.target.linux-x86_64.mk
+++ b/content/content_child.target.linux-x86_64.mk
@@ -84,8 +84,9 @@ LOCAL_SRC_FILES := \
 	content/child/simple_webmimeregistry_impl.cc \
 	content/child/site_isolation_policy.cc \
 	content/child/socket_stream_dispatcher.cc \
-	content/child/touch_fling_gesture_curve.cc \
+	content/child/sync_load_response.cc \
 	content/child/thread_safe_sender.cc \
+	content/child/touch_fling_gesture_curve.cc \
 	content/child/web_database_observer_impl.cc \
 	content/child/web_discardable_memory_impl.cc \
 	content/child/web_socket_stream_handle_impl.cc \
diff --git a/content/content_common.gypi b/content/content_common.gypi
index 6fcf141fe1..16efa4b5d0 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -132,6 +132,8 @@
     'common/android/device_telephony_info.h',
     'common/android/hash_set.cc',
     'common/android/hash_set.h',
+    'common/android/surface_texture_lookup.cc',
+    'common/android/surface_texture_lookup.h',
     'common/android/surface_texture_peer.cc',
     'common/android/surface_texture_peer.h',
     'common/appcache_messages.h',
@@ -543,6 +545,10 @@
       },
     }],
     ['OS=="android"',{
+      'sources': [
+        'common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc',
+        'common/gpu/client/gpu_memory_buffer_impl_surface_texture.h',
+      ],
       'link_settings': {
         'libraries': [
           '-landroid',  # ANativeWindow
diff --git a/content/content_common.target.darwin-arm.mk b/content/content_common.target.darwin-arm.mk
index 82d3c19e8c..56c1f4a80f 100644
--- a/content/content_common.target.darwin-arm.mk
+++ b/content/content_common.target.darwin-arm.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.darwin-mips.mk b/content/content_common.target.darwin-mips.mk
index 587697749d..c6fdc03602 100644
--- a/content/content_common.target.darwin-mips.mk
+++ b/content/content_common.target.darwin-mips.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.darwin-x86.mk b/content/content_common.target.darwin-x86.mk
index c8c583908a..42a53441f5 100644
--- a/content/content_common.target.darwin-x86.mk
+++ b/content/content_common.target.darwin-x86.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.darwin-x86_64.mk b/content/content_common.target.darwin-x86_64.mk
index 1be366c476..c4b01b2ca3 100644
--- a/content/content_common.target.darwin-x86_64.mk
+++ b/content/content_common.target.darwin-x86_64.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.linux-arm.mk b/content/content_common.target.linux-arm.mk
index 82d3c19e8c..56c1f4a80f 100644
--- a/content/content_common.target.linux-arm.mk
+++ b/content/content_common.target.linux-arm.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.linux-mips.mk b/content/content_common.target.linux-mips.mk
index 587697749d..c6fdc03602 100644
--- a/content/content_common.target.linux-mips.mk
+++ b/content/content_common.target.linux-mips.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.linux-x86.mk b/content/content_common.target.linux-x86.mk
index c8c583908a..42a53441f5 100644
--- a/content/content_common.target.linux-x86.mk
+++ b/content/content_common.target.linux-x86.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/content_common.target.linux-x86_64.mk b/content/content_common.target.linux-x86_64.mk
index 1be366c476..c4b01b2ca3 100644
--- a/content/content_common.target.linux-x86_64.mk
+++ b/content/content_common.target.linux-x86_64.mk
@@ -70,6 +70,7 @@ LOCAL_SRC_FILES := \
 	content/common/android/common_jni_registrar.cc \
 	content/common/android/device_telephony_info.cc \
 	content/common/android/hash_set.cc \
+	content/common/android/surface_texture_lookup.cc \
 	content/common/android/surface_texture_peer.cc \
 	content/common/browser_plugin/browser_plugin_constants.cc \
 	content/common/cc_messages.cc \
@@ -159,6 +160,7 @@ LOCAL_SRC_FILES := \
 	content/common/user_agent.cc \
 	content/common/webplugin_geometry.cc \
 	content/common/websocket.cc \
+	content/common/gpu/client/gpu_memory_buffer_impl_surface_texture.cc \
 	content/common/gpu/media/android_video_decode_accelerator.cc
 
 
diff --git a/content/public/android/java/src/org/chromium/content/app/ChildProcessService.java b/content/public/android/java/src/org/chromium/content/app/ChildProcessService.java
index 4fec77255d..ed694b7c81 100644
--- a/content/public/android/java/src/org/chromium/content/app/ChildProcessService.java
+++ b/content/public/android/java/src/org/chromium/content/app/ChildProcessService.java
@@ -285,6 +285,22 @@ public class ChildProcessService extends Service {
         }
     }
 
+    @SuppressWarnings("unused")
+    @CalledByNative
+    private Surface getSurfaceTextureSurface(int primaryId, int secondaryId) {
+        if (mCallback == null) {
+            Log.e(TAG, "No callback interface has been provided.");
+            return null;
+        }
+
+        try {
+            return mCallback.getSurfaceTextureSurface(primaryId, secondaryId);
+        } catch (RemoteException e) {
+            Log.e(TAG, "Unable to call getSurfaceTextureSurface: " + e);
+            return null;
+        }
+    }
+
     /**
      * The main entry point for a child process. This should be called from a new thread since
      * it will not return until the child process exits. See child_process_service.{h,cc}
diff --git a/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncher.java b/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncher.java
index d44163fa12..d88305c7f5 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncher.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncher.java
@@ -305,6 +305,7 @@ public class ChildProcessLauncher {
     static void start(
             Context context,
             final String[] commandLine,
+            int childProcessId,
             int[] fileIds,
             int[] fileFds,
             boolean[] fileAutoClose,
@@ -366,7 +367,7 @@ public class ChildProcessLauncher {
 
         connection.setupConnection(commandLine,
                                    filesToBeMapped,
-                                   createCallback(callbackType),
+                                   createCallback(childProcessId, callbackType),
                                    connectionCallback,
                                    Linker.getSharedRelros());
     }
@@ -392,7 +393,8 @@ public class ChildProcessLauncher {
     /**
      * This implementation is used to receive callbacks from the remote service.
      */
-    private static IChildProcessCallback createCallback(final int callbackType) {
+    private static IChildProcessCallback createCallback(
+            final int childProcessId, final int callbackType) {
         return new IChildProcessCallback.Stub() {
             /**
              * This is called by the remote service regularly to tell us about new values. Note that
@@ -423,6 +425,21 @@ public class ChildProcessLauncher {
 
                 return nativeGetViewSurface(surfaceId);
             }
+
+            @Override
+            public Surface getSurfaceTextureSurface(int primaryId, int secondaryId) {
+                if (callbackType != CALLBACK_FOR_RENDERER_PROCESS) {
+                    Log.e(TAG, "Illegal callback for non-renderer process.");
+                    return null;
+                }
+
+                if (secondaryId != childProcessId) {
+                    Log.e(TAG, "Illegal secondaryId for renderer process.");
+                    return null;
+                }
+
+                return nativeGetSurfaceTextureSurface(primaryId, secondaryId);
+            }
         };
     }
 
@@ -435,6 +452,8 @@ public class ChildProcessLauncher {
 
     private static native void nativeOnChildProcessStarted(long clientContext, int pid);
     private static native Surface nativeGetViewSurface(int surfaceId);
+    private static native Surface nativeGetSurfaceTextureSurface(
+            int surfaceTextureId, int childProcessId);
     private static native void nativeEstablishSurfacePeer(
             int pid, Surface surface, int primaryID, int secondaryID);
     private static native boolean nativeIsSingleProcess();
diff --git a/content/public/android/java/src/org/chromium/content/common/IChildProcessCallback.aidl b/content/public/android/java/src/org/chromium/content/common/IChildProcessCallback.aidl
index f0c26d1cf0..19f44dc584 100644
--- a/content/public/android/java/src/org/chromium/content/common/IChildProcessCallback.aidl
+++ b/content/public/android/java/src/org/chromium/content/common/IChildProcessCallback.aidl
@@ -13,4 +13,6 @@ interface IChildProcessCallback {
       int pid, in Surface surface, int primaryID, int secondaryID);
 
   Surface getViewSurface(int surfaceId);
+
+  Surface getSurfaceTextureSurface(int primaryId, int secondaryId);
 }
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 9f3f8eb9e5..949975b9cf 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -779,13 +779,13 @@ void RenderFrameImpl::OnNavigate(const FrameMsg_Navigate_Params& params) {
 }
 
 void RenderFrameImpl::OnBeforeUnload() {
-  // TODO(creis): Move dispatchBeforeUnloadEvent to WebFrame.  Until then, this
-  // should only be called on the main frame.  Eventually, the browser process
-  // should dispatch it to every frame that needs it.
+  // TODO(creis): Right now, this is only called on the main frame.  Make the
+  // browser process send dispatchBeforeUnloadEvent to every frame that needs
+  // it.
   CHECK(!frame_->parent());
 
   base::TimeTicks before_unload_start_time = base::TimeTicks::Now();
-  bool proceed = render_view_->webview()->dispatchBeforeUnloadEvent();
+  bool proceed = frame_->dispatchBeforeUnloadEvent();
   base::TimeTicks before_unload_end_time = base::TimeTicks::Now();
   Send(new FrameHostMsg_BeforeUnload_ACK(routing_id_, proceed,
                                          before_unload_start_time,
diff --git a/content/renderer/web_preferences.cc b/content/renderer/web_preferences.cc
index 3555116d7b..5bdcebd42a 100644
--- a/content/renderer/web_preferences.cc
+++ b/content/renderer/web_preferences.cc
@@ -267,8 +267,6 @@ void ApplyWebPreferences(const WebPreferences& prefs, WebView* web_view) {
   // ChromeClient::tabsToLinks which is part of the glue code.
   web_view->setTabsToLinks(prefs.tabs_to_links);
 
-  // TODO(scheib): crbug.com/344002 Remove FullScreenEnabled from Blink
-  settings->setFullScreenEnabled(true);
   settings->setAllowDisplayOfInsecureContent(
       prefs.allow_displaying_insecure_content);
   settings->setAllowRunningOfInsecureContent(
diff --git a/content/shell/renderer/test_runner/test_runner.cc b/content/shell/renderer/test_runner/test_runner.cc
index de6d749963..b580493166 100644
--- a/content/shell/renderer/test_runner/test_runner.cc
+++ b/content/shell/renderer/test_runner/test_runner.cc
@@ -1933,7 +1933,7 @@ bool TestRunner::IsCommandEnabled(const std::string& command) {
 }
 
 bool TestRunner::CallShouldCloseOnWebView() {
-  return web_view_->dispatchBeforeUnloadEvent();
+  return web_view_->mainFrame()->dispatchBeforeUnloadEvent();
 }
 
 void TestRunner::SetDomainRelaxationForbiddenForURLScheme(