Revert 80938 - Add a new RenderViewHostObserver interface for filtering IPCs send to RenderViewHost. This is needed because with TabContentsObserver, an observer might not know which RenderViewHost a message came from duing a pending navigation. A side-benefit is that we only have to add these observers once, instead of remembering/knowing all the delegates that might want to filter these messages.BUG=78629Review URL: http://codereview.chromium.org/6812030

TBR=jam@chromium.org

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@80956 0039d316-1c4b-4281-b951-d872f2087c98

31 files changed, 349 insertions, 279 deletions

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index d0d45cc..00ac1c9 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -4,10 +4,7 @@
 
 #include "chrome/browser/chrome_content_browser_client.h"
 
-#include "chrome/browser/debugger/devtools_handler.h"
-#include "chrome/browser/desktop_notification_handler.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/renderer_host/browser_render_process_host.h"
 #include "chrome/browser/ui/webui/chrome_web_ui_factory.h"
@@ -15,13 +12,6 @@
 
 namespace chrome {
 
-void ChromeContentBrowserClient::RenderViewHostCreated(
-    RenderViewHost* render_view_host) {
-  new DesktopNotificationHandler(render_view_host);
-  new DevToolsHandler(render_view_host);
-  new ExtensionMessageHandler(render_view_host);
-}
-
 void ChromeContentBrowserClient::PreCreateRenderView(
     RenderViewHost* render_view_host,
     Profile* profile,
diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
index d170ef1..c55fbae 100644
--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h
@@ -12,7 +12,6 @@ namespace chrome {
 
 class ChromeContentBrowserClient : public content::ContentBrowserClient {
  public:
-  virtual void RenderViewHostCreated(RenderViewHost* render_view_host);
   virtual void PreCreateRenderView(RenderViewHost* render_view_host,
                                    Profile* profile,
                                    const GURL& url);
diff --git a/chrome/browser/debugger/devtools_handler.cc b/chrome/browser/debugger/devtools_handler.cc
index dd6e7fc..e7f2caf 100644
--- a/chrome/browser/debugger/devtools_handler.cc
+++ b/chrome/browser/debugger/devtools_handler.cc
@@ -6,9 +6,11 @@
 
 #include "chrome/browser/debugger/devtools_manager.h"
 #include "chrome/common/devtools_messages.h"
+#include "content/browser/tab_contents/tab_contents.h"
 
-DevToolsHandler::DevToolsHandler(RenderViewHost* render_view_host)
-    : RenderViewHostObserver(render_view_host) {
+DevToolsHandler::DevToolsHandler(TabContents* tab,
+                                 RenderViewHost* render_view_host)
+    : tab_(tab), render_view_host_(render_view_host) {
 }
 
 DevToolsHandler::~DevToolsHandler() {
@@ -33,32 +35,46 @@ bool DevToolsHandler::OnMessageReceived(const IPC::Message& message) {
 
 void DevToolsHandler::OnForwardToAgent(const IPC::Message& message) {
   DevToolsManager::GetInstance()->ForwardToDevToolsAgent(
-      render_view_host(), message);
+      GetRenderViewHost(), message);
 }
 
 void DevToolsHandler::OnForwardToClient(const IPC::Message& message) {
   DevToolsManager::GetInstance()->ForwardToDevToolsClient(
-      render_view_host(), message);
+      GetRenderViewHost(), message);
 }
 
 void DevToolsHandler::OnActivateWindow() {
-  DevToolsManager::GetInstance()->ActivateWindow(render_view_host());
+  DevToolsManager::GetInstance()->ActivateWindow(GetRenderViewHost());
 }
 
 void DevToolsHandler::OnCloseWindow() {
-  DevToolsManager::GetInstance()->CloseWindow(render_view_host());
+  DevToolsManager::GetInstance()->CloseWindow(GetRenderViewHost());
 }
 
 void DevToolsHandler::OnRequestDockWindow() {
-  DevToolsManager::GetInstance()->RequestDockWindow(render_view_host());
+  DevToolsManager::GetInstance()->RequestDockWindow(GetRenderViewHost());
 }
 
 void DevToolsHandler::OnRequestUndockWindow() {
-  DevToolsManager::GetInstance()->RequestUndockWindow(render_view_host());
+  DevToolsManager::GetInstance()->RequestUndockWindow(GetRenderViewHost());
 }
 
 void DevToolsHandler::OnRuntimePropertyChanged(const std::string& name,
                                                const std::string& value) {
   DevToolsManager::GetInstance()->RuntimePropertyChanged(
-      render_view_host(), name, value);
+      GetRenderViewHost(), name, value);
+}
+
+RenderViewHost* DevToolsHandler::GetRenderViewHost() {
+  return tab_ ? tab_->render_view_host() : render_view_host_;
+}
+
+
+DevToolsObserver::DevToolsObserver(TabContents* tab_contents)
+    : TabContentsObserver(tab_contents),
+      handler_(tab_contents, NULL) {
+}
+
+bool DevToolsObserver::OnMessageReceived(const IPC::Message& message) {
+  return handler_.OnMessageReceived(message);
 }
diff --git a/chrome/browser/debugger/devtools_handler.h b/chrome/browser/debugger/devtools_handler.h
index 3212928..5ce9024 100644
--- a/chrome/browser/debugger/devtools_handler.h
+++ b/chrome/browser/debugger/devtools_handler.h
@@ -6,14 +6,16 @@
 #define CHROME_BROWSER_DEBUGGER_DEVTOOLS_HANDLER_H_
 #pragma once
 
-#include "content/browser/renderer_host/render_view_host_observer.h"
+#include "content/browser/tab_contents/tab_contents_observer.h"
 
-class DevToolsHandler : public RenderViewHostObserver {
+class RenderViewHost;
+
+class DevToolsHandler {
  public:
-  explicit DevToolsHandler(RenderViewHost* render_view_host);
+  DevToolsHandler(TabContents* tab, RenderViewHost* render_view_host);
   virtual ~DevToolsHandler();
 
-  // RenderViewHostObserver overrides.
+  // TabContentsObserver overrides.
   virtual bool OnMessageReceived(const IPC::Message& message);
 
  private:
@@ -26,7 +28,27 @@ class DevToolsHandler : public RenderViewHostObserver {
   void OnRuntimePropertyChanged(const std::string& name,
                                 const std::string& value);
 
+  RenderViewHost* GetRenderViewHost();
+
+  // If tab_ is null, then render_view_host_ is used instead
+  TabContents* tab_;
+  RenderViewHost* render_view_host_;
+
   DISALLOW_COPY_AND_ASSIGN(DevToolsHandler);
 };
 
+// A wrapper around DevToolsHandler that implements TabContentsObserver.
+class DevToolsObserver : public TabContentsObserver {
+ public:
+  explicit DevToolsObserver(TabContents* tab_contents);
+
+  // TabContentsObserver implementation.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+ private:
+  DevToolsHandler handler_;
+
+  DISALLOW_COPY_AND_ASSIGN(DevToolsObserver);
+};
+
 #endif  // CHROME_BROWSER_DEBUGGER_DEVTOOLS_HANDLER_H_
diff --git a/chrome/browser/desktop_notification_handler.cc b/chrome/browser/desktop_notification_handler.cc
index 8bd2ef2..8d56e22 100644
--- a/chrome/browser/desktop_notification_handler.cc
+++ b/chrome/browser/desktop_notification_handler.cc
@@ -6,17 +6,15 @@
 
 #include "chrome/browser/notifications/desktop_notification_service.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/browser_list.h"
 #include "content/browser/renderer_host/render_process_host.h"
-#include "content/browser/renderer_host/render_view_host.h"
-#include "content/browser/renderer_host/render_view_host_delegate.h"
+#include "content/browser/tab_contents/tab_contents.h"
 #include "content/common/desktop_notification_messages.h"
 
 DesktopNotificationHandler::DesktopNotificationHandler(
-    RenderViewHost* render_view_host)
-  : RenderViewHostObserver(render_view_host) {
-}
-
-DesktopNotificationHandler::~DesktopNotificationHandler() {
+    TabContents* tab, RenderProcessHost* process)
+  : tab_(tab),
+    process_(process) {
 }
 
 bool DesktopNotificationHandler::OnMessageReceived(
@@ -35,39 +33,65 @@ bool DesktopNotificationHandler::OnMessageReceived(
 }
 
 void DesktopNotificationHandler::OnShow(
+    const IPC::Message& message,
     const DesktopNotificationHostMsg_Show_Params& params) {
-  RenderProcessHost* process = render_view_host()->process();
+  RenderProcessHost* process = GetRenderProcessHost();
   DesktopNotificationService* service =
       process->profile()->GetDesktopNotificationService();
 
   service->ShowDesktopNotification(
     params,
     process->id(),
-    routing_id(),
+    message.routing_id(),
     DesktopNotificationService::PageNotification);
 }
 
-void DesktopNotificationHandler::OnCancel(int notification_id) {
-  RenderProcessHost* process = render_view_host()->process();
+void DesktopNotificationHandler::OnCancel(const IPC::Message& message,
+                                          int notification_id) {
+  RenderProcessHost* process = GetRenderProcessHost();
   DesktopNotificationService* service =
       process->profile()->GetDesktopNotificationService();
 
   service->CancelDesktopNotification(
       process->id(),
-      routing_id(),
+      message.routing_id(),
       notification_id);
 }
 
 void DesktopNotificationHandler::OnRequestPermission(
-    const GURL& source_origin, int callback_context) {
-  if (render_view_host()->delegate()->RequestDesktopNotificationPermission(
-          source_origin, callback_context)) {
+    const IPC::Message& message, const GURL& source_origin,
+    int callback_context) {
+  RenderProcessHost* process = GetRenderProcessHost();
+  Browser* browser = BrowserList::GetLastActive();
+  // We may not have a BrowserList if the chrome browser process is launched as
+  // a ChromeFrame process in which case we attempt to use the TabContents
+  // provided by the RenderViewHostDelegate.
+  TabContents* tab = browser ? browser->GetSelectedTabContents() : tab_;
+  if (!tab)
     return;
-  }
 
-  RenderProcessHost* process = render_view_host()->process();
   DesktopNotificationService* service =
-      process->profile()->GetDesktopNotificationService();
+      tab->profile()->GetDesktopNotificationService();
   service->RequestPermission(
-      source_origin, process->id(), routing_id(), callback_context, NULL);
+      source_origin,
+      process->id(),
+      message.routing_id(),
+      callback_context,
+      tab);
+}
+
+RenderProcessHost* DesktopNotificationHandler::GetRenderProcessHost() {
+  return tab_ ? tab_->GetRenderProcessHost() : process_;
+}
+
+DesktopNotificationHandlerForTC::DesktopNotificationHandlerForTC(
+    TabContents* tab_contents,
+    RenderProcessHost* process)
+    : TabContentsObserver(tab_contents),
+      handler_(tab_contents, process) {
+}
+
+bool DesktopNotificationHandlerForTC::OnMessageReceived(
+    const IPC::Message& message) {
+  return handler_.OnMessageReceived(message);
 }
diff --git a/chrome/browser/desktop_notification_handler.h b/chrome/browser/desktop_notification_handler.h
index 2823d53..1fac9c5 100644
--- a/chrome/browser/desktop_notification_handler.h
+++ b/chrome/browser/desktop_notification_handler.h
@@ -6,30 +6,56 @@
 #define CHROME_BROWSER_DESKTOP_NOTIFICATION_HANDLER_H_
 #pragma once
 
-#include "content/browser/renderer_host/render_view_host_observer.h"
+#include "content/browser/tab_contents/tab_contents_observer.h"
 
-class GURL;
 struct DesktopNotificationHostMsg_Show_Params;
+class RenderProcessHost;
 
 // Per-tab Desktop notification handler. Handles desktop notification IPCs
 // coming in from the renderer.
-class DesktopNotificationHandler : public RenderViewHostObserver {
+class DesktopNotificationHandler {
  public:
-  explicit DesktopNotificationHandler(RenderViewHost* render_view_host);
-  virtual ~DesktopNotificationHandler();
+  // tab_contents will be NULL when this object is used with non-tab contents,
+  // i.e. ExtensionHost.
+  DesktopNotificationHandler(TabContents* tab_contents,
+                             RenderProcessHost* process);
+  virtual ~DesktopNotificationHandler() {}
 
- private:
-  // RenderViewHostObserver implementation.
   bool OnMessageReceived(const IPC::Message& message);
 
+  RenderProcessHost* GetRenderProcessHost();
+
+ private:
   // IPC handlers.
-  void OnShow(const DesktopNotificationHostMsg_Show_Params& params);
-  void OnCancel(int notification_id);
-  void OnRequestPermission(const GURL& origin, int callback_id);
+  void OnShow(const IPC::Message& message,
+              const DesktopNotificationHostMsg_Show_Params& params);
+  void OnCancel(const IPC::Message& message, int notification_id);
+  void OnRequestPermission(const IPC::Message& message,
+                           const GURL& origin,
+                           int callback_id);
 
  private:
+  TabContents* tab_;
+  RenderProcessHost* process_;
+
   DISALLOW_COPY_AND_ASSIGN(DesktopNotificationHandler);
 };
 
+// A wrapper around DesktopNotificationHandler that implements
+// TabContentsObserver.
+class DesktopNotificationHandlerForTC : public TabContentsObserver {
+ public:
+  // tab_contents will be NULL when this object is used with non-tab contents,
+  // i.e. ExtensionHost.
+  DesktopNotificationHandlerForTC(TabContents* tab_contents,
+                                  RenderProcessHost* process);
+
+  // TabContentsObserver implementation.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+ private:
+  DesktopNotificationHandler handler_;
+};
+
 #endif  // CHROME_BROWSER_DESKTOP_NOTIFICATION_HANDLER_H_
 
diff --git a/chrome/browser/extensions/extension_host.cc b/chrome/browser/extensions/extension_host.cc
index 3969d12f..a3e2bb0 100644
--- a/chrome/browser/extensions/extension_host.cc
+++ b/chrome/browser/extensions/extension_host.cc
@@ -12,6 +12,10 @@
 #include "base/string_util.h"
 #include "chrome/browser/browser_shutdown.h"
 #include "chrome/browser/browser_window.h"
+#include "chrome/browser/debugger/devtools_handler.h"
+#include "chrome/browser/debugger/devtools_manager.h"
+#include "chrome/browser/desktop_notification_handler.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_tabs_module.h"
 #include "chrome/browser/file_select_helper.h"
@@ -151,6 +155,12 @@ ExtensionHost::ExtensionHost(const Extension* extension,
   // be the same extension that this points to.
   registrar_.Add(this, NotificationType::EXTENSION_UNLOADED,
                  Source<Profile>(profile_));
+
+  desktop_notification_handler_.reset(
+      new DesktopNotificationHandler(NULL, render_process_host()));
+  dev_tools_handler_.reset(new DevToolsHandler(NULL, render_view_host_));
+  extension_message_handler_.reset(new ExtensionMessageHandler(
+      render_process_host()->id(), render_view_host_, profile_));
 }
 
 ExtensionHost::~ExtensionHost() {
@@ -327,7 +337,7 @@ void ExtensionHost::DidNavigate(RenderViewHost* render_view_host,
     return;
 
   if (!params.url.SchemeIs(chrome::kExtensionScheme)) {
-    extension_function_dispatcher_.reset(NULL);
+    SetExtensionFunctionDispatcher(NULL);
     url_ = params.url;
     return;
   }
@@ -342,12 +352,12 @@ void ExtensionHost::DidNavigate(RenderViewHost* render_view_host,
   // it's better than the alternative.
   // TODO(erikkay) Perhaps we should display errors in developer mode.
   if (params.url.host() != extension_->id()) {
-    extension_function_dispatcher_.reset(NULL);
+    SetExtensionFunctionDispatcher(NULL);
     return;
   }
 
   url_ = params.url;
-  extension_function_dispatcher_.reset(
+  SetExtensionFunctionDispatcher(
       ExtensionFunctionDispatcher::Create(render_view_host_, this, url_));
 }
 
@@ -547,13 +557,6 @@ WebPreferences ExtensionHost::GetWebkitPrefs() {
   return webkit_prefs;
 }
 
-void ExtensionHost::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  if (extension_function_dispatcher_.get()) {
-    extension_function_dispatcher_->HandleRequest(params);
-  }
-}
-
 RenderViewHostDelegate::View* ExtensionHost::GetViewDelegate() {
   return this;
 }
@@ -787,6 +790,13 @@ bool ExtensionHost::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(ViewHostMsg_RunFileChooser, OnRunFileChooser)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
+
+  if (!handled)
+    handled = desktop_notification_handler_->OnMessageReceived(message);
+  if (!handled)
+    handled = dev_tools_handler_->OnMessageReceived(message);
+  if (!handled)
+    handled = extension_message_handler_->OnMessageReceived(message);
   return handled;
 }
 
@@ -802,7 +812,7 @@ void ExtensionHost::RenderViewCreated(RenderViewHost* render_view_host) {
   // we'll create 2 EFDs for the first navigation. We should try to find a
   // better way to unify them.
   // See http://code.google.com/p/chromium/issues/detail?id=18240
-  extension_function_dispatcher_.reset(
+  SetExtensionFunctionDispatcher(
       ExtensionFunctionDispatcher::Create(render_view_host, this, url_));
 
   if (extension_host_type_ == ViewType::EXTENSION_POPUP ||
@@ -836,3 +846,9 @@ void ExtensionHost::OnRunFileChooser(
     file_select_helper_.reset(new FileSelectHelper(profile()));
   file_select_helper_->RunFileChooser(render_view_host_, params);
 }
+
+void ExtensionHost::SetExtensionFunctionDispatcher(
+    ExtensionFunctionDispatcher* efd) {
+  extension_function_dispatcher_.reset(efd);
+  extension_message_handler_->set_extension_function_dispatcher(efd);
+}
diff --git a/chrome/browser/extensions/extension_host.h b/chrome/browser/extensions/extension_host.h
index 63adef8..9dcfb7f 100644
--- a/chrome/browser/extensions/extension_host.h
+++ b/chrome/browser/extensions/extension_host.h
@@ -26,7 +26,10 @@
 #endif
 
 class Browser;
+class DesktopNotificationHandler;
+class DevToolsHandler;
 class Extension;
+class ExtensionMessageHandler;
 class FileSelectHelper;
 class RenderProcessHost;
 class RenderWidgetHostView;
@@ -128,8 +131,6 @@ class ExtensionHost : public RenderViewHostDelegate,
   // RenderViewHostDelegate implementation.
   virtual RenderViewHostDelegate::View* GetViewDelegate();
   virtual WebPreferences GetWebkitPrefs();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
@@ -236,6 +237,10 @@ class ExtensionHost : public RenderViewHostDelegate,
   // event in platform specific way.
   virtual void UnhandledKeyboardEvent(const NativeWebKeyboardEvent& event) {}
 
+  // Updates extension_function_dispatcher_.  Call this instead of modifying it
+  // directly.
+  void SetExtensionFunctionDispatcher(ExtensionFunctionDispatcher* efd);
+
   // Returns true if we're hosting a background page.
   // This isn't valid until CreateRenderView is called.
   bool is_background_page() const { return !view(); }
@@ -287,6 +292,15 @@ class ExtensionHost : public RenderViewHostDelegate,
   // FileSelectHelper, lazily created.
   scoped_ptr<FileSelectHelper> file_select_helper_;
 
+  // Handles desktop notification IPCs.
+  scoped_ptr<DesktopNotificationHandler> desktop_notification_handler_;
+
+  // Filters dev tools IPCs.
+  scoped_ptr<DevToolsHandler> dev_tools_handler_;
+
+  // Handles extension IPCs.
+  scoped_ptr<ExtensionMessageHandler> extension_message_handler_;
+
   // The time that the last javascript message was dismissed.
   base::TimeTicks last_javascript_message_dismissal_;
 
diff --git a/chrome/browser/extensions/extension_message_handler.cc b/chrome/browser/extensions/extension_message_handler.cc
index 52517cb..9b872d0 100644
--- a/chrome/browser/extensions/extension_message_handler.cc
+++ b/chrome/browser/extensions/extension_message_handler.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/extensions/extension_message_handler.h"
 
+#include "chrome/browser/extensions/extension_function_dispatcher.h"
 #include "chrome/browser/extensions/extension_message_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/extensions/extension_messages.h"
@@ -11,10 +12,15 @@
 #include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
+#include "content/browser/tab_contents/tab_contents.h"
+#include "content/common/notification_service.h"
 
 ExtensionMessageHandler::ExtensionMessageHandler(
-    RenderViewHost* render_view_host)
-    : RenderViewHostObserver(render_view_host) {
+    int child_id, IPC::Message::Sender* sender, Profile* profile)
+    : child_id_(child_id),
+      sender_(sender),
+      extension_function_dispatcher_(NULL),
+      profile_(profile) {
 }
 
 ExtensionMessageHandler::~ExtensionMessageHandler() {
@@ -31,26 +37,75 @@ bool ExtensionMessageHandler::OnMessageReceived(
   return handled;
 }
 
+bool ExtensionMessageHandler::CanDispatchRequest(
+    int child_id,
+    int routing_id,
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (!ChildProcessSecurityPolicy::GetInstance()->
+          HasExtensionBindings(child_id)) {
+    // This can happen if someone uses window.open() to open an extension URL
+    // from a non-extension context.
+    sender_->Send(new ExtensionMsg_Response(
+        routing_id, params.request_id, false, std::string(),
+        "Access to extension API denied."));
+    return false;
+  }
+
+  return true;
+}
+
 void ExtensionMessageHandler::OnPostMessage(int port_id,
                                             const std::string& message) {
-  Profile* profile = render_view_host()->process()->profile();
-  if (profile->GetExtensionMessageService()) {
-    profile->GetExtensionMessageService()->PostMessageFromRenderer(
+  if (profile_->GetExtensionMessageService()) {
+    profile_->GetExtensionMessageService()->PostMessageFromRenderer(
         port_id, message);
   }
 }
 
 void ExtensionMessageHandler::OnRequest(
+    const IPC::Message& message,
     const ExtensionHostMsg_DomMessage_Params& params) {
-  if (!ChildProcessSecurityPolicy::GetInstance()->
-          HasExtensionBindings(render_view_host()->process()->id())) {
-    // This can happen if someone uses window.open() to open an extension URL
-    // from a non-extension context.
-    Send(new ExtensionMsg_Response(
-        routing_id(), params.request_id, false, std::string(),
-        "Access to extension API denied."));
+  DCHECK(child_id_);
+  if (!extension_function_dispatcher_ ||
+      !CanDispatchRequest(child_id_, message.routing_id(), params)) {
+    return;
+  }
+
+  extension_function_dispatcher_->HandleRequest(params);
+}
+
+ExtensionMessageObserver::ExtensionMessageObserver(TabContents* tab_contents)
+    : TabContentsObserver(tab_contents),
+      ALLOW_THIS_IN_INITIALIZER_LIST(
+          handler_(0, this, tab_contents->profile())) {
+  // We don't pass in a child_id to handler_ since for TabContents that can
+  // change later.
+}
+
+ExtensionMessageObserver::~ExtensionMessageObserver() {
+}
+
+bool ExtensionMessageObserver::OnMessageReceived(const IPC::Message& message) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(ExtensionMessageObserver, message)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+
+  if (!handled)
+    handled = handler_.OnMessageReceived(message);
+  return handled;
+}
+
+void ExtensionMessageObserver::OnRequest(
+    const IPC::Message& message,
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (!handler_.CanDispatchRequest(
+          tab_contents()->render_view_host()->process()->id(),
+          message.routing_id(),
+          params)) {
     return;
   }
 
-  render_view_host()->delegate()->ProcessWebUIMessage(params);
+  tab_contents()->render_view_host()->delegate()->ProcessWebUIMessage(params);
 }
diff --git a/chrome/browser/extensions/extension_message_handler.h b/chrome/browser/extensions/extension_message_handler.h
index d134d09..3cd8d3c 100644
--- a/chrome/browser/extensions/extension_message_handler.h
+++ b/chrome/browser/extensions/extension_message_handler.h
@@ -6,8 +6,10 @@
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_HANDLER_H_
 #pragma once
 
-#include "content/browser/renderer_host/render_view_host_observer.h"
+#include "content/browser/tab_contents/tab_contents_observer.h"
+#include "ipc/ipc_channel.h"
 
+class ExtensionFunctionDispatcher;
 class Profile;
 struct ExtensionHostMsg_DomMessage_Params;
 
@@ -15,21 +17,60 @@ struct ExtensionHostMsg_DomMessage_Params;
 // renderer/extension processes.  This object is created for renderers and also
 // ExtensionHost/BackgroundContents.  Contrast this with ExtensionTabHelper,
 // which is only created for TabContents.
-class ExtensionMessageHandler : public RenderViewHostObserver {
+class ExtensionMessageHandler : public IPC::Channel::Listener {
  public:
   // |sender| is guaranteed to outlive this object.
-  explicit ExtensionMessageHandler(RenderViewHost* render_view_host);
+  ExtensionMessageHandler(int child_id,
+                          IPC::Message::Sender* sender,
+                          Profile* profile);
   virtual ~ExtensionMessageHandler();
 
-  // RenderViewHostObserver overrides.
+  // IPC::Channel::Listener overrides.
   virtual bool OnMessageReceived(const IPC::Message& message);
 
+  // Returns true iff the message can be dispatched.
+  bool CanDispatchRequest(int child_id,
+                          int routing_id,
+                          const ExtensionHostMsg_DomMessage_Params& params);
+
+  void set_extension_function_dispatcher(ExtensionFunctionDispatcher* e) {
+    extension_function_dispatcher_ = e;
+  }
+
  private:
   // Message handlers.
   void OnPostMessage(int port_id, const std::string& message);
-  void OnRequest(const ExtensionHostMsg_DomMessage_Params& params);
+  void OnRequest(const IPC::Message& message,
+                 const ExtensionHostMsg_DomMessage_Params& params);
+
+  // The child id of the corresponding process.  Can be 0.
+  int child_id_;
+
+  // Guaranteed to outlive this object.
+  IPC::Message::Sender* sender_;
+  ExtensionFunctionDispatcher* extension_function_dispatcher_;
+
+  Profile* profile_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionMessageHandler);
 };
 
+// A TabContentsObserver that forwards IPCs to ExtensionMessageHandler.
+class ExtensionMessageObserver : public TabContentsObserver {
+ public:
+  explicit ExtensionMessageObserver(TabContents* tab_contents);
+  ~ExtensionMessageObserver();
+
+ private:
+  // TabContentsObserver overrides.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+  void OnRequest(const IPC::Message& message,
+                 const ExtensionHostMsg_DomMessage_Params& params);
+
+  ExtensionMessageHandler handler_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExtensionMessageObserver);
+};
+
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_HANDLER_H_
diff --git a/chrome/browser/notifications/balloon_host.cc b/chrome/browser/notifications/balloon_host.cc
index deb3f3b..1200891 100644
--- a/chrome/browser/notifications/balloon_host.cc
+++ b/chrome/browser/notifications/balloon_host.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/notifications/balloon_host.h"
 
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/notifications/balloon.h"
@@ -70,6 +71,12 @@ const string16& BalloonHost::GetSource() const {
   return balloon_->notification().display_source();
 }
 
+bool BalloonHost::OnMessageReceived(const IPC::Message& message) {
+  if (!extension_message_handler_.get())
+    return false;
+  return extension_message_handler_->OnMessageReceived(message);
+}
+
 WebPreferences BalloonHost::GetWebkitPrefs() {
   WebPreferences web_prefs =
       RenderViewHostDelegateHelper::GetWebkitPrefs(GetProfile(),
@@ -132,13 +139,6 @@ RenderViewHostDelegate::View* BalloonHost::GetViewDelegate() {
   return this;
 }
 
-void BalloonHost::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  if (extension_function_dispatcher_.get()) {
-    extension_function_dispatcher_->HandleRequest(params);
-  }
-}
-
 // RenderViewHostDelegate::View methods implemented to allow links to
 // open pages in new tabs.
 void BalloonHost::CreateNewWindow(
@@ -209,6 +209,11 @@ void BalloonHost::Init() {
             balloon_->notification().content_url());
     static_cast<BrowserRenderProcessHost*>(rvh->process())->set_installed_app(
         installed_app);
+
+    extension_message_handler_.reset(new ExtensionMessageHandler(
+        rvh->process()->id(), rvh, GetProfile()));
+    extension_message_handler_->set_extension_function_dispatcher(
+        extension_function_dispatcher_.get());
   } else if (enable_web_ui_) {
     rvh->AllowBindings(BindingsPolicy::WEB_UI);
   }
diff --git a/chrome/browser/notifications/balloon_host.h b/chrome/browser/notifications/balloon_host.h
index 475d6bd..b29955b 100644
--- a/chrome/browser/notifications/balloon_host.h
+++ b/chrome/browser/notifications/balloon_host.h
@@ -18,6 +18,7 @@
 
 class Balloon;
 class Browser;
+class ExtensionMessageHandler;
 class Profile;
 class SiteInstance;
 struct RendererPreferences;
@@ -46,6 +47,7 @@ class BalloonHost : public RenderViewHostDelegate,
   const string16& GetSource() const;
 
   // RenderViewHostDelegate overrides.
+  virtual bool OnMessageReceived(const IPC::Message& message);
   virtual WebPreferences GetWebkitPrefs();
   virtual SiteInstance* GetSiteInstance() const;
   virtual Profile* GetProfile() const;
@@ -61,8 +63,6 @@ class BalloonHost : public RenderViewHostDelegate,
   virtual int GetBrowserWindowID() const;
   virtual ViewType::Type GetRenderViewType() const;
   virtual RenderViewHostDelegate::View* GetViewDelegate();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
 
   // NotificationObserver override.
   virtual void Observe(NotificationType type,
@@ -160,6 +160,9 @@ class BalloonHost : public RenderViewHostDelegate,
   bool enable_web_ui_;
 
   NotificationRegistrar registrar_;
+
+  // Handles extension IPCs.
+  scoped_ptr<ExtensionMessageHandler> extension_message_handler_;
 };
 
 #endif  // CHROME_BROWSER_NOTIFICATIONS_BALLOON_HOST_H_
diff --git a/chrome/browser/notifications/desktop_notification_service.cc b/chrome/browser/notifications/desktop_notification_service.cc
index ef5bf76..a6e4eb5 100644
--- a/chrome/browser/notifications/desktop_notification_service.cc
+++ b/chrome/browser/notifications/desktop_notification_service.cc
@@ -17,7 +17,6 @@
 #include "chrome/browser/prefs/scoped_user_pref_update.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/tab_contents/confirm_infobar_delegate.h"
-#include "chrome/browser/ui/browser_list.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/browser_child_process_host.h"
@@ -501,12 +500,6 @@ void DesktopNotificationService::RequestPermission(
     const GURL& origin, int process_id, int route_id, int callback_context,
     TabContents* tab) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  if (!tab) {
-    Browser* browser = BrowserList::GetLastActive();
-    if (browser)
-      browser->GetSelectedTabContents();
-  }
-
   if (!tab)
     return;
 
diff --git a/chrome/browser/notifications/desktop_notification_service.h b/chrome/browser/notifications/desktop_notification_service.h
index a5c05a9..cf3ad4d 100644
--- a/chrome/browser/notifications/desktop_notification_service.h
+++ b/chrome/browser/notifications/desktop_notification_service.h
@@ -45,9 +45,7 @@ class DesktopNotificationService : public NotificationObserver {
 
   // Requests permission (using an info-bar) for a given origin.
   // |callback_context| contains an opaque value to pass back to the
-  // requesting process when the info-bar finishes.  A NULL tab can be given if
-  // none exist (i.e. background tab), in which case the currently selected tab
-  // will be used.
+  // requesting process when the info-bar finishes.
   void RequestPermission(const GURL& origin,
                          int process_id,
                          int route_id,
diff --git a/chrome/browser/tab_contents/background_contents.cc b/chrome/browser/tab_contents/background_contents.cc
index 8b30787..bd82e06 100644
--- a/chrome/browser/tab_contents/background_contents.cc
+++ b/chrome/browser/tab_contents/background_contents.cc
@@ -5,15 +5,17 @@
 #include "chrome/browser/tab_contents/background_contents.h"
 
 #include "chrome/browser/background_contents_service.h"
+#include "chrome/browser/desktop_notification_handler.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_message_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/renderer_preferences_util.h"
 #include "chrome/browser/ui/webui/chrome_web_ui_factory.h"
 #include "chrome/common/extensions/extension_constants.h"
-#include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/view_types.h"
 #include "content/browser/browsing_instance.h"
+#include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/site_instance.h"
 #include "content/common/notification_service.h"
@@ -42,6 +44,10 @@ BackgroundContents::BackgroundContents(SiteInstance* site_instance,
   // APP_TERMINATING before non-OTR profiles are destroyed).
   registrar_.Add(this, NotificationType::PROFILE_DESTROYED,
                  Source<Profile>(profile));
+  desktop_notification_handler_.reset(
+      new DesktopNotificationHandler(NULL, site_instance->GetProcess()));
+  extension_message_handler_.reset(new ExtensionMessageHandler(
+      render_view_host_->process()->id(), render_view_host_, profile));
 }
 
 // Exposed to allow creating mocks.
@@ -194,6 +200,13 @@ void BackgroundContents::RenderViewGone(RenderViewHost* rvh,
   delete this;
 }
 
+bool BackgroundContents::OnMessageReceived(const IPC::Message& message) {
+  bool handled = desktop_notification_handler_->OnMessageReceived(message);
+  if (!handled)
+    handled = extension_message_handler_->OnMessageReceived(message);
+  return handled;
+}
+
 RendererPreferences BackgroundContents::GetRendererPrefs(
     Profile* profile) const {
   RendererPreferences preferences;
@@ -209,15 +222,6 @@ WebPreferences BackgroundContents::GetWebkitPrefs() {
                                                       false);  // is_web_ui
 }
 
-void BackgroundContents::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  // TODO(rafaelw): It may make sense for extensions to be able to open
-  // BackgroundContents to chrome-extension://<id> pages. Consider implementing.
-  render_view_host_->Send(new ExtensionMsg_Response(
-      render_view_host_->routing_id(), params.request_id, false,
-      std::string(), "Access to extension API denied."));
-}
-
 void BackgroundContents::CreateNewWindow(
     int route_id,
     const ViewHostMsg_CreateWindow_Params& params) {
diff --git a/chrome/browser/tab_contents/background_contents.h b/chrome/browser/tab_contents/background_contents.h
index 1e7a451e..b33d9a0 100644
--- a/chrome/browser/tab_contents/background_contents.h
+++ b/chrome/browser/tab_contents/background_contents.h
@@ -19,7 +19,8 @@
 #include "webkit/glue/window_open_disposition.h"
 
 class TabContents;
-struct ExtensionHostMsg_DomMessage_Params;
+class DesktopNotificationHandler;
+class ExtensionMessageHandler;
 struct WebPreferences;
 
 namespace gfx {
@@ -68,8 +69,6 @@ class BackgroundContents : public RenderViewHostDelegate,
   virtual void DidNavigate(RenderViewHost* render_view_host,
                            const ViewHostMsg_FrameNavigate_Params& params);
   virtual WebPreferences GetWebkitPrefs();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
@@ -81,6 +80,7 @@ class BackgroundContents : public RenderViewHostDelegate,
   virtual void RenderViewGone(RenderViewHost* rvh,
                               base::TerminationStatus status,
                               int error_code);
+  virtual bool OnMessageReceived(const IPC::Message& message);
 
   // RenderViewHostDelegate::View
   virtual void CreateNewWindow(
@@ -166,6 +166,12 @@ class BackgroundContents : public RenderViewHostDelegate,
 
   NotificationRegistrar registrar_;
 
+  // Handles desktop notification IPCs.
+  scoped_ptr<DesktopNotificationHandler> desktop_notification_handler_;
+
+  // Handles extension IPCs.
+  scoped_ptr<ExtensionMessageHandler> extension_message_handler_;
+
   DISALLOW_COPY_AND_ASSIGN(BackgroundContents);
 };
 
diff --git a/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc b/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc
index d1e4b80..faeb076 100644
--- a/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc
+++ b/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc
@@ -11,6 +11,8 @@
 #include "chrome/browser/bookmarks/bookmark_model.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/custom_handlers/register_protocol_handler_infobar_delegate.h"
+#include "chrome/browser/debugger/devtools_handler.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_tab_helper.h"
 #include "chrome/browser/file_select_helper.h"
 #include "chrome/browser/history/top_sites.h"
@@ -69,6 +71,8 @@ TabContentsWrapper::TabContentsWrapper(TabContents* contents)
                  NotificationService::AllSources());
 
   // Create the per-tab observers.
+  dev_tools_observer_.reset(new DevToolsObserver(contents));
+  extension_message_observer_.reset(new ExtensionMessageObserver(contents));
   file_select_observer_.reset(new FileSelectObserver(contents));
   prerender_observer_.reset(new prerender::PrerenderObserver(contents));
   print_preview_.reset(new printing::PrintPreviewMessageHandler(contents));
diff --git a/chrome/browser/ui/tab_contents/tab_contents_wrapper.h b/chrome/browser/ui/tab_contents/tab_contents_wrapper.h
index af3f01d..63d9007 100644
--- a/chrome/browser/ui/tab_contents/tab_contents_wrapper.h
+++ b/chrome/browser/ui/tab_contents/tab_contents_wrapper.h
@@ -27,7 +27,9 @@ class PrintPreviewMessageHandler;
 class AutocompleteHistoryManager;
 class AutofillManager;
 class AutomationTabHelper;
+class DevToolsObserver;
 class Extension;
+class ExtensionMessageObserver;
 class ExtensionTabHelper;
 class FileSelectObserver;
 class FindTabHelper;
@@ -185,6 +187,8 @@ class TabContentsWrapper : public NotificationObserver,
   // (These provide no API for callers; objects that need to exist 1:1 with tabs
   // and silently do their thing live here.)
 
+  scoped_ptr<DevToolsObserver> dev_tools_observer_;
+  scoped_ptr<ExtensionMessageObserver> extension_message_observer_;
   scoped_ptr<FileSelectObserver> file_select_observer_;
   scoped_ptr<prerender::PrerenderObserver> prerender_observer_;
   scoped_ptr<printing::PrintPreviewMessageHandler> print_preview_;
diff --git a/chrome/browser/ui/views/dom_view.cc b/chrome/browser/ui/views/dom_view.cc
index e5795fa..94cf8bc 100644
--- a/chrome/browser/ui/views/dom_view.cc
+++ b/chrome/browser/ui/views/dom_view.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/ui/views/dom_view.h"
 
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "views/focus/focus_manager.h"
 
@@ -30,6 +31,8 @@ bool DOMView::Init(Profile* profile, SiteInstance* instance) {
   if (GetWidget())
     AttachTabContents();
 
+  extension_message_observer_.reset(new ExtensionMessageObserver(
+      tab_contents_.get()));
   return true;
 }
 
diff --git a/chrome/browser/ui/views/dom_view.h b/chrome/browser/ui/views/dom_view.h
index d24d700..5ee42d1 100644
--- a/chrome/browser/ui/views/dom_view.h
+++ b/chrome/browser/ui/views/dom_view.h
@@ -14,6 +14,7 @@
 #include "views/controls/native/native_view_host.h"
 #include "views/events/event.h"
 
+class ExtensionMessageObserver;
 class Profile;
 class SiteInstance;
 class TabContents;
@@ -57,6 +58,7 @@ class DOMView : public views::NativeViewHost {
 
  private:
   bool initialized_;
+  scoped_ptr<ExtensionMessageObserver> extension_message_observer_;
 
   DISALLOW_COPY_AND_ASSIGN(DOMView);
 };
diff --git a/content/browser/content_browser_client.cc b/content/browser/content_browser_client.cc
index 57392a1..5b763c2b 100644
--- a/content/browser/content_browser_client.cc
+++ b/content/browser/content_browser_client.cc
@@ -10,15 +10,6 @@
 
 namespace content {
 
-void ContentBrowserClient::RenderViewHostCreated(
-    RenderViewHost* render_view_host) {
-}
-
-void ContentBrowserClient::PreCreateRenderView(RenderViewHost* render_view_host,
-                                               Profile* profile,
-                                               const GURL& url) {
-}
-
 WebUIFactory* ContentBrowserClient::GetWebUIFactory() {
   // Return an empty factory so callsites don't have to check for NULL.
   return EmptyWebUIFactory::Get();
diff --git a/content/browser/content_browser_client.h b/content/browser/content_browser_client.h
index 1f3c7ca..e8350e6 100644
--- a/content/browser/content_browser_client.h
+++ b/content/browser/content_browser_client.h
@@ -19,13 +19,10 @@ class WebUIFactory;
 // Embedder API for participating in browser logic.
 class ContentBrowserClient {
  public:
-  // Notifies that a new RenderHostView has been created.
-  virtual void RenderViewHostCreated(RenderViewHost* render_view_host);
-
   // Initialize a RenderViewHost before its CreateRenderView method is called.
   virtual void PreCreateRenderView(RenderViewHost* render_view_host,
                                    Profile* profile,
-                                   const GURL& url);
+                                   const GURL& url) {}
 
   // Gets the WebUIFactory which will be responsible for generating WebUIs.
   virtual WebUIFactory* GetWebUIFactory();
diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
index 17c5338..3e6ef59 100644
--- a/content/browser/renderer_host/render_view_host.cc
+++ b/content/browser/renderer_host/render_view_host.cc
@@ -30,12 +30,10 @@
 #include "chrome/common/translate_errors.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/child_process_security_policy.h"
-#include "content/browser/content_browser_client.h"
 #include "content/browser/cross_site_request_manager.h"
 #include "content/browser/in_process_webkit/session_storage_namespace.h"
 #include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
-#include "content/browser/renderer_host/render_view_host_observer.h"
 #include "content/browser/renderer_host/render_widget_host.h"
 #include "content/browser/renderer_host/render_widget_host_view.h"
 #include "content/browser/site_instance.h"
@@ -117,14 +115,9 @@ RenderViewHost::RenderViewHost(SiteInstance* instance,
 
   DCHECK(instance_);
   DCHECK(delegate_);
-
-  content::GetContentClient()->browser()->RenderViewHostCreated(this);
 }
 
 RenderViewHost::~RenderViewHost() {
-  FOR_EACH_OBSERVER(
-      RenderViewHostObserver, observers_, RenderViewHostDestruction());
-
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_DELETED,
       Source<RenderViewHost>(this),
@@ -719,12 +712,6 @@ bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
   }
 #endif
 
-  ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
-  RenderViewHostObserver* observer;
-  while ((observer = it.GetNext()) != NULL)
-    if (observer->OnMessageReceived(msg))
-      return true;
-
   if (delegate_->OnMessageReceived(msg))
     return true;
 
@@ -1238,14 +1225,6 @@ void RenderViewHost::OnAddMessageToConsole(const std::wstring& message,
       << "\", source: " << source_id << " (" << line_no << ")";
 }
 
-void RenderViewHost::AddObserver(RenderViewHostObserver* observer) {
-  observers_.AddObserver(observer);
-}
-
-void RenderViewHost::RemoveObserver(RenderViewHostObserver* observer) {
-  observers_.RemoveObserver(observer);
-}
-
 bool RenderViewHost::PreHandleKeyboardEvent(
     const NativeWebKeyboardEvent& event, bool* is_keyboard_shortcut) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
diff --git a/content/browser/renderer_host/render_view_host.h b/content/browser/renderer_host/render_view_host.h
index 88dac2a..0304ec9 100644
--- a/content/browser/renderer_host/render_view_host.h
+++ b/content/browser/renderer_host/render_view_host.h
@@ -10,7 +10,6 @@
 #include <vector>
 
 #include "base/memory/scoped_ptr.h"
-#include "base/observer_list.h"
 #include "base/process_util.h"
 #include "chrome/browser/ui/find_bar/find_bar_controller.h"
 #include "chrome/common/content_settings_types.h"
@@ -33,7 +32,6 @@ class FilePath;
 class GURL;
 class ListValue;
 class RenderViewHostDelegate;
-class RenderViewHostObserver;
 class SessionStorageNamespace;
 class SiteInstance;
 class SkBitmap;
@@ -501,13 +499,6 @@ class RenderViewHost : public RenderWidgetHost {
                         GURL* url);
 
  protected:
-  friend class RenderViewHostObserver;
-
-  // Add and remove observers for filtering IPC messages.  Clients must be sure
-  // to remove the observer before they go away.
-  void AddObserver(RenderViewHostObserver* observer);
-  void RemoveObserver(RenderViewHostObserver* observer);
-
   // RenderWidgetHost protected overrides.
   virtual bool PreHandleKeyboardEvent(const NativeWebKeyboardEvent& event,
                                       bool* is_keyboard_shortcut);
@@ -691,9 +682,6 @@ class RenderViewHost : public RenderWidgetHost {
   // The enabled/disabled states of various commands.
   std::map<RenderViewCommand, CommandState> command_states_;
 
-  // A list of observers that filter messages.  Weak references.
-  ObserverList<RenderViewHostObserver> observers_;
-
   DISALLOW_COPY_AND_ASSIGN(RenderViewHost);
 };
 
diff --git a/content/browser/renderer_host/render_view_host_delegate.cc b/content/browser/renderer_host/render_view_host_delegate.cc
index bd1f5bd..2d56531 100644
--- a/content/browser/renderer_host/render_view_host_delegate.cc
+++ b/content/browser/renderer_host/render_view_host_delegate.cc
@@ -71,8 +71,3 @@ WebPreferences RenderViewHostDelegate::GetWebkitPrefs() {
 bool RenderViewHostDelegate::IsExternalTabContainer() const {
   return false;
 }
-
-bool RenderViewHostDelegate::RequestDesktopNotificationPermission(
-    const GURL& source_origin, int callback_context) {
-  return false;
-}
diff --git a/content/browser/renderer_host/render_view_host_delegate.h b/content/browser/renderer_host/render_view_host_delegate.h
index f4f0783..3fcc384 100644
--- a/content/browser/renderer_host/render_view_host_delegate.h
+++ b/content/browser/renderer_host/render_view_host_delegate.h
@@ -567,12 +567,6 @@ class RenderViewHostDelegate : public IPC::Channel::Listener {
   // Notification that a worker process has crashed.
   void WorkerCrashed() {}
 
-  // Ask the user if they want to allow the view to show desktop notifications.
-  // Returns true if the delegate will take care of asking the user, otherwise
-  // the caller will do the default behavior.
-  bool RequestDesktopNotificationPermission(const GURL& source_origin,
-                                            int callback_context);
-
  protected:
   virtual ~RenderViewHostDelegate() {}
 };
diff --git a/content/browser/renderer_host/render_view_host_observer.cc b/content/browser/renderer_host/render_view_host_observer.cc
deleted file mode 100644
index e60e2bb..0000000
--- a/content/browser/renderer_host/render_view_host_observer.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/renderer_host/render_view_host_observer.h"
-
-#include "content/browser/renderer_host/render_view_host.h"
-
-RenderViewHostObserver::RenderViewHostObserver(RenderViewHost* render_view_host)
-    : render_view_host_(render_view_host),
-      routing_id_(render_view_host->routing_id()) {
-  render_view_host_->AddObserver(this);
-}
-
-RenderViewHostObserver::~RenderViewHostObserver() {
-  if (render_view_host_)
-    render_view_host_->RemoveObserver(this);
-}
-
-void RenderViewHostObserver::RenderViewHostDestroyed() {
-  delete this;
-}
-
-bool RenderViewHostObserver::OnMessageReceived(const IPC::Message& message) {
-  return false;
-}
-
-bool RenderViewHostObserver::Send(IPC::Message* message) {
-  if (!render_view_host_) {
-    delete message;
-    return false;
-  }
-
-  return render_view_host_->Send(message);
-}
-
-void RenderViewHostObserver::RenderViewHostDestruction() {
-  render_view_host_->RemoveObserver(this);
-  RenderViewHostDestroyed();
-  render_view_host_ = NULL;
-}
diff --git a/content/browser/renderer_host/render_view_host_observer.h b/content/browser/renderer_host/render_view_host_observer.h
deleted file mode 100644
index 2f63935..0000000
--- a/content/browser/renderer_host/render_view_host_observer.h
+++ /dev/null
@@ -1,51 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_OBSERVER_H_
-#define CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_OBSERVER_H_
-
-#include "ipc/ipc_channel.h"
-
-class RenderViewHost;
-
-// An observer API implemented by classes which want to filter IPC messages from
-// RenderViewHost.
-class RenderViewHostObserver : public IPC::Channel::Listener,
-                               public IPC::Message::Sender {
- public:
-
- protected:
-  explicit RenderViewHostObserver(RenderViewHost* render_view_host);
-
-  virtual ~RenderViewHostObserver();
-
-  // Invoked when the RenderViewHost is being destroyed. Gives subclasses a
-  // chance to cleanup.  The base implementation will delete the object.
-  virtual void RenderViewHostDestroyed();
-
-  // IPC::Channel::Listener implementation.
-  virtual bool OnMessageReceived(const IPC::Message& message);
-
-  // IPC::Message::Sender implementation.
-  virtual bool Send(IPC::Message* message);
-
-  RenderViewHost* render_view_host() const { return render_view_host_; }
-  int routing_id() { return routing_id_; }
-
- private:
-  friend class RenderViewHost;
-
-  // Invoked from RenderViewHost. Invokes RenderViewHostDestroyed and NULL out
-  // |render_view_host_|.
-  void RenderViewHostDestruction();
-
-  RenderViewHost* render_view_host_;
-
-  // The routing ID of the associated RenderViewHost.
-  int routing_id_;
-
-  DISALLOW_COPY_AND_ASSIGN(RenderViewHostObserver);
-};
-
-#endif  // CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_OBSERVER_H_
diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index 1842c02..ebee41c 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -22,6 +22,7 @@
 #include "chrome/browser/content_settings/host_content_settings_map.h"
 #include "chrome/browser/debugger/devtools_manager.h"
 #include "chrome/browser/defaults.h"
+#include "chrome/browser/desktop_notification_handler.h"
 #include "chrome/browser/dom_operation_notification_details.h"
 #include "chrome/browser/download/download_item_model.h"
 #include "chrome/browser/download/download_manager.h"
@@ -35,7 +36,6 @@
 #include "chrome/browser/load_notification_details.h"
 #include "chrome/browser/metrics/metric_event_duration_details.h"
 #include "chrome/browser/metrics/user_metrics.h"
-#include "chrome/browser/notifications/desktop_notification_service.h"
 #include "chrome/browser/omnibox_search_hint.h"
 #include "chrome/browser/pdf_unsupported_feature.h"
 #include "chrome/browser/platform_util.h"
@@ -372,6 +372,8 @@ TabContents::~TabContents() {
 
 void TabContents::AddObservers() {
   favicon_helper_.reset(new FaviconHelper(this));
+  desktop_notification_handler_.reset(
+      new DesktopNotificationHandlerForTC(this, GetRenderProcessHost()));
   plugin_observer_.reset(new PluginObserver(this));
   safebrowsing_detection_host_.reset(new safe_browsing::ClientSideDetectionHost(
       this));
@@ -2424,15 +2426,6 @@ void TabContents::WorkerCrashed() {
     delegate()->WorkerCrashed();
 }
 
-void TabContents::RequestDesktopNotificationPermission(
-    const GURL& source_origin, int callback_context) {
-  DesktopNotificationService* service =
-      profile()->GetDesktopNotificationService();
-  service->RequestPermission(
-      source_origin, GetRenderProcessHost()->id(),
-      render_view_host()->routing_id(), callback_context, this);
-}
-
 void TabContents::BeforeUnloadFiredFromRenderManager(
     bool proceed,
     bool* proceed_to_fire_unload) {
diff --git a/content/browser/tab_contents/tab_contents.h b/content/browser/tab_contents/tab_contents.h
index e55f49d..b458293 100644
--- a/content/browser/tab_contents/tab_contents.h
+++ b/content/browser/tab_contents/tab_contents.h
@@ -60,6 +60,7 @@ class ClientSideDetectionHost;
 
 class BlockedContentContainer;
 class WebUI;
+class DesktopNotificationHandlerForTC;
 class DownloadItem;
 class Extension;
 class InfoBarDelegate;
@@ -893,8 +894,6 @@ class TabContents : public PageNavigator,
                                 int maximum_percent,
                                 bool remember);
   virtual void WorkerCrashed();
-  virtual void RequestDesktopNotificationPermission(const GURL& source_origin,
-                                                    int callback_context);
 
   // RenderViewHostManager::Delegate -------------------------------------------
 
@@ -981,6 +980,9 @@ class TabContents : public PageNavigator,
   // RenderViewHost::ContentSettingsDelegate.
   scoped_ptr<TabSpecificContentSettings> content_settings_delegate_;
 
+  // Handles desktop notification IPCs.
+  scoped_ptr<DesktopNotificationHandlerForTC> desktop_notification_handler_;
+
   // Handles IPCs related to SafeBrowsing client-side phishing detection.
   scoped_ptr<safe_browsing::ClientSideDetectionHost>
       safebrowsing_detection_host_;
diff --git a/content/content_browser.gypi b/content/content_browser.gypi
index f1df8aa..de3cf83 100644
--- a/content/content_browser.gypi
+++ b/content/content_browser.gypi
@@ -234,8 +234,6 @@
         'browser/renderer_host/render_view_host_factory.cc',
         'browser/renderer_host/render_view_host_factory.h',
         'browser/renderer_host/render_view_host_notification_task.h',
-        'browser/renderer_host/render_view_host_observer.cc',
-        'browser/renderer_host/render_view_host_observer.h',
         'browser/renderer_host/render_widget_fullscreen_host.cc',
         'browser/renderer_host/render_widget_fullscreen_host.h',
         'browser/renderer_host/render_widget_helper.cc',