Revert 83100 - Remove weird dependency on extensions from webui.Re-plumb extension request messages in a more sane way.Before, each RVH had ProcessWebUIMessage(), which wasserving as a manual way of plumbing both WebUI andextension messages to the right place, even though onlya few RVHD responded to either message.Instead of this, we now just teach more of the stack howto handle IPC messages in general, and delegate them upthrough the stack, giving each layer a chance to handlethem if it knows how.The result is simpler and smaller:179 insertions(+), 252 deletions(-)BUG=80311Review URL: http://codereview.chromium.org/6901021

TBR=aa@chromium.org
Review URL: http://codereview.chromium.org/6905045

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@83103 0039d316-1c4b-4281-b951-d872f2087c98

30 files changed, 180 insertions, 174 deletions

diff --git a/chrome/browser/chromeos/notifications/balloon_view_host.cc b/chrome/browser/chromeos/notifications/balloon_view_host.cc
index 87b978c..1e9be4f 100644
--- a/chrome/browser/chromeos/notifications/balloon_view_host.cc
+++ b/chrome/browser/chromeos/notifications/balloon_view_host.cc
@@ -7,9 +7,6 @@
 #include "base/stl_util-inl.h"
 #include "base/values.h"
 #include "chrome/common/extensions/extension_messages.h"
-#include "content/chrome/view_messages.h"
-#include "ipc/ipc_message.h"
-#include "ipc/ipc_message_macros.h"
 
 namespace chromeos {
 
@@ -18,15 +15,6 @@ BalloonViewHost::~BalloonViewHost() {
                                        message_callbacks_.end());
 }
 
-bool BalloonViewHost::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(WebUI, message)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_WebUISend, OnWebUISend)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
 bool BalloonViewHost::AddWebUIMessageCallback(
     const std::string& message,
     MessageCallback* callback) {
@@ -37,9 +25,10 @@ bool BalloonViewHost::AddWebUIMessageCallback(
   return ret.second;
 }
 
-void BalloonViewHost::OnWebUISend(const GURL& source_url,
-                                  const std::string& name,
-                                  const ListValue& args) {
+void BalloonViewHost::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  ::BalloonViewHost::ProcessWebUIMessage(params);
+
   // Look up the callback for this message.
   MessageCallbackMap::const_iterator callback =
       message_callbacks_.find(params.name);
diff --git a/chrome/browser/chromeos/notifications/balloon_view_host.h b/chrome/browser/chromeos/notifications/balloon_view_host.h
index 44bea08..5b6a3ca5 100644
--- a/chrome/browser/chromeos/notifications/balloon_view_host.h
+++ b/chrome/browser/chromeos/notifications/balloon_view_host.h
@@ -12,7 +12,6 @@
 #include <string>
 
 #include "base/callback.h"
-#include "base/compiler_specific.h"
 #include "ui/gfx/native_widget_types.h"
 
 class ListValue;
@@ -34,19 +33,15 @@ class BalloonViewHost : public ::BalloonViewHost {
   bool AddWebUIMessageCallback(const std::string& message,
                                MessageCallback* callback);
 
- private:
-  // RenderViewHostDelegate
-  virtual void OnMessageReceived(const IPC::Message& message) OVERRIDE;
+  // Process WebUI message.
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
 
+ private:
   // A map of message name -> message handling callback.
   typedef std::map<std::string, MessageCallback*> MessageCallbackMap;
   MessageCallbackMap message_callbacks_;
 
-  // Message handlers.
-  virtual void OnWebUISend(const GURL& source_url,
-                           const std::string& name,
-                           const ListValue& args);
-
   DISALLOW_COPY_AND_ASSIGN(BalloonViewHost);
 };
 
diff --git a/chrome/browser/extensions/extension_function_dispatcher.cc b/chrome/browser/extensions/extension_function_dispatcher.cc
index efca9b6..26b466b 100644
--- a/chrome/browser/extensions/extension_function_dispatcher.cc
+++ b/chrome/browser/extensions/extension_function_dispatcher.cc
@@ -26,6 +26,7 @@
 #include "chrome/browser/extensions/extension_idle_api.h"
 #include "chrome/browser/extensions/extension_infobar_module.h"
 #include "chrome/browser/extensions/extension_management_api.h"
+#include "chrome/browser/extensions/extension_message_service.h"
 #include "chrome/browser/extensions/extension_metrics_module.h"
 #include "chrome/browser/extensions/extension_module.h"
 #include "chrome/browser/extensions/extension_omnibox_api.h"
@@ -53,13 +54,10 @@
 #include "chrome/browser/ui/webui/favicon_source.h"
 #include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/url_constants.h"
-#include "content/browser/child_process_security_policy.h"
 #include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/common/notification_service.h"
 #include "content/common/result_codes.h"
-#include "ipc/ipc_message.h"
-#include "ipc/ipc_message_macros.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
 #if defined(TOOLKIT_VIEWS)
@@ -475,28 +473,8 @@ Browser* ExtensionFunctionDispatcher::GetCurrentBrowser(
   return browser;
 }
 
-bool ExtensionFunctionDispatcher::OnMessageReceived(
-    const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(ExtensionFunctionDispatcher, message)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void ExtensionFunctionDispatcher::OnRequest(
-    const ExtensionHostMsg_Request_Params& params) {
-  if (!ChildProcessSecurityPolicy::GetInstance()->
-          HasExtensionBindings(render_view_host_->process()->id())) {
-    // This can happen if someone uses window.open() to open an extension URL
-    // from a non-extension context.
-    render_view_host_->Send(new ExtensionMsg_Response(
-        render_view_host_->routing_id(), params.request_id, false,
-        std::string(), "Access to extension API denied."));
-    return;
-  }
-
+void ExtensionFunctionDispatcher::HandleRequest(
+    const ExtensionHostMsg_DomMessage_Params& params) {
   scoped_refptr<ExtensionFunction> function(
       FactoryRegistry::GetInstance()->NewFunction(params.name));
   function->set_dispatcher_peer(peer_);
diff --git a/chrome/browser/extensions/extension_function_dispatcher.h b/chrome/browser/extensions/extension_function_dispatcher.h
index 9f91d9d..cb67988 100644
--- a/chrome/browser/extensions/extension_function_dispatcher.h
+++ b/chrome/browser/extensions/extension_function_dispatcher.h
@@ -11,7 +11,6 @@
 
 #include "base/memory/ref_counted.h"
 #include "googleurl/src/gurl.h"
-#include "ipc/ipc_channel.h"
 #include "ui/gfx/native_widget_types.h"
 
 class Browser;
@@ -21,7 +20,7 @@ class ListValue;
 class Profile;
 class RenderViewHost;
 class TabContents;
-struct ExtensionHostMsg_Request_Params;
+struct ExtensionHostMsg_DomMessage_Params;
 
 // A factory function for creating new ExtensionFunction instances.
 typedef ExtensionFunction* (*ExtensionFunctionFactory)();
@@ -29,7 +28,7 @@ typedef ExtensionFunction* (*ExtensionFunctionFactory)();
 // ExtensionFunctionDispatcher receives requests to execute functions from
 // Chromium extensions running in a RenderViewHost and dispatches them to the
 // appropriate handler. It lives entirely on the UI thread.
-class ExtensionFunctionDispatcher : public IPC::Channel::Listener {
+class ExtensionFunctionDispatcher {
  public:
   class Delegate {
    public:
@@ -86,8 +85,8 @@ class ExtensionFunctionDispatcher : public IPC::Channel::Listener {
 
   Delegate* delegate() { return delegate_; }
 
-  // If |message| is an extension request, handle it. Returns true if handled.
-  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
+  // Handle a request to execute an extension function.
+  void HandleRequest(const ExtensionHostMsg_DomMessage_Params& params);
 
   // Send a response to a function.
   void SendResponse(ExtensionFunction* api, bool success);
@@ -122,9 +121,6 @@ class ExtensionFunctionDispatcher : public IPC::Channel::Listener {
                               const Extension* extension,
                               const GURL& url);
 
-  // Message handlers.
-  void OnRequest(const ExtensionHostMsg_Request_Params& params);
-
   // We need to keep a pointer to the profile because we use it in the dtor
   // in sending EXTENSION_FUNCTION_DISPATCHER_DESTROYED, but by that point
   // the render_view_host_ has been deleted.
diff --git a/chrome/browser/extensions/extension_host.cc b/chrome/browser/extensions/extension_host.cc
index d2e5bec..74f28e3 100644
--- a/chrome/browser/extensions/extension_host.cc
+++ b/chrome/browser/extensions/extension_host.cc
@@ -546,6 +546,13 @@ WebPreferences ExtensionHost::GetWebkitPrefs() {
   return webkit_prefs;
 }
 
+void ExtensionHost::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (extension_function_dispatcher_.get()) {
+    extension_function_dispatcher_->HandleRequest(params);
+  }
+}
+
 RenderViewHostDelegate::View* ExtensionHost::GetViewDelegate() {
   return this;
 }
@@ -777,11 +784,6 @@ ViewType::Type ExtensionHost::GetRenderViewType() const {
 }
 
 bool ExtensionHost::OnMessageReceived(const IPC::Message& message) {
-  if (extension_function_dispatcher_.get() &&
-      extension_function_dispatcher_->OnMessageReceived(message)) {
-    return true;
-  }
-
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ExtensionHost, message)
     IPC_MESSAGE_HANDLER(ViewHostMsg_RunFileChooser, OnRunFileChooser)
diff --git a/chrome/browser/extensions/extension_host.h b/chrome/browser/extensions/extension_host.h
index 1a23d20..63adef8 100644
--- a/chrome/browser/extensions/extension_host.h
+++ b/chrome/browser/extensions/extension_host.h
@@ -128,6 +128,8 @@ class ExtensionHost : public RenderViewHostDelegate,
   // RenderViewHostDelegate implementation.
   virtual RenderViewHostDelegate::View* GetViewDelegate();
   virtual WebPreferences GetWebkitPrefs();
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
diff --git a/chrome/browser/extensions/extension_message_handler.cc b/chrome/browser/extensions/extension_message_handler.cc
index 4447dac..52517cb 100644
--- a/chrome/browser/extensions/extension_message_handler.cc
+++ b/chrome/browser/extensions/extension_message_handler.cc
@@ -10,6 +10,7 @@
 #include "content/browser/child_process_security_policy.h"
 #include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
+#include "content/browser/renderer_host/render_view_host_delegate.h"
 
 ExtensionMessageHandler::ExtensionMessageHandler(
     RenderViewHost* render_view_host)
@@ -24,6 +25,7 @@ bool ExtensionMessageHandler::OnMessageReceived(
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ExtensionMessageHandler, message)
     IPC_MESSAGE_HANDLER(ExtensionHostMsg_PostMessage, OnPostMessage)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
@@ -37,3 +39,18 @@ void ExtensionMessageHandler::OnPostMessage(int port_id,
         port_id, message);
   }
 }
+
+void ExtensionMessageHandler::OnRequest(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (!ChildProcessSecurityPolicy::GetInstance()->
+          HasExtensionBindings(render_view_host()->process()->id())) {
+    // This can happen if someone uses window.open() to open an extension URL
+    // from a non-extension context.
+    Send(new ExtensionMsg_Response(
+        routing_id(), params.request_id, false, std::string(),
+        "Access to extension API denied."));
+    return;
+  }
+
+  render_view_host()->delegate()->ProcessWebUIMessage(params);
+}
diff --git a/chrome/browser/extensions/extension_message_handler.h b/chrome/browser/extensions/extension_message_handler.h
index 0ba4940..3a5c050 100644
--- a/chrome/browser/extensions/extension_message_handler.h
+++ b/chrome/browser/extensions/extension_message_handler.h
@@ -14,12 +14,6 @@ struct ExtensionHostMsg_DomMessage_Params;
 // Filters and dispatches extension-related IPC messages that arrive from
 // renderers. There is one of these objects for each RenderViewHost in Chrome.
 // Contrast this with ExtensionTabHelper, which is only created for TabContents.
-//
-// TODO(aa): Handling of content script messaging should be able to move to EFD
-// once there is an EFD for every RVHD where extension code can run. Then we
-// could eliminate this class. Right now, we don't end up with an EFD for tab
-// contents unless that tab contents is hosting chrome-extension:// URLs. That
-// still leaves content scripts. See also: crbug.com/80307.
 class ExtensionMessageHandler : public RenderViewHostObserver {
  public:
   // |sender| is guaranteed to outlive this object.
@@ -32,6 +26,7 @@ class ExtensionMessageHandler : public RenderViewHostObserver {
  private:
   // Message handlers.
   void OnPostMessage(int port_id, const std::string& message);
+  void OnRequest(const ExtensionHostMsg_DomMessage_Params& params);
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionMessageHandler);
 };
diff --git a/chrome/browser/extensions/extension_web_ui.cc b/chrome/browser/extensions/extension_web_ui.cc
index 7192c03..1a9b122 100644
--- a/chrome/browser/extensions/extension_web_ui.cc
+++ b/chrome/browser/extensions/extension_web_ui.cc
@@ -28,7 +28,6 @@
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/common/bindings_policy.h"
 #include "content/common/page_transition_types.h"
-#include "ipc/ipc_message.h"
 #include "net/base/file_stream.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/codec/png_codec.h"
@@ -185,11 +184,9 @@ void ExtensionWebUI::RenderViewReused(RenderViewHost* render_view_host) {
   ResetExtensionBookmarkManagerEventRouter();
 }
 
-bool ExtensionWebUI::OnMessageReceived(const IPC::Message& message) {
-  if (extension_function_dispatcher_.get())
-    return extension_function_dispatcher_->OnMessageReceived(message);
-
-  return false;
+void ExtensionWebUI::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  extension_function_dispatcher_->HandleRequest(params);
 }
 
 Browser* ExtensionWebUI::GetBrowser() {
diff --git a/chrome/browser/extensions/extension_web_ui.h b/chrome/browser/extensions/extension_web_ui.h
index f41ead3..34f0899 100644
--- a/chrome/browser/extensions/extension_web_ui.h
+++ b/chrome/browser/extensions/extension_web_ui.h
@@ -14,7 +14,6 @@
 #include "chrome/browser/favicon_service.h"
 #include "chrome/common/extensions/extension.h"
 #include "content/browser/webui/web_ui.h"
-#include "ipc/ipc_channel.h"
 
 class GURL;
 class ListValue;
@@ -22,7 +21,7 @@ class PrefService;
 class Profile;
 class RenderViewHost;
 class TabContents;
-struct ExtensionHostMsg_Request_Params;
+struct ExtensionHostMsg_DomMessage_Params;
 
 // This class implements WebUI for extensions and allows extensions to put UI in
 // the main tab contents area. For example, each extension can specify an
@@ -43,9 +42,10 @@ class ExtensionWebUI
   }
 
   // WebUI
-  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
   virtual void RenderViewCreated(RenderViewHost* render_view_host);
   virtual void RenderViewReused(RenderViewHost* render_view_host);
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
 
   // ExtensionFunctionDispatcher::Delegate
   virtual Browser* GetBrowser();
diff --git a/chrome/browser/notifications/balloon_host.cc b/chrome/browser/notifications/balloon_host.cc
index 3d600a0..ff6a035 100644
--- a/chrome/browser/notifications/balloon_host.cc
+++ b/chrome/browser/notifications/balloon_host.cc
@@ -22,7 +22,6 @@
 #include "content/common/notification_type.h"
 #include "content/common/renderer_preferences.h"
 #include "content/common/view_messages.h"
-#include "ipc/ipc_message.h"
 #include "webkit/glue/webpreferences.h"
 
 BalloonHost::BalloonHost(Balloon* balloon)
@@ -132,11 +131,11 @@ RenderViewHostDelegate::View* BalloonHost::GetViewDelegate() {
   return this;
 }
 
-bool BalloonHost::OnMessageReceived(const IPC::Message& message) {
-  if (extension_function_dispatcher_.get())
-    return extension_function_dispatcher_->OnMessageReceived(message);
-
-  return false;
+void BalloonHost::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (extension_function_dispatcher_.get()) {
+    extension_function_dispatcher_->HandleRequest(params);
+  }
 }
 
 // RenderViewHostDelegate::View methods implemented to allow links to
diff --git a/chrome/browser/notifications/balloon_host.h b/chrome/browser/notifications/balloon_host.h
index 9a70e61..475d6bd 100644
--- a/chrome/browser/notifications/balloon_host.h
+++ b/chrome/browser/notifications/balloon_host.h
@@ -9,7 +9,6 @@
 #include <string>
 #include <vector>
 
-#include "base/compiler_specific.h"
 #include "base/scoped_ptr.h"
 #include "chrome/browser/extensions/extension_function_dispatcher.h"
 #include "chrome/browser/tab_contents/render_view_host_delegate_helper.h"
@@ -24,10 +23,6 @@ class SiteInstance;
 struct RendererPreferences;
 struct WebPreferences;
 
-namespace IPC {
-class Message;
-}
-
 class BalloonHost : public RenderViewHostDelegate,
                     public RenderViewHostDelegate::View,
                     public ExtensionFunctionDispatcher::Delegate,
@@ -66,6 +61,8 @@ class BalloonHost : public RenderViewHostDelegate,
   virtual int GetBrowserWindowID() const;
   virtual ViewType::Type GetRenderViewType() const;
   virtual RenderViewHostDelegate::View* GetViewDelegate();
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
 
   // NotificationObserver override.
   virtual void Observe(NotificationType type,
@@ -134,9 +131,6 @@ class BalloonHost : public RenderViewHostDelegate,
   RenderViewHost* render_view_host_;
 
  private:
-  // RenderViewHostDelegate
-  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
-
   // Called to send an event that the balloon has been disconnected from
   // a renderer (if should_notify_on_disconnect_ is true).
   void NotifyDisconnect();
diff --git a/chrome/browser/tab_contents/background_contents.cc b/chrome/browser/tab_contents/background_contents.cc
index e5f98b8..c994fad 100644
--- a/chrome/browser/tab_contents/background_contents.cc
+++ b/chrome/browser/tab_contents/background_contents.cc
@@ -10,6 +10,7 @@
 #include "chrome/browser/renderer_preferences_util.h"
 #include "chrome/browser/ui/webui/chrome_web_ui_factory.h"
 #include "chrome/common/extensions/extension_constants.h"
+#include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/view_types.h"
 #include "content/browser/browsing_instance.h"
@@ -207,6 +208,15 @@ WebPreferences BackgroundContents::GetWebkitPrefs() {
                                                       false);  // is_web_ui
 }
 
+void BackgroundContents::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  // TODO(rafaelw): It may make sense for extensions to be able to open
+  // BackgroundContents to chrome-extension://<id> pages. Consider implementing.
+  render_view_host_->Send(new ExtensionMsg_Response(
+      render_view_host_->routing_id(), params.request_id, false,
+      std::string(), "Access to extension API denied."));
+}
+
 void BackgroundContents::CreateNewWindow(
     int route_id,
     const ViewHostMsg_CreateWindow_Params& params) {
diff --git a/chrome/browser/tab_contents/background_contents.h b/chrome/browser/tab_contents/background_contents.h
index f4e8874..1e7a451e 100644
--- a/chrome/browser/tab_contents/background_contents.h
+++ b/chrome/browser/tab_contents/background_contents.h
@@ -19,6 +19,7 @@
 #include "webkit/glue/window_open_disposition.h"
 
 class TabContents;
+struct ExtensionHostMsg_DomMessage_Params;
 struct WebPreferences;
 
 namespace gfx {
@@ -67,6 +68,8 @@ class BackgroundContents : public RenderViewHostDelegate,
   virtual void DidNavigate(RenderViewHost* render_view_host,
                            const ViewHostMsg_FrameNavigate_Params& params);
   virtual WebPreferences GetWebkitPrefs();
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
diff --git a/chrome/browser/ui/webui/sync_internals_ui.cc b/chrome/browser/ui/webui/sync_internals_ui.cc
index e11eb23..8ab946e1 100644
--- a/chrome/browser/ui/webui/sync_internals_ui.cc
+++ b/chrome/browser/ui/webui/sync_internals_ui.cc
@@ -42,10 +42,10 @@ SyncInternalsUI::~SyncInternalsUI() {
   }
 }
 
-void SyncInternalsUI::OnWebUISend(const GURL& source_url,
-                                  const std::string& name,
-                                  const ListValue& content) {
-  browser_sync::JsArgList args(content);
+void SyncInternalsUI::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  const std::string& name = params.name;
+  browser_sync::JsArgList args(params.arguments);
   VLOG(1) << "Received message: " << name << " with args "
           << args.ToString();
   // We handle this case directly because it needs to work even if
diff --git a/chrome/browser/ui/webui/sync_internals_ui.h b/chrome/browser/ui/webui/sync_internals_ui.h
index e5a8118..589b712 100644
--- a/chrome/browser/ui/webui/sync_internals_ui.h
+++ b/chrome/browser/ui/webui/sync_internals_ui.h
@@ -8,7 +8,6 @@
 
 #include <string>
 
-#include "base/compiler_specific.h"
 #include "base/basictypes.h"
 #include "chrome/browser/sync/js_event_handler.h"
 #include "content/browser/webui/web_ui.h"
@@ -36,13 +35,12 @@ class SyncInternalsUI : public WebUI, public browser_sync::JsEventHandler {
   //
   // TODO(akalin): Add a simple isSyncEnabled() message and make
   // getAboutInfo() be handled by the sync service.
-  virtual void OnWebUISend(const GURL& source_url,
-                           const std::string& name,
-                           const ListValue& args) OVERRIDE;
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
 
   // browser_sync::JsEventHandler implementation.
   virtual void HandleJsEvent(const std::string& name,
-                             const browser_sync::JsArgList& args) OVERRIDE;
+                             const browser_sync::JsArgList& args);
 
  private:
   // Returns the sync service's JsFrontend object, or NULL if the sync
diff --git a/chrome/browser/ui/webui/sync_internals_ui_unittest.cc b/chrome/browser/ui/webui/sync_internals_ui_unittest.cc
index 27b46a7..1407f10 100644
--- a/chrome/browser/ui/webui/sync_internals_ui_unittest.cc
+++ b/chrome/browser/ui/webui/sync_internals_ui_unittest.cc
@@ -12,6 +12,7 @@
 #include "chrome/browser/sync/js_arg_list.h"
 #include "chrome/browser/sync/js_test_util.h"
 #include "chrome/browser/sync/profile_sync_service_mock.h"
+#include "chrome/common/extensions/extension_messages.h"
 #include "chrome/test/profile_mock.h"
 #include "content/browser/browser_thread.h"
 #include "content/browser/renderer_host/test_render_view_host.h"
@@ -160,33 +161,33 @@ TEST_F(SyncInternalsUITest, HandleJsEventNullService) {
   GetTestSyncInternalsUI()->HandleJsEvent("testMessage", JsArgList(args));
 }
 
-TEST_F(SyncInternalsUITest, OnWebUISendBasic) {
+TEST_F(SyncInternalsUITest, ProcessWebUIMessageBasic) {
   ExpectSetupTeardownCalls();
 
-  std::string name = "testName";
-  ListValue args;
-  args.Append(Value::CreateIntegerValue(10));
+  ExtensionHostMsg_DomMessage_Params params;
+  params.name = "testName";
+  params.arguments.Append(Value::CreateIntegerValue(10));
 
   EXPECT_CALL(mock_js_backend_,
-              ProcessMessage(name, HasArgsAsList(args),
+              ProcessMessage(params.name, HasArgsAsList(params.arguments),
                              GetTestSyncInternalsUIAddress()));
 
   ConstructTestSyncInternalsUI();
 
-  GetTestSyncInternalsUI()->OnWebUISend(GURL(), name, args);
+  GetTestSyncInternalsUI()->ProcessWebUIMessage(params);
 }
 
-TEST_F(SyncInternalsUITest, OnWebUISendBasicNullService) {
+TEST_F(SyncInternalsUITest, ProcessWebUIMessageBasicNullService) {
   ExpectSetupTeardownCallsNullService();
 
   ConstructTestSyncInternalsUI();
 
-  std::string name = "testName";
-  ListValue args;
-  args.Append(Value::CreateIntegerValue(5));
+  ExtensionHostMsg_DomMessage_Params params;
+  params.name = "testName";
+  params.arguments.Append(Value::CreateIntegerValue(5));
 
   // Should drop the message.
-  GetTestSyncInternalsUI()->OnWebUISend(GURL(), name, args);
+  GetTestSyncInternalsUI()->ProcessWebUIMessage(params);
 }
 
 namespace {
@@ -194,28 +195,32 @@ const char kAboutInfoCall[] =
     "onGetAboutInfoFinished({\"summary\":\"SYNC DISABLED\"});";
 }  // namespace
 
-TEST_F(SyncInternalsUITest, OnWebUISendGetAboutInfo) {
+TEST_F(SyncInternalsUITest, ProcessWebUIMessageGetAboutInfo) {
   ExpectSetupTeardownCalls();
 
+  ExtensionHostMsg_DomMessage_Params params;
+  params.name = "getAboutInfo";
+
   ConstructTestSyncInternalsUI();
 
   EXPECT_CALL(*GetTestSyncInternalsUI(),
               ExecuteJavascript(ASCIIToUTF16(kAboutInfoCall)));
 
-  ListValue args;
-  GetTestSyncInternalsUI()->OnWebUISend(GURL(), "getAboutInfo", args);
+  GetTestSyncInternalsUI()->ProcessWebUIMessage(params);
 }
 
-TEST_F(SyncInternalsUITest, OnWebUISendGetAboutInfoNullService) {
+TEST_F(SyncInternalsUITest, ProcessWebUIMessageGetAboutInfoNullService) {
   ExpectSetupTeardownCallsNullService();
 
+  ExtensionHostMsg_DomMessage_Params params;
+  params.name = "getAboutInfo";
+
   ConstructTestSyncInternalsUI();
 
   EXPECT_CALL(*GetTestSyncInternalsUI(),
               ExecuteJavascript(ASCIIToUTF16(kAboutInfoCall)));
 
-  ListValue args;
-  GetTestSyncInternalsUI()->OnWebUISend(GURL(), "getAboutInfo", args);
+  GetTestSyncInternalsUI()->ProcessWebUIMessage(params);
 }
 
 }  // namespace
diff --git a/chrome/common/extensions/extension_messages.h b/chrome/common/extensions/extension_messages.h
index 74378dd..f2f5c34 100644
--- a/chrome/common/extensions/extension_messages.h
+++ b/chrome/common/extensions/extension_messages.h
@@ -16,7 +16,7 @@
 #define IPC_MESSAGE_START ExtensionMsgStart
 
 // Parameters structure for ExtensionHostMsg_Request.
-IPC_STRUCT_BEGIN(ExtensionHostMsg_Request_Params)
+IPC_STRUCT_BEGIN(ExtensionHostMsg_DomMessage_Params)
   // Message name.
   IPC_STRUCT_MEMBER(std::string, name)
 
@@ -214,7 +214,7 @@ IPC_MESSAGE_ROUTED1(ExtensionMsg_GetApplicationInfo,
 // A renderer sends this message when an extension process starts an API
 // request. The browser will always respond with a ExtensionMsg_Response.
 IPC_MESSAGE_ROUTED1(ExtensionHostMsg_Request,
-                    ExtensionHostMsg_Request_Params)
+                    ExtensionHostMsg_DomMessage_Params)
 
 // Notify the browser that the given extension added a listener to an event.
 IPC_MESSAGE_CONTROL2(ExtensionHostMsg_AddListener,
diff --git a/chrome/renderer/extensions/extension_process_bindings.cc b/chrome/renderer/extensions/extension_process_bindings.cc
index dec277e..8b7c5fa 100644
--- a/chrome/renderer/extensions/extension_process_bindings.cc
+++ b/chrome/renderer/extensions/extension_process_bindings.cc
@@ -364,7 +364,7 @@ class ExtensionImpl : public ExtensionBase {
     GetPendingRequestMap()[request_id].reset(new PendingRequest(
         current_context, name));
 
-    ExtensionHostMsg_Request_Params params;
+    ExtensionHostMsg_DomMessage_Params params;
     params.name = name;
     params.arguments.Swap(value_args);
     params.source_url = source_url;
diff --git a/content/DEPS b/content/DEPS
index 991fd7d3..bf29db6 100644
--- a/content/DEPS
+++ b/content/DEPS
@@ -8,13 +8,9 @@ include_rules = [
   # When the src\content refactoring is complete, this will be unnecessary (and
   # in fact, a layering violation).
   "+chrome",
-
   # The following directories have been refactored, so no new dependencies
   # should be added from these directories.
   "-chrome/browser/printing",
-  "-chrome/browser/extensions",
-  "-chrome/common/extensions",
-  "-chrome/renderer/extensions",
 
   # The subdirectories in content/ will manually allow their own include
   # directories in content/ so we disallow all of them.
diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
index b6fd42f..0b7a4a4 100644
--- a/content/browser/renderer_host/render_view_host.cc
+++ b/content/browser/renderer_host/render_view_host.cc
@@ -21,6 +21,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/icon_messages.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/translate_errors.h"
@@ -762,6 +763,7 @@ bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
                         OnMsgDidContentsPreferredSizeChange)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DomOperationResponse,
                         OnMsgDomOperationResponse)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_WebUISend, OnMsgWebUISend)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ForwardMessageToExternalHost,
                         OnMsgForwardMessageToExternalHost)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SetTooltipText, OnMsgSetTooltipText)
@@ -1086,6 +1088,40 @@ void RenderViewHost::OnMsgDomOperationResponse(
       Details<DomOperationNotificationDetails>(&details));
 }
 
+void RenderViewHost::OnMsgWebUISend(
+    const GURL& source_url, const std::string& message,
+    const std::string& content) {
+  if (!ChildProcessSecurityPolicy::GetInstance()->
+          HasWebUIBindings(process()->id())) {
+    NOTREACHED() << "Blocked unauthorized use of WebUIBindings.";
+    return;
+  }
+
+  scoped_ptr<Value> value;
+  if (!content.empty()) {
+    value.reset(base::JSONReader::Read(content, false));
+    if (!value.get() || !value->IsType(Value::TYPE_LIST)) {
+      // The page sent us something that we didn't understand.
+      // This probably indicates a programming error.
+      NOTREACHED() << "Invalid JSON argument in OnMsgWebUISend.";
+      return;
+    }
+  }
+
+  ExtensionHostMsg_DomMessage_Params params;
+  params.name = message;
+  if (value.get())
+    params.arguments.Swap(static_cast<ListValue*>(value.get()));
+  params.source_url = source_url;
+  // WebUI doesn't use these values yet.
+  // TODO(aa): When WebUI is ported to ExtensionFunctionDispatcher, send real
+  // values here.
+  params.request_id = -1;
+  params.has_callback = false;
+  params.user_gesture = false;
+  delegate_->ProcessWebUIMessage(params);
+}
+
 void RenderViewHost::OnMsgForwardMessageToExternalHost(
     const std::string& message, const std::string& origin,
     const std::string& target) {
diff --git a/content/browser/renderer_host/render_view_host.h b/content/browser/renderer_host/render_view_host.h
index 281bfeb..c9e7027 100644
--- a/content/browser/renderer_host/render_view_host.h
+++ b/content/browser/renderer_host/render_view_host.h
@@ -544,6 +544,9 @@ class RenderViewHost : public RenderWidgetHost {
   void OnMsgDidContentsPreferredSizeChange(const gfx::Size& new_size);
   void OnMsgDomOperationResponse(const std::string& json_string,
                                  int automation_id);
+  void OnMsgWebUISend(const GURL& source_url,
+                      const std::string& message,
+                      const std::string& content);
   void OnMsgForwardMessageToExternalHost(const std::string& message,
                                          const std::string& origin,
                                          const std::string& target);
diff --git a/content/browser/renderer_host/render_view_host_delegate.h b/content/browser/renderer_host/render_view_host_delegate.h
index f95a76d..f4f0783 100644
--- a/content/browser/renderer_host/render_view_host_delegate.h
+++ b/content/browser/renderer_host/render_view_host_delegate.h
@@ -45,6 +45,7 @@ class SkBitmap;
 class SSLClientAuthHandler;
 class SSLAddCertHandler;
 class TabContents;
+struct ExtensionHostMsg_DomMessage_Params;
 struct ViewHostMsg_CreateWindow_Params;
 struct ViewHostMsg_FrameNavigate_Params;
 struct WebApplicationInfo;
@@ -488,6 +489,11 @@ class RenderViewHostDelegate : public IPC::Channel::Listener {
   virtual void DomOperationResponse(const std::string& json_string,
                                     int automation_id) {}
 
+  // A message was sent from HTML-based UI.
+  // By default we ignore such messages.
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params) {}
+
   // A message for external host. By default we ignore such messages.
   // |receiver| can be a receiving script and |message| is any
   // arbitrary string that makes sense to the receiver.
diff --git a/content/browser/tab_contents/background_contents.h b/content/browser/tab_contents/background_contents.h
index ef03cd4..e544fde 100644
--- a/content/browser/tab_contents/background_contents.h
+++ b/content/browser/tab_contents/background_contents.h
@@ -67,6 +67,7 @@ class BackgroundContents : public RenderViewHostDelegate,
   virtual void DidNavigate(RenderViewHost* render_view_host,
                            const ViewHostMsg_FrameNavigate_Params& params);
   virtual WebPreferences GetWebkitPrefs();
+  virtual void ProcessWebUIMessage(const ViewHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index e84ca34..7c113a3 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -375,9 +375,6 @@ void TabContents::AddObservers() {
 }
 
 bool TabContents::OnMessageReceived(const IPC::Message& message) {
-  if (web_ui() && web_ui()->OnMessageReceived(message))
-    return true;
-
   ObserverListBase<TabContentsObserver>::Iterator it(observers_);
   TabContentsObserver* observer;
   while ((observer = it.GetNext()) != NULL)
@@ -2019,6 +2016,19 @@ void TabContents::DomOperationResponse(const std::string& json_string,
                                        int automation_id) {
 }
 
+void TabContents::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (!render_manager_.web_ui()) {
+    // This can happen if someone uses window.open() to open an extension URL
+    // from a non-extension context.
+    render_view_host()->Send(new ExtensionMsg_Response(
+        render_view_host()->routing_id(), params.request_id, false, "",
+        "Access to extension API denied."));
+    return;
+  }
+  render_manager_.web_ui()->ProcessWebUIMessage(params);
+}
+
 void TabContents::ProcessExternalHostMessage(const std::string& message,
                                              const std::string& origin,
                                              const std::string& target) {
diff --git a/content/browser/tab_contents/tab_contents.h b/content/browser/tab_contents/tab_contents.h
index f690393..17992dc 100644
--- a/content/browser/tab_contents/tab_contents.h
+++ b/content/browser/tab_contents/tab_contents.h
@@ -73,6 +73,7 @@ class TabContentsObserver;
 class TabContentsSSLHelper;
 class TabContentsView;
 class URLPattern;
+struct ExtensionHostMsg_DomMessage_Params;
 struct RendererPreferences;
 struct ThumbnailScore;
 struct ViewHostMsg_FrameNavigate_Params;
@@ -806,6 +807,8 @@ class TabContents : public PageNavigator,
                               WindowOpenDisposition disposition);
   virtual void DomOperationResponse(const std::string& json_string,
                                     int automation_id);
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void ProcessExternalHostMessage(const std::string& message,
                                           const std::string& origin,
                                           const std::string& target);
diff --git a/content/browser/webui/web_ui.cc b/content/browser/webui/web_ui.cc
index 87a14204..636f9e8 100644
--- a/content/browser/webui/web_ui.cc
+++ b/content/browser/webui/web_ui.cc
@@ -12,16 +12,11 @@
 #include "base/values.h"
 #include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/render_messages.h"
-#include "content/browser/child_process_security_policy.h"
-#include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/browser/tab_contents/tab_contents_view.h"
 #include "content/browser/webui/generic_handler.h"
 #include "content/common/bindings_policy.h"
-#include "content/common/view_messages.h"
-#include "ipc/ipc_message.h"
-#include "ipc/ipc_message_macros.h"
 
 namespace {
 
@@ -65,32 +60,16 @@ WebUI::~WebUI() {
 
 const WebUI::TypeID WebUI::kNoWebUI = NULL;
 
-bool WebUI::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(WebUI, message)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_WebUISend, OnWebUISend)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void WebUI::OnWebUISend(const GURL& source_url,
-                        const std::string& message,
-                        const ListValue& args) {
-  if (!ChildProcessSecurityPolicy::GetInstance()->
-          HasWebUIBindings(tab_contents_->GetRenderProcessHost()->id())) {
-    NOTREACHED() << "Blocked unauthorized use of WebUIBindings.";
-    return;
-  }
-
+void WebUI::ProcessWebUIMessage(
+    const ExtensionHostMsg_DomMessage_Params& params) {
   // Look up the callback for this message.
   MessageCallbackMap::const_iterator callback =
-      message_callbacks_.find(message);
+      message_callbacks_.find(params.name);
   if (callback == message_callbacks_.end())
     return;
 
   // Forward this message and content on.
-  callback->second->Run(&args);
+  callback->second->Run(&params.arguments);
 }
 
 void WebUI::CallJavascriptFunction(const std::string& function_name) {
diff --git a/content/browser/webui/web_ui.h b/content/browser/webui/web_ui.h
index e44f1bd..402d2fd 100644
--- a/content/browser/webui/web_ui.h
+++ b/content/browser/webui/web_ui.h
@@ -11,10 +11,8 @@
 #include <vector>
 
 #include "base/callback.h"
-#include "base/compiler_specific.h"
 #include "base/string16.h"
 #include "content/common/page_transition_types.h"
-#include "ipc/ipc_channel.h"
 
 class DictionaryValue;
 class WebUIMessageHandler;
@@ -24,20 +22,15 @@ class Profile;
 class RenderViewHost;
 class TabContents;
 class Value;
+struct ExtensionHostMsg_DomMessage_Params;
 
 // A WebUI sets up the datasources and message handlers for a given HTML-based
 // UI. It is contained by a WebUIManager.
-class WebUI : public IPC::Channel::Listener {
+class WebUI {
  public:
   explicit WebUI(TabContents* contents);
   virtual ~WebUI();
 
-  // IPC message handling.
-  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
-  virtual void OnWebUISend(const GURL& source_url,
-                           const std::string& message,
-                           const ListValue& args);
-
   // Called by RenderViewHost when the RenderView is first created. This is
   // *not* called for every page load because in some cases
   // RenderViewHostManager will reuse RenderView instances. In those cases,
@@ -59,6 +52,10 @@ class WebUI : public IPC::Channel::Listener {
   // won't be run in that case.
   virtual void DidBecomeActiveForReusedRenderView() {}
 
+  // Called from TabContents.
+  virtual void ProcessWebUIMessage(
+      const ExtensionHostMsg_DomMessage_Params& params);
+
   // Used by WebUIMessageHandlers.
   typedef Callback1<const ListValue*>::Type MessageCallback;
   void RegisterMessageCallback(const std::string& message,
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index a6d7997..4602f17 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -1619,7 +1619,7 @@ IPC_MESSAGE_ROUTED1(ViewHostMsg_DidContentsPreferredSizeChange,
 IPC_MESSAGE_ROUTED3(ViewHostMsg_WebUISend,
                     GURL /* source_url */,
                     std::string  /* message */,
-                    ListValue /* args */)
+                    std::string  /* args (as a JSON string) */)
 
 // A renderer sends this to the browser process when it wants to
 // create a ppapi plugin.  The browser will create the plugin process if
diff --git a/content/renderer/web_ui_bindings.cc b/content/renderer/web_ui_bindings.cc
index 1c42dbb..868d17a 100644
--- a/content/renderer/web_ui_bindings.cc
+++ b/content/renderer/web_ui_bindings.cc
@@ -4,6 +4,7 @@
 
 #include "content/renderer/web_ui_bindings.h"
 
+#include "base/json/json_writer.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util-inl.h"
 #include "base/values.h"
@@ -68,17 +69,14 @@ void WebUIBindings::send(const CppArgumentList& args, CppVariant* result) {
     return;
   const std::string message = args[0].ToString();
 
-  // If they've provided an optional message parameter, convert that into a
-  // Value to send to the browser process.
-  scoped_ptr<Value> content;
+  // If they've provided an optional message parameter, convert that into JSON.
+  std::string content;
   if (args.size() == 2) {
     if (!args[1].isObject())
       return;
 
-    content.reset(CreateValueFromCppVariant(args[1]));
-    CHECK(content->IsType(Value::TYPE_LIST));
-  } else {
-    content.reset(new ListValue());
+    scoped_ptr<Value> value(CreateValueFromCppVariant(args[1]));
+    base::JSONWriter::Write(value.get(), /* pretty_print= */ false, &content);
   }
 
   // Retrieve the source frame's url
@@ -88,11 +86,8 @@ void WebUIBindings::send(const CppArgumentList& args, CppVariant* result) {
     source_url = webframe->url();
 
   // Send the message up to the browser.
-  sender()->Send(new ViewHostMsg_WebUISend(
-      routing_id(),
-      source_url,
-      message,
-      *(static_cast<ListValue*>(content.get()))));
+  sender()->Send(
+      new ViewHostMsg_WebUISend(routing_id(), source_url, message, content));
 }
 
 void DOMBoundBrowserObject::SetProperty(const std::string& name,