Fix deadlock when plugin puts an alert and right afterwards the browser process makes a win32 call that ends up waiting on the plugin. Since the plugin thread is blocked, the Windows message doesn't get dispatched and the browser ui thread deadlocks. The message from the renderer would make the plugin run a nested message loop but it doesn't get run on the browser ui thread since it's blocked. The fix is to set the event that runs nested message loop in the renderer process.

BUG=23147
TEST=ui tests already cover nested message loops and plugins.  This particular scenario is hard to write a test case for because it's a race condition involving the browser.
Review URL: http://codereview.chromium.org/243018

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@27421 0039d316-1c4b-4281-b951-d872f2087c98

45 files changed, 125 insertions, 382 deletions

diff --git a/chrome/browser/app_modal_dialog.cc b/chrome/browser/app_modal_dialog.cc
index 8385626..8abf78e 100644
--- a/chrome/browser/app_modal_dialog.cc
+++ b/chrome/browser/app_modal_dialog.cc
@@ -117,9 +117,5 @@ void AppModalDialog::OnAccept(const std::wstring& prompt_text,
 }
 
 void AppModalDialog::OnClose() {
-  if (tab_contents_) {
-    tab_contents_->OnJavaScriptMessageBoxWindowDestroyed();
-  }
-
   SendCloseNotification();
 }
diff --git a/chrome/browser/browser.cc b/chrome/browser/browser.cc
index 8baf8dc..a2e2b243 100644
--- a/chrome/browser/browser.cc
+++ b/chrome/browser/browser.cc
@@ -632,7 +632,7 @@ TabContents* Browser::AddRestoredTab(
     bool select,
     bool pin) {
   TabContents* new_tab = new TabContents(profile(), NULL,
-      MSG_ROUTING_NONE, NULL, tabstrip_model_.GetSelectedTabContents());
+      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
   new_tab->controller().RestoreFromState(navigations, selected_navigation);
 
   bool really_pin =
@@ -654,7 +654,7 @@ void Browser::ReplaceRestoredTab(
     const std::vector<TabNavigation>& navigations,
     int selected_navigation) {
   TabContents* replacement = new TabContents(profile(), NULL,
-      MSG_ROUTING_NONE, NULL, tabstrip_model_.GetSelectedTabContents());
+      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
   replacement->controller().RestoreFromState(navigations, selected_navigation);
 
   tabstrip_model_.ReplaceNavigationControllerAt(
@@ -1565,7 +1565,7 @@ TabContents* Browser::CreateTabContentsForURL(
     PageTransition::Type transition, bool defer_load,
     SiteInstance* instance) const {
   TabContents* contents = new TabContents(profile, instance,
-      MSG_ROUTING_NONE, NULL, tabstrip_model_.GetSelectedTabContents());
+      MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
 
   if (!defer_load) {
     // Load the initial URL before adding the new tab contents to the tab strip
@@ -2581,7 +2581,7 @@ TabContents* Browser::BuildRestoredTab(
     // Create a NavigationController. This constructor creates the appropriate
     // set of TabContents.
     TabContents* new_tab = new TabContents(profile_, NULL,
-        MSG_ROUTING_NONE, NULL, tabstrip_model_.GetSelectedTabContents());
+        MSG_ROUTING_NONE, tabstrip_model_.GetSelectedTabContents());
     new_tab->controller().RestoreFromState(navigations, selected_navigation);
     return new_tab;
   } else {
diff --git a/chrome/browser/chromeos/main_menu.cc b/chrome/browser/chromeos/main_menu.cc
index 5d57217..d801ceb 100644
--- a/chrome/browser/chromeos/main_menu.cc
+++ b/chrome/browser/chromeos/main_menu.cc
@@ -82,7 +82,7 @@ void MainMenu::ShowImpl() {
   GURL menu_url(kMenuURL);
   site_instance_ = SiteInstance::CreateSiteInstanceForURL(browser_->profile(),
                                                           menu_url);
-  menu_rvh_ = new RenderViewHost(site_instance_, this, MSG_ROUTING_NONE, NULL);
+  menu_rvh_ = new RenderViewHost(site_instance_, this, MSG_ROUTING_NONE);
 
   rwhv_ = new RenderWidgetHostViewGtk(menu_rvh_);
   rwhv_->InitAsChild();
@@ -156,15 +156,13 @@ void MainMenu::RequestMove(const gfx::Rect& new_bounds) {
   rwhv_->SetSize(new_bounds.size());
 }
 
-void MainMenu::CreateNewWindow(int route_id,
-                               base::WaitableEvent* modal_dialog_event) {
+void MainMenu::CreateNewWindow(int route_id) {
   if (pending_contents_.get()) {
     NOTREACHED();
     return;
   }
 
-  helper_.CreateNewWindow(route_id, modal_dialog_event, browser_->profile(),
-                          site_instance_,
+  helper_.CreateNewWindow(route_id, browser_->profile(), site_instance_,
                           DOMUIFactory::GetDOMUIType(GURL(kMenuURL)), NULL);
   pending_contents_.reset(helper_.GetCreatedWindow(route_id));
   pending_contents_->set_delegate(&tab_contents_delegate_);
diff --git a/chrome/browser/chromeos/main_menu.h b/chrome/browser/chromeos/main_menu.h
index 0f4f257..85bf5689 100644
--- a/chrome/browser/chromeos/main_menu.h
+++ b/chrome/browser/chromeos/main_menu.h
@@ -117,8 +117,7 @@ class MainMenu : public RenderViewHostDelegate,
   virtual void RequestMove(const gfx::Rect& new_bounds);
 
   // RenderViewHostDelegate::View overrides.
-  virtual void CreateNewWindow(int route_id,
-                               base::WaitableEvent* modal_dialog_event);
+  virtual void CreateNewWindow(int route_id);
   virtual void CreateNewWidget(int route_id, bool activatable) {}
   virtual void ShowCreatedWindow(int route_id,
                                  WindowOpenDisposition disposition,
diff --git a/chrome/browser/debugger/devtools_window.cc b/chrome/browser/debugger/devtools_window.cc
index 4095273..75fb4fe 100644
--- a/chrome/browser/debugger/devtools_window.cc
+++ b/chrome/browser/debugger/devtools_window.cc
@@ -51,8 +51,7 @@ DevToolsWindow::DevToolsWindow(Profile* profile,
       inspected_window_(NULL),
       docked_(docked) {
   // Create TabContents with devtools.
-  tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL,
-                                  NULL);
+  tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL);
   GURL url(std::string(chrome::kChromeUIDevToolsURL) + "devtools.html");
   tab_contents_->render_view_host()->AllowBindings(BindingsPolicy::DOM_UI);
   tab_contents_->controller().LoadURL(url, GURL(), PageTransition::START_PAGE);
diff --git a/chrome/browser/extensions/extension_host.cc b/chrome/browser/extensions/extension_host.cc
index 9a1baa6..8ff822f 100644
--- a/chrome/browser/extensions/extension_host.cc
+++ b/chrome/browser/extensions/extension_host.cc
@@ -48,8 +48,7 @@ ExtensionHost::ExtensionHost(Extension* extension, SiteInstance* site_instance,
       document_element_available_(false),
       url_(url),
       extension_host_type_(host_type) {
-  render_view_host_ = new RenderViewHost(
-      site_instance, this, MSG_ROUTING_NONE, NULL);
+  render_view_host_ = new RenderViewHost(site_instance, this, MSG_ROUTING_NONE);
   render_view_host_->AllowBindings(BindingsPolicy::EXTENSION);
   if (enable_dom_automation_)
     render_view_host_->AllowBindings(BindingsPolicy::DOM_AUTOMATION);
@@ -289,10 +288,9 @@ RenderViewHostDelegate::View* ExtensionHost::GetViewDelegate() {
   return this;
 }
 
-void ExtensionHost::CreateNewWindow(int route_id,
-                                    base::WaitableEvent* modal_dialog_event) {
+void ExtensionHost::CreateNewWindow(int route_id) {
   delegate_view_helper_.CreateNewWindow(
-      route_id, modal_dialog_event, render_view_host()->process()->profile(),
+      route_id, render_view_host()->process()->profile(),
       site_instance(), DOMUIFactory::GetDOMUIType(url_), NULL);
 }
 
diff --git a/chrome/browser/extensions/extension_host.h b/chrome/browser/extensions/extension_host.h
index 3b3d64e..3a129a7 100644
--- a/chrome/browser/extensions/extension_host.h
+++ b/chrome/browser/extensions/extension_host.h
@@ -111,8 +111,7 @@ class ExtensionHost : public RenderViewHostDelegate,
                                     bool* did_suppress_message);
 
   // RenderViewHostDelegate::View
-  virtual void CreateNewWindow(int route_id,
-                               base::WaitableEvent* modal_dialog_event);
+  virtual void CreateNewWindow(int route_id);
   virtual void CreateNewWidget(int route_id, bool activatable);
   virtual void ShowCreatedWindow(int route_id,
                                  WindowOpenDisposition disposition,
diff --git a/chrome/browser/external_tab_container.cc b/chrome/browser/external_tab_container.cc
index b4bd12b..b478f14 100644
--- a/chrome/browser/external_tab_container.cc
+++ b/chrome/browser/external_tab_container.cc
@@ -90,8 +90,7 @@ bool ExternalTabContainer::Init(Profile* profile,
     tab_contents_ = existing_contents;
     tab_contents_->controller().set_profile(profile);
   } else {
-    tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL,
-                                    NULL);
+    tab_contents_ = new TabContents(profile, NULL, MSG_ROUTING_NONE, NULL);
   }
 
   tab_contents_->set_delegate(this);
diff --git a/chrome/browser/renderer_host/render_view_host.cc b/chrome/browser/renderer_host/render_view_host.cc
index 9a2b127..4184d43 100644
--- a/chrome/browser/renderer_host/render_view_host.cc
+++ b/chrome/browser/renderer_host/render_view_host.cc
@@ -100,15 +100,13 @@ RenderViewHost* RenderViewHost::FromID(int render_process_id,
 
 RenderViewHost::RenderViewHost(SiteInstance* instance,
                                RenderViewHostDelegate* delegate,
-                               int routing_id,
-                               base::WaitableEvent* modal_dialog_event)
+                               int routing_id)
     : RenderWidgetHost(instance->GetProcess(), routing_id),
       instance_(instance),
       delegate_(delegate),
       waiting_for_drag_context_response_(false),
       enabled_bindings_(0),
       pending_request_id_(0),
-      modal_dialog_count_(0),
       navigations_suspended_(false),
       suspended_nav_message_(NULL),
       run_modal_reply_msg_(NULL),
@@ -119,10 +117,6 @@ RenderViewHost::RenderViewHost(SiteInstance* instance,
       in_inspect_element_mode_(false) {
   DCHECK(instance_);
   DCHECK(delegate_);
-  if (modal_dialog_event == NULL)
-    modal_dialog_event = new base::WaitableEvent(true, false);
-
-  modal_dialog_event_.reset(modal_dialog_event);
 
   // TODO(mpcomplete): remove this notification (and registrar) when we figure
   // out why we're crashing on process()->Init().
@@ -189,28 +183,6 @@ bool RenderViewHost::CreateRenderView() {
 
   renderer_initialized_ = true;
 
-#if defined(OS_WIN)
-  HANDLE modal_dialog_event_handle;
-  HANDLE renderer_process_handle = process()->process().handle();
-  if (renderer_process_handle == NULL)
-    renderer_process_handle = GetCurrentProcess();
-
-  BOOL result = DuplicateHandle(GetCurrentProcess(),
-      modal_dialog_event_->handle(),
-      renderer_process_handle,
-      &modal_dialog_event_handle,
-      SYNCHRONIZE,
-      FALSE,
-      0);
-  DCHECK(result) <<
-      "Couldn't duplicate the modal dialog handle for the renderer.";
-#endif
-
-  ModalDialogEvent modal_dialog_event;
-#if defined(OS_WIN)
-  modal_dialog_event.event = modal_dialog_event_handle;
-#endif
-
   // Force local storage to be enabled for extensions. This is so that we can
   // enable extensions by default before databases, if necessary.
   // TODO(aa): This should be removed when local storage and databases are
@@ -222,7 +194,6 @@ bool RenderViewHost::CreateRenderView() {
   }
 
   Send(new ViewMsg_New(GetNativeViewId(),
-                       modal_dialog_event,
                        delegate_->GetRendererPrefs(),
                        webkit_prefs,
                        routing_id()));
@@ -612,17 +583,11 @@ void RenderViewHost::JavaScriptMessageBoxClosed(IPC::Message* reply_msg,
   Send(reply_msg);
 }
 
-void RenderViewHost::JavaScriptMessageBoxWindowDestroyed() {
-  ResetModalDialogEvent();
-}
-
 void RenderViewHost::ModalHTMLDialogClosed(IPC::Message* reply_msg,
                                            const std::string& json_retval) {
   if (is_waiting_for_unload_ack_)
     StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
 
-  ResetModalDialogEvent();
-
   ViewHostMsg_ShowModalHTMLDialog::WriteReplyParams(reply_msg, json_retval);
   Send(reply_msg);
 }
@@ -734,6 +699,11 @@ void RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
   // On Linux we can avoid this by avoiding sync messages from browser->plugin.
   // On Mac we avoid this by not supporting windowed plugins.
   if (msg.is_sync() && !msg.is_caller_pumping_messages()) {
+    // NOTE: IF YOU HIT THIS ASSERT, THE SOLUTION IS ALMOST NEVER TO RUN A
+    // NESTED MESSAGE LOOP IN THE RENDERER!!!
+    // That introduces reentrancy which causes hard to track bugs.  You should
+    // find a way to either turn this into an asynchronous message, or one
+    // that can be answered on the IO thread.
     NOTREACHED() << "Can't send sync messages to UI thread without pumping "
         "messages in the renderer or else deadlocks can occur if the page "
         "has windowed plugins! (message type " << msg.type() << ")";
@@ -869,26 +839,18 @@ void RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
 void RenderViewHost::Shutdown() {
   // If we are being run modally (see RunModal), then we need to cleanup.
   if (run_modal_reply_msg_) {
-    ResetModalDialogEvent();
     Send(run_modal_reply_msg_);
     run_modal_reply_msg_ = NULL;
   }
   RenderWidgetHost::Shutdown();
 }
 
-void RenderViewHost::CreateNewWindow(int route_id,
-                                     ModalDialogEvent modal_dialog_event) {
+void RenderViewHost::CreateNewWindow(int route_id) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (!view)
     return;
 
-  base::WaitableEvent* waitable_event = new base::WaitableEvent(
-#if defined(OS_WIN)
-      modal_dialog_event.event);
-#else
-      true, false);
-#endif
-  view->CreateNewWindow(route_id, waitable_event);
+  view->CreateNewWindow(route_id);
 }
 
 void RenderViewHost::CreateNewWidget(int route_id, bool activatable) {
@@ -921,7 +883,6 @@ void RenderViewHost::OnMsgShowWidget(int route_id,
 
 void RenderViewHost::OnMsgRunModal(IPC::Message* reply_msg) {
   DCHECK(!run_modal_reply_msg_);
-  SignalModalDialogEvent();
   run_modal_reply_msg_ = reply_msg;
 
   // TODO(darin): Bug 1107929: Need to inform our delegate to show this view in
@@ -1328,7 +1289,6 @@ void RenderViewHost::OnMsgRunJavaScriptMessage(
   // process input events.
   process()->set_ignore_input_events(true);
   StopHangMonitorTimeout();
-  SignalModalDialogEvent();
   delegate_->RunJavaScriptMessage(message, default_prompt, frame_url, flags,
                                   reply_msg,
                                   &are_javascript_messages_suppressed_);
@@ -1341,7 +1301,6 @@ void RenderViewHost::OnMsgRunBeforeUnloadConfirm(const GURL& frame_url,
   // shouldn't process input events.
   process()->set_ignore_input_events(true);
   StopHangMonitorTimeout();
-  SignalModalDialogEvent();
   delegate_->RunBeforeUnloadConfirm(message, reply_msg);
 }
 
@@ -1349,7 +1308,6 @@ void RenderViewHost::OnMsgShowModalHTMLDialog(
     const GURL& url, int width, int height, const std::string& json_arguments,
     IPC::Message* reply_msg) {
   StopHangMonitorTimeout();
-  SignalModalDialogEvent();
   delegate_->ShowModalHTMLDialog(url, width, height, json_arguments, reply_msg);
 }
 
@@ -1710,16 +1668,6 @@ void RenderViewHost::OnCSSInserted() {
   delegate_->DidInsertCSS();
 }
 
-void RenderViewHost::SignalModalDialogEvent() {
-  if (modal_dialog_count_++ == 0)
-    modal_dialog_event_->Signal();
-}
-
-void RenderViewHost::ResetModalDialogEvent() {
-  if (--modal_dialog_count_ == 0)
-    modal_dialog_event_->Reset();
-}
-
 void RenderViewHost::UpdateBrowserWindowId(int window_id) {
   Send(new ViewMsg_UpdateBrowserWindowId(routing_id(), window_id));
 }
diff --git a/chrome/browser/renderer_host/render_view_host.h b/chrome/browser/renderer_host/render_view_host.h
index 18f6021..e2710c3 100644
--- a/chrome/browser/renderer_host/render_view_host.h
+++ b/chrome/browser/renderer_host/render_view_host.h
@@ -12,7 +12,6 @@
 #include "chrome/browser/extensions/extension_function_dispatcher.h"
 #include "chrome/browser/renderer_host/render_view_host_delegate.h"
 #include "chrome/browser/renderer_host/render_widget_host.h"
-#include "chrome/common/modal_dialog_event.h"
 #include "chrome/common/notification_registrar.h"
 #include "chrome/common/notification_type.h"
 #include "chrome/common/page_zoom.h"
@@ -34,10 +33,6 @@ struct ViewMsg_Navigate_Params;
 struct WebDropData;
 struct WebPreferences;
 
-namespace base {
-class WaitableEvent;
-}
-
 namespace gfx {
 class Point;
 }
@@ -86,14 +81,10 @@ class RenderViewHost : public RenderWidgetHost,
   static RenderViewHost* FromID(int render_process_id, int render_view_id);
 
   // routing_id could be a valid route id, or it could be MSG_ROUTING_NONE, in
-  // which case RenderWidgetHost will create a new one.  modal_dialog_event is
-  // the event that's set when showing a modal dialog so that the renderer and
-  // plugin processes know to pump messages.  An existing event can be passed
-  // in, otherwise if it's NULL a new event will be created.
+  // which case RenderWidgetHost will create a new one.
   RenderViewHost(SiteInstance* instance,
                  RenderViewHostDelegate* delegate,
-                 int routing_id,
-                 base::WaitableEvent* modal_dialog_event);
+                 int routing_id);
   virtual ~RenderViewHost();
 
   SiteInstance* site_instance() const { return instance_; }
@@ -303,10 +294,6 @@ class RenderViewHost : public RenderWidgetHost,
                                   bool success,
                                   const std::wstring& prompt);
 
-  // This function is called when the JavaScript message box window has been
-  // destroyed.
-  void JavaScriptMessageBoxWindowDestroyed();
-
   // Notifies the RenderView that the modal html dialog has been closed.
   void ModalHTMLDialogClosed(IPC::Message* reply_msg,
                              const std::string& json_retval);
@@ -423,7 +410,7 @@ class RenderViewHost : public RenderWidgetHost,
   virtual gfx::Rect GetRootWindowResizerRect() const;
 
   // Creates a new RenderView with the given route id.
-  void CreateNewWindow(int route_id, ModalDialogEvent modal_dialog_event);
+  void CreateNewWindow(int route_id);
 
   // Creates a new RenderWidget with the given route id.
   void CreateNewWidget(int route_id, bool activatable);
@@ -440,9 +427,6 @@ class RenderViewHost : public RenderWidgetHost,
   // Notify the renderer that its view type has changed.
   void ViewTypeChanged(ViewType::Type type);
 
-  void SignalModalDialogEvent();
-  void ResetModalDialogEvent();
-
   // Tell renderer which browser window it is being attached to.
   void UpdateBrowserWindowId(int window_id);
 
@@ -625,15 +609,6 @@ class RenderViewHost : public RenderWidgetHost,
   // and thus started the unload process.
   int pending_request_id_;
 
-  // Handle to an event that's set when the page is showing a modal dialog box
-  // (or equivalent constrained window).  The renderer and plugin processes
-  // check this to know if they should pump messages/tasks then.
-  scoped_ptr<base::WaitableEvent> modal_dialog_event_;
-
-  // Multiple dialog boxes can be shown before the first one is finished,
-  // so we keep a counter to know when we can reset the modal dialog event.
-  int modal_dialog_count_;
-
   // Whether we should buffer outgoing Navigate messages rather than sending
   // them.  This will be true when a RenderViewHost is created for a cross-site
   // request, until we hear back from the onbeforeunload handler of the old
diff --git a/chrome/browser/renderer_host/render_view_host_delegate.h b/chrome/browser/renderer_host/render_view_host_delegate.h
index 416d608..9c121a1 100644
--- a/chrome/browser/renderer_host/render_view_host_delegate.h
+++ b/chrome/browser/renderer_host/render_view_host_delegate.h
@@ -80,8 +80,7 @@ class RenderViewHostDelegate {
     // the Windows function which is actually a #define.
     //
     // NOTE: this takes ownership of @modal_dialog_event
-    virtual void CreateNewWindow(int route_id,
-                                 base::WaitableEvent* modal_dialog_event) = 0;
+    virtual void CreateNewWindow(int route_id) = 0;
 
     // The page is trying to open a new widget (e.g. a select popup). The
     // widget should be created associated with the given route, but it should
diff --git a/chrome/browser/renderer_host/render_view_host_factory.cc b/chrome/browser/renderer_host/render_view_host_factory.cc
index 38af233..01e8a18 100644
--- a/chrome/browser/renderer_host/render_view_host_factory.cc
+++ b/chrome/browser/renderer_host/render_view_host_factory.cc
@@ -14,13 +14,11 @@ RenderViewHostFactory* RenderViewHostFactory::factory_ = NULL;
 RenderViewHost* RenderViewHostFactory::Create(
     SiteInstance* instance,
     RenderViewHostDelegate* delegate,
-    int routing_id,
-    base::WaitableEvent* modal_dialog_event) {
+    int routing_id) {
   if (factory_) {
-    return factory_->CreateRenderViewHost(instance, delegate,
-                                          routing_id, modal_dialog_event);
+    return factory_->CreateRenderViewHost(instance, delegate, routing_id);
   }
-  return new RenderViewHost(instance, delegate, routing_id, modal_dialog_event);
+  return new RenderViewHost(instance, delegate, routing_id);
 }
 
 // static
diff --git a/chrome/browser/renderer_host/render_view_host_factory.h b/chrome/browser/renderer_host/render_view_host_factory.h
index 9bbfa56..5e55054 100644
--- a/chrome/browser/renderer_host/render_view_host_factory.h
+++ b/chrome/browser/renderer_host/render_view_host_factory.h
@@ -25,8 +25,7 @@ class RenderViewHostFactory {
   // pointer will be passed to the caller.
   static RenderViewHost* Create(SiteInstance* instance,
                                 RenderViewHostDelegate* delegate,
-                                int routing_id,
-                                base::WaitableEvent* modal_dialog_event);
+                                int routing_id);
 
   // Returns true if there is currently a globally-registered factory.
   static bool has_factory() {
@@ -42,8 +41,7 @@ class RenderViewHostFactory {
   virtual RenderViewHost* CreateRenderViewHost(
       SiteInstance* instance,
       RenderViewHostDelegate* delegate,
-      int routing_id,
-      base::WaitableEvent* modal_dialog_event) = 0;
+      int routing_id) = 0;
 
   // Registers your factory to be called when new RenderViewHosts are created.
   // We have only one global factory, so there must be no factory registered
diff --git a/chrome/browser/renderer_host/render_widget_helper.cc b/chrome/browser/renderer_host/render_widget_helper.cc
index 26b8497..6534edf 100644
--- a/chrome/browser/renderer_host/render_widget_helper.cc
+++ b/chrome/browser/renderer_host/render_widget_helper.cc
@@ -202,40 +202,21 @@ void RenderWidgetHelper::OnCrossSiteClosePageACK(
 void RenderWidgetHelper::CreateNewWindow(int opener_id,
                                          bool user_gesture,
                                          base::ProcessHandle render_process,
-                                         int* route_id,
-                                         ModalDialogEvent* modal_dialog_event) {
+                                         int* route_id) {
   *route_id = GetNextRoutingID();
-
-  ModalDialogEvent modal_dialog_event_internal;
-#if defined(OS_WIN)
-  HANDLE event = CreateEvent(NULL, TRUE, FALSE, NULL);
-  modal_dialog_event_internal.event = event;
-
-  BOOL result = DuplicateHandle(GetCurrentProcess(),
-                                event,
-                                render_process,
-                                &modal_dialog_event->event,
-                                SYNCHRONIZE,
-                                FALSE,
-                                0);
-  DCHECK(result) << "Couldn't duplicate modal dialog event for the renderer.";
-#endif
-
   // Block resource requests until the view is created, since the HWND might be
   // needed if a response ends up creating a plugin.
   resource_dispatcher_host_->BlockRequestsForRoute(
       render_process_id_, *route_id);
 
   ui_loop_->PostTask(FROM_HERE, NewRunnableMethod(
-      this, &RenderWidgetHelper::OnCreateWindowOnUI, opener_id, *route_id,
-      modal_dialog_event_internal));
+      this, &RenderWidgetHelper::OnCreateWindowOnUI, opener_id, *route_id));
 }
 
-void RenderWidgetHelper::OnCreateWindowOnUI(
-    int opener_id, int route_id, ModalDialogEvent modal_dialog_event) {
+void RenderWidgetHelper::OnCreateWindowOnUI(int opener_id, int route_id) {
   RenderViewHost* host = RenderViewHost::FromID(render_process_id_, opener_id);
   if (host)
-    host->CreateNewWindow(route_id, modal_dialog_event);
+    host->CreateNewWindow(route_id);
 
   g_browser_process->io_thread()->message_loop()->PostTask(FROM_HERE,
       NewRunnableMethod(this, &RenderWidgetHelper::OnCreateWindowOnIO,
@@ -263,36 +244,6 @@ void RenderWidgetHelper::OnCreateWidgetOnUI(
     host->CreateNewWidget(route_id, activatable);
 }
 
-void RenderWidgetHelper::SignalModalDialogEvent(int routing_id) {
-  ui_loop()->PostTask(FROM_HERE,
-      NewRunnableMethod(
-          this, &RenderWidgetHelper::SignalModalDialogEventOnUI,
-          routing_id));
-}
-
-void RenderWidgetHelper::SignalModalDialogEventOnUI(int routing_id) {
-  RenderViewHost* host = RenderViewHost::FromID(render_process_id_,
-                                                routing_id);
-  if (host) {
-    host->SignalModalDialogEvent();
-  }
-}
-
-void RenderWidgetHelper::ResetModalDialogEvent(int routing_id) {
-  ui_loop()->PostTask(FROM_HERE,
-      NewRunnableMethod(
-          this, &RenderWidgetHelper::ResetModalDialogEventOnUI,
-          routing_id));
-}
-
-void RenderWidgetHelper::ResetModalDialogEventOnUI(int routing_id) {
-  RenderViewHost* host = RenderViewHost::FromID(render_process_id_,
-                                                routing_id);
-  if (host) {
-    host->ResetModalDialogEvent();
-  }
-}
-
 #if defined(OS_MACOSX)
 TransportDIB* RenderWidgetHelper::MapTransportDIB(TransportDIB::Id dib_id) {
   AutoLock locked(allocated_dibs_lock_);
diff --git a/chrome/browser/renderer_host/render_widget_helper.h b/chrome/browser/renderer_host/render_widget_helper.h
index 87c97be..2b3b445 100644
--- a/chrome/browser/renderer_host/render_widget_helper.h
+++ b/chrome/browser/renderer_host/render_widget_helper.h
@@ -13,7 +13,6 @@
 #include "base/ref_counted.h"
 #include "base/lock.h"
 #include "base/waitable_event.h"
-#include "chrome/common/modal_dialog_event.h"
 #include "chrome/common/transport_dib.h"
 
 namespace IPC {
@@ -126,8 +125,7 @@ class RenderWidgetHelper :
   void CreateNewWindow(int opener_id,
                        bool user_gesture,
                        base::ProcessHandle render_process,
-                       int* route_id,
-                       ModalDialogEvent* modal_dialog_event);
+                       int* route_id);
   void CreateNewWidget(int opener_id, bool activatable, int* route_id);
 
 #if defined(OS_MACOSX)
@@ -138,12 +136,6 @@ class RenderWidgetHelper :
   void FreeTransportDIB(TransportDIB::Id dib_id);
 #endif
 
-  // Helper functions to signal and reset the modal dialog event, used to
-  // signal the renderer that it needs to pump messages while waiting for
-  // sync calls to return. These functions proxy the request to the UI thread.
-  void SignalModalDialogEvent(int routing_id);
-  void ResetModalDialogEvent(int routing_id);
-
  private:
   // A class used to proxy a paint message.  PaintMsgProxy objects are created
   // on the IO thread and destroyed on the UI thread.
@@ -161,8 +153,7 @@ class RenderWidgetHelper :
 
   // Called on the UI thread to finish creating a window.
   void OnCreateWindowOnUI(int opener_id,
-                          int route_id,
-                          ModalDialogEvent modal_dialog_event);
+                          int route_id);
 
   // Called on the IO thread after a window was created on the UI thread.
   void OnCreateWindowOnIO(int route_id);
@@ -186,9 +177,6 @@ class RenderWidgetHelper :
   std::map<TransportDIB::Id, int> allocated_dibs_;
 #endif
 
-  void SignalModalDialogEventOnUI(int routing_id);
-  void ResetModalDialogEventOnUI(int routing_id);
-
   // A map of live paint messages.  Must hold pending_paints_lock_ to access.
   // The PaintMsgProxy objects are not owned by this map.  (See PaintMsgProxy
   // for details about how the lifetime of instances are managed.)
diff --git a/chrome/browser/renderer_host/resource_message_filter.cc b/chrome/browser/renderer_host/resource_message_filter.cc
index 0b8a923..44032b1 100644
--- a/chrome/browser/renderer_host/resource_message_filter.cc
+++ b/chrome/browser/renderer_host/resource_message_filter.cc
@@ -433,13 +433,11 @@ URLRequestContext* ResourceMessageFilter::GetRequestContext(
 }
 
 void ResourceMessageFilter::OnMsgCreateWindow(
-    int opener_id, bool user_gesture, int* route_id,
-    ModalDialogEvent* modal_dialog_event) {
+    int opener_id, bool user_gesture, int* route_id) {
   render_widget_helper_->CreateNewWindow(opener_id,
                                          user_gesture,
                                          handle(),
-                                         route_id,
-                                         modal_dialog_event);
+                                         route_id);
 }
 
 void ResourceMessageFilter::OnMsgCreateWidget(int opener_id,
@@ -824,8 +822,6 @@ void ResourceMessageFilter::OnScriptedPrint(
   }
   DCHECK(host_window);
 
-  render_widget_helper_->SignalModalDialogEvent(params.routing_id);
-
   printer_query->GetSettings(printing::PrinterQuery::ASK_USER,
                              host_window,
                              params.expected_pages_count,
@@ -854,7 +850,6 @@ void ResourceMessageFilter::OnScriptedPrintReply(
   } else {
     printer_query->StopWorker();
   }
-  render_widget_helper_->ResetModalDialogEvent(routing_id);
 }
 
 #endif  // OS_WIN
diff --git a/chrome/browser/renderer_host/resource_message_filter.h b/chrome/browser/renderer_host/resource_message_filter.h
index 6b93eee..2e54492 100644
--- a/chrome/browser/renderer_host/resource_message_filter.h
+++ b/chrome/browser/renderer_host/resource_message_filter.h
@@ -24,7 +24,6 @@
 #include "chrome/browser/net/resolve_proxy_msg_helper.h"
 #include "chrome/browser/renderer_host/render_widget_helper.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
-#include "chrome/common/modal_dialog_event.h"
 #include "chrome/common/notification_registrar.h"
 #include "chrome/common/transport_dib.h"
 #include "ipc/ipc_channel_proxy.h"
@@ -113,8 +112,7 @@ class ResourceMessageFilter : public IPC::ChannelProxy::MessageFilter,
                        const NotificationDetails& details);
 
  private:
-  void OnMsgCreateWindow(int opener_id, bool user_gesture, int* route_id,
-                         ModalDialogEvent* modal_dialog_event);
+  void OnMsgCreateWindow(int opener_id, bool user_gesture, int* route_id);
   void OnMsgCreateWidget(int opener_id, bool activatable, int* route_id);
   void OnSetCookie(const GURL& url,
                    const GURL& first_party_for_cookies,
diff --git a/chrome/browser/renderer_host/test/site_instance_unittest.cc b/chrome/browser/renderer_host/test/site_instance_unittest.cc
index 24b269e..0320152 100644
--- a/chrome/browser/renderer_host/test/site_instance_unittest.cc
+++ b/chrome/browser/renderer_host/test/site_instance_unittest.cc
@@ -116,7 +116,7 @@ TEST_F(SiteInstanceTest, SiteInstanceDestructor) {
                                                &siteDeleteCounter,
                                                &browsingDeleteCounter);
   {
-    TabContents contents(profile.get(), instance, MSG_ROUTING_NONE, NULL, NULL);
+    TabContents contents(profile.get(), instance, MSG_ROUTING_NONE, NULL);
     EXPECT_EQ(1, siteDeleteCounter);
     EXPECT_EQ(1, browsingDeleteCounter);
   }
diff --git a/chrome/browser/renderer_host/test/test_render_view_host.cc b/chrome/browser/renderer_host/test/test_render_view_host.cc
index 49ac1d4..9a65b2e 100644
--- a/chrome/browser/renderer_host/test/test_render_view_host.cc
+++ b/chrome/browser/renderer_host/test/test_render_view_host.cc
@@ -13,9 +13,8 @@ using webkit_glue::PasswordForm;
 
 TestRenderViewHost::TestRenderViewHost(SiteInstance* instance,
                                        RenderViewHostDelegate* delegate,
-                                       int routing_id,
-                                       base::WaitableEvent* modal_dialog_event)
-    : RenderViewHost(instance, delegate, routing_id, modal_dialog_event),
+                                       int routing_id)
+    : RenderViewHost(instance, delegate, routing_id),
       render_view_created_(false),
       delete_counter_(NULL) {
   set_view(new TestRenderWidgetHostView(this));
diff --git a/chrome/browser/renderer_host/test/test_render_view_host.h b/chrome/browser/renderer_host/test/test_render_view_host.h
index 5f1f0b8..cc707f8 100644
--- a/chrome/browser/renderer_host/test/test_render_view_host.h
+++ b/chrome/browser/renderer_host/test/test_render_view_host.h
@@ -101,8 +101,7 @@ class TestRenderViewHost : public RenderViewHost {
  public:
   TestRenderViewHost(SiteInstance* instance,
                      RenderViewHostDelegate* delegate,
-                     int routing_id,
-                     base::WaitableEvent* modal_dialog_event);
+                     int routing_id);
   virtual ~TestRenderViewHost();
 
   // Testing functions ---------------------------------------------------------
@@ -170,12 +169,10 @@ class TestRenderViewHostFactory : public RenderViewHostFactory {
   virtual RenderViewHost* CreateRenderViewHost(
       SiteInstance* instance,
       RenderViewHostDelegate* delegate,
-      int routing_id,
-      base::WaitableEvent* modal_dialog_event) {
+      int routing_id) {
     // See declaration of render_process_host_factory_ below.
     instance->set_render_process_host_factory(render_process_host_factory_);
-    return new TestRenderViewHost(instance, delegate, routing_id,
-                                  modal_dialog_event);
+    return new TestRenderViewHost(instance, delegate, routing_id);
   }
 
  private:
diff --git a/chrome/browser/tab_contents/interstitial_page.cc b/chrome/browser/tab_contents/interstitial_page.cc
index 7421c3a..4191d4d 100644
--- a/chrome/browser/tab_contents/interstitial_page.cc
+++ b/chrome/browser/tab_contents/interstitial_page.cc
@@ -78,8 +78,7 @@ class InterstitialPage::InterstitialPageRVHViewDelegate
   explicit InterstitialPageRVHViewDelegate(InterstitialPage* page);
 
   // RenderViewHostDelegate::View implementation:
-  virtual void CreateNewWindow(int route_id,
-                               base::WaitableEvent* modal_dialog_event);
+  virtual void CreateNewWindow(int route_id);
   virtual void CreateNewWidget(int route_id, bool activatable);
   virtual void ShowCreatedWindow(int route_id,
                                  WindowOpenDisposition disposition,
@@ -378,7 +377,7 @@ void InterstitialPage::DomOperationResponse(const std::string& json_string,
 RenderViewHost* InterstitialPage::CreateRenderViewHost() {
   RenderViewHost* render_view_host = new RenderViewHost(
       SiteInstance::CreateSiteInstance(tab()->profile()),
-      this, MSG_ROUTING_NONE, NULL);
+      this, MSG_ROUTING_NONE);
   return render_view_host;
 }
 
@@ -528,7 +527,7 @@ InterstitialPage::InterstitialPageRVHViewDelegate::
 }
 
 void InterstitialPage::InterstitialPageRVHViewDelegate::CreateNewWindow(
-    int route_id, base::WaitableEvent* modal_dialog_event) {
+    int route_id) {
   NOTREACHED() << "InterstitialPage does not support showing popups yet.";
 }
 
diff --git a/chrome/browser/tab_contents/navigation_controller_unittest.cc b/chrome/browser/tab_contents/navigation_controller_unittest.cc
index 285190e..a8b75c3 100644
--- a/chrome/browser/tab_contents/navigation_controller_unittest.cc
+++ b/chrome/browser/tab_contents/navigation_controller_unittest.cc
@@ -1144,7 +1144,7 @@ TEST_F(NavigationControllerTest, RestoreNavigate) {
   navigations.push_back(TabNavigation(0, url, GURL(),
                                       ASCIIToUTF16("Title"), "state",
                                       PageTransition::LINK));
-  TabContents our_contents(profile(), NULL, MSG_ROUTING_NONE, NULL, NULL);
+  TabContents our_contents(profile(), NULL, MSG_ROUTING_NONE, NULL);
   NavigationController& our_controller = our_contents.controller();
   our_controller.RestoreFromState(navigations, 0);
   our_controller.GoToIndex(0);
diff --git a/chrome/browser/tab_contents/render_view_host_delegate_helper.cc b/chrome/browser/tab_contents/render_view_host_delegate_helper.cc
index 2d5c359..fad0540 100644
--- a/chrome/browser/tab_contents/render_view_host_delegate_helper.cc
+++ b/chrome/browser/tab_contents/render_view_host_delegate_helper.cc
@@ -19,16 +19,18 @@
 #include "chrome/common/pref_names.h"
 #include "chrome/common/pref_service.h"
 
-void RenderViewHostDelegateViewHelper::CreateNewWindow(int route_id,
-    base::WaitableEvent* modal_dialog_event, Profile* profile,
-    SiteInstance* site, DOMUITypeID domui_type, TabContents* old_tab_contents) {
+void RenderViewHostDelegateViewHelper::CreateNewWindow(
+    int route_id,
+    Profile* profile,
+    SiteInstance* site,
+    DOMUITypeID domui_type,
+    TabContents* old_tab_contents) {
   // Create the new web contents. This will automatically create the new
   // TabContentsView. In the future, we may want to create the view separately.
   TabContents* new_contents =
       new TabContents(profile,
                       site,
                       route_id,
-                      modal_dialog_event,
                       old_tab_contents);
   new_contents->set_opener_dom_ui_type(domui_type);
   TabContentsView* new_view = new_contents->view();
diff --git a/chrome/browser/tab_contents/render_view_host_delegate_helper.h b/chrome/browser/tab_contents/render_view_host_delegate_helper.h
index a55e222..21ce783 100644
--- a/chrome/browser/tab_contents/render_view_host_delegate_helper.h
+++ b/chrome/browser/tab_contents/render_view_host_delegate_helper.h
@@ -31,7 +31,6 @@ class RenderViewHostDelegateViewHelper {
   RenderViewHostDelegateViewHelper() {}
 
   virtual void CreateNewWindow(int route_id,
-                               base::WaitableEvent* modal_dialog_event,
                                Profile* profile,
                                SiteInstance* site,
                                DOMUITypeID domui_type,
diff --git a/chrome/browser/tab_contents/render_view_host_manager.cc b/chrome/browser/tab_contents/render_view_host_manager.cc
index 6b3866f..29afb4a 100644
--- a/chrome/browser/tab_contents/render_view_host_manager.cc
+++ b/chrome/browser/tab_contents/render_view_host_manager.cc
@@ -48,15 +48,14 @@ RenderViewHostManager::~RenderViewHostManager() {
 
 void RenderViewHostManager::Init(Profile* profile,
                                  SiteInstance* site_instance,
-                                 int routing_id,
-                                 base::WaitableEvent* modal_dialog_event) {
+                                 int routing_id) {
   // Create a RenderViewHost, once we have an instance.  It is important to
   // immediately give this SiteInstance to a RenderViewHost so that it is
   // ref counted.
   if (!site_instance)
     site_instance = SiteInstance::CreateSiteInstance(profile);
   render_view_host_ = RenderViewHostFactory::Create(
-      site_instance, render_view_delegate_, routing_id, modal_dialog_event);
+      site_instance, render_view_delegate_, routing_id);
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CREATED_FOR_TAB,
       Source<RenderViewHostManager>(this),
@@ -213,10 +212,6 @@ void RenderViewHostManager::OnJavaScriptMessageBoxClosed(
   render_view_host_->JavaScriptMessageBoxClosed(reply_msg, success, prompt);
 }
 
-void RenderViewHostManager::OnJavaScriptMessageBoxWindowDestroyed() {
-  render_view_host_->JavaScriptMessageBoxWindowDestroyed();
-}
-
 void RenderViewHostManager::ShouldClosePage(bool for_cross_site_transition,
                                             bool proceed) {
   if (for_cross_site_transition) {
@@ -420,7 +415,7 @@ bool RenderViewHostManager::CreatePendingRenderView(SiteInstance* instance) {
   }
 
   pending_render_view_host_ = RenderViewHostFactory::Create(
-      instance, render_view_delegate_, MSG_ROUTING_NONE, NULL);
+      instance, render_view_delegate_, MSG_ROUTING_NONE);
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CREATED_FOR_TAB,
       Source<RenderViewHostManager>(this),
diff --git a/chrome/browser/tab_contents/render_view_host_manager.h b/chrome/browser/tab_contents/render_view_host_manager.h
index c562628..8d168cf 100644
--- a/chrome/browser/tab_contents/render_view_host_manager.h
+++ b/chrome/browser/tab_contents/render_view_host_manager.h
@@ -73,8 +73,7 @@ class RenderViewHostManager
   // For arguments, see TabContents constructor.
   void Init(Profile* profile,
             SiteInstance* site_instance,
-            int routing_id,
-            base::WaitableEvent* modal_dialog_event);
+            int routing_id);
 
   // Returns the currently actuive RenderViewHost.
   //
@@ -140,9 +139,6 @@ class RenderViewHostManager
                                     bool success,
                                     const std::wstring& prompt);
 
-  // Forwards this message to the RenderViewHost.
-  void OnJavaScriptMessageBoxWindowDestroyed();
-
   // Sets the passed passed interstitial as the currently showing interstitial.
   // |interstitial_page| should be non NULL (use the remove_interstitial_page
   // method to unset the interstitial) and no interstitial page should be set
diff --git a/chrome/browser/tab_contents/render_view_host_manager_unittest.cc b/chrome/browser/tab_contents/render_view_host_manager_unittest.cc
index 699b9e0..556b8bf 100644
--- a/chrome/browser/tab_contents/render_view_host_manager_unittest.cc
+++ b/chrome/browser/tab_contents/render_view_host_manager_unittest.cc
@@ -128,8 +128,7 @@ TEST_F(RenderViewHostManagerTest, Init) {
   TestTabContents tab_contents(profile_.get(), instance);
   RenderViewHostManager manager(&tab_contents, &tab_contents);
 
-  manager.Init(profile_.get(), instance, MSG_ROUTING_NONE,
-               NULL /* modal_dialog_event */);
+  manager.Init(profile_.get(), instance, MSG_ROUTING_NONE);
 
   RenderViewHost* host = manager.current_host();
   ASSERT_TRUE(host);
@@ -153,8 +152,7 @@ TEST_F(RenderViewHostManagerTest, Navigate) {
   // Create.
   RenderViewHostManager manager(&tab_contents, &tab_contents);
 
-  manager.Init(profile_.get(), instance, MSG_ROUTING_NONE,
-               NULL /* modal_dialog_event */);
+  manager.Init(profile_.get(), instance, MSG_ROUTING_NONE);
 
   RenderViewHost* host;
 
@@ -227,8 +225,7 @@ TEST_F(RenderViewHostManagerTest, DOMUI) {
   TestTabContents tab_contents(profile_.get(), instance);
   RenderViewHostManager manager(&tab_contents, &tab_contents);
 
-  manager.Init(profile_.get(), instance, MSG_ROUTING_NONE,
-               NULL /* modal_dialog_event */);
+  manager.Init(profile_.get(), instance, MSG_ROUTING_NONE);
 
   GURL url("chrome://newtab");
   NavigationEntry entry(NULL /* instance */, -1 /* page_id */, url,
diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index fab3ccc..4dd83dc 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -214,7 +214,6 @@ class TabContents::GearsCreateShortcutCallbackFunctor {
 TabContents::TabContents(Profile* profile,
                          SiteInstance* site_instance,
                          int routing_id,
-                         base::WaitableEvent* modal_dialog_event,
                          const TabContents* base_tab_contents)
     : delegate_(NULL),
       ALLOW_THIS_IN_INITIALIZER_LIST(controller_(this, profile)),
@@ -276,7 +275,7 @@ TabContents::TabContents(Profile* profile,
     generator->StartThumbnailing();
 #endif
 
-  render_manager_.Init(profile, site_instance, routing_id, modal_dialog_event);
+  render_manager_.Init(profile, site_instance, routing_id);
 
   // We have the initial size of the view be based on the size of the passed in
   // tab contents (normally a tab from the same window).
@@ -756,7 +755,7 @@ TabContents* TabContents::Clone() {
   // processes for some reason.
   TabContents* tc = new TabContents(profile(),
                                     SiteInstance::CreateSiteInstance(profile()),
-                                    MSG_ROUTING_NONE, NULL, this);
+                                    MSG_ROUTING_NONE, this);
   tc->controller().CopyStateFrom(controller_);
   return tc;
 }
@@ -1101,10 +1100,6 @@ void TabContents::OnJavaScriptMessageBoxClosed(IPC::Message* reply_msg,
   render_manager_.OnJavaScriptMessageBoxClosed(reply_msg, success, prompt);
 }
 
-void TabContents::OnJavaScriptMessageBoxWindowDestroyed() {
-  render_manager_.OnJavaScriptMessageBoxWindowDestroyed();
-}
-
 void TabContents::OnSavePage() {
   // If we can not save the page, try to download it.
   if (!SavePackage::IsSavableContents(contents_mime_type())) {
diff --git a/chrome/browser/tab_contents/tab_contents.h b/chrome/browser/tab_contents/tab_contents.h
index 5ce6acb..26d69f5 100644
--- a/chrome/browser/tab_contents/tab_contents.h
+++ b/chrome/browser/tab_contents/tab_contents.h
@@ -122,7 +122,6 @@ class TabContents : public PageNavigator,
   TabContents(Profile* profile,
               SiteInstance* site_instance,
               int routing_id,
-              base::WaitableEvent* modal_dialog_event,
               const TabContents* base_tab_contents);
   virtual ~TabContents();
 
@@ -549,9 +548,6 @@ class TabContents : public PageNavigator,
                                     bool success,
                                     const std::wstring& prompt);
 
-  // AppModalDialog calls this when the javascript dialog has been destroyed.
-  void OnJavaScriptMessageBoxWindowDestroyed();
-
   // Prepare for saving the current web page to disk.
   void OnSavePage();
 
diff --git a/chrome/browser/tab_contents/tab_contents_view.cc b/chrome/browser/tab_contents/tab_contents_view.cc
index df09b21..7a45e04 100644
--- a/chrome/browser/tab_contents/tab_contents_view.cc
+++ b/chrome/browser/tab_contents/tab_contents_view.cc
@@ -27,11 +27,9 @@ void TabContentsView::UpdatePreferredWidth(int pref_width) {
   preferred_width_ = pref_width;
 }
 
-void TabContentsView::CreateNewWindow(int route_id,
-                                      base::WaitableEvent* modal_dialog_event) {
+void TabContentsView::CreateNewWindow(int route_id) {
   delegate_view_helper_.CreateNewWindow(
-      route_id, modal_dialog_event,
-      tab_contents_->profile(), tab_contents_->GetSiteInstance(),
+      route_id, tab_contents_->profile(), tab_contents_->GetSiteInstance(),
       DOMUIFactory::GetDOMUIType(tab_contents_->GetURL()), tab_contents_);
 }
 
diff --git a/chrome/browser/tab_contents/tab_contents_view.h b/chrome/browser/tab_contents/tab_contents_view.h
index a83d4dd..ca42276 100644
--- a/chrome/browser/tab_contents/tab_contents_view.h
+++ b/chrome/browser/tab_contents/tab_contents_view.h
@@ -173,8 +173,7 @@ class TabContentsView : public RenderViewHostDelegate::View {
   // We implement these functions on RenderViewHostDelegate::View directly and
   // do some book-keeping associated with the request. The request is then
   // forwarded to *Internal which does platform-specific work.
-  virtual void CreateNewWindow(int route_id,
-                               base::WaitableEvent* modal_dialog_event);
+  virtual void CreateNewWindow(int route_id);
   virtual void CreateNewWidget(int route_id, bool activatable);
   virtual void ShowCreatedWindow(int route_id,
                                  WindowOpenDisposition disposition,
diff --git a/chrome/browser/tab_contents/test_tab_contents.cc b/chrome/browser/tab_contents/test_tab_contents.cc
index 904c780..97643f3 100644
--- a/chrome/browser/tab_contents/test_tab_contents.cc
+++ b/chrome/browser/tab_contents/test_tab_contents.cc
@@ -7,7 +7,7 @@
 #include "chrome/browser/renderer_host/test/test_render_view_host.h"
 
 TestTabContents::TestTabContents(Profile* profile, SiteInstance* instance)
-    : TabContents(profile, instance, MSG_ROUTING_NONE, NULL, NULL),
+    : TabContents(profile, instance, MSG_ROUTING_NONE, NULL),
       transition_cross_site(false) {
 }
 
diff --git a/chrome/browser/tab_contents/web_contents_unittest.cc b/chrome/browser/tab_contents/web_contents_unittest.cc
index 5231116..c7e089c 100644
--- a/chrome/browser/tab_contents/web_contents_unittest.cc
+++ b/chrome/browser/tab_contents/web_contents_unittest.cc
@@ -151,7 +151,7 @@ class TestInterstitialPage : public InterstitialPage {
   virtual RenderViewHost* CreateRenderViewHost() {
     return new TestRenderViewHost(
         SiteInstance::CreateSiteInstance(tab()->profile()),
-        this, MSG_ROUTING_NONE, NULL);
+        this, MSG_ROUTING_NONE);
   }
 
   virtual TabContentsView* CreateTabContentsView() { return NULL; }
diff --git a/chrome/browser/tabs/tab_strip_model_unittest.cc b/chrome/browser/tabs/tab_strip_model_unittest.cc
index afa1880..bc2eaa8 100644
--- a/chrome/browser/tabs/tab_strip_model_unittest.cc
+++ b/chrome/browser/tabs/tab_strip_model_unittest.cc
@@ -79,7 +79,7 @@ class TabStripDummyDelegate : public TabStripModelDelegate {
 class TabStripModelTest : public RenderViewHostTestHarness {
  public:
   TabContents* CreateTabContents() {
-    return new TabContents(profile(), NULL, 0, NULL, NULL);
+    return new TabContents(profile(), NULL, 0, NULL);
   }
 
   // Forwards a URL "load" request through to our dummy TabContents
@@ -1006,7 +1006,7 @@ TEST_F(TabStripModelTest, AddTabContents_ForgetOpeners) {
 
 // Added for http://b/issue?id=958960
 TEST_F(TabStripModelTest, AppendContentsReselectionTest) {
-  TabContents fake_destinations_tab(profile(), NULL, 0, NULL, NULL);
+  TabContents fake_destinations_tab(profile(), NULL, 0, NULL);
   TabStripDummyDelegate delegate(&fake_destinations_tab);
   TabStripModel tabstrip(&delegate, profile());
   EXPECT_TRUE(tabstrip.empty());
diff --git a/chrome/browser/views/dom_view.cc b/chrome/browser/views/dom_view.cc
index c8cebf7..a1bf0dc 100644
--- a/chrome/browser/views/dom_view.cc
+++ b/chrome/browser/views/dom_view.cc
@@ -21,8 +21,8 @@ bool DOMView::Init(Profile* profile, SiteInstance* instance) {
     return true;
 
   initialized_ = true;
-  tab_contents_.reset(new TabContents(profile, instance,
-                                      MSG_ROUTING_NONE, NULL, NULL));
+  tab_contents_.reset(
+      new TabContents(profile, instance, MSG_ROUTING_NONE, NULL));
   views::NativeViewHost::Attach(tab_contents_->GetNativeView());
   return true;
 }
diff --git a/chrome/chrome.gyp b/chrome/chrome.gyp
index c1d37f6..5d1e78d 100644
--- a/chrome/chrome.gyp
+++ b/chrome/chrome.gyp
@@ -545,8 +545,7 @@
         'common/logging_chrome.h',
         'common/main_function_params.h',
         'common/message_router.cc',
-        'common/message_router.h',
-        'common/modal_dialog_event.h',
+        'common/message_router.h'
         'common/mru_cache.h',
         'common/navigation_gesture.h',
         'common/navigation_types.h',
diff --git a/chrome/common/modal_dialog_event.h b/chrome/common/modal_dialog_event.h
deleted file mode 100644
index 2a14c87..0000000
--- a/chrome/common/modal_dialog_event.h
+++ /dev/null
@@ -1,20 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_COMMON_MODAL_DIALOG_EVENT_H_
-#define CHROME_COMMON_MODAL_DIALOG_EVENT_H_
-
-// This structure is passed around where we need a modal dialog event, which
-// is currently not plumbed on Mac & Linux.
-//
-// TODO(port) Fix this. This structure should probably go away and we should
-// do the modal dialog event in some portable way. If you remove this, be
-// sure to also remove the ParamTraits for it in resource_messages.h
-struct ModalDialogEvent {
-#if defined(OS_WIN)
-  HANDLE event;
-#endif
-};
-
-#endif  // CHROME_COMMON_MODAL_DIALOG_EVENT_H_
diff --git a/chrome/common/render_messages.h b/chrome/common/render_messages.h
index 8bc8405..99a4a68 100644
--- a/chrome/common/render_messages.h
+++ b/chrome/common/render_messages.h
@@ -22,7 +22,6 @@
 #include "chrome/common/extensions/update_manifest.h"
 #include "chrome/common/extensions/url_pattern.h"
 #include "chrome/common/filter_policy.h"
-#include "chrome/common/modal_dialog_event.h"
 #include "chrome/common/navigation_gesture.h"
 #include "chrome/common/page_transition_types.h"
 #include "chrome/common/renderer_preferences.h"
@@ -1726,29 +1725,6 @@ struct ParamTraits<WebDropData> {
   }
 };
 
-template<>
-struct ParamTraits<ModalDialogEvent> {
-  typedef ModalDialogEvent param_type;
-#if defined(OS_WIN)
-  static void Write(Message* m, const param_type& p) {
-    WriteParam(m, p.event);
-  }
-  static bool Read(const Message* m, void** iter, param_type* p) {
-    return ReadParam(m, iter, &p->event);
-  }
-#else
-  static void Write(Message* m, const param_type& p) {
-  }
-  static bool Read(const Message* m, void** iter, param_type* p) {
-    return true;
-  }
-#endif
-
-  static void Log(const param_type& p, std::wstring* l) {
-    l->append(L"<ModalDialogEvent>");
-  }
-};
-
 // Traits for AudioManager::Format.
 template <>
 struct ParamTraits<AudioManager::Format> {
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index ac124b5..28dc35b 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -69,9 +69,8 @@ IPC_BEGIN_MESSAGES(View)
   // Tells the renderer to create a new view.
   // This message is slightly different, the view it takes is the view to
   // create, the message itself is sent as a non-view control message.
-  IPC_MESSAGE_CONTROL5(ViewMsg_New,
+  IPC_MESSAGE_CONTROL4(ViewMsg_New,
                        gfx::NativeViewId, /* parent window */
-                       ModalDialogEvent, /* model dialog box event */
                        RendererPreferences,
                        WebPreferences,
                        int32 /* view id */)
@@ -769,13 +768,11 @@ IPC_END_MESSAGES(View)
 IPC_BEGIN_MESSAGES(ViewHost)
   // Sent by the renderer when it is creating a new window.  The browser creates
   // a tab for it and responds with a ViewMsg_CreatingNew_ACK.  If route_id is
-  // MSG_ROUTING_NONE, the view couldn't be created.  modal_dialog_event is set
-  // by the browser when a modal dialog is shown.
-  IPC_SYNC_MESSAGE_CONTROL2_2(ViewHostMsg_CreateWindow,
+  // MSG_ROUTING_NONE, the view couldn't be created.
+  IPC_SYNC_MESSAGE_CONTROL2_1(ViewHostMsg_CreateWindow,
                               int /* opener_id */,
                               bool /* user_gesture */,
-                              int /* route_id */,
-                              ModalDialogEvent /* modal_dialog_event */)
+                              int /* route_id */)
 
   // Similar to ViewHostMsg_CreateWindow, except used for sub-widgets, like
   // <select> dropdowns.  This message is sent to the TabContents that
diff --git a/chrome/renderer/print_web_view_helper_win.cc b/chrome/renderer/print_web_view_helper_win.cc
index bed79f7..c5bf711 100644
--- a/chrome/renderer/print_web_view_helper_win.cc
+++ b/chrome/renderer/print_web_view_helper_win.cc
@@ -99,11 +99,8 @@ void PrintWebViewHelper::Print(WebFrame* frame, bool script_initiated) {
       params.has_selection = frame->hasSelection();
       params.expected_pages_count = expected_pages_count;
 
-      msg = new ViewHostMsg_ScriptedPrint(params,
-                                          &print_settings);
-      msg->set_pump_messages_event(render_view_->modal_dialog_event());
-
-      if (Send(msg)) {
+      msg = new ViewHostMsg_ScriptedPrint(params, &print_settings);
+      if (render_view_->SendAndRunNestedMessageLoop(msg)) {
         msg = NULL;
 
         // If the settings are invalid, early quit.
diff --git a/chrome/renderer/render_thread.cc b/chrome/renderer/render_thread.cc
index 7480523..d307356 100644
--- a/chrome/renderer/render_thread.cc
+++ b/chrome/renderer/render_thread.cc
@@ -284,7 +284,7 @@ void RenderThread::OnControlMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(ViewMsg_Extension_SetL10nMessages,
                         OnExtensionSetL10nMessages)
 #if defined(IPC_MESSAGE_LOG_ENABLED)
-    IPC_MESSAGE_HANDLER(ViewMsg_SetIPCLoggingEnabled, 
+    IPC_MESSAGE_HANDLER(ViewMsg_SetIPCLoggingEnabled,
                         OnSetIPCLoggingEnabled)
 #endif
   IPC_END_MESSAGE_MAP()
@@ -318,22 +318,14 @@ void RenderThread::OnSetCSSColors(
 }
 
 void RenderThread::OnCreateNewView(gfx::NativeViewId parent_hwnd,
-                                   ModalDialogEvent modal_dialog_event,
                                    const RendererPreferences& renderer_prefs,
                                    const WebPreferences& webkit_prefs,
                                    int32 view_id) {
   EnsureWebKitInitialized();
 
   // When bringing in render_view, also bring in webkit's glue and jsbindings.
-  base::WaitableEvent* waitable_event = new base::WaitableEvent(
-#if defined(OS_WIN)
-      modal_dialog_event.event);
-#else
-      true, false);
-#endif
-
   RenderView::Create(
-      this, parent_hwnd, waitable_event, MSG_ROUTING_NONE, renderer_prefs,
+      this, parent_hwnd, MSG_ROUTING_NONE, renderer_prefs,
       webkit_prefs, new SharedRenderViewCounter(0), view_id);
 }
 
diff --git a/chrome/renderer/render_thread.h b/chrome/renderer/render_thread.h
index 9fa7203..5be1585 100644
--- a/chrome/renderer/render_thread.h
+++ b/chrome/renderer/render_thread.h
@@ -29,7 +29,6 @@ class SkBitmap;
 class UserScriptSlave;
 class URLPattern;
 
-struct ModalDialogEvent;
 struct RendererPreferences;
 struct WebPreferences;
 
@@ -152,7 +151,6 @@ class RenderThread : public RenderThreadBase,
   void OnSetNextPageID(int32 next_page_id);
   void OnSetCSSColors(const std::vector<CSSColors::CSSColorMapping>& colors);
   void OnCreateNewView(gfx::NativeViewId parent_hwnd,
-                       ModalDialogEvent modal_dialog_event,
                        const RendererPreferences& renderer_prefs,
                        const WebPreferences& webkit_prefs,
                        int32 view_id);
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 842dfc0..e86c27d 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -208,6 +208,7 @@ RenderView::RenderView(RenderThreadBase* render_thread,
       last_indexed_page_id_(-1),
       opened_by_user_gesture_(true),
       ALLOW_THIS_IN_INITIALIZER_LIST(method_factory_(this)),
+      modal_dialog_count_(0),
       devtools_agent_(NULL),
       devtools_client_(NULL),
       history_back_list_count_(0),
@@ -229,6 +230,8 @@ RenderView::RenderView(RenderThreadBase* render_thread,
       document_tag_(0),
       webkit_preferences_(webkit_preferences) {
   Singleton<RenderViewSet>()->render_view_set_.insert(this);
+
+  modal_dialog_event_.reset(new base::WaitableEvent(true, false));
 }
 
 RenderView::~RenderView() {
@@ -249,7 +252,6 @@ RenderView::~RenderView() {
 RenderView* RenderView::Create(
     RenderThreadBase* render_thread,
     gfx::NativeViewId parent_hwnd,
-    base::WaitableEvent* modal_dialog_event,
     int32 opener_id,
     const RendererPreferences& renderer_prefs,
     const WebPreferences& webkit_prefs,
@@ -258,7 +260,6 @@ RenderView* RenderView::Create(
   DCHECK(routing_id != MSG_ROUTING_NONE);
   scoped_refptr<RenderView> view = new RenderView(render_thread, webkit_prefs);
   view->Init(parent_hwnd,
-             modal_dialog_event,
              opener_id,
              renderer_prefs,
              counter,
@@ -285,7 +286,6 @@ void RenderView::PluginCrashed(base::ProcessId pid,
 }
 
 void RenderView::Init(gfx::NativeViewId parent_hwnd,
-                      base::WaitableEvent* modal_dialog_event,
                       int32 opener_id,
                       const RendererPreferences& renderer_prefs,
                       SharedRenderViewCounter* counter,
@@ -331,7 +331,6 @@ void RenderView::Init(gfx::NativeViewId parent_hwnd,
   }
 
   host_window_ = parent_hwnd;
-  modal_dialog_event_.reset(modal_dialog_event);
 
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kDomAutomationController))
@@ -1197,12 +1196,9 @@ bool RenderView::RunJavaScriptMessage(int type,
   std::wstring result_temp;
   if (!result)
     result = &result_temp;
-  IPC::SyncMessage* msg = new ViewHostMsg_RunJavaScriptMessage(
-      routing_id_, message, default_value, frame_url, type, &success, result);
-
-  msg->set_pump_messages_event(modal_dialog_event_.get());
-  Send(msg);
 
+  SendAndRunNestedMessageLoop(new ViewHostMsg_RunJavaScriptMessage(
+      routing_id_, message, default_value, frame_url, type, &success, result));
   return success;
 }
 
@@ -1311,26 +1307,18 @@ WebView* RenderView::createView(WebFrame* creator) {
   int32 routing_id = MSG_ROUTING_NONE;
   bool user_gesture = creator->isProcessingUserGesture();
 
-  ModalDialogEvent modal_dialog_event;
   render_thread_->Send(
-      new ViewHostMsg_CreateWindow(routing_id_, user_gesture, &routing_id,
-                                   &modal_dialog_event));
-  if (routing_id == MSG_ROUTING_NONE) {
+      new ViewHostMsg_CreateWindow(routing_id_, user_gesture, &routing_id));
+  if (routing_id == MSG_ROUTING_NONE)
     return NULL;
-  }
 
-  // The WebView holds a reference to this new RenderView
-  base::WaitableEvent* waitable_event = new base::WaitableEvent(
-#if defined(OS_WIN)
-      modal_dialog_event.event);
-#else
-      true, false);
-#endif
   RenderView* view = RenderView::Create(render_thread_,
-                                        NULL, waitable_event, routing_id_,
+                                        NULL,
+                                        routing_id_,
                                         renderer_preferences_,
                                         webkit_preferences_,
-                                        shared_popup_counter_, routing_id);
+                                        shared_popup_counter_,
+                                        routing_id);
   view->opened_by_user_gesture_ = user_gesture;
 
   // Record the security origin of the creator.
@@ -1595,13 +1583,9 @@ bool RenderView::runModalBeforeUnloadDialog(
   // This is an ignored return value, but is included so we can accept the same
   // response as RunJavaScriptMessage.
   std::wstring ignored_result;
-  IPC::SyncMessage* msg = new ViewHostMsg_RunBeforeUnloadConfirm(
+  SendAndRunNestedMessageLoop(new ViewHostMsg_RunBeforeUnloadConfirm(
       routing_id_, frame->url(), UTF16ToWideHack(message), &success,
-      &ignored_result);
-
-  msg->set_pump_messages_event(modal_dialog_event_.get());
-  Send(msg);
-
+      &ignored_result));
   return success;
 }
 
@@ -1718,10 +1702,7 @@ void RenderView::closeWidgetSoon() {
 void RenderView::runModal() {
   DCHECK(did_show_) << "should already have shown the view";
 
-  IPC::SyncMessage* msg = new ViewHostMsg_RunModal(routing_id_);
-
-  msg->set_pump_messages_event(modal_dialog_event_.get());
-  Send(msg);
+  SendAndRunNestedMessageLoop(new ViewHostMsg_RunModal(routing_id_));
 }
 
 // WebKit::WebFrameClient -----------------------------------------------------
@@ -2404,12 +2385,9 @@ void RenderView::ShowModalHTMLDialogForPlugin(
     const gfx::Size& size,
     const std::string& json_arguments,
     std::string* json_retval) {
-  IPC::SyncMessage* msg = new ViewHostMsg_ShowModalHTMLDialog(
+  SendAndRunNestedMessageLoop(new ViewHostMsg_ShowModalHTMLDialog(
       routing_id_, url, size.width(), size.height(), json_arguments,
-      json_retval);
-
-  msg->set_pump_messages_event(modal_dialog_event_.get());
-  Send(msg);
+      json_retval));
 }
 
 void RenderView::SyncNavigationState() {
@@ -3587,3 +3565,16 @@ void RenderView::EnsureDocumentTag() {
   }
 #endif
 }
+
+bool RenderView::SendAndRunNestedMessageLoop(IPC::SyncMessage* message) {
+  if (modal_dialog_count_++ == 0)
+    modal_dialog_event_->Signal();
+
+  message->EnableMessagePumping();  // Runs a nested message loop.
+  bool rv = Send(message);
+
+  if (--modal_dialog_count_ == 0)
+    modal_dialog_event_->Reset();
+
+  return rv;
+}
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index aeb4562..fd8c981 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -114,17 +114,14 @@ class RenderView : public RenderWidget,
   };
 
   // Creates a new RenderView.  The parent_hwnd specifies a HWND to use as the
-  // parent of the WebView HWND that will be created.  The modal_dialog_event
-  // is set by the RenderView whenever a modal dialog alert is shown, so that
-  // the renderer and plugin processes know to pump window messages.  If this
-  // is a constrained popup or as a new tab, opener_id is the routing ID of the
-  // RenderView responsible for creating this RenderView (corresponding to the
-  // parent_hwnd). |counter| is either a currently initialized counter, or NULL
-  // (in which case we treat this RenderView as a top level window).
+  // parent of the WebView HWND that will be created.  If this is a constrained
+  // popup or as a new tab, opener_id is the routing ID of the RenderView
+  // responsible for creating this RenderView (corresponding to parent_hwnd).
+  // |counter| is either a currently initialized counter, or NULL (in which case
+  // we treat this RenderView as a top level window).
   static RenderView* Create(
       RenderThreadBase* render_thread,
       gfx::NativeViewId parent_hwnd,
-      base::WaitableEvent* modal_dialog_event,  // takes ownership
       int32 opener_id,
       const RendererPreferences& renderer_prefs,
       const WebPreferences& webkit_prefs,
@@ -430,6 +427,9 @@ class RenderView : public RenderWidget,
     return webkit_preferences_;
   }
 
+  // Sends a message and runs a nested message loop.
+  bool SendAndRunNestedMessageLoop(IPC::SyncMessage* message);
+
  protected:
   // RenderWidget override.
   virtual void OnResize(const gfx::Size& new_size,
@@ -460,7 +460,6 @@ class RenderView : public RenderWidget,
   // set to 'MSG_ROUTING_NONE' if the true ID is not yet known. In this case,
   // CompleteInit must be called later with the true ID.
   void Init(gfx::NativeViewId parent,
-            base::WaitableEvent* modal_dialog_event,  // takes ownership
             int32 opener_id,
             const RendererPreferences& renderer_prefs,
             SharedRenderViewCounter* counter,
@@ -825,6 +824,10 @@ class RenderView : public RenderWidget,
   // check this to know if they should pump messages/tasks then.
   scoped_ptr<base::WaitableEvent> modal_dialog_event_;
 
+  // Multiple dialog boxes can be shown before the first one is finished,
+  // so we keep a counter to know when we can reset the modal dialog event.
+  int modal_dialog_count_;
+
   // Provides access to this renderer from the remote Inspector UI.
   scoped_ptr<DevToolsAgent> devtools_agent_;
 
diff --git a/chrome/test/render_view_test.cc b/chrome/test/render_view_test.cc
index 551eb17..2f12836 100644
--- a/chrome/test/render_view_test.cc
+++ b/chrome/test/render_view_test.cc
@@ -96,7 +96,7 @@ void RenderViewTest::SetUp() {
   render_thread_.set_routing_id(kRouteId);
 
   // This needs to pass the mock render thread to the view.
-  view_ = RenderView::Create(&render_thread_, NULL, NULL, kOpenerId,
+  view_ = RenderView::Create(&render_thread_, NULL, kOpenerId,
                              RendererPreferences(), WebPreferences(),
                              new SharedRenderViewCounter(0), kRouteId);