Plumb explicit IPC task runner through to IPC::Channel creation

tools/ipc_fuzzer/message_replay/replay_process.cc

Index: tools/ipc_fuzzer/message_replay/replay_process.cc
diff --git a/tools/ipc_fuzzer/message_replay/replay_process.cc b/tools/ipc_fuzzer/message_replay/replay_process.cc
index 21065d74d6657ff127afe8ee565718b1572ed039..9e097fcf63580c733bc36be2ad69207bae50fc0b 100644
--- a/tools/ipc_fuzzer/message_replay/replay_process.cc
+++ b/tools/ipc_fuzzer/message_replay/replay_process.cc
@@ -114,9 +114,11 @@ void ReplayProcess::OpenChannel() {
         base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
             switches::kMojoChannelToken);
     channel_ = IPC::ChannelProxy::Create(
-        IPC::ChannelMojo::CreateClientFactory(mojo::edk::CreateChildMessagePipe(
-            base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
-                switches::kMojoChannelToken))),
+        IPC::ChannelMojo::CreateClientFactory(
+            mojo::edk::CreateChildMessagePipe(
+                base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
+                    switches::kMojoChannelToken)),
+            io_thread_.task_runner()),
         this, io_thread_.task_runner());
   } else {
     std::string channel_name =