ipc: Update MachPortMac ownership semantics.

ipc/mach_port_attachment_mac.h

Index: ipc/mach_port_attachment_mac.h
diff --git a/ipc/mach_port_attachment_mac.h b/ipc/mach_port_attachment_mac.h
index efe93c46a13be202a60e6f3fecd013f2ee419cf9..48dc9aadd8da0625647deeeac54a1d19ab7ae450 100644
--- a/ipc/mach_port_attachment_mac.h
+++ b/ipc/mach_port_attachment_mac.h
@@ -45,7 +45,13 @@ class IPC_EXPORT MachPortAttachmentMac : public BrokerableAttachment {
     AttachmentId attachment_id;
   };
 
+  // This constructor increments the ref count of |mach_port_| and takes
+  // ownership of the result. Should only be called by the sender of a Chrome
+  // IPC message.
   explicit MachPortAttachmentMac(mach_port_t mach_port);
+
+  // These constructors do not take ownership of |mach_port|, and should only be
+  // called by the receiver of a Chrome IPC message.
   explicit MachPortAttachmentMac(const WireFormat& wire_format);
   explicit MachPortAttachmentMac(const BrokerableAttachment::AttachmentId& id);
 
@@ -56,9 +62,21 @@ class IPC_EXPORT MachPortAttachmentMac : public BrokerableAttachment {
 
   mach_port_t get_mach_port() const { return mach_port_; }
 
+  // The caller of this method has taken ownership of |mach_port_|.
+  void reset_mach_port_ownership() { owns_mach_port_ = false; }
+
  private:
   ~MachPortAttachmentMac() override;
   mach_port_t mach_port_;
+
+  // In the sender process, the attachment owns the Mach port of a newly created
+  // message. The attachment broker will eventually take ownership, and set
+  // this member to |false|.
+  // In the destination process, the attachment never owns the Mach port. The
+  // client code that receives the Chrome IPC message is always expected to take
+  // ownership.
+  bool owns_mach_port_;
+  DISALLOW_COPY_AND_ASSIGN(MachPortAttachmentMac);
 };
 
 }  // namespace internal