Convert ReadMessage...() to use the new user pointer handling (see r285350).

mojo/system/message_pipe.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MOJO_SYSTEM_MESSAGE_PIPE_H_
 #define MOJO_SYSTEM_MESSAGE_PIPE_H_
 
 #include <stdint.h>
 
 #include <vector>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/synchronization/lock.h"
 #include "mojo/public/c/system/message_pipe.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/system/dispatcher.h"
+#include "mojo/system/memory.h"
 #include "mojo/system/message_in_transit.h"
 #include "mojo/system/message_pipe_endpoint.h"
 #include "mojo/system/system_impl_export.h"
 
 namespace mojo {
 namespace system {
 
 class Channel;
 class Waiter;
 
@@ skipping 20 matching lines @@
   // corresponding names. In all cases, the port |port| must be open.
   void CancelAllWaiters(unsigned port);
   void Close(unsigned port);
   // Unlike |MessagePipeDispatcher::WriteMessage()|, this does not validate its
   // arguments.
   MojoResult WriteMessage(unsigned port,
                           const void* bytes,
                           uint32_t num_bytes,
                           std::vector<DispatcherTransport>* transports,
                           MojoWriteMessageFlags flags);
-  // Unlike |MessagePipeDispatcher::ReadMessage()|, this does not validate its
-  // arguments.
   MojoResult ReadMessage(unsigned port,
-                         void* bytes,
-                         uint32_t* num_bytes,
+                         UserPointer<void> bytes,
+                         UserPointer<uint32_t> num_bytes,
                          DispatcherVector* dispatchers,
                          uint32_t* num_dispatchers,
                          MojoReadMessageFlags flags);
   MojoResult AddWaiter(unsigned port,
                        Waiter* waiter,
                        MojoHandleSignals signals,
                        uint32_t context);
   void RemoveWaiter(unsigned port, Waiter* waiter);
 
   // This is called by the dispatcher to convert a local endpoint to a proxy
@@ skipping 39 matching lines @@
   base::Lock lock_;  // Protects the following members.
   scoped_ptr<MessagePipeEndpoint> endpoints_[2];
 
   DISALLOW_COPY_AND_ASSIGN(MessagePipe);
 };
 
 }  // namespace system
 }  // namespace mojo
 
 #endif  // MOJO_SYSTEM_MESSAGE_PIPE_H_