Ensure that the DirectWrite font cache works in Chrome canary on Windows 8+ with AppContainer prote…

content/browser/renderer_host/render_process_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Represents the browser side of the browser <--> renderer communication
 // channel. There will be one RenderProcessHost per renderer process.
 
 #include "content/browser/renderer_host/render_process_host_impl.h"
 
 #include <algorithm>
@@ skipping 157 matching lines @@
 #include "ui/native_theme/native_theme_switches.h"
 
 #if defined(OS_ANDROID)
 #include "content/browser/android/child_process_launcher_android.h"
 #include "content/browser/media/android/browser_demuxer_android.h"
 #include "content/browser/mojo/service_registrar_android.h"
 #include "content/browser/screen_orientation/screen_orientation_message_filter_android.h"
 #endif
 
 #if defined(OS_WIN)
+#include "base/memory/shared_memory.h"
 #include "base/win/scoped_com_initializer.h"
 #include "base/win/windows_version.h"
 #include "content/common/font_cache_dispatcher_win.h"
 #include "content/common/sandbox_win.h"
+#include "content/public/common/dwrite_font_platform_win.h"
 #include "sandbox/win/src/sandbox_policy.h"
+#include "ui/gfx/win/direct_write.h"
 #include "ui/gfx/win/dpi.h"
 #endif
 
 #if defined(ENABLE_BROWSER_CDMS)
 #include "content/browser/media/cdm/browser_cdm_manager.h"
 #endif
 
 #if defined(ENABLE_PLUGINS)
 #include "content/browser/plugin_service_impl.h"
 #endif
@@ skipping 129 matching lines @@
   return map;
 }
 
 // NOTE: changes to this class need to be reviewed by the security team.
 class RendererSandboxedProcessLauncherDelegate
     : public SandboxedProcessLauncherDelegate {
  public:
   explicit RendererSandboxedProcessLauncherDelegate(IPC::ChannelProxy* channel)
 #if defined(OS_POSIX)
       : ipc_fd_(channel->TakeClientFileDescriptor())
-#endif  // OS_POSIX
+#elif defined(OS_WIN)
+      : direct_write_font_cache_section_(NULL)
+#endif  // OS_WIN
   {}
 
   ~RendererSandboxedProcessLauncherDelegate() override {}
 
 #if defined(OS_WIN)
   void PreSpawnTarget(sandbox::TargetPolicy* policy, bool* success) override {
     AddBaseHandleClosePolicy(policy);
 
     if (base::win::GetVersion() == base::win::VERSION_WIN8 ||
         base::win::GetVersion() == base::win::VERSION_WIN8_1) {
       const base::CommandLine& command_line =
           *base::CommandLine::ForCurrentProcess();
       if (!command_line.HasSwitch(switches::kDisableAppContainer)) {
         // TODO(shrikant): Check if these constants should be different across
         // various versions of Chromium code base or could be same.
         // If there should be different SID per channel then move this code
         // in chrome rather than content and assign SID based on
         // VersionInfo::GetChannel().
         const wchar_t kAppContainerSid[] =
             L"S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-"
             L"924012148-129201922";
 
         policy->SetLowBox(kAppContainerSid);
       }
     }
 
+    // If we have a valid DirectWrite font cache section then add its handle to
+    // the list of handles being shared with the renderer process.
+    if (direct_write_font_cache_section_)
+      policy->AddHandleToShare(direct_write_font_cache_section_);
+
     GetContentClient()->browser()->PreSpawnRenderer(policy, success);
   }
 
+  void set_direct_write_font_cache_handle(
+      base::SharedMemoryHandle direct_write_font_cache_section) {
+    direct_write_font_cache_section_ = direct_write_font_cache_section;

[Shrikant Kelkar, 2015/05/05 20:43:16]

Scope/DuplicateHandle?

[ananta, 2015/05/07 22:00:47]

This code is no longer needed. Based on a discussion with cpu, we decided to
move this code to content sandbox

+  }
 #elif defined(OS_POSIX)
   bool ShouldUseZygote() override {
     const base::CommandLine& browser_command_line =
         *base::CommandLine::ForCurrentProcess();
     base::CommandLine::StringType renderer_prefix =
         browser_command_line.GetSwitchValueNative(switches::kRendererCmdPrefix);
     return renderer_prefix.empty();
   }
   base::ScopedFD TakeIpcFd() override { return ipc_fd_.Pass(); }
 #endif  // OS_WIN
 
  private:
 #if defined(OS_POSIX)
   base::ScopedFD ipc_fd_;
 #endif  // OS_POSIX
+
+#if defined(OS_WIN)
+  base::SharedMemoryHandle direct_write_font_cache_section_;

[Shrikant Kelkar, 2015/05/05 20:43:15]

Scope? Who is the owner?

[ananta, 2015/05/07 22:00:48]

Reworked the patch to move the handle sharing and passing the duplicated handle
via the command line code to content sandbox

+#endif
 };
 
 const char kSessionStorageHolderKey[] = "kSessionStorageHolderKey";
 
 class SessionStorageHolder : public base::SupportsUserData::Data {
  public:
   SessionStorageHolder() {}
   ~SessionStorageHolder() override {}
 
   void Hold(const SessionStorageNamespaceMap& sessions, int view_route_id) {
@@ skipping 271 matching lines @@
     // on starting in-process-render-thread.
     // So put it here to trigger ChannelMojo initialization earlier to enable
     // in-process-render-thread using ChannelMojo there.
     OnProcessLaunched();  // Fake a callback that the process is ready.
 
     in_process_renderer_->StartWithOptions(options);
 
     g_in_process_thread = in_process_renderer_->message_loop();
 
   } else {
+    RendererSandboxedProcessLauncherDelegate* sandbox_delegate =
+        new RendererSandboxedProcessLauncherDelegate(channel_.get());
+#if defined(OS_WIN)
+    // If DirectWrite is enabled for font rendering then open the font cache
+    // section and pass the handle to the renderer process. This is needed
+    // because renderer processes on Windows 8+ may be running in an
+    // AppContainer sandbox and hence their kernel object namespace may be
+    // partitioned.
+    if (!run_renderer_in_process() && gfx::win::ShouldUseDirectWrite()) {
+        std::string name(content::kFontCacheSharedSectionName);
+        name.append(base::UintToString(base::GetCurrentProcId()));
+        direct_write_font_cache_section_.set_inheritable(true);
+        if (direct_write_font_cache_section_.Open(name, true)) {
+          sandbox_delegate->set_direct_write_font_cache_handle(
+              direct_write_font_cache_section_.handle());
+        }
+    }
+#endif
     // Build command line for renderer.  We call AppendRendererCommandLine()
     // first so the process type argument will appear first.
     base::CommandLine* cmd_line = new base::CommandLine(renderer_path);
     if (!renderer_prefix.empty())
       cmd_line->PrependWrapper(renderer_prefix);
     AppendRendererCommandLine(cmd_line);
     cmd_line->AppendSwitchASCII(switches::kProcessChannelID, channel_id);
 
     // Spawn the child process asynchronously to avoid blocking the UI thread.
     // As long as there's no renderer prefix, we can use the zygote process
     // at this stage.
     child_process_launcher_.reset(new ChildProcessLauncher(
-        new RendererSandboxedProcessLauncherDelegate(channel_.get()),
+        sandbox_delegate,
         cmd_line,
         GetID(),
         this));
 
     fast_shutdown_started_ = false;
   }
 
   if (!gpu_observer_registered_) {
     gpu_observer_registered_ = true;
     ui::GpuSwitchingManager::GetInstance()->AddObserver(this);
@@ skipping 500 matching lines @@
 
   GetContentClient()->browser()->AppendExtraCommandLineSwitches(
       command_line, GetID());
 
   if (IsPinchToZoomEnabled())
     command_line->AppendSwitch(switches::kEnablePinch);
 
 #if defined(OS_WIN)
   command_line->AppendSwitchASCII(switches::kDeviceScaleFactor,
                                   base::DoubleToString(gfx::GetDPIScale()));
-  command_line->AppendSwitchASCII(
-      switches::kFontCacheSharedMemSuffix,
-      base::UintToString(base::GetCurrentProcId()));
+  if (direct_write_font_cache_section_.handle()) {
+    command_line->AppendSwitchASCII(
+        switches::kFontCacheSharedHandle,
+        base::UintToString(reinterpret_cast<unsigned int>(
+            direct_write_font_cache_section_.handle())));
+  }
 #endif
 
   AppendCompositorCommandLineFlags(command_line);
 }
 
 void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     const base::CommandLine& browser_cmd,
     base::CommandLine* renderer_cmd) const {
   // Propagate the following switches to the renderer command line (along
   // with any associated values) if present in the browser command line.
@@ skipping 1276 matching lines @@
   if (worker_ref_count_ == 0)
     Cleanup();
 }
 
 void RenderProcessHostImpl::GetAudioOutputControllers(
     const GetAudioOutputControllersCallback& callback) const {
   audio_renderer_host()->GetOutputControllers(callback);
 }
 
 }  // namespace content