Bug 219740

Summary: [macOS] Create sandbox extension for AppleAVDUserClient when Media in GPU process is not enabled
Product: WebKit Reporter: Per Arne Vollan <pvollan>
Component: WebKit Misc.Assignee: Per Arne Vollan <pvollan>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
ews-feeder: commit-queue-
Patch
none
Patch
bfulgham: review+
Patch none

Description Per Arne Vollan 2020-12-10 06:03:43 PST 
Create sandbox extension for AppleAVDUserClient for WebContent process when Media in GPU process is not enabled on macOS.
Comment 1 Per Arne Vollan 2020-12-10 06:04:01 PST 
<rdar://problem/70496905>
Comment 2 Per Arne Vollan 2020-12-10 06:11:22 PST 
Created attachment 415865 [details]
Patch
Comment 3 Per Arne Vollan 2020-12-10 06:22:22 PST 
Created attachment 415867 [details]
Patch
Comment 4 Per Arne Vollan 2020-12-10 06:28:43 PST 
Created attachment 415870 [details]
Patch
Comment 5 Brent Fulgham 2020-12-10 09:28:40 PST 
Comment on attachment 415870 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=415870&action=review

r=me. It's odd that this is apparently needed for Apple Silicon Macs, but isn't needed in the GPU Process. I'll bet that's a mistake.

> Source/WebKit/UIProcess/WebPageProxy.cpp:7795
> +#if PLATFORM(MAC) && CPU(ARM64)

Is this needed for Catalyst, too? Or does that get picked up by this rule, too?

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:934
> +            (iokit-user-client-class "AppleAVDUserClient")

Shouldn't this be listed in the GPU Process sandbox, too?
Comment 6 Per Arne Vollan 2020-12-10 11:05:33 PST 
Created attachment 415902 [details]
Patch
Comment 7 Per Arne Vollan 2020-12-10 11:08:15 PST 
(In reply to Brent Fulgham from comment #5)
> Comment on attachment 415870 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=415870&action=review
> 
> r=me. It's odd that this is apparently needed for Apple Silicon Macs, but
> isn't needed in the GPU Process. I'll bet that's a mistake.
> 
> > Source/WebKit/UIProcess/WebPageProxy.cpp:7795
> > +#if PLATFORM(MAC) && CPU(ARM64)
> 
> Is this needed for Catalyst, too? Or does that get picked up by this rule,
> too?
> 

I included Catalyst in the latest patch.

> > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:934
> > +            (iokit-user-client-class "AppleAVDUserClient")
> 
> Shouldn't this be listed in the GPU Process sandbox, too?

That is a good point. I have added this in the patch for landing.

Thanks for reviewing!
Comment 8 EWS 2020-12-10 14:31:54 PST 
Committed r270657: <https://trac.webkit.org/changeset/270657>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 415902 [details].