Revert 279557 "Support exposing Mojo services between render fra..."

Causing compile failure:
http://build.chromium.org/p/chromium.linux/builders/Android%20Builder%20%28dbg%29/builds/60210

> Support exposing Mojo services between render frames, render threads, and their respective hosts.
> 
> This introduces ServiceRegistry as an abstraction around providing
> services to and accessing services from a remote peer. In particular,
> this adds peered service registries to RenderProcessHost and
> RenderThread, and to RenderFrameHost and RenderFrame - the RenderFrame
> setup is implemented using the RenderProcessHost/RenderThread
> ServiceRegistry pair.
> 
> This replaces the existing WebUI handle setup by adding a webUI
> controller service to the frame host registry and a corresponding
> request for the webUI controller service to the frame registry.
> 
> BUG=386155
> 
> Review URL: https://codereview.chromium.org/285333003

TBR=sammc@chromium.org

Review URL: https://codereview.chromium.org/352013002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@279561 0039d316-1c4b-4281-b951-d872f2087c98

50 files changed, 288 insertions, 453 deletions

diff --git a/content/app/BUILD.gn b/content/app/BUILD.gn
index 981526f..13efa00 100644
--- a/content/app/BUILD.gn
+++ b/content/app/BUILD.gn
@@ -54,7 +54,7 @@ source_set("app") {
   } else {
     deps += [
       "//mojo/environment:chromium",
-      "//mojo/public/interfaces/interface_provider",
+      "//mojo/public/interfaces/service_provider:service_provider",
       "//mojo/service_manager",
       "//mojo/system",
     ]
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 7ec025c..325401f 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -86,7 +86,7 @@ source_set("browser") {
       "//cc",
       "//cc:cc_surfaces",
       "//mojo/public/cpp/bindings",
-      "//mojo/public/interfaces/interface_provider",
+      "//mojo/public/interfaces/service_provider:service_provider",
       "//mojo/public/js/bindings",
       "//net:http_server",
       "//third_party/icu",
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 9ffcbef..bfeee98 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -18,7 +18,6 @@
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/renderer_host/input/input_router.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/transition_request_manager.h"
@@ -26,7 +25,6 @@
 #include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/inter_process_time_ticks_converter.h"
-#include "content/common/render_frame_setup.mojom.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -164,16 +162,6 @@ RenderFrameHostImpl::RenderFrameHostImpl(
   g_routing_id_frame_map.Get().insert(std::make_pair(
       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
       this));
-
-  if (GetProcess()->GetServiceRegistry()) {
-    RenderFrameSetupPtr setup;
-    GetProcess()->GetServiceRegistry()->GetRemoteInterface(&setup);
-    mojo::IInterfaceProviderPtr service_provider;
-    setup->GetServiceProviderForFrame(routing_id_,
-                                      mojo::Get(&service_provider));
-    service_registry_.BindRemoteServiceProvider(
-        service_provider.PassMessagePipe());
-  }
 }
 
 RenderFrameHostImpl::~RenderFrameHostImpl() {
@@ -254,11 +242,6 @@ RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
   return render_view_host_;
 }
 
-ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
-  static_cast<RenderProcessHostImpl*>(GetProcess())->EnsureMojoActivated();
-  return &service_registry_;
-}
-
 bool RenderFrameHostImpl::Send(IPC::Message* message) {
   if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
     return render_view_host_->input_router()->SendInput(
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 092b630..b554511 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -14,7 +14,6 @@
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
-#include "content/common/mojo/service_registry_impl.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/javascript_message_type.h"
 #include "content/public/common/page_transition_types.h"
@@ -67,7 +66,6 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost {
       const base::string16& javascript,
       const JavaScriptResultCallback& callback) OVERRIDE;
   virtual RenderViewHost* GetRenderViewHost() OVERRIDE;
-  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // IPC::Sender
   virtual bool Send(IPC::Message* msg) OVERRIDE;
@@ -304,8 +302,6 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost {
   // When the last BeforeUnload message was sent.
   base::TimeTicks send_before_unload_start_time_;
 
-  ServiceRegistryImpl service_registry_;
-
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameHostImpl);
diff --git a/content/browser/mojo/mojo_application_host.cc b/content/browser/mojo/mojo_application_host.cc
index 2491252..90187b9 100644
--- a/content/browser/mojo/mojo_application_host.cc
+++ b/content/browser/mojo/mojo_application_host.cc
@@ -30,7 +30,7 @@ MojoApplicationHost::~MojoApplicationHost() {
 }
 
 bool MojoApplicationHost::Init() {
-  DCHECK(!client_handle_.is_valid()) << "Already initialized!";
+  DCHECK(!child_service_provider_.get()) << "Already initialized!";
 
   mojo::embedder::PlatformChannelPair channel_pair;
 
@@ -43,7 +43,8 @@ bool MojoApplicationHost::Init() {
   // Forward this to the client once we know its process handle.
   client_handle_ = channel_pair.PassClientHandle();
 
-  service_registry_.BindRemoteServiceProvider(message_pipe.Pass());
+  child_service_provider_.reset(
+      BindToPipe(new ServiceProviderImpl(), message_pipe.Pass()));
   return true;
 }
 
@@ -59,4 +60,12 @@ bool MojoApplicationHost::Activate(IPC::Sender* sender,
   return did_activate_;
 }
 
+void MojoApplicationHost::ServiceProviderImpl::ConnectToService(
+    const mojo::String& service_url,
+    const mojo::String& service_name,
+    mojo::ScopedMessagePipeHandle handle,
+    const mojo::String& requestor_url) {
+  // TODO(darin): Provide something meaningful here.
+}
+
 }  // namespace content
diff --git a/content/browser/mojo/mojo_application_host.h b/content/browser/mojo/mojo_application_host.h
index ae57104..f591326 100644
--- a/content/browser/mojo/mojo_application_host.h
+++ b/content/browser/mojo/mojo_application_host.h
@@ -6,9 +6,9 @@
 #define CONTENT_BROWSER_MOJO_MOJO_APPLICATION_HOST_H_
 
 #include "base/process/process_handle.h"
-#include "content/common/mojo/service_registry_impl.h"
 #include "mojo/embedder/channel_init.h"
 #include "mojo/embedder/scoped_platform_handle.h"
+#include "mojo/public/interfaces/service_provider/service_provider.mojom.h"
 
 namespace IPC {
 class Sender;
@@ -19,30 +19,48 @@ namespace content {
 // MojoApplicationHost represents the code needed on the browser side to setup
 // a child process as a Mojo application via Chrome IPC. The child process
 // should use MojoApplication to handle messages generated by an instance of
-// MojoApplicationHost. MojoApplicationHost makes the ServiceRegistry interface
-// available so that child-provided services can be invoked.
+// MojoApplicationHost. MojoApplicationHost makes the mojo::ShellClient
+// interface available so that child-provided services can be invoked.
 class MojoApplicationHost {
  public:
   MojoApplicationHost();
   virtual ~MojoApplicationHost();
 
   // Two-phase initialization:
-  //  1- Init makes service_registry() available synchronously.
+  //  1- Init makes the shell_client() available synchronously.
   //  2- Activate establishes the actual connection to the peer process.
   bool Init();
   bool Activate(IPC::Sender* sender, base::ProcessHandle process_handle);
 
   bool did_activate() const { return did_activate_; }
 
-  ServiceRegistry* service_registry() { return &service_registry_; }
+  mojo::ServiceProvider* service_provider() {
+    DCHECK(child_service_provider_.get());
+    return child_service_provider_->client();
+  }
 
  private:
+  class ServiceProviderImpl
+      : public mojo::InterfaceImpl<mojo::ServiceProvider> {
+   public:
+    virtual void OnConnectionError() OVERRIDE {
+      // TODO(darin): How should we handle this error?
+    }
+
+    // mojo::ServiceProvider methods:
+    virtual void ConnectToService(
+        const mojo::String& service_url,
+        const mojo::String& service_name,
+        mojo::ScopedMessagePipeHandle handle,
+        const mojo::String& requestor_url) OVERRIDE;
+  };
+
   mojo::embedder::ChannelInit channel_init_;
   mojo::embedder::ScopedPlatformHandle client_handle_;
 
-  bool did_activate_;
+  scoped_ptr<ServiceProviderImpl> child_service_provider_;
 
-  ServiceRegistryImpl service_registry_;
+  bool did_activate_;
 
   DISALLOW_COPY_AND_ASSIGN(MojoApplicationHost);
 };
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 80b7100..017db8a 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -69,6 +69,7 @@
 #include "content/browser/media/midi_host.h"
 #include "content/browser/message_port_message_filter.h"
 #include "content/browser/mime_registry_message_filter.h"
+#include "content/browser/mojo/mojo_application_host.h"
 #include "content/browser/plugin_service_impl.h"
 #include "content/browser/profiler_message_filter.h"
 #include "content/browser/push_messaging_message_filter.h"
@@ -140,6 +141,7 @@
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_switches.h"
 #include "media/base/media_switches.h"
+#include "mojo/common/common_type_converters.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "ppapi/shared_impl/ppapi_switches.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -446,7 +448,6 @@ RenderProcessHostImpl::RenderProcessHostImpl(
       is_self_deleted_(false),
 #endif
       pending_views_(0),
-      mojo_application_host_(new MojoApplicationHost),
       mojo_activation_required_(false),
       visible_widgets_(0),
       backgrounded_(true),
@@ -596,6 +597,7 @@ bool RenderProcessHostImpl::Init() {
       BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get());
 
   // Setup the Mojo channel.
+  mojo_application_host_.reset(new MojoApplicationHost());
   mojo_application_host_->Init();
 
   // Call the embedder first so that their IPC filters have priority.
@@ -906,12 +908,6 @@ void RenderProcessHostImpl::NotifyTimezoneChange() {
   Send(new ViewMsg_TimezoneChange());
 }
 
-ServiceRegistry* RenderProcessHostImpl::GetServiceRegistry() {
-  if (!mojo_application_host_)
-    return NULL;
-  return mojo_application_host_->service_registry();
-}
-
 void RenderProcessHostImpl::AddRoute(
     int32 routing_id,
     IPC::Listener* listener) {
@@ -1938,8 +1934,7 @@ void RenderProcessHostImpl::ProcessDied(bool already_dead) {
     iter.Advance();
   }
 
-  mojo_application_host_.reset(new MojoApplicationHost);
-  mojo_activation_required_ = false;
+  mojo_application_host_.reset();
 
   // It's possible that one of the calls out to the observers might have caused
   // this object to be no longer needed.
@@ -2259,9 +2254,17 @@ void RenderProcessHostImpl::DecrementWorkerRefCount() {
     Cleanup();
 }
 
-void RenderProcessHostImpl::EnsureMojoActivated() {
+void RenderProcessHostImpl::ConnectTo(
+    const base::StringPiece& service_name,
+    mojo::ScopedMessagePipeHandle handle) {
   mojo_activation_required_ = true;
   MaybeActivateMojo();
+
+  mojo_application_host_->service_provider()->ConnectToService(
+      mojo::String::From(service_name),
+      std::string(),
+      handle.Pass(),
+      mojo::String());
 }
 
 void RenderProcessHostImpl::OnAllocateGpuMemoryBuffer(uint32 width,
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 36f8f9a..61f9910 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -15,10 +15,8 @@
 #include "base/timer/timer.h"
 #include "content/browser/child_process_launcher.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
-#include "content/browser/mojo/mojo_application_host.h"
 #include "content/browser/power_monitor_message_broadcaster.h"
 #include "content/common/content_export.h"
-#include "content/common/mojo/service_registry_impl.h"
 #include "content/public/browser/gpu_data_manager_observer.h"
 #include "content/public/browser/render_process_host.h"
 #include "ipc/ipc_channel_proxy.h"
@@ -47,11 +45,13 @@ class AudioRendererHost;
 class BrowserDemuxerAndroid;
 class GpuMessageFilter;
 class MessagePortMessageFilter;
+class MojoApplicationHost;
 #if defined(ENABLE_WEBRTC)
 class P2PSocketDispatcherHost;
 #endif
 class PeerConnectionTrackerHost;
 class RendererMainThread;
+class RenderProcessHostMojoImpl;
 class RenderWidgetHelper;
 class RenderWidgetHost;
 class RenderWidgetHostImpl;
@@ -143,7 +143,6 @@ class CONTENT_EXPORT RenderProcessHostImpl
   virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id)
       OVERRIDE;
   virtual void NotifyTimezoneChange() OVERRIDE;
-  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // IPC::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg) OVERRIDE;
@@ -251,13 +250,23 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void IncrementWorkerRefCount();
   void DecrementWorkerRefCount();
 
+  // Establish a connection to a renderer-provided service. See
+  // content/common/mojo/mojo_service_names.h for a list of services.
+  void ConnectTo(const base::StringPiece& service_name,
+                 mojo::ScopedMessagePipeHandle handle);
+
+  template <typename Interface>
+  void ConnectTo(const base::StringPiece& service_name,
+                 mojo::InterfacePtr<Interface>* ptr) {
+    mojo::MessagePipe pipe;
+    ptr->Bind(pipe.handle0.Pass());
+    ConnectTo(service_name, pipe.handle1.Pass());
+  }
+
   // Call this function to resume the navigation when it was deferred
   // immediately after receiving response headers.
   void ResumeResponseDeferredAtStart(const GlobalRequestID& request_id);
 
-  // Activates Mojo for this process. Does nothing if Mojo is already activated.
-  void EnsureMojoActivated();
-
  protected:
   // A proxy for our IPC::Channel that lives on the IO thread (see
   // browser_process.h)
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 6b96be6..e14b364 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -48,9 +48,11 @@
 #include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/inter_process_time_ticks_converter.h"
+#include "content/common/mojo/mojo_service_names.h"
 #include "content/common/speech_recognition_messages.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/common/view_messages.h"
+#include "content/common/web_ui_setup.mojom.h"
 #include "content/public/browser/ax_event_notification_details.h"
 #include "content/public/browser/browser_accessibility_state.h"
 #include "content/public/browser/browser_context.h"
@@ -654,6 +656,27 @@ void RenderViewHostImpl::SetHasPendingCrossSiteRequest(
       GetProcess()->GetID(), GetRoutingID(), has_pending_request);
 }
 
+void RenderViewHostImpl::SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) {
+  // Never grant any bindings to browser plugin guests.
+  if (GetProcess()->IsIsolatedGuest()) {
+    NOTREACHED() << "Never grant bindings to a guest process.";
+    return;
+  }
+
+  if ((enabled_bindings_ & BINDINGS_POLICY_WEB_UI) == 0) {
+    NOTREACHED() << "You must grant bindings before setting the handle";
+    return;
+  }
+
+  DCHECK(renderer_initialized_);
+
+  WebUISetupPtr web_ui_setup;
+  static_cast<RenderProcessHostImpl*>(GetProcess())->ConnectTo(
+      kRendererService_WebUISetup, &web_ui_setup);
+
+  web_ui_setup->SetWebUIHandle(GetRoutingID(), handle.Pass());
+}
+
 #if defined(OS_ANDROID)
 void RenderViewHostImpl::ActivateNearestFindResult(int request_id,
                                                    float x,
diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
index 204d31c..5f7344f 100644
--- a/content/browser/renderer_host/render_view_host_impl.h
+++ b/content/browser/renderer_host/render_view_host_impl.h
@@ -209,6 +209,7 @@ class CONTENT_EXPORT RenderViewHostImpl
       const WebPreferences& prefs) OVERRIDE;
   virtual void GetAudioOutputControllers(
       const GetAudioOutputControllersCallback& callback) const OVERRIDE;
+  virtual void SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) OVERRIDE;
   virtual void SelectWordAroundCaret() OVERRIDE;
 
 #if defined(OS_ANDROID)
diff --git a/content/browser/webui/web_ui_mojo_browsertest.cc b/content/browser/webui/web_ui_mojo_browsertest.cc
index 6261316..5007a8d 100644
--- a/content/browser/webui/web_ui_mojo_browsertest.cc
+++ b/content/browser/webui/web_ui_mojo_browsertest.cc
@@ -12,19 +12,15 @@
 #include "base/strings/string_util.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/public/browser/browser_context.h"
-#include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/service_registry.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
-#include "content/shell/browser/shell.h"
 #include "content/test/data/web_ui_test_mojo_bindings.mojom.h"
 #include "grit/content_resources.h"
 #include "mojo/common/test/test_utils.h"
@@ -129,18 +125,13 @@ class PingTestWebUIController : public TestWebUIController {
    PingTestWebUIController(WebUI* web_ui, base::RunLoop* run_loop)
        : TestWebUIController(web_ui, run_loop) {
    }
-   virtual ~PingTestWebUIController() {}
 
   // WebUIController overrides:
   virtual void RenderViewCreated(RenderViewHost* render_view_host) OVERRIDE {
-    render_view_host->GetMainFrame()->GetServiceRegistry()->AddService(
-        "webui_controller",
-        base::Bind(&PingTestWebUIController::CreateHandler,
-                   base::Unretained(this)));
-  }
-
-  void CreateHandler(mojo::ScopedMessagePipeHandle handle) {
-    browser_target_.reset(new PingBrowserTargetImpl(handle.Pass(), run_loop_));
+    mojo::MessagePipe pipe;
+    browser_target_.reset(
+        new PingBrowserTargetImpl(pipe.handle0.Pass(), run_loop_));
+    render_view_host->SetWebUIHandle(pipe.handle1.Pass());
   }
 
  private:
@@ -221,19 +212,6 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, EndToEndPing) {
   // RunLoop is quit when message received from page.
   run_loop.Run();
   EXPECT_TRUE(got_message);
-
-  // Check that a second render frame in the same renderer process works
-  // correctly.
-  Shell* other_shell = CreateBrowser();
-  got_message = false;
-  base::RunLoop other_run_loop;
-  factory()->set_run_loop(&other_run_loop);
-  NavigateToURL(other_shell, test_url);
-  // RunLoop is quit when message received from page.
-  other_run_loop.Run();
-  EXPECT_TRUE(got_message);
-  EXPECT_EQ(shell()->web_contents()->GetRenderProcessHost(),
-            other_shell->web_contents()->GetRenderProcessHost());
 }
 
 }  // namespace
diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
index 5feeb5f..63a951a 100644
--- a/content/child/BUILD.gn
+++ b/content/child/BUILD.gn
@@ -18,7 +18,7 @@ source_set("child") {
     "//base",
     "//components/tracing",
     "//mojo/environment:chromium",
-    "//mojo/public/interfaces/interface_provider",
+    "//mojo/public/interfaces/service_provider",
     "//skia",
     "//third_party/icu",
     "//ui/base",
diff --git a/content/child/child_thread.cc b/content/child/child_thread.cc
index 315224e..89ff408 100644
--- a/content/child/child_thread.cc
+++ b/content/child/child_thread.cc
@@ -239,7 +239,7 @@ void ChildThread::Init() {
     IPC::Logging::GetInstance()->SetIPCSender(this);
 #endif
 
-  mojo_application_.reset(new MojoApplication);
+  mojo_application_.reset(new MojoApplication(this));
 
   sync_message_filter_ =
       new IPC::SyncMessageFilter(ChildProcess::current()->GetShutDownEvent());
@@ -370,6 +370,15 @@ void ChildThread::OnChannelError() {
   base::MessageLoop::current()->Quit();
 }
 
+void ChildThread::ConnectToService(
+    const mojo::String& service_url,
+    const mojo::String& service_name,
+    mojo::ScopedMessagePipeHandle message_pipe,
+    const mojo::String& requestor_url) {
+  // By default, we don't expect incoming connections.
+  NOTREACHED();
+}
+
 bool ChildThread::Send(IPC::Message* msg) {
   DCHECK(base::MessageLoop::current() == message_loop());
   if (!channel_) {
diff --git a/content/child/child_thread.h b/content/child/child_thread.h
index e7cf8ec..b272db3 100644
--- a/content/child/child_thread.h
+++ b/content/child/child_thread.h
@@ -13,10 +13,10 @@
 #include "base/memory/weak_ptr.h"
 #include "base/power_monitor/power_monitor.h"
 #include "base/tracked_objects.h"
-#include "content/child/mojo/mojo_application.h"
 #include "content/common/content_export.h"
 #include "content/common/message_router.h"
 #include "ipc/ipc_message.h"  // For IPC_MESSAGE_LOG_ENABLED.
+#include "mojo/public/interfaces/service_provider/service_provider.mojom.h"
 
 namespace base {
 class MessageLoop;
@@ -44,6 +44,7 @@ class ChildHistogramMessageFilter;
 class ChildResourceMessageFilter;
 class ChildSharedBitmapManager;
 class FileSystemDispatcher;
+class MojoApplication;
 class ServiceWorkerDispatcher;
 class ServiceWorkerMessageFilter;
 class QuotaDispatcher;
@@ -55,7 +56,10 @@ class WebSocketDispatcher;
 struct RequestInfo;
 
 // The main thread of a child process derives from this class.
-class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
+class CONTENT_EXPORT ChildThread
+    : public IPC::Listener,
+      public IPC::Sender,
+      public NON_EXPORTED_BASE(mojo::ServiceProvider) {
  public:
   // Creates the thread.
   ChildThread();
@@ -149,10 +153,6 @@ class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
   static void ShutdownThread();
 #endif
 
-  ServiceRegistry* service_registry() const {
-    return mojo_application_->service_registry();
-  }
-
  protected:
   friend class ChildProcess;
 
@@ -170,6 +170,13 @@ class CONTENT_EXPORT ChildThread : public IPC::Listener, public IPC::Sender {
   virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
   virtual void OnChannelError() OVERRIDE;
 
+  // mojo::ServiceProvider implementation:
+  virtual void ConnectToService(
+      const mojo::String& service_url,
+      const mojo::String& service_name,
+      mojo::ScopedMessagePipeHandle message_pipe,
+      const mojo::String& requestor_url) OVERRIDE;
+
  private:
   class ChildThreadMessageRouter : public MessageRouter {
    public:
diff --git a/content/child/mojo/mojo_application.cc b/content/child/mojo/mojo_application.cc
index bc1426f..79eea23 100644
--- a/content/child/mojo/mojo_application.cc
+++ b/content/child/mojo/mojo_application.cc
@@ -10,7 +10,8 @@
 
 namespace content {
 
-MojoApplication::MojoApplication() {
+MojoApplication::MojoApplication(mojo::ServiceProvider* service_provider)
+    : service_provider_(service_provider) {
 }
 
 MojoApplication::~MojoApplication() {
@@ -36,7 +37,9 @@ void MojoApplication::OnActivate(
       channel_init_.Init(handle,
                          ChildProcess::current()->io_message_loop_proxy());
   DCHECK(message_pipe.is_valid());
-  service_registry_.BindRemoteServiceProvider(message_pipe.Pass());
+
+  host_service_provider_.Bind(message_pipe.Pass());
+  host_service_provider_.set_client(service_provider_);
 }
 
 }  // namespace content
diff --git a/content/child/mojo/mojo_application.h b/content/child/mojo/mojo_application.h
index d745402..53fd541 100644
--- a/content/child/mojo/mojo_application.h
+++ b/content/child/mojo/mojo_application.h
@@ -5,9 +5,9 @@
 #ifndef CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
 #define CONTENT_CHILD_MOJO_MOJO_APPLICATION_H_
 
-#include "content/common/mojo/service_registry_impl.h"
 #include "ipc/ipc_platform_file.h"
 #include "mojo/embedder/channel_init.h"
+#include "mojo/public/interfaces/service_provider/service_provider.mojom.h"
 
 namespace IPC {
 class Message;
@@ -18,22 +18,27 @@ namespace content {
 // MojoApplication represents the code needed to setup a child process as a
 // Mojo application via Chrome IPC. Instantiate MojoApplication and call its
 // OnMessageReceived method to give it a shot at handling Chrome IPC messages.
-// It makes the ServiceRegistry interface available.
+// It makes the mojo::Shell interface available and calls methods on the given
+// mojo::ShellClient interface as calls come in.
 class MojoApplication {
  public:
-  MojoApplication();
-  virtual ~MojoApplication();
+  // The ShellClient pointer must remain valid for the lifetime of the
+  // MojoApplication instance.
+  explicit MojoApplication(mojo::ServiceProvider* service_provider);
+  ~MojoApplication();
 
   bool OnMessageReceived(const IPC::Message& msg);
 
-  ServiceRegistry* service_registry() { return &service_registry_; }
+  mojo::ServiceProvider* host_service_provider() {
+    return host_service_provider_.get();
+  }
 
  private:
   void OnActivate(const IPC::PlatformFileForTransit& file);
 
   mojo::embedder::ChannelInit channel_init_;
-
-  ServiceRegistryImpl service_registry_;
+  mojo::ServiceProviderPtr host_service_provider_;
+  mojo::ServiceProvider* service_provider_;
 
   DISALLOW_COPY_AND_ASSIGN(MojoApplication);
 };
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 96f017d..511027e 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -56,7 +56,6 @@ source_set("common") {
       "//gpu/command_buffer/client:gles2_implementation",
       "//gpu/command_buffer/service",
       "//gpu/ipc",
-      "//mojo/public/interfaces/interface_provider",
       "//ui/gl",
       "//webkit/browser:storage",
       "//webkit/common",
@@ -265,6 +264,6 @@ source_set("common") {
 
 mojom("mojo_bindings") {
   sources = [
-    "render_frame_setup.mojom",
+    "web_ui_setup.mojom",
   ]
 }
diff --git a/content/common/mojo/mojo_service_names.cc b/content/common/mojo/mojo_service_names.cc
new file mode 100644
index 0000000..26ff68f
--- /dev/null
+++ b/content/common/mojo/mojo_service_names.cc
@@ -0,0 +1,13 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/mojo/mojo_service_names.h"
+
+namespace content {
+
+// Renderer-provided services:
+
+const char kRendererService_WebUISetup[] = "content:web_ui_setup";
+
+}  // namespace content
diff --git a/content/common/mojo/mojo_service_names.h b/content/common/mojo/mojo_service_names.h
new file mode 100644
index 0000000..787b67d
--- /dev/null
+++ b/content/common/mojo/mojo_service_names.h
@@ -0,0 +1,18 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_SERVICE_CONSTANTS_H_
+#define CONTENT_COMMON_SERVICE_CONSTANTS_H_
+
+namespace content {
+
+// ----------------------------------------------------------------------------
+// Renderer-provided services:
+
+// WebUISetup <-> WebUISetupClient
+extern const char kRendererService_WebUISetup[];
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_SERVICE_CONSTANTS_H_
diff --git a/content/common/mojo/service_registry_impl.cc b/content/common/mojo/service_registry_impl.cc
deleted file mode 100644
index a049ce4..0000000
--- a/content/common/mojo/service_registry_impl.cc
+++ /dev/null
@@ -1,79 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mojo/service_registry_impl.h"
-
-#include "mojo/common/common_type_converters.h"
-
-namespace content {
-
-ServiceRegistryImpl::ServiceRegistryImpl() : bound_(false) {
-}
-
-ServiceRegistryImpl::ServiceRegistryImpl(mojo::ScopedMessagePipeHandle handle)
-    : bound_(false) {
-  BindRemoteServiceProvider(handle.Pass());
-}
-
-ServiceRegistryImpl::~ServiceRegistryImpl() {
-  while (!pending_connects_.empty()) {
-    mojo::CloseRaw(pending_connects_.front().second);
-    pending_connects_.pop();
-  }
-}
-
-void ServiceRegistryImpl::BindRemoteServiceProvider(
-    mojo::ScopedMessagePipeHandle handle) {
-  if (bound_)
-    return;
-
-  mojo::BindToPipe(this, handle.Pass());
-  bound_ = true;
-  while (!pending_connects_.empty()) {
-    client()->GetInterface(
-        mojo::String::From(pending_connects_.front().first),
-        mojo::ScopedMessagePipeHandle(pending_connects_.front().second));
-    pending_connects_.pop();
-  }
-}
-
-void ServiceRegistryImpl::OnConnectionError() {
-  // TODO(sammc): Support reporting this to our owner.
-  bound_ = false;
-}
-
-void ServiceRegistryImpl::AddService(
-    const std::string& service_name,
-    const base::Callback<void(mojo::ScopedMessagePipeHandle)> service_factory) {
-  service_factories_[service_name] = service_factory;
-}
-
-void ServiceRegistryImpl::RemoveService(const std::string& service_name) {
-  service_factories_.erase(service_name);
-}
-
-void ServiceRegistryImpl::GetRemoteInterface(
-    const base::StringPiece& service_name,
-    mojo::ScopedMessagePipeHandle handle) {
-  if (!bound_) {
-    pending_connects_.push(
-        std::make_pair(service_name.as_string(), handle.release()));
-    return;
-  }
-  client()->GetInterface(mojo::String::From(service_name), handle.Pass());
-}
-
-void ServiceRegistryImpl::GetInterface(
-    const mojo::String& name,
-    mojo::ScopedMessagePipeHandle client_handle) {
-  std::map<std::string,
-           base::Callback<void(mojo::ScopedMessagePipeHandle)> >::iterator it =
-      service_factories_.find(name);
-  if (it == service_factories_.end())
-    return;
-
-  it->second.Run(client_handle.Pass());
-}
-
-}  // namespace content
diff --git a/content/common/mojo/service_registry_impl.h b/content/common/mojo/service_registry_impl.h
deleted file mode 100644
index 8e60b37..0000000
--- a/content/common/mojo/service_registry_impl.h
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MOJO_SERVICE_REGISTRY_IMPL_H_
-#define CONTENT_COMMON_MOJO_SERVICE_REGISTRY_IMPL_H_
-
-#include <map>
-#include <queue>
-#include <string>
-#include <utility>
-
-#include "base/callback.h"
-#include "content/public/common/service_registry.h"
-#include "mojo/public/cpp/bindings/interface_impl.h"
-#include "mojo/public/cpp/system/core.h"
-#include "mojo/public/interfaces/interface_provider/interface_provider.mojom.h"
-
-namespace content {
-
-class ServiceRegistryImpl
-    : public ServiceRegistry,
-      public mojo::InterfaceImpl<mojo::IInterfaceProvider> {
- public:
-  ServiceRegistryImpl();
-  explicit ServiceRegistryImpl(mojo::ScopedMessagePipeHandle handle);
-  virtual ~ServiceRegistryImpl();
-
-  // Binds to a remote ServiceProvider. This will expose added services to the
-  // remote ServiceProvider with the corresponding handle and enable
-  // GetInterface to provide access to services exposed by the remote
-  // ServiceProvider.
-  void BindRemoteServiceProvider(mojo::ScopedMessagePipeHandle handle);
-
-  // ServiceRegistry overrides.
-  virtual void AddService(
-      const std::string& service_name,
-      const base::Callback<void(mojo::ScopedMessagePipeHandle)> service_factory)
-      OVERRIDE;
-  virtual void RemoveService(const std::string& service_name) OVERRIDE;
-  virtual void GetRemoteInterface(
-      const base::StringPiece& service_name,
-      mojo::ScopedMessagePipeHandle handle) OVERRIDE;
-
- private:
-  // mojo::InterfaceImpl<mojo::IInterfaceProvider> overrides.
-  virtual void GetInterface(
-      const mojo::String& name,
-      mojo::ScopedMessagePipeHandle client_handle) OVERRIDE;
-  virtual void OnConnectionError() OVERRIDE;
-
-  std::map<std::string, base::Callback<void(mojo::ScopedMessagePipeHandle)> >
-      service_factories_;
-  std::queue<std::pair<std::string, mojo::MessagePipeHandle> >
-      pending_connects_;
-  bool bound_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_MOJO_SERVICE_REGISTRY_IMPL_H_
diff --git a/content/common/render_frame_setup.mojom b/content/common/render_frame_setup.mojom
deleted file mode 100644
index 0315f06..0000000
--- a/content/common/render_frame_setup.mojom
+++ /dev/null
@@ -1,14 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-import "../../mojo/public/interfaces/interface_provider/interface_provider.mojom"
-
-module content {
-
-interface RenderFrameSetup {
-  GetServiceProviderForFrame(int32 frame_routing_id,
-                             mojo.IInterfaceProvider& service_provider);
-};
-
-}
diff --git a/content/common/web_ui_setup.mojom b/content/common/web_ui_setup.mojom
new file mode 100644
index 0000000..d61d96c
--- /dev/null
+++ b/content/common/web_ui_setup.mojom
@@ -0,0 +1,16 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content {
+
+[Peer=WebUISetup]
+interface WebUISetupClient {
+};
+
+[Peer=WebUISetupClient]
+interface WebUISetup {
+  SetWebUIHandle(int32 view_routing_id, handle<message_pipe> web_ui_handle);
+};
+
+}
diff --git a/content/content_common.gypi b/content/content_common.gypi
index d6d39f2b..ad69557 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -101,7 +101,6 @@
       'public/common/sandboxed_process_launcher_delegate.cc',
       'public/common/sandboxed_process_launcher_delegate.h',
       'public/common/security_style.h',
-      'public/common/service_registry.h',
       'public/common/show_desktop_notification_params.cc',
       'public/common/show_desktop_notification_params.h',
       'public/common/signed_certificate_timestamp_id_and_status.cc',
@@ -375,8 +374,8 @@
       'common/message_router.h',
       'common/mime_registry_messages.h',
       'common/mojo/mojo_messages.h',
-      'common/mojo/service_registry_impl.cc',
-      'common/mojo/service_registry_impl.h',
+      'common/mojo/mojo_service_names.cc',
+      'common/mojo/mojo_service_names.h',
       'common/navigation_gesture.h',
       'common/net/url_fetcher.cc',
       'common/net/url_request_user_data.cc',
@@ -533,10 +532,8 @@
         '../ipc/ipc.gyp:ipc',
         '../media/media.gyp:media',
         '../media/media.gyp:shared_memory_support',
-        '../mojo/mojo.gyp:mojo_cpp_bindings',
         '../mojo/mojo.gyp:mojo_environment_chromium',
         '../mojo/mojo.gyp:mojo_system_impl',
-        '../mojo/mojo.gyp:mojo_interface_provider_bindings',
         '../third_party/WebKit/public/blink.gyp:blink',
         '../ui/gl/gl.gyp:gl',
         '../webkit/common/gpu/webkit_gpu.gyp:webkit_gpu',
diff --git a/content/content_common_mojo_bindings.gypi b/content/content_common_mojo_bindings.gypi
index 5367991..7f35e67 100644
--- a/content/content_common_mojo_bindings.gypi
+++ b/content/content_common_mojo_bindings.gypi
@@ -12,7 +12,7 @@
         '../mojo/mojo.gyp:mojo_environment_chromium',
       ],
       'sources': [
-        'common/render_frame_setup.mojom',
+        'common/web_ui_setup.mojom',
       ],
       'includes': [ '../mojo/public/tools/bindings/mojom_bindings_generator.gypi' ],
       'export_dependent_settings': [
diff --git a/content/content_renderer.gypi b/content/content_renderer.gypi
index 8316703..528ad4d 100644
--- a/content/content_renderer.gypi
+++ b/content/content_renderer.gypi
@@ -465,6 +465,8 @@
       'renderer/web_ui_mojo_context_state.h',
       'renderer/web_ui_runner.cc',
       'renderer/web_ui_runner.h',
+      'renderer/web_ui_setup_impl.cc',
+      'renderer/web_ui_setup_impl.h',
       'renderer/webclipboard_impl.cc',
       'renderer/webclipboard_impl.h',
       'renderer/webgraphicscontext3d_provider_impl.cc',
diff --git a/content/content_tests.gypi b/content/content_tests.gypi
index c33825d..9bb43ff 100644
--- a/content/content_tests.gypi
+++ b/content/content_tests.gypi
@@ -991,9 +991,6 @@
             'public/test/content_browser_test_utils.h',
             'public/test/content_browser_test_utils_mac.mm',
           ],
-          'include_dirs': [
-            '<(SHARED_INTERMEDIATE_DIR)',
-          ],
           'conditions': [
             ['OS=="android"', {
               'dependencies': [
diff --git a/content/gpu/BUILD.gn b/content/gpu/BUILD.gn
index c00d3a6..6a47b73 100644
--- a/content/gpu/BUILD.gn
+++ b/content/gpu/BUILD.gn
@@ -27,7 +27,7 @@ source_set("gpu") {
   deps = [
     "//base",
     "//content:export",
-    "//mojo/public/interfaces/interface_provider",
+    "//mojo/public/interfaces/service_provider",
     "//skia",
     "//ui/gl",
   ]
diff --git a/content/plugin/BUILD.gn b/content/plugin/BUILD.gn
index 3c18c56..a5e6481 100644
--- a/content/plugin/BUILD.gn
+++ b/content/plugin/BUILD.gn
@@ -29,7 +29,7 @@ if (enable_plugins && !is_linux) {
 
     deps = [
       "//content:export",
-      "//mojo/public/interfaces/interface_provider",
+      "//mojo/public/interfaces/service_provider",
       "//skia",
       "//third_party/npapi",
       "//third_party/WebKit/public:blink",
diff --git a/content/ppapi_plugin/BUILD.gn b/content/ppapi_plugin/BUILD.gn
index 18f7b87..b27ae34 100644
--- a/content/ppapi_plugin/BUILD.gn
+++ b/content/ppapi_plugin/BUILD.gn
@@ -21,7 +21,7 @@ source_set("ppapi_plugin") {
   deps = [
     "//base",
     "//content:export",
-    "//mojo/public/interfaces/interface_provider",
+    "//mojo/public/interfaces/service_provider",
     "//ppapi:ppapi_ipc",
     "//skia",
     "//third_party/icu",
diff --git a/content/public/browser/render_frame_host.h b/content/public/browser/render_frame_host.h
index 31f4d8d..ac6ba5a 100644
--- a/content/public/browser/render_frame_host.h
+++ b/content/public/browser/render_frame_host.h
@@ -21,7 +21,6 @@ class Value;
 namespace content {
 class RenderProcessHost;
 class RenderViewHost;
-class ServiceRegistry;
 class SiteInstance;
 
 // The interface provides a communication conduit with a frame in the renderer.
@@ -75,9 +74,6 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Temporary until we get rid of RenderViewHost.
   virtual RenderViewHost* GetRenderViewHost() = 0;
 
-  // Returns the ServiceRegistry for this frame.
-  virtual ServiceRegistry* GetServiceRegistry() = 0;
-
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/content/public/browser/render_process_host.h b/content/public/browser/render_process_host.h
index b33a5b3..ee65036 100644
--- a/content/public/browser/render_process_host.h
+++ b/content/public/browser/render_process_host.h
@@ -27,7 +27,6 @@ class BrowserContext;
 class BrowserMessageFilter;
 class RenderProcessHostObserver;
 class RenderWidgetHost;
-class ServiceRegistry;
 class StoragePartition;
 struct GlobalRequestID;
 
@@ -233,9 +232,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // have changed.
   virtual void NotifyTimezoneChange() = 0;
 
-  // Returns the ServiceRegistry for this process.
-  virtual ServiceRegistry* GetServiceRegistry() = 0;
-
   // Static management functions -----------------------------------------------
 
   // Flag to run the renderer in process.  This is primarily
diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
index fcc81c0..559c0ef 100644
--- a/content/public/browser/render_view_host.h
+++ b/content/public/browser/render_view_host.h
@@ -210,6 +210,9 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   virtual void GetAudioOutputControllers(
       const GetAudioOutputControllersCallback& callback) const = 0;
 
+  // Sets the mojo handle for WebUI pages.
+  virtual void SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) = 0;
+
   // Notify the render view host to select the word around the caret.
   virtual void SelectWordAroundCaret() = 0;
 
diff --git a/content/public/common/service_registry.h b/content/public/common/service_registry.h
deleted file mode 100644
index f35bad4..0000000
--- a/content/public/common/service_registry.h
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_COMMON_SERVICE_REGISTRY_H_
-#define CONTENT_PUBLIC_COMMON_SERVICE_REGISTRY_H_
-
-#include <string>
-
-#include "base/bind.h"
-#include "base/callback.h"
-#include "base/strings/string_piece.h"
-#include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/interface_ptr.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
-#include "mojo/public/cpp/system/core.h"
-
-namespace content {
-
-// A ServiceRegistry exposes local services that have been added using
-// AddService to a paired remote ServiceRegistry and provides local access to
-// services exposed by the remote ServiceRegistry through GetInterface.
-class CONTENT_EXPORT ServiceRegistry {
- public:
-  virtual ~ServiceRegistry() {}
-
-  // Make the service created by |service_factory| available to the remote
-  // InterfaceProvider. In response to each request for a service,
-  // |service_factory| will be run with an InterfaceRequest<Interface>
-  // representing that request.
-  template <typename Interface>
-  void AddService(const base::Callback<void(mojo::InterfaceRequest<Interface>)>
-                      service_factory) {
-    AddService(Interface::Name_,
-               base::Bind(&ServiceRegistry::ForwardToServiceFactory<Interface>,
-                          service_factory));
-  }
-  virtual void AddService(
-      const std::string& service_name,
-      const base::Callback<void(mojo::ScopedMessagePipeHandle)>
-          service_factory) = 0;
-
-  // Remove future access to the service implementing Interface. Existing
-  // connections to the service are unaffected.
-  template <typename Interface>
-  void RemoveService() {
-    RemoveService(Interface::Name_);
-  }
-  virtual void RemoveService(const std::string& service_name) = 0;
-
-  // Connect to an interface provided by the remote interface provider.
-  template <typename Interface>
-  void GetRemoteInterface(mojo::InterfacePtr<Interface>* ptr) {
-    mojo::MessagePipe pipe;
-    ptr->Bind(pipe.handle0.Pass());
-    GetRemoteInterface(Interface::Name_, pipe.handle1.Pass());
-  }
-  virtual void GetRemoteInterface(const base::StringPiece& name,
-                                  mojo::ScopedMessagePipeHandle handle) = 0;
-
- private:
-  template <typename Interface>
-  static void ForwardToServiceFactory(
-      const base::Callback<void(mojo::InterfaceRequest<Interface>)>
-          service_factory,
-      mojo::ScopedMessagePipeHandle handle) {
-    service_factory.Run(mojo::MakeRequest<Interface>(handle.Pass()));
-  }
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_COMMON_SERVICE_REGISTRY_H_
diff --git a/content/public/renderer/render_frame.h b/content/public/renderer/render_frame.h
index cbc1546..c48acd8 100644
--- a/content/public/renderer/render_frame.h
+++ b/content/public/renderer/render_frame.h
@@ -25,7 +25,6 @@ struct WebPluginParams;
 namespace content {
 class ContextMenuClient;
 class RenderView;
-class ServiceRegistry;
 struct ContextMenuParams;
 struct WebPluginInfo;
 
@@ -89,9 +88,6 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   // Return true if this frame is hidden.
   virtual bool IsHidden() = 0;
 
-  // Returns the ServiceRegistry for this frame.
-  virtual ServiceRegistry* GetServiceRegistry() = 0;
-
  protected:
   virtual ~RenderFrame() {}
 
diff --git a/content/public/renderer/render_thread.h b/content/public/renderer/render_thread.h
index 695f1fd..a545150 100644
--- a/content/public/renderer/render_thread.h
+++ b/content/public/renderer/render_thread.h
@@ -39,7 +39,6 @@ namespace content {
 
 class RenderProcessObserver;
 class ResourceDispatcherDelegate;
-class ServiceRegistry;
 
 class CONTENT_EXPORT RenderThread : public IPC::Sender {
  public:
@@ -137,9 +136,6 @@ class CONTENT_EXPORT RenderThread : public IPC::Sender {
   // Release cached font.
   virtual void ReleaseCachedFonts() = 0;
 #endif
-
-  // Returns the ServiceRegistry for this thread.
-  virtual ServiceRegistry* GetServiceRegistry() = 0;
 };
 
 }  // namespace content
diff --git a/content/public/test/mock_render_process_host.cc b/content/public/test/mock_render_process_host.cc
index d503ca5..7fb8d03 100644
--- a/content/public/test/mock_render_process_host.cc
+++ b/content/public/test/mock_render_process_host.cc
@@ -223,10 +223,6 @@ void MockRenderProcessHost::ResumeRequestsForView(int route_id) {
 void MockRenderProcessHost::NotifyTimezoneChange() {
 }
 
-ServiceRegistry* MockRenderProcessHost::GetServiceRegistry() {
-  return NULL;
-}
-
 void MockRenderProcessHost::FilterURL(bool empty_allowed, GURL* url) {
   RenderProcessHostImpl::FilterURL(this, empty_allowed, url);
 }
diff --git a/content/public/test/mock_render_process_host.h b/content/public/test/mock_render_process_host.h
index 863bc67..a131efe 100644
--- a/content/public/test/mock_render_process_host.h
+++ b/content/public/test/mock_render_process_host.h
@@ -85,7 +85,6 @@ class MockRenderProcessHost : public RenderProcessHost {
   virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id)
       OVERRIDE;
   virtual void NotifyTimezoneChange() OVERRIDE;
-  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // IPC::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg) OVERRIDE;
diff --git a/content/public/test/mock_render_thread.cc b/content/public/test/mock_render_thread.cc
index 96bce94..0d1b0bc 100644
--- a/content/public/test/mock_render_thread.cc
+++ b/content/public/test/mock_render_thread.cc
@@ -188,10 +188,6 @@ void MockRenderThread::ReleaseCachedFonts() {
 
 #endif  // OS_WIN
 
-ServiceRegistry* MockRenderThread::GetServiceRegistry() {
-  return NULL;
-}
-
 void MockRenderThread::SendCloseMessage() {
   ViewMsg_Close msg(routing_id_);
   RenderViewImpl::FromRoutingID(routing_id_)->OnMessageReceived(msg);
diff --git a/content/public/test/mock_render_thread.h b/content/public/test/mock_render_thread.h
index f03b684..b664697 100644
--- a/content/public/test/mock_render_thread.h
+++ b/content/public/test/mock_render_thread.h
@@ -71,7 +71,6 @@ class MockRenderThread : public RenderThread {
   virtual void PreCacheFont(const LOGFONT& log_font) OVERRIDE;
   virtual void ReleaseCachedFonts() OVERRIDE;
 #endif
-  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   //////////////////////////////////////////////////////////////////////////
   // The following functions are called by the test itself.
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index 7cf46fd..4dde197 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -29,7 +29,7 @@ source_set("renderer") {
     "//gin",
     "//mojo/environment:chromium",
     "//mojo/public/js/bindings",
-    "//mojo/public/interfaces/interface_provider",
+    "//mojo/public/interfaces/service_provider",
     "//net",
     "//skia",
     "//third_party/icu",
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 92e7367..8ae2be2 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -408,12 +408,12 @@ RenderFrameImpl::RenderFrameImpl(RenderViewImpl* render_view, int routing_id)
       geolocation_dispatcher_(NULL),
       screen_orientation_dispatcher_(NULL),
       weak_factory_(this) {
+  RenderThread::Get()->AddRoute(routing_id_, this);
+
   std::pair<RoutingIDFrameMap::iterator, bool> result =
       g_routing_id_frame_map.Get().insert(std::make_pair(routing_id_, this));
   CHECK(result.second) << "Inserting a duplicate item.";
 
-  RenderThread::Get()->AddRoute(routing_id_, this);
-
   render_view_->RegisterRenderFrame(this);
 
 #if defined(OS_ANDROID)
@@ -904,11 +904,6 @@ void RenderFrameImpl::OnNavigate(const FrameMsg_Navigate_Params& params) {
   render_view_->pending_navigation_params_.reset();
 }
 
-void RenderFrameImpl::BindServiceRegistry(
-    mojo::ScopedMessagePipeHandle service_provider_handle) {
-  service_registry_.BindRemoteServiceProvider(service_provider_handle.Pass());
-}
-
 void RenderFrameImpl::OnBeforeUnload() {
   // TODO(creis): Right now, this is only called on the main frame.  Make the
   // browser process send dispatchBeforeUnloadEvent to every frame that needs
@@ -1321,10 +1316,6 @@ void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
   OnJavaScriptExecuteRequest(javascript, 0, false);
 }
 
-ServiceRegistry* RenderFrameImpl::GetServiceRegistry() {
-  return &service_registry_;
-}
-
 // blink::WebFrameClient implementation ----------------------------------------
 
 blink::WebPlugin* RenderFrameImpl::createPlugin(
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 117cc0b..71be416 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -14,7 +14,6 @@
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "base/process/process_handle.h"
-#include "content/common/mojo/service_registry_impl.h"
 #include "content/public/common/javascript_message_type.h"
 #include "content/public/common/referrer.h"
 #include "content/public/renderer/render_frame.h"
@@ -223,7 +222,6 @@ class CONTENT_EXPORT RenderFrameImpl
                                  blink::WebNavigationPolicy policy) OVERRIDE;
   virtual void ExecuteJavaScript(const base::string16& javascript) OVERRIDE;
   virtual bool IsHidden() OVERRIDE;
-  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // blink::WebFrameClient implementation:
   virtual blink::WebPlugin* createPlugin(blink::WebLocalFrame* frame,
@@ -399,11 +397,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // this back to private member.
   void OnNavigate(const FrameMsg_Navigate_Params& params);
 
-  // Binds this render frame's service registry to a handle to the remote
-  // service registry.
-  void BindServiceRegistry(
-      mojo::ScopedMessagePipeHandle service_provider_handle);
-
  protected:
   RenderFrameImpl(RenderViewImpl* render_view, int32 routing_id);
 
@@ -638,8 +631,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // The geolocation dispatcher attached to this view, lazily initialized.
   GeolocationDispatcher* geolocation_dispatcher_;
 
-  ServiceRegistryImpl service_registry_;
-
   // The screen orientation dispatcher attached to the view, lazily initialized.
   ScreenOrientationDispatcher* screen_orientation_dispatcher_;
 
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 2cf4fd8..6e124b3 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -51,7 +51,7 @@
 #include "content/common/gpu/client/gpu_memory_buffer_impl.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/gpu/gpu_process_launch_causes.h"
-#include "content/common/render_frame_setup.mojom.h"
+#include "content/common/mojo/mojo_service_names.h"
 #include "content/common/resource_messages.h"
 #include "content/common/view_messages.h"
 #include "content/common/worker_messages.h"
@@ -95,6 +95,7 @@
 #include "content/renderer/service_worker/embedded_worker_context_message_filter.h"
 #include "content/renderer/service_worker/embedded_worker_dispatcher.h"
 #include "content/renderer/shared_worker/embedded_shared_worker_stub.h"
+#include "content/renderer/web_ui_setup_impl.h"
 #include "grit/content_resources.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_forwarding_message_filter.h"
@@ -265,31 +266,6 @@ void NotifyTimezoneChangeOnThisThread() {
   v8::Date::DateTimeConfigurationChangeNotification(isolate);
 }
 
-class RenderFrameSetupImpl : public mojo::InterfaceImpl<RenderFrameSetup> {
- public:
-  virtual void GetServiceProviderForFrame(
-      int32_t frame_routing_id,
-      mojo::InterfaceRequest<mojo::IInterfaceProvider> request) OVERRIDE {
-    RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(frame_routing_id);
-    // We can receive a GetServiceProviderForFrame message for a frame not yet
-    // created due to a race between the message and a ViewMsg_New IPC that
-    // triggers creation of the RenderFrame we want.
-    if (!frame) {
-      RenderThreadImpl::current()->RegisterPendingRenderFrameConnect(
-          frame_routing_id, request.PassMessagePipe());
-      return;
-    }
-
-    frame->BindServiceRegistry(request.PassMessagePipe());
-  }
-
-  virtual void OnConnectionError() OVERRIDE { delete this; }
-};
-
-void CreateRenderFrameSetup(mojo::InterfaceRequest<RenderFrameSetup> request) {
-  mojo::BindToRequest(new RenderFrameSetupImpl(), &request);
-}
-
 }  // namespace
 
 RenderThreadImpl::HistogramCustomizer::HistogramCustomizer() {
@@ -532,19 +508,10 @@ void RenderThreadImpl::Init() {
     }
   }
 
-  service_registry()->AddService<RenderFrameSetup>(
-      base::Bind(CreateRenderFrameSetup));
-
   TRACE_EVENT_END_ETW("RenderThreadImpl::Init", 0, "");
 }
 
 RenderThreadImpl::~RenderThreadImpl() {
-  for (std::map<int, mojo::MessagePipeHandle>::iterator it =
-           pending_render_frame_connects_.begin();
-       it != pending_render_frame_connects_.end();
-       ++it) {
-    mojo::CloseRaw(it->second);
-  }
 }
 
 void RenderThreadImpl::Shutdown() {
@@ -713,18 +680,6 @@ scoped_refptr<base::MessageLoopProxy>
 
 void RenderThreadImpl::AddRoute(int32 routing_id, IPC::Listener* listener) {
   ChildThread::GetRouter()->AddRoute(routing_id, listener);
-  std::map<int, mojo::MessagePipeHandle>::iterator it =
-      pending_render_frame_connects_.find(routing_id);
-  if (it == pending_render_frame_connects_.end())
-    return;
-
-  RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(routing_id);
-  if (!frame)
-    return;
-
-  mojo::ScopedMessagePipeHandle handle(it->second);
-  pending_render_frame_connects_.erase(it);
-  frame->BindServiceRegistry(handle.Pass());
 }
 
 void RenderThreadImpl::RemoveRoute(int32 routing_id) {
@@ -748,15 +703,6 @@ void RenderThreadImpl::RemoveEmbeddedWorkerRoute(int32 routing_id) {
   }
 }
 
-void RenderThreadImpl::RegisterPendingRenderFrameConnect(
-    int routing_id,
-    mojo::ScopedMessagePipeHandle handle) {
-  std::pair<std::map<int, mojo::MessagePipeHandle>::iterator, bool> result =
-      pending_render_frame_connects_.insert(
-          std::make_pair(routing_id, handle.release()));
-  CHECK(result.second) << "Inserting a duplicate item.";
-}
-
 int RenderThreadImpl::GenerateRoutingID() {
   int routing_id = MSG_ROUTING_NONE;
   Send(new ViewHostMsg_GenerateRoutingID(&routing_id));
@@ -1153,10 +1099,6 @@ void RenderThreadImpl::ReleaseCachedFonts() {
 
 #endif  // OS_WIN
 
-ServiceRegistry* RenderThreadImpl::GetServiceRegistry() {
-  return service_registry();
-}
-
 bool RenderThreadImpl::IsMainThread() {
   return !!current();
 }
@@ -1237,6 +1179,19 @@ scoped_ptr<gfx::GpuMemoryBuffer> RenderThreadImpl::AllocateGpuMemoryBuffer(
       .PassAs<gfx::GpuMemoryBuffer>();
 }
 
+void RenderThreadImpl::ConnectToService(
+    const mojo::String& service_url,
+    const mojo::String& service_name,
+    mojo::ScopedMessagePipeHandle message_pipe,
+    const mojo::String& requestor_url) {
+  // TODO(darin): Invent some kind of registration system to use here.
+  if (service_url.To<base::StringPiece>() == kRendererService_WebUISetup) {
+    WebUISetupImpl::Bind(message_pipe.Pass());
+  } else {
+    NOTREACHED() << "Unknown service name";
+  }
+}
+
 void RenderThreadImpl::DoNotSuspendWebKitSharedTimer() {
   suspend_webkit_shared_timer_ = false;
 }
diff --git a/content/renderer/render_thread_impl.h b/content/renderer/render_thread_impl.h
index 3bc7f9d..d8d50c8 100644
--- a/content/renderer/render_thread_impl.h
+++ b/content/renderer/render_thread_impl.h
@@ -166,7 +166,6 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
   virtual void PreCacheFont(const LOGFONT& log_font) OVERRIDE;
   virtual void ReleaseCachedFonts() OVERRIDE;
 #endif
-  virtual ServiceRegistry* GetServiceRegistry() OVERRIDE;
 
   // Synchronously establish a channel to the GPU plugin if not previously
   // established or if it has been lost (for example if the GPU plugin crashed).
@@ -401,9 +400,6 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
   void AddEmbeddedWorkerRoute(int32 routing_id, IPC::Listener* listener);
   void RemoveEmbeddedWorkerRoute(int32 routing_id);
 
-  void RegisterPendingRenderFrameConnect(int routing_id,
-                                         mojo::ScopedMessagePipeHandle handle);
-
  private:
   // ChildThread
   virtual bool OnControlMessageReceived(const IPC::Message& msg) OVERRIDE;
@@ -429,6 +425,13 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
       unsigned internalformat,
       unsigned usage) OVERRIDE;
 
+  // mojo::ServiceProvider implementation:
+  virtual void ConnectToService(
+      const mojo::String& service_url,
+      const mojo::String& service_name,
+      mojo::ScopedMessagePipeHandle message_pipe,
+      const mojo::String& requestor_url) OVERRIDE;
+
   void Init();
 
   void OnSetZoomLevelForCurrentURL(const std::string& scheme,
@@ -577,8 +580,6 @@ class CONTENT_EXPORT RenderThreadImpl : public RenderThread,
   bool is_zero_copy_enabled_;
   bool is_one_copy_enabled_;
 
-  std::map<int, mojo::MessagePipeHandle> pending_render_frame_connects_;
-
   DISALLOW_COPY_AND_ASSIGN(RenderThreadImpl);
 };
 
diff --git a/content/renderer/web_ui_mojo.cc b/content/renderer/web_ui_mojo.cc
index 4ff9230..38c71d5 100644
--- a/content/renderer/web_ui_mojo.cc
+++ b/content/renderer/web_ui_mojo.cc
@@ -5,7 +5,6 @@
 #include "content/renderer/web_ui_mojo.h"
 
 #include "content/common/view_messages.h"
-#include "content/public/common/service_registry.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_view.h"
 #include "content/renderer/web_ui_mojo_context_state.h"
@@ -85,11 +84,8 @@ void WebUIMojo::DestroyContextState(v8::Handle<v8::Context> context) {
 
 void WebUIMojo::OnDidFinishDocumentLoad() {
   did_finish_document_load_ = true;
-  mojo::MessagePipe pipe;
-  SetHandleOnContextState(pipe.handle0.Pass());
-  RenderFrame::FromWebFrame(render_view()->GetWebView()->mainFrame())->
-      GetServiceRegistry()->
-          GetRemoteInterface("webui_controller", pipe.handle1.Pass());
+  if (pending_handle_.is_valid())
+    SetHandleOnContextState(pending_handle_.Pass());
 }
 
 void WebUIMojo::SetHandleOnContextState(mojo::ScopedMessagePipeHandle handle) {
diff --git a/content/renderer/web_ui_setup_impl.cc b/content/renderer/web_ui_setup_impl.cc
new file mode 100644
index 0000000..7cb7cda
--- /dev/null
+++ b/content/renderer/web_ui_setup_impl.cc
@@ -0,0 +1,33 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/web_ui_setup_impl.h"
+
+#include "content/public/renderer/render_view.h"
+#include "content/renderer/web_ui_mojo.h"
+
+namespace content {
+
+// static
+void WebUISetupImpl::Bind(mojo::ScopedMessagePipeHandle handle) {
+  mojo::BindToPipe(new WebUISetupImpl(), handle.Pass());
+}
+
+void WebUISetupImpl::OnConnectionError() {
+  delete this;
+}
+
+void WebUISetupImpl::SetWebUIHandle(
+    int32 view_routing_id,
+    mojo::ScopedMessagePipeHandle web_ui_handle) {
+  RenderView* render_view = RenderView::FromRoutingID(view_routing_id);
+  if (!render_view)
+    return;
+  WebUIMojo* web_ui_mojo = WebUIMojo::Get(render_view);
+  if (!web_ui_mojo)
+    return;
+  web_ui_mojo->SetBrowserHandle(web_ui_handle.Pass());
+}
+
+}  // namespace content
diff --git a/content/renderer/web_ui_setup_impl.h b/content/renderer/web_ui_setup_impl.h
new file mode 100644
index 0000000..6523454
--- /dev/null
+++ b/content/renderer/web_ui_setup_impl.h
@@ -0,0 +1,32 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
+#define CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
+
+#include "base/basictypes.h"
+#include "content/common/web_ui_setup.mojom.h"
+
+namespace content {
+
+class WebUISetupImpl : public mojo::InterfaceImpl<WebUISetup> {
+ public:
+  static void Bind(mojo::ScopedMessagePipeHandle handle);
+
+ private:
+  WebUISetupImpl() {}
+
+  virtual void OnConnectionError() OVERRIDE;
+
+  // WebUISetup methods:
+  virtual void SetWebUIHandle(
+      int32_t view_routing_id,
+      mojo::ScopedMessagePipeHandle web_ui_handle) OVERRIDE;
+
+  DISALLOW_COPY_AND_ASSIGN(WebUISetupImpl);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_WEB_UI_SETUP_IMPL_H_
diff --git a/content/utility/BUILD.gn b/content/utility/BUILD.gn
index a15e64b..1cc0ead 100644
--- a/content/utility/BUILD.gn
+++ b/content/utility/BUILD.gn
@@ -17,7 +17,7 @@ source_set("utility") {
     "//base",
     "//content:export",
     "//courgette:courgette_lib",
-    "//mojo/public/interfaces/interface_provider",
+    "//mojo/public/interfaces/service_provider",
     "//third_party/WebKit/public:blink_headers",
   ]
 }
diff --git a/content/worker/BUILD.gn b/content/worker/BUILD.gn
index 52a0206..3726aa8 100644
--- a/content/worker/BUILD.gn
+++ b/content/worker/BUILD.gn
@@ -24,7 +24,7 @@ source_set("worker") {
 
   deps = [
     "//base",
-    "//mojo/public/interfaces/interface_provider",
+    "//mojo/public/interfaces/service_provider",
     "//skia",
     "//third_party/WebKit/public:blink",
   ]