--- a/dom/plugins/PluginInstanceChild.cpp
+++ b/dom/plugins/PluginInstanceChild.cpp
@@ -16,16 +16,17 @@
  * The Original Code is Mozilla Plugin App.
  *
  * The Initial Developer of the Original Code is
  *   Chris Jones <jones.chris.g@gmail.com>
  * Portions created by the Initial Developer are Copyright (C) 2009
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Jim Mathies <jmathies@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -40,16 +41,17 @@
 #include "PluginModuleChild.h"
 #include "BrowserStreamChild.h"
 #include "PluginStreamChild.h"
 #include "StreamNotifyChild.h"
 
 #include "mozilla/ipc/SyncChannel.h"
 
 using namespace mozilla::plugins;
+using namespace mozilla::gfx;
 
 #ifdef MOZ_WIDGET_GTK2
 
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
 #include "gtk2xtbin.h"
 
@@ -323,18 +325,25 @@ PluginInstanceChild::AnswerNPP_HandleEve
     AssertPluginThread();
 
 #if defined(OS_LINUX) && defined(DEBUG)
     if (GraphicsExpose == event.event.type)
         printf("  received drawable 0x%lx\n",
                event.event.xgraphicsexpose.drawable);
 #endif
 
-    // plugins might be fooling with these, make a copy
+    // Make a copy since we may modify values.
     NPEvent evcopy = event.event;
+
+#ifdef OS_WIN
+    // Setup the shared dib for painting and update evcopy.
+    if (NPWindowTypeDrawable == mWindow.type && WM_PAINT == evcopy.event)
+        SharedSurfaceBeforePaint(evcopy);
+#endif
+
     *handled = mPluginIface->event(&mData, reinterpret_cast<void*>(&evcopy));
 
 #ifdef MOZ_X11
     if (GraphicsExpose == event.event.type) {
         // Make sure the X server completes the drawing before the parent
         // draws on top and destroys the Drawable.
         //
         // XSync() waits for the X server to complete.  Really this child
@@ -403,55 +412,68 @@ PluginInstanceChild::AnswerNPP_SetWindow
     mWsInfo.colormap = aWindow.colormap;
     if (!XVisualIDToInfo(mWsInfo.display, aWindow.visualID,
                          &mWsInfo.visual, &mWsInfo.depth))
         return false;
 
     *rv = mPluginIface->setwindow(&mData, &mWindow);
 
 #elif defined(OS_WIN)
-    ReparentPluginWindow((HWND)aWindow.window);
-    SizePluginWindow(aWindow.width, aWindow.height);
+    switch (aWindow.type) {
+      case NPWindowTypeWindow:
+      {
+          if (!CreatePluginWindow())
+              return false;
 
-    mWindow.window = (void*)mPluginWindowHWND;
-    mWindow.x = aWindow.x;
-    mWindow.y = aWindow.y;
-    mWindow.width = aWindow.width;
-    mWindow.height = aWindow.height;
-    mWindow.type = aWindow.type;
+          ReparentPluginWindow((HWND)aWindow.window);
+          SizePluginWindow(aWindow.width, aWindow.height);
+
+          mWindow.window = (void*)mPluginWindowHWND;
+          mWindow.x = aWindow.x;
+          mWindow.y = aWindow.y;
+          mWindow.width = aWindow.width;
+          mWindow.height = aWindow.height;
+          mWindow.type = aWindow.type;
 
-    *rv = mPluginIface->setwindow(&mData, &mWindow);
-    if (*rv == NPERR_NO_ERROR) {
-        WNDPROC wndProc = reinterpret_cast<WNDPROC>(
-            GetWindowLongPtr(mPluginWindowHWND, GWLP_WNDPROC));
-        if (wndProc != PluginWindowProc) {
-            mPluginWndProc = reinterpret_cast<WNDPROC>(
-                SetWindowLongPtr(mPluginWindowHWND, GWLP_WNDPROC,
-                                 reinterpret_cast<LONG>(PluginWindowProc)));
-        }
+          *rv = mPluginIface->setwindow(&mData, &mWindow);
+          if (*rv == NPERR_NO_ERROR) {
+              WNDPROC wndProc = reinterpret_cast<WNDPROC>(
+                  GetWindowLongPtr(mPluginWindowHWND, GWLP_WNDPROC));
+              if (wndProc != PluginWindowProc) {
+                  mPluginWndProc = reinterpret_cast<WNDPROC>(
+                      SetWindowLongPtr(mPluginWindowHWND, GWLP_WNDPROC,
+                                       reinterpret_cast<LONG>(PluginWindowProc)));
+              }
+          }
+      }
+      break;
+
+      case NPWindowTypeDrawable:
+          return SharedSurfaceSetWindow(aWindow, rv);
+      break;
+
+      default:
+          NS_NOTREACHED("Bad plugin window type.");
+          return false;
+      break;
     }
 
 #elif defined(OS_MACOSX)
 #  warning This is only a stub implementation IMPLEMENT ME
 
 #else
 #  error Implement me for your OS
 #endif
 
     return true;
 }
 
 bool
 PluginInstanceChild::Initialize()
 {
-#if defined(OS_WIN)
-    if (!CreatePluginWindow())
-        return false;
-#endif
-
     return true;
 }
 
 void
 PluginInstanceChild::Destroy()
 {
     // Copy the actors here so we don't enumerate a mutating array.
     nsAutoTArray<PluginScriptableObjectChild*, 10> objects;
@@ -463,16 +485,20 @@ PluginInstanceChild::Destroy()
     count = objects.Length();
     for (PRUint32 index = 0; index < count; index++) {
         PluginScriptableObjectChild*& actor = objects[index];
         NPObject* object = actor->GetObject();
         if (object->_class == PluginScriptableObjectChild::GetClass()) {
           PluginScriptableObjectChild::ScriptableInvalidate(object);
         }
     }
+
+#if defined(OS_WIN)
+    SharedSurfaceRelease();
+#endif
 }
 
 #if defined(OS_WIN)
 
 static const TCHAR kWindowClassName[] = TEXT("GeckoPluginWindow");
 static const TCHAR kPluginInstanceChildProperty[] = TEXT("PluginInstanceChildProperty");
 
 // static
@@ -500,36 +526,38 @@ PluginInstanceChild::RegisterWindowClass
     wcex.hIconSm        = 0;
 
     return RegisterClassEx(&wcex) ? true : false;
 }
 
 bool
 PluginInstanceChild::CreatePluginWindow()
 {
+    // already initialized
+    if (mPluginWindowHWND)
+        return true;
+        
     if (!RegisterWindowClass())
         return false;
 
-    if (!mPluginWindowHWND) {
-        mPluginWindowHWND =
-            CreateWindowEx(WS_EX_LEFT | WS_EX_LTRREADING |
-                           WS_EX_NOPARENTNOTIFY | // XXXbent Get rid of this!
-                           WS_EX_RIGHTSCROLLBAR,
-                           kWindowClassName, 0,
-                           WS_POPUP | WS_CLIPCHILDREN | WS_CLIPSIBLINGS, 0, 0,
-                           0, 0, NULL, 0, GetModuleHandle(NULL), 0);
-        if (!mPluginWindowHWND)
-            return false;
-        if (!SetProp(mPluginWindowHWND, kPluginInstanceChildProperty, this))
-            return false;
+    mPluginWindowHWND =
+        CreateWindowEx(WS_EX_LEFT | WS_EX_LTRREADING |
+                       WS_EX_NOPARENTNOTIFY | // XXXbent Get rid of this!
+                       WS_EX_RIGHTSCROLLBAR,
+                       kWindowClassName, 0,
+                       WS_POPUP | WS_CLIPCHILDREN | WS_CLIPSIBLINGS, 0, 0,
+                       0, 0, NULL, 0, GetModuleHandle(NULL), 0);
+    if (!mPluginWindowHWND)
+        return false;
+    if (!SetProp(mPluginWindowHWND, kPluginInstanceChildProperty, this))
+        return false;
 
-        // Apparently some plugins require an ASCII WndProc.
-        SetWindowLongPtrA(mPluginWindowHWND, GWLP_WNDPROC,
-                          reinterpret_cast<LONG>(DefWindowProcA));
-    }
+    // Apparently some plugins require an ASCII WndProc.
+    SetWindowLongPtrA(mPluginWindowHWND, GWLP_WNDPROC,
+                      reinterpret_cast<LONG>(DefWindowProcA));
 
     return true;
 }
 
 void
 PluginInstanceChild::DestroyPluginWindow()
 {
     if (mPluginWindowHWND) {
@@ -615,16 +643,70 @@ PluginInstanceChild::PluginWindowProc(HW
         self->DestroyPluginWindow();
 
     if (message == WM_NCDESTROY)
         RemoveProp(hWnd, kPluginInstanceChildProperty);
 
     return res;
 }
 
+/* windowless drawing helpers */
+
+bool
+PluginInstanceChild::SharedSurfaceSetWindow(const NPRemoteWindow& aWindow,
+                                            NPError* rv)
+{
+    // If the surfaceHandle is empty, parent is telling us we can reuse our cached
+    // memory surface and hdc. Otherwise, we need to reset, usually due to a
+    // expanding plugin port size.
+    if (!aWindow.surfaceHandle) {
+        if (!mSharedSurfaceDib.IsValid()) {
+            return false;
+        }
+    }
+    else {
+        // Attach to the new shared surface parent handed us.
+        if (NS_FAILED(mSharedSurfaceDib.Attach((SharedDIB::Handle)aWindow.surfaceHandle,
+                                               aWindow.width, aWindow.height, 32)))
+          return false;
+    }
+      
+    // NPRemoteWindow's origin is the origin of our shared dib.
+    mWindow.x      = 0;
+    mWindow.y      = 0;
+    mWindow.width  = aWindow.width;
+    mWindow.height = aWindow.height;
+    mWindow.type   = aWindow.type;
+
+    mWindow.window = reinterpret_cast<void*>(mSharedSurfaceDib.GetHDC());
+    *rv = mPluginIface->setwindow(&mData, &mWindow);
+
+    return true;
+}
+
+void
+PluginInstanceChild::SharedSurfaceRelease()
+{
+    mSharedSurfaceDib.Close();
+}
+
+void
+PluginInstanceChild::SharedSurfaceBeforePaint(NPEvent& evcopy)
+{
+    // Update the clip rect on our internal hdc
+    RECT* pRect = reinterpret_cast<RECT*>(evcopy.lParam);
+    if (pRect) {
+      HRGN clip = ::CreateRectRgnIndirect(pRect);
+      ::SelectClipRgn(mSharedSurfaceDib.GetHDC(), clip);
+      ::DeleteObject(clip);
+    }
+    // pass the internal hdc to the plugin
+    evcopy.wParam = WPARAM(mSharedSurfaceDib.GetHDC());
+}
+
 #endif // OS_WIN
 
 PPluginScriptableObjectChild*
 PluginInstanceChild::AllocPPluginScriptableObject()
 {
     AssertPluginThread();
 
     nsAutoPtr<PluginScriptableObjectChild>* object =
@@ -848,17 +930,24 @@ PluginInstanceChild::NPN_NewStream(NPMIM
 }
 
 bool
 PluginInstanceChild::InternalInvalidateRect(NPRect* aInvalidRect)
 {
     NS_ASSERTION(aInvalidRect, "Null pointer!");
 
 #ifdef OS_WIN
-    NS_ASSERTION(IsWindow(mPluginWindowHWND), "Bad window?!");
-    RECT rect = { aInvalidRect->left, aInvalidRect->top,
-                  aInvalidRect->right, aInvalidRect->bottom };
-    InvalidateRect(mPluginWindowHWND, &rect, FALSE);
+    // Invalidate and draw locally for windowed plugins.
+    if (mWindow.type == NPWindowTypeWindow) {
+      NS_ASSERTION(IsWindow(mPluginWindowHWND), "Bad window?!");
+      RECT rect = { aInvalidRect->left, aInvalidRect->top,
+                    aInvalidRect->right, aInvalidRect->bottom };
+      InvalidateRect(mPluginWindowHWND, &rect, FALSE);
+      return false;
+    }
+    // Windowless need the invalidation to propegate to parent
+    // triggering wm_paint handle event calls.
+    return true;
 #endif
 
     // Windowless plugins must return true!
     return false;
 }

--- a/dom/plugins/PluginInstanceChild.h
+++ b/dom/plugins/PluginInstanceChild.h
@@ -36,16 +36,19 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef dom_plugins_PluginInstanceChild_h
 #define dom_plugins_PluginInstanceChild_h 1
 
 #include "mozilla/plugins/PPluginInstanceChild.h"
 #include "mozilla/plugins/PluginScriptableObjectChild.h"
+#if defined(OS_WIN)
+#include "mozilla/gfx/SharedDIBWin.h"
+#endif
 
 #include "npfunctions.h"
 #include "nsAutoPtr.h"
 #include "nsTArray.h"
 
 #undef _MOZ_LOG
 #define _MOZ_LOG(s) printf("[PluginInstanceChild] %s\n", s)
 
@@ -199,14 +202,25 @@ private:
     NPSetWindowCallbackStruct mWsInfo;
 #elif defined(OS_WIN)
     HWND mPluginWindowHWND;
     WNDPROC mPluginWndProc;
     HWND mPluginParentHWND;
 #endif
 
     nsTArray<nsAutoPtr<PluginScriptableObjectChild> > mScriptableObjects;
+
+#if defined(OS_WIN)
+private:
+    // Shared dib rendering management for windowless plugins.
+    bool SharedSurfaceSetWindow(const NPRemoteWindow& aWindow, NPError* rv);
+    void SharedSurfaceBeforePaint(NPEvent& evcopy);
+    void SharedSurfaceRelease();
+
+private:
+    gfx::SharedDIBWin mSharedSurfaceDib;
+#endif // defined(OS_WIN)
 };
 
 } // namespace plugins
 } // namespace mozilla
 
 #endif // ifndef dom_plugins_PluginInstanceChild_h

--- a/dom/plugins/PluginInstanceParent.cpp
+++ b/dom/plugins/PluginInstanceParent.cpp
@@ -16,16 +16,17 @@
  * The Original Code is Mozilla Plugin App.
  *
  * The Initial Developer of the Original Code is
  *   Chris Jones <jones.chris.g@gmail.com>
  * Portions created by the Initial Developer are Copyright (C) 2009
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Jim Mathies <jmathies@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -41,25 +42,38 @@
 #include "BrowserStreamParent.h"
 #include "PluginModuleParent.h"
 #include "PluginStreamParent.h"
 #include "StreamNotifyParent.h"
 
 #include "npfunctions.h"
 #include "nsAutoPtr.h"
 
+#if defined(OS_WIN)
+#define NS_OOPP_DOUBLEPASS_MSGID TEXT("MozDoublePassMsg")
+#endif
+
 using namespace mozilla::plugins;
 
 PluginInstanceParent::PluginInstanceParent(PluginModuleParent* parent,
                                            NPP npp,
                                            const NPNetscapeFuncs* npniface)
   : mParent(parent),
     mNPP(npp),
-    mNPNIface(npniface)
+    mNPNIface(npniface),
+    mWindowType(NPWindowTypeWindow)
 {
+#if defined(OS_WIN)
+    // Event sent from nsObjectFrame indicating double pass rendering for
+    // windowless plugins. RegisterWindowMessage makes it easy sync event
+    // values, and insures we never conflict with windowing events we allow
+    // for windowless plugins.
+    mDoublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
+    mLocalCopyRender = false;
+#endif
 }
 
 PluginInstanceParent::~PluginInstanceParent()
 {
 }
 
 void
 PluginInstanceParent::Destroy()
@@ -73,16 +87,20 @@ PluginInstanceParent::Destroy()
 
     count = objects.Length();
     for (PRUint32 index = 0; index < count; index++) {
         NPObject* object = objects[index]->GetObject();
         if (object->_class == PluginScriptableObjectParent::GetClass()) {
           PluginScriptableObjectParent::ScriptableInvalidate(object);
         }
     }
+
+#if defined(OS_WIN)
+    SharedSurfaceRelease();
+#endif
 }
 
 PBrowserStreamParent*
 PluginInstanceParent::AllocPBrowserStream(const nsCString& url,
                                           const uint32_t& length,
                                           const uint32_t& lastmodified,
                                           PStreamNotifyParent* notifyData,
                                           const nsCString& headers,
@@ -314,23 +332,44 @@ PluginInstanceParent::RecvNPN_Invalidate
 
 NPError
 PluginInstanceParent::NPP_SetWindow(const NPWindow* aWindow)
 {
     _MOZ_LOG(__FUNCTION__);
     NS_ENSURE_TRUE(aWindow, NPERR_GENERIC_ERROR);
 
     NPRemoteWindow window;
+    mWindowType = aWindow->type;
+
+#if defined(OS_WIN)
+    // On windowless controls, reset the shared memory surface as needed.
+    if (mWindowType == NPWindowTypeDrawable) {
+        // SharedSurfaceSetWindow will take care of NPRemoteWindow.
+        if (!SharedSurfaceSetWindow(aWindow, window)) {
+          return NPERR_OUT_OF_MEMORY_ERROR;
+        }
+    }
+    else {
+        window.window = reinterpret_cast<unsigned long>(aWindow->window);
+        window.x = aWindow->x;
+        window.y = aWindow->y;
+        window.width = aWindow->width;
+        window.height = aWindow->height;
+        window.type = aWindow->type;
+    }
+#else
     window.window = reinterpret_cast<unsigned long>(aWindow->window);
     window.x = aWindow->x;
     window.y = aWindow->y;
     window.width = aWindow->width;
     window.height = aWindow->height;
-    window.clipRect = aWindow->clipRect;
+    window.clipRect = aWindow->clipRect; // MacOS specific
     window.type = aWindow->type;
+#endif
+
 #if defined(MOZ_X11) && defined(XP_UNIX) && !defined(XP_MACOSX)
     const NPSetWindowCallbackStruct* ws_info =
       static_cast<NPSetWindowCallbackStruct*>(aWindow->ws_info);
     window.visualID = ws_info->visual ? ws_info->visual->visualid : None;
     window.colormap = ws_info->colormap;
 #endif
 
     NPError prv;
@@ -438,16 +477,31 @@ int16_t
 PluginInstanceParent::NPP_HandleEvent(void* event)
 {
     _MOZ_LOG(__FUNCTION__);
 
     NPEvent* npevent = reinterpret_cast<NPEvent*>(event);
     NPRemoteEvent npremoteevent;
     npremoteevent.event = *npevent;
 
+#if defined(OS_WIN)
+    RECT rect;
+    if (mWindowType == NPWindowTypeDrawable) {
+        if (mDoublePassEvent && mDoublePassEvent == npevent->event) {
+            // Sent from nsObjectFrame to let us know a double pass render is in progress.
+            mLocalCopyRender = PR_TRUE;
+            return true;
+        } else if (WM_PAINT == npevent->event) {
+            // Don't forward on the second pass, otherwise, fall through.
+            if (!SharedSurfaceBeforePaint(rect, npremoteevent))
+                return true;
+        }
+    }
+#endif
+
 #if defined(MOZ_X11)
     if (GraphicsExpose == npevent->type) {
         printf("  schlepping drawable 0x%lx across the pipe\n",
                npevent->xgraphicsexpose.drawable);
         // Make sure the X server has created the Drawable and completes any
         // drawing before the plugin draws on top.
         //
         // XSync() waits for the X server to complete.  Really this parent
@@ -459,16 +513,22 @@ PluginInstanceParent::NPP_HandleEvent(vo
 #  endif
     }
 #endif
 
     int16_t handled;
     if (!CallNPP_HandleEvent(npremoteevent, &handled)) {
         return 0;               // no good way to handle errors here...
     }
+
+#if defined(OS_WIN)
+    if (handled && mWindowType == NPWindowTypeDrawable && WM_PAINT == npevent->event)
+        SharedSurfaceAfterPaint(npevent);
+#endif
+
     return handled;
 }
 
 NPError
 PluginInstanceParent::NPP_NewStream(NPMIMEType type, NPStream* stream,
                                     NPBool seekable, uint16_t* stype)
 {
     _MOZ_LOG(__FUNCTION__);
@@ -627,8 +687,131 @@ PluginInstanceParent::AnswerNPN_PushPopu
 }
 
 bool
 PluginInstanceParent::AnswerNPN_PopPopupsEnabledState(bool* aSuccess)
 {
     *aSuccess = mNPNIface->poppopupsenabledstate(mNPP);
     return true;
 }
+
+#if defined(OS_WIN)
+
+/* windowless drawing helpers */
+
+void
+PluginInstanceParent::SharedSurfaceRelease()
+{
+    mSharedSurfaceDib.Close();
+}
+
+bool
+PluginInstanceParent::SharedSurfaceSetWindow(const NPWindow* aWindow,
+                                             NPRemoteWindow& aRemoteWindow)
+{
+    aRemoteWindow.window = nsnull;
+    aRemoteWindow.x      = 0;
+    aRemoteWindow.y      = 0;
+    aRemoteWindow.width  = aWindow->width;
+    aRemoteWindow.height = aWindow->height;
+    aRemoteWindow.type   = aWindow->type;
+
+    nsIntRect newPort(aWindow->x, aWindow->y, aWindow->width, aWindow->height);
+
+    // save the the rect location within the browser window.
+    mPluginPort = newPort;
+
+    // move the port to our shared surface origin
+    newPort.MoveTo(0,0);
+
+    // check to see if we have the room in shared surface
+    if (mSharedSurfaceDib.IsValid() && mSharedSize.Contains(newPort)) {
+      // ok to paint
+      aRemoteWindow.surfaceHandle = 0;
+      return true;
+    }
+    
+    // allocate a new shared surface
+    SharedSurfaceRelease();
+    if (NS_FAILED(mSharedSurfaceDib.Create(reinterpret_cast<HDC>(aWindow->window),
+                                           newPort.width, newPort.height, 32)))
+      return false;
+
+    // save the new shared surface size we just allocated
+    mSharedSize = newPort;
+    
+    base::SharedMemoryHandle handle;
+    if (NS_FAILED(mSharedSurfaceDib.ShareToProcess(mParent->ChildProcessHandle(), &handle)))
+      return false;
+
+    aRemoteWindow.surfaceHandle = handle;
+    
+    return true;
+}
+
+bool
+PluginInstanceParent::SharedSurfaceBeforePaint(RECT& rect,
+                                               NPRemoteEvent& npremoteevent)
+{
+    RECT* dr = (RECT*)npremoteevent.event.lParam;
+    HDC parentHdc = (HDC)npremoteevent.event.wParam;
+
+    // We render twice per frame for windowless plugins that sit in transparent
+    // frames. (See nsObjectFrame and gfxWindowsNativeDrawing for details.) IPC
+    // message delays in OOP plugin painting can result in two passes yeilding
+    // different animation frames. The second rendering doesn't need to go over
+    // the wire (we already have a copy of the frame in mSharedSurfaceDib) so we
+    // skip off requesting the second. This also gives us a nice perf boost.
+    if (mLocalCopyRender) {
+      mLocalCopyRender = false;
+      // Reuse the old render.
+      SharedSurfaceAfterPaint(&npremoteevent.event);
+      return false;
+    }
+
+    nsIntRect dirtyRect(dr->left, dr->top, dr->right-dr->left, dr->bottom-dr->top);
+    dirtyRect.MoveBy(-mPluginPort.x, -mPluginPort.y); // should always be smaller than dirtyRect
+
+    ::BitBlt(mSharedSurfaceDib.GetHDC(),
+             dirtyRect.x,
+             dirtyRect.y,
+             dirtyRect.width,
+             dirtyRect.height,
+             parentHdc,
+             dr->left,
+             dr->top,
+             SRCCOPY);
+
+    // setup the translated dirty rect we'll send to the child
+    rect.left   = dirtyRect.x;
+    rect.top    = dirtyRect.y;
+    rect.right  = dirtyRect.width;
+    rect.bottom = dirtyRect.height;
+
+    npremoteevent.event.wParam = WPARAM(0);
+    npremoteevent.event.lParam = LPARAM(&rect);
+
+    // Send the event to the plugin
+    return true;
+}
+
+void
+PluginInstanceParent::SharedSurfaceAfterPaint(NPEvent* npevent)
+{
+    RECT* dr = (RECT*)npevent->lParam;
+    HDC parentHdc = (HDC)npevent->wParam;
+
+    nsIntRect dirtyRect(dr->left, dr->top, dr->right-dr->left, dr->bottom-dr->top);
+    dirtyRect.MoveBy(-mPluginPort.x, -mPluginPort.y);
+
+    // src copy the shared dib into the parent surface we are handed.
+    ::BitBlt(parentHdc,
+             dr->left,
+             dr->top,
+             dirtyRect.width,
+             dirtyRect.height,
+             mSharedSurfaceDib.GetHDC(),
+             dirtyRect.x,
+             dirtyRect.y,
+             SRCCOPY);
+}
+
+#endif // defined(OS_WIN)

--- a/dom/plugins/PluginInstanceParent.h
+++ b/dom/plugins/PluginInstanceParent.h
@@ -36,20 +36,24 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef dom_plugins_PluginInstanceParent_h
 #define dom_plugins_PluginInstanceParent_h 1
 
 #include "mozilla/plugins/PPluginInstanceParent.h"
 #include "mozilla/plugins/PluginScriptableObjectParent.h"
+#if defined(OS_WIN)
+#include "mozilla/gfx/SharedDIBWin.h"
+#endif
 
 #include "npfunctions.h"
 #include "nsAutoPtr.h"
 #include "nsTArray.h"
+#include "nsRect.h"
 
 #undef _MOZ_LOG
 #define _MOZ_LOG(s) printf("[PluginInstanceParent] %s\n", s)
 
 namespace mozilla {
 namespace plugins {
 
 class PBrowserStreamParent;
@@ -213,17 +217,34 @@ private:
     bool InternalGetValueForNPObject(NPNVariable aVariable,
                                      PPluginScriptableObjectParent** aValue,
                                      NPError* aResult);
 
 private:
     PluginModuleParent* mParent;
     NPP mNPP;
     const NPNetscapeFuncs* mNPNIface;
+    NPWindowType mWindowType;
 
     nsTArray<nsAutoPtr<PluginScriptableObjectParent> > mScriptableObjects;
+
+#if defined(OS_WIN)
+private:
+    // Used in rendering windowless plugins in other processes.
+    bool SharedSurfaceSetWindow(const NPWindow* aWindow, NPRemoteWindow& aRemoteWindow);
+    bool SharedSurfaceBeforePaint(RECT &rect, NPRemoteEvent& npremoteevent);
+    void SharedSurfaceAfterPaint(NPEvent* npevent);
+    void SharedSurfaceRelease();
+
+private:
+    gfx::SharedDIBWin  mSharedSurfaceDib;
+    nsIntRect          mPluginPort;
+    nsIntRect          mSharedSize;
+    PRUint32           mDoublePassEvent;
+    bool               mLocalCopyRender;
+#endif // defined(XP_WIN)
 };
 
 
 } // namespace plugins
 } // namespace mozilla
 
 #endif // ifndef dom_plugins_PluginInstanceParent_h

--- a/dom/plugins/PluginMessageUtils.h
+++ b/dom/plugins/PluginMessageUtils.h
@@ -84,16 +84,19 @@ struct NPRemoteWindow
   uint32_t width;
   uint32_t height;
   NPRect clipRect;
   NPWindowType type;
 #if defined(MOZ_X11) && defined(XP_UNIX) && !defined(XP_MACOSX)
   VisualID visualID;
   Colormap colormap;
 #endif /* XP_UNIX */
+#if defined(XP_WIN)
+  base::SharedMemoryHandle surfaceHandle;
+#endif
 };
 
 // XXX maybe not the best place for these. better one?
 
 #define VARSTR(v_)  case v_: return #v_
 inline const char* const
 NPPVariableToString(NPPVariable aVar)
 {
@@ -273,16 +276,19 @@ struct ParamTraits<mozilla::plugins::NPR
     WriteParam(aMsg, aParam.width);
     WriteParam(aMsg, aParam.height);
     WriteParam(aMsg, aParam.clipRect);
     WriteParam(aMsg, aParam.type);
 #if defined(MOZ_X11) && defined(XP_UNIX) && !defined(XP_MACOSX)
     aMsg->WriteULong(aParam.visualID);
     aMsg->WriteULong(aParam.colormap);
 #endif
+#if defined(XP_WIN)
+    WriteParam(aMsg, aParam.surfaceHandle);
+#endif
   }
 
   static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
   {
     unsigned long window;
     int32_t x, y;
     uint32_t width, height;
     NPRect clipRect;
@@ -299,27 +305,36 @@ struct ParamTraits<mozilla::plugins::NPR
 #if defined(MOZ_X11) && defined(XP_UNIX) && !defined(XP_MACOSX)
     unsigned long visualID;
     unsigned long colormap;
     if (!(aMsg->ReadULong(aIter, &visualID) &&
           aMsg->ReadULong(aIter, &colormap)))
       return false;
 #endif
 
+#if defined(XP_WIN)
+    base::SharedMemoryHandle surfaceHandle;
+    if (!ReadParam(aMsg, aIter, &surfaceHandle))
+      return false;
+#endif
+
     aResult->window = window;
     aResult->x = x;
     aResult->y = y;
     aResult->width = width;
     aResult->height = height;
     aResult->clipRect = clipRect;
     aResult->type = type;
 #if defined(MOZ_X11) && defined(XP_UNIX) && !defined(XP_MACOSX)
     aResult->visualID = visualID;
     aResult->colormap = colormap;
 #endif
+#if defined(XP_WIN)
+    aResult->surfaceHandle = surfaceHandle;
+#endif
     return true;
   }
 
   static void Log(const paramType& aParam, std::wstring* aLog)
   {
     aLog->append(StringPrintf(L"[%u, %d, %d, %u, %u, %d",
                               (unsigned long)aParam.window,
                               aParam.x, aParam.y, aParam.width,

--- a/dom/plugins/PluginModuleParent.h
+++ b/dom/plugins/PluginModuleParent.h
@@ -136,16 +136,17 @@ public:
         return mNPNIface;
     }
 
     static PluginInstanceParent* InstCast(NPP instance);
     static BrowserStreamParent* StreamCast(NPP instance, NPStream* s);
 
     bool EnsureValidNPIdentifier(NPIdentifier aIdentifier);
 
+    base::ProcessHandle ChildProcessHandle() { return mSubprocess->GetChildProcessHandle(); }
 private:
     void SetPluginFuncs(NPPluginFuncs* aFuncs);
 
     // Implement the module-level functions from NPAPI; these are
     // normally resolved directly from the DSO.
 #ifdef OS_LINUX
     NPError NP_Initialize(const NPNetscapeFuncs* npnIface,
                           NPPluginFuncs* nppIface);

--- a/gfx/Makefile.in
+++ b/gfx/Makefile.in
@@ -45,15 +45,19 @@ include $(DEPTH)/config/autoconf.mk
 MODULE		= gfx
 
 ifdef MOZ_TREE_CAIRO
 DIRS		= cairo
 endif
 
 DIRS		+= thebes public idl src qcms
 
+ifdef MOZ_IPC
+DIRS		+= ipc
+endif
+
 ifdef ENABLE_TESTS
 ifndef MOZ_ENABLE_LIBXUL
 TOOL_DIRS	+= tests
 endif
 endif
 
 include $(topsrcdir)/config/rules.mk

new file mode 100644
--- /dev/null
+++ b/gfx/ipc/Makefile.in
@@ -0,0 +1,73 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH       = ../..
+topsrcdir   = @top_srcdir@
+srcdir      = @srcdir@
+VPATH       = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+ifdef MOZ_IPC
+
+MODULE             = gfxipc
+LIBRARY_NAME       = gfxipc_s
+FORCE_STATIC_LIB   = 1
+LIBXUL_LIBRARY     = 1
+EXPORT_LIBRARY     = 1
+
+EXPORTS_NAMESPACES = mozilla/gfx
+
+EXPORTS_mozilla/gfx = \
+        SharedDIB.h   \
+        $(NULL)
+
+CPPSRCS = SharedDIB.cpp
+
+ENABLE_CXX_EXCEPTIONS	= 1
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
+CPPSRCS += SharedDIBWin.cpp
+EXPORTS_mozilla/gfx += SharedDIBWin.h
+endif
+
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
+
+endif
+
+include $(topsrcdir)/config/rules.mk

new file mode 100644
--- /dev/null
+++ b/gfx/ipc/SharedDIB.cpp
@@ -0,0 +1,118 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jim Mathies <jmathies@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "SharedDIB.h"
+
+namespace mozilla {
+namespace gfx {
+
+SharedDIB::SharedDIB() :
+  mShMem(nsnull)
+{
+}
+
+SharedDIB::~SharedDIB()
+{
+  Close();
+}
+
+nsresult
+SharedDIB::Create(PRUint32 aSize)
+{
+  Close();
+
+  mShMem = new base::SharedMemory();
+  if (!mShMem || !mShMem->Create(std::wstring(L""), false, false, aSize))
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  // Map the entire section
+  if (!mShMem->Map(0))
+    return NS_ERROR_FAILURE;
+
+  return NS_OK;
+}
+
+bool
+SharedDIB::IsValid()
+{
+  if (!mShMem)
+    return false;
+
+  return (mShMem->handle() != mShMem->NULLHandle() ? true : false);
+}
+
+nsresult
+SharedDIB::Close()
+{
+  if (mShMem)
+    delete mShMem;
+
+  mShMem = nsnull;
+
+  return NS_OK;
+}
+
+nsresult
+SharedDIB::Attach(Handle aHandle, PRUint32 aSize)
+{
+  Close();
+
+  mShMem = new base::SharedMemory(aHandle, false);
+  if(!mShMem)
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  if (!mShMem->Map(aSize))
+    return NS_ERROR_FAILURE;
+
+  return NS_OK;
+}
+
+nsresult
+SharedDIB::ShareToProcess(base::ProcessHandle aChildProcess, Handle *aChildHandle)
+{
+  if (!mShMem)
+    return NS_ERROR_UNEXPECTED;
+
+  if (!mShMem->ShareToProcess(aChildProcess, aChildHandle))
+    return NS_ERROR_UNEXPECTED;
+
+  return NS_OK;
+}
+
+} // gfx
+} // mozilla

new file mode 100644
--- /dev/null
+++ b/gfx/ipc/SharedDIB.h
@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jim Mathies <jmathies@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef gfx_SharedDIB_h__
+#define gfx_SharedDIB_h__
+
+#include "base/shared_memory.h"
+#include "prtypes.h"
+#include "nscore.h"
+
+namespace mozilla {
+namespace gfx {
+
+class SharedDIB
+{
+public:
+  typedef base::SharedMemoryHandle Handle;
+
+public:
+  SharedDIB();
+  ~SharedDIB();
+
+  // Create and allocate a new shared dib.
+  nsresult Create(PRUint32 aSize);
+
+  // Destroy or release resources associated with this dib.
+  nsresult Close();
+
+  // Returns true if this object contains a valid dib.
+  bool IsValid();
+
+  // Wrap a new shared dib around allocated shared memory. Note aHandle must point
+  // to a memory section large enough to hold a dib of size aSize, otherwise this
+  // will fail.
+  nsresult Attach(Handle aHandle, PRUint32 aSize);
+
+  // Returns a SharedMemoryHandle suitable for sharing with another process.
+  nsresult ShareToProcess(base::ProcessHandle aChildProcess, Handle *aChildHandle);
+
+protected:
+  base::SharedMemory *mShMem;
+};
+
+} // gfx
+} // mozilla
+
+#endif

new file mode 100644
--- /dev/null
+++ b/gfx/ipc/SharedDIBWin.cpp
@@ -0,0 +1,161 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jim Mathies <jmathies@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "SharedDIBWin.h"
+#include "nsMathUtils.h"
+#include "nsDebug.h"
+
+namespace mozilla {
+namespace gfx {
+
+SharedDIBWin::SharedDIBWin() :
+    mSharedHdc(nsnull)
+  , mSharedBmp(nsnull)
+  , mOldObj(nsnull)
+{
+}
+
+SharedDIBWin::~SharedDIBWin()
+{
+  Close();
+}
+
+nsresult
+SharedDIBWin::Close()
+{
+  if (mSharedHdc && mOldObj)
+    ::SelectObject(mSharedHdc, mOldObj);
+
+  if (mSharedHdc)
+    ::DeleteObject(mSharedHdc);
+
+  if (mSharedBmp)
+    ::DeleteObject(mSharedBmp);
+
+  mSharedHdc = NULL;
+  mOldObj = mSharedBmp = NULL;
+
+  SharedDIB::Close();
+
+  return NS_OK;
+}
+
+nsresult
+SharedDIBWin::Create(HDC aHdc, PRUint32 aWidth, PRUint32 aHeight, PRUint32 aDepth)
+{
+  Close();
+
+  // create the offscreen shared dib
+  BITMAPINFOHEADER bmih;
+  PRUint32 size = SetupBitmapHeader(aWidth, aHeight, aDepth, &bmih);
+
+  nsresult rv = SharedDIB::Create(size);
+  if (NS_FAILED(rv))
+    return rv;
+
+  if (NS_FAILED(SetupSurface(aHdc, &bmih))) {
+    Close();
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+SharedDIBWin::Attach(Handle aHandle, PRUint32 aWidth, PRUint32 aHeight, PRUint32 aDepth)
+{
+  Close();
+
+  BITMAPINFOHEADER bmih;
+  SetupBitmapHeader(aWidth, aHeight, aDepth, &bmih);
+
+  nsresult rv = SharedDIB::Attach(aHandle, 0);
+  if (NS_FAILED(rv))
+    return rv;
+
+  if (NS_FAILED(SetupSurface(NULL, &bmih))) {
+    Close();
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+PRUint32
+SharedDIBWin::SetupBitmapHeader(PRUint32 aWidth, PRUint32 aHeight, PRUint32 aDepth, BITMAPINFOHEADER *aHeader)
+{
+  NS_ASSERTION(aDepth == 32, "Invalid SharedDIBWin depth");
+
+  memset((void*)aHeader, 0, sizeof(BITMAPINFOHEADER));
+  aHeader->biSize        = sizeof(BITMAPINFOHEADER);
+  aHeader->biWidth       = aWidth;
+  aHeader->biHeight      = aHeight;
+  aHeader->biPlanes      = 1;
+  aHeader->biBitCount    = aDepth;
+  aHeader->biCompression = BI_RGB;
+
+  // deal better with varying depths. (we currently only ask for 32 bit)
+  return (sizeof(BITMAPINFOHEADER) + (aHeader->biHeight * aHeader->biWidth * (PRUint32)NS_ceil(aDepth/8)));
+}
+
+nsresult
+SharedDIBWin::SetupSurface(HDC aHdc, BITMAPINFOHEADER *aHdr)
+{
+  mSharedHdc = ::CreateCompatibleDC(aHdc);
+
+  if (!mSharedHdc)
+    return NS_ERROR_FAILURE;
+
+  void* ppvBits = nsnull;
+  mSharedBmp = ::CreateDIBSection(mSharedHdc,
+                                  (BITMAPINFO*)aHdr,
+                                  DIB_RGB_COLORS,
+                                  (void**)&ppvBits,
+                                  mShMem->handle(),
+                                  (unsigned long)sizeof(BITMAPINFOHEADER));
+  if (!mSharedBmp)
+    return NS_ERROR_FAILURE;
+
+  mOldObj = SelectObject(mSharedHdc, mSharedBmp);
+
+  return NS_OK;
+}
+
+
+} // gfx
+} // mozilla

new file mode 100644
--- /dev/null
+++ b/gfx/ipc/SharedDIBWin.h
@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jim Mathies <jmathies@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef gfx_SharedDIBWin_h__
+#define gfx_SharedDIBWin_h__
+
+#include <windows.h>
+
+#include "SharedDIB.h"
+
+namespace mozilla {
+namespace gfx {
+
+class SharedDIBWin : public SharedDIB
+{
+public:
+  SharedDIBWin();
+  ~SharedDIBWin();
+
+  // Allocate a new win32 dib section compatible with an hdc. The dib will
+  // be selected into the hdc on return.
+  nsresult Create(HDC aHdc, PRUint32 aWidth, PRUint32 aHeight, PRUint32 aDepth);
+
+  // Wrap a dib section around an existing shared memory object. aHandle should
+  // point to a section large enough for the dib's memory, otherwise this call
+  // will fail.
+  nsresult Attach(Handle aHandle, PRUint32 aWidth, PRUint32 aHeight, PRUint32 aDepth);
+
+  // Destroy or release resources associated with this dib.
+  nsresult Close();
+
+  // Return the HDC of the shared dib.
+  HDC GetHDC() { return mSharedHdc; }
+
+private:
+  HDC                 mSharedHdc;
+  HBITMAP             mSharedBmp;
+  HGDIOBJ             mOldObj;
+
+  PRUint32 SetupBitmapHeader(PRUint32 aWidth, PRUint32 aHeight, PRUint32 aDepth, BITMAPINFOHEADER *aHeader);
+  nsresult SetupSurface(HDC aHdc, BITMAPINFOHEADER *aHdr);
+};
+
+} // gfx
+} // mozilla
+
+#endif

--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -200,16 +200,19 @@ enum { XKeyPress = KeyPress };
 
 #ifdef MOZ_WIDGET_QT
 #include "gfxQtNativeRenderer.h"
 #endif
 
 #ifdef XP_WIN
 #include <wtypes.h>
 #include <winuser.h>
+#ifdef MOZ_IPC
+#define NS_OOPP_DOUBLEPASS_MSGID TEXT("MozDoublePassMsg")
+#endif
 #endif
 
 #ifdef XP_OS2
 #define INCL_PM
 #define INCL_GPI
 #include <os2.h>
 #endif
 
@@ -600,16 +603,19 @@ nsObjectFrame::Init(nsIContent*      aCo
   PR_LOG(nsObjectFrameLM, PR_LOG_DEBUG,
          ("Initializing nsObjectFrame %p for content %p\n", this, aContent));
 
   nsresult rv = nsObjectFrameSuper::Init(aContent, aParent, aPrevInFlow);
 
   if (NS_SUCCEEDED(rv)) {
     NotifyPluginEventObservers(NS_LITERAL_STRING("init").get());
   }
+#ifdef XP_WIN
+  mDoublePassEvent = 0;
+#endif
   return rv;
 }
 
 void
 nsObjectFrame::Destroy()
 {
   NS_ASSERTION(!mPreventInstantiation ||
                (mContent && mContent->GetCurrentDoc()->GetDisplayDocument()),
@@ -1675,16 +1681,17 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
 
     if (window->type == NPWindowTypeDrawable) {
       // check if we need to call SetWindow with updated parameters
       PRBool doupdatewindow = PR_FALSE;
       // the offset of the DC
       nsPoint origin;
       
       gfxWindowsNativeDrawing nativeDraw(ctx, frameGfxRect);
+      PRBool doublePass = PR_FALSE;
       do {
         HDC hdc = nativeDraw.BeginNativeDrawing();
         if (!hdc)
           return;
 
         RECT dest;
         nativeDraw.TransformToNativeRect(frameGfxRect, dest);
         RECT dirty;
@@ -1737,17 +1744,36 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
             inst->HandleEvent(&pluginEvent, &eventHandled);
           }
 
           inst->SetWindow(window);        
         }
 
         mInstanceOwner->Paint(dirty, hdc);
         nativeDraw.EndNativeDrawing();
-      } while (nativeDraw.ShouldRenderAgain());
+        doublePass = nativeDraw.ShouldRenderAgain();
+#ifdef MOZ_IPC
+        if (doublePass) {
+          // OOP plugin specific: let the shim know we are in the middle of a double pass
+          // render. The second pass will reuse the previous rendering without going over
+          // the wire.
+          if (!mDoublePassEvent)
+            mDoublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
+          if (mDoublePassEvent) {
+            NPEvent pluginEvent;
+            pluginEvent.event = mDoublePassEvent;
+            pluginEvent.wParam = 0;
+            pluginEvent.lParam = 0;
+            PRBool eventHandled = PR_FALSE;
+
+            inst->HandleEvent(&pluginEvent, &eventHandled);
+          }          
+        }
+#endif
+      } while (doublePass);
 
       nativeDraw.PaintToContext();
     } else if (!(ctx->GetFlags() & gfxContext::FLAG_DESTINED_FOR_SCREEN)) {
       // Get PrintWindow dynamically since it's not present on Win2K,
       // which we still support
       typedef BOOL (WINAPI * PrintWindowPtr)
           (HWND hwnd, HDC hdcBlt, UINT nFlags);
       PrintWindowPtr printProc = nsnull;

--- a/layout/generic/nsObjectFrame.h
+++ b/layout/generic/nsObjectFrame.h
@@ -230,16 +230,19 @@ protected:
   friend class nsPluginInstanceOwner;
   friend class nsDisplayPlugin;
 
 private:
   nsRefPtr<nsPluginInstanceOwner> mInstanceOwner;
   nsIView*                        mInnerView;
   nsCOMPtr<nsIWidget>             mWidget;
   nsIntRect                       mWindowlessRect;
+#ifdef XP_WIN
+  PRUint32                        mDoublePassEvent;
+#endif
 
   // For assertions that make it easier to determine if a crash is due
   // to the underlying problem described in bug 136927, and to prevent
   // reentry into instantiation.
   PRBool mPreventInstantiation;
 };
 
 class nsDisplayPlugin : public nsDisplayItem {

--- a/toolkit/library/libxul-config.mk
+++ b/toolkit/library/libxul-config.mk
@@ -93,16 +93,17 @@ endif
 # dependent libraries
 ifdef MOZ_IPC
 STATIC_LIBS += \
   domipc_s \
   domplugins_s \
   mozipc_s \
   chromium_s \
   ipcshell_s \
+  gfxipc_s \
   $(NULL)
 
 ifdef MOZ_IPDL_TESTS
 STATIC_LIBS += ipdlunittest_s
 endif
 
 ifeq (Linux,$(OS_ARCH))
 OS_LIBS += -lrt