Refactor 4 PPB_Flash functions to the new PPAPI resource model.

The functions being refactored are:
-SetInstanceAlwaysOnTop
-DrawGlyphs
-GetProxyForURL
-Navigate

Each of these functions was manually tested with a Flash movie that uses it.

Navigate() was tested on:
-http://www.tjgames.com.br/jogos-online/169-Yan_Loong.htm
-http://www.flonga.com/play/zombotron2.htm
which were consistently causing instance deletion during a Navigate() call (causing https://code.google.com/p/chromium/issues/detail?id=165978).

BUG=165978

Review URL: https://codereview.chromium.org/11510008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@173980 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/content/renderer/pepper/pepper_flash_renderer_host.cc b/content/renderer/pepper/pepper_flash_renderer_host.cc
index e17511d2..1afabe0 100644
--- a/content/renderer/pepper/pepper_flash_renderer_host.cc
+++ b/content/renderer/pepper/pepper_flash_renderer_host.cc
@@ -4,14 +4,34 @@
 
 #include "content/renderer/pepper/pepper_flash_renderer_host.h"
 
+#include <vector>
+
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/renderer_ppapi_host.h"
 #include "googleurl/src/gurl.h"
 #include "ipc/ipc_message_macros.h"
 #include "ppapi/c/pp_errors.h"
+#include "ppapi/c/trusted/ppb_browser_font_trusted.h"
 #include "ppapi/host/dispatch_host_message.h"
+#include "ppapi/proxy/host_dispatcher.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/resource_message_params.h"
+#include "ppapi/proxy/serialized_structs.h"
+#include "ppapi/thunk/enter.h"
+#include "ppapi/thunk/ppb_image_data_api.h"
+#include "skia/ext/platform_canvas.h"
+#include "third_party/skia/include/core/SkCanvas.h"
+#include "third_party/skia/include/core/SkMatrix.h"
+#include "third_party/skia/include/core/SkPaint.h"
+#include "third_party/skia/include/core/SkPoint.h"
+#include "third_party/skia/include/core/SkTemplates.h"
+#include "third_party/skia/include/core/SkTypeface.h"
+#include "ui/gfx/rect.h"
+#include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
+#include "webkit/plugins/ppapi/ppb_image_data_impl.h"
+
+using ppapi::thunk::EnterResourceNoLock;
+using ppapi::thunk::PPB_ImageData_API;
 
 namespace content {
 
@@ -19,10 +39,17 @@
     RendererPpapiHost* host,
     PP_Instance instance,
     PP_Resource resource)
-    : ResourceHost(host->GetPpapiHost(), instance, resource) {
+    : ResourceHost(host->GetPpapiHost(), instance, resource),
+      weak_factory_(ALLOW_THIS_IN_INITIALIZER_LIST(this)),
+      host_(host) {
 }
 
 PepperFlashRendererHost::~PepperFlashRendererHost() {
+  // This object may be destroyed in the middle of a sync message. If that is
+  // the case, make sure we respond to all the pending navigate calls.
+  std::vector<ppapi::host::ReplyMessageContext>::reverse_iterator it;
+  for (it = navigate_replies_.rbegin(); it != navigate_replies_.rend(); ++it)
+    SendReply(*it, IPC::Message());
 }
 
 int32_t PepperFlashRendererHost::OnResourceMessageReceived(
@@ -31,6 +58,14 @@
   IPC_BEGIN_MESSAGE_MAP(PepperFlashRendererHost, msg)
     PPAPI_DISPATCH_HOST_RESOURCE_CALL(PpapiHostMsg_Flash_GetProxyForURL,
                                       OnMsgGetProxyForURL);
+    PPAPI_DISPATCH_HOST_RESOURCE_CALL(PpapiHostMsg_Flash_SetInstanceAlwaysOnTop,
+                                      OnMsgSetInstanceAlwaysOnTop);
+    PPAPI_DISPATCH_HOST_RESOURCE_CALL(PpapiHostMsg_Flash_DrawGlyphs,
+                                      OnMsgDrawGlyphs);
+    PPAPI_DISPATCH_HOST_RESOURCE_CALL(PpapiHostMsg_Flash_Navigate,
+                                      OnMsgNavigate);
+    PPAPI_DISPATCH_HOST_RESOURCE_CALL(PpapiHostMsg_Flash_IsRectTopmost,
+                                      OnMsgIsRectTopmost);
   IPC_END_MESSAGE_MAP()
   return PP_ERROR_FAILED;
 }
@@ -49,4 +84,160 @@
   return PP_OK;
 }
 
+int32_t PepperFlashRendererHost::OnMsgSetInstanceAlwaysOnTop(
+    ppapi::host::HostMessageContext* host_context,
+    bool on_top) {
+  webkit::ppapi::PluginInstance* plugin_instance =
+      host_->GetPluginInstance(pp_instance());
+  if (plugin_instance)
+    plugin_instance->set_always_on_top(on_top);
+  // Since no reply is sent for this message, it doesn't make sense to return an
+  // error.
+  return PP_OK;
+}
+
+int32_t PepperFlashRendererHost::OnMsgDrawGlyphs(
+    ppapi::host::HostMessageContext* host_context,
+    ppapi::proxy::PPBFlash_DrawGlyphs_Params params) {
+  if (params.glyph_indices.size() != params.glyph_advances.size() ||
+      params.glyph_indices.empty())
+    return PP_ERROR_FAILED;
+
+  EnterResourceNoLock<PPB_ImageData_API> enter(
+      params.image_data.host_resource(), true);
+  if (enter.failed())
+    return PP_ERROR_FAILED;
+  webkit::ppapi::PPB_ImageData_Impl* image_resource =
+      static_cast<webkit::ppapi::PPB_ImageData_Impl*>(enter.object());
+
+  webkit::ppapi::ImageDataAutoMapper mapper(image_resource);
+  if (!mapper.is_valid())
+    return PP_ERROR_FAILED;
+
+  // Set up the typeface.
+  int style = SkTypeface::kNormal;
+  if (static_cast<PP_BrowserFont_Trusted_Weight>(params.font_desc.weight) >=
+      PP_BROWSERFONT_TRUSTED_WEIGHT_BOLD)
+    style |= SkTypeface::kBold;
+  if (params.font_desc.italic)
+    style |= SkTypeface::kItalic;
+  skia::RefPtr<SkTypeface> typeface = skia::AdoptRef(
+      SkTypeface::CreateFromName(params.font_desc.face.c_str(),
+                                 static_cast<SkTypeface::Style>(style)));
+  if (!typeface)
+    return PP_ERROR_FAILED;
+
+  // Set up the canvas.
+  SkCanvas* canvas = image_resource->GetPlatformCanvas();
+  SkAutoCanvasRestore acr(canvas, true);
+
+  // Clip is applied in pixels before the transform.
+  SkRect clip_rect = {
+    SkIntToScalar(params.clip.point.x),
+    SkIntToScalar(params.clip.point.y),
+    SkIntToScalar(params.clip.point.x + params.clip.size.width),
+    SkIntToScalar(params.clip.point.y + params.clip.size.height)
+  };
+  canvas->clipRect(clip_rect);
+
+  // Convert & set the matrix.
+  SkMatrix matrix;
+  matrix.set(SkMatrix::kMScaleX, SkFloatToScalar(params.transformation[0][0]));
+  matrix.set(SkMatrix::kMSkewX,  SkFloatToScalar(params.transformation[0][1]));
+  matrix.set(SkMatrix::kMTransX, SkFloatToScalar(params.transformation[0][2]));
+  matrix.set(SkMatrix::kMSkewY,  SkFloatToScalar(params.transformation[1][0]));
+  matrix.set(SkMatrix::kMScaleY, SkFloatToScalar(params.transformation[1][1]));
+  matrix.set(SkMatrix::kMTransY, SkFloatToScalar(params.transformation[1][2]));
+  matrix.set(SkMatrix::kMPersp0, SkFloatToScalar(params.transformation[2][0]));
+  matrix.set(SkMatrix::kMPersp1, SkFloatToScalar(params.transformation[2][1]));
+  matrix.set(SkMatrix::kMPersp2, SkFloatToScalar(params.transformation[2][2]));
+  canvas->concat(matrix);
+
+  SkPaint paint;
+  paint.setColor(params.color);
+  paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+  paint.setAntiAlias(true);
+  paint.setHinting(SkPaint::kFull_Hinting);
+  paint.setTextSize(SkIntToScalar(params.font_desc.size));
+  paint.setTypeface(typeface.get());  // Takes a ref and manages lifetime.
+  if (params.allow_subpixel_aa) {
+    paint.setSubpixelText(true);
+    paint.setLCDRenderText(true);
+  }
+
+  SkScalar x = SkIntToScalar(params.position.x);
+  SkScalar y = SkIntToScalar(params.position.y);
+
+  // Build up the skia advances.
+  size_t glyph_count = params.glyph_indices.size();
+  if (glyph_count == 0)
+    return PP_OK;
+  std::vector<SkPoint> storage;
+  storage.resize(glyph_count);
+  SkPoint* sk_positions = &storage[0];
+  for (uint32_t i = 0; i < glyph_count; i++) {
+    sk_positions[i].set(x, y);
+    x += SkFloatToScalar(params.glyph_advances[i].x);
+    y += SkFloatToScalar(params.glyph_advances[i].y);
+  }
+
+  canvas->drawPosText(&params.glyph_indices[0], glyph_count * 2, sk_positions,
+                      paint);
+
+  return PP_OK;
+}
+
+// CAUTION: This code is subtle because Navigate is a sync call which may
+// cause re-entrancy or cause the instance to be destroyed. If the instance
+// is destroyed we need to ensure that we respond to all outstanding sync
+// messages so that the plugin process does not remain blocked.
+int32_t PepperFlashRendererHost::OnMsgNavigate(
+    ppapi::host::HostMessageContext* host_context,
+    const ppapi::URLRequestInfoData& data,
+    const std::string& target,
+    bool from_user_action) {
+  // If our PluginInstance is already destroyed, just return a failure.
+  webkit::ppapi::PluginInstance* plugin_instance =
+      host_->GetPluginInstance(pp_instance());
+  if (!plugin_instance)
+    return PP_ERROR_FAILED;
+
+  // Navigate may call into Javascript (e.g. with a "javascript:" URL),
+  // or do things like navigate away from the page, either one of which will
+  // need to re-enter into the plugin. It is safe, because it is essentially
+  // equivalent to NPN_GetURL, where Flash would expect re-entrancy.
+  ppapi::proxy::HostDispatcher* host_dispatcher =
+      ppapi::proxy::HostDispatcher::GetForInstance(pp_instance());
+  host_dispatcher->set_allow_plugin_reentrancy();
+
+  // Grab a weak pointer to ourselves on the stack so we can check if we are
+  // still alive.
+  base::WeakPtr<PepperFlashRendererHost> weak_ptr = weak_factory_.GetWeakPtr();
+  // Keep track of reply contexts in case we are destroyed during a Navigate
+  // call. Even if we are destroyed, we still need to send these replies to
+  // unblock the plugin process.
+  navigate_replies_.push_back(host_context->MakeReplyMessageContext());
+  plugin_instance->Navigate(data, target.c_str(), from_user_action);
+  // This object might have been destroyed by this point. If it is destroyed
+  // the reply will be sent in the destructor. Otherwise send the reply here.
+  if (weak_ptr) {
+    SendReply(navigate_replies_.back(), IPC::Message());
+    navigate_replies_.pop_back();
+  }
+
+  // Return PP_OK_COMPLETIONPENDING so that no reply is automatically sent.
+  return PP_OK_COMPLETIONPENDING;
+}
+
+int32_t PepperFlashRendererHost::OnMsgIsRectTopmost(
+    ppapi::host::HostMessageContext* host_context,
+    const PP_Rect& rect) {
+  webkit::ppapi::PluginInstance* plugin_instance =
+      host_->GetPluginInstance(pp_instance());
+  if (plugin_instance && plugin_instance->IsRectTopmost(
+      gfx::Rect(rect.point.x, rect.point.y,rect.size.width, rect.size.height)))
+    return PP_OK;
+  return PP_ERROR_FAILED;
+}
+
 }  // namespace content
diff --git a/content/renderer/pepper/pepper_flash_renderer_host.h b/content/renderer/pepper/pepper_flash_renderer_host.h
index 87470c7..c2ed0eb 100644
--- a/content/renderer/pepper/pepper_flash_renderer_host.h
+++ b/content/renderer/pepper/pepper_flash_renderer_host.h
@@ -5,10 +5,26 @@
 #ifndef CONTENT_RENDERER_PEPPER_PEPPER_FLASH_RENDERER_HOST_H_
 #define CONTENT_RENDERER_PEPPER_PEPPER_FLASH_RENDERER_HOST_H_
 
+#include <string>
+#include <vector>
+
 #include "base/basictypes.h"
+#include "base/memory/weak_ptr.h"
 #include "ppapi/host/host_message_context.h"
 #include "ppapi/host/resource_host.h"
 
+struct PP_Rect;
+
+namespace ppapi {
+struct URLRequestInfoData;
+}
+
+namespace ppapi {
+namespace proxy {
+struct PPBFlash_DrawGlyphs_Params;
+}
+}
+
 namespace content {
 
 class RendererPpapiHost;
@@ -28,6 +44,24 @@
  private:
   int32_t OnMsgGetProxyForURL(ppapi::host::HostMessageContext* host_context,
                               const std::string& url);
+  int32_t OnMsgSetInstanceAlwaysOnTop(
+      ppapi::host::HostMessageContext* host_context,
+      bool on_top);
+  int32_t OnMsgDrawGlyphs(ppapi::host::HostMessageContext* host_context,
+                          ppapi::proxy::PPBFlash_DrawGlyphs_Params params);
+  int32_t OnMsgNavigate(ppapi::host::HostMessageContext* host_context,
+                        const ppapi::URLRequestInfoData& data,
+                        const std::string& target,
+                        bool from_user_action);
+  int32_t OnMsgIsRectTopmost(ppapi::host::HostMessageContext* host_context,
+                             const PP_Rect& rect);
+
+  base::WeakPtrFactory<PepperFlashRendererHost> weak_factory_;
+  // A stack of ReplyMessageContexts to track Navigate() calls which have not
+  // yet been replied to.
+  std::vector<ppapi::host::ReplyMessageContext> navigate_replies_;
+
+  RendererPpapiHost* host_;
 
   DISALLOW_COPY_AND_ASSIGN(PepperFlashRendererHost);
 };
diff --git a/ppapi/host/ppapi_host.cc b/ppapi/host/ppapi_host.cc
index 6cc4db7c..afb8396 100644
--- a/ppapi/host/ppapi_host.cc
+++ b/ppapi/host/ppapi_host.cc
@@ -134,6 +134,7 @@
     HostMessageContext* context) {
   ResourceHost* resource_host = GetResourceHost(params.pp_resource());
   if (resource_host) {
+    // CAUTION: Handling the message may cause the destruction of this object.
     resource_host->HandleMessage(nested_msg, context);
   } else {
     if (context->params.has_callback()) {
diff --git a/ppapi/host/resource_message_handler.cc b/ppapi/host/resource_message_handler.cc
index 9442c156..603d5e2 100644
--- a/ppapi/host/resource_message_handler.cc
+++ b/ppapi/host/resource_message_handler.cc
@@ -22,6 +22,11 @@
     const IPC::Message& msg,
     HostMessageContext* context) {
   ReplyMessageContext reply_context = context->MakeReplyMessageContext();
+  // CAUTION: Handling the message may cause the destruction of this object.
+  // The message handler should ensure that if there is a chance that the
+  // object will be destroyed, PP_OK_COMPLETIONPENDING is returned as the
+  // result of the message handler. Otherwise the code below will attempt to
+  // send a reply message on a destroyed object.
   reply_context.params.set_result(OnResourceMessageReceived(msg, context));
 
   // Sanity check the resource handler. Note if the result was
diff --git a/ppapi/proxy/flash_resource.cc b/ppapi/proxy/flash_resource.cc
index 8860247..854996e 100644
--- a/ppapi/proxy/flash_resource.cc
+++ b/ppapi/proxy/flash_resource.cc
@@ -11,14 +11,19 @@
 #include "base/time.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/private/ppb_flash.h"
+#include "ppapi/c/trusted/ppb_browser_font_trusted.h"
 #include "ppapi/proxy/plugin_dispatcher.h"
 #include "ppapi/proxy/plugin_globals.h"
 #include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/proxy/serialized_structs.h"
 #include "ppapi/shared_impl/ppapi_preferences.h"
 #include "ppapi/shared_impl/scoped_pp_var.h"
 #include "ppapi/shared_impl/time_conversion.h"
 #include "ppapi/shared_impl/var.h"
 #include "ppapi/thunk/enter.h"
+#include "ppapi/thunk/ppb_url_request_info_api.h"
+
+using ppapi::thunk::EnterResourceNoLock;
 
 namespace ppapi {
 namespace proxy {
@@ -165,5 +170,75 @@
   return PP_MakeUndefined();
 }
 
+void FlashResource::SetInstanceAlwaysOnTop(PP_Instance instance,
+                                           PP_Bool on_top) {
+  Post(RENDERER, PpapiHostMsg_Flash_SetInstanceAlwaysOnTop(PP_ToBool(on_top)));
+}
+
+PP_Bool FlashResource::DrawGlyphs(
+    PP_Instance instance,
+    PP_Resource pp_image_data,
+    const PP_BrowserFont_Trusted_Description* font_desc,
+    uint32_t color,
+    const PP_Point* position,
+    const PP_Rect* clip,
+    const float transformation[3][3],
+    PP_Bool allow_subpixel_aa,
+    uint32_t glyph_count,
+    const uint16_t glyph_indices[],
+    const PP_Point glyph_advances[]) {
+  EnterResourceNoLock<thunk::PPB_ImageData_API> enter(pp_image_data, true);
+  if (enter.failed())
+    return PP_FALSE;
+  // The instance parameter isn't strictly necessary but we check that it
+  // matches anyway.
+  if (enter.resource()->pp_instance() != instance)
+    return PP_FALSE;
+
+  PPBFlash_DrawGlyphs_Params params;
+  params.image_data = enter.resource()->host_resource();
+  params.font_desc.SetFromPPBrowserFontDescription(*font_desc);
+  params.color = color;
+  params.position = *position;
+  params.clip = *clip;
+  for (int i = 0; i < 3; i++) {
+    for (int j = 0; j < 3; j++)
+      params.transformation[i][j] = transformation[i][j];
+  }
+  params.allow_subpixel_aa = allow_subpixel_aa;
+
+  params.glyph_indices.insert(params.glyph_indices.begin(),
+                              &glyph_indices[0],
+                              &glyph_indices[glyph_count]);
+  params.glyph_advances.insert(params.glyph_advances.begin(),
+                               &glyph_advances[0],
+                               &glyph_advances[glyph_count]);
+
+  // This has to be synchronous because the caller may want to composite on
+  // top of the resulting text after the call is complete.
+  int32_t result = SyncCall<IPC::Message>(RENDERER,
+      PpapiHostMsg_Flash_DrawGlyphs(params));
+  return PP_FromBool(result == PP_OK);
+}
+
+int32_t FlashResource::Navigate(PP_Instance instance,
+                                PP_Resource request_info,
+                                const char* target,
+                                PP_Bool from_user_action) {
+  EnterResourceNoLock<thunk::PPB_URLRequestInfo_API> enter(request_info,
+                                                                  true);
+  if (enter.failed())
+    return PP_ERROR_BADRESOURCE;
+  return SyncCall<IPC::Message>(RENDERER, PpapiHostMsg_Flash_Navigate(
+      enter.object()->GetData(), target, PP_ToBool(from_user_action)));
+}
+
+PP_Bool FlashResource::IsRectTopmost(PP_Instance instance,
+                                     const PP_Rect* rect) {
+  int32_t result = SyncCall<IPC::Message>(RENDERER,
+      PpapiHostMsg_Flash_IsRectTopmost(*rect));
+  return PP_FromBool(result == PP_OK);
+}
+
 }  // namespace proxy
 }  // namespace ppapi
diff --git a/ppapi/proxy/flash_resource.h b/ppapi/proxy/flash_resource.h
index 1fa8697a..b8c819e 100644
--- a/ppapi/proxy/flash_resource.h
+++ b/ppapi/proxy/flash_resource.h
@@ -10,7 +10,6 @@
 #include "ppapi/c/private/ppb_flash.h"
 #include "ppapi/proxy/connection.h"
 #include "ppapi/proxy/plugin_resource.h"
-#include "ppapi/proxy/ppapi_proxy_export.h"
 #include "ppapi/thunk/ppb_flash_functions_api.h"
 
 namespace ppapi {
@@ -18,9 +17,9 @@
 
 class PluginDispatcher;
 
-class PPAPI_PROXY_EXPORT FlashResource
+class FlashResource
     : public PluginResource,
-      public NON_EXPORTED_BASE(thunk::PPB_Flash_Functions_API) {
+      public thunk::PPB_Flash_Functions_API {
  public:
   FlashResource(Connection connection,
                 PP_Instance instance,
@@ -41,6 +40,26 @@
                                         PP_Time t) OVERRIDE;
   virtual PP_Var GetSetting(PP_Instance instance,
                             PP_FlashSetting setting) OVERRIDE;
+  virtual void SetInstanceAlwaysOnTop(PP_Instance instance,
+                                      PP_Bool on_top) OVERRIDE;
+  virtual PP_Bool DrawGlyphs(
+      PP_Instance instance,
+      PP_Resource pp_image_data,
+      const PP_BrowserFont_Trusted_Description* font_desc,
+      uint32_t color,
+      const PP_Point* position,
+      const PP_Rect* clip,
+      const float transformation[3][3],
+      PP_Bool allow_subpixel_aa,
+      uint32_t glyph_count,
+      const uint16_t glyph_indices[],
+      const PP_Point glyph_advances[]) OVERRIDE;
+  virtual int32_t Navigate(PP_Instance instance,
+                           PP_Resource request_info,
+                           const char* target,
+                           PP_Bool from_user_action) OVERRIDE;
+  virtual PP_Bool IsRectTopmost(PP_Instance instance,
+                                const PP_Rect* rect) OVERRIDE;
 
  private:
   // Non-owning pointer to the PluginDispatcher that owns this object.
diff --git a/ppapi/proxy/ppapi_messages.h b/ppapi/proxy/ppapi_messages.h
index 28538f8..7e9bedda 100644
--- a/ppapi/proxy/ppapi_messages.h
+++ b/ppapi/proxy/ppapi_messages.h
@@ -1250,30 +1250,6 @@
                            ppapi::HostResource /* video_decoder */)
 
 // PPB_Flash.
-IPC_MESSAGE_ROUTED2(PpapiHostMsg_PPBFlash_SetInstanceAlwaysOnTop,
-                    PP_Instance /* instance */,
-                    PP_Bool /* on_top */)
-// This has to be synchronous becuase the caller may want to composite on
-// top of the resulting text after the call is complete.
-IPC_SYNC_MESSAGE_ROUTED2_1(
-    PpapiHostMsg_PPBFlash_DrawGlyphs,
-    PP_Instance /* instance */,
-    ppapi::proxy::PPBFlash_DrawGlyphs_Params /* params */,
-    PP_Bool /* result */)
-IPC_SYNC_MESSAGE_ROUTED4_1(PpapiHostMsg_PPBFlash_Navigate,
-                           PP_Instance /* instance */,
-                           ppapi::URLRequestInfoData /* request_data */,
-                           std::string /* target */,
-                           PP_Bool /* from_user_action */,
-                           int32_t /* result */)
-IPC_SYNC_MESSAGE_ROUTED2_1(PpapiHostMsg_PPBFlash_GetLocalTimeZoneOffset,
-                           PP_Instance /* instance */,
-                           PP_Time /* t */,
-                           double /* offset */)
-IPC_SYNC_MESSAGE_ROUTED2_1(PpapiHostMsg_PPBFlash_IsRectTopmost,
-                           PP_Instance /* instance */,
-                           PP_Rect /* rect */,
-                           PP_Bool /* result */)
 IPC_MESSAGE_ROUTED1(PpapiHostMsg_PPBFlash_InvokePrinting,
                     PP_Instance /* instance */)
 
@@ -1616,6 +1592,33 @@
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_Flash_GetLocalDataRestrictionsReply,
                      int32_t /* restrictions */)
 
+// Notifies the renderer whether the Flash instance is in windowed mode. No
+// reply is sent.
+IPC_MESSAGE_CONTROL1(PpapiHostMsg_Flash_SetInstanceAlwaysOnTop,
+                     bool /* on_top */)
+
+// Notifies the renderer to draw text to the given PP_ImageData resource. All
+// parmeters for drawing (including the resource to draw to) are contianed in
+// the PPBFlash_DrawGlyphs_Params structure. An error code is sent in a reply
+// message indicating success.
+IPC_MESSAGE_CONTROL1(PpapiHostMsg_Flash_DrawGlyphs,
+                     ppapi::proxy::PPBFlash_DrawGlyphs_Params /* params */)
+
+// Notifies the renderer to navigate to the given URL contained in the
+// URLRequestInfoData. An error code is sent in a reply message indicating
+// success.
+IPC_MESSAGE_CONTROL3(PpapiHostMsg_Flash_Navigate,
+                     ppapi::URLRequestInfoData /* data */,
+                     std::string /* target */,
+                     bool /* from_user_action */)
+
+// Queries the renderer on whether the plugin instance is the topmost element
+// in the area of the instance specified by the given PP_Rect. PP_OK is sent as
+// the error code in a reply message if the rect is topmost otherwise
+// PP_ERROR_FAILED is sent.
+IPC_MESSAGE_CONTROL1(PpapiHostMsg_Flash_IsRectTopmost,
+                     PP_Rect /* rect */)
+
 // DeviceEnumeration -----------------------------------------------------------
 // Device enumeration messages used by audio input and video capture.
 IPC_MESSAGE_CONTROL0(PpapiHostMsg_DeviceEnumeration_EnumerateDevices)
diff --git a/ppapi/proxy/ppb_flash_proxy.cc b/ppapi/proxy/ppb_flash_proxy.cc
index 2e911e4..cacd863 100644
--- a/ppapi/proxy/ppb_flash_proxy.cc
+++ b/ppapi/proxy/ppb_flash_proxy.cc
@@ -77,13 +77,6 @@
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PPB_Flash_Proxy, msg)
-    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_SetInstanceAlwaysOnTop,
-                        OnHostMsgSetInstanceAlwaysOnTop)
-    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_DrawGlyphs,
-                        OnHostMsgDrawGlyphs)
-    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_Navigate, OnHostMsgNavigate)
-    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_IsRectTopmost,
-                        OnHostMsgIsRectTopmost)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBFlash_InvokePrinting,
                         OnHostMsgInvokePrinting)
     IPC_MESSAGE_UNHANDLED(handled = false)
@@ -92,166 +85,6 @@
   return handled;
 }
 
-void PPB_Flash_Proxy::SetInstanceAlwaysOnTop(PP_Instance instance,
-                                             PP_Bool on_top) {
-  dispatcher()->Send(new PpapiHostMsg_PPBFlash_SetInstanceAlwaysOnTop(
-      API_ID_PPB_FLASH, instance, on_top));
-}
-
-PP_Bool PPB_Flash_Proxy::DrawGlyphs(
-    PP_Instance instance,
-    PP_Resource pp_image_data,
-    const PP_BrowserFont_Trusted_Description* font_desc,
-    uint32_t color,
-    const PP_Point* position,
-    const PP_Rect* clip,
-    const float transformation[3][3],
-    PP_Bool allow_subpixel_aa,
-    uint32_t glyph_count,
-    const uint16_t glyph_indices[],
-    const PP_Point glyph_advances[]) {
-  Resource* image_data =
-      PpapiGlobals::Get()->GetResourceTracker()->GetResource(pp_image_data);
-  if (!image_data)
-    return PP_FALSE;
-  // The instance parameter isn't strictly necessary but we check that it
-  // matches anyway.
-  if (image_data->pp_instance() != instance)
-    return PP_FALSE;
-
-  PPBFlash_DrawGlyphs_Params params;
-  params.image_data = image_data->host_resource();
-  params.font_desc.SetFromPPBrowserFontDescription(*font_desc);
-  params.color = color;
-  params.position = *position;
-  params.clip = *clip;
-  for (int i = 0; i < 3; i++) {
-    for (int j = 0; j < 3; j++)
-      params.transformation[i][j] = transformation[i][j];
-  }
-  params.allow_subpixel_aa = allow_subpixel_aa;
-
-  params.glyph_indices.insert(params.glyph_indices.begin(),
-                              &glyph_indices[0],
-                              &glyph_indices[glyph_count]);
-  params.glyph_advances.insert(params.glyph_advances.begin(),
-                               &glyph_advances[0],
-                               &glyph_advances[glyph_count]);
-
-  PP_Bool result = PP_FALSE;
-  dispatcher()->Send(new PpapiHostMsg_PPBFlash_DrawGlyphs(
-      API_ID_PPB_FLASH, instance, params, &result));
-  return result;
-}
-
-int32_t PPB_Flash_Proxy::Navigate(PP_Instance instance,
-                                  PP_Resource request_info,
-                                  const char* target,
-                                  PP_Bool from_user_action) {
-  thunk::EnterResourceNoLock<thunk::PPB_URLRequestInfo_API> enter(
-      request_info, true);
-  if (enter.failed())
-    return PP_ERROR_BADRESOURCE;
-  return Navigate(instance, enter.object()->GetData(), target,
-                  from_user_action);
-}
-
-int32_t PPB_Flash_Proxy::Navigate(PP_Instance instance,
-                                  const URLRequestInfoData& data,
-                                  const char* target,
-                                  PP_Bool from_user_action) {
-  int32_t result = PP_ERROR_FAILED;
-  dispatcher()->Send(new PpapiHostMsg_PPBFlash_Navigate(
-      API_ID_PPB_FLASH, instance, data, target, from_user_action, &result));
-  return result;
-}
-
-PP_Bool PPB_Flash_Proxy::IsRectTopmost(PP_Instance instance,
-                                       const PP_Rect* rect) {
-  PP_Bool result = PP_FALSE;
-  dispatcher()->Send(new PpapiHostMsg_PPBFlash_IsRectTopmost(
-      API_ID_PPB_FLASH, instance, *rect, &result));
-  return result;
-}
-
-void PPB_Flash_Proxy::OnHostMsgSetInstanceAlwaysOnTop(PP_Instance instance,
-                                                      PP_Bool on_top) {
-  EnterInstanceNoLock enter(instance);
-  if (enter.succeeded())
-    enter.functions()->GetFlashAPI()->SetInstanceAlwaysOnTop(instance, on_top);
-}
-
-void PPB_Flash_Proxy::OnHostMsgDrawGlyphs(
-    PP_Instance instance,
-    const PPBFlash_DrawGlyphs_Params& params,
-    PP_Bool* result) {
-  *result = PP_FALSE;
-  EnterInstanceNoLock enter(instance);
-  if (enter.failed())
-    return;
-
-  if (params.glyph_indices.size() != params.glyph_advances.size() ||
-      params.glyph_indices.empty())
-    return;
-
-  PP_BrowserFont_Trusted_Description font_desc;
-  params.font_desc.SetToPPBrowserFontDescription(&font_desc);
-
-  *result = enter.functions()->GetFlashAPI()->DrawGlyphs(
-      0,  // Unused instance param.
-      params.image_data.host_resource(), &font_desc,
-      params.color, &params.position, &params.clip,
-      const_cast<float(*)[3]>(params.transformation),
-      params.allow_subpixel_aa,
-      static_cast<uint32_t>(params.glyph_indices.size()),
-      const_cast<uint16_t*>(&params.glyph_indices[0]),
-      const_cast<PP_Point*>(&params.glyph_advances[0]));
-
-  // SetToPPFontDescription() creates a var which is owned by the caller.
-  PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(font_desc.face);
-}
-
-void PPB_Flash_Proxy::OnHostMsgNavigate(PP_Instance instance,
-                                        const URLRequestInfoData& data,
-                                        const std::string& target,
-                                        PP_Bool from_user_action,
-                                        int32_t* result) {
-  EnterInstanceNoLock enter_instance(instance);
-  if (enter_instance.failed()) {
-    *result = PP_ERROR_BADARGUMENT;
-    return;
-  }
-  DCHECK(!dispatcher()->IsPlugin());
-
-  // Validate the PP_Instance since we'll be constructing resources on its
-  // behalf.
-  HostDispatcher* host_dispatcher = static_cast<HostDispatcher*>(dispatcher());
-  if (HostDispatcher::GetForInstance(instance) != host_dispatcher) {
-    NOTREACHED();
-    *result = PP_ERROR_BADARGUMENT;
-    return;
-  }
-
-  // We need to allow re-entrancy here, because this may call into Javascript
-  // (e.g. with a "javascript:" URL), or do things like navigate away from the
-  // page, either one of which will need to re-enter into the plugin.
-  // It is safe, because it is essentially equivalent to NPN_GetURL, where Flash
-  // would expect re-entrancy. When running in-process, it does re-enter here.
-  host_dispatcher->set_allow_plugin_reentrancy();
-  *result = enter_instance.functions()->GetFlashAPI()->Navigate(
-      instance, data, target.c_str(), from_user_action);
-}
-
-void PPB_Flash_Proxy::OnHostMsgIsRectTopmost(PP_Instance instance,
-                                             PP_Rect rect,
-                                             PP_Bool* result) {
-  EnterInstanceNoLock enter(instance);
-  if (enter.succeeded())
-    *result = enter.functions()->GetFlashAPI()->IsRectTopmost(instance, &rect);
-  else
-    *result = PP_FALSE;
-}
-
 void PPB_Flash_Proxy::OnHostMsgInvokePrinting(PP_Instance instance) {
   // This function is actually implemented in the PPB_Flash_Print interface.
   // It's rarely used enough that we just request this interface when needed.
diff --git a/ppapi/proxy/ppb_flash_proxy.h b/ppapi/proxy/ppb_flash_proxy.h
index a900925..e7c773a 100644
--- a/ppapi/proxy/ppb_flash_proxy.h
+++ b/ppapi/proxy/ppb_flash_proxy.h
@@ -47,49 +47,10 @@
   // InterfaceProxy implementation.
   virtual bool OnMessageReceived(const IPC::Message& msg);
 
-  // PPB_Flash_API implementation.
-  virtual void SetInstanceAlwaysOnTop(PP_Instance instance,
-                                      PP_Bool on_top) OVERRIDE;
-  virtual PP_Bool DrawGlyphs(
-      PP_Instance instance,
-      PP_Resource pp_image_data,
-      const PP_BrowserFont_Trusted_Description* font_desc,
-      uint32_t color,
-      const PP_Point* position,
-      const PP_Rect* clip,
-      const float transformation[3][3],
-      PP_Bool allow_subpixel_aa,
-      uint32_t glyph_count,
-      const uint16_t glyph_indices[],
-      const PP_Point glyph_advances[]) OVERRIDE;
-  virtual int32_t Navigate(PP_Instance instance,
-                           PP_Resource request_info,
-                           const char* target,
-                           PP_Bool from_user_action) OVERRIDE;
-  virtual int32_t Navigate(PP_Instance instance,
-                           const URLRequestInfoData& data,
-                           const char* target,
-                           PP_Bool from_user_action) OVERRIDE;
-  virtual PP_Bool IsRectTopmost(PP_Instance instance,
-                                const PP_Rect* rect) OVERRIDE;
-
   static const ApiID kApiID = API_ID_PPB_FLASH;
 
  private:
   // Message handlers.
-  void OnHostMsgSetInstanceAlwaysOnTop(PP_Instance instance,
-                                       PP_Bool on_top);
-  void OnHostMsgDrawGlyphs(PP_Instance instance,
-                           const PPBFlash_DrawGlyphs_Params& params,
-                           PP_Bool* result);
-  void OnHostMsgNavigate(PP_Instance instance,
-                         const URLRequestInfoData& data,
-                         const std::string& target,
-                         PP_Bool from_user_action,
-                         int32_t* result);
-  void OnHostMsgIsRectTopmost(PP_Instance instance,
-                              PP_Rect rect,
-                              PP_Bool* result);
   void OnHostMsgInvokePrinting(PP_Instance instance);
 
   DISALLOW_COPY_AND_ASSIGN(PPB_Flash_Proxy);
diff --git a/ppapi/proxy/serialized_structs.h b/ppapi/proxy/serialized_structs.h
index bdc1b678..5c5dcab 100644
--- a/ppapi/proxy/serialized_structs.h
+++ b/ppapi/proxy/serialized_structs.h
@@ -62,7 +62,7 @@
   bool is_dir;
 };
 
-struct PPBFlash_DrawGlyphs_Params {
+struct PPAPI_PROXY_EXPORT PPBFlash_DrawGlyphs_Params {
   PPBFlash_DrawGlyphs_Params();
   ~PPBFlash_DrawGlyphs_Params();
 
diff --git a/ppapi/thunk/ppb_flash_api.h b/ppapi/thunk/ppb_flash_api.h
index 2f57aea..0c8d39b 100644
--- a/ppapi/thunk/ppb_flash_api.h
+++ b/ppapi/thunk/ppb_flash_api.h
@@ -6,13 +6,9 @@
 #define PPAPI_THUNK_PPB_FLASH_API_H_
 
 #include "ppapi/c/private/ppb_flash.h"
-#include "ppapi/c/private/ppb_flash_file.h"
 #include "ppapi/thunk/ppapi_thunk_export.h"
 
 namespace ppapi {
-
-struct URLRequestInfoData;
-
 namespace thunk {
 
 /////////////////////////// WARNING:DEPRECTATED ////////////////////////////////
@@ -26,35 +22,6 @@
 class PPAPI_THUNK_EXPORT PPB_Flash_API {
  public:
   virtual ~PPB_Flash_API() {}
-
-  // Flash.
-  virtual void SetInstanceAlwaysOnTop(PP_Instance instance, PP_Bool on_top) = 0;
-  virtual PP_Bool DrawGlyphs(
-      PP_Instance instance,
-      PP_Resource pp_image_data,
-      const PP_BrowserFont_Trusted_Description* font_desc,
-      uint32_t color,
-      const PP_Point* position,
-      const PP_Rect* clip,
-      const float transformation[3][3],
-      PP_Bool allow_subpixel_aa,
-      uint32_t glyph_count,
-      const uint16_t glyph_indices[],
-      const PP_Point glyph_advances[]) = 0;
-
-  // External function that takes a PPB_URLRequestInfo resource.
-  virtual int32_t Navigate(PP_Instance instance,
-                           PP_Resource request_info,
-                           const char* target,
-                           PP_Bool from_user_action) = 0;
-
-  // Internal navigate function that takes a URLRequestInfoData.
-  virtual int32_t Navigate(PP_Instance instance,
-                           const URLRequestInfoData& data,
-                           const char* target,
-                           PP_Bool from_user_action) = 0;
-
-  virtual PP_Bool IsRectTopmost(PP_Instance instance, const PP_Rect* rect) = 0;
 };
 
 }  // namespace thunk
diff --git a/ppapi/thunk/ppb_flash_functions_api.h b/ppapi/thunk/ppb_flash_functions_api.h
index ae15623..c497286c 100644
--- a/ppapi/thunk/ppb_flash_functions_api.h
+++ b/ppapi/thunk/ppb_flash_functions_api.h
@@ -11,6 +11,8 @@
 #include "ppapi/shared_impl/singleton_resource_id.h"
 #include "ppapi/thunk/ppapi_thunk_export.h"
 
+struct PP_BrowserFont_Trusted_Description;
+
 namespace ppapi {
 namespace thunk {
 
@@ -28,6 +30,25 @@
                                PP_Var value) = 0;
   virtual double GetLocalTimeZoneOffset(PP_Instance instance, PP_Time t) = 0;
   virtual PP_Var GetSetting(PP_Instance instance, PP_FlashSetting setting) = 0;
+  virtual void SetInstanceAlwaysOnTop(PP_Instance instance, PP_Bool on_top) = 0;
+  virtual PP_Bool DrawGlyphs(
+      PP_Instance instance,
+      PP_Resource pp_image_data,
+      const PP_BrowserFont_Trusted_Description* font_desc,
+      uint32_t color,
+      const PP_Point* position,
+      const PP_Rect* clip,
+      const float transformation[3][3],
+      PP_Bool allow_subpixel_aa,
+      uint32_t glyph_count,
+      const uint16_t glyph_indices[],
+      const PP_Point glyph_advances[]) = 0;
+  virtual int32_t Navigate(PP_Instance instance,
+                           PP_Resource request_info,
+                           const char* target,
+                           PP_Bool from_user_action) = 0;
+
+  virtual PP_Bool IsRectTopmost(PP_Instance instance, const PP_Rect* rect) = 0;
 
   static const SingletonResourceID kSingletonResourceID = FLASH_SINGLETON_ID;
 };
diff --git a/ppapi/thunk/ppb_flash_thunk.cc b/ppapi/thunk/ppb_flash_thunk.cc
index b9735f4..c4e27f1 100644
--- a/ppapi/thunk/ppb_flash_thunk.cc
+++ b/ppapi/thunk/ppb_flash_thunk.cc
@@ -22,10 +22,10 @@
 namespace {
 
 void SetInstanceAlwaysOnTop(PP_Instance instance, PP_Bool on_top) {
-  EnterInstance enter(instance);
+  EnterInstanceAPI<PPB_Flash_Functions_API> enter(instance);
   if (enter.failed())
     return;
-  enter.functions()->GetFlashAPI()->SetInstanceAlwaysOnTop(instance, on_top);
+  enter.functions()->SetInstanceAlwaysOnTop(instance, on_top);
 }
 
 PP_Bool DrawGlyphs(PP_Instance instance,
@@ -39,10 +39,10 @@
                    uint32_t glyph_count,
                    const uint16_t glyph_indices[],
                    const PP_Point glyph_advances[]) {
-  EnterInstance enter(instance);
+  EnterInstanceAPI<PPB_Flash_Functions_API> enter(instance);
   if (enter.failed())
     return PP_FALSE;
-  return enter.functions()->GetFlashAPI()->DrawGlyphs(
+  return enter.functions()->DrawGlyphs(
       instance, pp_image_data, font_desc, color, position, clip, transformation,
       allow_subpixel_aa, glyph_count, glyph_indices, glyph_advances);
 }
@@ -67,11 +67,11 @@
     instance = enter.resource()->pp_instance();
   }
 
-  EnterInstance enter(instance);
+  EnterInstanceAPI<PPB_Flash_Functions_API> enter(instance);
   if (enter.failed())
     return PP_ERROR_BADARGUMENT;
-  return enter.functions()->GetFlashAPI()->Navigate(instance, request_id,
-                                                    target, from_user_action);
+  return enter.functions()->Navigate(instance, request_id, target,
+                                     from_user_action);
 }
 
 void RunMessageLoop(PP_Instance instance) {
@@ -107,10 +107,10 @@
 }
 
 PP_Bool IsRectTopmost(PP_Instance instance, const PP_Rect* rect) {
-  EnterInstance enter(instance);
+  EnterInstanceAPI<PPB_Flash_Functions_API> enter(instance);
   if (enter.failed())
     return PP_FALSE;
-  return enter.functions()->GetFlashAPI()->IsRectTopmost(instance, rect);
+  return enter.functions()->IsRectTopmost(instance, rect);
 }
 
 int32_t InvokePrinting(PP_Instance instance) {
diff --git a/webkit/plugins/ppapi/ppb_flash_impl.cc b/webkit/plugins/ppapi/ppb_flash_impl.cc
index 12ae10a..9e321b4 100644
--- a/webkit/plugins/ppapi/ppb_flash_impl.cc
+++ b/webkit/plugins/ppapi/ppb_flash_impl.cc
@@ -5,7 +5,6 @@
 #include "webkit/plugins/ppapi/ppb_flash_impl.h"
 
 #include <string>
-#include <vector>
 
 #include "googleurl/src/gurl.h"
 #include "ppapi/c/private/ppb_flash.h"
@@ -13,167 +12,28 @@
 #include "ppapi/shared_impl/time_conversion.h"
 #include "ppapi/shared_impl/var.h"
 #include "ppapi/thunk/enter.h"
-#include "ppapi/thunk/ppb_image_data_api.h"
-#include "ppapi/thunk/ppb_url_request_info_api.h"
-#include "skia/ext/platform_canvas.h"
-#include "third_party/skia/include/core/SkCanvas.h"
-#include "third_party/skia/include/core/SkMatrix.h"
-#include "third_party/skia/include/core/SkPaint.h"
-#include "third_party/skia/include/core/SkPoint.h"
-#include "third_party/skia/include/core/SkTemplates.h"
-#include "third_party/skia/include/core/SkTypeface.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDocument.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginContainer.h"
-#include "ui/gfx/rect.h"
 #include "webkit/plugins/ppapi/common.h"
 #include "webkit/plugins/ppapi/host_globals.h"
 #include "webkit/plugins/ppapi/plugin_delegate.h"
 #include "webkit/plugins/ppapi/plugin_module.h"
 #include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
 #include "webkit/plugins/ppapi/resource_helper.h"
-#include "webkit/plugins/ppapi/ppb_image_data_impl.h"
 
 using ppapi::PPTimeToTime;
 using ppapi::StringVar;
 using ppapi::thunk::EnterResourceNoLock;
-using ppapi::thunk::PPB_ImageData_API;
-using ppapi::thunk::PPB_URLRequestInfo_API;
 
 namespace webkit {
 namespace ppapi {
 
-PPB_Flash_Impl::PPB_Flash_Impl(PluginInstance* instance)
-    : instance_(instance) {
+PPB_Flash_Impl::PPB_Flash_Impl(PluginInstance* instance) {
 }
 
 PPB_Flash_Impl::~PPB_Flash_Impl() {
 }
 
-void PPB_Flash_Impl::SetInstanceAlwaysOnTop(PP_Instance instance,
-                                            PP_Bool on_top) {
-  instance_->set_always_on_top(PP_ToBool(on_top));
-}
-
-PP_Bool PPB_Flash_Impl::DrawGlyphs(
-    PP_Instance instance,
-    PP_Resource pp_image_data,
-    const PP_BrowserFont_Trusted_Description* font_desc,
-    uint32_t color,
-    const PP_Point* position,
-    const PP_Rect* clip,
-    const float transformation[3][3],
-    PP_Bool allow_subpixel_aa,
-    uint32_t glyph_count,
-    const uint16_t glyph_indices[],
-    const PP_Point glyph_advances[]) {
-  EnterResourceNoLock<PPB_ImageData_API> enter(pp_image_data, true);
-  if (enter.failed())
-    return PP_FALSE;
-  PPB_ImageData_Impl* image_resource =
-      static_cast<PPB_ImageData_Impl*>(enter.object());
-
-  ImageDataAutoMapper mapper(image_resource);
-  if (!mapper.is_valid())
-    return PP_FALSE;
-
-  // Set up the typeface.
-  StringVar* face_name = StringVar::FromPPVar(font_desc->face);
-  if (!face_name)
-    return PP_FALSE;
-  int style = SkTypeface::kNormal;
-  if (font_desc->weight >= PP_BROWSERFONT_TRUSTED_WEIGHT_BOLD)
-    style |= SkTypeface::kBold;
-  if (font_desc->italic)
-    style |= SkTypeface::kItalic;
-  skia::RefPtr<SkTypeface> typeface = skia::AdoptRef(
-      SkTypeface::CreateFromName(face_name->value().c_str(),
-                                 static_cast<SkTypeface::Style>(style)));
-  if (!typeface)
-    return PP_FALSE;
-
-  // Set up the canvas.
-  SkCanvas* canvas = image_resource->GetPlatformCanvas();
-  SkAutoCanvasRestore acr(canvas, true);
-
-  // Clip is applied in pixels before the transform.
-  SkRect clip_rect = { SkIntToScalar(clip->point.x),
-                       SkIntToScalar(clip->point.y),
-                       SkIntToScalar(clip->point.x + clip->size.width),
-                       SkIntToScalar(clip->point.y + clip->size.height) };
-  canvas->clipRect(clip_rect);
-
-  // Convert & set the matrix.
-  SkMatrix matrix;
-  matrix.set(SkMatrix::kMScaleX, SkFloatToScalar(transformation[0][0]));
-  matrix.set(SkMatrix::kMSkewX,  SkFloatToScalar(transformation[0][1]));
-  matrix.set(SkMatrix::kMTransX, SkFloatToScalar(transformation[0][2]));
-  matrix.set(SkMatrix::kMSkewY,  SkFloatToScalar(transformation[1][0]));
-  matrix.set(SkMatrix::kMScaleY, SkFloatToScalar(transformation[1][1]));
-  matrix.set(SkMatrix::kMTransY, SkFloatToScalar(transformation[1][2]));
-  matrix.set(SkMatrix::kMPersp0, SkFloatToScalar(transformation[2][0]));
-  matrix.set(SkMatrix::kMPersp1, SkFloatToScalar(transformation[2][1]));
-  matrix.set(SkMatrix::kMPersp2, SkFloatToScalar(transformation[2][2]));
-  canvas->concat(matrix);
-
-  SkPaint paint;
-  paint.setColor(color);
-  paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-  paint.setAntiAlias(true);
-  paint.setHinting(SkPaint::kFull_Hinting);
-  paint.setTextSize(SkIntToScalar(font_desc->size));
-  paint.setTypeface(typeface.get());  // Takes a ref and manages lifetime.
-  if (allow_subpixel_aa) {
-    paint.setSubpixelText(true);
-    paint.setLCDRenderText(true);
-  }
-
-  SkScalar x = SkIntToScalar(position->x);
-  SkScalar y = SkIntToScalar(position->y);
-
-  // Build up the skia advances.
-  if (glyph_count == 0)
-    return PP_TRUE;
-  std::vector<SkPoint> storage;
-  storage.resize(glyph_count);
-  SkPoint* sk_positions = &storage[0];
-  for (uint32_t i = 0; i < glyph_count; i++) {
-    sk_positions[i].set(x, y);
-    x += SkFloatToScalar(glyph_advances[i].x);
-    y += SkFloatToScalar(glyph_advances[i].y);
-  }
-
-  canvas->drawPosText(glyph_indices, glyph_count * 2, sk_positions, paint);
-
-  return PP_TRUE;
-}
-
-int32_t PPB_Flash_Impl::Navigate(PP_Instance instance,
-                                 PP_Resource request_info,
-                                 const char* target,
-                                 PP_Bool from_user_action) {
-  EnterResourceNoLock<PPB_URLRequestInfo_API> enter(request_info, true);
-  if (enter.failed())
-    return PP_ERROR_BADRESOURCE;
-  return Navigate(instance, enter.object()->GetData(), target,
-                  from_user_action);
-}
-
-int32_t PPB_Flash_Impl::Navigate(PP_Instance instance,
-                                 const ::ppapi::URLRequestInfoData& data,
-                                 const char* target,
-                                 PP_Bool from_user_action) {
-  if (!target)
-    return PP_ERROR_BADARGUMENT;
-  return instance_->Navigate(data, target, PP_ToBool(from_user_action));
-}
-
-PP_Bool PPB_Flash_Impl::IsRectTopmost(PP_Instance instance,
-                                      const PP_Rect* rect) {
-  return PP_FromBool(instance_->IsRectTopmost(
-      gfx::Rect(rect->point.x, rect->point.y,
-                rect->size.width, rect->size.height)));
-}
-
 }  // namespace ppapi
 }  // namespace webkit
diff --git a/webkit/plugins/ppapi/ppb_flash_impl.h b/webkit/plugins/ppapi/ppb_flash_impl.h
index 7c2c690..f407fe5 100644
--- a/webkit/plugins/ppapi/ppb_flash_impl.h
+++ b/webkit/plugins/ppapi/ppb_flash_impl.h
@@ -21,35 +21,6 @@
   explicit PPB_Flash_Impl(PluginInstance* instance);
   virtual ~PPB_Flash_Impl();
 
-  // PPB_Flash_API.
-  virtual void SetInstanceAlwaysOnTop(PP_Instance instance,
-                                      PP_Bool on_top) OVERRIDE;
-  virtual PP_Bool DrawGlyphs(
-      PP_Instance instance,
-      PP_Resource pp_image_data,
-      const PP_BrowserFont_Trusted_Description* font_desc,
-      uint32_t color,
-      const PP_Point* position,
-      const PP_Rect* clip,
-      const float transformation[3][3],
-      PP_Bool allow_subpixel_aa,
-      uint32_t glyph_count,
-      const uint16_t glyph_indices[],
-      const PP_Point glyph_advances[]) OVERRIDE;
-  virtual int32_t Navigate(PP_Instance instance,
-                           PP_Resource request_info,
-                           const char* target,
-                           PP_Bool from_user_action) OVERRIDE;
-  virtual int32_t Navigate(PP_Instance instance,
-                           const ::ppapi::URLRequestInfoData& data,
-                           const char* target,
-                           PP_Bool from_user_action) OVERRIDE;
-  virtual PP_Bool IsRectTopmost(PP_Instance instance,
-                                const PP_Rect* rect) OVERRIDE;
-
- private:
-  PluginInstance* instance_;
-
   DISALLOW_COPY_AND_ASSIGN(PPB_Flash_Impl);
 };