gpu: reference target surfaces through a globally unique surface id.

This allows the gpu process to ignore all knowledge of renderers. It simplifies
some of the gpu <-> browser and gpu <-> renderer IPC, but mostly paves the way
for non-renderer clients.

Surfaces are kept in a global GpuSurfaceTracker which is just a thread-safe map.

BUG=99516
TEST=covered by existing tests. Run chrome, open poster circle (or other accelerated content page).


Review URL: http://codereview.chromium.org/9194005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@118172 0039d316-1c4b-4281-b951-d872f2087c98

34 files changed, 370 insertions, 204 deletions

diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index a9b3c15..1b15780 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc
@@ -403,21 +403,19 @@ void GpuProcessHost::EstablishGpuChannel(
 
 void GpuProcessHost::CreateViewCommandBuffer(
     gfx::PluginWindowHandle compositing_surface,
-    int32 render_view_id,
-    int32 client_id,
+    int surface_id,
+    int client_id,
     const GPUCreateCommandBufferConfig& init_params,
     const CreateCommandBufferCallback& callback) {
   DCHECK(CalledOnValidThread());
 
 #if defined(TOOLKIT_USES_GTK)
-  ViewID view_id(client_id, render_view_id);
-
   // There should only be one such command buffer (for the compositor).  In
   // practice, if the GPU process lost a context, GraphicsContext3D with
   // associated command buffer and view surface will not be gone until new
   // one is in place and all layers are reattached.
   linked_ptr<SurfaceRef> surface_ref;
-  SurfaceRefMap::iterator it = surface_refs_.find(view_id);
+  SurfaceRefMap::iterator it = surface_refs_.find(surface_id);
   if (it != surface_refs_.end())
     surface_ref = (*it).second;
   else
@@ -426,11 +424,10 @@ void GpuProcessHost::CreateViewCommandBuffer(
 
   if (compositing_surface != gfx::kNullPluginWindow &&
       Send(new GpuMsg_CreateViewCommandBuffer(
-          compositing_surface, render_view_id, client_id, init_params))) {
+          compositing_surface, surface_id, client_id, init_params))) {
     create_command_buffer_requests_.push(callback);
 #if defined(TOOLKIT_USES_GTK)
-    surface_refs_.insert(std::pair<ViewID, linked_ptr<SurfaceRef> >(
-        view_id, surface_ref));
+    surface_refs_.insert(std::make_pair(surface_id, surface_ref));
 #endif
   } else {
     CreateCommandBufferError(callback, MSG_ROUTING_NONE);
@@ -478,12 +475,9 @@ void GpuProcessHost::OnCommandBufferCreated(const int32 route_id) {
   }
 }
 
-void GpuProcessHost::OnDestroyCommandBuffer(
-    gfx::PluginWindowHandle window, int32 client_id,
-    int32 render_view_id) {
+void GpuProcessHost::OnDestroyCommandBuffer(int32 surface_id) {
 #if defined(TOOLKIT_USES_GTK)
-  ViewID view_id(client_id, render_view_id);
-  SurfaceRefMap::iterator it = surface_refs_.find(view_id);
+  SurfaceRefMap::iterator it = surface_refs_.find(surface_id);
   if (it != surface_refs_.end())
     surface_refs_.erase(it);
 #endif  // defined(TOOLKIT_USES_GTK)
diff --git a/content/browser/gpu/gpu_process_host.h b/content/browser/gpu/gpu_process_host.h
index 295803a..29ec0df 100644
--- a/content/browser/gpu/gpu_process_host.h
+++ b/content/browser/gpu/gpu_process_host.h
@@ -75,8 +75,8 @@ class GpuProcessHost : public BrowserChildProcessHost,
   // window associated with the given renderer.
   void CreateViewCommandBuffer(
       gfx::PluginWindowHandle compositing_surface,
-      int32 render_view_id,
-      int32 client_id,
+      int surface_id,
+      int client_id,
       const GPUCreateCommandBufferConfig& init_params,
       const CreateCommandBufferCallback& callback);
 
@@ -100,8 +100,7 @@ class GpuProcessHost : public BrowserChildProcessHost,
   // Message handlers.
   void OnChannelEstablished(const IPC::ChannelHandle& channel_handle);
   void OnCommandBufferCreated(const int32 route_id);
-  void OnDestroyCommandBuffer(
-      gfx::PluginWindowHandle window, int32 client_id, int32 render_view_id);
+  void OnDestroyCommandBuffer(int32 surface_id);
 
   bool LaunchGpuProcess(const std::string& channel_id);
 
@@ -125,9 +124,6 @@ class GpuProcessHost : public BrowserChildProcessHost,
   std::queue<CreateCommandBufferCallback> create_command_buffer_requests_;
 
 #if defined(TOOLKIT_USES_GTK)
-  typedef std::pair<int32 /* client_id */,
-                    int32 /* render_view_id */> ViewID;
-
   // Encapsulates surfaces that we lock when creating view command buffers.
   // We release this lock once the command buffer (or associated GPU process)
   // is destroyed. This prevents the browser from destroying the surface
@@ -136,7 +132,7 @@ class GpuProcessHost : public BrowserChildProcessHost,
   // Multimap is used to simulate reference counting, see comment in
   // GpuProcessHostUIShim::CreateViewCommandBuffer.
   class SurfaceRef;
-  typedef std::multimap<ViewID, linked_ptr<SurfaceRef> > SurfaceRefMap;
+  typedef std::multimap<int, linked_ptr<SurfaceRef> > SurfaceRefMap;
   SurfaceRefMap surface_refs_;
 #endif
 
diff --git a/content/browser/gpu/gpu_process_host_ui_shim.cc b/content/browser/gpu/gpu_process_host_ui_shim.cc
index 488553d..7d26d66 100644
--- a/content/browser/gpu/gpu_process_host_ui_shim.cc
+++ b/content/browser/gpu/gpu_process_host_ui_shim.cc
@@ -13,6 +13,7 @@
 #include "base/process_util.h"
 #include "content/browser/gpu/gpu_data_manager.h"
 #include "content/browser/gpu/gpu_process_host.h"
+#include "content/browser/gpu/gpu_surface_tracker.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/renderer_host/render_widget_host_view.h"
@@ -73,8 +74,13 @@ class ScopedSendOnIOThread {
   bool cancelled_;
 };
 
-RenderWidgetHostView* GetRenderWidgetHostViewFromID(int render_process_id,
-                                                    int render_widget_id) {
+RenderWidgetHostView* GetRenderWidgetHostViewFromSurfaceID(int surface_id) {
+  int render_process_id = 0;
+  int render_widget_id = 0;
+  if (!GpuSurfaceTracker::Get()->GetRenderWidgetIDForSurface(
+        surface_id, &render_process_id, &render_widget_id))
+    return NULL;
+
   content::RenderProcessHost* process =
       content::RenderProcessHost::FromID(render_process_id);
   if (!process)
@@ -226,8 +232,7 @@ void GpuProcessHostUIShim::OnGraphicsInfoCollected(
 
 #if defined(TOOLKIT_USES_GTK) || defined(OS_WIN)
 
-void GpuProcessHostUIShim::OnResizeView(int32 client_id,
-                                        int32 render_view_id,
+void GpuProcessHostUIShim::OnResizeView(int32 surface_id,
                                         int32 route_id,
                                         gfx::Size size) {
   // Always respond even if the window no longer exists. The GPU process cannot
@@ -237,8 +242,7 @@ void GpuProcessHostUIShim::OnResizeView(int32 client_id,
       host_id_,
       new AcceleratedSurfaceMsg_ResizeViewACK(route_id));
 
-  RenderWidgetHostView* view = GetRenderWidgetHostViewFromID(client_id,
-                                                             render_view_id);
+  RenderWidgetHostView* view = GetRenderWidgetHostViewFromSurfaceID(surface_id);
   if (!view)
     return;
 
@@ -278,16 +282,16 @@ void GpuProcessHostUIShim::OnAcceleratedSurfaceNew(
       host_id_,
       new AcceleratedSurfaceMsg_NewACK(
           params.route_id,
-          params.surface_id,
+          params.surface_handle,
           TransportDIB::DefaultHandleValue()));
 
-  RenderWidgetHostView* view = GetRenderWidgetHostViewFromID(
-      params.client_id, params.render_view_id);
+  RenderWidgetHostView* view = GetRenderWidgetHostViewFromSurfaceID(
+      params.surface_id);
   if (!view)
     return;
 
-  uint64 surface_id = params.surface_id;
-  TransportDIB::Handle surface_handle = TransportDIB::DefaultHandleValue();
+  uint64 surface_handle = params.surface_handle;
+  TransportDIB::Handle shm_handle = TransportDIB::DefaultHandleValue();
 
 #if defined(OS_MACOSX)
   if (params.create_transport_dib) {
@@ -305,7 +309,7 @@ void GpuProcessHostUIShim::OnAcceleratedSurfaceNew(
                                                 local_handle);
         // Create a remote handle for the GPU process to map the SHM.
         if (!shared_memory->ShareToProcess(0 /* pid, not needed */,
-                                           &surface_handle)) {
+                                           &shm_handle)) {
           return;
         }
       }
@@ -314,15 +318,15 @@ void GpuProcessHostUIShim::OnAcceleratedSurfaceNew(
     view->AcceleratedSurfaceSetIOSurface(params.window,
                                          params.width,
                                          params.height,
-                                         surface_id);
+                                         surface_handle);
   }
 #else  // defined(UI_COMPOSITOR_IMAGE_TRANSPORT)
   view->AcceleratedSurfaceNew(
-      params.width, params.height, &surface_id, &surface_handle);
+      params.width, params.height, &surface_handle, &shm_handle);
 #endif
   delayed_send.Cancel();
   Send(new AcceleratedSurfaceMsg_NewACK(
-      params.route_id, surface_id, surface_handle));
+      params.route_id, surface_handle, shm_handle));
 }
 
 #endif
@@ -336,8 +340,8 @@ void GpuProcessHostUIShim::OnAcceleratedSurfaceBuffersSwapped(
       host_id_,
       new AcceleratedSurfaceMsg_BuffersSwappedACK(params.route_id));
 
-  RenderWidgetHostView* view = GetRenderWidgetHostViewFromID(
-      params.client_id, params.render_view_id);
+  RenderWidgetHostView* view = GetRenderWidgetHostViewFromSurfaceID(
+      params.surface_id);
   if (!view)
     return;
 
@@ -356,8 +360,8 @@ void GpuProcessHostUIShim::OnAcceleratedSurfacePostSubBuffer(
       host_id_,
       new AcceleratedSurfaceMsg_PostSubBufferACK(params.route_id));
 
-  RenderWidgetHostView* view = GetRenderWidgetHostViewFromID(
-      params.client_id, params.render_view_id);
+  RenderWidgetHostView* view = GetRenderWidgetHostViewFromSurfaceID(
+      params.surface_id);
   if (!view)
     return;
 
@@ -371,8 +375,8 @@ void GpuProcessHostUIShim::OnAcceleratedSurfacePostSubBuffer(
 
 void GpuProcessHostUIShim::OnAcceleratedSurfaceRelease(
     const GpuHostMsg_AcceleratedSurfaceRelease_Params& params) {
-  RenderWidgetHostView* view = GetRenderWidgetHostViewFromID(
-      params.client_id, params.render_view_id);
+  RenderWidgetHostView* view = GetRenderWidgetHostViewFromSurfaceID(
+      params.surface_id);
   if (!view)
     return;
   view->AcceleratedSurfaceRelease(params.identifier);
diff --git a/content/browser/gpu/gpu_process_host_ui_shim.h b/content/browser/gpu/gpu_process_host_ui_shim.h
index 119a802..8b5a5f8 100644
--- a/content/browser/gpu/gpu_process_host_ui_shim.h
+++ b/content/browser/gpu/gpu_process_host_ui_shim.h
@@ -83,8 +83,7 @@ class GpuProcessHostUIShim
   void OnLogMessage(int level, const std::string& header,
       const std::string& message);
 #if defined(TOOLKIT_USES_GTK) || defined(OS_WIN)
-  void OnResizeView(int32 client_id,
-                    int32 render_view_id,
+  void OnResizeView(int32 surface_id,
                     int32 route_id,
                     gfx::Size size);
 #endif
diff --git a/content/browser/gpu/gpu_surface_tracker.cc b/content/browser/gpu/gpu_surface_tracker.cc
new file mode 100644
index 0000000..280f48f
--- /dev/null
+++ b/content/browser/gpu/gpu_surface_tracker.cc
@@ -0,0 +1,75 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/gpu/gpu_surface_tracker.h"
+
+#include "base/logging.h"
+
+GpuSurfaceTracker::GpuSurfaceTracker()
+    : next_surface_id_(1) {
+}
+
+GpuSurfaceTracker::~GpuSurfaceTracker() {
+}
+
+GpuSurfaceTracker* GpuSurfaceTracker::GetInstance() {
+  return Singleton<GpuSurfaceTracker>::get();
+}
+
+int GpuSurfaceTracker::AddSurfaceForRenderer(int renderer_id,
+                                             int render_widget_id) {
+  base::AutoLock lock(lock_);
+  SurfaceInfo info = { renderer_id, render_widget_id, gfx::kNullPluginWindow };
+  int surface_id = next_surface_id_++;
+  surface_map_[surface_id] = info;
+  return surface_id;
+}
+
+int GpuSurfaceTracker::LookupSurfaceForRenderer(int renderer_id,
+                                                int render_widget_id) {
+  base::AutoLock lock(lock_);
+  for (SurfaceMap::iterator it = surface_map_.begin(); it != surface_map_.end();
+       ++it) {
+    const SurfaceInfo& info = it->second;
+    if (info.renderer_id == renderer_id &&
+        info.render_widget_id == render_widget_id) {
+      return it->first;
+    }
+  }
+  return 0;
+}
+
+void GpuSurfaceTracker::RemoveSurface(int surface_id) {
+  base::AutoLock lock(lock_);
+  DCHECK(surface_map_.find(surface_id) != surface_map_.end());
+  surface_map_.erase(surface_id);
+}
+
+bool GpuSurfaceTracker::GetRenderWidgetIDForSurface(int surface_id,
+                                                    int* renderer_id,
+                                                    int* render_widget_id) {
+  base::AutoLock lock(lock_);
+  SurfaceMap::iterator it = surface_map_.find(surface_id);
+  if (it == surface_map_.end())
+    return false;
+  const SurfaceInfo& info = it->second;
+  *renderer_id = info.renderer_id;
+  *render_widget_id = info.render_widget_id;
+  return true;
+}
+
+void GpuSurfaceTracker::SetSurfaceHandle(int surface_id,
+                                         gfx::PluginWindowHandle handle) {
+  base::AutoLock lock(lock_);
+  DCHECK(surface_map_.find(surface_id) != surface_map_.end());
+  SurfaceInfo& info = surface_map_[surface_id];
+  info.handle = handle;
+}
+
+gfx::PluginWindowHandle GpuSurfaceTracker::GetSurfaceHandle(int surface_id) {
+  base::AutoLock lock(lock_);
+  DCHECK(surface_map_.find(surface_id) != surface_map_.end());
+  return surface_map_[surface_id].handle;
+}
+
diff --git a/content/browser/gpu/gpu_surface_tracker.h b/content/browser/gpu/gpu_surface_tracker.h
new file mode 100644
index 0000000..17fa13a
--- /dev/null
+++ b/content/browser/gpu/gpu_surface_tracker.h
@@ -0,0 +1,81 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_GPU_GPU_SURFACE_TRACKER_H_
+#define CONTENT_BROWSER_GPU_GPU_SURFACE_TRACKER_H_
+
+#include <map>
+
+#include "base/basictypes.h"
+#include "base/memory/singleton.h"
+#include "base/synchronization/lock.h"
+#include "ui/gfx/native_widget_types.h"
+
+// This class is responsible for managing rendering surfaces exposed to the
+// GPU process. Every surface gets registered to this class, and gets an ID.
+// All calls to and from the GPU process, with the exception of
+// CreateViewCommandBuffer, refer to the rendering surface by its ID.
+// This class is thread safe.
+//
+// Note: The ID can exist before the actual native handle for the surface is
+// created, for example to allow giving a reference to it to a renderer, so that
+// it is unamibiguously identified.
+class GpuSurfaceTracker {
+ public:
+  // Gets the global instance of the surface tracker.
+  static GpuSurfaceTracker* Get() { return GetInstance(); }
+
+  // Adds a surface for a given RenderWidgetHost. |renderer_id| is the renderer
+  // process ID, |render_widget_id| is the RenderWidgetHost route id within that
+  // renderer. Returns the surface ID.
+  int AddSurfaceForRenderer(int renderer_id, int render_widget_id);
+
+  // Looks up a surface for a given RenderWidgetHost. Returns the surface
+  // ID, or 0 if not found.
+  // Note: This is an O(N) lookup.
+  int LookupSurfaceForRenderer(int renderer_id, int render_widget_id);
+
+  // Removes a given existing surface.
+  void RemoveSurface(int surface_id);
+
+  // Gets the renderer process ID and RenderWidgetHost route id for a given
+  // surface, returning true if the surface is found (and corresponds to a
+  // RenderWidgetHost), or false if not.
+  bool GetRenderWidgetIDForSurface(int surface_id,
+                                   int* renderer_id,
+                                   int* render_widget_id);
+
+  // Sets the native handle for the given surface.
+  // Note: This is an O(log N) lookup.
+  void SetSurfaceHandle(int surface_id, gfx::PluginWindowHandle handle);
+
+  // Gets the native handle for the given surface.
+  // Note: This is an O(log N) lookup.
+  gfx::PluginWindowHandle GetSurfaceHandle(int surface_id);
+
+  // Gets the global instance of the surface tracker. Identical to Get(), but
+  // named that way for the implementation of Singleton.
+  static GpuSurfaceTracker* GetInstance();
+
+ private:
+  struct SurfaceInfo {
+    int renderer_id;
+    int render_widget_id;
+    gfx::PluginWindowHandle handle;
+  };
+  typedef std::map<int, SurfaceInfo> SurfaceMap;
+
+  friend struct DefaultSingletonTraits<GpuSurfaceTracker>;
+
+  GpuSurfaceTracker();
+  ~GpuSurfaceTracker();
+
+  base::Lock lock_;
+  SurfaceMap surface_map_;
+  int next_surface_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(GpuSurfaceTracker);
+};
+
+#endif  // CONTENT_BROWSER_GPU_GPU_SURFACE_TRACKER_H_
diff --git a/content/browser/renderer_host/accelerated_surface_container_linux.h b/content/browser/renderer_host/accelerated_surface_container_linux.h
index 1cb8ea1..3083fe3 100644
--- a/content/browser/renderer_host/accelerated_surface_container_linux.h
+++ b/content/browser/renderer_host/accelerated_surface_container_linux.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -21,9 +21,9 @@ class AcceleratedSurfaceContainerLinux {
   virtual void Release() = 0;
 
   // Initialize the surface container, and returns an ID for it.
-  // The |surface_id| given to this function may be modified, and the modified
-  // value should be used to identify the object.
-  virtual bool Initialize(uint64* surface_id) = 0;
+  // The |surface_handle| given to this function may be modified, and the
+  // modified value should be used to identify the object.
+  virtual bool Initialize(uint64* surface_handle) = 0;
 
   // Some implementations of this class use shared memory, this is the handle
   // to the shared buffer, which is part of the surface container.
diff --git a/content/browser/renderer_host/accelerated_surface_container_linux_cc.cc b/content/browser/renderer_host/accelerated_surface_container_linux_cc.cc
index 7c94582..e6936de 100644
--- a/content/browser/renderer_host/accelerated_surface_container_linux_cc.cc
+++ b/content/browser/renderer_host/accelerated_surface_container_linux_cc.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -37,7 +37,7 @@ class AcceleratedSurfaceContainerLinuxCC
   virtual void AddRef() { ui::TextureCC::AddRef(); }
   virtual void Release() { ui::TextureCC::Release(); }
 
-  virtual bool Initialize(uint64* surface_id) OVERRIDE {
+  virtual bool Initialize(uint64* surface_handle) OVERRIDE {
     ui::SharedResourcesCC* instance = ui::SharedResourcesCC::GetInstance();
     DCHECK(instance);
     image_transport_client_.reset(
@@ -45,7 +45,7 @@ class AcceleratedSurfaceContainerLinuxCC
     if (!image_transport_client_.get())
       return false;
 
-    texture_id_ = image_transport_client_->Initialize(surface_id);
+    texture_id_ = image_transport_client_->Initialize(surface_handle);
     if (!texture_id_) {
       image_transport_client_.reset();
       return false;
diff --git a/content/browser/renderer_host/accelerated_surface_container_linux_gl.cc b/content/browser/renderer_host/accelerated_surface_container_linux_gl.cc
index 4f773cd..78d1169 100644
--- a/content/browser/renderer_host/accelerated_surface_container_linux_gl.cc
+++ b/content/browser/renderer_host/accelerated_surface_container_linux_gl.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -23,7 +23,7 @@ class AcceleratedSurfaceContainerLinuxGL
   virtual void AddRef() { ui::TextureGL::AddRef(); }
   virtual void Release() { ui::TextureGL::Release(); }
 
-  virtual bool Initialize(uint64* surface_id) OVERRIDE {
+  virtual bool Initialize(uint64* surface_handle) OVERRIDE {
     ui::SharedResourcesGL* instance = ui::SharedResourcesGL::GetInstance();
     DCHECK(instance);
     image_transport_client_.reset(
@@ -31,7 +31,7 @@ class AcceleratedSurfaceContainerLinuxGL
     if (!image_transport_client_.get())
       return false;
 
-    texture_id_ = image_transport_client_->Initialize(surface_id);
+    texture_id_ = image_transport_client_->Initialize(surface_handle);
     if (!texture_id_) {
       image_transport_client_.reset();
       return false;
diff --git a/content/browser/renderer_host/accelerated_surface_container_mac.cc b/content/browser/renderer_host/accelerated_surface_container_mac.cc
index 86875f3..10b8292 100644
--- a/content/browser/renderer_host/accelerated_surface_container_mac.cc
+++ b/content/browser/renderer_host/accelerated_surface_container_mac.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -14,7 +14,7 @@ AcceleratedSurfaceContainerMac::AcceleratedSurfaceContainerMac(
     bool opaque)
     : manager_(manager),
       opaque_(opaque),
-      surface_id_(0),
+      surface_handle_(0),
       width_(0),
       height_(0),
       texture_(0),
@@ -219,15 +219,15 @@ bool AcceleratedSurfaceContainerMac::ShouldBeVisible() const {
   return visible_ && was_painted_to_ && !clip_rect_.IsEmpty();
 }
 
-void AcceleratedSurfaceContainerMac::set_was_painted_to(uint64 surface_id) {
-  set_was_painted_to_common(surface_id);
+void AcceleratedSurfaceContainerMac::set_was_painted_to(uint64 surface_handle) {
+  set_was_painted_to_common(surface_handle);
   update_rect_ = gfx::Rect();
 }
 
 void AcceleratedSurfaceContainerMac::set_was_painted_to(
-   uint64 surface_id,
+   uint64 surface_handle,
    const gfx::Rect& update_rect) {
-  set_was_painted_to_common(surface_id);
+  set_was_painted_to_common(surface_handle);
   update_rect_ = update_rect_.Union(update_rect);
 }
 
@@ -240,18 +240,18 @@ void AcceleratedSurfaceContainerMac::EnqueueTextureForDeletion() {
 }
 
 void AcceleratedSurfaceContainerMac::set_was_painted_to_common(
-    uint64 surface_id) {
-  if (surface_id && (!surface_ || surface_id != surface_id_)) {
+    uint64 surface_handle) {
+  if (surface_handle && (!surface_ || surface_handle != surface_handle_)) {
     // Keep the surface that was most recently painted to around.
     if (IOSurfaceSupport* io_surface_support = IOSurfaceSupport::Initialize()) {
       CFTypeRef surface = io_surface_support->IOSurfaceLookup(
-          static_cast<uint32>(surface_id));
+          static_cast<uint32>(surface_handle));
       // Can fail if IOSurface with that ID was already released by the
       // gpu process or the plugin process. We will get a |set_was_painted_to()|
       // message with a new surface soon in that case.
       if (surface) {
         surface_.reset(surface);
-        surface_id_ = surface_id;
+        surface_handle_ = surface_handle;
         surface_width_ = io_surface_support->IOSurfaceGetWidth(surface_);
         surface_height_ = io_surface_support->IOSurfaceGetHeight(surface_);
         EnqueueTextureForDeletion();
diff --git a/content/browser/renderer_host/accelerated_surface_container_mac.h b/content/browser/renderer_host/accelerated_surface_container_mac.h
index 1bbf730..fab05ce 100644
--- a/content/browser/renderer_host/accelerated_surface_container_mac.h
+++ b/content/browser/renderer_host/accelerated_surface_container_mac.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -82,8 +82,8 @@ class AcceleratedSurfaceContainerMac {
   bool ShouldBeVisible() const;
 
   // Notifies the the container that its surface was painted to.
-  void set_was_painted_to(uint64 surface_id);
-  void set_was_painted_to(uint64 surface_id,
+  void set_was_painted_to(uint64 surface_handle);
+  void set_was_painted_to(uint64 surface_handle,
                           const gfx::Rect& update_rect);
 
   // Notifies the container that its surface is invalid.
@@ -92,7 +92,7 @@ class AcceleratedSurfaceContainerMac {
   // Enqueue our texture for later deletion.
   void EnqueueTextureForDeletion();
 
-  void set_was_painted_to_common(uint64 surface_id);
+  void set_was_painted_to_common(uint64 surface_handle);
 
   // The manager of this accelerated surface container.
   AcceleratedSurfaceContainerManagerMac* manager_;
@@ -106,8 +106,8 @@ class AcceleratedSurfaceContainerMac {
   // IOSurfaceRef type when building on 10.5.
   base::mac::ScopedCFTypeRef<CFTypeRef> surface_;
 
-  // The id of |surface_|, or 0 if |surface_| is NULL.
-  uint64 surface_id_;
+  // The handle of |surface_|, or 0 if |surface_| is NULL.
+  uint64 surface_handle_;
 
   // The width and height of the io surface. During resizing, this is different
   // from |width_| and |height_|.
diff --git a/content/browser/renderer_host/accelerated_surface_container_manager_mac.cc b/content/browser/renderer_host/accelerated_surface_container_manager_mac.cc
index b31a483..eb2757c 100644
--- a/content/browser/renderer_host/accelerated_surface_container_manager_mac.cc
+++ b/content/browser/renderer_host/accelerated_surface_container_manager_mac.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -138,23 +138,23 @@ void AcceleratedSurfaceContainerManagerMac::ForceTextureReload() {
 }
 
 void AcceleratedSurfaceContainerManagerMac::SetSurfaceWasPaintedTo(
-    gfx::PluginWindowHandle id, uint64 surface_id) {
+    gfx::PluginWindowHandle id, uint64 surface_handle) {
   base::AutoLock lock(lock_);
 
   AcceleratedSurfaceContainerMac* container = MapIDToContainer(id);
   if (container)
-    container->set_was_painted_to(surface_id);
+    container->set_was_painted_to(surface_handle);
 }
 
 void AcceleratedSurfaceContainerManagerMac::SetSurfaceWasPaintedTo(
     gfx::PluginWindowHandle id,
-    uint64 surface_id,
+    uint64 surface_handle,
     const gfx::Rect& update_rect) {
   base::AutoLock lock(lock_);
 
   AcceleratedSurfaceContainerMac* container = MapIDToContainer(id);
   if (container)
-    container->set_was_painted_to(surface_id, update_rect);
+    container->set_was_painted_to(surface_handle, update_rect);
 }
 
 void AcceleratedSurfaceContainerManagerMac::SetRootSurfaceInvalid() {
diff --git a/content/browser/renderer_host/accelerated_surface_container_manager_mac.h b/content/browser/renderer_host/accelerated_surface_container_manager_mac.h
index d342971..a113053 100644
--- a/content/browser/renderer_host/accelerated_surface_container_manager_mac.h
+++ b/content/browser/renderer_host/accelerated_surface_container_manager_mac.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -82,9 +82,10 @@ class AcceleratedSurfaceContainerManagerMac {
   void ForceTextureReload();
 
   // Notifies a surface that it has been painted to.
-  void SetSurfaceWasPaintedTo(gfx::PluginWindowHandle id, uint64 surface_id);
   void SetSurfaceWasPaintedTo(gfx::PluginWindowHandle id,
-                              uint64 surface_id,
+                              uint64 surface_handle);
+  void SetSurfaceWasPaintedTo(gfx::PluginWindowHandle id,
+                              uint64 surface_handle,
                               const gfx::Rect& update_rect);
 
   // Notifies the root container that its surface is invalid.
diff --git a/content/browser/renderer_host/gpu_message_filter.cc b/content/browser/renderer_host/gpu_message_filter.cc
index 0533829..14b3b50 100644
--- a/content/browser/renderer_host/gpu_message_filter.cc
+++ b/content/browser/renderer_host/gpu_message_filter.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -10,6 +10,7 @@
 
 #include "base/bind.h"
 #include "content/browser/gpu/gpu_process_host.h"
+#include "content/browser/gpu/gpu_surface_tracker.h"
 #include "content/browser/renderer_host/render_widget_helper.h"
 #include "content/common/gpu/gpu_messages.h"
 
@@ -74,16 +75,26 @@ void GpuMessageFilter::OnEstablishGpuChannel(
 }
 
 void GpuMessageFilter::OnCreateViewCommandBuffer(
-    int32 render_view_id,
+    int32 surface_id,
     const GPUCreateCommandBufferConfig& init_params,
     IPC::Message* reply) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
-  GpuProcessHost* host = GpuProcessHost::FromID(gpu_host_id_);
+  GpuSurfaceTracker* surface_tracker = GpuSurfaceTracker::Get();
+  gfx::PluginWindowHandle compositing_surface = gfx::kNullPluginWindow;
 
-  gfx::PluginWindowHandle compositing_surface =
-      render_widget_helper_->LookupCompositingSurface(render_view_id);
+  int renderer_id = 0;
+  int render_widget_id = 0;
+  bool result = surface_tracker->GetRenderWidgetIDForSurface(
+      surface_id, &renderer_id, &render_widget_id);
+  if (result && renderer_id == render_process_id_) {
+    compositing_surface = surface_tracker->GetSurfaceHandle(surface_id);
+  } else {
+    DLOG(ERROR) << "Renderer " << render_process_id_
+                << " tried to access a surface for renderer " << renderer_id;
+  }
 
+  GpuProcessHost* host = GpuProcessHost::FromID(gpu_host_id_);
   if (!host || compositing_surface == gfx::kNullPluginWindow) {
     // TODO(apatrick): Eventually, this IPC message will be routed to a
     // GpuProcessStub with a particular routing ID. The error will be set if
@@ -95,7 +106,7 @@ void GpuMessageFilter::OnCreateViewCommandBuffer(
 
   host->CreateViewCommandBuffer(
       compositing_surface,
-      render_view_id,
+      surface_id,
       render_process_id_,
       init_params,
       base::Bind(&GpuMessageFilter::CreateCommandBufferCallback,
diff --git a/content/browser/renderer_host/gpu_message_filter.h b/content/browser/renderer_host/gpu_message_filter.h
index 7d5b91e..afd5b4e 100644
--- a/content/browser/renderer_host/gpu_message_filter.h
+++ b/content/browser/renderer_host/gpu_message_filter.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -43,7 +43,7 @@ class GpuMessageFilter : public content::BrowserMessageFilter,
   void OnEstablishGpuChannel(content::CauseForGpuLaunch,
                              IPC::Message* reply);
   void OnCreateViewCommandBuffer(
-      int32 render_view_id,
+      int32 surface_id,
       const GPUCreateCommandBufferConfig& init_params,
       IPC::Message* reply);
   // Helper callbacks for the message handlers.
diff --git a/content/browser/renderer_host/image_transport_client.cc b/content/browser/renderer_host/image_transport_client.cc
index 16439fb..bec2d71 100644
--- a/content/browser/renderer_host/image_transport_client.cc
+++ b/content/browser/renderer_host/image_transport_client.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -55,11 +55,11 @@ class ImageTransportClientEGL : public ImageTransportClient {
     }
   }
 
-  virtual unsigned int Initialize(uint64* surface_id) {
+  virtual unsigned int Initialize(uint64* surface_handle) {
     scoped_ptr<gfx::ScopedMakeCurrent> bind(resources_->GetScopedMakeCurrent());
     image_ = eglCreateImageKHR(
         gfx::GLSurfaceEGL::GetHardwareDisplay(), EGL_NO_CONTEXT,
-        EGL_NATIVE_PIXMAP_KHR, reinterpret_cast<void*>(*surface_id), NULL);
+        EGL_NATIVE_PIXMAP_KHR, reinterpret_cast<void*>(*surface_handle), NULL);
     if (!image_)
       return 0;
     GLuint texture = CreateTexture();
@@ -100,7 +100,7 @@ class ImageTransportClientGLX : public ImageTransportClient {
       XFreePixmap(dpy, pixmap_);
   }
 
-  virtual unsigned int Initialize(uint64* surface_id) {
+  virtual unsigned int Initialize(uint64* surface_handle) {
     TRACE_EVENT0("renderer_host", "ImageTransportClientGLX::Initialize");
     Display* dpy = static_cast<Display*>(resources_->GetDisplay());
 
@@ -112,7 +112,7 @@ class ImageTransportClientGLX : public ImageTransportClient {
     // We receive a window here rather than a pixmap directly because drivers
     // require (or required) that the pixmap used to create the GL texture be
     // created in the same process as the texture.
-    pixmap_ = XCompositeNameWindowPixmap(dpy, *surface_id);
+    pixmap_ = XCompositeNameWindowPixmap(dpy, *surface_handle);
 
     const int pixmapAttribs[] = {
       GLX_TEXTURE_TARGET_EXT, GLX_TEXTURE_2D_EXT,
@@ -233,19 +233,20 @@ class ImageTransportClientOSMesa : public ImageTransportClient {
   virtual ~ImageTransportClientOSMesa() {
   }
 
-  virtual unsigned int Initialize(uint64* surface_id) {
-    // We expect to make the id here, so don't want the other end giving us one
-    DCHECK_EQ(*surface_id, static_cast<uint64>(0));
+  virtual unsigned int Initialize(uint64* surface_handle) {
+    // We expect to make the handle here, so don't want the other end giving us
+    // one.
+    DCHECK_EQ(*surface_handle, static_cast<uint64>(0));
 
     // It's possible that this ID gneration could clash with IDs from other
     // AcceleratedSurfaceContainerTouch* objects, however we should never have
     // ids active from more than one type at the same time, so we have free
     // reign of the id namespace.
-    *surface_id = next_id_++;
+    *surface_handle = next_handle_++;
 
     shared_mem_.reset(
         TransportDIB::Create(size_.GetArea() * 4,  // GL_RGBA=4 B/px
-        *surface_id));
+        *surface_handle));
     if (!shared_mem_.get())
       return 0;
 
@@ -270,9 +271,9 @@ class ImageTransportClientOSMesa : public ImageTransportClient {
   gfx::Size size_;
   scoped_ptr<TransportDIB> shared_mem_;
   GLuint texture_;
-  static uint32 next_id_;
+  static uint32 next_handle_;
 };
-uint32 ImageTransportClientOSMesa::next_id_ = 0;
+uint32 ImageTransportClientOSMesa::next_handle_ = 0;
 
 #endif //  !USE_WAYLAND
 
diff --git a/content/browser/renderer_host/image_transport_client.h b/content/browser/renderer_host/image_transport_client.h
index afa5e8b..4981a31 100644
--- a/content/browser/renderer_host/image_transport_client.h
+++ b/content/browser/renderer_host/image_transport_client.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -24,7 +24,7 @@ class ImageTransportClient {
 
   // Initializes the client with the surface id. This returns the GL texture id,
   // or 0 if error.
-  virtual unsigned int Initialize(uint64* surface_id) = 0;
+  virtual unsigned int Initialize(uint64* surface_handle) = 0;
 
   // Gets the surface data into the texture.
   virtual void Acquire() = 0;
diff --git a/content/browser/renderer_host/mock_render_process_host.cc b/content/browser/renderer_host/mock_render_process_host.cc
index 989414e..2eafb5f 100644
--- a/content/browser/renderer_host/mock_render_process_host.cc
+++ b/content/browser/renderer_host/mock_render_process_host.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -125,11 +125,6 @@ TransportDIB* MockRenderProcessHost::GetTransportDIB(TransportDIB::Id dib_id) {
   return transport_dib_;
 }
 
-void MockRenderProcessHost::SetCompositingSurface(
-    int render_widget_id,
-    gfx::PluginWindowHandle compositing_surface) {
-}
-
 int MockRenderProcessHost::GetID() const {
   return id_;
 }
diff --git a/content/browser/renderer_host/mock_render_process_host.h b/content/browser/renderer_host/mock_render_process_host.h
index 4a41c43..183af21 100644
--- a/content/browser/renderer_host/mock_render_process_host.h
+++ b/content/browser/renderer_host/mock_render_process_host.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -49,9 +49,6 @@ class MockRenderProcessHost : public content::RenderProcessHost {
   virtual void DumpHandles() OVERRIDE;
   virtual base::ProcessHandle GetHandle() OVERRIDE;
   virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id) OVERRIDE;
-  virtual void SetCompositingSurface(
-      int render_widget_id,
-      gfx::PluginWindowHandle compositing_surface) OVERRIDE;
   virtual int GetID() const OVERRIDE;
   virtual bool HasConnection() const OVERRIDE;
   virtual void SetIgnoreInputEvents(bool ignore_input_events) OVERRIDE;
diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc
index 612e793..6429524 100644
--- a/content/browser/renderer_host/render_message_filter.cc
+++ b/content/browser/renderer_host/render_message_filter.cc
@@ -397,11 +397,14 @@ bool RenderMessageFilter::OffTheRecord() const {
 
 void RenderMessageFilter::OnMsgCreateWindow(
     const ViewHostMsg_CreateWindow_Params& params,
-    int* route_id, int64* cloned_session_storage_namespace_id) {
+    int* route_id,
+    int* surface_id,
+    int64* cloned_session_storage_namespace_id) {
   if (!content::GetContentClient()->browser()->CanCreateWindow(
           GURL(params.opener_security_origin), params.window_container_type,
           resource_context_, render_process_id_)) {
     *route_id = MSG_ROUTING_NONE;
+    *surface_id = 0;
     return;
   }
 
@@ -410,18 +413,23 @@ void RenderMessageFilter::OnMsgCreateWindow(
           params.session_storage_namespace_id);
   render_widget_helper_->CreateNewWindow(params,
                                          peer_handle(),
-                                         route_id);
+                                         route_id,
+                                         surface_id);
 }
 
 void RenderMessageFilter::OnMsgCreateWidget(int opener_id,
                                             WebKit::WebPopupType popup_type,
-                                            int* route_id) {
-  render_widget_helper_->CreateNewWidget(opener_id, popup_type, route_id);
+                                            int* route_id,
+                                            int* surface_id) {
+  render_widget_helper_->CreateNewWidget(
+      opener_id, popup_type, route_id, surface_id);
 }
 
 void RenderMessageFilter::OnMsgCreateFullscreenWidget(int opener_id,
-                                                      int* route_id) {
-  render_widget_helper_->CreateNewFullscreenWidget(opener_id, route_id);
+                                                      int* route_id,
+                                                      int* surface_id) {
+  render_widget_helper_->CreateNewFullscreenWidget(
+      opener_id, route_id, surface_id);
 }
 
 void RenderMessageFilter::OnSetCookie(const IPC::Message& message,
diff --git a/content/browser/renderer_host/render_message_filter.h b/content/browser/renderer_host/render_message_filter.h
index 319e9b9..f0519fd 100644
--- a/content/browser/renderer_host/render_message_filter.h
+++ b/content/browser/renderer_host/render_message_filter.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -101,11 +101,15 @@ class RenderMessageFilter : public content::BrowserMessageFilter {
 
   void OnMsgCreateWindow(const ViewHostMsg_CreateWindow_Params& params,
                          int* route_id,
+                         int* surface_id,
                          int64* cloned_session_storage_namespace_id);
   void OnMsgCreateWidget(int opener_id,
                          WebKit::WebPopupType popup_type,
-                         int* route_id);
-  void OnMsgCreateFullscreenWidget(int opener_id, int* route_id);
+                         int* route_id,
+                         int* surface_id);
+  void OnMsgCreateFullscreenWidget(int opener_id,
+                                   int* route_id,
+                                   int* surface_id);
   void OnSetCookie(const IPC::Message& message,
                    const GURL& url,
                    const GURL& first_party_for_cookies,
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index fc18b2e..60a5a0d 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -833,12 +833,6 @@ void RenderProcessHostImpl::ClearTransportDIBCache() {
   cached_dibs_.clear();
 }
 
-void RenderProcessHostImpl::SetCompositingSurface(
-    int render_widget_id,
-    gfx::PluginWindowHandle compositing_surface) {
-  widget_helper_->SetCompositingSurface(render_widget_id, compositing_surface);
-}
-
 bool RenderProcessHostImpl::Send(IPC::Message* msg) {
   if (!channel_.get()) {
     if (!is_initialized_) {
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index d700aa3..10f4372 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -68,9 +68,6 @@ class CONTENT_EXPORT RenderProcessHostImpl
   virtual void DumpHandles() OVERRIDE;
   virtual base::ProcessHandle GetHandle() OVERRIDE;
   virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id) OVERRIDE;
-  virtual void SetCompositingSurface(
-      int render_widget_id,
-      gfx::PluginWindowHandle compositing_surface) OVERRIDE;
   virtual content::BrowserContext* GetBrowserContext() const OVERRIDE;
   virtual int GetID() const OVERRIDE;
   virtual bool HasConnection() const OVERRIDE;
diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
index b0082c2..1badf4a 100644
--- a/content/browser/renderer_host/render_view_host.cc
+++ b/content/browser/renderer_host/render_view_host.cc
@@ -19,6 +19,7 @@
 #include "base/values.h"
 #include "content/browser/child_process_security_policy.h"
 #include "content/browser/cross_site_request_manager.h"
+#include "content/browser/gpu/gpu_surface_tracker.h"
 #include "content/browser/host_zoom_map.h"
 #include "content/browser/in_process_webkit/session_storage_namespace.h"
 #include "content/browser/power_save_blocker.h"
@@ -177,8 +178,8 @@ bool RenderViewHost::CreateRenderView(const string16& frame_name,
 
   renderer_initialized_ = true;
 
-  process()->SetCompositingSurface(routing_id(),
-                                   GetCompositingSurface());
+  GpuSurfaceTracker::Get()->SetSurfaceHandle(
+      surface_id(), GetCompositingSurface());
 
   // Ensure the RenderView starts with a next_page_id larger than any existing
   // page ID it might be asked to render.
@@ -192,6 +193,7 @@ bool RenderViewHost::CreateRenderView(const string16& frame_name,
       delegate_->GetRendererPrefs(process()->GetBrowserContext());
   params.web_preferences = delegate_->GetWebkitPrefs();
   params.view_id = routing_id();
+  params.surface_id = surface_id();
   params.session_storage_namespace_id = session_storage_namespace_->id();
   params.frame_name = frame_name;
   params.next_page_id = next_page_id;
diff --git a/content/browser/renderer_host/render_widget_helper.cc b/content/browser/renderer_host/render_widget_helper.cc
index 4803956..2124af5 100644
--- a/content/browser/renderer_host/render_widget_helper.cc
+++ b/content/browser/renderer_host/render_widget_helper.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -8,6 +8,7 @@
 #include "base/bind_helpers.h"
 #include "base/eintr_wrapper.h"
 #include "base/threading/thread.h"
+#include "content/browser/gpu/gpu_surface_tracker.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
@@ -212,8 +213,11 @@ void RenderWidgetHelper::OnCrossSiteSwapOutACK(
 void RenderWidgetHelper::CreateNewWindow(
     const ViewHostMsg_CreateWindow_Params& params,
     base::ProcessHandle render_process,
-    int* route_id) {
+    int* route_id,
+    int* surface_id) {
   *route_id = GetNextRoutingID();
+  *surface_id = GpuSurfaceTracker::Get()->AddSurfaceForRenderer(
+      render_process_id_, *route_id);
   // Block resource requests until the view is created, since the HWND might be
   // needed if a response ends up creating a plugin.
   resource_dispatcher_host_->BlockRequestsForRoute(
@@ -221,8 +225,8 @@ void RenderWidgetHelper::CreateNewWindow(
 
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
-      base::Bind(
-          &RenderWidgetHelper::OnCreateWindowOnUI, this, params, *route_id));
+      base::Bind(&RenderWidgetHelper::OnCreateWindowOnUI,
+                 this, params, *route_id));
 }
 
 void RenderWidgetHelper::OnCreateWindowOnUI(
@@ -245,8 +249,11 @@ void RenderWidgetHelper::OnCreateWindowOnIO(int route_id) {
 
 void RenderWidgetHelper::CreateNewWidget(int opener_id,
                                          WebKit::WebPopupType popup_type,
-                                         int* route_id) {
+                                         int* route_id,
+                                         int* surface_id) {
   *route_id = GetNextRoutingID();
+  *surface_id = GpuSurfaceTracker::Get()->AddSurfaceForRenderer(
+      render_process_id_, *route_id);
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(
@@ -255,8 +262,11 @@ void RenderWidgetHelper::CreateNewWidget(int opener_id,
 }
 
 void RenderWidgetHelper::CreateNewFullscreenWidget(int opener_id,
-                                                   int* route_id) {
+                                                   int* route_id,
+                                                   int* surface_id) {
   *route_id = GetNextRoutingID();
+  *surface_id = GpuSurfaceTracker::Get()->AddSurfaceForRenderer(
+      render_process_id_, *route_id);
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(
@@ -334,24 +344,3 @@ void RenderWidgetHelper::ClearAllocatedDIBs() {
   allocated_dibs_.clear();
 }
 #endif
-
-void RenderWidgetHelper::SetCompositingSurface(
-    int render_widget_id,
-    gfx::PluginWindowHandle compositing_surface) {
-  base::AutoLock locked(view_compositing_surface_map_lock_);
-  if (compositing_surface != gfx::kNullPluginWindow)
-    view_compositing_surface_map_[render_widget_id] = compositing_surface;
-  else
-    view_compositing_surface_map_.erase(render_widget_id);
-}
-
-gfx::PluginWindowHandle RenderWidgetHelper::LookupCompositingSurface(
-    int render_widget_id) {
-  base::AutoLock locked(view_compositing_surface_map_lock_);
-  ViewCompositingSurfaceMap::iterator it =
-      view_compositing_surface_map_.find(render_widget_id);
-  if (it == view_compositing_surface_map_.end())
-    return gfx::kNullPluginWindow;
-
-  return it->second;
-}
diff --git a/content/browser/renderer_host/render_widget_helper.h b/content/browser/renderer_host/render_widget_helper.h
index 766566a..f53e445 100644
--- a/content/browser/renderer_host/render_widget_helper.h
+++ b/content/browser/renderer_host/render_widget_helper.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -119,11 +119,6 @@ class RenderWidgetHelper
   TransportDIB* MapTransportDIB(TransportDIB::Id dib_id);
 #endif
 
-  // Set a mapping from a RenderWidgetHost to a compositing surface. Pass a null
-  // handle to remove the mapping.
-  void SetCompositingSurface(int render_widget_id,
-                             gfx::PluginWindowHandle compositing_surface);
-
   // IO THREAD ONLY -----------------------------------------------------------
 
   // Called on the IO thread when a UpdateRect message is received.
@@ -131,11 +126,13 @@ class RenderWidgetHelper
 
   void CreateNewWindow(const ViewHostMsg_CreateWindow_Params& params,
                        base::ProcessHandle render_process,
-                       int* route_id);
+                       int* route_id,
+                       int* surface_id);
   void CreateNewWidget(int opener_id,
                        WebKit::WebPopupType popup_type,
-                       int* route_id);
-  void CreateNewFullscreenWidget(int opener_id, int* route_id);
+                       int* route_id,
+                       int* surface_id);
+  void CreateNewFullscreenWidget(int opener_id, int* route_id, int* surface_id);
 
 #if defined(OS_MACOSX)
   // Called on the IO thread to handle the allocation of a TransportDIB.  If
@@ -151,9 +148,6 @@ class RenderWidgetHelper
   void FreeTransportDIB(TransportDIB::Id dib_id);
 #endif
 
-  // Lookup the compositing surface corresponding to a widget ID.
-  gfx::PluginWindowHandle LookupCompositingSurface(int render_widget_id);
-
  private:
   // A class used to proxy a paint message.  PaintMsgProxy objects are created
   // on the IO thread and destroyed on the UI thread.
@@ -210,11 +204,6 @@ class RenderWidgetHelper
   UpdateMsgProxyMap pending_paints_;
   base::Lock pending_paints_lock_;
 
-  // Maps from view ID to compositing surface.
-  typedef std::map<int, gfx::PluginWindowHandle> ViewCompositingSurfaceMap;
-  ViewCompositingSurfaceMap view_compositing_surface_map_;
-  base::Lock view_compositing_surface_map_lock_;
-
   int render_process_id_;
 
   // Event used to implement WaitForUpdateMsg.
diff --git a/content/browser/renderer_host/render_widget_host.cc b/content/browser/renderer_host/render_widget_host.cc
index 786aeef..38f8115 100644
--- a/content/browser/renderer_host/render_widget_host.cc
+++ b/content/browser/renderer_host/render_widget_host.cc
@@ -16,6 +16,7 @@
 #include "content/browser/accessibility/browser_accessibility_state.h"
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/browser/gpu/gpu_process_host_ui_shim.h"
+#include "content/browser/gpu/gpu_surface_tracker.h"
 #include "content/browser/renderer_host/backing_store.h"
 #include "content/browser/renderer_host/backing_store_manager.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
@@ -80,6 +81,7 @@ RenderWidgetHost::RenderWidgetHost(content::RenderProcessHost* process,
       view_(NULL),
       process_(process),
       routing_id_(routing_id),
+      surface_id_(0),
       is_loading_(false),
       is_hidden_(false),
       is_accelerated_compositing_active_(false),
@@ -101,8 +103,24 @@ RenderWidgetHost::RenderWidgetHost(content::RenderProcessHost* process,
       suppress_next_char_events_(false),
       pending_mouse_lock_request_(false),
       ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)) {
-  if (routing_id_ == MSG_ROUTING_NONE)
+  if (routing_id_ == MSG_ROUTING_NONE) {
     routing_id_ = process_->GetNextRoutingID();
+    surface_id_ = GpuSurfaceTracker::Get()->AddSurfaceForRenderer(
+        process_->GetID(),
+        routing_id_);
+  } else {
+    // TODO(piman): This is a O(N) lookup, where we could forward the
+    // information from the RenderWidgetHelper. The problem is that doing so
+    // currently leaks outside of content all the way to chrome classes, and
+    // would be a layering violation. Since we don't expect more than a few
+    // hundreds of RWH, this seems acceptable. Revisit if performance become a
+    // problem, for example by tracking in the RenderWidgetHelper the routing id
+    // (and surface id) that have been created, but whose RWH haven't yet.
+    surface_id_ = GpuSurfaceTracker::Get()->LookupSurfaceForRenderer(
+        process_->GetID(),
+        routing_id_);
+    DCHECK(surface_id_);
+  }
 
   process_->Attach(this, routing_id_);
   // Because the widget initializes as is_hidden_ == false,
@@ -126,14 +144,19 @@ RenderWidgetHost::~RenderWidgetHost() {
   // Clear our current or cached backing store if either remains.
   BackingStoreManager::RemoveBackingStore(this);
 
+  GpuSurfaceTracker::Get()->RemoveSurface(surface_id_);
+  surface_id_ = 0;
+
   process_->Release(routing_id_);
 }
 
 void RenderWidgetHost::SetView(RenderWidgetHostView* view) {
   view_ = view;
 
-  if (!view_)
-    process_->SetCompositingSurface(routing_id_, gfx::kNullPluginWindow);
+  if (!view_) {
+    GpuSurfaceTracker::Get()->SetSurfaceHandle(
+        surface_id_, gfx::kNullPluginWindow);
+  }
 }
 
 gfx::NativeViewId RenderWidgetHost::GetNativeViewId() const {
@@ -159,8 +182,8 @@ void RenderWidgetHost::Init() {
 
   renderer_initialized_ = true;
 
-  process_->SetCompositingSurface(routing_id_,
-                                  GetCompositingSurface());
+  GpuSurfaceTracker::Get()->SetSurfaceHandle(
+      surface_id_, GetCompositingSurface());
 
   // Send the ack along with the information on placement.
   Send(new ViewMsg_CreatingNew_ACK(routing_id_, GetNativeViewId()));
diff --git a/content/browser/renderer_host/render_widget_host.h b/content/browser/renderer_host/render_widget_host.h
index 422beda..3bb7e30 100644
--- a/content/browser/renderer_host/render_widget_host.h
+++ b/content/browser/renderer_host/render_widget_host.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -160,6 +160,7 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Channel::Listener,
 
   content::RenderProcessHost* process() const { return process_; }
   int routing_id() const { return routing_id_; }
+  int surface_id() const { return surface_id_; }
   bool renderer_accessible() { return renderer_accessible_; }
 
   bool empty() const { return current_size_.IsEmpty(); }
@@ -654,6 +655,9 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Channel::Listener,
   // The ID of the corresponding object in the Renderer Instance.
   int routing_id_;
 
+  // The ID of the surface corresponding to this render widget.
+  int surface_id_;
+
   // Indicates whether a page is loading or not.
   bool is_loading_;
 
diff --git a/content/browser/renderer_host/render_widget_host_unittest.cc b/content/browser/renderer_host/render_widget_host_unittest.cc
index 1b9a894..9feb70e 100644
--- a/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -261,7 +261,7 @@ class RenderWidgetHostTest : public testing::Test {
   void SetUp() {
     browser_context_.reset(new TestBrowserContext());
     process_ = new RenderWidgetHostProcess(browser_context_.get());
-    host_.reset(new MockRenderWidgetHost(process_, 1));
+    host_.reset(new MockRenderWidgetHost(process_, MSG_ROUTING_NONE));
     view_.reset(new TestView(host_.get()));
     host_->SetView(view_.get());
     host_->Init();
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 26bd057..9c3750c 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -346,7 +346,7 @@ void RenderWidgetHostViewAura::AcceleratedSurfaceBuffersSwapped(
     const GpuHostMsg_AcceleratedSurfaceBuffersSwapped_Params& params,
     int gpu_host_id) {
 #if defined(UI_COMPOSITOR_IMAGE_TRANSPORT)
-  current_surface_ = params.surface_id;
+  current_surface_ = params.surface_handle;
   UpdateExternalTexture();
 
   if (!window_->layer()->GetCompositor()) {
@@ -355,7 +355,7 @@ void RenderWidgetHostViewAura::AcceleratedSurfaceBuffersSwapped(
     RenderWidgetHost::AcknowledgeSwapBuffers(params.route_id, gpu_host_id);
   } else {
     gfx::Size surface_size =
-        accelerated_surface_containers_[params.surface_id]->GetSize();
+        accelerated_surface_containers_[params.surface_handle]->GetSize();
     window_->SchedulePaintInRect(gfx::Rect(surface_size));
 
     // Add sending an ACK to the list of things to do OnCompositingEnded
@@ -375,7 +375,7 @@ void RenderWidgetHostViewAura::AcceleratedSurfacePostSubBuffer(
     const GpuHostMsg_AcceleratedSurfacePostSubBuffer_Params& params,
     int gpu_host_id) {
 #if defined(UI_COMPOSITOR_IMAGE_TRANSPORT)
-  current_surface_ = params.surface_id;
+  current_surface_ = params.surface_handle;
   UpdateExternalTexture();
 
   if (!window_->layer()->GetCompositor()) {
@@ -384,7 +384,7 @@ void RenderWidgetHostViewAura::AcceleratedSurfacePostSubBuffer(
     RenderWidgetHost::AcknowledgePostSubBuffer(params.route_id, gpu_host_id);
   } else {
     gfx::Size surface_size =
-        accelerated_surface_containers_[params.surface_id]->GetSize();
+        accelerated_surface_containers_[params.surface_handle]->GetSize();
 
     // Co-ordinates come in OpenGL co-ordinate space.
     // We need to convert to layer space.
@@ -411,28 +411,29 @@ void RenderWidgetHostViewAura::AcceleratedSurfacePostSubBuffer(
 void RenderWidgetHostViewAura::AcceleratedSurfaceNew(
       int32 width,
       int32 height,
-      uint64* surface_id,
-      TransportDIB::Handle* surface_handle) {
+      uint64* surface_handle,
+      TransportDIB::Handle* shm_handle) {
   scoped_refptr<AcceleratedSurfaceContainerLinux> surface(
       AcceleratedSurfaceContainerLinux::Create(gfx::Size(width, height)));
-  if (!surface->Initialize(surface_id)) {
+  if (!surface->Initialize(surface_handle)) {
     LOG(ERROR) << "Failed to create AcceleratedSurfaceContainer";
     return;
   }
-  *surface_handle = surface->Handle();
+  *shm_handle = surface->Handle();
 
-  accelerated_surface_containers_[*surface_id] = surface;
+  accelerated_surface_containers_[*surface_handle] = surface;
 }
 
-void RenderWidgetHostViewAura::AcceleratedSurfaceRelease(uint64 surface_id) {
-  if (current_surface_ == surface_id) {
+void RenderWidgetHostViewAura::AcceleratedSurfaceRelease(
+    uint64 surface_handle) {
+  if (current_surface_ == surface_handle) {
     current_surface_ = gfx::kNullPluginWindow;
     // Don't call UpdateExternalTexture: it's possible that a new surface with
     // the same ID will be re-created right away, in which case we don't want to
     // flip back and forth. Instead wait until we got the accelerated
     // compositing deactivation.
   }
-  accelerated_surface_containers_.erase(surface_id);
+  accelerated_surface_containers_.erase(surface_handle);
 }
 #endif
 
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index 071ed59..1e9585f 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -884,7 +884,7 @@ void RenderWidgetHostViewMac::AcceleratedSurfaceBuffersSwapped(
     last_frame_was_accelerated_ = (params.window ==
         plugin_container_manager_.root_container_handle());
     plugin_container_manager_.SetSurfaceWasPaintedTo(params.window,
-                                                     params.surface_id);
+                                                     params.surface_handle);
 
     // The surface is hidden until its first paint, to not show garbage.
     if (plugin_container_manager_.SurfaceShouldBeVisible(params.window))
@@ -910,7 +910,7 @@ void RenderWidgetHostViewMac::AcceleratedSurfacePostSubBuffer(
         plugin_container_manager_.root_container_handle());
     plugin_container_manager_.SetSurfaceWasPaintedTo(
         params.window,
-        params.surface_id,
+        params.surface_handle,
         gfx::Rect(params.x, params.y, params.width, params.height));
 
     // The surface is hidden until its first paint, to not show garbage.
diff --git a/content/browser/renderer_host/render_widget_host_view_win.cc b/content/browser/renderer_host/render_widget_host_view_win.cc
index 7fcbe3a..87866b2 100644
--- a/content/browser/renderer_host/render_widget_host_view_win.cc
+++ b/content/browser/renderer_host/render_widget_host_view_win.cc
@@ -2082,7 +2082,7 @@ void RenderWidgetHostViewWin::OnAcceleratedCompositingStateChange() {
 void RenderWidgetHostViewWin::AcceleratedSurfaceBuffersSwapped(
     const GpuHostMsg_AcceleratedSurfaceBuffersSwapped_Params& params,
     int gpu_host_id) {
-  if (params.surface_id) {
+  if (params.surface_handle) {
     if (!accelerated_surface_.get() && compositor_host_window_) {
       accelerated_surface_.reset(new AcceleratedSurface);
     }
@@ -2097,7 +2097,7 @@ void RenderWidgetHostViewWin::AcceleratedSurfaceBuffersSwapped(
     accelerated_surface_->AsyncPresentAndAcknowledge(
         compositor_host_window_,
         params.size,
-        params.surface_id,
+        params.surface_handle,
         base::Bind(PostTaskOnIOThread,
                    FROM_HERE,
                    acknowledge_task));
diff --git a/content/browser/renderer_host/text_input_client_mac_unittest.mm b/content/browser/renderer_host/text_input_client_mac_unittest.mm
index c306acd..7de8a09 100644
--- a/content/browser/renderer_host/text_input_client_mac_unittest.mm
+++ b/content/browser/renderer_host/text_input_client_mac_unittest.mm
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -30,7 +30,8 @@ class TextInputClientMacTest : public testing::Test {
       : message_loop_(MessageLoop::TYPE_UI),
         browser_context_(),
         process_factory_(),
-        widget_(process_factory_.CreateRenderProcessHost(&browser_context_), 1),
+        widget_(process_factory_.CreateRenderProcessHost(&browser_context_),
+                MSG_ROUTING_NONE),
         thread_("TextInputClientMacTestThread") {}
 
   // Accessor for the TextInputClientMac instance.
diff --git a/content/browser/tab_contents/tab_contents_delegate_unittest.cc b/content/browser/tab_contents/tab_contents_delegate_unittest.cc
index 421270f..b2183f48 100644
--- a/content/browser/tab_contents/tab_contents_delegate_unittest.cc
+++ b/content/browser/tab_contents/tab_contents_delegate_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -22,9 +22,9 @@ TEST(WebContentsDelegateTest, UnregisterInDestructor) {
   TestBrowserContext browser_context;
 
   scoped_ptr<TabContents> contents_a(
-      new TabContents(&browser_context, NULL, 0, NULL, NULL));
+      new TabContents(&browser_context, NULL, MSG_ROUTING_NONE, NULL, NULL));
   scoped_ptr<TabContents> contents_b(
-      new TabContents(&browser_context, NULL, 0, NULL, NULL));
+      new TabContents(&browser_context, NULL, MSG_ROUTING_NONE, NULL, NULL));
   EXPECT_TRUE(contents_a->GetDelegate() == NULL);
   EXPECT_TRUE(contents_b->GetDelegate() == NULL);