Revert r15940 again. Unexpected layout test failures :(

TBR=mpcomplete


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@15942 0039d316-1c4b-4281-b951-d872f2087c98

19 files changed, 307 insertions, 78 deletions

diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index 769c6d1..90882c1 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -600,7 +600,7 @@ IPC_BEGIN_MESSAGES(ViewHost)
                               int /* route_id */,
                               ModalDialogEvent /* modal_dialog_event */)
 
-  // Similar to ViewHostMsg_CreateWindow, except used for sub-widgets, like
+  // Similar to ViewHostMsg_CreateView, except used for sub-widgets, like
   // <select> dropdowns.  This message is sent to the TabContents that
   // contains the widget being created.
   IPC_SYNC_MESSAGE_CONTROL2_1(ViewHostMsg_CreateWidget,
@@ -609,7 +609,7 @@ IPC_BEGIN_MESSAGES(ViewHost)
                               int /* route_id */)
 
   // These two messages are sent to the parent RenderViewHost to display the
-  // page/widget that was created by CreateWindow/CreateWidget.  routing_id
+  // page/widget that was created by CreateView/CreateWidget.  routing_id
   // refers to the id that was returned from the Create message above.
   // The initial_position parameter is a rectangle in screen coordinates.
   //
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index b8dff80..979f74f 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -68,6 +68,7 @@
 #include "webkit/glue/webdropdata.h"
 #include "webkit/glue/weberror.h"
 #include "webkit/glue/webframe.h"
+#include "webkit/glue/webhistoryitem.h"
 #include "webkit/glue/webkit_glue.h"
 #include "webkit/glue/webpreferences.h"
 #include "webkit/glue/webplugin_delegate.h"
@@ -1560,6 +1561,13 @@ WindowOpenDisposition RenderView::DispositionForNavigationAction(
           url.SchemeIs(chrome::kViewSourceScheme)) {
         OpenURL(webview, url, GURL(), disposition);
         return IGNORE_ACTION;  // Suppress the load here.
+      } else if (url.SchemeIs(kBackForwardNavigationScheme)) {
+        std::string offset_str = url.ExtractFileName();
+        int offset;
+        if (StringToInt(offset_str, &offset)) {
+          GoToEntryAtOffset(offset);
+          return IGNORE_ACTION;  // The browser process handles this one.
+        }
       }
     }
   }
@@ -2437,7 +2445,20 @@ void RenderView::OnAutofillFormSubmitted(WebView* webview,
   Send(new ViewHostMsg_AutofillFormSubmitted(routing_id_, form));
 }
 
-void RenderView::NavigateBackForwardSoon(int offset) {
+WebHistoryItem* RenderView::GetHistoryEntryAtOffset(int offset) {
+  // Our history list is kept in the browser process on the UI thread.  Since
+  // we can't make a sync IPC call to that thread without risking deadlock,
+  // we use a trick: construct a fake history item of the form:
+  //   history://go/OFFSET
+  // When WebCore tells us to navigate to it, we tell the browser process to
+  // do a back/forward navigation instead.
+
+  GURL url(StringPrintf("%s://go/%d", kBackForwardNavigationScheme, offset));
+  history_navigation_item_ = WebHistoryItem::Create(url, L"", "", NULL);
+  return history_navigation_item_.get();
+}
+
+void RenderView::GoToEntryAtOffset(int offset) {
   history_back_list_count_ += offset;
   history_forward_list_count_ -= offset;
 
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index 436772c..a993327 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -279,7 +279,7 @@ class RenderView : public RenderWidget,
   virtual void TakeFocus(WebView* webview, bool reverse);
   virtual void JSOutOfMemory();
 
-  virtual void NavigateBackForwardSoon(int offset);
+  virtual WebHistoryItem* GetHistoryEntryAtOffset(int offset);
   virtual int GetHistoryBackListCount();
   virtual int GetHistoryForwardListCount();
   virtual void OnNavStateChanged(WebView* webview);
@@ -463,6 +463,10 @@ class RenderView : public RenderWidget,
   // keyword search.
   void AddGURLSearchProvider(const GURL& osd_url, bool autodetected);
 
+  // Tells the browser process to navigate to a back/forward entry at the given
+  // offset from current.
+  void GoToEntryAtOffset(int offset);
+
   // RenderView IPC message handlers
   void SendThumbnail();
   void OnPrintPages();
@@ -766,6 +770,11 @@ class RenderView : public RenderWidget,
   // out of date responses.
   int form_field_autofill_request_id_;
 
+  // A cached WebHistoryItem used for back/forward navigations initiated by
+  // WebCore (via the window.history.go API).  We only have one such navigation
+  // pending at a time.
+  scoped_refptr<WebHistoryItem> history_navigation_item_;
+
   // We need to prevent windows from closing themselves with a window.close()
   // call while a blocked popup notification is being displayed. We cannot
   // synchronously query the Browser process. We cannot wait for the Browser
diff --git a/webkit/glue/back_forward_list_client_impl.cc b/webkit/glue/back_forward_list_client_impl.cc
index ec24804..99149d1 100644
--- a/webkit/glue/back_forward_list_client_impl.cc
+++ b/webkit/glue/back_forward_list_client_impl.cc
@@ -8,12 +8,11 @@
 #undef LOG
 
 #include "webkit/glue/back_forward_list_client_impl.h"
+#include "webkit/glue/webhistoryitem_impl.h"
 #include "webkit/glue/webview_impl.h"
 
 namespace webkit_glue {
 
-const char kBackForwardNavigationScheme[] = "chrome-back-forward";
-
 BackForwardListClientImpl::BackForwardListClientImpl(WebViewImpl* webview)
     : webview_(webview) {
 }
@@ -48,8 +47,15 @@ void BackForwardListClientImpl::goToItem(WebCore::HistoryItem* item) {
   previous_item_ = current_item_;
   current_item_ = item;
 
-  if (pending_history_item_ == item)
-    pending_history_item_ = NULL;
+  if (pending_history_item_) {
+    if (item == pending_history_item_->GetHistoryItem()) {
+      // Let the main frame know this HistoryItem is loading, so it can cache
+      // any ExtraData when the DataSource is created.
+      webview_->main_frame()->set_currently_loading_history_item(
+          pending_history_item_);
+      pending_history_item_ = NULL;
+    }
+  }
 }
 
 WebCore::HistoryItem* BackForwardListClientImpl::currentItem() {
@@ -60,21 +66,14 @@ WebCore::HistoryItem* BackForwardListClientImpl::itemAtIndex(int index) {
   if (!webview_->delegate())
     return NULL;
 
-  // Since we don't keep the entire back/forward list, we have no way to
-  // properly implement this method.  We return a dummy entry instead that we
-  // intercept in our FrameLoaderClient implementation in case WebCore asks
-  // to navigate to this HistoryItem.
-
-  // TODO(darin): We should change WebCore to handle history.{back,forward,go}
-  // differently.  It should perhaps just ask the FrameLoaderClient to perform
-  // those navigations.
-
-  WebCore::String url_string = WebCore::String::format(
-      "%s://go/%d", kBackForwardNavigationScheme, index);
+  WebHistoryItem* item = webview_->delegate()->GetHistoryEntryAtOffset(index);
+  if (!item)
+    return NULL;
 
-  pending_history_item_ =
-      WebCore::HistoryItem::create(url_string, WebCore::String(), 0.0);
-  return pending_history_item_.get();
+  // If someone has asked for a history item, we probably want to navigate to
+  // it soon.  Keep track of it until goToItem is called.
+  pending_history_item_ = static_cast<WebHistoryItemImpl*>(item);
+  return pending_history_item_->GetHistoryItem();
 }
 
 int BackForwardListClientImpl::backListCount() {
diff --git a/webkit/glue/back_forward_list_client_impl.h b/webkit/glue/back_forward_list_client_impl.h
index 45ad379..1a26c35 100644
--- a/webkit/glue/back_forward_list_client_impl.h
+++ b/webkit/glue/back_forward_list_client_impl.h
@@ -9,12 +9,11 @@
 
 #include "base/ref_counted.h"
 
+class WebHistoryItemImpl;
 class WebViewImpl;
 
 namespace webkit_glue {
 
-extern const char kBackForwardNavigationScheme[];
-
 class BackForwardListClientImpl : public WebCore::BackForwardListClient {
  public:
   BackForwardListClientImpl(WebViewImpl* webview);
@@ -40,7 +39,7 @@ class BackForwardListClientImpl : public WebCore::BackForwardListClient {
 
   // The last history item that was accessed via itemAtIndex().  We keep track
   // of this until goToItem() is called, so we can track the navigation.
-  RefPtr<WebCore::HistoryItem> pending_history_item_;
+  scoped_refptr<WebHistoryItemImpl> pending_history_item_;
 };
 
 } // namespace webkit_glue
diff --git a/webkit/glue/webframe_impl.cc b/webkit/glue/webframe_impl.cc
index 6976573..834f4a8 100644
--- a/webkit/glue/webframe_impl.cc
+++ b/webkit/glue/webframe_impl.cc
@@ -154,6 +154,7 @@ MSVC_POP_WARNING();
 #include "webkit/glue/webdatasource_impl.h"
 #include "webkit/glue/weberror_impl.h"
 #include "webkit/glue/webframe_impl.h"
+#include "webkit/glue/webhistoryitem_impl.h"
 #include "webkit/glue/weburlrequest_impl.h"
 #include "webkit/glue/webtextinput_impl.h"
 #include "webkit/glue/webview_impl.h"
@@ -664,15 +665,25 @@ void WebFrameImpl::CacheCurrentRequestInfo(WebDataSourceImpl* datasource) {
   // own requests, so the extra data needs to be transferred.
   scoped_refptr<WebRequest::ExtraData> extra;
 
-  // Our extra data may come from a request issued via LoadRequest.
-  if (currently_loading_request_)
+  // Our extra data may come from a request issued via LoadRequest, or a
+  // history navigation from WebCore.
+  if (currently_loading_request_) {
     extra = currently_loading_request_->GetExtraData();
+  } else if (currently_loading_history_item_) {
+    extra = currently_loading_history_item_->GetExtraData();
+    currently_loading_history_item_ = 0;
+  }
 
   // We must only update this if it is valid, or the valid state will be lost.
   if (extra)
     datasource->SetExtraData(extra);
 }
 
+void WebFrameImpl::set_currently_loading_history_item(
+    WebHistoryItemImpl* item) {
+  currently_loading_history_item_ = item;
+}
+
 void WebFrameImpl::StopLoading() {
   if (!frame_)
     return;
diff --git a/webkit/glue/webframe_impl.h b/webkit/glue/webframe_impl.h
index 45cdc91..fe7e3ef 100644
--- a/webkit/glue/webframe_impl.h
+++ b/webkit/glue/webframe_impl.h
@@ -43,6 +43,7 @@ class AltErrorPageResourceFetcher;
 class ChromePrintContext;
 class WebDataSourceImpl;
 class WebErrorImpl;
+class WebHistoryItemImpl;
 class WebPluginDelegate;
 class WebRequest;
 class WebView;
@@ -225,6 +226,8 @@ class WebFrameImpl : public WebFrame, public base::RefCounted<WebFrameImpl> {
   // If currently_loading_request is NULL, does nothing.
   void CacheCurrentRequestInfo(WebDataSourceImpl* datasource);
 
+  void set_currently_loading_history_item(WebHistoryItemImpl* item);
+
   // Getters for the impls corresponding to Get(Provisional)DataSource. They
   // may return NULL if there is no corresponding data source.
   WebDataSourceImpl* GetDataSourceImpl() const;
@@ -307,6 +310,10 @@ class WebFrameImpl : public WebFrame, public base::RefCounted<WebFrameImpl> {
   // information to him.  Only non-NULL during a call to LoadRequest.
   const WebRequest* currently_loading_request_;
 
+  // Similar to currently_loading_request_, except this will be set when
+  // WebCore initiates a history navigation (probably via javascript).
+  scoped_refptr<WebHistoryItemImpl> currently_loading_history_item_;
+
   // Plugins sometimes need to be notified when loads are complete so we keep
   // a pointer back to the appropriate plugin.
   WebPluginDelegate* plugin_delegate_;
diff --git a/webkit/glue/webframeloaderclient_impl.cc b/webkit/glue/webframeloaderclient_impl.cc
index b401d15..0ed8a39 100644
--- a/webkit/glue/webframeloaderclient_impl.cc
+++ b/webkit/glue/webframeloaderclient_impl.cc
@@ -56,6 +56,7 @@ MSVC_POP_WARNING();
 #include "webkit/glue/webdevtoolsagent_impl.h"
 #include "webkit/glue/weberror_impl.h"
 #include "webkit/glue/webframeloaderclient_impl.h"
+#include "webkit/glue/webhistoryitem_impl.h"
 #include "webkit/glue/webkit_glue.h"
 #include "webkit/glue/webplugin_impl.h"
 #include "webkit/glue/webresponse_impl.h"
@@ -786,6 +787,16 @@ void WebFrameLoaderClient::dispatchDidStartProvisionalLoad() {
     alt_404_page_fetcher_->Cancel();
 }
 
+NavigationGesture WebFrameLoaderClient::NavigationGestureForLastLoad() {
+  // TODO(timsteele): userGestureHint returns too many false positives
+  // (see bug 1051891) to trust it and assign NavigationGestureUser, so
+  // for now we assign Unknown in those cases and Auto otherwise.
+  // (Issue 874811 known false negative as well).
+  return webframe_->frame()->loader()->userGestureHint() ?
+      NavigationGestureUnknown :
+      NavigationGestureAuto;
+}
+
 void WebFrameLoaderClient::dispatchDidReceiveTitle(const String& title) {
   WebViewImpl* webview = webframe_->GetWebViewImpl();
   WebViewDelegate* d = webview->delegate();
@@ -1010,19 +1021,13 @@ void WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(
     // such navigations.
     const WebDataSourceImpl* ds = webframe_->GetProvisionalDataSourceImpl();
     if (ds) {
-      const GURL& url = ds->GetRequest().GetURL();
-      if (url.SchemeIs(webkit_glue::kBackForwardNavigationScheme)) {
-        HandleBackForwardNavigation(url);
-        disposition = IGNORE_ACTION;
-      } else {
-        bool is_redirect = !ds->GetRedirectChain().empty();
+      bool is_redirect = !ds->GetRedirectChain().empty();
 
-        WebNavigationType webnav_type =
-            WebDataSourceImpl::NavigationTypeToWebNavigationType(action.type());
+      WebNavigationType webnav_type =
+          WebDataSourceImpl::NavigationTypeToWebNavigationType(action.type());
 
-        disposition = d->DispositionForNavigationAction(
-            wv, webframe_, &ds->GetRequest(), webnav_type, disposition, is_redirect);
-      }
+      disposition = d->DispositionForNavigationAction(
+          wv, webframe_, &ds->GetRequest(), webnav_type, disposition, is_redirect);
 
       if (disposition != IGNORE_ACTION) {
         if (disposition == CURRENT_TAB) {
@@ -1632,29 +1637,6 @@ bool WebFrameLoaderClient::ActionSpecifiesDisposition(
   return true;
 }
 
-NavigationGesture WebFrameLoaderClient::NavigationGestureForLastLoad() {
-  // TODO(timsteele): userGestureHint returns too many false positives
-  // (see bug 1051891) to trust it and assign NavigationGestureUser, so
-  // for now we assign Unknown in those cases and Auto otherwise.
-  // (Issue 874811 known false negative as well).
-  return webframe_->frame()->loader()->userGestureHint() ?
-      NavigationGestureUnknown :
-      NavigationGestureAuto;
-}
-
-void WebFrameLoaderClient::HandleBackForwardNavigation(const GURL& url) {
-  DCHECK(url.SchemeIs(webkit_glue::kBackForwardNavigationScheme));
-
-  std::string offset_str = url.ExtractFileName();
-  int offset;
-  if (!StringToInt(offset_str, &offset))
-    return;
-
-  WebViewDelegate* d = webframe_->GetWebViewImpl()->delegate();
-  if (d)
-    d->NavigateBackForwardSoon(offset);
-}
-
 NetAgentImpl* WebFrameLoaderClient::GetNetAgentImpl() {
   WebViewImpl* web_view = webframe_->GetWebViewImpl();
   if (!web_view) {
diff --git a/webkit/glue/webframeloaderclient_impl.h b/webkit/glue/webframeloaderclient_impl.h
index f616aee..ec51ea8 100644
--- a/webkit/glue/webframeloaderclient_impl.h
+++ b/webkit/glue/webframeloaderclient_impl.h
@@ -220,9 +220,6 @@ class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
   // otherwise returns NavigationGestureUnknown.
   NavigationGesture NavigationGestureForLastLoad();
 
-  // Called when a dummy back-forward navigation is intercepted.
-  void HandleBackForwardNavigation(const GURL&);
-
   // Returns NetAgent instance if network tracking is enabled.
   NetAgentImpl* GetNetAgentImpl();
 
diff --git a/webkit/glue/webhistoryitem.h b/webkit/glue/webhistoryitem.h
new file mode 100644
index 0000000..6757211
--- /dev/null
+++ b/webkit/glue/webhistoryitem.h
@@ -0,0 +1,39 @@
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WEBKIT_GLUE_WEBHISTORYITEM_H_
+#define WEBKIT_GLUE_WEBHISTORYITEM_H_
+
+#include "webkit/glue/weburlrequest.h"  // for WebRequest::ExtraData
+
+class GURL;
+
+class WebHistoryItem : public base::RefCounted<WebHistoryItem> {
+ public:
+  // Create a new history item.
+  static WebHistoryItem* Create(const GURL& url,
+                                const std::wstring& title,
+                                const std::string& history_state,
+                                WebRequest::ExtraData* extra_data);
+
+  WebHistoryItem() { }
+  virtual ~WebHistoryItem() { }
+
+  // Returns the URL.
+  virtual const GURL& GetURL() const = 0;
+
+  // Returns the title.
+  virtual const std::wstring& GetTitle() const = 0;
+
+  // Returns the string representation of the history state for this entry.
+  virtual const std::string& GetHistoryState() const = 0;
+
+  // Returns any ExtraData associated with this history entry.
+  virtual WebRequest::ExtraData* GetExtraData() const = 0;
+
+ private:
+  DISALLOW_EVIL_CONSTRUCTORS(WebHistoryItem);
+};
+
+#endif  // #ifndef WEBKIT_GLUE_WEBHISTORYITEM_H_
diff --git a/webkit/glue/webhistoryitem_impl.cc b/webkit/glue/webhistoryitem_impl.cc
new file mode 100644
index 0000000..c381eed
--- /dev/null
+++ b/webkit/glue/webhistoryitem_impl.cc
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "webkit/glue/webhistoryitem_impl.h"
+
+#include "webkit/glue/glue_serialize.h"
+#include "webkit/glue/glue_util.h"
+
+#include "base/compiler_specific.h"
+
+MSVC_PUSH_WARNING_LEVEL(0);
+#include "HistoryItem.h"
+MSVC_POP_WARNING();
+
+
+WebHistoryItem* WebHistoryItem::Create(const GURL& url,
+                                       const std::wstring& title,
+                                       const std::string& history_state,
+                                       WebRequest::ExtraData* extra_data) {
+  return new WebHistoryItemImpl(url, title, history_state, extra_data);
+}
+
+WebHistoryItemImpl::WebHistoryItemImpl(const GURL& url,
+                                       const std::wstring& title,
+                                       const std::string& history_state,
+                                       WebRequest::ExtraData* extra_data) :
+    url_(url),
+    title_(title),
+    history_state_(history_state),
+    history_item_(NULL),
+    extra_data_(extra_data) {
+}
+
+WebHistoryItemImpl::~WebHistoryItemImpl() {
+}
+
+const std::wstring& WebHistoryItemImpl::GetTitle() const {
+  return title_;
+}
+
+const std::string& WebHistoryItemImpl::GetHistoryState() const {
+  return history_state_;
+}
+
+WebRequest::ExtraData* WebHistoryItemImpl::GetExtraData() const {
+  return extra_data_.get();
+}
+
+WebCore::HistoryItem* WebHistoryItemImpl::GetHistoryItem() const {
+  if (history_item_)
+    return history_item_.get();
+
+  if (history_state_.size() > 0) {
+    history_item_ = webkit_glue::HistoryItemFromString(history_state_);
+  } else {
+    history_item_ = WebCore::HistoryItem::create(
+      webkit_glue::StdStringToString(url_.spec()),
+      webkit_glue::StdWStringToString(title_),
+      0.0);
+  }
+
+  return history_item_.get();
+}
+
+const GURL& WebHistoryItemImpl::GetURL() const {
+  return url_;
+}
diff --git a/webkit/glue/webhistoryitem_impl.h b/webkit/glue/webhistoryitem_impl.h
new file mode 100644
index 0000000..b28fb91
--- /dev/null
+++ b/webkit/glue/webhistoryitem_impl.h
@@ -0,0 +1,47 @@
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WEBKIT_GLUE_WEBHISTORYITEM_IMPL_H_
+#define WEBKIT_GLUE_WEBHISTORYITEM_IMPL_H_
+
+#include "webkit/glue/webhistoryitem.h"
+#include "googleurl/src/gurl.h"
+
+#include "RefPtr.h"
+
+namespace WebCore {
+  class HistoryItem;
+}
+
+class WebHistoryItemImpl : public WebHistoryItem {
+ public:
+  WebHistoryItemImpl(const GURL& url,
+                     const std::wstring& title,
+                     const std::string& history_state,
+                     WebRequest::ExtraData* extra_data);
+  virtual ~WebHistoryItemImpl();
+
+  // WebHistoryItem
+  virtual const GURL& GetURL() const;
+  virtual const std::wstring& GetTitle() const;
+  virtual const std::string& GetHistoryState() const;
+  virtual WebRequest::ExtraData* GetExtraData() const;
+
+  // WebHistoryItemImpl
+  // Returns a WebCore::HistoryItem based on the history_state.  This is
+  // lazily-created and cached.
+  WebCore::HistoryItem* GetHistoryItem() const;
+
+ protected:
+  GURL url_;
+  std::wstring title_;
+  std::string history_state_;
+  mutable RefPtr<WebCore::HistoryItem> history_item_;
+  scoped_refptr<WebRequest::ExtraData> extra_data_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(WebHistoryItemImpl);
+};
+
+#endif  // #ifndef WEBKIT_GLUE_WEBHISTORYITEM_IMPL_H_
diff --git a/webkit/glue/webview_delegate.h b/webkit/glue/webview_delegate.h
index 525f745..186940b 100644
--- a/webkit/glue/webview_delegate.h
+++ b/webkit/glue/webview_delegate.h
@@ -55,6 +55,7 @@ class SkBitmap;
 class WebDevToolsAgentDelegate;
 class WebError;
 class WebFrame;
+class WebHistoryItem;
 class WebMediaPlayerDelegate;
 class WebPluginDelegate;
 class WebRequest;
@@ -701,9 +702,10 @@ class WebViewDelegate : virtual public WebWidgetDelegate {
 
   // History Related ---------------------------------------------------------
 
-  // Tells the embedder to navigate back or forward in session history by the
-  // given offset (relative to the current position in session history).
-  virtual void NavigateBackForwardSoon(int offset) {
+  // Returns the session history entry at a distance |offset| relative to the
+  // current entry.  Returns NULL on failure.
+  virtual WebHistoryItem* GetHistoryEntryAtOffset(int offset) {
+    return NULL;
   }
 
   // Returns how many entries are in the back and forward lists, respectively.
diff --git a/webkit/glue/webview_impl.cc b/webkit/glue/webview_impl.cc
index 53d0511..6830fd8 100644
--- a/webkit/glue/webview_impl.cc
+++ b/webkit/glue/webview_impl.cc
@@ -100,6 +100,7 @@ MSVC_POP_WARNING();
 #include "webkit/glue/searchable_form_data.h"
 #include "webkit/glue/webdevtoolsagent_impl.h"
 #include "webkit/glue/webdropdata.h"
+#include "webkit/glue/webhistoryitem_impl.h"
 #include "webkit/glue/webkit_glue.h"
 #include "webkit/glue/webpreferences.h"
 #include "webkit/glue/webdevtoolsagent.h"
diff --git a/webkit/tools/test_shell/test_navigation_controller.cc b/webkit/tools/test_shell/test_navigation_controller.cc
index cf26baf..ff4a753 100644
--- a/webkit/tools/test_shell/test_navigation_controller.cc
+++ b/webkit/tools/test_shell/test_navigation_controller.cc
@@ -5,6 +5,7 @@
 #include "webkit/tools/test_shell/test_navigation_controller.h"
 
 #include "base/logging.h"
+#include "webkit/glue/webhistoryitem.h"
 #include "webkit/tools/test_shell/test_shell.h"
 
 // ----------------------------------------------------------------------------
@@ -28,9 +29,21 @@ TestNavigationEntry::~TestNavigationEntry() {
 }
 
 void TestNavigationEntry::SetContentState(const std::string& state) {
+  cached_history_item_ = NULL;  // invalidate our cached item
   state_ = state;
 }
 
+WebHistoryItem* TestNavigationEntry::GetHistoryItem() const {
+  if (!cached_history_item_) {
+    TestShellExtraRequestData* extra_data =
+        new TestShellExtraRequestData(GetPageID());
+    cached_history_item_ =
+        WebHistoryItem::Create(GetURL(), GetTitle(), GetContentState(),
+                               extra_data);
+  }
+  return cached_history_item_;
+}
+
 // ----------------------------------------------------------------------------
 // TestNavigationController
 
diff --git a/webkit/tools/test_shell/test_navigation_controller.h b/webkit/tools/test_shell/test_navigation_controller.h
index e24fff30..07f42f8 100644
--- a/webkit/tools/test_shell/test_navigation_controller.h
+++ b/webkit/tools/test_shell/test_navigation_controller.h
@@ -16,6 +16,7 @@
 
 class GURL;
 class TestShell;
+class WebHistoryItem;
 
 // Associated with browser-initated navigations to hold tracking data.
 class TestShellExtraRequestData : public WebRequest::ExtraData {
@@ -66,6 +67,7 @@ class TestNavigationEntry {
   void SetPageID(int page_id) { page_id_ = page_id; }
   int32 GetPageID() const { return page_id_; }
 
+  WebHistoryItem* GetHistoryItem() const;
   const std::wstring& GetTargetFrame() const { return target_frame_; }
 
  private:
@@ -77,6 +79,8 @@ class TestNavigationEntry {
   std::wstring title_;
   std::string state_;
 
+  mutable scoped_refptr<WebHistoryItem> cached_history_item_;
+
   std::wstring target_frame_;
 
   DISALLOW_COPY_AND_ASSIGN(TestNavigationEntry);
diff --git a/webkit/tools/test_shell/test_webview_delegate.cc b/webkit/tools/test_shell/test_webview_delegate.cc
index c72683c..092b2a56 100644
--- a/webkit/tools/test_shell/test_webview_delegate.cc
+++ b/webkit/tools/test_shell/test_webview_delegate.cc
@@ -115,14 +115,6 @@ WebWidget* TestWebViewDelegate::CreatePopupWidget(WebView* webview,
   return shell_->CreatePopupWidget(webview);
 }
 
-WebWorker* TestWebViewDelegate::CreateWebWorker(WebWorkerClient* client) {
-#if ENABLE(WORKERS)
-  return TestWebWorkerHelper::CreateWebWorker(client);
-#else
-  return NULL;
-#endif
-}
-
 void TestWebViewDelegate::OpenURL(WebView* webview, const GURL& url,
                                   const GURL& referrer,
                                   WindowOpenDisposition disposition) {
@@ -669,8 +661,13 @@ void TestWebViewDelegate::DidEndEditing() {
   }
 }
 
-void TestWebViewDelegate::NavigateBackForwardSoon(int offset) {
-  shell_->navigation_controller()->GoToOffset(offset);
+WebHistoryItem* TestWebViewDelegate::GetHistoryEntryAtOffset(int offset) {
+  TestNavigationEntry* entry = static_cast<TestNavigationEntry*>(
+      shell_->navigation_controller()->GetEntryAtOffset(offset));
+  if (!entry)
+    return NULL;
+
+  return entry->GetHistoryItem();
 }
 
 int TestWebViewDelegate::GetHistoryBackListCount() {
@@ -891,3 +888,11 @@ std::wstring TestWebViewDelegate::GetFrameDescription(WebFrame* webframe) {
       return L"frame (anonymous)";
   }
 }
+
+WebWorker* TestWebViewDelegate::CreateWebWorker(WebWorkerClient* client) {
+#if ENABLE(WORKERS)
+  return TestWebWorkerHelper::CreateWebWorker(client);
+#else
+  return NULL;
+#endif
+}
diff --git a/webkit/tools/test_shell/test_webview_delegate.h b/webkit/tools/test_shell/test_webview_delegate.h
index 16db870..0c5ef3b 100644
--- a/webkit/tools/test_shell/test_webview_delegate.h
+++ b/webkit/tools/test_shell/test_webview_delegate.h
@@ -207,7 +207,7 @@ class TestWebViewDelegate : public base::RefCounted<TestWebViewDelegate>,
     WebNavigationType type,
     WindowOpenDisposition disposition,
     bool is_redirect);
-  virtual void NavigateBackForwardSoon(int offset);
+  virtual WebHistoryItem* GetHistoryEntryAtOffset(int offset);
   virtual int GetHistoryBackListCount();
   virtual int GetHistoryForwardListCount();
 
diff --git a/webkit/webkit.gyp b/webkit/webkit.gyp
index 2228e48..c7a8eda 100644
--- a/webkit/webkit.gyp
+++ b/webkit/webkit.gyp
@@ -4530,6 +4530,9 @@
         'glue/webframe_impl.h',
         'glue/webframeloaderclient_impl.cc',
         'glue/webframeloaderclient_impl.h',
+        'glue/webhistoryitem.h',
+        'glue/webhistoryitem_impl.cc',
+        'glue/webhistoryitem_impl.h',
         'glue/webkit_glue.cc',
         'glue/webkit_glue.h',
         'glue/webkitclient_impl.cc',