11 files changed, 177 insertions, 146 deletions

diff --git a/components/html_viewer/html_document_application_delegate.cc b/components/html_viewer/html_document_application_delegate.cc
index 54fa492..c97ce2de 100644
--- a/components/html_viewer/html_document_application_delegate.cc
+++ b/components/html_viewer/html_document_application_delegate.cc
@@ -7,6 +7,7 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "components/html_viewer/global_state.h"
+#include "components/html_viewer/html_document.h"
 #include "components/html_viewer/html_document_oopif.h"
 #include "components/html_viewer/html_viewer_switches.h"
 #include "mojo/application/public/cpp/application_connection.h"
@@ -21,8 +22,8 @@ bool EnableOOPIFs() {
   return base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kOOPIF);
 }
 
-HTMLDocument* CreateHTMLDocument(HTMLDocument::CreateParams* params) {
-  return new HTMLDocument(params);
+HTMLFrame* CreateHTMLFrame(HTMLFrame::CreateParams* params) {
+  return new HTMLFrame(params);
 }
 
 }  // namespace
@@ -79,9 +80,8 @@ HTMLDocumentApplicationDelegate::HTMLDocumentApplicationDelegate(
       url_(response->url),
       initial_response_(response.Pass()),
       global_state_(global_state),
-      html_document_creation_callback_(base::Bind(CreateHTMLDocument)),
-      weak_factory_(this) {
-}
+      html_frame_creation_callback_(base::Bind(CreateHTMLFrame)),
+      weak_factory_(this) {}
 
 HTMLDocumentApplicationDelegate::~HTMLDocumentApplicationDelegate() {
   // Deleting the documents is going to trigger a callback to
@@ -98,9 +98,9 @@ HTMLDocumentApplicationDelegate::~HTMLDocumentApplicationDelegate() {
   DCHECK(documents2_.empty());
 }
 
-void HTMLDocumentApplicationDelegate::SetHTMLDocumentCreationCallback(
-    const HTMLDocumentCreationCallback& callback) {
-  html_document_creation_callback_ = callback;
+void HTMLDocumentApplicationDelegate::SetHTMLFrameCreationCallback(
+    const HTMLFrameCreationCallback& callback) {
+  html_frame_creation_callback_ = callback;
 }
 
 // Callback from the quit closure. We key off this rather than
@@ -174,15 +174,15 @@ void HTMLDocumentApplicationDelegate::OnResponseReceived(
     HTMLDocumentOOPIF* document = new HTMLDocumentOOPIF(
         &app_, connection, response.Pass(), global_state_,
         base::Bind(&HTMLDocumentApplicationDelegate::OnHTMLDocumentDeleted2,
-                   base::Unretained(this)));
+                   base::Unretained(this)),
+        html_frame_creation_callback_);
     documents2_.insert(document);
   } else {
     HTMLDocument::CreateParams params(
         &app_, connection, response.Pass(), global_state_,
         base::Bind(&HTMLDocumentApplicationDelegate::OnHTMLDocumentDeleted,
                    base::Unretained(this)));
-    HTMLDocument* document = html_document_creation_callback_.Run(&params);
-    documents_.insert(document);
+    documents_.insert(new HTMLDocument(&params));
   }
 
   if (connector_queue) {
diff --git a/components/html_viewer/html_document_application_delegate.h b/components/html_viewer/html_document_application_delegate.h
index 30e8f37..d416428 100644
--- a/components/html_viewer/html_document_application_delegate.h
+++ b/components/html_viewer/html_document_application_delegate.h
@@ -11,7 +11,7 @@
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
-#include "components/html_viewer/html_document.h"
+#include "components/html_viewer/html_frame.h"
 #include "mojo/application/public/cpp/application_delegate.h"
 #include "mojo/application/public/cpp/application_impl.h"
 #include "mojo/services/network/public/interfaces/url_loader_factory.mojom.h"
@@ -20,6 +20,7 @@
 namespace html_viewer {
 
 class GlobalState;
+class HTMLDocument;
 class HTMLDocumentOOPIF;
 
 // ApplicationDelegate created by the content handler for a specific url.
@@ -31,11 +32,10 @@ class HTMLDocumentApplicationDelegate : public mojo::ApplicationDelegate {
       GlobalState* global_state,
       scoped_ptr<mojo::AppRefCount> parent_app_refcount);
 
-  typedef base::Callback<HTMLDocument*(HTMLDocument::CreateParams*)>
-      HTMLDocumentCreationCallback;
+  using HTMLFrameCreationCallback =
+      base::Callback<HTMLFrame*(HTMLFrame::CreateParams*)>;
 
-  void SetHTMLDocumentCreationCallback(
-      const HTMLDocumentCreationCallback& callback);
+  void SetHTMLFrameCreationCallback(const HTMLFrameCreationCallback& callback);
 
  private:
   class ServiceConnectorQueue;
@@ -76,7 +76,7 @@ class HTMLDocumentApplicationDelegate : public mojo::ApplicationDelegate {
   // HTMLDocument is deleted.
   std::set<HTMLDocumentOOPIF*> documents2_;
 
-  HTMLDocumentCreationCallback html_document_creation_callback_;
+  HTMLFrameCreationCallback html_frame_creation_callback_;
 
   base::WeakPtrFactory<HTMLDocumentApplicationDelegate> weak_factory_;
 
diff --git a/components/html_viewer/html_document_oopif.cc b/components/html_viewer/html_document_oopif.cc
index 37b7471..49f59ec 100644
--- a/components/html_viewer/html_document_oopif.cc
+++ b/components/html_viewer/html_document_oopif.cc
@@ -59,11 +59,13 @@ HTMLDocumentOOPIF::BeforeLoadCache::~BeforeLoadCache() {
   STLDeleteElements(&test_interface_requests);
 }
 
-HTMLDocumentOOPIF::HTMLDocumentOOPIF(mojo::ApplicationImpl* html_document_app,
-                                     mojo::ApplicationConnection* connection,
-                                     mojo::URLResponsePtr response,
-                                     GlobalState* global_state,
-                                     const DeleteCallback& delete_callback)
+HTMLDocumentOOPIF::HTMLDocumentOOPIF(
+    mojo::ApplicationImpl* html_document_app,
+    mojo::ApplicationConnection* connection,
+    mojo::URLResponsePtr response,
+    GlobalState* global_state,
+    const DeleteCallback& delete_callback,
+    const HTMLFrameCreationCallback& frame_creation_callback)
     : app_refcount_(html_document_app->app_lifetime_helper()
                         ->CreateAppRefCount()),
       html_document_app_(html_document_app),
@@ -71,7 +73,8 @@ HTMLDocumentOOPIF::HTMLDocumentOOPIF(mojo::ApplicationImpl* html_document_app,
       view_manager_client_factory_(html_document_app->shell(), this),
       global_state_(global_state),
       frame_(nullptr),
-      delete_callback_(delete_callback) {
+      delete_callback_(delete_callback),
+      frame_creation_callback_(frame_creation_callback) {
   // TODO(sky): nuke headless. We're not going to care about it anymore.
   DCHECK(!global_state_->is_headless());
 
@@ -215,6 +218,10 @@ mojo::ApplicationImpl* HTMLDocumentOOPIF::GetApp() {
   return html_document_app_;
 }
 
+HTMLFrame* HTMLDocumentOOPIF::CreateHTMLFrame(HTMLFrame::CreateParams* params) {
+  return frame_creation_callback_.Run(params);
+}
+
 void HTMLDocumentOOPIF::Create(mojo::ApplicationConnection* connection,
                                mojo::InterfaceRequest<AxProvider> request) {
   if (!did_finish_local_frame_load_) {
diff --git a/components/html_viewer/html_document_oopif.h b/components/html_viewer/html_document_oopif.h
index c129d7f..62d7a95 100644
--- a/components/html_viewer/html_document_oopif.h
+++ b/components/html_viewer/html_document_oopif.h
@@ -57,6 +57,8 @@ class HTMLDocumentOOPIF
       public mojo::InterfaceFactory<TestHTMLViewer> {
  public:
   using DeleteCallback = base::Callback<void(HTMLDocumentOOPIF*)>;
+  using HTMLFrameCreationCallback =
+      base::Callback<HTMLFrame*(HTMLFrame::CreateParams*)>;
 
   // Load a new HTMLDocument with |response|.
   // |html_document_app| is the application this app was created in, and
@@ -66,7 +68,8 @@ class HTMLDocumentOOPIF
                     mojo::ApplicationConnection* connection,
                     mojo::URLResponsePtr response,
                     GlobalState* setup,
-                    const DeleteCallback& delete_callback);
+                    const DeleteCallback& delete_callback,
+                    const HTMLFrameCreationCallback& frame_creation_callback);
 
   // Deletes this object.
   void Destroy();
@@ -107,6 +110,7 @@ class HTMLDocumentOOPIF
   bool ShouldNavigateLocallyInMainFrame() override;
   void OnFrameDidFinishLoad() override;
   mojo::ApplicationImpl* GetApp() override;
+  HTMLFrame* CreateHTMLFrame(HTMLFrame::CreateParams* params) override;
 
   // mojo::InterfaceFactory<mojo::AxProvider>:
   void Create(mojo::ApplicationConnection* connection,
@@ -146,6 +150,8 @@ class HTMLDocumentOOPIF
 
   DeleteCallback delete_callback_;
 
+  HTMLFrameCreationCallback frame_creation_callback_;
+
   DISALLOW_COPY_AND_ASSIGN(HTMLDocumentOOPIF);
 };
 
diff --git a/components/html_viewer/html_frame.cc b/components/html_viewer/html_frame.cc
index a63f8ba..dfa183f 100644
--- a/components/html_viewer/html_frame.cc
+++ b/components/html_viewer/html_frame.cc
@@ -121,26 +121,22 @@ bool CanNavigateLocally(blink::WebFrame* frame,
 
 }  // namespace
 
-HTMLFrame::HTMLFrame(const HTMLFrame::CreateParams& params)
-    : frame_tree_manager_(params.manager),
-      parent_(params.parent),
+HTMLFrame::HTMLFrame(CreateParams* params)
+    : frame_tree_manager_(params->manager),
+      parent_(params->parent),
       view_(nullptr),
-      id_(params.id),
+      id_(params->id),
       web_frame_(nullptr),
       web_widget_(nullptr),
-      delegate_(nullptr),
+      delegate_(params->delegate),
       weak_factory_(this) {
   if (parent_)
     parent_->children_.push_back(this);
-}
 
-void HTMLFrame::Init(
-    mojo::View* local_view,
-    const mojo::Map<mojo::String, mojo::Array<uint8_t>>& properties) {
-  if (local_view && local_view->id() == id_)
-    SetView(local_view);
+  if (params->view && params->view->id() == id_)
+    SetView(params->view);
 
-  SetReplicatedFrameStateFromClientProperties(properties, &state_);
+  SetReplicatedFrameStateFromClientProperties(params->properties, &state_);
 
   if (!parent_) {
     CreateRootWebWidget();
@@ -154,20 +150,21 @@ void HTMLFrame::Init(
     // We need to set the main frame before creating children so that state is
     // properly set up in blink.
     web_view()->setMainFrame(local_web_frame);
-    const gfx::Size size_in_pixels(local_view->bounds().width,
-                                   local_view->bounds().height);
+    const gfx::Size size_in_pixels(params->view->bounds().width,
+                                   params->view->bounds().height);
     const gfx::Size size_in_dips = gfx::ConvertSizeToDIP(
-        local_view->viewport_metrics().device_pixel_ratio, size_in_pixels);
+        params->view->viewport_metrics().device_pixel_ratio, size_in_pixels);
     web_widget_->resize(size_in_dips);
     web_frame_ = local_web_frame;
     web_view()->setDeviceScaleFactor(global_state()->device_pixel_ratio());
-    if (id_ != local_view->id()) {
+    if (id_ != params->view->id()) {
       blink::WebRemoteFrame* remote_web_frame =
           blink::WebRemoteFrame::create(state_.tree_scope, this);
       local_web_frame->swap(remote_web_frame);
       web_frame_ = remote_web_frame;
     }
-  } else if (local_view && id_ == local_view->id()) {
+  } else if (!params->allow_local_shared_frame && params->view &&
+             id_ == params->view->id()) {
     // Frame represents the local frame, and it isn't the root of the tree.
     HTMLFrame* previous_sibling = GetPreviousSibling(this);
     blink::WebFrame* previous_web_frame =
@@ -181,11 +178,17 @@ void HTMLFrame::Init(
     web_frame_ = parent_->web_frame()->toWebRemoteFrame()->createRemoteChild(
         state_.tree_scope, state_.name, state_.sandbox_flags, this);
   } else {
-    // This is hit if we're asked to create a child frame of a local parent.
+    // TODO(sky): this DCHECK, and |allow_local_shared_frame| should be
+    // moved to HTMLFrameTreeManager. It makes more sense there.
     // This should never happen (if we create a local child we don't call
     // Init(), and the frame server should not being creating child frames of
     // this frame).
-    NOTREACHED();
+    DCHECK(params->allow_local_shared_frame);
+
+    blink::WebLocalFrame* child_web_frame =
+        blink::WebLocalFrame::create(state_.tree_scope, this);
+    web_frame_ = child_web_frame;
+    parent_->web_frame_->appendChild(child_web_frame);
   }
 
   if (!IsLocal()) {
@@ -409,11 +412,13 @@ void HTMLFrame::SwapToRemote() {
 }
 
 void HTMLFrame::SwapToLocal(
+    HTMLFrameDelegate* delegate,
     mojo::View* view,
     const mojo::Map<mojo::String, mojo::Array<uint8_t>>& properties) {
   CHECK(!IsLocal());
   // It doesn't make sense for the root to swap to local.
   CHECK(parent_);
+  delegate_ = delegate;
   SetView(view);
   SetReplicatedFrameStateFromClientProperties(properties, &state_);
   blink::WebLocalFrame* local_web_frame =
@@ -679,18 +684,12 @@ blink::WebFrame* HTMLFrame::createChildFrame(
   GetLocalRoot()->server_->OnCreatedFrame(id_, child_view->id(),
                                           client_properties.Pass());
 
-  HTMLFrame::CreateParams params(frame_tree_manager_, this, child_view->id());
-  HTMLFrame* child_frame = new HTMLFrame(params);
-  child_frame->state_ = child_state;
-
-  child_frame->SetView(child_view);
+  HTMLFrame::CreateParams params(frame_tree_manager_, this, child_view->id(),
+                                 child_view, client_properties, nullptr);
+  params.allow_local_shared_frame = true;
+  HTMLFrame* child_frame = GetLocalRoot()->delegate_->CreateHTMLFrame(&params);
   child_frame->owned_view_.reset(new mojo::ScopedViewPtr(child_view));
-
-  blink::WebLocalFrame* child_web_frame =
-      blink::WebLocalFrame::create(scope, child_frame);
-  child_frame->web_frame_ = child_web_frame;
-  parent->appendChild(child_web_frame);
-  return child_web_frame;
+  return child_frame->web_frame_;
 }
 
 void HTMLFrame::frameDetached(blink::WebFrame* web_frame,
diff --git a/components/html_viewer/html_frame.h b/components/html_viewer/html_frame.h
index b354bec..d1e4e6c 100644
--- a/components/html_viewer/html_frame.h
+++ b/components/html_viewer/html_frame.h
@@ -61,19 +61,37 @@ class HTMLFrame : public blink::WebFrameClient,
                   public mojo::ViewObserver {
  public:
   struct CreateParams {
-    CreateParams(HTMLFrameTreeManager* manager, HTMLFrame* parent, uint32_t id)
-        : manager(manager), parent(parent), id(id) {}
+    CreateParams(
+        HTMLFrameTreeManager* manager,
+        HTMLFrame* parent,
+        uint32_t id,
+        mojo::View* view,
+        const mojo::Map<mojo::String, mojo::Array<uint8_t>>& properties,
+        HTMLFrameDelegate* delegate)
+        : manager(manager),
+          parent(parent),
+          id(id),
+          view(view),
+          properties(properties),
+          delegate(delegate),
+          allow_local_shared_frame(false) {}
     ~CreateParams() {}
 
     HTMLFrameTreeManager* manager;
     HTMLFrame* parent;
     uint32_t id;
-  };
+    mojo::View* view;
+    const mojo::Map<mojo::String, mojo::Array<uint8_t>>& properties;
+    HTMLFrameDelegate* delegate;
+
+   private:
+    friend class HTMLFrame;
 
-  explicit HTMLFrame(const CreateParams& params);
+    // TODO(sky): nuke.
+    bool allow_local_shared_frame;
+  };
 
-  void Init(mojo::View* local_view,
-            const mojo::Map<mojo::String, mojo::Array<uint8_t>>& properties);
+  explicit HTMLFrame(CreateParams* params);
 
   // Called when another app is embedded in the View this Frame is associated
   // with.
@@ -113,12 +131,64 @@ class HTMLFrame : public blink::WebFrameClient,
   // Returns true if this or one of the frames descendants is local.
   bool HasLocalDescendant() const;
 
- private:
-  friend class HTMLFrameTreeManager;
-
+ protected:
   virtual ~HTMLFrame();
 
-  void set_delegate(HTMLFrameDelegate* delegate) { delegate_ = delegate; }
+  // TODO(sky): move implementations to match new position.
+
+  // WebViewClient methods:
+  virtual blink::WebStorageNamespace* createSessionStorageNamespace();
+  virtual void didCancelCompositionOnSelectionChange();
+  virtual void didChangeContents();
+
+  // WebWidgetClient methods:
+  virtual void initializeLayerTreeView();
+  virtual blink::WebLayerTreeView* layerTreeView();
+  virtual void resetInputMethod();
+  virtual void didHandleGestureEvent(const blink::WebGestureEvent& event,
+                                     bool eventCancelled);
+  virtual void didUpdateTextOfFocusedElementByNonUserInput();
+  virtual void showImeIfNeeded();
+
+  // WebFrameClient methods:
+  virtual blink::WebMediaPlayer* createMediaPlayer(
+      blink::WebLocalFrame* frame,
+      const blink::WebURL& url,
+      blink::WebMediaPlayerClient* client,
+      blink::WebMediaPlayerEncryptedMediaClient* encrypted_client,
+      blink::WebContentDecryptionModule* initial_cdm);
+  virtual blink::WebFrame* createChildFrame(
+      blink::WebLocalFrame* parent,
+      blink::WebTreeScopeType scope,
+      const blink::WebString& frame_ame,
+      blink::WebSandboxFlags sandbox_flags);
+  virtual void frameDetached(blink::WebFrame* frame,
+                             blink::WebFrameClient::DetachType type);
+  virtual blink::WebCookieJar* cookieJar(blink::WebLocalFrame* frame);
+  virtual blink::WebNavigationPolicy decidePolicyForNavigation(
+      const NavigationPolicyInfo& info);
+  virtual void didAddMessageToConsole(const blink::WebConsoleMessage& message,
+                                      const blink::WebString& source_name,
+                                      unsigned source_line,
+                                      const blink::WebString& stack_trace);
+  virtual void didFinishLoad(blink::WebLocalFrame* frame);
+  virtual void didNavigateWithinPage(blink::WebLocalFrame* frame,
+                                     const blink::WebHistoryItem& history_item,
+                                     blink::WebHistoryCommitType commit_type);
+  virtual blink::WebGeolocationClient* geolocationClient();
+  virtual blink::WebEncryptedMediaClient* encryptedMediaClient();
+  virtual void didStartLoading(bool to_different_document);
+  virtual void didStopLoading();
+  virtual void didChangeLoadProgress(double load_progress);
+  virtual void didChangeName(blink::WebLocalFrame* frame,
+                             const blink::WebString& name);
+  virtual void didCommitProvisionalLoad(
+      blink::WebLocalFrame* frame,
+      const blink::WebHistoryItem& item,
+      blink::WebHistoryCommitType commit_type);
+
+ private:
+  friend class HTMLFrameTreeManager;
 
   // Binds this frame to the specified server. |this| serves as the
   // FrameTreeClient for the server.
@@ -164,6 +234,7 @@ class HTMLFrame : public blink::WebFrameClient,
 
   // Swaps this frame from a remote frame to a local frame.
   void SwapToLocal(
+      HTMLFrameDelegate* delegate,
       mojo::View* view,
       const mojo::Map<mojo::String, mojo::Array<uint8_t>>& properties);
 
@@ -203,57 +274,6 @@ class HTMLFrame : public blink::WebFrameClient,
       uint32_t target_frame_id,
       mandoline::HTMLMessageEventPtr serialized_event) override;
 
-  // WebViewClient methods:
-  virtual blink::WebStorageNamespace* createSessionStorageNamespace();
-  virtual void didCancelCompositionOnSelectionChange();
-  virtual void didChangeContents();
-
-  // WebWidgetClient methods:
-  virtual void initializeLayerTreeView();
-  virtual blink::WebLayerTreeView* layerTreeView();
-  virtual void resetInputMethod();
-  virtual void didHandleGestureEvent(const blink::WebGestureEvent& event,
-                                     bool eventCancelled);
-  virtual void didUpdateTextOfFocusedElementByNonUserInput();
-  virtual void showImeIfNeeded();
-
-  // WebFrameClient methods:
-  virtual blink::WebMediaPlayer* createMediaPlayer(
-      blink::WebLocalFrame* frame,
-      const blink::WebURL& url,
-      blink::WebMediaPlayerClient* client,
-      blink::WebMediaPlayerEncryptedMediaClient* encrypted_client,
-      blink::WebContentDecryptionModule* initial_cdm);
-  virtual blink::WebFrame* createChildFrame(
-      blink::WebLocalFrame* parent,
-      blink::WebTreeScopeType scope,
-      const blink::WebString& frame_ame,
-      blink::WebSandboxFlags sandbox_flags);
-  virtual void frameDetached(blink::WebFrame* frame,
-                             blink::WebFrameClient::DetachType type);
-  virtual blink::WebCookieJar* cookieJar(blink::WebLocalFrame* frame);
-  virtual blink::WebNavigationPolicy decidePolicyForNavigation(
-      const NavigationPolicyInfo& info);
-  virtual void didAddMessageToConsole(const blink::WebConsoleMessage& message,
-                                      const blink::WebString& source_name,
-                                      unsigned source_line,
-                                      const blink::WebString& stack_trace);
-  virtual void didFinishLoad(blink::WebLocalFrame* frame);
-  virtual void didNavigateWithinPage(blink::WebLocalFrame* frame,
-                                     const blink::WebHistoryItem& history_item,
-                                     blink::WebHistoryCommitType commit_type);
-  virtual blink::WebGeolocationClient* geolocationClient();
-  virtual blink::WebEncryptedMediaClient* encryptedMediaClient();
-  virtual void didStartLoading(bool to_different_document);
-  virtual void didStopLoading();
-  virtual void didChangeLoadProgress(double load_progress);
-  virtual void didChangeName(blink::WebLocalFrame* frame,
-                             const blink::WebString& name);
-  virtual void didCommitProvisionalLoad(
-      blink::WebLocalFrame* frame,
-      const blink::WebHistoryItem& item,
-      blink::WebHistoryCommitType commit_type);
-
   // blink::WebRemoteFrameClient:
   virtual void frameDetached(blink::WebRemoteFrameClient::DetachType type);
   virtual void postMessageEvent(blink::WebLocalFrame* source_web_frame,
diff --git a/components/html_viewer/html_frame_delegate.h b/components/html_viewer/html_frame_delegate.h
index 3320a84..c55f108 100644
--- a/components/html_viewer/html_frame_delegate.h
+++ b/components/html_viewer/html_frame_delegate.h
@@ -5,14 +5,14 @@
 #ifndef COMPONENTS_HTML_VIEWER_HTML_FRAME_DELEGATE_H_
 #define COMPONENTS_HTML_VIEWER_HTML_FRAME_DELEGATE_H_
 
+#include "components/html_viewer/html_frame.h"
+
 namespace mojo {
 class ApplicationImpl;
 }
 
 namespace html_viewer {
 
-class HTMLFrame;
-
 class HTMLFrameDelegate {
  public:
   // TODO(yzshen): Remove this check once the browser is able to navigate an
@@ -27,6 +27,9 @@ class HTMLFrameDelegate {
   // Returns the ApplicationImpl for the frame.
   virtual mojo::ApplicationImpl* GetApp() = 0;
 
+  // Creates a new HTMLFrame. The delegate must return non-null.
+  virtual HTMLFrame* CreateHTMLFrame(HTMLFrame::CreateParams* params) = 0;
+
  protected:
   virtual ~HTMLFrameDelegate() {}
 };
diff --git a/components/html_viewer/html_frame_tree_manager.cc b/components/html_viewer/html_frame_tree_manager.cc
index c529bda..2066f89 100644
--- a/components/html_viewer/html_frame_tree_manager.cc
+++ b/components/html_viewer/html_frame_tree_manager.cc
@@ -89,15 +89,13 @@ HTMLFrame* HTMLFrameTreeManager::CreateFrameAndAttachToTree(
     const mandoline::FrameDataPtr& data = frame_data[frame_data_index];
     if (existing_frame) {
       CHECK(!existing_frame->IsLocal());
-      existing_frame->set_delegate(delegate);
-      existing_frame->SwapToLocal(view, data->client_properties);
+      existing_frame->SwapToLocal(delegate, view, data->client_properties);
     } else {
       HTMLFrame* parent = frame_tree->root_->FindFrame(data->parent_id);
       CHECK(parent);
-      HTMLFrame::CreateParams params(frame_tree, parent, view->id());
-      HTMLFrame* frame = new HTMLFrame(params);
-      frame->set_delegate(delegate);
-      frame->Init(view, data->client_properties);
+      HTMLFrame::CreateParams params(frame_tree, parent, view->id(), view,
+                                     data->client_properties, delegate);
+      delegate->CreateHTMLFrame(&params);
     }
   }
 
@@ -167,18 +165,17 @@ HTMLFrame* HTMLFrameTreeManager::BuildFrameTree(
     }
     HTMLFrame::CreateParams params(this,
                                    !parents.empty() ? parents.back() : nullptr,
-                                   frame_data[i]->frame_id);
-    HTMLFrame* frame = new HTMLFrame(params);
+                                   frame_data[i]->frame_id, local_view,
+                                   frame_data[i]->client_properties, nullptr);
+    if (frame_data[i]->frame_id == local_frame_id)
+      params.delegate = delegate;
+
+    HTMLFrame* frame = delegate->CreateHTMLFrame(&params);
     if (!last_frame)
       root = frame;
     else
       DCHECK(frame->parent());
     last_frame = frame;
-
-    if (frame_data[i]->frame_id == local_frame_id)
-      frame->set_delegate(delegate);
-
-    frame->Init(local_view, frame_data[i]->client_properties);
   }
   return root;
 }
@@ -235,10 +232,10 @@ void HTMLFrameTreeManager::ProcessOnFrameAdded(
   if (pending_remove_ids_.count(frame_data->frame_id))
     return;
 
-  HTMLFrame::CreateParams params(this, parent, frame_data->frame_id);
-  // |parent| takes ownership of |frame|.
-  HTMLFrame* frame = new HTMLFrame(params);
-  frame->Init(nullptr, frame_data->client_properties);
+  HTMLFrame::CreateParams params(this, parent, frame_data->frame_id, nullptr,
+                                 frame_data->client_properties, nullptr);
+  // |parent| takes ownership of created HTMLFrame.
+  source->GetLocalRoot()->delegate_->CreateHTMLFrame(&params);
 }
 
 void HTMLFrameTreeManager::ProcessOnFrameRemoved(HTMLFrame* source,
diff --git a/components/html_viewer/layout_test_content_handler_impl.cc b/components/html_viewer/layout_test_content_handler_impl.cc
index 68721cc..a444177 100644
--- a/components/html_viewer/layout_test_content_handler_impl.cc
+++ b/components/html_viewer/layout_test_content_handler_impl.cc
@@ -40,17 +40,16 @@ void LayoutTestContentHandlerImpl::StartApplication(
           request.Pass(), response.Pass(), global_state(),
           app()->app_lifetime_helper()->CreateAppRefCount());
 
-  delegate->SetHTMLDocumentCreationCallback(
-      base::Bind(&LayoutTestContentHandlerImpl::CreateHTMLDocument,
-                 base::Unretained(this)));
+  delegate->SetHTMLFrameCreationCallback(base::Bind(
+      &LayoutTestContentHandlerImpl::CreateHTMLFrame, base::Unretained(this)));
 }
 
-HTMLDocument* LayoutTestContentHandlerImpl::CreateHTMLDocument(
-    HTMLDocument::CreateParams* params) {
-  typedef test_runner::WebTestProxy<
-      test_runner::WebFrameTestProxy<HTMLDocument, HTMLDocument::CreateParams*>,
-      HTMLDocument::CreateParams*> ProxyType;
-
+HTMLFrame* LayoutTestContentHandlerImpl::CreateHTMLFrame(
+    HTMLFrame::CreateParams* params) {
+  using ProxyType = test_runner::WebTestProxy<
+      test_runner::WebFrameTestProxy<HTMLFrame, HTMLFrame::CreateParams*>,
+      HTMLFrame::CreateParams*>;
+  // TODO(sky): this isn't right for all frame types, eg remote frames.
   ProxyType* proxy = new ProxyType(params);
   proxy->SetInterfaces(test_interfaces_);
   proxy->SetDelegate(test_delegate_);
diff --git a/components/html_viewer/layout_test_content_handler_impl.h b/components/html_viewer/layout_test_content_handler_impl.h
index 139472e..c05769f 100644
--- a/components/html_viewer/layout_test_content_handler_impl.h
+++ b/components/html_viewer/layout_test_content_handler_impl.h
@@ -6,8 +6,7 @@
 #define COMPONENTS_HTML_VIEWER_LAYOUT_TEST_CONTENT_HANDLER_IMPL_H_
 
 #include "components/html_viewer/content_handler_impl.h"
-
-#include "components/html_viewer/html_document.h"
+#include "components/html_viewer/html_frame.h"
 
 namespace test_runner {
 class WebTestInterfaces;
@@ -31,7 +30,7 @@ class LayoutTestContentHandlerImpl : public ContentHandlerImpl {
   void StartApplication(mojo::InterfaceRequest<mojo::Application> request,
                         mojo::URLResponsePtr response) override;
 
-  HTMLDocument* CreateHTMLDocument(HTMLDocument::CreateParams* params);
+  HTMLFrame* CreateHTMLFrame(HTMLFrame::CreateParams* params);
 
   test_runner::WebTestInterfaces* test_interfaces_;
   WebTestDelegateImpl* test_delegate_;
diff --git a/mandoline/BUILD.gn b/mandoline/BUILD.gn
index 7574a69..d9d75b5 100644
--- a/mandoline/BUILD.gn
+++ b/mandoline/BUILD.gn
@@ -37,6 +37,7 @@ group("tests") {
       "//components/filesystem:apptests",
       "//components/html_viewer:apptests",
       "//components/html_viewer:html_viewer_unittests",
+      "//components/html_viewer:layout_test_html_viewer",
       "//components/resource_provider:apptests",
       "//components/resource_provider:resource_provider_unittests",
       "//components/view_manager:tests",