ipc: Make a separate vector for brokerable attachments.

On Mac, an IPC::Message can have both non-brokered and brokered attachments.
During Message serialization, an index of the attachment is written as a
placeholder for the attachment. This relies on the assumption that there exists
a well defined ordering for all attachments. The receiving processes multiplexes
brokered and non-brokered attachments across different communication mediums,
and the ordering between them is non-deterministic.

I changed MessageAttachmentSet to have two vectors - one for brokered
attachments and one for non-brokered attachments. During Message serialization,
a bool is written that indicates whether the attachment is brokered, and then an
index into the appropriate vector.

I decided not to add an equivalent of |consumed_descriptor_highwater_| for
brokered attachments for two reasons:
  1) The sender has clearer ownership semantics for brokered attachments, and
  they will clean themselves up appropriately without assistance from the
  MessageAttachmentSet.
  2) Ownership semantics are fundamentally broken in the receiver, since the
  semantics for Message translation are stateless, whereas ownership transfer is
  stateful. Note the presence of awkward hacks for
  |consumed_descriptor_highwater_|, for which there is no good solution.

BUG=535711

Review URL: https://codereview.chromium.org/1401473002

Cr-Commit-Position: refs/heads/master@{#353457}

1 files changed, 6 insertions, 5 deletions

diff --git a/ipc/mojo/ipc_channel_mojo.cc b/ipc/mojo/ipc_channel_mojo.cc
index 5239cee..7b91f72 100644
--- a/ipc/mojo/ipc_channel_mojo.cc
+++ b/ipc/mojo/ipc_channel_mojo.cc
@@ -475,8 +475,9 @@ MojoResult ChannelMojo::ReadFromMessageAttachmentSet(
   // of FDs, so just to dup()-and-own them is the safest option.
   if (message->HasAttachments()) {
     MessageAttachmentSet* set = message->attachment_set();
-    for (unsigned i = 0; i < set->size(); ++i) {
-      scoped_refptr<MessageAttachment> attachment = set->GetAttachmentAt(i);
+    for (unsigned i = 0; i < set->num_non_brokerable_attachments(); ++i) {
+      scoped_refptr<MessageAttachment> attachment =
+          set->GetNonBrokerableAttachmentAt(i);
       switch (attachment->GetType()) {
         case MessageAttachment::TYPE_PLATFORM_FILE:
 #if defined(OS_POSIX) && !defined(OS_NACL)
@@ -486,7 +487,7 @@ MojoResult ChannelMojo::ReadFromMessageAttachmentSet(
                   attachment.get()));
           if (!file.is_valid()) {
             DPLOG(WARNING) << "Failed to dup FD to transmit.";
-            set->CommitAll();
+            set->CommitAllDescriptors();
             return MOJO_RESULT_UNKNOWN;
           }
 
@@ -498,7 +499,7 @@ MojoResult ChannelMojo::ReadFromMessageAttachmentSet(
           if (MOJO_RESULT_OK != wrap_result) {
             LOG(WARNING) << "Pipe failed to wrap handles. Closing: "
                          << wrap_result;
-            set->CommitAll();
+            set->CommitAllDescriptors();
             return wrap_result;
           }
 
@@ -522,7 +523,7 @@ MojoResult ChannelMojo::ReadFromMessageAttachmentSet(
       }
     }
 
-    set->CommitAll();
+    set->CommitAllDescriptors();
   }
 
   return MOJO_RESULT_OK;