Fix handling of free descriptors when calling dup2.

native_client_sdk/src/libraries/nacl_io/kernel_object.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "nacl_io/kernel_object.h"
 
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
@@ skipping 234 matching lines @@
 }
 
 void KernelObject::FreeAndReassignFD(int fd,
                                      const ScopedKernelHandle& handle,
                                      const std::string& path) {
   if (NULL == handle) {
     FreeFD(fd);
   } else {
     AUTO_LOCK(handle_lock_);
 
-    // If the required FD is larger than the current set, grow the set
-    if (fd >= (int)handle_map_.size())
+    // If the required FD is larger than the current set, grow the set.
+    int sz = static_cast<int>(handle_map_.size());
+    if (fd >= sz) {
+      // Expand the handle map to include all the extra descriptors
+      // up to and including fd.
       handle_map_.resize(fd + 1);
+      // Add all the new descriptors, except fd, to the free list.
+      for (; sz < fd; ++sz) {
+        free_fds_.push_back(sz);
+        std::push_heap(free_fds_.begin(), free_fds_.end(),
+                       std::greater<int>());
+      }
+    }
 
     // This path will be from an existing handle, and absolute.
     handle_map_[fd] = Descriptor_t(handle, path);
   }
 }
 
 void KernelObject::FreeFD(int fd) {
   AUTO_LOCK(handle_lock_);
 
   handle_map_[fd].handle.reset(NULL);
   free_fds_.push_back(fd);
 
   // Force lower numbered FD to be available first.
   std::push_heap(free_fds_.begin(), free_fds_.end(), std::greater<int>());
 }
 
 }  // namespace nacl_io