Add sandbox support for process memory limits

sandbox/win/src/sandbox_policy.h

Index: sandbox/win/src/sandbox_policy.h
diff --git a/sandbox/win/src/sandbox_policy.h b/sandbox/win/src/sandbox_policy.h
index a9f124516218ae00cebb1f42cf58bd7250798234..3290630dd5c9aa78ac46f1874850f80bd9a6f4d3 100644
--- a/sandbox/win/src/sandbox_policy.h
+++ b/sandbox/win/src/sandbox_policy.h
@@ -122,6 +122,16 @@ class TargetPolicy {
   // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN.
   virtual ResultCode SetJobLevel(JobLevel job_level, uint32 ui_exceptions) = 0;
 
+  // Sets a hard limit on the size of the commit set for the sandboxed process.
+  // If terminate is false, the allocation will fail when the limit is reached.
+  // If true, the process will terminate with SBOX_FATAL_MEMORY_EXCEEDED (7012)
+  // when the limit is reached.

[cpu_(ooo_6.6-7.5), 2014/06/06 19:44:05]

Not understanding this API. Say I have mapped a memory section of megabytes and
then at some point by touching the memory I hit the memory limit. The process is
terminated no matter what, right?

Second in the case of chrome, what does tcmalloc do if VirtualAlloc fails?

[jschuh, 2014/06/06 20:13:14]

No, it's commit charge, which is the largest amount of physical memory that
could be used if you add all disk backed memory and all physical pages in use.
So, once you map the file the whole thing counts against your commit charge.
The memory allocation function will just fail, rather than terminate the
process. However, I intentionally added the ability to terminate the process.
TCMalloc dies on OOM, but we're thinking about dumping TCMalloc for Win64,
because it looks worse than Windows LFH. Also, that doesn't account for other
things that could hit this limit without dying (e.g. creating a large bitmap
device context).

+  virtual ResultCode SetJobMemoryLimit(size_t limit, bool terminate) = 0;
+
+  // Returns whether the sandbox is set to terminate the process on hitting the
+  // memory limit imposed by the job object.
+  virtual bool WillTerminateOnJobMemoryLimit() const = 0;
+
   // Specifies the desktop on which the application is going to run. If the
   // desktop does not exist, it will be created. If alternate_winstation is
   // set to true, the desktop will be created on an alternate window station.