Move Mojo channel initialization closer to IPC::Channel setup

This CL introduces two new content classes:
- MojoApplicationHost encapsulates what's needed to host a Mojo App using Chrome IPC to bootstrap.
- MojoApplication represents what's needed to be a Mojo App using Chrome IPC to bootstrap.

The RenderProcess and RenderProcessHost interfaces are replaced with WebUISetup and WebUISetupClient interfaces. This way the interface is more specific to the service of setting up WebUI.

WebUISetupClient is empty and uninteresting. RenderProcessHostImpl no longer deals with WebUI setup. That is all done directly by RenderViewHostImpl by talking to the WebUISetup service.

Service names get defined in content/common/mojo/mojo_service_names.{h,cc}.

TBR=sky@chromium.org, tsepez@chromium.org
Originally reviewed at https://codereview.chromium.org/236813002/

Review URL: https://codereview.chromium.org/256403004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@265962 0039d316-1c4b-4281-b951-d872f2087c98

41 files changed, 487 insertions, 371 deletions

diff --git a/content/app/content_main_runner.cc b/content/app/content_main_runner.cc
index 71da1a5..2593b28 100644
--- a/content/app/content_main_runner.cc
+++ b/content/app/content_main_runner.cc
@@ -26,9 +26,6 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/browser/browser_main.h"
-#include "content/browser/gpu/gpu_process_host.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
-#include "content/browser/utility_process_host_impl.h"
 #include "content/common/set_process_title.h"
 #include "content/common/url_schemes.h"
 #include "content/gpu/in_process_gpu_thread.h"
@@ -63,6 +60,9 @@
 
 #if !defined(OS_IOS)
 #include "content/app/mojo/mojo_init.h"
+#include "content/browser/gpu/gpu_process_host.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
+#include "content/browser/utility_process_host_impl.h"
 #include "content/public/plugin/content_plugin_client.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/utility/content_utility_client.h"
diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index 0153179..de2a993 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc
@@ -39,7 +39,6 @@
 #include "content/browser/net/browser_online_state_observer.h"
 #include "content/browser/plugin_service_impl.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/speech/speech_recognition_manager_impl.h"
 #include "content/browser/startup_task_runner.h"
 #include "content/browser/webui/content_web_ui_controller_factory.h"
@@ -70,6 +69,10 @@
 #include "ui/aura/env.h"
 #endif
 
+#if !defined(OS_IOS)
+#include "content/browser/renderer_host/render_process_host_impl.h"
+#endif
+
 #if defined(OS_ANDROID)
 #include "base/android/jni_android.h"
 #include "content/browser/android/browser_startup_controller.h"
@@ -718,8 +721,10 @@ void BrowserMainLoop::ShutdownThreadsAndCleanUp() {
       base::Bind(base::IgnoreResult(&base::ThreadRestrictions::SetIOAllowed),
                  true));
 
+#if !defined(OS_IOS)
   if (RenderProcessHost::run_renderer_in_process())
     RenderProcessHostImpl::ShutDownInProcessRenderer();
+#endif
 
   if (parts_) {
     TRACE_EVENT0("shutdown",
diff --git a/content/browser/mojo/mojo_application_host.cc b/content/browser/mojo/mojo_application_host.cc
new file mode 100644
index 0000000..48d343a
--- /dev/null
+++ b/content/browser/mojo/mojo_application_host.cc
@@ -0,0 +1,65 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/mojo/mojo_application_host.h"
+
+#include "content/common/mojo/mojo_messages.h"
+#include "content/public/browser/browser_thread.h"
+#include "ipc/ipc_sender.h"
+#include "mojo/embedder/platform_channel_pair.h"
+
+namespace content {
+namespace {
+
+base::PlatformFile PlatformFileFromScopedPlatformHandle(
+    mojo::embedder::ScopedPlatformHandle handle) {
+#if defined(OS_POSIX)
+  return handle.release().fd;
+#elif defined(OS_WIN)
+  return handle.release().handle;
+#endif
+}
+
+}  // namespace
+
+MojoApplicationHost::MojoApplicationHost() : did_activate_(false) {
+}
+
+MojoApplicationHost::~MojoApplicationHost() {
+}
+
+bool MojoApplicationHost::Init() {
+  DCHECK(shell_client_.is_null()) << "Already initialized!";
+
+  mojo::embedder::PlatformChannelPair channel_pair;
+
+  mojo::ScopedMessagePipeHandle message_pipe = channel_init_.Init(
+      PlatformFileFromScopedPlatformHandle(channel_pair.PassServerHandle()),
+      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO));
+  if (!message_pipe.is_valid())
+    return false;
+
+  // Forward this to the client once we know its process handle.
+  client_handle_ = channel_pair.PassClientHandle();
+
+  // TODO(darin): Provide a Shell implementation
+  shell_client_.reset(
+      mojo::ScopedShellClientHandle::From(message_pipe.Pass()), NULL);
+
+  return true;
+}
+
+bool MojoApplicationHost::Activate(IPC::Sender* sender,
+                                   base::ProcessHandle process_handle) {
+  DCHECK(!did_activate_);
+  DCHECK(client_handle_.is_valid());
+
+  base::PlatformFile client_file =
+      PlatformFileFromScopedPlatformHandle(client_handle_.Pass());
+  did_activate_ = sender->Send(new MojoMsg_Activate(
+      IPC::GetFileHandleForProcess(client_file, process_handle, true)));
+  return did_activate_;
+}
+
+}  // namespace content
diff --git a/content/browser/mojo/mojo_application_host.h b/content/browser/mojo/mojo_application_host.h
new file mode 100644
index 0000000..68f6c32
--- /dev/null
+++ b/content/browser/mojo/mojo_application_host.h
@@ -0,0 +1,51 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_MOJO_MOJO_APPLICATION_HOST_H_
+#define CONTENT_BROWSER_MOJO_MOJO_APPLICATION_HOST_H_
+
+#include "base/process/process_handle.h"
+#include "mojo/common/channel_init.h"
+#include "mojo/embedder/scoped_platform_handle.h"
+#include "mojo/public/cpp/bindings/remote_ptr.h"
+#include "mojo/public/interfaces/shell/shell.mojom.h"
+
+namespace IPC {
+class Sender;
+}
+
+namespace content {
+
+// MojoApplicationHost represents the code needed on the browser side to setup
+// a child process as a Mojo application via Chrome IPC. The child process
+// should use MojoApplication to handle messages generated by an instance of
+// MojoApplicationHost. MojoApplicationHost makes the mojo::ShellClient
+// interface available so that child-provided services can be invoked.
+class MojoApplicationHost {
+ public:
+  MojoApplicationHost();
+  ~MojoApplicationHost();
+
+  // Two-phase initialization:
+  //  1- Init makes the shell_client() available synchronously.
+  //  2- Activate establishes the actual connection to the peer process.
+  bool Init();
+  bool Activate(IPC::Sender* sender, base::ProcessHandle process_handle);
+
+  bool did_activate() const { return did_activate_; }
+
+  mojo::ShellClient* shell_client() { return shell_client_.get(); }
+
+ private:
+  mojo::common::ChannelInit channel_init_;
+  mojo::embedder::ScopedPlatformHandle client_handle_;
+  mojo::RemotePtr<mojo::ShellClient> shell_client_;
+  bool did_activate_;
+
+  DISALLOW_COPY_AND_ASSIGN(MojoApplicationHost);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_MOJO_MOJO_APPLICATION_HOST_H_
diff --git a/content/browser/renderer_data_memoizing_store.h b/content/browser/renderer_data_memoizing_store.h
index a470fd1..ce8e293 100644
--- a/content/browser/renderer_data_memoizing_store.h
+++ b/content/browser/renderer_data_memoizing_store.h
@@ -9,8 +9,8 @@
 
 #include "base/bind.h"
 #include "base/synchronization/lock.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_process_host_observer.h"
 
 namespace content {
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index d3c015c..12b37cee 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -64,6 +64,7 @@
 #include "content/browser/media/media_internals.h"
 #include "content/browser/message_port_message_filter.h"
 #include "content/browser/mime_registry_message_filter.h"
+#include "content/browser/mojo/mojo_application_host.h"
 #include "content/browser/plugin_service_impl.h"
 #include "content/browser/profiler_message_filter.h"
 #include "content/browser/push_messaging_message_filter.h"
@@ -86,7 +87,6 @@
 #include "content/browser/renderer_host/pepper/pepper_message_filter.h"
 #include "content/browser/renderer_host/pepper/pepper_renderer_connection.h"
 #include "content/browser/renderer_host/render_message_filter.h"
-#include "content/browser/renderer_host/render_process_host_mojo_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_helper.h"
@@ -112,6 +112,7 @@
 #include "content/common/child_process_messages.h"
 #include "content/common/content_switches_internal.h"
 #include "content/common/gpu/gpu_messages.h"
+#include "content/common/mojo/mojo_messages.h"
 #include "content/common/resource_messages.h"
 #include "content/common/view_messages.h"
 #include "content/port/browser/render_widget_host_view_frame_subscriber.h"
@@ -137,6 +138,8 @@
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_switches.h"
 #include "media/base/media_switches.h"
+#include "mojo/common/common_type_converters.h"
+#include "mojo/public/cpp/bindings/allocation_scope.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "ppapi/shared_impl/ppapi_switches.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -538,6 +541,10 @@ bool RenderProcessHostImpl::Init() {
                                 BrowserThread::GetMessageLoopProxyForThread(
                                     BrowserThread::IO).get()));
 
+  // Setup the Mojo channel.
+  mojo_application_host_.reset(new MojoApplicationHost());
+  mojo_application_host_->Init();
+
   // Call the embedder first so that their IPC filters have priority.
   GetContentClient()->browser()->RenderProcessWillLaunch(this);
 
@@ -1827,7 +1834,7 @@ void RenderProcessHostImpl::ProcessDied(bool already_dead) {
     iter.Advance();
   }
 
-  render_process_host_mojo_.reset();
+  mojo_application_host_.reset();
 
   // It's possible that one of the calls out to the observers might have caused
   // this object to be no longer needed.
@@ -1962,6 +1969,14 @@ void RenderProcessHostImpl::OnProcessLaunched() {
       Source<RenderProcessHost>(this),
       NotificationService::NoDetails());
 
+  // TODO(darin): This is blocked on security review. Un-commenting this will
+  // allow Mojo calls from all renderers.
+#if 0
+  // Let the Mojo system get setup on the child process side before any other
+  // IPCs arrive. This way those may safely generate Mojo-related RPCs.
+  mojo_application_host_->Activate(this, GetHandle());
+#endif
+
   while (!queued_messages_.empty()) {
     Send(queued_messages_.front());
     queued_messages_.pop();
@@ -1971,9 +1986,6 @@ void RenderProcessHostImpl::OnProcessLaunched() {
   if (WebRTCInternals::GetInstance()->aec_dump_enabled())
     EnableAecDump(WebRTCInternals::GetInstance()->aec_dump_file_path());
 #endif
-
-  if (render_process_host_mojo_.get())
-    render_process_host_mojo_->OnProcessLaunched();
 }
 
 scoped_refptr<AudioRendererHost>
@@ -2047,12 +2059,15 @@ void RenderProcessHostImpl::DecrementWorkerRefCount() {
     Cleanup();
 }
 
-void RenderProcessHostImpl::SetWebUIHandle(
-    int32 view_routing_id,
+void RenderProcessHostImpl::ConnectTo(
+    const base::StringPiece& service_name,
     mojo::ScopedMessagePipeHandle handle) {
-  if (!render_process_host_mojo_)
-    render_process_host_mojo_.reset(new RenderProcessHostMojoImpl(this));
-  render_process_host_mojo_->SetWebUIHandle(view_routing_id, handle.Pass());
+  if (!mojo_application_host_->did_activate())
+    mojo_application_host_->Activate(this, GetHandle());
+
+  mojo::AllocationScope scope;
+  mojo_application_host_->shell_client()->AcceptConnection(service_name,
+                                                           handle.Pass());
 }
 
 }  // namespace content
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 25cc24a..4833f16 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -21,7 +21,9 @@
 #include "content/public/browser/render_process_host.h"
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_platform_file.h"
-#include "mojo/public/cpp/system/core.h"
+#include "mojo/embedder/scoped_platform_handle.h"
+#include "mojo/public/cpp/bindings/remote_ptr.h"
+#include "mojo/public/interfaces/shell/shell.mojom.h"
 
 struct ViewHostMsg_CompositorSurfaceBuffersSwapped_Params;
 
@@ -40,6 +42,7 @@ class BrowserDemuxerAndroid;
 class GeolocationDispatcherHost;
 class GpuMessageFilter;
 class MessagePortMessageFilter;
+class MojoApplicationHost;
 class PeerConnectionTrackerHost;
 class RendererMainThread;
 class RenderProcessHostMojoImpl;
@@ -237,8 +240,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void IncrementWorkerRefCount();
   void DecrementWorkerRefCount();
 
-  void SetWebUIHandle(int32 view_routing_id,
-                      mojo::ScopedMessagePipeHandle handle);
+  // Establish a connection to a renderer-provided service. See
+  // content/common/mojo/mojo_service_names.h for a list of services.
+  void ConnectTo(const base::StringPiece& service_name,
+                 mojo::ScopedMessagePipeHandle handle);
 
  protected:
   // A proxy for our IPC::Channel that lives on the IO thread (see
@@ -303,6 +308,8 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void SendDisableAecDumpToRenderer();
 #endif
 
+  scoped_ptr<MojoApplicationHost> mojo_application_host_;
+
   // The registered IPC listener objects. When this list is empty, we should
   // delete ourselves.
   IDMap<IPC::Listener> listeners_;
@@ -416,8 +423,6 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // Records the time when the process starts surviving for workers for UMA.
   base::TimeTicks survive_for_worker_start_time_;
 
-  scoped_ptr<RenderProcessHostMojoImpl> render_process_host_mojo_;
-
   base::WeakPtrFactory<RenderProcessHostImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderProcessHostImpl);
diff --git a/content/browser/renderer_host/render_process_host_mojo_impl.cc b/content/browser/renderer_host/render_process_host_mojo_impl.cc
deleted file mode 100644
index 1adb4a1..0000000
--- a/content/browser/renderer_host/render_process_host_mojo_impl.cc
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/renderer_host/render_process_host_mojo_impl.h"
-
-#include "base/platform_file.h"
-#include "content/common/mojo/mojo_messages.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/render_process_host.h"
-#include "mojo/common/mojo_channel_init.h"
-#include "mojo/embedder/platform_channel_pair.h"
-
-namespace content {
-
-namespace {
-
-base::PlatformFile PlatformFileFromScopedPlatformHandle(
-    mojo::embedder::ScopedPlatformHandle handle) {
-#if defined(OS_POSIX)
-  return handle.release().fd;
-#elif defined(OS_WIN)
-  return handle.release().handle;
-#endif
-}
-
-}  // namespace
-
-struct RenderProcessHostMojoImpl::PendingHandle {
-  PendingHandle() : view_routing_id(0) {}
-
-  int32 view_routing_id;
-  mojo::ScopedMessagePipeHandle handle;
-};
-
-RenderProcessHostMojoImpl::RenderProcessHostMojoImpl(RenderProcessHost* host)
-    : host_(host) {
-}
-
-RenderProcessHostMojoImpl::~RenderProcessHostMojoImpl() {
-}
-
-void RenderProcessHostMojoImpl::SetWebUIHandle(
-    int32 view_routing_id,
-    mojo::ScopedMessagePipeHandle handle) {
-  base::ProcessHandle process = host_->GetHandle();
-  if (process != base::kNullProcessHandle) {
-    CreateMojoChannel(process);  // Does nothing if already connected.
-    if (!render_process_mojo_.is_null()) {
-      render_process_mojo_->SetWebUIHandle(view_routing_id, handle.Pass());
-      return;
-    }
-  }
-
-  // Remember the request, we'll attempt to reconnect once the child process is
-  // launched.
-  pending_handle_.reset(new PendingHandle);
-  pending_handle_->view_routing_id = view_routing_id;
-  pending_handle_->handle = handle.Pass();
-}
-
-void RenderProcessHostMojoImpl::OnProcessLaunched() {
-  if (pending_handle_) {
-    scoped_ptr<PendingHandle> handle(pending_handle_.Pass());
-    SetWebUIHandle(handle->view_routing_id, handle->handle.Pass());
-  }
-}
-
-
-void RenderProcessHostMojoImpl::CreateMojoChannel(
-    base::ProcessHandle process_handle) {
-  if (mojo_channel_init_.get())
-    return;
-
-  mojo::embedder::PlatformChannelPair channel_pair;
-  mojo_channel_init_.reset(new mojo::common::MojoChannelInit);
-  mojo_channel_init_->Init(
-      PlatformFileFromScopedPlatformHandle(channel_pair.PassServerHandle()),
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO));
-  if (!mojo_channel_init_->is_handle_valid())
-    return;
-  base::PlatformFile client_file =
-      PlatformFileFromScopedPlatformHandle(channel_pair.PassClientHandle());
-  host_->Send(new MojoMsg_ChannelCreated(
-                  IPC::GetFileHandleForProcess(client_file, process_handle,
-                                               true)));
-  ScopedRenderProcessMojoHandle render_process_handle(
-      RenderProcessMojoHandle(
-          mojo_channel_init_->bootstrap_message_pipe().release().value()));
-  render_process_mojo_.reset(render_process_handle.Pass(), this);
-}
-
-}  // namespace content
diff --git a/content/browser/renderer_host/render_process_host_mojo_impl.h b/content/browser/renderer_host/render_process_host_mojo_impl.h
deleted file mode 100644
index f55268d..0000000
--- a/content/browser/renderer_host/render_process_host_mojo_impl.h
+++ /dev/null
@@ -1,58 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_RENDERER_HOST_BROWSER_RENDER_PROCESS_HOST_MOJO_IMPL_H_
-#define CONTENT_BROWSER_RENDERER_HOST_BROWSER_RENDER_PROCESS_HOST_MOJO_IMPL_H_
-
-#include "base/memory/scoped_ptr.h"
-#include "base/process/process_handle.h"
-#include "content/common/mojo/render_process.mojom.h"
-#include "mojo/public/cpp/bindings/remote_ptr.h"
-
-namespace mojo {
-namespace common {
-class MojoChannelInit;
-}
-}
-
-namespace content {
-
-class RenderProcessHost;
-
-// RenderProcessHostMojoImpl is responsible for initiating and maintaining the
-// connection with the content side of RenderProcessHostMojo.
-class RenderProcessHostMojoImpl : public RenderProcessHostMojo {
- public:
-  explicit RenderProcessHostMojoImpl(RenderProcessHost* host);
-  virtual ~RenderProcessHostMojoImpl();
-
-  void SetWebUIHandle(int32 view_routing_id,
-                      mojo::ScopedMessagePipeHandle handle);
-
-  // Invoked when the RenderPorcessHost has established a channel.
-  void OnProcessLaunched();
-
-private:
-  struct PendingHandle;
-
-  // Establishes the mojo channel to the renderer.
-  void CreateMojoChannel(base::ProcessHandle process_handle);
-
-  RenderProcessHost* host_;
-
-  // Used to establish the connection.
-  scoped_ptr<mojo::common::MojoChannelInit> mojo_channel_init_;
-
-  mojo::RemotePtr<content::RenderProcessMojo> render_process_mojo_;
-
-  // If non-null we're waiting to send a WebUI handle to the renderer when
-  // connected.
-  scoped_ptr<PendingHandle> pending_handle_;
-
-  DISALLOW_COPY_AND_ASSIGN(RenderProcessHostMojoImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_RENDERER_HOST_BROWSER_RENDER_PROCESS_HOST_MOJO_IMPL_H_
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index f88e2c9..074ebfa 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -46,9 +46,11 @@
 #include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/inter_process_time_ticks_converter.h"
+#include "content/common/mojo/mojo_service_names.h"
 #include "content/common/speech_recognition_messages.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/common/view_messages.h"
+#include "content/common/web_ui_setup.mojom.h"
 #include "content/port/browser/render_view_host_delegate_view.h"
 #include "content/port/browser/render_widget_host_view_port.h"
 #include "content/public/browser/ax_event_notification_details.h"
@@ -693,9 +695,13 @@ void RenderViewHostImpl::SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) {
   }
 
   DCHECK(renderer_initialized_);
-  RenderProcessHostImpl* process =
-      static_cast<RenderProcessHostImpl*>(GetProcess());
-  process->SetWebUIHandle(GetRoutingID(), handle.Pass());
+
+  mojo::InterfacePipe<WebUISetup, mojo::AnyInterface> pipe;
+  mojo::RemotePtr<WebUISetup> web_ui_setup(pipe.handle_to_self.Pass(), NULL);
+  web_ui_setup->SetWebUIHandle(GetRoutingID(), handle.Pass());
+
+  static_cast<RenderProcessHostImpl*>(GetProcess())->ConnectTo(
+      kRendererService_WebUISetup, pipe.handle_to_peer.Pass());
 }
 
 #if defined(OS_ANDROID)
diff --git a/content/child/child_thread.cc b/content/child/child_thread.cc
index 72be9fb..4bced8c 100644
--- a/content/child/child_thread.cc
+++ b/content/child/child_thread.cc
@@ -29,6 +29,7 @@
 #include "content/child/child_resource_message_filter.h"
 #include "content/child/child_shared_bitmap_manager.h"
 #include "content/child/fileapi/file_system_dispatcher.h"
+#include "content/child/mojo/mojo_application.h"
 #include "content/child/power_monitor_broadcast_source.h"
 #include "content/child/quota_dispatcher.h"
 #include "content/child/quota_message_filter.h"
@@ -236,6 +237,8 @@ void ChildThread::Init() {
     IPC::Logging::GetInstance()->SetIPCSender(this);
 #endif
 
+  mojo_application_.reset(new MojoApplication(this));
+
   sync_message_filter_ =
       new IPC::SyncMessageFilter(ChildProcess::current()->GetShutDownEvent());
   thread_safe_sender_ = new ThreadSafeSender(
@@ -349,6 +352,13 @@ void ChildThread::OnChannelError() {
   base::MessageLoop::current()->Quit();
 }
 
+void ChildThread::AcceptConnection(
+    const mojo::String& service_name,
+    mojo::ScopedMessagePipeHandle message_pipe) {
+  // By default, we don't expect incoming connections.
+  NOTREACHED();
+}
+
 bool ChildThread::Send(IPC::Message* msg) {
   DCHECK(base::MessageLoop::current() == message_loop());
   if (!channel_) {
@@ -409,6 +419,9 @@ base::SharedMemory* ChildThread::AllocateSharedMemory(
 }
 
 bool ChildThread::OnMessageReceived(const IPC::Message& msg) {
+  if (mojo_application_->OnMessageReceived(msg))
+    return true;
+
   // Resource responses are sent to the resource dispatcher.
   if (resource_dispatcher_->OnMessageReceived(msg))
     return true;
diff --git a/content/child/child_thread.h b/content/child/child_thread.h
index f8d9bf4..6af7016 100644
--- a/content/child/child_thread.h
+++ b/content/child/child_thread.h
@@ -16,6 +16,7 @@
 #include "content/common/content_export.h"
 #include "content/common/message_router.h"
 #include "ipc/ipc_message.h"  // For IPC_MESSAGE_LOG_ENABLED.
+#include "mojo/public/interfaces/shell/shell.mojom.h"
 
 namespace base {
 class MessageLoop;
@@ -43,6 +44,7 @@ class ChildHistogramMessageFilter;
 class ChildResourceMessageFilter;
 class ChildSharedBitmapManager;
 class FileSystemDispatcher;
+class MojoApplication;
 class ServiceWorkerDispatcher;
 class ServiceWorkerMessageFilter;
 class QuotaDispatcher;
@@ -54,7 +56,9 @@ class WebSocketDispatcher;
 struct RequestInfo;
 
 // The main thread of a child process derives from this class.
-class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
+class CONTENT_EXPORT ChildThread : public IPC::Listener,
+                                   public IPC::Sender,
+                                   public mojo::ShellClient {
  public:
   // Creates the thread.
   ChildThread();
@@ -170,6 +174,11 @@ class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
   virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
   virtual void OnChannelError() OVERRIDE;
 
+  // mojo::ShellClient implementation:
+  virtual void AcceptConnection(
+      const mojo::String& service_name,
+      mojo::ScopedMessagePipeHandle message_pipe) OVERRIDE;
+
  private:
   class ChildThreadMessageRouter : public MessageRouter {
    public:
@@ -197,6 +206,8 @@ class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
 
   void EnsureConnected();
 
+  scoped_ptr<MojoApplication> mojo_application_;
+
   std::string channel_name_;
   scoped_ptr<IPC::SyncChannel> channel_;
 
diff --git a/content/child/mojo/mojo_application.cc b/content/child/mojo/mojo_application.cc
new file mode 100644
index 0000000..1d61c0b
--- /dev/null
+++ b/content/child/mojo/mojo_application.cc
@@ -0,0 +1,45 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/mojo/mojo_application.h"
+
+#include "content/child/child_process.h"
+#include "content/common/mojo/mojo_messages.h"
+#include "ipc/ipc_message.h"
+
+namespace content {
+
+MojoApplication::MojoApplication(mojo::ShellClient* shell_client)
+    : shell_client_(shell_client) {
+}
+
+MojoApplication::~MojoApplication() {
+}
+
+bool MojoApplication::OnMessageReceived(const IPC::Message& msg) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(MojoApplication, msg)
+    IPC_MESSAGE_HANDLER(MojoMsg_Activate, OnActivate)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+void MojoApplication::OnActivate(
+    const IPC::PlatformFileForTransit& file) {
+#if defined(OS_POSIX)
+  base::PlatformFile handle = file.fd;
+#elif defined(OS_WIN)
+  base::PlatformFile handle = file;
+#endif
+  mojo::ScopedMessagePipeHandle message_pipe =
+      channel_init_.Init(handle,
+                         ChildProcess::current()->io_message_loop_proxy());
+  DCHECK(message_pipe.is_valid());
+
+  shell_.reset(
+      mojo::ScopedShellHandle::From(message_pipe.Pass()), shell_client_);
+}
+
+}  // namespace content
diff --git a/content/child/mojo/mojo_application.h b/content/child/mojo/mojo_application.h
new file mode 100644
index 0000000..fad9888
--- /dev/null
+++ b/content/child/mojo/mojo_application.h
@@ -0,0 +1,47 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
+#define CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
+
+#include "ipc/ipc_platform_file.h"
+#include "mojo/common/channel_init.h"
+#include "mojo/public/cpp/bindings/remote_ptr.h"
+#include "mojo/public/interfaces/shell/shell.mojom.h"
+
+namespace IPC {
+class Message;
+}
+
+namespace content {
+
+// MojoApplication represents the code needed to setup a child process as a
+// Mojo application via Chrome IPC. Instantiate MojoApplication and call its
+// OnMessageReceived method to give it a shot at handling Chrome IPC messages.
+// It makes the mojo::Shell interface available and calls methods on the given
+// mojo::ShellClient interface as calls come in.
+class MojoApplication {
+ public:
+  // The ShellClient pointer must remain valid for the lifetime of the
+  // MojoApplication instance.
+  explicit MojoApplication(mojo::ShellClient* shell_client);
+  ~MojoApplication();
+
+  bool OnMessageReceived(const IPC::Message& msg);
+
+  mojo::Shell* shell() { return shell_.get(); }
+
+ private:
+  void OnActivate(const IPC::PlatformFileForTransit& file);
+
+  mojo::common::ChannelInit channel_init_;
+  mojo::RemotePtr<mojo::Shell> shell_;
+  mojo::ShellClient* shell_client_;
+
+  DISALLOW_COPY_AND_ASSIGN(MojoApplication);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
diff --git a/content/common/mojo/mojo_messages.h b/content/common/mojo/mojo_messages.h
index 6e7685b..e9657da 100644
--- a/content/common/mojo/mojo_messages.h
+++ b/content/common/mojo/mojo_messages.h
@@ -19,5 +19,6 @@
 
 #define IPC_MESSAGE_START MojoMsgStart
 
-IPC_MESSAGE_CONTROL1(MojoMsg_ChannelCreated,
+// Mojo IPC is bootstrapped over Chrome IPC via this message.
+IPC_MESSAGE_CONTROL1(MojoMsg_Activate,
                      IPC::PlatformFileForTransit /* handle */);
diff --git a/content/common/mojo/mojo_service_names.cc b/content/common/mojo/mojo_service_names.cc
new file mode 100644
index 0000000..26ff68f
--- /dev/null
+++ b/content/common/mojo/mojo_service_names.cc
@@ -0,0 +1,13 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/mojo/mojo_service_names.h"
+
+namespace content {
+
+// Renderer-provided services:
+
+const char kRendererService_WebUISetup[] = "content:web_ui_setup";
+
+}  // namespace content
diff --git a/content/common/mojo/mojo_service_names.h b/content/common/mojo/mojo_service_names.h
new file mode 100644
index 0000000..787b67d
--- /dev/null
+++ b/content/common/mojo/mojo_service_names.h
@@ -0,0 +1,18 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_SERVICE_CONSTANTS_H_
+#define CONTENT_COMMON_SERVICE_CONSTANTS_H_
+
+namespace content {
+
+// ----------------------------------------------------------------------------
+// Renderer-provided services:
+
+// WebUISetup <-> WebUISetupClient
+extern const char kRendererService_WebUISetup[];
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_SERVICE_CONSTANTS_H_
diff --git a/content/common/mojo/render_process.mojom b/content/common/mojo/render_process.mojom
deleted file mode 100644
index 1ad9e55..0000000
--- a/content/common/mojo/render_process.mojom
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content {
-
-[Peer=RenderProcessMojo]
-interface RenderProcessHostMojo {
-};
-
-[Peer=RenderProcessHostMojo]
-interface RenderProcessMojo {
-  SetWebUIHandle(int32 view_routing_id,
-                 handle<message_pipe> browser_web_ui_handle);
-};
-
-}
diff --git a/content/common/web_ui_setup.mojom b/content/common/web_ui_setup.mojom
new file mode 100644
index 0000000..d61d96c
--- /dev/null
+++ b/content/common/web_ui_setup.mojom
@@ -0,0 +1,16 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content {
+
+[Peer=WebUISetup]
+interface WebUISetupClient {
+};
+
+[Peer=WebUISetupClient]
+interface WebUISetup {
+  SetWebUIHandle(int32 view_routing_id, handle<message_pipe> web_ui_handle);
+};
+
+}
diff --git a/content/content_app.gypi b/content/content_app.gypi
index ad443e2..4d10317 100644
--- a/content/content_app.gypi
+++ b/content/content_app.gypi
@@ -69,6 +69,7 @@
       'dependencies': [
         '../mojo/mojo.gyp:mojo_environment_chromium',
         '../mojo/mojo.gyp:mojo_service_manager',
+        '../mojo/mojo.gyp:mojo_shell_bindings',
         '../mojo/mojo.gyp:mojo_system_impl',
      ],
     }],
diff --git a/content/content_browser.gypi b/content/content_browser.gypi
index 9771856..139f946 100644
--- a/content/content_browser.gypi
+++ b/content/content_browser.gypi
@@ -808,6 +808,8 @@
     'browser/message_port_service.h',
     'browser/mime_registry_message_filter.cc',
     'browser/mime_registry_message_filter.h',
+    'browser/mojo/mojo_application_host.cc',
+    'browser/mojo/mojo_application_host.h',
     'browser/net/browser_online_state_observer.cc',
     'browser/net/browser_online_state_observer.h',
     'browser/net/sqlite_persistent_cookie_store.cc',
@@ -1075,8 +1077,6 @@
     'browser/renderer_host/render_message_filter.h',
     'browser/renderer_host/render_process_host_impl.cc',
     'browser/renderer_host/render_process_host_impl.h',
-    'browser/renderer_host/render_process_host_mojo_impl.cc',
-    'browser/renderer_host/render_process_host_mojo_impl.h',
     'browser/renderer_host/render_sandbox_host_linux.cc',
     'browser/renderer_host/render_sandbox_host_linux.h',
     'browser/renderer_host/render_process_host_impl.h',
@@ -1413,6 +1413,7 @@
         'content_common_mojo_bindings',
         '../cc/cc.gyp:cc',
         '../mojo/mojo.gyp:mojo_bindings',
+        '../mojo/mojo.gyp:mojo_shell_bindings',
         '../net/net.gyp:http_server',
         '../third_party/leveldatabase/leveldatabase.gyp:leveldatabase',
         '../ui/surface/surface.gyp:surface',
diff --git a/content/content_child.gypi b/content/content_child.gypi
index 575e5ff..c46451c 100644
--- a/content/content_child.gypi
+++ b/content/content_child.gypi
@@ -6,6 +6,8 @@
   'dependencies': [
     '../base/base.gyp:base',
     '../components/tracing.gyp:tracing',
+    '../mojo/mojo.gyp:mojo_environment_chromium',
+    '../mojo/mojo.gyp:mojo_shell_bindings',
     '../skia/skia.gyp:skia',
     '../ui/base/ui_base.gyp:ui_base',
     '../ui/gfx/gfx.gyp:gfx',
@@ -79,6 +81,8 @@
     'child/indexed_db/webidbdatabase_impl.h',
     'child/indexed_db/webidbfactory_impl.cc',
     'child/indexed_db/webidbfactory_impl.h',
+    'child/mojo/mojo_application.cc',
+    'child/mojo/mojo_application.h',
     'child/npapi/np_channel_base.cc',
     'child/npapi/np_channel_base.h',
     'child/npapi/npobject_base.h',
diff --git a/content/content_common.gypi b/content/content_common.gypi
index a4d16c3..c9aa6a7 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -352,6 +352,8 @@
     'common/message_router.h',
     'common/mime_registry_messages.h',
     'common/mojo/mojo_messages.h',
+    'common/mojo/mojo_service_names.cc',
+    'common/mojo/mojo_service_names.h',
     'common/navigation_gesture.h',
     'common/net/url_fetcher.cc',
     'common/net/url_request_user_data.cc',
diff --git a/content/content_common_mojo_bindings.gypi b/content/content_common_mojo_bindings.gypi
index 71d9225..6e0a62a 100644
--- a/content/content_common_mojo_bindings.gypi
+++ b/content/content_common_mojo_bindings.gypi
@@ -12,7 +12,7 @@
         '../mojo/mojo.gyp:mojo_environment_chromium',
       ],
       'sources': [
-        'common/mojo/render_process.mojom',
+        'common/web_ui_setup.mojom',
       ],
       # TODO(sky): this shouldn't be necessary. It's working around a bug in
       # gyp.
diff --git a/content/content_gpu.gypi b/content/content_gpu.gypi
index 1cc6de6..14ae896 100644
--- a/content/content_gpu.gypi
+++ b/content/content_gpu.gypi
@@ -5,6 +5,7 @@
 {
   'dependencies': [
     '../base/base.gyp:base',
+    '../mojo/mojo.gyp:mojo_shell_bindings',
     '../skia/skia.gyp:skia',
     '../ui/gl/gl.gyp:gl',
   ],
diff --git a/content/content_plugin.gypi b/content/content_plugin.gypi
index 2b53523..a8fa444 100644
--- a/content/content_plugin.gypi
+++ b/content/content_plugin.gypi
@@ -6,6 +6,7 @@
   'conditions': [
     ['enable_plugins==1 and OS!="linux"', {
       'dependencies': [
+        '../mojo/mojo.gyp:mojo_shell_bindings',
         '../skia/skia.gyp:skia',
         '../third_party/WebKit/public/blink.gyp:blink',
         '../third_party/npapi/npapi.gyp:npapi',
diff --git a/content/content_ppapi_plugin.gypi b/content/content_ppapi_plugin.gypi
index 578ffd0..0757a7d 100644
--- a/content/content_ppapi_plugin.gypi
+++ b/content/content_ppapi_plugin.gypi
@@ -7,6 +7,7 @@
     ['enable_plugins==1', {
       'dependencies': [
         '../base/base.gyp:base',
+        '../mojo/mojo.gyp:mojo_shell_bindings',
         '../ppapi/ppapi_internal.gyp:ppapi_ipc',
         '../ui/base/ui_base.gyp:ui_base',
         '../ui/gfx/gfx.gyp:gfx',
diff --git a/content/content_renderer.gypi b/content/content_renderer.gypi
index 8f86f8b..f45e51b 100644
--- a/content/content_renderer.gypi
+++ b/content/content_renderer.gypi
@@ -10,6 +10,7 @@
     '../media/media.gyp:media',
     '../mojo/mojo.gyp:mojo_environment_chromium',
     '../mojo/mojo.gyp:mojo_js_bindings_lib',
+    '../mojo/mojo.gyp:mojo_shell_bindings',
     '../net/net.gyp:net',
     '../skia/skia.gyp:skia',
     '../third_party/WebKit/public/blink.gyp:blink',
@@ -313,8 +314,6 @@
     'renderer/menu_item_builder.h',
     'renderer/mhtml_generator.cc',
     'renderer/mhtml_generator.h',
-    'renderer/mojo/mojo_render_process_observer.cc',
-    'renderer/mojo/mojo_render_process_observer.h',
     'renderer/mouse_lock_dispatcher.cc',
     'renderer/mouse_lock_dispatcher.h',
     'renderer/notification_provider.cc',
@@ -537,6 +536,8 @@
     'renderer/web_ui_mojo_context_state.h',
     'renderer/web_ui_runner.cc',
     'renderer/web_ui_runner.h',
+    'renderer/web_ui_setup_impl.cc',
+    'renderer/web_ui_setup_impl.h',
     'renderer/webclipboard_impl.cc',
     'renderer/webclipboard_impl.h',
     'renderer/webgraphicscontext3d_provider_impl.cc',
diff --git a/content/content_tests.gypi b/content/content_tests.gypi
index 76ff48d..58490de 100644
--- a/content/content_tests.gypi
+++ b/content/content_tests.gypi
@@ -22,6 +22,7 @@
           ],
           'include_dirs': [
             '..',
+            '<(SHARED_INTERMEDIATE_DIR)',
           ],
           'sources': [
             'public/test/layouttest_support.h',
diff --git a/content/content_utility.gypi b/content/content_utility.gypi
index 2d2a7c0..513c240 100644
--- a/content/content_utility.gypi
+++ b/content/content_utility.gypi
@@ -6,6 +6,7 @@
   'dependencies': [
     '../base/base.gyp:base',
     '../courgette/courgette.gyp:courgette_lib',
+    '../mojo/mojo.gyp:mojo_shell_bindings',
   ],
   'sources': [
     'public/utility/content_utility_client.cc',
diff --git a/content/content_worker.gypi b/content/content_worker.gypi
index 95d5292..5264a2c 100644
--- a/content/content_worker.gypi
+++ b/content/content_worker.gypi
@@ -5,6 +5,7 @@
 {
   'dependencies': [
     '../base/base.gyp:base',
+    '../mojo/mojo.gyp:mojo_shell_bindings',
     '../skia/skia.gyp:skia',
     '../third_party/WebKit/public/blink.gyp:blink',
   ],
diff --git a/content/public/test/content_test_suite_base.cc b/content/public/test/content_test_suite_base.cc
index 9f9be53..9307e53 100644
--- a/content/public/test/content_test_suite_base.cc
+++ b/content/public/test/content_test_suite_base.cc
@@ -10,9 +10,6 @@
 #include "base/test/test_suite.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "content/browser/browser_thread_impl.h"
-#include "content/browser/gpu/gpu_process_host.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
-#include "content/browser/utility_process_host_impl.h"
 #include "content/common/url_schemes.h"
 #include "content/gpu/in_process_gpu_thread.h"
 #include "content/public/common/content_client.h"
@@ -21,6 +18,12 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/ui_base_paths.h"
 
+#if !defined(OS_IOS)
+#include "content/browser/gpu/gpu_process_host.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
+#include "content/browser/utility_process_host_impl.h"
+#endif
+
 #if defined(OS_ANDROID)
 #include "base/android/jni_android.h"
 #include "content/browser/android/browser_jni_registrar.h"
diff --git a/content/renderer/mojo/mojo_render_process_observer.cc b/content/renderer/mojo/mojo_render_process_observer.cc
deleted file mode 100644
index 9790787..0000000
--- a/content/renderer/mojo/mojo_render_process_observer.cc
+++ /dev/null
@@ -1,72 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/mojo/mojo_render_process_observer.h"
-
-#include "base/message_loop/message_loop.h"
-#include "content/child/child_process.h"
-#include "content/common/mojo/mojo_messages.h"
-#include "content/public/renderer/render_thread.h"
-#include "content/public/renderer/render_view.h"
-#include "content/renderer/web_ui_mojo.h"
-#include "mojo/common/mojo_channel_init.h"
-
-namespace content {
-
-MojoRenderProcessObserver::MojoRenderProcessObserver(
-    RenderThread* render_thread)
-    : render_thread_(render_thread) {
-  render_thread_->AddObserver(this);
-}
-
-bool MojoRenderProcessObserver::OnControlMessageReceived(
-    const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(MojoRenderProcessObserver, message)
-    IPC_MESSAGE_HANDLER(MojoMsg_ChannelCreated, OnChannelCreated)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void MojoRenderProcessObserver::OnRenderProcessShutdown() {
-  delete this;
-}
-
-MojoRenderProcessObserver::~MojoRenderProcessObserver() {
-  render_thread_->RemoveObserver(this);
-}
-
-void MojoRenderProcessObserver::OnChannelCreated(
-    const IPC::PlatformFileForTransit& file) {
-#if defined(OS_POSIX)
-  base::PlatformFile handle = file.fd;
-#elif defined(OS_WIN)
-  base::PlatformFile handle = file;
-#endif
-  DCHECK(!channel_init_.get());
-  channel_init_.reset(new mojo::common::MojoChannelInit);
-  channel_init_->Init(handle, ChildProcess::current()->io_message_loop_proxy());
-  if (!channel_init_->is_handle_valid())
-    return;
-
-  ScopedRenderProcessHostMojoHandle render_process_host_handle(
-      RenderProcessHostMojoHandle(
-          channel_init_->bootstrap_message_pipe().release().value()));
-  render_process_host_mojo_.reset(render_process_host_handle.Pass(), this);
-}
-
-void MojoRenderProcessObserver::SetWebUIHandle(
-    int32 view_routing_id,
-    mojo::ScopedMessagePipeHandle web_ui_handle) {
-  RenderView* render_view = RenderView::FromRoutingID(view_routing_id);
-  if (!render_view)
-    return;
-  WebUIMojo* web_ui_mojo = WebUIMojo::Get(render_view);
-  if (!web_ui_mojo)
-    return;
-  web_ui_mojo->SetBrowserHandle(web_ui_handle.Pass());
-}
-
-}  // namespace content
diff --git a/content/renderer/mojo/mojo_render_process_observer.h b/content/renderer/mojo/mojo_render_process_observer.h
deleted file mode 100644
index a66a98d..0000000
--- a/content/renderer/mojo/mojo_render_process_observer.h
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MOJO_MOJO_RENDER_PROCESS_OBSERVER_H_
-#define CONTENT_RENDERER_MOJO_MOJO_RENDER_PROCESS_OBSERVER_H_
-
-#include "base/memory/scoped_ptr.h"
-#include "content/common/mojo/render_process.mojom.h"
-#include "content/public/renderer/render_process_observer.h"
-#include "ipc/ipc_platform_file.h"
-#include "mojo/public/cpp/bindings/remote_ptr.h"
-
-namespace mojo {
-namespace common {
-class MojoChannelInit;
-}
-namespace embedder {
-struct ChannelInfo;
-}
-}
-
-namespace content {
-
-class RenderThread;
-
-// RenderProcessObserver implementation that initializes the mojo channel when
-// the right IPC is seen.
-// MojoRenderProcessObserver deletes itself when the RenderProcess is shutdown.
-class MojoRenderProcessObserver
-    : public content::RenderProcessObserver,
-      public RenderProcessMojo {
- public:
-  MojoRenderProcessObserver(RenderThread* render_thread);
-
-  // RenderProcessObserver overrides:
-  virtual bool OnControlMessageReceived(const IPC::Message& message) OVERRIDE;
-  virtual void OnRenderProcessShutdown() OVERRIDE;
-
- private:
-  virtual ~MojoRenderProcessObserver();
-
-  void OnChannelCreated(const IPC::PlatformFileForTransit& file);
-
-  // RenderProcessMojo overrides:
-  virtual void SetWebUIHandle(
-      int32 view_routing_id,
-      mojo::ScopedMessagePipeHandle web_ui_handle) OVERRIDE;
-
-  content::RenderThread* render_thread_;
-
-  scoped_ptr<mojo::common::MojoChannelInit> channel_init_;
-
-  mojo::RemotePtr<content::RenderProcessHostMojo> render_process_host_mojo_;
-
-  DISALLOW_COPY_AND_ASSIGN(MojoRenderProcessObserver);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MOJO_MOJO_RENDER_PROCESS_OBSERVER_H_
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 8122735..455c20d 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -51,6 +51,7 @@
 #include "content/common/gpu/client/gpu_memory_buffer_impl.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/gpu/gpu_process_launch_causes.h"
+#include "content/common/mojo/mojo_service_names.h"
 #include "content/common/resource_messages.h"
 #include "content/common/view_messages.h"
 #include "content/common/worker_messages.h"
@@ -82,7 +83,6 @@
 #include "content/renderer/media/video_capture_impl_manager.h"
 #include "content/renderer/media/video_capture_message_filter.h"
 #include "content/renderer/media/webrtc_identity_service.h"
-#include "content/renderer/mojo/mojo_render_process_observer.h"
 #include "content/renderer/p2p/socket_dispatcher.h"
 #include "content/renderer/render_process_impl.h"
 #include "content/renderer/render_view_impl.h"
@@ -90,6 +90,7 @@
 #include "content/renderer/service_worker/embedded_worker_context_message_filter.h"
 #include "content/renderer/service_worker/embedded_worker_dispatcher.h"
 #include "content/renderer/shared_worker/embedded_shared_worker_stub.h"
+#include "content/renderer/web_ui_setup_impl.h"
 #include "grit/content_resources.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_forwarding_message_filter.h"
@@ -97,6 +98,7 @@
 #include "media/base/audio_hardware_config.h"
 #include "media/base/media.h"
 #include "media/filters/gpu_video_accelerator_factories.h"
+#include "mojo/common/common_type_converters.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "skia/ext/event_tracer_impl.h"
@@ -394,9 +396,6 @@ void RenderThreadImpl::Init() {
 
   AddFilter((new EmbeddedWorkerContextMessageFilter())->GetFilter());
 
-  // MojoRenderProcessObserver deletes itself as necessary.
-  new MojoRenderProcessObserver(this);
-
   GetContentClient()->renderer()->RenderThreadStarted();
 
   InitSkiaEventTracer();
@@ -1202,6 +1201,17 @@ scoped_ptr<gfx::GpuMemoryBuffer> RenderThreadImpl::AllocateGpuMemoryBuffer(
       internalformat).PassAs<gfx::GpuMemoryBuffer>();
 }
 
+void RenderThreadImpl::AcceptConnection(
+    const mojo::String& service_name,
+    mojo::ScopedMessagePipeHandle message_pipe) {
+  // TODO(darin): Invent some kind of registration system to use here.
+  if (service_name.To<base::StringPiece>() == kRendererService_WebUISetup) {
+    WebUISetupImpl::Bind(message_pipe.Pass());
+  } else {
+    NOTREACHED() << "Unknown service name";
+  }
+}
+
 void RenderThreadImpl::DoNotSuspendWebKitSharedTimer() {
   suspend_webkit_shared_timer_ = false;
 }
diff --git a/content/renderer/render_thread_impl.h b/content/renderer/render_thread_impl.h
index 4c945b1..a816bfe 100644
--- a/content/renderer/render_thread_impl.h
+++ b/content/renderer/render_thread_impl.h
@@ -401,6 +401,11 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
       size_t height,
       unsigned internalformat) OVERRIDE;
 
+  // mojo::ShellClient implementation:
+  virtual void AcceptConnection(
+      const mojo::String& service_name,
+      mojo::ScopedMessagePipeHandle message_pipe) OVERRIDE;
+
   void Init();
 
   void OnSetZoomLevelForCurrentURL(const std::string& scheme,
diff --git a/content/renderer/web_ui_setup_impl.cc b/content/renderer/web_ui_setup_impl.cc
new file mode 100644
index 0000000..e4c065f
--- /dev/null
+++ b/content/renderer/web_ui_setup_impl.cc
@@ -0,0 +1,41 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/web_ui_setup_impl.h"
+
+#include "content/public/renderer/render_view.h"
+#include "content/renderer/web_ui_mojo.h"
+
+namespace content {
+
+// static
+void WebUISetupImpl::Bind(mojo::ScopedMessagePipeHandle handle) {
+  // This instance will be destroyed when the pipe is closed. See OnError.
+  new WebUISetupImpl(handle.Pass());
+}
+
+WebUISetupImpl::WebUISetupImpl(mojo::ScopedMessagePipeHandle handle)
+    : client_(ScopedWebUISetupClientHandle::From(handle.Pass()), this) {
+}
+
+WebUISetupImpl::~WebUISetupImpl() {
+}
+
+void WebUISetupImpl::SetWebUIHandle(
+    int32 view_routing_id,
+    mojo::ScopedMessagePipeHandle web_ui_handle) {
+  RenderView* render_view = RenderView::FromRoutingID(view_routing_id);
+  if (!render_view)
+    return;
+  WebUIMojo* web_ui_mojo = WebUIMojo::Get(render_view);
+  if (!web_ui_mojo)
+    return;
+  web_ui_mojo->SetBrowserHandle(web_ui_handle.Pass());
+}
+
+void WebUISetupImpl::OnError() {
+  delete this;
+}
+
+}  // namespace content
diff --git a/content/renderer/web_ui_setup_impl.h b/content/renderer/web_ui_setup_impl.h
new file mode 100644
index 0000000..1bfc6ca
--- /dev/null
+++ b/content/renderer/web_ui_setup_impl.h
@@ -0,0 +1,39 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
+#define CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
+
+#include "base/basictypes.h"
+#include "content/common/web_ui_setup.mojom.h"
+#include "mojo/public/cpp/bindings/error_handler.h"
+#include "mojo/public/cpp/bindings/remote_ptr.h"
+
+namespace content {
+
+class WebUISetupImpl : public WebUISetup,
+                       public mojo::ErrorHandler {
+ public:
+  static void Bind(mojo::ScopedMessagePipeHandle handle);
+
+ private:
+  explicit WebUISetupImpl(mojo::ScopedMessagePipeHandle handle);
+  virtual ~WebUISetupImpl();
+
+  // WebUISetup methods:
+  virtual void SetWebUIHandle(
+      int32_t view_routing_id,
+      mojo::ScopedMessagePipeHandle web_ui_handle) OVERRIDE;
+
+  // mojo::ErrorHandler methods:
+  virtual void OnError() OVERRIDE;
+
+  mojo::RemotePtr<WebUISetupClient> client_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebUISetupImpl);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
diff --git a/mojo/common/mojo_channel_init.cc b/mojo/common/channel_init.cc
index 96190f9..7eef2ae 100644
--- a/mojo/common/mojo_channel_init.cc
+++ b/mojo/common/channel_init.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "mojo/common/mojo_channel_init.h"
+#include "mojo/common/channel_init.h"
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
@@ -11,13 +11,12 @@
 namespace mojo {
 namespace common {
 
-MojoChannelInit::MojoChannelInit()
+ChannelInit::ChannelInit()
     : channel_info_(NULL),
       weak_factory_(this) {
 }
 
-MojoChannelInit::~MojoChannelInit() {
-  bootstrap_message_pipe_.reset();
+ChannelInit::~ChannelInit() {
   if (channel_info_) {
     io_thread_task_runner_->PostTask(
         FROM_HERE,
@@ -25,23 +24,24 @@ MojoChannelInit::~MojoChannelInit() {
   }
 }
 
-void MojoChannelInit::Init(
+mojo::ScopedMessagePipeHandle ChannelInit::Init(
     base::PlatformFile file,
     scoped_refptr<base::TaskRunner> io_thread_task_runner) {
   DCHECK(!io_thread_task_runner_.get());  // Should only init once.
   io_thread_task_runner_ = io_thread_task_runner;
-  bootstrap_message_pipe_ = mojo::embedder::CreateChannel(
+  mojo::ScopedMessagePipeHandle message_pipe = mojo::embedder::CreateChannel(
       mojo::embedder::ScopedPlatformHandle(
           mojo::embedder::PlatformHandle(file)),
       io_thread_task_runner,
-      base::Bind(&MojoChannelInit::OnCreatedChannel, weak_factory_.GetWeakPtr(),
+      base::Bind(&ChannelInit::OnCreatedChannel, weak_factory_.GetWeakPtr(),
                  io_thread_task_runner),
       base::MessageLoop::current()->message_loop_proxy()).Pass();
+  return message_pipe.Pass();
 }
 
 // static
-void MojoChannelInit::OnCreatedChannel(
-    base::WeakPtr<MojoChannelInit> host,
+void ChannelInit::OnCreatedChannel(
+    base::WeakPtr<ChannelInit> host,
     scoped_refptr<base::TaskRunner> io_thread,
     embedder::ChannelInfo* channel) {
   // By the time we get here |host| may have been destroyed. If so, shutdown the
diff --git a/mojo/common/mojo_channel_init.h b/mojo/common/channel_init.h
index 8fa0094..ca134cb 100644
--- a/mojo/common/mojo_channel_init.h
+++ b/mojo/common/channel_init.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef MOJO_COMMON_MOJO_CHANNEL_INIT_H_
-#define MOJO_COMMON_MOJO_CHANNEL_INIT_H_
+#ifndef MOJO_COMMON_CHANNEL_INIT_H_
+#define MOJO_COMMON_CHANNEL_INIT_H_
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
@@ -23,27 +23,23 @@ struct ChannelInfo;
 
 namespace common {
 
-// MojoChannelInit handle creation (and destruction) of the mojo channel. It is
+// ChannelInit handle creation (and destruction) of the mojo channel. It is
 // expected that this class is created and destroyed on the main thread.
-class MOJO_COMMON_EXPORT MojoChannelInit {
+class MOJO_COMMON_EXPORT ChannelInit {
  public:
-  MojoChannelInit();
-  ~MojoChannelInit();
+  ChannelInit();
+  ~ChannelInit();
 
-  // Inits the channel. This takes ownership of |file|.
-  void Init(base::PlatformFile file,
-            scoped_refptr<base::TaskRunner> io_thread_task_runner);
-
-  bool is_handle_valid() const { return bootstrap_message_pipe_.is_valid(); }
-
-  mojo::ScopedMessagePipeHandle bootstrap_message_pipe() {
-    return bootstrap_message_pipe_.Pass();
-  }
+  // Initializes the channel. This takes ownership of |file|. Returns the
+  // primordial MessagePipe for the channel.
+  mojo::ScopedMessagePipeHandle Init(
+      base::PlatformFile file,
+      scoped_refptr<base::TaskRunner> io_thread_task_runner);
 
  private:
   // Invoked on the main thread once the channel has been established.
   static void OnCreatedChannel(
-      base::WeakPtr<MojoChannelInit> host,
+      base::WeakPtr<ChannelInit> host,
       scoped_refptr<base::TaskRunner> io_thread,
       embedder::ChannelInfo* channel);
 
@@ -52,15 +48,12 @@ class MOJO_COMMON_EXPORT MojoChannelInit {
   // If non-null the channel has been established.
   embedder::ChannelInfo* channel_info_;
 
-  // The handle from channel creation.
-  mojo::ScopedMessagePipeHandle bootstrap_message_pipe_;
-
-  base::WeakPtrFactory<MojoChannelInit> weak_factory_;
+  base::WeakPtrFactory<ChannelInit> weak_factory_;
 
-  DISALLOW_COPY_AND_ASSIGN(MojoChannelInit);
+  DISALLOW_COPY_AND_ASSIGN(ChannelInit);
 };
 
 }  // namespace common
 }  // namespace mojo
 
-#endif  // MOJO_COMMON_MOJO_CHANNEL_INIT_H_
+#endif  // MOJO_COMMON_CHANNEL_INIT_H_
diff --git a/mojo/mojo.gyp b/mojo/mojo.gyp
index 4db1476..68e0e17 100644
--- a/mojo/mojo.gyp
+++ b/mojo/mojo.gyp
@@ -280,6 +280,8 @@
         'mojo_system_impl',
       ],
       'sources': [
+        'common/channel_init.cc',
+        'common/channel_init.h',
         'common/common_type_converters.cc',
         'common/common_type_converters.h',
         'common/environment_data.cc',
@@ -289,8 +291,6 @@
         'common/message_pump_mojo.cc',
         'common/message_pump_mojo.h',
         'common/message_pump_mojo_handler.h',
-        'common/mojo_channel_init.cc',
-        'common/mojo_channel_init.h',
         'common/time_helper.cc',
         'common/time_helper.h',
       ],