Fix SessionStorage

Apparently the session storage code was pretty horribly broken.  It didn't correctly handle tabs being restored, didn't have the proper lifetime (this was the issue exposed in the bug), and had many leaks.

To fix this, things had to be plumbed fairly differently.  We need to pass session storage in on TabContents creation to ensure that the first RenderView will have the correct session storage id.  When closing a tab, we need to save the session storage with the restoration service.  When restoring a tab, we pass it back into the tab contents class.  When duplicating a tab, we clone the storage.

Lifetimes are now handled by standard reference counting code.  A SessionStorageNamespace object wraps an ID.  When it's instantiated, it allocates an ID.  When it's destroyed, it deletes the ID.  IDs make this process very lightweight (the heavyweight stuff is allocated on first use of SessionStorage) and it seperates the more complex lifetimes of SessionStorage namespaces (where less deterministic shutdown is more tollerable) from the LocalStorage namespace which needs to shutdown very precisely.

BUG=52393
TEST=Set some variable on session storage; close the tab; re-open the tab; the variable should still be set.  You can also run through the repro steps in the bug.

Review URL: http://codereview.chromium.org/3325012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@59350 0039d316-1c4b-4281-b951-d872f2087c98

42 files changed, 208 insertions, 93 deletions

diff --git a/chrome/browser/browser.cc b/chrome/browser/browser.cc
index 6fcd25f..deddb0b 100644
--- a/chrome/browser/browser.cc
+++ b/chrome/browser/browser.cc
@@ -962,9 +962,11 @@ TabContents* Browser::AddRestoredTab(
     const std::string& extension_app_id,
     bool select,
     bool pin,
-    bool from_last_session) {
-  TabContents* new_tab = new TabContents(profile(), NULL,
-      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
+    bool from_last_session,
+    SessionStorageNamespace* session_storage_namespace) {
+  TabContents* new_tab = new TabContents(
+      profile(), NULL, MSG_ROUTING_NONE,
+      tabstrip_model_.GetSelectedTabContents(), session_storage_namespace);
   new_tab->SetExtensionAppById(extension_app_id);
   new_tab->controller().RestoreFromState(navigations, selected_navigation,
                                          from_last_session);
@@ -1000,9 +1002,11 @@ void Browser::ReplaceRestoredTab(
     const std::vector<TabNavigation>& navigations,
     int selected_navigation,
     bool from_last_session,
-    const std::string& extension_app_id) {
+    const std::string& extension_app_id,
+    SessionStorageNamespace* session_storage_namespace) {
   TabContents* replacement = new TabContents(profile(), NULL,
-      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
+      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents(),
+      session_storage_namespace);
   replacement->SetExtensionAppById(extension_app_id);
   replacement->controller().RestoreFromState(navigations, selected_navigation,
                                              from_last_session);
@@ -2306,7 +2310,7 @@ TabContents* Browser::CreateTabContentsForURL(
     PageTransition::Type transition, bool defer_load,
     SiteInstance* instance) const {
   TabContents* contents = new TabContents(profile, instance,
-      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
+      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents(), NULL);
 
   if (!defer_load) {
     // Load the initial URL before adding the new tab contents to the tab strip
diff --git a/chrome/browser/browser.h b/chrome/browser/browser.h
index 3637871..8b6e779 100644
--- a/chrome/browser/browser.h
+++ b/chrome/browser/browser.h
@@ -37,6 +37,7 @@ class Extension;
 class FindBarController;
 class PrefService;
 class Profile;
+class SessionStorageNamespace;
 class SkBitmap;
 class StatusBubble;
 class TabNavigation;
@@ -370,7 +371,8 @@ class Browser : public TabStripModelDelegate,
                               const std::string& extension_app_id,
                               bool select,
                               bool pin,
-                              bool from_last_session);
+                              bool from_last_session,
+                              SessionStorageNamespace* storage_namespace);
   // Creates a new tab with the already-created TabContents 'new_contents'.
   // The window for the added contents will be reparented correctly when this
   // method returns.  If |disposition| is NEW_POPUP, |pos| should hold the
@@ -401,7 +403,8 @@ class Browser : public TabStripModelDelegate,
       const std::vector<TabNavigation>& navigations,
       int selected_navigation,
       bool from_last_session,
-      const std::string& extension_app_id);
+      const std::string& extension_app_id,
+      SessionStorageNamespace* session_storage_namespace);
 
   // Navigate to an index in the tab history, opening a new tab depending on the
   // disposition.
diff --git a/chrome/browser/browser_browsertest.cc b/chrome/browser/browser_browsertest.cc
index 119a0ed..23b998d 100644
--- a/chrome/browser/browser_browsertest.cc
+++ b/chrome/browser/browser_browsertest.cc
@@ -114,7 +114,7 @@ class BrowserTest : public ExtensionBrowserTest {
     ui_test_utils::NavigateToURL(browser(), url);
 
     TabContents* app_contents = new TabContents(browser()->profile(), NULL,
-                                                MSG_ROUTING_NONE, NULL);
+                                                MSG_ROUTING_NONE, NULL, NULL);
     app_contents->SetExtensionApp(extension_app);
 
     model->AddTabContents(app_contents, 0, 0, TabStripModel::ADD_NONE);
@@ -459,7 +459,7 @@ IN_PROC_BROWSER_TEST_F(BrowserTest, TabClosingWhenRemovingExtension) {
   ui_test_utils::NavigateToURL(browser(), url);
 
   TabContents* app_contents = new TabContents(browser()->profile(), NULL,
-                                              MSG_ROUTING_NONE, NULL);
+                                              MSG_ROUTING_NONE, NULL, NULL);
   app_contents->SetExtensionApp(extension_app);
 
   model->AddTabContents(app_contents, 0, 0, TabStripModel::ADD_NONE);
@@ -554,7 +554,7 @@ IN_PROC_BROWSER_TEST_F(BrowserTest, RestorePinnedTabs) {
   Extension* extension_app = GetExtension();
   ui_test_utils::NavigateToURL(browser(), url);
   TabContents* app_contents = new TabContents(browser()->profile(), NULL,
-                                              MSG_ROUTING_NONE, NULL);
+                                              MSG_ROUTING_NONE, NULL, NULL);
   app_contents->SetExtensionApp(extension_app);
   model->AddTabContents(app_contents, 0, 0, TabStripModel::ADD_NONE);
   model->SetTabPinned(0, true);
diff --git a/chrome/browser/chromeos/login/web_page_view.cc b/chrome/browser/chromeos/login/web_page_view.cc
index 64be489..5205fa1 100644
--- a/chrome/browser/chromeos/login/web_page_view.cc
+++ b/chrome/browser/chromeos/login/web_page_view.cc
@@ -53,7 +53,7 @@ WizardWebPageViewTabContents::WizardWebPageViewTabContents(
     Profile* profile,
     SiteInstance* site_instance,
     WebPageDelegate* page_delegate)
-      : TabContents(profile, site_instance, MSG_ROUTING_NONE, NULL),
+      : TabContents(profile, site_instance, MSG_ROUTING_NONE, NULL, NULL),
         page_delegate_(page_delegate) {
   }
 
diff --git a/chrome/browser/cocoa/html_dialog_window_controller.mm b/chrome/browser/cocoa/html_dialog_window_controller.mm
index 87691fb..b959798 100644
--- a/chrome/browser/cocoa/html_dialog_window_controller.mm
+++ b/chrome/browser/cocoa/html_dialog_window_controller.mm
@@ -265,8 +265,8 @@ void HtmlDialogWindowDelegateBridge::HandleKeyboardEvent(
 }
 
 - (void)loadDialogContents {
-  tabContents_.reset(
-      new TabContents(delegate_->profile(), NULL, MSG_ROUTING_NONE, NULL));
+  tabContents_.reset(new TabContents(
+      delegate_->profile(), NULL, MSG_ROUTING_NONE, NULL, NULL));
   [[self window] setContentView:tabContents_->GetNativeView()];
   tabContents_->set_delegate(delegate_.get());
 
diff --git a/chrome/browser/cocoa/tab_strip_controller_unittest.mm b/chrome/browser/cocoa/tab_strip_controller_unittest.mm
index e879b3c..cddc952 100644
--- a/chrome/browser/cocoa/tab_strip_controller_unittest.mm
+++ b/chrome/browser/cocoa/tab_strip_controller_unittest.mm
@@ -150,7 +150,7 @@ TEST_F(TabStripControllerTest, AddRemoveTabs) {
       SiteInstance::CreateSiteInstance(browser_helper_.profile());
   TabContents* tab_contents =
       new TabContents(browser_helper_.profile(), instance, MSG_ROUTING_NONE,
-                      NULL);
+                      NULL, NULL);
   model_->AppendTabContents(tab_contents, true);
   EXPECT_EQ(model_->count(), 1);
 }
diff --git a/chrome/browser/cocoa/tabpose_window_unittest.mm b/chrome/browser/cocoa/tabpose_window_unittest.mm
index e9ed441..10e2707 100644
--- a/chrome/browser/cocoa/tabpose_window_unittest.mm
+++ b/chrome/browser/cocoa/tabpose_window_unittest.mm
@@ -20,7 +20,8 @@ class TabposeWindowTest : public CocoaTest {
 
   void AppendTabToStrip() {
     TabContents* tab_contents = new TabContents(
-        browser_helper_.profile(), site_instance_, MSG_ROUTING_NONE, NULL);
+        browser_helper_.profile(), site_instance_, MSG_ROUTING_NONE,
+        NULL, NULL);
     browser_helper_.browser()->tabstrip_model()->AppendTabContents(
         tab_contents, /*foreground=*/true);
   }
diff --git a/chrome/browser/cocoa/translate/translate_infobar_unittest.mm b/chrome/browser/cocoa/translate/translate_infobar_unittest.mm
index 2c8f767..a389eba 100644
--- a/chrome/browser/cocoa/translate/translate_infobar_unittest.mm
+++ b/chrome/browser/cocoa/translate/translate_infobar_unittest.mm
@@ -81,6 +81,7 @@ class TranslationInfoBarTest : public CocoaTest {
         new TabContents(browser_helper_.profile(),
                         NULL,
                         MSG_ROUTING_NONE,
+                        NULL,
                         NULL));
     CreateInfoBar();
   }
diff --git a/chrome/browser/debugger/devtools_window.cc b/chrome/browser/debugger/devtools_window.cc
index 0d2ec24..a185444 100644
--- a/chrome/browser/debugger/devtools_window.cc
+++ b/chrome/browser/debugger/devtools_window.cc
@@ -14,6 +14,7 @@
 #include "chrome/browser/debugger/devtools_manager.h"
 #include "chrome/browser/debugger/devtools_window.h"
 #include "chrome/browser/extensions/extensions_service.h"
+#include "chrome/browser/in_process_webkit/session_storage_namespace.h"
 #include "chrome/browser/load_notification_details.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profile.h"
@@ -64,7 +65,7 @@ DevToolsWindow::DevToolsWindow(Profile* profile,
       is_loaded_(false),
       action_on_load_(DEVTOOLS_TOGGLE_ACTION_NONE) {
   // Create TabContents with devtools.
-  tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL);
+  tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL, NULL);
   tab_contents_->render_view_host()->AllowBindings(BindingsPolicy::DOM_UI);
   tab_contents_->controller().LoadURL(
       GetDevToolsUrl(), GURL(), PageTransition::START_PAGE);
diff --git a/chrome/browser/dom_ui/html_dialog_tab_contents_delegate_unittest.cc b/chrome/browser/dom_ui/html_dialog_tab_contents_delegate_unittest.cc
index 7f487fc..ac3ccaa 100644
--- a/chrome/browser/dom_ui/html_dialog_tab_contents_delegate_unittest.cc
+++ b/chrome/browser/dom_ui/html_dialog_tab_contents_delegate_unittest.cc
@@ -141,7 +141,7 @@ TEST_F(HtmlDialogTabContentsDelegateTest, AddNewContentsTest) {
   test_tab_contents_delegate_->SetWindowForNextCreatedBrowser(window);
 
   TabContents* contents =
-      new TabContents(profile(), NULL, MSG_ROUTING_NONE, NULL);
+      new TabContents(profile(), NULL, MSG_ROUTING_NONE, NULL, NULL);
   test_tab_contents_delegate_->AddNewContents(
       NULL, contents, NEW_FOREGROUND_TAB, gfx::Rect(), false);
   EXPECT_EQ(0, browser()->tab_count());
diff --git a/chrome/browser/extensions/extension_host.cc b/chrome/browser/extensions/extension_host.cc
index 2810999..cf95ce2 100644
--- a/chrome/browser/extensions/extension_host.cc
+++ b/chrome/browser/extensions/extension_host.cc
@@ -23,8 +23,6 @@
 #include "chrome/browser/extensions/extension_tabs_module.h"
 #include "chrome/browser/extensions/extensions_service.h"
 #include "chrome/browser/file_select_helper.h"
-#include "chrome/browser/in_process_webkit/dom_storage_context.h"
-#include "chrome/browser/in_process_webkit/webkit_context.h"
 #include "chrome/browser/message_box_handler.h"
 #include "chrome/browser/platform_util.h"
 #include "chrome/browser/prefs/pref_service.h"
@@ -131,10 +129,8 @@ ExtensionHost::ExtensionHost(Extension* extension, SiteInstance* site_instance,
       url_(url),
       extension_host_type_(host_type),
       associated_tab_contents_(NULL) {
-  int64 session_storage_namespace_id = profile_->GetWebKitContext()->
-      dom_storage_context()->AllocateSessionStorageNamespaceId();
   render_view_host_ = new RenderViewHost(site_instance, this, MSG_ROUTING_NONE,
-                                         session_storage_namespace_id);
+                                         NULL);
   render_view_host_->set_is_extension_process(true);
   render_view_host_->AllowBindings(BindingsPolicy::EXTENSION);
   if (enable_dom_automation_)
diff --git a/chrome/browser/external_tab_container_win.cc b/chrome/browser/external_tab_container_win.cc
index 1af539b..24d7f60 100644
--- a/chrome/browser/external_tab_container_win.cc
+++ b/chrome/browser/external_tab_container_win.cc
@@ -106,7 +106,8 @@ bool ExternalTabContainer::Init(Profile* profile,
     tab_contents_ = existing_contents;
     tab_contents_->controller().set_profile(profile);
   } else {
-    tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL);
+    tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE,
+                                    NULL, NULL);
   }
 
   tab_contents_->set_delegate(this);
diff --git a/chrome/browser/gtk/html_dialog_gtk.cc b/chrome/browser/gtk/html_dialog_gtk.cc
index 1df0df4..3c9d1fb 100644
--- a/chrome/browser/gtk/html_dialog_gtk.cc
+++ b/chrome/browser/gtk/html_dialog_gtk.cc
@@ -124,7 +124,7 @@ void HtmlDialogGtk::HandleKeyboardEvent(const NativeWebKeyboardEvent& event) {
 
 void HtmlDialogGtk::InitDialog() {
   tab_contents_.reset(
-      new TabContents(profile(), NULL, MSG_ROUTING_NONE, NULL));
+      new TabContents(profile(), NULL, MSG_ROUTING_NONE, NULL, NULL));
   tab_contents_->set_delegate(this);
 
   // This must be done before loading the page; see the comments in
diff --git a/chrome/browser/in_process_webkit/session_storage_namespace.cc b/chrome/browser/in_process_webkit/session_storage_namespace.cc
new file mode 100644
index 0000000..cfa2a5a
--- /dev/null
+++ b/chrome/browser/in_process_webkit/session_storage_namespace.cc
@@ -0,0 +1,31 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/in_process_webkit/session_storage_namespace.h"
+
+#include "chrome/browser/in_process_webkit/dom_storage_context.h"
+#include "chrome/browser/in_process_webkit/webkit_context.h"
+#include "chrome/browser/profile.h"
+
+SessionStorageNamespace::SessionStorageNamespace(Profile* profile)
+    : webkit_context_(profile->GetWebKitContext()),
+      id_(webkit_context_->dom_storage_context()
+          ->AllocateSessionStorageNamespaceId()) {
+}
+
+SessionStorageNamespace::SessionStorageNamespace(WebKitContext* webkit_context,
+                                                 int64 id)
+    : webkit_context_(webkit_context),
+      id_(id) {
+}
+
+SessionStorageNamespace::~SessionStorageNamespace() {
+  webkit_context_->DeleteSessionStorageNamespace(id_);
+}
+
+SessionStorageNamespace* SessionStorageNamespace::Clone() {
+  return new SessionStorageNamespace(
+      webkit_context_,
+      webkit_context_->dom_storage_context()->CloneSessionStorage(id_));
+}
diff --git a/chrome/browser/in_process_webkit/session_storage_namespace.h b/chrome/browser/in_process_webkit/session_storage_namespace.h
new file mode 100644
index 0000000..364882a
--- /dev/null
+++ b/chrome/browser/in_process_webkit/session_storage_namespace.h
@@ -0,0 +1,46 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_IN_PROCESS_WEBKIT_SESSION_STORAGE_NAMESPACE_H_
+#define CHROME_BROWSER_IN_PROCESS_WEBKIT_SESSION_STORAGE_NAMESPACE_H_
+#pragma once
+
+#include "base/basictypes.h"
+#include "base/ref_counted.h"
+
+class Profile;
+class WebKitContext;
+
+// This is a ref-counted class that represents a SessionStorageNamespace.
+// On destruction it ensures that the storage namespace is destroyed.
+// NOTE: That if we're shutting down, we don't strictly need to do this, but
+//       it keeps valgrind happy.
+class SessionStorageNamespace
+    : public base::RefCountedThreadSafe<SessionStorageNamespace> {
+ public:
+  explicit SessionStorageNamespace(Profile* profile);
+
+  int64 id() const { return id_; }
+
+  // The session storage namespace parameter allows multiple render views and
+  // tab contentses to share the same session storage (part of the WebStorage
+  // spec) space. Passing in NULL simply allocates a new one which is often the
+  // correct thing to do (especially in tests.
+  SessionStorageNamespace* Clone();
+
+ private:
+  SessionStorageNamespace(WebKitContext* webkit_context, int64 id);
+
+  friend class base::RefCountedThreadSafe<SessionStorageNamespace>;
+  ~SessionStorageNamespace();
+
+  scoped_refptr<WebKitContext> webkit_context_;
+
+  // The session storage namespace id.
+  int64 id_;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(SessionStorageNamespace);
+};
+
+#endif  // CHROME_BROWSER_IN_PROCESS_WEBKIT_SESSION_STORAGE_NAMESPACE_H_
diff --git a/chrome/browser/in_process_webkit/webkit_context.cc b/chrome/browser/in_process_webkit/webkit_context.cc
index ae1665a..0af2c2d 100644
--- a/chrome/browser/in_process_webkit/webkit_context.cc
+++ b/chrome/browser/in_process_webkit/webkit_context.cc
@@ -4,8 +4,10 @@
 
 #include "chrome/browser/in_process_webkit/webkit_context.h"
 
+#include "base/command_line.h"
 #include "chrome/browser/chrome_thread.h"
 #include "chrome/browser/profile.h"
+#include "chrome/common/chrome_switches.h"
 
 WebKitContext::WebKitContext(Profile* profile)
     : data_path_(profile->IsOffTheRecord() ? FilePath() : profile->GetPath()),
diff --git a/chrome/browser/in_process_webkit/webkit_context.h b/chrome/browser/in_process_webkit/webkit_context.h
index 26e0621..be20825c 100644
--- a/chrome/browser/in_process_webkit/webkit_context.h
+++ b/chrome/browser/in_process_webkit/webkit_context.h
@@ -56,8 +56,8 @@ class WebKitContext : public base::RefCountedThreadSafe<WebKitContext> {
                                const char* url_scheme_to_be_skipped,
                                const std::vector<string16>& protected_origins);
 
-  // Delete the session storage namespace associated with this id.  Called from
-  // the UI thread.
+  // Delete the session storage namespace associated with this id.  Can be
+  // called from any thread.
   void DeleteSessionStorageNamespace(int64 session_storage_namespace_id);
 
  private:
diff --git a/chrome/browser/notifications/balloon_host.cc b/chrome/browser/notifications/balloon_host.cc
index 6e3b44d..4251086 100644
--- a/chrome/browser/notifications/balloon_host.cc
+++ b/chrome/browser/notifications/balloon_host.cc
@@ -5,7 +5,6 @@
 #include "chrome/browser/notifications/balloon_host.h"
 
 #include "chrome/browser/browser_list.h"
-#include "chrome/browser/in_process_webkit/webkit_context.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/notifications/balloon.h"
 #include "chrome/browser/profile.h"
@@ -135,11 +134,8 @@ RendererPreferences BalloonHost::GetRendererPrefs(Profile* profile) const {
 
 void BalloonHost::Init() {
   DCHECK(!render_view_host_) << "BalloonViewHost already initialized.";
-  int64 session_storage_namespace_id = balloon_->profile()->GetWebKitContext()->
-      dom_storage_context()->AllocateSessionStorageNamespaceId();
-  RenderViewHost* rvh = new RenderViewHost(site_instance_.get(),
-                                           this, MSG_ROUTING_NONE,
-                                           session_storage_namespace_id);
+  RenderViewHost* rvh = new RenderViewHost(
+      site_instance_.get(), this, MSG_ROUTING_NONE, NULL);
   if (GetProfile()->GetExtensionsService()) {
     extension_function_dispatcher_.reset(
         ExtensionFunctionDispatcher::Create(
diff --git a/chrome/browser/renderer_host/render_view_host.cc b/chrome/browser/renderer_host/render_view_host.cc
index 4943481..cbbe369 100644
--- a/chrome/browser/renderer_host/render_view_host.cc
+++ b/chrome/browser/renderer_host/render_view_host.cc
@@ -20,6 +20,7 @@
 #include "chrome/browser/debugger/devtools_manager.h"
 #include "chrome/browser/dom_operation_notification_details.h"
 #include "chrome/browser/extensions/extension_message_service.h"
+#include "chrome/browser/in_process_webkit/session_storage_namespace.h"
 #include "chrome/browser/metrics/user_metrics.h"
 #include "chrome/browser/net/predictor_api.h"
 #include "chrome/browser/notifications/desktop_notification_service.h"
@@ -114,7 +115,7 @@ RenderViewHost* RenderViewHost::FromID(int render_process_id,
 RenderViewHost::RenderViewHost(SiteInstance* instance,
                                RenderViewHostDelegate* delegate,
                                int routing_id,
-                               int64 session_storage_namespace_id)
+                               SessionStorageNamespace* session_storage)
     : RenderWidgetHost(instance->GetProcess(), routing_id),
       instance_(instance),
       delegate_(delegate),
@@ -129,10 +130,15 @@ RenderViewHost::RenderViewHost(SiteInstance* instance,
       unload_ack_is_for_cross_site_transition_(false),
       are_javascript_messages_suppressed_(false),
       sudden_termination_allowed_(false),
-      session_storage_namespace_id_(session_storage_namespace_id),
+      session_storage_namespace_(session_storage),
       is_extension_process_(false),
       autofill_query_id_(0),
       save_accessibility_tree_for_testing_(false) {
+  if (!session_storage_namespace_) {
+    session_storage_namespace_ =
+        new SessionStorageNamespace(process()->profile());
+  }
+
   DCHECK(instance_);
   DCHECK(delegate_);
 }
@@ -189,7 +195,7 @@ bool RenderViewHost::CreateRenderView(const string16& frame_name) {
       delegate_->GetRendererPrefs(process()->profile());
   params.web_preferences = webkit_prefs;
   params.view_id = routing_id();
-  params.session_storage_namespace_id = session_storage_namespace_id_;
+  params.session_storage_namespace_id = session_storage_namespace_->id();
   params.frame_name = frame_name;
   Send(new ViewMsg_New(params));
 
diff --git a/chrome/browser/renderer_host/render_view_host.h b/chrome/browser/renderer_host/render_view_host.h
index b8d6af5..4d50fb8 100644
--- a/chrome/browser/renderer_host/render_view_host.h
+++ b/chrome/browser/renderer_host/render_view_host.h
@@ -29,6 +29,7 @@ class FilePath;
 class GURL;
 class ListValue;
 class RenderViewHostDelegate;
+class SessionStorageNamespace;
 class SiteInstance;
 class SkBitmap;
 class ViewMsg_Navigate;
@@ -98,11 +99,14 @@ class RenderViewHost : public RenderWidgetHost {
   static RenderViewHost* FromID(int render_process_id, int render_view_id);
 
   // routing_id could be a valid route id, or it could be MSG_ROUTING_NONE, in
-  // which case RenderWidgetHost will create a new one.
+  // which case RenderWidgetHost will create a new one. The session storage
+  // namespace parameter allows multiple render views to share the same session
+  // storage (part of the WebStorage spec) space. Passing in NULL simply
+  // allocates a new one (which is useful for testing).
   RenderViewHost(SiteInstance* instance,
                  RenderViewHostDelegate* delegate,
                  int routing_id,
-                 int64 session_storage_namespace_id);
+                 SessionStorageNamespace* session_storage_namespace);
   virtual ~RenderViewHost();
 
   SiteInstance* site_instance() const { return instance_; }
@@ -743,8 +747,8 @@ class RenderViewHost : public RenderWidgetHost {
   // True if the render view can be shut down suddenly.
   bool sudden_termination_allowed_;
 
-  // The session storage namespace id to be used by the associated render view.
-  int64 session_storage_namespace_id_;
+  // The session storage namespace to be used by the associated render view.
+  scoped_refptr<SessionStorageNamespace> session_storage_namespace_;
 
   // Whether this render view will get extension api bindings. This controls
   // what process type we use.
diff --git a/chrome/browser/renderer_host/render_view_host_factory.cc b/chrome/browser/renderer_host/render_view_host_factory.cc
index 4331f2d..070fdec 100644
--- a/chrome/browser/renderer_host/render_view_host_factory.cc
+++ b/chrome/browser/renderer_host/render_view_host_factory.cc
@@ -15,13 +15,13 @@ RenderViewHost* RenderViewHostFactory::Create(
     SiteInstance* instance,
     RenderViewHostDelegate* delegate,
     int routing_id,
-    int64 session_storage_namespace_id) {
+    SessionStorageNamespace* session_storage_namespace) {
   if (factory_) {
     return factory_->CreateRenderViewHost(instance, delegate, routing_id,
-                                          session_storage_namespace_id);
+                                          session_storage_namespace);
   }
   return new RenderViewHost(instance, delegate, routing_id,
-                            session_storage_namespace_id);
+                            session_storage_namespace);
 }
 
 // static
diff --git a/chrome/browser/renderer_host/render_view_host_factory.h b/chrome/browser/renderer_host/render_view_host_factory.h
index e228e67..1a5f5a9 100644
--- a/chrome/browser/renderer_host/render_view_host_factory.h
+++ b/chrome/browser/renderer_host/render_view_host_factory.h
@@ -10,6 +10,7 @@
 
 class RenderViewHost;
 class RenderViewHostDelegate;
+class SessionStorageNamespace;
 class SiteInstance;
 
 namespace base {
@@ -27,7 +28,7 @@ class RenderViewHostFactory {
   static RenderViewHost* Create(SiteInstance* instance,
                                 RenderViewHostDelegate* delegate,
                                 int routing_id,
-                                int64 session_storage_namespace_id);
+                                SessionStorageNamespace* session_storage);
 
   // Returns true if there is currently a globally-registered factory.
   static bool has_factory() {
@@ -44,7 +45,7 @@ class RenderViewHostFactory {
       SiteInstance* instance,
       RenderViewHostDelegate* delegate,
       int routing_id,
-      int64 session_storage_namespace_id) = 0;
+      SessionStorageNamespace* session_storage_namespace) = 0;
 
   // Registers your factory to be called when new RenderViewHosts are created.
   // We have only one global factory, so there must be no factory registered
diff --git a/chrome/browser/renderer_host/test/site_instance_unittest.cc b/chrome/browser/renderer_host/test/site_instance_unittest.cc
index f756d2e..c0cbfdb 100644
--- a/chrome/browser/renderer_host/test/site_instance_unittest.cc
+++ b/chrome/browser/renderer_host/test/site_instance_unittest.cc
@@ -119,7 +119,7 @@ TEST_F(SiteInstanceTest, SiteInstanceDestructor) {
                                                &siteDeleteCounter,
                                                &browsingDeleteCounter);
   {
-    TabContents contents(profile.get(), instance, MSG_ROUTING_NONE, NULL);
+    TabContents contents(profile.get(), instance, MSG_ROUTING_NONE, NULL, NULL);
     EXPECT_EQ(1, siteDeleteCounter);
     EXPECT_EQ(1, browsingDeleteCounter);
   }
diff --git a/chrome/browser/renderer_host/test/test_render_view_host.cc b/chrome/browser/renderer_host/test/test_render_view_host.cc
index bca21e1..70d6a9c 100644
--- a/chrome/browser/renderer_host/test/test_render_view_host.cc
+++ b/chrome/browser/renderer_host/test/test_render_view_host.cc
@@ -195,7 +195,7 @@ RenderViewHost* TestRenderViewHostFactory::CreateRenderViewHost(
     SiteInstance* instance,
     RenderViewHostDelegate* delegate,
     int routing_id,
-    int64 session_storage_namespace_id) {
+    SessionStorageNamespace* session_storage) {
   // See declaration of render_process_host_factory_ below.
   instance->set_render_process_host_factory(render_process_host_factory_);
   return new TestRenderViewHost(instance, delegate, routing_id);
diff --git a/chrome/browser/renderer_host/test/test_render_view_host.h b/chrome/browser/renderer_host/test/test_render_view_host.h
index 413ea96..30b7e29 100644
--- a/chrome/browser/renderer_host/test/test_render_view_host.h
+++ b/chrome/browser/renderer_host/test/test_render_view_host.h
@@ -217,7 +217,7 @@ class TestRenderViewHostFactory : public RenderViewHostFactory {
       SiteInstance* instance,
       RenderViewHostDelegate* delegate,
       int routing_id,
-      int64 session_storage_namespace_id);
+      SessionStorageNamespace* session_storage);
 
  private:
   // This is a bit of a hack. With the current design of the site instances /
diff --git a/chrome/browser/sessions/session_restore.cc b/chrome/browser/sessions/session_restore.cc
index 9a20e65..ab3b4a7 100644
--- a/chrome/browser/sessions/session_restore.cc
+++ b/chrome/browser/sessions/session_restore.cc
@@ -518,7 +518,8 @@ class SessionRestoreImpl : public NotificationObserver {
                                    tab.extension_app_id,
                                    false,
                                    tab.pinned,
-                                   true)->controller());
+                                   true,
+                                   NULL)->controller());
     }
   }
 
diff --git a/chrome/browser/sessions/tab_restore_service.cc b/chrome/browser/sessions/tab_restore_service.cc
index c62312a..23b7470 100644
--- a/chrome/browser/sessions/tab_restore_service.cc
+++ b/chrome/browser/sessions/tab_restore_service.cc
@@ -338,7 +338,8 @@ void TabRestoreService::RestoreEntryById(Browser* browser,
                                     tab.extension_app_id,
                                     (static_cast<int>(tab_i) ==
                                         window->selected_tab_index),
-                                    tab.pinned, tab.from_last_session);
+                                    tab.pinned, tab.from_last_session,
+                                    tab.session_storage_namespace);
         if (restored_tab)
           restored_tab->controller().LoadIfNecessary();
       }
@@ -476,6 +477,8 @@ void TabRestoreService::PopulateTab(Tab* tab,
   if (extension)
     tab->extension_app_id = extension->id();
 
+  tab->session_storage_namespace = controller->session_storage_namespace();
+
   // Browser may be NULL during unit tests.
   if (browser) {
     tab->browser_id = browser->session_id().id();
@@ -866,7 +869,8 @@ Browser* TabRestoreService::RestoreTab(const Tab& tab,
     browser->ReplaceRestoredTab(tab.navigations,
                                 tab.current_navigation_index,
                                 tab.from_last_session,
-                                tab.extension_app_id);
+                                tab.extension_app_id,
+                                tab.session_storage_namespace);
   } else {
     if (tab.has_browser())
       browser = BrowserList::FindBrowserWithID(tab.browser_id);
@@ -889,7 +893,8 @@ Browser* TabRestoreService::RestoreTab(const Tab& tab,
                             tab_index,
                             tab.current_navigation_index,
                             tab.extension_app_id,
-                            true, tab.pinned, tab.from_last_session);
+                            true, tab.pinned, tab.from_last_session,
+                            tab.session_storage_namespace);
   }
   return browser;
 }
diff --git a/chrome/browser/sessions/tab_restore_service.h b/chrome/browser/sessions/tab_restore_service.h
index 2f9a237..48c9dab 100644
--- a/chrome/browser/sessions/tab_restore_service.h
+++ b/chrome/browser/sessions/tab_restore_service.h
@@ -12,6 +12,7 @@
 
 #include "base/observer_list.h"
 #include "base/time.h"
+#include "chrome/browser/in_process_webkit/session_storage_namespace.h"
 #include "chrome/browser/sessions/base_session_service.h"
 #include "chrome/browser/sessions/session_id.h"
 #include "chrome/browser/sessions/session_types.h"
@@ -19,8 +20,8 @@
 class Browser;
 class NavigationController;
 class Profile;
-struct SessionWindow;
 class TabRestoreServiceObserver;
+struct SessionWindow;
 
 // TabRestoreService is responsible for maintaining the most recently closed
 // tabs and windows. When a tab is closed
@@ -94,6 +95,9 @@ class TabRestoreService : public BaseSessionService {
 
     // If non-empty gives the id of the extension for the tab.
     std::string extension_app_id;
+
+    // The associated session storage namespace (if any).
+    scoped_refptr<SessionStorageNamespace> session_storage_namespace;
   };
 
   // Represents a previously open window.
diff --git a/chrome/browser/sidebar/sidebar_container.cc b/chrome/browser/sidebar/sidebar_container.cc
index 73cac8d..aae917a 100644
--- a/chrome/browser/sidebar/sidebar_container.cc
+++ b/chrome/browser/sidebar/sidebar_container.cc
@@ -22,7 +22,7 @@ SidebarContainer::SidebarContainer(TabContents* tab,
       icon_(new SkBitmap) {
   // Create TabContents for sidebar.
   sidebar_contents_.reset(
-      new TabContents(tab->profile(), NULL, MSG_ROUTING_NONE, NULL));
+      new TabContents(tab->profile(), NULL, MSG_ROUTING_NONE, NULL, NULL));
   sidebar_contents_->render_view_host()->set_is_extension_process(true);
   sidebar_contents_->render_view_host()->AllowBindings(
       BindingsPolicy::EXTENSION);
diff --git a/chrome/browser/tab_contents/background_contents.cc b/chrome/browser/tab_contents/background_contents.cc
index da15fcc..ee459e1 100644
--- a/chrome/browser/tab_contents/background_contents.cc
+++ b/chrome/browser/tab_contents/background_contents.cc
@@ -6,8 +6,6 @@
 
 #include "chrome/browser/background_contents_service.h"
 #include "chrome/browser/browsing_instance.h"
-#include "chrome/browser/in_process_webkit/dom_storage_context.h"
-#include "chrome/browser/in_process_webkit/webkit_context.h"
 #include "chrome/browser/profile.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/site_instance.h"
@@ -28,10 +26,7 @@ BackgroundContents::BackgroundContents(SiteInstance* site_instance,
   Profile* profile = site_instance->browsing_instance()->profile();
 
   // TODO(rafaelw): Implement correct session storage.
-  int64 session_storage_namespace_id = profile->GetWebKitContext()->
-      dom_storage_context()->AllocateSessionStorageNamespaceId();
-  render_view_host_ = new RenderViewHost(site_instance, this, routing_id,
-                                         session_storage_namespace_id);
+  render_view_host_ = new RenderViewHost(site_instance, this, routing_id, NULL);
   render_view_host_->AllowScriptToClose(true);
 
   // Close ourselves when the application is shutting down.
diff --git a/chrome/browser/tab_contents/match_preview.cc b/chrome/browser/tab_contents/match_preview.cc
index 0b742db..709a582 100644
--- a/chrome/browser/tab_contents/match_preview.cc
+++ b/chrome/browser/tab_contents/match_preview.cc
@@ -166,7 +166,7 @@ void MatchPreview::Update(const GURL& url) {
 
   if (!preview_contents_.get()) {
     preview_contents_.reset(
-        new TabContents(host_->profile(), NULL, MSG_ROUTING_NONE, NULL));
+        new TabContents(host_->profile(), NULL, MSG_ROUTING_NONE, NULL, NULL));
     preview_contents_->set_delegate(delegate_.get());
     NotificationService::current()->Notify(
         NotificationType::MATCH_PREVIEW_TAB_CONTENTS_CREATED,
diff --git a/chrome/browser/tab_contents/navigation_controller.cc b/chrome/browser/tab_contents/navigation_controller.cc
index ce92c09..819bf6e 100644
--- a/chrome/browser/tab_contents/navigation_controller.cc
+++ b/chrome/browser/tab_contents/navigation_controller.cc
@@ -12,8 +12,7 @@
 #include "chrome/browser/browser_about_handler.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/browser_url_handler.h"
-#include "chrome/browser/in_process_webkit/dom_storage_context.h"
-#include "chrome/browser/in_process_webkit/webkit_context.h"
+#include "chrome/browser/in_process_webkit/session_storage_namespace.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profile.h"
 #include "chrome/browser/renderer_host/site_instance.h"
@@ -114,8 +113,10 @@ size_t NavigationController::max_entry_count_ =
 // static
 bool NavigationController::check_for_repost_ = true;
 
-NavigationController::NavigationController(TabContents* contents,
-                                           Profile* profile)
+NavigationController::NavigationController(
+    TabContents* contents,
+    Profile* profile,
+    SessionStorageNamespace* session_storage_namespace)
     : profile_(profile),
       pending_entry_(NULL),
       last_committed_entry_index_(-1),
@@ -125,10 +126,11 @@ NavigationController::NavigationController(TabContents* contents,
       max_restored_page_id_(-1),
       ALLOW_THIS_IN_INITIALIZER_LIST(ssl_manager_(this)),
       needs_reload_(false),
-      session_storage_namespace_id_(profile->GetWebKitContext()->
-          dom_storage_context()->AllocateSessionStorageNamespaceId()),
+      session_storage_namespace_(session_storage_namespace),
       pending_reload_(NO_RELOAD) {
   DCHECK(profile_);
+  if (!session_storage_namespace_)
+    session_storage_namespace_ = new SessionStorageNamespace(profile_);
 }
 
 NavigationController::~NavigationController() {
@@ -138,10 +140,6 @@ NavigationController::~NavigationController() {
       NotificationType::TAB_CLOSED,
       Source<NavigationController>(this),
       NotificationService::NoDetails());
-
-  // When we go away, the session storage namespace will no longer be reachable.
-  profile_->GetWebKitContext()->DeleteSessionStorageNamespace(
-      session_storage_namespace_id_);
 }
 
 void NavigationController::RestoreFromState(
@@ -947,9 +945,7 @@ void NavigationController::CopyStateFrom(const NavigationController& source) {
   needs_reload_ = true;
   InsertEntriesFrom(source, source.entry_count());
 
-  session_storage_namespace_id_ =
-      profile_->GetWebKitContext()->dom_storage_context()->CloneSessionStorage(
-          source.session_storage_namespace_id_);
+  session_storage_namespace_ = source.session_storage_namespace_->Clone();
 
   FinishRestore(source.last_committed_entry_index_, false);
 }
diff --git a/chrome/browser/tab_contents/navigation_controller.h b/chrome/browser/tab_contents/navigation_controller.h
index ed47492..be0be4b 100644
--- a/chrome/browser/tab_contents/navigation_controller.h
+++ b/chrome/browser/tab_contents/navigation_controller.h
@@ -21,6 +21,7 @@
 
 class NavigationEntry;
 class Profile;
+class SessionStorageNamespace;
 class SiteInstance;
 class TabContents;
 class TabNavigation;
@@ -137,7 +138,13 @@ class NavigationController {
 
   // ---------------------------------------------------------------------------
 
-  NavigationController(TabContents* tab_contents, Profile* profile);
+  // The session storage namespace parameter allows multiple render views and
+  // tab contentses to share the same session storage (part of the WebStorage
+  // spec) space. Passing in NULL simply allocates a new one which is often the
+  // correct thing to do (especially in tests.
+  NavigationController(TabContents* tab_contents,
+                       Profile* profile,
+                       SessionStorageNamespace* session_storage_namespace);
   ~NavigationController();
 
   // Returns the profile for this controller. It can never be NULL.
@@ -396,9 +403,9 @@ class NavigationController {
   // if it was restored from a previous session.  (-1 otherwise)
   int32 max_restored_page_id() const { return max_restored_page_id_; }
 
-  // The session storage namespace id that all child render views should use.
-  int64 session_storage_namespace_id() const {
-    return session_storage_namespace_id_;
+  // The session storage namespace that all child render views should use.
+  SessionStorageNamespace* session_storage_namespace() const {
+    return session_storage_namespace_;
   }
 
   // Disables checking for a repost and prompting the user. This is used during
@@ -583,7 +590,7 @@ class NavigationController {
   base::TimeTicks last_document_loaded_;
 
   // The session storage id that any (indirectly) owned RenderView should use.
-  int64 session_storage_namespace_id_;
+  scoped_refptr<SessionStorageNamespace> session_storage_namespace_;
 
   // Should Reload check for post data? The default is true, but is set to false
   // when testing.
diff --git a/chrome/browser/tab_contents/navigation_controller_unittest.cc b/chrome/browser/tab_contents/navigation_controller_unittest.cc
index 0794a38..da94be0 100644
--- a/chrome/browser/tab_contents/navigation_controller_unittest.cc
+++ b/chrome/browser/tab_contents/navigation_controller_unittest.cc
@@ -1328,7 +1328,7 @@ TEST_F(NavigationControllerTest, RestoreNavigate) {
   navigations.push_back(TabNavigation(0, url, GURL(),
                                       ASCIIToUTF16("Title"), "state",
                                       PageTransition::LINK));
-  TabContents our_contents(profile(), NULL, MSG_ROUTING_NONE, NULL);
+  TabContents our_contents(profile(), NULL, MSG_ROUTING_NONE, NULL, NULL);
   NavigationController& our_controller = our_contents.controller();
   our_controller.RestoreFromState(navigations, 0, true);
   our_controller.GoToIndex(0);
diff --git a/chrome/browser/tab_contents/render_view_host_delegate_helper.cc b/chrome/browser/tab_contents/render_view_host_delegate_helper.cc
index 0dddcc6..7a7f2d6 100644
--- a/chrome/browser/tab_contents/render_view_host_delegate_helper.cc
+++ b/chrome/browser/tab_contents/render_view_host_delegate_helper.cc
@@ -103,7 +103,8 @@ TabContents* RenderViewHostDelegateViewHelper::CreateNewWindow(
       new TabContents(profile,
                       site,
                       route_id,
-                      opener->GetAsTabContents());
+                      opener->GetAsTabContents(),
+                      NULL);
   new_contents->set_opener_dom_ui_type(domui_type);
   TabContentsView* new_view = new_contents->view();
 
diff --git a/chrome/browser/tab_contents/render_view_host_manager.cc b/chrome/browser/tab_contents/render_view_host_manager.cc
index d30b7d3..8883540 100644
--- a/chrome/browser/tab_contents/render_view_host_manager.cc
+++ b/chrome/browser/tab_contents/render_view_host_manager.cc
@@ -59,7 +59,7 @@ void RenderViewHostManager::Init(Profile* profile,
     site_instance = SiteInstance::CreateSiteInstance(profile);
   render_view_host_ = RenderViewHostFactory::Create(
       site_instance, render_view_delegate_, routing_id, delegate_->
-      GetControllerForRenderManager().session_storage_namespace_id());
+      GetControllerForRenderManager().session_storage_namespace());
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CREATED_FOR_TAB,
       Source<RenderViewHostManager>(this),
@@ -448,7 +448,7 @@ bool RenderViewHostManager::CreatePendingRenderView(
 
   pending_render_view_host_ = RenderViewHostFactory::Create(
       instance, render_view_delegate_, MSG_ROUTING_NONE, delegate_->
-      GetControllerForRenderManager().session_storage_namespace_id());
+      GetControllerForRenderManager().session_storage_namespace());
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CREATED_FOR_TAB,
       Source<RenderViewHostManager>(this),
diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index 14ad0fe..b5b4d49 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -50,6 +50,7 @@
 #include "chrome/browser/google/google_util.h"
 #include "chrome/browser/host_content_settings_map.h"
 #include "chrome/browser/hung_renderer_dialog.h"
+#include "chrome/browser/in_process_webkit/session_storage_namespace.h"
 #include "chrome/browser/message_box_handler.h"
 #include "chrome/browser/load_from_memory_cache_details.h"
 #include "chrome/browser/load_notification_details.h"
@@ -317,9 +318,11 @@ int TabContents::find_request_id_counter_ = -1;
 TabContents::TabContents(Profile* profile,
                          SiteInstance* site_instance,
                          int routing_id,
-                         const TabContents* base_tab_contents)
+                         const TabContents* base_tab_contents,
+                         SessionStorageNamespace* session_storage_namespace)
     : delegate_(NULL),
-      ALLOW_THIS_IN_INITIALIZER_LIST(controller_(this, profile)),
+      ALLOW_THIS_IN_INITIALIZER_LIST(controller_(
+          this, profile, session_storage_namespace)),
       ALLOW_THIS_IN_INITIALIZER_LIST(view_(
           TabContentsView::Create(this))),
       ALLOW_THIS_IN_INITIALIZER_LIST(render_manager_(this, this)),
@@ -929,7 +932,7 @@ TabContents* TabContents::Clone() {
   // processes for some reason.
   TabContents* tc = new TabContents(profile(),
                                     SiteInstance::CreateSiteInstance(profile()),
-                                    MSG_ROUTING_NONE, this);
+                                    MSG_ROUTING_NONE, this, NULL);
   tc->controller().CopyStateFrom(controller_);
   tc->extension_app_ = extension_app_;
   tc->extension_app_icon_ = extension_app_icon_;
@@ -1452,7 +1455,8 @@ TabContents* TabContents::CloneAndMakePhantom() {
   navigations.push_back(tab_nav);
 
   TabContents* new_contents =
-      new TabContents(profile(), NULL, MSG_ROUTING_NONE, NULL);
+      new TabContents(profile(), NULL, MSG_ROUTING_NONE, NULL,
+                      controller_.session_storage_namespace()->Clone());
   new_contents->SetExtensionApp(extension_app_);
   new_contents->controller().RestoreFromState(navigations, 0, false);
 
diff --git a/chrome/browser/tab_contents/tab_contents.h b/chrome/browser/tab_contents/tab_contents.h
index c0ed641..39596f3 100644
--- a/chrome/browser/tab_contents/tab_contents.h
+++ b/chrome/browser/tab_contents/tab_contents.h
@@ -79,6 +79,7 @@ class PluginInstaller;
 class Profile;
 struct RendererPreferences;
 class RenderViewHost;
+class SessionStorageNamespace;
 class SiteInstance;
 class SkBitmap;
 class TabContents;
@@ -119,10 +120,16 @@ class TabContents : public PageNavigator,
 
   // |base_tab_contents| is used if we want to size the new tab contents view
   // based on an existing tab contents view.  This can be NULL if not needed.
+  //
+  // The session storage namespace parameter allows multiple render views and
+  // tab contentses to share the same session storage (part of the WebStorage
+  // spec) space. Passing in NULL simply allocates a new one (which is useful
+  // for testing).
   TabContents(Profile* profile,
               SiteInstance* site_instance,
               int routing_id,
-              const TabContents* base_tab_contents);
+              const TabContents* base_tab_contents,
+              SessionStorageNamespace* session_storage_namespace);
   virtual ~TabContents();
 
   static void RegisterUserPrefs(PrefService* prefs);
diff --git a/chrome/browser/tab_contents/test_tab_contents.cc b/chrome/browser/tab_contents/test_tab_contents.cc
index 2c1ba39..ab6a325 100644
--- a/chrome/browser/tab_contents/test_tab_contents.cc
+++ b/chrome/browser/tab_contents/test_tab_contents.cc
@@ -13,7 +13,7 @@
 #include "chrome/common/notification_service.h"
 
 TestTabContents::TestTabContents(Profile* profile, SiteInstance* instance)
-    : TabContents(profile, instance, MSG_ROUTING_NONE, NULL),
+    : TabContents(profile, instance, MSG_ROUTING_NONE, NULL, NULL),
       transition_cross_site(false) {
   // Listen for infobar events so we can call InfoBarClosed() on the infobar
   // delegates and give them an opportunity to delete themselves.  (Since we
diff --git a/chrome/browser/tabs/tab_strip_model_unittest.cc b/chrome/browser/tabs/tab_strip_model_unittest.cc
index 557aadf..51924cf 100644
--- a/chrome/browser/tabs/tab_strip_model_unittest.cc
+++ b/chrome/browser/tabs/tab_strip_model_unittest.cc
@@ -104,13 +104,13 @@ class TabStripDummyDelegate : public TabStripModelDelegate {
 class TabStripModelTest : public RenderViewHostTestHarness {
  public:
   TabContents* CreateTabContents() {
-    return new TabContents(profile(), NULL, 0, NULL);
+    return new TabContents(profile(), NULL, 0, NULL, NULL);
   }
 
   TabContents* CreateTabContentsWithSharedRPH(TabContents* tab_contents) {
     TabContents* retval = new TabContents(profile(),
         tab_contents->render_view_host()->site_instance(), MSG_ROUTING_NONE,
-        NULL);
+        NULL, NULL);
     EXPECT_EQ(retval->GetRenderProcessHost(),
               tab_contents->GetRenderProcessHost());
     return retval;
@@ -1172,7 +1172,7 @@ TEST_F(TabStripModelTest, AddTabContents_ForgetOpeners) {
 
 // Added for http://b/issue?id=958960
 TEST_F(TabStripModelTest, AppendContentsReselectionTest) {
-  TabContents fake_destinations_tab(profile(), NULL, 0, NULL);
+  TabContents fake_destinations_tab(profile(), NULL, 0, NULL, NULL);
   TabStripDummyDelegate delegate(&fake_destinations_tab);
   TabStripModel tabstrip(&delegate, profile());
   EXPECT_TRUE(tabstrip.empty());
diff --git a/chrome/browser/views/dom_view.cc b/chrome/browser/views/dom_view.cc
index 9c42201..a4cc19a 100644
--- a/chrome/browser/views/dom_view.cc
+++ b/chrome/browser/views/dom_view.cc
@@ -31,7 +31,7 @@ bool DOMView::Init(Profile* profile, SiteInstance* instance) {
 
 TabContents* DOMView::CreateTabContents(Profile* profile,
                                         SiteInstance* instance) {
-  return new TabContents(profile, instance, MSG_ROUTING_NONE, NULL);
+  return new TabContents(profile, instance, MSG_ROUTING_NONE, NULL, NULL);
 }
 
 void DOMView::LoadURL(const GURL& url) {
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index 5d9f8f2..59c3060 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -1989,6 +1989,8 @@
         'browser/in_process_webkit/indexed_db_dispatcher_host.h',
         'browser/in_process_webkit/indexed_db_key_utility_client.cc',
         'browser/in_process_webkit/indexed_db_key_utility_client.h',
+        'browser/in_process_webkit/session_storage_namespace.cc',
+        'browser/in_process_webkit/session_storage_namespace.h',
         'browser/in_process_webkit/webkit_context.cc',
         'browser/in_process_webkit/webkit_context.h',
         'browser/in_process_webkit/webkit_thread.cc',