[Fuchsia] Add web_engine config, two flags for protected memory

Support global configuration options being read from /config/data.
This allows some WebEngine properties to be tailored to suit the
specific device and system configuration.

Initially two options are provided, to control availability of
protected memory for video playback.

Bug: fuchsia:41143
Change-Id: I5222b956fcce33ae49d575cdd308388310fa80b6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1907474
Commit-Queue: Sergey Ulanov <sergeyu@chromium.org>
Reviewed-by: Wez <wez@chromium.org>
Reviewed-by: David Dorwin <ddorwin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#714703}

fuchsia/engine/context_provider_impl.cc

@@ -24,15 +24,19 @@
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/fuchsia/default_job.h"
 #include "base/fuchsia/fuchsia_logging.h"
+#include "base/json/json_reader.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/process/launch.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
+#include "base/values.h"
 #include "build/build_config.h"
 #include "components/viz/common/features.h"
 #include "content/public/common/content_switches.h"
@@ -104,6 +108,34 @@ bool SetContentDirectoriesInCommandLine(
   return true;
 }
 
+constexpr char kConfigFileName[] = "/config/data/config.json";
+
+base::Value LoadConfigFrom(const base::FilePath& file_path) {
+  if (!base::PathExists(file_path)) {
+    DLOG(WARNING) << file_path.value()
+                  << " doesn't exist. Using default WebEngine configuration.";
+    return base::Value(base::Value::Type::DICTIONARY);
+  }
+
+  std::string file_content;
+  bool loaded = base::ReadFileToString(file_path, &file_content);
+  CHECK(loaded) << "Failed to read " << file_path.value();
+
+  base::JSONReader reader;
+  base::Optional<base::Value> parsed = reader.Read(file_content);
+  CHECK(parsed) << "Failed to parse " << file_path.value() << ": "
+                << reader.GetErrorMessage();
+  CHECK(parsed->is_dict()) << "Config is not a JSON dictinary: "
+                           << file_path.value();
+
+  return std::move(parsed.value());
+}
+
+const base::Value& GetWebEngineConfig() {
+  static base::Value config = LoadConfigFrom(base::FilePath(kConfigFileName));
+  return config;
+}
+
 // Returns true if DRM is supported in current configuration. Currently we
 // assume that it is supported on ARM64, but not on x64.
 //
@@ -238,9 +270,8 @@ void ContextProviderImpl::Create(
     enable_playready = false;
   }
 
-  bool enable_protected_graphics = enable_widevine || enable_playready;
-
-  if (enable_protected_graphics && !enable_vulkan) {
+  bool enable_drm = enable_widevine || enable_playready;
+  if (enable_drm && !enable_vulkan) {
     DLOG(ERROR) << "WIDEVINE_CDM and PLAYREADY_CDM features require VULKAN.";
     context_request.Close(ZX_ERR_INVALID_ARGS);
     return;
@@ -271,6 +302,20 @@ void ContextProviderImpl::Create(
     launch_command.AppendSwitch(switches::kDisableSoftwareRasterizer);
   }
 
+  const base::Value& web_engine_config = GetWebEngineConfig();
+  bool allow_protected_graphics =
+      web_engine_config.FindBoolPath("allow-protected-graphics")
+          .value_or(false);
+  bool force_protected_graphics =
+      web_engine_config.FindBoolPath("force-protected-graphics")
+          .value_or(false);
+  bool enable_protected_graphics =
+      (enable_drm && allow_protected_graphics) || force_protected_graphics;
+
+  if (enable_protected_graphics) {
+    launch_command.AppendSwitch(switches::kEnforceVulkanProtectedMemory);
+  }
+
   if (enable_widevine) {
     launch_command.AppendSwitch(switches::kEnableWidevine);
   }

fuchsia/engine/web_engine.cmx

 {
   "sandbox": {
     "features": [
+      "config-data",
+      "deprecated-ambient-replace-as-executable",
       "root-ssl-certificates",
-      "vulkan",
-      "deprecated-ambient-replace-as-executable"
+      "vulkan"
     ],
     "services": [
       "fuchsia.logger.LogSink",