Bug 1063318: Switch Chromium IPC code to Mozilla's ref/auto ptr types. Also fix thread safety bug. r=nfroyd
authorJosh Aas <joshmoz@gmail.com>
Fri, 19 Sep 2014 13:17:17 -0500
changeset 218670 f5a2e2a16e8469d994620b9f863837f38089c355
parent 218668 206e963fb3dd53fc6bf6f92b5e4121d5ffe6add7
child 218678 7283eb58334189852bb1aa06c611b599f3c31109
push idunknown
push userunknown
push dateunknown
reviewersnfroyd
bugs1063318
milestone35.0a1
Bug 1063318: Switch Chromium IPC code to Mozilla's ref/auto ptr types. Also fix thread safety bug. r=nfroyd
content/media/gmp/GMPProcessParent.h
dom/plugins/ipc/PluginProcessParent.h
ipc/chromium/moz.build
ipc/chromium/src/base/atomic_ref_count.h
ipc/chromium/src/base/atomic_sequence_num.h
ipc/chromium/src/base/file_util.h
ipc/chromium/src/base/message_loop.cc
ipc/chromium/src/base/message_loop.h
ipc/chromium/src/base/message_pump.h
ipc/chromium/src/base/message_pump_glib.h
ipc/chromium/src/base/message_pump_libevent.cc
ipc/chromium/src/base/message_pump_libevent.h
ipc/chromium/src/base/message_pump_mac.h
ipc/chromium/src/base/process_util_bsd.cc
ipc/chromium/src/base/process_util_linux.cc
ipc/chromium/src/base/process_util_posix.cc
ipc/chromium/src/base/process_util_win.cc
ipc/chromium/src/base/process_win.cc
ipc/chromium/src/base/ref_counted.cc
ipc/chromium/src/base/ref_counted.h
ipc/chromium/src/base/revocable_store.h
ipc/chromium/src/base/scoped_ptr.h
ipc/chromium/src/base/shared_memory_posix.cc
ipc/chromium/src/base/sys_info_win.cc
ipc/chromium/src/base/waitable_event.h
ipc/chromium/src/base/waitable_event_watcher.h
ipc/chromium/src/base/waitable_event_watcher_posix.cc
ipc/chromium/src/base/win_util.cc
ipc/chromium/src/chrome/common/child_process.h
ipc/chromium/src/chrome/common/child_process_host.h
ipc/chromium/src/chrome/common/child_thread.cc
ipc/chromium/src/chrome/common/child_thread.h
ipc/chromium/src/chrome/common/file_descriptor_set_posix.h
ipc/chromium/src/chrome/common/ipc_channel_posix.cc
ipc/chromium/src/chrome/common/ipc_channel_posix.h
ipc/chromium/src/chrome/common/ipc_channel_proxy.h
ipc/chromium/src/chrome/common/ipc_channel_win.cc
ipc/chromium/src/chrome/common/ipc_channel_win.h
ipc/chromium/src/chrome/common/ipc_logging.h
ipc/chromium/src/chrome/common/ipc_message.h
ipc/chromium/src/chrome/common/ipc_sync_channel.cc
ipc/chromium/src/chrome/common/ipc_sync_channel.h
ipc/glue/GeckoChildProcessHost.h
testing/mochitest/mochitest_options.py
xpcom/build/nsXPComInit.cpp
--- a/content/media/gmp/GMPProcessParent.h
+++ b/content/media/gmp/GMPProcessParent.h
@@ -5,17 +5,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef GMPProcessParent_h
 #define GMPProcessParent_h 1
 
 #include "mozilla/Attributes.h"
 #include "base/basictypes.h"
 #include "base/file_path.h"
-#include "base/scoped_ptr.h"
 #include "base/thread.h"
 #include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 namespace mozilla {
 namespace gmp {
 
--- a/dom/plugins/ipc/PluginProcessParent.h
+++ b/dom/plugins/ipc/PluginProcessParent.h
@@ -6,17 +6,16 @@
 
 #ifndef dom_plugins_PluginProcessParent_h
 #define dom_plugins_PluginProcessParent_h 1
 
 #include "mozilla/Attributes.h"
 #include "base/basictypes.h"
 
 #include "base/file_path.h"
-#include "base/scoped_ptr.h"
 #include "base/thread.h"
 #include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 namespace mozilla {
 namespace plugins {
--- a/ipc/chromium/moz.build
+++ b/ipc/chromium/moz.build
@@ -45,17 +45,16 @@ UNIFIED_SOURCES += [
     'src/base/lazy_instance.cc',
     'src/base/lock.cc',
     'src/base/logging.cc',
     'src/base/message_loop.cc',
     'src/base/message_pump_default.cc',
     'src/base/non_thread_safe.cc',
     'src/base/pickle.cc',
     'src/base/rand_util.cc',
-    'src/base/ref_counted.cc',
     'src/base/revocable_store.cc',
     'src/base/scoped_temp_dir.cc',
     'src/base/string_piece.cc',
     'src/base/string_util.cc',
     'src/base/thread.cc',
     'src/base/thread_collision_warner.cc',
     'src/base/time.cc',
     'src/base/timer.cc',
deleted file mode 100644
--- a/ipc/chromium/src/base/atomic_ref_count.h
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This is a low level implementation of atomic semantics for reference
-// counting.  Please use base/ref_counted.h directly instead.
-
-#ifndef BASE_ATOMIC_REF_COUNT_H_
-#define BASE_ATOMIC_REF_COUNT_H_
-
-#include "base/atomicops.h"
-
-namespace base {
-
-typedef subtle::Atomic32 AtomicRefCount;
-
-// Increment a reference count by "increment", which must exceed 0.
-inline void AtomicRefCountIncN(volatile AtomicRefCount *ptr,
-                               AtomicRefCount increment) {
-  subtle::NoBarrier_AtomicIncrement(ptr, increment);
-}
-
-// Decrement a reference count by "decrement", which must exceed 0,
-// and return whether the result is non-zero.
-// Insert barriers to ensure that state written before the reference count
-// became zero will be visible to a thread that has just made the count zero.
-inline bool AtomicRefCountDecN(volatile AtomicRefCount *ptr,
-                               AtomicRefCount decrement) {
-  return subtle::Barrier_AtomicIncrement(ptr, -decrement) != 0;
-}
-
-// Increment a reference count by 1.
-inline void AtomicRefCountInc(volatile AtomicRefCount *ptr) {
-  base::AtomicRefCountIncN(ptr, 1);
-}
-
-// Decrement a reference count by 1 and return whether the result is non-zero.
-// Insert barriers to ensure that state written before the reference count
-// became zero will be visible to a thread that has just made the count zero.
-inline bool AtomicRefCountDec(volatile AtomicRefCount *ptr) {
-  return base::AtomicRefCountDecN(ptr, 1);
-}
-
-// Return whether the reference count is one.  If the reference count is used
-// in the conventional way, a refrerence count of 1 implies that the current
-// thread owns the reference and no other thread shares it.  This call performs
-// the test for a reference count of one, and performs the memory barrier
-// needed for the owning thread to act on the object, knowing that it has
-// exclusive access to the object.
-inline bool AtomicRefCountIsOne(volatile AtomicRefCount *ptr) {
-  return subtle::Acquire_Load(ptr) == 1;
-}
-
-// Return whether the reference count is zero.  With conventional object
-// referencing counting, the object will be destroyed, so the reference count
-// should never be zero.  Hence this is generally used for a debug check.
-inline bool AtomicRefCountIsZero(volatile AtomicRefCount *ptr) {
-  return subtle::Acquire_Load(ptr) == 0;
-}
-
-}  // namespace base
-
-#endif  // BASE_ATOMIC_REF_COUNT_H_
deleted file mode 100644
--- a/ipc/chromium/src/base/atomic_sequence_num.h
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_ATOMIC_SEQUENCE_NUM_H_
-#define BASE_ATOMIC_SEQUENCE_NUM_H_
-
-#include "base/atomicops.h"
-#include "base/basictypes.h"
-
-namespace base {
-
-class AtomicSequenceNumber {
- public:
-  AtomicSequenceNumber() : seq_(0) { }
-  explicit AtomicSequenceNumber(base::LinkerInitialized x) { /* seq_ is 0 */ }
-
-  int GetNext() {
-    return static_cast<int>(
-        base::subtle::NoBarrier_AtomicIncrement(&seq_, 1) - 1);
-  }
-
- private:
-  base::subtle::Atomic32 seq_;
-  DISALLOW_COPY_AND_ASSIGN(AtomicSequenceNumber);
-};
-
-}  // namespace base
-
-#endif  // BASE_ATOMIC_SEQUENCE_NUM_H_
--- a/ipc/chromium/src/base/file_util.h
+++ b/ipc/chromium/src/base/file_util.h
@@ -22,17 +22,16 @@
 
 #include <stdio.h>
 
 #include <stack>
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
-#include "base/scoped_ptr.h"
 #include "base/file_path.h"
 
 namespace file_util {
 
 //-----------------------------------------------------------------------------
 // Functions that operate purely on a path string w/o touching the filesystem:
 
 // Returns true if the given path ends with a path separator character.
--- a/ipc/chromium/src/base/message_loop.cc
+++ b/ipc/chromium/src/base/message_loop.cc
@@ -314,17 +314,17 @@ void MessageLoop::PostTask_Helper(
   } else {
     DCHECK(delay_ms == 0) << "delay should not be negative";
   }
 
   // Warning: Don't try to short-circuit, and handle this thread's tasks more
   // directly, as it could starve handling of foreign threads.  Put every task
   // into this queue.
 
-  scoped_refptr<base::MessagePump> pump;
+  nsRefPtr<base::MessagePump> pump;
   {
     AutoLock locked(incoming_queue_lock_);
     incoming_queue_.push(pending_task);
     pump = pump_;
   }
   // Since the incoming_queue_ may contain a task that destroys this message
   // loop, we cannot exit incoming_queue_lock_ until we are done with |this|.
   // We use a stack-based reference to the message pump so that we can call
--- a/ipc/chromium/src/base/message_loop.h
+++ b/ipc/chromium/src/base/message_loop.h
@@ -4,34 +4,34 @@
 
 #ifndef BASE_MESSAGE_LOOP_H_
 #define BASE_MESSAGE_LOOP_H_
 
 #include <deque>
 #include <queue>
 #include <string>
 #include <vector>
+#include <map>
 
-#include <map>
 #include "base/lock.h"
 #include "base/message_pump.h"
 #include "base/observer_list.h"
-#include "base/ref_counted.h"
-#include "base/scoped_ptr.h"
 #include "base/task.h"
 #include "base/timer.h"
 
 #if defined(OS_WIN)
 // We need this to declare base::MessagePumpWin::Dispatcher, which we should
 // really just eliminate.
 #include "base/message_pump_win.h"
 #elif defined(OS_POSIX)
 #include "base/message_pump_libevent.h"
 #endif
 
+#include "nsAutoPtr.h"
+
 namespace mozilla {
 namespace ipc {
 
 class DoWorkRunnable;
 
 } /* namespace ipc */
 } /* namespace mozilla */
 
@@ -410,17 +410,17 @@ public:
   // Contains delayed tasks, sorted by their 'delayed_run_time' property.
   DelayedTaskQueue delayed_work_queue_;
 
   // A queue of non-nestable tasks that we had to defer because when it came
   // time to execute them we were in a nested message loop.  They will execute
   // once we're out of nested message loops.
   TaskQueue deferred_non_nestable_work_queue_;
 
-  scoped_refptr<base::MessagePump> pump_;
+  nsRefPtr<base::MessagePump> pump_;
 
   base::ObserverList<DestructionObserver> destruction_observers_;
 
   // A recursion block that prevents accidentally running additonal tasks when
   // insider a (accidentally induced?) nested message pump.
   bool nestable_tasks_allowed_;
 
   bool exception_restoration_;
--- a/ipc/chromium/src/base/message_pump.h
+++ b/ipc/chromium/src/base/message_pump.h
@@ -1,23 +1,25 @@
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MESSAGE_PUMP_H_
 #define BASE_MESSAGE_PUMP_H_
 
-#include "base/ref_counted.h"
+#include "nsISupportsImpl.h"
 
 namespace base {
 
 class TimeTicks;
 
-class MessagePump : public RefCountedThreadSafe<MessagePump> {
+class MessagePump {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MessagePump)
+
   // Please see the comments above the Run method for an illustration of how
   // these delegate methods are used.
   class Delegate {
    public:
     virtual ~Delegate() {}
 
     // Called from within Run in response to ScheduleWork or when the message
     // pump would otherwise call DoDelayedWork.  Returns true to indicate that
@@ -34,18 +36,16 @@ class MessagePump : public RefCountedThr
     // calls to this function need to be scheduled.
     virtual bool DoDelayedWork(TimeTicks* next_delayed_work_time) = 0;
 
     // Called from within Run just before the message pump goes to sleep.
     // Returns true to indicate that idle work was done.
     virtual bool DoIdleWork() = 0;
   };
 
-  virtual ~MessagePump() {}
-
   // The Run method is called to enter the message pump's run loop.
   //
   // Within the method, the message pump is responsible for processing native
   // messages as well as for giving cycles to the delegate periodically.  The
   // message pump should take care to mix delegate callbacks with native
   // message processing so neither type of event starves the other of cycles.
   //
   // The anatomy of a typical run loop:
@@ -118,13 +118,16 @@ class MessagePump : public RefCountedThr
   // "reasonably soon", this method can be a no-op to avoid expensive
   // atomic tests and/or syscalls required for ScheduleWork().
   virtual void ScheduleWorkForNestedLoop() { ScheduleWork(); };
 
   // Schedule a DoDelayedWork callback to happen at the specified time,
   // cancelling any pending DoDelayedWork callback.  This method may only be
   // used on the thread that called Run.
   virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time) = 0;
+
+protected:
+  virtual ~MessagePump() {};
 };
 
 }  // namespace base
 
 #endif  // BASE_MESSAGE_PUMP_H_
--- a/ipc/chromium/src/base/message_pump_glib.h
+++ b/ipc/chromium/src/base/message_pump_glib.h
@@ -2,18 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MESSAGE_PUMP_GLIB_H_
 #define BASE_MESSAGE_PUMP_GLIB_H_
 
 #include "base/message_pump.h"
 #include "base/observer_list.h"
-#include "base/scoped_ptr.h"
 #include "base/time.h"
+#include "mozilla/UniquePtr.h"
 
 typedef union _GdkEvent GdkEvent;
 typedef struct _GMainContext GMainContext;
 typedef struct _GPollFD GPollFD;
 typedef struct _GSource GSource;
 
 namespace base {
 
@@ -123,18 +123,18 @@ class MessagePumpForUI : public MessageP
   GSource* work_source_;
 
   // We use a wakeup pipe to make sure we'll get out of the glib polling phase
   // when another thread has scheduled us to do some work.  There is a glib
   // mechanism g_main_context_wakeup, but this won't guarantee that our event's
   // Dispatch() will be called.
   int wakeup_pipe_read_;
   int wakeup_pipe_write_;
-  // Use a scoped_ptr to avoid needing the definition of GPollFD in the header.
-  scoped_ptr<GPollFD> wakeup_gpollfd_;
+  // Use an autoptr to avoid needing the definition of GPollFD in the header.
+  mozilla::UniquePtr<GPollFD> wakeup_gpollfd_;
 
   // List of observers.
   ObserverList<Observer> observers_;
 
   DISALLOW_COPY_AND_ASSIGN(MessagePumpForUI);
 };
 
 }  // namespace base
--- a/ipc/chromium/src/base/message_pump_libevent.cc
+++ b/ipc/chromium/src/base/message_pump_libevent.cc
@@ -8,20 +8,20 @@
 #include <fcntl.h>
 #if defined(ANDROID) || defined(OS_POSIX)
 #include <unistd.h>
 #endif
 
 #include "eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/scoped_nsautorelease_pool.h"
-#include "base/scoped_ptr.h"
 #include "base/time.h"
 #include "nsDependentSubstring.h"
 #include "third_party/libevent/event.h"
+#include "mozilla/UniquePtr.h"
 
 // Lifecycle of struct event
 // Libevent uses two main data structures:
 // struct event_base (of which there is one per message pump), and
 // struct event (of which there is roughly one per socket).
 // The socket's struct event is created in
 // MessagePumpLibevent::WatchFileDescriptor(),
 // is owned by the FileDescriptorWatcher, and is destroyed in
@@ -165,21 +165,21 @@ bool MessagePumpLibevent::WatchFileDescr
     event_mask |= EV_WRITE;
   }
 
   // |should_delete_event| is true if we're modifying an event that's currently
   // active in |controller|.
   // If we're modifying an existing event and there's an error then we need to
   // tell libevent to clean it up via event_delete() before returning.
   bool should_delete_event = true;
-  scoped_ptr<event> evt(controller->ReleaseEvent());
+  mozilla::UniquePtr<event> evt(controller->ReleaseEvent());
   if (evt.get() == NULL) {
     should_delete_event = false;
     // Ownership is transferred to the controller.
-    evt.reset(new event);
+    evt = mozilla::MakeUnique<event>();
   }
 
   // Set current interest mask and message pump for this event.
   event_set(evt.get(), fd, event_mask, OnLibeventNotification,
             delegate);
 
   // Tell libevent which message pump this socket will belong to when we add it.
   if (event_base_set(event_base_, evt.get()) != 0) {
@@ -268,17 +268,17 @@ MessagePumpLibevent::CatchSignal(int sig
   DCHECK(sig > 0);
   DCHECK(sigevent);
   DCHECK(delegate);
   // TODO if we want to support re-using SignalEvents, this code needs
   // to jump through the same hoops as WatchFileDescriptor().  Not
   // needed at present
   DCHECK(NULL == sigevent->event_);
 
-  scoped_ptr<event> evt(new event);
+  mozilla::UniquePtr<event> evt = mozilla::MakeUnique<event>();
   signal_set(evt.get(), sig, OnLibeventSignalNotification, delegate);
 
   if (event_base_set(event_base_, evt.get()))
     return false;
 
   if (signal_add(evt.get(), NULL))
     return false;
 
--- a/ipc/chromium/src/base/message_pump_libevent.h
+++ b/ipc/chromium/src/base/message_pump_libevent.h
@@ -57,17 +57,16 @@ class MessagePumpLibevent : public Messa
     virtual ~Watcher() {}
     // Called from MessageLoop::Run when an FD can be read from/written to
     // without blocking
     virtual void OnFileCanReadWithoutBlocking(int fd) = 0;
     virtual void OnFileCanWriteWithoutBlocking(int fd) = 0;
   };
 
   MessagePumpLibevent();
-  virtual ~MessagePumpLibevent();
 
   enum Mode {
     WATCH_READ = 1 << 0,
     WATCH_WRITE = 1 << 1,
     WATCH_READ_WRITE = WATCH_READ | WATCH_WRITE
   };
 
   // Have the current thread's message loop watch for a a situation in which
@@ -134,16 +133,20 @@ class MessagePumpLibevent : public Messa
 
 
   // MessagePump methods:
   virtual void Run(Delegate* delegate);
   virtual void Quit();
   virtual void ScheduleWork();
   virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time);
 
+ protected:
+
+  virtual ~MessagePumpLibevent();
+
  private:
 
   // Risky part of constructor.  Returns true on success.
   bool Init();
 
   // This flag is set to false when Run should return.
   bool keep_running_;
 
--- a/ipc/chromium/src/base/message_pump_mac.h
+++ b/ipc/chromium/src/base/message_pump_mac.h
@@ -27,16 +27,18 @@
 // or NSRunLoop-based MessagePump subclass depending on which thread it is
 // called on.
 
 #ifndef BASE_MESSAGE_PUMP_MAC_H_
 #define BASE_MESSAGE_PUMP_MAC_H_
 
 #include "base/message_pump.h"
 
+#include "base/basictypes.h"
+
 #include <CoreFoundation/CoreFoundation.h>
 #include <IOKit/IOKitLib.h>
 
 #if defined(__OBJC__)
 @class NSAutoreleasePool;
 #else  // defined(__OBJC__)
 class NSAutoreleasePool;
 #endif  // defined(__OBJC__)
--- a/ipc/chromium/src/base/process_util_bsd.cc
+++ b/ipc/chromium/src/base/process_util_bsd.cc
@@ -13,16 +13,17 @@
 
 #include <string>
 
 #include "base/eintr_wrapper.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
+#include "mozilla/UniquePtr.h"
 
 #if defined(_POSIX_SPAWN) && _POSIX_SPAWN > 0
 #define HAVE_POSIX_SPAWN	1
 #endif
 
 /*
  * On platforms that are not gonk based, we fall back to an arbitrary
  * UID. This is generally the UID for user `nobody', albeit it is not
@@ -220,17 +221,17 @@ bool LaunchApp(const std::vector<std::st
 }
 
 bool LaunchApp(const std::vector<std::string>& argv,
                const file_handle_mapping_vector& fds_to_remap,
                const environment_map& env_vars_to_set,
                ChildPrivileges privs,
                bool wait, ProcessHandle* process_handle,
                ProcessArchitecture arch) {
-  scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
+  mozilla::UniquePtr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   // Illegal to allocate memory after fork and before execvp
   InjectiveMultimap fd_shuffle1, fd_shuffle2;
   fd_shuffle1.reserve(fds_to_remap.size());
   fd_shuffle2.reserve(fds_to_remap.size());
 
   pid_t pid = fork();
   if (pid < 0)
     return false;
--- a/ipc/chromium/src/base/process_util_linux.cc
+++ b/ipc/chromium/src/base/process_util_linux.cc
@@ -15,16 +15,17 @@
 #include <sys/wait.h>
 
 #include "base/eintr_wrapper.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "nsLiteralString.h"
+#include "mozilla/UniquePtr.h"
 
 #ifdef MOZ_B2G_LOADER
 #include "ProcessUtils.h"
 
 using namespace mozilla::ipc;
 #endif	// MOZ_B2G_LOADER
 
 #ifdef MOZ_WIDGET_GONK
@@ -202,23 +203,23 @@ bool LaunchApp(const std::vector<std::st
  */
 static bool
 LaunchAppProcLoader(const std::vector<std::string>& argv,
                     const file_handle_mapping_vector& fds_to_remap,
                     const environment_map& env_vars_to_set,
                     ChildPrivileges privs,
                     ProcessHandle* process_handle) {
   size_t i;
-  scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
+  mozilla::UniquePtr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   for (i = 0; i < argv.size(); i++) {
     argv_cstr[i] = const_cast<char*>(argv[i].c_str());
   }
   argv_cstr[argv.size()] = nullptr;
 
-  scoped_array<char*> env_cstr(new char*[env_vars_to_set.size() + 1]);
+  mozilla::UniquePtr<char*[]> env_cstr(new char*[env_vars_to_set.size() + 1]);
   i = 0;
   for (environment_map::const_iterator it = env_vars_to_set.begin();
        it != env_vars_to_set.end(); ++it) {
     env_cstr[i++] = strdup((it->first + "=" + it->second).c_str());
   }
   env_cstr[env_vars_to_set.size()] = nullptr;
 
   bool ok = ProcLoaderLoad((const char **)argv_cstr.get(),
@@ -256,17 +257,17 @@ bool LaunchApp(const std::vector<std::st
   static bool beforeFirstNuwaLaunch = true;
   if (!wait && beforeFirstNuwaLaunch && IsLaunchingNuwa(argv)) {
     beforeFirstNuwaLaunch = false;
     return LaunchAppProcLoader(argv, fds_to_remap, env_vars_to_set,
                                privs, process_handle);
   }
 #endif // MOZ_B2G_LOADER
 
-  scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
+  mozilla::UniquePtr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   // Illegal to allocate memory after fork and before execvp
   InjectiveMultimap fd_shuffle1, fd_shuffle2;
   fd_shuffle1.reserve(fds_to_remap.size());
   fd_shuffle2.reserve(fds_to_remap.size());
 
 #ifdef HAVE_PR_DUPLICATE_ENVIRONMENT
   Environment env;
   env.Merge(env_vars_to_set);
--- a/ipc/chromium/src/base/process_util_posix.cc
+++ b/ipc/chromium/src/base/process_util_posix.cc
@@ -17,22 +17,23 @@
 #include <limits>
 #include <set>
 
 #include "base/basictypes.h"
 #include "base/eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/platform_thread.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/sys_info.h"
 #include "base/time.h"
 #include "base/waitable_event.h"
 #include "base/dir_reader_posix.h"
 
+#include "mozilla/UniquePtr.h"
+
 const int kMicrosecondsPerSecond = 1000000;
 
 namespace base {
 
 ProcessId GetCurrentProcId() {
   return getpid();
 }
 
@@ -96,17 +97,17 @@ typedef unsigned long int rlim_t;
 class ScopedDIRClose {
  public:
   inline void operator()(DIR* x) const {
     if (x) {
       closedir(x);
     }
   }
 };
-typedef scoped_ptr_malloc<DIR, ScopedDIRClose> ScopedDIR;
+typedef mozilla::UniquePtr<DIR, ScopedDIRClose> ScopedDIR;
 
 
 void CloseSuperfluousFds(const base::InjectiveMultimap& saved_mapping) {
   // DANGER: no calls to malloc are allowed from now on:
   // http://crbug.com/36678
 #if defined(ANDROID)
   static const rlim_t kSystemDefaultMaxFds = 1024;
   static const char kFDDir[] = "/proc/self/fd";
--- a/ipc/chromium/src/base/process_util_win.cc
+++ b/ipc/chromium/src/base/process_util_win.cc
@@ -9,18 +9,16 @@
 #include "base/process_util.h"
 
 #include <windows.h>
 #include <winternl.h>
 #include <psapi.h>
 
 #include "base/histogram.h"
 #include "base/logging.h"
-#include "base/scoped_handle_win.h"
-#include "base/scoped_ptr.h"
 #include "base/win_util.h"
 
 #include <algorithm>
 
 namespace {
 
 // System pagesize. This value remains constant on x86/64 architectures.
 const int PAGESIZE_KB = 4;
--- a/ipc/chromium/src/base/process_win.cc
+++ b/ipc/chromium/src/base/process_win.cc
@@ -1,16 +1,15 @@
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/process.h"
 #include "base/logging.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 
 namespace base {
 
 void Process::Close() {
   if (!process_)
     return;
   CloseProcessHandle(process_);
   process_ = NULL;
deleted file mode 100644
--- a/ipc/chromium/src/base/ref_counted.cc
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/ref_counted.h"
-
-#include "base/logging.h"
-#include "base/thread_collision_warner.h"
-
-namespace base {
-
-namespace subtle {
-
-RefCountedBase::RefCountedBase() : ref_count_(0) {
-#ifndef NDEBUG
-  in_dtor_ = false;
-#endif
-}
-
-RefCountedBase::~RefCountedBase() {
-#ifndef NDEBUG
-  DCHECK(in_dtor_) << "RefCounted object deleted without calling Release()";
-#endif
-}
-
-void RefCountedBase::AddRef() {
-  // TODO(maruel): Add back once it doesn't assert 500 times/sec.
-  // Current thread books the critical section "AddRelease" without release it.
-  // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-#endif
-  ++ref_count_;
-}
-
-bool RefCountedBase::Release() {
-  // TODO(maruel): Add back once it doesn't assert 500 times/sec.
-  // Current thread books the critical section "AddRelease" without release it.
-  // DFAKE_SCOPED_LOCK_THREAD_LOCKED(add_release_);
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-#endif
-  if (--ref_count_ == 0) {
-#ifndef NDEBUG
-    in_dtor_ = true;
-#endif
-    return true;
-  }
-  return false;
-}
-
-RefCountedThreadSafeBase::RefCountedThreadSafeBase() : ref_count_(0) {
-#ifndef NDEBUG
-  in_dtor_ = false;
-#endif
-}
-
-RefCountedThreadSafeBase::~RefCountedThreadSafeBase() {
-#ifndef NDEBUG
-  DCHECK(in_dtor_) << "RefCountedThreadSafe object deleted without "
-                      "calling Release()";
-#endif
-}
-
-void RefCountedThreadSafeBase::AddRef() {
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-#endif
-  AtomicRefCountInc(&ref_count_);
-}
-
-bool RefCountedThreadSafeBase::Release() {
-#ifndef NDEBUG
-  DCHECK(!in_dtor_);
-  DCHECK(!AtomicRefCountIsZero(&ref_count_));
-#endif
-  if (!AtomicRefCountDec(&ref_count_)) {
-#ifndef NDEBUG
-    in_dtor_ = true;
-#endif
-    return true;
-  }
-  return false;
-}
-
-}  // namespace subtle
-
-}  // namespace base
deleted file mode 100644
--- a/ipc/chromium/src/base/ref_counted.h
+++ /dev/null
@@ -1,231 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_REF_COUNTED_H_
-#define BASE_REF_COUNTED_H_
-
-#include "base/atomic_ref_count.h"
-#include "base/thread_collision_warner.h"
-
-namespace base {
-
-namespace subtle {
-
-class RefCountedBase {
- protected:
-  RefCountedBase();
-  ~RefCountedBase();
-
-  void AddRef();
-
-  // Returns true if the object should self-delete.
-  bool Release();
-
- private:
-  int ref_count_;
-#ifndef NDEBUG
-  bool in_dtor_;
-#endif
-
-  DFAKE_MUTEX(add_release_)
-
-  DISALLOW_COPY_AND_ASSIGN(RefCountedBase);
-};
-
-class RefCountedThreadSafeBase {
- protected:
-  RefCountedThreadSafeBase();
-  ~RefCountedThreadSafeBase();
-
-  void AddRef();
-
-  // Returns true if the object should self-delete.
-  bool Release();
-
- private:
-  AtomicRefCount ref_count_;
-#ifndef NDEBUG
-  bool in_dtor_;
-#endif
-
-  DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafeBase);
-};
-
-
-
-}  // namespace subtle
-
-//
-// A base class for reference counted classes.  Otherwise, known as a cheap
-// knock-off of WebKit's RefCounted<T> class.  To use this guy just extend your
-// class from it like so:
-//
-//   class MyFoo : public base::RefCounted<MyFoo> {
-//    ...
-//   };
-//
-template <class T>
-class RefCounted : public subtle::RefCountedBase {
- public:
-  RefCounted() { }
-  ~RefCounted() { }
-
-  void AddRef() {
-    subtle::RefCountedBase::AddRef();
-  }
-
-  void Release() {
-    if (subtle::RefCountedBase::Release()) {
-      delete static_cast<T*>(this);
-    }
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(RefCounted<T>);
-};
-
-//
-// A thread-safe variant of RefCounted<T>
-//
-//   class MyFoo : public base::RefCountedThreadSafe<MyFoo> {
-//    ...
-//   };
-//
-template <class T>
-class RefCountedThreadSafe : public subtle::RefCountedThreadSafeBase {
- public:
-  RefCountedThreadSafe() { }
-  ~RefCountedThreadSafe() { }
-
-  void AddRef() {
-    subtle::RefCountedThreadSafeBase::AddRef();
-  }
-
-  void Release() {
-    if (subtle::RefCountedThreadSafeBase::Release()) {
-      delete static_cast<T*>(this);
-    }
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(RefCountedThreadSafe<T>);
-};
-
-//
-// A wrapper for some piece of data so we can place other things in
-// scoped_refptrs<>.
-//
-template<typename T>
-class RefCountedData : public base::RefCounted< base::RefCountedData<T> > {
- public:
-  RefCountedData() : data() {}
-  explicit RefCountedData(const T& in_value) : data(in_value) {}
-
-  T data;
-};
-
-}  // namespace base
-
-//
-// A smart pointer class for reference counted objects.  Use this class instead
-// of calling AddRef and Release manually on a reference counted object to
-// avoid common memory leaks caused by forgetting to Release an object
-// reference.  Sample usage:
-//
-//   class MyFoo : public RefCounted<MyFoo> {
-//    ...
-//   };
-//
-//   void some_function() {
-//     scoped_refptr<MyFoo> foo = new MyFoo();
-//     foo->Method(param);
-//     // |foo| is released when this function returns
-//   }
-//
-//   void some_other_function() {
-//     scoped_refptr<MyFoo> foo = new MyFoo();
-//     ...
-//     foo = NULL;  // explicitly releases |foo|
-//     ...
-//     if (foo)
-//       foo->Method(param);
-//   }
-//
-// The above examples show how scoped_refptr<T> acts like a pointer to T.
-// Given two scoped_refptr<T> classes, it is also possible to exchange
-// references between the two objects, like so:
-//
-//   {
-//     scoped_refptr<MyFoo> a = new MyFoo();
-//     scoped_refptr<MyFoo> b;
-//
-//     b.swap(a);
-//     // now, |b| references the MyFoo object, and |a| references NULL.
-//   }
-//
-// To make both |a| and |b| in the above example reference the same MyFoo
-// object, simply use the assignment operator:
-//
-//   {
-//     scoped_refptr<MyFoo> a = new MyFoo();
-//     scoped_refptr<MyFoo> b;
-//
-//     b = a;
-//     // now, |a| and |b| each own a reference to the same MyFoo object.
-//   }
-//
-template <class T>
-class scoped_refptr {
- public:
-  scoped_refptr() : ptr_(NULL) {
-  }
-
-  MOZ_IMPLICIT scoped_refptr(T* p) : ptr_(p) {
-    if (ptr_)
-      ptr_->AddRef();
-  }
-
-  scoped_refptr(const scoped_refptr<T>& r) : ptr_(r.ptr_) {
-    if (ptr_)
-      ptr_->AddRef();
-  }
-
-  ~scoped_refptr() {
-    if (ptr_)
-      ptr_->Release();
-  }
-
-  T* get() const { return ptr_; }
-  operator T*() const { return ptr_; }
-  T* operator->() const { return ptr_; }
-
-  scoped_refptr<T>& operator=(T* p) {
-    // AddRef first so that self assignment should work
-    if (p)
-      p->AddRef();
-    if (ptr_ )
-      ptr_ ->Release();
-    ptr_ = p;
-    return *this;
-  }
-
-  scoped_refptr<T>& operator=(const scoped_refptr<T>& r) {
-    return *this = r.ptr_;
-  }
-
-  void swap(T** pp) {
-    T* p = ptr_;
-    ptr_ = *pp;
-    *pp = p;
-  }
-
-  void swap(scoped_refptr<T>& r) {
-    swap(&r.ptr_);
-  }
-
- protected:
-  T* ptr_;
-};
-
-#endif  // BASE_REF_COUNTED_H_
--- a/ipc/chromium/src/base/revocable_store.h
+++ b/ipc/chromium/src/base/revocable_store.h
@@ -1,32 +1,37 @@
 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_REVOCABLE_STORE_H_
 #define BASE_REVOCABLE_STORE_H_
 
-#include "base/ref_counted.h"
+#include "base/basictypes.h"
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 
 // |RevocableStore| is a container of items that can be removed from the store.
 class RevocableStore {
  public:
   // A |StoreRef| is used to link the |RevocableStore| to its items.  There is
   // one StoreRef per store, and each item holds a reference to it.  If the
   // store wishes to revoke its items, it sets |store_| to null.  Items are
   // permitted to release their reference to the |StoreRef| when they no longer
   // require the store.
-  class StoreRef : public base::RefCounted<StoreRef> {
+  class StoreRef MOZ_FINAL {
    public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(StoreRef)
     explicit StoreRef(RevocableStore* store) : store_(store) { }
 
     void set_store(RevocableStore* store) { store_ = store; }
     RevocableStore* store() const { return store_; }
 
+   protected:
+    ~StoreRef() {}
    private:
     RevocableStore* store_;
 
     DISALLOW_EVIL_CONSTRUCTORS(StoreRef);
   };
 
   // An item in the store.  On construction, the object adds itself to the
   // store.
@@ -36,17 +41,17 @@ class RevocableStore {
     ~Revocable();
 
     // This item has been revoked if it no longer has a pointer to the store.
     bool revoked() const { return !store_reference_->store(); }
 
   private:
     // We hold a reference to the store through this ref pointer.  We release
     // this reference on destruction.
-    scoped_refptr<StoreRef> store_reference_;
+    nsRefPtr<StoreRef> store_reference_;
 
     DISALLOW_EVIL_CONSTRUCTORS(Revocable);
   };
 
   RevocableStore();
   ~RevocableStore();
 
   // Revokes all the items in the store.
@@ -58,17 +63,17 @@ class RevocableStore {
  private:
   friend class Revocable;
 
   // Adds an item to the store.  To add an item to the store, construct it
   // with a pointer to the store.
   void Add(Revocable* item);
 
   // This is the reference the unrevoked items in the store hold.
-  scoped_refptr<StoreRef> owning_reference_;
+  nsRefPtr<StoreRef> owning_reference_;
 
   // The number of unrevoked items in the store.
   int count_;
 
   DISALLOW_EVIL_CONSTRUCTORS(RevocableStore);
 };
 
 #endif  // BASE_REVOCABLE_STORE_H_
deleted file mode 100644
--- a/ipc/chromium/src/base/scoped_ptr.h
+++ /dev/null
@@ -1,380 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Scopers help you manage ownership of a pointer, helping you easily manage the
-// a pointer within a scope, and automatically destroying the pointer at the
-// end of a scope.  There are two main classes you will use, which coorespond
-// to the operators new/delete and new[]/delete[].
-//
-// Example usage (scoped_ptr):
-//   {
-//     scoped_ptr<Foo> foo(new Foo("wee"));
-//   }  // foo goes out of scope, releasing the pointer with it.
-//
-//   {
-//     scoped_ptr<Foo> foo;          // No pointer managed.
-//     foo.reset(new Foo("wee"));    // Now a pointer is managed.
-//     foo.reset(new Foo("wee2"));   // Foo("wee") was destroyed.
-//     foo.reset(new Foo("wee3"));   // Foo("wee2") was destroyed.
-//     foo->Method();                // Foo::Method() called.
-//     foo.get()->Method();          // Foo::Method() called.
-//     SomeFunc(foo.Release());      // SomeFunc takes owernship, foo no longer
-//                                   // manages a pointer.
-//     foo.reset(new Foo("wee4"));   // foo manages a pointer again.
-//     foo.reset();                  // Foo("wee4") destroyed, foo no longer
-//                                   // manages a pointer.
-//   }  // foo wasn't managing a pointer, so nothing was destroyed.
-//
-// Example usage (scoped_array):
-//   {
-//     scoped_array<Foo> foo(new Foo[100]);
-//     foo.get()->Method();  // Foo::Method on the 0th element.
-//     foo[10].Method();     // Foo::Method on the 10th element.
-//   }
-
-#ifndef BASE_SCOPED_PTR_H_
-#define BASE_SCOPED_PTR_H_
-
-// This is an implementation designed to match the anticipated future TR2
-// implementation of the scoped_ptr class, and its closely-related brethren,
-// scoped_array, scoped_ptr_malloc.
-
-#include <assert.h>
-#include <stdlib.h>
-#include <cstddef>
-
-// A scoped_ptr<T> is like a T*, except that the destructor of scoped_ptr<T>
-// automatically deletes the pointer it holds (if any).
-// That is, scoped_ptr<T> owns the T object that it points to.
-// Like a T*, a scoped_ptr<T> may hold either NULL or a pointer to a T object.
-// Also like T*, scoped_ptr<T> is thread-compatible, and once you
-// dereference it, you get the threadsafety guarantees of T.
-//
-// The size of a scoped_ptr is small:
-// sizeof(scoped_ptr<C>) == sizeof(C*)
-template <class C>
-class scoped_ptr {
- public:
-
-  // The element type
-  typedef C element_type;
-
-  // Constructor.  Defaults to intializing with NULL.
-  // There is no way to create an uninitialized scoped_ptr.
-  // The input parameter must be allocated with new.
-  explicit scoped_ptr(C* p = NULL) : ptr_(p) { }
-
-  // Destructor.  If there is a C object, delete it.
-  // We don't need to test ptr_ == NULL because C++ does that for us.
-  ~scoped_ptr() {
-    enum { type_must_be_complete = sizeof(C) };
-    delete ptr_;
-  }
-
-  // Reset.  Deletes the current owned object, if any.
-  // Then takes ownership of a new object, if given.
-  // this->reset(this->get()) works.
-  void reset(C* p = NULL) {
-    if (p != ptr_) {
-      enum { type_must_be_complete = sizeof(C) };
-      delete ptr_;
-      ptr_ = p;
-    }
-  }
-
-  // Accessors to get the owned object.
-  // operator* and operator-> will assert() if there is no current object.
-  C& operator*() const {
-    assert(ptr_ != NULL);
-    return *ptr_;
-  }
-  C* operator->() const  {
-    assert(ptr_ != NULL);
-    return ptr_;
-  }
-  C* get() const { return ptr_; }
-
-  // Comparison operators.
-  // These return whether two scoped_ptr refer to the same object, not just to
-  // two different but equal objects.
-  bool operator==(C* p) const { return ptr_ == p; }
-  bool operator!=(C* p) const { return ptr_ != p; }
-
-  // Swap two scoped pointers.
-  void swap(scoped_ptr& p2) {
-    C* tmp = ptr_;
-    ptr_ = p2.ptr_;
-    p2.ptr_ = tmp;
-  }
-
-  // Release a pointer.
-  // The return value is the current pointer held by this object.
-  // If this object holds a NULL pointer, the return value is NULL.
-  // After this operation, this object will hold a NULL pointer,
-  // and will not own the object any more.
-  C* release() {
-    C* retVal = ptr_;
-    ptr_ = NULL;
-    return retVal;
-  }
-
- private:
-  C* ptr_;
-
-  // Forbid comparison of scoped_ptr types.  If C2 != C, it totally doesn't
-  // make sense, and if C2 == C, it still doesn't make sense because you should
-  // never have the same object owned by two different scoped_ptrs.
-  template <class C2> bool operator==(scoped_ptr<C2> const& p2) const;
-  template <class C2> bool operator!=(scoped_ptr<C2> const& p2) const;
-
-  // Disallow evil constructors
-  scoped_ptr(const scoped_ptr&);
-  void operator=(const scoped_ptr&);
-};
-
-// Free functions
-template <class C>
-void swap(scoped_ptr<C>& p1, scoped_ptr<C>& p2) {
-  p1.swap(p2);
-}
-
-template <class C>
-bool operator==(C* p1, const scoped_ptr<C>& p2) {
-  return p1 == p2.get();
-}
-
-template <class C>
-bool operator!=(C* p1, const scoped_ptr<C>& p2) {
-  return p1 != p2.get();
-}
-
-// scoped_array<C> is like scoped_ptr<C>, except that the caller must allocate
-// with new [] and the destructor deletes objects with delete [].
-//
-// As with scoped_ptr<C>, a scoped_array<C> either points to an object
-// or is NULL.  A scoped_array<C> owns the object that it points to.
-// scoped_array<T> is thread-compatible, and once you index into it,
-// the returned objects have only the threadsafety guarantees of T.
-//
-// Size: sizeof(scoped_array<C>) == sizeof(C*)
-template <class C>
-class scoped_array {
- public:
-
-  // The element type
-  typedef C element_type;
-
-  // Constructor.  Defaults to intializing with NULL.
-  // There is no way to create an uninitialized scoped_array.
-  // The input parameter must be allocated with new [].
-  explicit scoped_array(C* p = NULL) : array_(p) { }
-
-  // Destructor.  If there is a C object, delete it.
-  // We don't need to test ptr_ == NULL because C++ does that for us.
-  ~scoped_array() {
-    enum { type_must_be_complete = sizeof(C) };
-    delete[] array_;
-  }
-
-  // Reset.  Deletes the current owned object, if any.
-  // Then takes ownership of a new object, if given.
-  // this->reset(this->get()) works.
-  void reset(C* p = NULL) {
-    if (p != array_) {
-      enum { type_must_be_complete = sizeof(C) };
-      delete[] array_;
-      array_ = p;
-    }
-  }
-
-  // Get one element of the current object.
-  // Will assert() if there is no current object, or index i is negative.
-  C& operator[](std::ptrdiff_t i) const {
-    assert(i >= 0);
-    assert(array_ != NULL);
-    return array_[i];
-  }
-
-  // Get a pointer to the zeroth element of the current object.
-  // If there is no current object, return NULL.
-  C* get() const {
-    return array_;
-  }
-
-  // Comparison operators.
-  // These return whether two scoped_array refer to the same object, not just to
-  // two different but equal objects.
-  bool operator==(C* p) const { return array_ == p; }
-  bool operator!=(C* p) const { return array_ != p; }
-
-  // Swap two scoped arrays.
-  void swap(scoped_array& p2) {
-    C* tmp = array_;
-    array_ = p2.array_;
-    p2.array_ = tmp;
-  }
-
-  // Release an array.
-  // The return value is the current pointer held by this object.
-  // If this object holds a NULL pointer, the return value is NULL.
-  // After this operation, this object will hold a NULL pointer,
-  // and will not own the object any more.
-  C* release() {
-    C* retVal = array_;
-    array_ = NULL;
-    return retVal;
-  }
-
- private:
-  C* array_;
-
-  // Forbid comparison of different scoped_array types.
-  template <class C2> bool operator==(scoped_array<C2> const& p2) const;
-  template <class C2> bool operator!=(scoped_array<C2> const& p2) const;
-
-  // Disallow evil constructors
-  scoped_array(const scoped_array&);
-  void operator=(const scoped_array&);
-};
-
-// Free functions
-template <class C>
-void swap(scoped_array<C>& p1, scoped_array<C>& p2) {
-  p1.swap(p2);
-}
-
-template <class C>
-bool operator==(C* p1, const scoped_array<C>& p2) {
-  return p1 == p2.get();
-}
-
-template <class C>
-bool operator!=(C* p1, const scoped_array<C>& p2) {
-  return p1 != p2.get();
-}
-
-// This class wraps the c library function free() in a class that can be
-// passed as a template argument to scoped_ptr_malloc below.
-class ScopedPtrMallocFree {
- public:
-  inline void operator()(void* x) const {
-    free(x);
-  }
-};
-
-// scoped_ptr_malloc<> is similar to scoped_ptr<>, but it accepts a
-// second template argument, the functor used to free the object.
-
-template<class C, class FreeProc = ScopedPtrMallocFree>
-class scoped_ptr_malloc {
- public:
-
-  // The element type
-  typedef C element_type;
-
-  // Constructor.  Defaults to intializing with NULL.
-  // There is no way to create an uninitialized scoped_ptr.
-  // The input parameter must be allocated with an allocator that matches the
-  // Free functor.  For the default Free functor, this is malloc, calloc, or
-  // realloc.
-  explicit scoped_ptr_malloc(C* p = NULL): ptr_(p) {}
-
-  // Destructor.  If there is a C object, call the Free functor.
-  ~scoped_ptr_malloc() {
-    free_(ptr_);
-  }
-
-  // Reset.  Calls the Free functor on the current owned object, if any.
-  // Then takes ownership of a new object, if given.
-  // this->reset(this->get()) works.
-  void reset(C* p = NULL) {
-    if (ptr_ != p) {
-      free_(ptr_);
-      ptr_ = p;
-    }
-  }
-
-  // Get the current object.
-  // operator* and operator-> will cause an assert() failure if there is
-  // no current object.
-  C& operator*() const {
-    assert(ptr_ != NULL);
-    return *ptr_;
-  }
-
-  C* operator->() const {
-    assert(ptr_ != NULL);
-    return ptr_;
-  }
-
-  C* get() const {
-    return ptr_;
-  }
-
-  // Comparison operators.
-  // These return whether a scoped_ptr_malloc and a plain pointer refer
-  // to the same object, not just to two different but equal objects.
-  // For compatibility wwith the boost-derived implementation, these
-  // take non-const arguments.
-  bool operator==(C* p) const {
-    return ptr_ == p;
-  }
-
-  bool operator!=(C* p) const {
-    return ptr_ != p;
-  }
-
-  // Swap two scoped pointers.
-  void swap(scoped_ptr_malloc & b) {
-    C* tmp = b.ptr_;
-    b.ptr_ = ptr_;
-    ptr_ = tmp;
-  }
-
-  // Release a pointer.
-  // The return value is the current pointer held by this object.
-  // If this object holds a NULL pointer, the return value is NULL.
-  // After this operation, this object will hold a NULL pointer,
-  // and will not own the object any more.
-  C* release() {
-    C* tmp = ptr_;
-    ptr_ = NULL;
-    return tmp;
-  }
-
- private:
-  C* ptr_;
-
-  // no reason to use these: each scoped_ptr_malloc should have its own object
-  template <class C2, class GP>
-  bool operator==(scoped_ptr_malloc<C2, GP> const& p) const;
-  template <class C2, class GP>
-  bool operator!=(scoped_ptr_malloc<C2, GP> const& p) const;
-
-  static FreeProc const free_;
-
-  // Disallow evil constructors
-  scoped_ptr_malloc(const scoped_ptr_malloc&);
-  void operator=(const scoped_ptr_malloc&);
-};
-
-template<class C, class FP>
-FP const scoped_ptr_malloc<C, FP>::free_ = FP();
-
-template<class C, class FP> inline
-void swap(scoped_ptr_malloc<C, FP>& a, scoped_ptr_malloc<C, FP>& b) {
-  a.swap(b);
-}
-
-template<class C, class FP> inline
-bool operator==(C* p, const scoped_ptr_malloc<C, FP>& b) {
-  return p == b.get();
-}
-
-template<class C, class FP> inline
-bool operator!=(C* p, const scoped_ptr_malloc<C, FP>& b) {
-  return p != b.get();
-}
-
-#endif  // BASE_SCOPED_PTR_H_
--- a/ipc/chromium/src/base/shared_memory_posix.cc
+++ b/ipc/chromium/src/base/shared_memory_posix.cc
@@ -9,16 +9,17 @@
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/platform_thread.h"
 #include "base/string_util.h"
+#include "mozilla/UniquePtr.h"
 
 namespace base {
 
 SharedMemory::SharedMemory()
     : mapped_file_(-1),
       inode_(0),
       memory_(NULL),
       read_only_(false),
@@ -137,17 +138,17 @@ class ScopedFILEClose {
  public:
   inline void operator()(FILE* x) const {
     if (x) {
       fclose(x);
     }
   }
 };
 
-typedef scoped_ptr_malloc<FILE, ScopedFILEClose> ScopedFILE;
+typedef mozilla::UniquePtr<FILE, ScopedFILEClose> ScopedFILE;
 
 }
 
 // Chromium mostly only use the unique/private shmem as specified by
 // "name == L"". The exception is in the StatsTable.
 // TODO(jrg): there is no way to "clean up" all unused named shmem if
 // we restart from a crash.  (That isn't a new problem, but it is a problem.)
 // In case we want to delete it later, it may be useful to save the value
--- a/ipc/chromium/src/base/sys_info_win.cc
+++ b/ipc/chromium/src/base/sys_info_win.cc
@@ -2,18 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/sys_info.h"
 
 #include <windows.h>
 
 #include "base/logging.h"
-#include "base/scoped_ptr.h"
 #include "base/string_util.h"
+#include "mozilla/UniquePtr.h"
 
 namespace base {
 
 // static
 int SysInfo::NumberOfProcessors() {
   SYSTEM_INFO info;
   GetSystemInfo(&info);
   return static_cast<int>(info.dwNumberOfProcessors);
@@ -52,17 +52,17 @@ bool SysInfo::HasEnvVar(const wchar_t* v
 }
 
 // static
 std::wstring SysInfo::GetEnvVar(const wchar_t* var) {
   DWORD value_length = GetEnvironmentVariable(var, NULL, 0);
   if (value_length == 0) {
     return L"";
   }
-  scoped_array<wchar_t> value(new wchar_t[value_length]);
+  mozilla::UniquePtr<wchar_t[]> value(new wchar_t[value_length]);
   GetEnvironmentVariable(var, value.get(), value_length);
   return std::wstring(value.get());
 }
 
 // static
 std::string SysInfo::OperatingSystemName() {
   return "Windows NT";
 }
--- a/ipc/chromium/src/base/waitable_event.h
+++ b/ipc/chromium/src/base/waitable_event.h
@@ -11,17 +11,18 @@
 #include <windows.h>
 #endif
 
 #if defined(OS_POSIX)
 #include <list>
 #include <utility>
 #include "base/condition_variable.h"
 #include "base/lock.h"
-#include "base/ref_counted.h"
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 #endif
 
 #include "base/message_loop.h"
 
 namespace base {
 
 // This replaces INFINITE from Win32
 static const int kNoTimeout = -1;
@@ -135,33 +136,35 @@ class WaitableEvent {
   // On Windows, one can close a HANDLE which is currently being waited on. The
   // MSDN documentation says that the resulting behaviour is 'undefined', but
   // it doesn't crash. However, if we were to include the following members
   // directly then, on POSIX, one couldn't use WaitableEventWatcher to watch an
   // event which gets deleted. This mismatch has bitten us several times now,
   // so we have a kernel of the WaitableEvent, which is reference counted.
   // WaitableEventWatchers may then take a reference and thus match the Windows
   // behaviour.
-  struct WaitableEventKernel :
-      public RefCountedThreadSafe<WaitableEventKernel> {
+  struct WaitableEventKernel MOZ_FINAL {
    public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(WaitableEventKernel)
     WaitableEventKernel(bool manual_reset, bool initially_signaled)
         : manual_reset_(manual_reset),
           signaled_(initially_signaled) {
     }
 
     bool Dequeue(Waiter* waiter, void* tag);
 
     Lock lock_;
     const bool manual_reset_;
     bool signaled_;
     std::list<Waiter*> waiters_;
+   protected:
+    ~WaitableEventKernel() {}
   };
 
-  scoped_refptr<WaitableEventKernel> kernel_;
+  nsRefPtr<WaitableEventKernel> kernel_;
 
   bool SignalAll();
   bool SignalOne();
   void Enqueue(Waiter* waiter);
 
   // When dealing with arrays of WaitableEvent*, we want to sort by the address
   // of the WaitableEvent in order to have a globally consistent locking order.
   // In that case we keep them, in sorted order, in an array of pairs where the
--- a/ipc/chromium/src/base/waitable_event_watcher.h
+++ b/ipc/chromium/src/base/waitable_event_watcher.h
@@ -7,16 +7,17 @@
 
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include "base/object_watcher.h"
 #else
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
+#include "nsAutoPtr.h"
 #endif
 
 namespace base {
 
 class Flag;
 class AsyncWaiter;
 class AsyncCallbackTask;
 class WaitableEvent;
@@ -136,18 +137,18 @@ class WaitableEventWatcher
   ObjectWatcher watcher_;
 #else
   // ---------------------------------------------------------------------------
   // Implementation of MessageLoop::DestructionObserver
   // ---------------------------------------------------------------------------
   void WillDestroyCurrentMessageLoop();
 
   MessageLoop* message_loop_;
-  scoped_refptr<Flag> cancel_flag_;
+  nsRefPtr<Flag> cancel_flag_;
   AsyncWaiter* waiter_;
   AsyncCallbackTask* callback_task_;
-  scoped_refptr<WaitableEvent::WaitableEventKernel> kernel_;
+  nsRefPtr<WaitableEvent::WaitableEventKernel> kernel_;
 #endif
 };
 
 }  // namespace base
 
 #endif  // BASE_WAITABLE_EVENT_WATCHER_H_
--- a/ipc/chromium/src/base/waitable_event_watcher_posix.cc
+++ b/ipc/chromium/src/base/waitable_event_watcher_posix.cc
@@ -4,16 +4,18 @@
 
 #include "base/waitable_event_watcher.h"
 
 #include "base/condition_variable.h"
 #include "base/lock.h"
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
 
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 #include "mozilla/Attributes.h"
 
 namespace base {
 
 // -----------------------------------------------------------------------------
 // WaitableEventWatcher (async waits).
 //
 // The basic design is that we add an AsyncWaiter to the wait-list of the event.
@@ -24,30 +26,33 @@ namespace base {
 // set when the wait has been canceled. At each stage in the above, we check the
 // flag before going onto the next stage. Since the wait may only be canceled in
 // the MessageLoop which runs the Task, we are assured that the delegate cannot
 // be called after canceling...
 
 // -----------------------------------------------------------------------------
 // A thread-safe, reference-counted, write-once flag.
 // -----------------------------------------------------------------------------
-class Flag : public RefCountedThreadSafe<Flag> {
+class Flag MOZ_FINAL {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(Flag)
   Flag() { flag_ = false; }
 
   void Set() {
     AutoLock locked(lock_);
     flag_ = true;
   }
 
   bool value() const {
     AutoLock locked(lock_);
     return flag_;
   }
 
+ protected:
+  ~Flag() {}
  private:
   mutable Lock lock_;
   bool flag_;
 };
 
 // -----------------------------------------------------------------------------
 // This is an asynchronous waiter which posts a task to a MessageLoop when
 // fired. An AsyncWaiter may only be in a single wait-list.
@@ -80,17 +85,17 @@ class AsyncWaiter MOZ_FINAL : public Wai
   // See StopWatching for discussion
   bool Compare(void* tag) {
     return tag == flag_.get();
   }
 
  private:
   MessageLoop *const message_loop_;
   Task *const cb_task_;
-  scoped_refptr<Flag> flag_;
+  nsRefPtr<Flag> flag_;
 };
 
 // -----------------------------------------------------------------------------
 // For async waits we need to make a callback in a MessageLoop thread. We do
 // this by posting this task, which calls the delegate and keeps track of when
 // the event is canceled.
 // -----------------------------------------------------------------------------
 class AsyncCallbackTask : public Task {
@@ -110,17 +115,17 @@ class AsyncCallbackTask : public Task {
       flag_->Set();
       delegate_->OnWaitableEventSignaled(event_);
     }
 
     // We are deleted by the MessageLoop
   }
 
  private:
-  scoped_refptr<Flag> flag_;
+  nsRefPtr<Flag> flag_;
   WaitableEventWatcher::Delegate *const delegate_;
   WaitableEvent *const event_;
 };
 
 WaitableEventWatcher::WaitableEventWatcher()
     : event_(NULL),
       message_loop_(NULL),
       cancel_flag_(NULL),
--- a/ipc/chromium/src/base/win_util.cc
+++ b/ipc/chromium/src/base/win_util.cc
@@ -4,18 +4,16 @@
 
 #include "base/win_util.h"
 
 #include <map>
 #include <sddl.h>
 
 #include "base/logging.h"
 #include "base/registry.h"
-#include "base/scoped_handle.h"
-#include "base/scoped_ptr.h"
 #include "base/singleton.h"
 #include "base/string_util.h"
 #include "base/tracked.h"
 
 namespace win_util {
 
 WinVersion GetWinVersion() {
   static bool checked_version = false;
--- a/ipc/chromium/src/chrome/common/child_process.h
+++ b/ipc/chromium/src/chrome/common/child_process.h
@@ -4,18 +4,18 @@
 
 #ifndef CHROME_COMMON_CHILD_PROCESS_H__
 #define CHROME_COMMON_CHILD_PROCESS_H__
 
 #include <string>
 #include <vector>
 #include "base/basictypes.h"
 #include "base/message_loop.h"
-#include "base/scoped_ptr.h"
 #include "base/waitable_event.h"
+#include "mozilla/UniquePtr.h"
 
 class ChildThread;
 
 
 // Base class for child processes of the browser process (i.e. renderer and
 // plugin host). This is a singleton object for each child process.
 class ChildProcess {
  public:
@@ -46,17 +46,17 @@ class ChildProcess {
   void ReleaseProcess();
 
   // Getter for the one ChildProcess object for this process.
   static ChildProcess* current() { return child_process_; }
 
  private:
   // NOTE: make sure that child_thread_ is listed before shutdown_event_, since
   // it depends on it (indirectly through IPC::SyncChannel).
-  scoped_ptr<ChildThread> child_thread_;
+  mozilla::UniquePtr<ChildThread> child_thread_;
 
   int ref_count_;
 
   // An event that will be signalled when we shutdown.
   base::WaitableEvent shutdown_event_;
 
   // The singleton instance for this process.
   static ChildProcess* child_process_;
--- a/ipc/chromium/src/chrome/common/child_process_host.h
+++ b/ipc/chromium/src/chrome/common/child_process_host.h
@@ -5,20 +5,20 @@
 #ifndef CHROME_COMMON_CHILD_PROCESS_HOST_H_
 #define CHROME_COMMON_CHILD_PROCESS_HOST_H_
 
 #include "build/build_config.h"
 
 #include <list>
 
 #include "base/basictypes.h"
-#include "base/scoped_ptr.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/child_process_info.h"
 #include "chrome/common/ipc_channel.h"
+#include "mozilla/UniquePtr.h"
 
 namespace mozilla {
 namespace ipc {
 class FileDescriptor;
 }
 }
 
 class NotificationType;
@@ -111,20 +111,20 @@ class ChildProcessHost :
   };
 
   ListenerHook listener_;
 
   // True while we're waiting the channel to be opened.
   bool opening_channel_;
 
   // The IPC::Channel.
-  scoped_ptr<IPC::Channel> channel_;
+  mozilla::UniquePtr<IPC::Channel> channel_;
 
   // IPC Channel's id.
   std::wstring channel_id_;
 
   // Used to watch the child process handle.
   base::WaitableEventWatcher watcher_;
 
-  scoped_ptr<base::WaitableEvent> process_event_;
+  mozilla::UniquePtr<base::WaitableEvent> process_event_;
 };
 
 #endif  // CHROME_COMMON_CHILD_PROCESS_HOST_H_
--- a/ipc/chromium/src/chrome/common/child_thread.cc
+++ b/ipc/chromium/src/chrome/common/child_thread.cc
@@ -84,32 +84,32 @@ void ChildThread::OnMessageReceived(cons
   }
 }
 
 ChildThread* ChildThread::current() {
   return ChildProcess::current()->child_thread();
 }
 
 void ChildThread::Init() {
-  channel_.reset(new IPC::Channel(channel_name_,
-                                  IPC::Channel::MODE_CLIENT,
-                                  this));
+  channel_ = mozilla::MakeUnique<IPC::Channel>(channel_name_,
+                                               IPC::Channel::MODE_CLIENT,
+                                               this);
 
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::current()->SetIPCSender(this);
 #endif
 }
 
 void ChildThread::CleanUp() {
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::current()->SetIPCSender(NULL);
 #endif
   // Need to destruct the SyncChannel to the browser before we go away because
   // it caches a pointer to this thread.
-  channel_.reset();
+  channel_ = nullptr;
 }
 
 void ChildThread::OnProcessFinalRelease() {
   if (!check_with_browser_before_shutdown_) {
     owner_loop_->PostTask(FROM_HERE, new MessageLoop::QuitTask());
     return;
   }
 }
--- a/ipc/chromium/src/chrome/common/child_thread.h
+++ b/ipc/chromium/src/chrome/common/child_thread.h
@@ -3,16 +3,17 @@
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_CHILD_THREAD_H_
 #define CHROME_COMMON_CHILD_THREAD_H_
 
 #include "base/thread.h"
 #include "chrome/common/ipc_sync_channel.h"
 #include "chrome/common/message_router.h"
+#include "mozilla/UniquePtr.h"
 
 class ResourceDispatcher;
 
 // Child processes's background thread should derive from this class.
 class ChildThread : public IPC::Channel::Listener,
                     public IPC::Message::Sender,
                     public base::Thread {
  public:
@@ -64,17 +65,17 @@ class ChildThread : public IPC::Channel:
 #ifdef MOZ_NUWA_PROCESS
   static void MarkThread();
 #endif
 
   // The message loop used to run tasks on the thread that started this thread.
   MessageLoop* owner_loop_;
 
   std::wstring channel_name_;
-  scoped_ptr<IPC::Channel> channel_;
+  mozilla::UniquePtr<IPC::Channel> channel_;
 
   // Used only on the background render thread to implement message routing
   // functionality to the consumers of the ChildThread.
   MessageRouter router_;
 
   Thread::Options options_;
 
   // If true, checks with the browser process before shutdown.  This avoids race
--- a/ipc/chromium/src/chrome/common/file_descriptor_set_posix.h
+++ b/ipc/chromium/src/chrome/common/file_descriptor_set_posix.h
@@ -4,27 +4,27 @@
 
 #ifndef CHROME_COMMON_FILE_DESCRIPTOR_SET_POSIX_H_
 #define CHROME_COMMON_FILE_DESCRIPTOR_SET_POSIX_H_
 
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/file_descriptor_posix.h"
-#include "base/ref_counted.h"
+#include "nsISupportsImpl.h"
 
 // -----------------------------------------------------------------------------
 // A FileDescriptorSet is an ordered set of POSIX file descriptors. These are
 // associated with IPC messages so that descriptors can be transmitted over a
 // UNIX domain socket.
 // -----------------------------------------------------------------------------
-class FileDescriptorSet : public base::RefCountedThreadSafe<FileDescriptorSet> {
+class FileDescriptorSet {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(FileDescriptorSet)
   FileDescriptorSet();
-  ~FileDescriptorSet();
 
   // Mac and Linux both limit the number of file descriptors per message to
   // slightly more than 250.
   enum {
     MAX_DESCRIPTORS_PER_MESSAGE = 250
   };
 
   // ---------------------------------------------------------------------------
@@ -79,16 +79,18 @@ class FileDescriptorSet : public base::R
   // Set the contents of the set from the given buffer. This set must be empty
   // before calling. The auto-close flag is set on all the descriptors so that
   // unconsumed descriptors are closed on destruction.
   void SetDescriptors(const int* buffer, unsigned count);
 
   // ---------------------------------------------------------------------------
 
  private:
+  ~FileDescriptorSet();
+
   // A vector of descriptors and close flags. If this message is sent, then
   // these descriptors are sent as control data. After sending, any descriptors
   // with a true flag are closed. If this message has been received, then these
   // are the descriptors which were received and all close flags are true.
   std::vector<base::FileDescriptor> descriptors_;
 
   // This contains the index of the next descriptor which should be consumed.
   // It's used in a couple of ways. Firstly, at destruction we can check that
--- a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
@@ -17,24 +17,24 @@
 #include <string>
 #include <map>
 
 #include "base/command_line.h"
 #include "base/eintr_wrapper.h"
 #include "base/lock.h"
 #include "base/logging.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/string_util.h"
 #include "base/singleton.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/file_descriptor_set_posix.h"
 #include "chrome/common/ipc_logging.h"
 #include "chrome/common/ipc_message_utils.h"
 #include "mozilla/ipc/ProtocolUtils.h"
+#include "mozilla/UniquePtr.h"
 
 #ifdef MOZ_TASK_TRACER
 #include "GeckoTaskTracerImpl.h"
 using namespace mozilla::tasktracer;
 #endif
 
 namespace IPC {
 
@@ -366,19 +366,19 @@ bool Channel::ChannelImpl::CreatePipe(co
  */
 void Channel::ChannelImpl::ResetFileDescriptor(int fd) {
   NS_ASSERTION(fd > 0 && fd == pipe_, "Invalid file descriptor");
 
   EnqueueHelloMessage();
 }
 
 bool Channel::ChannelImpl::EnqueueHelloMessage() {
-  scoped_ptr<Message> msg(new Message(MSG_ROUTING_NONE,
-                                      HELLO_MESSAGE_TYPE,
-                                      IPC::Message::PRIORITY_NORMAL));
+  mozilla::UniquePtr<Message> msg(new Message(MSG_ROUTING_NONE,
+                                              HELLO_MESSAGE_TYPE,
+                                              IPC::Message::PRIORITY_NORMAL));
   if (!msg->WriteInt(base::GetCurrentProcId())) {
     Close();
     return false;
   }
 
   OutputQueuePush(msg.release());
   return true;
 }
--- a/ipc/chromium/src/chrome/common/ipc_channel_posix.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.h
@@ -12,16 +12,18 @@
 #include <queue>
 #include <string>
 #include <vector>
 #include <list>
 
 #include "base/message_loop.h"
 #include "chrome/common/file_descriptor_set_posix.h"
 
+#include "nsAutoPtr.h"
+
 namespace IPC {
 
 // An implementation of ChannelImpl for POSIX systems that works via
 // socketpairs.  See the .cc file for an overview of the implementation.
 class Channel::ChannelImpl : public MessageLoopForIO::Watcher {
  public:
   // Mirror methods of Channel, see ipc_channel.h for description.
   ChannelImpl(const std::wstring& channel_id, Mode mode, Listener* listener);
@@ -141,17 +143,17 @@ class Channel::ChannelImpl : public Mess
   bool processing_incoming_;
 
   // This flag is set after we've closed the channel.
   bool closed_;
 
 #if defined(OS_MACOSX)
   struct PendingDescriptors {
     uint32_t id;
-    scoped_refptr<FileDescriptorSet> fds;
+    nsRefPtr<FileDescriptorSet> fds;
 
     PendingDescriptors() : id(0) { }
     PendingDescriptors(uint32_t id, FileDescriptorSet *fds)
       : id(id),
         fds(fds)
     { }
   };
 
--- a/ipc/chromium/src/chrome/common/ipc_channel_proxy.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_proxy.h
@@ -2,18 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_IPC_CHANNEL_PROXY_H__
 #define CHROME_COMMON_IPC_CHANNEL_PROXY_H__
 
 #include <vector>
 #include "base/lock.h"
-#include "base/ref_counted.h"
 #include "chrome/common/ipc_channel.h"
+#include "nsISupportsImpl.h"
+#include "nsAutoPtr.h"
 
 class MessageLoop;
 
 namespace IPC {
 
 //-----------------------------------------------------------------------------
 // IPC::ChannelProxy
 //
@@ -41,19 +42,19 @@ namespace IPC {
 //
 // The consumer of IPC::ChannelProxy is responsible for allocating the Thread
 // instance where the IPC::Channel will be created and operated.
 //
 class ChannelProxy : public Message::Sender {
  public:
   // A class that receives messages on the thread where the IPC channel is
   // running.  It can choose to prevent the default action for an IPC message.
-  class MessageFilter : public base::RefCountedThreadSafe<MessageFilter> {
+  class MessageFilter {
    public:
-    virtual ~MessageFilter() {}
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MessageFilter)
 
     // Called on the background thread to provide the filter with access to the
     // channel.  Called when the IPC channel is initialized or when AddFilter
     // is called if the channel is already initialized.
     virtual void OnFilterAdded(Channel* channel) {}
 
     // Called on the background thread when the filter has been removed from
     // the ChannelProxy and when the Channel is closing.  After a filter is
@@ -72,16 +73,18 @@ class ChannelProxy : public Message::Sen
     // OnFilterRemoved is called immediately after this.
     virtual void OnChannelClosing() {}
 
     // Return true to indicate that the message was handled, or false to let
     // the message be handled in the default way.
     virtual bool OnMessageReceived(const Message& message) {
       return false;
     }
+   protected:
+    virtual ~MessageFilter() {}
   };
 
   // Initializes a channel proxy.  The channel_id and mode parameters are
   // passed directly to the underlying IPC::Channel.  The listener is called on
   // the thread that creates the ChannelProxy.  The filter's OnMessageReceived
   // method is called on the thread where the IPC::Channel is running.  The
   // filter may be null if the consumer is not interested in handling messages
   // on the background thread.  Any message not handled by the filter will be
@@ -129,29 +132,30 @@ class ChannelProxy : public Message::Sen
   // A subclass uses this constructor if it needs to add more information
   // to the internal state.  If create_pipe_now is true, the pipe is created
   // immediately.  Otherwise it's created on the IO thread.
   ChannelProxy(const std::wstring& channel_id, Channel::Mode mode,
                MessageLoop* ipc_thread_loop, Context* context,
                bool create_pipe_now);
 
   // Used internally to hold state that is referenced on the IPC thread.
-  class Context : public base::RefCountedThreadSafe<Context>,
-                  public Channel::Listener {
+  class Context : public Channel::Listener {
    public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(Context)
     Context(Channel::Listener* listener, MessageFilter* filter,
             MessageLoop* ipc_thread);
-    virtual ~Context() { }
     MessageLoop* ipc_message_loop() const { return ipc_message_loop_; }
     const std::wstring& channel_id() const { return channel_id_; }
 
     // Dispatches a message on the listener thread.
     void OnDispatchMessage(const Message& message);
 
    protected:
+    virtual ~Context() {}
+
     // IPC::Channel::Listener methods:
     virtual void OnMessageReceived(const Message& message);
     virtual void OnChannelConnected(int32_t peer_pid);
     virtual void OnChannelError();
 
     // Like OnMessageReceived but doesn't try the filters.
     void OnMessageReceivedNoFilter(const Message& message);
 
@@ -179,31 +183,31 @@ class ChannelProxy : public Message::Sen
     void OnRemoveFilter(MessageFilter* filter);
     void OnDispatchConnected();
     void OnDispatchError();
 
     MessageLoop* listener_message_loop_;
     Channel::Listener* listener_;
 
     // List of filters.  This is only accessed on the IPC thread.
-    std::vector<scoped_refptr<MessageFilter> > filters_;
+    std::vector<nsRefPtr<MessageFilter> > filters_;
     MessageLoop* ipc_message_loop_;
     Channel* channel_;
     std::wstring channel_id_;
     int peer_pid_;
     bool channel_connected_called_;
   };
 
   Context* context() { return context_; }
 
  private:
   void Init(const std::wstring& channel_id, Channel::Mode mode,
             MessageLoop* ipc_thread_loop, bool create_pipe_now);
 
   // By maintaining this indirection (ref-counted) to our internal state, we
   // can safely be destroyed while the background thread continues to do stuff
   // that involves this data.
-  scoped_refptr<Context> context_;
+  nsRefPtr<Context> context_;
 };
 
 }  // namespace IPC
 
 #endif  // CHROME_COMMON_IPC_CHANNEL_PROXY_H__
--- a/ipc/chromium/src/chrome/common/ipc_channel_win.cc
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
@@ -196,19 +196,19 @@ bool Channel::ChannelImpl::CreatePipe(co
     return false;
   }
 
   // Create the Hello message to be sent when Connect is called
   return EnqueueHelloMessage();
 }
 
 bool Channel::ChannelImpl::EnqueueHelloMessage() {
-  scoped_ptr<Message> m(new Message(MSG_ROUTING_NONE,
-                                    HELLO_MESSAGE_TYPE,
-                                    IPC::Message::PRIORITY_NORMAL));
+  mozilla::UniquePtr<Message> m = mozilla::MakeUnique<Message>(MSG_ROUTING_NONE,
+                                                               HELLO_MESSAGE_TYPE,
+                                                               IPC::Message::PRIORITY_NORMAL);
   if (!m->WriteInt(GetCurrentProcessId())) {
     CloseHandle(pipe_);
     pipe_ = INVALID_HANDLE_VALUE;
     return false;
   }
 
   OutputQueuePush(m.release());
   return true;
--- a/ipc/chromium/src/chrome/common/ipc_channel_win.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.h
@@ -6,16 +6,17 @@
 #define CHROME_COMMON_IPC_CHANNEL_WIN_H_
 
 #include "chrome/common/ipc_channel.h"
 
 #include <queue>
 #include <string>
 
 #include "base/message_loop.h"
+#include "mozilla/UniquePtr.h"
 
 class NonThreadSafe;
 
 namespace IPC {
 
 class Channel::ChannelImpl : public MessageLoopForIO::IOHandler {
  public:
   // Mirror methods of Channel, see ipc_channel.h for description.
@@ -102,16 +103,16 @@ class Channel::ChannelImpl : public Mess
   // This variable is updated so it matches output_queue_.size(), except we can
   // read output_queue_length_ from any thread (if we're OK getting an
   // occasional out-of-date or bogus value).  We use output_queue_length_ to
   // implement Unsound_NumQueuedMessages.
   size_t output_queue_length_;
 
   ScopedRunnableMethodFactory<ChannelImpl> factory_;
 
-  scoped_ptr<NonThreadSafe> thread_check_;
+  mozilla::UniquePtr<NonThreadSafe> thread_check_;
 
   DISALLOW_COPY_AND_ASSIGN(ChannelImpl);
 };
 
 }  // namespace IPC
 
 #endif  // CHROME_COMMON_IPC_CHANNEL_WIN_H_
--- a/ipc/chromium/src/chrome/common/ipc_logging.h
+++ b/ipc/chromium/src/chrome/common/ipc_logging.h
@@ -9,16 +9,17 @@
 
 #ifdef IPC_MESSAGE_LOG_ENABLED
 
 #include "base/lock.h"
 #include "base/message_loop.h"
 #include "base/singleton.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/ipc_message_utils.h"
+#include "mozilla/UniquePtr.h"
 
 class MessageLoop;
 
 namespace IPC {
 
 class Message;
 
 // One instance per process.  Needs to be created on the main thread (the UI
@@ -86,18 +87,18 @@ class Logging : public base::WaitableEve
   std::wstring GetEventName(int browser_pid, bool enabled);
   void OnSendLogs();
   void Log(const LogData& data);
 
   void RegisterWaitForEvent(bool enabled);
 
   base::WaitableEventWatcher watcher_;
 
-  scoped_ptr<base::WaitableEvent> logging_event_on_;
-  scoped_ptr<base::WaitableEvent> logging_event_off_;
+  mozilla::UniquePtr<base::WaitableEvent> logging_event_on_;
+  mozilla::UniquePtr<base::WaitableEvent> logging_event_off_;
   bool enabled_;
 
   std::vector<LogData> queued_logs_;
   bool queue_invoke_later_pending_;
 
   Message::Sender* sender_;
   MessageLoop* main_thread_;
 
--- a/ipc/chromium/src/chrome/common/ipc_message.h
+++ b/ipc/chromium/src/chrome/common/ipc_message.h
@@ -14,17 +14,17 @@
 #include "GeckoTaskTracer.h"
 #endif
 
 #ifndef NDEBUG
 #define IPC_MESSAGE_LOG_ENABLED
 #endif
 
 #if defined(OS_POSIX)
-#include "base/ref_counted.h"
+#include "nsAutoPtr.h"
 #endif
 
 namespace base {
 struct FileDescriptor;
 }
 
 class FileDescriptorSet;
 
@@ -357,17 +357,17 @@ class Message : public Pickle {
   const Header* header() const {
     return headerT<Header>();
   }
 
   void InitLoggingVariables(const char* const name="???");
 
 #if defined(OS_POSIX)
   // The set of file descriptors associated with this message.
-  scoped_refptr<FileDescriptorSet> file_descriptor_set_;
+  nsRefPtr<FileDescriptorSet> file_descriptor_set_;
 
   // Ensure that a FileDescriptorSet is allocated
   void EnsureFileDescriptorSet();
 
   FileDescriptorSet* file_descriptor_set() {
     EnsureFileDescriptorSet();
     return file_descriptor_set_.get();
   }
--- a/ipc/chromium/src/chrome/common/ipc_sync_channel.cc
+++ b/ipc/chromium/src/chrome/common/ipc_sync_channel.cc
@@ -6,16 +6,17 @@
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/thread_local.h"
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/ipc_sync_message.h"
+#include "nsISupportsImpl.h"
 
 using base::TimeDelta;
 using base::TimeTicks;
 using base::WaitableEvent;
 
 namespace IPC {
 // When we're blocked in a Send(), we need to process incoming synchronous
 // messages right away because it could be blocking our reply (either
@@ -29,36 +30,33 @@ namespace IPC {
 // allows us to dispatch incoming sync messages when blocked.  The race
 // condition is handled because if Send is in the process of being called, it
 // will check the event.  In case the listener thread isn't sending a message,
 // we queue a task on the listener thread to dispatch the received messages.
 // The messages are stored in this queue object that's shared among all
 // SyncChannel objects on the same thread (since one object can receive a
 // sync message while another one is blocked).
 
-class SyncChannel::ReceivedSyncMsgQueue :
-    public base::RefCountedThreadSafe<ReceivedSyncMsgQueue> {
+class SyncChannel::ReceivedSyncMsgQueue {
  public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(SyncChannel::ReceivedSyncMsgQueue)
   // Returns the ReceivedSyncMsgQueue instance for this thread, creating one
   // if necessary.  Call RemoveContext on the same thread when done.
   static ReceivedSyncMsgQueue* AddContext() {
     // We want one ReceivedSyncMsgQueue per listener thread (i.e. since multiple
     // SyncChannel objects can block the same thread).
     ReceivedSyncMsgQueue* rv = lazy_tls_ptr_.Pointer()->Get();
     if (!rv) {
       rv = new ReceivedSyncMsgQueue();
       ReceivedSyncMsgQueue::lazy_tls_ptr_.Pointer()->Set(rv);
     }
     rv->listener_count_++;
     return rv;
   }
 
-  ~ReceivedSyncMsgQueue() {
-  }
-
   // Called on IPC thread when a synchronous message or reply arrives.
   void QueueMessage(const Message& msg, SyncChannel::SyncContext* context) {
     bool was_task_pending;
     {
       AutoLock auto_lock(message_lock_);
 
       was_task_pending = task_pending_;
       task_pending_ = true;
@@ -87,17 +85,17 @@ class SyncChannel::ReceivedSyncMsgQueue 
       task_pending_ = false;
     }
     DispatchMessages();
   }
 
   void DispatchMessages() {
     while (true) {
       Message* message;
-      scoped_refptr<SyncChannel::SyncContext> context;
+      nsRefPtr<SyncChannel::SyncContext> context;
       {
         AutoLock auto_lock(message_lock_);
         if (message_queue_.empty())
           break;
 
         message = message_queue_.front().message;
         context = message_queue_.front().context;
         message_queue_.pop_front();
@@ -143,31 +141,34 @@ class SyncChannel::ReceivedSyncMsgQueue 
       if (received_replies_[i].context->TryToUnblockListener(message)) {
         delete message;
         received_replies_.erase(received_replies_.begin() + i);
         return;
       }
     }
   }
 
+ protected:
+  ~ReceivedSyncMsgQueue() {}
+
  private:
   // See the comment in SyncChannel::SyncChannel for why this event is created
   // as manual reset.
   ReceivedSyncMsgQueue() :
       dispatch_event_(true, false),
       listener_message_loop_(MessageLoop::current()),
       task_pending_(false),
       listener_count_(0) {
   }
 
   // Holds information about a queued synchronous message or reply.
   struct QueuedMessage {
     QueuedMessage(Message* m, SyncContext* c) : message(m), context(c) { }
     Message* message;
-    scoped_refptr<SyncChannel::SyncContext> context;
+    nsRefPtr<SyncChannel::SyncContext> context;
   };
 
   typedef std::deque<QueuedMessage> SyncMessageQueue;
   SyncMessageQueue message_queue_;
 
   std::vector<QueuedMessage> received_replies_;
 
   // Set when we got a synchronous message that we must respond to as the
@@ -363,17 +364,17 @@ bool SyncChannel::Send(Message* message)
 
 bool SyncChannel::SendWithTimeout(Message* message, int timeout_ms) {
   if (!message->is_sync()) {
     ChannelProxy::Send(message);
     return true;
   }
 
   // *this* might get deleted in WaitForReply.
-  scoped_refptr<SyncContext> context(sync_context());
+  nsRefPtr<SyncContext> context(sync_context());
   if (context->shutdown_event()->IsSignaled()) {
     delete message;
     return false;
   }
 
   DCHECK(sync_messages_with_no_timeout_allowed_ ||
          timeout_ms != base::kNoTimeout);
   SyncMessage* sync_msg = static_cast<SyncMessage*>(message);
--- a/ipc/chromium/src/chrome/common/ipc_sync_channel.h
+++ b/ipc/chromium/src/chrome/common/ipc_sync_channel.h
@@ -4,22 +4,23 @@
 
 #ifndef CHROME_COMMON_IPC_SYNC_SENDER_H__
 #define CHROME_COMMON_IPC_SYNC_SENDER_H__
 
 #include <string>
 #include <deque>
 #include "base/basictypes.h"
 #include "base/lock.h"
-#include "base/ref_counted.h"
 #include "base/scoped_handle.h"
 #include "base/waitable_event.h"
 #include "base/waitable_event_watcher.h"
 #include "chrome/common/ipc_channel_proxy.h"
 
+#include "nsAutoPtr.h"
+
 namespace IPC {
 
 class SyncMessage;
 class MessageReplyDeserializer;
 
 // This is similar to IPC::ChannelProxy, with the added feature of supporting
 // sending synchronous messages.
 // Note that care must be taken that the lifetime of the ipc_thread argument
@@ -118,17 +119,17 @@ class SyncChannel : public ChannelProxy,
       base::WaitableEvent* done_event;
       bool send_result;
     };
 
     typedef std::deque<PendingSyncMsg> PendingSyncMessageQueue;
     PendingSyncMessageQueue deserializers_;
     Lock deserializers_lock_;
 
-    scoped_refptr<ReceivedSyncMsgQueue> received_sync_msgs_;
+    nsRefPtr<ReceivedSyncMsgQueue> received_sync_msgs_;
 
     base::WaitableEvent* shutdown_event_;
     base::WaitableEventWatcher shutdown_watcher_;
   };
 
  private:
   // WaitableEventWatcher::Delegate implementation.
   virtual void OnWaitableEventSignaled(base::WaitableEvent* arg);
--- a/ipc/glue/GeckoChildProcessHost.h
+++ b/ipc/glue/GeckoChildProcessHost.h
@@ -2,17 +2,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef __IPC_GLUE_GECKOCHILDPROCESSHOST_H__
 #define __IPC_GLUE_GECKOCHILDPROCESSHOST_H__
 
 #include "base/file_path.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/ipc/FileDescriptor.h"
 #include "mozilla/Monitor.h"
 #include "mozilla/StaticPtr.h"
 
--- a/testing/mochitest/mochitest_options.py
+++ b/testing/mochitest/mochitest_options.py
@@ -738,17 +738,17 @@ class B2GOptions(MochitestOptions):
         defaults["httpPort"] = DEFAULT_PORTS['http']
         defaults["sslPort"] = DEFAULT_PORTS['https']
         defaults["logFile"] = "mochitest.log"
         defaults["autorun"] = True
         defaults["closeWhenDone"] = True
         defaults["testPath"] = ""
         defaults["extensionsToExclude"] = ["specialpowers"]
         # See dependencies of bug 1038943.
-        defaults["leakThreshold"] = 5116
+        defaults["leakThreshold"] = 5180
         self.set_defaults(**defaults)
 
     def verifyRemoteOptions(self, options):
         if options.remoteWebServer == None:
             if os.name != "nt":
                 options.remoteWebServer = moznetwork.get_ip()
             else:
                 self.error("You must specify a --remote-webserver=<ip address>")
--- a/xpcom/build/nsXPComInit.cpp
+++ b/xpcom/build/nsXPComInit.cpp
@@ -126,16 +126,17 @@ extern nsresult nsStringInputStreamConst
 #include "base/command_line.h"
 #include "base/message_loop.h"
 
 #include "mozilla/ipc/BrowserProcessSubThread.h"
 #include "mozilla/AvailableMemoryTracker.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/CountingAllocatorBase.h"
 #include "mozilla/SystemMemoryReporter.h"
+#include "mozilla/UniquePtr.h"
 
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 #ifdef MOZ_VISUAL_EVENT_TRACER
 #include "mozilla/VisualEventTracer.h"
 #endif
 
 #include "ogg/ogg.h"
@@ -517,18 +518,17 @@ NS_InitXPCOM2(nsIServiceManager** aResul
     sMessageLoop->set_thread_name("Gecko");
     // Set experimental values for main thread hangs:
     // 512ms for transient hangs and 8192ms for permanent hangs
     sMessageLoop->set_hang_timeouts(512, 8192);
   }
 
   if (XRE_GetProcessType() == GeckoProcessType_Default &&
       !BrowserProcessSubThread::GetMessageLoop(BrowserProcessSubThread::IO)) {
-    scoped_ptr<BrowserProcessSubThread> ioThread(
-      new BrowserProcessSubThread(BrowserProcessSubThread::IO));
+    UniquePtr<BrowserProcessSubThread> ioThread = MakeUnique<BrowserProcessSubThread>(BrowserProcessSubThread::IO);
 
     base::Thread::Options options;
     options.message_loop_type = MessageLoop::TYPE_IO;
     if (NS_WARN_IF(!ioThread->StartWithOptions(options))) {
       return NS_ERROR_FAILURE;
     }
 
     sIOThread = ioThread.release();