Introduce PPB_Flash_Font.

It is a subset of PPB_PDF and shares the implementation with some PPB_PDF methods. With this interface, Pepper Flash doesn't need to depend on PPB_PDF.

BUG=None
TEST=None

Review URL: https://codereview.chromium.org/10905227

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@160861 0039d316-1c4b-4281-b951-d872f2087c98

39 files changed, 793 insertions, 83 deletions

diff --git a/chrome/chrome_renderer.gypi b/chrome/chrome_renderer.gypi
index 722ac31..42a727f 100644
--- a/chrome/chrome_renderer.gypi
+++ b/chrome/chrome_renderer.gypi
@@ -202,6 +202,8 @@
         'renderer/pepper/chrome_ppapi_interfaces.h',
         'renderer/pepper/chrome_renderer_pepper_host_factory.cc',
         'renderer/pepper/chrome_renderer_pepper_host_factory.h',
+        'renderer/pepper/pepper_flash_font_file_host.cc',
+        'renderer/pepper/pepper_flash_font_file_host.h',
         'renderer/pepper/pepper_flash_renderer_message_filter.cc',
         'renderer/pepper/pepper_flash_renderer_message_filter.h',
         'renderer/pepper/pepper_helper.cc',
diff --git a/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.cc b/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.cc
index ebdf6ba..f40d43d 100644
--- a/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.cc
+++ b/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.cc
@@ -4,14 +4,21 @@
 
 #include "chrome/renderer/pepper/chrome_renderer_pepper_host_factory.h"
 
+#include "base/logging.h"
+#include "chrome/renderer/pepper/pepper_flash_font_file_host.h"
+#include "content/public/renderer/renderer_ppapi_host.h"
+#include "ppapi/host/ppapi_host.h"
 #include "ppapi/host/resource_host.h"
 #include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/shared_impl/ppapi_permissions.h"
 
 using ppapi::host::ResourceHost;
 
 namespace chrome {
 
-ChromeRendererPepperHostFactory::ChromeRendererPepperHostFactory() {
+ChromeRendererPepperHostFactory::ChromeRendererPepperHostFactory(
+    content::RendererPpapiHost* host)
+    : host_(host) {
 }
 
 ChromeRendererPepperHostFactory::~ChromeRendererPepperHostFactory() {
@@ -23,7 +30,25 @@ ChromeRendererPepperHostFactory::CreateResourceHost(
     const ppapi::proxy::ResourceMessageCallParams& params,
     PP_Instance instance,
     const IPC::Message& message) {
-  // There are no Chrome-side implementations of resources.
+  DCHECK(host == host_->GetPpapiHost());
+
+  // Make sure the plugin is giving us a valid instance for this resource.
+  if (!host_->IsValidInstance(instance))
+    return scoped_ptr<ResourceHost>();
+
+  if (host_->GetPpapiHost()->permissions().HasPermission(
+      ppapi::PERMISSION_FLASH)) {
+    switch (message.type()) {
+      case PpapiHostMsg_FlashFontFile_Create::ID:
+        PpapiHostMsg_FlashFontFile_Create::Param param;
+        if (PpapiHostMsg_FlashFontFile_Create::Read(&message, &param)) {
+          return scoped_ptr<ResourceHost>(new PepperFlashFontFileHost(
+              host_, instance, params.pp_resource(), param.a, param.b));
+        }
+        break;
+    }
+  }
+
   return scoped_ptr<ResourceHost>();
 }
 
diff --git a/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.h b/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.h
index 18d609c..0dfba86 100644
--- a/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.h
+++ b/chrome/renderer/pepper/chrome_renderer_pepper_host_factory.h
@@ -5,17 +5,19 @@
 #ifndef CHROME_RENDERER_PEPPER_CHROME_RENDERER_PEPPER_HOST_FACTORY_H_
 #define CHROME_RENDERER_PEPPER_CHROME_RENDERER_PEPPER_HOST_FACTORY_H_
 
+#include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "ppapi/host/host_factory.h"
-#include "ppapi/shared_impl/ppapi_permissions.h"
 
-namespace chrome {
+namespace content {
+class RendererPpapiHost;
+}
 
-class PepperInstanceStateAccessor;
+namespace chrome {
 
 class ChromeRendererPepperHostFactory : public ppapi::host::HostFactory {
  public:
-  ChromeRendererPepperHostFactory();
+  explicit ChromeRendererPepperHostFactory(content::RendererPpapiHost* host);
   virtual ~ChromeRendererPepperHostFactory();
 
   // HostFactory.
@@ -26,6 +28,9 @@ class ChromeRendererPepperHostFactory : public ppapi::host::HostFactory {
       const IPC::Message& message) OVERRIDE;
 
  private:
+  // Not owned by this object.
+  content::RendererPpapiHost* host_;
+
   DISALLOW_COPY_AND_ASSIGN(ChromeRendererPepperHostFactory);
 };
 
diff --git a/chrome/renderer/pepper/pepper_flash_font_file_host.cc b/chrome/renderer/pepper/pepper_flash_font_file_host.cc
new file mode 100644
index 0000000..416d426
--- /dev/null
+++ b/chrome/renderer/pepper/pepper_flash_font_file_host.cc
@@ -0,0 +1,77 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/renderer/pepper/pepper_flash_font_file_host.h"
+
+#include "build/build_config.h"
+#include "content/public/renderer/renderer_ppapi_host.h"
+#include "ppapi/c/pp_errors.h"
+#include "ppapi/host/dispatch_host_message.h"
+#include "ppapi/host/host_message_context.h"
+#include "ppapi/host/ppapi_host.h"
+#include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/proxy/serialized_structs.h"
+
+#if defined(OS_LINUX) || defined(OS_OPENBSD)
+#include "content/public/common/child_process_sandbox_support_linux.h"
+#endif
+
+namespace chrome {
+
+PepperFlashFontFileHost::PepperFlashFontFileHost(
+    content::RendererPpapiHost* host,
+    PP_Instance instance,
+    PP_Resource resource,
+    const ppapi::proxy::SerializedFontDescription& description,
+    PP_PrivateFontCharset charset)
+    : ResourceHost(host->GetPpapiHost(), instance, resource),
+      renderer_ppapi_host_(host),
+      fd_(-1) {
+#if defined(OS_LINUX) || defined(OS_OPENBSD)
+  fd_ = content::MatchFontWithFallback(
+      description.face.c_str(), description.weight >= PP_FONTWEIGHT_BOLD,
+      description.italic, charset);
+#endif  // defined(OS_LINUX) || defined(OS_OPENBSD)
+}
+
+PepperFlashFontFileHost::~PepperFlashFontFileHost() {
+}
+
+int32_t PepperFlashFontFileHost::OnResourceMessageReceived(
+    const IPC::Message& msg,
+    ppapi::host::HostMessageContext* context) {
+  IPC_BEGIN_MESSAGE_MAP(PepperFlashFontFileHost, msg)
+    PPAPI_DISPATCH_HOST_RESOURCE_CALL(PpapiHostMsg_FlashFontFile_GetFontTable,
+                                      OnMsgGetFontTable)
+  IPC_END_MESSAGE_MAP()
+  return PP_ERROR_FAILED;
+}
+
+int32_t PepperFlashFontFileHost::OnMsgGetFontTable(
+    ppapi::host::HostMessageContext* context,
+    uint32_t table) {
+  std::string contents;
+  int32_t result = PP_ERROR_FAILED;
+#if defined(OS_LINUX) || defined(OS_OPENBSD)
+  if (fd_ != -1) {
+    size_t length = 0;
+    if (content::GetFontTable(fd_, table, NULL, &length)) {
+      contents.resize(length);
+      uint8_t* contents_ptr =
+          reinterpret_cast<uint8_t*>(const_cast<char*>(contents.c_str()));
+      if (content::GetFontTable(fd_, table, contents_ptr, &length)) {
+        result = PP_OK;
+      } else {
+        contents.clear();
+      }
+    }
+  }
+#endif  // defined(OS_LINUX) || defined(OS_OPENBSD)
+
+  context->reply_msg = PpapiPluginMsg_FlashFontFile_GetFontTableReply(contents);
+  return result;
+}
+
+}  // namespace chrome
+
diff --git a/chrome/renderer/pepper/pepper_flash_font_file_host.h b/chrome/renderer/pepper/pepper_flash_font_file_host.h
new file mode 100644
index 0000000..3ea884a
--- /dev/null
+++ b/chrome/renderer/pepper/pepper_flash_font_file_host.h
@@ -0,0 +1,53 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_RENDERER_PEPPER_PEPPER_FLASH_FONT_FILE_HOST_H_
+#define CHROME_RENDERER_PEPPER_PEPPER_FLASH_FONT_FILE_HOST_H_
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
+#include "ppapi/host/resource_host.h"
+
+namespace content {
+class RendererPpapiHost;
+}
+
+namespace ppapi {
+namespace proxy {
+struct SerializedFontDescription;
+}
+}
+
+namespace chrome {
+
+class PepperFlashFontFileHost : public ppapi::host::ResourceHost {
+ public:
+  PepperFlashFontFileHost(
+      content::RendererPpapiHost* host,
+      PP_Instance instance,
+      PP_Resource resource,
+      const ppapi::proxy::SerializedFontDescription& description,
+      PP_PrivateFontCharset charset);
+  virtual ~PepperFlashFontFileHost();
+
+  virtual int32_t OnResourceMessageReceived(
+      const IPC::Message& msg,
+      ppapi::host::HostMessageContext* context) OVERRIDE;
+
+ private:
+  int32_t OnMsgGetFontTable(ppapi::host::HostMessageContext* context,
+                            uint32_t table);
+
+  // Non-owning pointer.
+  content::RendererPpapiHost* renderer_ppapi_host_;
+  // Only valid on Linux.
+  int fd_;
+
+  DISALLOW_COPY_AND_ASSIGN(PepperFlashFontFileHost);
+};
+
+}  // namespace chrome
+
+#endif  // CHROME_RENDERER_PEPPER_PEPPER_FLASH_FONT_FILE_HOST_H_
diff --git a/chrome/renderer/pepper/pepper_helper.cc b/chrome/renderer/pepper/pepper_helper.cc
index 73ac2b6..4d2cff7 100644
--- a/chrome/renderer/pepper/pepper_helper.cc
+++ b/chrome/renderer/pepper/pepper_helper.cc
@@ -23,7 +23,7 @@ void PepperHelper::DidCreatePepperPlugin(content::RendererPpapiHost* host) {
   // kind of filter-like system to allow dynamic additions.
   host->GetPpapiHost()->AddHostFactoryFilter(
       scoped_ptr<ppapi::host::HostFactory>(
-          new ChromeRendererPepperHostFactory));
+          new ChromeRendererPepperHostFactory(host)));
   host->GetPpapiHost()->AddInstanceMessageFilter(
       scoped_ptr<ppapi::host::InstanceMessageFilter>(
           new PepperFlashRendererMessageFilter(host)));
diff --git a/ppapi/api/private/pp_private_font_charset.idl b/ppapi/api/private/pp_private_font_charset.idl
new file mode 100644
index 0000000..36e605a
--- /dev/null
+++ b/ppapi/api/private/pp_private_font_charset.idl
@@ -0,0 +1,27 @@
+/* Copyright (c) 2012 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+[assert_size(4)]
+enum PP_PrivateFontCharset {
+  PP_PRIVATEFONTCHARSET_ANSI = 0,
+  PP_PRIVATEFONTCHARSET_DEFAULT = 1,
+  PP_PRIVATEFONTCHARSET_SYMBOL = 2,
+  PP_PRIVATEFONTCHARSET_MAC = 77,
+  PP_PRIVATEFONTCHARSET_SHIFTJIS = 128,
+  PP_PRIVATEFONTCHARSET_HANGUL = 129,
+  PP_PRIVATEFONTCHARSET_JOHAB = 130,
+  PP_PRIVATEFONTCHARSET_GB2312 =134,
+  PP_PRIVATEFONTCHARSET_CHINESEBIG5 = 136,
+  PP_PRIVATEFONTCHARSET_GREEK = 161,
+  PP_PRIVATEFONTCHARSET_TURKISH = 162,
+  PP_PRIVATEFONTCHARSET_VIETNAMESE = 163,
+  PP_PRIVATEFONTCHARSET_HEBREW = 177,
+  PP_PRIVATEFONTCHARSET_ARABIC = 178,
+  PP_PRIVATEFONTCHARSET_BALTIC = 186,
+  PP_PRIVATEFONTCHARSET_RUSSIAN = 204,
+  PP_PRIVATEFONTCHARSET_THAI = 222,
+  PP_PRIVATEFONTCHARSET_EASTEUROPE = 238,
+  PP_PRIVATEFONTCHARSET_OEM = 255
+};
diff --git a/ppapi/api/private/ppb_flash_font_file.idl b/ppapi/api/private/ppb_flash_font_file.idl
new file mode 100644
index 0000000..51309f1
--- /dev/null
+++ b/ppapi/api/private/ppb_flash_font_file.idl
@@ -0,0 +1,39 @@
+/* Copyright (c) 2012 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/**
+ * This file contains the <code>PPB_Flash_FontFile</code> interface.
+ */
+
+label Chrome {
+  M24 = 0.1
+};
+
+interface PPB_Flash_FontFile {
+  /* Returns a resource identifying a font file corresponding to the given font
+   * request after applying the browser-specific fallback.
+   */
+  PP_Resource Create(
+      [in] PP_Instance instance,
+      [in] PP_FontDescription_Dev description,
+      [in] PP_PrivateFontCharset charset);
+
+  /* Determines if a given resource is Flash font file.
+   */
+  PP_Bool IsFlashFontFile([in] PP_Resource resource);
+
+  /* Returns the requested font table.
+   * |output_length| should pass in the size of |output|. And it will return
+   * the actual length of returned data. |output| could be NULL in order to
+   * query the size of the buffer size needed. In that case, the input value of
+   * |output_length| is ignored.
+   * Note: it is Linux only and fails directly on other platforms.
+   */
+  PP_Bool GetFontTable(
+      [in] PP_Resource font_file,
+      [in] uint32_t table,
+      [out] mem_t output,
+      [out] uint32_t output_length);
+};
diff --git a/ppapi/c/private/pp_private_font_charset.h b/ppapi/c/private/pp_private_font_charset.h
new file mode 100644
index 0000000..300be93
--- /dev/null
+++ b/ppapi/c/private/pp_private_font_charset.h
@@ -0,0 +1,51 @@
+/* Copyright (c) 2012 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/* From private/pp_private_font_charset.idl,
+ *   modified Fri Sep 07 12:50:35 2012.
+ */
+
+#ifndef PPAPI_C_PRIVATE_PP_PRIVATE_FONT_CHARSET_H_
+#define PPAPI_C_PRIVATE_PP_PRIVATE_FONT_CHARSET_H_
+
+#include "ppapi/c/pp_macros.h"
+
+/**
+ * @file
+ */
+
+
+/**
+ * @addtogroup Enums
+ * @{
+ */
+typedef enum {
+  PP_PRIVATEFONTCHARSET_ANSI = 0,
+  PP_PRIVATEFONTCHARSET_DEFAULT = 1,
+  PP_PRIVATEFONTCHARSET_SYMBOL = 2,
+  PP_PRIVATEFONTCHARSET_MAC = 77,
+  PP_PRIVATEFONTCHARSET_SHIFTJIS = 128,
+  PP_PRIVATEFONTCHARSET_HANGUL = 129,
+  PP_PRIVATEFONTCHARSET_JOHAB = 130,
+  PP_PRIVATEFONTCHARSET_GB2312 = 134,
+  PP_PRIVATEFONTCHARSET_CHINESEBIG5 = 136,
+  PP_PRIVATEFONTCHARSET_GREEK = 161,
+  PP_PRIVATEFONTCHARSET_TURKISH = 162,
+  PP_PRIVATEFONTCHARSET_VIETNAMESE = 163,
+  PP_PRIVATEFONTCHARSET_HEBREW = 177,
+  PP_PRIVATEFONTCHARSET_ARABIC = 178,
+  PP_PRIVATEFONTCHARSET_BALTIC = 186,
+  PP_PRIVATEFONTCHARSET_RUSSIAN = 204,
+  PP_PRIVATEFONTCHARSET_THAI = 222,
+  PP_PRIVATEFONTCHARSET_EASTEUROPE = 238,
+  PP_PRIVATEFONTCHARSET_OEM = 255
+} PP_PrivateFontCharset;
+PP_COMPILE_ASSERT_SIZE_IN_BYTES(PP_PrivateFontCharset, 4);
+/**
+ * @}
+ */
+
+#endif  /* PPAPI_C_PRIVATE_PP_PRIVATE_FONT_CHARSET_H_ */
+
diff --git a/ppapi/c/private/ppb_flash_font_file.h b/ppapi/c/private/ppb_flash_font_file.h
new file mode 100644
index 0000000..53bbfda
--- /dev/null
+++ b/ppapi/c/private/ppb_flash_font_file.h
@@ -0,0 +1,62 @@
+/* Copyright (c) 2012 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/* From private/ppb_flash_font_file.idl modified Mon Oct 08 10:46:09 2012. */
+
+#ifndef PPAPI_C_PRIVATE_PPB_FLASH_FONT_FILE_H_
+#define PPAPI_C_PRIVATE_PPB_FLASH_FONT_FILE_H_
+
+#include "ppapi/c/dev/ppb_font_dev.h"
+#include "ppapi/c/pp_bool.h"
+#include "ppapi/c/pp_instance.h"
+#include "ppapi/c/pp_macros.h"
+#include "ppapi/c/pp_resource.h"
+#include "ppapi/c/pp_stdint.h"
+#include "ppapi/c/pp_var.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
+
+#define PPB_FLASH_FONTFILE_INTERFACE_0_1 "PPB_Flash_FontFile;0.1"
+#define PPB_FLASH_FONTFILE_INTERFACE PPB_FLASH_FONTFILE_INTERFACE_0_1
+
+/**
+ * @file
+ * This file contains the <code>PPB_Flash_FontFile</code> interface.
+ */
+
+
+/**
+ * @addtogroup Interfaces
+ * @{
+ */
+struct PPB_Flash_FontFile_0_1 {
+  /* Returns a resource identifying a font file corresponding to the given font
+   * request after applying the browser-specific fallback.
+   */
+  PP_Resource (*Create)(PP_Instance instance,
+                        const struct PP_FontDescription_Dev* description,
+                        PP_PrivateFontCharset charset);
+  /* Determines if a given resource is Flash font file.
+   */
+  PP_Bool (*IsFlashFontFile)(PP_Resource resource);
+  /* Returns the requested font table.
+   * |output_length| should pass in the size of |output|. And it will return
+   * the actual length of returned data. |output| could be NULL in order to
+   * query the size of the buffer size needed. In that case, the input value of
+   * |output_length| is ignored.
+   * Note: it is Linux only and fails directly on other platforms.
+   */
+  PP_Bool (*GetFontTable)(PP_Resource font_file,
+                          uint32_t table,
+                          void* output,
+                          uint32_t* output_length);
+};
+
+typedef struct PPB_Flash_FontFile_0_1 PPB_Flash_FontFile;
+/**
+ * @}
+ */
+
+#endif  /* PPAPI_C_PRIVATE_PPB_FLASH_FONT_FILE_H_ */
+
diff --git a/ppapi/c/private/ppb_pdf.h b/ppapi/c/private/ppb_pdf.h
index 8ef076d..86203d1 100644
--- a/ppapi/c/private/ppb_pdf.h
+++ b/ppapi/c/private/ppb_pdf.h
@@ -10,6 +10,7 @@
 #include "ppapi/c/pp_instance.h"
 #include "ppapi/c/pp_resource.h"
 #include "ppapi/c/pp_var.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
 
 #define PPB_PDF_INTERFACE "PPB_PDF;1"
 
@@ -72,28 +73,6 @@ typedef enum {
 } PP_ResourceImage;
 
 typedef enum {
-  PP_PRIVATEFONTCHARSET_ANSI = 0,
-  PP_PRIVATEFONTCHARSET_DEFAULT = 1,
-  PP_PRIVATEFONTCHARSET_SYMBOL = 2,
-  PP_PRIVATEFONTCHARSET_MAC = 77,
-  PP_PRIVATEFONTCHARSET_SHIFTJIS = 128,
-  PP_PRIVATEFONTCHARSET_HANGUL = 129,
-  PP_PRIVATEFONTCHARSET_JOHAB = 130,
-  PP_PRIVATEFONTCHARSET_GB2312 =134,
-  PP_PRIVATEFONTCHARSET_CHINESEBIG5 = 136,
-  PP_PRIVATEFONTCHARSET_GREEK = 161,
-  PP_PRIVATEFONTCHARSET_TURKISH = 162,
-  PP_PRIVATEFONTCHARSET_VIETNAMESE = 163,
-  PP_PRIVATEFONTCHARSET_HEBREW = 177,
-  PP_PRIVATEFONTCHARSET_ARABIC = 178,
-  PP_PRIVATEFONTCHARSET_BALTIC = 186,
-  PP_PRIVATEFONTCHARSET_RUSSIAN = 204,
-  PP_PRIVATEFONTCHARSET_THAI = 222,
-  PP_PRIVATEFONTCHARSET_EASTEUROPE = 238,
-  PP_PRIVATEFONTCHARSET_OEM = 255
-} PP_PrivateFontCharset;
-
-typedef enum {
   PP_PDFFEATURE_HIDPI = 0
 } PP_PDFFeature;
 
diff --git a/ppapi/cpp/private/flash_font_file.cc b/ppapi/cpp/private/flash_font_file.cc
new file mode 100644
index 0000000..284761b
--- /dev/null
+++ b/ppapi/cpp/private/flash_font_file.cc
@@ -0,0 +1,66 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/cpp/private/flash_font_file.h"
+
+#include "ppapi/c/dev/ppb_font_dev.h"
+#include "ppapi/c/private/ppb_flash_font_file.h"
+#include "ppapi/c/private/ppb_pdf.h"
+#include "ppapi/cpp/instance_handle.h"
+#include "ppapi/cpp/module_impl.h"
+
+namespace pp {
+
+namespace {
+
+// TODO(yzshen): Once PPB_Flash_FontFile gets to the stable channel, we can
+// remove the code of using PPB_PDF in this file.
+template <> const char* interface_name<PPB_PDF>() {
+  return PPB_PDF_INTERFACE;
+}
+
+template <> const char* interface_name<PPB_Flash_FontFile_0_1>() {
+  return PPB_FLASH_FONTFILE_INTERFACE_0_1;
+}
+
+}  // namespace
+
+namespace flash {
+
+FontFile::FontFile(const InstanceHandle& instance,
+                   const PP_FontDescription_Dev* description,
+                   PP_PrivateFontCharset charset) : Resource() {
+  if (has_interface<PPB_Flash_FontFile_0_1>()) {
+    PassRefFromConstructor(get_interface<PPB_Flash_FontFile_0_1>()->Create(
+        instance.pp_instance(), description, charset));
+  } else if (has_interface<PPB_PDF>()) {
+    PassRefFromConstructor(get_interface<PPB_PDF>()->GetFontFileWithFallback(
+        instance.pp_instance(), description, charset));
+  }
+}
+
+FontFile::~FontFile() {
+}
+
+// static
+bool FontFile::IsAvailable() {
+  return has_interface<PPB_Flash_FontFile_0_1>() || has_interface<PPB_PDF>();
+}
+
+bool FontFile::GetFontTable(uint32_t table,
+                            void* output,
+                            uint32_t* output_length) {
+  if (has_interface<PPB_Flash_FontFile_0_1>()) {
+    return !!get_interface<PPB_Flash_FontFile_0_1>()->
+        GetFontTable(pp_resource(), table, output, output_length);
+  }
+  if (has_interface<PPB_PDF>()) {
+    return get_interface<PPB_PDF>()->GetFontTableForPrivateFontFile(
+        pp_resource(), table, output, output_length);
+  }
+  return false;
+}
+
+}  // namespace flash
+}  // namespace pp
diff --git a/ppapi/cpp/private/flash_font_file.h b/ppapi/cpp/private/flash_font_file.h
new file mode 100644
index 0000000..034c2fc
--- /dev/null
+++ b/ppapi/cpp/private/flash_font_file.h
@@ -0,0 +1,35 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_CPP_PRIVATE_FLASH_FONT_FILE_H_
+#define PPAPI_CPP_PRIVATE_FLASH_FONT_FILE_H_
+
+#include "ppapi/c/private/pp_private_font_charset.h"
+#include "ppapi/cpp/resource.h"
+
+struct PP_FontDescription_Dev;
+
+namespace pp {
+
+class InstanceHandle;
+
+namespace flash {
+
+class FontFile : public Resource {
+ public:
+  FontFile(const InstanceHandle& instance,
+           const PP_FontDescription_Dev* description,
+           PP_PrivateFontCharset charset);
+  virtual ~FontFile();
+
+  // Returns true if the required interface is available.
+  static bool IsAvailable();
+
+  bool GetFontTable(uint32_t table, void* output, uint32_t* output_length);
+};
+
+}  // namespace flash
+}  // namespace pp
+
+#endif  // PPAPI_CPP_PRIVATE_FLASH_FONT_FILE_H_
diff --git a/ppapi/native_client/src/untrusted/pnacl_irt_shim/pnacl_shim.c b/ppapi/native_client/src/untrusted/pnacl_irt_shim/pnacl_shim.c
index 75256be..b1c4e16 100644
--- a/ppapi/native_client/src/untrusted/pnacl_irt_shim/pnacl_shim.c
+++ b/ppapi/native_client/src/untrusted/pnacl_irt_shim/pnacl_shim.c
@@ -3,7 +3,7 @@
  * found in the LICENSE file.
  */
 
-/* Last generated from IDL: Mon Oct  8 10:50:14 2012. */
+/* Last generated from IDL: Mon Oct  8 16:28:58 2012. */
 #include "ppapi/generators/pnacl_shim.h"
 
 #include "ppapi/c/ppb.h"
@@ -70,6 +70,7 @@
 #include "ppapi/c/private/ppb_flash.h"
 #include "ppapi/c/private/ppb_flash_clipboard.h"
 #include "ppapi/c/private/ppb_flash_device_id.h"
+#include "ppapi/c/private/ppb_flash_font_file.h"
 #include "ppapi/c/private/ppb_flash_fullscreen.h"
 #include "ppapi/c/private/ppb_flash_message_loop.h"
 #include "ppapi/c/private/ppb_flash_print.h"
@@ -212,6 +213,7 @@ static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_12_5;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_Clipboard_3_0;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_Clipboard_4_0;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_DeviceID_1_0;
+static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_FontFile_0_1;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_FlashFullscreen_0_1;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_FlashFullscreen_1_0;
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_MessageLoop_0_1;
@@ -2564,6 +2566,8 @@ int32_t Pnacl_M21_PPB_Flash_DeviceID_GetDeviceID(PP_Resource device_id, struct P
 
 /* End wrapper methods for PPB_Flash_DeviceID_1_0 */
 
+/* Not generating wrapper methods for PPB_Flash_FontFile_0_1 */
+
 /* Not generating wrapper methods for PPB_FlashFullscreen_0_1 */
 
 /* Not generating wrapper methods for PPB_FlashFullscreen_1_0 */
@@ -3947,6 +3951,8 @@ struct PPB_Flash_DeviceID_1_0 Pnacl_Wrappers_PPB_Flash_DeviceID_1_0 = {
     .GetDeviceID = (int32_t (*)(PP_Resource device_id, struct PP_Var* id, struct PP_CompletionCallback callback))&Pnacl_M21_PPB_Flash_DeviceID_GetDeviceID
 };
 
+/* Not generating wrapper interface for PPB_Flash_FontFile_0_1 */
+
 /* Not generating wrapper interface for PPB_FlashFullscreen_0_1 */
 
 /* Not generating wrapper interface for PPB_FlashFullscreen_1_0 */
@@ -4740,6 +4746,12 @@ static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_DeviceID_1_0 = {
   .real_iface = NULL
 };
 
+static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_Flash_FontFile_0_1 = {
+  .iface_macro = PPB_FLASH_FONTFILE_INTERFACE_0_1,
+  .wrapped_iface = NULL /* Still need slot for real_iface */,
+  .real_iface = NULL
+};
+
 static struct __PnaclWrapperInfo Pnacl_WrapperInfo_PPB_FlashFullscreen_0_1 = {
   .iface_macro = PPB_FLASHFULLSCREEN_INTERFACE_0_1,
   .wrapped_iface = NULL /* Still need slot for real_iface */,
@@ -4984,6 +4996,7 @@ static struct __PnaclWrapperInfo *s_ppb_wrappers[] = {
   &Pnacl_WrapperInfo_PPB_Flash_Clipboard_3_0,
   &Pnacl_WrapperInfo_PPB_Flash_Clipboard_4_0,
   &Pnacl_WrapperInfo_PPB_Flash_DeviceID_1_0,
+  &Pnacl_WrapperInfo_PPB_Flash_FontFile_0_1,
   &Pnacl_WrapperInfo_PPB_FlashFullscreen_0_1,
   &Pnacl_WrapperInfo_PPB_FlashFullscreen_1_0,
   &Pnacl_WrapperInfo_PPB_Flash_MessageLoop_0_1,
diff --git a/ppapi/ppapi_proxy.gypi b/ppapi/ppapi_proxy.gypi
index a483945..ba6c030 100644
--- a/ppapi/ppapi_proxy.gypi
+++ b/ppapi/ppapi_proxy.gypi
@@ -29,6 +29,8 @@
           'proxy/file_chooser_resource.h',
           'proxy/flash_device_id_resource.cc',
           'proxy/flash_device_id_resource.h',
+          'proxy/flash_font_file_resource.cc',
+          'proxy/flash_font_file_resource.h',
           'proxy/gamepad_resource.cc',
           'proxy/gamepad_resource.h',
           'proxy/host_dispatcher.cc',
@@ -170,13 +172,14 @@
             'sources!': [
               'proxy/broker_dispatcher.cc',
               'proxy/flash_device_id_resource.cc',
+              'proxy/flash_font_file_resource.cc',
               'proxy/ppb_audio_input_proxy.cc',
               'proxy/ppb_broker_proxy.cc',
               'proxy/ppb_buffer_proxy.cc',
               'proxy/ppb_file_chooser_proxy.cc',
-              'proxy/ppb_flash_proxy.cc',
               'proxy/ppb_flash_menu_proxy.cc',
               'proxy/ppb_flash_message_loop_proxy.cc',
+              'proxy/ppb_flash_proxy.cc',
               'proxy/ppb_pdf_proxy.cc',
               'proxy/ppb_talk_private_proxy.cc',
               'proxy/ppb_video_capture_proxy.cc',
diff --git a/ppapi/ppapi_shared.gypi b/ppapi/ppapi_shared.gypi
index 3bcec1d..95d61dd 100644
--- a/ppapi/ppapi_shared.gypi
+++ b/ppapi/ppapi_shared.gypi
@@ -168,6 +168,8 @@
           'thunk/ppb_flash_device_id_thunk.cc',
           'thunk/ppb_flash_file_fileref_thunk.cc',
           'thunk/ppb_flash_file_modulelocal_thunk.cc',
+          'thunk/ppb_flash_font_file_api.h',
+          'thunk/ppb_flash_font_file_thunk.cc',
           'thunk/ppb_flash_fullscreen_thunk.cc',
           'thunk/ppb_flash_menu_api.h',
           'thunk/ppb_flash_menu_thunk.cc',
@@ -271,6 +273,7 @@
               'thunk/ppb_flash_device_id_thunk.cc',
               'thunk/ppb_flash_file_fileref_thunk.cc',
               'thunk/ppb_flash_file_modulelocal_thunk.cc',
+              'thunk/ppb_flash_font_file_thunk.cc',
               'thunk/ppb_flash_fullscreen_thunk.cc',
               'thunk/ppb_flash_menu_thunk.cc',
               'thunk/ppb_flash_message_loop_thunk.cc',
diff --git a/ppapi/ppapi_sources.gypi b/ppapi/ppapi_sources.gypi
index 7b199fe..eb60006 100644
--- a/ppapi/ppapi_sources.gypi
+++ b/ppapi/ppapi_sources.gypi
@@ -90,10 +90,12 @@
 
       # Private interfaces.
       'c/private/pp_file_handle.h',
+      'c/private/pp_private_font_charset.h',
       'c/private/ppb_content_decryptor_private.h',
       'c/private/ppb_flash.h',
       'c/private/ppb_flash_clipboard.h',
       'c/private/ppb_flash_file.h',
+      'c/private/ppb_flash_font_file.h',
       'c/private/ppb_flash_fullscreen.h',
       'c/private/ppb_flash_menu.h',
       'c/private/ppb_flash_message_loop.h',
@@ -263,6 +265,8 @@
       'cpp/private/flash_device_id.h',
       'cpp/private/flash_file.cc',
       'cpp/private/flash_file.h',
+      'cpp/private/flash_font_file.cc',
+      'cpp/private/flash_font_file.h',
       'cpp/private/flash_fullscreen.cc',
       'cpp/private/flash_fullscreen.h',
       'cpp/private/flash_menu.cc',
diff --git a/ppapi/proxy/flash_font_file_resource.cc b/ppapi/proxy/flash_font_file_resource.cc
new file mode 100644
index 0000000..ecb8bc2
--- /dev/null
+++ b/ppapi/proxy/flash_font_file_resource.cc
@@ -0,0 +1,85 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/proxy/flash_font_file_resource.h"
+
+#include <cstring>
+
+#include "ppapi/c/dev/ppb_font_dev.h"
+#include "ppapi/c/pp_errors.h"
+#include "ppapi/proxy/ppapi_messages.h"
+
+namespace ppapi {
+namespace proxy {
+
+FlashFontFileResource::FlashFontFileResource(
+    Connection connection,
+    PP_Instance instance,
+    const PP_FontDescription_Dev* description,
+    PP_PrivateFontCharset charset)
+    : PluginResource(connection, instance),
+      charset_(charset) {
+  description_.SetFromPPFontDescription(*description);
+}
+
+FlashFontFileResource::~FlashFontFileResource() {
+}
+
+thunk::PPB_Flash_FontFile_API*
+    FlashFontFileResource::AsPPB_Flash_FontFile_API() {
+  return this;
+}
+
+PP_Bool FlashFontFileResource::GetFontTable(uint32_t table,
+                                            void* output,
+                                            uint32_t* output_length) {
+  if (!output_length)
+    return PP_FALSE;
+
+  if (!sent_create_to_renderer()) {
+    SendCreateToRenderer(
+        PpapiHostMsg_FlashFontFile_Create(description_, charset_));
+  }
+
+  std::string* contents = GetFontTable(table);
+  if (!contents) {
+    IPC::Message reply;
+    int32_t result = CallRendererSync(
+        PpapiHostMsg_FlashFontFile_GetFontTable(table), &reply);
+    if (result != PP_OK)
+      return PP_FALSE;
+
+    PpapiPluginMsg_FlashFontFile_GetFontTableReply::Param param;
+    if (!PpapiPluginMsg_FlashFontFile_GetFontTableReply::Read(&reply, &param))
+      return PP_FALSE;
+
+    contents = AddFontTable(table, param.a);
+  }
+
+  // If we are going to copy the data into |output|, it must be big enough.
+  if (output && *output_length < contents->size())
+    return PP_FALSE;
+
+  *output_length = static_cast<uint32_t>(contents->size());
+  if (output)
+    memcpy(output, contents->c_str(), *output_length);
+  return PP_TRUE;
+}
+
+std::string* FlashFontFileResource::GetFontTable(uint32_t table) const {
+  FontTableMap::const_iterator found = font_tables_.find(table);
+  if (found == font_tables_.end())
+    return NULL;
+  return found->second.get();
+}
+
+std::string* FlashFontFileResource::AddFontTable(uint32_t table,
+                                                 const std::string& contents) {
+  linked_ptr<std::string> heap_string(new std::string(contents));
+  font_tables_[table] = heap_string;
+  return heap_string.get();
+}
+
+}  // namespace proxy
+}  // namespace ppapi
diff --git a/ppapi/proxy/flash_font_file_resource.h b/ppapi/proxy/flash_font_file_resource.h
new file mode 100644
index 0000000..1644394
--- /dev/null
+++ b/ppapi/proxy/flash_font_file_resource.h
@@ -0,0 +1,61 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_PROXY_FLASH_FONT_FILE_RESOURCE_H_
+#define PPAPI_PROXY_FLASH_FONT_FILE_RESOURCE_H_
+
+#include <map>
+#include <string>
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "base/memory/linked_ptr.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
+#include "ppapi/proxy/plugin_resource.h"
+#include "ppapi/proxy/serialized_structs.h"
+#include "ppapi/thunk/ppb_flash_font_file_api.h"
+
+struct PP_FontDescription_Dev;
+
+namespace ppapi {
+namespace proxy {
+
+// TODO(yzshen): write unittest and browser test.
+class FlashFontFileResource : public PluginResource,
+                              public thunk::PPB_Flash_FontFile_API {
+ public:
+  FlashFontFileResource(Connection connection,
+                        PP_Instance instance,
+                        const PP_FontDescription_Dev* description,
+                        PP_PrivateFontCharset charset);
+  virtual ~FlashFontFileResource();
+
+  // Resource overrides.
+  virtual thunk::PPB_Flash_FontFile_API* AsPPB_Flash_FontFile_API() OVERRIDE;
+
+  // PPB_Flash_FontFile_API.
+  virtual PP_Bool GetFontTable(uint32_t table,
+                               void* output,
+                               uint32_t* output_length) OVERRIDE;
+
+ private:
+  // Sees if we have a cache of the font table and returns a pointer to it.
+  // Returns NULL if we don't have it.
+  std::string* GetFontTable(uint32_t table) const;
+
+  std::string* AddFontTable(uint32_t table, const std::string& contents);
+
+  typedef std::map<uint32_t, linked_ptr<std::string> > FontTableMap;
+  FontTableMap font_tables_;
+
+  SerializedFontDescription description_;
+  PP_PrivateFontCharset charset_;
+
+  DISALLOW_COPY_AND_ASSIGN(FlashFontFileResource);
+};
+
+}  // namespace proxy
+}  // namespace ppapi
+
+#endif  // PPAPI_PROXY_FLASH_FONT_FILE_RESOURCE_H_
diff --git a/ppapi/proxy/interface_list.cc b/ppapi/proxy/interface_list.cc
index 57aa32a..74b5290 100644
--- a/ppapi/proxy/interface_list.cc
+++ b/ppapi/proxy/interface_list.cc
@@ -55,6 +55,7 @@
 #include "ppapi/c/private/ppb_file_ref_private.h"
 #include "ppapi/c/private/ppb_flash_clipboard.h"
 #include "ppapi/c/private/ppb_flash_file.h"
+#include "ppapi/c/private/ppb_flash_font_file.h"
 #include "ppapi/c/private/ppb_flash_fullscreen.h"
 #include "ppapi/c/private/ppb_flash.h"
 #include "ppapi/c/private/ppb_flash_device_id.h"
diff --git a/ppapi/proxy/ppapi_messages.h b/ppapi/proxy/ppapi_messages.h
index 3e9dca2..863cc4c6 100644
--- a/ppapi/proxy/ppapi_messages.h
+++ b/ppapi/proxy/ppapi_messages.h
@@ -31,6 +31,7 @@
 #include "ppapi/c/pp_resource.h"
 #include "ppapi/c/pp_size.h"
 #include "ppapi/c/pp_time.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
 #include "ppapi/c/private/ppb_flash.h"
 #include "ppapi/c/private/ppb_host_resolver_private.h"
 #include "ppapi/c/private/ppb_net_address_private.h"
@@ -42,6 +43,7 @@
 #include "ppapi/proxy/resource_message_params.h"
 #include "ppapi/proxy/serialized_flash_menu.h"
 #include "ppapi/proxy/serialized_structs.h"
+#include "ppapi/proxy/serialized_var.h"
 #include "ppapi/shared_impl/ppapi_preferences.h"
 #include "ppapi/shared_impl/ppb_device_ref_shared.h"
 #include "ppapi/shared_impl/ppb_input_event_shared.h"
@@ -69,6 +71,7 @@ IPC_ENUM_TRAITS(PP_NetworkListType_Private)
 IPC_ENUM_TRAITS(PP_PrintOrientation_Dev)
 IPC_ENUM_TRAITS(PP_PrintOutputFormat_Dev)
 IPC_ENUM_TRAITS(PP_PrintScalingOption_Dev)
+IPC_ENUM_TRAITS(PP_PrivateFontCharset)
 IPC_ENUM_TRAITS(PP_TextInput_Type)
 IPC_ENUM_TRAITS(PP_VideoDecodeError_Dev)
 IPC_ENUM_TRAITS(PP_VideoDecoder_Profile)
@@ -1662,3 +1665,14 @@ IPC_MESSAGE_CONTROL4(PpapiPluginMsg_WebSocket_ClosedReply,
                      bool /* was_clean */,
                      unsigned short /* code */,
                      std::string /* reason */)
+
+#if !defined(OS_NACL) && !defined(NACL_WIN64)
+// Flash font file.
+IPC_MESSAGE_CONTROL2(PpapiHostMsg_FlashFontFile_Create,
+                     ppapi::proxy::SerializedFontDescription /* description */,
+                     PP_PrivateFontCharset /* charset */)
+IPC_MESSAGE_CONTROL1(PpapiHostMsg_FlashFontFile_GetFontTable,
+                     uint32_t /* table */)
+IPC_MESSAGE_CONTROL1(PpapiPluginMsg_FlashFontFile_GetFontTableReply,
+                     std::string /* output */)
+#endif  // !defined(OS_NACL) && !defined(NACL_WIN64)
diff --git a/ppapi/proxy/ppapi_param_traits.cc b/ppapi/proxy/ppapi_param_traits.cc
index e5b820c..696c0aa 100644
--- a/ppapi/proxy/ppapi_param_traits.cc
+++ b/ppapi/proxy/ppapi_param_traits.cc
@@ -521,7 +521,7 @@ void ParamTraits<ppapi::proxy::SerializedDirEntry>::Log(const param_type& p,
 void ParamTraits<ppapi::proxy::SerializedFontDescription>::Write(
     Message* m,
     const param_type& p) {
-  ParamTraits<ppapi::proxy::SerializedVar>::Write(m, p.face);
+  ParamTraits<std::string>::Write(m, p.face);
   ParamTraits<int32_t>::Write(m, p.family);
   ParamTraits<uint32_t>::Write(m, p.size);
   ParamTraits<int32_t>::Write(m, p.weight);
@@ -537,7 +537,7 @@ bool ParamTraits<ppapi::proxy::SerializedFontDescription>::Read(
     PickleIterator* iter,
     param_type* r) {
   return
-      ParamTraits<ppapi::proxy::SerializedVar>::Read(m, iter, &r->face) &&
+      ParamTraits<std::string>::Read(m, iter, &r->face) &&
       ParamTraits<int32_t>::Read(m, iter, &r->family) &&
       ParamTraits<uint32_t>::Read(m, iter, &r->size) &&
       ParamTraits<int32_t>::Read(m, iter, &r->weight) &&
diff --git a/ppapi/proxy/ppb_flash_proxy.cc b/ppapi/proxy/ppb_flash_proxy.cc
index 9a7ace3..6a5a905 100644
--- a/ppapi/proxy/ppb_flash_proxy.cc
+++ b/ppapi/proxy/ppb_flash_proxy.cc
@@ -33,6 +33,7 @@
 #include "ppapi/shared_impl/scoped_pp_resource.h"
 #include "ppapi/shared_impl/time_conversion.h"
 #include "ppapi/shared_impl/var.h"
+#include "ppapi/shared_impl/var_tracker.h"
 #include "ppapi/thunk/enter.h"
 #include "ppapi/thunk/ppb_instance_api.h"
 #include "ppapi/thunk/ppb_url_request_info_api.h"
@@ -60,6 +61,8 @@ IPC::PlatformFileForTransit PlatformFileToPlatformFileForTransit(
 }
 
 void InvokePrinting(PP_Instance instance) {
+  ProxyAutoLock lock;
+
   PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
   if (dispatcher) {
     dispatcher->Send(new PpapiHostMsg_PPBFlash_InvokePrinting(
@@ -162,7 +165,7 @@ PP_Bool PPB_Flash_Proxy::DrawGlyphs(PP_Instance instance,
 
   PPBFlash_DrawGlyphs_Params params;
   params.image_data = image_data->host_resource();
-  params.font_desc.SetFromPPFontDescription(dispatcher(), *font_desc, true);
+  params.font_desc.SetFromPPFontDescription(*font_desc);
   params.color = color;
   params.position = *position;
   params.clip = *clip;
@@ -631,13 +634,13 @@ void PPB_Flash_Proxy::OnHostMsgDrawGlyphs(
   if (enter.failed())
     return;
 
-  PP_FontDescription_Dev font_desc;
-  params.font_desc.SetToPPFontDescription(dispatcher(), &font_desc, false);
-
   if (params.glyph_indices.size() != params.glyph_advances.size() ||
       params.glyph_indices.empty())
     return;
 
+  PP_FontDescription_Dev font_desc;
+  params.font_desc.SetToPPFontDescription(&font_desc);
+
   *result = enter.functions()->GetFlashAPI()->DrawGlyphs(
       0,  // Unused instance param.
       params.image_data.host_resource(), &font_desc,
@@ -647,6 +650,9 @@ void PPB_Flash_Proxy::OnHostMsgDrawGlyphs(
       static_cast<uint32_t>(params.glyph_indices.size()),
       const_cast<uint16_t*>(&params.glyph_indices[0]),
       const_cast<PP_Point*>(&params.glyph_advances[0]));
+
+  // SetToPPFontDescription() creates a var which is owned by the caller.
+  PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(font_desc.face);
 }
 
 void PPB_Flash_Proxy::OnHostMsgGetProxyForURL(PP_Instance instance,
diff --git a/ppapi/proxy/ppb_pdf_proxy.cc b/ppapi/proxy/ppb_pdf_proxy.cc
index aee308f..e06b806 100644
--- a/ppapi/proxy/ppb_pdf_proxy.cc
+++ b/ppapi/proxy/ppb_pdf_proxy.cc
@@ -15,6 +15,9 @@
 #include "ppapi/proxy/plugin_dispatcher.h"
 #include "ppapi/proxy/plugin_resource_tracker.h"
 #include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/shared_impl/ppapi_globals.h"
+#include "ppapi/shared_impl/proxy_lock.h"
+#include "ppapi/shared_impl/var_tracker.h"
 #include "ppapi/thunk/enter.h"
 #include "ppapi/thunk/ppb_pdf_api.h"
 
@@ -67,12 +70,14 @@ PP_Resource GetFontFileWithFallback(
     PP_Instance instance,
     const PP_FontDescription_Dev* description,
     PP_PrivateFontCharset charset) {
+  ProxyAutoLock lock;
+
   PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
   if (!dispatcher)
     return 0;
 
   SerializedFontDescription desc;
-  desc.SetFromPPFontDescription(dispatcher, *description, true);
+  desc.SetFromPPFontDescription(*description);
 
   HostResource result;
   dispatcher->Send(new PpapiHostMsg_PPBPDF_GetFontFileWithFallback(
@@ -168,10 +173,13 @@ void PPB_PDF_Proxy::OnMsgGetFontFileWithFallback(
     int32_t charset,
     HostResource* result) {
   PP_FontDescription_Dev desc;
-  in_desc.SetToPPFontDescription(dispatcher(), &desc, false);
+  in_desc.SetToPPFontDescription(&desc);
   result->SetHostResource(instance,
       ppb_pdf_impl_->GetFontFileWithFallback(
           instance, &desc, static_cast<PP_PrivateFontCharset>(charset)));
+
+  // SetToPPFontDescription() creates a var which is owned by the caller.
+  PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(desc.face);
 }
 
 void PPB_PDF_Proxy::OnMsgGetFontTableForPrivateFontFile(
diff --git a/ppapi/proxy/resource_creation_proxy.cc b/ppapi/proxy/resource_creation_proxy.cc
index 78123a6..cb260d9 100644
--- a/ppapi/proxy/resource_creation_proxy.cc
+++ b/ppapi/proxy/resource_creation_proxy.cc
@@ -10,6 +10,7 @@
 #include "ppapi/proxy/connection.h"
 #include "ppapi/proxy/file_chooser_resource.h"
 #include "ppapi/proxy/flash_device_id_resource.h"
+#include "ppapi/proxy/flash_font_file_resource.h"
 #include "ppapi/proxy/plugin_dispatcher.h"
 #include "ppapi/proxy/plugin_globals.h"
 #include "ppapi/proxy/plugin_proxy_delegate.h"
@@ -319,6 +320,14 @@ PP_Resource ResourceCreationProxy::CreateFlashDeviceID(PP_Instance instance) {
   return (new FlashDeviceIDResource(GetConnection(), instance))->GetReference();
 }
 
+PP_Resource ResourceCreationProxy::CreateFlashFontFile(
+    PP_Instance instance,
+    const PP_FontDescription_Dev* description,
+    PP_PrivateFontCharset charset) {
+  return (new FlashFontFileResource(
+      GetConnection(), instance, description, charset))->GetReference();
+}
+
 PP_Resource ResourceCreationProxy::CreateFlashMenu(
     PP_Instance instance,
     const PP_Flash_Menu* menu_data) {
diff --git a/ppapi/proxy/resource_creation_proxy.h b/ppapi/proxy/resource_creation_proxy.h
index 4860cbf..19070fb 100644
--- a/ppapi/proxy/resource_creation_proxy.h
+++ b/ppapi/proxy/resource_creation_proxy.h
@@ -144,6 +144,10 @@ class ResourceCreationProxy : public InterfaceProxy,
       PP_FileChooserMode_Dev mode,
       const char* accept_types) OVERRIDE;
   virtual PP_Resource CreateFlashDeviceID(PP_Instance instance) OVERRIDE;
+  virtual PP_Resource CreateFlashFontFile(
+      PP_Instance instance,
+      const PP_FontDescription_Dev* description,
+      PP_PrivateFontCharset charset) OVERRIDE;
   virtual PP_Resource CreateFlashMenu(PP_Instance instance,
                                       const PP_Flash_Menu* menu_data) OVERRIDE;
   virtual PP_Resource CreateFlashMessageLoop(PP_Instance instance) OVERRIDE;
diff --git a/ppapi/proxy/serialized_structs.cc b/ppapi/proxy/serialized_structs.cc
index c647ed1..6622d4a 100644
--- a/ppapi/proxy/serialized_structs.cc
+++ b/ppapi/proxy/serialized_structs.cc
@@ -8,6 +8,7 @@
 #include "ppapi/c/dev/ppb_font_dev.h"
 #include "ppapi/c/pp_file_info.h"
 #include "ppapi/c/pp_rect.h"
+#include "ppapi/shared_impl/var.h"
 
 namespace ppapi {
 namespace proxy {
@@ -26,13 +27,9 @@ SerializedFontDescription::SerializedFontDescription()
 SerializedFontDescription::~SerializedFontDescription() {}
 
 void SerializedFontDescription::SetFromPPFontDescription(
-    Dispatcher* dispatcher,
-    const PP_FontDescription_Dev& desc,
-    bool source_owns_ref) {
-  if (source_owns_ref)
-    face = SerializedVarSendInput(dispatcher, desc.face);
-  else
-    SerializedVarReturnValue(&face).Return(dispatcher, desc.face);
+    const PP_FontDescription_Dev& desc) {
+  StringVar* string_var = StringVar::FromPPVar(desc.face);
+  face = string_var ? string_var->value() : std::string();
 
   family = desc.family;
   size = desc.size;
@@ -44,17 +41,8 @@ void SerializedFontDescription::SetFromPPFontDescription(
 }
 
 void SerializedFontDescription::SetToPPFontDescription(
-    Dispatcher* dispatcher,
-    PP_FontDescription_Dev* desc,
-    bool dest_owns_ref) const {
-  if (dest_owns_ref) {
-    ReceiveSerializedVarReturnValue face_return_value;
-    *static_cast<SerializedVar*>(&face_return_value) = face;
-    desc->face = face_return_value.Return(dispatcher);
-  } else {
-    desc->face = SerializedVarReceiveInput(face).Get(dispatcher);
-  }
-
+    PP_FontDescription_Dev* desc) const {
+  desc->face = StringVar::StringToPPVar(face);
   desc->family = static_cast<PP_FontFamily_Dev>(family);
   desc->size = size;
   desc->weight = static_cast<PP_FontWeight_Dev>(weight);
diff --git a/ppapi/proxy/serialized_structs.h b/ppapi/proxy/serialized_structs.h
index ac9494d..1779fd8 100644
--- a/ppapi/proxy/serialized_structs.h
+++ b/ppapi/proxy/serialized_structs.h
@@ -16,7 +16,7 @@
 #include "ppapi/c/pp_instance.h"
 #include "ppapi/c/pp_point.h"
 #include "ppapi/c/pp_rect.h"
-#include "ppapi/proxy/serialized_var.h"
+#include "ppapi/proxy/ppapi_proxy_export.h"
 #include "ppapi/shared_impl/host_resource.h"
 
 class Pickle;
@@ -25,39 +25,23 @@ struct PP_FontDescription_Dev;
 namespace ppapi {
 namespace proxy {
 
-class Dispatcher;
-
-// PP_FontDescript_Dev has to be redefined with a SerializedVar in place of
-// the PP_Var used for the face name.
+// PP_FontDescript_Dev has to be redefined with a string in place of the PP_Var
+// used for the face name.
 struct PPAPI_PROXY_EXPORT SerializedFontDescription {
   SerializedFontDescription();
   ~SerializedFontDescription();
 
   // Converts a PP_FontDescription_Dev to a SerializedFontDescription.
   //
-  // If source_owns_ref is true, the reference owned by the
-  // PP_FontDescription_Dev will be unchanged and the caller is responsible for
-  // freeing it. When false, the SerializedFontDescription will take ownership
-  // of the ref. This is the difference between serializing as an input value
-  // (owns_ref = true) and an output value (owns_ref = true).
-  void SetFromPPFontDescription(Dispatcher* dispatcher,
-                                const PP_FontDescription_Dev& desc,
-                                bool source_owns_ref);
+  // The reference of |face| owned by the PP_FontDescription_Dev will be
+  // unchanged and the caller is responsible for freeing it.
+  void SetFromPPFontDescription(const PP_FontDescription_Dev& desc);
 
   // Converts to a PP_FontDescription_Dev. The face name will have one ref
-  // assigned to it on behalf of the caller.
-  //
-  // If dest_owns_ref is set, the resulting PP_FontDescription_Dev will keep a
-  // reference to any strings we made on its behalf even when the
-  // SerializedFontDescription goes away. When false, ownership of the ref will
-  // stay with the SerializedFontDescription and the PP_FontDescription_Dev
-  // will just refer to that one. This is the difference between deserializing
-  // as an input value (owns_ref = false) and an output value (owns_ref = true).
-  void SetToPPFontDescription(Dispatcher* dispatcher,
-                              PP_FontDescription_Dev* desc,
-                              bool dest_owns_ref) const;
-
-  SerializedVar face;
+  // assigned to it. The caller is responsible for freeing it.
+  void SetToPPFontDescription(PP_FontDescription_Dev* desc) const;
+
+  std::string face;
   int32_t family;
   uint32_t size;
   int32_t weight;
diff --git a/ppapi/shared_impl/api_id.h b/ppapi/shared_impl/api_id.h
index ba1723c..360b8cb 100644
--- a/ppapi/shared_impl/api_id.h
+++ b/ppapi/shared_impl/api_id.h
@@ -26,6 +26,7 @@ enum ApiID {
   API_ID_PPB_FILE_SYSTEM,
   API_ID_PPB_FLASH,
   API_ID_PPB_FLASH_DEVICE_ID,
+  API_ID_PPB_FLASH_FONTFILE,
   API_ID_PPB_FLASH_MENU,
   API_ID_PPB_FLASH_MESSAGELOOP,
   API_ID_PPB_FONT,
diff --git a/ppapi/shared_impl/resource.h b/ppapi/shared_impl/resource.h
index 7f3edc7..f14d988 100644
--- a/ppapi/shared_impl/resource.h
+++ b/ppapi/shared_impl/resource.h
@@ -36,6 +36,7 @@
   F(PPB_FileSystem_API) \
   F(PPB_Find_API) \
   F(PPB_Flash_DeviceID_API) \
+  F(PPB_Flash_FontFile_API) \
   F(PPB_Flash_Menu_API) \
   F(PPB_Flash_MessageLoop_API) \
   F(PPB_Graphics2D_API) \
diff --git a/ppapi/tests/all_c_includes.h b/ppapi/tests/all_c_includes.h
index e125f62..5aa109d 100644
--- a/ppapi/tests/all_c_includes.h
+++ b/ppapi/tests/all_c_includes.h
@@ -89,9 +89,11 @@
 #include "ppapi/c/ppp_instance.h"
 #include "ppapi/c/ppp_messaging.h"
 #include "ppapi/c/ppp_mouse_lock.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
 #include "ppapi/c/private/ppb_content_decryptor_private.h"
 #include "ppapi/c/private/ppb_flash.h"
 #include "ppapi/c/private/ppb_flash_clipboard.h"
+#include "ppapi/c/private/ppb_flash_font_file.h"
 #include "ppapi/c/private/ppb_flash_menu.h"
 #include "ppapi/c/private/ppb_flash_message_loop.h"
 #include "ppapi/c/private/ppb_flash_tcp_socket.h"
diff --git a/ppapi/tests/all_cpp_includes.h b/ppapi/tests/all_cpp_includes.h
index 1013171..69fa0d9 100644
--- a/ppapi/tests/all_cpp_includes.h
+++ b/ppapi/tests/all_cpp_includes.h
@@ -49,6 +49,7 @@
 #include "ppapi/cpp/mouse_lock.h"
 #include "ppapi/cpp/point.h"
 #include "ppapi/cpp/private/content_decryptor_private.h"
+#include "ppapi/cpp/private/flash_font_file.h"
 #include "ppapi/cpp/private/flash_fullscreen.h"
 #include "ppapi/cpp/private/instance_private.h"
 #include "ppapi/cpp/private/instance_private.h"
diff --git a/ppapi/thunk/interfaces_ppb_private_flash.h b/ppapi/thunk/interfaces_ppb_private_flash.h
index 8ec049a..91e50cd 100644
--- a/ppapi/thunk/interfaces_ppb_private_flash.h
+++ b/ppapi/thunk/interfaces_ppb_private_flash.h
@@ -50,6 +50,10 @@ PROXIED_IFACE(NoAPIName,
               PPB_FLASH_DEVICEID_INTERFACE_1_0,
               PPB_Flash_DeviceID_1_0)
 
+PROXIED_IFACE(NoAPIName,
+              PPB_FLASH_FONTFILE_INTERFACE_0_1,
+              PPB_Flash_FontFile_0_1)
+
 PROXIED_API(PPB_Flash_Menu)
 PROXIED_IFACE(PPB_Flash_Menu,
               PPB_FLASH_MENU_INTERFACE_0_2,
diff --git a/ppapi/thunk/ppb_flash_font_file_api.h b/ppapi/thunk/ppb_flash_font_file_api.h
new file mode 100644
index 0000000..9e8ce23
--- /dev/null
+++ b/ppapi/thunk/ppb_flash_font_file_api.h
@@ -0,0 +1,26 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_THUNK_PPB_FLASH_FONT_FILE_API_H_
+#define PPAPI_THUNK_PPB_FLASH_FONT_FILE_API_H_
+
+#include "ppapi/c/pp_stdint.h"
+
+namespace ppapi {
+namespace thunk {
+
+class PPB_Flash_FontFile_API {
+ public:
+  virtual ~PPB_Flash_FontFile_API() {}
+
+  virtual PP_Bool GetFontTable(uint32_t table,
+                               void* output,
+                               uint32_t* output_length) = 0;
+};
+
+}  // namespace thunk
+}  // namespace ppapi
+
+#endif  // PPAPI_THUNK_PPB_FLASH_FONT_FILE_API_H_
+
diff --git a/ppapi/thunk/ppb_flash_font_file_thunk.cc b/ppapi/thunk/ppb_flash_font_file_thunk.cc
new file mode 100644
index 0000000..ee338f0
--- /dev/null
+++ b/ppapi/thunk/ppb_flash_font_file_thunk.cc
@@ -0,0 +1,53 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/c/private/ppb_flash_font_file.h"
+#include "ppapi/thunk/enter.h"
+#include "ppapi/thunk/ppb_flash_font_file_api.h"
+#include "ppapi/thunk/resource_creation_api.h"
+#include "ppapi/thunk/thunk.h"
+
+namespace ppapi {
+namespace thunk {
+
+namespace {
+
+PP_Resource Create(PP_Instance instance,
+                   const PP_FontDescription_Dev* description,
+                   PP_PrivateFontCharset charset) {
+  EnterResourceCreation enter(instance);
+  if (enter.failed())
+    return 0;
+  return enter.functions()->CreateFlashFontFile(instance, description, charset);
+}
+
+PP_Bool IsFlashFontFile(PP_Resource resource) {
+  EnterResource<PPB_Flash_FontFile_API> enter(resource, false);
+  return PP_FromBool(enter.succeeded());
+}
+
+PP_Bool GetFontTable(PP_Resource font_file,
+                     uint32_t table,
+                     void* output,
+                     uint32_t* output_length) {
+  EnterResource<PPB_Flash_FontFile_API> enter(font_file, true);
+  if (enter.failed())
+    return PP_FALSE;
+  return enter.object()->GetFontTable(table, output, output_length);
+}
+
+const PPB_Flash_FontFile g_ppb_flash_fontfile_thunk = {
+  &Create,
+  &IsFlashFontFile,
+  &GetFontTable
+};
+
+}  // namespace
+
+const PPB_Flash_FontFile_0_1* GetPPB_Flash_FontFile_0_1_Thunk() {
+  return &g_ppb_flash_fontfile_thunk;
+}
+
+}  // namespace thunk
+}  // namespace ppapi
diff --git a/ppapi/thunk/resource_creation_api.h b/ppapi/thunk/resource_creation_api.h
index 0832dc2..7cf756f 100644
--- a/ppapi/thunk/resource_creation_api.h
+++ b/ppapi/thunk/resource_creation_api.h
@@ -18,10 +18,12 @@
 #include "ppapi/c/ppb_input_event.h"
 #include "ppapi/c/ppb_websocket.h"
 #include "ppapi/c/dev/pp_video_dev.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
 #include "ppapi/c/private/ppb_network_monitor_private.h"
 #include "ppapi/shared_impl/api_id.h"
 
 struct PP_Flash_Menu;
+struct PP_FontDescription_Dev;
 struct PP_BrowserFont_Trusted_Description;
 struct PP_Size;
 
@@ -143,6 +145,10 @@ class ResourceCreationAPI {
       PP_FileChooserMode_Dev mode,
       const char* accept_types) = 0;
   virtual PP_Resource CreateFlashDeviceID(PP_Instance instance) = 0;
+  virtual PP_Resource CreateFlashFontFile(
+      PP_Instance instance,
+      const PP_FontDescription_Dev* description,
+      PP_PrivateFontCharset charset) = 0;
   virtual PP_Resource CreateFlashMenu(PP_Instance instance,
                                       const PP_Flash_Menu* menu_data) = 0;
   virtual PP_Resource CreateFlashMessageLoop(PP_Instance instance) = 0;
diff --git a/webkit/plugins/ppapi/plugin_module.cc b/webkit/plugins/ppapi/plugin_module.cc
index 04862da..4b16a2a 100644
--- a/webkit/plugins/ppapi/plugin_module.cc
+++ b/webkit/plugins/ppapi/plugin_module.cc
@@ -71,6 +71,7 @@
 #include "ppapi/c/private/ppb_flash_clipboard.h"
 #include "ppapi/c/private/ppb_flash_device_id.h"
 #include "ppapi/c/private/ppb_flash_file.h"
+#include "ppapi/c/private/ppb_flash_font_file.h"
 #include "ppapi/c/private/ppb_flash_fullscreen.h"
 #include "ppapi/c/private/ppb_flash_message_loop.h"
 #include "ppapi/c/private/ppb_flash_tcp_socket.h"
diff --git a/webkit/plugins/ppapi/resource_creation_impl.cc b/webkit/plugins/ppapi/resource_creation_impl.cc
index 22ac0b2..717b830 100644
--- a/webkit/plugins/ppapi/resource_creation_impl.cc
+++ b/webkit/plugins/ppapi/resource_creation_impl.cc
@@ -131,6 +131,13 @@ PP_Resource ResourceCreationImpl::CreateFlashDeviceID(PP_Instance instance) {
   return 0;  // Not supported in-process.
 }
 
+PP_Resource ResourceCreationImpl::CreateFlashFontFile(
+    PP_Instance instance,
+    const PP_FontDescription_Dev* description,
+    PP_PrivateFontCharset charset) {
+  return 0;  // Not supported in-process.
+}
+
 PP_Resource ResourceCreationImpl::CreateFlashMenu(
     PP_Instance instance,
     const PP_Flash_Menu* menu_data) {
diff --git a/webkit/plugins/ppapi/resource_creation_impl.h b/webkit/plugins/ppapi/resource_creation_impl.h
index 77a7b99..10d058a5 100644
--- a/webkit/plugins/ppapi/resource_creation_impl.h
+++ b/webkit/plugins/ppapi/resource_creation_impl.h
@@ -49,6 +49,10 @@ class WEBKIT_PLUGINS_EXPORT ResourceCreationImpl
   virtual PP_Resource CreateFileSystem(PP_Instance instance,
                                        PP_FileSystemType type) OVERRIDE;
   virtual PP_Resource CreateFlashDeviceID(PP_Instance instance) OVERRIDE;
+  virtual PP_Resource CreateFlashFontFile(
+      PP_Instance instance,
+      const PP_FontDescription_Dev* description,
+      PP_PrivateFontCharset charset) OVERRIDE;
   virtual PP_Resource CreateFlashMenu(PP_Instance instance,
                                       const PP_Flash_Menu* menu_data) OVERRIDE;
   virtual PP_Resource CreateFlashMessageLoop(PP_Instance instance) OVERRIDE;