Move core pieces of chrome\browser. I've only gone up to "g", will do the rest in another cl.

TBR=avi
Review URL: http://codereview.chromium.org/6538100

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@75652 0039d316-1c4b-4281-b951-d872f2087c98

45 files changed, 1932 insertions, 1771 deletions

diff --git a/chrome/browser/browser_child_process_host.h b/chrome/browser/browser_child_process_host.h
index 28ca924..50774e1 100644
--- a/chrome/browser/browser_child_process_host.h
+++ b/chrome/browser/browser_child_process_host.h
@@ -6,138 +6,7 @@
 #define CHROME_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
 #pragma once
 
-#include <list>
-
-#include "chrome/browser/child_process_launcher.h"
-#include "chrome/browser/renderer_host/resource_message_filter.h"
-#include "chrome/common/child_process_host.h"
-#include "chrome/common/child_process_info.h"
-
-class ResourceDispatcherHost;
-
-// Plugins/workers and other child processes that live on the IO thread should
-// derive from this class.
-//
-// [Browser]RenderProcessHost is the main exception that doesn't derive from
-// this class. That project lives on the UI thread.
-class BrowserChildProcessHost : public ChildProcessHost,
-                                public ChildProcessInfo,
-                                public ChildProcessLauncher::Client {
- public:
-  virtual ~BrowserChildProcessHost();
-
-  // Prepares command_line for crash reporting as appropriate.  On Linux and
-  // Mac, a command-line flag to enable crash reporting in the child process
-  // will be appended if needed, because the child process may not have access
-  // to the data that determines the status of crash reporting in the
-  // currently-executing process.  This function is a no-op on Windows.
-  static void SetCrashReporterCommandLine(CommandLine* command_line);
-
-  // Terminates all child processes and deletes each ChildProcessHost instance.
-  static void TerminateAll();
-
-  // The Iterator class allows iteration through either all child processes, or
-  // ones of a specific type, depending on which constructor is used.  Note that
-  // this should be done from the IO thread and that the iterator should not be
-  // kept around as it may be invalidated on subsequent event processing in the
-  // event loop.
-  class Iterator {
-   public:
-    Iterator();
-    explicit Iterator(ChildProcessInfo::ProcessType type);
-    BrowserChildProcessHost* operator->() { return *iterator_; }
-    BrowserChildProcessHost* operator*() { return *iterator_; }
-    BrowserChildProcessHost* operator++();
-    bool Done();
-
-   private:
-    bool all_;
-    ChildProcessInfo::ProcessType type_;
-    std::list<BrowserChildProcessHost*>::iterator iterator_;
-  };
-
- protected:
-  // |resource_dispatcher_host| may be NULL to indicate none is needed for
-  // this process type.
-  // |url_request_context_getter| allows derived classes to override the
-  // net::URLRequestContext.
-  BrowserChildProcessHost(
-      ChildProcessInfo::ProcessType type,
-      ResourceDispatcherHost* resource_dispatcher_host,
-      ResourceMessageFilter::URLRequestContextOverride*
-          url_request_context_override);
-
-  // A convenient constructor for those classes that want to use the default
-  // net::URLRequestContext.
-  BrowserChildProcessHost(
-      ChildProcessInfo::ProcessType type,
-      ResourceDispatcherHost* resource_dispatcher_host);
-
-  // Derived classes call this to launch the child process asynchronously.
-  void Launch(
-#if defined(OS_WIN)
-      const FilePath& exposed_dir,
-#elif defined(OS_POSIX)
-      bool use_zygote,
-      const base::environment_vector& environ,
-#endif
-      CommandLine* cmd_line);
-
-  // Returns the handle of the child process. This can be called only after
-  // OnProcessLaunched is called or it will be invalid and may crash.
-  base::ProcessHandle GetChildProcessHandle() const;
-
-  // ChildProcessLauncher::Client implementation.
-  virtual void OnProcessLaunched() {}
-
-  // Derived classes can override this to know if the process crashed.
-  // |exit_code| is the status returned when the process crashed (for
-  // posix, as returned from waitpid(), for Windows, as returned from
-  // GetExitCodeProcess()).
-  virtual void OnProcessCrashed(int exit_code) {}
-
-  // Derived classes can override this to know if the process was
-  // killed.  |exit_code| is the status returned when the process
-  // was killed (for posix, as returned from waitpid(), for Windows,
-  // as returned from GetExitCodeProcess()).
-  virtual void OnProcessWasKilled(int exit_code) {}
-
-  // Returns the termination status of a child.  |exit_code| is the
-  // status returned when the process exited (for posix, as returned
-  // from waitpid(), for Windows, as returned from
-  // GetExitCodeProcess()).  |exit_code| may be NULL.
-  virtual base::TerminationStatus GetChildTerminationStatus(int* exit_code);
-
-  // Overrides from ChildProcessHost
-  virtual void OnChildDied();
-  virtual void ShutdownStarted();
-  virtual void Notify(NotificationType type);
-  // Extends the base class implementation and removes this host from
-  // the host list. Calls ChildProcessHost::ForceShutdown
-  virtual void ForceShutdown();
-
-  ResourceDispatcherHost* resource_dispatcher_host() {
-    return resource_dispatcher_host_;
-  }
-
- private:
-  void Initialize(ResourceMessageFilter::URLRequestContextOverride*
-      url_request_context_override);
-
-  // By using an internal class as the ChildProcessLauncher::Client, we can
-  // intercept OnProcessLaunched and do our own processing before
-  // calling the subclass' implementation.
-  class ClientHook : public ChildProcessLauncher::Client {
-   public:
-    explicit ClientHook(BrowserChildProcessHost* host);
-    virtual void OnProcessLaunched();
-   private:
-    BrowserChildProcessHost* host_;
-  };
-  ClientHook client_;
-  // May be NULL if this current process has no resource dispatcher host.
-  ResourceDispatcherHost* resource_dispatcher_host_;
-  scoped_ptr<ChildProcessLauncher> child_process_;
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/browser_child_process_host.h"
 
 #endif  // CHROME_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
diff --git a/chrome/browser/browser_message_filter.h b/chrome/browser/browser_message_filter.h
index 19f5c7d..8e1445d 100644
--- a/chrome/browser/browser_message_filter.h
+++ b/chrome/browser/browser_message_filter.h
@@ -6,59 +6,7 @@
 #define CHROME_BROWSER_BROWSER_MESSAGE_FILTER_H_
 #pragma once
 
-#include "base/process.h"
-#include "chrome/browser/browser_thread.h"
-#include "ipc/ipc_channel_proxy.h"
-
-// Base class for message filters in the browser process.  You can receive and
-// send messages on any thread.
-class BrowserMessageFilter : public IPC::ChannelProxy::MessageFilter,
-                             public IPC::Message::Sender {
- public:
-  BrowserMessageFilter();
-  virtual ~BrowserMessageFilter();
-
-  // IPC::ChannelProxy::MessageFilter methods.  If you override them, make sure
-  // to call them as well.  These are always called on the IO thread.
-  virtual void OnFilterAdded(IPC::Channel* channel);
-  virtual void OnChannelClosing();
-  virtual void OnChannelConnected(int32 peer_pid);
-  // DON'T OVERRIDE THIS!  Override the other version below.
-  virtual bool OnMessageReceived(const IPC::Message& message);
-
-  // IPC::Message::Sender implementation.  Can be called on any thread.  Can't
-  // send sync messages (since we don't want to block the browser on any other
-  // process).
-  virtual bool Send(IPC::Message* message);
-
-  // If you want the given message to be dispatched to your OnMessageReceived on
-  // a different thread, change |thread| to the id of the target thread.
-  // If you don't handle this message, or want to keep it on the IO thread, do
-  // nothing.
-  virtual void OverrideThreadForMessage(const IPC::Message& message,
-                                        BrowserThread::ID* thread);
-
-  // Override this to receive messages.
-  // Your function will normally be called on the IO thread.  However, if your
-  // OverrideThreadForMessage modifies the thread used to dispatch the message,
-  // your function will be called on the requested thread.
-  virtual bool OnMessageReceived(const IPC::Message& message,
-                                 bool* message_was_ok) = 0;
-
-  // Can be called on any thread, after OnChannelConnected is called.
-  base::ProcessHandle peer_handle() { return peer_handle_; }
-
- protected:
-  // Call this if a message couldn't be deserialized.  This kills the renderer.
-  // Can be called on any thread.
-  virtual void BadMessageReceived();
-
- private:
-  // Dispatches a message to the derived class.
-  bool DispatchMessage(const IPC::Message& message);
-
-  IPC::Channel* channel_;
-  base::ProcessHandle peer_handle_;
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/browser_message_filter.h"
 
 #endif  // CHROME_BROWSER_BROWSER_MESSAGE_FILTER_H_
diff --git a/chrome/browser/browser_thread.h b/chrome/browser/browser_thread.h
index dc4b00b..1a796dd 100644
--- a/chrome/browser/browser_thread.h
+++ b/chrome/browser/browser_thread.h
@@ -6,204 +6,7 @@
 #define CHROME_BROWSER_BROWSER_THREAD_H_
 #pragma once
 
-#include "base/synchronization/lock.h"
-#include "base/task.h"
-#include "base/threading/thread.h"
-
-namespace base {
-class MessageLoopProxy;
-}
-
-///////////////////////////////////////////////////////////////////////////////
-// BrowserThread
-//
-// This class represents a thread that is known by a browser-wide name.  For
-// example, there is one IO thread for the entire browser process, and various
-// pieces of code find it useful to retrieve a pointer to the IO thread's
-// Invoke a task by thread ID:
-//
-//   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE, task);
-//
-// The return value is false if the task couldn't be posted because the target
-// thread doesn't exist.  If this could lead to data loss, you need to check the
-// result and restructure the code to ensure it doesn't occur.
-//
-// This class automatically handles the lifetime of different threads.
-// It's always safe to call PostTask on any thread.  If it's not yet created,
-// the task is deleted.  There are no race conditions.  If the thread that the
-// task is posted to is guaranteed to outlive the current thread, then no locks
-// are used.  You should never need to cache pointers to MessageLoops, since
-// they're not thread safe.
-class BrowserThread : public base::Thread {
- public:
-  // An enumeration of the well-known threads.
-  // NOTE: threads must be listed in the order of their life-time, with each
-  // thread outliving every other thread below it.
-  enum ID {
-    // The main thread in the browser.
-    UI,
-
-    // This is the thread that interacts with the database.
-    DB,
-
-    // This is the "main" thread for WebKit within the browser process when
-    // NOT in --single-process mode.
-    WEBKIT,
-
-    // This is the thread that interacts with the file system.
-    FILE,
-
-    // Used to launch and terminate processes.
-    PROCESS_LAUNCHER,
-
-    // This is the thread to handle slow HTTP cache operations.
-    CACHE,
-
-    // This is the thread that processes IPC and network messages.
-    IO,
-
-#if defined(USE_X11)
-    // This thread has a second connection to the X server and is used to
-    // process UI requests when routing the request to the UI thread would risk
-    // deadlock.
-    BACKGROUND_X11,
-#endif
-
-    // This identifier does not represent a thread.  Instead it counts the
-    // number of well-known threads.  Insert new well-known threads before this
-    // identifier.
-    ID_COUNT
-  };
-
-  // Construct a BrowserThread with the supplied identifier.  It is an error
-  // to construct a BrowserThread that already exists.
-  explicit BrowserThread(ID identifier);
-
-  // Special constructor for the main (UI) thread and unittests. We use a dummy
-  // thread here since the main thread already exists.
-  BrowserThread(ID identifier, MessageLoop* message_loop);
-
-  virtual ~BrowserThread();
-
-  // These are the same methods in message_loop.h, but are guaranteed to either
-  // get posted to the MessageLoop if it's still alive, or be deleted otherwise.
-  // They return true iff the thread existed and the task was posted.  Note that
-  // even if the task is posted, there's no guarantee that it will run, since
-  // the target thread may already have a Quit message in its queue.
-  static bool PostTask(ID identifier,
-                       const tracked_objects::Location& from_here,
-                       Task* task);
-  static bool PostDelayedTask(ID identifier,
-                              const tracked_objects::Location& from_here,
-                              Task* task,
-                              int64 delay_ms);
-  static bool PostNonNestableTask(ID identifier,
-                                  const tracked_objects::Location& from_here,
-                                  Task* task);
-  static bool PostNonNestableDelayedTask(
-      ID identifier,
-      const tracked_objects::Location& from_here,
-      Task* task,
-      int64 delay_ms);
-
-  template <class T>
-  static bool DeleteSoon(ID identifier,
-                         const tracked_objects::Location& from_here,
-                         const T* object) {
-    return PostNonNestableTask(
-        identifier, from_here, new DeleteTask<T>(object));
-  }
-
-  template <class T>
-  static bool ReleaseSoon(ID identifier,
-                          const tracked_objects::Location& from_here,
-                          const T* object) {
-    return PostNonNestableTask(
-        identifier, from_here, new ReleaseTask<T>(object));
-  }
-
-  // Callable on any thread.  Returns whether the given ID corresponds to a well
-  // known thread.
-  static bool IsWellKnownThread(ID identifier);
-
-  // Callable on any thread.  Returns whether you're currently on a particular
-  // thread.
-  static bool CurrentlyOn(ID identifier);
-
-  // Callable on any thread.  Returns whether the threads message loop is valid.
-  // If this returns false it means the thread is in the process of shutting
-  // down.
-  static bool IsMessageLoopValid(ID identifier);
-
-  // If the current message loop is one of the known threads, returns true and
-  // sets identifier to its ID.  Otherwise returns false.
-  static bool GetCurrentThreadIdentifier(ID* identifier);
-
-  // Callers can hold on to a refcounted MessageLoopProxy beyond the lifetime
-  // of the thread.
-  static scoped_refptr<base::MessageLoopProxy> GetMessageLoopProxyForThread(
-      ID identifier);
-
-  // Use these templates in conjuction with RefCountedThreadSafe when you want
-  // to ensure that an object is deleted on a specific thread.  This is needed
-  // when an object can hop between threads (i.e. IO -> FILE -> IO), and thread
-  // switching delays can mean that the final IO tasks executes before the FILE
-  // task's stack unwinds.  This would lead to the object destructing on the
-  // FILE thread, which often is not what you want (i.e. to unregister from
-  // NotificationService, to notify other objects on the creating thread etc).
-  template<ID thread>
-  struct DeleteOnThread {
-    template<typename T>
-    static void Destruct(const T* x) {
-      if (CurrentlyOn(thread)) {
-        delete x;
-      } else {
-        DeleteSoon(thread, FROM_HERE, x);
-      }
-    }
-  };
-
-  // Sample usage:
-  // class Foo
-  //     : public base::RefCountedThreadSafe<
-  //           Foo, BrowserThread::DeleteOnIOThread> {
-  //
-  // ...
-  //  private:
-  //   friend struct BrowserThread::DeleteOnThread<BrowserThread::IO>;
-  //   friend class DeleteTask<Foo>;
-  //
-  //   ~Foo();
-  struct DeleteOnUIThread : public DeleteOnThread<UI> { };
-  struct DeleteOnIOThread : public DeleteOnThread<IO> { };
-  struct DeleteOnFileThread : public DeleteOnThread<FILE> { };
-  struct DeleteOnDBThread : public DeleteOnThread<DB> { };
-  struct DeleteOnWebKitThread : public DeleteOnThread<WEBKIT> { };
-
- private:
-  // Common initialization code for the constructors.
-  void Initialize();
-
-  static bool PostTaskHelper(
-      ID identifier,
-      const tracked_objects::Location& from_here,
-      Task* task,
-      int64 delay_ms,
-      bool nestable);
-
-  // The identifier of this thread.  Only one thread can exist with a given
-  // identifier at a given time.
-  ID identifier_;
-
-  // This lock protects |browser_threads_|.  Do not read or modify that array
-  // without holding this lock.  Do not block while holding this lock.
-  static base::Lock lock_;
-
-  // An array of the BrowserThread objects.  This array is protected by |lock_|.
-  // The threads are not owned by this array.  Typically, the threads are owned
-  // on the UI thread by the g_browser_process object.  BrowserThreads remove
-  // themselves from this array upon destruction.
-  static BrowserThread* browser_threads_[ID_COUNT];
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/browser_thread.h"
 
 #endif  // CHROME_BROWSER_BROWSER_THREAD_H_
diff --git a/chrome/browser/browsing_instance.h b/chrome/browser/browsing_instance.h
index 3082b61..eb33add 100644
--- a/chrome/browser/browsing_instance.h
+++ b/chrome/browser/browsing_instance.h
@@ -6,130 +6,7 @@
 #define CHROME_BROWSER_BROWSING_INSTANCE_H_
 #pragma once
 
-#include "base/hash_tables.h"
-#include "base/ref_counted.h"
-#include "chrome/browser/profiles/profile.h"
-
-class GURL;
-class SiteInstance;
-
-///////////////////////////////////////////////////////////////////////////////
-//
-// BrowsingInstance class
-//
-// A browsing instance corresponds to the notion of a "unit of related browsing
-// contexts" in the HTML 5 spec.  Intuitively, it represents a collection of
-// tabs and frames that can have script connections to each other.  In that
-// sense, it reflects the user interface, and not the contents of the tabs and
-// frames.
-//
-// We further subdivide a BrowsingInstance into SiteInstances, which represent
-// the documents within each BrowsingInstance that are from the same site and
-// thus can have script access to each other.  Different SiteInstances can
-// safely run in different processes, because their documents cannot access
-// each other's contents (due to the same origin policy).
-//
-// It is important to only have one SiteInstance per site within a given
-// BrowsingInstance.  This is because any two documents from the same site
-// might be able to script each other if they are in the same BrowsingInstance.
-// Thus, they must be rendered in the same process.
-//
-// If the process-per-site model is in use, then we ensure that there is only
-// one SiteInstance per site for the entire profile, not just for each
-// BrowsingInstance.  This reduces the number of renderer processes we create.
-// (This is currently only true if --process-per-site is specified at the
-// command line.)
-//
-// A BrowsingInstance is live as long as any SiteInstance has a reference to
-// it.  A SiteInstance is live as long as any NavigationEntry or RenderViewHost
-// have references to it.  Because both classes are RefCounted, they do not
-// need to be manually deleted.
-//
-// Currently, the BrowsingInstance class is not visible outside of the
-// SiteInstance class.  To get a new SiteInstance that is part of the same
-// BrowsingInstance, use SiteInstance::GetRelatedSiteInstance.  Because of
-// this, BrowsingInstances and SiteInstances are tested together in
-// site_instance_unittest.cc.
-//
-///////////////////////////////////////////////////////////////////////////////
-class BrowsingInstance : public base::RefCounted<BrowsingInstance> {
- public:
-  // Create a new BrowsingInstance.
-  explicit BrowsingInstance(Profile* profile);
-
-  // Returns whether the process-per-site model is in use (globally or just for
-  // the given url), in which case we should ensure there is only one
-  // SiteInstance per site for the entire profile, not just for this
-  // BrowsingInstance.
-  virtual bool ShouldUseProcessPerSite(const GURL& url);
-
-  // Get the profile to which this BrowsingInstance belongs.
-  Profile* profile() { return profile_; }
-
-  // Returns whether this BrowsingInstance has registered a SiteInstance for
-  // the site of the given URL.
-  bool HasSiteInstance(const GURL& url);
-
-  // Get the SiteInstance responsible for rendering the given URL.  Should
-  // create a new one if necessary, but should not create more than one
-  // SiteInstance per site.
-  SiteInstance* GetSiteInstanceForURL(const GURL& url);
-
-  // Adds the given SiteInstance to our map, to ensure that we do not create
-  // another SiteInstance for the same site.
-  void RegisterSiteInstance(SiteInstance* site_instance);
-
-  // Removes the given SiteInstance from our map, after all references to it
-  // have been deleted.  This means it is safe to create a new SiteInstance
-  // if the user later visits a page from this site, within this
-  // BrowsingInstance.
-  void UnregisterSiteInstance(SiteInstance* site_instance);
-
- protected:
-  friend class base::RefCounted<BrowsingInstance>;
-
-  // Virtual to allow tests to extend it.
-  virtual ~BrowsingInstance();
-
- private:
-  // Map of site to SiteInstance, to ensure we only have one SiteInstance per
-  // site.  The site string should be the possibly_invalid_spec() of a GURL
-  // obtained with SiteInstance::GetSiteForURL.
-  typedef base::hash_map<std::string, SiteInstance*> SiteInstanceMap;
-
-  // Map of Profile runtime Id to SiteInstanceMap, for use in the
-  // process-per-site model.
-  typedef base::hash_map<ProfileId, SiteInstanceMap> ProfileSiteInstanceMap;
-
-  // Returns a pointer to the relevant SiteInstanceMap for this object.  If the
-  // process-per-site model is in use, or if process-per-site-instance is in
-  // use and |url| matches a site for which we always use one process (e.g.,
-  // the new tab page), then this returns the SiteInstanceMap for the entire
-  // profile.  If not, this returns the BrowsingInstance's own private
-  // SiteInstanceMap.
-  SiteInstanceMap* GetSiteInstanceMap(Profile* profile, const GURL& url);
-
-  // Utility routine which removes the passed SiteInstance from the passed
-  // SiteInstanceMap.
-  bool RemoveSiteInstanceFromMap(SiteInstanceMap* map, const std::string& site,
-                                 SiteInstance* site_instance);
-
-  // Common profile to which all SiteInstances in this BrowsingInstance
-  // must belong.
-  Profile* const profile_;
-
-  // Map of site to SiteInstance, to ensure we only have one SiteInstance per
-  // site.  The site string should be the possibly_invalid_spec() of a GURL
-  // obtained with SiteInstance::GetSiteForURL.  Note that this map may not
-  // contain every active SiteInstance, because a race exists where two
-  // SiteInstances can be assigned to the same site.  This is ok in rare cases.
-  // This field is only used if we are not using process-per-site.
-  SiteInstanceMap site_instance_map_;
-
-  // Global map of Profile to SiteInstanceMap, for process-per-site.
-  static ProfileSiteInstanceMap profile_site_instance_map_;
-
-  DISALLOW_COPY_AND_ASSIGN(BrowsingInstance);
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/browsing_instance.h"
 
 #endif  // CHROME_BROWSER_BROWSING_INSTANCE_H_
diff --git a/chrome/browser/cancelable_request.h b/chrome/browser/cancelable_request.h
index dce7a2c..cb749ee 100644
--- a/chrome/browser/cancelable_request.h
+++ b/chrome/browser/cancelable_request.h
@@ -2,703 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// CancelableRequestProviders and Consumers work together to make requests that
-// execute on a background thread in the provider and return data to the
-// consumer. These class collaborate to keep a list of open requests and to
-// make sure that requests to not outlive either of the objects involved in the
-// transaction.
-//
-// If you do not need to return data to the consumer, do not use this system,
-// just use the regular Task/RunnableMethod stuff.
-//
-// The CancelableRequest object is used internally to each provider to track
-// request data and callback information.
-//
-// Example consumer calling |StartRequest| on a frontend service:
-//
-//   class MyClass {
-//     void MakeRequest() {
-//       frontend_service->StartRequest(some_input1, some_input2,
-//           &callback_consumer_,
-//           NewCallback(this, &MyClass:RequestComplete));
-//       // StartRequest() returns a Handle which may be retained for use with
-//       // CancelRequest() if required, e.g. in MyClass's destructor.
-//     }
-//
-//     void RequestComplete(int status) {
-//       ...
-//     }
-//
-//    private:
-//     CancelableRequestConsumer callback_consumer_;
-//   };
-//
-//
-// Example frontend provider. It receives requests and forwards them to the
-// backend on another thread:
-//
-//   class Frontend : public CancelableRequestProvider {
-//     typedef Callback1<int>::Type RequestCallbackType;
-//
-//     Handle StartRequest(int some_input1, int some_input2,
-//                         CancelableRequestConsumerBase* consumer,
-//                         RequestCallbackType* callback) {
-//       scoped_refptr<CancelableRequest<RequestCallbackType> > request(
-//           new CancelableRequest<RequestCallbackType>(callback));
-//       AddRequest(request, consumer);
-//
-//       // Send the parameters and the request to the backend thread.
-//       backend_thread_->PostTask(FROM_HERE,
-//           NewRunnableMethod(backend_, &Backend::DoRequest, request,
-//                             some_input1, some_input2));
-//
-//       // The handle will have been set by AddRequest.
-//       return request->handle();
-//     }
-//   };
-//
-//
-// Example backend provider that does work and dispatches the callback back
-// to the original thread. Note that we need to pass it as a scoped_refptr so
-// that the object will be kept alive if the request is canceled (releasing
-// the provider's reference to it).
-//
-//   class Backend {
-//     void DoRequest(
-//         scoped_refptr< CancelableRequest<Frontend::RequestCallbackType> >
-//             request,
-//         int some_input1, int some_input2) {
-//       if (request->canceled())
-//         return;
-//
-//       ... do your processing ...
-//
-//       // Depending on your typedefs, one of these two forms will be more
-//       // convenient:
-//       request->ForwardResult(Tuple1<int>(return_value));
-//
-//       // -- or --  (inferior in this case)
-//       request->ForwardResult(Frontend::RequestCallbackType::TupleType(
-//           return_value));
-//     }
-//   };
-
-#ifndef CHROME_BROWSER_CANCELABLE_REQUEST_H__
-#define CHROME_BROWSER_CANCELABLE_REQUEST_H__
+#ifndef CHROME_BROWSER_CANCELABLE_REQUEST_H_
+#define CHROME_BROWSER_CANCELABLE_REQUEST_H_
 #pragma once
 
-#include <map>
-#include <vector>
-
-#include "base/basictypes.h"
-#include "base/callback.h"
-#include "base/logging.h"
-#include "base/message_loop.h"
-#include "base/ref_counted.h"
-#include "base/scoped_ptr.h"
-#include "base/synchronization/cancellation_flag.h"
-#include "base/synchronization/lock.h"
-#include "base/task.h"
-#include "build/build_config.h"
-
-class CancelableRequestBase;
-class CancelableRequestConsumerBase;
-
-// CancelableRequestProvider --------------------------------------------------
-//
-// This class is threadsafe. Requests may be added or canceled from any thread,
-// but a task must only be canceled from the same thread it was initially run
-// on.
-//
-// It is intended that providers inherit from this class to provide the
-// necessary functionality.
-
-class CancelableRequestProvider {
- public:
-  // Identifies a specific request from this provider.
-  typedef int Handle;
-
-  CancelableRequestProvider();
-  virtual ~CancelableRequestProvider();
-
-  // Called by the enduser of the request to cancel it. This MUST be called on
-  // the same thread that originally issued the request (which is also the same
-  // thread that would have received the callback if it was not canceled).
-  // handle must be for a valid pending (not yet complete or cancelled) request.
-  void CancelRequest(Handle handle);
-
- protected:
-  // Adds a new request and initializes it. This is called by a derived class
-  // to add a new request. The request's Init() will be called (which is why
-  // the consumer is required. The handle to the new request is returned.
-  Handle AddRequest(CancelableRequestBase* request,
-                    CancelableRequestConsumerBase* consumer);
-
-  // Called by the CancelableRequest when the request has executed. It will
-  // be removed from the list of pending requests (as opposed to canceling,
-  // which will also set some state on the request).
-  void RequestCompleted(Handle handle);
-
- private:
-  typedef std::map<Handle, scoped_refptr<CancelableRequestBase> >
-      CancelableRequestMap;
-
-  // Only call this when you already have acquired pending_request_lock_.
-  void CancelRequestLocked(const CancelableRequestMap::iterator& item);
-
-  friend class CancelableRequestBase;
-
-  base::Lock pending_request_lock_;
-
-  // Lists all outstanding requests. Protected by the |lock_|.
-  CancelableRequestMap pending_requests_;
-
-  // The next handle value we will return. Protected by the |lock_|.
-  int next_handle_;
-
-  DISALLOW_COPY_AND_ASSIGN(CancelableRequestProvider);
-};
-
-// CancelableRequestConsumer --------------------------------------------------
-//
-// Classes wishing to make requests on a provider should have an instance of
-// this class. Callers will need to pass a pointer to this consumer object
-// when they make the request. It will automatically track any pending
-// requests, and will automatically cancel them on destruction to prevent the
-// accidental calling of freed memory.
-//
-// It is recommended to just have this class as a member variable since there
-// is nothing to be gained by inheriting from it other than polluting your
-// namespace.
-//
-// THIS CLASS IS NOT THREADSAFE (unlike the provider). You must make requests
-// and get callbacks all from the same thread.
-
-// Base class used to notify of new requests.
-class CancelableRequestConsumerBase {
- protected:
-  friend class CancelableRequestBase;
-  friend class CancelableRequestProvider;
-
-  virtual ~CancelableRequestConsumerBase() {
-  }
-
-  // Adds a new request to the list of requests that are being tracked. This
-  // is called by the provider when a new request is created.
-  virtual void OnRequestAdded(CancelableRequestProvider* provider,
-                              CancelableRequestProvider::Handle handle) = 0;
-
-  // Removes the given request from the list of pending requests. Called
-  // by the CancelableRequest immediately after the callback has executed for a
-  // given request, and by the provider when a request is canceled.
-  virtual void OnRequestRemoved(CancelableRequestProvider* provider,
-                                CancelableRequestProvider::Handle handle) = 0;
-
-  // Sent to provider before executing a callback.
-  virtual void WillExecute(CancelableRequestProvider* provider,
-                           CancelableRequestProvider::Handle handle) = 0;
-
-  // Sent after executing a callback.
-  virtual void DidExecute(CancelableRequestProvider* provider,
-                          CancelableRequestProvider::Handle handle) = 0;
-};
-
-// Template for clients to use. It allows them to associate random "client
-// data" with a specific request. The default value for this type is 0.
-// The type T should be small and easily copyable (like a pointer
-// or an integer).
-template<class T>
-class CancelableRequestConsumerTSimple : public CancelableRequestConsumerBase {
- public:
-  CancelableRequestConsumerTSimple();
-
-  // Cancel any outstanding requests so that we do not get called back after we
-  // are destroyed. As these requests are removed, the providers will call us
-  // back on OnRequestRemoved, which will then update the list. To iterate
-  // successfully while the list is changing out from under us, we make a copy.
-  virtual ~CancelableRequestConsumerTSimple();
-
-  // Associates some random data with a specified request. The request MUST be
-  // outstanding, or it will assert. This is intended to be called immediately
-  // after a request is issued.
-  void SetClientData(CancelableRequestProvider* p,
-                     CancelableRequestProvider::Handle h,
-                     T client_data);
-
-  // Retrieves previously associated data for a specified request. The request
-  // MUST be outstanding, or it will assert. This is intended to be called
-  // during processing of a callback to retrieve extra data.
-  T GetClientData(CancelableRequestProvider* p,
-                  CancelableRequestProvider::Handle h);
-
-  // Returns the data associated with the current request being processed. This
-  // is only valid during the time a callback is being processed.
-  T GetClientDataForCurrentRequest();
-
-  // Returns true if there are any pending requests.
-  bool HasPendingRequests() const;
-
-  // Returns the number of pending requests.
-  size_t PendingRequestCount() const;
-
-  // Cancels all requests outstanding.
-  void CancelAllRequests();
-
-  // Returns the handle for the first request that has the specified client data
-  // (in |handle|). Returns true if there is a request for the specified client
-  // data, false otherwise.
-  bool GetFirstHandleForClientData(T client_data,
-                                   CancelableRequestProvider::Handle* handle);
-
-  // Gets the client data for all pending requests.
-  void GetAllClientData(std::vector<T>* data);
-
- protected:
-  struct PendingRequest {
-    PendingRequest(CancelableRequestProvider* p,
-                   CancelableRequestProvider::Handle h)
-        : provider(p), handle(h) {
-    }
-
-    PendingRequest() : provider(NULL), handle(0) {}
-
-    // Comparison operator for stl.
-    bool operator<(const PendingRequest& other) const {
-      if (provider != other.provider)
-        return provider < other.provider;
-      return handle < other.handle;
-    }
-
-    bool is_valid() const { return provider != NULL; }
-
-    CancelableRequestProvider* provider;
-    CancelableRequestProvider::Handle handle;
-  };
-  typedef std::map<PendingRequest, T> PendingRequestList;
-
-  virtual T get_initial_t() const;
-
-  virtual void OnRequestAdded(CancelableRequestProvider* provider,
-                              CancelableRequestProvider::Handle handle);
-
-  virtual void OnRequestRemoved(CancelableRequestProvider* provider,
-                                CancelableRequestProvider::Handle handle);
-
-  virtual void WillExecute(CancelableRequestProvider* provider,
-                           CancelableRequestProvider::Handle handle);
-
-  virtual void DidExecute(CancelableRequestProvider* provider,
-                          CancelableRequestProvider::Handle handle);
-
-  // Lists all outstanding requests.
-  PendingRequestList pending_requests_;
-
-  // This is valid while processing a request and is used to identify the
-  // provider/handle of request.
-  PendingRequest current_request_;
-};
-
-template<class T>
-CancelableRequestConsumerTSimple<T>::CancelableRequestConsumerTSimple() {
-}
-
-template<class T>
-CancelableRequestConsumerTSimple<T>::~CancelableRequestConsumerTSimple() {
-  CancelAllRequests();
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::SetClientData(
-    CancelableRequestProvider* p,
-    CancelableRequestProvider::Handle h,
-    T client_data) {
-  PendingRequest request(p, h);
-  DCHECK(pending_requests_.find(request) != pending_requests_.end());
-  pending_requests_[request] = client_data;
-}
-
-template<class T>
-T CancelableRequestConsumerTSimple<T>::GetClientData(
-    CancelableRequestProvider* p,
-    CancelableRequestProvider::Handle h) {
-  PendingRequest request(p, h);
-  DCHECK(pending_requests_.find(request) != pending_requests_.end());
-  return pending_requests_[request];
-}
-
-template<class T>
-T CancelableRequestConsumerTSimple<T>::GetClientDataForCurrentRequest() {
-  DCHECK(current_request_.is_valid());
-  return GetClientData(current_request_.provider, current_request_.handle);
-}
-
-template<class T>
-bool CancelableRequestConsumerTSimple<T>::HasPendingRequests() const {
-  return !pending_requests_.empty();
-}
-
-template<class T>
-size_t CancelableRequestConsumerTSimple<T>::PendingRequestCount() const {
-  return pending_requests_.size();
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::CancelAllRequests() {
-  PendingRequestList copied_requests(pending_requests_);
-  for (typename PendingRequestList::iterator i = copied_requests.begin();
-       i != copied_requests.end(); ++i)
-    i->first.provider->CancelRequest(i->first.handle);
-  copied_requests.clear();
-
-  // That should have cleared all the pending items.
-  DCHECK(pending_requests_.empty());
-}
-
-template<class T>
-bool CancelableRequestConsumerTSimple<T>::GetFirstHandleForClientData(
-    T client_data,
-    CancelableRequestProvider::Handle* handle) {
-  for (typename PendingRequestList::const_iterator i =
-           pending_requests_.begin(); i != pending_requests_.end(); ++i) {
-    if (i->second == client_data) {
-      *handle = i->first.handle;
-      return true;
-    }
-  }
-  *handle = 0;
-  return false;
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::GetAllClientData(
-    std::vector<T>* data) {
-  DCHECK(data);
-  for (typename PendingRequestList::iterator i = pending_requests_.begin();
-       i != pending_requests_.end(); ++i)
-    data->push_back(i->second);
-}
-
-template<class T>
-T CancelableRequestConsumerTSimple<T>::get_initial_t() const {
-  return 0;
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::OnRequestAdded(
-    CancelableRequestProvider* provider,
-    CancelableRequestProvider::Handle handle) {
-  DCHECK(pending_requests_.find(PendingRequest(provider, handle)) ==
-         pending_requests_.end());
-  pending_requests_[PendingRequest(provider, handle)] = get_initial_t();
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::OnRequestRemoved(
-    CancelableRequestProvider* provider,
-    CancelableRequestProvider::Handle handle) {
-  typename PendingRequestList::iterator i =
-      pending_requests_.find(PendingRequest(provider, handle));
-  if (i == pending_requests_.end()) {
-    NOTREACHED() << "Got a complete notification for a nonexistent request";
-    return;
-  }
-
-  pending_requests_.erase(i);
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::WillExecute(
-    CancelableRequestProvider* provider,
-    CancelableRequestProvider::Handle handle) {
-  current_request_ = PendingRequest(provider, handle);
-}
-
-template<class T>
-void CancelableRequestConsumerTSimple<T>::DidExecute(
-    CancelableRequestProvider* provider,
-    CancelableRequestProvider::Handle handle) {
-  current_request_ = PendingRequest();
-}
-
-// See CancelableRequestConsumerTSimple. The default value for T
-// is given in |initial_t|.
-template<class T, T initial_t>
-class CancelableRequestConsumerT : public CancelableRequestConsumerTSimple<T> {
- public:
-  CancelableRequestConsumerT();
-  virtual ~CancelableRequestConsumerT();
-
- protected:
-  virtual T get_initial_t() const;
-};
-
-template<class T, T initial_t>
-CancelableRequestConsumerT<T, initial_t>::CancelableRequestConsumerT() {
-}
-
-template<class T, T initial_t>
-CancelableRequestConsumerT<T, initial_t>::~CancelableRequestConsumerT() {
-}
-
-template<class T, T initial_t>
-T CancelableRequestConsumerT<T, initial_t>::get_initial_t() const {
-  return initial_t;
-}
-
-// Some clients may not want to store data. Rather than do some complicated
-// thing with virtual functions to allow some consumers to store extra data and
-// some not to, we just define a default one that stores some dummy data.
-typedef CancelableRequestConsumerT<int, 0> CancelableRequestConsumer;
-
-// MSVC doesn't like complex extern templates and DLLs.
-#if !defined(COMPILER_MSVC)
-// The vast majority of CancelableRequestConsumers are instantiated on <int>,
-// so prevent that template from being expanded in normal code.
-extern template class CancelableRequestConsumerTSimple<int>;
-
-// We'll also want to extern-template the most common, typedef-ed
-// CancelableRequestConsumerT.
-extern template class CancelableRequestConsumerT<int, 0>;
-#endif
-
-// CancelableRequest ----------------------------------------------------------
-//
-// The request object that is used by a CancelableRequestProvider to send
-// results to a CancelableRequestConsumer. This request handles the returning
-// of results from a thread where the request is being executed to the thread
-// and callback where the results are used. IT SHOULD BE PASSED AS A
-// scoped_refptr TO KEEP IT ALIVE.
-//
-// It does not handle input parameters to the request. The caller must either
-// transfer those separately or derive from this class to add the desired
-// parameters.
-//
-// When the processing is complete on this message, the caller MUST call
-// ForwardResult() with the return arguments that will be passed to the
-// callback. If the request has been canceled, Return is optional (it will not
-// do anything). If you do not have to return to the caller, the cancelable
-// request system should not be used! (just use regular fire-and-forget tasks).
-//
-// Callback parameters are passed by value. In some cases, the request will
-// want to return a large amount of data (for example, an image). One good
-// approach is to derive from the CancelableRequest and make the data object
-// (for example, a std::vector) owned by the CancelableRequest. The pointer
-// to this data would be passed for the callback parameter. Since the
-// CancelableRequest outlives the callback call, the data will be valid on the
-// other thread for the callback, but will still be destroyed properly.
-
-// Non-templatized base class that provides cancellation
-class CancelableRequestBase
-    : public base::RefCountedThreadSafe<CancelableRequestBase> {
- public:
-  friend class CancelableRequestProvider;
-
-  // Initializes most things to empty, Init() must be called to complete
-  // initialization of the object. This will be done by the provider when
-  // the request is dispatched.
-  //
-  // This must be called on the same thread the callback will be executed on,
-  // it will save that thread for later.
-  //
-  // This two-phase init is done so that the constructor can have no
-  // parameters, which makes it much more convenient for derived classes,
-  // which can be common. The derived classes need only declare the variables
-  // they provide in the constructor rather than many lines of internal
-  // tracking data that are passed to the base class (us).
-  //
-  // In addition, not all of the information (for example, the handle) is known
-  // at construction time.
-  CancelableRequestBase();
-
-  CancelableRequestConsumerBase* consumer() const {
-    return consumer_;
-  }
-
-  CancelableRequestProvider::Handle handle() const {
-    return handle_;
-  }
-
-  // The canceled flag indicates that the request should not be executed.
-  // A request can never be uncanceled, so only a setter for true is provided.
-  // This can be called multiple times, but only from one thread.
-  void set_canceled() {
-    canceled_.Set();
-  }
-  bool canceled() {
-    return canceled_.IsSet();
-  }
-
- protected:
-  friend class base::RefCountedThreadSafe<CancelableRequestBase>;
-  virtual ~CancelableRequestBase();
-
-  // Initializes the object with the particulars from the provider. It may only
-  // be called once (it is called by the provider, which is a friend).
-  void Init(CancelableRequestProvider* provider,
-            CancelableRequestProvider::Handle handle,
-            CancelableRequestConsumerBase* consumer);
-
-  // Tells the provider that the request is complete, which then tells the
-  // consumer.
-  void NotifyCompleted() const {
-    provider_->RequestCompleted(handle());
-    consumer_->DidExecute(provider_, handle_);
-  }
-
-  // Cover method for CancelableRequestConsumerBase::WillExecute.
-  void WillExecute() {
-    consumer_->WillExecute(provider_, handle_);
-  }
-
-  // The message loop that this request was created on. The callback will
-  // happen on the same thread.
-  MessageLoop* callback_thread_;
-
-  // The provider for this request. When we execute, we will notify this that
-  // request is complete to it can remove us from the requests it tracks.
-  CancelableRequestProvider* provider_;
-
-  // Notified after we execute that the request is complete.  This should only
-  // be accessed if !canceled_.IsSet(), otherwise the pointer is invalid.
-  CancelableRequestConsumerBase* consumer_;
-
-  // The handle to this request inside the provider. This will be initialized
-  // to 0 when the request is created, and the provider will set it once the
-  // request has been dispatched.
-  CancelableRequestProvider::Handle handle_;
-
-  // Set if the caller cancels this request. No callbacks should be made when
-  // this is set.
-  base::CancellationFlag canceled_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(CancelableRequestBase);
-};
-
-// Templatized class. This is the one you should use directly or inherit from.
-// The callback can be invoked by calling the ForwardResult() method. For this,
-// you must either pack the parameters into a tuple, or use DispatchToMethod
-// (in tuple.h).
-//
-// If you inherit to add additional input parameters or to do more complex
-// memory management (see the bigger comment about this above), you can put
-// those on a subclass of this.
-//
-// We have decided to allow users to treat derived classes of this as structs,
-// so you can add members without getters and setters (which just makes the
-// code harder to read). Don't use underscores after these vars. For example:
-//
-//   typedef Callback1<int>::Type DoodieCallback;
-//
-//   class DoodieRequest : public CancelableRequest<DoodieCallback> {
-//    public:
-//     DoodieRequest(CallbackType* callback) : CancelableRequest(callback) {
-//     }
-//
-//    private:
-//     ~DoodieRequest() {}
-//
-//     int input_arg1;
-//     std::wstring input_arg2;
-//   };
-template<typename CB>
-class CancelableRequest : public CancelableRequestBase {
- public:
-  typedef CB CallbackType;          // CallbackRunner<...>
-  typedef typename CB::TupleType TupleType;  // Tuple of the callback args.
-
-  // The provider MUST call Init() (on the base class) before this is valid.
-  // This class will take ownership of the callback object and destroy it when
-  // appropriate.
-  explicit CancelableRequest(CallbackType* callback)
-      : CancelableRequestBase(),
-        callback_(callback) {
-    DCHECK(callback) << "We should always have a callback";
-  }
-
-  // Dispatches the parameters to the correct thread so the callback can be
-  // executed there. The caller does not need to check for cancel before
-  // calling this. It is optional in the cancelled case. In the non-cancelled
-  // case, this MUST be called.
-  //
-  // If there are any pointers in the parameters, they must live at least as
-  // long as the request so that it can be forwarded to the other thread.
-  // For complex objects, this would typically be done by having a derived
-  // request own the data itself.
-  void ForwardResult(const TupleType& param) {
-    DCHECK(callback_.get());
-    if (!canceled()) {
-      if (callback_thread_ == MessageLoop::current()) {
-        // We can do synchronous callbacks when we're on the same thread.
-        ExecuteCallback(param);
-      } else {
-        callback_thread_->PostTask(FROM_HERE, NewRunnableMethod(this,
-            &CancelableRequest<CB>::ExecuteCallback, param));
-      }
-    }
-  }
-
-  // Like |ForwardResult| but this never does a synchronous callback.
-  void ForwardResultAsync(const TupleType& param) {
-    DCHECK(callback_.get());
-    if (!canceled()) {
-      callback_thread_->PostTask(FROM_HERE, NewRunnableMethod(this,
-          &CancelableRequest<CB>::ExecuteCallback, param));
-    }
-  }
-
- protected:
-  virtual ~CancelableRequest() {}
-
- private:
-  // Executes the callback and notifies the provider and the consumer that this
-  // request has been completed. This must be called on the callback_thread_.
-  void ExecuteCallback(const TupleType& param) {
-    if (!canceled_.IsSet()) {
-      WillExecute();
-
-      // Execute the callback.
-      callback_->RunWithParams(param);
-
-      // Notify the provider that the request is complete. The provider will
-      // notify the consumer for us.
-      NotifyCompleted();
-    }
-  }
-
-  // This should only be executed if !canceled_.IsSet(),
-  // otherwise the pointers may be invalid.
-  scoped_ptr<CallbackType> callback_;
-};
-
-// A CancelableRequest with a single value. This is intended for use when
-// the provider provides a single value. The provider fills the result into
-// the value, and notifies the request with a pointer to the value. For example,
-// HistoryService has many methods that callback with a vector. Use the
-// following pattern for this:
-// 1. Define the callback:
-//      typedef Callback2<Handle, std::vector<Foo>*>::Type FooCallback;
-// 2. Define the CancelableRequest1 type.
-//    typedef CancelableRequest1<FooCallback, std::vector<Foo>> FooRequest;
-// 3. The provider method should then fillin the contents of the vector,
-//    forwarding the result like so:
-//    request->ForwardResult(FooRequest::TupleType(request->handle(),
-//                                                 &request->value));
-//
-// Tip: for passing more than one value, use a Tuple for the value.
-template<typename CB, typename Type>
-class CancelableRequest1 : public CancelableRequest<CB> {
- public:
-  explicit CancelableRequest1(
-      typename CancelableRequest<CB>::CallbackType* callback)
-      : CancelableRequest<CB>(callback) {
-  }
-
-  // The value.
-  Type value;
-
- protected:
-  virtual ~CancelableRequest1() {}
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/cancelable_request.h"
 
-#endif  // CHROME_BROWSER_CANCELABLE_REQUEST_H__
+#endif  // CHROME_BROWSER_CANCELABLE_REQUEST_H_
diff --git a/chrome/browser/cert_store.h b/chrome/browser/cert_store.h
index fb5eeec..8c2ca5c 100644
--- a/chrome/browser/cert_store.h
+++ b/chrome/browser/cert_store.h
@@ -6,79 +6,7 @@
 #define CHROME_BROWSER_CERT_STORE_H_
 #pragma once
 
-#include <map>
-
-#include "base/singleton.h"
-#include "base/synchronization/lock.h"
-#include "chrome/common/notification_observer.h"
-#include "chrome/common/notification_registrar.h"
-#include "net/base/x509_certificate.h"
-
-// The purpose of the cert store is to provide an easy way to store/retrieve
-// X509Certificate objects.  When stored, an X509Certificate object is
-// associated with a RenderProcessHost.  If all the RenderProcessHosts
-// associated with the cert have exited, the cert is removed from the store.
-// This class is used by the SSLManager to keep track of the certs associated
-// to loaded resources.
-// It can be accessed from the UI and IO threads (it is thread-safe).
-// Note that the cert ids will overflow if we register more than 2^32 - 1 certs
-// in 1 browsing session (which is highly unlikely to happen).
-
-class CertStore : public NotificationObserver {
- public:
-  // Returns the singleton instance of the CertStore.
-  static CertStore* GetInstance();
-
-  // Stores the specified cert and returns the id associated with it.  The cert
-  // is associated to the specified RenderProcessHost.
-  // When all the RenderProcessHosts associated with a cert have exited, the
-  // cert is removed from the store.
-  // Note: ids starts at 1.
-  int StoreCert(net::X509Certificate* cert, int render_process_host_id);
-
-  // Tries to retrieve the previously stored cert associated with the specified
-  // |cert_id|.  Returns whether the cert could be found, and, if |cert| is
-  // non-NULL, copies it in.
-  bool RetrieveCert(int cert_id, scoped_refptr<net::X509Certificate>* cert);
-
-  // NotificationObserver implementation.
-  virtual void Observe(NotificationType type,
-                       const NotificationSource& source,
-                       const NotificationDetails& details);
-
- private:
-  friend struct DefaultSingletonTraits<CertStore>;
-
-  CertStore();
-  ~CertStore();
-
-  // Remove the specified cert from id_to_cert_ and cert_to_id_.
-  // NOTE: the caller (RemoveCertsForRenderProcesHost) must hold cert_lock_.
-  void RemoveCertInternal(int cert_id);
-
-  // Removes all the certs associated with the specified process from the store.
-  void RemoveCertsForRenderProcesHost(int render_process_host_id);
-
-  typedef std::multimap<int, int> IDMap;
-  typedef std::map<int, scoped_refptr<net::X509Certificate> > CertMap;
-  typedef std::map<net::X509Certificate*, int, net::X509Certificate::LessThan>
-      ReverseCertMap;
-
-  NotificationRegistrar registrar_;
-
-  IDMap process_id_to_cert_id_;
-  IDMap cert_id_to_process_id_;
-
-  CertMap id_to_cert_;
-  ReverseCertMap cert_to_id_;
-
-  int next_cert_id_;
-
-  // This lock protects: process_to_ids_, id_to_processes_, id_to_cert_ and
-  //                     cert_to_id_.
-  base::Lock cert_lock_;
-
-  DISALLOW_COPY_AND_ASSIGN(CertStore);
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/cert_store.h"
 
 #endif  // CHROME_BROWSER_CERT_STORE_H_
diff --git a/chrome/browser/certificate_manager_model.h b/chrome/browser/certificate_manager_model.h
index 137197d..ecd2fcd 100644
--- a/chrome/browser/certificate_manager_model.h
+++ b/chrome/browser/certificate_manager_model.h
@@ -5,106 +5,7 @@
 #ifndef CHROME_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
 #define CHROME_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
 
-#include <map>
-#include <string>
-
-#include "base/ref_counted.h"
-#include "base/string16.h"
-#include "net/base/cert_database.h"
-
-// CertificateManagerModel provides the data to be displayed in the certificate
-// manager dialog, and processes changes from the view.
-class CertificateManagerModel {
- public:
-  // Map from the subject organization name to the list of certs from that
-  // organization.  If a cert does not have an organization name, the
-  // subject's CertPrincipal::GetDisplayName() value is used instead.
-  typedef std::map<std::string, net::CertificateList> OrgGroupingMap;
-
-  // Enumeration of the possible columns in the certificate manager tree view.
-  enum Column {
-    COL_SUBJECT_NAME,
-    COL_CERTIFICATE_STORE,
-    COL_SERIAL_NUMBER,
-    COL_EXPIRES_ON,
-  };
-
-  class Observer {
-   public:
-    // Called to notify the view that the certificate list has been refreshed.
-    // TODO(mattm): do a more granular updating strategy?  Maybe retrieve new
-    // list of certs, diff against past list, and then notify of the changes?
-    virtual void CertificatesRefreshed() = 0;
-  };
-
-  explicit CertificateManagerModel(Observer* observer);
-  ~CertificateManagerModel();
-
-  // Accessor for read-only access to the underlying CertDatabase.
-  const net::CertDatabase& cert_db() const { return cert_db_; }
-
-  // Refresh the list of certs.  Following this call, the observer
-  // CertificatesRefreshed method will be called so the view can call
-  // FilterAndBuildOrgGroupingMap as necessary to refresh its tree views.
-  void Refresh();
-
-  // Fill |map| with the certificates matching |filter_type|.
-  void FilterAndBuildOrgGroupingMap(net::CertType filter_type,
-                                    OrgGroupingMap* map) const;
-
-  // Get the data to be displayed in |column| for the given |cert|.
-  string16 GetColumnText(const net::X509Certificate& cert, Column column) const;
-
-  // Import certificates from PKCS #12 encoded |data|, using the given
-  // |password|.  Returns a net error code on failure.
-  int ImportFromPKCS12(net::CryptoModule* module, const std::string& data,
-                       const string16& password);
-
-  // Import CA certificates.
-  // Tries to import all the certificates given.  The root will be trusted
-  // according to |trust_bits|.  Any certificates that could not be imported
-  // will be listed in |not_imported|.
-  // |trust_bits| should be a bit field of TRUST_* values from CertDatabase, or
-  // UNTRUSTED.
-  // Returns false if there is an internal error, otherwise true is returned and
-  // |not_imported| should be checked for any certificates that were not
-  // imported.
-  bool ImportCACerts(const net::CertificateList& certificates,
-                     unsigned int trust_bits,
-                     net::CertDatabase::ImportCertFailureList* not_imported);
-
-  // Import server certificate.  The first cert should be the server cert.  Any
-  // additional certs should be intermediate/CA certs and will be imported but
-  // not given any trust.
-  // Any certificates that could not be imported will be listed in
-  // |not_imported|.
-  // Returns false if there is an internal error, otherwise true is returned and
-  // |not_imported| should be checked for any certificates that were not
-  // imported.
-  bool ImportServerCert(
-      const net::CertificateList& certificates,
-      net::CertDatabase::ImportCertFailureList* not_imported);
-
-  // Set trust values for certificate.
-  // |trust_bits| should be a bit field of TRUST_* values from CertDatabase, or
-  // UNTRUSTED.
-  // Returns true on success or false on failure.
-  bool SetCertTrust(const net::X509Certificate* cert,
-                    net::CertType type,
-                    unsigned int trust_bits);
-
-  // Delete the cert.  Returns true on success.  |cert| is still valid when this
-  // function returns.
-  bool Delete(net::X509Certificate* cert);
-
- private:
-  net::CertDatabase cert_db_;
-  net::CertificateList cert_list_;
-
-  // The observer to notify when certificate list is refreshed.
-  Observer* observer_;
-
-  DISALLOW_COPY_AND_ASSIGN(CertificateManagerModel);
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/certificate_manager_model.h"
 
 #endif  // CHROME_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
diff --git a/chrome/browser/certificate_viewer.h b/chrome/browser/certificate_viewer.h
index 89b0e04..54ab294 100644
--- a/chrome/browser/certificate_viewer.h
+++ b/chrome/browser/certificate_viewer.h
@@ -6,20 +6,7 @@
 #define CHROME_BROWSER_CERTIFICATE_VIEWER_H_
 #pragma once
 
-#include "ui/gfx/native_widget_types.h"
-
-namespace net {
-
-class X509Certificate;
-
-}  // namespace net
-
-// Opens a certificate viewer under |parent| to display the certificate from
-// the |CertStore| with id |cert_id|.
-void ShowCertificateViewerByID(gfx::NativeWindow parent, int cert_id);
-
-// Opens a certificate viewer under |parent| to display |cert|.
-void ShowCertificateViewer(gfx::NativeWindow parent,
-                           net::X509Certificate* cert);
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/certificate_viewer.h"
 
 #endif  // CHROME_BROWSER_CERTIFICATE_VIEWER_H_
diff --git a/chrome/browser/child_process_launcher.h b/chrome/browser/child_process_launcher.h
index a3add53..f05d3b0 100644
--- a/chrome/browser/child_process_launcher.h
+++ b/chrome/browser/child_process_launcher.h
@@ -6,66 +6,8 @@
 #define CHROME_BROWSER_CHILD_PROCESS_LAUNCHER_H_
 #pragma once
 
-#include "base/basictypes.h"
-#include "base/process_util.h"
-#include "base/ref_counted.h"
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/child_process_launcher.h"
 
-class CommandLine;
-
-// Launches a process asynchronously and notifies the client of the process
-// handle when it's available.  It's used to avoid blocking the calling thread
-// on the OS since often it can take > 100 ms to create the process.
-class ChildProcessLauncher {
- public:
-  class Client {
-   public:
-    // Will be called on the thread that the ChildProcessLauncher was
-    // constructed on.
-    virtual void OnProcessLaunched() = 0;
-
-   protected:
-    virtual ~Client() {}
-  };
-
-  // Launches the process asynchronously, calling the client when the result is
-  // ready.  Deleting this object before the process is created is safe, since
-  // the callback won't be called.  If the process is still running by the time
-  // this object destructs, it will be terminated.
-  // Takes ownership of cmd_line.
-  ChildProcessLauncher(
-#if defined(OS_WIN)
-      const FilePath& exposed_dir,
-#elif defined(OS_POSIX)
-      bool use_zygote,
-      const base::environment_vector& environ,
-      int ipcfd,
-#endif
-      CommandLine* cmd_line,
-      Client* client);
-  ~ChildProcessLauncher();
-
-  // True if the process is being launched and so the handle isn't available.
-  bool IsStarting();
-
-  // Getter for the process handle.  Only call after the process has started.
-  base::ProcessHandle GetHandle();
-
-  // Call this when the child process exits to know what happened to
-  // it.  |exit_code| is the exit code of the process if it exited
-  // (e.g. status from waitpid if on posix, from GetExitCodeProcess on
-  // Windows). |exit_code| may be NULL.
-  base::TerminationStatus GetChildTerminationStatus(int* exit_code);
-
-  // Changes whether the process runs in the background or not.  Only call
-  // this after the process has started.
-  void SetProcessBackgrounded(bool background);
-
- private:
-  class Context;
-
-  scoped_refptr<Context> context_;
-
-  DISALLOW_COPY_AND_ASSIGN(ChildProcessLauncher);
-};
 
 #endif  // CHROME_BROWSER_CHILD_PROCESS_LAUNCHER_H_
diff --git a/chrome/browser/child_process_security_policy.h b/chrome/browser/child_process_security_policy.h
index 9a99698..ce0adf2 100644
--- a/chrome/browser/child_process_security_policy.h
+++ b/chrome/browser/child_process_security_policy.h
@@ -7,158 +7,7 @@
 
 #pragma once
 
-#include <map>
-#include <set>
-#include <string>
-
-#include "base/basictypes.h"
-#include "base/gtest_prod_util.h"
-#include "base/singleton.h"
-#include "base/synchronization/lock.h"
-
-class FilePath;
-class GURL;
-
-// The ChildProcessSecurityPolicy class is used to grant and revoke security
-// capabilities for child porcesses.  For example, it restricts whether a child
-// process is permmitted to loaded file:// URLs based on whether the process
-// has ever been commanded to load file:// URLs by the browser.
-//
-// ChildProcessSecurityPolicy is a singleton that may be used on any thread.
-//
-class ChildProcessSecurityPolicy {
- public:
-  // Object can only be created through GetInstance() so the constructor is
-  // private.
-  ~ChildProcessSecurityPolicy();
-
-  // There is one global ChildProcessSecurityPolicy object for the entire
-  // browser process.  The object returned by this method may be accessed on
-  // any thread.
-  static ChildProcessSecurityPolicy* GetInstance();
-
-  // Web-safe schemes can be requested by any child process.  Once a web-safe
-  // scheme has been registered, any child process can request URLs with
-  // that scheme.  There is no mechanism for revoking web-safe schemes.
-  void RegisterWebSafeScheme(const std::string& scheme);
-
-  // Returns true iff |scheme| has been registered as a web-safe scheme.
-  bool IsWebSafeScheme(const std::string& scheme);
-
-  // Pseudo schemes are treated differently than other schemes because they
-  // cannot be requested like normal URLs.  There is no mechanism for revoking
-  // pseudo schemes.
-  void RegisterPseudoScheme(const std::string& scheme);
-
-  // Returns true iff |scheme| has been registered as pseudo scheme.
-  bool IsPseudoScheme(const std::string& scheme);
-
-  // Upon creation, child processes should register themselves by calling this
-  // this method exactly once.
-  void Add(int child_id);
-
-  // Upon destruction, child processess should unregister themselves by caling
-  // this method exactly once.
-  void Remove(int child_id);
-
-  // Whenever the browser processes commands the child process to request a URL,
-  // it should call this method to grant the child process the capability to
-  // request the URL.
-  void GrantRequestURL(int child_id, const GURL& url);
-
-  // Whenever the user picks a file from a <input type="file"> element, the
-  // browser should call this function to grant the child process the capability
-  // to upload the file to the web.
-  void GrantReadFile(int child_id, const FilePath& file);
-
-  // Grants certain permissions to a file. |permissions| must be a bit-set of
-  // base::PlatformFileFlags.
-  void GrantPermissionsForFile(int child_id,
-                               const FilePath& file,
-                               int permissions);
-
-  // Revokes all permissions granted to the given file.
-  void RevokeAllPermissionsForFile(int child_id, const FilePath& file);
-
-  // Grants the child process the capability to access URLs of the provided
-  // scheme.
-  void GrantScheme(int child_id, const std::string& scheme);
-
-  // Grant the child process the ability to use Web UI Bindings.
-  void GrantWebUIBindings(int child_id);
-
-  // Grant the child process the ability to use extension Bindings.
-  void GrantExtensionBindings(int child_id);
-
-  // Grant the child process the ability to read raw cookies.
-  void GrantReadRawCookies(int child_id);
-
-  // Revoke read raw cookies permission.
-  void RevokeReadRawCookies(int child_id);
-
-  // Before servicing a child process's request for a URL, the browser should
-  // call this method to determine whether the process has the capability to
-  // request the URL.
-  bool CanRequestURL(int child_id, const GURL& url);
-
-  // Before servicing a child process's request to upload a file to the web, the
-  // browser should call this method to determine whether the process has the
-  // capability to upload the requested file.
-  bool CanReadFile(int child_id, const FilePath& file);
-
-  // Determines if certain permissions were granted for a file. |permissions|
-  // must be a bit-set of base::PlatformFileFlags.
-  bool HasPermissionsForFile(int child_id,
-                             const FilePath& file,
-                             int permissions);
-
-  // Returns true if the specified child_id has been granted WebUIBindings.
-  // The browser should check this property before assuming the child process is
-  // allowed to use WebUIBindings.
-  bool HasWebUIBindings(int child_id);
-
-  // Returns true if the specified child_id has been granted WebUIBindings.
-  // The browser should check this property before assuming the child process is
-  // allowed to use extension bindings.
-  bool HasExtensionBindings(int child_id);
-
-  // Returns true if the specified child_id has been granted ReadRawCookies.
-  bool CanReadRawCookies(int child_id);
-
- private:
-  friend class ChildProcessSecurityPolicyInProcessBrowserTest;
-  FRIEND_TEST_ALL_PREFIXES(ChildProcessSecurityPolicyInProcessBrowserTest,
-                           NoLeak);
-
-  class SecurityState;
-
-  typedef std::set<std::string> SchemeSet;
-  typedef std::map<int, SecurityState*> SecurityStateMap;
-
-  // Obtain an instance of ChildProcessSecurityPolicy via GetInstance().
-  ChildProcessSecurityPolicy();
-  friend struct DefaultSingletonTraits<ChildProcessSecurityPolicy>;
-
-  // You must acquire this lock before reading or writing any members of this
-  // class.  You must not block while holding this lock.
-  base::Lock lock_;
-
-  // These schemes are white-listed for all child processes.  This set is
-  // protected by |lock_|.
-  SchemeSet web_safe_schemes_;
-
-  // These schemes do not actually represent retrievable URLs.  For example,
-  // the the URLs in the "about" scheme are aliases to other URLs.  This set is
-  // protected by |lock_|.
-  SchemeSet pseudo_schemes_;
-
-  // This map holds a SecurityState for each child process.  The key for the
-  // map is the ID of the ChildProcessHost.  The SecurityState objects are
-  // owned by this object and are protected by |lock_|.  References to them must
-  // not escape this class.
-  SecurityStateMap security_state_;
-
-  DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicy);
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/child_process_security_policy.h"
 
 #endif  // CHROME_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_
diff --git a/chrome/browser/chrome_blob_storage_context.h b/chrome/browser/chrome_blob_storage_context.h
index 5bd8a10..ffa74f2 100644
--- a/chrome/browser/chrome_blob_storage_context.h
+++ b/chrome/browser/chrome_blob_storage_context.h
@@ -6,41 +6,7 @@
 #define CHROME_BROWSER_CHROME_BLOB_STORAGE_CONTEXT_H_
 #pragma once
 
-#include "base/ref_counted.h"
-#include "base/scoped_ptr.h"
-#include "chrome/browser/browser_thread.h"
-
-class GURL;
-
-namespace webkit_blob {
-class BlobStorageController;
-}
-
-// A context class that keeps track of BlobStorageController used by the chrome.
-// There is an instance associated with each Profile. There could be multiple
-// URLRequestContexts in the same profile that refers to the same instance.
-//
-// All methods, except the ctor, are expected to be called on
-// the IO thread (unless specifically called out in doc comments).
-class ChromeBlobStorageContext
-    : public base::RefCountedThreadSafe<ChromeBlobStorageContext,
-                                        BrowserThread::DeleteOnIOThread> {
- public:
-  ChromeBlobStorageContext();
-
-  void InitializeOnIOThread();
-
-  webkit_blob::BlobStorageController* controller() const {
-    return controller_.get();
-  }
-
- private:
-  friend class BrowserThread;
-  friend class DeleteTask<ChromeBlobStorageContext>;
-
-  virtual ~ChromeBlobStorageContext();
-
-  scoped_ptr<webkit_blob::BlobStorageController> controller_;
-};
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/chrome_blob_storage_context.h"
 
 #endif  // CHROME_BROWSER_CHROME_BLOB_STORAGE_CONTEXT_H_
diff --git a/chrome/browser/cross_site_request_manager.h b/chrome/browser/cross_site_request_manager.h
index 6615ad1..eee1033 100644
--- a/chrome/browser/cross_site_request_manager.h
+++ b/chrome/browser/cross_site_request_manager.h
@@ -2,59 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_CROSS_SITE_REQUEST_MANAGER_H__
-#define CHROME_BROWSER_CROSS_SITE_REQUEST_MANAGER_H__
+#ifndef CHROME_BROWSER_CROSS_SITE_REQUEST_MANAGER_H_
+#define CHROME_BROWSER_CROSS_SITE_REQUEST_MANAGER_H_
 #pragma once
 
-#include <set>
-#include <utility>
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/cross_site_request_manager.h"
 
-#include "base/basictypes.h"
-#include "base/synchronization/lock.h"
-
-template <typename T> struct DefaultSingletonTraits;
-
-// CrossSiteRequestManager is used to handle bookkeeping for cross-site
-// requests and responses between the UI and IO threads.  Such requests involve
-// a transition from one RenderViewHost to another within TabContents, and
-// involve coordination with ResourceDispatcherHost.
-//
-// CrossSiteRequestManager is a singleton that may be used on any thread.
-//
-class CrossSiteRequestManager {
- public:
-  // Returns the singleton instance.
-  static CrossSiteRequestManager* GetInstance();
-
-  // Returns whether the RenderViewHost specified by the given IDs currently
-  // has a pending cross-site request.  If so, we will have to delay the
-  // response until the previous RenderViewHost runs its onunload handler.
-  // Called by ResourceDispatcherHost on the IO thread.
-  bool HasPendingCrossSiteRequest(int renderer_id, int render_view_id);
-
-  // Sets whether the RenderViewHost specified by the given IDs currently has a
-  // pending cross-site request.  Called by RenderViewHost on the UI thread.
-  void SetHasPendingCrossSiteRequest(int renderer_id,
-                                     int render_view_id,
-                                     bool has_pending);
-
- private:
-  friend struct DefaultSingletonTraits<CrossSiteRequestManager>;
-  typedef std::set<std::pair<int, int> > RenderViewSet;
-
-  CrossSiteRequestManager();
-  ~CrossSiteRequestManager();
-
-  // You must acquire this lock before reading or writing any members of this
-  // class.  You must not block while holding this lock.
-  base::Lock lock_;
-
-  // Set of (render_process_host_id, render_view_id) pairs of all
-  // RenderViewHosts that have pending cross-site requests.  Used to pass
-  // information about the RenderViewHosts between the UI and IO threads.
-  RenderViewSet pending_cross_site_views_;
-
-  DISALLOW_COPY_AND_ASSIGN(CrossSiteRequestManager);
-};
-
-#endif  // CHROME_BROWSER_CROSS_SITE_REQUEST_MANAGER_H__
+#endif  // CHROME_BROWSER_CROSS_SITE_REQUEST_MANAGER_H_
diff --git a/chrome/browser/disposition_utils.h b/chrome/browser/disposition_utils.h
index eb847f9..74ae1e0 100644
--- a/chrome/browser/disposition_utils.h
+++ b/chrome/browser/disposition_utils.h
@@ -6,19 +6,7 @@
 #define CHROME_BROWSER_DISPOSITION_UTILS_H_
 #pragma once
 
-#include "webkit/glue/window_open_disposition.h"
-
-namespace disposition_utils {
-
-// Translates event flags from a click on a link into the user's desired
-// window disposition.  For example, a middle click would mean to open
-// a background tab.
-WindowOpenDisposition DispositionFromClick(bool middle_button,
-                                           bool alt_key,
-                                           bool ctrl_key,
-                                           bool meta_key,
-                                           bool shift_key);
-
-}
+// TODO(jam): remove this file when all files have been converted.
+#include "content/browser/disposition_utils.h"
 
 #endif  // CHROME_BROWSER_DISPOSITION_UTILS_H_
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index 489384a..8648242 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -315,8 +315,6 @@
         'browser/bookmarks/recently_used_folders_combo_model.h',
         'browser/browser_about_handler.cc',
         'browser/browser_about_handler.h',
-        'browser/browser_child_process_host.cc',
-        'browser/browser_child_process_host.h',
         'browser/browser_main.cc',
         'browser/browser_main_gtk.cc',
         'browser/browser_main_gtk.h',
@@ -325,8 +323,6 @@
         'browser/browser_main_posix.h',
         'browser/browser_main_win.cc',
         'browser/browser_main_win.h',
-        'browser/browser_message_filter.cc',
-        'browser/browser_message_filter.h',
         'browser/browser_process.cc',
         'browser/browser_process.h',
         'browser/browser_process_impl.cc',
@@ -337,8 +333,6 @@
         'browser/browser_shutdown.h',
         'browser/browser_signin.cc',
         'browser/browser_signin.h',
-        'browser/browser_thread.cc',
-        'browser/browser_thread.h',
         'browser/browser_trial.cc',
         'browser/browser_trial.h',
         'browser/browser_url_handler.cc',
@@ -353,8 +347,6 @@
         'browser/browsing_data_local_storage_helper.h',
         'browser/browsing_data_remover.cc',
         'browser/browsing_data_remover.h',
-        'browser/browsing_instance.cc',
-        'browser/browsing_instance.h',
         'browser/bug_report_data.cc',
         'browser/bug_report_data.h',
         'browser/bug_report_util.cc',
@@ -367,22 +359,8 @@
         '<(protoc_out_dir)/chrome/browser/userfeedback/proto/extension.pb.cc',
         '<(protoc_out_dir)/chrome/browser/userfeedback/proto/math.pb.cc',
         '<(protoc_out_dir)/chrome/browser/userfeedback/proto/web.pb.cc',
-        'browser/cancelable_request.cc',
-        'browser/cancelable_request.h',
-        'browser/cert_store.cc',
-        'browser/cert_store.h',
-        'browser/certificate_manager_model.cc',
-        'browser/certificate_manager_model.h',
-        'browser/certificate_viewer.cc',
-        'browser/certificate_viewer.h',
         'browser/character_encoding.cc',
         'browser/character_encoding.h',
-        'browser/child_process_launcher.cc',
-        'browser/child_process_launcher.h',
-        'browser/child_process_security_policy.cc',
-        'browser/child_process_security_policy.h',
-        'browser/chrome_blob_storage_context.cc',
-        'browser/chrome_blob_storage_context.h',
         'browser/chrome_browser_application_mac.h',
         'browser/chrome_browser_application_mac.mm',
         'browser/chrome_plugin_browsing_context.cc',
@@ -828,8 +806,6 @@
         'browser/cookies_tree_model.h',
         'browser/crash_upload_list.cc',
         'browser/crash_upload_list.h',
-        'browser/cross_site_request_manager.cc',
-        'browser/cross_site_request_manager.h',
         'browser/custom_home_pages_table_model.cc',
         'browser/custom_home_pages_table_model.h',
         'browser/default_encoding_combo_model.cc',
@@ -858,8 +834,6 @@
         'browser/diagnostics/recon_diagnostics.h',
         'browser/diagnostics/sqlite_diagnostics.cc',
         'browser/diagnostics/sqlite_diagnostics.h',
-        'browser/disposition_utils.cc',
-        'browser/disposition_utils.h',
         'browser/dom_operation_notification_details.h',
         'browser/dom_ui/most_visited_handler.cc',
         'browser/dom_ui/most_visited_handler.h',
@@ -3653,9 +3627,6 @@
           ],
         }, {  # OS != "linux"
           'sources!': [
-            # TODO(mattm): Cert manager stuff is really !USE_NSS.
-            'browser/certificate_manager_model.cc',
-            'browser/certificate_manager_model.h',
             'browser/file_path_watcher/file_path_watcher_inotify.cc',
             'browser/webui/options/certificate_manager_handler.cc',
             'browser/webui/options/certificate_manager_handler.h',
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index 9f7942d..61bb976 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -1199,12 +1199,10 @@
         'browser/bookmarks/bookmark_utils_unittest.cc',
         'browser/browser_about_handler_unittest.cc',
         'browser/browser_commands_unittest.cc',
-        'browser/browser_thread_unittest.cc',
         'browser/browsing_data_appcache_helper_unittest.cc',
         'browser/browsing_data_database_helper_unittest.cc',
         'browser/browsing_data_indexed_db_helper_unittest.cc',
         'browser/browsing_data_local_storage_helper_unittest.cc',
-        'browser/child_process_security_policy_unittest.cc',
         'browser/chrome_browser_application_mac_unittest.mm',
         'browser/chrome_plugin_unittest.cc',
         'browser/chromeos/customization_document_unittest.cc',
@@ -1851,6 +1849,8 @@
         'test/v8_unit_test.cc',
         'test/v8_unit_test.h',
         'tools/convert_dict/convert_dict_unittest.cc',
+        '../content/browser/browser_thread_unittest.cc',
+        '../content/browser/child_process_security_policy_unittest.cc',
         '../content/browser/renderer_host/audio_renderer_host_unittest.cc',
         '../content/browser/renderer_host/render_widget_host_unittest.cc',
         '../content/browser/renderer_host/resource_dispatcher_host_unittest.cc',
@@ -2135,7 +2135,6 @@
         'browser/browsing_data_helper_browsertest.h',
         'browser/browsing_data_indexed_db_helper_browsertest.cc',
         'browser/browsing_data_local_storage_helper_browsertest.cc',
-        'browser/child_process_security_policy_browsertest.cc',
         'browser/chromeos/cros/cros_in_process_browser_test.cc',
         'browser/chromeos/cros/cros_in_process_browser_test.h',
         'browser/chromeos/cros/cros_mock.cc',
@@ -2325,6 +2324,7 @@
         'test/out_of_proc_test_runner.cc',
         'test/render_view_test.cc',
         'test/render_view_test.h',
+        '../content/browser/child_process_security_policy_browsertest.cc',
       ],
       'conditions': [
         ['chromeos==0', {
@@ -2400,7 +2400,7 @@
             'browser/extensions/extension_rlz_apitest.cc',
             # TODO(jam): http://crbug.com/15101 These tests fail on Linux and
             # Mac.
-            'browser/child_process_security_policy_browsertest.cc',
+            '../content/browser/child_process_security_policy_browsertest.cc',
             'browser/renderer_host/test/web_cache_manager_browsertest.cc',
             'browser/renderer_host/test/render_view_host_manager_browsertest.cc',
           ],
diff --git a/chrome/browser/browser_child_process_host.cc b/content/browser/browser_child_process_host.cc
index fd8af11..23ed85d 100644
--- a/chrome/browser/browser_child_process_host.cc
+++ b/content/browser/browser_child_process_host.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/browser_child_process_host.h"
+#include "content/browser/browser_child_process_host.h"
 
 #include "base/command_line.h"
 #include "base/file_path.h"
@@ -14,7 +14,6 @@
 #include "base/stl_util-inl.h"
 #include "base/string_util.h"
 #include "chrome/app/breakpad_mac.h"
-#include "chrome/browser/browser_thread.h"
 #include "chrome/common/child_process_logging.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_paths_internal.h"
@@ -24,6 +23,7 @@
 #include "chrome/common/process_watcher.h"
 #include "chrome/common/result_codes.h"
 #include "chrome/installer/util/google_update_settings.h"
+#include "content/browser/browser_thread.h"
 
 #if defined(OS_LINUX)
 #include "base/linux_util.h"
diff --git a/content/browser/browser_child_process_host.h b/content/browser/browser_child_process_host.h
new file mode 100644
index 0000000..f57ec5f
--- /dev/null
+++ b/content/browser/browser_child_process_host.h
@@ -0,0 +1,143 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
+#define CONTENT_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
+#pragma once
+
+#include <list>
+
+#include "chrome/common/child_process_host.h"
+#include "chrome/common/child_process_info.h"
+#include "content/browser/child_process_launcher.h"
+#include "content/browser/renderer_host/resource_message_filter.h"
+
+class ResourceDispatcherHost;
+
+// Plugins/workers and other child processes that live on the IO thread should
+// derive from this class.
+//
+// [Browser]RenderProcessHost is the main exception that doesn't derive from
+// this class. That project lives on the UI thread.
+class BrowserChildProcessHost : public ChildProcessHost,
+                                public ChildProcessInfo,
+                                public ChildProcessLauncher::Client {
+ public:
+  virtual ~BrowserChildProcessHost();
+
+  // Prepares command_line for crash reporting as appropriate.  On Linux and
+  // Mac, a command-line flag to enable crash reporting in the child process
+  // will be appended if needed, because the child process may not have access
+  // to the data that determines the status of crash reporting in the
+  // currently-executing process.  This function is a no-op on Windows.
+  static void SetCrashReporterCommandLine(CommandLine* command_line);
+
+  // Terminates all child processes and deletes each ChildProcessHost instance.
+  static void TerminateAll();
+
+  // The Iterator class allows iteration through either all child processes, or
+  // ones of a specific type, depending on which constructor is used.  Note that
+  // this should be done from the IO thread and that the iterator should not be
+  // kept around as it may be invalidated on subsequent event processing in the
+  // event loop.
+  class Iterator {
+   public:
+    Iterator();
+    explicit Iterator(ChildProcessInfo::ProcessType type);
+    BrowserChildProcessHost* operator->() { return *iterator_; }
+    BrowserChildProcessHost* operator*() { return *iterator_; }
+    BrowserChildProcessHost* operator++();
+    bool Done();
+
+   private:
+    bool all_;
+    ChildProcessInfo::ProcessType type_;
+    std::list<BrowserChildProcessHost*>::iterator iterator_;
+  };
+
+ protected:
+  // |resource_dispatcher_host| may be NULL to indicate none is needed for
+  // this process type.
+  // |url_request_context_getter| allows derived classes to override the
+  // net::URLRequestContext.
+  BrowserChildProcessHost(
+      ChildProcessInfo::ProcessType type,
+      ResourceDispatcherHost* resource_dispatcher_host,
+      ResourceMessageFilter::URLRequestContextOverride*
+          url_request_context_override);
+
+  // A convenient constructor for those classes that want to use the default
+  // net::URLRequestContext.
+  BrowserChildProcessHost(
+      ChildProcessInfo::ProcessType type,
+      ResourceDispatcherHost* resource_dispatcher_host);
+
+  // Derived classes call this to launch the child process asynchronously.
+  void Launch(
+#if defined(OS_WIN)
+      const FilePath& exposed_dir,
+#elif defined(OS_POSIX)
+      bool use_zygote,
+      const base::environment_vector& environ,
+#endif
+      CommandLine* cmd_line);
+
+  // Returns the handle of the child process. This can be called only after
+  // OnProcessLaunched is called or it will be invalid and may crash.
+  base::ProcessHandle GetChildProcessHandle() const;
+
+  // ChildProcessLauncher::Client implementation.
+  virtual void OnProcessLaunched() {}
+
+  // Derived classes can override this to know if the process crashed.
+  // |exit_code| is the status returned when the process crashed (for
+  // posix, as returned from waitpid(), for Windows, as returned from
+  // GetExitCodeProcess()).
+  virtual void OnProcessCrashed(int exit_code) {}
+
+  // Derived classes can override this to know if the process was
+  // killed.  |exit_code| is the status returned when the process
+  // was killed (for posix, as returned from waitpid(), for Windows,
+  // as returned from GetExitCodeProcess()).
+  virtual void OnProcessWasKilled(int exit_code) {}
+
+  // Returns the termination status of a child.  |exit_code| is the
+  // status returned when the process exited (for posix, as returned
+  // from waitpid(), for Windows, as returned from
+  // GetExitCodeProcess()).  |exit_code| may be NULL.
+  virtual base::TerminationStatus GetChildTerminationStatus(int* exit_code);
+
+  // Overrides from ChildProcessHost
+  virtual void OnChildDied();
+  virtual void ShutdownStarted();
+  virtual void Notify(NotificationType type);
+  // Extends the base class implementation and removes this host from
+  // the host list. Calls ChildProcessHost::ForceShutdown
+  virtual void ForceShutdown();
+
+  ResourceDispatcherHost* resource_dispatcher_host() {
+    return resource_dispatcher_host_;
+  }
+
+ private:
+  void Initialize(ResourceMessageFilter::URLRequestContextOverride*
+      url_request_context_override);
+
+  // By using an internal class as the ChildProcessLauncher::Client, we can
+  // intercept OnProcessLaunched and do our own processing before
+  // calling the subclass' implementation.
+  class ClientHook : public ChildProcessLauncher::Client {
+   public:
+    explicit ClientHook(BrowserChildProcessHost* host);
+    virtual void OnProcessLaunched();
+   private:
+    BrowserChildProcessHost* host_;
+  };
+  ClientHook client_;
+  // May be NULL if this current process has no resource dispatcher host.
+  ResourceDispatcherHost* resource_dispatcher_host_;
+  scoped_ptr<ChildProcessLauncher> child_process_;
+};
+
+#endif  // CONTENT_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
diff --git a/chrome/browser/browser_message_filter.cc b/content/browser/browser_message_filter.cc
index e68de00..e116153 100644
--- a/chrome/browser/browser_message_filter.cc
+++ b/content/browser/browser_message_filter.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/browser_message_filter.h"
+#include "content/browser/browser_message_filter.h"
 
 #include "base/logging.h"
 #include "base/process.h"
diff --git a/content/browser/browser_message_filter.h b/content/browser/browser_message_filter.h
new file mode 100644
index 0000000..e557dfd
--- /dev/null
+++ b/content/browser/browser_message_filter.h
@@ -0,0 +1,64 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_BROWSER_MESSAGE_FILTER_H_
+#define CONTENT_BROWSER_BROWSER_MESSAGE_FILTER_H_
+#pragma once
+
+#include "base/process.h"
+#include "content/browser/browser_thread.h"
+#include "ipc/ipc_channel_proxy.h"
+
+// Base class for message filters in the browser process.  You can receive and
+// send messages on any thread.
+class BrowserMessageFilter : public IPC::ChannelProxy::MessageFilter,
+                             public IPC::Message::Sender {
+ public:
+  BrowserMessageFilter();
+  virtual ~BrowserMessageFilter();
+
+  // IPC::ChannelProxy::MessageFilter methods.  If you override them, make sure
+  // to call them as well.  These are always called on the IO thread.
+  virtual void OnFilterAdded(IPC::Channel* channel);
+  virtual void OnChannelClosing();
+  virtual void OnChannelConnected(int32 peer_pid);
+  // DON'T OVERRIDE THIS!  Override the other version below.
+  virtual bool OnMessageReceived(const IPC::Message& message);
+
+  // IPC::Message::Sender implementation.  Can be called on any thread.  Can't
+  // send sync messages (since we don't want to block the browser on any other
+  // process).
+  virtual bool Send(IPC::Message* message);
+
+  // If you want the given message to be dispatched to your OnMessageReceived on
+  // a different thread, change |thread| to the id of the target thread.
+  // If you don't handle this message, or want to keep it on the IO thread, do
+  // nothing.
+  virtual void OverrideThreadForMessage(const IPC::Message& message,
+                                        BrowserThread::ID* thread);
+
+  // Override this to receive messages.
+  // Your function will normally be called on the IO thread.  However, if your
+  // OverrideThreadForMessage modifies the thread used to dispatch the message,
+  // your function will be called on the requested thread.
+  virtual bool OnMessageReceived(const IPC::Message& message,
+                                 bool* message_was_ok) = 0;
+
+  // Can be called on any thread, after OnChannelConnected is called.
+  base::ProcessHandle peer_handle() { return peer_handle_; }
+
+ protected:
+  // Call this if a message couldn't be deserialized.  This kills the renderer.
+  // Can be called on any thread.
+  virtual void BadMessageReceived();
+
+ private:
+  // Dispatches a message to the derived class.
+  bool DispatchMessage(const IPC::Message& message);
+
+  IPC::Channel* channel_;
+  base::ProcessHandle peer_handle_;
+};
+
+#endif  // CONTENT_BROWSER_BROWSER_MESSAGE_FILTER_H_
diff --git a/chrome/browser/browser_thread.cc b/content/browser/browser_thread.cc
index 877c2c5..c0e4355 100644
--- a/chrome/browser/browser_thread.cc
+++ b/content/browser/browser_thread.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/browser_thread.h"
+#include "content/browser/browser_thread.h"
 
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
diff --git a/content/browser/browser_thread.h b/content/browser/browser_thread.h
new file mode 100644
index 0000000..d5e4473
--- /dev/null
+++ b/content/browser/browser_thread.h
@@ -0,0 +1,209 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_BROWSER_THREAD_H_
+#define CONTENT_BROWSER_BROWSER_THREAD_H_
+#pragma once
+
+#include "base/synchronization/lock.h"
+#include "base/task.h"
+#include "base/threading/thread.h"
+
+namespace base {
+class MessageLoopProxy;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// BrowserThread
+//
+// This class represents a thread that is known by a browser-wide name.  For
+// example, there is one IO thread for the entire browser process, and various
+// pieces of code find it useful to retrieve a pointer to the IO thread's
+// Invoke a task by thread ID:
+//
+//   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE, task);
+//
+// The return value is false if the task couldn't be posted because the target
+// thread doesn't exist.  If this could lead to data loss, you need to check the
+// result and restructure the code to ensure it doesn't occur.
+//
+// This class automatically handles the lifetime of different threads.
+// It's always safe to call PostTask on any thread.  If it's not yet created,
+// the task is deleted.  There are no race conditions.  If the thread that the
+// task is posted to is guaranteed to outlive the current thread, then no locks
+// are used.  You should never need to cache pointers to MessageLoops, since
+// they're not thread safe.
+class BrowserThread : public base::Thread {
+ public:
+  // An enumeration of the well-known threads.
+  // NOTE: threads must be listed in the order of their life-time, with each
+  // thread outliving every other thread below it.
+  enum ID {
+    // The main thread in the browser.
+    UI,
+
+    // This is the thread that interacts with the database.
+    DB,
+
+    // This is the "main" thread for WebKit within the browser process when
+    // NOT in --single-process mode.
+    WEBKIT,
+
+    // This is the thread that interacts with the file system.
+    FILE,
+
+    // Used to launch and terminate processes.
+    PROCESS_LAUNCHER,
+
+    // This is the thread to handle slow HTTP cache operations.
+    CACHE,
+
+    // This is the thread that processes IPC and network messages.
+    IO,
+
+#if defined(USE_X11)
+    // This thread has a second connection to the X server and is used to
+    // process UI requests when routing the request to the UI thread would risk
+    // deadlock.
+    BACKGROUND_X11,
+#endif
+
+    // This identifier does not represent a thread.  Instead it counts the
+    // number of well-known threads.  Insert new well-known threads before this
+    // identifier.
+    ID_COUNT
+  };
+
+  // Construct a BrowserThread with the supplied identifier.  It is an error
+  // to construct a BrowserThread that already exists.
+  explicit BrowserThread(ID identifier);
+
+  // Special constructor for the main (UI) thread and unittests. We use a dummy
+  // thread here since the main thread already exists.
+  BrowserThread(ID identifier, MessageLoop* message_loop);
+
+  virtual ~BrowserThread();
+
+  // These are the same methods in message_loop.h, but are guaranteed to either
+  // get posted to the MessageLoop if it's still alive, or be deleted otherwise.
+  // They return true iff the thread existed and the task was posted.  Note that
+  // even if the task is posted, there's no guarantee that it will run, since
+  // the target thread may already have a Quit message in its queue.
+  static bool PostTask(ID identifier,
+                       const tracked_objects::Location& from_here,
+                       Task* task);
+  static bool PostDelayedTask(ID identifier,
+                              const tracked_objects::Location& from_here,
+                              Task* task,
+                              int64 delay_ms);
+  static bool PostNonNestableTask(ID identifier,
+                                  const tracked_objects::Location& from_here,
+                                  Task* task);
+  static bool PostNonNestableDelayedTask(
+      ID identifier,
+      const tracked_objects::Location& from_here,
+      Task* task,
+      int64 delay_ms);
+
+  template <class T>
+  static bool DeleteSoon(ID identifier,
+                         const tracked_objects::Location& from_here,
+                         const T* object) {
+    return PostNonNestableTask(
+        identifier, from_here, new DeleteTask<T>(object));
+  }
+
+  template <class T>
+  static bool ReleaseSoon(ID identifier,
+                          const tracked_objects::Location& from_here,
+                          const T* object) {
+    return PostNonNestableTask(
+        identifier, from_here, new ReleaseTask<T>(object));
+  }
+
+  // Callable on any thread.  Returns whether the given ID corresponds to a well
+  // known thread.
+  static bool IsWellKnownThread(ID identifier);
+
+  // Callable on any thread.  Returns whether you're currently on a particular
+  // thread.
+  static bool CurrentlyOn(ID identifier);
+
+  // Callable on any thread.  Returns whether the threads message loop is valid.
+  // If this returns false it means the thread is in the process of shutting
+  // down.
+  static bool IsMessageLoopValid(ID identifier);
+
+  // If the current message loop is one of the known threads, returns true and
+  // sets identifier to its ID.  Otherwise returns false.
+  static bool GetCurrentThreadIdentifier(ID* identifier);
+
+  // Callers can hold on to a refcounted MessageLoopProxy beyond the lifetime
+  // of the thread.
+  static scoped_refptr<base::MessageLoopProxy> GetMessageLoopProxyForThread(
+      ID identifier);
+
+  // Use these templates in conjuction with RefCountedThreadSafe when you want
+  // to ensure that an object is deleted on a specific thread.  This is needed
+  // when an object can hop between threads (i.e. IO -> FILE -> IO), and thread
+  // switching delays can mean that the final IO tasks executes before the FILE
+  // task's stack unwinds.  This would lead to the object destructing on the
+  // FILE thread, which often is not what you want (i.e. to unregister from
+  // NotificationService, to notify other objects on the creating thread etc).
+  template<ID thread>
+  struct DeleteOnThread {
+    template<typename T>
+    static void Destruct(const T* x) {
+      if (CurrentlyOn(thread)) {
+        delete x;
+      } else {
+        DeleteSoon(thread, FROM_HERE, x);
+      }
+    }
+  };
+
+  // Sample usage:
+  // class Foo
+  //     : public base::RefCountedThreadSafe<
+  //           Foo, BrowserThread::DeleteOnIOThread> {
+  //
+  // ...
+  //  private:
+  //   friend struct BrowserThread::DeleteOnThread<BrowserThread::IO>;
+  //   friend class DeleteTask<Foo>;
+  //
+  //   ~Foo();
+  struct DeleteOnUIThread : public DeleteOnThread<UI> { };
+  struct DeleteOnIOThread : public DeleteOnThread<IO> { };
+  struct DeleteOnFileThread : public DeleteOnThread<FILE> { };
+  struct DeleteOnDBThread : public DeleteOnThread<DB> { };
+  struct DeleteOnWebKitThread : public DeleteOnThread<WEBKIT> { };
+
+ private:
+  // Common initialization code for the constructors.
+  void Initialize();
+
+  static bool PostTaskHelper(
+      ID identifier,
+      const tracked_objects::Location& from_here,
+      Task* task,
+      int64 delay_ms,
+      bool nestable);
+
+  // The identifier of this thread.  Only one thread can exist with a given
+  // identifier at a given time.
+  ID identifier_;
+
+  // This lock protects |browser_threads_|.  Do not read or modify that array
+  // without holding this lock.  Do not block while holding this lock.
+  static base::Lock lock_;
+
+  // An array of the BrowserThread objects.  This array is protected by |lock_|.
+  // The threads are not owned by this array.  Typically, the threads are owned
+  // on the UI thread by the g_browser_process object.  BrowserThreads remove
+  // themselves from this array upon destruction.
+  static BrowserThread* browser_threads_[ID_COUNT];
+};
+
+#endif  // CONTENT_BROWSER_BROWSER_THREAD_H_
diff --git a/chrome/browser/browser_thread_unittest.cc b/content/browser/browser_thread_unittest.cc
index 948709a..af2a869 100644
--- a/chrome/browser/browser_thread_unittest.cc
+++ b/content/browser/browser_thread_unittest.cc
@@ -5,7 +5,7 @@
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
 #include "base/scoped_ptr.h"
-#include "chrome/browser/browser_thread.h"
+#include "content/browser/browser_thread.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
diff --git a/chrome/browser/browsing_instance.cc b/content/browser/browsing_instance.cc
index e7b3a41..b2c514c 100644
--- a/chrome/browser/browsing_instance.cc
+++ b/content/browser/browsing_instance.cc
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/browsing_instance.h"
+#include "content/browser/browsing_instance.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/renderer_host/site_instance.h"
 #include "chrome/browser/webui/web_ui_factory.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/url_constants.h"
+#include "content/browser/site_instance.h"
 
 // static
 BrowsingInstance::ProfileSiteInstanceMap
diff --git a/content/browser/browsing_instance.h b/content/browser/browsing_instance.h
new file mode 100644
index 0000000..0c4bb2e
--- /dev/null
+++ b/content/browser/browsing_instance.h
@@ -0,0 +1,135 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_BROWSING_INSTANCE_H_
+#define CONTENT_BROWSER_BROWSING_INSTANCE_H_
+#pragma once
+
+#include "base/hash_tables.h"
+#include "base/ref_counted.h"
+#include "chrome/browser/profiles/profile.h"
+
+class GURL;
+class SiteInstance;
+
+///////////////////////////////////////////////////////////////////////////////
+//
+// BrowsingInstance class
+//
+// A browsing instance corresponds to the notion of a "unit of related browsing
+// contexts" in the HTML 5 spec.  Intuitively, it represents a collection of
+// tabs and frames that can have script connections to each other.  In that
+// sense, it reflects the user interface, and not the contents of the tabs and
+// frames.
+//
+// We further subdivide a BrowsingInstance into SiteInstances, which represent
+// the documents within each BrowsingInstance that are from the same site and
+// thus can have script access to each other.  Different SiteInstances can
+// safely run in different processes, because their documents cannot access
+// each other's contents (due to the same origin policy).
+//
+// It is important to only have one SiteInstance per site within a given
+// BrowsingInstance.  This is because any two documents from the same site
+// might be able to script each other if they are in the same BrowsingInstance.
+// Thus, they must be rendered in the same process.
+//
+// If the process-per-site model is in use, then we ensure that there is only
+// one SiteInstance per site for the entire profile, not just for each
+// BrowsingInstance.  This reduces the number of renderer processes we create.
+// (This is currently only true if --process-per-site is specified at the
+// command line.)
+//
+// A BrowsingInstance is live as long as any SiteInstance has a reference to
+// it.  A SiteInstance is live as long as any NavigationEntry or RenderViewHost
+// have references to it.  Because both classes are RefCounted, they do not
+// need to be manually deleted.
+//
+// Currently, the BrowsingInstance class is not visible outside of the
+// SiteInstance class.  To get a new SiteInstance that is part of the same
+// BrowsingInstance, use SiteInstance::GetRelatedSiteInstance.  Because of
+// this, BrowsingInstances and SiteInstances are tested together in
+// site_instance_unittest.cc.
+//
+///////////////////////////////////////////////////////////////////////////////
+class BrowsingInstance : public base::RefCounted<BrowsingInstance> {
+ public:
+  // Create a new BrowsingInstance.
+  explicit BrowsingInstance(Profile* profile);
+
+  // Returns whether the process-per-site model is in use (globally or just for
+  // the given url), in which case we should ensure there is only one
+  // SiteInstance per site for the entire profile, not just for this
+  // BrowsingInstance.
+  virtual bool ShouldUseProcessPerSite(const GURL& url);
+
+  // Get the profile to which this BrowsingInstance belongs.
+  Profile* profile() { return profile_; }
+
+  // Returns whether this BrowsingInstance has registered a SiteInstance for
+  // the site of the given URL.
+  bool HasSiteInstance(const GURL& url);
+
+  // Get the SiteInstance responsible for rendering the given URL.  Should
+  // create a new one if necessary, but should not create more than one
+  // SiteInstance per site.
+  SiteInstance* GetSiteInstanceForURL(const GURL& url);
+
+  // Adds the given SiteInstance to our map, to ensure that we do not create
+  // another SiteInstance for the same site.
+  void RegisterSiteInstance(SiteInstance* site_instance);
+
+  // Removes the given SiteInstance from our map, after all references to it
+  // have been deleted.  This means it is safe to create a new SiteInstance
+  // if the user later visits a page from this site, within this
+  // BrowsingInstance.
+  void UnregisterSiteInstance(SiteInstance* site_instance);
+
+ protected:
+  friend class base::RefCounted<BrowsingInstance>;
+
+  // Virtual to allow tests to extend it.
+  virtual ~BrowsingInstance();
+
+ private:
+  // Map of site to SiteInstance, to ensure we only have one SiteInstance per
+  // site.  The site string should be the possibly_invalid_spec() of a GURL
+  // obtained with SiteInstance::GetSiteForURL.
+  typedef base::hash_map<std::string, SiteInstance*> SiteInstanceMap;
+
+  // Map of Profile runtime Id to SiteInstanceMap, for use in the
+  // process-per-site model.
+  typedef base::hash_map<ProfileId, SiteInstanceMap> ProfileSiteInstanceMap;
+
+  // Returns a pointer to the relevant SiteInstanceMap for this object.  If the
+  // process-per-site model is in use, or if process-per-site-instance is in
+  // use and |url| matches a site for which we always use one process (e.g.,
+  // the new tab page), then this returns the SiteInstanceMap for the entire
+  // profile.  If not, this returns the BrowsingInstance's own private
+  // SiteInstanceMap.
+  SiteInstanceMap* GetSiteInstanceMap(Profile* profile, const GURL& url);
+
+  // Utility routine which removes the passed SiteInstance from the passed
+  // SiteInstanceMap.
+  bool RemoveSiteInstanceFromMap(SiteInstanceMap* map, const std::string& site,
+                                 SiteInstance* site_instance);
+
+  // Common profile to which all SiteInstances in this BrowsingInstance
+  // must belong.
+  Profile* const profile_;
+
+  // Map of site to SiteInstance, to ensure we only have one SiteInstance per
+  // site.  The site string should be the possibly_invalid_spec() of a GURL
+  // obtained with SiteInstance::GetSiteForURL.  Note that this map may not
+  // contain every active SiteInstance, because a race exists where two
+  // SiteInstances can be assigned to the same site.  This is ok in rare cases.
+  // This field is only used if we are not using process-per-site.
+  SiteInstanceMap site_instance_map_;
+
+  // Global map of Profile to SiteInstanceMap, for process-per-site.
+  static ProfileSiteInstanceMap profile_site_instance_map_;
+
+  DISALLOW_COPY_AND_ASSIGN(BrowsingInstance);
+};
+
+#endif  // CONTENT_BROWSER_BROWSING_INSTANCE_H_
diff --git a/chrome/browser/cancelable_request.cc b/content/browser/cancelable_request.cc
index 3fdb482..f1826fd 100644
--- a/chrome/browser/cancelable_request.cc
+++ b/content/browser/cancelable_request.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/cancelable_request.h"
+#include "content/browser/cancelable_request.h"
 
 CancelableRequestProvider::CancelableRequestProvider() : next_handle_(1) {
 }
diff --git a/content/browser/cancelable_request.h b/content/browser/cancelable_request.h
new file mode 100644
index 0000000..9dc86d3
--- /dev/null
+++ b/content/browser/cancelable_request.h
@@ -0,0 +1,704 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// CancelableRequestProviders and Consumers work together to make requests that
+// execute on a background thread in the provider and return data to the
+// consumer. These class collaborate to keep a list of open requests and to
+// make sure that requests to not outlive either of the objects involved in the
+// transaction.
+//
+// If you do not need to return data to the consumer, do not use this system,
+// just use the regular Task/RunnableMethod stuff.
+//
+// The CancelableRequest object is used internally to each provider to track
+// request data and callback information.
+//
+// Example consumer calling |StartRequest| on a frontend service:
+//
+//   class MyClass {
+//     void MakeRequest() {
+//       frontend_service->StartRequest(some_input1, some_input2,
+//           &callback_consumer_,
+//           NewCallback(this, &MyClass:RequestComplete));
+//       // StartRequest() returns a Handle which may be retained for use with
+//       // CancelRequest() if required, e.g. in MyClass's destructor.
+//     }
+//
+//     void RequestComplete(int status) {
+//       ...
+//     }
+//
+//    private:
+//     CancelableRequestConsumer callback_consumer_;
+//   };
+//
+//
+// Example frontend provider. It receives requests and forwards them to the
+// backend on another thread:
+//
+//   class Frontend : public CancelableRequestProvider {
+//     typedef Callback1<int>::Type RequestCallbackType;
+//
+//     Handle StartRequest(int some_input1, int some_input2,
+//                         CancelableRequestConsumerBase* consumer,
+//                         RequestCallbackType* callback) {
+//       scoped_refptr<CancelableRequest<RequestCallbackType> > request(
+//           new CancelableRequest<RequestCallbackType>(callback));
+//       AddRequest(request, consumer);
+//
+//       // Send the parameters and the request to the backend thread.
+//       backend_thread_->PostTask(FROM_HERE,
+//           NewRunnableMethod(backend_, &Backend::DoRequest, request,
+//                             some_input1, some_input2));
+//
+//       // The handle will have been set by AddRequest.
+//       return request->handle();
+//     }
+//   };
+//
+//
+// Example backend provider that does work and dispatches the callback back
+// to the original thread. Note that we need to pass it as a scoped_refptr so
+// that the object will be kept alive if the request is canceled (releasing
+// the provider's reference to it).
+//
+//   class Backend {
+//     void DoRequest(
+//         scoped_refptr< CancelableRequest<Frontend::RequestCallbackType> >
+//             request,
+//         int some_input1, int some_input2) {
+//       if (request->canceled())
+//         return;
+//
+//       ... do your processing ...
+//
+//       // Depending on your typedefs, one of these two forms will be more
+//       // convenient:
+//       request->ForwardResult(Tuple1<int>(return_value));
+//
+//       // -- or --  (inferior in this case)
+//       request->ForwardResult(Frontend::RequestCallbackType::TupleType(
+//           return_value));
+//     }
+//   };
+
+#ifndef CONTENT_BROWSER_CANCELABLE_REQUEST_H_
+#define CONTENT_BROWSER_CANCELABLE_REQUEST_H_
+#pragma once
+
+#include <map>
+#include <vector>
+
+#include "base/basictypes.h"
+#include "base/callback.h"
+#include "base/logging.h"
+#include "base/message_loop.h"
+#include "base/ref_counted.h"
+#include "base/scoped_ptr.h"
+#include "base/synchronization/cancellation_flag.h"
+#include "base/synchronization/lock.h"
+#include "base/task.h"
+#include "build/build_config.h"
+
+class CancelableRequestBase;
+class CancelableRequestConsumerBase;
+
+// CancelableRequestProvider --------------------------------------------------
+//
+// This class is threadsafe. Requests may be added or canceled from any thread,
+// but a task must only be canceled from the same thread it was initially run
+// on.
+//
+// It is intended that providers inherit from this class to provide the
+// necessary functionality.
+
+class CancelableRequestProvider {
+ public:
+  // Identifies a specific request from this provider.
+  typedef int Handle;
+
+  CancelableRequestProvider();
+  virtual ~CancelableRequestProvider();
+
+  // Called by the enduser of the request to cancel it. This MUST be called on
+  // the same thread that originally issued the request (which is also the same
+  // thread that would have received the callback if it was not canceled).
+  // handle must be for a valid pending (not yet complete or cancelled) request.
+  void CancelRequest(Handle handle);
+
+ protected:
+  // Adds a new request and initializes it. This is called by a derived class
+  // to add a new request. The request's Init() will be called (which is why
+  // the consumer is required. The handle to the new request is returned.
+  Handle AddRequest(CancelableRequestBase* request,
+                    CancelableRequestConsumerBase* consumer);
+
+  // Called by the CancelableRequest when the request has executed. It will
+  // be removed from the list of pending requests (as opposed to canceling,
+  // which will also set some state on the request).
+  void RequestCompleted(Handle handle);
+
+ private:
+  typedef std::map<Handle, scoped_refptr<CancelableRequestBase> >
+      CancelableRequestMap;
+
+  // Only call this when you already have acquired pending_request_lock_.
+  void CancelRequestLocked(const CancelableRequestMap::iterator& item);
+
+  friend class CancelableRequestBase;
+
+  base::Lock pending_request_lock_;
+
+  // Lists all outstanding requests. Protected by the |lock_|.
+  CancelableRequestMap pending_requests_;
+
+  // The next handle value we will return. Protected by the |lock_|.
+  int next_handle_;
+
+  DISALLOW_COPY_AND_ASSIGN(CancelableRequestProvider);
+};
+
+// CancelableRequestConsumer --------------------------------------------------
+//
+// Classes wishing to make requests on a provider should have an instance of
+// this class. Callers will need to pass a pointer to this consumer object
+// when they make the request. It will automatically track any pending
+// requests, and will automatically cancel them on destruction to prevent the
+// accidental calling of freed memory.
+//
+// It is recommended to just have this class as a member variable since there
+// is nothing to be gained by inheriting from it other than polluting your
+// namespace.
+//
+// THIS CLASS IS NOT THREADSAFE (unlike the provider). You must make requests
+// and get callbacks all from the same thread.
+
+// Base class used to notify of new requests.
+class CancelableRequestConsumerBase {
+ protected:
+  friend class CancelableRequestBase;
+  friend class CancelableRequestProvider;
+
+  virtual ~CancelableRequestConsumerBase() {
+  }
+
+  // Adds a new request to the list of requests that are being tracked. This
+  // is called by the provider when a new request is created.
+  virtual void OnRequestAdded(CancelableRequestProvider* provider,
+                              CancelableRequestProvider::Handle handle) = 0;
+
+  // Removes the given request from the list of pending requests. Called
+  // by the CancelableRequest immediately after the callback has executed for a
+  // given request, and by the provider when a request is canceled.
+  virtual void OnRequestRemoved(CancelableRequestProvider* provider,
+                                CancelableRequestProvider::Handle handle) = 0;
+
+  // Sent to provider before executing a callback.
+  virtual void WillExecute(CancelableRequestProvider* provider,
+                           CancelableRequestProvider::Handle handle) = 0;
+
+  // Sent after executing a callback.
+  virtual void DidExecute(CancelableRequestProvider* provider,
+                          CancelableRequestProvider::Handle handle) = 0;
+};
+
+// Template for clients to use. It allows them to associate random "client
+// data" with a specific request. The default value for this type is 0.
+// The type T should be small and easily copyable (like a pointer
+// or an integer).
+template<class T>
+class CancelableRequestConsumerTSimple : public CancelableRequestConsumerBase {
+ public:
+  CancelableRequestConsumerTSimple();
+
+  // Cancel any outstanding requests so that we do not get called back after we
+  // are destroyed. As these requests are removed, the providers will call us
+  // back on OnRequestRemoved, which will then update the list. To iterate
+  // successfully while the list is changing out from under us, we make a copy.
+  virtual ~CancelableRequestConsumerTSimple();
+
+  // Associates some random data with a specified request. The request MUST be
+  // outstanding, or it will assert. This is intended to be called immediately
+  // after a request is issued.
+  void SetClientData(CancelableRequestProvider* p,
+                     CancelableRequestProvider::Handle h,
+                     T client_data);
+
+  // Retrieves previously associated data for a specified request. The request
+  // MUST be outstanding, or it will assert. This is intended to be called
+  // during processing of a callback to retrieve extra data.
+  T GetClientData(CancelableRequestProvider* p,
+                  CancelableRequestProvider::Handle h);
+
+  // Returns the data associated with the current request being processed. This
+  // is only valid during the time a callback is being processed.
+  T GetClientDataForCurrentRequest();
+
+  // Returns true if there are any pending requests.
+  bool HasPendingRequests() const;
+
+  // Returns the number of pending requests.
+  size_t PendingRequestCount() const;
+
+  // Cancels all requests outstanding.
+  void CancelAllRequests();
+
+  // Returns the handle for the first request that has the specified client data
+  // (in |handle|). Returns true if there is a request for the specified client
+  // data, false otherwise.
+  bool GetFirstHandleForClientData(T client_data,
+                                   CancelableRequestProvider::Handle* handle);
+
+  // Gets the client data for all pending requests.
+  void GetAllClientData(std::vector<T>* data);
+
+ protected:
+  struct PendingRequest {
+    PendingRequest(CancelableRequestProvider* p,
+                   CancelableRequestProvider::Handle h)
+        : provider(p), handle(h) {
+    }
+
+    PendingRequest() : provider(NULL), handle(0) {}
+
+    // Comparison operator for stl.
+    bool operator<(const PendingRequest& other) const {
+      if (provider != other.provider)
+        return provider < other.provider;
+      return handle < other.handle;
+    }
+
+    bool is_valid() const { return provider != NULL; }
+
+    CancelableRequestProvider* provider;
+    CancelableRequestProvider::Handle handle;
+  };
+  typedef std::map<PendingRequest, T> PendingRequestList;
+
+  virtual T get_initial_t() const;
+
+  virtual void OnRequestAdded(CancelableRequestProvider* provider,
+                              CancelableRequestProvider::Handle handle);
+
+  virtual void OnRequestRemoved(CancelableRequestProvider* provider,
+                                CancelableRequestProvider::Handle handle);
+
+  virtual void WillExecute(CancelableRequestProvider* provider,
+                           CancelableRequestProvider::Handle handle);
+
+  virtual void DidExecute(CancelableRequestProvider* provider,
+                          CancelableRequestProvider::Handle handle);
+
+  // Lists all outstanding requests.
+  PendingRequestList pending_requests_;
+
+  // This is valid while processing a request and is used to identify the
+  // provider/handle of request.
+  PendingRequest current_request_;
+};
+
+template<class T>
+CancelableRequestConsumerTSimple<T>::CancelableRequestConsumerTSimple() {
+}
+
+template<class T>
+CancelableRequestConsumerTSimple<T>::~CancelableRequestConsumerTSimple() {
+  CancelAllRequests();
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::SetClientData(
+    CancelableRequestProvider* p,
+    CancelableRequestProvider::Handle h,
+    T client_data) {
+  PendingRequest request(p, h);
+  DCHECK(pending_requests_.find(request) != pending_requests_.end());
+  pending_requests_[request] = client_data;
+}
+
+template<class T>
+T CancelableRequestConsumerTSimple<T>::GetClientData(
+    CancelableRequestProvider* p,
+    CancelableRequestProvider::Handle h) {
+  PendingRequest request(p, h);
+  DCHECK(pending_requests_.find(request) != pending_requests_.end());
+  return pending_requests_[request];
+}
+
+template<class T>
+T CancelableRequestConsumerTSimple<T>::GetClientDataForCurrentRequest() {
+  DCHECK(current_request_.is_valid());
+  return GetClientData(current_request_.provider, current_request_.handle);
+}
+
+template<class T>
+bool CancelableRequestConsumerTSimple<T>::HasPendingRequests() const {
+  return !pending_requests_.empty();
+}
+
+template<class T>
+size_t CancelableRequestConsumerTSimple<T>::PendingRequestCount() const {
+  return pending_requests_.size();
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::CancelAllRequests() {
+  PendingRequestList copied_requests(pending_requests_);
+  for (typename PendingRequestList::iterator i = copied_requests.begin();
+       i != copied_requests.end(); ++i)
+    i->first.provider->CancelRequest(i->first.handle);
+  copied_requests.clear();
+
+  // That should have cleared all the pending items.
+  DCHECK(pending_requests_.empty());
+}
+
+template<class T>
+bool CancelableRequestConsumerTSimple<T>::GetFirstHandleForClientData(
+    T client_data,
+    CancelableRequestProvider::Handle* handle) {
+  for (typename PendingRequestList::const_iterator i =
+           pending_requests_.begin(); i != pending_requests_.end(); ++i) {
+    if (i->second == client_data) {
+      *handle = i->first.handle;
+      return true;
+    }
+  }
+  *handle = 0;
+  return false;
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::GetAllClientData(
+    std::vector<T>* data) {
+  DCHECK(data);
+  for (typename PendingRequestList::iterator i = pending_requests_.begin();
+       i != pending_requests_.end(); ++i)
+    data->push_back(i->second);
+}
+
+template<class T>
+T CancelableRequestConsumerTSimple<T>::get_initial_t() const {
+  return 0;
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::OnRequestAdded(
+    CancelableRequestProvider* provider,
+    CancelableRequestProvider::Handle handle) {
+  DCHECK(pending_requests_.find(PendingRequest(provider, handle)) ==
+         pending_requests_.end());
+  pending_requests_[PendingRequest(provider, handle)] = get_initial_t();
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::OnRequestRemoved(
+    CancelableRequestProvider* provider,
+    CancelableRequestProvider::Handle handle) {
+  typename PendingRequestList::iterator i =
+      pending_requests_.find(PendingRequest(provider, handle));
+  if (i == pending_requests_.end()) {
+    NOTREACHED() << "Got a complete notification for a nonexistent request";
+    return;
+  }
+
+  pending_requests_.erase(i);
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::WillExecute(
+    CancelableRequestProvider* provider,
+    CancelableRequestProvider::Handle handle) {
+  current_request_ = PendingRequest(provider, handle);
+}
+
+template<class T>
+void CancelableRequestConsumerTSimple<T>::DidExecute(
+    CancelableRequestProvider* provider,
+    CancelableRequestProvider::Handle handle) {
+  current_request_ = PendingRequest();
+}
+
+// See CancelableRequestConsumerTSimple. The default value for T
+// is given in |initial_t|.
+template<class T, T initial_t>
+class CancelableRequestConsumerT : public CancelableRequestConsumerTSimple<T> {
+ public:
+  CancelableRequestConsumerT();
+  virtual ~CancelableRequestConsumerT();
+
+ protected:
+  virtual T get_initial_t() const;
+};
+
+template<class T, T initial_t>
+CancelableRequestConsumerT<T, initial_t>::CancelableRequestConsumerT() {
+}
+
+template<class T, T initial_t>
+CancelableRequestConsumerT<T, initial_t>::~CancelableRequestConsumerT() {
+}
+
+template<class T, T initial_t>
+T CancelableRequestConsumerT<T, initial_t>::get_initial_t() const {
+  return initial_t;
+}
+
+// Some clients may not want to store data. Rather than do some complicated
+// thing with virtual functions to allow some consumers to store extra data and
+// some not to, we just define a default one that stores some dummy data.
+typedef CancelableRequestConsumerT<int, 0> CancelableRequestConsumer;
+
+// MSVC doesn't like complex extern templates and DLLs.
+#if !defined(COMPILER_MSVC)
+// The vast majority of CancelableRequestConsumers are instantiated on <int>,
+// so prevent that template from being expanded in normal code.
+extern template class CancelableRequestConsumerTSimple<int>;
+
+// We'll also want to extern-template the most common, typedef-ed
+// CancelableRequestConsumerT.
+extern template class CancelableRequestConsumerT<int, 0>;
+#endif
+
+// CancelableRequest ----------------------------------------------------------
+//
+// The request object that is used by a CancelableRequestProvider to send
+// results to a CancelableRequestConsumer. This request handles the returning
+// of results from a thread where the request is being executed to the thread
+// and callback where the results are used. IT SHOULD BE PASSED AS A
+// scoped_refptr TO KEEP IT ALIVE.
+//
+// It does not handle input parameters to the request. The caller must either
+// transfer those separately or derive from this class to add the desired
+// parameters.
+//
+// When the processing is complete on this message, the caller MUST call
+// ForwardResult() with the return arguments that will be passed to the
+// callback. If the request has been canceled, Return is optional (it will not
+// do anything). If you do not have to return to the caller, the cancelable
+// request system should not be used! (just use regular fire-and-forget tasks).
+//
+// Callback parameters are passed by value. In some cases, the request will
+// want to return a large amount of data (for example, an image). One good
+// approach is to derive from the CancelableRequest and make the data object
+// (for example, a std::vector) owned by the CancelableRequest. The pointer
+// to this data would be passed for the callback parameter. Since the
+// CancelableRequest outlives the callback call, the data will be valid on the
+// other thread for the callback, but will still be destroyed properly.
+
+// Non-templatized base class that provides cancellation
+class CancelableRequestBase
+    : public base::RefCountedThreadSafe<CancelableRequestBase> {
+ public:
+  friend class CancelableRequestProvider;
+
+  // Initializes most things to empty, Init() must be called to complete
+  // initialization of the object. This will be done by the provider when
+  // the request is dispatched.
+  //
+  // This must be called on the same thread the callback will be executed on,
+  // it will save that thread for later.
+  //
+  // This two-phase init is done so that the constructor can have no
+  // parameters, which makes it much more convenient for derived classes,
+  // which can be common. The derived classes need only declare the variables
+  // they provide in the constructor rather than many lines of internal
+  // tracking data that are passed to the base class (us).
+  //
+  // In addition, not all of the information (for example, the handle) is known
+  // at construction time.
+  CancelableRequestBase();
+
+  CancelableRequestConsumerBase* consumer() const {
+    return consumer_;
+  }
+
+  CancelableRequestProvider::Handle handle() const {
+    return handle_;
+  }
+
+  // The canceled flag indicates that the request should not be executed.
+  // A request can never be uncanceled, so only a setter for true is provided.
+  // This can be called multiple times, but only from one thread.
+  void set_canceled() {
+    canceled_.Set();
+  }
+  bool canceled() {
+    return canceled_.IsSet();
+  }
+
+ protected:
+  friend class base::RefCountedThreadSafe<CancelableRequestBase>;
+  virtual ~CancelableRequestBase();
+
+  // Initializes the object with the particulars from the provider. It may only
+  // be called once (it is called by the provider, which is a friend).
+  void Init(CancelableRequestProvider* provider,
+            CancelableRequestProvider::Handle handle,
+            CancelableRequestConsumerBase* consumer);
+
+  // Tells the provider that the request is complete, which then tells the
+  // consumer.
+  void NotifyCompleted() const {
+    provider_->RequestCompleted(handle());
+    consumer_->DidExecute(provider_, handle_);
+  }
+
+  // Cover method for CancelableRequestConsumerBase::WillExecute.
+  void WillExecute() {
+    consumer_->WillExecute(provider_, handle_);
+  }
+
+  // The message loop that this request was created on. The callback will
+  // happen on the same thread.
+  MessageLoop* callback_thread_;
+
+  // The provider for this request. When we execute, we will notify this that
+  // request is complete to it can remove us from the requests it tracks.
+  CancelableRequestProvider* provider_;
+
+  // Notified after we execute that the request is complete.  This should only
+  // be accessed if !canceled_.IsSet(), otherwise the pointer is invalid.
+  CancelableRequestConsumerBase* consumer_;
+
+  // The handle to this request inside the provider. This will be initialized
+  // to 0 when the request is created, and the provider will set it once the
+  // request has been dispatched.
+  CancelableRequestProvider::Handle handle_;
+
+  // Set if the caller cancels this request. No callbacks should be made when
+  // this is set.
+  base::CancellationFlag canceled_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(CancelableRequestBase);
+};
+
+// Templatized class. This is the one you should use directly or inherit from.
+// The callback can be invoked by calling the ForwardResult() method. For this,
+// you must either pack the parameters into a tuple, or use DispatchToMethod
+// (in tuple.h).
+//
+// If you inherit to add additional input parameters or to do more complex
+// memory management (see the bigger comment about this above), you can put
+// those on a subclass of this.
+//
+// We have decided to allow users to treat derived classes of this as structs,
+// so you can add members without getters and setters (which just makes the
+// code harder to read). Don't use underscores after these vars. For example:
+//
+//   typedef Callback1<int>::Type DoodieCallback;
+//
+//   class DoodieRequest : public CancelableRequest<DoodieCallback> {
+//    public:
+//     DoodieRequest(CallbackType* callback) : CancelableRequest(callback) {
+//     }
+//
+//    private:
+//     ~DoodieRequest() {}
+//
+//     int input_arg1;
+//     std::wstring input_arg2;
+//   };
+template<typename CB>
+class CancelableRequest : public CancelableRequestBase {
+ public:
+  typedef CB CallbackType;          // CallbackRunner<...>
+  typedef typename CB::TupleType TupleType;  // Tuple of the callback args.
+
+  // The provider MUST call Init() (on the base class) before this is valid.
+  // This class will take ownership of the callback object and destroy it when
+  // appropriate.
+  explicit CancelableRequest(CallbackType* callback)
+      : CancelableRequestBase(),
+        callback_(callback) {
+    DCHECK(callback) << "We should always have a callback";
+  }
+
+  // Dispatches the parameters to the correct thread so the callback can be
+  // executed there. The caller does not need to check for cancel before
+  // calling this. It is optional in the cancelled case. In the non-cancelled
+  // case, this MUST be called.
+  //
+  // If there are any pointers in the parameters, they must live at least as
+  // long as the request so that it can be forwarded to the other thread.
+  // For complex objects, this would typically be done by having a derived
+  // request own the data itself.
+  void ForwardResult(const TupleType& param) {
+    DCHECK(callback_.get());
+    if (!canceled()) {
+      if (callback_thread_ == MessageLoop::current()) {
+        // We can do synchronous callbacks when we're on the same thread.
+        ExecuteCallback(param);
+      } else {
+        callback_thread_->PostTask(FROM_HERE, NewRunnableMethod(this,
+            &CancelableRequest<CB>::ExecuteCallback, param));
+      }
+    }
+  }
+
+  // Like |ForwardResult| but this never does a synchronous callback.
+  void ForwardResultAsync(const TupleType& param) {
+    DCHECK(callback_.get());
+    if (!canceled()) {
+      callback_thread_->PostTask(FROM_HERE, NewRunnableMethod(this,
+          &CancelableRequest<CB>::ExecuteCallback, param));
+    }
+  }
+
+ protected:
+  virtual ~CancelableRequest() {}
+
+ private:
+  // Executes the callback and notifies the provider and the consumer that this
+  // request has been completed. This must be called on the callback_thread_.
+  void ExecuteCallback(const TupleType& param) {
+    if (!canceled_.IsSet()) {
+      WillExecute();
+
+      // Execute the callback.
+      callback_->RunWithParams(param);
+
+      // Notify the provider that the request is complete. The provider will
+      // notify the consumer for us.
+      NotifyCompleted();
+    }
+  }
+
+  // This should only be executed if !canceled_.IsSet(),
+  // otherwise the pointers may be invalid.
+  scoped_ptr<CallbackType> callback_;
+};
+
+// A CancelableRequest with a single value. This is intended for use when
+// the provider provides a single value. The provider fills the result into
+// the value, and notifies the request with a pointer to the value. For example,
+// HistoryService has many methods that callback with a vector. Use the
+// following pattern for this:
+// 1. Define the callback:
+//      typedef Callback2<Handle, std::vector<Foo>*>::Type FooCallback;
+// 2. Define the CancelableRequest1 type.
+//    typedef CancelableRequest1<FooCallback, std::vector<Foo>> FooRequest;
+// 3. The provider method should then fillin the contents of the vector,
+//    forwarding the result like so:
+//    request->ForwardResult(FooRequest::TupleType(request->handle(),
+//                                                 &request->value));
+//
+// Tip: for passing more than one value, use a Tuple for the value.
+template<typename CB, typename Type>
+class CancelableRequest1 : public CancelableRequest<CB> {
+ public:
+  explicit CancelableRequest1(
+      typename CancelableRequest<CB>::CallbackType* callback)
+      : CancelableRequest<CB>(callback) {
+  }
+
+  // The value.
+  Type value;
+
+ protected:
+  virtual ~CancelableRequest1() {}
+};
+
+#endif  // CONTENT_BROWSER_CANCELABLE_REQUEST_H_
diff --git a/chrome/browser/cert_store.cc b/content/browser/cert_store.cc
index 6def04e..e43e570 100644
--- a/chrome/browser/cert_store.cc
+++ b/content/browser/cert_store.cc
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/cert_store.h"
+#include "content/browser/cert_store.h"
 
 #include <algorithm>
 #include <functional>
 
 #include "base/stl_util-inl.h"
-#include "chrome/browser/renderer_host/render_process_host.h"
-#include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/common/notification_service.h"
+#include "content/browser/renderer_host/render_process_host.h"
+#include "content/browser/renderer_host/render_view_host.h"
 
 template <typename T>
 struct MatchSecond {
diff --git a/content/browser/cert_store.h b/content/browser/cert_store.h
new file mode 100644
index 0000000..8022c9d
--- /dev/null
+++ b/content/browser/cert_store.h
@@ -0,0 +1,84 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CERT_STORE_H_
+#define CONTENT_BROWSER_CERT_STORE_H_
+#pragma once
+
+#include <map>
+
+#include "base/singleton.h"
+#include "base/synchronization/lock.h"
+#include "chrome/common/notification_observer.h"
+#include "chrome/common/notification_registrar.h"
+#include "net/base/x509_certificate.h"
+
+// The purpose of the cert store is to provide an easy way to store/retrieve
+// X509Certificate objects.  When stored, an X509Certificate object is
+// associated with a RenderProcessHost.  If all the RenderProcessHosts
+// associated with the cert have exited, the cert is removed from the store.
+// This class is used by the SSLManager to keep track of the certs associated
+// to loaded resources.
+// It can be accessed from the UI and IO threads (it is thread-safe).
+// Note that the cert ids will overflow if we register more than 2^32 - 1 certs
+// in 1 browsing session (which is highly unlikely to happen).
+
+class CertStore : public NotificationObserver {
+ public:
+  // Returns the singleton instance of the CertStore.
+  static CertStore* GetInstance();
+
+  // Stores the specified cert and returns the id associated with it.  The cert
+  // is associated to the specified RenderProcessHost.
+  // When all the RenderProcessHosts associated with a cert have exited, the
+  // cert is removed from the store.
+  // Note: ids starts at 1.
+  int StoreCert(net::X509Certificate* cert, int render_process_host_id);
+
+  // Tries to retrieve the previously stored cert associated with the specified
+  // |cert_id|.  Returns whether the cert could be found, and, if |cert| is
+  // non-NULL, copies it in.
+  bool RetrieveCert(int cert_id, scoped_refptr<net::X509Certificate>* cert);
+
+  // NotificationObserver implementation.
+  virtual void Observe(NotificationType type,
+                       const NotificationSource& source,
+                       const NotificationDetails& details);
+
+ private:
+  friend struct DefaultSingletonTraits<CertStore>;
+
+  CertStore();
+  ~CertStore();
+
+  // Remove the specified cert from id_to_cert_ and cert_to_id_.
+  // NOTE: the caller (RemoveCertsForRenderProcesHost) must hold cert_lock_.
+  void RemoveCertInternal(int cert_id);
+
+  // Removes all the certs associated with the specified process from the store.
+  void RemoveCertsForRenderProcesHost(int render_process_host_id);
+
+  typedef std::multimap<int, int> IDMap;
+  typedef std::map<int, scoped_refptr<net::X509Certificate> > CertMap;
+  typedef std::map<net::X509Certificate*, int, net::X509Certificate::LessThan>
+      ReverseCertMap;
+
+  NotificationRegistrar registrar_;
+
+  IDMap process_id_to_cert_id_;
+  IDMap cert_id_to_process_id_;
+
+  CertMap id_to_cert_;
+  ReverseCertMap cert_to_id_;
+
+  int next_cert_id_;
+
+  // This lock protects: process_to_ids_, id_to_processes_, id_to_cert_ and
+  //                     cert_to_id_.
+  base::Lock cert_lock_;
+
+  DISALLOW_COPY_AND_ASSIGN(CertStore);
+};
+
+#endif  // CONTENT_BROWSER_CERT_STORE_H_
diff --git a/chrome/browser/certificate_manager_model.cc b/content/browser/certificate_manager_model.cc
index 067a302..c1660b6 100644
--- a/chrome/browser/certificate_manager_model.cc
+++ b/content/browser/certificate_manager_model.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/certificate_manager_model.h"
+#include "content/browser/certificate_manager_model.h"
 
 #include "base/i18n/time_formatting.h"
 #include "base/logging.h"
diff --git a/content/browser/certificate_manager_model.h b/content/browser/certificate_manager_model.h
new file mode 100644
index 0000000..f134a68
--- /dev/null
+++ b/content/browser/certificate_manager_model.h
@@ -0,0 +1,110 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
+#define CONTENT_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
+
+#include <map>
+#include <string>
+
+#include "base/ref_counted.h"
+#include "base/string16.h"
+#include "net/base/cert_database.h"
+
+// CertificateManagerModel provides the data to be displayed in the certificate
+// manager dialog, and processes changes from the view.
+class CertificateManagerModel {
+ public:
+  // Map from the subject organization name to the list of certs from that
+  // organization.  If a cert does not have an organization name, the
+  // subject's CertPrincipal::GetDisplayName() value is used instead.
+  typedef std::map<std::string, net::CertificateList> OrgGroupingMap;
+
+  // Enumeration of the possible columns in the certificate manager tree view.
+  enum Column {
+    COL_SUBJECT_NAME,
+    COL_CERTIFICATE_STORE,
+    COL_SERIAL_NUMBER,
+    COL_EXPIRES_ON,
+  };
+
+  class Observer {
+   public:
+    // Called to notify the view that the certificate list has been refreshed.
+    // TODO(mattm): do a more granular updating strategy?  Maybe retrieve new
+    // list of certs, diff against past list, and then notify of the changes?
+    virtual void CertificatesRefreshed() = 0;
+  };
+
+  explicit CertificateManagerModel(Observer* observer);
+  ~CertificateManagerModel();
+
+  // Accessor for read-only access to the underlying CertDatabase.
+  const net::CertDatabase& cert_db() const { return cert_db_; }
+
+  // Refresh the list of certs.  Following this call, the observer
+  // CertificatesRefreshed method will be called so the view can call
+  // FilterAndBuildOrgGroupingMap as necessary to refresh its tree views.
+  void Refresh();
+
+  // Fill |map| with the certificates matching |filter_type|.
+  void FilterAndBuildOrgGroupingMap(net::CertType filter_type,
+                                    OrgGroupingMap* map) const;
+
+  // Get the data to be displayed in |column| for the given |cert|.
+  string16 GetColumnText(const net::X509Certificate& cert, Column column) const;
+
+  // Import certificates from PKCS #12 encoded |data|, using the given
+  // |password|.  Returns a net error code on failure.
+  int ImportFromPKCS12(net::CryptoModule* module, const std::string& data,
+                       const string16& password);
+
+  // Import CA certificates.
+  // Tries to import all the certificates given.  The root will be trusted
+  // according to |trust_bits|.  Any certificates that could not be imported
+  // will be listed in |not_imported|.
+  // |trust_bits| should be a bit field of TRUST_* values from CertDatabase, or
+  // UNTRUSTED.
+  // Returns false if there is an internal error, otherwise true is returned and
+  // |not_imported| should be checked for any certificates that were not
+  // imported.
+  bool ImportCACerts(const net::CertificateList& certificates,
+                     unsigned int trust_bits,
+                     net::CertDatabase::ImportCertFailureList* not_imported);
+
+  // Import server certificate.  The first cert should be the server cert.  Any
+  // additional certs should be intermediate/CA certs and will be imported but
+  // not given any trust.
+  // Any certificates that could not be imported will be listed in
+  // |not_imported|.
+  // Returns false if there is an internal error, otherwise true is returned and
+  // |not_imported| should be checked for any certificates that were not
+  // imported.
+  bool ImportServerCert(
+      const net::CertificateList& certificates,
+      net::CertDatabase::ImportCertFailureList* not_imported);
+
+  // Set trust values for certificate.
+  // |trust_bits| should be a bit field of TRUST_* values from CertDatabase, or
+  // UNTRUSTED.
+  // Returns true on success or false on failure.
+  bool SetCertTrust(const net::X509Certificate* cert,
+                    net::CertType type,
+                    unsigned int trust_bits);
+
+  // Delete the cert.  Returns true on success.  |cert| is still valid when this
+  // function returns.
+  bool Delete(net::X509Certificate* cert);
+
+ private:
+  net::CertDatabase cert_db_;
+  net::CertificateList cert_list_;
+
+  // The observer to notify when certificate list is refreshed.
+  Observer* observer_;
+
+  DISALLOW_COPY_AND_ASSIGN(CertificateManagerModel);
+};
+
+#endif  // CONTENT_BROWSER_CERTIFICATE_MANAGER_MODEL_H_
diff --git a/chrome/browser/certificate_viewer.cc b/content/browser/certificate_viewer.cc
index 73cc4d5c..3d92e7a 100644
--- a/chrome/browser/certificate_viewer.cc
+++ b/content/browser/certificate_viewer.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/certificate_viewer.h"
+#include "content/browser/certificate_viewer.h"
 
-#include "chrome/browser/cert_store.h"
+#include "content/browser/cert_store.h"
 
 void ShowCertificateViewerByID(gfx::NativeWindow parent, int cert_id) {
   scoped_refptr<net::X509Certificate> cert;
diff --git a/content/browser/certificate_viewer.h b/content/browser/certificate_viewer.h
new file mode 100644
index 0000000..8fa8befe
--- /dev/null
+++ b/content/browser/certificate_viewer.h
@@ -0,0 +1,25 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CERTIFICATE_VIEWER_H_
+#define CONTENT_BROWSER_CERTIFICATE_VIEWER_H_
+#pragma once
+
+#include "ui/gfx/native_widget_types.h"
+
+namespace net {
+
+class X509Certificate;
+
+}  // namespace net
+
+// Opens a certificate viewer under |parent| to display the certificate from
+// the |CertStore| with id |cert_id|.
+void ShowCertificateViewerByID(gfx::NativeWindow parent, int cert_id);
+
+// Opens a certificate viewer under |parent| to display |cert|.
+void ShowCertificateViewer(gfx::NativeWindow parent,
+                           net::X509Certificate* cert);
+
+#endif  // CONTENT_BROWSER_CERTIFICATE_VIEWER_H_
diff --git a/chrome/browser/child_process_launcher.cc b/content/browser/child_process_launcher.cc
index 0ed3f89..ded41be 100644
--- a/chrome/browser/child_process_launcher.cc
+++ b/content/browser/child_process_launcher.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/child_process_launcher.h"
+#include "content/browser/child_process_launcher.h"
 
 #include <utility>  // For std::pair.
 
@@ -11,11 +11,11 @@
 #include "base/scoped_ptr.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread.h"
-#include "chrome/browser/browser_thread.h"
 #include "chrome/common/chrome_descriptors.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/process_watcher.h"
 #include "chrome/common/result_codes.h"
+#include "content/browser/browser_thread.h"
 
 #if defined(OS_WIN)
 #include "base/file_path.h"
diff --git a/content/browser/child_process_launcher.h b/content/browser/child_process_launcher.h
new file mode 100644
index 0000000..0174f15
--- /dev/null
+++ b/content/browser/child_process_launcher.h
@@ -0,0 +1,71 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CHILD_PROCESS_LAUNCHER_H_
+#define CONTENT_BROWSER_CHILD_PROCESS_LAUNCHER_H_
+#pragma once
+
+#include "base/basictypes.h"
+#include "base/process_util.h"
+#include "base/ref_counted.h"
+
+class CommandLine;
+
+// Launches a process asynchronously and notifies the client of the process
+// handle when it's available.  It's used to avoid blocking the calling thread
+// on the OS since often it can take > 100 ms to create the process.
+class ChildProcessLauncher {
+ public:
+  class Client {
+   public:
+    // Will be called on the thread that the ChildProcessLauncher was
+    // constructed on.
+    virtual void OnProcessLaunched() = 0;
+
+   protected:
+    virtual ~Client() {}
+  };
+
+  // Launches the process asynchronously, calling the client when the result is
+  // ready.  Deleting this object before the process is created is safe, since
+  // the callback won't be called.  If the process is still running by the time
+  // this object destructs, it will be terminated.
+  // Takes ownership of cmd_line.
+  ChildProcessLauncher(
+#if defined(OS_WIN)
+      const FilePath& exposed_dir,
+#elif defined(OS_POSIX)
+      bool use_zygote,
+      const base::environment_vector& environ,
+      int ipcfd,
+#endif
+      CommandLine* cmd_line,
+      Client* client);
+  ~ChildProcessLauncher();
+
+  // True if the process is being launched and so the handle isn't available.
+  bool IsStarting();
+
+  // Getter for the process handle.  Only call after the process has started.
+  base::ProcessHandle GetHandle();
+
+  // Call this when the child process exits to know what happened to
+  // it.  |exit_code| is the exit code of the process if it exited
+  // (e.g. status from waitpid if on posix, from GetExitCodeProcess on
+  // Windows). |exit_code| may be NULL.
+  base::TerminationStatus GetChildTerminationStatus(int* exit_code);
+
+  // Changes whether the process runs in the background or not.  Only call
+  // this after the process has started.
+  void SetProcessBackgrounded(bool background);
+
+ private:
+  class Context;
+
+  scoped_refptr<Context> context_;
+
+  DISALLOW_COPY_AND_ASSIGN(ChildProcessLauncher);
+};
+
+#endif  // CONTENT_BROWSER_CHILD_PROCESS_LAUNCHER_H_
diff --git a/chrome/browser/child_process_security_policy.cc b/content/browser/child_process_security_policy.cc
index 5cd7009..b57f7d5 100644
--- a/chrome/browser/child_process_security_policy.cc
+++ b/content/browser/child_process_security_policy.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/child_process_security_policy.h"
+#include "content/browser/child_process_security_policy.h"
 
 #include "base/file_path.h"
 #include "base/logging.h"
diff --git a/content/browser/child_process_security_policy.h b/content/browser/child_process_security_policy.h
new file mode 100644
index 0000000..2f2df5e
--- /dev/null
+++ b/content/browser/child_process_security_policy.h
@@ -0,0 +1,164 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_
+#define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_
+
+#pragma once
+
+#include <map>
+#include <set>
+#include <string>
+
+#include "base/basictypes.h"
+#include "base/gtest_prod_util.h"
+#include "base/singleton.h"
+#include "base/synchronization/lock.h"
+
+class FilePath;
+class GURL;
+
+// The ChildProcessSecurityPolicy class is used to grant and revoke security
+// capabilities for child porcesses.  For example, it restricts whether a child
+// process is permmitted to loaded file:// URLs based on whether the process
+// has ever been commanded to load file:// URLs by the browser.
+//
+// ChildProcessSecurityPolicy is a singleton that may be used on any thread.
+//
+class ChildProcessSecurityPolicy {
+ public:
+  // Object can only be created through GetInstance() so the constructor is
+  // private.
+  ~ChildProcessSecurityPolicy();
+
+  // There is one global ChildProcessSecurityPolicy object for the entire
+  // browser process.  The object returned by this method may be accessed on
+  // any thread.
+  static ChildProcessSecurityPolicy* GetInstance();
+
+  // Web-safe schemes can be requested by any child process.  Once a web-safe
+  // scheme has been registered, any child process can request URLs with
+  // that scheme.  There is no mechanism for revoking web-safe schemes.
+  void RegisterWebSafeScheme(const std::string& scheme);
+
+  // Returns true iff |scheme| has been registered as a web-safe scheme.
+  bool IsWebSafeScheme(const std::string& scheme);
+
+  // Pseudo schemes are treated differently than other schemes because they
+  // cannot be requested like normal URLs.  There is no mechanism for revoking
+  // pseudo schemes.
+  void RegisterPseudoScheme(const std::string& scheme);
+
+  // Returns true iff |scheme| has been registered as pseudo scheme.
+  bool IsPseudoScheme(const std::string& scheme);
+
+  // Upon creation, child processes should register themselves by calling this
+  // this method exactly once.
+  void Add(int child_id);
+
+  // Upon destruction, child processess should unregister themselves by caling
+  // this method exactly once.
+  void Remove(int child_id);
+
+  // Whenever the browser processes commands the child process to request a URL,
+  // it should call this method to grant the child process the capability to
+  // request the URL.
+  void GrantRequestURL(int child_id, const GURL& url);
+
+  // Whenever the user picks a file from a <input type="file"> element, the
+  // browser should call this function to grant the child process the capability
+  // to upload the file to the web.
+  void GrantReadFile(int child_id, const FilePath& file);
+
+  // Grants certain permissions to a file. |permissions| must be a bit-set of
+  // base::PlatformFileFlags.
+  void GrantPermissionsForFile(int child_id,
+                               const FilePath& file,
+                               int permissions);
+
+  // Revokes all permissions granted to the given file.
+  void RevokeAllPermissionsForFile(int child_id, const FilePath& file);
+
+  // Grants the child process the capability to access URLs of the provided
+  // scheme.
+  void GrantScheme(int child_id, const std::string& scheme);
+
+  // Grant the child process the ability to use Web UI Bindings.
+  void GrantWebUIBindings(int child_id);
+
+  // Grant the child process the ability to use extension Bindings.
+  void GrantExtensionBindings(int child_id);
+
+  // Grant the child process the ability to read raw cookies.
+  void GrantReadRawCookies(int child_id);
+
+  // Revoke read raw cookies permission.
+  void RevokeReadRawCookies(int child_id);
+
+  // Before servicing a child process's request for a URL, the browser should
+  // call this method to determine whether the process has the capability to
+  // request the URL.
+  bool CanRequestURL(int child_id, const GURL& url);
+
+  // Before servicing a child process's request to upload a file to the web, the
+  // browser should call this method to determine whether the process has the
+  // capability to upload the requested file.
+  bool CanReadFile(int child_id, const FilePath& file);
+
+  // Determines if certain permissions were granted for a file. |permissions|
+  // must be a bit-set of base::PlatformFileFlags.
+  bool HasPermissionsForFile(int child_id,
+                             const FilePath& file,
+                             int permissions);
+
+  // Returns true if the specified child_id has been granted WebUIBindings.
+  // The browser should check this property before assuming the child process is
+  // allowed to use WebUIBindings.
+  bool HasWebUIBindings(int child_id);
+
+  // Returns true if the specified child_id has been granted WebUIBindings.
+  // The browser should check this property before assuming the child process is
+  // allowed to use extension bindings.
+  bool HasExtensionBindings(int child_id);
+
+  // Returns true if the specified child_id has been granted ReadRawCookies.
+  bool CanReadRawCookies(int child_id);
+
+ private:
+  friend class ChildProcessSecurityPolicyInProcessBrowserTest;
+  FRIEND_TEST_ALL_PREFIXES(ChildProcessSecurityPolicyInProcessBrowserTest,
+                           NoLeak);
+
+  class SecurityState;
+
+  typedef std::set<std::string> SchemeSet;
+  typedef std::map<int, SecurityState*> SecurityStateMap;
+
+  // Obtain an instance of ChildProcessSecurityPolicy via GetInstance().
+  ChildProcessSecurityPolicy();
+  friend struct DefaultSingletonTraits<ChildProcessSecurityPolicy>;
+
+  // You must acquire this lock before reading or writing any members of this
+  // class.  You must not block while holding this lock.
+  base::Lock lock_;
+
+  // These schemes are white-listed for all child processes.  This set is
+  // protected by |lock_|.
+  SchemeSet web_safe_schemes_;
+
+  // These schemes do not actually represent retrievable URLs.  For example,
+  // the the URLs in the "about" scheme are aliases to other URLs.  This set is
+  // protected by |lock_|.
+  SchemeSet pseudo_schemes_;
+
+  // This map holds a SecurityState for each child process.  The key for the
+  // map is the ID of the ChildProcessHost.  The SecurityState objects are
+  // owned by this object and are protected by |lock_|.  References to them must
+  // not escape this class.
+  SecurityStateMap security_state_;
+
+  DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicy);
+};
+
+#endif  // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_
diff --git a/chrome/browser/child_process_security_policy_browsertest.cc b/content/browser/child_process_security_policy_browsertest.cc
index 4bcd3dc..f28001d 100644
--- a/chrome/browser/child_process_security_policy_browsertest.cc
+++ b/content/browser/child_process_security_policy_browsertest.cc
@@ -7,13 +7,13 @@
 #include "base/basictypes.h"
 #include "base/file_path.h"
 #include "base/process_util.h"
-#include "chrome/browser/child_process_security_policy.h"
-#include "chrome/browser/renderer_host/render_process_host.h"
-#include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/common/result_codes.h"
 #include "chrome/test/in_process_browser_test.h"
 #include "chrome/test/ui_test_utils.h"
+#include "content/browser/child_process_security_policy.h"
+#include "content/browser/renderer_host/render_process_host.h"
+#include "content/browser/tab_contents/tab_contents.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 class ChildProcessSecurityPolicyInProcessBrowserTest
diff --git a/chrome/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 9910b45..92ba8d2 100644
--- a/chrome/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -7,8 +7,8 @@
 #include "base/basictypes.h"
 #include "base/file_path.h"
 #include "base/platform_file.h"
-#include "chrome/browser/child_process_security_policy.h"
 #include "chrome/common/url_constants.h"
+#include "content/browser/child_process_security_policy.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_test_job.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chrome/browser/chrome_blob_storage_context.cc b/content/browser/chrome_blob_storage_context.cc
index 139b8d1..245e860 100644
--- a/chrome/browser/chrome_blob_storage_context.cc
+++ b/content/browser/chrome_blob_storage_context.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/chrome_blob_storage_context.h"
+#include "content/browser/chrome_blob_storage_context.h"
 
 #include "chrome/browser/net/chrome_url_request_context.h"
 #include "webkit/blob/blob_storage_controller.h"
diff --git a/content/browser/chrome_blob_storage_context.h b/content/browser/chrome_blob_storage_context.h
new file mode 100644
index 0000000..1c5fe55
--- /dev/null
+++ b/content/browser/chrome_blob_storage_context.h
@@ -0,0 +1,46 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CHROME_BLOB_STORAGE_CONTEXT_H_
+#define CONTENT_BROWSER_CHROME_BLOB_STORAGE_CONTEXT_H_
+#pragma once
+
+#include "base/ref_counted.h"
+#include "base/scoped_ptr.h"
+#include "chrome/browser/browser_thread.h"
+
+class GURL;
+
+namespace webkit_blob {
+class BlobStorageController;
+}
+
+// A context class that keeps track of BlobStorageController used by the chrome.
+// There is an instance associated with each Profile. There could be multiple
+// URLRequestContexts in the same profile that refers to the same instance.
+//
+// All methods, except the ctor, are expected to be called on
+// the IO thread (unless specifically called out in doc comments).
+class ChromeBlobStorageContext
+    : public base::RefCountedThreadSafe<ChromeBlobStorageContext,
+                                        BrowserThread::DeleteOnIOThread> {
+ public:
+  ChromeBlobStorageContext();
+
+  void InitializeOnIOThread();
+
+  webkit_blob::BlobStorageController* controller() const {
+    return controller_.get();
+  }
+
+ private:
+  friend class BrowserThread;
+  friend class DeleteTask<ChromeBlobStorageContext>;
+
+  virtual ~ChromeBlobStorageContext();
+
+  scoped_ptr<webkit_blob::BlobStorageController> controller_;
+};
+
+#endif  // CONTENT_BROWSER_CHROME_BLOB_STORAGE_CONTEXT_H_
diff --git a/chrome/browser/cross_site_request_manager.cc b/content/browser/cross_site_request_manager.cc
index 6514933..38762bd 100644
--- a/chrome/browser/cross_site_request_manager.cc
+++ b/content/browser/cross_site_request_manager.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/cross_site_request_manager.h"
+#include "content/browser/cross_site_request_manager.h"
 
 #include "base/singleton.h"
 
diff --git a/content/browser/cross_site_request_manager.h b/content/browser/cross_site_request_manager.h
new file mode 100644
index 0000000..1274264
--- /dev/null
+++ b/content/browser/cross_site_request_manager.h
@@ -0,0 +1,60 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CROSS_SITE_REQUEST_MANAGER_H_
+#define CONTENT_BROWSER_CROSS_SITE_REQUEST_MANAGER_H_
+#pragma once
+
+#include <set>
+#include <utility>
+
+#include "base/basictypes.h"
+#include "base/synchronization/lock.h"
+
+template <typename T> struct DefaultSingletonTraits;
+
+// CrossSiteRequestManager is used to handle bookkeeping for cross-site
+// requests and responses between the UI and IO threads.  Such requests involve
+// a transition from one RenderViewHost to another within TabContents, and
+// involve coordination with ResourceDispatcherHost.
+//
+// CrossSiteRequestManager is a singleton that may be used on any thread.
+//
+class CrossSiteRequestManager {
+ public:
+  // Returns the singleton instance.
+  static CrossSiteRequestManager* GetInstance();
+
+  // Returns whether the RenderViewHost specified by the given IDs currently
+  // has a pending cross-site request.  If so, we will have to delay the
+  // response until the previous RenderViewHost runs its onunload handler.
+  // Called by ResourceDispatcherHost on the IO thread.
+  bool HasPendingCrossSiteRequest(int renderer_id, int render_view_id);
+
+  // Sets whether the RenderViewHost specified by the given IDs currently has a
+  // pending cross-site request.  Called by RenderViewHost on the UI thread.
+  void SetHasPendingCrossSiteRequest(int renderer_id,
+                                     int render_view_id,
+                                     bool has_pending);
+
+ private:
+  friend struct DefaultSingletonTraits<CrossSiteRequestManager>;
+  typedef std::set<std::pair<int, int> > RenderViewSet;
+
+  CrossSiteRequestManager();
+  ~CrossSiteRequestManager();
+
+  // You must acquire this lock before reading or writing any members of this
+  // class.  You must not block while holding this lock.
+  base::Lock lock_;
+
+  // Set of (render_process_host_id, render_view_id) pairs of all
+  // RenderViewHosts that have pending cross-site requests.  Used to pass
+  // information about the RenderViewHosts between the UI and IO threads.
+  RenderViewSet pending_cross_site_views_;
+
+  DISALLOW_COPY_AND_ASSIGN(CrossSiteRequestManager);
+};
+
+#endif  // CONTENT_BROWSER_CROSS_SITE_REQUEST_MANAGER_H_
diff --git a/chrome/browser/disposition_utils.cc b/content/browser/disposition_utils.cc
index 326a323..fba7479 100644
--- a/chrome/browser/disposition_utils.cc
+++ b/content/browser/disposition_utils.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/disposition_utils.h"
+#include "content/browser/disposition_utils.h"
 
 #include "build/build_config.h"
 
diff --git a/content/browser/disposition_utils.h b/content/browser/disposition_utils.h
new file mode 100644
index 0000000..ba8c9e5
--- /dev/null
+++ b/content/browser/disposition_utils.h
@@ -0,0 +1,24 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_DISPOSITION_UTILS_H_
+#define CONTENT_BROWSER_DISPOSITION_UTILS_H_
+#pragma once
+
+#include "webkit/glue/window_open_disposition.h"
+
+namespace disposition_utils {
+
+// Translates event flags from a click on a link into the user's desired
+// window disposition.  For example, a middle click would mean to open
+// a background tab.
+WindowOpenDisposition DispositionFromClick(bool middle_button,
+                                           bool alt_key,
+                                           bool ctrl_key,
+                                           bool meta_key,
+                                           bool shift_key);
+
+}
+
+#endif  // CONTENT_BROWSER_DISPOSITION_UTILS_H_
diff --git a/content/content_browser.gypi b/content/content_browser.gypi
index 1629d8b..4a5a09a 100644
--- a/content/content_browser.gypi
+++ b/content/content_browser.gypi
@@ -20,6 +20,32 @@
         '..',
       ],
       'sources': [
+        'browser/browser_child_process_host.cc',
+        'browser/browser_child_process_host.h',
+        'browser/browser_message_filter.cc',
+        'browser/browser_message_filter.h',
+        'browser/browser_thread.cc',
+        'browser/browser_thread.h',
+        'browser/browsing_instance.cc',
+        'browser/browsing_instance.h',
+        'browser/cancelable_request.cc',
+        'browser/cancelable_request.h',
+        'browser/cert_store.cc',
+        'browser/cert_store.h',
+        'browser/certificate_manager_model.cc',
+        'browser/certificate_manager_model.h',
+        'browser/certificate_viewer.cc',
+        'browser/certificate_viewer.h',
+        'browser/child_process_launcher.cc',
+        'browser/child_process_launcher.h',
+        'browser/child_process_security_policy.cc',
+        'browser/child_process_security_policy.h',
+        'browser/chrome_blob_storage_context.cc',
+        'browser/chrome_blob_storage_context.h',
+        'browser/cross_site_request_manager.cc',
+        'browser/cross_site_request_manager.h',
+        'browser/disposition_utils.cc',
+        'browser/disposition_utils.h',
         'browser/renderer_host/accelerated_surface_container_mac.cc',
         'browser/renderer_host/accelerated_surface_container_mac.h',
         'browser/renderer_host/accelerated_surface_container_manager_mac.cc',
@@ -144,6 +170,13 @@
             '../build/linux/system.gyp:x11',
           ],
         }],
+        ['OS!="linux"', {
+          'sources!': [
+            # TODO(mattm): Cert manager stuff is really !USE_NSS.
+            'browser/certificate_manager_model.cc',
+            'browser/certificate_manager_model.h',
+          ],
+        }],
       ],
     },
   ],