sandbox_bpf: rework how unsafe traps are compiled/verified

sandbox/linux/bpf_dsl/bpf_dsl.cc

Index: sandbox/linux/bpf_dsl/bpf_dsl.cc
diff --git a/sandbox/linux/bpf_dsl/bpf_dsl.cc b/sandbox/linux/bpf_dsl/bpf_dsl.cc
index 8b343f981103b47d64898ecba448b9c3c9ca94bc..dd8eab6c140137217500e64fc32ac415a5ab1afb 100644
--- a/sandbox/linux/bpf_dsl/bpf_dsl.cc
+++ b/sandbox/linux/bpf_dsl/bpf_dsl.cc
@@ -12,6 +12,7 @@
 #include "base/memory/ref_counted.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
+#include "sandbox/linux/seccomp-bpf/syscall_iterator.h"
 
 namespace sandbox {
 namespace bpf_dsl {
@@ -38,7 +39,7 @@ class ErrorResultExprImpl : public internal::ResultExprImpl {
   }
 
   virtual ErrorCode Compile(SandboxBPF* sb) const override {
-    return ErrorCode(err_);
+    return sb->Error(err_);
   }
 
  private:
@@ -112,6 +113,8 @@ class UnsafeTrapResultExprImpl : public internal::ResultExprImpl {
     return sb->UnsafeTrap(func_, arg_);
   }
 
+  virtual bool HasUnsafeTraps() const override { return true; }
+
  private:
   virtual ~UnsafeTrapResultExprImpl() {}
 
@@ -133,6 +136,10 @@ class IfThenResultExprImpl : public internal::ResultExprImpl {
         sb, then_result_->Compile(sb), else_result_->Compile(sb));
   }
 
+  virtual bool HasUnsafeTraps() const override {
+    return then_result_->HasUnsafeTraps() || else_result_->HasUnsafeTraps();
+  }
+
  private:
   virtual ~IfThenResultExprImpl() {}
 
@@ -249,6 +256,10 @@ class OrBoolExprImpl : public internal::BoolExprImpl {
 
 namespace internal {
 
+bool ResultExprImpl::HasUnsafeTraps() const {
+  return false;
+}
+
 uint64_t DefaultMask(size_t size) {
   switch (size) {
     case 4:
@@ -376,6 +387,17 @@ ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const {
   return InvalidSyscall()->Compile(sb);
 }
 
+bool SandboxBPFDSLPolicy::HasUnsafeTraps() const {
+  for (SyscallIterator iter(false); !iter.Done();) {
+    uint32_t sysnum = iter.Next();
+    if (SyscallIterator::IsValid(sysnum) &&
+        EvaluateSyscall(sysnum)->HasUnsafeTraps()) {
+      return true;
+    }
+  }
+  return InvalidSyscall()->HasUnsafeTraps();
+}
+
 ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, const void* aux) {
   return bpf_dsl::Trap(trap_func, aux);
 }