Convert ReadMessage...() to use the new user pointer handling (see r285350).

mojo/system/message_pipe.h

Index: mojo/system/message_pipe.h
diff --git a/mojo/system/message_pipe.h b/mojo/system/message_pipe.h
index e43dcb667a19482b4b8e89da22b79964cffbe858..82bd7b6a5e2a58451be030eacbc40f307b2a3079 100644
--- a/mojo/system/message_pipe.h
+++ b/mojo/system/message_pipe.h
@@ -16,6 +16,7 @@
 #include "mojo/public/c/system/message_pipe.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/system/dispatcher.h"
+#include "mojo/system/memory.h"
 #include "mojo/system/message_in_transit.h"
 #include "mojo/system/message_pipe_endpoint.h"
 #include "mojo/system/system_impl_export.h"
@@ -56,11 +57,9 @@ class MOJO_SYSTEM_IMPL_EXPORT MessagePipe :
                           uint32_t num_bytes,
                           std::vector<DispatcherTransport>* transports,
                           MojoWriteMessageFlags flags);
-  // Unlike |MessagePipeDispatcher::ReadMessage()|, this does not validate its
-  // arguments.
   MojoResult ReadMessage(unsigned port,
-                         void* bytes,
-                         uint32_t* num_bytes,
+                         UserPointer<void> bytes,
+                         UserPointer<uint32_t> num_bytes,
                          DispatcherVector* dispatchers,
                          uint32_t* num_dispatchers,
                          MojoReadMessageFlags flags);