RenderFrameProxy should use Mojo instead of IPC. Here is the list of current IPCs it handles:

message                    Sender
FrameMsg_DeleteProxy	RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_ChildFrameProcessGone	 CrossProcessFrameConnector via  RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_SetChildFrameSurface	 CrossProcessFrameConnector via  RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_UpdateOpener	RenderFrameHostImpl, RenderFrameHostManager, RenderFrameProxyHost -> RenderFrameProxy, RenderFrameImpl
FrameMsg_ViewChanged	CrossProcessFrameConnector via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_DidStartLoading	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_DidStopLoading		RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_DidUpdateFramePolicy	RenderFrameHostImpl via RenderFrameHost, RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy, RenderFrameImpl
FrameMsg_DidSetActiveSandboxFlags	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_DispatchLoad	RenderFrameHostImpl via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_Collapse	RenderFrameHostManager via RenderFrameProxyHost, RenderFrameHostImpl -> RenderFrameProxy, RenderFrameImpl
FrameMsg_DidUpdateName	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_AddContentSecurityPolicies	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_ResetContentSecurityPolicy	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_EnforceInsecureRequestPolicy	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_SetFrameOwnerProperties	RenderFrameHostManager via RenderFrameHostImpl and RenderFrameProxyHost,  RenderFrameProxyHost -> RenderFrameProxy, RenderFrameImpl
FrameMsg_DidUpdateOrigin	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
InputMsg_SetFocus	FrameTree via RenderFrameProxyHost, LegacyInputRouterImpl ->RenderWidget, RenderFrameProxy
FrameMsg_ResizeDueToAutoResize	CrossProcessFrameConnector via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_SetFocusedFrame	RenderFrameHostImpl, RenderFrameProxyHost -> RenderFrameProxy, RenderFrameImpl
FrameMsg_WillEnterFullscreen	RenderFrameHostImpl via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_SetHasReceivedUserGesture	RenderFrameHostManager via RenderFrameProxyHost -> RenderFrameProxy
FrameMsg_ScrollRectToVisible	RenderFrameProxyHost -> RenderFrameProxy

All of them except FrameMsg_DeleteProxy are sent by classes different from RenderFrameProxyHost. Thus, RenderFrameProxyHost should probably expose its Mojo pointer publicly.