Implement proxy for FlashMenu and Run/QuitMessageLoop

BUG=none
TEST=Pepper Flash

Review URL: http://codereview.chromium.org/6432001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@74981 0039d316-1c4b-4281-b951-d872f2087c98

28 files changed, 656 insertions, 72 deletions

diff --git a/ppapi/c/dev/ppb_testing_dev.h b/ppapi/c/dev/ppb_testing_dev.h
index 30c004c1..0a6a6c9 100644
--- a/ppapi/c/dev/ppb_testing_dev.h
+++ b/ppapi/c/dev/ppb_testing_dev.h
@@ -12,7 +12,7 @@
 
 struct PP_Point;
 
-#define PPB_TESTING_DEV_INTERFACE "PPB_Testing(Dev);0.5"
+#define PPB_TESTING_DEV_INTERFACE "PPB_Testing(Dev);0.6"
 
 // This interface contains functions used for unit testing. Do not use in
 // production code. They are not guaranteed to be available in normal plugin
@@ -57,11 +57,11 @@ struct PPB_Testing_Dev {
   // callback, you save the data and call QuitMessageLoop, which will then
   // pop back up and continue with the test. This avoids having to write a
   // complicated state machine for simple tests for asynchronous APIs.
-  void (*RunMessageLoop)();
+  void (*RunMessageLoop)(PP_Instance instance);
 
   // Posts a quit message for the outermost nested message loop. Use this to
   // exit and return back to the caller after you call RunMessageLoop.
-  void (*QuitMessageLoop)();
+  void (*QuitMessageLoop)(PP_Instance instance);
 
   // Returns the number of live objects (resources + strings + objects)
   // associated with this plugin instance. Used for detecting leaks. Returns
diff --git a/ppapi/c/private/ppb_flash.h b/ppapi/c/private/ppb_flash.h
index 3f8f222..c2d41dd 100644
--- a/ppapi/c/private/ppb_flash.h
+++ b/ppapi/c/private/ppb_flash.h
@@ -19,7 +19,7 @@
 
 // PPB_Flash -------------------------------------------------------------------
 
-#define PPB_FLASH_INTERFACE "PPB_Flash;5"
+#define PPB_FLASH_INTERFACE "PPB_Flash;6"
 
 #ifdef _WIN32
 typedef HANDLE PP_FileHandle;
@@ -122,11 +122,11 @@ struct PPB_Flash {
   // message loop (e.g., when displaying context menus), but Pepper provides
   // only an asynchronous call. After performing that asynchronous call, call
   // |RunMessageLoop()|. In the callback, call |QuitMessageLoop()|.
-  void (*RunMessageLoop)();
+  void (*RunMessageLoop)(PP_Instance instance);
 
   // Posts a quit message for the outermost nested message loop. Use this to
   // exit and return back to the caller after you call RunMessageLoop.
-  void (*QuitMessageLoop)();
+  void (*QuitMessageLoop)(PP_Instance instance);
 };
 
 // PPB_Flash_NetConnector ------------------------------------------------------
diff --git a/ppapi/ppapi_shared_proxy.gypi b/ppapi/ppapi_shared_proxy.gypi
index 435763a..29f7a03 100644
--- a/ppapi/ppapi_shared_proxy.gypi
+++ b/ppapi/ppapi_shared_proxy.gypi
@@ -87,6 +87,8 @@
         'proxy/ppb_cursor_control_proxy.h',
         'proxy/ppb_flash_proxy.cc',
         'proxy/ppb_flash_proxy.h',
+        'proxy/ppb_flash_menu_proxy.cc',
+        'proxy/ppb_flash_menu_proxy.h',
         'proxy/ppb_font_proxy.cc',
         'proxy/ppb_font_proxy.h',
         'proxy/ppb_fullscreen_proxy.cc',
@@ -119,6 +121,8 @@
         'proxy/ppp_class_proxy.h',
         'proxy/ppp_instance_proxy.cc',
         'proxy/ppp_instance_proxy.h',
+        'proxy/serialized_flash_menu.cc',
+        'proxy/serialized_flash_menu.h',
         'proxy/serialized_structs.cc',
         'proxy/serialized_structs.h',
         'proxy/serialized_var.cc',
diff --git a/ppapi/proxy/dispatcher.cc b/ppapi/proxy/dispatcher.cc
index f3fbc06..4dc97f2 100644
--- a/ppapi/proxy/dispatcher.cc
+++ b/ppapi/proxy/dispatcher.cc
@@ -37,6 +37,7 @@
 #include "ppapi/c/ppb_url_response_info.h"
 #include "ppapi/c/ppp_instance.h"
 #include "ppapi/c/private/ppb_flash.h"
+#include "ppapi/c/private/ppb_flash_menu.h"
 #include "ppapi/c/private/ppb_pdf.h"
 #include "ppapi/c/trusted/ppb_url_loader_trusted.h"
 #include "ppapi/proxy/ppapi_messages.h"
@@ -48,6 +49,7 @@
 #include "ppapi/proxy/ppb_core_proxy.h"
 #include "ppapi/proxy/ppb_cursor_control_proxy.h"
 #include "ppapi/proxy/ppb_flash_proxy.h"
+#include "ppapi/proxy/ppb_flash_menu_proxy.h"
 #include "ppapi/proxy/ppb_font_proxy.h"
 #include "ppapi/proxy/ppb_fullscreen_proxy.h"
 #include "ppapi/proxy/ppb_gles_chromium_texture_mapping_proxy.h"
@@ -102,6 +104,7 @@ InterfaceList::InterfaceList() {
   AddPPB(PPB_Core_Proxy::GetInfo());
   AddPPB(PPB_CursorControl_Proxy::GetInfo());
   AddPPB(PPB_Flash_Proxy::GetInfo());
+  AddPPB(PPB_Flash_Menu_Proxy::GetInfo());
   AddPPB(PPB_Font_Proxy::GetInfo());
   AddPPB(PPB_Fullscreen_Proxy::GetInfo());
   AddPPB(PPB_GLESChromiumTextureMapping_Proxy::GetInfo());
diff --git a/ppapi/proxy/interface_id.h b/ppapi/proxy/interface_id.h
index 0cce6e9..4d38648 100644
--- a/ppapi/proxy/interface_id.h
+++ b/ppapi/proxy/interface_id.h
@@ -21,6 +21,7 @@ enum InterfaceID {
   INTERFACE_ID_PPB_CORE,
   INTERFACE_ID_PPB_CURSORCONTROL,
   INTERFACE_ID_PPB_FLASH,
+  INTERFACE_ID_PPB_FLASH_MENU,
   INTERFACE_ID_PPB_FONT,
   INTERFACE_ID_PPB_FULLSCREEN,
   INTERFACE_ID_PPB_GLES_CHROMIUM_TM,
diff --git a/ppapi/proxy/plugin_resource.h b/ppapi/proxy/plugin_resource.h
index 1113f6a..115fc66 100644
--- a/ppapi/proxy/plugin_resource.h
+++ b/ppapi/proxy/plugin_resource.h
@@ -17,6 +17,7 @@
   F(AudioConfig) \
   F(Buffer) \
   F(Context3D) \
+  F(FlashMenu) \
   F(Font) \
   F(Graphics2D) \
   F(ImageData) \
diff --git a/ppapi/proxy/ppapi_messages.h b/ppapi/proxy/ppapi_messages.h
index af2ebe8..d3c07dd 100644
--- a/ppapi/proxy/ppapi_messages.h
+++ b/ppapi/proxy/ppapi_messages.h
@@ -21,6 +21,7 @@
 #include "ppapi/c/pp_module.h"
 #include "ppapi/c/pp_resource.h"
 #include "ppapi/proxy/ppapi_param_traits.h"
+#include "ppapi/proxy/serialized_flash_menu.h"
 #include "ppapi/proxy/serialized_structs.h"
 
 #include "ppapi/proxy/ppapi_messages_internal.h"
diff --git a/ppapi/proxy/ppapi_messages_internal.h b/ppapi/proxy/ppapi_messages_internal.h
index 7cab708..f9e09a6 100644
--- a/ppapi/proxy/ppapi_messages_internal.h
+++ b/ppapi/proxy/ppapi_messages_internal.h
@@ -325,6 +325,24 @@ IPC_SYNC_MESSAGE_ROUTED3_1(PpapiHostMsg_PPBFlash_NavigateToURL,
                            std::string /* url */,
                            std::string /* target */,
                            PP_Bool /* result */)
+IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBFlash_RunMessageLoop,
+                           PP_Instance /* instance */)
+IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBFlash_QuitMessageLoop,
+                           PP_Instance /* instance */)
+
+// PPB_Flash_Menu
+IPC_SYNC_MESSAGE_ROUTED2_1(PpapiHostMsg_PPBFlashMenu_Create,
+                           PP_Instance /* instance */,
+                           pp::proxy::SerializedFlashMenu /* menu_data */,
+                           pp::proxy::HostResource /* result */)
+IPC_MESSAGE_ROUTED2(PpapiHostMsg_PPBFlashMenu_Show,
+                    pp::proxy::HostResource /* menu */,
+                    PP_Point /* location */)
+IPC_MESSAGE_ROUTED3(PpapiMsg_PPBFlashMenu_ShowACK,
+                    pp::proxy::HostResource /* menu */,
+                    int32_t /* selected_id */,
+                    int32_t /* result */)
+
 
 // PPB_Font.
 IPC_SYNC_MESSAGE_ROUTED2_3(
@@ -449,9 +467,10 @@ IPC_SYNC_MESSAGE_ROUTED3_1(
     pp::proxy::HostResource /* image */,
     PP_Point /* top_left */,
     PP_Bool /* result */)
-IPC_SYNC_MESSAGE_ROUTED0_1(PpapiHostMsg_PPBTesting_RunMessageLoop,
-                           bool /* dummy since there's no 0_0 variant */)
-IPC_MESSAGE_ROUTED0(PpapiHostMsg_PPBTesting_QuitMessageLoop)
+IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBTesting_RunMessageLoop,
+                           PP_Instance /* instance */)
+IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBTesting_QuitMessageLoop,
+                           PP_Instance /* instance */)
 IPC_SYNC_MESSAGE_ROUTED1_1(PpapiHostMsg_PPBTesting_GetLiveObjectsForInstance,
                            PP_Instance /* instance */,
                            uint32 /* result */)
diff --git a/ppapi/proxy/ppapi_param_traits.cc b/ppapi/proxy/ppapi_param_traits.cc
index c4f9aae..b3611f4 100644
--- a/ppapi/proxy/ppapi_param_traits.cc
+++ b/ppapi/proxy/ppapi_param_traits.cc
@@ -12,6 +12,7 @@
 #include "ppapi/proxy/interface_proxy.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/serialized_var.h"
+#include "ppapi/proxy/serialized_flash_menu.h"
 
 namespace IPC {
 
@@ -477,4 +478,24 @@ void ParamTraits< std::vector<pp::proxy::SerializedVar> >::Log(
     std::string* l) {
 }
 
+// SerializedFlashMenu ---------------------------------------------------------
+
+// static
+void ParamTraits<pp::proxy::SerializedFlashMenu>::Write(Message* m,
+                                                        const param_type& p) {
+  p.WriteToMessage(m);
+}
+
+// static
+bool ParamTraits<pp::proxy::SerializedFlashMenu>::Read(const Message* m,
+                                                       void** iter,
+                                                       param_type* r) {
+  return r->ReadFromMessage(m, iter);
+}
+
+// static
+void ParamTraits<pp::proxy::SerializedFlashMenu>::Log(const param_type& p,
+                                                      std::string* l) {
+}
+
 }  // namespace IPC
diff --git a/ppapi/proxy/ppapi_param_traits.h b/ppapi/proxy/ppapi_param_traits.h
index 017cd39..83b4342 100644
--- a/ppapi/proxy/ppapi_param_traits.h
+++ b/ppapi/proxy/ppapi_param_traits.h
@@ -14,16 +14,18 @@
 
 struct PP_FileInfo_Dev;
 struct PP_ObjectProperty;
+struct PP_Flash_Menu;
 
 namespace pp {
 namespace proxy {
 
+class HostResource;
 struct PPBFlash_DrawGlyphs_Params;
 struct PPBFont_DrawTextAt_Params;
 struct PPBURLLoader_UpdateProgress_Params;
 struct SerializedDirEntry;
 struct SerializedFontDescription;
-class HostResource;
+class SerializedFlashMenu;
 class SerializedVar;
 
 }  // namespace proxy
@@ -151,6 +153,14 @@ struct ParamTraits< std::vector<pp::proxy::SerializedVar> > {
   static void Log(const param_type& p, std::string* l);
 };
 
+template<>
+struct ParamTraits<pp::proxy::SerializedFlashMenu> {
+  typedef pp::proxy::SerializedFlashMenu param_type;
+  static void Write(Message* m, const param_type& p);
+  static bool Read(const Message* m, void** iter, param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
 }  // namespace IPC
 
 #endif  // PPAPI_PROXY_PPAPI_PARAM_TRAITS_H_
diff --git a/ppapi/proxy/ppb_flash_menu_proxy.cc b/ppapi/proxy/ppb_flash_menu_proxy.cc
new file mode 100644
index 0000000..1f37768
--- /dev/null
+++ b/ppapi/proxy/ppb_flash_menu_proxy.cc
@@ -0,0 +1,204 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/proxy/ppb_flash_menu_proxy.h"
+
+#include "ppapi/c/pp_errors.h"
+#include "ppapi/c/private/ppb_flash_menu.h"
+#include "ppapi/proxy/ppapi_messages.h"
+
+namespace pp {
+namespace proxy {
+
+class FlashMenu : public PluginResource {
+ public:
+  explicit FlashMenu(const HostResource& resource)
+      : PluginResource(resource),
+        callback_(PP_BlockUntilComplete()),
+        selected_id_ptr_(NULL) {
+  }
+
+  virtual ~FlashMenu() {}
+
+  // Resource overrides.
+  virtual FlashMenu* AsFlashMenu() { return this; }
+
+  int32_t* selected_id_ptr() const { return selected_id_ptr_; }
+  void set_selected_id_ptr(int32_t* ptr) { selected_id_ptr_ = ptr; }
+
+  PP_CompletionCallback callback() const { return callback_; }
+  void set_callback(PP_CompletionCallback cb) { callback_ = cb; }
+
+ private:
+  PP_CompletionCallback callback_;
+  int32_t* selected_id_ptr_;
+
+  DISALLOW_COPY_AND_ASSIGN(FlashMenu);
+};
+
+namespace {
+
+PP_Resource Create(PP_Instance instance_id, const PP_Flash_Menu* menu_data) {
+  PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance_id);
+  if (!dispatcher)
+    return 0;
+
+  HostResource result;
+  pp::proxy::SerializedFlashMenu serialized_menu;
+  if (!serialized_menu.SetPPMenu(menu_data))
+    return 0;
+
+  dispatcher->Send(new PpapiHostMsg_PPBFlashMenu_Create(
+      INTERFACE_ID_PPB_FLASH_MENU, instance_id, serialized_menu, &result));
+  if (result.is_null())
+    return 0;
+
+  linked_ptr<FlashMenu> menu(new FlashMenu(result));
+  return PluginResourceTracker::GetInstance()->AddResource(menu);
+}
+
+PP_Bool IsFlashMenu(PP_Resource resource) {
+  return BoolToPPBool(!!PluginResource::GetAs<FlashMenu>(resource));
+}
+
+int32_t Show(PP_Resource menu_id,
+             const PP_Point* location,
+             int32_t* selected_id,
+             PP_CompletionCallback callback) {
+  FlashMenu* object = PluginResource::GetAs<FlashMenu>(menu_id);
+  if (!object)
+    return PP_ERROR_BADRESOURCE;
+  PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(
+      object->instance());
+  if (!dispatcher)
+    return PP_ERROR_FAILED;
+
+  if (object->callback().func)
+    return PP_ERROR_INPROGRESS;
+
+  object->set_selected_id_ptr(selected_id);
+  object->set_callback(callback);
+
+  dispatcher->Send(new PpapiHostMsg_PPBFlashMenu_Show(
+      INTERFACE_ID_PPB_FLASH_MENU, object->host_resource(), *location));
+
+  return PP_ERROR_WOULDBLOCK;
+}
+
+const PPB_Flash_Menu flash_menu_interface = {
+  &Create,
+  &IsFlashMenu,
+  &Show,
+};
+
+InterfaceProxy* CreateFlashMenuProxy(Dispatcher* dispatcher,
+                                     const void* target_interface) {
+  return new PPB_Flash_Menu_Proxy(dispatcher, target_interface);
+}
+
+}  // namespace
+
+PPB_Flash_Menu_Proxy::PPB_Flash_Menu_Proxy(Dispatcher* dispatcher,
+                                           const void* target_interface)
+    : InterfaceProxy(dispatcher, target_interface),
+      callback_factory_(ALLOW_THIS_IN_INITIALIZER_LIST(this)) {
+}
+
+PPB_Flash_Menu_Proxy::~PPB_Flash_Menu_Proxy() {
+}
+
+const InterfaceProxy::Info* PPB_Flash_Menu_Proxy::GetInfo() {
+  static const Info info = {
+    &flash_menu_interface,
+    PPB_FLASH_MENU_INTERFACE,
+    INTERFACE_ID_PPB_FLASH_MENU,
+    true,
+    &CreateFlashMenuProxy,
+  };
+  return &info;
+}
+
+bool PPB_Flash_Menu_Proxy::OnMessageReceived(const IPC::Message& msg) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(PPB_Flash_Menu_Proxy, msg)
+    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlashMenu_Create,
+                        OnMsgCreate)
+    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlashMenu_Show,
+                        OnMsgShow)
+
+    IPC_MESSAGE_HANDLER(PpapiMsg_PPBFlashMenu_ShowACK,
+                        OnMsgShowACK)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  // FIXME(brettw) handle bad messages!
+  return handled;
+}
+
+void PPB_Flash_Menu_Proxy::OnMsgCreate(PP_Instance instance_id,
+                                       const SerializedFlashMenu& menu_data,
+                                       HostResource* result) {
+  PP_Resource resource = ppb_flash_menu_target()->Create(instance_id,
+                                                         menu_data.pp_menu());
+  result->SetHostResource(instance_id, resource);
+}
+
+struct PPB_Flash_Menu_Proxy::ShowRequest {
+  HostResource menu;
+  int32_t selected_id;
+};
+
+void PPB_Flash_Menu_Proxy::OnMsgShow(const HostResource& menu,
+                                     const PP_Point& location) {
+  ShowRequest* request = new ShowRequest;
+  request->menu = menu;
+  CompletionCallback callback = callback_factory_.NewCallback(
+      &PPB_Flash_Menu_Proxy::SendShowACKToPlugin, request);
+  int32_t result = ppb_flash_menu_target()->Show(
+      menu.host_resource(),
+      &location,
+      &request->selected_id,
+      callback.pp_completion_callback());
+  if (result != PP_ERROR_WOULDBLOCK) {
+    // There was some error, so we won't get a callback. We need to now issue
+    // the ACK to the plugin so that it hears about the error. This will also
+    // clean up the data associated with the callback.
+    callback.Run(result);
+  }
+}
+
+void PPB_Flash_Menu_Proxy::OnMsgShowACK(const HostResource& menu,
+                                        int32_t selected_id,
+                                        int32_t result) {
+  PP_Resource plugin_resource =
+      PluginResourceTracker::GetInstance()->PluginResourceForHostResource(menu);
+  if (!plugin_resource)
+    return;
+  FlashMenu* object = PluginResource::GetAs<FlashMenu>(plugin_resource);
+  if (!object) {
+    // The plugin has released the FlashMenu object so don't issue the
+    // callback.
+    return;
+  }
+
+  // Be careful to make the callback NULL before issuing the callback since the
+  // plugin might want to show the menu again from within the callback.
+  PP_CompletionCallback callback = object->callback();
+  object->set_callback(PP_BlockUntilComplete());
+  *(object->selected_id_ptr()) = selected_id;
+  PP_RunCompletionCallback(&callback, result);
+}
+
+void PPB_Flash_Menu_Proxy::SendShowACKToPlugin(
+    int32_t result,
+    ShowRequest* request) {
+  dispatcher()->Send(new PpapiMsg_PPBFlashMenu_ShowACK(
+      INTERFACE_ID_PPB_FLASH_MENU,
+      request->menu,
+      request->selected_id,
+      result));
+  delete request;
+}
+
+}  // namespace proxy
+}  // namespace pp
diff --git a/ppapi/proxy/ppb_flash_menu_proxy.h b/ppapi/proxy/ppb_flash_menu_proxy.h
new file mode 100644
index 0000000..1684bac
--- /dev/null
+++ b/ppapi/proxy/ppb_flash_menu_proxy.h
@@ -0,0 +1,55 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_PPB_FLASH_MENU_PROXY_H_
+#define PPAPI_PPB_FLASH_MENU_PROXY_H_
+
+#include "ppapi/proxy/interface_proxy.h"
+#include "ppapi/proxy/plugin_resource.h"
+#include "ppapi/proxy/proxy_non_thread_safe_ref_count.h"
+
+struct PP_Flash_Menu;
+struct PP_Point;
+struct PPB_Flash_Menu;
+
+namespace pp {
+namespace proxy {
+
+class SerializedFlashMenu;
+
+class PPB_Flash_Menu_Proxy : public InterfaceProxy {
+ public:
+  PPB_Flash_Menu_Proxy(Dispatcher* dispatcher, const void* target_interface);
+  virtual ~PPB_Flash_Menu_Proxy();
+
+  static const Info* GetInfo();
+
+  const PPB_Flash_Menu* ppb_flash_menu_target() const {
+    return static_cast<const PPB_Flash_Menu*>(target_interface());
+  }
+
+  // InterfaceProxy implementation.
+  virtual bool OnMessageReceived(const IPC::Message& msg);
+
+ private:
+  struct ShowRequest;
+
+  void OnMsgCreate(PP_Instance instance_id,
+                   const SerializedFlashMenu& menu_data,
+                   HostResource* resource);
+  void OnMsgShow(const HostResource& menu,
+                 const PP_Point& location);
+  void OnMsgShowACK(const HostResource& menu,
+                    int32_t selected_id,
+                    int32_t result);
+  void SendShowACKToPlugin(int32_t result, ShowRequest* request);
+
+  CompletionCallbackFactory<PPB_Flash_Menu_Proxy,
+                            ProxyNonThreadSafeRefCount> callback_factory_;
+};
+
+}  // namespace proxy
+}  // namespace pp
+
+#endif  // PPAPI_PPB_FLASH_MENU_PROXY_H_
diff --git a/ppapi/proxy/ppb_flash_proxy.cc b/ppapi/proxy/ppb_flash_proxy.cc
index 7b2e778..e1101f2 100644
--- a/ppapi/proxy/ppb_flash_proxy.cc
+++ b/ppapi/proxy/ppb_flash_proxy.cc
@@ -5,6 +5,7 @@
 #include "ppapi/proxy/ppb_flash_proxy.h"
 
 #include "base/logging.h"
+#include "base/message_loop.h"
 #include "build/build_config.h"
 #include "ppapi/c/dev/pp_file_info_dev.h"
 #include "ppapi/c/dev/ppb_font_dev.h"
@@ -235,6 +236,24 @@ PP_Bool NavigateToURL(PP_Instance instance,
   return result;
 }
 
+void RunMessageLoop(PP_Instance instance) {
+  PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
+  if (!dispatcher)
+    return;
+  IPC::SyncMessage* msg = new PpapiHostMsg_PPBFlash_RunMessageLoop(
+        INTERFACE_ID_PPB_FLASH, instance);
+  msg->EnableMessagePumping();
+  dispatcher->Send(msg);
+}
+
+void QuitMessageLoop(PP_Instance instance) {
+  PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
+  if (!dispatcher)
+    return;
+  dispatcher->Send(new PpapiHostMsg_PPBFlash_QuitMessageLoop(
+        INTERFACE_ID_PPB_FLASH, instance));
+}
+
 const PPB_Flash flash_interface = {
   &SetInstanceAlwaysOnTop,
   &DrawGlyphs,
@@ -247,6 +266,8 @@ const PPB_Flash flash_interface = {
   &GetModuleLocalDirContents,
   &FreeModuleLocalDirContents,
   &NavigateToURL,
+  &RunMessageLoop,
+  &QuitMessageLoop,
 };
 
 InterfaceProxy* CreateFlashProxy(Dispatcher* dispatcher,
@@ -298,6 +319,10 @@ bool PPB_Flash_Proxy::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_GetModuleLocalDirContents,
                         OnMsgGetModuleLocalDirContents)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_NavigateToURL, OnMsgNavigateToURL)
+    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_RunMessageLoop,
+                        OnMsgRunMessageLoop)
+    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_QuitMessageLoop,
+                        OnMsgQuitMessageLoop)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   // TODO(brettw) handle bad messages!
@@ -414,5 +439,13 @@ void PPB_Flash_Proxy::OnMsgNavigateToURL(PP_Instance instance,
                                               target.c_str());
 }
 
+void PPB_Flash_Proxy::OnMsgRunMessageLoop(PP_Instance instance) {
+  ppb_flash_target()->RunMessageLoop(instance);
+}
+
+void PPB_Flash_Proxy::OnMsgQuitMessageLoop(PP_Instance instance) {
+  ppb_flash_target()->QuitMessageLoop(instance);
+}
+
 }  // namespace proxy
 }  // namespace pp
diff --git a/ppapi/proxy/ppb_flash_proxy.h b/ppapi/proxy/ppb_flash_proxy.h
index 1d66a68..67cf418 100644
--- a/ppapi/proxy/ppb_flash_proxy.h
+++ b/ppapi/proxy/ppb_flash_proxy.h
@@ -75,6 +75,8 @@ class PPB_Flash_Proxy : public InterfaceProxy {
                           const std::string& url,
                           const std::string& target,
                           PP_Bool* result);
+  void OnMsgRunMessageLoop(PP_Instance instance);
+  void OnMsgQuitMessageLoop(PP_Instance instance);
 };
 
 }  // namespace proxy
diff --git a/ppapi/proxy/ppb_testing_proxy.cc b/ppapi/proxy/ppb_testing_proxy.cc
index ca15151..593ed7d 100644
--- a/ppapi/proxy/ppb_testing_proxy.cc
+++ b/ppapi/proxy/ppb_testing_proxy.cc
@@ -41,15 +41,22 @@ PP_Bool ReadImageData(PP_Resource graphics_2d,
   return result;
 }
 
-void RunMessageLoop() {
-  bool old_state = MessageLoop::current()->NestableTasksAllowed();
-  MessageLoop::current()->SetNestableTasksAllowed(true);
-  MessageLoop::current()->Run();
-  MessageLoop::current()->SetNestableTasksAllowed(old_state);
+void RunMessageLoop(PP_Instance instance) {
+  PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
+  if (!dispatcher)
+    return;
+  IPC::SyncMessage* msg = new PpapiHostMsg_PPBTesting_RunMessageLoop(
+        INTERFACE_ID_PPB_TESTING, instance);
+  msg->EnableMessagePumping();
+  dispatcher->Send(msg);
 }
 
-void QuitMessageLoop() {
-  MessageLoop::current()->QuitNow();
+void QuitMessageLoop(PP_Instance instance) {
+  PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
+  if (!dispatcher)
+    return;
+  dispatcher->Send(new PpapiHostMsg_PPBTesting_QuitMessageLoop(
+        INTERFACE_ID_PPB_TESTING, instance));
 }
 
 uint32_t GetLiveObjectsForInstance(PP_Instance instance_id) {
@@ -122,13 +129,12 @@ void PPB_Testing_Proxy::OnMsgReadImageData(
       device_context_2d.host_resource(), image.host_resource(), &top_left);
 }
 
-void PPB_Testing_Proxy::OnMsgRunMessageLoop(bool* dummy) {
-  ppb_testing_target()->RunMessageLoop();
-  *dummy = false;
+void PPB_Testing_Proxy::OnMsgRunMessageLoop(PP_Instance instance) {
+  ppb_testing_target()->RunMessageLoop(instance);
 }
 
-void PPB_Testing_Proxy::OnMsgQuitMessageLoop() {
-  ppb_testing_target()->QuitMessageLoop();
+void PPB_Testing_Proxy::OnMsgQuitMessageLoop(PP_Instance instance) {
+  ppb_testing_target()->QuitMessageLoop(instance);
 }
 
 void PPB_Testing_Proxy::OnMsgGetLiveObjectsForInstance(PP_Instance instance,
diff --git a/ppapi/proxy/ppb_testing_proxy.h b/ppapi/proxy/ppb_testing_proxy.h
index ed938f1..352a2ae 100644
--- a/ppapi/proxy/ppb_testing_proxy.h
+++ b/ppapi/proxy/ppb_testing_proxy.h
@@ -37,8 +37,8 @@ class PPB_Testing_Proxy : public InterfaceProxy {
                           const HostResource& image,
                           const PP_Point& top_left,
                           PP_Bool* result);
-  void OnMsgRunMessageLoop(bool* dummy);
-  void OnMsgQuitMessageLoop();
+  void OnMsgRunMessageLoop(PP_Instance instance);
+  void OnMsgQuitMessageLoop(PP_Instance instance);
   void OnMsgGetLiveObjectsForInstance(PP_Instance instance, uint32_t* result);
 
   DISALLOW_COPY_AND_ASSIGN(PPB_Testing_Proxy);
diff --git a/ppapi/proxy/serialized_flash_menu.cc b/ppapi/proxy/serialized_flash_menu.cc
new file mode 100644
index 0000000..c7ef5ab
--- /dev/null
+++ b/ppapi/proxy/serialized_flash_menu.cc
@@ -0,0 +1,172 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/proxy/serialized_flash_menu.h"
+
+#include "ipc/ipc_message.h"
+#include "ppapi/c/private/ppb_flash_menu.h"
+#include "ppapi/proxy/ppapi_param_traits.h"
+
+namespace pp {
+namespace proxy {
+
+namespace {
+// Maximum depth of submenus allowed (e.g., 1 indicates that submenus are
+// allowed, but not sub-submenus).
+const int kMaxMenuDepth = 2;
+
+bool CheckMenu(int depth, const PP_Flash_Menu* menu);
+void FreeMenu(const PP_Flash_Menu* menu);
+void WriteMenu(IPC::Message* m, const PP_Flash_Menu* menu);
+PP_Flash_Menu* ReadMenu(int depth, const IPC::Message* m, void** iter);
+
+bool CheckMenuItem(int depth, const PP_Flash_MenuItem* item) {
+  if (item->type == PP_FLASH_MENUITEM_TYPE_SUBMENU)
+    return CheckMenu(depth, item->submenu);
+  return true;
+}
+
+bool CheckMenu(int depth, const PP_Flash_Menu* menu) {
+  if (depth > kMaxMenuDepth || !menu)
+    return false;
+  ++depth;
+
+  if (menu->count && !menu->items)
+    return false;
+
+  for (uint32_t i = 0; i < menu->count; ++i) {
+    if (!CheckMenuItem(depth, menu->items + i))
+      return false;
+  }
+  return true;
+}
+
+void WriteMenuItem(IPC::Message* m, const PP_Flash_MenuItem* menu_item) {
+  PP_Flash_MenuItem_Type type = menu_item->type;
+  m->WriteUInt32(type);
+  m->WriteString(menu_item->name ? menu_item->name : "");
+  m->WriteInt(menu_item->id);
+  IPC::ParamTraits<PP_Bool>::Write(m, menu_item->enabled);
+  IPC::ParamTraits<PP_Bool>::Write(m, menu_item->checked);
+  if (type == PP_FLASH_MENUITEM_TYPE_SUBMENU)
+    WriteMenu(m, menu_item->submenu);
+}
+
+void WriteMenu(IPC::Message* m, const PP_Flash_Menu* menu) {
+  m->WriteUInt32(menu->count);
+  for (uint32_t i = 0; i < menu->count; ++i)
+    WriteMenuItem(m, menu->items + i);
+}
+
+void FreeMenuItem(const PP_Flash_MenuItem* menu_item) {
+  if (menu_item->name)
+    delete [] menu_item->name;
+  if (menu_item->submenu)
+    FreeMenu(menu_item->submenu);
+}
+
+void FreeMenu(const PP_Flash_Menu* menu) {
+  if (menu->items) {
+    for (uint32_t i = 0; i < menu->count; ++i)
+      FreeMenuItem(menu->items + i);
+    delete [] menu->items;
+  }
+  delete menu;
+}
+
+bool ReadMenuItem(int depth,
+                  const IPC::Message* m,
+                  void** iter,
+                  PP_Flash_MenuItem* menu_item) {
+  uint32_t type;
+  if (!m->ReadUInt32(iter, &type))
+    return false;
+  if (type > PP_FLASH_MENUITEM_TYPE_SUBMENU)
+    return false;
+  menu_item->type = static_cast<PP_Flash_MenuItem_Type>(type);
+  std::string name;
+  if (!m->ReadString(iter, &name))
+    return false;
+  menu_item->name = new char[name.size() + 1];
+  std::copy(name.begin(), name.end(), menu_item->name);
+  menu_item->name[name.size()] = 0;
+  if (!m->ReadInt(iter, &menu_item->id))
+    return false;
+  if (!IPC::ParamTraits<PP_Bool>::Read(m, iter, &menu_item->enabled))
+    return false;
+  if (!IPC::ParamTraits<PP_Bool>::Read(m, iter, &menu_item->checked))
+    return false;
+  if (type == PP_FLASH_MENUITEM_TYPE_SUBMENU) {
+    menu_item->submenu = ReadMenu(depth, m, iter);
+    if (!menu_item->submenu)
+      return false;
+  }
+  return true;
+}
+
+PP_Flash_Menu* ReadMenu(int depth, const IPC::Message* m, void** iter) {
+  if (depth > kMaxMenuDepth)
+    return NULL;
+  ++depth;
+
+  PP_Flash_Menu* menu = new PP_Flash_Menu;
+  menu->items = NULL;
+
+  if (!m->ReadUInt32(iter, &menu->count)) {
+    FreeMenu(menu);
+    return NULL;
+  }
+
+  if (menu->count == 0)
+    return menu;
+
+  menu->items = new PP_Flash_MenuItem[menu->count];
+  memset(menu->items, 0, sizeof(PP_Flash_MenuItem) * menu->count);
+  for (uint32_t i = 0; i < menu->count; ++i) {
+    if (!ReadMenuItem(depth, m, iter, menu->items + i)) {
+      FreeMenu(menu);
+      return NULL;
+    }
+  }
+  return menu;
+}
+
+}  // anonymous namespace
+
+SerializedFlashMenu::SerializedFlashMenu()
+    : pp_menu_(NULL),
+      own_menu_(false) {
+}
+
+SerializedFlashMenu::~SerializedFlashMenu() {
+  if (own_menu_)
+    FreeMenu(pp_menu_);
+}
+
+bool SerializedFlashMenu::SetPPMenu(const PP_Flash_Menu* menu) {
+  DCHECK(!pp_menu_);
+  if (!CheckMenu(0, menu))
+    return false;
+  pp_menu_ = menu;
+  own_menu_ = false;
+  return true;
+}
+
+
+void SerializedFlashMenu::WriteToMessage(IPC::Message* m) const {
+  WriteMenu(m, pp_menu_);
+}
+
+bool SerializedFlashMenu::ReadFromMessage(const IPC::Message* m, void** iter) {
+  DCHECK(!pp_menu_);
+  pp_menu_ = ReadMenu(0, m, iter);
+  if (!pp_menu_)
+    return false;
+
+  own_menu_ = true;
+  return true;
+}
+
+}  // namespace proxy
+}  // namespace pp
diff --git a/ppapi/proxy/serialized_flash_menu.h b/ppapi/proxy/serialized_flash_menu.h
new file mode 100644
index 0000000..fb72922
--- /dev/null
+++ b/ppapi/proxy/serialized_flash_menu.h
@@ -0,0 +1,44 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_PROXY_SERIALIZED_FLASH_MENU_H_
+#define PPAPI_PROXY_SERIALIZED_FLASH_MENU_H_
+
+#include <string>
+#include <vector>
+
+#include "base/basictypes.h"
+#include "base/scoped_ptr.h"
+
+struct PP_Flash_Menu;
+
+namespace IPC {
+class Message;
+}
+
+namespace pp {
+namespace proxy {
+
+class SerializedFlashMenu {
+ public:
+  SerializedFlashMenu();
+  ~SerializedFlashMenu();
+
+  bool SetPPMenu(const PP_Flash_Menu* menu);
+
+  const PP_Flash_Menu* pp_menu() const { return pp_menu_; }
+
+  void WriteToMessage(IPC::Message* m) const;
+  bool ReadFromMessage(const IPC::Message* m, void** iter);
+
+ private:
+  const PP_Flash_Menu* pp_menu_;
+  bool own_menu_;
+  DISALLOW_COPY_AND_ASSIGN(SerializedFlashMenu);
+};
+
+}  // namespace proxy
+}  // namespace pp
+
+#endif  // PPAPI_PROXY_SERIALIZED_FLASH_MENU_H_
diff --git a/ppapi/tests/test_directory_reader.cc b/ppapi/tests/test_directory_reader.cc
index 3ae83f3..45e9a99 100644
--- a/ppapi/tests/test_directory_reader.cc
+++ b/ppapi/tests/test_directory_reader.cc
@@ -40,7 +40,7 @@ void TestDirectoryReader::RunTest() {
 }
 
 std::string TestDirectoryReader::TestGetNextFile() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   pp::FileSystem_Dev file_system(
       instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   int32_t rv = file_system.Open(1024, callback);
diff --git a/ppapi/tests/test_file_io.cc b/ppapi/tests/test_file_io.cc
index ec0172c..4a7278f 100644
--- a/ppapi/tests/test_file_io.cc
+++ b/ppapi/tests/test_file_io.cc
@@ -29,10 +29,11 @@ std::string ReportMismatch(const std::string& method_name,
       expected_result + "' expected.";
 }
 
-int32_t ReadEntireFile(pp::FileIO_Dev* file_io,
+int32_t ReadEntireFile(PP_Instance instance,
+                       pp::FileIO_Dev* file_io,
                        int32_t offset,
                        std::string* data) {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance);
   char buf[256];
   int32_t read_offset = offset;
 
@@ -51,10 +52,11 @@ int32_t ReadEntireFile(pp::FileIO_Dev* file_io,
   return PP_OK;
 }
 
-int32_t WriteEntireBuffer(pp::FileIO_Dev* file_io,
+int32_t WriteEntireBuffer(PP_Instance instance,
+                          pp::FileIO_Dev* file_io,
                           int32_t offset,
                           const std::string& data) {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance);
   int32_t write_offset = offset;
   const char* buf = data.c_str();
   int32_t size = data.size();
@@ -91,7 +93,7 @@ void TestFileIO::RunTest() {
 }
 
 std::string TestFileIO::TestOpen() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   pp::FileRef_Dev file_ref(file_system, "/file_open");
@@ -122,7 +124,7 @@ std::string TestFileIO::TestOpen() {
 }
 
 std::string TestFileIO::TestReadWriteSetLength() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   pp::FileRef_Dev file_ref(file_system, "/file_read_write_setlength");
@@ -144,13 +146,13 @@ std::string TestFileIO::TestReadWriteSetLength() {
     return ReportError("FileIO::Open", rv);
 
   // Write something to the file.
-  rv = WriteEntireBuffer(&file_io, 0, "test_test");
+  rv = WriteEntireBuffer(instance_->pp_instance(), &file_io, 0, "test_test");
   if (rv != PP_OK)
     return ReportError("FileIO::Write", rv);
 
   // Read the entire file.
   std::string read_buffer;
-  rv = ReadEntireFile(&file_io, 0, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 0, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (read_buffer != "test_test")
@@ -165,7 +167,7 @@ std::string TestFileIO::TestReadWriteSetLength() {
 
   // Check the file contents.
   read_buffer.clear();
-  rv = ReadEntireFile(&file_io, 0, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 0, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (read_buffer != "test")
@@ -173,20 +175,20 @@ std::string TestFileIO::TestReadWriteSetLength() {
 
   // Try to read past the end of the file.
   read_buffer.clear();
-  rv = ReadEntireFile(&file_io, 100, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 100, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (!read_buffer.empty())
     return ReportMismatch("FileIO::Read", read_buffer, "<empty string>");
 
   // Write past the end of the file. The file should be zero-padded.
-  rv = WriteEntireBuffer(&file_io, 8, "test");
+  rv = WriteEntireBuffer(instance_->pp_instance(), &file_io, 8, "test");
   if (rv != PP_OK)
     return ReportError("FileIO::Write", rv);
 
   // Check the contents of the file.
   read_buffer.clear();
-  rv = ReadEntireFile(&file_io, 0, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 0, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (read_buffer != std::string("test\0\0\0\0test", 12))
@@ -202,7 +204,7 @@ std::string TestFileIO::TestReadWriteSetLength() {
 
   // Check the contents of the file.
   read_buffer.clear();
-  rv = ReadEntireFile(&file_io, 0, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 0, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (read_buffer != std::string("test\0\0\0\0test\0\0\0\0", 16))
@@ -210,13 +212,13 @@ std::string TestFileIO::TestReadWriteSetLength() {
                           std::string("test\0\0\0\0test\0\0\0\0", 16));
 
   // Write in the middle of the file.
-  rv = WriteEntireBuffer(&file_io, 4, "test");
+  rv = WriteEntireBuffer(instance_->pp_instance(), &file_io, 4, "test");
   if (rv != PP_OK)
     return ReportError("FileIO::Write", rv);
 
   // Check the contents of the file.
   read_buffer.clear();
-  rv = ReadEntireFile(&file_io, 0, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 0, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (read_buffer != std::string("testtesttest\0\0\0\0", 16))
@@ -225,7 +227,7 @@ std::string TestFileIO::TestReadWriteSetLength() {
 
   // Read from the middle of the file.
   read_buffer.clear();
-  rv = ReadEntireFile(&file_io, 4, &read_buffer);
+  rv = ReadEntireFile(instance_->pp_instance(), &file_io, 4, &read_buffer);
   if (rv != PP_OK)
     return ReportError("FileIO::Read", rv);
   if (read_buffer != std::string("testtest\0\0\0\0", 12))
@@ -236,7 +238,7 @@ std::string TestFileIO::TestReadWriteSetLength() {
 }
 
 std::string TestFileIO::TestTouchQuery() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   int32_t rv = file_system.Open(1024, callback);
@@ -297,7 +299,7 @@ std::string TestFileIO::TestTouchQuery() {
 }
 
 std::string TestFileIO::TestAbortCalls() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   pp::FileRef_Dev file_ref(file_system, "/file_abort_calls");
@@ -319,7 +321,10 @@ std::string TestFileIO::TestAbortCalls() {
       return ReportError("FileIO::Open", rv);
 
     // N.B.: Should write at least 3 bytes.
-    rv = WriteEntireBuffer(&file_io, 0, "foobarbazquux");
+    rv = WriteEntireBuffer(instance_->pp_instance(),
+                           &file_io,
+                           0,
+                           "foobarbazquux");
     if (rv != PP_OK)
       return ReportError("FileIO::Write", rv);
   }
diff --git a/ppapi/tests/test_file_ref.cc b/ppapi/tests/test_file_ref.cc
index d3f137a..c336548 100644
--- a/ppapi/tests/test_file_ref.cc
+++ b/ppapi/tests/test_file_ref.cc
@@ -72,7 +72,7 @@ std::string TestFileRef::TestGetFileSystemType() {
   request.SetURL("test_url_loader_data/hello.txt");
   request.SetStreamToFile(true);
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(instance_);
   int32_t rv = loader.Open(request, callback);
@@ -121,7 +121,7 @@ std::string TestFileRef::TestGetName() {
   request.SetURL("test_url_loader_data/hello.txt");
   request.SetStreamToFile(true);
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(instance_);
   int32_t rv = loader.Open(request, callback);
@@ -165,7 +165,7 @@ std::string TestFileRef::TestGetPath() {
   request.SetURL("test_url_loader_data/hello.txt");
   request.SetStreamToFile(true);
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(instance_);
   int32_t rv = loader.Open(request, callback);
@@ -220,7 +220,7 @@ std::string TestFileRef::TestGetParent() {
   request.SetURL("test_url_loader_data/hello.txt");
   request.SetStreamToFile(true);
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(instance_);
   int32_t rv = loader.Open(request, callback);
@@ -244,7 +244,7 @@ std::string TestFileRef::TestGetParent() {
 }
 
 std::string TestFileRef::TestMakeDirectory() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   // Open.
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
@@ -328,7 +328,7 @@ std::string TestFileRef::TestMakeDirectory() {
 }
 
 std::string TestFileRef::TestQueryAndTouchFile() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   int32_t rv = file_system.Open(1024, callback);
   if (rv == PP_ERROR_WOULDBLOCK)
@@ -412,7 +412,7 @@ std::string TestFileRef::TestQueryAndTouchFile() {
 }
 
 std::string TestFileRef::TestDeleteFileAndDirectory() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   int32_t rv = file_system.Open(1024, callback);
   if (rv == PP_ERROR_WOULDBLOCK)
@@ -496,7 +496,7 @@ std::string TestFileRef::TestDeleteFileAndDirectory() {
 }
 
 std::string TestFileRef::TestRenameFileAndDirectory() {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   pp::FileSystem_Dev file_system(instance_, PP_FILESYSTEMTYPE_LOCALTEMPORARY);
   int32_t rv = file_system.Open(1024, callback);
   if (rv == PP_ERROR_WOULDBLOCK)
diff --git a/ppapi/tests/test_graphics_2d.cc b/ppapi/tests/test_graphics_2d.cc
index b673b81..d0e3f20 100644
--- a/ppapi/tests/test_graphics_2d.cc
+++ b/ppapi/tests/test_graphics_2d.cc
@@ -63,7 +63,7 @@ void TestGraphics2D::RunTest() {
 }
 
 void TestGraphics2D::QuitMessageLoop() {
-  testing_interface_->QuitMessageLoop();
+  testing_interface_->QuitMessageLoop(instance_->pp_instance());
 }
 
 bool TestGraphics2D::ReadImageData(const pp::Graphics2D& dc,
@@ -93,7 +93,7 @@ bool TestGraphics2D::FlushAndWaitForDone(pp::Graphics2D* context) {
     return true;
   if (rv != PP_ERROR_WOULDBLOCK)
     return false;
-  testing_interface_->RunMessageLoop();
+  testing_interface_->RunMessageLoop(instance_->pp_instance());
   return true;
 }
 
diff --git a/ppapi/tests/test_url_loader.cc b/ppapi/tests/test_url_loader.cc
index 72e6d40..2b606c2 100644
--- a/ppapi/tests/test_url_loader.cc
+++ b/ppapi/tests/test_url_loader.cc
@@ -56,7 +56,7 @@ void TestURLLoader::RunTest() {
 
 std::string TestURLLoader::ReadEntireFile(pp::FileIO_Dev* file_io,
                                           std::string* data) {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   char buf[256];
   int64_t offset = 0;
 
@@ -77,7 +77,7 @@ std::string TestURLLoader::ReadEntireFile(pp::FileIO_Dev* file_io,
 
 std::string TestURLLoader::ReadEntireResponseBody(pp::URLLoader* loader,
                                                   std::string* body) {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   char buf[2];  // Small so that multiple reads are needed.
 
   for (;;) {
@@ -97,7 +97,7 @@ std::string TestURLLoader::ReadEntireResponseBody(pp::URLLoader* loader,
 std::string TestURLLoader::LoadAndCompareBody(
     const pp::URLRequestInfo& request,
     const std::string& expected_body) {
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(*instance_);
   int32_t rv = loader.Open(request, callback);
@@ -194,7 +194,7 @@ std::string TestURLLoader::TestStreamToFile() {
   request.SetURL("test_url_loader_data/hello.txt");
   request.SetStreamToFile(true);
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(*instance_);
   int32_t rv = loader.Open(request, callback);
@@ -251,7 +251,7 @@ std::string TestURLLoader::TestSameOriginRestriction() {
   pp::URLRequestInfo request;
   request.SetURL("http://www.google.com/");
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(*instance_);
   int32_t rv = loader.Open(request, callback);
@@ -278,7 +278,7 @@ std::string TestURLLoader::TestAuditURLRedirect() {
   request.SetURL("/server-redirect?www.google.com");
   request.SetFollowRedirects(false);
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
 
   pp::URLLoader loader(*instance_);
   int32_t rv = loader.Open(request, callback);
@@ -305,7 +305,7 @@ std::string TestURLLoader::TestAbortCalls() {
   pp::URLRequestInfo request;
   request.SetURL("test_url_loader_data/hello.txt");
 
-  TestCompletionCallback callback;
+  TestCompletionCallback callback(instance_->pp_instance());
   int32_t rv;
 
   // Abort |Open()|.
diff --git a/ppapi/tests/test_utils.cc b/ppapi/tests/test_utils.cc
index 30246ab..fcaff40 100644
--- a/ppapi/tests/test_utils.cc
+++ b/ppapi/tests/test_utils.cc
@@ -26,16 +26,17 @@ std::string ReportError(const char* method, int32_t error) {
   return result;
 }
 
-TestCompletionCallback::TestCompletionCallback()
+TestCompletionCallback::TestCompletionCallback(PP_Instance instance)
     : result_(PP_ERROR_WOULDBLOCK),
       post_quit_task_(false),
-      run_count_(0) {
+      run_count_(0),
+      instance_(instance) {
 }
 
 int32_t TestCompletionCallback::WaitForResult() {
   result_ = PP_ERROR_WOULDBLOCK;  // Reset
   post_quit_task_ = true;
-  GetTestingInterface()->RunMessageLoop();
+  GetTestingInterface()->RunMessageLoop(instance_);
   return result_;
 }
 
@@ -52,6 +53,6 @@ void TestCompletionCallback::Handler(void* user_data, int32_t result) {
   callback->run_count_++;
   if (callback->post_quit_task_) {
     callback->post_quit_task_ = false;
-    GetTestingInterface()->QuitMessageLoop();
+    GetTestingInterface()->QuitMessageLoop(callback->instance_);
   }
 }
diff --git a/ppapi/tests/test_utils.h b/ppapi/tests/test_utils.h
index 192b239..6fde9bf 100644
--- a/ppapi/tests/test_utils.h
+++ b/ppapi/tests/test_utils.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "ppapi/c/dev/ppb_testing_dev.h"
+#include "ppapi/c/pp_instance.h"
 #include "ppapi/c/pp_stdint.h"
 #include "ppapi/cpp/completion_callback.h"
 
@@ -16,7 +17,7 @@ std::string ReportError(const char* method, int32_t error);
 
 class TestCompletionCallback {
  public:
-  TestCompletionCallback();
+  TestCompletionCallback(PP_Instance instance);
 
   int32_t WaitForResult();
 
@@ -31,6 +32,7 @@ class TestCompletionCallback {
   int32_t result_;
   bool post_quit_task_;
   unsigned run_count_;
+  PP_Instance instance_;
 };
 
 #endif  // PPAPI_TESTS_TEST_UTILS_H_
diff --git a/webkit/plugins/ppapi/plugin_module.cc b/webkit/plugins/ppapi/plugin_module.cc
index a99a29c..4e852c1 100644
--- a/webkit/plugins/ppapi/plugin_module.cc
+++ b/webkit/plugins/ppapi/plugin_module.cc
@@ -185,14 +185,14 @@ PP_Bool ReadImageData(PP_Resource device_context_2d,
   return BoolToPPBool(context->ReadImageData(image, top_left));
 }
 
-void RunMessageLoop() {
+void RunMessageLoop(PP_Instance instance) {
   bool old_state = MessageLoop::current()->NestableTasksAllowed();
   MessageLoop::current()->SetNestableTasksAllowed(true);
   MessageLoop::current()->Run();
   MessageLoop::current()->SetNestableTasksAllowed(old_state);
 }
 
-void QuitMessageLoop() {
+void QuitMessageLoop(PP_Instance instance) {
   MessageLoop::current()->QuitNow();
 }
 
diff --git a/webkit/plugins/ppapi/ppb_flash_impl.cc b/webkit/plugins/ppapi/ppb_flash_impl.cc
index 36ba4ac..2a922c0 100644
--- a/webkit/plugins/ppapi/ppb_flash_impl.cc
+++ b/webkit/plugins/ppapi/ppb_flash_impl.cc
@@ -218,14 +218,14 @@ PP_Bool NavigateToURL(PP_Instance pp_instance,
   return BoolToPPBool(instance->NavigateToURL(url, target));
 }
 
-void RunMessageLoop() {
+void RunMessageLoop(PP_Instance instance) {
   bool old_state = MessageLoop::current()->NestableTasksAllowed();
   MessageLoop::current()->SetNestableTasksAllowed(true);
   MessageLoop::current()->Run();
   MessageLoop::current()->SetNestableTasksAllowed(old_state);
 }
 
-void QuitMessageLoop() {
+void QuitMessageLoop(PP_Instance instance) {
   MessageLoop::current()->QuitNow();
 }
 
diff --git a/webkit/plugins/ppapi/ppb_flash_menu_impl.cc b/webkit/plugins/ppapi/ppb_flash_menu_impl.cc
index f41e941..52f81b6 100644
--- a/webkit/plugins/ppapi/ppb_flash_menu_impl.cc
+++ b/webkit/plugins/ppapi/ppb_flash_menu_impl.cc
@@ -72,13 +72,13 @@ bool ConvertMenuData(const PP_Flash_Menu* in_menu,
                      size_t depth,
                      PPB_Flash_Menu_Impl::MenuData* out_menu,
                      std::vector<int32_t>* menu_id_map) {
-  if (depth > kMaxMenuDepth)
+  if (depth > kMaxMenuDepth || !in_menu)
     return false;
 
   // Clear the output, just in case.
   out_menu->clear();
 
-  if (!in_menu || !in_menu->count)
+  if (!in_menu->count)
     return true;  // Nothing else to do.
 
   if (!in_menu->items || in_menu->count > kMaxMenuEntries)