Revert of Remove a bunch of NPAPI quirks and related support code (patchset #1 id:80001 of https://codereview.chromium.org/1813143002/ )

Reason for revert:
Speculative revert: could have broken Win8 GN build. See crbug.com/597032

Original issue's description:
> Remove a bunch of NPAPI quirks and related support code
>
> BUG=493212
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation
>
> Committed: https://crrev.com/f8396023a9e38d3ec249cdf1f730e4b79cebbc7e
> Cr-Commit-Position: refs/heads/master@{#382642}

TBR=dcheng@chromium.org,jam@chromium.org,piman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=493212

Review URL: https://codereview.chromium.org/1825253002

Cr-Commit-Position: refs/heads/master@{#382684}

36 files changed, 1791 insertions, 8 deletions

diff --git a/content/browser/frame_host/render_widget_host_view_child_frame.cc b/content/browser/frame_host/render_widget_host_view_child_frame.cc
index 602be87..027f5e4 100644
--- a/content/browser/frame_host/render_widget_host_view_child_frame.cc
+++ b/content/browser/frame_host/render_widget_host_view_child_frame.cc
@@ -538,6 +538,11 @@ bool RenderWidgetHostViewChildFrame::HasAcceleratedSurface(
 void RenderWidgetHostViewChildFrame::SetParentNativeViewAccessible(
     gfx::NativeViewAccessible accessible_parent) {
 }
+
+gfx::NativeViewId RenderWidgetHostViewChildFrame::GetParentForWindowlessPlugin()
+    const {
+  return NULL;
+}
 #endif  // defined(OS_WIN)
 
 // cc::SurfaceFactoryClient implementation.
diff --git a/content/browser/frame_host/render_widget_host_view_child_frame.h b/content/browser/frame_host/render_widget_host_view_child_frame.h
index 507fce5..4336e10 100644
--- a/content/browser/frame_host/render_widget_host_view_child_frame.h
+++ b/content/browser/frame_host/render_widget_host_view_child_frame.h
@@ -167,6 +167,7 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
 #if defined(OS_WIN)
   void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) override;
+  gfx::NativeViewId GetParentForWindowlessPlugin() const override;
 #endif
   BrowserAccessibilityManager* CreateBrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate, bool for_root_frame) override;
diff --git a/content/browser/frame_host/render_widget_host_view_guest.cc b/content/browser/frame_host/render_widget_host_view_guest.cc
index e9516eb..10c8313 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.cc
+++ b/content/browser/frame_host/render_widget_host_view_guest.cc
@@ -515,6 +515,11 @@ void RenderWidgetHostViewGuest::UnlockCompositingSurface() {
 void RenderWidgetHostViewGuest::SetParentNativeViewAccessible(
     gfx::NativeViewAccessible accessible_parent) {
 }
+
+gfx::NativeViewId RenderWidgetHostViewGuest::GetParentForWindowlessPlugin()
+    const {
+  return NULL;
+}
 #endif
 
 void RenderWidgetHostViewGuest::DestroyGuestView() {
diff --git a/content/browser/frame_host/render_widget_host_view_guest.h b/content/browser/frame_host/render_widget_host_view_guest.h
index 52f1f8b..c46b6ef 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.h
+++ b/content/browser/frame_host/render_widget_host_view_guest.h
@@ -137,6 +137,7 @@ class CONTENT_EXPORT RenderWidgetHostViewGuest
 #if defined(OS_WIN)
   void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) override;
+  gfx::NativeViewId GetParentForWindowlessPlugin() const override;
 #endif
 
   void WheelEventAck(const blink::WebMouseWheelEvent& event,
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 0f80e94..59cf26f 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -469,6 +469,12 @@ bool RenderWidgetHostImpl::OnMessageReceived(const IPC::Message &msg) {
     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionChanged, OnSelectionChanged)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionBoundsChanged,
                         OnSelectionBoundsChanged)
+#if defined(OS_WIN)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_WindowlessPluginDummyWindowCreated,
+                        OnWindowlessPluginDummyWindowCreated)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_WindowlessPluginDummyWindowDestroyed,
+                        OnWindowlessPluginDummyWindowDestroyed)
+#endif
     IPC_MESSAGE_HANDLER(InputHostMsg_ImeCompositionRangeChanged,
                         OnImeCompositionRangeChanged)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidFirstPaintAfterLoad,
@@ -1812,6 +1818,43 @@ void RenderWidgetHostImpl::OnShowDisambiguationPopup(
   Send(new ViewMsg_ReleaseDisambiguationPopupBitmap(GetRoutingID(), id));
 }
 
+#if defined(OS_WIN)
+void RenderWidgetHostImpl::OnWindowlessPluginDummyWindowCreated(
+    gfx::NativeViewId dummy_activation_window) {
+  HWND hwnd = reinterpret_cast<HWND>(dummy_activation_window);
+
+  // This may happen as a result of a race condition when the plugin is going
+  // away.
+  wchar_t window_title[MAX_PATH + 1] = {0};
+  if (!IsWindow(hwnd) ||
+      !GetWindowText(hwnd, window_title, arraysize(window_title)) ||
+      lstrcmpiW(window_title, kDummyActivationWindowName) != 0) {
+    return;
+  }
+
+#if defined(USE_AURA)
+  SetParent(hwnd,
+            reinterpret_cast<HWND>(view_->GetParentForWindowlessPlugin()));
+#else
+  SetParent(hwnd, reinterpret_cast<HWND>(GetNativeViewId()));
+#endif
+  dummy_windows_for_activation_.push_back(hwnd);
+}
+
+void RenderWidgetHostImpl::OnWindowlessPluginDummyWindowDestroyed(
+    gfx::NativeViewId dummy_activation_window) {
+  HWND hwnd = reinterpret_cast<HWND>(dummy_activation_window);
+  std::list<HWND>::iterator i = dummy_windows_for_activation_.begin();
+  for (; i != dummy_windows_for_activation_.end(); ++i) {
+    if ((*i) == hwnd) {
+      dummy_windows_for_activation_.erase(i);
+      return;
+    }
+  }
+  NOTREACHED() << "Unknown dummy window";
+}
+#endif
+
 void RenderWidgetHostImpl::SetIgnoreInputEvents(bool ignore_input_events) {
   ignore_input_events_ = ignore_input_events;
 }
diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
index f9600fc..6094b9b 100644
--- a/content/browser/renderer_host/render_widget_host_impl.h
+++ b/content/browser/renderer_host/render_widget_host_impl.h
@@ -589,6 +589,12 @@ class CONTENT_EXPORT RenderWidgetHostImpl : public RenderWidgetHost,
   void OnShowDisambiguationPopup(const gfx::Rect& rect_pixels,
                                  const gfx::Size& size,
                                  const cc::SharedBitmapId& id);
+#if defined(OS_WIN)
+  void OnWindowlessPluginDummyWindowCreated(
+      gfx::NativeViewId dummy_activation_window);
+  void OnWindowlessPluginDummyWindowDestroyed(
+      gfx::NativeViewId dummy_activation_window);
+#endif
   void OnSelectionChanged(const base::string16& text,
                           uint32_t offset,
                           const gfx::Range& range);
@@ -798,6 +804,10 @@ class CONTENT_EXPORT RenderWidgetHostImpl : public RenderWidgetHost,
   // being sent, in which case the timer should fire).
   bool received_paint_after_load_;
 
+#if defined(OS_WIN)
+  std::list<HWND> dummy_windows_for_activation_;
+#endif
+
   RenderWidgetHostLatencyTracker latency_tracker_;
 
   int next_browser_snapshot_id_;
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index add56ff..b5f413f 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -1075,6 +1075,15 @@ void RenderWidgetHostViewAura::DidStopFlinging() {
 void RenderWidgetHostViewAura::SetParentNativeViewAccessible(
     gfx::NativeViewAccessible accessible_parent) {
 }
+
+gfx::NativeViewId RenderWidgetHostViewAura::GetParentForWindowlessPlugin()
+    const {
+  if (legacy_render_widget_host_HWND_) {
+    return reinterpret_cast<gfx::NativeViewId>(
+        legacy_render_widget_host_HWND_->hwnd());
+  }
+  return NULL;
+}
 #endif
 
 bool RenderWidgetHostViewAura::HasAcceleratedSurface(
@@ -2577,8 +2586,10 @@ void RenderWidgetHostViewAura::InternalSetBounds(const gfx::Rect& rect) {
   delegated_frame_host_->WasResized();
 #if defined(OS_WIN)
   // Create the legacy dummy window which corresponds to the bounds of the
-  // webcontents. It is needed for accessibility and for scrolling to work in
-  // legacy drivers for trackpoints/trackpads, etc.
+  // webcontents. This will be passed as the container window for windowless
+  // plugins.
+  // Additonally the legacy dummy window is needed for accessibility and for
+  // scrolling to work in legacy drivers for trackpoints/trackpads, etc.
   if (!legacy_window_destroyed_ && GetNativeViewId()) {
     if (!legacy_render_widget_host_HWND_) {
       legacy_render_widget_host_HWND_ = LegacyRenderWidgetHostHWND::Create(
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
index 245105f..932fd37 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/content/browser/renderer_host/render_widget_host_view_aura.h
@@ -210,6 +210,7 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
 #if defined(OS_WIN)
   void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) override;
+  gfx::NativeViewId GetParentForWindowlessPlugin() const override;
 #endif
 
   // Overridden from ui::TextInputClient:
diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
index ff99d5f..0422f82 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/content/browser/renderer_host/render_widget_host_view_base.h
@@ -381,6 +381,10 @@ class CONTENT_EXPORT RenderWidgetHostViewBase : public RenderWidgetHostView,
 #if defined(OS_WIN)
   virtual void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) = 0;
+
+  // Returns an HWND that's given as the parent window for windowless Flash to
+  // workaround crbug.com/301548.
+  virtual gfx::NativeViewId GetParentForWindowlessPlugin() const = 0;
 #endif
 
   // Add and remove observers for lifetime event notifications. The order in
diff --git a/content/browser/renderer_host/render_widget_host_view_mus.cc b/content/browser/renderer_host/render_widget_host_view_mus.cc
index 8b945da9..9d2d21f 100644
--- a/content/browser/renderer_host/render_widget_host_view_mus.cc
+++ b/content/browser/renderer_host/render_widget_host_view_mus.cc
@@ -319,6 +319,11 @@ void RenderWidgetHostViewMus::UnlockCompositingSurface() {
 #if defined(OS_WIN)
 void RenderWidgetHostViewMus::SetParentNativeViewAccessible(
     gfx::NativeViewAccessible accessible_parent) {}
+
+gfx::NativeViewId RenderWidgetHostViewMus::GetParentForWindowlessPlugin()
+    const {
+  return gfx::NativeViewId();
+}
 #endif
 
 }  // namespace content
diff --git a/content/browser/renderer_host/render_widget_host_view_mus.h b/content/browser/renderer_host/render_widget_host_view_mus.h
index d63ae6e..69b1686 100644
--- a/content/browser/renderer_host/render_widget_host_view_mus.h
+++ b/content/browser/renderer_host/render_widget_host_view_mus.h
@@ -124,6 +124,7 @@ class CONTENT_EXPORT RenderWidgetHostViewMus : public RenderWidgetHostViewBase {
 #if defined(OS_WIN)
   void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) override;
+  gfx::NativeViewId GetParentForWindowlessPlugin() const override;
 #endif
 
   RenderWidgetHostImpl* host_;
diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
index ee79f18..d6993ef 100644
--- a/content/child/BUILD.gn
+++ b/content/child/BUILD.gn
@@ -93,7 +93,11 @@ source_set("child") {
         "npapi/webplugin_delegate_impl_mac.mm",
       ]
     } else if (is_win) {
-      sources -= [ "npapi/webplugin_delegate_impl_win.cc" ]
+      sources -= [
+        "npapi/webplugin_delegate_impl_win.cc",
+        "npapi/webplugin_ime_win.cc",
+        "npapi/webplugin_ime_win.h",
+      ]
     } else if (is_android) {
       sources -= [ "npapi/webplugin_delegate_impl_android.cc" ]
     }
diff --git a/content/child/npapi/plugin_host.cc b/content/child/npapi/plugin_host.cc
index f560061..f5a04ef 100644
--- a/content/child/npapi/plugin_host.cc
+++ b/content/child/npapi/plugin_host.cc
@@ -502,6 +502,8 @@ NPError NPN_GetValue(NPP id, NPNVariable variable, void* value) {
   // Variables:
   //    NPNVxDisplay (unix only)
   //    NPNVxtAppContext (unix only)
+  //    NPNVnetscapeWindow (win only) - Gets the native window on which the
+  //              plugin drawing occurs, returns HWND
   //    NPNVjavascriptEnabledBool:  tells whether Javascript is enabled
   //    NPNVasdEnabledBool:  tells whether SmartUpdate is enabled
   //    NPNVOfflineBool: tells whether offline-mode is enabled
@@ -549,6 +551,19 @@ NPError NPN_GetValue(NPP id, NPNVariable variable, void* value) {
       }
       break;
     }
+  #if !defined(OS_MACOSX)  // OS X doesn't have windowed plugins.
+    case NPNVnetscapeWindow: {
+      scoped_refptr<PluginInstance> plugin = FindInstance(id);
+      if (!plugin.get()) {
+        NOTREACHED();
+        return NPERR_INVALID_INSTANCE_ERROR;
+      }
+      gfx::PluginWindowHandle handle = plugin->window_handle();
+      *((void**)value) = (void*)handle;
+      rv = NPERR_NO_ERROR;
+      break;
+    }
+  #endif
     case NPNVjavascriptEnabledBool: {
       // yes, JS is enabled.
       *((void**)value) = (void*)1;
diff --git a/content/child/npapi/plugin_instance.cc b/content/child/npapi/plugin_instance.cc
index 3e9808e..3889bd7 100644
--- a/content/child/npapi/plugin_instance.cc
+++ b/content/child/npapi/plugin_instance.cc
@@ -35,6 +35,7 @@ PluginInstance::PluginInstance(PluginLib* plugin, const std::string& mime_type)
       npp_(0),
       host_(PluginHost::Singleton()),
       npp_functions_(plugin->functions()),
+      window_handle_(0),
       transparent_(true),
       webplugin_(0),
       mime_type_(mime_type),
diff --git a/content/child/npapi/plugin_instance.h b/content/child/npapi/plugin_instance.h
index 8eeaa3e..75a1e99 100644
--- a/content/child/npapi/plugin_instance.h
+++ b/content/child/npapi/plugin_instance.h
@@ -76,6 +76,12 @@ class PluginInstance : public base::RefCountedThreadSafe<PluginInstance> {
   // NPAPI's instance identifier for this instance
   NPP npp() { return npp_; }
 
+  // Get/Set for the instance's window handle.
+  gfx::PluginWindowHandle window_handle() const { return window_handle_; }
+  void set_window_handle(gfx::PluginWindowHandle value) {
+    window_handle_ = value;
+  }
+
   // Get/Set whether this instance is transparent. This only applies to
   // windowless plugins.  Transparent plugins require that webkit paint the
   // background.
@@ -221,6 +227,7 @@ class PluginInstance : public base::RefCountedThreadSafe<PluginInstance> {
   NPP                                      npp_;
   scoped_refptr<PluginHost>                host_;
   NPPluginFuncs*                           npp_functions_;
+  gfx::PluginWindowHandle                  window_handle_;
   bool                                     transparent_;
   WebPlugin*                               webplugin_;
   std::string                              mime_type_;
diff --git a/content/child/npapi/webplugin.h b/content/child/npapi/webplugin.h
index 48da4ab..9e7f1ed 100644
--- a/content/child/npapi/webplugin.h
+++ b/content/child/npapi/webplugin.h
@@ -66,6 +66,15 @@ class WebPlugin {
   // Returns true iff in incognito mode.
   virtual bool IsOffTheRecord() = 0;
 
+#if defined(OS_WIN)
+  // |pump_messages_event| is a event handle which is used in NPP_HandleEvent
+  // calls to pump messages if the plugin enters a modal loop.
+  // |dummy_activation_window} is used to ensure correct keyboard activation.
+  // It needs to be a child of the parent window.
+  virtual void SetWindowlessData(HANDLE pump_messages_event,
+                                 gfx::NativeViewId dummy_activation_window) = 0;
+#endif
+
 #if defined(OS_MACOSX)
   // Called to inform the WebPlugin that the plugin has gained or lost focus.
   virtual void FocusChanged(bool focused) {}
diff --git a/content/child/npapi/webplugin_delegate_impl.h b/content/child/npapi/webplugin_delegate_impl.h
index 3ed44c4..f07256b 100644
--- a/content/child/npapi/webplugin_delegate_impl.h
+++ b/content/child/npapi/webplugin_delegate_impl.h
@@ -46,6 +46,10 @@ class WebPluginAcceleratedSurface;
 class ExternalDragTracker;
 #endif  // OS_MACOSX
 
+#if defined(OS_WIN)
+class WebPluginIMEWin;
+#endif  // OS_WIN
+
 // An implementation of WebPluginDelegate that runs in the plugin process,
 // proxied from the renderer by WebPluginDelegateProxy.
 class WebPluginDelegateImpl : public WebPluginDelegate {
@@ -107,6 +111,21 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
   // Informs the plugin that the view it is in has gained or lost focus.
   void SetContentAreaHasFocus(bool has_focus);
 
+#if defined(OS_WIN)
+  // Informs the plugin that an IME has changed its status.
+  void ImeCompositionUpdated(const base::string16& text,
+                             const std::vector<int>& clauses,
+                             const std::vector<int>& target,
+                             int cursor_position);
+
+  // Informs the plugin that IME composition has completed./ If |text| is empty,
+  // IME was cancelled.
+  void ImeCompositionCompleted(const base::string16& text);
+
+  // Returns the IME status retrieved from a plugin.
+  bool GetIMEStatus(int* input_type, gfx::Rect* caret_rect);
+#endif
+
 #if defined(OS_MACOSX) && !defined(USE_AURA)
   // Informs the plugin that the geometry has changed, as with UpdateGeometry,
   // but also includes the new buffer context for that new geometry.
@@ -156,6 +175,20 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
   // Called by DestroyInstance(), used for platform-specific destruction.
   void PlatformDestroyInstance();
 
+#if defined(OS_WIN)
+  // Our WndProc functions.
+  static LRESULT CALLBACK FlashWindowlessWndProc(
+      HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam);
+  static LRESULT CALLBACK DummyWindowProc(
+      HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
+
+  // Used for throttling Flash messages.
+  static void ClearThrottleQueueForWindow(HWND window);
+  static void OnThrottleMessage();
+  static void ThrottleMessage(WNDPROC proc, HWND hwnd, UINT message,
+      WPARAM wParam, LPARAM lParam);
+#endif
+
   //----------------------------
   // used for windowless plugins
   void WindowlessUpdateGeometry(const gfx::Rect& window_rect,
@@ -194,12 +227,67 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
   WebPlugin* plugin_;
   scoped_refptr<PluginInstance> instance_;
 
+#if defined(OS_WIN)
+  // An IME emulator used by a windowless plugin to retrieve IME data through
+  // IMM32 functions.
+  scoped_ptr<WebPluginIMEWin> plugin_ime_;
+#endif  // defined(OS_WIN)
+
   NPWindow window_;
   gfx::Rect window_rect_;
   gfx::Rect clip_rect_;
   int quirks_;
 
-#if defined(OS_MACOSX) && !defined(USE_AURA)
+#if defined(OS_WIN)
+  // Windowless plugins don't have keyboard focus causing issues with the
+  // plugin not receiving keyboard events if the plugin enters a modal
+  // loop like TrackPopupMenuEx or MessageBox, etc.
+  // This is a basic issue with windows activation and focus arising due to
+  // the fact that these windows are created by different threads. Activation
+  // and focus are thread specific states, and if the browser has focus,
+  // the plugin may not have focus.
+  // To fix a majority of these activation issues we create a dummy visible
+  // child window to which we set focus whenever the windowless plugin
+  // receives a WM_LBUTTONDOWN/WM_RBUTTONDOWN message via NPP_HandleEvent.
+
+  HWND dummy_window_for_activation_;
+  HWND dummy_window_parent_;
+  WNDPROC old_dummy_window_proc_;
+  bool CreateDummyWindowForActivation();
+
+  // Returns true if the event passed in needs to be tracked for a potential
+  // modal loop.
+  static bool ShouldTrackEventForModalLoops(NPEvent* event);
+
+  // The message filter hook procedure, which tracks modal loops entered by
+  // a plugin in the course of a NPP_HandleEvent call.
+  static LRESULT CALLBACK HandleEventMessageFilterHook(int code, WPARAM wParam,
+                                                       LPARAM lParam);
+
+  // TrackPopupMenu interceptor. Parameters are the same as the Win32 function
+  // TrackPopupMenu.
+  static BOOL WINAPI TrackPopupMenuPatch(HMENU menu, unsigned int flags, int x,
+                                         int y, int reserved, HWND window,
+                                         const RECT* rect);
+
+  // SetCursor interceptor for windowless plugins.
+  static HCURSOR WINAPI SetCursorPatch(HCURSOR cursor);
+
+  // RegEnumKeyExW interceptor.
+  static LONG WINAPI RegEnumKeyExWPatch(
+      HKEY key, DWORD index, LPWSTR name, LPDWORD name_size, LPDWORD reserved,
+      LPWSTR class_name, LPDWORD class_size, PFILETIME last_write_time);
+
+  // GetProcAddress intercepter for windowless plugins.
+  static FARPROC WINAPI GetProcAddressPatch(HMODULE module, LPCSTR name);
+
+  // WindowFromPoint patch for Flash windowless plugins. When flash receives
+  // mouse move messages it calls the WindowFromPoint API to eventually convert
+  // the mouse coordinates to screen. We need to return the dummy plugin parent
+  // window for Aura to ensure that these conversions occur correctly.
+  static HWND WINAPI WindowFromPointPatch(POINT point);
+
+#elif defined(OS_MACOSX) && !defined(USE_AURA)
   // Sets window_rect_ to |rect|
   void SetPluginRect(const gfx::Rect& rect);
   // Sets content_area_origin to |origin|
@@ -252,6 +340,15 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
   // The url with which the plugin was instantiated.
   std::string plugin_url_;
 
+#if defined(OS_WIN)
+  // Handle to the message filter hook
+  HHOOK handle_event_message_filter_hook_;
+
+  // Event which is set when the plugin enters a modal loop in the course
+  // of a NPP_HandleEvent call.
+  HANDLE handle_event_pump_messages_event_;
+#endif
+
   // Holds the depth of the HandleEvent callstack.
   int handle_event_depth_;
 
diff --git a/content/child/npapi/webplugin_delegate_impl_win.cc b/content/child/npapi/webplugin_delegate_impl_win.cc
index 7065705..f0213e3 100644
--- a/content/child/npapi/webplugin_delegate_impl_win.cc
+++ b/content/child/npapi/webplugin_delegate_impl_win.cc
@@ -22,10 +22,13 @@
 #include "base/strings/stringprintf.h"
 #include "base/synchronization/lock.h"
 #include "base/version.h"
+#include "base/win/iat_patch_function.h"
+#include "base/win/registry.h"
 #include "base/win/windows_version.h"
 #include "content/child/npapi/plugin_instance.h"
 #include "content/child/npapi/plugin_lib.h"
 #include "content/child/npapi/webplugin.h"
+#include "content/child/npapi/webplugin_ime_win.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/common/plugin_constants_win.h"
 #include "content/public/common/content_constants.h"
@@ -42,6 +45,47 @@ namespace content {
 
 namespace {
 
+const wchar_t kWebPluginDelegateProperty[] = L"WebPluginDelegateProperty";
+
+// The fastest we are willing to process WM_USER+1 events for Flash.
+// Flash can easily exceed the limits of our CPU if we don't throttle it.
+// The throttle has been chosen by testing various delays and compromising
+// on acceptable Flash performance and reasonable CPU consumption.
+//
+// I'd like to make the throttle delay variable, based on the amount of
+// time currently required to paint Flash plugins.  There isn't a good
+// way to count the time spent in aggregate plugin painting, however, so
+// this seems to work well enough.
+const int kFlashWMUSERMessageThrottleDelayMs = 5;
+
+// The current instance of the plugin which entered the modal loop.
+WebPluginDelegateImpl* g_current_plugin_instance = NULL;
+
+typedef std::deque<MSG> ThrottleQueue;
+base::LazyInstance<ThrottleQueue> g_throttle_queue = LAZY_INSTANCE_INITIALIZER;
+
+base::LazyInstance<std::map<HWND, WNDPROC> > g_window_handle_proc_map =
+    LAZY_INSTANCE_INITIALIZER;
+
+// Helper object for patching the TrackPopupMenu API.
+base::LazyInstance<base::win::IATPatchFunction> g_iat_patch_track_popup_menu =
+    LAZY_INSTANCE_INITIALIZER;
+
+// Helper object for patching the SetCursor API.
+base::LazyInstance<base::win::IATPatchFunction> g_iat_patch_set_cursor =
+    LAZY_INSTANCE_INITIALIZER;
+
+// Helper object for patching the RegEnumKeyExW API.
+base::LazyInstance<base::win::IATPatchFunction> g_iat_patch_reg_enum_key_ex_w =
+    LAZY_INSTANCE_INITIALIZER;
+
+// Helper object for patching the GetProcAddress API.
+base::LazyInstance<base::win::IATPatchFunction> g_iat_patch_get_proc_address =
+    LAZY_INSTANCE_INITIALIZER;
+
+base::LazyInstance<base::win::IATPatchFunction> g_iat_patch_window_from_point =
+    LAZY_INSTANCE_INITIALIZER;
+
 // http://crbug.com/16114
 // Enforces providing a valid device context in NPWindow, so that NPP_SetWindow
 // is never called with NPNWindoTypeDrawable and NPWindow set to NULL.
@@ -74,13 +118,104 @@ class DrawableContextEnforcer {
   bool disposable_dc_;
 };
 
+// These are from ntddk.h
+typedef LONG NTSTATUS;
+
+#ifndef STATUS_SUCCESS
+#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
+#endif
+
+#ifndef STATUS_BUFFER_TOO_SMALL
+#define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L)
+#endif
+
+typedef enum _KEY_INFORMATION_CLASS {
+  KeyBasicInformation,
+  KeyNodeInformation,
+  KeyFullInformation,
+  KeyNameInformation,
+  KeyCachedInformation,
+  KeyVirtualizationInformation
+} KEY_INFORMATION_CLASS;
+
+typedef struct _KEY_NAME_INFORMATION {
+  ULONG NameLength;
+  WCHAR Name[1];
+} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
+
+typedef DWORD (__stdcall *ZwQueryKeyType)(
+    HANDLE  key_handle,
+    int key_information_class,
+    PVOID  key_information,
+    ULONG  length,
+    PULONG  result_length);
+
+// Returns a key's full path.
+std::wstring GetKeyPath(HKEY key) {
+  if (key == NULL)
+    return L"";
+
+  HMODULE dll = GetModuleHandle(L"ntdll.dll");
+  if (dll == NULL)
+    return L"";
+
+  ZwQueryKeyType func = reinterpret_cast<ZwQueryKeyType>(
+      ::GetProcAddress(dll, "ZwQueryKey"));
+  if (func == NULL)
+    return L"";
+
+  DWORD size = 0;
+  DWORD result = 0;
+  result = func(key, KeyNameInformation, 0, 0, &size);
+  if (result != static_cast<DWORD>(STATUS_BUFFER_TOO_SMALL))
+    return L"";
+
+  scoped_ptr<char[]> buffer(new char[size]);
+  if (buffer.get() == NULL)
+    return L"";
+
+  result = func(key, KeyNameInformation, buffer.get(), size, &size);
+  if (result != static_cast<DWORD>(STATUS_SUCCESS))
+    return L"";
+
+  KEY_NAME_INFORMATION* info =
+      reinterpret_cast<KEY_NAME_INFORMATION*>(buffer.get());
+  return std::wstring(info->Name, info->NameLength / sizeof(wchar_t));
+}
+
+uint32_t GetPluginMajorVersion(const WebPluginInfo& plugin_info) {
+  Version plugin_version;
+  WebPluginInfo::CreateVersionFromString(plugin_info.version, &plugin_version);
+
+  uint32_t major_version = 0;
+  if (plugin_version.IsValid())
+    major_version = plugin_version.components()[0];
+
+  return major_version;
+}
+
 }  // namespace
 
+LRESULT CALLBACK WebPluginDelegateImpl::HandleEventMessageFilterHook(
+    int code, WPARAM wParam, LPARAM lParam) {
+  if (g_current_plugin_instance) {
+    g_current_plugin_instance->OnModalLoopEntered();
+  } else {
+    NOTREACHED();
+  }
+  return CallNextHookEx(NULL, code, wParam, lParam);
+}
+
 WebPluginDelegateImpl::WebPluginDelegateImpl(WebPlugin* plugin,
                                              PluginInstance* instance)
     : plugin_(plugin),
       instance_(instance),
       quirks_(0),
+      dummy_window_for_activation_(NULL),
+      dummy_window_parent_(NULL),
+      old_dummy_window_proc_(NULL),
+      handle_event_message_filter_hook_(NULL),
+      handle_event_pump_messages_event_(NULL),
       handle_event_depth_(0),
       first_set_window_call_(true),
       plugin_has_focus_(false),
@@ -89,17 +224,182 @@ WebPluginDelegateImpl::WebPluginDelegateImpl(WebPlugin* plugin,
       creation_succeeded_(false),
       user_gesture_msg_factory_(this) {
   memset(&window_, 0, sizeof(window_));
+
+  const WebPluginInfo& plugin_info = instance_->plugin_lib()->plugin_info();
+  base::string16 filename =
+      base::ToLowerASCII(plugin_info.path.BaseName().value());
+
+  if (instance_->mime_type() == kFlashPluginSwfMimeType ||
+      filename == kFlashPlugin) {
+    // Flash only requests windowless plugins if we return a Mozilla user
+    // agent.
+    instance_->set_use_mozilla_user_agent();
+    quirks_ |= PLUGIN_QUIRK_THROTTLE_WM_USER_PLUS_ONE;
+    quirks_ |= PLUGIN_QUIRK_PATCH_SETCURSOR;
+    quirks_ |= PLUGIN_QUIRK_ALWAYS_NOTIFY_SUCCESS;
+    quirks_ |= PLUGIN_QUIRK_HANDLE_MOUSE_CAPTURE;
+    quirks_ |= PLUGIN_QUIRK_EMULATE_IME;
+    quirks_ |= PLUGIN_QUIRK_FAKE_WINDOW_FROM_POINT;
+  } else if (filename == kAcrobatReaderPlugin) {
+    // Check for the version number above or equal 9.
+    uint32_t major_version = GetPluginMajorVersion(plugin_info);
+    if (major_version >= 9) {
+      quirks_ |= PLUGIN_QUIRK_DIE_AFTER_UNLOAD;
+      // 9.2 needs this.
+      quirks_ |= PLUGIN_QUIRK_SETWINDOW_TWICE;
+    }
+    quirks_ |= PLUGIN_QUIRK_BLOCK_NONSTANDARD_GETURL_REQUESTS;
+  } else if (plugin_info.name.find(L"Windows Media Player") !=
+             std::wstring::npos) {
+    // Windows Media Player needs two NPP_SetWindow calls.
+    quirks_ |= PLUGIN_QUIRK_SETWINDOW_TWICE;
+
+    // Windowless mode doesn't work in the WMP NPAPI plugin.
+    quirks_ |= PLUGIN_QUIRK_NO_WINDOWLESS;
+
+    // The media player plugin sets its size on the first NPP_SetWindow call
+    // and never updates its size. We should call the underlying NPP_SetWindow
+    // only when we have the correct size.
+    quirks_ |= PLUGIN_QUIRK_IGNORE_FIRST_SETWINDOW_CALL;
+
+    if (filename == kOldWMPPlugin) {
+      // Non-admin users on XP couldn't modify the key to force the new UI.
+      quirks_ |= PLUGIN_QUIRK_PATCH_REGENUMKEYEXW;
+    }
+  } else if (instance_->mime_type() == "audio/x-pn-realaudio-plugin" ||
+             filename == kRealPlayerPlugin) {
+    quirks_ |= PLUGIN_QUIRK_DONT_CALL_WND_PROC_RECURSIVELY;
+  } else if (plugin_info.name.find(L"VLC Multimedia Plugin") !=
+             std::wstring::npos ||
+             plugin_info.name.find(L"VLC Multimedia Plug-in") !=
+             std::wstring::npos) {
+    // VLC hangs on NPP_Destroy if we call NPP_SetWindow with a null window
+    // handle
+    quirks_ |= PLUGIN_QUIRK_DONT_SET_NULL_WINDOW_HANDLE_ON_DESTROY;
+    uint32_t major_version = GetPluginMajorVersion(plugin_info);
+    if (major_version == 0) {
+      // VLC 0.8.6d and 0.8.6e crash if multiple instances are created.
+      quirks_ |= PLUGIN_QUIRK_DONT_ALLOW_MULTIPLE_INSTANCES;
+    }
+  } else if (filename == kSilverlightPlugin) {
+    // Explanation for this quirk can be found in
+    // WebPluginDelegateImpl::Initialize.
+    quirks_ |= PLUGIN_QUIRK_PATCH_SETCURSOR;
+  } else if (plugin_info.name.find(L"DivX Web Player") !=
+             std::wstring::npos) {
+    // The divx plugin sets its size on the first NPP_SetWindow call and never
+    // updates its size. We should call the underlying NPP_SetWindow only when
+    // we have the correct size.
+    quirks_ |= PLUGIN_QUIRK_IGNORE_FIRST_SETWINDOW_CALL;
+  }
 }
 
 WebPluginDelegateImpl::~WebPluginDelegateImpl() {
+  if (::IsWindow(dummy_window_for_activation_)) {
+    WNDPROC current_wnd_proc = reinterpret_cast<WNDPROC>(
+        GetWindowLongPtr(dummy_window_for_activation_, GWLP_WNDPROC));
+    if (current_wnd_proc == DummyWindowProc) {
+      SetWindowLongPtr(dummy_window_for_activation_,
+                       GWLP_WNDPROC,
+                       reinterpret_cast<LONG_PTR>(old_dummy_window_proc_));
+    }
+    ::DestroyWindow(dummy_window_for_activation_);
+  }
+
   DestroyInstance();
+
+  if (handle_event_pump_messages_event_) {
+    CloseHandle(handle_event_pump_messages_event_);
+  }
 }
 
 bool WebPluginDelegateImpl::PlatformInitialize() {
+  CreateDummyWindowForActivation();
+  handle_event_pump_messages_event_ = CreateEvent(NULL, TRUE, FALSE, NULL);
+  plugin_->SetWindowlessData(
+      handle_event_pump_messages_event_,
+      reinterpret_cast<gfx::NativeViewId>(dummy_window_for_activation_));
+
+  // Windowless plugins call the WindowFromPoint API and passes the result of
+  // that to the TrackPopupMenu API call as the owner window. This causes the
+  // API to fail as the API expects the window handle to live on the same
+  // thread as the caller. It works in the other browsers as the plugin lives
+  // on the browser thread. Our workaround is to intercept the TrackPopupMenu
+  // API and replace the window handle with the dummy activation window.
+  if (!g_iat_patch_track_popup_menu.Pointer()->is_patched()) {
+    g_iat_patch_track_popup_menu.Pointer()->Patch(
+        GetPluginPath().value().c_str(), "user32.dll", "TrackPopupMenu",
+        WebPluginDelegateImpl::TrackPopupMenuPatch);
+  }
+
+  // Windowless plugins can set cursors by calling the SetCursor API. This
+  // works because the thread inputs of the browser UI thread and the plugin
+  // thread are attached. We intercept the SetCursor API for windowless
+  // plugins and remember the cursor being set. This is shipped over to the
+  // browser in the HandleEvent call, which ensures that the cursor does not
+  // change when a windowless plugin instance changes the cursor
+  // in a background tab.
+  if (!g_iat_patch_set_cursor.Pointer()->is_patched() &&
+      (quirks_ & PLUGIN_QUIRK_PATCH_SETCURSOR)) {
+    g_iat_patch_set_cursor.Pointer()->Patch(
+        GetPluginPath().value().c_str(), "user32.dll", "SetCursor",
+        WebPluginDelegateImpl::SetCursorPatch);
+  }
+
+  // On XP, WMP will use its old UI unless a registry key under HKLM has the
+  // name of the current process.  We do it in the installer for admin users,
+  // for the rest patch this function.
+  if ((quirks_ & PLUGIN_QUIRK_PATCH_REGENUMKEYEXW) &&
+      base::win::GetVersion() == base::win::VERSION_XP &&
+      (base::win::RegKey().Open(HKEY_LOCAL_MACHINE,
+          L"SOFTWARE\\Microsoft\\MediaPlayer\\ShimInclusionList\\chrome.exe",
+          KEY_READ) != ERROR_SUCCESS) &&
+      !g_iat_patch_reg_enum_key_ex_w.Pointer()->is_patched()) {
+    g_iat_patch_reg_enum_key_ex_w.Pointer()->Patch(
+        L"wmpdxm.dll", "advapi32.dll", "RegEnumKeyExW",
+        WebPluginDelegateImpl::RegEnumKeyExWPatch);
+  }
+
+  // Flash retrieves the pointers to IMM32 functions with GetProcAddress() calls
+  // and use them to retrieve IME data. We add a patch to this function so we
+  // can dispatch these IMM32 calls to the WebPluginIMEWin class, which emulates
+  // IMM32 functions for Flash.
+  if (!g_iat_patch_get_proc_address.Pointer()->is_patched() &&
+      (quirks_ & PLUGIN_QUIRK_EMULATE_IME)) {
+    g_iat_patch_get_proc_address.Pointer()->Patch(
+        GetPluginPath().value().c_str(), "kernel32.dll", "GetProcAddress",
+        GetProcAddressPatch);
+  }
+
+  if (!g_iat_patch_window_from_point.Pointer()->is_patched() &&
+      (quirks_ & PLUGIN_QUIRK_FAKE_WINDOW_FROM_POINT)) {
+    g_iat_patch_window_from_point.Pointer()->Patch(
+        GetPluginPath().value().c_str(), "user32.dll", "WindowFromPoint",
+        WebPluginDelegateImpl::WindowFromPointPatch);
+  }
+
   return true;
 }
 
 void WebPluginDelegateImpl::PlatformDestroyInstance() {
+  if (!instance_->plugin_lib())
+    return;
+
+  // Unpatch if this is the last plugin instance.
+  if (instance_->plugin_lib()->instance_count() != 1)
+    return;
+
+  if (g_iat_patch_set_cursor.Pointer()->is_patched())
+    g_iat_patch_set_cursor.Pointer()->Unpatch();
+
+  if (g_iat_patch_track_popup_menu.Pointer()->is_patched())
+    g_iat_patch_track_popup_menu.Pointer()->Unpatch();
+
+  if (g_iat_patch_reg_enum_key_ex_w.Pointer()->is_patched())
+    g_iat_patch_reg_enum_key_ex_w.Pointer()->Unpatch();
+
+  if (g_iat_patch_window_from_point.Pointer()->is_patched())
+    g_iat_patch_window_from_point.Pointer()->Unpatch();
 }
 
 void WebPluginDelegateImpl::Paint(SkCanvas* canvas, const gfx::Rect& rect) {
@@ -110,6 +410,234 @@ void WebPluginDelegateImpl::Paint(SkCanvas* canvas, const gfx::Rect& rect) {
   }
 }
 
+// Erase all messages in the queue destined for a particular window.
+// When windows are closing, callers should use this function to clear
+// the queue.
+// static
+void WebPluginDelegateImpl::ClearThrottleQueueForWindow(HWND window) {
+  ThrottleQueue* throttle_queue = g_throttle_queue.Pointer();
+
+  ThrottleQueue::iterator it;
+  for (it = throttle_queue->begin(); it != throttle_queue->end(); ) {
+    if (it->hwnd == window) {
+      it = throttle_queue->erase(it);
+    } else {
+      it++;
+    }
+  }
+}
+
+// Delayed callback for processing throttled messages.
+// Throttled messages are aggregated globally across all plugins.
+// static
+void WebPluginDelegateImpl::OnThrottleMessage() {
+  // The current algorithm walks the list and processes the first
+  // message it finds for each plugin.  It is important to service
+  // all active plugins with each pass through the throttle, otherwise
+  // we see video jankiness.  Copy the set to notify before notifying
+  // since we may re-enter OnThrottleMessage from CallWindowProc!
+  ThrottleQueue* throttle_queue = g_throttle_queue.Pointer();
+  ThrottleQueue notify_queue;
+  std::set<HWND> processed;
+
+  ThrottleQueue::iterator it = throttle_queue->begin();
+  while (it != throttle_queue->end()) {
+    const MSG& msg = *it;
+    if (processed.find(msg.hwnd) == processed.end()) {
+      processed.insert(msg.hwnd);
+      notify_queue.push_back(msg);
+      it = throttle_queue->erase(it);
+    } else {
+      it++;
+    }
+  }
+
+  // Due to re-entrancy, we must save our queue state now.  Otherwise, we may
+  // self-post below, and *also* start up another delayed task when the first
+  // entry is pushed onto the queue in ThrottleMessage().
+  bool throttle_queue_was_empty = throttle_queue->empty();
+
+  for (it = notify_queue.begin(); it != notify_queue.end(); ++it) {
+    const MSG& msg = *it;
+    WNDPROC proc = reinterpret_cast<WNDPROC>(msg.time);
+    // It is possible that the window was closed after we queued
+    // this message.  This is a rare event; just verify the window
+    // is alive.  (see also bug 1259488)
+    if (IsWindow(msg.hwnd))
+      CallWindowProc(proc, msg.hwnd, msg.message, msg.wParam, msg.lParam);
+  }
+
+  if (!throttle_queue_was_empty) {
+    base::MessageLoop::current()->PostDelayedTask(
+        FROM_HERE,
+        base::Bind(&WebPluginDelegateImpl::OnThrottleMessage),
+        base::TimeDelta::FromMilliseconds(kFlashWMUSERMessageThrottleDelayMs));
+  }
+}
+
+// Schedule a windows message for delivery later.
+// static
+void WebPluginDelegateImpl::ThrottleMessage(WNDPROC proc, HWND hwnd,
+                                            UINT message, WPARAM wParam,
+                                            LPARAM lParam) {
+  MSG msg;
+  // Cast through uintptr_t and then DWORD to make the truncation explicit.
+  msg.time = static_cast<DWORD>(reinterpret_cast<uintptr_t>(proc));
+  msg.hwnd = hwnd;
+  msg.message = message;
+  msg.wParam = wParam;
+  msg.lParam = lParam;
+
+  ThrottleQueue* throttle_queue = g_throttle_queue.Pointer();
+
+  throttle_queue->push_back(msg);
+
+  if (throttle_queue->size() == 1) {
+    base::MessageLoop::current()->PostDelayedTask(
+        FROM_HERE,
+        base::Bind(&WebPluginDelegateImpl::OnThrottleMessage),
+        base::TimeDelta::FromMilliseconds(kFlashWMUSERMessageThrottleDelayMs));
+  }
+}
+
+// We go out of our way to find the hidden windows created by Flash for
+// windowless plugins.  We throttle the rate at which they deliver messages
+// so that they will not consume outrageous amounts of CPU.
+// static
+LRESULT CALLBACK WebPluginDelegateImpl::FlashWindowlessWndProc(
+    HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam) {
+  std::map<HWND, WNDPROC>::iterator index =
+      g_window_handle_proc_map.Get().find(hwnd);
+
+  WNDPROC old_proc = (*index).second;
+  DCHECK(old_proc);
+
+  switch (message) {
+    case WM_NCDESTROY: {
+      WebPluginDelegateImpl::ClearThrottleQueueForWindow(hwnd);
+      g_window_handle_proc_map.Get().erase(index);
+      break;
+    }
+    // Flash may flood the message queue with WM_USER+1 message causing 100% CPU
+    // usage.  See https://bugzilla.mozilla.org/show_bug.cgi?id=132759.  We
+    // prevent this by throttling the messages.
+    case WM_USER + 1: {
+      WebPluginDelegateImpl::ThrottleMessage(old_proc, hwnd, message, wparam,
+                                             lparam);
+      return TRUE;
+    }
+
+    default: {
+      break;
+    }
+  }
+  return CallWindowProc(old_proc, hwnd, message, wparam, lparam);
+}
+
+LRESULT CALLBACK WebPluginDelegateImpl::DummyWindowProc(
+    HWND hwnd, UINT message, WPARAM w_param, LPARAM l_param) {
+  WebPluginDelegateImpl* delegate = reinterpret_cast<WebPluginDelegateImpl*>(
+      GetProp(hwnd, kWebPluginDelegateProperty));
+  CHECK(delegate);
+  if (message == WM_WINDOWPOSCHANGING) {
+    // We need to know when the dummy window is parented because windowless
+    // plugins need the parent window for things like menus. There's no message
+    // for a parent being changed, but a WM_WINDOWPOSCHANGING is sent so we
+    // check every time we get it.
+    // For non-aura builds, this never changes since RenderWidgetHostViewWin's
+    // window is constant. For aura builds, this changes every time the tab gets
+    // dragged to a new window.
+    HWND parent = GetParent(hwnd);
+    if (parent != delegate->dummy_window_parent_) {
+      delegate->dummy_window_parent_ = parent;
+
+      // Set the containing window handle as the instance window handle. This is
+      // what Safari does. Not having a valid window handle causes subtle bugs
+      // with plugins which retrieve the window handle and use it for things
+      // like context menus. The window handle can be retrieved via
+      // NPN_GetValue of NPNVnetscapeWindow.
+      delegate->instance_->set_window_handle(parent);
+
+      // The plugin caches the result of NPNVnetscapeWindow when we originally
+      // called NPP_SetWindow, so force it to get the new value.
+      delegate->WindowlessSetWindow();
+    }
+  } else if (message == WM_NCDESTROY) {
+    RemoveProp(hwnd, kWebPluginDelegateProperty);
+  }
+  return CallWindowProc(
+      delegate->old_dummy_window_proc_, hwnd, message, w_param, l_param);
+}
+
+// Callback for enumerating the Flash windows.
+BOOL CALLBACK EnumFlashWindows(HWND window, LPARAM arg) {
+  WNDPROC wnd_proc = reinterpret_cast<WNDPROC>(arg);
+  TCHAR class_name[1024];
+  if (!RealGetWindowClass(window, class_name,
+                          sizeof(class_name)/sizeof(TCHAR))) {
+    LOG(ERROR) << "RealGetWindowClass failure: " << GetLastError();
+    return FALSE;
+  }
+
+  if (wcscmp(class_name, L"SWFlash_PlaceholderX"))
+    return TRUE;
+
+  WNDPROC current_wnd_proc = reinterpret_cast<WNDPROC>(
+        GetWindowLongPtr(window, GWLP_WNDPROC));
+  if (current_wnd_proc != wnd_proc) {
+    WNDPROC old_flash_proc = reinterpret_cast<WNDPROC>(SetWindowLongPtr(
+        window, GWLP_WNDPROC,
+        reinterpret_cast<LONG_PTR>(wnd_proc)));
+    DCHECK(old_flash_proc);
+    g_window_handle_proc_map.Get()[window] = old_flash_proc;
+  }
+
+  return TRUE;
+}
+
+bool WebPluginDelegateImpl::CreateDummyWindowForActivation() {
+  DCHECK(!dummy_window_for_activation_);
+
+  dummy_window_for_activation_ = CreateWindowEx(
+    0,
+    L"Static",
+    kDummyActivationWindowName,
+    WS_CHILD,
+    0,
+    0,
+    0,
+    0,
+    // We don't know the parent of the dummy window yet, so just set it to the
+    // desktop and it'll get parented by the browser.
+    GetDesktopWindow(),
+    0,
+    GetModuleHandle(NULL),
+    0);
+
+  if (dummy_window_for_activation_ == 0)
+    return false;
+
+  BOOL result = SetProp(dummy_window_for_activation_,
+                        kWebPluginDelegateProperty, this);
+  DCHECK(result == TRUE) << "SetProp failed, last error = " << GetLastError();
+  old_dummy_window_proc_ = reinterpret_cast<WNDPROC>(SetWindowLongPtr(
+      dummy_window_for_activation_, GWLP_WNDPROC,
+      reinterpret_cast<LONG_PTR>(DummyWindowProc)));
+
+  // Flash creates background windows which use excessive CPU in our
+  // environment; we wrap these windows and throttle them so that they don't
+  // get out of hand.
+  if (!EnumThreadWindows(::GetCurrentThreadId(), EnumFlashWindows,
+      reinterpret_cast<LPARAM>(
+      &WebPluginDelegateImpl::FlashWindowlessWndProc))) {
+    // Log that this happened.  Flash will still work; it just means the
+    // throttle isn't installed (and Flash will use more CPU).
+    NOTREACHED();
+    LOG(ERROR) << "Failed to wrap all windowless Flash windows";
+  }
+  return true;
+}
+
 // Returns true if the message passed in corresponds to a user gesture.
 static bool IsUserGestureMessage(unsigned int message) {
   switch (message) {
@@ -332,6 +860,51 @@ bool WebPluginDelegateImpl::PlatformHandleInputEvent(
     return false;
   }
 
+  // Allow this plugin to access this IME emulator through IMM32 API while the
+  // plugin is processing this event.
+  if (GetQuirks() & PLUGIN_QUIRK_EMULATE_IME) {
+    if (!plugin_ime_)
+      plugin_ime_.reset(new WebPluginIMEWin);
+  }
+  WebPluginIMEWin::ScopedLock lock(
+      event.isKeyboardEventType(event.type) ? plugin_ime_.get() : NULL);
+
+  HWND last_focus_window = NULL;
+
+  if (ShouldTrackEventForModalLoops(&np_event)) {
+    // A windowless plugin can enter a modal loop in a NPP_HandleEvent call.
+    // For e.g. Flash puts up a context menu when we right click on the
+    // windowless plugin area. We detect this by setting up a message filter
+    // hook pror to calling NPP_HandleEvent on the plugin and unhook on
+    // return from NPP_HandleEvent. If the plugin does enter a modal loop
+    // in that context we unhook on receiving the first notification in
+    // the message filter hook.
+    handle_event_message_filter_hook_ =
+        SetWindowsHookEx(WH_MSGFILTER, HandleEventMessageFilterHook, NULL,
+                         GetCurrentThreadId());
+    // To ensure that the plugin receives keyboard events we set focus to the
+    // dummy window.
+    // TODO(iyengar) We need a framework in the renderer to identify which
+    // windowless plugin is under the mouse and to handle this. This would
+    // also require some changes in RenderWidgetHost to detect this in the
+    // WM_MOUSEACTIVATE handler and inform the renderer accordingly.
+    bool valid = GetParent(dummy_window_for_activation_) != GetDesktopWindow();
+    if (valid) {
+      last_focus_window = ::SetFocus(dummy_window_for_activation_);
+    } else {
+      NOTREACHED() << "Dummy window not parented";
+    }
+  }
+
+  bool old_task_reentrancy_state =
+      base::MessageLoop::current()->NestableTasksAllowed();
+
+  // Maintain a local/global stack for the g_current_plugin_instance variable
+  // as this may be a nested invocation.
+  WebPluginDelegateImpl* last_plugin_instance = g_current_plugin_instance;
+
+  g_current_plugin_instance = this;
+
   handle_event_depth_++;
 
   bool popups_enabled = false;
@@ -363,7 +936,174 @@ bool WebPluginDelegateImpl::PlatformHandleInputEvent(
 
   handle_event_depth_--;
 
+  g_current_plugin_instance = last_plugin_instance;
+
+  // We could have multiple NPP_HandleEvent calls nested together in case
+  // the plugin enters a modal loop. Reset the pump messages event when
+  // the outermost NPP_HandleEvent call unwinds.
+  if (handle_event_depth_ == 0) {
+    ResetEvent(handle_event_pump_messages_event_);
+  }
+
+  // If we didn't enter a modal loop, need to unhook the filter.
+  if (handle_event_message_filter_hook_) {
+    UnhookWindowsHookEx(handle_event_message_filter_hook_);
+    handle_event_message_filter_hook_ = NULL;
+  }
+
+  if (::IsWindow(last_focus_window)) {
+    // Restore the nestable tasks allowed state in the message loop and reset
+    // the os modal loop state as the plugin returned from the TrackPopupMenu
+    // API call.
+    base::MessageLoop::current()->SetNestableTasksAllowed(
+        old_task_reentrancy_state);
+    base::MessageLoop::current()->set_os_modal_loop(false);
+    // The Flash plugin at times sets focus to its hidden top level window
+    // with class name SWFlash_PlaceholderX. This causes the chrome browser
+    // window to receive a WM_ACTIVATEAPP message as a top level window from
+    // another thread is now active. We end up in a state where the chrome
+    // browser window is not active even though the user clicked on it.
+    // Our workaround for this is to send over a raw
+    // WM_LBUTTONDOWN/WM_LBUTTONUP combination to the last focus window, which
+    // does the trick.
+    if (dummy_window_for_activation_ != ::GetFocus()) {
+      INPUT input_info = {0};
+      input_info.type = INPUT_MOUSE;
+      input_info.mi.dwFlags = MOUSEEVENTF_LEFTDOWN;
+      ::SendInput(1, &input_info, sizeof(INPUT));
+
+      input_info.type = INPUT_MOUSE;
+      input_info.mi.dwFlags = MOUSEEVENTF_LEFTUP;
+      ::SendInput(1, &input_info, sizeof(INPUT));
+    } else {
+      ::SetFocus(last_focus_window);
+    }
+  }
   return ret;
 }
 
+
+void WebPluginDelegateImpl::OnModalLoopEntered() {
+  DCHECK(handle_event_pump_messages_event_ != NULL);
+  SetEvent(handle_event_pump_messages_event_);
+
+  base::MessageLoop::current()->SetNestableTasksAllowed(true);
+  base::MessageLoop::current()->set_os_modal_loop(true);
+
+  UnhookWindowsHookEx(handle_event_message_filter_hook_);
+  handle_event_message_filter_hook_ = NULL;
+}
+
+bool WebPluginDelegateImpl::ShouldTrackEventForModalLoops(NPEvent* event) {
+  if (event->event == WM_RBUTTONDOWN)
+    return true;
+  return false;
+}
+
+BOOL WINAPI WebPluginDelegateImpl::TrackPopupMenuPatch(
+    HMENU menu, unsigned int flags, int x, int y, int reserved,
+    HWND window, const RECT* rect) {
+
+  if (g_current_plugin_instance) {
+    unsigned long window_process_id = 0;
+    unsigned long window_thread_id =
+        GetWindowThreadProcessId(window, &window_process_id);
+    // TrackPopupMenu fails if the window passed in belongs to a different
+    // thread.
+    if (::GetCurrentThreadId() != window_thread_id) {
+      bool valid =
+          GetParent(g_current_plugin_instance->dummy_window_for_activation_) !=
+              GetDesktopWindow();
+      if (valid) {
+        window = g_current_plugin_instance->dummy_window_for_activation_;
+      } else {
+        NOTREACHED() << "Dummy window not parented";
+      }
+    }
+  }
+
+  BOOL result = TrackPopupMenu(menu, flags, x, y, reserved, window, rect);
+  return result;
+}
+
+HCURSOR WINAPI WebPluginDelegateImpl::SetCursorPatch(HCURSOR cursor) {
+  // The windowless flash plugin periodically calls SetCursor in a wndproc
+  // instantiated on the plugin thread. This causes annoying cursor flicker
+  // when the mouse is moved on a foreground tab, with a windowless plugin
+  // instance in a background tab. We just ignore the call here.
+  if (!g_current_plugin_instance) {
+    HCURSOR current_cursor = GetCursor();
+    if (current_cursor != cursor) {
+      ::SetCursor(cursor);
+    }
+    return current_cursor;
+  }
+  return ::SetCursor(cursor);
+}
+
+LONG WINAPI WebPluginDelegateImpl::RegEnumKeyExWPatch(
+    HKEY key, DWORD index, LPWSTR name, LPDWORD name_size, LPDWORD reserved,
+    LPWSTR class_name, LPDWORD class_size, PFILETIME last_write_time) {
+  DWORD orig_size = *name_size;
+  LONG rv = RegEnumKeyExW(key, index, name, name_size, reserved, class_name,
+                          class_size, last_write_time);
+  if (rv == ERROR_SUCCESS &&
+      GetKeyPath(key).find(L"Microsoft\\MediaPlayer\\ShimInclusionList") !=
+          std::wstring::npos) {
+    static const wchar_t kChromeExeName[] = L"chrome.exe";
+    wcsncpy_s(name, orig_size, kChromeExeName, arraysize(kChromeExeName));
+    *name_size =
+        std::min(orig_size, static_cast<DWORD>(arraysize(kChromeExeName)));
+  }
+
+  return rv;
+}
+
+void WebPluginDelegateImpl::ImeCompositionUpdated(
+    const base::string16& text,
+    const std::vector<int>& clauses,
+    const std::vector<int>& target,
+    int cursor_position) {
+  if (!plugin_ime_)
+    plugin_ime_.reset(new WebPluginIMEWin);
+
+  plugin_ime_->CompositionUpdated(text, clauses, target, cursor_position);
+  plugin_ime_->SendEvents(instance());
+}
+
+void WebPluginDelegateImpl::ImeCompositionCompleted(
+    const base::string16& text) {
+  if (!plugin_ime_)
+    plugin_ime_.reset(new WebPluginIMEWin);
+  plugin_ime_->CompositionCompleted(text);
+  plugin_ime_->SendEvents(instance());
+}
+
+bool WebPluginDelegateImpl::GetIMEStatus(int* input_type,
+                                         gfx::Rect* caret_rect) {
+  if (!plugin_ime_)
+    return false;
+  return plugin_ime_->GetStatus(input_type, caret_rect);
+}
+
+// static
+FARPROC WINAPI WebPluginDelegateImpl::GetProcAddressPatch(HMODULE module,
+                                                          LPCSTR name) {
+  FARPROC imm_function = WebPluginIMEWin::GetProcAddress(name);
+  if (imm_function)
+    return imm_function;
+  return ::GetProcAddress(module, name);
+}
+
+HWND WINAPI WebPluginDelegateImpl::WindowFromPointPatch(POINT point) {
+  HWND window = WindowFromPoint(point);
+  if (::ScreenToClient(window, &point)) {
+    HWND child = ChildWindowFromPoint(window, point);
+    if (::IsWindow(child) &&
+        ::GetProp(child, content::kPluginDummyParentProperty))
+      return child;
+  }
+  return window;
+}
+
 }  // namespace content
diff --git a/content/child/npapi/webplugin_ime_win.cc b/content/child/npapi/webplugin_ime_win.cc
new file mode 100644
index 0000000..7523495
--- /dev/null
+++ b/content/child/npapi/webplugin_ime_win.cc
@@ -0,0 +1,314 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/npapi/webplugin_ime_win.h"
+
+#include <stddef.h>
+#include <string.h>
+
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "base/lazy_instance.h"
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/synchronization/lock.h"
+#include "content/child/npapi/plugin_instance.h"
+#include "content/common/plugin_constants_win.h"
+
+#pragma comment(lib, "imm32.lib")
+
+namespace content {
+
+// A critical section that prevents two or more plugins from accessing a
+// WebPluginIMEWin instance through our patch function.
+base::LazyInstance<base::Lock>::Leaky
+    g_webplugin_ime_lock = LAZY_INSTANCE_INITIALIZER;
+
+WebPluginIMEWin* WebPluginIMEWin::instance_ = NULL;
+
+WebPluginIMEWin::WebPluginIMEWin()
+    : cursor_position_(0),
+      delta_start_(0),
+      composing_text_(false),
+      support_ime_messages_(false),
+      status_updated_(false),
+      input_type_(1) {
+  memset(result_clauses_, 0, sizeof(result_clauses_));
+}
+
+WebPluginIMEWin::~WebPluginIMEWin() {
+}
+
+void WebPluginIMEWin::CompositionUpdated(const base::string16& text,
+                                         std::vector<int> clauses,
+                                         std::vector<int> target,
+                                         int cursor_position) {
+  // Send a WM_IME_STARTCOMPOSITION message when a user starts a composition.
+  NPEvent np_event;
+  if (!composing_text_) {
+    composing_text_ = true;
+    result_text_.clear();
+
+    np_event.event = WM_IME_STARTCOMPOSITION;
+    np_event.wParam = 0;
+    np_event.lParam = 0;
+    events_.push_back(np_event);
+  }
+
+  // We can update the following values from this event: GCS_COMPSTR,
+  // GCS_COMPATTR, GCSCOMPCLAUSE, GCS_CURSORPOS, and GCS_DELTASTART. We send a
+  // WM_IME_COMPOSITION message to notify the list of updated values.
+  np_event.event = WM_IME_COMPOSITION;
+  np_event.wParam = 0;
+  np_event.lParam = GCS_COMPSTR | GCS_COMPATTR | GCS_COMPCLAUSE |
+      GCS_CURSORPOS | GCS_DELTASTART;
+  events_.push_back(np_event);
+
+  // Converts this event to the IMM32 data so we do not have to convert it every
+  // time when a plugin call an IMM32 function.
+  composition_text_ = text;
+
+  // Create the composition clauses returned when a plugin calls
+  // ImmGetCompositionString() with GCS_COMPCLAUSE.
+  composition_clauses_.clear();
+  for (size_t i = 0; i < clauses.size(); ++i)
+    composition_clauses_.push_back(clauses[i]);
+
+  // Create the composition attributes used by GCS_COMPATTR.
+  if (target.size() == 2) {
+    composition_attributes_.assign(text.length(), ATTR_CONVERTED);
+    for (int i = target[0]; i < target[1]; ++i)
+        composition_attributes_[i] = ATTR_TARGET_CONVERTED;
+  } else {
+    composition_attributes_.assign(text.length(), ATTR_INPUT);
+  }
+
+  cursor_position_ = cursor_position;
+  delta_start_ = cursor_position;
+}
+
+void WebPluginIMEWin::CompositionCompleted(const base::string16& text) {
+  composing_text_ = false;
+
+  // We should update the following values when we finish a composition:
+  // GCS_RESULTSTR, GCS_RESULTCLAUSE, GCS_CURSORPOS, and GCS_DELTASTART. We
+  // send a WM_IME_COMPOSITION message to notify the list of updated values.
+  NPEvent np_event;
+  np_event.event = WM_IME_COMPOSITION;
+  np_event.wParam = 0;
+  np_event.lParam = GCS_CURSORPOS | GCS_DELTASTART | GCS_RESULTSTR |
+      GCS_RESULTCLAUSE;
+  events_.push_back(np_event);
+
+  // We also send a WM_IME_ENDCOMPOSITION message after the final
+  // WM_IME_COMPOSITION message (i.e. after finishing a composition).
+  np_event.event = WM_IME_ENDCOMPOSITION;
+  np_event.wParam = 0;
+  np_event.lParam = 0;
+  events_.push_back(np_event);
+
+  // If the target plugin does not seem to support IME messages, we send
+  // each character in IME text with a WM_CHAR message so the plugin can
+  // insert the IME text.
+  if (!support_ime_messages_) {
+    np_event.event = WM_CHAR;
+    np_event.wParam = 0;
+    np_event.lParam = 0;
+    for (size_t i = 0; i < result_text_.length(); ++i) {
+      np_event.wParam = result_text_[i];
+      events_.push_back(np_event);
+    }
+  }
+
+  // Updated the result text and its clause. (Unlike composition clauses, a
+  // result clause consists of only one region.)
+  result_text_ = text;
+
+  result_clauses_[0] = 0;
+  result_clauses_[1] = result_text_.length();
+
+  cursor_position_ = result_clauses_[1];
+  delta_start_ = result_clauses_[1];
+}
+
+bool WebPluginIMEWin::SendEvents(PluginInstance* instance) {
+  // We allow the patch functions to access this WebPluginIMEWin instance only
+  // while we send IME events to the plugin.
+  ScopedLock lock(this);
+
+  bool ret = true;
+  for (std::vector<NPEvent>::iterator it = events_.begin();
+       it != events_.end(); ++it) {
+    if (!instance->NPP_HandleEvent(&(*it)))
+      ret = false;
+  }
+
+  events_.clear();
+  return ret;
+}
+
+bool WebPluginIMEWin::GetStatus(int* input_type, gfx::Rect* caret_rect) {
+  *input_type = input_type_;
+  *caret_rect = caret_rect_;
+  return true;
+}
+
+// static
+FARPROC WebPluginIMEWin::GetProcAddress(LPCSTR name) {
+  static const struct {
+    const char* name;
+    FARPROC function;
+  } kImm32Functions[] = {
+    { "ImmAssociateContextEx",
+        reinterpret_cast<FARPROC>(ImmAssociateContextEx) },
+    { "ImmGetCompositionStringW",
+        reinterpret_cast<FARPROC>(ImmGetCompositionStringW) },
+    { "ImmGetContext", reinterpret_cast<FARPROC>(ImmGetContext) },
+    { "ImmReleaseContext", reinterpret_cast<FARPROC>(ImmReleaseContext) },
+    { "ImmSetCandidateWindow",
+        reinterpret_cast<FARPROC>(ImmSetCandidateWindow) },
+    { "ImmSetOpenStatus", reinterpret_cast<FARPROC>(ImmSetOpenStatus) },
+  };
+  for (size_t i = 0; i < arraysize(kImm32Functions); ++i) {
+    if (!lstrcmpiA(name, kImm32Functions[i].name))
+      return kImm32Functions[i].function;
+  }
+  return NULL;
+}
+
+void WebPluginIMEWin::Lock() {
+  g_webplugin_ime_lock.Pointer()->Acquire();
+  instance_ = this;
+}
+
+void WebPluginIMEWin::Unlock() {
+  instance_ = NULL;
+  g_webplugin_ime_lock.Pointer()->Release();
+}
+
+// static
+WebPluginIMEWin* WebPluginIMEWin::GetInstance(HIMC context) {
+  return instance_ && context == reinterpret_cast<HIMC>(instance_) ?
+      instance_ : NULL;
+}
+
+// static
+BOOL WINAPI WebPluginIMEWin::ImmAssociateContextEx(HWND window,
+                                                   HIMC context,
+                                                   DWORD flags) {
+  WebPluginIMEWin* instance = GetInstance(context);
+  if (!instance)
+    return ::ImmAssociateContextEx(window, context, flags);
+
+  int input_type = !context && !flags;
+  instance->input_type_ = input_type;
+  instance->status_updated_ = true;
+  return TRUE;
+}
+
+// static
+LONG WINAPI WebPluginIMEWin::ImmGetCompositionStringW(HIMC context,
+                                                      DWORD index,
+                                                      LPVOID dst_data,
+                                                      DWORD dst_size) {
+  WebPluginIMEWin* instance = GetInstance(context);
+  if (!instance)
+    return ::ImmGetCompositionStringW(context, index, dst_data, dst_size);
+
+  const void* src_data = NULL;
+  DWORD src_size = 0;
+  switch (index) {
+    case GCS_COMPSTR:
+      src_data = instance->composition_text_.c_str();
+      src_size = instance->composition_text_.length() * sizeof(wchar_t);
+      break;
+
+    case GCS_COMPATTR:
+      src_data = instance->composition_attributes_.c_str();
+      src_size = instance->composition_attributes_.length();
+      break;
+
+    case GCS_COMPCLAUSE:
+      src_data = &instance->composition_clauses_[0];
+      src_size = instance->composition_clauses_.size() * sizeof(uint32_t);
+      break;
+
+    case GCS_CURSORPOS:
+      return instance->cursor_position_;
+
+    case GCS_DELTASTART:
+      return instance->delta_start_;
+
+    case GCS_RESULTSTR:
+      src_data = instance->result_text_.c_str();
+      src_size = instance->result_text_.length() * sizeof(wchar_t);
+      break;
+
+    case GCS_RESULTCLAUSE:
+      src_data = &instance->result_clauses_[0];
+      src_size = sizeof(instance->result_clauses_);
+      break;
+
+    default:
+      break;
+  }
+  if (!src_data || !src_size)
+    return IMM_ERROR_NODATA;
+
+  if (dst_size >= src_size)
+    memcpy(dst_data, src_data, src_size);
+
+  return src_size;
+}
+
+// static
+HIMC WINAPI WebPluginIMEWin::ImmGetContext(HWND window) {
+  WebPluginIMEWin* instance = instance_;
+  if (instance)
+    instance->support_ime_messages_ = true;
+  return reinterpret_cast<HIMC>(instance);
+}
+
+// static
+BOOL WINAPI WebPluginIMEWin::ImmReleaseContext(HWND window, HIMC context) {
+  if (!GetInstance(context))
+    return ::ImmReleaseContext(window, context);
+  return TRUE;
+}
+
+// static
+BOOL WINAPI WebPluginIMEWin::ImmSetCandidateWindow(HIMC context,
+                                                   CANDIDATEFORM* candidate) {
+  WebPluginIMEWin* instance = GetInstance(context);
+  if (!instance)
+    return ::ImmSetCandidateWindow(context, candidate);
+
+  gfx::Rect caret_rect(candidate->rcArea);
+  if ((candidate->dwStyle & CFS_EXCLUDE) &&
+      instance->caret_rect_ != caret_rect) {
+    instance->caret_rect_ = caret_rect;
+    instance->status_updated_ = true;
+  }
+  return TRUE;
+}
+
+// static
+BOOL WINAPI WebPluginIMEWin::ImmSetOpenStatus(HIMC context, BOOL open) {
+  WebPluginIMEWin* instance = GetInstance(context);
+  if (!instance)
+    return ::ImmSetOpenStatus(context, open);
+
+  int input_type = open ? 1 : 0;
+  if (instance->input_type_ != input_type) {
+    instance->input_type_ = input_type;
+    instance->status_updated_ = true;
+  }
+
+  return TRUE;
+}
+
+}  // namespace content
diff --git a/content/child/npapi/webplugin_ime_win.h b/content/child/npapi/webplugin_ime_win.h
new file mode 100644
index 0000000..006705e
--- /dev/null
+++ b/content/child/npapi/webplugin_ime_win.h
@@ -0,0 +1,184 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_NPAPI_WEBPLUGIN_IME_WIN_H_
+#define CONTENT_CHILD_NPAPI_WEBPLUGIN_IME_WIN_H_
+
+#include <stdint.h>
+
+#include <string>
+#include <vector>
+
+#include "base/strings/string16.h"
+#include "third_party/npapi/bindings/npapi.h"
+#include "ui/gfx/geometry/rect.h"
+
+namespace content {
+
+class PluginInstance;
+
+// A class that emulates an IME for windowless plugins. A windowless plugin
+// does not have a window. Therefore, we cannot attach an IME to a windowless
+// plugin. To allow such windowless plugins to use IMEs without any changes to
+// them, this class receives the IME data from a browser and patches IMM32
+// functions to return the IME data when a windowless plugin calls IMM32
+// functions. I would not Flash retrieves pointers to IMM32 functions with
+// GetProcAddress(), this class also needs a hook to GetProcAddress() to
+// dispatch IMM32 function calls from a plugin to this class as listed in the
+// following snippet.
+//
+//   FARPROC WINAPI GetProcAddressPatch(HMODULE module, LPCSTR name) {
+//     FARPROC* proc = WebPluginIMEWin::GetProcAddress(name);
+//     if (proc)
+//       return proc;
+//     return ::GetProcAddress(module, name);
+//   }
+//   ...
+//   app::win::IATPatchFunction get_proc_address;
+//   get_proc_address.Patch(
+//       GetPluginPath().value().c_str(), "kernel32.dll", "GetProcAddress",
+//       GetProcAddressPatch);
+//
+// After we successfuly dispatch IMM32 calls from a plugin to this class, we
+// need to update its IME data so the class can return it to the plugin through
+// its IMM32 calls. To update the IME data, we call CompositionUpdated() or
+// CompositionCompleted() BEFORE sending an IMM32 Window message to the plugin
+// with a SendEvents() call as listed in the following snippet. (Plugins call
+// IMM32 functions when it receives IMM32 window messages. We need to update the
+// IME data of this class before sending IMM32 messages so the plugins can get
+// the latest data.)
+//
+//   WebPluginIMEWin ime;
+//   ...
+//   base::string16 text = "composing";
+//   std::vector<int> clauses;
+//   clauses.push_back(0);
+//   clauses.push_back(text.length());
+//   std::vector<int> target;
+//   ime.CompositionUpdated(text, clauses, target, text.length());
+//   ime.SendEvents(instance());
+//
+//   base::string16 result = "result";
+//   ime.CompositionCompleted(result);
+//   ime.SendEvents(instance());
+//
+// This class also provides GetStatus() so we can retrieve the IME status
+// changed by a plugin with IMM32 functions. This function is mainly used for
+// retrieving the position of a caret.
+//
+class WebPluginIMEWin {
+ public:
+  // A simple class that allows a plugin to access a WebPluginIMEWin instance
+  // only in a scope.
+  class ScopedLock {
+   public:
+    explicit ScopedLock(WebPluginIMEWin* instance) : instance_(instance) {
+      if (instance_)
+        instance_->Lock();
+    }
+    ~ScopedLock() {
+      if (instance_)
+        instance_->Unlock();
+    }
+
+   private:
+    WebPluginIMEWin* instance_;
+  };
+
+  WebPluginIMEWin();
+  ~WebPluginIMEWin();
+
+  // Sends raw IME events sent from a browser to this IME emulator and updates
+  // the list of Windows events to be sent to a plugin. A raw IME event is
+  // mapped to two or more Windows events and it is not so trivial to send these
+  // Windows events to a plugin. This function inserts Windows events in the
+  // order expected by a plugin.
+  void CompositionUpdated(const base::string16& text,
+                          std::vector<int> clauses,
+                          std::vector<int> target,
+                          int cursor_position);
+  void CompositionCompleted(const base::string16& text);
+
+  // Send all the events added in Update() to a plugin.
+  bool SendEvents(PluginInstance* instance);
+
+  // Retrieves the status of this IME emulator.
+  bool GetStatus(int* input_type, gfx::Rect* caret_rect);
+
+  // Returns the pointers to IMM32-emulation functions implemented by this
+  // class. This function is used for over-writing the ones returned from
+  // GetProcAddress() calls of Win32 API.
+  static FARPROC GetProcAddress(const char* name);
+
+ private:
+  // Allow (or disallow) the patch functions to use this WebPluginIMEWin
+  // instance through our patch functions. Our patch functions need a static
+  // member variable |instance_| to access a WebPluginIMEWIn instance. We lock
+  // this static variable to prevent two or more plugins from accessing a
+  // WebPluginIMEWin instance.
+  void Lock();
+  void Unlock();
+
+  // Retrieve the instance of this class.
+  static WebPluginIMEWin* GetInstance(HIMC context);
+
+  // IMM32 patch functions implemented by this class.
+  static BOOL WINAPI ImmAssociateContextEx(HWND window,
+                                           HIMC context,
+                                           DWORD flags);
+  static LONG WINAPI ImmGetCompositionStringW(HIMC context,
+                                              DWORD index,
+                                              LPVOID dst_data,
+                                              DWORD dst_size);
+  static HIMC WINAPI ImmGetContext(HWND window);
+  static BOOL WINAPI ImmReleaseContext(HWND window, HIMC context);
+  static BOOL WINAPI ImmSetCandidateWindow(HIMC context,
+                                           CANDIDATEFORM* candidate);
+  static BOOL WINAPI ImmSetOpenStatus(HIMC context, BOOL open);
+
+  // a list of NPEvents to be sent to a plugin.
+  std::vector<NPEvent> events_;
+
+  // The return value for GCS_COMPSTR.
+  base::string16 composition_text_;
+
+  // The return value for GCS_RESULTSTR.
+  base::string16 result_text_;
+
+  // The return value for GCS_COMPATTR.
+  std::string composition_attributes_;
+
+  // The return value for GCS_COMPCLAUSE.
+  std::vector<uint32_t> composition_clauses_;
+
+  // The return value for GCS_RESULTCLAUSE.
+  uint32_t result_clauses_[2];
+
+  // The return value for GCS_CURSORPOS.
+  int cursor_position_;
+
+  // The return value for GCS_DELTASTART.
+  int delta_start_;
+
+  // Whether we are composing text. This variable is used for sending a
+  // WM_IME_STARTCOMPOSITION message when we start composing IME text.
+  bool composing_text_;
+
+  // Whether a plugin supports IME messages. When a plugin cannot handle
+  // IME messages, we need to send the IME text with WM_CHAR messages as Windows
+  // does.
+  bool support_ime_messages_;
+
+  // The IME status received from a plugin.
+  bool status_updated_;
+  int input_type_;
+  gfx::Rect caret_rect_;
+
+  // The pointer to the WebPluginIMEWin instance used by patch functions.
+  static WebPluginIMEWin* instance_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_NPAPI_WEBPLUGIN_IME_WIN_H_
diff --git a/content/child/plugin_messages.h b/content/child/plugin_messages.h
index 63a0f45..f6ceca2 100644
--- a/content/child/plugin_messages.h
+++ b/content/child/plugin_messages.h
@@ -111,6 +111,17 @@ IPC_MESSAGE_CONTROL1(PluginMsg_SignalModalDialogEvent,
 IPC_MESSAGE_CONTROL1(PluginMsg_ResetModalDialogEvent,
                      int /* render_view_id */)
 
+#if defined(OS_WIN)
+IPC_MESSAGE_ROUTED4(PluginMsg_ImeCompositionUpdated,
+                    base::string16 /* text */,
+                    std::vector<int> /* clauses */,
+                    std::vector<int>, /* target */
+                    int /* cursor_position */)
+
+IPC_MESSAGE_ROUTED1(PluginMsg_ImeCompositionCompleted,
+                    base::string16 /* text */)
+#endif
+
 #if defined(OS_MACOSX)
 IPC_MESSAGE_ROUTED1(PluginMsg_SetWindowFocus,
                     bool /* has_focus */)
@@ -171,6 +182,26 @@ IPC_SYNC_MESSAGE_CONTROL1_0(PluginHostMsg_SetException,
 
 IPC_MESSAGE_CONTROL0(PluginHostMsg_PluginShuttingDown)
 
+#if defined(OS_WIN)
+// The modal_loop_pump_messages_event parameter is an event handle which is
+// passed in for windowless plugins and is used to indicate if messages
+// are to be pumped in sync calls to the plugin process. Currently used
+// in HandleEvent calls.
+IPC_SYNC_MESSAGE_ROUTED2_0(PluginHostMsg_SetWindowlessData,
+                           HANDLE /* modal_loop_pump_messages_event */,
+                           gfx::NativeViewId /* dummy_activation_window*/)
+
+// Send the IME status retrieved from a windowless plugin. A windowless plugin
+// uses the IME attached to a browser process as a renderer does. A plugin
+// sends this message to control the IME status of a browser process. I would
+// note that a plugin sends this message to a renderer process that hosts this
+// plugin (not directly to a browser process) so the renderer process can
+// update its IME status.
+IPC_MESSAGE_ROUTED2(PluginHostMsg_NotifyIMEStatus,
+                    int /* input_type */,
+                    gfx::Rect /* caret_rect */)
+#endif
+
 #if defined(OS_MACOSX)
 IPC_MESSAGE_ROUTED1(PluginHostMsg_FocusChanged,
                     bool /* focused */)
diff --git a/content/common/plugin_constants_win.cc b/content/common/plugin_constants_win.cc
index 5f2a5cb..9330c81 100644
--- a/content/common/plugin_constants_win.cc
+++ b/content/common/plugin_constants_win.cc
@@ -6,13 +6,20 @@
 
 namespace content {
 
+const base::char16 kDummyActivationWindowName[] = L"DummyWindowForActivation";
 const base::char16 kRegistryMozillaPlugins[] = L"SOFTWARE\\MozillaPlugins";
 const base::char16 kMozillaActiveXPlugin[] = L"npmozax.dll";
 const base::char16 kNewWMPPlugin[] = L"np-mswmp.dll";
 const base::char16 kOldWMPPlugin[] = L"npdsplay.dll";
 const base::char16 kYahooApplicationStatePlugin[] = L"npystate.dll";
 const base::char16 kWanWangProtocolHandlerPlugin[] = L"npww.dll";
+const base::char16 kFlashPlugin[] = L"npswf32.dll";
+const base::char16 kAcrobatReaderPlugin[] = L"nppdf32.dll";
+const base::char16 kRealPlayerPlugin[] = L"nppl3260.dll";
+const base::char16 kSilverlightPlugin[] = L"npctrl.dll";
 const base::char16 kJavaPlugin1[] = L"npjp2.dll";
 const base::char16 kJavaPlugin2[] = L"npdeploytk.dll";
+const char kGPUPluginMimeType[] = "application/vnd.google.chrome.gpu-plugin";
+const base::char16 kPluginDummyParentProperty[] = L"NPAPIPluginDummyParent";
 
 }  // namespace content
diff --git a/content/common/plugin_constants_win.h b/content/common/plugin_constants_win.h
index 5363868..815cbf4 100644
--- a/content/common/plugin_constants_win.h
+++ b/content/common/plugin_constants_win.h
@@ -14,6 +14,8 @@
 
 namespace content {
 
+extern const base::char16 kDummyActivationWindowName[];
+
 // The name of the registry key which NPAPI plugins update on installation.
 extern const base::char16 kRegistryMozillaPlugins[];
 
@@ -22,9 +24,17 @@ extern const base::char16 kNewWMPPlugin[];
 extern const base::char16 kOldWMPPlugin[];
 extern const base::char16 kYahooApplicationStatePlugin[];
 extern const base::char16 kWanWangProtocolHandlerPlugin[];
+extern const base::char16 kFlashPlugin[];
+extern const base::char16 kAcrobatReaderPlugin[];
+extern const base::char16 kRealPlayerPlugin[];
+extern const base::char16 kSilverlightPlugin[];
 extern const base::char16 kJavaPlugin1[];
 extern const base::char16 kJavaPlugin2[];
 
+extern const char kGPUPluginMimeType[];
+
+extern const base::char16 kPluginDummyParentProperty[];
+
 }  // namespace content
 
 #endif  // CONTENT_COMMON_PLUGIN_CONSTANTS_WIN_H_
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index a17ad85..9346980 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -1055,6 +1055,14 @@ IPC_MESSAGE_ROUTED2(ViewHostMsg_FocusedNodeChanged,
 
 IPC_MESSAGE_ROUTED1(ViewHostMsg_SetCursor, content::WebCursor)
 
+#if defined(OS_WIN)
+IPC_MESSAGE_ROUTED1(ViewHostMsg_WindowlessPluginDummyWindowCreated,
+                    gfx::NativeViewId /* dummy_activation_window */)
+
+IPC_MESSAGE_ROUTED1(ViewHostMsg_WindowlessPluginDummyWindowDestroyed,
+                    gfx::NativeViewId /* dummy_activation_window */)
+#endif
+
 // Get the list of proxies to use for |url|, as a semicolon delimited list
 // of "<TYPE> <HOST>:<PORT>" | "DIRECT".
 IPC_SYNC_MESSAGE_CONTROL1_2(ViewHostMsg_ResolveProxy,
diff --git a/content/content_child.gypi b/content/content_child.gypi
index ead38e5..eb92f42 100644
--- a/content/content_child.gypi
+++ b/content/content_child.gypi
@@ -180,6 +180,8 @@
       'child/npapi/webplugin_delegate_impl_aura.cc',
       'child/npapi/webplugin_delegate_impl_mac.mm',
       'child/npapi/webplugin_delegate_impl_win.cc',
+      'child/npapi/webplugin_ime_win.cc',
+      'child/npapi/webplugin_ime_win.h',
       'child/npapi/webplugin_resource_client.h',
       'child/permissions/permission_dispatcher.cc',
       'child/permissions/permission_dispatcher.h',
diff --git a/content/plugin/webplugin_delegate_stub.cc b/content/plugin/webplugin_delegate_stub.cc
index a70be97..0f1db98 100644
--- a/content/plugin/webplugin_delegate_stub.cc
+++ b/content/plugin/webplugin_delegate_stub.cc
@@ -103,6 +103,12 @@ bool WebPluginDelegateStub::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(PluginMsg_UpdateGeometry, OnUpdateGeometry)
     IPC_MESSAGE_HANDLER(PluginMsg_UpdateGeometrySync, OnUpdateGeometry)
     IPC_MESSAGE_HANDLER(PluginMsg_SetContentAreaFocus, OnSetContentAreaFocus)
+#if defined(OS_WIN) && !defined(USE_AURA)
+    IPC_MESSAGE_HANDLER(PluginMsg_ImeCompositionUpdated,
+                        OnImeCompositionUpdated)
+    IPC_MESSAGE_HANDLER(PluginMsg_ImeCompositionCompleted,
+                        OnImeCompositionCompleted)
+#endif
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER(PluginMsg_SetWindowFocus, OnSetWindowFocus)
     IPC_MESSAGE_HANDLER(PluginMsg_ContainerHidden, OnContainerHidden)
@@ -173,6 +179,10 @@ void WebPluginDelegateStub::OnInit(const PluginMsg_Init_Params& params,
 
 void WebPluginDelegateStub::OnSetFocus(bool focused) {
   delegate_->SetFocus(focused);
+#if defined(OS_WIN) && !defined(USE_AURA)
+  if (focused)
+    webplugin_->UpdateIMEStatus();
+#endif
 }
 
 void WebPluginDelegateStub::OnHandleInputEvent(
@@ -233,6 +243,24 @@ void WebPluginDelegateStub::OnSetContentAreaFocus(bool has_focus) {
     delegate_->SetContentAreaHasFocus(has_focus);
 }
 
+#if defined(OS_WIN) && !defined(USE_AURA)
+void WebPluginDelegateStub::OnImeCompositionUpdated(
+    const base::string16& text,
+    const std::vector<int>& clauses,
+    const std::vector<int>& target,
+    int cursor_position) {
+  if (delegate_)
+    delegate_->ImeCompositionUpdated(text, clauses, target, cursor_position);
+  webplugin_->UpdateIMEStatus();
+}
+
+void WebPluginDelegateStub::OnImeCompositionCompleted(
+    const base::string16& text) {
+  if (delegate_)
+    delegate_->ImeCompositionCompleted(text);
+}
+#endif
+
 #if defined(OS_MACOSX)
 void WebPluginDelegateStub::OnSetWindowFocus(bool has_focus) {
   if (delegate_)
diff --git a/content/plugin/webplugin_delegate_stub.h b/content/plugin/webplugin_delegate_stub.h
index c42141c..bd99966 100644
--- a/content/plugin/webplugin_delegate_stub.h
+++ b/content/plugin/webplugin_delegate_stub.h
@@ -71,6 +71,13 @@ class WebPluginDelegateStub : public IPC::Listener,
   void OnGetFormValue(base::string16* value, bool* success);
 
   void OnSetContentAreaFocus(bool has_focus);
+#if defined(OS_WIN) && !defined(USE_AURA)
+  void OnImeCompositionUpdated(const base::string16& text,
+                               const std::vector<int>& clauses,
+                               const std::vector<int>& target,
+                               int cursor_position);
+  void OnImeCompositionCompleted(const base::string16& text);
+#endif
 #if defined(OS_MACOSX)
   void OnSetWindowFocus(bool has_focus);
   void OnContainerHidden();
diff --git a/content/plugin/webplugin_proxy.cc b/content/plugin/webplugin_proxy.cc
index 89c1915..8744d22 100644
--- a/content/plugin/webplugin_proxy.cc
+++ b/content/plugin/webplugin_proxy.cc
@@ -76,6 +76,19 @@ bool WebPluginProxy::Send(IPC::Message* msg) {
   return channel_->Send(msg);
 }
 
+#if defined(OS_WIN)
+void WebPluginProxy::SetWindowlessData(
+    HANDLE pump_messages_event, gfx::NativeViewId dummy_activation_window) {
+  HANDLE pump_messages_event_for_renderer = NULL;
+  BrokerDuplicateHandle(pump_messages_event, channel_->peer_pid(),
+                                 &pump_messages_event_for_renderer,
+                                 SYNCHRONIZE | EVENT_MODIFY_STATE, 0);
+  DCHECK(pump_messages_event_for_renderer);
+  Send(new PluginHostMsg_SetWindowlessData(
+      route_id_, pump_messages_event_for_renderer, dummy_activation_window));
+}
+#endif
+
 void WebPluginProxy::Invalidate() {
   gfx::Rect rect(0, 0,
                  delegate_->GetRect().width(),
@@ -462,4 +475,17 @@ bool WebPluginProxy::IsOffTheRecord() {
   return channel_->incognito();
 }
 
+#if defined(OS_WIN) && !defined(USE_AURA)
+void WebPluginProxy::UpdateIMEStatus() {
+  // Retrieve the IME status from a plugin and send it to a renderer process
+  // when the plugin has updated it.
+  int input_type;
+  gfx::Rect caret_rect;
+  if (!delegate_->GetIMEStatus(&input_type, &caret_rect))
+    return;
+
+  Send(new PluginHostMsg_NotifyIMEStatus(route_id_, input_type, caret_rect));
+}
+#endif
+
 }  // namespace content
diff --git a/content/plugin/webplugin_proxy.h b/content/plugin/webplugin_proxy.h
index a3386a7..3703056 100644
--- a/content/plugin/webplugin_proxy.h
+++ b/content/plugin/webplugin_proxy.h
@@ -72,6 +72,10 @@ class WebPluginProxy : public WebPlugin,
   void DidStartLoading() override;
   void DidStopLoading() override;
   bool IsOffTheRecord() override;
+#if defined(OS_WIN)
+  void SetWindowlessData(HANDLE pump_messages_event,
+                         gfx::NativeViewId dummy_activation_window) override;
+#endif
 #if defined(OS_MACOSX)
   void FocusChanged(bool focused) override;
   void StartIme() override;
@@ -103,6 +107,14 @@ class WebPluginProxy : public WebPlugin,
   // Callback from the renderer to let us know that a paint occurred.
   void DidPaint();
 
+#if defined(OS_WIN) && !defined(USE_AURA)
+  // Retrieves the IME status from a windowless plugin and sends it to a
+  // renderer process. A renderer process will convert the coordinates from
+  // local to the window coordinates and send the converted coordinates to a
+  // browser process.
+  void UpdateIMEStatus();
+#endif
+
  private:
   class SharedTransportDIB : public base::RefCounted<SharedTransportDIB> {
    public:
diff --git a/content/renderer/npapi/webplugin_delegate_proxy.cc b/content/renderer/npapi/webplugin_delegate_proxy.cc
index d69fd40..2e80b85 100644
--- a/content/renderer/npapi/webplugin_delegate_proxy.cc
+++ b/content/renderer/npapi/webplugin_delegate_proxy.cc
@@ -108,6 +108,8 @@ WebPluginDelegateProxy::WebPluginDelegateProxy(
       uses_shared_bitmaps_(true),
 #if defined(OS_MACOSX)
       uses_compositor_(false),
+#elif defined(OS_WIN)
+      dummy_activation_window_(NULL),
 #endif
       mime_type_(mime_type),
       instance_id_(MSG_ROUTING_NONE),
@@ -130,12 +132,20 @@ WebPluginDelegateProxy::SharedBitmap::SharedBitmap() {}
 WebPluginDelegateProxy::SharedBitmap::~SharedBitmap() {}
 
 void WebPluginDelegateProxy::PluginDestroyed() {
-#if defined(OS_MACOSX)
+#if defined(OS_MACOSX) || defined(OS_WIN)
   // Ensure that the renderer doesn't think the plugin still has focus.
   if (render_view_)
     render_view_->PluginFocusChanged(false, instance_id_);
 #endif
 
+#if defined(OS_WIN)
+  if (dummy_activation_window_ && render_view_) {
+    render_view_->Send(new ViewHostMsg_WindowlessPluginDummyWindowDestroyed(
+        render_view_->GetRoutingID(), dummy_activation_window_));
+  }
+  dummy_activation_window_ = NULL;
+#endif
+
   if (render_view_.get())
     render_view_->UnregisterPluginDelegate(this);
 
@@ -294,6 +304,10 @@ bool WebPluginDelegateProxy::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(PluginHostMsg_CancelDocumentLoad, OnCancelDocumentLoad)
     IPC_MESSAGE_HANDLER(PluginHostMsg_DidStartLoading, OnDidStartLoading)
     IPC_MESSAGE_HANDLER(PluginHostMsg_DidStopLoading, OnDidStopLoading)
+#if defined(OS_WIN)
+    IPC_MESSAGE_HANDLER(PluginHostMsg_SetWindowlessData, OnSetWindowlessData)
+    IPC_MESSAGE_HANDLER(PluginHostMsg_NotifyIMEStatus, OnNotifyIMEStatus)
+#endif
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER(PluginHostMsg_FocusChanged,
                         OnFocusChanged);
@@ -321,7 +335,7 @@ void WebPluginDelegateProxy::OnChannelError() {
         info_.path, channel_host_->peer_pid());
   }
 
-#if defined(OS_MACOSX)
+#if defined(OS_MACOSX) || defined(OS_WIN)
   // Ensure that the renderer doesn't think the plugin still has focus.
   if (render_view_)
     render_view_->PluginFocusChanged(false, instance_id_);
@@ -577,6 +591,10 @@ bool WebPluginDelegateProxy::GetFormValue(base::string16* value) {
 
 void WebPluginDelegateProxy::SetFocus(bool focused) {
   Send(new PluginMsg_SetFocus(instance_id_, focused));
+#if defined(OS_WIN)
+  if (render_view_)
+    render_view_->PluginFocusChanged(focused, instance_id_);
+#endif
 }
 
 bool WebPluginDelegateProxy::HandleInputEvent(
@@ -584,7 +602,14 @@ bool WebPluginDelegateProxy::HandleInputEvent(
     WebCursor::CursorInfo* cursor_info) {
   bool handled = false;
   WebCursor cursor;
-  Send(new PluginMsg_HandleInputEvent(instance_id_, &event, &handled, &cursor));
+  // A windowless plugin can enter a modal loop in the context of a
+  // NPP_HandleEvent call, in which case we need to pump messages to
+  // the plugin. We pass of the corresponding event handle to the
+  // plugin process, which is set if the plugin does enter a modal loop.
+  IPC::SyncMessage* message = new PluginMsg_HandleInputEvent(
+      instance_id_, &event, &handled, &cursor);
+  message->set_pump_messages_event(modal_loop_pump_messages_event_.get());
+  Send(message);
   return handled;
 }
 
@@ -601,6 +626,35 @@ void WebPluginDelegateProxy::SetContentAreaFocus(bool has_focus) {
   Send(msg);
 }
 
+#if defined(OS_WIN)
+void WebPluginDelegateProxy::ImeCompositionUpdated(
+    const base::string16& text,
+    const std::vector<int>& clauses,
+    const std::vector<int>& target,
+    int cursor_position,
+    int plugin_id) {
+  // Dispatch the raw IME data if this plugin is the focused one.
+  if (instance_id_ != plugin_id)
+    return;
+
+  IPC::Message* msg = new PluginMsg_ImeCompositionUpdated(instance_id_,
+      text, clauses, target, cursor_position);
+  msg->set_unblock(true);
+  Send(msg);
+}
+
+void WebPluginDelegateProxy::ImeCompositionCompleted(const base::string16& text,
+                                                     int plugin_id) {
+  // Dispatch the IME text if this plugin is the focused one.
+  if (instance_id_ != plugin_id)
+    return;
+
+  IPC::Message* msg = new PluginMsg_ImeCompositionCompleted(instance_id_, text);
+  msg->set_unblock(true);
+  Send(msg);
+}
+#endif
+
 #if defined(OS_MACOSX)
 void WebPluginDelegateProxy::SetWindowFocus(bool window_has_focus) {
   IPC::Message* msg = new PluginMsg_SetWindowFocus(instance_id_,
@@ -652,6 +706,50 @@ void WebPluginDelegateProxy::ImeCompositionCompleted(const base::string16& text,
 }
 #endif  // OS_MACOSX
 
+#if defined(OS_WIN)
+void WebPluginDelegateProxy::OnSetWindowlessData(
+      HANDLE modal_loop_pump_messages_event_handle,
+      gfx::NativeViewId dummy_activation_window) {
+  DCHECK(!modal_loop_pump_messages_event_.get());
+  DCHECK(!dummy_activation_window_);
+  base::win::ScopedHandle modal_loop_pump_messages_event(
+      modal_loop_pump_messages_event_handle);
+
+  dummy_activation_window_ = dummy_activation_window;
+  render_view_->Send(new ViewHostMsg_WindowlessPluginDummyWindowCreated(
+      render_view_->GetRoutingID(), dummy_activation_window_));
+
+  // Bug 25583: this can be null because some "virus scanners" block the
+  // DuplicateHandle call in the plugin process.
+  if (!modal_loop_pump_messages_event.IsValid())
+    return;
+
+  modal_loop_pump_messages_event_.reset(
+      new base::WaitableEvent(std::move(modal_loop_pump_messages_event)));
+}
+
+void WebPluginDelegateProxy::OnNotifyIMEStatus(int input_type,
+                                               const gfx::Rect& caret_rect) {
+  if (!render_view_)
+    return;
+
+  ViewHostMsg_TextInputState_Params params;
+  params.type = static_cast<ui::TextInputType>(input_type);
+  params.mode = ui::TEXT_INPUT_MODE_DEFAULT;
+  params.can_compose_inline = true;
+  render_view_->Send(new ViewHostMsg_TextInputStateChanged(
+      render_view_->GetRoutingID(), params));
+
+  ViewHostMsg_SelectionBounds_Params bounds_params;
+  bounds_params.anchor_rect = bounds_params.focus_rect = caret_rect;
+  bounds_params.anchor_dir = bounds_params.focus_dir =
+      blink::WebTextDirectionLeftToRight;
+  bounds_params.is_anchor_first = true;
+  render_view_->Send(new ViewHostMsg_SelectionBoundsChanged(
+      render_view_->GetRoutingID(), bounds_params));
+}
+#endif
+
 void WebPluginDelegateProxy::OnInvalidateRect(const gfx::Rect& rect) {
   if (!plugin_)
     return;
diff --git a/content/renderer/npapi/webplugin_delegate_proxy.h b/content/renderer/npapi/webplugin_delegate_proxy.h
index d980de8..9e3643e 100644
--- a/content/renderer/npapi/webplugin_delegate_proxy.h
+++ b/content/renderer/npapi/webplugin_delegate_proxy.h
@@ -80,6 +80,19 @@ class WebPluginDelegateProxy
   // Informs the plugin that its containing content view has gained or lost
   // first responder status.
   virtual void SetContentAreaFocus(bool has_focus);
+#if defined(OS_WIN)
+  // Informs the plugin that plugin IME has updated its status.
+  virtual void ImeCompositionUpdated(
+      const base::string16& text,
+      const std::vector<int>& clauses,
+      const std::vector<int>& target,
+      int cursor_position,
+      int plugin_id);
+  // Informs the plugin that plugin IME has completed.
+  // If |text| is empty, composition was cancelled.
+  virtual void ImeCompositionCompleted(const base::string16& text,
+                                       int plugin_id);
+#endif
 #if defined(OS_MACOSX)
   // Informs the plugin that its enclosing window has gained or lost focus.
   virtual void SetWindowFocus(bool window_has_focus);
@@ -143,6 +156,11 @@ class WebPluginDelegateProxy
                                              uint32_t surface_id);
   void OnAcceleratedPluginSwappedIOSurface();
 #endif
+#if defined(OS_WIN)
+  void OnSetWindowlessData(HANDLE modal_loop_pump_messages_event_handle,
+                           gfx::NativeViewId dummy_activation_window);
+  void OnNotifyIMEStatus(const int input_mode, const gfx::Rect& caret_rect);
+#endif
   // Helper function that sends the UpdateGeometry message.
   void SendUpdateGeometry(bool bitmaps_changed);
 
@@ -208,6 +226,9 @@ class WebPluginDelegateProxy
   bool uses_shared_bitmaps_;
 #if defined(OS_MACOSX)
   bool uses_compositor_;
+#elif defined(OS_WIN)
+  // Used for windowless plugins so that keyboard activation works.
+  gfx::NativeViewId dummy_activation_window_;
 #endif
   scoped_refptr<PluginChannelHost> channel_host_;
   std::string mime_type_;
@@ -222,6 +243,10 @@ class WebPluginDelegateProxy
   // Dummy NPP used to uniquely identify this plugin.
   scoped_ptr<NPP_t> npp_;
 
+  // Event passed in by the plugin process and is used to decide if messages
+  // need to be pumped in the NPP_HandleEvent sync call.
+  scoped_ptr<base::WaitableEvent> modal_loop_pump_messages_event_;
+
   // Bitmap for crashed plugin
   SkBitmap* sad_plugin_;
 
diff --git a/content/renderer/npapi/webplugin_impl.h b/content/renderer/npapi/webplugin_impl.h
index 8d54cc3..3e695e6 100644
--- a/content/renderer/npapi/webplugin_impl.h
+++ b/content/renderer/npapi/webplugin_impl.h
@@ -110,6 +110,12 @@ class WebPluginImpl : public WebPlugin,
   void DidStartLoading() override;
   void DidStopLoading() override;
   bool IsOffTheRecord() override;
+#if defined(OS_WIN)
+  void SetWindowlessData(HANDLE pump_messages_event,
+                         gfx::NativeViewId dummy_activation_window) override {}
+  void ReparentPluginWindow(HWND window, HWND parent) { }
+  void ReportExecutableMemory(size_t size) { }
+#endif
 #if defined(OS_MACOSX)
   WebPluginAcceleratedSurface* GetAcceleratedSurface(
       gfx::GpuPreference gpu_preference) override;
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index a88549a..e5052e8 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -638,6 +638,9 @@ RenderViewImpl::RenderViewImpl(CompositorDependencies* compositor_deps,
 #if defined(OS_ANDROID)
       expected_content_intent_id_(0),
 #endif
+#if defined(OS_WIN)
+      focused_plugin_id_(-1),
+#endif
 #if defined(ENABLE_PLUGINS)
       focused_pepper_plugin_(NULL),
       pepper_last_mouse_event_target_(NULL),
@@ -1207,6 +1210,15 @@ void RenderViewImpl::UnregisterPluginDelegate(
   plugin_delegates_.erase(delegate);
 }
 
+#if defined(OS_WIN)
+void RenderViewImpl::PluginFocusChanged(bool focused, int plugin_id) {
+  if (focused)
+    focused_plugin_id_ = plugin_id;
+  else
+    focused_plugin_id_ = -1;
+}
+#endif
+
 #if defined(OS_MACOSX)
 void RenderViewImpl::PluginFocusChanged(bool focused, int plugin_id) {
   Send(new ViewHostMsg_PluginFocusChanged(GetRoutingID(), focused, plugin_id));
@@ -2914,6 +2926,32 @@ void RenderViewImpl::OnImeSetComposition(
         text, underlines, selection_start, selection_end);
     return;
   }
+
+#if defined(OS_WIN)
+  // When a plugin has focus, we create platform-specific IME data used by
+  // our IME emulator and send it directly to the focused plugin, i.e. we
+  // bypass WebKit. (WebPluginDelegate dispatches this IME data only when its
+  // instance ID is the same one as the specified ID.)
+  if (focused_plugin_id_ >= 0) {
+    std::vector<int> clauses;
+    std::vector<int> target;
+    for (size_t i = 0; i < underlines.size(); ++i) {
+      clauses.push_back(underlines[i].startOffset);
+      clauses.push_back(underlines[i].endOffset);
+      if (underlines[i].thick) {
+        target.clear();
+        target.push_back(underlines[i].startOffset);
+        target.push_back(underlines[i].endOffset);
+      }
+    }
+    std::set<WebPluginDelegateProxy*>::iterator it;
+    for (it = plugin_delegates_.begin(); it != plugin_delegates_.end(); ++it) {
+      (*it)->ImeCompositionUpdated(text, clauses, target, selection_end,
+                                   focused_plugin_id_);
+    }
+    return;
+  }
+#endif  // OS_WIN
 #endif  // ENABLE_PLUGINS
   if (replacement_range.IsValid() && webview()) {
     // Select the text in |replacement_range|, it will then be replaced by
@@ -2942,6 +2980,20 @@ void RenderViewImpl::OnImeConfirmComposition(
         text, replacement_range, keep_selection);
     return;
   }
+#if defined(OS_WIN)
+  // Same as OnImeSetComposition(), we send the text from IMEs directly to
+  // plugins. When we send IME text directly to plugins, we should not send
+  // it to WebKit to prevent WebKit from controlling IMEs.
+  // TODO(thakis): Honor |replacement_range| for plugins?
+  if (focused_plugin_id_ >= 0) {
+    std::set<WebPluginDelegateProxy*>::iterator it;
+    for (it = plugin_delegates_.begin();
+          it != plugin_delegates_.end(); ++it) {
+      (*it)->ImeCompositionCompleted(text, focused_plugin_id_);
+    }
+    return;
+  }
+#endif  // OS_WIN
 #endif  // ENABLE_PLUGINS
   if (replacement_range.IsValid() && webview()) {
     // Select the text in |replacement_range|, it will then be replaced by
diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
index b8df750..d508b9f 100644
--- a/content/renderer/render_view_impl.h
+++ b/content/renderer/render_view_impl.h
@@ -258,10 +258,12 @@ class CONTENT_EXPORT RenderViewImpl
     pepper_last_mouse_event_target_ = plugin;
   }
 
-#if defined(OS_MACOSX)
+#if defined(OS_MACOSX) || defined(OS_WIN)
   // Informs the render view that the given plugin has gained or lost focus.
   void PluginFocusChanged(bool focused, int plugin_id);
+#endif
 
+#if defined(OS_MACOSX)
   // Starts plugin IME.
   void StartPluginIme();
 #endif
@@ -940,6 +942,11 @@ class CONTENT_EXPORT RenderViewImpl
   // location or tab focus and visibily. These are non-owning references.
   std::set<WebPluginDelegateProxy*> plugin_delegates_;
 
+#if defined(OS_WIN)
+  // The ID of the focused NPAPI plugin.
+  int focused_plugin_id_;
+#endif
+
 #if defined(ENABLE_PLUGINS)
   typedef std::set<PepperPluginInstanceImpl*> PepperPluginSet;
   PepperPluginSet active_pepper_instances_;
diff --git a/content/test/test_render_view_host.cc b/content/test/test_render_view_host.cc
index 761ae47..bb5999e 100644
--- a/content/test/test_render_view_host.cc
+++ b/content/test/test_render_view_host.cc
@@ -205,6 +205,11 @@ void TestRenderWidgetHostView::UnlockMouse() {
 void TestRenderWidgetHostView::SetParentNativeViewAccessible(
     gfx::NativeViewAccessible accessible_parent) {
 }
+
+gfx::NativeViewId TestRenderWidgetHostView::GetParentForWindowlessPlugin()
+    const {
+  return 0;
+}
 #endif
 
 TestRenderViewHost::TestRenderViewHost(SiteInstance* instance,
diff --git a/content/test/test_render_view_host.h b/content/test/test_render_view_host.h
index 1291ab4..5dbcd3e 100644
--- a/content/test/test_render_view_host.h
+++ b/content/test/test_render_view_host.h
@@ -138,6 +138,7 @@ class TestRenderWidgetHostView : public RenderWidgetHostViewBase {
 #if defined(OS_WIN)
   void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) override;
+  gfx::NativeViewId GetParentForWindowlessPlugin() const override;
 #endif
 
   bool is_showing() const { return is_showing_; }