Do not double-unref send rights when using POLICY_SUBSTITUE_PORT.

sandbox/mac/os_compatibility.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/os_compatibility.h"
 
 #include <servers/bootstrap.h>
 #include <unistd.h>
 
 #include "base/mac/mac_util.h"
@@ skipping 69 matching lines @@
 
 template <typename R>
 void LaunchdLookUp2FillReply(mach_msg_header_t* header, mach_port_t port) {
   R* reply = reinterpret_cast<R*>(header);
   reply->Head.msgh_size = sizeof(R);
   reply->Head.msgh_bits =
       MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND_ONCE) |
       MACH_MSGH_BITS_COMPLEX;
   reply->msgh_body.msgh_descriptor_count = 1;
   reply->service_port.name = port;
-  reply->service_port.disposition = MACH_MSG_TYPE_PORT_SEND;
+  reply->service_port.disposition = MACH_MSG_TYPE_COPY_SEND;
   reply->service_port.type = MACH_MSG_PORT_DESCRIPTOR;
 }
 
 template <typename R>
 bool LaunchdSwapIntegerIsGetOnly(const mach_msg_header_t* header) {
   const R* request = reinterpret_cast<const R*>(header);
   return request->inkey == 0 && request->inval == 0 && request->outkey != 0;
 }
 
 }  // namespace
@@ skipping 17 matching lines @@
   } else {
     DLOG(ERROR) << "Unknown OS, using launchd compatibility shim from 10.7.";
     shim.look_up2_get_request_name =
         &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;
   }
 
   return shim;
 }
 
 }  // namespace sandbox