Revert 249516 "Move DidCommitProvisionalLoad code from RenderVie..."

> Move DidCommitProvisionalLoad code from RenderView to RenderFrame.
> 
> BUG=304341
> R=creis@chromium.org
> 
> Review URL: https://codereview.chromium.org/135723003

Casuses a UAF on ASAN bots in SigninBrowserTest.SigninSkipForNowAndGoBack
http://build.chromium.org/p/chromium.memory/builders/Linux%20ASAN%20Tests%20%283%29/builds/22688/steps/browser_tests/logs/stdio

TBR=nasko@chromium.org

Review URL: https://codereview.chromium.org/152143010

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@249583 0039d316-1c4b-4281-b951-d872f2087c98

40 files changed, 969 insertions, 1266 deletions

diff --git a/chrome/common/extensions/extension_messages.h b/chrome/common/extensions/extension_messages.h
index 6ad9b67..e4e5ec4 100644
--- a/chrome/common/extensions/extension_messages.h
+++ b/chrome/common/extensions/extension_messages.h
@@ -671,9 +671,8 @@ IPC_MESSAGE_CONTROL2(ExtensionHostMsg_AddDOMActionToActivityLog,
 // certain conditions.  This message is sent in response to several events:
 //
 // * ExtensionMsg_WatchPages was received, updating the set of conditions.
-// * A new page is loaded.  This will be sent after
-//   FrameHostMsg_DidCommitProvisionalLoad. Currently this only fires for the
-//   main frame.
+// * A new page is loaded.  This will be sent after ViewHostMsg_FrameNavigate.
+//   Currently this only fires for the main frame.
 // * Something changed on an existing frame causing the set of matching searches
 //   to change.
 IPC_MESSAGE_ROUTED1(ExtensionHostMsg_OnWatchedPageChange,
diff --git a/content/browser/frame_host/interstitial_page_impl.cc b/content/browser/frame_host/interstitial_page_impl.cc
index 41470a4..090ac12 100644
--- a/content/browser/frame_host/interstitial_page_impl.cc
+++ b/content/browser/frame_host/interstitial_page_impl.cc
@@ -23,7 +23,6 @@
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/port/browser/render_view_host_delegate_view.h"
 #include "content/port/browser/render_widget_host_view_port.h"
@@ -397,7 +396,7 @@ void InterstitialPageImpl::RenderViewTerminated(
 
 void InterstitialPageImpl::DidNavigate(
     RenderViewHost* render_view_host,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
+    const ViewHostMsg_FrameNavigate_Params& params) {
   // A fast user could have navigated away from the page that triggered the
   // interstitial while the interstitial was loading, that would have disabled
   // us. In that case we can dismiss ourselves.
diff --git a/content/browser/frame_host/interstitial_page_impl.h b/content/browser/frame_host/interstitial_page_impl.h
index 5415fc9..36e0807 100644
--- a/content/browser/frame_host/interstitial_page_impl.h
+++ b/content/browser/frame_host/interstitial_page_impl.h
@@ -91,12 +91,6 @@ class CONTENT_EXPORT InterstitialPageImpl
   RenderViewHost* GetRenderViewHost() const;
 #endif
 
-  // TODO(nasko): This should move to InterstitialPageNavigatorImpl, but in
-  // the meantime make it public, so it can be called directly.
-  void DidNavigate(
-      RenderViewHost* render_view_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
-
  protected:
   // NotificationObserver method:
   virtual void Observe(int type,
@@ -117,6 +111,9 @@ class CONTENT_EXPORT InterstitialPageImpl
   virtual void RenderViewTerminated(RenderViewHost* render_view_host,
                                     base::TerminationStatus status,
                                     int error_code) OVERRIDE;
+  virtual void DidNavigate(
+      RenderViewHost* render_view_host,
+      const ViewHostMsg_FrameNavigate_Params& params) OVERRIDE;
   virtual void UpdateTitle(RenderViewHost* render_view_host,
                            int32 page_id,
                            const base::string16& title,
diff --git a/content/browser/frame_host/interstitial_page_navigator_impl.cc b/content/browser/frame_host/interstitial_page_navigator_impl.cc
index 82f40af..830e1bf 100644
--- a/content/browser/frame_host/interstitial_page_navigator_impl.cc
+++ b/content/browser/frame_host/interstitial_page_navigator_impl.cc
@@ -6,22 +6,12 @@
 
 #include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigator_delegate.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"
 
 namespace content {
 
 InterstitialPageNavigatorImpl::InterstitialPageNavigatorImpl(
     InterstitialPageImpl* interstitial,
-    NavigationControllerImpl* navigation_controller)
-    : interstitial_(interstitial) {}
-
-void InterstitialPageNavigatorImpl::DidNavigate(
-    RenderFrameHostImpl* render_frame_host,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& input_params) {
-  // TODO(nasko): Move implementation here, but for the time being call out
-  // to the interstitial page code.
-  interstitial_->DidNavigate(
-      render_frame_host->render_view_host(), input_params);
+    NavigationControllerImpl* navigation_controller) {
 }
 
 }  // namespace content
diff --git a/content/browser/frame_host/interstitial_page_navigator_impl.h b/content/browser/frame_host/interstitial_page_navigator_impl.h
index 2b57f7a..1b55fd2 100644
--- a/content/browser/frame_host/interstitial_page_navigator_impl.h
+++ b/content/browser/frame_host/interstitial_page_navigator_impl.h
@@ -22,18 +22,9 @@ class CONTENT_EXPORT InterstitialPageNavigatorImpl : public Navigator {
       InterstitialPageImpl* interstitial,
       NavigationControllerImpl* navigation_controller);
 
-  virtual void DidNavigate(
-      RenderFrameHostImpl* render_frame_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params&
-          input_params) OVERRIDE;
-
  private:
   virtual ~InterstitialPageNavigatorImpl() {}
 
-  // The InterstitialPage with which this navigator object is associated.
-  // Non owned pointer.
-  InterstitialPageImpl* interstitial_;
-
   DISALLOW_COPY_AND_ASSIGN(InterstitialPageNavigatorImpl);
 };
 
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 57a92f5..fff4c63 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -20,7 +20,6 @@
 #include "content/browser/frame_host/navigation_entry_screenshot_manager.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"  // Temporary
 #include "content/browser/site_instance_impl.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/content_browser_client.h"
@@ -737,7 +736,7 @@ void NavigationControllerImpl::LoadURLWithParams(const LoadURLParams& params) {
 
 bool NavigationControllerImpl::RendererDidNavigate(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    const ViewHostMsg_FrameNavigate_Params& params,
     LoadCommittedDetails* details) {
   is_initial_navigation_ = false;
 
@@ -854,7 +853,7 @@ bool NavigationControllerImpl::RendererDidNavigate(
 
 NavigationType NavigationControllerImpl::ClassifyNavigation(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) const {
+    const ViewHostMsg_FrameNavigate_Params& params) const {
   if (params.page_id == -1) {
     // The renderer generates the page IDs, and so if it gives us the invalid
     // page ID (-1) we know it didn't actually navigate. This happens in a few
@@ -989,7 +988,7 @@ NavigationType NavigationControllerImpl::ClassifyNavigation(
 
 void NavigationControllerImpl::RendererDidNavigateToNewPage(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    const ViewHostMsg_FrameNavigate_Params& params,
     bool replace_entry) {
   NavigationEntryImpl* new_entry;
   bool update_virtual_url;
@@ -1053,7 +1052,7 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
 
 void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
+    const ViewHostMsg_FrameNavigate_Params& params) {
   // We should only get here for main frame navigations.
   DCHECK(PageTransitionIsMainFrame(params.transition));
 
@@ -1106,7 +1105,7 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
 
 void NavigationControllerImpl::RendererDidNavigateToSamePage(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
+    const ViewHostMsg_FrameNavigate_Params& params) {
   // This mode implies we have a pending entry that's the same as an existing
   // entry for this page ID. This entry is guaranteed to exist by
   // ClassifyNavigation. All we need to do is update the existing entry.
@@ -1133,7 +1132,7 @@ void NavigationControllerImpl::RendererDidNavigateToSamePage(
 
 void NavigationControllerImpl::RendererDidNavigateInPage(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    const ViewHostMsg_FrameNavigate_Params& params,
     bool* did_replace_entry) {
   DCHECK(PageTransitionIsMainFrame(params.transition)) <<
       "WebKit should only tell us about in-page navs for the main frame.";
@@ -1162,7 +1161,7 @@ void NavigationControllerImpl::RendererDidNavigateInPage(
 
 void NavigationControllerImpl::RendererDidNavigateNewSubframe(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
+    const ViewHostMsg_FrameNavigate_Params& params) {
   if (PageTransitionCoreTypeIs(params.transition,
                                PAGE_TRANSITION_AUTO_SUBFRAME)) {
     // This is not user-initiated. Ignore.
@@ -1184,7 +1183,7 @@ void NavigationControllerImpl::RendererDidNavigateNewSubframe(
 
 bool NavigationControllerImpl::RendererDidNavigateAutoSubframe(
     RenderViewHost* rvh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
+    const ViewHostMsg_FrameNavigate_Params& params) {
   // We're guaranteed to have a previously committed entry, and we now need to
   // handle navigation inside of a subframe in it without creating a new entry.
   DCHECK(GetLastCommittedEntry());
diff --git a/content/browser/frame_host/navigation_controller_impl.h b/content/browser/frame_host/navigation_controller_impl.h
index a33f5bc..e9206b4 100644
--- a/content/browser/frame_host/navigation_controller_impl.h
+++ b/content/browser/frame_host/navigation_controller_impl.h
@@ -16,7 +16,7 @@
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_type.h"
 
-struct FrameHostMsg_DidCommitProvisionalLoad_Params;
+struct ViewHostMsg_FrameNavigate_Params;
 
 namespace content {
 class NavigationEntryImpl;
@@ -136,10 +136,9 @@ class CONTENT_EXPORT NavigationControllerImpl
   // and it will return false.
   //
   // TODO(creis): Change RenderViewHost to RenderFrameHost.
-  bool RendererDidNavigate(
-      RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-      LoadCommittedDetails* details);
+  bool RendererDidNavigate(RenderViewHost* rvh,
+                           const ViewHostMsg_FrameNavigate_Params& params,
+                           LoadCommittedDetails* details);
 
   // Notifies us that we just became active. This is used by the WebContentsImpl
   // so that we know to load URLs that were pending as "lazy" loads.
@@ -236,7 +235,7 @@ class CONTENT_EXPORT NavigationControllerImpl
   // Classifies the given renderer navigation (see the NavigationType enum).
   NavigationType ClassifyNavigation(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) const;
+      const ViewHostMsg_FrameNavigate_Params& params) const;
 
   // Causes the controller to load the specified entry. The function assumes
   // ownership of the pointer since it is put in the navigation list.
@@ -259,24 +258,24 @@ class CONTENT_EXPORT NavigationControllerImpl
   // TODO(creis): Change RenderViewHost to RenderFrameHost.
   void RendererDidNavigateToNewPage(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+      const ViewHostMsg_FrameNavigate_Params& params,
       bool replace_entry);
   void RendererDidNavigateToExistingPage(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
+      const ViewHostMsg_FrameNavigate_Params& params);
   void RendererDidNavigateToSamePage(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
+      const ViewHostMsg_FrameNavigate_Params& params);
   void RendererDidNavigateInPage(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+      const ViewHostMsg_FrameNavigate_Params& params,
       bool* did_replace_entry);
   void RendererDidNavigateNewSubframe(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
+      const ViewHostMsg_FrameNavigate_Params& params);
   bool RendererDidNavigateAutoSubframe(
       RenderViewHost* rvh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
+      const ViewHostMsg_FrameNavigate_Params& params);
 
   // Helper function for code shared between Reload() and ReloadIgnoringCache().
   void ReloadInternal(bool check_for_repost, ReloadType reload_type);
diff --git a/content/browser/frame_host/navigation_controller_impl_unittest.cc b/content/browser/frame_host/navigation_controller_impl_unittest.cc
index 7b07331..318fb62 100644
--- a/content/browser/frame_host/navigation_controller_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_unittest.cc
@@ -277,7 +277,7 @@ TEST_F(NavigationControllerTest, GoToOffset) {
     urls[i] = GURL(base::StringPrintf("http://www.a.com/%d", i));
   }
 
-  main_test_rfh()->SendNavigate(0, urls[0]);
+  test_rvh()->SendNavigate(0, urls[0]);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
   EXPECT_EQ(urls[0], controller.GetVisibleEntry()->GetVirtualURL());
@@ -286,7 +286,7 @@ TEST_F(NavigationControllerTest, GoToOffset) {
   EXPECT_FALSE(controller.CanGoToOffset(1));
 
   for (int i = 1; i <= 4; ++i) {
-    main_test_rfh()->SendNavigate(i, urls[i]);
+    test_rvh()->SendNavigate(i, urls[i]);
     EXPECT_EQ(1U, navigation_entry_committed_counter_);
     navigation_entry_committed_counter_ = 0;
     EXPECT_EQ(urls[i], controller.GetVisibleEntry()->GetVirtualURL());
@@ -321,7 +321,7 @@ TEST_F(NavigationControllerTest, GoToOffset) {
     url_index += offset;
     // Check that the GoToOffset will land on the expected page.
     EXPECT_EQ(urls[url_index], controller.GetPendingEntry()->GetVirtualURL());
-    main_test_rfh()->SendNavigate(url_index, urls[url_index]);
+    test_rvh()->SendNavigate(url_index, urls[url_index]);
     EXPECT_EQ(1U, navigation_entry_committed_counter_);
     navigation_entry_committed_counter_ = 0;
     // Check that we can go to any valid offset into the history.
@@ -364,7 +364,7 @@ TEST_F(NavigationControllerTest, LoadURL) {
   // We should have gotten no notifications from the preceeding checks.
   EXPECT_EQ(0U, notifications.size());
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -445,7 +445,7 @@ TEST_F(NavigationControllerTest, LoadURLSameTime) {
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -455,7 +455,7 @@ TEST_F(NavigationControllerTest, LoadURLSameTime) {
   // Simulate the beforeunload ack for the cross-site transition, and then the
   // commit.
   test_rvh()->SendShouldCloseACK(true);
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -578,7 +578,7 @@ TEST_F(NavigationControllerTest, LoadURL_SamePage) {
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -588,7 +588,7 @@ TEST_F(NavigationControllerTest, LoadURL_SamePage) {
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -619,14 +619,14 @@ TEST_F(NavigationControllerTest, LoadURL_SamePage_DifferentMethod) {
   const GURL url1("http://foo1");
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url1;
   params.transition = PAGE_TRANSITION_TYPED;
   params.is_post = true;
   params.post_id = 123;
   params.page_state = PageState::CreateForTesting(url1, false, 0, 0);
-  main_test_rfh()->SendNavigateWithParams(&params);
+  test_rvh()->SendNavigateWithParams(&params);
 
   // The post data should be visible.
   NavigationEntry* entry = controller.GetVisibleEntry();
@@ -635,7 +635,7 @@ TEST_F(NavigationControllerTest, LoadURL_SamePage_DifferentMethod) {
   EXPECT_EQ(entry->GetPostID(), 123);
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
 
   // We should not have produced a new session history entry.
   ASSERT_EQ(controller.GetVisibleEntry(), entry);
@@ -656,7 +656,7 @@ TEST_F(NavigationControllerTest, LoadURL_Discarded) {
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -693,13 +693,13 @@ TEST_F(NavigationControllerTest, LoadURL_NoPending) {
   const GURL kExistingURL1("http://eh");
   controller.LoadURL(
       kExistingURL1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, kExistingURL1);
+  test_rvh()->SendNavigate(0, kExistingURL1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   // Do a new navigation without making a pending one.
   const GURL kNewURL("http://see");
-  main_test_rfh()->SendNavigate(99, kNewURL);
+  test_rvh()->SendNavigate(99, kNewURL);
 
   // There should no longer be any pending entry, and the third navigation we
   // just made should be committed.
@@ -723,7 +723,7 @@ TEST_F(NavigationControllerTest, LoadURL_NewPending) {
   const GURL kExistingURL1("http://eh");
   controller.LoadURL(
       kExistingURL1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, kExistingURL1);
+  test_rvh()->SendNavigate(0, kExistingURL1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -760,14 +760,14 @@ TEST_F(NavigationControllerTest, LoadURL_ExistingPending) {
   const GURL kExistingURL1("http://foo/eh");
   controller.LoadURL(
       kExistingURL1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, kExistingURL1);
+  test_rvh()->SendNavigate(0, kExistingURL1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   const GURL kExistingURL2("http://foo/bee");
   controller.LoadURL(
       kExistingURL2, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(1, kExistingURL2);
+  test_rvh()->SendNavigate(1, kExistingURL2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -781,7 +781,7 @@ TEST_F(NavigationControllerTest, LoadURL_ExistingPending) {
   // Before that commits, do a new navigation.
   const GURL kNewURL("http://foo/see");
   LoadCommittedDetails details;
-  main_test_rfh()->SendNavigate(3, kNewURL);
+  test_rvh()->SendNavigate(3, kNewURL);
 
   // There should no longer be any pending entry, and the third navigation we
   // just made should be committed.
@@ -806,7 +806,7 @@ TEST_F(NavigationControllerTest, LoadURL_PrivilegedPending) {
       kExistingURL1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   // Pretend it has bindings so we can tell if we incorrectly copy it.
   test_rvh()->AllowBindings(2);
-  main_test_rfh()->SendNavigate(0, kExistingURL1);
+  test_rvh()->SendNavigate(0, kExistingURL1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -859,14 +859,14 @@ TEST_F(NavigationControllerTest, LoadURL_BackPreemptsPending) {
   const GURL kExistingURL1("http://foo/eh");
   controller.LoadURL(
       kExistingURL1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, kExistingURL1);
+  test_rvh()->SendNavigate(0, kExistingURL1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   const GURL kExistingURL2("http://foo/bee");
   controller.LoadURL(
       kExistingURL2, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(1, kExistingURL2);
+  test_rvh()->SendNavigate(1, kExistingURL2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -879,7 +879,7 @@ TEST_F(NavigationControllerTest, LoadURL_BackPreemptsPending) {
   EXPECT_EQ(1, controller.GetLastCommittedEntryIndex());
 
   // Before that commits, a back navigation from the renderer commits.
-  main_test_rfh()->SendNavigate(0, kExistingURL1);
+  test_rvh()->SendNavigate(0, kExistingURL1);
 
   // There should no longer be any pending entry, and the back navigation we
   // just made should be committed.
@@ -918,7 +918,7 @@ TEST_F(NavigationControllerTest, LoadURL_IgnorePreemptsPending) {
 
   // Before that commits, a document.write and location.reload can cause the
   // renderer to send a FrameNavigate with page_id -1.
-  main_test_rfh()->SendNavigate(-1, kExistingURL);
+  test_rvh()->SendNavigate(-1, kExistingURL);
 
   // This should clear the pending entry and notify of a navigation state
   // change, so that we do not keep displaying kNewURL.
@@ -995,7 +995,7 @@ TEST_F(NavigationControllerTest, LoadURL_RedirectAbortDoesntShowPendingURL) {
   const GURL kExistingURL("http://foo/eh");
   controller.LoadURL(kExistingURL, content::Referrer(),
                      content::PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, kExistingURL);
+  test_rvh()->SendNavigate(0, kExistingURL);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1122,7 +1122,7 @@ TEST_F(NavigationControllerTest, Reload) {
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
   ASSERT_TRUE(controller.GetVisibleEntry());
@@ -1146,7 +1146,7 @@ TEST_F(NavigationControllerTest, Reload) {
   // See http://crbug.com/96041.
   EXPECT_TRUE(controller.GetVisibleEntry()->GetTitle().empty());
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1174,14 +1174,14 @@ TEST_F(NavigationControllerTest, Reload_GeneratesNewPage) {
   const GURL url2("http://foo2");
 
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   controller.Reload(true);
   EXPECT_EQ(0U, notifications.size());
 
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1203,7 +1203,7 @@ TEST_F(NavigationControllerTest, ReloadWithGuest) {
 
   const GURL url1("http://foo1");
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   ASSERT_TRUE(controller.GetVisibleEntry());
 
   // Make the entry believe its RenderProcessHost is a guest.
@@ -1239,8 +1239,7 @@ TEST_F(NavigationControllerTest, ReloadOriginalRequestURL) {
   controller.LoadURL(
       original_url, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigateWithOriginalRequestURL(
-      0, final_url, original_url);
+  test_rvh()->SendNavigateWithOriginalRequestURL(0, final_url, original_url);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1271,7 +1270,7 @@ TEST_F(NavigationControllerTest, ReloadOriginalRequestURL) {
   EXPECT_TRUE(controller.GetVisibleEntry()->GetTitle().empty());
 
   // Send that the navigation has proceeded; say it got redirected again.
-  main_test_rfh()->SendNavigate(0, final_url);
+  test_rvh()->SendNavigate(0, final_url);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1321,7 +1320,7 @@ TEST_F(NavigationControllerTest, ResetEntryValuesAfterCommit) {
   EXPECT_EQ(1U, pending_entry->redirect_chain().size());
   EXPECT_TRUE(pending_entry->should_clear_history_list());
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
 
   // Certain values that are only used for pending entries get reset after
   // commit.
@@ -1344,12 +1343,12 @@ TEST_F(NavigationControllerTest, Back) {
   RegisterForAllNavNotifications(&notifications, &controller);
 
   const GURL url1("http://foo1");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   const GURL url2("http://foo2");
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1373,7 +1372,7 @@ TEST_F(NavigationControllerTest, Back) {
   EXPECT_GE(controller.GetEntryAtIndex(1)->GetTimestamp(),
             controller.GetEntryAtIndex(0)->GetTimestamp());
 
-  main_test_rfh()->SendNavigate(0, url2);
+  test_rvh()->SendNavigate(0, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1407,12 +1406,12 @@ TEST_F(NavigationControllerTest, Back_GeneratesNewPage) {
 
   controller.LoadURL(
       url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   controller.LoadURL(url2, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1428,7 +1427,7 @@ TEST_F(NavigationControllerTest, Back_GeneratesNewPage) {
   EXPECT_FALSE(controller.CanGoBack());
   EXPECT_TRUE(controller.CanGoForward());
 
-  main_test_rfh()->SendNavigate(2, url3);
+  test_rvh()->SendNavigate(2, url3);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1454,12 +1453,12 @@ TEST_F(NavigationControllerTest, Back_NewPending) {
   const GURL kUrl3("http://foo3");
 
   // First navigate two places so we have some back history.
-  main_test_rfh()->SendNavigate(0, kUrl1);
+  test_rvh()->SendNavigate(0, kUrl1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   // controller.LoadURL(kUrl2, PAGE_TRANSITION_TYPED);
-  main_test_rfh()->SendNavigate(1, kUrl2);
+  test_rvh()->SendNavigate(1, kUrl2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1484,12 +1483,12 @@ TEST_F(NavigationControllerTest, Back_OtherBackPending) {
   const GURL kUrl3("http://foo/3");
 
   // First navigate three places so we have some back history.
-  main_test_rfh()->SendNavigate(0, kUrl1);
-  main_test_rfh()->SendNavigate(1, kUrl2);
-  main_test_rfh()->SendNavigate(2, kUrl3);
+  test_rvh()->SendNavigate(0, kUrl1);
+  test_rvh()->SendNavigate(1, kUrl2);
+  test_rvh()->SendNavigate(2, kUrl3);
 
   // With nothing pending, say we get a navigation to the second entry.
-  main_test_rfh()->SendNavigate(1, kUrl2);
+  test_rvh()->SendNavigate(1, kUrl2);
 
   // We know all the entries have the same site instance, so we can just grab
   // a random one for looking up other entries.
@@ -1505,7 +1504,7 @@ TEST_F(NavigationControllerTest, Back_OtherBackPending) {
 
   // Now go forward to the last item again and say it was committed.
   controller.GoForward();
-  main_test_rfh()->SendNavigate(2, kUrl3);
+  test_rvh()->SendNavigate(2, kUrl3);
 
   // Now start going back one to the second page. It will be pending.
   controller.GoBack();
@@ -1514,7 +1513,7 @@ TEST_F(NavigationControllerTest, Back_OtherBackPending) {
 
   // Not synthesize a totally new back event to the first page. This will not
   // match the pending one.
-  main_test_rfh()->SendNavigate(0, kUrl1);
+  test_rvh()->SendNavigate(0, kUrl1);
 
   // The committed navigation should clear the pending entry.
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
@@ -1533,16 +1532,16 @@ TEST_F(NavigationControllerTest, Forward) {
   const GURL url1("http://foo1");
   const GURL url2("http://foo2");
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   controller.GoBack();
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1566,7 +1565,7 @@ TEST_F(NavigationControllerTest, Forward) {
   EXPECT_GE(controller.GetEntryAtIndex(0)->GetTimestamp(),
             controller.GetEntryAtIndex(1)->GetTimestamp());
 
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1598,15 +1597,15 @@ TEST_F(NavigationControllerTest, Forward_GeneratesNewPage) {
   const GURL url2("http://foo2");
   const GURL url3("http://foo3");
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   controller.GoBack();
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1622,7 +1621,7 @@ TEST_F(NavigationControllerTest, Forward_GeneratesNewPage) {
   EXPECT_TRUE(controller.CanGoBack());
   EXPECT_FALSE(controller.CanGoForward());
 
-  main_test_rfh()->SendNavigate(2, url3);
+  test_rvh()->SendNavigate(2, url3);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
   EXPECT_TRUE(notifications.Check1AndReset(NOTIFICATION_NAV_LIST_PRUNED));
@@ -1650,7 +1649,7 @@ TEST_F(NavigationControllerTest, Redirect) {
   controller.LoadURL(url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
 
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigate(0, url2);
+  test_rvh()->SendNavigate(0, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1661,7 +1660,7 @@ TEST_F(NavigationControllerTest, Redirect) {
   EXPECT_EQ(controller.GetPendingEntryIndex(), -1);
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
 
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url2;
   params.transition = PAGE_TRANSITION_SERVER_REDIRECT;
@@ -1707,7 +1706,7 @@ TEST_F(NavigationControllerTest, PostThenRedirect) {
   controller.GetVisibleEntry()->SetHasPostData(true);
 
   EXPECT_EQ(0U, notifications.size());
-  main_test_rfh()->SendNavigate(0, url2);
+  test_rvh()->SendNavigate(0, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1718,7 +1717,7 @@ TEST_F(NavigationControllerTest, PostThenRedirect) {
   EXPECT_EQ(controller.GetPendingEntryIndex(), -1);
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
 
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url2;
   params.transition = PAGE_TRANSITION_SERVER_REDIRECT;
@@ -1765,7 +1764,7 @@ TEST_F(NavigationControllerTest, ImmediateRedirect) {
   EXPECT_EQ(controller.GetPendingEntryIndex(), -1);
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
 
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url2;
   params.transition = PAGE_TRANSITION_SERVER_REDIRECT;
@@ -1803,12 +1802,12 @@ TEST_F(NavigationControllerTest, NewSubframe) {
   RegisterForAllNavNotifications(&notifications, &controller);
 
   const GURL url1("http://foo1");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   const GURL url2("http://foo2");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 1;
   params.url = url2;
   params.transition = PAGE_TRANSITION_MANUAL_SUBFRAME;
@@ -1844,7 +1843,7 @@ TEST_F(NavigationControllerTest, SubframeOnEmptyPage) {
 
   // Navigation controller currently has no entries.
   const GURL url("http://foo2");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 1;
   params.url = url;
   params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
@@ -1866,12 +1865,12 @@ TEST_F(NavigationControllerTest, AutoSubframe) {
   RegisterForAllNavNotifications(&notifications, &controller);
 
   const GURL url1("http://foo1");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   const GURL url2("http://foo2");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url2;
   params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
@@ -1897,13 +1896,13 @@ TEST_F(NavigationControllerTest, BackSubframe) {
 
   // Main page.
   const GURL url1("http://foo1");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   // First manual subframe navigation.
   const GURL url2("http://foo2");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 1;
   params.url = url2;
   params.transition = PAGE_TRANSITION_MANUAL_SUBFRAME;
@@ -1962,11 +1961,11 @@ TEST_F(NavigationControllerTest, LinkClick) {
   const GURL url1("http://foo1");
   const GURL url2("http://foo2");
 
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -1987,13 +1986,13 @@ TEST_F(NavigationControllerTest, InPage) {
 
   // Main page.
   const GURL url1("http://foo");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   // Ensure main page navigation to same url respects the was_within_same_page
   // hint provided in the params.
-  FrameHostMsg_DidCommitProvisionalLoad_Params self_params;
+  ViewHostMsg_FrameNavigate_Params self_params;
   self_params.page_id = 0;
   self_params.url = url1;
   self_params.transition = PAGE_TRANSITION_LINK;
@@ -2014,7 +2013,7 @@ TEST_F(NavigationControllerTest, InPage) {
 
   // Fragment navigation to a new page_id.
   const GURL url2("http://foo#a");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 1;
   params.url = url2;
   params.transition = PAGE_TRANSITION_LINK;
@@ -2033,7 +2032,7 @@ TEST_F(NavigationControllerTest, InPage) {
   EXPECT_EQ(2, controller.GetEntryCount());
 
   // Go back one.
-  FrameHostMsg_DidCommitProvisionalLoad_Params back_params(params);
+  ViewHostMsg_FrameNavigate_Params back_params(params);
   controller.GoBack();
   back_params.url = url1;
   back_params.page_id = 0;
@@ -2047,7 +2046,7 @@ TEST_F(NavigationControllerTest, InPage) {
   EXPECT_EQ(back_params.url, controller.GetVisibleEntry()->GetURL());
 
   // Go forward
-  FrameHostMsg_DidCommitProvisionalLoad_Params forward_params(params);
+  ViewHostMsg_FrameNavigate_Params forward_params(params);
   controller.GoForward();
   forward_params.url = url2;
   forward_params.page_id = 1;
@@ -2094,13 +2093,13 @@ TEST_F(NavigationControllerTest, InPage_Replace) {
 
   // Main page.
   const GURL url1("http://foo");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
   // First navigation.
   const GURL url2("http://foo#a");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;  // Same page_id
   params.url = url2;
   params.transition = PAGE_TRANSITION_LINK;
@@ -2133,7 +2132,7 @@ TEST_F(NavigationControllerTest, ClientRedirectAfterInPageNavigation) {
   // Load an initial page.
   {
     const GURL url("http://foo/");
-    main_test_rfh()->SendNavigate(0, url);
+    test_rvh()->SendNavigate(0, url);
     EXPECT_EQ(1U, navigation_entry_committed_counter_);
     navigation_entry_committed_counter_ = 0;
   }
@@ -2141,7 +2140,7 @@ TEST_F(NavigationControllerTest, ClientRedirectAfterInPageNavigation) {
   // Navigate to a new page.
   {
     const GURL url("http://foo2/");
-    main_test_rfh()->SendNavigate(1, url);
+    test_rvh()->SendNavigate(1, url);
     EXPECT_EQ(1U, navigation_entry_committed_counter_);
     navigation_entry_committed_counter_ = 0;
   }
@@ -2149,7 +2148,7 @@ TEST_F(NavigationControllerTest, ClientRedirectAfterInPageNavigation) {
   // Navigate within the page.
   {
     const GURL url("http://foo2/#a");
-    FrameHostMsg_DidCommitProvisionalLoad_Params params;
+    ViewHostMsg_FrameNavigate_Params params;
     params.page_id = 1;  // Same page_id
     params.url = url;
     params.transition = PAGE_TRANSITION_LINK;
@@ -2172,7 +2171,7 @@ TEST_F(NavigationControllerTest, ClientRedirectAfterInPageNavigation) {
   // Perform a client redirect to a new page.
   {
     const GURL url("http://foo3/");
-    FrameHostMsg_DidCommitProvisionalLoad_Params params;
+    ViewHostMsg_FrameNavigate_Params params;
     params.page_id = 2;  // New page_id
     params.url = url;
     params.transition = PAGE_TRANSITION_CLIENT_REDIRECT;
@@ -2196,7 +2195,7 @@ TEST_F(NavigationControllerTest, ClientRedirectAfterInPageNavigation) {
   {
     const GURL url("http://foo2/");
     controller.GoBack();
-    main_test_rfh()->SendNavigate(1, url);
+    test_rvh()->SendNavigate(1, url);
     EXPECT_EQ(1U, navigation_entry_committed_counter_);
     navigation_entry_committed_counter_ = 0;
     EXPECT_EQ(url, controller.GetVisibleEntry()->GetURL());
@@ -2248,7 +2247,7 @@ TEST_F(NavigationControllerTest, EnforceMaxNavigationCount) {
     GURL url(base::StringPrintf("http://www.a.com/%d", url_index));
     controller.LoadURL(
         url, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-    main_test_rfh()->SendNavigate(url_index, url);
+    test_rvh()->SendNavigate(url_index, url);
   }
 
   EXPECT_EQ(controller.GetEntryCount(), kMaxEntryCount);
@@ -2260,7 +2259,7 @@ TEST_F(NavigationControllerTest, EnforceMaxNavigationCount) {
   GURL url(base::StringPrintf("http://www.a.com/%d", url_index));
   controller.LoadURL(
       url, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(url_index, url);
+  test_rvh()->SendNavigate(url_index, url);
   url_index++;
 
   // We should have got a pruned navigation.
@@ -2278,7 +2277,7 @@ TEST_F(NavigationControllerTest, EnforceMaxNavigationCount) {
     url = GURL(base::StringPrintf("http:////www.a.com/%d", url_index));
     controller.LoadURL(
         url, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-    main_test_rfh()->SendNavigate(url_index, url);
+    test_rvh()->SendNavigate(url_index, url);
     url_index++;
   }
   EXPECT_EQ(controller.GetEntryCount(), kMaxEntryCount);
@@ -2339,7 +2338,7 @@ TEST_F(NavigationControllerTest, RestoreNavigate) {
   EXPECT_EQ(timestamp, our_controller.GetEntryAtIndex(0)->GetTimestamp());
 
   // Say we navigated to that entry.
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url;
   params.transition = PAGE_TRANSITION_LINK;
@@ -2426,7 +2425,7 @@ TEST_F(NavigationControllerTest, RestoreNavigateAfterFailure) {
                                                   fail_load_params));
 
   // Now the pending restored entry commits.
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = url;
   params.transition = PAGE_TRANSITION_LINK;
@@ -2457,7 +2456,7 @@ TEST_F(NavigationControllerTest, Interstitial) {
   const GURL url1("http://foo");
   controller.LoadURL(
       url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
 
   // Now navigate somewhere with an interstitial.
   const GURL url2("http://bar");
@@ -2468,7 +2467,7 @@ TEST_F(NavigationControllerTest, Interstitial) {
 
   // At this point the interstitial will be displayed and the load will still
   // be pending. If the user continues, the load will commit.
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
 
   // The page should be a normal page again.
   EXPECT_EQ(url2, controller.GetLastCommittedEntry()->GetURL());
@@ -2488,19 +2487,19 @@ TEST_F(NavigationControllerTest, RemoveEntry) {
 
   controller.LoadURL(
       url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   controller.LoadURL(
       url2, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(1, url2);
+  test_rvh()->SendNavigate(1, url2);
   controller.LoadURL(
       url3, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(2, url3);
+  test_rvh()->SendNavigate(2, url3);
   controller.LoadURL(
       url4, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(3, url4);
+  test_rvh()->SendNavigate(3, url4);
   controller.LoadURL(
       url5, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(4, url5);
+  test_rvh()->SendNavigate(4, url5);
 
   // Try to remove the last entry.  Will fail because it is the current entry.
   EXPECT_FALSE(controller.RemoveEntryAtIndex(controller.GetEntryCount() - 1));
@@ -2514,7 +2513,7 @@ TEST_F(NavigationControllerTest, RemoveEntry) {
   EXPECT_FALSE(controller.RemoveEntryAtIndex(controller.GetEntryCount() - 2));
 
   // Now commit and delete the last entry.
-  main_test_rfh()->SendNavigate(3, url4);
+  test_rvh()->SendNavigate(3, url4);
   EXPECT_TRUE(controller.RemoveEntryAtIndex(controller.GetEntryCount() - 1));
   EXPECT_EQ(4, controller.GetEntryCount());
   EXPECT_EQ(3, controller.GetLastCommittedEntryIndex());
@@ -2551,10 +2550,10 @@ TEST_F(NavigationControllerTest, TransientEntry) {
 
   controller.LoadURL(
       url0, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url0);
+  test_rvh()->SendNavigate(0, url0);
   controller.LoadURL(
       url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(1, url1);
+  test_rvh()->SendNavigate(1, url1);
 
   notifications.Reset();
 
@@ -2580,7 +2579,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   // Navigate.
   controller.LoadURL(
       url2, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(2, url2);
+  test_rvh()->SendNavigate(2, url2);
 
   // We should have navigated, transient entry should be gone.
   EXPECT_EQ(url2, controller.GetVisibleEntry()->GetURL());
@@ -2591,7 +2590,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   transient_entry->SetURL(transient_url);
   controller.SetTransientEntry(transient_entry);
   EXPECT_EQ(transient_url, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(3, url3);
+  test_rvh()->SendNavigate(3, url3);
   // Transient entry should be gone.
   EXPECT_EQ(url3, controller.GetVisibleEntry()->GetURL());
   EXPECT_EQ(controller.GetEntryCount(), 4);
@@ -2603,7 +2602,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   transient_entry->SetURL(transient_url);
   controller.SetTransientEntry(transient_entry);
   EXPECT_EQ(transient_url, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(4, url4);
+  test_rvh()->SendNavigate(4, url4);
   EXPECT_EQ(url4, controller.GetVisibleEntry()->GetURL());
   EXPECT_EQ(controller.GetEntryCount(), 5);
 
@@ -2618,7 +2617,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   // Transient entry should be gone.
   EXPECT_EQ(url4, controller.GetVisibleEntry()->GetURL());
   EXPECT_EQ(controller.GetEntryCount(), 5);
-  main_test_rfh()->SendNavigate(3, url3);
+  test_rvh()->SendNavigate(3, url3);
 
   // Add a transient and go to an entry before the current one.
   transient_entry = new NavigationEntryImpl;
@@ -2631,7 +2630,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   EXPECT_EQ(url1, controller.GetPendingEntry()->GetURL());
   // Visible entry does not update for history navigations until commit.
   EXPECT_EQ(url3, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(1, url1);
+  test_rvh()->SendNavigate(1, url1);
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
 
   // Add a transient and go to an entry after the current one.
@@ -2645,7 +2644,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   // land on url2 (which is visible after the commit).
   EXPECT_EQ(url2, controller.GetPendingEntry()->GetURL());
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(2, url2);
+  test_rvh()->SendNavigate(2, url2);
   EXPECT_EQ(url2, controller.GetVisibleEntry()->GetURL());
 
   // Add a transient and go forward.
@@ -2659,7 +2658,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   EXPECT_FALSE(controller.GetTransientEntry());
   EXPECT_EQ(url3, controller.GetPendingEntry()->GetURL());
   EXPECT_EQ(url2, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(3, url3);
+  test_rvh()->SendNavigate(3, url3);
   EXPECT_EQ(url3, controller.GetVisibleEntry()->GetURL());
 
   // Add a transient and do an in-page navigation, replacing the current entry.
@@ -2667,7 +2666,7 @@ TEST_F(NavigationControllerTest, TransientEntry) {
   transient_entry->SetURL(transient_url);
   controller.SetTransientEntry(transient_entry);
   EXPECT_EQ(transient_url, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(3, url3_ref);
+  test_rvh()->SendNavigate(3, url3_ref);
   // Transient entry should be gone.
   EXPECT_FALSE(controller.GetTransientEntry());
   EXPECT_EQ(url3_ref, controller.GetVisibleEntry()->GetURL());
@@ -2691,7 +2690,7 @@ TEST_F(NavigationControllerTest, ReloadTransient) {
   // Load |url0|, and start a pending navigation to |url1|.
   controller.LoadURL(
       url0, Referrer(), PAGE_TRANSITION_TYPED, std::string());
-  main_test_rfh()->SendNavigate(0, url0);
+  test_rvh()->SendNavigate(0, url0);
   controller.LoadURL(
       url1, Referrer(), PAGE_TRANSITION_TYPED, std::string());
 
@@ -2713,7 +2712,7 @@ TEST_F(NavigationControllerTest, ReloadTransient) {
   EXPECT_EQ(controller.GetEntryAtIndex(0)->GetURL(), url0);
 
   // Load of |transient_url| completes.
-  main_test_rfh()->SendNavigate(1, transient_url);
+  test_rvh()->SendNavigate(1, transient_url);
   ASSERT_EQ(controller.GetEntryCount(), 2);
   EXPECT_EQ(controller.GetEntryAtIndex(0)->GetURL(), url0);
   EXPECT_EQ(controller.GetEntryAtIndex(1)->GetURL(), transient_url);
@@ -2752,7 +2751,7 @@ TEST_F(NavigationControllerTest, RendererInitiatedPendingEntries) {
   EXPECT_EQ(url2, controller.GetPendingEntry()->GetVirtualURL());
 
   // Once it commits, the URL and virtual URL should reflect the actual page.
-  main_test_rfh()->SendNavigate(0, url2);
+  test_rvh()->SendNavigate(0, url2);
   EXPECT_EQ(url2, controller.GetLastCommittedEntry()->GetURL());
   EXPECT_EQ(url2, controller.GetLastCommittedEntry()->GetVirtualURL());
 
@@ -2775,7 +2774,7 @@ TEST_F(NavigationControllerTest, RendererInitiatedPendingEntries) {
   // TODO(nasko): Until OnNavigate is moved to RenderFrameHost, we need
   // to go through the RenderViewHost. The TestRenderViewHost routes navigations
   // to the main frame.
-  main_test_rfh()->SendNavigate(0, url2);
+  test_rvh()->SendNavigate(0, url2);
   EXPECT_EQ(url2, controller.GetLastCommittedEntry()->GetURL());
 }
 
@@ -2795,7 +2794,7 @@ TEST_F(NavigationControllerTest, DontShowRendererURLUntilCommit) {
   controller.LoadURL(url0, Referrer(), PAGE_TRANSITION_TYPED, std::string());
   EXPECT_EQ(url0, controller.GetPendingEntry()->GetURL());
   EXPECT_EQ(url0, controller.GetVisibleEntry()->GetURL());
-  main_test_rfh()->SendNavigate(0, url0);
+  test_rvh()->SendNavigate(0, url0);
 
   // For link clicks (renderer-initiated navigations), the pending entry should
   // update before commit but the visible should not.
@@ -2810,7 +2809,7 @@ TEST_F(NavigationControllerTest, DontShowRendererURLUntilCommit) {
 
   // After commit, both visible should be updated, there should be no pending
   // entry, and we should no longer treat the entry as renderer-initiated.
-  main_test_rfh()->SendNavigate(1, url1);
+  test_rvh()->SendNavigate(1, url1);
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
   EXPECT_FALSE(controller.GetPendingEntry());
   EXPECT_FALSE(
@@ -2883,7 +2882,7 @@ TEST_F(NavigationControllerTest, DontShowRendererURLInNewTabAfterCommit) {
   EXPECT_FALSE(test_rvh()->has_accessed_initial_document());
 
   // Simulate a commit and then starting a new pending navigation.
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   NavigationController::LoadURLParams load_url2_params(url2);
   load_url2_params.transition_type = PAGE_TRANSITION_LINK;
   load_url2_params.is_renderer_initiated = true;
@@ -2905,7 +2904,7 @@ TEST_F(NavigationControllerTest, IsInPageNavigation) {
   NavigationControllerImpl& controller = controller_impl();
   // Navigate to URL with no refs.
   const GURL url("http://www.google.com/home.html");
-  main_test_rfh()->SendNavigate(0, url);
+  test_rvh()->SendNavigate(0, url);
 
   // Reloading the page is not an in-page navigation.
   EXPECT_FALSE(controller.IsURLInPageNavigation(url));
@@ -2915,7 +2914,7 @@ TEST_F(NavigationControllerTest, IsInPageNavigation) {
   EXPECT_TRUE(controller.IsURLInPageNavigation(url_with_ref));
 
   // Navigate to URL with refs.
-  main_test_rfh()->SendNavigate(1, url_with_ref);
+  test_rvh()->SendNavigate(1, url_with_ref);
 
   // Reloading the page is not an in-page navigation.
   EXPECT_FALSE(controller.IsURLInPageNavigation(url_with_ref));
@@ -2943,7 +2942,7 @@ TEST_F(NavigationControllerTest, SameSubframe) {
   NavigationControllerImpl& controller = controller_impl();
   // Navigate the main frame.
   const GURL url("http://www.google.com/");
-  main_test_rfh()->SendNavigate(0, url);
+  test_rvh()->SendNavigate(0, url);
 
   // We should be at the first navigation entry.
   EXPECT_EQ(controller.GetEntryCount(), 1);
@@ -2951,7 +2950,7 @@ TEST_F(NavigationControllerTest, SameSubframe) {
 
   // Navigate a subframe that would normally count as in-page.
   const GURL subframe("http://www.google.com/#");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 0;
   params.url = subframe;
   params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
@@ -3066,7 +3065,7 @@ TEST_F(NavigationControllerTest, SubframeWhilePending) {
   // Send a subframe update from the first page, as if one had just
   // automatically loaded. Auto subframes don't increment the page ID.
   const GURL url1_sub("http://foo/subframe");
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = controller.GetLastCommittedEntry()->GetPageID();
   params.url = url1_sub;
   params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
@@ -3741,7 +3740,7 @@ TEST_F(NavigationControllerTest, PruneAllButLastCommittedForPendingNotInList) {
   EXPECT_EQ(1, controller.GetEntryCount());
 
   // Try to commit the pending entry.
-  main_test_rfh()->SendNavigate(2, url3);
+  test_rvh()->SendNavigate(2, url3);
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_FALSE(controller.GetPendingEntry());
   EXPECT_EQ(2, controller.GetEntryCount());
@@ -3783,7 +3782,7 @@ TEST_F(NavigationControllerTest, IsInitialNavigation) {
 
   // After commit, it stays false.
   const GURL url1("http://foo1");
-  main_test_rfh()->SendNavigate(0, url1);
+  test_rvh()->SendNavigate(0, url1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
   EXPECT_FALSE(controller.IsInitialNavigation());
@@ -3806,7 +3805,7 @@ TEST_F(NavigationControllerTest, ClearFaviconOnRedirect) {
   TestNotificationTracker notifications;
   RegisterForAllNavNotifications(&notifications, &controller);
 
-  main_test_rfh()->SendNavigate(0, kPageWithFavicon);
+  test_rvh()->SendNavigate(0, kPageWithFavicon);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -3821,7 +3820,7 @@ TEST_F(NavigationControllerTest, ClearFaviconOnRedirect) {
   favicon_status.valid = true;
   EXPECT_FALSE(DoImagesMatch(kDefaultFavicon, entry->GetFavicon().image));
 
-  main_test_rfh()->SendNavigateWithTransition(
+  test_rvh()->SendNavigateWithTransition(
       0,  // same page ID.
       kPageWithoutFavicon,
       PAGE_TRANSITION_CLIENT_REDIRECT);
@@ -3846,7 +3845,7 @@ TEST_F(NavigationControllerTest, BackNavigationDoesNotClearFavicon) {
   TestNotificationTracker notifications;
   RegisterForAllNavNotifications(&notifications, &controller);
 
-  main_test_rfh()->SendNavigate(0, kUrl1);
+  test_rvh()->SendNavigate(0, kUrl1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
 
@@ -3860,10 +3859,10 @@ TEST_F(NavigationControllerTest, BackNavigationDoesNotClearFavicon) {
   favicon_status.valid = true;
 
   // Navigate to another page and go back to the original page.
-  main_test_rfh()->SendNavigate(1, kUrl2);
+  test_rvh()->SendNavigate(1, kUrl2);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
-  main_test_rfh()->SendNavigateWithTransition(
+  test_rvh()->SendNavigateWithTransition(
       0,
       kUrl1,
       PAGE_TRANSITION_FORWARD_BACK);
diff --git a/content/browser/frame_host/navigator.h b/content/browser/frame_host/navigator.h
index 5bab536..d069bf8 100644
--- a/content/browser/frame_host/navigator.h
+++ b/content/browser/frame_host/navigator.h
@@ -10,7 +10,6 @@
 #include "content/public/browser/navigation_controller.h"
 
 class GURL;
-struct FrameHostMsg_DidCommitProvisionalLoad_Params;
 struct FrameHostMsg_DidFailProvisionalLoadWithError_Params;
 
 namespace base {
@@ -56,11 +55,6 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
       const GURL& source_url,
       const GURL& target_url) {}
 
-  // The RenderFrameHostImpl has committed a navigation.
-  virtual void DidNavigate(
-      RenderFrameHostImpl* render_frame_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {}
-
   // Causes the Navigator to navigate in the right render frame to |entry|,
   // which must be already part of the entries in the navigation controller.
   // This does not change the NavigationController state.
diff --git a/content/browser/frame_host/navigator_delegate.cc b/content/browser/frame_host/navigator_delegate.cc
deleted file mode 100644
index a284c0f..0000000
--- a/content/browser/frame_host/navigator_delegate.cc
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/navigator_delegate.h"
-
-namespace content {
-
-bool NavigatorDelegate::CanOverscrollContent() {
-  return false;
-}
-
-}  // namespace content
diff --git a/content/browser/frame_host/navigator_delegate.h b/content/browser/frame_host/navigator_delegate.h
index a1fa40c..e918277 100644
--- a/content/browser/frame_host/navigator_delegate.h
+++ b/content/browser/frame_host/navigator_delegate.h
@@ -5,23 +5,16 @@
 #ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_DELEGATE_H_
 #define CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_DELEGATE_H_
 
-#include "base/strings/string16.h"
 #include "content/public/browser/invalidate_type.h"
 #include "content/public/browser/navigation_controller.h"
-#include "content/public/common/page_transition_types.h"
-
-class GURL;
-struct FrameHostMsg_DidCommitProvisionalLoad_Params;
-struct FrameHostMsg_DidFailProvisionalLoadWithError_Params;
 
 namespace content {
 
-class RenderFrameHostImpl;
-struct LoadCommittedDetails;
+class RenderFrameHost;
 
 // A delegate API used by Navigator to notify its embedder of navigation
 // related events.
-class CONTENT_EXPORT NavigatorDelegate {
+class NavigatorDelegate {
  public:
   // The RenderFrameHost started a provisional load for the frame
   // represented by |render_frame_host|.
@@ -44,30 +37,6 @@ class CONTENT_EXPORT NavigatorDelegate {
       RenderFrameHostImpl* render_frame_host,
       const GURL& validated_target_url) {}
 
-  // A navigation was committed in |render_frame_host|.
-  virtual void DidCommitProvisionalLoad(
-      int64 frame_id,
-      const base::string16& frame_unique_name,
-      bool is_main_frame,
-      const GURL& url,
-      PageTransition transition_type,
-      RenderFrameHostImpl* render_frame_host) {}
-
-  // Handles post-navigation tasks in navigation AFTER the entry has been
-  // committed to the NavigationController. Note that the NavigationEntry is
-  // not provided since it may be invalid/changed after being committed. The
-  // NavigationController's last committed entry is for this navigation.
-  virtual void DidNavigateMainFramePostCommit(
-      const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {}
-  virtual void DidNavigateAnyFramePostCommit(
-      RenderFrameHostImpl* render_frame_host,
-      const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {}
-
-  virtual void SetMainFrameMimeType(const std::string& mime_type) {}
-  virtual bool CanOverscrollContent();
-
   // Notification to the Navigator embedder that navigation state has
   // changed. This method corresponds to
   // WebContents::NotifyNavigationStateChanged.
diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index bd7ce59..0103285 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc
@@ -20,10 +20,8 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/invalidate_type.h"
 #include "content/public/browser/navigation_controller.h"
-#include "content/public/browser/navigation_details.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/common/bindings_policy.h"
-#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
@@ -32,11 +30,6 @@ namespace content {
 
 namespace {
 
-content::RenderFrameHostManager* GetRenderManager(
-    content::RenderFrameHostImpl* rfh) {
-  return rfh->frame_tree_node()->render_manager();
-}
-
 ViewMsg_Navigate_Type::Value GetNavigationType(
     BrowserContext* browser_context, const NavigationEntryImpl& entry,
     NavigationController::ReloadType reload_type) {
@@ -368,164 +361,4 @@ base::TimeTicks NavigatorImpl::GetCurrentLoadStart() {
   return current_load_start_;
 }
 
-void NavigatorImpl::DidNavigate(
-    RenderFrameHostImpl* render_frame_host,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& input_params) {
-  FrameHostMsg_DidCommitProvisionalLoad_Params params(input_params);
-  FrameTree* frame_tree = render_frame_host->frame_tree_node()->frame_tree();
-  RenderViewHostImpl* rvh = render_frame_host->render_view_host();
-  bool use_site_per_process =
-      CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess);
-  if (frame_tree->IsFirstNavigationAfterSwap()) {
-    // First navigation should be a main frame navigation.
-    // TODO(creis): This DCHECK is currently disabled for --site-per-process
-    // because cross-process subframe navigations still have a main frame
-    // PageTransition.
-    if (!use_site_per_process)
-      DCHECK(PageTransitionIsMainFrame(params.transition));
-    frame_tree->OnFirstNavigationAfterSwap(params.frame_id);
-  }
-
-  // When using --site-per-process, look up the FrameTreeNode ID that the
-  // renderer-specific frame ID corresponds to.
-  int64 frame_tree_node_id = frame_tree->root()->frame_tree_node_id();
-  if (use_site_per_process) {
-    frame_tree_node_id =
-        render_frame_host->frame_tree_node()->frame_tree_node_id();
-    DCHECK_EQ(params.frame_id,
-              render_frame_host->frame_tree_node()->frame_id());
-
-    // TODO(creis): In the short term, cross-process subframe navigations are
-    // happening in the pending RenderViewHost's top-level frame.  (We need to
-    // both mirror the frame tree and get the navigation to occur in the correct
-    // subframe to fix this.)  Until then, we should check whether we have a
-    // pending NavigationEntry with a frame ID and if so, treat the
-    // cross-process "main frame" navigation as a subframe navigation.  This
-    // limits us to a single cross-process subframe per RVH, and it affects
-    // NavigateToEntry, NavigatorImpl::DidStartProvisionalLoad, and
-    // OnDidFinishLoad.
-    NavigationEntryImpl* pending_entry =
-        NavigationEntryImpl::FromNavigationEntry(
-            controller_->GetPendingEntry());
-    int root_ftn_id = frame_tree->root()->frame_tree_node_id();
-    if (pending_entry &&
-        pending_entry->frame_tree_node_id() != -1 &&
-        pending_entry->frame_tree_node_id() != root_ftn_id) {
-      params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
-      frame_tree_node_id = pending_entry->frame_tree_node_id();
-    }
-  }
-
-  if (PageTransitionIsMainFrame(params.transition)) {
-    // When overscroll navigation gesture is enabled, a screenshot of the page
-    // in its current state is taken so that it can be used during the
-    // nav-gesture. It is necessary to take the screenshot here, before calling
-    // RenderFrameHostManager::DidNavigateMainFrame, because that can change
-    // WebContents::GetRenderViewHost to return the new host, instead of the one
-    // that may have just been swapped out.
-    if (delegate_ && delegate_->CanOverscrollContent())
-      controller_->TakeScreenshot();
-
-    if (!use_site_per_process)
-      GetRenderManager(render_frame_host)->DidNavigateMainFrame(rvh);
-  }
-
-  // When using --site-per-process, we notify the RFHM for all navigations,
-  // not just main frame navigations.
-  if (use_site_per_process) {
-    FrameTreeNode* frame = frame_tree->FindByID(frame_tree_node_id);
-    // TODO(creis): Rename to DidNavigateFrame.
-    frame->render_manager()->DidNavigateMainFrame(rvh);
-  }
-
-  // Update the site of the SiteInstance if it doesn't have one yet, unless
-  // assigning a site is not necessary for this URL.  In that case, the
-  // SiteInstance can still be considered unused until a navigation to a real
-  // page.
-  SiteInstanceImpl* site_instance =
-      static_cast<SiteInstanceImpl*>(render_frame_host->GetSiteInstance());
-  if (!site_instance->HasSite() &&
-      ShouldAssignSiteForURL(params.url)) {
-    site_instance->SetSite(params.url);
-  }
-
-  // Need to update MIME type here because it's referred to in
-  // UpdateNavigationCommands() called by RendererDidNavigate() to
-  // determine whether or not to enable the encoding menu.
-  // It's updated only for the main frame. For a subframe,
-  // RenderView::UpdateURL does not set params.contents_mime_type.
-  // (see http://code.google.com/p/chromium/issues/detail?id=2929 )
-  // TODO(jungshik): Add a test for the encoding menu to avoid
-  // regressing it again.
-  // TODO(nasko): Verify the correctness of the above comment, since some of the
-  // code doesn't exist anymore. Also, move this code in the
-  // PageTransitionIsMainFrame code block above.
-  if (PageTransitionIsMainFrame(params.transition) && delegate_)
-    delegate_->SetMainFrameMimeType(params.contents_mime_type);
-
-  LoadCommittedDetails details;
-  bool did_navigate = controller_->RendererDidNavigate(rvh, params, &details);
-
-  // For now, keep track of each frame's URL in its FrameTreeNode.  This lets
-  // us estimate our process count for implementing OOP iframes.
-  // TODO(creis): Remove this when we track which pages commit in each frame.
-  frame_tree->SetFrameUrl(params.frame_id, params.url);
-
-  // Send notification about committed provisional loads. This notification is
-  // different from the NAV_ENTRY_COMMITTED notification which doesn't include
-  // the actual URL navigated to and isn't sent for AUTO_SUBFRAME navigations.
-  if (details.type != NAVIGATION_TYPE_NAV_IGNORE && delegate_) {
-    // For AUTO_SUBFRAME navigations, an event for the main frame is generated
-    // that is not recorded in the navigation history. For the purpose of
-    // tracking navigation events, we treat this event as a sub frame navigation
-    // event.
-    bool is_main_frame = did_navigate ? details.is_main_frame : false;
-    PageTransition transition_type = params.transition;
-    // Whether or not a page transition was triggered by going backward or
-    // forward in the history is only stored in the navigation controller's
-    // entry list.
-    if (did_navigate &&
-        (controller_->GetLastCommittedEntry()->GetTransitionType() &
-            PAGE_TRANSITION_FORWARD_BACK)) {
-      transition_type = PageTransitionFromInt(
-          params.transition | PAGE_TRANSITION_FORWARD_BACK);
-    }
-
-    delegate_->DidCommitProvisionalLoad(params.frame_id,
-                                        params.frame_unique_name,
-                                        is_main_frame,
-                                        params.url,
-                                        transition_type,
-                                        render_frame_host);
-  }
-
-  if (!did_navigate)
-    return;  // No navigation happened.
-
-  // DO NOT ADD MORE STUFF TO THIS FUNCTION! Your component should either listen
-  // for the appropriate notification (best) or you can add it to
-  // DidNavigateMainFramePostCommit / DidNavigateAnyFramePostCommit (only if
-  // necessary, please).
-
-  // Run post-commit tasks.
-  if (delegate_) {
-    if (details.is_main_frame)
-      delegate_->DidNavigateMainFramePostCommit(details, params);
-
-    delegate_->DidNavigateAnyFramePostCommit(
-        render_frame_host, details, params);
-  }
-}
-
-bool NavigatorImpl::ShouldAssignSiteForURL(const GURL& url) {
-  // about:blank should not "use up" a new SiteInstance.  The SiteInstance can
-  // still be used for a normal web site.
-  if (url == GURL(kAboutBlankURL))
-    return false;
-
-  // The embedder will then have the opportunity to determine if the URL
-  // should "use up" the SiteInstance.
-  return GetContentClient()->browser()->ShouldAssignSiteForURL(url);
-}
-
 }  // namespace content
diff --git a/content/browser/frame_host/navigator_impl.h b/content/browser/frame_host/navigator_impl.h
index 9fa33b6..769b5d2 100644
--- a/content/browser/frame_host/navigator_impl.h
+++ b/content/browser/frame_host/navigator_impl.h
@@ -14,7 +14,6 @@ namespace content {
 
 class NavigationControllerImpl;
 class NavigatorDelegate;
-struct LoadCommittedDetails;
 
 // This class is an implementation of Navigator, responsible for managing
 // navigations in regular browser tabs.
@@ -38,10 +37,6 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
       int32 page_id,
       const GURL& source_url,
       const GURL& target_url) OVERRIDE;
-  virtual void DidNavigate(
-      RenderFrameHostImpl* render_frame_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params&
-          input_params) OVERRIDE;
   virtual bool NavigateToEntry(
       RenderFrameHostImpl* render_frame_host,
       const NavigationEntryImpl& entry,
@@ -54,8 +49,6 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
  private:
   virtual ~NavigatorImpl() {}
 
-  bool ShouldAssignSiteForURL(const GURL& url);
-
   // The NavigationController that will keep track of session history for all
   // RenderFrameHost objects using this NavigatorImpl.
   // TODO(nasko): Move ownership of the NavigationController from
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 570e771..98122c8 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -6,7 +6,6 @@
 
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
-#include "base/metrics/user_metrics_action.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ -15,11 +14,9 @@
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/common/frame_messages.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/user_metrics.h"
-#include "content/public/common/url_constants.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -136,8 +133,6 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
                         OnDidFailProvisionalLoadWithError)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidRedirectProvisionalLoad,
                         OnDidRedirectProvisionalLoad)
-    IPC_MESSAGE_HANDLER_GENERIC(FrameHostMsg_DidCommitProvisionalLoad,
-                                OnNavigate(msg))
     IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
     IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
   IPC_END_MESSAGE_MAP_EX()
@@ -192,101 +187,6 @@ void RenderFrameHostImpl::OnDidRedirectProvisionalLoad(
       this, page_id, source_url, target_url);
 }
 
-// Called when the renderer navigates.  For every frame loaded, we'll get this
-// notification containing parameters identifying the navigation.
-//
-// Subframes are identified by the page transition type.  For subframes loaded
-// as part of a wider page load, the page_id will be the same as for the top
-// level frame.  If the user explicitly requests a subframe navigation, we will
-// get a new page_id because we need to create a new navigation entry for that
-// action.
-void RenderFrameHostImpl::OnNavigate(const IPC::Message& msg) {
-  // Read the parameters out of the IPC message directly to avoid making another
-  // copy when we filter the URLs.
-  PickleIterator iter(msg);
-  FrameHostMsg_DidCommitProvisionalLoad_Params validated_params;
-  if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::
-      Read(&msg, &iter, &validated_params))
-    return;
-
-  // If we're waiting for a cross-site beforeunload ack from this renderer and
-  // we receive a Navigate message from the main frame, then the renderer was
-  // navigating already and sent it before hearing the ViewMsg_Stop message.
-  // We do not want to cancel the pending navigation in this case, since the
-  // old page will soon be stopped.  Instead, treat this as a beforeunload ack
-  // to allow the pending navigation to continue.
-  if (render_view_host_->is_waiting_for_beforeunload_ack_ &&
-      render_view_host_->unload_ack_is_for_cross_site_transition_ &&
-      PageTransitionIsMainFrame(validated_params.transition)) {
-    render_view_host_->OnShouldCloseACK(
-        true, render_view_host_->send_should_close_start_time_,
-        base::TimeTicks::Now());
-    return;
-  }
-
-  // If we're waiting for an unload ack from this renderer and we receive a
-  // Navigate message, then the renderer was navigating before it received the
-  // unload request.  It will either respond to the unload request soon or our
-  // timer will expire.  Either way, we should ignore this message, because we
-  // have already committed to closing this renderer.
-  if (render_view_host_->is_waiting_for_unload_ack_)
-    return;
-
-  // Cache the main frame id, so we can use it for creating the frame tree
-  // root node when needed.
-  if (PageTransitionIsMainFrame(validated_params.transition)) {
-    if (render_view_host_->main_frame_id_ == -1) {
-      render_view_host_->main_frame_id_ = validated_params.frame_id;
-    } else {
-      // TODO(nasko): We plan to remove the usage of frame_id in navigation
-      // and move to routing ids. This is in place to ensure that a
-      // renderer is not misbehaving and sending us incorrect data.
-      DCHECK_EQ(render_view_host_->main_frame_id_, validated_params.frame_id);
-    }
-  }
-  RenderProcessHost* process = GetProcess();
-
-  // Attempts to commit certain off-limits URL should be caught more strictly
-  // than our FilterURL checks below.  If a renderer violates this policy, it
-  // should be killed.
-  if (!CanCommitURL(validated_params.url)) {
-    VLOG(1) << "Blocked URL " << validated_params.url.spec();
-    validated_params.url = GURL(kAboutBlankURL);
-    RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
-    // Kills the process.
-    process->ReceivedBadMessage();
-  }
-
-  // Now that something has committed, we don't need to track whether the
-  // initial page has been accessed.
-  render_view_host_->has_accessed_initial_document_ = false;
-
-  // Without this check, an evil renderer can trick the browser into creating
-  // a navigation entry for a banned URL.  If the user clicks the back button
-  // followed by the forward button (or clicks reload, or round-trips through
-  // session restore, etc), we'll think that the browser commanded the
-  // renderer to load the URL and grant the renderer the privileges to request
-  // the URL.  To prevent this attack, we block the renderer from inserting
-  // banned URLs into the navigation controller in the first place.
-  process->FilterURL(false, &validated_params.url);
-  process->FilterURL(true, &validated_params.referrer.url);
-  for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
-      it != validated_params.redirects.end(); ++it) {
-    process->FilterURL(false, &(*it));
-  }
-  process->FilterURL(true, &validated_params.searchable_form_url);
-
-  // Without this check, the renderer can trick the browser into using
-  // filenames it can't access in a future session restore.
-  if (!render_view_host_->CanAccessFilesOfPageState(
-          validated_params.page_state)) {
-    GetProcess()->ReceivedBadMessage();
-    return;
-  }
-
-  frame_tree_node()->navigator()->DidNavigate(this, validated_params);
-}
-
 void RenderFrameHostImpl::SwapOut() {
   if (render_view_host_->IsRenderViewLive()) {
     Send(new FrameMsg_SwapOut(routing_id_));
@@ -321,13 +221,4 @@ void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
   delegate_->ShowContextMenu(this, validated_params);
 }
 
-bool RenderFrameHostImpl::CanCommitURL(const GURL& url) {
-  // TODO(creis): We should also check for WebUI pages here.  Also, when the
-  // out-of-process iframes implementation is ready, we should check for
-  // cross-site URLs that are not allowed to commit in this process.
-
-  // Give the client a chance to disallow URLs from committing.
-  return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
-}
-
 }  // namespace content
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 7f1c04c..64864cb 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -97,7 +97,6 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost {
                       bool is_swapped_out);
 
  private:
-  friend class TestRenderFrameHost;
   friend class TestRenderViewHost;
 
   // IPC Message handlers.
@@ -111,15 +110,9 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost {
   void OnDidRedirectProvisionalLoad(int32 page_id,
                                     const GURL& source_url,
                                     const GURL& target_url);
-  void OnNavigate(const IPC::Message& msg);
   void OnSwapOutACK();
   void OnContextMenu(const ContextMenuParams& params);
 
-  // Returns whether the given URL is allowed to commit in the current process.
-  // This is a more conservative check than RenderProcessHost::FilterURL, since
-  // it will be used to kill processes that commit unauthorized URLs.
-  bool CanCommitURL(const GURL& url);
-
   // For now, RenderFrameHosts indirectly keep RenderViewHosts alive via a
   // refcount that calls Shutdown when it reaches zero.  This allows each
   // RenderFrameHostManager to just care about RenderFrameHosts, while ensuring
diff --git a/content/browser/frame_host/render_frame_host_manager_unittest.cc b/content/browser/frame_host/render_frame_host_manager_unittest.cc
index 91f9761..92744e8 100644
--- a/content/browser/frame_host/render_frame_host_manager_unittest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_unittest.cc
@@ -5,11 +5,9 @@
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_manager.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_service.h"
@@ -975,7 +973,7 @@ TEST_F(RenderFrameHostManagerTest, PageDoesBackAndReload) {
       pending_render_view_host());
 
   // Before that RVH has committed, the evil page reloads itself.
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   params.page_id = 1;
   params.url = kUrl2;
   params.transition = PAGE_TRANSITION_CLIENT_REDIRECT;
@@ -984,11 +982,7 @@ TEST_F(RenderFrameHostManagerTest, PageDoesBackAndReload) {
   params.was_within_same_page = false;
   params.is_post = false;
   params.page_state = PageState::CreateFromURL(kUrl2);
-
-  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(evil_rvh);
-  RenderFrameHostImpl* rfh = RenderFrameHostImpl::FromID(
-      rvh->GetProcess()->GetID(), rvh->main_frame_routing_id());
-  contents()->GetFrameTree()->root()->navigator()->DidNavigate(rfh, params);
+  contents()->DidNavigate(evil_rvh, params);
 
   // That should have cancelled the pending RVH, and the evil RVH should be the
   // current one.
diff --git a/content/browser/loader/resource_scheduler_filter.cc b/content/browser/loader/resource_scheduler_filter.cc
index 2cf32e6..66e9ea4 100644
--- a/content/browser/loader/resource_scheduler_filter.cc
+++ b/content/browser/loader/resource_scheduler_filter.cc
@@ -6,7 +6,6 @@
 
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/loader/resource_scheduler.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/common/page_transition_types.h"
 
@@ -29,10 +28,10 @@ bool ResourceSchedulerFilter::OnMessageReceived(const IPC::Message& message,
     return false;
 
   switch (message.type()) {
-    case FrameHostMsg_DidCommitProvisionalLoad::ID: {
+    case ViewHostMsg_FrameNavigate::ID: {
       PickleIterator iter(message);
-      FrameHostMsg_DidCommitProvisionalLoad_Params params;
-      if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::Read(
+      ViewHostMsg_FrameNavigate_Params params;
+      if (!IPC::ParamTraits<ViewHostMsg_FrameNavigate_Params>::Read(
           &message, &iter, &params)) {
         break;
       }
diff --git a/content/browser/renderer_host/render_view_host_browsertest.cc b/content/browser/renderer_host/render_view_host_browsertest.cc
index 3d2253b..555852c 100644
--- a/content/browser/renderer_host/render_view_host_browsertest.cc
+++ b/content/browser/renderer_host/render_view_host_browsertest.cc
@@ -13,7 +13,6 @@
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_paths.h"
-#include "content/public/common/frame_navigate_params.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test.h"
diff --git a/content/browser/renderer_host/render_view_host_delegate.h b/content/browser/renderer_host/render_view_host_delegate.h
index 975f9e1..891bbde 100644
--- a/content/browser/renderer_host/render_view_host_delegate.h
+++ b/content/browser/renderer_host/render_view_host_delegate.h
@@ -24,7 +24,7 @@ class GURL;
 class SkBitmap;
 class WebKeyboardEvent;
 struct ViewHostMsg_CreateWindow_Params;
-struct FrameHostMsg_DidCommitProvisionalLoad_Params;
+struct ViewHostMsg_FrameNavigate_Params;
 struct ViewMsg_PostMessage_Params;
 struct WebPreferences;
 
@@ -147,6 +147,10 @@ class CONTENT_EXPORT RenderViewHostDelegate {
   // RenderView is going to be destroyed
   virtual void RenderViewDeleted(RenderViewHost* render_view_host) {}
 
+  // The RenderView was navigated to a different page.
+  virtual void DidNavigate(RenderViewHost* render_view_host,
+                           const ViewHostMsg_FrameNavigate_Params& params) {}
+
   // The state for the page changed and should be updated.
   virtual void UpdateState(RenderViewHost* render_view_host,
                            int32 page_id,
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 863648a..8011841 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -43,7 +43,6 @@
 #include "content/common/content_switches_internal.h"
 #include "content/common/desktop_notification_messages.h"
 #include "content/common/drag_messages.h"
-#include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/inter_process_time_ticks_converter.h"
 #include "content/common/speech_recognition_messages.h"
@@ -1221,6 +1220,7 @@ bool RenderViewHostImpl::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunModal, OnRunModal)
     IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady)
     IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone)
+    IPC_MESSAGE_HANDLER_GENERIC(ViewHostMsg_FrameNavigate, OnNavigate(msg))
     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState)
     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle)
     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding)
@@ -1434,10 +1434,97 @@ void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame(
   NOTREACHED();
 }
 
+// Called when the renderer navigates.  For every frame loaded, we'll get this
+// notification containing parameters identifying the navigation.
+//
+// Subframes are identified by the page transition type.  For subframes loaded
+// as part of a wider page load, the page_id will be the same as for the top
+// level frame.  If the user explicitly requests a subframe navigation, we will
+// get a new page_id because we need to create a new navigation entry for that
+// action.
 void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) {
-  // TODO(nasko): Forward calls to the top level RenderFrameHost until all
-  // callers of this method on RenderViewHost are removed.
-  delegate_->GetFrameTree()->GetMainFrame()->OnMessageReceived(msg);
+  // Read the parameters out of the IPC message directly to avoid making another
+  // copy when we filter the URLs.
+  PickleIterator iter(msg);
+  ViewHostMsg_FrameNavigate_Params validated_params;
+  if (!IPC::ParamTraits<ViewHostMsg_FrameNavigate_Params>::
+      Read(&msg, &iter, &validated_params))
+    return;
+
+  // If we're waiting for a cross-site beforeunload ack from this renderer and
+  // we receive a Navigate message from the main frame, then the renderer was
+  // navigating already and sent it before hearing the ViewMsg_Stop message.
+  // We do not want to cancel the pending navigation in this case, since the
+  // old page will soon be stopped.  Instead, treat this as a beforeunload ack
+  // to allow the pending navigation to continue.
+  if (is_waiting_for_beforeunload_ack_ &&
+      unload_ack_is_for_cross_site_transition_ &&
+      PageTransitionIsMainFrame(validated_params.transition)) {
+    OnShouldCloseACK(true, send_should_close_start_time_,
+                        base::TimeTicks::Now());
+    return;
+  }
+
+  // If we're waiting for an unload ack from this renderer and we receive a
+  // Navigate message, then the renderer was navigating before it received the
+  // unload request.  It will either respond to the unload request soon or our
+  // timer will expire.  Either way, we should ignore this message, because we
+  // have already committed to closing this renderer.
+  if (is_waiting_for_unload_ack_)
+    return;
+
+  // Cache the main frame id, so we can use it for creating the frame tree
+  // root node when needed.
+  if (PageTransitionIsMainFrame(validated_params.transition)) {
+    if (main_frame_id_ == -1) {
+      main_frame_id_ = validated_params.frame_id;
+    } else {
+      // TODO(nasko): We plan to remove the usage of frame_id in navigation
+      // and move to routing ids. This is in place to ensure that a
+      // renderer is not misbehaving and sending us incorrect data.
+      DCHECK_EQ(main_frame_id_, validated_params.frame_id);
+    }
+  }
+  RenderProcessHost* process = GetProcess();
+
+  // Attempts to commit certain off-limits URL should be caught more strictly
+  // than our FilterURL checks below.  If a renderer violates this policy, it
+  // should be killed.
+  if (!CanCommitURL(validated_params.url)) {
+    VLOG(1) << "Blocked URL " << validated_params.url.spec();
+    validated_params.url = GURL(kAboutBlankURL);
+    RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
+    // Kills the process.
+    process->ReceivedBadMessage();
+  }
+
+  // Now that something has committed, we don't need to track whether the
+  // initial page has been accessed.
+  has_accessed_initial_document_ = false;
+
+  // Without this check, an evil renderer can trick the browser into creating
+  // a navigation entry for a banned URL.  If the user clicks the back button
+  // followed by the forward button (or clicks reload, or round-trips through
+  // session restore, etc), we'll think that the browser commanded the
+  // renderer to load the URL and grant the renderer the privileges to request
+  // the URL.  To prevent this attack, we block the renderer from inserting
+  // banned URLs into the navigation controller in the first place.
+  process->FilterURL(false, &validated_params.url);
+  process->FilterURL(true, &validated_params.referrer.url);
+  for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
+      it != validated_params.redirects.end(); ++it) {
+    process->FilterURL(false, &(*it));
+  }
+  process->FilterURL(true, &validated_params.searchable_form_url);
+
+  // Without this check, the renderer can trick the browser into using
+  // filenames it can't access in a future session restore.
+  if (!CanAccessFilesOfPageState(validated_params.page_state)) {
+    GetProcess()->ReceivedBadMessage();
+    return;
+  }
+
+  delegate_->DidNavigate(this, validated_params);
 }
 
 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) {
@@ -1878,6 +1965,15 @@ void RenderViewHostImpl::ToggleSpeechInput() {
   Send(new InputTagSpeechMsg_ToggleSpeechInput(GetRoutingID()));
 }
 
+bool RenderViewHostImpl::CanCommitURL(const GURL& url) {
+  // TODO(creis): We should also check for WebUI pages here.  Also, when the
+  // out-of-process iframes implementation is ready, we should check for
+  // cross-site URLs that are not allowed to commit in this process.
+
+  // Give the client a chance to disallow URLs from committing.
+  return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
+}
+
 void RenderViewHostImpl::ExitFullscreen() {
   RejectMouseLockOrUnlockIfNecessary();
   // Notify delegate_ and renderer of fullscreen state change.
diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
index de8e0d0..f185fad 100644
--- a/content/browser/renderer_host/render_view_host_impl.h
+++ b/content/browser/renderer_host/render_view_host_impl.h
@@ -418,9 +418,6 @@ class CONTENT_EXPORT RenderViewHostImpl
   int64 main_frame_id() const {
     return main_frame_id_;
   }
-  int main_frame_routing_id() const {
-    return main_frame_routing_id_;
-  }
 
   // Set the opener to null in the renderer process.
   void DisownOpener();
@@ -457,6 +454,11 @@ class CONTENT_EXPORT RenderViewHostImpl
     return is_waiting_for_unload_ack_;
   }
 
+  // Returns whether the given URL is allowed to commit in the current process.
+  // This is a more conservative check than RenderProcessHost::FilterURL, since
+  // it will be used to kill processes that commit unauthorized URLs.
+  bool CanCommitURL(const GURL& url);
+
   // Update the FrameTree to use this RenderViewHost's main frame
   // RenderFrameHost. Called when the RenderViewHost is committed.
   //
@@ -585,10 +587,6 @@ class CONTENT_EXPORT RenderViewHostImpl
 #endif
 
  private:
-  // TODO(nasko): Temporarily friend RenderFrameHostImpl, so we don't duplicate
-  // utility functions and state needed in both classes, while we move frame
-  // specific code away from this class.
-  friend class RenderFrameHostImpl;
   friend class TestRenderViewHost;
   FRIEND_TEST_ALL_PREFIXES(RenderViewHostTest, BasicRenderFrameHost);
   FRIEND_TEST_ALL_PREFIXES(RenderViewHostTest, RoutingIdSane);
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index a674788..840098e 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -2076,80 +2076,6 @@ void WebContentsImpl::DidRedirectProvisionalLoad(
                                       render_frame_host));
 }
 
-void WebContentsImpl::DidCommitProvisionalLoad(
-    int64 frame_id,
-    const base::string16& frame_unique_name,
-    bool is_main_frame,
-    const GURL& url,
-    PageTransition transition_type,
-    RenderFrameHostImpl* render_frame_host) {
-  // Notify observers about the commit of the provisional load.
-  FOR_EACH_OBSERVER(
-      WebContentsObserver,
-      observers_,
-      DidCommitProvisionalLoadForFrame(frame_id,
-                                       frame_unique_name,
-                                       is_main_frame,
-                                       url,
-                                       transition_type,
-                                       render_frame_host->render_view_host()));
-}
-
-void WebContentsImpl::DidNavigateMainFramePostCommit(
-    const LoadCommittedDetails& details,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
-  if (details.is_navigation_to_different_page()) {
-    // Clear the status bubble. This is a workaround for a bug where WebKit
-    // doesn't let us know that the cursor left an element during a
-    // transition (this is also why the mouse cursor remains as a hand after
-    // clicking on a link); see bugs 1184641 and 980803. We don't want to
-    // clear the bubble when a user navigates to a named anchor in the same
-    // page.
-    UpdateTargetURL(details.entry->GetPageID(), GURL());
-  }
-
-  if (!details.is_in_page) {
-    // Once the main frame is navigated, we're no longer considered to have
-    // displayed insecure content.
-    displayed_insecure_content_ = false;
-    SSLManager::NotifySSLInternalStateChanged(
-        GetController().GetBrowserContext());
-  }
-
-  // Notify observers about navigation.
-  FOR_EACH_OBSERVER(WebContentsObserver, observers_,
-                    DidNavigateMainFrame(details, params));
-
-  if (delegate_) {
-    delegate_->DidNavigateMainFramePostCommit(this);
-    view_->SetOverscrollControllerEnabled(delegate_->CanOverscrollContent());
-  }
-}
-
-void WebContentsImpl::DidNavigateAnyFramePostCommit(
-    RenderFrameHostImpl* render_frame_host,
-    const LoadCommittedDetails& details,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
-  // If we navigate off the page, close all JavaScript dialogs.
-  if (dialog_manager_ && !details.is_in_page)
-    dialog_manager_->CancelActiveAndPendingDialogs(this);
-
-  // Notify observers about navigation.
-  FOR_EACH_OBSERVER(WebContentsObserver, observers_,
-                    DidNavigateAnyFrame(details, params));
-}
-
-void WebContentsImpl::SetMainFrameMimeType(const std::string& mime_type) {
-  contents_mime_type_ = mime_type;
-}
-
-bool WebContentsImpl::CanOverscrollContent() {
-  if (delegate_)
-    return delegate_->CanOverscrollContent();
-
-  return false;
-}
-
 void WebContentsImpl::OnDidLoadResourceFromMemoryCache(
     const GURL& url,
     const std::string& security_info,
@@ -2594,6 +2520,56 @@ void WebContentsImpl::SetIsLoading(RenderViewHost* render_view_host,
       type, Source<NavigationController>(&controller_), det);
 }
 
+void WebContentsImpl::DidNavigateMainFramePostCommit(
+    const LoadCommittedDetails& details,
+    const ViewHostMsg_FrameNavigate_Params& params) {
+  if (details.is_navigation_to_different_page()) {
+    // Clear the status bubble. This is a workaround for a bug where WebKit
+    // doesn't let us know that the cursor left an element during a
+    // transition (this is also why the mouse cursor remains as a hand after
+    // clicking on a link); see bugs 1184641 and 980803. We don't want to
+    // clear the bubble when a user navigates to a named anchor in the same
+    // page.
+    UpdateTargetURL(details.entry->GetPageID(), GURL());
+  }
+
+  if (!details.is_in_page) {
+    // Once the main frame is navigated, we're no longer considered to have
+    // displayed insecure content.
+    displayed_insecure_content_ = false;
+    SSLManager::NotifySSLInternalStateChanged(
+        GetController().GetBrowserContext());
+  }
+
+  // Notify observers about navigation.
+  FOR_EACH_OBSERVER(WebContentsObserver, observers_,
+                    DidNavigateMainFrame(details, params));
+}
+
+void WebContentsImpl::DidNavigateAnyFramePostCommit(
+    RenderViewHost* render_view_host,
+    const LoadCommittedDetails& details,
+    const ViewHostMsg_FrameNavigate_Params& params) {
+  // If we navigate off the page, close all JavaScript dialogs.
+  if (dialog_manager_ && !details.is_in_page)
+    dialog_manager_->CancelActiveAndPendingDialogs(this);
+
+  // Notify observers about navigation.
+  FOR_EACH_OBSERVER(WebContentsObserver, observers_,
+                    DidNavigateAnyFrame(details, params));
+}
+
+bool WebContentsImpl::ShouldAssignSiteForURL(const GURL& url) {
+  // about:blank should not "use up" a new SiteInstance.  The SiteInstance can
+  // still be used for a normal web site.
+  if (url == GURL(kAboutBlankURL))
+    return false;
+
+  // The embedder will then have the opportunity to determine if the URL
+  // should "use up" the SiteInstance.
+  return GetContentClient()->browser()->ShouldAssignSiteForURL(url);
+}
+
 void WebContentsImpl::UpdateMaxPageIDIfNecessary(RenderViewHost* rvh) {
   // If we are creating a RVH for a restored controller, then we need to make
   // sure the RenderView starts with a next_page_id_ larger than the number
@@ -2851,6 +2827,149 @@ void WebContentsImpl::RenderViewDeleted(RenderViewHost* rvh) {
   FOR_EACH_OBSERVER(WebContentsObserver, observers_, RenderViewDeleted(rvh));
 }
 
+void WebContentsImpl::DidNavigate(
+    RenderViewHost* rvh,
+    const ViewHostMsg_FrameNavigate_Params& orig_params) {
+  ViewHostMsg_FrameNavigate_Params params(orig_params);
+  bool use_site_per_process =
+      CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess);
+  if (frame_tree_.IsFirstNavigationAfterSwap()) {
+    // First navigation should be a main frame navigation.
+    // TODO(creis): This DCHECK is currently disabled for --site-per-process
+    // because cross-process subframe navigations still have a main frame
+    // PageTransition.
+    if (!use_site_per_process)
+      DCHECK(PageTransitionIsMainFrame(params.transition));
+    frame_tree_.OnFirstNavigationAfterSwap(params.frame_id);
+  }
+
+  // When using --site-per-process, look up the FrameTreeNode ID that the
+  // renderer-specific frame ID corresponds to.
+  int64 frame_tree_node_id = frame_tree_.root()->frame_tree_node_id();
+  if (use_site_per_process) {
+    FrameTreeNode* source_node = frame_tree_.FindByFrameID(params.frame_id);
+    if (source_node)
+      frame_tree_node_id = source_node->frame_tree_node_id();
+
+    // TODO(creis): In the short term, cross-process subframe navigations are
+    // happening in the pending RenderViewHost's top-level frame.  (We need to
+    // both mirror the frame tree and get the navigation to occur in the correct
+    // subframe to fix this.)  Until then, we should check whether we have a
+    // pending NavigationEntry with a frame ID and if so, treat the
+    // cross-process "main frame" navigation as a subframe navigation.  This
+    // limits us to a single cross-process subframe per RVH, and it affects
+    // NavigateToEntry, NavigatorImpl::DidStartProvisionalLoad, and
+    // OnDidFinishLoad.
+    NavigationEntryImpl* pending_entry =
+        NavigationEntryImpl::FromNavigationEntry(controller_.GetPendingEntry());
+    int root_ftn_id = frame_tree_.root()->frame_tree_node_id();
+    if (pending_entry &&
+        pending_entry->frame_tree_node_id() != -1 &&
+        pending_entry->frame_tree_node_id() != root_ftn_id) {
+      params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
+      frame_tree_node_id = pending_entry->frame_tree_node_id();
+    }
+  }
+
+  if (PageTransitionIsMainFrame(params.transition)) {
+    // When overscroll navigation gesture is enabled, a screenshot of the page
+    // in its current state is taken so that it can be used during the
+    // nav-gesture. It is necessary to take the screenshot here, before calling
+    // RenderFrameHostManager::DidNavigateMainFrame, because that can change
+    // WebContents::GetRenderViewHost to return the new host, instead of the one
+    // that may have just been swapped out.
+    if (delegate_ && delegate_->CanOverscrollContent())
+      controller_.TakeScreenshot();
+
+    if (!use_site_per_process)
+      GetRenderManager()->DidNavigateMainFrame(rvh);
+  }
+
+  // When using --site-per-process, we notify the RFHM for all navigations,
+  // not just main frame navigations.
+  if (use_site_per_process) {
+    FrameTreeNode* frame = frame_tree_.FindByID(frame_tree_node_id);
+    // TODO(creis): Rename to DidNavigateFrame.
+    frame->render_manager()->DidNavigateMainFrame(rvh);
+  }
+
+  // Update the site of the SiteInstance if it doesn't have one yet, unless
+  // assigning a site is not necessary for this URL.  In that case, the
+  // SiteInstance can still be considered unused until a navigation to a real
+  // page.
+  if (!static_cast<SiteInstanceImpl*>(GetSiteInstance())->HasSite() &&
+      ShouldAssignSiteForURL(params.url)) {
+    static_cast<SiteInstanceImpl*>(GetSiteInstance())->SetSite(params.url);
+  }
+
+  // Need to update MIME type here because it's referred to in
+  // UpdateNavigationCommands() called by RendererDidNavigate() to
+  // determine whether or not to enable the encoding menu.
+  // It's updated only for the main frame. For a subframe,
+  // RenderView::UpdateURL does not set params.contents_mime_type.
+  // (see http://code.google.com/p/chromium/issues/detail?id=2929 )
+  // TODO(jungshik): Add a test for the encoding menu to avoid
+  // regressing it again.
+  if (PageTransitionIsMainFrame(params.transition))
+    contents_mime_type_ = params.contents_mime_type;
+
+  LoadCommittedDetails details;
+  bool did_navigate = controller_.RendererDidNavigate(rvh, params, &details);
+
+  // For now, keep track of each frame's URL in its FrameTreeNode.  This lets
+  // us estimate our process count for implementing OOP iframes.
+  // TODO(creis): Remove this when we track which pages commit in each frame.
+  frame_tree_.SetFrameUrl(params.frame_id, params.url);
+
+  // Send notification about committed provisional loads. This notification is
+  // different from the NAV_ENTRY_COMMITTED notification which doesn't include
+  // the actual URL navigated to and isn't sent for AUTO_SUBFRAME navigations.
+  if (details.type != NAVIGATION_TYPE_NAV_IGNORE) {
+    // For AUTO_SUBFRAME navigations, an event for the main frame is generated
+    // that is not recorded in the navigation history. For the purpose of
+    // tracking navigation events, we treat this event as a sub frame navigation
+    // event.
+    bool is_main_frame = did_navigate ? details.is_main_frame : false;
+    PageTransition transition_type = params.transition;
+    // Whether or not a page transition was triggered by going backward or
+    // forward in the history is only stored in the navigation controller's
+    // entry list.
+    if (did_navigate &&
+        (controller_.GetLastCommittedEntry()->GetTransitionType() &
+            PAGE_TRANSITION_FORWARD_BACK)) {
+      transition_type = PageTransitionFromInt(
+          params.transition | PAGE_TRANSITION_FORWARD_BACK);
+    }
+    // Notify observers about the commit of the provisional load.
+    FOR_EACH_OBSERVER(WebContentsObserver, observers_,
+                      DidCommitProvisionalLoadForFrame(
+                          params.frame_id,
+                          params.frame_unique_name,
+                          is_main_frame,
+                          params.url,
+                          transition_type,
+                          rvh));
+  }
+
+  if (!did_navigate)
+    return;  // No navigation happened.
+
+  // DO NOT ADD MORE STUFF TO THIS FUNCTION! Your component should either listen
+  // for the appropriate notification (best) or you can add it to
+  // DidNavigateMainFramePostCommit / DidNavigateAnyFramePostCommit (only if
+  // necessary, please).
+
+  // Run post-commit tasks.
+  if (details.is_main_frame) {
+    DidNavigateMainFramePostCommit(details, params);
+    if (delegate_) {
+      delegate_->DidNavigateMainFramePostCommit(this);
+      view_->SetOverscrollControllerEnabled(delegate_->CanOverscrollContent());
+    }
+  }
+  DidNavigateAnyFramePostCommit(rvh, details, params);
+}
+
 void WebContentsImpl::UpdateState(RenderViewHost* rvh,
                                   int32 page_id,
                                   const PageState& page_state) {
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index e540ff7..cbf3fa9 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -328,6 +328,9 @@ class CONTENT_EXPORT WebContentsImpl
                                     base::TerminationStatus status,
                                     int error_code) OVERRIDE;
   virtual void RenderViewDeleted(RenderViewHost* render_view_host) OVERRIDE;
+  virtual void DidNavigate(
+      RenderViewHost* render_view_host,
+      const ViewHostMsg_FrameNavigate_Params& params) OVERRIDE;
   virtual void UpdateState(RenderViewHost* render_view_host,
                            int32 page_id,
                            const PageState& page_state) OVERRIDE;
@@ -461,22 +464,6 @@ class CONTENT_EXPORT WebContentsImpl
   virtual void DidRedirectProvisionalLoad(
       RenderFrameHostImpl* render_frame_host,
       const GURL& validated_target_url) OVERRIDE;
-  virtual void DidCommitProvisionalLoad(
-      int64 frame_id,
-      const base::string16& frame_unique_name,
-      bool is_main_frame,
-      const GURL& url,
-      PageTransition transition_type,
-      RenderFrameHostImpl* render_frame_host) OVERRIDE;
-  virtual void DidNavigateMainFramePostCommit(
-      const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) OVERRIDE;
-  virtual void DidNavigateAnyFramePostCommit(
-      RenderFrameHostImpl* render_frame_host,
-      const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) OVERRIDE;
-  virtual void SetMainFrameMimeType(const std::string& mime_type) OVERRIDE;
-  virtual bool CanOverscrollContent() OVERRIDE;
   virtual void NotifyChangedNavigationState(
       InvalidateTypes changed_flags) OVERRIDE;
   virtual void AboutToNavigateRenderFrame(
@@ -759,6 +746,17 @@ class CONTENT_EXPORT WebContentsImpl
   // committed to the navigation controller. Note that the navigation entry is
   // not provided since it may be invalid/changed after being committed. The
   // current navigation entry is in the NavigationController at this point.
+  void DidNavigateMainFramePostCommit(
+      const LoadCommittedDetails& details,
+      const ViewHostMsg_FrameNavigate_Params& params);
+  void DidNavigateAnyFramePostCommit(
+      RenderViewHost* render_view_host,
+      const LoadCommittedDetails& details,
+      const ViewHostMsg_FrameNavigate_Params& params);
+
+  // Specifies whether the passed in URL should be assigned as the site of the
+  // current SiteInstance, if it does not yet have a site.
+  bool ShouldAssignSiteForURL(const GURL& url);
 
   // If our controller was restored, update the max page ID associated with the
   // given RenderViewHost to be larger than the number of restored entries.
diff --git a/content/browser/web_contents/web_contents_impl_unittest.cc b/content/browser/web_contents/web_contents_impl_unittest.cc
index aa5d9b6..bcea4c1 100644
--- a/content/browser/web_contents/web_contents_impl_unittest.cc
+++ b/content/browser/web_contents/web_contents_impl_unittest.cc
@@ -9,7 +9,6 @@
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/interstitial_page_delegate.h"
@@ -152,7 +151,7 @@ class TestInterstitialPage : public InterstitialPageImpl {
   }
 
   void TestDidNavigate(int page_id, const GURL& url) {
-    FrameHostMsg_DidCommitProvisionalLoad_Params params;
+    ViewHostMsg_FrameNavigate_Params params;
     InitNavigateParams(&params, page_id, url, PAGE_TRANSITION_TYPED);
     DidNavigate(GetRenderViewHostForTesting(), params);
   }
@@ -299,7 +298,7 @@ class TestWebContentsObserver : public WebContentsObserver {
 TEST_F(WebContentsImplTest, UpdateTitle) {
   NavigationControllerImpl& cont =
       static_cast<NavigationControllerImpl&>(controller());
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   InitNavigateParams(&params, 0, GURL(kAboutBlankURL), PAGE_TRANSITION_TYPED);
 
   LoadCommittedDetails details;
@@ -347,7 +346,7 @@ TEST_F(WebContentsImplTest, NTPViewSource) {
   EXPECT_TRUE(process()->sink().GetFirstMessageMatching(
       ViewMsg_EnableViewSourceMode::ID));
 
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
   InitNavigateParams(&params, 0, kGURL, PAGE_TRANSITION_TYPED);
   LoadCommittedDetails details;
   cont.RendererDidNavigate(test_rvh(), params, &details);
@@ -1094,7 +1093,7 @@ TEST_F(WebContentsImplTest, CrossSiteCantPreemptAfterUnload) {
   // flight.  We should ignore it, wait for the unload ack, and let the pending
   // request continue.  Otherwise, the contents may close spontaneously or stop
   // responding to navigation requests.  (See bug 23942.)
-  FrameHostMsg_DidCommitProvisionalLoad_Params params1a;
+  ViewHostMsg_FrameNavigate_Params params1a;
   InitNavigateParams(&params1a, 2, GURL("http://www.google.com/foo"),
                      PAGE_TRANSITION_TYPED);
   orig_rvh->SendNavigate(2, GURL("http://www.google.com/foo"));
diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index e4f3f96..9ebf35a 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h
@@ -8,11 +8,8 @@
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/frame_param.h"
-#include "content/common/navigation_gesture.h"
 #include "content/public/common/common_param_traits.h"
 #include "content/public/common/context_menu_params.h"
-#include "content/public/common/frame_navigate_params.h"
-#include "content/public/common/page_state.h"
 #include "ipc/ipc_message_macros.h"
 #include "url/gurl.h"
 
@@ -87,71 +84,6 @@ IPC_STRUCT_BEGIN(FrameHostMsg_DidFailProvisionalLoadWithError_Params)
   IPC_STRUCT_MEMBER(bool, showing_repost_interstitial)
 IPC_STRUCT_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
-  IPC_STRUCT_TRAITS_MEMBER(page_id)
-  IPC_STRUCT_TRAITS_MEMBER(url)
-  IPC_STRUCT_TRAITS_MEMBER(base_url)
-  IPC_STRUCT_TRAITS_MEMBER(referrer)
-  IPC_STRUCT_TRAITS_MEMBER(transition)
-  IPC_STRUCT_TRAITS_MEMBER(redirects)
-  IPC_STRUCT_TRAITS_MEMBER(should_update_history)
-  IPC_STRUCT_TRAITS_MEMBER(searchable_form_url)
-  IPC_STRUCT_TRAITS_MEMBER(searchable_form_encoding)
-  IPC_STRUCT_TRAITS_MEMBER(contents_mime_type)
-  IPC_STRUCT_TRAITS_MEMBER(socket_address)
-IPC_STRUCT_TRAITS_END()
-
-// Parameters structure for FrameHostMsg_DidCommitProvisionalLoad, which has
-// too many data parameters to be reasonably put in a predefined IPC message.
-IPC_STRUCT_BEGIN_WITH_PARENT(FrameHostMsg_DidCommitProvisionalLoad_Params,
-                             content::FrameNavigateParams)
-  IPC_STRUCT_TRAITS_PARENT(content::FrameNavigateParams)
-  // The frame ID for this navigation. The frame ID uniquely identifies the
-  // frame the navigation happened in for a given renderer.
-  IPC_STRUCT_MEMBER(int64, frame_id)
-
-  // The WebFrame's uniqueName().
-  IPC_STRUCT_MEMBER(base::string16, frame_unique_name)
-
-  // Information regarding the security of the connection (empty if the
-  // connection was not secure).
-  IPC_STRUCT_MEMBER(std::string, security_info)
-
-  // The gesture that initiated this navigation.
-  IPC_STRUCT_MEMBER(content::NavigationGesture, gesture)
-
-  // True if this was a post request.
-  IPC_STRUCT_MEMBER(bool, is_post)
-
-  // The POST body identifier. -1 if it doesn't exist.
-  IPC_STRUCT_MEMBER(int64, post_id)
-
-  // Whether the frame navigation resulted in no change to the documents within
-  // the page. For example, the navigation may have just resulted in scrolling
-  // to a named anchor.
-  IPC_STRUCT_MEMBER(bool, was_within_same_page)
-
-  // The status code of the HTTP request.
-  IPC_STRUCT_MEMBER(int, http_status_code)
-
-  // True if the connection was proxied.  In this case, socket_address
-  // will represent the address of the proxy, rather than the remote host.
-  IPC_STRUCT_MEMBER(bool, was_fetched_via_proxy)
-
-  // Serialized history item state to store in the navigation entry.
-  IPC_STRUCT_MEMBER(content::PageState, page_state)
-
-  // Original request's URL.
-  IPC_STRUCT_MEMBER(GURL, original_request_url)
-
-  // User agent override used to navigate.
-  IPC_STRUCT_MEMBER(bool, is_overriding_user_agent)
-
-  // Notifies the browser that for this navigation, the session history was
-  // successfully cleared.
-  IPC_STRUCT_MEMBER(bool, history_list_was_cleared)
-IPC_STRUCT_END()
-
 // -----------------------------------------------------------------------------
 // Messages sent from the browser to the renderer.
 
@@ -230,12 +162,6 @@ IPC_MESSAGE_ROUTED3(FrameHostMsg_DidRedirectProvisionalLoad,
                     GURL /* source_url*/,
                     GURL /* target_url */)
 
-// Notifies the browser that a frame in the view has changed. This message
-// has a lot of parameters and is packed/unpacked by functions defined in
-// render_messages.h.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_DidCommitProvisionalLoad,
-                    FrameHostMsg_DidCommitProvisionalLoad_Params)
-
 // Sent to the browser when the renderer detects it is blocked on a pepper
 // plugin message for too long. This is also sent when it becomes unhung
 // (according to the value of is_hung). The browser can give the user the
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index 588545b..20bec60 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -23,6 +23,7 @@
 #include "content/public/common/common_param_traits.h"
 #include "content/public/common/favicon_url.h"
 #include "content/public/common/file_chooser_params.h"
+#include "content/public/common/frame_navigate_params.h"
 #include "content/public/common/javascript_message_type.h"
 #include "content/public/common/menu_item.h"
 #include "content/public/common/page_state.h"
@@ -183,6 +184,20 @@ IPC_STRUCT_TRAITS_BEGIN(content::FileChooserParams)
 #endif
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
+  IPC_STRUCT_TRAITS_MEMBER(page_id)
+  IPC_STRUCT_TRAITS_MEMBER(url)
+  IPC_STRUCT_TRAITS_MEMBER(base_url)
+  IPC_STRUCT_TRAITS_MEMBER(referrer)
+  IPC_STRUCT_TRAITS_MEMBER(transition)
+  IPC_STRUCT_TRAITS_MEMBER(redirects)
+  IPC_STRUCT_TRAITS_MEMBER(should_update_history)
+  IPC_STRUCT_TRAITS_MEMBER(searchable_form_url)
+  IPC_STRUCT_TRAITS_MEMBER(searchable_form_encoding)
+  IPC_STRUCT_TRAITS_MEMBER(contents_mime_type)
+  IPC_STRUCT_TRAITS_MEMBER(socket_address)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::PepperRendererInstanceData)
   IPC_STRUCT_TRAITS_MEMBER(render_process_id)
   IPC_STRUCT_TRAITS_MEMBER(render_frame_id)
@@ -338,6 +353,57 @@ IPC_STRUCT_BEGIN(ViewHostMsg_DateTimeDialogValue_Params)
   IPC_STRUCT_MEMBER(std::vector<content::DateTimeSuggestion>, suggestions)
 IPC_STRUCT_END()
 
+// Parameters structure for ViewHostMsg_FrameNavigate, which has too many data
+// parameters to be reasonably put in a predefined IPC message.
+IPC_STRUCT_BEGIN_WITH_PARENT(ViewHostMsg_FrameNavigate_Params,
+                             content::FrameNavigateParams)
+  IPC_STRUCT_TRAITS_PARENT(content::FrameNavigateParams)
+  // The frame ID for this navigation. The frame ID uniquely identifies the
+  // frame the navigation happened in for a given renderer.
+  IPC_STRUCT_MEMBER(int64, frame_id)
+
+  // The WebFrame's uniqueName().
+  IPC_STRUCT_MEMBER(base::string16, frame_unique_name)
+
+  // Information regarding the security of the connection (empty if the
+  // connection was not secure).
+  IPC_STRUCT_MEMBER(std::string, security_info)
+
+  // The gesture that initiated this navigation.
+  IPC_STRUCT_MEMBER(content::NavigationGesture, gesture)
+
+  // True if this was a post request.
+  IPC_STRUCT_MEMBER(bool, is_post)
+
+  // The POST body identifier. -1 if it doesn't exist.
+  IPC_STRUCT_MEMBER(int64, post_id)
+
+  // Whether the frame navigation resulted in no change to the documents within
+  // the page. For example, the navigation may have just resulted in scrolling
+  // to a named anchor.
+  IPC_STRUCT_MEMBER(bool, was_within_same_page)
+
+  // The status code of the HTTP request.
+  IPC_STRUCT_MEMBER(int, http_status_code)
+
+  // True if the connection was proxied.  In this case, socket_address
+  // will represent the address of the proxy, rather than the remote host.
+  IPC_STRUCT_MEMBER(bool, was_fetched_via_proxy)
+
+  // Serialized history item state to store in the navigation entry.
+  IPC_STRUCT_MEMBER(content::PageState, page_state)
+
+  // Original request's URL.
+  IPC_STRUCT_MEMBER(GURL, original_request_url)
+
+  // User agent override used to navigate.
+  IPC_STRUCT_MEMBER(bool, is_overriding_user_agent)
+
+  // Notifies the browser that for this navigation, the session history was
+  // successfully cleared.
+  IPC_STRUCT_MEMBER(bool, history_list_was_cleared)
+IPC_STRUCT_END()
+
 IPC_STRUCT_BEGIN(ViewHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(GURL, url)
   IPC_STRUCT_MEMBER(content::Referrer, referrer)
@@ -482,7 +548,7 @@ IPC_STRUCT_BEGIN(ViewMsg_Navigate_Params)
   // The page_id for this navigation, or -1 if it is a new navigation.  Back,
   // Forward, and Reload navigations should have a valid page_id.  If the load
   // succeeds, then this page_id will be reflected in the resultant
-  // FrameHostMsg_DidCommitProvisionalLoad message.
+  // ViewHostMsg_FrameNavigate message.
   IPC_STRUCT_MEMBER(int32, page_id)
 
   // If page_id is -1, then pending_history_list_offset will also be -1.
@@ -1348,6 +1414,12 @@ IPC_MESSAGE_ROUTED0(ViewHostMsg_UpdateScreenRects_ACK)
 IPC_MESSAGE_ROUTED1(ViewHostMsg_RequestMove,
                     gfx::Rect /* position */)
 
+// Notifies the browser that a frame in the view has changed. This message
+// has a lot of parameters and is packed/unpacked by functions defined in
+// render_messages.h.
+IPC_MESSAGE_ROUTED1(ViewHostMsg_FrameNavigate,
+                    ViewHostMsg_FrameNavigate_Params)
+
 // Message to show a popup menu using native cocoa controls (Mac only).
 IPC_MESSAGE_ROUTED1(ViewHostMsg_ShowPopup,
                     ViewHostMsg_ShowPopup_Params)
diff --git a/content/content_browser.gypi b/content/content_browser.gypi
index b8a15fd..3e9e4c5 100644
--- a/content/content_browser.gypi
+++ b/content/content_browser.gypi
@@ -524,7 +524,6 @@
     'browser/frame_host/navigator.h',
     'browser/frame_host/navigator_impl.cc',
     'browser/frame_host/navigator_impl.h',
-    'browser/frame_host/navigator_delegate.cc',
     'browser/frame_host/navigator_delegate.h',
     'browser/frame_host/cross_process_frame_connector.cc',
     'browser/frame_host/cross_process_frame_connector.h',
diff --git a/content/public/browser/navigation_details.h b/content/public/browser/navigation_details.h
index 5103f64..5a01aec 100644
--- a/content/public/browser/navigation_details.h
+++ b/content/public/browser/navigation_details.h
@@ -51,8 +51,8 @@ struct CONTENT_EXPORT LoadCommittedDetails {
 
   // When the committed load is a web page from the renderer, this string
   // specifies the security state if the page is secure.
-  // See FrameHostMsg_DidCommitProvisionalLoad_Params.security_info, where it
-  // comes from. Use SSLManager::DeserializeSecurityInfo to decode it.
+  // See ViewHostMsg_FrameNavigate_Params.security_info, where it comes from.
+  // Use SSLManager::DeserializeSecurityInfo to decode it.
   std::string serialized_security_info;
 
   // Returns whether the main frame navigated to a different page (e.g., not
diff --git a/content/public/browser/web_contents_observer.h b/content/public/browser/web_contents_observer.h
index ae71eec..34cc96d 100644
--- a/content/public/browser/web_contents_observer.h
+++ b/content/public/browser/web_contents_observer.h
@@ -9,7 +9,6 @@
 #include "base/process/process_handle.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/navigation_controller.h"
-#include "content/public/common/frame_navigate_params.h"
 #include "content/public/common/page_transition_types.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
diff --git a/content/public/test/render_view_test.cc b/content/public/test/render_view_test.cc
index 7bc229e..5de488b 100644
--- a/content/public/test/render_view_test.cc
+++ b/content/public/test/render_view_test.cc
@@ -6,7 +6,6 @@
 
 #include "base/run_loop.h"
 #include "content/common/dom_storage/dom_storage_types.h"
-#include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/native_web_keyboard_event.h"
@@ -335,7 +334,7 @@ void RenderViewTest::Reload(const GURL& url) {
 }
 
 uint32 RenderViewTest::GetNavigationIPCType() {
-  return FrameHostMsg_DidCommitProvisionalLoad::ID;
+  return ViewHostMsg_FrameNavigate::ID;
 }
 
 void RenderViewTest::Resize(gfx::Size new_size,
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index aa46aea..a205148 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -11,7 +11,6 @@
 #include "base/debug/alias.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/i18n/char_iterator.h"
-#include "base/metrics/histogram.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "content/child/appcache/appcache_dispatcher.h"
@@ -31,7 +30,6 @@
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/renderer/context_menu_client.h"
 #include "content/public/renderer/document_state.h"
-#include "content/public/renderer/history_item_serialization.h"
 #include "content/public/renderer/navigation_state.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/renderer/accessibility/renderer_accessibility.h"
@@ -57,7 +55,6 @@
 #include "third_party/WebKit/public/platform/WebVector.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
-#include "third_party/WebKit/public/web/WebGlyphCache.h"
 #include "third_party/WebKit/public/web/WebNavigationPolicy.h"
 #include "third_party/WebKit/public/web/WebPlugin.h"
 #include "third_party/WebKit/public/web/WebPluginParams.h"
@@ -84,7 +81,6 @@ using blink::WebContextMenuData;
 using blink::WebDataSource;
 using blink::WebDocument;
 using blink::WebFrame;
-using blink::WebHistoryItem;
 using blink::WebNavigationPolicy;
 using blink::WebPluginParams;
 using blink::WebReferrerPolicy;
@@ -112,36 +108,6 @@ namespace {
 typedef std::map<blink::WebFrame*, RenderFrameImpl*> FrameMap;
 base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
 
-int64 ExtractPostId(const WebHistoryItem& item) {
-  if (item.isNull())
-    return -1;
-
-  if (item.httpBody().isNull())
-    return -1;
-
-  return item.httpBody().identifier();
-}
-
-WebURLResponseExtraDataImpl* GetExtraDataFromResponse(
-    const WebURLResponse& response) {
-  return static_cast<WebURLResponseExtraDataImpl*>(
-      response.extraData());
-}
-
-void GetRedirectChain(WebDataSource* ds, std::vector<GURL>* result) {
-  // Replace any occurrences of swappedout:// with about:blank.
-  const WebURL& blank_url = GURL(kAboutBlankURL);
-  WebVector<WebURL> urls;
-  ds->redirectChain(urls);
-  result->reserve(urls.size());
-  for (size_t i = 0; i < urls.size(); ++i) {
-    if (urls[i] != GURL(kSwappedOutURL))
-      result->push_back(urls[i]);
-    else
-      result->push_back(blank_url);
-  }
-}
-
 }  // namespace
 
 static RenderFrameImpl* (*g_create_render_frame_impl)(RenderViewImpl*, int32) =
@@ -978,7 +944,7 @@ void RenderFrameImpl::didReceiveServerRedirectForProvisionalLoad(
     return;
   }
   std::vector<GURL> redirects;
-  GetRedirectChain(data_source, &redirects);
+  RenderViewImpl::GetRedirectChain(data_source, &redirects);
   if (redirects.size() >= 2) {
     Send(new FrameHostMsg_DidRedirectProvisionalLoad(
         routing_id_,
@@ -1091,94 +1057,20 @@ void RenderFrameImpl::didFailProvisionalLoad(
 
 void RenderFrameImpl::didCommitProvisionalLoad(blink::WebFrame* frame,
                                                bool is_new_navigation) {
-  DocumentState* document_state =
-      DocumentState::FromDataSource(frame->dataSource());
-  NavigationState* navigation_state = document_state->navigation_state();
-  InternalDocumentStateData* internal_data =
-      InternalDocumentStateData::FromDocumentState(document_state);
-
-  if (document_state->commit_load_time().is_null())
-    document_state->set_commit_load_time(Time::Now());
-
-  if (internal_data->must_reset_scroll_and_scale_state()) {
-    render_view_->webview()->resetScrollAndScaleState();
-    internal_data->set_must_reset_scroll_and_scale_state(false);
-  }
-  internal_data->set_use_error_page(false);
-
-  if (is_new_navigation) {
-    // When we perform a new navigation, we need to update the last committed
-    // session history entry with state for the page we are leaving.
-    render_view_->UpdateSessionHistory(frame);
-
-    // We bump our Page ID to correspond with the new session history entry.
-    render_view_->page_id_ = render_view_->next_page_id_++;
-
-    // Don't update history_page_ids_ (etc) for kSwappedOutURL, since
-    // we don't want to forget the entry that was there, and since we will
-    // never come back to kSwappedOutURL.  Note that we have to call
-    // UpdateSessionHistory and update page_id_ even in this case, so that
-    // the current entry gets a state update and so that we don't send a
-    // state update to the wrong entry when we swap back in.
-    if (render_view_->GetLoadingUrl(frame) != GURL(kSwappedOutURL)) {
-      // Advance our offset in session history, applying the length limit.
-      // There is now no forward history.
-      render_view_->history_list_offset_++;
-      if (render_view_->history_list_offset_ >= kMaxSessionHistoryEntries)
-        render_view_->history_list_offset_ = kMaxSessionHistoryEntries - 1;
-      render_view_->history_list_length_ =
-          render_view_->history_list_offset_ + 1;
-      render_view_->history_page_ids_.resize(
-          render_view_->history_list_length_, -1);
-      render_view_->history_page_ids_[render_view_->history_list_offset_] =
-          render_view_->page_id_;
-    }
-  } else {
-    // Inspect the navigation_state on this frame to see if the navigation
-    // corresponds to a session history navigation...  Note: |frame| may or
-    // may not be the toplevel frame, but for the case of capturing session
-    // history, the first committed frame suffices.  We keep track of whether
-    // we've seen this commit before so that only capture session history once
-    // per navigation.
-    //
-    // Note that we need to check if the page ID changed. In the case of a
-    // reload, the page ID doesn't change, and UpdateSessionHistory gets the
-    // previous URL and the current page ID, which would be wrong.
-    if (navigation_state->pending_page_id() != -1 &&
-        navigation_state->pending_page_id() != render_view_->page_id_ &&
-        !navigation_state->request_committed()) {
-      // This is a successful session history navigation!
-      render_view_->UpdateSessionHistory(frame);
-      render_view_->page_id_ = navigation_state->pending_page_id();
-
-      render_view_->history_list_offset_ =
-          navigation_state->pending_history_list_offset();
-
-      // If the history list is valid, our list of page IDs should be correct.
-      DCHECK(render_view_->history_list_length_ <= 0 ||
-             render_view_->history_list_offset_ < 0 ||
-             render_view_->history_list_offset_ >=
-                 render_view_->history_list_length_ ||
-             render_view_->history_page_ids_[render_view_->history_list_offset_]
-                  == render_view_->page_id_);
-    }
-  }
-
+  // TODO(nasko): Move implementation here. Needed state:
+  // * page_id_
+  // * next_page_id_
+  // * history_list_offset_
+  // * history_list_length_
+  // * history_page_ids_
+  // Needed methods
+  // * webview
+  // * UpdateSessionHistory
+  // * GetLoadingUrl
   render_view_->didCommitProvisionalLoad(frame, is_new_navigation);
+
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
                     DidCommitProvisionalLoad(is_new_navigation));
-
-  // Remember that we've already processed this request, so we don't update
-  // the session history again.  We do this regardless of whether this is
-  // a session history navigation, because if we attempted a session history
-  // navigation without valid HistoryItem state, WebCore will think it is a
-  // new navigation.
-  navigation_state->set_request_committed(true);
-
-  UpdateURL(frame);
-
-  // Check whether we have new encoding name.
-  render_view_->UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
 }
 
 void RenderFrameImpl::didClearWindowObject(blink::WebFrame* frame,
@@ -1248,21 +1140,9 @@ void RenderFrameImpl::didFinishLoad(blink::WebFrame* frame) {
 
 void RenderFrameImpl::didNavigateWithinPage(blink::WebFrame* frame,
                                             bool is_new_navigation) {
-  // If this was a reference fragment navigation that we initiated, then we
-  // could end up having a non-null pending navigation params.  We just need to
-  // update the ExtraData on the datasource so that others who read the
-  // ExtraData will get the new NavigationState.  Similarly, if we did not
-  // initiate this navigation, then we need to take care to reset any pre-
-  // existing navigation state to a content-initiated navigation state.
-  // DidCreateDataSource conveniently takes care of this for us.
-  didCreateDataSource(frame, frame->dataSource());
-
-  DocumentState* document_state =
-      DocumentState::FromDataSource(frame->dataSource());
-  NavigationState* new_state = document_state->navigation_state();
-  new_state->set_was_within_same_page(true);
-
-  didCommitProvisionalLoad(frame, is_new_navigation);
+  // TODO(nasko): Move implementation here. No state needed, just observers
+  // notification before sending message to the browser process.
+  render_view_->didNavigateWithinPage(frame, is_new_navigation);
 }
 
 void RenderFrameImpl::didUpdateCurrentHistoryItem(blink::WebFrame* frame) {
@@ -1439,7 +1319,8 @@ void RenderFrameImpl::didReceiveResponse(
   int http_status_code = response.httpStatusCode();
 
   // Record page load flags.
-  WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
+  WebURLResponseExtraDataImpl* extra_data =
+      RenderViewImpl::GetExtraDataFromResponse(response);
   if (extra_data) {
     document_state->set_was_fetched_via_spdy(
         extra_data->was_fetched_via_spdy());
@@ -1750,177 +1631,4 @@ void RenderFrameImpl::OnStop() {
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnStop());
 }
 
-// Tell the embedding application that the URL of the active page has changed.
-void RenderFrameImpl::UpdateURL(WebFrame* frame) {
-  WebDataSource* ds = frame->dataSource();
-  DCHECK(ds);
-
-  const WebURLRequest& request = ds->request();
-  const WebURLRequest& original_request = ds->originalRequest();
-  const WebURLResponse& response = ds->response();
-
-  DocumentState* document_state = DocumentState::FromDataSource(ds);
-  NavigationState* navigation_state = document_state->navigation_state();
-  InternalDocumentStateData* internal_data =
-      InternalDocumentStateData::FromDocumentState(document_state);
-
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
-  params.http_status_code = response.httpStatusCode();
-  params.is_post = false;
-  params.post_id = -1;
-  params.page_id = render_view_->page_id_;
-  params.frame_id = frame->identifier();
-  params.frame_unique_name = frame->uniqueName();
-  params.socket_address.set_host(response.remoteIPAddress().utf8());
-  params.socket_address.set_port(response.remotePort());
-  WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
-  if (extra_data)
-    params.was_fetched_via_proxy = extra_data->was_fetched_via_proxy();
-  params.was_within_same_page = navigation_state->was_within_same_page();
-  params.security_info = response.securityInfo();
-
-  // Set the URL to be displayed in the browser UI to the user.
-  params.url = render_view_->GetLoadingUrl(frame);
-  DCHECK(!is_swapped_out_ || params.url == GURL(kSwappedOutURL));
-
-  if (frame->document().baseURL() != params.url)
-    params.base_url = frame->document().baseURL();
-
-  GetRedirectChain(ds, &params.redirects);
-  params.should_update_history = !ds->hasUnreachableURL() &&
-      !response.isMultipartPayload() && (response.httpStatusCode() != 404);
-
-  params.searchable_form_url = internal_data->searchable_form_url();
-  params.searchable_form_encoding = internal_data->searchable_form_encoding();
-
-  params.gesture = render_view_->navigation_gesture_;
-  render_view_->navigation_gesture_ = NavigationGestureUnknown;
-
-  // Make navigation state a part of the DidCommitProvisionalLoad message so
-  // that commited entry has it at all times.
-  WebHistoryItem item = frame->currentHistoryItem();
-  if (item.isNull()) {
-    item.initialize();
-    item.setURLString(request.url().spec().utf16());
-  }
-  params.page_state = HistoryItemToPageState(item);
-
-  if (!frame->parent()) {
-    // Top-level navigation.
-
-    // Reset the zoom limits in case a plugin had changed them previously. This
-    // will also call us back which will cause us to send a message to
-    // update WebContentsImpl.
-    render_view_->webview()->zoomLimitsChanged(
-        ZoomFactorToZoomLevel(kMinimumZoomFactor),
-        ZoomFactorToZoomLevel(kMaximumZoomFactor));
-
-    // Set zoom level, but don't do it for full-page plugin since they don't use
-    // the same zoom settings.
-    HostZoomLevels::iterator host_zoom =
-        render_view_->host_zoom_levels_.find(GURL(request.url()));
-    if (render_view_->webview()->mainFrame()->document().isPluginDocument()) {
-      // Reset the zoom levels for plugins.
-      render_view_->webview()->setZoomLevel(0);
-    } else {
-      if (host_zoom != render_view_->host_zoom_levels_.end())
-        render_view_->webview()->setZoomLevel(host_zoom->second);
-    }
-
-    if (host_zoom != render_view_->host_zoom_levels_.end()) {
-      // This zoom level was merely recorded transiently for this load.  We can
-      // erase it now.  If at some point we reload this page, the browser will
-      // send us a new, up-to-date zoom level.
-      render_view_->host_zoom_levels_.erase(host_zoom);
-    }
-
-    // Update contents MIME type for main frame.
-    params.contents_mime_type = ds->response().mimeType().utf8();
-
-    params.transition = navigation_state->transition_type();
-    if (!PageTransitionIsMainFrame(params.transition)) {
-      // If the main frame does a load, it should not be reported as a subframe
-      // navigation.  This can occur in the following case:
-      // 1. You're on a site with frames.
-      // 2. You do a subframe navigation.  This is stored with transition type
-      //    MANUAL_SUBFRAME.
-      // 3. You navigate to some non-frame site, say, google.com.
-      // 4. You navigate back to the page from step 2.  Since it was initially
-      //    MANUAL_SUBFRAME, it will be that same transition type here.
-      // We don't want that, because any navigation that changes the toplevel
-      // frame should be tracked as a toplevel navigation (this allows us to
-      // update the URL bar, etc).
-      params.transition = PAGE_TRANSITION_LINK;
-    }
-
-    // If the page contained a client redirect (meta refresh, document.loc...),
-    // set the referrer and transition appropriately.
-    if (ds->isClientRedirect()) {
-      params.referrer =
-          Referrer(params.redirects[0], ds->request().referrerPolicy());
-      params.transition = static_cast<PageTransition>(
-          params.transition | PAGE_TRANSITION_CLIENT_REDIRECT);
-    } else {
-      params.referrer = RenderViewImpl::GetReferrerFromRequest(
-          frame, ds->request());
-    }
-
-    base::string16 method = request.httpMethod();
-    if (EqualsASCII(method, "POST")) {
-      params.is_post = true;
-      params.post_id = ExtractPostId(item);
-    }
-
-    // Send the user agent override back.
-    params.is_overriding_user_agent = internal_data->is_overriding_user_agent();
-
-    // Track the URL of the original request.  We use the first entry of the
-    // redirect chain if it exists because the chain may have started in another
-    // process.
-    if (params.redirects.size() > 0)
-      params.original_request_url = params.redirects.at(0);
-    else
-      params.original_request_url = original_request.url();
-
-    params.history_list_was_cleared =
-        navigation_state->history_list_was_cleared();
-
-    // Save some histogram data so we can compute the average memory used per
-    // page load of the glyphs.
-    UMA_HISTOGRAM_COUNTS_10000("Memory.GlyphPagesPerLoad",
-                               blink::WebGlyphCache::pageCount());
-
-    // This message needs to be sent before any of allowScripts(),
-    // allowImages(), allowPlugins() is called for the new page, so that when
-    // these functions send a ViewHostMsg_ContentBlocked message, it arrives
-    // after the FrameHostMsg_DidCommitProvisionalLoad message.
-    Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
-  } else {
-    // Subframe navigation: the type depends on whether this navigation
-    // generated a new session history entry. When they do generate a session
-    // history entry, it means the user initiated the navigation and we should
-    // mark it as such. This test checks if this is the first time UpdateURL
-    // has been called since WillNavigateToURL was called to initiate the load.
-    if (render_view_->page_id_ > render_view_->last_page_id_sent_to_browser_)
-      params.transition = PAGE_TRANSITION_MANUAL_SUBFRAME;
-    else
-      params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
-
-    DCHECK(!navigation_state->history_list_was_cleared());
-    params.history_list_was_cleared = false;
-
-    // Don't send this message while the subframe is swapped out.
-    if (!is_swapped_out())
-      Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
-  }
-
-  render_view_->last_page_id_sent_to_browser_ =
-      std::max(render_view_->last_page_id_sent_to_browser_,
-               render_view_->page_id_);
-
-  // If we end up reusing this WebRequest (for example, due to a #ref click),
-  // we don't want the transition type to persist.  Just clear it.
-  navigation_state->set_transition_type(PAGE_TRANSITION_LINK);
-}
-
 }  // namespace content
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 9192c23..5633aa4 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -329,14 +329,10 @@ class CONTENT_EXPORT RenderFrameImpl
   FRIEND_TEST_ALL_PREFIXES(RenderFrameImplTest,
                            ShouldUpdateSelectionTextFromContextMenuParams);
 
-  typedef std::map<GURL, double> HostZoomLevels;
-
   // Functions to add and remove observers for this object.
   void AddObserver(RenderFrameObserver* observer);
   void RemoveObserver(RenderFrameObserver* observer);
 
-  void UpdateURL(blink::WebFrame* frame);
-
   // IPC message handlers ------------------------------------------------------
   //
   // The documentation for these functions should be in
diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
index a562d37..924cb7e 100644
--- a/content/renderer/render_view_browsertest.cc
+++ b/content/renderer/render_view_browsertest.cc
@@ -460,12 +460,11 @@ TEST_F(RenderViewImplTest, OnNavigationHttpPost) {
 
   const IPC::Message* frame_navigate_msg =
       render_thread_->sink().GetUniqueMessageMatching(
-          FrameHostMsg_DidCommitProvisionalLoad::ID);
+          ViewHostMsg_FrameNavigate::ID);
   EXPECT_TRUE(frame_navigate_msg);
 
-  FrameHostMsg_DidCommitProvisionalLoad::Param host_nav_params;
-  FrameHostMsg_DidCommitProvisionalLoad::Read(frame_navigate_msg,
-                                              &host_nav_params);
+  ViewHostMsg_FrameNavigate::Param host_nav_params;
+  ViewHostMsg_FrameNavigate::Read(frame_navigate_msg, &host_nav_params);
   EXPECT_TRUE(host_nav_params.a.is_post);
 
   // Check post data sent to browser matches
@@ -719,13 +718,12 @@ TEST_F(RenderViewImplTest, ReloadWhileSwappedOut) {
   // Verify page A committed, not swappedout://.
   const IPC::Message* frame_navigate_msg =
       render_thread_->sink().GetUniqueMessageMatching(
-          FrameHostMsg_DidCommitProvisionalLoad::ID);
+          ViewHostMsg_FrameNavigate::ID);
   EXPECT_TRUE(frame_navigate_msg);
 
   // Read URL out of the parent trait of the params object.
-  FrameHostMsg_DidCommitProvisionalLoad::Param commit_params;
-  FrameHostMsg_DidCommitProvisionalLoad::Read(frame_navigate_msg,
-                                              &commit_params);
+  ViewHostMsg_FrameNavigate::Param commit_params;
+  ViewHostMsg_FrameNavigate::Read(frame_navigate_msg, &commit_params);
   EXPECT_NE(GURL("swappedout://"), commit_params.a.url);
 }
 
@@ -1724,7 +1722,7 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // No history to merge and a committed page to be kept.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
   view()->OnSetHistoryLengthAndPrune(0, expected_page_id);
   EXPECT_EQ(1, view()->history_list_length_);
@@ -1733,7 +1731,7 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // No history to merge and a committed page to be pruned.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
   view()->OnSetHistoryLengthAndPrune(0, expected_page_id + 1);
   EXPECT_EQ(0, view()->history_list_length_);
@@ -1741,7 +1739,7 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // No history to merge and a committed page that the browser was unaware of.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
   view()->OnSetHistoryLengthAndPrune(0, -1);
   EXPECT_EQ(1, view()->history_list_length_);
@@ -1750,7 +1748,7 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // History to merge and a committed page to be kept.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
   view()->OnSetHistoryLengthAndPrune(2, expected_page_id);
   EXPECT_EQ(3, view()->history_list_length_);
@@ -1761,7 +1759,7 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // History to merge and a committed page to be pruned.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
   view()->OnSetHistoryLengthAndPrune(2, expected_page_id + 1);
   EXPECT_EQ(2, view()->history_list_length_);
@@ -1771,7 +1769,7 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // History to merge and a committed page that the browser was unaware of.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
   view()->OnSetHistoryLengthAndPrune(2, -1);
   EXPECT_EQ(3, view()->history_list_length_);
@@ -1784,9 +1782,9 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   int expected_page_id_2 = -1;
 
   // No history to merge and two committed pages, both to be kept.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id_2 = view()->page_id_;
   EXPECT_GT(expected_page_id_2, expected_page_id);
   view()->OnSetHistoryLengthAndPrune(0, expected_page_id);
@@ -1797,9 +1795,9 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // No history to merge and two committed pages, and only the second is kept.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id_2 = view()->page_id_;
   EXPECT_GT(expected_page_id_2, expected_page_id);
   view()->OnSetHistoryLengthAndPrune(0, expected_page_id_2);
@@ -1810,9 +1808,9 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
 
   // No history to merge and two committed pages, both of which the browser was
   // unaware of.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id_2 = view()->page_id_;
   EXPECT_GT(expected_page_id_2, expected_page_id);
   view()->OnSetHistoryLengthAndPrune(0, -1);
@@ -1823,9 +1821,9 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // History to merge and two committed pages, both to be kept.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id_2 = view()->page_id_;
   EXPECT_GT(expected_page_id_2, expected_page_id);
   view()->OnSetHistoryLengthAndPrune(2, expected_page_id);
@@ -1838,9 +1836,9 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
   ClearHistory();
 
   // History to merge and two committed pages, and only the second is kept.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id_2 = view()->page_id_;
   EXPECT_GT(expected_page_id_2, expected_page_id);
   view()->OnSetHistoryLengthAndPrune(2, expected_page_id_2);
@@ -1853,9 +1851,9 @@ TEST_F(RenderViewImplTest, SetHistoryLengthAndPrune) {
 
   // History to merge and two committed pages, both of which the browser was
   // unaware of.
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id = view()->page_id_;
-  frame()->didCommitProvisionalLoad(GetMainFrame(), true);
+  view()->didCommitProvisionalLoad(GetMainFrame(), true);
   expected_page_id_2 = view()->page_id_;
   EXPECT_GT(expected_page_id_2, expected_page_id);
   view()->OnSetHistoryLengthAndPrune(2, -1);
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 0832fad..4d27120 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -373,6 +373,22 @@ static bool IsReload(const ViewMsg_Navigate_Params& params) {
 }
 
 // static
+void RenderViewImpl::GetRedirectChain(WebDataSource* ds,
+                                      std::vector<GURL>* result) {
+  // Replace any occurrences of swappedout:// with about:blank.
+  const WebURL& blank_url = GURL(kAboutBlankURL);
+  WebVector<WebURL> urls;
+  ds->redirectChain(urls);
+  result->reserve(urls.size());
+  for (size_t i = 0; i < urls.size(); ++i) {
+    if (urls[i] != GURL(kSwappedOutURL))
+      result->push_back(urls[i]);
+    else
+      result->push_back(blank_url);
+  }
+}
+
+// static
 Referrer RenderViewImpl::GetReferrerFromRequest(
     WebFrame* frame,
     const WebURLRequest& request) {
@@ -380,6 +396,13 @@ Referrer RenderViewImpl::GetReferrerFromRequest(
                   request.referrerPolicy());
 }
 
+// static
+WebURLResponseExtraDataImpl* RenderViewImpl::GetExtraDataFromResponse(
+    const WebURLResponse& response) {
+  return static_cast<WebURLResponseExtraDataImpl*>(
+      response.extraData());
+}
+
 NOINLINE static void CrashIntentionally() {
   // NOTE(shess): Crash directly rather than using NOTREACHED() so
   // that the signature is easier to triage in crash reports.
@@ -676,6 +699,16 @@ class WebWidgetLockTarget : public MouseLockDispatcher::LockTarget {
   blink::WebWidget* webwidget_;
 };
 
+int64 ExtractPostId(const WebHistoryItem& item) {
+  if (item.isNull())
+    return -1;
+
+  if (item.httpBody().isNull())
+    return -1;
+
+  return item.httpBody().identifier();
+}
+
 bool TouchEnabled() {
 // Based on the definition of chrome::kEnableTouchIcon.
 #if defined(OS_ANDROID)
@@ -1811,6 +1844,179 @@ void RenderViewImpl::OnPauseVideo() {
 
 ///////////////////////////////////////////////////////////////////////////////
 
+// Tell the embedding application that the URL of the active page has changed
+void RenderViewImpl::UpdateURL(WebFrame* frame) {
+  WebDataSource* ds = frame->dataSource();
+  DCHECK(ds);
+
+  const WebURLRequest& request = ds->request();
+  const WebURLRequest& original_request = ds->originalRequest();
+  const WebURLResponse& response = ds->response();
+
+  DocumentState* document_state = DocumentState::FromDataSource(ds);
+  NavigationState* navigation_state = document_state->navigation_state();
+  InternalDocumentStateData* internal_data =
+      InternalDocumentStateData::FromDocumentState(document_state);
+
+  ViewHostMsg_FrameNavigate_Params params;
+  params.http_status_code = response.httpStatusCode();
+  params.is_post = false;
+  params.post_id = -1;
+  params.page_id = page_id_;
+  params.frame_id = frame->identifier();
+  params.frame_unique_name = frame->uniqueName();
+  params.socket_address.set_host(response.remoteIPAddress().utf8());
+  params.socket_address.set_port(response.remotePort());
+  WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
+  if (extra_data) {
+    params.was_fetched_via_proxy = extra_data->was_fetched_via_proxy();
+  }
+  params.was_within_same_page = navigation_state->was_within_same_page();
+  params.security_info = response.securityInfo();
+
+  // Set the URL to be displayed in the browser UI to the user.
+  params.url = GetLoadingUrl(frame);
+  DCHECK(!is_swapped_out_ || params.url == GURL(kSwappedOutURL));
+
+  if (frame->document().baseURL() != params.url)
+    params.base_url = frame->document().baseURL();
+
+  GetRedirectChain(ds, &params.redirects);
+  params.should_update_history = !ds->hasUnreachableURL() &&
+      !response.isMultipartPayload() && (response.httpStatusCode() != 404);
+
+  params.searchable_form_url = internal_data->searchable_form_url();
+  params.searchable_form_encoding = internal_data->searchable_form_encoding();
+
+  params.gesture = navigation_gesture_;
+  navigation_gesture_ = NavigationGestureUnknown;
+
+  // Make navigation state a part of the FrameNavigate message so that commited
+  // entry had it at all times.
+  WebHistoryItem item = frame->currentHistoryItem();
+  if (item.isNull()) {
+    item.initialize();
+    item.setURLString(request.url().spec().utf16());
+  }
+  params.page_state = HistoryItemToPageState(item);
+
+  if (!frame->parent()) {
+    // Top-level navigation.
+
+    // Reset the zoom limits in case a plugin had changed them previously. This
+    // will also call us back which will cause us to send a message to
+    // update WebContentsImpl.
+    webview()->zoomLimitsChanged(ZoomFactorToZoomLevel(kMinimumZoomFactor),
+                                 ZoomFactorToZoomLevel(kMaximumZoomFactor));
+
+    // Set zoom level, but don't do it for full-page plugin since they don't use
+    // the same zoom settings.
+    HostZoomLevels::iterator host_zoom =
+        host_zoom_levels_.find(GURL(request.url()));
+    if (webview()->mainFrame()->document().isPluginDocument()) {
+      // Reset the zoom levels for plugins.
+      webview()->setZoomLevel(0);
+    } else {
+      if (host_zoom != host_zoom_levels_.end())
+        webview()->setZoomLevel(host_zoom->second);
+    }
+
+    if (host_zoom != host_zoom_levels_.end()) {
+      // This zoom level was merely recorded transiently for this load.  We can
+      // erase it now.  If at some point we reload this page, the browser will
+      // send us a new, up-to-date zoom level.
+      host_zoom_levels_.erase(host_zoom);
+    }
+
+    // Update contents MIME type for main frame.
+    params.contents_mime_type = ds->response().mimeType().utf8();
+
+    params.transition = navigation_state->transition_type();
+    if (!PageTransitionIsMainFrame(params.transition)) {
+      // If the main frame does a load, it should not be reported as a subframe
+      // navigation.  This can occur in the following case:
+      // 1. You're on a site with frames.
+      // 2. You do a subframe navigation.  This is stored with transition type
+      //    MANUAL_SUBFRAME.
+      // 3. You navigate to some non-frame site, say, google.com.
+      // 4. You navigate back to the page from step 2.  Since it was initially
+      //    MANUAL_SUBFRAME, it will be that same transition type here.
+      // We don't want that, because any navigation that changes the toplevel
+      // frame should be tracked as a toplevel navigation (this allows us to
+      // update the URL bar, etc).
+      params.transition = PAGE_TRANSITION_LINK;
+    }
+
+    // If the page contained a client redirect (meta refresh, document.loc...),
+    // set the referrer and transition appropriately.
+    if (ds->isClientRedirect()) {
+      params.referrer =
+          Referrer(params.redirects[0], ds->request().referrerPolicy());
+      params.transition = static_cast<PageTransition>(
+          params.transition | PAGE_TRANSITION_CLIENT_REDIRECT);
+    } else {
+      params.referrer = GetReferrerFromRequest(frame, ds->request());
+    }
+
+    base::string16 method = request.httpMethod();
+    if (EqualsASCII(method, "POST")) {
+      params.is_post = true;
+      params.post_id = ExtractPostId(item);
+    }
+
+    // Send the user agent override back.
+    params.is_overriding_user_agent = internal_data->is_overriding_user_agent();
+
+    // Track the URL of the original request.  We use the first entry of the
+    // redirect chain if it exists because the chain may have started in another
+    // process.
+    if (params.redirects.size() > 0)
+      params.original_request_url = params.redirects.at(0);
+    else
+      params.original_request_url = original_request.url();
+
+    params.history_list_was_cleared =
+        navigation_state->history_list_was_cleared();
+
+    // Save some histogram data so we can compute the average memory used per
+    // page load of the glyphs.
+    UMA_HISTOGRAM_COUNTS_10000("Memory.GlyphPagesPerLoad",
+                               blink::WebGlyphCache::pageCount());
+
+    // This message needs to be sent before any of allowScripts(),
+    // allowImages(), allowPlugins() is called for the new page, so that when
+    // these functions send a ViewHostMsg_ContentBlocked message, it arrives
+    // after the ViewHostMsg_FrameNavigate message.
+    Send(new ViewHostMsg_FrameNavigate(routing_id_, params));
+  } else {
+    // Subframe navigation: the type depends on whether this navigation
+    // generated a new session history entry. When they do generate a session
+    // history entry, it means the user initiated the navigation and we should
+    // mark it as such. This test checks if this is the first time UpdateURL
+    // has been called since WillNavigateToURL was called to initiate the load.
+    if (page_id_ > last_page_id_sent_to_browser_)
+      params.transition = PAGE_TRANSITION_MANUAL_SUBFRAME;
+    else
+      params.transition = PAGE_TRANSITION_AUTO_SUBFRAME;
+
+    DCHECK(!navigation_state->history_list_was_cleared());
+    params.history_list_was_cleared = false;
+
+    // Don't send this message while the subframe is swapped out.
+    // TODO(creis): This whole method should move to RenderFrame.
+    RenderFrameImpl* rf = RenderFrameImpl::FromWebFrame(frame);
+    if (!rf || !rf->is_swapped_out())
+      Send(new ViewHostMsg_FrameNavigate(routing_id_, params));
+  }
+
+  last_page_id_sent_to_browser_ =
+      std::max(last_page_id_sent_to_browser_, page_id_);
+
+  // If we end up reusing this WebRequest (for example, due to a #ref click),
+  // we don't want the transition type to persist.  Just clear it.
+  navigation_state->set_transition_type(PAGE_TRANSITION_LINK);
+}
+
 // Tell the embedding application that the title of the active page has changed
 void RenderViewImpl::UpdateTitle(WebFrame* frame,
                                  const base::string16& title,
@@ -3269,11 +3475,88 @@ void RenderViewImpl::didFailProvisionalLoad(WebFrame* frame,
 
 void RenderViewImpl::didCommitProvisionalLoad(WebFrame* frame,
                                               bool is_new_navigation) {
+  DocumentState* document_state =
+      DocumentState::FromDataSource(frame->dataSource());
+  NavigationState* navigation_state = document_state->navigation_state();
+  InternalDocumentStateData* internal_data =
+      InternalDocumentStateData::FromDocumentState(document_state);
+
+  if (document_state->commit_load_time().is_null())
+    document_state->set_commit_load_time(Time::Now());
+
+  if (internal_data->must_reset_scroll_and_scale_state()) {
+    webview()->resetScrollAndScaleState();
+    internal_data->set_must_reset_scroll_and_scale_state(false);
+  }
+  internal_data->set_use_error_page(false);
+
+  if (is_new_navigation) {
+    // When we perform a new navigation, we need to update the last committed
+    // session history entry with state for the page we are leaving.
+    UpdateSessionHistory(frame);
+
+    // We bump our Page ID to correspond with the new session history entry.
+    page_id_ = next_page_id_++;
+
+    // Don't update history_page_ids_ (etc) for kSwappedOutURL, since
+    // we don't want to forget the entry that was there, and since we will
+    // never come back to kSwappedOutURL.  Note that we have to call
+    // UpdateSessionHistory and update page_id_ even in this case, so that
+    // the current entry gets a state update and so that we don't send a
+    // state update to the wrong entry when we swap back in.
+    if (GetLoadingUrl(frame) != GURL(kSwappedOutURL)) {
+      // Advance our offset in session history, applying the length limit.
+      // There is now no forward history.
+      history_list_offset_++;
+      if (history_list_offset_ >= kMaxSessionHistoryEntries)
+        history_list_offset_ = kMaxSessionHistoryEntries - 1;
+      history_list_length_ = history_list_offset_ + 1;
+      history_page_ids_.resize(history_list_length_, -1);
+      history_page_ids_[history_list_offset_] = page_id_;
+    }
+  } else {
+    // Inspect the navigation_state on this frame to see if the navigation
+    // corresponds to a session history navigation...  Note: |frame| may or
+    // may not be the toplevel frame, but for the case of capturing session
+    // history, the first committed frame suffices.  We keep track of whether
+    // we've seen this commit before so that only capture session history once
+    // per navigation.
+    //
+    // Note that we need to check if the page ID changed. In the case of a
+    // reload, the page ID doesn't change, and UpdateSessionHistory gets the
+    // previous URL and the current page ID, which would be wrong.
+    if (navigation_state->pending_page_id() != -1 &&
+        navigation_state->pending_page_id() != page_id_ &&
+        !navigation_state->request_committed()) {
+      // This is a successful session history navigation!
+      UpdateSessionHistory(frame);
+      page_id_ = navigation_state->pending_page_id();
+
+      history_list_offset_ = navigation_state->pending_history_list_offset();
+
+      // If the history list is valid, our list of page IDs should be correct.
+      DCHECK(history_list_length_ <= 0 ||
+             history_list_offset_ < 0 ||
+             history_list_offset_ >= history_list_length_ ||
+             history_page_ids_[history_list_offset_] == page_id_);
+    }
+  }
+
   FOR_EACH_OBSERVER(RenderViewObserver, observers_,
                     DidCommitProvisionalLoad(frame, is_new_navigation));
 
-  // TODO(nasko): Transition this code to RenderFrameImpl, since g_view_map is
-  // not accessible from there.
+  // Remember that we've already processed this request, so we don't update
+  // the session history again.  We do this regardless of whether this is
+  // a session history navigation, because if we attempted a session history
+  // navigation without valid HistoryItem state, WebCore will think it is a
+  // new navigation.
+  navigation_state->set_request_committed(true);
+
+  UpdateURL(frame);
+
+  // Check whether we have new encoding name.
+  UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
+
   if (!frame->parent()) {  // Only for top frames.
     RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
     if (render_thread_impl) {  // Can be NULL in tests.
@@ -3408,11 +3691,22 @@ void RenderViewImpl::didFinishLoad(WebFrame* frame) {
 }
 
 void RenderViewImpl::didNavigateWithinPage(
-    WebFrame* frame,
-    bool is_new_navigation) {
-  // TODO(nasko): Forward calls to the main RenderFrameImpl until all
-  // callers of this method on RenderView are removed.
-  main_render_frame_->didNavigateWithinPage(frame, is_new_navigation);
+    WebFrame* frame, bool is_new_navigation) {
+  // If this was a reference fragment navigation that we initiated, then we
+  // could end up having a non-null pending navigation params.  We just need to
+  // update the ExtraData on the datasource so that others who read the
+  // ExtraData will get the new NavigationState.  Similarly, if we did not
+  // initiate this navigation, then we need to take care to reset any pre-
+  // existing navigation state to a content-initiated navigation state.
+  // DidCreateDataSource conveniently takes care of this for us.
+  didCreateDataSource(frame, frame->dataSource());
+
+  DocumentState* document_state =
+      DocumentState::FromDataSource(frame->dataSource());
+  NavigationState* new_state = document_state->navigation_state();
+  new_state->set_was_within_same_page(true);
+
+  didCommitProvisionalLoad(frame, is_new_navigation);
 }
 
 void RenderViewImpl::didUpdateCurrentHistoryItem(WebFrame* frame) {
diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
index a3eb957..97d4c13 100644
--- a/content/renderer/render_view_impl.h
+++ b/content/renderer/render_view_impl.h
@@ -807,6 +807,9 @@ class CONTENT_EXPORT RenderViewImpl
     CONNECTION_ERROR,
   };
 
+  static void GetRedirectChain(blink::WebDataSource* ds,
+                               std::vector<GURL>* result);
+
   static blink::WebReferrerPolicy GetReferrerPolicyFromRequest(
       blink::WebFrame* frame,
       const blink::WebURLRequest& request);
@@ -815,6 +818,10 @@ class CONTENT_EXPORT RenderViewImpl
       blink::WebFrame* frame,
       const blink::WebURLRequest& request);
 
+  static webkit_glue::WebURLResponseExtraDataImpl* GetExtraDataFromResponse(
+      const blink::WebURLResponse& response);
+
+  void UpdateURL(blink::WebFrame* frame);
   void UpdateTitle(blink::WebFrame* frame, const base::string16& title,
                    blink::WebTextDirection title_direction);
   void UpdateSessionHistory(blink::WebFrame* frame);
diff --git a/content/test/test_render_frame_host.cc b/content/test/test_render_frame_host.cc
index ec6a349..e9a3bc8 100644
--- a/content/test/test_render_frame_host.cc
+++ b/content/test/test_render_frame_host.cc
@@ -5,15 +5,8 @@
 #include "content/test/test_render_frame_host.h"
 
 #include "content/browser/frame_host/frame_tree.h"
-#include "content/common/frame_messages.h"
 #include "content/test/test_render_view_host.h"
 
-namespace {
-
-const int64 kFrameId = 13UL;
-
-}  // namespace
-
 namespace content {
 
 TestRenderFrameHost::TestRenderFrameHost(RenderViewHostImpl* render_view_host,
@@ -27,9 +20,7 @@ TestRenderFrameHost::TestRenderFrameHost(RenderViewHostImpl* render_view_host,
                           frame_tree,
                           frame_tree_node,
                           routing_id,
-                          is_swapped_out),
-      contents_mime_type_("text/html"),
-      simulate_history_list_was_cleared_(false) {
+                          is_swapped_out) {
   // Allow TestRenderViewHosts to easily access their main frame RFH.
   if (frame_tree_node == frame_tree->root()) {
     static_cast<TestRenderViewHost*>(render_view_host)->
@@ -39,94 +30,4 @@ TestRenderFrameHost::TestRenderFrameHost(RenderViewHostImpl* render_view_host,
 
 TestRenderFrameHost::~TestRenderFrameHost() {}
 
-void TestRenderFrameHost::SendNavigate(int page_id, const GURL& url) {
-  SendNavigateWithTransition(page_id, url, PAGE_TRANSITION_LINK);
-}
-
-void TestRenderFrameHost::SendNavigateWithTransition(
-    int page_id,
-    const GURL& url,
-    PageTransition transition) {
-  SendNavigateWithTransitionAndResponseCode(page_id, url, transition, 200);
-}
-
-void TestRenderFrameHost::SendFailedNavigate(int page_id, const GURL& url) {
-  SendNavigateWithTransitionAndResponseCode(
-      page_id, url, PAGE_TRANSITION_LINK, 500);
-}
-
-void TestRenderFrameHost::SendNavigateWithTransitionAndResponseCode(
-    int page_id,
-    const GURL& url, PageTransition transition,
-    int response_code) {
-  // DidStartProvisionalLoad may delete the pending entry that holds |url|,
-  // so we keep a copy of it to use in SendNavigateWithParameters.
-  GURL url_copy(url);
-  OnDidStartProvisionalLoadForFrame(kFrameId, -1, true, url_copy);
-  SendNavigateWithParameters(
-      page_id, url_copy, transition, url_copy, response_code, 0);
-}
-
-void TestRenderFrameHost::SendNavigateWithOriginalRequestURL(
-    int page_id,
-    const GURL& url,
-    const GURL& original_request_url) {
-  OnDidStartProvisionalLoadForFrame(kFrameId, -1, true, url);
-  SendNavigateWithParameters(
-      page_id, url, PAGE_TRANSITION_LINK, original_request_url, 200, 0);
-}
-
-void TestRenderFrameHost::SendNavigateWithFile(
-    int page_id,
-    const GURL& url,
-    const base::FilePath& file_path) {
-  SendNavigateWithParameters(
-      page_id, url, PAGE_TRANSITION_LINK, url, 200, &file_path);
-}
-
-void TestRenderFrameHost::SendNavigateWithParams(
-    FrameHostMsg_DidCommitProvisionalLoad_Params* params) {
-  params->frame_id = kFrameId;
-  FrameHostMsg_DidCommitProvisionalLoad msg(1, *params);
-  OnNavigate(msg);
-}
-
-void TestRenderFrameHost::SendNavigateWithParameters(
-    int page_id,
-    const GURL& url,
-    PageTransition transition,
-    const GURL& original_request_url,
-    int response_code,
-    const base::FilePath* file_path_for_history_item) {
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
-  params.page_id = page_id;
-  params.frame_id = kFrameId;
-  params.url = url;
-  params.referrer = Referrer();
-  params.transition = transition;
-  params.redirects = std::vector<GURL>();
-  params.should_update_history = true;
-  params.searchable_form_url = GURL();
-  params.searchable_form_encoding = std::string();
-  params.security_info = std::string();
-  params.gesture = NavigationGestureUser;
-  params.contents_mime_type = contents_mime_type_;
-  params.is_post = false;
-  params.was_within_same_page = false;
-  params.http_status_code = response_code;
-  params.socket_address.set_host("2001:db8::1");
-  params.socket_address.set_port(80);
-  params.history_list_was_cleared = simulate_history_list_was_cleared_;
-  params.original_request_url = original_request_url;
-
-  params.page_state = PageState::CreateForTesting(
-      url,
-      false,
-      file_path_for_history_item ? "data" : NULL,
-      file_path_for_history_item);
-
-  FrameHostMsg_DidCommitProvisionalLoad msg(1, params);
-  OnNavigate(msg);
-}
-
 }  // namespace content
diff --git a/content/test/test_render_frame_host.h b/content/test/test_render_frame_host.h
index 25caa87..7668b25 100644
--- a/content/test/test_render_frame_host.h
+++ b/content/test/test_render_frame_host.h
@@ -7,9 +7,6 @@
 
 #include "base/basictypes.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/public/common/page_transition_types.h"
-
-struct FrameHostMsg_DidCommitProvisionalLoad_Params;
 
 namespace content {
 
@@ -23,55 +20,10 @@ class TestRenderFrameHost : public RenderFrameHostImpl {
                       bool is_swapped_out);
   virtual ~TestRenderFrameHost();
 
-  void SendNavigate(int page_id, const GURL& url);
-  void SendNavigateWithTransition(
-      int page_id,
-      const GURL& url,
-      PageTransition transition);
-  void SendFailedNavigate(int page_id, const GURL& url);
-  void SendNavigateWithTransitionAndResponseCode(
-      int page_id,
-      const GURL& url, PageTransition transition,
-      int response_code);
-  void SendNavigateWithOriginalRequestURL(
-      int page_id,
-      const GURL& url,
-      const GURL& original_request_url);
-  void SendNavigateWithFile(
-      int page_id,
-      const GURL& url,
-      const base::FilePath& file_path);
-  void SendNavigateWithParams(
-      FrameHostMsg_DidCommitProvisionalLoad_Params* params);
-  void SendNavigateWithParameters(
-      int page_id,
-      const GURL& url,
-      PageTransition transition,
-      const GURL& original_request_url,
-      int response_code,
-      const base::FilePath* file_path_for_history_item);
-
-  void set_contents_mime_type(const std::string& mime_type) {
-    contents_mime_type_ = mime_type;
-  }
-
-  // If set, navigations will appear to have cleared the history list in the
-  // RenderFrame
-  // (FrameHostMsg_DidCommitProvisionalLoad_Params::history_list_was_cleared).
-  // False by default.
-  void set_simulate_history_list_was_cleared(bool cleared) {
-    simulate_history_list_was_cleared_ = cleared;
-  }
-
   // TODO(nick): As necessary for testing, override behavior of RenderFrameHost
   // here.
 
  private:
-  std::string contents_mime_type_;
-
-  // See set_simulate_history_list_was_cleared() above.
-  bool simulate_history_list_was_cleared_;
-
   DISALLOW_COPY_AND_ASSIGN(TestRenderFrameHost);
 };
 
diff --git a/content/test/test_render_view_host.cc b/content/test/test_render_view_host.cc
index 38facdb..1945e9f 100644
--- a/content/test/test_render_view_host.cc
+++ b/content/test/test_render_view_host.cc
@@ -9,7 +9,6 @@
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/common/dom_storage/dom_storage_types.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/navigation_controller.h"
@@ -31,7 +30,7 @@ const int64 kFrameId = 13UL;
 }  // namespace
 
 
-void InitNavigateParams(FrameHostMsg_DidCommitProvisionalLoad_Params* params,
+void InitNavigateParams(ViewHostMsg_FrameNavigate_Params* params,
                         int page_id,
                         const GURL& url,
                         PageTransition transition) {
@@ -275,60 +274,86 @@ bool TestRenderViewHost::IsRenderViewLive() const {
 }
 
 void TestRenderViewHost::SendNavigate(int page_id, const GURL& url) {
-  main_render_frame_host_->SendNavigate(page_id, url);
+  SendNavigateWithTransition(page_id, url, PAGE_TRANSITION_LINK);
 }
 
 void TestRenderViewHost::SendFailedNavigate(int page_id, const GURL& url) {
-  main_render_frame_host_->SendFailedNavigate(page_id, url);
+  SendNavigateWithTransitionAndResponseCode(
+      page_id, url, PAGE_TRANSITION_LINK, 500);
 }
 
 void TestRenderViewHost::SendNavigateWithTransition(
-    int page_id,
-    const GURL& url,
-    PageTransition transition) {
-  main_render_frame_host_->SendNavigateWithTransition(page_id, url, transition);
+    int page_id, const GURL& url, PageTransition transition) {
+  SendNavigateWithTransitionAndResponseCode(page_id, url, transition, 200);
 }
 
 void TestRenderViewHost::SendNavigateWithOriginalRequestURL(
-    int page_id,
-    const GURL& url,
-    const GURL& original_request_url) {
-  main_render_frame_host_->SendNavigateWithOriginalRequestURL(
-      page_id, url, original_request_url);
+    int page_id, const GURL& url, const GURL& original_request_url) {
+  main_render_frame_host()->OnDidStartProvisionalLoadForFrame(
+      kFrameId, -1, true, url);
+  SendNavigateWithParameters(page_id, url, PAGE_TRANSITION_LINK,
+                             original_request_url, 200, 0);
 }
 
 void TestRenderViewHost::SendNavigateWithFile(
-    int page_id,
-    const GURL& url,
-    const base::FilePath& file_path) {
-  main_render_frame_host_->SendNavigateWithFile(page_id, url, file_path);
+    int page_id, const GURL& url, const base::FilePath& file_path) {
+  SendNavigateWithParameters(page_id, url, PAGE_TRANSITION_LINK,
+                             url, 200, &file_path);
 }
 
 void TestRenderViewHost::SendNavigateWithParams(
-    FrameHostMsg_DidCommitProvisionalLoad_Params* params) {
-  main_render_frame_host_->SendNavigateWithParams(params);
+    ViewHostMsg_FrameNavigate_Params* params) {
+  params->frame_id = kFrameId;
+  ViewHostMsg_FrameNavigate msg(1, *params);
+  OnNavigate(msg);
 }
 
 void TestRenderViewHost::SendNavigateWithTransitionAndResponseCode(
-    int page_id,
-    const GURL& url,
-    PageTransition transition,
+    int page_id, const GURL& url, PageTransition transition,
     int response_code) {
-  main_render_frame_host_->SendNavigateWithTransitionAndResponseCode(
-      page_id, url, transition, response_code);
+  // DidStartProvisionalLoad may delete the pending entry that holds |url|,
+  // so we keep a copy of it to use in SendNavigateWithParameters.
+  GURL url_copy(url);
+  main_render_frame_host()->OnDidStartProvisionalLoadForFrame(
+      kFrameId, -1, true, url_copy);
+  SendNavigateWithParameters(page_id, url_copy, transition, url_copy,
+                             response_code, 0);
 }
 
 void TestRenderViewHost::SendNavigateWithParameters(
-    int page_id,
-    const GURL& url,
-    PageTransition transition,
-    const GURL& original_request_url,
-    int response_code,
+    int page_id, const GURL& url, PageTransition transition,
+    const GURL& original_request_url, int response_code,
     const base::FilePath* file_path_for_history_item) {
-
-  main_render_frame_host_->SendNavigateWithParameters(
-      page_id, url, transition, original_request_url, response_code,
+  ViewHostMsg_FrameNavigate_Params params;
+  params.page_id = page_id;
+  params.frame_id = kFrameId;
+  params.url = url;
+  params.referrer = Referrer();
+  params.transition = transition;
+  params.redirects = std::vector<GURL>();
+  params.should_update_history = true;
+  params.searchable_form_url = GURL();
+  params.searchable_form_encoding = std::string();
+  params.security_info = std::string();
+  params.gesture = NavigationGestureUser;
+  params.contents_mime_type = contents_mime_type_;
+  params.is_post = false;
+  params.was_within_same_page = false;
+  params.http_status_code = response_code;
+  params.socket_address.set_host("2001:db8::1");
+  params.socket_address.set_port(80);
+  params.was_fetched_via_proxy = simulate_fetch_via_proxy_;
+  params.history_list_was_cleared = simulate_history_list_was_cleared_;
+  params.original_request_url = original_request_url;
+
+  params.page_state = PageState::CreateForTesting(
+      url,
+      false,
+      file_path_for_history_item ? "data" : NULL,
       file_path_for_history_item);
+
+  ViewHostMsg_FrameNavigate msg(1, params);
+  OnNavigate(msg);
 }
 
 void TestRenderViewHost::SendShouldCloseACK(bool proceed) {
@@ -338,7 +363,6 @@ void TestRenderViewHost::SendShouldCloseACK(bool proceed) {
 
 void TestRenderViewHost::SetContentsMimeType(const std::string& mime_type) {
   contents_mime_type_ = mime_type;
-  main_render_frame_host_->set_contents_mime_type(mime_type);
 }
 
 void TestRenderViewHost::SimulateSwapOutACK() {
@@ -377,7 +401,6 @@ void TestRenderViewHost::set_simulate_fetch_via_proxy(bool proxy) {
 
 void TestRenderViewHost::set_simulate_history_list_was_cleared(bool cleared) {
   simulate_history_list_was_cleared_ = cleared;
-  main_render_frame_host_->set_simulate_history_list_was_cleared(cleared);
 }
 
 RenderViewHostImplTestHarness::RenderViewHostImplTestHarness() {
diff --git a/content/test/test_render_view_host.h b/content/test/test_render_view_host.h
index cf963e4..9eecd7c2 100644
--- a/content/test/test_render_view_host.h
+++ b/content/test/test_render_view_host.h
@@ -26,7 +26,7 @@
 //
 // To use, derive your test base class from RenderViewHostImplTestHarness.
 
-struct FrameHostMsg_DidCommitProvisionalLoad_Params;
+struct ViewHostMsg_FrameNavigate_Params;
 
 namespace gfx {
 class Rect;
@@ -40,7 +40,7 @@ class TestWebContents;
 
 // Utility function to initialize ViewHostMsg_NavigateParams_Params
 // with given |page_id|, |url| and |transition_type|.
-void InitNavigateParams(FrameHostMsg_DidCommitProvisionalLoad_Params* params,
+void InitNavigateParams(ViewHostMsg_FrameNavigate_Params* params,
                         int page_id,
                         const GURL& url,
                         PageTransition transition_type);
@@ -236,19 +236,16 @@ class TestRenderViewHost
   // RenderViewHostTester implementation.  Note that CreateRenderView
   // is not specified since it is synonymous with the one from
   // RenderViewHostImpl, see below.
+  virtual void SendNavigate(int page_id, const GURL& url) OVERRIDE;
+  virtual void SendFailedNavigate(int page_id, const GURL& url) OVERRIDE;
+  virtual void SendNavigateWithTransition(int page_id, const GURL& url,
+                                          PageTransition transition) OVERRIDE;
   virtual void SendShouldCloseACK(bool proceed) OVERRIDE;
   virtual void SetContentsMimeType(const std::string& mime_type) OVERRIDE;
   virtual void SimulateSwapOutACK() OVERRIDE;
   virtual void SimulateWasHidden() OVERRIDE;
   virtual void SimulateWasShown() OVERRIDE;
 
-  // NOTE: These methods are deprecated and the equivalents in
-  // TestRenderFrameHost should be used.
-  virtual void SendNavigate(int page_id, const GURL& url) OVERRIDE;
-  virtual void SendFailedNavigate(int page_id, const GURL& url) OVERRIDE;
-  virtual void SendNavigateWithTransition(int page_id, const GURL& url,
-                                          PageTransition transition) OVERRIDE;
-
   // Calls OnNavigate on the RenderViewHost with the given information,
   // including a custom original request URL.  Sets the rest of the
   // parameters in the message to the "typical" values.  This is a helper
@@ -259,8 +256,7 @@ class TestRenderViewHost
   void SendNavigateWithFile(
       int page_id, const GURL& url, const base::FilePath& file_path);
 
-  void SendNavigateWithParams(
-      FrameHostMsg_DidCommitProvisionalLoad_Params* params);
+  void SendNavigateWithParams(ViewHostMsg_FrameNavigate_Params* params);
 
   void TestOnUpdateStateWithFile(
       int process_id, const base::FilePath& file_path);
@@ -303,8 +299,7 @@ class TestRenderViewHost
   void set_simulate_fetch_via_proxy(bool proxy);
 
   // If set, navigations will appear to have cleared the history list in the
-  // RenderView
-  // (FrameHostMsg_DidCommitProvisionalLoad_Params::history_list_was_cleared).
+  // RenderView (ViewHostMsg_FrameNavigate_Params::history_list_was_cleared).
   // False by default.
   void set_simulate_history_list_was_cleared(bool cleared);
 
diff --git a/content/test/test_web_contents.cc b/content/test/test_web_contents.cc
index 50f9bb5..d645b31 100644
--- a/content/test/test_web_contents.cc
+++ b/content/test/test_web_contents.cc
@@ -9,10 +9,8 @@
 #include "content/browser/browser_url_handler_impl.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigator.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
-#include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_source.h"
@@ -70,7 +68,7 @@ void TestWebContents::TestDidNavigateWithReferrer(
     const GURL& url,
     const Referrer& referrer,
     PageTransition transition) {
-  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  ViewHostMsg_FrameNavigate_Params params;
 
   params.page_id = page_id;
   params.url = url;
@@ -86,10 +84,7 @@ void TestWebContents::TestDidNavigateWithReferrer(
   params.is_post = false;
   params.page_state = PageState::CreateFromURL(url);
 
-  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(render_view_host);
-  RenderFrameHostImpl* rfh = RenderFrameHostImpl::FromID(
-      rvh->GetProcess()->GetID(), rvh->main_frame_routing_id());
-  frame_tree_.root()->navigator()->DidNavigate(rfh, params);
+  DidNavigate(render_view_host, params);
 }
 
 WebPreferences TestWebContents::TestGetWebkitPrefs() {