8 files changed, 18 insertions, 2 deletions
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 84236bb..7a64479 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -139,6 +139,12 @@ const char kDeviceManagementUrl[]           = "device-management-url";
 // Triggers a pletora of diagnostic modes.
 const char kDiagnostics[]                   = "diagnostics";
 
+// Disables client-visible 3D APIs, in particular WebGL and Pepper 3D.
+// This is controlled by policy and is kept separate from the other
+// enable/disable switches to avoid accidentally regressing the policy
+// support for controlling access to these APIs.
+const char kDisable3DAPIs[]                 = "disable-3d-apis";
+
 // Disables accelerated compositing.
 const char kDisableAcceleratedCompositing[] =
     "disable-accelerated-compositing";
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index 2a3f11d35..1ddf692 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -52,6 +52,7 @@ extern const char kCountry[];
 extern const char kDebugPrint[];
 extern const char kDeviceManagementUrl[];
 extern const char kDiagnostics[];
+extern const char kDisable3DAPIs[];
 extern const char kDisableAcceleratedCompositing[];
 extern const char kDisableAltWinstation[];
 extern const char kDisableApplicationCache[];
diff --git a/chrome/common/policy_constants.cc b/chrome/common/policy_constants.cc
index 8fcad63..300b450 100644
--- a/chrome/common/policy_constants.cc
+++ b/chrome/common/policy_constants.cc
@@ -71,6 +71,7 @@ const char kEnableAuthNegotiatePort[] = "EnableAuthNegotiatePort";
 const char kAuthServerWhitelist[] = "AuthServerWhitelist";
 const char kAuthNegotiateDelegateWhitelist[] = "AuthNegotiateDelegateWhitelist";
 const char kGSSAPILibraryName[] = "GSSAPILibraryName";
+const char kDisable3DAPIs[] = "Disable3DAPIs";
 
 // Chrome Frame specific policy constants
 const char kChromeFrameRendererSettings[] = "ChromeFrameRendererSettings";
diff --git a/chrome/common/policy_constants.h b/chrome/common/policy_constants.h
index 318e27c..a1e2a83 100644
--- a/chrome/common/policy_constants.h
+++ b/chrome/common/policy_constants.h
@@ -67,6 +67,7 @@ extern const char kEnableAuthNegotiatePort[];
 extern const char kAuthServerWhitelist[];
 extern const char kAuthNegotiateDelegateWhitelist[];
 extern const char kGSSAPILibraryName[];
+extern const char kDisable3DAPIs[];
 
 // Chrome Frame specific policy constants
 extern const char kChromeFrameRendererSettings[];
diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index 11203d8..c4af1e1 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc
@@ -631,6 +631,9 @@ const char kGeolocationDefaultContentSetting[] =
 // Dictionary that maps [frame, toplevel] to their Geolocation content setting.
 const char kGeolocationContentSettings[] = "geolocation.content_settings";
 
+// Preference to disable 3D APIs (WebGL, Pepper 3D).
+const char kDisable3DAPIs[] = "disable_3d_apis";
+
 // *************** LOCAL STATE ***************
 // These are attached to the machine/installation
 
diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index 4dcaad5..6e4a47d 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h
@@ -438,6 +438,8 @@ extern const char kGSSAPILibraryName[];
 
 extern const char kKnownBackgroundPages[];
 
+extern const char kDisable3DAPIs[];
+
 }  // namespace prefs
 
 #endif  // CHROME_COMMON_PREF_NAMES_H_
diff --git a/chrome/common/sandbox_init_wrapper_mac.cc b/chrome/common/sandbox_init_wrapper_mac.cc
index 540b6da..b9cfa50 100644
--- a/chrome/common/sandbox_init_wrapper_mac.cc
+++ b/chrome/common/sandbox_init_wrapper_mac.cc
@@ -24,7 +24,8 @@ bool SandboxInitWrapper::InitializeSandbox(const CommandLine& command_line,
     // Browser process isn't sandboxed.
     return true;
   } else if (process_type == switches::kRendererProcess) {
-    if (!command_line.HasSwitch(switches::kDisableExperimentalWebGL) &&
+    if (!command_line.HasSwitch(switches::kDisable3DAPIs) &&
+        !command_line.HasSwitch(switches::kDisableExperimentalWebGL) &&
         command_line.HasSwitch(switches::kInProcessWebGL)) {
       // TODO(kbr): this check seems to be necessary only on this
       // platform because the sandbox is initialized later. Remove
diff --git a/chrome/common/sandbox_policy.cc b/chrome/common/sandbox_policy.cc
index 2b932d0..2667cf9 100644
--- a/chrome/common/sandbox_policy.cc
+++ b/chrome/common/sandbox_policy.cc
@@ -546,7 +546,8 @@ base::ProcessHandle StartProcessWithAccess(CommandLine* cmd_line,
     in_sandbox = false;
   }
 #endif
-  if (!browser_command_line.HasSwitch(switches::kDisableExperimentalWebGL) &&
+  if (!browser_command_line.HasSwitch(switches::kDisable3DAPIs) &&
+      !browser_command_line.HasSwitch(switches::kDisableExperimentalWebGL) &&
       browser_command_line.HasSwitch(switches::kInProcessWebGL)) {
     // In process WebGL won't work if the sandbox is enabled.
     in_sandbox = false;