Linux sandbox: Restrict sched_* calls in the renderer policy.

Linux sandbox: Restrict sched_* calls in the renderer policy.

BUG=413855
Committed: https://crrev.com/9c2d68671be845029dc83ee5667aeb32da693d2b
Cr-Commit-Position: refs/heads/master@{#299193}

[rickyz (no longer on Chrome), 2014-10-08 23:52:16]

rickyz@chromium.org changed reviewers:
+ jln@chromium.org

[rickyz (no longer on Chrome), 2014-10-08 23:52:17]

Looks like WebRTC in Chromium has picked up the change, so the renderer policy
change should be OK now.

I tested the renderer policy with:
browser_tests
content_browsertests
Compiled a release build with Flash and tested youtube + a flash game

With help from Jorge, I tested the cros arm GPU policy on an ARM chromebook with
some webgl experiments and didn't see any sandbox-related crashes, though it was
being pretty flaky, and the GPU process was hanging and getting killed by the
watchdog pretty often - not sure how expected thsi is yet.

[jln (very slow on Chromium), 2014-10-09 00:00:39]

Hmm, I would suggest that we split this in to two CL. One for renderer, another
one for the GPU.
It's nice to be able to revert with one click, and it also makes bisection more
verbose when tracking down issues.

GPU is hard to test and a tough beast and I think we may want to send a FYI to
the gpu-team when landing this.

[rickyz (no longer on Chrome), 2014-10-09 00:17:40]

On 2014/10/09 00:00:39, jln (slow on IPC reviews) wrote:
> Hmm, I would suggest that we split this in to two CL. One for renderer,
another
> one for the GPU.
> It's nice to be able to revert with one click, and it also makes bisection
more
> verbose when tracking down issues.
> 
> GPU is hard to test and a tough beast and I think we may want to send a FYI to
> the gpu-team when landing this.

I split the GPU part into https://codereview.chromium.org/640123002/, and I'll
send a note about the it to GPU folks (is graphics-dev the right group for
this)?

[jln (very slow on Chromium), 2014-10-09 00:20:48]

lgtm

> I split the GPU part into https://codereview.chromium.org/640123002/, and I'll
> send a note about the it to GPU folks (is graphics-dev the right group for
> this)?

Yes, I think so!

[rickyz (no longer on Chrome), 2014-10-10 21:28:53]

The CQ bit was checked by rickyz@chromium.org

[commit-bot: I haz the power, 2014-10-10 21:30:20]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/639183003/20001

[commit-bot: I haz the power, 2014-10-10 21:46:32]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2014-10-10 21:47:32]

Patchset 2 (id:??) landed as
https://crrev.com/9c2d68671be845029dc83ee5667aeb32da693d2b
Cr-Commit-Position: refs/heads/master@{#299193}