Bug 1063318: Switch Chromium IPC code to Mozilla's ref/auto ptr types. Also fix thread safety bug. r=nfroyd
authorJosh Aas <joshmoz@gmail.com>
Fri, 19 Sep 2014 13:17:17 -0500
changeset 206279 f5a2e2a16e8469d994620b9f863837f38089c355
parent 206278 206e963fb3dd53fc6bf6f92b5e4121d5ffe6add7
child 206280 7283eb58334189852bb1aa06c611b599f3c31109
push id27520
push userkwierso@gmail.com
push dateSat, 20 Sep 2014 00:25:19 +0000
treeherdermozilla-central@27253887d2cc [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnfroyd
bugs1063318
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1063318: Switch Chromium IPC code to Mozilla's ref/auto ptr types. Also fix thread safety bug. r=nfroyd
content/media/gmp/GMPProcessParent.h
dom/plugins/ipc/PluginProcessParent.h
ipc/chromium/moz.build
ipc/chromium/src/base/atomic_ref_count.h
ipc/chromium/src/base/atomic_sequence_num.h
ipc/chromium/src/base/file_util.h
ipc/chromium/src/base/message_loop.cc
ipc/chromium/src/base/message_loop.h
ipc/chromium/src/base/message_pump.h
ipc/chromium/src/base/message_pump_glib.h
ipc/chromium/src/base/message_pump_libevent.cc
ipc/chromium/src/base/message_pump_libevent.h
ipc/chromium/src/base/message_pump_mac.h
ipc/chromium/src/base/process_util_bsd.cc
ipc/chromium/src/base/process_util_linux.cc
ipc/chromium/src/base/process_util_posix.cc
ipc/chromium/src/base/process_util_win.cc
ipc/chromium/src/base/process_win.cc
ipc/chromium/src/base/ref_counted.cc
ipc/chromium/src/base/ref_counted.h
ipc/chromium/src/base/revocable_store.h
ipc/chromium/src/base/scoped_ptr.h
ipc/chromium/src/base/shared_memory_posix.cc
ipc/chromium/src/base/sys_info_win.cc
ipc/chromium/src/base/waitable_event.h
ipc/chromium/src/base/waitable_event_watcher.h
ipc/chromium/src/base/waitable_event_watcher_posix.cc
ipc/chromium/src/base/win_util.cc
ipc/chromium/src/chrome/common/child_process.h
ipc/chromium/src/chrome/common/child_process_host.h
ipc/chromium/src/chrome/common/child_thread.cc
ipc/chromium/src/chrome/common/child_thread.h
ipc/chromium/src/chrome/common/file_descriptor_set_posix.h
ipc/chromium/src/chrome/common/ipc_channel_posix.cc
ipc/chromium/src/chrome/common/ipc_channel_posix.h
ipc/chromium/src/chrome/common/ipc_channel_proxy.h
ipc/chromium/src/chrome/common/ipc_channel_win.cc
ipc/chromium/src/chrome/common/ipc_channel_win.h
ipc/chromium/src/chrome/common/ipc_logging.h
ipc/chromium/src/chrome/common/ipc_message.h
ipc/chromium/src/chrome/common/ipc_sync_channel.cc
ipc/chromium/src/chrome/common/ipc_sync_channel.h
ipc/glue/GeckoChildProcessHost.h
testing/mochitest/mochitest_options.py
xpcom/build/nsXPComInit.cpp
--- a/content/media/gmp/GMPProcessParent.h
+++ b/content/media/gmp/GMPProcessParent.h
@@ -5,17 +5,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef GMPProcessParent_h
 #define GMPProcessParent_h 1
 
 #include "mozilla/Attributes.h"
 #include "base/basictypes.h"
 #include "base/file_path.h"
-#include "base/scoped_ptr.h"
 #include "base/thread.h"
 #include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 namespace mozilla {
 namespace gmp {
 
--- a/dom/plugins/ipc/PluginProcessParent.h
+++ b/dom/plugins/ipc/PluginProcessParent.h
@@ -6,17 +6,16 @@
 
 #ifndef dom_plugins_PluginProcessParent_h
 #define dom_plugins_PluginProcessParent_h 1
 
 #include "mozilla/Attributes.h"
 #include "base/basictypes.h"
 
 #include "base/file_path.h"
-#include "base/scoped_ptr.h"
 #include "base/thread.h"
 #include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 namespace mozilla {
 namespace plugins {
--- a/ipc/chromium/moz.build
+++ b/ipc/chromium/moz.build
@@ -45,17 +45,16 @@ UNIFIED_SOURCES += [
     'src/base/lazy_instance.cc',
     'src/base/lock.cc',
     'src/base/logging.cc',
     'src/base/message_loop.cc',
     'src/base/message_pump_default.cc',
     'src/base/non_thread_safe.cc',
     'src/base/pickle.cc',
     'src/base/rand_util.cc',
-    'src/base/ref_counted.cc',
     'src/base/revocable_store.cc',
     'src/base/scoped_temp_dir.cc',
     'src/base/string_piece.cc',
     'src/base/string_util.cc',
     'src/base/thread.cc',
     'src/base/thread_collision_warner.cc',
     'src/base/time.cc',
     'src/base/timer.cc',
deleted file mode 100644
--- a/ipc/chromium/src/base/atomic_ref_count.h
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This is a low level implementation of atomic semantics for reference
-// counting.  Please use base/ref_counted.h directly instead.
-
-#ifndef BASE_ATOMIC_REF_COUNT_H_
-#define BASE_ATOMIC_REF_COUNT_H_
-
-#include "base/atomicops.h"
-
-namespace base {
-
-typedef subtle::Atomic32 AtomicRefCount;
-
-// Increment a reference count by "increment", which must exceed 0.
-inline void AtomicRefCountIncN(volatile AtomicRefCount *ptr,
-                               AtomicRefCount increment) {
-  subtle::NoBarrier_AtomicIncrement(ptr, increment);
-}
-
-// Decrement a reference count by "decrement", which must exceed 0,
-// and return whether the result is non-zero.
-// Insert barriers to ensure that state written before the reference count
-// became zero will be visible to a thread that has just made the count zero.
-inline bool AtomicRefCountDecN(volatile AtomicRefCount *ptr,
-                               AtomicRefCount decrement) {
-  return subtle::Barrier_AtomicIncrement(ptr, -decrement) != 0;
-}
-
-// Increment a reference count by 1.
-inline void AtomicRefCountInc(volatile AtomicRefCount *ptr) {
-  base::AtomicRefCountIncN(ptr, 1);
-}
-
-// Decrement a reference count by 1 and return whether the result is non-zero.
-// Insert barriers to ensure that state written before the reference count
-// became zero will be visible to a thread that has just made the count zero.
-inline bool AtomicRefCountDec(volatile AtomicRefCount *ptr) {
-  return base::AtomicRefCountDecN(ptr, 1);
-}
-
-// Return whether the reference count is one.  If the reference count is used
-// in the conventional way, a refrerence count of 1 implies that the current
-// thread owns the reference and no other thread shares it.  This call performs
-// the test for a reference count of one, and performs the memory barrier
-// needed for the owning thread to act on the object, knowing that it has
-// exclusive access to the object.
-inline bool AtomicRefCountIsOne(volatile AtomicRefCount *ptr) {
-  return subtle::Acquire_Load(ptr) == 1;
-}
-
-// Return whether the reference count is zero.  With conventional object
-// referencing counting, the object will be destroyed, so the reference count
-// should never be zero.  Hence this is generally used for a debug check.
-inline bool AtomicRefCountIsZero(volatile AtomicRefCount *ptr) {
-  return subtle::Acquire_Load(ptr) == 0;
-}
-
-}  // namespace base
-
-#endif  // BASE_ATOMIC_REF_COUNT_H_
deleted file mode 100644
--- a/ipc/chromium/src/base/atomic_sequence_num.h
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_ATOMIC_SEQUENCE_NUM_H_
-#define BASE_ATOMIC_SEQUENCE_NUM_H_
-
-#include "base/atomicops.h"
-#include "base/basictypes.h"
-
-namespace base {
-
-class AtomicSequenceNumber {
- public:
-  AtomicSequenceNumber() : seq_(0) { }
-  explicit AtomicSequenceNumber(base::LinkerInitialized x) { /* seq_ is 0 */ }
-
-  int GetNext() {
-    return static_cast<int>(
-        base::subtle::NoBarrier_AtomicIncrement(&seq_, 1) - 1);
-  }
-
- private:
-  base::subtle::Atomic32 seq_;
-  DISALLOW_COPY_AND_ASSIGN(AtomicSequenceNumber);
-};
-
-}  // namespace base
-
-#endif  // BASE_ATOMIC_SEQUENCE_NUM_H_
--- a/ipc/chromium/src/base/file_util.h
+++ b/ipc/chromium/src/base/file_util.h
@@ -22,17 +22,16 @@
 
 #include <stdio.h>
 
 #include <stack>
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
-#include "base/scoped_ptr.h"
 #include "base/file_path.h"
 
 namespace file_util {
 
 //-----------------------------------------------------------------------------
 // Functions that operate purely on a path string w/o touching the filesystem:
 
 // Returns true if the given path ends with a path separator character.
--- a/ipc/chromium/src/base/message_loop.cc
+++ b/ipc/chromium/src/base/message_loop.cc
@@ -314,17 +314,17 @@ void MessageLoop::PostTask_Helper(
   } else {
     DCHECK(delay_ms == 0) << "delay should not be negative";
   }
 
   // Warning: Don't try to short-circuit, and handle this thread's tasks more
   // directly, as it could starve handling of foreign threads.  Put every task
   // into this queue.
 
-  scoped_refptr<base::MessagePump> pump;
+  nsRefPtr<base::MessagePump> pump;
   {
     AutoLock locked(incoming_queue_lock_);
     incoming_queue_.push(pending_task);
     pump = pump_;
   }
   // Since the incoming_queue_ may contain a task that destroys this message
   // loop, we cannot exit incoming_queue_lock_ until we are done with |this|.
   // We use a stack-based reference to the message pump so that we can call
--- a/ipc/chromium/src/base/message_loop.h
+++ b/ipc/chromium/src/base/message_loop.h
@@ -4,34 +4,34 @@
 
 #ifndef BASE_MESSAGE_LOOP_H_
 #define BASE_MESSAGE_LOOP_H_
 
 #include <deque>
 #include <queue>
 #include <string>
 #include <vector>
+#include <map>
 
-#include <map>
 #include "base/lock.h"
 #include "base/message_pump.h"
 #include "base/observer_list.h"
-#include "base/ref_counted.h"
-#include "base/scoped_ptr.h"
 #include "base/task.h"
 #include "base/timer.h"
 
 #if defined(OS_WIN)
 // We need this to declare base::MessagePumpWin::Dispatcher, which we should
 // really just eliminate.
 #include "base/message_pump_win.h"
 #elif defined(OS_POSIX)
 #include "base/message_pump_libevent.h"
 #endif
 
+#include "nsAutoPtr.h"
+
 namespace mozilla {
 namespace ipc {
 
 class DoWorkRunnable;
 
 } /* namespace ipc */
 } /* namespace mozilla */
 
@@ -410,17 +410,17 @@ public:
   // Contains delayed tasks, sorted by their 'delayed_run_time' property.
   DelayedTaskQueue delayed_work_queue_;
 
   // A queue of non-nestable tasks that we had to defer because when it came
   // time to execute them we were in a nested message loop.  They will execute
   // once we're out of nested message loops.
   TaskQueue deferred_non_nestable_work_queue_;
 
-  scoped_refptr<base::MessagePump> pump_;
+  nsRefPtr<base::MessagePump> pump_;
 
   base::ObserverList<DestructionObserver> destruction_observers_;
 
   // A recursion block that prevents accidentally running additonal tasks when
   // insider a (accidentally induced?) nested message pump.
   bool nestable_tasks_allowed_;
 
   bool exception_restoration_;
--- a/ipc/chromium/src/base/message_pump.h
+++ b/ipc/chromium/src/base/message_pump.h
@@ -1,23 +1,25 @@
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MESSAGE_PUMP_H_
 #define BASE_MESSAGE_PUMP_H_
 
-#include "base/ref_counted.h"
+#include "nsISupportsImpl.h"
 
 namespace base {
 
 class TimeTicks;
 
-class MessagePump : public RefCountedThreadSafe<MessagePump> {
+class MessagePump {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MessagePump)
+
   // Please see the comments above the Run method for an illustration of how
   // these delegate methods are used.
   class Delegate {
    public:
     virtual ~Delegate() {}
 
     // Called from within Run in response to ScheduleWork or when the message
     // pump would otherwise call DoDelayedWork.  Returns true to indicate that
@@ -34,18 +36,16 @@ class MessagePump : public RefCountedThr
     // calls to this function need to be scheduled.
     virtual bool DoDelayedWork(TimeTicks* next_delayed_work_time) = 0;
 
     // Called from within Run just before the message pump goes to sleep.
     // Returns true to indicate that idle work was done.
     virtual bool DoIdleWork() = 0;
   };
 
-  virtual ~MessagePump() {}
-
   // The Run method is called to enter the message pump's run loop.
   //
   // Within the method, the message pump is responsible for processing native
   // messages as well as for giving cycles to the delegate periodically.  The
   // message pump should take care to mix delegate callbacks with native
   // message processing so neither type of event starves the other of cycles.
   //
   // The anatomy of a typical run loop:
@@ -118,13 +118,16 @@ class MessagePump : public RefCountedThr
   // "reasonably soon", this method can be a no-op to avoid expensive
   // atomic tests and/or syscalls required for ScheduleWork().
   virtual void ScheduleWorkForNestedLoop() { ScheduleWork(); };
 
   // Schedule a DoDelayedWork callback to happen at the specified time,
   // cancelling any pending DoDelayedWork callback.  This method may only be
   // used on the thread that called Run.
   virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time) = 0;
+
+protected:
+  virtual ~MessagePump() {};
 };
 
 }  // namespace base
 
 #endif  // BASE_MESSAGE_PUMP_H_
--- a/ipc/chromium/src/base/message_pump_glib.h
+++ b/ipc/chromium/src/base/message_pump_glib.h
@@ -2,18 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MESSAGE_PUMP_GLIB_H_
 #define BASE_MESSAGE_PUMP_GLIB_H_
 
 #include "base/message_pump.h"
 #include "base/observer_list.h"
-#include "base/scoped_ptr.h"
 #include "base/time.h"
+#include "mozilla/UniquePtr.h"
 
 typedef union _GdkEvent GdkEvent;
 typedef struct _GMainContext GMainContext;
 typedef struct _GPollFD GPollFD;
 typedef struct _GSource GSource;
 
 namespace base {
 
@@ -123,18 +123,18 @@ class MessagePumpForUI : public MessageP
   GSource* work_source_;
 
   // We use a wakeup pipe to make sure we'll get out of the glib polling phase
   // when another thread has scheduled us to do some work.  There is a glib
   // mechanism g_main_context_wakeup, but this won't guarantee that our event's
   // Dispatch() will be called.
   int wakeup_pipe_read_;
   int wakeup_pipe_write_;
-  // Use a scoped_ptr to avoid needing the definition of GPollFD in the header.
-  scoped_ptr<GPollFD> wakeup_gpollfd_;
+  // Use an autoptr to avoid needing the definition of GPollFD in the header.
+  mozilla::UniquePtr<GPollFD> wakeup_gpollfd_;
 
   // List of observers.
   ObserverList<Observer> observers_;
 
   DISALLOW_COPY_AND_ASSIGN(MessagePumpForUI);
 };
 
 }  // namespace base
--- a/ipc/chromium/src/base/message_pump_libevent.cc
+++ b/ipc/chromium/src/base/message_pump_libevent.cc
@@ -8,20 +8,20 @@
 #include <fcntl.h>
 #if defined(ANDROID) || defined(OS_POSIX)
 #include <unistd.h>
 #endif
 
 #include "eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/scoped_nsautorelease_pool.h"
-#include "base/scoped_ptr.h"
 #include "base/time.h"
 #include "nsDependentSubstring.h"
 #include "third_party/libevent/event.h"
+#include "mozilla/UniquePtr.h"
 
 // Lifecycle of struct event
 // Libevent uses two main data structures:
 // struct event_base (of which there is one per message pump), and
 // struct event (of which there is roughly one per socket).
 // The socket's struct event is created in
 // MessagePumpLibevent::WatchFileDescriptor(),
 // is owned by the FileDescriptorWatcher, and is destroyed in
@@ -165,21 +165,21 @@ bool MessagePumpLibevent::WatchFileDescr
     event_mask |= EV_WRITE;
   }
 
   // |should_delete_event| is true if we're modifying an event that's currently
   // active in |controller|.
   // If we're modifying an existing event and there's an error then we need to
   // tell libevent to clean it up via event_delete() before returning.
   bool should_delete_event = true;
-  scoped_ptr<event> evt(controller->ReleaseEvent());
+  mozilla::UniquePtr<event> evt(controller->ReleaseEvent());
   if (evt.get() == NULL) {
     should_delete_event = false;
     // Ownership is transferred to the controller.
-    evt.reset(new event);
+    evt = mozilla::MakeUnique<event>();
   }
 
   // Set current interest mask and message pump for this event.
   event_set(evt.get(), fd, event_mask, OnLibeventNotification,
             delegate);
 
   // Tell libevent which message pump this socket will belong to when we add it.
   if (event_base_set(event_base_, evt.get()) != 0) {
@@ -268,17 +268,17 @@ MessagePumpLibevent::CatchSignal(int sig
   DCHECK(sig > 0);
   DCHECK(sigevent);
   DCHECK(delegate);
   // TODO if we want to support re-using SignalEvents, this code needs
   // to jump through the same hoops as WatchFileDescriptor().  Not
   // needed at present
   DCHECK(NULL == sigevent->event_);
 
-  scoped_ptr<event> evt(new event);
+  mozilla::UniquePtr<event> evt = mozilla::MakeUnique<event>();
   signal_set(evt.get(), sig, OnLibeventSignalNotification, delegate);
 
   if (event_base_set(event_base_, evt.get()))
     return false;
 
   if (signal_add(evt.get(), NULL))
     return false;
 
--- a/ipc/chromium/src/base/message_pump_libevent.h
+++ b/ipc/chromium/src/base/message_pump_libevent.h
@@ -57,17 +57,16 @@ class MessagePumpLibevent : public Messa
     virtual ~Watcher() {}
     // Called from MessageLoop::Run when an FD can be read from/written to
     // without blocking
     virtual void OnFileCanReadWithoutBlocking(int fd) = 0;
     virtual void OnFileCanWriteWithoutBlocking(int fd) = 0;
   };
 
   MessagePumpLibevent();
-  virtual ~MessagePumpLibevent();
 
   enum Mode {
     WATCH_READ = 1 << 0,
     WATCH_WRITE = 1 << 1,
     WATCH_READ_WRITE = WATCH_READ | WATCH_WRITE
   };
 
   // Have the current thread's message loop watch for a a situation in which
@@ -134,16 +133,20 @@ class MessagePumpLibevent : public Messa
 
 
   // MessagePump methods:
   virtual void Run(Delegate* delegate);
   virtual void Quit();
   virtual void ScheduleWork();
   virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time);
 
+ protected:
+
+  virtual ~MessagePumpLibevent();
+
  private:
 
   // Risky part of constructor.  Returns true on success.
   bool Init();
 
   // This flag is set to false when Run should return.
   bool keep_running_;
 
--- a/ipc/chromium/src/base/message_pump_mac.h
+++ b/ipc/chromium/src/base/message_pump_mac.h
@@ -27,16 +27,18 @@
 // or NSRunLoop-based MessagePump subclass depending on which thread it is
 // called on.
 
 #ifndef BASE_MESSAGE_PUMP_MAC_H_
 #define BASE_MESSAGE_PUMP_MAC_H_
 
 #include "base/message_pump.h"
 
+#include "base/basictypes.h"
+
 #include <CoreFoundation/CoreFoundation.h>
 #include <IOKit/IOKitLib.h>
 
 #if defined(__OBJC__)
 @class NSAutoreleasePool;
 #else  // defined(__OBJC__)
 class NSAutoreleasePool;
 #endif  // defined(__OBJC__)
--- a/ipc/chromium/src/base/process_util_bsd.cc
+++ b/ipc/chromium/src/base/process_util_bsd.cc
@@ -13,16 +13,17 @@
 
 #include <string>
 
 #include "base/eintr_wrapper.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
+#include "mozilla/UniquePtr.h"
 
 #if defined(_POSIX_SPAWN) && _POSIX_SPAWN > 0
 #define HAVE_POSIX_SPAWN	1
 #endif
 
 /*
  * On platforms that are not gonk based, we fall back to an arbitrary
  * UID. This is generally the UID for user `nobody', albeit it is not
@@ -220,17 +221,17 @@ bool LaunchApp(const std::vector<std::st
 }
 
 bool LaunchApp(const std::vector<std::string>& argv,
                const file_handle_mapping_vector& fds_to_remap,
                const environment_map& env_vars_to_set,
                ChildPrivileges privs,
                bool wait, ProcessHandle* process_handle,
                ProcessArchitecture arch) {
-  scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
+  mozilla::UniquePtr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   // Illegal to allocate memory after fork and before execvp
   InjectiveMultimap fd_shuffle1, fd_shuffle2;
   fd_shuffle1.reserve(fds_to_remap.size());
   fd_shuffle2.reserve(fds_to_remap.size());
 
   pid_t pid = fork();
   if (pid < 0)
     return false;
--- a/ipc/chromium/src/base/process_util_linux.cc
+++ b/ipc/chromium/src/base/process_util_linux.cc
@@ -15,16 +15,17 @@
 #include <sys/wait.h>
 
 #include "base/eintr_wrapper.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "nsLiteralString.h"
+#include "mozilla/UniquePtr.h"
 
 #ifdef MOZ_B2G_LOADER
 #include "ProcessUtils.h"
 
 using namespace mozilla::ipc;
 #endif	// MOZ_B2G_LOADER
 
 #ifdef MOZ_WIDGET_GONK
@@ -202,23 +203,23 @@ bool LaunchApp(const std::vector<std::st
  */
 static bool
 LaunchAppProcLoader(const std::vector<std::string>& argv,
                     const file_handle_mapping_vector& fds_to_remap,
                     const environment_map& env_vars_to_set,
                     ChildPrivileges privs,
                     ProcessHandle* process_handle) {
   size_t i;
-  scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
+  mozilla::UniquePtr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   for (i = 0; i < argv.size(); i++) {
     argv_cstr[i] = const_cast<char*>(argv[i].c_str());
   }
   argv_cstr[argv.size()] = nullptr;
 
-  scoped_array<char*> env_cstr(new char*[env_vars_to_set.size() + 1]);
+  mozilla::UniquePtr<char*[]> env_cstr(new char*[env_vars_to_set.size() + 1]);
   i = 0;
   for (environment_map::const_iterator it = env_vars_to_set.begin();
        it != env_vars_to_set.end(); ++it) {
     env_cstr[i++] = strdup((it->first + "=" + it->second).c_str());
   }
   env_cstr[env_vars_to_set.size()] = nullptr;
 
   bool ok = ProcLoaderLoad((const char **)argv_cstr.get(),
@@ -256,17 +257,17 @@ bool LaunchApp(const std::vector<std::st
   static bool beforeFirstNuwaLaunch = true;
   if (!wait && beforeFirstNuwaLaunch && IsLaunchingNuwa(argv)) {
     beforeFirstNuwaLaunch = false;
     return LaunchAppProcLoader(argv, fds_to_remap, env_vars_to_set,
                                privs, process_handle);
   }
 #endif // MOZ_B2G_LOADER
 
-  scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
+  mozilla::UniquePtr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   // Illegal to allocate memory after fork and before execvp
   InjectiveMultimap fd_shuffle1, fd_shuffle2;
   fd_shuffle1.reserve(fds_to_remap.size());
   fd_shuffle2.reserve(fds_to_remap.size());
 
 #ifdef HAVE_PR_DUPLICATE_ENVIRONMENT
   Environment env;
   env.Merge(env_vars_to_set);
--- a/ipc/chromium/src/base/process_util_posix.cc
+++ b/ipc/chromium/src/base/process_util_posix.cc
@@ -17,22 +17,23 @@
 #include <limits>
 #include <set>
 
 #include "base/basictypes.h"
 #include "base/eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/platform_thread.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/sys_info.h"
 #include "base/time.h"
 #include "base/waitable_event.h"
 #include "base/dir_reader_posix.h"
 
+#include "mozilla/UniquePtr.h"
+
 const int kMicrosecondsPerSecond = 1000000;
 
 namespace base {
 
 ProcessId GetCurrentProcId() {
   return getpid();
 }
 
@@ -96,17 +97,17 @@ typedef unsigned long int rlim_t;
 class ScopedDIRClose {
  public:
   inline void operator()(DIR* x) const {
     if (x) {
       closedir(x);
     }
   }
 };
-typedef scoped_ptr_malloc<DIR, ScopedDIRClose> ScopedDIR;
+typedef mozilla::UniquePtr<DIR, ScopedDIRClose> ScopedDIR;
 
 
 void CloseSuperfluousFds(const base::InjectiveMultimap& saved_mapping) {
   // DANGER: no calls to malloc are allowed from now on:
   // http://crbug.com/36678
 #if defined(ANDROID)
   static const rlim_t kSystemDefaultMaxFds = 1024;
   static const char kFDDir[] = "/proc/self/fd";
--- a/ipc/chromium/src/base/process_util_win.cc
+++ b/ipc/chromium/src/base/process_util_win.cc
@@ -9,18 +9,16 @@
 #include "base/process_util.h"
 
 #include <windows.h>
 #include <winternl.h>
 #include <psapi.h>
 
 #include "base/histogram.h"
 #include "base/logging.h"
-#include "base/scoped_handle_win.h"
-#include "base/scoped_ptr.h"
 #include "base/win_util.h"
 
 #include <algorithm>
 
 namespace {
 
 // System pagesize. This value remains constant on x86/64 architectures.
 const int PAGESIZE_KB = 4;
--- a/ipc/chromium/src/base/process_win.cc
+++ b/ipc/chromium/src/base/process_win.cc
@@ -1,16 +1,15 @@
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/process.h"
 #include "base/logging.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 
 namespace base {
 
 void Process::Close() {
   if (!process_)
     return;
   CloseProcessHandle(process_);
   process_ = NULL;
deleted file mode 100644
--- a/ipc/chromium/src/base/ref_counted.cc
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/ref_counted.h"
-
-#include "base/logging.h"
-#include "base/thread_collision_warner.h"
-
-namespace base {
-
-namespace subtle {
-
-RefCountedBase::RefCountedBase() : ref_count_(0) {
-#ifndef NDEBUG
-  in_dtor_ = false;
-#endif
-}
-
-RefCountedBase::~RefCountedBase() {
-#ifndef NDEBUG
-  DCHECK(in_dtor_) << "RefCounted object deleted without calling Release()";
-#endif
-}
-
-void RefCountedBase::AddRef() {
-  // TODO(maruel): Add back once it doesn't assert 500 times/sec.
-  // Current thread books the critical section "AddRelease" without release it.
-  // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-#endif
-  ++ref_count_;
-}
-
-bool RefCountedBase::Release() {
-  // TODO(maruel): Add back once it doesn't assert 500 times/sec.
-  // Current thread books the critical section "AddRelease" without release it.
-  // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-#endif
-  if (--ref_count_ == 0) {
-#ifndef NDEBUG
-    in_dtor_ = true;
-#endif
-    return true;
-  }
-  return false;
-}
-
-RefCountedThreadSafeBase::RefCountedThreadSafeBase() : ref_count_(0) {
-#ifndef NDEBUG
-  in_dtor_ = false;
-#endif
-}
-
-RefCountedThreadSafeBase::~RefCountedThreadSafeBase() {
-#ifndef NDEBUG
-  DCHECK(in_dtor_) << "RefCountedThreadSafe object deleted without "
-                      "calling Release()";
-#endif
-}
-
-void RefCountedThreadSafeBase::AddRef() {
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-#endif
-  AtomicRefCountInc(&ref_count_);
-}
-
-bool RefCountedThreadSafeBase::Release() {
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-  DCHECK(!AtomicRefCountIsZero(&ref_count_));
-#endif
-  if (!AtomicRefCountDec(&ref_count_)) {
-#ifndef NDEBUG
-    in_dtor_ = true;
-#endif
-    return true;
-  }
-  return false;
-}
-
-}  // namespace subtle
-
-}  // namespace base
deleted file mode 100644
--- a/ipc/chromium/src/base/ref_counted.h
+++ /dev/null
@@ -1,231 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_REF_COUNTED_H_
-#define BASE_REF_COUNTED_H_
-
-#include "base/atomic_ref_count.h"
-#include "base/thread_collision_warner.h"
-
-namespace base {
-
-namespace subtle {
-
-class RefCountedBase {
- protected:
-  RefCountedBase();
-  ~RefCountedBase();
-
-  void AddRef();
-
-  // Returns true if the object should self-delete.
-  bool Release();
-
- private:
-  int ref_count_;
-#ifndef NDEBUG
-  bool in_dtor_;
-#endif
-
-  DFAKE_MUTEX(add_release_)
-
-  DISALLOW_COPY_AND_ASSIGN(RefCountedBase);
-};
-
-class RefCountedThreadSafeBase {
- protected:
-  RefCountedThreadSafeBase();
-  ~RefCountedThreadSafeBase();
-
-  void AddRef();
-
-  // Returns true if the object should self-delete.
-  bool Release();
-
- private:
-  AtomicRefCount ref_count_;
-#ifndef NDEBUG
-  bool in_dtor_;
-#endif
-
-  DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafeBase);
-};
-
-
-
-}  // namespace subtle
-
-//
-// A base class for reference counted classes.  Otherwise, known as a cheap
-// knock-off of WebKit's RefCounted<T> class.  To use this guy just extend your
-// class from it like so:
-//
-//   class MyFoo : public base::RefCounted<MyFoo> {
-//    ...
-//   };
-//
-template <class T>
-class RefCounted : public subtle::RefCountedBase {
- public:
-  RefCounted() { }
-  ~RefCounted() { }
-
-  void AddRef() {
-    subtle::RefCountedBase::AddRef();
-  }
-
-  void Release() {
-    if (subtle::RefCountedBase::Release()) {
-      delete static_cast<T*>(this);
-    }
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(RefCounted<T>);
-};
-
-//
-// A thread-safe variant of RefCounted<T>
-//
-//   class MyFoo : public base::RefCountedThreadSafe<MyFoo> {
-//    ...
-//   };
-//
-template <class T>
-class RefCountedThreadSafe : public subtle::RefCountedThreadSafeBase {
- public:
-  RefCountedThreadSafe() { }
-  ~RefCountedThreadSafe() { }
-
-  void AddRef() {
-    subtle::RefCountedThreadSafeBase::AddRef();
-  }
-
-  void Release() {
-    if (subtle::RefCountedThreadSafeBase::Release()) {
-      delete static_cast<T*>(this);
-    }
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafe<T>);
-};
-
-//
-// A wrapper for some piece of data so we can place other things in
-// scoped_refptrs<>.
-//
-template<typename T>
-class RefCountedData : public base::RefCounted< base::RefCountedData<T> > {
- public:
-  RefCountedData() : data() {}
-  explicit RefCountedData(const T& in_value) : data(in_value) {}
-
-  T data;
-};
-
-}  // namespace base
-
-//
-// A smart pointer class for reference counted objects.  Use this class instead
-// of calling AddRef and Release manually on a reference counted object to
-// avoid common memory leaks caused by forgetting to Release an object
-// reference.  Sample usage:
-//
-//   class MyFoo : public RefCounted<MyFoo> {
-//    ...
-//   };
-//
-//   void some_function() {
-//     scoped_refptr<MyFoo> foo = new MyFoo();
-//     foo->Method(param);
-//     // |foo| is released when this function returns
-//   }
-//
-//   void some_other_function() {
-//     scoped_refptr<MyFoo> foo = new MyFoo();
-//     ...
-//     foo = NULL;  // explicitly releases |foo|
-//     ...
-//     if (foo)
-//       foo->Method(param);
-//   }
-//
-// The above examples show how scoped_refptr<T> acts like a pointer to T.
-// Given two scoped_refptr<T> classes, it is also possible to exchange
-// references between the two objects, like so:
-//
-//   {
-//     scoped_refptr<MyFoo> a = new MyFoo();
-//     scoped_refptr<MyFoo> b;
-//
-//     b.swap(a);
-//     // now, |b| references the MyFoo object, and |a| references NULL.
-//   }
-//
-// To make both |a| and |b| in the above example reference the same MyFoo
-// object, simply use the assignment operator:
-//
-//   {
-//     scoped_refptr<MyFoo> a = new MyFoo();
-//     scoped_refptr<MyFoo> b;
-//
-//     b = a;
-//     // now, |a| and |b| each own a reference to the same MyFoo object.
-//   }
-//
-template <class T>
-class scoped_refptr {
- public:
-  scoped_refptr() : ptr_(NULL) {
-  }
-
-  MOZ_IMPLICIT scoped_refptr(T* p) : ptr_(p) {
-    if (ptr_)
-      ptr_->AddRef();
-  }
-
-  scoped_refptr(const scoped_refptr<T>& r) : ptr_(r.ptr_) {
-    if (ptr_)
-      ptr_->AddRef();
-  }
-
-  ~scoped_refptr() {
-    if (ptr_)
-      ptr_->Release();
-  }
-
-  T* get() const { return ptr_; }
-  operator T*() const { return ptr_; }
-  T* operator->() const { return ptr_; }
-
-  scoped_refptr<T>& operator=(T* p) {
-    // AddRef first so that self assignment should work
-    if (p)
-      p->AddRef();
-    if (ptr_ )
-      ptr_ ->Release();
-    ptr_ = p;
-    return *this;
-  }
-
-  scoped_refptr<T>& operator=(const scoped_refptr<T>& r) {
-    return *this = r.ptr_;
-  }
-
-  void swap(T** pp) {
-    T* p = ptr_;
-    ptr_ = *pp;
-    *pp = p;
-  }
-
-  void swap(scoped_refptr<T>& r) {
-    swap(&r.ptr_);
-  }
-
- protected:
-  T* ptr_;
-};
-
-#endif  // BASE_REF_COUNTED_H_
--- a/ipc/chromium/src/base/revocable_store.h
+++ b/ipc/chromium/src/base/revocable_store.h
@@ -1,32 +1,37 @@
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_REVOCABLE_STORE_H_
 #define BASE_REVOCABLE_STORE_H_
 
-#include "base/ref_counted.h"
+#include "base/basictypes.h"
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 
 // |RevocableStore| is a container of items that can be removed from the store.
 class RevocableStore {
  public:
   // A |StoreRef| is used to link the |RevocableStore| to its items.  There is
   // one StoreRef per store, and each item holds a reference to it.  If the
   // store wishes to revoke its items, it sets |store_| to null.  Items are
   // permitted to release their reference to the |StoreRef| when they no longer
   // require the store.
-  class StoreRef : public base::RefCounted<StoreRef> {
+  class StoreRef MOZ_FINAL {
    public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(StoreRef)
     explicit StoreRef(RevocableStore* store) : store_(store) { }
 
     void set_store(RevocableStore* store) { store_ = store; }
     RevocableStore* store() const { return store_; }
 
+   protected:
+    ~StoreRef() {}
    private:
     RevocableStore* store_;
 
     DISALLOW_EVIL_CONSTRUCTORS(StoreRef);
   };
 
   // An item in the store.  On construction, the object adds itself to the
   // store.
@@ -36,17 +41,17 @@ class RevocableStore {
     ~Revocable();
 
     // This item has been revoked if it no longer has a pointer to the store.
     bool revoked() const { return !store_reference_->store(); }
 
   private:
     // We hold a reference to the store through this ref pointer.  We release
     // this reference on destruction.
-    scoped_refptr<StoreRef> store_reference_;
+    nsRefPtr<StoreRef> store_reference_;
 
     DISALLOW_EVIL_CONSTRUCTORS(Revocable);
   };
 
   RevocableStore();
   ~RevocableStore();
 
   // Revokes all the items in the store.
@@ -58,17 +63,17 @@ class RevocableStore {
  private:
   friend class Revocable;
 
   // Adds an item to the store.  To add an item to the store, construct it
   // with a pointer to the store.
   void Add(Revocable* item);
 
   // This is the reference the unrevoked items in the store hold.
-  scoped_refptr<StoreRef> owning_reference_;
+  nsRefPtr<StoreRef> owning_reference_;
 
   // The number of unrevoked items in the store.
   int count_;
 
   DISALLOW_EVIL_CONSTRUCTORS(RevocableStore);
 };
 
 #endif  // BASE_REVOCABLE_STORE_H_
deleted file mode 100644
--- a/ipc/chromium/src/base/scoped_ptr.h
+++ /dev/null
@@ -1,380 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Scopers help you manage ownership of a pointer, helping you easily manage the
-// a pointer within a scope, and automatically destroying the pointer at the
-// end of a scope.  There are two main classes you will use, which coorespond
-// to the operators new/delete and new[]/delete[].
-//
-// Example usage (scoped_ptr):
-//   {
-//     scoped_ptr<Foo> foo(new Foo("wee"));
-//   }  // foo goes out of scope, releasing the pointer with it.
-//
-//   {
-//     scoped_ptr<Foo> foo;          // No pointer managed.
-//     foo.reset(new Foo("wee"));    // Now a pointer is managed.
-//     foo.reset(new Foo("wee2"));   // Foo("wee") was destroyed.
-//     foo.reset(new Foo("wee3"));   // Foo("wee2") was destroyed.
-//     foo->Method();                // Foo::Method() called.
-//     foo.get()->Method();          // Foo::Method() called.
-//     SomeFunc(foo.Release());      // SomeFunc takes owernship, foo no longer
-//                                   // manages a pointer.
-//     foo.reset(new Foo("wee4"));   // foo manages a pointer again.
-//     foo.reset();                  // Foo("wee4") destroyed, foo no longer
-//                                   // manages a pointer.
-//   }  // foo wasn't managing a pointer, so nothing was destroyed.
-//
-// Example usage (scoped_array):
-//   {
-//     scoped_array<Foo> foo(new Foo[100]);
-//     foo.get()->Method();  // Foo::Method on the 0th element.
-//     foo[10].Method();     // Foo::Method on the 10th element.
-//   }
-
-#ifndef BASE_SCOPED_PTR_H_
-#define BASE_SCOPED_PTR_H_
-
-// This is an implementation designed to match the anticipated future TR2
-// implementation of the scoped_ptr class, and its closely-related brethren,
-// scoped_array, scoped_ptr_malloc.
-
-#include <assert.h>
-#include <stdlib.h>
-#include <cstddef>
-
-// A scoped_ptr<T> is like a T*, except that the destructor of scoped_ptr<T>
-// automatically deletes the pointer it holds (if any).
-// That is, scoped_ptr<T> owns the T object that it points to.
-// Like a T*, a scoped_ptr<T> may hold either NULL or a pointer to a T object.
-// Also like T*, scoped_ptr<T> is thread-compatible, and once you
-// dereference it, you get the threadsafety guarantees of T.
-//
-// The size of a scoped_ptr is small:
-// sizeof(scoped_ptr<C>) == sizeof(C*)
-template <class C>
-class scoped_ptr {
- public:
-
-  // The element type
-  typedef C element_type;
-
-  // Constructor.  Defaults to intializing with NULL.
-  // There is no way to create an uninitialized scoped_ptr.
-  // The input parameter must be allocated with new.
-  explicit scoped_ptr(C* p = NULL) : ptr_(p) { }
-
-  // Destructor.  If there is a C object, delete it.
-  // We don't need to test ptr_ == NULL because C++ does that for us.
-  ~scoped_ptr() {
-    enum { type_must_be_complete = sizeof(C) };
-    delete ptr_;
-  }
-
-  // Reset.  Deletes the current owned object, if any.
-  // Then takes ownership of a new object, if given.
-  // this->reset(this->get()) works.
-  void reset(C* p = NULL) {
-    if (p != ptr_) {
-      enum { type_must_be_complete = sizeof(C) };
-      delete ptr_;
-      ptr_ = p;
-    }
-  }
-
-  // Accessors to get the owned object.
-  // operator* and operator-> will assert() if there is no current object.
-  C& operator*() const {
-    assert(ptr_ != NULL);
-    return *ptr_;
-  }
-  C* operator->() const  {
-    assert(ptr_ != NULL);
-    return ptr_;
-  }
-  C* get() const { return ptr_; }
-
-  // Comparison operators.
-  // These return whether two scoped_ptr refer to the same object, not just to
-  // two different but equal objects.
-  bool operator==(C* p) const { return ptr_ == p; }
-  bool operator!=(C* p) const { return ptr_ != p; }
-
-  // Swap two scoped pointers.
-  void swap(scoped_ptr& p2) {
-    C* tmp = ptr_;
-    ptr_ = p2.ptr_;
-    p2.ptr_ = tmp;
-  }
-
-  // Release a pointer.
-  // The return value is the current pointer held by this object.
-  // If this object holds a NULL pointer, the return value is NULL.
-  // After this operation, this object will hold a NULL pointer,
-  // and will not own the object any more.
-  C* release() {
-    C* retVal = ptr_;
-    ptr_ = NULL;
-    return retVal;
-  }
-
- private:
-  C* ptr_;
-
-  // Forbid comparison of scoped_ptr types.  If C2 != C, it totally doesn't
-  // make sense, and if C2 == C, it still doesn't make sense because you should
-  // never have the same object owned by two different scoped_ptrs.
-  template <class C2> bool operator==(scoped_ptr<C2> const& p2) const;
-  template <class C2> bool operator!=(scoped_ptr<C2> const& p2) const;
-
-  // Disallow evil constructors
-  scoped_ptr(const scoped_ptr&);
-  void operator=(const scoped_ptr&);
-};
-
-// Free functions
-template <class C>
-void swap(scoped_ptr<C>& p1, scoped_ptr<C>& p2) {
-  p1.swap(p2);
-}
-
-template <class C>
-bool operator==(C* p1, const scoped_ptr<C>& p2) {
-  return p1 == p2.get();
-}
-
-template <class C>
-bool operator!=(C* p1, const scoped_ptr<C>& p2) {
-  return p1 != p2.get();
-}
-
-// scoped_array<C> is like scoped_ptr<C>, except that the caller must allocate
-// with new [] and the destructor deletes objects with delete [].
-//
-// As with scoped_ptr<C>, a scoped_array<C> either points to an object
-// or is NULL.  A scoped_array<C> owns the object that it points to.
-// scoped_array<T> is thread-compatible, and once you index into it,
-// the returned objects have only the threadsafety guarantees of T.
-//
-// Size: sizeof(scoped_array<C>) == sizeof(C*)
-template <class C>
-class scoped_array {
- public:
-
-  // The element type
-  typedef C element_type;
-
-  // Constructor.  Defaults to intializing with NULL.
-  // There is no way to create an uninitialized scoped_array.
-  // The input parameter must be allocated with new [].
-  explicit scoped_array(C* p = NULL) : array_(p) { }
-
-  // Destructor.  If there is a C object, delete it.
-  // We don't need to test ptr_ == NULL because C++ does that for us.
-  ~scoped_array() {
-    enum { type_must_be_complete = sizeof(C) };
-    delete[] array_;
-  }
-
-  // Reset.  Deletes the current owned object, if any.
-  // Then takes ownership of a new object, if given.
-  // this->reset(this->get()) works.
-  void reset(C* p = NULL) {
-    if (p != array_) {
-      enum { type_must_be_complete = sizeof(C) };
-      delete[] array_;
-      array_ = p;
-    }
-  }
-
-  // Get one element of the current object.
-  // Will assert() if there is no current object, or index i is negative.
-  C& operator[](std::ptrdiff_t i) const {
-    assert(i >= 0);
-    assert(array_ != NULL);
-    return array_[i];
-  }
-
-  // Get a pointer to the zeroth element of the current object.
-  // If there is no current object, return NULL.
-  C* get() const {
-    return array_;
-  }
-
-  // Comparison operators.
-  // These return whether two scoped_array refer to the same object, not just to
-  // two different but equal objects.
-  bool operator==(C* p) const { return array_ == p; }
-  bool operator!=(C* p) const { return array_ != p; }
-
-  // Swap two scoped arrays.
-  void swap(scoped_array& p2) {
-    C* tmp = array_;
-    array_ = p2.array_;
-    p2.array_ = tmp;
-  }
-
-  // Release an array.
-  // The return value is the current pointer held by this object.
-  // If this object holds a NULL pointer, the return value is NULL.
-  // After this operation, this object will hold a NULL pointer,
-  // and will not own the object any more.
-  C* release() {
-    C* retVal = array_;
-    array_ = NULL;
-    return retVal;
-  }
-
- private:
-  C* array_;
-
-  // Forbid comparison of different scoped_array types.
-  template <class C2> bool operator==(scoped_array<C2> const& p2) const;
-  template <class C2> bool operator!=(scoped_array<C2> const& p2) const;
-
-  // Disallow evil constructors
-  scoped_array(const scoped_array&);
-  void operator=(const scoped_array&);
-};
-
-// Free functions
-template <class C>
-void swap(scoped_array<C>& p1, scoped_array<C>& p2) {
-  p1.swap(p2);
-}
-
-template <class C>
-bool operator==(C* p1, const scoped_array<C>& p2) {
-  return p1 == p2.get();
-}
-
-template <class C>
-bool operator!=(C* p1, const scoped_array<C>& p2) {
-  return p1 != p2.get();
-}
-
-// This class wraps the c library function free() in a class that can be
-// passed as a template argument to scoped_ptr_malloc below.
-class ScopedPtrMallocFree {
- public:
-  inline void operator()(void* x) const {
-    free(x);
-  }
-};
-
-// scoped_ptr_malloc<> is similar to scoped_ptr<>, but it accepts a
-// second template argument, the functor used to free the object.
-
-template<class C, class FreeProc = ScopedPtrMallocFree>
-class scoped_ptr_malloc {
- public:
-
-  // The element type
-  typedef C element_type;
-
-  // Constructor.  Defaults to intializing with NULL.
-  // There is no way to create an uninitialized scoped_ptr.
-  // The input parameter must be allocated with an allocator that matches the
-  // Free functor.  For the default Free functor, this is malloc, calloc, or
-  // realloc.
-  explicit scoped_ptr_malloc(C* p = NULL): ptr_(p) {}
-
-  // Destructor.  If there is a C object, call the Free functor.
-  ~scoped_ptr_malloc() {
-    free_(ptr_);
-  }
-
-  // Reset.  Calls the Free functor on the current owned object, if any.
-  // Then takes ownership of a new object, if given.
-  // this->reset(this->get()) works.
-  void reset(C* p = NULL) {
-    if (ptr_ != p) {
-      free_(ptr_);
-      ptr_ = p;
-    }
-  }
-
-  // Get the current object.
-  // operator* and operator-> will cause an assert() failure if there is
-  // no current object.
-  C& operator*() const {
-    assert(ptr_ != NULL);
-    return *ptr_;
-  }
-
-  C* operator->() const {
-    assert(ptr_ != NULL);
-    return ptr_;
-  }
-
-  C* get() const {
-    return ptr_;
-  }
-
-  // Comparison operators.
-  // These return whether a scoped_ptr_malloc and a plain pointer refer
-  // to the same object, not just to two different but equal objects.
-  // For compatibility wwith the boost-derived implementation, these
-  // take non-const arguments.
-  bool operator==(C* p) const {
-    return ptr_ == p;
-  }
-
-  bool operator!=(C* p) const {
-    return ptr_ != p;
-  }
-
-  // Swap two scoped pointers.
-  void swap(scoped_ptr_malloc & b) {
-    C* tmp = b.ptr_;
-    b.ptr_ = ptr_;
-    ptr_ = tmp;
-  }
-
-  // Release a pointer.
-  // The return value is the current pointer held by this object.
-  // If this object holds a NULL pointer, the return value is NULL.
-  // After this operation, this object will hold a NULL pointer,
-  // and will not own the object any more.
-  C* release() {
-    C* tmp = ptr_;
-    ptr_ = NULL;
-    return tmp;
-  }
-
- private:
-  C* ptr_;
-
-  // no reason to use these: each scoped_ptr_malloc should have its own object
-  template <class C2, class GP>
-  bool operator==(scoped_ptr_malloc<C2, GP> const& p) const;
-  template <class C2, class GP>
-  bool operator!=(scoped_ptr_malloc<C2, GP> const& p) const;
-
-  static FreeProc const free_;
-
-  // Disallow evil constructors
-  scoped_ptr_malloc(const scoped_ptr_malloc&);
-  void operator=(const scoped_ptr_malloc&);
-};
-
-template<class C, class FP>
-FP const scoped_ptr_malloc<C, FP>::free_ = FP();
-
-template<class C, class FP> inline
-void swap(scoped_ptr_malloc<C, FP>& a, scoped_ptr_malloc<C, FP>& b) {
-  a.swap(b);
-}
-
-template<class C, class FP> inline
-bool operator==(C* p, const scoped_ptr_malloc<C, FP>& b) {
-  return p == b.get();
-}
-
-template<class C, class FP> inline
-bool operator!=(C* p, const scoped_ptr_malloc<C, FP>& b) {
-  return p != b.get();
-}
-
-#endif  // BASE_SCOPED_PTR_H_
--- a/ipc/chromium/src/base/shared_memory_posix.cc
+++ b/ipc/chromium/src/base/shared_memory_posix.cc
@@ -9,16 +9,17 @@
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/platform_thread.h"
 #include "base/string_util.h"
+#include "mozilla/UniquePtr.h"
 
 namespace base {
 
 SharedMemory::SharedMemory()
     : mapped_file_(-1),
       inode_(0),
       memory_(NULL),
       read_only_(false),
@@ -137,17 +138,17 @@ class ScopedFILEClose {
  public:
   inline void operator()(FILE* x) const {
     if (x) {
       fclose(x);
     }
   }
 };
 
-typedef scoped_ptr_malloc<FILE, ScopedFILEClose> ScopedFILE;
+typedef mozilla::UniquePtr<FILE, ScopedFILEClose> ScopedFILE;
 
 }
 
 // Chromium mostly only use the unique/private shmem as specified by
 // "name == L"". The exception is in the StatsTable.
 // TODO(jrg): there is no way to "clean up" all unused named shmem if
 // we restart from a crash.  (That isn't a new problem, but it is a problem.)
 // In case we want to delete it later, it may be useful to save the value
--- a/ipc/chromium/src/base/sys_info_win.cc
+++ b/ipc/chromium/src/base/sys_info_win.cc
@@ -2,18 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/sys_info.h"
 
 #include <windows.h>
 
 #include "base/logging.h"
-#include "base/scoped_ptr.h"
 #include "base/string_util.h"
+#include "mozilla/UniquePtr.h"
 
 namespace base {
 
 // static
 int SysInfo::NumberOfProcessors() {
   SYSTEM_INFO info;
   GetSystemInfo(&info);
   return static_cast<int>(info.dwNumberOfProcessors);
@@ -52,17 +52,17 @@ bool SysInfo::HasEnvVar(const wchar_t* v
 }
 
 // static
 std::wstring SysInfo::GetEnvVar(const wchar_t* var) {
   DWORD value_length = GetEnvironmentVariable(var, NULL, 0);
   if (value_length == 0) {
     return L"";
   }
-  scoped_array<wchar_t> value(new wchar_t[value_length]);
+  mozilla::UniquePtr<wchar_t[]> value(new wchar_t[value_length]);
   GetEnvironmentVariable(var, value.get(), value_length);
   return std::wstring(value.get());
 }
 
 // static
 std::string SysInfo::OperatingSystemName() {
   return "Windows NT";
 }
--- a/ipc/chromium/src/base/waitable_event.h
+++ b/ipc/chromium/src/base/waitable_event.h
@@ -11,17 +11,18 @@
 #include <windows.h>
 #endif
 
 #if defined(OS_POSIX)
 #include <list>
 #include <utility>
 #include "base/condition_variable.h"
 #include "base/lock.h"
-#include "base/ref_counted.h"
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 #endif
 
 #include "base/message_loop.h"
 
 namespace base {
 
 // This replaces INFINITE from Win32
 static const int kNoTimeout = -1;
@@ -135,33 +136,35 @@ class WaitableEvent {
   // On Windows, one can close a HANDLE which is currently being waited on. The
   // MSDN documentation says that the resulting behaviour is 'undefined', but
   // it doesn't crash. However, if we were to include the following members
   // directly then, on POSIX, one couldn't use WaitableEventWatcher to watch an
   // event which gets deleted. This mismatch has bitten us several times now,
   // so we have a kernel of the WaitableEvent, which is reference counted.
   // WaitableEventWatchers may then take a reference and thus match the Windows
   // behaviour.
-  struct WaitableEventKernel :
-      public RefCountedThreadSafe<WaitableEventKernel> {
+  struct WaitableEventKernel MOZ_FINAL {
    public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(WaitableEventKernel)
     WaitableEventKernel(bool manual_reset, bool initially_signaled)
         : manual_reset_(manual_reset),
           signaled_(initially_signaled) {
     }
 
     bool Dequeue(Waiter* waiter, void* tag);
 
     Lock lock_;
     const bool manual_reset_;
     bool signaled_;
     std::list<Waiter*> waiters_;
+   protected:
+    ~WaitableEventKernel() {}
   };
 
-  scoped_refptr<WaitableEventKernel> kernel_;
+  nsRefPtr<WaitableEventKernel> kernel_;
 
   bool SignalAll();
   bool SignalOne();
   void Enqueue(Waiter* waiter);
 
   // When dealing with arrays of WaitableEvent*, we want to sort by the address
   // of the WaitableEvent in order to have a globally consistent locking order.
   // In that case we keep them, in sorted order, in an array of pairs where the
--- a/ipc/chromium/src/base/waitable_event_watcher.h
+++ b/ipc/chromium/src/base/waitable_event_watcher.h
@@ -7,16 +7,17 @@
 
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include "base/object_watcher.h"
 #else
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
+#include "nsAutoPtr.h"
 #endif
 
 namespace base {
 
 class Flag;
 class AsyncWaiter;
 class AsyncCallbackTask;
 class WaitableEvent;
@@ -136,18 +137,18 @@ class WaitableEventWatcher
   ObjectWatcher watcher_;
 #else
   // ---------------------------------------------------------------------------
   // Implementation of MessageLoop::DestructionObserver
   // ---------------------------------------------------------------------------
   void WillDestroyCurrentMessageLoop();
 
   MessageLoop* message_loop_;
-  scoped_refptr<Flag> cancel_flag_;
+  nsRefPtr<Flag> cancel_flag_;
   AsyncWaiter* waiter_;
   AsyncCallbackTask* callback_task_;
-  scoped_refptr<WaitableEvent::WaitableEventKernel> kernel_;
+  nsRefPtr<WaitableEvent::WaitableEventKernel> kernel_;
 #endif
 };
 
 }  // namespace base
 
 #endif  // BASE_WAITABLE_EVENT_WATCHER_H_
--- a/ipc/chromium/src/base/waitable_event_watcher_posix.cc
+++ b/ipc/chromium/src/base/waitable_event_watcher_posix.cc
@@ -4,16 +4,18 @@
 
 #include "base/waitable_event_watcher.h"
 
 #include "base/condition_variable.h"
 #include "base/lock.h"
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
 
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 #include "mozilla/Attributes.h"
 
 namespace base {
 
 // -----------------------------------------------------------------------------
 // WaitableEventWatcher (async waits).
 //
 // The basic design is that we add an AsyncWaiter to the wait-list of the event.
@@ -24,30 +26,33 @@ namespace base {
 // set when the wait has been canceled. At each stage in the above, we check the
 // flag before going onto the next stage. Since the wait may only be canceled in
 // the MessageLoop which runs the Task, we are assured that the delegate cannot
 // be called after canceling...
 
 // -----------------------------------------------------------------------------
 // A thread-safe, reference-counted, write-once flag.
 // -----------------------------------------------------------------------------
-class Flag : public RefCountedThreadSafe<Flag> {
+class Flag MOZ_FINAL {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(Flag)
   Flag() { flag_ = false; }
 
   void Set() {
     AutoLock locked(lock_);
     flag_ = true;
   }
 
   bool value() const {
     AutoLock locked(lock_);
     return flag_;
   }
 
+ protected:
+  ~Flag() {}
  private:
   mutable Lock lock_;
   bool flag_;
 };
 
 // -----------------------------------------------------------------------------
 // This is an asynchronous waiter which posts a task to a MessageLoop when
 // fired. An AsyncWaiter may only be in a single wait-list.
@@ -80,17 +85,17 @@ class AsyncWaiter MOZ_FINAL : public Wai
   // See StopWatching for discussion
   bool Compare(void* tag) {
     return tag == flag_.get();
   }
 
  private:
   MessageLoop *const message_loop_;
   Task *const cb_task_;
-  scoped_refptr<Flag> flag_;
+  nsRefPtr<Flag> flag_;
 };
 
 // -----------------------------------------------------------------------------
 // For async waits we need to make a callback in a MessageLoop thread. We do
 // this by posting this task, which calls the delegate and keeps track of when
 // the event is canceled.
 // -----------------------------------------------------------------------------
 class AsyncCallbackTask : public Task {
@@ -110,17 +115,17 @@ class AsyncCallbackTask : public Task {
       flag_->Set();
       delegate_->OnWaitableEventSignaled(event_);
     }
 
     // We are deleted by the MessageLoop
   }
 
  private:
-  scoped_refptr<Flag> flag_;
+  nsRefPtr<Flag> flag_;
   WaitableEventWatcher::Delegate *const delegate_;
   WaitableEvent *const event_;
 };
 
 WaitableEventWatcher::WaitableEventWatcher()
     : event_(NULL),
       message_loop_(NULL),
       cancel_flag_(NULL),
--- a/ipc/chromium/src/base/win_util.cc
+++ b/ipc/chromium/src/base/win_util.cc
@@ -4,18 +4,16 @@
 
 #include "base/win_util.h"
 
 #include <map>
 #include <sddl.h>
 
 #include "base/logging.h"
 #include "base/registry.h"
-#include "base/scoped_handle.h"
-#include "base/scoped_ptr.h"
 #include "base/singleton.h"
 #include "base/string_util.h"
 #include "base/tracked.h"
 
 namespace win_util {
 
 WinVersion GetWinVersion() {
   static bool checked_version = false;
--- a/ipc/chromium/src/chrome/common/child_process.h
+++ b/ipc/chromium/src/chrome/common/child_process.h
@@ -4,18 +4,18 @@
 
 #ifndef CHROME_COMMON_CHILD_PROCESS_H__
 #define CHROME_COMMON_CHILD_PROCESS_H__
 
 #include <string>
 #include <vector>
 #include "base/basictypes.h"
 #include "base/message_loop.h"
-#include "base/scoped_ptr.h"
 #include "base/waitable_event.h"
+#include "mozilla/UniquePtr.h"
 
 class ChildThread;
 
 
 // Base class for child processes of the browser process (i.e. renderer and
 // plugin host). This is a singleton object for each child process.
 class ChildProcess {
  public:
@@ -46,17 +46,17 @@ class ChildProcess {
   void ReleaseProcess();
 
   // Getter for the one ChildProcess object for this process.
   static ChildProcess* current() { return child_process_; }
 
  private:
   // NOTE: make sure that child_thread_ is listed before shutdown_event_, since
   // it depends on it (indirectly through IPC::SyncChannel).
-  scoped_ptr<ChildThread> child_thread_;
+  mozilla::UniquePtr<ChildThread> child_thread_;
 
   int ref_count_;
 
   // An event that will be signalled when we shutdown.
   base::WaitableEvent shutdown_event_;
 
   // The singleton instance for this process.
   static ChildProcess* child_process_;
--- a/ipc/chromium/src/chrome/common/child_process_host.h
+++ b/ipc/chromium/src/chrome/common/child_process_host.h
@@ -5,20 +5,20 @@
 #ifndef CHROME_COMMON_CHILD_PROCESS_HOST_H_
 #define CHROME_COMMON_CHILD_PROCESS_HOST_H_
 
 #include "build/build_config.h"
 
 #include <list>
 
 #include "base/basictypes.h"
-#include "base/scoped_ptr.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/child_process_info.h"
 #include "chrome/common/ipc_channel.h"
+#include "mozilla/UniquePtr.h"
 
 namespace mozilla {
 namespace ipc {
 class FileDescriptor;
 }
 }
 
 class NotificationType;
@@ -111,20 +111,20 @@ class ChildProcessHost :
   };
 
   ListenerHook listener_;
 
   // True while we're waiting the channel to be opened.
   bool opening_channel_;
 
   // The IPC::Channel.
-  scoped_ptr<IPC::Channel> channel_;
+  mozilla::UniquePtr<IPC::Channel> channel_;
 
   // IPC Channel's id.
   std::wstring channel_id_;
 
   // Used to watch the child process handle.
   base::WaitableEventWatcher watcher_;
 
-  scoped_ptr<base::WaitableEvent> process_event_;
+  mozilla::UniquePtr<base::WaitableEvent> process_event_;
 };
 
 #endif  // CHROME_COMMON_CHILD_PROCESS_HOST_H_
--- a/ipc/chromium/src/chrome/common/child_thread.cc
+++ b/ipc/chromium/src/chrome/common/child_thread.cc
@@ -84,32 +84,32 @@ void ChildThread::OnMessageReceived(cons
   }
 }
 
 ChildThread* ChildThread::current() {
   return ChildProcess::current()->child_thread();
 }
 
 void ChildThread::Init() {
-  channel_.reset(new IPC::Channel(channel_name_,
-                                  IPC::Channel::MODE_CLIENT,
-                                  this));
+  channel_ = mozilla::MakeUnique<IPC::Channel>(channel_name_,
+                                               IPC::Channel::MODE_CLIENT,
+                                               this);
 
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::current()->SetIPCSender(this);
 #endif
 }
 
 void ChildThread::CleanUp() {
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::current()->SetIPCSender(NULL);
 #endif
   // Need to destruct the SyncChannel to the browser before we go away because
   // it caches a pointer to this thread.
-  channel_.reset();
+  channel_ = nullptr;
 }
 
 void ChildThread::OnProcessFinalRelease() {
   if (!check_with_browser_before_shutdown_) {
     owner_loop_->PostTask(FROM_HERE, new MessageLoop::QuitTask());
     return;
   }
 }
--- a/ipc/chromium/src/chrome/common/child_thread.h
+++ b/ipc/chromium/src/chrome/common/child_thread.h
@@ -3,16 +3,17 @@
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_CHILD_THREAD_H_
 #define CHROME_COMMON_CHILD_THREAD_H_
 
 #include "base/thread.h"
 #include "chrome/common/ipc_sync_channel.h"
 #include "chrome/common/message_router.h"
+#include "mozilla/UniquePtr.h"
 
 class ResourceDispatcher;
 
 // Child processes's background thread should derive from this class.
 class ChildThread : public IPC::Channel::Listener,
                     public IPC::Message::Sender,
                     public base::Thread {
  public:
@@ -64,17 +65,17 @@ class ChildThread : public IPC::Channel:
 #ifdef MOZ_NUWA_PROCESS
   static void MarkThread();
 #endif
 
   // The message loop used to run tasks on the thread that started this thread.
   MessageLoop* owner_loop_;
 
   std::wstring channel_name_;
-  scoped_ptr<IPC::Channel> channel_;
+  mozilla::UniquePtr<IPC::Channel> channel_;
 
   // Used only on the background render thread to implement message routing
   // functionality to the consumers of the ChildThread.
   MessageRouter router_;
 
   Thread::Options options_;
 
   // If true, checks with the browser process before shutdown.  This avoids race
--- a/ipc/chromium/src/chrome/common/file_descriptor_set_posix.h
+++ b/ipc/chromium/src/chrome/common/file_descriptor_set_posix.h
@@ -4,27 +4,27 @@
 
 #ifndef CHROME_COMMON_FILE_DESCRIPTOR_SET_POSIX_H_
 #define CHROME_COMMON_FILE_DESCRIPTOR_SET_POSIX_H_
 
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/file_descriptor_posix.h"
-#include "base/ref_counted.h"
+#include "nsISupportsImpl.h"
 
 // -----------------------------------------------------------------------------
 // A FileDescriptorSet is an ordered set of POSIX file descriptors. These are
 // associated with IPC messages so that descriptors can be transmitted over a
 // UNIX domain socket.
 // -----------------------------------------------------------------------------
-class FileDescriptorSet : public base::RefCountedThreadSafe<FileDescriptorSet> {
+class FileDescriptorSet {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(FileDescriptorSet)
   FileDescriptorSet();
-  ~FileDescriptorSet();
 
   // Mac and Linux both limit the number of file descriptors per message to
   // slightly more than 250.
   enum {
     MAX_DESCRIPTORS_PER_MESSAGE = 250
   };
 
   // ---------------------------------------------------------------------------
@@ -79,16 +79,18 @@ class FileDescriptorSet : public base::R
   // Set the contents of the set from the given buffer. This set must be empty
   // before calling. The auto-close flag is set on all the descriptors so that
   // unconsumed descriptors are closed on destruction.
   void SetDescriptors(const int* buffer, unsigned count);
 
   // ---------------------------------------------------------------------------
 
  private:
+  ~FileDescriptorSet();
+
   // A vector of descriptors and close flags. If this message is sent, then
   // these descriptors are sent as control data. After sending, any descriptors
   // with a true flag are closed. If this message has been received, then these
   // are the descriptors which were received and all close flags are true.
   std::vector<base::FileDescriptor> descriptors_;
 
   // This contains the index of the next descriptor which should be consumed.
   // It's used in a couple of ways. Firstly, at destruction we can check that
--- a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
@@ -17,24 +17,24 @@
 #include <string>
 #include <map>
 
 #include "base/command_line.h"
 #include "base/eintr_wrapper.h"
 #include "base/lock.h"
 #include "base/logging.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/string_util.h"
 #include "base/singleton.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/file_descriptor_set_posix.h"
 #include "chrome/common/ipc_logging.h"
 #include "chrome/common/ipc_message_utils.h"
 #include "mozilla/ipc/ProtocolUtils.h"
+#include "mozilla/UniquePtr.h"
 
 #ifdef MOZ_TASK_TRACER
 #include "GeckoTaskTracerImpl.h"
 using namespace mozilla::tasktracer;
 #endif
 
 namespace IPC {
 
@@ -366,19 +366,19 @@ bool Channel::ChannelImpl::CreatePipe(co
  */
 void Channel::ChannelImpl::ResetFileDescriptor(int fd) {
   NS_ASSERTION(fd > 0 && fd == pipe_, "Invalid file descriptor");
 
   EnqueueHelloMessage();
 }
 
 bool Channel::ChannelImpl::EnqueueHelloMessage() {
-  scoped_ptr<Message> msg(new Message(MSG_ROUTING_NONE,
-                                      HELLO_MESSAGE_TYPE,
-                                      IPC::Message::PRIORITY_NORMAL));
+  mozilla::UniquePtr<Message> msg(new Message(MSG_ROUTING_NONE,
+                                              HELLO_MESSAGE_TYPE,
+                                              IPC::Message::PRIORITY_NORMAL));
   if (!msg->WriteInt(base::GetCurrentProcId())) {
     Close();
     return false;
   }
 
   OutputQueuePush(msg.release());
   return true;
 }
--- a/ipc/chromium/src/chrome/common/ipc_channel_posix.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.h
@@ -12,16 +12,18 @@
 #include <queue>
 #include <string>
 #include <vector>
 #include <list>
 
 #include "base/message_loop.h"
 #include "chrome/common/file_descriptor_set_posix.h"
 
+#include "nsAutoPtr.h"
+
 namespace IPC {
 
 // An implementation of ChannelImpl for POSIX systems that works via
 // socketpairs.  See the .cc file for an overview of the implementation.
 class Channel::ChannelImpl : public MessageLoopForIO::Watcher {
  public:
   // Mirror methods of Channel, see ipc_channel.h for description.
   ChannelImpl(const std::wstring& channel_id, Mode mode, Listener* listener);
@@ -141,17 +143,17 @@ class Channel::ChannelImpl : public Mess
   bool processing_incoming_;
 
   // This flag is set after we've closed the channel.
   bool closed_;
 
 #if defined(OS_MACOSX)
   struct PendingDescriptors {
     uint32_t id;
-    scoped_refptr<FileDescriptorSet> fds;
+    nsRefPtr<FileDescriptorSet> fds;
 
     PendingDescriptors() : id(0) { }
     PendingDescriptors(uint32_t id, FileDescriptorSet *fds)
       : id(id),
         fds(fds)
     { }
   };
 
--- a/ipc/chromium/src/chrome/common/ipc_channel_proxy.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_proxy.h
@@ -2,18 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_IPC_CHANNEL_PROXY_H__
 #define CHROME_COMMON_IPC_CHANNEL_PROXY_H__
 
 #include <vector>
 #include "base/lock.h"
-#include "base/ref_counted.h"
 #include "chrome/common/ipc_channel.h"
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 
 class MessageLoop;
 
 namespace IPC {
 
 //-----------------------------------------------------------------------------
 // IPC::ChannelProxy
 //
@@ -41,19 +42,19 @@ namespace IPC {
 //
 // The consumer of IPC::ChannelProxy is responsible for allocating the Thread
 // instance where the IPC::Channel will be created and operated.
 //
 class ChannelProxy : public Message::Sender {
  public:
   // A class that receives messages on the thread where the IPC channel is
   // running.  It can choose to prevent the default action for an IPC message.
-  class MessageFilter : public base::RefCountedThreadSafe<MessageFilter> {
+  class MessageFilter {
    public:
-    virtual ~MessageFilter() {}
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MessageFilter)
 
     // Called on the background thread to provide the filter with access to the
     // channel.  Called when the IPC channel is initialized or when AddFilter
     // is called if the channel is already initialized.
     virtual void OnFilterAdded(Channel* channel) {}
 
     // Called on the background thread when the filter has been removed from
     // the ChannelProxy and when the Channel is closing.  After a filter is
@@ -72,16 +73,18 @@ class ChannelProxy : public Message::Sen
     // OnFilterRemoved is called immediately after this.
     virtual void OnChannelClosing() {}
 
     // Return true to indicate that the message was handled, or false to let
     // the message be handled in the default way.
     virtual bool OnMessageReceived(const Message& message) {
       return false;
     }
+   protected:
+    virtual ~MessageFilter() {}
   };
 
   // Initializes a channel proxy.  The channel_id and mode parameters are
   // passed directly to the underlying IPC::Channel.  The listener is called on
   // the thread that creates the ChannelProxy.  The filter's OnMessageReceived
   // method is called on the thread where the IPC::Channel is running.  The
   // filter may be null if the consumer is not interested in handling messages
   // on the background thread.  Any message not handled by the filter will be
@@ -129,29 +132,30 @@ class ChannelProxy : public Message::Sen
   // A subclass uses this constructor if it needs to add more information
   // to the internal state.  If create_pipe_now is true, the pipe is created
   // immediately.  Otherwise it's created on the IO thread.
   ChannelProxy(const std::wstring& channel_id, Channel::Mode mode,
                MessageLoop* ipc_thread_loop, Context* context,
                bool create_pipe_now);
 
   // Used internally to hold state that is referenced on the IPC thread.
-  class Context : public base::RefCountedThreadSafe<Context>,
-                  public Channel::Listener {
+  class Context : public Channel::Listener {
    public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(Context)
     Context(Channel::Listener* listener, MessageFilter* filter,
             MessageLoop* ipc_thread);
-    virtual ~Context() { }
     MessageLoop* ipc_message_loop() const { return ipc_message_loop_; }
     const std::wstring& channel_id() const { return channel_id_; }
 
     // Dispatches a message on the listener thread.
     void OnDispatchMessage(const Message& message);
 
    protected:
+    virtual ~Context() {}
+
     // IPC::Channel::Listener methods:
     virtual void OnMessageReceived(const Message& message);
     virtual void OnChannelConnected(int32_t peer_pid);
     virtual void OnChannelError();
 
     // Like OnMessageReceived but doesn't try the filters.
     void OnMessageReceivedNoFilter(const Message& message);
 
@@ -179,31 +183,31 @@ class ChannelProxy : public Message::Sen
     void OnRemoveFilter(MessageFilter* filter);
     void OnDispatchConnected();
     void OnDispatchError();
 
     MessageLoop* listener_message_loop_;
     Channel::Listener* listener_;
 
     // List of filters.  This is only accessed on the IPC thread.
-    std::vector<scoped_refptr<MessageFilter> > filters_;
+    std::vector<nsRefPtr<MessageFilter> > filters_;
     MessageLoop* ipc_message_loop_;
     Channel* channel_;
     std::wstring channel_id_;
     int peer_pid_;
     bool channel_connected_called_;
   };
 
   Context* context() { return context_; }
 
  private:
   void Init(const std::wstring& channel_id, Channel::Mode mode,
             MessageLoop* ipc_thread_loop, bool create_pipe_now);
 
   // By maintaining this indirection (ref-counted) to our internal state, we
   // can safely be destroyed while the background thread continues to do stuff
   // that involves this data.
-  scoped_refptr<Context> context_;
+  nsRefPtr<Context> context_;
 };
 
 }  // namespace IPC
 
 #endif  // CHROME_COMMON_IPC_CHANNEL_PROXY_H__
--- a/ipc/chromium/src/chrome/common/ipc_channel_win.cc
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
@@ -196,19 +196,19 @@ bool Channel::ChannelImpl::CreatePipe(co
     return false;
   }
 
   // Create the Hello message to be sent when Connect is called
   return EnqueueHelloMessage();
 }
 
 bool Channel::ChannelImpl::EnqueueHelloMessage() {
-  scoped_ptr<Message> m(new Message(MSG_ROUTING_NONE,
-                                    HELLO_MESSAGE_TYPE,
-                                    IPC::Message::PRIORITY_NORMAL));
+  mozilla::UniquePtr<Message> m = mozilla::MakeUnique<Message>(MSG_ROUTING_NONE,
+                                                               HELLO_MESSAGE_TYPE,
+                                                               IPC::Message::PRIORITY_NORMAL);
   if (!m->WriteInt(GetCurrentProcessId())) {
     CloseHandle(pipe_);
     pipe_ = INVALID_HANDLE_VALUE;
     return false;
   }
 
   OutputQueuePush(m.release());
   return true;
--- a/ipc/chromium/src/chrome/common/ipc_channel_win.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.h
@@ -6,16 +6,17 @@
 #define CHROME_COMMON_IPC_CHANNEL_WIN_H_
 
 #include "chrome/common/ipc_channel.h"
 
 #include <queue>
 #include <string>
 
 #include "base/message_loop.h"
+#include "mozilla/UniquePtr.h"
 
 class NonThreadSafe;
 
 namespace IPC {
 
 class Channel::ChannelImpl : public MessageLoopForIO::IOHandler {
  public:
   // Mirror methods of Channel, see ipc_channel.h for description.
@@ -102,16 +103,16 @@ class Channel::ChannelImpl : public Mess
   // This variable is updated so it matches output_queue_.size(), except we can
   // read output_queue_length_ from any thread (if we're OK getting an
   // occasional out-of-date or bogus value).  We use output_queue_length_ to
   // implement Unsound_NumQueuedMessages.
   size_t output_queue_length_;
 
   ScopedRunnableMethodFactory<ChannelImpl> factory_;
 
-  scoped_ptr<NonThreadSafe> thread_check_;
+  mozilla::UniquePtr<NonThreadSafe> thread_check_;
 
   DISALLOW_COPY_AND_ASSIGN(ChannelImpl);
 };
 
 }  // namespace IPC
 
 #endif  // CHROME_COMMON_IPC_CHANNEL_WIN_H_
--- a/ipc/chromium/src/chrome/common/ipc_logging.h
+++ b/ipc/chromium/src/chrome/common/ipc_logging.h
@@ -9,16 +9,17 @@
 
 #ifdef IPC_MESSAGE_LOG_ENABLED
 
 #include "base/lock.h"
 #include "base/message_loop.h"
 #include "base/singleton.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/ipc_message_utils.h"
+#include "mozilla/UniquePtr.h"
 
 class MessageLoop;
 
 namespace IPC {
 
 class Message;
 
 // One instance per process.  Needs to be created on the main thread (the UI
@@ -86,18 +87,18 @@ class Logging : public base::WaitableEve
   std::wstring GetEventName(int browser_pid, bool enabled);
   void OnSendLogs();
   void Log(const LogData& data);
 
   void RegisterWaitForEvent(bool enabled);
 
   base::WaitableEventWatcher watcher_;
 
-  scoped_ptr<base::WaitableEvent> logging_event_on_;
-  scoped_ptr<base::WaitableEvent> logging_event_off_;
+  mozilla::UniquePtr<base::WaitableEvent> logging_event_on_;
+  mozilla::UniquePtr<base::WaitableEvent> logging_event_off_;
   bool enabled_;
 
   std::vector<LogData> queued_logs_;
   bool queue_invoke_later_pending_;
 
   Message::Sender* sender_;
   MessageLoop* main_thread_;
 
--- a/ipc/chromium/src/chrome/common/ipc_message.h
+++ b/ipc/chromium/src/chrome/common/ipc_message.h
@@ -14,17 +14,17 @@
 #include "GeckoTaskTracer.h"
 #endif
 
 #ifndef NDEBUG
 #define IPC_MESSAGE_LOG_ENABLED
 #endif
 
 #if defined(OS_POSIX)
-#include "base/ref_counted.h"
+#include "nsAutoPtr.h"
 #endif
 
 namespace base {
 struct FileDescriptor;
 }
 
 class FileDescriptorSet;
 
@@ -357,17 +357,17 @@ class Message : public Pickle {
   const Header* header() const {
     return headerT<Header>();
   }
 
   void InitLoggingVariables(const char* const name="???");
 
 #if defined(OS_POSIX)
   // The set of file descriptors associated with this message.
-  scoped_refptr<FileDescriptorSet> file_descriptor_set_;
+  nsRefPtr<FileDescriptorSet> file_descriptor_set_;
 
   // Ensure that a FileDescriptorSet is allocated
   void EnsureFileDescriptorSet();
 
   FileDescriptorSet* file_descriptor_set() {
     EnsureFileDescriptorSet();
     return file_descriptor_set_.get();
   }
--- a/ipc/chromium/src/chrome/common/ipc_sync_channel.cc
+++ b/ipc/chromium/src/chrome/common/ipc_sync_channel.cc
@@ -6,16 +6,17 @@
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/thread_local.h"
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/ipc_sync_message.h"
+#include "nsISupportsImpl.h"
 
 using base::TimeDelta;
 using base::TimeTicks;
 using base::WaitableEvent;
 
 namespace IPC {
 // When we're blocked in a Send(), we need to process incoming synchronous
 // messages right away because it could be blocking our reply (either
@@ -29,36 +30,33 @@ namespace IPC {
 // allows us to dispatch incoming sync messages when blocked.  The race
 // condition is handled because if Send is in the process of being called, it
 // will check the event.  In case the listener thread isn't sending a message,
 // we queue a task on the listener thread to dispatch the received messages.
 // The messages are stored in this queue object that's shared among all
 // SyncChannel objects on the same thread (since one object can receive a
 // sync message while another one is blocked).
 
-class SyncChannel::ReceivedSyncMsgQueue :
-    public base::RefCountedThreadSafe<ReceivedSyncMsgQueue> {
+class SyncChannel::ReceivedSyncMsgQueue {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(SyncChannel::ReceivedSyncMsgQueue)
   // Returns the ReceivedSyncMsgQueue instance for this thread, creating one
   // if necessary.  Call RemoveContext on the same thread when done.
   static ReceivedSyncMsgQueue* AddContext() {
     // We want one ReceivedSyncMsgQueue per listener thread (i.e. since multiple
     // SyncChannel objects can block the same thread).
     ReceivedSyncMsgQueue* rv = lazy_tls_ptr_.Pointer()->Get();
     if (!rv) {
       rv = new ReceivedSyncMsgQueue();
       ReceivedSyncMsgQueue::lazy_tls_ptr_.Pointer()->Set(rv);
     }
     rv->listener_count_++;
     return rv;
   }
 
-  ~ReceivedSyncMsgQueue() {
-  }
-
   // Called on IPC thread when a synchronous message or reply arrives.
   void QueueMessage(const Message& msg, SyncChannel::SyncContext* context) {
     bool was_task_pending;
     {
       AutoLock auto_lock(message_lock_);
 
       was_task_pending = task_pending_;
       task_pending_ = true;
@@ -87,17 +85,17 @@ class SyncChannel::ReceivedSyncMsgQueue 
       task_pending_ = false;
     }
     DispatchMessages();
   }
 
   void DispatchMessages() {
     while (true) {
       Message* message;
-      scoped_refptr<SyncChannel::SyncContext> context;
+      nsRefPtr<SyncChannel::SyncContext> context;
       {
         AutoLock auto_lock(message_lock_);
         if (message_queue_.empty())
           break;
 
         message = message_queue_.front().message;
         context = message_queue_.front().context;
         message_queue_.pop_front();
@@ -143,31 +141,34 @@ class SyncChannel::ReceivedSyncMsgQueue 
       if (received_replies_[i].context->TryToUnblockListener(message)) {
         delete message;
         received_replies_.erase(received_replies_.begin() + i);
         return;
       }
     }
   }
 
+ protected:
+  ~ReceivedSyncMsgQueue() {}
+
  private:
   // See the comment in SyncChannel::SyncChannel for why this event is created
   // as manual reset.
   ReceivedSyncMsgQueue() :
       dispatch_event_(true, false),
       listener_message_loop_(MessageLoop::current()),
       task_pending_(false),
       listener_count_(0) {
   }
 
   // Holds information about a queued synchronous message or reply.
   struct QueuedMessage {
     QueuedMessage(Message* m, SyncContext* c) : message(m), context(c) { }
     Message* message;
-    scoped_refptr<SyncChannel::SyncContext> context;
+    nsRefPtr<SyncChannel::SyncContext> context;
   };
 
   typedef std::deque<QueuedMessage> SyncMessageQueue;
   SyncMessageQueue message_queue_;
 
   std::vector<QueuedMessage> received_replies_;
 
   // Set when we got a synchronous message that we must respond to as the
@@ -363,17 +364,17 @@ bool SyncChannel::Send(Message* message)
 
 bool SyncChannel::SendWithTimeout(Message* message, int timeout_ms) {
   if (!message->is_sync()) {
     ChannelProxy::Send(message);
     return true;
   }
 
   // *this* might get deleted in WaitForReply.
-  scoped_refptr<SyncContext> context(sync_context());
+  nsRefPtr<SyncContext> context(sync_context());
   if (context->shutdown_event()->IsSignaled()) {
     delete message;
     return false;
   }
 
   DCHECK(sync_messages_with_no_timeout_allowed_ ||
          timeout_ms != base::kNoTimeout);
   SyncMessage* sync_msg = static_cast<SyncMessage*>(message);
--- a/ipc/chromium/src/chrome/common/ipc_sync_channel.h
+++ b/ipc/chromium/src/chrome/common/ipc_sync_channel.h
@@ -4,22 +4,23 @@
 
 #ifndef CHROME_COMMON_IPC_SYNC_SENDER_H__
 #define CHROME_COMMON_IPC_SYNC_SENDER_H__
 
 #include <string>
 #include <deque>
 #include "base/basictypes.h"
 #include "base/lock.h"
-#include "base/ref_counted.h"
 #include "base/scoped_handle.h"
 #include "base/waitable_event.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/ipc_channel_proxy.h"
 
+#include "nsAutoPtr.h"
+
 namespace IPC {
 
 class SyncMessage;
 class MessageReplyDeserializer;
 
 // This is similar to IPC::ChannelProxy, with the added feature of supporting
 // sending synchronous messages.
 // Note that care must be taken that the lifetime of the ipc_thread argument
@@ -118,17 +119,17 @@ class SyncChannel : public ChannelProxy,
       base::WaitableEvent* done_event;
       bool send_result;
     };
 
     typedef std::deque<PendingSyncMsg> PendingSyncMessageQueue;
     PendingSyncMessageQueue deserializers_;
     Lock deserializers_lock_;
 
-    scoped_refptr<ReceivedSyncMsgQueue> received_sync_msgs_;
+    nsRefPtr<ReceivedSyncMsgQueue> received_sync_msgs_;
 
     base::WaitableEvent* shutdown_event_;
     base::WaitableEventWatcher shutdown_watcher_;
   };
 
  private:
   // WaitableEventWatcher::Delegate implementation.
   virtual void OnWaitableEventSignaled(base::WaitableEvent* arg);
--- a/ipc/glue/GeckoChildProcessHost.h
+++ b/ipc/glue/GeckoChildProcessHost.h
@@ -2,17 +2,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef __IPC_GLUE_GECKOCHILDPROCESSHOST_H__
 #define __IPC_GLUE_GECKOCHILDPROCESSHOST_H__
 
 #include "base/file_path.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/ipc/FileDescriptor.h"
 #include "mozilla/Monitor.h"
 #include "mozilla/StaticPtr.h"
 
--- a/testing/mochitest/mochitest_options.py
+++ b/testing/mochitest/mochitest_options.py
@@ -738,17 +738,17 @@ class B2GOptions(MochitestOptions):
         defaults["httpPort"] = DEFAULT_PORTS['http']
         defaults["sslPort"] = DEFAULT_PORTS['https']
         defaults["logFile"] = "mochitest.log"
         defaults["autorun"] = True
         defaults["closeWhenDone"] = True
         defaults["testPath"] = ""
         defaults["extensionsToExclude"] = ["specialpowers"]
         # See dependencies of bug 1038943.
-        defaults["leakThreshold"] = 5116
+        defaults["leakThreshold"] = 5180
         self.set_defaults(**defaults)
 
     def verifyRemoteOptions(self, options):
         if options.remoteWebServer == None:
             if os.name != "nt":
                 options.remoteWebServer = moznetwork.get_ip()
             else:
                 self.error("You must specify a --remote-webserver=<ip address>")
--- a/xpcom/build/nsXPComInit.cpp
+++ b/xpcom/build/nsXPComInit.cpp
@@ -126,16 +126,17 @@ extern nsresult nsStringInputStreamConst
 #include "base/command_line.h"
 #include "base/message_loop.h"
 
 #include "mozilla/ipc/BrowserProcessSubThread.h"
 #include "mozilla/AvailableMemoryTracker.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/CountingAllocatorBase.h"
 #include "mozilla/SystemMemoryReporter.h"
+#include "mozilla/UniquePtr.h"
 
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 #ifdef MOZ_VISUAL_EVENT_TRACER
 #include "mozilla/VisualEventTracer.h"
 #endif
 
 #include "ogg/ogg.h"
@@ -517,18 +518,17 @@ NS_InitXPCOM2(nsIServiceManager** aResul
     sMessageLoop->set_thread_name("Gecko");
     // Set experimental values for main thread hangs:
     // 512ms for transient hangs and 8192ms for permanent hangs
     sMessageLoop->set_hang_timeouts(512, 8192);
   }
 
   if (XRE_GetProcessType() == GeckoProcessType_Default &&
       !BrowserProcessSubThread::GetMessageLoop(BrowserProcessSubThread::IO)) {
-    scoped_ptr<BrowserProcessSubThread> ioThread(
-      new BrowserProcessSubThread(BrowserProcessSubThread::IO));
+    UniquePtr<BrowserProcessSubThread> ioThread = MakeUnique<BrowserProcessSubThread>(BrowserProcessSubThread::IO);
 
     base::Thread::Options options;
     options.message_loop_type = MessageLoop::TYPE_IO;
     if (NS_WARN_IF(!ioThread->StartWithOptions(options))) {
       return NS_ERROR_FAILURE;
     }
 
     sIOThread = ioThread.release();