Change Win32k PPAPI lockdown to use finch params for mime type.

content/browser/ppapi_plugin_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ppapi_plugin_process_host.h"
 
 #include <stddef.h>
 
 #include <string>
 #include <utility>
@@ skipping 72 matching lines @@
     // The Pepper process is as locked-down as a renderer except that it can
     // create the server side of Chrome pipes.
     sandbox::ResultCode result;
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
                              sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
                              L"\\\\.\\pipe\\chrome.*");
     if (result != sandbox::SBOX_ALL_OK)
       return false;
 
 #if !defined(NACL_WIN64)
-    for (const auto& mime_type : info_.mime_types) {
-      if (IsWin32kLockdownEnabledForMimeType(mime_type.mime_type)) {
-        if (!AddWin32kLockdownPolicy(policy))
-          return false;
-        break;
+    if (IsWin32kRendererLockdownEnabled()) {
+      for (const auto& mime_type : info_.mime_types) {
+        if (GetContentClient()->browser()->IsWin32kLockdownEnabledForMimeType(

[Alexei Svitkine (slow), 2016/01/26 08:23:40]

Nit: Store the result of GetContentClient()->browser() in a var outside the
loop.

[jam, 2016/01/26 15:18:51]

given that the list of mime types should be pretty small, why do this without
seeing that it's slow?

[Will Harris, 2016/01/26 22:57:54]

GetContentClient() does seem to do a CALL and it's done twice (once here and
once below) so saving to a stack variable seems like a reasonable optimization.

+                mime_type.mime_type)) {
+          if (!AddWin32kLockdownPolicy(policy))
+            return false;
+          break;
+        }
       }
     }
 #endif
     const base::string16& sid =
         GetContentClient()->browser()->GetAppContainerSidForSandboxType(
             GetSandboxType());
     if (!sid.empty())
       AddAppContainerPolicy(policy, sid.c_str());
 
     return true;
@@ skipping 426 matching lines @@
   // sent_requests_ queue should be the one that the plugin just created.
   Client* client = sent_requests_.front();
   sent_requests_.pop();
 
   const ChildProcessData& data = process_->GetData();
   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
                                data.id);
 }
 
 }  // namespace content