Use SharedPersistentMemoryAllocator to share field trial state

content/browser/child_process_launcher.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_launcher.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
 #include "base/i18n/icu_util.h"
 #include "base/logging.h"
+#include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/process/launch.h"
 #include "base/process/process.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread.h"
 #include "build/build_config.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_descriptors.h"
 #include "content/public/common/content_switches.h"
@@ skipping 89 matching lines @@
 }
 #endif
 
 void LaunchOnLauncherThread(const NotifyCallback& callback,
                             BrowserThread::ID client_thread_id,
                             int child_process_id,
                             SandboxedProcessLauncherDelegate* delegate,
 #if defined(OS_ANDROID)
                             base::ScopedFD ipcfd,
 #endif
-                            const base::SharedMemory* field_trial_state,
                             mojo::edk::ScopedPlatformHandle client_handle,
                             base::CommandLine* cmd_line) {
   DCHECK_CURRENTLY_ON(BrowserThread::PROCESS_LAUNCHER);
   std::unique_ptr<SandboxedProcessLauncherDelegate> delegate_deleter(delegate);
 #if !defined(OS_ANDROID)
   ZygoteHandle zygote = nullptr;
   int launch_result = LAUNCH_RESULT_FAILURE;
 #endif
 #if defined(OS_WIN)
   bool launch_elevated = delegate->ShouldLaunchElevated();
@@ skipping 11 matching lines @@
 #if defined(OS_WIN)
   if (launch_elevated) {
     // When establishing a Mojo connection, the pipe path has already been added
     // to the command line.
     base::LaunchOptions options;
     options.start_hidden = true;
     process = base::LaunchElevatedProcess(*cmd_line, options);
   } else {
     base::HandlesToInheritVector handles;
     handles.push_back(client_handle.get().handle);
-    if (field_trial_state)
-      handles.push_back(field_trial_state->handle().GetHandle());
+    if (base::FieldTrialList::field_trial_allocator) {

[Alexei Svitkine (slow), 2016/10/12 20:41:00]

Instead of this construct, how about making a function on FieldTrialList that
takes |handles| and appends it if necessary. Then, it's a simple call here and
you don't need to expose the allocator object outside the .cc file.

[lawrencewu, 2016/10/14 04:54:10]

Done. Created a AppendFieldTrialHandleIfNeeded() function and made the allocator
private.

+      handles.push_back(
+          base::FieldTrialList::field_trial_allocator->shared_memory()

[bcwhite, 2016/10/13 14:28:02]

The shared memory MUST be passed read-only.  Renderers are untrusted and we
can't allow for a compromised one to be able to alter these settings.  Ensure
that is the case and document it.

[lawrencewu, 2016/10/14 04:54:10]

If I understand the shared memory model correctly, this means that if the shared
memory is NOT read-only (which, I believe, is the case), then I must duplicate
the handle with read-only permissions and pass that handle down, right?

Haven't done any work on this issue yet, just want to clarify.

[bcwhite, 2016/10/14 13:56:56]

Sounds reasonable but I don't know.  You'll have to ask somebody with more
low-level windows experience.

+              ->handle()
+              .GetHandle());
+    }
     cmd_line->AppendSwitchASCII(
         mojo::edk::PlatformChannelPair::kMojoPlatformChannelHandleSwitch,
         base::UintToString(base::win::HandleToUint32(handles[0])));
     launch_result =
         StartSandboxedProcess(delegate, cmd_line, handles, &process);
   }
 #elif defined(OS_POSIX)
   std::string process_type =
       cmd_line->GetSwitchValueASCII(switches::kProcessType);
   std::unique_ptr<FileDescriptorInfo> files_to_register(
@@ skipping 225 matching lines @@
 #endif
 }
 
 }  // namespace
 
 ChildProcessLauncher::ChildProcessLauncher(
     SandboxedProcessLauncherDelegate* delegate,
     base::CommandLine* cmd_line,
     int child_process_id,
     Client* client,
-    const base::SharedMemory* field_trial_state,
     const std::string& mojo_child_token,
     const mojo::edk::ProcessErrorCallback& process_error_callback,
     bool terminate_on_shutdown)
     : client_(client),
       termination_status_(base::TERMINATION_STATUS_NORMAL_TERMINATION),
       exit_code_(RESULT_CODE_NORMAL_EXIT),
       zygote_(nullptr),
       starting_(true),
       process_error_callback_(process_error_callback),
 #if defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER) ||  \
     defined(MEMORY_SANITIZER) || defined(THREAD_SANITIZER) || \
     defined(UNDEFINED_SANITIZER)
       terminate_child_on_shutdown_(false),
 #else
       terminate_child_on_shutdown_(terminate_on_shutdown),
 #endif
       mojo_child_token_(mojo_child_token),
       weak_factory_(this) {
   DCHECK(CalledOnValidThread());
   CHECK(BrowserThread::GetCurrentThreadIdentifier(&client_thread_id_));
-  Launch(delegate, cmd_line, child_process_id, field_trial_state);
+  Launch(delegate, cmd_line, child_process_id);
 }
 
 ChildProcessLauncher::~ChildProcessLauncher() {
   DCHECK(CalledOnValidThread());
   if (process_.IsValid() && terminate_child_on_shutdown_) {
     // On Posix, EnsureProcessTerminated can lead to 2 seconds of sleep!  So
     // don't this on the UI/IO threads.
     BrowserThread::PostTask(BrowserThread::PROCESS_LAUNCHER, FROM_HERE,
                             base::Bind(&TerminateOnLauncherThread, zygote_,
                                        base::Passed(&process_)));
   }
 }
 
 void ChildProcessLauncher::Launch(SandboxedProcessLauncherDelegate* delegate,
                                   base::CommandLine* cmd_line,
-                                  int child_process_id,
-                                  const base::SharedMemory* field_trial_state) {
+                                  int child_process_id) {
   DCHECK(CalledOnValidThread());
 
 #if defined(OS_ANDROID)
   // Android only supports renderer, sandboxed utility and gpu.
   std::string process_type =
       cmd_line->GetSwitchValueASCII(switches::kProcessType);
   CHECK(process_type == switches::kGpuProcess ||
         process_type == switches::kRendererProcess ||
 #if defined(ENABLE_PLUGINS)
         process_type == switches::kPpapiPluginProcess ||
@@ skipping 28 matching lines @@
                                            weak_factory_.GetWeakPtr(),
                                            terminate_child_on_shutdown_,
                                            base::Passed(&server_handle)));
   BrowserThread::PostTask(
       BrowserThread::PROCESS_LAUNCHER, FROM_HERE,
       base::Bind(&LaunchOnLauncherThread, reply_callback, client_thread_id_,
                  child_process_id, delegate,
 #if defined(OS_ANDROID)
                  base::Passed(&ipcfd),
 #endif
-                 field_trial_state, base::Passed(&client_handle), cmd_line));
+                 base::Passed(&client_handle), cmd_line));
 }
 
 void ChildProcessLauncher::UpdateTerminationStatus(bool known_dead) {
   DCHECK(CalledOnValidThread());
 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
   if (zygote_) {
     termination_status_ = zygote_->GetTerminationStatus(
         process_.Handle(), known_dead, &exit_code_);
   } else if (known_dead) {
     termination_status_ =
@@ skipping 124 matching lines @@
 }
 
 ChildProcessLauncher::Client* ChildProcessLauncher::ReplaceClientForTest(
     Client* client) {
   Client* ret = client_;
   client_ = client;
   return ret;
 }
 
 }  // namespace content