Load NPAPI plugin resources through the browser process directly instead of going through the renderer. This is needed because when we have site isolation enabled we won't trust the renderer to fetch urls from arbitrary origins, which is something that NPAPI plugins can do.

In a followup I'll implement range requests.

For now this is behind the --direct-npapi-requests flag.

BUG=286074
R=ananta@chromium.org, jschuh@chromium.org

Review URL: https://codereview.chromium.org/23503043

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@222602 0039d316-1c4b-4281-b951-d872f2087c98

16 files changed, 407 insertions, 59 deletions

diff --git a/content/child/npapi/plugin_instance.cc b/content/child/npapi/plugin_instance.cc
index d2f2a57..30b3a58 100644
--- a/content/child/npapi/plugin_instance.cc
+++ b/content/child/npapi/plugin_instance.cc
@@ -675,13 +675,9 @@ void PluginInstance::URLRedirectResponse(bool allow, void* notify_data) {
           stream_index != open_streams_.end(); ++stream_index) {
     PluginStream* plugin_stream = stream_index->get();
     if (plugin_stream->notify_data() == notify_data) {
-      WebPluginResourceClient* resource_client =
-          plugin_stream->AsResourceClient();
-      webplugin_->URLRedirectResponse(allow, resource_client->ResourceId());
-      if (allow) {
-        plugin_stream->UpdateUrl(
-            plugin_stream->pending_redirect_url().c_str());
-      }
+      PluginStreamUrl* plugin_stream_url =
+          static_cast<PluginStreamUrl*>(plugin_stream);
+      plugin_stream_url->URLRedirectResponse(allow);
       break;
     }
   }
diff --git a/content/child/npapi/plugin_stream.cc b/content/child/npapi/plugin_stream.cc
index 6656678..8b8a7f7 100644
--- a/content/child/npapi/plugin_stream.cc
+++ b/content/child/npapi/plugin_stream.cc
@@ -45,13 +45,6 @@ PluginStream::~PluginStream() {
   free(const_cast<char*>(stream_.url));
 }
 
-void PluginStream::UpdateUrl(const char* url) {
-  DCHECK(!opened_);
-  free(const_cast<char*>(stream_.url));
-  stream_.url = base::strdup(url);
-  pending_redirect_url_.clear();
-}
-
 bool PluginStream::Open(const std::string& mime_type,
                         const std::string& headers,
                         uint32 length,
diff --git a/content/child/npapi/plugin_stream.h b/content/child/npapi/plugin_stream.h
index af7ad28..644e16c 100644
--- a/content/child/npapi/plugin_stream.h
+++ b/content/child/npapi/plugin_stream.h
@@ -29,10 +29,6 @@ class PluginStream : public base::RefCounted<PluginStream> {
                bool need_notify,
                void* notify_data);
 
-  // In case of a redirect, this can be called to update the url.  But it must
-  // be called before Open().
-  void UpdateUrl(const char* url);
-
   // Opens the stream to the Plugin.
   // If the mime-type is not specified, we'll try to find one based on the
   // mime-types table and the extension (if any) in the URL.
@@ -63,7 +59,9 @@ class PluginStream : public base::RefCounted<PluginStream> {
   // Cancels any HTTP requests initiated by the stream.
   virtual void CancelRequest() {}
 
-  const NPStream* stream() const { return &stream_; }
+  NPStream* stream() { return &stream_; }
+
+  PluginInstance* instance() { return instance_.get(); }
 
   // setter/getter for the seekable attribute on the stream.
   bool seekable() const { return seekable_stream_; }
@@ -75,23 +73,14 @@ class PluginStream : public base::RefCounted<PluginStream> {
 
   void* notify_data() const { return notify_data_; }
 
-  std::string pending_redirect_url() const { return pending_redirect_url_; }
-
  protected:
   friend class base::RefCounted<PluginStream>;
 
   virtual ~PluginStream();
 
-  PluginInstance* instance() { return instance_.get(); }
-
   // Check if the stream is open.
   bool open() { return opened_; }
 
-  // If the plugin participates in HTTP URL redirect handling then this member
-  // holds the url being redirected to while we wait for the plugin to make a
-  // decision on whether to allow or deny the redirect.
-  std::string pending_redirect_url_;
-
  private:
   // Per platform method to reset the temporary file handle.
   void ResetTempFileHandle();
diff --git a/content/child/npapi/plugin_stream_url.cc b/content/child/npapi/plugin_stream_url.cc
index b68d8df..98ea4b1 100644
--- a/content/child/npapi/plugin_stream_url.cc
+++ b/content/child/npapi/plugin_stream_url.cc
@@ -6,9 +6,11 @@
 
 #include <algorithm>
 
+#include "base/strings/string_util.h"
 #include "content/child/npapi/plugin_host.h"
 #include "content/child/npapi/plugin_instance.h"
 #include "content/child/npapi/plugin_lib.h"
+#include "content/child/npapi/plugin_url_fetcher.h"
 #include "content/child/npapi/webplugin.h"
 #include "net/http/http_response_headers.h"
 
@@ -25,6 +27,21 @@ PluginStreamUrl::PluginStreamUrl(
       id_(resource_id) {
 }
 
+void PluginStreamUrl::SetPluginURLFetcher(PluginURLFetcher* fetcher) {
+  plugin_url_fetcher_.reset(fetcher);
+}
+
+void PluginStreamUrl::URLRedirectResponse(bool allow) {
+  if (plugin_url_fetcher_.get()) {
+    plugin_url_fetcher_->URLRedirectResponse(allow);
+  } else {
+    instance()->webplugin()->URLRedirectResponse(allow, id_);
+  }
+
+  if (allow)
+    UpdateUrl(pending_redirect_url_.c_str());
+}
+
 bool PluginStreamUrl::Close(NPReason reason) {
   // Protect the stream against it being destroyed or the whole plugin instance
   // being destroyed within the destroy stream handler.
@@ -41,8 +58,12 @@ WebPluginResourceClient* PluginStreamUrl::AsResourceClient() {
 
 void PluginStreamUrl::CancelRequest() {
   if (id_ > 0) {
-    if (instance()->webplugin()) {
-      instance()->webplugin()->CancelResource(id_);
+    if (plugin_url_fetcher_.get()) {
+      plugin_url_fetcher_->Cancel();
+    } else {
+      if (instance()->webplugin()) {
+        instance()->webplugin()->CancelResource(id_);
+      }
     }
     id_ = 0;
   }
@@ -141,7 +162,7 @@ int PluginStreamUrl::ResourceId() {
 }
 
 PluginStreamUrl::~PluginStreamUrl() {
-  if (instance() && instance()->webplugin()) {
+  if (!plugin_url_fetcher_.get() && instance() && instance()->webplugin()) {
     instance()->webplugin()->ResourceClientDeleted(AsResourceClient());
   }
 }
@@ -159,4 +180,11 @@ void PluginStreamUrl::SetDeferLoading(bool value) {
                                                      value);
 }
 
+void PluginStreamUrl::UpdateUrl(const char* url) {
+  DCHECK(!open());
+  free(const_cast<char*>(stream()->url));
+  stream()->url = base::strdup(url);
+  pending_redirect_url_.clear();
+}
+
 }  // namespace content
diff --git a/content/child/npapi/plugin_stream_url.h b/content/child/npapi/plugin_stream_url.h
index 6cc6ab2..3b52d85 100644
--- a/content/child/npapi/plugin_stream_url.h
+++ b/content/child/npapi/plugin_stream_url.h
@@ -7,13 +7,14 @@
 
 #include <vector>
 
+#include "base/memory/scoped_ptr.h"
 #include "content/child/npapi/plugin_stream.h"
 #include "content/child/npapi/webplugin_resource_client.h"
 #include "url/gurl.h"
 
 namespace content {
-
 class PluginInstance;
+class PluginURLFetcher;
 
 // A NPAPI Stream based on a URL.
 class PluginStreamUrl : public PluginStream,
@@ -29,6 +30,10 @@ class PluginStreamUrl : public PluginStream,
                   bool notify_needed,
                   void *notify_data);
 
+  void SetPluginURLFetcher(PluginURLFetcher* fetcher);
+
+  void URLRedirectResponse(bool allow);
+
   // Stop sending the stream to the client.
   // Overrides the base Close so we can cancel our fetching the URL if
   // it is still loading.
@@ -58,12 +63,23 @@ class PluginStreamUrl : public PluginStream,
  private:
   void SetDeferLoading(bool value);
 
+  // In case of a redirect, this can be called to update the url.  But it must
+  // be called before Open().
+  void UpdateUrl(const char* url);
+
   GURL url_;
   unsigned long id_;
   // Ids of additional resources requested via range requests issued on
   // seekable streams.
   std::vector<unsigned long> range_requests_;
 
+  // If the plugin participates in HTTP URL redirect handling then this member
+  // holds the url being redirected to while we wait for the plugin to make a
+  // decision on whether to allow or deny the redirect.
+  std::string pending_redirect_url_;
+
+  scoped_ptr<PluginURLFetcher> plugin_url_fetcher_;
+
   DISALLOW_COPY_AND_ASSIGN(PluginStreamUrl);
 };
 
diff --git a/content/child/npapi/plugin_url_fetcher.cc b/content/child/npapi/plugin_url_fetcher.cc
new file mode 100644
index 0000000..373f69d
--- /dev/null
+++ b/content/child/npapi/plugin_url_fetcher.cc
@@ -0,0 +1,188 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/npapi/plugin_url_fetcher.h"
+
+#include "content/child/child_thread.h"
+#include "content/child/npapi/webplugin.h"
+#include "content/child/npapi/plugin_host.h"
+#include "content/child/npapi/plugin_instance.h"
+#include "content/child/npapi/plugin_stream_url.h"
+#include "content/child/npapi/webplugin_resource_client.h"
+#include "content/child/plugin_messages.h"
+#include "content/child/resource_dispatcher.h"
+#include "net/base/load_flags.h"
+#include "net/base/net_errors.h"
+#include "net/http/http_response_headers.h"
+#include "webkit/common/resource_request_body.h"
+
+namespace content {
+
+PluginURLFetcher::PluginURLFetcher(PluginStreamUrl* plugin_stream,
+                                   const GURL& url,
+                                   const GURL& first_party_for_cookies,
+                                   const std::string& method,
+                                   const std::string& post_data,
+                                   const GURL& referrer,
+                                   bool notify_redirects,
+                                   bool is_plugin_src_load,
+                                   int origin_pid,
+                                   int render_view_id,
+                                   unsigned long resource_id)
+    : plugin_stream_(plugin_stream),
+      url_(url),
+      first_party_for_cookies_(first_party_for_cookies),
+      method_(method),
+      post_data_(post_data),
+      referrer_(referrer),
+      notify_redirects_(notify_redirects),
+      is_plugin_src_load_(is_plugin_src_load),
+      resource_id_(resource_id),
+      data_offset_(0) {
+  webkit_glue::ResourceLoaderBridge::RequestInfo request_info;
+  request_info.method = method;
+  request_info.url = url;
+  request_info.first_party_for_cookies = first_party_for_cookies;
+  request_info.referrer = referrer;
+  request_info.load_flags = net::LOAD_NORMAL;
+  request_info.requestor_pid = origin_pid;
+  request_info.request_type = ResourceType::OBJECT;
+  request_info.routing_id = render_view_id;
+
+  std::vector<char> body;
+  if (method == "POST") {
+    std::vector<std::string> names;
+    std::vector<std::string> values;
+    PluginHost::SetPostData(
+        post_data.c_str(), post_data.size(), &names, &values, &body);
+    for (size_t i = 0; i < names.size(); ++i) {
+      if (!request_info.headers.empty())
+        request_info.headers += "\r\n";
+
+      request_info.headers += names[i] + ": " + values[i];
+    }
+  }
+
+  bridge_.reset(ChildThread::current()->resource_dispatcher()->CreateBridge(
+      request_info));
+  if (!body.empty()) {
+    scoped_refptr<webkit_glue::ResourceRequestBody> request_body =
+        new webkit_glue::ResourceRequestBody;
+    request_body->AppendBytes(&body[0], body.size());
+    bridge_->SetRequestBody(request_body.get());
+  }
+
+  bridge_->Start(this);
+
+  // TODO(jam): range requests
+}
+
+PluginURLFetcher::~PluginURLFetcher() {
+}
+
+void PluginURLFetcher::Cancel() {
+  bridge_->Cancel();
+}
+
+void PluginURLFetcher::URLRedirectResponse(bool allow) {
+  if (allow) {
+    bridge_->SetDefersLoading(true);
+  } else {
+    bridge_->Cancel();
+    plugin_stream_->DidFail(resource_id_);  // That will delete |this|.
+  }
+}
+
+void PluginURLFetcher::OnUploadProgress(uint64 position, uint64 size) {
+}
+
+bool PluginURLFetcher::OnReceivedRedirect(
+    const GURL& new_url,
+    const webkit_glue::ResourceResponseInfo& info,
+    bool* has_new_first_party_for_cookies,
+    GURL* new_first_party_for_cookies) {
+  // TODO(jam): THIS LOGIC IS COPIED FROM WebPluginImpl::willSendRequest until
+  // kDirectNPAPIRequests is the default and we can remove the old path there.
+
+  // Currently this check is just to catch an https -> http redirect when
+  // loading the main plugin src URL. Longer term, we could investigate
+  // firing mixed diplay or scripting issues for subresource loads
+  // initiated by plug-ins.
+  if (is_plugin_src_load_ &&
+      !plugin_stream_->instance()->webplugin()->CheckIfRunInsecureContent(
+          new_url)) {
+    plugin_stream_->DidFail(resource_id_);  // That will delete |this|.
+    return false;
+  }
+
+  // It's unfortunate that this logic of when a redirect's method changes is
+  // in url_request.cc, but weburlloader_impl.cc and this file have to duplicate
+  // it instead of passing that information.
+  if (info.headers->response_code() != 307)
+    method_ = "GET";
+  GURL old_url = url_;
+  url_ = new_url;
+  *has_new_first_party_for_cookies = true;
+  *new_first_party_for_cookies = first_party_for_cookies_;
+
+  // If the plugin does not participate in url redirect notifications then just
+  // block cross origin 307 POST redirects.
+  if (!notify_redirects_) {
+    if (info.headers->response_code() == 307 && method_ == "POST" &&
+        old_url.GetOrigin() != new_url.GetOrigin()) {
+      plugin_stream_->DidFail(resource_id_);  // That will delete |this|.
+      return false;
+    }
+  } else {
+    // Pause the request while we ask the plugin what to do about the redirect.
+    bridge_->SetDefersLoading(true);
+    plugin_stream_->WillSendRequest(url_, info.headers->response_code());
+  }
+
+  return true;
+}
+
+void PluginURLFetcher::OnReceivedResponse(
+    const webkit_glue::ResourceResponseInfo& info) {
+  // TODO(jam): see WebPluginImpl::didReceiveResponse for request_is_seekable
+  bool request_is_seekable = false;
+  uint32 last_modified = 0;
+
+  base::Time temp;
+  if (info.headers->GetLastModifiedValue(&temp))
+    last_modified = static_cast<uint32>(temp.ToDoubleT());
+
+  std::string headers = info.headers->raw_headers();
+
+  plugin_stream_->DidReceiveResponse(info.mime_type,
+                              headers,
+                              info.content_length,
+                              last_modified,
+                              request_is_seekable);
+}
+
+void PluginURLFetcher::OnDownloadedData(int len,
+                                        int encoded_data_length) {
+}
+
+void PluginURLFetcher::OnReceivedData(const char* data,
+                                      int data_length,
+                                      int encoded_data_length) {
+  plugin_stream_->DidReceiveData(data, data_length, data_offset_);
+  data_offset_ += data_length;
+}
+
+void PluginURLFetcher::OnCompletedRequest(
+    int error_code,
+    bool was_ignored_by_handler,
+    const std::string& security_info,
+    const base::TimeTicks& completion_time) {
+  if (error_code == net::OK) {
+    plugin_stream_->DidFinishLoading(resource_id_);
+  } else {
+    plugin_stream_->DidFail(resource_id_);
+  }
+}
+
+}  // namespace content
diff --git a/content/child/npapi/plugin_url_fetcher.h b/content/child/npapi/plugin_url_fetcher.h
new file mode 100644
index 0000000..0c29987
--- /dev/null
+++ b/content/child/npapi/plugin_url_fetcher.h
@@ -0,0 +1,80 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_NPAPI_URL_FETCHER_H_
+#define CONTENT_CHILD_NPAPI_URL_FETCHER_H_
+
+#include <string>
+
+#include "base/memory/scoped_ptr.h"
+#include "url/gurl.h"
+#include "webkit/child/resource_loader_bridge.h"
+
+namespace webkit_glue {
+class ResourceLoaderBridge;
+}
+
+namespace content {
+class PluginStreamUrl;
+
+// Fetches URLS for a plugin using ResourceDispatcher.
+class PluginURLFetcher : public webkit_glue::ResourceLoaderBridge::Peer {
+ public:
+  PluginURLFetcher(PluginStreamUrl* plugin_stream,
+                   const GURL& url,
+                   const GURL& first_party_for_cookies,
+                   const std::string& method,
+                   const std::string& post_data,
+                   const GURL& referrer,
+                   bool notify_redirects,
+                   bool is_plugin_src_load,
+                   int origin_pid,
+                   int render_view_id,
+                   unsigned long resource_id);
+  virtual ~PluginURLFetcher();
+
+  // Cancels the current request.
+  void Cancel();
+
+  // Called with the plugin's reply to NPP_URLRedirectNotify.
+  void URLRedirectResponse(bool allow);
+
+ private:
+  // webkit_glue::ResourceLoaderBridge::Peer implementation:
+  virtual void OnUploadProgress(uint64 position, uint64 size) OVERRIDE;
+  virtual bool OnReceivedRedirect(const GURL& new_url,
+                                  const webkit_glue::ResourceResponseInfo& info,
+                                  bool* has_new_first_party_for_cookies,
+                                  GURL* new_first_party_for_cookies) OVERRIDE;
+  virtual void OnReceivedResponse(
+      const webkit_glue::ResourceResponseInfo& info) OVERRIDE;
+  virtual void OnDownloadedData(int len, int encoded_data_length) OVERRIDE;
+  virtual void OnReceivedData(const char* data,
+                              int data_length,
+                              int encoded_data_length) OVERRIDE;
+  virtual void OnCompletedRequest(
+      int error_code,
+      bool was_ignored_by_handler,
+      const std::string& security_info,
+      const base::TimeTicks& completion_time) OVERRIDE;
+
+  PluginStreamUrl* plugin_stream_;
+  GURL url_;
+  GURL first_party_for_cookies_;
+  std::string method_;
+  std::string post_data_;
+  GURL referrer_;
+  bool notify_redirects_;
+  bool is_plugin_src_load_;
+  unsigned long resource_id_;
+  int data_offset_;
+
+  scoped_ptr<webkit_glue::ResourceLoaderBridge> bridge_;
+
+  DISALLOW_COPY_AND_ASSIGN(PluginURLFetcher);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_NPAPI_URL_FETCHER_H_
diff --git a/content/child/npapi/webplugin.h b/content/child/npapi/webplugin.h
index 545ee94..c97a78c 100644
--- a/content/child/npapi/webplugin.h
+++ b/content/child/npapi/webplugin.h
@@ -46,14 +46,7 @@ class WebPlugin {
   // Called by the plugin delegate to let it know that the window is being
   // destroyed.
   virtual void WillDestroyWindow(gfx::PluginWindowHandle window) = 0;
-#if defined(OS_WIN)
-  // |pump_messages_event| is a event handle which is used in NPP_HandleEvent
-  // calls to pump messages if the plugin enters a modal loop.
-  // |dummy_activation_window} is used to ensure correct keyboard activation.
-  // It needs to be a child of the parent window.
-  virtual void SetWindowlessData(HANDLE pump_messages_event,
-                                 gfx::NativeViewId dummy_activation_window) = 0;
-#endif
+
   // Cancels a pending request.
   virtual void CancelResource(unsigned long id) = 0;
   virtual void Invalidate() = 0;
@@ -109,6 +102,23 @@ class WebPlugin {
   virtual void SetDeferResourceLoading(unsigned long resource_id,
                                        bool defer) = 0;
 
+  // Handles NPN_URLRedirectResponse calls issued by plugins in response to
+  // HTTP URL redirect notifications.
+  virtual void URLRedirectResponse(bool allow, int resource_id) = 0;
+
+  // Returns true if the new url is a secure transition. This is to catch a
+  // plugin src url transitioning from https to http.
+  virtual bool CheckIfRunInsecureContent(const GURL& url) = 0;
+
+#if defined(OS_WIN)
+  // |pump_messages_event| is a event handle which is used in NPP_HandleEvent
+  // calls to pump messages if the plugin enters a modal loop.
+  // |dummy_activation_window} is used to ensure correct keyboard activation.
+  // It needs to be a child of the parent window.
+  virtual void SetWindowlessData(HANDLE pump_messages_event,
+                                 gfx::NativeViewId dummy_activation_window) = 0;
+#endif
+
 #if defined(OS_MACOSX)
   // Called to inform the WebPlugin that the plugin has gained or lost focus.
   virtual void FocusChanged(bool focused) {}
@@ -128,10 +138,6 @@ class WebPlugin {
                                                    uint32 surface_id) = 0;
   virtual void AcceleratedPluginSwappedIOSurface() = 0;
 #endif
-
-  // Handles NPN_URLRedirectResponse calls issued by plugins in response to
-  // HTTP URL redirect notifications.
-  virtual void URLRedirectResponse(bool allow, int resource_id) = 0;
 };
 
 }  // namespace content
diff --git a/content/child/npapi/webplugin_delegate.h b/content/child/npapi/webplugin_delegate.h
index 005d88f..9e07c3c 100644
--- a/content/child/npapi/webplugin_delegate.h
+++ b/content/child/npapi/webplugin_delegate.h
@@ -28,7 +28,6 @@ class Rect;
 
 namespace content {
 
-class WebPlugin;
 class WebPluginResourceClient;
 
 // This is the interface that a plugin implementation needs to provide.
@@ -48,7 +47,6 @@ class WebPluginDelegate {
   virtual bool Initialize(const GURL& url,
                           const std::vector<std::string>& arg_names,
                           const std::vector<std::string>& arg_values,
-                          WebPlugin* plugin,
                           bool load_manually) = 0;
 
   // Called when the WebPlugin is being destroyed.  This is a signal to the
@@ -129,6 +127,22 @@ class WebPluginDelegate {
   // has become seekable.
   virtual WebPluginResourceClient* CreateSeekableResourceClient(
       unsigned long resource_id, int range_request_id) = 0;
+
+  // Tell the plugin that the given URL should be fetched. This is a result of
+  // loading the plugin data or the plugin calling HandleURLRequest which didn't
+  // end up being routed to another frame or being a javscript:// URL.
+  virtual void FetchURL(unsigned long resource_id,
+                        int notify_id,
+                        const GURL& url,
+                        const GURL& first_party_for_cookies,
+                        const std::string& method,
+                        const std::string& post_data,
+                        const GURL& referrer,
+                        bool notify_redirects,
+                        bool is_plugin_src_load,
+                        int origin_pid,
+                        int render_view_id) = 0;
+
 };
 
 }  // namespace content
diff --git a/content/child/npapi/webplugin_delegate_impl.cc b/content/child/npapi/webplugin_delegate_impl.cc
index b7334aa..1c377bb 100644
--- a/content/child/npapi/webplugin_delegate_impl.cc
+++ b/content/child/npapi/webplugin_delegate_impl.cc
@@ -14,6 +14,7 @@
 #include "content/child/npapi/plugin_instance.h"
 #include "content/child/npapi/plugin_lib.h"
 #include "content/child/npapi/plugin_stream_url.h"
+#include "content/child/npapi/plugin_url_fetcher.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "webkit/glue/webkit_glue.h"
 
@@ -23,6 +24,7 @@ using WebKit::WebInputEvent;
 namespace content {
 
 WebPluginDelegateImpl* WebPluginDelegateImpl::Create(
+    WebPlugin* plugin,
     const base::FilePath& filename,
     const std::string& mime_type) {
   scoped_refptr<PluginLib> plugin_lib(PluginLib::CreatePluginLib(filename));
@@ -34,7 +36,7 @@ WebPluginDelegateImpl* WebPluginDelegateImpl::Create(
     return NULL;
 
   scoped_refptr<PluginInstance> instance(plugin_lib->CreateInstance(mime_type));
-  return new WebPluginDelegateImpl(instance.get());
+  return new WebPluginDelegateImpl(plugin, instance.get());
 }
 
 void WebPluginDelegateImpl::PluginDestroyed() {
@@ -49,10 +51,7 @@ bool WebPluginDelegateImpl::Initialize(
     const GURL& url,
     const std::vector<std::string>& arg_names,
     const std::vector<std::string>& arg_values,
-    WebPlugin* plugin,
     bool load_manually) {
-  plugin_ = plugin;
-
   instance_->set_web_plugin(plugin_);
   if (quirks_ & PLUGIN_QUIRK_DONT_ALLOW_MULTIPLE_INSTANCES) {
     PluginLib* plugin_lib = instance()->plugin_lib();
@@ -301,4 +300,26 @@ WebPluginResourceClient* WebPluginDelegateImpl::CreateSeekableResourceClient(
   return resource_client;
 }
 
+void WebPluginDelegateImpl::FetchURL(unsigned long resource_id,
+                                     int notify_id,
+                                     const GURL& url,
+                                     const GURL& first_party_for_cookies,
+                                     const std::string& method,
+                                     const std::string& post_data,
+                                     const GURL& referrer,
+                                     bool notify_redirects,
+                                     bool is_plugin_src_load,
+                                     int origin_pid,
+                                     int render_view_id) {
+  // TODO(jam): once we switch over to resource loading always happening in this
+  // code path, remove WebPluginResourceClient abstraction.
+  PluginStreamUrl* plugin_stream = instance()->CreateStream(
+      resource_id, url, std::string(), notify_id);
+
+  plugin_stream->SetPluginURLFetcher(new PluginURLFetcher(
+      plugin_stream, url, first_party_for_cookies, method, post_data,
+      referrer, notify_redirects, is_plugin_src_load, origin_pid,
+      render_view_id, resource_id));
+}
+
 }  // namespace content
diff --git a/content/child/npapi/webplugin_delegate_impl.h b/content/child/npapi/webplugin_delegate_impl.h
index 19ccc35..92962ff 100644
--- a/content/child/npapi/webplugin_delegate_impl.h
+++ b/content/child/npapi/webplugin_delegate_impl.h
@@ -41,8 +41,9 @@ class CARenderer;
 #endif
 
 namespace content {
-
 class PluginInstance;
+class PluginURLFetcher;
+class WebPlugin;
 
 #if defined(OS_MACOSX)
 class WebPluginAcceleratedSurface;
@@ -77,14 +78,14 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
     PLUGIN_QUIRK_EMULATE_IME = 131072,  // Windows.
   };
 
-  static WebPluginDelegateImpl* Create(const base::FilePath& filename,
+  static WebPluginDelegateImpl* Create(WebPlugin* plugin,
+                                       const base::FilePath& filename,
                                        const std::string& mime_type);
 
   // WebPluginDelegate implementation
   virtual bool Initialize(const GURL& url,
                           const std::vector<std::string>& arg_names,
                           const std::vector<std::string>& arg_values,
-                          WebPlugin* plugin,
                           bool load_manually) OVERRIDE;
   virtual void PluginDestroyed() OVERRIDE;
   virtual void UpdateGeometry(const gfx::Rect& window_rect,
@@ -116,6 +117,17 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
       unsigned long resource_id, const GURL& url, int notify_id) OVERRIDE;
   virtual WebPluginResourceClient* CreateSeekableResourceClient(
       unsigned long resource_id, int range_request_id) OVERRIDE;
+  virtual void FetchURL(unsigned long resource_id,
+                        int notify_id,
+                        const GURL& url,
+                        const GURL& first_party_for_cookies,
+                        const std::string& method,
+                        const std::string& post_data,
+                        const GURL& referrer,
+                        bool notify_redirects,
+                        bool is_plugin_src_load,
+                        int origin_pid,
+                        int render_view_id) OVERRIDE;
   // End of WebPluginDelegate implementation.
 
   gfx::PluginWindowHandle windowed_handle() const { return windowed_handle_; }
@@ -193,7 +205,7 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
   friend class base::DeleteHelper<WebPluginDelegateImpl>;
   friend class WebPluginDelegate;
 
-  explicit WebPluginDelegateImpl(PluginInstance* instance);
+  WebPluginDelegateImpl(WebPlugin* plugin, PluginInstance* instance);
   virtual ~WebPluginDelegateImpl();
 
   // Called by Initialize() for platform-specific initialization.
diff --git a/content/child/npapi/webplugin_delegate_impl_android.cc b/content/child/npapi/webplugin_delegate_impl_android.cc
index 35c1488..fadaeee 100644
--- a/content/child/npapi/webplugin_delegate_impl_android.cc
+++ b/content/child/npapi/webplugin_delegate_impl_android.cc
@@ -15,11 +15,12 @@ using WebKit::WebInputEvent;
 namespace content {
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : windowed_handle_(0),
       windowed_did_set_window_(false),
       windowless_(false),
-      plugin_(NULL),
+      plugin_(plugin),
       instance_(instance),
       quirks_(0),
       handle_event_depth_(0),
diff --git a/content/child/npapi/webplugin_delegate_impl_aura.cc b/content/child/npapi/webplugin_delegate_impl_aura.cc
index bfe3378..3416990 100644
--- a/content/child/npapi/webplugin_delegate_impl_aura.cc
+++ b/content/child/npapi/webplugin_delegate_impl_aura.cc
@@ -11,7 +11,8 @@ using WebKit::WebInputEvent;
 
 namespace content {
 
-WebPluginDelegateImpl::WebPluginDelegateImpl(PluginInstance* instance) {
+WebPluginDelegateImpl::WebPluginDelegateImpl(WebPlugin* plugin,
+                                             PluginInstance* instance) {
 }
 
 WebPluginDelegateImpl::~WebPluginDelegateImpl() {
diff --git a/content/child/npapi/webplugin_delegate_impl_gtk.cc b/content/child/npapi/webplugin_delegate_impl_gtk.cc
index d50f09a..371d834 100644
--- a/content/child/npapi/webplugin_delegate_impl_gtk.cc
+++ b/content/child/npapi/webplugin_delegate_impl_gtk.cc
@@ -29,11 +29,12 @@ using WebKit::WebMouseEvent;
 namespace content {
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : windowed_handle_(0),
       windowed_did_set_window_(false),
       windowless_(false),
-      plugin_(NULL),
+      plugin_(plugin),
       instance_(instance),
       windowless_shm_pixmap_(None),
       pixmap_(NULL),
diff --git a/content/child/npapi/webplugin_delegate_impl_mac.mm b/content/child/npapi/webplugin_delegate_impl_mac.mm
index 82207b5..2951fca 100644
--- a/content/child/npapi/webplugin_delegate_impl_mac.mm
+++ b/content/child/npapi/webplugin_delegate_impl_mac.mm
@@ -146,11 +146,12 @@ int ExternalDragTracker::WebEventButtonModifierMask() {
 #pragma mark Core WebPluginDelegate implementation
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : windowed_handle_(gfx::kNullPluginWindow),
       // all Mac plugins are "windowless" in the Windows/X11 sense
       windowless_(true),
-      plugin_(NULL),
+      plugin_(plugin),
       instance_(instance),
       quirks_(0),
       use_buffer_context_(true),
diff --git a/content/child/npapi/webplugin_delegate_impl_win.cc b/content/child/npapi/webplugin_delegate_impl_win.cc
index 2f1d488..e788cb2 100644
--- a/content/child/npapi/webplugin_delegate_impl_win.cc
+++ b/content/child/npapi/webplugin_delegate_impl_win.cc
@@ -220,10 +220,11 @@ LRESULT CALLBACK WebPluginDelegateImpl::MouseHookProc(
 }
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
+    WebPlugin* plugin,
     PluginInstance* instance)
     : instance_(instance),
       quirks_(0),
-      plugin_(NULL),
+      plugin_(plugin),
       windowless_(false),
       windowed_handle_(NULL),
       windowed_did_set_window_(false),