Bug 1453639: Call InitializeHandleVerifier before other sandbox calls. r=jimm

security/sandbox/win/SandboxInitialization.cpp

@@ -106,6 +106,9 @@ InitializeHandleVerifier()
 static sandbox::TargetServices*
 InitializeTargetServices()
 {
+  // This might disable the verifier, so we want to do it before it is used.
+  InitializeHandleVerifier();
+
   sandbox::TargetServices* targetServices =
     sandbox::SandboxFactory::GetTargetServices();
   if (!targetServices) {
@@ -116,8 +119,6 @@ InitializeTargetServices()
     return nullptr;
   }
 
-  InitializeHandleVerifier();
-
   return targetServices;
 }
 
@@ -139,6 +140,9 @@ LowerSandbox()
 static sandbox::BrokerServices*
 InitializeBrokerServices()
 {
+  // This might disable the verifier, so we want to do it before it is used.
+  InitializeHandleVerifier();
+
   sandbox::BrokerServices* brokerServices =
     sandbox::SandboxFactory::GetBrokerServices();
   if (!brokerServices) {
@@ -158,8 +162,6 @@ InitializeBrokerServices()
   scoped_refptr<sandbox::TargetPolicy> policy = brokerServices->CreatePolicy();
   sandbox::ResultCode result = policy->CreateAlternateDesktop(true);
 
-  InitializeHandleVerifier();
-
   return brokerServices;
 }