1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
content / browser / child_process_launcher.h [blame]
// Copyright 2012 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CONTENT_BROWSER_CHILD_PROCESS_LAUNCHER_H_
#define CONTENT_BROWSER_CHILD_PROCESS_LAUNCHER_H_
#include <memory>
#include <optional>
#include <string>
#include "base/memory/raw_ptr.h"
#include "base/memory/ref_counted.h"
#include "base/memory/weak_ptr.h"
#include "base/process/kill.h"
#include "base/process/process.h"
#include "base/process/process_metrics.h"
#include "base/time/time.h"
#include "build/build_config.h"
#include "content/browser/child_process_launcher_helper.h"
#include "content/common/content_export.h"
#include "content/public/browser/browser_child_process_host.h"
#include "content/public/browser/browser_thread.h"
#include "content/public/browser/child_process_termination_info.h"
#include "content/public/common/result_codes.h"
#include "mojo/public/cpp/system/invitation.h"
#include "third_party/abseil-cpp/absl/types/variant.h"
#include "third_party/perfetto/include/perfetto/tracing/traced_proto.h"
#if BUILDFLAG(IS_ANDROID)
#include "content/public/browser/android/child_process_importance.h"
#endif
#if BUILDFLAG(IS_WIN)
#include "base/win/windows_types.h"
#endif
#if BUILDFLAG(IS_POSIX)
#include "base/files/scoped_file.h"
#endif
namespace base {
class CommandLine;
class UnsafeSharedMemoryRegion;
class ReadOnlySharedMemoryRegion;
#if BUILDFLAG(IS_ANDROID)
namespace android {
enum class ChildBindingState;
}
#endif
} // namespace base
namespace perfetto {
namespace protos {
namespace pbzero {
class ChildProcessLauncherPriority;
}
} // namespace protos
} // namespace perfetto
namespace content {
class SandboxedProcessLauncherDelegate;
// Note: These codes are listed in a histogram and any new codes should be added
// at the end.
enum LaunchResultCode {
// Launch start code, to not overlap with sandbox::ResultCode.
LAUNCH_RESULT_START = 1001,
// Launch success.
LAUNCH_RESULT_SUCCESS,
// Generic launch failure.
LAUNCH_RESULT_FAILURE,
// Placeholder for last item of the enum.
LAUNCH_RESULT_CODE_LAST_CODE
};
#if BUILDFLAG(IS_WIN)
static_assert(static_cast<int>(LAUNCH_RESULT_START) >
static_cast<int>(sandbox::SBOX_ERROR_LAST),
"LaunchResultCode must not overlap with sandbox::ResultCode");
#endif
struct RenderProcessPriority {
RenderProcessPriority(bool visible,
bool has_media_stream,
bool has_foreground_service_worker,
unsigned int frame_depth,
bool intersects_viewport,
bool boost_for_pending_views,
bool boost_for_loading
#if BUILDFLAG(IS_ANDROID)
,
ChildProcessImportance importance
#endif
#if !BUILDFLAG(IS_ANDROID)
,
std::optional<base::Process::Priority> priority_override
#endif
)
: visible(visible),
has_media_stream(has_media_stream),
has_foreground_service_worker(has_foreground_service_worker),
frame_depth(frame_depth),
intersects_viewport(intersects_viewport),
boost_for_pending_views(boost_for_pending_views),
boost_for_loading(boost_for_loading)
#if BUILDFLAG(IS_ANDROID)
,
importance(importance)
#endif
#if !BUILDFLAG(IS_ANDROID)
,
priority_override(priority_override)
#endif
{
}
// Returns true if the child process is backgrounded.
// DEPRECATED NOTICE: Use GetProcessPriority() instead.
bool is_background() const;
// Returns the process priority for this child process.
base::Process::Priority GetProcessPriority() const;
bool operator==(const RenderProcessPriority& other) const;
bool operator!=(const RenderProcessPriority& other) const;
using TraceProto = perfetto::protos::pbzero::ChildProcessLauncherPriority;
void WriteIntoTrace(perfetto::TracedProto<TraceProto> proto) const;
// Prefer `GetProcessPriority()` to inspecting these fields individually (to
// ensure all priority logic is consistent).
// |visible| is true if the process is responsible for one or more widget(s)
// in foreground tabs. The notion of "visible" is determined by the embedder
// but is ideally a widget in a non-minimized, non-background, non-occluded
// tab (i.e. with pixels visible on the screen).
bool visible;
// |has_media_stream| is true when the process is responsible for "hearable"
// content.
bool has_media_stream;
// |has_foreground_service_worker| is true when the process has a service
// worker that may need to service timely events from other, possibly visible,
// processes.
bool has_foreground_service_worker;
// |frame_depth| is the depth of the shallowest frame this process is
// responsible for which has |visible| visibility. It only makes sense to
// compare this property for two RenderProcessPriority instances with matching
// |visible| properties.
unsigned int frame_depth;
// |intersects_viewport| is true if this process is responsible for a frame
// which intersects a viewport which has |visible| visibility. It only makes
// sense to compare this property for two RenderProcessPriority instances
// with matching |visible| properties.
bool intersects_viewport;
// |boost_for_pending_views| is true if this process is responsible for a
// pending view (this is used to boost priority of a process responsible for
// foreground content which hasn't yet been added as a visible widget -- i.e.
// during navigation).
bool boost_for_pending_views;
// |boost_for_loading| is true if this process is responsible for committing
// navigation and initial loading.
bool boost_for_loading;
#if BUILDFLAG(IS_ANDROID)
ChildProcessImportance importance;
#endif
#if !BUILDFLAG(IS_ANDROID)
// If this is set then the built-in process priority calculation system is
// ignored, and an externally computed process priority is used.
std::optional<base::Process::Priority> priority_override;
#endif
};
// Data to pass as file descriptors.
struct ChildProcessLauncherFileData {
ChildProcessLauncherFileData();
ChildProcessLauncherFileData(const ChildProcessLauncherFileData& others) =
delete;
ChildProcessLauncherFileData& operator=(const ChildProcessLauncherFileData&) =
delete;
~ChildProcessLauncherFileData();
#if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)
// Files opened by the browser and passed as corresponding file descriptors
// in the child process. If a FilePath is provided, the file will be opened
// and the descriptor cached for future process launches. If a ScopedFD is
// provided, it will be passed to the new process and closed in the current
// one.
//
// The files will be stored in base::FileDescriptorStore in the new process,
// with the corresponding key.
//
// Currently only supported on Linux, ChromeOS and Android platforms.
// TODO(crbug.com/40253015): this currently silently fails on Android.
std::map<std::string, absl::variant<base::FilePath, base::ScopedFD>>
files_to_preload;
#endif
};
// Launches a process asynchronously and notifies the client of the process
// handle when it's available. It's used to avoid blocking the calling thread
// on the OS since often it can take > 100 ms to create the process.
class CONTENT_EXPORT ChildProcessLauncher {
public:
class CONTENT_EXPORT Client {
public:
// Will be called on the thread that the ChildProcessLauncher was
// constructed on.
virtual void OnProcessLaunched() = 0;
virtual void OnProcessLaunchFailed(int error_code) {}
#if BUILDFLAG(IS_ANDROID)
// Whether the process can use pre-warmed up connection.
virtual bool CanUseWarmUpConnection();
#endif
protected:
virtual ~Client() {}
};
// Launches the process asynchronously, calling the client when the result is
// ready. Deleting this object before the process is created is safe, since
// the callback won't be called. If the process is still running by the time
// this object destructs, it will be terminated.
// Takes ownership of cmd_line.
//
// If `process_error_callback` is provided, it will be called if a Mojo error
// is encountered when processing messages from the child process. This
// callback must be safe to call from any thread.
ChildProcessLauncher(
std::unique_ptr<SandboxedProcessLauncherDelegate> delegate,
std::unique_ptr<base::CommandLine> cmd_line,
int child_process_id,
Client* client,
mojo::OutgoingInvitation mojo_invitation,
const mojo::ProcessErrorCallback& process_error_callback,
std::unique_ptr<ChildProcessLauncherFileData> file_data,
base::UnsafeSharedMemoryRegion = {},
base::ReadOnlySharedMemoryRegion = {},
bool terminate_on_shutdown = true);
ChildProcessLauncher(const ChildProcessLauncher&) = delete;
ChildProcessLauncher& operator=(const ChildProcessLauncher&) = delete;
~ChildProcessLauncher();
// True if the process is being launched and so the handle isn't available.
bool IsStarting();
// Getter for the process. Only call after the process has started.
const base::Process& GetProcess() const;
// Call this when the child process exits to know what happened to it.
// |known_dead| can be true if we already know the process is dead as it can
// help the implemention figure the proper TerminationStatus.
// On Linux, the use of |known_dead| is subtle and can be crucial if an
// accurate status is important. With |known_dead| set to false, a dead
// process could be seen as running. With |known_dead| set to true, the
// process will be killed if it was still running. See ZygoteHostImpl for
// more discussion of Linux implementation details.
ChildProcessTerminationInfo GetChildTerminationInfo(bool known_dead);
#if BUILDFLAG(IS_ANDROID)
// Changes whether the render process runs in the background or not. Only
// call this after the process has started.
void SetRenderProcessPriority(const RenderProcessPriority& priority);
#else
// Changes whether the process runs in the background or not. Only call
// this after the process has started.
void SetProcessPriority(base::Process::Priority priority);
#endif // BUILDFLAG(IS_ANDROID)
// Terminates the process associated with this ChildProcessLauncher.
// Returns true if the process was stopped, false if the process had not been
// started yet or could not be stopped.
// Note that |exit_code| is not used on Android.
bool Terminate(int exit_code);
// Similar to Terminate() but takes in a |process|.
// On Android |process| must have been started by ChildProcessLauncher for
// this method to work.
static bool TerminateProcess(const base::Process& process, int exit_code);
// Replaces the ChildProcessLauncher::Client for testing purposes. Returns the
// previous client.
Client* ReplaceClientForTest(Client* client);
#if BUILDFLAG(IS_ANDROID)
// Returns the highest binding state for the ChildProcessConnection.
base::android::ChildBindingState GetEffectiveChildBindingState();
// Dumps the stack of the child process without crashing it.
void DumpProcessStack();
#endif
private:
friend class internal::ChildProcessLauncherHelper;
// Notifies the client about the result of the operation.
void Notify(internal::ChildProcessLauncherHelper::Process process,
#if BUILDFLAG(IS_WIN)
DWORD last_error,
#endif
int error_code);
raw_ptr<Client> client_;
// The process associated with this ChildProcessLauncher. Set in Notify by
// ChildProcessLauncherHelper once the process was started.
internal::ChildProcessLauncherHelper::Process process_;
base::TimeTicks process_start_time_;
ChildProcessTerminationInfo termination_info_;
bool starting_;
// Controls whether the child process should be terminated on browser
// shutdown. Default behavior is to terminate the child.
const bool terminate_child_on_shutdown_;
// Indicates if the child process should be launched with elevated privileges.
// Can only be true on Windows.
bool should_launch_elevated_ = false;
scoped_refptr<internal::ChildProcessLauncherHelper> helper_;
base::WeakPtrFactory<ChildProcessLauncher> weak_factory_{this};
};
} // namespace content
#endif // CONTENT_BROWSER_CHILD_PROCESS_LAUNCHER_H_