Backed out changeset d9872fdd25f8 (bug 1337331) for causing build problems for others + on request on bob
authorCarsten "Tomcat" Book <cbook@mozilla.com>
Fri, 24 Mar 2017 11:24:13 +0100
changeset 397423 72bc265f157f3937f25d18be68b60fb982df695a
parent 397422 90bc9728e5af79f157c01b67c4abd727395ad906
child 397493 473e0b20176139cff952b04e3eeff3ee155d0d3d
push id7391
push usermtabara@mozilla.com
push dateMon, 12 Jun 2017 13:08:53 +0000
treeherdermozilla-beta@2191d7f87e2e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1337331
milestone55.0a1
backs outd9872fdd25f8529697f75c6a7ef88d18dc7b5f80
first release with
nightly linux32
72bc265f157f / 55.0a1 / 20170324110206 / files
nightly linux64
72bc265f157f / 55.0a1 / 20170324110206 / files
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
Backed out changeset d9872fdd25f8 (bug 1337331) for causing build problems for others + on request on bob
security/sandbox/chromium-shim/base/MissingBasicTypes.h
security/sandbox/chromium-shim/base/debug/activity_tracker.h
security/sandbox/chromium-shim/base/debug/stack_trace.h
security/sandbox/chromium-shim/base/file_version_info_win.h
security/sandbox/chromium-shim/base/files/file_path.cpp
security/sandbox/chromium-shim/base/files/file_util.h
security/sandbox/chromium-shim/base/gtest_prod_util.h
security/sandbox/chromium-shim/base/logging.cpp
security/sandbox/chromium-shim/base/metrics/histogram_macros.h
security/sandbox/chromium-shim/base/scoped_native_library.h
security/sandbox/chromium-shim/base/threading/platform_thread_linux.cpp
security/sandbox/chromium-shim/base/trace_event/heap_profiler_allocation_context_tracker.h
security/sandbox/chromium-shim/base/tracked_objects.h
security/sandbox/chromium-shim/base/win/base_features.h
security/sandbox/chromium-shim/base/win/registry.h
security/sandbox/chromium-shim/base/win/sdkdecls.h
security/sandbox/chromium/base/at_exit.cc
security/sandbox/chromium/base/at_exit.h
security/sandbox/chromium/base/atomic_ref_count.h
security/sandbox/chromium/base/base_paths.h
security/sandbox/chromium/base/base_paths_win.h
security/sandbox/chromium/base/base_switches.cc
security/sandbox/chromium/base/base_switches.h
security/sandbox/chromium/base/bind.h
security/sandbox/chromium/base/bind_helpers.h
security/sandbox/chromium/base/bind_internal.h
security/sandbox/chromium/base/bind_internal_win.h
security/sandbox/chromium/base/bit_cast.h
security/sandbox/chromium/base/callback.h
security/sandbox/chromium/base/callback_forward.h
security/sandbox/chromium/base/callback_internal.cc
security/sandbox/chromium/base/callback_internal.h
security/sandbox/chromium/base/compiler_specific.h
security/sandbox/chromium/base/containers/adapters.h
security/sandbox/chromium/base/containers/hash_tables.h
security/sandbox/chromium/base/cpu.cc
security/sandbox/chromium/base/cpu.h
security/sandbox/chromium/base/debug/profiler.cc
security/sandbox/chromium/base/debug/profiler.h
security/sandbox/chromium/base/environment.h
security/sandbox/chromium/base/files/file_path.h
security/sandbox/chromium/base/guid.h
security/sandbox/chromium/base/hash.cc
security/sandbox/chromium/base/hash.h
security/sandbox/chromium/base/lazy_instance.h
security/sandbox/chromium/base/location.h
security/sandbox/chromium/base/logging.h
security/sandbox/chromium/base/macros.h
security/sandbox/chromium/base/memory/aligned_memory.h
security/sandbox/chromium/base/memory/free_deleter.h
security/sandbox/chromium/base/memory/ptr_util.h
security/sandbox/chromium/base/memory/raw_scoped_refptr_mismatch_checker.h
security/sandbox/chromium/base/memory/ref_counted.cc
security/sandbox/chromium/base/memory/ref_counted.h
security/sandbox/chromium/base/memory/scoped_ptr.h
security/sandbox/chromium/base/memory/shared_memory.h
security/sandbox/chromium/base/memory/shared_memory_handle.h
security/sandbox/chromium/base/memory/shared_memory_handle_win.cc
security/sandbox/chromium/base/memory/shared_memory_win.cc
security/sandbox/chromium/base/memory/singleton.h
security/sandbox/chromium/base/memory/weak_ptr.h
security/sandbox/chromium/base/move.h
security/sandbox/chromium/base/numerics/safe_conversions.h
security/sandbox/chromium/base/numerics/safe_conversions_impl.h
security/sandbox/chromium/base/numerics/safe_math.h
security/sandbox/chromium/base/numerics/safe_math_impl.h
security/sandbox/chromium/base/process/kill.h
security/sandbox/chromium/base/process/launch.h
security/sandbox/chromium/base/process/process.h
security/sandbox/chromium/base/process/process_handle_win.cc
security/sandbox/chromium/base/rand_util_win.cc
security/sandbox/chromium/base/sequence_checker.h
security/sandbox/chromium/base/sequence_checker_impl.h
security/sandbox/chromium/base/sequence_token.h
security/sandbox/chromium/base/sequenced_task_runner.h
security/sandbox/chromium/base/stl_util.h
security/sandbox/chromium/base/strings/safe_sprintf_unittest.cc
security/sandbox/chromium/base/strings/string16.h
security/sandbox/chromium/base/strings/string_number_conversions.cc
security/sandbox/chromium/base/strings/string_number_conversions.h
security/sandbox/chromium/base/strings/string_piece.h
security/sandbox/chromium/base/strings/string_split.cc
security/sandbox/chromium/base/strings/string_split.h
security/sandbox/chromium/base/strings/string_util.cc
security/sandbox/chromium/base/strings/string_util.h
security/sandbox/chromium/base/strings/utf_string_conversion_utils.h
security/sandbox/chromium/base/synchronization/condition_variable.h
security/sandbox/chromium/base/synchronization/condition_variable_posix.cc
security/sandbox/chromium/base/synchronization/lock.h
security/sandbox/chromium/base/synchronization/lock_impl.h
security/sandbox/chromium/base/synchronization/lock_impl_posix.cc
security/sandbox/chromium/base/synchronization/lock_impl_win.cc
security/sandbox/chromium/base/synchronization/waitable_event.h
security/sandbox/chromium/base/synchronization/waitable_event_posix.cc
security/sandbox/chromium/base/task_runner.h
security/sandbox/chromium/base/task_scheduler/task_traits.h
security/sandbox/chromium/base/template_util.h
security/sandbox/chromium/base/third_party/dmg_fp/dtoa.cc
security/sandbox/chromium/base/threading/platform_thread.h
security/sandbox/chromium/base/threading/platform_thread_internal_posix.cc
security/sandbox/chromium/base/threading/platform_thread_internal_posix.h
security/sandbox/chromium/base/threading/platform_thread_linux.cc
security/sandbox/chromium/base/threading/platform_thread_posix.cc
security/sandbox/chromium/base/threading/platform_thread_win.cc
security/sandbox/chromium/base/threading/sequenced_worker_pool.h
security/sandbox/chromium/base/threading/thread_checker_impl.h
security/sandbox/chromium/base/threading/thread_id_name_manager.cc
security/sandbox/chromium/base/threading/thread_local.h
security/sandbox/chromium/base/threading/thread_local_posix.cc
security/sandbox/chromium/base/threading/thread_local_storage.cc
security/sandbox/chromium/base/threading/thread_local_storage.h
security/sandbox/chromium/base/threading/thread_local_storage_posix.cc
security/sandbox/chromium/base/threading/thread_local_storage_win.cc
security/sandbox/chromium/base/threading/thread_local_win.cc
security/sandbox/chromium/base/threading/thread_restrictions.cc
security/sandbox/chromium/base/threading/thread_restrictions.h
security/sandbox/chromium/base/time/time.cc
security/sandbox/chromium/base/time/time.h
security/sandbox/chromium/base/time/time_posix.cc
security/sandbox/chromium/base/time/time_win.cc
security/sandbox/chromium/base/tuple.h
security/sandbox/chromium/base/values.h
security/sandbox/chromium/base/version.h
security/sandbox/chromium/base/win/current_module.h
security/sandbox/chromium/base/win/scoped_handle.cc
security/sandbox/chromium/base/win/scoped_handle.h
security/sandbox/chromium/base/win/scoped_process_information.cc
security/sandbox/chromium/base/win/windows_version.cc
security/sandbox/chromium/base/win/windows_version.h
security/sandbox/chromium/build/build_config.h
security/sandbox/chromium/build/buildflag.h
security/sandbox/chromium/sandbox/linux/bpf_dsl/bpf_dsl.cc
security/sandbox/chromium/sandbox/linux/bpf_dsl/bpf_dsl.h
security/sandbox/chromium/sandbox/linux/bpf_dsl/bpf_dsl_forward.h
security/sandbox/chromium/sandbox/linux/bpf_dsl/bpf_dsl_impl.h
security/sandbox/chromium/sandbox/linux/bpf_dsl/codegen.cc
security/sandbox/chromium/sandbox/linux/bpf_dsl/codegen.h
security/sandbox/chromium/sandbox/linux/bpf_dsl/cons.h
security/sandbox/chromium/sandbox/linux/seccomp-bpf/bpf_tester_compatibility_delegate.h
security/sandbox/chromium/sandbox/linux/seccomp-bpf/bpf_tests.h
security/sandbox/chromium/sandbox/linux/seccomp-bpf/bpf_tests_unittest.cc
security/sandbox/chromium/sandbox/linux/seccomp-bpf/sandbox_bpf.cc
security/sandbox/chromium/sandbox/linux/seccomp-bpf/sandbox_bpf.h
security/sandbox/chromium/sandbox/linux/seccomp-bpf/sandbox_bpf_test_runner.cc
security/sandbox/chromium/sandbox/linux/seccomp-bpf/sandbox_bpf_test_runner.h
security/sandbox/chromium/sandbox/linux/seccomp-bpf/syscall.cc
security/sandbox/chromium/sandbox/linux/services/syscall_wrappers.cc
security/sandbox/chromium/sandbox/linux/services/syscall_wrappers.h
security/sandbox/chromium/sandbox/linux/system_headers/x86_32_linux_syscalls.h
security/sandbox/chromium/sandbox/win/src/Wow64.cc
security/sandbox/chromium/sandbox/win/src/Wow64.h
security/sandbox/chromium/sandbox/win/src/Wow64_64.cc
security/sandbox/chromium/sandbox/win/src/acl.cc
security/sandbox/chromium/sandbox/win/src/acl.h
security/sandbox/chromium/sandbox/win/src/app_container.cc
security/sandbox/chromium/sandbox/win/src/app_container.h
security/sandbox/chromium/sandbox/win/src/app_container_test.cc
security/sandbox/chromium/sandbox/win/src/app_container_unittest.cc
security/sandbox/chromium/sandbox/win/src/broker_services.cc
security/sandbox/chromium/sandbox/win/src/broker_services.h
security/sandbox/chromium/sandbox/win/src/file_policy_test.cc
security/sandbox/chromium/sandbox/win/src/filesystem_interception.cc
security/sandbox/chromium/sandbox/win/src/handle_closer.cc
security/sandbox/chromium/sandbox/win/src/handle_closer_agent.cc
security/sandbox/chromium/sandbox/win/src/handle_closer_test.cc
security/sandbox/chromium/sandbox/win/src/handle_inheritance_test.cc
security/sandbox/chromium/sandbox/win/src/handle_interception.cc
security/sandbox/chromium/sandbox/win/src/integrity_level_test.cc
security/sandbox/chromium/sandbox/win/src/interception.cc
security/sandbox/chromium/sandbox/win/src/interception.h
security/sandbox/chromium/sandbox/win/src/interception_unittest.cc
security/sandbox/chromium/sandbox/win/src/interceptors.h
security/sandbox/chromium/sandbox/win/src/interceptors_64.cc
security/sandbox/chromium/sandbox/win/src/interceptors_64.h
security/sandbox/chromium/sandbox/win/src/ipc_tags.h
security/sandbox/chromium/sandbox/win/src/job.cc
security/sandbox/chromium/sandbox/win/src/named_pipe_interception.cc
security/sandbox/chromium/sandbox/win/src/named_pipe_policy_test.cc
security/sandbox/chromium/sandbox/win/src/nt_internals.h
security/sandbox/chromium/sandbox/win/src/policy_broker.cc
security/sandbox/chromium/sandbox/win/src/policy_broker.h
security/sandbox/chromium/sandbox/win/src/policy_low_level.h
security/sandbox/chromium/sandbox/win/src/policy_target_test.cc
security/sandbox/chromium/sandbox/win/src/process_mitigations.cc
security/sandbox/chromium/sandbox/win/src/process_mitigations.h
security/sandbox/chromium/sandbox/win/src/process_mitigations_test.cc
security/sandbox/chromium/sandbox/win/src/process_mitigations_win32k_dispatcher.cc
security/sandbox/chromium/sandbox/win/src/process_mitigations_win32k_dispatcher.h
security/sandbox/chromium/sandbox/win/src/process_mitigations_win32k_interception.cc
security/sandbox/chromium/sandbox/win/src/process_mitigations_win32k_interception.h
security/sandbox/chromium/sandbox/win/src/process_mitigations_win32k_policy.cc
security/sandbox/chromium/sandbox/win/src/process_mitigations_win32k_policy.h
security/sandbox/chromium/sandbox/win/src/process_policy_test.cc
security/sandbox/chromium/sandbox/win/src/process_thread_dispatcher.cc
security/sandbox/chromium/sandbox/win/src/process_thread_dispatcher.h
security/sandbox/chromium/sandbox/win/src/process_thread_interception.cc
security/sandbox/chromium/sandbox/win/src/process_thread_interception.h
security/sandbox/chromium/sandbox/win/src/process_thread_policy.cc
security/sandbox/chromium/sandbox/win/src/process_thread_policy.h
security/sandbox/chromium/sandbox/win/src/registry_dispatcher.cc
security/sandbox/chromium/sandbox/win/src/registry_interception.cc
security/sandbox/chromium/sandbox/win/src/registry_policy.cc
security/sandbox/chromium/sandbox/win/src/restricted_token.cc
security/sandbox/chromium/sandbox/win/src/restricted_token.h
security/sandbox/chromium/sandbox/win/src/restricted_token_unittest.cc
security/sandbox/chromium/sandbox/win/src/restricted_token_utils.cc
security/sandbox/chromium/sandbox/win/src/restricted_token_utils.h
security/sandbox/chromium/sandbox/win/src/sandbox.h
security/sandbox/chromium/sandbox/win/src/sandbox.vcproj
security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc
security/sandbox/chromium/sandbox/win/src/sandbox_policy.h
security/sandbox/chromium/sandbox/win/src/sandbox_policy_base.cc
security/sandbox/chromium/sandbox/win/src/sandbox_policy_base.h
security/sandbox/chromium/sandbox/win/src/sandbox_types.h
security/sandbox/chromium/sandbox/win/src/security_level.h
security/sandbox/chromium/sandbox/win/src/service_resolver_32.cc
security/sandbox/chromium/sandbox/win/src/service_resolver_64.cc
security/sandbox/chromium/sandbox/win/src/service_resolver_unittest.cc
security/sandbox/chromium/sandbox/win/src/sharedmem_ipc_server.cc
security/sandbox/chromium/sandbox/win/src/sharedmem_ipc_server.h
security/sandbox/chromium/sandbox/win/src/sync_interception.cc
security/sandbox/chromium/sandbox/win/src/target_process.cc
security/sandbox/chromium/sandbox/win/src/target_process.h
security/sandbox/chromium/sandbox/win/src/target_services.cc
security/sandbox/chromium/sandbox/win/src/top_level_dispatcher.cc
security/sandbox/chromium/sandbox/win/src/top_level_dispatcher.h
security/sandbox/chromium/sandbox/win/src/win_utils.cc
security/sandbox/chromium/sandbox/win/src/win_utils.h
security/sandbox/chromium/sandbox/win/src/win_utils_unittest.cc
security/sandbox/chromium/sandbox/win/src/window.cc
security/sandbox/linux/moz.build
security/sandbox/moz-chromium-commit-status.txt
security/sandbox/moz.build
security/sandbox/win/src/sandboxbroker/moz.build
security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
security/sandbox/win/src/sandboxtarget/sandboxTarget.cpp
security/sandbox/win/src/sandboxtarget/sandboxTarget.h
new file mode 100644
--- /dev/null
+++ b/security/sandbox/chromium-shim/base/MissingBasicTypes.h
@@ -0,0 +1,25 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef security_sandbox_MissingBasicTypes_h__
+#define security_sandbox_MissingBasicTypes_h__
+
+#include <stdint.h>
+
+// These types are still used by the Chromium sandbox code. When referencing
+// Chromium sandbox code from Gecko we can't use the normal base/basictypes.h as
+// it clashes with the one from ipc/chromium/src/base/. These types have been
+// removed from the one in ipc/chromium/src/base/.
+typedef int8_t int8;
+typedef uint8_t uint8;
+typedef int16_t int16;
+typedef uint16_t uint16;
+typedef int32_t int32;
+typedef uint32_t uint32;
+typedef int64_t int64;
+typedef uint64_t uint64;
+
+#endif  // security_sandbox_MissingBasicTypes_h__
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/debug/activity_tracker.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a dummy version of Chromium source file base/debug/activity_tracker.h.
-// To provide a class required in base/synchronization/lock_impl_win.cc
-// ScopedLockAcquireActivity. We don't use activity tracking.
-
-#ifndef BASE_DEBUG_ACTIVITY_TRACKER_H_
-#define BASE_DEBUG_ACTIVITY_TRACKER_H_
-
-#include "base/base_export.h"
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-
-namespace base {
-class PlatformThreadHandle;
-class WaitableEvent;
-
-namespace internal {
-class LockImpl;
-}
-
-namespace debug {
-
-class BASE_EXPORT ScopedLockAcquireActivity
-{
- public:
-  ALWAYS_INLINE
-  explicit ScopedLockAcquireActivity(const base::internal::LockImpl* lock) {}
-  DISALLOW_COPY_AND_ASSIGN(ScopedLockAcquireActivity);
-};
-
-class BASE_EXPORT ScopedEventWaitActivity
-{
- public:
-  ALWAYS_INLINE
-  explicit ScopedEventWaitActivity(const base::WaitableEvent* event) {}
-  DISALLOW_COPY_AND_ASSIGN(ScopedEventWaitActivity);
-};
-
-class BASE_EXPORT ScopedThreadJoinActivity
-{
- public:
-  ALWAYS_INLINE
-  explicit ScopedThreadJoinActivity(const base::PlatformThreadHandle* thread) {}
-  DISALLOW_COPY_AND_ASSIGN(ScopedThreadJoinActivity);
-};
-
-
-}  // namespace debug
-}  // namespace base
-
-#endif  // BASE_DEBUG_ACTIVITY_TRACKER_H_
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/debug/stack_trace.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a dummy version of Chromium source file base/debug/stack_trace.h.
-// To provide a dummy class StackTrace required in base/win/scoped_handle.cc.
-
-#ifndef BASE_DEBUG_STACK_TRACE_H_
-#define BASE_DEBUG_STACK_TRACE_H_
-
-namespace base {
-namespace debug {
-
-class BASE_EXPORT StackTrace {
- public:
-  StackTrace() {};
-};
-
-}  // namespace debug
-}  // namespace base
-
-#endif  // BASE_DEBUG_STACK_TRACE_H_
--- a/security/sandbox/chromium-shim/base/file_version_info_win.h
+++ b/security/sandbox/chromium-shim/base/file_version_info_win.h
@@ -6,26 +6,24 @@
 
 // This is a dummy version of Chromium source file base/file_version_info_win.h
 // Within our copy of Chromium files FileVersionInfoWin is only used in
 // base/win/windows_version.cc in GetVersionFromKernel32, which we don't use.
 
 #ifndef BASE_FILE_VERSION_INFO_WIN_H_
 #define BASE_FILE_VERSION_INFO_WIN_H_
 
-#include "mozilla/Assertions.h"
-
 struct tagVS_FIXEDFILEINFO;
 typedef tagVS_FIXEDFILEINFO VS_FIXEDFILEINFO;
 
 namespace base {
 class FilePath;
 }
 
 class FileVersionInfoWin {
  public:
   static FileVersionInfoWin*
-    CreateFileVersionInfo(const base::FilePath& file_path) { MOZ_CRASH(); }
+    CreateFileVersionInfo(const base::FilePath& file_path) { return nullptr; }
 
-  VS_FIXEDFILEINFO* fixed_file_info() { MOZ_CRASH(); }
+  VS_FIXEDFILEINFO* fixed_file_info() { return nullptr; }
 };
 
 #endif  // BASE_FILE_VERSION_INFO_WIN_H_
--- a/security/sandbox/chromium-shim/base/files/file_path.cpp
+++ b/security/sandbox/chromium-shim/base/files/file_path.cpp
@@ -3,20 +3,17 @@
 // found in the LICENSE file.
 
 // This is a dummy version of Chromium source file base/file/file_path.cc.
 // To provide the functions required in base/win/windows_version.cc
 // GetVersionFromKernel32, which we don't use.
 
 #include "base/files/file_path.h"
 
-#include "mozilla/Assertions.h"
-
 namespace base {
 
 FilePath::FilePath(FilePath::StringPieceType path) {
-  MOZ_CRASH();
 }
 
 FilePath::~FilePath() {
 }
 
 } // namespace base
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/files/file_util.h
+++ /dev/null
@@ -1,11 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a cut down version of Chromium source file base/files/file_util.h
-// This is included in base/memory/shared_memory.h, but it only actually
-// requires the include for base/files/file_path.h.
-
-#include "base/files/file_path.h"
--- a/security/sandbox/chromium-shim/base/gtest_prod_util.h
+++ b/security/sandbox/chromium-shim/base/gtest_prod_util.h
@@ -1,22 +1,17 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef BASE_GTEST_PROD_UTIL_H_
-#define BASE_GTEST_PROD_UTIL_H_
-
 #ifndef FRIEND_TEST
 #define FRIEND_TEST(A, B)
 #endif
 
 #ifndef FRIEND_TEST_ALL_PREFIXES
 #define FRIEND_TEST_ALL_PREFIXES(test_case_name, test_name)
 #endif
 
 #ifndef FORWARD_DECLARE_TEST
 #define FORWARD_DECLARE_TEST(test_case_name, test_name)
 #endif
-
-#endif  // BASE_GTEST_PROD_UTIL_H_
--- a/security/sandbox/chromium-shim/base/logging.cpp
+++ b/security/sandbox/chromium-shim/base/logging.cpp
@@ -23,18 +23,16 @@
 #endif
 
 #if defined(OS_WIN)
 #include "base/strings/utf_string_conversions.h"
 #endif
 
 #include <algorithm>
 
-#include "mozilla/Unused.h"
-
 namespace logging {
 
 namespace {
 
 int g_min_log_level = 0;
 
 LoggingDestination g_logging_destination = LOG_DEFAULT;
 
@@ -124,29 +122,27 @@ SystemErrorCode GetLastSystemErrorCode()
 
 #if defined(OS_WIN)
 Win32ErrorLogMessage::Win32ErrorLogMessage(const char* file,
                                            int line,
                                            LogSeverity severity,
                                            SystemErrorCode err)
     : err_(err),
       log_message_(file, line, severity) {
-  mozilla::Unused << err_;
 }
 
 Win32ErrorLogMessage::~Win32ErrorLogMessage() {
 }
 #elif defined(OS_POSIX)
 ErrnoLogMessage::ErrnoLogMessage(const char* file,
                                  int line,
                                  LogSeverity severity,
                                  SystemErrorCode err)
     : err_(err),
       log_message_(file, line, severity) {
-  mozilla::Unused << err_;
 }
 
 ErrnoLogMessage::~ErrnoLogMessage() {
 }
 #endif  // OS_WIN
 
 void RawLog(int level, const char* message) {
 }
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/metrics/histogram_macros.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a dummy version of Chromium source file base/metrics/histogram_macros.h.
-// To provide to histogram macros required in base/memory/shared_memory_win.cc
-// UMA_HISTOGRAM_ENUMERATION and UMA_HISTOGRAM_SPARSE_SLOWLY.
-// We don't require Chromiums histogram collection code.
-
-#ifndef BASE_METRICS_HISTOGRAM_MACROS_H_
-#define BASE_METRICS_HISTOGRAM_MACROS_H_
-
-#define UMA_HISTOGRAM_ENUMERATION(name, sample, enum_max) do { } while (0)
-#define UMA_HISTOGRAM_SPARSE_SLOWLY(name, sample) do { } while (0)
-
-#endif  // BASE_METRICS_HISTOGRAM_MACROS_H_
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/scoped_native_library.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a cut down version of Chromium source file base/scoped_native_library.h
-// The chromium sandbox only requires ScopedNativeLibrary class to automatically
-// unload the library, which we can achieve with UniquePtr.
-
-#ifndef BASE_SCOPED_NATIVE_LIBRARY_H_
-#define BASE_SCOPED_NATIVE_LIBRARY_H_
-
-#include "mozilla/UniquePtr.h"
-
-namespace base {
-
-struct HModuleFreePolicy
-{
-  typedef HMODULE pointer;
-  void operator()(pointer hModule)
-  {
-    ::FreeLibrary(hModule);
-  }
-};
-
-typedef mozilla::UniquePtr<HMODULE, HModuleFreePolicy> ScopedNativeLibrary;
-
-} // namespace base
-
-#endif  // BASE_SCOPED_NATIVE_LIBRARY_H_
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/threading/platform_thread_linux.cpp
+++ /dev/null
@@ -1,64 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a cut down version of Chromium source file base/threading/platform_thread_linux.h
-// with only the functions required. It also has a dummy implementation of
-// SetCurrentThreadPriorityForPlatform, which should not be called.
-
-#include "base/threading/platform_thread.h"
-
-#include "base/threading/platform_thread_internal_posix.h"
-
-#include "mozilla/Assertions.h"
-
-namespace base {
-namespace internal {
-
-namespace {
-const struct sched_param kRealTimePrio = {8};
-}  // namespace
-
-const ThreadPriorityToNiceValuePair kThreadPriorityToNiceValueMap[4] = {
-    {ThreadPriority::BACKGROUND, 10},
-    {ThreadPriority::NORMAL, 0},
-    {ThreadPriority::DISPLAY, -8},
-    {ThreadPriority::REALTIME_AUDIO, -10},
-};
-
-bool SetCurrentThreadPriorityForPlatform(ThreadPriority priority) {
-  MOZ_CRASH();
-}
-
-bool GetCurrentThreadPriorityForPlatform(ThreadPriority* priority) {
-  int maybe_sched_rr = 0;
-  struct sched_param maybe_realtime_prio = {0};
-  if (pthread_getschedparam(pthread_self(), &maybe_sched_rr,
-                            &maybe_realtime_prio) == 0 &&
-      maybe_sched_rr == SCHED_RR &&
-      maybe_realtime_prio.sched_priority == kRealTimePrio.sched_priority) {
-    *priority = ThreadPriority::REALTIME_AUDIO;
-    return true;
-  }
-  return false;
-}
-
-}  // namespace internal
-
-void InitThreading() {}
-
-void TerminateOnThread() {}
-
-size_t GetDefaultThreadStackSize(const pthread_attr_t& attributes) {
-#if !defined(THREAD_SANITIZER)
-  return 0;
-#else
-  // ThreadSanitizer bloats the stack heavily. Evidence has been that the
-  // default stack size isn't enough for some browser tests.
-  return 2 * (1 << 23);  // 2 times 8192K (the default stack size on Linux).
-#endif
-}
-
-}  // namespace base
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/trace_event/heap_profiler_allocation_context_tracker.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a dummy version of Chromium source file base/trace_event/heap_profiler_allocation_context_tracker.h.
-// To provide a function required in base/threading/thread_id_name_manager.cc
-// SetCurrentThreadName. We don't use the heap profiler.
-
-#ifndef BASE_TRACE_EVENT_HEAP_PROFILER_ALLOCATION_CONTEXT_TRACKER_H_
-#define BASE_TRACE_EVENT_HEAP_PROFILER_ALLOCATION_CONTEXT_TRACKER_H_
-
-namespace base {
-namespace trace_event {
-
-// The allocation context tracker keeps track of thread-local context for heap
-// profiling. It includes a pseudo stack of trace events. On every allocation
-// the tracker provides a snapshot of its context in the form of an
-// |AllocationContext| that is to be stored together with the allocation
-// details.
-class BASE_EXPORT AllocationContextTracker {
- public:
-  static void SetCurrentThreadName(const char* name) {}
-
-  DISALLOW_COPY_AND_ASSIGN(AllocationContextTracker);
-};
-
-}  // namespace trace_event
-}  // namespace base
-
-#endif  // BASE_TRACE_EVENT_HEAP_PROFILER_ALLOCATION_CONTEXT_TRACKER_H_
--- a/security/sandbox/chromium-shim/base/tracked_objects.h
+++ b/security/sandbox/chromium-shim/base/tracked_objects.h
@@ -1,23 +1,19 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef _SECURITY_SANDBOX_TRACKED_OBJECTS_H_
 #define _SECURITY_SANDBOX_TRACKED_OBJECTS_H_
-
-#include "mozilla/Assertions.h"
-
 namespace tracked_objects
 {
   class ThreadData
   {
   public:
     static void InitializeThreadContext(const std::string& name)
     {
-      MOZ_CRASH();
     }
   };
 }
 #endif
deleted file mode 100644
--- a/security/sandbox/chromium-shim/base/win/base_features.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// This is a dummy version of a file that is generated by the chromium build
-// from base/win/BUILD.gn.
-
-#ifndef BASE_WIN_BASE_FEATURES_H_
-#define BASE_WIN_BASE_FEATURES_H_
-
-#include "build/buildflag.h"
-
-#define BUILDFLAG_INTERNAL_SINGLE_MODULE_MODE_HANDLE_VERIFIER() (false)
-
-#endif  // BASE_WIN_BASE_FEATURES_H_
--- a/security/sandbox/chromium-shim/base/win/registry.h
+++ b/security/sandbox/chromium-shim/base/win/registry.h
@@ -2,45 +2,31 @@
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // This is a stripped down version of Chromium source file base/win/registry.h
 // Within our copy of Chromium files this is only used in base/win/windows_version.cc
 // in OSInfo::processor_model_name, which we don't use.
-// It is also used in GetUBR, which is used as the VersionNumber.patch, which
-// again is not needed by the sandbox.
 
 #ifndef BASE_WIN_REGISTRY_H_
 #define BASE_WIN_REGISTRY_H_
 
-#include <winerror.h>
-
 namespace base {
 namespace win {
 
 class BASE_EXPORT RegKey {
  public:
-  RegKey() {};
   RegKey(HKEY rootkey, const wchar_t* subkey, REGSAM access) {}
   ~RegKey() {}
 
-  LONG Open(HKEY rootkey, const wchar_t* subkey, REGSAM access) {
-    return ERROR_CANTOPEN;
-  }
-
-  LONG ReadValueDW(const wchar_t* name, DWORD* out_value) const
-  {
-    return ERROR_CANTREAD;
-  }
-
   LONG ReadValue(const wchar_t* name, std::wstring* out_value) const
   {
-    return ERROR_CANTREAD;
+    return 0;
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(RegKey);
 };
 
 }  // namespace win
 }  // namespace base
--- a/security/sandbox/chromium-shim/base/win/sdkdecls.h
+++ b/security/sandbox/chromium-shim/base/win/sdkdecls.h
@@ -183,63 +183,9 @@ typedef struct _PROCESS_MITIGATION_EXTEN
       DWORD DisableExtensionPoints : 1;
       DWORD ReservedFlags : 31;
     };
   };
 } PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, *PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY;
 
 #endif // NTDDI_WIN8
 #endif // (_WIN32_WINNT < 0x0602)
-
-#if (_WIN32_WINNT < 0x0A00)
-//
-// Define Font Disable Policy.  When enabled, this option will
-// block loading Non System Fonts.
-//
-
-#define PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_MASK                              (0x00000003ui64 << 48)
-#define PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_DEFER                             (0x00000000ui64 << 48)
-#define PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_ALWAYS_ON                         (0x00000001ui64 << 48)
-#define PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_ALWAYS_OFF                        (0x00000002ui64 << 48)
-#define PROCESS_CREATION_MITIGATION_POLICY_AUDIT_NONSYSTEM_FONTS                          (0x00000003ui64 << 48)
-
-//
-// Define remote image load options.  When enabled, this option will
-// block mapping of images from remote devices.
-//
-
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_MASK                      (0x00000003ui64 << 52)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_DEFER                     (0x00000000ui64 << 52)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_ALWAYS_ON                 (0x00000001ui64 << 52)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_ALWAYS_OFF                (0x00000002ui64 << 52)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_RESERVED                  (0x00000003ui64 << 52)
-
-//
-// Define low IL image load options.  When enabled, this option will
-// block mapping of images that have the low mandatory label.
-//
-
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_MASK                   (0x00000003ui64 << 56)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_DEFER                  (0x00000000ui64 << 56)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_ALWAYS_ON              (0x00000001ui64 << 56)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_ALWAYS_OFF             (0x00000002ui64 << 56)
-#define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_RESERVED               (0x00000003ui64 << 56)
-
-//
-// Define Attribute to disable creation of child process
-//
-
-#define PROCESS_CREATION_CHILD_PROCESS_RESTRICTED                                         0x01
-#define PROCESS_CREATION_CHILD_PROCESS_OVERRIDE                                           0x02
-
-//
-// Define Attribute for Desktop Appx Overide. 
-//
-
-#define PROCESS_CREATION_DESKTOP_APPX_OVERRIDE                                            0x04
-
-#define ProcThreadAttributeChildProcessPolicy 14
-
-#define PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY \
-    ProcThreadAttributeValue (ProcThreadAttributeChildProcessPolicy, FALSE, TRUE, FALSE)
-
-#endif // (_WIN32_WINNT >= 0x0A00)
 #endif // _SECURITY_SANDBOX_BASE_SHIM_SDKDECLS_H_
--- a/security/sandbox/chromium/base/at_exit.cc
+++ b/security/sandbox/chromium/base/at_exit.cc
@@ -1,34 +1,32 @@
 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/at_exit.h"
 
 #include <stddef.h>
 #include <ostream>
-#include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/logging.h"
 
 namespace base {
 
 // Keep a stack of registered AtExitManagers.  We always operate on the most
 // recent, and we should never have more than one outside of testing (for a
 // statically linked version of this library).  Testing may use the shadow
 // version of the constructor, and if we are building a dynamic library we may
 // end up with multiple AtExitManagers on the same process.  We don't protect
 // this for thread-safe access, since it will only be modified in testing.
 static AtExitManager* g_top_manager = NULL;
 
-AtExitManager::AtExitManager()
-    : processing_callbacks_(false), next_manager_(g_top_manager) {
+AtExitManager::AtExitManager() : next_manager_(g_top_manager) {
 // If multiple modules instantiate AtExitManagers they'll end up living in this
 // module... they have to coexist.
 #if !defined(COMPONENT_BUILD)
   DCHECK(!g_top_manager);
 #endif
   g_top_manager = this;
 }
 
@@ -52,46 +50,33 @@ void AtExitManager::RegisterCallback(AtE
 // static
 void AtExitManager::RegisterTask(base::Closure task) {
   if (!g_top_manager) {
     NOTREACHED() << "Tried to RegisterCallback without an AtExitManager";
     return;
   }
 
   AutoLock lock(g_top_manager->lock_);
-  DCHECK(!g_top_manager->processing_callbacks_);
-  g_top_manager->stack_.push(std::move(task));
+  g_top_manager->stack_.push(task);
 }
 
 // static
 void AtExitManager::ProcessCallbacksNow() {
   if (!g_top_manager) {
     NOTREACHED() << "Tried to ProcessCallbacksNow without an AtExitManager";
     return;
   }
 
-  // Callbacks may try to add new callbacks, so run them without holding
-  // |lock_|. This is an error and caught by the DCHECK in RegisterTask(), but
-  // handle it gracefully in release builds so we don't deadlock.
-  std::stack<base::Closure> tasks;
-  {
-    AutoLock lock(g_top_manager->lock_);
-    tasks.swap(g_top_manager->stack_);
-    g_top_manager->processing_callbacks_ = true;
+  AutoLock lock(g_top_manager->lock_);
+
+  while (!g_top_manager->stack_.empty()) {
+    base::Closure task = g_top_manager->stack_.top();
+    task.Run();
+    g_top_manager->stack_.pop();
   }
-
-  while (!tasks.empty()) {
-    base::Closure task = tasks.top();
-    task.Run();
-    tasks.pop();
-  }
-
-  // Expect that all callbacks have been run.
-  DCHECK(g_top_manager->stack_.empty());
 }
 
-AtExitManager::AtExitManager(bool shadow)
-    : processing_callbacks_(false), next_manager_(g_top_manager) {
+AtExitManager::AtExitManager(bool shadow) : next_manager_(g_top_manager) {
   DCHECK(shadow || !g_top_manager);
   g_top_manager = this;
 }
 
 }  // namespace base
--- a/security/sandbox/chromium/base/at_exit.h
+++ b/security/sandbox/chromium/base/at_exit.h
@@ -54,17 +54,16 @@ class BASE_EXPORT AtExitManager {
   // even if one already exists.  This should only be used for testing!
   // AtExitManagers are kept on a global stack, and it will be removed during
   // destruction.  This allows you to shadow another AtExitManager.
   explicit AtExitManager(bool shadow);
 
  private:
   base::Lock lock_;
   std::stack<base::Closure> stack_;
-  bool processing_callbacks_;
   AtExitManager* next_manager_;  // Stack of managers to allow shadowing.
 
   DISALLOW_COPY_AND_ASSIGN(AtExitManager);
 };
 
 #if defined(UNIT_TEST)
 class ShadowingAtExitManager : public AtExitManager {
  public:
--- a/security/sandbox/chromium/base/atomic_ref_count.h
+++ b/security/sandbox/chromium/base/atomic_ref_count.h
@@ -7,17 +7,17 @@
 
 #ifndef BASE_ATOMIC_REF_COUNT_H_
 #define BASE_ATOMIC_REF_COUNT_H_
 
 #include "base/atomicops.h"
 
 namespace base {
 
-typedef subtle::AtomicWord AtomicRefCount;
+typedef subtle::Atomic32 AtomicRefCount;
 
 // Increment a reference count by "increment", which must exceed 0.
 inline void AtomicRefCountIncN(volatile AtomicRefCount *ptr,
                                AtomicRefCount increment) {
   subtle::NoBarrier_AtomicIncrement(ptr, increment);
 }
 
 // Decrement a reference count by "decrement", which must exceed 0,
--- a/security/sandbox/chromium/base/base_paths.h
+++ b/security/sandbox/chromium/base/base_paths.h
@@ -27,18 +27,19 @@ namespace base {
 enum BasePathKey {
   PATH_START = 0,
 
   DIR_CURRENT,       // Current directory.
   DIR_EXE,           // Directory containing FILE_EXE.
   DIR_MODULE,        // Directory containing FILE_MODULE.
   DIR_TEMP,          // Temporary directory.
   DIR_HOME,          // User's root home directory. On Windows this will look
-                     // like "C:\Users\<user>"  which isn't necessarily a great
-                     // place to put files.
+                     // like "C:\Users\you" (or on XP
+                     // "C:\Document and Settings\you") which isn't necessarily
+                     // a great place to put files.
   FILE_EXE,          // Path and filename of the current executable.
   FILE_MODULE,       // Path and filename of the module containing the code for
                      // the PathService (which could differ from FILE_EXE if the
                      // PathService were compiled into a shared object, for
                      // example).
   DIR_SOURCE_ROOT,   // Returns the root of the source tree. This key is useful
                      // for tests that need to locate various resources. It
                      // should not be used outside of test code.
--- a/security/sandbox/chromium/base/base_paths_win.h
+++ b/security/sandbox/chromium/base/base_paths_win.h
@@ -20,34 +20,35 @@ enum {
   // DIR_PROGRAM_FILES         1               2                  1
   // DIR_PROGRAM_FILESX86      1               2                  2
   // DIR_PROGRAM_FILES6432     1               1                  1
   // 1 - C:\Program Files   2 - C:\Program Files (x86)
   DIR_PROGRAM_FILES,      // See table above.
   DIR_PROGRAM_FILESX86,   // See table above.
   DIR_PROGRAM_FILES6432,  // See table above.
 
-  DIR_IE_INTERNET_CACHE,       // Temporary Internet Files directory.
-  DIR_COMMON_START_MENU,       // Usually "C:\ProgramData\Microsoft\Windows\
-                               // Start Menu\Programs"
-  DIR_START_MENU,              // Usually "C:\Users\<user>\AppData\Roaming\
-                               // Microsoft\Windows\Start Menu\Programs"
-  DIR_APP_DATA,                // Application Data directory under the user
-                               // profile.
-  DIR_LOCAL_APP_DATA,          // "Local Settings\Application Data" directory
-                               // under the user profile.
-  DIR_COMMON_APP_DATA,         // Usually "C:\ProgramData".
-  DIR_APP_SHORTCUTS,           // Where tiles on the start screen are stored,
-                               // only for Windows 8. Maps to "Local\AppData\
-                               // Microsoft\Windows\Application Shortcuts\".
-  DIR_COMMON_DESKTOP,          // Directory for the common desktop (visible
-                               // on all user's Desktop).
-  DIR_USER_QUICK_LAUNCH,       // Directory for the quick launch shortcuts.
-  DIR_TASKBAR_PINS,            // Directory for the shortcuts pinned to taskbar.
-  DIR_IMPLICIT_APP_SHORTCUTS,  // The implicit user pinned shortcut directory.
-  DIR_WINDOWS_FONTS,           // Usually C:\Windows\Fonts.
+  DIR_IE_INTERNET_CACHE,  // Temporary Internet Files directory.
+  DIR_COMMON_START_MENU,  // Usually "C:\Documents and Settings\All Users\
+                          // Start Menu\Programs"
+  DIR_START_MENU,         // Usually "C:\Documents and Settings\<user>\
+                          // Start Menu\Programs"
+  DIR_APP_DATA,           // Application Data directory under the user profile.
+  DIR_LOCAL_APP_DATA,     // "Local Settings\Application Data" directory under
+                          // the user profile.
+  DIR_COMMON_APP_DATA,    // W2K, XP, W2K3: "C:\Documents and Settings\
+                          // All Users\Application Data".
+                          // Vista, W2K8 and above: "C:\ProgramData".
+  DIR_APP_SHORTCUTS,      // Where tiles on the start screen are stored, only
+                          // for Windows 8. Maps to "Local\AppData\Microsoft\
+                          // Windows\Application Shortcuts\".
+  DIR_COMMON_DESKTOP,     // Directory for the common desktop (visible
+                          // on all user's Desktop).
+  DIR_USER_QUICK_LAUNCH,  // Directory for the quick launch shortcuts.
+  DIR_TASKBAR_PINS,       // Directory for the shortcuts pinned to taskbar
+                          // (Win7-8) via base::win::PinShortcutToTaskbar().
+  DIR_WINDOWS_FONTS,      // Usually C:\Windows\Fonts.
 
   PATH_WIN_END
 };
 
 }  // namespace base
 
 #endif  // BASE_BASE_PATHS_WIN_H_
--- a/security/sandbox/chromium/base/base_switches.cc
+++ b/security/sandbox/chromium/base/base_switches.cc
@@ -15,20 +15,16 @@ const char kDisableBreakpad[]           
 // generated internally.
 const char kEnableCrashReporter[]           = "enable-crash-reporter";
 
 // Makes memory allocators keep track of their allocations and context, so a
 // detailed breakdown of memory usage can be presented in chrome://tracing when
 // the memory-infra category is enabled.
 const char kEnableHeapProfiling[]           = "enable-heap-profiling";
 
-// Report native (walk the stack) allocation traces. By default pseudo stacks
-// derived from trace events are reported.
-const char kEnableHeapProfilingModeNative[] = "native";
-
 // Generates full memory crash dump.
 const char kFullMemoryCrashReport[]         = "full-memory-crash-report";
 
 // Force low-end device mode when set.
 const char kEnableLowEndDeviceMode[]        = "enable-low-end-device-mode";
 
 // Force disabling of low-end device mode when set.
 const char kDisableLowEndDeviceMode[]       = "disable-low-end-device-mode";
@@ -45,21 +41,16 @@ const char kForceFieldTrials[]          
 
 // Suppresses all error dialogs when present.
 const char kNoErrorDialogs[]                = "noerrdialogs";
 
 // When running certain tests that spawn child processes, this switch indicates
 // to the test framework that the current process is a child process.
 const char kTestChildProcess[]              = "test-child-process";
 
-// When running certain tests that spawn child processes, this switch indicates
-// to the test framework that the current process should not initialize ICU to
-// avoid creating any scoped handles too early in startup.
-const char kTestDoNotInitializeIcu[]        = "test-do-not-initialize-icu";
-
 // Gives the default maximal active V-logging level; 0 is the default.
 // Normally positive values are used for V-logging levels.
 const char kV[]                             = "v";
 
 // Gives the per-module maximal V-logging levels to override the value
 // given by --v.  E.g. "my_module=2,foo*=3" would change the logging
 // level for all code in source files "my_module.*" and "foo*.*"
 // ("-inl" suffixes are also disregarded for this matching).
@@ -84,26 +75,16 @@ const char kTraceToFileName[]           
 // Configure whether chrome://profiler will contain timing information. This
 // option is enabled by default. A value of "0" will disable profiler timing,
 // while all other values will enable it.
 const char kProfilerTiming[]                = "profiler-timing";
 // Value of the --profiler-timing flag that will disable timing information for
 // chrome://profiler.
 const char kProfilerTimingDisabledValue[]   = "0";
 
-// Specifies a location for profiling output. This will only work if chrome has
-// been built with the gyp variable profiling=1 or gn arg enable_profiling=true.
-//
-//   {pid} if present will be replaced by the pid of the process.
-//   {count} if present will be incremented each time a profile is generated
-//           for this process.
-// The default is chrome-profile-{pid} for the browser and test-profile-{pid}
-// for tests.
-const char kProfilingFile[] = "profiling-file";
-
 #if defined(OS_WIN)
 // Disables the USB keyboard detection for blocking the OSK on Win8+.
 const char kDisableUsbKeyboardDetect[]      = "disable-usb-keyboard-detect";
 #endif
 
 #if defined(OS_POSIX)
 // Used for turning on Breakpad crash reporting in a debug environment where
 // crash reporting is typically compiled but disabled.
--- a/security/sandbox/chromium/base/base_switches.h
+++ b/security/sandbox/chromium/base/base_switches.h
@@ -10,26 +10,23 @@
 #include "build/build_config.h"
 
 namespace switches {
 
 extern const char kDisableBreakpad[];
 extern const char kDisableLowEndDeviceMode[];
 extern const char kEnableCrashReporter[];
 extern const char kEnableHeapProfiling[];
-extern const char kEnableHeapProfilingModeNative[];
 extern const char kEnableLowEndDeviceMode[];
 extern const char kForceFieldTrials[];
 extern const char kFullMemoryCrashReport[];
 extern const char kNoErrorDialogs[];
 extern const char kProfilerTiming[];
 extern const char kProfilerTimingDisabledValue[];
-extern const char kProfilingFile[];
 extern const char kTestChildProcess[];
-extern const char kTestDoNotInitializeIcu[];
 extern const char kTraceToFile[];
 extern const char kTraceToFileName[];
 extern const char kV[];
 extern const char kVModule[];
 extern const char kWaitForDebugger[];
 
 #if defined(OS_WIN)
 extern const char kDisableUsbKeyboardDetect[];
--- a/security/sandbox/chromium/base/bind.h
+++ b/security/sandbox/chromium/base/bind.h
@@ -1,83 +1,101 @@
 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_BIND_H_
 #define BASE_BIND_H_
 
 #include "base/bind_internal.h"
+#include "base/callback_internal.h"
 
 // -----------------------------------------------------------------------------
 // Usage documentation
 // -----------------------------------------------------------------------------
 //
-// See //docs/callback.md for documentation.
+// See base/callback.h for documentation.
 //
 //
 // -----------------------------------------------------------------------------
 // Implementation notes
 // -----------------------------------------------------------------------------
 //
 // If you're reading the implementation, before proceeding further, you should
 // read the top comment of base/bind_internal.h for a definition of common
 // terms and concepts.
+//
+// RETURN TYPES
+//
+// Though Bind()'s result is meant to be stored in a Callback<> type, it
+// cannot actually return the exact type without requiring a large amount
+// of extra template specializations. The problem is that in order to
+// discern the correct specialization of Callback<>, Bind would need to
+// unwrap the function signature to determine the signature's arity, and
+// whether or not it is a method.
+//
+// Each unique combination of (arity, function_type, num_prebound) where
+// function_type is one of {function, method, const_method} would require
+// one specialization.  We eventually have to do a similar number of
+// specializations anyways in the implementation (see the Invoker<>,
+// classes).  However, it is avoidable in Bind if we return the result
+// via an indirection like we do below.
+//
+// TODO(ajwong): We might be able to avoid this now, but need to test.
+//
+// It is possible to move most of the static_assert into BindState<>, but it
+// feels a little nicer to have the asserts here so people do not need to crack
+// open bind_internal.h.  On the other hand, it makes Bind() harder to read.
 
 namespace base {
 
-// Bind as OnceCallback.
 template <typename Functor, typename... Args>
-inline OnceCallback<MakeUnboundRunType<Functor, Args...>>
-BindOnce(Functor&& functor, Args&&... args) {
-  using BindState = internal::MakeBindStateType<Functor, Args...>;
-  using UnboundRunType = MakeUnboundRunType<Functor, Args...>;
-  using Invoker = internal::Invoker<BindState, UnboundRunType>;
-  using CallbackType = OnceCallback<UnboundRunType>;
+base::Callback<
+    typename internal::BindState<
+        typename internal::FunctorTraits<Functor>::RunnableType,
+        typename internal::FunctorTraits<Functor>::RunType,
+        typename internal::CallbackParamTraits<Args>::StorageType...>
+            ::UnboundRunType>
+Bind(Functor functor, const Args&... args) {
+  // Type aliases for how to store and run the functor.
+  using RunnableType = typename internal::FunctorTraits<Functor>::RunnableType;
+  using RunType = typename internal::FunctorTraits<Functor>::RunType;
 
-  // Store the invoke func into PolymorphicInvoke before casting it to
-  // InvokeFuncStorage, so that we can ensure its type matches to
-  // PolymorphicInvoke, to which CallbackType will cast back.
-  using PolymorphicInvoke = typename CallbackType::PolymorphicInvoke;
-  PolymorphicInvoke invoke_func = &Invoker::RunOnce;
+  // Use RunnableType::RunType instead of RunType above because our
+  // checks below for bound references need to know what the actual
+  // functor is going to interpret the argument as.
+  using BoundRunType = typename RunnableType::RunType;
 
-  using InvokeFuncStorage = internal::BindStateBase::InvokeFuncStorage;
-  return CallbackType(new BindState(
-      reinterpret_cast<InvokeFuncStorage>(invoke_func),
-      std::forward<Functor>(functor),
-      std::forward<Args>(args)...));
-}
+  using BoundArgs =
+      internal::TakeTypeListItem<sizeof...(Args),
+                                 internal::ExtractArgs<BoundRunType>>;
 
-// Bind as RepeatingCallback.
-template <typename Functor, typename... Args>
-inline RepeatingCallback<MakeUnboundRunType<Functor, Args...>>
-BindRepeating(Functor&& functor, Args&&... args) {
-  using BindState = internal::MakeBindStateType<Functor, Args...>;
-  using UnboundRunType = MakeUnboundRunType<Functor, Args...>;
-  using Invoker = internal::Invoker<BindState, UnboundRunType>;
-  using CallbackType = RepeatingCallback<UnboundRunType>;
+  // Do not allow binding a non-const reference parameter. Non-const reference
+  // parameters are disallowed by the Google style guide.  Also, binding a
+  // non-const reference parameter can make for subtle bugs because the
+  // invoked function will receive a reference to the stored copy of the
+  // argument and not the original.
+  static_assert(!internal::HasNonConstReferenceItem<BoundArgs>::value,
+                "do not bind functions with nonconst ref");
 
-  // Store the invoke func into PolymorphicInvoke before casting it to
-  // InvokeFuncStorage, so that we can ensure its type matches to
-  // PolymorphicInvoke, to which CallbackType will cast back.
-  using PolymorphicInvoke = typename CallbackType::PolymorphicInvoke;
-  PolymorphicInvoke invoke_func = &Invoker::Run;
+  const bool is_method = internal::HasIsMethodTag<RunnableType>::value;
 
-  using InvokeFuncStorage = internal::BindStateBase::InvokeFuncStorage;
-  return CallbackType(new BindState(
-      reinterpret_cast<InvokeFuncStorage>(invoke_func),
-      std::forward<Functor>(functor),
-      std::forward<Args>(args)...));
-}
+  // For methods, we need to be careful for parameter 1.  We do not require
+  // a scoped_refptr because BindState<> itself takes care of AddRef() for
+  // methods. We also disallow binding of an array as the method's target
+  // object.
+  static_assert(!internal::BindsArrayToFirstArg<is_method, Args...>::value,
+                "first bound argument to method cannot be array");
+  static_assert(
+      !internal::HasRefCountedParamAsRawPtr<is_method, Args...>::value,
+      "a parameter is a refcounted type and needs scoped_refptr");
 
-// Unannotated Bind.
-// TODO(tzik): Deprecate this and migrate to OnceCallback and
-// RepeatingCallback, once they get ready.
-template <typename Functor, typename... Args>
-inline Callback<MakeUnboundRunType<Functor, Args...>>
-Bind(Functor&& functor, Args&&... args) {
-  return BindRepeating(std::forward<Functor>(functor),
-                       std::forward<Args>(args)...);
+  using BindState = internal::BindState<
+      RunnableType, RunType,
+      typename internal::CallbackParamTraits<Args>::StorageType...>;
+
+  return Callback<typename BindState::UnboundRunType>(
+      new BindState(internal::MakeRunnable(functor), args...));
 }
 
 }  // namespace base
 
 #endif  // BASE_BIND_H_
--- a/security/sandbox/chromium/base/bind_helpers.h
+++ b/security/sandbox/chromium/base/bind_helpers.h
@@ -23,19 +23,16 @@
 //
 // Passed() is for transferring movable-but-not-copyable types (eg. scoped_ptr)
 // through a Callback. Logically, this signifies a destructive transfer of
 // the state of the argument into the target function.  Invoking
 // Callback::Run() twice on a Callback that was created with a Passed()
 // argument will CHECK() because the first invocation would have already
 // transferred ownership to the target function.
 //
-// RetainedRef() accepts a ref counted object and retains a reference to it.
-// When the callback is called, the object is passed as a raw pointer.
-//
 // ConstRef() allows binding a constant reference to an argument rather
 // than a copy.
 //
 // IgnoreResult() is used to adapt a function or Callback with a return type to
 // one with a void return. This is most useful if you have a function with,
 // say, a pesky ignorable bool return that you want to use with PostTask or
 // something else that expect a Callback with a void return.
 //
@@ -69,29 +66,16 @@
 //   foo_callback.Run();  // Prints "2"
 //
 //   foo_callback.Reset();  // |pn| is deleted.  Also will happen when
 //                          // |foo_callback| goes out of scope.
 //
 // Without Owned(), someone would have to know to delete |pn| when the last
 // reference to the Callback is deleted.
 //
-// EXAMPLE OF RetainedRef():
-//
-//    void foo(RefCountedBytes* bytes) {}
-//
-//    scoped_refptr<RefCountedBytes> bytes = ...;
-//    Closure callback = Bind(&foo, base::RetainedRef(bytes));
-//    callback.Run();
-//
-// Without RetainedRef, the scoped_refptr would try to implicitly convert to
-// a raw pointer and fail compilation:
-//
-//    Closure callback = Bind(&foo, bytes); // ERROR!
-//
 //
 // EXAMPLE OF ConstRef():
 //
 //   void foo(int arg) { cout << arg << endl }
 //
 //   int n = 1;
 //   Closure no_ref = Bind(&foo, n);
 //   Closure has_ref = Bind(&foo, ConstRef(n));
@@ -116,21 +100,20 @@
 //   cb->Run(1);  // Prints "1".
 //
 //   // Prints "1" on |ml|.
 //   ml->PostTask(FROM_HERE, Bind(IgnoreResult(&DoSomething), 1);
 //
 //
 // EXAMPLE OF Passed():
 //
-//   void TakesOwnership(std::unique_ptr<Foo> arg) { }
-//   std::unique_ptr<Foo> CreateFoo() { return std::unique_ptr<Foo>(new Foo());
-//   }
+//   void TakesOwnership(scoped_ptr<Foo> arg) { }
+//   scoped_ptr<Foo> CreateFoo() { return scoped_ptr<Foo>(new Foo()); }
 //
-//   std::unique_ptr<Foo> f(new Foo());
+//   scoped_ptr<Foo> f(new Foo());
 //
 //   // |cb| is given ownership of Foo(). |f| is now NULL.
 //   // You can use std::move(f) in place of &f, but it's more verbose.
 //   Closure cb = Bind(&TakesOwnership, Passed(&f));
 //
 //   // Run was never called so |cb| still owns Foo() and deletes
 //   // it on Reset().
 //   cb.Reset();
@@ -162,27 +145,159 @@
 
 #include <stddef.h>
 
 #include <type_traits>
 #include <utility>
 
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
+#include "base/template_util.h"
 #include "build/build_config.h"
 
 namespace base {
+namespace internal {
+
+// Use the Substitution Failure Is Not An Error (SFINAE) trick to inspect T
+// for the existence of AddRef() and Release() functions of the correct
+// signature.
+//
+// http://en.wikipedia.org/wiki/Substitution_failure_is_not_an_error
+// http://stackoverflow.com/questions/257288/is-it-possible-to-write-a-c-template-to-check-for-a-functions-existence
+// http://stackoverflow.com/questions/4358584/sfinae-approach-comparison
+// http://stackoverflow.com/questions/1966362/sfinae-to-check-for-inherited-member-functions
+//
+// The last link in particular show the method used below.
+//
+// For SFINAE to work with inherited methods, we need to pull some extra tricks
+// with multiple inheritance.  In the more standard formulation, the overloads
+// of Check would be:
+//
+//   template <typename C>
+//   Yes NotTheCheckWeWant(Helper<&C::TargetFunc>*);
+//
+//   template <typename C>
+//   No NotTheCheckWeWant(...);
+//
+//   static const bool value = sizeof(NotTheCheckWeWant<T>(0)) == sizeof(Yes);
+//
+// The problem here is that template resolution will not match
+// C::TargetFunc if TargetFunc does not exist directly in C.  That is, if
+// TargetFunc in inherited from an ancestor, &C::TargetFunc will not match,
+// |value| will be false.  This formulation only checks for whether or
+// not TargetFunc exist directly in the class being introspected.
+//
+// To get around this, we play a dirty trick with multiple inheritance.
+// First, We create a class BaseMixin that declares each function that we
+// want to probe for.  Then we create a class Base that inherits from both T
+// (the class we wish to probe) and BaseMixin.  Note that the function
+// signature in BaseMixin does not need to match the signature of the function
+// we are probing for; thus it's easiest to just use void().
+//
+// Now, if TargetFunc exists somewhere in T, then &Base::TargetFunc has an
+// ambiguous resolution between BaseMixin and T.  This lets us write the
+// following:
+//
+//   template <typename C>
+//   No GoodCheck(Helper<&C::TargetFunc>*);
+//
+//   template <typename C>
+//   Yes GoodCheck(...);
+//
+//   static const bool value = sizeof(GoodCheck<Base>(0)) == sizeof(Yes);
+//
+// Notice here that the variadic version of GoodCheck() returns Yes here
+// instead of No like the previous one. Also notice that we calculate |value|
+// by specializing GoodCheck() on Base instead of T.
+//
+// We've reversed the roles of the variadic, and Helper overloads.
+// GoodCheck(Helper<&C::TargetFunc>*), when C = Base, fails to be a valid
+// substitution if T::TargetFunc exists. Thus GoodCheck<Base>(0) will resolve
+// to the variadic version if T has TargetFunc.  If T::TargetFunc does not
+// exist, then &C::TargetFunc is not ambiguous, and the overload resolution
+// will prefer GoodCheck(Helper<&C::TargetFunc>*).
+//
+// This method of SFINAE will correctly probe for inherited names, but it cannot
+// typecheck those names.  It's still a good enough sanity check though.
+//
+// Works on gcc-4.2, gcc-4.4, and Visual Studio 2008.
+//
+// TODO(ajwong): Move to ref_counted.h or template_util.h when we've vetted
+// this works well.
+//
+// TODO(ajwong): Make this check for Release() as well.
+// See http://crbug.com/82038.
+template <typename T>
+class SupportsAddRefAndRelease {
+  using Yes = char[1];
+  using No = char[2];
+
+  struct BaseMixin {
+    void AddRef();
+  };
+
+// MSVC warns when you try to use Base if T has a private destructor, the
+// common pattern for refcounted types. It does this even though no attempt to
+// instantiate Base is made.  We disable the warning for this definition.
+#if defined(OS_WIN)
+#pragma warning(push)
+#pragma warning(disable:4624)
+#endif
+  struct Base : public T, public BaseMixin {
+  };
+#if defined(OS_WIN)
+#pragma warning(pop)
+#endif
+
+  template <void(BaseMixin::*)()> struct Helper {};
+
+  template <typename C>
+  static No& Check(Helper<&C::AddRef>*);
+
+  template <typename >
+  static Yes& Check(...);
+
+ public:
+  enum { value = sizeof(Check<Base>(0)) == sizeof(Yes) };
+};
+
+// Helpers to assert that arguments of a recounted type are bound with a
+// scoped_refptr.
+template <bool IsClasstype, typename T>
+struct UnsafeBindtoRefCountedArgHelper : false_type {
+};
 
 template <typename T>
-struct IsWeakReceiver;
+struct UnsafeBindtoRefCountedArgHelper<true, T>
+    : integral_constant<bool, SupportsAddRefAndRelease<T>::value> {
+};
+
+template <typename T>
+struct UnsafeBindtoRefCountedArg : false_type {
+};
+
+template <typename T>
+struct UnsafeBindtoRefCountedArg<T*>
+    : UnsafeBindtoRefCountedArgHelper<is_class<T>::value, T> {
+};
 
-template <typename>
-struct BindUnwrapTraits;
+template <typename T>
+class HasIsMethodTag {
+  using Yes = char[1];
+  using No = char[2];
 
-namespace internal {
+  template <typename U>
+  static Yes& Check(typename U::IsMethod*);
+
+  template <typename U>
+  static No& Check(...);
+
+ public:
+  enum { value = sizeof(Check<T>(0)) == sizeof(Yes) };
+};
 
 template <typename T>
 class UnretainedWrapper {
  public:
   explicit UnretainedWrapper(T* o) : ptr_(o) {}
   T* get() const { return ptr_; }
  private:
   T* ptr_;
@@ -193,47 +308,43 @@ class ConstRefWrapper {
  public:
   explicit ConstRefWrapper(const T& o) : ptr_(&o) {}
   const T& get() const { return *ptr_; }
  private:
   const T* ptr_;
 };
 
 template <typename T>
-class RetainedRefWrapper {
- public:
-  explicit RetainedRefWrapper(T* o) : ptr_(o) {}
-  explicit RetainedRefWrapper(scoped_refptr<T> o) : ptr_(std::move(o)) {}
-  T* get() const { return ptr_.get(); }
- private:
-  scoped_refptr<T> ptr_;
-};
-
-template <typename T>
 struct IgnoreResultHelper {
-  explicit IgnoreResultHelper(T functor) : functor_(std::move(functor)) {}
-  explicit operator bool() const { return !!functor_; }
+  explicit IgnoreResultHelper(T functor) : functor_(functor) {}
 
   T functor_;
 };
 
+template <typename T>
+struct IgnoreResultHelper<Callback<T> > {
+  explicit IgnoreResultHelper(const Callback<T>& functor) : functor_(functor) {}
+
+  const Callback<T>& functor_;
+};
+
 // An alternate implementation is to avoid the destructive copy, and instead
 // specialize ParamTraits<> for OwnedWrapper<> to change the StorageType to
-// a class that is essentially a std::unique_ptr<>.
+// a class that is essentially a scoped_ptr<>.
 //
 // The current implementation has the benefit though of leaving ParamTraits<>
 // fully in callback_internal.h as well as avoiding type conversions during
 // storage.
 template <typename T>
 class OwnedWrapper {
  public:
   explicit OwnedWrapper(T* o) : ptr_(o) {}
   ~OwnedWrapper() { delete ptr_; }
   T* get() const { return ptr_; }
-  OwnedWrapper(OwnedWrapper&& other) {
+  OwnedWrapper(const OwnedWrapper& other) {
     ptr_ = other.ptr_;
     other.ptr_ = NULL;
   }
 
  private:
   mutable T* ptr_;
 };
 
@@ -260,49 +371,141 @@ class OwnedWrapper {
 //     and stored by value which will not work for general move-only types.
 //  2) is_valid_ is distinct from NULL because it is valid to bind a "NULL"
 //     scoper to a Callback and allow the Callback to execute once.
 template <typename T>
 class PassedWrapper {
  public:
   explicit PassedWrapper(T&& scoper)
       : is_valid_(true), scoper_(std::move(scoper)) {}
-  PassedWrapper(PassedWrapper&& other)
+  PassedWrapper(const PassedWrapper& other)
       : is_valid_(other.is_valid_), scoper_(std::move(other.scoper_)) {}
-  T Take() const {
+  T Pass() const {
     CHECK(is_valid_);
     is_valid_ = false;
     return std::move(scoper_);
   }
 
  private:
   mutable bool is_valid_;
   mutable T scoper_;
 };
 
+// Unwrap the stored parameters for the wrappers above.
 template <typename T>
-using Unwrapper = BindUnwrapTraits<typename std::decay<T>::type>;
+struct UnwrapTraits {
+  using ForwardType = const T&;
+  static ForwardType Unwrap(const T& o) { return o; }
+};
+
+template <typename T>
+struct UnwrapTraits<UnretainedWrapper<T> > {
+  using ForwardType = T*;
+  static ForwardType Unwrap(UnretainedWrapper<T> unretained) {
+    return unretained.get();
+  }
+};
+
+template <typename T>
+struct UnwrapTraits<ConstRefWrapper<T> > {
+  using ForwardType = const T&;
+  static ForwardType Unwrap(ConstRefWrapper<T> const_ref) {
+    return const_ref.get();
+  }
+};
+
+template <typename T>
+struct UnwrapTraits<scoped_refptr<T> > {
+  using ForwardType = T*;
+  static ForwardType Unwrap(const scoped_refptr<T>& o) { return o.get(); }
+};
+
+template <typename T>
+struct UnwrapTraits<WeakPtr<T> > {
+  using ForwardType = const WeakPtr<T>&;
+  static ForwardType Unwrap(const WeakPtr<T>& o) { return o; }
+};
+
+template <typename T>
+struct UnwrapTraits<OwnedWrapper<T> > {
+  using ForwardType = T*;
+  static ForwardType Unwrap(const OwnedWrapper<T>& o) {
+    return o.get();
+  }
+};
 
 template <typename T>
-auto Unwrap(T&& o) -> decltype(Unwrapper<T>::Unwrap(std::forward<T>(o))) {
-  return Unwrapper<T>::Unwrap(std::forward<T>(o));
-}
+struct UnwrapTraits<PassedWrapper<T> > {
+  using ForwardType = T;
+  static T Unwrap(PassedWrapper<T>& o) {
+    return o.Pass();
+  }
+};
+
+// Utility for handling different refcounting semantics in the Bind()
+// function.
+template <bool is_method, typename... T>
+struct MaybeScopedRefPtr;
+
+template <bool is_method>
+struct MaybeScopedRefPtr<is_method> {
+  MaybeScopedRefPtr() {}
+};
+
+template <typename T, typename... Rest>
+struct MaybeScopedRefPtr<false, T, Rest...> {
+  MaybeScopedRefPtr(const T&, const Rest&...) {}
+};
+
+template <typename T, size_t n, typename... Rest>
+struct MaybeScopedRefPtr<false, T[n], Rest...> {
+  MaybeScopedRefPtr(const T*, const Rest&...) {}
+};
+
+template <typename T, typename... Rest>
+struct MaybeScopedRefPtr<true, T, Rest...> {
+  MaybeScopedRefPtr(const T& o, const Rest&...) {}
+};
+
+template <typename T, typename... Rest>
+struct MaybeScopedRefPtr<true, T*, Rest...> {
+  MaybeScopedRefPtr(T* o, const Rest&...) : ref_(o) {}
+  scoped_refptr<T> ref_;
+};
+
+// No need to additionally AddRef() and Release() since we are storing a
+// scoped_refptr<> inside the storage object already.
+template <typename T, typename... Rest>
+struct MaybeScopedRefPtr<true, scoped_refptr<T>, Rest...> {
+  MaybeScopedRefPtr(const scoped_refptr<T>&, const Rest&...) {}
+};
+
+template <typename T, typename... Rest>
+struct MaybeScopedRefPtr<true, const T*, Rest...> {
+  MaybeScopedRefPtr(const T* o, const Rest&...) : ref_(o) {}
+  scoped_refptr<const T> ref_;
+};
 
 // IsWeakMethod is a helper that determine if we are binding a WeakPtr<> to a
 // method.  It is used internally by Bind() to select the correct
 // InvokeHelper that will no-op itself in the event the WeakPtr<> for
 // the target object is invalidated.
 //
 // The first argument should be the type of the object that will be received by
 // the method.
-template <bool is_method, typename... Args>
-struct IsWeakMethod : std::false_type {};
+template <bool IsMethod, typename... Args>
+struct IsWeakMethod : public false_type {};
 
 template <typename T, typename... Args>
-struct IsWeakMethod<true, T, Args...> : IsWeakReceiver<T> {};
+struct IsWeakMethod<true, WeakPtr<T>, Args...> : public true_type {};
+
+template <typename T, typename... Args>
+struct IsWeakMethod<true, ConstRefWrapper<WeakPtr<T>>, Args...>
+    : public true_type {};
+
 
 // Packs a list of types to hold them in a single type.
 template <typename... Types>
 struct TypeList {};
 
 // Used for DropTypeListItem implementation.
 template <size_t n, typename List>
 struct DropTypeListItemImpl;
@@ -375,54 +578,38 @@ struct MakeFunctionTypeImpl<R, TypeList<
   typedef R Type(Args...);
 };
 
 // A type-level function that constructs a function type that has |R| as its
 // return type and has TypeLists items as its arguments.
 template <typename R, typename ArgList>
 using MakeFunctionType = typename MakeFunctionTypeImpl<R, ArgList>::Type;
 
-// Used for ExtractArgs and ExtractReturnType.
+// Used for ExtractArgs.
 template <typename Signature>
 struct ExtractArgsImpl;
 
 template <typename R, typename... Args>
 struct ExtractArgsImpl<R(Args...)> {
-  using ReturnType = R;
-  using ArgsList = TypeList<Args...>;
+  using Type = TypeList<Args...>;
 };
 
 // A type-level function that extracts function arguments into a TypeList.
 // E.g. ExtractArgs<R(A, B, C)> is evaluated to TypeList<A, B, C>.
 template <typename Signature>
-using ExtractArgs = typename ExtractArgsImpl<Signature>::ArgsList;
-
-// A type-level function that extracts the return type of a function.
-// E.g. ExtractReturnType<R(A, B, C)> is evaluated to R.
-template <typename Signature>
-using ExtractReturnType = typename ExtractArgsImpl<Signature>::ReturnType;
+using ExtractArgs = typename ExtractArgsImpl<Signature>::Type;
 
 }  // namespace internal
 
 template <typename T>
 static inline internal::UnretainedWrapper<T> Unretained(T* o) {
   return internal::UnretainedWrapper<T>(o);
 }
 
 template <typename T>
-static inline internal::RetainedRefWrapper<T> RetainedRef(T* o) {
-  return internal::RetainedRefWrapper<T>(o);
-}
-
-template <typename T>
-static inline internal::RetainedRefWrapper<T> RetainedRef(scoped_refptr<T> o) {
-  return internal::RetainedRefWrapper<T>(std::move(o));
-}
-
-template <typename T>
 static inline internal::ConstRefWrapper<T> ConstRef(const T& o) {
   return internal::ConstRefWrapper<T>(o);
 }
 
 template <typename T>
 static inline internal::OwnedWrapper<T> Owned(T* o) {
   return internal::OwnedWrapper<T>(o);
 }
@@ -430,97 +617,42 @@ static inline internal::OwnedWrapper<T> 
 // We offer 2 syntaxes for calling Passed().  The first takes an rvalue and
 // is best suited for use with the return value of a function or other temporary
 // rvalues. The second takes a pointer to the scoper and is just syntactic sugar
 // to avoid having to write Passed(std::move(scoper)).
 //
 // Both versions of Passed() prevent T from being an lvalue reference. The first
 // via use of enable_if, and the second takes a T* which will not bind to T&.
 template <typename T,
-          typename std::enable_if<!std::is_lvalue_reference<T>::value>::type* =
+          typename std::enable_if<internal::IsMoveOnlyType<T>::value &&
+                                  !std::is_lvalue_reference<T>::value>::type* =
               nullptr>
 static inline internal::PassedWrapper<T> Passed(T&& scoper) {
   return internal::PassedWrapper<T>(std::move(scoper));
 }
-template <typename T>
+template <typename T,
+          typename std::enable_if<internal::IsMoveOnlyType<T>::value>::type* =
+              nullptr>
 static inline internal::PassedWrapper<T> Passed(T* scoper) {
   return internal::PassedWrapper<T>(std::move(*scoper));
 }
 
 template <typename T>
 static inline internal::IgnoreResultHelper<T> IgnoreResult(T data) {
-  return internal::IgnoreResultHelper<T>(std::move(data));
+  return internal::IgnoreResultHelper<T>(data);
+}
+
+template <typename T>
+static inline internal::IgnoreResultHelper<Callback<T> >
+IgnoreResult(const Callback<T>& data) {
+  return internal::IgnoreResultHelper<Callback<T> >(data);
 }
 
 BASE_EXPORT void DoNothing();
 
 template<typename T>
 void DeletePointer(T* obj) {
   delete obj;
 }
 
-// An injection point to control |this| pointer behavior on a method invocation.
-// If IsWeakReceiver<> is true_type for |T| and |T| is used for a receiver of a
-// method, base::Bind cancels the method invocation if the receiver is tested as
-// false.
-// E.g. Foo::bar() is not called:
-//   struct Foo : base::SupportsWeakPtr<Foo> {
-//     void bar() {}
-//   };
-//
-//   WeakPtr<Foo> oo = nullptr;
-//   base::Bind(&Foo::bar, oo).Run();
-template <typename T>
-struct IsWeakReceiver : std::false_type {};
-
-template <typename T>
-struct IsWeakReceiver<internal::ConstRefWrapper<T>> : IsWeakReceiver<T> {};
-
-template <typename T>
-struct IsWeakReceiver<WeakPtr<T>> : std::true_type {};
-
-// An injection point to control how bound objects passed to the target
-// function. BindUnwrapTraits<>::Unwrap() is called for each bound objects right
-// before the target function is invoked.
-template <typename>
-struct BindUnwrapTraits {
-  template <typename T>
-  static T&& Unwrap(T&& o) { return std::forward<T>(o); }
-};
-
-template <typename T>
-struct BindUnwrapTraits<internal::UnretainedWrapper<T>> {
-  static T* Unwrap(const internal::UnretainedWrapper<T>& o) {
-    return o.get();
-  }
-};
-
-template <typename T>
-struct BindUnwrapTraits<internal::ConstRefWrapper<T>> {
-  static const T& Unwrap(const internal::ConstRefWrapper<T>& o) {
-    return o.get();
-  }
-};
-
-template <typename T>
-struct BindUnwrapTraits<internal::RetainedRefWrapper<T>> {
-  static T* Unwrap(const internal::RetainedRefWrapper<T>& o) {
-    return o.get();
-  }
-};
-
-template <typename T>
-struct BindUnwrapTraits<internal::OwnedWrapper<T>> {
-  static T* Unwrap(const internal::OwnedWrapper<T>& o) {
-    return o.get();
-  }
-};
-
-template <typename T>
-struct BindUnwrapTraits<internal::PassedWrapper<T>> {
-  static T Unwrap(const internal::PassedWrapper<T>& o) {
-    return o.Take();
-  }
-};
-
 }  // namespace base
 
 #endif  // BASE_BIND_HELPERS_H_
--- a/security/sandbox/chromium/base/bind_internal.h
+++ b/security/sandbox/chromium/base/bind_internal.h
@@ -2,557 +2,424 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_BIND_INTERNAL_H_
 #define BASE_BIND_INTERNAL_H_
 
 #include <stddef.h>
 
-#include <tuple>
 #include <type_traits>
 
 #include "base/bind_helpers.h"
 #include "base/callback_internal.h"
 #include "base/memory/raw_scoped_refptr_mismatch_checker.h"
 #include "base/memory/weak_ptr.h"
 #include "base/template_util.h"
 #include "base/tuple.h"
 #include "build/build_config.h"
 
+#if defined(OS_WIN)
+#include "base/bind_internal_win.h"
+#endif
+
 namespace base {
 namespace internal {
 
 // See base/callback.h for user documentation.
 //
 //
 // CONCEPTS:
-//  Functor -- A movable type representing something that should be called.
-//             All function pointers and Callback<> are functors even if the
-//             invocation syntax differs.
+//  Runnable -- A type (really a type class) that has a single Run() method
+//              and a RunType typedef that corresponds to the type of Run().
+//              A Runnable can declare that it should treated like a method
+//              call by including a typedef named IsMethod.  The value of
+//              this typedef is NOT inspected, only the existence.  When a
+//              Runnable declares itself a method, Bind() will enforce special
+//              refcounting + WeakPtr handling semantics for the first
+//              parameter which is expected to be an object.
+//  Functor -- A copyable type representing something that should be called.
+//             All function pointers, Callback<>, and Runnables are functors
+//             even if the invocation syntax differs.
 //  RunType -- A function type (as opposed to function _pointer_ type) for
-//             a Callback<>::Run().  Usually just a convenience typedef.
+//             a Run() function.  Usually just a convenience typedef.
 //  (Bound)Args -- A set of types that stores the arguments.
 //
 // Types:
+//  RunnableAdapter<> -- Wraps the various "function" pointer types into an
+//                       object that adheres to the Runnable interface.
 //  ForceVoidReturn<> -- Helper class for translating function signatures to
 //                       equivalent forms with a "void" return type.
-//  FunctorTraits<> -- Type traits used to determine the correct RunType and
-//                     invocation manner for a Functor.  This is where function
+//  FunctorTraits<> -- Type traits used determine the correct RunType and
+//                     RunnableType for a Functor.  This is where function
 //                     signature adapters are applied.
-//  InvokeHelper<> -- Take a Functor + arguments and actully invokes it.
+//  MakeRunnable<> -- Takes a Functor and returns an object in the Runnable
+//                    type class that represents the underlying Functor.
+//  InvokeHelper<> -- Take a Runnable + arguments and actully invokes it.
 //                    Handle the differing syntaxes needed for WeakPtr<>
-//                    support.  This is separate from Invoker to avoid creating
-//                    multiple version of Invoker<>.
-//  Invoker<> -- Unwraps the curried parameters and executes the Functor.
+//                    support, and for ignoring return values.  This is separate
+//                    from Invoker to avoid creating multiple version of
+//                    Invoker<>.
+//  Invoker<> -- Unwraps the curried parameters and executes the Runnable.
 //  BindState<> -- Stores the curried parameters, and is the main entry point
-//                 into the Bind() system.
-
-template <typename...>
-struct make_void {
-  using type = void;
-};
-
-// A clone of C++17 std::void_t.
-// Unlike the original version, we need |make_void| as a helper struct to avoid
-// a C++14 defect.
-// ref: http://en.cppreference.com/w/cpp/types/void_t
-// ref: http://open-std.org/JTC1/SC22/WG21/docs/cwg_defects.html#1558
-template <typename... Ts>
-using void_t = typename make_void<Ts...>::type;
-
-template <typename Callable,
-          typename Signature = decltype(&Callable::operator())>
-struct ExtractCallableRunTypeImpl;
+//                 into the Bind() system, doing most of the type resolution.
+//                 There are ARITY BindState types.
 
-template <typename Callable, typename R, typename... Args>
-struct ExtractCallableRunTypeImpl<Callable, R(Callable::*)(Args...) const> {
-  using Type = R(Args...);
-};
-
-// Evaluated to RunType of the given callable type.
-// Example:
-//   auto f = [](int, char*) { return 0.1; };
-//   ExtractCallableRunType<decltype(f)>
-//   is evaluated to
-//   double(int, char*);
-template <typename Callable>
-using ExtractCallableRunType =
-    typename ExtractCallableRunTypeImpl<Callable>::Type;
+// HasNonConstReferenceParam selects true_type when any of the parameters in
+// |Sig| is a non-const reference.
+// Implementation note: This non-specialized case handles zero-arity case only.
+// Non-zero-arity cases should be handled by the specialization below.
+template <typename List>
+struct HasNonConstReferenceItem : false_type {};
 
-// IsConvertibleToRunType<Functor> is std::true_type if |Functor| has operator()
-// and convertible to the corresponding function pointer. Otherwise, it's
-// std::false_type.
-// Example:
-//   IsConvertibleToRunType<void(*)()>::value is false.
-//
-//   struct Foo {};
-//   IsConvertibleToRunType<void(Foo::*)()>::value is false.
-//
-//   auto f = []() {};
-//   IsConvertibleToRunType<decltype(f)>::value is true.
-//
-//   int i = 0;
-//   auto g = [i]() {};
-//   IsConvertibleToRunType<decltype(g)>::value is false.
-template <typename Functor, typename SFINAE = void>
-struct IsConvertibleToRunType : std::false_type {};
-
-template <typename Callable>
-struct IsConvertibleToRunType<Callable, void_t<decltype(&Callable::operator())>>
-    : std::is_convertible<Callable, ExtractCallableRunType<Callable>*> {};
+// Implementation note: Select true_type if the first parameter is a non-const
+// reference.  Otherwise, skip the first parameter and check rest of parameters
+// recursively.
+template <typename T, typename... Args>
+struct HasNonConstReferenceItem<TypeList<T, Args...>>
+    : std::conditional<is_non_const_reference<T>::value,
+                       true_type,
+                       HasNonConstReferenceItem<TypeList<Args...>>>::type {};
 
 // HasRefCountedTypeAsRawPtr selects true_type when any of the |Args| is a raw
 // pointer to a RefCounted type.
 // Implementation note: This non-specialized case handles zero-arity case only.
 // Non-zero-arity cases should be handled by the specialization below.
 template <typename... Args>
-struct HasRefCountedTypeAsRawPtr : std::false_type {};
+struct HasRefCountedTypeAsRawPtr : false_type {};
 
 // Implementation note: Select true_type if the first parameter is a raw pointer
 // to a RefCounted type. Otherwise, skip the first parameter and check rest of
 // parameters recursively.
 template <typename T, typename... Args>
 struct HasRefCountedTypeAsRawPtr<T, Args...>
     : std::conditional<NeedsScopedRefptrButGetsRawPtr<T>::value,
-                       std::true_type,
+                       true_type,
                        HasRefCountedTypeAsRawPtr<Args...>>::type {};
 
+// BindsArrayToFirstArg selects true_type when |is_method| is true and the first
+// item of |Args| is an array type.
+// Implementation note: This non-specialized case handles !is_method case and
+// zero-arity case only.  Other cases should be handled by the specialization
+// below.
+template <bool is_method, typename... Args>
+struct BindsArrayToFirstArg : false_type {};
+
+template <typename T, typename... Args>
+struct BindsArrayToFirstArg<true, T, Args...> : is_array<T> {};
+
+// HasRefCountedParamAsRawPtr is the same to HasRefCountedTypeAsRawPtr except
+// when |is_method| is true HasRefCountedParamAsRawPtr skips the first argument.
+// Implementation note: This non-specialized case handles !is_method case and
+// zero-arity case only.  Other cases should be handled by the specialization
+// below.
+template <bool is_method, typename... Args>
+struct HasRefCountedParamAsRawPtr : HasRefCountedTypeAsRawPtr<Args...> {};
+
+template <typename T, typename... Args>
+struct HasRefCountedParamAsRawPtr<true, T, Args...>
+    : HasRefCountedTypeAsRawPtr<Args...> {};
+
+// RunnableAdapter<>
+//
+// The RunnableAdapter<> templates provide a uniform interface for invoking
+// a function pointer, method pointer, or const method pointer. The adapter
+// exposes a Run() method with an appropriate signature. Using this wrapper
+// allows for writing code that supports all three pointer types without
+// undue repetition.  Without it, a lot of code would need to be repeated 3
+// times.
+//
+// For method pointers and const method pointers the first argument to Run()
+// is considered to be the received of the method.  This is similar to STL's
+// mem_fun().
+//
+// This class also exposes a RunType typedef that is the function type of the
+// Run() function.
+//
+// If and only if the wrapper contains a method or const method pointer, an
+// IsMethod typedef is exposed.  The existence of this typedef (NOT the value)
+// marks that the wrapper should be considered a method wrapper.
+
+template <typename Functor>
+class RunnableAdapter;
+
+// Function.
+template <typename R, typename... Args>
+class RunnableAdapter<R(*)(Args...)> {
+ public:
+  // MSVC 2013 doesn't support Type Alias of function types.
+  // Revisit this after we update it to newer version.
+  typedef R RunType(Args...);
+
+  explicit RunnableAdapter(R(*function)(Args...))
+      : function_(function) {
+  }
+
+  R Run(typename CallbackParamTraits<Args>::ForwardType... args) {
+    return function_(CallbackForward(args)...);
+  }
+
+ private:
+  R (*function_)(Args...);
+};
+
+// Method.
+template <typename R, typename T, typename... Args>
+class RunnableAdapter<R(T::*)(Args...)> {
+ public:
+  // MSVC 2013 doesn't support Type Alias of function types.
+  // Revisit this after we update it to newer version.
+  typedef R RunType(T*, Args...);
+  using IsMethod = true_type;
+
+  explicit RunnableAdapter(R(T::*method)(Args...))
+      : method_(method) {
+  }
+
+  R Run(T* object, typename CallbackParamTraits<Args>::ForwardType... args) {
+    return (object->*method_)(CallbackForward(args)...);
+  }
+
+ private:
+  R (T::*method_)(Args...);
+};
+
+// Const Method.
+template <typename R, typename T, typename... Args>
+class RunnableAdapter<R(T::*)(Args...) const> {
+ public:
+  using RunType = R(const T*, Args...);
+  using IsMethod = true_type;
+
+  explicit RunnableAdapter(R(T::*method)(Args...) const)
+      : method_(method) {
+  }
+
+  R Run(const T* object,
+        typename CallbackParamTraits<Args>::ForwardType... args) {
+    return (object->*method_)(CallbackForward(args)...);
+  }
+
+ private:
+  R (T::*method_)(Args...) const;
+};
+
+
 // ForceVoidReturn<>
 //
 // Set of templates that support forcing the function return type to void.
 template <typename Sig>
 struct ForceVoidReturn;
 
 template <typename R, typename... Args>
 struct ForceVoidReturn<R(Args...)> {
-  using RunType = void(Args...);
+  // MSVC 2013 doesn't support Type Alias of function types.
+  // Revisit this after we update it to newer version.
+  typedef void RunType(Args...);
 };
 
+
 // FunctorTraits<>
 //
 // See description at top of file.
-template <typename Functor, typename SFINAE = void>
-struct FunctorTraits;
-
-// For a callable type that is convertible to the corresponding function type.
-// This specialization is intended to allow binding captureless lambdas by
-// base::Bind(), based on the fact that captureless lambdas can be convertible
-// to the function type while capturing lambdas can't.
-template <typename Functor>
-struct FunctorTraits<
-    Functor,
-    typename std::enable_if<IsConvertibleToRunType<Functor>::value>::type> {
-  using RunType = ExtractCallableRunType<Functor>;
-  static constexpr bool is_method = false;
-  static constexpr bool is_nullable = false;
-
-  template <typename... RunArgs>
-  static ExtractReturnType<RunType>
-  Invoke(const Functor& functor, RunArgs&&... args) {
-    return functor(std::forward<RunArgs>(args)...);
-  }
+template <typename T>
+struct FunctorTraits {
+  using RunnableType = RunnableAdapter<T>;
+  using RunType = typename RunnableType::RunType;
 };
 
-// For functions.
-template <typename R, typename... Args>
-struct FunctorTraits<R (*)(Args...)> {
-  using RunType = R(Args...);
-  static constexpr bool is_method = false;
-  static constexpr bool is_nullable = true;
+template <typename T>
+struct FunctorTraits<IgnoreResultHelper<T>> {
+  using RunnableType = typename FunctorTraits<T>::RunnableType;
+  using RunType =
+      typename ForceVoidReturn<typename RunnableType::RunType>::RunType;
+};
 
-  template <typename... RunArgs>
-  static R Invoke(R (*function)(Args...), RunArgs&&... args) {
-    return function(std::forward<RunArgs>(args)...);
-  }
+template <typename T>
+struct FunctorTraits<Callback<T>> {
+  using RunnableType = Callback<T> ;
+  using RunType = typename Callback<T>::RunType;
 };
 
-#if defined(OS_WIN) && !defined(ARCH_CPU_X86_64)
+
+// MakeRunnable<>
+//
+// Converts a passed in functor to a RunnableType using type inference.
 
-// For functions.
-template <typename R, typename... Args>
-struct FunctorTraits<R(__stdcall*)(Args...)> {
-  using RunType = R(Args...);
-  static constexpr bool is_method = false;
-  static constexpr bool is_nullable = true;
+template <typename T>
+typename FunctorTraits<T>::RunnableType MakeRunnable(const T& t) {
+  return RunnableAdapter<T>(t);
+}
 
-  template <typename... RunArgs>
-  static R Invoke(R(__stdcall* function)(Args...), RunArgs&&... args) {
-    return function(std::forward<RunArgs>(args)...);
-  }
-};
+template <typename T>
+typename FunctorTraits<T>::RunnableType
+MakeRunnable(const IgnoreResultHelper<T>& t) {
+  return MakeRunnable(t.functor_);
+}
 
-// For functions.
-template <typename R, typename... Args>
-struct FunctorTraits<R(__fastcall*)(Args...)> {
-  using RunType = R(Args...);
-  static constexpr bool is_method = false;
-  static constexpr bool is_nullable = true;
+template <typename T>
+const typename FunctorTraits<Callback<T>>::RunnableType&
+MakeRunnable(const Callback<T>& t) {
+  DCHECK(!t.is_null());
+  return t;
+}
+
 
-  template <typename... RunArgs>
-  static R Invoke(R(__fastcall* function)(Args...), RunArgs&&... args) {
-    return function(std::forward<RunArgs>(args)...);
-  }
-};
-
-#endif  // defined(OS_WIN) && !defined(ARCH_CPU_X86_64)
+// InvokeHelper<>
+//
+// There are 3 logical InvokeHelper<> specializations: normal, void-return,
+// WeakCalls.
+//
+// The normal type just calls the underlying runnable.
+//
+// We need a InvokeHelper to handle void return types in order to support
+// IgnoreResult().  Normally, if the Runnable's RunType had a void return,
+// the template system would just accept "return functor.Run()" ignoring
+// the fact that a void function is being used with return. This piece of
+// sugar breaks though when the Runnable's RunType is not void.  Thus, we
+// need a partial specialization to change the syntax to drop the "return"
+// from the invocation call.
+//
+// WeakCalls similarly need special syntax that is applied to the first
+// argument to check if they should no-op themselves.
+template <bool IsWeakCall, typename ReturnType, typename Runnable,
+          typename ArgsType>
+struct InvokeHelper;
 
-// For methods.
-template <typename R, typename Receiver, typename... Args>
-struct FunctorTraits<R (Receiver::*)(Args...)> {
-  using RunType = R(Receiver*, Args...);
-  static constexpr bool is_method = true;
-  static constexpr bool is_nullable = true;
-
-  template <typename ReceiverPtr, typename... RunArgs>
-  static R Invoke(R (Receiver::*method)(Args...),
-                  ReceiverPtr&& receiver_ptr,
-                  RunArgs&&... args) {
-    // Clang skips CV qualifier check on a method pointer invocation when the
-    // receiver is a subclass. Store the receiver into a const reference to
-    // T to ensure the CV check works.
-    // https://llvm.org/bugs/show_bug.cgi?id=27037
-    Receiver& receiver = *receiver_ptr;
-    return (receiver.*method)(std::forward<RunArgs>(args)...);
+template <typename ReturnType, typename Runnable, typename... Args>
+struct InvokeHelper<false, ReturnType, Runnable, TypeList<Args...>> {
+  static ReturnType MakeItSo(Runnable runnable, Args... args) {
+    return runnable.Run(CallbackForward(args)...);
   }
 };
 
-// For const methods.
-template <typename R, typename Receiver, typename... Args>
-struct FunctorTraits<R (Receiver::*)(Args...) const> {
-  using RunType = R(const Receiver*, Args...);
-  static constexpr bool is_method = true;
-  static constexpr bool is_nullable = true;
-
-  template <typename ReceiverPtr, typename... RunArgs>
-  static R Invoke(R (Receiver::*method)(Args...) const,
-                  ReceiverPtr&& receiver_ptr,
-                  RunArgs&&... args) {
-    // Clang skips CV qualifier check on a method pointer invocation when the
-    // receiver is a subclass. Store the receiver into a const reference to
-    // T to ensure the CV check works.
-    // https://llvm.org/bugs/show_bug.cgi?id=27037
-    const Receiver& receiver = *receiver_ptr;
-    return (receiver.*method)(std::forward<RunArgs>(args)...);
-  }
-};
-
-// For IgnoreResults.
-template <typename T>
-struct FunctorTraits<IgnoreResultHelper<T>> : FunctorTraits<T> {
-  using RunType =
-      typename ForceVoidReturn<typename FunctorTraits<T>::RunType>::RunType;
-
-  template <typename IgnoreResultType, typename... RunArgs>
-  static void Invoke(IgnoreResultType&& ignore_result_helper,
-                     RunArgs&&... args) {
-    FunctorTraits<T>::Invoke(
-        std::forward<IgnoreResultType>(ignore_result_helper).functor_,
-        std::forward<RunArgs>(args)...);
+template <typename Runnable, typename... Args>
+struct InvokeHelper<false, void, Runnable, TypeList<Args...>> {
+  static void MakeItSo(Runnable runnable, Args... args) {
+    runnable.Run(CallbackForward(args)...);
   }
 };
 
-// For Callbacks.
-template <typename R, typename... Args,
-          CopyMode copy_mode, RepeatMode repeat_mode>
-struct FunctorTraits<Callback<R(Args...), copy_mode, repeat_mode>> {
-  using RunType = R(Args...);
-  static constexpr bool is_method = false;
-  static constexpr bool is_nullable = true;
-
-  template <typename CallbackType, typename... RunArgs>
-  static R Invoke(CallbackType&& callback, RunArgs&&... args) {
-    DCHECK(!callback.is_null());
-    return std::forward<CallbackType>(callback).Run(
-        std::forward<RunArgs>(args)...);
+template <typename Runnable, typename BoundWeakPtr, typename... Args>
+struct InvokeHelper<true, void, Runnable, TypeList<BoundWeakPtr, Args...>> {
+  static void MakeItSo(Runnable runnable, BoundWeakPtr weak_ptr, Args... args) {
+    if (!weak_ptr.get()) {
+      return;
+    }
+    runnable.Run(weak_ptr.get(), CallbackForward(args)...);
   }
 };
 
-// InvokeHelper<>
-//
-// There are 2 logical InvokeHelper<> specializations: normal, WeakCalls.
-//
-// The normal type just calls the underlying runnable.
-//
-// WeakCalls need special syntax that is applied to the first argument to check
-// if they should no-op themselves.
-template <bool is_weak_call, typename ReturnType>
-struct InvokeHelper;
+#if !defined(_MSC_VER)
 
-template <typename ReturnType>
-struct InvokeHelper<false, ReturnType> {
-  template <typename Functor, typename... RunArgs>
-  static inline ReturnType MakeItSo(Functor&& functor, RunArgs&&... args) {
-    using Traits = FunctorTraits<typename std::decay<Functor>::type>;
-    return Traits::Invoke(std::forward<Functor>(functor),
-                          std::forward<RunArgs>(args)...);
-  }
-};
-
-template <typename ReturnType>
-struct InvokeHelper<true, ReturnType> {
+template <typename ReturnType, typename Runnable, typename ArgsType>
+struct InvokeHelper<true, ReturnType, Runnable, ArgsType> {
   // WeakCalls are only supported for functions with a void return type.
   // Otherwise, the function result would be undefined if the the WeakPtr<>
   // is invalidated.
-  static_assert(std::is_void<ReturnType>::value,
+  static_assert(is_void<ReturnType>::value,
                 "weak_ptrs can only bind to methods without return values");
+};
 
-  template <typename Functor, typename BoundWeakPtr, typename... RunArgs>
-  static inline void MakeItSo(Functor&& functor,
-                              BoundWeakPtr&& weak_ptr,
-                              RunArgs&&... args) {
-    if (!weak_ptr)
-      return;
-    using Traits = FunctorTraits<typename std::decay<Functor>::type>;
-    Traits::Invoke(std::forward<Functor>(functor),
-                   std::forward<BoundWeakPtr>(weak_ptr),
-                   std::forward<RunArgs>(args)...);
-  }
-};
+#endif
 
 // Invoker<>
 //
 // See description at the top of the file.
-template <typename StorageType, typename UnboundRunType>
+template <typename BoundIndices,
+          typename StorageType, typename Unwrappers,
+          typename InvokeHelperType, typename UnboundForwardRunType>
 struct Invoker;
 
-template <typename StorageType, typename R, typename... UnboundArgs>
-struct Invoker<StorageType, R(UnboundArgs...)> {
-  static R RunOnce(BindStateBase* base, UnboundArgs&&... unbound_args) {
-    // Local references to make debugger stepping easier. If in a debugger,
-    // you really want to warp ahead and step through the
-    // InvokeHelper<>::MakeItSo() call below.
+template <size_t... bound_indices,
+          typename StorageType,
+          typename... Unwrappers,
+          typename InvokeHelperType,
+          typename R,
+          typename... UnboundForwardArgs>
+struct Invoker<IndexSequence<bound_indices...>,
+               StorageType, TypeList<Unwrappers...>,
+               InvokeHelperType, R(UnboundForwardArgs...)> {
+  static R Run(BindStateBase* base,
+               UnboundForwardArgs... unbound_args) {
     StorageType* storage = static_cast<StorageType*>(base);
-    static constexpr size_t num_bound_args =
-        std::tuple_size<decltype(storage->bound_args_)>::value;
-    return RunImpl(std::move(storage->functor_),
-                   std::move(storage->bound_args_),
-                   MakeIndexSequence<num_bound_args>(),
-                   std::forward<UnboundArgs>(unbound_args)...);
-  }
-
-  static R Run(BindStateBase* base, UnboundArgs&&... unbound_args) {
     // Local references to make debugger stepping easier. If in a debugger,
     // you really want to warp ahead and step through the
     // InvokeHelper<>::MakeItSo() call below.
-    const StorageType* storage = static_cast<StorageType*>(base);
-    static constexpr size_t num_bound_args =
-        std::tuple_size<decltype(storage->bound_args_)>::value;
-    return RunImpl(storage->functor_,
-                   storage->bound_args_,
-                   MakeIndexSequence<num_bound_args>(),
-                   std::forward<UnboundArgs>(unbound_args)...);
-  }
-
- private:
-  template <typename Functor, typename BoundArgsTuple, size_t... indices>
-  static inline R RunImpl(Functor&& functor,
-                          BoundArgsTuple&& bound,
-                          IndexSequence<indices...>,
-                          UnboundArgs&&... unbound_args) {
-    static constexpr bool is_method =
-        FunctorTraits<typename std::decay<Functor>::type>::is_method;
-
-    using DecayedArgsTuple = typename std::decay<BoundArgsTuple>::type;
-    static constexpr bool is_weak_call =
-        IsWeakMethod<is_method,
-                     typename std::tuple_element<
-                         indices,
-                         DecayedArgsTuple>::type...>::value;
-
-    return InvokeHelper<is_weak_call, R>::MakeItSo(
-        std::forward<Functor>(functor),
-        Unwrap(base::get<indices>(std::forward<BoundArgsTuple>(bound)))...,
-        std::forward<UnboundArgs>(unbound_args)...);
-  }
-};
-
-// Used to implement MakeUnboundRunType.
-template <typename Functor, typename... BoundArgs>
-struct MakeUnboundRunTypeImpl {
-  using RunType =
-      typename FunctorTraits<typename std::decay<Functor>::type>::RunType;
-  using ReturnType = ExtractReturnType<RunType>;
-  using Args = ExtractArgs<RunType>;
-  using UnboundArgs = DropTypeListItem<sizeof...(BoundArgs), Args>;
-  using Type = MakeFunctionType<ReturnType, UnboundArgs>;
-};
-template <typename Functor>
-typename std::enable_if<FunctorTraits<Functor>::is_nullable, bool>::type
-IsNull(const Functor& functor) {
-  return !functor;
-}
-
-template <typename Functor>
-typename std::enable_if<!FunctorTraits<Functor>::is_nullable, bool>::type
-IsNull(const Functor&) {
-  return false;
-}
-
-template <typename Functor, typename... BoundArgs>
-struct BindState;
-
-template <typename BindStateType, typename SFINAE = void>
-struct CancellationChecker {
-  static constexpr bool is_cancellable = false;
-  static bool Run(const BindStateBase*) {
-    return false;
-  }
-};
-
-template <typename Functor, typename... BoundArgs>
-struct CancellationChecker<
-    BindState<Functor, BoundArgs...>,
-    typename std::enable_if<IsWeakMethod<FunctorTraits<Functor>::is_method,
-                                         BoundArgs...>::value>::type> {
-  static constexpr bool is_cancellable = true;
-  static bool Run(const BindStateBase* base) {
-    using BindStateType = BindState<Functor, BoundArgs...>;
-    const BindStateType* bind_state = static_cast<const BindStateType*>(base);
-    return !base::get<0>(bind_state->bound_args_);
-  }
-};
-
-template <typename Signature,
-          typename... BoundArgs,
-          CopyMode copy_mode,
-          RepeatMode repeat_mode>
-struct CancellationChecker<
-    BindState<Callback<Signature, copy_mode, repeat_mode>, BoundArgs...>> {
-  static constexpr bool is_cancellable = true;
-  static bool Run(const BindStateBase* base) {
-    using Functor = Callback<Signature, copy_mode, repeat_mode>;
-    using BindStateType = BindState<Functor, BoundArgs...>;
-    const BindStateType* bind_state = static_cast<const BindStateType*>(base);
-    return bind_state->functor_.IsCancelled();
+    return InvokeHelperType::MakeItSo(
+        storage->runnable_,
+        Unwrappers::Unwrap(get<bound_indices>(storage->bound_args_))...,
+        CallbackForward(unbound_args)...);
   }
 };
 
-// Template helpers to detect using Bind() on a base::Callback without any
-// additional arguments. In that case, the original base::Callback object should
-// just be directly used.
-template <typename Functor, typename... BoundArgs>
-struct BindingCallbackWithNoArgs {
-  static constexpr bool value = false;
-};
-
-template <typename Signature,
-          typename... BoundArgs,
-          CopyMode copy_mode,
-          RepeatMode repeat_mode>
-struct BindingCallbackWithNoArgs<Callback<Signature, copy_mode, repeat_mode>,
-                                 BoundArgs...> {
-  static constexpr bool value = sizeof...(BoundArgs) == 0;
-};
 
 // BindState<>
 //
-// This stores all the state passed into Bind().
-template <typename Functor, typename... BoundArgs>
-struct BindState final : BindStateBase {
-  using IsCancellable = std::integral_constant<
-      bool, CancellationChecker<BindState>::is_cancellable>;
+// This stores all the state passed into Bind() and is also where most
+// of the template resolution magic occurs.
+//
+// Runnable is the functor we are binding arguments to.
+// RunType is type of the Run() function that the Invoker<> should use.
+// Normally, this is the same as the RunType of the Runnable, but it can
+// be different if an adapter like IgnoreResult() has been used.
+//
+// BoundArgs contains the storage type for all the bound arguments.
+template <typename Runnable, typename RunType, typename... BoundArgs>
+struct BindState;
+
+template <typename Runnable,
+          typename R,
+          typename... Args,
+          typename... BoundArgs>
+struct BindState<Runnable, R(Args...), BoundArgs...> final
+    : public BindStateBase {
+ private:
+  using StorageType = BindState<Runnable, R(Args...), BoundArgs...>;
+  using RunnableType = Runnable;
+
+  // true_type if Runnable is a method invocation and the first bound argument
+  // is a WeakPtr.
+  using IsWeakCall =
+      IsWeakMethod<HasIsMethodTag<Runnable>::value, BoundArgs...>;
 
-  template <typename ForwardFunctor, typename... ForwardBoundArgs>
-  explicit BindState(BindStateBase::InvokeFuncStorage invoke_func,
-                     ForwardFunctor&& functor,
-                     ForwardBoundArgs&&... bound_args)
-      // IsCancellable is std::false_type if the CancellationChecker<>::Run
-      // returns always false. Otherwise, it's std::true_type.
-      : BindState(IsCancellable{},
-                  invoke_func,
-                  std::forward<ForwardFunctor>(functor),
-                  std::forward<ForwardBoundArgs>(bound_args)...) {
-    static_assert(!BindingCallbackWithNoArgs<Functor, BoundArgs...>::value,
-                  "Attempting to bind a base::Callback with no additional "
-                  "arguments: save a heap allocation and use the original "
-                  "base::Callback object");
-  }
+  using BoundIndices = MakeIndexSequence<sizeof...(BoundArgs)>;
+  using Unwrappers = TypeList<UnwrapTraits<BoundArgs>...>;
+  using UnboundForwardArgs = DropTypeListItem<
+      sizeof...(BoundArgs),
+      TypeList<typename CallbackParamTraits<Args>::ForwardType...>>;
+  using UnboundForwardRunType = MakeFunctionType<R, UnboundForwardArgs>;
+
+  using InvokeHelperArgs = ConcatTypeLists<
+      TypeList<typename UnwrapTraits<BoundArgs>::ForwardType...>,
+      UnboundForwardArgs>;
+  using InvokeHelperType =
+      InvokeHelper<IsWeakCall::value, R, Runnable, InvokeHelperArgs>;
+
+  using UnboundArgs = DropTypeListItem<sizeof...(BoundArgs), TypeList<Args...>>;
 
-  Functor functor_;
-  std::tuple<BoundArgs...> bound_args_;
+ public:
+  using InvokerType = Invoker<BoundIndices, StorageType, Unwrappers,
+                              InvokeHelperType, UnboundForwardRunType>;
+  using UnboundRunType = MakeFunctionType<R, UnboundArgs>;
+
+  BindState(const Runnable& runnable, const BoundArgs&... bound_args)
+      : BindStateBase(&Destroy),
+        runnable_(runnable),
+        ref_(bound_args...),
+        bound_args_(bound_args...) {}
+
+  RunnableType runnable_;
+  MaybeScopedRefPtr<HasIsMethodTag<Runnable>::value, BoundArgs...> ref_;
+  Tuple<BoundArgs...> bound_args_;
 
  private:
-  template <typename ForwardFunctor, typename... ForwardBoundArgs>
-  explicit BindState(std::true_type,
-                     BindStateBase::InvokeFuncStorage invoke_func,
-                     ForwardFunctor&& functor,
-                     ForwardBoundArgs&&... bound_args)
-      : BindStateBase(invoke_func, &Destroy,
-                      &CancellationChecker<BindState>::Run),
-        functor_(std::forward<ForwardFunctor>(functor)),
-        bound_args_(std::forward<ForwardBoundArgs>(bound_args)...) {
-    DCHECK(!IsNull(functor_));
-  }
-
-  template <typename ForwardFunctor, typename... ForwardBoundArgs>
-  explicit BindState(std::false_type,
-                     BindStateBase::InvokeFuncStorage invoke_func,
-                     ForwardFunctor&& functor,
-                     ForwardBoundArgs&&... bound_args)
-      : BindStateBase(invoke_func, &Destroy),
-        functor_(std::forward<ForwardFunctor>(functor)),
-        bound_args_(std::forward<ForwardBoundArgs>(bound_args)...) {
-    DCHECK(!IsNull(functor_));
-  }
-
   ~BindState() {}
 
-  static void Destroy(const BindStateBase* self) {
-    delete static_cast<const BindState*>(self);
+  static void Destroy(BindStateBase* self) {
+    delete static_cast<BindState*>(self);
   }
 };
 
-// Used to implement MakeBindStateType.
-template <bool is_method, typename Functor, typename... BoundArgs>
-struct MakeBindStateTypeImpl;
-
-template <typename Functor, typename... BoundArgs>
-struct MakeBindStateTypeImpl<false, Functor, BoundArgs...> {
-  static_assert(!HasRefCountedTypeAsRawPtr<BoundArgs...>::value,
-                "A parameter is a refcounted type and needs scoped_refptr.");
-  using Type = BindState<typename std::decay<Functor>::type,
-                         typename std::decay<BoundArgs>::type...>;
-};
-
-template <typename Functor>
-struct MakeBindStateTypeImpl<true, Functor> {
-  using Type = BindState<typename std::decay<Functor>::type>;
-};
-
-template <typename Functor, typename Receiver, typename... BoundArgs>
-struct MakeBindStateTypeImpl<true, Functor, Receiver, BoundArgs...> {
-  static_assert(
-      !std::is_array<typename std::remove_reference<Receiver>::type>::value,
-      "First bound argument to a method cannot be an array.");
-  static_assert(!HasRefCountedTypeAsRawPtr<BoundArgs...>::value,
-                "A parameter is a refcounted type and needs scoped_refptr.");
-
- private:
-  using DecayedReceiver = typename std::decay<Receiver>::type;
-
- public:
-  using Type = BindState<
-      typename std::decay<Functor>::type,
-      typename std::conditional<
-          std::is_pointer<DecayedReceiver>::value,
-          scoped_refptr<typename std::remove_pointer<DecayedReceiver>::type>,
-          DecayedReceiver>::type,
-      typename std::decay<BoundArgs>::type...>;
-};
-
-template <typename Functor, typename... BoundArgs>
-using MakeBindStateType = typename MakeBindStateTypeImpl<
-    FunctorTraits<typename std::decay<Functor>::type>::is_method,
-    Functor,
-    BoundArgs...>::Type;
-
 }  // namespace internal
-
-// Returns a RunType of bound functor.
-// E.g. MakeUnboundRunType<R(A, B, C), A, B> is evaluated to R(C).
-template <typename Functor, typename... BoundArgs>
-using MakeUnboundRunType =
-    typename internal::MakeUnboundRunTypeImpl<Functor, BoundArgs...>::Type;
-
 }  // namespace base
 
 #endif  // BASE_BIND_INTERNAL_H_
new file mode 100644
--- /dev/null
+++ b/security/sandbox/chromium/base/bind_internal_win.h
@@ -0,0 +1,69 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Specializations of RunnableAdapter<> for Windows specific calling
+// conventions.  Please see base/bind_internal.h for more info.
+
+#ifndef BASE_BIND_INTERNAL_WIN_H_
+#define BASE_BIND_INTERNAL_WIN_H_
+
+#include "build/build_config.h"
+
+// In the x64 architecture in Windows, __fastcall, __stdcall, etc, are all
+// the same as __cdecl which would turn the following specializations into
+// multiple definitions.
+#if !defined(ARCH_CPU_X86_64)
+
+namespace base {
+namespace internal {
+
+template <typename Functor>
+class RunnableAdapter;
+
+// __stdcall Function.
+template <typename R, typename... Args>
+class RunnableAdapter<R(__stdcall *)(Args...)> {
+ public:
+  // MSVC 2013 doesn't support Type Alias of function types.
+  // Revisit this after we update it to newer version.
+  typedef R RunType(Args...);
+
+  explicit RunnableAdapter(R(__stdcall *function)(Args...))
+      : function_(function) {
+  }
+
+  R Run(typename CallbackParamTraits<Args>::ForwardType... args) {
+    return function_(args...);
+  }
+
+ private:
+  R (__stdcall *function_)(Args...);
+};
+
+// __fastcall Function.
+template <typename R, typename... Args>
+class RunnableAdapter<R(__fastcall *)(Args...)> {
+ public:
+  // MSVC 2013 doesn't support Type Alias of function types.
+  // Revisit this after we update it to newer version.
+  typedef R RunType(Args...);
+
+  explicit RunnableAdapter(R(__fastcall *function)(Args...))
+      : function_(function) {
+  }
+
+  R Run(typename CallbackParamTraits<Args>::ForwardType... args) {
+    return function_(args...);
+  }
+
+ private:
+  R (__fastcall *function_)(Args...);
+};
+
+}  // namespace internal
+}  // namespace base
+
+#endif  // !defined(ARCH_CPU_X86_64)
+
+#endif  // BASE_BIND_INTERNAL_WIN_H_
--- a/security/sandbox/chromium/base/bit_cast.h
+++ b/security/sandbox/chromium/base/bit_cast.h
@@ -1,20 +1,16 @@
 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_BIT_CAST_H_
 #define BASE_BIT_CAST_H_
 
 #include <string.h>
-#include <type_traits>
-
-#include "base/compiler_specific.h"
-#include "build/build_config.h"
 
 // bit_cast<Dest,Source> is a template function that implements the equivalent
 // of "*reinterpret_cast<Dest*>(&source)".  We need this in very low-level
 // functions like the protobuf library and fast math support.
 //
 //   float f = 3.14159265358979;
 //   int i = bit_cast<int32_t>(f);
 //   // i = 0x40490fdb
@@ -53,48 +49,23 @@
 // bit_cast<> calls memcpy() which is blessed by the standard, especially by the
 // example in section 3.9 .  Also, of course, bit_cast<> wraps up the nasty
 // logic in one place.
 //
 // Fortunately memcpy() is very fast.  In optimized mode, compilers replace
 // calls to memcpy() with inline object code when the size argument is a
 // compile-time constant.  On a 32-bit system, memcpy(d,s,4) compiles to one
 // load and one store, and memcpy(d,s,8) compiles to two loads and two stores.
+//
+// WARNING: if Dest or Source is a non-POD type, the result of the memcpy
+// is likely to surprise you.
 
 template <class Dest, class Source>
 inline Dest bit_cast(const Source& source) {
   static_assert(sizeof(Dest) == sizeof(Source),
                 "bit_cast requires source and destination to be the same size");
 
-#if (__GNUC__ > 5 || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1) || \
-     (defined(__clang__) && defined(_LIBCPP_VERSION)))
-  // GCC 5.1 contains the first libstdc++ with is_trivially_copyable.
-  // Assume libc++ Just Works: is_trivially_copyable added on May 13th 2011.
-  // However, with libc++ when GCC is the compiler the trait is buggy, see
-  // crbug.com/607158, so fall back to the less strict variant for non-clang.
-  static_assert(std::is_trivially_copyable<Dest>::value,
-                "non-trivially-copyable bit_cast is undefined");
-  static_assert(std::is_trivially_copyable<Source>::value,
-                "non-trivially-copyable bit_cast is undefined");
-#elif HAS_FEATURE(is_trivially_copyable)
-  // The compiler supports an equivalent intrinsic.
-  static_assert(__is_trivially_copyable(Dest),
-                "non-trivially-copyable bit_cast is undefined");
-  static_assert(__is_trivially_copyable(Source),
-                "non-trivially-copyable bit_cast is undefined");
-#elif COMPILER_GCC
-  // Fallback to compiler intrinsic on GCC and clang (which pretends to be
-  // GCC). This isn't quite the same as is_trivially_copyable but it'll do for
-  // our purpose.
-  static_assert(__has_trivial_copy(Dest),
-                "non-trivially-copyable bit_cast is undefined");
-  static_assert(__has_trivial_copy(Source),
-                "non-trivially-copyable bit_cast is undefined");
-#else
-  // Do nothing, let the bots handle it.
-#endif
-
   Dest dest;
   memcpy(&dest, &source, sizeof(dest));
   return dest;
 }
 
 #endif  // BASE_BIT_CAST_H_
--- a/security/sandbox/chromium/base/callback.h
+++ b/security/sandbox/chromium/base/callback.h
@@ -2,123 +2,404 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_CALLBACK_H_
 #define BASE_CALLBACK_H_
 
 #include "base/callback_forward.h"
 #include "base/callback_internal.h"
+#include "base/template_util.h"
 
 // NOTE: Header files that do not require the full definition of Callback or
 // Closure should #include "base/callback_forward.h" instead of this file.
 
 // -----------------------------------------------------------------------------
-// Usage documentation
+// Introduction
+// -----------------------------------------------------------------------------
+//
+// The templated Callback class is a generalized function object. Together
+// with the Bind() function in bind.h, they provide a type-safe method for
+// performing partial application of functions.
+//
+// Partial application (or "currying") is the process of binding a subset of
+// a function's arguments to produce another function that takes fewer
+// arguments. This can be used to pass around a unit of delayed execution,
+// much like lexical closures are used in other languages. For example, it
+// is used in Chromium code to schedule tasks on different MessageLoops.
+//
+// A callback with no unbound input parameters (base::Callback<void()>)
+// is called a base::Closure. Note that this is NOT the same as what other
+// languages refer to as a closure -- it does not retain a reference to its
+// enclosing environment.
+//
+// MEMORY MANAGEMENT AND PASSING
+//
+// The Callback objects themselves should be passed by const-reference, and
+// stored by copy. They internally store their state via a refcounted class
+// and thus do not need to be deleted.
+//
+// The reason to pass via a const-reference is to avoid unnecessary
+// AddRef/Release pairs to the internal state.
+//
+//
+// -----------------------------------------------------------------------------
+// Quick reference for basic stuff
+// -----------------------------------------------------------------------------
+//
+// BINDING A BARE FUNCTION
+//
+//   int Return5() { return 5; }
+//   base::Callback<int()> func_cb = base::Bind(&Return5);
+//   LOG(INFO) << func_cb.Run();  // Prints 5.
+//
+// BINDING A CLASS METHOD
+//
+//   The first argument to bind is the member function to call, the second is
+//   the object on which to call it.
+//
+//   class Ref : public base::RefCountedThreadSafe<Ref> {
+//    public:
+//     int Foo() { return 3; }
+//     void PrintBye() { LOG(INFO) << "bye."; }
+//   };
+//   scoped_refptr<Ref> ref = new Ref();
+//   base::Callback<void()> ref_cb = base::Bind(&Ref::Foo, ref);
+//   LOG(INFO) << ref_cb.Run();  // Prints out 3.
+//
+//   By default the object must support RefCounted or you will get a compiler
+//   error. If you're passing between threads, be sure it's
+//   RefCountedThreadSafe! See "Advanced binding of member functions" below if
+//   you don't want to use reference counting.
+//
+// RUNNING A CALLBACK
+//
+//   Callbacks can be run with their "Run" method, which has the same
+//   signature as the template argument to the callback.
+//
+//   void DoSomething(const base::Callback<void(int, std::string)>& callback) {
+//     callback.Run(5, "hello");
+//   }
+//
+//   Callbacks can be run more than once (they don't get deleted or marked when
+//   run). However, this precludes using base::Passed (see below).
+//
+//   void DoSomething(const base::Callback<double(double)>& callback) {
+//     double myresult = callback.Run(3.14159);
+//     myresult += callback.Run(2.71828);
+//   }
+//
+// PASSING UNBOUND INPUT PARAMETERS
+//
+//   Unbound parameters are specified at the time a callback is Run(). They are
+//   specified in the Callback template type:
+//
+//   void MyFunc(int i, const std::string& str) {}
+//   base::Callback<void(int, const std::string&)> cb = base::Bind(&MyFunc);
+//   cb.Run(23, "hello, world");
+//
+// PASSING BOUND INPUT PARAMETERS
+//
+//   Bound parameters are specified when you create thee callback as arguments
+//   to Bind(). They will be passed to the function and the Run()ner of the
+//   callback doesn't see those values or even know that the function it's
+//   calling.
+//
+//   void MyFunc(int i, const std::string& str) {}
+//   base::Callback<void()> cb = base::Bind(&MyFunc, 23, "hello world");
+//   cb.Run();
+//
+//   A callback with no unbound input parameters (base::Callback<void()>)
+//   is called a base::Closure. So we could have also written:
+//
+//   base::Closure cb = base::Bind(&MyFunc, 23, "hello world");
+//
+//   When calling member functions, bound parameters just go after the object
+//   pointer.
+//
+//   base::Closure cb = base::Bind(&MyClass::MyFunc, this, 23, "hello world");
+//
+// PARTIAL BINDING OF PARAMETERS
+//
+//   You can specify some parameters when you create the callback, and specify
+//   the rest when you execute the callback.
+//
+//   void MyFunc(int i, const std::string& str) {}
+//   base::Callback<void(const std::string&)> cb = base::Bind(&MyFunc, 23);
+//   cb.Run("hello world");
+//
+//   When calling a function bound parameters are first, followed by unbound
+//   parameters.
+//
+//
+// -----------------------------------------------------------------------------
+// Quick reference for advanced binding
+// -----------------------------------------------------------------------------
+//
+// BINDING A CLASS METHOD WITH WEAK POINTERS
+//
+//   base::Bind(&MyClass::Foo, GetWeakPtr());
+//
+//   The callback will not be run if the object has already been destroyed.
+//   DANGER: weak pointers are not threadsafe, so don't use this
+//   when passing between threads!
+//
+// BINDING A CLASS METHOD WITH MANUAL LIFETIME MANAGEMENT
+//
+//   base::Bind(&MyClass::Foo, base::Unretained(this));
+//
+//   This disables all lifetime management on the object. You're responsible
+//   for making sure the object is alive at the time of the call. You break it,
+//   you own it!
+//
+// BINDING A CLASS METHOD AND HAVING THE CALLBACK OWN THE CLASS
+//
+//   MyClass* myclass = new MyClass;
+//   base::Bind(&MyClass::Foo, base::Owned(myclass));
+//
+//   The object will be deleted when the callback is destroyed, even if it's
+//   not run (like if you post a task during shutdown). Potentially useful for
+//   "fire and forget" cases.
+//
+// IGNORING RETURN VALUES
+//
+//   Sometimes you want to call a function that returns a value in a callback
+//   that doesn't expect a return value.
+//
+//   int DoSomething(int arg) { cout << arg << endl; }
+//   base::Callback<void(int)> cb =
+//       base::Bind(base::IgnoreResult(&DoSomething));
+//
+//
+// -----------------------------------------------------------------------------
+// Quick reference for binding parameters to Bind()
 // -----------------------------------------------------------------------------
 //
-// See //docs/callback.md for documentation.
+// Bound parameters are specified as arguments to Bind() and are passed to the
+// function. A callback with no parameters or no unbound parameters is called a
+// Closure (base::Callback<void()> and base::Closure are the same thing).
+//
+// PASSING PARAMETERS OWNED BY THE CALLBACK
+//
+//   void Foo(int* arg) { cout << *arg << endl; }
+//   int* pn = new int(1);
+//   base::Closure foo_callback = base::Bind(&foo, base::Owned(pn));
+//
+//   The parameter will be deleted when the callback is destroyed, even if it's
+//   not run (like if you post a task during shutdown).
+//
+// PASSING PARAMETERS AS A scoped_ptr
+//
+//   void TakesOwnership(scoped_ptr<Foo> arg) {}
+//   scoped_ptr<Foo> f(new Foo);
+//   // f becomes null during the following call.
+//   base::Closure cb = base::Bind(&TakesOwnership, base::Passed(&f));
+//
+//   Ownership of the parameter will be with the callback until the it is run,
+//   when ownership is passed to the callback function. This means the callback
+//   can only be run once. If the callback is never run, it will delete the
+//   object when it's destroyed.
+//
+// PASSING PARAMETERS AS A scoped_refptr
+//
+//   void TakesOneRef(scoped_refptr<Foo> arg) {}
+//   scoped_refptr<Foo> f(new Foo)
+//   base::Closure cb = base::Bind(&TakesOneRef, f);
+//
+//   This should "just work." The closure will take a reference as long as it
+//   is alive, and another reference will be taken for the called function.
+//
+// PASSING PARAMETERS BY REFERENCE
+//
+//   Const references are *copied* unless ConstRef is used. Example:
+//
+//   void foo(const int& arg) { printf("%d %p\n", arg, &arg); }
+//   int n = 1;
+//   base::Closure has_copy = base::Bind(&foo, n);
+//   base::Closure has_ref = base::Bind(&foo, base::ConstRef(n));
+//   n = 2;
+//   foo(n);                        // Prints "2 0xaaaaaaaaaaaa"
+//   has_copy.Run();                // Prints "1 0xbbbbbbbbbbbb"
+//   has_ref.Run();                 // Prints "2 0xaaaaaaaaaaaa"
+//
+//   Normally parameters are copied in the closure. DANGER: ConstRef stores a
+//   const reference instead, referencing the original parameter. This means
+//   that you must ensure the object outlives the callback!
+//
+//
+// -----------------------------------------------------------------------------
+// Implementation notes
+// -----------------------------------------------------------------------------
+//
+// WHERE IS THIS DESIGN FROM:
+//
+// The design Callback and Bind is heavily influenced by C++'s
+// tr1::function/tr1::bind, and by the "Google Callback" system used inside
+// Google.
+//
+//
+// HOW THE IMPLEMENTATION WORKS:
+//
+// There are three main components to the system:
+//   1) The Callback classes.
+//   2) The Bind() functions.
+//   3) The arguments wrappers (e.g., Unretained() and ConstRef()).
+//
+// The Callback classes represent a generic function pointer. Internally,
+// it stores a refcounted piece of state that represents the target function
+// and all its bound parameters.  Each Callback specialization has a templated
+// constructor that takes an BindState<>*.  In the context of the constructor,
+// the static type of this BindState<> pointer uniquely identifies the
+// function it is representing, all its bound parameters, and a Run() method
+// that is capable of invoking the target.
+//
+// Callback's constructor takes the BindState<>* that has the full static type
+// and erases the target function type as well as the types of the bound
+// parameters.  It does this by storing a pointer to the specific Run()
+// function, and upcasting the state of BindState<>* to a
+// BindStateBase*. This is safe as long as this BindStateBase pointer
+// is only used with the stored Run() pointer.
+//
+// To BindState<> objects are created inside the Bind() functions.
+// These functions, along with a set of internal templates, are responsible for
+//
+//  - Unwrapping the function signature into return type, and parameters
+//  - Determining the number of parameters that are bound
+//  - Creating the BindState storing the bound parameters
+//  - Performing compile-time asserts to avoid error-prone behavior
+//  - Returning an Callback<> with an arity matching the number of unbound
+//    parameters and that knows the correct refcounting semantics for the
+//    target object if we are binding a method.
+//
+// The Bind functions do the above using type-inference, and template
+// specializations.
+//
+// By default Bind() will store copies of all bound parameters, and attempt
+// to refcount a target object if the function being bound is a class method.
+// These copies are created even if the function takes parameters as const
+// references. (Binding to non-const references is forbidden, see bind.h.)
+//
+// To change this behavior, we introduce a set of argument wrappers
+// (e.g., Unretained(), and ConstRef()).  These are simple container templates
+// that are passed by value, and wrap a pointer to argument.  See the
+// file-level comment in base/bind_helpers.h for more info.
+//
+// These types are passed to the Unwrap() functions, and the MaybeRefcount()
+// functions respectively to modify the behavior of Bind().  The Unwrap()
+// and MaybeRefcount() functions change behavior by doing partial
+// specialization based on whether or not a parameter is a wrapper type.
+//
+// ConstRef() is similar to tr1::cref.  Unretained() is specific to Chromium.
+//
+//
+// WHY NOT TR1 FUNCTION/BIND?
+//
+// Direct use of tr1::function and tr1::bind was considered, but ultimately
+// rejected because of the number of copy constructors invocations involved
+// in the binding of arguments during construction, and the forwarding of
+// arguments during invocation.  These copies will no longer be an issue in
+// C++0x because C++0x will support rvalue reference allowing for the compiler
+// to avoid these copies.  However, waiting for C++0x is not an option.
+//
+// Measured with valgrind on gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5), the
+// tr1::bind call itself will invoke a non-trivial copy constructor three times
+// for each bound parameter.  Also, each when passing a tr1::function, each
+// bound argument will be copied again.
+//
+// In addition to the copies taken at binding and invocation, copying a
+// tr1::function causes a copy to be made of all the bound parameters and
+// state.
+//
+// Furthermore, in Chromium, it is desirable for the Callback to take a
+// reference on a target object when representing a class method call.  This
+// is not supported by tr1.
+//
+// Lastly, tr1::function and tr1::bind has a more general and flexible API.
+// This includes things like argument reordering by use of
+// tr1::bind::placeholder, support for non-const reference parameters, and some
+// limited amount of subtyping of the tr1::function object (e.g.,
+// tr1::function<int(int)> is convertible to tr1::function<void(int)>).
+//
+// These are not features that are required in Chromium. Some of them, such as
+// allowing for reference parameters, and subtyping of functions, may actually
+// become a source of errors. Removing support for these features actually
+// allows for a simpler implementation, and a terser Currying API.
+//
+//
+// WHY NOT GOOGLE CALLBACKS?
+//
+// The Google callback system also does not support refcounting.  Furthermore,
+// its implementation has a number of strange edge cases with respect to type
+// conversion of its arguments.  In particular, the argument's constness must
+// at times match exactly the function signature, or the type-inference might
+// break.  Given the above, writing a custom solution was easier.
+//
+//
+// MISSING FUNCTIONALITY
+//  - Invoking the return of Bind.  Bind(&foo).Run() does not work;
+//  - Binding arrays to functions that take a non-const pointer.
+//    Example:
+//      void Foo(const char* ptr);
+//      void Bar(char* ptr);
+//      Bind(&Foo, "test");
+//      Bind(&Bar, "test");  // This fails because ptr is not const.
 
 namespace base {
 
-namespace internal {
-
-// RunMixin provides different variants of `Run()` function to `Callback<>`
-// based on the type of callback.
-template <typename CallbackType>
-class RunMixin;
-
-// Specialization for OnceCallback.
-template <typename R, typename... Args>
-class RunMixin<Callback<R(Args...), CopyMode::MoveOnly, RepeatMode::Once>> {
- private:
-  using CallbackType =
-      Callback<R(Args...), CopyMode::MoveOnly, RepeatMode::Once>;
-
- public:
-  using PolymorphicInvoke = R(*)(internal::BindStateBase*, Args&&...);
+// First, we forward declare the Callback class template. This informs the
+// compiler that the template only has 1 type parameter which is the function
+// signature that the Callback is representing.
+//
+// After this, create template specializations for 0-7 parameters. Note that
+// even though the template typelist grows, the specialization still
+// only has one type: the function signature.
+//
+// If you are thinking of forward declaring Callback in your own header file,
+// please include "base/callback_forward.h" instead.
 
-  R Run(Args... args) && {
-    // Move the callback instance into a local variable before the invocation,
-    // that ensures the internal state is cleared after the invocation.
-    // It's not safe to touch |this| after the invocation, since running the
-    // bound function may destroy |this|.
-    CallbackType cb = static_cast<CallbackType&&>(*this);
-    PolymorphicInvoke f =
-        reinterpret_cast<PolymorphicInvoke>(cb.polymorphic_invoke());
-    return f(cb.bind_state_.get(), std::forward<Args>(args)...);
-  }
-};
-
-// Specialization for RepeatingCallback.
-template <typename R, typename... Args, CopyMode copy_mode>
-class RunMixin<Callback<R(Args...), copy_mode, RepeatMode::Repeating>> {
- private:
-  using CallbackType = Callback<R(Args...), copy_mode, RepeatMode::Repeating>;
-
- public:
-  using PolymorphicInvoke = R(*)(internal::BindStateBase*, Args&&...);
-
-  R Run(Args... args) const {
-    const CallbackType& cb = static_cast<const CallbackType&>(*this);
-    PolymorphicInvoke f =
-        reinterpret_cast<PolymorphicInvoke>(cb.polymorphic_invoke());
-    return f(cb.bind_state_.get(), std::forward<Args>(args)...);
-  }
-};
-
-template <typename From, typename To>
-struct IsCallbackConvertible : std::false_type {};
-
-template <typename Signature>
-struct IsCallbackConvertible<
-  Callback<Signature, CopyMode::Copyable, RepeatMode::Repeating>,
-  Callback<Signature, CopyMode::MoveOnly, RepeatMode::Once>> : std::true_type {
-};
-
+namespace internal {
+template <typename Runnable, typename RunType, typename... BoundArgsType>
+struct BindState;
 }  // namespace internal
 
-template <typename R,
-          typename... Args,
-          internal::CopyMode copy_mode,
-          internal::RepeatMode repeat_mode>
-class Callback<R(Args...), copy_mode, repeat_mode>
-    : public internal::CallbackBase<copy_mode>,
-      public internal::RunMixin<Callback<R(Args...), copy_mode, repeat_mode>> {
+template <typename R, typename... Args>
+class Callback<R(Args...)> : public internal::CallbackBase {
  public:
-  static_assert(repeat_mode != internal::RepeatMode::Once ||
-                copy_mode == internal::CopyMode::MoveOnly,
-                "OnceCallback must be MoveOnly.");
+  // MSVC 2013 doesn't support Type Alias of function types.
+  // Revisit this after we update it to newer version.
+  typedef R RunType(Args...);
 
-  using RunType = R(Args...);
-
-  Callback() : internal::CallbackBase<copy_mode>(nullptr) {}
+  Callback() : CallbackBase(nullptr) { }
 
-  explicit Callback(internal::BindStateBase* bind_state)
-      : internal::CallbackBase<copy_mode>(bind_state) {
-  }
-
-  template <typename OtherCallback,
-            typename = typename std::enable_if<
-                internal::IsCallbackConvertible<OtherCallback, Callback>::value
-            >::type>
-  Callback(OtherCallback other)
-      : internal::CallbackBase<copy_mode>(std::move(other)) {}
-
-  template <typename OtherCallback,
-            typename = typename std::enable_if<
-                internal::IsCallbackConvertible<OtherCallback, Callback>::value
-            >::type>
-  Callback& operator=(OtherCallback other) {
-    static_cast<internal::CallbackBase<copy_mode>&>(*this) = std::move(other);
-    return *this;
+  template <typename Runnable, typename BindRunType, typename... BoundArgsType>
+  explicit Callback(
+      internal::BindState<Runnable, BindRunType, BoundArgsType...>* bind_state)
+      : CallbackBase(bind_state) {
+    // Force the assignment to a local variable of PolymorphicInvoke
+    // so the compiler will typecheck that the passed in Run() method has
+    // the correct type.
+    PolymorphicInvoke invoke_func =
+        &internal::BindState<Runnable, BindRunType, BoundArgsType...>
+            ::InvokerType::Run;
+    polymorphic_invoke_ = reinterpret_cast<InvokeFuncStorage>(invoke_func);
   }
 
   bool Equals(const Callback& other) const {
-    return this->EqualsInternal(other);
+    return CallbackBase::Equals(other);
   }
 
-  friend class internal::RunMixin<Callback>;
+  R Run(typename internal::CallbackParamTraits<Args>::ForwardType... args)
+      const {
+    PolymorphicInvoke f =
+        reinterpret_cast<PolymorphicInvoke>(polymorphic_invoke_);
+
+    return f(bind_state_.get(), internal::CallbackForward(args)...);
+  }
+
+ private:
+  using PolymorphicInvoke =
+      R(*)(internal::BindStateBase*,
+           typename internal::CallbackParamTraits<Args>::ForwardType...);
 };
 
 }  // namespace base
 
 #endif  // BASE_CALLBACK_H_
--- a/security/sandbox/chromium/base/callback_forward.h
+++ b/security/sandbox/chromium/base/callback_forward.h
@@ -1,48 +1,19 @@
 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_CALLBACK_FORWARD_H_
 #define BASE_CALLBACK_FORWARD_H_
 
 namespace base {
-namespace internal {
 
-// CopyMode is used to control the copyablity of a Callback.
-// MoveOnly indicates the Callback is not copyable but movable, and Copyable
-// indicates it is copyable and movable.
-enum class CopyMode {
-  MoveOnly,
-  Copyable,
-};
-
-enum class RepeatMode {
-  Once,
-  Repeating,
-};
-
-}  // namespace internal
-
-template <typename Signature,
-          internal::CopyMode copy_mode = internal::CopyMode::Copyable,
-          internal::RepeatMode repeat_mode = internal::RepeatMode::Repeating>
+template <typename Sig>
 class Callback;
 
 // Syntactic sugar to make Callback<void()> easier to declare since it
 // will be used in a lot of APIs with delayed execution.
 using Closure = Callback<void()>;
 
-template <typename Signature>
-using OnceCallback = Callback<Signature,
-                              internal::CopyMode::MoveOnly,
-                              internal::RepeatMode::Once>;
-template <typename Signature>
-using RepeatingCallback = Callback<Signature,
-                                   internal::CopyMode::Copyable,
-                                   internal::RepeatMode::Repeating>;
-using OnceClosure = OnceCallback<void()>;
-using RepeatingClosure = RepeatingCallback<void()>;
-
 }  // namespace base
 
 #endif  // BASE_CALLBACK_FORWARD_H_
--- a/security/sandbox/chromium/base/callback_internal.cc
+++ b/security/sandbox/chromium/base/callback_internal.cc
@@ -4,99 +4,43 @@
 
 #include "base/callback_internal.h"
 
 #include "base/logging.h"
 
 namespace base {
 namespace internal {
 
-namespace {
-
-bool ReturnFalse(const BindStateBase*) {
-  return false;
-}
-
-}  // namespace
-
-BindStateBase::BindStateBase(InvokeFuncStorage polymorphic_invoke,
-                             void (*destructor)(const BindStateBase*))
-    : BindStateBase(polymorphic_invoke, destructor, &ReturnFalse) {
-}
-
-BindStateBase::BindStateBase(InvokeFuncStorage polymorphic_invoke,
-                             void (*destructor)(const BindStateBase*),
-                             bool (*is_cancelled)(const BindStateBase*))
-    : polymorphic_invoke_(polymorphic_invoke),
-      ref_count_(0),
-      destructor_(destructor),
-      is_cancelled_(is_cancelled) {}
-
-void BindStateBase::AddRef() const {
+void BindStateBase::AddRef() {
   AtomicRefCountInc(&ref_count_);
 }
 
-void BindStateBase::Release() const {
+void BindStateBase::Release() {
   if (!AtomicRefCountDec(&ref_count_))
     destructor_(this);
 }
 
-CallbackBase<CopyMode::MoveOnly>::CallbackBase(CallbackBase&& c) = default;
-
-CallbackBase<CopyMode::MoveOnly>&
-CallbackBase<CopyMode::MoveOnly>::operator=(CallbackBase&& c) = default;
+CallbackBase::CallbackBase(const CallbackBase& c) = default;
+CallbackBase& CallbackBase::operator=(const CallbackBase& c) = default;
 
-CallbackBase<CopyMode::MoveOnly>::CallbackBase(
-    const CallbackBase<CopyMode::Copyable>& c)
-    : bind_state_(c.bind_state_) {}
-
-CallbackBase<CopyMode::MoveOnly>& CallbackBase<CopyMode::MoveOnly>::operator=(
-    const CallbackBase<CopyMode::Copyable>& c) {
-  bind_state_ = c.bind_state_;
-  return *this;
+void CallbackBase::Reset() {
+  polymorphic_invoke_ = NULL;
+  // NULL the bind_state_ last, since it may be holding the last ref to whatever
+  // object owns us, and we may be deleted after that.
+  bind_state_ = NULL;
 }
 
-void CallbackBase<CopyMode::MoveOnly>::Reset() {
-  // NULL the bind_state_ last, since it may be holding the last ref to whatever
-  // object owns us, and we may be deleted after that.
-  bind_state_ = nullptr;
+bool CallbackBase::Equals(const CallbackBase& other) const {
+  return bind_state_.get() == other.bind_state_.get() &&
+         polymorphic_invoke_ == other.polymorphic_invoke_;
 }
 
-bool CallbackBase<CopyMode::MoveOnly>::IsCancelled() const {
-  DCHECK(bind_state_);
-  return bind_state_->IsCancelled();
-}
-
-bool CallbackBase<CopyMode::MoveOnly>::EqualsInternal(
-    const CallbackBase& other) const {
-  return bind_state_ == other.bind_state_;
-}
-
-CallbackBase<CopyMode::MoveOnly>::CallbackBase(
-    BindStateBase* bind_state)
-    : bind_state_(bind_state) {
+CallbackBase::CallbackBase(BindStateBase* bind_state)
+    : bind_state_(bind_state),
+      polymorphic_invoke_(NULL) {
   DCHECK(!bind_state_.get() || bind_state_->ref_count_ == 1);
 }
 
-CallbackBase<CopyMode::MoveOnly>::~CallbackBase() {}
-
-CallbackBase<CopyMode::Copyable>::CallbackBase(
-    const CallbackBase& c)
-    : CallbackBase<CopyMode::MoveOnly>(nullptr) {
-  bind_state_ = c.bind_state_;
+CallbackBase::~CallbackBase() {
 }
 
-CallbackBase<CopyMode::Copyable>::CallbackBase(CallbackBase&& c) = default;
-
-CallbackBase<CopyMode::Copyable>&
-CallbackBase<CopyMode::Copyable>::operator=(const CallbackBase& c) {
-  bind_state_ = c.bind_state_;
-  return *this;
-}
-
-CallbackBase<CopyMode::Copyable>&
-CallbackBase<CopyMode::Copyable>::operator=(CallbackBase&& c) = default;
-
-template class CallbackBase<CopyMode::MoveOnly>;
-template class CallbackBase<CopyMode::Copyable>;
-
 }  // namespace internal
 }  // namespace base
--- a/security/sandbox/chromium/base/callback_internal.h
+++ b/security/sandbox/chromium/base/callback_internal.h
@@ -3,137 +3,232 @@
 // found in the LICENSE file.
 
 // This file contains utility functions and classes that help the
 // implementation, and management of the Callback objects.
 
 #ifndef BASE_CALLBACK_INTERNAL_H_
 #define BASE_CALLBACK_INTERNAL_H_
 
+#include <stddef.h>
+#include <memory>
+#include <type_traits>
+
 #include "base/atomic_ref_count.h"
 #include "base/base_export.h"
-#include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/template_util.h"
 
 namespace base {
 namespace internal {
-template <CopyMode copy_mode>
 class CallbackBase;
 
 // BindStateBase is used to provide an opaque handle that the Callback
 // class can use to represent a function object with bound arguments.  It
 // behaves as an existential type that is used by a corresponding
 // DoInvoke function to perform the function execution.  This allows
 // us to shield the Callback class from the types of the bound argument via
 // "type erasure."
 // At the base level, the only task is to add reference counting data. Don't use
 // RefCountedThreadSafe since it requires the destructor to be a virtual method.
 // Creating a vtable for every BindState template instantiation results in a lot
 // of bloat. Its only task is to call the destructor which can be done with a
 // function pointer.
-class BASE_EXPORT BindStateBase {
- public:
-  using InvokeFuncStorage = void(*)();
-
+class BindStateBase {
  protected:
-  BindStateBase(InvokeFuncStorage polymorphic_invoke,
-                void (*destructor)(const BindStateBase*));
-  BindStateBase(InvokeFuncStorage polymorphic_invoke,
-                void (*destructor)(const BindStateBase*),
-                bool (*is_cancelled)(const BindStateBase*));
+  explicit BindStateBase(void (*destructor)(BindStateBase*))
+      : ref_count_(0), destructor_(destructor) {}
   ~BindStateBase() = default;
 
  private:
   friend class scoped_refptr<BindStateBase>;
-  template <CopyMode copy_mode>
   friend class CallbackBase;
 
-  bool IsCancelled() const {
-    return is_cancelled_(this);
-  }
-
-  void AddRef() const;
-  void Release() const;
+  void AddRef();
+  void Release();
 
-  // In C++, it is safe to cast function pointers to function pointers of
-  // another type. It is not okay to use void*. We create a InvokeFuncStorage
-  // that that can store our function pointer, and then cast it back to
-  // the original type on usage.
-  InvokeFuncStorage polymorphic_invoke_;
-
-  mutable AtomicRefCount ref_count_;
+  AtomicRefCount ref_count_;
 
   // Pointer to a function that will properly destroy |this|.
-  void (*destructor_)(const BindStateBase*);
-  bool (*is_cancelled_)(const BindStateBase*);
+  void (*destructor_)(BindStateBase*);
 
   DISALLOW_COPY_AND_ASSIGN(BindStateBase);
 };
 
 // Holds the Callback methods that don't require specialization to reduce
 // template bloat.
-// CallbackBase<MoveOnly> is a direct base class of MoveOnly callbacks, and
-// CallbackBase<Copyable> uses CallbackBase<MoveOnly> for its implementation.
-template <>
-class BASE_EXPORT CallbackBase<CopyMode::MoveOnly> {
+class BASE_EXPORT CallbackBase {
  public:
-  CallbackBase(CallbackBase&& c);
-  CallbackBase& operator=(CallbackBase&& c);
-
-  explicit CallbackBase(const CallbackBase<CopyMode::Copyable>& c);
-  CallbackBase& operator=(const CallbackBase<CopyMode::Copyable>& c);
+  CallbackBase(const CallbackBase& c);
+  CallbackBase& operator=(const CallbackBase& c);
 
   // Returns true if Callback is null (doesn't refer to anything).
   bool is_null() const { return bind_state_.get() == NULL; }
-  explicit operator bool() const { return !is_null(); }
-
-  // Returns true if the callback invocation will be nop due to an cancellation.
-  // It's invalid to call this on uninitialized callback.
-  bool IsCancelled() const;
 
   // Returns the Callback into an uninitialized state.
   void Reset();
 
  protected:
-  using InvokeFuncStorage = BindStateBase::InvokeFuncStorage;
+  // In C++, it is safe to cast function pointers to function pointers of
+  // another type. It is not okay to use void*. We create a InvokeFuncStorage
+  // that that can store our function pointer, and then cast it back to
+  // the original type on usage.
+  using InvokeFuncStorage = void(*)();
 
   // Returns true if this callback equals |other|. |other| may be null.
-  bool EqualsInternal(const CallbackBase& other) const;
+  bool Equals(const CallbackBase& other) const;
 
   // Allow initializing of |bind_state_| via the constructor to avoid default
-  // initialization of the scoped_refptr.
+  // initialization of the scoped_refptr.  We do not also initialize
+  // |polymorphic_invoke_| here because doing a normal assignment in the
+  // derived Callback templates makes for much nicer compiler errors.
   explicit CallbackBase(BindStateBase* bind_state);
 
-  InvokeFuncStorage polymorphic_invoke() const {
-    return bind_state_->polymorphic_invoke_;
-  }
-
   // Force the destructor to be instantiated inside this translation unit so
   // that our subclasses will not get inlined versions.  Avoids more template
   // bloat.
   ~CallbackBase();
 
   scoped_refptr<BindStateBase> bind_state_;
+  InvokeFuncStorage polymorphic_invoke_;
+};
+
+// A helper template to determine if given type is non-const move-only-type,
+// i.e. if a value of the given type should be passed via std::move() in a
+// destructive way. Types are considered to be move-only if they have a
+// sentinel MoveOnlyTypeForCPP03 member: a class typically gets this from using
+// the DISALLOW_COPY_AND_ASSIGN_WITH_MOVE_FOR_BIND macro.
+// It would be easy to generalize this trait to all move-only types... but this
+// confuses template deduction in VS2013 with certain types such as
+// std::unique_ptr.
+// TODO(dcheng): Revisit this when Windows switches to VS2015 by default.
+template <typename T> struct IsMoveOnlyType {
+  template <typename U>
+  static YesType Test(const typename U::MoveOnlyTypeForCPP03*);
+
+  template <typename U>
+  static NoType Test(...);
+
+  static const bool value = sizeof((Test<T>(0))) == sizeof(YesType) &&
+                            !is_const<T>::value;
+};
+
+// Specialization of IsMoveOnlyType so that std::unique_ptr is still considered
+// move-only, even without the sentinel member.
+template <typename T>
+struct IsMoveOnlyType<std::unique_ptr<T>> : std::true_type {};
+
+template <typename>
+struct CallbackParamTraitsForMoveOnlyType;
+
+template <typename>
+struct CallbackParamTraitsForNonMoveOnlyType;
+
+// TODO(tzik): Use a default parameter once MSVS supports variadic templates
+// with default values.
+// http://connect.microsoft.com/VisualStudio/feedbackdetail/view/957801/compilation-error-with-variadic-templates
+//
+// This is a typetraits object that's used to take an argument type, and
+// extract a suitable type for storing and forwarding arguments.
+//
+// In particular, it strips off references, and converts arrays to
+// pointers for storage; and it avoids accidentally trying to create a
+// "reference of a reference" if the argument is a reference type.
+//
+// This array type becomes an issue for storage because we are passing bound
+// parameters by const reference. In this case, we end up passing an actual
+// array type in the initializer list which C++ does not allow.  This will
+// break passing of C-string literals.
+template <typename T>
+struct CallbackParamTraits
+    : std::conditional<IsMoveOnlyType<T>::value,
+         CallbackParamTraitsForMoveOnlyType<T>,
+         CallbackParamTraitsForNonMoveOnlyType<T>>::type {
+};
+
+template <typename T>
+struct CallbackParamTraitsForNonMoveOnlyType {
+  using ForwardType = const T&;
+  using StorageType = T;
 };
 
-// CallbackBase<Copyable> is a direct base class of Copyable Callbacks.
-template <>
-class BASE_EXPORT CallbackBase<CopyMode::Copyable>
-    : public CallbackBase<CopyMode::MoveOnly> {
- public:
-  CallbackBase(const CallbackBase& c);
-  CallbackBase(CallbackBase&& c);
-  CallbackBase& operator=(const CallbackBase& c);
-  CallbackBase& operator=(CallbackBase&& c);
- protected:
-  explicit CallbackBase(BindStateBase* bind_state)
-      : CallbackBase<CopyMode::MoveOnly>(bind_state) {}
-  ~CallbackBase() {}
+// The Storage should almost be impossible to trigger unless someone manually
+// specifies type of the bind parameters.  However, in case they do,
+// this will guard against us accidentally storing a reference parameter.
+//
+// The ForwardType should only be used for unbound arguments.
+template <typename T>
+struct CallbackParamTraitsForNonMoveOnlyType<T&> {
+  using ForwardType = T&;
+  using StorageType = T;
+};
+
+// Note that for array types, we implicitly add a const in the conversion. This
+// means that it is not possible to bind array arguments to functions that take
+// a non-const pointer. Trying to specialize the template based on a "const
+// T[n]" does not seem to match correctly, so we are stuck with this
+// restriction.
+template <typename T, size_t n>
+struct CallbackParamTraitsForNonMoveOnlyType<T[n]> {
+  using ForwardType = const T*;
+  using StorageType = const T*;
+};
+
+// See comment for CallbackParamTraits<T[n]>.
+template <typename T>
+struct CallbackParamTraitsForNonMoveOnlyType<T[]> {
+  using ForwardType = const T*;
+  using StorageType = const T*;
 };
 
-extern template class CallbackBase<CopyMode::MoveOnly>;
-extern template class CallbackBase<CopyMode::Copyable>;
+// Parameter traits for movable-but-not-copyable scopers.
+//
+// Callback<>/Bind() understands movable-but-not-copyable semantics where
+// the type cannot be copied but can still have its state destructively
+// transferred (aka. moved) to another instance of the same type by calling a
+// helper function.  When used with Bind(), this signifies transferal of the
+// object's state to the target function.
+//
+// For these types, the ForwardType must not be a const reference, or a
+// reference.  A const reference is inappropriate, and would break const
+// correctness, because we are implementing a destructive move.  A non-const
+// reference cannot be used with temporaries which means the result of a
+// function or a cast would not be usable with Callback<> or Bind().
+template <typename T>
+struct CallbackParamTraitsForMoveOnlyType {
+  using ForwardType = T;
+  using StorageType = T;
+};
+
+// CallbackForward() is a very limited simulation of C++11's std::forward()
+// used by the Callback/Bind system for a set of movable-but-not-copyable
+// types.  It is needed because forwarding a movable-but-not-copyable
+// argument to another function requires us to invoke the proper move
+// operator to create a rvalue version of the type.  The supported types are
+// whitelisted below as overloads of the CallbackForward() function. The
+// default template compiles out to be a no-op.
+//
+// In C++11, std::forward would replace all uses of this function.  However, it
+// is impossible to implement a general std::forward without C++11 due to a lack
+// of rvalue references.
+//
+// In addition to Callback/Bind, this is used by PostTaskAndReplyWithResult to
+// simulate std::forward() and forward the result of one Callback as a
+// parameter to another callback. This is to support Callbacks that return
+// the movable-but-not-copyable types whitelisted above.
+template <typename T>
+typename std::enable_if<!IsMoveOnlyType<T>::value, T>::type& CallbackForward(
+    T& t) {
+  return t;
+}
+
+template <typename T>
+typename std::enable_if<IsMoveOnlyType<T>::value, T>::type CallbackForward(
+    T& t) {
+  return std::move(t);
+}
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_CALLBACK_INTERNAL_H_
--- a/security/sandbox/chromium/base/compiler_specific.h
+++ b/security/sandbox/chromium/base/compiler_specific.h
@@ -95,24 +95,16 @@
 #if defined(COMPILER_GCC)
 #define NOINLINE __attribute__((noinline))
 #elif defined(COMPILER_MSVC)
 #define NOINLINE __declspec(noinline)
 #else
 #define NOINLINE
 #endif
 
-#if COMPILER_GCC && defined(NDEBUG)
-#define ALWAYS_INLINE inline __attribute__((__always_inline__))
-#elif COMPILER_MSVC && defined(NDEBUG)
-#define ALWAYS_INLINE __forceinline
-#else
-#define ALWAYS_INLINE inline
-#endif
-
 // Specify memory alignment for structs, classes, etc.
 // Use like:
 //   class ALIGNAS(16) MyClass { ... }
 //   ALIGNAS(16) int array[4];
 #if defined(COMPILER_MSVC)
 #define ALIGNAS(byte_alignment) __declspec(align(byte_alignment))
 #elif defined(COMPILER_GCC)
 #define ALIGNAS(byte_alignment) __attribute__((aligned(byte_alignment)))
@@ -172,25 +164,16 @@
 // passing data to another process via shared memory.
 #define MSAN_CHECK_MEM_IS_INITIALIZED(p, size) \
     __msan_check_mem_is_initialized(p, size)
 #else  // MEMORY_SANITIZER
 #define MSAN_UNPOISON(p, size)
 #define MSAN_CHECK_MEM_IS_INITIALIZED(p, size)
 #endif  // MEMORY_SANITIZER
 
-// DISABLE_CFI_PERF -- Disable Control Flow Integrity for perf reasons.
-#if !defined(DISABLE_CFI_PERF)
-#if defined(__clang__) && defined(OFFICIAL_BUILD)
-#define DISABLE_CFI_PERF __attribute__((no_sanitize("cfi")))
-#else
-#define DISABLE_CFI_PERF
-#endif
-#endif
-
 // Macro useful for writing cross-platform function pointers.
 #if !defined(CDECL)
 #if defined(OS_WIN)
 #define CDECL __cdecl
 #else  // defined(OS_WIN)
 #define CDECL
 #endif  // defined(OS_WIN)
 #endif  // !defined(CDECL)
@@ -199,25 +182,9 @@
 #if !defined(UNLIKELY)
 #if defined(COMPILER_GCC)
 #define UNLIKELY(x) __builtin_expect(!!(x), 0)
 #else
 #define UNLIKELY(x) (x)
 #endif  // defined(COMPILER_GCC)
 #endif  // !defined(UNLIKELY)
 
-#if !defined(LIKELY)
-#if defined(COMPILER_GCC)
-#define LIKELY(x) __builtin_expect((x), 1)
-#else
-#define LIKELY(x) (x)
-#endif  // defined(COMPILER_GCC)
-#endif  // !defined(LIKELY)
-
-// Compiler feature-detection.
-// clang.llvm.org/docs/LanguageExtensions.html#has-feature-and-has-extension
-#if defined(__has_feature)
-#define HAS_FEATURE(FEATURE) __has_feature(FEATURE)
-#else
-#define HAS_FEATURE(FEATURE) 0
-#endif
-
 #endif  // BASE_COMPILER_SPECIFIC_H_
deleted file mode 100644
--- a/security/sandbox/chromium/base/containers/adapters.h
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_CONTAINERS_ADAPTERS_H_
-#define BASE_CONTAINERS_ADAPTERS_H_
-
-#include <stddef.h>
-
-#include <iterator>
-
-#include "base/macros.h"
-
-namespace base {
-
-namespace internal {
-
-// Internal adapter class for implementing base::Reversed.
-template <typename T>
-class ReversedAdapter {
- public:
-  using Iterator = decltype(static_cast<T*>(nullptr)->rbegin());
-
-  explicit ReversedAdapter(T& t) : t_(t) {}
-  ReversedAdapter(const ReversedAdapter& ra) : t_(ra.t_) {}
-
-  // TODO(mdempsky): Once we can use C++14 library features, use std::rbegin
-  // and std::rend instead, so we can remove the specialization below.
-  Iterator begin() const { return t_.rbegin(); }
-  Iterator end() const { return t_.rend(); }
-
- private:
-  T& t_;
-
-  DISALLOW_ASSIGN(ReversedAdapter);
-};
-
-template <typename T, size_t N>
-class ReversedAdapter<T[N]> {
- public:
-  using Iterator = std::reverse_iterator<T*>;
-
-  explicit ReversedAdapter(T (&t)[N]) : t_(t) {}
-  ReversedAdapter(const ReversedAdapter& ra) : t_(ra.t_) {}
-
-  Iterator begin() const { return Iterator(&t_[N]); }
-  Iterator end() const { return Iterator(&t_[0]); }
-
- private:
-  T (&t_)[N];
-
-  DISALLOW_ASSIGN(ReversedAdapter);
-};
-
-}  // namespace internal
-
-// Reversed returns a container adapter usable in a range-based "for" statement
-// for iterating a reversible container in reverse order.
-//
-// Example:
-//
-//   std::vector<int> v = ...;
-//   for (int i : base::Reversed(v)) {
-//     // iterates through v from back to front
-//   }
-template <typename T>
-internal::ReversedAdapter<T> Reversed(T& t) {
-  return internal::ReversedAdapter<T>(t);
-}
-
-}  // namespace base
-
-#endif  // BASE_CONTAINERS_ADAPTERS_H_
--- a/security/sandbox/chromium/base/containers/hash_tables.h
+++ b/security/sandbox/chromium/base/containers/hash_tables.h
@@ -1,75 +1,281 @@
 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+
+//
+// Deal with the differences between Microsoft and GNU implemenations
+// of hash_map. Allows all platforms to use |base::hash_map| and
+// |base::hash_set|.
+//  eg:
+//   base::hash_map<int> my_map;
+//   base::hash_set<int> my_set;
+//
+// NOTE: It is an explicit non-goal of this class to provide a generic hash
+// function for pointers.  If you want to hash a pointers to a particular class,
+// please define the template specialization elsewhere (for example, in its
+// header file) and keep it specific to just pointers to that class.  This is
+// because identity hashes are not desirable for all types that might show up
+// in containers as pointers.
 
 #ifndef BASE_CONTAINERS_HASH_TABLES_H_
 #define BASE_CONTAINERS_HASH_TABLES_H_
 
-#include <cstddef>
-#include <unordered_map>
-#include <unordered_set>
+#include <stddef.h>
+#include <stdint.h>
+
 #include <utility>
 
-#include "base/hash.h"
+#include "base/strings/string16.h"
+#include "build/build_config.h"
+
+#if defined(COMPILER_MSVC)
+#include <unordered_map>
+#include <unordered_set>
+
+#define BASE_HASH_NAMESPACE std
+
+#elif defined(COMPILER_GCC)
+
+#define BASE_HASH_NAMESPACE base_hash
 
-// This header file is deprecated. Use the corresponding C++11 type
-// instead. https://crbug.com/576864
+// This is a hack to disable the gcc 4.4 warning about hash_map and hash_set
+// being deprecated.  We can get rid of this when we upgrade to VS2008 and we
+// can use <tr1/unordered_map> and <tr1/unordered_set>.
+#ifdef __DEPRECATED
+#define CHROME_OLD__DEPRECATED __DEPRECATED
+#undef __DEPRECATED
+#endif
 
-// Use a custom hasher instead.
-#define BASE_HASH_NAMESPACE base_hash
+#include <ext/hash_map>
+#include <ext/hash_set>
+#define BASE_HASH_IMPL_NAMESPACE __gnu_cxx
+
+#include <string>
+
+#ifdef CHROME_OLD__DEPRECATED
+#define __DEPRECATED CHROME_OLD__DEPRECATED
+#undef CHROME_OLD__DEPRECATED
+#endif
 
 namespace BASE_HASH_NAMESPACE {
 
-// A separate hasher which, by default, forwards to std::hash. This is so legacy
-// uses of BASE_HASH_NAMESPACE with base::hash_map do not interfere with
-// std::hash mid-transition.
+// The pre-standard hash behaves like C++11's std::hash, except around pointers.
+// const char* is specialized to hash the C string and hash functions for
+// general T* are missing. Define a BASE_HASH_NAMESPACE::hash which aligns with
+// the C++11 behavior.
+
 template<typename T>
 struct hash {
-  std::size_t operator()(const T& value) const { return std::hash<T>()(value); }
+  std::size_t operator()(const T& value) const {
+    return BASE_HASH_IMPL_NAMESPACE::hash<T>()(value);
+  }
+};
+
+template<typename T>
+struct hash<T*> {
+  std::size_t operator()(T* value) const {
+    return BASE_HASH_IMPL_NAMESPACE::hash<uintptr_t>()(
+        reinterpret_cast<uintptr_t>(value));
+  }
 };
 
-// Use base::IntPairHash from base/hash.h as a custom hasher instead.
-template <typename Type1, typename Type2>
-struct hash<std::pair<Type1, Type2>> {
+// The GNU C++ library provides identity hash functions for many integral types,
+// but not for |long long|.  This hash function will truncate if |size_t| is
+// narrower than |long long|.  This is probably good enough for what we will
+// use it for.
+
+#define DEFINE_TRIVIAL_HASH(integral_type) \
+    template<> \
+    struct hash<integral_type> { \
+      std::size_t operator()(integral_type value) const { \
+        return static_cast<std::size_t>(value); \
+      } \
+    }
+
+DEFINE_TRIVIAL_HASH(long long);
+DEFINE_TRIVIAL_HASH(unsigned long long);
+
+#undef DEFINE_TRIVIAL_HASH
+
+// Implement string hash functions so that strings of various flavors can
+// be used as keys in STL maps and sets.  The hash algorithm comes from the
+// GNU C++ library, in <tr1/functional>.  It is duplicated here because GCC
+// versions prior to 4.3.2 are unable to compile <tr1/functional> when RTTI
+// is disabled, as it is in our build.
+
+#define DEFINE_STRING_HASH(string_type) \
+    template<> \
+    struct hash<string_type> { \
+      std::size_t operator()(const string_type& s) const { \
+        std::size_t result = 0; \
+        for (string_type::const_iterator i = s.begin(); i != s.end(); ++i) \
+          result = (result * 131) + *i; \
+        return result; \
+      } \
+    }
+
+DEFINE_STRING_HASH(std::string);
+DEFINE_STRING_HASH(base::string16);
+
+#undef DEFINE_STRING_HASH
+
+}  // namespace BASE_HASH_NAMESPACE
+
+#else  // COMPILER
+#error define BASE_HASH_NAMESPACE for your compiler
+#endif  // COMPILER
+
+namespace base {
+
+// On MSVC, use the C++11 containers.
+#if defined(COMPILER_MSVC)
+
+template<class Key, class T,
+         class Hash = std::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<std::pair<const Key, T>>>
+using hash_map = std::unordered_map<Key, T, Hash, Pred, Alloc>;
+
+template<class Key, class T,
+         class Hash = std::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<std::pair<const Key, T>>>
+using hash_multimap = std::unordered_multimap<Key, T, Hash, Pred, Alloc>;
+
+template<class Key,
+         class Hash = std::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<Key>>
+using hash_multiset = std::unordered_multiset<Key, Hash, Pred, Alloc>;
+
+template<class Key,
+         class Hash = std::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<Key>>
+using hash_set = std::unordered_set<Key, Hash, Pred, Alloc>;
+
+#else  // !COMPILER_MSVC
+
+// Otherwise, use the pre-standard ones, but override the default hash to match
+// C++11.
+template<class Key, class T,
+         class Hash = BASE_HASH_NAMESPACE::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<std::pair<const Key, T>>>
+using hash_map = BASE_HASH_IMPL_NAMESPACE::hash_map<Key, T, Hash, Pred, Alloc>;
+
+template<class Key, class T,
+         class Hash = BASE_HASH_NAMESPACE::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<std::pair<const Key, T>>>
+using hash_multimap =
+    BASE_HASH_IMPL_NAMESPACE::hash_multimap<Key, T, Hash, Pred, Alloc>;
+
+template<class Key,
+         class Hash = BASE_HASH_NAMESPACE::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<Key>>
+using hash_multiset =
+    BASE_HASH_IMPL_NAMESPACE::hash_multiset<Key, Hash, Pred, Alloc>;
+
+template<class Key,
+         class Hash = BASE_HASH_NAMESPACE::hash<Key>,
+         class Pred = std::equal_to<Key>,
+         class Alloc = std::allocator<Key>>
+using hash_set = BASE_HASH_IMPL_NAMESPACE::hash_set<Key, Hash, Pred, Alloc>;
+
+#undef BASE_HASH_IMPL_NAMESPACE
+
+#endif  // COMPILER_MSVC
+
+// Implement hashing for pairs of at-most 32 bit integer values.
+// When size_t is 32 bits, we turn the 64-bit hash code into 32 bits by using
+// multiply-add hashing. This algorithm, as described in
+// Theorem 4.3.3 of the thesis "Über die Komplexität der Multiplikation in
+// eingeschränkten Branchingprogrammmodellen" by Woelfel, is:
+//
+//   h32(x32, y32) = (h64(x32, y32) * rand_odd64 + rand16 * 2^16) % 2^64 / 2^32
+//
+// Contact danakj@chromium.org for any questions.
+inline std::size_t HashInts32(uint32_t value1, uint32_t value2) {
+  uint64_t value1_64 = value1;
+  uint64_t hash64 = (value1_64 << 32) | value2;
+
+  if (sizeof(std::size_t) >= sizeof(uint64_t))
+    return static_cast<std::size_t>(hash64);
+
+  uint64_t odd_random = 481046412LL << 32 | 1025306955LL;
+  uint32_t shift_random = 10121U << 16;
+
+  hash64 = hash64 * odd_random + shift_random;
+  std::size_t high_bits = static_cast<std::size_t>(
+      hash64 >> (8 * (sizeof(uint64_t) - sizeof(std::size_t))));
+  return high_bits;
+}
+
+// Implement hashing for pairs of up-to 64-bit integer values.
+// We use the compound integer hash method to produce a 64-bit hash code, by
+// breaking the two 64-bit inputs into 4 32-bit values:
+// http://opendatastructures.org/versions/edition-0.1d/ods-java/node33.html#SECTION00832000000000000000
+// Then we reduce our result to 32 bits if required, similar to above.
+inline std::size_t HashInts64(uint64_t value1, uint64_t value2) {
+  uint32_t short_random1 = 842304669U;
+  uint32_t short_random2 = 619063811U;
+  uint32_t short_random3 = 937041849U;
+  uint32_t short_random4 = 3309708029U;
+
+  uint32_t value1a = static_cast<uint32_t>(value1 & 0xffffffff);
+  uint32_t value1b = static_cast<uint32_t>((value1 >> 32) & 0xffffffff);
+  uint32_t value2a = static_cast<uint32_t>(value2 & 0xffffffff);
+  uint32_t value2b = static_cast<uint32_t>((value2 >> 32) & 0xffffffff);
+
+  uint64_t product1 = static_cast<uint64_t>(value1a) * short_random1;
+  uint64_t product2 = static_cast<uint64_t>(value1b) * short_random2;
+  uint64_t product3 = static_cast<uint64_t>(value2a) * short_random3;
+  uint64_t product4 = static_cast<uint64_t>(value2b) * short_random4;
+
+  uint64_t hash64 = product1 + product2 + product3 + product4;
+
+  if (sizeof(std::size_t) >= sizeof(uint64_t))
+    return static_cast<std::size_t>(hash64);
+
+  uint64_t odd_random = 1578233944LL << 32 | 194370989LL;
+  uint32_t shift_random = 20591U << 16;
+
+  hash64 = hash64 * odd_random + shift_random;
+  std::size_t high_bits = static_cast<std::size_t>(
+      hash64 >> (8 * (sizeof(uint64_t) - sizeof(std::size_t))));
+  return high_bits;
+}
+
+template<typename T1, typename T2>
+inline std::size_t HashPair(T1 value1, T2 value2) {
+  // This condition is expected to be compile-time evaluated and optimised away
+  // in release builds.
+  if (sizeof(T1) > sizeof(uint32_t) || (sizeof(T2) > sizeof(uint32_t)))
+    return HashInts64(value1, value2);
+
+  return HashInts32(value1, value2);
+}
+
+}  // namespace base
+
+namespace BASE_HASH_NAMESPACE {
+
+// Implement methods for hashing a pair of integers, so they can be used as
+// keys in STL containers.
+
+template<typename Type1, typename Type2>
+struct hash<std::pair<Type1, Type2> > {
   std::size_t operator()(std::pair<Type1, Type2> value) const {
-    return base::HashInts(value.first, value.second);
+    return base::HashPair(value.first, value.second);
   }
 };
 
 }  // namespace BASE_HASH_NAMESPACE
 
-namespace base {
-
-// Use std::unordered_map instead.
-template <class Key,
-          class T,
-          class Hash = BASE_HASH_NAMESPACE::hash<Key>,
-          class Pred = std::equal_to<Key>,
-          class Alloc = std::allocator<std::pair<const Key, T>>>
-using hash_map = std::unordered_map<Key, T, Hash, Pred, Alloc>;
-
-// Use std::unordered_multimap instead.
-template <class Key,
-          class T,
-          class Hash = BASE_HASH_NAMESPACE::hash<Key>,
-          class Pred = std::equal_to<Key>,
-          class Alloc = std::allocator<std::pair<const Key, T>>>
-using hash_multimap = std::unordered_multimap<Key, T, Hash, Pred, Alloc>;
-
-// Use std::unordered_multiset instead.
-template <class Key,
-          class Hash = BASE_HASH_NAMESPACE::hash<Key>,
-          class Pred = std::equal_to<Key>,
-          class Alloc = std::allocator<Key>>
-using hash_multiset = std::unordered_multiset<Key, Hash, Pred, Alloc>;
-
-// Use std::unordered_set instead.
-template <class Key,
-          class Hash = BASE_HASH_NAMESPACE::hash<Key>,
-          class Pred = std::equal_to<Key>,
-          class Alloc = std::allocator<Key>>
-using hash_set = std::unordered_set<Key, Hash, Pred, Alloc>;
-
-}  // namespace base
+#undef DEFINE_PAIR_HASH_FUNCTION_START
+#undef DEFINE_PAIR_HASH_FUNCTION_END
 
 #endif  // BASE_CONTAINERS_HASH_TABLES_H_
--- a/security/sandbox/chromium/base/cpu.cc
+++ b/security/sandbox/chromium/base/cpu.cc
@@ -2,21 +2,23 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/cpu.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include <algorithm>
 
 #include "base/macros.h"
+#include "base/strings/string_piece.h"
 #include "build/build_config.h"
 
 #if defined(ARCH_CPU_ARM_FAMILY) && (defined(OS_ANDROID) || defined(OS_LINUX))
 #include "base/files/file_util.h"
 #include "base/lazy_instance.h"
 #endif
 
 #if defined(ARCH_CPU_X86_FAMILY)
@@ -38,21 +40,21 @@ CPU::CPU()
     ext_family_(0),
     has_mmx_(false),
     has_sse_(false),
     has_sse2_(false),
     has_sse3_(false),
     has_ssse3_(false),
     has_sse41_(false),
     has_sse42_(false),
-    has_popcnt_(false),
     has_avx_(false),
     has_avx2_(false),
     has_aesni_(false),
     has_non_stop_time_stamp_counter_(false),
+    has_broken_neon_(false),
     cpu_vendor_("unknown") {
   Initialize();
 }
 
 namespace {
 
 #if defined(ARCH_CPU_X86_FAMILY)
 #ifndef _MSC_VER
@@ -92,47 +94,101 @@ uint64_t _xgetbv(uint32_t xcr) {
 }
 
 #endif  // !_MSC_VER
 #endif  // ARCH_CPU_X86_FAMILY
 
 #if defined(ARCH_CPU_ARM_FAMILY) && (defined(OS_ANDROID) || defined(OS_LINUX))
 class LazyCpuInfoValue {
  public:
-  LazyCpuInfoValue() {
+  LazyCpuInfoValue() : has_broken_neon_(false) {
     // This function finds the value from /proc/cpuinfo under the key "model
     // name" or "Processor". "model name" is used in Linux 3.8 and later (3.7
     // and later for arm64) and is shown once per CPU. "Processor" is used in
     // earler versions and is shown only once at the top of /proc/cpuinfo
     // regardless of the number CPUs.
     const char kModelNamePrefix[] = "model name\t: ";
     const char kProcessorPrefix[] = "Processor\t: ";
 
+    // This function also calculates whether we believe that this CPU has a
+    // broken NEON unit based on these fields from cpuinfo:
+    unsigned implementer = 0, architecture = 0, variant = 0, part = 0,
+             revision = 0;
+    const struct {
+      const char key[17];
+      unsigned int* result;
+    } kUnsignedValues[] = {
+      {"CPU implementer", &implementer},
+      {"CPU architecture", &architecture},
+      {"CPU variant", &variant},
+      {"CPU part", &part},
+      {"CPU revision", &revision},
+    };
+
     std::string contents;
     ReadFileToString(FilePath("/proc/cpuinfo"), &contents);
     DCHECK(!contents.empty());
     if (contents.empty()) {
       return;
     }
 
     std::istringstream iss(contents);
     std::string line;
     while (std::getline(iss, line)) {
       if (brand_.empty() &&
           (line.compare(0, strlen(kModelNamePrefix), kModelNamePrefix) == 0 ||
            line.compare(0, strlen(kProcessorPrefix), kProcessorPrefix) == 0)) {
         brand_.assign(line.substr(strlen(kModelNamePrefix)));
       }
+
+      for (size_t i = 0; i < arraysize(kUnsignedValues); i++) {
+        const char *key = kUnsignedValues[i].key;
+        const size_t len = strlen(key);
+
+        if (line.compare(0, len, key) == 0 &&
+            line.size() >= len + 1 &&
+            (line[len] == '\t' || line[len] == ' ' || line[len] == ':')) {
+          size_t colon_pos = line.find(':', len);
+          if (colon_pos == std::string::npos) {
+            continue;
+          }
+
+          const StringPiece line_sp(line);
+          StringPiece value_sp = line_sp.substr(colon_pos + 1);
+          while (!value_sp.empty() &&
+                 (value_sp[0] == ' ' || value_sp[0] == '\t')) {
+            value_sp = value_sp.substr(1);
+          }
+
+          // The string may have leading "0x" or not, so we use strtoul to
+          // handle that.
+          char* endptr;
+          std::string value(value_sp.as_string());
+          unsigned long int result = strtoul(value.c_str(), &endptr, 0);
+          if (*endptr == 0 && result <= UINT_MAX) {
+            *kUnsignedValues[i].result = result;
+          }
+        }
+      }
     }
+
+    has_broken_neon_ =
+      implementer == 0x51 &&
+      architecture == 7 &&
+      variant == 1 &&
+      part == 0x4d &&
+      revision == 0;
   }
 
   const std::string& brand() const { return brand_; }
+  bool has_broken_neon() const { return has_broken_neon_; }
 
  private:
   std::string brand_;
+  bool has_broken_neon_;
   DISALLOW_COPY_AND_ASSIGN(LazyCpuInfoValue);
 };
 
 base::LazyInstance<LazyCpuInfoValue>::Leaky g_lazy_cpuinfo =
     LAZY_INSTANCE_INITIALIZER;
 
 #endif  // defined(ARCH_CPU_ARM_FAMILY) && (defined(OS_ANDROID) ||
         // defined(OS_LINUX))
@@ -173,18 +229,16 @@ void CPU::Initialize() {
     ext_family_ = (cpu_info[0] >> 20) & 0xff;
     has_mmx_ =   (cpu_info[3] & 0x00800000) != 0;
     has_sse_ =   (cpu_info[3] & 0x02000000) != 0;
     has_sse2_ =  (cpu_info[3] & 0x04000000) != 0;
     has_sse3_ =  (cpu_info[2] & 0x00000001) != 0;
     has_ssse3_ = (cpu_info[2] & 0x00000200) != 0;
     has_sse41_ = (cpu_info[2] & 0x00080000) != 0;
     has_sse42_ = (cpu_info[2] & 0x00100000) != 0;
-    has_popcnt_ = (cpu_info[2] & 0x00800000) != 0;
-
     // AVX instructions will generate an illegal instruction exception unless
     //   a) they are supported by the CPU,
     //   b) XSAVE is supported by the CPU and
     //   c) XSAVE is enabled by the kernel.
     // See http://software.intel.com/en-us/blogs/2011/04/14/is-avx-enabled
     //
     // In addition, we have observed some crashes with the xgetbv instruction
     // even after following Intel's example code. (See crbug.com/375968.)
@@ -218,16 +272,17 @@ void CPU::Initialize() {
 
   const int parameter_containing_non_stop_time_stamp_counter = 0x80000007;
   if (max_parameter >= parameter_containing_non_stop_time_stamp_counter) {
     __cpuid(cpu_info, parameter_containing_non_stop_time_stamp_counter);
     has_non_stop_time_stamp_counter_ = (cpu_info[3] & (1 << 8)) != 0;
   }
 #elif defined(ARCH_CPU_ARM_FAMILY) && (defined(OS_ANDROID) || defined(OS_LINUX))
   cpu_brand_.assign(g_lazy_cpuinfo.Get().brand());
+  has_broken_neon_ = g_lazy_cpuinfo.Get().has_broken_neon();
 #endif
 }
 
 CPU::IntelMicroArchitecture CPU::GetIntelMicroArchitecture() const {
   if (has_avx2()) return AVX2;
   if (has_avx()) return AVX;
   if (has_sse42()) return SSE42;
   if (has_sse41()) return SSE41;
--- a/security/sandbox/chromium/base/cpu.h
+++ b/security/sandbox/chromium/base/cpu.h
@@ -41,23 +41,26 @@ class BASE_EXPORT CPU {
   int extended_family() const { return ext_family_; }
   bool has_mmx() const { return has_mmx_; }
   bool has_sse() const { return has_sse_; }
   bool has_sse2() const { return has_sse2_; }
   bool has_sse3() const { return has_sse3_; }
   bool has_ssse3() const { return has_ssse3_; }
   bool has_sse41() const { return has_sse41_; }
   bool has_sse42() const { return has_sse42_; }
-  bool has_popcnt() const { return has_popcnt_; }
   bool has_avx() const { return has_avx_; }
   bool has_avx2() const { return has_avx2_; }
   bool has_aesni() const { return has_aesni_; }
   bool has_non_stop_time_stamp_counter() const {
     return has_non_stop_time_stamp_counter_;
   }
+  // has_broken_neon is only valid on ARM chips. If true, it indicates that we
+  // believe that the NEON unit on the current CPU is flawed and cannot execute
+  // some code. See https://code.google.com/p/chromium/issues/detail?id=341598
+  bool has_broken_neon() const { return has_broken_neon_; }
 
   IntelMicroArchitecture GetIntelMicroArchitecture() const;
   const std::string& cpu_brand() const { return cpu_brand_; }
 
  private:
   // Query the processor for CPUID information.
   void Initialize();
 
@@ -70,20 +73,20 @@ class BASE_EXPORT CPU {
   int ext_family_;
   bool has_mmx_;
   bool has_sse_;
   bool has_sse2_;
   bool has_sse3_;
   bool has_ssse3_;
   bool has_sse41_;
   bool has_sse42_;
-  bool has_popcnt_;
   bool has_avx_;
   bool has_avx2_;
   bool has_aesni_;
   bool has_non_stop_time_stamp_counter_;
+  bool has_broken_neon_;
   std::string cpu_vendor_;
   std::string cpu_brand_;
 };
 
 }  // namespace base
 
 #endif  // BASE_CPU_H_
--- a/security/sandbox/chromium/base/debug/profiler.cc
+++ b/security/sandbox/chromium/base/debug/profiler.cc
@@ -8,17 +8,16 @@
 
 #include "base/debug/debugging_flags.h"
 #include "base/process/process_handle.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
-#include "base/win/current_module.h"
 #include "base/win/pe_image.h"
 #endif  // defined(OS_WIN)
 
 // TODO(peria): Enable profiling on Windows.
 #if BUILDFLAG(ENABLE_PROFILING) && !defined(NO_TCMALLOC) && !defined(OS_WIN)
 #include "third_party/tcmalloc/chromium/src/gperftools/profiler.h"
 #endif
 
@@ -52,20 +51,16 @@ void FlushProfiling() {
 bool BeingProfiled() {
   return ProfilingIsEnabledForAllThreads();
 }
 
 void RestartProfilingAfterFork() {
   ProfilerRegisterThread();
 }
 
-bool IsProfilingSupported() {
-  return true;
-}
-
 #else
 
 void StartProfiling(const std::string& name) {
 }
 
 void StopProfiling() {
 }
 
@@ -74,20 +69,16 @@ void FlushProfiling() {
 
 bool BeingProfiled() {
   return false;
 }
 
 void RestartProfilingAfterFork() {
 }
 
-bool IsProfilingSupported() {
-  return false;
-}
-
 #endif
 
 #if !defined(OS_WIN)
 
 bool IsBinaryInstrumented() {
   return false;
 }
 
@@ -104,27 +95,31 @@ AddDynamicSymbol GetProfilerAddDynamicSy
 }
 
 MoveDynamicSymbol GetProfilerMoveDynamicSymbolFunc() {
   return NULL;
 }
 
 #else  // defined(OS_WIN)
 
+// http://blogs.msdn.com/oldnewthing/archive/2004/10/25/247180.aspx
+extern "C" IMAGE_DOS_HEADER __ImageBase;
+
 bool IsBinaryInstrumented() {
   enum InstrumentationCheckState {
     UNINITIALIZED,
     INSTRUMENTED_IMAGE,
     NON_INSTRUMENTED_IMAGE,
   };
 
   static InstrumentationCheckState state = UNINITIALIZED;
 
   if (state == UNINITIALIZED) {
-    base::win::PEImage image(CURRENT_MODULE());
+    HMODULE this_module = reinterpret_cast<HMODULE>(&__ImageBase);
+    base::win::PEImage image(this_module);
 
     // Check to be sure our image is structured as we'd expect.
     DCHECK(image.VerifyMagic());
 
     // Syzygy-instrumented binaries contain a PE image section named ".thunks",
     // and all Syzygy-modified binaries contain the ".syzygy" image section.
     // This is a very fast check, as it only looks at the image header.
     if ((image.GetImageSectionHeaderByName(".thunks") != NULL) &&
@@ -149,18 +144,18 @@ struct FunctionSearchContext {
 // Callback function to PEImage::EnumImportChunks.
 bool FindResolutionFunctionInImports(
     const base::win::PEImage &image, const char* module_name,
     PIMAGE_THUNK_DATA unused_name_table, PIMAGE_THUNK_DATA import_address_table,
     PVOID cookie) {
   FunctionSearchContext* context =
       reinterpret_cast<FunctionSearchContext*>(cookie);
 
-  DCHECK(context);
-  DCHECK(!context->function);
+  DCHECK_NE(static_cast<FunctionSearchContext*>(NULL), context);
+  DCHECK_EQ(static_cast<FARPROC>(NULL), context->function);
 
   // Our import address table contains pointers to the functions we import
   // at this point. Let's retrieve the first such function and use it to
   // find the module this import was resolved to by the loader.
   const wchar_t* function_in_module =
       reinterpret_cast<const wchar_t*>(import_address_table->u1.Function);
 
   // Retrieve the module by a function in the module.
@@ -184,17 +179,18 @@ bool FindResolutionFunctionInImports(
   return true;
 }
 
 template <typename FunctionType>
 FunctionType FindFunctionInImports(const char* function_name) {
   if (!IsBinaryInstrumented())
     return NULL;
 
-  base::win::PEImage image(CURRENT_MODULE());
+  HMODULE this_module = reinterpret_cast<HMODULE>(&__ImageBase);
+  base::win::PEImage image(this_module);
 
   FunctionSearchContext ctx = { function_name, NULL };
   image.EnumImportChunks(FindResolutionFunctionInImports, &ctx);
 
   return reinterpret_cast<FunctionType>(ctx.function);
 }
 
 }  // namespace
--- a/security/sandbox/chromium/base/debug/profiler.h
+++ b/security/sandbox/chromium/base/debug/profiler.h
@@ -33,19 +33,16 @@ BASE_EXPORT void FlushProfiling();
 BASE_EXPORT bool BeingProfiled();
 
 // Reset profiling after a fork, which disables timers.
 BASE_EXPORT void RestartProfilingAfterFork();
 
 // Returns true iff this executable is instrumented with the Syzygy profiler.
 BASE_EXPORT bool IsBinaryInstrumented();
 
-// Returns true iff this executable supports profiling.
-BASE_EXPORT bool IsProfilingSupported();
-
 // There's a class of profilers that use "return address swizzling" to get a
 // hook on function exits. This class of profilers uses some form of entry hook,
 // like e.g. binary instrumentation, or a compiler flag, that calls a hook each
 // time a function is invoked. The hook then switches the return address on the
 // stack for the address of an exit hook function, and pushes the original
 // return address to a shadow stack of some type. When in due course the CPU
 // executes a return to the exit hook, the exit hook will do whatever work it
 // does on function exit, then arrange to return to the original return address.
deleted file mode 100644
--- a/security/sandbox/chromium/base/environment.h
+++ /dev/null
@@ -1,90 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_ENVIRONMENT_H_
-#define BASE_ENVIRONMENT_H_
-
-#include <map>
-#include <memory>
-#include <string>
-
-#include "base/base_export.h"
-#include "base/strings/string16.h"
-#include "base/strings/string_piece.h"
-#include "build/build_config.h"
-
-namespace base {
-
-namespace env_vars {
-
-#if defined(OS_POSIX)
-BASE_EXPORT extern const char kHome[];
-#endif
-
-}  // namespace env_vars
-
-class BASE_EXPORT Environment {
- public:
-  virtual ~Environment();
-
-  // Returns the appropriate platform-specific instance.
-  static std::unique_ptr<Environment> Create();
-
-  // Gets an environment variable's value and stores it in |result|.
-  // Returns false if the key is unset.
-  virtual bool GetVar(StringPiece variable_name, std::string* result) = 0;
-
-  // Syntactic sugar for GetVar(variable_name, nullptr);
-  virtual bool HasVar(StringPiece variable_name);
-
-  // Returns true on success, otherwise returns false.
-  virtual bool SetVar(StringPiece variable_name,
-                      const std::string& new_value) = 0;
-
-  // Returns true on success, otherwise returns false.
-  virtual bool UnSetVar(StringPiece variable_name) = 0;
-};
-
-
-#if defined(OS_WIN)
-
-typedef string16 NativeEnvironmentString;
-typedef std::map<NativeEnvironmentString, NativeEnvironmentString>
-    EnvironmentMap;
-
-// Returns a modified environment vector constructed from the given environment
-// and the list of changes given in |changes|. Each key in the environment is
-// matched against the first element of the pairs. In the event of a match, the
-// value is replaced by the second of the pair, unless the second is empty, in
-// which case the key-value is removed.
-//
-// This Windows version takes and returns a Windows-style environment block
-// which is a concatenated list of null-terminated 16-bit strings. The end is
-// marked by a double-null terminator. The size of the returned string will
-// include the terminators.
-BASE_EXPORT string16 AlterEnvironment(const wchar_t* env,
-                                      const EnvironmentMap& changes);
-
-#elif defined(OS_POSIX)
-
-typedef std::string NativeEnvironmentString;
-typedef std::map<NativeEnvironmentString, NativeEnvironmentString>
-    EnvironmentMap;
-
-// See general comments for the Windows version above.
-//
-// This Posix version takes and returns a Posix-style environment block, which
-// is a null-terminated list of pointers to null-terminated strings. The
-// returned array will have appended to it the storage for the array itself so
-// there is only one pointer to manage, but this means that you can't copy the
-// array without keeping the original around.
-BASE_EXPORT std::unique_ptr<char* []> AlterEnvironment(
-    const char* const* env,
-    const EnvironmentMap& changes);
-
-#endif
-
-}  // namespace base
-
-#endif  // BASE_ENVIRONMENT_H_
--- a/security/sandbox/chromium/base/files/file_path.h
+++ b/security/sandbox/chromium/base/files/file_path.h
@@ -133,17 +133,16 @@
 #elif defined(OS_WIN)
 #define PRIsFP "ls"
 #endif  // OS_WIN
 
 namespace base {
 
 class Pickle;
 class PickleIterator;
-class PickleSizer;
 
 // An abstraction to isolate users from the differences between native
 // pathnames on different platforms.
 class BASE_EXPORT FilePath {
  public:
 #if defined(OS_POSIX)
   // On most platforms, native pathnames are char arrays, and the encoding
   // may or may not be specified.  On Mac OS X, native pathnames are encoded
@@ -368,22 +367,21 @@ class BASE_EXPORT FilePath {
   // Returns a FilePath object from a path name in UTF-8. This function
   // should only be used for cases where you are sure that the input
   // string is UTF-8.
   //
   // Like AsUTF8Unsafe(), this function is unsafe. This function
   // internally calls SysWideToNativeMB() on POSIX systems other than Mac
   // and Chrome OS, to mitigate the encoding issue. See the comment at
   // AsUTF8Unsafe() for details.
-  static FilePath FromUTF8Unsafe(StringPiece utf8);
+  static FilePath FromUTF8Unsafe(const std::string& utf8);
 
   // Similar to FromUTF8Unsafe, but accepts UTF-16 instead.
-  static FilePath FromUTF16Unsafe(StringPiece16 utf16);
+  static FilePath FromUTF16Unsafe(const string16& utf16);
 
-  void GetSizeForPickle(PickleSizer* sizer) const;
   void WriteToPickle(Pickle* pickle) const;
   bool ReadFromPickle(PickleIterator* iter);
 
   // Normalize all path separators to backslash on Windows
   // (if FILE_PATH_USES_WIN_SEPARATORS is true), or do nothing on POSIX systems.
   FilePath NormalizePathSeparators() const;
 
   // Normalize all path separattors to given type on Windows
--- a/security/sandbox/chromium/base/guid.h
+++ b/security/sandbox/chromium/base/guid.h
@@ -5,39 +5,29 @@
 #ifndef BASE_GUID_H_
 #define BASE_GUID_H_
 
 #include <stdint.h>
 
 #include <string>
 
 #include "base/base_export.h"
-#include "base/strings/string_piece.h"
 #include "build/build_config.h"
 
 namespace base {
 
-// Generate a 128-bit (pseudo) random GUID in the form of version 4 as described
-// in RFC 4122, section 4.4.
-// The format of GUID version 4 must be xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx,
-// where y is one of [8, 9, A, B].
-// The hexadecimal values "a" through "f" are output as lower case characters.
+// Generate a 128-bit random GUID of the form: "%08X-%04X-%04X-%04X-%012llX".
 // If GUID generation fails an empty string is returned.
+// The POSIX implementation uses pseudo random number generation to create
+// the GUID.  The Windows implementation uses system services.
 BASE_EXPORT std::string GenerateGUID();
 
-// Returns true if the input string conforms to the version 4 GUID format.
-// Note that this does NOT check if the hexadecimal values "a" through "f"
-// are in lower case characters, as Version 4 RFC says onput they're
-// case insensitive. (Use IsValidGUIDOutputString for checking if the
-// given string is valid output string)
-BASE_EXPORT bool IsValidGUID(const base::StringPiece& guid);
+// Returns true if the input string conforms to the GUID format.
+BASE_EXPORT bool IsValidGUID(const std::string& guid);
 
-// Returns true if the input string is valid version 4 GUID output string.
-// This also checks if the hexadecimal values "a" through "f" are in lower
-// case characters.
-BASE_EXPORT bool IsValidGUIDOutputString(const base::StringPiece& guid);
-
+#if defined(OS_POSIX)
 // For unit testing purposes only.  Do not use outside of tests.
 BASE_EXPORT std::string RandomDataToGUIDString(const uint64_t bytes[2]);
+#endif
 
 }  // namespace base
 
 #endif  // BASE_GUID_H_
--- a/security/sandbox/chromium/base/hash.cc
+++ b/security/sandbox/chromium/base/hash.cc
@@ -6,17 +6,13 @@
 
 // Definition in base/third_party/superfasthash/superfasthash.c. (Third-party
 // code did not come with its own header file, so declaring the function here.)
 // Note: This algorithm is also in Blink under Source/wtf/StringHasher.h.
 extern "C" uint32_t SuperFastHash(const char* data, int len);
 
 namespace base {
 
-uint32_t SuperFastHash(const char* data, size_t length) {
-  if (length > static_cast<size_t>(std::numeric_limits<int>::max())) {
-    NOTREACHED();
-    return 0;
-  }
-  return ::SuperFastHash(data, static_cast<int>(length));
+uint32_t SuperFastHash(const char* data, int len) {
+  return ::SuperFastHash(data, len);
 }
 
 }  // namespace base
--- a/security/sandbox/chromium/base/hash.h
+++ b/security/sandbox/chromium/base/hash.h
@@ -5,114 +5,36 @@
 #ifndef BASE_HASH_H_
 #define BASE_HASH_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <limits>
 #include <string>
-#include <utility>
 
 #include "base/base_export.h"
 #include "base/logging.h"
 
 namespace base {
 
 // WARNING: This hash function should not be used for any cryptographic purpose.
-BASE_EXPORT uint32_t SuperFastHash(const char* data, size_t length);
+BASE_EXPORT uint32_t SuperFastHash(const char* data, int len);
 
 // Computes a hash of a memory buffer |data| of a given |length|.
 // WARNING: This hash function should not be used for any cryptographic purpose.
 inline uint32_t Hash(const char* data, size_t length) {
-  return SuperFastHash(data, length);
+  if (length > static_cast<size_t>(std::numeric_limits<int>::max())) {
+    NOTREACHED();
+    return 0;
+  }
+  return SuperFastHash(data, static_cast<int>(length));
 }
 
 // Computes a hash of a string |str|.
 // WARNING: This hash function should not be used for any cryptographic purpose.
 inline uint32_t Hash(const std::string& str) {
   return Hash(str.data(), str.size());
 }
 
-// Implement hashing for pairs of at-most 32 bit integer values.
-// When size_t is 32 bits, we turn the 64-bit hash code into 32 bits by using
-// multiply-add hashing. This algorithm, as described in
-// Theorem 4.3.3 of the thesis "Über die Komplexität der Multiplikation in
-// eingeschränkten Branchingprogrammmodellen" by Woelfel, is:
-//
-//   h32(x32, y32) = (h64(x32, y32) * rand_odd64 + rand16 * 2^16) % 2^64 / 2^32
-//
-// Contact danakj@chromium.org for any questions.
-inline size_t HashInts32(uint32_t value1, uint32_t value2) {
-  uint64_t value1_64 = value1;
-  uint64_t hash64 = (value1_64 << 32) | value2;
-
-  if (sizeof(size_t) >= sizeof(uint64_t))
-    return static_cast<size_t>(hash64);
-
-  uint64_t odd_random = 481046412LL << 32 | 1025306955LL;
-  uint32_t shift_random = 10121U << 16;
-
-  hash64 = hash64 * odd_random + shift_random;
-  size_t high_bits =
-      static_cast<size_t>(hash64 >> (8 * (sizeof(uint64_t) - sizeof(size_t))));
-  return high_bits;
-}
-
-// Implement hashing for pairs of up-to 64-bit integer values.
-// We use the compound integer hash method to produce a 64-bit hash code, by
-// breaking the two 64-bit inputs into 4 32-bit values:
-// http://opendatastructures.org/versions/edition-0.1d/ods-java/node33.html#SECTION00832000000000000000
-// Then we reduce our result to 32 bits if required, similar to above.
-inline size_t HashInts64(uint64_t value1, uint64_t value2) {
-  uint32_t short_random1 = 842304669U;
-  uint32_t short_random2 = 619063811U;
-  uint32_t short_random3 = 937041849U;
-  uint32_t short_random4 = 3309708029U;
-
-  uint32_t value1a = static_cast<uint32_t>(value1 & 0xffffffff);
-  uint32_t value1b = static_cast<uint32_t>((value1 >> 32) & 0xffffffff);
-  uint32_t value2a = static_cast<uint32_t>(value2 & 0xffffffff);
-  uint32_t value2b = static_cast<uint32_t>((value2 >> 32) & 0xffffffff);
-
-  uint64_t product1 = static_cast<uint64_t>(value1a) * short_random1;
-  uint64_t product2 = static_cast<uint64_t>(value1b) * short_random2;
-  uint64_t product3 = static_cast<uint64_t>(value2a) * short_random3;
-  uint64_t product4 = static_cast<uint64_t>(value2b) * short_random4;
-
-  uint64_t hash64 = product1 + product2 + product3 + product4;
-
-  if (sizeof(size_t) >= sizeof(uint64_t))
-    return static_cast<size_t>(hash64);
-
-  uint64_t odd_random = 1578233944LL << 32 | 194370989LL;
-  uint32_t shift_random = 20591U << 16;
-
-  hash64 = hash64 * odd_random + shift_random;
-  size_t high_bits =
-      static_cast<size_t>(hash64 >> (8 * (sizeof(uint64_t) - sizeof(size_t))));
-  return high_bits;
-}
-
-template <typename T1, typename T2>
-inline size_t HashInts(T1 value1, T2 value2) {
-  // This condition is expected to be compile-time evaluated and optimised away
-  // in release builds.
-  if (sizeof(T1) > sizeof(uint32_t) || (sizeof(T2) > sizeof(uint32_t)))
-    return HashInts64(value1, value2);
-
-  return HashInts32(value1, value2);
-}
-
-// A templated hasher for pairs of integer types.
-template <typename T>
-struct IntPairHash;
-
-template <typename Type1, typename Type2>
-struct IntPairHash<std::pair<Type1, Type2>> {
-  size_t operator()(std::pair<Type1, Type2> value) const {
-    return HashInts(value.first, value.second);
-  }
-};
-
 }  // namespace base
 
 #endif  // BASE_HASH_H_
--- a/security/sandbox/chromium/base/lazy_instance.h
+++ b/security/sandbox/chromium/base/lazy_instance.h
@@ -50,17 +50,17 @@
 // initialization.
 #define LAZY_INSTANCE_INITIALIZER {0}
 
 namespace base {
 
 template <typename Type>
 struct DefaultLazyInstanceTraits {
   static const bool kRegisterOnExit = true;
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   static const bool kAllowedToAccessOnNonjoinableThread = false;
 #endif
 
   static Type* New(void* instance) {
     DCHECK_EQ(reinterpret_cast<uintptr_t>(instance) & (ALIGNOF(Type) - 1), 0u)
         << ": Bad boy, the buffer passed to placement new is not aligned!\n"
         "This may break some stuff like SSE-based optimizations assuming the "
         "<Type> objects are word aligned.";
@@ -84,30 +84,30 @@ namespace internal {
 // base::LazyInstance<T, base::internal::LeakyLazyInstanceTraits<T> >
 // my_leaky_lazy_instance;
 // (especially when T is MyLongTypeNameImplClientHolderFactory).
 // Only use this internal::-qualified verbose form to extend this traits class
 // (depending on its implementation details).
 template <typename Type>
 struct LeakyLazyInstanceTraits {
   static const bool kRegisterOnExit = false;
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   static const bool kAllowedToAccessOnNonjoinableThread = true;
 #endif
 
   static Type* New(void* instance) {
     ANNOTATE_SCOPED_MEMORY_LEAK;
     return DefaultLazyInstanceTraits<Type>::New(instance);
   }
   static void Delete(Type* instance) {
   }
 };
 
 // Our AtomicWord doubles as a spinlock, where a value of
-// kLazyInstanceStateCreating means the spinlock is being held for creation.
+// kBeingCreatedMarker means the spinlock is being held for creation.
 static const subtle::AtomicWord kLazyInstanceStateCreating = 1;
 
 // Check if instance needs to be created. If so return true otherwise
 // if another thread has beat us, wait for instance to be created and
 // return false.
 BASE_EXPORT bool NeedsLazyInstance(subtle::AtomicWord* state);
 
 // After creating an instance, call this to register the dtor to be called
@@ -133,17 +133,17 @@ class LazyInstance {
   // instances.
   typedef LazyInstance<Type, internal::LeakyLazyInstanceTraits<Type> > Leaky;
 
   Type& Get() {
     return *Pointer();
   }
 
   Type* Pointer() {
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
     // Avoid making TLS lookup on release builds.
     if (!Traits::kAllowedToAccessOnNonjoinableThread)
       ThreadRestrictions::AssertSingletonAllowed();
 #endif
     // If any bit in the created mask is true, the instance has already been
     // fully constructed.
     static const subtle::AtomicWord kLazyInstanceCreatedMask =
         ~internal::kLazyInstanceStateCreating;
--- a/security/sandbox/chromium/base/location.h
+++ b/security/sandbox/chromium/base/location.h
@@ -6,17 +6,17 @@
 #define BASE_LOCATION_H_
 
 #include <stddef.h>
 
 #include <cassert>
 #include <string>
 
 #include "base/base_export.h"
-#include "base/hash.h"
+#include "base/containers/hash_tables.h"
 
 namespace tracked_objects {
 
 // Location provides basic info where of an object was constructed, or was
 // significantly brought to life.
 class BASE_EXPORT Location {
  public:
   // Constructor should be called with a long-lived char*, such as __FILE__.
@@ -54,17 +54,17 @@ class BASE_EXPORT Location {
       // Compute the hash value using file name pointer and line number.
       // No need to use |function_name_| since the other two fields uniquely
       // identify this location.
 
       // The file name will always be uniquely identified by its pointer since
       // it comes from __FILE__, so no need to check the contents of the string.
       // See the definition of FROM_HERE in location.h, and how it is used
       // elsewhere.
-      return base::HashInts(reinterpret_cast<uintptr_t>(location.file_name()),
+      return base::HashPair(reinterpret_cast<uintptr_t>(location.file_name()),
                             location.line_number());
     }
   };
 
   // Translate the some of the state in this instance into a human readable
   // string with HTML characters in the function names escaped, and append that
   // string to |output|.  Inclusion of the file_name_ and function_name_ are
   // optional, and controlled by the boolean arguments.
@@ -92,17 +92,17 @@ struct BASE_EXPORT LocationSnapshot {
   std::string file_name;
   std::string function_name;
   int line_number;
 };
 
 BASE_EXPORT const void* GetProgramCounter();
 
 // Define a macro to record the current source location.
-#define FROM_HERE FROM_HERE_WITH_EXPLICIT_FUNCTION(__func__)
+#define FROM_HERE FROM_HERE_WITH_EXPLICIT_FUNCTION(__FUNCTION__)
 
 #define FROM_HERE_WITH_EXPLICIT_FUNCTION(function_name)                        \
     ::tracked_objects::Location(function_name,                                 \
                                 __FILE__,                                      \
                                 __LINE__,                                      \
                                 ::tracked_objects::GetProgramCounter())
 
 }  // namespace tracked_objects
--- a/security/sandbox/chromium/base/logging.h
+++ b/security/sandbox/chromium/base/logging.h
@@ -6,23 +6,20 @@
 #define BASE_LOGGING_H_
 
 #include <stddef.h>
 
 #include <cassert>
 #include <cstring>
 #include <sstream>
 #include <string>
-#include <type_traits>
-#include <utility>
 
 #include "base/base_export.h"
 #include "base/debug/debugger.h"
 #include "base/macros.h"
-#include "base/template_util.h"
 #include "build/build_config.h"
 
 //
 // Optional message capabilities
 // -----------------------------
 // Assertion failed messages and fatal errors are displayed in a dialog box
 // before the application exits. However, running this UI creates a message
 // loop, which causes application messages to be processed and potentially
@@ -304,26 +301,25 @@ const LogSeverity LOG_DFATAL = LOG_ERROR
 #else
 const LogSeverity LOG_DFATAL = LOG_FATAL;
 #endif
 
 // A few definitions of macros that don't generate much code. These are used
 // by LOG() and LOG_IF, etc. Since these are used all over our code, it's
 // better to have compact code for these operations.
 #define COMPACT_GOOGLE_LOG_EX_INFO(ClassName, ...) \
-  ::logging::ClassName(__FILE__, __LINE__, ::logging::LOG_INFO, ##__VA_ARGS__)
-#define COMPACT_GOOGLE_LOG_EX_WARNING(ClassName, ...)              \
-  ::logging::ClassName(__FILE__, __LINE__, ::logging::LOG_WARNING, \
-                       ##__VA_ARGS__)
+  logging::ClassName(__FILE__, __LINE__, logging::LOG_INFO , ##__VA_ARGS__)
+#define COMPACT_GOOGLE_LOG_EX_WARNING(ClassName, ...) \
+  logging::ClassName(__FILE__, __LINE__, logging::LOG_WARNING , ##__VA_ARGS__)
 #define COMPACT_GOOGLE_LOG_EX_ERROR(ClassName, ...) \
-  ::logging::ClassName(__FILE__, __LINE__, ::logging::LOG_ERROR, ##__VA_ARGS__)
+  logging::ClassName(__FILE__, __LINE__, logging::LOG_ERROR , ##__VA_ARGS__)
 #define COMPACT_GOOGLE_LOG_EX_FATAL(ClassName, ...) \
-  ::logging::ClassName(__FILE__, __LINE__, ::logging::LOG_FATAL, ##__VA_ARGS__)
+  logging::ClassName(__FILE__, __LINE__, logging::LOG_FATAL , ##__VA_ARGS__)
 #define COMPACT_GOOGLE_LOG_EX_DFATAL(ClassName, ...) \
-  ::logging::ClassName(__FILE__, __LINE__, ::logging::LOG_DFATAL, ##__VA_ARGS__)
+  logging::ClassName(__FILE__, __LINE__, logging::LOG_DFATAL , ##__VA_ARGS__)
 
 #define COMPACT_GOOGLE_LOG_INFO \
   COMPACT_GOOGLE_LOG_EX_INFO(LogMessage)
 #define COMPACT_GOOGLE_LOG_WARNING \
   COMPACT_GOOGLE_LOG_EX_WARNING(LogMessage)
 #define COMPACT_GOOGLE_LOG_ERROR \
   COMPACT_GOOGLE_LOG_EX_ERROR(LogMessage)
 #define COMPACT_GOOGLE_LOG_FATAL \
@@ -372,48 +368,53 @@ const LogSeverity LOG_0 = LOG_ERROR;
 // ostream. We employ a neat hack by calling the stream() member
 // function of LogMessage which seems to avoid the problem.
 #define LOG_STREAM(severity) COMPACT_GOOGLE_LOG_ ## severity.stream()
 
 #define LOG(severity) LAZY_STREAM(LOG_STREAM(severity), LOG_IS_ON(severity))
 #define LOG_IF(severity, condition) \
   LAZY_STREAM(LOG_STREAM(severity), LOG_IS_ON(severity) && (condition))
 
+#define SYSLOG(severity) LOG(severity)
+#define SYSLOG_IF(severity, condition) LOG_IF(severity, condition)
+
 // The VLOG macros log with negative verbosities.
 #define VLOG_STREAM(verbose_level) \
-  ::logging::LogMessage(__FILE__, __LINE__, -verbose_level).stream()
+  logging::LogMessage(__FILE__, __LINE__, -verbose_level).stream()
 
 #define VLOG(verbose_level) \
   LAZY_STREAM(VLOG_STREAM(verbose_level), VLOG_IS_ON(verbose_level))
 
 #define VLOG_IF(verbose_level, condition) \
   LAZY_STREAM(VLOG_STREAM(verbose_level), \
       VLOG_IS_ON(verbose_level) && (condition))
 
 #if defined (OS_WIN)
 #define VPLOG_STREAM(verbose_level) \
-  ::logging::Win32ErrorLogMessage(__FILE__, __LINE__, -verbose_level, \
+  logging::Win32ErrorLogMessage(__FILE__, __LINE__, -verbose_level, \
     ::logging::GetLastSystemErrorCode()).stream()
 #elif defined(OS_POSIX)
 #define VPLOG_STREAM(verbose_level) \
-  ::logging::ErrnoLogMessage(__FILE__, __LINE__, -verbose_level, \
+  logging::ErrnoLogMessage(__FILE__, __LINE__, -verbose_level, \
     ::logging::GetLastSystemErrorCode()).stream()
 #endif
 
 #define VPLOG(verbose_level) \
   LAZY_STREAM(VPLOG_STREAM(verbose_level), VLOG_IS_ON(verbose_level))
 
 #define VPLOG_IF(verbose_level, condition) \
   LAZY_STREAM(VPLOG_STREAM(verbose_level), \
     VLOG_IS_ON(verbose_level) && (condition))
 
 // TODO(akalin): Add more VLOG variants, e.g. VPLOG.
 
 #define LOG_ASSERT(condition)  \
   LOG_IF(FATAL, !(condition)) << "Assert failed: " #condition ". "
+#define SYSLOG_ASSERT(condition) \
+  SYSLOG_IF(FATAL, !(condition)) << "Assert failed: " #condition ". "
 
 #if defined(OS_WIN)
 #define PLOG_STREAM(severity) \
   COMPACT_GOOGLE_LOG_EX_ ## severity(Win32ErrorLogMessage, \
       ::logging::GetLastSystemErrorCode()).stream()
 #elif defined(OS_POSIX)
 #define PLOG_STREAM(severity) \
   COMPACT_GOOGLE_LOG_EX_ ## severity(ErrnoLogMessage, \
@@ -429,17 +430,17 @@ const LogSeverity LOG_0 = LOG_ERROR;
 // The actual stream used isn't important.
 #define EAT_STREAM_PARAMETERS                                           \
   true ? (void) 0 : ::logging::LogMessageVoidify() & LOG_STREAM(FATAL)
 
 // Captures the result of a CHECK_EQ (for example) and facilitates testing as a
 // boolean.
 class CheckOpResult {
  public:
-  // |message| must be non-null if and only if the check failed.
+  // |message| must be null if and only if the check failed.
   CheckOpResult(std::string* message) : message_(message) {}
   // Returns true if the check succeeded.
   operator bool() const { return !message_; }
   // Returns the message.
   std::string* message() { return message_; }
 
  private:
   std::string* message_;
@@ -447,38 +448,32 @@ class CheckOpResult {
 
 // CHECK dies with a fatal error if condition is not true.  It is *not*
 // controlled by NDEBUG, so the check will be executed regardless of
 // compilation mode.
 //
 // We make sure CHECK et al. always evaluates their arguments, as
 // doing CHECK(FunctionWithSideEffect()) is a common idiom.
 
-#if defined(OFFICIAL_BUILD) && defined(NDEBUG)
+#if defined(OFFICIAL_BUILD) && defined(NDEBUG) && !defined(OS_ANDROID)
 
 // Make all CHECK functions discard their log strings to reduce code
-// bloat, and improve performance, for official release builds.
+// bloat for official release builds (except Android).
 
-#if defined(COMPILER_GCC) || __clang__
-#define LOGGING_CRASH() __builtin_trap()
-#else
-#define LOGGING_CRASH() ((void)(*(volatile char*)0 = 0))
-#endif
-
-// This is not calling BreakDebugger since this is called frequently, and
-// calling an out-of-line function instead of a noreturn inline macro prevents
-// compiler optimizations.
+// TODO(akalin): This would be more valuable if there were some way to
+// remove BreakDebugger() from the backtrace, perhaps by turning it
+// into a macro (like __debugbreak() on Windows).
 #define CHECK(condition)                                                \
-  !(condition) ? LOGGING_CRASH() : EAT_STREAM_PARAMETERS
+  !(condition) ? ::base::debug::BreakDebugger() : EAT_STREAM_PARAMETERS
 
 #define PCHECK(condition) CHECK(condition)
 
 #define CHECK_OP(name, op, val1, val2) CHECK((val1) op (val2))
 
-#else  // !(OFFICIAL_BUILD && NDEBUG)
+#else
 
 #if defined(_PREFAST_) && defined(OS_WIN)
 // Use __analysis_assume to tell the VC++ static analysis engine that
 // assert conditions are true, to suppress warnings.  The LAZY_STREAM
 // parameter doesn't reference 'condition' in /analyze builds because
 // this evaluation confuses /analyze. The !! before condition is because
 // __analysis_assume gets confused on some conditions:
 // http://randomascii.wordpress.com/2011/09/13/analyze-for-visual-studio-the-ugly-part-5/
@@ -491,79 +486,51 @@ class CheckOpResult {
 #define PCHECK(condition)                \
   __analysis_assume(!!(condition)),      \
   LAZY_STREAM(PLOG_STREAM(FATAL), false) \
   << "Check failed: " #condition ". "
 
 #else  // _PREFAST_
 
 // Do as much work as possible out of line to reduce inline code size.
-#define CHECK(condition)                                                      \
-  LAZY_STREAM(::logging::LogMessage(__FILE__, __LINE__, #condition).stream(), \
+#define CHECK(condition)                                                    \
+  LAZY_STREAM(logging::LogMessage(__FILE__, __LINE__, #condition).stream(), \
               !(condition))
 
 #define PCHECK(condition)                       \
   LAZY_STREAM(PLOG_STREAM(FATAL), !(condition)) \
   << "Check failed: " #condition ". "
 
 #endif  // _PREFAST_
 
 // Helper macro for binary operators.
 // Don't use this macro directly in your code, use CHECK_EQ et al below.
 // The 'switch' is used to prevent the 'else' from being ambiguous when the
 // macro is used in an 'if' clause such as:
 // if (a == 1)
 //   CHECK_EQ(2, a);
 #define CHECK_OP(name, op, val1, val2)                                         \
   switch (0) case 0: default:                                                  \
-  if (::logging::CheckOpResult true_if_passed =                                \
-      ::logging::Check##name##Impl((val1), (val2),                             \
-                                   #val1 " " #op " " #val2))                   \
+  if (logging::CheckOpResult true_if_passed =                                  \
+      logging::Check##name##Impl((val1), (val2),                               \
+                                 #val1 " " #op " " #val2))                     \
    ;                                                                           \
   else                                                                         \
-    ::logging::LogMessage(__FILE__, __LINE__, true_if_passed.message()).stream()
-
-#endif  // !(OFFICIAL_BUILD && NDEBUG)
-
-// This formats a value for a failing CHECK_XX statement.  Ordinarily,
-// it uses the definition for operator<<, with a few special cases below.
-template <typename T>
-inline typename std::enable_if<
-    base::internal::SupportsOstreamOperator<const T&>::value,
-    void>::type
-MakeCheckOpValueString(std::ostream* os, const T& v) {
-  (*os) << v;
-}
+    logging::LogMessage(__FILE__, __LINE__, true_if_passed.message()).stream()
 
-// We need overloads for enums that don't support operator<<.
-// (i.e. scoped enums where no operator<< overload was declared).
-template <typename T>
-inline typename std::enable_if<
-    !base::internal::SupportsOstreamOperator<const T&>::value &&
-        std::is_enum<T>::value,
-    void>::type
-MakeCheckOpValueString(std::ostream* os, const T& v) {
-  (*os) << static_cast<typename base::underlying_type<T>::type>(v);
-}
-
-// We need an explicit overload for std::nullptr_t.
-BASE_EXPORT void MakeCheckOpValueString(std::ostream* os, std::nullptr_t p);
+#endif
 
 // Build the error message string.  This is separate from the "Impl"
 // function template because it is not performance critical and so can
 // be out of line, while the "Impl" code should be inline.  Caller
 // takes ownership of the returned string.
 template<class t1, class t2>
 std::string* MakeCheckOpString(const t1& v1, const t2& v2, const char* names) {
   std::ostringstream ss;
-  ss << names << " (";
-  MakeCheckOpValueString(&ss, v1);
-  ss << " vs. ";
-  MakeCheckOpValueString(&ss, v2);
-  ss << ")";
+  ss << names << " (" << v1 << " vs. " << v2 << ")";
   std::string* msg = new std::string(ss.str());
   return msg;
 }
 
 // Commonly used instantiations of MakeCheckOpString<>. Explicitly instantiated
 // in logging.cc.
 extern template BASE_EXPORT std::string* MakeCheckOpString<int, int>(
     const int&, const int&, const char* names);
@@ -584,75 +551,87 @@ std::string* MakeCheckOpString<std::stri
 // The (int, int) specialization works around the issue that the compiler
 // will not instantiate the template version of the function on values of
 // unnamed enum type - see comment below.
 #define DEFINE_CHECK_OP_IMPL(name, op) \
   template <class t1, class t2> \
   inline std::string* Check##name##Impl(const t1& v1, const t2& v2, \
                                         const char* names) { \
     if (v1 op v2) return NULL; \
-    else return ::logging::MakeCheckOpString(v1, v2, names);    \
+    else return MakeCheckOpString(v1, v2, names); \
   } \
   inline std::string* Check##name##Impl(int v1, int v2, const char* names) { \
     if (v1 op v2) return NULL; \
-    else return ::logging::MakeCheckOpString(v1, v2, names);    \
+    else return MakeCheckOpString(v1, v2, names); \
   }
 DEFINE_CHECK_OP_IMPL(EQ, ==)
 DEFINE_CHECK_OP_IMPL(NE, !=)
 DEFINE_CHECK_OP_IMPL(LE, <=)
 DEFINE_CHECK_OP_IMPL(LT, < )
 DEFINE_CHECK_OP_IMPL(GE, >=)
 DEFINE_CHECK_OP_IMPL(GT, > )
 #undef DEFINE_CHECK_OP_IMPL
 
 #define CHECK_EQ(val1, val2) CHECK_OP(EQ, ==, val1, val2)
 #define CHECK_NE(val1, val2) CHECK_OP(NE, !=, val1, val2)
 #define CHECK_LE(val1, val2) CHECK_OP(LE, <=, val1, val2)
 #define CHECK_LT(val1, val2) CHECK_OP(LT, < , val1, val2)
 #define CHECK_GE(val1, val2) CHECK_OP(GE, >=, val1, val2)
 #define CHECK_GT(val1, val2) CHECK_OP(GT, > , val1, val2)
 
+#if defined(NDEBUG)
+#define ENABLE_DLOG 0
+#else
+#define ENABLE_DLOG 1
+#endif
+
 #if defined(NDEBUG) && !defined(DCHECK_ALWAYS_ON)
 #define DCHECK_IS_ON() 0
 #else
 #define DCHECK_IS_ON() 1
 #endif
 
 // Definitions for DLOG et al.
 
-#if DCHECK_IS_ON()
+#if ENABLE_DLOG
 
 #define DLOG_IS_ON(severity) LOG_IS_ON(severity)
 #define DLOG_IF(severity, condition) LOG_IF(severity, condition)
 #define DLOG_ASSERT(condition) LOG_ASSERT(condition)
 #define DPLOG_IF(severity, condition) PLOG_IF(severity, condition)
 #define DVLOG_IF(verboselevel, condition) VLOG_IF(verboselevel, condition)
 #define DVPLOG_IF(verboselevel, condition) VPLOG_IF(verboselevel, condition)
 
-#else  // DCHECK_IS_ON()
+#else  // ENABLE_DLOG
 
-// If !DCHECK_IS_ON(), we want to avoid emitting any references to |condition|
-// (which may reference a variable defined only if DCHECK_IS_ON()).
-// Contrast this with DCHECK et al., which has different behavior.
+// If ENABLE_DLOG is off, we want to avoid emitting any references to
+// |condition| (which may reference a variable defined only if NDEBUG
+// is not defined).  Contrast this with DCHECK et al., which has
+// different behavior.
 
 #define DLOG_IS_ON(severity) false
 #define DLOG_IF(severity, condition) EAT_STREAM_PARAMETERS
 #define DLOG_ASSERT(condition) EAT_STREAM_PARAMETERS
 #define DPLOG_IF(severity, condition) EAT_STREAM_PARAMETERS
 #define DVLOG_IF(verboselevel, condition) EAT_STREAM_PARAMETERS
 #define DVPLOG_IF(verboselevel, condition) EAT_STREAM_PARAMETERS
 
-#endif  // DCHECK_IS_ON()
+#endif  // ENABLE_DLOG
 
-// DEBUG_MODE is for runtime uses like
+// DEBUG_MODE is for uses like
 //   if (DEBUG_MODE) foo.CheckThatFoo();
-// We tie its state to DCHECK_IS_ON().
+// instead of
+//   #ifndef NDEBUG
+//     foo.CheckThatFoo();
+//   #endif
 //
-// For compile-time checks, #if DCHECK_IS_ON() can be used.
-enum { DEBUG_MODE = DCHECK_IS_ON() };
+// We tie its state to ENABLE_DLOG.
+enum { DEBUG_MODE = ENABLE_DLOG };
+
+#undef ENABLE_DLOG
 
 #define DLOG(severity)                                          \
   LAZY_STREAM(LOG_STREAM(severity), DLOG_IS_ON(severity))
 
 #define DPLOG(severity)                                         \
   LAZY_STREAM(PLOG_STREAM(severity), DLOG_IS_ON(severity))
 
 #define DVLOG(verboselevel) DVLOG_IF(verboselevel, VLOG_IS_ON(verboselevel))
@@ -709,46 +688,45 @@ const LogSeverity LOG_DCHECK = LOG_INFO;
 #endif  // _PREFAST_
 
 // Helper macro for binary operators.
 // Don't use this macro directly in your code, use DCHECK_EQ et al below.
 // The 'switch' is used to prevent the 'else' from being ambiguous when the
 // macro is used in an 'if' clause such as:
 // if (a == 1)
 //   DCHECK_EQ(2, a);
-#define DCHECK_OP(name, op, val1, val2)                                \
-  switch (0) case 0: default:                                          \
-  if (::logging::CheckOpResult true_if_passed =                        \
-      DCHECK_IS_ON() ?                                                 \
-      ::logging::Check##name##Impl((val1), (val2),                     \
-                                   #val1 " " #op " " #val2) : nullptr) \
-   ;                                                                   \
-  else                                                                 \
-    ::logging::LogMessage(__FILE__, __LINE__, ::logging::LOG_DCHECK,   \
-                          true_if_passed.message()).stream()
+#define DCHECK_OP(name, op, val1, val2)                               \
+  switch (0) case 0: default:                                         \
+  if (logging::CheckOpResult true_if_passed =                         \
+      DCHECK_IS_ON() ?                                                \
+      logging::Check##name##Impl((val1), (val2),                      \
+                                 #val1 " " #op " " #val2) : nullptr)  \
+   ;                                                                  \
+  else                                                                \
+    logging::LogMessage(__FILE__, __LINE__, ::logging::LOG_DCHECK,    \
+                        true_if_passed.message()).stream()
 
 // Equality/Inequality checks - compare two values, and log a
 // LOG_DCHECK message including the two values when the result is not
 // as expected.  The values must have operator<<(ostream, ...)
 // defined.
 //
 // You may append to the error message like so:
-//   DCHECK_NE(1, 2) << "The world must be ending!";
+//   DCHECK_NE(1, 2) << ": The world must be ending!";
 //
 // We are very careful to ensure that each argument is evaluated exactly
 // once, and that anything which is legal to pass as a function argument is
 // legal here.  In particular, the arguments may be temporary expressions
 // which will end up being destroyed at the end of the apparent statement,
 // for example:
 //   DCHECK_EQ(string("abc")[1], 'b');
 //
-// WARNING: These don't compile correctly if one of the arguments is a pointer
-// and the other is NULL.  In new code, prefer nullptr instead.  To
-// work around this for C++98, simply static_cast NULL to the type of the
-// desired pointer.
+// WARNING: These may not compile correctly if one of the arguments is a pointer
+// and the other is NULL. To work around this, simply static_cast NULL to the
+// type of the desired pointer.
 
 #define DCHECK_EQ(val1, val2) DCHECK_OP(EQ, ==, val1, val2)
 #define DCHECK_NE(val1, val2) DCHECK_OP(NE, !=, val1, val2)
 #define DCHECK_LE(val1, val2) DCHECK_OP(LE, <=, val1, val2)
 #define DCHECK_LT(val1, val2) DCHECK_OP(LT, < , val1, val2)
 #define DCHECK_GE(val1, val2) DCHECK_OP(GE, >=, val1, val2)
 #define DCHECK_GT(val1, val2) DCHECK_OP(GT, > , val1, val2)
 
@@ -790,19 +768,16 @@ class BASE_EXPORT LogMessage {
   // Used for DCHECK_EQ(), etc. Takes ownership of the given string.
   LogMessage(const char* file, int line, LogSeverity severity,
              std::string* result);
 
   ~LogMessage();
 
   std::ostream& stream() { return stream_; }
 
-  LogSeverity severity() { return severity_; }
-  std::string str() { return stream_.str(); }
-
  private:
   void Init(const char* file, int line);
 
   LogSeverity severity_;
   std::ostringstream stream_;
   size_t message_start_;  // Offset of the start of the message (past prefix
                           // info).
   // The file and line information passed in to the constructor.
@@ -827,16 +802,22 @@ class BASE_EXPORT LogMessage {
   };
 
   SaveLastError last_error_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(LogMessage);
 };
 
+// A non-macro interface to the log facility; (useful
+// when the logging level is not a compile-time constant).
+inline void LogAtLevel(int log_level, const std::string& msg) {
+  LogMessage(__FILE__, __LINE__, log_level).stream() << msg;
+}
+
 // This class is used to explicitly ignore values in the conditional
 // logging macros.  This avoids compiler warnings like "value computed
 // is not used" and "statement has no effect".
 class LogMessageVoidify {
  public:
   LogMessageVoidify() { }
   // This has to be an operator with a precedence lower than << but
   // higher than ?:
@@ -900,24 +881,22 @@ class BASE_EXPORT ErrnoLogMessage {
 // NOTE: Since the log file is opened as necessary by the action of logging
 //       statements, there's no guarantee that it will stay closed
 //       after this call.
 BASE_EXPORT void CloseLogFile();
 
 // Async signal safe logging mechanism.
 BASE_EXPORT void RawLog(int level, const char* message);
 
-#define RAW_LOG(level, message) \
-  ::logging::RawLog(::logging::LOG_##level, message)
+#define RAW_LOG(level, message) logging::RawLog(logging::LOG_ ## level, message)
 
-#define RAW_CHECK(condition)                               \
-  do {                                                     \
-    if (!(condition))                                      \
-      ::logging::RawLog(::logging::LOG_FATAL,              \
-                        "Check failed: " #condition "\n"); \
+#define RAW_CHECK(condition)                                                   \
+  do {                                                                         \
+    if (!(condition))                                                          \
+      logging::RawLog(logging::LOG_FATAL, "Check failed: " #condition "\n");   \
   } while (0)
 
 #if defined(OS_WIN)
 // Returns true if logging to file is enabled.
 BASE_EXPORT bool IsLoggingToFileEnabled();
 
 // Returns the default log file path.
 BASE_EXPORT std::wstring GetLogFileFullPath();
--- a/security/sandbox/chromium/base/macros.h
+++ b/security/sandbox/chromium/base/macros.h
@@ -15,21 +15,21 @@
 // Put this in the declarations for a class to be uncopyable.
 #define DISALLOW_COPY(TypeName) \
   TypeName(const TypeName&) = delete
 
 // Put this in the declarations for a class to be unassignable.
 #define DISALLOW_ASSIGN(TypeName) \
   void operator=(const TypeName&) = delete
 
-// A macro to disallow the copy constructor and operator= functions.
-// This should be used in the private: declarations for a class.
+// A macro to disallow the copy constructor and operator= functions
+// This should be used in the private: declarations for a class
 #define DISALLOW_COPY_AND_ASSIGN(TypeName) \
-  TypeName(const TypeName&) = delete;      \
-  void operator=(const TypeName&) = delete
+  TypeName(const TypeName&);               \
+  void operator=(const TypeName&)
 
 // A macro to disallow all the implicit constructors, namely the
 // default constructor, copy constructor and operator= functions.
 //
 // This should be used in the private: declarations for a class
 // that wants to prevent anyone from instantiating it. This is
 // especially useful for classes containing only static methods.
 #define DISALLOW_IMPLICIT_CONSTRUCTORS(TypeName) \
@@ -47,17 +47,17 @@
 // use its type.
 template <typename T, size_t N> char (&ArraySizeHelper(T (&array)[N]))[N];
 #define arraysize(array) (sizeof(ArraySizeHelper(array)))
 
 // Used to explicitly mark the return value of a function as unused. If you are
 // really sure you don't want to do anything with the return value of a function
 // that has been marked WARN_UNUSED_RESULT, wrap it with this. Example:
 //
-//   std::unique_ptr<MyType> my_var = ...;
+//   scoped_ptr<MyType> my_var = ...;
 //   if (TakeOwnership(my_var.get()) == SUCCESS)
 //     ignore_result(my_var.release());
 //
 template<typename T>
 inline void ignore_result(const T&) {
 }
 
 // The following enum should be used only as a constructor argument to indicate
--- a/security/sandbox/chromium/base/memory/aligned_memory.h
+++ b/security/sandbox/chromium/base/memory/aligned_memory.h
@@ -21,19 +21,19 @@
 //
 // Alternatively, a runtime sized aligned allocation can be created:
 //
 //   float* my_array = static_cast<float*>(AlignedAlloc(size, alignment));
 //
 //   // ... later, to release the memory:
 //   AlignedFree(my_array);
 //
-// Or using unique_ptr:
+// Or using scoped_ptr:
 //
-//   std::unique_ptr<float, AlignedFreeDeleter> my_array(
+//   scoped_ptr<float, AlignedFreeDeleter> my_array(
 //       static_cast<float*>(AlignedAlloc(size, alignment)));
 
 #ifndef BASE_MEMORY_ALIGNED_MEMORY_H_
 #define BASE_MEMORY_ALIGNED_MEMORY_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ -99,18 +99,18 @@ BASE_EXPORT void* AlignedAlloc(size_t si
 inline void AlignedFree(void* ptr) {
 #if defined(COMPILER_MSVC)
   _aligned_free(ptr);
 #else
   free(ptr);
 #endif
 }
 
-// Deleter for use with unique_ptr. E.g., use as
-//   std::unique_ptr<Foo, base::AlignedFreeDeleter> foo;
+// Deleter for use with scoped_ptr. E.g., use as
+//   scoped_ptr<Foo, base::AlignedFreeDeleter> foo;
 struct AlignedFreeDeleter {
   inline void operator()(void* ptr) const {
     AlignedFree(ptr);
   }
 };
 
 }  // namespace base
 
deleted file mode 100644
--- a/security/sandbox/chromium/base/memory/free_deleter.h
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_MEMORY_FREE_DELETER_H_
-#define BASE_MEMORY_FREE_DELETER_H_
-
-#include <stdlib.h>
-
-namespace base {
-
-// Function object which invokes 'free' on its parameter, which must be
-// a pointer. Can be used to store malloc-allocated pointers in std::unique_ptr:
-//
-// std::unique_ptr<int, base::FreeDeleter> foo_ptr(
-//     static_cast<int*>(malloc(sizeof(int))));
-struct FreeDeleter {
-  inline void operator()(void* ptr) const {
-    free(ptr);
-  }
-};
-
-}  // namespace base
-
-#endif  // BASE_MEMORY_FREE_DELETER_H_
deleted file mode 100644
--- a/security/sandbox/chromium/base/memory/ptr_util.h
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_MEMORY_PTR_UTIL_H_
-#define BASE_MEMORY_PTR_UTIL_H_
-
-#include <memory>
-#include <utility>
-
-namespace base {
-
-// Helper to transfer ownership of a raw pointer to a std::unique_ptr<T>.
-// Note that std::unique_ptr<T> has very different semantics from
-// std::unique_ptr<T[]>: do not use this helper for array allocations.
-template <typename T>
-std::unique_ptr<T> WrapUnique(T* ptr) {
-  return std::unique_ptr<T>(ptr);
-}
-
-namespace internal {
-
-template <typename T>
-struct MakeUniqueResult {
-  using Scalar = std::unique_ptr<T>;
-};
-
-template <typename T>
-struct MakeUniqueResult<T[]> {
-  using Array = std::unique_ptr<T[]>;
-};
-
-template <typename T, size_t N>
-struct MakeUniqueResult<T[N]> {
-  using Invalid = void;
-};
-
-}  // namespace internal
-
-// Helper to construct an object wrapped in a std::unique_ptr. This is an
-// implementation of C++14's std::make_unique that can be used in Chrome.
-//
-// MakeUnique<T>(args) should be preferred over WrapUnique(new T(args)): bare
-// calls to `new` should be treated with scrutiny.
-//
-// Usage:
-//   // ptr is a std::unique_ptr<std::string>
-//   auto ptr = MakeUnique<std::string>("hello world!");
-//
-//   // arr is a std::unique_ptr<int[]>
-//   auto arr = MakeUnique<int[]>(5);
-
-// Overload for non-array types. Arguments are forwarded to T's constructor.
-template <typename T, typename... Args>
-typename internal::MakeUniqueResult<T>::Scalar MakeUnique(Args&&... args) {
-  return std::unique_ptr<T>(new T(std::forward<Args>(args)...));
-}
-
-// Overload for array types of unknown bound, e.g. T[]. The array is allocated
-// with `new T[n]()` and value-initialized: note that this is distinct from
-// `new T[n]`, which default-initializes.
-template <typename T>
-typename internal::MakeUniqueResult<T>::Array MakeUnique(size_t size) {
-  return std::unique_ptr<T>(new typename std::remove_extent<T>::type[size]());
-}
-
-// Overload to reject array types of known bound, e.g. T[n].
-template <typename T, typename... Args>
-typename internal::MakeUniqueResult<T>::Invalid MakeUnique(Args&&... args) =
-    delete;
-
-}  // namespace base
-
-#endif  // BASE_MEMORY_PTR_UTIL_H_
--- a/security/sandbox/chromium/base/memory/raw_scoped_refptr_mismatch_checker.h
+++ b/security/sandbox/chromium/base/memory/raw_scoped_refptr_mismatch_checker.h
@@ -1,58 +1,64 @@
 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MEMORY_RAW_SCOPED_REFPTR_MISMATCH_CHECKER_H_
 #define BASE_MEMORY_RAW_SCOPED_REFPTR_MISMATCH_CHECKER_H_
 
-#include <tuple>
-#include <type_traits>
-
 #include "base/memory/ref_counted.h"
+#include "base/template_util.h"
+#include "base/tuple.h"
+#include "build/build_config.h"
 
 // It is dangerous to post a task with a T* argument where T is a subtype of
 // RefCounted(Base|ThreadSafeBase), since by the time the parameter is used, the
 // object may already have been deleted since it was not held with a
 // scoped_refptr. Example: http://crbug.com/27191
 // The following set of traits are designed to generate a compile error
 // whenever this antipattern is attempted.
 
 namespace base {
 
 // This is a base internal implementation file used by task.h and callback.h.
 // Not for public consumption, so we wrap it in namespace internal.
 namespace internal {
 
 template <typename T>
 struct NeedsScopedRefptrButGetsRawPtr {
+#if defined(OS_WIN)
+  enum {
+    value = base::false_type::value
+  };
+#else
   enum {
     // Human readable translation: you needed to be a scoped_refptr if you are a
     // raw pointer type and are convertible to a RefCounted(Base|ThreadSafeBase)
     // type.
-    value = (std::is_pointer<T>::value &&
-             (std::is_convertible<T, subtle::RefCountedBase*>::value ||
-              std::is_convertible<T, subtle::RefCountedThreadSafeBase*>::value))
+    value = (is_pointer<T>::value &&
+             (is_convertible<T, subtle::RefCountedBase*>::value ||
+              is_convertible<T, subtle::RefCountedThreadSafeBase*>::value))
   };
+#endif
 };
 
 template <typename Params>
 struct ParamsUseScopedRefptrCorrectly {
   enum { value = 0 };
 };
 
 template <>
-struct ParamsUseScopedRefptrCorrectly<std::tuple<>> {
+struct ParamsUseScopedRefptrCorrectly<Tuple<>> {
   enum { value = 1 };
 };
 
 template <typename Head, typename... Tail>
-struct ParamsUseScopedRefptrCorrectly<std::tuple<Head, Tail...>> {
+struct ParamsUseScopedRefptrCorrectly<Tuple<Head, Tail...>> {
   enum { value = !NeedsScopedRefptrButGetsRawPtr<Head>::value &&
-                  ParamsUseScopedRefptrCorrectly<std::tuple<Tail...>>::value };
+                 ParamsUseScopedRefptrCorrectly<Tuple<Tail...>>::value };
 };
 
 }  // namespace internal
 
 }  // namespace base
 
 #endif  // BASE_MEMORY_RAW_SCOPED_REFPTR_MISMATCH_CHECKER_H_
--- a/security/sandbox/chromium/base/memory/ref_counted.cc
+++ b/security/sandbox/chromium/base/memory/ref_counted.cc
@@ -10,42 +10,42 @@ namespace base {
 namespace subtle {
 
 bool RefCountedThreadSafeBase::HasOneRef() const {
   return AtomicRefCountIsOne(
       &const_cast<RefCountedThreadSafeBase*>(this)->ref_count_);
 }
 
 RefCountedThreadSafeBase::RefCountedThreadSafeBase() : ref_count_(0) {
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   in_dtor_ = false;
 #endif
 }
 
 RefCountedThreadSafeBase::~RefCountedThreadSafeBase() {
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   DCHECK(in_dtor_) << "RefCountedThreadSafe object deleted without "
                       "calling Release()";
 #endif
 }
 
 void RefCountedThreadSafeBase::AddRef() const {
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   DCHECK(!in_dtor_);
 #endif
   AtomicRefCountInc(&ref_count_);
 }
 
 bool RefCountedThreadSafeBase::Release() const {
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   DCHECK(!in_dtor_);
   DCHECK(!AtomicRefCountIsZero(&ref_count_));
 #endif
   if (!AtomicRefCountDec(&ref_count_)) {
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
     in_dtor_ = true;
 #endif
     return true;
   }
   return false;
 }
 
 }  // namespace subtle
--- a/security/sandbox/chromium/base/memory/ref_counted.h
+++ b/security/sandbox/chromium/base/memory/ref_counted.h
@@ -1,85 +1,84 @@
 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MEMORY_REF_COUNTED_H_
 #define BASE_MEMORY_REF_COUNTED_H_
 
-#include <stddef.h>
-
 #include <cassert>
 #include <iosfwd>
-#include <type_traits>
 
 #include "base/atomic_ref_count.h"
 #include "base/base_export.h"
 #include "base/compiler_specific.h"
+#include "base/macros.h"
+#ifndef NDEBUG
 #include "base/logging.h"
-#include "base/macros.h"
+#endif
 #include "base/threading/thread_collision_warner.h"
 #include "build/build_config.h"
 
 namespace base {
 
 namespace subtle {
 
 class BASE_EXPORT RefCountedBase {
  public:
   bool HasOneRef() const { return ref_count_ == 1; }
 
  protected:
   RefCountedBase()
       : ref_count_(0)
-#if DCHECK_IS_ON()
-        , in_dtor_(false)
-#endif
-  {
+  #ifndef NDEBUG
+      , in_dtor_(false)
+  #endif
+      {
   }
 
   ~RefCountedBase() {
-#if DCHECK_IS_ON()
+  #ifndef NDEBUG
     DCHECK(in_dtor_) << "RefCounted object deleted without calling Release()";
-#endif
+  #endif
   }
 
 
   void AddRef() const {
     // TODO(maruel): Add back once it doesn't assert 500 times/sec.
     // Current thread books the critical section "AddRelease"
     // without release it.
     // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
-#if DCHECK_IS_ON()
+  #ifndef NDEBUG
     DCHECK(!in_dtor_);
-#endif
+  #endif
     ++ref_count_;
   }
 
   // Returns true if the object should self-delete.
   bool Release() const {
     // TODO(maruel): Add back once it doesn't assert 500 times/sec.
     // Current thread books the critical section "AddRelease"
     // without release it.
     // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
-#if DCHECK_IS_ON()
+  #ifndef NDEBUG
     DCHECK(!in_dtor_);
-#endif
+  #endif
     if (--ref_count_ == 0) {
-#if DCHECK_IS_ON()
+  #ifndef NDEBUG
       in_dtor_ = true;
-#endif
+  #endif
       return true;
     }
     return false;
   }
 
  private:
-  mutable size_t ref_count_;
-#if DCHECK_IS_ON()
+  mutable int ref_count_;
+#ifndef NDEBUG
   mutable bool in_dtor_;
 #endif
 
   DFAKE_MUTEX(add_release_);
 
   DISALLOW_COPY_AND_ASSIGN(RefCountedBase);
 };
 
@@ -93,56 +92,56 @@ class BASE_EXPORT RefCountedThreadSafeBa
 
   void AddRef() const;
 
   // Returns true if the object should self-delete.
   bool Release() const;
 
  private:
   mutable AtomicRefCount ref_count_;
-#if DCHECK_IS_ON()
+#ifndef NDEBUG
   mutable bool in_dtor_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafeBase);
 };
 
 }  // namespace subtle
 
 //
 // A base class for reference counted classes.  Otherwise, known as a cheap
-// knock-off of WebKit's RefCounted<T> class.  To use this, just extend your
+// knock-off of WebKit's RefCounted<T> class.  To use this guy just extend your
 // class from it like so:
 //
 //   class MyFoo : public base::RefCounted<MyFoo> {
 //    ...
 //    private:
 //     friend class base::RefCounted<MyFoo>;
 //     ~MyFoo();
 //   };
 //
 // You should always make your destructor non-public, to avoid any code deleting
 // the object accidently while there are references to it.
 template <class T>
 class RefCounted : public subtle::RefCountedBase {
  public:
-  RefCounted() = default;
+  RefCounted() {}
 
   void AddRef() const {
     subtle::RefCountedBase::AddRef();
   }
 
   void Release() const {
     if (subtle::RefCountedBase::Release()) {
       delete static_cast<const T*>(this);
     }
   }
 
  protected:
-  ~RefCounted() = default;
+  ~RefCounted() {}
 
  private:
   DISALLOW_COPY_AND_ASSIGN(RefCounted<T>);
 };
 
 // Forward declaration.
 template <class T, typename Traits> class RefCountedThreadSafe;
 
@@ -169,30 +168,30 @@ struct DefaultRefCountedThreadSafeTraits
 // If you're using the default trait, then you should add compile time
 // asserts that no one else is deleting your object.  i.e.
 //    private:
 //     friend class base::RefCountedThreadSafe<MyFoo>;
 //     ~MyFoo();
 template <class T, typename Traits = DefaultRefCountedThreadSafeTraits<T> >
 class RefCountedThreadSafe : public subtle::RefCountedThreadSafeBase {
  public:
-  RefCountedThreadSafe() = default;
+  RefCountedThreadSafe() {}
 
   void AddRef() const {
     subtle::RefCountedThreadSafeBase::AddRef();
   }
 
   void Release() const {
     if (subtle::RefCountedThreadSafeBase::Release()) {
       Traits::Destruct(static_cast<const T*>(this));
     }
   }
 
  protected:
-  ~RefCountedThreadSafe() = default;
+  ~RefCountedThreadSafe() {}
 
  private:
   friend struct DefaultRefCountedThreadSafeTraits<T>;
   static void DeleteInternal(const T* x) { delete x; }
 
   DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafe);
 };
 
@@ -206,17 +205,17 @@ class RefCountedData
  public:
   RefCountedData() : data() {}
   RefCountedData(const T& in_value) : data(in_value) {}
 
   T data;
 
  private:
   friend class base::RefCountedThreadSafe<base::RefCountedData<T> >;
-  ~RefCountedData() = default;
+  ~RefCountedData() {}
 };
 
 }  // namespace base
 
 //
 // A smart pointer class for reference counted objects.  Use this class instead
 // of calling AddRef and Release manually on a reference counted object to
 // avoid common memory leaks caused by forgetting to Release an object
@@ -230,32 +229,32 @@ class RefCountedData
 //     scoped_refptr<MyFoo> foo = new MyFoo();
 //     foo->Method(param);
 //     // |foo| is released when this function returns
 //   }
 //
 //   void some_other_function() {
 //     scoped_refptr<MyFoo> foo = new MyFoo();
 //     ...
-//     foo = nullptr;  // explicitly releases |foo|
+//     foo = NULL;  // explicitly releases |foo|
 //     ...
 //     if (foo)
 //       foo->Method(param);
 //   }
 //
 // The above examples show how scoped_refptr<T> acts like a pointer to T.
 // Given two scoped_refptr<T> classes, it is also possible to exchange
 // references between the two objects, like so:
 //
 //   {
 //     scoped_refptr<MyFoo> a = new MyFoo();
 //     scoped_refptr<MyFoo> b;
 //
 //     b.swap(a);
-//     // now, |b| references the MyFoo object, and |a| references nullptr.
+//     // now, |b| references the MyFoo object, and |a| references NULL.
 //   }
 //
 // To make both |a| and |b| in the above example reference the same MyFoo
 // object, simply use the assignment operator:
 //
 //   {
 //     scoped_refptr<MyFoo> a = new MyFoo();
 //     scoped_refptr<MyFoo> b;
@@ -264,64 +263,61 @@ class RefCountedData
 //     // now, |a| and |b| each own a reference to the same MyFoo object.
 //   }
 //
 template <class T>
 class scoped_refptr {
  public:
   typedef T element_type;
 
-  scoped_refptr() {}
+  scoped_refptr() : ptr_(NULL) {
+  }
 
   scoped_refptr(T* p) : ptr_(p) {
     if (ptr_)
       AddRef(ptr_);
   }
 
   // Copy constructor.
   scoped_refptr(const scoped_refptr<T>& r) : ptr_(r.ptr_) {
     if (ptr_)
       AddRef(ptr_);
   }
 
   // Copy conversion constructor.
-  template <typename U,
-            typename = typename std::enable_if<
-                std::is_convertible<U*, T*>::value>::type>
+  template <typename U>
   scoped_refptr(const scoped_refptr<U>& r) : ptr_(r.get()) {
     if (ptr_)
       AddRef(ptr_);
   }
 
   // Move constructor. This is required in addition to the conversion
   // constructor below in order for clang to warn about pessimizing moves.
   scoped_refptr(scoped_refptr&& r) : ptr_(r.get()) { r.ptr_ = nullptr; }
 
   // Move conversion constructor.
-  template <typename U,
-            typename = typename std::enable_if<
-                std::is_convertible<U*, T*>::value>::type>
+  template <typename U>
   scoped_refptr(scoped_refptr<U>&& r) : ptr_(r.get()) {
     r.ptr_ = nullptr;
   }
 
   ~scoped_refptr() {
     if (ptr_)
       Release(ptr_);
   }
 
   T* get() const { return ptr_; }
 
   T& operator*() const {
-    assert(ptr_ != nullptr);
+    assert(ptr_ != NULL);
     return *ptr_;
   }
 
   T* operator->() const {
-    assert(ptr_ != nullptr);
+    assert(ptr_ != NULL);
     return ptr_;
   }
 
   scoped_refptr<T>& operator=(T* p) {
     // AddRef first so that self assignment should work
     if (p)
       AddRef(p);
     T* old_ptr = ptr_;
@@ -356,17 +352,30 @@ class scoped_refptr {
     ptr_ = *pp;
     *pp = p;
   }
 
   void swap(scoped_refptr<T>& r) {
     swap(&r.ptr_);
   }
 
-  explicit operator bool() const { return ptr_ != nullptr; }
+ private:
+  template <typename U> friend class scoped_refptr;
+
+  // Allow scoped_refptr<T> to be used in boolean expressions, but not
+  // implicitly convertible to a real bool (which is dangerous).
+  //
+  // Note that this trick is only safe when the == and != operators
+  // are declared explicitly, as otherwise "refptr1 == refptr2"
+  // will compile but do the wrong thing (i.e., convert to Testable
+  // and then do the comparison).
+  typedef T* scoped_refptr::*Testable;
+
+ public:
+  operator Testable() const { return ptr_ ? &scoped_refptr::ptr_ : nullptr; }
 
   template <typename U>
   bool operator==(const scoped_refptr<U>& rhs) const {
     return ptr_ == rhs.get();
   }
 
   template <typename U>
   bool operator!=(const scoped_refptr<U>& rhs) const {
@@ -374,88 +383,64 @@ class scoped_refptr {
   }
 
   template <typename U>
   bool operator<(const scoped_refptr<U>& rhs) const {
     return ptr_ < rhs.get();
   }
 
  protected:
-  T* ptr_ = nullptr;
+  T* ptr_;
 
  private:
-  // Friend required for move constructors that set r.ptr_ to null.
-  template <typename U>
-  friend class scoped_refptr;
-
   // Non-inline helpers to allow:
   //     class Opaque;
   //     extern template class scoped_refptr<Opaque>;
   // Otherwise the compiler will complain that Opaque is an incomplete type.
   static void AddRef(T* ptr);
   static void Release(T* ptr);
 };
 
-// static
 template <typename T>
 void scoped_refptr<T>::AddRef(T* ptr) {
   ptr->AddRef();
 }
 
-// static
 template <typename T>
 void scoped_refptr<T>::Release(T* ptr) {
   ptr->Release();
 }
 
 // Handy utility for creating a scoped_refptr<T> out of a T* explicitly without
 // having to retype all the template arguments
 template <typename T>
 scoped_refptr<T> make_scoped_refptr(T* t) {
   return scoped_refptr<T>(t);
 }
 
+// Temporary operator overloads to facilitate the transition. See
+// https://crbug.com/110610.
 template <typename T, typename U>
 bool operator==(const scoped_refptr<T>& lhs, const U* rhs) {
   return lhs.get() == rhs;
 }
 
 template <typename T, typename U>
 bool operator==(const T* lhs, const scoped_refptr<U>& rhs) {
   return lhs == rhs.get();
 }
 
-template <typename T>
-bool operator==(const scoped_refptr<T>& lhs, std::nullptr_t null) {
-  return !static_cast<bool>(lhs);
-}
-
-template <typename T>
-bool operator==(std::nullptr_t null, const scoped_refptr<T>& rhs) {
-  return !static_cast<bool>(rhs);
-}
-
 template <typename T, typename U>
 bool operator!=(const scoped_refptr<T>& lhs, const U* rhs) {
   return !operator==(lhs, rhs);
 }
 
 template <typename T, typename U>
 bool operator!=(const T* lhs, const scoped_refptr<U>& rhs) {
   return !operator==(lhs, rhs);
 }
 
 template <typename T>
-bool operator!=(const scoped_refptr<T>& lhs, std::nullptr_t null) {
-  return !operator==(lhs, null);
-}
-
-template <typename T>
-bool operator!=(std::nullptr_t null, const scoped_refptr<T>& rhs) {
-  return !operator==(null, rhs);
-}
-
-template <typename T>
 std::ostream& operator<<(std::ostream& out, const scoped_refptr<T>& p) {
   return out << p.get();
 }
 
 #endif  // BASE_MEMORY_REF_COUNTED_H_
new file mode 100644
--- /dev/null
+++ b/security/sandbox/chromium/base/memory/scoped_ptr.h
@@ -0,0 +1,607 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Scopers help you manage ownership of a pointer, helping you easily manage a
+// pointer within a scope, and automatically destroying the pointer at the end
+// of a scope.  There are two main classes you will use, which correspond to the
+// operators new/delete and new[]/delete[].
+//
+// Example usage (scoped_ptr<T>):
+//   {
+//     scoped_ptr<Foo> foo(new Foo("wee"));
+//   }  // foo goes out of scope, releasing the pointer with it.
+//
+//   {
+//     scoped_ptr<Foo> foo;          // No pointer managed.
+//     foo.reset(new Foo("wee"));    // Now a pointer is managed.
+//     foo.reset(new Foo("wee2"));   // Foo("wee") was destroyed.
+//     foo.reset(new Foo("wee3"));   // Foo("wee2") was destroyed.
+//     foo->Method();                // Foo::Method() called.
+//     foo.get()->Method();          // Foo::Method() called.
+//     SomeFunc(foo.release());      // SomeFunc takes ownership, foo no longer
+//                                   // manages a pointer.
+//     foo.reset(new Foo("wee4"));   // foo manages a pointer again.
+//     foo.reset();                  // Foo("wee4") destroyed, foo no longer
+//                                   // manages a pointer.
+//   }  // foo wasn't managing a pointer, so nothing was destroyed.
+//
+// Example usage (scoped_ptr<T[]>):
+//   {
+//     scoped_ptr<Foo[]> foo(new Foo[100]);
+//     foo.get()->Method();  // Foo::Method on the 0th element.
+//     foo[10].Method();     // Foo::Method on the 10th element.
+//   }
+//
+// These scopers also implement part of the functionality of C++11 unique_ptr
+// in that they are "movable but not copyable."  You can use the scopers in
+// the parameter and return types of functions to signify ownership transfer
+// in to and out of a function.  When calling a function that has a scoper
+// as the argument type, it must be called with an rvalue of a scoper, which
+// can be created by using std::move(), or the result of another function that
+// generates a temporary; passing by copy will NOT work.  Here is an example
+// using scoped_ptr:
+//
+//   void TakesOwnership(scoped_ptr<Foo> arg) {
+//     // Do something with arg.
+//   }
+//   scoped_ptr<Foo> CreateFoo() {
+//     // No need for calling std::move() for returning a move-only value, or
+//     // when you already have an rvalue as we do here.
+//     return scoped_ptr<Foo>(new Foo("new"));
+//   }
+//   scoped_ptr<Foo> PassThru(scoped_ptr<Foo> arg) {
+//     return arg;
+//   }
+//
+//   {
+//     scoped_ptr<Foo> ptr(new Foo("yay"));  // ptr manages Foo("yay").
+//     TakesOwnership(std::move(ptr));       // ptr no longer owns Foo("yay").
+//     scoped_ptr<Foo> ptr2 = CreateFoo();   // ptr2 owns the return Foo.
+//     scoped_ptr<Foo> ptr3 =                // ptr3 now owns what was in ptr2.
+//         PassThru(std::move(ptr2));        // ptr2 is correspondingly nullptr.
+//   }
+//
+// Notice that if you do not call std::move() when returning from PassThru(), or
+// when invoking TakesOwnership(), the code will not compile because scopers
+// are not copyable; they only implement move semantics which require calling
+// the std::move() function to signify a destructive transfer of state.
+// CreateFoo() is different though because we are constructing a temporary on
+// the return line and thus can avoid needing to call std::move().
+//
+// The conversion move-constructor properly handles upcast in initialization,
+// i.e. you can use a scoped_ptr<Child> to initialize a scoped_ptr<Parent>:
+//
+//   scoped_ptr<Foo> foo(new Foo());
+//   scoped_ptr<FooParent> parent(std::move(foo));
+
+#ifndef BASE_MEMORY_SCOPED_PTR_H_
+#define BASE_MEMORY_SCOPED_PTR_H_
+
+// This is an implementation designed to match the anticipated future TR2
+// implementation of the scoped_ptr class.
+
+#include <assert.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+#include <iosfwd>
+#include <memory>
+#include <type_traits>
+#include <utility>
+
+#include "base/compiler_specific.h"
+#include "base/macros.h"
+#include "base/move.h"
+#include "base/template_util.h"
+
+namespace base {
+
+namespace subtle {
+class RefCountedBase;
+class RefCountedThreadSafeBase;
+}  // namespace subtle
+
+// Function object which invokes 'free' on its parameter, which must be
+// a pointer. Can be used to store malloc-allocated pointers in scoped_ptr:
+//
+// scoped_ptr<int, base::FreeDeleter> foo_ptr(
+//     static_cast<int*>(malloc(sizeof(int))));
+struct FreeDeleter {
+  inline void operator()(void* ptr) const {
+    free(ptr);
+  }
+};
+
+namespace internal {
+
+template <typename T> struct IsNotRefCounted {
+  enum {
+    value = !base::is_convertible<T*, base::subtle::RefCountedBase*>::value &&
+        !base::is_convertible<T*, base::subtle::RefCountedThreadSafeBase*>::
+            value
+  };
+};
+
+// Minimal implementation of the core logic of scoped_ptr, suitable for
+// reuse in both scoped_ptr and its specializations.
+template <class T, class D>
+class scoped_ptr_impl {
+ public:
+  explicit scoped_ptr_impl(T* p) : data_(p) {}
+
+  // Initializer for deleters that have data parameters.
+  scoped_ptr_impl(T* p, const D& d) : data_(p, d) {}
+
+  // Templated constructor that destructively takes the value from another
+  // scoped_ptr_impl.
+  template <typename U, typename V>
+  scoped_ptr_impl(scoped_ptr_impl<U, V>* other)
+      : data_(other->release(), other->get_deleter()) {
+    // We do not support move-only deleters.  We could modify our move
+    // emulation to have base::subtle::move() and base::subtle::forward()
+    // functions that are imperfect emulations of their C++11 equivalents,
+    // but until there's a requirement, just assume deleters are copyable.
+  }
+
+  template <typename U, typename V>
+  void TakeState(scoped_ptr_impl<U, V>* other) {
+    // See comment in templated constructor above regarding lack of support
+    // for move-only deleters.
+    reset(other->release());
+    get_deleter() = other->get_deleter();
+  }
+
+  ~scoped_ptr_impl() {
+    // Match libc++, which calls reset() in its destructor.
+    // Use nullptr as the new value for three reasons:
+    // 1. libc++ does it.
+    // 2. Avoids infinitely recursing into destructors if two classes are owned
+    //    in a reference cycle (see ScopedPtrTest.ReferenceCycle).
+    // 3. If |this| is accessed in the future, in a use-after-free bug, attempts
+    //    to dereference |this|'s pointer should cause either a failure or a
+    //    segfault closer to the problem. If |this| wasn't reset to nullptr,
+    //    the access would cause the deleted memory to be read or written
+    //    leading to other more subtle issues.
+    reset(nullptr);
+  }
+
+  void reset(T* p) {
+    // Match C++11's definition of unique_ptr::reset(), which requires changing
+    // the pointer before invoking the deleter on the old pointer. This prevents
+    // |this| from being accessed after the deleter is run, which may destroy
+    // |this|.
+    T* old = data_.ptr;
+    data_.ptr = p;
+    if (old != nullptr)
+      static_cast<D&>(data_)(old);
+  }
+
+  T* get() const { return data_.ptr; }
+
+  D& get_deleter() { return data_; }
+  const D& get_deleter() const { return data_; }
+
+  void swap(scoped_ptr_impl& p2) {
+    // Standard swap idiom: 'using std::swap' ensures that std::swap is
+    // present in the overload set, but we call swap unqualified so that
+    // any more-specific overloads can be used, if available.
+    using std::swap;
+    swap(static_cast<D&>(data_), static_cast<D&>(p2.data_));
+    swap(data_.ptr, p2.data_.ptr);
+  }
+
+  T* release() {
+    T* old_ptr = data_.ptr;
+    data_.ptr = nullptr;
+    return old_ptr;
+  }
+
+ private:
+  // Needed to allow type-converting constructor.
+  template <typename U, typename V> friend class scoped_ptr_impl;
+
+  // Use the empty base class optimization to allow us to have a D
+  // member, while avoiding any space overhead for it when D is an
+  // empty class.  See e.g. http://www.cantrip.org/emptyopt.html for a good
+  // discussion of this technique.
+  struct Data : public D {
+    explicit Data(T* ptr_in) : ptr(ptr_in) {}
+    Data(T* ptr_in, const D& other) : D(other), ptr(ptr_in) {}
+    T* ptr;
+  };
+
+  Data data_;
+
+  DISALLOW_COPY_AND_ASSIGN(scoped_ptr_impl);
+};
+
+}  // namespace internal
+
+}  // namespace base
+
+// A scoped_ptr<T> is like a T*, except that the destructor of scoped_ptr<T>
+// automatically deletes the pointer it holds (if any).
+// That is, scoped_ptr<T> owns the T object that it points to.
+// Like a T*, a scoped_ptr<T> may hold either nullptr or a pointer to a T
+// object. Also like T*, scoped_ptr<T> is thread-compatible, and once you
+// dereference it, you get the thread safety guarantees of T.
+//
+// The size of scoped_ptr is small. On most compilers, when using the
+// std::default_delete, sizeof(scoped_ptr<T>) == sizeof(T*). Custom deleters
+// will increase the size proportional to whatever state they need to have. See
+// comments inside scoped_ptr_impl<> for details.
+//
+// Current implementation targets having a strict subset of  C++11's
+// unique_ptr<> features. Known deficiencies include not supporting move-only
+// deleteres, function pointers as deleters, and deleters with reference
+// types.
+template <class T, class D = std::default_delete<T>>
+class scoped_ptr {
+  DISALLOW_COPY_AND_ASSIGN_WITH_MOVE_FOR_BIND(scoped_ptr)
+
+  static_assert(!std::is_array<T>::value,
+                "scoped_ptr doesn't support array with size");
+  static_assert(base::internal::IsNotRefCounted<T>::value,
+                "T is a refcounted type and needs a scoped_refptr");
+
+ public:
+  // The element and deleter types.
+  using element_type = T;
+  using deleter_type = D;
+
+  // Constructor.  Defaults to initializing with nullptr.
+  scoped_ptr() : impl_(nullptr) {}
+
+  // Constructor.  Takes ownership of p.
+  explicit scoped_ptr(element_type* p) : impl_(p) {}
+
+  // Constructor.  Allows initialization of a stateful deleter.
+  scoped_ptr(element_type* p, const D& d) : impl_(p, d) {}
+
+  // Constructor.  Allows construction from a nullptr.
+  scoped_ptr(std::nullptr_t) : impl_(nullptr) {}
+
+  // Move constructor.
+  //
+  // IMPLEMENTATION NOTE: Clang requires a move constructor to be defined (and
+  // not just the conversion constructor) in order to warn on pessimizing moves.
+  // The requirements for the move constructor are specified in C++11
+  // 20.7.1.2.1.15-17, which has some subtleties around reference deleters. As
+  // we don't support reference (or move-only) deleters, the post conditions are
+  // trivially true: we always copy construct the deleter from other's deleter.
+  scoped_ptr(scoped_ptr&& other) : impl_(&other.impl_) {}
+
+  // Conversion constructor.  Allows construction from a scoped_ptr rvalue for a
+  // convertible type and deleter.
+  //
+  // IMPLEMENTATION NOTE: C++ 20.7.1.2.1.19 requires this constructor to only
+  // participate in overload resolution if all the following are true:
+  // - U is implicitly convertible to T: this is important for 2 reasons:
+  //     1. So type traits don't incorrectly return true, e.g.
+  //          std::is_convertible<scoped_ptr<Base>, scoped_ptr<Derived>>::value
+  //        should be false.
+  //     2. To make sure code like this compiles:
+  //        void F(scoped_ptr<int>);
+  //        void F(scoped_ptr<Base>);
+  //        // Ambiguous since both conversion constructors match.
+  //        F(scoped_ptr<Derived>());
+  // - U is not an array type: to prevent conversions from scoped_ptr<T[]> to
+  //   scoped_ptr<T>.
+  // - D is a reference type and E is the same type, or D is not a reference
+  //   type and E is implicitly convertible to D: again, we don't support
+  //   reference deleters, so we only worry about the latter requirement.
+  template <typename U,
+            typename E,
+            typename std::enable_if<!std::is_array<U>::value &&
+                                    std::is_convertible<U*, T*>::value &&
+                                    std::is_convertible<E, D>::value>::type* =
+                nullptr>
+  scoped_ptr(scoped_ptr<U, E>&& other)
+      : impl_(&other.impl_) {}
+
+  // operator=.
+  //
+  // IMPLEMENTATION NOTE: Unlike the move constructor, Clang does not appear to
+  // require a move assignment operator to trigger the pessimizing move warning:
+  // in this case, the warning triggers when moving a temporary. For consistency
+  // with the move constructor, we define it anyway. C++11 20.7.1.2.3.1-3
+  // defines several requirements around this: like the move constructor, the
+  // requirements are simplified by the fact that we don't support move-only or
+  // reference deleters.
+  scoped_ptr& operator=(scoped_ptr&& rhs) {
+    impl_.TakeState(&rhs.impl_);
+    return *this;
+  }
+
+  // operator=.  Allows assignment from a scoped_ptr rvalue for a convertible
+  // type and deleter.
+  //
+  // IMPLEMENTATION NOTE: C++11 unique_ptr<> keeps this operator= distinct from
+  // the normal move assignment operator. C++11 20.7.1.2.3.4-7 contains the
+  // requirement for this operator, but like the conversion constructor, the
+  // requirements are greatly simplified by not supporting move-only or
+  // reference deleters.
+  template <typename U,
+            typename E,
+            typename std::enable_if<!std::is_array<U>::value &&
+                                    std::is_convertible<U*, T*>::value &&
+                                    // Note that this really should be
+                                    // std::is_assignable, but <type_traits>
+                                    // appears to be missing this on some
+                                    // platforms. This is close enough (though
+                                    // it's not the same).
+                                    std::is_convertible<D, E>::value>::type* =
+                nullptr>
+  scoped_ptr& operator=(scoped_ptr<U, E>&& rhs) {
+    impl_.TakeState(&rhs.impl_);
+    return *this;
+  }
+
+  // operator=.  Allows assignment from a nullptr. Deletes the currently owned
+  // object, if any.
+  scoped_ptr& operator=(std::nullptr_t) {
+    reset();
+    return *this;
+  }
+
+  // Reset.  Deletes the currently owned object, if any.
+  // Then takes ownership of a new object, if given.
+  void reset(element_type* p = nullptr) { impl_.reset(p); }
+
+  // Accessors to get the owned object.
+  // operator* and operator-> will assert() if there is no current object.
+  element_type& operator*() const {
+    assert(impl_.get() != nullptr);
+    return *impl_.get();
+  }
+  element_type* operator->() const  {
+    assert(impl_.get() != nullptr);
+    return impl_.get();
+  }
+  element_type* get() const { return impl_.get(); }
+
+  // Access to the deleter.
+  deleter_type& get_deleter() { return impl_.get_deleter(); }
+  const deleter_type& get_deleter() const { return impl_.get_deleter(); }
+
+  // Allow scoped_ptr<element_type> to be used in boolean expressions, but not
+  // implicitly convertible to a real bool (which is dangerous).
+  //
+  // Note that this trick is only safe when the == and != operators
+  // are declared explicitly, as otherwise "scoped_ptr1 ==
+  // scoped_ptr2" will compile but do the wrong thing (i.e., convert
+  // to Testable and then do the comparison).
+ private:
+  typedef base::internal::scoped_ptr_impl<element_type, deleter_type>
+      scoped_ptr::*Testable;
+
+ public:
+  operator Testable() const {
+    return impl_.get() ? &scoped_ptr::impl_ : nullptr;
+  }
+
+  // Swap two scoped pointers.
+  void swap(scoped_ptr& p2) {
+    impl_.swap(p2.impl_);
+  }
+
+  // Release a pointer.
+  // The return value is the current pointer held by this object. If this object
+  // holds a nullptr, the return value is nullptr. After this operation, this
+  // object will hold a nullptr, and will not own the object any more.
+  element_type* release() WARN_UNUSED_RESULT {
+    return impl_.release();
+  }
+
+ private:
+  // Needed to reach into |impl_| in the constructor.
+  template <typename U, typename V> friend class scoped_ptr;
+  base::internal::scoped_ptr_impl<element_type, deleter_type> impl_;
+
+  // Forbidden for API compatibility with std::unique_ptr.
+  explicit scoped_ptr(int disallow_construction_from_null);
+};
+
+template <class T, class D>
+class scoped_ptr<T[], D> {
+  DISALLOW_COPY_AND_ASSIGN_WITH_MOVE_FOR_BIND(scoped_ptr)
+
+ public:
+  // The element and deleter types.
+  using element_type = T;
+  using deleter_type = D;
+
+  // Constructor.  Defaults to initializing with nullptr.
+  scoped_ptr() : impl_(nullptr) {}
+
+  // Constructor. Stores the given array. Note that the argument's type
+  // must exactly match T*. In particular:
+  // - it cannot be a pointer to a type derived from T, because it is
+  //   inherently unsafe in the general case to access an array through a
+  //   pointer whose dynamic type does not match its static type (eg., if
+  //   T and the derived types had different sizes access would be
+  //   incorrectly calculated). Deletion is also always undefined
+  //   (C++98 [expr.delete]p3). If you're doing this, fix your code.
+  // - it cannot be const-qualified differently from T per unique_ptr spec
+  //   (http://cplusplus.github.com/LWG/lwg-active.html#2118). Users wanting
+  //   to work around this may use const_cast<const T*>().
+  explicit scoped_ptr(element_type* array) : impl_(array) {}
+
+  // Constructor.  Allows construction from a nullptr.
+  scoped_ptr(std::nullptr_t) : impl_(nullptr) {}
+
+  // Constructor.  Allows construction from a scoped_ptr rvalue.
+  scoped_ptr(scoped_ptr&& other) : impl_(&other.impl_) {}
+
+  // operator=.  Allows assignment from a scoped_ptr rvalue.
+  scoped_ptr& operator=(scoped_ptr&& rhs) {
+    impl_.TakeState(&rhs.impl_);
+    return *this;
+  }
+
+  // operator=.  Allows assignment from a nullptr. Deletes the currently owned
+  // array, if any.
+  scoped_ptr& operator=(std::nullptr_t) {
+    reset();
+    return *this;
+  }
+
+  // Reset.  Deletes the currently owned array, if any.
+  // Then takes ownership of a new object, if given.
+  void reset(element_type* array = nullptr) { impl_.reset(array); }
+
+  // Accessors to get the owned array.
+  element_type& operator[](size_t i) const {
+    assert(impl_.get() != nullptr);
+    return impl_.get()[i];
+  }
+  element_type* get() const { return impl_.get(); }
+
+  // Access to the deleter.
+  deleter_type& get_deleter() { return impl_.get_deleter(); }
+  const deleter_type& get_deleter() const { return impl_.get_deleter(); }
+
+  // Allow scoped_ptr<element_type> to be used in boolean expressions, but not
+  // implicitly convertible to a real bool (which is dangerous).
+ private:
+  typedef base::internal::scoped_ptr_impl<element_type, deleter_type>
+      scoped_ptr::*Testable;
+
+ public:
+  operator Testable() const {
+    return impl_.get() ? &scoped_ptr::impl_ : nullptr;
+  }
+
+  // Swap two scoped pointers.
+  void swap(scoped_ptr& p2) {
+    impl_.swap(p2.impl_);
+  }
+
+  // Release a pointer.
+  // The return value is the current pointer held by this object. If this object
+  // holds a nullptr, the return value is nullptr. After this operation, this
+  // object will hold a nullptr, and will not own the object any more.
+  element_type* release() WARN_UNUSED_RESULT {
+    return impl_.release();
+  }
+
+ private:
+  // Force element_type to be a complete type.
+  enum { type_must_be_complete = sizeof(element_type) };
+
+  // Actually hold the data.
+  base::internal::scoped_ptr_impl<element_type, deleter_type> impl_;
+
+  // Disable initialization from any type other than element_type*, by
+  // providing a constructor that matches such an initialization, but is
+  // private and has no definition. This is disabled because it is not safe to
+  // call delete[] on an array whose static type does not match its dynamic
+  // type.
+  template <typename U> explicit scoped_ptr(U* array);
+  explicit scoped_ptr(int disallow_construction_from_null);
+
+  // Disable reset() from any type other than element_type*, for the same
+  // reasons as the constructor above.
+  template <typename U> void reset(U* array);
+  void reset(int disallow_reset_from_null);
+};
+
+// Free functions
+template <class T, class D>
+void swap(scoped_ptr<T, D>& p1, scoped_ptr<T, D>& p2) {
+  p1.swap(p2);
+}
+
+template <class T1, class D1, class T2, class D2>
+bool operator==(const scoped_ptr<T1, D1>& p1, const scoped_ptr<T2, D2>& p2) {
+  return p1.get() == p2.get();
+}
+template <class T, class D>
+bool operator==(const scoped_ptr<T, D>& p, std::nullptr_t) {
+  return p.get() == nullptr;
+}
+template <class T, class D>
+bool operator==(std::nullptr_t, const scoped_ptr<T, D>& p) {
+  return p.get() == nullptr;
+}
+
+template <class T1, class D1, class T2, class D2>
+bool operator!=(const scoped_ptr<T1, D1>& p1, const scoped_ptr<T2, D2>& p2) {
+  return !(p1 == p2);
+}
+template <class T, class D>
+bool operator!=(const scoped_ptr<T, D>& p, std::nullptr_t) {
+  return !(p == nullptr);
+}
+template <class T, class D>
+bool operator!=(std::nullptr_t, const scoped_ptr<T, D>& p) {
+  return !(p == nullptr);
+}
+
+template <class T1, class D1, class T2, class D2>
+bool operator<(const scoped_ptr<T1, D1>& p1, const scoped_ptr<T2, D2>& p2) {
+  return p1.get() < p2.get();
+}
+template <class T, class D>
+bool operator<(const scoped_ptr<T, D>& p, std::nullptr_t) {
+  return p.get() < nullptr;
+}
+template <class T, class D>
+bool operator<(std::nullptr_t, const scoped_ptr<T, D>& p) {
+  return nullptr < p.get();
+}
+
+template <class T1, class D1, class T2, class D2>
+bool operator>(const scoped_ptr<T1, D1>& p1, const scoped_ptr<T2, D2>& p2) {
+  return p2 < p1;
+}
+template <class T, class D>
+bool operator>(const scoped_ptr<T, D>& p, std::nullptr_t) {
+  return nullptr < p;
+}
+template <class T, class D>
+bool operator>(std::nullptr_t, const scoped_ptr<T, D>& p) {
+  return p < nullptr;
+}
+
+template <class T1, class D1, class T2, class D2>
+bool operator<=(const scoped_ptr<T1, D1>& p1, const scoped_ptr<T2, D2>& p2) {
+  return !(p1 > p2);
+}
+template <class T, class D>
+bool operator<=(const scoped_ptr<T, D>& p, std::nullptr_t) {
+  return !(p > nullptr);
+}
+template <class T, class D>
+bool operator<=(std::nullptr_t, const scoped_ptr<T, D>& p) {
+  return !(nullptr > p);
+}
+
+template <class T1, class D1, class T2, class D2>
+bool operator>=(const scoped_ptr<T1, D1>& p1, const scoped_ptr<T2, D2>& p2) {
+  return !(p1 < p2);
+}
+template <class T, class D>
+bool operator>=(const scoped_ptr<T, D>& p, std::nullptr_t) {
+  return !(p < nullptr);
+}
+template <class T, class D>
+bool operator>=(std::nullptr_t, const scoped_ptr<T, D>& p) {
+  return !(nullptr < p);
+}
+
+// A function to convert T* into scoped_ptr<T>
+// Doing e.g. make_scoped_ptr(new FooBarBaz<type>(arg)) is a shorter notation
+// for scoped_ptr<FooBarBaz<type> >(new FooBarBaz<type>(arg))
+template <typename T>
+scoped_ptr<T> make_scoped_ptr(T* ptr) {
+  return scoped_ptr<T>(ptr);
+}
+
+template <typename T>
+std::ostream& operator<<(std::ostream& out, const scoped_ptr<T>& p) {
+  return out << p.get();
+}
+
+#endif  // BASE_MEMORY_SCOPED_PTR_H_
deleted file mode 100644
--- a/security/sandbox/chromium/base/memory/shared_memory.h
+++ /dev/null
@@ -1,292 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_MEMORY_SHARED_MEMORY_H_
-#define BASE_MEMORY_SHARED_MEMORY_H_
-
-#include <stddef.h>
-
-#include <string>
-
-#include "base/base_export.h"
-#include "base/macros.h"
-#include "base/memory/shared_memory_handle.h"
-#include "base/process/process_handle.h"
-#include "build/build_config.h"
-
-#if defined(OS_POSIX)
-#include <stdio.h>
-#include <sys/types.h>
-#include <semaphore.h>
-#include "base/file_descriptor_posix.h"
-#include "base/files/file_util.h"
-#include "base/files/scoped_file.h"
-#endif
-
-#if defined(OS_WIN)
-#include "base/win/scoped_handle.h"
-#endif
-
-namespace base {
-
-class FilePath;
-
-// Options for creating a shared memory object.
-struct BASE_EXPORT SharedMemoryCreateOptions {
-#if !(defined(OS_MACOSX) && !defined(OS_IOS))
-  // DEPRECATED (crbug.com/345734):
-  // If NULL, the object is anonymous.  This pointer is owned by the caller
-  // and must live through the call to Create().
-  const std::string* name_deprecated = nullptr;
-
-  // DEPRECATED (crbug.com/345734):
-  // If true, and the shared memory already exists, Create() will open the
-  // existing shared memory and ignore the size parameter.  If false,
-  // shared memory must not exist.  This flag is meaningless unless
-  // name_deprecated is non-NULL.
-  bool open_existing_deprecated = false;
-#endif  // !(defined(OS_MACOSX) && !defined(OS_IOS))
-
-  // Size of the shared memory object to be created.
-  // When opening an existing object, this has no effect.
-  size_t size = 0;
-
-  // If true, mappings might need to be made executable later.
-  bool executable = false;
-
-  // If true, the file can be shared read-only to a process.
-  bool share_read_only = false;
-};
-
-// Platform abstraction for shared memory.  Provides a C++ wrapper
-// around the OS primitive for a memory mapped file.
-class BASE_EXPORT SharedMemory {
- public:
-  SharedMemory();
-
-#if defined(OS_WIN)
-  // Similar to the default constructor, except that this allows for
-  // calling LockDeprecated() to acquire the named mutex before either Create or
-  // Open are called on Windows.
-  explicit SharedMemory(const std::wstring& name);
-#endif
-
-  // Create a new SharedMemory object from an existing, open
-  // shared memory file.
-  //
-  // WARNING: This does not reduce the OS-level permissions on the handle; it
-  // only affects how the SharedMemory will be mmapped.  Use
-  // ShareReadOnlyToProcess to drop permissions.  TODO(jln,jyasskin): DCHECK
-  // that |read_only| matches the permissions of the handle.
-  SharedMemory(const SharedMemoryHandle& handle, bool read_only);
-
-  // Closes any open files.
-  ~SharedMemory();
-
-  // Return true iff the given handle is valid (i.e. not the distingished
-  // invalid value; NULL for a HANDLE and -1 for a file descriptor)
-  static bool IsHandleValid(const SharedMemoryHandle& handle);
-
-  // Returns invalid handle (see comment above for exact definition).
-  static SharedMemoryHandle NULLHandle();
-
-  // Closes a shared memory handle.
-  static void CloseHandle(const SharedMemoryHandle& handle);
-
-  // Returns the maximum number of handles that can be open at once per process.
-  static size_t GetHandleLimit();
-
-  // Duplicates The underlying OS primitive. Returns NULLHandle() on failure.
-  // The caller is responsible for destroying the duplicated OS primitive.
-  static SharedMemoryHandle DuplicateHandle(const SharedMemoryHandle& handle);
-
-#if defined(OS_POSIX) && !(defined(OS_MACOSX) && !defined(OS_IOS))
-  // This method requires that the SharedMemoryHandle is backed by a POSIX fd.
-  static int GetFdFromSharedMemoryHandle(const SharedMemoryHandle& handle);
-#endif
-
-#if defined(OS_POSIX) && !defined(OS_ANDROID)
-  // Gets the size of the shared memory region referred to by |handle|.
-  // Returns false on a failure to determine the size. On success, populates the
-  // output variable |size|.
-  static bool GetSizeFromSharedMemoryHandle(const SharedMemoryHandle& handle,
-                                            size_t* size);
-#endif  // defined(OS_POSIX) && !defined(OS_ANDROID)
-
-  // Creates a shared memory object as described by the options struct.
-  // Returns true on success and false on failure.
-  bool Create(const SharedMemoryCreateOptions& options);
-
-  // Creates and maps an anonymous shared memory segment of size size.
-  // Returns true on success and false on failure.
-  bool CreateAndMapAnonymous(size_t size);
-
-  // Creates an anonymous shared memory segment of size size.
-  // Returns true on success and false on failure.
-  bool CreateAnonymous(size_t size) {
-    SharedMemoryCreateOptions options;
-    options.size = size;
-    return Create(options);
-  }
-
-#if !defined(OS_MACOSX) || defined(OS_IOS)
-  // DEPRECATED (crbug.com/345734):
-  // Creates or opens a shared memory segment based on a name.
-  // If open_existing is true, and the shared memory already exists,
-  // opens the existing shared memory and ignores the size parameter.
-  // If open_existing is false, shared memory must not exist.
-  // size is the size of the block to be created.
-  // Returns true on success, false on failure.
-  bool CreateNamedDeprecated(
-      const std::string& name, bool open_existing, size_t size) {
-    SharedMemoryCreateOptions options;
-    options.name_deprecated = &name;
-    options.open_existing_deprecated = open_existing;
-    options.size = size;
-    return Create(options);
-  }
-
-  // Deletes resources associated with a shared memory segment based on name.
-  // Not all platforms require this call.
-  bool Delete(const std::string& name);
-
-  // Opens a shared memory segment based on a name.
-  // If read_only is true, opens for read-only access.
-  // Returns true on success, false on failure.
-  bool Open(const std::string& name, bool read_only);
-#endif  // !defined(OS_MACOSX) || defined(OS_IOS)
-
-  // Maps the shared memory into the caller's address space.
-  // Returns true on success, false otherwise.  The memory address
-  // is accessed via the memory() accessor.  The mapped address is guaranteed to
-  // have an alignment of at least MAP_MINIMUM_ALIGNMENT. This method will fail
-  // if this object is currently mapped.
-  bool Map(size_t bytes) {
-    return MapAt(0, bytes);
-  }
-
-  // Same as above, but with |offset| to specify from begining of the shared
-  // memory block to map.
-  // |offset| must be alignent to value of |SysInfo::VMAllocationGranularity()|.
-  bool MapAt(off_t offset, size_t bytes);
-  enum { MAP_MINIMUM_ALIGNMENT = 32 };
-
-  // Unmaps the shared memory from the caller's address space.
-  // Returns true if successful; returns false on error or if the
-  // memory is not mapped.
-  bool Unmap();
-
-  // The size requested when the map is first created.
-  size_t requested_size() const { return requested_size_; }
-
-  // The actual size of the mapped memory (may be larger than requested).
-  size_t mapped_size() const { return mapped_size_; }
-
-  // Gets a pointer to the opened memory space if it has been
-  // Mapped via Map().  Returns NULL if it is not mapped.
-  void* memory() const { return memory_; }
-
-  // Returns the underlying OS handle for this segment.
-  // Use of this handle for anything other than an opaque
-  // identifier is not portable.
-  SharedMemoryHandle handle() const;
-
-  // Returns the underlying OS handle for this segment. The caller also gets
-  // ownership of the handle. This is logically equivalent to:
-  //   SharedMemoryHandle dup = DuplicateHandle(handle());
-  //   Close();
-  //   return dup;
-  SharedMemoryHandle TakeHandle();
-
-  // Closes the open shared memory segment. The memory will remain mapped if
-  // it was previously mapped.
-  // It is safe to call Close repeatedly.
-  void Close();
-
-  // Shares the shared memory to another process.  Attempts to create a
-  // platform-specific new_handle which can be used in a remote process to read
-  // the shared memory file.  new_handle is an output parameter to receive the
-  // handle for use in the remote process.
-  //
-  // |*this| must have been initialized using one of the Create*() or Open()
-  // methods with share_read_only=true. If it was constructed from a
-  // SharedMemoryHandle, this call will CHECK-fail.
-  //
-  // Returns true on success, false otherwise.
-  bool ShareReadOnlyToProcess(ProcessHandle process,
-                              SharedMemoryHandle* new_handle) {
-    return ShareToProcessCommon(process, new_handle, false, SHARE_READONLY);
-  }
-
-  // Logically equivalent to:
-  //   bool ok = ShareReadOnlyToProcess(process, new_handle);
-  //   Close();
-  //   return ok;
-  // Note that the memory is unmapped by calling this method, regardless of the
-  // return value.
-  bool GiveReadOnlyToProcess(ProcessHandle process,
-                             SharedMemoryHandle* new_handle) {
-    return ShareToProcessCommon(process, new_handle, true, SHARE_READONLY);
-  }
-
-  // Shares the shared memory to another process.  Attempts
-  // to create a platform-specific new_handle which can be
-  // used in a remote process to access the shared memory
-  // file.  new_handle is an output parameter to receive
-  // the handle for use in the remote process.
-  // Returns true on success, false otherwise.
-  bool ShareToProcess(ProcessHandle process,
-                      SharedMemoryHandle* new_handle) {
-    return ShareToProcessCommon(process, new_handle, false, SHARE_CURRENT_MODE);
-  }
-
-  // Logically equivalent to:
-  //   bool ok = ShareToProcess(process, new_handle);
-  //   Close();
-  //   return ok;
-  // Note that the memory is unmapped by calling this method, regardless of the
-  // return value.
-  bool GiveToProcess(ProcessHandle process,
-                     SharedMemoryHandle* new_handle) {
-    return ShareToProcessCommon(process, new_handle, true, SHARE_CURRENT_MODE);
-  }
-
- private:
-#if defined(OS_POSIX) && !defined(OS_NACL) && !defined(OS_ANDROID) && \
-    !(defined(OS_MACOSX) && !defined(OS_IOS))
-  bool PrepareMapFile(ScopedFILE fp, ScopedFD readonly);
-  bool FilePathForMemoryName(const std::string& mem_name, FilePath* path);
-#endif
-  enum ShareMode {
-    SHARE_READONLY,
-    SHARE_CURRENT_MODE,
-  };
-  bool ShareToProcessCommon(ProcessHandle process,
-                            SharedMemoryHandle* new_handle,
-                            bool close_self,
-                            ShareMode);
-
-#if defined(OS_WIN)
-  // If true indicates this came from an external source so needs extra checks
-  // before being mapped.
-  bool external_section_;
-  std::wstring       name_;
-  win::ScopedHandle  mapped_file_;
-#elif defined(OS_MACOSX) && !defined(OS_IOS)
-  // The OS primitive that backs the shared memory region.
-  SharedMemoryHandle shm_;
-#elif defined(OS_POSIX)
-  int                mapped_file_;
-  int                readonly_mapped_file_;
-#endif
-  size_t             mapped_size_;
-  void*              memory_;
-  bool               read_only_;
-  size_t             requested_size_;
-
-  DISALLOW_COPY_AND_ASSIGN(SharedMemory);
-};
-}  // namespace base
-
-#endif  // BASE_MEMORY_SHARED_MEMORY_H_
deleted file mode 100644
--- a/security/sandbox/chromium/base/memory/shared_memory_handle.h
+++ /dev/null
@@ -1,162 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_MEMORY_SHARED_MEMORY_HANDLE_H_
-#define BASE_MEMORY_SHARED_MEMORY_HANDLE_H_
-
-#include <stddef.h>
-
-#include "build/build_config.h"
-
-#if defined(OS_WIN)
-#include <windows.h>
-#include "base/process/process_handle.h"
-#elif defined(OS_MACOSX) && !defined(OS_IOS)
-#include <mach/mach.h>
-#include "base/base_export.h"
-#include "base/macros.h"
-#include "base/process/process_handle.h"
-#elif defined(OS_POSIX)
-#include <sys/types.h>
-#include "base/file_descriptor_posix.h"
-#endif
-
-namespace base {
-
-// SharedMemoryHandle is a platform specific type which represents
-// the underlying OS handle to a shared memory segment.
-#if defined(OS_POSIX) && !(defined(OS_MACOSX) && !defined(OS_IOS))
-typedef FileDescriptor SharedMemoryHandle;
-#elif defined(OS_WIN)
-class BASE_EXPORT SharedMemoryHandle {
- public:
-  // The default constructor returns an invalid SharedMemoryHandle.
-  SharedMemoryHandle();
-  SharedMemoryHandle(HANDLE h, base::ProcessId pid);
-
-  // Standard copy constructor. The new instance shares the underlying OS
-  // primitives.
-  SharedMemoryHandle(const SharedMemoryHandle& handle);
-
-  // Standard assignment operator. The updated instance shares the underlying
-  // OS primitives.
-  SharedMemoryHandle& operator=(const SharedMemoryHandle& handle);
-
-  // Comparison operators.
-  bool operator==(const SharedMemoryHandle& handle) const;
-  bool operator!=(const SharedMemoryHandle& handle) const;
-
-  // Closes the underlying OS resources.
-  void Close() const;
-
-  // Whether the underlying OS primitive is valid.
-  bool IsValid() const;
-
-  // Whether |pid_| is the same as the current process's id.
-  bool BelongsToCurrentProcess() const;
-
-  // Whether handle_ needs to be duplicated into the destination process when
-  // an instance of this class is passed over a Chrome IPC channel.
-  bool NeedsBrokering() const;
-
-  void SetOwnershipPassesToIPC(bool ownership_passes);
-  bool OwnershipPassesToIPC() const;
-
-  HANDLE GetHandle() const;
-  base::ProcessId GetPID() const;
-
- private:
-  HANDLE handle_;
-
-  // The process in which |handle_| is valid and can be used. If |handle_| is
-  // invalid, this will be kNullProcessId.
-  base::ProcessId pid_;
-
-  // Whether passing this object as a parameter to an IPC message passes
-  // ownership of |handle_| to the IPC stack. This is meant to mimic the
-  // behavior of the |auto_close| parameter of FileDescriptor. This member only
-  // affects attachment-brokered SharedMemoryHandles.
-  // Defaults to |false|.
-  bool ownership_passes_to_ipc_;
-};
-#else
-class BASE_EXPORT SharedMemoryHandle {
- public:
-  // The default constructor returns an invalid SharedMemoryHandle.
-  SharedMemoryHandle();
-
-  // Makes a Mach-based SharedMemoryHandle of the given size. On error,
-  // subsequent calls to IsValid() return false.
-  explicit SharedMemoryHandle(mach_vm_size_t size);
-
-  // Makes a Mach-based SharedMemoryHandle from |memory_object|, a named entry
-  // in the task with process id |pid|. The memory region has size |size|.
-  SharedMemoryHandle(mach_port_t memory_object,
-                     mach_vm_size_t size,
-                     base::ProcessId pid);
-
-  // Standard copy constructor. The new instance shares the underlying OS
-  // primitives.
-  SharedMemoryHandle(const SharedMemoryHandle& handle);
-
-  // Standard assignment operator. The updated instance shares the underlying
-  // OS primitives.
-  SharedMemoryHandle& operator=(const SharedMemoryHandle& handle);
-
-  // Duplicates the underlying OS resources.
-  SharedMemoryHandle Duplicate() const;
-
-  // Comparison operators.
-  bool operator==(const SharedMemoryHandle& handle) const;
-  bool operator!=(const SharedMemoryHandle& handle) const;
-
-  // Whether the underlying OS primitive is valid. Once the SharedMemoryHandle
-  // is backed by a valid OS primitive, it becomes immutable.
-  bool IsValid() const;
-
-  // Exposed so that the SharedMemoryHandle can be transported between
-  // processes.
-  mach_port_t GetMemoryObject() const;
-
-  // Returns false on a failure to determine the size. On success, populates the
-  // output variable |size|. Returns 0 if the handle is invalid.
-  bool GetSize(size_t* size) const;
-
-  // The SharedMemoryHandle must be valid.
-  // Returns whether the SharedMemoryHandle was successfully mapped into memory.
-  // On success, |memory| is an output variable that contains the start of the
-  // mapped memory.
-  bool MapAt(off_t offset, size_t bytes, void** memory, bool read_only);
-
-  // Closes the underlying OS primitive.
-  void Close() const;
-
-  void SetOwnershipPassesToIPC(bool ownership_passes);
-  bool OwnershipPassesToIPC() const;
-
- private:
-  // Shared code between copy constructor and operator=.
-  void CopyRelevantData(const SharedMemoryHandle& handle);
-
-  mach_port_t memory_object_ = MACH_PORT_NULL;
-
-  // The size of the shared memory region when |type_| is MACH. Only
-  // relevant if |memory_object_| is not |MACH_PORT_NULL|.
-  mach_vm_size_t size_ = 0;
-
-  // The pid of the process in which |memory_object_| is usable. Only
-  // relevant if |memory_object_| is not |MACH_PORT_NULL|.
-  base::ProcessId pid_ = 0;
-
-  // Whether passing this object as a parameter to an IPC message passes
-  // ownership of |memory_object_| to the IPC stack. This is meant to mimic
-  // the behavior of the |auto_close| parameter of FileDescriptor.
-  // Defaults to |false|.
-  bool ownership_passes_to_ipc_ = false;
-};
-#endif
-
-}  // namespace base
-
-#endif  // BASE_MEMORY_SHARED_MEMORY_HANDLE_H_
deleted file mode 100644
--- a/security/sandbox/chromium/base/memory/shared_memory_handle_win.cc
+++ /dev/null
@@ -1,79 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/memory/shared_memory_handle.h"
-
-#include "base/logging.h"
-
-namespace base {
-
-SharedMemoryHandle::SharedMemoryHandle()
-    : handle_(nullptr), pid_(kNullProcessId), ownership_passes_to_ipc_(false) {}
-
-SharedMemoryHandle::SharedMemoryHandle(HANDLE h, base::ProcessId pid)
-    : handle_(h), pid_(pid), ownership_passes_to_ipc_(false) {}
-
-SharedMemoryHandle::SharedMemoryHandle(const SharedMemoryHandle& handle)
-    : handle_(handle.handle_),
-      pid_(handle.pid_),
-      ownership_passes_to_ipc_(handle.ownership_passes_to_ipc_) {}
-
-SharedMemoryHandle& SharedMemoryHandle::operator=(
-    const SharedMemoryHandle& handle) {
-  if (this == &handle)
-    return *this;
-
-  handle_ = handle.handle_;
-  pid_ = handle.pid_;
-  ownership_passes_to_ipc_ = handle.ownership_passes_to_ipc_;
-  return *this;
-}
-
-bool SharedMemoryHandle::operator==(const SharedMemoryHandle& handle) const {
-  // Invalid handles are always equal.
-  if (!IsValid() && !handle.IsValid())
-    return true;
-
-  return handle_ == handle.handle_ && pid_ == handle.pid_;
-}
-
-bool SharedMemoryHandle::operator!=(const SharedMemoryHandle& handle) const {
-  return !(*this == handle);
-}
-
-void SharedMemoryHandle::Close() const {
-  DCHECK(handle_ != nullptr);
-  DCHECK(BelongsToCurrentProcess());
-  ::CloseHandle(handle_);
-}
-
-bool SharedMemoryHandle::IsValid() const {
-  return handle_ != nullptr;
-}
-
-bool SharedMemoryHandle::BelongsToCurrentProcess() const {
-  return pid_ == base::GetCurrentProcId();
-}
-
-bool SharedMemoryHandle::NeedsBrokering() const {
-  return BelongsToCurrentProcess();
-}
-
-HANDLE SharedMemoryHandle::GetHandle() const {
-  return handle_;
-}
-
-base::ProcessId SharedMemoryHandle::GetPID() const {
-  return pid_;
-}
-
-void SharedMemoryHandle::SetOwnershipPassesToIPC(bool ownership_passes) {
-  ownership_passes_to_ipc_ = ownership_passes;
-}
-
-bool SharedMemoryHandle::OwnershipPassesToIPC() const {
-  return ownership_passes_to_ipc_;
-}
-
-}  // namespace base
deleted file mode 100644
--- a/security/sandbox/chromium/base/memory/shared_memory_win.cc
+++ /dev/null
@@ -1,395 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/memory/shared_memory.h"
-
-#include <aclapi.h>
-#include <stddef.h>
-#include <stdint.h>
-
-#include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/rand_util.h"
-#include "base/strings/stringprintf.h"
-#include "base/strings/utf_string_conversions.h"
-
-namespace {
-
-// Errors that can occur during Shared Memory construction.
-// These match tools/metrics/histograms/histograms.xml.
-// This enum is append-only.
-enum CreateError {
-  SUCCESS = 0,
-  SIZE_ZERO = 1,
-  SIZE_TOO_LARGE = 2,
-  INITIALIZE_ACL_FAILURE = 3,
-  INITIALIZE_SECURITY_DESC_FAILURE = 4,
-  SET_SECURITY_DESC_FAILURE = 5,
-  CREATE_FILE_MAPPING_FAILURE = 6,
-  REDUCE_PERMISSIONS_FAILURE = 7,
-  ALREADY_EXISTS = 8,
-  CREATE_ERROR_LAST = ALREADY_EXISTS
-};
-
-// Emits UMA metrics about encountered errors. Pass zero (0) for |winerror|
-// if there is no associated Windows error.
-void LogError(CreateError error, DWORD winerror) {
-  UMA_HISTOGRAM_ENUMERATION("SharedMemory.CreateError", error,
-                            CREATE_ERROR_LAST + 1);
-  static_assert(ERROR_SUCCESS == 0, "Windows error code changed!");
-  if (winerror != ERROR_SUCCESS)
-    UMA_HISTOGRAM_SPARSE_SLOWLY("SharedMemory.CreateWinError", winerror);
-}
-
-typedef enum _SECTION_INFORMATION_CLASS {
-  SectionBasicInformation,
-} SECTION_INFORMATION_CLASS;
-
-typedef struct _SECTION_BASIC_INFORMATION {
-  PVOID BaseAddress;
-  ULONG Attributes;
-  LARGE_INTEGER Size;
-} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
-
-typedef ULONG(__stdcall* NtQuerySectionType)(
-    HANDLE SectionHandle,
-    SECTION_INFORMATION_CLASS SectionInformationClass,
-    PVOID SectionInformation,
-    ULONG SectionInformationLength,
-    PULONG ResultLength);
-
-// Returns the length of the memory section starting at the supplied address.
-size_t GetMemorySectionSize(void* address) {
-  MEMORY_BASIC_INFORMATION memory_info;
-  if (!::VirtualQuery(address, &memory_info, sizeof(memory_info)))
-    return 0;
-  return memory_info.RegionSize - (static_cast<char*>(address) -
-         static_cast<char*>(memory_info.AllocationBase));
-}
-
-// Checks if the section object is safe to map. At the moment this just means
-// it's not an image section.
-bool IsSectionSafeToMap(HANDLE handle) {
-  static NtQuerySectionType nt_query_section_func;
-  if (!nt_query_section_func) {
-    nt_query_section_func = reinterpret_cast<NtQuerySectionType>(
-        ::GetProcAddress(::GetModuleHandle(L"ntdll.dll"), "NtQuerySection"));
-    DCHECK(nt_query_section_func);
-  }
-
-  // The handle must have SECTION_QUERY access for this to succeed.
-  SECTION_BASIC_INFORMATION basic_information = {};
-  ULONG status =
-      nt_query_section_func(handle, SectionBasicInformation, &basic_information,
-                            sizeof(basic_information), nullptr);
-  if (status)
-    return false;
-  return (basic_information.Attributes & SEC_IMAGE) != SEC_IMAGE;
-}
-
-// Returns a HANDLE on success and |nullptr| on failure.
-// This function is similar to CreateFileMapping, but removes the permissions
-// WRITE_DAC, WRITE_OWNER, READ_CONTROL, and DELETE.
-//
-// A newly created file mapping has two sets of permissions. It has access
-// control permissions (WRITE_DAC, WRITE_OWNER, READ_CONTROL, and DELETE) and
-// file permissions (FILE_MAP_READ, FILE_MAP_WRITE, etc.). ::DuplicateHandle()
-// with the parameter DUPLICATE_SAME_ACCESS copies both sets of permissions.
-//
-// The Chrome sandbox prevents HANDLEs with the WRITE_DAC permission from being
-// duplicated into unprivileged processes. But the only way to copy file
-// permissions is with the parameter DUPLICATE_SAME_ACCESS. This means that
-// there is no way for a privileged process to duplicate a file mapping into an
-// unprivileged process while maintaining the previous file permissions.
-//
-// By removing all access control permissions of a file mapping immediately
-// after creation, ::DuplicateHandle() effectively only copies the file
-// permissions.
-HANDLE CreateFileMappingWithReducedPermissions(SECURITY_ATTRIBUTES* sa,
-                                               size_t rounded_size,
-                                               LPCWSTR name) {
-  HANDLE h = CreateFileMapping(INVALID_HANDLE_VALUE, sa, PAGE_READWRITE, 0,
-                               static_cast<DWORD>(rounded_size), name);
-  if (!h) {
-    LogError(CREATE_FILE_MAPPING_FAILURE, GetLastError());
-    return nullptr;
-  }
-
-  HANDLE h2;
-  BOOL success = ::DuplicateHandle(
-      GetCurrentProcess(), h, GetCurrentProcess(), &h2,
-      FILE_MAP_READ | FILE_MAP_WRITE | SECTION_QUERY, FALSE, 0);
-  BOOL rv = ::CloseHandle(h);
-  DCHECK(rv);
-
-  if (!success) {
-    LogError(REDUCE_PERMISSIONS_FAILURE, GetLastError());
-    return nullptr;
-  }
-
-  return h2;
-}
-
-}  // namespace.
-
-namespace base {
-
-SharedMemory::SharedMemory()
-    : external_section_(false),
-      mapped_size_(0),
-      memory_(NULL),
-      read_only_(false),
-      requested_size_(0) {}
-
-SharedMemory::SharedMemory(const std::wstring& name)
-    : external_section_(false),
-      name_(name),
-      mapped_size_(0),
-      memory_(NULL),
-      read_only_(false),
-      requested_size_(0) {}
-
-SharedMemory::SharedMemory(const SharedMemoryHandle& handle, bool read_only)
-    : external_section_(true),
-      mapped_size_(0),
-      memory_(NULL),
-      read_only_(read_only),
-      requested_size_(0) {
-  DCHECK(!handle.IsValid() || handle.BelongsToCurrentProcess());
-  mapped_file_.Set(handle.GetHandle());
-}
-
-SharedMemory::~SharedMemory() {
-  Unmap();
-  Close();
-}
-
-// static
-bool SharedMemory::IsHandleValid(const SharedMemoryHandle& handle) {
-  return handle.IsValid();
-}
-
-// static
-SharedMemoryHandle SharedMemory::NULLHandle() {
-  return SharedMemoryHandle();
-}
-
-// static
-void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) {
-  handle.Close();
-}
-
-// static
-size_t SharedMemory::GetHandleLimit() {
-  // Rounded down from value reported here:
-  // http://blogs.technet.com/b/markrussinovich/archive/2009/09/29/3283844.aspx
-  return static_cast<size_t>(1 << 23);
-}
-
-// static
-SharedMemoryHandle SharedMemory::DuplicateHandle(
-    const SharedMemoryHandle& handle) {
-  DCHECK(handle.BelongsToCurrentProcess());
-  HANDLE duped_handle;
-  ProcessHandle process = GetCurrentProcess();
-  BOOL success =
-      ::DuplicateHandle(process, handle.GetHandle(), process, &duped_handle, 0,
-                        FALSE, DUPLICATE_SAME_ACCESS);
-  if (success) {
-    base::SharedMemoryHandle handle(duped_handle, GetCurrentProcId());
-    handle.SetOwnershipPassesToIPC(true);
-    return handle;
-  }
-  return SharedMemoryHandle();
-}
-
-bool SharedMemory::CreateAndMapAnonymous(size_t size) {
-  return CreateAnonymous(size) && Map(size);
-}
-
-bool SharedMemory::Create(const SharedMemoryCreateOptions& options) {
-  // TODO(bsy,sehr): crbug.com/210609 NaCl forces us to round up 64k here,
-  // wasting 32k per mapping on average.
-  static const size_t kSectionMask = 65536 - 1;
-  DCHECK(!options.executable);
-  DCHECK(!mapped_file_.Get());
-  if (options.size == 0) {
-    LogError(SIZE_ZERO, 0);
-    return false;
-  }
-
-  // Check maximum accounting for overflow.
-  if (options.size >
-      static_cast<size_t>(std::numeric_limits<int>::max()) - kSectionMask) {
-    LogError(SIZE_TOO_LARGE, 0);
-    return false;
-  }
-
-  size_t rounded_size = (options.size + kSectionMask) & ~kSectionMask;
-  name_ = options.name_deprecated ?
-      ASCIIToUTF16(*options.name_deprecated) : L"";
-  SECURITY_ATTRIBUTES sa = { sizeof(sa), NULL, FALSE };
-  SECURITY_DESCRIPTOR sd;
-  ACL dacl;
-
-  if (name_.empty()) {
-    // Add an empty DACL to enforce anonymous read-only sections.
-    sa.lpSecurityDescriptor = &sd;
-    if (!InitializeAcl(&dacl, sizeof(dacl), ACL_REVISION)) {
-      LogError(INITIALIZE_ACL_FAILURE, GetLastError());
-      return false;
-    }
-    if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION)) {
-      LogError(INITIALIZE_SECURITY_DESC_FAILURE, GetLastError());
-      return false;
-    }
-    if (!SetSecurityDescriptorDacl(&sd, TRUE, &dacl, FALSE)) {
-      LogError(SET_SECURITY_DESC_FAILURE, GetLastError());
-      return false;
-    }
-
-    // Windows ignores DACLs on certain unnamed objects (like shared sections).
-    // So, we generate a random name when we need to enforce read-only.
-    uint64_t rand_values[4];
-    RandBytes(&rand_values, sizeof(rand_values));
-    name_ = StringPrintf(L"CrSharedMem_%016llx%016llx%016llx%016llx",
-                         rand_values[0], rand_values[1],
-                         rand_values[2], rand_values[3]);
-  }
-  mapped_file_.Set(CreateFileMappingWithReducedPermissions(
-      &sa, rounded_size, name_.empty() ? nullptr : name_.c_str()));
-  if (!mapped_file_.IsValid()) {
-    // The error is logged within CreateFileMappingWithReducedPermissions().
-    return false;
-  }
-
-  requested_size_ = options.size;
-
-  // Check if the shared memory pre-exists.
-  if (GetLastError() == ERROR_ALREADY_EXISTS) {
-    // If the file already existed, set requested_size_ to 0 to show that
-    // we don't know the size.
-    requested_size_ = 0;
-    external_section_ = true;
-    if (!options.open_existing_deprecated) {
-      Close();
-      // From "if" above: GetLastError() == ERROR_ALREADY_EXISTS.
-      LogError(ALREADY_EXISTS, ERROR_ALREADY_EXISTS);
-      return false;
-    }
-  }
-
-  LogError(SUCCESS, ERROR_SUCCESS);
-  return true;
-}
-
-bool SharedMemory::Delete(const std::string& name) {
-  // intentionally empty -- there is nothing for us to do on Windows.
-  return true;
-}
-
-bool SharedMemory::Open(const std::string& name, bool read_only) {
-  DCHECK(!mapped_file_.Get());
-  DWORD access = FILE_MAP_READ | SECTION_QUERY;
-  if (!read_only)
-    access |= FILE_MAP_WRITE;
-  name_ = ASCIIToUTF16(name);
-  read_only_ = read_only;
-  mapped_file_.Set(
-      OpenFileMapping(access, false, name_.empty() ? nullptr : name_.c_str()));
-  if (!mapped_file_.IsValid())
-    return false;
-  // If a name specified assume it's an external section.
-  if (!name_.empty())
-    external_section_ = true;
-  // Note: size_ is not set in this case.
-  return true;
-}
-
-bool SharedMemory::MapAt(off_t offset, size_t bytes) {
-  if (!mapped_file_.Get())
-    return false;
-
-  if (bytes > static_cast<size_t>(std::numeric_limits<int>::max()))
-    return false;
-
-  if (memory_)
-    return false;
-
-  if (external_section_ && !IsSectionSafeToMap(mapped_file_.Get()))
-    return false;
-
-  memory_ = MapViewOfFile(
-      mapped_file_.Get(),
-      read_only_ ? FILE_MAP_READ : FILE_MAP_READ | FILE_MAP_WRITE,
-      static_cast<uint64_t>(offset) >> 32, static_cast<DWORD>(offset), bytes);
-  if (memory_ != NULL) {
-    DCHECK_EQ(0U, reinterpret_cast<uintptr_t>(memory_) &
-        (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1));
-    mapped_size_ = GetMemorySectionSize(memory_);
-    return true;
-  }
-  return false;
-}
-
-bool SharedMemory::Unmap() {
-  if (memory_ == NULL)
-    return false;
-
-  UnmapViewOfFile(memory_);
-  memory_ = NULL;
-  return true;
-}
-
-bool SharedMemory::ShareToProcessCommon(ProcessHandle process,
-                                        SharedMemoryHandle* new_handle,
-                                        bool close_self,
-                                        ShareMode share_mode) {
-  *new_handle = SharedMemoryHandle();
-  DWORD access = FILE_MAP_READ | SECTION_QUERY;
-  DWORD options = 0;
-  HANDLE mapped_file = mapped_file_.Get();
-  HANDLE result;
-  if (share_mode == SHARE_CURRENT_MODE && !read_only_)
-    access |= FILE_MAP_WRITE;
-  if (close_self) {
-    // DUPLICATE_CLOSE_SOURCE causes DuplicateHandle to close mapped_file.
-    options = DUPLICATE_CLOSE_SOURCE;
-    HANDLE detached_handle = mapped_file_.Take();
-    DCHECK_EQ(detached_handle, mapped_file);
-    Unmap();
-  }
-
-  if (process == GetCurrentProcess() && close_self) {
-    *new_handle = SharedMemoryHandle(mapped_file, base::GetCurrentProcId());
-    return true;
-  }
-
-  if (!::DuplicateHandle(GetCurrentProcess(), mapped_file, process, &result,
-                         access, FALSE, options)) {
-    return false;
-  }
-  *new_handle = SharedMemoryHandle(result, base::GetProcId(process));
-  new_handle->SetOwnershipPassesToIPC(true);
-  return true;
-}
-
-
-void SharedMemory::Close() {
-  mapped_file_.Close();
-}
-
-SharedMemoryHandle SharedMemory::handle() const {
-  return SharedMemoryHandle(mapped_file_.Get(), base::GetCurrentProcId(