Renderers should obtain browser InterfaceProvider by connecting to browser

content/browser/android/interface_registry_android_impl.cc

Index: content/browser/android/interface_registry_android_impl.cc
diff --git a/content/browser/android/interface_registry_android_impl.cc b/content/browser/android/interface_registry_android_impl.cc
index d02169203c166f6db4ff41ec267ae9bffdad1cce..02f67b76619937703bca37b98f8a1e810a202dab 100644
--- a/content/browser/android/interface_registry_android_impl.cc
+++ b/content/browser/android/interface_registry_android_impl.cc
@@ -10,6 +10,7 @@
 #include "base/android/jni_string.h"
 #include "base/callback.h"
 #include "base/memory/ptr_util.h"
+#include "content/public/browser/browser_thread.h"
 #include "jni/InterfaceRegistry_jni.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "services/shell/public/cpp/interface_provider.h"
@@ -87,10 +88,14 @@ void InterfaceRegistryAndroidImpl::AddInterface(
   ScopedJavaGlobalRef<jobject> j_scoped_factory;
   j_scoped_factory.Reset(env, j_factory);
 
+  // All Java interfaces must be bound on the main thread.
+  scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner =
+      BrowserThread::GetTaskRunnerForThread(BrowserThread::UI);
   interface_registry_->AddInterface(
-      name, base::Bind(&CreateImplAndAttach, j_scoped_interface_registry,
-                        j_scoped_manager, j_scoped_factory),
-      nullptr);
+      name,
+      base::Bind(&CreateImplAndAttach, j_scoped_interface_registry,
+                 j_scoped_manager, j_scoped_factory),
+      ui_task_runner);
 }
 
 void InterfaceRegistryAndroidImpl::RemoveInterface(