IPC: Make ChannelReader inherit from SupportsAttachmentBrokering.

Each IPC::Channel will have a reference to an AttachmentBroker. This is
accomplished by requiring each of the Channel::Create methods to have a
|broker| parameter. For now, the |broker| parameter has a default value of
nullptr. This default parameter only exists so that this CL and subsequent
refactors can be decomposed into smaller CLs. The default parameter will be
removed once all callers of Channel::Create have been updated to pass in an
appropriate broker.

BUG=493414

Review URL: https://codereview.chromium.org/1185133006

Cr-Commit-Position: refs/heads/master@{#334699}

31 files changed, 287 insertions, 146 deletions

diff --git a/ipc/ipc_channel.h b/ipc/ipc_channel.h
index 65c678b5..c5c46a7 100644
--- a/ipc/ipc_channel.h
+++ b/ipc/ipc_channel.h
@@ -20,6 +20,7 @@
 
 namespace IPC {
 
+class AttachmentBroker;
 class Listener;
 
 //------------------------------------------------------------------------------
@@ -118,11 +119,21 @@ class IPC_EXPORT Channel : public Sender {
   //
   // TODO(morrita): Replace CreateByModeForProxy() with one of above Create*().
   //
-  static scoped_ptr<Channel> Create(
-      const IPC::ChannelHandle &channel_handle, Mode mode, Listener* listener);
-
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
+  static scoped_ptr<Channel> Create(const IPC::ChannelHandle& channel_handle,
+                                    Mode mode,
+                                    Listener* listener,
+                                    AttachmentBroker* broker = nullptr);
+
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
   static scoped_ptr<Channel> CreateClient(
-      const IPC::ChannelHandle &channel_handle, Listener* listener);
+      const IPC::ChannelHandle& channel_handle,
+      Listener* listener,
+      AttachmentBroker* broker = nullptr);
 
   // Channels on Windows are named by default and accessible from other
   // processes. On POSIX channels are anonymous by default and not accessible
@@ -130,18 +141,29 @@ class IPC_EXPORT Channel : public Sender {
   // On Windows MODE_NAMED_SERVER is equivalent to MODE_SERVER and
   // MODE_NAMED_CLIENT is equivalent to MODE_CLIENT.
   static scoped_ptr<Channel> CreateNamedServer(
-      const IPC::ChannelHandle &channel_handle, Listener* listener);
+      const IPC::ChannelHandle& channel_handle,
+      Listener* listener,
+      AttachmentBroker* broker);
   static scoped_ptr<Channel> CreateNamedClient(
-      const IPC::ChannelHandle &channel_handle, Listener* listener);
+      const IPC::ChannelHandle& channel_handle,
+      Listener* listener,
+      AttachmentBroker* broker);
 #if defined(OS_POSIX)
   // An "open" named server accepts connections from ANY client.
   // The caller must then implement their own access-control based on the
   // client process' user Id.
   static scoped_ptr<Channel> CreateOpenNamedServer(
-      const IPC::ChannelHandle &channel_handle, Listener* listener);
+      const IPC::ChannelHandle& channel_handle,
+      Listener* listener,
+      AttachmentBroker* broker);
 #endif
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
   static scoped_ptr<Channel> CreateServer(
-      const IPC::ChannelHandle &channel_handle, Listener* listener);
+      const IPC::ChannelHandle& channel_handle,
+      Listener* listener,
+      AttachmentBroker* broker = nullptr);
 
   ~Channel() override;
 
diff --git a/ipc/ipc_channel_common.cc b/ipc/ipc_channel_common.cc
index 23b85e2..5438c66 100644
--- a/ipc/ipc_channel_common.cc
+++ b/ipc/ipc_channel_common.cc
@@ -8,36 +8,49 @@ namespace IPC {
 
 // static
 scoped_ptr<Channel> Channel::CreateClient(
-    const IPC::ChannelHandle &channel_handle, Listener* listener) {
-  return Channel::Create(channel_handle, Channel::MODE_CLIENT, listener);
+    const IPC::ChannelHandle& channel_handle,
+    Listener* listener,
+    AttachmentBroker* broker) {
+  return Channel::Create(channel_handle, Channel::MODE_CLIENT, listener,
+                         broker);
 }
 
 // static
 scoped_ptr<Channel> Channel::CreateNamedServer(
-    const IPC::ChannelHandle &channel_handle, Listener* listener) {
-  return Channel::Create(channel_handle, Channel::MODE_NAMED_SERVER, listener);
+    const IPC::ChannelHandle& channel_handle,
+    Listener* listener,
+    AttachmentBroker* broker) {
+  return Channel::Create(channel_handle, Channel::MODE_NAMED_SERVER, listener,
+                         broker);
 }
 
 // static
 scoped_ptr<Channel> Channel::CreateNamedClient(
-    const IPC::ChannelHandle &channel_handle, Listener* listener) {
-  return Channel::Create(channel_handle, Channel::MODE_NAMED_CLIENT, listener);
+    const IPC::ChannelHandle& channel_handle,
+    Listener* listener,
+    AttachmentBroker* broker) {
+  return Channel::Create(channel_handle, Channel::MODE_NAMED_CLIENT, listener,
+                         broker);
 }
 
 #if defined(OS_POSIX)
 // static
 scoped_ptr<Channel> Channel::CreateOpenNamedServer(
-    const IPC::ChannelHandle &channel_handle, Listener* listener) {
-  return Channel::Create(channel_handle,
-                         Channel::MODE_OPEN_NAMED_SERVER,
-                         listener);
+    const IPC::ChannelHandle& channel_handle,
+    Listener* listener,
+    AttachmentBroker* broker) {
+  return Channel::Create(channel_handle, Channel::MODE_OPEN_NAMED_SERVER,
+                         listener, broker);
 }
 #endif
 
 // static
 scoped_ptr<Channel> Channel::CreateServer(
-    const IPC::ChannelHandle &channel_handle, Listener* listener) {
-  return Channel::Create(channel_handle, Channel::MODE_SERVER, listener);
+    const IPC::ChannelHandle& channel_handle,
+    Listener* listener,
+    AttachmentBroker* broker) {
+  return Channel::Create(channel_handle, Channel::MODE_SERVER, listener,
+                         broker);
 }
 
 Channel::~Channel() {
diff --git a/ipc/ipc_channel_factory.cc b/ipc/ipc_channel_factory.cc
index c8431c0..ac05085 100644
--- a/ipc/ipc_channel_factory.cc
+++ b/ipc/ipc_channel_factory.cc
@@ -11,21 +11,22 @@ namespace {
 class PlatformChannelFactory : public ChannelFactory {
  public:
   PlatformChannelFactory(ChannelHandle handle,
-                         Channel::Mode mode)
-      : handle_(handle), mode_(mode) {
-  }
+                         Channel::Mode mode,
+                         AttachmentBroker* broker)
+      : handle_(handle), mode_(mode), broker_(broker) {}
 
   std::string GetName() const override {
     return handle_.name;
   }
 
   scoped_ptr<Channel> BuildChannel(Listener* listener) override {
-    return Channel::Create(handle_, mode_, listener);
+    return Channel::Create(handle_, mode_, listener, broker_);
   }
 
  private:
   ChannelHandle handle_;
   Channel::Mode mode_;
+  AttachmentBroker* broker_;
 
   DISALLOW_COPY_AND_ASSIGN(PlatformChannelFactory);
 };
@@ -33,9 +34,11 @@ class PlatformChannelFactory : public ChannelFactory {
 } // namespace
 
 // static
-scoped_ptr<ChannelFactory> ChannelFactory::Create(
-    const ChannelHandle& handle, Channel::Mode mode) {
-  return scoped_ptr<ChannelFactory>(new PlatformChannelFactory(handle, mode));
+scoped_ptr<ChannelFactory> ChannelFactory::Create(const ChannelHandle& handle,
+                                                  Channel::Mode mode,
+                                                  AttachmentBroker* broker) {
+  return scoped_ptr<ChannelFactory>(
+      new PlatformChannelFactory(handle, mode, broker));
 }
 
 }  // namespace IPC
diff --git a/ipc/ipc_channel_factory.h b/ipc/ipc_channel_factory.h
index 84bcf97..71ebe8a 100644
--- a/ipc/ipc_channel_factory.h
+++ b/ipc/ipc_channel_factory.h
@@ -13,6 +13,8 @@
 
 namespace IPC {
 
+class AttachmentBroker;
+
 // Encapsulates how a Channel is created. A ChannelFactory can be
 // passed to the constructor of ChannelProxy or SyncChannel to tell them
 // how to create underlying channel.
@@ -20,8 +22,9 @@ class IPC_EXPORT ChannelFactory {
  public:
   // Creates a factory for "native" channel built through
   // IPC::Channel::Create().
-  static scoped_ptr<ChannelFactory> Create(
-      const ChannelHandle& handle, Channel::Mode mode);
+  static scoped_ptr<ChannelFactory> Create(const ChannelHandle& handle,
+                                           Channel::Mode mode,
+                                           AttachmentBroker* broker);
 
   virtual ~ChannelFactory() { }
   virtual std::string GetName() const = 0;
diff --git a/ipc/ipc_channel_nacl.cc b/ipc/ipc_channel_nacl.cc
index f5b33ce..19a3289 100644
--- a/ipc/ipc_channel_nacl.cc
+++ b/ipc/ipc_channel_nacl.cc
@@ -122,13 +122,15 @@ void ChannelNacl::ReaderThreadRunner::Run() {
 
 ChannelNacl::ChannelNacl(const IPC::ChannelHandle& channel_handle,
                          Mode mode,
-                         Listener* listener)
+                         Listener* listener,
+                         AttachmentBroker* broker)
     : ChannelReader(listener),
       mode_(mode),
       waiting_connect_(true),
       pipe_(-1),
       pipe_name_(channel_handle.name),
-      weak_ptr_factory_(this) {
+      weak_ptr_factory_(this),
+      broker_(broker) {
   if (!CreatePipe(channel_handle)) {
     // The pipe may have been closed already.
     const char *modestr = (mode_ & MODE_SERVER_FLAG) ? "server" : "client";
@@ -217,6 +219,10 @@ bool ChannelNacl::Send(Message* message) {
   return true;
 }
 
+AttachmentBroker* ChannelNacl::GetAttachmentBroker() {
+  return broker_;
+}
+
 void ChannelNacl::DidRecvMsg(scoped_ptr<MessageContents> contents) {
   // Close sets the pipe to -1. It's possible we'll get a buffer sent to us from
   // the reader thread after Close is called. If so, we ignore it.
@@ -372,10 +378,12 @@ void ChannelNacl::HandleInternalMessage(const Message& msg) {
 // Channel's methods
 
 // static
-scoped_ptr<Channel> Channel::Create(
-    const IPC::ChannelHandle &channel_handle, Mode mode, Listener* listener) {
+scoped_ptr<Channel> Channel::Create(const IPC::ChannelHandle& channel_handle,
+                                    Mode mode,
+                                    Listener* listener,
+                                    AttachmentBroker* broker) {
   return scoped_ptr<Channel>(
-      new ChannelNacl(channel_handle, mode, listener));
+      new ChannelNacl(channel_handle, mode, listener, broker));
 }
 
 }  // namespace IPC
diff --git a/ipc/ipc_channel_nacl.h b/ipc/ipc_channel_nacl.h
index f0649b2..82ef6edc 100644
--- a/ipc/ipc_channel_nacl.h
+++ b/ipc/ipc_channel_nacl.h
@@ -35,9 +35,11 @@ class ChannelNacl : public Channel,
                     public internal::ChannelReader {
  public:
   // Mirror methods of Channel, see ipc_channel.h for description.
+  // |broker| must outlive the newly created object.
   ChannelNacl(const IPC::ChannelHandle& channel_handle,
               Mode mode,
-              Listener* listener);
+              Listener* listener,
+              AttachmentBroker* broker);
   ~ChannelNacl() override;
 
   // Channel implementation.
@@ -46,6 +48,7 @@ class ChannelNacl : public Channel,
   bool Connect() override;
   void Close() override;
   bool Send(Message* message) override;
+  AttachmentBroker* GetAttachmentBroker() override;
 
   // Posted to the main thread by ReaderThreadRunner.
   void DidRecvMsg(scoped_ptr<MessageContents> contents);
@@ -114,6 +117,9 @@ class ChannelNacl : public Channel,
 
   base::WeakPtrFactory<ChannelNacl> weak_ptr_factory_;
 
+  // |broker_| must outlive this instance.
+  AttachmentBroker* broker_;
+
   DISALLOW_IMPLICIT_CONSTRUCTORS(ChannelNacl);
 };
 
diff --git a/ipc/ipc_channel_posix.cc b/ipc/ipc_channel_posix.cc
index 20c73e2..6c0393b 100644
--- a/ipc/ipc_channel_posix.cc
+++ b/ipc/ipc_channel_posix.cc
@@ -182,7 +182,9 @@ int ChannelPosix::global_pid_ = 0;
 #endif  // OS_LINUX
 
 ChannelPosix::ChannelPosix(const IPC::ChannelHandle& channel_handle,
-                           Mode mode, Listener* listener)
+                           Mode mode,
+                           Listener* listener,
+                           AttachmentBroker* broker)
     : ChannelReader(listener),
       mode_(mode),
       peer_pid_(base::kNullProcessId),
@@ -191,7 +193,8 @@ ChannelPosix::ChannelPosix(const IPC::ChannelHandle& channel_handle,
       message_send_bytes_written_(0),
       pipe_name_(channel_handle.name),
       in_dtor_(false),
-      must_unlink_(false) {
+      must_unlink_(false),
+      broker_(broker) {
   if (!CreatePipe(channel_handle)) {
     // The pipe may have been closed already.
     const char *modestr = (mode_ & MODE_SERVER_FLAG) ? "server" : "client";
@@ -517,6 +520,10 @@ bool ChannelPosix::Send(Message* message) {
   return true;
 }
 
+AttachmentBroker* ChannelPosix::GetAttachmentBroker() {
+  return broker_;
+}
+
 int ChannelPosix::GetClientFileDescriptor() const {
   base::AutoLock lock(client_pipe_lock_);
   return client_pipe_.get();
@@ -995,9 +1002,12 @@ void ChannelPosix::ResetSafely(base::ScopedFD* fd) {
 // Channel's methods
 
 // static
-scoped_ptr<Channel> Channel::Create(
-    const IPC::ChannelHandle &channel_handle, Mode mode, Listener* listener) {
-  return make_scoped_ptr(new ChannelPosix(channel_handle, mode, listener));
+scoped_ptr<Channel> Channel::Create(const IPC::ChannelHandle& channel_handle,
+                                    Mode mode,
+                                    Listener* listener,
+                                    AttachmentBroker* broker) {
+  return make_scoped_ptr(
+      new ChannelPosix(channel_handle, mode, listener, broker));
 }
 
 // static
diff --git a/ipc/ipc_channel_posix.h b/ipc/ipc_channel_posix.h
index 986eb8a..879adc3 100644
--- a/ipc/ipc_channel_posix.h
+++ b/ipc/ipc_channel_posix.h
@@ -26,14 +26,18 @@ class IPC_EXPORT ChannelPosix : public Channel,
                                 public internal::ChannelReader,
                                 public base::MessageLoopForIO::Watcher {
  public:
-  ChannelPosix(const IPC::ChannelHandle& channel_handle, Mode mode,
-               Listener* listener);
+  // |broker| must outlive the newly created object.
+  ChannelPosix(const IPC::ChannelHandle& channel_handle,
+               Mode mode,
+               Listener* listener,
+               AttachmentBroker* broker);
   ~ChannelPosix() override;
 
   // Channel implementation
   bool Connect() override;
   void Close() override;
   bool Send(Message* message) override;
+  AttachmentBroker* GetAttachmentBroker() override;
   base::ProcessId GetPeerPID() const override;
   base::ProcessId GetSelfPID() const override;
   int GetClientFileDescriptor() const override;
@@ -175,6 +179,9 @@ class IPC_EXPORT ChannelPosix : public Channel,
   static int global_pid_;
 #endif  // OS_LINUX
 
+  // |broker_| must outlive this instance.
+  AttachmentBroker* broker_;
+
   DISALLOW_IMPLICIT_CONSTRUCTORS(ChannelPosix);
 };
 
diff --git a/ipc/ipc_channel_posix_unittest.cc b/ipc/ipc_channel_posix_unittest.cc
index aa54540..9209d2c 100644
--- a/ipc/ipc_channel_posix_unittest.cc
+++ b/ipc/ipc_channel_posix_unittest.cc
@@ -201,8 +201,8 @@ TEST_F(IPCChannelPosixTest, BasicListen) {
   IPC::ChannelHandle handle(kChannelName);
   SetUpSocket(&handle, IPC::Channel::MODE_NAMED_SERVER);
   unlink(handle.name.c_str());
-  scoped_ptr<IPC::ChannelPosix> channel(
-      new IPC::ChannelPosix(handle, IPC::Channel::MODE_NAMED_SERVER, NULL));
+  scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
+      handle, IPC::Channel::MODE_NAMED_SERVER, NULL, nullptr));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -220,8 +220,8 @@ TEST_F(IPCChannelPosixTest, BasicConnected) {
 
   base::FileDescriptor fd(pipe_fds[0], false);
   IPC::ChannelHandle handle(socket_name, fd);
-  scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_SERVER, NULL));
+  scoped_ptr<IPC::ChannelPosix> channel(
+      new IPC::ChannelPosix(handle, IPC::Channel::MODE_SERVER, NULL, nullptr));
   ASSERT_TRUE(channel->Connect());
   ASSERT_FALSE(channel->AcceptsConnections());
   channel->Close();
@@ -230,7 +230,7 @@ TEST_F(IPCChannelPosixTest, BasicConnected) {
   // Make sure that we can use the socket that is created for us by
   // a standard channel.
   scoped_ptr<IPC::ChannelPosix> channel2(new IPC::ChannelPosix(
-      socket_name, IPC::Channel::MODE_SERVER, NULL));
+      socket_name, IPC::Channel::MODE_SERVER, NULL, nullptr));
   ASSERT_TRUE(channel2->Connect());
   ASSERT_FALSE(channel2->AcceptsConnections());
 }
@@ -243,11 +243,11 @@ TEST_F(IPCChannelPosixTest, SendHangTest) {
   IPCChannelPosixTestListener in_listener(true);
   IPC::ChannelHandle in_handle("IN");
   scoped_ptr<IPC::ChannelPosix> in_chan(new IPC::ChannelPosix(
-      in_handle, IPC::Channel::MODE_SERVER, &in_listener));
+      in_handle, IPC::Channel::MODE_SERVER, &in_listener, nullptr));
   IPC::ChannelHandle out_handle(
       "OUT", base::FileDescriptor(in_chan->TakeClientFileDescriptor()));
   scoped_ptr<IPC::ChannelPosix> out_chan(new IPC::ChannelPosix(
-      out_handle, IPC::Channel::MODE_CLIENT, &out_listener));
+      out_handle, IPC::Channel::MODE_CLIENT, &out_listener, nullptr));
   ASSERT_TRUE(in_chan->Connect());
   ASSERT_TRUE(out_chan->Connect());
   in_chan->Close();  // simulate remote process dying at an unfortunate time.
@@ -268,11 +268,11 @@ TEST_F(IPCChannelPosixTest, AcceptHangTest) {
   IPCChannelPosixTestListener in_listener(true);
   IPC::ChannelHandle in_handle("IN");
   scoped_ptr<IPC::ChannelPosix> in_chan(new IPC::ChannelPosix(
-      in_handle, IPC::Channel::MODE_SERVER, &in_listener));
+      in_handle, IPC::Channel::MODE_SERVER, &in_listener, nullptr));
   IPC::ChannelHandle out_handle(
       "OUT", base::FileDescriptor(in_chan->TakeClientFileDescriptor()));
   scoped_ptr<IPC::ChannelPosix> out_chan(new IPC::ChannelPosix(
-      out_handle, IPC::Channel::MODE_CLIENT, &out_listener));
+      out_handle, IPC::Channel::MODE_CLIENT, &out_listener, nullptr));
   ASSERT_TRUE(in_chan->Connect());
   in_chan->Close();  // simulate remote process dying at an unfortunate time.
   ASSERT_FALSE(out_chan->Connect());
@@ -286,7 +286,7 @@ TEST_F(IPCChannelPosixTest, AdvancedConnected) {
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   SetUpSocket(&chan_handle, IPC::Channel::MODE_NAMED_SERVER);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -317,7 +317,7 @@ TEST_F(IPCChannelPosixTest, ResetState) {
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   SetUpSocket(&chan_handle, IPC::Channel::MODE_NAMED_SERVER);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -353,7 +353,7 @@ TEST_F(IPCChannelPosixTest, BadChannelName) {
   // Test empty name
   IPC::ChannelHandle handle("");
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_SERVER, NULL));
+      handle, IPC::Channel::MODE_NAMED_SERVER, NULL, nullptr));
   ASSERT_FALSE(channel->Connect());
 
   // Test name that is too long.
@@ -367,7 +367,7 @@ TEST_F(IPCChannelPosixTest, BadChannelName) {
   EXPECT_GE(strlen(kTooLongName), IPC::kMaxSocketNameLength);
   IPC::ChannelHandle handle2(kTooLongName);
   scoped_ptr<IPC::ChannelPosix> channel2(new IPC::ChannelPosix(
-      handle2, IPC::Channel::MODE_NAMED_SERVER, NULL));
+      handle2, IPC::Channel::MODE_NAMED_SERVER, NULL, nullptr));
   EXPECT_FALSE(channel2->Connect());
 }
 
@@ -378,7 +378,7 @@ TEST_F(IPCChannelPosixTest, MultiConnection) {
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   SetUpSocket(&chan_handle, IPC::Channel::MODE_NAMED_SERVER);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -414,9 +414,9 @@ TEST_F(IPCChannelPosixTest, DoubleServer) {
   IPCChannelPosixTestListener listener2(false);
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_SERVER, &listener));
+      chan_handle, IPC::Channel::MODE_SERVER, &listener, nullptr));
   scoped_ptr<IPC::ChannelPosix> channel2(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_SERVER, &listener2));
+      chan_handle, IPC::Channel::MODE_SERVER, &listener2, nullptr));
   ASSERT_TRUE(channel->Connect());
   ASSERT_FALSE(channel2->Connect());
 }
@@ -426,7 +426,7 @@ TEST_F(IPCChannelPosixTest, BadMode) {
   IPCChannelPosixTestListener listener(false);
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NONE, &listener));
+      chan_handle, IPC::Channel::MODE_NONE, &listener, nullptr));
   ASSERT_FALSE(channel->Connect());
 }
 
@@ -438,7 +438,7 @@ TEST_F(IPCChannelPosixTest, IsNamedServerInitialized) {
   ASSERT_FALSE(IPC::Channel::IsNamedServerInitialized(
       connection_socket_name));
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
   ASSERT_TRUE(IPC::Channel::IsNamedServerInitialized(
       connection_socket_name));
   channel->Close();
@@ -454,7 +454,7 @@ MULTIPROCESS_TEST_MAIN(IPCChannelPosixTestConnectionProc) {
   IPC::ChannelHandle handle(IPCChannelPosixTest::GetConnectionSocketName());
   IPCChannelPosixTest::SetUpSocket(&handle, IPC::Channel::MODE_NAMED_CLIENT);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener));
+      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener, nullptr));
   EXPECT_TRUE(channel->Connect());
   IPCChannelPosixTest::SpinRunLoop(TestTimeouts::action_max_timeout());
   EXPECT_EQ(IPCChannelPosixTestListener::MESSAGE_RECEIVED, listener.status());
@@ -468,7 +468,7 @@ MULTIPROCESS_TEST_MAIN(IPCChannelPosixFailConnectionProc) {
   IPC::ChannelHandle handle(IPCChannelPosixTest::GetConnectionSocketName());
   IPCChannelPosixTest::SetUpSocket(&handle, IPC::Channel::MODE_NAMED_CLIENT);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener));
+      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener, nullptr));
 
   // In this case connect may succeed or fail depending on if the packet
   // actually gets sent at sendmsg. Since we never delay on send, we may not
diff --git a/ipc/ipc_channel_proxy.cc b/ipc/ipc_channel_proxy.cc
index 5767618..269fd6a 100644
--- a/ipc/ipc_channel_proxy.cc
+++ b/ipc/ipc_channel_proxy.cc
@@ -347,7 +347,6 @@ void ChannelProxy::Context::Send(Message* message) {
                             base::Passed(scoped_ptr<Message>(message))));
 }
 
-
 //-----------------------------------------------------------------------------
 
 // static
@@ -355,9 +354,10 @@ scoped_ptr<ChannelProxy> ChannelProxy::Create(
     const IPC::ChannelHandle& channel_handle,
     Channel::Mode mode,
     Listener* listener,
-    const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner) {
+    const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner,
+    AttachmentBroker* broker) {
   scoped_ptr<ChannelProxy> channel(new ChannelProxy(listener, ipc_task_runner));
-  channel->Init(channel_handle, mode, true);
+  channel->Init(channel_handle, mode, true, broker);
   return channel.Pass();
 }
 
@@ -396,7 +396,8 @@ ChannelProxy::~ChannelProxy() {
 
 void ChannelProxy::Init(const IPC::ChannelHandle& channel_handle,
                         Channel::Mode mode,
-                        bool create_pipe_now) {
+                        bool create_pipe_now,
+                        AttachmentBroker* broker) {
 #if defined(OS_POSIX)
   // When we are creating a server on POSIX, we need its file descriptor
   // to be created immediately so that it can be accessed and passed
@@ -406,8 +407,7 @@ void ChannelProxy::Init(const IPC::ChannelHandle& channel_handle,
     create_pipe_now = true;
   }
 #endif  // defined(OS_POSIX)
-  Init(ChannelFactory::Create(channel_handle, mode),
-       create_pipe_now);
+  Init(ChannelFactory::Create(channel_handle, mode, broker), create_pipe_now);
 }
 
 void ChannelProxy::Init(scoped_ptr<ChannelFactory> factory,
diff --git a/ipc/ipc_channel_proxy.h b/ipc/ipc_channel_proxy.h
index 5d38006..73cb7e0 100644
--- a/ipc/ipc_channel_proxy.h
+++ b/ipc/ipc_channel_proxy.h
@@ -82,11 +82,15 @@ class IPC_EXPORT ChannelProxy : public Sender, public base::NonThreadSafe {
   // on the background thread.  Any message not handled by the filter will be
   // dispatched to the listener.  The given task runner correspond to a thread
   // on which IPC::Channel is created and used (e.g. IO thread).
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
   static scoped_ptr<ChannelProxy> Create(
       const IPC::ChannelHandle& channel_handle,
       Channel::Mode mode,
       Listener* listener,
-      const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner);
+      const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner,
+      AttachmentBroker* broker = nullptr);
 
   static scoped_ptr<ChannelProxy> Create(
       scoped_ptr<ChannelFactory> factory,
@@ -99,8 +103,13 @@ class IPC_EXPORT ChannelProxy : public Sender, public base::NonThreadSafe {
   // proxy that was not initialized in its constructor. If create_pipe_now is
   // true, the pipe is created synchronously. Otherwise it's created on the IO
   // thread.
-  void Init(const IPC::ChannelHandle& channel_handle, Channel::Mode mode,
-            bool create_pipe_now);
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
+  void Init(const IPC::ChannelHandle& channel_handle,
+            Channel::Mode mode,
+            bool create_pipe_now,
+            AttachmentBroker* broker = nullptr);
   void Init(scoped_ptr<ChannelFactory> factory, bool create_pipe_now);
 
   // Close the IPC::Channel.  This operation completes asynchronously, once the
diff --git a/ipc/ipc_channel_proxy_unittest.cc b/ipc/ipc_channel_proxy_unittest.cc
index 4144a8a..ee5dc22 100644
--- a/ipc/ipc_channel_proxy_unittest.cc
+++ b/ipc/ipc_channel_proxy_unittest.cc
@@ -423,8 +423,7 @@ MULTIPROCESS_IPC_TEST_CLIENT_MAIN(ChannelProxyClient) {
   base::MessageLoopForIO main_message_loop;
   ChannelReflectorListener listener;
   scoped_ptr<IPC::Channel> channel(IPC::Channel::CreateClient(
-      IPCTestBase::GetChannelName("ChannelProxyClient"),
-      &listener));
+      IPCTestBase::GetChannelName("ChannelProxyClient"), &listener, nullptr));
   CHECK(channel->Connect());
   listener.Init(channel.get());
 
diff --git a/ipc/ipc_channel_reader.h b/ipc/ipc_channel_reader.h
index 9dec8c1..0fdc354 100644
--- a/ipc/ipc_channel_reader.h
+++ b/ipc/ipc_channel_reader.h
@@ -6,6 +6,7 @@
 #define IPC_IPC_CHANNEL_READER_H_
 
 #include "base/basictypes.h"
+#include "ipc/attachment_broker.h"
 #include "ipc/ipc_channel.h"
 #include "ipc/ipc_export.h"
 
@@ -24,7 +25,7 @@ namespace internal {
 // functionality that would benefit from being factored out. If we add
 // something like that in the future, it would be more appropriate to add it
 // here (and rename appropriately) rather than writing a different class.
-class ChannelReader {
+class ChannelReader : virtual public SupportsAttachmentBrokering {
  public:
   explicit ChannelReader(Listener* listener);
   virtual ~ChannelReader();
diff --git a/ipc/ipc_channel_unittest.cc b/ipc/ipc_channel_unittest.cc
index 142881a..2623154 100644
--- a/ipc/ipc_channel_unittest.cc
+++ b/ipc/ipc_channel_unittest.cc
@@ -190,8 +190,7 @@ MULTIPROCESS_IPC_TEST_CLIENT_MAIN(GenericClient) {
 
   // Set up IPC channel.
   scoped_ptr<IPC::Channel> channel(IPC::Channel::CreateClient(
-      IPCTestBase::GetChannelName("GenericClient"),
-      &listener));
+      IPCTestBase::GetChannelName("GenericClient"), &listener, nullptr));
   CHECK(channel->Connect());
   listener.Init(channel.get());
   IPC::TestChannelListener::SendOneMessage(channel.get(), "hello from child");
diff --git a/ipc/ipc_channel_win.cc b/ipc/ipc_channel_win.cc
index edba83a..cd12cad 100644
--- a/ipc/ipc_channel_win.cc
+++ b/ipc/ipc_channel_win.cc
@@ -34,8 +34,10 @@ ChannelWin::State::~State() {
                 "member.");
 }
 
-ChannelWin::ChannelWin(const IPC::ChannelHandle &channel_handle,
-                       Mode mode, Listener* listener)
+ChannelWin::ChannelWin(const IPC::ChannelHandle& channel_handle,
+                       Mode mode,
+                       Listener* listener,
+                       AttachmentBroker* broker)
     : ChannelReader(listener),
       input_state_(this),
       output_state_(this),
@@ -44,7 +46,8 @@ ChannelWin::ChannelWin(const IPC::ChannelHandle &channel_handle,
       processing_incoming_(false),
       validate_client_(false),
       client_secret_(0),
-      weak_factory_(this) {
+      weak_factory_(this),
+      broker_(broker) {
   CreatePipe(channel_handle, mode);
 }
 
@@ -101,6 +104,10 @@ bool ChannelWin::Send(Message* message) {
   return true;
 }
 
+AttachmentBroker* ChannelWin::GetAttachmentBroker() {
+  return broker_;
+}
+
 base::ProcessId ChannelWin::GetPeerPID() const {
   return peer_pid_;
 }
@@ -476,10 +483,12 @@ void ChannelWin::OnIOCompleted(
 // Channel's methods
 
 // static
-scoped_ptr<Channel> Channel::Create(
-    const IPC::ChannelHandle &channel_handle, Mode mode, Listener* listener) {
+scoped_ptr<Channel> Channel::Create(const IPC::ChannelHandle& channel_handle,
+                                    Mode mode,
+                                    Listener* listener,
+                                    AttachmentBroker* broker) {
   return scoped_ptr<Channel>(
-      new ChannelWin(channel_handle, mode, listener));
+      new ChannelWin(channel_handle, mode, listener, broker));
 }
 
 // static
diff --git a/ipc/ipc_channel_win.h b/ipc/ipc_channel_win.h
index 04990d4..c720377 100644
--- a/ipc/ipc_channel_win.h
+++ b/ipc/ipc_channel_win.h
@@ -27,14 +27,18 @@ class ChannelWin : public Channel,
                    public base::MessageLoopForIO::IOHandler {
  public:
   // Mirror methods of Channel, see ipc_channel.h for description.
-  ChannelWin(const IPC::ChannelHandle &channel_handle, Mode mode,
-             Listener* listener);
+  // |broker| must outlive the newly created object.
+  ChannelWin(const IPC::ChannelHandle& channel_handle,
+             Mode mode,
+             Listener* listener,
+             AttachmentBroker* broker);
   ~ChannelWin() override;
 
   // Channel implementation
   bool Connect() override;
   void Close() override;
   bool Send(Message* message) override;
+  AttachmentBroker* GetAttachmentBroker() override;
   base::ProcessId GetPeerPID() const override;
   base::ProcessId GetSelfPID() const override;
 
@@ -104,6 +108,9 @@ class ChannelWin : public Channel,
   scoped_ptr<base::ThreadChecker> thread_check_;
   base::WeakPtrFactory<ChannelWin> weak_factory_;
 
+  // |broker_| must outlive this instance.
+  AttachmentBroker* broker_;
+
   DISALLOW_COPY_AND_ASSIGN(ChannelWin);
 };
 
diff --git a/ipc/ipc_fuzzing_tests.cc b/ipc/ipc_fuzzing_tests.cc
index c19d842..d3ff1a0 100644
--- a/ipc/ipc_fuzzing_tests.cc
+++ b/ipc/ipc_fuzzing_tests.cc
@@ -251,8 +251,7 @@ MULTIPROCESS_IPC_TEST_CLIENT_MAIN(FuzzServerClient) {
   base::MessageLoopForIO main_message_loop;
   FuzzerServerListener listener;
   scoped_ptr<IPC::Channel> channel(IPC::Channel::CreateClient(
-      IPCTestBase::GetChannelName("FuzzServerClient"),
-      &listener));
+      IPCTestBase::GetChannelName("FuzzServerClient"), &listener, nullptr));
   CHECK(channel->Connect());
   listener.Init(channel.get());
   base::MessageLoop::current()->Run();
diff --git a/ipc/ipc_perftest_support.cc b/ipc/ipc_perftest_support.cc
index 5ae4076..31a37a7 100644
--- a/ipc/ipc_perftest_support.cc
+++ b/ipc/ipc_perftest_support.cc
@@ -327,8 +327,8 @@ PingPongTestClient::~PingPongTestClient() {
 
 scoped_ptr<Channel> PingPongTestClient::CreateChannel(
     Listener* listener) {
-  return Channel::CreateClient(
-      IPCTestBase::GetChannelName("PerformanceClient"), listener);
+  return Channel::CreateClient(IPCTestBase::GetChannelName("PerformanceClient"),
+                               listener, nullptr);
 }
 
 int PingPongTestClient::RunMain() {
diff --git a/ipc/ipc_send_fds_test.cc b/ipc/ipc_send_fds_test.cc
index 2328c30..7669c8f 100644
--- a/ipc/ipc_send_fds_test.cc
+++ b/ipc/ipc_send_fds_test.cc
@@ -149,8 +149,7 @@ int SendFdsClientCommon(const std::string& test_client_name,
 
   // Set up IPC channel.
   scoped_ptr<IPC::Channel> channel(IPC::Channel::CreateClient(
-      IPCTestBase::GetChannelName(test_client_name),
-      &listener));
+      IPCTestBase::GetChannelName(test_client_name), &listener, nullptr));
   CHECK(channel->Connect());
 
   // Run message loop.
@@ -245,10 +244,10 @@ class PipeChannelHelper {
 
   void Init() {
     IPC::ChannelHandle in_handle("IN");
-    in = IPC::Channel::CreateServer(in_handle, &null_listener_);
+    in = IPC::Channel::CreateServer(in_handle, &null_listener_, nullptr);
     IPC::ChannelHandle out_handle(
         "OUT", base::FileDescriptor(in->TakeClientFileDescriptor()));
-    out = IPC::Channel::CreateClient(out_handle, &cb_listener_);
+    out = IPC::Channel::CreateClient(out_handle, &cb_listener_, nullptr);
     // PostTask the connect calls to make sure the callbacks happens
     // on the right threads.
     in_thread_->task_runner()->PostTask(
diff --git a/ipc/ipc_sync_channel.cc b/ipc/ipc_sync_channel.cc
index 06cd46f..35b88a7 100644
--- a/ipc/ipc_sync_channel.cc
+++ b/ipc/ipc_sync_channel.cc
@@ -412,10 +412,11 @@ scoped_ptr<SyncChannel> SyncChannel::Create(
     Listener* listener,
     const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner,
     bool create_pipe_now,
-    base::WaitableEvent* shutdown_event) {
+    base::WaitableEvent* shutdown_event,
+    AttachmentBroker* broker) {
   scoped_ptr<SyncChannel> channel =
       Create(listener, ipc_task_runner, shutdown_event);
-  channel->Init(channel_handle, mode, create_pipe_now);
+  channel->Init(channel_handle, mode, create_pipe_now, broker);
   return channel.Pass();
 }
 
diff --git a/ipc/ipc_sync_channel.h b/ipc/ipc_sync_channel.h
index 3593485..8b4b9a9 100644
--- a/ipc/ipc_sync_channel.h
+++ b/ipc/ipc_sync_channel.h
@@ -68,13 +68,17 @@ class IPC_EXPORT SyncChannel : public ChannelProxy {
   // Creates and initializes a sync channel. If create_pipe_now is specified,
   // the channel will be initialized synchronously.
   // The naming pattern follows IPC::Channel.
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
   static scoped_ptr<SyncChannel> Create(
       const IPC::ChannelHandle& channel_handle,
       IPC::Channel::Mode mode,
       Listener* listener,
       const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner,
       bool create_pipe_now,
-      base::WaitableEvent* shutdown_event);
+      base::WaitableEvent* shutdown_event,
+      AttachmentBroker* broker = nullptr);
 
   static scoped_ptr<SyncChannel> Create(
       scoped_ptr<ChannelFactory> factory,
diff --git a/ipc/ipc_sync_channel_unittest.cc b/ipc/ipc_sync_channel_unittest.cc
index 7e81d5d..1e61a68 100644
--- a/ipc/ipc_sync_channel_unittest.cc
+++ b/ipc/ipc_sync_channel_unittest.cc
@@ -155,7 +155,7 @@ class Worker : public Listener, public Sender {
   virtual SyncChannel* CreateChannel() {
     scoped_ptr<SyncChannel> channel = SyncChannel::Create(
         channel_name_, mode_, this, ipc_thread_.task_runner().get(), true,
-        &shutdown_event_);
+        &shutdown_event_, nullptr);
     return channel.release();
   }
 
@@ -327,7 +327,7 @@ class TwoStepServer : public Worker {
     SyncChannel* channel =
         SyncChannel::Create(channel_name(), mode(), this,
                             ipc_thread().task_runner().get(), create_pipe_now_,
-                            shutdown_event()).release();
+                            shutdown_event(), nullptr).release();
     return channel;
   }
 
@@ -349,7 +349,7 @@ class TwoStepClient : public Worker {
     SyncChannel* channel =
         SyncChannel::Create(channel_name(), mode(), this,
                             ipc_thread().task_runner().get(), create_pipe_now_,
-                            shutdown_event()).release();
+                            shutdown_event(), nullptr).release();
     return channel;
   }
 
@@ -1138,7 +1138,7 @@ class RestrictedDispatchClient : public Worker {
 
     non_restricted_channel_ = SyncChannel::Create(
         "non_restricted_channel", IPC::Channel::MODE_CLIENT, this,
-        ipc_thread().task_runner().get(), true, shutdown_event());
+        ipc_thread().task_runner().get(), true, shutdown_event(), nullptr);
 
     server_->ListenerThread()->task_runner()->PostTask(
         FROM_HERE, base::Bind(&RestrictedDispatchServer::OnDoPing, server_, 2));
@@ -1525,7 +1525,7 @@ class RestrictedDispatchPipeWorker : public Worker {
     event2_->Wait();
     other_channel_ = SyncChannel::Create(
         other_channel_name_, IPC::Channel::MODE_CLIENT, this,
-        ipc_thread().task_runner().get(), true, shutdown_event());
+        ipc_thread().task_runner().get(), true, shutdown_event(), nullptr);
     other_channel_->SetRestrictDispatchChannelGroup(group_);
     if (!is_first()) {
       event1_->Signal();
@@ -1601,7 +1601,7 @@ class ReentrantReplyServer1 : public Worker {
   void Run() override {
     server2_channel_ = SyncChannel::Create(
         "reentrant_reply2", IPC::Channel::MODE_CLIENT, this,
-        ipc_thread().task_runner().get(), true, shutdown_event());
+        ipc_thread().task_runner().get(), true, shutdown_event(), nullptr);
     server_ready_->Signal();
     Message* msg = new SyncChannelTestMsg_Reentrant1();
     server2_channel_->Send(msg);
diff --git a/ipc/ipc_test_base.cc b/ipc/ipc_test_base.cc
index 0d66282..4de5543 100644
--- a/ipc/ipc_test_base.cc
+++ b/ipc/ipc_test_base.cc
@@ -90,8 +90,7 @@ void IPCTestBase::CreateChannelProxy(
   CHECK(!channel_proxy_.get());
   channel_proxy_ = IPC::ChannelProxy::Create(
       CreateChannelFactory(GetTestChannelHandle(), ipc_task_runner.get()),
-      listener,
-      ipc_task_runner);
+      listener, ipc_task_runner);
 }
 
 void IPCTestBase::DestroyChannelProxy() {
@@ -161,5 +160,6 @@ scoped_refptr<base::SequencedTaskRunner> IPCTestBase::task_runner() {
 scoped_ptr<IPC::ChannelFactory> IPCTestBase::CreateChannelFactory(
     const IPC::ChannelHandle& handle,
     base::SequencedTaskRunner* runner) {
-  return IPC::ChannelFactory::Create(handle, IPC::Channel::MODE_SERVER);
+  return IPC::ChannelFactory::Create(handle, IPC::Channel::MODE_SERVER,
+                                     nullptr);
 }
diff --git a/ipc/mojo/ipc_channel_mojo.cc b/ipc/mojo/ipc_channel_mojo.cc
index 62fcb19..4886a125 100644
--- a/ipc/mojo/ipc_channel_mojo.cc
+++ b/ipc/mojo/ipc_channel_mojo.cc
@@ -31,11 +31,13 @@ class MojoChannelFactory : public ChannelFactory {
   MojoChannelFactory(ChannelMojo::Delegate* delegate,
                      scoped_refptr<base::TaskRunner> io_runner,
                      ChannelHandle channel_handle,
-                     Channel::Mode mode)
+                     Channel::Mode mode,
+                     AttachmentBroker* broker)
       : delegate_(delegate),
         io_runner_(io_runner),
         channel_handle_(channel_handle),
-        mode_(mode) {}
+        mode_(mode),
+        broker_(broker) {}
 
   std::string GetName() const override {
     return channel_handle_.name;
@@ -43,7 +45,7 @@ class MojoChannelFactory : public ChannelFactory {
 
   scoped_ptr<Channel> BuildChannel(Listener* listener) override {
     return ChannelMojo::Create(delegate_, io_runner_, channel_handle_, mode_,
-                               listener);
+                               listener, broker_);
   }
 
  private:
@@ -51,6 +53,7 @@ class MojoChannelFactory : public ChannelFactory {
   scoped_refptr<base::TaskRunner> io_runner_;
   ChannelHandle channel_handle_;
   Channel::Mode mode_;
+  AttachmentBroker* broker_;
 };
 
 //------------------------------------------------------------------------------
@@ -62,12 +65,14 @@ class ClientChannelMojo : public ChannelMojo,
   ClientChannelMojo(ChannelMojo::Delegate* delegate,
                     scoped_refptr<base::TaskRunner> io_runner,
                     const ChannelHandle& handle,
-                    Listener* listener);
+                    Listener* listener,
+                    AttachmentBroker* broker);
   ~ClientChannelMojo() override;
   // MojoBootstrap::Delegate implementation
   void OnPipeAvailable(mojo::embedder::ScopedPlatformHandle handle) override;
   // mojo::ErrorHandler implementation
   void OnConnectionError() override;
+
   // ClientChannel implementation
   void Init(
       mojo::ScopedMessagePipeHandle pipe,
@@ -86,8 +91,14 @@ class ClientChannelMojo : public ChannelMojo,
 ClientChannelMojo::ClientChannelMojo(ChannelMojo::Delegate* delegate,
                                      scoped_refptr<base::TaskRunner> io_runner,
                                      const ChannelHandle& handle,
-                                     Listener* listener)
-    : ChannelMojo(delegate, io_runner, handle, Channel::MODE_CLIENT, listener),
+                                     Listener* listener,
+                                     AttachmentBroker* broker)
+    : ChannelMojo(delegate,
+                  io_runner,
+                  handle,
+                  Channel::MODE_CLIENT,
+                  listener,
+                  broker),
       binding_(this),
       weak_factory_(this) {
 }
@@ -124,7 +135,8 @@ class ServerChannelMojo : public ChannelMojo, public mojo::ErrorHandler {
   ServerChannelMojo(ChannelMojo::Delegate* delegate,
                     scoped_refptr<base::TaskRunner> io_runner,
                     const ChannelHandle& handle,
-                    Listener* listener);
+                    Listener* listener,
+                    AttachmentBroker* broker);
   ~ServerChannelMojo() override;
 
   // MojoBootstrap::Delegate implementation
@@ -151,8 +163,14 @@ class ServerChannelMojo : public ChannelMojo, public mojo::ErrorHandler {
 ServerChannelMojo::ServerChannelMojo(ChannelMojo::Delegate* delegate,
                                      scoped_refptr<base::TaskRunner> io_runner,
                                      const ChannelHandle& handle,
-                                     Listener* listener)
-    : ChannelMojo(delegate, io_runner, handle, Channel::MODE_SERVER, listener),
+                                     Listener* listener,
+                                     AttachmentBroker* broker)
+    : ChannelMojo(delegate,
+                  io_runner,
+                  handle,
+                  Channel::MODE_SERVER,
+                  listener,
+                  broker),
       weak_factory_(this) {
 }
 
@@ -248,14 +266,15 @@ scoped_ptr<ChannelMojo> ChannelMojo::Create(
     scoped_refptr<base::TaskRunner> io_runner,
     const ChannelHandle& channel_handle,
     Mode mode,
-    Listener* listener) {
+    Listener* listener,
+    AttachmentBroker* broker) {
   switch (mode) {
     case Channel::MODE_CLIENT:
-      return make_scoped_ptr(
-          new ClientChannelMojo(delegate, io_runner, channel_handle, listener));
+      return make_scoped_ptr(new ClientChannelMojo(
+          delegate, io_runner, channel_handle, listener, broker));
     case Channel::MODE_SERVER:
-      return make_scoped_ptr(
-          new ServerChannelMojo(delegate, io_runner, channel_handle, listener));
+      return make_scoped_ptr(new ServerChannelMojo(
+          delegate, io_runner, channel_handle, listener, broker));
     default:
       NOTREACHED();
       return nullptr;
@@ -266,25 +285,28 @@ scoped_ptr<ChannelMojo> ChannelMojo::Create(
 scoped_ptr<ChannelFactory> ChannelMojo::CreateServerFactory(
     ChannelMojo::Delegate* delegate,
     scoped_refptr<base::TaskRunner> io_runner,
-    const ChannelHandle& channel_handle) {
+    const ChannelHandle& channel_handle,
+    AttachmentBroker* broker) {
   return make_scoped_ptr(new MojoChannelFactory(
-      delegate, io_runner, channel_handle, Channel::MODE_SERVER));
+      delegate, io_runner, channel_handle, Channel::MODE_SERVER, broker));
 }
 
 // static
 scoped_ptr<ChannelFactory> ChannelMojo::CreateClientFactory(
     ChannelMojo::Delegate* delegate,
     scoped_refptr<base::TaskRunner> io_runner,
-    const ChannelHandle& channel_handle) {
+    const ChannelHandle& channel_handle,
+    AttachmentBroker* broker) {
   return make_scoped_ptr(new MojoChannelFactory(
-      delegate, io_runner, channel_handle, Channel::MODE_CLIENT));
+      delegate, io_runner, channel_handle, Channel::MODE_CLIENT, broker));
 }
 
 ChannelMojo::ChannelMojo(ChannelMojo::Delegate* delegate,
                          scoped_refptr<base::TaskRunner> io_runner,
                          const ChannelHandle& handle,
                          Mode mode,
-                         Listener* listener)
+                         Listener* listener,
+                         AttachmentBroker* broker)
     : mode_(mode),
       listener_(listener),
       peer_pid_(base::kNullProcessId),
@@ -293,7 +315,7 @@ ChannelMojo::ChannelMojo(ChannelMojo::Delegate* delegate,
       weak_factory_(this) {
   // Create MojoBootstrap after all members are set as it touches
   // ChannelMojo from a different thread.
-  bootstrap_ = MojoBootstrap::Create(handle, mode, this);
+  bootstrap_ = MojoBootstrap::Create(handle, mode, this, broker);
   if (io_runner == base::MessageLoop::current()->task_runner()) {
     InitOnIOThread(delegate);
   } else {
diff --git a/ipc/mojo/ipc_channel_mojo.h b/ipc/mojo/ipc_channel_mojo.h
index 3a1d98a..b84a6e3 100644
--- a/ipc/mojo/ipc_channel_mojo.h
+++ b/ipc/mojo/ipc_channel_mojo.h
@@ -69,25 +69,37 @@ class IPC_MOJO_EXPORT ChannelMojo
 
   // Create ChannelMojo. A bootstrap channel is created as well.
   // |host| must not be null for server channels.
+  // |broker| must outlive the newly created channel.
   static scoped_ptr<ChannelMojo> Create(
       Delegate* delegate,
       scoped_refptr<base::TaskRunner> io_runner,
       const ChannelHandle& channel_handle,
       Mode mode,
-      Listener* listener);
+      Listener* listener,
+      AttachmentBroker* broker);
 
   // Create a factory object for ChannelMojo.
   // The factory is used to create Mojo-based ChannelProxy family.
   // |host| must not be null.
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
+  // |broker| must outlive the factory and all channels it creates.
   static scoped_ptr<ChannelFactory> CreateServerFactory(
       Delegate* delegate,
       scoped_refptr<base::TaskRunner> io_runner,
-      const ChannelHandle& channel_handle);
+      const ChannelHandle& channel_handle,
+      AttachmentBroker* broker = nullptr);
 
+  // TODO(erikchen): Remove default parameter for |broker|. It exists only to
+  // make the upcoming refactor decomposable into smaller CLs.
+  // http://crbug.com/493414.
+  // |broker| must outlive the factory and all channels it creates.
   static scoped_ptr<ChannelFactory> CreateClientFactory(
       Delegate* delegate,
       scoped_refptr<base::TaskRunner> io_runner,
-      const ChannelHandle& channel_handle);
+      const ChannelHandle& channel_handle,
+      AttachmentBroker* broker = nullptr);
 
   ~ChannelMojo() override;
 
@@ -129,7 +141,8 @@ class IPC_MOJO_EXPORT ChannelMojo
               scoped_refptr<base::TaskRunner> io_runner,
               const ChannelHandle& channel_handle,
               Mode mode,
-              Listener* listener);
+              Listener* listener,
+              AttachmentBroker* broker);
 
   void CreateMessagingPipe(mojo::embedder::ScopedPlatformHandle handle,
                            const CreateMessagingPipeCallback& callback);
diff --git a/ipc/mojo/ipc_channel_mojo_unittest.cc b/ipc/mojo/ipc_channel_mojo_unittest.cc
index df5b7ba..17242bf 100644
--- a/ipc/mojo/ipc_channel_mojo_unittest.cc
+++ b/ipc/mojo/ipc_channel_mojo_unittest.cc
@@ -68,9 +68,10 @@ class ListenerThatExpectsOK : public IPC::Listener {
 class ChannelClient {
  public:
   explicit ChannelClient(IPC::Listener* listener, const char* name) {
-    channel_ = IPC::ChannelMojo::Create(NULL, main_message_loop_.task_runner(),
-                                        IPCTestBase::GetChannelName(name),
-                                        IPC::Channel::MODE_CLIENT, listener);
+    channel_ =
+        IPC::ChannelMojo::Create(NULL, main_message_loop_.task_runner(),
+                                 IPCTestBase::GetChannelName(name),
+                                 IPC::Channel::MODE_CLIENT, listener, nullptr);
   }
 
   void Connect() {
@@ -116,8 +117,8 @@ class IPCChannelMojoTest : public IPCChannelMojoTestBase {
       const IPC::ChannelHandle& handle,
       base::SequencedTaskRunner* runner) override {
     host_.reset(new IPC::ChannelMojoHost(task_runner()));
-    return IPC::ChannelMojo::CreateServerFactory(host_->channel_delegate(),
-                                                 task_runner(), handle);
+    return IPC::ChannelMojo::CreateServerFactory(
+        host_->channel_delegate(), task_runner(), handle, nullptr);
   }
 
   bool DidStartClient() override {
@@ -224,8 +225,8 @@ class IPCChannelMojoErrorTest : public IPCChannelMojoTestBase {
       const IPC::ChannelHandle& handle,
       base::SequencedTaskRunner* runner) override {
     host_.reset(new IPC::ChannelMojoHost(task_runner()));
-    return IPC::ChannelMojo::CreateServerFactory(host_->channel_delegate(),
-                                                 task_runner(), handle);
+    return IPC::ChannelMojo::CreateServerFactory(
+        host_->channel_delegate(), task_runner(), handle, nullptr);
   }
 
   bool DidStartClient() override {
@@ -558,8 +559,8 @@ class IPCChannelMojoDeadHandleTest : public IPCChannelMojoTestBase {
       const IPC::ChannelHandle& handle,
       base::SequencedTaskRunner* runner) override {
     host_.reset(new IPC::ChannelMojoHost(task_runner()));
-    return IPC::ChannelMojo::CreateServerFactory(host_->channel_delegate(),
-                                                 task_runner(), handle);
+    return IPC::ChannelMojo::CreateServerFactory(
+        host_->channel_delegate(), task_runner(), handle, nullptr);
   }
 
   bool DidStartClient() override {
diff --git a/ipc/mojo/ipc_mojo_bootstrap.cc b/ipc/mojo/ipc_mojo_bootstrap.cc
index cd9b24a..48d0c27 100644
--- a/ipc/mojo/ipc_mojo_bootstrap.cc
+++ b/ipc/mojo/ipc_mojo_bootstrap.cc
@@ -173,14 +173,16 @@ void MojoClientBootstrap::OnChannelConnected(int32 peer_pid) {
 // static
 scoped_ptr<MojoBootstrap> MojoBootstrap::Create(ChannelHandle handle,
                                                 Channel::Mode mode,
-                                                Delegate* delegate) {
+                                                Delegate* delegate,
+                                                AttachmentBroker* broker) {
   CHECK(mode == Channel::MODE_CLIENT || mode == Channel::MODE_SERVER);
   scoped_ptr<MojoBootstrap> self =
       mode == Channel::MODE_CLIENT
           ? scoped_ptr<MojoBootstrap>(new MojoClientBootstrap())
           : scoped_ptr<MojoBootstrap>(new MojoServerBootstrap());
+
   scoped_ptr<Channel> bootstrap_channel =
-      Channel::Create(handle, mode, self.get());
+      Channel::Create(handle, mode, self.get(), broker);
   self->Init(bootstrap_channel.Pass(), delegate);
   return self.Pass();
 }
diff --git a/ipc/mojo/ipc_mojo_bootstrap.h b/ipc/mojo/ipc_mojo_bootstrap.h
index 1f71d2e..e8861cb 100644
--- a/ipc/mojo/ipc_mojo_bootstrap.h
+++ b/ipc/mojo/ipc_mojo_bootstrap.h
@@ -13,6 +13,8 @@
 
 namespace IPC {
 
+class AttachmentBroker;
+
 // MojoBootstrap establishes a bootstrap pipe between two processes in
 // Chrome. It creates a native IPC::Channel first, then sends one
 // side of a newly created pipe to peer process. The pipe is intended
@@ -38,7 +40,8 @@ class IPC_MOJO_EXPORT MojoBootstrap : public Listener {
   // mode as |mode|. The result is notified to passed |delegate|.
   static scoped_ptr<MojoBootstrap> Create(ChannelHandle handle,
                                           Channel::Mode mode,
-                                          Delegate* delegate);
+                                          Delegate* delegate,
+                                          AttachmentBroker* broker);
 
   MojoBootstrap();
   ~MojoBootstrap() override;
diff --git a/ipc/mojo/ipc_mojo_bootstrap_unittest.cc b/ipc/mojo/ipc_mojo_bootstrap_unittest.cc
index fbe0fa8..65d216f 100644
--- a/ipc/mojo/ipc_mojo_bootstrap_unittest.cc
+++ b/ipc/mojo/ipc_mojo_bootstrap_unittest.cc
@@ -47,7 +47,7 @@ TEST_F(IPCMojoBootstrapTest, Connect) {
 
   TestingDelegate delegate;
   scoped_ptr<IPC::MojoBootstrap> bootstrap = IPC::MojoBootstrap::Create(
-      GetTestChannelHandle(), IPC::Channel::MODE_SERVER, &delegate);
+      GetTestChannelHandle(), IPC::Channel::MODE_SERVER, &delegate, nullptr);
 
   ASSERT_TRUE(bootstrap->Connect());
 #if defined(OS_POSIX)
@@ -71,7 +71,8 @@ MULTIPROCESS_IPC_TEST_CLIENT_MAIN(IPCMojoBootstrapTestClient) {
   scoped_ptr<IPC::MojoBootstrap> bootstrap = IPC::MojoBootstrap::Create(
       IPCTestBase::GetChannelName("IPCMojoBootstrapTestClient"),
       IPC::Channel::MODE_CLIENT,
-      &delegate);
+      &delegate,
+      nullptr);
 
   bootstrap->Connect();
 
diff --git a/ipc/mojo/ipc_mojo_perftest.cc b/ipc/mojo/ipc_mojo_perftest.cc
index dc96dd1..34ab5f9 100644
--- a/ipc/mojo/ipc_mojo_perftest.cc
+++ b/ipc/mojo/ipc_mojo_perftest.cc
@@ -39,7 +39,7 @@ public:
       base::SequencedTaskRunner* runner) override {
     host_.reset(new IPC::ChannelMojoHost(runner));
     return IPC::ChannelMojo::CreateServerFactory(host_->channel_delegate(),
-                                                 runner, handle);
+                                                 runner, handle, nullptr);
   }
 
   bool DidStartClient() override {
@@ -89,7 +89,7 @@ scoped_ptr<IPC::Channel> MojoTestClient::CreateChannel(
     IPC::Listener* listener) {
   return scoped_ptr<IPC::Channel>(IPC::ChannelMojo::Create(
       NULL, task_runner(), IPCTestBase::GetChannelName("PerformanceClient"),
-      IPC::Channel::MODE_CLIENT, listener));
+      IPC::Channel::MODE_CLIENT, listener, nullptr));
 }
 
 MULTIPROCESS_IPC_TEST_CLIENT_MAIN(PerformanceClient) {
diff --git a/ipc/sync_socket_unittest.cc b/ipc/sync_socket_unittest.cc
index 82ab0cd..0172c2f 100644
--- a/ipc/sync_socket_unittest.cc
+++ b/ipc/sync_socket_unittest.cc
@@ -110,8 +110,8 @@ MULTIPROCESS_IPC_TEST_CLIENT_MAIN(SyncSocketServerClient) {
   base::MessageLoopForIO main_message_loop;
   SyncSocketServerListener listener;
   scoped_ptr<IPC::Channel> channel(IPC::Channel::CreateClient(
-      IPCTestBase::GetChannelName("SyncSocketServerClient"),
-      &listener));
+      IPCTestBase::GetChannelName("SyncSocketServerClient"), &listener,
+      nullptr));
   EXPECT_TRUE(channel->Connect());
   listener.Init(channel.get());
   base::MessageLoop::current()->Run();