--- a/security/manager/ssl/ScopedNSSTypes.h
+++ b/security/manager/ssl/ScopedNSSTypes.h
@@ -289,16 +289,20 @@ MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(Un
                                       SECKEY_DestroySubjectPublicKeyInfo)
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueCERTUserNotice,
                                       CERTUserNotice,
                                       CERT_DestroyUserNotice)
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueCERTValidity,
                                       CERTValidity,
                                       CERT_DestroyValidity)
 
+MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueHASHContext,
+                                      HASHContext,
+                                      HASH_Destroy)
+
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueNSSCMSMessage,
                                       NSSCMSMessage,
                                       NSS_CMSMessage_Destroy)
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueNSSCMSSignedData,
                                       NSSCMSSignedData,
                                       NSS_CMSSignedData_Destroy)
 
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniquePK11GenericObject,

--- a/security/manager/ssl/nsCryptoHash.cpp
+++ b/security/manager/ssl/nsCryptoHash.cpp
@@ -43,54 +43,51 @@ void
 nsCryptoHash::virtualDestroyNSSReference()
 {
   destructorSafeDestroyNSSReference();
 }
 
 void
 nsCryptoHash::destructorSafeDestroyNSSReference()
 {
-  if (mHashContext)
-    HASH_Destroy(mHashContext);
   mHashContext = nullptr;
 }
 
 NS_IMPL_ISUPPORTS(nsCryptoHash, nsICryptoHash)
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsCryptoHash::Init(uint32_t algorithm)
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
   HASH_HashType hashType = (HASH_HashType)algorithm;
-  if (mHashContext)
-  {
-    if ((!mInitialized) && (HASH_GetType(mHashContext) == hashType))
-    {
+  if (mHashContext) {
+    if (!mInitialized && HASH_GetType(mHashContext.get()) == hashType) {
       mInitialized = true;
-      HASH_Begin(mHashContext);
+      HASH_Begin(mHashContext.get());
       return NS_OK;
     }
 
     // Destroy current hash context if the type was different
     // or Finish method wasn't called.
-    HASH_Destroy(mHashContext);
+    mHashContext = nullptr;
     mInitialized = false;
   }
 
-  mHashContext = HASH_Create(hashType);
-  if (!mHashContext)
+  mHashContext.reset(HASH_Create(hashType));
+  if (!mHashContext) {
     return NS_ERROR_INVALID_ARG;
+  }
 
-  HASH_Begin(mHashContext);
+  HASH_Begin(mHashContext.get());
   mInitialized = true;
-  return NS_OK; 
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsCryptoHash::InitWithString(const nsACString & aAlgorithm)
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return NS_ERROR_NOT_AVAILABLE;
@@ -119,22 +116,23 @@ nsCryptoHash::InitWithString(const nsACS
 
 NS_IMETHODIMP
 nsCryptoHash::Update(const uint8_t *data, uint32_t len)
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return NS_ERROR_NOT_AVAILABLE;
   }
-  
-  if (!mInitialized)
+
+  if (!mInitialized) {
     return NS_ERROR_NOT_INITIALIZED;
+  }
 
-  HASH_Update(mHashContext, data, len);
-  return NS_OK; 
+  HASH_Update(mHashContext.get(), data, len);
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsCryptoHash::UpdateFromStream(nsIInputStream *data, uint32_t aLen)
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return NS_ERROR_NOT_AVAILABLE;
@@ -196,17 +194,17 @@ nsCryptoHash::Finish(bool ascii, nsACStr
   
   if (!mInitialized)
     return NS_ERROR_NOT_INITIALIZED;
   
   uint32_t hashLen = 0;
   unsigned char buffer[HASH_LENGTH_MAX];
   unsigned char* pbuffer = buffer;
 
-  HASH_End(mHashContext, pbuffer, &hashLen, HASH_LENGTH_MAX);
+  HASH_End(mHashContext.get(), pbuffer, &hashLen, HASH_LENGTH_MAX);
 
   mInitialized = false;
 
   if (ascii)
   {
     UniquePORTString asciiData(BTOA_DataToAscii(buffer, hashLen));
     NS_ENSURE_TRUE(asciiData, NS_ERROR_OUT_OF_MEMORY);
 
@@ -222,18 +220,18 @@ nsCryptoHash::Finish(bool ascii, nsACStr
 
 //---------------------------------------------
 // Implementing nsICryptoHMAC
 //---------------------------------------------
 
 NS_IMPL_ISUPPORTS(nsCryptoHMAC, nsICryptoHMAC)
 
 nsCryptoHMAC::nsCryptoHMAC()
+  : mHMACContext(nullptr)
 {
-  mHMACContext = nullptr;
 }
 
 nsCryptoHMAC::~nsCryptoHMAC()
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return;
   }
@@ -245,32 +243,28 @@ void
 nsCryptoHMAC::virtualDestroyNSSReference()
 {
   destructorSafeDestroyNSSReference();
 }
 
 void
 nsCryptoHMAC::destructorSafeDestroyNSSReference()
 {
-  if (mHMACContext)
-    PK11_DestroyContext(mHMACContext, true);
   mHMACContext = nullptr;
 }
 
 NS_IMETHODIMP
 nsCryptoHMAC::Init(uint32_t aAlgorithm, nsIKeyObject *aKeyObject)
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  if (mHMACContext)
-  {
-    PK11_DestroyContext(mHMACContext, true);
+  if (mHMACContext) {
     mHMACContext = nullptr;
   }
 
   CK_MECHANISM_TYPE mechType;
   switch (aAlgorithm) {
     case nsICryptoHMAC::MD5:
       mechType = CKM_MD5_HMAC; break;
     case nsICryptoHMAC::SHA1:
@@ -298,21 +292,23 @@ nsCryptoHMAC::Init(uint32_t aAlgorithm, 
   PK11SymKey* key;
   // GetKeyObj doesn't addref the key
   rv = aKeyObject->GetKeyObj(&key);
   NS_ENSURE_SUCCESS(rv, rv);
 
   SECItem rawData;
   rawData.data = 0;
   rawData.len = 0;
-  mHMACContext = PK11_CreateContextBySymKey(mechType, CKA_SIGN, key, &rawData);
+  mHMACContext.reset(PK11_CreateContextBySymKey(mechType, CKA_SIGN, key,
+                                                &rawData));
   NS_ENSURE_TRUE(mHMACContext, NS_ERROR_FAILURE);
 
-  SECStatus ss = PK11_DigestBegin(mHMACContext);
-  NS_ENSURE_TRUE(ss == SECSuccess, NS_ERROR_FAILURE);
+  if (PK11_DigestBegin(mHMACContext.get()) != SECSuccess) {
+    return NS_ERROR_FAILURE;
+  }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsCryptoHMAC::Update(const uint8_t *aData, uint32_t aLen)
 {
   nsNSSShutDownPreventionLock locker;
@@ -321,19 +317,20 @@ nsCryptoHMAC::Update(const uint8_t *aDat
   }
 
   if (!mHMACContext)
     return NS_ERROR_NOT_INITIALIZED;
 
   if (!aData)
     return NS_ERROR_INVALID_ARG;
 
-  SECStatus ss = PK11_DigestOp(mHMACContext, aData, aLen);
-  NS_ENSURE_TRUE(ss == SECSuccess, NS_ERROR_FAILURE);
-  
+  if (PK11_DigestOp(mHMACContext.get(), aData, aLen) != SECSuccess) {
+    return NS_ERROR_FAILURE;
+  }
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsCryptoHMAC::UpdateFromStream(nsIInputStream *aStream, uint32_t aLen)
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
@@ -398,17 +395,17 @@ nsCryptoHMAC::Finish(bool aASCII, nsACSt
 
   if (!mHMACContext)
     return NS_ERROR_NOT_INITIALIZED;
 
   uint32_t hashLen = 0;
   unsigned char buffer[HASH_LENGTH_MAX];
   unsigned char* pbuffer = buffer;
 
-  PK11_DigestFinal(mHMACContext, pbuffer, &hashLen, HASH_LENGTH_MAX);
+  PK11_DigestFinal(mHMACContext.get(), pbuffer, &hashLen, HASH_LENGTH_MAX);
   if (aASCII)
   {
     UniquePORTString asciiData(BTOA_DataToAscii(buffer, hashLen));
     NS_ENSURE_TRUE(asciiData, NS_ERROR_OUT_OF_MEMORY);
 
     _retval.Assign(asciiData.get());
   }
   else
@@ -422,13 +419,14 @@ nsCryptoHMAC::Finish(bool aASCII, nsACSt
 NS_IMETHODIMP
 nsCryptoHMAC::Reset()
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  SECStatus ss = PK11_DigestBegin(mHMACContext);
-  NS_ENSURE_TRUE(ss == SECSuccess, NS_ERROR_FAILURE);
+  if (PK11_DigestBegin(mHMACContext.get()) != SECSuccess) {
+    return NS_ERROR_FAILURE;
+  }
 
   return NS_OK;
 }

--- a/security/manager/ssl/nsCryptoHash.h
+++ b/security/manager/ssl/nsCryptoHash.h
@@ -1,21 +1,22 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef _nsCryptoHash_h_
-#define _nsCryptoHash_h_
+#ifndef nsCryptoHash_h
+#define nsCryptoHash_h
 
+#include "ScopedNSSTypes.h"
+#include "hasht.h"
+#include "nsICryptoHMAC.h"
 #include "nsICryptoHash.h"
-#include "nsICryptoHMAC.h"
 #include "nsNSSShutDown.h"
-#include "hasht.h"
 #include "secmodt.h"
 
 class nsIInputStream;
 
 #define NS_CRYPTO_HASH_CID {0x36a1d3b3, 0xd886, 0x4317, {0x96, 0xff, 0x87, 0xb0, 0x00, 0x5c, 0xfe, 0xf7}}
 #define NS_CRYPTO_HMAC_CID {0xa496d0a2, 0xdff7, 0x4e23, {0xbd, 0x65, 0x1c, 0xa7, 0x42, 0xfa, 0x17, 0x8a}}
 
 class nsCryptoHash final : public nsICryptoHash, public nsNSSShutDownObject
@@ -24,33 +25,32 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSICRYPTOHASH
 
   nsCryptoHash();
 
 private:
   ~nsCryptoHash();
 
-  HASHContext* mHashContext;
+  mozilla::UniqueHASHContext mHashContext;
   bool mInitialized;
 
   virtual void virtualDestroyNSSReference() override;
   void destructorSafeDestroyNSSReference();
 };
 
 class nsCryptoHMAC : public nsICryptoHMAC, public nsNSSShutDownObject
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSICRYPTOHMAC
 
   nsCryptoHMAC();
 
 private:
   ~nsCryptoHMAC();
-  PK11Context* mHMACContext;
+  mozilla::UniquePK11Context mHMACContext;
 
   virtual void virtualDestroyNSSReference() override;
   void destructorSafeDestroyNSSReference();
 };
 
-#endif // _nsCryptoHash_h_
-
+#endif // nsCryptoHash_h