Enforce/require MOJO_HANDLE_RIGHT_TRANSFER in sending handles via MojoWriteMessage().

mojo/public/platform/native/system_impl_private_unittest.cc

Index: mojo/public/platform/native/system_impl_private_unittest.cc
diff --git a/mojo/public/platform/native/system_impl_private_unittest.cc b/mojo/public/platform/native/system_impl_private_unittest.cc
index 03fcafd69bbf2f7f2b5f32774a53a387f6024c5c..1c5bc8cdb57286e710a375f0e93c7cd632aeb263 100644
--- a/mojo/public/platform/native/system_impl_private_unittest.cc
+++ b/mojo/public/platform/native/system_impl_private_unittest.cc
@@ -723,5 +723,43 @@ TEST(SystemImplTest, BasicSharedBuffer) {
   // 2 SystemImpls are leaked...
 }
 
+TEST(CoreTest, MessagePipeChecksTransferRight) {
+  MojoSystemImpl sys = MojoSystemImplCreateImpl();
+
+  MojoHandle h0 = MOJO_HANDLE_INVALID;
+  MojoHandle h1 = MOJO_HANDLE_INVALID;
+  EXPECT_EQ(MOJO_RESULT_OK,
+            MojoSystemImplCreateMessagePipe(sys, nullptr, &h0, &h1));
+
+  // Create a shared buffer (which is transferrable and duplicatable).
+  MojoHandle h_transferrable = MOJO_HANDLE_INVALID;
+  EXPECT_EQ(MOJO_RESULT_OK, MojoSystemImplCreateSharedBuffer(sys, nullptr, 100,
+                                                             &h_transferrable));
+
+  // Make a non-transferrable duplicate handle.
+  MojoHandle h_not_transferrable = MOJO_HANDLE_INVALID;
+  EXPECT_EQ(MOJO_RESULT_OK,
+            MojoSystemImplDuplicateHandleWithReducedRights(
+                sys, h_transferrable, MOJO_HANDLE_RIGHT_TRANSFER,
+                &h_not_transferrable));
+
+  // |h_transferrable| can be transferred.
+  EXPECT_EQ(MOJO_RESULT_OK,
+            MojoSystemImplWriteMessage(sys, h0, nullptr, 0u, &h_transferrable,
+                                       1u, MOJO_WRITE_MESSAGE_FLAG_NONE));
+
+  // |h_not_transferrable| can be transferred.
+  EXPECT_EQ(
+      MOJO_RESULT_PERMISSION_DENIED,
+      MojoSystemImplWriteMessage(sys, h0, nullptr, 0u, &h_not_transferrable, 1u,
+                                 MOJO_WRITE_MESSAGE_FLAG_NONE));
+
+  EXPECT_EQ(MOJO_RESULT_OK, MojoSystemImplClose(sys, h0));
+  EXPECT_EQ(MOJO_RESULT_OK, MojoSystemImplClose(sys, h1));
+  EXPECT_EQ(MOJO_RESULT_OK, MojoSystemImplClose(sys, h_not_transferrable));
+
+  // 1 SystemImpl is leaked...
+}
+
 }  // namespace
 }  // namespace mojo