Bind Application in renderer.

This involved changing how we get the client handle to the renderer. In the first iteration I was passing this on the command line but that turns out not to work with the sandbox. So instead I an approach used by the Mojo-in-Chrome MojoApplication class and pass the primordial handle via Chrome IPC.

I had to twiddle a bunch of BUILD.gn files in content to get this to work without crashing due to inconsistencies in how MOJO_SHELL_CLIENT was defined.

R=jam@chromium.org,tsepez@chromium.org
http://crbug.com/551253

Committed: https://crrev.com/3edb97198bc5fbc22c5cf13286e8af80449ddfb9
Cr-Commit-Position: refs/heads/master@{#360293}

Review URL: https://codereview.chromium.org/1452823003

Cr-Commit-Position: refs/heads/master@{#360396}

26 files changed, 250 insertions, 116 deletions

diff --git a/components/mus/example/window_type_launcher/main.cc b/components/mus/example/window_type_launcher/main.cc
index 9cecc39..c2e94f9 100644
--- a/components/mus/example/window_type_launcher/main.cc
+++ b/components/mus/example/window_type_launcher/main.cc
@@ -61,19 +61,17 @@ int main(int argc, char** argv) {
                                    io_thread.task_runner().get(),
                                    mojo::embedder::ScopedPlatformHandle());
 
-    mojo::InterfaceRequest<mojo::Application> application_request;
-    scoped_ptr<mojo::runner::RunnerConnection> connection(
-        mojo::runner::RunnerConnection::ConnectToRunner(&application_request));
-
+    base::MessageLoop loop(mojo::common::MessagePumpMojo::Create());
     WindowTypeLauncher delegate;
     {
-      base::MessageLoop loop(mojo::common::MessagePumpMojo::Create());
+      mojo::InterfaceRequest<mojo::Application> application_request;
+      scoped_ptr<mojo::runner::RunnerConnection> connection(
+          mojo::runner::RunnerConnection::ConnectToRunner(
+              &application_request, mojo::ScopedMessagePipeHandle()));
       mojo::ApplicationImpl impl(&delegate, application_request.Pass());
       loop.Run();
     }
 
-    connection.reset();
-
     mojo::embedder::ShutdownIPCSupport();
   }
 
diff --git a/content/app/BUILD.gn b/content/app/BUILD.gn
index b83b529..021c51f 100644
--- a/content/app/BUILD.gn
+++ b/content/app/BUILD.gn
@@ -70,6 +70,7 @@ if (is_ios) {
 content_app_extra_configs = [
   "//build/config/compiler:wexit_time_destructors",
   "//content:content_implementation",
+  "//content/public/common:mojo_shell_client",
   "//v8:external_startup_data",
 ]
 
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 9990e72..66a7ab9 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -12,7 +12,10 @@ source_set("browser") {
   # internal content ones) should depend on the public one.
   visibility = [ "//content/public/browser:browser_sources" ]
 
-  configs += [ "//build/config:precompiled_headers" ]
+  configs += [
+    "//build/config:precompiled_headers",
+    "//content/public/common:mojo_shell_client",
+  ]
   defines = []
   libs = []
   ldflags = []
@@ -104,7 +107,10 @@ source_set("browser") {
             ],
             ".")
 
-    defines += [ "MOJO_SHELL_CLIENT" ]
+    sources += [
+      "mojo/mojo_shell_client_host.cc",
+      "mojo/mojo_shell_client_host.h",
+    ]
 
     # Non-iOS deps.
     deps += [
diff --git a/content/browser/child_process_launcher.cc b/content/browser/child_process_launcher.cc
index 830d5b9..e54cada 100644
--- a/content/browser/child_process_launcher.cc
+++ b/content/browser/child_process_launcher.cc
@@ -48,17 +48,6 @@
 #include "gin/v8_initializer.h"
 #endif
 
-#if defined(MOJO_SHELL_CLIENT)
-#include "base/thread_task_runner_handle.h"
-#include "content/public/common/mojo_shell_connection.h"
-#include "mojo/application/public/cpp/application_impl.h"
-#include "mojo/converters/network/network_type_converters.h"
-#include "mojo/shell/application_manager.mojom.h"
-#include "third_party/mojo/src/mojo/edk/embedder/embedder.h"
-#include "third_party/mojo/src/mojo/edk/embedder/platform_channel_pair.h"
-#include "third_party/mojo/src/mojo/edk/embedder/scoped_platform_handle.h"
-#endif
-
 namespace content {
 
 namespace {
@@ -333,10 +322,6 @@ void SetProcessBackgroundedOnLauncherThread(base::Process process,
 #endif
 }
 
-#if defined(MOJO_SHELL_CLIENT)
-void DidCreateChannel(mojo::embedder::ChannelInfo* info) {}
-#endif
-
 }  // namespace
 
 ChildProcessLauncher::ChildProcessLauncher(
@@ -380,10 +365,6 @@ void ChildProcessLauncher::Launch(
     int child_process_id) {
   DCHECK(CalledOnValidThread());
 
-#if defined(MOJO_SHELL_CLIENT)
-  CreateMojoShellChannel(cmd_line, child_process_id);
-#endif
-
 #if defined(OS_ANDROID)
   // Android only supports renderer, sandboxed utility and gpu.
   std::string process_type =
@@ -523,46 +504,6 @@ void ChildProcessLauncher::Notify(
   }
 }
 
-#if defined(MOJO_SHELL_CLIENT)
-void ChildProcessLauncher::CreateMojoShellChannel(
-    base::CommandLine* command_line,
-    int child_process_id) {
-  // Some process types get created before the main message loop.
-  if (!MojoShellConnection::Get())
-    return;
-
-  // Create the channel to be shared with the target process.
-  mojo::embedder::HandlePassingInformation handle_passing_info;
-  mojo::embedder::PlatformChannelPair platform_channel_pair;
-
-  // Give one end to the shell so that it can create an instance.
-  mojo::embedder::ScopedPlatformHandle platform_channel =
-      platform_channel_pair.PassServerHandle();
-  mojo::ScopedMessagePipeHandle handle(mojo::embedder::CreateChannel(
-      platform_channel.Pass(), base::Bind(&DidCreateChannel),
-      base::ThreadTaskRunnerHandle::Get()));
-  mojo::shell::mojom::ApplicationManagerPtr application_manager;
-  MojoShellConnection::Get()->GetApplication()->ConnectToService(
-      mojo::URLRequest::From(std::string("mojo:shell")),
-      &application_manager);
-  // The content of the URL/qualifier we pass is actually meaningless, it's only
-  // important that they're unique per process.
-  // TODO(beng): We need to specify a restrictive CapabilityFilter here that
-  //             matches the needs of the target process. Figure out where that
-  //             specification is best determined (not here, this is a common
-  //             chokepoint for all process types) and how to wire it through.
-  //             http://crbug.com/555393
-  application_manager->CreateInstanceForHandle(
-      mojo::ScopedHandle(mojo::Handle(handle.release().value())),
-      "exe:chrome_renderer",  // See above about how this string is meaningless.
-      base::IntToString(child_process_id));
-
-  // Put the other end on the command line used to launch the target.
-  platform_channel_pair.PrepareToPassClientHandleToChildProcess(
-      command_line, &handle_passing_info);
-}
-#endif  // defined(MOJO_SHELL_CLIENT)
-
 bool ChildProcessLauncher::IsStarting() {
   // TODO(crbug.com/469248): This fails in some tests.
   // DCHECK(CalledOnValidThread());
diff --git a/content/browser/mojo/mojo_shell_client_host.cc b/content/browser/mojo/mojo_shell_client_host.cc
new file mode 100644
index 0000000..7c2c8ac
--- /dev/null
+++ b/content/browser/mojo/mojo_shell_client_host.cc
@@ -0,0 +1,72 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/thread_task_runner_handle.h"
+#include "content/browser/mojo/mojo_shell_client_host.h"
+#include "content/common/mojo/mojo_messages.h"
+#include "content/public/common/mojo_shell_connection.h"
+#include "ipc/ipc_sender.h"
+#include "mojo/application/public/cpp/application_impl.h"
+#include "mojo/converters/network/network_type_converters.h"
+#include "mojo/shell/application_manager.mojom.h"
+#include "third_party/mojo/src/mojo/edk/embedder/embedder.h"
+#include "third_party/mojo/src/mojo/edk/embedder/platform_channel_pair.h"
+#include "third_party/mojo/src/mojo/edk/embedder/scoped_platform_handle.h"
+
+namespace content {
+namespace {
+void DidCreateChannel(mojo::embedder::ChannelInfo* info) {}
+
+base::PlatformFile PlatformFileFromScopedPlatformHandle(
+    mojo::embedder::ScopedPlatformHandle handle) {
+#if defined(OS_POSIX)
+  return handle.release().fd;
+#elif defined(OS_WIN)
+  return handle.release().handle;
+#endif
+}
+
+}  // namespace
+
+void RegisterChildWithExternalShell(int child_process_id,
+                                    base::ProcessHandle process_handle,
+                                    IPC::Sender* sender) {
+  // Some process types get created before the main message loop.
+  if (!MojoShellConnection::Get())
+    return;
+
+  // Create the channel to be shared with the target process.
+  mojo::embedder::HandlePassingInformation handle_passing_info;
+  mojo::embedder::PlatformChannelPair platform_channel_pair;
+
+  // Give one end to the shell so that it can create an instance.
+  mojo::embedder::ScopedPlatformHandle platform_channel =
+      platform_channel_pair.PassServerHandle();
+  mojo::ScopedMessagePipeHandle handle(mojo::embedder::CreateChannel(
+      platform_channel.Pass(), base::Bind(&DidCreateChannel),
+      base::ThreadTaskRunnerHandle::Get()));
+  mojo::shell::mojom::ApplicationManagerPtr application_manager;
+  MojoShellConnection::Get()->GetApplication()->ConnectToService(
+      mojo::URLRequest::From(std::string("mojo:shell")),
+      &application_manager);
+  // The content of the URL/qualifier we pass is actually meaningless, it's only
+  // important that they're unique per process.
+  // TODO(beng): We need to specify a restrictive CapabilityFilter here that
+  //             matches the needs of the target process. Figure out where that
+  //             specification is best determined (not here, this is a common
+  //             chokepoint for all process types) and how to wire it through.
+  //             http://crbug.com/555393
+  application_manager->CreateInstanceForHandle(
+      mojo::ScopedHandle(mojo::Handle(handle.release().value())),
+      "exe:chrome_renderer",  // See above about how this string is meaningless.
+      base::IntToString(child_process_id));
+
+  // Send the other end to the child via Chrome IPC.
+  base::PlatformFile client_file = PlatformFileFromScopedPlatformHandle(
+      platform_channel_pair.PassClientHandle());
+  sender->Send(new MojoMsg_BindControllerHandle(
+      IPC::GetFileHandleForProcess(client_file, process_handle, true)));
+}
+
+}  // namespace content
diff --git a/content/browser/mojo/mojo_shell_client_host.h b/content/browser/mojo/mojo_shell_client_host.h
new file mode 100644
index 0000000..3f2b4da
--- /dev/null
+++ b/content/browser/mojo/mojo_shell_client_host.h
@@ -0,0 +1,27 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_MOJO_MOJO_SHELL_CLIENT_HOST_H_
+#define CONTENT_BROWSER_MOJO_MOJO_SHELL_CLIENT_HOST_H_
+
+#include "base/process/process_handle.h"
+
+namespace IPC {
+class Sender;
+}
+
+namespace content {
+
+// Creates a communication channel between the external Mojo shell and the
+// child. The server handle of this channel is shared with the external shell
+// via Mojo IPC and the client handle is shared with the child via Chrome IPC.
+// |child_process_id| is used to uniquify the child in the external shell's
+// instance map.
+void RegisterChildWithExternalShell(int child_process_id,
+                                    base::ProcessHandle process_handle,
+                                    IPC::Sender* sender);
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_MOJO_MOJO_SHELL_CLIENT_HOST_H_
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 75334a2..0aa3ee339 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -221,6 +221,10 @@
 #include "content/common/media/media_stream_messages.h"
 #endif
 
+#if defined(MOJO_SHELL_CLIENT)
+#include "content/browser/mojo/mojo_shell_client_host.h"
+#endif
+
 #if defined(OS_WIN)
 #define IntToStringType base::IntToString16
 #else
@@ -2450,6 +2454,12 @@ void RenderProcessHostImpl::OnProcessLaunched() {
                                          Source<RenderProcessHost>(this),
                                          NotificationService::NoDetails());
 
+#if defined(MOJO_SHELL_CLIENT)
+  // Send a handle that the external Mojo shell can use to pass an Application
+  // request to the child.
+  RegisterChildWithExternalShell(id_, GetHandle(), this);
+#endif
+
   // TODO(erikchen): Remove ScopedTracker below once http://crbug.com/465841
   // is fixed.
   tracked_objects::ScopedTracker tracking_profile4(
diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
index 02dec55..3ebac31 100644
--- a/content/child/BUILD.gn
+++ b/content/child/BUILD.gn
@@ -15,7 +15,10 @@ source_set("child") {
                         ".",
                         "//content")
 
-  configs += [ "//build/config:precompiled_headers" ]
+  configs += [
+    "//build/config:precompiled_headers",
+    "//content/public/common:mojo_shell_client",
+  ]
 
   public_deps = [
     "//third_party/mojo/src/mojo/edk/system",
diff --git a/content/child/child_thread_impl.cc b/content/child/child_thread_impl.cc
index 01cf63a..845eabd 100644
--- a/content/child/child_thread_impl.cc
+++ b/content/child/child_thread_impl.cc
@@ -73,6 +73,11 @@
 #include "ui/ozone/public/client_native_pixmap_factory.h"
 #endif
 
+#if defined(MOJO_SHELL_CLIENT)
+#include "content/common/mojo/mojo_messages.h"
+#include "content/common/mojo/mojo_shell_connection_impl.h"
+#endif
+
 using tracked_objects::ThreadData;
 
 namespace content {
@@ -654,6 +659,9 @@ bool ChildThreadImpl::OnMessageReceived(const IPC::Message& msg) {
 #if defined(USE_TCMALLOC)
     IPC_MESSAGE_HANDLER(ChildProcessMsg_GetTcmallocStats, OnGetTcmallocStats)
 #endif
+#if defined(MOJO_SHELL_CLIENT)
+    IPC_MESSAGE_HANDLER(MojoMsg_BindControllerHandle, OnBindControllerHandle)
+#endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
@@ -718,6 +726,21 @@ void ChildThreadImpl::OnGetTcmallocStats() {
 }
 #endif
 
+#if defined(MOJO_SHELL_CLIENT)
+void ChildThreadImpl::OnBindControllerHandle(
+    const IPC::PlatformFileForTransit& file) {
+#if defined(OS_POSIX)
+  base::PlatformFile handle = file.fd;
+#elif defined(OS_WIN)
+  base::PlatformFile handle = file;
+#endif
+  mojo::ScopedMessagePipeHandle message_pipe =
+      mojo_shell_channel_init_.Init(handle, GetIOTaskRunner());
+  DCHECK(message_pipe.is_valid());
+  MojoShellConnectionImpl::CreateWithMessagePipe(message_pipe.Pass());
+}
+#endif
+
 ChildThreadImpl* ChildThreadImpl::current() {
   return g_lazy_tls.Pointer()->Get();
 }
diff --git a/content/child/child_thread_impl.h b/content/child/child_thread_impl.h
index 2914b00..8d2b45c 100644
--- a/content/child/child_thread_impl.h
+++ b/content/child/child_thread_impl.h
@@ -20,6 +20,11 @@
 #include "content/public/child/child_thread.h"
 #include "ipc/ipc_message.h"  // For IPC_MESSAGE_LOG_ENABLED.
 
+#if defined(MOJO_SHELL_CLIENT)
+#include "content/common/mojo/channel_init.h"
+#include "ipc/ipc_platform_file.h"
+#endif
+
 namespace base {
 class MessageLoop;
 
@@ -235,6 +240,9 @@ class CONTENT_EXPORT ChildThreadImpl
 #if defined(USE_TCMALLOC)
   void OnGetTcmallocStats();
 #endif
+#if defined(MOJO_SHELL_CLIENT)
+  void OnBindControllerHandle(const IPC::PlatformFileForTransit& file);
+#endif
 
   void EnsureConnected();
 
@@ -297,6 +305,10 @@ class CONTENT_EXPORT ChildThreadImpl
 
   scoped_refptr<base::SequencedTaskRunner> browser_process_io_runner_;
 
+#if defined(MOJO_SHELL_CLIENT)
+  ChannelInit mojo_shell_channel_init_;
+#endif
+
   base::WeakPtrFactory<ChildThreadImpl> channel_connected_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ChildThreadImpl);
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index fbe711a..f9f4600 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -208,7 +208,7 @@ source_set("common") {
     ]
   }
 
-  defines = [ "MOJO_SHELL_CLIENT" ]
+  defines = []
   include_dirs = []
   libs = []
   ldflags = []
diff --git a/content/common/mojo/mojo_messages.h b/content/common/mojo/mojo_messages.h
index 45133d7..89c94f3 100644
--- a/content/common/mojo/mojo_messages.h
+++ b/content/common/mojo/mojo_messages.h
@@ -21,3 +21,8 @@
 // Mojo IPC is bootstrapped over Chrome IPC via this message.
 IPC_MESSAGE_CONTROL1(MojoMsg_Activate,
                      IPC::PlatformFileForTransit /* handle */)
+
+// Mojo IPC to an external shell is bootstrapped over Chrome IPC via this
+// message.
+IPC_MESSAGE_CONTROL1(MojoMsg_BindControllerHandle,
+                     IPC::PlatformFileForTransit /* handle */)
diff --git a/content/common/mojo/mojo_shell_connection_impl.cc b/content/common/mojo/mojo_shell_connection_impl.cc
index 5125df3..25c8be1 100644
--- a/content/common/mojo/mojo_shell_connection_impl.cc
+++ b/content/common/mojo/mojo_shell_connection_impl.cc
@@ -31,19 +31,26 @@ bool IsRunningInMojoShell() {
 // static
 void MojoShellConnectionImpl::Create() {
   DCHECK(IsRunningInMojoShell());
+  CreateWithMessagePipe(mojo::ScopedMessagePipeHandle());
+}
+
+// static
+void MojoShellConnectionImpl::CreateWithMessagePipe(
+    mojo::ScopedMessagePipeHandle handle) {
   DCHECK(!lazy_tls_ptr.Pointer()->Get());
   MojoShellConnectionImpl* connection = new MojoShellConnectionImpl;
   lazy_tls_ptr.Pointer()->Set(connection);
-  connection->WaitForShell();
+  connection->WaitForShell(handle.Pass());
 }
 
 MojoShellConnectionImpl::MojoShellConnectionImpl() : initialized_(false) {}
 MojoShellConnectionImpl::~MojoShellConnectionImpl() {}
 
-void MojoShellConnectionImpl::WaitForShell() {
+void MojoShellConnectionImpl::WaitForShell(
+    mojo::ScopedMessagePipeHandle handle) {
   mojo::InterfaceRequest<mojo::Application> application_request;
-  runner_connection_.reset(
-      mojo::runner::RunnerConnection::ConnectToRunner(&application_request));
+  runner_connection_.reset(mojo::runner::RunnerConnection::ConnectToRunner(
+      &application_request, handle.Pass()));
   application_impl_.reset(new mojo::ApplicationImpl(
       this, application_request.Pass()));
   application_impl_->WaitForInitialize();
diff --git a/content/common/mojo/mojo_shell_connection_impl.h b/content/common/mojo/mojo_shell_connection_impl.h
index 484e2ab7..8891acb 100644
--- a/content/common/mojo/mojo_shell_connection_impl.h
+++ b/content/common/mojo/mojo_shell_connection_impl.h
@@ -11,6 +11,7 @@
 #include "base/memory/scoped_ptr.h"
 #include "content/public/common/mojo_shell_connection.h"
 #include "mojo/application/public/cpp/application_delegate.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 
 namespace mojo {
 namespace runner {
@@ -20,8 +21,7 @@ class RunnerConnection;
 
 namespace content {
 
-// Returns true if the Chrome browser process was launched from the external
-// Mojo shell.
+// Returns true for processes launched from an external mojo shell.
 bool IsRunningInMojoShell();
 
 class MojoShellConnectionImpl : public MojoShellConnection,
@@ -32,6 +32,9 @@ class MojoShellConnectionImpl : public MojoShellConnection,
   // thread until calling GetApplication() will return an Initialized()
   // application with a bound ShellPtr.
   static void Create();
+  // Same as Create(), but receives a handle instead of looking for one on the
+  // command line.
+  static void CreateWithMessagePipe(mojo::ScopedMessagePipeHandle handle);
 
  private:
   MojoShellConnectionImpl();
@@ -50,7 +53,7 @@ class MojoShellConnectionImpl : public MojoShellConnection,
   // Blocks the calling thread until a connection to the spawning shell is
   // established, an Application request from it is bound, and the Initialize()
   // method on that application is called.
-  void WaitForShell();
+  void WaitForShell(mojo::ScopedMessagePipeHandle handle);
 
   bool initialized_;
   scoped_ptr<mojo::runner::RunnerConnection> runner_connection_;
diff --git a/content/gpu/BUILD.gn b/content/gpu/BUILD.gn
index 74c0142..ea70fe5 100644
--- a/content/gpu/BUILD.gn
+++ b/content/gpu/BUILD.gn
@@ -38,7 +38,10 @@ source_set("gpu_sources") {
     "in_process_gpu_thread.h",
   ]
 
-  configs += [ "//content:content_implementation" ]
+  configs += [
+    "//content:content_implementation",
+    "//content/public/common:mojo_shell_client",
+  ]
 
   deps = [
     "//base",
diff --git a/content/plugin/BUILD.gn b/content/plugin/BUILD.gn
index 32b6e03..096b3ce 100644
--- a/content/plugin/BUILD.gn
+++ b/content/plugin/BUILD.gn
@@ -28,7 +28,10 @@ if (enable_plugins && !is_linux) {
       "webplugin_proxy.h",
     ]
 
-    configs += [ "//content:content_implementation" ]
+    configs += [
+      "//content:content_implementation",
+      "//content/public/common:mojo_shell_client",
+    ]
 
     deps = [
       "//content:export",
diff --git a/content/ppapi_plugin/BUILD.gn b/content/ppapi_plugin/BUILD.gn
index ef4dcdf..6ce967d 100644
--- a/content/ppapi_plugin/BUILD.gn
+++ b/content/ppapi_plugin/BUILD.gn
@@ -32,7 +32,10 @@ source_set("ppapi_plugin_sources") {
     "ppapi_thread.h",
   ]
 
-  configs += [ "//content:content_implementation" ]
+  configs += [
+    "//content:content_implementation",
+    "//content/public/common:mojo_shell_client",
+  ]
 
   deps = [
     "//base",
diff --git a/content/public/browser/BUILD.gn b/content/public/browser/BUILD.gn
index 89fdec1..aaa0ae4 100644
--- a/content/public/browser/BUILD.gn
+++ b/content/public/browser/BUILD.gn
@@ -46,6 +46,7 @@ source_set("browser_sources") {
   configs += [
     "//build/config:precompiled_headers",
     "//content:content_implementation",
+    "//content/public/common:mojo_shell_client",
   ]
 
   public_deps = [
diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
index 63f5fa9..9c1e0f7 100644
--- a/content/public/common/BUILD.gn
+++ b/content/public/common/BUILD.gn
@@ -44,6 +44,15 @@ config("static_switches_defines") {
   defines = [ "COMPILE_CONTENT_STATICALLY" ]
 }
 
+# Set in GN builds, triggering behavior in content when run from an external
+# Mojo shell.
+config("mojo_shell_client") {
+  # This configuration has only been tested on these platforms.
+  if (is_win || is_linux || is_chromeos) {
+    defines = [ "MOJO_SHELL_CLIENT" ]
+  }
+}
+
 # This target allows you to use the content_switches constants and statically
 # link to it, without depending on the rest of content. This is only for use
 # without content, or you will get multiply defined symbols.
diff --git a/content/public/renderer/BUILD.gn b/content/public/renderer/BUILD.gn
index 0ab2d33..778d66f 100644
--- a/content/public/renderer/BUILD.gn
+++ b/content/public/renderer/BUILD.gn
@@ -25,7 +25,10 @@ source_set("renderer_sources") {
                         ".",
                         "//content")
 
-  configs += [ "//content:content_implementation" ]
+  configs += [
+    "//content:content_implementation",
+    "//content/public/common:mojo_shell_client",
+  ]
 
   deps = [
     "//content/public/common:common_sources",
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index 42da81ac..d105612 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -18,6 +18,7 @@ source_set("renderer") {
 
   configs += [
     "//content:content_implementation",
+    "//content/public/common:mojo_shell_client",
     "//build/config/compiler:no_size_t_to_int_warning",
   ]
 
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index c9f5fa0..c6d764c 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -349,6 +349,7 @@ test("content_browsertests") {
   configs += [
     "//build/config:precompiled_headers",
     "//build/config/compiler:no_size_t_to_int_warning",
+    "//content/public/common:mojo_shell_client",
   ]
 
   deps = [
@@ -549,7 +550,10 @@ test("content_unittests") {
     }
   }
 
-  configs += [ "//build/config:precompiled_headers" ]
+  configs += [
+    "//build/config:precompiled_headers",
+    "//content/public/common:mojo_shell_client",
+  ]
 
   deps = [
     ":test_support",
diff --git a/content/utility/BUILD.gn b/content/utility/BUILD.gn
index 65012ac..9bfe941 100644
--- a/content/utility/BUILD.gn
+++ b/content/utility/BUILD.gn
@@ -13,7 +13,10 @@ source_set("utility") {
   sources =
       rebase_path(content_utility_gypi_values.utility_sources, ".", "//content")
 
-  configs += [ "//content:content_implementation" ]
+  configs += [
+    "//content:content_implementation",
+    "//content/public/common:mojo_shell_client",
+  ]
 
   deps = [
     "//base",
diff --git a/mojo/runner/child/runner_connection.cc b/mojo/runner/child/runner_connection.cc
index c7758c4..ca0c7fc 100644
--- a/mojo/runner/child/runner_connection.cc
+++ b/mojo/runner/child/runner_connection.cc
@@ -23,6 +23,8 @@ namespace mojo {
 namespace runner {
 namespace {
 
+void DidCreateChannel(embedder::ChannelInfo* channel_info) {}
+
 // Blocks a thread until another thread unblocks it, at which point it unblocks
 // and runs a closure provided by that thread.
 class Blocker {
@@ -89,7 +91,8 @@ class RunnerConnectionImpl : public RunnerConnection {
 
   // Returns true if a connection to the runner has been established and
   // |request| has been modified, false if no connection was established.
-  bool WaitForApplicationRequest(InterfaceRequest<Application>* request);
+  bool WaitForApplicationRequest(InterfaceRequest<Application>* request,
+                                 ScopedMessagePipeHandle handle);
 
   ChildControllerImpl* controller() const { return controller_.get(); }
 
@@ -133,23 +136,15 @@ class ChildControllerImpl : public ChildController {
   // etc.
   static void Create(RunnerConnectionImpl* connection,
                      const GotApplicationRequestCallback& callback,
-                     embedder::ScopedPlatformHandle platform_channel,
+                     ScopedMessagePipeHandle runner_handle,
                      const Blocker::Unblocker& unblocker) {
     DCHECK(connection);
-    DCHECK(platform_channel.is_valid());
-
     DCHECK(!connection->controller());
 
     scoped_ptr<ChildControllerImpl> impl(
         new ChildControllerImpl(connection, callback, unblocker));
 
-    ScopedMessagePipeHandle host_message_pipe(embedder::CreateChannel(
-        platform_channel.Pass(),
-        base::Bind(&ChildControllerImpl::DidCreateChannel,
-                   base::Unretained(impl.get())),
-        base::ThreadTaskRunnerHandle::Get()));
-
-    impl->Bind(host_message_pipe.Pass());
+    impl->Bind(runner_handle.Pass());
 
     connection->set_controller(impl.Pass());
   }
@@ -191,13 +186,6 @@ class ChildControllerImpl : public ChildController {
     binding_.set_connection_error_handler([this]() { OnConnectionError(); });
   }
 
-  // Callback for |embedder::CreateChannel()|.
-  void DidCreateChannel(embedder::ChannelInfo* channel_info) {
-    DVLOG(2) << "ChildControllerImpl::DidCreateChannel()";
-    DCHECK(thread_checker_.CalledOnValidThread());
-    channel_info_ = channel_info;
-  }
-
   static void ReturnApplicationRequestOnMainThread(
       const GotApplicationRequestCallback& callback,
       InterfaceRequest<Application> application_request) {
@@ -217,12 +205,20 @@ class ChildControllerImpl : public ChildController {
 };
 
 bool RunnerConnectionImpl::WaitForApplicationRequest(
-    InterfaceRequest<Application>* request) {
-  embedder::ScopedPlatformHandle platform_channel =
-      embedder::PlatformChannelPair::PassClientHandleFromParentProcess(
-          *base::CommandLine::ForCurrentProcess());
-  if (!platform_channel.is_valid())
-    return false;
+    InterfaceRequest<Application>* request,
+    ScopedMessagePipeHandle handle) {
+  // If a valid message pipe to the runner was not provided, look for one on the
+  // command line.
+  if (!handle.is_valid()) {
+    embedder::ScopedPlatformHandle platform_channel =
+        embedder::PlatformChannelPair::PassClientHandleFromParentProcess(
+            *base::CommandLine::ForCurrentProcess());
+    if (!platform_channel.is_valid())
+      return false;
+    handle = embedder::CreateChannel(platform_channel.Pass(),
+                                     base::Bind(&DidCreateChannel),
+                                     base::ThreadTaskRunnerHandle::Get());
+  }
 
   Blocker blocker;
   controller_runner_->PostTask(
@@ -230,7 +226,7 @@ bool RunnerConnectionImpl::WaitForApplicationRequest(
       base::Bind(
           &ChildControllerImpl::Create, base::Unretained(this),
           base::Bind(&OnGotApplicationRequest, base::Unretained(request)),
-          base::Passed(&platform_channel), blocker.GetUnblocker()));
+          base::Passed(&handle), blocker.GetUnblocker()));
   blocker.Block();
 
   return true;
@@ -242,9 +238,10 @@ RunnerConnection::~RunnerConnection() {}
 
 // static
 RunnerConnection* RunnerConnection::ConnectToRunner(
-    InterfaceRequest<Application>* request) {
+    InterfaceRequest<Application>* request,
+    ScopedMessagePipeHandle handle) {
   RunnerConnectionImpl* connection = new RunnerConnectionImpl;
-  if (!connection->WaitForApplicationRequest(request)) {
+  if (!connection->WaitForApplicationRequest(request, handle.Pass())) {
     delete connection;
     return nullptr;
   }
diff --git a/mojo/runner/child/runner_connection.h b/mojo/runner/child/runner_connection.h
index 8ca8778..68202e1 100644
--- a/mojo/runner/child/runner_connection.h
+++ b/mojo/runner/child/runner_connection.h
@@ -24,7 +24,8 @@ class RunnerConnection {
   // If a connection to the runner cannot be established, |request| will not be
   // modified and this function will return null.
   static RunnerConnection* ConnectToRunner(
-      InterfaceRequest<Application>* request);
+      InterfaceRequest<Application>* request,
+      ScopedMessagePipeHandle handle);
 
  protected:
   RunnerConnection();
diff --git a/mojo/runner/child/test_native_main.cc b/mojo/runner/child/test_native_main.cc
index c9bf253..a7e57b4 100644
--- a/mojo/runner/child/test_native_main.cc
+++ b/mojo/runner/child/test_native_main.cc
@@ -56,19 +56,17 @@ int TestNativeMain(mojo::ApplicationDelegate* application_delegate) {
         mojo::embedder::ProcessType::NONE, &process_delegate,
         io_thread.task_runner().get(), mojo::embedder::ScopedPlatformHandle());
 
+    base::MessageLoop loop(mojo::common::MessagePumpMojo::Create());
     mojo::InterfaceRequest<mojo::Application> application_request;
     scoped_ptr<mojo::runner::RunnerConnection> connection(
-        mojo::runner::RunnerConnection::ConnectToRunner(&application_request));
-
-    base::MessageLoop loop(mojo::common::MessagePumpMojo::Create());
+        mojo::runner::RunnerConnection::ConnectToRunner(
+            &application_request, ScopedMessagePipeHandle()));
     {
       mojo::ApplicationImpl impl(application_delegate,
                                  application_request.Pass());
       loop.Run();
     }
 
-    connection.reset();
-
     mojo::embedder::ShutdownIPCSupport();
   }