Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

27 files changed, 6030 insertions, 0 deletions

diff --git a/ipc/chromium/src/chrome/common/child_process.cc b/ipc/chromium/src/chrome/common/child_process.cc
new file mode 100644
index 0000000000..637564c30c
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/child_process.cc
@@ -0,0 +1,29 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/child_process.h"
+
+#include "base/basictypes.h"
+#include "base/string_util.h"
+#include "chrome/common/child_thread.h"
+
+ChildProcess* ChildProcess::child_process_;
+
+ChildProcess::ChildProcess(ChildThread* child_thread)
+    : child_thread_(child_thread) {
+  DCHECK(!child_process_);
+  child_process_ = this;
+  if (child_thread_.get())  // null in unittests.
+    child_thread_->Run();
+}
+
+ChildProcess::~ChildProcess() {
+  DCHECK(child_process_ == this);
+
+  if (child_thread_.get()) child_thread_->Stop();
+
+  child_process_ = NULL;
+}
diff --git a/ipc/chromium/src/chrome/common/child_process.h b/ipc/chromium/src/chrome/common/child_process.h
new file mode 100644
index 0000000000..7ce4cffa81
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/child_process.h
@@ -0,0 +1,45 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_CHILD_PROCESS_H__
+#define CHROME_COMMON_CHILD_PROCESS_H__
+
+#include <string>
+#include <vector>
+#include "base/basictypes.h"
+#include "base/message_loop.h"
+#include "base/waitable_event.h"
+#include "mozilla/UniquePtr.h"
+
+class ChildThread;
+
+// Base class for child processes of the browser process (i.e. renderer and
+// plugin host). This is a singleton object for each child process.
+class ChildProcess {
+ public:
+  // Child processes should have an object that derives from this class.  The
+  // constructor will return once ChildThread has started.
+  explicit ChildProcess(ChildThread* child_thread);
+  virtual ~ChildProcess();
+
+  // Getter for this process' main thread.
+  ChildThread* child_thread() { return child_thread_.get(); }
+
+  // Getter for the one ChildProcess object for this process.
+  static ChildProcess* current() { return child_process_; }
+
+ private:
+  // NOTE: make sure that child_thread_ is listed before shutdown_event_, since
+  // it depends on it (indirectly through IPC::SyncChannel).
+  mozilla::UniquePtr<ChildThread> child_thread_;
+
+  // The singleton instance for this process.
+  static ChildProcess* child_process_;
+
+  DISALLOW_EVIL_CONSTRUCTORS(ChildProcess);
+};
+
+#endif  // CHROME_COMMON_CHILD_PROCESS_H__
diff --git a/ipc/chromium/src/chrome/common/child_process_host.cc b/ipc/chromium/src/chrome/common/child_process_host.cc
new file mode 100644
index 0000000000..1fdb6b6e66
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/child_process_host.cc
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/child_process_host.h"
+
+#include "base/compiler_specific.h"
+#include "base/logging.h"
+#include "base/message_loop.h"
+#include "base/process_util.h"
+#include "base/waitable_event.h"
+#include "mozilla/ipc/ProcessChild.h"
+#include "mozilla/ipc/BrowserProcessSubThread.h"
+typedef mozilla::ipc::BrowserProcessSubThread ChromeThread;
+#include "chrome/common/process_watcher.h"
+
+using mozilla::ipc::FileDescriptor;
+
+ChildProcessHost::ChildProcessHost()
+    : ALLOW_THIS_IN_INITIALIZER_LIST(listener_(this)),
+      opening_channel_(false) {}
+
+ChildProcessHost::~ChildProcessHost() {}
+
+bool ChildProcessHost::CreateChannel() {
+  channel_id_ = IPC::Channel::GenerateVerifiedChannelID();
+  channel_.reset(
+      new IPC::Channel(channel_id_, IPC::Channel::MODE_SERVER, &listener_));
+#if defined(OS_WIN)
+  channel_->StartAcceptingHandles(IPC::Channel::MODE_SERVER);
+#elif defined(OS_MACOSX)
+  channel_->StartAcceptingMachPorts(IPC::Channel::MODE_SERVER);
+#endif
+  if (!channel_->Connect()) return false;
+
+  opening_channel_ = true;
+
+  return true;
+}
+
+ChildProcessHost::ListenerHook::ListenerHook(ChildProcessHost* host)
+    : host_(host) {}
+
+void ChildProcessHost::ListenerHook::OnMessageReceived(
+    mozilla::UniquePtr<IPC::Message> msg) {
+  host_->OnMessageReceived(std::move(msg));
+}
+
+void ChildProcessHost::ListenerHook::OnChannelConnected(
+    base::ProcessId peer_pid) {
+  host_->opening_channel_ = false;
+  host_->OnChannelConnected(peer_pid);
+}
+
+void ChildProcessHost::ListenerHook::OnChannelError() {
+  host_->opening_channel_ = false;
+  host_->OnChannelError();
+}
+
+void ChildProcessHost::ListenerHook::GetQueuedMessages(
+    std::queue<mozilla::UniquePtr<IPC::Message>>& queue) {
+  host_->GetQueuedMessages(queue);
+}
diff --git a/ipc/chromium/src/chrome/common/child_process_host.h b/ipc/chromium/src/chrome/common/child_process_host.h
new file mode 100644
index 0000000000..195aa08a52
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/child_process_host.h
@@ -0,0 +1,83 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_CHILD_PROCESS_HOST_H_
+#define CHROME_COMMON_CHILD_PROCESS_HOST_H_
+
+#include "build/build_config.h"
+
+#include <list>
+
+#include "base/basictypes.h"
+#include "chrome/common/ipc_channel.h"
+#include "mozilla/UniquePtr.h"
+
+namespace mozilla {
+namespace ipc {
+class FileDescriptor;
+}
+}  // namespace mozilla
+
+// Plugins/workers and other child processes that live on the IO thread should
+// derive from this class.
+class ChildProcessHost : public IPC::Channel::Listener {
+ public:
+  virtual ~ChildProcessHost();
+
+  using ChannelId = IPC::Channel::ChannelId;
+
+ protected:
+  explicit ChildProcessHost();
+
+  // Derived classes return true if it's ok to shut down the child process.
+  virtual bool CanShutdown() = 0;
+
+  // Creates the IPC channel.  Returns true iff it succeeded.
+  bool CreateChannel();
+
+  // IPC::Channel::Listener implementation:
+  virtual void OnMessageReceived(
+      mozilla::UniquePtr<IPC::Message> msg) override {}
+  virtual void OnChannelConnected(base::ProcessId peer_pid) override {}
+  virtual void OnChannelError() override {}
+
+  bool opening_channel() { return opening_channel_; }
+  const ChannelId& channel_id() { return channel_id_; }
+
+  IPC::Channel* channelp() const { return channel_.get(); }
+  mozilla::UniquePtr<IPC::Channel> TakeChannel() { return std::move(channel_); }
+
+ private:
+  // By using an internal class as the IPC::Channel::Listener, we can intercept
+  // OnMessageReceived/OnChannelConnected and do our own processing before
+  // calling the subclass' implementation.
+  class ListenerHook : public IPC::Channel::Listener {
+   public:
+    explicit ListenerHook(ChildProcessHost* host);
+    virtual void OnMessageReceived(
+        mozilla::UniquePtr<IPC::Message> msg) override;
+    virtual void OnChannelConnected(base::ProcessId peer_pid) override;
+    virtual void OnChannelError() override;
+    virtual void GetQueuedMessages(
+        std::queue<mozilla::UniquePtr<IPC::Message>>& queue) override;
+
+   private:
+    ChildProcessHost* host_;
+  };
+
+  ListenerHook listener_;
+
+  // True while we're waiting the channel to be opened.
+  bool opening_channel_;
+
+  // The IPC::Channel.
+  mozilla::UniquePtr<IPC::Channel> channel_;
+
+  // IPC Channel's id.
+  ChannelId channel_id_;
+};
+
+#endif  // CHROME_COMMON_CHILD_PROCESS_HOST_H_
diff --git a/ipc/chromium/src/chrome/common/child_thread.cc b/ipc/chromium/src/chrome/common/child_thread.cc
new file mode 100644
index 0000000000..0206e92f4a
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/child_thread.cc
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/child_thread.h"
+
+#include "chrome/common/child_process.h"
+#include "mozilla/ipc/NodeController.h"
+
+ChildThread::ChildThread(Thread::Options options)
+    : Thread("IPC I/O Child"),
+      owner_loop_(MessageLoop::current()),
+      options_(options) {
+  DCHECK(owner_loop_);
+  channel_name_ = IPC::Channel::ChannelIDForCurrentProcess();
+}
+
+ChildThread::~ChildThread() = default;
+
+bool ChildThread::Run() {
+  bool r = StartWithOptions(options_);
+  return r;
+}
+
+ChildThread* ChildThread::current() {
+  return ChildProcess::current()->child_thread();
+}
+
+void ChildThread::Init() {
+  auto channel = mozilla::MakeUnique<IPC::Channel>(
+      channel_name_, IPC::Channel::MODE_CLIENT, nullptr);
+#if defined(OS_WIN)
+  channel->StartAcceptingHandles(IPC::Channel::MODE_CLIENT);
+#elif defined(OS_MACOSX)
+  channel->StartAcceptingMachPorts(IPC::Channel::MODE_CLIENT);
+#endif
+
+  initial_port_ =
+      mozilla::ipc::NodeController::InitChildProcess(std::move(channel));
+}
+
+void ChildThread::CleanUp() { mozilla::ipc::NodeController::CleanUp(); }
diff --git a/ipc/chromium/src/chrome/common/child_thread.h b/ipc/chromium/src/chrome/common/child_thread.h
new file mode 100644
index 0000000000..1491d04019
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/child_thread.h
@@ -0,0 +1,56 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_CHILD_THREAD_H_
+#define CHROME_COMMON_CHILD_THREAD_H_
+
+#include "base/thread.h"
+#include "chrome/common/ipc_channel.h"
+#include "mojo/core/ports/port_ref.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/ipc/ScopedPort.h"
+
+class ResourceDispatcher;
+
+// Child processes's background thread should derive from this class.
+class ChildThread : public base::Thread {
+ public:
+  // Creates the thread.
+  explicit ChildThread(Thread::Options options);
+  virtual ~ChildThread();
+
+  mozilla::ipc::ScopedPort TakeInitialPort() {
+    return std::move(initial_port_);
+  }
+
+ protected:
+  friend class ChildProcess;
+
+  // Starts the thread.
+  bool Run();
+
+ protected:
+  // Returns the one child thread.
+  static ChildThread* current();
+
+  // Thread implementation.
+  virtual void Init() override;
+  virtual void CleanUp() override;
+
+ private:
+  // The message loop used to run tasks on the thread that started this thread.
+  MessageLoop* owner_loop_;
+
+  IPC::Channel::ChannelId channel_name_;
+
+  mozilla::ipc::ScopedPort initial_port_;
+
+  Thread::Options options_;
+
+  DISALLOW_EVIL_CONSTRUCTORS(ChildThread);
+};
+
+#endif  // CHROME_COMMON_CHILD_THREAD_H_
diff --git a/ipc/chromium/src/chrome/common/chrome_switches.cc b/ipc/chromium/src/chrome/common/chrome_switches.cc
new file mode 100644
index 0000000000..185934c87d
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/chrome_switches.cc
@@ -0,0 +1,18 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/chrome_switches.h"
+
+namespace switches {
+
+// Can't find the switch you are looking for? try looking in
+// base/base_switches.cc instead.
+
+// The value of this switch tells the child process which
+// IPC channel the browser expects to use to communicate with it.
+const wchar_t kProcessChannelID[] = L"channel";
+
+}  // namespace switches
diff --git a/ipc/chromium/src/chrome/common/chrome_switches.h b/ipc/chromium/src/chrome/common/chrome_switches.h
new file mode 100644
index 0000000000..d0a60508c0
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/chrome_switches.h
@@ -0,0 +1,22 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Defines all the command-line switches used by Chrome.
+
+#ifndef CHROME_COMMON_CHROME_SWITCHES_H__
+#define CHROME_COMMON_CHROME_SWITCHES_H__
+
+#if defined(COMPILER_MSVC)
+#  include <string.h>
+#endif
+
+namespace switches {
+
+extern const wchar_t kProcessChannelID[];
+
+}  // namespace switches
+
+#endif  // CHROME_COMMON_CHROME_SWITCHES_H__
diff --git a/ipc/chromium/src/chrome/common/ipc_channel.h b/ipc/chromium/src/chrome/common/ipc_channel.h
new file mode 100644
index 0000000000..3cd04ba3de
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel.h
@@ -0,0 +1,221 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_IPC_CHANNEL_H_
+#define CHROME_COMMON_IPC_CHANNEL_H_
+
+#include <cstdint>
+#include <queue>
+#include "base/basictypes.h"
+#include "base/process.h"
+#include "build/build_config.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/UniquePtrExtensions.h"
+#include "mozilla/WeakPtr.h"
+#include "chrome/common/ipc_message.h"
+
+#ifdef OS_WIN
+#  include <string>
+#endif
+
+namespace IPC {
+
+class Message;
+class MessageReader;
+class MessageWriter;
+
+//------------------------------------------------------------------------------
+
+class Channel {
+  // Security tests need access to the pipe handle.
+  friend class ChannelTest;
+
+ public:
+  // Windows channels use named objects and connect to them by name,
+  // but on Unix we use unnamed socketpairs and pass capabilities
+  // directly using SCM_RIGHTS messages.  This type abstracts away
+  // that difference.
+#ifdef OS_WIN
+  typedef std::wstring ChannelId;
+#else
+  struct ChannelId {};
+#endif
+
+  // For channels which are created after initialization, handles to the pipe
+  // endpoints may be passed around directly using IPC messages.
+  using ChannelHandle = mozilla::UniqueFileHandle;
+
+  // Implemented by consumers of a Channel to receive messages.
+  //
+  // All listeners will only be called on the IO thread, and must be destroyed
+  // on the IO thread.
+  class Listener : public mozilla::SupportsWeakPtr {
+   public:
+    virtual ~Listener() = default;
+
+    // Called when a message is received.
+    virtual void OnMessageReceived(mozilla::UniquePtr<Message> message) = 0;
+
+    // Called when the channel is connected and we have received the internal
+    // Hello message from the peer.
+    virtual void OnChannelConnected(base::ProcessId peer_pid) {}
+
+    // Called when an error is detected that causes the channel to close.
+    // This method is not called when a channel is closed normally.
+    virtual void OnChannelError() {}
+
+    // If the listener has queued messages, swap them for |queue| like so
+    //   swap(impl->my_queued_messages, queue);
+    virtual void GetQueuedMessages(
+        std::queue<mozilla::UniquePtr<Message>>& queue) {}
+  };
+
+  enum Mode { MODE_SERVER, MODE_CLIENT };
+
+  enum {
+
+  // The maximum message size in bytes. Attempting to receive a
+  // message of this size or bigger results in a channel error.
+  // This is larger in fuzzing builds to allow the fuzzing of passing
+  // large data structures into DOM methods without crashing.
+#ifndef FUZZING
+    kMaximumMessageSize = 256 * 1024 * 1024,
+#else
+    kMaximumMessageSize = 1792 * 1024 * 1024,  // 1.75GB
+#endif
+
+    // Amount of data to read at once from the pipe.
+    kReadBufferSize = 4 * 1024,
+  };
+
+  // Initialize a Channel.
+  //
+  // |channel_id| identifies the communication Channel.
+  // |mode| specifies whether this Channel is to operate in server mode or
+  // client mode.  In server mode, the Channel is responsible for setting up the
+  // IPC object, whereas in client mode, the Channel merely connects to the
+  // already established IPC object.
+  // |listener| receives a callback on the current thread for each newly
+  // received message.
+  //
+  // The Channel must be created and destroyed on the IO thread, and all
+  // methods, unless otherwise noted, are only safe to call on the I/O thread.
+  //
+  Channel(const ChannelId& channel_id, Mode mode, Listener* listener);
+
+  // Initialize a pre-created channel |pipe| as |mode|.
+  Channel(ChannelHandle pipe, Mode mode, Listener* listener);
+
+  ~Channel();
+
+  // Connect the pipe.  On the server side, this will initiate
+  // waiting for connections.  On the client, it attempts to
+  // connect to a pre-existing pipe.  Note, calling Connect()
+  // will not block the calling thread and may complete
+  // asynchronously.
+  bool Connect();
+
+  // Close this Channel explicitly.  May be called multiple times.
+  void Close();
+
+  // Modify the Channel's listener.
+  Listener* set_listener(Listener* listener);
+
+  // Send a message over the Channel to the listener on the other end.
+  //
+  // This method may be called from any thread, so long as the `Channel` is not
+  // destroyed before it returns.
+  //
+  // If you Send() a message on a Close()'d channel, we delete the message
+  // immediately.
+  bool Send(mozilla::UniquePtr<Message> message);
+
+  // The PID which this channel has been opened with. This will be
+  // `-1` until `OnChannelConnected` has been called.
+  int32_t OtherPid() const;
+
+  // IsClosed() is safe to call from any thread, but the value returned may
+  // be out of date.
+  bool IsClosed() const;
+
+#if defined(OS_POSIX)
+  // On POSIX an IPC::Channel wraps a socketpair(), this method returns the
+  // FD # for the client end of the socket and the equivalent FD# to use for
+  // mapping it into the Child process.
+  // This method may only be called on the server side of a channel.
+  void GetClientFileDescriptorMapping(int* src_fd, int* dest_fd) const;
+
+  // Close the client side of the socketpair.
+  void CloseClientFileDescriptor();
+
+#  if defined(OS_MACOSX)
+  // Configure the mach task_t for the peer task.
+  void SetOtherMachTask(task_t task);
+
+  // Tell this pipe to accept mach ports. Exactly one side of the IPC connection
+  // must be set as `MODE_SERVER` and that side will be responsible for
+  // transferring the rights between processes.
+  void StartAcceptingMachPorts(Mode mode);
+#  endif
+
+#elif defined(OS_WIN)
+  // Tell this pipe to accept handles. Exactly one side of the IPC connection
+  // must be set as `MODE_SERVER`, and that side will be responsible for calling
+  // `DuplicateHandle` to transfer the handle between processes.
+  void StartAcceptingHandles(Mode mode);
+#endif  // defined(OS_POSIX)
+
+  // On Windows: Generates a channel ID that, if passed to the client
+  // as a shared secret, will validate the client's authenticity.
+  // Other platforms don't use channel IDs, so this returns the dummy
+  // ChannelId value.
+  static ChannelId GenerateVerifiedChannelID();
+
+  // On Windows: Retrieves the initial channel ID passed to the
+  // current process by its parent.  Other platforms don't do this;
+  // the dummy ChannelId value is returned instead.
+  static ChannelId ChannelIDForCurrentProcess();
+
+#if defined(MOZ_WIDGET_ANDROID)
+  // Used to set the first IPC file descriptor in the child process on Android.
+  // See ipc_channel_posix.cc for further details on how this is used.
+  static void SetClientChannelFd(int fd);
+#endif  // defined(MOZ_WIDGET_ANDROID)
+
+  // Create a new pair of pipe endpoints which can be used to establish a
+  // native IPC::Channel connection.
+  static bool CreateRawPipe(ChannelHandle* server, ChannelHandle* client);
+
+ private:
+  // PIMPL to which all channel calls are delegated.
+  class ChannelImpl;
+  RefPtr<ChannelImpl> channel_impl_;
+
+  enum {
+#if defined(OS_MACOSX)
+    // If the channel receives a message that contains file descriptors, then
+    // it will reply back with this message, indicating that the message has
+    // been received. The sending channel can then close any descriptors that
+    // had been marked as auto_close. This works around a sendmsg() bug on BSD
+    // where the kernel can eagerly close file descriptors that are in message
+    // queues but not yet delivered.
+    RECEIVED_FDS_MESSAGE_TYPE = kuint16max - 1,
+#endif
+
+    // The Hello message is internal to the Channel class.  It is sent
+    // by the peer when the channel is connected.  The message contains
+    // just the process id (pid).  The message has a special routing_id
+    // (MSG_ROUTING_NONE) and type (HELLO_MESSAGE_TYPE).
+    HELLO_MESSAGE_TYPE = kuint16max  // Maximum value of message type
+                                     // (uint16_t), to avoid conflicting with
+                                     // normal message types, which are
+                                     // enumeration constants starting from 0.
+  };
+};
+
+}  // namespace IPC
+
+#endif  // CHROME_COMMON_IPC_CHANNEL_H_
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_capability.h b/ipc/chromium/src/chrome/common/ipc_channel_capability.h
new file mode 100644
index 0000000000..c23f16e577
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_capability.h
@@ -0,0 +1,61 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CHROME_COMMON_IPC_CHANNEL_CAPABILITY_H_
+#define CHROME_COMMON_IPC_CHANNEL_CAPABILITY_H_
+
+#include "mozilla/ThreadSafety.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/EventTargetCapability.h"
+#include "nsISerialEventTarget.h"
+
+namespace IPC {
+
+// A thread-safety capability used in IPC channel implementations. Combines an
+// EventTargetCapability and a Mutex to allow using each independently, as well
+// as combined together.
+//
+// The ChannelCapability grants shared access if on the IOThread or if the send
+// mutex is held, and only allows exclusive access if both on the IO thread and
+// holding the send mutex. This is similar to a `MutexSingleWriter`, but more
+// flexible due to providing access to each sub-capability.
+class MOZ_CAPABILITY("channel cap") ChannelCapability {
+ public:
+  using Mutex = mozilla::Mutex;
+  using Thread = mozilla::EventTargetCapability<nsISerialEventTarget>;
+
+  ChannelCapability(const char* mutex_name, nsISerialEventTarget* io_thread)
+      : send_mutex_(mutex_name), io_thread_(io_thread) {}
+
+  const Thread& IOThread() const MOZ_RETURN_CAPABILITY(io_thread_) {
+    return io_thread_;
+  }
+  Mutex& SendMutex() MOZ_RETURN_CAPABILITY(send_mutex_) { return send_mutex_; }
+
+  // Note that we're on the IO thread, and thus have shared access to values
+  // guarded by the channel capability for the thread-safety analysis.
+  void NoteOnIOThread() const MOZ_REQUIRES(io_thread_)
+      MOZ_ASSERT_SHARED_CAPABILITY(this) {}
+
+  // Note that we're holding the send mutex, and thus have shared access to
+  // values guarded by the channel capability for the thread-safety analysis.
+  void NoteSendMutex() const MOZ_REQUIRES(send_mutex_)
+      MOZ_ASSERT_SHARED_CAPABILITY(this) {}
+
+  // Note that we're holding the send mutex while on the IO thread, and thus
+  // have exclusive access to values guarded by the channel capability for the
+  // thread-safety analysis.
+  void NoteExclusiveAccess() const MOZ_REQUIRES(io_thread_, send_mutex_)
+      MOZ_ASSERT_CAPABILITY(this) {}
+
+ private:
+  mozilla::Mutex send_mutex_;
+  mozilla::EventTargetCapability<nsISerialEventTarget> io_thread_;
+};
+
+}  // namespace IPC
+
+#endif  // CHROME_COMMON_IPC_CHANNEL_CAPABILITY_H_
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
new file mode 100644
index 0000000000..8b6fc3349a
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
@@ -0,0 +1,1317 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/ipc_channel_posix.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include "mozilla/Mutex.h"
+#if defined(OS_MACOSX)
+#  include <mach/message.h>
+#  include <mach/port.h>
+#  include "mozilla/UniquePtrExtensions.h"
+#  include "chrome/common/mach_ipc_mac.h"
+#endif
+#if defined(OS_MACOSX) || defined(OS_NETBSD)
+#  include <sched.h>
+#endif
+#include <stddef.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sys/uio.h>
+
+#include <string>
+#include <map>
+
+#include "base/command_line.h"
+#include "base/eintr_wrapper.h"
+#include "base/logging.h"
+#include "base/process_util.h"
+#include "base/string_util.h"
+#include "chrome/common/chrome_switches.h"
+#include "chrome/common/ipc_channel_utils.h"
+#include "chrome/common/ipc_message_utils.h"
+#include "mozilla/ipc/Endpoint.h"
+#include "mozilla/ipc/ProtocolUtils.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/StaticMutex.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
+
+// Use OS specific iovec array limit where it's possible.
+#if defined(IOV_MAX)
+static const size_t kMaxIOVecSize = IOV_MAX;
+#elif defined(ANDROID)
+static const size_t kMaxIOVecSize = 256;
+#else
+static const size_t kMaxIOVecSize = 16;
+#endif
+
+using namespace mozilla::ipc;
+
+namespace IPC {
+
+// IPC channels on Windows use named pipes (CreateNamedPipe()) with
+// channel ids as the pipe names.  Channels on POSIX use anonymous
+// Unix domain sockets created via socketpair() as pipes.  These don't
+// quite line up.
+//
+// When creating a child subprocess, the parent side of the fork
+// arranges it such that the initial control channel ends up on the
+// magic file descriptor gClientChannelFd in the child.  Future
+// connections (file descriptors) can then be passed via that
+// connection via sendmsg().
+//
+// On Android, child processes are created as a service instead of
+// forking the parent process. The Android Binder service is used to
+// transport the IPC channel file descriptor to the child process.
+// So rather than re-mapping the file descriptor to a known value,
+// the received channel file descriptor is set by calling
+// SetClientChannelFd before gecko has been initialized and started
+// in the child process.
+
+//------------------------------------------------------------------------------
+namespace {
+
+// This is the file descriptor number that a client process expects to find its
+// IPC socket.
+static int gClientChannelFd =
+#if defined(MOZ_WIDGET_ANDROID)
+    // On android the fd is set at the time of child creation.
+    -1
+#else
+    3
+#endif  // defined(MOZ_WIDGET_ANDROID)
+    ;
+
+//------------------------------------------------------------------------------
+
+bool ErrorIsBrokenPipe(int err) { return err == EPIPE || err == ECONNRESET; }
+
+// Some Android ARM64 devices appear to have a bug where sendmsg
+// sometimes returns 0xFFFFFFFF, which we're assuming is a -1 that was
+// incorrectly truncated to 32-bit and then zero-extended.
+// See bug 1660826 for details.
+//
+// This is a workaround to detect that value and replace it with -1
+// (and check that there really was an error), because the largest
+// amount we'll ever write is Channel::kMaximumMessageSize (256MiB).
+//
+// The workaround is also enabled on x86_64 Android on debug builds,
+// although the bug isn't known to manifest there, so that there will
+// be some CI coverage of this code.
+
+static inline ssize_t corrected_sendmsg(int socket,
+                                        const struct msghdr* message,
+                                        int flags) {
+#if defined(ANDROID) && \
+    (defined(__aarch64__) || (defined(DEBUG) && defined(__x86_64__)))
+  static constexpr auto kBadValue = static_cast<ssize_t>(0xFFFFFFFF);
+  static_assert(kBadValue > 0);
+
+#  ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  errno = 0;
+#  endif
+  ssize_t bytes_written = sendmsg(socket, message, flags);
+  if (bytes_written == kBadValue) {
+    MOZ_DIAGNOSTIC_ASSERT(errno != 0);
+    bytes_written = -1;
+  }
+  MOZ_DIAGNOSTIC_ASSERT(bytes_written < kBadValue);
+  return bytes_written;
+#else
+  return sendmsg(socket, message, flags);
+#endif
+}
+
+}  // namespace
+//------------------------------------------------------------------------------
+
+#if defined(MOZ_WIDGET_ANDROID)
+void Channel::SetClientChannelFd(int fd) { gClientChannelFd = fd; }
+#endif  // defined(MOZ_WIDGET_ANDROID)
+
+Channel::ChannelImpl::ChannelImpl(const ChannelId& channel_id, Mode mode,
+                                  Listener* listener)
+    : chan_cap_("ChannelImpl::SendMutex",
+                MessageLoopForIO::current()->SerialEventTarget()) {
+  Init(mode, listener);
+
+  if (!CreatePipe(mode)) {
+    CHROMIUM_LOG(WARNING) << "Unable to create pipe in "
+                          << (mode == MODE_SERVER ? "server" : "client")
+                          << " mode error(" << strerror(errno) << ").";
+    return;
+  }
+
+  EnqueueHelloMessage();
+}
+
+Channel::ChannelImpl::ChannelImpl(ChannelHandle pipe, Mode mode,
+                                  Listener* listener)
+    : chan_cap_("ChannelImpl::SendMutex",
+                MessageLoopForIO::current()->SerialEventTarget()) {
+  Init(mode, listener);
+  SetPipe(pipe.release());
+
+  EnqueueHelloMessage();
+}
+
+void Channel::ChannelImpl::SetPipe(int fd) {
+  chan_cap_.NoteExclusiveAccess();
+
+  pipe_ = fd;
+  pipe_buf_len_ = 0;
+  if (fd >= 0) {
+    int buf_len;
+    socklen_t optlen = sizeof(buf_len);
+    if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &buf_len, &optlen) != 0) {
+      CHROMIUM_LOG(WARNING)
+          << "Unable to determine pipe buffer size: " << strerror(errno);
+      return;
+    }
+    CHECK(optlen == sizeof(buf_len));
+    CHECK(buf_len > 0);
+    pipe_buf_len_ = static_cast<unsigned>(buf_len);
+  }
+}
+
+bool Channel::ChannelImpl::PipeBufHasSpaceAfter(size_t already_written) {
+  // If the OS didn't tell us the buffer size for some reason, then
+  // don't apply this limitation on the amount we try to write.
+  return pipe_buf_len_ == 0 ||
+         static_cast<size_t>(pipe_buf_len_) > already_written;
+}
+
+void Channel::ChannelImpl::Init(Mode mode, Listener* listener) {
+  // Verify that we fit in a "quantum-spaced" jemalloc bucket.
+  static_assert(sizeof(*this) <= 512, "Exceeded expected size class");
+
+  MOZ_RELEASE_ASSERT(kControlBufferHeaderSize >= CMSG_SPACE(0));
+  MOZ_RELEASE_ASSERT(kControlBufferSize >=
+                     CMSG_SPACE(sizeof(int) * kControlBufferMaxFds));
+
+  chan_cap_.NoteExclusiveAccess();
+
+  mode_ = mode;
+  is_blocked_on_write_ = false;
+  partial_write_.reset();
+  input_buf_offset_ = 0;
+  input_buf_ = mozilla::MakeUnique<char[]>(Channel::kReadBufferSize);
+  input_cmsg_buf_ = mozilla::MakeUnique<char[]>(kControlBufferSize);
+  SetPipe(-1);
+  client_pipe_ = -1;
+  listener_ = listener;
+  waiting_connect_ = true;
+#if defined(OS_MACOSX)
+  last_pending_fd_id_ = 0;
+  other_task_ = nullptr;
+#endif
+}
+
+bool Channel::ChannelImpl::CreatePipe(Mode mode) {
+  chan_cap_.NoteExclusiveAccess();
+
+  DCHECK(pipe_ == -1);
+
+  if (mode == MODE_SERVER) {
+    ChannelHandle server, client;
+    if (!Channel::CreateRawPipe(&server, &client)) {
+      return false;
+    }
+
+    SetPipe(server.release());
+    client_pipe_ = client.release();
+  } else {
+    static mozilla::Atomic<bool> consumed(false);
+    CHECK(!consumed.exchange(true))
+    << "child process main channel can be created only once";
+    SetPipe(gClientChannelFd);
+  }
+
+  return true;
+}
+
+bool Channel::ChannelImpl::EnqueueHelloMessage() {
+  mozilla::UniquePtr<Message> msg(
+      new Message(MSG_ROUTING_NONE, HELLO_MESSAGE_TYPE));
+  if (!msg->WriteInt(base::GetCurrentProcId())) {
+    CloseLocked();
+    return false;
+  }
+
+  OutputQueuePush(std::move(msg));
+  return true;
+}
+
+bool Channel::ChannelImpl::Connect() {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  return ConnectLocked();
+}
+
+bool Channel::ChannelImpl::ConnectLocked() {
+  chan_cap_.NoteExclusiveAccess();
+
+  if (pipe_ == -1) {
+    return false;
+  }
+
+#if defined(OS_MACOSX)
+  // If we're still waiting for our peer task to be provided, don't start
+  // listening yet. We'll start receiving messages once the task_t is set.
+  if (accept_mach_ports_ && privileged_ && !other_task_) {
+    MOZ_ASSERT(waiting_connect_);
+    return true;
+  }
+#endif
+
+  MessageLoopForIO::current()->WatchFileDescriptor(
+      pipe_, true, MessageLoopForIO::WATCH_READ, &read_watcher_, this);
+  waiting_connect_ = false;
+
+  return ProcessOutgoingMessages();
+}
+
+bool Channel::ChannelImpl::ProcessIncomingMessages() {
+  chan_cap_.NoteOnIOThread();
+
+  struct msghdr msg = {0};
+  struct iovec iov;
+
+  msg.msg_iov = &iov;
+  msg.msg_iovlen = 1;
+  msg.msg_control = input_cmsg_buf_.get();
+
+  for (;;) {
+    msg.msg_controllen = kControlBufferSize;
+
+    if (pipe_ == -1) return false;
+
+    // In some cases the beginning of a message will be stored in input_buf_. We
+    // don't want to overwrite that, so we store the new data after it.
+    iov.iov_base = input_buf_.get() + input_buf_offset_;
+    iov.iov_len = Channel::kReadBufferSize - input_buf_offset_;
+
+    // Read from pipe.
+    // recvmsg() returns 0 if the connection has closed or EAGAIN if no data
+    // is waiting on the pipe.
+    ssize_t bytes_read = HANDLE_EINTR(recvmsg(pipe_, &msg, MSG_DONTWAIT));
+
+    if (bytes_read < 0) {
+      if (errno == EAGAIN) {
+        return true;
+      } else {
+        if (!ErrorIsBrokenPipe(errno)) {
+          CHROMIUM_LOG(ERROR)
+              << "pipe error (fd " << pipe_ << "): " << strerror(errno);
+        }
+        return false;
+      }
+    } else if (bytes_read == 0) {
+      // The pipe has closed...
+      Close();
+      return false;
+    }
+    DCHECK(bytes_read);
+
+    // a pointer to an array of |num_wire_fds| file descriptors from the read
+    const int* wire_fds = NULL;
+    unsigned num_wire_fds = 0;
+
+    // walk the list of control messages and, if we find an array of file
+    // descriptors, save a pointer to the array
+
+    // This next if statement is to work around an OSX issue where
+    // CMSG_FIRSTHDR will return non-NULL in the case that controllen == 0.
+    // Here's a test case:
+    //
+    // int main() {
+    // struct msghdr msg;
+    //   msg.msg_control = &msg;
+    //   msg.msg_controllen = 0;
+    //   if (CMSG_FIRSTHDR(&msg))
+    //     printf("Bug found!\n");
+    // }
+    if (msg.msg_controllen > 0) {
+      // On OSX, CMSG_FIRSTHDR doesn't handle the case where controllen is 0
+      // and will return a pointer into nowhere.
+      for (struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg); cmsg;
+           cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+        if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
+          const unsigned payload_len = cmsg->cmsg_len - CMSG_LEN(0);
+          DCHECK(payload_len % sizeof(int) == 0);
+          wire_fds = reinterpret_cast<int*>(CMSG_DATA(cmsg));
+          num_wire_fds = payload_len / 4;
+
+          if (msg.msg_flags & MSG_CTRUNC) {
+            CHROMIUM_LOG(ERROR)
+                << "SCM_RIGHTS message was truncated"
+                << " cmsg_len:" << cmsg->cmsg_len << " fd:" << pipe_;
+            for (unsigned i = 0; i < num_wire_fds; ++i)
+              IGNORE_EINTR(close(wire_fds[i]));
+            return false;
+          }
+          break;
+        }
+      }
+    }
+
+    // Process messages from input buffer.
+    const char* p = input_buf_.get();
+    const char* end = input_buf_.get() + input_buf_offset_ + bytes_read;
+
+    // A pointer to an array of |num_fds| file descriptors which includes any
+    // fds that have spilled over from a previous read.
+    const int* fds;
+    unsigned num_fds;
+    unsigned fds_i = 0;  // the index of the first unused descriptor
+
+    if (input_overflow_fds_.empty()) {
+      fds = wire_fds;
+      num_fds = num_wire_fds;
+    } else {
+      // This code may look like a no-op in the case where
+      // num_wire_fds == 0, but in fact:
+      //
+      // 1. wire_fds will be nullptr, so passing it to memcpy is
+      // undefined behavior according to the C standard, even though
+      // the memcpy length is 0.
+      //
+      // 2. prev_size will be an out-of-bounds index for
+      // input_overflow_fds_; this is undefined behavior according to
+      // the C++ standard, even though the element only has its
+      // pointer taken and isn't accessed (and the corresponding
+      // operation on a C array would be defined).
+      //
+      // UBSan makes #1 a fatal error, and assertions in libstdc++ do
+      // the same for #2 if enabled.
+      if (num_wire_fds > 0) {
+        const size_t prev_size = input_overflow_fds_.size();
+        input_overflow_fds_.resize(prev_size + num_wire_fds);
+        memcpy(&input_overflow_fds_[prev_size], wire_fds,
+               num_wire_fds * sizeof(int));
+      }
+      fds = &input_overflow_fds_[0];
+      num_fds = input_overflow_fds_.size();
+    }
+
+    // The data for the message we're currently reading consists of any data
+    // stored in incoming_message_ followed by data in input_buf_ (followed by
+    // other messages).
+
+    // NOTE: We re-check `pipe_` after each message to make sure we weren't
+    // closed while calling `OnMessageReceived` or `OnChannelConnected`.
+    while (p < end && pipe_ != -1) {
+      // Try to figure out how big the message is. Size is 0 if we haven't read
+      // enough of the header to know the size.
+      uint32_t message_length = 0;
+      if (incoming_message_) {
+        message_length = incoming_message_->size();
+      } else {
+        message_length = Message::MessageSize(p, end);
+      }
+
+      if (!message_length) {
+        // We haven't seen the full message header.
+        MOZ_ASSERT(!incoming_message_);
+
+        // Move everything we have to the start of the buffer. We'll finish
+        // reading this message when we get more data. For now we leave it in
+        // input_buf_.
+        memmove(input_buf_.get(), p, end - p);
+        input_buf_offset_ = end - p;
+
+        break;
+      }
+
+      input_buf_offset_ = 0;
+
+      bool partial;
+      if (incoming_message_) {
+        // We already have some data for this message stored in
+        // incoming_message_. We want to append the new data there.
+        Message& m = *incoming_message_;
+
+        // How much data from this message remains to be added to
+        // incoming_message_?
+        MOZ_DIAGNOSTIC_ASSERT(message_length > m.CurrentSize());
+        uint32_t remaining = message_length - m.CurrentSize();
+
+        // How much data from this message is stored in input_buf_?
+        uint32_t in_buf = std::min(remaining, uint32_t(end - p));
+
+        m.InputBytes(p, in_buf);
+        p += in_buf;
+
+        // Are we done reading this message?
+        partial = in_buf != remaining;
+      } else {
+        // How much data from this message is stored in input_buf_?
+        uint32_t in_buf = std::min(message_length, uint32_t(end - p));
+
+        incoming_message_ = mozilla::MakeUnique<Message>(p, in_buf);
+        p += in_buf;
+
+        // Are we done reading this message?
+        partial = in_buf != message_length;
+      }
+
+      if (partial) {
+        break;
+      }
+
+      Message& m = *incoming_message_;
+
+      if (m.header()->num_handles) {
+        // the message has file descriptors
+        const char* error = NULL;
+        if (m.header()->num_handles > num_fds - fds_i) {
+          // the message has been completely received, but we didn't get
+          // enough file descriptors.
+          error = "Message needs unreceived descriptors";
+        }
+
+        if (m.header()->num_handles >
+            IPC::Message::MAX_DESCRIPTORS_PER_MESSAGE) {
+          // There are too many descriptors in this message
+          error = "Message requires an excessive number of descriptors";
+        }
+
+        if (error) {
+          CHROMIUM_LOG(WARNING)
+              << error << " channel:" << this << " message-type:" << m.type()
+              << " header()->num_handles:" << m.header()->num_handles
+              << " num_fds:" << num_fds << " fds_i:" << fds_i;
+          // close the existing file descriptors so that we don't leak them
+          for (unsigned i = fds_i; i < num_fds; ++i)
+            IGNORE_EINTR(close(fds[i]));
+          input_overflow_fds_.clear();
+          // abort the connection
+          return false;
+        }
+
+#if defined(OS_MACOSX)
+        // Send a message to the other side, indicating that we are now
+        // responsible for closing the descriptor.
+        auto fdAck = mozilla::MakeUnique<Message>(MSG_ROUTING_NONE,
+                                                  RECEIVED_FDS_MESSAGE_TYPE);
+        DCHECK(m.fd_cookie() != 0);
+        fdAck->set_fd_cookie(m.fd_cookie());
+        {
+          mozilla::MutexAutoLock lock(SendMutex());
+          OutputQueuePush(std::move(fdAck));
+        }
+#endif
+
+        nsTArray<mozilla::UniqueFileHandle> handles(m.header()->num_handles);
+        for (unsigned end_i = fds_i + m.header()->num_handles; fds_i < end_i;
+             ++fds_i) {
+          handles.AppendElement(mozilla::UniqueFileHandle(fds[fds_i]));
+        }
+        m.SetAttachedFileHandles(std::move(handles));
+      }
+
+      // Note: We set other_pid_ below when we receive a Hello message (which
+      // has no routing ID), but we only emit a profiler marker for messages
+      // with a routing ID, so there's no conflict here.
+      AddIPCProfilerMarker(m, other_pid_, MessageDirection::eReceiving,
+                           MessagePhase::TransferEnd);
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+      DLOG(INFO) << "received message on channel @" << this << " with type "
+                 << m.type();
+#endif
+
+      if (m.routing_id() == MSG_ROUTING_NONE &&
+          m.type() == HELLO_MESSAGE_TYPE) {
+        // The Hello message contains only the process id.
+        int32_t other_pid = MessageIterator(m).NextInt();
+        SetOtherPid(other_pid);
+        listener_->OnChannelConnected(other_pid);
+#if defined(OS_MACOSX)
+      } else if (m.routing_id() == MSG_ROUTING_NONE &&
+                 m.type() == RECEIVED_FDS_MESSAGE_TYPE) {
+        DCHECK(m.fd_cookie() != 0);
+        CloseDescriptors(m.fd_cookie());
+#endif
+      } else {
+        mozilla::LogIPCMessage::Run run(&m);
+#if defined(OS_MACOSX)
+        if (!AcceptMachPorts(m)) {
+          return false;
+        }
+#endif
+        listener_->OnMessageReceived(std::move(incoming_message_));
+      }
+
+      incoming_message_ = nullptr;
+    }
+
+    input_overflow_fds_ = std::vector<int>(&fds[fds_i], &fds[num_fds]);
+
+    // When the input data buffer is empty, the overflow fds should be too. If
+    // this is not the case, we probably have a rogue renderer which is trying
+    // to fill our descriptor table.
+    if (!incoming_message_ && input_buf_offset_ == 0 &&
+        !input_overflow_fds_.empty()) {
+      // We close these descriptors in Close()
+      return false;
+    }
+  }
+}
+
+bool Channel::ChannelImpl::ProcessOutgoingMessages() {
+  // NOTE: This method may be called on threads other than `IOThread()`.
+  chan_cap_.NoteSendMutex();
+
+  DCHECK(!waiting_connect_);  // Why are we trying to send messages if there's
+                              // no connection?
+  is_blocked_on_write_ = false;
+
+  if (output_queue_.IsEmpty()) return true;
+
+  if (pipe_ == -1) return false;
+
+  // Write out all the messages we can till the write blocks or there are no
+  // more outgoing messages.
+  while (!output_queue_.IsEmpty()) {
+    Message* msg = output_queue_.FirstElement().get();
+
+    struct msghdr msgh = {0};
+
+    char cmsgBuf[kControlBufferSize];
+
+    if (partial_write_.isNothing()) {
+#if defined(OS_MACOSX)
+      if (!TransferMachPorts(*msg)) {
+        return false;
+      }
+#endif
+
+      if (msg->attached_handles_.Length() >
+          IPC::Message::MAX_DESCRIPTORS_PER_MESSAGE) {
+        MOZ_DIAGNOSTIC_ASSERT(false, "Too many file descriptors!");
+        CHROMIUM_LOG(FATAL) << "Too many file descriptors!";
+        // This should not be reached.
+        return false;
+      }
+
+      msg->header()->num_handles = msg->attached_handles_.Length();
+#if defined(OS_MACOSX)
+      if (!msg->attached_handles_.IsEmpty()) {
+        msg->set_fd_cookie(++last_pending_fd_id_);
+      }
+#endif
+
+      Pickle::BufferList::IterImpl iter(msg->Buffers());
+      MOZ_DIAGNOSTIC_ASSERT(!iter.Done(), "empty message");
+      partial_write_.emplace(PartialWrite{iter, msg->attached_handles_});
+
+      AddIPCProfilerMarker(*msg, other_pid_, MessageDirection::eSending,
+                           MessagePhase::TransferStart);
+    }
+
+    if (partial_write_->iter_.Done()) {
+      MOZ_DIAGNOSTIC_ASSERT(false, "partial_write_->iter_ should not be done");
+      // report a send error to our caller, which will close the channel.
+      return false;
+    }
+
+    // How much of this message have we written so far?
+    Pickle::BufferList::IterImpl iter = partial_write_->iter_;
+    auto handles = partial_write_->handles_;
+
+    // Serialize attached file descriptors into the cmsg header. Only up to
+    // kControlBufferMaxFds can be serialized at once, so messages with more
+    // attachments must be sent over multiple `sendmsg` calls.
+    const size_t num_fds = std::min(handles.Length(), kControlBufferMaxFds);
+    size_t max_amt_to_write = iter.TotalBytesAvailable(msg->Buffers());
+    if (num_fds > 0) {
+      msgh.msg_control = cmsgBuf;
+      msgh.msg_controllen = CMSG_LEN(sizeof(int) * num_fds);
+      struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msgh);
+      cmsg->cmsg_level = SOL_SOCKET;
+      cmsg->cmsg_type = SCM_RIGHTS;
+      cmsg->cmsg_len = msgh.msg_controllen;
+      for (size_t i = 0; i < num_fds; ++i) {
+        reinterpret_cast<int*>(CMSG_DATA(cmsg))[i] = handles[i].get();
+      }
+
+      // Avoid writing one byte per remaining handle in excess of
+      // kControlBufferMaxFds.  Each handle written will consume a minimum of 4
+      // bytes in the message (to store it's index), so we can depend on there
+      // being enough data to send every handle.
+      size_t remaining = handles.Length() - num_fds;
+      MOZ_ASSERT(max_amt_to_write > remaining,
+                 "must be at least one byte in the message for each handle");
+      max_amt_to_write -= remaining;
+    }
+
+    // Store remaining segments to write into iovec.
+    //
+    // Don't add more than kMaxIOVecSize iovecs so that we avoid
+    // OS-dependent limits.  Also, stop adding iovecs if we've already
+    // prepared to write at least the full buffer size.
+    struct iovec iov[kMaxIOVecSize];
+    size_t iov_count = 0;
+    size_t amt_to_write = 0;
+    while (!iter.Done() && iov_count < kMaxIOVecSize &&
+           PipeBufHasSpaceAfter(amt_to_write) &&
+           amt_to_write < max_amt_to_write) {
+      char* data = iter.Data();
+      size_t size =
+          std::min(iter.RemainingInSegment(), max_amt_to_write - amt_to_write);
+
+      iov[iov_count].iov_base = data;
+      iov[iov_count].iov_len = size;
+      iov_count++;
+      amt_to_write += size;
+      iter.Advance(msg->Buffers(), size);
+    }
+    MOZ_ASSERT(amt_to_write <= max_amt_to_write);
+    MOZ_ASSERT(amt_to_write > 0);
+
+    const bool intentional_short_write = !iter.Done();
+    msgh.msg_iov = iov;
+    msgh.msg_iovlen = iov_count;
+
+    ssize_t bytes_written =
+        HANDLE_EINTR(corrected_sendmsg(pipe_, &msgh, MSG_DONTWAIT));
+
+    if (bytes_written < 0) {
+      switch (errno) {
+        case EAGAIN:
+          // Not an error; the sendmsg would have blocked, so return to the
+          // event loop and try again later.
+          break;
+#if defined(OS_MACOSX) || defined(OS_NETBSD)
+          // (Note: this comment is copied from https://crrev.com/86c3d9ef4fdf6;
+          // see also bug 1142693 comment #73.)
+          //
+          // On OS X if sendmsg() is trying to send fds between processes and
+          // there isn't enough room in the output buffer to send the fd
+          // structure over atomically then EMSGSIZE is returned. The same
+          // applies to NetBSD as well.
+          //
+          // EMSGSIZE presents a problem since the system APIs can only call us
+          // when there's room in the socket buffer and not when there is
+          // "enough" room.
+          //
+          // The current behavior is to return to the event loop when EMSGSIZE
+          // is received and hopefull service another FD.  This is however still
+          // technically a busy wait since the event loop will call us right
+          // back until the receiver has read enough data to allow passing the
+          // FD over atomically.
+        case EMSGSIZE:
+          // Because this is likely to result in a busy-wait, we'll try to make
+          // it easier for the receiver to make progress, but only if we're on
+          // the I/O thread already.
+          if (IOThread().IsOnCurrentThread()) {
+            sched_yield();
+          }
+          break;
+#endif
+        default:
+          if (!ErrorIsBrokenPipe(errno)) {
+            CHROMIUM_LOG(ERROR) << "pipe error: " << strerror(errno);
+          }
+          return false;
+      }
+    }
+
+    if (intentional_short_write ||
+        static_cast<size_t>(bytes_written) != amt_to_write) {
+      // If write() fails with EAGAIN or EMSGSIZE then bytes_written will be -1.
+      if (bytes_written > 0) {
+        MOZ_DIAGNOSTIC_ASSERT(intentional_short_write ||
+                              static_cast<size_t>(bytes_written) <
+                                  amt_to_write);
+        partial_write_->iter_.AdvanceAcrossSegments(msg->Buffers(),
+                                                    bytes_written);
+        partial_write_->handles_ = handles.From(num_fds);
+        // We should not hit the end of the buffer.
+        MOZ_DIAGNOSTIC_ASSERT(!partial_write_->iter_.Done());
+      }
+
+      is_blocked_on_write_ = true;
+      if (IOThread().IsOnCurrentThread()) {
+        // If we're on the I/O thread already, tell libevent to call us back
+        // when things are unblocked.
+        MessageLoopForIO::current()->WatchFileDescriptor(
+            pipe_,
+            false,  // One shot
+            MessageLoopForIO::WATCH_WRITE, &write_watcher_, this);
+      } else {
+        // Otherwise, emulate being called back from libevent on the I/O thread,
+        // which will re-try the write, and then potentially start watching if
+        // still necessary.
+        IOThread().Dispatch(mozilla::NewRunnableMethod<int>(
+            "ChannelImpl::ContinueProcessOutgoing", this,
+            &ChannelImpl::OnFileCanWriteWithoutBlocking, -1));
+      }
+      return true;
+    } else {
+      MOZ_ASSERT(partial_write_->handles_.Length() == num_fds,
+                 "not all handles were sent");
+      partial_write_.reset();
+
+#if defined(OS_MACOSX)
+      if (!msg->attached_handles_.IsEmpty()) {
+        pending_fds_.push_back(PendingDescriptors{
+            msg->fd_cookie(), std::move(msg->attached_handles_)});
+      }
+#else
+      if (bytes_written > 0) {
+        msg->attached_handles_.Clear();
+      }
+#endif
+
+      // Message sent OK!
+
+      AddIPCProfilerMarker(*msg, other_pid_, MessageDirection::eSending,
+                           MessagePhase::TransferEnd);
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+      DLOG(INFO) << "sent message @" << msg << " on channel @" << this
+                 << " with type " << msg->type();
+#endif
+      OutputQueuePop();
+      // msg has been destroyed, so clear the dangling reference.
+      msg = nullptr;
+    }
+  }
+  return true;
+}
+
+bool Channel::ChannelImpl::Send(mozilla::UniquePtr<Message> message) {
+  // NOTE: This method may be called on threads other than `IOThread()`.
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteSendMutex();
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+  DLOG(INFO) << "sending message @" << message.get() << " on channel @" << this
+             << " with type " << message->type() << " ("
+             << output_queue_.Count() << " in queue)";
+#endif
+
+  // If the channel has been closed, ProcessOutgoingMessages() is never going
+  // to pop anything off output_queue; output_queue will only get emptied when
+  // the channel is destructed.  We might as well delete message now, instead
+  // of waiting for the channel to be destructed.
+  if (pipe_ == -1) {
+    if (mozilla::ipc::LoggingEnabled()) {
+      fprintf(stderr,
+              "Can't send message %s, because this channel is closed.\n",
+              message->name());
+    }
+    return false;
+  }
+
+  OutputQueuePush(std::move(message));
+  if (!waiting_connect_) {
+    if (!is_blocked_on_write_) {
+      if (!ProcessOutgoingMessages()) return false;
+    }
+  }
+
+  return true;
+}
+
+void Channel::ChannelImpl::GetClientFileDescriptorMapping(int* src_fd,
+                                                          int* dest_fd) const {
+  IOThread().AssertOnCurrentThread();
+  DCHECK(mode_ == MODE_SERVER);
+  *src_fd = client_pipe_;
+  *dest_fd = gClientChannelFd;
+}
+
+void Channel::ChannelImpl::CloseClientFileDescriptor() {
+  IOThread().AssertOnCurrentThread();
+  if (client_pipe_ != -1) {
+    IGNORE_EINTR(close(client_pipe_));
+    client_pipe_ = -1;
+  }
+}
+
+// Called by libevent when we can read from th pipe without blocking.
+void Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int fd) {
+  IOThread().AssertOnCurrentThread();
+  chan_cap_.NoteOnIOThread();
+
+  if (!waiting_connect_ && fd == pipe_ && pipe_ != -1) {
+    if (!ProcessIncomingMessages()) {
+      Close();
+      listener_->OnChannelError();
+      // The OnChannelError() call may delete this, so we need to exit now.
+      return;
+    }
+  }
+}
+
+#if defined(OS_MACOSX)
+void Channel::ChannelImpl::CloseDescriptors(uint32_t pending_fd_id) {
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+
+  DCHECK(pending_fd_id != 0);
+  for (std::list<PendingDescriptors>::iterator i = pending_fds_.begin();
+       i != pending_fds_.end(); i++) {
+    if ((*i).id == pending_fd_id) {
+      pending_fds_.erase(i);
+      return;
+    }
+  }
+  DCHECK(false) << "pending_fd_id not in our list!";
+}
+#endif
+
+void Channel::ChannelImpl::OutputQueuePush(mozilla::UniquePtr<Message> msg) {
+  chan_cap_.NoteSendMutex();
+
+  mozilla::LogIPCMessage::LogDispatchWithPid(msg.get(), other_pid_);
+
+  MOZ_DIAGNOSTIC_ASSERT(pipe_ != -1);
+  msg->AssertAsLargeAsHeader();
+  output_queue_.Push(std::move(msg));
+}
+
+void Channel::ChannelImpl::OutputQueuePop() {
+  // Clear any reference to the front of output_queue_ before we destroy it.
+  partial_write_.reset();
+
+  mozilla::UniquePtr<Message> message = output_queue_.Pop();
+}
+
+// Called by libevent when we can write to the pipe without blocking.
+void Channel::ChannelImpl::OnFileCanWriteWithoutBlocking(int fd) {
+  RefPtr<ChannelImpl> grip(this);
+  IOThread().AssertOnCurrentThread();
+  mozilla::ReleasableMutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+  if (pipe_ != -1 && !ProcessOutgoingMessages()) {
+    CloseLocked();
+    lock.Unlock();
+    listener_->OnChannelError();
+  }
+}
+
+void Channel::ChannelImpl::Close() {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  CloseLocked();
+}
+
+void Channel::ChannelImpl::CloseLocked() {
+  chan_cap_.NoteExclusiveAccess();
+
+  // Close can be called multiple times, so we need to make sure we're
+  // idempotent.
+
+  // Unregister libevent for the FIFO and close it.
+  read_watcher_.StopWatchingFileDescriptor();
+  write_watcher_.StopWatchingFileDescriptor();
+  if (pipe_ != -1) {
+    IGNORE_EINTR(close(pipe_));
+    SetPipe(-1);
+  }
+  if (client_pipe_ != -1) {
+    IGNORE_EINTR(close(client_pipe_));
+    client_pipe_ = -1;
+  }
+
+  while (!output_queue_.IsEmpty()) {
+    OutputQueuePop();
+  }
+
+  // Close any outstanding, received file descriptors
+  for (std::vector<int>::iterator i = input_overflow_fds_.begin();
+       i != input_overflow_fds_.end(); ++i) {
+    IGNORE_EINTR(close(*i));
+  }
+  input_overflow_fds_.clear();
+
+#if defined(OS_MACOSX)
+  pending_fds_.clear();
+
+  other_task_ = nullptr;
+#endif
+}
+
+#if defined(OS_MACOSX)
+void Channel::ChannelImpl::SetOtherMachTask(task_t task) {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+
+  if (NS_WARN_IF(pipe_ == -1)) {
+    return;
+  }
+
+  MOZ_ASSERT(accept_mach_ports_ && privileged_ && waiting_connect_);
+  other_task_ = mozilla::RetainMachSendRight(task);
+  // Now that `other_task_` is provided, we can continue connecting.
+  ConnectLocked();
+}
+
+void Channel::ChannelImpl::StartAcceptingMachPorts(Mode mode) {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+
+  if (accept_mach_ports_) {
+    MOZ_ASSERT(privileged_ == (MODE_SERVER == mode));
+    return;
+  }
+  accept_mach_ports_ = true;
+  privileged_ = MODE_SERVER == mode;
+}
+
+//------------------------------------------------------------------------------
+// Mach port transferring logic
+//
+// It is currently not possible to directly transfer a mach send right between
+// two content processes using SCM_RIGHTS, unlike how we can handle file
+// descriptors. This means that mach ports need to be transferred through a
+// separate mechanism. This file only implements support for transferring mach
+// ports between a (potentially sandboxed) child process and the parent process.
+// Support for transferring mach ports between other process pairs is handled by
+// `NodeController`, which is responsible for relaying messages which carry
+// handles via the parent process.
+//
+// The logic which we use for doing this is based on the following from
+// Chromium, which pioneered this technique. As of this writing, chromium no
+// longer uses this strategy, as all IPC messages are sent using mach ports on
+// macOS.
+// https://source.chromium.org/chromium/chromium/src/+/9f707e5e04598d8303fa99ca29eb507c839767d8:mojo/core/mach_port_relay.cc
+// https://source.chromium.org/chromium/chromium/src/+/9f707e5e04598d8303fa99ca29eb507c839767d8:base/mac/mach_port_util.cc.
+//
+// As we only need to consider messages between the privileged (parent) and
+// unprivileged (child) processes in this code, there are 2 relevant cases which
+// we need to handle:
+//
+// # Unprivileged (child) to Privileged (parent)
+//
+// As the privileged process has access to the unprivileged process' `task_t`,
+// it is possible to directly extract the mach port from the target process'
+// address space, given its name, using `mach_port_extract_right`.
+//
+// To transfer the port, the unprivileged process will leak a reference to the
+// send right, and include the port's name in the message footer. The privileged
+// process will extract that port right (and drop the reference in the old
+// process) using `mach_port_extract_right` with `MACH_MSG_TYPE_MOVE_SEND`. The
+// call to `mach_port_extract_right` is handled by `BrokerExtractSendRight`
+//
+// # Privileged (parent) to Unprivileged (child)
+//
+// Unfortunately, the process of transferring a right into a target process is
+// more complex.  The only well-supported way to transfer a right into a process
+// is by sending it with `mach_msg`, and receiving it on the other side [1].
+//
+// To work around this, the privileged process uses `mach_port_allocate` to
+// create a new receive right in the target process using its `task_t`, and
+// `mach_port_extract_right` to extract a send-once right to that port. It then
+// sends a message to the port with port we're intending to send as an
+// attachment. This is handled by `BrokerTransferSendRight`, which returns the
+// name of the newly created receive right in the target process to be sent in
+// the message footer.
+//
+// In the unprivileged process, `mach_msg` is used to receive a single message
+// from the receive right, which will have the actual port we were trying to
+// transfer as an attachment. This is handled by the `MachReceivePortSendRight`
+// function.
+//
+// [1] We cannot use `mach_port_insert_right` to transfer the right into the
+// target process, as that method requires explicitly specifying the remote
+// port's name, and we do not control the port name allocator.
+
+// Extract a send right from the given peer task. A reference to the remote
+// right will be dropped.  See comment above for details.
+static mozilla::UniqueMachSendRight BrokerExtractSendRight(
+    task_t task, mach_port_name_t name) {
+  mach_port_t extractedRight = MACH_PORT_NULL;
+  mach_msg_type_name_t extractedRightType;
+  kern_return_t kr =
+      mach_port_extract_right(task, name, MACH_MSG_TYPE_MOVE_SEND,
+                              &extractedRight, &extractedRightType);
+  if (kr != KERN_SUCCESS) {
+    CHROMIUM_LOG(ERROR) << "failed to extract port right from other process. "
+                        << mach_error_string(kr);
+    return nullptr;
+  }
+  MOZ_ASSERT(extractedRightType == MACH_MSG_TYPE_PORT_SEND,
+             "We asked the OS for a send port");
+  return mozilla::UniqueMachSendRight(extractedRight);
+}
+
+// Transfer a send right to the given peer task. The name of a receive right in
+// the remote process will be returned if successful. The sent port can be
+// obtained from that port in the peer task using `MachReceivePortSendRight`.
+// See comment above for details.
+static mozilla::Maybe<mach_port_name_t> BrokerTransferSendRight(
+    task_t task, mozilla::UniqueMachSendRight port_to_send) {
+  mach_port_name_t endpoint;
+  kern_return_t kr =
+      mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &endpoint);
+  if (kr != KERN_SUCCESS) {
+    CHROMIUM_LOG(ERROR)
+        << "Unable to create receive right in TransferMachPorts. "
+        << mach_error_string(kr);
+    return mozilla::Nothing();
+  }
+
+  // Clean up the endpoint on error.
+  auto destroyEndpoint =
+      mozilla::MakeScopeExit([&] { mach_port_deallocate(task, endpoint); });
+
+  // Change its message queue limit so that it accepts one message.
+  mach_port_limits limits = {};
+  limits.mpl_qlimit = 1;
+  kr = mach_port_set_attributes(task, endpoint, MACH_PORT_LIMITS_INFO,
+                                reinterpret_cast<mach_port_info_t>(&limits),
+                                MACH_PORT_LIMITS_INFO_COUNT);
+  if (kr != KERN_SUCCESS) {
+    CHROMIUM_LOG(ERROR)
+        << "Unable configure receive right in TransferMachPorts. "
+        << mach_error_string(kr);
+    return mozilla::Nothing();
+  }
+
+  // Get a send right.
+  mach_port_t send_once_right;
+  mach_msg_type_name_t send_right_type;
+  kr = mach_port_extract_right(task, endpoint, MACH_MSG_TYPE_MAKE_SEND_ONCE,
+                               &send_once_right, &send_right_type);
+  if (kr != KERN_SUCCESS) {
+    CHROMIUM_LOG(ERROR) << "Unable extract send right in TransferMachPorts. "
+                        << mach_error_string(kr);
+    return mozilla::Nothing();
+  }
+  MOZ_ASSERT(MACH_MSG_TYPE_PORT_SEND_ONCE == send_right_type);
+
+  kr = MachSendPortSendRight(send_once_right, port_to_send.get(),
+                             mozilla::Some(0), MACH_MSG_TYPE_MOVE_SEND_ONCE);
+  if (kr != KERN_SUCCESS) {
+    // This right will be destroyed due to being a SEND_ONCE right if we
+    // succeed.
+    mach_port_deallocate(mach_task_self(), send_once_right);
+    CHROMIUM_LOG(ERROR) << "Unable to transfer right in TransferMachPorts. "
+                        << mach_error_string(kr);
+    return mozilla::Nothing();
+  }
+
+  destroyEndpoint.release();
+  return mozilla::Some(endpoint);
+}
+
+// Process footer information attached to the message, and acquire owning
+// references to any transferred mach ports. See comment above for details.
+bool Channel::ChannelImpl::AcceptMachPorts(Message& msg) {
+  chan_cap_.NoteOnIOThread();
+
+  uint32_t num_send_rights = msg.header()->num_send_rights;
+  if (num_send_rights == 0) {
+    return true;
+  }
+
+  if (!accept_mach_ports_) {
+    CHROMIUM_LOG(ERROR) << "invalid message: " << msg.name()
+                        << ". channel is not configured to accept mach ports";
+    return false;
+  }
+
+  // Read in the payload from the footer, truncating the message.
+  nsTArray<uint32_t> payload;
+  payload.AppendElements(num_send_rights);
+  if (!msg.ReadFooter(payload.Elements(), num_send_rights * sizeof(uint32_t),
+                      /* truncate */ true)) {
+    CHROMIUM_LOG(ERROR) << "failed to read mach port payload from message";
+    return false;
+  }
+  msg.header()->num_send_rights = 0;
+
+  // Read in the handles themselves, transferring ownership as required.
+  nsTArray<mozilla::UniqueMachSendRight> rights(num_send_rights);
+  for (uint32_t name : payload) {
+    mozilla::UniqueMachSendRight right;
+    if (privileged_) {
+      if (!other_task_) {
+        CHROMIUM_LOG(ERROR) << "other_task_ is invalid in AcceptMachPorts";
+        return false;
+      }
+      right = BrokerExtractSendRight(other_task_.get(), name);
+    } else {
+      kern_return_t kr = MachReceivePortSendRight(
+          mozilla::UniqueMachReceiveRight(name), mozilla::Some(0), &right);
+      if (kr != KERN_SUCCESS) {
+        CHROMIUM_LOG(ERROR)
+            << "failed to receive mach send right. " << mach_error_string(kr);
+        return false;
+      }
+    }
+    if (!right) {
+      return false;
+    }
+    rights.AppendElement(std::move(right));
+  }
+
+  // We're done with the handle footer, truncate the message at that point.
+  msg.attached_send_rights_ = std::move(rights);
+  MOZ_ASSERT(msg.num_send_rights() == num_send_rights);
+  return true;
+}
+
+// Transfer ownership of any attached mach ports to the peer task, and add the
+// required information for AcceptMachPorts to the message footer. See comment
+// above for details.
+bool Channel::ChannelImpl::TransferMachPorts(Message& msg) {
+  uint32_t num_send_rights = msg.num_send_rights();
+  if (num_send_rights == 0) {
+    return true;
+  }
+
+  if (!accept_mach_ports_) {
+    CHROMIUM_LOG(ERROR) << "cannot send message: " << msg.name()
+                        << ". channel is not configured to accept mach ports";
+    return false;
+  }
+
+#  ifdef DEBUG
+  uint32_t rights_offset = msg.header()->payload_size;
+#  endif
+
+  nsTArray<uint32_t> payload(num_send_rights);
+  for (auto& port_to_send : msg.attached_send_rights_) {
+    if (privileged_) {
+      if (!other_task_) {
+        CHROMIUM_LOG(ERROR) << "other_task_ is invalid in TransferMachPorts";
+        return false;
+      }
+      mozilla::Maybe<mach_port_name_t> endpoint =
+          BrokerTransferSendRight(other_task_.get(), std::move(port_to_send));
+      if (!endpoint) {
+        return false;
+      }
+      payload.AppendElement(*endpoint);
+    } else {
+      payload.AppendElement(port_to_send.release());
+    }
+  }
+  msg.attached_send_rights_.Clear();
+
+  msg.WriteFooter(payload.Elements(), payload.Length() * sizeof(uint32_t));
+  msg.header()->num_send_rights = num_send_rights;
+
+  MOZ_ASSERT(msg.header()->payload_size ==
+                 rights_offset + (sizeof(uint32_t) * num_send_rights),
+             "Unexpected number of bytes written for send rights footer?");
+  return true;
+}
+#endif
+
+//------------------------------------------------------------------------------
+// Channel's methods simply call through to ChannelImpl.
+Channel::Channel(const ChannelId& channel_id, Mode mode, Listener* listener)
+    : channel_impl_(new ChannelImpl(channel_id, mode, listener)) {
+  MOZ_COUNT_CTOR(IPC::Channel);
+}
+
+Channel::Channel(ChannelHandle pipe, Mode mode, Listener* listener)
+    : channel_impl_(new ChannelImpl(std::move(pipe), mode, listener)) {
+  MOZ_COUNT_CTOR(IPC::Channel);
+}
+
+Channel::~Channel() { MOZ_COUNT_DTOR(IPC::Channel); }
+
+bool Channel::Connect() { return channel_impl_->Connect(); }
+
+void Channel::Close() { channel_impl_->Close(); }
+
+Channel::Listener* Channel::set_listener(Listener* listener) {
+  return channel_impl_->set_listener(listener);
+}
+
+bool Channel::Send(mozilla::UniquePtr<Message> message) {
+  return channel_impl_->Send(std::move(message));
+}
+
+void Channel::GetClientFileDescriptorMapping(int* src_fd, int* dest_fd) const {
+  return channel_impl_->GetClientFileDescriptorMapping(src_fd, dest_fd);
+}
+
+void Channel::CloseClientFileDescriptor() {
+  channel_impl_->CloseClientFileDescriptor();
+}
+
+int32_t Channel::OtherPid() const { return channel_impl_->OtherPid(); }
+
+bool Channel::IsClosed() const { return channel_impl_->IsClosed(); }
+
+#if defined(OS_MACOSX)
+void Channel::SetOtherMachTask(task_t task) {
+  channel_impl_->SetOtherMachTask(task);
+}
+
+void Channel::StartAcceptingMachPorts(Mode mode) {
+  channel_impl_->StartAcceptingMachPorts(mode);
+}
+#endif
+
+// static
+Channel::ChannelId Channel::GenerateVerifiedChannelID() { return {}; }
+
+// static
+Channel::ChannelId Channel::ChannelIDForCurrentProcess() { return {}; }
+
+// static
+bool Channel::CreateRawPipe(ChannelHandle* server, ChannelHandle* client) {
+  int fds[2];
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, fds) < 0) {
+    mozilla::ipc::AnnotateCrashReportWithErrno(
+        CrashReporter::Annotation::IpcCreatePipeSocketPairErrno, errno);
+    return false;
+  }
+
+  auto configureFd = [](int fd) -> bool {
+    // Mark the endpoints as non-blocking
+    if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
+      mozilla::ipc::AnnotateCrashReportWithErrno(
+          CrashReporter::Annotation::IpcCreatePipeFcntlErrno, errno);
+      return false;
+    }
+
+    // Mark the pipes as FD_CLOEXEC
+    int flags = fcntl(fd, F_GETFD);
+    if (flags == -1) {
+      mozilla::ipc::AnnotateCrashReportWithErrno(
+          CrashReporter::Annotation::IpcCreatePipeCloExecErrno, errno);
+      return false;
+    }
+    flags |= FD_CLOEXEC;
+    if (fcntl(fd, F_SETFD, flags) == -1) {
+      mozilla::ipc::AnnotateCrashReportWithErrno(
+          CrashReporter::Annotation::IpcCreatePipeCloExecErrno, errno);
+      return false;
+    }
+    return true;
+  };
+
+  if (!configureFd(fds[0]) || !configureFd(fds[1])) {
+    IGNORE_EINTR(close(fds[0]));
+    IGNORE_EINTR(close(fds[1]));
+    return false;
+  }
+
+  server->reset(fds[0]);
+  client->reset(fds[1]);
+  return true;
+}
+
+}  // namespace IPC
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_posix.h b/ipc/chromium/src/chrome/common/ipc_channel_posix.h
new file mode 100644
index 0000000000..43670db01c
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.h
@@ -0,0 +1,227 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_IPC_CHANNEL_POSIX_H_
+#define CHROME_COMMON_IPC_CHANNEL_POSIX_H_
+
+#include "chrome/common/ipc_channel.h"
+#include "chrome/common/ipc_channel_capability.h"
+
+#include <sys/socket.h>  // for CMSG macros
+
+#include <atomic>
+#include <string>
+#include <vector>
+#include <list>
+
+#include "base/message_loop.h"
+#include "base/task.h"
+
+#include "mozilla/Maybe.h"
+#include "mozilla/Queue.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/UniquePtrExtensions.h"
+#include "nsISupports.h"
+
+namespace IPC {
+
+// An implementation of ChannelImpl for POSIX systems that works via
+// socketpairs.  See the .cc file for an overview of the implementation.
+class Channel::ChannelImpl : public MessageLoopForIO::Watcher {
+ public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DELETE_ON_EVENT_TARGET(
+      ChannelImpl, IOThread().GetEventTarget());
+
+  using ChannelId = Channel::ChannelId;
+
+  // Mirror methods of Channel, see ipc_channel.h for description.
+  ChannelImpl(const ChannelId& channel_id, Mode mode, Listener* listener);
+  ChannelImpl(ChannelHandle pipe, Mode mode, Listener* listener);
+  bool Connect() MOZ_EXCLUDES(SendMutex());
+  void Close() MOZ_EXCLUDES(SendMutex());
+  Listener* set_listener(Listener* listener) {
+    IOThread().AssertOnCurrentThread();
+    chan_cap_.NoteOnIOThread();
+    Listener* old = listener_;
+    listener_ = listener;
+    return old;
+  }
+  // NOTE: `Send` may be called on threads other than the I/O thread.
+  bool Send(mozilla::UniquePtr<Message> message) MOZ_EXCLUDES(SendMutex());
+  void GetClientFileDescriptorMapping(int* src_fd, int* dest_fd) const;
+
+  void CloseClientFileDescriptor();
+
+  int32_t OtherPid() {
+    IOThread().AssertOnCurrentThread();
+    chan_cap_.NoteOnIOThread();
+    return other_pid_;
+  }
+
+  // See the comment in ipc_channel.h for info on IsClosed()
+  // NOTE: `IsClosed` may be called on threads other than the I/O thread.
+  bool IsClosed() MOZ_EXCLUDES(SendMutex()) {
+    mozilla::MutexAutoLock lock(SendMutex());
+    chan_cap_.NoteSendMutex();
+    return pipe_ == -1;
+  }
+
+#if defined(OS_MACOSX)
+  void SetOtherMachTask(task_t task) MOZ_EXCLUDES(SendMutex());
+
+  void StartAcceptingMachPorts(Mode mode) MOZ_EXCLUDES(SendMutex());
+#endif
+
+ private:
+  ~ChannelImpl() { Close(); }
+
+  void Init(Mode mode, Listener* listener)
+      MOZ_REQUIRES(SendMutex(), IOThread());
+  bool CreatePipe(Mode mode) MOZ_REQUIRES(SendMutex(), IOThread());
+  void SetPipe(int fd) MOZ_REQUIRES(SendMutex(), IOThread());
+  void SetOtherPid(int other_pid) MOZ_REQUIRES(IOThread())
+      MOZ_EXCLUDES(SendMutex()) {
+    mozilla::MutexAutoLock lock(SendMutex());
+    chan_cap_.NoteExclusiveAccess();
+    other_pid_ = other_pid;
+  }
+  bool PipeBufHasSpaceAfter(size_t already_written)
+      MOZ_REQUIRES_SHARED(chan_cap_);
+  bool EnqueueHelloMessage() MOZ_REQUIRES(SendMutex(), IOThread());
+  bool ConnectLocked() MOZ_REQUIRES(SendMutex(), IOThread());
+  void CloseLocked() MOZ_REQUIRES(SendMutex(), IOThread());
+
+  bool ProcessIncomingMessages() MOZ_REQUIRES(IOThread());
+  bool ProcessOutgoingMessages() MOZ_REQUIRES(SendMutex());
+
+  // MessageLoopForIO::Watcher implementation.
+  virtual void OnFileCanReadWithoutBlocking(int fd) override;
+  virtual void OnFileCanWriteWithoutBlocking(int fd) override;
+
+#if defined(OS_MACOSX)
+  void CloseDescriptors(uint32_t pending_fd_id) MOZ_REQUIRES(IOThread())
+      MOZ_EXCLUDES(SendMutex());
+
+  // Called on a Message immediately before it is sent/recieved to transfer
+  // handles to the remote process, or accept handles from the remote process.
+  bool AcceptMachPorts(Message& msg) MOZ_REQUIRES(IOThread());
+  bool TransferMachPorts(Message& msg) MOZ_REQUIRES_SHARED(chan_cap_);
+#endif
+
+  void OutputQueuePush(mozilla::UniquePtr<Message> msg)
+      MOZ_REQUIRES(SendMutex());
+  void OutputQueuePop() MOZ_REQUIRES(SendMutex());
+
+  const ChannelCapability::Thread& IOThread() const
+      MOZ_RETURN_CAPABILITY(chan_cap_.IOThread()) {
+    return chan_cap_.IOThread();
+  }
+
+  ChannelCapability::Mutex& SendMutex()
+      MOZ_RETURN_CAPABILITY(chan_cap_.SendMutex()) {
+    return chan_cap_.SendMutex();
+  }
+
+  // Compound capability of a Mutex and the IO thread.
+  ChannelCapability chan_cap_;
+
+  Mode mode_ MOZ_GUARDED_BY(IOThread());
+
+  // After accepting one client connection on our server socket we want to
+  // stop listening.
+  MessageLoopForIO::FileDescriptorWatcher read_watcher_
+      MOZ_GUARDED_BY(IOThread());
+  MessageLoopForIO::FileDescriptorWatcher write_watcher_
+      MOZ_GUARDED_BY(IOThread());
+
+  // Indicates whether we're currently blocked waiting for a write to complete.
+  bool is_blocked_on_write_ MOZ_GUARDED_BY(SendMutex()) = false;
+
+  // If sending a message blocks then we use this iterator to keep track of
+  // where in the message we are. It gets reset when the message is finished
+  // sending.
+  struct PartialWrite {
+    Pickle::BufferList::IterImpl iter_;
+    mozilla::Span<const mozilla::UniqueFileHandle> handles_;
+  };
+  mozilla::Maybe<PartialWrite> partial_write_ MOZ_GUARDED_BY(SendMutex());
+
+  int pipe_ MOZ_GUARDED_BY(chan_cap_);
+  // The client end of our socketpair().
+  int client_pipe_ MOZ_GUARDED_BY(IOThread());
+  // The SO_SNDBUF value of pipe_, or 0 if unknown.
+  unsigned pipe_buf_len_ MOZ_GUARDED_BY(chan_cap_);
+
+  Listener* listener_ MOZ_GUARDED_BY(IOThread());
+
+  // Messages to be sent are queued here.
+  mozilla::Queue<mozilla::UniquePtr<Message>, 64> output_queue_
+      MOZ_GUARDED_BY(SendMutex());
+
+  // We read from the pipe into these buffers.
+  size_t input_buf_offset_ MOZ_GUARDED_BY(IOThread());
+  mozilla::UniquePtr<char[]> input_buf_ MOZ_GUARDED_BY(IOThread());
+  mozilla::UniquePtr<char[]> input_cmsg_buf_ MOZ_GUARDED_BY(IOThread());
+
+  // The control message buffer will hold all of the file descriptors that will
+  // be read in during a single recvmsg call. Message::WriteFileDescriptor
+  // always writes one word of data for every file descriptor added to the
+  // message, and the number of file descriptors per recvmsg will not exceed
+  // kControlBufferMaxFds. This is based on the true maximum SCM_RIGHTS
+  // descriptor count, which is just over 250 on both Linux and macOS.
+  //
+  // This buffer also holds a control message header of size CMSG_SPACE(0)
+  // bytes. However, CMSG_SPACE is not a constant on Macs, so we can't use it
+  // here. Consequently, we pick a number here that is at least CMSG_SPACE(0) on
+  // all platforms. We assert at runtime, in Channel::ChannelImpl::Init, that
+  // it's big enough.
+  static constexpr size_t kControlBufferMaxFds = 200;
+  static constexpr size_t kControlBufferHeaderSize = 32;
+  static constexpr size_t kControlBufferSize =
+      kControlBufferMaxFds * sizeof(int) + kControlBufferHeaderSize;
+
+  // Large incoming messages that span multiple pipe buffers get built-up in the
+  // buffers of this message.
+  mozilla::UniquePtr<Message> incoming_message_ MOZ_GUARDED_BY(IOThread());
+  std::vector<int> input_overflow_fds_ MOZ_GUARDED_BY(IOThread());
+
+  // Will be set to `true` until `Connect()` has been called and communication
+  // is ready. For privileged connections on macOS, this will not be cleared
+  // until the peer mach port has been provided to allow transferring mach
+  // ports.
+  bool waiting_connect_ MOZ_GUARDED_BY(chan_cap_) = true;
+
+  // We keep track of the PID of the other side of this channel so that we can
+  // record this when generating logs of IPC messages.
+  int32_t other_pid_ MOZ_GUARDED_BY(chan_cap_) = -1;
+
+#if defined(OS_MACOSX)
+  struct PendingDescriptors {
+    uint32_t id;
+    nsTArray<mozilla::UniqueFileHandle> handles;
+  };
+
+  std::list<PendingDescriptors> pending_fds_ MOZ_GUARDED_BY(SendMutex());
+
+  // A generation ID for RECEIVED_FD messages.
+  uint32_t last_pending_fd_id_ MOZ_GUARDED_BY(SendMutex()) = 0;
+
+  // Whether or not to accept mach ports from a remote process, and whether this
+  // process is the privileged side of a IPC::Channel which can transfer mach
+  // ports.
+  bool accept_mach_ports_ MOZ_GUARDED_BY(chan_cap_) = false;
+  bool privileged_ MOZ_GUARDED_BY(chan_cap_) = false;
+
+  // If available, the task port for the remote process.
+  mozilla::UniqueMachSendRight other_task_ MOZ_GUARDED_BY(chan_cap_);
+#endif
+
+  DISALLOW_COPY_AND_ASSIGN(ChannelImpl);
+};
+
+}  // namespace IPC
+
+#endif  // CHROME_COMMON_IPC_CHANNEL_POSIX_H_
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_utils.cc b/ipc/chromium/src/chrome/common/ipc_channel_utils.cc
new file mode 100644
index 0000000000..7e737762f3
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_utils.cc
@@ -0,0 +1,58 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "chrome/common/ipc_channel_utils.h"
+
+#include "mozilla/ProfilerMarkers.h"
+#include "chrome/common/ipc_message.h"
+#include "base/process.h"
+
+namespace IPC {
+
+void AddIPCProfilerMarker(const Message& aMessage, int32_t aOtherPid,
+                          mozilla::ipc::MessageDirection aDirection,
+                          mozilla::ipc::MessagePhase aPhase) {
+  if (aMessage.routing_id() != MSG_ROUTING_NONE &&
+      profiler_feature_active(ProfilerFeature::IPCMessages)) {
+    if (static_cast<base::ProcessId>(aOtherPid) == base::kInvalidProcessId) {
+      DLOG(WARNING) << "Unable to record IPC profile marker, other PID not set";
+      return;
+    }
+
+    if (profiler_is_locked_on_current_thread()) {
+      // One of the profiler mutexes is locked on this thread, don't record
+      // markers, because we don't want to expose profiler IPCs due to the
+      // profiler itself, and also to avoid possible re-entrancy issues.
+      return;
+    }
+
+    // The current timestamp must be given to the `IPCMarker` payload.
+    [[maybe_unused]] const mozilla::TimeStamp now = mozilla::TimeStamp::Now();
+    bool isThreadBeingProfiled =
+        profiler_thread_is_being_profiled_for_markers();
+    PROFILER_MARKER(
+        "IPC", IPC,
+        mozilla::MarkerOptions(
+            mozilla::MarkerTiming::InstantAt(now),
+            // If the thread is being profiled, add the marker to
+            // the current thread. If the thread is not being
+            // profiled, add the marker to the main thread. It will
+            // appear in the main thread's IPC track. Profiler
+            // analysis UI correlates all the IPC markers from
+            // different threads and generates processed markers.
+            isThreadBeingProfiled ? mozilla::MarkerThreadId::CurrentThread()
+                                  : mozilla::MarkerThreadId::MainThread()),
+        IPCMarker, now, now, aOtherPid, aMessage.seqno(), aMessage.type(),
+        mozilla::ipc::UnknownSide, aDirection, aPhase, aMessage.is_sync(),
+        // aOriginThreadId: If the thread is being profiled, do not include a
+        // thread ID, as it's the same as the markers. Only include this field
+        // when the marker is being sent from another thread.
+        isThreadBeingProfiled ? mozilla::MarkerThreadId{}
+                              : mozilla::MarkerThreadId::CurrentThread());
+  }
+}
+
+}  // namespace IPC
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_utils.h b/ipc/chromium/src/chrome/common/ipc_channel_utils.h
new file mode 100644
index 0000000000..1bcfcf7032
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_utils.h
@@ -0,0 +1,21 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CHROME_COMMON_IPC_CHANNEL_UTILS_H_
+#define CHROME_COMMON_IPC_CHANNEL_UTILS_H_
+
+#include "chrome/common/ipc_message.h"
+#include "mozilla/ipc/MessageChannel.h"
+
+namespace IPC {
+
+void AddIPCProfilerMarker(const Message& aMessage, int32_t aOtherPid,
+                          mozilla::ipc::MessageDirection aDirection,
+                          mozilla::ipc::MessagePhase aPhase);
+
+}  // namespace IPC
+
+#endif  // CHROME_COMMON_IPC_CHANNEL_UTILS_H_
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_win.cc b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
new file mode 100644
index 0000000000..10a9f2d91f
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
@@ -0,0 +1,920 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/ipc_channel_win.h"
+
+#include <windows.h>
+#include <sstream>
+
+#include "base/command_line.h"
+#include "base/compiler_specific.h"
+#include "base/logging.h"
+#include "base/process_util.h"
+#include "base/rand_util.h"
+#include "base/string_util.h"
+#include "base/win_util.h"
+#include "chrome/common/chrome_switches.h"
+#include "chrome/common/ipc_channel_utils.h"
+#include "chrome/common/ipc_message_utils.h"
+#include "mozilla/ipc/ProtocolUtils.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/LateWriteChecks.h"
+#include "mozilla/RandomNum.h"
+#include "nsThreadUtils.h"
+
+using namespace mozilla::ipc;
+
+namespace IPC {
+//------------------------------------------------------------------------------
+
+Channel::ChannelImpl::State::State(ChannelImpl* channel) {
+  memset(&context.overlapped, 0, sizeof(context.overlapped));
+  context.handler = channel;
+}
+
+Channel::ChannelImpl::State::~State() {
+  COMPILE_ASSERT(!offsetof(Channel::ChannelImpl::State, context),
+                 starts_with_io_context);
+}
+
+//------------------------------------------------------------------------------
+
+Channel::ChannelImpl::ChannelImpl(const ChannelId& channel_id, Mode mode,
+                                  Listener* listener)
+    : chan_cap_("ChannelImpl::SendMutex",
+                MessageLoopForIO::current()->SerialEventTarget()),
+      ALLOW_THIS_IN_INITIALIZER_LIST(input_state_(this)),
+      ALLOW_THIS_IN_INITIALIZER_LIST(output_state_(this)) {
+  Init(mode, listener);
+
+  if (!CreatePipe(channel_id, mode)) {
+    // The pipe may have been closed already.
+    CHROMIUM_LOG(WARNING) << "Unable to create pipe named \"" << channel_id
+                          << "\" in " << (mode == 0 ? "server" : "client")
+                          << " mode.";
+  }
+}
+
+Channel::ChannelImpl::ChannelImpl(ChannelHandle pipe, Mode mode,
+                                  Listener* listener)
+    : chan_cap_("ChannelImpl::SendMutex",
+                MessageLoopForIO::current()->SerialEventTarget()),
+      ALLOW_THIS_IN_INITIALIZER_LIST(input_state_(this)),
+      ALLOW_THIS_IN_INITIALIZER_LIST(output_state_(this)) {
+  Init(mode, listener);
+
+  if (!pipe) {
+    return;
+  }
+
+  shared_secret_ = 0;
+  waiting_for_shared_secret_ = false;
+  pipe_ = pipe.release();
+  EnqueueHelloMessage();
+}
+
+void Channel::ChannelImpl::Init(Mode mode, Listener* listener) {
+  // Verify that we fit in a "quantum-spaced" jemalloc bucket.
+  static_assert(sizeof(*this) <= 512, "Exceeded expected size class");
+
+  chan_cap_.NoteExclusiveAccess();
+
+  mode_ = mode;
+  pipe_ = INVALID_HANDLE_VALUE;
+  listener_ = listener;
+  waiting_connect_ = true;
+  processing_incoming_ = false;
+  input_buf_offset_ = 0;
+  input_buf_ = mozilla::MakeUnique<char[]>(Channel::kReadBufferSize);
+  accept_handles_ = false;
+  privileged_ = false;
+  other_process_ = INVALID_HANDLE_VALUE;
+}
+
+void Channel::ChannelImpl::OutputQueuePush(mozilla::UniquePtr<Message> msg) {
+  chan_cap_.NoteSendMutex();
+
+  mozilla::LogIPCMessage::LogDispatchWithPid(msg.get(), other_pid_);
+
+  output_queue_.Push(std::move(msg));
+}
+
+void Channel::ChannelImpl::OutputQueuePop() {
+  mozilla::UniquePtr<Message> message = output_queue_.Pop();
+}
+
+void Channel::ChannelImpl::Close() {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  CloseLocked();
+}
+
+void Channel::ChannelImpl::CloseLocked() {
+  chan_cap_.NoteExclusiveAccess();
+
+  if (connect_timeout_) {
+    connect_timeout_->Cancel();
+    connect_timeout_ = nullptr;
+  }
+
+  // If we still have pending I/O, cancel it. The references inside
+  // `input_state_` and `output_state_` will keep the buffers alive until they
+  // complete.
+  if (input_state_.is_pending || output_state_.is_pending) {
+    CancelIo(pipe_);
+  }
+
+  // Closing the handle at this point prevents us from issuing more requests
+  // form OnIOCompleted().
+  if (pipe_ != INVALID_HANDLE_VALUE) {
+    CloseHandle(pipe_);
+    pipe_ = INVALID_HANDLE_VALUE;
+  }
+
+  // If we have a connection to the other process, close the handle.
+  if (other_process_ != INVALID_HANDLE_VALUE) {
+    CloseHandle(other_process_);
+    other_process_ = INVALID_HANDLE_VALUE;
+  }
+
+  // Don't return from `CloseLocked()` until the IO has been completed,
+  // otherwise the IO thread may exit with outstanding IO, leaking the
+  // ChannelImpl.
+  //
+  // It's OK to unlock here, as calls to `Send` from other threads will be
+  // rejected, due to `pipe_` having been cleared.
+  while (input_state_.is_pending || output_state_.is_pending) {
+    mozilla::MutexAutoUnlock unlock(SendMutex());
+    MessageLoopForIO::current()->WaitForIOCompletion(INFINITE, this);
+  }
+
+  while (!output_queue_.IsEmpty()) {
+    OutputQueuePop();
+  }
+}
+
+bool Channel::ChannelImpl::Send(mozilla::UniquePtr<Message> message) {
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteSendMutex();
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+  DLOG(INFO) << "sending message @" << message.get() << " on channel @" << this
+             << " with type " << message->type() << " ("
+             << output_queue_.Count() << " in queue)";
+#endif
+
+  if (pipe_ == INVALID_HANDLE_VALUE) {
+    if (mozilla::ipc::LoggingEnabled()) {
+      fprintf(stderr,
+              "Can't send message %s, because this channel is closed.\n",
+              message->name());
+    }
+    return false;
+  }
+
+  OutputQueuePush(std::move(message));
+  // ensure waiting to write
+  if (!waiting_connect_) {
+    if (!output_state_.is_pending) {
+      if (!ProcessOutgoingMessages(NULL, 0, false)) {
+        return false;
+      }
+    }
+  }
+
+  return true;
+}
+
+const Channel::ChannelId Channel::ChannelImpl::PipeName(
+    const ChannelId& channel_id, int32_t* secret) const {
+  MOZ_ASSERT(secret);
+
+  std::wostringstream ss;
+  ss << L"\\\\.\\pipe\\chrome.";
+
+  // Prevent the shared secret from ending up in the pipe name.
+  size_t index = channel_id.find_first_of(L'\\');
+  if (index != std::string::npos) {
+    StringToInt(channel_id.substr(index + 1), secret);
+    ss << channel_id.substr(0, index - 1);
+  } else {
+    // This case is here to support predictable named pipes in tests.
+    *secret = 0;
+    ss << channel_id;
+  }
+  return ss.str();
+}
+
+bool Channel::ChannelImpl::CreatePipe(const ChannelId& channel_id, Mode mode) {
+  chan_cap_.NoteExclusiveAccess();
+
+  DCHECK(pipe_ == INVALID_HANDLE_VALUE);
+  const ChannelId pipe_name = PipeName(channel_id, &shared_secret_);
+  if (mode == MODE_SERVER) {
+    waiting_for_shared_secret_ = !!shared_secret_;
+    pipe_ = CreateNamedPipeW(pipe_name.c_str(),
+                             PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED |
+                                 FILE_FLAG_FIRST_PIPE_INSTANCE,
+                             PIPE_TYPE_BYTE | PIPE_READMODE_BYTE,
+                             1,  // number of pipe instances
+                             // output buffer size (XXX tune)
+                             Channel::kReadBufferSize,
+                             // input buffer size (XXX tune)
+                             Channel::kReadBufferSize,
+                             5000,  // timeout in milliseconds (XXX tune)
+                             NULL);
+  } else {
+    pipe_ = CreateFileW(
+        pipe_name.c_str(), GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
+        SECURITY_SQOS_PRESENT | SECURITY_IDENTIFICATION | FILE_FLAG_OVERLAPPED,
+        NULL);
+  }
+  if (pipe_ == INVALID_HANDLE_VALUE) {
+    // If this process is being closed, the pipe may be gone already.
+    CHROMIUM_LOG(WARNING) << "failed to create pipe: " << GetLastError();
+    return false;
+  }
+
+  // Create the Hello message to be sent when Connect is called
+  return EnqueueHelloMessage();
+}
+
+bool Channel::ChannelImpl::EnqueueHelloMessage() {
+  chan_cap_.NoteExclusiveAccess();
+
+  auto m = mozilla::MakeUnique<Message>(MSG_ROUTING_NONE, HELLO_MESSAGE_TYPE);
+
+  // If we're waiting for our shared secret from the other end's hello message
+  // then don't give the game away by sending it in ours.
+  int32_t secret = waiting_for_shared_secret_ ? 0 : shared_secret_;
+
+  // Also, don't send if the value is zero (for IPC backwards compatability).
+  if (!m->WriteInt(GetCurrentProcessId()) ||
+      (secret && !m->WriteUInt32(secret))) {
+    CloseHandle(pipe_);
+    pipe_ = INVALID_HANDLE_VALUE;
+    return false;
+  }
+
+  OutputQueuePush(std::move(m));
+  return true;
+}
+
+bool Channel::ChannelImpl::Connect() {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+
+  if (pipe_ == INVALID_HANDLE_VALUE) return false;
+
+  MessageLoopForIO::current()->RegisterIOHandler(pipe_, this);
+
+  // Check to see if there is a client connected to our pipe...
+  if (mode_ == MODE_SERVER) {
+    DCHECK(!input_state_.is_pending);
+    if (!ProcessConnection()) {
+      return false;
+    }
+  } else {
+    waiting_connect_ = false;
+  }
+
+  if (!input_state_.is_pending) {
+    // Complete setup asynchronously. By not setting input_state_.is_pending
+    // to `this`, we indicate to OnIOCompleted that this is the special
+    // initialization signal, while keeping a reference through the
+    // `RunnableMethod`.
+    IOThread().Dispatch(
+        mozilla::NewRunnableMethod<MessageLoopForIO::IOContext*, DWORD, DWORD>(
+            "ContinueConnect", this, &ChannelImpl::OnIOCompleted,
+            &input_state_.context, 0, 0));
+  }
+
+  if (!waiting_connect_) {
+    DCHECK(!output_state_.is_pending);
+    ProcessOutgoingMessages(NULL, 0, false);
+  }
+  return true;
+}
+
+bool Channel::ChannelImpl::ProcessConnection() {
+  chan_cap_.NoteExclusiveAccess();
+
+  DCHECK(!input_state_.is_pending);
+
+  // Do we have a client connected to our pipe?
+  if (INVALID_HANDLE_VALUE == pipe_) return false;
+
+  BOOL ok = ConnectNamedPipe(pipe_, &input_state_.context.overlapped);
+
+  DWORD err = GetLastError();
+  if (ok) {
+    // Uhm, the API documentation says that this function should never
+    // return success when used in overlapped mode.
+    NOTREACHED();
+    return false;
+  }
+
+  switch (err) {
+    case ERROR_IO_PENDING: {
+      static bool kExtendedTimeout =
+#ifdef DEBUG
+          true;
+#else
+          !!PR_GetEnv("MOZ_RUN_GTEST");
+#endif
+      input_state_.is_pending = this;
+      NS_NewTimerWithCallback(
+          getter_AddRefs(connect_timeout_),
+          [self = RefPtr{this}](nsITimer* timer) {
+            CHROMIUM_LOG(ERROR) << "ConnectNamedPipe timed out!";
+            self->IOThread().AssertOnCurrentThread();
+            self->Close();
+            self->listener_->OnChannelError();
+          },
+          kExtendedTimeout ? 60000 : 10000, nsITimer::TYPE_ONE_SHOT,
+          "ChannelImpl::ProcessConnection", IOThread().GetEventTarget());
+    } break;
+    case ERROR_PIPE_CONNECTED:
+      waiting_connect_ = false;
+      if (connect_timeout_) {
+        connect_timeout_->Cancel();
+        connect_timeout_ = nullptr;
+      }
+      break;
+    case ERROR_NO_DATA:
+      // The pipe is being closed.
+      return false;
+    default:
+      NOTREACHED();
+      return false;
+  }
+
+  return true;
+}
+
+void Channel::ChannelImpl::SetOtherPid(int other_pid) {
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+  other_pid_ = other_pid;
+
+  // Now that we know the remote pid, open a privileged handle to the
+  // child process if needed to transfer handles to/from it.
+  if (privileged_ && other_process_ == INVALID_HANDLE_VALUE) {
+    other_process_ = OpenProcess(PROCESS_DUP_HANDLE, false, other_pid_);
+    if (!other_process_) {
+      other_process_ = INVALID_HANDLE_VALUE;
+      CHROMIUM_LOG(ERROR) << "Failed to acquire privileged handle to "
+                          << other_pid_ << ", cannot accept handles";
+    }
+  }
+}
+
+bool Channel::ChannelImpl::ProcessIncomingMessages(
+    MessageLoopForIO::IOContext* context, DWORD bytes_read, bool was_pending) {
+  chan_cap_.NoteOnIOThread();
+
+  DCHECK(!input_state_.is_pending);
+
+  if (was_pending) {
+    DCHECK(context);
+
+    if (!context || !bytes_read) return false;
+  } else {
+    // This happens at channel initialization.
+    DCHECK(!bytes_read && context == &input_state_.context);
+  }
+
+  for (;;) {
+    if (bytes_read == 0) {
+      if (INVALID_HANDLE_VALUE == pipe_) return false;
+
+      // Read from pipe...
+      BOOL ok = ReadFile(pipe_, input_buf_.get() + input_buf_offset_,
+                         Channel::kReadBufferSize - input_buf_offset_,
+                         &bytes_read, &input_state_.context.overlapped);
+      if (!ok) {
+        DWORD err = GetLastError();
+        if (err == ERROR_IO_PENDING) {
+          input_state_.is_pending = this;
+          return true;
+        }
+        if (err != ERROR_BROKEN_PIPE) {
+          CHROMIUM_LOG(ERROR) << "pipe error: " << err;
+        }
+        return false;
+      }
+      input_state_.is_pending = this;
+      return true;
+    }
+    DCHECK(bytes_read);
+
+    // Process messages from input buffer.
+
+    const char* p = input_buf_.get();
+    const char* end = input_buf_.get() + input_buf_offset_ + bytes_read;
+
+    // NOTE: We re-check `pipe_` after each message to make sure we weren't
+    // closed while calling `OnMessageReceived` or `OnChannelConnected`.
+    while (p < end && INVALID_HANDLE_VALUE != pipe_) {
+      // Try to figure out how big the message is. Size is 0 if we haven't read
+      // enough of the header to know the size.
+      uint32_t message_length = 0;
+      if (incoming_message_) {
+        message_length = incoming_message_->size();
+      } else {
+        message_length = Message::MessageSize(p, end);
+      }
+
+      if (!message_length) {
+        // We haven't seen the full message header.
+        MOZ_ASSERT(!incoming_message_);
+
+        // Move everything we have to the start of the buffer. We'll finish
+        // reading this message when we get more data. For now we leave it in
+        // input_buf_.
+        memmove(input_buf_.get(), p, end - p);
+        input_buf_offset_ = end - p;
+
+        break;
+      }
+
+      input_buf_offset_ = 0;
+
+      bool partial;
+      if (incoming_message_) {
+        // We already have some data for this message stored in
+        // incoming_message_. We want to append the new data there.
+        Message& m = *incoming_message_;
+
+        // How much data from this message remains to be added to
+        // incoming_message_?
+        MOZ_ASSERT(message_length > m.CurrentSize());
+        uint32_t remaining = message_length - m.CurrentSize();
+
+        // How much data from this message is stored in input_buf_?
+        uint32_t in_buf = std::min(remaining, uint32_t(end - p));
+
+        m.InputBytes(p, in_buf);
+        p += in_buf;
+
+        // Are we done reading this message?
+        partial = in_buf != remaining;
+      } else {
+        // How much data from this message is stored in input_buf_?
+        uint32_t in_buf = std::min(message_length, uint32_t(end - p));
+
+        incoming_message_ = mozilla::MakeUnique<Message>(p, in_buf);
+        p += in_buf;
+
+        // Are we done reading this message?
+        partial = in_buf != message_length;
+      }
+
+      if (partial) {
+        break;
+      }
+
+      Message& m = *incoming_message_;
+
+      // Note: We set other_pid_ below when we receive a Hello message (which
+      // has no routing ID), but we only emit a profiler marker for messages
+      // with a routing ID, so there's no conflict here.
+      AddIPCProfilerMarker(m, other_pid_, MessageDirection::eReceiving,
+                           MessagePhase::TransferEnd);
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+      DLOG(INFO) << "received message on channel @" << this << " with type "
+                 << m.type();
+#endif
+      if (m.routing_id() == MSG_ROUTING_NONE &&
+          m.type() == HELLO_MESSAGE_TYPE) {
+        // The Hello message contains the process id and must include the
+        // shared secret, if we are waiting for it.
+        MessageIterator it = MessageIterator(m);
+        int32_t other_pid = it.NextInt();
+        SetOtherPid(other_pid);
+        if (waiting_for_shared_secret_ && (it.NextInt() != shared_secret_)) {
+          NOTREACHED();
+          // Something went wrong. Abort connection.
+          // NOTE: Caller will `Close()` and notify `OnChannelError`.
+          return false;
+        }
+        waiting_for_shared_secret_ = false;
+
+        listener_->OnChannelConnected(other_pid);
+      } else {
+        mozilla::LogIPCMessage::Run run(&m);
+        if (!AcceptHandles(m)) {
+          return false;
+        }
+        listener_->OnMessageReceived(std::move(incoming_message_));
+      }
+
+      incoming_message_ = nullptr;
+    }
+
+    bytes_read = 0;  // Get more data.
+  }
+}
+
+bool Channel::ChannelImpl::ProcessOutgoingMessages(
+    MessageLoopForIO::IOContext* context, DWORD bytes_written,
+    bool was_pending) {
+  chan_cap_.NoteSendMutex();
+
+  DCHECK(!output_state_.is_pending);
+  DCHECK(!waiting_connect_);  // Why are we trying to send messages if there's
+                              // no connection?
+  if (was_pending) {
+    DCHECK(context);
+    if (!context || bytes_written == 0) {
+      DWORD err = GetLastError();
+      if (err != ERROR_BROKEN_PIPE) {
+        CHROMIUM_LOG(ERROR) << "pipe error: " << err;
+      }
+      return false;
+    }
+    // Message was sent.
+    DCHECK(!output_queue_.IsEmpty());
+    Message* m = output_queue_.FirstElement().get();
+
+    MOZ_RELEASE_ASSERT(partial_write_iter_.isSome());
+    Pickle::BufferList::IterImpl& iter = partial_write_iter_.ref();
+    iter.Advance(m->Buffers(), bytes_written);
+    if (iter.Done()) {
+      AddIPCProfilerMarker(*m, other_pid_, MessageDirection::eSending,
+                           MessagePhase::TransferEnd);
+
+      partial_write_iter_.reset();
+      OutputQueuePop();
+      // m has been destroyed, so clear the dangling reference.
+      m = nullptr;
+    }
+  }
+
+  if (output_queue_.IsEmpty()) return true;
+
+  if (INVALID_HANDLE_VALUE == pipe_) return false;
+
+  // Write to pipe...
+  Message* m = output_queue_.FirstElement().get();
+
+  if (partial_write_iter_.isNothing()) {
+    AddIPCProfilerMarker(*m, other_pid_, MessageDirection::eSending,
+                         MessagePhase::TransferStart);
+    if (!TransferHandles(*m)) {
+      return false;
+    }
+    Pickle::BufferList::IterImpl iter(m->Buffers());
+    partial_write_iter_.emplace(iter);
+  }
+
+  Pickle::BufferList::IterImpl& iter = partial_write_iter_.ref();
+
+  // Don't count this write for the purposes of late write checking. If this
+  // message results in a legitimate file write, that will show up when it
+  // happens.
+  mozilla::PushSuspendLateWriteChecks();
+  BOOL ok = WriteFile(pipe_, iter.Data(), iter.RemainingInSegment(),
+                      &bytes_written, &output_state_.context.overlapped);
+  mozilla::PopSuspendLateWriteChecks();
+
+  if (!ok) {
+    DWORD err = GetLastError();
+    if (err == ERROR_IO_PENDING) {
+      output_state_.is_pending = this;
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+      DLOG(INFO) << "sent pending message @" << m << " on channel @" << this
+                 << " with type " << m->type();
+#endif
+
+      return true;
+    }
+    if (err != ERROR_BROKEN_PIPE) {
+      CHROMIUM_LOG(ERROR) << "pipe error: " << err;
+    }
+    return false;
+  }
+
+#ifdef IPC_MESSAGE_DEBUG_EXTRA
+  DLOG(INFO) << "sent message @" << m << " on channel @" << this
+             << " with type " << m->type();
+#endif
+
+  output_state_.is_pending = this;
+  return true;
+}
+
+void Channel::ChannelImpl::OnIOCompleted(MessageLoopForIO::IOContext* context,
+                                         DWORD bytes_transfered, DWORD error) {
+  // NOTE: In case the pending reference was the last reference, release it
+  // outside of the lock.
+  RefPtr<ChannelImpl> was_pending;
+
+  IOThread().AssertOnCurrentThread();
+  chan_cap_.NoteOnIOThread();
+
+  bool ok;
+  if (context == &input_state_.context) {
+    was_pending = input_state_.is_pending.forget();
+    bool was_waiting_connect = waiting_connect_;
+    if (was_waiting_connect) {
+      mozilla::MutexAutoLock lock(SendMutex());
+      if (!ProcessConnection()) {
+        return;
+      }
+      // We may have some messages queued up to send...
+      if (!output_queue_.IsEmpty() && !output_state_.is_pending) {
+        ProcessOutgoingMessages(NULL, 0, false);
+      }
+      if (input_state_.is_pending) {
+        return;
+      }
+      // else, fall-through and look for incoming messages...
+    }
+    // we don't support recursion through OnMessageReceived yet!
+    DCHECK(!processing_incoming_);
+    processing_incoming_ = true;
+    ok = ProcessIncomingMessages(context, bytes_transfered,
+                                 was_pending && !was_waiting_connect);
+    processing_incoming_ = false;
+  } else {
+    mozilla::MutexAutoLock lock(SendMutex());
+    DCHECK(context == &output_state_.context);
+    was_pending = output_state_.is_pending.forget();
+    ok = ProcessOutgoingMessages(context, bytes_transfered, was_pending);
+  }
+  if (!ok && INVALID_HANDLE_VALUE != pipe_) {
+    // We don't want to re-enter Close().
+    Close();
+    listener_->OnChannelError();
+  }
+}
+
+void Channel::ChannelImpl::StartAcceptingHandles(Mode mode) {
+  IOThread().AssertOnCurrentThread();
+  mozilla::MutexAutoLock lock(SendMutex());
+  chan_cap_.NoteExclusiveAccess();
+
+  if (accept_handles_) {
+    MOZ_ASSERT(privileged_ == (mode == MODE_SERVER));
+    return;
+  }
+  accept_handles_ = true;
+  privileged_ = mode == MODE_SERVER;
+
+  if (privileged_ && other_pid_ != -1 &&
+      other_process_ == INVALID_HANDLE_VALUE) {
+    other_process_ = OpenProcess(PROCESS_DUP_HANDLE, false, other_pid_);
+    if (!other_process_) {
+      other_process_ = INVALID_HANDLE_VALUE;
+      CHROMIUM_LOG(ERROR) << "Failed to acquire privileged handle to "
+                          << other_pid_ << ", cannot accept handles";
+    }
+  }
+}
+
+static uint32_t HandleToUint32(HANDLE h) {
+  // Cast through uintptr_t and then unsigned int to make the truncation to
+  // 32 bits explicit. Handles are size of-pointer but are always 32-bit values.
+  // https://docs.microsoft.com/en-ca/windows/win32/winprog64/interprocess-communication
+  // says: 64-bit versions of Windows use 32-bit handles for interoperability.
+  return static_cast<uint32_t>(reinterpret_cast<uintptr_t>(h));
+}
+
+static HANDLE Uint32ToHandle(uint32_t h) {
+  return reinterpret_cast<HANDLE>(
+      static_cast<uintptr_t>(static_cast<int32_t>(h)));
+}
+
+bool Channel::ChannelImpl::AcceptHandles(Message& msg) {
+  chan_cap_.NoteOnIOThread();
+
+  MOZ_ASSERT(msg.num_handles() == 0);
+
+  uint32_t num_handles = msg.header()->num_handles;
+  if (num_handles == 0) {
+    return true;
+  }
+
+  if (!accept_handles_) {
+    CHROMIUM_LOG(ERROR) << "invalid message: " << msg.name()
+                        << ". channel is not configured to accept handles";
+    return false;
+  }
+
+  // Read in the payload from the footer, truncating the message.
+  nsTArray<uint32_t> payload;
+  payload.AppendElements(num_handles);
+  if (!msg.ReadFooter(payload.Elements(), num_handles * sizeof(uint32_t),
+                      /* truncate */ true)) {
+    CHROMIUM_LOG(ERROR) << "failed to read handle payload from message";
+    return false;
+  }
+  msg.header()->num_handles = 0;
+
+  // Read in the handles themselves, transferring ownership as required.
+  nsTArray<mozilla::UniqueFileHandle> handles(num_handles);
+  for (uint32_t handleValue : payload) {
+    HANDLE handle = Uint32ToHandle(handleValue);
+
+    // If we're the privileged process, the remote process will have leaked
+    // the sent handles in its local address space, and be relying on us to
+    // duplicate them, otherwise the remote privileged side will have
+    // transferred the handles to us already.
+    if (privileged_) {
+      if (other_process_ == INVALID_HANDLE_VALUE) {
+        CHROMIUM_LOG(ERROR) << "other_process_ is invalid in AcceptHandles";
+        return false;
+      }
+      if (!::DuplicateHandle(other_process_, handle, GetCurrentProcess(),
+                             &handle, 0, FALSE,
+                             DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE)) {
+        CHROMIUM_LOG(ERROR) << "DuplicateHandle failed for handle " << handle
+                            << " in AcceptHandles";
+        return false;
+      }
+    }
+
+    // The handle is directly owned by this process now, and can be added to
+    // our `handles` array.
+    handles.AppendElement(mozilla::UniqueFileHandle(handle));
+  }
+
+  // We're done with the handle footer, truncate the message at that point.
+  msg.SetAttachedFileHandles(std::move(handles));
+  MOZ_ASSERT(msg.num_handles() == num_handles);
+  return true;
+}
+
+bool Channel::ChannelImpl::TransferHandles(Message& msg) {
+  chan_cap_.NoteSendMutex();
+
+  MOZ_ASSERT(msg.header()->num_handles == 0);
+
+  uint32_t num_handles = msg.num_handles();
+  if (num_handles == 0) {
+    return true;
+  }
+
+  if (!accept_handles_) {
+    CHROMIUM_LOG(ERROR) << "cannot send message: " << msg.name()
+                        << ". channel is not configured to accept handles";
+    return false;
+  }
+
+#ifdef DEBUG
+  uint32_t handles_offset = msg.header()->payload_size;
+#endif
+
+  nsTArray<uint32_t> payload(num_handles);
+  for (uint32_t i = 0; i < num_handles; ++i) {
+    // Release ownership of the handle. It'll be cloned when the parent process
+    // transfers it with DuplicateHandle either in this process or the remote
+    // process.
+    HANDLE handle = msg.attached_handles_[i].release();
+
+    // If we're the privileged process, transfer the HANDLE to our remote before
+    // sending the message. Otherwise, the remote privileged process will
+    // transfer the handle for us, so leak it.
+    if (privileged_) {
+      if (other_process_ == INVALID_HANDLE_VALUE) {
+        CHROMIUM_LOG(ERROR) << "other_process_ is invalid in TransferHandles";
+        return false;
+      }
+      if (!::DuplicateHandle(GetCurrentProcess(), handle, other_process_,
+                             &handle, 0, FALSE,
+                             DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE)) {
+        CHROMIUM_LOG(ERROR) << "DuplicateHandle failed for handle " << handle
+                            << " in TransferHandles";
+        return false;
+      }
+    }
+
+    payload.AppendElement(HandleToUint32(handle));
+  }
+  msg.attached_handles_.Clear();
+
+  msg.WriteFooter(payload.Elements(), payload.Length() * sizeof(uint32_t));
+  msg.header()->num_handles = num_handles;
+
+  MOZ_ASSERT(msg.header()->payload_size ==
+                 handles_offset + (sizeof(uint32_t) * num_handles),
+             "Unexpected number of bytes written for handles footer?");
+  return true;
+}
+
+//------------------------------------------------------------------------------
+// Channel's methods simply call through to ChannelImpl.
+Channel::Channel(const ChannelId& channel_id, Mode mode, Listener* listener)
+    : channel_impl_(new ChannelImpl(channel_id, mode, listener)) {
+  MOZ_COUNT_CTOR(IPC::Channel);
+}
+
+Channel::Channel(ChannelHandle pipe, Mode mode, Listener* listener)
+    : channel_impl_(new ChannelImpl(std::move(pipe), mode, listener)) {
+  MOZ_COUNT_CTOR(IPC::Channel);
+}
+
+Channel::~Channel() { MOZ_COUNT_DTOR(IPC::Channel); }
+
+bool Channel::Connect() { return channel_impl_->Connect(); }
+
+void Channel::Close() { channel_impl_->Close(); }
+
+void Channel::StartAcceptingHandles(Mode mode) {
+  channel_impl_->StartAcceptingHandles(mode);
+}
+
+Channel::Listener* Channel::set_listener(Listener* listener) {
+  return channel_impl_->set_listener(listener);
+}
+
+bool Channel::Send(mozilla::UniquePtr<Message> message) {
+  return channel_impl_->Send(std::move(message));
+}
+
+int32_t Channel::OtherPid() const { return channel_impl_->OtherPid(); }
+
+bool Channel::IsClosed() const { return channel_impl_->IsClosed(); }
+
+namespace {
+
+// Global atomic used to guarantee channel IDs are unique.
+mozilla::Atomic<int> g_last_id;
+
+}  // namespace
+
+// static
+Channel::ChannelId Channel::GenerateVerifiedChannelID() {
+  // Windows pipes can be enumerated by low-privileged processes. So, we
+  // append a strong random value after the \ character. This value is not
+  // included in the pipe name, but sent as part of the client hello, to
+  // prevent hijacking the pipe name to spoof the client.
+  int secret;
+  do {  // Guarantee we get a non-zero value.
+    secret = base::RandInt(0, std::numeric_limits<int>::max());
+  } while (secret == 0);
+  return StringPrintf(L"%d.%u.%d\\%d", base::GetCurrentProcId(), g_last_id++,
+                      base::RandInt(0, std::numeric_limits<int32_t>::max()),
+                      secret);
+}
+
+// static
+Channel::ChannelId Channel::ChannelIDForCurrentProcess() {
+  return CommandLine::ForCurrentProcess()->GetSwitchValue(
+      switches::kProcessChannelID);
+}
+
+// static
+bool Channel::CreateRawPipe(ChannelHandle* server, ChannelHandle* client) {
+  std::wstring pipe_name =
+      StringPrintf(L"\\\\.\\pipe\\gecko.%lu.%lu.%I64u", ::GetCurrentProcessId(),
+                   ::GetCurrentThreadId(), mozilla::RandomUint64OrDie());
+  const DWORD kOpenMode =
+      PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED | FILE_FLAG_FIRST_PIPE_INSTANCE;
+  const DWORD kPipeMode = PIPE_TYPE_BYTE | PIPE_READMODE_BYTE;
+  *server = mozilla::UniqueFileHandle(
+      ::CreateNamedPipeW(pipe_name.c_str(), kOpenMode, kPipeMode,
+                         1,                         // Max instances.
+                         Channel::kReadBufferSize,  // Output buffer size.
+                         Channel::kReadBufferSize,  // Input buffer size.
+                         5000,                      // Timeout in ms.
+                         nullptr));  // Default security descriptor.
+  if (!server) {
+    NS_WARNING(
+        nsPrintfCString("CreateNamedPipeW Failed %lu", ::GetLastError()).get());
+    return false;
+  }
+
+  const DWORD kDesiredAccess = GENERIC_READ | GENERIC_WRITE;
+  // The SECURITY_ANONYMOUS flag means that the server side cannot impersonate
+  // the client, which is useful as both server & client may be unprivileged.
+  const DWORD kFlags =
+      SECURITY_SQOS_PRESENT | SECURITY_ANONYMOUS | FILE_FLAG_OVERLAPPED;
+  *client = mozilla::UniqueFileHandle(
+      ::CreateFileW(pipe_name.c_str(), kDesiredAccess, 0, nullptr,
+                    OPEN_EXISTING, kFlags, nullptr));
+  if (!client) {
+    NS_WARNING(
+        nsPrintfCString("CreateFileW Failed %lu", ::GetLastError()).get());
+    return false;
+  }
+
+  // Since a client has connected, ConnectNamedPipe() should return zero and
+  // GetLastError() should return ERROR_PIPE_CONNECTED.
+  if (::ConnectNamedPipe(server->get(), nullptr) ||
+      ::GetLastError() != ERROR_PIPE_CONNECTED) {
+    NS_WARNING(
+        nsPrintfCString("ConnectNamedPipe Failed %lu", ::GetLastError()).get());
+    return false;
+  }
+  return true;
+}
+
+}  // namespace IPC
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_win.h b/ipc/chromium/src/chrome/common/ipc_channel_win.h
new file mode 100644
index 0000000000..5c141ebe34
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.h
@@ -0,0 +1,202 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_IPC_CHANNEL_WIN_H_
+#define CHROME_COMMON_IPC_CHANNEL_WIN_H_
+
+#include "chrome/common/ipc_channel.h"
+#include "chrome/common/ipc_channel_capability.h"
+#include "chrome/common/ipc_message.h"
+
+#include <atomic>
+#include <string>
+
+#include "base/message_loop.h"
+#include "base/task.h"
+#include "nsISupportsImpl.h"
+
+#include "mozilla/EventTargetCapability.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/Queue.h"
+#include "mozilla/UniquePtr.h"
+
+namespace IPC {
+
+class Channel::ChannelImpl : public MessageLoopForIO::IOHandler {
+ public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DELETE_ON_EVENT_TARGET(
+      ChannelImpl, IOThread().GetEventTarget());
+
+  using ChannelId = Channel::ChannelId;
+  using ChannelHandle = Channel::ChannelHandle;
+
+  // Mirror methods of Channel, see ipc_channel.h for description.
+  ChannelImpl(const ChannelId& channel_id, Mode mode, Listener* listener);
+  ChannelImpl(ChannelHandle pipe, Mode mode, Listener* listener);
+  bool Connect() MOZ_EXCLUDES(SendMutex());
+  void Close() MOZ_EXCLUDES(SendMutex());
+  void StartAcceptingHandles(Mode mode) MOZ_EXCLUDES(SendMutex());
+  Listener* set_listener(Listener* listener) {
+    IOThread().AssertOnCurrentThread();
+    chan_cap_.NoteOnIOThread();
+    Listener* old = listener_;
+    listener_ = listener;
+    return old;
+  }
+  // NOTE: `Send` may be called on threads other than the I/O thread.
+  bool Send(mozilla::UniquePtr<Message> message) MOZ_EXCLUDES(SendMutex());
+
+  int32_t OtherPid() {
+    IOThread().AssertOnCurrentThread();
+    chan_cap_.NoteOnIOThread();
+    return other_pid_;
+  }
+
+  // See the comment in ipc_channel.h for info on IsClosed()
+  // NOTE: `IsClosed` may be called on threads other than the I/O thread.
+  bool IsClosed() MOZ_EXCLUDES(SendMutex()) {
+    mozilla::MutexAutoLock lock(SendMutex());
+    chan_cap_.NoteSendMutex();
+    return pipe_ == INVALID_HANDLE_VALUE;
+  }
+
+ private:
+  ~ChannelImpl() {
+    IOThread().AssertOnCurrentThread();
+    if (pipe_ != INVALID_HANDLE_VALUE ||
+        other_process_ != INVALID_HANDLE_VALUE) {
+      Close();
+    }
+  }
+
+  void Init(Mode mode, Listener* listener)
+      MOZ_REQUIRES(SendMutex(), IOThread());
+
+  void OutputQueuePush(mozilla::UniquePtr<Message> msg)
+      MOZ_REQUIRES(SendMutex());
+  void OutputQueuePop() MOZ_REQUIRES(SendMutex());
+
+  const ChannelId PipeName(const ChannelId& channel_id, int32_t* secret) const;
+  bool CreatePipe(const ChannelId& channel_id, Mode mode)
+      MOZ_REQUIRES(SendMutex(), IOThread());
+  void SetOtherPid(int other_pid) MOZ_REQUIRES(IOThread())
+      MOZ_EXCLUDES(SendMutex());
+  bool EnqueueHelloMessage() MOZ_REQUIRES(SendMutex(), IOThread());
+  void CloseLocked() MOZ_REQUIRES(SendMutex(), IOThread());
+
+  bool ProcessConnection() MOZ_REQUIRES(SendMutex(), IOThread());
+  bool ProcessIncomingMessages(MessageLoopForIO::IOContext* context,
+                               DWORD bytes_read, bool was_pending)
+      MOZ_REQUIRES(IOThread());
+  bool ProcessOutgoingMessages(MessageLoopForIO::IOContext* context,
+                               DWORD bytes_written, bool was_pending)
+      MOZ_REQUIRES(SendMutex());
+
+  // Called on a Message immediately before it is sent/recieved to transfer
+  // handles to the remote process, or accept handles from the remote process.
+  bool AcceptHandles(Message& msg) MOZ_REQUIRES(IOThread());
+  bool TransferHandles(Message& msg) MOZ_REQUIRES(SendMutex());
+
+  // MessageLoop::IOHandler implementation.
+  virtual void OnIOCompleted(MessageLoopForIO::IOContext* context,
+                             DWORD bytes_transfered, DWORD error);
+
+  const ChannelCapability::Thread& IOThread() const
+      MOZ_RETURN_CAPABILITY(chan_cap_.IOThread()) {
+    return chan_cap_.IOThread();
+  }
+
+  ChannelCapability::Mutex& SendMutex()
+      MOZ_RETURN_CAPABILITY(chan_cap_.SendMutex()) {
+    return chan_cap_.SendMutex();
+  }
+
+ private:
+  // Compound capability of a Mutex and the IO thread.
+  ChannelCapability chan_cap_;
+
+  Mode mode_ MOZ_GUARDED_BY(IOThread());
+
+  struct State {
+    explicit State(ChannelImpl* channel);
+    ~State();
+    MessageLoopForIO::IOContext context;
+    // When there is pending I/O, this holds a strong reference to the
+    // ChannelImpl to prevent it from going away.
+    RefPtr<ChannelImpl> is_pending;
+  };
+
+  State input_state_ MOZ_GUARDED_BY(IOThread());
+  State output_state_ MOZ_GUARDED_BY(SendMutex());
+
+  HANDLE pipe_ MOZ_GUARDED_BY(chan_cap_) = INVALID_HANDLE_VALUE;
+
+  Listener* listener_ MOZ_GUARDED_BY(IOThread()) = nullptr;
+
+  // Messages to be sent are queued here.
+  mozilla::Queue<mozilla::UniquePtr<Message>, 64> output_queue_
+      MOZ_GUARDED_BY(SendMutex());
+
+  // If sending a message blocks then we use this iterator to keep track of
+  // where in the message we are. It gets reset when the message is finished
+  // sending.
+  mozilla::Maybe<Pickle::BufferList::IterImpl> partial_write_iter_
+      MOZ_GUARDED_BY(SendMutex());
+
+  // We read from the pipe into this buffer
+  mozilla::UniquePtr<char[]> input_buf_ MOZ_GUARDED_BY(IOThread());
+  size_t input_buf_offset_ MOZ_GUARDED_BY(IOThread()) = 0;
+
+  // Large incoming messages that span multiple pipe buffers get built-up in the
+  // buffers of this message.
+  mozilla::UniquePtr<Message> incoming_message_ MOZ_GUARDED_BY(IOThread());
+
+  // Timer started when a MODE_SERVER channel begins waiting for a connection,
+  // and cancelled when the connection completes. Will produce an error if no
+  // connection occurs before the timeout.
+  nsCOMPtr<nsITimer> connect_timeout_ MOZ_GUARDED_BY(IOThread());
+
+  // Will be set to `true` until `Connect()` has been called, and, if in
+  // server-mode, the client has connected. The `input_state_` is used to wait
+  // for the client to connect in overlapped mode.
+  bool waiting_connect_ MOZ_GUARDED_BY(chan_cap_) = true;
+
+  // This flag is set when processing incoming messages.  It is used to
+  // avoid recursing through ProcessIncomingMessages, which could cause
+  // problems.  TODO(darin): make this unnecessary
+  bool processing_incoming_ MOZ_GUARDED_BY(IOThread()) = false;
+
+  // We keep track of the PID of the other side of this channel so that we can
+  // record this when generating logs of IPC messages.
+  int32_t other_pid_ MOZ_GUARDED_BY(chan_cap_) = -1;
+
+  // This is a unique per-channel value used to authenticate the client end of
+  // a connection. If the value is non-zero, the client passes it in the hello
+  // and the host validates. (We don't send the zero value to preserve IPC
+  // compatibility with existing clients that don't validate the channel.)
+  int32_t shared_secret_ MOZ_GUARDED_BY(IOThread()) = 0;
+
+  // In server-mode, we wait for the channel at the other side of the pipe to
+  // send us back our shared secret, if we are using one.
+  bool waiting_for_shared_secret_ MOZ_GUARDED_BY(IOThread()) = false;
+
+  // Whether or not to accept handles from a remote process, and whether this
+  // process is the privileged side of a IPC::Channel which can transfer
+  // handles.
+  bool accept_handles_ MOZ_GUARDED_BY(chan_cap_) = false;
+  bool privileged_ MOZ_GUARDED_BY(chan_cap_) = false;
+
+  // A privileged process handle used to transfer HANDLEs to and from the remote
+  // process. This will only be used if `privileged_` is set.
+  HANDLE other_process_ MOZ_GUARDED_BY(chan_cap_) = INVALID_HANDLE_VALUE;
+
+  DISALLOW_COPY_AND_ASSIGN(ChannelImpl);
+};
+
+}  // namespace IPC
+
+#endif  // CHROME_COMMON_IPC_CHANNEL_WIN_H_
diff --git a/ipc/chromium/src/chrome/common/ipc_message.cc b/ipc/chromium/src/chrome/common/ipc_message.cc
new file mode 100644
index 0000000000..5343c67fc0
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_message.cc
@@ -0,0 +1,218 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/ipc_message.h"
+
+#include "base/logging.h"
+#include "build/build_config.h"
+#include "mojo/core/ports/event.h"
+
+#include <utility>
+
+#include "nsISupportsImpl.h"
+
+namespace IPC {
+
+//------------------------------------------------------------------------------
+
+const mojo::core::ports::UserMessage::TypeInfo Message::kUserMessageTypeInfo{};
+
+Message::~Message() { MOZ_COUNT_DTOR(IPC::Message); }
+
+Message::Message(int32_t routing_id, msgid_t type, uint32_t segment_capacity,
+                 HeaderFlags flags)
+    : UserMessage(&kUserMessageTypeInfo),
+      Pickle(sizeof(Header), segment_capacity) {
+  MOZ_COUNT_CTOR(IPC::Message);
+  header()->routing = routing_id;
+  header()->type = type;
+  header()->flags = flags;
+  header()->num_handles = 0;
+  header()->txid = -1;
+  header()->seqno = 0;
+#if defined(OS_MACOSX)
+  header()->cookie = 0;
+  header()->num_send_rights = 0;
+#endif
+  header()->event_footer_size = 0;
+}
+
+Message::Message(const char* data, int data_len)
+    : UserMessage(&kUserMessageTypeInfo),
+      Pickle(sizeof(Header), data, data_len) {
+  MOZ_COUNT_CTOR(IPC::Message);
+}
+
+/*static*/ mozilla::UniquePtr<Message> Message::IPDLMessage(
+    int32_t routing_id, msgid_t type, uint32_t segment_capacity,
+    HeaderFlags flags) {
+  return mozilla::MakeUnique<Message>(routing_id, type, segment_capacity,
+                                      flags);
+}
+
+/*static*/ mozilla::UniquePtr<Message> Message::ForSyncDispatchError(
+    NestedLevel level) {
+  auto m = mozilla::MakeUnique<Message>(0, 0, 0, HeaderFlags(level));
+  auto& flags = m->header()->flags;
+  flags.SetSync();
+  flags.SetReply();
+  flags.SetReplyError();
+  return m;
+}
+
+void Message::WriteFooter(const void* data, uint32_t data_len) {
+  if (data_len == 0) {
+    return;
+  }
+
+  WriteBytes(data, data_len);
+}
+
+bool Message::ReadFooter(void* buffer, uint32_t buffer_len, bool truncate) {
+  if (buffer_len == 0) {
+    return true;
+  }
+
+  if (NS_WARN_IF(AlignInt(header()->payload_size) != header()->payload_size) ||
+      NS_WARN_IF(AlignInt(buffer_len) > header()->payload_size)) {
+    return false;
+  }
+
+  // Seek to the start of the footer, and read it in. We read in with a
+  // duplicate of the iterator so we can use it to truncate later.
+  uint32_t offset = header()->payload_size - AlignInt(buffer_len);
+  PickleIterator footer_iter(*this);
+  if (NS_WARN_IF(!IgnoreBytes(&footer_iter, offset))) {
+    return false;
+  }
+
+  PickleIterator read_iter(footer_iter);
+  bool ok = ReadBytesInto(&read_iter, buffer, buffer_len);
+
+  // If requested, truncate the buffer to the start of the footer.
+  if (truncate) {
+    Truncate(&footer_iter);
+  }
+  return ok;
+}
+
+bool Message::WriteFileHandle(mozilla::UniqueFileHandle handle) {
+  uint32_t handle_index = attached_handles_.Length();
+  WriteUInt32(handle_index);
+  if (handle_index == MAX_DESCRIPTORS_PER_MESSAGE) {
+    return false;
+  }
+  attached_handles_.AppendElement(std::move(handle));
+  return true;
+}
+
+bool Message::ConsumeFileHandle(PickleIterator* iter,
+                                mozilla::UniqueFileHandle* handle) const {
+  uint32_t handle_index;
+  if (!ReadUInt32(iter, &handle_index)) {
+    return false;
+  }
+  if (handle_index >= attached_handles_.Length()) {
+    return false;
+  }
+  // NOTE: This mutates the underlying array, replacing the handle with an
+  // invalid handle.
+  *handle = std::exchange(attached_handles_[handle_index], nullptr);
+  return true;
+}
+
+void Message::SetAttachedFileHandles(
+    nsTArray<mozilla::UniqueFileHandle> handles) {
+  MOZ_DIAGNOSTIC_ASSERT(attached_handles_.IsEmpty());
+  attached_handles_ = std::move(handles);
+}
+
+uint32_t Message::num_handles() const { return attached_handles_.Length(); }
+
+void Message::WritePort(mozilla::ipc::ScopedPort port) {
+  uint32_t port_index = attached_ports_.Length();
+  WriteUInt32(port_index);
+  attached_ports_.AppendElement(std::move(port));
+}
+
+bool Message::ConsumePort(PickleIterator* iter,
+                          mozilla::ipc::ScopedPort* port) const {
+  uint32_t port_index;
+  if (!ReadUInt32(iter, &port_index)) {
+    return false;
+  }
+  if (port_index >= attached_ports_.Length()) {
+    return false;
+  }
+  // NOTE: This mutates the underlying array, replacing the port with a consumed
+  // port.
+  *port = std::exchange(attached_ports_[port_index], {});
+  return true;
+}
+
+void Message::SetAttachedPorts(nsTArray<mozilla::ipc::ScopedPort> ports) {
+  MOZ_DIAGNOSTIC_ASSERT(attached_ports_.IsEmpty());
+  attached_ports_ = std::move(ports);
+}
+
+#if defined(OS_MACOSX)
+bool Message::WriteMachSendRight(mozilla::UniqueMachSendRight port) {
+  uint32_t index = attached_send_rights_.Length();
+  WriteUInt32(index);
+  if (index == MAX_DESCRIPTORS_PER_MESSAGE) {
+    return false;
+  }
+  attached_send_rights_.AppendElement(std::move(port));
+  return true;
+}
+
+bool Message::ConsumeMachSendRight(PickleIterator* iter,
+                                   mozilla::UniqueMachSendRight* port) const {
+  uint32_t index;
+  if (!ReadUInt32(iter, &index)) {
+    return false;
+  }
+  if (index >= attached_send_rights_.Length()) {
+    return false;
+  }
+  // NOTE: This mutates the underlying array, replacing the send right with a
+  // null right.
+  *port = std::exchange(attached_send_rights_[index], nullptr);
+  return true;
+}
+
+uint32_t Message::num_send_rights() const {
+  return attached_send_rights_.Length();
+}
+#endif
+
+bool Message::WillBeRoutedExternally(
+    mojo::core::ports::UserMessageEvent& event) {
+  if (!attached_ports_.IsEmpty()) {
+    // Explicitly attach any ports which were attached to this Message to this
+    // UserMessageEvent before we route it externally so that they can be
+    // transferred correctly. These ports will be recovered if needed in
+    // `GetMessage`.
+    MOZ_DIAGNOSTIC_ASSERT(
+        event.num_ports() == 0,
+        "Must not have previously attached ports to the UserMessageEvent");
+    event.ReservePorts(attached_ports_.Length());
+    for (size_t i = 0; i < event.num_ports(); ++i) {
+      event.ports()[i] = attached_ports_[i].Release().name();
+    }
+    attached_ports_.Clear();
+  }
+  return true;
+}
+
+void Message::AssertAsLargeAsHeader() const {
+  MOZ_DIAGNOSTIC_ASSERT(size() >= sizeof(Header));
+  MOZ_DIAGNOSTIC_ASSERT(CurrentSize() >= sizeof(Header));
+  // Our buffers should agree with what our header specifies.
+  MOZ_DIAGNOSTIC_ASSERT(size() == CurrentSize());
+}
+
+}  // namespace IPC
diff --git a/ipc/chromium/src/chrome/common/ipc_message.h b/ipc/chromium/src/chrome/common/ipc_message.h
new file mode 100644
index 0000000000..15188c8280
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_message.h
@@ -0,0 +1,424 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_IPC_MESSAGE_H__
+#define CHROME_COMMON_IPC_MESSAGE_H__
+
+#include <string>
+
+#include "base/basictypes.h"
+#include "base/pickle.h"
+#include "mojo/core/ports/user_message.h"
+#include "mojo/core/ports/port_ref.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtrExtensions.h"
+#include "mozilla/ipc/ScopedPort.h"
+#include "nsTArray.h"
+
+namespace mozilla {
+
+#ifdef FUZZING_SNAPSHOT
+namespace fuzzing {
+class IPCFuzzController;
+}
+#endif
+
+namespace ipc {
+class MiniTransceiver;
+}
+}  // namespace mozilla
+
+namespace IPC {
+
+//------------------------------------------------------------------------------
+
+// Generated by IPDL compiler
+const char* StringFromIPCMessageType(uint32_t aMessageType);
+
+class Channel;
+class Message;
+class MessageReader;
+class MessageWriter;
+struct LogData;
+
+class Message : public mojo::core::ports::UserMessage, public Pickle {
+ public:
+  static const TypeInfo kUserMessageTypeInfo;
+
+  typedef uint32_t msgid_t;
+
+  enum NestedLevel {
+    NOT_NESTED = 1,
+    NESTED_INSIDE_SYNC = 2,
+    NESTED_INSIDE_CPOW = 3
+  };
+
+  enum PriorityValue {
+    NORMAL_PRIORITY = 0,
+    INPUT_PRIORITY = 1,
+    VSYNC_PRIORITY = 2,
+    MEDIUMHIGH_PRIORITY = 3,
+    CONTROL_PRIORITY = 4,
+  };
+
+  enum MessageCompression {
+    COMPRESSION_NONE,
+    COMPRESSION_ENABLED,
+    COMPRESSION_ALL
+  };
+
+  enum Sync {
+    SYNC = 0,
+    ASYNC = 1,
+  };
+
+  enum Constructor {
+    NOT_CONSTRUCTOR = 0,
+    CONSTRUCTOR = 1,
+  };
+
+  enum Reply {
+    NOT_REPLY = 0,
+    REPLY = 1,
+  };
+
+  enum LazySend {
+    EAGER_SEND = 0,
+    LAZY_SEND = 1,
+  };
+
+  // The hard limit of handles or file descriptors allowed in a single message.
+  static constexpr size_t MAX_DESCRIPTORS_PER_MESSAGE = 32767;
+
+  class HeaderFlags {
+    friend class Message;
+#ifdef FUZZING_SNAPSHOT
+    // IPCFuzzController calls various private API functions on the header.
+    friend class mozilla::fuzzing::IPCFuzzController;
+#endif
+
+    enum {
+      NESTED_MASK = 0x0003,
+      PRIO_MASK = 0x001C,
+      SYNC_BIT = 0x0020,
+      REPLY_BIT = 0x0040,
+      REPLY_ERROR_BIT = 0x0080,
+      LAZY_SEND_BIT = 0x0100,
+      COMPRESS_BIT = 0x0200,
+      COMPRESSALL_BIT = 0x0400,
+      CONSTRUCTOR_BIT = 0x0800,
+      RELAY_BIT = 0x1000,
+    };
+
+   public:
+    constexpr HeaderFlags() : mFlags(NOT_NESTED) {}
+
+    explicit constexpr HeaderFlags(NestedLevel level) : mFlags(level) {}
+
+    constexpr HeaderFlags(NestedLevel level, PriorityValue priority,
+                          MessageCompression compression, LazySend lazy_send,
+                          Constructor constructor, Sync sync, Reply reply)
+        : mFlags(level | (priority << 2) |
+                 (compression == COMPRESSION_ENABLED ? COMPRESS_BIT
+                  : compression == COMPRESSION_ALL   ? COMPRESSALL_BIT
+                                                     : 0) |
+                 (lazy_send == LAZY_SEND ? LAZY_SEND_BIT : 0) |
+                 (constructor == CONSTRUCTOR ? CONSTRUCTOR_BIT : 0) |
+                 (sync == SYNC ? SYNC_BIT : 0) |
+                 (reply == REPLY ? REPLY_BIT : 0)) {}
+
+    NestedLevel Level() const {
+      return static_cast<NestedLevel>(mFlags & NESTED_MASK);
+    }
+
+    PriorityValue Priority() const {
+      return static_cast<PriorityValue>((mFlags & PRIO_MASK) >> 2);
+    }
+
+    MessageCompression Compression() const {
+      return ((mFlags & COMPRESS_BIT)      ? COMPRESSION_ENABLED
+              : (mFlags & COMPRESSALL_BIT) ? COMPRESSION_ALL
+                                           : COMPRESSION_NONE);
+    }
+
+    bool IsLazySend() const { return (mFlags & LAZY_SEND_BIT) != 0; }
+
+    bool IsConstructor() const { return (mFlags & CONSTRUCTOR_BIT) != 0; }
+    bool IsSync() const { return (mFlags & SYNC_BIT) != 0; }
+    bool IsReply() const { return (mFlags & REPLY_BIT) != 0; }
+
+    bool IsReplyError() const { return (mFlags & REPLY_ERROR_BIT) != 0; }
+    bool IsRelay() const { return (mFlags & RELAY_BIT) != 0; }
+
+   private:
+    void SetConstructor() { mFlags |= CONSTRUCTOR_BIT; }
+    void SetSync() { mFlags |= SYNC_BIT; }
+    void SetReply() { mFlags |= REPLY_BIT; }
+    void SetReplyError() { mFlags |= REPLY_ERROR_BIT; }
+    void SetRelay(bool relay) {
+      if (relay) {
+        mFlags |= RELAY_BIT;
+      } else {
+        mFlags &= ~RELAY_BIT;
+      }
+    }
+
+    uint32_t mFlags;
+  };
+
+  virtual ~Message();
+
+  // Initialize a message with a user-defined type, priority value, and
+  // destination WebView ID.
+  Message(int32_t routing_id, msgid_t type,
+          uint32_t segmentCapacity = 0,  // 0 for the default capacity.
+          HeaderFlags flags = HeaderFlags());
+
+  Message(const char* data, int data_len);
+
+  Message(const Message&) = delete;
+  Message(Message&&) = delete;
+  Message& operator=(const Message&) = delete;
+  Message& operator=(Message&&) = delete;
+
+  // Helper method for the common case (default segmentCapacity, recording
+  // the write latency of messages) of IPDL message creation.  This helps
+  // move the malloc and some of the parameter setting out of autogenerated
+  // code.
+  static mozilla::UniquePtr<Message> IPDLMessage(int32_t routing_id,
+                                                 msgid_t type,
+                                                 uint32_t segmentCapacity,
+                                                 HeaderFlags flags);
+
+  // One-off constructors for special error-handling messages.
+  static mozilla::UniquePtr<Message> ForSyncDispatchError(NestedLevel level);
+
+  NestedLevel nested_level() const { return header()->flags.Level(); }
+
+  PriorityValue priority() const { return header()->flags.Priority(); }
+
+  bool is_constructor() const { return header()->flags.IsConstructor(); }
+
+  // True if this is a synchronous message.
+  bool is_sync() const { return header()->flags.IsSync(); }
+
+  MessageCompression compress_type() const {
+    return header()->flags.Compression();
+  }
+
+  bool is_lazy_send() const { return header()->flags.IsLazySend(); }
+
+  bool is_reply() const { return header()->flags.IsReply(); }
+
+  bool is_reply_error() const { return header()->flags.IsReplyError(); }
+
+  msgid_t type() const { return header()->type; }
+
+  int32_t routing_id() const { return header()->routing; }
+
+  void set_routing_id(int32_t new_id) { header()->routing = new_id; }
+
+  int32_t transaction_id() const { return header()->txid; }
+
+  void set_transaction_id(int32_t txid) { header()->txid = txid; }
+
+  int32_t seqno() const { return header()->seqno; }
+
+  void set_seqno(int32_t aSeqno) { header()->seqno = aSeqno; }
+
+  const char* name() const { return StringFromIPCMessageType(type()); }
+
+  uint32_t num_handles() const;
+
+  bool is_relay() const { return header()->flags.IsRelay(); }
+  void set_relay(bool new_relay) { header()->flags.SetRelay(new_relay); }
+
+  template <class T>
+  static bool Dispatch(const Message* msg, T* obj, void (T::*func)()) {
+    (obj->*func)();
+    return true;
+  }
+
+  template <class T>
+  static bool Dispatch(const Message* msg, T* obj, void (T::*func)() const) {
+    (obj->*func)();
+    return true;
+  }
+
+  template <class T>
+  static bool Dispatch(const Message* msg, T* obj,
+                       void (T::*func)(const Message&)) {
+    (obj->*func)(*msg);
+    return true;
+  }
+
+  template <class T>
+  static bool Dispatch(const Message* msg, T* obj,
+                       void (T::*func)(const Message&) const) {
+    (obj->*func)(*msg);
+    return true;
+  }
+
+  // We should not be sending messages that are smaller than our header size.
+  void AssertAsLargeAsHeader() const;
+
+  // UserMessage implementation
+  size_t GetSizeIfSerialized() const override { return size(); }
+  bool WillBeRoutedExternally(mojo::core::ports::UserMessageEvent&) override;
+
+  // Write the given footer bytes to the end of the current message. The
+  // footer's `data_len` will be padded to a multiple of 4 bytes.
+  void WriteFooter(const void* data, uint32_t data_len);
+  // Read a footer written with `WriteFooter` from the end of the message, given
+  // a buffer and the length of the footer. If `truncate` is true, the message
+  // will be truncated, removing the footer.
+  [[nodiscard]] bool ReadFooter(void* buffer, uint32_t buffer_len,
+                                bool truncate);
+
+  uint32_t event_footer_size() const { return header()->event_footer_size; }
+
+  void set_event_footer_size(uint32_t size) {
+    header()->event_footer_size = size;
+  }
+
+  static int HeaderSize() { return sizeof(Header); }
+
+  // Figure out how big the message starting at range_start is. Returns 0 if
+  // there's no enough data to determine (i.e., if [range_start, range_end) does
+  // not contain enough of the message header to know the size).
+  static uint32_t MessageSize(const char* range_start, const char* range_end) {
+    return Pickle::MessageSize(HeaderSize(), range_start, range_end);
+  }
+
+  bool WriteFileHandle(mozilla::UniqueFileHandle handle);
+
+  // WARNING: This method is marked as `const` so it can be called when
+  // deserializing the message, but will mutate it, consuming the handle.
+  bool ConsumeFileHandle(PickleIterator* iter,
+                         mozilla::UniqueFileHandle* handle) const;
+
+  // Called when receiving an IPC message to attach file handles which were
+  // received from IPC. Must only be called when there are no handles on this
+  // IPC::Message.
+  void SetAttachedFileHandles(nsTArray<mozilla::UniqueFileHandle> handles);
+
+#if defined(OS_MACOSX) || defined(OS_IOS)
+  void set_fd_cookie(uint32_t cookie) { header()->cookie = cookie; }
+  uint32_t fd_cookie() const { return header()->cookie; }
+#endif
+
+  void WritePort(mozilla::ipc::ScopedPort port);
+
+  // This method consumes the port from the message, preventing the message's
+  // destructor from destroying the port and meaning that future attempts to
+  // read this port will instead produce an invalid port.
+  //
+  // WARNING: This method is marked as `const` so it can be called when
+  // deserializing the message, but will mutate the message.
+  bool ConsumePort(PickleIterator* iter, mozilla::ipc::ScopedPort* port) const;
+
+  // Called when loading an IPC message to attach ports which were recieved form
+  // IPC. Must only be called when there are no ports on this IPC::Message.
+  void SetAttachedPorts(nsTArray<mozilla::ipc::ScopedPort> ports);
+
+#if defined(OS_MACOSX) || defined(OS_IOS)
+  bool WriteMachSendRight(mozilla::UniqueMachSendRight port);
+
+  // WARNING: This method is marked as `const` so it can be called when
+  // deserializing the message, but will mutate it, consuming the send rights.
+  bool ConsumeMachSendRight(PickleIterator* iter,
+                            mozilla::UniqueMachSendRight* port) const;
+
+  uint32_t num_send_rights() const;
+#endif
+
+  uint32_t num_relayed_attachments() const {
+#if defined(OS_WIN)
+    return num_handles();
+#elif defined(OS_MACOSX) || defined(OS_IOS)
+    return num_send_rights();
+#else
+    return 0;
+#endif
+  }
+
+#ifdef FUZZING_SNAPSHOT
+  bool IsFuzzMsg() { return isFuzzMsg; }
+  void SetFuzzMsg() { isFuzzMsg = true; }
+#endif
+
+  friend class Channel;
+  friend class MessageReplyDeserializer;
+  friend class SyncMessage;
+  friend class mozilla::ipc::MiniTransceiver;
+
+#if !defined(OS_MACOSX) && !defined(OS_IOS) && !defined(FUZZING_SNAPSHOT)
+ protected:
+#endif
+
+  struct Header : Pickle::Header {
+    int32_t routing;       // ID of the view that this message is destined for
+    msgid_t type;          // specifies the user-defined message type
+    HeaderFlags flags;     // specifies control flags for the message
+    uint32_t num_handles;  // the number of handles included with this message
+#if defined(OS_MACOSX) || defined(OS_IOS)
+    uint32_t cookie;  // cookie to ACK that the descriptors have been read.
+    uint32_t num_send_rights;  // the number of mach send rights included with
+                               // this message
+#endif
+    // For sync messages, a transaction ID for message ordering.
+    int32_t txid;
+    // Sequence number
+    int32_t seqno;
+    // Size of the message's event footer
+    uint32_t event_footer_size;
+  };
+
+  Header* header() { return headerT<Header>(); }
+  const Header* header() const { return headerT<Header>(); }
+
+  // The set of file handles which are attached to this message.
+  //
+  // Mutable, as this array can be mutated during `ReadHandle` when
+  // deserializing a message.
+  mutable nsTArray<mozilla::UniqueFileHandle> attached_handles_;
+
+  // The set of mojo ports which are attached to this message.
+  //
+  // Mutable, as this array can be mutated during `ConsumePort` when
+  // deserializing a message.
+  mutable nsTArray<mozilla::ipc::ScopedPort> attached_ports_;
+
+#if defined(OS_MACOSX) || defined(OS_IOS)
+  // The set of mach send rights which are attached to this message.
+  //
+  // Mutable, as this array can be mutated during `ConsumeMachSendRight` when
+  // deserializing a message.
+  mutable nsTArray<mozilla::UniqueMachSendRight> attached_send_rights_;
+#endif
+
+#ifdef FUZZING_SNAPSHOT
+  bool isFuzzMsg = false;
+#endif
+};
+
+//------------------------------------------------------------------------------
+
+}  // namespace IPC
+
+enum SpecialRoutingIDs {
+  // indicates that we don't have a routing ID yet.
+  MSG_ROUTING_NONE = kint32min,
+
+  // indicates a general message not sent to a particular tab.
+  MSG_ROUTING_CONTROL = kint32max
+};
+
+#define IPC_REPLY_ID 0xFFF0    // Special message id for replies
+#define IPC_LOGGING_ID 0xFFF1  // Special message id for logging
+
+#endif  // CHROME_COMMON_IPC_MESSAGE_H__
diff --git a/ipc/chromium/src/chrome/common/ipc_message_utils.cc b/ipc/chromium/src/chrome/common/ipc_message_utils.cc
new file mode 100644
index 0000000000..49cb277e5f
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_message_utils.cc
@@ -0,0 +1,105 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "chrome/common/ipc_message_utils.h"
+#include "mozilla/ipc/SharedMemory.h"
+#include "mozilla/ipc/SharedMemoryBasic.h"
+
+namespace IPC {
+
+static uint32_t kShmemThreshold = 64 * 1024;
+
+MessageBufferWriter::MessageBufferWriter(MessageWriter* writer,
+                                         uint32_t full_len)
+    : writer_(writer) {
+  if (full_len > kShmemThreshold) {
+    shmem_ = new mozilla::ipc::SharedMemoryBasic();
+    if (!shmem_->Create(full_len)) {
+      writer->FatalError("SharedMemory::Create failed!");
+      return;
+    }
+    if (!shmem_->Map(full_len)) {
+      writer->FatalError("SharedMemory::Map failed");
+      return;
+    }
+    if (!shmem_->WriteHandle(writer)) {
+      writer->FatalError("SharedMemory::WriterHandle failed");
+      return;
+    }
+    buffer_ = reinterpret_cast<char*>(shmem_->memory());
+  }
+  remaining_ = full_len;
+}
+
+MessageBufferWriter::~MessageBufferWriter() {
+  if (remaining_ != 0) {
+    writer_->FatalError("didn't fully write message buffer");
+  }
+}
+
+bool MessageBufferWriter::WriteBytes(const void* data, uint32_t len) {
+  MOZ_RELEASE_ASSERT(len == remaining_ || (len % 4) == 0,
+                     "all writes except for the final write must be a multiple "
+                     "of 4 bytes in length due to padding");
+  if (len > remaining_) {
+    writer_->FatalError("MessageBufferWriter overrun");
+    return false;
+  }
+  remaining_ -= len;
+  // If we're serializing using a shared memory region, `buffer_` will be
+  // initialized to point into that region.
+  if (buffer_) {
+    memcpy(buffer_, data, len);
+    buffer_ += len;
+    return true;
+  }
+  return writer_->WriteBytes(data, len);
+}
+
+MessageBufferReader::MessageBufferReader(MessageReader* reader,
+                                         uint32_t full_len)
+    : reader_(reader) {
+  if (full_len > kShmemThreshold) {
+    shmem_ = new mozilla::ipc::SharedMemoryBasic();
+    if (!shmem_->ReadHandle(reader)) {
+      reader->FatalError("SharedMemory::ReadHandle failed!");
+      return;
+    }
+    if (!shmem_->Map(full_len)) {
+      reader->FatalError("SharedMemory::Map failed");
+      return;
+    }
+    buffer_ = reinterpret_cast<const char*>(shmem_->memory());
+  }
+  remaining_ = full_len;
+}
+
+MessageBufferReader::~MessageBufferReader() {
+  if (remaining_ != 0) {
+    reader_->FatalError("didn't fully write message buffer");
+  }
+}
+
+bool MessageBufferReader::ReadBytesInto(void* data, uint32_t len) {
+  MOZ_RELEASE_ASSERT(len == remaining_ || (len % 4) == 0,
+                     "all reads except for the final read must be a multiple "
+                     "of 4 bytes in length due to padding");
+  if (len > remaining_) {
+    reader_->FatalError("MessageBufferReader overrun");
+    return false;
+  }
+  remaining_ -= len;
+  // If we're serializing using a shared memory region, `buffer_` will be
+  // initialized to point into that region.
+  if (buffer_) {
+    memcpy(data, buffer_, len);
+    buffer_ += len;
+    return true;
+  }
+  return reader_->ReadBytesInto(data, len);
+}
+
+}  // namespace IPC
diff --git a/ipc/chromium/src/chrome/common/ipc_message_utils.h b/ipc/chromium/src/chrome/common/ipc_message_utils.h
new file mode 100644
index 0000000000..90b94feaed
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/ipc_message_utils.h
@@ -0,0 +1,1093 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_IPC_MESSAGE_UTILS_H_
+#define CHROME_COMMON_IPC_MESSAGE_UTILS_H_
+
+#include <cstdint>
+#include <iterator>
+#include <map>
+#include <unordered_map>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+#include "ErrorList.h"
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "base/logging.h"
+#include "base/pickle.h"
+#include "base/string_util.h"
+#include "build/build_config.h"
+#include "chrome/common/ipc_message.h"
+#include "mozilla/CheckedInt.h"
+#include "mozilla/IntegerRange.h"
+
+#if defined(OS_WIN)
+#  include <windows.h>
+#endif
+
+template <typename T>
+class RefPtr;
+template <typename T>
+class nsCOMPtr;
+
+namespace mozilla::ipc {
+class IProtocol;
+template <typename P>
+struct IPDLParamTraits;
+class SharedMemory;
+
+// Implemented in ProtocolUtils.cpp
+MOZ_NEVER_INLINE void PickleFatalError(const char* aMsg, IProtocol* aActor);
+}  // namespace mozilla::ipc
+
+namespace IPC {
+
+/**
+ * Context used to serialize into an IPC::Message. Provides relevant context
+ * used when serializing.
+ */
+class MOZ_STACK_CLASS MessageWriter final {
+ public:
+  explicit MessageWriter(Message& message,
+                         mozilla::ipc::IProtocol* actor = nullptr)
+      : message_(message), actor_(actor) {}
+
+  MessageWriter(const MessageWriter&) = delete;
+  MessageWriter& operator=(const MessageWriter&) = delete;
+
+  mozilla::ipc::IProtocol* GetActor() const { return actor_; }
+
+#define FORWARD_WRITE(name, type) \
+  bool Write##name(const type& result) { return message_.Write##name(result); }
+
+  FORWARD_WRITE(Bool, bool)
+  FORWARD_WRITE(Int16, int16_t)
+  FORWARD_WRITE(UInt16, uint16_t)
+  FORWARD_WRITE(Int, int)
+  FORWARD_WRITE(Long, long)
+  FORWARD_WRITE(ULong, unsigned long)
+  FORWARD_WRITE(Int32, int32_t)
+  FORWARD_WRITE(UInt32, uint32_t)
+  FORWARD_WRITE(Int64, int64_t)
+  FORWARD_WRITE(UInt64, uint64_t)
+  FORWARD_WRITE(Double, double)
+  FORWARD_WRITE(IntPtr, intptr_t)
+  FORWARD_WRITE(UnsignedChar, unsigned char)
+  FORWARD_WRITE(String, std::string)
+  FORWARD_WRITE(WString, std::wstring)
+
+#undef FORWARD_WRITE
+
+  bool WriteData(const char* data, uint32_t length) {
+    return message_.WriteData(data, length);
+  }
+
+  bool WriteBytes(const void* data, uint32_t data_len) {
+    return message_.WriteBytes(data, data_len);
+  }
+
+  bool WriteBytesZeroCopy(void* data, uint32_t data_len, uint32_t capacity) {
+    return message_.WriteBytesZeroCopy(data, data_len, capacity);
+  }
+
+  bool WriteSentinel(uint32_t sentinel) {
+    return message_.WriteSentinel(sentinel);
+  }
+
+  bool WriteFileHandle(mozilla::UniqueFileHandle handle) {
+    return message_.WriteFileHandle(std::move(handle));
+  }
+
+  void WritePort(mozilla::ipc::ScopedPort port) {
+    message_.WritePort(std::move(port));
+  }
+
+#if defined(OS_MACOSX) || defined(OS_IOS)
+  bool WriteMachSendRight(mozilla::UniqueMachSendRight port) {
+    return message_.WriteMachSendRight(std::move(port));
+  }
+#endif
+
+  void FatalError(const char* aErrorMsg) const {
+    mozilla::ipc::PickleFatalError(aErrorMsg, actor_);
+  }
+
+ private:
+  Message& message_;
+  mozilla::ipc::IProtocol* actor_;
+};
+
+/**
+ * Context used to read data from an IPC::Message. Provides relevant context
+ * used when deserializing and tracks iteration.
+ */
+class MOZ_STACK_CLASS MessageReader final {
+ public:
+  explicit MessageReader(const Message& message,
+                         mozilla::ipc::IProtocol* actor = nullptr)
+      : message_(message), iter_(message), actor_(actor) {}
+
+  MessageReader(const MessageReader&) = delete;
+  MessageReader& operator=(const MessageReader&) = delete;
+
+  mozilla::ipc::IProtocol* GetActor() const { return actor_; }
+
+#define FORWARD_READ(name, type)                \
+  [[nodiscard]] bool Read##name(type* result) { \
+    return message_.Read##name(&iter_, result); \
+  }
+
+  FORWARD_READ(Bool, bool)
+  FORWARD_READ(Int16, int16_t)
+  FORWARD_READ(UInt16, uint16_t)
+  FORWARD_READ(Short, short)
+  FORWARD_READ(Int, int)
+  FORWARD_READ(Long, long)
+  FORWARD_READ(ULong, unsigned long)
+  FORWARD_READ(Int32, int32_t)
+  FORWARD_READ(UInt32, uint32_t)
+  FORWARD_READ(Int64, int64_t)
+  FORWARD_READ(UInt64, uint64_t)
+  FORWARD_READ(Double, double)
+  FORWARD_READ(IntPtr, intptr_t)
+  FORWARD_READ(UnsignedChar, unsigned char)
+  FORWARD_READ(String, std::string)
+  FORWARD_READ(WString, std::wstring)
+
+  // Special version of ReadInt() which rejects negative values
+  FORWARD_READ(Length, int);
+
+#undef FORWARD_READ
+
+  [[nodiscard]] bool ReadBytesInto(void* data, uint32_t length) {
+    return message_.ReadBytesInto(&iter_, data, length);
+  }
+
+  [[nodiscard]] bool IgnoreBytes(uint32_t length) {
+    return message_.IgnoreBytes(&iter_, length);
+  }
+
+  [[nodiscard]] bool ReadSentinel(uint32_t sentinel) {
+    return message_.ReadSentinel(&iter_, sentinel);
+  }
+
+  bool IgnoreSentinel() { return message_.IgnoreSentinel(&iter_); }
+
+  bool HasBytesAvailable(uint32_t len) {
+    return message_.HasBytesAvailable(&iter_, len);
+  }
+
+  void EndRead() { message_.EndRead(iter_, message_.type()); }
+
+  [[nodiscard]] bool ConsumeFileHandle(mozilla::UniqueFileHandle* handle) {
+    return message_.ConsumeFileHandle(&iter_, handle);
+  }
+
+  [[nodiscard]] bool ConsumePort(mozilla::ipc::ScopedPort* port) {
+    return message_.ConsumePort(&iter_, port);
+  }
+
+#if defined(OS_MACOSX) || defined(OS_IOS)
+  [[nodiscard]] bool ConsumeMachSendRight(mozilla::UniqueMachSendRight* port) {
+    return message_.ConsumeMachSendRight(&iter_, port);
+  }
+#endif
+
+  void FatalError(const char* aErrorMsg) const {
+    mozilla::ipc::PickleFatalError(aErrorMsg, actor_);
+  }
+
+ private:
+  const Message& message_;
+  PickleIterator iter_;
+  mozilla::ipc::IProtocol* actor_;
+};
+
+namespace detail {
+
+// Helper for checking `T::kHasDeprecatedReadParamPrivateConstructor` using a
+// fallback when the member isn't defined.
+template <typename T>
+inline constexpr auto HasDeprecatedReadParamPrivateConstructor(int)
+    -> decltype(T::kHasDeprecatedReadParamPrivateConstructor) {
+  return T::kHasDeprecatedReadParamPrivateConstructor;
+}
+
+template <typename T>
+inline constexpr bool HasDeprecatedReadParamPrivateConstructor(...) {
+  return false;
+}
+
+}  // namespace detail
+
+/**
+ * Result type returned from some `ParamTraits<T>::Read` implementations, and
+ * from `IPC::ReadParam<T>(MessageReader*)`. Either contains the value or
+ * indicates a failure to deserialize.
+ *
+ * This type can be thought of as a variant on `Maybe<T>`, except that it
+ * unconditionally constructs the underlying value if it is default
+ * constructible. This helps keep code size down, especially when calling
+ * outparameter-based ReadParam implementations (bug 1815177).
+ */
+template <typename T,
+          bool = std::is_default_constructible_v<T> ||
+                 detail::HasDeprecatedReadParamPrivateConstructor<T>(0)>
+class ReadResult {
+ public:
+  ReadResult() = default;
+
+  template <typename U, std::enable_if_t<std::is_convertible_v<U, T>, int> = 0>
+  MOZ_IMPLICIT ReadResult(U&& aData)
+      : mIsOk(true), mData(std::forward<U>(aData)) {}
+
+  template <typename... Args>
+  explicit ReadResult(std::in_place_t, Args&&... aArgs)
+      : mIsOk(true), mData(std::forward<Args>(aArgs)...) {}
+
+  ReadResult(const ReadResult&) = default;
+  ReadResult(ReadResult&&) = default;
+
+  template <typename U, std::enable_if_t<std::is_convertible_v<U, T>, int> = 0>
+  MOZ_IMPLICIT ReadResult& operator=(U&& aData) {
+    mIsOk = true;
+    mData = std::forward<U>(aData);
+    return *this;
+  }
+
+  ReadResult& operator=(const ReadResult&) = default;
+  ReadResult& operator=(ReadResult&&) noexcept = default;
+
+  // Check if the ReadResult contains a valid value.
+  explicit operator bool() const { return isOk(); }
+  bool isOk() const { return mIsOk; }
+
+  // Get the data from this ReadResult.
+  T& get() {
+    MOZ_ASSERT(mIsOk);
+    return mData;
+  }
+  const T& get() const {
+    MOZ_ASSERT(mIsOk);
+    return mData;
+  }
+
+  T& operator*() { return get(); }
+  const T& operator*() const { return get(); }
+
+  T* operator->() { return &get(); }
+  const T* operator->() const { return &get(); }
+
+  // Try to extract a `Maybe<T>` from this ReadResult.
+  mozilla::Maybe<T> TakeMaybe() {
+    if (mIsOk) {
+      mIsOk = false;
+      return mozilla::Some(std::move(mData));
+    }
+    return mozilla::Nothing();
+  }
+
+  // Get the underlying data from this ReadResult, even if not OK.
+  //
+  // This is only available for types which are default constructible, and is
+  // used to optimize old-style `ReadParam` calls.
+  T& GetStorage() { return mData; }
+
+  // Compliment to `GetStorage` used to set the ReadResult into an OK state
+  // without constructing the underlying value.
+  void SetOk(bool aIsOk) { mIsOk = aIsOk; }
+
+ private:
+  bool mIsOk = false;
+  T mData{};
+};
+
+template <typename T>
+class ReadResult<T, false> {
+ public:
+  ReadResult() = default;
+
+  template <typename U, std::enable_if_t<std::is_convertible_v<U, T>, int> = 0>
+  MOZ_IMPLICIT ReadResult(U&& aData)
+      : mData(std::in_place, std::forward<U>(aData)) {}
+
+  template <typename... Args>
+  explicit ReadResult(std::in_place_t, Args&&... aArgs)
+      : mData(std::in_place, std::forward<Args>(aArgs)...) {}
+
+  ReadResult(const ReadResult&) = default;
+  ReadResult(ReadResult&&) = default;
+
+  template <typename U, std::enable_if_t<std::is_convertible_v<U, T>, int> = 0>
+  MOZ_IMPLICIT ReadResult& operator=(U&& aData) {
+    mData.reset();
+    mData.emplace(std::forward<U>(aData));
+    return *this;
+  }
+
+  ReadResult& operator=(const ReadResult&) = default;
+  ReadResult& operator=(ReadResult&&) noexcept = default;
+
+  // Check if the ReadResult contains a valid value.
+  explicit operator bool() const { return isOk(); }
+  bool isOk() const { return mData.isSome(); }
+
+  // Get the data from this ReadResult.
+  T& get() { return mData.ref(); }
+  const T& get() const { return mData.ref(); }
+
+  T& operator*() { return get(); }
+  const T& operator*() const { return get(); }
+
+  T* operator->() { return &get(); }
+  const T* operator->() const { return &get(); }
+
+  // Try to extract a `Maybe<T>` from this ReadResult.
+  mozilla::Maybe<T> TakeMaybe() { return std::move(mData); }
+
+  // These methods are only available if the type is default constructible.
+  T& GetStorage() = delete;
+  void SetOk(bool aIsOk) = delete;
+
+ private:
+  mozilla::Maybe<T> mData;
+};
+
+//-----------------------------------------------------------------------------
+// An iterator class for reading the fields contained within a Message.
+
+class MessageIterator {
+ public:
+  explicit MessageIterator(const Message& m) : msg_(m), iter_(m) {}
+  int NextInt() const {
+    int val;
+    if (!msg_.ReadInt(&iter_, &val)) NOTREACHED();
+    return val;
+  }
+  intptr_t NextIntPtr() const {
+    intptr_t val;
+    if (!msg_.ReadIntPtr(&iter_, &val)) NOTREACHED();
+    return val;
+  }
+  const std::string NextString() const {
+    std::string val;
+    if (!msg_.ReadString(&iter_, &val)) NOTREACHED();
+    return val;
+  }
+  const std::wstring NextWString() const {
+    std::wstring val;
+    if (!msg_.ReadWString(&iter_, &val)) NOTREACHED();
+    return val;
+  }
+
+ private:
+  const Message& msg_;
+  mutable PickleIterator iter_;
+};
+
+//-----------------------------------------------------------------------------
+// ParamTraits specializations, etc.
+//
+// The full set of types ParamTraits is specialized upon contains *possibly*
+// repeated types: unsigned long may be uint32_t or size_t, unsigned long long
+// may be uint64_t or size_t, nsresult may be uint32_t, and so on.  You can't
+// have ParamTraits<unsigned int> *and* ParamTraits<uint32_t> if unsigned int
+// is uint32_t -- that's multiple definitions, and you can only have one.
+//
+// You could use #ifs and macro conditions to avoid duplicates, but they'd be
+// hairy: heavily dependent upon OS and compiler author choices, forced to
+// address all conflicts by hand.  Happily there's a better way.  The basic
+// idea looks like this, where T -> U represents T inheriting from U:
+//
+// class ParamTraits<P>
+// |
+// --> class ParamTraits1<P>
+//     |
+//     --> class ParamTraits2<P>
+//         |
+//         --> class ParamTraitsN<P> // or however many levels
+//
+// The default specialization of ParamTraits{M}<P> is an empty class that
+// inherits from ParamTraits{M + 1}<P> (or nothing in the base case).
+//
+// Now partition the set of parameter types into sets without duplicates.
+// Assign each set of types to a level M.  Then specialize ParamTraitsM for
+// each of those types.  A reference to ParamTraits<P> will consist of some
+// number of empty classes inheriting in sequence, ending in a non-empty
+// ParamTraits{N}<P>.  It's okay for the parameter types to be duplicative:
+// either name of a type will resolve to the same ParamTraits{N}<P>.
+//
+// The nice thing is that because templates are instantiated lazily, if we
+// indeed have uint32_t == unsigned int, say, with the former in level N and
+// the latter in M > N, ParamTraitsM<unsigned int> won't be created (as long as
+// nobody uses ParamTraitsM<unsigned int>, but why would you), and no duplicate
+// code will be compiled or extra symbols generated.  It's as efficient at
+// runtime as manually figuring out and avoiding conflicts by #ifs.
+//
+// The scheme we follow below names the various classes according to the types
+// in them, and the number of ParamTraits levels is larger, but otherwise it's
+// exactly the above idea.
+//
+
+template <class P>
+struct ParamTraits;
+
+template <typename P>
+inline void WriteParam(MessageWriter* writer, P&& p) {
+  ParamTraits<std::decay_t<P>>::Write(writer, std::forward<P>(p));
+}
+
+namespace detail {
+
+template <typename P>
+inline constexpr auto ParamTraitsReadUsesOutParam()
+    -> decltype(ParamTraits<P>::Read(std::declval<MessageReader*>(),
+                                     std::declval<P*>())) {
+  return true;
+}
+
+template <typename P>
+inline constexpr auto ParamTraitsReadUsesOutParam()
+    -> decltype(ParamTraits<P>::Read(std::declval<MessageReader*>()), bool{}) {
+  return false;
+}
+
+}  // namespace detail
+
+template <typename P>
+inline bool WARN_UNUSED_RESULT ReadParam(MessageReader* reader, P* p) {
+  if constexpr (!detail::ParamTraitsReadUsesOutParam<P>()) {
+    auto maybe = ParamTraits<P>::Read(reader);
+    if (maybe) {
+      *p = std::move(*maybe);
+      return true;
+    }
+    return false;
+  } else {
+    return ParamTraits<P>::Read(reader, p);
+  }
+}
+
+template <typename P>
+inline ReadResult<P> WARN_UNUSED_RESULT ReadParam(MessageReader* reader) {
+  if constexpr (!detail::ParamTraitsReadUsesOutParam<P>()) {
+    return ParamTraits<P>::Read(reader);
+  } else {
+    ReadResult<P> p;
+    p.SetOk(ParamTraits<P>::Read(reader, &p.GetStorage()));
+    return p;
+  }
+}
+
+class MOZ_STACK_CLASS MessageBufferWriter {
+ public:
+  // Create a MessageBufferWriter to write `full_len` bytes into `writer`.
+  // If the length exceeds a threshold, a shared memory region may be used
+  // instead of including the data inline.
+  //
+  // NOTE: This does _NOT_ write out the length of the buffer.
+  // NOTE: Data written this way _MUST_ be read using `MessageBufferReader`.
+  MessageBufferWriter(MessageWriter* writer, uint32_t full_len);
+  ~MessageBufferWriter();
+
+  MessageBufferWriter(const MessageBufferWriter&) = delete;
+  MessageBufferWriter& operator=(const MessageBufferWriter&) = delete;
+
+  // Write `len` bytes from `data` into the message.
+  //
+  // Exactly `full_len` bytes should be written across multiple calls before the
+  // `MessageBufferWriter` is destroyed.
+  //
+  // WARNING: all writes (other than the last write) must be multiples of 4
+  // bytes in length. Not doing this will lead to padding being introduced into
+  // the payload and break things. This can probably be improved in the future
+  // with deeper integration between `MessageBufferWriter` and `Pickle`.
+  bool WriteBytes(const void* data, uint32_t len);
+
+ private:
+  MessageWriter* writer_;
+  RefPtr<mozilla::ipc::SharedMemory> shmem_;
+  char* buffer_ = nullptr;
+  uint32_t remaining_ = 0;
+};
+
+class MOZ_STACK_CLASS MessageBufferReader {
+ public:
+  // Create a MessageBufferReader to read `full_len` bytes from `reader` which
+  // were written using `MessageBufferWriter`.
+  //
+  // NOTE: This may consume a shared memory region from the message, meaning
+  // that the same data cannot be read multiple times.
+  // NOTE: Data read this way _MUST_ be written using `MessageBufferWriter`.
+  MessageBufferReader(MessageReader* reader, uint32_t full_len);
+  ~MessageBufferReader();
+
+  MessageBufferReader(const MessageBufferReader&) = delete;
+  MessageBufferReader& operator=(const MessageBufferReader&) = delete;
+
+  // Read `count` bytes from the message into `data`.
+  //
+  // Exactly `full_len` bytes should be read across multiple calls before the
+  // `MessageBufferReader` is destroyed.
+  //
+  // WARNING: all reads (other than the last read) must be multiples of 4 bytes
+  // in length. Not doing this will lead to bytes being skipped in the payload
+  // and break things. This can probably be improved in the future with deeper
+  // integration between `MessageBufferReader` and `Pickle`.
+  [[nodiscard]] bool ReadBytesInto(void* data, uint32_t len);
+
+ private:
+  MessageReader* reader_;
+  RefPtr<mozilla::ipc::SharedMemory> shmem_;
+  const char* buffer_ = nullptr;
+  uint32_t remaining_ = 0;
+};
+
+// Whether or not it is safe to serialize the given type using
+// `WriteBytesOrShmem`.
+template <typename P>
+constexpr bool kUseWriteBytes =
+    !std::is_same_v<std::remove_const_t<std::remove_reference_t<P>>, bool> &&
+    (std::is_integral_v<std::remove_const_t<std::remove_reference_t<P>>> ||
+     std::is_floating_point_v<std::remove_const_t<std::remove_reference_t<P>>>);
+
+/**
+ * Helper for writing a contiguous sequence (such as for a string or array) into
+ * a message, with optimizations for basic integral and floating point types.
+ *
+ * Integral types will be copied into shared memory if the sequence exceeds 64k
+ * bytes in size.
+ *
+ * Values written with this method must be read with `ReadSequenceParam`.
+ *
+ * The type parameter specifies the semantics to use, and should generally
+ * either be `P&&` or `const P&`. The constness of the `data` argument should
+ * match this parameter.
+ */
+template <typename P>
+void WriteSequenceParam(MessageWriter* writer, std::remove_reference_t<P>* data,
+                        size_t length) {
+  mozilla::CheckedUint32 ipc_length(length);
+  if (!ipc_length.isValid()) {
+    writer->FatalError("invalid length passed to WriteSequenceParam");
+    return;
+  }
+  writer->WriteUInt32(ipc_length.value());
+
+  if constexpr (kUseWriteBytes<P>) {
+    mozilla::CheckedUint32 byte_length =
+        ipc_length * sizeof(std::remove_reference_t<P>);
+    if (!byte_length.isValid()) {
+      writer->FatalError("invalid byte length in WriteSequenceParam");
+      return;
+    }
+    MessageBufferWriter buf_writer(writer, byte_length.value());
+    buf_writer.WriteBytes(data, byte_length.value());
+  } else {
+    auto* end = data + length;
+    for (auto* it = data; it != end; ++it) {
+      WriteParam(writer, std::forward<P>(*it));
+    }
+  }
+}
+
+template <typename P>
+bool ReadSequenceParamImpl(MessageReader* reader, P* data, uint32_t length) {
+  if (length == 0) {
+    return true;
+  }
+  if (!data) {
+    reader->FatalError("allocation failed in ReadSequenceParam");
+    return false;
+  }
+
+  if constexpr (kUseWriteBytes<P>) {
+    mozilla::CheckedUint32 byte_length(length);
+    byte_length *= sizeof(P);
+    if (!byte_length.isValid()) {
+      reader->FatalError("invalid byte length in ReadSequenceParam");
+      return false;
+    }
+    MessageBufferReader buf_reader(reader, byte_length.value());
+    return buf_reader.ReadBytesInto(data, byte_length.value());
+  } else {
+    P* end = data + length;
+    for (auto* it = data; it != end; ++it) {
+      if (!ReadParam(reader, it)) {
+        return false;
+      }
+    }
+    return true;
+  }
+}
+
+template <typename P, typename I>
+bool ReadSequenceParamImpl(MessageReader* reader, mozilla::Maybe<I>&& data,
+                           uint32_t length) {
+  static_assert(!kUseWriteBytes<P>,
+                "Cannot return an output iterator if !kUseWriteBytes<P>");
+  static_assert(
+      std::is_base_of_v<std::output_iterator_tag,
+                        typename std::iterator_traits<I>::iterator_category>,
+      "must be Maybe<output iterator>");
+  if (length == 0) {
+    return true;
+  }
+  if (!data) {
+    reader->FatalError("allocation failed in ReadSequenceParam");
+    return false;
+  }
+
+  for (uint32_t i = 0; i < length; ++i) {
+    auto elt = ReadParam<P>(reader);
+    if (!elt) {
+      return false;
+    }
+    *data.ref() = std::move(*elt);
+    ++data.ref();
+  }
+  return true;
+}
+
+/**
+ * Helper for reading a contiguous sequence (such as a string or array) into a
+ * message which was previously written using `WriteSequenceParam`.
+ *
+ * The function argument `allocator` will be called with the length of the
+ * sequence, and must return either a pointer to the memory region which the
+ * sequence should be read into, or a Maybe of a C++ output iterator which will
+ * infallibly accept length elements, and append them to the output sequence.
+ *
+ * If the type satisfies kUseWriteBytes, output iterators are not supported.
+ */
+template <typename P, typename F>
+bool WARN_UNUSED_RESULT ReadSequenceParam(MessageReader* reader,
+                                          F&& allocator) {
+  uint32_t length = 0;
+  if (!reader->ReadUInt32(&length)) {
+    reader->FatalError("failed to read byte length in ReadSequenceParam");
+    return false;
+  }
+
+  return ReadSequenceParamImpl<P>(reader, allocator(length), length);
+}
+
+// Temporary fallback class to allow types to declare serialization using the
+// IPDLParamTraits type class. Will be removed once all remaining
+// IPDLParamTraits implementations are gone. (bug 1754009)
+
+template <class P>
+struct ParamTraitsIPDLFallback {
+  template <class R>
+  static auto Write(MessageWriter* writer, R&& p)
+      -> decltype(mozilla::ipc::IPDLParamTraits<P>::Write(writer,
+                                                          writer->GetActor(),
+                                                          std::forward<R>(p))) {
+    mozilla::ipc::IPDLParamTraits<P>::Write(writer, writer->GetActor(),
+                                            std::forward<R>(p));
+  }
+  template <class R>
+  static auto Read(MessageReader* reader, R* r)
+      -> decltype(mozilla::ipc::IPDLParamTraits<P>::Read(reader,
+                                                         reader->GetActor(),
+                                                         r)) {
+    return mozilla::ipc::IPDLParamTraits<P>::Read(reader, reader->GetActor(),
+                                                  r);
+  }
+};
+
+// Fundamental types.
+
+template <class P>
+struct ParamTraitsFundamental : ParamTraitsIPDLFallback<P> {};
+
+template <>
+struct ParamTraitsFundamental<bool> {
+  typedef bool param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteBool(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadBool(r);
+  }
+};
+
+template <>
+struct ParamTraitsFundamental<int> {
+  typedef int param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteInt(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadInt(r);
+  }
+};
+
+template <>
+struct ParamTraitsFundamental<long> {
+  typedef long param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteLong(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadLong(r);
+  }
+};
+
+template <>
+struct ParamTraitsFundamental<unsigned long> {
+  typedef unsigned long param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteULong(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadULong(r);
+  }
+};
+
+template <>
+struct ParamTraitsFundamental<long long> {
+  typedef long long param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteBytes(&p, sizeof(param_type));
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadBytesInto(r, sizeof(*r));
+  }
+};
+
+template <>
+struct ParamTraitsFundamental<unsigned long long> {
+  typedef unsigned long long param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteBytes(&p, sizeof(param_type));
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadBytesInto(r, sizeof(*r));
+  }
+};
+
+template <>
+struct ParamTraitsFundamental<double> {
+  typedef double param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteDouble(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadDouble(r);
+  }
+};
+
+// Fixed-size <stdint.h> types.
+
+template <class P>
+struct ParamTraitsFixed : ParamTraitsFundamental<P> {};
+
+template <>
+struct ParamTraitsFixed<int16_t> {
+  typedef int16_t param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteInt16(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadInt16(r);
+  }
+};
+
+template <>
+struct ParamTraitsFixed<uint16_t> {
+  typedef uint16_t param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteUInt16(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadUInt16(r);
+  }
+};
+
+template <>
+struct ParamTraitsFixed<uint32_t> {
+  typedef uint32_t param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteUInt32(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadUInt32(r);
+  }
+};
+
+template <>
+struct ParamTraitsFixed<int64_t> {
+  typedef int64_t param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteInt64(p);
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadInt64(r);
+  }
+};
+
+template <>
+struct ParamTraitsFixed<uint64_t> {
+  typedef uint64_t param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteInt64(static_cast<int64_t>(p));
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadInt64(reinterpret_cast<int64_t*>(r));
+  }
+};
+
+// std::* types.
+
+template <class P>
+struct ParamTraitsStd : ParamTraitsFixed<P> {};
+
+template <class T>
+struct ParamTraitsStd<std::basic_string<T>> {
+  typedef std::basic_string<T> param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    WriteSequenceParam<const T&>(writer, p.data(), p.size());
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return ReadSequenceParam<T>(reader, [&](uint32_t length) -> T* {
+      r->resize(length);
+      return r->data();
+    });
+  }
+};
+
+template <class K, class V>
+struct ParamTraitsStd<std::map<K, V>> {
+  typedef std::map<K, V> param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    WriteParam(writer, static_cast<int>(p.size()));
+    typename param_type::const_iterator iter;
+    for (iter = p.begin(); iter != p.end(); ++iter) {
+      WriteParam(writer, iter->first);
+      WriteParam(writer, iter->second);
+    }
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    int size;
+    if (!ReadParam(reader, &size) || size < 0) return false;
+    for (int i = 0; i < size; ++i) {
+      K k;
+      if (!ReadParam(reader, &k)) return false;
+      V& value = (*r)[k];
+      if (!ReadParam(reader, &value)) return false;
+    }
+    return true;
+  }
+};
+
+// Windows-specific types.
+
+template <class P>
+struct ParamTraitsWindows : ParamTraitsStd<P> {};
+
+#if defined(OS_WIN)
+template <>
+struct ParamTraitsWindows<HANDLE> {
+  static_assert(sizeof(HANDLE) == sizeof(intptr_t), "Wrong size for HANDLE?");
+
+  static void Write(MessageWriter* writer, HANDLE p) {
+    writer->WriteIntPtr(reinterpret_cast<intptr_t>(p));
+  }
+  static bool Read(MessageReader* reader, HANDLE* r) {
+    return reader->ReadIntPtr(reinterpret_cast<intptr_t*>(r));
+  }
+};
+
+template <>
+struct ParamTraitsWindows<HWND> {
+  static_assert(sizeof(HWND) == sizeof(intptr_t), "Wrong size for HWND?");
+
+  static void Write(MessageWriter* writer, HWND p) {
+    writer->WriteIntPtr(reinterpret_cast<intptr_t>(p));
+  }
+  static bool Read(MessageReader* reader, HWND* r) {
+    return reader->ReadIntPtr(reinterpret_cast<intptr_t*>(r));
+  }
+};
+#endif  // defined(OS_WIN)
+
+// Various ipc/chromium types.
+
+template <class P>
+struct ParamTraitsIPC : ParamTraitsWindows<P> {};
+
+// `UniqueFileHandle` may be serialized over IPC channels. On the receiving
+// side, the UniqueFileHandle is a valid duplicate of the handle which was
+// transmitted.
+//
+// When sending a UniqueFileHandle, the handle must be valid at the time of
+// transmission. As transmission is asynchronous, this requires passing
+// ownership of the handle to IPC.
+//
+// A UniqueFileHandle may only be read once. After it has been read once, it
+// will be consumed, and future reads will return an invalid handle.
+template <>
+struct ParamTraitsIPC<mozilla::UniqueFileHandle> {
+  typedef mozilla::UniqueFileHandle param_type;
+  static void Write(MessageWriter* writer, param_type&& p) {
+    const bool valid = p != nullptr;
+    WriteParam(writer, valid);
+    if (valid) {
+      if (!writer->WriteFileHandle(std::move(p))) {
+        writer->FatalError("Too many file handles for one message!");
+        NOTREACHED() << "Too many file handles for one message!";
+      }
+    }
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    bool valid;
+    if (!ReadParam(reader, &valid)) {
+      reader->FatalError("Error reading file handle validity");
+      return false;
+    }
+
+    if (!valid) {
+      *r = nullptr;
+      return true;
+    }
+
+    if (!reader->ConsumeFileHandle(r)) {
+      reader->FatalError("File handle not found in message!");
+      return false;
+    }
+    return true;
+  }
+};
+
+#if defined(OS_MACOSX) || defined(OS_IOS)
+// `UniqueMachSendRight` may be serialized over IPC channels. On the receiving
+// side, the UniqueMachSendRight is the local name of the right which was
+// transmitted.
+//
+// When sending a UniqueMachSendRight, the right must be valid at the time of
+// transmission. As transmission is asynchronous, this requires passing
+// ownership of the handle to IPC.
+//
+// A UniqueMachSendRight may only be read once. After it has been read once, it
+// will be consumed, and future reads will return an invalid right.
+template <>
+struct ParamTraitsIPC<mozilla::UniqueMachSendRight> {
+  typedef mozilla::UniqueMachSendRight param_type;
+  static void Write(MessageWriter* writer, param_type&& p) {
+    const bool valid = p != nullptr;
+    WriteParam(writer, valid);
+    if (valid) {
+      if (!writer->WriteMachSendRight(std::move(p))) {
+        writer->FatalError("Too many mach send rights for one message!");
+        NOTREACHED() << "Too many mach send rights for one message!";
+      }
+    }
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    bool valid;
+    if (!ReadParam(reader, &valid)) {
+      reader->FatalError("Error reading mach send right validity");
+      return false;
+    }
+
+    if (!valid) {
+      *r = nullptr;
+      return true;
+    }
+
+    if (!reader->ConsumeMachSendRight(r)) {
+      reader->FatalError("Mach send right not found in message!");
+      return false;
+    }
+    return true;
+  }
+};
+#endif
+
+// Mozilla-specific types.
+
+template <class P>
+struct ParamTraitsMozilla : ParamTraitsIPC<P> {};
+
+// Sending-only specialization for mozilla::Span<T const>. Uses an identical
+// serialization format as `const nsTArray<T>&`.
+template <class T>
+struct ParamTraitsMozilla<mozilla::Span<const T>> {
+  static void Write(MessageWriter* writer, mozilla::Span<const T> p) {
+    WriteSequenceParam<const T>(writer, p.Elements(), p.Length());
+  }
+};
+
+template <>
+struct ParamTraitsMozilla<nsresult> {
+  typedef nsresult param_type;
+  static void Write(MessageWriter* writer, const param_type& p) {
+    writer->WriteUInt32(static_cast<uint32_t>(p));
+  }
+  static bool Read(MessageReader* reader, param_type* r) {
+    return reader->ReadUInt32(reinterpret_cast<uint32_t*>(r));
+  }
+};
+
+// See comments for the IPDLParamTraits specializations for RefPtr<T> and
+// nsCOMPtr<T> for more details.
+template <class T>
+struct ParamTraitsMozilla<RefPtr<T>> {
+  static void Write(MessageWriter* writer, const RefPtr<T>& p) {
+    ParamTraits<T*>::Write(writer, p.get());
+  }
+
+  static bool Read(MessageReader* reader, RefPtr<T>* r) {
+    return ParamTraits<T*>::Read(reader, r);
+  }
+};
+
+template <class T>
+struct ParamTraitsMozilla<nsCOMPtr<T>> {
+  static void Write(MessageWriter* writer, const nsCOMPtr<T>& p) {
+    ParamTraits<T*>::Write(writer, p.get());
+  }
+
+  static bool Read(MessageReader* reader, nsCOMPtr<T>* r) {
+    RefPtr<T> refptr;
+    if (!ParamTraits<T*>::Read(reader, &refptr)) {
+      return false;
+    }
+    *r = std::move(refptr);
+    return true;
+  }
+};
+
+template <class T>
+struct ParamTraitsMozilla<mozilla::NotNull<T>> {
+  static void Write(MessageWriter* writer, const mozilla::NotNull<T>& p) {
+    ParamTraits<T>::Write(writer, p.get());
+  }
+
+  static ReadResult<mozilla::NotNull<T>> Read(MessageReader* reader) {
+    auto ptr = ReadParam<T>(reader);
+    if (!ptr) {
+      return {};
+    }
+    if (!*ptr) {
+      reader->FatalError("unexpected null value");
+      return {};
+    }
+    return mozilla::WrapNotNull(std::move(*ptr));
+  }
+};
+
+// Finally, ParamTraits itself.
+
+template <class P>
+struct ParamTraits : ParamTraitsMozilla<P> {};
+
+}  // namespace IPC
+
+#endif  // CHROME_COMMON_IPC_MESSAGE_UTILS_H_
diff --git a/ipc/chromium/src/chrome/common/mach_ipc_mac.cc b/ipc/chromium/src/chrome/common/mach_ipc_mac.cc
new file mode 100644
index 0000000000..2fa1a47fd3
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/mach_ipc_mac.cc
@@ -0,0 +1,93 @@
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/mach_ipc_mac.h"
+
+#include "base/logging.h"
+#include "mozilla/UniquePtrExtensions.h"
+#include "nsDebug.h"
+
+namespace {
+// Struct for sending a Mach message with a single port.
+struct MachSinglePortMessage {
+  mach_msg_header_t header;
+  mach_msg_body_t body;
+  mach_msg_port_descriptor_t data;
+};
+
+// Struct for receiving a Mach message with a single port.
+struct MachSinglePortMessageTrailer : MachSinglePortMessage {
+  mach_msg_audit_trailer_t trailer;
+};
+}  // namespace
+
+//==============================================================================
+kern_return_t MachSendPortSendRight(
+    mach_port_t endpoint, mach_port_t attachment,
+    mozilla::Maybe<mach_msg_timeout_t> opt_timeout,
+    mach_msg_type_name_t endpoint_disposition) {
+  mach_msg_option_t opts = MACH_SEND_MSG;
+  mach_msg_timeout_t timeout = MACH_MSG_TIMEOUT_NONE;
+  if (opt_timeout) {
+    opts |= MACH_SEND_TIMEOUT;
+    timeout = *opt_timeout;
+  }
+
+  MachSinglePortMessage send_msg{};
+  send_msg.header.msgh_bits =
+      MACH_MSGH_BITS(endpoint_disposition, 0) | MACH_MSGH_BITS_COMPLEX;
+  send_msg.header.msgh_size = sizeof(send_msg);
+  send_msg.header.msgh_remote_port = endpoint;
+  send_msg.header.msgh_local_port = MACH_PORT_NULL;
+  send_msg.header.msgh_reserved = 0;
+  send_msg.header.msgh_id = 0;
+  send_msg.body.msgh_descriptor_count = 1;
+  send_msg.data.name = attachment;
+  send_msg.data.disposition = MACH_MSG_TYPE_COPY_SEND;
+  send_msg.data.type = MACH_MSG_PORT_DESCRIPTOR;
+
+  return mach_msg(&send_msg.header, opts, send_msg.header.msgh_size, 0,
+                  MACH_PORT_NULL, timeout, MACH_PORT_NULL);
+}
+
+//==============================================================================
+kern_return_t MachReceivePortSendRight(
+    const mozilla::UniqueMachReceiveRight& endpoint,
+    mozilla::Maybe<mach_msg_timeout_t> opt_timeout,
+    mozilla::UniqueMachSendRight* attachment, audit_token_t* audit_token) {
+  mach_msg_option_t opts = MACH_RCV_MSG |
+                           MACH_RCV_TRAILER_TYPE(MACH_MSG_TRAILER_FORMAT_0) |
+                           MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT);
+  mach_msg_timeout_t timeout = MACH_MSG_TIMEOUT_NONE;
+  if (opt_timeout) {
+    opts |= MACH_RCV_TIMEOUT;
+    timeout = *opt_timeout;
+  }
+
+  MachSinglePortMessageTrailer recv_msg{};
+  recv_msg.header.msgh_local_port = endpoint.get();
+  recv_msg.header.msgh_size = sizeof(recv_msg);
+
+  kern_return_t kr =
+      mach_msg(&recv_msg.header, opts, 0, recv_msg.header.msgh_size,
+               endpoint.get(), timeout, MACH_PORT_NULL);
+  if (kr != KERN_SUCCESS) {
+    return kr;
+  }
+
+  if (NS_WARN_IF(!(recv_msg.header.msgh_bits & MACH_MSGH_BITS_COMPLEX)) ||
+      NS_WARN_IF(recv_msg.body.msgh_descriptor_count != 1) ||
+      NS_WARN_IF(recv_msg.data.type != MACH_MSG_PORT_DESCRIPTOR) ||
+      NS_WARN_IF(recv_msg.data.disposition != MACH_MSG_TYPE_MOVE_SEND) ||
+      NS_WARN_IF(recv_msg.header.msgh_size != sizeof(MachSinglePortMessage))) {
+    mach_msg_destroy(&recv_msg.header);
+    return KERN_FAILURE;  // Invalid message format
+  }
+
+  attachment->reset(recv_msg.data.name);
+  if (audit_token) {
+    *audit_token = recv_msg.trailer.msgh_audit;
+  }
+  return KERN_SUCCESS;
+}
diff --git a/ipc/chromium/src/chrome/common/mach_ipc_mac.h b/ipc/chromium/src/chrome/common/mach_ipc_mac.h
new file mode 100644
index 0000000000..c9af70c0c6
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/mach_ipc_mac.h
@@ -0,0 +1,40 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_MACH_IPC_MAC_H_
+#define BASE_MACH_IPC_MAC_H_
+
+#include <mach/mach.h>
+#include <mach/message.h>
+#include <servers/bootstrap.h>
+#include <sys/types.h>
+
+#include "mozilla/Maybe.h"
+#include "mozilla/Result.h"
+#include "mozilla/UniquePtrExtensions.h"
+
+//==============================================================================
+// Helper function for sending a minimal mach IPC messages with a single send
+// right attached. The endpoint will not be consumed unless the
+// `endpoint_disposition` argument is set to a consuming disposition, and
+// `KERN_SUCCESS` is returned.
+kern_return_t MachSendPortSendRight(
+    mach_port_t endpoint, mach_port_t attachment,
+    mozilla::Maybe<mach_msg_timeout_t> opt_timeout,
+    mach_msg_type_name_t endpoint_disposition = MACH_MSG_TYPE_COPY_SEND);
+
+//==============================================================================
+// Helper function for receiving a minimal mach IPC message with a single send
+// right attached.
+// If the `audit_token` parameter is provided, it will be populated with the
+// sender's audit token, which can be used to verify the identity of the sender.
+kern_return_t MachReceivePortSendRight(
+    const mozilla::UniqueMachReceiveRight& endpoint,
+    mozilla::Maybe<mach_msg_timeout_t> opt_timeout,
+    mozilla::UniqueMachSendRight* attachment,
+    audit_token_t* audit_token = nullptr);
+
+#endif  // BASE_MACH_IPC_MAC_H_
diff --git a/ipc/chromium/src/chrome/common/mach_message_source_mac.cc b/ipc/chromium/src/chrome/common/mach_message_source_mac.cc
new file mode 100644
index 0000000000..d3be7efdb5
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/mach_message_source_mac.cc
@@ -0,0 +1,61 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/mach_message_source_mac.h"
+
+#include "base/logging.h"
+
+MachMessageSource::MachMessageSource(mach_port_t port,
+                                     MachPortListener* msg_listener,
+                                     bool* success) {
+  DCHECK(msg_listener);
+  DCHECK(success);
+  DCHECK(port != MACH_PORT_NULL);
+
+  CFMachPortContext port_context = {0};
+  port_context.info = msg_listener;
+
+  scoped_cftyperef<CFMachPortRef> cf_mach_port_ref(CFMachPortCreateWithPort(
+      kCFAllocatorDefault, port, MachMessageSource::OnReceiveMachMessage,
+      &port_context, NULL));
+
+  if (cf_mach_port_ref.get() == NULL) {
+    CHROMIUM_LOG(WARNING) << "CFMachPortCreate failed";
+    *success = false;
+    return;
+  }
+
+  // Create a RL source.
+  machport_runloop_ref_.reset(CFMachPortCreateRunLoopSource(
+      kCFAllocatorDefault, cf_mach_port_ref.get(), 0));
+
+  if (machport_runloop_ref_.get() == NULL) {
+    CHROMIUM_LOG(WARNING) << "CFMachPortCreateRunLoopSource failed";
+    *success = false;
+    return;
+  }
+
+  CFRunLoopAddSource(CFRunLoopGetCurrent(), machport_runloop_ref_.get(),
+                     kCFRunLoopCommonModes);
+  *success = true;
+}
+
+MachMessageSource::~MachMessageSource() {
+  CFRunLoopRemoveSource(CFRunLoopGetCurrent(), machport_runloop_ref_.get(),
+                        kCFRunLoopCommonModes);
+}
+
+// static
+void MachMessageSource::OnReceiveMachMessage(CFMachPortRef port, void* msg,
+                                             CFIndex size, void* closure) {
+  MachPortListener* msg_listener = static_cast<MachPortListener*>(closure);
+  size_t msg_size = (size < 0) ? 0 : static_cast<size_t>(size);
+  DCHECK(msg && msg_size > 0);  // this should never happen!
+
+  if (msg_listener && msg && msg_size > 0) {
+    msg_listener->OnMachMessageReceived(msg, msg_size);
+  }
+}
diff --git a/ipc/chromium/src/chrome/common/mach_message_source_mac.h b/ipc/chromium/src/chrome/common/mach_message_source_mac.h
new file mode 100644
index 0000000000..92ce0a73d4
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/mach_message_source_mac.h
@@ -0,0 +1,60 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_MACH_MESSAGE_SOURCE_MAC_H_
+#define CHROME_COMMON_MACH_MESSAGE_SOURCE_MAC_H_
+
+#include <CoreServices/CoreServices.h>
+
+#include "base/scoped_cftyperef.h"
+
+// Handles registering and cleaning up after a CFRunloopSource for a Mach port.
+// Messages received on the port are piped through to a delegate.
+//
+// Example:
+//  class MyListener : public MachMessageSource::MachPortListener {
+//   public:
+//    void OnMachMessageReceived(void* mach_msg, size_t size) {
+//      printf("received message on Mach port\n");
+//    }
+//  };
+//
+//  mach_port_t a_port = ...;
+//  MyListener listener;
+//  bool success = false;
+//  MachMessageSource message_source(port, listener, &success);
+//
+//  if (!success) {
+//    exit(1);  // Couldn't register mach runloop source.
+//  }
+//
+//  CFRunLoopRun();  // Process messages on runloop...
+class MachMessageSource {
+ public:
+  // Classes that want to listen on a Mach port can implement
+  // OnMachMessageReceived, |mach_msg| is a pointer to the raw message data and
+  // |size| is the buffer size;
+  class MachPortListener {
+   public:
+    virtual void OnMachMessageReceived(void* mach_msg, size_t size) = 0;
+  };
+
+  // |listener| is a week reference passed to CF, it needs to remain in
+  // existence till this object is destroeyd.
+  MachMessageSource(mach_port_t port, MachPortListener* listener,
+                    bool* success);
+  ~MachMessageSource();
+
+ private:
+  // Called by CF when a new message arrives on the Mach port.
+  static void OnReceiveMachMessage(CFMachPortRef port, void* msg, CFIndex size,
+                                   void* closure);
+
+  scoped_cftyperef<CFRunLoopSourceRef> machport_runloop_ref_;
+  DISALLOW_COPY_AND_ASSIGN(MachMessageSource);
+};
+
+#endif  // CHROME_COMMON_MACH_MESSAGE_SOURCE_MAC_H_
diff --git a/ipc/chromium/src/chrome/common/process_watcher.h b/ipc/chromium/src/chrome/common/process_watcher.h
new file mode 100644
index 0000000000..f1ccae6310
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/process_watcher.h
@@ -0,0 +1,38 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_PROCESS_WATCHER_H_
+#define CHROME_COMMON_PROCESS_WATCHER_H_
+
+#include "base/basictypes.h"
+#include "base/process_util.h"
+
+class ProcessWatcher {
+ public:
+  // This method ensures that the specified process eventually terminates, and
+  // then it closes the given process handle.
+  //
+  // It assumes that the process has already been signalled to exit, and it
+  // begins by waiting a small amount of time for it to exit.  If the process
+  // does not appear to have exited, then this function starts to become
+  // aggressive about ensuring that the process terminates.
+  //
+  // This method does not block the calling thread.
+  //
+  // NOTE: The process handle must have been opened with the PROCESS_TERMINATE
+  // and SYNCHRONIZE permissions.
+  //
+  static void EnsureProcessTerminated(base::ProcessHandle process_handle,
+                                      bool force = true);
+
+ private:
+  // Do not instantiate this class.
+  ProcessWatcher();
+
+  DISALLOW_COPY_AND_ASSIGN(ProcessWatcher);
+};
+
+#endif  // CHROME_COMMON_PROCESS_WATCHER_H_
diff --git a/ipc/chromium/src/chrome/common/process_watcher_posix_sigchld.cc b/ipc/chromium/src/chrome/common/process_watcher_posix_sigchld.cc
new file mode 100644
index 0000000000..8f62dfdbda
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/process_watcher_posix_sigchld.cc
@@ -0,0 +1,257 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <errno.h>
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <time.h>
+
+#include "base/eintr_wrapper.h"
+#include "base/message_loop.h"
+#include "base/process_util.h"
+#include "prenv.h"
+
+#include "chrome/common/process_watcher.h"
+
+// Maximum amount of time (in milliseconds) to wait for the process to exit.
+// XXX/cjones: fairly arbitrary, chosen to match process_watcher_win.cc
+static constexpr int kMaxWaitMs = 2000;
+
+// This is also somewhat arbitrary, but loosely based on Try results.
+// See also toolkit.asyncshutdown.crash_timeout (currently 60s) after
+// which the parent process will be killed.
+#ifdef MOZ_CODE_COVERAGE
+// Code coverage instrumentation can be slow (especially when writing
+// out data, which has to take a lock on the data files).
+static constexpr int kShutdownWaitMs = 80000;
+#elif defined(MOZ_ASAN) || defined(MOZ_TSAN)
+// Sanitizers slow things down in some cases; see bug 1806224.
+static constexpr int kShutdownWaitMs = 40000;
+#else
+static constexpr int kShutdownWaitMs = 8000;
+#endif
+
+namespace {
+
+class ChildReaper : public base::MessagePumpLibevent::SignalEvent,
+                    public base::MessagePumpLibevent::SignalWatcher {
+ public:
+  explicit ChildReaper(pid_t process) : process_(process) {}
+
+  virtual ~ChildReaper() {
+    // subclasses should have cleaned up |process_| already
+    DCHECK(!process_);
+
+    // StopCatching() is implicit
+  }
+
+  virtual void OnSignal(int sig) override {
+    DCHECK(SIGCHLD == sig);
+    DCHECK(process_);
+
+    // this may be the SIGCHLD for a process other than |process_|
+    if (base::IsProcessDead(process_)) {
+      process_ = 0;
+      StopCatching();
+    }
+  }
+
+ protected:
+  void WaitForChildExit() {
+    CHECK(process_);
+    while (!base::IsProcessDead(process_, true)) {
+      // It doesn't matter if this is interrupted; we just need to
+      // wait for some amount of time while the other process status
+      // event is (hopefully) handled.  This is used only during an
+      // error case at shutdown, so a 1s wait won't be too noticeable.
+      sleep(1);
+    }
+  }
+
+  pid_t process_;
+
+ private:
+  ChildReaper(const ChildReaper&) = delete;
+
+  const ChildReaper& operator=(const ChildReaper&) = delete;
+};
+
+// Fear the reaper
+class ChildGrimReaper : public ChildReaper, public mozilla::Runnable {
+ public:
+  explicit ChildGrimReaper(pid_t process)
+      : ChildReaper(process), mozilla::Runnable("ChildGrimReaper") {}
+
+  virtual ~ChildGrimReaper() {
+    if (process_) KillProcess();
+  }
+
+  NS_IMETHOD Run() override {
+    // we may have already been signaled by the time this runs
+    if (process_) KillProcess();
+
+    return NS_OK;
+  }
+
+ private:
+  void KillProcess() {
+    DCHECK(process_);
+
+    if (base::IsProcessDead(process_)) {
+      process_ = 0;
+      return;
+    }
+
+    if (0 == kill(process_, SIGKILL)) {
+      // XXX this will block for whatever amount of time it takes the
+      // XXX OS to tear down the process's resources.  might need to
+      // XXX rethink this if it proves expensive
+      WaitForChildExit();
+    } else {
+      CHROMIUM_LOG(ERROR) << "Failed to deliver SIGKILL to " << process_ << "!"
+                          << "(" << errno << ").";
+    }
+    process_ = 0;
+  }
+
+  ChildGrimReaper(const ChildGrimReaper&) = delete;
+
+  const ChildGrimReaper& operator=(const ChildGrimReaper&) = delete;
+};
+
+class ChildLaxReaper : public ChildReaper,
+                       public MessageLoop::DestructionObserver {
+ public:
+  explicit ChildLaxReaper(pid_t process) : ChildReaper(process) {}
+
+  virtual ~ChildLaxReaper() {
+    // WillDestroyCurrentMessageLoop() should have reaped process_ already
+    DCHECK(!process_);
+  }
+
+  virtual void OnSignal(int sig) override {
+    ChildReaper::OnSignal(sig);
+
+    if (!process_) {
+      MessageLoop::current()->RemoveDestructionObserver(this);
+      delete this;
+    }
+  }
+
+  virtual void WillDestroyCurrentMessageLoop() override {
+    DCHECK(process_);
+    if (!process_) {
+      return;
+    }
+
+    // Exception for the fake hang tests in ipc/glue/test/browser
+    if (!PR_GetEnv("MOZ_TEST_CHILD_EXIT_HANG")) {
+      CrashProcessIfHanging();
+    }
+    if (process_) {
+      WaitForChildExit();
+      process_ = 0;
+    }
+
+    // XXX don't think this is necessary, since destruction can only
+    // be observed once, but can't hurt
+    MessageLoop::current()->RemoveDestructionObserver(this);
+    delete this;
+  }
+
+ private:
+  ChildLaxReaper(const ChildLaxReaper&) = delete;
+
+  void CrashProcessIfHanging() {
+    if (base::IsProcessDead(process_)) {
+      process_ = 0;
+      return;
+    }
+
+    // If child processes seems to be hanging on shutdown, wait for a
+    // reasonable time.  The wait is global instead of per-process
+    // because the child processes should be shutting down in
+    // parallel, and also we're potentially racing global timeouts
+    // like nsTerminator.  (The counter doesn't need to be atomic;
+    // this is always called on the I/O thread.)
+    static int sWaitMs = kShutdownWaitMs;
+    if (sWaitMs > 0) {
+      CHROMIUM_LOG(WARNING)
+          << "Process " << process_
+          << " may be hanging at shutdown; will wait for up to " << sWaitMs
+          << "ms";
+    }
+    // There isn't a way to do a time-limited wait that's both
+    // portable and doesn't require messing with signals.  Instead, we
+    // sleep in short increments and poll the process status.
+    while (sWaitMs > 0) {
+      static constexpr int kWaitTickMs = 200;
+      struct timespec ts = {kWaitTickMs / 1000, (kWaitTickMs % 1000) * 1000000};
+      HANDLE_EINTR(nanosleep(&ts, &ts));
+      sWaitMs -= kWaitTickMs;
+
+      if (base::IsProcessDead(process_)) {
+        process_ = 0;
+        return;
+      }
+    }
+
+    // We want TreeHerder to flag this log line as an error, so that
+    // this is more obviously a deliberate crash; "fatal error" is one
+    // of the strings it looks for.
+    CHROMIUM_LOG(ERROR)
+        << "Process " << process_
+        << " hanging at shutdown; attempting crash report (fatal error).";
+
+    kill(process_, SIGABRT);
+  }
+
+  const ChildLaxReaper& operator=(const ChildLaxReaper&) = delete;
+};
+
+}  // namespace
+
+/**
+ * Do everything possible to ensure that |process| has been reaped
+ * before this process exits.
+ *
+ * |grim| decides how strict to be with the child's shutdown.
+ *
+ *                | child exit timeout | upon parent shutdown:
+ *                +--------------------+----------------------------------
+ *   force=true   | 2 seconds          | kill(child, SIGKILL)
+ *   force=false  | infinite           | waitpid(child)
+ *
+ * If a child process doesn't shut down properly, and |grim=false|
+ * used, then the parent will wait on the child forever.  So,
+ * |force=false| is expected to be used when an external entity can be
+ * responsible for terminating hung processes, e.g. automated test
+ * harnesses.
+ */
+void ProcessWatcher::EnsureProcessTerminated(base::ProcessHandle process,
+                                             bool force) {
+  DCHECK(process != base::GetCurrentProcId());
+  DCHECK(process > 0);
+
+  if (base::IsProcessDead(process)) return;
+
+  MessageLoopForIO* loop = MessageLoopForIO::current();
+  if (force) {
+    RefPtr<ChildGrimReaper> reaper = new ChildGrimReaper(process);
+
+    loop->CatchSignal(SIGCHLD, reaper, reaper);
+    // |loop| takes ownership of |reaper|
+    loop->PostDelayedTask(reaper.forget(), kMaxWaitMs);
+  } else {
+    ChildLaxReaper* reaper = new ChildLaxReaper(process);
+
+    loop->CatchSignal(SIGCHLD, reaper, reaper);
+    // |reaper| destroys itself after destruction notification
+    loop->AddDestructionObserver(reaper);
+  }
+}
diff --git a/ipc/chromium/src/chrome/common/process_watcher_win.cc b/ipc/chromium/src/chrome/common/process_watcher_win.cc
new file mode 100644
index 0000000000..2e0efbf6a7
--- /dev/null
+++ b/ipc/chromium/src/chrome/common/process_watcher_win.cc
@@ -0,0 +1,252 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/process_watcher.h"
+
+#include <algorithm>
+#include <processthreadsapi.h>
+#include <synchapi.h>
+#include "base/message_loop.h"
+#include "base/object_watcher.h"
+#include "prenv.h"
+
+// Maximum amount of time (in milliseconds) to wait for the process to exit.
+static constexpr int kWaitInterval = 2000;
+
+// This is somewhat arbitrary, but based on Try run results.  When
+// changing this, be aware of toolkit.asyncshutdown.crash_timeout
+// (currently 60s), after which the parent process will be killed.
+#ifdef MOZ_CODE_COVERAGE
+// Child processes seem to take longer to shut down on ccov builds, at
+// least in the wdspec tests; ~20s has been observed, and we'll spam
+// false positives unless this is increased.
+static constexpr DWORD kShutdownWaitMs = 80000;
+#elif defined(MOZ_ASAN) || defined(MOZ_TSAN)
+// Sanitizers also slow things down in some cases; see bug 1806224.
+static constexpr DWORD kShutdownWaitMs = 40000;
+#else
+static constexpr DWORD kShutdownWaitMs = 8000;
+#endif
+
+namespace {
+
+static bool IsProcessDead(base::ProcessHandle process) {
+  return WaitForSingleObject(process, 0) == WAIT_OBJECT_0;
+}
+
+class ChildReaper : public mozilla::Runnable,
+                    public base::ObjectWatcher::Delegate,
+                    public MessageLoop::DestructionObserver {
+ public:
+  explicit ChildReaper(base::ProcessHandle process, bool force)
+      : mozilla::Runnable("ChildReaper"), process_(process), force_(force) {
+    watcher_.StartWatching(process_, this);
+  }
+
+  virtual ~ChildReaper() {
+    if (process_) {
+      KillProcess();
+      DCHECK(!process_) << "Make sure to close the handle.";
+    }
+  }
+
+  // MessageLoop::DestructionObserver -----------------------------------------
+
+  virtual void WillDestroyCurrentMessageLoop() {
+    MOZ_ASSERT(!force_);
+    if (process_) {
+      // Exception for the fake hang tests in ipc/glue/test/browser
+      if (!PR_GetEnv("MOZ_TEST_CHILD_EXIT_HANG")) {
+        CrashProcessIfHanging();
+      }
+      WaitForSingleObject(process_, INFINITE);
+      base::CloseProcessHandle(process_);
+      process_ = 0;
+
+      MessageLoop::current()->RemoveDestructionObserver(this);
+      delete this;
+    }
+  }
+
+  // Task ---------------------------------------------------------------------
+
+  NS_IMETHOD Run() override {
+    MOZ_ASSERT(force_);
+    if (process_) {
+      KillProcess();
+    }
+    return NS_OK;
+  }
+
+  // MessageLoop::Watcher -----------------------------------------------------
+
+  virtual void OnObjectSignaled(HANDLE object) {
+    // When we're called from KillProcess, the ObjectWatcher may still be
+    // watching.  the process handle, so make sure it has stopped.
+    watcher_.StopWatching();
+
+    base::CloseProcessHandle(process_);
+    process_ = 0;
+
+    if (!force_) {
+      MessageLoop::current()->RemoveDestructionObserver(this);
+      delete this;
+    }
+  }
+
+ private:
+  void KillProcess() {
+    MOZ_ASSERT(force_);
+
+    // OK, time to get frisky.  We don't actually care when the process
+    // terminates.  We just care that it eventually terminates, and that's what
+    // TerminateProcess should do for us. Don't check for the result code since
+    // it fails quite often. This should be investigated eventually.
+    TerminateProcess(process_, base::PROCESS_END_PROCESS_WAS_HUNG);
+
+    // Now, just cleanup as if the process exited normally.
+    OnObjectSignaled(process_);
+  }
+
+  void CrashProcessIfHanging() {
+    if (IsProcessDead(process_)) {
+      return;
+    }
+    DWORD pid = GetProcessId(process_);
+    DCHECK(pid != 0);
+
+    // If child processes seems to be hanging on shutdown, wait for a
+    // reasonable time.  The wait is global instead of per-process
+    // because the child processes should be shutting down in
+    // parallel, and also we're potentially racing global timeouts
+    // like nsTerminator.  (The counter doesn't need to be atomic;
+    // this is always called on the I/O thread.)
+    static DWORD sWaitMs = kShutdownWaitMs;
+    if (sWaitMs > 0) {
+      CHROMIUM_LOG(WARNING)
+          << "Process " << pid
+          << " may be hanging at shutdown; will wait for up to " << sWaitMs
+          << "ms";
+    }
+    const auto beforeWait = mozilla::TimeStamp::NowLoRes();
+    const DWORD waitStatus = WaitForSingleObject(process_, sWaitMs);
+
+    const double elapsed =
+        (mozilla::TimeStamp::NowLoRes() - beforeWait).ToMilliseconds();
+    sWaitMs -= static_cast<DWORD>(
+        std::clamp(elapsed, 0.0, static_cast<double>(sWaitMs)));
+
+    switch (waitStatus) {
+      case WAIT_TIMEOUT:
+        // The process is still running.
+        break;
+      case WAIT_OBJECT_0:
+        // The process exited.
+        return;
+      case WAIT_FAILED:
+        CHROMIUM_LOG(ERROR) << "Waiting for process " << pid
+                            << " failed; error " << GetLastError();
+        DCHECK(false) << "WaitForSingleObject failed";
+        // Process status unclear; assume it's gone.
+        return;
+      default:
+        DCHECK(false) << "WaitForSingleObject returned " << waitStatus;
+        // Again, not clear what's happening so avoid touching the process
+        return;
+    }
+
+    // We want TreeHerder to flag this log line as an error, so that
+    // this is more obviously a deliberate crash; "fatal error" is one
+    // of the strings it looks for.
+    CHROMIUM_LOG(ERROR)
+        << "Process " << pid
+        << " hanging at shutdown; attempting crash report (fatal error)";
+
+    // We're going to use CreateRemoteThread to call DbgBreakPoint in
+    // the target process; it's in a "known DLL" so it should be at
+    // the same address in all processes.  (Normal libraries, like
+    // xul.dll, are usually at the same address but can be relocated
+    // in case of conflict.)
+    //
+    // DbgBreakPoint doesn't take an argument, so we can give it an
+    // arbitrary value to make it easier to identify these crash
+    // reports.  (reinterpret_cast isn't constexpr, so this is
+    // declared as an integer and cast to the required type later.)
+    // The primary use case for all of this is in CI, where we'll also
+    // have log messages, but if these crashes end up in Socorro in
+    // significant numbers then we'll be able to look for this value.
+    static constexpr uint64_t kIpcMagic = 0x43504900435049;
+
+    const HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
+    if (!ntdll) {
+      CHROMIUM_LOG(ERROR) << "couldn't find ntdll.dll: error "
+                          << GetLastError();
+      return;
+    }
+    const auto dbgBreak = reinterpret_cast<LPTHREAD_START_ROUTINE>(
+        GetProcAddress(ntdll, "DbgBreakPoint"));
+    if (!dbgBreak) {
+      CHROMIUM_LOG(ERROR) << "couldn't find DbgBreakPoint: error "
+                          << GetLastError();
+      return;
+    }
+
+    const DWORD rights = PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
+                         PROCESS_VM_OPERATION | PROCESS_VM_WRITE |
+                         PROCESS_VM_READ;
+    HANDLE process_priv = nullptr;
+    if (!DuplicateHandle(GetCurrentProcess(), process_, GetCurrentProcess(),
+                         &process_priv, rights, /* inherit */ FALSE,
+                         /* options */ 0)) {
+      const auto error = GetLastError();
+      CHROMIUM_LOG(ERROR) << "OpenProcess: error " << error;
+    } else {
+      DCHECK(process_priv);
+      HANDLE thread =
+          CreateRemoteThread(process_priv, /* sec attr */ nullptr,
+                             /* stack */ 0, dbgBreak, (LPVOID)kIpcMagic,
+                             /* flags */ 0, nullptr);
+      if (!thread) {
+        const auto error = GetLastError();
+        CHROMIUM_LOG(ERROR) << "CreateRemoteThread: error " << error;
+      } else {
+        CloseHandle(thread);
+      }
+      CloseHandle(process_priv);
+    }
+  }
+
+  // The process that we are watching.
+  base::ProcessHandle process_;
+
+  base::ObjectWatcher watcher_;
+
+  bool force_;
+
+  DISALLOW_EVIL_CONSTRUCTORS(ChildReaper);
+};
+
+}  // namespace
+
+// static
+void ProcessWatcher::EnsureProcessTerminated(base::ProcessHandle process,
+                                             bool force) {
+  DCHECK(process != GetCurrentProcess());
+
+  // If already signaled, then we are done!
+  if (IsProcessDead(process)) {
+    base::CloseProcessHandle(process);
+    return;
+  }
+
+  MessageLoopForIO* loop = MessageLoopForIO::current();
+  if (force) {
+    RefPtr<mozilla::Runnable> task = new ChildReaper(process, force);
+    loop->PostDelayedTask(task.forget(), kWaitInterval);
+  } else {
+    loop->AddDestructionObserver(new ChildReaper(process, force));
+  }
+}