Mojo: Fix MojoReadMessage() with *num_handles == 0.

mojo/system/core_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/system/core_impl.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "mojo/system/dispatcher.h"
@@ skipping 304 matching lines @@
 
   if (num_handles) {
     if (!VerifyUserPointer<uint32_t>(num_handles, 1))
       return MOJO_RESULT_INVALID_ARGUMENT;
     if (!VerifyUserPointer<MojoHandle>(handles, *num_handles))
       return MOJO_RESULT_INVALID_ARGUMENT;
   }
 
   // Easy case: won't receive any handles.
   if (!num_handles || *num_handles == 0)
-    return dispatcher->ReadMessage(bytes, num_bytes, 0, NULL, flags);
+    return dispatcher->ReadMessage(bytes, num_bytes, NULL, num_handles, flags);
 
   std::vector<scoped_refptr<Dispatcher> > dispatchers;
   MojoResult rv = dispatcher->ReadMessage(bytes, num_bytes,
                                           &dispatchers, num_handles,
                                           flags);
   if (!dispatchers.empty()) {
     DCHECK_EQ(rv, MOJO_RESULT_OK);
     DCHECK(num_handles);
     DCHECK_LE(dispatchers.size(), static_cast<size_t>(*num_handles));
 
@@ skipping 101 matching lines @@
   // |Wait()|/|WaitMany()| call. (Only after doing this can |waiter| be
   // destroyed, but this would still be required if the waiter were in TLS.)
   for (i = 0; i < num_added; i++)
     dispatchers[i]->RemoveWaiter(&waiter);
 
   return rv;
 }
 
 }  // namespace system
 }  // namespace mojo