Move some more renderer messages to content. Also move a couple of files which should have been moved.TBR=tsepez

R=sky@chromium.org,*,jam@chromium.org,jcivelli@chromium.org,phajdan.jr@chromium.org,darin@chromium.org,brettw@chromium.org,ben@chromium.org
Review URL: http://codereview.chromium.org/6718020

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@78957 0039d316-1c4b-4281-b951-d872f2087c98

14 files changed, 460 insertions, 21 deletions

diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
index f4100c2..8739121 100644
--- a/content/browser/renderer_host/render_view_host.cc
+++ b/content/browser/renderer_host/render_view_host.cc
@@ -561,10 +561,6 @@ void RenderViewHost::GetApplicationInfo(int32 page_id) {
   Send(new ViewMsg_GetApplicationInfo(routing_id(), page_id));
 }
 
-void RenderViewHost::CaptureThumbnail() {
-  Send(new ViewMsg_CaptureThumbnail(routing_id()));
-}
-
 void RenderViewHost::CaptureSnapshot() {
   Send(new ViewMsg_CaptureSnapshot(routing_id()));
 }
@@ -1441,17 +1437,12 @@ void RenderViewHost::ForwardKeyboardEvent(
 
 void RenderViewHost::ForwardEditCommand(const std::string& name,
                                         const std::string& value) {
-  IPC::Message* message = new ViewMsg_ExecuteEditCommand(routing_id(),
-                                                         name,
-                                                         value);
-  Send(message);
+  Send(new ViewMsg_ExecuteEditCommand(routing_id(), name, value));
 }
 
 void RenderViewHost::ForwardEditCommandsForNextKeyEvent(
     const EditCommands& edit_commands) {
-  IPC::Message* message = new ViewMsg_SetEditCommandsForNextKeyEvent(
-      routing_id(), edit_commands);
-  Send(message);
+  Send(new ViewMsg_SetEditCommandsForNextKeyEvent(routing_id(), edit_commands));
 }
 
 void RenderViewHost::ForwardMessageFromExternalHost(const std::string& message,
diff --git a/content/browser/renderer_host/render_view_host.h b/content/browser/renderer_host/render_view_host.h
index d0a0aa9..48eea5b 100644
--- a/content/browser/renderer_host/render_view_host.h
+++ b/content/browser/renderer_host/render_view_host.h
@@ -302,9 +302,6 @@ class RenderViewHost : public RenderWidgetHost {
   // the data is available.
   void GetApplicationInfo(int32 page_id);
 
-  // Captures a thumbnail representation of the page.
-  void CaptureThumbnail();
-
   // Captures a snapshot of the page.
   void CaptureSnapshot();
 
diff --git a/content/browser/renderer_host/render_widget_host.h b/content/browser/renderer_host/render_widget_host.h
index 61021c1..11cc45d 100644
--- a/content/browser/renderer_host/render_widget_host.h
+++ b/content/browser/renderer_host/render_widget_host.h
@@ -16,7 +16,7 @@
 #include "base/scoped_ptr.h"
 #include "base/string16.h"
 #include "base/timer.h"
-#include "chrome/common/edit_command.h"
+#include "content/common/edit_command.h"
 #include "content/common/native_web_keyboard_event.h"
 #include "content/common/property_bag.h"
 #include "ipc/ipc_channel.h"
diff --git a/content/browser/renderer_host/render_widget_host_unittest.cc b/content/browser/renderer_host/render_widget_host_unittest.cc
index d708bed..39a05fb 100644
--- a/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -8,12 +8,12 @@
 #include "base/timer.h"
 #include "build/build_config.h"
 #include "chrome/common/render_messages.h"
-#include "chrome/common/render_messages_params.h"
 #include "chrome/test/testing_profile.h"
 #include "content/browser/renderer_host/backing_store.h"
 #include "content/browser/renderer_host/test_render_view_host.h"
 #include "content/common/notification_details.h"
 #include "content/common/notification_source.h"
+#include "content/common/view_messages.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/keycodes/keyboard_codes.h"
 #include "ui/gfx/canvas_skia.h"
diff --git a/content/common/edit_command.h b/content/common/edit_command.h
new file mode 100644
index 0000000..660cbda
--- /dev/null
+++ b/content/common/edit_command.h
@@ -0,0 +1,25 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_EDIT_COMMAND_H_
+#define CONTENT_COMMON_EDIT_COMMAND_H_
+#pragma once
+
+#include <string>
+#include <vector>
+
+// Types related to sending edit commands to the renderer.
+struct EditCommand {
+  EditCommand() { }
+  EditCommand(const std::string& n, const std::string& v)
+      : name(n), value(v) {
+  }
+
+  std::string name;
+  std::string value;
+};
+
+typedef std::vector<EditCommand> EditCommands;
+
+#endif  // CONTENT_COMMON_EDIT_COMMAND_H_
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index 1f34df0..6ce89e9 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -5,9 +5,15 @@
 // IPC messages for page rendering.
 // Multiply-included message file, hence no include guard.
 
+#include "content/common/common_param_traits.h"
 #include "content/common/css_colors.h"
+#include "content/common/edit_command.h"
 #include "content/common/renderer_preferences.h"
 #include "ipc/ipc_message_macros.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebMediaPlayerAction.h"
+#include "ui/gfx/rect.h"
+#include "webkit/glue/context_menu.h"
+#include "webkit/glue/webmenuitem.h"
 #include "webkit/glue/webpreferences.h"
 
 #define IPC_MESSAGE_START ViewMsgStart
@@ -15,6 +21,14 @@
 IPC_ENUM_TRAITS(CSSColors::CSSColorName)
 IPC_ENUM_TRAITS(RendererPreferencesHintingEnum)
 IPC_ENUM_TRAITS(RendererPreferencesSubpixelRenderingEnum)
+IPC_ENUM_TRAITS(WebKit::WebContextMenuData::MediaType)
+IPC_ENUM_TRAITS(WebKit::WebMediaPlayerAction::Type)
+IPC_ENUM_TRAITS(WebMenuItem::Type)
+
+IPC_STRUCT_TRAITS_BEGIN(EditCommand)
+  IPC_STRUCT_TRAITS_MEMBER(name)
+  IPC_STRUCT_TRAITS_MEMBER(value)
+IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(RendererPreferences)
   IPC_STRUCT_TRAITS_MEMBER(can_accept_load_drops)
@@ -33,6 +47,11 @@ IPC_STRUCT_TRAITS_BEGIN(RendererPreferences)
   IPC_STRUCT_TRAITS_MEMBER(caret_blink_interval)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(WebKit::WebMediaPlayerAction)
+  IPC_STRUCT_TRAITS_MEMBER(type)
+  IPC_STRUCT_TRAITS_MEMBER(enable)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(standard_font_family)
   IPC_STRUCT_TRAITS_MEMBER(fixed_font_family)
@@ -92,6 +111,74 @@ IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(fullscreen_enabled)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(WebMenuItem)
+  IPC_STRUCT_TRAITS_MEMBER(label)
+  IPC_STRUCT_TRAITS_MEMBER(type)
+  IPC_STRUCT_TRAITS_MEMBER(action)
+  IPC_STRUCT_TRAITS_MEMBER(rtl)
+  IPC_STRUCT_TRAITS_MEMBER(has_directional_override)
+  IPC_STRUCT_TRAITS_MEMBER(enabled)
+  IPC_STRUCT_TRAITS_MEMBER(checked)
+  IPC_STRUCT_TRAITS_MEMBER(submenu)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(webkit_glue::CustomContextMenuContext)
+  IPC_STRUCT_TRAITS_MEMBER(is_pepper_menu)
+  IPC_STRUCT_TRAITS_MEMBER(request_id)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(ContextMenuParams)
+  IPC_STRUCT_TRAITS_MEMBER(media_type)
+  IPC_STRUCT_TRAITS_MEMBER(x)
+  IPC_STRUCT_TRAITS_MEMBER(y)
+  IPC_STRUCT_TRAITS_MEMBER(link_url)
+  IPC_STRUCT_TRAITS_MEMBER(unfiltered_link_url)
+  IPC_STRUCT_TRAITS_MEMBER(src_url)
+  IPC_STRUCT_TRAITS_MEMBER(is_image_blocked)
+  IPC_STRUCT_TRAITS_MEMBER(page_url)
+  IPC_STRUCT_TRAITS_MEMBER(frame_url)
+  IPC_STRUCT_TRAITS_MEMBER(frame_content_state)
+  IPC_STRUCT_TRAITS_MEMBER(media_flags)
+  IPC_STRUCT_TRAITS_MEMBER(selection_text)
+  IPC_STRUCT_TRAITS_MEMBER(misspelled_word)
+  IPC_STRUCT_TRAITS_MEMBER(dictionary_suggestions)
+  IPC_STRUCT_TRAITS_MEMBER(spellcheck_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(is_editable)
+#if defined(OS_MACOSX)
+  IPC_STRUCT_TRAITS_MEMBER(writing_direction_default)
+  IPC_STRUCT_TRAITS_MEMBER(writing_direction_left_to_right)
+  IPC_STRUCT_TRAITS_MEMBER(writing_direction_right_to_left)
+#endif  // OS_MACOSX
+  IPC_STRUCT_TRAITS_MEMBER(edit_flags)
+  IPC_STRUCT_TRAITS_MEMBER(security_info)
+  IPC_STRUCT_TRAITS_MEMBER(frame_charset)
+  IPC_STRUCT_TRAITS_MEMBER(custom_context)
+  IPC_STRUCT_TRAITS_MEMBER(custom_items)
+IPC_STRUCT_TRAITS_END()
+
+// This message is used for supporting popup menus on Mac OS X using native
+// Cocoa controls. The renderer sends us this message which we use to populate
+// the popup menu.
+IPC_STRUCT_BEGIN(ViewHostMsg_ShowPopup_Params)
+  // Position on the screen.
+  IPC_STRUCT_MEMBER(gfx::Rect, bounds)
+
+  // The height of each item in the menu.
+  IPC_STRUCT_MEMBER(int, item_height)
+
+  // The size of the font to use for those items.
+  IPC_STRUCT_MEMBER(double, item_font_size)
+
+  // The currently selected (displayed) item in the menu.
+  IPC_STRUCT_MEMBER(int, selected_item)
+
+  // The entire list of items in the popup menu.
+  IPC_STRUCT_MEMBER(std::vector<WebMenuItem>, popup_items)
+
+  // Whether items should be right-aligned.
+  IPC_STRUCT_MEMBER(bool, right_aligned)
+IPC_STRUCT_END()
+
 IPC_STRUCT_BEGIN(ViewMsg_New_Params)
   // The parent window's id.
   IPC_STRUCT_MEMBER(gfx::NativeViewId, parent_window)
@@ -151,7 +238,117 @@ IPC_MESSAGE_ROUTED1(ViewMsg_SetRendererPrefs,
                     RendererPreferences)
 
 // This passes a set of webkit preferences down to the renderer.
-IPC_MESSAGE_ROUTED1(ViewMsg_UpdateWebPreferences, WebPreferences)
+IPC_MESSAGE_ROUTED1(ViewMsg_UpdateWebPreferences,
+                    WebPreferences)
+
+// Tells the render view to close.
+IPC_MESSAGE_ROUTED0(ViewMsg_Close)
+
+// Tells the render view to change its size.  A ViewHostMsg_PaintRect message
+// is generated in response provided new_size is not empty and not equal to
+// the view's current size.  The generated ViewHostMsg_PaintRect message will
+// have the IS_RESIZE_ACK flag set. It also receives the resizer rect so that
+// we don't have to fetch it every time WebKit asks for it.
+IPC_MESSAGE_ROUTED2(ViewMsg_Resize,
+                    gfx::Size /* new_size */,
+                    gfx::Rect /* resizer_rect */)
+
+// Sent to inform the view that it was hidden.  This allows it to reduce its
+// resource utilization.
+IPC_MESSAGE_ROUTED0(ViewMsg_WasHidden)
+
+// Tells the render view that it is no longer hidden (see WasHidden), and the
+// render view is expected to respond with a full repaint if needs_repainting
+// is true.  In that case, the generated ViewHostMsg_PaintRect message will
+// have the IS_RESTORE_ACK flag set.  If needs_repainting is false, then this
+// message does not trigger a message in response.
+IPC_MESSAGE_ROUTED1(ViewMsg_WasRestored,
+                    bool /* needs_repainting */)
+
+// Sent to render the view into the supplied transport DIB, resize
+// the web widget to match the |page_size|, scale it by the
+// appropriate scale to make it fit the |desired_size|, and return
+// it.  In response to this message, the host generates a
+// ViewHostMsg_PaintAtSize_ACK message.  Note that the DIB *must* be
+// the right size to receive an RGBA image at the |desired_size|.
+// |tag| is sent along with ViewHostMsg_PaintAtSize_ACK unmodified to
+// identify the PaintAtSize message the ACK belongs to.
+IPC_MESSAGE_ROUTED4(ViewMsg_PaintAtSize,
+                    TransportDIB::Handle /* dib_handle */,
+                    int /* tag */,
+                    gfx::Size /* page_size */,
+                    gfx::Size /* desired_size */)
+
+// Tells the render view that a ViewHostMsg_UpdateRect message was processed.
+// This signals the render view that it can send another UpdateRect message.
+IPC_MESSAGE_ROUTED0(ViewMsg_UpdateRect_ACK)
+
+// Message payload includes:
+// 1. A blob that should be cast to WebInputEvent
+// 2. An optional boolean value indicating if a RawKeyDown event is associated
+//    to a keyboard shortcut of the browser.
+IPC_MESSAGE_ROUTED0(ViewMsg_HandleInputEvent)
+
+// This message notifies the renderer that the next key event is bound to one
+// or more pre-defined edit commands. If the next key event is not handled
+// by webkit, the specified edit commands shall be executed against current
+// focused frame.
+// Parameters
+// * edit_commands (see chrome/common/edit_command_types.h)
+//   Contains one or more edit commands.
+// See third_party/WebKit/Source/WebCore/editing/EditorCommand.cpp for detailed
+// definition of webkit edit commands.
+//
+// This message must be sent just before sending a key event.
+IPC_MESSAGE_ROUTED1(ViewMsg_SetEditCommandsForNextKeyEvent,
+                    std::vector<EditCommand> /* edit_commands */)
+
+// Message payload is the name/value of a WebCore edit command to execute.
+IPC_MESSAGE_ROUTED2(ViewMsg_ExecuteEditCommand,
+                    std::string, /* name */
+                    std::string /* value */)
+
+IPC_MESSAGE_ROUTED0(ViewMsg_MouseCaptureLost)
+
+// TODO(darin): figure out how this meshes with RestoreFocus
+IPC_MESSAGE_ROUTED1(ViewMsg_SetFocus,
+                    bool /* enable */)
+
+// Tells the renderer to focus the first (last if reverse is true) focusable
+// node.
+IPC_MESSAGE_ROUTED1(ViewMsg_SetInitialFocus,
+                    bool /* reverse */)
+
+// Tells the renderer to scroll the currently focused node into view only if
+// the currently focused node is a Text node (textfield, text area or content
+// editable divs).
+IPC_MESSAGE_ROUTED0(ViewMsg_ScrollFocusedEditableNodeIntoView)
+
+// Executes custom context menu action that was provided from WebKit.
+IPC_MESSAGE_ROUTED2(ViewMsg_CustomContextMenuAction,
+                    webkit_glue::CustomContextMenuContext /* custom_context */,
+                    unsigned /* action */)
+
+// Sent in response to a ViewHostMsg_ContextMenu to let the renderer know that
+// the menu has been closed.
+IPC_MESSAGE_ROUTED1(ViewMsg_ContextMenuClosed,
+                    webkit_glue::CustomContextMenuContext /* custom_context */)
+
+// Tells the renderer to perform the given action on the media player
+// located at the given point.
+IPC_MESSAGE_ROUTED2(ViewMsg_MediaPlayerActionAt,
+                    gfx::Point, /* location */
+                    WebKit::WebMediaPlayerAction)
+
 
 // Messages sent from the renderer to the browser.
 
+// Used to tell the parent that the user right clicked on an area of the
+// content area, and a context menu should be shown for it. The params
+// object contains information about the node(s) that were selected when the
+// user right clicked.
+IPC_MESSAGE_ROUTED1(ViewHostMsg_ContextMenu, ContextMenuParams)
+
+// Message to show a popup menu using native cocoa controls (Mac only).
+IPC_MESSAGE_ROUTED1(ViewHostMsg_ShowPopup,
+                    ViewHostMsg_ShowPopup_Params)
\ No newline at end of file
diff --git a/content/content_common.gypi b/content/content_common.gypi
index d889966..56e36e0 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -69,6 +69,7 @@
         'common/dom_storage_messages.h',
         'common/dx_diag_node.cc',
         'common/dx_diag_node.h',
+        'common/edit_command.h',
         'common/file_path_watcher/file_path_watcher.cc',
         'common/file_path_watcher/file_path_watcher.h',
         'common/file_path_watcher/file_path_watcher_inotify.cc',
diff --git a/content/content_renderer.gypi b/content/content_renderer.gypi
index 0282bf3..6e37ebc 100644
--- a/content/content_renderer.gypi
+++ b/content/content_renderer.gypi
@@ -34,6 +34,8 @@
         'renderer/cookie_message_filter.h',
         'renderer/device_orientation_dispatcher.cc',
         'renderer/device_orientation_dispatcher.h',
+        'renderer/external_popup_menu.cc',
+        'renderer/external_popup_menu.h',
         'renderer/geolocation_dispatcher.cc',
         'renderer/geolocation_dispatcher.h',
         'renderer/ggl.cc',
diff --git a/content/renderer/external_popup_menu.cc b/content/renderer/external_popup_menu.cc
new file mode 100644
index 0000000..0fced1e
--- /dev/null
+++ b/content/renderer/external_popup_menu.cc
@@ -0,0 +1,46 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/external_popup_menu.h"
+
+#include "content/common/view_messages.h"
+#include "content/renderer/render_view.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebExternalPopupMenuClient.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebRect.h"
+
+ExternalPopupMenu::ExternalPopupMenu(
+    RenderView* render_view,
+    const WebKit::WebPopupMenuInfo& popup_menu_info,
+    WebKit::WebExternalPopupMenuClient* popup_menu_client)
+    : render_view_(render_view),
+      popup_menu_info_(popup_menu_info),
+      popup_menu_client_(popup_menu_client) {
+}
+
+void ExternalPopupMenu::show(const WebKit::WebRect& bounds) {
+  ViewHostMsg_ShowPopup_Params popup_params;
+  popup_params.bounds = bounds;
+  popup_params.item_height = popup_menu_info_.itemHeight;
+  popup_params.item_font_size = popup_menu_info_.itemFontSize;
+  popup_params.selected_item = popup_menu_info_.selectedIndex;
+  for (size_t i = 0; i < popup_menu_info_.items.size(); ++i)
+    popup_params.popup_items.push_back(WebMenuItem(popup_menu_info_.items[i]));
+  popup_params.right_aligned = popup_menu_info_.rightAligned;
+  render_view_->Send(
+      new ViewHostMsg_ShowPopup(render_view_->routing_id(), popup_params));
+}
+
+void ExternalPopupMenu::close()  {
+  popup_menu_client_ = NULL;
+  render_view_ = NULL;
+}
+
+void ExternalPopupMenu::DidSelectItem(int index) {
+  if (!popup_menu_client_)
+    return;
+  if (index == -1)
+    popup_menu_client_->didCancel();
+  else
+    popup_menu_client_->didAcceptIndex(index);
+}
diff --git a/content/renderer/external_popup_menu.h b/content/renderer/external_popup_menu.h
new file mode 100644
index 0000000..ef83d071
--- /dev/null
+++ b/content/renderer/external_popup_menu.h
@@ -0,0 +1,39 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
+#define CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
+
+#include "base/basictypes.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebExternalPopupMenu.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebPopupMenuInfo.h"
+
+class RenderView;
+namespace WebKit {
+class WebExternalPopupMenuClient;
+}
+
+class ExternalPopupMenu : public WebKit::WebExternalPopupMenu {
+ public:
+  ExternalPopupMenu(RenderView* render_view,
+                    const WebKit::WebPopupMenuInfo& popup_menu_info,
+                    WebKit::WebExternalPopupMenuClient* popup_menu_client);
+
+  // Called when the user has selected an item. |selected_item| is -1 if the
+  // user canceled the popup.
+  void DidSelectItem(int selected_index);
+
+  // WebKit::WebExternalPopupMenu implementation:
+  virtual void show(const WebKit::WebRect& bounds);
+  virtual void close();
+
+ private:
+  RenderView* render_view_;
+  WebKit::WebPopupMenuInfo popup_menu_info_;
+  WebKit::WebExternalPopupMenuClient* popup_menu_client_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExternalPopupMenu);
+};
+
+#endif  // CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
diff --git a/content/renderer/external_popup_menu_unittest.cc b/content/renderer/external_popup_menu_unittest.cc
new file mode 100644
index 0000000..a2e04dd
--- /dev/null
+++ b/content/renderer/external_popup_menu_unittest.cc
@@ -0,0 +1,140 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/utf_string_conversions.h"
+#include "chrome/test/render_view_test.h"
+#include "content/common/view_messages.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSize.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
+
+// Tests for the external select popup menu (Mac specific).
+
+namespace {
+
+const char* const kSelectID = "mySelect";
+const char* const kEmptySelectID = "myEmptySelect";
+
+}  // namespace
+
+class ExternalPopupMenuTest : public RenderViewTest {
+ public:
+  ExternalPopupMenuTest() {}
+
+  virtual void SetUp() {
+    RenderViewTest::SetUp();
+    // We need to set this explictly as RenderMain is not run.
+    WebKit::WebView::setUseExternalPopupMenus(true);
+
+    std::string html = "<select id='mySelect' onchange='selectChanged(this)'>"
+                       "  <option>zero</option>"
+                       "  <option selected='1'>one</option>"
+                       "  <option>two</option>"
+                       "</select>"
+                       "<select id='myEmptySelect'>"
+                       "</select>";
+    if (ShouldRemoveSelectOnChange()) {
+      html += "<script>"
+              "  function selectChanged(select) {"
+              "    select.parentNode.removeChild(select);"
+              "  }"
+              "</script>";
+    }
+
+    // Load the test page.
+    LoadHTML(html.c_str());
+
+    // Set a minimum size and give focus so simulated events work.
+    view_->webwidget()->resize(WebKit::WebSize(500, 500));
+    view_->webwidget()->setFocus(true);
+  }
+
+  int GetSelectedIndex() {
+    string16 script(ASCIIToUTF16(kSelectID));
+    script.append(ASCIIToUTF16(".selectedIndex"));
+    int selected_index = -1;
+    ExecuteJavaScriptAndReturnIntValue(script, &selected_index);
+    return selected_index;
+  }
+
+ protected:
+  virtual bool ShouldRemoveSelectOnChange() const { return false; }
+
+  DISALLOW_COPY_AND_ASSIGN(ExternalPopupMenuTest);
+};
+
+// Normal case: test showing a select popup, canceling/selecting an item.
+TEST_F(ExternalPopupMenuTest, NormalCase) {
+  IPC::TestSink& sink = render_thread_.sink();
+
+  // Click the text field once.
+  EXPECT_TRUE(SimulateElementClick(kSelectID));
+
+  // We should have sent a message to the browser to show the popup menu.
+  const IPC::Message* message =
+      sink.GetUniqueMessageMatching(ViewHostMsg_ShowPopup::ID);
+  ASSERT_TRUE(message != NULL);
+  Tuple1<ViewHostMsg_ShowPopup_Params> param;
+  ViewHostMsg_ShowPopup::Read(message, &param);
+  ASSERT_EQ(3U, param.a.popup_items.size());
+  EXPECT_EQ(1, param.a.selected_item);
+
+  // Simulate the user canceling the popup, the index should not have changed.
+  view_->OnSelectPopupMenuItem(-1);
+  EXPECT_EQ(1, GetSelectedIndex());
+
+  // Show the pop-up again and this time make a selection.
+  EXPECT_TRUE(SimulateElementClick(kSelectID));
+  view_->OnSelectPopupMenuItem(0);
+  EXPECT_EQ(0, GetSelectedIndex());
+
+  // Show the pop-up again and make another selection.
+  sink.ClearMessages();
+  EXPECT_TRUE(SimulateElementClick(kSelectID));
+  message = sink.GetUniqueMessageMatching(ViewHostMsg_ShowPopup::ID);
+  ASSERT_TRUE(message != NULL);
+  ViewHostMsg_ShowPopup::Read(message, &param);
+  ASSERT_EQ(3U, param.a.popup_items.size());
+  EXPECT_EQ(0, param.a.selected_item);
+}
+
+// Page shows popup, then navigates away while popup showing, then select.
+TEST_F(ExternalPopupMenuTest, ShowPopupThenNavigate) {
+  // Click the text field once.
+  EXPECT_TRUE(SimulateElementClick(kSelectID));
+
+  // Now we navigate to another pager.
+  LoadHTML("<blink>Awesome page!</blink>");
+
+  // Now the user selects something, we should not crash.
+  view_->OnSelectPopupMenuItem(-1);
+}
+
+// An empty select should not cause a crash when clicked.
+// http://crbug.com/63774
+TEST_F(ExternalPopupMenuTest, EmptySelect) {
+  EXPECT_TRUE(SimulateElementClick(kEmptySelectID));
+}
+
+class ExternalPopupMenuRemoveTest : public ExternalPopupMenuTest {
+ public:
+  ExternalPopupMenuRemoveTest() {}
+
+ protected:
+  virtual bool ShouldRemoveSelectOnChange() const { return true; }
+};
+
+// Tests that nothing bad happen when the page removes the select when it
+// changes. (http://crbug.com/61997)
+TEST_F(ExternalPopupMenuRemoveTest, RemoveOnChange) {
+  // Click the text field once to show the popup.
+  EXPECT_TRUE(SimulateElementClick(kSelectID));
+
+  // Select something, it causes the select to be removed from the page.
+  view_->OnSelectPopupMenuItem(0);
+
+  // Just to check the soundness of the test, call SimulateElementClick again.
+  // It should return false as the select has been removed.
+  EXPECT_FALSE(SimulateElementClick(kSelectID));
+}
diff --git a/content/renderer/pepper_plugin_delegate_impl.cc b/content/renderer/pepper_plugin_delegate_impl.cc
index 6f701fb..e4ccc96 100644
--- a/content/renderer/pepper_plugin_delegate_impl.cc
+++ b/content/renderer/pepper_plugin_delegate_impl.cc
@@ -25,6 +25,7 @@
 #include "content/common/file_system/file_system_dispatcher.h"
 #include "content/common/pepper_file_messages.h"
 #include "content/common/pepper_messages.h"
+#include "content/common/view_messages.h"
 #include "content/renderer/audio_message_filter.h"
 #include "content/renderer/command_buffer_proxy.h"
 #include "content/renderer/content_renderer_client.h"
diff --git a/content/renderer/render_view.cc b/content/renderer/render_view.cc
index 13a72e8..c537f11 100644
--- a/content/renderer/render_view.cc
+++ b/content/renderer/render_view.cc
@@ -82,6 +82,7 @@
 #include "content/renderer/audio_message_filter.h"
 #include "content/renderer/content_renderer_client.h"
 #include "content/renderer/device_orientation_dispatcher.h"
+#include "content/renderer/external_popup_menu.h"
 #include "content/renderer/geolocation_dispatcher.h"
 #include "content/renderer/ggl.h"
 #include "content/renderer/load_progress_tracker.h"
@@ -963,7 +964,6 @@ bool RenderView::OnMessageReceived(const IPC::Message& message) {
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderView, message)
-    IPC_MESSAGE_HANDLER(ViewMsg_CaptureThumbnail, OnCaptureThumbnail)
     IPC_MESSAGE_HANDLER(ViewMsg_CaptureSnapshot, OnCaptureSnapshot)
     IPC_MESSAGE_HANDLER(ViewMsg_Navigate, OnNavigate)
     IPC_MESSAGE_HANDLER(ViewMsg_Stop, OnStop)
diff --git a/content/renderer/render_view.h b/content/renderer/render_view.h
index 5166095..3842831 100644
--- a/content/renderer/render_view.h
+++ b/content/renderer/render_view.h
@@ -23,11 +23,10 @@
 #include "base/weak_ptr.h"
 #include "build/build_config.h"
 #include "chrome/common/content_settings.h"
-#include "chrome/common/edit_command.h"
 #include "chrome/common/view_types.h"
-#include "chrome/renderer/external_popup_menu.h"
 #include "chrome/renderer/page_load_histograms.h"
 #include "content/renderer/renderer_webcookiejar_impl.h"
+#include "content/common/edit_command.h"
 #include "content/common/navigation_gesture.h"
 #include "content/common/page_zoom.h"
 #include "content/common/renderer_preferences.h"
@@ -59,8 +58,8 @@ class DeviceOrientationDispatcher;
 class DevToolsAgent;
 class DevToolsClient;
 class DomAutomationController;
-class WebUIBindings;
 class ExternalHostBindings;
+class ExternalPopupMenu;
 class FilePath;
 class GeolocationDispatcher;
 class GeolocationDispatcherOld;
@@ -80,6 +79,7 @@ class SpeechInputDispatcher;
 class SpellCheckProvider;
 class WebPluginDelegatePepper;
 class WebPluginDelegateProxy;
+class WebUIBindings;
 struct ContextMenuMediaParams;
 struct PP_Flash_NetAddress;
 struct ThumbnailScore;