From agl. Cleaned up version of issue 19046.

POSIX: bitmap data on the wire

On Windows, when drawing a given rect in the renderer, we allocate memory for the bitmap, render and send a shared memory handle across IPC. In the browser, we bitblit the shared memory to the backing store and draw it to the screen.

In the long term, on Linux, we want the backingstore to be shared with both X and the renderer. The renderer then draws directly to that store, sends an IPC to the browser and the browser sends a message to X to bitblit to the display. Since only cache a few backing stores we'll need messages from the browser to tell the renderer to attach and detatch from shared memory regions as they get created and evicted.

In the short term, however, to get something that works, we make a BitmapWireData typedef. This will be a shared memory region on Windows, as before, and on POSIX we'll be sending the bitmap data over the wire. Obviously this'll be pretty slow but it'll work sooner.
Review URL: http://codereview.chromium.org/19491

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@9065 0039d316-1c4b-4281-b951-d872f2087c98

14 files changed, 227 insertions, 73 deletions

diff --git a/chrome/browser/browser.scons b/chrome/browser/browser.scons
index 14b33e9..9d5cc5c 100644
--- a/chrome/browser/browser.scons
+++ b/chrome/browser/browser.scons
@@ -37,6 +37,7 @@ if env.Bit('windows'):
       ],
   )
 
+# input_files initialized to common files + Windows specific ones.
 input_files = ChromeFileList([
   # TODO(sgk):  violate standard indentation so we don't have to
   # reindent too much when we remove the explicit MSVSFilter() calls
@@ -514,6 +515,9 @@ input_files = ChromeFileList([
   MSVSFilter('Renderer Host', [
     'renderer_host/async_resource_handler.cc',
     'renderer_host/async_resource_handler.h',
+    'renderer_host/backing_store.h',
+    'renderer_host/backing_store.cc',
+    'renderer_host/backing_store_win.cc',
     'renderer_host/browser_render_process_host.cc',
     'renderer_host/browser_render_process_host.h',
     'renderer_host/buffered_resource_handler.cc',
@@ -656,11 +660,6 @@ input_files = ChromeFileList([
     'toolbar_model.h',
 ])
 
-if env.Bit('mac'):
-  input_files.Remove(
-      'spellchecker.cc',
-  )
-
 if not env.Bit('windows'):
   # TODO: Port these.
   input_files.Remove(
@@ -760,7 +759,6 @@ if not env.Bit('windows'):
       'printing/win_printing_context.cc',
       'renderer_host/render_view_host.cc',
       'renderer_host/render_widget_helper.cc',
-      'renderer_host/render_widget_host.cc',
       'renderer_host/cross_site_resource_handler.cc',
       'renderer_host/resource_dispatcher_host.cc',
       'repost_form_warning_dialog.cc',
@@ -808,6 +806,7 @@ if not env.Bit('windows'):
       'window_sizer.cc',
   )
 
+  # Remove Windows-specific files on other platforms.
   input_files.Remove(
       'browser_main_win.cc',
       'history/history_publisher_win.cc',
@@ -815,6 +814,7 @@ if not env.Bit('windows'):
       'js_before_unload_handler_win.cc',
       'jsmessage_box_handler_win.cc',
       'password_manager/password_form_manager_win.cc',
+      'renderer_host/backing_store_win.cc',
       'renderer_host/render_widget_host_view_win.cc',
       'tab_contents/web_contents_view_win.cc',
       'webdata/web_data_service_win.cc',
@@ -823,11 +823,22 @@ if not env.Bit('windows'):
       '../tools/build/win/precompiled_wtl.h',
   )
 
+  # Add files shared across non-Windows platforms.
+  input_files.Append(
+      'renderer_host/backing_store_posix.cc',
+  )
+
+
 if env.Bit('linux'):
   input_files.Extend([
       'browser_main_gtk.cc',
   ])
 
+if env.Bit('mac'):
+  input_files.Remove(
+      'spellchecker.cc',
+  )
+
 if env.Bit('windows'):
   env.TypeLibrary('history/history_indexer.idl')
 
diff --git a/chrome/browser/renderer_host/backing_store.cc b/chrome/browser/renderer_host/backing_store.cc
index 9cff6aa7..da988768 100644
--- a/chrome/browser/renderer_host/backing_store.cc
+++ b/chrome/browser/renderer_host/backing_store.cc
@@ -60,7 +60,7 @@ BackingStore* BackingStoreManager::PrepareBackingStore(
     RenderWidgetHost* host,
     const gfx::Rect& backing_store_rect,
     base::ProcessHandle process_handle,
-    HANDLE bitmap_section,
+    BitmapWireData bitmap_section,
     const gfx::Rect& bitmap_rect,
     bool* needs_full_paint) {
   BackingStore* backing_store = GetBackingStore(host,
diff --git a/chrome/browser/renderer_host/backing_store.h b/chrome/browser/renderer_host/backing_store.h
index eddb4c4..ce15c88 100644
--- a/chrome/browser/renderer_host/backing_store.h
+++ b/chrome/browser/renderer_host/backing_store.h
@@ -10,10 +10,13 @@
 #include "base/gfx/size.h"
 #include "base/process.h"
 #include "build/build_config.h"
+#include "chrome/common/bitmap_wire_data.h"
 #include "chrome/common/mru_cache.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
+#elif defined(OS_POSIX)
+#include "skia/ext/platform_canvas.h"
 #endif
 
 class RenderWidgetHost;
@@ -33,17 +36,15 @@ class BackingStore {
 #endif
 
   // Paints the bitmap from the renderer onto the backing store.
-  // TODO(port): The HANDLE is a shared section on Windows. Abstract this.
   bool PaintRect(base::ProcessHandle process,
-                 HANDLE bitmap_section,
+                 BitmapWireData bitmap_section,
                  const gfx::Rect& bitmap_rect);
 
   // Scrolls the given rect in the backing store, replacing the given region
   // identified by |bitmap_rect| by the bitmap in the file identified by the
   // given file handle.
-  // TODO(port): The HANDLE is a shared section on Windows. Abstract this.
   void ScrollRect(base::ProcessHandle process,
-                  HANDLE bitmap, const gfx::Rect& bitmap_rect,
+                  BitmapWireData bitmap, const gfx::Rect& bitmap_rect,
                   int dx, int dy,
                   const gfx::Rect& clip_rect,
                   const gfx::Size& view_size);
@@ -69,7 +70,9 @@ class BackingStore {
 
   // Handle to the original bitmap in the dc.
   HANDLE original_bitmap_;
-#endif
+#elif defined(OS_POSIX)
+  skia::PlatformCanvas canvas_;
+#endif  // defined(OS_WIN)
 
   DISALLOW_COPY_AND_ASSIGN(BackingStore);
 };
@@ -105,11 +108,10 @@ class BackingStoreManager {
   // needs_full_paint
   //   Set if we need to send out a request to paint the view
   //   to the renderer.
-  // TODO(port): The HANDLE is a shared section on Windows. Abstract this.
   static BackingStore* PrepareBackingStore(RenderWidgetHost* host,
                                            const gfx::Rect& backing_store_rect,
                                            base::ProcessHandle process_handle,
-                                           HANDLE bitmap_section,
+                                           BitmapWireData bitmap_section,
                                            const gfx::Rect& bitmap_rect,
                                            bool* needs_full_paint);
 
diff --git a/chrome/browser/renderer_host/backing_store_posix.cc b/chrome/browser/renderer_host/backing_store_posix.cc
new file mode 100644
index 0000000..a21b235
--- /dev/null
+++ b/chrome/browser/renderer_host/backing_store_posix.cc
@@ -0,0 +1,37 @@
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/renderer_host/backing_store.h"
+
+BackingStore::BackingStore(const gfx::Size& size)
+    : size_(size) {
+  if (!canvas_.initialize(size.width(), size.height(), true))
+    SK_CRASH();
+}
+
+BackingStore::~BackingStore() {
+}
+
+bool BackingStore::PaintRect(base::ProcessHandle process,
+                             BitmapWireData bitmap,
+                             const gfx::Rect& bitmap_rect) {
+  if (bitmap.width() != bitmap_rect.width() ||
+      bitmap.height() != bitmap_rect.height() ||
+      bitmap.config() != SkBitmap::kARGB_8888_Config) {
+    return false;
+  }
+
+  canvas_.drawBitmap(bitmap, bitmap_rect.x(), bitmap_rect.y());
+  return true;
+}
+
+void BackingStore::ScrollRect(base::ProcessHandle process,
+                              BitmapWireData bitmap,
+                              const gfx::Rect& bitmap_rect,
+                              int dx, int dy,
+                              const gfx::Rect& clip_rect,
+                              const gfx::Size& view_size) {
+  // TODO(port): implement scrolling
+  NOTIMPLEMENTED();
+}
diff --git a/chrome/browser/renderer_host/backing_store_win.cc b/chrome/browser/renderer_host/backing_store_win.cc
index 0a09d2e..2ca9396 100644
--- a/chrome/browser/renderer_host/backing_store_win.cc
+++ b/chrome/browser/renderer_host/backing_store_win.cc
@@ -31,7 +31,7 @@ BackingStore::~BackingStore() {
 }
 
 bool BackingStore::PaintRect(base::ProcessHandle process,
-                             HANDLE bitmap_section,
+                             BitmapWireData bitmap_section,
                              const gfx::Rect& bitmap_rect) {
   // The bitmap received is valid only in the renderer process.
   HANDLE valid_bitmap =
@@ -76,7 +76,8 @@ bool BackingStore::PaintRect(base::ProcessHandle process,
 }
 
 void BackingStore::ScrollRect(base::ProcessHandle process,
-                              HANDLE bitmap, const gfx::Rect& bitmap_rect,
+                              BitmapWireData bitmap,
+                              const gfx::Rect& bitmap_rect,
                               int dx, int dy,
                               const gfx::Rect& clip_rect,
                               const gfx::Size& view_size) {
diff --git a/chrome/browser/renderer_host/render_widget_host.cc b/chrome/browser/renderer_host/render_widget_host.cc
index a163705..50a6ef3 100644
--- a/chrome/browser/renderer_host/render_widget_host.cc
+++ b/chrome/browser/renderer_host/render_widget_host.cc
@@ -4,19 +4,23 @@
 
 #include "chrome/browser/renderer_host/render_widget_host.h"
 
-#include "base/gfx/gdi_util.h"
+#include "base/gfx/native_widget_types.h"
 #include "base/message_loop.h"
-#include "chrome/app/chrome_dll_resource.h"
 #include "chrome/browser/renderer_host/backing_store.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_widget_helper.h"
 #include "chrome/browser/renderer_host/render_widget_host_view.h"
 #include "chrome/common/notification_service.h"
-#include "chrome/common/win_util.h"
 #include "chrome/views/view.h"
 #include "webkit/glue/webcursor.h"
 #include "webkit/glue/webinputevent.h"
 
+#if defined(OS_WIN)
+#include "base/gfx/gdi_util.h"
+#include "chrome/app/chrome_dll_resource.h"
+#include "chrome/common/win_util.h"
+#endif  // defined(OS_WIN)
+
 using base::Time;
 using base::TimeDelta;
 using base::TimeTicks;
@@ -35,18 +39,18 @@ static const int kHungRendererDelayMs = 20000;
 
 RenderWidgetHost::RenderWidgetHost(RenderProcessHost* process,
                                    int routing_id)
-    : process_(process),
+    : view_(NULL),
+      process_(process),
       routing_id_(routing_id),
-      resize_ack_pending_(false),
-      mouse_move_pending_(false),
-      view_(NULL),
       is_loading_(false),
       is_hidden_(false),
+      repaint_ack_pending_(false),
+      resize_ack_pending_(false),
       suppress_view_updating_(false),
+      mouse_move_pending_(false),
       needs_repainting_on_restore_(false),
       is_unresponsive_(false),
-      view_being_painted_(false),
-      repaint_ack_pending_(false) {
+      view_being_painted_(false) {
   if (routing_id_ == MSG_ROUTING_NONE)
     routing_id_ = process_->GetNextRoutingID();
 
@@ -277,9 +281,15 @@ void RenderWidgetHost::ForwardWheelEvent(
 }
 
 void RenderWidgetHost::ForwardKeyboardEvent(const WebKeyboardEvent& key_event) {
+#if defined(OS_WIN)
   if (key_event.type == WebKeyboardEvent::CHAR &&
       (key_event.key_code == VK_RETURN || key_event.key_code == VK_SPACE))
     OnEnterOrSpace();
+#else
+  // TODO(port): we don't have portable keyboard codes yet
+  // Maybe use keyboard_codes.h if we stick with it
+  NOTIMPLEMENTED();
+#endif
 
   ForwardInputEvent(key_event, sizeof(WebKeyboardEvent));
 }
@@ -408,7 +418,6 @@ void RenderWidgetHost::OnMsgPaintRect(
     UMA_HISTOGRAM_TIMES(L"MPArch.RWH_RepaintDelta", delta);
   }
 
-  DCHECK(params.bitmap);
   DCHECK(!params.bitmap_rect.IsEmpty());
   DCHECK(!params.view_size.IsEmpty());
 
@@ -547,7 +556,7 @@ void RenderWidgetHost::OnMsgImeUpdateStatus(ViewHostMsg_ImeControl control,
   }
 }
 
-void RenderWidgetHost::PaintBackingStoreRect(HANDLE bitmap,
+void RenderWidgetHost::PaintBackingStoreRect(BitmapWireData bitmap,
                                              const gfx::Rect& bitmap_rect,
                                              const gfx::Size& view_size) {
   if (is_hidden_) {
@@ -576,7 +585,7 @@ void RenderWidgetHost::PaintBackingStoreRect(HANDLE bitmap,
   }
 }
 
-void RenderWidgetHost::ScrollBackingStoreRect(HANDLE bitmap,
+void RenderWidgetHost::ScrollBackingStoreRect(BitmapWireData bitmap,
                                               const gfx::Rect& bitmap_rect,
                                               int dx, int dy,
                                               const gfx::Rect& clip_rect,
diff --git a/chrome/browser/renderer_host/render_widget_host.h b/chrome/browser/renderer_host/render_widget_host.h
index d61320b..08f20f0 100644
--- a/chrome/browser/renderer_host/render_widget_host.h
+++ b/chrome/browser/renderer_host/render_widget_host.h
@@ -5,13 +5,13 @@
 #ifndef CHROME_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_H_
 #define CHROME_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_H_
 
-#include <windows.h>
-
 #include <vector>
 
 #include "base/gfx/size.h"
 #include "base/timer.h"
+#include "chrome/common/bitmap_wire_data.h"
 #include "chrome/common/ipc_channel.h"
+#include "chrome/common/render_messages.h"
 #include "testing/gtest/include/gtest/gtest_prod.h"
 
 namespace gfx {
@@ -27,7 +27,6 @@ class WebKeyboardEvent;
 class WebMouseEvent;
 class WebMouseWheelEvent;
 class WebCursor;
-enum ViewHostMsg_ImeControl;
 struct ViewHostMsg_PaintRect_Params;
 struct ViewHostMsg_ScrollRect_Params;
 struct WebPluginGeometry;
@@ -260,14 +259,14 @@ class RenderWidgetHost : public IPC::Channel::Listener {
                             const gfx::Rect& caret_rect);
 
   // Paints the given bitmap to the current backing store at the given location.
-  void PaintBackingStoreRect(HANDLE bitmap,
+  void PaintBackingStoreRect(BitmapWireData bitmap,
                              const gfx::Rect& bitmap_rect,
                              const gfx::Size& view_size);
 
   // Scrolls the given |clip_rect| in the backing by the given dx/dy amount. The
   // |bitmap| and its corresponding location |bitmap_rect| in the backing store
   // is the newly painted pixels by the renderer.
-  void ScrollBackingStoreRect(HANDLE bitmap,
+  void ScrollBackingStoreRect(BitmapWireData bitmap,
                               const gfx::Rect& bitmap_rect,
                               int dx, int dy,
                               const gfx::Rect& clip_rect,
diff --git a/chrome/chrome.xcodeproj/project.pbxproj b/chrome/chrome.xcodeproj/project.pbxproj
index 7d98b2b..baa8874 100644
--- a/chrome/chrome.xcodeproj/project.pbxproj
+++ b/chrome/chrome.xcodeproj/project.pbxproj
@@ -203,6 +203,7 @@
 		4DDC644B0EAE390800FB5EBE /* libxml.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 4D7BFB230E9D4BBF009A6919 /* libxml.a */; };
 		4DDC64580EAE394200FB5EBE /* libzlib.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 4DDC64550EAE392400FB5EBE /* libzlib.a */; };
 		534E66C40F311BEC0006B2B2 /* temp_scaffolding_stubs.cc in Sources */ = {isa = PBXBuildFile; fileRef = 534E66C30F311BEC0006B2B2 /* temp_scaffolding_stubs.cc */; };
+		671555F7DF06E224B646E5D2 /* backing_store_posix.cc in Sources */ = {isa = PBXBuildFile; fileRef = B94B5B0CBF4D7FAC48BB1AE2 /* backing_store_posix.cc */; };
 		8268477E0F2F69C8009F6555 /* profile_manager_unittest.cc in Sources */ = {isa = PBXBuildFile; fileRef = 4D7BF8E60E9D4839009A6919 /* profile_manager_unittest.cc */; };
 		8268477F0F2F69D1009F6555 /* profile_manager.cc in Sources */ = {isa = PBXBuildFile; fileRef = 4D7BF8E40E9D4839009A6919 /* profile_manager.cc */; };
 		826847800F2F69D1009F6555 /* profile.cc in Sources */ = {isa = PBXBuildFile; fileRef = 4D7BF8E20E9D4839009A6919 /* profile.cc */; };
@@ -1989,6 +1990,7 @@
 		B6CCB9F70F1EC32700106F0D /* web_drag_source.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = web_drag_source.h; path = tab_contents/web_drag_source.h; sourceTree = "<group>"; };
 		B6CCB9F80F1EC32700106F0D /* web_drop_target.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = web_drop_target.cc; path = tab_contents/web_drop_target.cc; sourceTree = "<group>"; };
 		B6CCB9F90F1EC32700106F0D /* web_drop_target.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = web_drop_target.h; path = tab_contents/web_drop_target.h; sourceTree = "<group>"; };
+		B94B5B0CBF4D7FAC48BB1AE2 /* backing_store_posix.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = backing_store_posix.cc; path = browser/renderer_host/backing_store_posix.cc; sourceTree = SOURCE_ROOT; };
 		E40CC5E10F2E348900708647 /* history_contents_provider.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = history_contents_provider.cc; path = autocomplete/history_contents_provider.cc; sourceTree = "<group>"; };
 		E40CC5E20F2E348900708647 /* history_contents_provider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = history_contents_provider.h; path = autocomplete/history_contents_provider.h; sourceTree = "<group>"; };
 		E40CC5E40F2E349000708647 /* history_contents_provider_unittest.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = history_contents_provider_unittest.cc; path = autocomplete/history_contents_provider_unittest.cc; sourceTree = "<group>"; };
@@ -2429,6 +2431,7 @@
 				4D7BFB090E9D4BA1009A6919 /* Projects */,
 				4D7BF3070E9D477E009A6919 /* Products */,
 				A9C335E39D39A7DE087850FC /* url_pattern_unittest.cc */,
+				B94B5B0CBF4D7FAC48BB1AE2 /* backing_store_posix.cc */,
 				6447F24FADC63E58A44DB762 /* url_pattern.cc */,
 			);
 			sourceTree = "<group>";
@@ -4495,6 +4498,7 @@
 				4D7BFA1E0E9D48FD009A6919 /* archived_database.cc in Sources */,
 				E45075DC0F150A53003BE099 /* async_resource_handler.cc in Sources */,
 				E43A770B0F1660EA00ABD5D1 /* automation_resource_tracker.cc in Sources */,
+				671555F7DF06E224B646E5D2 /* backing_store_posix.cc in Sources */,
 				E40CC5EE0F2E34C100708647 /* base_history_model.cc in Sources */,
 				4D7BFAEE0E9D49E5009A6919 /* bloom_filter.cc in Sources */,
 				E45075B20F1505C0003BE099 /* bookmark_codec.cc in Sources */,
diff --git a/chrome/common/bitmap_wire_data.h b/chrome/common/bitmap_wire_data.h
new file mode 100644
index 0000000..c4e1edd
--- /dev/null
+++ b/chrome/common/bitmap_wire_data.h
@@ -0,0 +1,35 @@
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_BITMAP_WIRE_DATA_H_
+#define CHROME_COMMON_BITMAP_WIRE_DATA_H_
+
+#if defined(OS_POSIX)
+class SkBitmap;
+#endif
+
+// BitmapWireData is the type of the bitmap data which is carried from renderer
+// to browser over the wire.
+
+#if defined(OS_WIN)
+
+// On Windows, the bitmap data is carried out-of-band in a shared memory
+// segment. This is the handle to the shared memory. These handles are valid
+// only in the context of the renderer process.
+// TODO(agl): get a clarification on that last sentence. It doesn't make any
+// sense to me
+typedef HANDLE BitmapWireData;
+
+#elif defined(OS_POSIX)
+
+// On POSIX, we currently serialise the bitmap data over the wire. This will
+// change at some point when we too start using shared memory, but we wish to
+// use shared memory in a different way so this is a temporary work-around.
+// TODO(port): implement drawing with shared backing stores and replace this
+//   with an IPC no-op type.
+typedef SkBitmap BitmapWireData;
+
+#endif  // defined(OS_WIN)
+
+#endif  // CHROME_COMMON_BITMAP_WIRE_DATA_H_
diff --git a/chrome/common/render_messages.h b/chrome/common/render_messages.h
index dd756d7..95c7e6d 100644
--- a/chrome/common/render_messages.h
+++ b/chrome/common/render_messages.h
@@ -10,8 +10,10 @@
 #include <map>
 
 #include "base/basictypes.h"
+#include "base/gfx/native_widget_types.h"
 #include "base/ref_counted.h"
 #include "base/shared_memory.h"
+#include "chrome/common/bitmap_wire_data.h"
 #include "chrome/common/filter_policy.h"
 #include "chrome/common/ipc_message.h"
 #include "chrome/common/ipc_message_utils.h"
@@ -33,6 +35,10 @@
 #include "webkit/glue/webpreferences.h"
 #include "webkit/glue/webview_delegate.h"
 
+#if defined(OS_POSIX)
+#include "skia/include/SkBitmap.h"
+#endif
+
 // Parameters structure for ViewMsg_Navigate, which has too many data
 // parameters to be reasonably put in a predefined IPC message.
 struct ViewMsg_Navigate_Params {
@@ -190,13 +196,9 @@ struct ViewHostMsg_PaintRect_Flags {
   }
 };
 
-#if defined(OS_WIN)
-// TODO(port): Make these structs portable.
-
 struct ViewHostMsg_PaintRect_Params {
-  // The bitmap to be painted into the rect given by bitmap_rect.  Valid only
-  // in the context of the renderer process.
-  base::SharedMemoryHandle bitmap;
+  // The bitmap to be painted into the rect given by bitmap_rect.
+  BitmapWireData bitmap;
 
   // The position and size of the bitmap.
   gfx::Rect bitmap_rect;
@@ -228,9 +230,8 @@ struct ViewHostMsg_PaintRect_Params {
 // Parameters structure for ViewHostMsg_ScrollRect, which has too many data
 // parameters to be reasonably put in a predefined IPC message.
 struct ViewHostMsg_ScrollRect_Params {
-  // The bitmap to be painted into the rect exposed by scrolling.  This handle
-  // is valid only in the context of the renderer process.
-  base::SharedMemoryHandle bitmap;
+  // The bitmap to be painted into the rect exposed by scrolling.
+  BitmapWireData bitmap;
 
   // The position and size of the bitmap.
   gfx::Rect bitmap_rect;
@@ -248,7 +249,6 @@ struct ViewHostMsg_ScrollRect_Params {
   // New window locations for plugin child windows.
   std::vector<WebPluginGeometry> plugin_window_moves;
 };
-#endif  // defined(OS_WIN)
 
 // Parameters structure for ViewMsg_UploadFile.
 struct ViewMsg_UploadFile_Params {
@@ -967,9 +967,6 @@ struct ParamTraits<ViewHostMsg_ContextMenu_Params> {
   }
 };
 
-#if defined(OS_WIN)
-// TODO(port): Make these messages portable.
-
 // Traits for ViewHostMsg_PaintRect_Params structure to pack/unpack.
 template <>
 struct ParamTraits<ViewHostMsg_PaintRect_Params> {
@@ -1078,7 +1075,6 @@ struct ParamTraits<WebPluginGeometry> {
     l->append(L")");
   }
 };
-#endif  // defined(OS_WIN)
 
 // Traits for ViewMsg_GetPlugins_Reply structure to pack/unpack.
 template <>
@@ -1738,6 +1734,31 @@ struct ParamTraits<ModalDialogEvent> {
   }
 };
 
+#if defined(OS_POSIX)
+
+// TODO(port): this shouldn't exist. However, the plugin stuff is really using
+// HWNDS (NativeView), and making Windows calls based on them. I've not figured
+// out the deal with plugins yet.
+template <>
+struct ParamTraits<gfx::NativeView> {
+  typedef gfx::NativeView param_type;
+  static void Write(Message* m, const param_type& p) {
+    NOTIMPLEMENTED();
+  }
+
+  static bool Read(const Message* m, void** iter, param_type* p) {
+    NOTIMPLEMENTED();
+    *p = NULL;
+    return true;
+  }
+
+  static void Log(const param_type& p, std::wstring* l) {
+    l->append(StringPrintf(L"<gfx::NativeView>"));
+  }
+};
+
+#endif  // defined(OS_POSIX)
+
 }  // namespace IPC
 
 #endif  // CHROME_COMMON_RENDER_MESSAGES_H_
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index 732c730..149dd53 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -613,7 +613,6 @@ IPC_BEGIN_MESSAGES(ViewHost, 2)
                               navigating to a POST again and we're going to
                               show the POST interstitial */ )
 
-#if defined(OS_WIN)
   // Sent to paint part of the view.  In response to this message, the host
   // generates a ViewMsg_PaintRect_ACK message.
   IPC_MESSAGE_ROUTED1(ViewHostMsg_PaintRect,
@@ -623,7 +622,6 @@ IPC_BEGIN_MESSAGES(ViewHost, 2)
   // generates a ViewMsg_ScrollRect_ACK message.
   IPC_MESSAGE_ROUTED1(ViewHostMsg_ScrollRect,
                       ViewHostMsg_ScrollRect_Params)
-#endif
 
   // Acknowledges receipt of a ViewMsg_HandleInputEvent message.
   // Payload is a WebInputEvent::Type which is the type of the event, followed
diff --git a/chrome/renderer/render_widget.cc b/chrome/renderer/render_widget.cc
index 587c517..1e14993 100644
--- a/chrome/renderer/render_widget.cc
+++ b/chrome/renderer/render_widget.cc
@@ -9,8 +9,14 @@
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/scoped_ptr.h"
+#include "build/build_config.h"
 #include "chrome/renderer/render_process.h"
-#include "skia/ext/platform_canvas_win.h"
+#include "skia/ext/platform_canvas.h"
+
+#if defined(OS_POSIX)
+#include "skia/include/SkPixelRef.h"
+#include "skia/include/SkMallocPixelRef.h"
+#endif  // defined(OS_POSIX)
 
 #include "webkit/glue/webinputevent.h"
 #include "webkit/glue/webwidget.h"
@@ -77,10 +83,10 @@ RenderWidget::RenderWidget(RenderThreadBase* render_thread, bool activatable)
       next_paint_flags_(0),
       paint_reply_pending_(false),
       did_show_(false),
-      closing_(false),
       is_hidden_(false),
       needs_repainting_on_restore_(false),
       has_focus_(false),
+      closing_(false),
       ime_is_active_(false),
       ime_control_enable_ime_(true),
       ime_control_x_(-1),
@@ -352,25 +358,25 @@ void RenderWidget::ClearFocus() {
 }
 
 void RenderWidget::PaintRect(const gfx::Rect& rect,
-                             base::SharedMemory* paint_buf) {
-  skia::PlatformCanvasWin canvas(rect.width(), rect.height(), true,
-      paint_buf->handle());
+                             skia::PlatformCanvas* canvas) {
   // Bring the canvas into the coordinate system of the paint rect
-  canvas.translate(static_cast<SkScalar>(-rect.x()),
-                   static_cast<SkScalar>(-rect.y()));
+  canvas->translate(static_cast<SkScalar>(-rect.x()),
+                    static_cast<SkScalar>(-rect.y()));
 
-  webwidget_->Paint(&canvas, rect);
+  webwidget_->Paint(canvas, rect);
 
   // Flush to underlying bitmap.  TODO(darin): is this needed?
-  canvas.getTopPlatformDevice().accessBitmap(false);
+  canvas->getTopPlatformDevice().accessBitmap(false);
 
   // Let the subclass observe this paint operations.
   DidPaint();
 }
 
+// static
 size_t RenderWidget::GetPaintBufSize(const gfx::Rect& rect) {
   // TODO(darin): protect against overflow
-  return 4 * rect.width() * rect.height();
+  const size_t stride = skia::PlatformCanvas::StrideForWidth(rect.width());
+  return stride * rect.height();
 }
 
 void RenderWidget::DoDeferredPaint() {
@@ -394,22 +400,38 @@ void RenderWidget::DoDeferredPaint() {
   paint_rect_ = gfx::Rect();
 
   // Compute a buffer for painting and cache it.
+#if defined(OS_WIN)
   current_paint_buf_ =
       RenderProcess::AllocSharedMemory(GetPaintBufSize(damaged_rect));
   if (!current_paint_buf_) {
     NOTREACHED();
     return;
   }
+  skia::PlatformCanvasWin canvas(damaged_rect.width(), damaged_rect.height(),
+                                 true, current_paint_buf_->handle());
+#elif defined(OS_POSIX)
+  // Currently, on POSIX, we are serialising the bitmap data over the IPC
+  // channel.
+  skia::PlatformCanvas canvas(damaged_rect.width(), damaged_rect.height(),
+                              true);
+#endif  // defined(OS_POSIX)
 
-  PaintRect(damaged_rect, current_paint_buf_);
+  PaintRect(damaged_rect, &canvas);
 
   ViewHostMsg_PaintRect_Params params;
-  params.bitmap = current_paint_buf_->handle();
   params.bitmap_rect = damaged_rect;
   params.view_size = size_;
   params.plugin_window_moves = plugin_window_moves_;
   params.flags = next_paint_flags_;
 
+#if defined(OS_WIN)
+  // Windows passes a HANDLE to the shared memory over IPC
+  params.bitmap = current_paint_buf_->handle();
+#elif defined(OS_POSIX)
+  // POSIX currently passes the data itself.
+  params.bitmap = canvas.getDevice()->accessBitmap(false);
+#endif  // defined(OS_WIN)
+
   plugin_window_moves_.clear();
 
   paint_reply_pending_ = true;
@@ -469,17 +491,25 @@ void RenderWidget::DoDeferredScroll() {
   // In case the scroll offset exceeds the width/height of the scroll rect
   damaged_rect = scroll_rect_.Intersect(damaged_rect);
 
+#if defined(OS_WIN)
   current_scroll_buf_ =
       RenderProcess::AllocSharedMemory(GetPaintBufSize(damaged_rect));
   if (!current_scroll_buf_) {
     NOTREACHED();
     return;
   }
+  skia::PlatformCanvasWin canvas(damaged_rect.width(), damaged_rect.height(),
+                                 true, current_scroll_buf_->handle());
+#elif defined(OS_POSIX)
+  // Currently, on POSIX, we are serialising the bitmap data over the IPC
+  // channel.
+  skia::PlatformCanvas canvas(damaged_rect.width(), damaged_rect.height(),
+                              true);
+#endif  // defined(OS_POSIX)
 
   // Set these parameters before calling Paint, since that could result in
   // further invalidates (uncommon).
   ViewHostMsg_ScrollRect_Params params;
-  params.bitmap = current_scroll_buf_->handle();
   params.bitmap_rect = damaged_rect;
   params.dx = scroll_delta_.x();
   params.dy = scroll_delta_.y();
@@ -487,12 +517,20 @@ void RenderWidget::DoDeferredScroll() {
   params.view_size = size_;
   params.plugin_window_moves = plugin_window_moves_;
 
+#if defined(OS_WIN)
+  // Windows passes a HANDLE to the shared memory over IPC
+  params.bitmap = current_scroll_buf_->handle();
+#elif defined(OS_POSIX)
+  // POSIX currently passes the data itself.
+  params.bitmap = canvas.getDevice()->accessBitmap(false);
+#endif  // defined(OS_WIN)
+
   plugin_window_moves_.clear();
 
   // Mark the scroll operation as no longer pending.
   scroll_rect_ = gfx::Rect();
 
-  PaintRect(damaged_rect, current_scroll_buf_);
+  PaintRect(damaged_rect, &canvas);
   Send(new ViewHostMsg_ScrollRect(routing_id_, params));
   UpdateIME();
 }
diff --git a/chrome/renderer/render_widget.h b/chrome/renderer/render_widget.h
index c594f64..df193bd 100644
--- a/chrome/renderer/render_widget.h
+++ b/chrome/renderer/render_widget.h
@@ -14,6 +14,7 @@
 #include "base/ref_counted.h"
 #include "chrome/common/ipc_channel.h"
 #include "chrome/common/render_messages.h"
+#include "skia/ext/platform_canvas.h"
 
 #include "webkit/glue/webwidget_delegate.h"
 #include "webkit/glue/webcursor.h"
@@ -85,6 +86,10 @@ class RenderWidget : public IPC::Channel::Listener,
   // Close the underlying WebWidget.
   void Close();
 
+  // Get the size of the paint buffer for the given rectangle, rounding up to
+  // the allocation granularity of the system.
+  static size_t GetPaintBufSize(const gfx::Rect& rect);
+
  protected:
   // Friend RefCounted so that the dtor can be non-public. Using this class
   // without ref-counting is an error.
@@ -100,14 +105,10 @@ class RenderWidget : public IPC::Channel::Listener,
   // Finishes creation of a pending view started with Init.
   void CompleteInit(gfx::NativeViewId parent);
 
-  // Paints the given rectangular region of the WebWidget into paint_buf (a
-  // shared memory segment returned by AllocPaintBuf). The caller must ensure
-  // that the given rect fits within the bounds of the WebWidget.
-  void PaintRect(const gfx::Rect& rect, base::SharedMemory* paint_buf);
-
-  // Get the size of the paint buffer for the given rectangle, rounding up to
-  // the allocation granularity of the system.
-  size_t GetPaintBufSize(const gfx::Rect& rect);
+  // Paints the given rectangular region of the WebWidget into canvas (a
+  // shared memory segment returned by AllocPaintBuf on Windows). The caller
+  // must ensure that the given rect fits within the bounds of the WebWidget.
+  void PaintRect(const gfx::Rect& rect, skia::PlatformCanvas* canvas);
 
   void DoDeferredPaint();
   void DoDeferredScroll();
diff --git a/chrome/renderer/renderer.scons b/chrome/renderer/renderer.scons
index b799929..48ac553 100644
--- a/chrome/renderer/renderer.scons
+++ b/chrome/renderer/renderer.scons
@@ -103,8 +103,6 @@ if env.Bit('linux'):
       'debug_message_handler.cc',
       'external_js_object.cc',
       'plugin_channel_host.cc',
-      'render_view.cc',
-      'render_widget.cc',
       'renderer_main.cc',
       'webplugin_delegate_proxy.cc',
   )