macOS V2 Sandbox: allow com.apple.MTLCompilerService.

This adds the MTLCompilerService to the sandbox, allowing for more
efficient video rendering.

Bug: 957217
Change-Id: I67ffb983b5f866e64724abff20a099083d343036
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1592051
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Auto-Submit: Greg Kerr <kerrnel@chromium.org>
Cr-Commit-Position: refs/heads/master@{#656477}

services/service_manager/sandbox/mac/gpu.sb

@@ -91,5 +91,9 @@
 ; Needed for VideoToolbox usage - https://crbug.com/767037
 (allow mach-lookup (global-name "com.apple.coremedia.videodecoder"))
 
+; Needed for 10.14.5+ - https://crbug.com/957217
+(if (defined? 'xpc-service-name)
+  (allow mach-lookup (xpc-service-name "com.apple.MTLCompilerService")))
+
 ; Needed for GPU process to fallback to SwiftShader - https://crbug.com/897914
 (allow file-read-data file-read-metadata (subpath (param bundle-version-path)))

services/service_manager/sandbox/mac/gpu_v2.sb

@@ -22,6 +22,11 @@
   (global-name "com.apple.windowserver.active")
 )
 
+; Needed for metal decoding - https://crbug.com/957217
+(if (>= os-version 1014)
+  (allow mach-lookup (xpc-service-name "com.apple.MTLCompilerService"))
+)
+
 ; Needed for WebGL - https://crbug.com/75343
 (allow iokit-open
   (iokit-connection "IOAccelerator")