Load NPAPI plugin resources through the browser process directly instead of going through the renderer. This is needed because when we have site isolation enabled we won't trust the renderer to fetch urls from arbitrary origins, which is something that NPAPI plugins can do.

In a followup I'll implement range requests.

For now this is behind the --direct-npapi-requests flag.

BUG=286074
R=ananta@chromium.org, jschuh@chromium.org

Review URL: https://codereview.chromium.org/23503043

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@222602 0039d316-1c4b-4281-b951-d872f2087c98

32 files changed, 722 insertions, 216 deletions

diff --git a/content/browser/loader/resource_request_info_impl.cc b/content/browser/loader/resource_request_info_impl.cc
index e7b2828..c41fe39 100644
--- a/content/browser/loader/resource_request_info_impl.cc
+++ b/content/browser/loader/resource_request_info_impl.cc
@@ -195,6 +195,9 @@ bool ResourceRequestInfoImpl::GetAssociatedRenderView(
       *render_view_id = -1;
       return false;
     }
+  } else if (process_type_ == PROCESS_TYPE_PLUGIN) {
+    *render_process_id = origin_pid_;
+    *render_view_id = route_id_;
   } else {
     *render_process_id = child_id_;
     *render_view_id = route_id_;
diff --git a/content/browser/plugin_process_host.cc b/content/browser/plugin_process_host.cc
index 0e7dffb..86d3134 100644
--- a/content/browser/plugin_process_host.cc
+++ b/content/browser/plugin_process_host.cc
@@ -22,6 +22,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/browser_child_process_host_impl.h"
+#include "content/browser/loader/resource_message_filter.h"
 #include "content/browser/gpu/gpu_data_manager_impl.h"
 #include "content/browser/plugin_service_impl.h"
 #include "content/common/child_process_host_impl.h"
@@ -31,9 +32,11 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/plugin_service.h"
+#include "content/public/browser/resource_context.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
 #include "ipc/ipc_switches.h"
+#include "net/url_request/url_request_context_getter.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/gl/gl_switches.h"
@@ -253,6 +256,16 @@ bool PluginProcessHost::Init(const WebPluginInfo& info) {
   // been destroyed.
   process_->SetTerminateChildOnShutdown(false);
 
+  ResourceMessageFilter::GetContextsCallback get_contexts_callback(
+      base::Bind(&PluginProcessHost::GetContexts,
+      base::Unretained(this)));
+
+  // TODO(jam): right now we're passing NULL for appcache, blob storage, and
+  // file system. If NPAPI plugins actually use this, we'll have to plumb them.
+  ResourceMessageFilter* resource_message_filter = new ResourceMessageFilter(
+      process_->GetData().id, PROCESS_TYPE_PLUGIN, NULL, NULL, NULL,
+      get_contexts_callback);
+  process_->GetHost()->AddFilter(resource_message_filter);
   return true;
 }
 
@@ -270,6 +283,8 @@ bool PluginProcessHost::OnMessageReceived(const IPC::Message& msg) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PluginProcessHost, msg)
     IPC_MESSAGE_HANDLER(PluginProcessHostMsg_ChannelCreated, OnChannelCreated)
+    IPC_MESSAGE_HANDLER(PluginProcessHostMsg_ChannelDestroyed,
+                        OnChannelDestroyed)
 #if defined(OS_WIN)
     IPC_MESSAGE_HANDLER(PluginProcessHostMsg_PluginWindowDestroyed,
                         OnPluginWindowDestroyed)
@@ -291,7 +306,6 @@ bool PluginProcessHost::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
-  DCHECK(handled);
   return handled;
 }
 
@@ -328,21 +342,6 @@ void PluginProcessHost::CancelRequests() {
   }
 }
 
-// static
-void PluginProcessHost::CancelPendingRequestsForResourceContext(
-    ResourceContext* context) {
-  for (PluginProcessHostIterator host_it; !host_it.Done(); ++host_it) {
-    PluginProcessHost* host = *host_it;
-    for (size_t i = 0; i < host->pending_requests_.size(); ++i) {
-      if (host->pending_requests_[i]->GetResourceContext() == context) {
-        host->pending_requests_[i]->OnError();
-        host->pending_requests_.erase(host->pending_requests_.begin() + i);
-        --i;
-      }
-    }
-  }
-}
-
 void PluginProcessHost::OpenChannelToPlugin(Client* client) {
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
@@ -408,9 +407,22 @@ void PluginProcessHost::OnChannelCreated(
     const IPC::ChannelHandle& channel_handle) {
   Client* client = sent_requests_.front();
 
-  if (client)
+  if (client) {
+    resource_context_map_[client->ID()] = client->GetResourceContext();
     client->OnChannelOpened(channel_handle);
+  }
   sent_requests_.pop_front();
 }
 
+void PluginProcessHost::OnChannelDestroyed(int renderer_id) {
+  resource_context_map_.erase(renderer_id);
+}
+
+void PluginProcessHost::GetContexts(const ResourceHostMsg_Request& request,
+                                    ResourceContext** resource_context,
+                                    net::URLRequestContext** request_context) {
+  *resource_context = resource_context_map_[request.origin_pid];
+  *request_context = (*resource_context)->GetRequestContext();
+}
+
 }  // namespace content
diff --git a/content/browser/plugin_process_host.h b/content/browser/plugin_process_host.h
index 61ce44d..75c667d 100644
--- a/content/browser/plugin_process_host.h
+++ b/content/browser/plugin_process_host.h
@@ -8,6 +8,7 @@
 #include "build/build_config.h"
 
 #include <list>
+#include <map>
 #include <set>
 #include <string>
 #include <vector>
@@ -22,6 +23,9 @@
 #include "content/public/common/webplugininfo.h"
 #include "ipc/ipc_channel_proxy.h"
 #include "ui/gfx/native_widget_types.h"
+#include "webkit/common/resource_type.h"
+
+struct ResourceHostMsg_Request;
 
 namespace gfx {
 class Rect;
@@ -31,6 +35,10 @@ namespace IPC {
 struct ChannelHandle;
 }
 
+namespace net {
+class URLRequestContext;
+}
+
 namespace content {
 class BrowserChildProcessHostImpl;
 class ResourceContext;
@@ -87,9 +95,6 @@ class CONTENT_EXPORT PluginProcessHost : public BrowserChildProcessHostDelegate,
   // OnChannelOpened in the client is called.
   void OpenChannelToPlugin(Client* client);
 
-  // Cancels all pending channel requests for the given resource context.
-  static void CancelPendingRequestsForResourceContext(ResourceContext* context);
-
   // This function is called to cancel pending requests to open new channels.
   void CancelPendingRequest(Client* client);
 
@@ -125,6 +130,7 @@ class CONTENT_EXPORT PluginProcessHost : public BrowserChildProcessHostDelegate,
 
   // Message handlers.
   void OnChannelCreated(const IPC::ChannelHandle& channel_handle);
+  void OnChannelDestroyed(int renderer_id);
 
 #if defined(OS_WIN)
   void OnPluginWindowDestroyed(HWND window, HWND parent);
@@ -148,6 +154,11 @@ class CONTENT_EXPORT PluginProcessHost : public BrowserChildProcessHostDelegate,
 
   void CancelRequests();
 
+  // Callback for ResourceMessageFilter.
+  void GetContexts(const ResourceHostMsg_Request& request,
+                   ResourceContext** resource_context,
+                   net::URLRequestContext** request_context);
+
   // These are channel requests that we are waiting to send to the
   // plugin process once the channel is opened.
   std::vector<Client*> pending_requests_;
@@ -174,6 +185,10 @@ class CONTENT_EXPORT PluginProcessHost : public BrowserChildProcessHostDelegate,
   bool plugin_cursor_visible_;
 #endif
 
+  // Map from render_process_id to its ResourceContext
+  typedef std::map<int, ResourceContext*> ResourceContextMap;
+  ResourceContextMap resource_context_map_;
+
   scoped_ptr<BrowserChildProcessHostImpl> process_;
 
   DISALLOW_COPY_AND_ASSIGN(PluginProcessHost);
diff --git a/content/child/npapi/plugin_instance.cc b/content/child/npapi/plugin_instance.cc
index d2f2a57..30b3a58 100644
--- a/content/child/npapi/plugin_instance.cc
+++ b/content/child/npapi/plugin_instance.cc
@@ -675,13 +675,9 @@ void PluginInstance::URLRedirectResponse(bool allow, void* notify_data) {
           stream_index != open_streams_.end(); ++stream_index) {
     PluginStream* plugin_stream = stream_index->get();
     if (plugin_stream->notify_data() == notify_data) {
-      WebPluginResourceClient* resource_client =
-          plugin_stream->AsResourceClient();
-      webplugin_->URLRedirectResponse(allow, resource_client->ResourceId());
-      if (allow) {
-        plugin_stream->UpdateUrl(
-            plugin_stream->pending_redirect_url().c_str());
-      }
+      PluginStreamUrl* plugin_stream_url =
+          static_cast<PluginStreamUrl*>(plugin_stream);
+      plugin_stream_url->URLRedirectResponse(allow);
       break;
     }
   }
diff --git a/content/child/npapi/plugin_stream.cc b/content/child/npapi/plugin_stream.cc
index 6656678..8b8a7f7 100644
--- a/content/child/npapi/plugin_stream.cc
+++ b/content/child/npapi/plugin_stream.cc
@@ -45,13 +45,6 @@ PluginStream::~PluginStream() {
   free(const_cast<char*>(stream_.url));
 }
 
-void PluginStream::UpdateUrl(const char* url) {
-  DCHECK(!opened_);
-  free(const_cast<char*>(stream_.url));
-  stream_.url = base::strdup(url);
-  pending_redirect_url_.clear();
-}
-
 bool PluginStream::Open(const std::string& mime_type,
                         const std::string& headers,
                         uint32 length,
diff --git a/content/child/npapi/plugin_stream.h b/content/child/npapi/plugin_stream.h
index af7ad28..644e16c 100644
--- a/content/child/npapi/plugin_stream.h
+++ b/content/child/npapi/plugin_stream.h
@@ -29,10 +29,6 @@ class PluginStream : public base::RefCounted<PluginStream> {
                bool need_notify,
                void* notify_data);
 
-  // In case of a redirect, this can be called to update the url.  But it must
-  // be called before Open().
-  void UpdateUrl(const char* url);
-
   // Opens the stream to the Plugin.
   // If the mime-type is not specified, we'll try to find one based on the
   // mime-types table and the extension (if any) in the URL.
@@ -63,7 +59,9 @@ class PluginStream : public base::RefCounted<PluginStream> {
   // Cancels any HTTP requests initiated by the stream.
   virtual void CancelRequest() {}
 
-  const NPStream* stream() const { return &stream_; }
+  NPStream* stream() { return &stream_; }
+
+  PluginInstance* instance() { return instance_.get(); }
 
   // setter/getter for the seekable attribute on the stream.
   bool seekable() const { return seekable_stream_; }
@@ -75,23 +73,14 @@ class PluginStream : public base::RefCounted<PluginStream> {
 
   void* notify_data() const { return notify_data_; }
 
-  std::string pending_redirect_url() const { return pending_redirect_url_; }
-
  protected:
   friend class base::RefCounted<PluginStream>;
 
   virtual ~PluginStream();
 
-  PluginInstance* instance() { return instance_.get(); }
-
   // Check if the stream is open.
   bool open() { return opened_; }
 
-  // If the plugin participates in HTTP URL redirect handling then this member
-  // holds the url being redirected to while we wait for the plugin to make a
-  // decision on whether to allow or deny the redirect.
-  std::string pending_redirect_url_;
-
  private:
   // Per platform method to reset the temporary file handle.
   void ResetTempFileHandle();
diff --git a/content/child/npapi/plugin_stream_url.cc b/content/child/npapi/plugin_stream_url.cc
index b68d8df..98ea4b1 100644
--- a/content/child/npapi/plugin_stream_url.cc
+++ b/content/child/npapi/plugin_stream_url.cc
@@ -6,9 +6,11 @@
 
 #include <algorithm>
 
+#include "base/strings/string_util.h"
 #include "content/child/npapi/plugin_host.h"
 #include "content/child/npapi/plugin_instance.h"
 #include "content/child/npapi/plugin_lib.h"
+#include "content/child/npapi/plugin_url_fetcher.h"
 #include "content/child/npapi/webplugin.h"
 #include "net/http/http_response_headers.h"
 
@@ -25,6 +27,21 @@ PluginStreamUrl::PluginStreamUrl(
       id_(resource_id) {
 }
 
+void PluginStreamUrl::SetPluginURLFetcher(PluginURLFetcher* fetcher) {
+  plugin_url_fetcher_.reset(fetcher);
+}
+
+void PluginStreamUrl::URLRedirectResponse(bool allow) {
+  if (plugin_url_fetcher_.get()) {
+    plugin_url_fetcher_->URLRedirectResponse(allow);
+  } else {
+    instance()->webplugin()->URLRedirectResponse(allow, id_);
+  }
+
+  if (allow)
+    UpdateUrl(pending_redirect_url_.c_str());
+}
+
 bool PluginStreamUrl::Close(NPReason reason) {
   // Protect the stream against it being destroyed or the whole plugin instance
   // being destroyed within the destroy stream handler.
@@ -41,8 +58,12 @@ WebPluginResourceClient* PluginStreamUrl::AsResourceClient() {
 
 void PluginStreamUrl::CancelRequest() {
   if (id_ > 0) {
-    if (instance()->webplugin()) {
-      instance()->webplugin()->CancelResource(id_);
+    if (plugin_url_fetcher_.get()) {
+      plugin_url_fetcher_->Cancel();
+    } else {
+      if (instance()->webplugin()) {
+        instance()->webplugin()->CancelResource(id_);
+      }
     }
     id_ = 0;
   }
@@ -141,7 +162,7 @@ int PluginStreamUrl::ResourceId() {
 }
 
 PluginStreamUrl::~PluginStreamUrl() {
-  if (instance() && instance()->webplugin()) {
+  if (!plugin_url_fetcher_.get() && instance() && instance()->webplugin()) {
     instance()->webplugin()->ResourceClientDeleted(AsResourceClient());
   }
 }
@@ -159,4 +180,11 @@ void PluginStreamUrl::SetDeferLoading(bool value) {
                                                      value);
 }
 
+void PluginStreamUrl::UpdateUrl(const char* url) {
+  DCHECK(!open());
+  free(const_cast<char*>(stream()->url));
+  stream()->url = base::strdup(url);
+  pending_redirect_url_.clear();
+}
+
 }  // namespace content
diff --git a/content/child/npapi/plugin_stream_url.h b/content/child/npapi/plugin_stream_url.h
index 6cc6ab2..3b52d85 100644
--- a/content/child/npapi/plugin_stream_url.h
+++ b/content/child/npapi/plugin_stream_url.h
@@ -7,13 +7,14 @@
 
 #include <vector>
 
+#include "base/memory/scoped_ptr.h"
 #include "content/child/npapi/plugin_stream.h"
 #include "content/child/npapi/webplugin_resource_client.h"
 #include "url/gurl.h"
 
 namespace content {
-
 class PluginInstance;
+class PluginURLFetcher;
 
 // A NPAPI Stream based on a URL.
 class PluginStreamUrl : public PluginStream,
@@ -29,6 +30,10 @@ class PluginStreamUrl : public PluginStream,
                   bool notify_needed,
                   void *notify_data);
 
+  void SetPluginURLFetcher(PluginURLFetcher* fetcher);
+
+  void URLRedirectResponse(bool allow);
+
   // Stop sending the stream to the client.
   // Overrides the base Close so we can cancel our fetching the URL if
   // it is still loading.
@@ -58,12 +63,23 @@ class PluginStreamUrl : public PluginStream,
  private:
   void SetDeferLoading(bool value);
 
+  // In case of a redirect, this can be called to update the url.  But it must
+  // be called before Open().
+  void UpdateUrl(const char* url);
+
   GURL url_;
   unsigned long id_;
   // Ids of additional resources requested via range requests issued on
   // seekable streams.
   std::vector<unsigned long> range_requests_;
 
+  // If the plugin participates in HTTP URL redirect handling then this member
+  // holds the url being redirected to while we wait for the plugin to make a
+  // decision on whether to allow or deny the redirect.
+  std::string pending_redirect_url_;
+
+  scoped_ptr<PluginURLFetcher> plugin_url_fetcher_;
+
   DISALLOW_COPY_AND_ASSIGN(PluginStreamUrl);
 };
 
diff --git a/content/child/npapi/plugin_url_fetcher.cc b/content/child/npapi/plugin_url_fetcher.cc
new file mode 100644
index 0000000..373f69d
--- /dev/null
+++ b/content/child/npapi/plugin_url_fetcher.cc
@@ -0,0 +1,188 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/npapi/plugin_url_fetcher.h"
+
+#include "content/child/child_thread.h"
+#include "content/child/npapi/webplugin.h"
+#include "content/child/npapi/plugin_host.h"
+#include "content/child/npapi/plugin_instance.h"
+#include "content/child/npapi/plugin_stream_url.h"
+#include "content/child/npapi/webplugin_resource_client.h"
+#include "content/child/plugin_messages.h"
+#include "content/child/resource_dispatcher.h"
+#include "net/base/load_flags.h"
+#include "net/base/net_errors.h"
+#include "net/http/http_response_headers.h"
+#include "webkit/common/resource_request_body.h"
+
+namespace content {
+
+PluginURLFetcher::PluginURLFetcher(PluginStreamUrl* plugin_stream,
+                                   const GURL& url,
+                                   const GURL& first_party_for_cookies,
+                                   const std::string& method,
+                                   const std::string& post_data,
+                                   const GURL& referrer,
+                                   bool notify_redirects,
+                                   bool is_plugin_src_load,
+                                   int origin_pid,
+                                   int render_view_id,
+                                   unsigned long resource_id)
+    : plugin_stream_(plugin_stream),
+      url_(url),
+      first_party_for_cookies_(first_party_for_cookies),
+      method_(method),
+      post_data_(post_data),
+      referrer_(referrer),
+      notify_redirects_(notify_redirects),
+      is_plugin_src_load_(is_plugin_src_load),
+      resource_id_(resource_id),
+      data_offset_(0) {
+  webkit_glue::ResourceLoaderBridge::RequestInfo request_info;
+  request_info.method = method;
+  request_info.url = url;
+  request_info.first_party_for_cookies = first_party_for_cookies;
+  request_info.referrer = referrer;
+  request_info.load_flags = net::LOAD_NORMAL;
+  request_info.requestor_pid = origin_pid;
+  request_info.request_type = ResourceType::OBJECT;
+  request_info.routing_id = render_view_id;
+
+  std::vector<char> body;
+  if (method == "POST") {
+    std::vector<std::string> names;
+    std::vector<std::string> values;
+    PluginHost::SetPostData(
+        post_data.c_str(), post_data.size(), &names, &values, &body);
+    for (size_t i = 0; i < names.size(); ++i) {
+      if (!request_info.headers.empty())
+        request_info.headers += "\r\n";
+
+      request_info.headers += names[i] + ": " + values[i];
+    }
+  }
+
+  bridge_.reset(ChildThread::current()->resource_dispatcher()->CreateBridge(
+      request_info));
+  if (!body.empty()) {
+    scoped_refptr<webkit_glue::ResourceRequestBody> request_body =
+        new webkit_glue::ResourceRequestBody;
+    request_body->AppendBytes(&body[0], body.size());
+    bridge_->SetRequestBody(request_body.get());
+  }
+
+  bridge_->Start(this);
+
+  // TODO(jam): range requests
+}
+
+PluginURLFetcher::~PluginURLFetcher() {
+}
+
+void PluginURLFetcher::Cancel() {
+  bridge_->Cancel();
+}
+
+void PluginURLFetcher::URLRedirectResponse(bool allow) {
+  if (allow) {
+    bridge_->SetDefersLoading(true);
+  } else {
+    bridge_->Cancel();
+    plugin_stream_->DidFail(resource_id_);  // That will delete |this|.
+  }
+}
+
+void PluginURLFetcher::OnUploadProgress(uint64 position, uint64 size) {
+}
+
+bool PluginURLFetcher::OnReceivedRedirect(
+    const GURL& new_url,
+    const webkit_glue::ResourceResponseInfo& info,
+    bool* has_new_first_party_for_cookies,
+    GURL* new_first_party_for_cookies) {
+  // TODO(jam): THIS LOGIC IS COPIED FROM WebPluginImpl::willSendRequest until
+  // kDirectNPAPIRequests is the default and we can remove the old path there.
+
+  // Currently this check is just to catch an https -> http redirect when
+  // loading the main plugin src URL. Longer term, we could investigate
+  // firing mixed diplay or scripting issues for subresource loads
+  // initiated by plug-ins.
+  if (is_plugin_src_load_ &&
+      !plugin_stream_->instance()->webplugin()->CheckIfRunInsecureContent(
+          new_url)) {
+    plugin_stream_->DidFail(resource_id_);  // That will delete |this|.
+    return false;
+  }
+
+  // It's unfortunate that this logic of when a redirect's method changes is
+  // in url_request.cc, but weburlloader_impl.cc and this file have to duplicate
+  // it instead of passing that information.
+  if (info.headers->response_code() != 307)
+    method_ = "GET";
+  GURL old_url = url_;
+  url_ = new_url;
+  *has_new_first_party_for_cookies = true;
+  *new_first_party_for_cookies = first_party_for_cookies_;
+
+  // If the plugin does not participate in url redirect notifications then just
+  // block cross origin 307 POST redirects.
+  if (!notify_redirects_) {
+    if (info.headers->response_code() == 307 && method_ == "POST" &&
+        old_url.GetOrigin() != new_url.GetOrigin()) {
+      plugin_stream_->DidFail(resource_id_);  // That will delete |this|.
+      return false;
+    }
+  } else {
+    // Pause the request while we ask the plugin what to do about the redirect.
+    bridge_->SetDefersLoading(true);
+    plugin_stream_->WillSendRequest(url_, info.headers->response_code());
+  }
+
+  return true;
+}
+
+void PluginURLFetcher::OnReceivedResponse(
+    const webkit_glue::ResourceResponseInfo& info) {
+  // TODO(jam): see WebPluginImpl::didReceiveResponse for request_is_seekable
+  bool request_is_seekable = false;
+  uint32 last_modified = 0;
+
+  base::Time temp;
+  if (info.headers->GetLastModifiedValue(&temp))
+    last_modified = static_cast<uint32>(temp.ToDoubleT());
+
+  std::string headers = info.headers->raw_headers();
+
+  plugin_stream_->DidReceiveResponse(info.mime_type,
+                              headers,
+                              info.content_length,
+                              last_modified,
+                              request_is_seekable);
+}
+
+void PluginURLFetcher::OnDownloadedData(int len,
+                                        int encoded_data_length) {
+}
+
+void PluginURLFetcher::OnReceivedData(const char* data,
+                                      int data_length,
+                                      int encoded_data_length) {
+  plugin_stream_->DidReceiveData(data, data_length, data_offset_);
+  data_offset_ += data_length;
+}
+
+void PluginURLFetcher::OnCompletedRequest(
+    int error_code,
+    bool was_ignored_by_handler,
+    const std::string& security_info,
+    const base::TimeTicks& completion_time) {
+  if (error_code == net::OK) {
+    plugin_stream_->DidFinishLoading(resource_id_);
+  } else {
+    plugin_stream_->DidFail(resource_id_);
+  }
+}
+
+}  // namespace content
diff --git a/content/child/npapi/plugin_url_fetcher.h b/content/child/npapi/plugin_url_fetcher.h
new file mode 100644
index 0000000..0c29987
--- /dev/null
+++ b/content/child/npapi/plugin_url_fetcher.h
@@ -0,0 +1,80 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_NPAPI_URL_FETCHER_H_
+#define CONTENT_CHILD_NPAPI_URL_FETCHER_H_
+
+#include <string>
+
+#include "base/memory/scoped_ptr.h"
+#include "url/gurl.h"
+#include "webkit/child/resource_loader_bridge.h"
+
+namespace webkit_glue {
+class ResourceLoaderBridge;
+}
+
+namespace content {
+class PluginStreamUrl;
+
+// Fetches URLS for a plugin using ResourceDispatcher.
+class PluginURLFetcher : public webkit_glue::ResourceLoaderBridge::Peer {
+ public:
+  PluginURLFetcher(PluginStreamUrl* plugin_stream,
+                   const GURL& url,
+                   const GURL& first_party_for_cookies,
+                   const std::string& method,
+                   const std::string& post_data,
+                   const GURL& referrer,
+                   bool notify_redirects,
+                   bool is_plugin_src_load,
+                   int origin_pid,
+                   int render_view_id,
+                   unsigned long resource_id);
+  virtual ~PluginURLFetcher();
+
+  // Cancels the current request.
+  void Cancel();
+
+  // Called with the plugin's reply to NPP_URLRedirectNotify.
+  void URLRedirectResponse(bool allow);
+
+ private:
+  // webkit_glue::ResourceLoaderBridge::Peer implementation:
+  virtual void OnUploadProgress(uint64 position, uint64 size) OVERRIDE;
+  virtual bool OnReceivedRedirect(const GURL& new_url,
+                                  const webkit_glue::ResourceResponseInfo& info,
+                                  bool* has_new_first_party_for_cookies,
+                                  GURL* new_first_party_for_cookies) OVERRIDE;
+  virtual void OnReceivedResponse(
+      const webkit_glue::ResourceResponseInfo& info) OVERRIDE;
+  virtual void OnDownloadedData(int len, int encoded_data_length) OVERRIDE;
+  virtual void OnReceivedData(const char* data,
+                              int data_length,
+                              int encoded_data_length) OVERRIDE;
+  virtual void OnCompletedRequest(
+      int error_code,
+      bool was_ignored_by_handler,
+      const std::string& security_info,
+      const base::TimeTicks& completion_time) OVERRIDE;
+
+  PluginStreamUrl* plugin_stream_;
+  GURL url_;
+  GURL first_party_for_cookies_;
+  std::string method_;
+  std::string post_data_;
+  GURL referrer_;
+  bool notify_redirects_;
+  bool is_plugin_src_load_;
+  unsigned long resource_id_;
+  int data_offset_;
+
+  scoped_ptr<webkit_glue::ResourceLoaderBridge> bridge_;
+
+  DISALLOW_COPY_AND_ASSIGN(PluginURLFetcher);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_NPAPI_URL_FETCHER_H_
diff --git a/content/child/npapi/webplugin.h b/content/child/npapi/webplugin.h
index 545ee94..c97a78c 100644
--- a/content/child/npapi/webplugin.h
+++ b/content/child/npapi/webplugin.h
@@ -46,14 +46,7 @@ class WebPlugin {
   // Called by the plugin delegate to let it know that the window is being
   // destroyed.
   virtual void WillDestroyWindow(gfx::PluginWindowHandle window) = 0;
-#if defined(OS_WIN)
-  // |pump_messages_event| is a event handle which is used in NPP_HandleEvent
-  // calls to pump messages if the plugin enters a modal loop.
-  // |dummy_activation_window} is used to ensure correct keyboard activation.
-  // It needs to be a child of the parent window.
-  virtual void SetWindowlessData(HANDLE pump_messages_event,
-                                 gfx::NativeViewId dummy_activation_window) = 0;
-#endif
+
   // Cancels a pending request.
   virtual void CancelResource(unsigned long id) = 0;
   virtual void Invalidate() = 0;
@@ -109,6 +102,23 @@ class WebPlugin {
   virtual void SetDeferResourceLoading(unsigned long resource_id,
                                        bool defer) = 0;
 
+  // Handles NPN_URLRedirectResponse calls issued by plugins in response to
+  // HTTP URL redirect notifications.
+  virtual void URLRedirectResponse(bool allow, int resource_id) = 0;
+
+  // Returns true if the new url is a secure transition. This is to catch a
+  // plugin src url transitioning from https to http.
+  virtual bool CheckIfRunInsecureContent(const GURL& url) = 0;
+
+#if defined(OS_WIN)
+  // |pump_messages_event| is a event handle which is used in NPP_HandleEvent
+  // calls to pump messages if the plugin enters a modal loop.
+  // |dummy_activation_window} is used to ensure correct keyboard activation.
+  // It needs to be a child of the parent window.
+  virtual void SetWindowlessData(HANDLE pump_messages_event,
+                                 gfx::NativeViewId dummy_activation_window) = 0;
+#endif
+
 #if defined(OS_MACOSX)
   // Called to inform the WebPlugin that the plugin has gained or lost focus.
   virtual void FocusChanged(bool focused) {}
@@ -128,10 +138,6 @@ class WebPlugin {
                                                    uint32 surface_id) = 0;
   virtual void AcceleratedPluginSwappedIOSurface() = 0;
 #endif
-
-  // Handles NPN_URLRedirectResponse calls issued by plugins in response to
-  // HTTP URL redirect notifications.
-  virtual void URLRedirectResponse(bool allow, int resource_id) = 0;
 };
 
 }  // namespace content
diff --git a/content/child/npapi/webplugin_delegate.h b/content/child/npapi/webplugin_delegate.h
index 005d88f..9e07c3c 100644
--- a/content/child/npapi/webplugin_delegate.h
+++ b/content/child/npapi/webplugin_delegate.h
@@ -28,7 +28,6 @@ class Rect;
 
 namespace content {
 
-class WebPlugin;
 class WebPluginResourceClient;
 
 // This is the interface that a plugin implementation needs to provide.
@@ -48,7 +47,6 @@ class WebPluginDelegate {
   virtual bool Initialize(const GURL& url,
                           const std::vector<std::string>& arg_names,
                           const std::vector<std::string>& arg_values,
-                          WebPlugin* plugin,
                           bool load_manually) = 0;
 
   // Called when the WebPlugin is being destroyed.  This is a signal to the
@@ -129,6 +127,22 @@ class WebPluginDelegate {
   // has become seekable.
   virtual WebPluginResourceClient* CreateSeekableResourceClient(
       unsigned long resource_id, int range_request_id) = 0;
+
+  // Tell the plugin that the given URL should be fetched. This is a result of
+  // loading the plugin data or the plugin calling HandleURLRequest which didn't
+  // end up being routed to another frame or being a javscript:// URL.
+  virtual void FetchURL(unsigned long resource_id,
+                        int notify_id,
+                        const GURL& url,
+                        const GURL& first_party_for_cookies,
+                        const std::string& method,
+                        const std::string& post_data,
+                        const GURL& referrer,
+                        bool notify_redirects,
+                        bool is_plugin_src_load,
+                        int origin_pid,
+                        int render_view_id) = 0;
+
 };
 
 }  // namespace content
diff --git a/content/child/npapi/webplugin_delegate_impl.cc b/content/child/npapi/webplugin_delegate_impl.cc
index b7334aa..1c377bb 100644
--- a/content/child/npapi/webplugin_delegate_impl.cc
+++ b/content/child/npapi/webplugin_delegate_impl.cc
@@ -14,6 +14,7 @@
 #include "content/child/npapi/plugin_instance.h"
 #include "content/child/npapi/plugin_lib.h"
 #include "content/child/npapi/plugin_stream_url.h"
+#include "content/child/npapi/plugin_url_fetcher.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "webkit/glue/webkit_glue.h"
 
@@ -23,6 +24,7 @@ using WebKit::WebInputEvent;
 namespace content {
 
 WebPluginDelegateImpl* WebPluginDelegateImpl::Create(
+    WebPlugin* plugin,
     const base::FilePath& filename,
     const std::string& mime_type) {
   scoped_refptr<PluginLib> plugin_lib(PluginLib::CreatePluginLib(filename));
@@ -34,7 +36,7 @@ WebPluginDelegateImpl* WebPluginDelegateImpl::Create(
     return NULL;
 
   scoped_refptr<PluginInstance> instance(plugin_lib->CreateInstance(mime_type));
-  return new WebPluginDelegateImpl(instance.get());
+  return new WebPluginDelegateImpl(plugin, instance.get());
 }
 
 void WebPluginDelegateImpl::PluginDestroyed() {
@@ -49,10 +51,7 @@ bool WebPluginDelegateImpl::Initialize(
     const GURL& url,
     const std::vector<std::string>& arg_names,
     const std::vector<std::string>& arg_values,
-    WebPlugin* plugin,
     bool load_manually) {
-  plugin_ = plugin;
-
   instance_->set_web_plugin(plugin_);
   if (quirks_ & PLUGIN_QUIRK_DONT_ALLOW_MULTIPLE_INSTANCES) {
     PluginLib* plugin_lib = instance()->plugin_lib();
@@ -301,4 +300,26 @@ WebPluginResourceClient* WebPluginDelegateImpl::CreateSeekableResourceClient(
   return resource_client;
 }
 
+void WebPluginDelegateImpl::FetchURL(unsigned long resource_id,
+                                     int notify_id,
+                                     const GURL& url,
+                                     const GURL& first_party_for_cookies,
+                                     const std::string& method,
+                                     const std::string& post_data,
+                                     const GURL& referrer,
+                                     bool notify_redirects,
+                                     bool is_plugin_src_load,
+                                     int origin_pid,
+                                     int render_view_id) {
+  // TODO(jam): once we switch over to resource loading always happening in this
+  // code path, remove WebPluginResourceClient abstraction.
+  PluginStreamUrl* plugin_stream = instance()->CreateStream(
+      resource_id, url, std::string(), notify_id);
+
+  plugin_stream->SetPluginURLFetcher(new PluginURLFetcher(
+      plugin_stream, url, first_party_for_cookies, method, post_data,
+      referrer, notify_redirects, is_plugin_src_load, origin_pid,
+      render_view_id, resource_id));
+}
+
 }  // namespace content
diff --git a/content/child/npapi/webplugin_delegate_impl.h b/content/child/npapi/webplugin_delegate_impl.h
index 19ccc35..92962ff 100644
--- a/content/child/npapi/webplugin_delegate_impl.h
+++ b/content/child/npapi/webplugin_delegate_impl.h
@@ -41,8 +41,9 @@ class CARenderer;
 #endif
 
 namespace content {
-
 class PluginInstance;
+class PluginURLFetcher;
+class WebPlugin;
 
 #if defined(OS_MACOSX)
 class WebPluginAcceleratedSurface;
@@ -77,14 +78,14 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
     PLUGIN_QUIRK_EMULATE_IME = 131072,  // Windows.
   };
 
-  static WebPluginDelegateImpl* Create(const base::FilePath& filename,
+  static WebPluginDelegateImpl* Create(WebPlugin* plugin,
+                                       const base::FilePath& filename,
                                        const std::string& mime_type);
 
   // WebPluginDelegate implementation
   virtual bool Initialize(const GURL& url,
                           const std::vector<std::string>& arg_names,
                           const std::vector<std::string>& arg_values,
-                          WebPlugin* plugin,
                           bool load_manually) OVERRIDE;
   virtual void PluginDestroyed() OVERRIDE;
   virtual void UpdateGeometry(const gfx::Rect& window_rect,
@@ -116,6 +117,17 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
       unsigned long resource_id, const GURL& url, int notify_id) OVERRIDE;
   virtual WebPluginResourceClient* CreateSeekableResourceClient(
       unsigned long resource_id, int range_request_id) OVERRIDE;
+  virtual void FetchURL(unsigned long resource_id,
+                        int notify_id,
+                        const GURL& url,
+                        const GURL& first_party_for_cookies,
+                        const std::string& method,
+                        const std::string& post_data,
+                        const GURL& referrer,
+                        bool notify_redirects,
+                        bool is_plugin_src_load,
+                        int origin_pid,
+                        int render_view_id) OVERRIDE;
   // End of WebPluginDelegate implementation.
 
   gfx::PluginWindowHandle windowed_handle() const { return windowed_handle_; }
@@ -193,7 +205,7 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
   friend class base::DeleteHelper<WebPluginDelegateImpl>;
   friend class WebPluginDelegate;
 
-  explicit WebPluginDelegateImpl(PluginInstance* instance);
+  WebPluginDelegateImpl(WebPlugin* plugin, PluginInstance* instance);
   virtual ~WebPluginDelegateImpl();
 
   // Called by Initialize() for platform-specific initialization.
diff --git a/content/child/npapi/webplugin_delegate_impl_android.cc b/content/child/npapi/webplugin_delegate_impl_android.cc
index 35c1488..fadaeee 100644
--- a/content/child/npapi/webplugin_delegate_impl_android.cc
+++ b/content/child/npapi/webplugin_delegate_impl_android.cc
@@ -15,11 +15,12 @@ using WebKit::WebInputEvent;
 namespace content {
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : windowed_handle_(0),
       windowed_did_set_window_(false),
       windowless_(false),
-      plugin_(NULL),
+      plugin_(plugin),
       instance_(instance),
       quirks_(0),
       handle_event_depth_(0),
diff --git a/content/child/npapi/webplugin_delegate_impl_aura.cc b/content/child/npapi/webplugin_delegate_impl_aura.cc
index bfe3378..3416990 100644
--- a/content/child/npapi/webplugin_delegate_impl_aura.cc
+++ b/content/child/npapi/webplugin_delegate_impl_aura.cc
@@ -11,7 +11,8 @@ using WebKit::WebInputEvent;
 
 namespace content {
 
-WebPluginDelegateImpl::WebPluginDelegateImpl(PluginInstance* instance) {
+WebPluginDelegateImpl::WebPluginDelegateImpl(WebPlugin* plugin,
+                                             PluginInstance* instance) {
 }
 
 WebPluginDelegateImpl::~WebPluginDelegateImpl() {
diff --git a/content/child/npapi/webplugin_delegate_impl_gtk.cc b/content/child/npapi/webplugin_delegate_impl_gtk.cc
index d50f09a..371d834 100644
--- a/content/child/npapi/webplugin_delegate_impl_gtk.cc
+++ b/content/child/npapi/webplugin_delegate_impl_gtk.cc
@@ -29,11 +29,12 @@ using WebKit::WebMouseEvent;
 namespace content {
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : windowed_handle_(0),
       windowed_did_set_window_(false),
       windowless_(false),
-      plugin_(NULL),
+      plugin_(plugin),
       instance_(instance),
       windowless_shm_pixmap_(None),
       pixmap_(NULL),
diff --git a/content/child/npapi/webplugin_delegate_impl_mac.mm b/content/child/npapi/webplugin_delegate_impl_mac.mm
index 82207b5..2951fca 100644
--- a/content/child/npapi/webplugin_delegate_impl_mac.mm
+++ b/content/child/npapi/webplugin_delegate_impl_mac.mm
@@ -146,11 +146,12 @@ int ExternalDragTracker::WebEventButtonModifierMask() {
 #pragma mark Core WebPluginDelegate implementation
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : windowed_handle_(gfx::kNullPluginWindow),
       // all Mac plugins are "windowless" in the Windows/X11 sense
       windowless_(true),
-      plugin_(NULL),
+      plugin_(plugin),
       instance_(instance),
       quirks_(0),
       use_buffer_context_(true),
diff --git a/content/child/npapi/webplugin_delegate_impl_win.cc b/content/child/npapi/webplugin_delegate_impl_win.cc
index 2f1d488..e788cb2 100644
--- a/content/child/npapi/webplugin_delegate_impl_win.cc
+++ b/content/child/npapi/webplugin_delegate_impl_win.cc
@@ -220,10 +220,11 @@ LRESULT CALLBACK WebPluginDelegateImpl::MouseHookProc(
 }
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : instance_(instance),
       quirks_(0),
-      plugin_(NULL),
+      plugin_(plugin),
       windowless_(false),
       windowed_handle_(NULL),
       windowed_did_set_window_(false),
diff --git a/content/child/plugin_messages.h b/content/child/plugin_messages.h
index 7c0d825..1c112e6 100644
--- a/content/child/plugin_messages.h
+++ b/content/child/plugin_messages.h
@@ -52,6 +52,19 @@ IPC_STRUCT_BEGIN(PluginMsg_DidReceiveResponseParams)
   IPC_STRUCT_MEMBER(bool, request_is_seekable)
 IPC_STRUCT_END()
 
+IPC_STRUCT_BEGIN(PluginMsg_FetchURL_Params)
+  IPC_STRUCT_MEMBER(unsigned long, resource_id)
+  IPC_STRUCT_MEMBER(int, notify_id)
+  IPC_STRUCT_MEMBER(GURL, url)
+  IPC_STRUCT_MEMBER(GURL, first_party_for_cookies)
+  IPC_STRUCT_MEMBER(std::string, method)
+  IPC_STRUCT_MEMBER(std::string, post_data)
+  IPC_STRUCT_MEMBER(GURL, referrer)
+  IPC_STRUCT_MEMBER(bool, notify_redirect)
+  IPC_STRUCT_MEMBER(bool, is_plugin_src_load)
+  IPC_STRUCT_MEMBER(int, render_view_id)
+IPC_STRUCT_END()
+
 IPC_STRUCT_BEGIN(PluginMsg_UpdateGeometry_Param)
   IPC_STRUCT_MEMBER(gfx::Rect, window_rect)
   IPC_STRUCT_MEMBER(gfx::Rect, clip_rect)
@@ -125,36 +138,6 @@ IPC_SYNC_MESSAGE_ROUTED1_2(PluginMsg_HandleInputEvent,
 IPC_MESSAGE_ROUTED1(PluginMsg_SetContentAreaFocus,
                     bool /* has_focus */)
 
-#if defined(OS_WIN)
-IPC_MESSAGE_ROUTED4(PluginMsg_ImeCompositionUpdated,
-                    string16 /* text */,
-                    std::vector<int> /* clauses */,
-                    std::vector<int>, /* target */
-                    int /* cursor_position */)
-
-IPC_MESSAGE_ROUTED1(PluginMsg_ImeCompositionCompleted,
-                    string16 /* text */)
-#endif
-
-#if defined(OS_MACOSX)
-IPC_MESSAGE_ROUTED1(PluginMsg_SetWindowFocus,
-                    bool /* has_focus */)
-
-IPC_MESSAGE_ROUTED0(PluginMsg_ContainerHidden)
-
-IPC_MESSAGE_ROUTED3(PluginMsg_ContainerShown,
-                    gfx::Rect /* window_frame */,
-                    gfx::Rect /* view_frame */,
-                    bool /* has_focus */)
-
-IPC_MESSAGE_ROUTED2(PluginMsg_WindowFrameChanged,
-                    gfx::Rect /* window_frame */,
-                    gfx::Rect /* view_frame */)
-
-IPC_MESSAGE_ROUTED1(PluginMsg_ImeCompositionCompleted,
-                    string16 /* text */)
-#endif
-
 IPC_SYNC_MESSAGE_ROUTED3_0(PluginMsg_WillSendRequest,
                            unsigned long /* id */,
                            GURL /* url */,
@@ -206,7 +189,38 @@ IPC_MESSAGE_CONTROL1(PluginMsg_SignalModalDialogEvent,
 IPC_MESSAGE_CONTROL1(PluginMsg_ResetModalDialogEvent,
                      int /* render_view_id */)
 
+IPC_MESSAGE_ROUTED1(PluginMsg_FetchURL,
+                    PluginMsg_FetchURL_Params)
+
+#if defined(OS_WIN)
+IPC_MESSAGE_ROUTED4(PluginMsg_ImeCompositionUpdated,
+                    string16 /* text */,
+                    std::vector<int> /* clauses */,
+                    std::vector<int>, /* target */
+                    int /* cursor_position */)
+
+IPC_MESSAGE_ROUTED1(PluginMsg_ImeCompositionCompleted,
+                    string16 /* text */)
+#endif
+
 #if defined(OS_MACOSX)
+IPC_MESSAGE_ROUTED1(PluginMsg_SetWindowFocus,
+                    bool /* has_focus */)
+
+IPC_MESSAGE_ROUTED0(PluginMsg_ContainerHidden)
+
+IPC_MESSAGE_ROUTED3(PluginMsg_ContainerShown,
+                    gfx::Rect /* window_frame */,
+                    gfx::Rect /* view_frame */,
+                    bool /* has_focus */)
+
+IPC_MESSAGE_ROUTED2(PluginMsg_WindowFrameChanged,
+                    gfx::Rect /* window_frame */,
+                    gfx::Rect /* view_frame */)
+
+IPC_MESSAGE_ROUTED1(PluginMsg_ImeCompositionCompleted,
+                    string16 /* text */)
+
 // This message, used only on 10.6 and later, transmits the "fake"
 // window handle allocated by the browser on behalf of the renderer
 // to the GPU plugin.
@@ -224,26 +238,6 @@ IPC_MESSAGE_ROUTED1(PluginMsg_SetFakeAcceleratedSurfaceWindowHandle,
 IPC_SYNC_MESSAGE_ROUTED1_0(PluginHostMsg_SetWindow,
                            gfx::PluginWindowHandle /* window */)
 
-#if defined(OS_WIN)
-// The modal_loop_pump_messages_event parameter is an event handle which is
-// passed in for windowless plugins and is used to indicate if messages
-// are to be pumped in sync calls to the plugin process. Currently used
-// in HandleEvent calls.
-IPC_SYNC_MESSAGE_ROUTED2_0(PluginHostMsg_SetWindowlessData,
-                           HANDLE /* modal_loop_pump_messages_event */,
-                           gfx::NativeViewId /* dummy_activation_window*/)
-
-// Send the IME status retrieved from a windowless plug-in. A windowless plug-in
-// uses the IME attached to a browser process as a renderer does. A plug-in
-// sends this message to control the IME status of a browser process. I would
-// note that a plug-in sends this message to a renderer process that hosts this
-// plug-in (not directly to a browser process) so the renderer process can
-// update its IME status.
-IPC_MESSAGE_ROUTED2(PluginHostMsg_NotifyIMEStatus,
-                    int /* input_type */,
-                    gfx::Rect /* caret_rect */)
-#endif
-
 IPC_MESSAGE_ROUTED1(PluginHostMsg_URLRequest,
                     PluginHostMsg_URLRequest_Params)
 
@@ -292,6 +286,34 @@ IPC_SYNC_MESSAGE_CONTROL1_0(PluginHostMsg_SetException,
 
 IPC_MESSAGE_CONTROL0(PluginHostMsg_PluginShuttingDown)
 
+IPC_MESSAGE_ROUTED2(PluginHostMsg_URLRedirectResponse,
+                    bool /* allow */,
+                    int  /* resource_id */)
+
+IPC_SYNC_MESSAGE_ROUTED1_1(PluginHostMsg_CheckIfRunInsecureContent,
+                           GURL /* url */,
+                           bool /* result */)
+
+#if defined(OS_WIN)
+// The modal_loop_pump_messages_event parameter is an event handle which is
+// passed in for windowless plugins and is used to indicate if messages
+// are to be pumped in sync calls to the plugin process. Currently used
+// in HandleEvent calls.
+IPC_SYNC_MESSAGE_ROUTED2_0(PluginHostMsg_SetWindowlessData,
+                           HANDLE /* modal_loop_pump_messages_event */,
+                           gfx::NativeViewId /* dummy_activation_window*/)
+
+// Send the IME status retrieved from a windowless plug-in. A windowless plug-in
+// uses the IME attached to a browser process as a renderer does. A plug-in
+// sends this message to control the IME status of a browser process. I would
+// note that a plug-in sends this message to a renderer process that hosts this
+// plug-in (not directly to a browser process) so the renderer process can
+// update its IME status.
+IPC_MESSAGE_ROUTED2(PluginHostMsg_NotifyIMEStatus,
+                    int /* input_type */,
+                    gfx::Rect /* caret_rect */)
+#endif
+
 #if defined(OS_MACOSX)
 IPC_MESSAGE_ROUTED1(PluginHostMsg_FocusChanged,
                     bool /* focused */)
@@ -322,10 +344,6 @@ IPC_MESSAGE_ROUTED3(PluginHostMsg_AcceleratedPluginAllocatedIOSurface,
 IPC_MESSAGE_ROUTED0(PluginHostMsg_AcceleratedPluginSwappedIOSurface)
 #endif
 
-IPC_MESSAGE_ROUTED2(PluginHostMsg_URLRedirectResponse,
-                    bool /* allow */,
-                    int  /* resource_id */)
-
 
 //-----------------------------------------------------------------------------
 // NPObject messages
diff --git a/content/common/plugin_process_messages.h b/content/common/plugin_process_messages.h
index 6e6ec8a..fb76a9e6 100644
--- a/content/common/plugin_process_messages.h
+++ b/content/common/plugin_process_messages.h
@@ -48,6 +48,9 @@ IPC_MESSAGE_CONTROL3(PluginProcessMsg_ClearSiteData,
 IPC_MESSAGE_CONTROL1(PluginProcessHostMsg_ChannelCreated,
                      IPC::ChannelHandle /* channel_handle */)
 
+IPC_MESSAGE_CONTROL1(PluginProcessHostMsg_ChannelDestroyed,
+                     int /* renderer_id */)
+
 IPC_MESSAGE_CONTROL1(PluginProcessHostMsg_ClearSiteDataResult,
                      bool /* success */)
 
diff --git a/content/common/resource_messages.h b/content/common/resource_messages.h
index 1eb4664..082be1a 100644
--- a/content/common/resource_messages.h
+++ b/content/common/resource_messages.h
@@ -148,6 +148,9 @@ IPC_STRUCT_BEGIN(ResourceHostMsg_Request)
 
   // Process ID from which this request originated, or zero if it originated
   // in the renderer itself.
+  // If kDirectNPAPIRequests isn't specified, then plugin requests get routed
+  // through the renderer and and this holds the pid of the plugin process.
+  // Otherwise this holds the render_process_id of the view that has the plugin.
   IPC_STRUCT_MEMBER(int, origin_pid)
 
   // What this resource load is for (main frame, sub-frame, sub-resource,
diff --git a/content/content_child.gypi b/content/content_child.gypi
index e168326..3e3d5a2 100644
--- a/content/content_child.gypi
+++ b/content/content_child.gypi
@@ -89,6 +89,8 @@
     'child/npapi/plugin_stream_win.cc',
     'child/npapi/plugin_string_stream.cc',
     'child/npapi/plugin_string_stream.h',
+    'child/npapi/plugin_url_fetcher.cc',
+    'child/npapi/plugin_url_fetcher.h',
     'child/npapi/plugin_web_event_converter_mac.h',
     'child/npapi/plugin_web_event_converter_mac.mm',
     'child/npapi/webplugin.h',
diff --git a/content/plugin/plugin_channel.cc b/content/plugin/plugin_channel.cc
index 31cba22..3340ea8 100644
--- a/content/plugin/plugin_channel.cc
+++ b/content/plugin/plugin_channel.cc
@@ -204,6 +204,8 @@ base::WaitableEvent* PluginChannel::GetModalDialogEvent(int render_view_id) {
 }
 
 PluginChannel::~PluginChannel() {
+  PluginThread::current()->Send(new PluginProcessHostMsg_ChannelDestroyed(
+      renderer_id_));
   base::MessageLoop::current()->PostDelayedTask(
       FROM_HERE,
       base::Bind(&PluginReleaseCallback),
diff --git a/content/plugin/webplugin_delegate_stub.cc b/content/plugin/webplugin_delegate_stub.cc
index af574e4..68bf374 100644
--- a/content/plugin/webplugin_delegate_stub.cc
+++ b/content/plugin/webplugin_delegate_stub.cc
@@ -146,6 +146,7 @@ bool WebPluginDelegateStub::OnMessageReceived(const IPC::Message& msg) {
                         OnHandleURLRequestReply)
     IPC_MESSAGE_HANDLER(PluginMsg_HTTPRangeRequestReply,
                         OnHTTPRangeRequestReply)
+    IPC_MESSAGE_HANDLER(PluginMsg_FetchURL, OnFetchURL)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
@@ -181,7 +182,7 @@ void WebPluginDelegateStub::OnInit(const PluginMsg_Init_Params& params,
                                   instance_id_,
                                   page_url_,
                                   params.host_render_view_routing_id);
-  delegate_ = WebPluginDelegateImpl::Create(path, mime_type_);
+  delegate_ = WebPluginDelegateImpl::Create(webplugin_, path, mime_type_);
   if (delegate_) {
     if (delegate_->GetQuirks() &
         WebPluginDelegateImpl::PLUGIN_QUIRK_DIE_AFTER_UNLOAD) {
@@ -203,7 +204,6 @@ void WebPluginDelegateStub::OnInit(const PluginMsg_Init_Params& params,
     *result = delegate_->Initialize(params.url,
                                     arg_names,
                                     arg_values,
-                                    webplugin_,
                                     params.load_manually);
     *transparent = delegate_->instance()->transparent();
   }
@@ -423,4 +423,19 @@ void WebPluginDelegateStub::OnHTTPRangeRequestReply(
   webplugin_->OnResourceCreated(resource_id, resource_client);
 }
 
+void WebPluginDelegateStub::OnFetchURL(
+    const PluginMsg_FetchURL_Params& params) {
+  delegate_->FetchURL(params.resource_id,
+                      params.notify_id,
+                      params.url,
+                      params.first_party_for_cookies,
+                      params.method,
+                      params.post_data,
+                      params.referrer,
+                      params.notify_redirect,
+                      params.is_plugin_src_load,
+                      channel_->renderer_id(),
+                      params.render_view_id);
+}
+
 }  // namespace content
diff --git a/content/plugin/webplugin_delegate_stub.h b/content/plugin/webplugin_delegate_stub.h
index 5efb58e..375fee4 100644
--- a/content/plugin/webplugin_delegate_stub.h
+++ b/content/plugin/webplugin_delegate_stub.h
@@ -19,6 +19,7 @@
 
 struct PluginMsg_Init_Params;
 struct PluginMsg_DidReceiveResponseParams;
+struct PluginMsg_FetchURL_Params;
 struct PluginMsg_UpdateGeometry_Param;
 class WebCursor;
 
@@ -107,6 +108,7 @@ class WebPluginDelegateStub : public IPC::Listener,
                                const GURL& url,
                                int notify_id);
   void OnHTTPRangeRequestReply(unsigned long resource_id, int range_request_id);
+  void OnFetchURL(const PluginMsg_FetchURL_Params& params);
 
   std::string mime_type_;
   int instance_id_;
diff --git a/content/plugin/webplugin_proxy.cc b/content/plugin/webplugin_proxy.cc
index 0988d68..51635ec 100644
--- a/content/plugin/webplugin_proxy.cc
+++ b/content/plugin/webplugin_proxy.cc
@@ -14,6 +14,7 @@
 #include "content/child/npapi/npobject_proxy.h"
 #include "content/child/npapi/npobject_util.h"
 #include "content/child/npapi/webplugin_delegate_impl.h"
+#include "content/child/npapi/webplugin_resource_client.h"
 #include "content/child/plugin_messages.h"
 #include "content/plugin/plugin_channel.h"
 #include "content/plugin/plugin_thread.h"
@@ -676,12 +677,14 @@ bool WebPluginProxy::IsOffTheRecord() {
 
 void WebPluginProxy::ResourceClientDeleted(
     WebPluginResourceClient* resource_client) {
+  // resource_client->ResourceId() is 0 at this point, so can't use it as an
+  // index into the map.
   ResourceClientMap::iterator index = resource_clients_.begin();
   while (index != resource_clients_.end()) {
     WebPluginResourceClient* client = (*index).second;
-
     if (client == resource_client) {
-      resource_clients_.erase(index++);
+      resource_clients_.erase(index);
+      return;
     } else {
       index++;
     }
@@ -692,6 +695,13 @@ void WebPluginProxy::URLRedirectResponse(bool allow, int resource_id) {
   Send(new PluginHostMsg_URLRedirectResponse(route_id_, allow, resource_id));
 }
 
+bool WebPluginProxy::CheckIfRunInsecureContent(const GURL& url) {
+  bool result = true;
+  Send(new PluginHostMsg_CheckIfRunInsecureContent(
+      host_render_view_routing_id_, url, &result));
+  return result;
+}
+
 #if defined(OS_WIN) && !defined(USE_AURA)
 void WebPluginProxy::UpdateIMEStatus() {
   // Retrieve the IME status from a plug-in and send it to a renderer process
diff --git a/content/plugin/webplugin_proxy.h b/content/plugin/webplugin_proxy.h
index d1899f5..ea8a12a 100644
--- a/content/plugin/webplugin_proxy.h
+++ b/content/plugin/webplugin_proxy.h
@@ -19,6 +19,7 @@
 #include "base/timer/timer.h"
 #include "content/child/npapi/webplugin.h"
 #include "ipc/ipc_message.h"
+#include "ipc/ipc_sender.h"
 #include "skia/ext/refptr.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "url/gurl.h"
@@ -28,6 +29,8 @@
 #include "ui/gl/gpu_preference.h"
 #include "ui/surface/transport_dib.h"
 
+struct PluginMsg_FetchURL_Params;
+
 namespace content {
 class PluginChannel;
 class WebPluginDelegateImpl;
@@ -38,7 +41,8 @@ class WebPluginAcceleratedSurfaceProxy;
 
 // This is an implementation of WebPlugin that proxies all calls to the
 // renderer.
-class WebPluginProxy : public WebPlugin {
+class WebPluginProxy : public WebPlugin,
+                       public IPC::Sender {
  public:
   // Creates a new proxy for WebPlugin, using the given sender to send the
   // marshalled WebPlugin calls.
@@ -54,10 +58,6 @@ class WebPluginProxy : public WebPlugin {
   virtual void SetWindow(gfx::PluginWindowHandle window) OVERRIDE;
   virtual void SetAcceptsInputEvents(bool accepts) OVERRIDE;
   virtual void WillDestroyWindow(gfx::PluginWindowHandle window) OVERRIDE;
-#if defined(OS_WIN)
-  void SetWindowlessData(HANDLE pump_messages_event,
-                         gfx::NativeViewId dummy_activation_window);
-#endif
   virtual void CancelResource(unsigned long id) OVERRIDE;
   virtual void Invalidate() OVERRIDE;
   virtual void InvalidateRect(const gfx::Rect& rect) OVERRIDE;
@@ -91,7 +91,12 @@ class WebPluginProxy : public WebPlugin {
   virtual bool IsOffTheRecord() OVERRIDE;
   virtual void ResourceClientDeleted(
       WebPluginResourceClient* resource_client) OVERRIDE;
-
+  virtual void URLRedirectResponse(bool allow, int resource_id) OVERRIDE;
+  virtual bool CheckIfRunInsecureContent(const GURL& url) OVERRIDE;
+#if defined(OS_WIN)
+  void SetWindowlessData(HANDLE pump_messages_event,
+                         gfx::NativeViewId dummy_activation_window);
+#endif
 #if defined(OS_MACOSX)
   virtual void FocusChanged(bool focused) OVERRIDE;
   virtual void StartIme() OVERRIDE;
@@ -103,7 +108,9 @@ class WebPluginProxy : public WebPlugin {
                                                    uint32 surface_id) OVERRIDE;
   virtual void AcceleratedPluginSwappedIOSurface() OVERRIDE;
 #endif
-  virtual void URLRedirectResponse(bool allow, int resource_id) OVERRIDE;
+
+  // IPC::Sender implementation.
+  virtual bool Send(IPC::Message* msg) OVERRIDE;
 
   // class-specific methods
 
@@ -148,8 +155,6 @@ class WebPluginProxy : public WebPlugin {
     scoped_ptr<TransportDIB> dib_;
   };
 
-  bool Send(IPC::Message* msg);
-
   // Handler for sending over the paint event to the plugin.
   void OnPaint(const gfx::Rect& damaged_rect);
 
diff --git a/content/renderer/npapi/webplugin_delegate_proxy.cc b/content/renderer/npapi/webplugin_delegate_proxy.cc
index de133d5..cf34bee 100644
--- a/content/renderer/npapi/webplugin_delegate_proxy.cc
+++ b/content/renderer/npapi/webplugin_delegate_proxy.cc
@@ -28,13 +28,13 @@
 #include "content/child/npapi/npobject_proxy.h"
 #include "content/child/npapi/npobject_stub.h"
 #include "content/child/npapi/npobject_util.h"
-#include "content/child/npapi/webplugin.h"
 #include "content/child/npapi/webplugin_resource_client.h"
 #include "content/child/plugin_messages.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/view_messages.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/npapi/plugin_channel_host.h"
+#include "content/renderer/npapi/webplugin_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/sad_plugin.h"
@@ -201,10 +201,11 @@ class ResourceClientProxy : public WebPluginResourceClient {
 }  // namespace
 
 WebPluginDelegateProxy::WebPluginDelegateProxy(
+    WebPluginImpl* plugin,
     const std::string& mime_type,
     const base::WeakPtr<RenderViewImpl>& render_view)
     : render_view_(render_view),
-      plugin_(NULL),
+      plugin_(plugin),
       uses_shared_bitmaps_(false),
 #if defined(OS_MACOSX)
       uses_compositor_(false),
@@ -284,7 +285,6 @@ bool WebPluginDelegateProxy::Initialize(
     const GURL& url,
     const std::vector<std::string>& arg_names,
     const std::vector<std::string>& arg_values,
-    WebPlugin* plugin,
     bool load_manually) {
   // TODO(shess): Attempt to work around http://crbug.com/97285 and
   // http://crbug.com/141055 by retrying the connection.  Reports seem
@@ -373,8 +373,6 @@ bool WebPluginDelegateProxy::Initialize(
   params.host_render_view_routing_id = render_view_->routing_id();
   params.load_manually = load_manually;
 
-  plugin_ = plugin;
-
   result = false;
   Send(new PluginMsg_Init(instance_id_, params, &transparent_, &result));
 
@@ -440,10 +438,6 @@ bool WebPluginDelegateProxy::OnMessageReceived(const IPC::Message& msg) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(WebPluginDelegateProxy, msg)
     IPC_MESSAGE_HANDLER(PluginHostMsg_SetWindow, OnSetWindow)
-#if defined(OS_WIN)
-    IPC_MESSAGE_HANDLER(PluginHostMsg_SetWindowlessData, OnSetWindowlessData)
-    IPC_MESSAGE_HANDLER(PluginHostMsg_NotifyIMEStatus, OnNotifyIMEStatus)
-#endif
     IPC_MESSAGE_HANDLER(PluginHostMsg_CancelResource, OnCancelResource)
     IPC_MESSAGE_HANDLER(PluginHostMsg_InvalidateRect, OnInvalidateRect)
     IPC_MESSAGE_HANDLER(PluginHostMsg_GetWindowScriptNPObject,
@@ -458,7 +452,14 @@ bool WebPluginDelegateProxy::OnMessageReceived(const IPC::Message& msg) {
                         OnInitiateHTTPRangeRequest)
     IPC_MESSAGE_HANDLER(PluginHostMsg_DeferResourceLoading,
                         OnDeferResourceLoading)
-
+    IPC_MESSAGE_HANDLER(PluginHostMsg_URLRedirectResponse,
+                        OnURLRedirectResponse)
+    IPC_MESSAGE_HANDLER(PluginHostMsg_CheckIfRunInsecureContent,
+                        OnCheckIfRunInsecureContent)
+#if defined(OS_WIN)
+    IPC_MESSAGE_HANDLER(PluginHostMsg_SetWindowlessData, OnSetWindowlessData)
+    IPC_MESSAGE_HANDLER(PluginHostMsg_NotifyIMEStatus, OnNotifyIMEStatus)
+#endif
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER(PluginHostMsg_FocusChanged,
                         OnFocusChanged);
@@ -471,8 +472,6 @@ bool WebPluginDelegateProxy::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(PluginHostMsg_AcceleratedPluginSwappedIOSurface,
                         OnAcceleratedPluginSwappedIOSurface)
 #endif
-    IPC_MESSAGE_HANDLER(PluginHostMsg_URLRedirectResponse,
-                        OnURLRedirectResponse)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   DCHECK(handled);
@@ -1119,6 +1118,31 @@ WebPluginResourceClient* WebPluginDelegateProxy::CreateSeekableResourceClient(
   return proxy;
 }
 
+void WebPluginDelegateProxy::FetchURL(unsigned long resource_id,
+                                      int notify_id,
+                                      const GURL& url,
+                                      const GURL& first_party_for_cookies,
+                                      const std::string& method,
+                                      const std::string& post_data,
+                                      const GURL& referrer,
+                                      bool notify_redirects,
+                                      bool is_plugin_src_load,
+                                      int origin_pid,
+                                      int render_view_id) {
+  PluginMsg_FetchURL_Params params;
+  params.resource_id = resource_id;
+  params.notify_id = notify_id;
+  params.url = url;
+  params.first_party_for_cookies = first_party_for_cookies;
+  params.method = method;
+  params.post_data = post_data;
+  params.referrer = referrer;
+  params.notify_redirect = notify_redirects;
+  params.is_plugin_src_load = is_plugin_src_load;
+  params.render_view_id = render_view_id;
+  Send(new PluginMsg_FetchURL(instance_id_, params));
+}
+
 #if defined(OS_MACOSX)
 void WebPluginDelegateProxy::OnFocusChanged(bool focused) {
   if (render_view_)
@@ -1204,4 +1228,9 @@ void WebPluginDelegateProxy::OnURLRedirectResponse(bool allow,
   plugin_->URLRedirectResponse(allow, resource_id);
 }
 
+void WebPluginDelegateProxy::OnCheckIfRunInsecureContent(const GURL& url,
+                                                         bool* result) {
+  *result = plugin_->CheckIfRunInsecureContent(url);
+}
+
 }  // namespace content
diff --git a/content/renderer/npapi/webplugin_delegate_proxy.h b/content/renderer/npapi/webplugin_delegate_proxy.h
index 3c5e5a2..168f890 100644
--- a/content/renderer/npapi/webplugin_delegate_proxy.h
+++ b/content/renderer/npapi/webplugin_delegate_proxy.h
@@ -39,6 +39,7 @@ namespace content {
 class NPObjectStub;
 class PluginChannelHost;
 class RenderViewImpl;
+class WebPluginImpl;
 
 // An implementation of WebPluginDelegate that proxies all calls to
 // the plugin process.
@@ -48,7 +49,8 @@ class WebPluginDelegateProxy
       public IPC::Sender,
       public base::SupportsWeakPtr<WebPluginDelegateProxy> {
  public:
-  WebPluginDelegateProxy(const std::string& mime_type,
+  WebPluginDelegateProxy(WebPluginImpl* plugin,
+                         const std::string& mime_type,
                          const base::WeakPtr<RenderViewImpl>& render_view);
 
   // WebPluginDelegate implementation:
@@ -56,7 +58,6 @@ class WebPluginDelegateProxy
   virtual bool Initialize(const GURL& url,
                           const std::vector<std::string>& arg_names,
                           const std::vector<std::string>& arg_values,
-                          WebPlugin* plugin,
                           bool load_manually) OVERRIDE;
   virtual void UpdateGeometry(const gfx::Rect& window_rect,
                               const gfx::Rect& clip_rect) OVERRIDE;
@@ -122,6 +123,17 @@ class WebPluginDelegateProxy
       unsigned long resource_id, const GURL& url, int notify_id) OVERRIDE;
   virtual WebPluginResourceClient* CreateSeekableResourceClient(
       unsigned long resource_id, int range_request_id) OVERRIDE;
+  virtual void FetchURL(unsigned long resource_id,
+                        int notify_id,
+                        const GURL& url,
+                        const GURL& first_party_for_cookies,
+                        const std::string& method,
+                        const std::string& post_data,
+                        const GURL& referrer,
+                        bool notify_redirects,
+                        bool is_plugin_src_load,
+                        int origin_pid,
+                        int render_view_id) OVERRIDE;
 
   gfx::PluginWindowHandle GetPluginWindowHandle();
 
@@ -141,11 +153,6 @@ class WebPluginDelegateProxy
   // Message handlers for messages that proxy WebPlugin methods, which
   // we translate into calls to the real WebPlugin.
   void OnSetWindow(gfx::PluginWindowHandle window);
-#if defined(OS_WIN)
-  void OnSetWindowlessData(HANDLE modal_loop_pump_messages_event,
-                           gfx::NativeViewId dummy_activation_window);
-  void OnNotifyIMEStatus(const int input_mode, const gfx::Rect& caret_rect);
-#endif
   void OnCompleteURL(const std::string& url_in, std::string* url_out,
                      bool* result);
   void OnHandleURLRequest(const PluginHostMsg_URLRequest_Params& params);
@@ -164,7 +171,8 @@ class WebPluginDelegateProxy
                                   const std::string& range_info,
                                   int range_request_id);
   void OnDeferResourceLoading(unsigned long resource_id, bool defer);
-
+  void OnURLRedirectResponse(bool allow, int resource_id);
+  void OnCheckIfRunInsecureContent(const GURL& url, bool* result);
 #if defined(OS_MACOSX)
   void OnFocusChanged(bool focused);
   void OnStartIme();
@@ -175,9 +183,11 @@ class WebPluginDelegateProxy
                                              uint32 surface_id);
   void OnAcceleratedPluginSwappedIOSurface();
 #endif
-
-  void OnURLRedirectResponse(bool allow, int resource_id);
-
+#if defined(OS_WIN)
+  void OnSetWindowlessData(HANDLE modal_loop_pump_messages_event,
+                           gfx::NativeViewId dummy_activation_window);
+  void OnNotifyIMEStatus(const int input_mode, const gfx::Rect& caret_rect);
+#endif
   // Helper function that sends the UpdateGeometry message.
   void SendUpdateGeometry(bool bitmaps_changed);
 
@@ -238,7 +248,7 @@ class WebPluginDelegateProxy
 #endif
 
   base::WeakPtr<RenderViewImpl> render_view_;
-  WebPlugin* plugin_;
+  WebPluginImpl* plugin_;
   bool uses_shared_bitmaps_;
 #if defined(OS_MACOSX)
   bool uses_compositor_;
diff --git a/content/renderer/npapi/webplugin_impl.cc b/content/renderer/npapi/webplugin_impl.cc
index 4de0631..a80f745 100644
--- a/content/renderer/npapi/webplugin_impl.cc
+++ b/content/renderer/npapi/webplugin_impl.cc
@@ -5,6 +5,7 @@
 #include "content/renderer/npapi/webplugin_impl.h"
 
 #include "base/bind.h"
+#include "base/command_line.h"
 #include "base/debug/crash_logging.h"
 #include "base/logging.h"
 #include "base/memory/linked_ptr.h"
@@ -20,6 +21,7 @@
 #include "content/child/npapi/webplugin_resource_client.h"
 #include "content/common/view_messages.h"
 #include "content/public/common/content_constants.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/npapi/webplugin_delegate_proxy.h"
 #include "content/renderer/render_process.h"
@@ -256,7 +258,7 @@ bool WebPluginImpl::initialize(WebPluginContainer* container) {
   SetContainer(container);
 
   bool ok = plugin_delegate->Initialize(
-      plugin_url_, arg_names_, arg_values_, this, load_manually_);
+      plugin_url_, arg_names_, arg_values_, load_manually_);
   if (!ok) {
     plugin_delegate->PluginDestroyed();
 
@@ -624,10 +626,6 @@ bool WebPluginImpl::SetPostData(WebURLRequest* request,
   return rv;
 }
 
-WebPluginDelegate* WebPluginImpl::delegate() {
-  return delegate_;
-}
-
 bool WebPluginImpl::IsValidUrl(const GURL& url, Referrer referrer_flag) {
   if (referrer_flag == PLUGIN_SRC &&
       mime_type_ == kFlashPluginSwfMimeType &&
@@ -655,7 +653,7 @@ WebPluginDelegate* WebPluginImpl::CreatePluginDelegate() {
   bool in_process_plugin = RenderProcess::current()->UseInProcessPlugins();
   if (in_process_plugin) {
 #if defined(OS_WIN) && !defined(USE_AURA)
-    return WebPluginDelegateImpl::Create(file_path_, mime_type_);
+    return WebPluginDelegateImpl::Create(this, file_path_, mime_type_);
 #else
     // In-proc plugins aren't supported on non-Windows.
     NOTIMPLEMENTED();
@@ -663,7 +661,7 @@ WebPluginDelegate* WebPluginImpl::CreatePluginDelegate() {
 #endif
   }
 
-  return new WebPluginDelegateProxy(mime_type_, render_view_);
+  return new WebPluginDelegateProxy(this, mime_type_, render_view_);
 }
 
 WebPluginImpl::RoutingStatus WebPluginImpl::RouteToFrame(
@@ -805,6 +803,13 @@ void WebPluginImpl::URLRedirectResponse(bool allow, int resource_id) {
   }
 }
 
+bool WebPluginImpl::CheckIfRunInsecureContent(const GURL& url) {
+  if (!webframe_)
+    return true;
+
+  return webframe_->checkIfRunInsecureContent(url);
+}
+
 #if defined(OS_MACOSX)
 WebPluginAcceleratedSurface* WebPluginImpl::GetAcceleratedSurface(
     gfx::GpuPreference gpu_preference) {
@@ -894,6 +899,8 @@ WebPluginImpl::ClientInfo* WebPluginImpl::GetClientInfoFromLoader(
 void WebPluginImpl::willSendRequest(WebURLLoader* loader,
                                     WebURLRequest& request,
                                     const WebURLResponse& response) {
+  // TODO(jam): THIS LOGIC IS COPIED IN PluginURLFetcher::OnReceivedRedirect
+  // until kDirectNPAPIRequests is the default and we can remove this old path.
   WebPluginImpl::ClientInfo* client_info = GetClientInfoFromLoader(loader);
   if (client_info) {
     // Currently this check is just to catch an https -> http redirect when
@@ -1183,16 +1190,14 @@ void WebPluginImpl::HandleURLRequestInternal(const char* url,
   if (!WebPluginImpl::IsValidUrl(complete_url, referrer_flag))
     return;
 
-  WebPluginResourceClient* resource_client = delegate_->CreateResourceClient(
-      resource_id, complete_url, notify_id);
-  if (!resource_client)
-    return;
-
   // If the RouteToFrame call returned a failure then inform the result
   // back to the plugin asynchronously.
   if ((routing_status == INVALID_URL) ||
       (routing_status == GENERAL_FAILURE)) {
-    resource_client->DidFail(resource_id);
+    WebPluginResourceClient* resource_client = delegate_->CreateResourceClient(
+        resource_id, complete_url, notify_id);
+    if (resource_client)
+      resource_client->DidFail(resource_id);
     return;
   }
 
@@ -1202,9 +1207,37 @@ void WebPluginImpl::HandleURLRequestInternal(const char* url,
   if (!delegate_)
     return;
 
-  InitiateHTTPRequest(resource_id, resource_client, complete_url, method, buf,
-                      len, NULL, referrer_flag, notify_redirects,
-                      is_plugin_src_load);
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDirectNPAPIRequests)) {
+    // We got here either because the plugin called GetURL/PostURL, or because
+    // we're fetching the data for an embed tag. If we're in multi-process mode,
+    // we want to fetch the data in the plugin process as the renderer won't be
+    // able to request any origin when site isolation is in place. So bounce
+    // this request back to the plugin process which will use ResourceDispatcher
+    // to fetch the url.
+
+    // TODO(jam): any better way of getting this? Can't find a way to get
+    // frame()->loader()->outgoingReferrer() which
+    // WebFrameImpl::setReferrerForRequest does.
+    WebURLRequest request(complete_url);
+    SetReferrer(&request, referrer_flag);
+    GURL referrer(
+        request.httpHeaderField(WebString::fromUTF8("Referer")).utf8());
+
+    GURL first_party_for_cookies = webframe_->document().firstPartyForCookies();
+    delegate_->FetchURL(resource_id, notify_id, complete_url,
+                        first_party_for_cookies, method, std::string(buf, len),
+                        referrer, notify_redirects, is_plugin_src_load, 0,
+                        render_view_->routing_id());
+  } else {
+    WebPluginResourceClient* resource_client = delegate_->CreateResourceClient(
+        resource_id, complete_url, notify_id);
+    if (!resource_client)
+      return;
+    InitiateHTTPRequest(resource_id, resource_client, complete_url, method, buf,
+                        len, NULL, referrer_flag, notify_redirects,
+                        is_plugin_src_load);
+  }
 }
 
 unsigned long WebPluginImpl::GetNextResourceId() {
@@ -1381,7 +1414,7 @@ bool WebPluginImpl::ReinitializePluginForResponse(
   container_->allowScriptObjects();
 
   bool ok = plugin_delegate && plugin_delegate->Initialize(
-      plugin_url_, arg_names_, arg_values_, this, load_manually_);
+      plugin_url_, arg_names_, arg_values_, load_manually_);
 
   if (!ok) {
     container_->clearScriptObjects();
diff --git a/content/renderer/npapi/webplugin_impl.h b/content/renderer/npapi/webplugin_impl.h
index 63f85fb..264a5fc 100644
--- a/content/renderer/npapi/webplugin_impl.h
+++ b/content/renderer/npapi/webplugin_impl.h
@@ -66,9 +66,9 @@ class WebPluginImpl : public WebPlugin,
                                          const char* buf,
                                          uint32 length);
 
-  virtual WebPluginDelegate* delegate();
+  WebKit::WebFrame* webframe() { return webframe_; }
+  WebPluginDelegate* delegate() { return delegate_; }
 
- private:
   // WebKit::WebPlugin methods:
   virtual bool initialize(
       WebKit::WebPluginContainer* container);
@@ -101,12 +101,6 @@ class WebPluginImpl : public WebPlugin,
   virtual void SetWindow(gfx::PluginWindowHandle window) OVERRIDE;
   virtual void SetAcceptsInputEvents(bool accepts) OVERRIDE;
   virtual void WillDestroyWindow(gfx::PluginWindowHandle window) OVERRIDE;
-#if defined(OS_WIN)
-  void SetWindowlessData(HANDLE pump_messages_event,
-                         gfx::NativeViewId dummy_activation_window) { }
-  void ReparentPluginWindow(HWND window, HWND parent) { }
-  void ReportExecutableMemory(size_t size) { }
-#endif
   virtual void CancelResource(unsigned long id) OVERRIDE;
   virtual void Invalidate() OVERRIDE;
   virtual void InvalidateRect(const gfx::Rect& rect) OVERRIDE;
@@ -119,7 +113,29 @@ class WebPluginImpl : public WebPlugin,
                          const std::string& cookie) OVERRIDE;
   virtual std::string GetCookies(const GURL& url,
                                  const GURL& first_party_for_cookies) OVERRIDE;
+  virtual void HandleURLRequest(const char* url,
+                                const char *method,
+                                const char* target,
+                                const char* buf,
+                                unsigned int len,
+                                int notify_id,
+                                bool popups_allowed,
+                                bool notify_redirects) OVERRIDE;
+  virtual void CancelDocumentLoad() OVERRIDE;
+  virtual void InitiateHTTPRangeRequest(const char* url,
+                                        const char* range_info,
+                                        int pending_request_id) OVERRIDE;
+  virtual bool IsOffTheRecord() OVERRIDE;
+  virtual void SetDeferResourceLoading(unsigned long resource_id,
+                                       bool defer) OVERRIDE;
   virtual void URLRedirectResponse(bool allow, int resource_id) OVERRIDE;
+  virtual bool CheckIfRunInsecureContent(const GURL& url) OVERRIDE;
+#if defined(OS_WIN)
+  void SetWindowlessData(HANDLE pump_messages_event,
+                         gfx::NativeViewId dummy_activation_window) { }
+  void ReparentPluginWindow(HWND window, HWND parent) { }
+  void ReportExecutableMemory(size_t size) { }
+#endif
 #if defined(OS_MACOSX)
   virtual WebPluginAcceleratedSurface* GetAcceleratedSurface(
       gfx::GpuPreference gpu_preference) OVERRIDE;
@@ -130,6 +146,7 @@ class WebPluginImpl : public WebPlugin,
   virtual void AcceleratedPluginSwappedIOSurface() OVERRIDE;
 #endif
 
+ private:
   // Given a (maybe partial) url, completes using the base url.
   GURL CompleteURL(const char* url);
 
@@ -215,27 +232,6 @@ class WebPluginImpl : public WebPlugin,
   // request given a handle.
   void RemoveClient(WebKit::WebURLLoader* loader);
 
-  virtual void HandleURLRequest(const char* url,
-                                const char *method,
-                                const char* target,
-                                const char* buf,
-                                unsigned int len,
-                                int notify_id,
-                                bool popups_allowed,
-                                bool notify_redirects) OVERRIDE;
-
-  virtual void CancelDocumentLoad() OVERRIDE;
-
-  virtual void InitiateHTTPRangeRequest(const char* url,
-                                        const char* range_info,
-                                        int pending_request_id) OVERRIDE;
-
-  virtual void SetDeferResourceLoading(unsigned long resource_id,
-                                       bool defer) OVERRIDE;
-
-  // Ignore in-process plugins mode for this flag.
-  virtual bool IsOffTheRecord() OVERRIDE;
-
   // Handles HTTP multipart responses, i.e. responses received with a HTTP
   // status code of 206.
   // Returns false if response is not multipart (may be if we requested