Initialize the bootstrap sandbox in the browser process.

sandbox/mac/bootstrap_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/bootstrap_sandbox.h"
 
 #include "base/logging.h"
 #include "base/mac/mach_logging.h"
 
 #include "sandbox/mac/launchd_interception_server.h"
@@ skipping 42 matching lines @@
 BootstrapSandbox::~BootstrapSandbox() {
   kern_return_t kr = task_set_special_port(mach_task_self(),
       TASK_BOOTSTRAP_PORT, real_bootstrap_port_);
   MACH_CHECK(kr == KERN_SUCCESS, kr);
 }
 
 void BootstrapSandbox::RegisterSandboxPolicy(
     int sandbox_policy_id,
     const BootstrapSandboxPolicy& policy) {
   CHECK(IsPolicyValid(policy));
-  CHECK_GT(sandbox_policy_id, 0);
+  CHECK_GT(sandbox_policy_id, kNotAPolicy);
   base::AutoLock lock(lock_);
   DCHECK(policies_.find(sandbox_policy_id) == policies_.end());
   policies_.insert(std::make_pair(sandbox_policy_id, policy));
 }
 
 void BootstrapSandbox::PrepareToForkWithPolicy(int sandbox_policy_id) {
   base::AutoLock lock(lock_);
 
   CHECK(policies_.find(sandbox_policy_id) != policies_.end());
   CHECK_EQ(kNotAPolicy, effective_policy_id_)
@@ skipping 21 matching lines @@
     sandboxed_processes_.insert(std::make_pair(handle, effective_policy_id_));
     VLOG(3) << "Bootstrap sandbox enforced for pid " << handle;
   }
 
   effective_policy_id_ = kNotAPolicy;
 }
 
 void BootstrapSandbox::ChildDied(base::ProcessHandle handle) {
   base::AutoLock lock(lock_);
   const auto& it = sandboxed_processes_.find(handle);
-  CHECK(it != sandboxed_processes_.end());
-  sandboxed_processes_.erase(it);
+  if (it != sandboxed_processes_.end())
+    sandboxed_processes_.erase(it);
 }
 
 const BootstrapSandboxPolicy* BootstrapSandbox::PolicyForProcess(
     pid_t pid) const {
   base::AutoLock lock(lock_);
   const auto& process = sandboxed_processes_.find(pid);
 
   // The new child could send bootstrap requests before the parent calls
   // FinishedFork().
   int policy_id = effective_policy_id_;
@@ skipping 11 matching lines @@
     : real_bootstrap_port_(MACH_PORT_NULL),
       effective_policy_id_(kNotAPolicy) {
   mach_port_t port = MACH_PORT_NULL;
   kern_return_t kr = task_get_special_port(
       mach_task_self(), TASK_BOOTSTRAP_PORT, &port);
   MACH_CHECK(kr == KERN_SUCCESS, kr);
   real_bootstrap_port_.reset(port);
 }
 
 }  // namespace sandbox