Content "gn check" work.

content/public/browser/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//content/browser/browser.gni")
 import("//build/config/ui.gni")
 
 # See //content/BUILD.gn for how this works.
 group("browser") {
   if (is_component_build) {
     public_deps = [
       "//content",
     ]
   } else {
     public_deps = [
       ":browser_sources",
     ]
   }
 }
 
 source_set("browser_sources") {
+  # External code should depend on via ":browser" above.
   visibility = [ "//content/*" ]
 
   sources = rebase_path(content_browser_gypi_values.public_browser_sources,
                         ".",
                         "//content")
 
   configs += [
     "//build/config:precompiled_headers",
     "//content:content_implementation",
   ]
 
   public_deps = [
     "//content/public/common:mojo_bindings",
     "//mojo/public/cpp/bindings",
     "//mojo/public/cpp/system",
 
     # We expose skia headers in the public API.
     "//skia",
   ]
   deps = [
     "//cc",
-    "//content/browser",
+    "//content/browser",  # Must not be public_deps!
     "//content/public/common:common_sources",
     "//gpu",
     "//media",
     "//net",
     "//ppapi/c",
     "//storage/browser",
     "//ui/accessibility",
     "//ui/base",
     "//ui/events",
     "//ui/gl",
     "//ui/surface",
   ]
 
   allow_circular_includes_from = [
     # This target is a pair with content/browser. They always go together and
     # include headers from each other.
     "//content/browser",
   ]
 
   if (is_android) {
     deps += [ "//ui/android" ]
   }
 
   if (use_aura) {
     sources -= [ "context_factory.h" ]
     deps += [ "//ui/aura" ]
   }
 }