Give plug-in processes an executable heap and disable PIE/ASLR for Native

content/browser/plugin_process_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/plugin_process_host.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #elif defined(OS_POSIX)
 #include <utility>  // for pair<>
@@ skipping 157 matching lines @@
   set_version(info_.version);
 
   if (!CreateChannel())
     return false;
 
   // Build command line for plugin. When we have a plugin launcher, we can't
   // allow "self" on linux and we need the real file path.
   const CommandLine& browser_command_line = *CommandLine::ForCurrentProcess();
   CommandLine::StringType plugin_launcher =
       browser_command_line.GetSwitchValueNative(switches::kPluginLauncher);
-  FilePath exe_path = GetChildPath(plugin_launcher.empty());
+
+#if defined(OS_MACOSX)
+  // Run the plug-in process in a mode tolerant of heap execution without
+  // explicit mprotect calls. Some plug-ins still rely on this quaint and
+  // archaic "feature." See http://crbug.com/93551.
+  int flags = CHILD_ALLOW_HEAP_EXECUTION;
+#elif defined(OS_LINUX)
+  int flags = plugin_launcher.empty() ? CHILD_ALLOW_SELF : CHILD_NORMAL;
+#else
+  int flags = CHILD_NORMAL;
+#endif
+
+  FilePath exe_path = GetChildPath(flags);
   if (exe_path.empty())
     return false;
 
   CommandLine* cmd_line = new CommandLine(exe_path);
   // Put the process type and plugin path first so they're easier to see
   // in process listings using native process management tools.
   cmd_line->AppendSwitchASCII(switches::kProcessType, switches::kPluginProcess);
   cmd_line->AppendSwitchPath(switches::kPluginPath, info.path);
 
   // Propagate the following switches to the plugin command line (along with
@@ skipping 166 matching lines @@
   }
 }
 
 void PluginProcessHost::OnChannelCreated(
     const IPC::ChannelHandle& channel_handle) {
   Client* client = sent_requests_.front();
 
   client->OnChannelOpened(channel_handle);
   sent_requests_.pop();
 }