Pepper: Remove LOAD_MODULE SRPC call in SFI mode.

components/nacl/browser/nacl_host_message_filter.cc

Index: components/nacl/browser/nacl_host_message_filter.cc
diff --git a/components/nacl/browser/nacl_host_message_filter.cc b/components/nacl/browser/nacl_host_message_filter.cc
index 94d8ae810d315b03a622cc1eada830159dc15a3f..063d43e2fb847d598852aa8d960ee84c6ac3c362 100644
--- a/components/nacl/browser/nacl_host_message_filter.cc
+++ b/components/nacl/browser/nacl_host_message_filter.cc
@@ -141,10 +141,15 @@ void NaClHostMessageFilter::LaunchNaClContinuation(
     const nacl::NaClLaunchParams& launch_params,
     IPC::Message* reply_msg,
     ppapi::PpapiPermissions permissions) {
+  NaClFileToken nexe_token = {
+      launch_params.nexe_token_lo,  // lo
+      launch_params.nexe_token_hi   // hi
+  };
   NaClProcessHost* host = new NaClProcessHost(
       GURL(launch_params.manifest_url),
       base::File(

[Mark Seaborn, 2014/07/02 23:48:36]

Putting launch_params.nexe_file into a base::File is not safe on Windows.

This is a handle ID in the renderer process's handle namespace.

But base::File is a managed reference.  Its destructor will call CloseHandle()
using the current process's namespace.

This could give the renderer process the ability to close handle IDs of its
choice in the browser.

The options are:
 1) Avoid using base::File for this.
 2) Explicitly call ::DuplicateHandle() here to get a locally-valid handle that
you can put into a base::File.

(2) seems preferable since it reduces the scope of the remote handle ID, even
though it involves two DuplicateHandle() calls instead of one.

[teravest, 2014/07/07 22:48:47]

Thanks for catching this! I agree that using ::DuplicateHandle here is the
better option. Done.

           IPC::PlatformFileForTransitToPlatformFile(launch_params.nexe_file)),
+      nexe_token,
       permissions,
       launch_params.render_view_id,
       launch_params.permission_bits,