Add sandbox support for process memory limits

sandbox/win/src/sandbox_policy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_
 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_
 
 #include <string>
 
 #include "base/basictypes.h"
@@ skipping 104 matching lines @@
   //
   // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise.
   //
   // Note: JOB_OBJECT_XXXX constants are defined in winnt.h and documented at
   // length in:
   //   http://msdn2.microsoft.com/en-us/library/ms684152.aspx
   //
   // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN.
   virtual ResultCode SetJobLevel(JobLevel job_level, uint32 ui_exceptions) = 0;
 
+  // Sets a hard limit on the size of the commit set for the sandboxed process.
+  // If terminate is false, the allocation will fail when the limit is reached.
+  // If true, the process will terminate with SBOX_FATAL_MEMORY_EXCEEDED (7012)
+  // when the limit is reached.

[cpu_(ooo_6.6-7.5), 2014/06/06 19:44:05]

Not understanding this API. Say I have mapped a memory section of megabytes and
then at some point by touching the memory I hit the memory limit. The process is
terminated no matter what, right?

Second in the case of chrome, what does tcmalloc do if VirtualAlloc fails?

[jschuh, 2014/06/06 20:13:14]

No, it's commit charge, which is the largest amount of physical memory that
could be used if you add all disk backed memory and all physical pages in use.
So, once you map the file the whole thing counts against your commit charge.
The memory allocation function will just fail, rather than terminate the
process. However, I intentionally added the ability to terminate the process.
TCMalloc dies on OOM, but we're thinking about dumping TCMalloc for Win64,
because it looks worse than Windows LFH. Also, that doesn't account for other
things that could hit this limit without dying (e.g. creating a large bitmap
device context).

+  virtual ResultCode SetJobMemoryLimit(size_t limit, bool terminate) = 0;
+
+  // Returns whether the sandbox is set to terminate the process on hitting the
+  // memory limit imposed by the job object.
+  virtual bool WillTerminateOnJobMemoryLimit() const = 0;
+
   // Specifies the desktop on which the application is going to run. If the
   // desktop does not exist, it will be created. If alternate_winstation is
   // set to true, the desktop will be created on an alternate window station.
   virtual ResultCode SetAlternateDesktop(bool alternate_winstation) = 0;
 
   // Returns the name of the alternate desktop used. If an alternate window
   // station is specified, the name is prepended by the window station name,
   // followed by a backslash.
   virtual base::string16 GetAlternateDesktop() const = 0;
 
@@ skipping 84 matching lines @@
   // A NULL value for handle_name indicates all handles of the specified type.
   // An empty string for handle_name indicates the handle is unnamed.
   virtual ResultCode AddKernelObjectToClose(const wchar_t* handle_type,
                                             const wchar_t* handle_name) = 0;
 };
 
 }  // namespace sandbox
 
 
 #endif  // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_