diff --git a/src/com/android/browser/ActiveTabsPage.java b/src/com/android/browser/ActiveTabsPage.java
index 90c417a..72f291c 100644
--- a/src/com/android/browser/ActiveTabsPage.java
+++ b/src/com/android/browser/ActiveTabsPage.java
@@ -49,7 +49,7 @@
         mListView.setOnItemClickListener(new AdapterView.OnItemClickListener() {
                 public void onItemClick(AdapterView<?> parent, View view,
                         int position, long id) {
-                    if (mControl.getTabCount() < TabControl.MAX_TABS) {
+                    if (mControl.canCreateNewTab()) {
                         position--;
                     }
                     boolean needToAttach = false;
@@ -92,7 +92,7 @@
     private class TabsListAdapter extends BaseAdapter {
         public int getCount() {
             int count = mControl.getTabCount();
-            if (count < TabControl.MAX_TABS) {
+            if (mControl.canCreateNewTab()) {
                 count++;
             }
             return count;
@@ -107,7 +107,7 @@
             return 2;
         }
         public int getItemViewType(int position) {
-            if (mControl.getTabCount() < TabControl.MAX_TABS) {
+            if (mControl.canCreateNewTab()) {
                 position--;
             }
             // Do not recycle the "add new tab" item.
@@ -115,7 +115,7 @@
         }
         public View getView(int position, View convertView, ViewGroup parent) {
             final int tabCount = mControl.getTabCount();
-            if (tabCount < TabControl.MAX_TABS) {
+            if (mControl.canCreateNewTab()) {
                 position--;
             }
 
@@ -131,8 +131,8 @@
                 ImageView favicon =
                         (ImageView) convertView.findViewById(R.id.favicon);
                 View close = convertView.findViewById(R.id.close);
-                TabControl.Tab tab = mControl.getTab(position);
-                mControl.populatePickerData(tab);
+                Tab tab = mControl.getTab(position);
+                tab.populatePickerData();
                 title.setText(tab.getTitle());
                 url.setText(tab.getUrl());
                 Bitmap icon = tab.getFavicon();
diff --git a/src/com/android/browser/BrowserActivity.java b/src/com/android/browser/BrowserActivity.java
index 0eeb60f..1a6ee0d 100644
--- a/src/com/android/browser/BrowserActivity.java
+++ b/src/com/android/browser/BrowserActivity.java
@@ -34,33 +34,23 @@
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.ServiceConnection;
-import android.content.DialogInterface.OnCancelListener;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
-import android.content.res.AssetManager;
 import android.content.res.Configuration;
 import android.content.res.Resources;
 import android.database.Cursor;
-import android.database.sqlite.SQLiteDatabase;
-import android.database.sqlite.SQLiteException;
 import android.graphics.Bitmap;
 import android.graphics.BitmapFactory;
 import android.graphics.Canvas;
-import android.graphics.DrawFilter;
-import android.graphics.Paint;
-import android.graphics.PaintFlagsDrawFilter;
 import android.graphics.Picture;
 import android.graphics.PixelFormat;
 import android.graphics.Rect;
 import android.graphics.drawable.Drawable;
-import android.hardware.SensorListener;
-import android.hardware.SensorManager;
 import android.net.ConnectivityManager;
 import android.net.NetworkInfo;
 import android.net.Uri;
 import android.net.WebAddress;
-import android.net.http.EventHandler;
 import android.net.http.SslCertificate;
 import android.net.http.SslError;
 import android.os.AsyncTask;
@@ -99,39 +89,26 @@
 import android.view.WindowManager;
 import android.view.ContextMenu.ContextMenuInfo;
 import android.view.MenuItem.OnMenuItemClickListener;
-import android.view.animation.AlphaAnimation;
-import android.view.animation.Animation;
-import android.view.animation.AnimationSet;
-import android.view.animation.DecelerateInterpolator;
-import android.view.animation.ScaleAnimation;
-import android.view.animation.TranslateAnimation;
 import android.webkit.CookieManager;
 import android.webkit.CookieSyncManager;
 import android.webkit.DownloadListener;
-import android.webkit.GeolocationPermissions;
 import android.webkit.HttpAuthHandler;
 import android.webkit.PluginManager;
 import android.webkit.SslErrorHandler;
 import android.webkit.URLUtil;
 import android.webkit.ValueCallback;
 import android.webkit.WebChromeClient;
-import android.webkit.WebChromeClient.CustomViewCallback;
 import android.webkit.WebHistoryItem;
 import android.webkit.WebIconDatabase;
-import android.webkit.WebStorage;
 import android.webkit.WebView;
-import android.webkit.WebViewClient;
 import android.widget.EditText;
 import android.widget.FrameLayout;
 import android.widget.LinearLayout;
 import android.widget.TextView;
 import android.widget.Toast;
 
-import java.io.BufferedOutputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -139,14 +116,9 @@
 import java.net.URLEncoder;
 import java.text.ParseException;
 import java.util.Date;
-import java.util.Enumeration;
 import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.Vector;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipFile;
 
 public class BrowserActivity extends Activity
     implements View.OnCreateContextMenuListener,
@@ -162,8 +134,6 @@
     private IGoogleLoginService mGls = null;
     private ServiceConnection mGlsConnection = null;
 
-    private SensorManager mSensorManager = null;
-
     // These are single-character shortcuts for searching popular sources.
     private static final int SHORTCUT_INVALID = 0;
     private static final int SHORTCUT_GOOGLE_SEARCH = 1;
@@ -171,23 +141,6 @@
     private static final int SHORTCUT_DICTIONARY_SEARCH = 3;
     private static final int SHORTCUT_GOOGLE_MOBILE_LOCAL_SEARCH = 4;
 
-    /* Whitelisted webpages
-    private static HashSet<String> sWhiteList;
-
-    static {
-        sWhiteList = new HashSet<String>();
-        sWhiteList.add("cnn.com/");
-        sWhiteList.add("espn.go.com/");
-        sWhiteList.add("nytimes.com/");
-        sWhiteList.add("engadget.com/");
-        sWhiteList.add("yahoo.com/");
-        sWhiteList.add("msn.com/");
-        sWhiteList.add("amazon.com/");
-        sWhiteList.add("consumerist.com/");
-        sWhiteList.add("google.com/m/news");
-    }
-    */
-
     private void setupHomePage() {
         final Runnable getAccount = new Runnable() {
             public void run() {
@@ -293,7 +246,8 @@
      */
     private FrameLayout mBrowserFrameLayout;
 
-    @Override public void onCreate(Bundle icicle) {
+    @Override
+    public void onCreate(Bundle icicle) {
         if (LOGV_ENABLED) {
             Log.v(LOGTAG, this + " onStart");
         }
@@ -312,16 +266,6 @@
             return;
         }
 
-        //
-        // start MASF proxy service
-        //
-        //Intent proxyServiceIntent = new Intent();
-        //proxyServiceIntent.setComponent
-        //    (new ComponentName(
-        //        "com.android.masfproxyservice",
-        //        "com.android.masfproxyservice.MasfProxyService"));
-        //startService(proxyServiceIntent, null);
-
         mSecLockIcon = Resources.getSystem().getDrawable(
                 android.R.drawable.ic_secure);
         mMixLockIcon = Resources.getSystem().getDrawable(
@@ -436,7 +380,7 @@
             // the tab will be close when exit.
             UrlData urlData = getUrlDataFromIntent(intent);
 
-            final TabControl.Tab t = mTabControl.createNewTab(
+            final Tab t = mTabControl.createNewTab(
                     Intent.ACTION_VIEW.equals(intent.getAction()) &&
                     intent.getData() != null,
                     intent.getStringExtra(Browser.EXTRA_APPLICATION_ID), urlData.mUrl);
@@ -486,7 +430,7 @@
 
     @Override
     protected void onNewIntent(Intent intent) {
-        TabControl.Tab current = mTabControl.getCurrentTab();
+        Tab current = mTabControl.getCurrentTab();
         // When a tab is closed on exit, the current tab index is set to -1.
         // Reset before proceed as Browser requires the current tab to be set.
         if (current == null) {
@@ -529,7 +473,7 @@
             if (Intent.ACTION_VIEW.equals(action)
                     && !getPackageName().equals(appId)
                     && (flags & Intent.FLAG_ACTIVITY_BROUGHT_TO_FRONT) != 0) {
-                TabControl.Tab appTab = mTabControl.getTabFromId(appId);
+                Tab appTab = mTabControl.getTabFromId(appId);
                 if (appTab != null) {
                     Log.i(LOGTAG, "Reusing tab for " + appId);
                     // Dismiss the subwindow if applicable.
@@ -745,100 +689,8 @@
         return inUrl;
     }
 
-    /**
-     * Looking for the pattern like this
-     *
-     *          *
-     *         * *
-     *      ***   *     *******
-     *             *   *
-     *              * *
-     *               *
-     */
-    private final SensorListener mSensorListener = new SensorListener() {
-        private long mLastGestureTime;
-        private float[] mPrev = new float[3];
-        private float[] mPrevDiff = new float[3];
-        private float[] mDiff = new float[3];
-        private float[] mRevertDiff = new float[3];
-
-        public void onSensorChanged(int sensor, float[] values) {
-            boolean show = false;
-            float[] diff = new float[3];
-
-            for (int i = 0; i < 3; i++) {
-                diff[i] = values[i] - mPrev[i];
-                if (Math.abs(diff[i]) > 1) {
-                    show = true;
-                }
-                if ((diff[i] > 1.0 && mDiff[i] < 0.2)
-                        || (diff[i] < -1.0 && mDiff[i] > -0.2)) {
-                    // start track when there is a big move, or revert
-                    mRevertDiff[i] = mDiff[i];
-                    mDiff[i] = 0;
-                } else if (diff[i] > -0.2 && diff[i] < 0.2) {
-                    // reset when it is flat
-                    mDiff[i] = mRevertDiff[i]  = 0;
-                }
-                mDiff[i] += diff[i];
-                mPrevDiff[i] = diff[i];
-                mPrev[i] = values[i];
-            }
-
-            if (false) {
-                // only shows if we think the delta is big enough, in an attempt
-                // to detect "serious" moves left/right or up/down
-                Log.d("BrowserSensorHack", "sensorChanged " + sensor + " ("
-                        + values[0] + ", " + values[1] + ", " + values[2] + ")"
-                        + " diff(" + diff[0] + " " + diff[1] + " " + diff[2]
-                        + ")");
-                Log.d("BrowserSensorHack", "      mDiff(" + mDiff[0] + " "
-                        + mDiff[1] + " " + mDiff[2] + ")" + " mRevertDiff("
-                        + mRevertDiff[0] + " " + mRevertDiff[1] + " "
-                        + mRevertDiff[2] + ")");
-            }
-
-            long now = android.os.SystemClock.uptimeMillis();
-            if (now - mLastGestureTime > 1000) {
-                mLastGestureTime = 0;
-
-                float y = mDiff[1];
-                float z = mDiff[2];
-                float ay = Math.abs(y);
-                float az = Math.abs(z);
-                float ry = mRevertDiff[1];
-                float rz = mRevertDiff[2];
-                float ary = Math.abs(ry);
-                float arz = Math.abs(rz);
-                boolean gestY = ay > 2.5f && ary > 1.0f && ay > ary;
-                boolean gestZ = az > 3.5f && arz > 1.0f && az > arz;
-
-                if ((gestY || gestZ) && !(gestY && gestZ)) {
-                    WebView view = mTabControl.getCurrentWebView();
-
-                    if (view != null) {
-                        if (gestZ) {
-                            if (z < 0) {
-                                view.zoomOut();
-                            } else {
-                                view.zoomIn();
-                            }
-                        } else {
-                            view.flingScroll(0, Math.round(y * 100));
-                        }
-                    }
-                    mLastGestureTime = now;
-                }
-            }
-        }
-
-        public void onAccuracyChanged(int sensor, int accuracy) {
-            // TODO Auto-generated method stub
-
-        }
-    };
-
-    @Override protected void onResume() {
+    @Override
+    protected void onResume() {
         super.onResume();
         if (LOGV_ENABLED) {
             Log.v(LOGTAG, "BrowserActivity.onResume: this=" + this);
@@ -868,18 +720,6 @@
         registerReceiver(mNetworkStateIntentReceiver,
                          mNetworkStateChangedFilter);
         WebView.enablePlatformNotifications();
-
-        if (mSettings.doFlick()) {
-            if (mSensorManager == null) {
-                mSensorManager = (SensorManager) getSystemService(
-                        Context.SENSOR_SERVICE);
-            }
-            mSensorManager.registerListener(mSensorListener,
-                    SensorManager.SENSOR_ACCELEROMETER,
-                    SensorManager.SENSOR_DELAY_FASTEST);
-        } else {
-            mSensorManager = null;
-        }
     }
 
     /**
@@ -1045,6 +885,7 @@
             showFakeTitleBar();
         }
     }
+
     private void hideFakeTitleBar() {
         if (mFakeTitleBar.getParent() == null) return;
         WindowManager.LayoutParams params = (WindowManager.LayoutParams)
@@ -1080,7 +921,8 @@
      *  onSaveInstanceState is called right before onStop(). The map contains
      *  the saved state.
      */
-    @Override protected void onSaveInstanceState(Bundle outState) {
+    @Override
+    protected void onSaveInstanceState(Bundle outState) {
         if (LOGV_ENABLED) {
             Log.v(LOGTAG, "BrowserActivity.onSaveInstanceState: this=" + this);
         }
@@ -1094,7 +936,8 @@
         mTabControl.saveState(outState);
     }
 
-    @Override protected void onPause() {
+    @Override
+    protected void onPause() {
         super.onPause();
 
         if (mActivityInPause) {
@@ -1129,13 +972,10 @@
         // unregister network state listener
         unregisterReceiver(mNetworkStateIntentReceiver);
         WebView.disablePlatformNotifications();
-
-        if (mSensorManager != null) {
-            mSensorManager.unregisterListener(mSensorListener);
-        }
     }
 
-    @Override protected void onDestroy() {
+    @Override
+    protected void onDestroy() {
         if (LOGV_ENABLED) {
             Log.v(LOGTAG, "BrowserActivity.onDestroy: this=" + this);
         }
@@ -1149,7 +989,7 @@
         if (mTabControl == null) return;
 
         // Remove the current tab and sub window
-        TabControl.Tab t = mTabControl.getCurrentTab();
+        Tab t = mTabControl.getCurrentTab();
         if (t != null) {
             dismissSubWindow(t);
             removeTabFromContentView(t);
@@ -1162,16 +1002,6 @@
             mGlsConnection = null;
         }
 
-        //
-        // stop MASF proxy service
-        //
-        //Intent proxyServiceIntent = new Intent();
-        //proxyServiceIntent.setComponent
-        //   (new ComponentName(
-        //        "com.android.masfproxyservice",
-        //        "com.android.masfproxyservice.MasfProxyService"));
-        //stopService(proxyServiceIntent);
-
         unregisterReceiver(mPackageInstallationReceiver);
     }
 
@@ -1217,16 +1047,18 @@
         }
     }
 
-    @Override public void onLowMemory() {
+    @Override
+    public void onLowMemory() {
         super.onLowMemory();
         mTabControl.freeMemory();
     }
 
     private boolean resumeWebViewTimers() {
-        if ((!mActivityInPause && !mPageStarted) ||
-                (mActivityInPause && mPageStarted)) {
+        Tab tab = mTabControl.getCurrentTab();
+        boolean inLoad = tab.inLoad();
+        if ((!mActivityInPause && !inLoad) || (mActivityInPause && inLoad)) {
             CookieSyncManager.getInstance().startSync();
-            WebView w = mTabControl.getCurrentWebView();
+            WebView w = tab.getWebView();
             if (w != null) {
                 w.resumeTimers();
             }
@@ -1237,7 +1069,9 @@
     }
 
     private boolean pauseWebViewTimers() {
-        if (mActivityInPause && !mPageStarted) {
+        Tab tab = mTabControl.getCurrentTab();
+        boolean inLoad = tab.inLoad();
+        if (mActivityInPause && !inLoad) {
             CookieSyncManager.getInstance().stopSync();
             WebView w = mTabControl.getCurrentWebView();
             if (w != null) {
@@ -1326,6 +1160,10 @@
         return mTabControl.getCurrentTopWebView();
     }
 
+    TabControl getTabControl() {
+        return mTabControl;
+    }
+
     @Override
     public boolean onCreateOptionsMenu(Menu menu) {
         super.onCreateOptionsMenu(menu);
@@ -1437,8 +1275,8 @@
      *                 the current one, return false.
      */
     /* package */ boolean switchToTab(int index) {
-        TabControl.Tab tab = mTabControl.getTab(index);
-        TabControl.Tab currentTab = mTabControl.getCurrentTab();
+        Tab tab = mTabControl.getTab(index);
+        Tab currentTab = mTabControl.getCurrentTab();
         if (tab == null || tab == currentTab) {
             return false;
         }
@@ -1454,20 +1292,20 @@
         return true;
     }
 
-    /* package */ TabControl.Tab openTabToHomePage() {
+    /* package */ Tab openTabToHomePage() {
         return openTabAndShow(mSettings.getHomePage(), false, null);
     }
 
     /* package */ void closeCurrentWindow() {
-        final TabControl.Tab current = mTabControl.getCurrentTab();
+        final Tab current = mTabControl.getCurrentTab();
         if (mTabControl.getTabCount() == 1) {
             // This is the last tab.  Open a new one, with the home
             // page and close the current one.
-            TabControl.Tab newTab = openTabToHomePage();
+            openTabToHomePage();
             closeTab(current);
             return;
         }
-        final TabControl.Tab parent = current.getParentTab();
+        final Tab parent = current.getParentTab();
         int indexToShow = -1;
         if (parent != null) {
             indexToShow = mTabControl.getTabIndex(parent);
@@ -1580,7 +1418,7 @@
                 break;
 
             case R.id.homepage_menu_id:
-                TabControl.Tab current = mTabControl.getCurrentTab();
+                Tab current = mTabControl.getCurrentTab();
                 if (current != null) {
                     dismissSubWindow(current);
                     current.getWebView().loadUrl(mSettings.getHomePage());
@@ -1646,7 +1484,7 @@
                     int menuid = item.getItemId();
                     for (int id = 0; id < WINDOW_SHORTCUT_ID_ARRAY.length; id++) {
                         if (WINDOW_SHORTCUT_ID_ARRAY[id] == menuid) {
-                            TabControl.Tab desiredTab = mTabControl.getTab(id);
+                            Tab desiredTab = mTabControl.getTab(id);
                             if (desiredTab != null &&
                                     desiredTab != mTabControl.getCurrentTab()) {
                                 switchToTab(id);
@@ -1671,8 +1509,8 @@
         mMenuState = R.id.MAIN_MENU;
     }
 
-    @Override public boolean onPrepareOptionsMenu(Menu menu)
-    {
+    @Override
+    public boolean onPrepareOptionsMenu(Menu menu) {
         // This happens when the user begins to hold down the menu key, so
         // allow them to chord to get a shortcut.
         mCanChord = true;
@@ -1713,7 +1551,7 @@
                         .setEnabled(canGoForward);
 
                 menu.findItem(R.id.new_tab_menu_id).setEnabled(
-                        mTabControl.getTabCount() < TabControl.MAX_TABS);
+                        mTabControl.canCreateNewTab());
 
                 // decide whether to show the share link option
                 PackageManager pm = getPackageManager();
@@ -1817,7 +1655,7 @@
                 menu.setHeaderView(titleView);
                 // decide whether to show the open link in new tab option
                 menu.findItem(R.id.open_newtab_context_menu_id).setVisible(
-                        mTabControl.getTabCount() < TabControl.MAX_TABS);
+                        mTabControl.canCreateNewTab());
                 PackageManager pm = getPackageManager();
                 Intent send = new Intent(Intent.ACTION_SEND);
                 send.setType("text/plain");
@@ -1845,13 +1683,13 @@
 
     // Attach the given tab to the content view.
     // this should only be called for the current tab.
-    private void attachTabToContentView(TabControl.Tab t) {
+    private void attachTabToContentView(Tab t) {
         // Attach the container that contains the main WebView and any other UI
         // associated with the tab.
         t.attachTabToContentView(mContentView);
 
         if (mShouldShowErrorConsole) {
-            ErrorConsoleView errorConsole = mTabControl.getCurrentErrorConsole(true);
+            ErrorConsoleView errorConsole = t.getErrorConsole(true);
             if (errorConsole.numberOfErrors() == 0) {
                 errorConsole.showConsole(ErrorConsoleView.SHOW_NONE);
             } else {
@@ -1863,14 +1701,6 @@
                                                   ViewGroup.LayoutParams.WRAP_CONTENT));
         }
 
-        setLockIconType(t.getLockIconType());
-        setPrevLockType(t.getPrevLockIconType());
-
-        // this is to match the code in removeTabFromContentView()
-        if (!mPageStarted && t.getTopWindow().getProgress() < 100) {
-            mPageStarted = true;
-        }
-
         WebView view = t.getWebView();
         view.setEmbeddedTitleBar(mTitleBar);
         // Request focus on the top window.
@@ -1878,70 +1708,51 @@
     }
 
     // Attach a sub window to the main WebView of the given tab.
-    private void attachSubWindow(TabControl.Tab t) {
+    void attachSubWindow(Tab t) {
         t.attachSubWindow(mContentView);
         getTopWindow().requestFocus();
     }
 
     // Remove the given tab from the content view.
-    private void removeTabFromContentView(TabControl.Tab t) {
+    private void removeTabFromContentView(Tab t) {
         // Remove the container that contains the main WebView.
         t.removeTabFromContentView(mContentView);
 
-        if (mTabControl.getCurrentErrorConsole(false) != null) {
-            mErrorConsoleContainer.removeView(mTabControl.getCurrentErrorConsole(false));
+        ErrorConsoleView errorConsole = t.getErrorConsole(false);
+        if (errorConsole != null) {
+            mErrorConsoleContainer.removeView(errorConsole);
         }
 
         WebView view = t.getWebView();
         if (view != null) {
             view.setEmbeddedTitleBar(null);
         }
-
-        // unlike attachTabToContentView(), removeTabFromContentView() can be
-        // called for the non-current tab. Need to add the check.
-        if (t == mTabControl.getCurrentTab()) {
-            t.setLockIconType(getLockIconType());
-            t.setPrevLockIconType(getPrevLockType());
-
-            // this is not a perfect solution. But currently there is one
-            // WebViewClient for all the WebView. if user switches from an
-            // in-load window to an already loaded window, mPageStarted will not
-            // be set to false. If user leaves the Browser, pauseWebViewTimers()
-            // won't do anything and leaves the timer running even Browser is in
-            // the background.
-            if (mPageStarted) {
-                mPageStarted = false;
-            }
-        }
     }
 
     // Remove the sub window if it exists. Also called by TabControl when the
     // user clicks the 'X' to dismiss a sub window.
-    /* package */ void dismissSubWindow(TabControl.Tab t) {
+    /* package */ void dismissSubWindow(Tab t) {
         t.removeSubWindow(mContentView);
-        // Tell the TabControl to dismiss the subwindow. This will destroy
-        // the WebView.
-        mTabControl.dismissSubWindow(t);
+        // dismiss the subwindow. This will destroy the WebView.
+        t.dismissSubWindow();
         getTopWindow().requestFocus();
     }
 
     // A wrapper function of {@link #openTabAndShow(UrlData, boolean, String)}
     // that accepts url as string.
-    private TabControl.Tab openTabAndShow(String url, boolean closeOnExit,
-            String appId) {
+    private Tab openTabAndShow(String url, boolean closeOnExit, String appId) {
         return openTabAndShow(new UrlData(url), closeOnExit, appId);
     }
 
     // This method does a ton of stuff. It will attempt to create a new tab
     // if we haven't reached MAX_TABS. Otherwise it uses the current tab. If
     // url isn't null, it will load the given url.
-    /* package */ TabControl.Tab openTabAndShow(UrlData urlData,
-            boolean closeOnExit, String appId) {
-        final boolean newTab = mTabControl.getTabCount() != TabControl.MAX_TABS;
-        final TabControl.Tab currentTab = mTabControl.getCurrentTab();
-        if (newTab) {
-            final TabControl.Tab tab = mTabControl.createNewTab(
-                    closeOnExit, appId, urlData.mUrl);
+    /* package */Tab openTabAndShow(UrlData urlData, boolean closeOnExit,
+            String appId) {
+        final Tab currentTab = mTabControl.getCurrentTab();
+        if (mTabControl.canCreateNewTab()) {
+            final Tab tab = mTabControl.createNewTab(closeOnExit, appId,
+                    urlData.mUrl);
             WebView webview = tab.getWebView();
             // If the last tab was removed from the active tabs page, currentTab
             // will be null.
@@ -1967,9 +1778,9 @@
         return currentTab;
     }
 
-    private TabControl.Tab openTab(String url) {
+    private Tab openTab(String url) {
         if (mSettings.openInBackground()) {
-            TabControl.Tab t = mTabControl.createNewTab();
+            Tab t = mTabControl.createNewTab();
             if (t != null) {
                 WebView view = t.getWebView();
                 view.loadUrl(url);
@@ -2026,7 +1837,8 @@
      * call resetTitleAndRevertLockIcon.
      */
     /* package */ void resetTitleAndRevertLockIcon() {
-        revertLockIcon();
+        mTabControl.getCurrentTab().revertLockIcon();
+        updateLockIconToLatest();
         resetTitleIconAndProgress();
     }
 
@@ -2040,7 +1852,7 @@
         }
         resetTitleAndIcon(current);
         int progress = current.getProgress();
-        mWebChromeClient.onProgressChanged(current, progress);
+        current.getWebChromeClient().onProgressChanged(current, progress);
     }
 
     // Reset the title and the icon based on the given item.
@@ -2060,7 +1872,7 @@
      * @param url The URL of the site being loaded.
      * @param title The title of the site being loaded.
      */
-    private void setUrlTitle(String url, String title) {
+    void setUrlTitle(String url, String title) {
         mUrl = url;
         mTitle = title;
 
@@ -2106,41 +1918,16 @@
     }
 
     // Set the favicon in the title bar.
-    private void setFavicon(Bitmap icon) {
+    void setFavicon(Bitmap icon) {
         mTitleBar.setFavicon(icon);
         mFakeTitleBar.setFavicon(icon);
     }
 
     /**
-     * Saves the current lock-icon state before resetting
-     * the lock icon. If we have an error, we may need to
-     * roll back to the previous state.
-     */
-    private void saveLockIcon() {
-        mPrevLockType = mLockIconType;
-    }
-
-    /**
-     * Reverts the lock-icon state to the last saved state,
-     * for example, if we had an error, and need to cancel
-     * the load.
-     */
-    private void revertLockIcon() {
-        mLockIconType = mPrevLockType;
-
-        if (LOGV_ENABLED) {
-            Log.v(LOGTAG, "BrowserActivity.revertLockIcon:" +
-                  " revert lock icon to " + mLockIconType);
-        }
-
-        updateLockIconToLatest();
-    }
-
-    /**
      * Close the tab, remove its associated title bar, and adjust mTabControl's
      * current tab to a valid value.
      */
-    /* package */ void closeTab(TabControl.Tab t) {
+    /* package */ void closeTab(Tab t) {
         int currentIndex = mTabControl.getCurrentIndex();
         int removeIndex = mTabControl.getTabIndex(t);
         mTabControl.removeTab(t);
@@ -2152,7 +1939,7 @@
     }
 
     private void goBackOnePageOrQuit() {
-        TabControl.Tab current = mTabControl.getCurrentTab();
+        Tab current = mTabControl.getCurrentTab();
         if (current == null) {
             /*
              * Instead of finishing the activity, simply push this to the back
@@ -2170,17 +1957,17 @@
         } else {
             // Check to see if we are closing a window that was created by
             // another window. If so, we switch back to that window.
-            TabControl.Tab parent = current.getParentTab();
+            Tab parent = current.getParentTab();
             if (parent != null) {
                 switchToTab(mTabControl.getTabIndex(parent));
                 // Now we close the other tab
                 closeTab(current);
             } else {
                 if (current.closeOnExit()) {
-                    // force mPageStarted to be false as we are going to either
-                    // finish the activity or remove the tab. This will ensure
-                    // pauseWebView() taking action.
-                    mPageStarted = false;
+                    // force the tab's inLoad() to be false as we are going to
+                    // either finish the activity or remove the tab. This will
+                    // ensure pauseWebViewTimers() taking action.
+                    mTabControl.getCurrentTab().clearInLoad();
                     if (mTabControl.getTabCount() == 1) {
                         finish();
                         return;
@@ -2213,6 +2000,10 @@
         }
     }
 
+    boolean isMenuDown() {
+        return mMenuIsDown;
+    }
+
     @Override
     public boolean onKeyDown(int keyCode, KeyEvent event) {
         // The default key mode is DEFAULT_KEYS_SEARCH_LOCAL. As the MENU is
@@ -2258,7 +2049,8 @@
                 if (event.isTracking() && !event.isCanceled()) {
                     if (mCustomView != null) {
                         // if a custom view is showing, hide it
-                        mWebChromeClient.onHideCustomView();
+                        mTabControl.getCurrentWebView().getWebChromeClient()
+                                .onHideCustomView();
                     } else if (mActiveTabsPage != null) {
                         // if tab page is showing, hide it
                         removeActiveTabPage(true);
@@ -2286,7 +2078,12 @@
         resetTitleAndRevertLockIcon();
         WebView w = getTopWindow();
         w.stopLoading();
-        mWebViewClient.onPageFinished(w, w.getUrl());
+        // FIXME: before refactor, it is using mWebViewClient. So I keep the
+        // same logic here. But for subwindow case, should we call into the main
+        // WebView's onPageFinished as we never call its onPageStarted and if
+        // the page finishes itself, we don't call onPageFinished.
+        mTabControl.getCurrentWebView().getWebViewClient().onPageFinished(w,
+                w.getUrl());
 
         cancelStopToast();
         mStopToast = Toast
@@ -2294,6 +2091,10 @@
         mStopToast.show();
     }
 
+    boolean didUserStopLoading() {
+        return mDidStopLoad;
+    }
+
     private void cancelStopToast() {
         if (mStopToast != null) {
             mStopToast.cancel();
@@ -2301,9 +2102,16 @@
         }
     }
 
-    // called by a non-UI thread to post the message
-    public void postMessage(int what, int arg1, int arg2, Object obj) {
-        mHandler.sendMessage(mHandler.obtainMessage(what, arg1, arg2, obj));
+    // called by a UI or non-UI thread to post the message
+    public void postMessage(int what, int arg1, int arg2, Object obj,
+            long delayMillis) {
+        mHandler.sendMessageDelayed(mHandler.obtainMessage(what, arg1, arg2,
+                obj), delayMillis);
+    }
+
+    // called by a UI or non-UI thread to remove the message
+    void removeMessages(int what, Object object) {
+        mHandler.removeMessages(what, object);
     }
 
     // public message ids
@@ -2315,7 +2123,7 @@
     private static final int CANCEL_CREDS_REQUEST    = 103;
     private static final int RELEASE_WAKELOCK        = 107;
 
-    private static final int UPDATE_BOOKMARK_THUMBNAIL = 108;
+    static final int UPDATE_BOOKMARK_THUMBNAIL       = 108;
 
     // Private handler for handling javascript and saving passwords
     private Handler mHandler = new Handler() {
@@ -2340,9 +2148,8 @@
                             loadURL(getTopWindow(), url);
                             break;
                         case R.id.open_newtab_context_menu_id:
-                            final TabControl.Tab parent = mTabControl
-                                    .getCurrentTab();
-                            final TabControl.Tab newTab = openTab(url);
+                            final Tab parent = mTabControl.getCurrentTab();
+                            final Tab newTab = openTab(url);
                             if (newTab != parent) {
                                 parent.addChildTab(newTab);
                             }
@@ -2491,7 +2298,7 @@
     }
 
     // -------------------------------------------------------------------------
-    // WebViewClient implementation.
+    // Helper function for WebViewClient.
     //-------------------------------------------------------------------------
 
     // Use in overrideUrlLoading
@@ -2500,1036 +2307,306 @@
     /* package */ final static String SCHEME_WTAI_SD = "wtai://wp/sd;";
     /* package */ final static String SCHEME_WTAI_AP = "wtai://wp/ap;";
 
-    /* package */ WebViewClient getWebViewClient() {
-        return mWebViewClient;
-    }
+    void onPageStarted(WebView view, String url, Bitmap favicon) {
+        // when BrowserActivity just starts, onPageStarted may be called before
+        // onResume as it is triggered from onCreate. Call resumeWebViewTimers
+        // to start the timer. As we won't switch tabs while an activity is in
+        // pause state, we can ensure calling resume and pause in pair.
+        if (mActivityInPause) resumeWebViewTimers();
 
-    private void updateIcon(WebView view, Bitmap icon) {
-        if (icon != null) {
-            BrowserBookmarksAdapter.updateBookmarkFavicon(mResolver,
-                    view.getOriginalUrl(), view.getUrl(), icon);
-        }
-        setFavicon(icon);
-    }
+        resetLockIcon(url);
+        setUrlTitle(url, null);
+        setFavicon(favicon);
+        mInLoad = true;
+        mDidStopLoad = false;
+        showFakeTitleBar();
+        updateInLoadMenuItems();
+        if (!mIsNetworkUp) createAndShowNetworkDialog();
 
-    private void updateIcon(String url, Bitmap icon) {
-        if (icon != null) {
-            BrowserBookmarksAdapter.updateBookmarkFavicon(mResolver,
-                    null, url, icon);
-        }
-        setFavicon(icon);
-    }
-
-    private final WebViewClient mWebViewClient = new WebViewClient() {
-        @Override
-        public void onPageStarted(WebView view, String url, Bitmap favicon) {
-            resetLockIcon(url);
-            setUrlTitle(url, null);
-
-            // We've started to load a new page. If there was a pending message
-            // to save a screenshot then we will now take the new page and
-            // save an incorrect screenshot. Therefore, remove any pending
-            // thumbnail messages from the queue.
-            mHandler.removeMessages(UPDATE_BOOKMARK_THUMBNAIL);
-
-            // If we start a touch icon load and then load a new page, we don't
-            // want to cancel the current touch icon loader. But, we do want to
-            // create a new one when the touch icon url is known.
-            if (mTouchIconLoader != null) {
-                mTouchIconLoader.mActivity = null;
-                mTouchIconLoader = null;
-            }
-
-            ErrorConsoleView errorConsole = mTabControl.getCurrentErrorConsole(false);
-            if (errorConsole != null) {
-                errorConsole.clearErrorMessages();
-                if (mShouldShowErrorConsole) {
-                    errorConsole.showConsole(ErrorConsoleView.SHOW_NONE);
-                }
-            }
-
-            // Call updateIcon instead of setFavicon so the bookmark
-            // database can be updated.
-            updateIcon(url, favicon);
-
-            if (mSettings.isTracing()) {
-                String host;
-                try {
-                    WebAddress uri = new WebAddress(url);
-                    host = uri.mHost;
-                } catch (android.net.ParseException ex) {
-                    host = "browser";
-                }
-                host = host.replace('.', '_');
-                host += ".trace";
-                mInTrace = true;
-                Debug.startMethodTracing(host, 20 * 1024 * 1024);
-            }
-
-            // Performance probe
-            if (false) {
-                mStart = SystemClock.uptimeMillis();
-                mProcessStart = Process.getElapsedCpuTime();
-                long[] sysCpu = new long[7];
-                if (Process.readProcFile("/proc/stat", SYSTEM_CPU_FORMAT, null,
-                        sysCpu, null)) {
-                    mUserStart = sysCpu[0] + sysCpu[1];
-                    mSystemStart = sysCpu[2];
-                    mIdleStart = sysCpu[3];
-                    mIrqStart = sysCpu[4] + sysCpu[5] + sysCpu[6];
-                }
-                mUiStart = SystemClock.currentThreadTimeMillis();
-            }
-
-            if (!mPageStarted) {
-                mPageStarted = true;
-                // if onResume() has been called, resumeWebViewTimers() does
-                // nothing.
-                resumeWebViewTimers();
-            }
-
-            // reset sync timer to avoid sync starts during loading a page
-            CookieSyncManager.getInstance().resetSync();
-
-            mInLoad = true;
-            mDidStopLoad = false;
-            showFakeTitleBar();
-            updateInLoadMenuItems();
-            if (!mIsNetworkUp) {
-                createAndShowNetworkDialog();
-                if (view != null) {
-                    view.setNetworkAvailable(false);
-                }
-            }
-        }
-
-        @Override
-        public void onPageFinished(WebView view, String url) {
-            // Reset the title and icon in case we stopped a provisional
-            // load.
-            resetTitleAndIcon(view);
-
-            if (!mDidStopLoad) {
-                // Only update the bookmark screenshot if the user did not
-                // cancel the load early.
-                Message updateScreenshot = Message.obtain(mHandler, UPDATE_BOOKMARK_THUMBNAIL, view);
-                mHandler.sendMessageDelayed(updateScreenshot, 500);
-            }
-
-            // Update the lock icon image only once we are done loading
-            updateLockIconToLatest();
-
-            // Performance probe
-            if (false) {
-                long[] sysCpu = new long[7];
-                if (Process.readProcFile("/proc/stat", SYSTEM_CPU_FORMAT, null,
-                        sysCpu, null)) {
-                    String uiInfo = "UI thread used "
-                            + (SystemClock.currentThreadTimeMillis() - mUiStart)
-                            + " ms";
-                    if (LOGD_ENABLED) {
-                        Log.d(LOGTAG, uiInfo);
-                    }
-                    //The string that gets written to the log
-                    String performanceString = "It took total "
-                            + (SystemClock.uptimeMillis() - mStart)
-                            + " ms clock time to load the page."
-                            + "\nbrowser process used "
-                            + (Process.getElapsedCpuTime() - mProcessStart)
-                            + " ms, user processes used "
-                            + (sysCpu[0] + sysCpu[1] - mUserStart) * 10
-                            + " ms, kernel used "
-                            + (sysCpu[2] - mSystemStart) * 10
-                            + " ms, idle took " + (sysCpu[3] - mIdleStart) * 10
-                            + " ms and irq took "
-                            + (sysCpu[4] + sysCpu[5] + sysCpu[6] - mIrqStart)
-                            * 10 + " ms, " + uiInfo;
-                    if (LOGD_ENABLED) {
-                        Log.d(LOGTAG, performanceString + "\nWebpage: " + url);
-                    }
-                    if (url != null) {
-                        // strip the url to maintain consistency
-                        String newUrl = new String(url);
-                        if (newUrl.startsWith("http://www.")) {
-                            newUrl = newUrl.substring(11);
-                        } else if (newUrl.startsWith("http://")) {
-                            newUrl = newUrl.substring(7);
-                        } else if (newUrl.startsWith("https://www.")) {
-                            newUrl = newUrl.substring(12);
-                        } else if (newUrl.startsWith("https://")) {
-                            newUrl = newUrl.substring(8);
-                        }
-                        if (LOGD_ENABLED) {
-                            Log.d(LOGTAG, newUrl + " loaded");
-                        }
-                        /*
-                        if (sWhiteList.contains(newUrl)) {
-                            // The string that gets pushed to the statistcs
-                            // service
-                            performanceString = performanceString
-                                    + "\nWebpage: "
-                                    + newUrl
-                                    + "\nCarrier: "
-                                    + android.os.SystemProperties
-                                            .get("gsm.sim.operator.alpha");
-                            if (mWebView != null
-                                    && mWebView.getContext() != null
-                                    && mWebView.getContext().getSystemService(
-                                    Context.CONNECTIVITY_SERVICE) != null) {
-                                ConnectivityManager cManager =
-                                        (ConnectivityManager) mWebView
-                                        .getContext().getSystemService(
-                                        Context.CONNECTIVITY_SERVICE);
-                                NetworkInfo nInfo = cManager
-                                        .getActiveNetworkInfo();
-                                if (nInfo != null) {
-                                    performanceString = performanceString
-                                            + "\nNetwork Type: "
-                                            + nInfo.getType().toString();
-                                }
-                            }
-                            Checkin.logEvent(mResolver,
-                                    Checkin.Events.Tag.WEBPAGE_LOAD,
-                                    performanceString);
-                            Log.w(LOGTAG, "pushed to the statistics service");
-                        }
-                        */
-                    }
-                }
-             }
-
-            if (mInTrace) {
-                mInTrace = false;
-                Debug.stopMethodTracing();
-            }
-
-            if (mPageStarted) {
-                mPageStarted = false;
-                // pauseWebViewTimers() will do nothing and return false if
-                // onPause() is not called yet.
-                if (pauseWebViewTimers()) {
-                    if (mWakeLock.isHeld()) {
-                        mHandler.removeMessages(RELEASE_WAKELOCK);
-                        mWakeLock.release();
-                    }
-                }
-            }
-        }
-
-        // return true if want to hijack the url to let another app to handle it
-        @Override
-        public boolean shouldOverrideUrlLoading(WebView view, String url) {
-            if (url.startsWith(SCHEME_WTAI)) {
-                // wtai://wp/mc;number
-                // number=string(phone-number)
-                if (url.startsWith(SCHEME_WTAI_MC)) {
-                    Intent intent = new Intent(Intent.ACTION_VIEW,
-                            Uri.parse(WebView.SCHEME_TEL +
-                            url.substring(SCHEME_WTAI_MC.length())));
-                    startActivity(intent);
-                    return true;
-                }
-                // wtai://wp/sd;dtmf
-                // dtmf=string(dialstring)
-                if (url.startsWith(SCHEME_WTAI_SD)) {
-                    // TODO
-                    // only send when there is active voice connection
-                    return false;
-                }
-                // wtai://wp/ap;number;name
-                // number=string(phone-number)
-                // name=string
-                if (url.startsWith(SCHEME_WTAI_AP)) {
-                    // TODO
-                    return false;
-                }
-            }
-
-            // The "about:" schemes are internal to the browser; don't
-            // want these to be dispatched to other apps.
-            if (url.startsWith("about:")) {
-                return false;
-            }
-
-            Intent intent;
-
-            // perform generic parsing of the URI to turn it into an Intent.
+        if (mSettings.isTracing()) {
+            String host;
             try {
-                intent = Intent.parseUri(url, Intent.URI_INTENT_SCHEME);
-            } catch (URISyntaxException ex) {
-                Log.w("Browser", "Bad URI " + url + ": " + ex.getMessage());
-                return false;
+                WebAddress uri = new WebAddress(url);
+                host = uri.mHost;
+            } catch (android.net.ParseException ex) {
+                host = "browser";
             }
+            host = host.replace('.', '_');
+            host += ".trace";
+            mInTrace = true;
+            Debug.startMethodTracing(host, 20 * 1024 * 1024);
+        }
 
-            // check whether the intent can be resolved. If not, we will see
-            // whether we can download it from the Market.
-            if (getPackageManager().resolveActivity(intent, 0) == null) {
-                String packagename = intent.getPackage();
-                if (packagename != null) {
-                    intent = new Intent(Intent.ACTION_VIEW, Uri
-                            .parse("market://search?q=pname:" + packagename));
-                    intent.addCategory(Intent.CATEGORY_BROWSABLE);
-                    startActivity(intent);
-                    return true;
-                } else {
-                    return false;
+        // Performance probe
+        if (false) {
+            mStart = SystemClock.uptimeMillis();
+            mProcessStart = Process.getElapsedCpuTime();
+            long[] sysCpu = new long[7];
+            if (Process.readProcFile("/proc/stat", SYSTEM_CPU_FORMAT, null,
+                    sysCpu, null)) {
+                mUserStart = sysCpu[0] + sysCpu[1];
+                mSystemStart = sysCpu[2];
+                mIdleStart = sysCpu[3];
+                mIrqStart = sysCpu[4] + sysCpu[5] + sysCpu[6];
+            }
+            mUiStart = SystemClock.currentThreadTimeMillis();
+        }
+    }
+
+    void onPageFinished(WebView view, String url) {
+        // Reset the title and icon in case we stopped a provisional load.
+        resetTitleAndIcon(view);
+        // Update the lock icon image only once we are done loading
+        updateLockIconToLatest();
+        // pause the WebView timer and release the wake lock if it is finished
+        // while BrowserActivity is in pause state.
+        if (mActivityInPause && pauseWebViewTimers()) {
+            if (mWakeLock.isHeld()) {
+                mHandler.removeMessages(RELEASE_WAKELOCK);
+                mWakeLock.release();
+            }
+        }
+
+        // Performance probe
+        if (false) {
+            long[] sysCpu = new long[7];
+            if (Process.readProcFile("/proc/stat", SYSTEM_CPU_FORMAT, null,
+                    sysCpu, null)) {
+                String uiInfo = "UI thread used "
+                        + (SystemClock.currentThreadTimeMillis() - mUiStart)
+                        + " ms";
+                if (LOGD_ENABLED) {
+                    Log.d(LOGTAG, uiInfo);
+                }
+                //The string that gets written to the log
+                String performanceString = "It took total "
+                        + (SystemClock.uptimeMillis() - mStart)
+                        + " ms clock time to load the page."
+                        + "\nbrowser process used "
+                        + (Process.getElapsedCpuTime() - mProcessStart)
+                        + " ms, user processes used "
+                        + (sysCpu[0] + sysCpu[1] - mUserStart) * 10
+                        + " ms, kernel used "
+                        + (sysCpu[2] - mSystemStart) * 10
+                        + " ms, idle took " + (sysCpu[3] - mIdleStart) * 10
+                        + " ms and irq took "
+                        + (sysCpu[4] + sysCpu[5] + sysCpu[6] - mIrqStart)
+                        * 10 + " ms, " + uiInfo;
+                if (LOGD_ENABLED) {
+                    Log.d(LOGTAG, performanceString + "\nWebpage: " + url);
+                }
+                if (url != null) {
+                    // strip the url to maintain consistency
+                    String newUrl = new String(url);
+                    if (newUrl.startsWith("http://www.")) {
+                        newUrl = newUrl.substring(11);
+                    } else if (newUrl.startsWith("http://")) {
+                        newUrl = newUrl.substring(7);
+                    } else if (newUrl.startsWith("https://www.")) {
+                        newUrl = newUrl.substring(12);
+                    } else if (newUrl.startsWith("https://")) {
+                        newUrl = newUrl.substring(8);
+                    }
+                    if (LOGD_ENABLED) {
+                        Log.d(LOGTAG, newUrl + " loaded");
+                    }
                 }
             }
+         }
 
-            // sanitize the Intent, ensuring web pages can not bypass browser
-            // security (only access to BROWSABLE activities).
-            intent.addCategory(Intent.CATEGORY_BROWSABLE);
-            intent.setComponent(null);
-            try {
-                if (startActivityIfNeeded(intent, -1)) {
-                    return true;
-                }
-            } catch (ActivityNotFoundException ex) {
-                // ignore the error. If no application can handle the URL,
-                // eg about:blank, assume the browser can handle it.
-            }
+        if (mInTrace) {
+            mInTrace = false;
+            Debug.stopMethodTracing();
+        }
+    }
 
-            if (mMenuIsDown) {
-                openTab(url);
-                closeOptionsMenu();
+    boolean shouldOverrideUrlLoading(WebView view, String url) {
+        if (url.startsWith(SCHEME_WTAI)) {
+            // wtai://wp/mc;number
+            // number=string(phone-number)
+            if (url.startsWith(SCHEME_WTAI_MC)) {
+                Intent intent = new Intent(Intent.ACTION_VIEW,
+                        Uri.parse(WebView.SCHEME_TEL +
+                        url.substring(SCHEME_WTAI_MC.length())));
+                startActivity(intent);
                 return true;
             }
+            // wtai://wp/sd;dtmf
+            // dtmf=string(dialstring)
+            if (url.startsWith(SCHEME_WTAI_SD)) {
+                // TODO: only send when there is active voice connection
+                return false;
+            }
+            // wtai://wp/ap;number;name
+            // number=string(phone-number)
+            // name=string
+            if (url.startsWith(SCHEME_WTAI_AP)) {
+                // TODO
+                return false;
+            }
+        }
 
+        // The "about:" schemes are internal to the browser; don't want these to
+        // be dispatched to other apps.
+        if (url.startsWith("about:")) {
             return false;
         }
 
-        /**
-         * Updates the lock icon. This method is called when we discover another
-         * resource to be loaded for this page (for example, javascript). While
-         * we update the icon type, we do not update the lock icon itself until
-         * we are done loading, it is slightly more secure this way.
-         */
-        @Override
-        public void onLoadResource(WebView view, String url) {
-            if (url != null && url.length() > 0) {
-                // It is only if the page claims to be secure
-                // that we may have to update the lock:
-                if (mLockIconType == LOCK_ICON_SECURE) {
-                    // If NOT a 'safe' url, change the lock to mixed content!
-                    if (!(URLUtil.isHttpsUrl(url) || URLUtil.isDataUrl(url) || URLUtil.isAboutUrl(url))) {
-                        mLockIconType = LOCK_ICON_MIXED;
-                        if (LOGV_ENABLED) {
-                            Log.v(LOGTAG, "BrowserActivity.updateLockIcon:" +
-                                  " updated lock icon to " + mLockIconType + " due to " + url);
-                        }
-                    }
-                }
-            }
+        Intent intent;
+        // perform generic parsing of the URI to turn it into an Intent.
+        try {
+            intent = Intent.parseUri(url, Intent.URI_INTENT_SCHEME);
+        } catch (URISyntaxException ex) {
+            Log.w("Browser", "Bad URI " + url + ": " + ex.getMessage());
+            return false;
         }
 
-        /**
-         * Show the dialog, asking the user if they would like to continue after
-         * an excessive number of HTTP redirects.
-         */
-        @Override
-        public void onTooManyRedirects(WebView view, final Message cancelMsg,
-                final Message continueMsg) {
-            new AlertDialog.Builder(BrowserActivity.this)
-                .setTitle(R.string.browserFrameRedirect)
-                .setMessage(R.string.browserFrame307Post)
-                .setPositiveButton(R.string.ok, new DialogInterface.OnClickListener() {
-                    public void onClick(DialogInterface dialog, int which) {
-                        continueMsg.sendToTarget();
-                    }})
-                .setNegativeButton(R.string.cancel, new DialogInterface.OnClickListener() {
-                    public void onClick(DialogInterface dialog, int which) {
-                        cancelMsg.sendToTarget();
-                    }})
-                .setOnCancelListener(new OnCancelListener() {
-                    public void onCancel(DialogInterface dialog) {
-                        cancelMsg.sendToTarget();
-                    }})
-                .show();
-        }
-
-        // Container class for the next error dialog that needs to be
-        // displayed.
-        class ErrorDialog {
-            public final int mTitle;
-            public final String mDescription;
-            public final int mError;
-            ErrorDialog(int title, String desc, int error) {
-                mTitle = title;
-                mDescription = desc;
-                mError = error;
-            }
-        };
-
-        private void processNextError() {
-            if (mQueuedErrors == null) {
-                return;
-            }
-            // The first one is currently displayed so just remove it.
-            mQueuedErrors.removeFirst();
-            if (mQueuedErrors.size() == 0) {
-                mQueuedErrors = null;
-                return;
-            }
-            showError(mQueuedErrors.getFirst());
-        }
-
-        private DialogInterface.OnDismissListener mDialogListener =
-                new DialogInterface.OnDismissListener() {
-                    public void onDismiss(DialogInterface d) {
-                        processNextError();
-                    }
-                };
-        private LinkedList<ErrorDialog> mQueuedErrors;
-
-        private void queueError(int err, String desc) {
-            if (mQueuedErrors == null) {
-                mQueuedErrors = new LinkedList<ErrorDialog>();
-            }
-            for (ErrorDialog d : mQueuedErrors) {
-                if (d.mError == err) {
-                    // Already saw a similar error, ignore the new one.
-                    return;
-                }
-            }
-            ErrorDialog errDialog = new ErrorDialog(
-                    err == WebViewClient.ERROR_FILE_NOT_FOUND ?
-                    R.string.browserFrameFileErrorLabel :
-                    R.string.browserFrameNetworkErrorLabel,
-                    desc, err);
-            mQueuedErrors.addLast(errDialog);
-
-            // Show the dialog now if the queue was empty.
-            if (mQueuedErrors.size() == 1) {
-                showError(errDialog);
-            }
-        }
-
-        private void showError(ErrorDialog errDialog) {
-            AlertDialog d = new AlertDialog.Builder(BrowserActivity.this)
-                    .setTitle(errDialog.mTitle)
-                    .setMessage(errDialog.mDescription)
-                    .setPositiveButton(R.string.ok, null)
-                    .create();
-            d.setOnDismissListener(mDialogListener);
-            d.show();
-        }
-
-        /**
-         * Show a dialog informing the user of the network error reported by
-         * WebCore.
-         */
-        @Override
-        public void onReceivedError(WebView view, int errorCode,
-                String description, String failingUrl) {
-            if (errorCode != WebViewClient.ERROR_HOST_LOOKUP &&
-                    errorCode != WebViewClient.ERROR_CONNECT &&
-                    errorCode != WebViewClient.ERROR_BAD_URL &&
-                    errorCode != WebViewClient.ERROR_UNSUPPORTED_SCHEME &&
-                    errorCode != WebViewClient.ERROR_FILE) {
-                queueError(errorCode, description);
-            }
-            Log.e(LOGTAG, "onReceivedError " + errorCode + " " + failingUrl
-                    + " " + description);
-
-            // We need to reset the title after an error.
-            resetTitleAndRevertLockIcon();
-        }
-
-        /**
-         * Check with the user if it is ok to resend POST data as the page they
-         * are trying to navigate to is the result of a POST.
-         */
-        @Override
-        public void onFormResubmission(WebView view, final Message dontResend,
-                                       final Message resend) {
-            new AlertDialog.Builder(BrowserActivity.this)
-                .setTitle(R.string.browserFrameFormResubmitLabel)
-                .setMessage(R.string.browserFrameFormResubmitMessage)
-                .setPositiveButton(R.string.ok, new DialogInterface.OnClickListener() {
-                    public void onClick(DialogInterface dialog, int which) {
-                        resend.sendToTarget();
-                    }})
-                .setNegativeButton(R.string.cancel, new DialogInterface.OnClickListener() {
-                    public void onClick(DialogInterface dialog, int which) {
-                        dontResend.sendToTarget();
-                    }})
-                .setOnCancelListener(new OnCancelListener() {
-                    public void onCancel(DialogInterface dialog) {
-                        dontResend.sendToTarget();
-                    }})
-                .show();
-        }
-
-        /**
-         * Insert the url into the visited history database.
-         * @param url The url to be inserted.
-         * @param isReload True if this url is being reloaded.
-         * FIXME: Not sure what to do when reloading the page.
-         */
-        @Override
-        public void doUpdateVisitedHistory(WebView view, String url,
-                boolean isReload) {
-            if (url.regionMatches(true, 0, "about:", 0, 6)) {
-                return;
-            }
-            // remove "client" before updating it to the history so that it wont
-            // show up in the auto-complete list.
-            int index = url.indexOf("client=ms-");
-            if (index > 0 && url.contains(".google.")) {
-                int end = url.indexOf('&', index);
-                if (end > 0) {
-                    url = url.substring(0, index)
-                            .concat(url.substring(end + 1));
-                } else {
-                    // the url.charAt(index-1) should be either '?' or '&'
-                    url = url.substring(0, index-1);
-                }
-            }
-            Browser.updateVisitedHistory(mResolver, url, true);
-            WebIconDatabase.getInstance().retainIconForPageUrl(url);
-        }
-
-        /**
-         * Displays SSL error(s) dialog to the user.
-         */
-        @Override
-        public void onReceivedSslError(
-            final WebView view, final SslErrorHandler handler, final SslError error) {
-
-            if (mSettings.showSecurityWarnings()) {
-                final LayoutInflater factory =
-                    LayoutInflater.from(BrowserActivity.this);
-                final View warningsView =
-                    factory.inflate(R.layout.ssl_warnings, null);
-                final LinearLayout placeholder =
-                    (LinearLayout)warningsView.findViewById(R.id.placeholder);
-
-                if (error.hasError(SslError.SSL_UNTRUSTED)) {
-                    LinearLayout ll = (LinearLayout)factory
-                        .inflate(R.layout.ssl_warning, null);
-                    ((TextView)ll.findViewById(R.id.warning))
-                        .setText(R.string.ssl_untrusted);
-                    placeholder.addView(ll);
-                }
-
-                if (error.hasError(SslError.SSL_IDMISMATCH)) {
-                    LinearLayout ll = (LinearLayout)factory
-                        .inflate(R.layout.ssl_warning, null);
-                    ((TextView)ll.findViewById(R.id.warning))
-                        .setText(R.string.ssl_mismatch);
-                    placeholder.addView(ll);
-                }
-
-                if (error.hasError(SslError.SSL_EXPIRED)) {
-                    LinearLayout ll = (LinearLayout)factory
-                        .inflate(R.layout.ssl_warning, null);
-                    ((TextView)ll.findViewById(R.id.warning))
-                        .setText(R.string.ssl_expired);
-                    placeholder.addView(ll);
-                }
-
-                if (error.hasError(SslError.SSL_NOTYETVALID)) {
-                    LinearLayout ll = (LinearLayout)factory
-                        .inflate(R.layout.ssl_warning, null);
-                    ((TextView)ll.findViewById(R.id.warning))
-                        .setText(R.string.ssl_not_yet_valid);
-                    placeholder.addView(ll);
-                }
-
-                new AlertDialog.Builder(BrowserActivity.this)
-                    .setTitle(R.string.security_warning)
-                    .setIcon(android.R.drawable.ic_dialog_alert)
-                    .setView(warningsView)
-                    .setPositiveButton(R.string.ssl_continue,
-                            new DialogInterface.OnClickListener() {
-                                public void onClick(DialogInterface dialog, int whichButton) {
-                                    handler.proceed();
-                                }
-                            })
-                    .setNeutralButton(R.string.view_certificate,
-                            new DialogInterface.OnClickListener() {
-                                public void onClick(DialogInterface dialog, int whichButton) {
-                                    showSSLCertificateOnError(view, handler, error);
-                                }
-                            })
-                    .setNegativeButton(R.string.cancel,
-                            new DialogInterface.OnClickListener() {
-                                public void onClick(DialogInterface dialog, int whichButton) {
-                                    handler.cancel();
-                                    BrowserActivity.this.resetTitleAndRevertLockIcon();
-                                }
-                            })
-                    .setOnCancelListener(
-                            new DialogInterface.OnCancelListener() {
-                                public void onCancel(DialogInterface dialog) {
-                                    handler.cancel();
-                                    BrowserActivity.this.resetTitleAndRevertLockIcon();
-                                }
-                            })
-                    .show();
-            } else {
-                handler.proceed();
-            }
-        }
-
-        /**
-         * Handles an HTTP authentication request.
-         *
-         * @param handler The authentication handler
-         * @param host The host
-         * @param realm The realm
-         */
-        @Override
-        public void onReceivedHttpAuthRequest(WebView view,
-                final HttpAuthHandler handler, final String host, final String realm) {
-            String username = null;
-            String password = null;
-
-            boolean reuseHttpAuthUsernamePassword =
-                handler.useHttpAuthUsernamePassword();
-
-            if (reuseHttpAuthUsernamePassword &&
-                    (mTabControl.getCurrentWebView() != null)) {
-                String[] credentials =
-                        mTabControl.getCurrentWebView()
-                                .getHttpAuthUsernamePassword(host, realm);
-                if (credentials != null && credentials.length == 2) {
-                    username = credentials[0];
-                    password = credentials[1];
-                }
-            }
-
-            if (username != null && password != null) {
-                handler.proceed(username, password);
-            } else {
-                showHttpAuthentication(handler, host, realm, null, null, null, 0);
-            }
-        }
-
-        @Override
-        public boolean shouldOverrideKeyEvent(WebView view, KeyEvent event) {
-            if (mMenuIsDown) {
-                // only check shortcut key when MENU is held
-                return getWindow().isShortcutKey(event.getKeyCode(), event);
+        // check whether the intent can be resolved. If not, we will see
+        // whether we can download it from the Market.
+        if (getPackageManager().resolveActivity(intent, 0) == null) {
+            String packagename = intent.getPackage();
+            if (packagename != null) {
+                intent = new Intent(Intent.ACTION_VIEW, Uri
+                        .parse("market://search?q=pname:" + packagename));
+                intent.addCategory(Intent.CATEGORY_BROWSABLE);
+                startActivity(intent);
+                return true;
             } else {
                 return false;
             }
         }
 
-        @Override
-        public void onUnhandledKeyEvent(WebView view, KeyEvent event) {
-            if (view != mTabControl.getCurrentTopWebView()) {
-                return;
-            }
-            if (event.isDown()) {
-                BrowserActivity.this.onKeyDown(event.getKeyCode(), event);
-            } else {
-                BrowserActivity.this.onKeyUp(event.getKeyCode(), event);
-            }
-        }
-    };
-
-    //--------------------------------------------------------------------------
-    // WebChromeClient implementation
-    //--------------------------------------------------------------------------
-
-    /* package */ WebChromeClient getWebChromeClient() {
-        return mWebChromeClient;
-    }
-
-    private final WebChromeClient mWebChromeClient = new WebChromeClient() {
-        // Helper method to create a new tab or sub window.
-        private void createWindow(final boolean dialog, final Message msg) {
-            if (dialog) {
-                mTabControl.createSubWindow();
-                final TabControl.Tab t = mTabControl.getCurrentTab();
-                attachSubWindow(t);
-                WebView.WebViewTransport transport =
-                        (WebView.WebViewTransport) msg.obj;
-                transport.setWebView(t.getSubWebView());
-                msg.sendToTarget();
-            } else {
-                final TabControl.Tab parent = mTabControl.getCurrentTab();
-                final TabControl.Tab newTab
-                        = openTabAndShow(EMPTY_URL_DATA, false, null);
-                if (newTab != parent) {
-                    parent.addChildTab(newTab);
-                }
-                WebView.WebViewTransport transport =
-                        (WebView.WebViewTransport) msg.obj;
-                transport.setWebView(mTabControl.getCurrentWebView());
-                msg.sendToTarget();
-            }
-        }
-
-        @Override
-        public boolean onCreateWindow(WebView view, final boolean dialog,
-                final boolean userGesture, final Message resultMsg) {
-            // Short-circuit if we can't create any more tabs or sub windows.
-            if (dialog && mTabControl.getCurrentSubWindow() != null) {
-                new AlertDialog.Builder(BrowserActivity.this)
-                        .setTitle(R.string.too_many_subwindows_dialog_title)
-                        .setIcon(android.R.drawable.ic_dialog_alert)
-                        .setMessage(R.string.too_many_subwindows_dialog_message)
-                        .setPositiveButton(R.string.ok, null)
-                        .show();
-                return false;
-            } else if (mTabControl.getTabCount() >= TabControl.MAX_TABS) {
-                new AlertDialog.Builder(BrowserActivity.this)
-                        .setTitle(R.string.too_many_windows_dialog_title)
-                        .setIcon(android.R.drawable.ic_dialog_alert)
-                        .setMessage(R.string.too_many_windows_dialog_message)
-                        .setPositiveButton(R.string.ok, null)
-                        .show();
-                return false;
-            }
-
-            // Short-circuit if this was a user gesture.
-            if (userGesture) {
-                createWindow(dialog, resultMsg);
+        // sanitize the Intent, ensuring web pages can not bypass browser
+        // security (only access to BROWSABLE activities).
+        intent.addCategory(Intent.CATEGORY_BROWSABLE);
+        intent.setComponent(null);
+        try {
+            if (startActivityIfNeeded(intent, -1)) {
                 return true;
             }
+        } catch (ActivityNotFoundException ex) {
+            // ignore the error. If no application can handle the URL,
+            // eg about:blank, assume the browser can handle it.
+        }
 
-            // Allow the popup and create the appropriate window.
-            final AlertDialog.OnClickListener allowListener =
-                    new AlertDialog.OnClickListener() {
-                        public void onClick(DialogInterface d,
-                                int which) {
-                            createWindow(dialog, resultMsg);
-                        }
-                    };
-
-            // Block the popup by returning a null WebView.
-            final AlertDialog.OnClickListener blockListener =
-                    new AlertDialog.OnClickListener() {
-                        public void onClick(DialogInterface d, int which) {
-                            resultMsg.sendToTarget();
-                        }
-                    };
-
-            // Build a confirmation dialog to display to the user.
-            final AlertDialog d =
-                    new AlertDialog.Builder(BrowserActivity.this)
-                    .setTitle(R.string.attention)
-                    .setIcon(android.R.drawable.ic_dialog_alert)
-                    .setMessage(R.string.popup_window_attempt)
-                    .setPositiveButton(R.string.allow, allowListener)
-                    .setNegativeButton(R.string.block, blockListener)
-                    .setCancelable(false)
-                    .create();
-
-            // Show the confirmation dialog.
-            d.show();
+        if (mMenuIsDown) {
+            openTab(url);
+            closeOptionsMenu();
             return true;
         }
+        return false;
+    }
 
-        @Override
-        public void onCloseWindow(WebView window) {
-            final TabControl.Tab current = mTabControl.getCurrentTab();
-            final TabControl.Tab parent = current.getParentTab();
-            if (parent != null) {
-                // JavaScript can only close popup window.
-                switchToTab(mTabControl.getTabIndex(parent));
-                // Now we need to close the window
-                closeTab(current);
-            }
-        }
+    // -------------------------------------------------------------------------
+    // Helper function for WebChromeClient
+    // -------------------------------------------------------------------------
 
-        @Override
-        public void onProgressChanged(WebView view, int newProgress) {
-            mTitleBar.setProgress(newProgress);
-            mFakeTitleBar.setProgress(newProgress);
+    void onProgressChanged(WebView view, int newProgress) {
+        mTitleBar.setProgress(newProgress);
+        mFakeTitleBar.setProgress(newProgress);
 
-            if (newProgress == 100) {
-                // onProgressChanged() may continue to be called after the main
-                // frame has finished loading, as any remaining sub frames
-                // continue to load. We'll only get called once though with
-                // newProgress as 100 when everything is loaded.
-                // (onPageFinished is called once when the main frame completes
-                // loading regardless of the state of any sub frames so calls
-                // to onProgressChanges may continue after onPageFinished has
-                // executed)
-
-                // sync cookies and cache promptly here.
-                CookieSyncManager.getInstance().sync();
-                if (mInLoad) {
-                    mInLoad = false;
-                    updateInLoadMenuItems();
-                    // If the options menu is open, leave the title bar
-                    if (!mOptionsMenuOpen || !mIconView) {
-                        hideFakeTitleBar();
-                    }
-                }
-            } else if (!mInLoad) {
-                // onPageFinished may have already been called but a subframe
-                // is still loading and updating the progress. Reset mInLoad
-                // and update the menu items.
-                mInLoad = true;
+        if (newProgress == 100) {
+            // onProgressChanged() may continue to be called after the main
+            // frame has finished loading, as any remaining sub frames continue
+            // to load. We'll only get called once though with newProgress as
+            // 100 when everything is loaded. (onPageFinished is called once
+            // when the main frame completes loading regardless of the state of
+            // any sub frames so calls to onProgressChanges may continue after
+            // onPageFinished has executed)
+            if (mInLoad) {
+                mInLoad = false;
                 updateInLoadMenuItems();
-                if (!mOptionsMenuOpen || mIconView) {
-                    // This page has begun to load, so show the title bar
-                    showFakeTitleBar();
+                // If the options menu is open, leave the title bar
+                if (!mOptionsMenuOpen || !mIconView) {
+                    hideFakeTitleBar();
                 }
             }
-        }
-
-        @Override
-        public void onReceivedTitle(WebView view, String title) {
-            String url = view.getUrl();
-
-            // here, if url is null, we want to reset the title
-            setUrlTitle(url, title);
-
-            if (url == null ||
-                url.length() >= SQLiteDatabase.SQLITE_MAX_LIKE_PATTERN_LENGTH) {
-                return;
-            }
-            // See if we can find the current url in our history database and
-            // add the new title to it.
-            if (url.startsWith("http://www.")) {
-                url = url.substring(11);
-            } else if (url.startsWith("http://")) {
-                url = url.substring(4);
-            }
-            try {
-                url = "%" + url;
-                String [] selArgs = new String[] { url };
-
-                String where = Browser.BookmarkColumns.URL + " LIKE ? AND "
-                        + Browser.BookmarkColumns.BOOKMARK + " = 0";
-                Cursor c = mResolver.query(Browser.BOOKMARKS_URI,
-                    Browser.HISTORY_PROJECTION, where, selArgs, null);
-                if (c.moveToFirst()) {
-                    // Current implementation of database only has one entry per
-                    // url.
-                    ContentValues map = new ContentValues();
-                    map.put(Browser.BookmarkColumns.TITLE, title);
-                    mResolver.update(Browser.BOOKMARKS_URI, map,
-                            "_id = " + c.getInt(0), null);
-                }
-                c.close();
-            } catch (IllegalStateException e) {
-                Log.e(LOGTAG, "BrowserActivity onReceived title", e);
-            } catch (SQLiteException ex) {
-                Log.e(LOGTAG, "onReceivedTitle() caught SQLiteException: ", ex);
+        } else if (!mInLoad) {
+            // onPageFinished may have already been called but a subframe is
+            // still loading and updating the progress. Reset mInLoad and update
+            // the menu items.
+            mInLoad = true;
+            updateInLoadMenuItems();
+            if (!mOptionsMenuOpen || mIconView) {
+                // This page has begun to load, so show the title bar
+                showFakeTitleBar();
             }
         }
+    }
 
-        @Override
-        public void onReceivedIcon(WebView view, Bitmap icon) {
-            updateIcon(view, icon);
+    void onShowCustomView(View view, WebChromeClient.CustomViewCallback callback) {
+        if (mCustomView != null)
+            return;
+
+        // Add the custom view to its container.
+        mCustomViewContainer.addView(view, COVER_SCREEN_GRAVITY_CENTER);
+        mCustomView = view;
+        mCustomViewCallback = callback;
+        // Save the menu state and set it to empty while the custom
+        // view is showing.
+        mOldMenuState = mMenuState;
+        mMenuState = EMPTY_MENU;
+        // Hide the content view.
+        mContentView.setVisibility(View.GONE);
+        // Finally show the custom view container.
+        mCustomViewContainer.setVisibility(View.VISIBLE);
+        mCustomViewContainer.bringToFront();
+    }
+
+    void onHideCustomView() {
+        if (mCustomView == null)
+            return;
+
+        // Hide the custom view.
+        mCustomView.setVisibility(View.GONE);
+        // Remove the custom view from its container.
+        mCustomViewContainer.removeView(mCustomView);
+        mCustomView = null;
+        // Reset the old menu state.
+        mMenuState = mOldMenuState;
+        mOldMenuState = EMPTY_MENU;
+        mCustomViewContainer.setVisibility(View.GONE);
+        mCustomViewCallback.onCustomViewHidden();
+        // Show the content view.
+        mContentView.setVisibility(View.VISIBLE);
+    }
+
+    Bitmap getDefaultVideoPoster() {
+        if (mDefaultVideoPoster == null) {
+            mDefaultVideoPoster = BitmapFactory.decodeResource(
+                    getResources(), R.drawable.default_video_poster);
         }
+        return mDefaultVideoPoster;
+    }
 
-        @Override
-        public void onReceivedTouchIconUrl(WebView view, String url,
-                boolean precomposed) {
-            final ContentResolver cr = getContentResolver();
-            final Cursor c =
-                    BrowserBookmarksAdapter.queryBookmarksForUrl(cr,
-                            view.getOriginalUrl(), view.getUrl(), true);
-            if (c != null) {
-                if (c.getCount() > 0) {
-                    // Let precomposed icons take precedence over non-composed
-                    // icons.
-                    if (precomposed && mTouchIconLoader != null) {
-                        mTouchIconLoader.cancel(false);
-                        mTouchIconLoader = null;
-                    }
-                    // Have only one async task at a time.
-                    if (mTouchIconLoader == null) {
-                        mTouchIconLoader = new DownloadTouchIcon(
-                                BrowserActivity.this, cr, c, view);
-                        mTouchIconLoader.execute(url);
-                    }
-                } else {
-                    c.close();
-                }
-            }
+    View getVideoLoadingProgressView() {
+        if (mVideoProgressView == null) {
+            LayoutInflater inflater = LayoutInflater.from(BrowserActivity.this);
+            mVideoProgressView = inflater.inflate(
+                    R.layout.video_loading_progress, null);
         }
-
-        @Override
-        public void onShowCustomView(View view, WebChromeClient.CustomViewCallback callback) {
-            if (mCustomView != null)
-                return;
-
-            // Add the custom view to its container.
-            mCustomViewContainer.addView(view, COVER_SCREEN_GRAVITY_CENTER);
-            mCustomView = view;
-            mCustomViewCallback = callback;
-            // Save the menu state and set it to empty while the custom
-            // view is showing.
-            mOldMenuState = mMenuState;
-            mMenuState = EMPTY_MENU;
-            // Hide the content view.
-            mContentView.setVisibility(View.GONE);
-            // Finally show the custom view container.
-            mCustomViewContainer.setVisibility(View.VISIBLE);
-            mCustomViewContainer.bringToFront();
-        }
-
-        @Override
-        public void onHideCustomView() {
-            if (mCustomView == null)
-                return;
-
-            // Hide the custom view.
-            mCustomView.setVisibility(View.GONE);
-            // Remove the custom view from its container.
-            mCustomViewContainer.removeView(mCustomView);
-            mCustomView = null;
-            // Reset the old menu state.
-            mMenuState = mOldMenuState;
-            mOldMenuState = EMPTY_MENU;
-            mCustomViewContainer.setVisibility(View.GONE);
-            mCustomViewCallback.onCustomViewHidden();
-            // Show the content view.
-            mContentView.setVisibility(View.VISIBLE);
-        }
-
-        /**
-         * The origin has exceeded its database quota.
-         * @param url the URL that exceeded the quota
-         * @param databaseIdentifier the identifier of the database on
-         *     which the transaction that caused the quota overflow was run
-         * @param currentQuota the current quota for the origin.
-         * @param estimatedSize the estimated size of the database.
-         * @param totalUsedQuota is the sum of all origins' quota.
-         * @param quotaUpdater The callback to run when a decision to allow or
-         *     deny quota has been made. Don't forget to call this!
-         */
-        @Override
-        public void onExceededDatabaseQuota(String url,
-            String databaseIdentifier, long currentQuota, long estimatedSize,
-            long totalUsedQuota, WebStorage.QuotaUpdater quotaUpdater) {
-            mSettings.getWebStorageSizeManager().onExceededDatabaseQuota(
-                    url, databaseIdentifier, currentQuota, estimatedSize,
-                    totalUsedQuota, quotaUpdater);
-        }
-
-        /**
-         * The Application Cache has exceeded its max size.
-         * @param spaceNeeded is the amount of disk space that would be needed
-         * in order for the last appcache operation to succeed.
-         * @param totalUsedQuota is the sum of all origins' quota.
-         * @param quotaUpdater A callback to inform the WebCore thread that a new
-         * app cache size is available. This callback must always be executed at
-         * some point to ensure that the sleeping WebCore thread is woken up.
-         */
-        @Override
-        public void onReachedMaxAppCacheSize(long spaceNeeded,
-                long totalUsedQuota, WebStorage.QuotaUpdater quotaUpdater) {
-            mSettings.getWebStorageSizeManager().onReachedMaxAppCacheSize(
-                    spaceNeeded, totalUsedQuota, quotaUpdater);
-        }
-
-        /**
-         * Instructs the browser to show a prompt to ask the user to set the
-         * Geolocation permission state for the specified origin.
-         * @param origin The origin for which Geolocation permissions are
-         *     requested.
-         * @param callback The callback to call once the user has set the
-         *     Geolocation permission state.
-         */
-        @Override
-        public void onGeolocationPermissionsShowPrompt(String origin,
-                GeolocationPermissions.Callback callback) {
-            mTabControl.getCurrentTab().getGeolocationPermissionsPrompt().show(
-                    origin, callback);
-        }
-
-        /**
-         * Instructs the browser to hide the Geolocation permissions prompt.
-         */
-        @Override
-        public void onGeolocationPermissionsHidePrompt() {
-            mTabControl.getCurrentTab().getGeolocationPermissionsPrompt().hide();
-        }
-
-        /* Adds a JavaScript error message to the system log.
-         * @param message The error message to report.
-         * @param lineNumber The line number of the error.
-         * @param sourceID The name of the source file that caused the error.
-         */
-        @Override
-        public void addMessageToConsole(String message, int lineNumber, String sourceID) {
-            ErrorConsoleView errorConsole = mTabControl.getCurrentErrorConsole(true);
-            errorConsole.addErrorMessage(message, sourceID, lineNumber);
-                if (mShouldShowErrorConsole &&
-                        errorConsole.getShowState() != ErrorConsoleView.SHOW_MAXIMIZED) {
-                    errorConsole.showConsole(ErrorConsoleView.SHOW_MINIMIZED);
-                }
-            Log.w(LOGTAG, "Console: " + message + " " + sourceID + ":" + lineNumber);
-        }
-
-        /**
-         * Ask the browser for an icon to represent a <video> element.
-         * This icon will be used if the Web page did not specify a poster attribute.
-         *
-         * @return Bitmap The icon or null if no such icon is available.
-         * @hide pending API Council approval
-         */
-        @Override
-        public Bitmap getDefaultVideoPoster() {
-            if (mDefaultVideoPoster == null) {
-                mDefaultVideoPoster = BitmapFactory.decodeResource(
-                        getResources(), R.drawable.default_video_poster);
-            }
-            return mDefaultVideoPoster;
-        }
-
-        /**
-         * Ask the host application for a custom progress view to show while
-         * a <video> is loading.
-         *
-         * @return View The progress view.
-         * @hide pending API Council approval
-         */
-        @Override
-        public View getVideoLoadingProgressView() {
-            if (mVideoProgressView == null) {
-                LayoutInflater inflater = LayoutInflater.from(BrowserActivity.this);
-                mVideoProgressView = inflater.inflate(R.layout.video_loading_progress, null);
-            }
-            return mVideoProgressView;
-        }
-
-        @Override
-        public void openFileChooser(ValueCallback<Uri> uploadMsg) {
-            if (mUploadMessage != null) return;
-            mUploadMessage = uploadMsg;
-            Intent i = new Intent(Intent.ACTION_GET_CONTENT);
-            i.addCategory(Intent.CATEGORY_OPENABLE);
-            i.setType("*/*");
-            BrowserActivity.this.startActivityForResult(
-                    Intent.createChooser(i, getString(R.string.choose_upload)),
-                    FILE_SELECTED);
-        }
-
-        /**
-         * Deliver a list of already-visited URLs
-         * @hide pending API Council approval
-         */
-        @Override
-        public void getVisitedHistory(final ValueCallback<String[]> callback) {
-            AsyncTask<Void, Void, String[]> task = new AsyncTask<Void, Void, String[]>() {
-                public String[] doInBackground(Void... unused) {
-                    return Browser.getVisitedHistory(getContentResolver());
-                }
-
-                public void onPostExecute(String[] result) {
-                    callback.onReceiveValue(result);
-
-                };
-            };
-            task.execute();
-        };
-    };
+        return mVideoProgressView;
+    }
 
     /*
      * The Object used to inform the WebView of the file to upload.
      */
     private ValueCallback<Uri> mUploadMessage;
 
+    void openFileChooser(ValueCallback<Uri> uploadMsg) {
+        if (mUploadMessage != null) return;
+        mUploadMessage = uploadMsg;
+        Intent i = new Intent(Intent.ACTION_GET_CONTENT);
+        i.addCategory(Intent.CATEGORY_OPENABLE);
+        i.setType("*/*");
+        BrowserActivity.this.startActivityForResult(Intent.createChooser(i,
+                getString(R.string.choose_upload)), FILE_SELECTED);
+    }
+
+    // -------------------------------------------------------------------------
+    // Implement functions for DownloadListener
+    // -------------------------------------------------------------------------
+
     /**
      * Notify the host application a download should be done, or that
      * the data should be streamed if a streaming viewer is available.
@@ -3682,47 +2759,23 @@
 
     }
 
+    // -------------------------------------------------------------------------
+
     /**
      * Resets the lock icon. This method is called when we start a new load and
      * know the url to be loaded.
      */
     private void resetLockIcon(String url) {
         // Save the lock-icon state (we revert to it if the load gets cancelled)
-        saveLockIcon();
-
-        mLockIconType = LOCK_ICON_UNSECURE;
-        if (URLUtil.isHttpsUrl(url)) {
-            mLockIconType = LOCK_ICON_SECURE;
-            if (LOGV_ENABLED) {
-                Log.v(LOGTAG, "BrowserActivity.resetLockIcon:" +
-                      " reset lock icon to " + mLockIconType);
-            }
-        }
-
+        mTabControl.getCurrentTab().resetLockIcon(url);
         updateLockIconImage(LOCK_ICON_UNSECURE);
     }
 
-    /* package */ void setLockIconType(int type) {
-        mLockIconType = type;
-    }
-
-    /* package */ int getLockIconType() {
-        return mLockIconType;
-    }
-
-    /* package */ void setPrevLockType(int type) {
-        mPrevLockType = type;
-    }
-
-    /* package */ int getPrevLockType() {
-        return mPrevLockType;
-    }
-
     /**
      * Update the lock icon to correspond to our latest state.
      */
-    /* package */ void updateLockIconToLatest() {
-        updateLockIconImage(mLockIconType);
+    private void updateLockIconToLatest() {
+        updateLockIconImage(mTabControl.getCurrentTab().getLockIconType());
     }
 
     /**
@@ -3747,7 +2800,7 @@
      * not. This is important, since we need to know whether to return to
      * the parent dialog or simply dismiss.
      */
-    private void showPageInfo(final TabControl.Tab tab,
+    private void showPageInfo(final Tab tab,
                               final boolean fromShowSSLCertificateOnError) {
         final LayoutInflater factory = LayoutInflater
                 .from(this);
@@ -3865,7 +2918,7 @@
      * (accessible from the Page-Info dialog).
      * @param tab The tab to show certificate for.
      */
-    private void showSSLCertificate(final TabControl.Tab tab) {
+    private void showSSLCertificate(final Tab tab) {
         final View certificateView =
                 inflateCertificateView(tab.getWebView().getCertificate());
         if (certificateView == null) {
@@ -3917,7 +2970,7 @@
      * connection that resulted in an SSL error or proceeding per user request.
      * @param error The SSL error object.
      */
-    private void showSSLCertificateOnError(
+    void showSSLCertificateOnError(
         final WebView view, final SslErrorHandler handler, final SslError error) {
 
         final View certificateView =
@@ -3976,8 +3029,8 @@
                                 mSSLCertificateOnErrorHandler = null;
                                 mSSLCertificateOnErrorError = null;
 
-                                mWebViewClient.onReceivedSslError(
-                                    view, handler, error);
+                                view.getWebViewClient().onReceivedSslError(
+                                                view, handler, error);
                             }
                         })
                  .setNeutralButton(R.string.page_info_view,
@@ -4002,8 +3055,8 @@
                                 mSSLCertificateOnErrorHandler = null;
                                 mSSLCertificateOnErrorError = null;
 
-                                mWebViewClient.onReceivedSslError(
-                                    view, handler, error);
+                                view.getWebViewClient().onReceivedSslError(
+                                                view, handler, error);
                             }
                         })
                 .show();
@@ -4094,7 +3147,7 @@
     /**
      * Displays an http-authentication dialog.
      */
-    private void showHttpAuthentication(final HttpAuthHandler handler,
+    void showHttpAuthentication(final HttpAuthHandler handler,
             final String host, final String realm, final String title,
             final String name, final String password, int focusId) {
         LayoutInflater factory = LayoutInflater.from(this);
@@ -4215,6 +3268,10 @@
         }
     }
 
+    boolean isNetworkUp() {
+        return mIsNetworkUp;
+    }
+
     // This method shows the network dialog alerting the user that the net is
     // down. It will only show the dialog if mAlertDialog is null.
     private void createAndShowNetworkDialog() {
@@ -4238,7 +3295,7 @@
                     if (extras != null && extras.getBoolean("new_window", false)) {
                         openTab(data);
                     } else {
-                        final TabControl.Tab currentTab =
+                        final Tab currentTab =
                                 mTabControl.getCurrentTab();
                         dismissSubWindow(currentTab);
                         if (data != null && data.length() != 0) {
@@ -4270,7 +3327,7 @@
         Intent intent = new Intent(this,
                 BrowserDownloadPage.class);
         intent.setData(downloadRecord);
-        startActivityForResult(intent, this.DOWNLOAD_PAGE);
+        startActivityForResult(intent, BrowserActivity.DOWNLOAD_PAGE);
 
     }
 
@@ -4307,8 +3364,7 @@
         intent.putExtra("url", url);
         intent.putExtra("thumbnail", thumbnail);
         // Disable opening in a new window if we have maxed out the windows
-        intent.putExtra("disable_new_window", mTabControl.getTabCount()
-                >= TabControl.MAX_TABS);
+        intent.putExtra("disable_new_window", !mTabControl.canCreateNewTab());
         intent.putExtra("touch_icon_url", current.getTouchIconUrl());
         if (startWithHistory) {
             intent.putExtra(CombinedBookmarkHistoryActivity.STARTING_TAB,
@@ -4322,7 +3378,7 @@
         // In case the user enters nothing.
         if (url != null && url.length() != 0 && view != null) {
             url = smartUrlFilter(url);
-            if (!mWebViewClient.shouldOverrideUrlLoading(view, url)) {
+            if (!view.getWebViewClient().shouldOverrideUrlLoading(view, url)) {
                 view.loadUrl(url);
             }
         }
@@ -4335,16 +3391,6 @@
         return null;
     }
 
-
-    // get window count
-
-    int getWindowCount(){
-      if(mTabControl != null){
-        return mTabControl.getTabCount();
-      }
-      return 0;
-    }
-
     protected static final Pattern ACCEPTED_URI_SCHEMA = Pattern.compile(
             "(?i)" + // switch on case insensitive matching
             "(" +    // begin group for schema
@@ -4418,7 +3464,8 @@
 
         mShouldShowErrorConsole = flag;
 
-        ErrorConsoleView errorConsole = mTabControl.getCurrentErrorConsole(true);
+        ErrorConsoleView errorConsole = mTabControl.getCurrentTab()
+                .getErrorConsole(true);
 
         if (flag) {
             // Setting the show state of the console will cause it's the layout to be inflated.
@@ -4438,13 +3485,14 @@
 
     }
 
+    boolean shouldShowErrorConsole() {
+        return mShouldShowErrorConsole;
+    }
+
     final static int LOCK_ICON_UNSECURE = 0;
     final static int LOCK_ICON_SECURE   = 1;
     final static int LOCK_ICON_MIXED    = 2;
 
-    private int mLockIconType = LOCK_ICON_UNSECURE;
-    private int mPrevLockType = LOCK_ICON_UNSECURE;
-
     private BrowserSettings mSettings;
     private TabControl      mTabControl;
     private ContentResolver mResolver;
@@ -4470,7 +3518,6 @@
     private boolean mIsNetworkUp;
     private boolean mDidStopLoad;
 
-    private boolean mPageStarted;
     private boolean mActivityInPause = true;
 
     private boolean mMenuIsDown;
@@ -4516,7 +3563,7 @@
     // As PageInfo has different style for landscape / portrait, we have
     // to re-open it when configuration changed
     private AlertDialog mPageInfoDialog;
-    private TabControl.Tab mPageInfoView;
+    private Tab mPageInfoView;
     // If the Page-Info dialog is launched from the SSL-certificate-on-error
     // dialog, we should not just dismiss it, but should get back to the
     // SSL-certificate-on-error dialog. This flag is used to store this state
@@ -4532,7 +3579,7 @@
     // as SSLCertificate has different style for landscape / portrait, we
     // have to re-open it when configuration changed
     private AlertDialog mSSLCertificateDialog;
-    private TabControl.Tab mSSLCertificateView;
+    private Tab mSSLCertificateView;
 
     // as HttpAuthentication has different style for landscape / portrait, we
     // have to re-open it when configuration changed
@@ -4597,9 +3644,6 @@
 
     private BroadcastReceiver mPackageInstallationReceiver;
 
-    // AsyncTask for downloading touch icons
-    /* package */ DownloadTouchIcon mTouchIconLoader;
-
     // activity requestCode
     final static int COMBO_PAGE                 = 1;
     final static int DOWNLOAD_PAGE              = 2;
diff --git a/src/com/android/browser/BrowserSettings.java b/src/com/android/browser/BrowserSettings.java
index e36d54b..bb369ae 100644
--- a/src/com/android/browser/BrowserSettings.java
+++ b/src/com/android/browser/BrowserSettings.java
@@ -106,9 +106,6 @@
     // The setting can be then toggled from the settings menu.
     private boolean showConsole = true;
 
-    // Browser only settings
-    private boolean doFlick = false;
-
     // Private preconfigured values
     private static int minimumFontSize = 8;
     private static int minimumLogicalFontSize = 8;
@@ -336,7 +333,6 @@
             tracing = p.getBoolean("enable_tracing", tracing);
             lightTouch = p.getBoolean("enable_light_touch", lightTouch);
             navDump = p.getBoolean("enable_nav_dump", navDump);
-            doFlick = p.getBoolean("enable_flick", doFlick);
             userAgent = Integer.parseInt(p.getString("user_agent", "0"));
         }
         // JS flags is loaded from DB even if showDebugSettings is false,
@@ -422,10 +418,6 @@
         return navDump;
     }
 
-    public boolean doFlick() {
-        return doFlick;
-    }
-
     public boolean showDebugSettings() {
         return showDebugSettings;
     }
diff --git a/src/com/android/browser/DownloadTouchIcon.java b/src/com/android/browser/DownloadTouchIcon.java
index 07d2d3a..1761dd4 100644
--- a/src/com/android/browser/DownloadTouchIcon.java
+++ b/src/com/android/browser/DownloadTouchIcon.java
@@ -42,11 +42,10 @@
     private final String mOriginalUrl;
     private final String mUrl;
     private final String mUserAgent;
-    /* package */ BrowserActivity mActivity;
+    /* package */ Tab mTab;
 
-    public DownloadTouchIcon(BrowserActivity activity, ContentResolver cr,
-            Cursor c, WebView view) {
-        mActivity = activity;
+    public DownloadTouchIcon(Tab tab, ContentResolver cr, Cursor c, WebView view) {
+        mTab = tab;
         mContentResolver = cr;
         mCursor = c;
         // Store these in case they change.
@@ -56,7 +55,7 @@
     }
 
     public DownloadTouchIcon(ContentResolver cr, Cursor c, String url) {
-        mActivity = null;
+        mTab = null;
         mContentResolver = cr;
         mCursor = c;
         mOriginalUrl = null;
@@ -109,9 +108,9 @@
     @Override
     public void onPostExecute(Bitmap icon) {
         // Do this first in case the download failed.
-        if (mActivity != null) {
+        if (mTab != null) {
             // Remove the touch icon loader from the BrowserActivity.
-            mActivity.mTouchIconLoader = null;
+            mTab.mTouchIconLoader = null;
         }
 
         if (icon == null || mCursor == null || isCancelled()) {
diff --git a/src/com/android/browser/Tab.java b/src/com/android/browser/Tab.java
new file mode 100644
index 0000000..3bb136c
--- /dev/null
+++ b/src/com/android/browser/Tab.java
@@ -0,0 +1,1568 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.browser;
+
+import java.io.File;
+import java.util.LinkedList;
+import java.util.Vector;
+
+import android.app.AlertDialog;
+import android.content.ContentResolver;
+import android.content.ContentValues;
+import android.content.DialogInterface;
+import android.content.DialogInterface.OnCancelListener;
+import android.database.Cursor;
+import android.database.sqlite.SQLiteDatabase;
+import android.database.sqlite.SQLiteException;
+import android.graphics.Bitmap;
+import android.net.Uri;
+import android.net.http.SslError;
+import android.os.AsyncTask;
+import android.os.Bundle;
+import android.os.Message;
+import android.provider.Browser;
+import android.util.Log;
+import android.view.KeyEvent;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+import android.view.View.OnClickListener;
+import android.webkit.CookieSyncManager;
+import android.webkit.GeolocationPermissions;
+import android.webkit.HttpAuthHandler;
+import android.webkit.SslErrorHandler;
+import android.webkit.URLUtil;
+import android.webkit.ValueCallback;
+import android.webkit.WebBackForwardList;
+import android.webkit.WebChromeClient;
+import android.webkit.WebHistoryItem;
+import android.webkit.WebIconDatabase;
+import android.webkit.WebStorage;
+import android.webkit.WebView;
+import android.webkit.WebViewClient;
+import android.widget.FrameLayout;
+import android.widget.ImageButton;
+import android.widget.LinearLayout;
+import android.widget.TextView;
+
+/**
+ * Class for maintaining Tabs with a main WebView and a subwindow.
+ */
+class Tab {
+    // Log Tag
+    private static final String LOGTAG = "Tab";
+    // The Geolocation permissions prompt
+    private GeolocationPermissionsPrompt mGeolocationPermissionsPrompt;
+    // Main WebView wrapper
+    private View mContainer;
+    // Main WebView
+    private WebView mMainView;
+    // Subwindow container
+    private View mSubViewContainer;
+    // Subwindow WebView
+    private WebView mSubView;
+    // Saved bundle for when we are running low on memory. It contains the
+    // information needed to restore the WebView if the user goes back to the
+    // tab.
+    private Bundle mSavedState;
+    // Data used when displaying the tab in the picker.
+    private PickerData mPickerData;
+    // Parent Tab. This is the Tab that created this Tab, or null if the Tab was
+    // created by the UI
+    private Tab mParentTab;
+    // Tab that constructed by this Tab. This is used when this Tab is
+    // destroyed, it clears all mParentTab values in the children.
+    private Vector<Tab> mChildTabs;
+    // If true, the tab will be removed when back out of the first page.
+    private boolean mCloseOnExit;
+    // If true, the tab is in the foreground of the current activity.
+    private boolean mInForeground;
+    // If true, the tab is in loading state.
+    private boolean mInLoad;
+    // Application identifier used to find tabs that another application wants
+    // to reuse.
+    private String mAppId;
+    // Keep the original url around to avoid killing the old WebView if the url
+    // has not changed.
+    private String mOriginalUrl;
+    // Error console for the tab
+    private ErrorConsoleView mErrorConsole;
+    // the lock icon type and previous lock icon type for the tab
+    private int mLockIconType;
+    private int mPrevLockIconType;
+    // Inflation service for making subwindows.
+    private final LayoutInflater mInflateService;
+    // The BrowserActivity which owners the Tab
+    private final BrowserActivity mActivity;
+
+    // AsyncTask for downloading touch icons
+    DownloadTouchIcon mTouchIconLoader;
+
+    // Extra saved information for displaying the tab in the picker.
+    private static class PickerData {
+        String  mUrl;
+        String  mTitle;
+        Bitmap  mFavicon;
+    }
+
+    // Used for saving and restoring each Tab
+    static final String WEBVIEW = "webview";
+    static final String NUMTABS = "numTabs";
+    static final String CURRTAB = "currentTab";
+    static final String CURRURL = "currentUrl";
+    static final String CURRTITLE = "currentTitle";
+    static final String CURRPICTURE = "currentPicture";
+    static final String CLOSEONEXIT = "closeonexit";
+    static final String PARENTTAB = "parentTab";
+    static final String APPID = "appid";
+    static final String ORIGINALURL = "originalUrl";
+
+    // -------------------------------------------------------------------------
+
+    // Container class for the next error dialog that needs to be displayed
+    private class ErrorDialog {
+        public final int mTitle;
+        public final String mDescription;
+        public final int mError;
+        ErrorDialog(int title, String desc, int error) {
+            mTitle = title;
+            mDescription = desc;
+            mError = error;
+        }
+    };
+
+    private void processNextError() {
+        if (mQueuedErrors == null) {
+            return;
+        }
+        // The first one is currently displayed so just remove it.
+        mQueuedErrors.removeFirst();
+        if (mQueuedErrors.size() == 0) {
+            mQueuedErrors = null;
+            return;
+        }
+        showError(mQueuedErrors.getFirst());
+    }
+
+    private DialogInterface.OnDismissListener mDialogListener =
+            new DialogInterface.OnDismissListener() {
+                public void onDismiss(DialogInterface d) {
+                    processNextError();
+                }
+            };
+    private LinkedList<ErrorDialog> mQueuedErrors;
+
+    private void queueError(int err, String desc) {
+        if (mQueuedErrors == null) {
+            mQueuedErrors = new LinkedList<ErrorDialog>();
+        }
+        for (ErrorDialog d : mQueuedErrors) {
+            if (d.mError == err) {
+                // Already saw a similar error, ignore the new one.
+                return;
+            }
+        }
+        ErrorDialog errDialog = new ErrorDialog(
+                err == WebViewClient.ERROR_FILE_NOT_FOUND ?
+                R.string.browserFrameFileErrorLabel :
+                R.string.browserFrameNetworkErrorLabel,
+                desc, err);
+        mQueuedErrors.addLast(errDialog);
+
+        // Show the dialog now if the queue was empty and it is in foreground
+        if (mQueuedErrors.size() == 1 && mInForeground) {
+            showError(errDialog);
+        }
+    }
+
+    private void showError(ErrorDialog errDialog) {
+        if (mInForeground) {
+            AlertDialog d = new AlertDialog.Builder(mActivity)
+                    .setTitle(errDialog.mTitle)
+                    .setMessage(errDialog.mDescription)
+                    .setPositiveButton(R.string.ok, null)
+                    .create();
+            d.setOnDismissListener(mDialogListener);
+            d.show();
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // WebViewClient implementation for the main WebView
+    // -------------------------------------------------------------------------
+
+    private final WebViewClient mWebViewClient = new WebViewClient() {
+        @Override
+        public void onPageStarted(WebView view, String url, Bitmap favicon) {
+            mInLoad = true;
+
+            // We've started to load a new page. If there was a pending message
+            // to save a screenshot then we will now take the new page and save
+            // an incorrect screenshot. Therefore, remove any pending thumbnail
+            // messages from the queue.
+            mActivity.removeMessages(BrowserActivity.UPDATE_BOOKMARK_THUMBNAIL,
+                    view);
+
+            // If we start a touch icon load and then load a new page, we don't
+            // want to cancel the current touch icon loader. But, we do want to
+            // create a new one when the touch icon url is known.
+            if (mTouchIconLoader != null) {
+                mTouchIconLoader.mTab = null;
+                mTouchIconLoader = null;
+            }
+
+            // reset the error console
+            if (mErrorConsole != null) {
+                mErrorConsole.clearErrorMessages();
+                if (mActivity.shouldShowErrorConsole()) {
+                    mErrorConsole.showConsole(ErrorConsoleView.SHOW_NONE);
+                }
+            }
+
+            // update the bookmark database for favicon
+            if (favicon != null) {
+                BrowserBookmarksAdapter.updateBookmarkFavicon(mActivity
+                        .getContentResolver(), view.getOriginalUrl(), view
+                        .getUrl(), favicon);
+            }
+
+            // reset sync timer to avoid sync starts during loading a page
+            CookieSyncManager.getInstance().resetSync();
+
+            if (!mActivity.isNetworkUp()) {
+                view.setNetworkAvailable(false);
+            }
+
+            // finally update the UI in the activity if it is in the foreground
+            if (mInForeground) {
+                mActivity.onPageStarted(view, url, favicon);
+            }
+        }
+
+        @Override
+        public void onPageFinished(WebView view, String url) {
+            mInLoad = false;
+
+            if (mInForeground && !mActivity.didUserStopLoading()
+                    || !mInForeground) {
+                // Only update the bookmark screenshot if the user did not
+                // cancel the load early.
+                mActivity.postMessage(
+                        BrowserActivity.UPDATE_BOOKMARK_THUMBNAIL, 0, 0, view,
+                        500);
+            }
+
+            // finally update the UI in the activity if it is in the foreground
+            if (mInForeground) {
+                mActivity.onPageFinished(view, url);
+            }
+        }
+
+        // return true if want to hijack the url to let another app to handle it
+        @Override
+        public boolean shouldOverrideUrlLoading(WebView view, String url) {
+            if (mInForeground) {
+                return mActivity.shouldOverrideUrlLoading(view, url);
+            } else {
+                return false;
+            }
+        }
+
+        /**
+         * Updates the lock icon. This method is called when we discover another
+         * resource to be loaded for this page (for example, javascript). While
+         * we update the icon type, we do not update the lock icon itself until
+         * we are done loading, it is slightly more secure this way.
+         */
+        @Override
+        public void onLoadResource(WebView view, String url) {
+            if (url != null && url.length() > 0) {
+                // It is only if the page claims to be secure that we may have
+                // to update the lock:
+                if (mLockIconType == BrowserActivity.LOCK_ICON_SECURE) {
+                    // If NOT a 'safe' url, change the lock to mixed content!
+                    if (!(URLUtil.isHttpsUrl(url) || URLUtil.isDataUrl(url)
+                            || URLUtil.isAboutUrl(url))) {
+                        mLockIconType = BrowserActivity.LOCK_ICON_MIXED;
+                    }
+                }
+            }
+        }
+
+        /**
+         * Show the dialog if it is in the foreground, asking the user if they
+         * would like to continue after an excessive number of HTTP redirects.
+         * Cancel if it is in the background.
+         */
+        @Override
+        public void onTooManyRedirects(WebView view, final Message cancelMsg,
+                final Message continueMsg) {
+            if (!mInForeground) {
+                cancelMsg.sendToTarget();
+                return;
+            }
+            new AlertDialog.Builder(mActivity).setTitle(
+                    R.string.browserFrameRedirect).setMessage(
+                    R.string.browserFrame307Post).setPositiveButton(
+                    R.string.ok, new DialogInterface.OnClickListener() {
+                        public void onClick(DialogInterface dialog, int which) {
+                            continueMsg.sendToTarget();
+                        }
+                    }).setNegativeButton(R.string.cancel,
+                    new DialogInterface.OnClickListener() {
+                        public void onClick(DialogInterface dialog, int which) {
+                            cancelMsg.sendToTarget();
+                        }
+                    }).setOnCancelListener(new OnCancelListener() {
+                public void onCancel(DialogInterface dialog) {
+                    cancelMsg.sendToTarget();
+                }
+            }).show();
+        }
+
+        /**
+         * Show a dialog informing the user of the network error reported by
+         * WebCore if it is in the foreground.
+         */
+        @Override
+        public void onReceivedError(WebView view, int errorCode,
+                String description, String failingUrl) {
+            if (errorCode != WebViewClient.ERROR_HOST_LOOKUP &&
+                    errorCode != WebViewClient.ERROR_CONNECT &&
+                    errorCode != WebViewClient.ERROR_BAD_URL &&
+                    errorCode != WebViewClient.ERROR_UNSUPPORTED_SCHEME &&
+                    errorCode != WebViewClient.ERROR_FILE) {
+                queueError(errorCode, description);
+            }
+            Log.e(LOGTAG, "onReceivedError " + errorCode + " " + failingUrl
+                    + " " + description);
+
+            // We need to reset the title after an error if it is in foreground.
+            if (mInForeground) {
+                mActivity.resetTitleAndRevertLockIcon();
+            }
+        }
+
+        /**
+         * Check with the user if it is ok to resend POST data as the page they
+         * are trying to navigate to is the result of a POST.
+         */
+        @Override
+        public void onFormResubmission(WebView view, final Message dontResend,
+                                       final Message resend) {
+            if (!mInForeground) {
+                dontResend.sendToTarget();
+                return;
+            }
+            new AlertDialog.Builder(mActivity).setTitle(
+                    R.string.browserFrameFormResubmitLabel).setMessage(
+                    R.string.browserFrameFormResubmitMessage)
+                    .setPositiveButton(R.string.ok,
+                            new DialogInterface.OnClickListener() {
+                                public void onClick(DialogInterface dialog,
+                                        int which) {
+                                    resend.sendToTarget();
+                                }
+                            }).setNegativeButton(R.string.cancel,
+                            new DialogInterface.OnClickListener() {
+                                public void onClick(DialogInterface dialog,
+                                        int which) {
+                                    dontResend.sendToTarget();
+                                }
+                            }).setOnCancelListener(new OnCancelListener() {
+                        public void onCancel(DialogInterface dialog) {
+                            dontResend.sendToTarget();
+                        }
+                    }).show();
+        }
+
+        /**
+         * Insert the url into the visited history database.
+         * @param url The url to be inserted.
+         * @param isReload True if this url is being reloaded.
+         * FIXME: Not sure what to do when reloading the page.
+         */
+        @Override
+        public void doUpdateVisitedHistory(WebView view, String url,
+                boolean isReload) {
+            if (url.regionMatches(true, 0, "about:", 0, 6)) {
+                return;
+            }
+            // remove "client" before updating it to the history so that it wont
+            // show up in the auto-complete list.
+            int index = url.indexOf("client=ms-");
+            if (index > 0 && url.contains(".google.")) {
+                int end = url.indexOf('&', index);
+                if (end > 0) {
+                    url = url.substring(0, index)
+                            .concat(url.substring(end + 1));
+                } else {
+                    // the url.charAt(index-1) should be either '?' or '&'
+                    url = url.substring(0, index-1);
+                }
+            }
+            Browser.updateVisitedHistory(mActivity.getContentResolver(), url,
+                    true);
+            WebIconDatabase.getInstance().retainIconForPageUrl(url);
+        }
+
+        /**
+         * Displays SSL error(s) dialog to the user.
+         */
+        @Override
+        public void onReceivedSslError(final WebView view,
+                final SslErrorHandler handler, final SslError error) {
+            if (!mInForeground) {
+                handler.cancel();
+                return;
+            }
+            if (BrowserSettings.getInstance().showSecurityWarnings()) {
+                final LayoutInflater factory =
+                    LayoutInflater.from(mActivity);
+                final View warningsView =
+                    factory.inflate(R.layout.ssl_warnings, null);
+                final LinearLayout placeholder =
+                    (LinearLayout)warningsView.findViewById(R.id.placeholder);
+
+                if (error.hasError(SslError.SSL_UNTRUSTED)) {
+                    LinearLayout ll = (LinearLayout)factory
+                        .inflate(R.layout.ssl_warning, null);
+                    ((TextView)ll.findViewById(R.id.warning))
+                        .setText(R.string.ssl_untrusted);
+                    placeholder.addView(ll);
+                }
+
+                if (error.hasError(SslError.SSL_IDMISMATCH)) {
+                    LinearLayout ll = (LinearLayout)factory
+                        .inflate(R.layout.ssl_warning, null);
+                    ((TextView)ll.findViewById(R.id.warning))
+                        .setText(R.string.ssl_mismatch);
+                    placeholder.addView(ll);
+                }
+
+                if (error.hasError(SslError.SSL_EXPIRED)) {
+                    LinearLayout ll = (LinearLayout)factory
+                        .inflate(R.layout.ssl_warning, null);
+                    ((TextView)ll.findViewById(R.id.warning))
+                        .setText(R.string.ssl_expired);
+                    placeholder.addView(ll);
+                }
+
+                if (error.hasError(SslError.SSL_NOTYETVALID)) {
+                    LinearLayout ll = (LinearLayout)factory
+                        .inflate(R.layout.ssl_warning, null);
+                    ((TextView)ll.findViewById(R.id.warning))
+                        .setText(R.string.ssl_not_yet_valid);
+                    placeholder.addView(ll);
+                }
+
+                new AlertDialog.Builder(mActivity).setTitle(
+                        R.string.security_warning).setIcon(
+                        android.R.drawable.ic_dialog_alert).setView(
+                        warningsView).setPositiveButton(R.string.ssl_continue,
+                        new DialogInterface.OnClickListener() {
+                            public void onClick(DialogInterface dialog,
+                                    int whichButton) {
+                                handler.proceed();
+                            }
+                        }).setNeutralButton(R.string.view_certificate,
+                        new DialogInterface.OnClickListener() {
+                            public void onClick(DialogInterface dialog,
+                                    int whichButton) {
+                                mActivity.showSSLCertificateOnError(view,
+                                        handler, error);
+                            }
+                        }).setNegativeButton(R.string.cancel,
+                        new DialogInterface.OnClickListener() {
+                            public void onClick(DialogInterface dialog,
+                                    int whichButton) {
+                                handler.cancel();
+                                mActivity.resetTitleAndRevertLockIcon();
+                            }
+                        }).setOnCancelListener(
+                        new DialogInterface.OnCancelListener() {
+                            public void onCancel(DialogInterface dialog) {
+                                handler.cancel();
+                                mActivity.resetTitleAndRevertLockIcon();
+                            }
+                        }).show();
+            } else {
+                handler.proceed();
+            }
+        }
+
+        /**
+         * Handles an HTTP authentication request.
+         *
+         * @param handler The authentication handler
+         * @param host The host
+         * @param realm The realm
+         */
+        @Override
+        public void onReceivedHttpAuthRequest(WebView view,
+                final HttpAuthHandler handler, final String host,
+                final String realm) {
+            String username = null;
+            String password = null;
+
+            boolean reuseHttpAuthUsernamePassword = handler
+                    .useHttpAuthUsernamePassword();
+
+            if (reuseHttpAuthUsernamePassword && mMainView != null) {
+                String[] credentials = mMainView.getHttpAuthUsernamePassword(
+                        host, realm);
+                if (credentials != null && credentials.length == 2) {
+                    username = credentials[0];
+                    password = credentials[1];
+                }
+            }
+
+            if (username != null && password != null) {
+                handler.proceed(username, password);
+            } else {
+                if (mInForeground) {
+                    mActivity.showHttpAuthentication(handler, host, realm,
+                            null, null, null, 0);
+                } else {
+                    handler.cancel();
+                }
+            }
+        }
+
+        @Override
+        public boolean shouldOverrideKeyEvent(WebView view, KeyEvent event) {
+            if (!mInForeground) {
+                return false;
+            }
+            if (mActivity.isMenuDown()) {
+                // only check shortcut key when MENU is held
+                return mActivity.getWindow().isShortcutKey(event.getKeyCode(),
+                        event);
+            } else {
+                return false;
+            }
+        }
+
+        @Override
+        public void onUnhandledKeyEvent(WebView view, KeyEvent event) {
+            if (!mInForeground) {
+                return;
+            }
+            if (event.isDown()) {
+                mActivity.onKeyDown(event.getKeyCode(), event);
+            } else {
+                mActivity.onKeyUp(event.getKeyCode(), event);
+            }
+        }
+    };
+
+    // -------------------------------------------------------------------------
+    // WebChromeClient implementation for the main WebView
+    // -------------------------------------------------------------------------
+
+    private final WebChromeClient mWebChromeClient = new WebChromeClient() {
+        // Helper method to create a new tab or sub window.
+        private void createWindow(final boolean dialog, final Message msg) {
+            WebView.WebViewTransport transport =
+                    (WebView.WebViewTransport) msg.obj;
+            if (dialog) {
+                createSubWindow();
+                mActivity.attachSubWindow(Tab.this);
+                transport.setWebView(mSubView);
+            } else {
+                final Tab newTab = mActivity.openTabAndShow(
+                        BrowserActivity.EMPTY_URL_DATA, false, null);
+                if (newTab != Tab.this) {
+                    Tab.this.addChildTab(newTab);
+                }
+                transport.setWebView(newTab.getWebView());
+            }
+            msg.sendToTarget();
+        }
+
+        @Override
+        public boolean onCreateWindow(WebView view, final boolean dialog,
+                final boolean userGesture, final Message resultMsg) {
+            // only allow new window or sub window for the foreground case
+            if (!mInForeground) {
+                return false;
+            }
+            // Short-circuit if we can't create any more tabs or sub windows.
+            if (dialog && mSubView != null) {
+                new AlertDialog.Builder(mActivity)
+                        .setTitle(R.string.too_many_subwindows_dialog_title)
+                        .setIcon(android.R.drawable.ic_dialog_alert)
+                        .setMessage(R.string.too_many_subwindows_dialog_message)
+                        .setPositiveButton(R.string.ok, null)
+                        .show();
+                return false;
+            } else if (!mActivity.getTabControl().canCreateNewTab()) {
+                new AlertDialog.Builder(mActivity)
+                        .setTitle(R.string.too_many_windows_dialog_title)
+                        .setIcon(android.R.drawable.ic_dialog_alert)
+                        .setMessage(R.string.too_many_windows_dialog_message)
+                        .setPositiveButton(R.string.ok, null)
+                        .show();
+                return false;
+            }
+
+            // Short-circuit if this was a user gesture.
+            if (userGesture) {
+                createWindow(dialog, resultMsg);
+                return true;
+            }
+
+            // Allow the popup and create the appropriate window.
+            final AlertDialog.OnClickListener allowListener =
+                    new AlertDialog.OnClickListener() {
+                        public void onClick(DialogInterface d,
+                                int which) {
+                            createWindow(dialog, resultMsg);
+                        }
+                    };
+
+            // Block the popup by returning a null WebView.
+            final AlertDialog.OnClickListener blockListener =
+                    new AlertDialog.OnClickListener() {
+                        public void onClick(DialogInterface d, int which) {
+                            resultMsg.sendToTarget();
+                        }
+                    };
+
+            // Build a confirmation dialog to display to the user.
+            final AlertDialog d =
+                    new AlertDialog.Builder(mActivity)
+                    .setTitle(R.string.attention)
+                    .setIcon(android.R.drawable.ic_dialog_alert)
+                    .setMessage(R.string.popup_window_attempt)
+                    .setPositiveButton(R.string.allow, allowListener)
+                    .setNegativeButton(R.string.block, blockListener)
+                    .setCancelable(false)
+                    .create();
+
+            // Show the confirmation dialog.
+            d.show();
+            return true;
+        }
+
+        @Override
+        public void onRequestFocus(WebView view) {
+            if (!mInForeground) {
+                mActivity.switchToTab(mActivity.getTabControl().getTabIndex(
+                        Tab.this));
+            }
+        }
+
+        @Override
+        public void onCloseWindow(WebView window) {
+            if (mParentTab != null) {
+                // JavaScript can only close popup window.
+                if (mInForeground) {
+                    mActivity.switchToTab(mActivity.getTabControl()
+                            .getTabIndex(mParentTab));
+                }
+                mActivity.closeTab(Tab.this);
+            }
+        }
+
+        @Override
+        public void onProgressChanged(WebView view, int newProgress) {
+            if (newProgress == 100) {
+                // sync cookies and cache promptly here.
+                CookieSyncManager.getInstance().sync();
+            }
+            if (mInForeground) {
+                mActivity.onProgressChanged(view, newProgress);
+            }
+        }
+
+        @Override
+        public void onReceivedTitle(WebView view, String title) {
+            String url = view.getUrl();
+            if (mInForeground) {
+                // here, if url is null, we want to reset the title
+                mActivity.setUrlTitle(url, title);
+            }
+            if (url == null ||
+                url.length() >= SQLiteDatabase.SQLITE_MAX_LIKE_PATTERN_LENGTH) {
+                return;
+            }
+            // See if we can find the current url in our history database and
+            // add the new title to it.
+            if (url.startsWith("http://www.")) {
+                url = url.substring(11);
+            } else if (url.startsWith("http://")) {
+                url = url.substring(4);
+            }
+            try {
+                final ContentResolver cr = mActivity.getContentResolver();
+                url = "%" + url;
+                String [] selArgs = new String[] { url };
+                String where = Browser.BookmarkColumns.URL + " LIKE ? AND "
+                        + Browser.BookmarkColumns.BOOKMARK + " = 0";
+                Cursor c = cr.query(Browser.BOOKMARKS_URI,
+                        Browser.HISTORY_PROJECTION, where, selArgs, null);
+                if (c.moveToFirst()) {
+                    // Current implementation of database only has one entry per
+                    // url.
+                    ContentValues map = new ContentValues();
+                    map.put(Browser.BookmarkColumns.TITLE, title);
+                    cr.update(Browser.BOOKMARKS_URI, map, "_id = "
+                            + c.getInt(0), null);
+                }
+                c.close();
+            } catch (IllegalStateException e) {
+                Log.e(LOGTAG, "Tab onReceived title", e);
+            } catch (SQLiteException ex) {
+                Log.e(LOGTAG, "onReceivedTitle() caught SQLiteException: ", ex);
+            }
+        }
+
+        @Override
+        public void onReceivedIcon(WebView view, Bitmap icon) {
+            if (icon != null) {
+                BrowserBookmarksAdapter.updateBookmarkFavicon(mActivity
+                        .getContentResolver(), view.getOriginalUrl(), view
+                        .getUrl(), icon);
+            }
+            if (mInForeground) {
+                mActivity.setFavicon(icon);
+            }
+        }
+
+        @Override
+        public void onReceivedTouchIconUrl(WebView view, String url,
+                boolean precomposed) {
+            final ContentResolver cr = mActivity.getContentResolver();
+            final Cursor c = BrowserBookmarksAdapter.queryBookmarksForUrl(cr,
+                            view.getOriginalUrl(), view.getUrl(), true);
+            if (c != null) {
+                if (c.getCount() > 0) {
+                    // Let precomposed icons take precedence over non-composed
+                    // icons.
+                    if (precomposed && mTouchIconLoader != null) {
+                        mTouchIconLoader.cancel(false);
+                        mTouchIconLoader = null;
+                    }
+                    // Have only one async task at a time.
+                    if (mTouchIconLoader == null) {
+                        mTouchIconLoader = new DownloadTouchIcon(Tab.this, cr,
+                                c, view);
+                        mTouchIconLoader.execute(url);
+                    }
+                } else {
+                    c.close();
+                }
+            }
+        }
+
+        @Override
+        public void onShowCustomView(View view,
+                WebChromeClient.CustomViewCallback callback) {
+            if (mInForeground) mActivity.onShowCustomView(view, callback);
+        }
+
+        @Override
+        public void onHideCustomView() {
+            if (mInForeground) mActivity.onHideCustomView();
+        }
+
+        /**
+         * The origin has exceeded its database quota.
+         * @param url the URL that exceeded the quota
+         * @param databaseIdentifier the identifier of the database on which the
+         *            transaction that caused the quota overflow was run
+         * @param currentQuota the current quota for the origin.
+         * @param estimatedSize the estimated size of the database.
+         * @param totalUsedQuota is the sum of all origins' quota.
+         * @param quotaUpdater The callback to run when a decision to allow or
+         *            deny quota has been made. Don't forget to call this!
+         */
+        @Override
+        public void onExceededDatabaseQuota(String url,
+            String databaseIdentifier, long currentQuota, long estimatedSize,
+            long totalUsedQuota, WebStorage.QuotaUpdater quotaUpdater) {
+            BrowserSettings.getInstance().getWebStorageSizeManager()
+                    .onExceededDatabaseQuota(url, databaseIdentifier,
+                            currentQuota, estimatedSize, totalUsedQuota,
+                            quotaUpdater);
+        }
+
+        /**
+         * The Application Cache has exceeded its max size.
+         * @param spaceNeeded is the amount of disk space that would be needed
+         *            in order for the last appcache operation to succeed.
+         * @param totalUsedQuota is the sum of all origins' quota.
+         * @param quotaUpdater A callback to inform the WebCore thread that a
+         *            new app cache size is available. This callback must always
+         *            be executed at some point to ensure that the sleeping
+         *            WebCore thread is woken up.
+         */
+        @Override
+        public void onReachedMaxAppCacheSize(long spaceNeeded,
+                long totalUsedQuota, WebStorage.QuotaUpdater quotaUpdater) {
+            BrowserSettings.getInstance().getWebStorageSizeManager()
+                    .onReachedMaxAppCacheSize(spaceNeeded, totalUsedQuota,
+                            quotaUpdater);
+        }
+
+        /**
+         * Instructs the browser to show a prompt to ask the user to set the
+         * Geolocation permission state for the specified origin.
+         * @param origin The origin for which Geolocation permissions are
+         *     requested.
+         * @param callback The callback to call once the user has set the
+         *     Geolocation permission state.
+         */
+        @Override
+        public void onGeolocationPermissionsShowPrompt(String origin,
+                GeolocationPermissions.Callback callback) {
+            if (mInForeground) {
+                mGeolocationPermissionsPrompt.show(origin, callback);
+            }
+        }
+
+        /**
+         * Instructs the browser to hide the Geolocation permissions prompt.
+         */
+        @Override
+        public void onGeolocationPermissionsHidePrompt() {
+            if (mInForeground) {
+                mGeolocationPermissionsPrompt.hide();
+            }
+        }
+
+        /* Adds a JavaScript error message to the system log.
+         * @param message The error message to report.
+         * @param lineNumber The line number of the error.
+         * @param sourceID The name of the source file that caused the error.
+         */
+        @Override
+        public void addMessageToConsole(String message, int lineNumber,
+                String sourceID) {
+            if (mInForeground) {
+                // call getErrorConsole(true) so it will create one if needed
+                ErrorConsoleView errorConsole = getErrorConsole(true);
+                errorConsole.addErrorMessage(message, sourceID, lineNumber);
+                if (mActivity.shouldShowErrorConsole()
+                        && errorConsole.getShowState() != ErrorConsoleView.SHOW_MAXIMIZED) {
+                    errorConsole.showConsole(ErrorConsoleView.SHOW_MINIMIZED);
+                }
+            }
+            Log.w(LOGTAG, "Console: " + message + " " + sourceID + ":"
+                    + lineNumber);
+        }
+
+        /**
+         * Ask the browser for an icon to represent a <video> element.
+         * This icon will be used if the Web page did not specify a poster attribute.
+         * @return Bitmap The icon or null if no such icon is available.
+         */
+        @Override
+        public Bitmap getDefaultVideoPoster() {
+            if (mInForeground) {
+                return mActivity.getDefaultVideoPoster();
+            }
+            return null;
+        }
+
+        /**
+         * Ask the host application for a custom progress view to show while
+         * a <video> is loading.
+         * @return View The progress view.
+         */
+        @Override
+        public View getVideoLoadingProgressView() {
+            if (mInForeground) {
+                return mActivity.getVideoLoadingProgressView();
+            }
+            return null;
+        }
+
+        @Override
+        public void openFileChooser(ValueCallback<Uri> uploadMsg) {
+            if (mInForeground) {
+                mActivity.openFileChooser(uploadMsg);
+            } else {
+                uploadMsg.onReceiveValue(null);
+            }
+        }
+
+        /**
+         * Deliver a list of already-visited URLs
+         */
+        @Override
+        public void getVisitedHistory(final ValueCallback<String[]> callback) {
+            AsyncTask<Void, Void, String[]> task = new AsyncTask<Void, Void, String[]>() {
+                public String[] doInBackground(Void... unused) {
+                    return Browser.getVisitedHistory(mActivity
+                            .getContentResolver());
+                }
+                public void onPostExecute(String[] result) {
+                    callback.onReceiveValue(result);
+                };
+            };
+            task.execute();
+        };
+    };
+
+    // -------------------------------------------------------------------------
+    // WebViewClient implementation for the sub window
+    // -------------------------------------------------------------------------
+
+    // Subclass of WebViewClient used in subwindows to notify the main
+    // WebViewClient of certain WebView activities.
+    private static class SubWindowClient extends WebViewClient {
+        // The main WebViewClient.
+        private final WebViewClient mClient;
+
+        SubWindowClient(WebViewClient client) {
+            mClient = client;
+        }
+        @Override
+        public void doUpdateVisitedHistory(WebView view, String url,
+                boolean isReload) {
+            mClient.doUpdateVisitedHistory(view, url, isReload);
+        }
+        @Override
+        public boolean shouldOverrideUrlLoading(WebView view, String url) {
+            return mClient.shouldOverrideUrlLoading(view, url);
+        }
+        @Override
+        public void onReceivedSslError(WebView view, SslErrorHandler handler,
+                SslError error) {
+            mClient.onReceivedSslError(view, handler, error);
+        }
+        @Override
+        public void onReceivedHttpAuthRequest(WebView view,
+                HttpAuthHandler handler, String host, String realm) {
+            mClient.onReceivedHttpAuthRequest(view, handler, host, realm);
+        }
+        @Override
+        public void onFormResubmission(WebView view, Message dontResend,
+                Message resend) {
+            mClient.onFormResubmission(view, dontResend, resend);
+        }
+        @Override
+        public void onReceivedError(WebView view, int errorCode,
+                String description, String failingUrl) {
+            mClient.onReceivedError(view, errorCode, description, failingUrl);
+        }
+        @Override
+        public boolean shouldOverrideKeyEvent(WebView view,
+                android.view.KeyEvent event) {
+            return mClient.shouldOverrideKeyEvent(view, event);
+        }
+        @Override
+        public void onUnhandledKeyEvent(WebView view,
+                android.view.KeyEvent event) {
+            mClient.onUnhandledKeyEvent(view, event);
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // WebChromeClient implementation for the sub window
+    // -------------------------------------------------------------------------
+
+    private class SubWindowChromeClient extends WebChromeClient {
+        // The main WebChromeClient.
+        private final WebChromeClient mClient;
+
+        SubWindowChromeClient(WebChromeClient client) {
+            mClient = client;
+        }
+        @Override
+        public void onProgressChanged(WebView view, int newProgress) {
+            mClient.onProgressChanged(view, newProgress);
+        }
+        @Override
+        public boolean onCreateWindow(WebView view, boolean dialog,
+                boolean userGesture, android.os.Message resultMsg) {
+            return mClient.onCreateWindow(view, dialog, userGesture, resultMsg);
+        }
+        @Override
+        public void onCloseWindow(WebView window) {
+            if (window != mSubView) {
+                Log.e(LOGTAG, "Can't close the window");
+            }
+            mActivity.dismissSubWindow(Tab.this);
+        }
+    }
+
+    // -------------------------------------------------------------------------
+
+    // Construct a new tab
+    Tab(BrowserActivity activity, WebView w, boolean closeOnExit, String appId,
+            String url) {
+        mActivity = activity;
+        mCloseOnExit = closeOnExit;
+        mAppId = appId;
+        mOriginalUrl = url;
+        mLockIconType = BrowserActivity.LOCK_ICON_UNSECURE;
+        mPrevLockIconType = BrowserActivity.LOCK_ICON_UNSECURE;
+        mInLoad = false;
+        mInForeground = false;
+
+        mInflateService = LayoutInflater.from(activity);
+
+        // The tab consists of a container view, which contains the main
+        // WebView, as well as any other UI elements associated with the tab.
+        mContainer = mInflateService.inflate(R.layout.tab, null);
+
+        mGeolocationPermissionsPrompt =
+            (GeolocationPermissionsPrompt) mContainer.findViewById(
+                R.id.geolocation_permissions_prompt);
+
+        setWebView(w);
+    }
+
+    /**
+     * Sets the WebView for this tab, correctly removing the old WebView from
+     * the container view.
+     */
+    void setWebView(WebView w) {
+        if (mMainView == w) {
+            return;
+        }
+        // If the WebView is changing, the page will be reloaded, so any ongoing
+        // Geolocation permission requests are void.
+        mGeolocationPermissionsPrompt.hide();
+
+        // Just remove the old one.
+        FrameLayout wrapper =
+                (FrameLayout) mContainer.findViewById(R.id.webview_wrapper);
+        wrapper.removeView(mMainView);
+
+        // set the new one
+        mMainView = w;
+        // attached the WebViewClient and WebChromeClient
+        if (mMainView != null) {
+            mMainView.setWebViewClient(mWebViewClient);
+            mMainView.setWebChromeClient(mWebChromeClient);
+        }
+    }
+
+    /**
+     * Destroy the tab's main WebView and subWindow if any
+     */
+    void destroy() {
+        if (mMainView != null) {
+            dismissSubWindow();
+            BrowserSettings.getInstance().deleteObserver(mMainView.getSettings());
+            // save the WebView to call destroy() after detach it from the tab
+            WebView webView = mMainView;
+            setWebView(null);
+            webView.destroy();
+        }
+    }
+
+    /**
+     * Remove the tab from the parent
+     */
+    void removeFromTree() {
+        // detach the children
+        if (mChildTabs != null) {
+            for(Tab t : mChildTabs) {
+                t.setParentTab(null);
+            }
+        }
+        // remove itself from the parent list
+        if (mParentTab != null) {
+            mParentTab.mChildTabs.remove(this);
+        }
+    }
+
+    /**
+     * Create a new subwindow unless a subwindow already exists.
+     * @return True if a new subwindow was created. False if one already exists.
+     */
+    boolean createSubWindow() {
+        if (mSubView == null) {
+            mSubViewContainer = mInflateService.inflate(
+                    R.layout.browser_subwindow, null);
+            mSubView = (WebView) mSubViewContainer.findViewById(R.id.webview);
+            // use trackball directly
+            mSubView.setMapTrackballToArrowKeys(false);
+            mSubView.setWebViewClient(new SubWindowClient(mWebViewClient));
+            mSubView.setWebChromeClient(new SubWindowChromeClient(
+                    mWebChromeClient));
+            mSubView.setDownloadListener(mActivity);
+            mSubView.setOnCreateContextMenuListener(mActivity);
+            final BrowserSettings s = BrowserSettings.getInstance();
+            s.addObserver(mSubView.getSettings()).update(s, null);
+            final ImageButton cancel = (ImageButton) mSubViewContainer
+                    .findViewById(R.id.subwindow_close);
+            cancel.setOnClickListener(new OnClickListener() {
+                public void onClick(View v) {
+                    mSubView.getWebChromeClient().onCloseWindow(mSubView);
+                }
+            });
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Dismiss the subWindow for the tab.
+     */
+    void dismissSubWindow() {
+        if (mSubView != null) {
+            BrowserSettings.getInstance().deleteObserver(
+                    mSubView.getSettings());
+            mSubView.destroy();
+            mSubView = null;
+            mSubViewContainer = null;
+        }
+    }
+
+    /**
+     * Attach the sub window to the content view.
+     */
+    void attachSubWindow(ViewGroup content) {
+        if (mSubView != null) {
+            content.addView(mSubViewContainer,
+                    BrowserActivity.COVER_SCREEN_PARAMS);
+        }
+    }
+
+    /**
+     * Remove the sub window from the content view.
+     */
+    void removeSubWindow(ViewGroup content) {
+        if (mSubView != null) {
+            content.removeView(mSubViewContainer);
+        }
+    }
+
+    /**
+     * This method attaches both the WebView and any sub window to the
+     * given content view.
+     */
+    void attachTabToContentView(ViewGroup content) {
+        if (mMainView == null) {
+            return;
+        }
+
+        // Attach the WebView to the container and then attach the
+        // container to the content view.
+        FrameLayout wrapper =
+                (FrameLayout) mContainer.findViewById(R.id.webview_wrapper);
+        wrapper.addView(mMainView);
+        content.addView(mContainer, BrowserActivity.COVER_SCREEN_PARAMS);
+        attachSubWindow(content);
+    }
+
+    /**
+     * Remove the WebView and any sub window from the given content view.
+     */
+    void removeTabFromContentView(ViewGroup content) {
+        if (mMainView == null) {
+            return;
+        }
+
+        // Remove the container from the content and then remove the
+        // WebView from the container. This will trigger a focus change
+        // needed by WebView.
+        FrameLayout wrapper =
+                (FrameLayout) mContainer.findViewById(R.id.webview_wrapper);
+        wrapper.removeView(mMainView);
+        content.removeView(mContainer);
+        removeSubWindow(content);
+    }
+
+    /**
+     * Set the parent tab of this tab.
+     */
+    void setParentTab(Tab parent) {
+        mParentTab = parent;
+        // This tab may have been freed due to low memory. If that is the case,
+        // the parent tab index is already saved. If we are changing that index
+        // (most likely due to removing the parent tab) we must update the
+        // parent tab index in the saved Bundle.
+        if (mSavedState != null) {
+            if (parent == null) {
+                mSavedState.remove(PARENTTAB);
+            } else {
+                mSavedState.putInt(PARENTTAB, mActivity.getTabControl()
+                        .getTabIndex(parent));
+            }
+        }
+    }
+
+    /**
+     * When a Tab is created through the content of another Tab, then we
+     * associate the Tabs.
+     * @param child the Tab that was created from this Tab
+     */
+    void addChildTab(Tab child) {
+        if (mChildTabs == null) {
+            mChildTabs = new Vector<Tab>();
+        }
+        mChildTabs.add(child);
+        child.setParentTab(this);
+    }
+
+    Vector<Tab> getChildTabs() {
+        return mChildTabs;
+    }
+
+    void resume() {
+        if (mMainView != null) {
+            mMainView.onResume();
+            if (mSubView != null) {
+                mSubView.onResume();
+            }
+        }
+    }
+
+    void pause() {
+        if (mMainView != null) {
+            mMainView.onPause();
+            if (mSubView != null) {
+                mSubView.onPause();
+            }
+        }
+    }
+
+    void putInForeground() {
+        mInForeground = true;
+        resume();
+        mMainView.setOnCreateContextMenuListener(mActivity);
+        if (mSubView != null) {
+            mSubView.setOnCreateContextMenuListener(mActivity);
+        }
+        // Show the pending error dialog if the queue is not empty
+        if (mQueuedErrors != null && mQueuedErrors.size() >  0) {
+            showError(mQueuedErrors.getFirst());
+        }
+    }
+
+    void putInBackground() {
+        mInForeground = false;
+        pause();
+        mMainView.setOnCreateContextMenuListener(null);
+        if (mSubView != null) {
+            mSubView.setOnCreateContextMenuListener(null);
+        }
+    }
+
+    /**
+     * Return the top window of this tab; either the subwindow if it is not
+     * null or the main window.
+     * @return The top window of this tab.
+     */
+    WebView getTopWindow() {
+        if (mSubView != null) {
+            return mSubView;
+        }
+        return mMainView;
+    }
+
+    /**
+     * Return the main window of this tab. Note: if a tab is freed in the
+     * background, this can return null. It is only guaranteed to be
+     * non-null for the current tab.
+     * @return The main WebView of this tab.
+     */
+    WebView getWebView() {
+        return mMainView;
+    }
+
+    /**
+     * Return the subwindow of this tab or null if there is no subwindow.
+     * @return The subwindow of this tab or null.
+     */
+    WebView getSubWebView() {
+        return mSubView;
+    }
+
+    /**
+     * @return The geolocation permissions prompt for this tab.
+     */
+    GeolocationPermissionsPrompt getGeolocationPermissionsPrompt() {
+        return mGeolocationPermissionsPrompt;
+    }
+
+    /**
+     * @return The application id string
+     */
+    String getAppId() {
+        return mAppId;
+    }
+
+    /**
+     * Set the application id string
+     * @param id
+     */
+    void setAppId(String id) {
+        mAppId = id;
+    }
+
+    /**
+     * @return The original url associated with this Tab
+     */
+    String getOriginalUrl() {
+        return mOriginalUrl;
+    }
+
+    /**
+     * Set the original url associated with this tab
+     */
+    void setOriginalUrl(String url) {
+        mOriginalUrl = url;
+    }
+
+    /**
+     * Get the url of this tab. Valid after calling populatePickerData, but
+     * before calling wipePickerData, or if the webview has been destroyed.
+     * @return The WebView's url or null.
+     */
+    String getUrl() {
+        if (mPickerData != null) {
+            return mPickerData.mUrl;
+        }
+        return null;
+    }
+
+    /**
+     * Get the title of this tab. Valid after calling populatePickerData, but
+     * before calling wipePickerData, or if the webview has been destroyed. If
+     * the url has no title, use the url instead.
+     * @return The WebView's title (or url) or null.
+     */
+    String getTitle() {
+        if (mPickerData != null) {
+            return mPickerData.mTitle;
+        }
+        return null;
+    }
+
+    /**
+     * Get the favicon of this tab. Valid after calling populatePickerData, but
+     * before calling wipePickerData, or if the webview has been destroyed.
+     * @return The WebView's favicon or null.
+     */
+    Bitmap getFavicon() {
+        if (mPickerData != null) {
+            return mPickerData.mFavicon;
+        }
+        return null;
+    }
+
+    /**
+     * Return the tab's error console. Creates the console if createIfNEcessary
+     * is true and we haven't already created the console.
+     * @param createIfNecessary Flag to indicate if the console should be
+     *            created if it has not been already.
+     * @return The tab's error console, or null if one has not been created and
+     *         createIfNecessary is false.
+     */
+    ErrorConsoleView getErrorConsole(boolean createIfNecessary) {
+        if (createIfNecessary && mErrorConsole == null) {
+            mErrorConsole = new ErrorConsoleView(mActivity);
+            mErrorConsole.setWebView(mMainView);
+        }
+        return mErrorConsole;
+    }
+
+    /**
+     * If this Tab was created through another Tab, then this method returns
+     * that Tab.
+     * @return the Tab parent or null
+     */
+    public Tab getParentTab() {
+        return mParentTab;
+    }
+
+    /**
+     * Return whether this tab should be closed when it is backing out of the
+     * first page.
+     * @return TRUE if this tab should be closed when exit.
+     */
+    boolean closeOnExit() {
+        return mCloseOnExit;
+    }
+
+    /**
+     * Saves the current lock-icon state before resetting the lock icon. If we
+     * have an error, we may need to roll back to the previous state.
+     */
+    void resetLockIcon(String url) {
+        mPrevLockIconType = mLockIconType;
+        mLockIconType = BrowserActivity.LOCK_ICON_UNSECURE;
+        if (URLUtil.isHttpsUrl(url)) {
+            mLockIconType = BrowserActivity.LOCK_ICON_SECURE;
+        }
+    }
+
+    /**
+     * Reverts the lock-icon state to the last saved state, for example, if we
+     * had an error, and need to cancel the load.
+     */
+    void revertLockIcon() {
+        mLockIconType = mPrevLockIconType;
+    }
+
+    /**
+     * @return The tab's lock icon type.
+     */
+    int getLockIconType() {
+        return mLockIconType;
+    }
+
+    /**
+     * @return TRUE if onPageStarted is called while onPageFinished is not
+     *         called yet.
+     */
+    boolean inLoad() {
+        return mInLoad;
+    }
+
+    // force mInLoad to be false. This should only be called before closing the
+    // tab to ensure BrowserActivity's pauseWebViewTimers() is called correctly.
+    void clearInLoad() {
+        mInLoad = false;
+    }
+
+    void populatePickerData() {
+        if (mMainView == null) {
+            populatePickerDataFromSavedState();
+            return;
+        }
+
+        // FIXME: The only place we cared about subwindow was for
+        // bookmarking (i.e. not when saving state). Was this deliberate?
+        final WebBackForwardList list = mMainView.copyBackForwardList();
+        final WebHistoryItem item = list != null ? list.getCurrentItem() : null;
+        populatePickerData(item);
+    }
+
+    // Populate the picker data using the given history item and the current top
+    // WebView.
+    private void populatePickerData(WebHistoryItem item) {
+        mPickerData = new PickerData();
+        if (item != null) {
+            mPickerData.mUrl = item.getUrl();
+            mPickerData.mTitle = item.getTitle();
+            mPickerData.mFavicon = item.getFavicon();
+            if (mPickerData.mTitle == null) {
+                mPickerData.mTitle = mPickerData.mUrl;
+            }
+        }
+    }
+
+    // Create the PickerData and populate it using the saved state of the tab.
+    void populatePickerDataFromSavedState() {
+        if (mSavedState == null) {
+            return;
+        }
+        mPickerData = new PickerData();
+        mPickerData.mUrl = mSavedState.getString(CURRURL);
+        mPickerData.mTitle = mSavedState.getString(CURRTITLE);
+    }
+
+    void clearPickerData() {
+        mPickerData = null;
+    }
+
+    /**
+     * Get the saved state bundle.
+     * @return
+     */
+    Bundle getSavedState() {
+        return mSavedState;
+    }
+
+    /**
+     * Set the saved state.
+     */
+    void setSavedState(Bundle state) {
+        mSavedState = state;
+    }
+
+    /**
+     * @return TRUE if succeed in saving the state.
+     */
+    boolean saveState() {
+        // If the WebView is null it means we ran low on memory and we already
+        // stored the saved state in mSavedState.
+        if (mMainView == null) {
+            return mSavedState != null;
+        }
+
+        mSavedState = new Bundle();
+        final WebBackForwardList list = mMainView.saveState(mSavedState);
+        if (list != null) {
+            final File f = new File(mActivity.getTabControl().getThumbnailDir(),
+                    mMainView.hashCode() + "_pic.save");
+            if (mMainView.savePicture(mSavedState, f)) {
+                mSavedState.putString(CURRPICTURE, f.getPath());
+            }
+        }
+
+        // Store some extra info for displaying the tab in the picker.
+        final WebHistoryItem item = list != null ? list.getCurrentItem() : null;
+        populatePickerData(item);
+
+        if (mPickerData.mUrl != null) {
+            mSavedState.putString(CURRURL, mPickerData.mUrl);
+        }
+        if (mPickerData.mTitle != null) {
+            mSavedState.putString(CURRTITLE, mPickerData.mTitle);
+        }
+        mSavedState.putBoolean(CLOSEONEXIT, mCloseOnExit);
+        if (mAppId != null) {
+            mSavedState.putString(APPID, mAppId);
+        }
+        if (mOriginalUrl != null) {
+            mSavedState.putString(ORIGINALURL, mOriginalUrl);
+        }
+        // Remember the parent tab so the relationship can be restored.
+        if (mParentTab != null) {
+            mSavedState.putInt(PARENTTAB, mActivity.getTabControl().getTabIndex(
+                    mParentTab));
+        }
+        return true;
+    }
+
+    /*
+     * Restore the state of the tab.
+     */
+    boolean restoreState(Bundle b) {
+        if (b == null) {
+            return false;
+        }
+        // Restore the internal state even if the WebView fails to restore.
+        // This will maintain the app id, original url and close-on-exit values.
+        mSavedState = null;
+        mPickerData = null;
+        mCloseOnExit = b.getBoolean(CLOSEONEXIT);
+        mAppId = b.getString(APPID);
+        mOriginalUrl = b.getString(ORIGINALURL);
+
+        final WebBackForwardList list = mMainView.restoreState(b);
+        if (list == null) {
+            return false;
+        }
+        if (b.containsKey(CURRPICTURE)) {
+            final File f = new File(b.getString(CURRPICTURE));
+            mMainView.restorePicture(b, f);
+            f.delete();
+        }
+        return true;
+    }
+}
diff --git a/src/com/android/browser/TabControl.java b/src/com/android/browser/TabControl.java
index 40f6c31..8373182 100644
--- a/src/com/android/browser/TabControl.java
+++ b/src/com/android/browser/TabControl.java
@@ -16,33 +16,13 @@
 
 package com.android.browser;
 
-import android.content.Context;
-import android.graphics.Bitmap;
-import android.graphics.Picture;
-import android.net.http.SslError;
 import android.os.Bundle;
-import android.os.Message;
 import android.util.Log;
-import android.view.Gravity;
-import android.view.LayoutInflater;
 import android.view.View;
-import android.view.ViewGroup;
-import android.view.View.OnClickListener;
-import android.webkit.HttpAuthHandler;
-import android.webkit.JsPromptResult;
-import android.webkit.JsResult;
-import android.webkit.SslErrorHandler;
 import android.webkit.WebBackForwardList;
-import android.webkit.WebChromeClient;
-import android.webkit.WebHistoryItem;
 import android.webkit.WebView;
-import android.webkit.WebViewClient;
-import android.widget.FrameLayout;
-import android.widget.ImageButton;
-import android.widget.LinearLayout;
 
 import java.io.File;
-import java.io.FileInputStream;
 import java.util.ArrayList;
 import java.util.Vector;
 
@@ -50,13 +30,7 @@
     // Log Tag
     private static final String LOGTAG = "TabControl";
     // Maximum number of tabs.
-    static final int MAX_TABS = 8;
-    // Static instance of an empty callback.
-    private static final WebViewClient mEmptyClient =
-            new WebViewClient();
-    // Instance of BackgroundChromeClient for background tabs.
-    private final BackgroundChromeClient mBackgroundChromeClient =
-            new BackgroundChromeClient();
+    private static final int MAX_TABS = 8;
     // Private array of WebViews that are used as tabs.
     private ArrayList<Tab> mTabs = new ArrayList<Tab>(MAX_TABS);
     // Queue of most recently viewed tabs.
@@ -66,393 +40,6 @@
     // A private instance of BrowserActivity to interface with when adding and
     // switching between tabs.
     private final BrowserActivity mActivity;
-    // Inflation service for making subwindows.
-    private final LayoutInflater mInflateService;
-    // Subclass of WebViewClient used in subwindows to notify the main
-    // WebViewClient of certain WebView activities.
-    private static class SubWindowClient extends WebViewClient {
-        // The main WebViewClient.
-        private final WebViewClient mClient;
-
-        SubWindowClient(WebViewClient client) {
-            mClient = client;
-        }
-        @Override
-        public void doUpdateVisitedHistory(WebView view, String url,
-                boolean isReload) {
-            mClient.doUpdateVisitedHistory(view, url, isReload);
-        }
-        @Override
-        public boolean shouldOverrideUrlLoading(WebView view, String url) {
-            return mClient.shouldOverrideUrlLoading(view, url);
-        }
-        @Override
-        public void onReceivedSslError(WebView view, SslErrorHandler handler,
-                SslError error) {
-            mClient.onReceivedSslError(view, handler, error);
-        }
-        @Override
-        public void onReceivedHttpAuthRequest(WebView view,
-                HttpAuthHandler handler, String host, String realm) {
-            mClient.onReceivedHttpAuthRequest(view, handler, host, realm);
-        }
-        @Override
-        public void onFormResubmission(WebView view, Message dontResend,
-                Message resend) {
-            mClient.onFormResubmission(view, dontResend, resend);
-        }
-        @Override
-        public void onReceivedError(WebView view, int errorCode,
-                String description, String failingUrl) {
-            mClient.onReceivedError(view, errorCode, description, failingUrl);
-        }
-        @Override
-        public boolean shouldOverrideKeyEvent(WebView view,
-                android.view.KeyEvent event) {
-            return mClient.shouldOverrideKeyEvent(view, event);
-        }
-        @Override
-        public void onUnhandledKeyEvent(WebView view,
-                android.view.KeyEvent event) {
-            mClient.onUnhandledKeyEvent(view, event);
-        }
-    }
-    // Subclass of WebChromeClient to display javascript dialogs.
-    private class SubWindowChromeClient extends WebChromeClient {
-        // This subwindow's tab.
-        private final Tab mTab;
-        // The main WebChromeClient.
-        private final WebChromeClient mClient;
-
-        SubWindowChromeClient(Tab t, WebChromeClient client) {
-            mTab = t;
-            mClient = client;
-        }
-        @Override
-        public void onProgressChanged(WebView view, int newProgress) {
-            mClient.onProgressChanged(view, newProgress);
-        }
-        @Override
-        public boolean onCreateWindow(WebView view, boolean dialog,
-                boolean userGesture, android.os.Message resultMsg) {
-            return mClient.onCreateWindow(view, dialog, userGesture, resultMsg);
-        }
-        @Override
-        public void onCloseWindow(WebView window) {
-            if (Browser.DEBUG && window != mTab.mSubView) {
-                throw new AssertionError("Can't close the window");
-            }
-            mActivity.dismissSubWindow(mTab);
-        }
-    }
-    // Background WebChromeClient for focusing tabs
-    private class BackgroundChromeClient extends WebChromeClient {
-        @Override
-        public void onRequestFocus(WebView view) {
-            Tab t = getTabFromView(view);
-            if (t != getCurrentTab()) {
-                mActivity.switchToTab(getTabIndex(t));
-            }
-        }
-    }
-
-    // Extra saved information for displaying the tab in the picker.
-    public static class PickerData {
-        String  mUrl;
-        String  mTitle;
-        Bitmap  mFavicon;
-        float   mScale;
-        int     mScrollX;
-        int     mScrollY;
-    }
-
-    /**
-     * Private class for maintaining Tabs with a main WebView and a subwindow.
-     */
-    public class Tab {
-        // The Geolocation permissions prompt
-        private GeolocationPermissionsPrompt mGeolocationPermissionsPrompt;
-        private View mContainer;
-        // Main WebView
-        private WebView mMainView;
-        // Subwindow WebView
-        private WebView mSubView;
-        // Subwindow container
-        private View mSubViewContainer;
-        // Subwindow callback
-        private SubWindowClient mSubViewClient;
-        // Subwindow chrome callback
-        private SubWindowChromeClient mSubViewChromeClient;
-        // Saved bundle for when we are running low on memory. It contains the
-        // information needed to restore the WebView if the user goes back to
-        // the tab.
-        private Bundle mSavedState;
-        // Data used when displaying the tab in the picker.
-        private PickerData mPickerData;
-
-        // Parent Tab. This is the Tab that created this Tab, or null
-        // if the Tab was created by the UI
-        private Tab mParentTab;
-        // Tab that constructed by this Tab. This is used when this
-        // Tab is destroyed, it clears all mParentTab values in the 
-        // children.
-        private Vector<Tab> mChildTabs;
-
-        private Boolean mCloseOnExit;
-        // Application identifier used to find tabs that another application
-        // wants to reuse.
-        private String mAppId;
-        // Keep the original url around to avoid killing the old WebView if the
-        // url has not changed.
-        private String mOriginalUrl;
-
-        private ErrorConsoleView mErrorConsole;
-        // the lock icon type and previous lock icon type for the tab
-        private int mSavedLockIconType;
-        private int mSavedPrevLockIconType;
-
-        // Construct a new tab
-        private Tab(WebView w, boolean closeOnExit, String appId, String url, Context context) {
-            mCloseOnExit = closeOnExit;
-            mAppId = appId;
-            mOriginalUrl = url;
-            mSavedLockIconType = BrowserActivity.LOCK_ICON_UNSECURE;
-            mSavedPrevLockIconType = BrowserActivity.LOCK_ICON_UNSECURE;
-
-            // The tab consists of a container view, which contains the main
-            // WebView, as well as any other UI elements associated with the tab.
-            LayoutInflater factory = LayoutInflater.from(context);
-            mContainer = factory.inflate(R.layout.tab, null);
-
-            mGeolocationPermissionsPrompt =
-                (GeolocationPermissionsPrompt) mContainer.findViewById(
-                    R.id.geolocation_permissions_prompt);
-
-            setWebView(w);
-        }
-
-        /**
-         * Sets the WebView for this tab, correctly removing the old WebView
-         * from the container view.
-         */
-        public void setWebView(WebView w) {
-            if (mMainView == w) {
-                return;
-            }
-            // If the WebView is changing, the page will be reloaded, so any ongoing Geolocation
-            // permission requests are void.
-            mGeolocationPermissionsPrompt.hide();
-
-            // Just remove the old one.
-            FrameLayout wrapper =
-                    (FrameLayout) mContainer.findViewById(R.id.webview_wrapper);
-            wrapper.removeView(mMainView);
-            mMainView = w;
-        }
-
-        /**
-         * This method attaches both the WebView and any sub window to the
-         * given content view.
-         */
-        public void attachTabToContentView(ViewGroup content) {
-            if (mMainView == null) {
-                return;
-            }
-
-            // Attach the WebView to the container and then attach the
-            // container to the content view.
-            FrameLayout wrapper =
-                    (FrameLayout) mContainer.findViewById(R.id.webview_wrapper);
-            wrapper.addView(mMainView);
-            content.addView(mContainer, BrowserActivity.COVER_SCREEN_PARAMS);
-            attachSubWindow(content);
-        }
-
-        /**
-         * Remove the WebView and any sub window from the given content view.
-         */
-        public void removeTabFromContentView(ViewGroup content) {
-            if (mMainView == null) {
-                return;
-            }
-
-            // Remove the container from the content and then remove the
-            // WebView from the container. This will trigger a focus change
-            // needed by WebView.
-            FrameLayout wrapper =
-                    (FrameLayout) mContainer.findViewById(R.id.webview_wrapper);
-            wrapper.removeView(mMainView);
-            content.removeView(mContainer);
-            removeSubWindow(content);
-        }
-
-        /**
-         * Attach the sub window to the content view.
-         */
-        public void attachSubWindow(ViewGroup content) {
-            if (mSubView != null) {
-                content.addView(mSubViewContainer,
-                        BrowserActivity.COVER_SCREEN_PARAMS);
-            }
-        }
-
-        /**
-         * Remove the sub window from the content view.
-         */
-        public void removeSubWindow(ViewGroup content) {
-            if (mSubView != null) {
-                content.removeView(mSubViewContainer);
-            }
-        }
-
-        /**
-         * Return the top window of this tab; either the subwindow if it is not
-         * null or the main window.
-         * @return The top window of this tab.
-         */
-        public WebView getTopWindow() {
-            if (mSubView != null) {
-                return mSubView;
-            }
-            return mMainView;
-        }
-
-        /**
-         * Return the main window of this tab. Note: if a tab is freed in the
-         * background, this can return null. It is only guaranteed to be 
-         * non-null for the current tab.
-         * @return The main WebView of this tab.
-         */
-        public WebView getWebView() {
-            return mMainView;
-        }
-
-        /**
-         * @return The geolocation permissions prompt for this tab.
-         */
-        public GeolocationPermissionsPrompt getGeolocationPermissionsPrompt() {
-            return mGeolocationPermissionsPrompt;
-        }
-
-        /**
-         * Return the subwindow of this tab or null if there is no subwindow.
-         * @return The subwindow of this tab or null.
-         */
-        public WebView getSubWebView() {
-            return mSubView;
-        }
-
-        /**
-         * Get the url of this tab.  Valid after calling populatePickerData, but
-         * before calling wipePickerData, or if the webview has been destroyed.
-         * 
-         * @return The WebView's url or null.
-         */
-        public String getUrl() {
-            if (mPickerData != null) {
-                return mPickerData.mUrl;
-            }
-            return null;
-        }
-
-        /**
-         * Get the title of this tab.  Valid after calling populatePickerData, 
-         * but before calling wipePickerData, or if the webview has been 
-         * destroyed.  If the url has no title, use the url instead.
-         * 
-         * @return The WebView's title (or url) or null.
-         */
-        public String getTitle() {
-            if (mPickerData != null) {
-                return mPickerData.mTitle;
-            }
-            return null;
-        }
-
-        public Bitmap getFavicon() {
-            if (mPickerData != null) {
-                return mPickerData.mFavicon;
-            }
-            return null;
-        }
-
-        private void setParentTab(Tab parent) {
-            mParentTab = parent;
-            // This tab may have been freed due to low memory. If that is the
-            // case, the parent tab index is already saved. If we are changing
-            // that index (most likely due to removing the parent tab) we must
-            // update the parent tab index in the saved Bundle.
-            if (mSavedState != null) {
-                if (parent == null) {
-                    mSavedState.remove(PARENTTAB);
-                } else {
-                    mSavedState.putInt(PARENTTAB, getTabIndex(parent));
-                }
-            }
-        }
-        
-        /**
-         * When a Tab is created through the content of another Tab, then 
-         * we associate the Tabs. 
-         * @param child the Tab that was created from this Tab
-         */
-        public void addChildTab(Tab child) {
-            if (mChildTabs == null) {
-                mChildTabs = new Vector<Tab>();
-            }
-            mChildTabs.add(child);
-            child.setParentTab(this);
-        }
-        
-        private void removeFromTree() {
-            // detach the children
-            if (mChildTabs != null) {
-                for(Tab t : mChildTabs) {
-                    t.setParentTab(null);
-                }
-            }
-            
-            // Find myself in my parent list
-            if (mParentTab != null) {
-                mParentTab.mChildTabs.remove(this);
-            }
-        }
-        
-        /**
-         * If this Tab was created through another Tab, then this method
-         * returns that Tab.
-         * @return the Tab parent or null
-         */
-        public Tab getParentTab() {
-            return mParentTab;
-        }
-
-        /**
-         * Return whether this tab should be closed when it is backing out of
-         * the first page.
-         * @return TRUE if this tab should be closed when exit.
-         */
-        public boolean closeOnExit() {
-            return mCloseOnExit;
-        }
-
-        void setLockIconType(int type) {
-            mSavedLockIconType = type;
-        }
-
-        int getLockIconType() {
-            return mSavedLockIconType;
-        }
-
-        void setPrevLockIconType(int type) {
-            mSavedPrevLockIconType = type;
-        }
-
-        int getPrevLockIconType() {
-            return mSavedPrevLockIconType;
-        }
-    };
-
     // Directory to store thumbnails for each WebView.
     private final File mThumbnailDir;
 
@@ -464,9 +51,6 @@
      */
     TabControl(BrowserActivity activity) {
         mActivity = activity;
-        mInflateService =
-                ((LayoutInflater) activity.getSystemService(
-                        Context.LAYOUT_INFLATER_SERVICE));
         mThumbnailDir = activity.getDir("thumbnails", 0);
     }
 
@@ -488,29 +72,7 @@
         if (t == null) {
             return null;
         }
-        return t.mMainView;
-    }
-
-    /**
-     * Return the current tab's error console. Creates the console if createIfNEcessary
-     * is true and we haven't already created the console.
-     * @param createIfNecessary Flag to indicate if the console should be created if it has
-     *                          not been already.
-     * @return The current tab's error console, or null if one has not been created and
-     *         createIfNecessary is false.
-     */
-    ErrorConsoleView getCurrentErrorConsole(boolean createIfNecessary) {
-        Tab t = getTab(mCurrentTab);
-        if (t == null) {
-            return null;
-        }
-
-        if (createIfNecessary && t.mErrorConsole == null) {
-            t.mErrorConsole = new ErrorConsoleView(mActivity);
-            t.mErrorConsole.setWebView(t.mMainView);
-        }
-
-        return t.mErrorConsole;
+        return t.getWebView();
     }
 
     /**
@@ -523,7 +85,7 @@
         if (t == null) {
             return null;
         }
-        return t.mSubView != null ? t.mSubView : t.mMainView;
+        return t.getTopWindow();
     }
 
     /**
@@ -535,7 +97,7 @@
         if (t == null) {
             return null;
         }
-        return t.mSubView;
+        return t.getSubWebView();
     }
 
     /**
@@ -578,6 +140,10 @@
         return mTabs.indexOf(tab);
     }
 
+    boolean canCreateNewTab() {
+        return MAX_TABS != mTabs.size();
+    }
+
     /**
      * Create a new tab.
      * @return The newly createTab or null if we have reached the maximum
@@ -592,10 +158,10 @@
         final WebView w = createNewWebView();
 
         // Create a new tab and add it to the tab list
-        Tab t = new Tab(w, closeOnExit, appId, url, mActivity);
+        Tab t = new Tab(mActivity, w, closeOnExit, appId, url);
         mTabs.add(t);
         // Initially put the tab in the background.
-        putTabInBackground(t);
+        t.putInBackground();
         return t;
     }
 
@@ -616,86 +182,51 @@
         if (t == null) {
             return false;
         }
+
         // Only remove the tab if it is the current one.
         if (getCurrentTab() == t) {
-            putTabInBackground(t);
+            t.putInBackground();
+            mCurrentTab = -1;
         }
 
-        // Only destroy the WebView if it still exists.
-        if (t.mMainView != null) {
-            // Take down the sub window.
-            dismissSubWindow(t);
-            // Remove the WebView's settings from the BrowserSettings list of
-            // observers.
-            BrowserSettings.getInstance().deleteObserver(
-                    t.mMainView.getSettings());
-            WebView w = t.mMainView;
-            t.setWebView(null);
-            // Destroy the main view
-            w.destroy();
-        }
+        // destroy the tab
+        t.destroy();
         // clear it's references to parent and children
         t.removeFromTree();
-        
         // Remove it from our list of tabs.
         mTabs.remove(t);
 
         // The tab indices have shifted, update all the saved state so we point
         // to the correct index.
         for (Tab tab : mTabs) {
-            if (tab.mChildTabs != null) {
-                for (Tab child : tab.mChildTabs) {
+            Vector<Tab> children = tab.getChildTabs();
+            if (children != null) {
+                for (Tab child : children) {
                     child.setParentTab(tab);
                 }
             }
         }
 
-
         // This tab may have been pushed in to the background and then closed.
         // If the saved state contains a picture file, delete the file.
-        if (t.mSavedState != null) {
-            if (t.mSavedState.containsKey(CURRPICTURE)) {
-                new File(t.mSavedState.getString(CURRPICTURE)).delete();
+        Bundle savedState = t.getSavedState();
+        if (savedState != null) {
+            if (savedState.containsKey(Tab.CURRPICTURE)) {
+                new File(savedState.getString(Tab.CURRPICTURE)).delete();
             }
         }
 
         // Remove it from the queue of viewed tabs.
         mTabQueue.remove(t);
-        mCurrentTab = -1;
         return true;
     }
 
     /**
-     * Clear the back/forward list for all the current tabs.
-     */
-    void clearHistory() {
-        int size = getTabCount();
-        for (int i = 0; i < size; i++) {
-            Tab t = mTabs.get(i);
-            // TODO: if a tab is freed due to low memory, its history is not
-            // cleared here.
-            if (t.mMainView != null) {
-                t.mMainView.clearHistory();
-            }
-            if (t.mSubView != null) {
-                t.mSubView.clearHistory();
-            }
-        }
-    }
-
-    /**
      * Destroy all the tabs and subwindows
      */
     void destroy() {
-        BrowserSettings s = BrowserSettings.getInstance();
         for (Tab t : mTabs) {
-            if (t.mMainView != null) {
-                dismissSubWindow(t);
-                s.deleteObserver(t.mMainView.getSettings());
-                WebView w = t.mMainView;
-                t.setWebView(null);
-                w.destroy();
-            }
+            t.destroy();
         }
         mTabs.clear();
         mTabQueue.clear();
@@ -709,17 +240,6 @@
         return mTabs.size();
     }
 
-    // Used for saving and restoring each Tab
-    private static final String WEBVIEW = "webview";
-    private static final String NUMTABS = "numTabs";
-    private static final String CURRTAB = "currentTab";
-    private static final String CURRURL = "currentUrl";
-    private static final String CURRTITLE = "currentTitle";
-    private static final String CURRPICTURE = "currentPicture";
-    private static final String CLOSEONEXIT = "closeonexit";
-    private static final String PARENTTAB = "parentTab";
-    private static final String APPID = "appid";
-    private static final String ORIGINALURL = "originalUrl";
 
     /**
      * Save the state of all the Tabs.
@@ -727,13 +247,13 @@
      */
     void saveState(Bundle outState) {
         final int numTabs = getTabCount();
-        outState.putInt(NUMTABS, numTabs);
+        outState.putInt(Tab.NUMTABS, numTabs);
         final int index = getCurrentIndex();
-        outState.putInt(CURRTAB, (index >= 0 && index < numTabs) ? index : 0);
+        outState.putInt(Tab.CURRTAB, (index >= 0 && index < numTabs) ? index : 0);
         for (int i = 0; i < numTabs; i++) {
             final Tab t = getTab(i);
-            if (saveState(t)) {
-                outState.putBundle(WEBVIEW + i, t.mSavedState);
+            if (t.saveState()) {
+                outState.putBundle(Tab.WEBVIEW + i, t.getSavedState());
             }
         }
     }
@@ -746,33 +266,34 @@
      */
     boolean restoreState(Bundle inState) {
         final int numTabs = (inState == null)
-                ? -1 : inState.getInt(NUMTABS, -1);
+                ? -1 : inState.getInt(Tab.NUMTABS, -1);
         if (numTabs == -1) {
             return false;
         } else {
-            final int currentTab = inState.getInt(CURRTAB, -1);
+            final int currentTab = inState.getInt(Tab.CURRTAB, -1);
             for (int i = 0; i < numTabs; i++) {
                 if (i == currentTab) {
                     Tab t = createNewTab();
                     // Me must set the current tab before restoring the state
                     // so that all the client classes are set.
                     setCurrentTab(t);
-                    if (!restoreState(inState.getBundle(WEBVIEW + i), t)) {
+                    if (!t.restoreState(inState.getBundle(Tab.WEBVIEW + i))) {
                         Log.w(LOGTAG, "Fail in restoreState, load home page.");
-                        t.mMainView.loadUrl(BrowserSettings.getInstance()
+                        t.getWebView().loadUrl(BrowserSettings.getInstance()
                                 .getHomePage());
                     }
                 } else {
                     // Create a new tab and don't restore the state yet, add it
                     // to the tab list
-                    Tab t = new Tab(null, false, null, null, mActivity);
-                    t.mSavedState = inState.getBundle(WEBVIEW + i);
-                    if (t.mSavedState != null) {
-                        populatePickerDataFromSavedState(t);
+                    Tab t = new Tab(mActivity, null, false, null, null);
+                    Bundle state = inState.getBundle(Tab.WEBVIEW + i);
+                    if (state != null) {
+                        t.setSavedState(state);
+                        t.populatePickerDataFromSavedState();
                         // Need to maintain the app id and original url so we
                         // can possibly reuse this tab.
-                        t.mAppId = t.mSavedState.getString(APPID);
-                        t.mOriginalUrl = t.mSavedState.getString(ORIGINALURL);
+                        t.setAppId(state.getString(Tab.APPID));
+                        t.setOriginalUrl(state.getString(Tab.ORIGINALURL));
                     }
                     mTabs.add(t);
                     mTabQueue.add(t);
@@ -781,10 +302,10 @@
             // Rebuild the tree of tabs. Do this after all tabs have been
             // created/restored so that the parent tab exists.
             for (int i = 0; i < numTabs; i++) {
-                final Bundle b = inState.getBundle(WEBVIEW + i);
+                final Bundle b = inState.getBundle(Tab.WEBVIEW + i);
                 final Tab t = getTab(i);
                 if (b != null && t != null) {
-                    final int parentIndex = b.getInt(PARENTTAB, -1);
+                    final int parentIndex = b.getInt(Tab.PARENTTAB, -1);
                     if (parentIndex != -1) {
                         final Tab parent = getTab(parentIndex);
                         if (parent != null) {
@@ -808,9 +329,10 @@
         Tab t = getLeastUsedTab(getCurrentTab());
         if (t != null) {
             Log.w(LOGTAG, "Free a tab in the browser");
-            freeTab(t);
-            // force a gc
-            System.gc();
+            // store the WebView's state.
+            t.saveState();
+            // destroy the tab
+            t.destroy();
             return;
         }
 
@@ -820,8 +342,6 @@
         if (view != null) {
             view.freeMemory();
         }
-        // force a gc
-        System.gc();
     }
 
     private Tab getLeastUsedTab(Tab current) {
@@ -831,7 +351,7 @@
             return null;
         }
 
-        // Rip through the queue starting at the beginning and teardown the
+        // Rip through the queue starting at the beginning and tear down the
         // next available tab.
         Tab t = null;
         int i = 0;
@@ -842,69 +362,18 @@
         do {
             t = mTabQueue.get(i++);
         } while (i < queueSize
-                && ((t != null && t.mMainView == null)
-                    || t == current.mParentTab));
+                && ((t != null && t.getWebView() == null)
+                    || t == current.getParentTab()));
 
         // Don't do anything if the last remaining tab is the current one or if
         // the last tab has been freed already.
-        if (t == current || t.mMainView == null) {
+        if (t == current || t.getWebView() == null) {
             return null;
         }
 
         return t;
     }
 
-    private void freeTab(Tab t) {
-        // Store the WebView's state.
-        saveState(t);
-
-        // Tear down the tab.
-        dismissSubWindow(t);
-        // Remove the WebView's settings from the BrowserSettings list of
-        // observers.
-        BrowserSettings.getInstance().deleteObserver(t.mMainView.getSettings());
-        WebView w = t.mMainView;
-        t.setWebView(null);
-        w.destroy();
-    }
-
-    /**
-     * Create a new subwindow unless a subwindow already exists.
-     * @return True if a new subwindow was created. False if one already exists.
-     */
-    void createSubWindow() {
-        Tab t = getTab(mCurrentTab);
-        if (t != null && t.mSubView == null) {
-            final View v = mInflateService.inflate(R.layout.browser_subwindow, null);
-            final WebView w = (WebView) v.findViewById(R.id.webview);
-            w.setMapTrackballToArrowKeys(false); // use trackball directly
-            final SubWindowClient subClient =
-                    new SubWindowClient(mActivity.getWebViewClient());
-            final SubWindowChromeClient subChromeClient =
-                    new SubWindowChromeClient(t,
-                            mActivity.getWebChromeClient());
-            w.setWebViewClient(subClient);
-            w.setWebChromeClient(subChromeClient);
-            w.setDownloadListener(mActivity);
-            w.setOnCreateContextMenuListener(mActivity);
-            final BrowserSettings s = BrowserSettings.getInstance();
-            s.addObserver(w.getSettings()).update(s, null);
-            t.mSubView = w;
-            t.mSubViewClient = subClient;
-            t.mSubViewChromeClient = subChromeClient;
-            // FIXME: I really hate having to know the name of the view
-            // containing the webview.
-            t.mSubViewContainer = v.findViewById(R.id.subwindow_container);
-            final ImageButton cancel =
-                    (ImageButton) v.findViewById(R.id.subwindow_close);
-            cancel.setOnClickListener(new OnClickListener() {
-                    public void onClick(View v) {
-                        subChromeClient.onCloseWindow(w);
-                    }
-                });
-        }
-    }
-
     /**
      * Show the tab that contains the given WebView.
      * @param view The WebView used to find the tab.
@@ -913,7 +382,7 @@
         final int size = getTabCount();
         for (int i = 0; i < size; i++) {
             final Tab t = getTab(i);
-            if (t.mSubView == view || t.mMainView == view) {
+            if (t.getSubWebView() == view || t.getWebView() == view) {
                 return t;
             }
         }
@@ -931,32 +400,42 @@
         final int size = getTabCount();
         for (int i = 0; i < size; i++) {
             final Tab t = getTab(i);
-            if (id.equals(t.mAppId)) {
+            if (id.equals(t.getAppId())) {
                 return t;
             }
         }
         return null;
     }
 
+    /**
+     * Stop loading in all opened WebView including subWindows.
+     */
     void stopAllLoading() {
         final int size = getTabCount();
         for (int i = 0; i < size; i++) {
-            final WebView webview = getTab(i).getTopWindow();
+            final Tab t = getTab(i);
+            final WebView webview = t.getWebView();
             if (webview != null) {
                 webview.stopLoading();
             }
+            final WebView subview = t.getSubWebView();
+            if (subview != null) {
+                webview.stopLoading();
+            }
         }
     }
 
     // This method checks if a non-app tab (one created within the browser)
     // matches the given url.
     private boolean tabMatchesUrl(Tab t, String url) {
-        if (t.mAppId != null) {
+        if (t.getAppId() != null) {
             return false;
-        } else if (t.mMainView == null) {
+        }
+        WebView webview = t.getWebView();
+        if (webview == null) {
             return false;
-        } else if (url.equals(t.mMainView.getUrl()) ||
-                url.equals(t.mMainView.getOriginalUrl())) {
+        } else if (url.equals(webview.getUrl())
+                || url.equals(webview.getOriginalUrl())) {
             return true;
         }
         return false;
@@ -992,9 +471,9 @@
      * was deleted.
      */
     boolean recreateWebView(Tab t, String url) {
-        final WebView w = t.mMainView;
+        final WebView w = t.getWebView();
         if (w != null) {
-            if (url != null && url.equals(t.mOriginalUrl)) {
+            if (url != null && url.equals(t.getOriginalUrl())) {
                 // The original url matches the current url. Just go back to the
                 // first history item so we can load it faster than if we
                 // rebuilt the WebView.
@@ -1005,11 +484,7 @@
                     return false;
                 }
             }
-            // Remove the settings object from the global settings and destroy
-            // the WebView.
-            BrowserSettings.getInstance().deleteObserver(
-                    t.mMainView.getSettings());
-            t.mMainView.destroy();
+            t.destroy();
         }
         // Create a new WebView. If this tab is the current tab, we need to put
         // back all the clients so force it to be the current tab.
@@ -1017,12 +492,11 @@
         if (getCurrentTab() == t) {
             setCurrentTab(t, true);
         }
-        // Clear the saved state except for the app id and close-on-exit
-        // values.
-        t.mSavedState = null;
-        t.mPickerData = null;
+        // Clear the saved state and picker data
+        t.setSavedState(null);
+        t.clearPickerData();
         // Save the new url in order to avoid deleting the WebView.
-        t.mOriginalUrl = url;
+        t.setOriginalUrl(url);
         return true;
     }
 
@@ -1037,6 +511,11 @@
         w.setMapTrackballToArrowKeys(false); // use trackball directly
         // Enable the built-in zoom
         w.getSettings().setBuiltInZoomControls(true);
+        // Attach DownloadManager so that downloads can start in an active or
+        // a non-active window. This can happen when going to a site that does
+        // a redirect after a period of time. The user could have switched to
+        // another tab while waiting for the download to start.
+        w.setDownloadListener(mActivity);
         // Add this WebView to the settings observer list and update the
         // settings
         final BrowserSettings s = BrowserSettings.getInstance();
@@ -1053,48 +532,20 @@
         return setCurrentTab(newTab, false);
     }
 
-    /*package*/ void pauseCurrentTab() {
+    void pauseCurrentTab() {
         Tab t = getCurrentTab();
         if (t != null) {
-            t.mMainView.onPause();
-            if (t.mSubView != null) {
-                t.mSubView.onPause();
-            }
+            t.pause();
         }
     }
 
-    /*package*/ void resumeCurrentTab() {
+    void resumeCurrentTab() {
         Tab t = getCurrentTab();
         if (t != null) {
-            t.mMainView.onResume();
-            if (t.mSubView != null) {
-                t.mSubView.onResume();
-            }
+            t.resume();
         }
     }
 
-    private void putViewInForeground(WebView v, WebViewClient vc,
-                                     WebChromeClient cc) {
-        v.setWebViewClient(vc);
-        v.setWebChromeClient(cc);
-        v.setOnCreateContextMenuListener(mActivity);
-        v.setDownloadListener(mActivity);
-        v.onResume();
-    }
-
-    private void putViewInBackground(WebView v) {
-        // Set an empty callback so that default actions are not triggered.
-        v.setWebViewClient(mEmptyClient);
-        v.setWebChromeClient(mBackgroundChromeClient);
-        v.setOnCreateContextMenuListener(null);
-        // Leave the DownloadManager attached so that downloads can start in
-        // a non-active window. This can happen when going to a site that does
-        // a redirect after a period of time. The user could have switched to
-        // another tab while waiting for the download to start.
-        v.setDownloadListener(mActivity);
-        v.onPause();
-    }
-
     /**
      * If force is true, this method skips the check for newTab == current.
      */
@@ -1104,10 +555,9 @@
             return true;
         }
         if (current != null) {
-            // Remove the current WebView and the container of the subwindow
-            putTabInBackground(current);
+            current.putInBackground();
+            mCurrentTab = -1;
         }
-
         if (newTab == null) {
             return false;
         }
@@ -1119,214 +569,22 @@
         }
         mTabQueue.add(newTab);
 
-        WebView mainView;
-
         // Display the new current tab
         mCurrentTab = mTabs.indexOf(newTab);
-        mainView = newTab.mMainView;
+        WebView mainView = newTab.getWebView();
         boolean needRestore = (mainView == null);
         if (needRestore) {
             // Same work as in createNewTab() except don't do new Tab()
             mainView = createNewWebView();
             newTab.setWebView(mainView);
         }
-        putViewInForeground(mainView, mActivity.getWebViewClient(),
-                            mActivity.getWebChromeClient());
-        // Add the subwindow if it exists
-        if (newTab.mSubViewContainer != null) {
-            putViewInForeground(newTab.mSubView, newTab.mSubViewClient,
-                                newTab.mSubViewChromeClient);
-        }
+        newTab.putInForeground();
         if (needRestore) {
             // Have to finish setCurrentTab work before calling restoreState
-            if (!restoreState(newTab.mSavedState, newTab)) {
+            if (!newTab.restoreState(newTab.getSavedState())) {
                 mainView.loadUrl(BrowserSettings.getInstance().getHomePage());
             }
         }
         return true;
     }
-
-    /*
-     * Put the tab in the background using all the empty/background clients.
-     */
-    private void putTabInBackground(Tab t) {
-        putViewInBackground(t.mMainView);
-        if (t.mSubView != null) {
-            putViewInBackground(t.mSubView);
-        }
-    }
-
-    /*
-     * Dismiss the subwindow for the given tab.
-     */
-    void dismissSubWindow(Tab t) {
-        if (t != null && t.mSubView != null) {
-            BrowserSettings.getInstance().deleteObserver(
-                    t.mSubView.getSettings());
-            t.mSubView.destroy();
-            t.mSubView = null;
-            t.mSubViewContainer = null;
-        }
-    }
-
-    /**
-     * Ensure that Tab t has data to display in the tab picker.
-     * @param  t   Tab to populate.
-     */
-    /* package */ void populatePickerData(Tab t) {
-        if (t == null) {
-            return;
-        }
-
-        // mMainView == null indicates that the tab has been freed.
-        if (t.mMainView == null) {
-            populatePickerDataFromSavedState(t);
-            return;
-        }
-
-        // FIXME: The only place we cared about subwindow was for 
-        // bookmarking (i.e. not when saving state). Was this deliberate?
-        final WebBackForwardList list = t.mMainView.copyBackForwardList();
-        final WebHistoryItem item =
-                list != null ? list.getCurrentItem() : null;
-        populatePickerData(t, item);
-    }
-
-    // Create the PickerData and populate it using the saved state of the tab.
-    private void populatePickerDataFromSavedState(Tab t) {
-        if (t.mSavedState == null) {
-            return;
-        }
-
-        final PickerData data = new PickerData();
-        final Bundle state = t.mSavedState;
-        data.mUrl = state.getString(CURRURL);
-        data.mTitle = state.getString(CURRTITLE);
-        // XXX: These keys are from WebView.savePicture so if they change, this
-        // will break.
-        data.mScale = state.getFloat("scale", 1.0f);
-        data.mScrollX = state.getInt("scrollX", 0);
-        data.mScrollY = state.getInt("scrollY", 0);
-
-        // Set the tab's picker data.
-        t.mPickerData = data;
-    }
-
-    // Populate the picker data using the given history item and the current
-    // top WebView.
-    private void populatePickerData(Tab t, WebHistoryItem item) {
-        final PickerData data = new PickerData();
-        if (item != null) {
-            data.mUrl = item.getUrl();
-            data.mTitle = item.getTitle();
-            data.mFavicon = item.getFavicon();
-            if (data.mTitle == null) {
-                data.mTitle = data.mUrl;
-            }
-        }
-        // We want to display the top window in the tab picker but use the url
-        // and title of the main window.
-        final WebView w = t.getTopWindow();
-        data.mScale = w.getScale();
-        data.mScrollX = w.getScrollX();
-        data.mScrollY = w.getScrollY();
-
-        t.mPickerData = data;
-    }
-    
-    /**
-     * Clean up the data for all tabs.
-     */
-    /* package */ void wipeAllPickerData() {
-        int size = getTabCount();
-        for (int i = 0; i < size; i++) {
-            final Tab t = getTab(i);
-            if (t != null && t.mSavedState == null) {
-                t.mPickerData = null;
-            }
-        }
-    }
-
-    /*
-     * Save the state for an individual tab.
-     */
-    private boolean saveState(Tab t) {
-        if (t != null) {
-            final WebView w = t.mMainView;
-            // If the WebView is null it means we ran low on memory and we
-            // already stored the saved state in mSavedState.
-            if (w == null) {
-                return true;
-            }
-            final Bundle b = new Bundle();
-            final WebBackForwardList list = w.saveState(b);
-            if (list != null) {
-                final File f = new File(mThumbnailDir, w.hashCode()
-                        + "_pic.save");
-                if (w.savePicture(b, f)) {
-                    b.putString(CURRPICTURE, f.getPath());
-                }
-            }
-
-            // Store some extra info for displaying the tab in the picker.
-            final WebHistoryItem item =
-                    list != null ? list.getCurrentItem() : null;
-            populatePickerData(t, item);
-
-            // XXX: WebView.savePicture stores the scale and scroll positions
-            // in the bundle so we don't have to do it here.
-            final PickerData data = t.mPickerData;
-            if (data.mUrl != null) {
-                b.putString(CURRURL, data.mUrl);
-            }
-            if (data.mTitle != null) {
-                b.putString(CURRTITLE, data.mTitle);
-            }
-            b.putBoolean(CLOSEONEXIT, t.mCloseOnExit);
-            if (t.mAppId != null) {
-                b.putString(APPID, t.mAppId);
-            }
-            if (t.mOriginalUrl != null) {
-                b.putString(ORIGINALURL, t.mOriginalUrl);
-            }
-
-            // Remember the parent tab so the relationship can be restored.
-            if (t.mParentTab != null) {
-                b.putInt(PARENTTAB, getTabIndex(t.mParentTab));
-            }
-
-            // Remember the saved state.
-            t.mSavedState = b;
-            return true;
-        }
-        return false;
-    }
-
-    /*
-     * Restore the state of the tab.
-     */
-    private boolean restoreState(Bundle b, Tab t) {
-        if (b == null) {
-            return false;
-        }
-        // Restore the internal state even if the WebView fails to restore.
-        // This will maintain the app id, original url and close-on-exit values.
-        t.mSavedState = null;
-        t.mPickerData = null;
-        t.mCloseOnExit = b.getBoolean(CLOSEONEXIT);
-        t.mAppId = b.getString(APPID);
-        t.mOriginalUrl = b.getString(ORIGINALURL);
-
-        final WebView w = t.mMainView;
-        final WebBackForwardList list = w.restoreState(b);
-        if (list == null) {
-            return false;
-        }
-        if (b.containsKey(CURRPICTURE)) {
-            final File f = new File(b.getString(CURRPICTURE));
-            w.restorePicture(b, f);
-            f.delete();
-        }
-        return true;
-    }
 }