Mojo: Don't allow closed pipe handles to be sent

mojo/edk/system/message_pipe_dispatcher.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/message_pipe_dispatcher.h"
 
 #include <limits>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ skipping 469 matching lines @@
                                          PlatformHandle* handles) {
   SerializedState* state = static_cast<SerializedState*>(destination);
   state->pipe_id = pipe_id_;
   state->endpoint = static_cast<int8_t>(endpoint_);
   ports[0] = port_.name();
   return true;
 }
 
 bool MessagePipeDispatcher::BeginTransit() {
   base::AutoLock lock(signal_lock_);
-  if (in_transit_)
+  if (in_transit_ || port_closed_)
     return false;
   in_transit_ = true;
   return in_transit_;
 }
 
 void MessagePipeDispatcher::CompleteTransitAndClose() {
   node_controller_->SetPortObserver(port_, nullptr);
 
   base::AutoLock lock(signal_lock_);
   in_transit_ = false;
@@ skipping 105 matching lines @@
     DVLOG(1) << "Peer closure detected on message pipe " << pipe_id_
              << " endpoint " << endpoint_ << " [port=" << port_.name() << "]";
   }
 #endif
 
   awakables_.AwakeForStateChange(GetHandleSignalsStateNoLock());
 }
 
 }  // namespace edk
 }  // namespace mojo