Move dispatching and sending of the last extension specific messages out of TabContents and RenderView.I added a TabContents::Registrar helper class for allowing classing to temporarily observe a TabContents. This allows them to easily and safetly filter IPC messages. I used this for ExecuteCodeInTabFunction.

Review URL: http://codereview.chromium.org/6794035

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@80468 0039d316-1c4b-4281-b951-d872f2087c98

35 files changed, 498 insertions, 301 deletions

diff --git a/chrome/browser/extensions/execute_code_in_tab_function.cc b/chrome/browser/extensions/execute_code_in_tab_function.cc
index e73c7a6..11b0875 100644
--- a/chrome/browser/extensions/execute_code_in_tab_function.cc
+++ b/chrome/browser/extensions/execute_code_in_tab_function.cc
@@ -17,13 +17,16 @@
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/extensions/extension_error_utils.h"
+#include "chrome/common/extensions/extension_messages.h"
+#include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/common/notification_service.h"
 
 namespace keys = extension_tabs_module_constants;
 
 ExecuteCodeInTabFunction::ExecuteCodeInTabFunction()
-    : execute_tab_id_(-1),
+    : ALLOW_THIS_IN_INITIALIZER_LIST(registrar_(this)),
+      execute_tab_id_(-1),
       all_frames_(false) {
 }
 
@@ -165,24 +168,46 @@ bool ExecuteCodeInTabFunction::Execute(const std::string& code_string) {
   } else if (function_name != TabsExecuteScriptFunction::function_name()) {
     DCHECK(false);
   }
-  if (!contents->tab_contents()->ExecuteCode(request_id(), extension->id(),
-      is_js_code, code_string, all_frames_)) {
-    SendResponse(false);
+
+  ExtensionMsg_ExecuteCode_Params params;
+  params.request_id = request_id();
+  params.extension_id = extension->id();
+  params.is_javascript = is_js_code;
+  params.code = code_string;
+  params.all_frames = all_frames_;
+  contents->render_view_host()->Send(new ExtensionMsg_ExecuteCode(
+      contents->render_view_host()->routing_id(), params));
+
+  registrar_.Observe(contents->tab_contents());
+  AddRef();  // balanced in OnExecuteCodeFinished()
+  return true;
+}
+
+bool ExecuteCodeInTabFunction::OnMessageReceived(const IPC::Message& message) {
+  if (message.type() != ExtensionHostMsg_ExecuteCodeFinished::ID)
     return false;
+
+  int message_request_id;
+  void* iter = NULL;
+  if (!message.ReadInt(&iter, &message_request_id)) {
+    NOTREACHED() << "malformed extension message";
+    return true;
   }
-  registrar_.Add(this, NotificationType::TAB_CODE_EXECUTED,
-                 NotificationService::AllSources());
-  AddRef();  // balanced in Observe()
+
+  if (message_request_id != request_id())
+    return false;
+
+  IPC_BEGIN_MESSAGE_MAP(ExecuteCodeInTabFunction, message)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_ExecuteCodeFinished,
+                        OnExecuteCodeFinished)
+  IPC_END_MESSAGE_MAP()
   return true;
 }
 
-void ExecuteCodeInTabFunction::Observe(NotificationType type,
-                                       const NotificationSource& source,
-                                       const NotificationDetails& details) {
-  std::pair<int, bool>* result_details =
-      Details<std::pair<int, bool> >(details).ptr();
-  if (result_details->first == request_id()) {
-    SendResponse(result_details->second);
-    Release();  // balanced in Execute()
-  }
+void ExecuteCodeInTabFunction::OnExecuteCodeFinished(int request_id,
+                                                     bool success) {
+  SendResponse(success);
+
+  registrar_.Observe(NULL);
+  Release();  // balanced in Execute()
 }
diff --git a/chrome/browser/extensions/execute_code_in_tab_function.h b/chrome/browser/extensions/execute_code_in_tab_function.h
index e330629..a1a416a 100644
--- a/chrome/browser/extensions/execute_code_in_tab_function.h
+++ b/chrome/browser/extensions/execute_code_in_tab_function.h
@@ -10,12 +10,11 @@
 
 #include "chrome/browser/extensions/extension_function.h"
 #include "chrome/common/extensions/extension_resource.h"
-#include "content/common/notification_observer.h"
-#include "content/common/notification_registrar.h"
+#include "content/browser/tab_contents/tab_contents_observer.h"
 
 // Implement API call tabs.executeScript and tabs.insertCSS.
 class ExecuteCodeInTabFunction : public AsyncExtensionFunction,
-                                 public NotificationObserver {
+                                 public TabContentsObserver {
  public:
   ExecuteCodeInTabFunction();
   virtual ~ExecuteCodeInTabFunction();
@@ -23,9 +22,11 @@ class ExecuteCodeInTabFunction : public AsyncExtensionFunction,
  private:
   virtual bool RunImpl();
 
-  virtual void Observe(NotificationType type,
-                       const NotificationSource& source,
-                       const NotificationDetails& details);
+  // TabContentsObserver overrides.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+  // Message handler.
+  void OnExecuteCodeFinished(int request_id, bool success);
 
   // Called when contents from the file whose path is specified in JSON
   // arguments has been loaded.
@@ -35,7 +36,7 @@ class ExecuteCodeInTabFunction : public AsyncExtensionFunction,
   // true on success. If true is returned, this does an AddRef.
   bool Execute(const std::string& code_string);
 
-  NotificationRegistrar registrar_;
+  TabContentsObserver::Registrar registrar_;
 
   // Id of tab which executes code.
   int execute_tab_id_;
diff --git a/chrome/browser/extensions/extension_function_dispatcher.cc b/chrome/browser/extensions/extension_function_dispatcher.cc
index b0bd2bb..8da4119 100644
--- a/chrome/browser/extensions/extension_function_dispatcher.cc
+++ b/chrome/browser/extensions/extension_function_dispatcher.cc
@@ -486,7 +486,9 @@ void ExtensionFunctionDispatcher::HandleRequest(
 
   if (!service->ExtensionBindingsAllowed(function->source_url()) ||
       !extension->HasApiPermission(function->name())) {
-    render_view_host_->BlockExtensionRequest(function->request_id());
+    render_view_host_->Send(new ExtensionMsg_Response(
+        render_view_host_->routing_id(), function->request_id(), false,
+        std::string(), "Access to extension API denied."));
     return;
   }
 
@@ -498,15 +500,17 @@ void ExtensionFunctionDispatcher::HandleRequest(
 
     function->Run();
   } else {
-    render_view_host_->SendExtensionResponse(function->request_id(), false,
-        std::string(), QuotaLimitHeuristic::kGenericOverQuotaError);
+    render_view_host_->Send(new ExtensionMsg_Response(
+        render_view_host_->routing_id(), function->request_id(), false,
+        std::string(), QuotaLimitHeuristic::kGenericOverQuotaError));
   }
 }
 
 void ExtensionFunctionDispatcher::SendResponse(ExtensionFunction* function,
                                                bool success) {
-  render_view_host_->SendExtensionResponse(function->request_id(), success,
-      function->GetResult(), function->GetError());
+  render_view_host_->Send(new ExtensionMsg_Response(
+      render_view_host_->routing_id(), function->request_id(), success,
+      function->GetResult(), function->GetError()));
 }
 
 void ExtensionFunctionDispatcher::HandleBadMessage(ExtensionFunction* api) {
diff --git a/chrome/browser/extensions/extension_host.cc b/chrome/browser/extensions/extension_host.cc
index a663fdb..bae5378 100644
--- a/chrome/browser/extensions/extension_host.cc
+++ b/chrome/browser/extensions/extension_host.cc
@@ -16,7 +16,7 @@
 #include "chrome/browser/debugger/devtools_manager.h"
 #include "chrome/browser/debugger/devtools_handler.h"
 #include "chrome/browser/desktop_notification_handler.h"
-#include "chrome/browser/extensions/extension_message_service.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_tabs_module.h"
 #include "chrome/browser/file_select_helper.h"
@@ -32,7 +32,6 @@
 #include "chrome/common/bindings_policy.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_constants.h"
-#include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/view_types.h"
@@ -160,6 +159,8 @@ ExtensionHost::ExtensionHost(const Extension* extension,
   desktop_notification_handler_.reset(
       new DesktopNotificationHandler(NULL, render_process_host()));
   dev_tools_handler_.reset(new DevToolsHandler(NULL, render_view_host_));
+  extension_message_handler_.reset(new ExtensionMessageHandler(
+      render_process_host()->id(), render_view_host_, profile_));
 }
 
 ExtensionHost::~ExtensionHost() {
@@ -336,7 +337,7 @@ void ExtensionHost::DidNavigate(RenderViewHost* render_view_host,
     return;
 
   if (!params.url.SchemeIs(chrome::kExtensionScheme)) {
-    extension_function_dispatcher_.reset(NULL);
+    SetExtensionFunctionDispatcher(NULL);
     url_ = params.url;
     return;
   }
@@ -351,12 +352,12 @@ void ExtensionHost::DidNavigate(RenderViewHost* render_view_host,
   // it's better than the alternative.
   // TODO(erikkay) Perhaps we should display errors in developer mode.
   if (params.url.host() != extension_->id()) {
-    extension_function_dispatcher_.reset(NULL);
+    SetExtensionFunctionDispatcher(NULL);
     return;
   }
 
   url_ = params.url;
-  extension_function_dispatcher_.reset(
+  SetExtensionFunctionDispatcher(
       ExtensionFunctionDispatcher::Create(render_view_host_, this, url_));
 }
 
@@ -556,13 +557,6 @@ WebPreferences ExtensionHost::GetWebkitPrefs() {
   return webkit_prefs;
 }
 
-void ExtensionHost::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  if (extension_function_dispatcher_.get()) {
-    extension_function_dispatcher_->HandleRequest(params);
-  }
-}
-
 RenderViewHostDelegate::View* ExtensionHost::GetViewDelegate() {
   return this;
 }
@@ -794,7 +788,6 @@ bool ExtensionHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ExtensionHost, message)
     IPC_MESSAGE_HANDLER(ViewHostMsg_RunFileChooser, OnRunFileChooser)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_PostMessage, OnPostMessage)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
@@ -802,6 +795,8 @@ bool ExtensionHost::OnMessageReceived(const IPC::Message& message) {
     handled = desktop_notification_handler_->OnMessageReceived(message);
   if (!handled)
     handled = dev_tools_handler_->OnMessageReceived(message);
+  if (!handled)
+    handled = extension_message_handler_->OnMessageReceived(message);
   return handled;
 }
 
@@ -817,7 +812,7 @@ void ExtensionHost::RenderViewCreated(RenderViewHost* render_view_host) {
   // we'll create 2 EFDs for the first navigation. We should try to find a
   // better way to unify them.
   // See http://code.google.com/p/chromium/issues/detail?id=18240
-  extension_function_dispatcher_.reset(
+  SetExtensionFunctionDispatcher(
       ExtensionFunctionDispatcher::Create(render_view_host, this, url_));
 
   if (extension_host_type_ == ViewType::EXTENSION_POPUP ||
@@ -852,9 +847,8 @@ void ExtensionHost::OnRunFileChooser(
   file_select_helper_->RunFileChooser(render_view_host_, params);
 }
 
-void ExtensionHost::OnPostMessage(int port_id, const std::string& message) {
-  if (profile()->GetExtensionMessageService()) {
-    profile()->GetExtensionMessageService()->PostMessageFromRenderer(
-        port_id, message);
-  }
+void ExtensionHost::SetExtensionFunctionDispatcher(
+    ExtensionFunctionDispatcher* efd) {
+  extension_function_dispatcher_.reset(efd);
+  extension_message_handler_->set_extension_function_dispatcher(efd);
 }
diff --git a/chrome/browser/extensions/extension_host.h b/chrome/browser/extensions/extension_host.h
index 1601a8c..9dcfb7f 100644
--- a/chrome/browser/extensions/extension_host.h
+++ b/chrome/browser/extensions/extension_host.h
@@ -29,6 +29,7 @@ class Browser;
 class DesktopNotificationHandler;
 class DevToolsHandler;
 class Extension;
+class ExtensionMessageHandler;
 class FileSelectHelper;
 class RenderProcessHost;
 class RenderWidgetHostView;
@@ -130,8 +131,6 @@ class ExtensionHost : public RenderViewHostDelegate,
   // RenderViewHostDelegate implementation.
   virtual RenderViewHostDelegate::View* GetViewDelegate();
   virtual WebPreferences GetWebkitPrefs();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
@@ -232,13 +231,16 @@ class ExtensionHost : public RenderViewHostDelegate,
 
   // Message handlers.
   void OnRunFileChooser(const ViewHostMsg_RunFileChooser_Params& params);
-  void OnPostMessage(int port_id, const std::string& message);
 
   // Handles keyboard events that were not handled by HandleKeyboardEvent().
   // Platform specific implementation may override this method to handle the
   // event in platform specific way.
   virtual void UnhandledKeyboardEvent(const NativeWebKeyboardEvent& event) {}
 
+  // Updates extension_function_dispatcher_.  Call this instead of modifying it
+  // directly.
+  void SetExtensionFunctionDispatcher(ExtensionFunctionDispatcher* efd);
+
   // Returns true if we're hosting a background page.
   // This isn't valid until CreateRenderView is called.
   bool is_background_page() const { return !view(); }
@@ -296,6 +298,9 @@ class ExtensionHost : public RenderViewHostDelegate,
   // Filters dev tools IPCs.
   scoped_ptr<DevToolsHandler> dev_tools_handler_;
 
+  // Handles extension IPCs.
+  scoped_ptr<ExtensionMessageHandler> extension_message_handler_;
+
   // The time that the last javascript message was dismissed.
   base::TimeTicks last_javascript_message_dismissal_;
 
diff --git a/chrome/browser/extensions/extension_message_handler.cc b/chrome/browser/extensions/extension_message_handler.cc
new file mode 100644
index 0000000..eb407bc
--- /dev/null
+++ b/chrome/browser/extensions/extension_message_handler.cc
@@ -0,0 +1,111 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/extensions/extension_message_handler.h"
+
+#include "chrome/browser/extensions/extension_function_dispatcher.h"
+#include "chrome/browser/extensions/extension_message_service.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/common/extensions/extension_messages.h"
+#include "content/browser/child_process_security_policy.h"
+#include "content/browser/renderer_host/render_process_host.h"
+#include "content/browser/renderer_host/render_view_host.h"
+#include "content/browser/renderer_host/render_view_host_delegate.h"
+#include "content/browser/tab_contents/tab_contents.h"
+#include "content/common/notification_service.h"
+
+ExtensionMessageHandler::ExtensionMessageHandler(
+    int child_id, IPC::Message::Sender* sender, Profile* profile)
+    : child_id_(child_id),
+      sender_(sender),
+      extension_function_dispatcher_(NULL),
+      profile_(profile) {
+}
+
+ExtensionMessageHandler::~ExtensionMessageHandler() {
+}
+
+bool ExtensionMessageHandler::OnMessageReceived(
+    const IPC::Message& message) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(ExtensionMessageHandler, message)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_PostMessage, OnPostMessage)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+bool ExtensionMessageHandler::CanDispatchRequest(
+    int child_id,
+    int routing_id,
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (!ChildProcessSecurityPolicy::GetInstance()->
+          HasExtensionBindings(child_id)) {
+    // This can happen if someone uses window.open() to open an extension URL
+    // from a non-extension context.
+    sender_->Send(new ExtensionMsg_Response(
+      routing_id, params.request_id, false, std::string(),
+      "Access to extension API denied."));
+    return false;
+  }
+
+  return true;
+}
+
+void ExtensionMessageHandler::OnPostMessage(int port_id,
+                                            const std::string& message) {
+  if (profile_->GetExtensionMessageService()) {
+    profile_->GetExtensionMessageService()->PostMessageFromRenderer(
+        port_id, message);
+  }
+}
+
+void ExtensionMessageHandler::OnRequest(
+    const IPC::Message& message,
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  DCHECK(child_id_);
+  if (!extension_function_dispatcher_ ||
+      !CanDispatchRequest(child_id_, message.routing_id(), params)) {
+    return;
+  }
+
+  extension_function_dispatcher_->HandleRequest(params);
+}
+
+ExtensionMessageObserver::ExtensionMessageObserver(TabContents* tab_contents)
+    : TabContentsObserver(tab_contents),
+      ALLOW_THIS_IN_INITIALIZER_LIST(
+          handler_(0, this, tab_contents->profile())) {
+  // We don't pass in a child_id to handler_ since for TabContents that can
+  // change later.
+}
+
+ExtensionMessageObserver::~ExtensionMessageObserver() {
+}
+
+bool ExtensionMessageObserver::OnMessageReceived(const IPC::Message& message) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(ExtensionMessageObserver, message)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+
+  if (!handled)
+    handled = handler_.OnMessageReceived(message);
+  return handled;
+}
+
+void ExtensionMessageObserver::OnRequest(
+    const IPC::Message& message,
+    const ExtensionHostMsg_DomMessage_Params& params) {
+  if (!handler_.CanDispatchRequest(
+          tab_contents()->render_view_host()->process()->id(),
+          message.routing_id(),
+          params)) {
+    return;
+  }
+
+  tab_contents()->render_view_host()->delegate()->ProcessWebUIMessage(params);
+}
diff --git a/chrome/browser/extensions/extension_message_handler.h b/chrome/browser/extensions/extension_message_handler.h
new file mode 100644
index 0000000..3cd8d3c
--- /dev/null
+++ b/chrome/browser/extensions/extension_message_handler.h
@@ -0,0 +1,76 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_HANDLER_H_
+#define CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_HANDLER_H_
+#pragma once
+
+#include "content/browser/tab_contents/tab_contents_observer.h"
+#include "ipc/ipc_channel.h"
+
+class ExtensionFunctionDispatcher;
+class Profile;
+struct ExtensionHostMsg_DomMessage_Params;
+
+// Filters and dispatches extension-related IPC messages that arrive from
+// renderer/extension processes.  This object is created for renderers and also
+// ExtensionHost/BackgroundContents.  Contrast this with ExtensionTabHelper,
+// which is only created for TabContents.
+class ExtensionMessageHandler : public IPC::Channel::Listener {
+ public:
+  // |sender| is guaranteed to outlive this object.
+  ExtensionMessageHandler(int child_id,
+                          IPC::Message::Sender* sender,
+                          Profile* profile);
+  virtual ~ExtensionMessageHandler();
+
+  // IPC::Channel::Listener overrides.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+  // Returns true iff the message can be dispatched.
+  bool CanDispatchRequest(int child_id,
+                          int routing_id,
+                          const ExtensionHostMsg_DomMessage_Params& params);
+
+  void set_extension_function_dispatcher(ExtensionFunctionDispatcher* e) {
+    extension_function_dispatcher_ = e;
+  }
+
+ private:
+  // Message handlers.
+  void OnPostMessage(int port_id, const std::string& message);
+  void OnRequest(const IPC::Message& message,
+                 const ExtensionHostMsg_DomMessage_Params& params);
+
+  // The child id of the corresponding process.  Can be 0.
+  int child_id_;
+
+  // Guaranteed to outlive this object.
+  IPC::Message::Sender* sender_;
+  ExtensionFunctionDispatcher* extension_function_dispatcher_;
+
+  Profile* profile_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExtensionMessageHandler);
+};
+
+// A TabContentsObserver that forwards IPCs to ExtensionMessageHandler.
+class ExtensionMessageObserver : public TabContentsObserver {
+ public:
+  explicit ExtensionMessageObserver(TabContents* tab_contents);
+  ~ExtensionMessageObserver();
+
+ private:
+  // TabContentsObserver overrides.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+  void OnRequest(const IPC::Message& message,
+                 const ExtensionHostMsg_DomMessage_Params& params);
+
+  ExtensionMessageHandler handler_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExtensionMessageObserver);
+};
+
+#endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_HANDLER_H_
diff --git a/chrome/browser/extensions/extension_tab_helper.cc b/chrome/browser/extensions/extension_tab_helper.cc
index 16c3534..ad22905 100644
--- a/chrome/browser/extensions/extension_tab_helper.cc
+++ b/chrome/browser/extensions/extension_tab_helper.cc
@@ -4,9 +4,10 @@
 
 #include "chrome/browser/extensions/extension_tab_helper.h"
 
-#include "chrome/browser/extensions/extension_message_service.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/tab_contents/tab_contents_wrapper.h"
+#include "chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.h"
 #include "chrome/common/extensions/extension_action.h"
 #include "chrome/common/extensions/extension_icon_set.h"
 #include "chrome/common/extensions/extension_messages.h"
@@ -15,9 +16,10 @@
 #include "content/browser/tab_contents/navigation_controller.h"
 #include "content/common/notification_service.h"
 
-ExtensionTabHelper::ExtensionTabHelper(TabContents* tab_contents)
-    : TabContentsObserver(tab_contents),
-      extension_app_(NULL) {
+ExtensionTabHelper::ExtensionTabHelper(TabContentsWrapper* wrapper)
+    : TabContentsObserver(wrapper->tab_contents()),
+      extension_app_(NULL),
+      wrapper_(wrapper) {
 }
 
 ExtensionTabHelper::~ExtensionTabHelper() {
@@ -33,6 +35,10 @@ void ExtensionTabHelper::PageActionStateChanged() {
       TabContents::INVALIDATE_PAGE_ACTIONS);
 }
 
+void ExtensionTabHelper::GetApplicationInfo(int32 page_id) {
+  Send(new ExtensionMsg_GetApplicationInfo(routing_id(), page_id));
+}
+
 void ExtensionTabHelper::SetExtensionApp(const Extension* extension) {
   DCHECK(!extension || extension->GetFullLaunchURL().is_valid());
   extension_app_ = extension;
@@ -103,12 +109,28 @@ void ExtensionTabHelper::DidNavigateMainFramePostCommit(
 bool ExtensionTabHelper::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ExtensionTabHelper, message)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_PostMessage, OnPostMessage)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_DidGetApplicationInfo,
+                        OnDidGetApplicationInfo)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_InstallApplication,
+                        OnInstallApplication)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
+void ExtensionTabHelper::OnDidGetApplicationInfo(
+    int32 page_id, const WebApplicationInfo& info) {
+  web_app_info_ = info;
+
+  if (wrapper_->delegate())
+    wrapper_->delegate()->OnDidGetApplicationInfo(wrapper_, page_id);
+}
+
+void ExtensionTabHelper::OnInstallApplication(const WebApplicationInfo& info) {
+  if (wrapper_->delegate())
+    wrapper_->delegate()->OnInstallApplication(wrapper_, info);
+}
+
 void ExtensionTabHelper::UpdateExtensionAppIcon(const Extension* extension) {
   extension_app_icon_.reset();
 
@@ -134,11 +156,3 @@ void ExtensionTabHelper::OnImageLoaded(SkBitmap* image,
     tab_contents()->NotifyNavigationStateChanged(TabContents::INVALIDATE_TAB);
   }
 }
-
-void ExtensionTabHelper::OnPostMessage(int port_id,
-                                       const std::string& message) {
-  if (tab_contents()->profile()->GetExtensionMessageService()) {
-    tab_contents()->profile()->GetExtensionMessageService()->
-        PostMessageFromRenderer(port_id, message);
-  }
-}
diff --git a/chrome/browser/extensions/extension_tab_helper.h b/chrome/browser/extensions/extension_tab_helper.h
index 5b9c60a..c47423e 100644
--- a/chrome/browser/extensions/extension_tab_helper.h
+++ b/chrome/browser/extensions/extension_tab_helper.h
@@ -2,21 +2,24 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_EXTENSIONS_EXTENSOIN_TAB_HELPER_H_
-#define CHROME_BROWSER_EXTENSIONS_EXTENSOIN_TAB_HELPER_H_
+#ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_HELPER_H_
+#define CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_HELPER_H_
 #pragma once
 
 #include "content/browser/tab_contents/tab_contents_observer.h"
 #include "chrome/browser/extensions/image_loading_tracker.h"
+#include "chrome/common/web_apps.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
 class Extension;
+class TabContentsWrapper;
+struct WebApplicationInfo;
 
 // Per-tab extension helper.
 class ExtensionTabHelper : public TabContentsObserver,
                            public ImageLoadingTracker::Observer {
  public:
-  explicit ExtensionTabHelper(TabContents* tab_contents);
+  explicit ExtensionTabHelper(TabContentsWrapper* wrapper);
   virtual ~ExtensionTabHelper();
 
   // Copies the internal state from another ExtensionTabHelper.
@@ -25,6 +28,11 @@ class ExtensionTabHelper : public TabContentsObserver,
   // Call this after updating a page action to notify clients about the changes.
   void PageActionStateChanged();
 
+  // Requests application info for the specified page. This is an asynchronous
+  // request. The delegate is notified by way of OnDidGetApplicationInfo when
+  // the data is available.
+  void GetApplicationInfo(int32 page_id);
+
   // App extensions ------------------------------------------------------------
 
   // Sets the extension denoting this as an app. If |extension| is non-null this
@@ -43,6 +51,9 @@ class ExtensionTabHelper : public TabContentsObserver,
 
   const Extension* extension_app() const { return extension_app_; }
   bool is_app() const { return extension_app_ != NULL; }
+  const WebApplicationInfo& web_app_info() const {
+    return web_app_info_;
+  }
 
   // If an app extension has been explicitly set for this TabContents its icon
   // is returned.
@@ -60,7 +71,11 @@ class ExtensionTabHelper : public TabContentsObserver,
   virtual void DidNavigateMainFramePostCommit(
       const NavigationController::LoadCommittedDetails& details,
       const ViewHostMsg_FrameNavigate_Params& params) OVERRIDE;
-  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+  // Message handlers.
+  void OnDidGetApplicationInfo(int32 page_id, const WebApplicationInfo& info);
+  void OnInstallApplication(const WebApplicationInfo& info);
 
   // App extensions related methods:
 
@@ -72,9 +87,6 @@ class ExtensionTabHelper : public TabContentsObserver,
   virtual void OnImageLoaded(SkBitmap* image, const ExtensionResource& resource,
                              int index);
 
-  // Message handlers.
-  void OnPostMessage(int port_id, const std::string& message);
-
   // Data for app extensions ---------------------------------------------------
 
   // If non-null this tab is an app tab and this is the extension the tab was
@@ -87,7 +99,12 @@ class ExtensionTabHelper : public TabContentsObserver,
   // Used for loading extension_app_icon_.
   scoped_ptr<ImageLoadingTracker> extension_app_image_loader_;
 
+  // Cached web app info data.
+  WebApplicationInfo web_app_info_;
+
+  TabContentsWrapper* wrapper_;
+
   DISALLOW_COPY_AND_ASSIGN(ExtensionTabHelper);
 };
 
-#endif  // CHROME_BROWSER_EXTENSIONS_EXTENSOIN_TAB_HELPER_H_
+#endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_HELPER_H_
diff --git a/chrome/browser/notifications/balloon_host.cc b/chrome/browser/notifications/balloon_host.cc
index e105b3c..d9bffc19 100644
--- a/chrome/browser/notifications/balloon_host.cc
+++ b/chrome/browser/notifications/balloon_host.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/notifications/balloon_host.h"
 
 #include "chrome/browser/browser_list.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/notifications/balloon.h"
@@ -70,6 +71,12 @@ const string16& BalloonHost::GetSource() const {
   return balloon_->notification().display_source();
 }
 
+bool BalloonHost::OnMessageReceived(const IPC::Message& message) {
+  if (!extension_message_handler_.get())
+    return false;
+  return extension_message_handler_->OnMessageReceived(message);
+}
+
 WebPreferences BalloonHost::GetWebkitPrefs() {
   WebPreferences web_prefs =
       RenderViewHostDelegateHelper::GetWebkitPrefs(GetProfile(),
@@ -132,13 +139,6 @@ RenderViewHostDelegate::View* BalloonHost::GetViewDelegate() {
   return this;
 }
 
-void BalloonHost::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  if (extension_function_dispatcher_.get()) {
-    extension_function_dispatcher_->HandleRequest(params);
-  }
-}
-
 // RenderViewHostDelegate::View methods implemented to allow links to
 // open pages in new tabs.
 void BalloonHost::CreateNewWindow(
@@ -209,6 +209,11 @@ void BalloonHost::Init() {
             balloon_->notification().content_url());
     static_cast<BrowserRenderProcessHost*>(rvh->process())->set_installed_app(
         installed_app);
+
+    extension_message_handler_.reset(new ExtensionMessageHandler(
+        rvh->process()->id(), rvh, GetProfile()));
+    extension_message_handler_->set_extension_function_dispatcher(
+        extension_function_dispatcher_.get());
   } else if (enable_web_ui_) {
     rvh->AllowBindings(BindingsPolicy::WEB_UI);
   }
diff --git a/chrome/browser/notifications/balloon_host.h b/chrome/browser/notifications/balloon_host.h
index 475d6bd..b29955b 100644
--- a/chrome/browser/notifications/balloon_host.h
+++ b/chrome/browser/notifications/balloon_host.h
@@ -18,6 +18,7 @@
 
 class Balloon;
 class Browser;
+class ExtensionMessageHandler;
 class Profile;
 class SiteInstance;
 struct RendererPreferences;
@@ -46,6 +47,7 @@ class BalloonHost : public RenderViewHostDelegate,
   const string16& GetSource() const;
 
   // RenderViewHostDelegate overrides.
+  virtual bool OnMessageReceived(const IPC::Message& message);
   virtual WebPreferences GetWebkitPrefs();
   virtual SiteInstance* GetSiteInstance() const;
   virtual Profile* GetProfile() const;
@@ -61,8 +63,6 @@ class BalloonHost : public RenderViewHostDelegate,
   virtual int GetBrowserWindowID() const;
   virtual ViewType::Type GetRenderViewType() const;
   virtual RenderViewHostDelegate::View* GetViewDelegate();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
 
   // NotificationObserver override.
   virtual void Observe(NotificationType type,
@@ -160,6 +160,9 @@ class BalloonHost : public RenderViewHostDelegate,
   bool enable_web_ui_;
 
   NotificationRegistrar registrar_;
+
+  // Handles extension IPCs.
+  scoped_ptr<ExtensionMessageHandler> extension_message_handler_;
 };
 
 #endif  // CHROME_BROWSER_NOTIFICATIONS_BALLOON_HOST_H_
diff --git a/chrome/browser/prerender/prerender_contents.cc b/chrome/browser/prerender/prerender_contents.cc
index 166f4f9..51fa15d 100644
--- a/chrome/browser/prerender/prerender_contents.cc
+++ b/chrome/browser/prerender/prerender_contents.cc
@@ -372,11 +372,6 @@ WebPreferences PrerenderContents::GetWebkitPrefs() {
                                                       false);  // is_web_ui
 }
 
-void PrerenderContents::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  render_view_host_->BlockExtensionRequest(params.request_id);
-}
-
 void PrerenderContents::CreateNewWindow(
     int route_id,
     const ViewHostMsg_CreateWindow_Params& params) {
diff --git a/chrome/browser/prerender/prerender_contents.h b/chrome/browser/prerender/prerender_contents.h
index 9db6e4c..13569d2 100644
--- a/chrome/browser/prerender/prerender_contents.h
+++ b/chrome/browser/prerender/prerender_contents.h
@@ -116,8 +116,6 @@ class PrerenderContents : public RenderViewHostDelegate,
                            int32 page_id,
                            const std::wstring& title);
   virtual WebPreferences GetWebkitPrefs();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
diff --git a/chrome/browser/tab_contents/background_contents.cc b/chrome/browser/tab_contents/background_contents.cc
index 648aeb2..bd82e06 100644
--- a/chrome/browser/tab_contents/background_contents.cc
+++ b/chrome/browser/tab_contents/background_contents.cc
@@ -6,15 +6,16 @@
 
 #include "chrome/browser/background_contents_service.h"
 #include "chrome/browser/desktop_notification_handler.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_message_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/renderer_preferences_util.h"
 #include "chrome/browser/ui/webui/chrome_web_ui_factory.h"
 #include "chrome/common/extensions/extension_constants.h"
-#include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/view_types.h"
 #include "content/browser/browsing_instance.h"
+#include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/site_instance.h"
 #include "content/common/notification_service.h"
@@ -45,6 +46,8 @@ BackgroundContents::BackgroundContents(SiteInstance* site_instance,
                  Source<Profile>(profile));
   desktop_notification_handler_.reset(
       new DesktopNotificationHandler(NULL, site_instance->GetProcess()));
+  extension_message_handler_.reset(new ExtensionMessageHandler(
+      render_view_host_->process()->id(), render_view_host_, profile));
 }
 
 // Exposed to allow creating mocks.
@@ -198,16 +201,9 @@ void BackgroundContents::RenderViewGone(RenderViewHost* rvh,
 }
 
 bool BackgroundContents::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(BackgroundContents, message)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_PostMessage, OnPostMessage)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-
-  // Forward desktop notification IPCs if any to the
-  // DesktopNotificationHandler.
+  bool handled = desktop_notification_handler_->OnMessageReceived(message);
   if (!handled)
-   handled = desktop_notification_handler_->OnMessageReceived(message);
+    handled = extension_message_handler_->OnMessageReceived(message);
   return handled;
 }
 
@@ -226,13 +222,6 @@ WebPreferences BackgroundContents::GetWebkitPrefs() {
                                                       false);  // is_web_ui
 }
 
-void BackgroundContents::ProcessWebUIMessage(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  // TODO(rafaelw): It may make sense for extensions to be able to open
-  // BackgroundContents to chrome-extension://<id> pages. Consider implementing.
-  render_view_host_->BlockExtensionRequest(params.request_id);
-}
-
 void BackgroundContents::CreateNewWindow(
     int route_id,
     const ViewHostMsg_CreateWindow_Params& params) {
@@ -285,12 +274,3 @@ BackgroundContents::GetBackgroundContentsByID(int render_process_id,
 
   return render_view_host->delegate()->GetAsBackgroundContents();
 }
-
-void BackgroundContents::OnPostMessage(int port_id,
-                                       const std::string& message) {
-  Profile* profile = render_view_host_->process()->profile();
-  if (profile->GetExtensionMessageService()) {
-    profile->GetExtensionMessageService()->PostMessageFromRenderer(
-        port_id, message);
-  }
-}
diff --git a/chrome/browser/tab_contents/background_contents.h b/chrome/browser/tab_contents/background_contents.h
index 3db1bfc..b33d9a0 100644
--- a/chrome/browser/tab_contents/background_contents.h
+++ b/chrome/browser/tab_contents/background_contents.h
@@ -19,8 +19,9 @@
 #include "webkit/glue/window_open_disposition.h"
 
 class TabContents;
-struct WebPreferences;
 class DesktopNotificationHandler;
+class ExtensionMessageHandler;
+struct WebPreferences;
 
 namespace gfx {
 class Rect;
@@ -68,8 +69,6 @@ class BackgroundContents : public RenderViewHostDelegate,
   virtual void DidNavigate(RenderViewHost* render_view_host,
                            const ViewHostMsg_FrameNavigate_Params& params);
   virtual WebPreferences GetWebkitPrefs();
-  virtual void ProcessWebUIMessage(
-      const ExtensionHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
                                     const std::wstring& default_prompt,
                                     const GURL& frame_url,
@@ -153,9 +152,6 @@ class BackgroundContents : public RenderViewHostDelegate,
   BackgroundContents();
 
  private:
-  // Message handlers.
-  void OnPostMessage(int port_id, const std::string& message);
-
   // The delegate for this BackgroundContents.
   Delegate* delegate_;
 
@@ -173,6 +169,9 @@ class BackgroundContents : public RenderViewHostDelegate,
   // Handles desktop notification IPCs.
   scoped_ptr<DesktopNotificationHandler> desktop_notification_handler_;
 
+  // Handles extension IPCs.
+  scoped_ptr<ExtensionMessageHandler> extension_message_handler_;
+
   DISALLOW_COPY_AND_ASSIGN(BackgroundContents);
 };
 
diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
index 938605a..c0bdf7b 100644
--- a/chrome/browser/ui/browser.cc
+++ b/chrome/browser/ui/browser.cc
@@ -1803,7 +1803,7 @@ void Browser::OpenCreateShortcutsDialog() {
 
   // Start fetching web app info for CreateApplicationShortcut dialog and show
   // the dialog when the data is available in OnDidGetApplicationInfo.
-  current_tab->render_view_host()->GetApplicationInfo(entry->page_id());
+  current_tab->extension_tab_helper()->GetApplicationInfo(entry->page_id());
 #else
   NOTIMPLEMENTED();
 #endif
@@ -2940,7 +2940,8 @@ void Browser::LoadingStateChanged(TabContents* source) {
       // malware site etc). When this happens, we abort the shortcut update.
       NavigationEntry* entry = source->controller().GetLastCommittedEntry();
       if (entry) {
-        source->render_view_host()->GetApplicationInfo(entry->page_id());
+        TabContentsWrapper::GetCurrentWrapperForContents(source)->
+            extension_tab_helper()->GetApplicationInfo(entry->page_id());
       } else {
         pending_web_app_action_ = NONE;
       }
@@ -3241,23 +3242,42 @@ bool Browser::ShouldAddNavigationToHistory(
   return !IsApplication();
 }
 
-void Browser::OnDidGetApplicationInfo(TabContents* tab_contents,
+void Browser::ContentRestrictionsChanged(TabContents* source) {
+  UpdateCommandsForContentRestrictionState();
+}
+
+void Browser::WorkerCrashed() {
+  TabContents* tab_contents = GetSelectedTabContents();
+  if (!tab_contents)
+    return;
+  tab_contents->AddInfoBar(new SimpleAlertInfoBarDelegate(tab_contents, NULL,
+      l10n_util::GetStringUTF16(IDS_WEBWORKER_CRASHED_PROMPT), true));
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Browser, TabContentsWrapperDelegate implementation:
+
+void Browser::URLStarredChanged(TabContentsWrapper* source, bool starred) {
+  if (source == GetSelectedTabContentsWrapper())
+    window_->SetStarredState(starred);
+}
+
+void Browser::OnDidGetApplicationInfo(TabContentsWrapper* source,
                                       int32 page_id) {
-  TabContentsWrapper* current_tab = GetSelectedTabContentsWrapper();
-  if (current_tab->tab_contents() != tab_contents)
+  if (GetSelectedTabContentsWrapper() != source)
     return;
 
-  NavigationEntry* entry = current_tab->controller().GetLastCommittedEntry();
+  NavigationEntry* entry = source->controller().GetLastCommittedEntry();
   if (!entry || (entry->page_id() != page_id))
     return;
 
   switch (pending_web_app_action_) {
     case CREATE_SHORTCUT: {
-      window()->ShowCreateWebAppShortcutsDialog(current_tab);
+      window()->ShowCreateWebAppShortcutsDialog(source);
       break;
     }
     case UPDATE_SHORTCUT: {
-      web_app::UpdateShortcutForTabContents(current_tab);
+      web_app::UpdateShortcutForTabContents(source);
       break;
     }
     default:
@@ -3268,7 +3288,7 @@ void Browser::OnDidGetApplicationInfo(TabContents* tab_contents,
   pending_web_app_action_ = NONE;
 }
 
-void Browser::OnInstallApplication(TabContents* source,
+void Browser::OnInstallApplication(TabContentsWrapper* source,
                                    const WebApplicationInfo& web_app) {
   ExtensionService* extensions_service = profile()->GetExtensionService();
   if (!extensions_service)
@@ -3281,26 +3301,6 @@ void Browser::OnInstallApplication(TabContents* source,
   installer->InstallWebApp(web_app);
 }
 
-void Browser::ContentRestrictionsChanged(TabContents* source) {
-  UpdateCommandsForContentRestrictionState();
-}
-
-void Browser::WorkerCrashed() {
-  TabContents* tab_contents = GetSelectedTabContents();
-  if (!tab_contents)
-    return;
-  tab_contents->AddInfoBar(new SimpleAlertInfoBarDelegate(tab_contents, NULL,
-      l10n_util::GetStringUTF16(IDS_WEBWORKER_CRASHED_PROMPT), true));
-}
-
-///////////////////////////////////////////////////////////////////////////////
-// Browser, TabContentsWrapperDelegate implementation:
-
-void Browser::URLStarredChanged(TabContentsWrapper* source, bool starred) {
-  if (source == GetSelectedTabContentsWrapper())
-    window_->SetStarredState(starred);
-}
-
 ///////////////////////////////////////////////////////////////////////////////
 // Browser, SearchEngineTabHelperDelegate implementation:
 
diff --git a/chrome/browser/ui/browser.h b/chrome/browser/ui/browser.h
index 9af0b4c..bae2786 100644
--- a/chrome/browser/ui/browser.h
+++ b/chrome/browser/ui/browser.h
@@ -813,16 +813,18 @@ class Browser : public TabHandlerDelegate,
   virtual bool ShouldAddNavigationToHistory(
       const history::HistoryAddPageArgs& add_page_args,
       NavigationType::Type navigation_type);
-  virtual void OnDidGetApplicationInfo(TabContents* tab_contents,
-                                       int32 page_id);
-  virtual void OnInstallApplication(TabContents* tab_contents,
-                                    const WebApplicationInfo& app_info);
   virtual void ContentRestrictionsChanged(TabContents* source);
   virtual void WorkerCrashed();
 
   // Overridden from TabContentsWrapperDelegate:
   virtual void URLStarredChanged(TabContentsWrapper* source,
                                  bool starred) OVERRIDE;
+  virtual void OnDidGetApplicationInfo(TabContentsWrapper* source,
+                                       int32 page_id) OVERRIDE;
+  virtual void OnInstallApplication(
+      TabContentsWrapper* source,
+      const WebApplicationInfo& app_info) OVERRIDE;
+
   // Overridden from SearchEngineTabHelperDelegate:
   virtual void ConfirmSetDefaultSearchProvider(
       TabContents* tab_contents,
diff --git a/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc b/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc
index 39a0c74..1ef716f 100644
--- a/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc
+++ b/chrome/browser/ui/tab_contents/tab_contents_wrapper.cc
@@ -11,6 +11,7 @@
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/custom_handlers/register_protocol_handler_infobar_delegate.h"
 #include "chrome/browser/debugger/devtools_handler.h"
+#include "chrome/browser/extensions/extension_message_handler.h"
 #include "chrome/browser/extensions/extension_tab_helper.h"
 #include "chrome/browser/file_select_helper.h"
 #include "chrome/browser/history/top_sites.h"
@@ -54,7 +55,7 @@ TabContentsWrapper::TabContentsWrapper(TabContents* contents)
   // Create the tab helpers.
   autocomplete_history_manager_.reset(new AutocompleteHistoryManager(contents));
   autofill_manager_.reset(new AutofillManager(contents));
-  extension_tab_helper_.reset(new ExtensionTabHelper(contents));
+  extension_tab_helper_.reset(new ExtensionTabHelper(this));
   find_tab_helper_.reset(new FindTabHelper(contents));
   password_manager_delegate_.reset(new PasswordManagerDelegateImpl(contents));
   password_manager_.reset(
@@ -69,6 +70,7 @@ TabContentsWrapper::TabContentsWrapper(TabContents* contents)
 
   // Create the per-tab observers.
   dev_tools_observer_.reset(new DevToolsObserver(contents));
+  extension_message_observer_.reset(new ExtensionMessageObserver(contents));
   file_select_observer_.reset(new FileSelectObserver(contents));
   prerender_observer_.reset(new prerender::PrerenderObserver(contents));
   printing_.reset(new printing::PrintViewManager(contents));
diff --git a/chrome/browser/ui/tab_contents/tab_contents_wrapper.h b/chrome/browser/ui/tab_contents/tab_contents_wrapper.h
index 38ee4f9..95202fd 100644
--- a/chrome/browser/ui/tab_contents/tab_contents_wrapper.h
+++ b/chrome/browser/ui/tab_contents/tab_contents_wrapper.h
@@ -28,6 +28,7 @@ class AutocompleteHistoryManager;
 class AutofillManager;
 class DevToolsObserver;
 class Extension;
+class ExtensionMessageObserver;
 class ExtensionTabHelper;
 class FileSelectObserver;
 class FindTabHelper;
@@ -182,6 +183,7 @@ class TabContentsWrapper : public NotificationObserver,
   // and silently do their thing live here.)
 
   scoped_ptr<DevToolsObserver> dev_tools_observer_;
+  scoped_ptr<ExtensionMessageObserver> extension_message_observer_;
   scoped_ptr<FileSelectObserver> file_select_observer_;
   scoped_ptr<prerender::PrerenderObserver> prerender_observer_;
 
diff --git a/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.cc b/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.cc
index 61a2718..750c29e 100644
--- a/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.cc
+++ b/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.cc
@@ -6,3 +6,13 @@
 
 TabContentsWrapperDelegate::~TabContentsWrapperDelegate() {
 }
+
+// Notification when an application programmatically requests installation.
+void TabContentsWrapperDelegate::OnInstallApplication(
+    TabContentsWrapper* source,
+    const WebApplicationInfo& app_info) {
+}
+
+void TabContentsWrapperDelegate::OnDidGetApplicationInfo(
+    TabContentsWrapper* source, int32 page_id) {
+}
diff --git a/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.h b/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.h
index 14cdc2ff..99129f6 100644
--- a/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.h
+++ b/chrome/browser/ui/tab_contents/tab_contents_wrapper_delegate.h
@@ -6,7 +6,10 @@
 #define CHROME_BROWSER_UI_TAB_CONTENTS_TAB_CONTENTS_WRAPPER_DELEGATE_H_
 #pragma once
 
+#include "base/basictypes.h"
+
 class TabContentsWrapper;
+struct WebApplicationInfo;
 
 // Objects implement this interface to get notified about changes in the
 // TabContentsWrapper and to provide necessary functionality.
@@ -15,6 +18,14 @@ class TabContentsWrapperDelegate {
   // Notification that the starredness of the current URL changed.
   virtual void URLStarredChanged(TabContentsWrapper* source, bool starred) = 0;
 
+  // Notification that a user's request to install an application has completed.
+  virtual void OnDidGetApplicationInfo(TabContentsWrapper* source,
+                                       int32 page_id);
+
+  // Notification when an application programmatically requests installation.
+  virtual void OnInstallApplication(TabContentsWrapper* source,
+                                    const WebApplicationInfo& app_info);
+
  protected:
   virtual ~TabContentsWrapperDelegate();
 };
diff --git a/chrome/browser/ui/views/create_application_shortcut_view.cc b/chrome/browser/ui/views/create_application_shortcut_view.cc
index a2167fa..2e2079a 100644
--- a/chrome/browser/ui/views/create_application_shortcut_view.cc
+++ b/chrome/browser/ui/views/create_application_shortcut_view.cc
@@ -7,6 +7,7 @@
 #include "base/callback.h"
 #include "base/utf_string_conversions.h"
 #include "base/win/windows_version.h"
+#include "chrome/browser/extensions/extension_tab_helper.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/tab_contents/tab_contents_wrapper.h"
@@ -416,7 +417,7 @@ CreateUrlApplicationShortcutView::CreateUrlApplicationShortcutView(
 
   web_app::GetShortcutInfoForTab(tab_contents_, &shortcut_info_);
   const WebApplicationInfo& app_info =
-      tab_contents_->tab_contents()->web_app_info();
+      tab_contents_->extension_tab_helper()->web_app_info();
   if (!app_info.icons.empty()) {
     web_app::GetIconsInfo(app_info, &unprocessed_icons_);
     FetchIcon();
diff --git a/chrome/browser/ui/web_applications/web_app_ui.cc b/chrome/browser/ui/web_applications/web_app_ui.cc
index 5c92e0e..3a1d46f 100644
--- a/chrome/browser/ui/web_applications/web_app_ui.cc
+++ b/chrome/browser/ui/web_applications/web_app_ui.cc
@@ -8,6 +8,7 @@
 #include "base/path_service.h"
 #include "base/task.h"
 #include "base/win/windows_version.h"
+#include "chrome/browser/extensions/extension_tab_helper.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/web_applications/web_app.h"
 #include "chrome/browser/ui/tab_contents/tab_contents_wrapper.h"
@@ -92,7 +93,7 @@ UpdateShortcutWorker::UpdateShortcutWorker(TabContentsWrapper* tab_contents)
     : tab_contents_(tab_contents),
       profile_path_(tab_contents->profile()->GetPath()) {
   web_app::GetShortcutInfoForTab(tab_contents_, &shortcut_info_);
-  web_app::GetIconsInfo(tab_contents_->tab_contents()->web_app_info(),
+  web_app::GetIconsInfo(tab_contents_->extension_tab_helper()->web_app_info(),
                         &unprocessed_icons_);
   file_name_ = web_app::internals::GetSanitizedFileName(shortcut_info_.title);
 
@@ -292,7 +293,8 @@ void GetShortcutInfoForTab(TabContentsWrapper* tab_contents_wrapper,
   DCHECK(info);  // Must provide a valid info.
   const TabContents* tab_contents = tab_contents_wrapper->tab_contents();
 
-  const WebApplicationInfo& app_info = tab_contents->web_app_info();
+  const WebApplicationInfo& app_info =
+      tab_contents_wrapper->extension_tab_helper()->web_app_info();
 
   info->url = app_info.app_url.is_empty() ? tab_contents->GetURL() :
                                             app_info.app_url;
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index c580b6f..320eeb8 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -926,6 +926,8 @@
         'browser/extensions/extension_management_api.h',
         'browser/extensions/extension_menu_manager.cc',
         'browser/extensions/extension_menu_manager.h',
+        'browser/extensions/extension_message_handler.cc',
+        'browser/extensions/extension_message_handler.h',
         'browser/extensions/extension_message_service.cc',
         'browser/extensions/extension_message_service.h',
         'browser/extensions/extension_metrics_module.cc',
diff --git a/chrome/common/extensions/extension_messages.h b/chrome/common/extensions/extension_messages.h
index f3091ba..5a0c4fd 100644
--- a/chrome/common/extensions/extension_messages.h
+++ b/chrome/common/extensions/extension_messages.h
@@ -267,7 +267,7 @@ IPC_SYNC_MESSAGE_CONTROL1_1(ExtensionHostMsg_GetMessageBundle,
                             SubstitutionMap /* message bundle */)
 
 // Send from the renderer to the browser to return the script running result.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_ExecuteCodeFinished,
+IPC_MESSAGE_ROUTED2(ExtensionHostMsg_ExecuteCodeFinished,
                     int, /* request id */
                     bool /* whether the script ran successfully */)
 
diff --git a/chrome/renderer/user_script_idle_scheduler.cc b/chrome/renderer/user_script_idle_scheduler.cc
index 7b4243f..a04a715 100644
--- a/chrome/renderer/user_script_idle_scheduler.cc
+++ b/chrome/renderer/user_script_idle_scheduler.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -113,7 +113,7 @@ void UserScriptIdleScheduler::OnExecuteCode(
     const ExtensionMsg_ExecuteCode_Params& params) {
   WebFrame* main_frame = GetMainFrame();
   if (!main_frame) {
-    Send(new ViewHostMsg_ExecuteCodeFinished(
+    Send(new ExtensionHostMsg_ExecuteCodeFinished(
         routing_id(), params.request_id, false));
     return;
   }
@@ -163,7 +163,7 @@ void UserScriptIdleScheduler::ExecuteCodeImpl(
     }
   }
 
-  Send(new ViewHostMsg_ExecuteCodeFinished(
+  Send(new ExtensionHostMsg_ExecuteCodeFinished(
       routing_id(), params.request_id, true));
 }
 
diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
index c0c6fad..3e6ef59 100644
--- a/content/browser/renderer_host/render_view_host.cc
+++ b/content/browser/renderer_host/render_view_host.cc
@@ -29,7 +29,6 @@
 #include "chrome/common/spellcheck_messages.h"
 #include "chrome/common/translate_errors.h"
 #include "chrome/common/url_constants.h"
-#include "chrome/common/web_apps.h"
 #include "content/browser/child_process_security_policy.h"
 #include "content/browser/cross_site_request_manager.h"
 #include "content/browser/in_process_webkit/session_storage_namespace.h"
@@ -561,10 +560,6 @@ int RenderViewHost::DownloadFavicon(const GURL& url, int image_size) {
   return id;
 }
 
-void RenderViewHost::GetApplicationInfo(int32 page_id) {
-  Send(new ExtensionMsg_GetApplicationInfo(routing_id(), page_id));
-}
-
 void RenderViewHost::CaptureSnapshot() {
   Send(new ViewMsg_CaptureSnapshot(routing_id()));
 }
@@ -748,8 +743,6 @@ bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
                         OnMsgDocumentAvailableInMainFrame)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DocumentOnLoadCompletedInMainFrame,
                         OnMsgDocumentOnLoadCompletedInMainFrame)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_ExecuteCodeFinished,
-                        OnExecuteCodeFinished)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ContextMenu, OnMsgContextMenu)
     IPC_MESSAGE_HANDLER(ViewHostMsg_OpenURL, OnMsgOpenURL)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidContentsPreferredSizeChange,
@@ -769,7 +762,6 @@ bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(ViewHostMsg_TakeFocus, OnTakeFocus)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AddMessageToConsole, OnAddMessageToConsole)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShouldClose_ACK, OnMsgShouldCloseACK)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnExtensionRequest)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionChanged, OnMsgSelectionChanged)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AccessibilityNotifications,
                         OnAccessibilityNotifications)
@@ -1031,14 +1023,6 @@ void RenderViewHost::OnMsgDocumentOnLoadCompletedInMainFrame(int32 page_id) {
   delegate_->DocumentOnLoadCompletedInMainFrame(this, page_id);
 }
 
-void RenderViewHost::OnExecuteCodeFinished(int request_id, bool success) {
-  std::pair<int, bool> result_details(request_id, success);
-  NotificationService::current()->Notify(
-      NotificationType::TAB_CODE_EXECUTED,
-      NotificationService::AllSources(),
-      Details<std::pair<int, bool> >(&result_details));
-}
-
 void RenderViewHost::OnMsgContextMenu(const ContextMenuParams& params) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (!view)
@@ -1389,31 +1373,6 @@ void RenderViewHost::ForwardMessageFromExternalHost(const std::string& message,
                                                  target));
 }
 
-void RenderViewHost::OnExtensionRequest(
-    const ExtensionHostMsg_DomMessage_Params& params) {
-  if (!ChildProcessSecurityPolicy::GetInstance()->
-          HasExtensionBindings(process()->id())) {
-    // This can happen if someone uses window.open() to open an extension URL
-    // from a non-extension context.
-    BlockExtensionRequest(params.request_id);
-    return;
-  }
-
-  delegate_->ProcessWebUIMessage(params);
-}
-
-void RenderViewHost::SendExtensionResponse(int request_id, bool success,
-                                           const std::string& response,
-                                           const std::string& error) {
-  Send(new ExtensionMsg_Response(
-      routing_id(), request_id, success, response, error));
-}
-
-void RenderViewHost::BlockExtensionRequest(int request_id) {
-  SendExtensionResponse(request_id, false, "",
-                        "Access to extension API denied.");
-}
-
 void RenderViewHost::UpdateBrowserWindowId(int window_id) {
   Send(new ViewMsg_UpdateBrowserWindowId(routing_id(), window_id));
 }
diff --git a/content/browser/renderer_host/render_view_host.h b/content/browser/renderer_host/render_view_host.h
index ff675a0..0304ec9 100644
--- a/content/browser/renderer_host/render_view_host.h
+++ b/content/browser/renderer_host/render_view_host.h
@@ -38,13 +38,11 @@ class SkBitmap;
 class ViewMsg_Navigate;
 struct ContentSettings;
 struct ContextMenuParams;
-struct ExtensionHostMsg_DomMessage_Params;
 struct MediaPlayerAction;
 struct ViewHostMsg_AccessibilityNotification_Params;
 struct ViewHostMsg_CreateWindow_Params;
 struct ViewHostMsg_ShowPopup_Params;
 struct ViewMsg_Navigate_Params;
-struct WebApplicationInfo;
 struct WebDropData;
 struct WebPreferences;
 struct UserMetricsAction;
@@ -289,11 +287,6 @@ class RenderViewHost : public RenderWidgetHost {
   // browser.
   int DownloadFavicon(const GURL& url, int image_size);
 
-  // Requests application info for the specified page. This is an asynchronous
-  // request. The delegate is notified by way of OnDidGetApplicationInfo when
-  // the data is available.
-  void GetApplicationInfo(int32 page_id);
-
   // Captures a snapshot of the page.
   void CaptureSnapshot();
 
@@ -441,15 +434,6 @@ class RenderViewHost : public RenderWidgetHost {
   // Creates a full screen RenderWidget.
   void CreateNewFullscreenWidget(int route_id);
 
-  // Sends the response to an extension api call.
-  void SendExtensionResponse(int request_id, bool success,
-                             const std::string& response,
-                             const std::string& error);
-
-  // Sends a response to an extension api call that it was blocked for lack of
-  // permission.
-  void BlockExtensionRequest(int request_id);
-
   // Tells the renderer which browser window it is being attached to.
   void UpdateBrowserWindowId(int window_id);
 
@@ -550,7 +534,6 @@ class RenderViewHost : public RenderWidgetHost {
   void OnMsgDidChangeLoadProgress(double load_progress);
   void OnMsgDocumentAvailableInMainFrame();
   void OnMsgDocumentOnLoadCompletedInMainFrame(int32 page_id);
-  void OnExecuteCodeFinished(int request_id, bool success);
   void OnMsgUpdateFaviconURL(int32 page_id, const GURL& icon_url);
   void OnMsgDidDownloadFavicon(int id,
                                const GURL& image_url,
@@ -593,7 +576,6 @@ class RenderViewHost : public RenderWidgetHost {
                                 const std::string& value);
   void OnMsgShouldCloseACK(bool proceed);
 
-  void OnExtensionRequest(const ExtensionHostMsg_DomMessage_Params& params);
   void OnAccessibilityNotifications(
       const std::vector<ViewHostMsg_AccessibilityNotification_Params>& params);
   void OnCSSInserted();
diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index 7f152f5..d1866ab 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -416,10 +416,6 @@ bool TabContents::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(ViewHostMsg_PDFHasUnsupportedFeature,
                         OnPDFHasUnsupportedFeature)
     IPC_MESSAGE_HANDLER(ViewHostMsg_GoToEntryAtOffset, OnGoToEntryAtOffset)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_DidGetApplicationInfo,
-                        OnDidGetApplicationInfo)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_InstallApplication,
-                        OnInstallApplication)
     IPC_MESSAGE_HANDLER(ViewHostMsg_PageContents, OnPageContents)
     IPC_MESSAGE_HANDLER(ViewHostMsg_PageTranslated, OnPageTranslated)
     IPC_MESSAGE_UNHANDLED(handled = false)
@@ -846,22 +842,6 @@ void TabContents::AddNewContents(TabContents* new_contents,
   PopupNotificationVisibilityChanged(blocked_contents_ != NULL);
 }
 
-bool TabContents::ExecuteCode(int request_id, const std::string& extension_id,
-                              bool is_js_code, const std::string& code_string,
-                              bool all_frames) {
-  RenderViewHost* host = render_view_host();
-  if (!host)
-    return false;
-
-  ExtensionMsg_ExecuteCode_Params params;
-  params.request_id = request_id;
-  params.extension_id = extension_id;
-  params.is_javascript = is_js_code;
-  params.code = code_string;
-  params.all_frames = all_frames;
-  return host->Send(new ExtensionMsg_ExecuteCode(host->routing_id(), params));
-}
-
 void TabContents::PopupNotificationVisibilityChanged(bool visible) {
   if (is_being_destroyed_)
     return;
@@ -1794,19 +1774,6 @@ void TabContents::OnGoToEntryAtOffset(int offset) {
   }
 }
 
-void TabContents::OnDidGetApplicationInfo(int32 page_id,
-                                          const WebApplicationInfo& info) {
-  web_app_info_ = info;
-
-  if (delegate())
-    delegate()->OnDidGetApplicationInfo(this, page_id);
-}
-
-void TabContents::OnInstallApplication(const WebApplicationInfo& info) {
-  if (delegate())
-    delegate()->OnInstallApplication(this, info);
-}
-
 void TabContents::OnPageContents(const GURL& url,
                                  int32 page_id,
                                  const string16& contents,
@@ -2250,7 +2217,9 @@ void TabContents::ProcessWebUIMessage(
   if (!render_manager_.web_ui()) {
     // This can happen if someone uses window.open() to open an extension URL
     // from a non-extension context.
-    render_view_host()->BlockExtensionRequest(params.request_id);
+    render_view_host()->Send(new ExtensionMsg_Response(
+        render_view_host()->routing_id(), params.request_id, false, "",
+        "Access to extension API denied."));
     return;
   }
   render_manager_.web_ui()->ProcessWebUIMessage(params);
diff --git a/content/browser/tab_contents/tab_contents.h b/content/browser/tab_contents/tab_contents.h
index 9aeaf33..356d2b5 100644
--- a/content/browser/tab_contents/tab_contents.h
+++ b/content/browser/tab_contents/tab_contents.h
@@ -30,6 +30,7 @@
 #include "content/browser/tab_contents/navigation_entry.h"
 #include "content/browser/tab_contents/page_navigator.h"
 #include "content/browser/tab_contents/render_view_host_manager.h"
+#include "content/browser/tab_contents/tab_contents_observer.h"
 #include "content/browser/webui/web_ui.h"
 #include "content/common/notification_registrar.h"
 #include "content/common/property_bag.h"
@@ -217,13 +218,6 @@ class TabContents : public PageNavigator,
   // space is provided for the favicon, and the favicon is never displayed.
   virtual bool ShouldDisplayFavicon();
 
-  // Add and remove observers for page navigation notifications. Adding or
-  // removing multiple times has no effect. The order in which notifications
-  // are sent to observers is undefined. Clients must be sure to remove the
-  // observer before they go away.
-  void AddObserver(TabContentsObserver* observer);
-  void RemoveObserver(TabContentsObserver* observer);
-
   // Return whether this tab contents is loading a resource.
   bool is_loading() const { return is_loading_; }
 
@@ -243,10 +237,6 @@ class TabContents : public PageNavigator,
     encoding_.clear();
   }
 
-  const WebApplicationInfo& web_app_info() const {
-    return web_app_info_;
-  }
-
   const SkBitmap& app_icon() const { return app_icon_; }
 
   // Sets an app icon associated with TabContents and fires an INVALIDATE_TITLE
@@ -376,12 +366,6 @@ class TabContents : public PageNavigator,
                       const gfx::Rect& initial_pos,
                       bool user_gesture);
 
-  // Execute code in this tab. Returns true if the message was successfully
-  // sent.
-  bool ExecuteCode(int request_id, const std::string& extension_id,
-                   bool is_js_code, const std::string& code_string,
-                   bool all_frames);
-
   // Called when the blocked popup notification is shown or hidden.
   virtual void PopupNotificationVisibilityChanged(bool visible);
 
@@ -660,6 +644,16 @@ class TabContents : public PageNavigator,
   WebUI::TypeID GetWebUITypeForCurrentState();
 
  protected:
+  friend class TabContentsObserver;
+  friend class TabContentsObserver::Registrar;
+
+  // Add and remove observers for page navigation notifications. Adding or
+  // removing multiple times has no effect. The order in which notifications
+  // are sent to observers is undefined. Clients must be sure to remove the
+  // observer before they go away.
+  void AddObserver(TabContentsObserver* observer);
+  void RemoveObserver(TabContentsObserver* observer);
+
   // from RenderViewHostDelegate.
   virtual bool OnMessageReceived(const IPC::Message& message);
 
@@ -725,8 +719,6 @@ class TabContents : public PageNavigator,
   void OnPDFHasUnsupportedFeature();
 
   void OnGoToEntryAtOffset(int offset);
-  void OnDidGetApplicationInfo(int32 page_id, const WebApplicationInfo& info);
-  void OnInstallApplication(const WebApplicationInfo& info);
   void OnPageContents(const GURL& url,
                       int32 page_id,
                       const string16& contents,
@@ -992,9 +984,6 @@ class TabContents : public PageNavigator,
   // Handles downloading favicons.
   scoped_ptr<FaviconHelper> favicon_helper_;
 
-  // Cached web app info data.
-  WebApplicationInfo web_app_info_;
-
   // Cached web app icon.
   SkBitmap app_icon_;
 
diff --git a/content/browser/tab_contents/tab_contents_delegate.cc b/content/browser/tab_contents/tab_contents_delegate.cc
index 93b572b..5456009 100644
--- a/content/browser/tab_contents/tab_contents_delegate.cc
+++ b/content/browser/tab_contents/tab_contents_delegate.cc
@@ -189,16 +189,6 @@ bool TabContentsDelegate::ShouldAddNavigationToHistory(
   return true;
 }
 
-void TabContentsDelegate::OnDidGetApplicationInfo(TabContents* tab_contents,
-                                                  int32 page_id) {
-}
-
-// Notification when an application programmatically requests installation.
-void TabContentsDelegate::OnInstallApplication(
-    TabContents* tab_contents,
-    const WebApplicationInfo& app_info) {
-}
-
 gfx::NativeWindow TabContentsDelegate::GetFrameNativeWindow() {
   return NULL;
 }
diff --git a/content/browser/tab_contents/tab_contents_delegate.h b/content/browser/tab_contents/tab_contents_delegate.h
index a709a93..d47aac7 100644
--- a/content/browser/tab_contents/tab_contents_delegate.h
+++ b/content/browser/tab_contents/tab_contents_delegate.h
@@ -36,7 +36,6 @@ struct NativeWebKeyboardEvent;
 class Profile;
 class RenderViewHost;
 class TabContents;
-struct WebApplicationInfo;
 
 // Objects implement this interface to get notified about changes in the
 // TabContents and to provide necessary functionality.
@@ -284,14 +283,6 @@ class TabContentsDelegate : public AutomationResourceRoutingDelegate {
       const history::HistoryAddPageArgs& add_page_args,
       NavigationType::Type navigation_type);
 
-  // Notification that a user's request to install an application has completed.
-  virtual void OnDidGetApplicationInfo(TabContents* tab_contents,
-                                       int32 page_id);
-
-  // Notification when an application programmatically requests installation.
-  virtual void OnInstallApplication(TabContents* tab_contents,
-                                    const WebApplicationInfo& app_info);
-
   // Returns the native window framing the view containing the tab contents.
   virtual gfx::NativeWindow GetFrameNativeWindow();
 
diff --git a/content/browser/tab_contents/tab_contents_observer.cc b/content/browser/tab_contents/tab_contents_observer.cc
index 1a5c3c3..d2eae1c 100644
--- a/content/browser/tab_contents/tab_contents_observer.cc
+++ b/content/browser/tab_contents/tab_contents_observer.cc
@@ -7,6 +7,24 @@
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/tab_contents/tab_contents.h"
 
+TabContentsObserver::Registrar::Registrar(TabContentsObserver* observer)
+    : observer_(observer), tab_(NULL) {
+}
+
+TabContentsObserver::Registrar::~Registrar() {
+  if (tab_)
+    tab_->RemoveObserver(observer_);
+}
+
+void TabContentsObserver::Registrar::Observe(TabContents* tab) {
+  observer_->SetTabContents(tab);
+  if (tab_)
+    tab_->RemoveObserver(observer_);
+  tab_ = tab;
+  if (tab_)
+    tab_->AddObserver(observer_);
+}
+
 void TabContentsObserver::NavigateToPendingEntry() {
 }
 
@@ -35,12 +53,15 @@ void TabContentsObserver::RenderViewGone() {
 void TabContentsObserver::StopNavigation() {
 }
 
-TabContentsObserver::TabContentsObserver(TabContents* tab_contents)
-    : tab_contents_(tab_contents),
-      routing_id_(tab_contents->render_view_host()->routing_id()) {
+TabContentsObserver::TabContentsObserver(TabContents* tab_contents) {
+  SetTabContents(tab_contents);
   tab_contents_->AddObserver(this);
 }
 
+TabContentsObserver::TabContentsObserver()
+    : tab_contents_(NULL), routing_id_(MSG_ROUTING_NONE) {
+}
+
 TabContentsObserver::~TabContentsObserver() {
   if (tab_contents_)
     tab_contents_->RemoveObserver(this);
@@ -62,6 +83,12 @@ bool TabContentsObserver::Send(IPC::Message* message) {
   return tab_contents_->render_view_host()->Send(message);
 }
 
+void TabContentsObserver::SetTabContents(TabContents* tab_contents) {
+  tab_contents_ = tab_contents;
+  if (tab_contents_)
+    routing_id_ = tab_contents->render_view_host()->routing_id();
+}
+
 void TabContentsObserver::TabContentsDestroyed() {
   // Do cleanup so that 'this' can safely be deleted from
   // OnTabContentsDestroyed.
diff --git a/content/browser/tab_contents/tab_contents_observer.h b/content/browser/tab_contents/tab_contents_observer.h
index 899fcf7..69d371a 100644
--- a/content/browser/tab_contents/tab_contents_observer.h
+++ b/content/browser/tab_contents/tab_contents_observer.h
@@ -12,8 +12,29 @@ struct ViewHostMsg_FrameNavigate_Params;
 
 // An observer API implemented by classes which are interested in various page
 // load events from TabContents.  They also get a chance to filter IPC messages.
-class TabContentsObserver : public IPC::Channel::Listener {
+class TabContentsObserver : public IPC::Channel::Listener,
+                            public IPC::Message::Sender {
  public:
+  // Use this as a member variable in a class that uses the emptry constructor
+  // version of this interface.
+  class Registrar {
+   public:
+    explicit Registrar(TabContentsObserver* observer);
+    ~Registrar();
+
+    // Call this to start observing a tab.  Passing in NULL resets it.
+    // This can only be used to watch one tab at a time.  If you call this and
+    // you're already observing another tab, the old tab won't be observed
+    // afterwards.
+    void Observe(TabContents* tab);
+
+   private:
+    TabContentsObserver* observer_;
+    TabContents* tab_;
+
+    DISALLOW_COPY_AND_ASSIGN(Registrar);
+  };
+
   virtual void NavigateToPendingEntry();
 
   virtual void DidNavigateMainFramePostCommit(
@@ -45,7 +66,15 @@ class TabContentsObserver : public IPC::Channel::Listener {
 #endif
 
  protected:
+  // Use this constructor when the object is tied to a single TabContents for
+  // its entire lifetime.
   explicit TabContentsObserver(TabContents* tab_contents);
+
+  // Use this constructor when the object wants to observe a TabContents for
+  // part of its lifetime.  It can use a TabContentsRegistrar member variable
+  // to start and stop observing.
+  TabContentsObserver();
+
   virtual ~TabContentsObserver();
 
   // Invoked when the TabContents is being destroyed. Gives subclasses a chance
@@ -62,6 +91,11 @@ class TabContentsObserver : public IPC::Channel::Listener {
   TabContents* tab_contents() const { return tab_contents_; }
   int routing_id() const { return routing_id_; }
 
+ protected:
+  friend class Registrar;
+
+  void SetTabContents(TabContents* tab_contents);
+
  private:
   friend class TabContents;
 
diff --git a/content/common/notification_type.h b/content/common/notification_type.h
index 74f2b38..e834e1d 100644
--- a/content/common/notification_type.h
+++ b/content/common/notification_type.h
@@ -285,9 +285,6 @@ class NotificationType {
     // actual snapshot.
     TAB_SNAPSHOT_TAKEN,
 
-    // Send after the code is run in specified tab.
-    TAB_CODE_EXECUTED,
-
     // The user has changed the browser theme.
     BROWSER_THEME_CHANGED,