Enforce/require MOJO_HANDLE_RIGHT_TRANSFER in sending handles via MojoWriteMessage().

mojo/edk/system/handle_table.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MOJO_EDK_SYSTEM_HANDLE_TABLE_H_
 #define MOJO_EDK_SYSTEM_HANDLE_TABLE_H_
 
 #include <stddef.h>
 
 #include <unordered_map>
@@ skipping 57 matching lines @@
   // Adds the given vector of handles (of size at most
   // |kMaxMessageNumHandles|). |handle_values| must point to an array of size at
   // least |handles->size()|. Unlike the other |AddHandle...()| functions, some
   // of the handles may be invalid ("null"). Returns true on success in which
   // case all the handles in |*handles| are moved from, and false on failure (if
   // the handle table is full), in which case it leaves all |handles->at(...)||
   // (and all the handles unadded) and |handle_values[...]| untouched.
   bool AddHandleVector(HandleVector* handles, MojoHandle* handle_values);
 
   // Tries to mark the given handle values as busy and start transport on them
-  // (i.e., take their dispatcher locks); |transports| must be sized to contain
-  // |num_handles| elements. On failure, returns them to their original
+  // (i.e., take their dispatcher locks). The handles to be transported must all
+  // have the |MOJO_HANDLE_RIGHT_TRANSFER| right. |transports| must be sized to
+  // contain |num_handles| elements. On failure, returns them to their original
   // (non-busy, unlocked state).
   MojoResult MarkBusyAndStartTransport(
       MojoHandle disallowed_handle,
       const MojoHandle* handle_values,
       uint32_t num_handles,
       std::vector<HandleTransport>* transports);
 
   // Remove the given handle values, which must all be present and which should
   // have previously been marked busy by |MarkBusyAndStartTransport()|.
   void RemoveBusyHandles(const MojoHandle* handle_values, uint32_t num_handles);
@@ skipping 41 matching lines @@
   HandleToEntryMap handle_to_entry_map_;
   MojoHandle next_handle_value_;  // Invariant: never |MOJO_HANDLE_INVALID|.
 
   MOJO_DISALLOW_COPY_AND_ASSIGN(HandleTable);
 };
 
 }  // namespace system
 }  // namespace mojo
 
 #endif  // MOJO_EDK_SYSTEM_HANDLE_TABLE_H_