Update from https://crrev.com/306655

sandbox/linux/bpf_dsl/bpf_dsl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 
 #include <limits>
 
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h"
 #include "sandbox/linux/bpf_dsl/policy_compiler.h"
+#include "sandbox/linux/seccomp-bpf/die.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 
 namespace sandbox {
 namespace bpf_dsl {
 namespace {
 
+intptr_t BPFFailure(const struct arch_seccomp_data&, void* aux) {
+  SANDBOX_DIE(static_cast<char*>(aux));
+}
+
 class AllowResultExprImpl : public internal::ResultExprImpl {
  public:
   AllowResultExprImpl() {}
 
   ErrorCode Compile(PolicyCompiler* pc) const override {
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 
+  bool IsAllow() const override { return true; }
+
  private:
   ~AllowResultExprImpl() override {}
 
   DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl);
 };
 
 class ErrorResultExprImpl : public internal::ResultExprImpl {
  public:
   explicit ErrorResultExprImpl(int err) : err_(err) {
     CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO);
   }
 
   ErrorCode Compile(PolicyCompiler* pc) const override {
     return pc->Error(err_);
   }
 
+  bool IsDeny() const override { return true; }
+
  private:
   ~ErrorResultExprImpl() override {}
 
   int err_;
 
   DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl);
 };
 
-class KillResultExprImpl : public internal::ResultExprImpl {
- public:
-  explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); }
-
-  ErrorCode Compile(PolicyCompiler* pc) const override {
-    return pc->Kill(msg_);
-  }
-
- private:
-  ~KillResultExprImpl() override {}
-
-  const char* msg_;
-
-  DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl);
-};
-
 class TraceResultExprImpl : public internal::ResultExprImpl {
  public:
   TraceResultExprImpl(uint16_t aux) : aux_(aux) {}
 
   ErrorCode Compile(PolicyCompiler* pc) const override {
     return ErrorCode(ErrorCode::ERR_TRACE + aux_);
   }
 
  private:
   ~TraceResultExprImpl() override {}
 
   uint16_t aux_;
 
   DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl);
 };
 
 class TrapResultExprImpl : public internal::ResultExprImpl {
  public:
-  TrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg)
-      : func_(func), arg_(arg) {
+  TrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg, bool safe)
+      : func_(func), arg_(arg), safe_(safe) {
     DCHECK(func_);
   }
 
   ErrorCode Compile(PolicyCompiler* pc) const override {
-    return pc->Trap(func_, arg_);
+    return pc->Trap(func_, arg_, safe_);
   }
 
+  bool HasUnsafeTraps() const override { return safe_ == false; }
+
+  bool IsDeny() const override { return true; }
+
  private:
   ~TrapResultExprImpl() override {}
 
   TrapRegistry::TrapFnc func_;
   const void* arg_;
+  bool safe_;
 
   DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl);
 };
 
-class UnsafeTrapResultExprImpl : public internal::ResultExprImpl {
- public:
-  UnsafeTrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg)
-      : func_(func), arg_(arg) {
-    DCHECK(func_);
-  }
-
-  ErrorCode Compile(PolicyCompiler* pc) const override {
-    return pc->UnsafeTrap(func_, arg_);
-  }
-
-  bool HasUnsafeTraps() const override { return true; }
-
- private:
-  ~UnsafeTrapResultExprImpl() override {}
-
-  TrapRegistry::TrapFnc func_;
-  const void* arg_;
-
-  DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl);
-};
-
 class IfThenResultExprImpl : public internal::ResultExprImpl {
  public:
   IfThenResultExprImpl(const BoolExpr& cond,
                        const ResultExpr& then_result,
                        const ResultExpr& else_result)
       : cond_(cond), then_result_(then_result), else_result_(else_result) {}
 
   ErrorCode Compile(PolicyCompiler* pc) const override {
     return cond_->Compile(
         pc, then_result_->Compile(pc), else_result_->Compile(pc));
@@ skipping 116 matching lines @@
 };
 
 }  // namespace
 
 namespace internal {
 
 bool ResultExprImpl::HasUnsafeTraps() const {
   return false;
 }
 
+bool ResultExprImpl::IsAllow() const {
+  return false;
+}
+
+bool ResultExprImpl::IsDeny() const {
+  return false;
+}
+
 uint64_t DefaultMask(size_t size) {
   switch (size) {
     case 4:
       return std::numeric_limits<uint32_t>::max();
     case 8:
       return std::numeric_limits<uint64_t>::max();
     default:
       CHECK(false) << "Unimplemented DefaultMask case";
       return 0;
   }
@@ skipping 13 matching lines @@
 
 ResultExpr Allow() {
   return ResultExpr(new const AllowResultExprImpl());
 }
 
 ResultExpr Error(int err) {
   return ResultExpr(new const ErrorResultExprImpl(err));
 }
 
 ResultExpr Kill(const char* msg) {
-  return ResultExpr(new const KillResultExprImpl(msg));
+  return Trap(BPFFailure, msg);
 }
 
 ResultExpr Trace(uint16_t aux) {
   return ResultExpr(new const TraceResultExprImpl(aux));
 }
 
 ResultExpr Trap(TrapRegistry::TrapFnc trap_func, const void* aux) {
-  return ResultExpr(new const TrapResultExprImpl(trap_func, aux));
+  return ResultExpr(
+      new const TrapResultExprImpl(trap_func, aux, true /* safe */));
 }
 
 ResultExpr UnsafeTrap(TrapRegistry::TrapFnc trap_func, const void* aux) {
-  return ResultExpr(new const UnsafeTrapResultExprImpl(trap_func, aux));
+  return ResultExpr(
+      new const TrapResultExprImpl(trap_func, aux, false /* unsafe */));
 }
 
 BoolExpr BoolConst(bool value) {
   return BoolExpr(new const ConstBoolExprImpl(value));
 }
 
 BoolExpr operator!(const BoolExpr& cond) {
   return BoolExpr(new const NegateBoolExprImpl(cond));
 }
 
@@ skipping 51 matching lines @@
         new const IfThenResultExprImpl(clause.first, clause.second, expr));
   }
   return expr;
 }
 
 }  // namespace bpf_dsl
 }  // namespace sandbox
 
 template class scoped_refptr<const sandbox::bpf_dsl::internal::BoolExprImpl>;
 template class scoped_refptr<const sandbox::bpf_dsl::internal::ResultExprImpl>;