browser-plugin: Allow accepting drag-n-drop events.

This allows dragging content from within the embedder (or other windows) into
the browser-tag plugin.

BUG=120264

Review URL: https://codereview.chromium.org/11088043

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@161457 0039d316-1c4b-4281-b951-d872f2087c98

17 files changed, 339 insertions, 97 deletions

diff --git a/content/browser/browser_plugin/browser_plugin_embedder.cc b/content/browser/browser_plugin/browser_plugin_embedder.cc
index 091c00c..3f001ae 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder.cc
+++ b/content/browser/browser_plugin/browser_plugin_embedder.cc
@@ -95,6 +95,7 @@ void BrowserPluginEmbedder::CreateGuest(RenderViewHost* render_view_host,
 
   guest = guest_web_contents->GetBrowserPluginGuest();
   guest->set_embedder_render_process_host(render_view_host->GetProcess());
+  guest->set_embedder_render_view_host(render_view_host);
 
   RendererPreferences* guest_renderer_prefs =
       guest_web_contents->GetMutableRendererPrefs();
@@ -272,6 +273,17 @@ void BrowserPluginEmbedder::SetGuestVisibility(int instance_id,
     guest->SetVisibility(visible_, guest_visible);
 }
 
+void BrowserPluginEmbedder::DragStatusUpdate(
+    int instance_id,
+    WebKit::WebDragStatus drag_status,
+    const WebDropData& drop_data,
+    WebKit::WebDragOperationsMask drag_mask,
+    const gfx::Point& location) {
+  BrowserPluginGuest* guest = GetGuestByInstanceID(instance_id);
+  if (guest)
+    guest->DragStatusUpdate(drag_status, drop_data, drag_mask, location);
+}
+
 void BrowserPluginEmbedder::Go(int instance_id, int relative_index) {
   BrowserPluginGuest* guest = GetGuestByInstanceID(instance_id);
   if (guest)
diff --git a/content/browser/browser_plugin/browser_plugin_embedder.h b/content/browser/browser_plugin/browser_plugin_embedder.h
index 72fa569..d282798 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder.h
+++ b/content/browser/browser_plugin/browser_plugin_embedder.h
@@ -26,7 +26,10 @@
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
 #include "ui/surface/transport_dib.h"
+#include "webkit/glue/webdropdata.h"
 
 class WebContentsImpl;
 struct BrowserPluginHostMsg_ResizeGuest_Params;
@@ -36,6 +39,7 @@ class WebInputEvent;
 }
 
 namespace gfx {
+class Point;
 class Rect;
 class Size;
 }
@@ -107,6 +111,11 @@ class CONTENT_EXPORT BrowserPluginEmbedder : public WebContentsObserver,
   void PluginDestroyed(int instance_id);
   void SetGuestVisibility(int instance_id,
                           bool guest_visible);
+  void DragStatusUpdate(int instance_id,
+                        WebKit::WebDragStatus drag_status,
+                        const WebDropData& drop_data,
+                        WebKit::WebDragOperationsMask drag_mask,
+                        const gfx::Point& location);
 
   // Overrides factory for testing. Default (NULL) value indicates regular
   // (non-test) environment.
diff --git a/content/browser/browser_plugin/browser_plugin_embedder_helper.cc b/content/browser/browser_plugin/browser_plugin_embedder_helper.cc
index 78866a2..ba63545 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder_helper.cc
+++ b/content/browser/browser_plugin/browser_plugin_embedder_helper.cc
@@ -51,6 +51,8 @@ bool BrowserPluginEmbedderHelper::OnMessageReceived(
     IPC_MESSAGE_HANDLER(BrowserPluginHostMsg_TerminateGuest, OnTerminateGuest)
     IPC_MESSAGE_HANDLER(BrowserPluginHostMsg_SetVisibility,
                         OnSetGuestVisibility)
+    IPC_MESSAGE_HANDLER(BrowserPluginHostMsg_DragStatusUpdate,
+                        OnDragStatusUpdate)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
@@ -160,5 +162,14 @@ void BrowserPluginEmbedderHelper::OnSetGuestVisibility(int instance_id,
   embedder_->SetGuestVisibility(instance_id, visible);
 }
 
+void BrowserPluginEmbedderHelper::OnDragStatusUpdate(
+    int instance_id,
+    WebKit::WebDragStatus drag_status,
+    const WebDropData& drop_data,
+    WebKit::WebDragOperationsMask drag_mask,
+    const gfx::Point& location) {
+  embedder_->DragStatusUpdate(instance_id, drag_status, drop_data, drag_mask,
+      location);
+}
 
 }  // namespace content
diff --git a/content/browser/browser_plugin/browser_plugin_embedder_helper.h b/content/browser/browser_plugin/browser_plugin_embedder_helper.h
index f89cb48..30db73f 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder_helper.h
+++ b/content/browser/browser_plugin/browser_plugin_embedder_helper.h
@@ -9,6 +9,8 @@
 
 #include "base/compiler_specific.h"
 #include "content/public/browser/render_view_host_observer.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
 
 namespace IPC {
 class Message;
@@ -16,10 +18,12 @@ class SyncMessage;
 }
 
 namespace gfx {
+class Point;
 class Size;
 }
 
 struct BrowserPluginHostMsg_ResizeGuest_Params;
+struct WebDropData;
 
 namespace content {
 
@@ -68,6 +72,11 @@ class BrowserPluginEmbedderHelper : public RenderViewHostObserver {
   void OnReload(int instance_id);
   void OnTerminateGuest(int instance_id);
   void OnSetGuestVisibility(int instance_id, bool visible);
+  void OnDragStatusUpdate(int instance_id,
+                          WebKit::WebDragStatus drag_status,
+                          const WebDropData& drop_data,
+                          WebKit::WebDragOperationsMask drag_mask,
+                          const gfx::Point& location);
 
   BrowserPluginEmbedder* embedder_;
 
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index e225583..fc2475a 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -14,6 +14,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/browser_plugin_messages.h"
 #include "content/common/view_messages.h"
+#include "content/port/browser/render_view_host_delegate_view.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_process_host.h"
@@ -23,7 +24,9 @@
 #include "content/public/common/result_codes.h"
 #include "content/browser/browser_plugin/browser_plugin_host_factory.h"
 #include "net/base/net_errors.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebCursorInfo.h"
 #include "ui/surface/transport_dib.h"
+#include "webkit/glue/webdropdata.h"
 #include "webkit/glue/resource_type.h"
 
 namespace content {
@@ -40,6 +43,7 @@ BrowserPluginGuest::BrowserPluginGuest(int instance_id,
                                        RenderViewHost* render_view_host)
     : WebContentsObserver(web_contents),
       embedder_render_process_host_(NULL),
+      embedder_render_view_host_(NULL),
       instance_id_(instance_id),
 #if defined(OS_WIN)
       damage_buffer_size_(0),
@@ -144,6 +148,37 @@ void BrowserPluginGuest::SetVisibility(bool embedder_visible, bool visible) {
     web_contents()->WasHidden();
 }
 
+void BrowserPluginGuest::DragStatusUpdate(WebKit::WebDragStatus drag_status,
+                                          const WebDropData& drop_data,
+                                          WebKit::WebDragOperationsMask mask,
+                                          const gfx::Point& location) {
+  RenderViewHost* host = web_contents()->GetRenderViewHost();
+  switch (drag_status) {
+    case WebKit::WebDragStatusEnter:
+      host->DragTargetDragEnter(drop_data, location, location, mask, 0);
+      break;
+    case WebKit::WebDragStatusOver:
+      host->DragTargetDragOver(location, location, mask, 0);
+      break;
+    case WebKit::WebDragStatusLeave:
+      host->DragTargetDragLeave();
+      break;
+    case WebKit::WebDragStatusDrop:
+      host->DragTargetDrop(location, location, 0);
+      break;
+    case WebKit::WebDragStatusUnknown:
+      NOTREACHED();
+  }
+}
+
+void BrowserPluginGuest::UpdateDragCursor(WebKit::WebDragOperation operation) {
+  CHECK(embedder_render_view_host_);
+  RenderViewHostDelegateView* view =
+      embedder_render_view_host_->GetDelegate()->GetDelegateView();
+  if (view)
+    view->UpdateDragCursor(operation);
+}
+
 WebContents* BrowserPluginGuest::GetWebContents() {
   return web_contents();
 }
diff --git a/content/browser/browser_plugin/browser_plugin_guest.h b/content/browser/browser_plugin/browser_plugin_guest.h
index 3c8254f..d20ab10 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/content/browser/browser_plugin/browser_plugin_guest.h
@@ -38,11 +38,14 @@
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
 #include "ui/gfx/rect.h"
 #include "webkit/glue/webcursor.h"
 
 class TransportDIB;
 struct ViewHostMsg_UpdateRect_Params;
+struct WebDropData;
 
 namespace WebKit {
 class WebInputEvent;
@@ -83,6 +86,9 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
       RenderProcessHost* render_process_host) {
     embedder_render_process_host_ = render_process_host;
   }
+  void set_embedder_render_view_host(RenderViewHost* render_view_host) {
+    embedder_render_view_host_ = render_view_host;
+  }
 
   bool visible() const { return visible_; }
 
@@ -160,6 +166,22 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
   // RenderThreadImpl::IdleHandlerInForegroundTab (executed when visible).
   void SetVisibility(bool embedder_visible, bool visible);
 
+  // Handles drag events from the embedder.
+  // When dragging, the drag events go to the embedder first, and if the drag
+  // happens on the browser plugin, then the plugin sends a corresponding
+  // drag-message to the guest. This routes the drag-message to the guest
+  // renderer.
+  void DragStatusUpdate(WebKit::WebDragStatus drag_status,
+                        const WebDropData& drop_data,
+                        WebKit::WebDragOperationsMask drag_mask,
+                        const gfx::Point& location);
+
+  // Updates the cursor during dragging.
+  // During dragging, if the guest notifies to update the cursor for a drag,
+  // then it is necessary to route the cursor update to the embedder correctly
+  // so that the cursor updates properly.
+  void UpdateDragCursor(WebKit::WebDragOperation operation);
+
   // Exposes the protected web_contents() from WebContentsObserver.
   WebContents* GetWebContents();
 
@@ -218,6 +240,7 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
 
   NotificationRegistrar notification_registrar_;
   RenderProcessHost* embedder_render_process_host_;
+  RenderViewHost* embedder_render_view_host_;
   // An identifier that uniquely identifies a browser plugin guest within an
   // embedder.
   int instance_id_;
diff --git a/content/browser/browser_plugin/browser_plugin_guest_helper.cc b/content/browser/browser_plugin/browser_plugin_guest_helper.cc
index 68512ca..b1de4d9 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_helper.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest_helper.cc
@@ -6,6 +6,7 @@
 
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/common/drag_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/render_view_host.h"
 
@@ -25,6 +26,7 @@ bool BrowserPluginGuestHelper::OnMessageReceived(
     const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(BrowserPluginGuestHelper, message)
+    IPC_MESSAGE_HANDLER(DragHostMsg_UpdateDragCursor, OnUpdateDragCursor)
     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateRect, OnUpdateRect)
     IPC_MESSAGE_HANDLER(ViewHostMsg_HandleInputEvent_ACK, OnHandleInputEventAck)
     IPC_MESSAGE_HANDLER(ViewHostMsg_TakeFocus, OnTakeFocus)
@@ -37,6 +39,11 @@ bool BrowserPluginGuestHelper::OnMessageReceived(
   return handled;
 }
 
+void BrowserPluginGuestHelper::OnUpdateDragCursor(
+    WebKit::WebDragOperation current_op) {
+  guest_->UpdateDragCursor(current_op);
+}
+
 void BrowserPluginGuestHelper::OnUpdateRect(
     const ViewHostMsg_UpdateRect_Params& params) {
   guest_->UpdateRect(render_view_host(), params);
diff --git a/content/browser/browser_plugin/browser_plugin_guest_helper.h b/content/browser/browser_plugin/browser_plugin_guest_helper.h
index fd0c045..d7ead1d 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_helper.h
+++ b/content/browser/browser_plugin/browser_plugin_guest_helper.h
@@ -7,6 +7,7 @@
 
 #include "content/public/browser/render_view_host_observer.h"
 #include "content/public/browser/notification_registrar.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebInputEvent.h"
 
 class WebCursor;
@@ -42,6 +43,7 @@ class BrowserPluginGuestHelper : public RenderViewHostObserver {
 
  private:
   // Message handlers
+  void OnUpdateDragCursor(WebKit::WebDragOperation current_op);
   void OnUpdateRect(const ViewHostMsg_UpdateRect_Params& params);
   void OnHandleInputEventAck(WebKit::WebInputEvent::Type event_type,
                              bool processed);
diff --git a/content/browser/browser_plugin/browser_plugin_host_browsertest.cc b/content/browser/browser_plugin/browser_plugin_host_browsertest.cc
index 4f19031..907a7c8 100644
--- a/content/browser/browser_plugin/browser_plugin_host_browsertest.cc
+++ b/content/browser/browser_plugin/browser_plugin_host_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_view_host_observer.h"
+#include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_utils.h"
@@ -35,9 +36,9 @@ using content::BrowserPluginHostFactory;
 
 namespace {
 
-const char* kHTMLForGuest =
+const char kHTMLForGuest[] =
     "data:text/html,<html><body>hello world</body></html>";
-const char* kHTMLForGuestInfiniteLoop =
+const char kHTMLForGuestInfiniteLoop[] =
     "data:text/html,<html><head><script type=\"text/javascript\">"
     "function StartInfiniteLoop() {"
     "  setTimeout(function () {while (true) {} }, 0);"
@@ -56,11 +57,22 @@ const char kHTMLForGuestTouchHandler[] =
     "     handler);"
     "}"
     "</script></html>";
-const char* kHTMLForGuestWithTitle =
+const char kHTMLForGuestWithTitle[] =
     "data:text/html,"
     "<html><head><title>%s</title></head>"
     "<body>hello world</body>"
     "</html>";
+const char kHTMLForGuestAcceptDrag[] =
+    "data:text/html,<html><body>"
+    "<script>"
+    "function dropped() {"
+    "  document.title = \"DROPPED\";"
+    "}"
+    "</script>"
+    "<textarea id=\"text\" style=\"width:100%; height: 100%\""
+    "    ondrop=\"dropped();\">"
+    "</textarea>"
+    "</body></html>";
 
 std::string GetHTMLForGuestWithTitle(const std::string& title) {
   return StringPrintf(kHTMLForGuestWithTitle, title.c_str());
@@ -233,6 +245,13 @@ class BrowserPluginHostTest : public ContentBrowserTest {
                      false);  // command.
   }
 
+  // Executes the javascript synchronously and makes sure the returned value is
+  // freed properly.
+  void ExecuteSyncJSFunction(RenderViewHost* rvh, const string16& jscript) {
+    scoped_ptr<base::Value> value(rvh->ExecuteJavascriptAndGetValue(
+        string16(), jscript));
+  }
+
   // This helper method does the following:
   // 1. Start the test server and navigate the shell to |embedder_url|.
   // 2. Execute custom pre-navigation |embedder_code| if provided.
@@ -254,18 +273,16 @@ class BrowserPluginHostTest : public ContentBrowserTest {
 
     // Allow the test to do some operations on the embedder before we perform
     // the first navigation of the guest.
-    if (!embedder_code.empty()) {
-      rvh->ExecuteJavascriptAndGetValue(string16(),
-                                        ASCIIToUTF16(embedder_code));
-    }
+    if (!embedder_code.empty())
+      ExecuteSyncJSFunction(rvh, ASCIIToUTF16(embedder_code));
 
     if (!is_guest_data_url) {
       test_url = test_server()->GetURL(guest_url);
-      rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
-          StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
+      ExecuteSyncJSFunction(rvh,
+          ASCIIToUTF16(StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
     } else {
-      rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
-          StringPrintf("SetSrc('%s');", guest_url.c_str())));
+      ExecuteSyncJSFunction(rvh,
+          ASCIIToUTF16(StringPrintf("SetSrc('%s');", guest_url.c_str())));
     }
 
     // Wait to make sure embedder is created/attached to WebContents.
@@ -310,12 +327,11 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, MAYBE_NavigateGuest) {
   // Override the hang timeout for guest to be very small.
   content::BrowserPluginGuest::set_factory_for_testing(
       TestShortHangTimeoutGuestFactory::GetInstance());
-  const char* kEmbedderURL = "files/browser_plugin_embedder_crash.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder_crash.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuestInfiniteLoop, true, "");
 
-  test_guest()->web_contents()->
-      GetRenderViewHost()->ExecuteJavascriptAndGetValue(
-          string16(), ASCIIToUTF16("StartInfiniteLoop();"));
+  ExecuteSyncJSFunction(test_guest()->web_contents()->GetRenderViewHost(),
+                        ASCIIToUTF16("StartInfiniteLoop();"));
 
   // Send a mouse event to the guest.
   SimulateMouseClick(test_embedder()->web_contents());
@@ -334,7 +350,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, NavigateAfterResize) {
   const gfx::Size nxt_size = gfx::Size(100, 200);
   const std::string embedder_code =
       StringPrintf("SetSize(%d, %d);", nxt_size.width(), nxt_size.height());
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, embedder_code);
 
   // Wait for the guest to receive a damage buffer of size 100x200.
@@ -343,7 +359,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, NavigateAfterResize) {
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, AdvanceFocus) {
-  const char* kEmbedderURL = "files/browser_plugin_focus.html";
+  const char kEmbedderURL[] = "files/browser_plugin_focus.html";
   const char* kGuestURL = "files/browser_plugin_focus_child.html";
   StartBrowserPluginTest(kEmbedderURL, kGuestURL, false, "");
 
@@ -374,7 +390,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, EmbedderChangedAfterSwap) {
   ASSERT_TRUE(https_server.Start());
 
   // 1. Load an embedder page with one guest in it.
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
 
   // 2. Navigate to a URL in https, so we trigger a RenderViewHost swap.
@@ -400,7 +416,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, EmbedderChangedAfterSwap) {
 // therefore the embedder created on first page navigation stays the same in
 // web_contents.
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, EmbedderSameAfterNav) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
   WebContentsImpl* embedder_web_contents = test_embedder()->web_contents();
 
@@ -425,13 +441,13 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, EmbedderSameAfterNav) {
 
 // This test verifies that hiding the embedder also hides the guest.
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, BrowserPluginVisibilityChanged) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
 
   // Hide the Browser Plugin.
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       "document.getElementById('plugin').style.visibility = 'hidden'"));
 
   // Make sure that the guest is hidden.
@@ -439,7 +455,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, BrowserPluginVisibilityChanged) {
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, EmbedderVisibilityChanged) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
 
   // Hide the embedder.
@@ -451,14 +467,14 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, EmbedderVisibilityChanged) {
 
 // This test verifies that calling the reload method reloads the guest.
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, ReloadGuest) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
 
   test_guest()->ResetUpdateRectCount();
 
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       "document.getElementById('plugin').reload()"));
   test_guest()->WaitForReload();
 }
@@ -466,12 +482,12 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, ReloadGuest) {
 // This test verifies that calling the stop method forwards the stop request
 // to the guest's WebContents.
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, StopGuest) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
 
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       "document.getElementById('plugin').stop()"));
   test_guest()->WaitForStop();
 }
@@ -479,7 +495,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, StopGuest) {
 // Verifies that installing/uninstalling touch-event handlers in the guest
 // plugin correctly updates the touch-event handling state in the embedder.
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, AcceptTouchEvents) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuestTouchHandler, true, "");
 
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
@@ -491,24 +507,22 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, AcceptTouchEvents) {
   // start listening for touch events too.
   RenderViewHostMessageObserver observer(rvh,
       ViewHostMsg_HasTouchEventHandlers::ID);
-  test_guest()->web_contents()->
-      GetRenderViewHost()->ExecuteJavascriptAndGetValue(
-          string16(), ASCIIToUTF16("InstallTouchHandler();"));
+  ExecuteSyncJSFunction(test_guest()->web_contents()->GetRenderViewHost(),
+                        ASCIIToUTF16("InstallTouchHandler();"));
   observer.WaitUntilMessageReceived();
   EXPECT_TRUE(rvh->has_touch_handler());
 
   // Uninstalling the touch-handler in guest should cause the embedder to stop
   // listening for touch events.
   observer.ResetState();
-  test_guest()->web_contents()->
-      GetRenderViewHost()->ExecuteJavascriptAndGetValue(
-          string16(), ASCIIToUTF16("UninstallTouchHandler();"));
+  ExecuteSyncJSFunction(test_guest()->web_contents()->GetRenderViewHost(),
+                        ASCIIToUTF16("UninstallTouchHandler();"));
   observer.WaitUntilMessageReceived();
   EXPECT_FALSE(rvh->has_touch_handler());
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(
       kEmbedderURL, GetHTMLForGuestWithTitle("P1"), true, "");
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
@@ -520,8 +534,8 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
     content::TitleWatcher title_watcher(test_guest()->web_contents(),
                                         expected_title);
 
-    rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
-        StringPrintf("SetSrc('%s');", GetHTMLForGuestWithTitle("P2").c_str())));
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16(StringPrintf("SetSrc('%s');",
+        GetHTMLForGuestWithTitle("P2").c_str())));
 
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
@@ -533,8 +547,8 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
     content::TitleWatcher title_watcher(test_guest()->web_contents(),
                                         expected_title);
 
-    rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
-        StringPrintf("SetSrc('%s');", GetHTMLForGuestWithTitle("P3").c_str())));
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16(StringPrintf("SetSrc('%s');",
+        GetHTMLForGuestWithTitle("P3").c_str())));
 
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
@@ -546,20 +560,18 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
     content::TitleWatcher title_watcher(test_guest()->web_contents(),
                                         expected_title);
 
-    rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16("Back();"));
-
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16("Back();"));
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
 
-    base::Value* value =
-        rvh->ExecuteJavascriptAndGetValue(string16(),
-                                          ASCIIToUTF16("CanGoBack()"));
+    scoped_ptr<base::Value> value(rvh->ExecuteJavascriptAndGetValue(string16(),
+        ASCIIToUTF16("CanGoBack()")));
     bool result = false;
     ASSERT_TRUE(value->GetAsBoolean(&result));
     EXPECT_TRUE(result);
 
-    value = rvh->ExecuteJavascriptAndGetValue(string16(),
-                                              ASCIIToUTF16("CanGoForward()"));
+    value.reset(rvh->ExecuteJavascriptAndGetValue(string16(),
+        ASCIIToUTF16("CanGoForward()")));
     result = false;
     ASSERT_TRUE(value->GetAsBoolean(&result));
     EXPECT_TRUE(result);
@@ -571,14 +583,12 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
     content::TitleWatcher title_watcher(test_guest()->web_contents(),
                                         expected_title);
 
-    rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16("Forward();"));
-
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16("Forward();"));
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
 
-    base::Value* value =
-        rvh->ExecuteJavascriptAndGetValue(string16(),
-                                          ASCIIToUTF16("CanGoForward()"));
+    scoped_ptr<base::Value> value(rvh->ExecuteJavascriptAndGetValue(string16(),
+        ASCIIToUTF16("CanGoForward()")));
     bool result = true;
     ASSERT_TRUE(value->GetAsBoolean(&result));
     EXPECT_FALSE(result);
@@ -590,14 +600,12 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
     content::TitleWatcher title_watcher(test_guest()->web_contents(),
                                         expected_title);
 
-    rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16("Go(-2);"));
-
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16("Go(-2);"));
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
 
-    base::Value* value =
-        rvh->ExecuteJavascriptAndGetValue(string16(),
-                                          ASCIIToUTF16("CanGoBack()"));
+    scoped_ptr<base::Value> value(rvh->ExecuteJavascriptAndGetValue(string16(),
+        ASCIIToUTF16("CanGoBack()")));
     bool result = true;
     ASSERT_TRUE(value->GetAsBoolean(&result));
     EXPECT_FALSE(result);
@@ -607,7 +615,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, Renavigate) {
 // This tests verifies that reloading the embedder does not crash the browser
 // and that the guest is reset.
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, ReloadEmbedder) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
@@ -620,8 +628,8 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, ReloadEmbedder) {
     content::TitleWatcher title_watcher(test_embedder()->web_contents(),
                                         expected_title);
 
-    rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
-        StringPrintf("SetTitle('%s');", "modified")));
+    ExecuteSyncJSFunction(rvh, ASCIIToUTF16(StringPrintf("SetTitle('%s');",
+        "modified")));
 
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
@@ -638,9 +646,8 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, ReloadEmbedder) {
     string16 actual_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expected_title, actual_title);
 
-    test_embedder()->web_contents()->GetRenderViewHost()->
-        ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
-            StringPrintf("SetSrc('%s');", kHTMLForGuest)));
+    ExecuteSyncJSFunction(test_embedder()->web_contents()->GetRenderViewHost(),
+        ASCIIToUTF16(StringPrintf("SetSrc('%s');", kHTMLForGuest)));
 
     const BrowserPluginEmbedder::ContainerInstanceMap& instance_map =
         test_embedder()->guest_web_contents_for_testing();
@@ -656,12 +663,12 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, ReloadEmbedder) {
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, TerminateGuest) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, kHTMLForGuest, true, "");
 
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       "document.getElementById('plugin').terminate()"));
 
   // Expect the guest to crash.
@@ -669,7 +676,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, TerminateGuest) {
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadStart) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, "about:blank", true, "");
 
   const string16 expected_title = ASCIIToUTF16(kHTMLForGuest);
@@ -678,7 +685,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadStart) {
   // Renavigate the guest to |kHTMLForGuest|.
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       StringPrintf("SetSrc('%s');", kHTMLForGuest)));
 
   string16 actual_title = title_watcher.WaitAndGetTitle();
@@ -686,7 +693,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadStart) {
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadAbort) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, "about:blank", true, "");
 
   const string16 expected_title = ASCIIToUTF16("ERR_EMPTY_RESPONSE");
@@ -697,7 +704,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadAbort) {
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
   GURL test_url = test_server()->GetURL("close-socket");
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       StringPrintf("SetSrc('%s');", test_url.spec().c_str())));
 
   string16 actual_title = title_watcher.WaitAndGetTitle();
@@ -705,7 +712,7 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadAbort) {
 }
 
 IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadRedirect) {
-  const char* kEmbedderURL = "files/browser_plugin_embedder.html";
+  const char kEmbedderURL[] = "files/browser_plugin_embedder.html";
   StartBrowserPluginTest(kEmbedderURL, "about:blank", true, "");
 
   const string16 expected_title = ASCIIToUTF16("redirected");
@@ -717,23 +724,70 @@ IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, LoadRedirect) {
       "server-redirect?files/title1.html"));
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       test_embedder()->web_contents()->GetRenderViewHost());
-  rvh->ExecuteJavascriptAndGetValue(string16(), ASCIIToUTF16(
+  ExecuteSyncJSFunction(rvh, ASCIIToUTF16(
       StringPrintf("SetSrc('%s');", redirect_url.spec().c_str())));
 
   string16 actual_title = title_watcher.WaitAndGetTitle();
   EXPECT_EQ(expected_title, actual_title);
 
   // Verify that we heard a loadRedirect during the navigation.
-  base::Value* v = rvh->ExecuteJavascriptAndGetValue(
-      string16(), ASCIIToUTF16("redirectOldUrl"));
+  scoped_ptr<base::Value> value(rvh->ExecuteJavascriptAndGetValue(
+      string16(), ASCIIToUTF16("redirectOldUrl")));
   std::string result;
-  EXPECT_TRUE(v->GetAsString(&result));
+  EXPECT_TRUE(value->GetAsString(&result));
   EXPECT_EQ(redirect_url.spec().c_str(), result);
 
-  v = rvh->ExecuteJavascriptAndGetValue(
-      string16(), ASCIIToUTF16("redirectNewUrl"));
-  EXPECT_TRUE(v->GetAsString(&result));
+  value.reset(rvh->ExecuteJavascriptAndGetValue(
+      string16(), ASCIIToUTF16("redirectNewUrl")));
+  EXPECT_TRUE(value->GetAsString(&result));
   EXPECT_EQ(test_server()->GetURL("files/title1.html").spec().c_str(), result);
 }
 
+// Tests that a drag-n-drop over the browser plugin in the embedder happens
+// correctly.
+IN_PROC_BROWSER_TEST_F(BrowserPluginHostTest, AcceptDragEvents) {
+  const char kEmbedderURL[] = "files/browser_plugin_dragging.html";
+  StartBrowserPluginTest(kEmbedderURL, kHTMLForGuestAcceptDrag, true, "");
+
+  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
+      test_embedder()->web_contents()->GetRenderViewHost());
+
+  // Get a location in the embedder outside of the plugin.
+  base::ListValue *start, *end;
+  scoped_ptr<base::Value> value(rvh->ExecuteJavascriptAndGetValue(string16(),
+      ASCIIToUTF16("dragLocation()")));
+  ASSERT_TRUE(value->GetAsList(&start) && start->GetSize() == 2);
+  double start_x, start_y;
+  ASSERT_TRUE(start->GetDouble(0, &start_x) && start->GetDouble(1, &start_y));
+
+  // Get a location in the embedder that falls inside the plugin.
+  value.reset(rvh->ExecuteJavascriptAndGetValue(string16(),
+      ASCIIToUTF16("dropLocation()")));
+  ASSERT_TRUE(value->GetAsList(&end) && end->GetSize() == 2);
+  double end_x, end_y;
+  ASSERT_TRUE(end->GetDouble(0, &end_x) && end->GetDouble(1, &end_y));
+
+  WebDropData drop_data;
+  GURL url = GURL("https://www.domain.com/index.html");
+  drop_data.url = url;
+
+  // Pretend that the URL is being dragged over the embedder. Start the drag
+  // from outside the plugin, then move the drag inside the plugin and drop.
+  // This should trigger appropriate messages from the embedder to the guest,
+  // and end with a drop on the guest. The guest changes title when a drop
+  // happens.
+  const string16 expected_title = ASCIIToUTF16("DROPPED");
+  content::TitleWatcher title_watcher(test_guest()->web_contents(),
+      expected_title);
+
+  rvh->DragTargetDragEnter(drop_data, gfx::Point(start_x, start_y),
+      gfx::Point(start_x, start_y), WebKit::WebDragOperationEvery, 0);
+  rvh->DragTargetDragOver(gfx::Point(end_x, end_y), gfx::Point(end_x, end_y),
+      WebKit::WebDragOperationEvery, 0);
+  rvh->DragTargetDrop(gfx::Point(end_x, end_y), gfx::Point(end_x, end_y), 0);
+
+  string16 actual_title = title_watcher.WaitAndGetTitle();
+  EXPECT_EQ(expected_title, actual_title);
+}
+
 }  // namespace content
diff --git a/content/common/browser_plugin_messages.h b/content/common/browser_plugin_messages.h
index 67520a8..69de1ee 100644
--- a/content/common/browser_plugin_messages.h
+++ b/content/common/browser_plugin_messages.h
@@ -14,15 +14,21 @@
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_message_macros.h"
 #include "ipc/ipc_message_utils.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
+#include "ui/gfx/point.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/size.h"
 #include "webkit/glue/webcursor.h"
+#include "webkit/glue/webdropdata.h"
 
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
 #define IPC_MESSAGE_START BrowserPluginMsgStart
 
+IPC_ENUM_TRAITS(WebKit::WebDragStatus)
+
 // Browser plugin messages
 
 // -----------------------------------------------------------------------------
@@ -122,6 +128,14 @@ IPC_MESSAGE_ROUTED2(BrowserPluginHostMsg_SetVisibility,
                     int /* instance_id */,
                     bool /* visible */)
 
+// Tells the guest that a drag event happened on the plugin.
+IPC_MESSAGE_ROUTED5(BrowserPluginHostMsg_DragStatusUpdate,
+                    int /* instance_id */,
+                    WebKit::WebDragStatus /* drag_status */,
+                    WebDropData /* drop_data */,
+                    WebKit::WebDragOperationsMask /* operation_mask */,
+                    gfx::Point /* plugin_location */)
+
 // -----------------------------------------------------------------------------
 // These messages are from the guest renderer to the browser process
 
diff --git a/content/common/content_message_generator.h b/content/common/content_message_generator.h
index 59f8dfe..72a3902 100644
--- a/content/common/content_message_generator.h
+++ b/content/common/content_message_generator.h
@@ -18,6 +18,7 @@
 #include "content/common/devtools_messages.h"
 #include "content/common/dom_storage_messages.h"
 #include "content/common/drag_messages.h"
+#include "content/common/drag_traits.h"
 #include "content/common/file_utilities_messages.h"
 #include "content/common/fileapi/file_system_messages.h"
 #include "content/common/fileapi/webblob_messages.h"
diff --git a/content/common/drag_messages.h b/content/common/drag_messages.h
index 26cb7d3..f1d8ce7 100644
--- a/content/common/drag_messages.h
+++ b/content/common/drag_messages.h
@@ -14,28 +14,6 @@
 
 #define IPC_MESSAGE_START DragMsgStart
 
-IPC_ENUM_TRAITS(WebKit::WebDragOperation)
-
-IPC_STRUCT_TRAITS_BEGIN(WebDropData::FileInfo)
-  IPC_STRUCT_TRAITS_MEMBER(path)
-  IPC_STRUCT_TRAITS_MEMBER(display_name)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(WebDropData)
-  IPC_STRUCT_TRAITS_MEMBER(url)
-  IPC_STRUCT_TRAITS_MEMBER(url_title)
-  IPC_STRUCT_TRAITS_MEMBER(download_metadata)
-  IPC_STRUCT_TRAITS_MEMBER(referrer_policy)
-  IPC_STRUCT_TRAITS_MEMBER(filenames)
-  IPC_STRUCT_TRAITS_MEMBER(filesystem_id)
-  IPC_STRUCT_TRAITS_MEMBER(text)
-  IPC_STRUCT_TRAITS_MEMBER(html)
-  IPC_STRUCT_TRAITS_MEMBER(html_base_url)
-  IPC_STRUCT_TRAITS_MEMBER(file_description_filename)
-  IPC_STRUCT_TRAITS_MEMBER(file_contents)
-  IPC_STRUCT_TRAITS_MEMBER(custom_data)
-IPC_STRUCT_TRAITS_END()
-
 // Messages sent from the browser to the renderer.
 
 IPC_MESSAGE_ROUTED5(DragMsg_TargetDragEnter,
diff --git a/content/common/drag_traits.h b/content/common/drag_traits.h
new file mode 100644
index 0000000..ccd841b
--- /dev/null
+++ b/content/common/drag_traits.h
@@ -0,0 +1,33 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/common_param_traits.h"
+#include "ipc/ipc_message_macros.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
+#include "ui/gfx/point.h"
+#include "webkit/glue/webdropdata.h"
+
+#define IPC_MESSAGE_START DragMsgStart
+
+IPC_ENUM_TRAITS(WebKit::WebDragOperation)
+
+IPC_STRUCT_TRAITS_BEGIN(WebDropData::FileInfo)
+  IPC_STRUCT_TRAITS_MEMBER(path)
+  IPC_STRUCT_TRAITS_MEMBER(display_name)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(WebDropData)
+  IPC_STRUCT_TRAITS_MEMBER(url)
+  IPC_STRUCT_TRAITS_MEMBER(url_title)
+  IPC_STRUCT_TRAITS_MEMBER(download_metadata)
+  IPC_STRUCT_TRAITS_MEMBER(referrer_policy)
+  IPC_STRUCT_TRAITS_MEMBER(filenames)
+  IPC_STRUCT_TRAITS_MEMBER(filesystem_id)
+  IPC_STRUCT_TRAITS_MEMBER(text)
+  IPC_STRUCT_TRAITS_MEMBER(html)
+  IPC_STRUCT_TRAITS_MEMBER(html_base_url)
+  IPC_STRUCT_TRAITS_MEMBER(file_description_filename)
+  IPC_STRUCT_TRAITS_MEMBER(file_contents)
+  IPC_STRUCT_TRAITS_MEMBER(custom_data)
+IPC_STRUCT_TRAITS_END()
diff --git a/content/content_common.gypi b/content/content_common.gypi
index 5b5eff7..314a650 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -164,6 +164,7 @@
     'common/devtools_messages.h',
     'common/dom_storage_messages.h',
     'common/drag_messages.h',
+    'common/drag_traits.h',
     'common/edit_command.h',
     'common/fileapi/file_system_dispatcher.cc',
     'common/fileapi/file_system_dispatcher.h',
diff --git a/content/renderer/browser_plugin/browser_plugin.cc b/content/renderer/browser_plugin/browser_plugin.cc
index 294cec0..9e4b961 100644
--- a/content/renderer/browser_plugin/browser_plugin.cc
+++ b/content/renderer/browser_plugin/browser_plugin.cc
@@ -761,6 +761,24 @@ bool BrowserPlugin::handleInputEvent(const WebKit::WebInputEvent& event,
   return handled;
 }
 
+bool BrowserPlugin::handleDragStatusUpdate(WebKit::WebDragStatus drag_status,
+                                           const WebKit::WebDragData& drag_data,
+                                           WebKit::WebDragOperationsMask mask,
+                                           const WebKit::WebPoint& position,
+                                           const WebKit::WebPoint& screen) {
+  if (guest_crashed_ || !navigate_src_sent_)
+    return false;
+  BrowserPluginManager::Get()->Send(
+      new BrowserPluginHostMsg_DragStatusUpdate(
+        render_view_->GetRoutingID(),
+        instance_id_,
+        drag_status,
+        WebDropData(drag_data),
+        mask,
+        position));
+  return false;
+}
+
 void BrowserPlugin::didReceiveResponse(
     const WebKit::WebURLResponse& response) {
 }
diff --git a/content/renderer/browser_plugin/browser_plugin.h b/content/renderer/browser_plugin/browser_plugin.h
index 6c87869..f646f3c2 100644
--- a/content/renderer/browser_plugin/browser_plugin.h
+++ b/content/renderer/browser_plugin/browser_plugin.h
@@ -15,6 +15,7 @@
 #include "content/renderer/browser_plugin/browser_plugin_backing_store.h"
 #include "content/renderer/browser_plugin/browser_plugin_bindings.h"
 #include "content/renderer/render_view_impl.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
 
 struct BrowserPluginHostMsg_ResizeGuest_Params;
 struct BrowserPluginMsg_DidNavigate_Params;
@@ -121,6 +122,11 @@ class CONTENT_EXPORT BrowserPlugin :
   virtual bool handleInputEvent(
       const WebKit::WebInputEvent& event,
       WebKit::WebCursorInfo& cursor_info) OVERRIDE;
+  virtual bool handleDragStatusUpdate(WebKit::WebDragStatus drag_status,
+                                      const WebKit::WebDragData& drag_data,
+                                      WebKit::WebDragOperationsMask mask,
+                                      const WebKit::WebPoint& position,
+                                      const WebKit::WebPoint& screen) OVERRIDE;
   virtual void didReceiveResponse(
       const WebKit::WebURLResponse& response) OVERRIDE;
   virtual void didReceiveData(const char* data, int data_length) OVERRIDE;
diff --git a/content/test/data/browser_plugin_dragging.html b/content/test/data/browser_plugin_dragging.html
new file mode 100644
index 0000000..cecfd14
--- /dev/null
+++ b/content/test/data/browser_plugin_dragging.html
@@ -0,0 +1,29 @@
+<textarea id='id_message'>
+</textarea>
+
+<object id="plugin"
+    tabindex="0"
+    type="application/browser-plugin"
+    width="240"
+    height="120"
+    style='border: solid 1px red'
+    contentEditable
+    >
+</object>
+
+<script>
+function dragLocation() {
+  return [id_message.offsetLeft + id_message.offsetWidth / 2,
+          id_message.offsetTop + id_message.offsetHeight / 2];
+}
+
+function dropLocation() {
+  return [plugin.offsetLeft + plugin.offsetWidth / 2,
+          plugin.offsetTop + plugin.offsetHeight / 2];
+}
+
+function SetSrc(src) {
+  plugin = document.getElementById('plugin');
+  plugin.src = src;
+}
+</script>