Support exposing Mojo services between render frames, render threads, and their respective hosts.

This introduces ServiceRegistry as an abstraction around providing
services to and accessing services from a remote peer. In particular,
this adds peered service registries to RenderProcessHost and
RenderThread, and to RenderFrameHost and RenderFrame - the RenderFrame
setup is implemented using the RenderProcessHost/RenderThread
ServiceRegistry pair.

This replaces the existing WebUI handle setup by adding a webUI
controller service to the frame host registry and a corresponding
request for the webUI controller service to the frame registry.

BUG=386155

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=279557

Review URL: https://codereview.chromium.org/285333003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@279623 0039d316-1c4b-4281-b951-d872f2087c98

63 files changed, 485 insertions, 303 deletions

diff --git a/chrome/browser/ui/webui/mojo_web_ui_controller.cc b/chrome/browser/ui/webui/mojo_web_ui_controller.cc
index 04ba05f..574bb61 100644
--- a/chrome/browser/ui/webui/mojo_web_ui_controller.cc
+++ b/chrome/browser/ui/webui/mojo_web_ui_controller.cc
@@ -6,14 +6,16 @@
 
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/mojo_web_ui_handler.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/service_registry.h"
 #include "mojo/public/cpp/system/core.h"
 
 MojoWebUIController::MojoWebUIController(content::WebUI* contents)
-    : WebUIController(contents),
-      mojo_data_source_(NULL) {
+    : WebUIController(contents), mojo_data_source_(NULL), weak_factory_(this) {
 }
 
 MojoWebUIController::~MojoWebUIController() {
@@ -22,10 +24,10 @@ MojoWebUIController::~MojoWebUIController() {
 void MojoWebUIController::RenderViewCreated(
     content::RenderViewHost* render_view_host) {
   render_view_host->AllowBindings(content::BINDINGS_POLICY_WEB_UI);
-
-  mojo::MessagePipe pipe;
-  ui_handler_ = CreateUIHandler(pipe.handle0.Pass());
-  render_view_host->SetWebUIHandle(pipe.handle1.Pass());
+  render_view_host->GetMainFrame()->GetServiceRegistry()->AddService(
+      "webui_controller",
+      base::Bind(&MojoWebUIController::CreateAndStoreUIHandler,
+                 weak_factory_.GetWeakPtr()));
 }
 
 void MojoWebUIController::AddMojoResourcePath(const std::string& path,
@@ -36,3 +38,8 @@ void MojoWebUIController::AddMojoResourcePath(const std::string& path,
   }
   mojo_data_source_->AddResourcePath(path, resource_id);
 }
+
+void MojoWebUIController::CreateAndStoreUIHandler(
+    mojo::ScopedMessagePipeHandle handle) {
+  ui_handler_ = CreateUIHandler(handle.Pass());
+}
diff --git a/chrome/browser/ui/webui/mojo_web_ui_controller.h b/chrome/browser/ui/webui/mojo_web_ui_controller.h
index cf79861..35ba56d 100644
--- a/chrome/browser/ui/webui/mojo_web_ui_controller.h
+++ b/chrome/browser/ui/webui/mojo_web_ui_controller.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "content/public/browser/web_ui_controller.h"
 #include "mojo/public/cpp/system/core.h"
 
@@ -42,11 +43,16 @@ class MojoWebUIController : public content::WebUIController {
       mojo::ScopedMessagePipeHandle handle_to_page) = 0;
 
  private:
+  // Invoked in response to a connection from the renderer.
+  void CreateAndStoreUIHandler(mojo::ScopedMessagePipeHandle handle);
+
   // Bindings files are registered here.
   content::WebUIDataSource* mojo_data_source_;
 
   scoped_ptr<MojoWebUIHandler> ui_handler_;
 
+  base::WeakPtrFactory<MojoWebUIController> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MojoWebUIController);
 };
 
diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index caaee48..e4342c4 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi
@@ -452,6 +452,8 @@
         'common',
         'test_support_common',
         '../base/base.gyp:base',
+        '../mojo/mojo.gyp:mojo_environment_chromium',
+        '../mojo/mojo.gyp:mojo_system_impl',
         '../skia/skia.gyp:skia',
         '../sync/sync.gyp:sync',
         '../testing/gmock.gyp:gmock',
diff --git a/chrome/test/DEPS b/chrome/test/DEPS
index 5d3b3a9..340cc31 100644
--- a/chrome/test/DEPS
+++ b/chrome/test/DEPS
@@ -16,6 +16,7 @@ include_rules = [
 
   "+grit",  # For generated headers
   "+media/base",
+  "+mojo/embedder",
   "+sandbox/win/tests",
   "+webkit/glue",
   "+win8/test",
diff --git a/chrome/test/base/run_all_unittests.cc b/chrome/test/base/run_all_unittests.cc
index ae5b600..cfe6491 100644
--- a/chrome/test/base/run_all_unittests.cc
+++ b/chrome/test/base/run_all_unittests.cc
@@ -6,10 +6,12 @@
 #include "base/test/launcher/unit_test_launcher.h"
 #include "chrome/test/base/chrome_unit_test_suite.h"
 #include "content/public/test/unittest_test_suite.h"
+#include "mojo/embedder/embedder.h"
 
 int main(int argc, char **argv) {
   content::UnitTestTestSuite test_suite(new ChromeUnitTestSuite(argc, argv));
 
+  mojo::embedder::Init();
   return base::LaunchUnitTests(
       argc, argv, base::Bind(&content::UnitTestTestSuite::Run,
                              base::Unretained(&test_suite)));
diff --git a/content/app/BUILD.gn b/content/app/BUILD.gn
index 13efa00..981526f 100644
--- a/content/app/BUILD.gn
+++ b/content/app/BUILD.gn
@@ -54,7 +54,7 @@ source_set("app") {
   } else {
     deps += [
       "//mojo/environment:chromium",
-      "//mojo/public/interfaces/service_provider:service_provider",
+      "//mojo/public/interfaces/interface_provider",
       "//mojo/service_manager",
       "//mojo/system",
     ]
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 325401f..7ec025c 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -86,7 +86,7 @@ source_set("browser") {
       "//cc",
       "//cc:cc_surfaces",
       "//mojo/public/cpp/bindings",
-      "//mojo/public/interfaces/service_provider:service_provider",
+      "//mojo/public/interfaces/interface_provider",
       "//mojo/public/js/bindings",
       "//net:http_server",
       "//third_party/icu",
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index bfeee98..9ffcbef 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -18,6 +18,7 @@
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/renderer_host/input/input_router.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/transition_request_manager.h"
@@ -25,6 +26,7 @@
 #include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/inter_process_time_ticks_converter.h"
+#include "content/common/render_frame_setup.mojom.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -162,6 +164,16 @@ RenderFrameHostImpl::RenderFrameHostImpl(
   g_routing_id_frame_map.Get().insert(std::make_pair(
       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
       this));
+
+  if (GetProcess()->GetServiceRegistry()) {
+    RenderFrameSetupPtr setup;
+    GetProcess()->GetServiceRegistry()->GetRemoteInterface(&setup);
+    mojo::IInterfaceProviderPtr service_provider;
+    setup->GetServiceProviderForFrame(routing_id_,
+                                      mojo::Get(&service_provider));
+    service_registry_.BindRemoteServiceProvider(
+        service_provider.PassMessagePipe());
+  }
 }
 
 RenderFrameHostImpl::~RenderFrameHostImpl() {
@@ -242,6 +254,11 @@ RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
   return render_view_host_;
 }
 
+ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
+  static_cast<RenderProcessHostImpl*>(GetProcess())->EnsureMojoActivated();
+  return &service_registry_;
+}
+
 bool RenderFrameHostImpl::Send(IPC::Message* message) {
   if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
     return render_view_host_->input_router()->SendInput(
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index b554511..092b630 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -14,6 +14,7 @@
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
+#include "content/common/mojo/service_registry_impl.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/javascript_message_type.h"
 #include "content/public/common/page_transition_types.h"
@@ -66,6 +67,7 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost {
       const base::string16& javascript,
       const JavaScriptResultCallback& callback) OVERRIDE;
   virtual RenderViewHost* GetRenderViewHost() OVERRIDE;
+  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // IPC::Sender
   virtual bool Send(IPC::Message* msg) OVERRIDE;
@@ -302,6 +304,8 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost {
   // When the last BeforeUnload message was sent.
   base::TimeTicks send_before_unload_start_time_;
 
+  ServiceRegistryImpl service_registry_;
+
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameHostImpl);
diff --git a/content/browser/mojo/mojo_application_host.cc b/content/browser/mojo/mojo_application_host.cc
index 90187b9..2491252 100644
--- a/content/browser/mojo/mojo_application_host.cc
+++ b/content/browser/mojo/mojo_application_host.cc
@@ -30,7 +30,7 @@ MojoApplicationHost::~MojoApplicationHost() {
 }
 
 bool MojoApplicationHost::Init() {
-  DCHECK(!child_service_provider_.get()) << "Already initialized!";
+  DCHECK(!client_handle_.is_valid()) << "Already initialized!";
 
   mojo::embedder::PlatformChannelPair channel_pair;
 
@@ -43,8 +43,7 @@ bool MojoApplicationHost::Init() {
   // Forward this to the client once we know its process handle.
   client_handle_ = channel_pair.PassClientHandle();
 
-  child_service_provider_.reset(
-      BindToPipe(new ServiceProviderImpl(), message_pipe.Pass()));
+  service_registry_.BindRemoteServiceProvider(message_pipe.Pass());
   return true;
 }
 
@@ -60,12 +59,4 @@ bool MojoApplicationHost::Activate(IPC::Sender* sender,
   return did_activate_;
 }
 
-void MojoApplicationHost::ServiceProviderImpl::ConnectToService(
-    const mojo::String& service_url,
-    const mojo::String& service_name,
-    mojo::ScopedMessagePipeHandle handle,
-    const mojo::String& requestor_url) {
-  // TODO(darin): Provide something meaningful here.
-}
-
 }  // namespace content
diff --git a/content/browser/mojo/mojo_application_host.h b/content/browser/mojo/mojo_application_host.h
index f591326..ae57104 100644
--- a/content/browser/mojo/mojo_application_host.h
+++ b/content/browser/mojo/mojo_application_host.h
@@ -6,9 +6,9 @@
 #define CONTENT_BROWSER_MOJO_MOJO_APPLICATION_HOST_H_
 
 #include "base/process/process_handle.h"
+#include "content/common/mojo/service_registry_impl.h"
 #include "mojo/embedder/channel_init.h"
 #include "mojo/embedder/scoped_platform_handle.h"
-#include "mojo/public/interfaces/service_provider/service_provider.mojom.h"
 
 namespace IPC {
 class Sender;
@@ -19,49 +19,31 @@ namespace content {
 // MojoApplicationHost represents the code needed on the browser side to setup
 // a child process as a Mojo application via Chrome IPC. The child process
 // should use MojoApplication to handle messages generated by an instance of
-// MojoApplicationHost. MojoApplicationHost makes the mojo::ShellClient
-// interface available so that child-provided services can be invoked.
+// MojoApplicationHost. MojoApplicationHost makes the ServiceRegistry interface
+// available so that child-provided services can be invoked.
 class MojoApplicationHost {
  public:
   MojoApplicationHost();
   virtual ~MojoApplicationHost();
 
   // Two-phase initialization:
-  //  1- Init makes the shell_client() available synchronously.
+  //  1- Init makes service_registry() available synchronously.
   //  2- Activate establishes the actual connection to the peer process.
   bool Init();
   bool Activate(IPC::Sender* sender, base::ProcessHandle process_handle);
 
   bool did_activate() const { return did_activate_; }
 
-  mojo::ServiceProvider* service_provider() {
-    DCHECK(child_service_provider_.get());
-    return child_service_provider_->client();
-  }
+  ServiceRegistry* service_registry() { return &service_registry_; }
 
  private:
-  class ServiceProviderImpl
-      : public mojo::InterfaceImpl<mojo::ServiceProvider> {
-   public:
-    virtual void OnConnectionError() OVERRIDE {
-      // TODO(darin): How should we handle this error?
-    }
-
-    // mojo::ServiceProvider methods:
-    virtual void ConnectToService(
-        const mojo::String& service_url,
-        const mojo::String& service_name,
-        mojo::ScopedMessagePipeHandle handle,
-        const mojo::String& requestor_url) OVERRIDE;
-  };
-
   mojo::embedder::ChannelInit channel_init_;
   mojo::embedder::ScopedPlatformHandle client_handle_;
 
-  scoped_ptr<ServiceProviderImpl> child_service_provider_;
-
   bool did_activate_;
 
+  ServiceRegistryImpl service_registry_;
+
   DISALLOW_COPY_AND_ASSIGN(MojoApplicationHost);
 };
 
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 7b5cd1c..b67ecae 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -69,7 +69,6 @@
 #include "content/browser/media/midi_host.h"
 #include "content/browser/message_port_message_filter.h"
 #include "content/browser/mime_registry_message_filter.h"
-#include "content/browser/mojo/mojo_application_host.h"
 #include "content/browser/plugin_service_impl.h"
 #include "content/browser/profiler_message_filter.h"
 #include "content/browser/push_messaging_message_filter.h"
@@ -141,7 +140,6 @@
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_switches.h"
 #include "media/base/media_switches.h"
-#include "mojo/common/common_type_converters.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "ppapi/shared_impl/ppapi_switches.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -448,6 +446,7 @@ RenderProcessHostImpl::RenderProcessHostImpl(
       is_self_deleted_(false),
 #endif
       pending_views_(0),
+      mojo_application_host_(new MojoApplicationHost),
       mojo_activation_required_(false),
       visible_widgets_(0),
       backgrounded_(true),
@@ -597,7 +596,6 @@ bool RenderProcessHostImpl::Init() {
       BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get());
 
   // Setup the Mojo channel.
-  mojo_application_host_.reset(new MojoApplicationHost());
   mojo_application_host_->Init();
 
   // Call the embedder first so that their IPC filters have priority.
@@ -908,6 +906,12 @@ void RenderProcessHostImpl::NotifyTimezoneChange() {
   Send(new ViewMsg_TimezoneChange());
 }
 
+ServiceRegistry* RenderProcessHostImpl::GetServiceRegistry() {
+  if (!mojo_application_host_)
+    return NULL;
+  return mojo_application_host_->service_registry();
+}
+
 void RenderProcessHostImpl::AddRoute(
     int32 routing_id,
     IPC::Listener* listener) {
@@ -1933,7 +1937,8 @@ void RenderProcessHostImpl::ProcessDied(bool already_dead) {
     iter.Advance();
   }
 
-  mojo_application_host_.reset();
+  mojo_application_host_.reset(new MojoApplicationHost);
+  mojo_activation_required_ = false;
 
   // It's possible that one of the calls out to the observers might have caused
   // this object to be no longer needed.
@@ -2253,17 +2258,9 @@ void RenderProcessHostImpl::DecrementWorkerRefCount() {
     Cleanup();
 }
 
-void RenderProcessHostImpl::ConnectTo(
-    const base::StringPiece& service_name,
-    mojo::ScopedMessagePipeHandle handle) {
+void RenderProcessHostImpl::EnsureMojoActivated() {
   mojo_activation_required_ = true;
   MaybeActivateMojo();
-
-  mojo_application_host_->service_provider()->ConnectToService(
-      mojo::String::From(service_name),
-      std::string(),
-      handle.Pass(),
-      mojo::String());
 }
 
 void RenderProcessHostImpl::OnAllocateGpuMemoryBuffer(uint32 width,
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 61f9910..36f8f9a 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -15,8 +15,10 @@
 #include "base/timer/timer.h"
 #include "content/browser/child_process_launcher.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
+#include "content/browser/mojo/mojo_application_host.h"
 #include "content/browser/power_monitor_message_broadcaster.h"
 #include "content/common/content_export.h"
+#include "content/common/mojo/service_registry_impl.h"
 #include "content/public/browser/gpu_data_manager_observer.h"
 #include "content/public/browser/render_process_host.h"
 #include "ipc/ipc_channel_proxy.h"
@@ -45,13 +47,11 @@ class AudioRendererHost;
 class BrowserDemuxerAndroid;
 class GpuMessageFilter;
 class MessagePortMessageFilter;
-class MojoApplicationHost;
 #if defined(ENABLE_WEBRTC)
 class P2PSocketDispatcherHost;
 #endif
 class PeerConnectionTrackerHost;
 class RendererMainThread;
-class RenderProcessHostMojoImpl;
 class RenderWidgetHelper;
 class RenderWidgetHost;
 class RenderWidgetHostImpl;
@@ -143,6 +143,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
   virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id)
       OVERRIDE;
   virtual void NotifyTimezoneChange() OVERRIDE;
+  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // IPC::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg) OVERRIDE;
@@ -250,23 +251,13 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void IncrementWorkerRefCount();
   void DecrementWorkerRefCount();
 
-  // Establish a connection to a renderer-provided service. See
-  // content/common/mojo/mojo_service_names.h for a list of services.
-  void ConnectTo(const base::StringPiece& service_name,
-                 mojo::ScopedMessagePipeHandle handle);
-
-  template <typename Interface>
-  void ConnectTo(const base::StringPiece& service_name,
-                 mojo::InterfacePtr<Interface>* ptr) {
-    mojo::MessagePipe pipe;
-    ptr->Bind(pipe.handle0.Pass());
-    ConnectTo(service_name, pipe.handle1.Pass());
-  }
-
   // Call this function to resume the navigation when it was deferred
   // immediately after receiving response headers.
   void ResumeResponseDeferredAtStart(const GlobalRequestID& request_id);
 
+  // Activates Mojo for this process. Does nothing if Mojo is already activated.
+  void EnsureMojoActivated();
+
  protected:
   // A proxy for our IPC::Channel that lives on the IO thread (see
   // browser_process.h)
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index e14b364..6b96be6 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -48,11 +48,9 @@
 #include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/inter_process_time_ticks_converter.h"
-#include "content/common/mojo/mojo_service_names.h"
 #include "content/common/speech_recognition_messages.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/common/view_messages.h"
-#include "content/common/web_ui_setup.mojom.h"
 #include "content/public/browser/ax_event_notification_details.h"
 #include "content/public/browser/browser_accessibility_state.h"
 #include "content/public/browser/browser_context.h"
@@ -656,27 +654,6 @@ void RenderViewHostImpl::SetHasPendingCrossSiteRequest(
       GetProcess()->GetID(), GetRoutingID(), has_pending_request);
 }
 
-void RenderViewHostImpl::SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) {
-  // Never grant any bindings to browser plugin guests.
-  if (GetProcess()->IsIsolatedGuest()) {
-    NOTREACHED() << "Never grant bindings to a guest process.";
-    return;
-  }
-
-  if ((enabled_bindings_ & BINDINGS_POLICY_WEB_UI) == 0) {
-    NOTREACHED() << "You must grant bindings before setting the handle";
-    return;
-  }
-
-  DCHECK(renderer_initialized_);
-
-  WebUISetupPtr web_ui_setup;
-  static_cast<RenderProcessHostImpl*>(GetProcess())->ConnectTo(
-      kRendererService_WebUISetup, &web_ui_setup);
-
-  web_ui_setup->SetWebUIHandle(GetRoutingID(), handle.Pass());
-}
-
 #if defined(OS_ANDROID)
 void RenderViewHostImpl::ActivateNearestFindResult(int request_id,
                                                    float x,
diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
index 5f7344f..204d31c 100644
--- a/content/browser/renderer_host/render_view_host_impl.h
+++ b/content/browser/renderer_host/render_view_host_impl.h
@@ -209,7 +209,6 @@ class CONTENT_EXPORT RenderViewHostImpl
       const WebPreferences& prefs) OVERRIDE;
   virtual void GetAudioOutputControllers(
       const GetAudioOutputControllersCallback& callback) const OVERRIDE;
-  virtual void SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) OVERRIDE;
   virtual void SelectWordAroundCaret() OVERRIDE;
 
 #if defined(OS_ANDROID)
diff --git a/content/browser/webui/web_ui_mojo_browsertest.cc b/content/browser/webui/web_ui_mojo_browsertest.cc
index 5007a8d..6261316 100644
--- a/content/browser/webui/web_ui_mojo_browsertest.cc
+++ b/content/browser/webui/web_ui_mojo_browsertest.cc
@@ -12,15 +12,19 @@
 #include "base/strings/string_util.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/service_registry.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
 #include "content/test/data/web_ui_test_mojo_bindings.mojom.h"
 #include "grit/content_resources.h"
 #include "mojo/common/test/test_utils.h"
@@ -125,13 +129,18 @@ class PingTestWebUIController : public TestWebUIController {
    PingTestWebUIController(WebUI* web_ui, base::RunLoop* run_loop)
        : TestWebUIController(web_ui, run_loop) {
    }
+   virtual ~PingTestWebUIController() {}
 
   // WebUIController overrides:
   virtual void RenderViewCreated(RenderViewHost* render_view_host) OVERRIDE {
-    mojo::MessagePipe pipe;
-    browser_target_.reset(
-        new PingBrowserTargetImpl(pipe.handle0.Pass(), run_loop_));
-    render_view_host->SetWebUIHandle(pipe.handle1.Pass());
+    render_view_host->GetMainFrame()->GetServiceRegistry()->AddService(
+        "webui_controller",
+        base::Bind(&PingTestWebUIController::CreateHandler,
+                   base::Unretained(this)));
+  }
+
+  void CreateHandler(mojo::ScopedMessagePipeHandle handle) {
+    browser_target_.reset(new PingBrowserTargetImpl(handle.Pass(), run_loop_));
   }
 
  private:
@@ -212,6 +221,19 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, EndToEndPing) {
   // RunLoop is quit when message received from page.
   run_loop.Run();
   EXPECT_TRUE(got_message);
+
+  // Check that a second render frame in the same renderer process works
+  // correctly.
+  Shell* other_shell = CreateBrowser();
+  got_message = false;
+  base::RunLoop other_run_loop;
+  factory()->set_run_loop(&other_run_loop);
+  NavigateToURL(other_shell, test_url);
+  // RunLoop is quit when message received from page.
+  other_run_loop.Run();
+  EXPECT_TRUE(got_message);
+  EXPECT_EQ(shell()->web_contents()->GetRenderProcessHost(),
+            other_shell->web_contents()->GetRenderProcessHost());
 }
 
 }  // namespace
diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
index 63a951a..5feeb5f 100644
--- a/content/child/BUILD.gn
+++ b/content/child/BUILD.gn
@@ -18,7 +18,7 @@ source_set("child") {
     "//base",
     "//components/tracing",
     "//mojo/environment:chromium",
-    "//mojo/public/interfaces/service_provider",
+    "//mojo/public/interfaces/interface_provider",
     "//skia",
     "//third_party/icu",
     "//ui/base",
diff --git a/content/child/child_thread.cc b/content/child/child_thread.cc
index 89ff408..315224e 100644
--- a/content/child/child_thread.cc
+++ b/content/child/child_thread.cc
@@ -239,7 +239,7 @@ void ChildThread::Init() {
     IPC::Logging::GetInstance()->SetIPCSender(this);
 #endif
 
-  mojo_application_.reset(new MojoApplication(this));
+  mojo_application_.reset(new MojoApplication);
 
   sync_message_filter_ =
       new IPC::SyncMessageFilter(ChildProcess::current()->GetShutDownEvent());
@@ -370,15 +370,6 @@ void ChildThread::OnChannelError() {
   base::MessageLoop::current()->Quit();
 }
 
-void ChildThread::ConnectToService(
-    const mojo::String& service_url,
-    const mojo::String& service_name,
-    mojo::ScopedMessagePipeHandle message_pipe,
-    const mojo::String& requestor_url) {
-  // By default, we don't expect incoming connections.
-  NOTREACHED();
-}
-
 bool ChildThread::Send(IPC::Message* msg) {
   DCHECK(base::MessageLoop::current() == message_loop());
   if (!channel_) {
diff --git a/content/child/child_thread.h b/content/child/child_thread.h
index b272db3..e7cf8ec 100644
--- a/content/child/child_thread.h
+++ b/content/child/child_thread.h
@@ -13,10 +13,10 @@
 #include "base/memory/weak_ptr.h"
 #include "base/power_monitor/power_monitor.h"
 #include "base/tracked_objects.h"
+#include "content/child/mojo/mojo_application.h"
 #include "content/common/content_export.h"
 #include "content/common/message_router.h"
 #include "ipc/ipc_message.h"  // For IPC_MESSAGE_LOG_ENABLED.
-#include "mojo/public/interfaces/service_provider/service_provider.mojom.h"
 
 namespace base {
 class MessageLoop;
@@ -44,7 +44,6 @@ class ChildHistogramMessageFilter;
 class ChildResourceMessageFilter;
 class ChildSharedBitmapManager;
 class FileSystemDispatcher;
-class MojoApplication;
 class ServiceWorkerDispatcher;
 class ServiceWorkerMessageFilter;
 class QuotaDispatcher;
@@ -56,10 +55,7 @@ class WebSocketDispatcher;
 struct RequestInfo;
 
 // The main thread of a child process derives from this class.
-class CONTENT_EXPORT ChildThread
-    : public IPC::Listener,
-      public IPC::Sender,
-      public NON_EXPORTED_BASE(mojo::ServiceProvider) {
+class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
  public:
   // Creates the thread.
   ChildThread();
@@ -153,6 +149,10 @@ class CONTENT_EXPORT ChildThread
   static void ShutdownThread();
 #endif
 
+  ServiceRegistry* service_registry() const {
+    return mojo_application_->service_registry();
+  }
+
  protected:
   friend class ChildProcess;
 
@@ -170,13 +170,6 @@ class CONTENT_EXPORT ChildThread
   virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
   virtual void OnChannelError() OVERRIDE;
 
-  // mojo::ServiceProvider implementation:
-  virtual void ConnectToService(
-      const mojo::String& service_url,
-      const mojo::String& service_name,
-      mojo::ScopedMessagePipeHandle message_pipe,
-      const mojo::String& requestor_url) OVERRIDE;
-
  private:
   class ChildThreadMessageRouter : public MessageRouter {
    public:
diff --git a/content/child/mojo/mojo_application.cc b/content/child/mojo/mojo_application.cc
index 79eea23..bc1426f 100644
--- a/content/child/mojo/mojo_application.cc
+++ b/content/child/mojo/mojo_application.cc
@@ -10,8 +10,7 @@
 
 namespace content {
 
-MojoApplication::MojoApplication(mojo::ServiceProvider* service_provider)
-    : service_provider_(service_provider) {
+MojoApplication::MojoApplication() {
 }
 
 MojoApplication::~MojoApplication() {
@@ -37,9 +36,7 @@ void MojoApplication::OnActivate(
       channel_init_.Init(handle,
                          ChildProcess::current()->io_message_loop_proxy());
   DCHECK(message_pipe.is_valid());
-
-  host_service_provider_.Bind(message_pipe.Pass());
-  host_service_provider_.set_client(service_provider_);
+  service_registry_.BindRemoteServiceProvider(message_pipe.Pass());
 }
 
 }  // namespace content
diff --git a/content/child/mojo/mojo_application.h b/content/child/mojo/mojo_application.h
index 53fd541..d745402 100644
--- a/content/child/mojo/mojo_application.h
+++ b/content/child/mojo/mojo_application.h
@@ -5,9 +5,9 @@
 #ifndef CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
 #define CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
 
+#include "content/common/mojo/service_registry_impl.h"
 #include "ipc/ipc_platform_file.h"
 #include "mojo/embedder/channel_init.h"
-#include "mojo/public/interfaces/service_provider/service_provider.mojom.h"
 
 namespace IPC {
 class Message;
@@ -18,27 +18,22 @@ namespace content {
 // MojoApplication represents the code needed to setup a child process as a
 // Mojo application via Chrome IPC. Instantiate MojoApplication and call its
 // OnMessageReceived method to give it a shot at handling Chrome IPC messages.
-// It makes the mojo::Shell interface available and calls methods on the given
-// mojo::ShellClient interface as calls come in.
+// It makes the ServiceRegistry interface available.
 class MojoApplication {
  public:
-  // The ShellClient pointer must remain valid for the lifetime of the
-  // MojoApplication instance.
-  explicit MojoApplication(mojo::ServiceProvider* service_provider);
-  ~MojoApplication();
+  MojoApplication();
+  virtual ~MojoApplication();
 
   bool OnMessageReceived(const IPC::Message& msg);
 
-  mojo::ServiceProvider* host_service_provider() {
-    return host_service_provider_.get();
-  }
+  ServiceRegistry* service_registry() { return &service_registry_; }
 
  private:
   void OnActivate(const IPC::PlatformFileForTransit& file);
 
   mojo::embedder::ChannelInit channel_init_;
-  mojo::ServiceProviderPtr host_service_provider_;
-  mojo::ServiceProvider* service_provider_;
+
+  ServiceRegistryImpl service_registry_;
 
   DISALLOW_COPY_AND_ASSIGN(MojoApplication);
 };
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 511027e..96f017d 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -56,6 +56,7 @@ source_set("common") {
       "//gpu/command_buffer/client:gles2_implementation",
       "//gpu/command_buffer/service",
       "//gpu/ipc",
+      "//mojo/public/interfaces/interface_provider",
       "//ui/gl",
       "//webkit/browser:storage",
       "//webkit/common",
@@ -264,6 +265,6 @@ source_set("common") {
 
 mojom("mojo_bindings") {
   sources = [
-    "web_ui_setup.mojom",
+    "render_frame_setup.mojom",
   ]
 }
diff --git a/content/common/mojo/mojo_service_names.cc b/content/common/mojo/mojo_service_names.cc
deleted file mode 100644
index 26ff68f..0000000
--- a/content/common/mojo/mojo_service_names.cc
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mojo/mojo_service_names.h"
-
-namespace content {
-
-// Renderer-provided services:
-
-const char kRendererService_WebUISetup[] = "content:web_ui_setup";
-
-}  // namespace content
diff --git a/content/common/mojo/mojo_service_names.h b/content/common/mojo/mojo_service_names.h
deleted file mode 100644
index 787b67d..0000000
--- a/content/common/mojo/mojo_service_names.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_SERVICE_CONSTANTS_H_
-#define CONTENT_COMMON_SERVICE_CONSTANTS_H_
-
-namespace content {
-
-// ----------------------------------------------------------------------------
-// Renderer-provided services:
-
-// WebUISetup <-> WebUISetupClient
-extern const char kRendererService_WebUISetup[];
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_SERVICE_CONSTANTS_H_
diff --git a/content/common/mojo/service_registry_impl.cc b/content/common/mojo/service_registry_impl.cc
new file mode 100644
index 0000000..d19b96f
--- /dev/null
+++ b/content/common/mojo/service_registry_impl.cc
@@ -0,0 +1,78 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/mojo/service_registry_impl.h"
+
+#include "mojo/common/common_type_converters.h"
+
+namespace content {
+
+ServiceRegistryImpl::ServiceRegistryImpl() : bound_(false) {
+}
+
+ServiceRegistryImpl::ServiceRegistryImpl(mojo::ScopedMessagePipeHandle handle)
+    : bound_(false) {
+  BindRemoteServiceProvider(handle.Pass());
+}
+
+ServiceRegistryImpl::~ServiceRegistryImpl() {
+  while (!pending_connects_.empty()) {
+    mojo::CloseRaw(pending_connects_.front().second);
+    pending_connects_.pop();
+  }
+}
+
+void ServiceRegistryImpl::BindRemoteServiceProvider(
+    mojo::ScopedMessagePipeHandle handle) {
+  DCHECK(!bound_);
+  bound_ = true;
+  mojo::BindToPipe(this, handle.Pass());
+  while (!pending_connects_.empty()) {
+    client()->GetInterface(
+        mojo::String::From(pending_connects_.front().first),
+        mojo::ScopedMessagePipeHandle(pending_connects_.front().second));
+    pending_connects_.pop();
+  }
+}
+
+void ServiceRegistryImpl::OnConnectionError() {
+  // TODO(sammc): Support reporting this to our owner.
+}
+
+void ServiceRegistryImpl::AddService(
+    const std::string& service_name,
+    const base::Callback<void(mojo::ScopedMessagePipeHandle)> service_factory) {
+  bool inserted = service_factories_.insert(
+      std::make_pair(service_name, service_factory)).second;
+  DCHECK(inserted);
+}
+
+void ServiceRegistryImpl::RemoveService(const std::string& service_name) {
+  service_factories_.erase(service_name);
+}
+
+void ServiceRegistryImpl::GetRemoteInterface(
+    const base::StringPiece& service_name,
+    mojo::ScopedMessagePipeHandle handle) {
+  if (!bound_) {
+    pending_connects_.push(
+        std::make_pair(service_name.as_string(), handle.release()));
+    return;
+  }
+  client()->GetInterface(mojo::String::From(service_name), handle.Pass());
+}
+
+void ServiceRegistryImpl::GetInterface(
+    const mojo::String& name,
+    mojo::ScopedMessagePipeHandle client_handle) {
+  std::map<std::string,
+           base::Callback<void(mojo::ScopedMessagePipeHandle)> >::iterator it =
+      service_factories_.find(name);
+  if (it == service_factories_.end())
+    return;
+
+  it->second.Run(client_handle.Pass());
+}
+
+}  // namespace content
diff --git a/content/common/mojo/service_registry_impl.h b/content/common/mojo/service_registry_impl.h
new file mode 100644
index 0000000..8e60b37
--- /dev/null
+++ b/content/common/mojo/service_registry_impl.h
@@ -0,0 +1,61 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_MOJO_SERVICE_REGISTRY_IMPL_H_
+#define CONTENT_COMMON_MOJO_SERVICE_REGISTRY_IMPL_H_
+
+#include <map>
+#include <queue>
+#include <string>
+#include <utility>
+
+#include "base/callback.h"
+#include "content/public/common/service_registry.h"
+#include "mojo/public/cpp/bindings/interface_impl.h"
+#include "mojo/public/cpp/system/core.h"
+#include "mojo/public/interfaces/interface_provider/interface_provider.mojom.h"
+
+namespace content {
+
+class ServiceRegistryImpl
+    : public ServiceRegistry,
+      public mojo::InterfaceImpl<mojo::IInterfaceProvider> {
+ public:
+  ServiceRegistryImpl();
+  explicit ServiceRegistryImpl(mojo::ScopedMessagePipeHandle handle);
+  virtual ~ServiceRegistryImpl();
+
+  // Binds to a remote ServiceProvider. This will expose added services to the
+  // remote ServiceProvider with the corresponding handle and enable
+  // GetInterface to provide access to services exposed by the remote
+  // ServiceProvider.
+  void BindRemoteServiceProvider(mojo::ScopedMessagePipeHandle handle);
+
+  // ServiceRegistry overrides.
+  virtual void AddService(
+      const std::string& service_name,
+      const base::Callback<void(mojo::ScopedMessagePipeHandle)> service_factory)
+      OVERRIDE;
+  virtual void RemoveService(const std::string& service_name) OVERRIDE;
+  virtual void GetRemoteInterface(
+      const base::StringPiece& service_name,
+      mojo::ScopedMessagePipeHandle handle) OVERRIDE;
+
+ private:
+  // mojo::InterfaceImpl<mojo::IInterfaceProvider> overrides.
+  virtual void GetInterface(
+      const mojo::String& name,
+      mojo::ScopedMessagePipeHandle client_handle) OVERRIDE;
+  virtual void OnConnectionError() OVERRIDE;
+
+  std::map<std::string, base::Callback<void(mojo::ScopedMessagePipeHandle)> >
+      service_factories_;
+  std::queue<std::pair<std::string, mojo::MessagePipeHandle> >
+      pending_connects_;
+  bool bound_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_MOJO_SERVICE_REGISTRY_IMPL_H_
diff --git a/content/common/render_frame_setup.mojom b/content/common/render_frame_setup.mojom
new file mode 100644
index 0000000..0315f06
--- /dev/null
+++ b/content/common/render_frame_setup.mojom
@@ -0,0 +1,14 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import "../../mojo/public/interfaces/interface_provider/interface_provider.mojom"
+
+module content {
+
+interface RenderFrameSetup {
+  GetServiceProviderForFrame(int32 frame_routing_id,
+                             mojo.IInterfaceProvider& service_provider);
+};
+
+}
diff --git a/content/common/web_ui_setup.mojom b/content/common/web_ui_setup.mojom
deleted file mode 100644
index d61d96c..0000000
--- a/content/common/web_ui_setup.mojom
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content {
-
-[Peer=WebUISetup]
-interface WebUISetupClient {
-};
-
-[Peer=WebUISetupClient]
-interface WebUISetup {
-  SetWebUIHandle(int32 view_routing_id, handle<message_pipe> web_ui_handle);
-};
-
-}
diff --git a/content/content_app.gypi b/content/content_app.gypi
index fcb98e9..d285cc7 100644
--- a/content/content_app.gypi
+++ b/content/content_app.gypi
@@ -67,8 +67,8 @@
     }, {  # OS!="ios"
       'dependencies': [
         '../mojo/mojo.gyp:mojo_environment_chromium',
+        '../mojo/mojo.gyp:mojo_interface_provider_bindings',
         '../mojo/mojo.gyp:mojo_service_manager',
-        '../mojo/mojo.gyp:mojo_service_provider_bindings',
         '../mojo/mojo.gyp:mojo_system_impl',
      ],
     }],
diff --git a/content/content_browser.gypi b/content/content_browser.gypi
index a3cf7e8..66db276 100644
--- a/content/content_browser.gypi
+++ b/content/content_browser.gypi
@@ -1510,8 +1510,8 @@
         '../cc/cc.gyp:cc',
         '../cc/cc.gyp:cc_surfaces',
         '../mojo/mojo.gyp:mojo_cpp_bindings',
+        '../mojo/mojo.gyp:mojo_interface_provider_bindings',
         '../mojo/mojo.gyp:mojo_js_bindings',
-        '../mojo/mojo.gyp:mojo_service_provider_bindings',
         '../net/net.gyp:http_server',
         '../third_party/leveldatabase/leveldatabase.gyp:leveldatabase',
         '../ui/surface/surface.gyp:surface',
diff --git a/content/content_child.gypi b/content/content_child.gypi
index 3e45b0c..6709bed 100644
--- a/content/content_child.gypi
+++ b/content/content_child.gypi
@@ -7,7 +7,7 @@
     '../base/base.gyp:base',
     '../components/tracing.gyp:tracing',
     '../mojo/mojo.gyp:mojo_environment_chromium',
-    '../mojo/mojo.gyp:mojo_service_provider_bindings',
+    '../mojo/mojo.gyp:mojo_interface_provider_bindings',
     '../skia/skia.gyp:skia',
     '../ui/base/ui_base.gyp:ui_base',
     '../ui/gfx/gfx.gyp:gfx',
diff --git a/content/content_common.gypi b/content/content_common.gypi
index 8f26dbf..7bc6b8ce 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -101,6 +101,7 @@
       'public/common/sandboxed_process_launcher_delegate.cc',
       'public/common/sandboxed_process_launcher_delegate.h',
       'public/common/security_style.h',
+      'public/common/service_registry.h',
       'public/common/show_desktop_notification_params.cc',
       'public/common/show_desktop_notification_params.h',
       'public/common/signed_certificate_timestamp_id_and_status.cc',
@@ -374,8 +375,8 @@
       'common/message_router.h',
       'common/mime_registry_messages.h',
       'common/mojo/mojo_messages.h',
-      'common/mojo/mojo_service_names.cc',
-      'common/mojo/mojo_service_names.h',
+      'common/mojo/service_registry_impl.cc',
+      'common/mojo/service_registry_impl.h',
       'common/navigation_gesture.h',
       'common/net/url_fetcher.cc',
       'common/net/url_request_user_data.cc',
@@ -532,8 +533,10 @@
         '../ipc/ipc.gyp:ipc',
         '../media/media.gyp:media',
         '../media/media.gyp:shared_memory_support',
+        '../mojo/mojo.gyp:mojo_cpp_bindings',
         '../mojo/mojo.gyp:mojo_environment_chromium',
         '../mojo/mojo.gyp:mojo_system_impl',
+        '../mojo/mojo.gyp:mojo_interface_provider_bindings',
         '../third_party/WebKit/public/blink.gyp:blink',
         '../ui/gl/gl.gyp:gl',
         '../webkit/common/gpu/webkit_gpu.gyp:webkit_gpu',
diff --git a/content/content_common_mojo_bindings.gypi b/content/content_common_mojo_bindings.gypi
index 7f35e67..5367991 100644
--- a/content/content_common_mojo_bindings.gypi
+++ b/content/content_common_mojo_bindings.gypi
@@ -12,7 +12,7 @@
         '../mojo/mojo.gyp:mojo_environment_chromium',
       ],
       'sources': [
-        'common/web_ui_setup.mojom',
+        'common/render_frame_setup.mojom',
       ],
       'includes': [ '../mojo/public/tools/bindings/mojom_bindings_generator.gypi' ],
       'export_dependent_settings': [
diff --git a/content/content_gpu.gypi b/content/content_gpu.gypi
index 4827493..1499f13 100644
--- a/content/content_gpu.gypi
+++ b/content/content_gpu.gypi
@@ -5,7 +5,7 @@
 {
   'dependencies': [
     '../base/base.gyp:base',
-    '../mojo/mojo.gyp:mojo_service_provider_bindings',
+    '../mojo/mojo.gyp:mojo_interface_provider_bindings',
     '../skia/skia.gyp:skia',
     '../ui/gl/gl.gyp:gl',
   ],
diff --git a/content/content_plugin.gypi b/content/content_plugin.gypi
index c6baab9..f95181d 100644
--- a/content/content_plugin.gypi
+++ b/content/content_plugin.gypi
@@ -6,7 +6,7 @@
   'conditions': [
     ['enable_plugins==1 and OS!="linux"', {
       'dependencies': [
-        '../mojo/mojo.gyp:mojo_service_provider_bindings',
+        '../mojo/mojo.gyp:mojo_interface_provider_bindings',
         '../skia/skia.gyp:skia',
         '../third_party/WebKit/public/blink.gyp:blink',
         '../third_party/npapi/npapi.gyp:npapi',
diff --git a/content/content_ppapi_plugin.gypi b/content/content_ppapi_plugin.gypi
index f79e1bf..6ee6b0a 100644
--- a/content/content_ppapi_plugin.gypi
+++ b/content/content_ppapi_plugin.gypi
@@ -7,7 +7,7 @@
     ['enable_plugins==1', {
       'dependencies': [
         '../base/base.gyp:base',
-        '../mojo/mojo.gyp:mojo_service_provider_bindings',
+        '../mojo/mojo.gyp:mojo_interface_provider_bindings',
         '../ppapi/ppapi_internal.gyp:ppapi_ipc',
         '../ui/base/ui_base.gyp:ui_base',
         '../ui/gfx/gfx.gyp:gfx',
diff --git a/content/content_renderer.gypi b/content/content_renderer.gypi
index 528ad4d..a717184 100644
--- a/content/content_renderer.gypi
+++ b/content/content_renderer.gypi
@@ -13,8 +13,8 @@
     '../jingle/jingle.gyp:jingle_glue',
     '../media/media.gyp:media',
     '../mojo/mojo.gyp:mojo_environment_chromium',
+    '../mojo/mojo.gyp:mojo_interface_provider_bindings',
     '../mojo/mojo.gyp:mojo_js_bindings_lib',
-    '../mojo/mojo.gyp:mojo_service_provider_bindings',
     '../net/net.gyp:net',
     '../skia/skia.gyp:skia',
     '../third_party/WebKit/public/blink.gyp:blink',
@@ -465,8 +465,6 @@
       'renderer/web_ui_mojo_context_state.h',
       'renderer/web_ui_runner.cc',
       'renderer/web_ui_runner.h',
-      'renderer/web_ui_setup_impl.cc',
-      'renderer/web_ui_setup_impl.h',
       'renderer/webclipboard_impl.cc',
       'renderer/webclipboard_impl.h',
       'renderer/webgraphicscontext3d_provider_impl.cc',
diff --git a/content/content_tests.gypi b/content/content_tests.gypi
index 9bb43ff..c33825d 100644
--- a/content/content_tests.gypi
+++ b/content/content_tests.gypi
@@ -991,6 +991,9 @@
             'public/test/content_browser_test_utils.h',
             'public/test/content_browser_test_utils_mac.mm',
           ],
+          'include_dirs': [
+            '<(SHARED_INTERMEDIATE_DIR)',
+          ],
           'conditions': [
             ['OS=="android"', {
               'dependencies': [
diff --git a/content/content_utility.gypi b/content/content_utility.gypi
index 2b46f7d..fd8fa77 100644
--- a/content/content_utility.gypi
+++ b/content/content_utility.gypi
@@ -6,7 +6,7 @@
   'dependencies': [
     '../base/base.gyp:base',
     '../courgette/courgette.gyp:courgette_lib',
-    '../mojo/mojo.gyp:mojo_service_provider_bindings',
+    '../mojo/mojo.gyp:mojo_interface_provider_bindings',
   ],
   'sources': [
     'public/utility/content_utility_client.cc',
diff --git a/content/content_worker.gypi b/content/content_worker.gypi
index a04b662..97ceab2 100644
--- a/content/content_worker.gypi
+++ b/content/content_worker.gypi
@@ -5,7 +5,7 @@
 {
   'dependencies': [
     '../base/base.gyp:base',
-    '../mojo/mojo.gyp:mojo_service_provider_bindings',
+    '../mojo/mojo.gyp:mojo_interface_provider_bindings',
     '../skia/skia.gyp:skia',
     '../third_party/WebKit/public/blink.gyp:blink',
   ],
diff --git a/content/gpu/BUILD.gn b/content/gpu/BUILD.gn
index 6a47b73..c00d3a6 100644
--- a/content/gpu/BUILD.gn
+++ b/content/gpu/BUILD.gn
@@ -27,7 +27,7 @@ source_set("gpu") {
   deps = [
     "//base",
     "//content:export",
-    "//mojo/public/interfaces/service_provider",
+    "//mojo/public/interfaces/interface_provider",
     "//skia",
     "//ui/gl",
   ]
diff --git a/content/plugin/BUILD.gn b/content/plugin/BUILD.gn
index a5e6481..3c18c56 100644
--- a/content/plugin/BUILD.gn
+++ b/content/plugin/BUILD.gn
@@ -29,7 +29,7 @@ if (enable_plugins && !is_linux) {
 
     deps = [
       "//content:export",
-      "//mojo/public/interfaces/service_provider",
+      "//mojo/public/interfaces/interface_provider",
       "//skia",
       "//third_party/npapi",
       "//third_party/WebKit/public:blink",
diff --git a/content/ppapi_plugin/BUILD.gn b/content/ppapi_plugin/BUILD.gn
index b27ae34..18f7b87 100644
--- a/content/ppapi_plugin/BUILD.gn
+++ b/content/ppapi_plugin/BUILD.gn
@@ -21,7 +21,7 @@ source_set("ppapi_plugin") {
   deps = [
     "//base",
     "//content:export",
-    "//mojo/public/interfaces/service_provider",
+    "//mojo/public/interfaces/interface_provider",
     "//ppapi:ppapi_ipc",
     "//skia",
     "//third_party/icu",
diff --git a/content/public/browser/render_frame_host.h b/content/public/browser/render_frame_host.h
index ac6ba5a..31f4d8d 100644
--- a/content/public/browser/render_frame_host.h
+++ b/content/public/browser/render_frame_host.h
@@ -21,6 +21,7 @@ class Value;
 namespace content {
 class RenderProcessHost;
 class RenderViewHost;
+class ServiceRegistry;
 class SiteInstance;
 
 // The interface provides a communication conduit with a frame in the renderer.
@@ -74,6 +75,9 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Temporary until we get rid of RenderViewHost.
   virtual RenderViewHost* GetRenderViewHost() = 0;
 
+  // Returns the ServiceRegistry for this frame.
+  virtual ServiceRegistry* GetServiceRegistry() = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/content/public/browser/render_process_host.h b/content/public/browser/render_process_host.h
index ee65036..b33a5b3 100644
--- a/content/public/browser/render_process_host.h
+++ b/content/public/browser/render_process_host.h
@@ -27,6 +27,7 @@ class BrowserContext;
 class BrowserMessageFilter;
 class RenderProcessHostObserver;
 class RenderWidgetHost;
+class ServiceRegistry;
 class StoragePartition;
 struct GlobalRequestID;
 
@@ -232,6 +233,9 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // have changed.
   virtual void NotifyTimezoneChange() = 0;
 
+  // Returns the ServiceRegistry for this process.
+  virtual ServiceRegistry* GetServiceRegistry() = 0;
+
   // Static management functions -----------------------------------------------
 
   // Flag to run the renderer in process.  This is primarily
diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
index 559c0ef..fcc81c0 100644
--- a/content/public/browser/render_view_host.h
+++ b/content/public/browser/render_view_host.h
@@ -210,9 +210,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   virtual void GetAudioOutputControllers(
       const GetAudioOutputControllersCallback& callback) const = 0;
 
-  // Sets the mojo handle for WebUI pages.
-  virtual void SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) = 0;
-
   // Notify the render view host to select the word around the caret.
   virtual void SelectWordAroundCaret() = 0;
 
diff --git a/content/public/common/service_registry.h b/content/public/common/service_registry.h
new file mode 100644
index 0000000..f35bad4
--- /dev/null
+++ b/content/public/common/service_registry.h
@@ -0,0 +1,73 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_SERVICE_REGISTRY_H_
+#define CONTENT_PUBLIC_COMMON_SERVICE_REGISTRY_H_
+
+#include <string>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/strings/string_piece.h"
+#include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/interface_ptr.h"
+#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/system/core.h"
+
+namespace content {
+
+// A ServiceRegistry exposes local services that have been added using
+// AddService to a paired remote ServiceRegistry and provides local access to
+// services exposed by the remote ServiceRegistry through GetInterface.
+class CONTENT_EXPORT ServiceRegistry {
+ public:
+  virtual ~ServiceRegistry() {}
+
+  // Make the service created by |service_factory| available to the remote
+  // InterfaceProvider. In response to each request for a service,
+  // |service_factory| will be run with an InterfaceRequest<Interface>
+  // representing that request.
+  template <typename Interface>
+  void AddService(const base::Callback<void(mojo::InterfaceRequest<Interface>)>
+                      service_factory) {
+    AddService(Interface::Name_,
+               base::Bind(&ServiceRegistry::ForwardToServiceFactory<Interface>,
+                          service_factory));
+  }
+  virtual void AddService(
+      const std::string& service_name,
+      const base::Callback<void(mojo::ScopedMessagePipeHandle)>
+          service_factory) = 0;
+
+  // Remove future access to the service implementing Interface. Existing
+  // connections to the service are unaffected.
+  template <typename Interface>
+  void RemoveService() {
+    RemoveService(Interface::Name_);
+  }
+  virtual void RemoveService(const std::string& service_name) = 0;
+
+  // Connect to an interface provided by the remote interface provider.
+  template <typename Interface>
+  void GetRemoteInterface(mojo::InterfacePtr<Interface>* ptr) {
+    mojo::MessagePipe pipe;
+    ptr->Bind(pipe.handle0.Pass());
+    GetRemoteInterface(Interface::Name_, pipe.handle1.Pass());
+  }
+  virtual void GetRemoteInterface(const base::StringPiece& name,
+                                  mojo::ScopedMessagePipeHandle handle) = 0;
+
+ private:
+  template <typename Interface>
+  static void ForwardToServiceFactory(
+      const base::Callback<void(mojo::InterfaceRequest<Interface>)>
+          service_factory,
+      mojo::ScopedMessagePipeHandle handle) {
+    service_factory.Run(mojo::MakeRequest<Interface>(handle.Pass()));
+  }
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_SERVICE_REGISTRY_H_
diff --git a/content/public/renderer/render_frame.h b/content/public/renderer/render_frame.h
index c48acd8..cbc1546 100644
--- a/content/public/renderer/render_frame.h
+++ b/content/public/renderer/render_frame.h
@@ -25,6 +25,7 @@ struct WebPluginParams;
 namespace content {
 class ContextMenuClient;
 class RenderView;
+class ServiceRegistry;
 struct ContextMenuParams;
 struct WebPluginInfo;
 
@@ -88,6 +89,9 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   // Return true if this frame is hidden.
   virtual bool IsHidden() = 0;
 
+  // Returns the ServiceRegistry for this frame.
+  virtual ServiceRegistry* GetServiceRegistry() = 0;
+
  protected:
   virtual ~RenderFrame() {}
 
diff --git a/content/public/renderer/render_thread.h b/content/public/renderer/render_thread.h
index a545150..695f1fd 100644
--- a/content/public/renderer/render_thread.h
+++ b/content/public/renderer/render_thread.h
@@ -39,6 +39,7 @@ namespace content {
 
 class RenderProcessObserver;
 class ResourceDispatcherDelegate;
+class ServiceRegistry;
 
 class CONTENT_EXPORT RenderThread : public IPC::Sender {
  public:
@@ -136,6 +137,9 @@ class CONTENT_EXPORT RenderThread : public IPC::Sender {
   // Release cached font.
   virtual void ReleaseCachedFonts() = 0;
 #endif
+
+  // Returns the ServiceRegistry for this thread.
+  virtual ServiceRegistry* GetServiceRegistry() = 0;
 };
 
 }  // namespace content
diff --git a/content/public/test/mock_render_process_host.cc b/content/public/test/mock_render_process_host.cc
index 7fb8d03..d503ca5 100644
--- a/content/public/test/mock_render_process_host.cc
+++ b/content/public/test/mock_render_process_host.cc
@@ -223,6 +223,10 @@ void MockRenderProcessHost::ResumeRequestsForView(int route_id) {
 void MockRenderProcessHost::NotifyTimezoneChange() {
 }
 
+ServiceRegistry* MockRenderProcessHost::GetServiceRegistry() {
+  return NULL;
+}
+
 void MockRenderProcessHost::FilterURL(bool empty_allowed, GURL* url) {
   RenderProcessHostImpl::FilterURL(this, empty_allowed, url);
 }
diff --git a/content/public/test/mock_render_process_host.h b/content/public/test/mock_render_process_host.h
index a131efe..863bc67 100644
--- a/content/public/test/mock_render_process_host.h
+++ b/content/public/test/mock_render_process_host.h
@@ -85,6 +85,7 @@ class MockRenderProcessHost : public RenderProcessHost {
   virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id)
       OVERRIDE;
   virtual void NotifyTimezoneChange() OVERRIDE;
+  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // IPC::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg) OVERRIDE;
diff --git a/content/public/test/mock_render_thread.cc b/content/public/test/mock_render_thread.cc
index 0d1b0bc..96bce94 100644
--- a/content/public/test/mock_render_thread.cc
+++ b/content/public/test/mock_render_thread.cc
@@ -188,6 +188,10 @@ void MockRenderThread::ReleaseCachedFonts() {
 
 #endif  // OS_WIN
 
+ServiceRegistry* MockRenderThread::GetServiceRegistry() {
+  return NULL;
+}
+
 void MockRenderThread::SendCloseMessage() {
   ViewMsg_Close msg(routing_id_);
   RenderViewImpl::FromRoutingID(routing_id_)->OnMessageReceived(msg);
diff --git a/content/public/test/mock_render_thread.h b/content/public/test/mock_render_thread.h
index b664697..f03b684 100644
--- a/content/public/test/mock_render_thread.h
+++ b/content/public/test/mock_render_thread.h
@@ -71,6 +71,7 @@ class MockRenderThread : public RenderThread {
   virtual void PreCacheFont(const LOGFONT& log_font) OVERRIDE;
   virtual void ReleaseCachedFonts() OVERRIDE;
 #endif
+  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   //////////////////////////////////////////////////////////////////////////
   // The following functions are called by the test itself.
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index 4dde197..7cf46fd 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -29,7 +29,7 @@ source_set("renderer") {
     "//gin",
     "//mojo/environment:chromium",
     "//mojo/public/js/bindings",
-    "//mojo/public/interfaces/service_provider",
+    "//mojo/public/interfaces/interface_provider",
     "//net",
     "//skia",
     "//third_party/icu",
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 8ae2be2..92e7367 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -408,12 +408,12 @@ RenderFrameImpl::RenderFrameImpl(RenderViewImpl* render_view, int routing_id)
       geolocation_dispatcher_(NULL),
       screen_orientation_dispatcher_(NULL),
       weak_factory_(this) {
-  RenderThread::Get()->AddRoute(routing_id_, this);
-
   std::pair<RoutingIDFrameMap::iterator, bool> result =
       g_routing_id_frame_map.Get().insert(std::make_pair(routing_id_, this));
   CHECK(result.second) << "Inserting a duplicate item.";
 
+  RenderThread::Get()->AddRoute(routing_id_, this);
+
   render_view_->RegisterRenderFrame(this);
 
 #if defined(OS_ANDROID)
@@ -904,6 +904,11 @@ void RenderFrameImpl::OnNavigate(const FrameMsg_Navigate_Params& params) {
   render_view_->pending_navigation_params_.reset();
 }
 
+void RenderFrameImpl::BindServiceRegistry(
+    mojo::ScopedMessagePipeHandle service_provider_handle) {
+  service_registry_.BindRemoteServiceProvider(service_provider_handle.Pass());
+}
+
 void RenderFrameImpl::OnBeforeUnload() {
   // TODO(creis): Right now, this is only called on the main frame.  Make the
   // browser process send dispatchBeforeUnloadEvent to every frame that needs
@@ -1316,6 +1321,10 @@ void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
   OnJavaScriptExecuteRequest(javascript, 0, false);
 }
 
+ServiceRegistry* RenderFrameImpl::GetServiceRegistry() {
+  return &service_registry_;
+}
+
 // blink::WebFrameClient implementation ----------------------------------------
 
 blink::WebPlugin* RenderFrameImpl::createPlugin(
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 71be416..117cc0b 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -14,6 +14,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "base/process/process_handle.h"
+#include "content/common/mojo/service_registry_impl.h"
 #include "content/public/common/javascript_message_type.h"
 #include "content/public/common/referrer.h"
 #include "content/public/renderer/render_frame.h"
@@ -222,6 +223,7 @@ class CONTENT_EXPORT RenderFrameImpl
                                  blink::WebNavigationPolicy policy) OVERRIDE;
   virtual void ExecuteJavaScript(const base::string16& javascript) OVERRIDE;
   virtual bool IsHidden() OVERRIDE;
+  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // blink::WebFrameClient implementation:
   virtual blink::WebPlugin* createPlugin(blink::WebLocalFrame* frame,
@@ -397,6 +399,11 @@ class CONTENT_EXPORT RenderFrameImpl
   // this back to private member.
   void OnNavigate(const FrameMsg_Navigate_Params& params);
 
+  // Binds this render frame's service registry to a handle to the remote
+  // service registry.
+  void BindServiceRegistry(
+      mojo::ScopedMessagePipeHandle service_provider_handle);
+
  protected:
   RenderFrameImpl(RenderViewImpl* render_view, int32 routing_id);
 
@@ -631,6 +638,8 @@ class CONTENT_EXPORT RenderFrameImpl
   // The geolocation dispatcher attached to this view, lazily initialized.
   GeolocationDispatcher* geolocation_dispatcher_;
 
+  ServiceRegistryImpl service_registry_;
+
   // The screen orientation dispatcher attached to the view, lazily initialized.
   ScreenOrientationDispatcher* screen_orientation_dispatcher_;
 
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 6e124b3..2cf4fd8 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -51,7 +51,7 @@
 #include "content/common/gpu/client/gpu_memory_buffer_impl.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/gpu/gpu_process_launch_causes.h"
-#include "content/common/mojo/mojo_service_names.h"
+#include "content/common/render_frame_setup.mojom.h"
 #include "content/common/resource_messages.h"
 #include "content/common/view_messages.h"
 #include "content/common/worker_messages.h"
@@ -95,7 +95,6 @@
 #include "content/renderer/service_worker/embedded_worker_context_message_filter.h"
 #include "content/renderer/service_worker/embedded_worker_dispatcher.h"
 #include "content/renderer/shared_worker/embedded_shared_worker_stub.h"
-#include "content/renderer/web_ui_setup_impl.h"
 #include "grit/content_resources.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_forwarding_message_filter.h"
@@ -266,6 +265,31 @@ void NotifyTimezoneChangeOnThisThread() {
   v8::Date::DateTimeConfigurationChangeNotification(isolate);
 }
 
+class RenderFrameSetupImpl : public mojo::InterfaceImpl<RenderFrameSetup> {
+ public:
+  virtual void GetServiceProviderForFrame(
+      int32_t frame_routing_id,
+      mojo::InterfaceRequest<mojo::IInterfaceProvider> request) OVERRIDE {
+    RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(frame_routing_id);
+    // We can receive a GetServiceProviderForFrame message for a frame not yet
+    // created due to a race between the message and a ViewMsg_New IPC that
+    // triggers creation of the RenderFrame we want.
+    if (!frame) {
+      RenderThreadImpl::current()->RegisterPendingRenderFrameConnect(
+          frame_routing_id, request.PassMessagePipe());
+      return;
+    }
+
+    frame->BindServiceRegistry(request.PassMessagePipe());
+  }
+
+  virtual void OnConnectionError() OVERRIDE { delete this; }
+};
+
+void CreateRenderFrameSetup(mojo::InterfaceRequest<RenderFrameSetup> request) {
+  mojo::BindToRequest(new RenderFrameSetupImpl(), &request);
+}
+
 }  // namespace
 
 RenderThreadImpl::HistogramCustomizer::HistogramCustomizer() {
@@ -508,10 +532,19 @@ void RenderThreadImpl::Init() {
     }
   }
 
+  service_registry()->AddService<RenderFrameSetup>(
+      base::Bind(CreateRenderFrameSetup));
+
   TRACE_EVENT_END_ETW("RenderThreadImpl::Init", 0, "");
 }
 
 RenderThreadImpl::~RenderThreadImpl() {
+  for (std::map<int, mojo::MessagePipeHandle>::iterator it =
+           pending_render_frame_connects_.begin();
+       it != pending_render_frame_connects_.end();
+       ++it) {
+    mojo::CloseRaw(it->second);
+  }
 }
 
 void RenderThreadImpl::Shutdown() {
@@ -680,6 +713,18 @@ scoped_refptr<base::MessageLoopProxy>
 
 void RenderThreadImpl::AddRoute(int32 routing_id, IPC::Listener* listener) {
   ChildThread::GetRouter()->AddRoute(routing_id, listener);
+  std::map<int, mojo::MessagePipeHandle>::iterator it =
+      pending_render_frame_connects_.find(routing_id);
+  if (it == pending_render_frame_connects_.end())
+    return;
+
+  RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(routing_id);
+  if (!frame)
+    return;
+
+  mojo::ScopedMessagePipeHandle handle(it->second);
+  pending_render_frame_connects_.erase(it);
+  frame->BindServiceRegistry(handle.Pass());
 }
 
 void RenderThreadImpl::RemoveRoute(int32 routing_id) {
@@ -703,6 +748,15 @@ void RenderThreadImpl::RemoveEmbeddedWorkerRoute(int32 routing_id) {
   }
 }
 
+void RenderThreadImpl::RegisterPendingRenderFrameConnect(
+    int routing_id,
+    mojo::ScopedMessagePipeHandle handle) {
+  std::pair<std::map<int, mojo::MessagePipeHandle>::iterator, bool> result =
+      pending_render_frame_connects_.insert(
+          std::make_pair(routing_id, handle.release()));
+  CHECK(result.second) << "Inserting a duplicate item.";
+}
+
 int RenderThreadImpl::GenerateRoutingID() {
   int routing_id = MSG_ROUTING_NONE;
   Send(new ViewHostMsg_GenerateRoutingID(&routing_id));
@@ -1099,6 +1153,10 @@ void RenderThreadImpl::ReleaseCachedFonts() {
 
 #endif  // OS_WIN
 
+ServiceRegistry* RenderThreadImpl::GetServiceRegistry() {
+  return service_registry();
+}
+
 bool RenderThreadImpl::IsMainThread() {
   return !!current();
 }
@@ -1179,19 +1237,6 @@ scoped_ptr<gfx::GpuMemoryBuffer> RenderThreadImpl::AllocateGpuMemoryBuffer(
       .PassAs<gfx::GpuMemoryBuffer>();
 }
 
-void RenderThreadImpl::ConnectToService(
-    const mojo::String& service_url,
-    const mojo::String& service_name,
-    mojo::ScopedMessagePipeHandle message_pipe,
-    const mojo::String& requestor_url) {
-  // TODO(darin): Invent some kind of registration system to use here.
-  if (service_url.To<base::StringPiece>() == kRendererService_WebUISetup) {
-    WebUISetupImpl::Bind(message_pipe.Pass());
-  } else {
-    NOTREACHED() << "Unknown service name";
-  }
-}
-
 void RenderThreadImpl::DoNotSuspendWebKitSharedTimer() {
   suspend_webkit_shared_timer_ = false;
 }
diff --git a/content/renderer/render_thread_impl.h b/content/renderer/render_thread_impl.h
index d8d50c8..3bc7f9d 100644
--- a/content/renderer/render_thread_impl.h
+++ b/content/renderer/render_thread_impl.h
@@ -166,6 +166,7 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
   virtual void PreCacheFont(const LOGFONT& log_font) OVERRIDE;
   virtual void ReleaseCachedFonts() OVERRIDE;
 #endif
+  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // Synchronously establish a channel to the GPU plugin if not previously
   // established or if it has been lost (for example if the GPU plugin crashed).
@@ -400,6 +401,9 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
   void AddEmbeddedWorkerRoute(int32 routing_id, IPC::Listener* listener);
   void RemoveEmbeddedWorkerRoute(int32 routing_id);
 
+  void RegisterPendingRenderFrameConnect(int routing_id,
+                                         mojo::ScopedMessagePipeHandle handle);
+
  private:
   // ChildThread
   virtual bool OnControlMessageReceived(const IPC::Message& msg) OVERRIDE;
@@ -425,13 +429,6 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
       unsigned internalformat,
       unsigned usage) OVERRIDE;
 
-  // mojo::ServiceProvider implementation:
-  virtual void ConnectToService(
-      const mojo::String& service_url,
-      const mojo::String& service_name,
-      mojo::ScopedMessagePipeHandle message_pipe,
-      const mojo::String& requestor_url) OVERRIDE;
-
   void Init();
 
   void OnSetZoomLevelForCurrentURL(const std::string& scheme,
@@ -580,6 +577,8 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
   bool is_zero_copy_enabled_;
   bool is_one_copy_enabled_;
 
+  std::map<int, mojo::MessagePipeHandle> pending_render_frame_connects_;
+
   DISALLOW_COPY_AND_ASSIGN(RenderThreadImpl);
 };
 
diff --git a/content/renderer/web_ui_mojo.cc b/content/renderer/web_ui_mojo.cc
index 38c71d5..4ff9230 100644
--- a/content/renderer/web_ui_mojo.cc
+++ b/content/renderer/web_ui_mojo.cc
@@ -5,6 +5,7 @@
 #include "content/renderer/web_ui_mojo.h"
 
 #include "content/common/view_messages.h"
+#include "content/public/common/service_registry.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_view.h"
 #include "content/renderer/web_ui_mojo_context_state.h"
@@ -84,8 +85,11 @@ void WebUIMojo::DestroyContextState(v8::Handle<v8::Context> context) {
 
 void WebUIMojo::OnDidFinishDocumentLoad() {
   did_finish_document_load_ = true;
-  if (pending_handle_.is_valid())
-    SetHandleOnContextState(pending_handle_.Pass());
+  mojo::MessagePipe pipe;
+  SetHandleOnContextState(pipe.handle0.Pass());
+  RenderFrame::FromWebFrame(render_view()->GetWebView()->mainFrame())->
+      GetServiceRegistry()->
+          GetRemoteInterface("webui_controller", pipe.handle1.Pass());
 }
 
 void WebUIMojo::SetHandleOnContextState(mojo::ScopedMessagePipeHandle handle) {
diff --git a/content/renderer/web_ui_setup_impl.cc b/content/renderer/web_ui_setup_impl.cc
deleted file mode 100644
index 7cb7cda..0000000
--- a/content/renderer/web_ui_setup_impl.cc
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/web_ui_setup_impl.h"
-
-#include "content/public/renderer/render_view.h"
-#include "content/renderer/web_ui_mojo.h"
-
-namespace content {
-
-// static
-void WebUISetupImpl::Bind(mojo::ScopedMessagePipeHandle handle) {
-  mojo::BindToPipe(new WebUISetupImpl(), handle.Pass());
-}
-
-void WebUISetupImpl::OnConnectionError() {
-  delete this;
-}
-
-void WebUISetupImpl::SetWebUIHandle(
-    int32 view_routing_id,
-    mojo::ScopedMessagePipeHandle web_ui_handle) {
-  RenderView* render_view = RenderView::FromRoutingID(view_routing_id);
-  if (!render_view)
-    return;
-  WebUIMojo* web_ui_mojo = WebUIMojo::Get(render_view);
-  if (!web_ui_mojo)
-    return;
-  web_ui_mojo->SetBrowserHandle(web_ui_handle.Pass());
-}
-
-}  // namespace content
diff --git a/content/renderer/web_ui_setup_impl.h b/content/renderer/web_ui_setup_impl.h
deleted file mode 100644
index 6523454..0000000
--- a/content/renderer/web_ui_setup_impl.h
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
-#define CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
-
-#include "base/basictypes.h"
-#include "content/common/web_ui_setup.mojom.h"
-
-namespace content {
-
-class WebUISetupImpl : public mojo::InterfaceImpl<WebUISetup> {
- public:
-  static void Bind(mojo::ScopedMessagePipeHandle handle);
-
- private:
-  WebUISetupImpl() {}
-
-  virtual void OnConnectionError() OVERRIDE;
-
-  // WebUISetup methods:
-  virtual void SetWebUIHandle(
-      int32_t view_routing_id,
-      mojo::ScopedMessagePipeHandle web_ui_handle) OVERRIDE;
-
-  DISALLOW_COPY_AND_ASSIGN(WebUISetupImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
diff --git a/content/utility/BUILD.gn b/content/utility/BUILD.gn
index 1cc0ead..a15e64b 100644
--- a/content/utility/BUILD.gn
+++ b/content/utility/BUILD.gn
@@ -17,7 +17,7 @@ source_set("utility") {
     "//base",
     "//content:export",
     "//courgette:courgette_lib",
-    "//mojo/public/interfaces/service_provider",
+    "//mojo/public/interfaces/interface_provider",
     "//third_party/WebKit/public:blink_headers",
   ]
 }
diff --git a/content/worker/BUILD.gn b/content/worker/BUILD.gn
index 3726aa8..52a0206 100644
--- a/content/worker/BUILD.gn
+++ b/content/worker/BUILD.gn
@@ -24,7 +24,7 @@ source_set("worker") {
 
   deps = [
     "//base",
-    "//mojo/public/interfaces/service_provider",
+    "//mojo/public/interfaces/interface_provider",
     "//skia",
     "//third_party/WebKit/public:blink",
   ]