Fix DXVA2 video decoding which was broken with recent process handle brokering changes

and a sandbox policy change which runs the gpu process in a windows job object with
ui restrictions on. This causes the DXVA device creation to fail.

BUG=none
TEST=DXVA decoder initialization and decoding should now work in the gpu process.
Review URL: https://chromiumcodereview.appspot.com/10163013

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@133328 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 29 insertions, 15 deletions

diff --git a/content/common/gpu/client/gpu_video_decode_accelerator_host.cc b/content/common/gpu/client/gpu_video_decode_accelerator_host.cc
index 59ff3a1..6cd519b 100644
--- a/content/common/gpu/client/gpu_video_decode_accelerator_host.cc
+++ b/content/common/gpu/client/gpu_video_decode_accelerator_host.cc
@@ -13,6 +13,10 @@
 #include "ipc/ipc_message_macros.h"
 #include "ipc/ipc_message_utils.h"
 
+#if defined(OS_WIN)
+#include "content/public/common/sandbox_init.h"
+#endif  // OS_WIN
+
 using media::VideoDecodeAccelerator;
 
 GpuVideoDecodeAcceleratorHost::GpuVideoDecodeAcceleratorHost(
@@ -65,9 +69,20 @@ bool GpuVideoDecodeAcceleratorHost::Initialize(
 void GpuVideoDecodeAcceleratorHost::Decode(
     const media::BitstreamBuffer& bitstream_buffer) {
   DCHECK(CalledOnValidThread());
+  base::SharedMemoryHandle buffer_handle = bitstream_buffer.handle();
+#if defined(OS_WIN)
+  if (!content::BrokerDuplicateHandle(bitstream_buffer.handle(),
+                                      channel_->gpu_pid(),
+                                      &buffer_handle, 0,
+                                      DUPLICATE_SAME_ACCESS)) {
+    NOTREACHED() << "Failed to duplicate buffer handler";
+    return;
+  }
+#endif  // OS_WIN
+
   Send(new AcceleratedVideoDecoderMsg_Decode(
-      decoder_route_id_, bitstream_buffer.handle(),
-      bitstream_buffer.id(), bitstream_buffer.size()));
+      decoder_route_id_, buffer_handle, bitstream_buffer.id(),
+      bitstream_buffer.size()));
 }
 
 void GpuVideoDecodeAcceleratorHost::AssignPictureBuffers(
diff --git a/content/common/sandbox_policy.cc b/content/common/sandbox_policy.cc
index 549f5c7..1bd1e4f 100644
--- a/content/common/sandbox_policy.cc
+++ b/content/common/sandbox_policy.cc
@@ -339,29 +339,28 @@ bool AddPolicyForGPU(CommandLine* cmd_line, sandbox::TargetPolicy* policy) {
         // Swiftshader path.
         policy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
                               sandbox::USER_LIMITED);
-        // UI restrictions break when we access Windows from outside our job.
-        // However, we don't want a proxy window in this process because it can
-        // introduce deadlocks where the renderer blocks on the gpu, which in
-        // turn blocks on the browser UI thread. So, instead we forgo a window
-        // message pump entirely and just add job restrictions to prevent child
-        // processes.
-        policy->SetJobLevel(sandbox::JOB_LIMITED_USER,
-                            JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS |
-                            JOB_OBJECT_UILIMIT_DESKTOP |
-                            JOB_OBJECT_UILIMIT_EXITWINDOWS |
-                            JOB_OBJECT_UILIMIT_DISPLAYSETTINGS);
       } else {
         // Angle + DirectX path.
         policy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
                               sandbox::USER_RESTRICTED);
-        policy->SetJobLevel(sandbox::JOB_LOCKDOWN,
-                            JOB_OBJECT_UILIMIT_HANDLES);
         // This is a trick to keep the GPU out of low-integrity processes. It
         // starts at low-integrity for UIPI to work, then drops below
         // low-integrity after warm-up.
         policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_UNTRUSTED);
       }
 
+      // UI restrictions break when we access Windows from outside our job.
+      // However, we don't want a proxy window in this process because it can
+      // introduce deadlocks where the renderer blocks on the gpu, which in
+      // turn blocks on the browser UI thread. So, instead we forgo a window
+      // message pump entirely and just add job restrictions to prevent child
+      // processes.
+      policy->SetJobLevel(sandbox::JOB_LIMITED_USER,
+                          JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS |
+                          JOB_OBJECT_UILIMIT_DESKTOP |
+                          JOB_OBJECT_UILIMIT_EXITWINDOWS |
+                          JOB_OBJECT_UILIMIT_DISPLAYSETTINGS);
+
       policy->SetIntegrityLevel(sandbox::INTEGRITY_LEVEL_LOW);
     }
   } else {