Add NaCl support to app_shell

Perform NaCl initialization during app_shell's startup path similar to
how Chrome initializes it.
* Refactor some of the lazy background page impulse code into ProcessManager so it can be shared with Chrome

BUG=400577
TEST=manual tests of app_shell, existing ProcessManager unit tests and browser tests

Review URL: https://codereview.chromium.org/437503004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@290082 0039d316-1c4b-4281-b951-d872f2087c98

30 files changed, 631 insertions, 80 deletions

diff --git a/chrome/browser/extensions/plugin_manager.cc b/chrome/browser/extensions/plugin_manager.cc
index 86bbe93..8d979f2 100644
--- a/chrome/browser/extensions/plugin_manager.cc
+++ b/chrome/browser/extensions/plugin_manager.cc
@@ -19,12 +19,12 @@
 #include "extensions/common/extension.h"
 #include "url/gurl.h"
 
-using content::PluginService;
-
 #if !defined(DISABLE_NACL)
-static const char kNaClPluginMimeType[] = "application/x-nacl";
+#include "components/nacl/common/nacl_constants.h"
 #endif
 
+using content::PluginService;
+
 namespace extensions {
 
 PluginManager::PluginManager(content::BrowserContext* context)
@@ -184,7 +184,7 @@ void PluginManager::UpdatePluginListWithNaClModules() {
   // Check each MIME type the plugins handle for the NaCl MIME type.
   for (mime_iter = pepper_info->mime_types.begin();
        mime_iter != pepper_info->mime_types.end(); ++mime_iter) {
-    if (mime_iter->mime_type == kNaClPluginMimeType) {
+    if (mime_iter->mime_type == nacl::kNaClPluginMimeType) {
       // This plugin handles "application/x-nacl".
 
       PluginService::GetInstance()->UnregisterInternalPlugin(pepper_info->path);
diff --git a/chrome/browser/nacl_host/nacl_browser_delegate_impl.cc b/chrome/browser/nacl_host/nacl_browser_delegate_impl.cc
index 229c882..3251a8e 100644
--- a/chrome/browser/nacl_host/nacl_browser_delegate_impl.cc
+++ b/chrome/browser/nacl_host/nacl_browser_delegate_impl.cc
@@ -19,8 +19,6 @@
 #include "chrome/common/logging_chrome.h"
 #include "chrome/common/pepper_permission_util.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/site_instance.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/browser/process_manager.h"
@@ -28,6 +26,7 @@
 #include "extensions/common/extension.h"
 #include "extensions/common/url_pattern.h"
 #include "ppapi/c/private/ppb_nacl_private.h"
+#include "url/gurl.h"
 
 namespace {
 
@@ -63,36 +62,10 @@ void OnKeepaliveOnUIThread(
   if (instance_data.size() < 1)
     return;
 
-  content::RenderFrameHost* render_frame_host =
-      content::RenderFrameHost::FromID(
-          instance_data[0].render_process_id, instance_data[0].render_frame_id);
-  if (!render_frame_host)
-    return;
-
-  content::SiteInstance* site_instance = render_frame_host->GetSiteInstance();
-  if (!site_instance)
-    return;
-
-  extensions::ExtensionSystem* extension_system =
-      extensions::ExtensionSystem::Get(site_instance->GetBrowserContext());
-  if (!extension_system)
-    return;
-
-  const ExtensionService* extension_service =
-      extension_system->extension_service();
-  if (!extension_service)
-    return;
-
-  const extensions::Extension* extension = extension_service->GetExtensionById(
-      instance_data[0].document_url.host(), false);
-  if (!extension)
-    return;
-
-  extensions::ProcessManager* pm = extension_system->process_manager();
-  if (!pm)
-    return;
-
-  pm->KeepaliveImpulse(extension);
+  extensions::ProcessManager::OnKeepaliveFromPlugin(
+      instance_data[0].render_process_id,
+      instance_data[0].render_frame_id,
+      instance_data[0].document_url.host());
 }
 
 // Calls OnKeepaliveOnUIThread on UI thread.
diff --git a/chrome/browser/plugins/plugin_info_message_filter.cc b/chrome/browser/plugins/plugin_info_message_filter.cc
index 2eade2a..f1d721c 100644
--- a/chrome/browser/plugins/plugin_info_message_filter.cc
+++ b/chrome/browser/plugins/plugin_info_message_filter.cc
@@ -16,7 +16,6 @@
 #include "chrome/browser/plugins/plugin_metadata.h"
 #include "chrome/browser/plugins/plugin_prefs.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/common/chrome_content_client.h"
 #include "chrome/common/content_settings.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/render_messages.h"
@@ -35,6 +34,10 @@
 #include "base/win/metro.h"
 #endif
 
+#if !defined(DISABLE_NACL)
+#include "components/nacl/common/nacl_constants.h"
+#endif
+
 using content::PluginService;
 using content::WebPluginInfo;
 
@@ -47,9 +50,11 @@ bool ShouldUseJavaScriptSettingForPlugin(const WebPluginInfo& plugin) {
     return false;
   }
 
+#if !defined(DISABLE_NACL)
   // Treat Native Client invocations like JavaScript.
-  if (plugin.name == base::ASCIIToUTF16(ChromeContentClient::kNaClPluginName))
+  if (plugin.name == base::ASCIIToUTF16(nacl::kNaClPluginName))
     return true;
+#endif
 
 #if defined(WIDEVINE_CDM_AVAILABLE) && defined(ENABLE_PEPPER_CDMS)
   // Treat CDM invocations like JavaScript.
diff --git a/chrome/browser/plugins/plugin_prefs.cc b/chrome/browser/plugins/plugin_prefs.cc
index d8cc025..25d3516 100644
--- a/chrome/browser/plugins/plugin_prefs.cc
+++ b/chrome/browser/plugins/plugin_prefs.cc
@@ -23,7 +23,6 @@
 #include "chrome/browser/plugins/plugin_prefs_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_constants.h"
-#include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
@@ -33,6 +32,10 @@
 #include "content/public/browser/plugin_service.h"
 #include "content/public/common/webplugininfo.h"
 
+#if !defined(DISABLE_NACL)
+#include "components/nacl/common/nacl_constants.h"
+#endif
+
 using content::BrowserThread;
 using content::PluginService;
 
@@ -241,15 +244,16 @@ bool PluginPrefs::IsPluginEnabled(const content::WebPluginInfo& plugin) const {
   if (plugin_status == POLICY_DISABLED || group_status == POLICY_DISABLED)
     return false;
 
+#if !defined(DISABLE_NACL)
   // If enabling NaCl, make sure the plugin is also enabled. See bug
   // http://code.google.com/p/chromium/issues/detail?id=81010 for more
   // information.
   // TODO(dspringer): When NaCl is on by default, remove this code.
-  if ((plugin.name ==
-       base::ASCIIToUTF16(ChromeContentClient::kNaClPluginName)) &&
+  if ((plugin.name == base::ASCIIToUTF16(nacl::kNaClPluginName)) &&
       CommandLine::ForCurrentProcess()->HasSwitch(switches::kEnableNaCl)) {
     return true;
   }
+#endif
 
   base::AutoLock auto_lock(lock_);
   // Check user preferences for the plug-in.
diff --git a/chrome/common/chrome_content_client.cc b/chrome/common/chrome_content_client.cc
index 3a5452e..fde26ef 100644
--- a/chrome/common/chrome_content_client.cc
+++ b/chrome/common/chrome_content_client.cc
@@ -50,6 +50,7 @@
 #endif
 
 #if !defined(DISABLE_NACL)
+#include "components/nacl/common/nacl_constants.h"
 #include "ppapi/native_client/src/trusted/plugin/ppapi_entrypoints.h"
 #endif
 
@@ -74,18 +75,6 @@ const char kPDFPluginOutOfProcessMimeType[] =
 const uint32 kPDFPluginPermissions = ppapi::PERMISSION_PRIVATE |
                                      ppapi::PERMISSION_DEV;
 
-#if !defined(DISABLE_NACL)
-const char kNaClPluginMimeType[] = "application/x-nacl";
-const char kNaClPluginExtension[] = "";
-const char kNaClPluginDescription[] = "Native Client Executable";
-const uint32 kNaClPluginPermissions = ppapi::PERMISSION_PRIVATE |
-                                      ppapi::PERMISSION_DEV;
-
-const char kPnaclPluginMimeType[] = "application/x-pnacl";
-const char kPnaclPluginExtension[] = "";
-const char kPnaclPluginDescription[] = "Portable Native Client Executable";
-#endif  // !defined(DISABLE_NACL)
-
 const char kO1DPluginName[] = "Google Talk Plugin Video Renderer";
 const char kO1DPluginMimeType[] ="application/o1d";
 const char kO1DPluginExtension[] = "";
@@ -182,21 +171,21 @@ void ComputeBuiltInPlugins(std::vector<content::PepperPluginInfo>* plugins) {
     // The nacl plugin is now built into the Chromium binary.
     nacl.is_internal = true;
     nacl.path = path;
-    nacl.name = ChromeContentClient::kNaClPluginName;
-    content::WebPluginMimeType nacl_mime_type(kNaClPluginMimeType,
-                                              kNaClPluginExtension,
-                                              kNaClPluginDescription);
+    nacl.name = nacl::kNaClPluginName;
+    content::WebPluginMimeType nacl_mime_type(nacl::kNaClPluginMimeType,
+                                              nacl::kNaClPluginExtension,
+                                              nacl::kNaClPluginDescription);
     nacl.mime_types.push_back(nacl_mime_type);
-    content::WebPluginMimeType pnacl_mime_type(kPnaclPluginMimeType,
-                                               kPnaclPluginExtension,
-                                               kPnaclPluginDescription);
+    content::WebPluginMimeType pnacl_mime_type(nacl::kPnaclPluginMimeType,
+                                               nacl::kPnaclPluginExtension,
+                                               nacl::kPnaclPluginDescription);
     nacl.mime_types.push_back(pnacl_mime_type);
     nacl.internal_entry_points.get_interface = nacl_plugin::PPP_GetInterface;
     nacl.internal_entry_points.initialize_module =
         nacl_plugin::PPP_InitializeModule;
     nacl.internal_entry_points.shutdown_module =
         nacl_plugin::PPP_ShutdownModule;
-    nacl.permissions = kNaClPluginPermissions;
+    nacl.permissions = ppapi::PERMISSION_PRIVATE | ppapi::PERMISSION_DEV;
     plugins->push_back(nacl);
   }
 #endif  // !defined(DISABLE_NACL)
diff --git a/chrome/common/chrome_content_client.h b/chrome/common/chrome_content_client.h
index a2768fb..8424d87 100644
--- a/chrome/common/chrome_content_client.h
+++ b/chrome/common/chrome_content_client.h
@@ -18,8 +18,6 @@ std::string GetUserAgent();
 class ChromeContentClient : public content::ContentClient {
  public:
   static const char* const kPDFPluginName;
-  static const char* const kNaClPluginName;
-  static const char* const kNaClOldPluginName;
   static const char* const kRemotingViewerPluginPath;
 
   virtual void SetActiveURL(const GURL& url) OVERRIDE;
diff --git a/chrome/common/chrome_content_client_constants.cc b/chrome/common/chrome_content_client_constants.cc
index a577c09..aeda534 100644
--- a/chrome/common/chrome_content_client_constants.cc
+++ b/chrome/common/chrome_content_client_constants.cc
@@ -5,7 +5,5 @@
 #include "chrome/common/chrome_content_client.h"
 
 const char* const ChromeContentClient::kPDFPluginName = "Chrome PDF Viewer";
-const char* const ChromeContentClient::kNaClPluginName = "Native Client";
-const char* const ChromeContentClient::kNaClOldPluginName = "Chrome NaCl";
 const char* const ChromeContentClient::kRemotingViewerPluginPath =
     "internal-remoting-viewer";
diff --git a/chrome/renderer/DEPS b/chrome/renderer/DEPS
index 64d1fe22..dce37d2 100644
--- a/chrome/renderer/DEPS
+++ b/chrome/renderer/DEPS
@@ -8,6 +8,7 @@ include_rules = [
   "+components/content_settings/core/common",
   "+components/data_reduction_proxy/common",
   "+components/dom_distiller/core",
+  "+components/nacl/common",
   "+components/nacl/renderer",
   "+components/plugins/renderer",
   "+components/signin/core/common",
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index 9eb68b5..84dd16c 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -15,7 +15,6 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
-#include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/chrome_version_info.h"
@@ -115,6 +114,7 @@
 #include "widevine_cdm_version.h"  // In SHARED_INTERMEDIATE_DIR.
 
 #if !defined(DISABLE_NACL)
+#include "components/nacl/common/nacl_constants.h"
 #include "components/nacl/renderer/nacl_helper.h"
 #endif
 
@@ -230,9 +230,11 @@ bool ShouldUseJavaScriptSettingForPlugin(const WebPluginInfo& plugin) {
     return false;
   }
 
+#if !defined(DISABLE_NACL)
   // Treat Native Client invocations like JavaScript.
-  if (plugin.name == ASCIIToUTF16(ChromeContentClient::kNaClPluginName))
+  if (plugin.name == ASCIIToUTF16(nacl::kNaClPluginName))
     return true;
+#endif
 
 #if defined(WIDEVINE_CDM_AVAILABLE) && defined(ENABLE_PEPPER_CDMS)
   // Treat CDM invocations like JavaScript.
@@ -676,12 +678,13 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
         break;
       }
       case ChromeViewHostMsg_GetPluginInfo_Status::kAllowed: {
+#if !defined(DISABLE_NACL)
         const bool is_nacl_plugin =
-            plugin.name == ASCIIToUTF16(ChromeContentClient::kNaClPluginName);
+            plugin.name == ASCIIToUTF16(nacl::kNaClPluginName);
         const bool is_nacl_mime_type =
-            actual_mime_type == "application/x-nacl";
+            actual_mime_type == nacl::kNaClPluginMimeType;
         const bool is_pnacl_mime_type =
-            actual_mime_type == "application/x-pnacl";
+            actual_mime_type == nacl::kPnaclPluginMimeType;
         if (is_nacl_plugin || is_nacl_mime_type || is_pnacl_mime_type) {
           bool is_nacl_unrestricted = false;
           if (is_nacl_mime_type) {
@@ -740,6 +743,7 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
             break;
           }
         }
+#endif  // !defined(DISABLE_NACL)
 
         // Delay loading plugins if prerendering.
         // TODO(mmenke):  In the case of prerendering, feed into
diff --git a/components/nacl.gyp b/components/nacl.gyp
index 7c096f9..0bba251 100644
--- a/components/nacl.gyp
+++ b/components/nacl.gyp
@@ -406,6 +406,8 @@
               'sources': [
                 'nacl/common/nacl_cmd_line.cc',
                 'nacl/common/nacl_cmd_line.h',
+                'nacl/common/nacl_constants.cc',
+                'nacl/common/nacl_constants.h',
                 'nacl/common/nacl_messages.cc',
                 'nacl/common/nacl_messages.h',
                 'nacl/common/nacl_types.cc',
@@ -485,6 +487,8 @@
       'sources': [
         'nacl/common/nacl_cmd_line.cc',
         'nacl/common/nacl_cmd_line.h',
+        'nacl/common/nacl_constants.cc',
+        'nacl/common/nacl_constants.h',
         'nacl/common/nacl_host_messages.h',
         'nacl/common/nacl_host_messages.cc',
         'nacl/common/nacl_messages.cc',
diff --git a/components/nacl/common/nacl_constants.cc b/components/nacl/common/nacl_constants.cc
new file mode 100644
index 0000000..d3a8a63
--- /dev/null
+++ b/components/nacl/common/nacl_constants.cc
@@ -0,0 +1,24 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/nacl/common/nacl_constants.h"
+
+#include "base/files/file_path.h"
+
+namespace nacl {
+
+const char kNaClPluginName[] = "Native Client";
+
+const char kNaClPluginMimeType[] = "application/x-nacl";
+const char kNaClPluginExtension[] = "";
+const char kNaClPluginDescription[] = "Native Client Executable";
+
+const char kPnaclPluginMimeType[] = "application/x-pnacl";
+const char kPnaclPluginExtension[] = "";
+const char kPnaclPluginDescription[] = "Portable Native Client Executable";
+
+const base::FilePath::CharType kInternalNaClPluginFileName[] =
+    FILE_PATH_LITERAL("internal-nacl-plugin");
+
+}  // namespace nacl
diff --git a/components/nacl/common/nacl_constants.h b/components/nacl/common/nacl_constants.h
new file mode 100644
index 0000000..2b18e0e
--- /dev/null
+++ b/components/nacl/common/nacl_constants.h
@@ -0,0 +1,25 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_NACL_COMMON_NACL_CONSTANTS_H_
+#define COMPONENTS_NACL_COMMON_NACL_CONSTANTS_H_
+
+#include "base/files/file_path.h"
+
+namespace nacl {
+
+extern const char kNaClPluginName[];
+extern const char kNaClPluginMimeType[];
+extern const char kNaClPluginExtension[];
+extern const char kNaClPluginDescription[];
+
+extern const char kPnaclPluginMimeType[];
+extern const char kPnaclPluginExtension[];
+extern const char kPnaclPluginDescription[];
+
+extern const base::FilePath::CharType kInternalNaClPluginFileName[];
+
+}  // namespace nacl
+
+#endif  // COMPONENTS_NACL_COMMON_NACL_CONSTANTS_H_
diff --git a/extensions/browser/process_manager.cc b/extensions/browser/process_manager.cc
index fc45e69..fe56315 100644
--- a/extensions/browser/process_manager.cc
+++ b/extensions/browser/process_manager.cc
@@ -509,6 +509,33 @@ void ProcessManager::KeepaliveImpulse(const Extension* extension) {
   }
 }
 
+// static
+void ProcessManager::OnKeepaliveFromPlugin(int render_process_id,
+                                           int render_frame_id,
+                                           const std::string& extension_id) {
+  content::RenderFrameHost* render_frame_host =
+      content::RenderFrameHost::FromID(render_process_id, render_frame_id);
+  if (!render_frame_host)
+    return;
+
+  content::SiteInstance* site_instance = render_frame_host->GetSiteInstance();
+  if (!site_instance)
+    return;
+
+  BrowserContext* browser_context = site_instance->GetBrowserContext();
+  const Extension* extension =
+      ExtensionRegistry::Get(browser_context)->enabled_extensions().GetByID(
+          extension_id);
+  if (!extension)
+    return;
+
+  ProcessManager* pm = ExtensionSystem::Get(browser_context)->process_manager();
+  if (!pm)
+    return;
+
+  pm->KeepaliveImpulse(extension);
+}
+
 // DecrementLazyKeepaliveCount is called when no calls to KeepaliveImpulse
 // have been made for at least event_page_idle_time_. In the best case an
 // impulse was made just before being cleared, and the decrement will occur
diff --git a/extensions/browser/process_manager.h b/extensions/browser/process_manager.h
index a5422bc7..e7be995 100644
--- a/extensions/browser/process_manager.h
+++ b/extensions/browser/process_manager.h
@@ -108,6 +108,11 @@ class ProcessManager : public content::NotificationObserver {
   // called regularly.
   void KeepaliveImpulse(const Extension* extension);
 
+  // Triggers a keepalive impulse for a plug-in (e.g NaCl).
+  static void OnKeepaliveFromPlugin(int render_process_id,
+                                    int render_frame_id,
+                                    const std::string& extension_id);
+
   // Handles a response to the ShouldSuspend message, used for lazy background
   // pages.
   void OnShouldSuspendAck(const std::string& extension_id, uint64 sequence_id);
diff --git a/extensions/shell/app/DEPS b/extensions/shell/app/DEPS
index b9b52a1..5b7cd97 100644
--- a/extensions/shell/app/DEPS
+++ b/extensions/shell/app/DEPS
@@ -1,6 +1,7 @@
 include_rules = [
   "+extensions/shell",
   "+chromeos",
+  "+components/nacl",
   "+content/public/app",
   "+content/public/browser",
   "+sandbox",
diff --git a/extensions/shell/app/shell_main_delegate.cc b/extensions/shell/app/shell_main_delegate.cc
index c49319e..1fae2d7 100644
--- a/extensions/shell/app/shell_main_delegate.cc
+++ b/extensions/shell/app/shell_main_delegate.cc
@@ -22,6 +22,12 @@
 #include "chromeos/chromeos_paths.h"
 #endif
 
+#if !defined(DISABLE_NACL)
+#include "components/nacl/common/nacl_paths.h"
+#include "components/nacl/common/nacl_switches.h"
+#include "components/nacl/zygote/nacl_fork_delegate_linux.h"
+#endif
+
 namespace {
 
 void InitLogging() {
@@ -54,6 +60,9 @@ bool ShellMainDelegate::BasicStartupComplete(int* exit_code) {
 #if defined(OS_CHROMEOS)
   chromeos::RegisterPathProvider();
 #endif
+#if !defined(DISABLE_NACL)
+  nacl::RegisterPathProvider();
+#endif
   extensions::RegisterPathProvider();
   return false;
 }
@@ -83,6 +92,13 @@ ShellMainDelegate::CreateContentRendererClient() {
   return renderer_client_.get();
 }
 
+void ShellMainDelegate::ZygoteStarting(
+    ScopedVector<content::ZygoteForkDelegate>* delegates) {
+#if !defined(DISABLE_NACL)
+  nacl::AddNaClZygoteForkDelegates(delegates);
+#endif
+}
+
 scoped_ptr<ShellRendererMainDelegate>
 ShellMainDelegate::CreateShellRendererMainDelegate() {
   return scoped_ptr<ShellRendererMainDelegate>();
@@ -104,6 +120,9 @@ bool ShellMainDelegate::ProcessNeedsResourceBundle(
   return process_type.empty() ||
          process_type == switches::kZygoteProcess ||
          process_type == switches::kRendererProcess ||
+#if !defined(DISABLE_NACL)
+         process_type == switches::kNaClLoaderProcess ||
+#endif
          process_type == switches::kUtilityProcess;
 }
 
diff --git a/extensions/shell/app/shell_main_delegate.h b/extensions/shell/app/shell_main_delegate.h
index 7e120f4..b9999cc 100644
--- a/extensions/shell/app/shell_main_delegate.h
+++ b/extensions/shell/app/shell_main_delegate.h
@@ -31,6 +31,8 @@ class ShellMainDelegate : public content::ContentMainDelegate {
   virtual content::ContentBrowserClient* CreateContentBrowserClient() OVERRIDE;
   virtual content::ContentRendererClient* CreateContentRendererClient()
       OVERRIDE;
+  virtual void ZygoteStarting(
+      ScopedVector<content::ZygoteForkDelegate>* delegates) OVERRIDE;
 
  protected:
   // The created object is owned by this object.
diff --git a/extensions/shell/app_shell.gyp b/extensions/shell/app_shell.gyp
index f304af9..32a2772 100644
--- a/extensions/shell/app_shell.gyp
+++ b/extensions/shell/app_shell.gyp
@@ -108,6 +108,20 @@
             '<(DEPTH)/ui/display/display.gyp:display',
           ],
         }],
+        ['disable_nacl==0', {
+          'dependencies': [
+            '<(DEPTH)/components/nacl.gyp:nacl',
+            '<(DEPTH)/components/nacl.gyp:nacl_browser',
+            '<(DEPTH)/components/nacl.gyp:nacl_common',
+            '<(DEPTH)/components/nacl.gyp:nacl_helper',
+            '<(DEPTH)/components/nacl.gyp:nacl_renderer',
+            '<(DEPTH)/components/nacl.gyp:nacl_switches',
+          ],
+          'sources': [
+            'browser/shell_nacl_browser_delegate.cc',
+            'browser/shell_nacl_browser_delegate.h',
+          ],
+        }],
       ],
     },
     {
diff --git a/extensions/shell/browser/DEPS b/extensions/shell/browser/DEPS
index de200f9..597cad0 100644
--- a/extensions/shell/browser/DEPS
+++ b/extensions/shell/browser/DEPS
@@ -1,11 +1,12 @@
 include_rules = [
   "+chromeos",
   "+components/keyed_service",
+  "+components/nacl/browser",
+  "+components/nacl/common",
   "+components/omaha_query_params",
   "+components/pref_registry",
   "+components/user_prefs",
   "+content/public/browser",
-  "+third_party/cros_system_api",
 
   # Pieces of content_shell reused in app_shell.
   "+content/shell/browser/shell_browser_context.h",
@@ -18,11 +19,14 @@ include_rules = [
   # Only used in API tests that should be moved to extensions/browser/api/...
   "+net",
 
+  "+ppapi",
   "+sync/api",
 
   # Disallow views to keep the binary size down.
   "-ui/views",
 
+  "+third_party/cros_system_api",
+
   "-webkit",
   "+webkit/browser/quota",
 ]
diff --git a/extensions/shell/browser/shell_browser_main_parts.cc b/extensions/shell/browser/shell_browser_main_parts.cc
index 4ab9360..820f1b4 100644
--- a/extensions/shell/browser/shell_browser_main_parts.cc
+++ b/extensions/shell/browser/shell_browser_main_parts.cc
@@ -31,6 +31,13 @@
 #include "extensions/shell/browser/shell_network_controller_chromeos.h"
 #endif
 
+#if !defined(DISABLE_NACL)
+#include "components/nacl/browser/nacl_browser.h"
+#include "components/nacl/browser/nacl_process_host.h"
+#include "content/public/browser/browser_thread.h"
+#include "extensions/shell/browser/shell_nacl_browser_delegate.h"
+#endif
+
 using content::BrowserContext;
 
 namespace {
@@ -115,6 +122,16 @@ void ShellBrowserMainParts::PreMainMessageLoopRun() {
   BrowserContextDependencyManager::GetInstance()->CreateBrowserContextServices(
       browser_context_.get());
 
+#if !defined(DISABLE_NACL)
+  // Takes ownership.
+  nacl::NaClBrowser::SetDelegate(
+      new ShellNaClBrowserDelegate(browser_context_.get()));
+  content::BrowserThread::PostTask(
+      content::BrowserThread::IO,
+      FROM_HERE,
+      base::Bind(nacl::NaClProcessHost::EarlyStartup));
+#endif
+
   devtools_delegate_.reset(
       new content::ShellDevToolsDelegate(browser_context_.get()));
   if (parameters_.ui_task) {
diff --git a/extensions/shell/browser/shell_content_browser_client.cc b/extensions/shell/browser/shell_content_browser_client.cc
index 328fb878..3fb07f5 100644
--- a/extensions/shell/browser/shell_content_browser_client.cc
+++ b/extensions/shell/browser/shell_content_browser_client.cc
@@ -24,6 +24,18 @@
 #include "extensions/shell/browser/shell_extension_system.h"
 #include "url/gurl.h"
 
+#if !defined(DISABLE_NACL)
+#include "components/nacl/browser/nacl_browser.h"
+#include "components/nacl/browser/nacl_host_message_filter.h"
+#include "components/nacl/browser/nacl_process_host.h"
+#include "components/nacl/common/nacl_process_type.h"
+#include "components/nacl/common/nacl_switches.h"
+#include "content/public/browser/browser_child_process_host.h"
+#include "content/public/browser/child_process_data.h"
+#endif
+
+using base::CommandLine;
+using content::BrowserContext;
 using content::BrowserThread;
 
 namespace extensions {
@@ -63,8 +75,18 @@ content::BrowserMainParts* ShellContentBrowserClient::CreateBrowserMainParts(
 void ShellContentBrowserClient::RenderProcessWillLaunch(
     content::RenderProcessHost* host) {
   int render_process_id = host->GetID();
-  host->AddFilter(new ExtensionMessageFilter(
-      render_process_id, browser_main_parts_->browser_context()));
+  BrowserContext* browser_context = browser_main_parts_->browser_context();
+  host->AddFilter(
+      new ExtensionMessageFilter(render_process_id, browser_context));
+  // PluginInfoMessageFilter is not required because app_shell does not have
+  // the concept of disabled plugins.
+#if !defined(DISABLE_NACL)
+  host->AddFilter(new nacl::NaClHostMessageFilter(
+      render_process_id,
+      browser_context->IsOffTheRecord(),
+      browser_context->GetPath(),
+      browser_context->GetRequestContextForRenderProcess(render_process_id)));
+#endif
 }
 
 bool ShellContentBrowserClient::ShouldUseProcessPerSite(
@@ -166,12 +188,26 @@ void ShellContentBrowserClient::AppendExtraCommandLineSwitches(
     int child_process_id) {
   std::string process_type =
       command_line->GetSwitchValueASCII(::switches::kProcessType);
-  if (process_type == ::switches::kRendererProcess) {
-    // TODO(jamescook): Should we check here if the process is in the extension
-    // service process map, or can we assume all renderers are extension
-    // renderers?
-    command_line->AppendSwitch(switches::kExtensionProcess);
+  if (process_type == ::switches::kRendererProcess)
+    AppendRendererSwitches(command_line);
+}
+
+content::BrowserPpapiHost*
+ShellContentBrowserClient::GetExternalBrowserPpapiHost(int plugin_process_id) {
+#if !defined(DISABLE_NACL)
+  content::BrowserChildProcessHostIterator iter(PROCESS_TYPE_NACL_LOADER);
+  while (!iter.Done()) {
+    nacl::NaClProcessHost* host = static_cast<nacl::NaClProcessHost*>(
+        iter.GetDelegate());
+    if (host->process() &&
+        host->process()->GetData().id == plugin_process_id) {
+      // Found the plugin.
+      return host->browser_ppapi_host();
+    }
+    ++iter;
   }
+#endif
+  return NULL;
 }
 
 void ShellContentBrowserClient::GetAdditionalAllowedSchemesForFileSystem(
@@ -181,6 +217,25 @@ void ShellContentBrowserClient::GetAdditionalAllowedSchemesForFileSystem(
   additional_allowed_schemes->push_back(kExtensionScheme);
 }
 
+void ShellContentBrowserClient::AppendRendererSwitches(
+    CommandLine* command_line) {
+  // TODO(jamescook): Should we check here if the process is in the extension
+  // service process map, or can we assume all renderers are extension
+  // renderers?
+  command_line->AppendSwitch(switches::kExtensionProcess);
+
+#if !defined(DISABLE_NACL)
+  // NOTE: app_shell does not support non-SFI mode, so it does not pass through
+  // SFI switches either here or for the zygote process.
+  static const char* const kSwitchNames[] = {
+    ::switches::kEnableNaClDebug,
+  };
+  command_line->CopySwitchesFrom(*CommandLine::ForCurrentProcess(),
+                                 kSwitchNames,
+                                 arraysize(kSwitchNames));
+#endif  // !defined(DISABLE_NACL)
+}
+
 const Extension* ShellContentBrowserClient::GetExtension(
     content::SiteInstance* site_instance) {
   ExtensionRegistry* registry =
diff --git a/extensions/shell/browser/shell_content_browser_client.h b/extensions/shell/browser/shell_content_browser_client.h
index da884fd..1b5fbac 100644
--- a/extensions/shell/browser/shell_content_browser_client.h
+++ b/extensions/shell/browser/shell_content_browser_client.h
@@ -10,6 +10,10 @@
 
 class GURL;
 
+namespace base {
+class CommandLine;
+}
+
 namespace content {
 class BrowserContext;
 }
@@ -52,10 +56,15 @@ class ShellContentBrowserClient : public content::ContentBrowserClient {
       content::SiteInstance* site_instance) OVERRIDE;
   virtual void AppendExtraCommandLineSwitches(base::CommandLine* command_line,
                                               int child_process_id) OVERRIDE;
+  virtual content::BrowserPpapiHost* GetExternalBrowserPpapiHost(
+      int plugin_process_id) OVERRIDE;
   virtual void GetAdditionalAllowedSchemesForFileSystem(
       std::vector<std::string>* additional_schemes) OVERRIDE;
 
  private:
+  // Appends command line switches for a renderer process.
+  void AppendRendererSwitches(base::CommandLine* command_line);
+
   // Returns the extension or app associated with |site_instance| or NULL.
   const Extension* GetExtension(content::SiteInstance* site_instance);
 
diff --git a/extensions/shell/browser/shell_nacl_browser_delegate.cc b/extensions/shell/browser/shell_nacl_browser_delegate.cc
new file mode 100644
index 0000000..a9b01e0
--- /dev/null
+++ b/extensions/shell/browser/shell_nacl_browser_delegate.cc
@@ -0,0 +1,189 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "extensions/shell/browser/shell_nacl_browser_delegate.h"
+
+#include <string>
+
+#include "base/command_line.h"
+#include "base/path_service.h"
+#include "base/strings/string_split.h"
+#include "base/strings/string_util.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/site_instance.h"
+#include "extensions/browser/extension_system.h"
+#include "extensions/browser/info_map.h"
+#include "extensions/browser/process_manager.h"
+#include "extensions/common/constants.h"
+#include "extensions/common/extension.h"
+#include "extensions/common/url_pattern.h"
+#include "ppapi/c/private/ppb_nacl_private.h"
+#include "url/gurl.h"
+
+using content::BrowserContext;
+using content::BrowserThread;
+using content::BrowserPpapiHost;
+
+namespace extensions {
+namespace {
+
+// Handles an extension's NaCl process transitioning in or out of idle state by
+// relaying the state to the extension's process manager. See Chrome's
+// NaClBrowserDelegateImpl for another example.
+void OnKeepaliveOnUIThread(
+    const BrowserPpapiHost::OnKeepaliveInstanceData& instance_data,
+    const base::FilePath& profile_data_directory) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  // Only one instance will exist for NaCl embeds, even when more than one
+  // embed of the same plugin exists on the same page.
+  DCHECK(instance_data.size() == 1);
+  if (instance_data.size() < 1)
+    return;
+
+  ProcessManager::OnKeepaliveFromPlugin(instance_data[0].render_process_id,
+                                        instance_data[0].render_frame_id,
+                                        instance_data[0].document_url.host());
+}
+
+// Calls OnKeepaliveOnUIThread on UI thread.
+void OnKeepalive(const BrowserPpapiHost::OnKeepaliveInstanceData& instance_data,
+                 const base::FilePath& profile_data_directory) {
+  DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::UI));
+  BrowserThread::PostTask(
+      BrowserThread::UI,
+      FROM_HERE,
+      base::Bind(
+          &OnKeepaliveOnUIThread, instance_data, profile_data_directory));
+}
+
+}  // namespace
+
+ShellNaClBrowserDelegate::ShellNaClBrowserDelegate(BrowserContext* context)
+    : browser_context_(context) {
+  DCHECK(browser_context_);
+}
+
+ShellNaClBrowserDelegate::~ShellNaClBrowserDelegate() {
+}
+
+void ShellNaClBrowserDelegate::ShowMissingArchInfobar(int render_process_id,
+                                                      int render_view_id) {
+  // app_shell does not have infobars.
+  LOG(ERROR) << "Missing architecture for pid " << render_process_id;
+}
+
+bool ShellNaClBrowserDelegate::DialogsAreSuppressed() {
+  return false;
+}
+
+bool ShellNaClBrowserDelegate::GetCacheDirectory(base::FilePath* cache_dir) {
+  // Just use the general cache directory, not a subdirectory like Chrome does.
+  return PathService::Get(base::DIR_CACHE, cache_dir);
+}
+
+bool ShellNaClBrowserDelegate::GetPluginDirectory(base::FilePath* plugin_dir) {
+  // On Posix, plugins are in the module directory.
+  return PathService::Get(base::DIR_MODULE, plugin_dir);
+}
+
+bool ShellNaClBrowserDelegate::GetPnaclDirectory(base::FilePath* pnacl_dir) {
+  // On Posix, the pnacl directory is inside the plugin directory.
+  base::FilePath plugin_dir;
+  if (!GetPluginDirectory(&plugin_dir))
+    return false;
+  *pnacl_dir = plugin_dir.Append(FILE_PATH_LITERAL("pnacl"));
+  return true;
+}
+
+bool ShellNaClBrowserDelegate::GetUserDirectory(base::FilePath* user_dir) {
+  base::FilePath path = browser_context_->GetPath();
+  if (!path.empty()) {
+    *user_dir = path;
+    return true;
+  }
+  return false;
+}
+
+std::string ShellNaClBrowserDelegate::GetVersionString() const {
+  // Used to trigger update of the validation caches.
+  // TODO(jamescook): Generate a real version number and use it both here and
+  // in our user agent. http://crbug.com/402612
+  return "1.2.3.4";
+}
+
+ppapi::host::HostFactory* ShellNaClBrowserDelegate::CreatePpapiHostFactory(
+    content::BrowserPpapiHost* ppapi_host) {
+  return NULL;
+}
+
+void ShellNaClBrowserDelegate::SetDebugPatterns(std::string debug_patterns) {
+  // No debugger support. Developers should use Chrome for debugging.
+}
+
+bool ShellNaClBrowserDelegate::URLMatchesDebugPatterns(
+    const GURL& manifest_url) {
+  // No debugger support. Developers should use Chrome for debugging.
+  return false;
+}
+
+// This function is security sensitive.  Be sure to check with a security
+// person before you modify it.
+// TODO(jamescook): Refactor this code into the extensions module so it can
+// be shared with Chrome's NaClBrowserDelegateImpl. http://crbug.com/403017
+bool ShellNaClBrowserDelegate::MapUrlToLocalFilePath(
+    const GURL& file_url,
+    bool use_blocking_api,
+    const base::FilePath& profile_directory,
+    base::FilePath* file_path) {
+  scoped_refptr<InfoMap> info_map =
+      ExtensionSystem::Get(browser_context_)->info_map();
+  // Check that the URL is recognized by the extension system.
+  const Extension* extension =
+      info_map->extensions().GetExtensionOrAppByURL(file_url);
+  if (!extension)
+    return false;
+
+  // This is a short-cut which avoids calling a blocking file operation
+  // (GetFilePath()), so that this can be called on the IO thread. It only
+  // handles a subset of the urls.
+  if (!use_blocking_api) {
+    if (file_url.SchemeIs(kExtensionScheme)) {
+      std::string path = file_url.path();
+      base::TrimString(path, "/", &path);  // Remove first slash
+      *file_path = extension->path().AppendASCII(path);
+      return true;
+    }
+    return false;
+  }
+
+  // Check that the URL references a resource in the extension.
+  // NOTE: app_shell does not support shared modules.
+  ExtensionResource resource = extension->GetResource(file_url.path());
+  if (resource.empty())
+    return false;
+
+  // GetFilePath is a blocking function call.
+  const base::FilePath resource_file_path = resource.GetFilePath();
+  if (resource_file_path.empty())
+    return false;
+
+  *file_path = resource_file_path;
+  return true;
+}
+
+content::BrowserPpapiHost::OnKeepaliveCallback
+ShellNaClBrowserDelegate::GetOnKeepaliveCallback() {
+  return base::Bind(&OnKeepalive);
+}
+
+bool ShellNaClBrowserDelegate::IsNonSfiModeAllowed(
+    const base::FilePath& profile_directory,
+    const GURL& manifest_url) {
+  return false;
+}
+
+}  // namespace extensions
diff --git a/extensions/shell/browser/shell_nacl_browser_delegate.h b/extensions/shell/browser/shell_nacl_browser_delegate.h
new file mode 100644
index 0000000..0b4467a
--- /dev/null
+++ b/extensions/shell/browser/shell_nacl_browser_delegate.h
@@ -0,0 +1,57 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef EXTENSIONS_SHELL_BROWSER_SHELL_NACL_BROWSER_DELEGATE_H_
+#define EXTENSIONS_SHELL_BROWSER_SHELL_NACL_BROWSER_DELEGATE_H_
+
+#include "base/compiler_specific.h"
+#include "base/macros.h"
+#include "components/nacl/browser/nacl_browser_delegate.h"
+
+namespace content {
+class BrowserContext;
+}
+
+namespace extensions {
+class InfoMap;
+
+// A lightweight NaClBrowserDelegate for app_shell. Only supports a single
+// BrowserContext.
+class ShellNaClBrowserDelegate : public NaClBrowserDelegate {
+ public:
+  // Uses |context| to look up extensions via InfoMap on the IO thread.
+  explicit ShellNaClBrowserDelegate(content::BrowserContext* context);
+  virtual ~ShellNaClBrowserDelegate();
+
+  // NaClBrowserDelegate overrides:
+  virtual void ShowMissingArchInfobar(int render_process_id,
+                                      int render_view_id) OVERRIDE;
+  virtual bool DialogsAreSuppressed() OVERRIDE;
+  virtual bool GetCacheDirectory(base::FilePath* cache_dir) OVERRIDE;
+  virtual bool GetPluginDirectory(base::FilePath* plugin_dir) OVERRIDE;
+  virtual bool GetPnaclDirectory(base::FilePath* pnacl_dir) OVERRIDE;
+  virtual bool GetUserDirectory(base::FilePath* user_dir) OVERRIDE;
+  virtual std::string GetVersionString() const OVERRIDE;
+  virtual ppapi::host::HostFactory* CreatePpapiHostFactory(
+      content::BrowserPpapiHost* ppapi_host) OVERRIDE;
+  virtual bool MapUrlToLocalFilePath(const GURL& url,
+                                     bool is_blocking,
+                                     const base::FilePath& profile_directory,
+                                     base::FilePath* file_path) OVERRIDE;
+  virtual void SetDebugPatterns(std::string debug_patterns) OVERRIDE;
+  virtual bool URLMatchesDebugPatterns(const GURL& manifest_url) OVERRIDE;
+  virtual content::BrowserPpapiHost::OnKeepaliveCallback
+      GetOnKeepaliveCallback() OVERRIDE;
+  virtual bool IsNonSfiModeAllowed(const base::FilePath& profile_directory,
+                                   const GURL& manifest_url) OVERRIDE;
+
+ private:
+  content::BrowserContext* browser_context_;  // Not owned.
+
+  DISALLOW_COPY_AND_ASSIGN(ShellNaClBrowserDelegate);
+};
+
+}  // namespace extensions
+
+#endif  // EXTENSIONS_SHELL_BROWSER_SHELL_NACL_BROWSER_DELEGATE_H_
diff --git a/extensions/shell/common/DEPS b/extensions/shell/common/DEPS
new file mode 100644
index 0000000..6facae8
--- /dev/null
+++ b/extensions/shell/common/DEPS
@@ -0,0 +1,4 @@
+include_rules = [
+  "+components/nacl/common",
+  "+ppapi",
+]
diff --git a/extensions/shell/common/shell_content_client.cc b/extensions/shell/common/shell_content_client.cc
index 5f0df03..47f99bc 100644
--- a/extensions/shell/common/shell_content_client.cc
+++ b/extensions/shell/common/shell_content_client.cc
@@ -11,7 +11,31 @@
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 
+#if !defined(DISABLE_NACL)
+#include "base/base_paths.h"
+#include "base/files/file_path.h"
+#include "base/path_service.h"
+#include "components/nacl/common/nacl_constants.h"
+#include "content/public/common/pepper_plugin_info.h"
+#include "ppapi/native_client/src/trusted/plugin/ppapi_entrypoints.h"
+#include "ppapi/shared_impl/ppapi_permissions.h"
+#endif
+
 namespace extensions {
+namespace {
+
+#if !defined(DISABLE_NACL)
+bool GetNaClPluginPath(base::FilePath* path) {
+  // On Posix, plugins live in the module directory.
+  base::FilePath module;
+  if (!PathService::Get(base::DIR_MODULE, &module))
+    return false;
+  *path = module.Append(nacl::kInternalNaClPluginFileName);
+  return true;
+}
+#endif  // !defined(DISABLE_NACL)
+
+}  // namespace
 
 ShellContentClient::ShellContentClient() {
 }
@@ -19,6 +43,36 @@ ShellContentClient::ShellContentClient() {
 ShellContentClient::~ShellContentClient() {
 }
 
+void ShellContentClient::AddPepperPlugins(
+    std::vector<content::PepperPluginInfo>* plugins) {
+#if !defined(DISABLE_NACL)
+  base::FilePath path;
+  if (!GetNaClPluginPath(&path))
+    return;
+
+  content::PepperPluginInfo nacl;
+  // The nacl plugin is now built into the binary.
+  nacl.is_internal = true;
+  nacl.path = path;
+  nacl.name = nacl::kNaClPluginName;
+  content::WebPluginMimeType nacl_mime_type(nacl::kNaClPluginMimeType,
+                                            nacl::kNaClPluginExtension,
+                                            nacl::kNaClPluginDescription);
+  nacl.mime_types.push_back(nacl_mime_type);
+  content::WebPluginMimeType pnacl_mime_type(nacl::kPnaclPluginMimeType,
+                                             nacl::kPnaclPluginExtension,
+                                             nacl::kPnaclPluginDescription);
+  nacl.mime_types.push_back(pnacl_mime_type);
+  nacl.internal_entry_points.get_interface = nacl_plugin::PPP_GetInterface;
+  nacl.internal_entry_points.initialize_module =
+      nacl_plugin::PPP_InitializeModule;
+  nacl.internal_entry_points.shutdown_module =
+      nacl_plugin::PPP_ShutdownModule;
+  nacl.permissions = ppapi::PERMISSION_PRIVATE | ppapi::PERMISSION_DEV;
+  plugins->push_back(nacl);
+#endif  // !defined(DISABLE_NACL)
+}
+
 void ShellContentClient::AddAdditionalSchemes(
     std::vector<std::string>* standard_schemes,
     std::vector<std::string>* savable_schemes) {
diff --git a/extensions/shell/common/shell_content_client.h b/extensions/shell/common/shell_content_client.h
index f0a722e..d3583e24 100644
--- a/extensions/shell/common/shell_content_client.h
+++ b/extensions/shell/common/shell_content_client.h
@@ -6,6 +6,7 @@
 #define EXTENSIONS_SHELL_COMMON_SHELL_CONTENT_CLIENT_H_
 
 #include "base/compiler_specific.h"
+#include "base/macros.h"
 #include "content/public/common/content_client.h"
 
 namespace extensions {
@@ -15,6 +16,8 @@ class ShellContentClient : public content::ContentClient {
   ShellContentClient();
   virtual ~ShellContentClient();
 
+  virtual void AddPepperPlugins(
+      std::vector<content::PepperPluginInfo>* plugins) OVERRIDE;
   virtual void AddAdditionalSchemes(
       std::vector<std::string>* standard_schemes,
       std::vector<std::string>* saveable_shemes) OVERRIDE;
@@ -26,6 +29,9 @@ class ShellContentClient : public content::ContentClient {
   virtual base::RefCountedStaticMemory* GetDataResourceBytes(
       int resource_id) const OVERRIDE;
   virtual gfx::Image& GetNativeImageNamed(int resource_id) const OVERRIDE;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ShellContentClient);
 };
 
 }  // namespace extensions
diff --git a/extensions/shell/renderer/DEPS b/extensions/shell/renderer/DEPS
index baafcac..bf14c1d 100644
--- a/extensions/shell/renderer/DEPS
+++ b/extensions/shell/renderer/DEPS
@@ -1,7 +1,9 @@
 include_rules = [
   # Only allow includes the renderer can use.
+  "+components/nacl/common",
+  "+components/nacl/renderer",
   "+content/public/renderer",
-
+  "+ppapi",
   "+third_party/WebKit/public",
   "+v8/include",
 ]
diff --git a/extensions/shell/renderer/shell_content_renderer_client.cc b/extensions/shell/renderer/shell_content_renderer_client.cc
index c7a9be6..b6f8ed7 100644
--- a/extensions/shell/renderer/shell_content_renderer_client.cc
+++ b/extensions/shell/renderer/shell_content_renderer_client.cc
@@ -16,6 +16,13 @@
 #include "extensions/shell/renderer/shell_extensions_renderer_client.h"
 #include "extensions/shell/renderer/shell_renderer_main_delegate.h"
 
+#if !defined(DISABLE_NACL)
+#include "components/nacl/common/nacl_constants.h"
+#include "components/nacl/renderer/nacl_helper.h"
+#include "components/nacl/renderer/ppb_nacl_private_impl.h"
+#include "ppapi/c/private/ppb_nacl_private.h"
+#endif
+
 using blink::WebFrame;
 using blink::WebString;
 using content::RenderThread;
@@ -93,8 +100,15 @@ void ShellContentRendererClient::RenderThreadStarted() {
 
 void ShellContentRendererClient::RenderFrameCreated(
     content::RenderFrame* render_frame) {
-  // ShellFrameHelper destroyes itself when the RenderFrame is destroyed.
+  // ShellFrameHelper destroys itself when the RenderFrame is destroyed.
   new ShellFrameHelper(render_frame, extension_dispatcher_.get());
+
+  // TODO(jamescook): Do we need to add a new PepperHelper(render_frame) here?
+  // It doesn't seem necessary for either Pepper or NaCl.
+  // http://crbug.com/403004
+#if !defined(DISABLE_NACL)
+  new nacl::NaClHelper(render_frame);
+#endif
 }
 
 void ShellContentRendererClient::RenderViewCreated(
@@ -104,6 +118,22 @@ void ShellContentRendererClient::RenderViewCreated(
     delegate_->OnViewCreated(render_view);
 }
 
+bool ShellContentRendererClient::OverrideCreatePlugin(
+    content::RenderFrame* render_frame,
+    blink::WebLocalFrame* frame,
+    const blink::WebPluginParams& params,
+    blink::WebPlugin** plugin) {
+  // Allow the content module to create the plugin.
+  return false;
+}
+
+blink::WebPlugin* ShellContentRendererClient::CreatePluginReplacement(
+    content::RenderFrame* render_frame,
+    const base::FilePath& plugin_path) {
+  // Don't provide a custom "failed to load" plugin.
+  return NULL;
+}
+
 bool ShellContentRendererClient::WillSendRequest(
     blink::WebFrame* frame,
     content::PageTransition transition_type,
@@ -123,6 +153,27 @@ void ShellContentRendererClient::DidCreateScriptContext(
       frame, context, extension_group, world_id);
 }
 
+const void* ShellContentRendererClient::CreatePPAPIInterface(
+    const std::string& interface_name) {
+#if !defined(DISABLE_NACL)
+  if (interface_name == PPB_NACL_PRIVATE_INTERFACE)
+    return nacl::GetNaClPrivateInterface();
+#endif
+  return NULL;
+}
+
+bool ShellContentRendererClient::IsExternalPepperPlugin(
+    const std::string& module_name) {
+#if !defined(DISABLE_NACL)
+  // TODO(bbudge) remove this when the trusted NaCl plugin has been removed.
+  // We must defer certain plugin events for NaCl instances since we switch
+  // from the in-process to the out-of-process proxy after instantiating them.
+  return module_name == nacl::kNaClPluginName;
+#else
+  return false;
+#endif
+}
+
 bool ShellContentRendererClient::ShouldEnableSiteIsolationPolicy() const {
   // Extension renderers don't need site isolation.
   return false;
diff --git a/extensions/shell/renderer/shell_content_renderer_client.h b/extensions/shell/renderer/shell_content_renderer_client.h
index e7a1fbc..f40233c 100644
--- a/extensions/shell/renderer/shell_content_renderer_client.h
+++ b/extensions/shell/renderer/shell_content_renderer_client.h
@@ -29,6 +29,13 @@ class ShellContentRendererClient : public content::ContentRendererClient {
   virtual void RenderThreadStarted() OVERRIDE;
   virtual void RenderFrameCreated(content::RenderFrame* render_frame) OVERRIDE;
   virtual void RenderViewCreated(content::RenderView* render_view) OVERRIDE;
+  virtual bool OverrideCreatePlugin(content::RenderFrame* render_frame,
+                                    blink::WebLocalFrame* frame,
+                                    const blink::WebPluginParams& params,
+                                    blink::WebPlugin** plugin) OVERRIDE;
+  virtual blink::WebPlugin* CreatePluginReplacement(
+      content::RenderFrame* render_frame,
+      const base::FilePath& plugin_path) OVERRIDE;
   virtual bool WillSendRequest(blink::WebFrame* frame,
                                content::PageTransition transition_type,
                                const GURL& url,
@@ -38,6 +45,9 @@ class ShellContentRendererClient : public content::ContentRendererClient {
                                       v8::Handle<v8::Context> context,
                                       int extension_group,
                                       int world_id) OVERRIDE;
+  virtual const void* CreatePPAPIInterface(
+      const std::string& interface_name) OVERRIDE;
+  virtual bool IsExternalPepperPlugin(const std::string& module_name) OVERRIDE;
   virtual bool ShouldEnableSiteIsolationPolicy() const OVERRIDE;
 
  private: