Have each SandboxedProcessLauncherDelegate maintain a zygote.

components/nacl/browser/nacl_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/browser/nacl_process_host.h"
 
 #include <string.h>
 #include <algorithm>
 #include <string>
 #include <utility>
@@ skipping 50 matching lines @@
 #include "ppapi/shared_impl/ppapi_constants.h"
 #include "ppapi/shared_impl/ppapi_nacl_plugin_args.h"
 
 #if defined(OS_POSIX)
 
 #include <arpa/inet.h>
 #include <fcntl.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 
+#include "content/public/browser/zygote_handle_linux.h"
 #include "ipc/ipc_channel_posix.h"
 #elif defined(OS_WIN)
 #include <windows.h>
 #include <winsock2.h>
 
 #include "base/threading/thread.h"
 #include "base/win/scoped_handle.h"
 #include "components/nacl/browser/nacl_broker_service_win.h"
 #include "components/nacl/common/nacl_debug_exception_handler_win.h"
 #include "content/public/common/sandbox_init.h"
@@ skipping 67 matching lines @@
   return (base::win::OSInfo::GetInstance()->wow64_status() ==
           base::win::OSInfo::WOW64_ENABLED);
 }
 
 }  // namespace
 
 #endif  // defined(OS_WIN)
 
 namespace {
 
+#if defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
+content::ZygoteHandle g_nacl_zygote;
+#endif  // defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
+
 // NOTE: changes to this class need to be reviewed by the security team.
 class NaClSandboxedProcessLauncherDelegate
     : public content::SandboxedProcessLauncherDelegate {
  public:
   NaClSandboxedProcessLauncherDelegate(ChildProcessHost* host)
 #if defined(OS_POSIX)
       : ipc_fd_(host->TakeClientFileDescriptor())
 #endif
   {}
 
   ~NaClSandboxedProcessLauncherDelegate() override {}
 
 #if defined(OS_WIN)
   void PostSpawnTarget(base::ProcessHandle process) override {
     // For Native Client sel_ldr processes on 32-bit Windows, reserve 1 GB of
     // address space to prevent later failure due to address space fragmentation
     // from .dll loading. The NaCl process will attempt to locate this space by
     // scanning the address space using VirtualQuery.
     // TODO(bbudge) Handle the --no-sandbox case.
     // http://code.google.com/p/nativeclient/issues/detail?id=2131
     const SIZE_T kNaClSandboxSize = 1 << 30;
     if (!nacl::AllocateAddressSpaceASLR(process, kNaClSandboxSize)) {
       DLOG(WARNING) << "Failed to reserve address space for Native Client";
     }
   }
 #elif defined(OS_POSIX)
-  bool ShouldUseZygote() override { return true; }
+#if !defined(OS_MACOSX) && !defined(OS_ANDROID)
+  content::ZygoteHandle* GetZygote() override { return &g_nacl_zygote; }
+#endif  // !defined(OS_MACOSX) && !defined(OS_ANDROID)
+
   base::ScopedFD TakeIpcFd() override { return std::move(ipc_fd_); }
 #endif  // OS_WIN
 
  private:
 #if defined(OS_POSIX)
   base::ScopedFD ipc_fd_;
 #endif  // OS_POSIX
 };
 
 void SetCloseOnExec(NaClHandle fd) {
@@ skipping 215 matching lines @@
       cmd->GetSwitchValueASCII(switches::kNaClDebugMask);
   // By default, exclude debugging SSH and the PNaCl translator.
   // about::flags only allows empty flags as the default, so replace
   // the empty setting with the default. To debug all apps, use a wild-card.
   if (nacl_debug_mask.empty()) {
     nacl_debug_mask = "!*://*/*ssh_client.nmf,chrome://pnacl-translator/*";
   }
   NaClBrowser::GetDelegate()->SetDebugPatterns(nacl_debug_mask);
 }
 
+#if defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
+// static
+void NaClProcessHost::EarlyZygoteLaunch() {
+  DCHECK(!g_nacl_zygote);
+  g_nacl_zygote = content::CreateZygote();
+}
+#endif  // defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
+
 // static
 void NaClProcessHost::SetPpapiKeepAliveThrottleForTesting(
     unsigned milliseconds) {
   keepalive_throttle_interval_milliseconds_ = milliseconds;
 }
 
 void NaClProcessHost::Launch(
     NaClHostMessageFilter* nacl_host_message_filter,
     IPC::Message* reply_msg,
     const base::FilePath& manifest_path) {
@@ skipping 943 matching lines @@
     NaClStartDebugExceptionHandlerThread(
         process.Pass(), info, base::ThreadTaskRunnerHandle::Get(),
         base::Bind(&NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker,
                    weak_factory_.GetWeakPtr()));
     return true;
   }
 }
 #endif
 
 }  // namespace nacl