Preload libxcb-glx on Nvidia GPUs

This is a speculative fix for a crash where seccomp blocks lazy library
loading, which may occur on certain versions of the Nvidia driver.

R=kbr
BUG=1137632

Change-Id: I7716739263ffb3b478003ad9eef4ffaa2b6467f7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2510360
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Matthew Denton <mpdenton@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#822915}

content/gpu/gpu_main.cc

@@ -477,6 +477,8 @@ bool StartSandboxLinux(gpu::GpuWatchdogThread* watchdog_thread,
       gpu_info && angle::IsAMD(gpu_info->active_gpu().vendor_id);
   sandbox_options.use_intel_specific_policies =
       gpu_info && angle::IsIntel(gpu_info->active_gpu().vendor_id);
+  sandbox_options.use_nvidia_specific_policies =
+      gpu_info && angle::IsNVIDIA(gpu_info->active_gpu().vendor_id);
   sandbox_options.accelerated_video_decode_enabled =
       !gpu_prefs.disable_accelerated_video_decode;
   sandbox_options.accelerated_video_encode_enabled =

content/gpu/gpu_sandbox_hook_linux.cc

@@ -395,6 +395,14 @@ bool LoadAmdGpuLibraries() {
   return true;
 }
 
+bool LoadNvidiaLibraries() {
+  // The driver may lazily load libxcb-glx. It's not an error on wayland-only
+  // systems for the library to be missing.
+  if (!dlopen("libxcb-glx.so.0", dlopen_flag))
+    LOG(WARNING) << "dlopen(libxcb-glx.so.0) failed with error: " << dlerror();
+  return true;
+}
+
 bool IsAcceleratedVideoEnabled(
     const sandbox::policy::SandboxSeccompBPF::Options& options) {
   return options.accelerated_video_encode_enabled ||
@@ -433,10 +441,14 @@ bool LoadLibrariesForGpu(
     }
     if (options.use_amd_specific_policies)
       return LoadAmdGpuLibraries();
-  } else if (UseChromecastSandboxAllowlist() && IsArchitectureArm()) {
-    LoadArmGpuLibraries();
-    if (UseV4L2Codec())
-      LoadChromecastV4L2Libraries();
+  } else {
+    if (UseChromecastSandboxAllowlist() && IsArchitectureArm()) {
+      LoadArmGpuLibraries();
+      if (UseV4L2Codec())
+        LoadChromecastV4L2Libraries();
+    }
+    if (options.use_nvidia_specific_policies)
+      return LoadNvidiaLibraries();
   }
   return true;
 }

sandbox/policy/linux/sandbox_seccomp_bpf_linux.h

@@ -26,8 +26,9 @@ namespace policy {
 class SANDBOX_POLICY_EXPORT SandboxSeccompBPF {
  public:
   struct Options {
-    bool use_amd_specific_policies = false;    // For ChromiumOS.
-    bool use_intel_specific_policies = false;  // For ChromiumOS.
+    bool use_amd_specific_policies = false;     // For ChromiumOS.
+    bool use_intel_specific_policies = false;   // For ChromiumOS.
+    bool use_nvidia_specific_policies = false;  // For Linux.
 
     // Options for GPU's PreSandboxHook.
     bool accelerated_video_decode_enabled = false;