BASELINE: Update Chromium to 100.0.4896.167

Change-Id: I98cbeb5d7543d966ffe04d8cefded0c493a11333
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

29 files changed, 386 insertions, 739 deletions

diff --git a/chromium/components/guest_view/browser/BUILD.gn b/chromium/components/guest_view/browser/BUILD.gn
index 896e0191f55..5bc153ac065 100644
--- a/chromium/components/guest_view/browser/BUILD.gn
+++ b/chromium/components/guest_view/browser/BUILD.gn
@@ -23,8 +23,8 @@ static_library("browser") {
     "//components/guest_view/browser/guest_view_manager_delegate.cc",
     "//components/guest_view/browser/guest_view_manager_delegate.h",
     "//components/guest_view/browser/guest_view_manager_factory.h",
-    "//components/guest_view/browser/guest_view_message_filter.cc",
-    "//components/guest_view/browser/guest_view_message_filter.h",
+    "//components/guest_view/browser/guest_view_message_handler.cc",
+    "//components/guest_view/browser/guest_view_message_handler.h",
   ]
 
   public_deps = [
@@ -34,12 +34,10 @@ static_library("browser") {
   deps = [
     "//build:chromeos_buildflags",
     "//components/crash/core/common:crash_key",
-    "//components/keyed_service/content",
-    "//components/keyed_service/core",
+    "//components/guest_view/common:mojom",
     "//components/zoom",
     "//content/public/browser",
     "//content/public/common",
-    "//ipc",
     "//third_party/blink/public/common",
     "//url",
   ]
diff --git a/chromium/components/guest_view/browser/DEPS b/chromium/components/guest_view/browser/DEPS
index 5b0cbd043af..84bd166d3ec 100644
--- a/chromium/components/guest_view/browser/DEPS
+++ b/chromium/components/guest_view/browser/DEPS
@@ -1,11 +1,8 @@
 include_rules = [
   "+components/crash/core/common/crash_key.h",
-  "+components/keyed_service/content/browser_context_keyed_service_shutdown_notifier_factory.h",
-  "+components/keyed_service/core/keyed_service_shutdown_notifier.h",
   "+components/zoom",
   "+content/public/browser",
   "+content/public/common",
-  "+ipc",
   "+third_party/blink/public/common/page/page_zoom.h",
   "+third_party/blink/public/common/input/web_gesture_event.h",
   "+third_party/blink/public/common/input/web_input_event.h",
diff --git a/chromium/components/guest_view/browser/bad_message.cc b/chromium/components/guest_view/browser/bad_message.cc
index 81240a02d87..28f5345cf1b 100644
--- a/chromium/components/guest_view/browser/bad_message.cc
+++ b/chromium/components/guest_view/browser/bad_message.cc
@@ -6,7 +6,6 @@
 
 #include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
-#include "content/public/browser/browser_message_filter.h"
 #include "content/public/browser/render_process_host.h"
 
 namespace guest_view {
@@ -37,11 +36,5 @@ void ReceivedBadMessage(int render_process_id, BadMessageReason reason) {
   ReceivedBadMessage(rph, reason);
 }
 
-void ReceivedBadMessage(content::BrowserMessageFilter* filter,
-                        BadMessageReason reason) {
-  LogBadMessage(reason);
-  filter->ShutdownForBadMessage();
-}
-
 }  // namespace bad_message
 }  // namespace guest_view
diff --git a/chromium/components/guest_view/browser/bad_message.h b/chromium/components/guest_view/browser/bad_message.h
index 1a38fa6daa9..3de2636bf84 100644
--- a/chromium/components/guest_view/browser/bad_message.h
+++ b/chromium/components/guest_view/browser/bad_message.h
@@ -6,7 +6,6 @@
 #define COMPONENTS_GUEST_VIEW_BROWSER_BAD_MESSAGE_H_
 
 namespace content {
-class BrowserMessageFilter;
 class RenderProcessHost;
 }  // namespace content
 
@@ -41,12 +40,6 @@ void ReceivedBadMessage(content::RenderProcessHost* host,
                         BadMessageReason reason);
 void ReceivedBadMessage(int render_process_id, BadMessageReason reason);
 
-// Called when a browser message filter receives a bad IPC message from a
-// renderer process. Logs the event, records a histogram metric for the
-// |reason|, and terminates the process for |filter|.
-void ReceivedBadMessage(content::BrowserMessageFilter* filter,
-                        BadMessageReason reason);
-
 }  // namespace bad_message
 }  // namespace guest_view
 
diff --git a/chromium/components/guest_view/browser/guest_view_base.cc b/chromium/components/guest_view/browser/guest_view_base.cc
index 8fe70ba32cd..3b579b818d1 100644
--- a/chromium/components/guest_view/browser/guest_view_base.cc
+++ b/chromium/components/guest_view/browser/guest_view_base.cc
@@ -15,7 +15,6 @@
 #include "components/guest_view/browser/guest_view_event.h"
 #include "components/guest_view/browser/guest_view_manager.h"
 #include "components/guest_view/common/guest_view_constants.h"
-#include "components/guest_view/common/guest_view_messages.h"
 #include "components/zoom/page_zoom.h"
 #include "components/zoom/zoom_controller.h"
 #include "content/public/browser/color_chooser.h"
@@ -239,7 +238,8 @@ void GuestViewBase::InitWithWebContents(
   GetGuestViewManager()->AddGuest(guest_instance_id_, guest_web_contents);
 
   // Populate the view instance ID if we have it on creation.
-  create_params.GetInteger(kParameterInstanceId, &view_instance_id_);
+  view_instance_id_ = create_params.FindIntKey(kParameterInstanceId)
+                          .value_or(view_instance_id_);
 
   SetUpSizing(create_params);
 
@@ -466,7 +466,8 @@ void GuestViewBase::Destroy(bool also_delete) {
 
 void GuestViewBase::SetAttachParams(const base::DictionaryValue& params) {
   attach_params_.reset(params.DeepCopy());
-  attach_params_->GetInteger(kParameterInstanceId, &view_instance_id_);
+  view_instance_id_ = attach_params_->FindIntKey(kParameterInstanceId)
+                          .value_or(view_instance_id_);
 }
 
 void GuestViewBase::SetOpener(GuestViewBase* guest) {
@@ -491,14 +492,18 @@ void GuestViewBase::WillAttach(WebContents* embedder_web_contents,
                                bool is_full_page_plugin,
                                base::OnceClosure completion_callback) {
   WillAttach(embedder_web_contents, nullptr, element_instance_id,
-             is_full_page_plugin, std::move(completion_callback));
-}
-
-void GuestViewBase::WillAttach(WebContents* embedder_web_contents,
-                               content::RenderFrameHost* outer_contents_frame,
-                               int element_instance_id,
-                               bool is_full_page_plugin,
-                               base::OnceClosure completion_callback) {
+             is_full_page_plugin, std::move(completion_callback),
+             base::NullCallback());
+}
+
+void GuestViewBase::WillAttach(
+    WebContents* embedder_web_contents,
+    content::RenderFrameHost* outer_contents_frame,
+    int element_instance_id,
+    bool is_full_page_plugin,
+    base::OnceClosure completion_callback,
+    GuestViewMessageHandler::AttachToEmbedderFrameCallback
+        attachment_callback) {
   // Stop tracking the old embedder's zoom level.
   if (owner_web_contents())
     StopTrackingEmbedderZoomLevel();
@@ -524,14 +529,12 @@ void GuestViewBase::WillAttach(WebContents* embedder_web_contents,
   owner_web_contents_->AttachInnerWebContents(
       base::WrapUnique<WebContents>(web_contents()), outer_contents_frame,
       is_full_page_plugin);
-  // TODO(ekaramad): MimeHandlerViewGuest might not need this ACK
-  // (https://crbug.com/659750).
   // We don't ACK until after AttachToOuterWebContentsFrame, so that
-  // |outer_contents_frame| gets swapped before the AttachIframeGuest callback
-  // is run. We also need to send the ACK before queued events are sent in
-  // DidAttach.
-  embedder_web_contents->GetMainFrame()->Send(
-      new GuestViewMsg_AttachToEmbedderFrame_ACK(element_instance_id));
+  // |outer_contents_frame| gets swapped before the AttachToEmbedderFrame
+  // callback is run. We also need to send the ACK before queued events are sent
+  // in DidAttach.
+  if (attachment_callback)
+    std::move(attachment_callback).Run();
 
   // Completing attachment will resume suspended resource loads and then send
   // queued events.
@@ -710,6 +713,7 @@ content::RenderWidgetHost* GuestViewBase::GetOwnerRenderWidgetHost() {
   // embedded in a cross-process frame, this method should be overrode for that
   // specific guest type. For all other guests, the owner RenderWidgetHost is
   // that of the owner WebContents.
+  DCHECK(!CanBeEmbeddedInsideCrossProcessFrames());
   auto* owner = GetOwnerWebContents();
   if (owner && owner->GetRenderWidgetHostView())
     return owner->GetRenderWidgetHostView()->GetRenderWidgetHost();
@@ -722,6 +726,7 @@ content::SiteInstance* GuestViewBase::GetOwnerSiteInstance() {
   // embedded in a cross-process frame, this method should be overrode for that
   // specific guest type. For all other guests, the owner site instance can be
   // from the owner WebContents.
+  DCHECK(!CanBeEmbeddedInsideCrossProcessFrames());
   if (auto* owner_contents = GetOwnerWebContents())
     return owner_contents->GetSiteInstance();
   return nullptr;
@@ -730,12 +735,14 @@ content::SiteInstance* GuestViewBase::GetOwnerSiteInstance() {
 void GuestViewBase::AttachToOuterWebContentsFrame(
     content::RenderFrameHost* embedder_frame,
     int32_t element_instance_id,
-    bool is_full_page_plugin) {
+    bool is_full_page_plugin,
+    GuestViewMessageHandler::AttachToEmbedderFrameCallback
+        attachment_callback) {
   auto completion_callback =
       base::BindOnce(&GuestViewBase::DidAttach, weak_ptr_factory_.GetWeakPtr());
   WillAttach(WebContents::FromRenderFrameHost(embedder_frame), embedder_frame,
              element_instance_id, is_full_page_plugin,
-             std::move(completion_callback));
+             std::move(completion_callback), std::move(attachment_callback));
 }
 
 void GuestViewBase::OnZoomChanged(
@@ -814,15 +821,15 @@ void GuestViewBase::SetUpSizing(const base::DictionaryValue& params) {
       params.FindBoolKey(kAttributeAutoSize);
   bool auto_size_enabled = auto_size_enabled_opt.value_or(auto_size_enabled_);
 
-  int max_height = max_auto_size_.height();
-  int max_width = max_auto_size_.width();
-  params.GetInteger(kAttributeMaxHeight, &max_height);
-  params.GetInteger(kAttributeMaxWidth, &max_width);
+  int max_height =
+      params.FindIntKey(kAttributeMaxHeight).value_or(max_auto_size_.height());
+  int max_width =
+      params.FindIntKey(kAttributeMaxWidth).value_or(max_auto_size_.width());
 
-  int min_height = min_auto_size_.height();
-  int min_width = min_auto_size_.width();
-  params.GetInteger(kAttributeMinHeight, &min_height);
-  params.GetInteger(kAttributeMinWidth, &min_width);
+  int min_height =
+      params.FindIntKey(kAttributeMinHeight).value_or(min_auto_size_.height());
+  int min_width =
+      params.FindIntKey(kAttributeMinWidth).value_or(min_auto_size_.width());
 
   double element_height = params.FindDoublePath(kElementHeight).value_or(0.0);
   double element_width = params.FindDoublePath(kElementWidth).value_or(0.0);
@@ -912,7 +919,7 @@ void GuestViewBase::SetOwnerHost() {
                     : std::string();
 }
 
-bool GuestViewBase::CanBeEmbeddedInsideCrossProcessFrames() {
+bool GuestViewBase::CanBeEmbeddedInsideCrossProcessFrames() const {
   return false;
 }
 
diff --git a/chromium/components/guest_view/browser/guest_view_base.h b/chromium/components/guest_view/browser/guest_view_base.h
index 13074cab054..c6dc516e006 100644
--- a/chromium/components/guest_view/browser/guest_view_base.h
+++ b/chromium/components/guest_view/browser/guest_view_base.h
@@ -11,6 +11,7 @@
 #include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/values.h"
+#include "components/guest_view/browser/guest_view_message_handler.h"
 #include "components/guest_view/common/guest_view_constants.h"
 #include "components/zoom/zoom_observer.h"
 #include "content/public/browser/browser_plugin_guest_delegate.h"
@@ -164,7 +165,10 @@ class GuestViewBase : public content::BrowserPluginGuestDelegate,
   // Returns the user browser context of the embedder.
   content::BrowserContext* browser_context() const { return browser_context_; }
 
-  // Returns the URL of the owner WebContents.
+  // Returns the URL of the owner WebContents' SiteInstance.
+  // WARNING: Be careful using this with GuestViews where
+  // `CanBeEmbeddedInsideCrossProcessFrames` is true. This returns the site of
+  // the WebContents, not the embedding frame.
   const GURL& GetOwnerSiteURL() const;
 
   // Returns the host of the owner WebContents. For extensions, this is the
@@ -195,13 +199,16 @@ class GuestViewBase : public content::BrowserPluginGuestDelegate,
   // |embedder_frame| is a frame in the embedder WebContents (owned by a
   // HTMLFrameOwnerElement associated with the GuestView's element in the
   // embedder process) which will be used for attaching.
-  void AttachToOuterWebContentsFrame(content::RenderFrameHost* embedder_frame,
-                                     int32_t element_instance_id,
-                                     bool is_full_page_plugin);
+  void AttachToOuterWebContentsFrame(
+      content::RenderFrameHost* embedder_frame,
+      int32_t element_instance_id,
+      bool is_full_page_plugin,
+      GuestViewMessageHandler::AttachToEmbedderFrameCallback
+          attachment_callback);
 
   // Returns true if the corresponding guest is allowed to be embedded inside an
   // <iframe> which is cross process.
-  virtual bool CanBeEmbeddedInsideCrossProcessFrames();
+  virtual bool CanBeEmbeddedInsideCrossProcessFrames() const;
 
  protected:
   explicit GuestViewBase(content::WebContents* owner_web_contents);
@@ -400,7 +407,9 @@ class GuestViewBase : public content::BrowserPluginGuestDelegate,
                   content::RenderFrameHost* outer_contents_frame,
                   int browser_plugin_instance_id,
                   bool is_full_page_plugin,
-                  base::OnceClosure completion_callback);
+                  base::OnceClosure completion_callback,
+                  GuestViewMessageHandler::AttachToEmbedderFrameCallback
+                      attachment_callback);
 
   // This guest tracks the lifetime of the WebContents specified by
   // |owner_web_contents_|. If |owner_web_contents_| is destroyed then this
diff --git a/chromium/components/guest_view/browser/guest_view_manager.h b/chromium/components/guest_view/browser/guest_view_manager.h
index c76e6604427..105ce7af2d6 100644
--- a/chromium/components/guest_view/browser/guest_view_manager.h
+++ b/chromium/components/guest_view/browser/guest_view_manager.h
@@ -139,7 +139,7 @@ class GuestViewManager : public content::BrowserPluginGuestManager,
  protected:
   friend class GuestViewBase;
   friend class GuestViewEvent;
-  friend class GuestViewMessageFilter;
+  friend class GuestViewMessageHandler;
 
   class EmbedderRenderProcessHostObserver;
 
diff --git a/chromium/components/guest_view/browser/guest_view_message_filter.cc b/chromium/components/guest_view/browser/guest_view_message_filter.cc
deleted file mode 100644
index 9a762e36d22..00000000000
--- a/chromium/components/guest_view/browser/guest_view_message_filter.cc
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/guest_view/browser/guest_view_message_filter.h"
-
-#include <memory>
-
-#include "base/memory/singleton.h"
-#include "components/guest_view/browser/bad_message.h"
-#include "components/guest_view/browser/guest_view_base.h"
-#include "components/guest_view/browser/guest_view_manager.h"
-#include "components/guest_view/browser/guest_view_manager_delegate.h"
-#include "components/guest_view/common/guest_view_messages.h"
-#include "components/keyed_service/content/browser_context_keyed_service_shutdown_notifier_factory.h"
-#include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/render_process_host.h"
-#include "content/public/browser/render_view_host.h"
-#include "ipc/ipc_message_macros.h"
-
-using content::BrowserContext;
-using content::BrowserThread;
-using content::RenderFrameHost;
-using content::WebContents;
-
-namespace guest_view {
-
-namespace {
-
-class ShutdownNotifierFactory
-    : public BrowserContextKeyedServiceShutdownNotifierFactory {
- public:
-  static ShutdownNotifierFactory* GetInstance() {
-    return base::Singleton<ShutdownNotifierFactory>::get();
-  }
-
- private:
-  friend struct base::DefaultSingletonTraits<ShutdownNotifierFactory>;
-
-  ShutdownNotifierFactory()
-      : BrowserContextKeyedServiceShutdownNotifierFactory(
-            "GuestViewMessageFilter") {}
-  ~ShutdownNotifierFactory() override = default;
-};
-
-}  // namespace
-
-GuestViewMessageFilter::GuestViewMessageFilter(
-    const uint32_t* message_classes_to_filter,
-    size_t num_message_classes_to_filter,
-    int render_process_id,
-    BrowserContext* context)
-    : BrowserMessageFilter(message_classes_to_filter,
-                           num_message_classes_to_filter),
-      render_process_id_(render_process_id),
-      browser_context_(context) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  browser_context_shutdown_subscription_ =
-      ShutdownNotifierFactory::GetInstance()->Get(context)->Subscribe(
-          base::BindRepeating(&GuestViewMessageFilter::OnBrowserContextShutdown,
-                              base::Unretained(this)));
-}
-
-GuestViewMessageFilter::~GuestViewMessageFilter() {
-  // The filter is destroyed on the UI thread as
-  // |browser_context_shutdown_subscription_| was created there.
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-}
-
-void GuestViewMessageFilter::EnsureShutdownNotifierFactoryBuilt() {
-  ShutdownNotifierFactory::GetInstance();
-}
-
-void GuestViewMessageFilter::OnBrowserContextShutdown() {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  browser_context_ = nullptr;
-  browser_context_shutdown_subscription_ = {};
-}
-
-GuestViewManager* GuestViewMessageFilter::GetOrCreateGuestViewManager() {
-  DCHECK(browser_context_);
-  auto* manager = GuestViewManager::FromBrowserContext(browser_context_);
-  if (!manager) {
-    manager = GuestViewManager::CreateWithDelegate(
-        browser_context_, std::make_unique<GuestViewManagerDelegate>());
-  }
-  return manager;
-}
-
-GuestViewManager* GuestViewMessageFilter::GetGuestViewManagerOrKill() {
-  DCHECK(browser_context_);
-  auto* manager = GuestViewManager::FromBrowserContext(browser_context_);
-  if (!manager) {
-    bad_message::ReceivedBadMessage(
-        this, bad_message::GVMF_UNEXPECTED_MESSAGE_BEFORE_GVM_CREATION);
-  }
-  return manager;
-}
-
-void GuestViewMessageFilter::OverrideThreadForMessage(
-    const IPC::Message& message,
-    BrowserThread::ID* thread) {
-  if (IPC_MESSAGE_CLASS(message) == GuestViewMsgStart)
-    *thread = BrowserThread::UI;
-}
-
-void GuestViewMessageFilter::OnDestruct() const {
-  BrowserThread::DeleteOnUIThread::Destruct(this);
-}
-
-bool GuestViewMessageFilter::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(GuestViewMessageFilter, message)
-    IPC_MESSAGE_HANDLER(GuestViewHostMsg_AttachToEmbedderFrame,
-                        OnAttachToEmbedderFrame)
-    IPC_MESSAGE_HANDLER(GuestViewHostMsg_ViewCreated, OnViewCreated)
-    IPC_MESSAGE_HANDLER(GuestViewHostMsg_ViewGarbageCollected,
-                        OnViewGarbageCollected)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void GuestViewMessageFilter::OnViewCreated(int view_instance_id,
-                                           const std::string& view_type) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  if (!browser_context_)
-    return;
-  GetOrCreateGuestViewManager()->ViewCreated(render_process_id_,
-                                             view_instance_id, view_type);
-}
-
-void GuestViewMessageFilter::OnViewGarbageCollected(int view_instance_id) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  if (!browser_context_)
-    return;
-  GetOrCreateGuestViewManager()->ViewGarbageCollected(render_process_id_,
-                                                      view_instance_id);
-}
-
-void GuestViewMessageFilter::OnAttachToEmbedderFrame(
-    int embedder_local_render_frame_id,
-    int element_instance_id,
-    int guest_instance_id,
-    const base::DictionaryValue& params) {
-  if (!browser_context_)
-    return;
-
-  // We should have a GuestViewManager at this point. If we don't then the
-  // embedder is misbehaving.
-  auto* manager = GetGuestViewManagerOrKill();
-  if (!manager)
-    return;
-
-  content::WebContents* guest_web_contents =
-      manager->GetGuestByInstanceIDSafely(guest_instance_id,
-                                          render_process_id_);
-  if (!guest_web_contents)
-    return;
-
-  auto* guest = GuestViewBase::FromWebContents(guest_web_contents);
-  content::WebContents* owner_web_contents = guest->owner_web_contents();
-  DCHECK(owner_web_contents);
-  auto* embedder_frame = RenderFrameHost::FromID(
-      render_process_id_, embedder_local_render_frame_id);
-
-  // Update the guest manager about the attachment.
-  // This sets up the embedder and guest pairing information inside
-  // the manager.
-  manager->AttachGuest(render_process_id_, element_instance_id,
-                       guest_instance_id, params);
-
-  guest->AttachToOuterWebContentsFrame(embedder_frame, element_instance_id,
-                                       false /* is_full_page_plugin */);
-}
-
-}  // namespace guest_view
diff --git a/chromium/components/guest_view/browser/guest_view_message_filter.h b/chromium/components/guest_view/browser/guest_view_message_filter.h
deleted file mode 100644
index 6403f21892d..00000000000
--- a/chromium/components/guest_view/browser/guest_view_message_filter.h
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_GUEST_VIEW_BROWSER_GUEST_VIEW_MESSAGE_FILTER_H_
-#define COMPONENTS_GUEST_VIEW_BROWSER_GUEST_VIEW_MESSAGE_FILTER_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include <string>
-
-#include "base/memory/raw_ptr.h"
-#include "components/keyed_service/core/keyed_service_shutdown_notifier.h"
-#include "content/public/browser/browser_message_filter.h"
-#include "content/public/browser/browser_thread.h"
-
-namespace base {
-class DictionaryValue;
-}
-
-namespace content {
-class BrowserContext;
-}
-
-namespace guest_view {
-class GuestViewManager;
-
-// This class filters out incoming GuestView-specific IPC messages from the
-// renderer process. It is created on the UI thread. Messages may be handled on
-// the IO thread or the UI thread.
-class GuestViewMessageFilter : public content::BrowserMessageFilter {
- public:
-  GuestViewMessageFilter(const GuestViewMessageFilter&) = delete;
-  GuestViewMessageFilter& operator=(const GuestViewMessageFilter&) = delete;
-
-  static void EnsureShutdownNotifierFactoryBuilt();
-
- protected:
-  GuestViewMessageFilter(const uint32_t* message_classes_to_filter,
-                         size_t num_message_classes_to_filter,
-                         int render_process_id,
-                         content::BrowserContext* context);
-
-  ~GuestViewMessageFilter() override;
-
-  // Returns the GuestViewManager for |browser_context_| if one already exists,
-  // or creates and returns one for |browser_context_| otherwise.
-  virtual GuestViewManager* GetOrCreateGuestViewManager();
-
-  // Returns the GuestViewManager for |browser_context_| if it exists.
-  // Callers consider the renderer to be misbehaving if we don't have a
-  // GuestViewManager at this point, in which case we kill the renderer and
-  // return nullptr.
-  GuestViewManager* GetGuestViewManagerOrKill();
-
-  // content::BrowserMessageFilter implementation.
-  void OverrideThreadForMessage(const IPC::Message& message,
-                                content::BrowserThread::ID* thread) override;
-  void OnDestruct() const override;
-  bool OnMessageReceived(const IPC::Message& message) override;
-
-  const int render_process_id_;
-
-  // Should only be accessed on the UI thread.
-  // May become null if this filter outlives the BrowserContext.
-  raw_ptr<content::BrowserContext> browser_context_;
-
- private:
-  friend class content::BrowserThread;
-  friend class base::DeleteHelper<GuestViewMessageFilter>;
-
-  // Message handlers on the UI thread.
-  void OnAttachToEmbedderFrame(int embedder_local_render_frame_id,
-                               int element_instance_id,
-                               int guest_instance_id,
-                               const base::DictionaryValue& params);
-  void OnViewCreated(int view_instance_id, const std::string& view_type);
-  void OnViewGarbageCollected(int view_instance_id);
-
-  void OnBrowserContextShutdown();
-
-  base::CallbackListSubscription browser_context_shutdown_subscription_;
-};
-
-}  // namespace guest_view
-
-#endif  // COMPONENTS_GUEST_VIEW_BROWSER_GUEST_VIEW_MESSAGE_FILTER_H_
diff --git a/chromium/components/guest_view/browser/guest_view_message_handler.cc b/chromium/components/guest_view/browser/guest_view_message_handler.cc
new file mode 100644
index 00000000000..caf901e2ef3
--- /dev/null
+++ b/chromium/components/guest_view/browser/guest_view_message_handler.cc
@@ -0,0 +1,123 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/guest_view/browser/guest_view_message_handler.h"
+
+#include <memory>
+
+#include "components/guest_view/browser/bad_message.h"
+#include "components/guest_view/browser/guest_view_base.h"
+#include "components/guest_view/browser/guest_view_manager.h"
+#include "components/guest_view/browser/guest_view_manager_delegate.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
+
+using content::BrowserThread;
+using content::RenderFrameHost;
+
+namespace guest_view {
+
+GuestViewMessageHandler::GuestViewMessageHandler(int render_process_id)
+    : render_process_id_(render_process_id) {}
+
+GuestViewMessageHandler::~GuestViewMessageHandler() = default;
+
+GuestViewManager* GuestViewMessageHandler::GetOrCreateGuestViewManager() {
+  auto* browser_context = GetBrowserContext();
+  auto* manager = GuestViewManager::FromBrowserContext(browser_context);
+  if (!manager) {
+    manager = GuestViewManager::CreateWithDelegate(
+        browser_context, CreateGuestViewManagerDelegate(browser_context));
+  }
+  return manager;
+}
+
+GuestViewManager* GuestViewMessageHandler::GetGuestViewManagerOrKill() {
+  auto* manager = GuestViewManager::FromBrowserContext(GetBrowserContext());
+  if (!manager) {
+    bad_message::ReceivedBadMessage(
+        render_process_id(),
+        bad_message::GVMF_UNEXPECTED_MESSAGE_BEFORE_GVM_CREATION);
+  }
+  return manager;
+}
+
+std::unique_ptr<GuestViewManagerDelegate>
+GuestViewMessageHandler::CreateGuestViewManagerDelegate(
+    content::BrowserContext* context) const {
+  return std::make_unique<GuestViewManagerDelegate>();
+}
+
+content::BrowserContext* GuestViewMessageHandler::GetBrowserContext() const {
+  auto* rph = content::RenderProcessHost::FromID(render_process_id());
+  return rph ? rph->GetBrowserContext() : nullptr;
+}
+
+void GuestViewMessageHandler::ViewCreated(int view_instance_id,
+                                          const std::string& view_type) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (!GetBrowserContext())
+    return;
+  GetOrCreateGuestViewManager()->ViewCreated(render_process_id(),
+                                             view_instance_id, view_type);
+}
+
+void GuestViewMessageHandler::ViewGarbageCollected(int view_instance_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (!GetBrowserContext())
+    return;
+  GetOrCreateGuestViewManager()->ViewGarbageCollected(render_process_id(),
+                                                      view_instance_id);
+}
+
+void GuestViewMessageHandler::AttachToEmbedderFrame(
+    int embedder_local_render_frame_id,
+    int element_instance_id,
+    int guest_instance_id,
+    base::Value params,
+    AttachToEmbedderFrameCallback callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (!GetBrowserContext()) {
+    std::move(callback).Run();
+    return;
+  }
+
+  // We should have a GuestViewManager at this point. If we don't then the
+  // embedder is misbehaving.
+  auto* manager = GetGuestViewManagerOrKill();
+  if (!manager) {
+    // The renderer has been killed, and this event logged, by
+    // `ReceivedBadMessage`, so we can just return.
+    std::move(callback).Run();
+    return;
+  }
+
+  content::WebContents* guest_web_contents =
+      manager->GetGuestByInstanceIDSafely(guest_instance_id,
+                                          render_process_id());
+  if (!guest_web_contents) {
+    std::move(callback).Run();
+    return;
+  }
+
+  auto* guest = GuestViewBase::FromWebContents(guest_web_contents);
+  content::WebContents* owner_web_contents = guest->owner_web_contents();
+  DCHECK(owner_web_contents);
+  auto* embedder_frame = RenderFrameHost::FromID(
+      render_process_id(), embedder_local_render_frame_id);
+
+  // Update the guest manager about the attachment.
+  // This sets up the embedder and guest pairing information inside
+  // the manager.
+  manager->AttachGuest(render_process_id(), element_instance_id,
+                       guest_instance_id,
+                       base::Value::AsDictionaryValue(params));
+
+  guest->AttachToOuterWebContentsFrame(embedder_frame, element_instance_id,
+                                       false /* is_full_page_plugin */,
+                                       std::move(callback));
+}
+
+}  // namespace guest_view
diff --git a/chromium/components/guest_view/browser/guest_view_message_handler.h b/chromium/components/guest_view/browser/guest_view_message_handler.h
new file mode 100644
index 00000000000..6ff5fba692e
--- /dev/null
+++ b/chromium/components/guest_view/browser/guest_view_message_handler.h
@@ -0,0 +1,64 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_GUEST_VIEW_BROWSER_GUEST_VIEW_MESSAGE_HANDLER_H_
+#define COMPONENTS_GUEST_VIEW_BROWSER_GUEST_VIEW_MESSAGE_HANDLER_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "components/guest_view/common/guest_view.mojom.h"
+
+namespace content {
+class BrowserContext;
+}
+
+namespace guest_view {
+class GuestViewManager;
+class GuestViewManagerDelegate;
+
+class GuestViewMessageHandler : public mojom::GuestViewHost {
+ public:
+  GuestViewMessageHandler(const GuestViewMessageHandler&) = delete;
+  GuestViewMessageHandler& operator=(const GuestViewMessageHandler&) = delete;
+  ~GuestViewMessageHandler() override;
+
+ protected:
+  explicit GuestViewMessageHandler(int render_process_id);
+
+  int render_process_id() const { return render_process_id_; }
+
+ private:
+  // Returns the GuestViewManager for the BrowserContext of our associated
+  // render process if one already exists, otherwise creates and returns one.
+  GuestViewManager* GetOrCreateGuestViewManager();
+
+  // Returns the GuestViewManager for the BrowserContext of our associated
+  // render process if it exists. Callers consider the renderer to be
+  // misbehaving if we don't have a GuestViewManager at this point, in which
+  // case we kill the renderer and return nullptr.
+  GuestViewManager* GetGuestViewManagerOrKill();
+
+  virtual std::unique_ptr<GuestViewManagerDelegate>
+  CreateGuestViewManagerDelegate(content::BrowserContext* context) const;
+
+  content::BrowserContext* GetBrowserContext() const;
+
+  // mojom::GuestViewHost
+  void AttachToEmbedderFrame(int embedder_local_render_frame_id,
+                             int element_instance_id,
+                             int guest_instance_id,
+                             base::Value params,
+                             AttachToEmbedderFrameCallback callback) override;
+  void ViewCreated(int view_instance_id, const std::string& view_type) override;
+  void ViewGarbageCollected(int view_instance_id) override;
+
+  const int render_process_id_;
+};
+
+}  // namespace guest_view
+
+#endif  // COMPONENTS_GUEST_VIEW_BROWSER_GUEST_VIEW_MESSAGE_HANDLER_H_
diff --git a/chromium/components/guest_view/common/BUILD.gn b/chromium/components/guest_view/common/BUILD.gn
index 9916d95a111..da6741e5b57 100644
--- a/chromium/components/guest_view/common/BUILD.gn
+++ b/chromium/components/guest_view/common/BUILD.gn
@@ -1,15 +1,16 @@
+import("//mojo/public/tools/bindings/mojom.gni")
+
 static_library("common") {
   output_name = "guest_view_common"
   sources = [
     "guest_view_constants.cc",
     "guest_view_constants.h",
-    "guest_view_message_generator.cc",
-    "guest_view_message_generator.h",
-    "guest_view_messages.h",
   ]
+}
 
-  deps = [
-    "//base",
-    "//ipc",
-  ]
+mojom("mojom") {
+  cpp_only = true
+  disable_variants = true
+  sources = [ "guest_view.mojom" ]
+  public_deps = [ "//mojo/public/mojom/base" ]
 }
diff --git a/chromium/components/guest_view/common/DEPS b/chromium/components/guest_view/common/DEPS
deleted file mode 100644
index b0e64bf2235..00000000000
--- a/chromium/components/guest_view/common/DEPS
+++ /dev/null
@@ -1,3 +0,0 @@
-include_rules = [
-  "+ipc"
-]
diff --git a/chromium/components/guest_view/common/OWNERS b/chromium/components/guest_view/common/OWNERS
index 42444bcd16d..1feb5149750 100644
--- a/chromium/components/guest_view/common/OWNERS
+++ b/chromium/components/guest_view/common/OWNERS
@@ -1,2 +1,4 @@
-per-file *_messages*.h=set noparent
-per-file *_messages*.h=file://ipc/SECURITY_OWNERS
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/chromium/components/guest_view/common/guest_view.mojom b/chromium/components/guest_view/common/guest_view.mojom
new file mode 100644
index 00000000000..8929e45a9d4
--- /dev/null
+++ b/chromium/components/guest_view/common/guest_view.mojom
@@ -0,0 +1,32 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module guest_view.mojom;
+
+import "mojo/public/mojom/base/values.mojom";
+
+// The renderer uses this interface to create GuestViews, make requests to the
+// browser to attach a GuestView to a container frame, and notify the browser
+// of state relating to a guest's container.
+interface GuestViewHost {
+  // We have a RenderFrame with routing id of |embedder_local_frame_routing_id|.
+  // We want this local frame to be replaced with a remote frame that points
+  // to a GuestView. This message will attach the local frame to the guest.
+  // The GuestView is identified by its ID: |guest_instance_id|.
+  AttachToEmbedderFrame(
+      int32 embedder_local_frame_routing_id,
+      int32 element_instance_id,
+      int32 guest_instance_id,
+      mojo_base.mojom.DictionaryValue params) => ();
+
+  // Sent by the renderer when a GuestView (identified by |view_instance_id|)
+  // has been created in JavaScript.
+  ViewCreated(int32 view_instance_id, string view_type);
+
+  // Sent by the renderer when a GuestView (identified by |view_instance_id|)
+  // has been garbage collected in JavaScript.
+  // TODO(mcnee): Instead of a separate message for cleanup, consider having
+  // `ViewCreated` incorporate a "keep alive" interface.
+  ViewGarbageCollected(int32 view_instance_id);
+};
diff --git a/chromium/components/guest_view/common/guest_view_message_generator.cc b/chromium/components/guest_view/common/guest_view_message_generator.cc
deleted file mode 100644
index 363c62a4be4..00000000000
--- a/chromium/components/guest_view/common/guest_view_message_generator.cc
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Get basic type definitions.
-#define IPC_MESSAGE_IMPL
-#include "components/guest_view/common/guest_view_message_generator.h"
-
-// Generate constructors.
-#include "ipc/struct_constructor_macros.h"
-#include "components/guest_view/common/guest_view_message_generator.h"
-
-// Generate param traits write methods.
-#include "ipc/param_traits_write_macros.h"
-namespace IPC {
-#include "components/guest_view/common/guest_view_message_generator.h"
-}  // namespace IPC
-
-// Generate param traits read methods.
-#include "ipc/param_traits_read_macros.h"
-namespace IPC {
-#include "components/guest_view/common/guest_view_message_generator.h"
-}  // namespace IPC
-
-// Generate param traits log methods.
-#include "ipc/param_traits_log_macros.h"
-namespace IPC {
-#include "components/guest_view/common/guest_view_message_generator.h"
-}  // namespace IPC
diff --git a/chromium/components/guest_view/common/guest_view_message_generator.h b/chromium/components/guest_view/common/guest_view_message_generator.h
deleted file mode 100644
index 9f1bb10b405..00000000000
--- a/chromium/components/guest_view/common/guest_view_message_generator.h
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Multiply-included file, no traditional include guard.
-
-#undef COMPONENTS_GUEST_VIEW_COMMON_GUEST_VIEW_MESSAGES_H_
-#include "components/guest_view/common/guest_view_messages.h"
diff --git a/chromium/components/guest_view/common/guest_view_messages.h b/chromium/components/guest_view/common/guest_view_messages.h
deleted file mode 100644
index 82a0d4ea1d3..00000000000
--- a/chromium/components/guest_view/common/guest_view_messages.h
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// IPC messages for GuestViews.
-
-#ifndef COMPONENTS_GUEST_VIEW_COMMON_GUEST_VIEW_MESSAGES_H_
-#define COMPONENTS_GUEST_VIEW_COMMON_GUEST_VIEW_MESSAGES_H_
-
-#include "base/values.h"
-#include "ipc/ipc_message_macros.h"
-#include "ipc/ipc_message_start.h"
-
-#define IPC_MESSAGE_START GuestViewMsgStart
-
-// Messages sent from the browser to the renderer.
-
-// Tells the embedder that a guest has been attached in --site-per-process mode.
-IPC_MESSAGE_CONTROL1(GuestViewMsg_AttachToEmbedderFrame_ACK,
-                     int /* element_instance_id */)
-
-// Messages sent from the renderer to the browser.
-
-// We have a RenderFrame with routing id of |embedder_local_frame_routing_id|.
-// We want this local frame to be replaced with a remote frame that points
-// to a GuestView. This message will attach the local frame to the guest.
-// The GuestView is identified by its ID: |guest_instance_id|.
-IPC_MESSAGE_CONTROL4(GuestViewHostMsg_AttachToEmbedderFrame,
-                     int /* embedder_local_frame_routing_id */,
-                     int /* element_instance_id */,
-                     int /* guest_instance_id */,
-                     base::DictionaryValue /* params */)
-
-// Sent by the renderer when a GuestView (identified by |view_instance_id|) has
-// been created in JavaScript.
-IPC_MESSAGE_CONTROL2(GuestViewHostMsg_ViewCreated,
-                     int /* view_instance_id */,
-                     std::string /* view_type */)
-
-// Sent by the renderer when a GuestView (identified by |view_instance_id|) has
-// been garbage collected in JavaScript.
-IPC_MESSAGE_CONTROL1(GuestViewHostMsg_ViewGarbageCollected,
-                     int /* view_instance_id */)
-
-#endif  // COMPONENTS_GUEST_VIEW_COMMON_GUEST_VIEW_MESSAGES_H_
diff --git a/chromium/components/guest_view/renderer/BUILD.gn b/chromium/components/guest_view/renderer/BUILD.gn
index 13065887efd..bd63370d960 100644
--- a/chromium/components/guest_view/renderer/BUILD.gn
+++ b/chromium/components/guest_view/renderer/BUILD.gn
@@ -12,24 +12,18 @@ static_library("renderer") {
   sources = [
     "guest_view_container.cc",
     "guest_view_container.h",
-    "guest_view_container_dispatcher.cc",
-    "guest_view_container_dispatcher.h",
     "guest_view_request.cc",
     "guest_view_request.h",
-    "iframe_guest_view_container.cc",
-    "iframe_guest_view_container.h",
-    "iframe_guest_view_request.cc",
-    "iframe_guest_view_request.h",
   ]
 
   deps = [
     "//base",
     "//components/guest_view/common",
+    "//components/guest_view/common:mojom",
     "//content/public/common",
     "//content/public/renderer",
+    "//ipc",
     "//third_party/blink/public:blink",
     "//v8",
   ]
-
-  public_deps = [ "//ipc" ]
 }
diff --git a/chromium/components/guest_view/renderer/guest_view_container.cc b/chromium/components/guest_view/renderer/guest_view_container.cc
index 4aece41201b..ec7e13fc293 100644
--- a/chromium/components/guest_view/renderer/guest_view_container.cc
+++ b/chromium/components/guest_view/renderer/guest_view_container.cc
@@ -9,11 +9,9 @@
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "components/guest_view/common/guest_view_constants.h"
-#include "components/guest_view/common/guest_view_messages.h"
 #include "components/guest_view/renderer/guest_view_request.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
-#include "content/public/renderer/render_view.h"
 #include "ui/gfx/geometry/size.h"
 #include "v8/include/v8-context.h"
 #include "v8/include/v8-function.h"
@@ -112,7 +110,7 @@ void GuestViewContainer::Destroy(bool embedder_frame_destroyed) {
       pending_response_->ExecuteCallbackIfAvailable(0 /* argc */, nullptr);
 
     while (pending_requests_.size() > 0) {
-      std::unique_ptr<GuestViewRequest> pending_request =
+      std::unique_ptr<GuestViewAttachRequest> pending_request =
           std::move(pending_requests_.front());
       pending_requests_.pop_front();
       // Call the JavaScript callbacks with no arguments which implies an error.
@@ -137,13 +135,13 @@ void GuestViewContainer::RenderFrameDestroyed() {
 }
 
 void GuestViewContainer::IssueRequest(
-    std::unique_ptr<GuestViewRequest> request) {
+    std::unique_ptr<GuestViewAttachRequest> request) {
   EnqueueRequest(std::move(request));
   PerformPendingRequest();
 }
 
 void GuestViewContainer::EnqueueRequest(
-    std::unique_ptr<GuestViewRequest> request) {
+    std::unique_ptr<GuestViewAttachRequest> request) {
   pending_requests_.push_back(std::move(request));
 }
 
@@ -151,21 +149,13 @@ void GuestViewContainer::PerformPendingRequest() {
   if (pending_requests_.empty() || pending_response_.get())
     return;
 
-  std::unique_ptr<GuestViewRequest> pending_request =
+  std::unique_ptr<GuestViewAttachRequest> pending_request =
       std::move(pending_requests_.front());
   pending_requests_.pop_front();
   pending_request->PerformRequest();
   pending_response_ = std::move(pending_request);
 }
 
-void GuestViewContainer::HandlePendingResponseCallback(
-    const IPC::Message& message) {
-  CHECK(pending_response_);
-  std::unique_ptr<GuestViewRequest> pending_response =
-      std::move(pending_response_);
-  pending_response->HandleResponse(message);
-}
-
 void GuestViewContainer::RunDestructionCallback(bool embedder_frame_destroyed) {
   // Do not attempt to run |destruction_callback_| if the embedder frame was
   // destroyed. Trying to invoke callback on RenderFrame destruction results in
@@ -178,8 +168,8 @@ void GuestViewContainer::RunDestructionCallback(bool embedder_frame_destroyed) {
     v8::HandleScope handle_scope(destruction_isolate_);
     v8::Local<v8::Function> callback = v8::Local<v8::Function>::New(
         destruction_isolate_, destruction_callback_);
-    v8::Local<v8::Context> context = callback->CreationContext();
-    if (context.IsEmpty())
+    v8::Local<v8::Context> context;
+    if (!callback->GetCreationContext().ToLocal(&context))
       return;
 
     v8::Context::Scope context_scope(context);
@@ -191,11 +181,16 @@ void GuestViewContainer::RunDestructionCallback(bool embedder_frame_destroyed) {
   }
 }
 
-void GuestViewContainer::OnHandleCallback(const IPC::Message& message) {
+void GuestViewContainer::OnRequestAcknowledged(
+    GuestViewAttachRequest* request) {
   base::WeakPtr<GuestViewContainer> weak_ptr(weak_ptr_factory_.GetWeakPtr());
 
   // Handle the callback for the current request with a pending response.
-  HandlePendingResponseCallback(message);
+  CHECK(pending_response_);
+  DCHECK_EQ(pending_response_.get(), request);
+  std::unique_ptr<GuestViewAttachRequest> pending_response =
+      std::move(pending_response_);
+  pending_response->ExecuteCallbackIfAvailable(0, nullptr);
 
   // Check that this container has not been deleted (crbug.com/718292).
   if (!weak_ptr)
@@ -205,18 +200,6 @@ void GuestViewContainer::OnHandleCallback(const IPC::Message& message) {
   PerformPendingRequest();
 }
 
-bool GuestViewContainer::OnMessage(const IPC::Message& message) {
-  return false;
-}
-
-bool GuestViewContainer::OnMessageReceived(const IPC::Message& message) {
-  if (OnMessage(message))
-    return true;
-
-  OnHandleCallback(message);
-  return true;
-}
-
 void GuestViewContainer::SetElementInstanceID(int element_instance_id) {
   DCHECK_EQ(element_instance_id_, guest_view::kInstanceIDNone);
   element_instance_id_ = element_instance_id;
@@ -249,8 +232,8 @@ void GuestViewContainer::CallElementResizeCallback(
   v8::HandleScope handle_scope(element_resize_isolate_);
   v8::Local<v8::Function> callback = v8::Local<v8::Function>::New(
       element_resize_isolate_, element_resize_callback_);
-  v8::Local<v8::Context> context = callback->CreationContext();
-  if (context.IsEmpty())
+  v8::Local<v8::Context> context;
+  if (!callback->GetCreationContext().ToLocal(&context))
     return;
 
   const int argc = 2;
diff --git a/chromium/components/guest_view/renderer/guest_view_container.h b/chromium/components/guest_view/renderer/guest_view_container.h
index 6ea89fe3007..f5539fdcd97 100644
--- a/chromium/components/guest_view/renderer/guest_view_container.h
+++ b/chromium/components/guest_view/renderer/guest_view_container.h
@@ -9,7 +9,6 @@
 
 #include "base/containers/circular_deque.h"
 #include "base/memory/weak_ptr.h"
-#include "ipc/ipc_message.h"
 #include "v8/include/v8-forward.h"
 #include "v8/include/v8-persistent-handle.h"
 
@@ -23,7 +22,7 @@ class RenderFrame;
 
 namespace guest_view {
 
-class GuestViewRequest;
+class GuestViewAttachRequest;
 
 class GuestViewContainer {
  public:
@@ -37,14 +36,13 @@ class GuestViewContainer {
   // IssueRequest queues up a |request| until the container is ready and
   // the browser process has responded to the last request if it's still
   // pending.
-  void IssueRequest(std::unique_ptr<GuestViewRequest> request);
+  void IssueRequest(std::unique_ptr<GuestViewAttachRequest> request);
 
   int element_instance_id() const { return element_instance_id_; }
   content::RenderFrame* render_frame() const { return render_frame_; }
 
-  // Called by GuestViewContainerDispatcher to dispatch message to this
-  // container.
-  bool OnMessageReceived(const IPC::Message& message);
+  // Called when a previously issued `request` was acknowledged by the browser.
+  void OnRequestAcknowledged(GuestViewAttachRequest* request);
 
   // Destroys this GuestViewContainer after performing necessary cleanup.
   // |embedder_frame_destroyed| is true if this destruction is due to the
@@ -59,10 +57,6 @@ class GuestViewContainer {
   // Called when the embedding RenderFrame is destroyed.
   virtual void OnRenderFrameDestroyed() {}
 
-  // Called to respond to IPCs from the browser process that have not been
-  // handled by GuestViewContainer.
-  virtual bool OnMessage(const IPC::Message& message);
-
   // Called to perform actions when a GuestViewContainer is about to be
   // destroyed.
   // Note that this should be called exactly once.
@@ -76,17 +70,14 @@ class GuestViewContainer {
  protected:
   virtual ~GuestViewContainer();
 
-  void OnHandleCallback(const IPC::Message& message);
-
  private:
   class RenderFrameLifetimeObserver;
   friend class RenderFrameLifetimeObserver;
 
   void RenderFrameDestroyed();
 
-  void EnqueueRequest(std::unique_ptr<GuestViewRequest> request);
+  void EnqueueRequest(std::unique_ptr<GuestViewAttachRequest> request);
   void PerformPendingRequest();
-  void HandlePendingResponseCallback(const IPC::Message& message);
   void RunDestructionCallback(bool embedder_frame_destroyed);
   void CallElementResizeCallback(const gfx::Size& new_size);
 
@@ -96,8 +87,9 @@ class GuestViewContainer {
 
   bool in_destruction_;
 
-  base::circular_deque<std::unique_ptr<GuestViewRequest>> pending_requests_;
-  std::unique_ptr<GuestViewRequest> pending_response_;
+  base::circular_deque<std::unique_ptr<GuestViewAttachRequest>>
+      pending_requests_;
+  std::unique_ptr<GuestViewAttachRequest> pending_response_;
 
   v8::Global<v8::Function> destruction_callback_;
   v8::Isolate* destruction_isolate_;
diff --git a/chromium/components/guest_view/renderer/guest_view_container_dispatcher.cc b/chromium/components/guest_view/renderer/guest_view_container_dispatcher.cc
deleted file mode 100644
index a21c58226d7..00000000000
--- a/chromium/components/guest_view/renderer/guest_view_container_dispatcher.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/guest_view/renderer/guest_view_container_dispatcher.h"
-
-#include "components/guest_view/common/guest_view_constants.h"
-#include "components/guest_view/renderer/guest_view_container.h"
-#include "ipc/ipc_message_macros.h"
-#include "ipc/ipc_message_start.h"
-
-namespace guest_view {
-
-GuestViewContainerDispatcher::GuestViewContainerDispatcher() {
-}
-
-GuestViewContainerDispatcher::~GuestViewContainerDispatcher() {
-}
-
-bool GuestViewContainerDispatcher::HandlesMessage(const IPC::Message& message) {
-  return IPC_MESSAGE_CLASS(message) == GuestViewMsgStart;
-}
-
-bool GuestViewContainerDispatcher::OnControlMessageReceived(
-    const IPC::Message& message) {
-  if (!HandlesMessage(message))
-    return false;
-
-  int element_instance_id = kInstanceIDNone;
-  base::PickleIterator iter(message);
-  bool success = iter.ReadInt(&element_instance_id);
-  DCHECK(success);
-
-  auto* container = GuestViewContainer::FromID(element_instance_id);
-  if (!container)
-    return false;
-
-  return container->OnMessageReceived(message);
-}
-
-}  // namespace guest_view
diff --git a/chromium/components/guest_view/renderer/guest_view_container_dispatcher.h b/chromium/components/guest_view/renderer/guest_view_container_dispatcher.h
deleted file mode 100644
index aefadb7a73e..00000000000
--- a/chromium/components/guest_view/renderer/guest_view_container_dispatcher.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_GUEST_VIEW_RENDERER_GUEST_VIEW_CONTAINER_DISPATCHER_H_
-#define COMPONENTS_GUEST_VIEW_RENDERER_GUEST_VIEW_CONTAINER_DISPATCHER_H_
-
-#include "content/public/renderer/render_thread_observer.h"
-#include "ipc/ipc_message.h"
-
-namespace guest_view {
-
-// Dispatcher used to route messages to GuestViewContainer.
-class GuestViewContainerDispatcher : public content::RenderThreadObserver {
- public:
-  GuestViewContainerDispatcher();
-
-  GuestViewContainerDispatcher(const GuestViewContainerDispatcher&) = delete;
-  GuestViewContainerDispatcher& operator=(const GuestViewContainerDispatcher&) =
-      delete;
-
-  ~GuestViewContainerDispatcher() override;
-
- protected:
-  // Returns true if |message| is handled for a GuestViewContainer.
-  virtual bool HandlesMessage(const IPC::Message& message);
-
-  // content::RenderThreadObserver implementation.
-  bool OnControlMessageReceived(const IPC::Message& message) override;
-};
-
-}  // namespace guest_view
-
-#endif  // COMPONENTS_GUEST_VIEW_RENDERER_GUEST_VIEW_CONTAINER_DISPATCHER_H_
diff --git a/chromium/components/guest_view/renderer/guest_view_request.cc b/chromium/components/guest_view/renderer/guest_view_request.cc
index 118e070249e..a315dd269cf 100644
--- a/chromium/components/guest_view/renderer/guest_view_request.cc
+++ b/chromium/components/guest_view/renderer/guest_view_request.cc
@@ -7,10 +7,13 @@
 #include <tuple>
 #include <utility>
 
-#include "components/guest_view/common/guest_view_messages.h"
+#include "base/no_destructor.h"
+#include "components/guest_view/common/guest_view.mojom.h"
 #include "components/guest_view/renderer/guest_view_container.h"
 #include "content/public/renderer/render_frame.h"
+#include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/render_view.h"
+#include "ipc/ipc_sync_channel.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_remote_frame.h"
 #include "third_party/blink/public/web/web_view.h"
@@ -20,33 +23,66 @@
 
 namespace guest_view {
 
-GuestViewRequest::GuestViewRequest(GuestViewContainer* container,
-                                   v8::Local<v8::Function> callback,
-                                   v8::Isolate* isolate)
+namespace {
+
+mojom::GuestViewHost* GetGuestViewHost() {
+  static base::NoDestructor<mojo::AssociatedRemote<mojom::GuestViewHost>>
+      guest_view_host;
+  if (!*guest_view_host) {
+    content::RenderThread::Get()->GetChannel()->GetRemoteAssociatedInterface(
+        guest_view_host.get());
+  }
+
+  return guest_view_host->get();
+}
+
+}  // namespace
+
+GuestViewAttachRequest::GuestViewAttachRequest(
+    guest_view::GuestViewContainer* container,
+    int render_frame_routing_id,
+    int guest_instance_id,
+    std::unique_ptr<base::DictionaryValue> params,
+    v8::Local<v8::Function> callback,
+    v8::Isolate* isolate)
     : container_(container),
       callback_(isolate, callback),
-      isolate_(isolate) {
+      isolate_(isolate),
+      render_frame_routing_id_(render_frame_routing_id),
+      guest_instance_id_(guest_instance_id),
+      params_(std::move(params)) {}
+
+GuestViewAttachRequest::~GuestViewAttachRequest() = default;
+
+void GuestViewAttachRequest::PerformRequest() {
+  GetGuestViewHost()->AttachToEmbedderFrame(
+      render_frame_routing_id_, container_->element_instance_id(),
+      guest_instance_id_, params_->Clone(),
+      base::BindOnce(&GuestViewAttachRequest::OnAcknowledged,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
-GuestViewRequest::~GuestViewRequest() {
+void GuestViewAttachRequest::OnAcknowledged() {
+  // Destroys `this`.
+  container_->OnRequestAcknowledged(this);
 }
 
-void GuestViewRequest::ExecuteCallbackIfAvailable(
+void GuestViewAttachRequest::ExecuteCallbackIfAvailable(
     int argc,
     std::unique_ptr<v8::Local<v8::Value>[]> argv) {
   if (callback_.IsEmpty())
     return;
 
-  v8::HandleScope handle_scope(isolate());
+  v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Function> callback =
       v8::Local<v8::Function>::New(isolate_, callback_);
-  v8::Local<v8::Context> context = callback->CreationContext();
-  if (context.IsEmpty())
+  v8::Local<v8::Context> context;
+  if (!callback->GetCreationContext().ToLocal(&context))
     return;
 
   v8::Context::Scope context_scope(context);
-  v8::MicrotasksScope microtasks(
-      isolate(), v8::MicrotasksScope::kDoNotRunMicrotasks);
+  v8::MicrotasksScope microtasks(isolate_,
+                                 v8::MicrotasksScope::kDoNotRunMicrotasks);
 
   callback->Call(context, context->Global(), argc, argv.get())
       .FromMaybe(v8::Local<v8::Value>());
diff --git a/chromium/components/guest_view/renderer/guest_view_request.h b/chromium/components/guest_view/renderer/guest_view_request.h
index d26f3a72f45..ec5456df891 100644
--- a/chromium/components/guest_view/renderer/guest_view_request.h
+++ b/chromium/components/guest_view/renderer/guest_view_request.h
@@ -7,7 +7,8 @@
 
 #include <memory>
 
-#include "ipc/ipc_message.h"
+#include "base/memory/weak_ptr.h"
+#include "base/values.h"
 #include "v8/include/v8-forward.h"
 #include "v8/include/v8-persistent-handle.h"
 
@@ -15,30 +16,29 @@ namespace guest_view {
 
 class GuestViewContainer;
 
-// A GuestViewRequest is the base class for an asynchronous operation performed
-// on a GuestView or GuestViewContainer from JavaScript. This operation may be
-// queued until the container is ready to be operated upon (it has geometry).
-// A GuestViewRequest may or may not have a callback back into JavaScript.
-// Typically, performing a request involves sending an IPC to the browser
-// process in PerformRequest. Handling a response involves receiving a related
-// IPC from the browser process in HandleResponse.
-class GuestViewRequest {
+// This class represents an attach request from Javascript.
+// A GuestViewAttachRequest is an asynchronous operation performed on a
+// GuestView or GuestViewContainer from JavaScript. This operation may be queued
+// until the container is ready to be operated upon (it has geometry). A
+// GuestViewAttachRequest may or may not have a callback back into JavaScript.
+// Performing a request involves sending an IPC to the browser process in
+// PerformRequest which the browser will acknowledge.
+class GuestViewAttachRequest {
  public:
-  GuestViewRequest(GuestViewContainer* container,
-                   v8::Local<v8::Function> callback,
-                   v8::Isolate* isolate);
+  GuestViewAttachRequest(GuestViewContainer* container,
+                         int render_frame_routing_id,
+                         int guest_instance_id,
+                         std::unique_ptr<base::DictionaryValue> params,
+                         v8::Local<v8::Function> callback,
+                         v8::Isolate* isolate);
 
-  GuestViewRequest(const GuestViewRequest&) = delete;
-  GuestViewRequest& operator=(const GuestViewRequest&) = delete;
+  GuestViewAttachRequest(const GuestViewAttachRequest&) = delete;
+  GuestViewAttachRequest& operator=(const GuestViewAttachRequest&) = delete;
 
-  virtual ~GuestViewRequest();
+  ~GuestViewAttachRequest();
 
   // Performs the associated request.
-  virtual void PerformRequest() = 0;
-
-  // Called by GuestViewContainer when the browser process has responded to the
-  // request initiated by PerformRequest.
-  virtual void HandleResponse(const IPC::Message& message) = 0;
+  void PerformRequest();
 
   // Called to call the callback associated with this request if one is
   // available.
@@ -47,14 +47,17 @@ class GuestViewRequest {
   void ExecuteCallbackIfAvailable(int argc,
                                   std::unique_ptr<v8::Local<v8::Value>[]> argv);
 
-  GuestViewContainer* container() const { return container_; }
-
-  v8::Isolate* isolate() const { return isolate_; }
-
  private:
+  void OnAcknowledged();
+
   GuestViewContainer* const container_;
   v8::Global<v8::Function> callback_;
   v8::Isolate* const isolate_;
+  const int render_frame_routing_id_;
+  const int guest_instance_id_;
+  std::unique_ptr<base::DictionaryValue> params_;
+
+  base::WeakPtrFactory<GuestViewAttachRequest> weak_ptr_factory_{this};
 };
 
 }  // namespace guest_view
diff --git a/chromium/components/guest_view/renderer/iframe_guest_view_container.cc b/chromium/components/guest_view/renderer/iframe_guest_view_container.cc
deleted file mode 100644
index aa244a5c83b..00000000000
--- a/chromium/components/guest_view/renderer/iframe_guest_view_container.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/guest_view/renderer/iframe_guest_view_container.h"
-
-#include "base/feature_list.h"
-#include "components/guest_view/common/guest_view_messages.h"
-#include "content/public/common/content_features.h"
-#include "content/public/renderer/render_frame.h"
-
-namespace guest_view {
-
-IframeGuestViewContainer::IframeGuestViewContainer(
-    content::RenderFrame* render_frame)
-    : GuestViewContainer(render_frame) {
-}
-
-IframeGuestViewContainer::~IframeGuestViewContainer() {
-}
-
-bool IframeGuestViewContainer::OnMessage(const IPC::Message& message) {
-  if (message.type() != GuestViewMsg_AttachToEmbedderFrame_ACK::ID)
-    return false;
-
-  OnHandleCallback(message);
-  return true;
-}
-
-}  // namespace guest_view
diff --git a/chromium/components/guest_view/renderer/iframe_guest_view_container.h b/chromium/components/guest_view/renderer/iframe_guest_view_container.h
deleted file mode 100644
index 03f8a323979..00000000000
--- a/chromium/components/guest_view/renderer/iframe_guest_view_container.h
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_GUEST_VIEW_RENDERER_IFRAME_GUEST_VIEW_CONTAINER_H_
-#define COMPONENTS_GUEST_VIEW_RENDERER_IFRAME_GUEST_VIEW_CONTAINER_H_
-
-#include "components/guest_view/renderer/guest_view_container.h"
-
-namespace guest_view {
-
-// A GuestViewContainer whose container element is backed by an out-of-process
-// <iframe>.
-// This container handles messages related to guest attachment in
-// --site-per-process.
-class IframeGuestViewContainer : public GuestViewContainer {
- public:
-  explicit IframeGuestViewContainer(content::RenderFrame* render_frame);
-
-  IframeGuestViewContainer(const IframeGuestViewContainer&) = delete;
-  IframeGuestViewContainer& operator=(const IframeGuestViewContainer&) = delete;
-
-  ~IframeGuestViewContainer() override;
-
-  // GuestViewContainer overrides.
-  bool OnMessage(const IPC::Message& message) override;
-};
-
-}  // namespace guest_view
-
-#endif  // COMPONENTS_GUEST_VIEW_RENDERER_IFRAME_GUEST_VIEW_CONTAINER_H_
diff --git a/chromium/components/guest_view/renderer/iframe_guest_view_request.cc b/chromium/components/guest_view/renderer/iframe_guest_view_request.cc
deleted file mode 100644
index 08545af43b9..00000000000
--- a/chromium/components/guest_view/renderer/iframe_guest_view_request.cc
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/guest_view/renderer/iframe_guest_view_request.h"
-
-#include <utility>
-
-#include "components/guest_view/common/guest_view_messages.h"
-#include "components/guest_view/renderer/guest_view_container.h"
-#include "content/public/renderer/render_frame.h"
-
-namespace guest_view {
-
-GuestViewAttachIframeRequest::GuestViewAttachIframeRequest(
-    guest_view::GuestViewContainer* container,
-    int render_frame_routing_id,
-    int guest_instance_id,
-    std::unique_ptr<base::DictionaryValue> params,
-    v8::Local<v8::Function> callback,
-    v8::Isolate* isolate)
-    : GuestViewRequest(container, callback, isolate),
-      render_frame_routing_id_(render_frame_routing_id),
-      guest_instance_id_(guest_instance_id),
-      params_(std::move(params)) {}
-
-GuestViewAttachIframeRequest::~GuestViewAttachIframeRequest() {
-}
-
-void GuestViewAttachIframeRequest::PerformRequest() {
-  DCHECK(container()->render_frame());
-
-  container()->render_frame()->Send(new GuestViewHostMsg_AttachToEmbedderFrame(
-      render_frame_routing_id_, container()->element_instance_id(),
-      guest_instance_id_, *params_));
-}
-
-void GuestViewAttachIframeRequest::HandleResponse(const IPC::Message& message) {
-  GuestViewMsg_AttachToEmbedderFrame_ACK::Param param;
-  bool message_read_status =
-      GuestViewMsg_AttachToEmbedderFrame_ACK::Read(&message, &param);
-  DCHECK(message_read_status);
-
-  ExecuteCallbackIfAvailable(0, nullptr);
-}
-
-}  // namespace guest_view
diff --git a/chromium/components/guest_view/renderer/iframe_guest_view_request.h b/chromium/components/guest_view/renderer/iframe_guest_view_request.h
deleted file mode 100644
index de702eddbed..00000000000
--- a/chromium/components/guest_view/renderer/iframe_guest_view_request.h
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_GUEST_VIEW_RENDERER_IFRAME_GUEST_VIEW_REQUEST_H_
-#define COMPONENTS_GUEST_VIEW_RENDERER_IFRAME_GUEST_VIEW_REQUEST_H_
-
-#include <memory>
-
-#include "base/values.h"
-#include "components/guest_view/renderer/guest_view_request.h"
-#include "ipc/ipc_message.h"
-#include "v8/include/v8-forward.h"
-
-namespace guest_view {
-class GuestViewContainer;
-
-// This class represents an AttachGuest request in --site-per-process from
-// Javascript. It includes
-// the input parameters and the callback function.
-class GuestViewAttachIframeRequest : public guest_view::GuestViewRequest {
- public:
-  GuestViewAttachIframeRequest(GuestViewContainer* container,
-                               int render_frame_routing_id,
-                               int guest_instance_id,
-                               std::unique_ptr<base::DictionaryValue> params,
-                               v8::Local<v8::Function> callback,
-                               v8::Isolate* isolate);
-
-  GuestViewAttachIframeRequest(const GuestViewAttachIframeRequest&) = delete;
-  GuestViewAttachIframeRequest& operator=(const GuestViewAttachIframeRequest&) =
-      delete;
-
-  ~GuestViewAttachIframeRequest() override;
-
-  void PerformRequest() override;
-  void HandleResponse(const IPC::Message& message) override;
-
- private:
-  const int render_frame_routing_id_;
-  const int guest_instance_id_;
-  std::unique_ptr<base::DictionaryValue> params_;
-};
-
-}  // namespace guest_view
-
-#endif  // COMPONENTS_GUEST_VIEW_RENDERER_IFRAME_GUEST_VIEW_REQUEST_H_