Fix DXVA2 video decoding which was broken with recent process handle brokering changes

content/common/sandbox_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_policy.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 321 matching lines @@
                             sandbox::USER_LIMITED);
       policy->SetJobLevel(sandbox::JOB_UNPROTECTED, 0);
       policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_LOW);
     } else {
       if (cmd_line->GetSwitchValueASCII(switches::kUseGL) ==
           gfx::kGLImplementationSwiftShaderName ||
           cmd_line->HasSwitch(switches::kReduceGpuSandbox)) {
         // Swiftshader path.
         policy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
                               sandbox::USER_LIMITED);
-        // UI restrictions break when we access Windows from outside our job.
-        // However, we don't want a proxy window in this process because it can
-        // introduce deadlocks where the renderer blocks on the gpu, which in
-        // turn blocks on the browser UI thread. So, instead we forgo a window
-        // message pump entirely and just add job restrictions to prevent child
-        // processes.
-        policy->SetJobLevel(sandbox::JOB_LIMITED_USER,
-                            JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS |
-                            JOB_OBJECT_UILIMIT_DESKTOP |
-                            JOB_OBJECT_UILIMIT_EXITWINDOWS |
-                            JOB_OBJECT_UILIMIT_DISPLAYSETTINGS);
       } else {
         // Angle + DirectX path.
         policy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
                               sandbox::USER_RESTRICTED);
-        policy->SetJobLevel(sandbox::JOB_LOCKDOWN,
-                            JOB_OBJECT_UILIMIT_HANDLES);
         // This is a trick to keep the GPU out of low-integrity processes. It
         // starts at low-integrity for UIPI to work, then drops below
         // low-integrity after warm-up.
         policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_UNTRUSTED);
       }
 
+      // UI restrictions break when we access Windows from outside our job.
+      // However, we don't want a proxy window in this process because it can
+      // introduce deadlocks where the renderer blocks on the gpu, which in
+      // turn blocks on the browser UI thread. So, instead we forgo a window
+      // message pump entirely and just add job restrictions to prevent child
+      // processes.
+      policy->SetJobLevel(sandbox::JOB_LIMITED_USER,
+                          JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS |
+                          JOB_OBJECT_UILIMIT_DESKTOP |
+                          JOB_OBJECT_UILIMIT_EXITWINDOWS |
+                          JOB_OBJECT_UILIMIT_DISPLAYSETTINGS);
+
       policy->SetIntegrityLevel(sandbox::INTEGRITY_LEVEL_LOW);
     }
   } else {
     policy->SetJobLevel(sandbox::JOB_UNPROTECTED, 0);
     policy->SetTokenLevel(sandbox::USER_UNPROTECTED,
                           sandbox::USER_LIMITED);
   }
 
   // Allow the server side of GPU sockets, which are pipes that have
   // the "chrome.gpu" namespace and an arbitrary suffix.
@@ skipping 327 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content