Convert ReadMessage...() to use the new user pointer handling (see r285350).

Also add a |PutArray()| method to |UserPointer<>|.

R=darin@chromium.org

Review URL: https://codereview.chromium.org/417303002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@285702 0039d316-1c4b-4281-b951-d872f2087c98

19 files changed, 185 insertions, 214 deletions

diff --git a/mojo/system/core.cc b/mojo/system/core.cc
index 641bcd7..053c3fa 100644
--- a/mojo/system/core.cc
+++ b/mojo/system/core.cc
@@ -273,13 +273,11 @@ MojoResult Core::ReadMessage(MojoHandle message_pipe_handle,
   MojoResult rv;
   if (num_handles_value == 0) {
     // Easy case: won't receive any handles.
-    rv = dispatcher->ReadMessage(bytes.GetPointerUnsafe(),
-                                 num_bytes.GetPointerUnsafe(), NULL,
-                                 &num_handles_value, flags);
+    rv = dispatcher->ReadMessage(bytes, num_bytes, NULL, &num_handles_value,
+                                 flags);
   } else {
     DispatcherVector dispatchers;
-    rv = dispatcher->ReadMessage(bytes.GetPointerUnsafe(),
-                                 num_bytes.GetPointerUnsafe(), &dispatchers,
+    rv = dispatcher->ReadMessage(bytes, num_bytes, &dispatchers,
                                  &num_handles_value, flags);
     if (!dispatchers.empty()) {
       DCHECK_EQ(rv, MOJO_RESULT_OK);
diff --git a/mojo/system/core_test_base.cc b/mojo/system/core_test_base.cc
index bde8c69..2fbcc98 100644
--- a/mojo/system/core_test_base.cc
+++ b/mojo/system/core_test_base.cc
@@ -66,17 +66,14 @@ class MockDispatcher : public Dispatcher {
   }
 
   virtual MojoResult ReadMessageImplNoLock(
-      void* bytes,
-      uint32_t* num_bytes,
+      UserPointer<void> bytes,
+      UserPointer<uint32_t> num_bytes,
       DispatcherVector* dispatchers,
       uint32_t* num_dispatchers,
       MojoReadMessageFlags /*flags*/) OVERRIDE {
     info_->IncrementReadMessageCallCount();
     lock().AssertAcquired();
 
-    if (num_bytes && !VerifyUserPointerWithSize<1>(bytes, *num_bytes))
-      return MOJO_RESULT_INVALID_ARGUMENT;
-
     if (num_dispatchers) {
       *num_dispatchers = 1;
       if (dispatchers) {
diff --git a/mojo/system/core_unittest.cc b/mojo/system/core_unittest.cc
index 59ff1c8..88d7f6d 100644
--- a/mojo/system/core_unittest.cc
+++ b/mojo/system/core_unittest.cc
@@ -54,18 +54,11 @@ TEST_F(CoreTest, Basic) {
                                 NullUserPointer(),
                                 MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(1u, info.GetReadMessageCallCount());
-  num_bytes = 1;
-  EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
-            core()->ReadMessage(h, NullUserPointer(),
-                                MakeUserPointer(&num_bytes), NullUserPointer(),
-                                NullUserPointer(),
-                                MOJO_READ_MESSAGE_FLAG_NONE));
-  EXPECT_EQ(2u, info.GetReadMessageCallCount());
   EXPECT_EQ(MOJO_RESULT_OK,
             core()->ReadMessage(h, NullUserPointer(), NullUserPointer(),
                                 NullUserPointer(), NullUserPointer(),
                                 MOJO_READ_MESSAGE_FLAG_NONE));
-  EXPECT_EQ(3u, info.GetReadMessageCallCount());
+  EXPECT_EQ(2u, info.GetReadMessageCallCount());
 
   EXPECT_EQ(0u, info.GetWriteDataCallCount());
   EXPECT_EQ(MOJO_RESULT_UNIMPLEMENTED,
diff --git a/mojo/system/dispatcher.cc b/mojo/system/dispatcher.cc
index 1c58c87..964d32f 100644
--- a/mojo/system/dispatcher.cc
+++ b/mojo/system/dispatcher.cc
@@ -120,8 +120,8 @@ MojoResult Dispatcher::WriteMessage(
   return WriteMessageImplNoLock(bytes, num_bytes, transports, flags);
 }
 
-MojoResult Dispatcher::ReadMessage(void* bytes,
-                                   uint32_t* num_bytes,
+MojoResult Dispatcher::ReadMessage(UserPointer<void> bytes,
+                                   UserPointer<uint32_t> num_bytes,
                                    DispatcherVector* dispatchers,
                                    uint32_t* num_dispatchers,
     MojoReadMessageFlags flags) {
@@ -265,11 +265,12 @@ MojoResult Dispatcher::WriteMessageImplNoLock(
   return MOJO_RESULT_INVALID_ARGUMENT;
 }
 
-MojoResult Dispatcher::ReadMessageImplNoLock(void* /*bytes*/,
-                                             uint32_t* /*num_bytes*/,
-                                             DispatcherVector* /*dispatchers*/,
-                                             uint32_t* /*num_dispatchers*/,
-                                             MojoReadMessageFlags /*flags*/) {
+MojoResult Dispatcher::ReadMessageImplNoLock(
+    UserPointer<void> /*bytes*/,
+    UserPointer<uint32_t> /*num_bytes*/,
+    DispatcherVector* /*dispatchers*/,
+    uint32_t* /*num_dispatchers*/,
+    MojoReadMessageFlags /*flags*/) {
   lock_.AssertAcquired();
   DCHECK(!is_closed_);
   // By default, not supported. Only needed for message pipe dispatchers.
diff --git a/mojo/system/dispatcher.h b/mojo/system/dispatcher.h
index 6a43740..dd5e2404 100644
--- a/mojo/system/dispatcher.h
+++ b/mojo/system/dispatcher.h
@@ -87,8 +87,8 @@ class MOJO_SYSTEM_IMPL_EXPORT Dispatcher :
   // |dispatchers| must be non-null but empty, if |num_dispatchers| is non-null
   // and nonzero. On success, it will be set to the dispatchers to be received
   // (and assigned handles) as part of the message.
-  MojoResult ReadMessage(void* bytes,
-                         uint32_t* num_bytes,
+  MojoResult ReadMessage(UserPointer<void> bytes,
+                         UserPointer<uint32_t> num_bytes,
                          DispatcherVector* dispatchers,
                          uint32_t* num_dispatchers,
                          MojoReadMessageFlags flags);
@@ -217,8 +217,8 @@ class MOJO_SYSTEM_IMPL_EXPORT Dispatcher :
       uint32_t num_bytes,
       std::vector<DispatcherTransport>* transports,
       MojoWriteMessageFlags flags);
-  virtual MojoResult ReadMessageImplNoLock(void* bytes,
-                                           uint32_t* num_bytes,
+  virtual MojoResult ReadMessageImplNoLock(UserPointer<void> bytes,
+                                           UserPointer<uint32_t> num_bytes,
                                            DispatcherVector* dispatchers,
                                            uint32_t* num_dispatchers,
                                            MojoReadMessageFlags flags);
diff --git a/mojo/system/dispatcher_unittest.cc b/mojo/system/dispatcher_unittest.cc
index f301f90..4f7b5db 100644
--- a/mojo/system/dispatcher_unittest.cc
+++ b/mojo/system/dispatcher_unittest.cc
@@ -48,7 +48,7 @@ TEST(DispatcherTest, Basic) {
   EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
             d->WriteMessage(NULL, 0, NULL, MOJO_WRITE_MESSAGE_FLAG_NONE));
   EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
-            d->ReadMessage(NULL, NULL, NULL, NULL,
+            d->ReadMessage(NullUserPointer(), NullUserPointer(), NULL, NULL,
                            MOJO_WRITE_MESSAGE_FLAG_NONE));
   EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
             d->WriteData(NULL, NULL, MOJO_WRITE_DATA_FLAG_NONE));
@@ -77,7 +77,7 @@ TEST(DispatcherTest, Basic) {
   EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
             d->WriteMessage(NULL, 0, NULL, MOJO_WRITE_MESSAGE_FLAG_NONE));
   EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
-            d->ReadMessage(NULL, NULL, NULL, NULL,
+            d->ReadMessage(NullUserPointer(), NullUserPointer(), NULL, NULL,
                            MOJO_WRITE_MESSAGE_FLAG_NONE));
   EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
             d->WriteData(NULL, NULL, MOJO_WRITE_DATA_FLAG_NONE));
@@ -152,7 +152,8 @@ class ThreadSafetyStressThread : public base::SimpleThread {
         break;
       case READ_MESSAGE:
         EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
-                  dispatcher_->ReadMessage(NULL, NULL, NULL, NULL,
+                  dispatcher_->ReadMessage(NullUserPointer(), NullUserPointer(),
+                                           NULL, NULL,
                                            MOJO_WRITE_MESSAGE_FLAG_NONE));
         break;
       case WRITE_DATA:
diff --git a/mojo/system/local_message_pipe_endpoint.cc b/mojo/system/local_message_pipe_endpoint.cc
index 09decd3..3cbc712 100644
--- a/mojo/system/local_message_pipe_endpoint.cc
+++ b/mojo/system/local_message_pipe_endpoint.cc
@@ -63,15 +63,16 @@ void LocalMessagePipeEndpoint::CancelAllWaiters() {
   waiter_list_.CancelAllWaiters();
 }
 
-MojoResult LocalMessagePipeEndpoint::ReadMessage(void* bytes,
-                                                 uint32_t* num_bytes,
-                                                 DispatcherVector* dispatchers,
-                                                 uint32_t* num_dispatchers,
-                                                 MojoReadMessageFlags flags) {
+MojoResult LocalMessagePipeEndpoint::ReadMessage(
+    UserPointer<void> bytes,
+    UserPointer<uint32_t> num_bytes,
+    DispatcherVector* dispatchers,
+    uint32_t* num_dispatchers,
+    MojoReadMessageFlags flags) {
   DCHECK(is_open_);
   DCHECK(!dispatchers || dispatchers->empty());
 
-  const uint32_t max_bytes = num_bytes ? *num_bytes : 0;
+  const uint32_t max_bytes = num_bytes.IsNull() ? 0 : num_bytes.Get();
   const uint32_t max_num_dispatchers = num_dispatchers ? *num_dispatchers : 0;
 
   if (message_queue_.IsEmpty()) {
@@ -83,10 +84,10 @@ MojoResult LocalMessagePipeEndpoint::ReadMessage(void* bytes,
   // and release the lock immediately.
   bool enough_space = true;
   MessageInTransit* message = message_queue_.PeekMessage();
-  if (num_bytes)
-    *num_bytes = message->num_bytes();
+  if (!num_bytes.IsNull())
+    num_bytes.Put(message->num_bytes());
   if (message->num_bytes() <= max_bytes)
-    memcpy(bytes, message->bytes(), message->num_bytes());
+    bytes.PutArray(message->bytes(), message->num_bytes());
   else
     enough_space = false;
 
diff --git a/mojo/system/local_message_pipe_endpoint.h b/mojo/system/local_message_pipe_endpoint.h
index 4e59cfb..1d3a076 100644
--- a/mojo/system/local_message_pipe_endpoint.h
+++ b/mojo/system/local_message_pipe_endpoint.h
@@ -31,8 +31,8 @@ class MOJO_SYSTEM_IMPL_EXPORT LocalMessagePipeEndpoint
   // implement/override these:
   virtual void Close() OVERRIDE;
   virtual void CancelAllWaiters() OVERRIDE;
-  virtual MojoResult ReadMessage(void* bytes,
-                                 uint32_t* num_bytes,
+  virtual MojoResult ReadMessage(UserPointer<void> bytes,
+                                 UserPointer<uint32_t> num_bytes,
                                  DispatcherVector* dispatchers,
                                  uint32_t* num_dispatchers,
                                  MojoReadMessageFlags flags) OVERRIDE;
diff --git a/mojo/system/memory.h b/mojo/system/memory.h
index e19bfa8..0d23573 100644
--- a/mojo/system/memory.h
+++ b/mojo/system/memory.h
@@ -89,6 +89,9 @@ struct NullUserPointer {};
 // in-out parameters (in which case the |Put()| method is available).
 template <typename Type>
 class UserPointer {
+ private:
+  typedef typename internal::VoidToChar<Type>::type NonVoidType;
+
  public:
   // Instead of explicitly using these constructors, you can often use
   // |MakeUserPointer()| (or |NullUserPointer()| for null pointers). (The common
@@ -115,13 +118,24 @@ class UserPointer {
     return !pointer_;
   }
 
-  // We want to force a copy here, so return |Type| not |const Type&|.
+  // Gets the value (of type |Type|) pointed to by this user pointer. Use this
+  // when you'd use the rvalue |*user_pointer|, but be aware that this may be
+  // costly -- so if the value will be used multiple times, you should save it.
+  //
+  // (We want to force a copy here, so return |Type| not |const Type&|.)
   Type Get() const {
     internal::CheckUserPointerHelper<sizeof(Type),
                                      MOJO_ALIGNOF(Type)>(pointer_);
     return *pointer_;
   }
 
+  // TODO(vtl): Add a |GetArray()| method (see |PutArray()|).
+
+  // Puts a value (of type |Type|, or of type |char| if |Type| is |void|) to the
+  // location pointed to by this user pointer. Use this when you'd use the
+  // lvalue |*user_pointer|. Since this may be costly, you should avoid using
+  // this (for the same user pointer) more than once.
+  //
   // Note: This |Put()| method is not valid when |T| is const, e.g., |const
   // uint32_t|, but it's okay to include them so long as this template is only
   // implicitly instantiated (see 14.7.1 of the C++11 standard) and not
@@ -138,12 +152,29 @@ class UserPointer {
   //       const _Type& value) { ... }
   // (which obviously be correct), but C++03 doesn't allow default function
   // template arguments.
-  void Put(const typename internal::VoidToChar<Type>::type& value) {
-    internal::CheckUserPointerHelper<sizeof(Type),
-                                     MOJO_ALIGNOF(Type)>(pointer_);
+  void Put(const NonVoidType& value) {
+    internal::CheckUserPointerHelper<sizeof(NonVoidType),
+                                     MOJO_ALIGNOF(NonVoidType)>(pointer_);
     *pointer_ = value;
   }
 
+  // Puts an array (of type |Type|, or just a buffer if |Type| is |void|) and
+  // size |count| (number of elements, or number of bytes if |Type| is |void|)
+  // to the location pointed to by this user pointer. Use this when you'd do
+  // something like |memcpy(user_pointer, source, count * sizeof(Type))|.
+  //
+  // Note: The same comments about the validity of |Put()| (except for the part
+  // about |void|) apply here.
+  void PutArray(const Type* source, size_t count) {
+    internal::CheckUserPointerWithCountHelper<sizeof(NonVoidType),
+                                              MOJO_ALIGNOF(NonVoidType)>(source,
+                                                                         count);
+    memcpy(pointer_, source, count * sizeof(NonVoidType));
+  }
+
+  // Gets a |UserPointer| at offset |i| (in |Type|s) relative to this. This
+  // method is not valid if |Type| is |void| (TODO(vtl): Maybe I should make it
+  // valid, with the offset in bytes?).
   UserPointer At(size_t i) const {
     return UserPointer(pointer_ + i);
   }
diff --git a/mojo/system/message_pipe.cc b/mojo/system/message_pipe.cc
index c297f38..a301c8f 100644
--- a/mojo/system/message_pipe.cc
+++ b/mojo/system/message_pipe.cc
@@ -83,8 +83,8 @@ MojoResult MessagePipe::WriteMessage(
 }
 
 MojoResult MessagePipe::ReadMessage(unsigned port,
-                                    void* bytes,
-                                    uint32_t* num_bytes,
+                                    UserPointer<void> bytes,
+                                    UserPointer<uint32_t> num_bytes,
                                     DispatcherVector* dispatchers,
                                     uint32_t* num_dispatchers,
                                     MojoReadMessageFlags flags) {
diff --git a/mojo/system/message_pipe.h b/mojo/system/message_pipe.h
index e43dcb6..82bd7b6 100644
--- a/mojo/system/message_pipe.h
+++ b/mojo/system/message_pipe.h
@@ -16,6 +16,7 @@
 #include "mojo/public/c/system/message_pipe.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/system/dispatcher.h"
+#include "mojo/system/memory.h"
 #include "mojo/system/message_in_transit.h"
 #include "mojo/system/message_pipe_endpoint.h"
 #include "mojo/system/system_impl_export.h"
@@ -56,11 +57,9 @@ class MOJO_SYSTEM_IMPL_EXPORT MessagePipe :
                           uint32_t num_bytes,
                           std::vector<DispatcherTransport>* transports,
                           MojoWriteMessageFlags flags);
-  // Unlike |MessagePipeDispatcher::ReadMessage()|, this does not validate its
-  // arguments.
   MojoResult ReadMessage(unsigned port,
-                         void* bytes,
-                         uint32_t* num_bytes,
+                         UserPointer<void> bytes,
+                         UserPointer<uint32_t> num_bytes,
                          DispatcherVector* dispatchers,
                          uint32_t* num_dispatchers,
                          MojoReadMessageFlags flags);
diff --git a/mojo/system/message_pipe_dispatcher.cc b/mojo/system/message_pipe_dispatcher.cc
index 484613c..6e32d03 100644
--- a/mojo/system/message_pipe_dispatcher.cc
+++ b/mojo/system/message_pipe_dispatcher.cc
@@ -198,20 +198,12 @@ MojoResult MessagePipeDispatcher::WriteMessageImplNoLock(
 }
 
 MojoResult MessagePipeDispatcher::ReadMessageImplNoLock(
-    void* bytes,
-    uint32_t* num_bytes,
+    UserPointer<void> bytes,
+    UserPointer<uint32_t> num_bytes,
     DispatcherVector* dispatchers,
     uint32_t* num_dispatchers,
     MojoReadMessageFlags flags) {
   lock().AssertAcquired();
-
-  if (num_bytes) {
-    if (!VerifyUserPointer<uint32_t>(num_bytes))
-      return MOJO_RESULT_INVALID_ARGUMENT;
-    if (!VerifyUserPointerWithSize<1>(bytes, *num_bytes))
-      return MOJO_RESULT_INVALID_ARGUMENT;
-  }
-
   return message_pipe_->ReadMessage(port_, bytes, num_bytes, dispatchers,
                                     num_dispatchers, flags);
 }
diff --git a/mojo/system/message_pipe_dispatcher.h b/mojo/system/message_pipe_dispatcher.h
index d3a3946..b5bc19c 100644
--- a/mojo/system/message_pipe_dispatcher.h
+++ b/mojo/system/message_pipe_dispatcher.h
@@ -83,8 +83,8 @@ class MOJO_SYSTEM_IMPL_EXPORT MessagePipeDispatcher : public Dispatcher {
       uint32_t num_bytes,
       std::vector<DispatcherTransport>* transports,
       MojoWriteMessageFlags flags) OVERRIDE;
-  virtual MojoResult ReadMessageImplNoLock(void* bytes,
-                                           uint32_t* num_bytes,
+  virtual MojoResult ReadMessageImplNoLock(UserPointer<void> bytes,
+                                           UserPointer<uint32_t> num_bytes,
                                            DispatcherVector* dispatchers,
                                            uint32_t* num_dispatchers,
                                            MojoReadMessageFlags flags) OVERRIDE;
diff --git a/mojo/system/message_pipe_dispatcher_unittest.cc b/mojo/system/message_pipe_dispatcher_unittest.cc
index 95f5bf8..675adcb 100644
--- a/mojo/system/message_pipe_dispatcher_unittest.cc
+++ b/mojo/system/message_pipe_dispatcher_unittest.cc
@@ -82,8 +82,8 @@ TEST(MessagePipeDispatcherTest, Basic) {
     buffer[0] = 0;
     buffer_size = kBufferSize;
     EXPECT_EQ(MOJO_RESULT_OK,
-              d0->ReadMessage(buffer, &buffer_size,
-                              0, NULL,
+              d0->ReadMessage(UserPointer<void>(buffer),
+                              MakeUserPointer(&buffer_size), 0, NULL,
                               MOJO_READ_MESSAGE_FLAG_NONE));
     EXPECT_EQ(kBufferSize, buffer_size);
     EXPECT_EQ(123456789, buffer[0]);
@@ -139,14 +139,6 @@ TEST(MessagePipeDispatcherTest, InvalidParams) {
                              NULL,
                              MOJO_WRITE_MESSAGE_FLAG_NONE));
 
-  // |ReadMessage|:
-  // Null buffer with nonzero buffer size.
-  uint32_t buffer_size = 1;
-  EXPECT_EQ(MOJO_RESULT_INVALID_ARGUMENT,
-            d0->ReadMessage(NULL, &buffer_size,
-                            0, NULL,
-                            MOJO_READ_MESSAGE_FLAG_NONE));
-
   EXPECT_EQ(MOJO_RESULT_OK, d0->Close());
   EXPECT_EQ(MOJO_RESULT_OK, d1->Close());
 }
@@ -191,8 +183,8 @@ TEST(MessagePipeDispatcherTest, BasicClosed) {
     buffer[0] = 0;
     buffer_size = kBufferSize;
     EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-              d1->ReadMessage(buffer, &buffer_size,
-                              0, NULL,
+              d1->ReadMessage(UserPointer<void>(buffer),
+                              MakeUserPointer(&buffer_size), 0, NULL,
                               MOJO_READ_MESSAGE_FLAG_NONE));
 
     // Close |d1|.
@@ -207,8 +199,8 @@ TEST(MessagePipeDispatcherTest, BasicClosed) {
     buffer[0] = 0;
     buffer_size = kBufferSize;
     EXPECT_EQ(MOJO_RESULT_OK,
-              d0->ReadMessage(buffer, &buffer_size,
-                              0, NULL,
+              d0->ReadMessage(UserPointer<void>(buffer),
+                              MakeUserPointer(&buffer_size), 0, NULL,
                               MOJO_READ_MESSAGE_FLAG_NONE));
     EXPECT_EQ(kBufferSize, buffer_size);
     EXPECT_EQ(123456789, buffer[0]);
@@ -222,8 +214,8 @@ TEST(MessagePipeDispatcherTest, BasicClosed) {
     buffer[0] = 0;
     buffer_size = kBufferSize;
     EXPECT_EQ(MOJO_RESULT_OK,
-              d0->ReadMessage(buffer, &buffer_size,
-                              0, NULL,
+              d0->ReadMessage(UserPointer<void>(buffer),
+                              MakeUserPointer(&buffer_size), 0, NULL,
                               MOJO_READ_MESSAGE_FLAG_NONE));
     EXPECT_EQ(kBufferSize, buffer_size);
     EXPECT_EQ(234567890, buffer[0]);
@@ -243,8 +235,8 @@ TEST(MessagePipeDispatcherTest, BasicClosed) {
     buffer[0] = 0;
     buffer_size = kBufferSize;
     EXPECT_EQ(MOJO_RESULT_FAILED_PRECONDITION,
-              d0->ReadMessage(buffer, &buffer_size,
-                              0, NULL,
+              d0->ReadMessage(UserPointer<void>(buffer),
+                              MakeUserPointer(&buffer_size), 0, NULL,
                               MOJO_READ_MESSAGE_FLAG_NONE));
 
     // Try writing to |d0|; should fail (other end closed).
@@ -328,8 +320,8 @@ TEST(MessagePipeDispatcherTest, MAYBE_BasicThreaded) {
     buffer[0] = 0;
     buffer_size = kBufferSize;
     EXPECT_EQ(MOJO_RESULT_OK,
-              d1->ReadMessage(buffer, &buffer_size,
-                              0, NULL,
+              d1->ReadMessage(UserPointer<void>(buffer),
+                              MakeUserPointer(&buffer_size), 0, NULL,
                               MOJO_READ_MESSAGE_FLAG_NONE));
     EXPECT_EQ(kBufferSize, buffer_size);
     EXPECT_EQ(123456789, buffer[0]);
@@ -489,9 +481,9 @@ class ReaderThread : public base::SimpleThread {
       // Clear the buffer so that we can check the result.
       memset(buffer, 0, sizeof(buffer));
       uint32_t buffer_size = static_cast<uint32_t>(sizeof(buffer));
-      result = read_dispatcher_->ReadMessage(buffer, &buffer_size,
-                                             0, NULL,
-                                             MOJO_READ_MESSAGE_FLAG_NONE);
+      result = read_dispatcher_->ReadMessage(UserPointer<void>(buffer),
+                                             MakeUserPointer(&buffer_size), 0,
+                                             NULL, MOJO_READ_MESSAGE_FLAG_NONE);
       EXPECT_TRUE(result == MOJO_RESULT_OK ||
                   result == MOJO_RESULT_SHOULD_WAIT) << "result: " << result;
       // We're racing with others to read, so maybe we failed.
diff --git a/mojo/system/message_pipe_endpoint.cc b/mojo/system/message_pipe_endpoint.cc
index f5ccfc7..ccb100c 100644
--- a/mojo/system/message_pipe_endpoint.cc
+++ b/mojo/system/message_pipe_endpoint.cc
@@ -18,8 +18,8 @@ void MessagePipeEndpoint::CancelAllWaiters() {
   NOTREACHED();
 }
 
-MojoResult MessagePipeEndpoint::ReadMessage(void* /*bytes*/,
-                                            uint32_t* /*num_bytes*/,
+MojoResult MessagePipeEndpoint::ReadMessage(UserPointer<void> /*bytes*/,
+                                            UserPointer<uint32_t> /*num_bytes*/,
                                             DispatcherVector* /*dispatchers*/,
                                             uint32_t* /*num_dispatchers*/,
                                             MojoReadMessageFlags /*flags*/) {
diff --git a/mojo/system/message_pipe_endpoint.h b/mojo/system/message_pipe_endpoint.h
index 7da65f0..8ba1b81 100644
--- a/mojo/system/message_pipe_endpoint.h
+++ b/mojo/system/message_pipe_endpoint.h
@@ -15,6 +15,7 @@
 #include "mojo/public/c/system/message_pipe.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/system/dispatcher.h"
+#include "mojo/system/memory.h"
 #include "mojo/system/message_in_transit.h"
 #include "mojo/system/system_impl_export.h"
 
@@ -61,8 +62,8 @@ class MOJO_SYSTEM_IMPL_EXPORT MessagePipeEndpoint {
   // operation involves both endpoints.
   virtual void Close();
   virtual void CancelAllWaiters();
-  virtual MojoResult ReadMessage(void* bytes,
-                                 uint32_t* num_bytes,
+  virtual MojoResult ReadMessage(UserPointer<void> bytes,
+                                 UserPointer<uint32_t> num_bytes,
                                  DispatcherVector* dispatchers,
                                  uint32_t* num_dispatchers,
                                  MojoReadMessageFlags flags);
diff --git a/mojo/system/message_pipe_unittest.cc b/mojo/system/message_pipe_unittest.cc
index f6a76dc..523e57d 100644
--- a/mojo/system/message_pipe_unittest.cc
+++ b/mojo/system/message_pipe_unittest.cc
@@ -39,9 +39,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(kBufferSize, buffer_size);
   EXPECT_EQ(123, buffer[0]);
@@ -52,9 +51,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
 
   // Write from port 1 (to port 0).
@@ -71,9 +69,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
   EXPECT_EQ(789012345, buffer[0]);
@@ -82,9 +79,8 @@ TEST(MessagePipeTest, Basic) {
   // Read again from port 0 -- it should be empty.
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
 
   // Write two messages from port 0 (to port 1).
@@ -107,8 +103,7 @@ TEST(MessagePipeTest, Basic) {
   // Also test that giving a null buffer is okay when the buffer size is 0.
   buffer_size = 0;
   EXPECT_EQ(MOJO_RESULT_RESOURCE_EXHAUSTED,
-            mp->ReadMessage(1,
-                            NULL, &buffer_size,
+            mp->ReadMessage(1, NullUserPointer(), MakeUserPointer(&buffer_size),
                             0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
@@ -119,9 +114,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = 1;
   EXPECT_EQ(MOJO_RESULT_RESOURCE_EXHAUSTED,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
   EXPECT_EQ(123, buffer[0]);
@@ -132,9 +126,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
   EXPECT_EQ(123456789, buffer[0]);
@@ -145,9 +138,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
   EXPECT_EQ(234567890, buffer[0]);
@@ -156,9 +148,8 @@ TEST(MessagePipeTest, Basic) {
   // Read again from port 1 -- it should be empty.
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
 
   // Write from port 0 (to port 1).
@@ -187,9 +178,8 @@ TEST(MessagePipeTest, Basic) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
   EXPECT_EQ(345678901, buffer[0]);
@@ -198,9 +188,8 @@ TEST(MessagePipeTest, Basic) {
   // Read again from port 1 -- it should be empty (and port 0 is closed).
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_FAILED_PRECONDITION,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
 
   mp->Close(1);
@@ -226,8 +215,7 @@ TEST(MessagePipeTest, CloseWithQueuedIncomingMessages) {
   // Port 0 shouldn't be empty.
   buffer_size = 0;
   EXPECT_EQ(MOJO_RESULT_RESOURCE_EXHAUSTED,
-            mp->ReadMessage(0,
-                            NULL, &buffer_size,
+            mp->ReadMessage(0, NullUserPointer(), MakeUserPointer(&buffer_size),
                             0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(kBufferSize, buffer_size);
@@ -256,8 +244,7 @@ TEST(MessagePipeTest, DiscardMode) {
   // Read/discard from port 0 (no buffer); get size.
   buffer_size = 0;
   EXPECT_EQ(MOJO_RESULT_RESOURCE_EXHAUSTED,
-            mp->ReadMessage(0,
-                            NULL, &buffer_size,
+            mp->ReadMessage(0, NullUserPointer(), MakeUserPointer(&buffer_size),
                             0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
@@ -265,9 +252,8 @@ TEST(MessagePipeTest, DiscardMode) {
   // Read again from port 0 -- it should be empty.
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
 
   // Write from port 1 (to port 0).
@@ -284,9 +270,8 @@ TEST(MessagePipeTest, DiscardMode) {
   buffer[1] = 456;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
   EXPECT_EQ(890123456, buffer[0]);
@@ -295,9 +280,8 @@ TEST(MessagePipeTest, DiscardMode) {
   // Read again from port 0 -- it should be empty.
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
 
   // Write from port 1 (to port 0).
@@ -312,18 +296,16 @@ TEST(MessagePipeTest, DiscardMode) {
   // Read/discard from port 0 (buffer too small); get size.
   buffer_size = 1;
   EXPECT_EQ(MOJO_RESULT_RESOURCE_EXHAUSTED,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
   EXPECT_EQ(static_cast<uint32_t>(sizeof(buffer[0])), buffer_size);
 
   // Read again from port 0 -- it should be empty.
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
 
   // Write from port 1 (to port 0).
@@ -338,17 +320,14 @@ TEST(MessagePipeTest, DiscardMode) {
   // Discard from port 0.
   buffer_size = 1;
   EXPECT_EQ(MOJO_RESULT_RESOURCE_EXHAUSTED,
-            mp->ReadMessage(0,
-                            NULL, NULL,
-                            0, NULL,
+            mp->ReadMessage(0, NullUserPointer(), NullUserPointer(), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
 
   // Read again from port 0 -- it should be empty.
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp->ReadMessage(0,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(0, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_MAY_DISCARD));
 
   mp->Close(0);
@@ -423,9 +402,8 @@ TEST(MessagePipeTest, BasicWaiting) {
   buffer[0] = 0;
   buffer_size = kBufferSize;
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(1,
-                            buffer, &buffer_size,
-                            0, NULL,
+            mp->ReadMessage(1, UserPointer<void>(buffer),
+                            MakeUserPointer(&buffer_size), 0, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(123456789, buffer[0]);
 
diff --git a/mojo/system/multiprocess_message_pipe_unittest.cc b/mojo/system/multiprocess_message_pipe_unittest.cc
index c3305c1..729c64b 100644
--- a/mojo/system/multiprocess_message_pipe_unittest.cc
+++ b/mojo/system/multiprocess_message_pipe_unittest.cc
@@ -169,9 +169,8 @@ MOJO_MULTIPROCESS_TEST_CHILD_MAIN(EchoEcho) {
 
     std::string read_buffer(1000, '\0');
     uint32_t read_buffer_size = static_cast<uint32_t>(read_buffer.size());
-    CHECK_EQ(mp->ReadMessage(0,
-                             &read_buffer[0], &read_buffer_size,
-                             NULL, NULL,
+    CHECK_EQ(mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                             MakeUserPointer(&read_buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE),
              MOJO_RESULT_OK);
     read_buffer.resize(read_buffer_size);
@@ -215,9 +214,8 @@ TEST_F(MultiprocessMessagePipeTest, Basic) {
 
   std::string read_buffer(1000, '\0');
   uint32_t read_buffer_size = static_cast<uint32_t>(read_buffer.size());
-  CHECK_EQ(mp->ReadMessage(0,
-                           &read_buffer[0], &read_buffer_size,
-                           NULL, NULL,
+  CHECK_EQ(mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                           MakeUserPointer(&read_buffer_size), NULL, NULL,
                            MOJO_READ_MESSAGE_FLAG_NONE),
            MOJO_RESULT_OK);
   read_buffer.resize(read_buffer_size);
@@ -264,9 +262,8 @@ TEST_F(MultiprocessMessagePipeTest, QueueMessages) {
 
     std::string read_buffer(kNumMessages * 2, '\0');
     uint32_t read_buffer_size = static_cast<uint32_t>(read_buffer.size());
-    CHECK_EQ(mp->ReadMessage(0,
-                             &read_buffer[0], &read_buffer_size,
-                             NULL, NULL,
+    CHECK_EQ(mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                             MakeUserPointer(&read_buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE),
              MOJO_RESULT_OK);
     read_buffer.resize(read_buffer_size);
@@ -303,10 +300,9 @@ MOJO_MULTIPROCESS_TEST_CHILD_MAIN(CheckSharedBuffer) {
   uint32_t num_bytes = static_cast<uint32_t>(read_buffer.size());
   DispatcherVector dispatchers;
   uint32_t num_dispatchers = 10;  // Maximum number to receive.
-  CHECK_EQ(mp->ReadMessage(0,
-                           &read_buffer[0], &num_bytes,
-                           &dispatchers, &num_dispatchers,
-                           MOJO_READ_MESSAGE_FLAG_NONE),
+  CHECK_EQ(mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                           MakeUserPointer(&num_bytes), &dispatchers,
+                           &num_dispatchers, MOJO_READ_MESSAGE_FLAG_NONE),
            MOJO_RESULT_OK);
   read_buffer.resize(num_bytes);
   CHECK_EQ(read_buffer, std::string("go 1"));
@@ -346,9 +342,8 @@ MOJO_MULTIPROCESS_TEST_CHILD_MAIN(CheckSharedBuffer) {
 
   read_buffer = std::string(100, '\0');
   num_bytes = static_cast<uint32_t>(read_buffer.size());
-  CHECK_EQ(mp->ReadMessage(0,
-                           &read_buffer[0], &num_bytes,
-                           NULL, NULL,
+  CHECK_EQ(mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                           MakeUserPointer(&num_bytes), NULL, NULL,
                            MOJO_READ_MESSAGE_FLAG_NONE),
            MOJO_RESULT_OK);
   read_buffer.resize(num_bytes);
@@ -419,9 +414,8 @@ TEST_F(MultiprocessMessagePipeTest, MAYBE_SharedBufferPassing) {
   std::string read_buffer(100, '\0');
   uint32_t num_bytes = static_cast<uint32_t>(read_buffer.size());
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp->ReadMessage(0,
-                            &read_buffer[0], &num_bytes,
-                            NULL, NULL,
+            mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                            MakeUserPointer(&num_bytes), NULL, NULL,
                             MOJO_READ_MESSAGE_FLAG_NONE));
   read_buffer.resize(num_bytes);
   EXPECT_EQ(std::string("go 2"), read_buffer);
@@ -469,10 +463,9 @@ MOJO_MULTIPROCESS_TEST_CHILD_MAIN(CheckPlatformHandleFile) {
   uint32_t num_bytes = static_cast<uint32_t>(read_buffer.size());
   DispatcherVector dispatchers;
   uint32_t num_dispatchers = 10;  // Maximum number to receive.
-  CHECK_EQ(mp->ReadMessage(0,
-                           &read_buffer[0], &num_bytes,
-                           &dispatchers, &num_dispatchers,
-                           MOJO_READ_MESSAGE_FLAG_NONE),
+  CHECK_EQ(mp->ReadMessage(0, UserPointer<void>(&read_buffer[0]),
+                           MakeUserPointer(&num_bytes), &dispatchers,
+                           &num_dispatchers, MOJO_READ_MESSAGE_FLAG_NONE),
            MOJO_RESULT_OK);
   mp->Close(0);
 
diff --git a/mojo/system/remote_message_pipe_unittest.cc b/mojo/system/remote_message_pipe_unittest.cc
index 46f8f54..1bd3f7b 100644
--- a/mojo/system/remote_message_pipe_unittest.cc
+++ b/mojo/system/remote_message_pipe_unittest.cc
@@ -214,9 +214,8 @@ TEST_F(RemoteMessagePipeTest, Basic) {
 
   // Read from MP 1, port 1.
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp1->ReadMessage(1,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp1->ReadMessage(1, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(buffer_size));
   EXPECT_STREQ(kHello, buffer);
@@ -239,9 +238,8 @@ TEST_F(RemoteMessagePipeTest, Basic) {
 
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp0->ReadMessage(0,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp0->ReadMessage(0, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kWorld), static_cast<size_t>(buffer_size));
   EXPECT_STREQ(kWorld, buffer);
@@ -315,29 +313,25 @@ TEST_F(RemoteMessagePipeTest, Multiplex) {
   // Make sure there's nothing on MP 0, port 0 or MP 1, port 1 or MP 2, port 0.
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp0->ReadMessage(0,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp0->ReadMessage(0, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp1->ReadMessage(1,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp1->ReadMessage(1, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp2->ReadMessage(0,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp2->ReadMessage(0, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
 
   // Read from MP 3, port 1.
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp3->ReadMessage(1,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp3->ReadMessage(1, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(buffer_size));
   EXPECT_STREQ(kHello, buffer);
@@ -361,28 +355,24 @@ TEST_F(RemoteMessagePipeTest, Multiplex) {
   // Make sure there's nothing on the other ports.
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp0->ReadMessage(0,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp0->ReadMessage(0, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp2->ReadMessage(0,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp2->ReadMessage(0, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_SHOULD_WAIT,
-            mp3->ReadMessage(1,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp3->ReadMessage(1, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
 
   buffer_size = static_cast<uint32_t>(sizeof(buffer));
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp1->ReadMessage(1,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp1->ReadMessage(1, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kWorld), static_cast<size_t>(buffer_size));
   EXPECT_STREQ(kWorld, buffer);
@@ -440,9 +430,8 @@ TEST_F(RemoteMessagePipeTest, CloseBeforeConnect) {
 
   // Read from MP 1, port 1.
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp1->ReadMessage(1,
-                             buffer, &buffer_size,
-                             NULL, NULL,
+            mp1->ReadMessage(1, UserPointer<void>(buffer),
+                             MakeUserPointer(&buffer_size), NULL, NULL,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(buffer_size));
   EXPECT_STREQ(kHello, buffer);
@@ -506,7 +495,8 @@ TEST_F(RemoteMessagePipeTest, HandlePassing) {
   DispatcherVector read_dispatchers;
   uint32_t read_num_dispatchers = 10;  // Maximum to get.
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp1->ReadMessage(1, read_buffer, &read_buffer_size,
+            mp1->ReadMessage(1, UserPointer<void>(read_buffer),
+                             MakeUserPointer(&read_buffer_size),
                              &read_dispatchers, &read_num_dispatchers,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(read_buffer_size));
@@ -541,7 +531,8 @@ TEST_F(RemoteMessagePipeTest, HandlePassing) {
   memset(read_buffer, 0, sizeof(read_buffer));
   read_buffer_size = static_cast<uint32_t>(sizeof(read_buffer));
   EXPECT_EQ(MOJO_RESULT_OK,
-            dispatcher->ReadMessage(read_buffer, &read_buffer_size, 0, NULL,
+            dispatcher->ReadMessage(UserPointer<void>(read_buffer),
+                                    MakeUserPointer(&read_buffer_size), 0, NULL,
                                     MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(read_buffer_size));
   EXPECT_STREQ(kHello, read_buffer);
@@ -565,8 +556,9 @@ TEST_F(RemoteMessagePipeTest, HandlePassing) {
   memset(read_buffer, 0, sizeof(read_buffer));
   read_buffer_size = static_cast<uint32_t>(sizeof(read_buffer));
   EXPECT_EQ(MOJO_RESULT_OK,
-            local_mp->ReadMessage(1, read_buffer, &read_buffer_size, NULL, NULL,
-                                  MOJO_READ_MESSAGE_FLAG_NONE));
+            local_mp->ReadMessage(1, UserPointer<void>(read_buffer),
+                                  MakeUserPointer(&read_buffer_size), NULL,
+                                  NULL, MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(read_buffer_size));
   EXPECT_STREQ(kHello, read_buffer);
 
@@ -656,7 +648,8 @@ TEST_F(RemoteMessagePipeTest, MAYBE_SharedBufferPassing) {
   DispatcherVector read_dispatchers;
   uint32_t read_num_dispatchers = 10;  // Maximum to get.
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp1->ReadMessage(1, read_buffer, &read_buffer_size,
+            mp1->ReadMessage(1, UserPointer<void>(read_buffer),
+                             MakeUserPointer(&read_buffer_size),
                              &read_dispatchers, &read_num_dispatchers,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kHello), static_cast<size_t>(read_buffer_size));
@@ -771,7 +764,8 @@ TEST_F(RemoteMessagePipeTest, MAYBE_PlatformHandlePassing) {
   DispatcherVector read_dispatchers;
   uint32_t read_num_dispatchers = 10;  // Maximum to get.
   EXPECT_EQ(MOJO_RESULT_OK,
-            mp1->ReadMessage(1, read_buffer, &read_buffer_size,
+            mp1->ReadMessage(1, UserPointer<void>(read_buffer),
+                             MakeUserPointer(&read_buffer_size),
                              &read_dispatchers, &read_num_dispatchers,
                              MOJO_READ_MESSAGE_FLAG_NONE));
   EXPECT_EQ(sizeof(kWorld), static_cast<size_t>(read_buffer_size));