Hook embedded shell up to MojoShellConnection

BUG=586314,589242

Review URL: https://codereview.chromium.org/1738663002

Cr-Commit-Position: refs/heads/master@{#377823}

32 files changed, 281 insertions, 92 deletions

diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 8ae5275..26fd1b1 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -43,6 +43,7 @@ source_set("browser") {
     "//mojo/shell",
     "//mojo/shell/public/cpp:cpp_for_chromium",
     "//mojo/shell/public/interfaces",
+    "//mojo/shell/runner/host:lib",
     "//net",
     "//net:extras",
     "//skia",
@@ -107,12 +108,6 @@ source_set("browser") {
             ],
             ".")
 
-    sources += [
-      "mojo/mojo_shell_client_host.cc",
-      "mojo/mojo_shell_client_host.h",
-      "mojo/renderer_capability_filter.cc",
-    ]
-
     # Non-iOS deps.
     deps += [
       "//cc",
diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
index 5380cd7..666fdf3 100644
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -41,12 +41,6 @@
 #include "content/browser/mach_broker_mac.h"
 #endif
 
-
-#if defined(MOJO_SHELL_CLIENT)
-#include "content/browser/mojo/mojo_shell_client_host.h"
-#include "content/common/mojo/mojo_shell_connection_impl.h"
-#endif
-
 namespace content {
 namespace {
 
diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index 8f6909b..d7a4638 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc
@@ -63,6 +63,7 @@
 #include "content/common/content_switches_internal.h"
 #include "content/common/host_discardable_shared_memory_manager.h"
 #include "content/common/host_shared_bitmap_manager.h"
+#include "content/common/mojo/mojo_shell_connection_impl.h"
 #include "content/public/browser/browser_main_parts.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
@@ -76,6 +77,7 @@
 #include "media/base/media.h"
 #include "media/base/user_input_monitor.h"
 #include "media/midi/midi_manager.h"
+#include "mojo/shell/public/cpp/shell.h"
 #include "net/base/network_change_notifier.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/ssl/ssl_config_service.h"
@@ -177,9 +179,6 @@
 #endif
 
 #if defined(MOJO_SHELL_CLIENT)
-#include "content/common/mojo/mojo_shell_connection_impl.h"
-#include "mojo/converters/network/network_type_converters.h"
-#include "mojo/shell/public/cpp/shell.h"
 #include "ui/views/mus/window_manager_connection.h"
 #endif
 
@@ -915,16 +914,14 @@ int BrowserMainLoop::CreateThreads() {
 }
 
 int BrowserMainLoop::PreMainMessageLoopRun() {
-#if defined(MOJO_SHELL_CLIENT)
   if (IsRunningInMojoShell()) {
     MojoShellConnectionImpl::Create();
     MojoShellConnectionImpl::Get()->BindToCommandLinePlatformChannel();
-#if defined(USE_AURA)
+#if defined(MOJO_SHELL_CLIENT) && defined(USE_AURA)
     views::WindowManagerConnection::Create(
         MojoShellConnection::Get()->GetShell());
 #endif
   }
-#endif
 
   if (parts_) {
     TRACE_EVENT0("startup",
@@ -972,9 +969,8 @@ void BrowserMainLoop::ShutdownThreadsAndCleanUp() {
       base::Bind(base::IgnoreResult(&base::ThreadRestrictions::SetIOAllowed),
                  true));
 
-#if defined(MOJO_SHELL_CLIENT)
-  MojoShellConnection::Destroy();
-#endif
+  if (IsRunningInMojoShell())
+    MojoShellConnection::Destroy();
 
 #if !defined(OS_IOS)
   if (RenderProcessHost::run_renderer_in_process())
diff --git a/content/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 2360468..a0ea17a 100644
--- a/content/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -132,6 +132,8 @@ TEST_F(ChildProcessSecurityPolicyTest, IsWebSafeSchemeTest) {
   EXPECT_TRUE(p->IsWebSafeScheme("registered-web-safe-scheme"));
 
   EXPECT_FALSE(p->IsWebSafeScheme(kChromeUIScheme));
+  EXPECT_FALSE(p->IsWebSafeScheme(kExeScheme));
+  EXPECT_FALSE(p->IsWebSafeScheme(kMojoScheme));
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, IsPseudoSchemeTest) {
diff --git a/content/browser/mojo/mojo_shell_client_host.cc b/content/browser/mojo/mojo_shell_client_host.cc
index 86a6737..6a7b707 100644
--- a/content/browser/mojo/mojo_shell_client_host.cc
+++ b/content/browser/mojo/mojo_shell_client_host.cc
@@ -111,6 +111,7 @@ class PIDSender : public RenderProcessHostObserver {
 }  // namespace
 
 void RegisterChildWithExternalShell(int child_process_id,
+                                    int instance_id,
                                     RenderProcessHost* render_process_host) {
   // Some process types get created before the main message loop.
   if (!MojoShellConnection::Get())
@@ -143,8 +144,8 @@ void RegisterChildWithExternalShell(int child_process_id,
   //             specification is best determined (not here, this is a common
   //             chokepoint for all process types) and how to wire it through.
   //             http://crbug.com/555393
-  std::string url =
-      base::StringPrintf("exe:chrome_renderer%d", child_process_id);
+  std::string url = base::StringPrintf(
+      "exe:chrome_renderer%d_%d", child_process_id, instance_id);
 
   mojo::shell::mojom::PIDReceiverPtr pid_receiver;
   mojo::InterfaceRequest<mojo::shell::mojom::PIDReceiver> request =
diff --git a/content/browser/mojo/mojo_shell_client_host.h b/content/browser/mojo/mojo_shell_client_host.h
index 8b945fa..6585d58 100644
--- a/content/browser/mojo/mojo_shell_client_host.h
+++ b/content/browser/mojo/mojo_shell_client_host.h
@@ -16,9 +16,10 @@ class RenderProcessHost;
 
 // Creates a communication channel between the external Mojo shell and the
 // child. The server handle of this channel is shared with the external shell
-// via Mojo IPC. |child_process_id| is used to uniquify the child in the
-// external shell's instance map.
+// via Mojo IPC. |child_process_id| and |instance_id| are used to uniquify the
+// child in the external shell's instance map.
 void RegisterChildWithExternalShell(int child_process_id,
+                                    int instance_id,
                                     RenderProcessHost* render_process_host);
 
 // Returns the URL associated with an instance corresponding to the renderer
diff --git a/content/browser/mojo/mojo_shell_context.cc b/content/browser/mojo/mojo_shell_context.cc
index 31f449a..4b0e3be 100644
--- a/content/browser/mojo/mojo_shell_context.cc
+++ b/content/browser/mojo/mojo_shell_context.cc
@@ -13,6 +13,7 @@
 #include "base/thread_task_runner_handle.h"
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/common/gpu/gpu_process_launch_causes.h"
+#include "content/common/mojo/mojo_shell_connection_impl.h"
 #include "content/common/mojo/static_application_loader.h"
 #include "content/common/process_control.mojom.h"
 #include "content/public/browser/browser_thread.h"
@@ -27,12 +28,17 @@
 #include "mojo/shell/application_loader.h"
 #include "mojo/shell/connect_params.h"
 #include "mojo/shell/identity.h"
+#include "mojo/shell/native_runner.h"
 #include "mojo/shell/public/cpp/shell_client.h"
+#include "mojo/shell/public/interfaces/shell.mojom.h"
+#include "mojo/shell/runner/host/in_process_native_runner.h"
 
 namespace content {
 
 namespace {
 
+const char kBrowserAppUrl[] = "exe:chrome";
+
 // An extra set of apps to register on initialization, if set by a test.
 const MojoShellContext::StaticApplicationMap* g_applications_for_test;
 
@@ -201,8 +207,12 @@ MojoShellContext::MojoShellContext() {
       BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE);
   bool register_mojo_url_schemes = false;
 
+  scoped_ptr<mojo::shell::NativeRunnerFactory> native_runner_factory(
+      new mojo::shell::InProcessNativeRunnerFactory(
+          BrowserThread::GetBlockingPool()));
   application_manager_.reset(new mojo::shell::ApplicationManager(
-      nullptr, file_task_runner.get(), register_mojo_url_schemes, nullptr));
+      std::move(native_runner_factory), file_task_runner.get(),
+      register_mojo_url_schemes, nullptr));
 
   application_manager_->set_default_loader(
       scoped_ptr<mojo::shell::ApplicationLoader>(new DefaultApplicationLoader));
@@ -249,9 +259,16 @@ MojoShellContext::MojoShellContext() {
       scoped_ptr<mojo::shell::ApplicationLoader>(new GpuProcessLoader()),
       GURL("mojo:media"));
 #endif
+
+  if (!IsRunningInMojoShell()) {
+    MojoShellConnectionImpl::Create(
+        application_manager_->InitInstanceForEmbedder(GURL(kBrowserAppUrl)));
+  }
 }
 
 MojoShellContext::~MojoShellContext() {
+  if (!IsRunningInMojoShell())
+    MojoShellConnectionImpl::Destroy();
 }
 
 // static
diff --git a/content/browser/mojo/renderer_capability_filter.cc b/content/browser/mojo/renderer_capability_filter.cc
index d2f362e..c08f5e9 100644
--- a/content/browser/mojo/renderer_capability_filter.cc
+++ b/content/browser/mojo/renderer_capability_filter.cc
@@ -4,9 +4,12 @@
 
 #include <utility>
 
-#include "components/mus/public/interfaces/gpu.mojom.h"
 #include "content/browser/mojo/mojo_shell_client_host.h"
 
+#if defined(MOJO_SHELL_CLIENT)
+#include "components/mus/public/interfaces/gpu.mojom.h"
+#endif
+
 namespace content {
 
 mojo::shell::mojom::CapabilityFilterPtr CreateCapabilityFilterForRenderer() {
@@ -14,9 +17,12 @@ mojo::shell::mojom::CapabilityFilterPtr CreateCapabilityFilterForRenderer() {
   // think about when changing it.
   mojo::shell::mojom::CapabilityFilterPtr filter(
       mojo::shell::mojom::CapabilityFilter::New());
+  filter->filter.SetToEmpty();
+#if defined(MOJO_SHELL_CLIENT)
   mojo::Array<mojo::String> window_manager_interfaces;
   window_manager_interfaces.push_back(mus::mojom::Gpu::Name_);
   filter->filter.insert("mojo:mus", std::move(window_manager_interfaces));
+#endif
   return filter;
 }
 
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index e393673..b62a5b5 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -80,6 +80,7 @@
 #include "content/browser/message_port_message_filter.h"
 #include "content/browser/mime_registry_message_filter.h"
 #include "content/browser/mojo/mojo_application_host.h"
+#include "content/browser/mojo/mojo_shell_client_host.h"
 #include "content/browser/navigator_connect/service_port_service_impl.h"
 #include "content/browser/notifications/notification_message_filter.h"
 #include "content/browser/permissions/permission_service_context.h"
@@ -124,6 +125,7 @@
 #include "content/common/in_process_child_thread_params.h"
 #include "content/common/mojo/channel_init.h"
 #include "content/common/mojo/mojo_messages.h"
+#include "content/common/mojo/mojo_shell_connection_impl.h"
 #include "content/common/render_process_messages.h"
 #include "content/common/resource_messages.h"
 #include "content/common/site_isolation_policy.h"
@@ -230,11 +232,6 @@
 #include "content/common/media/media_stream_messages.h"
 #endif
 
-#if defined(MOJO_SHELL_CLIENT)
-#include "content/browser/mojo/mojo_shell_client_host.h"
-#include "content/common/mojo/mojo_shell_connection_impl.h"
-#endif
-
 #if defined(OS_WIN)
 #define IntToStringType base::IntToString16
 #else
@@ -626,10 +623,6 @@ RenderProcessHostImpl::RenderProcessHostImpl(
   IPC::AttachmentBrokerPrivileged::CreateBrokerIfNeeded();
 #endif  // defined(OS_MACOSX) && !defined(OS_IOS)
 #endif  // USE_ATTACHMENT_BROKER
-
-#if defined(MOJO_SHELL_CLIENT)
-  RegisterChildWithExternalShell(id_, this);
-#endif
 }
 
 // static
@@ -708,6 +701,8 @@ bool RenderProcessHostImpl::Init() {
   if (channel_)
     return true;
 
+  RegisterChildWithExternalShell(id_, instance_id_++, this);
+
   base::CommandLine::StringType renderer_prefix;
   // A command prefix is something prepended to the command line of the spawned
   // process.
@@ -1631,11 +1626,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
       renderer_cmd->AppendSwitch(switches::kWaitForDebugger);
     }
   }
-
-#if defined(MOJO_SHELL_CLIENT)
-  if (IsRunningInMojoShell())
-    renderer_cmd->AppendSwitch(switches::kEnableMojoShellConnection);
-#endif
 }
 
 base::ProcessHandle RenderProcessHostImpl::GetHandle() const {
@@ -2588,10 +2578,8 @@ void RenderProcessHostImpl::OnProcessLaunched() {
                                      process_handle, true)));
   }
 
-#if defined(MOJO_SHELL_CLIENT)
   // Send the mojo shell handle to the renderer.
   SendExternalMojoShellHandleToChild(GetHandle(), this);
-#endif
 
   // Allow Mojo to be setup before the renderer sees any Chrome IPC messages.
   // This way, Mojo can be safely used from the renderer in response to any
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 03a6f0c..4c6455f 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -414,6 +414,11 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // The globally-unique identifier for this RPH.
   const int id_;
 
+  // A secondary ID used by the Mojo shell to distinguish different incarnations
+  // of the same RPH from each other. Unlike |id_| this is not globally unique,
+  // but it is guaranteed to change every time Init() is called.
+  int instance_id_ = 1;
+
   BrowserContext* browser_context_;
 
   // Owned by |browser_context_|.
diff --git a/content/child/child_thread_impl.cc b/content/child/child_thread_impl.cc
index c5cf734..2999a12 100644
--- a/content/child/child_thread_impl.cc
+++ b/content/child/child_thread_impl.cc
@@ -53,6 +53,7 @@
 #include "content/common/child_process_messages.h"
 #include "content/common/in_process_child_thread_params.h"
 #include "content/common/mojo/mojo_messages.h"
+#include "content/common/mojo/mojo_shell_connection_impl.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/attachment_broker.h"
 #include "ipc/attachment_broker_unprivileged.h"
@@ -68,10 +69,6 @@
 #include "ui/ozone/public/client_native_pixmap_factory.h"
 #endif
 
-#if defined(MOJO_SHELL_CLIENT)
-#include "content/common/mojo/mojo_shell_connection_impl.h"
-#endif
-
 using tracked_objects::ThreadData;
 
 namespace content {
@@ -682,7 +679,8 @@ void ChildThreadImpl::OnProfilingPhaseCompleted(int profiling_phase) {
 
 void ChildThreadImpl::OnBindExternalMojoShellHandle(
     const IPC::PlatformFileForTransit& file) {
-#if defined(MOJO_SHELL_CLIENT)
+  if (!MojoShellConnectionImpl::Get())
+    return;
 #if defined(OS_POSIX)
   base::PlatformFile handle = file.fd;
 #elif defined(OS_WIN)
@@ -691,7 +689,6 @@ void ChildThreadImpl::OnBindExternalMojoShellHandle(
   mojo::ScopedMessagePipeHandle pipe =
       mojo_shell_channel_init_.Init(handle, GetIOTaskRunner());
   MojoShellConnectionImpl::Get()->BindToMessagePipe(std::move(pipe));
-#endif  // defined(MOJO_SHELL_CLIENT)
 }
 
 void ChildThreadImpl::OnSetMojoParentPipeHandle(
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 45c63a6..3854840 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -134,13 +134,6 @@ source_set("common") {
                         ".",
                         "//content")
 
-  # These files are only built in a GN build because they bring in
-  # dependencies that don't build with GYP.
-  sources += [
-    "mojo/mojo_shell_connection_impl.cc",
-    "mojo/mojo_shell_connection_impl.h",
-  ]
-
   configs += [
     "//content:content_implementation",
     "//build/config:precompiled_headers",
diff --git a/content/common/mojo/mojo_shell_connection_impl.cc b/content/common/mojo/mojo_shell_connection_impl.cc
index 282b4b1..8531205 100644
--- a/content/common/mojo/mojo_shell_connection_impl.cc
+++ b/content/common/mojo/mojo_shell_connection_impl.cc
@@ -17,6 +17,7 @@
 
 namespace content {
 namespace {
+
 using MojoShellConnectionPtr =
     base::ThreadLocalPointer<MojoShellConnectionImpl>;
 
@@ -34,11 +35,25 @@ bool IsRunningInMojoShell() {
 // static
 void MojoShellConnectionImpl::Create() {
   DCHECK(!lazy_tls_ptr.Pointer()->Get());
-  MojoShellConnectionImpl* connection = new MojoShellConnectionImpl;
+  MojoShellConnectionImpl* connection =
+      new MojoShellConnectionImpl(true /* external */);
   lazy_tls_ptr.Pointer()->Set(connection);
 }
 
 // static
+void MojoShellConnectionImpl::Create(
+    mojo::shell::mojom::ShellClientRequest request) {
+  DCHECK(!lazy_tls_ptr.Pointer()->Get());
+  MojoShellConnectionImpl* connection =
+      new MojoShellConnectionImpl(false /* external */);
+  lazy_tls_ptr.Pointer()->Set(connection);
+
+  connection->shell_connection_.reset(
+      new mojo::ShellConnection(connection, std::move(request)));
+  connection->shell_connection_->WaitForInitialize();
+}
+
+// static
 MojoShellConnectionImpl* MojoShellConnectionImpl::Get() {
   return static_cast<MojoShellConnectionImpl*>(MojoShellConnection::Get());
 }
@@ -57,7 +72,9 @@ void MojoShellConnectionImpl::BindToMessagePipe(
   WaitForShell(std::move(handle));
 }
 
-MojoShellConnectionImpl::MojoShellConnectionImpl() : initialized_(false) {}
+MojoShellConnectionImpl::MojoShellConnectionImpl(bool external) :
+    external_(external), initialized_(false) {}
+
 MojoShellConnectionImpl::~MojoShellConnectionImpl() {
   STLDeleteElements(&listeners_);
 }
@@ -66,7 +83,12 @@ void MojoShellConnectionImpl::WaitForShell(
     mojo::ScopedMessagePipeHandle handle) {
   mojo::shell::mojom::ShellClientRequest request;
   runner_connection_.reset(mojo::shell::RunnerConnection::ConnectToRunner(
-      &request, std::move(handle)));
+      &request, std::move(handle), false /* exit_on_error */));
+  if (!runner_connection_) {
+    delete this;
+    lazy_tls_ptr.Pointer()->Set(nullptr);
+    return;
+  }
   shell_connection_.reset(new mojo::ShellConnection(this, std::move(request)));
   shell_connection_->WaitForInitialize();
 }
@@ -91,7 +113,7 @@ mojo::Shell* MojoShellConnectionImpl::GetShell() {
 }
 
 bool MojoShellConnectionImpl::UsingExternalShell() const {
-  return true;
+  return external_;
 }
 
 void MojoShellConnectionImpl::AddListener(Listener* listener) {
diff --git a/content/common/mojo/mojo_shell_connection_impl.h b/content/common/mojo/mojo_shell_connection_impl.h
index d18d73a..dd588e0 100644
--- a/content/common/mojo/mojo_shell_connection_impl.h
+++ b/content/common/mojo/mojo_shell_connection_impl.h
@@ -11,6 +11,7 @@
 #include "base/memory/scoped_ptr.h"
 #include "content/public/common/mojo_shell_connection.h"
 #include "mojo/public/cpp/system/message_pipe.h"
+#include "mojo/shell/public/cpp/shell.h"
 #include "mojo/shell/public/cpp/shell_client.h"
 #include "mojo/shell/public/cpp/shell_connection.h"
 
@@ -32,6 +33,10 @@ class MojoShellConnectionImpl : public MojoShellConnection,
   // thread. Retrieve it using MojoShellConnection::Get().
   static void Create();
 
+  // Like above but for initializing a connection to an embedded in-process
+  // shell implementation. Binds to |request|.
+  static void Create(mojo::shell::mojom::ShellClientRequest request);
+
   // Will return null if no connection has been established (either because it
   // hasn't happened yet or the application was not spawned from the external
   // Mojo shell).
@@ -47,7 +52,7 @@ class MojoShellConnectionImpl : public MojoShellConnection,
   void BindToMessagePipe(mojo::ScopedMessagePipeHandle handle);
 
  private:
-  MojoShellConnectionImpl();
+  explicit MojoShellConnectionImpl(bool external);
   ~MojoShellConnectionImpl() override;
 
   // mojo::ShellClient:
@@ -66,6 +71,7 @@ class MojoShellConnectionImpl : public MojoShellConnection,
   // method on that application is called.
   void WaitForShell(mojo::ScopedMessagePipeHandle handle);
 
+  bool external_;
   bool initialized_;
   scoped_ptr<mojo::shell::RunnerConnection> runner_connection_;
   scoped_ptr<mojo::ShellConnection> shell_connection_;
diff --git a/content/common/url_schemes.cc b/content/common/url_schemes.cc
index c985e85..018d9de 100644
--- a/content/common/url_schemes.cc
+++ b/content/common/url_schemes.cc
@@ -36,6 +36,10 @@ void RegisterContentSchemes(bool lock_schemes) {
   url::AddStandardScheme(kGuestScheme, url::SCHEME_WITHOUT_PORT);
   url::AddStandardScheme(kMetadataScheme, url::SCHEME_WITHOUT_AUTHORITY);
 
+  // TODO(rockot): Remove these. http://crbug.com/590012.
+  url::AddStandardScheme(kExeScheme, url::SCHEME_WITHOUT_AUTHORITY);
+  url::AddStandardScheme(kMojoScheme, url::SCHEME_WITHOUT_AUTHORITY);
+
   for (const url::SchemeWithType& scheme : additional_standard_schemes)
     url::AddStandardScheme(scheme.scheme, scheme.type);
 
diff --git a/content/content_browser.gypi b/content/content_browser.gypi
index e0dac55..1953f4c5 100644
--- a/content/content_browser.gypi
+++ b/content/content_browser.gypi
@@ -28,6 +28,7 @@
     '../mojo/mojo_public.gyp:mojo_js_bindings',
     '../mojo/mojo_services.gyp:network_service_bindings_lib',
     '../mojo/mojo_services.gyp:updater_bindings_lib',
+    '../mojo/mojo_shell.gyp:mojo_runner_host_lib',
     '../mojo/mojo_shell.gyp:mojo_shell_lib',
     '../net/net.gyp:http_server',
     '../net/net.gyp:net',
@@ -1088,8 +1089,11 @@
       'browser/mojo/mojo_app_connection_impl.h',
       'browser/mojo/mojo_application_host.cc',
       'browser/mojo/mojo_application_host.h',
+      'browser/mojo/mojo_shell_client_host.cc',
+      'browser/mojo/mojo_shell_client_host.h',
       'browser/mojo/mojo_shell_context.cc',
       'browser/mojo/mojo_shell_context.h',
+      'browser/mojo/renderer_capability_filter.cc',
       'browser/mojo/service_registrar_android.cc',
       'browser/mojo/service_registrar_android.h',
       'browser/mojo/service_registry_android.cc',
diff --git a/content/content_common.gypi b/content/content_common.gypi
index dad9e15..5e4ab21 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -27,6 +27,7 @@
     '../mojo/mojo_base.gyp:mojo_environment_chromium',
     '../mojo/mojo_edk.gyp:mojo_system_impl',
     '../mojo/mojo_public.gyp:mojo_cpp_bindings',
+    '../mojo/mojo_shell.gyp:mojo_runner_connection_lib',
     '../net/net.gyp:net',
     '../skia/skia.gyp:skia',
     '../storage/storage_common.gyp:storage_common',
@@ -515,6 +516,8 @@
       'common/mojo/channel_init.cc',
       'common/mojo/channel_init.h',
       'common/mojo/mojo_messages.h',
+      'common/mojo/mojo_shell_connection_impl.cc',
+      'common/mojo/mojo_shell_connection_impl.h',
       'common/mojo/service_registry_impl.cc',
       'common/mojo/service_registry_impl.h',
       'common/mojo/static_application_loader.cc',
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index aeeef71..462b789 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -392,9 +392,6 @@ const char kEnableLogging[]                 = "enable-logging";
 // Enables the memory benchmarking extension
 const char kEnableMemoryBenchmarking[]      = "enable-memory-benchmarking";
 
-// Enable the Mojo shell connection in renderers.
-const char kEnableMojoShellConnection[] = "enable-mojo-shell-connection";
-
 // Enables the network information API.
 const char kEnableNetworkInformation[]      = "enable-network-information";
 
diff --git a/content/public/common/content_switches.h b/content/public/common/content_switches.h
index e61ce30..6277db9 100644
--- a/content/public/common/content_switches.h
+++ b/content/public/common/content_switches.h
@@ -121,7 +121,6 @@ CONTENT_EXPORT extern const char kEnableImageColorProfiles[];
 CONTENT_EXPORT extern const char kEnableLCDText[];
 CONTENT_EXPORT extern const char kEnableLogging[];
 extern const char kEnableMemoryBenchmarking[];
-CONTENT_EXPORT extern const char kEnableMojoShellConnection[];
 CONTENT_EXPORT extern const char kEnableNetworkInformation[];
 CONTENT_EXPORT extern const char kEnableNotificationActionIcons[];
 CONTENT_EXPORT extern const char kEnablePartialRaster[];
diff --git a/content/public/common/url_constants.cc b/content/public/common/url_constants.cc
index 93225b6..028900f 100644
--- a/content/public/common/url_constants.cc
+++ b/content/public/common/url_constants.cc
@@ -11,8 +11,10 @@ namespace content {
 // There are security implications associated with introducing new schemes.
 const char kChromeDevToolsScheme[] = "chrome-devtools";
 const char kChromeUIScheme[] = "chrome";
+const char kExeScheme[] = "exe";
 const char kGuestScheme[] = "chrome-guest";
 const char kMetadataScheme[] = "metadata";
+const char kMojoScheme[] = "mojo";
 const char kSwappedOutScheme[] = "swappedout";
 const char kViewSourceScheme[] = "view-source";
 #if defined(OS_CHROMEOS)
diff --git a/content/public/common/url_constants.h b/content/public/common/url_constants.h
index 65c1e6d..c1413f5 100644
--- a/content/public/common/url_constants.h
+++ b/content/public/common/url_constants.h
@@ -18,8 +18,10 @@ namespace content {
 // from there.
 CONTENT_EXPORT extern const char kChromeDevToolsScheme[];
 CONTENT_EXPORT extern const char kChromeUIScheme[];  // Used for WebUIs.
+CONTENT_EXPORT extern const char kExeScheme[];
 CONTENT_EXPORT extern const char kGuestScheme[];
 CONTENT_EXPORT extern const char kMetadataScheme[];
+CONTENT_EXPORT extern const char kMojoScheme[];
 CONTENT_EXPORT extern const char kSwappedOutScheme[];
 CONTENT_EXPORT extern const char kViewSourceScheme[];
 #if defined(OS_CHROMEOS)
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 928702d..9cb97a9 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -852,7 +852,9 @@ void RenderThreadImpl::Init() {
 #if defined(MOJO_SHELL_CLIENT)
   // We may not have a MojoShellConnection object in tests that directly
   // instantiate a RenderThreadImpl.
-  if (MojoShellConnection::Get())
+  if (MojoShellConnection::Get() &&
+      base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kUseMusInRenderer))
     CreateRenderWidgetWindowTreeClientFactory();
 #endif
 
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 1b911e4..888a9f1 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -705,7 +705,8 @@ scoped_ptr<cc::OutputSurface> RenderWidget::CreateOutputSurface(bool fallback) {
     use_software = true;
 
 #if defined(MOJO_SHELL_CLIENT)
-  if (MojoShellConnection::Get() && !use_software) {
+  if (MojoShellConnection::Get() && !use_software &&
+      command_line.HasSwitch(switches::kUseMusInRenderer)) {
     RenderWidgetMusConnection* connection =
         RenderWidgetMusConnection::GetOrCreate(routing_id());
     return connection->CreateOutputSurface();
diff --git a/content/renderer/renderer_main.cc b/content/renderer/renderer_main.cc
index 8e63f01..6045eae 100644
--- a/content/renderer/renderer_main.cc
+++ b/content/renderer/renderer_main.cc
@@ -25,6 +25,7 @@
 #include "components/scheduler/renderer/renderer_scheduler.h"
 #include "content/child/child_process.h"
 #include "content/common/content_constants_internal.h"
+#include "content/common/mojo/mojo_shell_connection_impl.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/renderer/content_renderer_client.h"
@@ -60,10 +61,6 @@
 #include "ui/ozone/public/client_native_pixmap_factory.h"
 #endif
 
-#if defined(MOJO_SHELL_CLIENT)
-#include "content/common/mojo/mojo_shell_connection_impl.h"
-#endif
-
 namespace content {
 namespace {
 // This function provides some ways to test crash and assertion handling
@@ -96,10 +93,7 @@ int RendererMain(const MainFunctionParams& parameters) {
 
   const base::CommandLine& parsed_command_line = parameters.command_line;
 
-#if defined(MOJO_SHELL_CLIENT)
-  if (parsed_command_line.HasSwitch(switches::kEnableMojoShellConnection))
-    MojoShellConnectionImpl::Create();
-#endif
+  MojoShellConnectionImpl::Create();
 
 #if defined(OS_MACOSX)
   base::mac::ScopedNSAutoreleasePool* pool = parameters.autorelease_pool;
diff --git a/mojo/mojo_shell.gyp b/mojo/mojo_shell.gyp
index 8298d8e..57b2b21 100644
--- a/mojo/mojo_shell.gyp
+++ b/mojo/mojo_shell.gyp
@@ -50,8 +50,8 @@
       'shell/tests/capability_filter_unittest.cc',
     ],
     'dependencies': [
-      '<(DEPTH)/mojo/mojo_shell.gyp:mojo_shell_lib',
-      '<(DEPTH)/mojo/mojo_shell.gyp:mojo_shell_test_bindings',
+      'mojo_shell_lib',
+      'mojo_shell_test_bindings',
       '<(DEPTH)/base/base.gyp:base',
       '<(DEPTH)/mojo/mojo_base.gyp:mojo_application_base',
       '<(DEPTH)/mojo/mojo_base.gyp:mojo_common_lib',
@@ -74,5 +74,95 @@
     'includes': [
       'mojom_bindings_generator_explicit.gypi',
     ],
+  }, {
+    'target_name': 'mojo_runner_connection_lib',
+    'type': 'static_library',
+    'sources': [
+      'shell/runner/child/runner_connection.cc',
+      'shell/runner/child/runner_connection.h',
+    ],
+    'dependencies': [
+      'mojo_runner_common_lib',
+      'mojo_runner_connection_bindings_lib',
+      '<(DEPTH)/base/base.gyp:base',
+      '<(DEPTH)/mojo/mojo_base.gyp:mojo_application_base',
+      '<(DEPTH)/mojo/mojo_edk.gyp:mojo_system_impl',
+      '<(DEPTH)/mojo/mojo_platform_handle.gyp:platform_handle',
+      '<(DEPTH)/mojo/mojo_public.gyp:mojo_message_pump_lib',
+    ],
+  }, {
+    'target_name': 'mojo_runner_common_lib',
+    'type': 'static_library',
+    'sources': [
+      'shell/runner/common/switches.cc',
+      'shell/runner/common/switches.h',
+    ],
+    'include_dirs': [
+      '..',
+    ],
+  }, {
+    'target_name': 'mojo_runner_connection_bindings_lib',
+    'type': 'static_library',
+    'dependencies': [
+      'mojo_runner_connection_mojom',
+    ],
+  }, {
+    'target_name': 'mojo_runner_connection_mojom',
+    'type': 'none',
+    'variables': {
+      'mojom_files': [
+        'shell/runner/child/child_controller.mojom',
+      ],
+    },
+    'includes': [
+      'mojom_bindings_generator_explicit.gypi',
+    ],
+    'dependencies': [
+      '<(DEPTH)/mojo/mojo_base.gyp:mojo_application_base',
+    ],
+  }, {
+    'target_name': 'mojo_runner_host_lib',
+    'type': 'static_library',
+    'sources': [
+      'shell/runner/host/child_process.cc',
+      'shell/runner/host/child_process.h',
+      'shell/runner/host/child_process_base.cc',
+      'shell/runner/host/child_process_base.h',
+      'shell/runner/host/child_process_host.cc',
+      'shell/runner/host/child_process_host.h',
+      'shell/runner/host/in_process_native_runner.cc',
+      'shell/runner/host/in_process_native_runner.h',
+      'shell/runner/host/out_of_process_native_runner.cc',
+      'shell/runner/host/out_of_process_native_runner.h',
+      'shell/runner/host/native_application_support.cc',
+      'shell/runner/host/native_application_support.h',
+      'shell/runner/init.cc',
+      'shell/runner/init.h',
+    ],
+    'dependencies': [
+      'mojo_runner_common_lib',
+      'mojo_runner_connection_bindings_lib',
+      'mojo_shell_lib',
+      '<(DEPTH)/base/base.gyp:base',
+      '<(DEPTH)/base/base.gyp:base_i18n',
+      '<(DEPTH)/base/base.gyp:base_static',
+      '<(DEPTH)/mojo/mojo_edk.gyp:mojo_system_impl',
+      '<(DEPTH)/mojo/mojo_platform_handle.gyp:platform_handle',
+      '<(DEPTH)/mojo/mojo_public.gyp:mojo_message_pump_lib',
+    ],
+    'conditions': [
+      ['OS=="linux"', {
+        'sources': [
+          'shell/runner/host/linux_sandbox.cc',
+          'shell/runner/host/linux_sandbox.h',
+        ],
+        'dependencies': [
+          '<(DEPTH)/sandbox/sandbox.gyp:sandbox',
+          '<(DEPTH)/sandbox/sandbox.gyp:sandbox_services',
+          '<(DEPTH)/sandbox/sandbox.gyp:seccomp_bpf',
+          '<(DEPTH)/sandbox/sandbox.gyp:seccomp_bpf_helpers',
+        ],
+      }],
+    ],
   }],
 }
diff --git a/mojo/shell/application_manager.cc b/mojo/shell/application_manager.cc
index 314f4ea..3267d5c 100644
--- a/mojo/shell/application_manager.cc
+++ b/mojo/shell/application_manager.cc
@@ -99,6 +99,21 @@ void ApplicationManager::Connect(scoped_ptr<ConnectParams> params) {
                   weak_ptr_factory_.GetWeakPtr(), base::Passed(&params)));
 }
 
+mojom::ShellClientRequest ApplicationManager::InitInstanceForEmbedder(
+    const GURL& url) {
+  DCHECK(!embedder_instance_);
+
+  mojo::shell::Identity target(url, std::string(), mojom::Connector::kUserRoot);
+  target.SetFilter(GetPermissiveCapabilityFilter());
+  DCHECK(!GetApplicationInstance(target));
+
+  mojom::ShellClientRequest request;
+  embedder_instance_ = CreateInstance(target, &request);
+  DCHECK(embedder_instance_);
+
+  return request;
+}
+
 void ApplicationManager::SetLoaderForURL(scoped_ptr<ApplicationLoader> loader,
                                          const GURL& url) {
   URLToLoaderMap::iterator it = url_to_loader_.find(url);
diff --git a/mojo/shell/application_manager.h b/mojo/shell/application_manager.h
index fb1763b..92ed969 100644
--- a/mojo/shell/application_manager.h
+++ b/mojo/shell/application_manager.h
@@ -83,6 +83,12 @@ class ApplicationManager : public ShellClient,
   // instance of the target application is running, one will be loaded.
   void Connect(scoped_ptr<ConnectParams> params);
 
+  // Creates a new ApplicationInstance identified as |url|. This is intended for
+  // use by the ApplicationManager's embedder to register itself with the shell.
+  // The URL is never resolved and there must not be an existing instance
+  // associated with it. This must only be called once.
+  mojom::ShellClientRequest InitInstanceForEmbedder(const GURL& url);
+
   // Sets the default Loader to be used if not overridden by SetLoaderForURL().
   void set_default_loader(scoped_ptr<ApplicationLoader> loader) {
     default_loader_ = std::move(loader);
@@ -186,6 +192,9 @@ class ApplicationManager : public ShellClient,
   // Counter used to assign ids to content handlers.
   uint32_t shell_client_factory_id_counter_;
 
+  // The ApplicationInstance created by the shell embedder, if any.
+  ApplicationInstance* embedder_instance_ = nullptr;
+
   InterfacePtrSet<mojom::ApplicationManagerListener> listeners_;
 
   base::Callback<void(const Identity&)> instance_quit_callback_;
diff --git a/mojo/shell/runner/child/runner_connection.cc b/mojo/shell/runner/child/runner_connection.cc
index 313c00a..900ee2c 100644
--- a/mojo/shell/runner/child/runner_connection.cc
+++ b/mojo/shell/runner/child/runner_connection.cc
@@ -96,7 +96,8 @@ class RunnerConnectionImpl : public RunnerConnection {
   // Returns true if a connection to the runner has been established and
   // |request| has been modified, false if no connection was established.
   bool WaitForApplicationRequest(InterfaceRequest<mojom::ShellClient>* request,
-                                 ScopedMessagePipeHandle handle);
+                                 ScopedMessagePipeHandle handle,
+                                 bool exit_on_error);
 
   ChildControllerImpl* controller() const { return controller_.get(); }
 
@@ -141,12 +142,14 @@ class ChildControllerImpl : public mojom::ChildController {
   static void Create(RunnerConnectionImpl* connection,
                      const GotApplicationRequestCallback& callback,
                      ScopedMessagePipeHandle runner_handle,
-                     const Blocker::Unblocker& unblocker) {
+                     const Blocker::Unblocker& unblocker,
+                     bool exit_on_error) {
     DCHECK(connection);
     DCHECK(!connection->controller());
 
     scoped_ptr<ChildControllerImpl> impl(
-        new ChildControllerImpl(connection, callback, unblocker));
+        new ChildControllerImpl(connection, callback, unblocker,
+                                exit_on_error));
 
     impl->Bind(std::move(runner_handle));
 
@@ -162,7 +165,16 @@ class ChildControllerImpl : public mojom::ChildController {
     // A connection error means the connection to the shell is lost. This is not
     // recoverable.
     DLOG(ERROR) << "Connection error to the shell.";
-    _exit(1);
+    if (exit_on_error_) {
+      _exit(1);
+    } else if (on_app_complete_.is_null()) {
+      // If we failed before we could even get a ShellClient request from the
+      // shell, signal failure to the RunnerConnection, as it's still blocking
+      // on a response.
+      unblocker_.Unblock(
+          base::Bind(&ChildControllerImpl::ReturnApplicationRequestOnMainThread,
+                     callback_, nullptr));
+    }
   }
 
   // |mojom::ChildController| methods:
@@ -184,11 +196,13 @@ class ChildControllerImpl : public mojom::ChildController {
  private:
   ChildControllerImpl(RunnerConnectionImpl* connection,
                       const GotApplicationRequestCallback& callback,
-                      const Blocker::Unblocker& unblocker)
+                      const Blocker::Unblocker& unblocker,
+                      bool exit_on_error)
       : connection_(connection),
         callback_(callback),
         unblocker_(unblocker),
-        binding_(this) {}
+        binding_(this),
+        exit_on_error_(exit_on_error) {}
 
   static void ReturnApplicationRequestOnMainThread(
       const GotApplicationRequestCallback& callback,
@@ -204,12 +218,15 @@ class ChildControllerImpl : public mojom::ChildController {
 
   Binding<ChildController> binding_;
 
+  bool exit_on_error_;
+
   DISALLOW_COPY_AND_ASSIGN(ChildControllerImpl);
 };
 
 bool RunnerConnectionImpl::WaitForApplicationRequest(
     InterfaceRequest<mojom::ShellClient>* request,
-    ScopedMessagePipeHandle handle) {
+    ScopedMessagePipeHandle handle,
+    bool exit_on_error) {
   // If a valid message pipe to the runner was not provided, look for one on the
   // command line.
   if (!handle.is_valid()) {
@@ -232,11 +249,11 @@ bool RunnerConnectionImpl::WaitForApplicationRequest(
       FROM_HERE,
       base::Bind(
           &ChildControllerImpl::Create, base::Unretained(this),
-          base::Bind(&OnGotApplicationRequest, base::Unretained(request)),
-          base::Passed(&handle), blocker.GetUnblocker()));
+          base::Bind(&OnGotApplicationRequest, request), base::Passed(&handle),
+          blocker.GetUnblocker(), exit_on_error));
   blocker.Block();
 
-  return true;
+  return request->is_pending();
 }
 
 }  // namespace
@@ -246,9 +263,11 @@ RunnerConnection::~RunnerConnection() {}
 // static
 RunnerConnection* RunnerConnection::ConnectToRunner(
     InterfaceRequest<mojom::ShellClient>* request,
-    ScopedMessagePipeHandle handle) {
+    ScopedMessagePipeHandle handle,
+    bool exit_on_error) {
   RunnerConnectionImpl* connection = new RunnerConnectionImpl;
-  if (!connection->WaitForApplicationRequest(request, std::move(handle))) {
+  if (!connection->WaitForApplicationRequest(
+      request, std::move(handle), exit_on_error)) {
     delete connection;
     return nullptr;
   }
diff --git a/mojo/shell/runner/child/runner_connection.h b/mojo/shell/runner/child/runner_connection.h
index 488b996..e49f73e 100644
--- a/mojo/shell/runner/child/runner_connection.h
+++ b/mojo/shell/runner/child/runner_connection.h
@@ -21,11 +21,20 @@ class RunnerConnection {
   // Establish a connection to the runner, blocking the calling thread until
   // it is established. The Application request from the runner is returned via
   // |request|.
+  //
   // If a connection to the runner cannot be established, |request| will not be
   // modified and this function will return null.
+  //
+  // If |exit_on_error| is true, the calling process will be terminated in the
+  // event of an error on |handle|.
+  //
+  // TODO(rockot): Remove |exit_on_error| when it's safe for all clients to be
+  // terminated on such errors. For now we don't want this killing content's
+  // child processes.
   static RunnerConnection* ConnectToRunner(
       InterfaceRequest<mojom::ShellClient>* request,
-      ScopedMessagePipeHandle handle);
+      ScopedMessagePipeHandle handle,
+      bool exit_on_error = true);
 
  protected:
   RunnerConnection();
diff --git a/mojo/shell/runner/host/BUILD.gn b/mojo/shell/runner/host/BUILD.gn
index b4e38f7..911ee11 100644
--- a/mojo/shell/runner/host/BUILD.gn
+++ b/mojo/shell/runner/host/BUILD.gn
@@ -15,6 +15,10 @@ group("host") {
   ]
 }
 
+config("native_application_support_with_gles2") {
+  defines = [ "NATIVE_APPLICATION_USE_GLES2_IMPL" ]
+}
+
 source_set("native_application_support") {
   sources = [
     "native_application_support.cc",
@@ -23,11 +27,15 @@ source_set("native_application_support") {
 
   deps = [
     "//base",
-    "//mojo/gles2",
     "//mojo/platform_handle:platform_handle_impl",
     "//mojo/shell",
   ]
 
+  if (!is_mac) {
+    configs += [ ":native_application_support_with_gles2" ]
+    deps += [ "//mojo/gles2" ]
+  }
+
   # This target has to include the public thunk headers, which generally
   # shouldn't be included without picking an implementation. We are providing
   # the implementation but the thunk header target cannot declare that we are
diff --git a/mojo/shell/runner/host/linux_sandbox.cc b/mojo/shell/runner/host/linux_sandbox.cc
index 545511e..6cd3750 100644
--- a/mojo/shell/runner/host/linux_sandbox.cc
+++ b/mojo/shell/runner/host/linux_sandbox.cc
@@ -94,8 +94,10 @@ class SandboxPolicy : public sandbox::BaselinePolicy {
       case __NR_ugetrlimit:
 #endif
       case __NR_uname:
+#if defined(__arm__) || defined(__x86_64__) || defined(__mips__)
       case __NR_getsockopt:
       case __NR_setsockopt:
+#endif
         return sandbox::bpf_dsl::Allow();
     }
 
diff --git a/mojo/shell/runner/host/native_application_support.cc b/mojo/shell/runner/host/native_application_support.cc
index 97288fa..b965144 100644
--- a/mojo/shell/runner/host/native_application_support.cc
+++ b/mojo/shell/runner/host/native_application_support.cc
@@ -11,10 +11,13 @@
 #include "base/files/file_util.h"
 #include "base/logging.h"
 #include "mojo/platform_handle/platform_handle_private_thunks.h"
+#include "mojo/public/platform/native/system_thunks.h"
+
+#if defined(NATIVE_APPLICATION_USE_GLES2_IMPL)
 #include "mojo/public/platform/native/gles2_impl_chromium_extension_thunks.h"
 #include "mojo/public/platform/native/gles2_impl_thunks.h"
 #include "mojo/public/platform/native/gles2_thunks.h"
-#include "mojo/public/platform/native/system_thunks.h"
+#endif
 
 namespace mojo {
 namespace shell {
@@ -67,6 +70,7 @@ bool RunNativeApplication(
     return false;
   }
 
+#if defined(NATIVE_APPLICATION_USE_GLES2_IMPL)
   if (SetThunks(&MojoMakeGLES2ControlThunks, "MojoSetGLES2ControlThunks",
                 app_library)) {
     // If we have the control thunks, we should also have the GLES2
@@ -84,6 +88,8 @@ bool RunNativeApplication(
     SetThunks(MojoMakeGLES2ImplChromiumExtensionThunks,
               "MojoSetGLES2ImplChromiumExtensionThunks", app_library);
   }
+#endif
+
 // Unlike system thunks, we don't warn on a lack of GLES2 thunks because
 // not everything is a visual app.