ipc: Use a global for the process's attachment broker.

This eliminates the need for a lot of plumbing, at the expense of yet another
global.

BUG=493414

Review URL: https://codereview.chromium.org/1292263003

Cr-Commit-Position: refs/heads/master@{#348649}

38 files changed, 138 insertions, 181 deletions

diff --git a/content/browser/gpu/browser_gpu_channel_host_factory.cc b/content/browser/gpu/browser_gpu_channel_host_factory.cc
index 5032d2c..3dda551 100644
--- a/content/browser/gpu/browser_gpu_channel_host_factory.cc
+++ b/content/browser/gpu/browser_gpu_channel_host_factory.cc
@@ -308,10 +308,6 @@ void BrowserGpuChannelHostFactory::CreateViewCommandBufferOnIO(
                  request));
 }
 
-IPC::AttachmentBroker* BrowserGpuChannelHostFactory::GetAttachmentBroker() {
-  return content::ChildProcessHost::GetAttachmentBroker();
-}
-
 // static
 void BrowserGpuChannelHostFactory::CommandBufferCreatedOnIO(
     CreateRequest* request, CreateCommandBufferResult result) {
diff --git a/content/browser/gpu/browser_gpu_channel_host_factory.h b/content/browser/gpu/browser_gpu_channel_host_factory.h
index d68911c..c0bcedc 100644
--- a/content/browser/gpu/browser_gpu_channel_host_factory.h
+++ b/content/browser/gpu/browser_gpu_channel_host_factory.h
@@ -31,7 +31,6 @@ class CONTENT_EXPORT BrowserGpuChannelHostFactory
       int32 surface_id,
       const GPUCreateCommandBufferConfig& init_params,
       int32 route_id) override;
-  IPC::AttachmentBroker* GetAttachmentBroker() override;
 
   int GpuProcessHostId() { return gpu_host_id_; }
 #if !defined(OS_ANDROID)
diff --git a/content/browser/plugin_data_remover_impl.cc b/content/browser/plugin_data_remover_impl.cc
index e192327..d0cb9ac 100644
--- a/content/browser/plugin_data_remover_impl.cc
+++ b/content/browser/plugin_data_remover_impl.cc
@@ -227,8 +227,7 @@ class PluginDataRemoverImpl::Context
       return;
 
     DCHECK(!channel_.get());
-    channel_ = IPC::Channel::CreateClient(
-        handle, this, content::ChildProcessHost::GetAttachmentBroker());
+    channel_ = IPC::Channel::CreateClient(handle, this);
     if (!channel_->Connect()) {
       NOTREACHED() << "Couldn't connect to plugin";
       SignalDone();
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 7ac8881..2d9a2b0 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -737,14 +737,12 @@ scoped_ptr<IPC::ChannelProxy> RenderProcessHostImpl::CreateChannelProxy(
 
     return IPC::ChannelProxy::Create(
         IPC::ChannelMojo::CreateServerFactory(
-            mojo_task_runner, channel_id,
-            content::ChildProcessHost::GetAttachmentBroker()),
+            mojo_task_runner, channel_id),
         this, runner.get());
   }
 
   return IPC::ChannelProxy::Create(
-      channel_id, IPC::Channel::MODE_SERVER, this, runner.get(),
-      content::ChildProcessHost::GetAttachmentBroker());
+      channel_id, IPC::Channel::MODE_SERVER, this, runner.get());
 }
 
 void RenderProcessHostImpl::CreateMessageFilters() {
diff --git a/content/child/child_thread_impl.cc b/content/child/child_thread_impl.cc
index 08c2075..bfb1f3a 100644
--- a/content/child/child_thread_impl.cc
+++ b/content/child/child_thread_impl.cc
@@ -357,15 +357,14 @@ void ChildThreadImpl::ConnectChannel(bool use_mojo_channel) {
     VLOG(1) << "Mojo is enabled on child";
     scoped_refptr<base::SequencedTaskRunner> io_task_runner = GetIOTaskRunner();
     DCHECK(io_task_runner);
-    channel_->Init(IPC::ChannelMojo::CreateClientFactory(
-                       io_task_runner, channel_name_, attachment_broker_.get()),
-                   create_pipe_now);
+    channel_->Init(
+        IPC::ChannelMojo::CreateClientFactory(io_task_runner, channel_name_),
+        create_pipe_now);
     return;
   }
 
   VLOG(1) << "Mojo is disabled on child";
-  channel_->Init(channel_name_, IPC::Channel::MODE_CLIENT, create_pipe_now,
-                 attachment_broker_.get());
+  channel_->Init(channel_name_, IPC::Channel::MODE_CLIENT, create_pipe_now);
 }
 
 void ChildThreadImpl::Init(const Options& options) {
@@ -380,6 +379,16 @@ void ChildThreadImpl::Init(const Options& options) {
   // the logger, and the logger does not like being created on the IO thread.
   IPC::Logging::GetInstance();
 #endif
+
+#if defined(OS_WIN)
+  // The only reason a global would already exist is if the thread is being run
+  // in the browser process because of a command line switch.
+  if (!IPC::AttachmentBroker::GetGlobal()) {
+    attachment_broker_.reset(new IPC::AttachmentBrokerUnprivilegedWin());
+    IPC::AttachmentBroker::SetGlobal(attachment_broker_.get());
+  }
+#endif
+
   channel_ =
       IPC::SyncChannel::Create(this, ChildProcess::current()->io_task_runner(),
                                ChildProcess::current()->GetShutDownEvent());
@@ -388,10 +397,6 @@ void ChildThreadImpl::Init(const Options& options) {
     IPC::Logging::GetInstance()->SetIPCSender(this);
 #endif
 
-#if defined(OS_WIN)
-  attachment_broker_.reset(new IPC::AttachmentBrokerUnprivilegedWin());
-#endif
-
   mojo_application_.reset(new MojoApplication(GetIOTaskRunner()));
 
   sync_message_filter_ = channel_->CreateSyncMessageFilter();
@@ -565,10 +570,6 @@ void ChildThreadImpl::ReleaseCachedFonts() {
 }
 #endif
 
-IPC::AttachmentBroker* ChildThreadImpl::GetAttachmentBroker() {
-  return attachment_broker_.get();
-}
-
 MessageRouter* ChildThreadImpl::GetRouter() {
   DCHECK(base::MessageLoop::current() == message_loop());
   return &router_;
diff --git a/content/child/child_thread_impl.h b/content/child/child_thread_impl.h
index 286c69a..3e644ab 100644
--- a/content/child/child_thread_impl.h
+++ b/content/child/child_thread_impl.h
@@ -87,7 +87,6 @@ class CONTENT_EXPORT ChildThreadImpl
   void PreCacheFont(const LOGFONT& log_font) override;
   void ReleaseCachedFonts() override;
 #endif
-  IPC::AttachmentBroker* GetAttachmentBroker() override;
 
   IPC::SyncChannel* channel() { return channel_.get(); }
 
diff --git a/content/child/npapi/np_channel_base.cc b/content/child/npapi/np_channel_base.cc
index 341a3da..c227c88 100644
--- a/content/child/npapi/np_channel_base.cc
+++ b/content/child/npapi/np_channel_base.cc
@@ -68,8 +68,7 @@ NPChannelBase* NPChannelBase::GetChannel(
     ChannelFactory factory,
     base::SingleThreadTaskRunner* ipc_task_runner,
     bool create_pipe_now,
-    base::WaitableEvent* shutdown_event,
-    IPC::AttachmentBroker* broker) {
+    base::WaitableEvent* shutdown_event) {
 #if defined(OS_POSIX)
   // On POSIX the channel_handle conveys an FD (socket) which is duped by the
   // kernel during the IPC message exchange (via the SCM_RIGHTS mechanism).
@@ -99,8 +98,7 @@ NPChannelBase* NPChannelBase::GetChannel(
           IPC::Channel::GenerateVerifiedChannelID(channel_key);
     }
     channel->mode_ = mode;
-    if (channel->Init(ipc_task_runner, create_pipe_now, shutdown_event,
-                      broker)) {
+    if (channel->Init(ipc_task_runner, create_pipe_now, shutdown_event)) {
       (*GetChannelMap())[channel_key] = channel;
     } else {
       channel = NULL;
@@ -176,8 +174,7 @@ base::WaitableEvent* NPChannelBase::GetModalDialogEvent(int render_view_id) {
 
 bool NPChannelBase::Init(base::SingleThreadTaskRunner* ipc_task_runner,
                          bool create_pipe_now,
-                         base::WaitableEvent* shutdown_event,
-                         IPC::AttachmentBroker* broker) {
+                         base::WaitableEvent* shutdown_event) {
 #if defined(OS_POSIX)
   // Attempting to initialize with an invalid channel handle.
   // See http://crbug.com/97285 for details.
@@ -187,7 +184,7 @@ bool NPChannelBase::Init(base::SingleThreadTaskRunner* ipc_task_runner,
 
   channel_ =
       IPC::SyncChannel::Create(channel_handle_, mode_, this, ipc_task_runner,
-                               create_pipe_now, shutdown_event, broker);
+                               create_pipe_now, shutdown_event);
 
 #if defined(OS_POSIX)
   // Check the validity of fd for bug investigation.  Remove after fixed.
diff --git a/content/child/npapi/np_channel_base.h b/content/child/npapi/np_channel_base.h
index c05dc38..3a8c9e3 100644
--- a/content/child/npapi/np_channel_base.h
+++ b/content/child/npapi/np_channel_base.h
@@ -21,10 +21,6 @@ namespace base {
 class SingleThreadTaskRunner;
 }
 
-namespace IPC {
-class AttachmentBroker;
-}
-
 namespace content {
 
 // Encapsulates an IPC channel between a renderer and another process. Used to
@@ -109,8 +105,7 @@ class NPChannelBase : public IPC::Listener,
       ChannelFactory factory,
       base::SingleThreadTaskRunner* ipc_task_runner,
       bool create_pipe_now,
-      base::WaitableEvent* shutdown_event,
-      IPC::AttachmentBroker* broker);
+      base::WaitableEvent* shutdown_event);
 
   // Sends a message to all instances.
   static void Broadcast(IPC::Message* message);
@@ -134,8 +129,7 @@ class NPChannelBase : public IPC::Listener,
 
   virtual bool Init(base::SingleThreadTaskRunner* ipc_task_runner,
                     bool create_pipe_now,
-                    base::WaitableEvent* shutdown_event,
-                    IPC::AttachmentBroker* broker);
+                    base::WaitableEvent* shutdown_event);
 
   scoped_ptr<IPC::SyncChannel> channel_;
   IPC::ChannelHandle channel_handle_;
diff --git a/content/common/child_process_host_impl.cc b/content/common/child_process_host_impl.cc
index a35bea6..071d96d 100644
--- a/content/common/child_process_host_impl.cc
+++ b/content/common/child_process_host_impl.cc
@@ -18,6 +18,7 @@
 #include "base/process/process_metrics.h"
 #include "base/rand_util.h"
 #include "base/strings/stringprintf.h"
+#include "base/synchronization/lock.h"
 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
 #include "content/common/child_process_messages.h"
 #include "content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.h"
@@ -35,13 +36,34 @@
 #include "ipc/attachment_broker_privileged_win.h"
 #endif  // OS_LINUX
 
-#if defined(OS_WIN)
-base::LazyInstance<IPC::AttachmentBrokerPrivilegedWin>::Leaky
-    g_attachment_broker = LAZY_INSTANCE_INITIALIZER;
-#endif  // defined(OS_WIN)
-
 namespace {
 
+#if USE_ATTACHMENT_BROKER
+// This class is wrapped in a singleton to ensure that its constructor is only
+// called once. The constructor creates an attachment broker and
+// sets it as the global broker.
+class AttachmentBrokerWrapper {
+ public:
+  AttachmentBrokerWrapper() {
+    IPC::AttachmentBroker::SetGlobal(&attachment_broker_);
+  }
+
+  IPC::AttachmentBrokerPrivileged* GetAttachmentBroker() {
+    return &attachment_broker_;
+  }
+
+ private:
+  IPC::AttachmentBrokerPrivilegedWin attachment_broker_;
+};
+
+base::LazyInstance<AttachmentBrokerWrapper>::Leaky
+    g_attachment_broker_wrapper = LAZY_INSTANCE_INITIALIZER;
+
+IPC::AttachmentBrokerPrivileged* GetAttachmentBroker() {
+  return g_attachment_broker_wrapper.Get().GetAttachmentBroker();
+}
+#endif  // USE_ATTACHMENT_BROKER
+
 // Global atomic to generate child process unique IDs.
 base::StaticAtomicSequenceNumber g_unique_id;
 
@@ -83,15 +105,6 @@ base::FilePath ChildProcessHost::GetChildPath(int flags) {
   return child_path;
 }
 
-// static
-IPC::AttachmentBrokerPrivileged* ChildProcessHost::GetAttachmentBroker() {
-#if USE_ATTACHMENT_BROKER
-  return &g_attachment_broker.Get();
-#else
-  return nullptr;
-#endif  // USE_ATTACHMENT_BROKER
-}
-
 ChildProcessHostImpl::ChildProcessHostImpl(ChildProcessHostDelegate* delegate)
     : delegate_(delegate),
       opening_channel_(false) {
@@ -102,7 +115,7 @@ ChildProcessHostImpl::ChildProcessHostImpl(ChildProcessHostDelegate* delegate)
 
 ChildProcessHostImpl::~ChildProcessHostImpl() {
 #if USE_ATTACHMENT_BROKER
-  g_attachment_broker.Get().DeregisterCommunicationChannel(channel_.get());
+  GetAttachmentBroker()->DeregisterCommunicationChannel(channel_.get());
 #endif
   for (size_t i = 0; i < filters_.size(); ++i) {
     filters_[i]->OnChannelClosing();
@@ -123,12 +136,11 @@ void ChildProcessHostImpl::ForceShutdown() {
 
 std::string ChildProcessHostImpl::CreateChannel() {
   channel_id_ = IPC::Channel::GenerateVerifiedChannelID(std::string());
-  channel_ =
-      IPC::Channel::CreateServer(channel_id_, this, GetAttachmentBroker());
+  channel_ = IPC::Channel::CreateServer(channel_id_, this);
   if (!channel_->Connect())
     return std::string();
 #if USE_ATTACHMENT_BROKER
-  g_attachment_broker.Get().RegisterCommunicationChannel(channel_.get());
+  GetAttachmentBroker()->RegisterCommunicationChannel(channel_.get());
 #endif
 
   for (size_t i = 0; i < filters_.size(); ++i)
diff --git a/content/common/gpu/client/gpu_channel_host.cc b/content/common/gpu/client/gpu_channel_host.cc
index 8c68528..6b1706c 100644
--- a/content/common/gpu/client/gpu_channel_host.cc
+++ b/content/common/gpu/client/gpu_channel_host.cc
@@ -79,9 +79,9 @@ void GpuChannelHost::Connect(const IPC::ChannelHandle& channel_handle,
   // since we need to filter everything to route it to the right thread.
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner =
       factory_->GetIOThreadTaskRunner();
-  channel_ = IPC::SyncChannel::Create(
-      channel_handle, IPC::Channel::MODE_CLIENT, NULL, io_task_runner.get(),
-      true, shutdown_event, factory_->GetAttachmentBroker());
+  channel_ =
+      IPC::SyncChannel::Create(channel_handle, IPC::Channel::MODE_CLIENT, NULL,
+                               io_task_runner.get(), true, shutdown_event);
 
   sync_filter_ = channel_->CreateSyncMessageFilter();
 
diff --git a/content/common/gpu/client/gpu_channel_host.h b/content/common/gpu/client/gpu_channel_host.h
index dd55374..46dd934 100644
--- a/content/common/gpu/client/gpu_channel_host.h
+++ b/content/common/gpu/client/gpu_channel_host.h
@@ -21,7 +21,6 @@
 #include "content/common/gpu/gpu_stream_priority.h"
 #include "content/common/message_router.h"
 #include "gpu/config/gpu_info.h"
-#include "ipc/attachment_broker.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_sync_channel.h"
 #include "ipc/message_filter.h"
@@ -59,8 +58,7 @@ namespace content {
 class CommandBufferProxyImpl;
 class GpuChannelHost;
 
-class CONTENT_EXPORT GpuChannelHostFactory
-    : virtual public IPC::SupportsAttachmentBrokering {
+class CONTENT_EXPORT GpuChannelHostFactory {
  public:
   virtual ~GpuChannelHostFactory() {}
 
diff --git a/content/common/gpu/gpu_channel.cc b/content/common/gpu/gpu_channel.cc
index c16db44..7ebd553 100644
--- a/content/common/gpu/gpu_channel.cc
+++ b/content/common/gpu/gpu_channel.cc
@@ -648,16 +648,15 @@ GpuChannel::~GpuChannel() {
     preempting_flag_->Reset();
 }
 
-IPC::ChannelHandle GpuChannel::Init(base::WaitableEvent* shutdown_event,
-                                    IPC::AttachmentBroker* attachment_broker) {
+IPC::ChannelHandle GpuChannel::Init(base::WaitableEvent* shutdown_event) {
   DCHECK(shutdown_event);
   DCHECK(!channel_);
 
   IPC::ChannelHandle channel_handle(channel_id_);
 
-  channel_ = IPC::SyncChannel::Create(channel_handle, IPC::Channel::MODE_SERVER,
-                                      this, io_task_runner_, false,
-                                      shutdown_event, attachment_broker);
+  channel_ =
+      IPC::SyncChannel::Create(channel_handle, IPC::Channel::MODE_SERVER, this,
+                               io_task_runner_, false, shutdown_event);
 
 #if defined(OS_POSIX)
   // On POSIX, pass the renderer-side FD. Also mark it as auto-close so
diff --git a/content/common/gpu/gpu_channel.h b/content/common/gpu/gpu_channel.h
index d51a98b..a9300c6 100644
--- a/content/common/gpu/gpu_channel.h
+++ b/content/common/gpu/gpu_channel.h
@@ -45,7 +45,6 @@ class SubscriptionRefSet;
 }
 
 namespace IPC {
-class AttachmentBroker;
 class MessageFilter;
 }
 
@@ -79,8 +78,7 @@ class CONTENT_EXPORT GpuChannel
 
   // Initializes the IPC channel. Caller takes ownership of the client FD in
   // the returned handle and is responsible for closing it.
-  virtual IPC::ChannelHandle Init(base::WaitableEvent* shutdown_event,
-                                  IPC::AttachmentBroker* attachment_broker);
+  virtual IPC::ChannelHandle Init(base::WaitableEvent* shutdown_event);
 
   // Get the GpuChannelManager that owns this channel.
   GpuChannelManager* gpu_channel_manager() const {
diff --git a/content/common/gpu/gpu_channel_manager.cc b/content/common/gpu/gpu_channel_manager.cc
index 0359393..df99ccd 100644
--- a/content/common/gpu/gpu_channel_manager.cc
+++ b/content/common/gpu/gpu_channel_manager.cc
@@ -35,7 +35,6 @@ GpuChannelManager::GpuChannelManager(
     base::SingleThreadTaskRunner* task_runner,
     base::SingleThreadTaskRunner* io_task_runner,
     base::WaitableEvent* shutdown_event,
-    IPC::AttachmentBroker* broker,
     gpu::SyncPointManager* sync_point_manager,
     GpuMemoryBufferFactory* gpu_memory_buffer_factory)
     : task_runner_(task_runner),
@@ -48,7 +47,6 @@ GpuChannelManager::GpuChannelManager(
           GpuMemoryManager::kDefaultMaxSurfacesWithFrontbufferSoftLimit),
       sync_point_manager_(sync_point_manager),
       gpu_memory_buffer_factory_(gpu_memory_buffer_factory),
-      attachment_broker_(broker),
       weak_factory_(this) {
   DCHECK(task_runner);
   DCHECK(io_task_runner);
@@ -171,8 +169,7 @@ void GpuChannelManager::OnEstablishChannel(int client_id,
   scoped_ptr<GpuChannel> channel = CreateGpuChannel(
       share_group, mailbox_manager, client_id, client_tracing_id,
       allow_future_sync_points, allow_real_time_streams);
-  IPC::ChannelHandle channel_handle =
-      channel->Init(shutdown_event_, attachment_broker_);
+  IPC::ChannelHandle channel_handle = channel->Init(shutdown_event_);
 
   gpu_channels_.set(client_id, channel.Pass());
 
diff --git a/content/common/gpu/gpu_channel_manager.h b/content/common/gpu/gpu_channel_manager.h
index 4de851ab..6359437 100644
--- a/content/common/gpu/gpu_channel_manager.h
+++ b/content/common/gpu/gpu_channel_manager.h
@@ -44,7 +44,6 @@ class ShaderTranslatorCache;
 }
 
 namespace IPC {
-class AttachmentBroker;
 struct ChannelHandle;
 class SyncChannel;
 }
@@ -62,13 +61,11 @@ class GpuWatchdog;
 class CONTENT_EXPORT GpuChannelManager : public IPC::Listener,
                           public IPC::Sender {
  public:
-  // |broker| must outlive GpuChannelManager and any channels it creates.
   GpuChannelManager(IPC::SyncChannel* channel,
                     GpuWatchdog* watchdog,
                     base::SingleThreadTaskRunner* task_runner,
                     base::SingleThreadTaskRunner* io_task_runner,
                     base::WaitableEvent* shutdown_event,
-                    IPC::AttachmentBroker* broker,
                     gpu::SyncPointManager* sync_point_manager,
                     GpuMemoryBufferFactory* gpu_memory_buffer_factory);
   ~GpuChannelManager() override;
@@ -174,8 +171,6 @@ class CONTENT_EXPORT GpuChannelManager : public IPC::Listener,
       framebuffer_completeness_cache_;
   scoped_refptr<gfx::GLSurface> default_offscreen_surface_;
   GpuMemoryBufferFactory* const gpu_memory_buffer_factory_;
-  // Must outlive this instance of GpuChannelManager.
-  IPC::AttachmentBroker* attachment_broker_;
 
   // Member variables should appear before the WeakPtrFactory, to ensure
   // that any WeakPtrs to Controller are invalidated before its members
diff --git a/content/common/gpu/gpu_channel_test_common.cc b/content/common/gpu/gpu_channel_test_common.cc
index d7433ff..5925a54 100644
--- a/content/common/gpu/gpu_channel_test_common.cc
+++ b/content/common/gpu/gpu_channel_test_common.cc
@@ -22,7 +22,6 @@ TestGpuChannelManager::TestGpuChannelManager(
                         task_runner,
                         io_task_runner,
                         nullptr,
-                        nullptr,
                         sync_point_manager,
                         gpu_memory_buffer_factory),
       sink_(sink) {}
@@ -83,9 +82,7 @@ base::ProcessId TestGpuChannel::GetClientPID() const {
   return base::kNullProcessId;
 }
 
-IPC::ChannelHandle TestGpuChannel::Init(
-    base::WaitableEvent* shutdown_event,
-    IPC::AttachmentBroker* attachment_broker) {
+IPC::ChannelHandle TestGpuChannel::Init(base::WaitableEvent* shutdown_event) {
   filter_->OnFilterAdded(sink_);
   return IPC::ChannelHandle(channel_id());
 }
diff --git a/content/common/gpu/gpu_channel_test_common.h b/content/common/gpu/gpu_channel_test_common.h
index 1230933..be4109b 100644
--- a/content/common/gpu/gpu_channel_test_common.h
+++ b/content/common/gpu/gpu_channel_test_common.h
@@ -60,8 +60,7 @@ class TestGpuChannel : public GpuChannel {
 
   base::ProcessId GetClientPID() const override;
 
-  IPC::ChannelHandle Init(base::WaitableEvent* shutdown_event,
-                          IPC::AttachmentBroker* attachment_broker) override;
+  IPC::ChannelHandle Init(base::WaitableEvent* shutdown_event) override;
 
   // IPC::Sender implementation.
   bool Send(IPC::Message* msg) override;
diff --git a/content/gpu/gpu_child_thread.cc b/content/gpu/gpu_child_thread.cc
index 7cb56a7..c6c1e31 100644
--- a/content/gpu/gpu_child_thread.cc
+++ b/content/gpu/gpu_child_thread.cc
@@ -261,7 +261,7 @@ void GpuChildThread::OnInitialize() {
       channel(), watchdog_thread_.get(),
       base::ThreadTaskRunnerHandle::Get().get(),
       ChildProcess::current()->io_task_runner(),
-      ChildProcess::current()->GetShutDownEvent(), GetAttachmentBroker(),
+      ChildProcess::current()->GetShutDownEvent(),
       sync_point_manager_, gpu_memory_buffer_factory_));
 
 #if defined(USE_OZONE)
diff --git a/content/plugin/plugin_channel.cc b/content/plugin/plugin_channel.cc
index c37eb0c..90993e9 100644
--- a/content/plugin/plugin_channel.cc
+++ b/content/plugin/plugin_channel.cc
@@ -141,8 +141,7 @@ class PluginChannel::MessageFilter : public IPC::MessageFilter {
 
 PluginChannel* PluginChannel::GetPluginChannel(
     int renderer_id,
-    base::SingleThreadTaskRunner* ipc_task_runner,
-    IPC::AttachmentBroker* broker) {
+    base::SingleThreadTaskRunner* ipc_task_runner) {
   // Map renderer ID to a (single) channel to that process.
   std::string channel_key = base::StringPrintf(
       "%d.r%d", base::GetCurrentProcId(), renderer_id);
@@ -150,7 +149,7 @@ PluginChannel* PluginChannel::GetPluginChannel(
   PluginChannel* channel =
       static_cast<PluginChannel*>(NPChannelBase::GetChannel(
           channel_key, IPC::Channel::MODE_SERVER, ClassFactory, ipc_task_runner,
-          false, ChildProcess::current()->GetShutDownEvent(), broker));
+          false, ChildProcess::current()->GetShutDownEvent()));
 
   if (channel)
     channel->renderer_id_ = renderer_id;
@@ -226,12 +225,9 @@ void PluginChannel::CleanUp() {
 
 bool PluginChannel::Init(base::SingleThreadTaskRunner* ipc_task_runner,
                          bool create_pipe_now,
-                         base::WaitableEvent* shutdown_event,
-                         IPC::AttachmentBroker* broker) {
-  if (!NPChannelBase::Init(ipc_task_runner, create_pipe_now, shutdown_event,
-                           broker)) {
+                         base::WaitableEvent* shutdown_event) {
+  if (!NPChannelBase::Init(ipc_task_runner, create_pipe_now, shutdown_event))
     return false;
-  }
 
   channel_->AddFilter(filter_.get());
   return true;
diff --git a/content/plugin/plugin_channel.h b/content/plugin/plugin_channel.h
index 94ae639..c97b1f1 100644
--- a/content/plugin/plugin_channel.h
+++ b/content/plugin/plugin_channel.h
@@ -28,8 +28,7 @@ class PluginChannel : public NPChannelBase {
   // by the browser.
   static PluginChannel* GetPluginChannel(
       int renderer_id,
-      base::SingleThreadTaskRunner* ipc_task_runner,
-      IPC::AttachmentBroker* broker);
+      base::SingleThreadTaskRunner* ipc_task_runner);
 
   // Send a message to all renderers that the process is going to shutdown.
   static void NotifyRenderersOfPendingShutdown();
@@ -65,8 +64,7 @@ class PluginChannel : public NPChannelBase {
   void CleanUp() override;
   bool Init(base::SingleThreadTaskRunner* ipc_task_runner,
             bool create_pipe_now,
-            base::WaitableEvent* shutdown_event,
-            IPC::AttachmentBroker* broker) override;
+            base::WaitableEvent* shutdown_event) override;
 
  private:
   class MessageFilter;
diff --git a/content/plugin/plugin_thread.cc b/content/plugin/plugin_thread.cc
index d2ae61f..7625109 100644
--- a/content/plugin/plugin_thread.cc
+++ b/content/plugin/plugin_thread.cc
@@ -138,8 +138,7 @@ bool PluginThread::OnControlMessageReceived(const IPC::Message& msg) {
 void PluginThread::OnCreateChannel(int renderer_id,
                                    bool incognito) {
   scoped_refptr<PluginChannel> channel(PluginChannel::GetPluginChannel(
-      renderer_id, ChildProcess::current()->io_task_runner(),
-      GetAttachmentBroker()));
+      renderer_id, ChildProcess::current()->io_task_runner()));
   IPC::ChannelHandle channel_handle;
   if (channel.get()) {
     channel_handle.name = channel->channel_handle().name;
diff --git a/content/public/child/child_thread.h b/content/public/child/child_thread.h
index 04d8527..4a29667 100644
--- a/content/public/child/child_thread.h
+++ b/content/public/child/child_thread.h
@@ -6,7 +6,6 @@
 #define CONTENT_PUBLIC_CHILD_CHILD_THREAD_H_
 
 #include "content/common/content_export.h"
-#include "ipc/attachment_broker.h"
 #include "ipc/ipc_sender.h"
 
 #if defined(OS_WIN)
@@ -17,9 +16,7 @@ namespace content {
 
 // An abstract base class that contains logic shared between most child
 // processes of the embedder.
-class CONTENT_EXPORT ChildThread
-    : public IPC::Sender,
-      virtual public IPC::SupportsAttachmentBrokering {
+class CONTENT_EXPORT ChildThread : public IPC::Sender {
  public:
   // Returns the one child thread for this process.  Note that this can only be
   // accessed when running on the child thread itself.
diff --git a/content/public/common/child_process_host.h b/content/public/common/child_process_host.h
index d36d310..0544a5a 100644
--- a/content/public/common/child_process_host.h
+++ b/content/public/common/child_process_host.h
@@ -71,10 +71,6 @@ class CONTENT_EXPORT ChildProcessHost : public IPC::Sender {
   // On failure, returns an empty FilePath.
   static base::FilePath GetChildPath(int flags);
 
-  // Returns an AttachmentBroker used to broker attachments of IPC messages to
-  // child processes.
-  static IPC::AttachmentBrokerPrivileged* GetAttachmentBroker();
-
   // Send the shutdown message to the child process.
   // Does not check with the delegate's CanShutdown.
   virtual void ForceShutdown() = 0;
diff --git a/content/public/test/mock_render_thread.cc b/content/public/test/mock_render_thread.cc
index dee8514..2d6fd6e 100644
--- a/content/public/test/mock_render_thread.cc
+++ b/content/public/test/mock_render_thread.cc
@@ -189,10 +189,6 @@ void MockRenderThread::ReleaseCachedFonts() {
 
 #endif  // OS_WIN
 
-IPC::AttachmentBroker* MockRenderThread::GetAttachmentBroker() {
-  return nullptr;
-}
-
 ServiceRegistry* MockRenderThread::GetServiceRegistry() {
   return NULL;
 }
diff --git a/content/public/test/mock_render_thread.h b/content/public/test/mock_render_thread.h
index b5e1550..efcbf75 100644
--- a/content/public/test/mock_render_thread.h
+++ b/content/public/test/mock_render_thread.h
@@ -76,7 +76,6 @@ class MockRenderThread : public RenderThread {
   void PreCacheFont(const LOGFONT& log_font) override;
   void ReleaseCachedFonts() override;
 #endif
-  IPC::AttachmentBroker* GetAttachmentBroker() override;
   ServiceRegistry* GetServiceRegistry() override;
 
   //////////////////////////////////////////////////////////////////////////
diff --git a/content/renderer/npapi/plugin_channel_host.cc b/content/renderer/npapi/plugin_channel_host.cc
index 86ea903..d552ff8 100644
--- a/content/renderer/npapi/plugin_channel_host.cc
+++ b/content/renderer/npapi/plugin_channel_host.cc
@@ -60,13 +60,11 @@ bool* PluginChannelHost::GetRemoveTrackingFlag() {
 // static
 PluginChannelHost* PluginChannelHost::GetPluginChannelHost(
     const IPC::ChannelHandle& channel_handle,
-    base::SingleThreadTaskRunner* ipc_task_runner,
-    IPC::AttachmentBroker* broker) {
+    base::SingleThreadTaskRunner* ipc_task_runner) {
   PluginChannelHost* result =
       static_cast<PluginChannelHost*>(NPChannelBase::GetChannel(
           channel_handle, IPC::Channel::MODE_CLIENT, ClassFactory,
-          ipc_task_runner, true, ChildProcess::current()->GetShutDownEvent(),
-          broker));
+          ipc_task_runner, true, ChildProcess::current()->GetShutDownEvent()));
   return result;
 }
 
@@ -78,10 +76,8 @@ PluginChannelHost::~PluginChannelHost() {
 
 bool PluginChannelHost::Init(base::SingleThreadTaskRunner* ipc_task_runner,
                              bool create_pipe_now,
-                             base::WaitableEvent* shutdown_event,
-                             IPC::AttachmentBroker* broker) {
-  return NPChannelBase::Init(ipc_task_runner, create_pipe_now, shutdown_event,
-                             broker);
+                             base::WaitableEvent* shutdown_event) {
+  return NPChannelBase::Init(ipc_task_runner, create_pipe_now, shutdown_event);
 }
 
 int PluginChannelHost::GenerateRouteID() {
diff --git a/content/renderer/npapi/plugin_channel_host.h b/content/renderer/npapi/plugin_channel_host.h
index dd9dd1b..6c6f8e2 100644
--- a/content/renderer/npapi/plugin_channel_host.h
+++ b/content/renderer/npapi/plugin_channel_host.h
@@ -9,10 +9,6 @@
 #include "content/child/npapi/np_channel_base.h"
 #include "ipc/ipc_channel_handle.h"
 
-namespace IPC {
-class AttachmentBroker;
-}
-
 namespace content {
 class NPObjectBase;
 
@@ -27,13 +23,11 @@ class PluginChannelHost : public NPChannelBase {
 #endif
   static PluginChannelHost* GetPluginChannelHost(
       const IPC::ChannelHandle& channel_handle,
-      base::SingleThreadTaskRunner* ipc_task_runner,
-      IPC::AttachmentBroker* broker);
+      base::SingleThreadTaskRunner* ipc_task_runner);
 
   bool Init(base::SingleThreadTaskRunner* ipc_task_runner,
             bool create_pipe_now,
-            base::WaitableEvent* shutdown_event,
-            IPC::AttachmentBroker* broker) override;
+            base::WaitableEvent* shutdown_event) override;
 
   int GenerateRouteID() override;
 
diff --git a/content/renderer/npapi/webplugin_delegate_proxy.cc b/content/renderer/npapi/webplugin_delegate_proxy.cc
index 0f9768e..22d2799 100644
--- a/content/renderer/npapi/webplugin_delegate_proxy.cc
+++ b/content/renderer/npapi/webplugin_delegate_proxy.cc
@@ -322,8 +322,7 @@ bool WebPluginDelegateProxy::Initialize(
     }
 
     channel_host = PluginChannelHost::GetPluginChannelHost(
-        channel_handle, ChildProcess::current()->io_task_runner(),
-        RenderThreadImpl::current()->GetAttachmentBroker());
+        channel_handle, ChildProcess::current()->io_task_runner());
     if (!channel_host.get()) {
       LOG(ERROR) << "Couldn't get PluginChannelHost";
       continue;
diff --git a/ipc/attachment_broker.cc b/ipc/attachment_broker.cc
index 7450ec3..7e04bcd 100644
--- a/ipc/attachment_broker.cc
+++ b/ipc/attachment_broker.cc
@@ -6,8 +6,23 @@
 
 #include <algorithm>
 
+namespace {
+IPC::AttachmentBroker* g_attachment_broker = nullptr;
+}
+
 namespace IPC {
 
+// static
+void AttachmentBroker::SetGlobal(AttachmentBroker* broker) {
+  CHECK(!g_attachment_broker);
+  g_attachment_broker = broker;
+}
+
+// static
+AttachmentBroker* AttachmentBroker::GetGlobal() {
+  return g_attachment_broker;
+}
+
 AttachmentBroker::AttachmentBroker() {}
 AttachmentBroker::~AttachmentBroker() {}
 
diff --git a/ipc/attachment_broker.h b/ipc/attachment_broker.h
index 5b65289..577d762 100644
--- a/ipc/attachment_broker.h
+++ b/ipc/attachment_broker.h
@@ -50,6 +50,12 @@ class IPC_EXPORT AttachmentBroker : public Listener {
         const BrokerableAttachment::AttachmentId& id) = 0;
   };
 
+  // Each process has at most one attachment broker. The process is responsible
+  // for ensuring that |broker| stays alive for as long as the process is
+  // sending/receiving ipc messages.
+  static void SetGlobal(AttachmentBroker* broker);
+  static AttachmentBroker* GetGlobal();
+
   AttachmentBroker();
   ~AttachmentBroker() override;
 
diff --git a/ipc/attachment_broker_privileged_win_unittest.cc b/ipc/attachment_broker_privileged_win_unittest.cc
index 2e46f2b..480a2b4 100644
--- a/ipc/attachment_broker_privileged_win_unittest.cc
+++ b/ipc/attachment_broker_privileged_win_unittest.cc
@@ -154,6 +154,7 @@ class IPCAttachmentBrokerPrivilegedWinTest : public IPCTestBase {
   // Takes ownership of |broker|. Has no effect if called after CommonSetUp().
   void set_broker(IPC::AttachmentBrokerUnprivilegedWin* broker) {
     broker_.reset(broker);
+    IPC::AttachmentBroker::SetGlobal(broker);
   }
 
   void CommonSetUp() {
@@ -343,7 +344,7 @@ int CommonPrivilegedProcessMain(OnMessageReceivedCallback callback,
 
   // Set up IPC channel.
   IPC::AttachmentBrokerPrivilegedWin broker;
-  listener.set_listener(&broker);
+  IPC::AttachmentBroker::SetGlobal(&broker);
   scoped_ptr<IPC::Channel> channel(IPC::Channel::CreateClient(
       IPCTestBase::GetChannelName(channel_name), &listener, &broker));
   broker.RegisterCommunicationChannel(channel.get());
diff --git a/ipc/ipc_channel_nacl.cc b/ipc/ipc_channel_nacl.cc
index b8704bf..769ead0 100644
--- a/ipc/ipc_channel_nacl.cc
+++ b/ipc/ipc_channel_nacl.cc
@@ -130,8 +130,7 @@ ChannelNacl::ChannelNacl(const IPC::ChannelHandle& channel_handle,
       waiting_connect_(true),
       pipe_(-1),
       pipe_name_(channel_handle.name),
-      weak_ptr_factory_(this),
-      broker_(broker) {
+      weak_ptr_factory_(this) {
   if (!CreatePipe(channel_handle)) {
     // The pipe may have been closed already.
     const char *modestr = (mode_ & MODE_SERVER_FLAG) ? "server" : "client";
@@ -225,7 +224,7 @@ bool ChannelNacl::Send(Message* message) {
 }
 
 AttachmentBroker* ChannelNacl::GetAttachmentBroker() {
-  return broker_;
+  return nullptr;
 }
 
 void ChannelNacl::DidRecvMsg(scoped_ptr<MessageContents> contents) {
diff --git a/ipc/ipc_channel_nacl.h b/ipc/ipc_channel_nacl.h
index 8d26772..0ed0da8 100644
--- a/ipc/ipc_channel_nacl.h
+++ b/ipc/ipc_channel_nacl.h
@@ -120,9 +120,6 @@ class ChannelNacl : public Channel,
 
   base::WeakPtrFactory<ChannelNacl> weak_ptr_factory_;
 
-  // |broker_| must outlive this instance.
-  AttachmentBroker* broker_;
-
   DISALLOW_IMPLICIT_CONSTRUCTORS(ChannelNacl);
 };
 
diff --git a/ipc/ipc_channel_posix.cc b/ipc/ipc_channel_posix.cc
index 2339687..b3aee8e 100644
--- a/ipc/ipc_channel_posix.cc
+++ b/ipc/ipc_channel_posix.cc
@@ -38,6 +38,7 @@
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/synchronization/lock.h"
+#include "ipc/attachment_broker.h"
 #include "ipc/ipc_descriptors.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_logging.h"
@@ -182,8 +183,7 @@ int ChannelPosix::global_pid_ = 0;
 
 ChannelPosix::ChannelPosix(const IPC::ChannelHandle& channel_handle,
                            Mode mode,
-                           Listener* listener,
-                           AttachmentBroker* broker)
+                           Listener* listener)
     : ChannelReader(listener),
       mode_(mode),
       peer_pid_(base::kNullProcessId),
@@ -192,8 +192,7 @@ ChannelPosix::ChannelPosix(const IPC::ChannelHandle& channel_handle,
       message_send_bytes_written_(0),
       pipe_name_(channel_handle.name),
       in_dtor_(false),
-      must_unlink_(false),
-      broker_(broker) {
+      must_unlink_(false) {
   if (!CreatePipe(channel_handle)) {
     // The pipe may have been closed already.
     const char *modestr = (mode_ & MODE_SERVER_FLAG) ? "server" : "client";
@@ -524,7 +523,7 @@ bool ChannelPosix::Send(Message* message) {
 }
 
 AttachmentBroker* ChannelPosix::GetAttachmentBroker() {
-  return broker_;
+  return AttachmentBroker::GetGlobal();
 }
 
 int ChannelPosix::GetClientFileDescriptor() const {
@@ -1023,7 +1022,7 @@ scoped_ptr<Channel> Channel::Create(const IPC::ChannelHandle& channel_handle,
                                     Listener* listener,
                                     AttachmentBroker* broker) {
   return make_scoped_ptr(
-      new ChannelPosix(channel_handle, mode, listener, broker));
+      new ChannelPosix(channel_handle, mode, listener));
 }
 
 // static
diff --git a/ipc/ipc_channel_posix.h b/ipc/ipc_channel_posix.h
index 8760135..be47705d 100644
--- a/ipc/ipc_channel_posix.h
+++ b/ipc/ipc_channel_posix.h
@@ -29,8 +29,7 @@ class IPC_EXPORT ChannelPosix : public Channel,
   // |broker| must outlive the newly created object.
   ChannelPosix(const IPC::ChannelHandle& channel_handle,
                Mode mode,
-               Listener* listener,
-               AttachmentBroker* broker);
+               Listener* listener);
   ~ChannelPosix() override;
 
   // Channel implementation
@@ -182,9 +181,6 @@ class IPC_EXPORT ChannelPosix : public Channel,
   static int global_pid_;
 #endif  // OS_LINUX
 
-  // |broker_| must outlive this instance.
-  AttachmentBroker* broker_;
-
   DISALLOW_IMPLICIT_CONSTRUCTORS(ChannelPosix);
 };
 
diff --git a/ipc/ipc_channel_posix_unittest.cc b/ipc/ipc_channel_posix_unittest.cc
index eb78b7c..3aa9d04 100644
--- a/ipc/ipc_channel_posix_unittest.cc
+++ b/ipc/ipc_channel_posix_unittest.cc
@@ -203,7 +203,7 @@ TEST_F(IPCChannelPosixTest, BasicListen) {
   SetUpSocket(&handle, IPC::Channel::MODE_NAMED_SERVER);
   unlink(handle.name.c_str());
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_SERVER, NULL, nullptr));
+      handle, IPC::Channel::MODE_NAMED_SERVER, NULL));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -222,7 +222,7 @@ TEST_F(IPCChannelPosixTest, BasicConnected) {
   base::FileDescriptor fd(pipe_fds[0], false);
   IPC::ChannelHandle handle(socket_name, fd);
   scoped_ptr<IPC::ChannelPosix> channel(
-      new IPC::ChannelPosix(handle, IPC::Channel::MODE_SERVER, NULL, nullptr));
+      new IPC::ChannelPosix(handle, IPC::Channel::MODE_SERVER, NULL));
   ASSERT_TRUE(channel->Connect());
   ASSERT_FALSE(channel->AcceptsConnections());
   channel->Close();
@@ -231,7 +231,7 @@ TEST_F(IPCChannelPosixTest, BasicConnected) {
   // Make sure that we can use the socket that is created for us by
   // a standard channel.
   scoped_ptr<IPC::ChannelPosix> channel2(new IPC::ChannelPosix(
-      socket_name, IPC::Channel::MODE_SERVER, NULL, nullptr));
+      socket_name, IPC::Channel::MODE_SERVER, NULL));
   ASSERT_TRUE(channel2->Connect());
   ASSERT_FALSE(channel2->AcceptsConnections());
 }
@@ -244,11 +244,11 @@ TEST_F(IPCChannelPosixTest, SendHangTest) {
   IPCChannelPosixTestListener in_listener(true);
   IPC::ChannelHandle in_handle("IN");
   scoped_ptr<IPC::ChannelPosix> in_chan(new IPC::ChannelPosix(
-      in_handle, IPC::Channel::MODE_SERVER, &in_listener, nullptr));
+      in_handle, IPC::Channel::MODE_SERVER, &in_listener));
   IPC::ChannelHandle out_handle(
       "OUT", base::FileDescriptor(in_chan->TakeClientFileDescriptor()));
   scoped_ptr<IPC::ChannelPosix> out_chan(new IPC::ChannelPosix(
-      out_handle, IPC::Channel::MODE_CLIENT, &out_listener, nullptr));
+      out_handle, IPC::Channel::MODE_CLIENT, &out_listener));
   ASSERT_TRUE(in_chan->Connect());
   ASSERT_TRUE(out_chan->Connect());
   in_chan->Close();  // simulate remote process dying at an unfortunate time.
@@ -269,11 +269,11 @@ TEST_F(IPCChannelPosixTest, AcceptHangTest) {
   IPCChannelPosixTestListener in_listener(true);
   IPC::ChannelHandle in_handle("IN");
   scoped_ptr<IPC::ChannelPosix> in_chan(new IPC::ChannelPosix(
-      in_handle, IPC::Channel::MODE_SERVER, &in_listener, nullptr));
+      in_handle, IPC::Channel::MODE_SERVER, &in_listener));
   IPC::ChannelHandle out_handle(
       "OUT", base::FileDescriptor(in_chan->TakeClientFileDescriptor()));
   scoped_ptr<IPC::ChannelPosix> out_chan(new IPC::ChannelPosix(
-      out_handle, IPC::Channel::MODE_CLIENT, &out_listener, nullptr));
+      out_handle, IPC::Channel::MODE_CLIENT, &out_listener));
   ASSERT_TRUE(in_chan->Connect());
   in_chan->Close();  // simulate remote process dying at an unfortunate time.
   ASSERT_FALSE(out_chan->Connect());
@@ -292,7 +292,7 @@ TEST_F(IPCChannelPosixTest, MAYBE_AdvancedConnected) {
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   SetUpSocket(&chan_handle, IPC::Channel::MODE_NAMED_SERVER);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -328,7 +328,7 @@ TEST_F(IPCChannelPosixTest, MAYBE_ResetState) {
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   SetUpSocket(&chan_handle, IPC::Channel::MODE_NAMED_SERVER);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -364,7 +364,7 @@ TEST_F(IPCChannelPosixTest, BadChannelName) {
   // Test empty name
   IPC::ChannelHandle handle("");
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_SERVER, NULL, nullptr));
+      handle, IPC::Channel::MODE_NAMED_SERVER, NULL));
   ASSERT_FALSE(channel->Connect());
 
   // Test name that is too long.
@@ -378,7 +378,7 @@ TEST_F(IPCChannelPosixTest, BadChannelName) {
   EXPECT_GE(strlen(kTooLongName), IPC::kMaxSocketNameLength);
   IPC::ChannelHandle handle2(kTooLongName);
   scoped_ptr<IPC::ChannelPosix> channel2(new IPC::ChannelPosix(
-      handle2, IPC::Channel::MODE_NAMED_SERVER, NULL, nullptr));
+      handle2, IPC::Channel::MODE_NAMED_SERVER, NULL));
   EXPECT_FALSE(channel2->Connect());
 }
 
@@ -394,7 +394,7 @@ TEST_F(IPCChannelPosixTest, MAYBE_MultiConnection) {
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   SetUpSocket(&chan_handle, IPC::Channel::MODE_NAMED_SERVER);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
   ASSERT_TRUE(channel->Connect());
   ASSERT_TRUE(channel->AcceptsConnections());
   ASSERT_FALSE(channel->HasAcceptedConnection());
@@ -430,9 +430,9 @@ TEST_F(IPCChannelPosixTest, DoubleServer) {
   IPCChannelPosixTestListener listener2(false);
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_SERVER, &listener, nullptr));
+      chan_handle, IPC::Channel::MODE_SERVER, &listener));
   scoped_ptr<IPC::ChannelPosix> channel2(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_SERVER, &listener2, nullptr));
+      chan_handle, IPC::Channel::MODE_SERVER, &listener2));
   ASSERT_TRUE(channel->Connect());
   ASSERT_FALSE(channel2->Connect());
 }
@@ -442,7 +442,7 @@ TEST_F(IPCChannelPosixTest, BadMode) {
   IPCChannelPosixTestListener listener(false);
   IPC::ChannelHandle chan_handle(GetConnectionSocketName());
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NONE, &listener, nullptr));
+      chan_handle, IPC::Channel::MODE_NONE, &listener));
   ASSERT_FALSE(channel->Connect());
 }
 
@@ -454,7 +454,7 @@ TEST_F(IPCChannelPosixTest, IsNamedServerInitialized) {
   ASSERT_FALSE(IPC::Channel::IsNamedServerInitialized(
       connection_socket_name));
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener, nullptr));
+      chan_handle, IPC::Channel::MODE_NAMED_SERVER, &listener));
   ASSERT_TRUE(IPC::Channel::IsNamedServerInitialized(
       connection_socket_name));
   channel->Close();
@@ -470,7 +470,7 @@ MULTIPROCESS_TEST_MAIN(IPCChannelPosixTestConnectionProc) {
   IPC::ChannelHandle handle(IPCChannelPosixTest::GetConnectionSocketName());
   IPCChannelPosixTest::SetUpSocket(&handle, IPC::Channel::MODE_NAMED_CLIENT);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener, nullptr));
+      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener));
   EXPECT_TRUE(channel->Connect());
   IPCChannelPosixTest::SpinRunLoop(TestTimeouts::action_max_timeout());
   EXPECT_EQ(IPCChannelPosixTestListener::MESSAGE_RECEIVED, listener.status());
@@ -484,7 +484,7 @@ MULTIPROCESS_TEST_MAIN(IPCChannelPosixFailConnectionProc) {
   IPC::ChannelHandle handle(IPCChannelPosixTest::GetConnectionSocketName());
   IPCChannelPosixTest::SetUpSocket(&handle, IPC::Channel::MODE_NAMED_CLIENT);
   scoped_ptr<IPC::ChannelPosix> channel(new IPC::ChannelPosix(
-      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener, nullptr));
+      handle, IPC::Channel::MODE_NAMED_CLIENT, &listener));
 
   // In this case connect may succeed or fail depending on if the packet
   // actually gets sent at sendmsg. Since we never delay on send, we may not
diff --git a/ipc/ipc_channel_win.cc b/ipc/ipc_channel_win.cc
index 4ac5823..79b0001 100644
--- a/ipc/ipc_channel_win.cc
+++ b/ipc/ipc_channel_win.cc
@@ -18,6 +18,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_checker.h"
 #include "base/win/scoped_handle.h"
+#include "ipc/attachment_broker.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_message_attachment_set.h"
@@ -38,8 +39,7 @@ ChannelWin::State::~State() {
 
 ChannelWin::ChannelWin(const IPC::ChannelHandle& channel_handle,
                        Mode mode,
-                       Listener* listener,
-                       AttachmentBroker* broker)
+                       Listener* listener)
     : ChannelReader(listener),
       input_state_(this),
       output_state_(this),
@@ -48,7 +48,6 @@ ChannelWin::ChannelWin(const IPC::ChannelHandle& channel_handle,
       processing_incoming_(false),
       validate_client_(false),
       client_secret_(0),
-      broker_(broker),
       weak_factory_(this) {
   CreatePipe(channel_handle, mode);
 }
@@ -107,11 +106,12 @@ bool ChannelWin::ProcessMessageForDelivery(Message* message) {
   // both Send() and ProcessMessageForDelivery() may be re-entrant. Brokered
   // attachments must be sent before the Message itself.
   if (message->HasBrokerableAttachments()) {
-    DCHECK(broker_);
+    DCHECK(GetAttachmentBroker());
     DCHECK(peer_pid_ != base::kNullProcessId);
     for (const BrokerableAttachment* attachment :
          message->attachment_set()->PeekBrokerableAttachments()) {
-      if (!broker_->SendAttachmentToProcess(attachment, peer_pid_)) {
+      if (!GetAttachmentBroker()->SendAttachmentToProcess(attachment,
+                                                          peer_pid_)) {
         delete message;
         return false;
       }
@@ -161,7 +161,7 @@ void ChannelWin::FlushPrelimQueue() {
 }
 
 AttachmentBroker* ChannelWin::GetAttachmentBroker() {
-  return broker_;
+  return AttachmentBroker::GetGlobal();
 }
 
 base::ProcessId ChannelWin::GetPeerPID() const {
@@ -567,7 +567,7 @@ scoped_ptr<Channel> Channel::Create(const IPC::ChannelHandle& channel_handle,
                                     Listener* listener,
                                     AttachmentBroker* broker) {
   return scoped_ptr<Channel>(
-      new ChannelWin(channel_handle, mode, listener, broker));
+      new ChannelWin(channel_handle, mode, listener));
 }
 
 // static
diff --git a/ipc/ipc_channel_win.h b/ipc/ipc_channel_win.h
index 579f7f7..35a158e 100644
--- a/ipc/ipc_channel_win.h
+++ b/ipc/ipc_channel_win.h
@@ -32,8 +32,7 @@ class ChannelWin : public Channel,
   // |broker| must outlive the newly created object.
   ChannelWin(const IPC::ChannelHandle& channel_handle,
              Mode mode,
-             Listener* listener,
-             AttachmentBroker* broker);
+             Listener* listener);
   ~ChannelWin() override;
 
   // Channel implementation
@@ -133,9 +132,6 @@ class ChannelWin : public Channel,
 
   scoped_ptr<base::ThreadChecker> thread_check_;
 
-  // |broker_| must outlive this instance.
-  AttachmentBroker* broker_;
-
   base::WeakPtrFactory<ChannelWin> weak_factory_;
   DISALLOW_COPY_AND_ASSIGN(ChannelWin);
 };