Make members of Singleton<T> private and only visible to the singleton type.

net/socket/dns_cert_provenance_checker.cc

Index: net/socket/dns_cert_provenance_checker.cc
diff --git a/net/socket/dns_cert_provenance_checker.cc b/net/socket/dns_cert_provenance_checker.cc
index 27c4982b5c24cf2699e5516858843b0923c10632..2243755a5cf6df3da7149e2e2efe4f5fec4aaebc 100644
--- a/net/socket/dns_cert_provenance_checker.cc
+++ b/net/socket/dns_cert_provenance_checker.cc
@@ -19,10 +19,10 @@
 #include "base/basictypes.h"
 #include "base/crypto/encryptor.h"
 #include "base/crypto/symmetric_key.h"
+#include "base/lazy_instance.h"
 #include "base/non_thread_safe.h"
 #include "base/pickle.h"
 #include "base/scoped_ptr.h"
-#include "base/singleton.h"
 #include "net/base/completion_callback.h"
 #include "net/base/dns_util.h"
 #include "net/base/dnsrr_resolver.h"
@@ -72,13 +72,16 @@ class DnsCertLimits {
   }
 
  private:
-  friend struct DefaultSingletonTraits<DnsCertLimits>;
+  friend struct base::DefaultLazyInstanceTraits<DnsCertLimits>;
 
   std::set<std::string> uploaded_hostnames_;
 
   DISALLOW_COPY_AND_ASSIGN(DnsCertLimits);
 };
 
+static base::LazyInstance<DnsCertLimits> g_dns_cert_limits(
+    base::LINKER_INITIALIZED);
+
 // DnsCertProvenanceCheck performs the DNS lookup of the certificate. This
 // class is self-deleting.
 class DnsCertProvenanceCheck : public NonThreadSafe {
@@ -105,7 +108,7 @@ class DnsCertProvenanceCheck : public NonThreadSafe {
     if (der_certs_.empty())
       return;
 
-    DnsCertLimits* const limits = Singleton<DnsCertLimits>::get();
+    DnsCertLimits* const limits = g_dns_cert_limits.Pointer();
     if (limits->HaveReachedMaxUploads() ||
         limits->HaveUploadedForHostname(hostname_)) {
       return;
@@ -146,7 +149,7 @@ class DnsCertProvenanceCheck : public NonThreadSafe {
       LOG(ERROR) << "FAILED"
                  << " hostname:" << hostname_
                  << " domain:" << domain_;
-      Singleton<DnsCertLimits>::get()->DidUpload(hostname_);
+      g_dns_cert_limits.Get().DidUpload(hostname_);
       delegate_->OnDnsCertLookupFailed(hostname_, der_certs_);
     } else if (status == OK) {
       LOG(ERROR) << "GOOD"