Top document isolation mode prototype

content/browser/browsing_instance.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browsing_instance.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/public/browser/browser_context.h"
@@ skipping 18 matching lines @@
 
 SiteInstance* BrowsingInstance::GetSiteInstanceForURL(const GURL& url) {
   std::string site =
       SiteInstanceImpl::GetSiteForURL(browser_context_, url)
           .possibly_invalid_spec();
 
   SiteInstanceMap::iterator i = site_instance_map_.find(site);
   if (i != site_instance_map_.end())
     return i->second;
 
+  bool use_doghouse = !site_instance_map_.empty() &&
+                      base::CommandLine::ForCurrentProcess()->HasSwitch(
+                          switches::kDogHouseProcess);
+
+  if (use_doghouse) {
+    if (SiteInstance* doghouse = GetDoghouseSiteInstance()) {
+      return doghouse;
+    }
+  }
+
 
   // No current SiteInstance for this site, so let's create one.
   SiteInstanceImpl* instance = new SiteInstanceImpl(this);
 
   // Set the site of this new SiteInstance, which will register it with us.
   instance->SetSite(url);
+
+  // TODO(xiaochengh): Say something here...
+  instance->SetForDoghouse(use_doghouse);

[ncarter (slow), 2016/03/14 17:42:24]

I think this choice (of which SiteInstance becomes the doghouse) needs to
somehow be aware of main frame / subframe state, which simply isn't available at
this level.

My expectation is that the first SiteInstance we create will be for the main
frame, which we want to be non-doghouse process.

The crashes you see may be process kills due to the LockToOrigin checks.
Basically, you cannot have UseDedicatedProcessesForAllSites() return true and
then also put two different sites in the same renderer process: the process will
be locked only to the first origin, and we will kill the renderer when the
second site tries to e.g. read document.cookie.

The solution is to not have UseDedicatedProcessesForAllSites() return true in
doghouse mode. Ultimately doghouse is going to be a fourth site isolation mode
(after --site-per-process, --isolate-extensions, and
--isolate-sites-for-testing). Getting this mode implemented right seems like
something that will require a pretty deep knowledge of the process model, so I'm
happy to take it on -- I actually started hacking on it on Friday. I am
optimistic that I can have a patch up today.

   return instance;
 }
 
+SiteInstance* BrowsingInstance::GetDoghouseSiteInstance() const {
+  for (SiteInstanceMap::const_iterator i = site_instance_map_.begin();
+       i != site_instance_map_.end(); ++i) {
+    if (i->second->IsForDoghouse())
+      return i->second;
+  }
+  return nullptr;
+}
+
 void BrowsingInstance::RegisterSiteInstance(SiteInstance* site_instance) {
   DCHECK(static_cast<SiteInstanceImpl*>(site_instance)
              ->browsing_instance_.get() ==
          this);
   DCHECK(static_cast<SiteInstanceImpl*>(site_instance)->HasSite());
   std::string site = site_instance->GetSiteURL().possibly_invalid_spec();
 
   // Only register if we don't have a SiteInstance for this site already.
   // It's possible to have two SiteInstances point to the same site if two
   // tabs are navigated there at the same time.  (We don't call SetSite or
@@ skipping 24 matching lines @@
 }
 
 BrowsingInstance::~BrowsingInstance() {
   // We should only be deleted when all of the SiteInstances that refer to
   // us are gone.
   DCHECK(site_instance_map_.empty());
   DCHECK_EQ(0u, active_contents_count_);
 }
 
 }  // namespace content